@githolon/dsl 0.105.23 → 0.106.0

package/dart/lib/src/webview_bridge.dart

@@ -55,8 +55,11 @@ typedef NomosEngine = NomosBridge;
 /// One stable bounded page from an authenticated declared-query index. [cursor] is opaque framework
 /// state: pass it back unchanged to request the next page; [done] means this page exhausted the query.
 final class NomosPage<T> {
-  const NomosPage(
-      {required this.rows, required this.cursor, required this.done});
+  const NomosPage({
+    required this.rows,
+    required this.cursor,
+    required this.done,
+  });
 
   final List<T> rows;
   final String? cursor;
@@ -98,57 +101,59 @@ final class NomosBirthCertificate {
   final String? authProviderAudience;
 
   static String _string(
-          Map<String, Object?> wire, String camel, String snake) =>
-      (wire[camel] ?? wire[snake] ?? '').toString();
+    Map<String, Object?> wire,
+    String camel,
+    String snake,
+  ) => (wire[camel] ?? wire[snake] ?? '').toString();
 
   static List<int> _bytes(
-          Map<String, Object?> wire, String camel, String snake) =>
-      ((wire[camel] ?? wire[snake]) as List? ?? const <Object?>[])
-          .map((value) => (value as num).toInt())
-          .toList(growable: false);
-
-  factory NomosBirthCertificate.fromWire(Map<String, Object?> wire) =>
-      NomosBirthCertificate(
-        child: _string(wire, 'child', 'child'),
-        founder: _string(wire, 'founder', 'founder'),
-        verified: wire['verified'] == true,
-        parentKey: _bytes(wire, 'parentKey', 'parent_key'),
-        parentId: _string(wire, 'parentId', 'parent_id'),
-        epoch: (wire['epoch'] as num?)?.toInt() ?? 0,
-        signature: _bytes(wire, 'signature', 'signature'),
-        verifiedVia: (wire['verifiedVia'] ?? wire['verified_via'])?.toString(),
-        idpToken: (wire['idpToken'] ?? wire['idp_token'])?.toString(),
-        capturedClock:
-            ((wire['capturedClock'] ?? wire['captured_clock']) as num?)
-                ?.toInt(),
-        authProviderIssuer:
-            (wire['authProviderIssuer'] ?? wire['auth_provider_issuer'])
-                ?.toString(),
-        authProviderJwks:
-            (wire['authProviderJwks'] ?? wire['auth_provider_jwks'])
-                ?.toString(),
-        authProviderAudience:
-            (wire['authProviderAudience'] ?? wire['auth_provider_audience'])
-                ?.toString(),
-      );
+    Map<String, Object?> wire,
+    String camel,
+    String snake,
+  ) => ((wire[camel] ?? wire[snake]) as List? ?? const <Object?>[])
+      .map((value) => (value as num).toInt())
+      .toList(growable: false);
+
+  factory NomosBirthCertificate.fromWire(
+    Map<String, Object?> wire,
+  ) => NomosBirthCertificate(
+    child: _string(wire, 'child', 'child'),
+    founder: _string(wire, 'founder', 'founder'),
+    verified: wire['verified'] == true,
+    parentKey: _bytes(wire, 'parentKey', 'parent_key'),
+    parentId: _string(wire, 'parentId', 'parent_id'),
+    epoch: (wire['epoch'] as num?)?.toInt() ?? 0,
+    signature: _bytes(wire, 'signature', 'signature'),
+    verifiedVia: (wire['verifiedVia'] ?? wire['verified_via'])?.toString(),
+    idpToken: (wire['idpToken'] ?? wire['idp_token'])?.toString(),
+    capturedClock: ((wire['capturedClock'] ?? wire['captured_clock']) as num?)
+        ?.toInt(),
+    authProviderIssuer:
+        (wire['authProviderIssuer'] ?? wire['auth_provider_issuer'])
+            ?.toString(),
+    authProviderJwks: (wire['authProviderJwks'] ?? wire['auth_provider_jwks'])
+        ?.toString(),
+    authProviderAudience:
+        (wire['authProviderAudience'] ?? wire['auth_provider_audience'])
+            ?.toString(),
+  );
 
   Map<String, Object?> toWire() => <String, Object?>{
-        'child': child,
-        'founder': founder,
-        'verified': verified,
-        'parentKey': parentKey,
-        'parentId': parentId,
-        'epoch': epoch,
-        'signature': signature,
-        if (verifiedVia != null) 'verifiedVia': verifiedVia,
-        if (idpToken != null) 'idpToken': idpToken,
-        if (capturedClock != null) 'capturedClock': capturedClock,
-        if (authProviderIssuer != null)
-          'authProviderIssuer': authProviderIssuer,
-        if (authProviderJwks != null) 'authProviderJwks': authProviderJwks,
-        if (authProviderAudience != null)
-          'authProviderAudience': authProviderAudience,
-      };
+    'child': child,
+    'founder': founder,
+    'verified': verified,
+    'parentKey': parentKey,
+    'parentId': parentId,
+    'epoch': epoch,
+    'signature': signature,
+    if (verifiedVia != null) 'verifiedVia': verifiedVia,
+    if (idpToken != null) 'idpToken': idpToken,
+    if (capturedClock != null) 'capturedClock': capturedClock,
+    if (authProviderIssuer != null) 'authProviderIssuer': authProviderIssuer,
+    if (authProviderJwks != null) 'authProviderJwks': authProviderJwks,
+    if (authProviderAudience != null)
+      'authProviderAudience': authProviderAudience,
+  };
 }
 
 /// Facts signed by [NomosBridge.signBirthCert]. The secret remains a separate argument and never
@@ -183,21 +188,20 @@ final class NomosBirthCertificateSpec {
   final String? authProviderAudience;
 
   Map<String, Object?> toWire() => <String, Object?>{
-        'child': child,
-        'founder': founder,
-        'verified': verified,
-        'parentKey': parentKey,
-        'parentId': parentId,
-        'epoch': epoch,
-        if (verifiedVia != null) 'verifiedVia': verifiedVia,
-        if (idpToken != null) 'idpToken': idpToken,
-        if (capturedClock != null) 'capturedClock': capturedClock,
-        if (authProviderIssuer != null)
-          'authProviderIssuer': authProviderIssuer,
-        if (authProviderJwks != null) 'authProviderJwks': authProviderJwks,
-        if (authProviderAudience != null)
-          'authProviderAudience': authProviderAudience,
-      };
+    'child': child,
+    'founder': founder,
+    'verified': verified,
+    'parentKey': parentKey,
+    'parentId': parentId,
+    'epoch': epoch,
+    if (verifiedVia != null) 'verifiedVia': verifiedVia,
+    if (idpToken != null) 'idpToken': idpToken,
+    if (capturedClock != null) 'capturedClock': capturedClock,
+    if (authProviderIssuer != null) 'authProviderIssuer': authProviderIssuer,
+    if (authProviderJwks != null) 'authProviderJwks': authProviderJwks,
+    if (authProviderAudience != null)
+      'authProviderAudience': authProviderAudience,
+  };
 }
 
 /// The protocol version the runner and the bridge agree on (`webview-runner.mjs` `WEBVIEW_BRIDGE_VERSION`).
@@ -247,8 +251,11 @@ class TransferProgress {
   final int received;
   final int? total;
   final String kind; // 'delta' (incremental) | 'full' (initial clone)
-  const TransferProgress(
-      {required this.received, this.total, this.kind = 'delta'});
+  const TransferProgress({
+    required this.received,
+    this.total,
+    this.kind = 'delta',
+  });
   double? get fraction => (total == null || total == 0)
       ? null
       : (received / total!).clamp(0.0, 1.0);
@@ -332,18 +339,17 @@ class SyncStatus {
     DateTime? lastSyncedAt,
     String? lastError,
     bool clearError = false,
-  }) =>
-      SyncStatus(
-        phase: phase ?? this.phase,
-        ahead: ahead ?? this.ahead,
-        behind: behind ?? this.behind,
-        saved: saved ?? this.saved,
-        onMain: onMain ?? this.onMain,
-        deadLetters: deadLetters ?? this.deadLetters,
-        transfer: clearTransfer ? null : (transfer ?? this.transfer),
-        lastSyncedAt: lastSyncedAt ?? this.lastSyncedAt,
-        lastError: clearError ? null : (lastError ?? this.lastError),
-      );
+  }) => SyncStatus(
+    phase: phase ?? this.phase,
+    ahead: ahead ?? this.ahead,
+    behind: behind ?? this.behind,
+    saved: saved ?? this.saved,
+    onMain: onMain ?? this.onMain,
+    deadLetters: deadLetters ?? this.deadLetters,
+    transfer: clearTransfer ? null : (transfer ?? this.transfer),
+    lastSyncedAt: lastSyncedAt ?? this.lastSyncedAt,
+    lastError: clearError ? null : (lastError ?? this.lastError),
+  );
 }
 
 bool _sameTransferProgress(TransferProgress? left, TransferProgress? right) =>
@@ -374,13 +380,19 @@ class NomosCreated {
   /// The workspace the offer ran on (NomosRef). Additive — defaults to '' on older runners that
   /// don't stamp it; then [ref] is workspace-blank (still a valid locator on the local plane).
   final String workspace;
-  const NomosCreated(
-      {required this.type, required this.id, this.workspace = ''});
+  const NomosCreated({
+    required this.type,
+    required this.id,
+    this.workspace = '',
+  });
 
   /// The canonical [NomosRef] view — the `{workspace,type,id}` triple, followable/serializable
   /// (`nomos://<workspace>/<type>/<id>`). One reference, everywhere.
   NomosRef<Object?> get ref => NmsInternalNomosRefs.create<Object?>(
-      workspace: workspace, type: type, id: id);
+    workspace: workspace,
+    type: type,
+    id: id,
+  );
   @override
   String toString() => id;
 }
@@ -407,36 +419,40 @@ class NomosBbox {
     double? minLat,
     double? maxLng,
     double? maxLat,
-  })  : minX = (minX ?? minLng)!,
-        minY = (minY ?? minLat)!,
-        maxX = (maxX ?? maxLng)!,
-        maxY = (maxY ?? maxLat)!;
+  }) : minX = (minX ?? minLng)!,
+       minY = (minY ?? minLat)!,
+       maxX = (maxX ?? maxLng)!,
+       maxY = (maxY ?? maxLat)!;
 
