@githolon/dsl 0.103.9 → 0.103.10

package/dart/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 0.64.10
+
+- Single-flight each generated child open on the process-wide kernel plane, reuse resident sibling custody
+  for foreign reads, and restore every generated child from framework-owned local custody before consulting
+  cloud transport. Typed kernel refusals and the offer gate remain the only authority path.
+
+## 0.64.9
+
+- Cache the installed structural law interface across generated domain binding, eliminating repeated
+  full-interface kernel reads while retaining governed invalidation on replay and law changes.
+
 ## 0.64.8
 
 - Deduplicate structurally identical workspace and application status snapshots while still seeding every

package/dart/lib/src/runner/node-entry.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // <define:__NOMOS_KERNEL_RELEASE__>
-var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "b40b537a66fe971c86ace3e0f8f2c1ff4087bdb0f7e50d2c9e5d5798633f41a6", version: "kernel-b40b537a", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 }, testMint: { hash: "fd8eeca068dabc11c84825a181062df5958fb9322c945e623753494f760fdc37", version: "kernel-fd8eeca0", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 } };
+var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "d512065a204a4b5ac59dd8dfc262d98e49d9e47823582a6123351f4668c68c8b", version: "kernel-d512065a", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 }, testMint: { hash: "1c66f90d98e71f451b5d3505bba09b66694a22674845e2fd499468854c1a0aae", version: "kernel-1c66f90d", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 } };
 
