@githolon/dsl 0.105.13 → 0.105.15

package/dart/CHANGELOG.md

@@ -1,3 +1,16 @@
+## 0.64.31
+
+- Restage the validated intent-offer byte gate and deterministic signer-posture reader into the immutable Dart runner.
+
+## 0.64.30
+
+- Recover an authenticated generated application's replacement device through the established repeated-birth compatibility lane when guardian policy refuses keyless enrolment.
+- Resolve signer posture from the relation tuple's deterministic aggregate address so composed application law cannot make framework query aliases ambiguous.
+
+## 0.64.29
+
+- Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.
+
 ## 0.64.28
 
 - Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.

package/dart/lib/src/runner/node-entry.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // <define:__NOMOS_KERNEL_RELEASE__>
-var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "64219cdd5441cd92cb08d5200a6e65e7814364cc6d1b7cd1b014322ea4372092", version: "kernel-64219cdd", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "9ca691fd3524897b2edc236167b1b490701c85b41ad066cc41041829d42357f7", version: "kernel-9ca691fd", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
+var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "d37253bcefd90a180a6a1af96422a9f0724dfca9efd9ae7cff070afa2c410f09", version: "kernel-d37253bc", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "b6bddd8d61390edbe2ee4e5f3c7f21108bdb7800af746d20f568936f63e2d517", version: "kernel-b6bddd8d", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
 