   /// Deprecated geographic accessors — spatial axes are generic. Prefer [minX]/[minY]/[maxX]/[maxY].
   @Deprecated(
-      'Spatial axes are generic; use minX/minY. Kept for source compat.')
+    'Spatial axes are generic; use minX/minY. Kept for source compat.',
+  )
   double get minLng => minX;
   @Deprecated(
-      'Spatial axes are generic; use minX/minY. Kept for source compat.')
+    'Spatial axes are generic; use minX/minY. Kept for source compat.',
+  )
   double get minLat => minY;
   @Deprecated(
-      'Spatial axes are generic; use maxX/maxY. Kept for source compat.')
+    'Spatial axes are generic; use maxX/maxY. Kept for source compat.',
+  )
   double get maxLng => maxX;
   @Deprecated(
-      'Spatial axes are generic; use maxX/maxY. Kept for source compat.')
+    'Spatial axes are generic; use maxX/maxY. Kept for source compat.',
+  )
   double get maxLat => maxY;
 
   Map<String, Object?> toJson() => {
-        'minX': minX,
-        'minY': minY,
-        'maxX': maxX,
-        'maxY': maxY,
-        // Geographic aliases so a pre-genericisation runner (which reads minLng/…) still works.
-        'minLng': minX,
-        'minLat': minY,
-        'maxLng': maxX,
-        'maxLat': maxY,
-      };
+    'minX': minX,
+    'minY': minY,
+    'maxX': maxX,
+    'maxY': maxY,
+    // Geographic aliases so a pre-genericisation runner (which reads minLng/…) still works.
+    'minLng': minX,
+    'minLat': minY,
+    'maxLng': maxX,
+    'maxLat': maxY,
+  };
 }
 
 /// One member's structural compat verdict — `ok`, plus the exact break [reason] when not.
@@ -497,8 +513,9 @@ class NomosCompat {
     final install = (m['install'] as Map?)?.cast<String, Object?>() ?? const {};
     return NomosCompat(
       generatedFor: (m['generatedFor'] as String?) ?? '',
-      workspaceRuns:
-          ((m['workspaceRuns'] as List?) ?? const []).map((e) => '$e').toList(),
+      workspaceRuns: ((m['workspaceRuns'] as List?) ?? const [])
+          .map((e) => '$e')
+          .toList(),
       matches: m['matches'] == true,
       offerKnown: m['offerKnown'] == true,
       structurallyCompatible: m['structurallyCompatible'] as bool?,
@@ -528,21 +545,22 @@ class NomosScopeKey {
 
   /// Framework-private deterministic child address, present only for an unborn owned business aggregate.
   final String? workspace;
-  const NomosScopeKey(
-      {required this.scope,
-      required this.epoch,
-      required this.key,
-      this.ownedKeySubject,
-      this.ownedCustody,
-      this.workspace});
+  const NomosScopeKey({
+    required this.scope,
+    required this.epoch,
+    required this.key,
+    this.ownedKeySubject,
+    this.ownedCustody,
+    this.workspace,
+  });
   Map<String, Object?> toJson() => {
-        'scope': scope,
-        'epoch': epoch,
-        'key': key,
-        if (ownedKeySubject != null) 'ownedKeySubject': ownedKeySubject,
-        if (ownedCustody != null) 'ownedCustody': ownedCustody,
-        if (workspace != null) 'workspace': workspace,
-      };
+    'scope': scope,
+    'epoch': epoch,
+    'key': key,
+    if (ownedKeySubject != null) 'ownedKeySubject': ownedKeySubject,
+    if (ownedCustody != null) 'ownedCustody': ownedCustody,
+    if (workspace != null) 'workspace': workspace,
+  };
 }
 
 /// The entire app-facing multi-device surface for owned business state. The request is deliberately an
@@ -569,8 +587,10 @@ class NomosDevices {
     if (principal == null || principal.trim().isEmpty) {
       throw StateError('devices.approve() needs a signed-in Nomos session');
     }
-    final payload =
-        await bridge.nomosPrepareOwnedDeviceApproval(request, scope);
+    final payload = await bridge.nomosPrepareOwnedDeviceApproval(
+      request,
+      scope,
+    );
     return bridge.offerOutcome(
       domain: domain,
       directiveId: 'nomos_internal_approve_owned_device_7c1f5e',
@@ -600,7 +620,8 @@ class NomosRecovery {
   Future<Map<String, Object?>> protectWith(String person) {
     if (person.trim().isEmpty) {
       throw ArgumentError(
-          'recovery.protectWith() needs the person who will recover you');
+        'recovery.protectWith() needs the person who will recover you',
+      );
     }
     return bridge.nomosProtectOwnedIdentity(
       scope: scope,
@@ -644,25 +665,33 @@ class WrappedKeyStore implements NomosKeyStore {
   final String principal;
   final String deviceSecret;
   final Map<String, Future<List<NomosScopeKey>>> _cache = {};
-  WrappedKeyStore(
-      {required this.bridge,
-      required this.principal,
-      required this.deviceSecret});
+  WrappedKeyStore({
+    required this.bridge,
+    required this.principal,
+    required this.deviceSecret,
+  });
 
   Future<List<NomosScopeKey>> _loadScope(String scope) {
     return _cache.putIfAbsent(scope, () async {
-      final rows = await bridge
-          .query('wrappedKeysByRecipient', {'recipientPrincipal': principal});
+      final rows = await bridge.query('wrappedKeysByRecipient', {
+        'recipientPrincipal': principal,
+      });
       final held = <NomosScopeKey>[];
       for (final row in rows) {
         final d = ((row['data'] ?? row) as Map);
         if (d['scope']?.toString() != scope) continue;
         final key = await bridge.cryptoUnwrapKey(
-            secret: deviceSecret,
-            hpkeEpk: d['hpkeEpk'].toString(),
-            ct: d['ct'].toString());
-        held.add(NomosScopeKey(
-            scope: scope, epoch: (d['epoch'] as num?)?.toInt() ?? 0, key: key));
+          secret: deviceSecret,
+          hpkeEpk: d['hpkeEpk'].toString(),
+          ct: d['ct'].toString(),
+        );
+        held.add(
+          NomosScopeKey(
+            scope: scope,
+            epoch: (d['epoch'] as num?)?.toInt() ?? 0,
+            key: key,
+          ),
+        );
       }
       held.sort((a, b) => b.epoch - a.epoch);
       return held;
@@ -749,16 +778,19 @@ class BirthIncomplete implements Exception {
   @override
   String toString() {
     final list = failedBirths
-        .map((o) =>
-            '${o['workspace'] ?? '?'} [${o['status']}${o['code'] != null ? ': ${o['code']}' : ''}]'
-            '${o['reason'] != null ? ' — ${o['reason']}' : ''}')
+        .map(
+          (o) =>
+              '${o['workspace'] ?? '?'} [${o['status']}${o['code'] != null ? ': ${o['code']}' : ''}]'
+              '${o['reason'] != null ? ' — ${o['reason']}' : ''}',
+        )
         .join('; ');
-    final lawUnavailable =
-        failedBirths.any((o) => o['code'] == 'BirthLawPackageUnavailable');
+    final lawUnavailable = failedBirths.any(
+      (o) => o['code'] == 'BirthLawPackageUnavailable',
+    );
     return 'BirthIncomplete: ${failedBirths.length} child workspace(s) did NOT come up — $list. '
         'The parent offer admitted, but the child was not fully born, so opening it would poll head:null '
         'until timeout. ${lawUnavailable ? "The child's law package is not resolvable from the parent's "
-            "custody — deploy it to the parent (POST /v2/workspaces/<parent>/domains) BEFORE birthing." : "See the outcome's reason/code."}';
+                  "custody — deploy it to the parent (POST /v2/workspaces/<parent>/domains) BEFORE birthing." : "See the outcome's reason/code."}';
   }
 }
 
@@ -768,8 +800,11 @@ class NomosEpochResult {
   final String head;
   final int epoch;
   final List<String> roster;
-  const NomosEpochResult(
-      {required this.head, required this.epoch, required this.roster});
+  const NomosEpochResult({
+    required this.head,
+    required this.epoch,
+    required this.roster,
+  });
 }
 
 /// THE OWNER CEREMONY surface — `<Domain>Client(bridge, actor: owner).encryption`. All three verbs open a
@@ -784,18 +819,20 @@ class NomosEncryption {
   /// The encryption scopes this domain defines (each a `requires(cap)`).
   final List<String> scopes;
 
-  NomosEncryption(
-      {required this.bridge,
-      required this.domain,
-      this.domainHash,
-      this.actor,
-      required this.scopes});
+  NomosEncryption({
+    required this.bridge,
+    required this.domain,
+    this.domainHash,
+    this.actor,
+    required this.scopes,
+  });
 
   String _defScope([String? scope]) {
     if (scope != null && scope.isNotEmpty) return scope;
     if (scopes.length == 1) return scopes.first;
     throw StateError(
-        'this domain defines ${scopes.length} encryption scopes $scopes — pass a scope to pick one');
+      'this domain defines ${scopes.length} encryption scopes $scopes — pass a scope to pick one',
+    );
   }
 
   // A BARE scope IS `workspace:self#<relation>` (the era rule); a per-record scope is `<type>:<id>#<relation>`.
@@ -815,13 +852,14 @@ class NomosEncryption {
     final subjects = rows.isEmpty
         ? const <String, dynamic>{}
         : ((rows.first['data'] as Map?)?['subjects'] as Map?) ??
-            const <String, dynamic>{};
+              const <String, dynamic>{};
     final out = <String>[];
     subjects.forEach((subj, leafRaw) {
       Map? leaf;
       try {
-        leaf =
-            leafRaw is String ? jsonDecode(leafRaw) as Map : (leafRaw as Map);
+        leaf = leafRaw is String
+            ? jsonDecode(leafRaw) as Map
+            : (leafRaw as Map);
       } catch (_) {
         leaf = null;
       }
@@ -844,31 +882,38 @@ class NomosEncryption {
   Future<String> _freshScopeKey() async {
     final kp = await bridge.cryptoKeygen();
     final secret = base64Decode((kp['secret'] ?? '').toString());
-    return base64Encode(secret.sublist(
-        0, 32)); // the 32-byte epoch secret; NEVER lands on chain
+    return base64Encode(
+      secret.sublist(0, 32),
+    ); // the 32-byte epoch secret; NEVER lands on chain
   }
 