 // runner/node-entry.ts
 import { createInterface } from "node:readline";
@@ -427,7 +427,15 @@ function createWebviewRunner({ post: post2, openRealm: openRealm2 }) {
     async refreshCredentials(a) {
       const rec = pickSession(a);
       const holon = await liveHolon(rec);
-      if (typeof holon.refreshAuthToken !== "function") throw new Error("connected holon cannot refresh identity proof in place");
+      if (typeof holon.refreshCredentials === "function") {
+        const result2 = holon.refreshCredentials({
+          ...a.authToken !== void 0 ? { authToken: String(a.authToken) } : {},
+          ...a.authorSecret !== void 0 ? { authorSecret: String(a.authorSecret) } : {}
+        });
+        if (rec.autoStop?.trigger) rec.autoStop.trigger("credential-refresh");
+        return result2;
+      }
+      if (typeof holon.refreshAuthToken !== "function") throw new Error("connected holon cannot refresh credentials in place");
       const result = holon.refreshAuthToken(String(a.authToken ?? ""));
       if (rec.autoStop?.trigger) rec.autoStop.trigger("credential-refresh");
       return result;
@@ -6811,7 +6819,7 @@ function providerOperation(mode, rawFields, workBytes) {
   else throw new Error(`no typed protobuf operation for provider call '${mode}'`);
   return { case: "custody", value: create(CustodyRequestSchema, { operation: custody }) };
 }
-function nmsInternalReportProviderTransport(host, encoded, phases, responseBytes) {
+function nmsInternalReportProviderTransport(host, encoded, phases, responseBytes, context = {}) {
   const rounded = Object.fromEntries(Object.entries({ encode: encoded.encodeMs, ...phases }).map(([key, value]) => [key, Math.round(value * 1e3) / 1e3]));
   const totalMs = Object.values(rounded).reduce((sum, value) => sum + value, 0);
   const debug2 = globalThis.__NOMOS_PROFILE_TRANSPORT__ === true || globalThis.process?.env?.NOMOS_PROFILE_TRANSPORT === "1";
@@ -6819,10 +6827,13 @@ function nmsInternalReportProviderTransport(host, encoded, phases, responseBytes
   console.warn(`[nomos-transport-perf] ${JSON.stringify({
     host,
     mode: encoded.mode,
+    detail: encoded.detail,
+    requestId: encoded.requestId,
     totalMs: Math.round(totalMs * 1e3) / 1e3,
     phases: rounded,
     requestBytes: encoded.bytes.length,
-    responseBytes
+    responseBytes,
+    ...context
   })}`);
 }
 function nmsInternalEncodeProviderCall(mode, fields, workBytes, requestPrefix = "browser") {
@@ -6839,7 +6850,9 @@ function nmsInternalEncodeTypedProviderCall(operation, requestPrefix = "browser"
     requestId,
     operation
   }));
-  return { requestId, mode: operation.case || "empty", bytes, encodeMs: monotonicMs() - started };
+  const query = operation.case === "query" ? operation.value.query : void 0;
+  const detail = query?.case === "named" ? `query:named:${String(query.value.operation)}` : query?.case ? `query:${query.case}` : operation.case || "empty";
+  return { requestId, mode: operation.case || "empty", detail, bytes, encodeMs: monotonicMs() - started };
 }
 function nmsInternalDecodeProviderResponse(bytes, requestId, stderr = []) {
   const response = fromBinary(CallResponseSchema, bytes);
@@ -6900,7 +6913,8 @@ function nmsInternalDecodeProviderResponse(bytes, requestId, stderr = []) {
               verdictDecodeUs: Number(result.value.spans.verdictDecodeUs),
               promoteAndCleanupRefsUs: Number(result.value.spans.promoteAndCleanupRefsUs),
               frontierRebuildUs: Number(result.value.spans.frontierRebuildUs),
-              frontierStoreUs: Number(result.value.spans.frontierStoreUs)
+              frontierStoreUs: Number(result.value.spans.frontierStoreUs),
+              verification: result.value.spans.verification ? jsVerifyChainDiagnostics(result.value.spans.verification) : void 0
             } : void 0
           });
         case "repoStats":
@@ -6969,7 +6983,15 @@ function jsVerifyChainDiagnostics(diagnostics) {
         typedInstallVerifierUs: Number(step.phases.typedInstallVerifierUs),
         admissionUs: Number(step.phases.admissionUs),
         foldUs: Number(step.phases.foldUs)
-      } : void 0
+      } : void 0,
+      engineTimings: step.engineTimings.map((timing) => ({
+        phase: timing.phase,
+        totalUs: Number(timing.totalUs)
+      }))
+    })),
+    engineTimings: diagnostics.engineTimings.map((timing) => ({
+      phase: timing.phase,
+      totalUs: Number(timing.totalUs)
     }))
   };
 }
@@ -7017,7 +7039,7 @@ function nmsInternalParseSnapshot(bytes) {
   return { treeBytes: bytes, ckpt: null, frontier: null, cursor: null, stateRoot: null, syncedBase: null };
 }
 function nmsInternalBuildSnapshot(treeBytes, ckpt, syncedBase) {
-  const hasCheckpoint = !!(ckpt && (ckpt.blob || ckpt.frontier || ckpt.cursor && ckpt.stateRoot));
+  const hasCheckpoint = !!(ckpt && (ckpt.blob || ckpt.frontier || ckpt.cursor));
   if (!hasCheckpoint && !syncedBase) return treeBytes;
   return enc2.encode(JSON.stringify({
     v: 2,
@@ -7163,7 +7185,7 @@ function createWasmEnginePlane({ span } = {}) {
     const view = {
       /** The parsed restore checkpoint (so index.mjs can drive checkpoint_import after boot, exactly as before). */
       get restoreCheckpoint() {
-        return _ckptBlobStr || _ckptFrontierStr || _ckptCursor && _ckptStateRoot ? { blob: _ckptBlobStr, frontier: _ckptFrontierStr, cursor: _ckptCursor, stateRoot: _ckptStateRoot } : null;
+        return _ckptBlobStr || _ckptFrontierStr || _ckptCursor ? { blob: _ckptBlobStr, frontier: _ckptFrontierStr, cursor: _ckptCursor, stateRoot: _ckptStateRoot } : null;
       },
       /** The converged fork point persisted in the restoreFrom snapshot (null for old/tree-only snapshots). */
       get restoreSyncedBase() {
@@ -7337,7 +7359,7 @@ function createWasmEnginePlane({ span } = {}) {
         const treeBytes = serializeTree(wsDirNode);
         return nmsInternalBuildSnapshot(
           treeBytes,
-          ckpt && (ckpt.blob || ckpt.frontier || ckpt.cursor && ckpt.stateRoot) ? ckpt : null,
+          ckpt && (ckpt.blob || ckpt.frontier || ckpt.cursor) ? ckpt : null,
           opts.syncedBase || null
         );
       }
@@ -8605,7 +8627,7 @@ async function connectSingle({ cloud, workspace, clientId, authToken, restoreFro