 // runner/node-entry.ts
 import { createInterface } from "node:readline";
@@ -534,7 +534,7 @@ function createWebviewRunner({ post: post2, openRealm: openRealm2 }) {
     // FRAMEWORK-PRIVATE: generated clients say model.adopt(); the runner/client owns proof + receipt assembly.
     async adoptGeneratedModel(a) {
       const rec = pickSession(a);
-      const r = await (await liveHolon(rec)).__nomosAdoptModel(a.domain, a.candidateHash, { because: a.because, dispositions: a.dispositions });
+      const r = await (await liveHolon(rec)).__nomosAdoptModel(a.domain, a.candidateHash, { because: a.because });
       if (r && r.ok && rec.autoStop && rec.autoStop.trigger) rec.autoStop.trigger("write");
       return { verdict: r };
     },
@@ -7667,7 +7667,7 @@ function prepareManagedPromotion(report, candidateHash, domain, opts = {}) {
       domainHash: candidateHash,
       ...opts.replaces ? { replaces: opts.replaces } : {},
       retireReplaced: opts.retireReplaced ?? false,
-      ...opts.dispositions ? { dispositions: opts.dispositions } : {},
+      ...report.dispositions ? { dispositions: report.dispositions } : {},
       preflight
     }
   };
@@ -7683,7 +7683,6 @@ function prepareManagedRestoration(report, currentHash, priorHash, domain, opts
   }
   const acceptanceReason = opts.acceptanceReason?.trim();
   const prepared = prepareManagedPromotion(report, priorHash, domain, {
-    dispositions: report.dispositions,
     ...acceptanceReason ? { acceptanceReason } : {}
   });
   if (!prepared.ok) {
@@ -8153,8 +8152,8 @@ function createGovernanceOffers(ctx) {
     },
     /**
      * PARENT-AUTHORITY POSTURE (read-only diagnostic): is `identity:<principal>#signer@key:<keyHash>`
-     * a LIVE tuple on `parent`'s chain? Reads the parent's declared `relationTuplesByObject` query over
-     * the open gateway — one O(1) relation read, no authoring. Returns
+     * a LIVE tuple on `parent`'s chain? Reads the tuple's deterministic aggregate address over the
+     * generic record lane — one O(1) read, no authoring and no ambiguous query alias in composed law. Returns
      * `{ parent, principal, keyHash, object, relation, enrolled, revoked, checkedAt }`.
      * `revoked: true` means the subject's leaf was flipped `status:revoked` (remove-wins — a lawful
      * re-enroll of the SAME key is refused; mint + enroll a new device key instead).
@@ -8168,12 +8167,13 @@ function createGovernanceOffers(ctx) {
         keyHash = await sha256hexBytes2(bytesUnb642(publicKey));
       }
       const object = signerObjectOf(p);
+      const aggregateId = `reltuple-${object}-signer`;
       let rows;
       if (parent === workspace && !remote) {
-        rows = JSON.parse(call("query", { queryBytes: qBytes2({ kind: "query", queryId: "relationTuplesByObject", paramsJson: JSON.stringify({ object }) }) })) || [];
+        rows = JSON.parse(call("query", { queryBytes: qBytes2({ op: "byId", aggregateId }) })) || [];
       } else {
         const headers = authToken ? { Authorization: `Bearer ${authToken}`, "x-nomos-auth": authToken } : authHeaders;
-        const r = await _fetch(`${base}/v2/workspaces/${parent}/relationTuplesByObject?object=${encodeURIComponent(object)}`, { headers });
+        const r = await _fetch(`${base}/v2/workspaces/${parent}/aggregates/${encodeURIComponent(aggregateId)}`, { headers });