-  Future<String?> _memberPubKey(String principal,
-      {String? newcomer,
-      String? newcomerPub,
-      Map<String, String>? memberKeys}) async {
+  Future<String?> _memberPubKey(
+    String principal, {
+    String? newcomer,
+    String? newcomerPub,
+    Map<String, String>? memberKeys,
+  }) async {
     if (memberKeys != null && memberKeys[principal] != null) {
       return memberKeys[principal];
     }
     if (newcomer == principal && newcomerPub != null) return newcomerPub;
     // Published enc key (encKeyByPrincipal) — present only when the domain composed the registry; tolerate absence.
     try {
-      final reg =
-          await bridge.query('encKeyByPrincipal', {'principal': principal});
+      final reg = await bridge.query('encKeyByPrincipal', {
+        'principal': principal,
+      });
       if (reg.isNotEmpty) {
         final pub = (reg.first['data'] as Map?)?['encPublicKey'];
         if (pub != null && pub.toString().isNotEmpty) return pub.toString();
       }
-    } catch (_) {/* not routed — fall through to the prior-wrap lane */}
+    } catch (_) {
+      /* not routed — fall through to the prior-wrap lane */
+    }
     // The member's most-recent WrappedKey pins the pubkey it was last sealed to (rotation needs no re-publish).
     try {
-      final wraps = await bridge
-          .query('wrappedKeysByRecipient', {'recipientPrincipal': principal});
+      final wraps = await bridge.query('wrappedKeysByRecipient', {
+        'recipientPrincipal': principal,
+      });
       int bestEpoch = -1;
       String? bestPub;
       for (final w in wraps) {
@@ -881,7 +926,9 @@ class NomosEncryption {
         }
       }
       if (bestPub != null) return bestPub;
-    } catch (_) {/* not routed */}
+    } catch (_) {
+      /* not routed */
+    }
     return null;
   }
 
@@ -911,10 +958,12 @@ class NomosEncryption {
     final key = scopeKey ?? await _freshScopeKey();
     final wraps = <Map<String, Object?>>[];
     for (final principal in members) {
-      final pub = await _memberPubKey(principal,
-          newcomer: addPrincipal,
-          newcomerPub: addPublicKey,
-          memberKeys: memberKeys);
+      final pub = await _memberPubKey(
+        principal,
+        newcomer: addPrincipal,
+        newcomerPub: addPublicKey,
+        memberKeys: memberKeys,
+      );
       if (pub == null) throw EncryptionMemberKeyMissing(principal, scope);
       final w = await bridge.cryptoWrapKey(recipientPub: pub, scopeKey: key);
       wraps.add({
@@ -937,8 +986,7 @@ class NomosEncryption {
       },
       actor: actor,
       domainHash: domainHash,
-    ))
-        .head;
+    )).head;
     return NomosEpochResult(head: head, epoch: epoch, roster: members);
   }
 
@@ -958,18 +1006,21 @@ class NomosEncryption {
   }) async {
     final s = _defScope(scope);
     await bridge.offerOutcome(
-        domain: domain,
-        directiveId: grantDirective,
-        payload: grantPayload,
-        actor: actor,
-        domainHash: domainHash);
-    return _advance(s,
-        addPrincipal: principal,
-        addPublicKey: publicKey,
-        scopeKey: scopeKey,
-        memberKeys: memberKeys,
-        expectRoster: expectRoster,
-        openedAt: openedAt);
+      domain: domain,
+      directiveId: grantDirective,
+      payload: grantPayload,
+      actor: actor,
+      domainHash: domainHash,
+    );
+    return _advance(
+      s,
+      addPrincipal: principal,
+      addPublicKey: publicKey,
+      scopeKey: scopeKey,
+      memberKeys: memberKeys,
+      expectRoster: expectRoster,
+      openedAt: openedAt,
+    );
   }
 
   /// Revoke a member + open a fresh epoch re-wrapping the key to the SURVIVORS only. FORWARD-ONLY: the removed
@@ -986,17 +1037,20 @@ class NomosEncryption {
   }) async {
     final s = _defScope(scope);
     await bridge.offerOutcome(
-        domain: domain,
-        directiveId: revokeDirective,
-        payload: revokePayload,
-        actor: actor,
-        domainHash: domainHash);
-    return _advance(s,
-        remove: [principal],
-        scopeKey: scopeKey,
-        memberKeys: memberKeys,
-        expectRoster: expectRoster,
-        openedAt: openedAt);
+      domain: domain,
+      directiveId: revokeDirective,
+      payload: revokePayload,
+      actor: actor,
+      domainHash: domainHash,
+    );
+    return _advance(
+      s,
+      remove: [principal],
+      scopeKey: scopeKey,
+      memberKeys: memberKeys,
+      expectRoster: expectRoster,
+      openedAt: openedAt,
+    );
   }
 
   /// Routine rotation — open a fresh epoch re-wrapping the key to the CURRENT roster (no membership change).
@@ -1006,12 +1060,13 @@ class NomosEncryption {
     Map<String, String>? memberKeys,
     List<String>? expectRoster,
     String? openedAt,
-  }) =>
-      _advance(_defScope(scope),
-          scopeKey: scopeKey,
-          memberKeys: memberKeys,
-          expectRoster: expectRoster,
-          openedAt: openedAt);
+  }) => _advance(
+    _defScope(scope),
+    scopeKey: scopeKey,
+    memberKeys: memberKeys,
+    expectRoster: expectRoster,
+    openedAt: openedAt,
+  );
 }
 
 /// The result of [NomosBridge.offerCreates]: the new local [head], every aggregate the plan minted, and —
@@ -1036,9 +1091,8 @@ final class NomosOperationStatus {
 /// adopted that shared position. Callers never inspect workspaces, URLs, credentials, headers or Git heads.
 final class NomosOperationReceipt {
   NomosOperationReceipt._()
-      : _status =
-            const NomosOperationStatus(NomosOperationPhase.locallyAccepted),
-        _changes = StreamController<NomosOperationStatus>.broadcast();
+    : _status = const NomosOperationStatus(NomosOperationPhase.locallyAccepted),
+      _changes = StreamController<NomosOperationStatus>.broadcast();
 
   NomosOperationStatus _status;
   final StreamController<NomosOperationStatus> _changes;
@@ -1099,7 +1153,8 @@ class NomosOfferOutcome {
   NomosOperationReceipt get receipt =>
       _receipt ??
       (throw StateError(
-          'This legacy offer outcome has no operation receipt; regenerate the application client.'));
+        'This legacy offer outcome has no operation receipt; regenerate the application client.',
+      ));
 
   const NomosOfferOutcome({
     required this.head,
@@ -1123,8 +1178,13 @@ class NomosOfferOutcome {
   /// (`final estate = await engine.follow(outcome.bornRefs.single);`) so app code never carries a
   /// loose workspace string. The ref's type is the reserved `nomos.Workspace` locator tag.
   List<NomosRef<Object?>> get bornRefs => born
-      .map((w) => NmsInternalNomosRefs.create<Object?>(
-          workspace: w, type: 'nomos.Workspace', id: w))
+      .map(
+        (w) => NmsInternalNomosRefs.create<Object?>(
+          workspace: w,
+          type: 'nomos.Workspace',
+          id: w,
+        ),
+      )
       .toList();
 }
 
@@ -1141,11 +1201,16 @@ extension NomosRefAcquire<TAggregate> on NomosRef<TAggregate> {
   }) {
     final workspace = NmsInternalNomosRefs.workspace(this);
     if (workspace.isEmpty) {
-      throw ArgumentError.value(this, 'ref',
-          'NomosRef.acquire: the ref carries no workspace — only a workspace-complete ref is openable');
+      throw ArgumentError.value(
+        this,
+        'ref',
+        'NomosRef.acquire: the ref carries no workspace — only a workspace-complete ref is openable',
+      );
     }
-    return bridge.acquireSession(workspace,
-        ifAbsentCredentials: ifAbsentCredentials);
+    return bridge.acquireSession(
+      workspace,
+      ifAbsentCredentials: ifAbsentCredentials,
+    );
   }
 }
 
@@ -1190,16 +1255,14 @@ final class _NomosRetainedCloudAccess {
   final String cloud;
   final Future<String?> Function() signIn;
 
-  const _NomosRetainedCloudAccess({
-    required this.cloud,
-    required this.signIn,
-  });
+  const _NomosRetainedCloudAccess({required this.cloud, required this.signIn});
 