   if (salvageOnly) allowUnborn = true;
   if (!cloud || !workspace) throw new Error("connect({ cloud, workspace }) required");
   const _fetch = typeof fetchImpl === "function" ? fetchImpl : globalThis.fetch;
-  const deviceSecret = authorSecret || "";
+  let deviceSecret = authorSecret || "";
   const base = cloud.replace(/\/+$/, "");
   const localOnly = /^local:\/\//i.test(base);
   const historicSnapshotConfig = historicSnapshots === false ? null : historicSnapshots && typeof historicSnapshots === "object" ? historicSnapshots : {};
@@ -8849,9 +8871,11 @@ ${String(commit).toLowerCase()}`;
   const watchStops = /* @__PURE__ */ new Set();
   let installedLawRowsCache;
   let installedLawCurrentCache;
-  const invalidateInstalledLawRows = () => {
+  let installedInterfaceCache;
+  const invalidateInstalledLawMetadata = () => {
     installedLawRowsCache = void 0;
     installedLawCurrentCache = void 0;
+    installedInterfaceCache = void 0;
   };
   let _disposed = false;
   const nudgeWatches = () => {
@@ -9196,10 +9220,13 @@ ${String(commit).toLowerCase()}`;
   const compatGuardWrite = (directiveId, force) => assertWriteShippable(compatState, directiveId, { force, workspace });
   let _lastInterfaceReadError = null;
   const installedInterfaceInner = () => {
+    if (installedInterfaceCache !== void 0) return installedInterfaceCache;
     try {
       const compact2 = JSON.parse(call("query", { queryBytes: qBytes({ op: "interfaceOffer" }) }));
       _lastInterfaceReadError = null;
-      return compact2 && typeof compact2 === "object" && !Array.isArray(compact2) && Object.keys(compact2).length ? compact2 : null;
+      const installedInterface = compact2 && typeof compact2 === "object" && !Array.isArray(compact2) && Object.keys(compact2).length ? compact2 : null;
+      installedInterfaceCache = installedInterface;
+      return installedInterface;
     } catch (error) {
       _lastInterfaceReadError = error instanceof Error ? error : new Error(String(error));
       return null;
@@ -9339,7 +9366,7 @@ ${String(commit).toLowerCase()}`;
         }
       }
     }
-    invalidateInstalledLawRows();
+    invalidateInstalledLawMetadata();
     nudgeWatches();
     return {
       upToDate: false,
@@ -9481,22 +9508,35 @@ ${String(commit).toLowerCase()}`;
     };
     return err;
   };
-  if (ckptBlobStr || ckptFrontierStr || ckptStagedFrontierFile || ckptCursor && ckptStateRoot) {
+  if (ckptBlobStr || ckptFrontierStr || ckptStagedFrontierFile || ckptCursor) {
     const _ckptSpan = span("receive", restoreFrom ? "boot: restore folded state (snapshot)" : "boot: restore checkpoint", "boot");
+    let checkpointResult = null;
     try {
-      call("checkpoint_import", {
+      checkpointResult = JSON.parse(call("checkpoint_import", {
         ...ckptBlobStr ? { blob: ckptBlobStr } : {},
         ...ckptFrontierStr ? { frontier: ckptFrontierStr } : {},
         ...ckptStagedFrontierFile ? { stagedFrontierFile: ckptStagedFrontierFile } : {},
         ...ckptCursor ? { cursor: ckptCursor } : {},
-        ...ckptStateRoot ? { stateRoot: ckptStateRoot } : {}
-      });
+        ...ckptStateRoot ? { stateRoot: ckptStateRoot } : {},
+        // Cold-open latency is a public runtime property. Ask the kernel for
+        // its bounded phase table so tenant tooling can distinguish custody,
+        // schema, SQLite hydration and policy-cache work without profiling the
+        // opaque host bridge or weakening the kernel boundary.
+        spans: true
+      }));
     } catch (error) {
       if (typeof process !== "undefined" && process.env?.NOMOS_DEBUG_RAW) {
         console.error("[nomos] checkpoint restore refused", error);
       }
     }
-    _ckptSpan.end();
+    _ckptSpan.end(checkpointResult ? {
+      restored: checkpointResult.restored,
+      reason: checkpointResult.reason,
+      aggregates: checkpointResult.aggregates,
+      readOnly: checkpointResult.readOnly,
+      lazyReadIndex: checkpointResult.lazyReadIndex,
+      kernelSpans: checkpointResult.kernelSpans
+    } : {});
   }
   const remoteUnavailableAtConnect = (cause) => {
     const msg = String(cause?.message || cause);
@@ -9972,7 +10012,7 @@ ${String(commit).toLowerCase()}`;
         affected = Array.isArray(res.affected) ? res.affected : [];
       }
       if ((domain === "nomos" || domain === "bootstrap") && ["installDomain", "stageDomain", "promoteDomain", "rollbackDomain"].includes(directiveId)) {
-        invalidateInstalledLawRows();
+        invalidateInstalledLawMetadata();
       }
       scheduleMaintenanceSoon();
       nudgeWatchesSoon();
@@ -12617,6 +12657,29 @@ ${String(commit).toLowerCase()}`;
       authHeaders = packAuthHeaders({ authToken: activeAuthToken, principal: connectionPrincipal });
       return { refreshed: true };
     },
+    /** Refresh the client-held identity proof and/or default signing key without disposing, remounting or
+     * refolding this resident holon. The kernel remains the authority: changing the client key grants
+     * nothing; the next offer still has to prove that key is enrolled under the workspace law. */
+    refreshCredentials: ({ authToken: token, authorSecret: secret } = {}) => {
+      if (token !== void 0) {
+        const next = typeof token === "string" ? token.trim() : "";
+        if (next) {
+          const subjectClaim = jwtClaim(next, "sub");
+          const nextSubject = canonicalPrincipal(
+            typeof subjectClaim === "string" ? subjectClaim : ""
+          );
+          if (!nextSubject || nextSubject !== connectionPrincipal) {
+            throw new Error("credential refresh changed the signed-in identity; reopen the application explicitly");
+          }
+        }
+        activeAuthToken = next;
+        authHeaders = packAuthHeaders({ authToken: activeAuthToken, principal: connectionPrincipal });
+      }
+      if (secret !== void 0) {
+        deviceSecret = typeof secret === "string" ? secret.trim() : "";
+      }
+      return { refreshed: true };
+    },
     /**
      * THE ONE ENCODER as the public offer entrypoint. A generated client (TS or Dart-via-bridge) calls THIS
      * with the planned payload + the verified `actor` — it NEVER re-encodes the v2 envelope itself. The bytes