         const text = await r.text();
         let body;
         try {
@@ -8181,7 +8181,7 @@ function createGovernanceOffers(ctx) {
         } catch {
           body = text;
         }
-        if (!r.ok) throw new Error(`parentSignerEnrollment: reading ${parent}'s relationTuplesByObject failed (${r.status}): ${typeof body === "string" ? body.slice(0, 200) : JSON.stringify(body).slice(0, 200)}`);
+        if (!r.ok) throw new Error(`parentSignerEnrollment: reading ${parent}'s signer tuple failed (${r.status}): ${typeof body === "string" ? body.slice(0, 200) : JSON.stringify(body).slice(0, 200)}`);
         rows = Array.isArray(body) ? body : body && Array.isArray(body.rows) ? body.rows : [];
       }
       let enrolled = false, revoked = false, verifiedVia;
@@ -8227,7 +8227,14 @@ function createGovernanceOffers(ctx) {
         rows = JSON.parse(call("query", { queryBytes: qBytes2({ kind: "query", queryId: "relationTuplesByObject", paramsJson: JSON.stringify({ object }) }) })) || [];
       } else {
         const headers = authToken ? { Authorization: `Bearer ${authToken}`, "x-nomos-auth": authToken } : authHeaders;
-        const r = await _fetch(`${base}/v2/workspaces/${ws}/relationTuplesByObject?object=${encodeURIComponent(object)}`, { headers });
+        const route = await resolveFrameworkRoute({
+          parent: ws,
+          operationId: "relationTuplesByObject",
+          method: "get",
+          token: authToken,
+          principal: subj
+        });
+        const r = await _fetch(`${base}/v2/workspaces/${ws}${route.path}?object=${encodeURIComponent(object)}`, { headers });
         const text = await r.text();
         let body;
         try {
@@ -10234,7 +10241,7 @@ ${String(commit).toLowerCase()}`;
             domain,
             candidateHash,
             atHash,
-            ...opts.dispositions ? { dispositions: opts.dispositions } : {}
+            ackBy: connectionPrincipal
           })
         }));
       });
@@ -10247,8 +10254,7 @@ ${String(commit).toLowerCase()}`;
     }
     const prepared = prepareManagedPromotion(report, candidateHash, domain, {
       ...currentHash && currentHash !== candidateHash ? { replaces: currentHash } : {},
-      ...opts.because !== void 0 ? { acceptanceReason: opts.because } : {},
-      ...opts.dispositions ? { dispositions: opts.dispositions } : {}
+      ...opts.because !== void 0 ? { acceptanceReason: opts.because } : {}
     });
     if (!prepared.ok) return prepared;
     try {

package/dart/lib/src/runner/offline-install.mjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // <define:__NOMOS_KERNEL_RELEASE__>
-var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "64219cdd5441cd92cb08d5200a6e65e7814364cc6d1b7cd1b014322ea4372092", version: "kernel-64219cdd", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "9ca691fd3524897b2edc236167b1b490701c85b41ad066cc41041829d42357f7", version: "kernel-9ca691fd", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
+var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "d37253bcefd90a180a6a1af96422a9f0724dfca9efd9ae7cff070afa2c410f09", version: "kernel-d37253bc", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "b6bddd8d61390edbe2ee4e5f3c7f21108bdb7800af746d20f568936f63e2d517", version: "kernel-b6bddd8d", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
 