   Future<NomosSessionCredentials> credentials() async {
     final token = await signIn();
     if (token == null || token.trim().isEmpty) {
       throw StateError(
-          'Nomos could not refresh the signed-in identity while opening a referenced business workspace');
+        'Nomos could not refresh the signed-in identity while opening a referenced business workspace',
+      );
     }
     return NomosSessionCredentials(cloud: cloud, authToken: token);
   }
@@ -1247,9 +1310,9 @@ class NomosBridge {
   // The DERIVED app-ready sync state. seeded-on-listen with a metrics poll; updated on sync/signal/transfer.
   late final StreamController<SyncStatus> _syncStatusCtrl =
       StreamController<SyncStatus>.broadcast(
-    onListen: _startStatusPoll,
-    onCancel: _stopStatusPollIfUnused,
-  );
+        onListen: _startStatusPoll,
+        onCancel: _stopStatusPollIfUnused,
+      );
   SyncStatus _status = const SyncStatus();
   final Map<String, SyncStatus> _statusBySession = {};
   final Map<String, StreamController<SyncStatus>> _syncStatusBySession = {};
@@ -1286,7 +1349,7 @@ class NomosBridge {
   // child sessions. The callback receives only the typed review object; child
   // addresses, archives, credentials and lifecycle directives remain private.
   final Map<String, Future<void> Function(DomainClientModelAdoptionRequired)>
-      _sessionModelChangeHandlers = {};
+  _sessionModelChangeHandlers = {};
   // [acquireSession]'s per-workspace single-flight: workspace → the in-flight open every concurrent
   // acquirer joins (removed when it completes; a live session then hits the fast path instead).
   final Map<String, Future<NomosSession>> _acquiring = {};
@@ -1414,9 +1477,11 @@ class NomosBridge {
       final ctrl = _watches[m['subId']];
       if (ctrl != null && !ctrl.isClosed) {
         if (m['ok'] == false) {
-          final info = NomosErrorInfo.fromBridgeMessage(m,
-              fallbackMessage: 'the watch read failed',
-              fallbackOperation: 'watch');
+          final info = NomosErrorInfo.fromBridgeMessage(
+            m,
+            fallbackMessage: 'the watch read failed',
+            fallbackOperation: 'watch',
+          );
           ctrl.addError(nomosErrorFromInfo(info));
         } else {
           ctrl.add((m['rows'] as List?) ?? const []);
@@ -1427,9 +1492,11 @@ class NomosBridge {
       final cctrl = _compatWatches[m['subId']];
       if (cctrl != null && !cctrl.isClosed) {
         if (m['ok'] == false) {
-          final info = NomosErrorInfo.fromBridgeMessage(m,
-              fallbackMessage: 'the compat watch failed',
-              fallbackOperation: 'watchCompatibility');
+          final info = NomosErrorInfo.fromBridgeMessage(
+            m,
+            fallbackMessage: 'the compat watch failed',
+            fallbackOperation: 'watchCompatibility',
+          );
           cctrl.addError(nomosErrorFromInfo(info));
         } else {
           cctrl.add(((m['rows'] as Map?)?.cast<String, Object?>()) ?? const {});
@@ -1440,8 +1507,9 @@ class NomosBridge {
     if (event == 'lawChanged') {
       // COMPAT SUPERPOWER (#72b): a synced install/upgrade/retire moved the workspace's offer under this
       // live client. Cache the fresh verdict + emit it so the app re-checks feature flags without polling.
-      final c =
-          NomosCompat.fromJson((m['compat'] as Map?)?.cast<String, Object?>());
+      final c = NomosCompat.fromJson(
+        (m['compat'] as Map?)?.cast<String, Object?>(),
+      );
       if (c != null) {
         _lastCompat = c;
         final sess = m['session'] as String?;
@@ -1468,21 +1536,24 @@ class NomosBridge {
           // telemetry; the app-ready status needs only one legible error and an honest error phase.
           final detail = m['error']?.toString() ?? 'automatic sync failed';
           _updateScopedStatus(
-              session,
-              (current) => current.copyWith(
-                  phase: SyncPhase.error,
-                  clearTransfer: true,
-                  lastError: detail));
+            session,
+            (current) => current.copyWith(
+              phase: SyncPhase.error,
+              clearTransfer: true,
+              lastError: detail,
+            ),
+          );
         } else if (result?['offline'] == true) {
           // Offline is expected transport debt. The durable local branch remains ahead and autoSync owns the
           // retry; do not claim a completed sync or overwrite the previous successful timestamp.
           _updateScopedStatus(
-              session,
-              (current) => current.copyWith(
-                  phase: SyncPhase.offline,
-                  clearTransfer: true,
-                  lastError:
-                      (result?['pushError'] as Map?)?['error']?.toString()));
+            session,
+            (current) => current.copyWith(
+              phase: SyncPhase.offline,
+              clearTransfer: true,
+              lastError: (result?['pushError'] as Map?)?['error']?.toString(),
+            ),
+          );
         } else if (result?['pushFailed'] == true) {
           // The sync round itself completed, but shared custody refused the
           // push. `stillAhead` is durable debt, not success: surface the
@@ -1491,24 +1562,30 @@ class NomosBridge {
           // out behind a generic saving state.
           final detail = _syncPushFailureDetail(result!);
           _updateScopedStatus(
-              session,
-              (current) => current.copyWith(
-                  phase: SyncPhase.error,
-                  clearTransfer: true,
-                  lastError: detail));
+            session,
+            (current) => current.copyWith(
+              phase: SyncPhase.error,
+              clearTransfer: true,
+              lastError: detail,
+            ),
+          );
         } else {
           // A completed round → idle (the next metrics poll folds in residual ahead/behind), stamp the time.
           _updateScopedStatus(
-              session,
-              (current) => current.copyWith(
-                  phase: SyncPhase.idle,
-                  clearTransfer: true,
-                  clearError: true,
-                  lastSyncedAt: DateTime.now()));
+            session,
+            (current) => current.copyWith(
+              phase: SyncPhase.idle,
+              clearTransfer: true,
+              clearError: true,
+              lastSyncedAt: DateTime.now(),
+            ),
+          );
         }
       } else if (m['status'] == 'closed' || m['status'] == 'offline') {
-        _updateScopedStatus(m['session']?.toString(),
-            (current) => current.copyWith(phase: SyncPhase.offline));
+        _updateScopedStatus(
+          m['session']?.toString(),
+          (current) => current.copyWith(phase: SyncPhase.offline),
+        );
       }
       return;
     }
@@ -1535,11 +1612,13 @@ class NomosBridge {
       final tp = TransferProgress.fromMessage(m);
       if (!_transferEvents.isClosed) _transferEvents.add(tp);
       _updateScopedStatus(
-          m['session']?.toString(),
-          (current) => current.copyWith(
-              phase: tp.done ? SyncPhase.syncing : SyncPhase.transferring,
-              transfer: tp,
-              clearTransfer: tp.done));
+        m['session']?.toString(),
+        (current) => current.copyWith(
+          phase: tp.done ? SyncPhase.syncing : SyncPhase.transferring,
+          transfer: tp,
+          clearTransfer: tp.done,
+        ),
+      );
       return;
     }
     if (event == 'trace') {
@@ -1552,10 +1631,11 @@ class NomosBridge {
       if (!_signalEvents.isClosed) _signalEvents.add(m);
       // the doorbell says canonical main advanced → we're behind until the next pull lands.
       _updateScopedStatus(
-          m['session']?.toString(),
-          (current) => current.phase == SyncPhase.idle
-              ? current.copyWith(phase: SyncPhase.behind)
-              : current);
+        m['session']?.toString(),
+        (current) => current.phase == SyncPhase.idle
+            ? current.copyWith(phase: SyncPhase.behind)
+            : current,
+      );
       return;
     }
     if (event == 'span') {
@@ -1584,14 +1664,20 @@ class NomosBridge {
           .map((e) => e.cast<String, Object?>())
           .toList();
       if (failedBirths != null && failedBirths.isNotEmpty) {
-        completer.completeError(BirthIncomplete(failedBirths,
-            head: ((m['errorInfo'] as Map?)?['head'] ?? '').toString()));
+        completer.completeError(
+          BirthIncomplete(
+            failedBirths,
+            head: ((m['errorInfo'] as Map?)?['head'] ?? '').toString(),
+          ),
+        );
         return;
       }
-      final info = NomosErrorInfo.fromBridgeMessage(m,
-          fallbackOperation: op,
-          fallbackTrace: trace,
-          fallbackMessage: 'the githolon refused the request');
+      final info = NomosErrorInfo.fromBridgeMessage(
+        m,
+        fallbackOperation: op,
+        fallbackTrace: trace,
+        fallbackMessage: 'the githolon refused the request',
+      );
       completer.completeError(nomosErrorFromInfo(info));
     }
   }
@@ -1647,7 +1733,8 @@ class NomosBridge {
       final parts = token.split('.');
       if (parts.length < 2) return null;
       final payload = jsonDecode(
-          utf8.decode(base64Url.decode(base64Url.normalize(parts[1]))));
+        utf8.decode(base64Url.decode(base64Url.normalize(parts[1]))),
+      );
       final sub = payload is Map ? payload['sub'] : null;
       if (sub is! String || sub.trim().isEmpty) return null;
       final value = sub.trim();
@@ -1658,11 +1745,14 @@ class NomosBridge {
   }
 
   NomosOperationReceipt _registerOperationReceipt(
-      String workspace, String intentId) {
+    String workspace,
+    String intentId,
+  ) {
     if (intentId.isEmpty) {
       throw StateError(
-          'Nomos accepted a local write without returning its stable intent identity. '
-          'The runtime and kernel release are incompatible.');
+        'Nomos accepted a local write without returning its stable intent identity. '
+        'The runtime and kernel release are incompatible.',
+      );
     }
     final plane = _eventPlane;
     // A locally accepted write is not current until custody convergence
@@ -1684,7 +1774,9 @@ class NomosBridge {
   }
 
   void _advanceOperationReceipts(
-      String workspace, Map<String, Object?> result) {
+    String workspace,
+    Map<String, Object?> result,
+  ) {
     final pending = _eventPlane._operationReceipts[workspace];
     if (pending == null || pending.isEmpty) return;
 
@@ -1703,12 +1795,14 @@ class NomosBridge {
   }
 
   bool _syncNeedsCredentialRefresh(
-      Map<String, Object?> message, Map<String, Object?> result) {
+    Map<String, Object?> message,
+    Map<String, Object?> result,
+  ) {
     final push = (result['pushError'] as Map?)?.cast<String, Object?>();
     final status = push?['status'];
     if (status == 401 || status == 403) return true;
-    final text =
-        '${message['error'] ?? ''} ${push?['error'] ?? ''}'.toLowerCase();
+    final text = '${message['error'] ?? ''} ${push?['error'] ?? ''}'
+        .toLowerCase();
     return text.contains('unauthenticated') ||
         text.contains('token expired') ||
         text.contains('invalid token');
@@ -1735,7 +1829,8 @@ class NomosBridge {
         final token = (await retained.signIn())?.trim() ?? '';
         if (token.isEmpty) {
           throw StateError(
-              'Nomos could not refresh the signed-in identity for background sync.');
+            'Nomos could not refresh the signed-in identity for background sync.',
+          );
         }
         await plane.session(workspace)._call('refreshCredentials', {
           'authToken': token,
@@ -1804,24 +1899,27 @@ class NomosBridge {
             const [])
         .map((e) => (e as Map).cast<String, Object?>())
         .map((w) {
-      final ws = w['workspace']?.toString() ?? '';
-      // `connected` is the app's own connect() truth; `parked`/resident come from the runner realm.
-      w['state'] = (w['parked'] == true)
-          ? 'parked'
-          : (connected.contains(ws) ? 'connected' : 'resident');
-      return w;
-    }).toList();
+          final ws = w['workspace']?.toString() ?? '';
+          // `connected` is the app's own connect() truth; `parked`/resident come from the runner realm.
+          w['state'] = (w['parked'] == true)
+              ? 'parked'
+              : (connected.contains(ws) ? 'connected' : 'resident');
+          return w;
+        })
+        .toList();
   }
 