package/dart/lib/src/runner/offline-install.mjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // <define:__NOMOS_KERNEL_RELEASE__>
-var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "b40b537a66fe971c86ace3e0f8f2c1ff4087bdb0f7e50d2c9e5d5798633f41a6", version: "kernel-b40b537a", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 }, testMint: { hash: "fd8eeca068dabc11c84825a181062df5958fb9322c945e623753494f760fdc37", version: "kernel-fd8eeca0", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 } };
+var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "d512065a204a4b5ac59dd8dfc262d98e49d9e47823582a6123351f4668c68c8b", version: "kernel-d512065a", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 }, testMint: { hash: "1c66f90d98e71f451b5d3505bba09b66694a22674845e2fd499468854c1a0aae", version: "kernel-1c66f90d", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 } };
 
 // runner/offline-install.ts
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync } from "node:fs";
@@ -8817,7 +8817,7 @@ async function countRemoteCommits(eng2, ledger) {
     }
   }
 }
-var projectionStats = (eng2, ws) => namedQueryProto(eng2, ws || "root", QueryOperation.PROJECTION_STATS);
+var projectionStats = (eng2, ws = "root", options = {}) => namedQueryProto(eng2, ws || "root", QueryOperation.PROJECTION_STATS, options.deep ? { deep: true } : {});
 var memoryDropProbe = (eng2, ws) => namedQueryProto(eng2, ws, QueryOperation.MEMORY_DROP_PROBE);
 var readiness = (eng2, ws) => namedQueryProto(eng2, ws, QueryOperation.READINESS);
 function warmEngine(eng2, opts = {}) {

package/dart/lib/src/webview_bridge.dart

@@ -1176,6 +1176,15 @@ class NomosSessionCredentials {
   });
 }
 
+/// Framework-owned local custody lookup for generated child workspaces.
+///
+/// The callback returns an opaque snapshot string. The bridge never interprets
+/// it; the kernel authenticates and restores it through the ordinary connect
+/// path. Keeping this hook on the process-wide bridge lets every generated
+/// child share the root scope's persistence lifecycle without giving tenant
+/// code another repository or workspace-opening API.
+typedef NomosLocalCustodyLoader = Future<String?> Function(String workspace);
+
 final class _NomosRetainedCloudAccess {
   final String cloud;
   final Future<String?> Function() signIn;
@@ -1258,6 +1267,7 @@ class NomosBridge {
   // without asking tenant code for cloud URLs, tokens, sessions or signing keys. Kept per source
   // session so one local plane may safely host applications from different clouds/identities.
   final Map<String, _NomosRetainedCloudAccess> _sessionCloudAccess = {};
+  NomosLocalCustodyLoader? _localCustodyLoader;
   // One model-decision policy follows the generated application through its
   // child sessions. The callback receives only the typed review object; child
   // addresses, archives, credentials and lifecycle directives remain private.
@@ -2353,6 +2363,27 @@ class NomosBridge {
           }
           return ready(session(workspace));
         }
+        String? restoreFrom;
+        final loadLocalCustody = plane._localCustodyLoader;
+        if (loadLocalCustody != null) {
+          try {
+            restoreFrom = await loadLocalCustody(workspace);
+          } catch (_) {
+            // A cache-store failure is absence, never authority. The ordinary
+            // cloud open below remains the correctness path.
+            restoreFrom = null;
+          }
+        }
+        if (ifAbsentCredentials == null && restoreFrom != null) {
+          await connect(
+            workspace: workspace,
+            session: workspace,
+            authorSecret: authorSecret,
+            restoreFrom: restoreFrom,
+            allowUnborn: true,
+          );
+          return ready(session(workspace));
+        }
         if (ifAbsentCredentials == null) {
           throw StateError(
               'acquireSession("$workspace"): the workspace is not on this device\'s plane and no '
@@ -2366,6 +2397,7 @@ class NomosBridge {
           clientId: c.clientId,
           authToken: c.authToken,
           authorSecret: c.authorSecret ?? authorSecret,
+          restoreFrom: restoreFrom,
           allowUnborn: c.allowUnborn,
         );
         return ready(session(workspace));
@@ -2376,6 +2408,16 @@ class NomosBridge {
     });
   }
 