 // runner/offline-install.ts
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync } from "node:fs";
@@ -102,6 +102,8 @@ async function refreshRuntimeDir(cloud, dir, { fetchImpl = globalThis.fetch, log
 // src/_adapter/engine.ts
 var engine_exports = {};
 __export(engine_exports, {
+  MAX_INLINE_INTENT_OFFER_BYTES: () => MAX_INLINE_INTENT_OFFER_BYTES,
+  MAX_STAGED_INTENT_OFFER_BYTES: () => MAX_STAGED_INTENT_OFFER_BYTES,
   NOMOS_SHARD_ROWS_READ: () => NOMOS_SHARD_ROWS_READ,
   admitAll: () => admitAll,
   admitIntentOffers: () => admitIntentOffers,
@@ -164,6 +166,7 @@ __export(engine_exports, {
   ingestPackAsCustody: () => ingestPackAsCustody,
   installedLaw: () => installedLaw,
   intentOfferResidencies: () => intentOfferResidencies,
+  intentOfferSizeRefusal: () => intentOfferSizeRefusal,
   isDirty: () => isDirty,
   isWarranted: () => isWarranted,
   kernelStamp: () => kernelStamp,
@@ -2009,7 +2012,7 @@ function prepareManagedPromotion(report, candidateHash, domain, opts = {}) {
       domainHash: candidateHash,
       ...opts.replaces ? { replaces: opts.replaces } : {},
       retireReplaced: opts.retireReplaced ?? false,
-      ...opts.dispositions ? { dispositions: opts.dispositions } : {},
+      ...report.dispositions ? { dispositions: report.dispositions } : {},
       preflight
     }
   };
@@ -2025,7 +2028,6 @@ function prepareManagedRestoration(report, currentHash, priorHash, domain, opts
   }
   const acceptanceReason = opts.acceptanceReason?.trim();
   const prepared = prepareManagedPromotion(report, priorHash, domain, {
-    dispositions: report.dispositions,
     ...acceptanceReason ? { acceptanceReason } : {}
   });
   if (!prepared.ok) {
@@ -6782,6 +6784,12 @@ async function replicateIntents(eng2, ws, ledger, intents, { push = true } = {})
   log("replicate-globals", { ws, replicated: replicated.length, skipped: skipped.length, refused: refused.length });
   return { replicated, skipped, refused };
 }
+var MAX_INLINE_INTENT_OFFER_BYTES = 32 * 1024 * 1024;
+var MAX_STAGED_INTENT_OFFER_BYTES = 64 * 1024 * 1024;
+function intentOfferSizeRefusal(staged, byteLength) {
+  const maxOfferBytes = staged ? MAX_STAGED_INTENT_OFFER_BYTES : MAX_INLINE_INTENT_OFFER_BYTES;
+  return byteLength <= 0 || byteLength > maxOfferBytes ? `intent offer must carry changeB64 <= ${maxOfferBytes / (1024 * 1024)} MiB` : null;
+}
 async function admitIntentOffers(eng2, ws, ledger, offers, { receiptFence = null, shardRouting = null, clientBase = null } = {}) {
   const main = await mainIntentIds(eng2, ws);
   const sessions = /* @__PURE__ */ new Map();
@@ -6853,9 +6861,16 @@ async function admitIntentOffers(eng2, ws, ledger, offers, { receiptFence = null
     let blob = offer?.blob instanceof Uint8Array ? offer.blob : null;
     try {
       if (!blob && typeof offer?.changeB64 === "string") blob = Uint8Array.from(atob(offer.changeB64), (c) => c.charCodeAt(0));
-      const maxOfferBytes = offer?.staged ? 64 * 1024 * 1024 : 32 * 1024 * 1024;
-      if (!blob || blob.byteLength === 0 || blob.byteLength > maxOfferBytes) {
-        rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: `intent offer must carry changeB64 <= ${maxOfferBytes / (1024 * 1024)} MiB` });
+      if (!blob) {
+        rec.rejected.push({
+          oid: String(offer?.oid || "").slice(0, 10),
+          error: intentOfferSizeRefusal(!!offer?.staged, 0)
+        });
+        continue;
+      }
+      const sizeRefusal = intentOfferSizeRefusal(!!offer?.staged, blob.byteLength);
+      if (sizeRefusal !== null) {
+        rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: sizeRefusal });
         continue;
       }
       const inspected = kgit.inspectChange(eng2, blob);
@@ -7115,7 +7130,7 @@ async function mountWorkspace(eng2, ws, ledger) {
         throw new Error(`kernel refused restored main ${remoteMain}: ${JSON.stringify(mounted)}`);
       }
       restored = true;
-      if (!seeded?.seeded) {
+      if (!seeded?.seeded && ledger.readOnly !== true) {
         void pushCheckpoint(eng2, ws, ledger).catch(() => {
         });
       }
@@ -8580,12 +8595,12 @@ async function verifyChain(eng2, ws, ledger) {
 function verifyChainLocal(eng2, ws) {
   return namedQueryProto(eng2, ws, QueryOperation.VERIFY_CHAIN);
 }
-function historyPreflight(eng2, ws, domain, candidateHash, atHash, dispositions) {
+function historyPreflight(eng2, ws, domain, candidateHash, atHash, actor = "") {
   return namedQueryProto(eng2, ws, QueryOperation.HISTORY_PREFLIGHT, {
     domain,
     candidateHash,
     atHash,
-    ...dispositions ? { dispositions } : {}
+    ...actor.trim() ? { ackBy: actor.trim() } : {}
   });
 }
 function historyRestorePreflight(eng2, ws, domain, currentHash, priorHash, atHash, actor) {
@@ -8612,7 +8627,7 @@ function promotePreflighted(eng2, ws, domain, candidateHash, opts = {}) {
   }
   let report;
   try {
-    report = historyPreflight(eng2, ws, domain, candidateHash, atHash, opts.dispositions);
+    report = historyPreflight(eng2, ws, domain, candidateHash, atHash, actingPrincipal);
   } catch (error) {
     return { ok: false, stage: "preflight", error: String(error?.message || error) };
   }
@@ -8621,7 +8636,6 @@ function promotePreflighted(eng2, ws, domain, candidateHash, opts = {}) {
   const {
     replaces: _replaces,
     retireReplaced: _retireReplaced,
-    dispositions: _dispositions,
     acceptanceReason: _acceptance,
     ...authorOpts
   } = opts;