   /// Framework-private plane persistence primitive. It snapshots exact local custody even when [workspace]
   /// was born in the kernel but no Dart runner session has ever acquired it. This does not connect, mount a
   /// tenant session, fetch from cloud, or grant authority; the serving realm exports its resident plane view.
   Future<({String workspace, String head, String? snapshot, bool unchanged})>
-      nomosInternalSnapshotWorkspace(String workspace, {String? ifHead}) async {
-    final r = _asMap(await _call('snapshotWorkspace', {
-      'workspace': workspace,
-      if (ifHead != null && ifHead.isNotEmpty) 'ifHead': ifHead,
-    }));
+  nomosInternalSnapshotWorkspace(String workspace, {String? ifHead}) async {
+    final r = _asMap(
+      await _call('snapshotWorkspace', {
+        'workspace': workspace,
+        if (ifHead != null && ifHead.isNotEmpty) 'ifHead': ifHead,
+      }),
+    );
     return (
       workspace: (r['workspace'] ?? workspace).toString(),
       head: (r['head'] ?? '').toString(),
@@ -1833,51 +1931,55 @@ class NomosBridge {
   /// Open a workspace on this plane: boot its LOCAL githolon under the installed law (from [restoreFrom]
   /// custody, or a cloud pull when [cloud] is given). This is the sugar the single-workspace path uses; a
   /// multi-workspace app names a [session] per workspace and holds their [session] handles.
-  Future<void> connect(
-      {String? cloud,
-      required String workspace,
-      String? clientId,
-      String? authToken,
-      String? authorSecret,
-      String? restoreFrom,
-      bool allowUnborn = false,
-      bool recover = false,
-      CustodyBreakPolicy? onCustodyBreak,
-      String? session,
-      int? maxMounted}) async {
+  Future<void> connect({
+    String? cloud,
+    required String workspace,
+    String? clientId,
+    String? authToken,
+    String? authorSecret,
+    String? restoreFrom,
+    bool allowUnborn = false,
+    bool recover = false,
+    CustodyBreakPolicy? onCustodyBreak,
+    String? session,
+    int? maxMounted,
+  }) async {
     final ws = session ?? workspace;
     // Record the session name ONLY on a SUCCESSFUL open. Adding it before the await left a PHANTOM session
     // behind on a failed connect (a corrupt restoreFrom, an unreachable cloud): acquireSession/follow fast-path
     // on `_sessionNames.contains` and would hand back a dead handle whose every op refuses "session not
     // connected", and ifAbsentCredentials would never fire. The `_call` throwing skips the add below.
-    final r = _asMap(await _call('connect', {
-      // [cloud] is OPTIONAL — omit it to open a LOCAL-ONLY workspace (a local githolon with no cloud
-      // counterpart; the runner uses a `local://` sentinel and sync is a no-op). Pass it to make the
-      // workspace cloud-bound (per-workspace sync posture). A device's plane freely mixes both.
-      if (cloud != null) 'cloud': cloud,
-      'workspace': workspace,
-      // MULTI-WORKSPACE: name the [session] this connect opens on this device's local plane (default =
-      // [workspace]). Omitted on the single-workspace sugar path (byte-identical wire to before).
-      if (session != null) 'session': session,
-      if (clientId != null) 'clientId': clientId,
-      if (authToken != null) 'authToken': authToken,
-      // The device signing secret (base64, from [authorKeygen]) — the warrant default for every offer.
-      // Stays client-side; the kernel mints the signed-author attestation so authorship is replay-provable.
-      if (authorSecret != null) 'authorSecret': authorSecret,
-      if (restoreFrom != null) 'restoreFrom': restoreFrom,
-      if (allowUnborn) 'allowUnborn': true,
-      // the realm's mounted-workspace budget (LRU park/remount above it) — first connect wins.
-      if (maxMounted != null) 'maxMounted': maxMounted,
-      // RECOVER-IN-PLACE over a corrupt restoreFrom snapshot: salvage local-only writes + DLQ, refold fresh
-      // from cloud, re-offer the salvaged work. The report lands on [lastRecovery]. Nothing local is lost.
-      if (recover) 'recover': true,
-      // CUSTODY-BREAK POLICY (rebirth_and_custody_lifecycle.md): "adopt"/"reject" decide automatically;
-      // "ask" surfaces the break on [custodyEvents] (kind "ask") and awaits [resolveCustodyBreak]. Omitted ⇒
-      // fail closed (the break surfaces as an error on the sync/pull that hit it; the holon stays local).
-      if (onCustodyBreak != null) 'onCustodyBreak': onCustodyBreak.wire,
-    }));
-    _eventPlane._sessionNames
-        .add(ws); // the open succeeded — the session is real now
+    final r = _asMap(
+      await _call('connect', {
+        // [cloud] is OPTIONAL — omit it to open a LOCAL-ONLY workspace (a local githolon with no cloud
+        // counterpart; the runner uses a `local://` sentinel and sync is a no-op). Pass it to make the
+        // workspace cloud-bound (per-workspace sync posture). A device's plane freely mixes both.
+        if (cloud != null) 'cloud': cloud,
+        'workspace': workspace,
+        // MULTI-WORKSPACE: name the [session] this connect opens on this device's local plane (default =
+        // [workspace]). Omitted on the single-workspace sugar path (byte-identical wire to before).
+        if (session != null) 'session': session,
+        if (clientId != null) 'clientId': clientId,
+        if (authToken != null) 'authToken': authToken,
+        // The device signing secret (base64, from [authorKeygen]) — the warrant default for every offer.
+        // Stays client-side; the kernel mints the signed-author attestation so authorship is replay-provable.
+        if (authorSecret != null) 'authorSecret': authorSecret,
+        if (restoreFrom != null) 'restoreFrom': restoreFrom,
+        if (allowUnborn) 'allowUnborn': true,
+        // the realm's mounted-workspace budget (LRU park/remount above it) — first connect wins.
+        if (maxMounted != null) 'maxMounted': maxMounted,
+        // RECOVER-IN-PLACE over a corrupt restoreFrom snapshot: salvage local-only writes + DLQ, refold fresh
+        // from cloud, re-offer the salvaged work. The report lands on [lastRecovery]. Nothing local is lost.
+        if (recover) 'recover': true,
+        // CUSTODY-BREAK POLICY (rebirth_and_custody_lifecycle.md): "adopt"/"reject" decide automatically;
+        // "ask" surfaces the break on [custodyEvents] (kind "ask") and awaits [resolveCustodyBreak]. Omitted ⇒
+        // fail closed (the break surfaces as an error on the sync/pull that hit it; the holon stays local).
+        if (onCustodyBreak != null) 'onCustodyBreak': onCustodyBreak.wire,
+      }),
+    );
+    _eventPlane._sessionNames.add(
+      ws,
+    ); // the open succeeded — the session is real now
     // Opening succeeded, but scoped metrics have not yet proved that this
     // workspace is current. Unknown readiness must fail closed: otherwise a
     // generated `whenCurrent()` can observe the default idle value and return
@@ -1893,8 +1995,8 @@ class NomosBridge {
     if (authorSecret != null && authorSecret.isNotEmpty) {
       _eventPlane._sessionAuthorSecrets[ws] = authorSecret;
     }
-    _eventPlane._lastRecovery =
-        (r['recovery'] as Map?)?.cast<String, Object?>();
+    _eventPlane._lastRecovery = (r['recovery'] as Map?)
+        ?.cast<String, Object?>();
     if (_eventPlane._syncStatusCtrl.hasListener) {
       unawaited(_eventPlane._pollMetricsOnce());
     }
@@ -1918,21 +2020,30 @@ class NomosBridge {
   /// Where a session sits on the custody spectrum (incarnation, posture, pending/salvaged local work,
   /// supersession history) — for a status banner or a "you're offline on old truth" indicator.
   Future<NomosCustodyStatus> custodyStatus({String? session}) async =>
-      NomosCustodyStatus.fromJson(_asMap(await _call(
-          'custodyStatus', {if (session != null) 'session': session})));
+      NomosCustodyStatus.fromJson(
+        _asMap(
+          await _call('custodyStatus', {
+            if (session != null) 'session': session,
+          }),
+        ),
+      );
 
   /// Continue an `ask`-policy custody break with the user's decision (adopt|reject) — the async UX lane.
-  Future<Map<String, Object?>> resolveCustodyBreak(String decision,
-          {String? session}) async =>
-      _asMap(await _call('resolveCustodyBreak', {
-        'decision': decision,
-        if (session != null) 'session': session,
-      }));
+  Future<Map<String, Object?>> resolveCustodyBreak(
+    String decision, {
+    String? session,
+  }) async => _asMap(
+    await _call('resolveCustodyBreak', {
+      'decision': decision,
+      if (session != null) 'session': session,
+    }),
+  );
 
   /// The parked salvaged intents (re-offerable local work an `adopt` rescued) — metadata only.
   Future<List<Map<String, Object?>>> salvagedIntents({String? session}) async {
-    final r = _asMap(await _call(
-        'salvagedIntents', {if (session != null) 'session': session}));
+    final r = _asMap(
+      await _call('salvagedIntents', {if (session != null) 'session': session}),
+    );
     return ((r['salvaged'] as List?) ?? const [])
         .map((e) => (e as Map).cast<String, Object?>())
         .toList();
@@ -1940,16 +2051,26 @@ class NomosBridge {
 
   /// Re-offer parked salvaged work under the current (adopted) law — the explicit app move (never automatic
   /// across incarnations). [id] re-offers one; omitted re-offers all.
-  Future<Map<String, Object?>> reofferSalvaged(
-          {String? id, String? session}) async =>
-      _asMap(await _call('reofferSalvaged',
-          {if (id != null) 'id': id, if (session != null) 'session': session}));
+  Future<Map<String, Object?>> reofferSalvaged({
+    String? id,
+    String? session,
+  }) async => _asMap(
+    await _call('reofferSalvaged', {
+      if (id != null) 'id': id,
+      if (session != null) 'session': session,
+    }),
+  );
 