+  /// @internal Attach the generated application's opaque local-custody store
+  /// to this process-wide plane. Child opens consult it before cloning from
+  /// cloud; the kernel remains the only component that can authenticate or
+  /// interpret the returned bytes.
+  void nomosInternalRetainLocalCustodyLoader(
+    NomosLocalCustodyLoader loader,
+  ) {
+    _eventPlane._localCustodyLoader = loader;
+  }
+
   /// Reserve a KERNEL-MINTED typed id (`<TypeTag>_<uuidv7>`) via the holon's front-door mint — for app-side
   /// references (routing keys, optimistic UI). `.creates` payloads still carry NO id: the LAW mints those
   /// (see [offerCreates], which returns them).
@@ -2383,6 +2425,29 @@ class NomosBridge {
       (_asMap(await _call('mintId', {'typeTag': typeTag}))['id'] ?? '')
           .toString();
 
+  /// Refresh client-held credentials on this already-open workspace without
+  /// replacing its resident holon or refolding custody. This grants no
+  /// authority: every offer is still judged by the kernel's author gate.
+  Future<void> refreshCredentials(
+      {String? authToken, String? authorSecret}) async {
+    if (authToken == null && authorSecret == null) return;
+    await _call('refreshCredentials', {
+      if (authToken != null) 'authToken': authToken,
+      if (authorSecret != null) 'authorSecret': authorSecret,
+    });
+    // The resident holon and the plane's future-child template advance
+    // together. Otherwise home signs correctly after first-device enrolment
+    // while a later catalogue/estate opens with the old empty default key.
+    final session = _sessionName;
+    if (session != null && authorSecret != null) {
+      if (authorSecret.isEmpty) {
+        _eventPlane._sessionAuthorSecrets.remove(session);
+      } else {
+        _eventPlane._sessionAuthorSecrets[session] = authorSecret;
+      }
+    }
+  }
+
   /// @internal The immutable genesis of a sibling custody chain. This is observational metadata used to
   /// compose an ordinary source-enrolment offer; the kernel still reopens and proves every foreign read.
   Future<String> nomosWorkspaceGenesis(String workspace,

package/dart/pubspec.yaml

@@ -7,7 +7,7 @@ repository: https://github.com/Captain-App/nomos2
 description: >-
   Nomos 2 Dart client — generated domain values, intent payloads and application
   lifecycle types over the typed Nomos kernel protocol and USDA custody model.
-version: 0.64.8
+version: 0.64.10
 
 environment:
   sdk: ^3.5.0

package/dart/test/acquire_session_test.dart

@@ -167,6 +167,54 @@ void main() {
     await bridge.dispose();
   });
 
+  test(
+      'an absent generated child restores opaque local custody before cloud convergence',
+      () async {
+    final runner = FakeRunner();
+    final bridge = NomosBridge(runner);
+    await bridge.ready;
+    var loads = 0;
+    bridge.nomosInternalRetainLocalCustodyLoader((workspace) async {
+      loads++;
+      expect(workspace, 'catalogue');
+      return 'opaque-kernel-snapshot';
+    });
+
+    final child = await bridge.acquireSession(
+      'catalogue',
+      ifAbsentCredentials: () async => const NomosSessionCredentials(
+        cloud: 'https://cloud.example',
+        authToken: 'token',
+      ),
+    );
+
+    expect(child.workspace, 'catalogue');
+    expect(loads, 1);
+    expect(runner.connectCount, 1);
+    expect(runner.connectArgs(0)['restoreFrom'], 'opaque-kernel-snapshot');
+    expect(runner.connectArgs(0)['cloud'], 'https://cloud.example');
+    await bridge.dispose();
+  });
+
+  test('opaque local custody can open without inventing cloud authority',
+      () async {
+    final runner = FakeRunner();
+    final bridge = NomosBridge(runner);
+    await bridge.ready;
+    bridge.nomosInternalRetainLocalCustodyLoader(
+      (_) async => 'opaque-kernel-snapshot',
+    );
+
+    final child = await bridge.acquireSession('offline-child');
+
+    expect(child.workspace, 'offline-child');
+    expect(runner.connectCount, 1);
+    final args = runner.connectArgs(0);
+    expect(args['restoreFrom'], 'opaque-kernel-snapshot');
+    expect(args.containsKey('cloud'), isFalse);
+    await bridge.dispose();
+  });
+
   test(
       'a NomosSession delegates acquireSession to the parent plane (one registry)',
       () async {
@@ -199,6 +247,31 @@ void main() {
     await bridge.dispose();
   });
 