package/dart/lib/src/session_bound.dart

@@ -191,7 +191,7 @@ class DomainClientModelAdoptionRequired implements Exception {
   final String summary;
   final DomainModelReview review;
   final Future<void> Function()? _stage;
-  final Future<void> Function(String reason, {Map<String, Object?>? dispositions})? _accept;
+  final Future<void> Function(String reason)? _accept;
 
   const DomainClientModelAdoptionRequired({
     required this.expectedDomainKey,
@@ -200,7 +200,7 @@ class DomainClientModelAdoptionRequired implements Exception {
     required this.summary,
     required this.review,
     Future<void> Function()? stage,
-    Future<void> Function(String reason, {Map<String, Object?>? dispositions})? accept,
+    Future<void> Function(String reason)? accept,
   })  : _stage = stage,
         _accept = accept;
 
@@ -216,10 +216,10 @@ class DomainClientModelAdoptionRequired implements Exception {
 
   bool get canAccept => _accept != null;
 
-  /// [dispositions] carries only sids the kernel's OWN exact-history proof
-  /// named as truly removed (`{"retired": [sid, ...]}`) — never authored from
-  /// memory; a wrong disposition is a silent data-model error, not a waiver.
-  Future<void> accept(String reason, {Map<String, Object?>? dispositions}) {
+  /// Accept the candidate after reviewing the compiler-derived consequences.
+  /// Stable identities, retirements and value evolutions come from candidate
+  /// law; application code supplies accountability, never mechanical waivers.
+  Future<void> accept(String reason) {
     final value = reason.trim();
     if (value.isEmpty) {
       throw ArgumentError.value(
@@ -232,7 +232,7 @@ class DomainClientModelAdoptionRequired implements Exception {
     if (accept == null) {
       throw StateError('This generated model change cannot be accepted.');
     }
-    return accept(value, dispositions: dispositions);
+    return accept(value);
   }
 
   @override

package/dart/lib/src/webview_bridge.dart

@@ -2761,13 +2761,11 @@ class NomosBridge {
     required String domain,
     required String candidateHash,
     String? because,
-    Map<String, Object?>? dispositions,
   }) async {
     final r = _asMap(await _call('adoptGeneratedModel', {
       'domain': domain,
       'candidateHash': candidateHash,
       if (because != null) 'because': because,
-      if (dispositions != null) 'dispositions': dispositions,
     }));
     return ((r['verdict'] as Map?) ?? const <String, Object?>{})
         .cast<String, Object?>();
@@ -4057,7 +4055,8 @@ class NomosBridge {
     if (!_syncEvents.isClosed) await _syncEvents.close();
     if (!_signalEvents.isClosed) await _signalEvents.close();
     if (!_custodyEvents.isClosed) await _custodyEvents.close();
-    if (!_localWorkRejectedEvents.isClosed) await _localWorkRejectedEvents.close();
+    if (!_localWorkRejectedEvents.isClosed)
+      await _localWorkRejectedEvents.close();
     if (!_flameEvents.isClosed) await _flameEvents.close();
     if (!_spanEvents.isClosed) await _spanEvents.close();
     if (!_transferEvents.isClosed) await _transferEvents.close();
@@ -4382,8 +4381,8 @@ class _BridgeForeignWorkspaceReader implements NomosForeignWorkspaceReader {
 String? nomosInternalResidencyRequiredWorkspace(Object error) {
   final text = error.toString();
   if (!text.contains('foreign-read-not-ready')) return null;
-  final match = RegExp(r"source workspace '([^']+)' is not resident")
-      .firstMatch(text);
+  final match =
+      RegExp(r"source workspace '([^']+)' is not resident").firstMatch(text);
   final workspace = match?.group(1)?.trim();
   return (workspace == null || workspace.isEmpty) ? null : workspace;
 }

package/dart/pubspec.yaml

@@ -7,7 +7,7 @@ repository: https://github.com/Captain-App/nomos2
 description: >-
   Nomos 2 Dart client — generated domain values, intent payloads and application
   lifecycle types over the typed Nomos kernel protocol and USDA custody model.
-version: 0.64.28
+version: 0.64.31
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.105.13",
+  "version": "0.105.15",
   "type": "module",
   "sideEffects": false,
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",