   /// Discard one parked salvaged intent — the app's explicit choice.
-  Future<Map<String, Object?>> discardSalvaged(String id,
-          {String? session}) async =>
-      _asMap(await _call('discardSalvaged',
-          {'id': id, if (session != null) 'session': session}));
+  Future<Map<String, Object?>> discardSalvaged(
+    String id, {
+    String? session,
+  }) async => _asMap(
+    await _call('discardSalvaged', {
+      'id': id,
+      if (session != null) 'session': session,
+    }),
+  );
 
   // ── THE DEAD-LETTER QUEUE (refused-but-legitimate work is NEVER lost) — the Dart mirror of the
   //   JS holon's DLQ surface (`deadLetters()` / `retryDeadLetter()` / `discardDeadLetter()`). A
@@ -1961,7 +2082,8 @@ class NomosBridge {
   /// the intent bytes stay in the durable queue.
   Future<List<Map<String, Object?>>> deadLetters({String? session}) async {
     final r = _asMap(
-        await _call('deadLetters', {if (session != null) 'session': session}));
+      await _call('deadLetters', {if (session != null) 'session': session}),
+    );
     return ((r['dead'] as List?) ?? const [])
         .map((e) => (e as Map).cast<String, Object?>())
         .toList();
@@ -1970,16 +2092,26 @@ class NomosBridge {
   /// Retry one dead letter (after the law fix landed): pulls canon first (it may already be
   /// admitted), else re-offers the parked bytes locally. `{ok, head?|alreadyOnMain?|error?}` —
   /// a refusal leaves the entry parked (with the fresh error), never lost.
-  Future<Map<String, Object?>> retryDeadLetter(String id,
-          {String? session}) async =>
-      _asMap(await _call('retryDeadLetter',
-          {'id': id, if (session != null) 'session': session}));
+  Future<Map<String, Object?>> retryDeadLetter(
+    String id, {
+    String? session,
+  }) async => _asMap(
+    await _call('retryDeadLetter', {
+      'id': id,
+      if (session != null) 'session': session,
+    }),
+  );
 
   /// Discard one dead letter — the app's EXPLICIT choice to drop the work. `{ok}`.
-  Future<Map<String, Object?>> discardDeadLetter(String id,
-          {String? session}) async =>
-      _asMap(await _call('discardDeadLetter',
-          {'id': id, if (session != null) 'session': session}));
+  Future<Map<String, Object?>> discardDeadLetter(
+    String id, {
+    String? session,
+  }) async => _asMap(
+    await _call('discardDeadLetter', {
+      'id': id,
+      if (session != null) 'session': session,
+    }),
+  );
 
   /// SALVAGE — best-effort extraction of this holon's local-only authored work (un-synced pending
   /// writes + the DLQ), each with its full `changeB64` bytes: `{pendingWrites, deadLetters}`. The
@@ -1990,15 +2122,17 @@ class NomosBridge {
   /// ABSORB salvaged work into THIS holon: pending writes are re-offered under the current law
   /// (a refusal dead-letters — never lost), and dead-letter entries are re-queued into the DLQ.
   /// Returns the recovery report `{salvagedWrites, requeuedDeadLetters, unsalvageable}`.
-  Future<Map<String, Object?>> absorbSalvage(
-          {List<Map<String, Object?>> pendingWrites = const [],
-          List<Map<String, Object?>> deadLetters = const [],
-          String? session}) async =>
-      _asMap(await _call('absorbSalvage', {
-        'pendingWrites': pendingWrites,
-        'deadLetters': deadLetters,
-        if (session != null) 'session': session,
-      }));
+  Future<Map<String, Object?>> absorbSalvage({
+    List<Map<String, Object?>> pendingWrites = const [],
+    List<Map<String, Object?>> deadLetters = const [],
+    String? session,
+  }) async => _asMap(
+    await _call('absorbSalvage', {
+      'pendingWrites': pendingWrites,
+      'deadLetters': deadLetters,
+      if (session != null) 'session': session,
+    }),
+  );
 
   /// The salvage report from the most recent `connect(recover: true)` — `{ salvagedWrites, requeuedDeadLetters,
   /// unsalvageable }`, or null if the connection didn't recover. Show "recovered N writes" / surface
@@ -2008,9 +2142,10 @@ class NomosBridge {
 
   /// LOCAL-FIRST offer: carry opaque intent bytes into the GitHolon. Returns the new local head; durable on [sync].
   @Deprecated(
-      'Engine-level generic writes are the footgun (session_bound_clients.md ask 1/7): '
-      'dispatch through a generated <Domain>Client bound to a NomosSession '
-      '(XClient.bind(session)). Retained for CLIs/admin tooling/generated internals only.')
+    'Engine-level generic writes are the footgun (session_bound_clients.md ask 1/7): '
+    'dispatch through a generated <Domain>Client bound to a NomosSession '
+    '(XClient.bind(session)). Retained for CLIs/admin tooling/generated internals only.',
+  )
   Future<String> offer({required String intentBytes}) async {
     final r = _asMap(await _call('offer', {'intentBytes': intentBytes}));
     return r['head'].toString();
@@ -2025,10 +2160,11 @@ class NomosBridge {
   /// inject evidence. [force] carries the deploy/evolve force flag through. [session] pins the workspace in
   /// a cluster harness (absent ⇒ the runner's sole-session default).
   @Deprecated(
-      'Engine-level string-y writes are the footgun (session_bound_clients.md ask 1/7): '
-      'dispatch through a generated <Domain>Client bound to a NomosSession '
-      '(XClient.bind(session) — no domain/directive strings at call sites). '
-      'Retained for CLIs/admin tooling/generated internals only.')
+    'Engine-level string-y writes are the footgun (session_bound_clients.md ask 1/7): '
+    'dispatch through a generated <Domain>Client bound to a NomosSession '
+    '(XClient.bind(session) — no domain/directive strings at call sites). '
+    'Retained for CLIs/admin tooling/generated internals only.',
+  )
   Future<String> offerDirective({
     required String domain,
     required String directiveId,
@@ -2043,20 +2179,22 @@ class NomosBridge {
     String? authorSecret,
     NomosBirthCertificate? birthCertificate,
   }) async {
-    final r = _asMap(await _call('offerDirective', {
-      'domain': domain,
-      'directiveId': directiveId,
-      'payload': payload,
-      if (actor != null) 'actor': actor,
-      if (domainHash != null) 'domainHash': domainHash,
-      if (nomosConflictSnapshots != null)
-        '__nomosConflictSnapshots': nomosConflictSnapshots,
-      if (force != null) 'force': force,
-      if (session != null) 'session': session,
-      if (authorSecret != null) 'authorSecret': authorSecret,
-      if (birthCertificate != null)
-        'birthCertificate': birthCertificate.toWire(),
-    }));
+    final r = _asMap(
+      await _call('offerDirective', {
+        'domain': domain,
+        'directiveId': directiveId,
+        'payload': payload,
+        if (actor != null) 'actor': actor,
+        if (domainHash != null) 'domainHash': domainHash,
+        if (nomosConflictSnapshots != null)
+          '__nomosConflictSnapshots': nomosConflictSnapshots,
+        if (force != null) 'force': force,
+        if (session != null) 'session': session,
+        if (authorSecret != null) 'authorSecret': authorSecret,
+        if (birthCertificate != null)
+          'birthCertificate': birthCertificate.toWire(),
+      }),
+    );
     return r['head'].toString();
   }
 
@@ -2065,9 +2203,10 @@ class NomosBridge {
   /// generated create method returns the typed id with NO query-after round-trip. [created] is empty for
   /// pure mutations.
   @Deprecated(
-      'Engine-level string-y writes are the footgun (session_bound_clients.md ask 1/7): '
-      'dispatch through a generated <Domain>Client bound to a NomosSession. '
-      'Retained for CLIs/admin tooling/generated internals only.')
+    'Engine-level string-y writes are the footgun (session_bound_clients.md ask 1/7): '
+    'dispatch through a generated <Domain>Client bound to a NomosSession. '
+    'Retained for CLIs/admin tooling/generated internals only.',
+  )
   Future<NomosOfferOutcome> offerCreates({
     required String domain,
     required String directiveId,
@@ -2079,19 +2218,18 @@ class NomosBridge {
     String? session,
     String? authorSecret,
     NomosBirthCertificate? birthCertificate,
-  }) =>
-      offerOutcome(
-        domain: domain,
-        directiveId: directiveId,
-        payload: payload,
-        actor: actor,
-        domainHash: domainHash,
-        nomosConflictSnapshots: nomosConflictSnapshots,
-        force: force,
-        session: session,
-        authorSecret: authorSecret,
-        birthCertificate: birthCertificate,
-      );
+  }) => offerOutcome(
+    domain: domain,
+    directiveId: directiveId,
+    payload: payload,
+    actor: actor,
+    domainHash: domainHash,
+    nomosConflictSnapshots: nomosConflictSnapshots,
+    force: force,
+    session: session,
+    authorSecret: authorSecret,
+    birthCertificate: birthCertificate,
+  );
 