+  test('an in-place signing-key refresh is inherited by later sibling opens',
+      () async {
+    final runner = FakeRunner(resident: ['catalogue', 'estate']);
+    final bridge = NomosBridge(runner);
+    await bridge.ready;
+    await bridge.connect(workspace: 'home', session: 'home');
+
+    await bridge
+        .session('home')
+        .refreshCredentials(authorSecret: 'newly-enrolled-device-key');
+    await bridge.session('home').acquireSession('catalogue');
+
+    expect(runner.connectCount, 2);
+    expect(runner.connectArgs(1)['authorSecret'], 'newly-enrolled-device-key',
+        reason:
+            'refreshing the resident holon must also advance the plane credential inherited by siblings');
+
+    await bridge.session('home').refreshCredentials(authorSecret: '');
+    await bridge.session('home').acquireSession('estate');
+    expect(runner.connectArgs(2).containsKey('authorSecret'), isFalse,
+        reason:
+            'clearing a resident signing key must not leak it into later sibling opens');
+    await bridge.dispose();
+  });
+
   test(
       'generated child inherits typed model decisions and stages opaque USDZ privately',
       () async {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.103.9",
+  "version": "0.103.10",
   "type": "module",
   "sideEffects": false,
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",

package/runtime/generated-application-host.js

@@ -5870,7 +5870,7 @@ function providerOperation(mode, rawFields, workBytes) {
   else throw new Error(`no typed protobuf operation for provider call '${mode}'`);
   return { case: "custody", value: create(CustodyRequestSchema, { operation: custody }) };
 }
-function nmsInternalReportProviderTransport(host, encoded, phases, responseBytes) {
+function nmsInternalReportProviderTransport(host, encoded, phases, responseBytes, context = {}) {
   const rounded = Object.fromEntries(Object.entries({ encode: encoded.encodeMs, ...phases }).map(([key, value]) => [key, Math.round(value * 1e3) / 1e3]));
   const totalMs = Object.values(rounded).reduce((sum, value) => sum + value, 0);
   const debug2 = globalThis.__NOMOS_PROFILE_TRANSPORT__ === true || globalThis.process?.env?.NOMOS_PROFILE_TRANSPORT === "1";
@@ -5878,10 +5878,13 @@ function nmsInternalReportProviderTransport(host, encoded, phases, responseBytes
   console.warn(`[nomos-transport-perf] ${JSON.stringify({
     host,
     mode: encoded.mode,
+    detail: encoded.detail,
+    requestId: encoded.requestId,
     totalMs: Math.round(totalMs * 1e3) / 1e3,
     phases: rounded,
     requestBytes: encoded.bytes.length,
-    responseBytes
+    responseBytes,
+    ...context
   })}`);
 }
 function nmsInternalEncodeProviderCall(mode, fields, workBytes, requestPrefix = "browser") {
@@ -5898,7 +5901,9 @@ function nmsInternalEncodeTypedProviderCall(operation, requestPrefix = "browser"
     requestId,
     operation
   }));
-  return { requestId, mode: operation.case || "empty", bytes, encodeMs: monotonicMs() - started };
+  const query = operation.case === "query" ? operation.value.query : void 0;
+  const detail = query?.case === "named" ? `query:named:${String(query.value.operation)}` : query?.case ? `query:${query.case}` : operation.case || "empty";
+  return { requestId, mode: operation.case || "empty", detail, bytes, encodeMs: monotonicMs() - started };
 }
 function nmsInternalDecodeProviderResponse(bytes, requestId, stderr = []) {
   const response = fromBinary(CallResponseSchema, bytes);
@@ -5959,7 +5964,8 @@ function nmsInternalDecodeProviderResponse(bytes, requestId, stderr = []) {
               verdictDecodeUs: Number(result.value.spans.verdictDecodeUs),
               promoteAndCleanupRefsUs: Number(result.value.spans.promoteAndCleanupRefsUs),
               frontierRebuildUs: Number(result.value.spans.frontierRebuildUs),
-              frontierStoreUs: Number(result.value.spans.frontierStoreUs)
+              frontierStoreUs: Number(result.value.spans.frontierStoreUs),
+              verification: result.value.spans.verification ? jsVerifyChainDiagnostics(result.value.spans.verification) : void 0
             } : void 0
           });
         case "repoStats":
@@ -6028,7 +6034,15 @@ function jsVerifyChainDiagnostics(diagnostics) {
         typedInstallVerifierUs: Number(step.phases.typedInstallVerifierUs),
         admissionUs: Number(step.phases.admissionUs),