package/runtime/generated-application-host.js

@@ -6698,7 +6698,7 @@ function prepareManagedPromotion(report, candidateHash, domain, opts = {}) {
       domainHash: candidateHash,
       ...opts.replaces ? { replaces: opts.replaces } : {},
       retireReplaced: opts.retireReplaced ?? false,
-      ...opts.dispositions ? { dispositions: opts.dispositions } : {},
+      ...report.dispositions ? { dispositions: report.dispositions } : {},
       preflight
     }
   };
@@ -6714,7 +6714,6 @@ function prepareManagedRestoration(report, currentHash, priorHash, domain, opts
   }
   const acceptanceReason = opts.acceptanceReason?.trim();
   const prepared = prepareManagedPromotion(report, priorHash, domain, {
-    dispositions: report.dispositions,
     ...acceptanceReason ? { acceptanceReason } : {}
   });
   if (!prepared.ok) {
@@ -7184,8 +7183,8 @@ function createGovernanceOffers(ctx) {
     },
     /**
      * PARENT-AUTHORITY POSTURE (read-only diagnostic): is `identity:<principal>#signer@key:<keyHash>`
-     * a LIVE tuple on `parent`'s chain? Reads the parent's declared `relationTuplesByObject` query over
-     * the open gateway — one O(1) relation read, no authoring. Returns
+     * a LIVE tuple on `parent`'s chain? Reads the tuple's deterministic aggregate address over the
+     * generic record lane — one O(1) read, no authoring and no ambiguous query alias in composed law. Returns
      * `{ parent, principal, keyHash, object, relation, enrolled, revoked, checkedAt }`.
      * `revoked: true` means the subject's leaf was flipped `status:revoked` (remove-wins — a lawful
      * re-enroll of the SAME key is refused; mint + enroll a new device key instead).
@@ -7199,12 +7198,13 @@ function createGovernanceOffers(ctx) {
         keyHash = await sha256hexBytes2(bytesUnb642(publicKey));
       }
       const object = signerObjectOf(p);
+      const aggregateId = `reltuple-${object}-signer`;
       let rows;
       if (parent === workspace && !remote) {
-        rows = JSON.parse(call("query", { queryBytes: qBytes2({ kind: "query", queryId: "relationTuplesByObject", paramsJson: JSON.stringify({ object }) }) })) || [];
+        rows = JSON.parse(call("query", { queryBytes: qBytes2({ op: "byId", aggregateId }) })) || [];
       } else {
         const headers = authToken ? { Authorization: `Bearer ${authToken}`, "x-nomos-auth": authToken } : authHeaders;
-        const r = await _fetch(`${base}/v2/workspaces/${parent}/relationTuplesByObject?object=${encodeURIComponent(object)}`, { headers });
+        const r = await _fetch(`${base}/v2/workspaces/${parent}/aggregates/${encodeURIComponent(aggregateId)}`, { headers });
         const text2 = await r.text();
         let body;
         try {
@@ -7212,7 +7212,7 @@ function createGovernanceOffers(ctx) {
         } catch {
           body = text2;
         }
-        if (!r.ok) throw new Error(`parentSignerEnrollment: reading ${parent}'s relationTuplesByObject failed (${r.status}): ${typeof body === "string" ? body.slice(0, 200) : JSON.stringify(body).slice(0, 200)}`);
+        if (!r.ok) throw new Error(`parentSignerEnrollment: reading ${parent}'s signer tuple failed (${r.status}): ${typeof body === "string" ? body.slice(0, 200) : JSON.stringify(body).slice(0, 200)}`);
         rows = Array.isArray(body) ? body : body && Array.isArray(body.rows) ? body.rows : [];
       }
       let enrolled = false, revoked = false, verifiedVia;
@@ -7258,7 +7258,14 @@ function createGovernanceOffers(ctx) {
         rows = JSON.parse(call("query", { queryBytes: qBytes2({ kind: "query", queryId: "relationTuplesByObject", paramsJson: JSON.stringify({ object }) }) })) || [];
       } else {
         const headers = authToken ? { Authorization: `Bearer ${authToken}`, "x-nomos-auth": authToken } : authHeaders;
-        const r = await _fetch(`${base}/v2/workspaces/${ws}/relationTuplesByObject?object=${encodeURIComponent(object)}`, { headers });
+        const route = await resolveFrameworkRoute({
+          parent: ws,
+          operationId: "relationTuplesByObject",
+          method: "get",
+          token: authToken,
+          principal: subj
+        });
+        const r = await _fetch(`${base}/v2/workspaces/${ws}${route.path}?object=${encodeURIComponent(object)}`, { headers });
         const text2 = await r.text();
         let body;
         try {
@@ -9265,7 +9272,7 @@ ${String(commit).toLowerCase()}`;
             domain,
             candidateHash,
             atHash,
-            ...opts.dispositions ? { dispositions: opts.dispositions } : {}