   /// THE ONE OUTCOME-RETURNING OFFER LANE — [offerDirective] answering the full typed [NomosOfferOutcome]
   /// (head + law-minted `created` NomosRefs + births), for EVERY generated method (create or mutate). A pure
@@ -2121,23 +2259,29 @@ class NomosBridge {
     // attributable breakdown of one offer with no new API.
     final t0 = DateTime.now().millisecondsSinceEpoch;
     try {
-      r = _asMap(await _call('offerDirective', {
-        'domain': domain,
-        'directiveId': directiveId,
-        'payload': payload,
-        if (actor != null) 'actor': actor,
-        if (domainHash != null) 'domainHash': domainHash,
-        if (nomosConflictSnapshots != null)
-          '__nomosConflictSnapshots': nomosConflictSnapshots,
-        if (force != null) 'force': force,
-        if (session != null) 'session': session,
-        if (authorSecret != null) 'authorSecret': authorSecret,
-        if (birthCertificate != null)
-          'birthCertificate': birthCertificate.toWire(),
-      }));
+      r = _asMap(
+        await _call('offerDirective', {
+          'domain': domain,
+          'directiveId': directiveId,
+          'payload': payload,
+          if (actor != null) 'actor': actor,
+          if (domainHash != null) 'domainHash': domainHash,
+          if (nomosConflictSnapshots != null)
+            '__nomosConflictSnapshots': nomosConflictSnapshots,
+          if (force != null) 'force': force,
+          if (session != null) 'session': session,
+          if (authorSecret != null) 'authorSecret': authorSecret,
+          if (birthCertificate != null)
+            'birthCertificate': birthCertificate.toWire(),
+        }),
+      );
     } catch (e) {
-      throw await _wrapDomainNotInstalled(e,
-          domain: domain, domainHash: domainHash, requestedWorkspace: session);
+      throw await _wrapDomainNotInstalled(
+        e,
+        domain: domain,
+        domainHash: domainHash,
+        requestedWorkspace: session,
+      );
     }
     final t1 = DateTime.now().millisecondsSinceEpoch;
     final timing = r['timing'];
@@ -2150,17 +2294,19 @@ class NomosBridge {
         }
 
         noteLocalSpan(
-            track: 'submit',
-            name: 'offer: bridge ipc (up-leg)',
-            kind: 'bridge-ipc',
-            t0: t0,
-            t1: within(recv));
+          track: 'submit',
+          name: 'offer: bridge ipc (up-leg)',
+          kind: 'bridge-ipc',
+          t0: t0,
+          t1: within(recv),
+        );
         noteLocalSpan(
-            track: 'submit',
-            name: 'offer: response delivery (down-leg)',
-            kind: 'response-delivery',
-            t0: within(done),
-            t1: t1);
+          track: 'submit',
+          name: 'offer: response delivery (down-leg)',
+          kind: 'response-delivery',
+          t0: within(done),
+          t1: t1,
+        );
       }
     }
     final births = ((r['birthOutcomes'] as List?) ?? const [])
@@ -2182,8 +2328,9 @@ class NomosBridge {
     final bornRaw = (r['born'] as List?);
     final bornNames = <String>[
       if (bornRaw != null)
-        ...bornRaw
-            .map((e) => (e is Map ? (e['workspace'] ?? '') : e).toString())
+        ...bornRaw.map(
+          (e) => (e is Map ? (e['workspace'] ?? '') : e).toString(),
+        )
       else
         ...births
             .map((m) => (m['workspace'] ?? '').toString())
@@ -2196,7 +2343,8 @@ class NomosBridge {
       }
     }
     final sourceSession = session ?? _sessionName;
-    final birthAuthorSecret = authorSecret ??
+    final birthAuthorSecret =
+        authorSecret ??
         (sourceSession == null
             ? null
             : _eventPlane._sessionAuthorSecrets[sourceSession]);
@@ -2219,17 +2367,23 @@ class NomosBridge {
       workspace: ws,
       created: ((r['created'] as List?) ?? const [])
           .whereType<Map>()
-          .map((m) => NomosCreated(
+          .map(
+            (m) => NomosCreated(
               type: (m['type'] ?? '').toString(),
               id: (m['id'] ?? '').toString(),
-              workspace: ws))
+              workspace: ws,
+            ),
+          )
           .toList(),
       affected: ((r['affected'] as List?) ?? const [])
           .whereType<Map>()
-          .map((m) => NomosCreated(
+          .map(
+            (m) => NomosCreated(
               type: (m['type'] ?? '').toString(),
               id: (m['id'] ?? '').toString(),
-              workspace: ws))
+              workspace: ws,
+            ),
+          )
           .toList(),
       born: bornNames,
       birthOutcomes: births,
@@ -2241,12 +2395,16 @@ class NomosBridge {
   /// context (which session, what it actually runs, the likely causes) — the string itself
   /// originates in the sealed kernel, so the bridge (not the kernel) owns the ergonomics.
   /// Anything that isn't that refusal passes through unchanged.
-  Future<Object> _wrapDomainNotInstalled(Object e,
-      {required String domain,
-      String? domainHash,
-      String? requestedWorkspace}) async {
-    if (!RegExp(r"no active installed law declares domain '")
-        .hasMatch(e.toString())) return e;
+  Future<Object> _wrapDomainNotInstalled(
+    Object e, {
+    required String domain,
+    String? domainHash,
+    String? requestedWorkspace,
+  }) async {
+    if (!RegExp(
+      r"no active installed law declares domain '",
+    ).hasMatch(e.toString()))
+      return e;
     final self = this;
     final sessionWs = self is NomosSession ? self.workspace : null;
     var activeKeys = const <String>[];
@@ -2272,8 +2430,9 @@ class NomosBridge {
   /// installed package, read off the LOCAL projection (offline). Keys = the ACTIVE domain keys the
   /// workspace serves. Null when no on-ledger interface is observed yet (pre-#72e law).
   Future<Map<String, Object?>?> interfaceOffer({String? session}) async {
-    final r = _asMap(await _call(
-        'interfaceOffer', {if (session != null) 'session': session}));
+    final r = _asMap(
+      await _call('interfaceOffer', {if (session != null) 'session': session}),
+    );
     return (r['offer'] as Map?)?.cast<String, Object?>();
   }
 
@@ -2301,26 +2460,32 @@ class NomosBridge {
   /// cloud (omit for the local plane — a locally-born child mounts in place, no re-clone).
   /// [authorSecret] — the device signing key for the followed session's writes (era-0: an attested-born
   /// child is WARRANTED; write access needs its owner's enrolled device key).
-  Future<NomosSession> follow<TAggregate>(NomosRef<TAggregate> ref,
-      {String? cloud,
-      String? clientId,
-      String? authToken,
-      bool allowUnborn = false,
-      String? authorSecret}) async {
+  Future<NomosSession> follow<TAggregate>(
+    NomosRef<TAggregate> ref, {
+    String? cloud,
+    String? clientId,
+    String? authToken,
+    bool allowUnborn = false,
+    String? authorSecret,
+  }) async {
     final ws = NmsInternalNomosRefs.workspace(ref);
     if (ws.isEmpty) {
-      throw ArgumentError.value(ref, 'ref',
-          'follow: the NomosRef carries no workspace — only a workspace-complete ref is followable');
+      throw ArgumentError.value(
+        ref,
+        'ref',
+        'follow: the NomosRef carries no workspace — only a workspace-complete ref is followable',
+      );
     }
     if (!_sessionNames.contains(ws)) {
       await connect(
-          cloud: cloud,
-          workspace: ws,
-          session: ws,
-          clientId: clientId,
-          authToken: authToken,
-          allowUnborn: allowUnborn,
-          authorSecret: authorSecret);
+        cloud: cloud,
+        workspace: ws,
+        session: ws,
+        clientId: clientId,
+        authToken: authToken,
+        allowUnborn: allowUnborn,
+        authorSecret: authorSecret,
+      );
     }
     return session(ws);
   }
@@ -2339,10 +2504,12 @@ class NomosBridge {
   /// which every attested-born child is — refuses unsigned writes, so a locally-born child the app will
   /// WRITE to must be acquired with its owner's device key). Applies to the resident (local) open;
   /// the credentials path takes its own `NomosSessionCredentials.authorSecret` (falling back to this).
-  Future<NomosSession> acquireSession(String workspace,
-      {Future<NomosSessionCredentials> Function()? ifAbsentCredentials,
-      String? authorSecret,
-      String? inheritedPrincipal}) {
+  Future<NomosSession> acquireSession(
+    String workspace, {
+    Future<NomosSessionCredentials> Function()? ifAbsentCredentials,
+    String? authorSecret,
+    String? inheritedPrincipal,
+  }) {
     // Fast path: a live session needs no runner round-trip (and never asks for credentials).
     final plane = _eventPlane;
     final sourcePrincipal = inheritedPrincipal ?? principal;
@@ -2351,7 +2518,8 @@ class NomosBridge {
       final existing = plane._sessionPrincipals[workspace];
       if (existing != null && existing != sourcePrincipal) {
         throw StateError(
-            'acquireSession("$workspace"): the workspace is already bound to a different signed-in person');
+          'acquireSession("$workspace"): the workspace is already bound to a different signed-in person',
+        );
       }
       plane._sessionPrincipals[workspace] = sourcePrincipal;
       final source = _sessionName;
@@ -2389,41 +2557,43 @@ class NomosBridge {
       return ready(session(workspace));
     }
     // SINGLE-FLIGHT: one in-flight open per workspace per plane; concurrent callers join it.
-    return plane._acquiring.putIfAbsent(workspace, () async {
-      // RESIDENCY IS THE KERNEL'S TO DEMAND AND OURS TO SATISFY. Replaying a chain can reach a
-      // colocated read whose source workspace is not mounted; the kernel refuses TYPED, naming it.
-      // Mount the named sibling — which consults local custody first and only then clones — and
-      // retry. Bounded, and each name is satisfied at most once, so a genuinely missing workspace
-      // fails with the kernel's own refusal instead of spinning.
-      final satisfied = <String>{};
-      for (var round = 0;; round++) {
-        try {
-          return await _acquireSessionOnce(
-            workspace,
-            ready: ready,
-            inheritPrincipal: inheritPrincipal,
-            ifAbsentCredentials: ifAbsentCredentials,
-            authorSecret: authorSecret,
-          );
-        } catch (error) {
-          final required = nomosInternalResidencyRequiredWorkspace(error);
-          if (required == null ||
-              required == workspace ||
-              !satisfied.add(required) ||
-              round >= 8) {
-            rethrow;
+    return plane._acquiring
+        .putIfAbsent(workspace, () async {
+          // RESIDENCY IS THE KERNEL'S TO DEMAND AND OURS TO SATISFY. Replaying a chain can reach a
+          // colocated read whose source workspace is not mounted; the kernel refuses TYPED, naming it.
+          // Mount the named sibling — which consults local custody first and only then clones — and
+          // retry. Bounded, and each name is satisfied at most once, so a genuinely missing workspace
+          // fails with the kernel's own refusal instead of spinning.
+          final satisfied = <String>{};
+          for (var round = 0; ; round++) {
+            try {
+              return await _acquireSessionOnce(
+                workspace,
+                ready: ready,
+                inheritPrincipal: inheritPrincipal,
+                ifAbsentCredentials: ifAbsentCredentials,
+                authorSecret: authorSecret,
+              );
+            } catch (error) {
+              final required = nomosInternalResidencyRequiredWorkspace(error);
+              if (required == null ||
+                  required == workspace ||
+                  !satisfied.add(required) ||
+                  round >= 8) {
+                rethrow;
+              }
+              await acquireSession(
+                required,
+                ifAbsentCredentials: ifAbsentCredentials,
+                authorSecret: authorSecret,
+                inheritedPrincipal: sourcePrincipal,
+              );
+            }
           }
-          await acquireSession(
-            required,
-            ifAbsentCredentials: ifAbsentCredentials,
-            authorSecret: authorSecret,
-            inheritedPrincipal: sourcePrincipal,
-          );
-        }
-      }
-    }).whenComplete(() {
-      plane._acquiring.remove(workspace);
-    });
+        })
+        .whenComplete(() {
+          plane._acquiring.remove(workspace);
+        });
   }
 