         foldUs: Number(step.phases.foldUs)
-      } : void 0
+      } : void 0,
+      engineTimings: step.engineTimings.map((timing) => ({
+        phase: timing.phase,
+        totalUs: Number(timing.totalUs)
+      }))
+    })),
+    engineTimings: diagnostics.engineTimings.map((timing) => ({
+      phase: timing.phase,
+      totalUs: Number(timing.totalUs)
     }))
   };
 }
@@ -6076,7 +6090,7 @@ function nmsInternalParseSnapshot(bytes) {
   return { treeBytes: bytes, ckpt: null, frontier: null, cursor: null, stateRoot: null, syncedBase: null };
 }
 function nmsInternalBuildSnapshot(treeBytes, ckpt, syncedBase) {
-  const hasCheckpoint = !!(ckpt && (ckpt.blob || ckpt.frontier || ckpt.cursor && ckpt.stateRoot));
+  const hasCheckpoint = !!(ckpt && (ckpt.blob || ckpt.frontier || ckpt.cursor));
   if (!hasCheckpoint && !syncedBase) return treeBytes;
   return enc2.encode(JSON.stringify({
     v: 2,
@@ -6222,7 +6236,7 @@ function createWasmEnginePlane({ span } = {}) {
     const view = {
       /** The parsed restore checkpoint (so index.mjs can drive checkpoint_import after boot, exactly as before). */
       get restoreCheckpoint() {
-        return _ckptBlobStr || _ckptFrontierStr || _ckptCursor && _ckptStateRoot ? { blob: _ckptBlobStr, frontier: _ckptFrontierStr, cursor: _ckptCursor, stateRoot: _ckptStateRoot } : null;
+        return _ckptBlobStr || _ckptFrontierStr || _ckptCursor ? { blob: _ckptBlobStr, frontier: _ckptFrontierStr, cursor: _ckptCursor, stateRoot: _ckptStateRoot } : null;
       },
       /** The converged fork point persisted in the restoreFrom snapshot (null for old/tree-only snapshots). */
       get restoreSyncedBase() {
@@ -6396,7 +6410,7 @@ function createWasmEnginePlane({ span } = {}) {
         const treeBytes = serializeTree(wsDirNode);
         return nmsInternalBuildSnapshot(
           treeBytes,
-          ckpt && (ckpt.blob || ckpt.frontier || ckpt.cursor && ckpt.stateRoot) ? ckpt : null,
+          ckpt && (ckpt.blob || ckpt.frontier || ckpt.cursor) ? ckpt : null,
           opts.syncedBase || null
         );
       }
@@ -7664,7 +7678,7 @@ async function connectSingle({ cloud, workspace, clientId, authToken, restoreFro
   if (salvageOnly) allowUnborn = true;
   if (!cloud || !workspace) throw new Error("connect({ cloud, workspace }) required");
   const _fetch = typeof fetchImpl === "function" ? fetchImpl : globalThis.fetch;
-  const deviceSecret = authorSecret || "";
+  let deviceSecret = authorSecret || "";
   const base = cloud.replace(/\/+$/, "");
   const localOnly = /^local:\/\//i.test(base);
   const historicSnapshotConfig = historicSnapshots === false ? null : historicSnapshots && typeof historicSnapshots === "object" ? historicSnapshots : {};
@@ -7908,9 +7922,11 @@ ${String(commit).toLowerCase()}`;
   const watchStops = /* @__PURE__ */ new Set();
   let installedLawRowsCache;
   let installedLawCurrentCache;
-  const invalidateInstalledLawRows = () => {
+  let installedInterfaceCache;
+  const invalidateInstalledLawMetadata = () => {
     installedLawRowsCache = void 0;
     installedLawCurrentCache = void 0;
+    installedInterfaceCache = void 0;
   };
   let _disposed = false;
   const nudgeWatches = () => {
@@ -8255,10 +8271,13 @@ ${String(commit).toLowerCase()}`;
   const compatGuardWrite = (directiveId, force) => assertWriteShippable(compatState, directiveId, { force, workspace });
   let _lastInterfaceReadError = null;
   const installedInterfaceInner = () => {
+    if (installedInterfaceCache !== void 0) return installedInterfaceCache;
     try {
       const compact = JSON.parse(call("query", { queryBytes: qBytes({ op: "interfaceOffer" }) }));
       _lastInterfaceReadError = null;
-      return compact && typeof compact === "object" && !Array.isArray(compact) && Object.keys(compact).length ? compact : null;
+      const installedInterface = compact && typeof compact === "object" && !Array.isArray(compact) && Object.keys(compact).length ? compact : null;
+      installedInterfaceCache = installedInterface;
+      return installedInterface;
     } catch (error) {
       _lastInterfaceReadError = error instanceof Error ? error : new Error(String(error));
       return null;
@@ -8398,7 +8417,7 @@ ${String(commit).toLowerCase()}`;
         }
       }
     }
-    invalidateInstalledLawRows();
+    invalidateInstalledLawMetadata();
     nudgeWatches();