+            ackBy: connectionPrincipal
           })
         }));
       });
@@ -9278,8 +9285,7 @@ ${String(commit).toLowerCase()}`;
     }
     const prepared = prepareManagedPromotion(report, candidateHash, domain, {
       ...currentHash && currentHash !== candidateHash ? { replaces: currentHash } : {},
-      ...opts.because !== void 0 ? { acceptanceReason: opts.because } : {},
-      ...opts.dispositions ? { dispositions: opts.dispositions } : {}
+      ...opts.because !== void 0 ? { acceptanceReason: opts.because } : {}
     });
     if (!prepared.ok) return prepared;
     try {
@@ -13492,16 +13498,55 @@ function applicationError(message, code, cause) {
   if (cause !== void 0) error.cause = cause;
   return error;
 }
-async function ensureGeneratedModelCurrent(application) {
+function applicationOpenFailure(application, requestedModel, cause) {
+  const typed = cause;
+  if (typed?.name === "NomosApplicationError" && typeof typed.code === "string") {
+    return cause;
+  }
+  const raw = String(cause?.message ?? cause ?? "unknown failure");
+  if (/birth-current-law-unavailable|birth install target|\[nomos\.birth\.model_not_active\]/i.test(raw)) {
+    const model = /(?:birth install target|under model)\s+([0-9a-f]{64})/i.exec(raw)?.[1] ?? requestedModel;
+    const shortModel = /^[0-9a-f]{64}$/i.test(model) ? `${model.slice(0, 16)}\u2026` : "the requested model";
+    return applicationError(
+      `Nomos application '${application}' cannot create this private workspace because its parent does not currently serve model ${shortModel}. No workspace was created. A current generated client should inherit the parent's active model at birth and then govern adoption of its packaged model; regenerate the application client before retrying, or have an authorised application release adopt that model on the parent.`,
+      "nomos.application.bootstrap_model_not_active",
+      cause
+    );
+  }
+  return applicationError(
+    `Nomos could not finish preparing the signed-in '${application}' application: ${raw}`,
+    "nomos.application.open_failed",
+    cause
+  );
+}
+async function ensureGeneratedModelCurrent(application, approveModel) {
   if (application.model?.adopt === void 0) {
     throw applicationError(
       "This generated application has no model lifecycle surface and cannot prove its plans are current.",
       "nomos.application.model_lifecycle_missing"
     );
   }
-  const adoption = await application.model.adopt();
+  let adoption = await application.model.adopt();
+  if (adoption.status === "needs-staging" && adoption.stage !== void 0) {
+    adoption = await adoption.stage();
+  }
   if (adoption.status === "adopted") return;
   if (adoption.status === "needs-decision") {
+    if (approveModel !== void 0 && adoption.accept !== void 0) {
+      const approval = await approveModel({
+        summary: adoption.summary,
+        review: adoption.review
+      });
+      const because = approval.because.trim();
+      if (!because) {
+        throw applicationError(
+          "Model approval must state the business reason for the change.",
+          "nomos.application.model_decision_reason_missing"
+        );
+      }
+      adoption = await adoption.accept(because);
+      if (adoption.status === "adopted") return;
+    }
     throw applicationError(
       "This application model changes prior business outcomes and needs an attributed migration decision before the app can write.",
       "nomos.application.model_decision_required",
@@ -13624,7 +13669,7 @@ async function nomosInternalOpenGeneratedApplication(options, bind, internals =
       ...environment?.NOMOS_TEST_K_ROOT_PUBLIC ? { __testKRootPublic: environment.NOMOS_TEST_K_ROOT_PUBLIC } : {}
     });
     const applicationObject = measureOpenSync("bind generated business API", () => bind(holon2, user));
-    await ensureGeneratedModelCurrent(applicationObject);
+    await ensureGeneratedModelCurrent(applicationObject, options.approveModel);
     await measureOpen("prepare generated entry commands", () => prepareGeneratedEntryCommands(holon2, options.readyCommands, options.onPerformance));
     const stop = holon2.autoSync({
       onResult: (result) => {
@@ -13861,17 +13906,11 @@ async function nomosInternalOpenGeneratedApplication(options, bind, internals =
     }
     authToken = deviceToken;
     if (!completed) {
-      let homeAvailable = false;
-      try {
-        homeAvailable = Boolean(await measureOpen("check private application custody", () => authorityHolon.head()));
-      } catch {
-      }
-      if (!homeAvailable) {
+      const birthOrRepeat = async () => {
         const birth = await measureOpen("establish private application custody", () => authorityHolon.nomosInternalBirthReceivingGroup({
           parent: application,
           principal,
           subject,
-          lawHash: options.lawHash,
           device: { secret, public: publicKey },
           authToken,
           idToken: authToken,
@@ -13881,16 +13920,36 @@ async function nomosInternalOpenGeneratedApplication(options, bind, internals =
         }));
         const verdict = birth.verify;
         if (verdict !== void 0 && verdict.valid !== true) throw new Error(`the born application failed replay verification: ${String(verdict.error ?? "unknown")}`);
+      };
+      let homeAvailable = false;
+      try {
+        homeAvailable = Boolean(await measureOpen("check private application custody", () => authorityHolon.head()));
+      } catch {
+      }
+      if (!homeAvailable) {
+        await birthOrRepeat();
       } else if (!hadDurableSecret) {
-        await measureOpen("enrol application device with its parent", () => authorityHolon.ensureParentSignerEnrollment({
-          parent: application,
-          principal,
-          publicKey,
-          authorSecret: secret,
-          authToken,
-          idToken: authToken,
-          verifiedVia: issuer
-        }));
+        try {
+          await measureOpen("enrol application device in its private custody", () => authorityHolon.ensureParentSignerEnrollment({
+            // The write gate that this device will use is the receiving-group workspace itself.
+            // The application root authorises/births that home; it is not a substitute signer index.
+            parent: receivingGroup,
+            // The author gate speaks canonical Nomos principals. A provider subject is deliberately
+            // opaque and may contain its own namespace separators; never enrol that raw value as the actor.
+            principal: subject,
+            publicKey,
+            authorSecret: secret,
+            authToken,
+            idToken: authToken,
+            verifiedVia: issuer
+          }));
+        } catch (error) {
+          if (String(error).includes("receiving-group-additional-device-requires-current-device-or-guardian")) {
+            await birthOrRepeat();
+          } else {
+            throw error;
+          }
+        }
       }
       await measureOpen("save application bootstrap progress", () => store.saveText(journalState, "home-available"));
       authorityHolon = await measureOpen("rebind durable application authority", () => mountAuthority(secret, authToken));
@@ -13904,8 +13963,8 @@ async function nomosInternalOpenGeneratedApplication(options, bind, internals =
       if (verified.valid !== true) throw new Error(`the private authority context failed replay verification: ${String(verified.error ?? "unknown")}`);
       await measureOpen("save application bootstrap progress", () => store.saveText(journalState, "verified"));
       try {
-        await measureOpen("confirm parent signer enrolment", () => authorityHolon.ensureParentSignerEnrollment({
-          parent: application,
+        await measureOpen("confirm private-custody signer enrolment", () => authorityHolon.ensureParentSignerEnrollment({
+          parent: receivingGroup,
           principal: subject,
           authorSecret: secret,
           authToken,
@@ -13930,7 +13989,7 @@ async function nomosInternalOpenGeneratedApplication(options, bind, internals =
     } catch {
     }
     const applicationObject = measureOpenSync("bind generated business API", () => bind(holon, user));
-    await measureOpen("confirm generated model is current", () => ensureGeneratedModelCurrent(applicationObject));
+    await measureOpen("confirm generated model is current", () => ensureGeneratedModelCurrent(applicationObject, options.approveModel));
     await measureOpen("prepare generated entry commands", () => prepareGeneratedEntryCommands(holon, options.readyCommands, options.onPerformance));
     phase = "current";
     autoSync = holon.autoSync({
@@ -14009,7 +14068,7 @@ async function nomosInternalOpenGeneratedApplication(options, bind, internals =
   } catch (cause) {
     await closeRealm().catch(() => {
     });
-    throw applicationError("Nomos could not finish preparing the signed-in business application.", "nomos.application.open_failed", cause);
+    throw applicationOpenFailure(application, options.lawHash, cause);
   }
 }
 export {