     return {
       upToDate: false,
@@ -8540,22 +8559,35 @@ ${String(commit).toLowerCase()}`;
     };
     return err;
   };
-  if (ckptBlobStr || ckptFrontierStr || ckptStagedFrontierFile || ckptCursor && ckptStateRoot) {
+  if (ckptBlobStr || ckptFrontierStr || ckptStagedFrontierFile || ckptCursor) {
     const _ckptSpan = span("receive", restoreFrom ? "boot: restore folded state (snapshot)" : "boot: restore checkpoint", "boot");
+    let checkpointResult = null;
     try {
-      call("checkpoint_import", {
+      checkpointResult = JSON.parse(call("checkpoint_import", {
         ...ckptBlobStr ? { blob: ckptBlobStr } : {},
         ...ckptFrontierStr ? { frontier: ckptFrontierStr } : {},
         ...ckptStagedFrontierFile ? { stagedFrontierFile: ckptStagedFrontierFile } : {},
         ...ckptCursor ? { cursor: ckptCursor } : {},
-        ...ckptStateRoot ? { stateRoot: ckptStateRoot } : {}
-      });
+        ...ckptStateRoot ? { stateRoot: ckptStateRoot } : {},
+        // Cold-open latency is a public runtime property. Ask the kernel for
+        // its bounded phase table so tenant tooling can distinguish custody,
+        // schema, SQLite hydration and policy-cache work without profiling the
+        // opaque host bridge or weakening the kernel boundary.
+        spans: true
+      }));
     } catch (error) {
       if (typeof process !== "undefined" && process.env?.NOMOS_DEBUG_RAW) {
         console.error("[nomos] checkpoint restore refused", error);
       }
     }
-    _ckptSpan.end();
+    _ckptSpan.end(checkpointResult ? {
+      restored: checkpointResult.restored,
+      reason: checkpointResult.reason,
+      aggregates: checkpointResult.aggregates,
+      readOnly: checkpointResult.readOnly,
+      lazyReadIndex: checkpointResult.lazyReadIndex,
+      kernelSpans: checkpointResult.kernelSpans
+    } : {});
   }
   const remoteUnavailableAtConnect = (cause) => {
     const msg = String(cause?.message || cause);
@@ -9031,7 +9063,7 @@ ${String(commit).toLowerCase()}`;
         affected = Array.isArray(res.affected) ? res.affected : [];
       }
       if ((domain === "nomos" || domain === "bootstrap") && ["installDomain", "stageDomain", "promoteDomain", "rollbackDomain"].includes(directiveId)) {
-        invalidateInstalledLawRows();
+        invalidateInstalledLawMetadata();
       }
       scheduleMaintenanceSoon();
       nudgeWatchesSoon();
@@ -11676,6 +11708,29 @@ ${String(commit).toLowerCase()}`;
       authHeaders = packAuthHeaders({ authToken: activeAuthToken, principal: connectionPrincipal });
       return { refreshed: true };
     },
+    /** Refresh the client-held identity proof and/or default signing key without disposing, remounting or
+     * refolding this resident holon. The kernel remains the authority: changing the client key grants
+     * nothing; the next offer still has to prove that key is enrolled under the workspace law. */
+    refreshCredentials: ({ authToken: token, authorSecret: secret } = {}) => {
+      if (token !== void 0) {
+        const next = typeof token === "string" ? token.trim() : "";
+        if (next) {
+          const subjectClaim = jwtClaim(next, "sub");
+          const nextSubject = canonicalPrincipal(
+            typeof subjectClaim === "string" ? subjectClaim : ""
+          );
+          if (!nextSubject || nextSubject !== connectionPrincipal) {
+            throw new Error("credential refresh changed the signed-in identity; reopen the application explicitly");
+          }
+        }
+        activeAuthToken = next;
+        authHeaders = packAuthHeaders({ authToken: activeAuthToken, principal: connectionPrincipal });
+      }
+      if (secret !== void 0) {
+        deviceSecret = typeof secret === "string" ? secret.trim() : "";
+      }
+      return { refreshed: true };
+    },
     /**
      * THE ONE ENCODER as the public offer entrypoint. A generated client (TS or Dart-via-bridge) calls THIS
      * with the planned payload + the verified `actor` — it NEVER re-encodes the v2 envelope itself. The bytes

package/src/compile_package_main.ts

@@ -1650,8 +1650,8 @@ const NOMOS_TYPES_DEP = "^0.8.4";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.64.8";
-const NOMOS_FLUTTER_DEP = "^0.63.11";
+const NOMOS_CLIENT_DEP = "^0.64.10";
+const NOMOS_FLUTTER_DEP = "^0.63.13";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).