   Future<NomosSession> _acquireSessionOnce(
@@ -2445,18 +2615,20 @@ class NomosBridge {
         // credentials (an explicitly local tool/test), preserve the local-only open.
         var resident = false;
         try {
-          resident = (await listWorkspaces())
-              .any((w) => w['workspace']?.toString() == workspace);
+          resident = (await listWorkspaces()).any(
+            (w) => w['workspace']?.toString() == workspace,
+          );
         } catch (_) {
           // a pre-connect plane has no registry yet — fall through to the credentials decision below.
         }
         if (resident) {
           if (ifAbsentCredentials == null) {
             await connect(
-                workspace: workspace,
-                session: workspace,
-                allowUnborn: true,
-                authorSecret: authorSecret);
+              workspace: workspace,
+              session: workspace,
+              allowUnborn: true,
+              authorSecret: authorSecret,
+            );
           } else {
             final c = await ifAbsentCredentials();
             await connect(
@@ -2496,8 +2668,9 @@ class NomosBridge {
         }
         if (ifAbsentCredentials == null) {
           throw StateError(
-              'acquireSession("$workspace"): the workspace is not on this device\'s plane and no '
-              'ifAbsentCredentials was given — a cloud open is genuinely required');
+            'acquireSession("$workspace"): the workspace is not on this device\'s plane and no '
+            'ifAbsentCredentials was given — a cloud open is genuinely required',
+          );
         }
         final c = await ifAbsentCredentials();
         await connect(
@@ -2519,9 +2692,7 @@ class NomosBridge {
   /// to this process-wide plane. Child opens consult it before cloning from
   /// cloud; the kernel remains the only component that can authenticate or
   /// interpret the returned bytes.
-  void nomosInternalRetainLocalCustodyLoader(
-    NomosLocalCustodyLoader loader,
-  ) {
+  void nomosInternalRetainLocalCustodyLoader(NomosLocalCustodyLoader loader) {
     _eventPlane._localCustodyLoader = loader;
   }
 
@@ -2535,8 +2706,10 @@ class NomosBridge {
   /// Refresh client-held credentials on this already-open workspace without
   /// replacing its resident holon or refolding custody. This grants no
   /// authority: every offer is still judged by the kernel's author gate.
-  Future<void> refreshCredentials(
-      {String? authToken, String? authorSecret}) async {
+  Future<void> refreshCredentials({
+    String? authToken,
+    String? authorSecret,
+  }) async {
     if (authToken == null && authorSecret == null) return;
     await _call('refreshCredentials', {
       if (authToken != null) 'authToken': authToken,
@@ -2557,12 +2730,16 @@ class NomosBridge {
 
   /// @internal The immutable genesis of a sibling custody chain. This is observational metadata used to
   /// compose an ordinary source-enrolment offer; the kernel still reopens and proves every foreign read.
-  Future<String> nomosWorkspaceGenesis(String workspace,
-          {String? session}) async =>
-      (_asMap(await _call('nomosWorkspaceGenesis', {
-                'workspace': workspace,
-                if (session != null) 'session': session,
-              }))['genesis'] ??
+  Future<String> nomosWorkspaceGenesis(
+    String workspace, {
+    String? session,
+  }) async =>
+      (_asMap(
+                await _call('nomosWorkspaceGenesis', {
+                  'workspace': workspace,
+                  if (session != null) 'session': session,
+                }),
+              )['genesis'] ??
               '')
           .toString();
 
@@ -2575,9 +2752,10 @@ class NomosBridge {
   /// the holon encodes the v2 offer envelope via the single codec and admits it. Returns the new local head.
   /// (This is the canonical name; [offerDirective] is the legacy alias the generated clients still call.)
   @Deprecated(
-      'Engine-level string-y writes are the footgun (session_bound_clients.md ask 1/7): '
-      'dispatch through a generated <Domain>Client bound to a NomosSession. '
-      'Retained for CLIs/admin tooling/generated internals only.')
+    'Engine-level string-y writes are the footgun (session_bound_clients.md ask 1/7): '
+    'dispatch through a generated <Domain>Client bound to a NomosSession. '
+    'Retained for CLIs/admin tooling/generated internals only.',
+  )
   Future<String> offerIntent({
     required String domain,
     required String directiveId,
@@ -2587,26 +2765,25 @@ class NomosBridge {
     List<Map<String, Object?>>? nomosConflictSnapshots,
     bool? force,
     String? session,
-  }) =>
-      offerDirective(
-          domain: domain,
-          directiveId: directiveId,
-          payload: payload,
-          actor: actor,
-          domainHash: domainHash,
-          nomosConflictSnapshots: nomosConflictSnapshots,
-          force: force,
-          session: session);
-
-  /// RELEASE COHERENCE — assert the connected cloud's kernel supports every capability this law needs (the
-  /// generated client passes its baked `requiresKernel`, e.g. `['compoundKeys']` for a compound-key query).
-  /// Throws a typed [KernelCoherenceError] on a skew (a stale/mismatched cloud kernel) with the named reason,
-  /// instead of an opaque deep-fold refusal. A best-effort no-op when the cloud advertises no capabilities
-  /// (older worker / offline). Called automatically by the generated client at bind; safe to call directly.
-  Future<void> assertKernelCoherence(List<String> requiresKernel,
-      {String? lawHash, String? session}) async {
+  }) => offerDirective(
+    domain: domain,
+    directiveId: directiveId,
+    payload: payload,
+    actor: actor,
+    domainHash: domainHash,
+    nomosConflictSnapshots: nomosConflictSnapshots,
+    force: force,
+    session: session,
+  );
+
+  /// Resolve the generated law's standard OSGi Contract Namespace requirements before bind.
+  Future<void> assertKernelCoherence(
+    List<Map<String, String>> kernelContracts, {
+    String? lawHash,
+    String? session,
+  }) async {
     await _call('assertKernelCoherence', {
-      'requiresKernel': requiresKernel,
+      'kernelContracts': kernelContracts,
       if (lawHash != null) 'lawHash': lawHash,
       if (session != null) 'session': session,
     });
@@ -2626,10 +2803,11 @@ class NomosBridge {
   /// The kernel looks up `(domain, directiveId)` in the ACTIVE installed law — [domain] must name the law
   /// that actually declares [directiveId], never assume `'workspaces'`.
   @Deprecated(
-      'Engine-level generic writes with a loose parent string are the footgun '
-      '(session_bound_clients.md asks 1/4/7): births go through the generated <Domain>Client '
-      'bound to the PARENT NomosSession (its birth method infers parent = the session workspace). '
-      'Retained for CLIs/admin tooling/generated compatibility shims only.')
+    'Engine-level generic writes with a loose parent string are the footgun '
+    '(session_bound_clients.md asks 1/4/7): births go through the generated <Domain>Client '
+    'bound to the PARENT NomosSession (its birth method infers parent = the session workspace). '
+    'Retained for CLIs/admin tooling/generated compatibility shims only.',
+  )
   Future<Map<String, Object?>> createWorkspace({
     required String parent,
     required String actor,
@@ -2645,20 +2823,26 @@ class NomosBridge {
     // a frontend dev never threads a key through.
     final Map<String, Object?> r;
     try {
-      r = _asMap(await _call('createWorkspace', {
-        'parent': parent,
-        'actor': actor,
-        if (authorSecret != null) 'authorSecret': authorSecret,
-        if (name != null) 'name': name,
-        if (payload != null) 'payload': payload,
-        'directiveId': directiveId,
-        'domain': domain,
-        if (domainHash != null) 'domainHash': domainHash,
-        if (authToken != null) 'authToken': authToken,
-      }));
+      r = _asMap(
+        await _call('createWorkspace', {
+          'parent': parent,
+          'actor': actor,
+          if (authorSecret != null) 'authorSecret': authorSecret,
+          if (name != null) 'name': name,
+          if (payload != null) 'payload': payload,
+          'directiveId': directiveId,
+          'domain': domain,
+          if (domainHash != null) 'domainHash': domainHash,
+          if (authToken != null) 'authToken': authToken,
+        }),
+      );
     } catch (e) {
-      throw await _wrapDomainNotInstalled(e,
-          domain: domain, domainHash: domainHash, requestedWorkspace: parent);
+      throw await _wrapDomainNotInstalled(
+        e,
+        domain: domain,
+        domainHash: domainHash,
+        requestedWorkspace: parent,
+      );
     }
     final verdict = (r['verdict'] as Map?)?.cast<String, Object?>() ?? r;
     // STRUCTURED AUTHZ REFUSAL (co2 DX): a refused relay used to surface only the generic 422 body.
@@ -2695,17 +2879,19 @@ class NomosBridge {
     String? authToken,
   }) async {
     // [authorSecret] defaults to the connection's signing key — the frontend dev never handles a key.
-    final r = _asMap(await _call('shareWith', {
-      'subject': subject,
-      'relation': relation,
-      if (authorSecret != null) 'authorSecret': authorSecret,
-      'asserterPrincipal': asserterPrincipal,
-      if (homeLawHash != null) 'homeLawHash': homeLawHash,
-      'object': object,
-      if (asserterWorkspace != null) 'asserterWorkspace': asserterWorkspace,
-      if (attestedAt != null) 'attestedAt': attestedAt,
-      if (authToken != null) 'authToken': authToken,
-    }));
+    final r = _asMap(
+      await _call('shareWith', {
+        'subject': subject,
+        'relation': relation,
+        if (authorSecret != null) 'authorSecret': authorSecret,
+        'asserterPrincipal': asserterPrincipal,
+        if (homeLawHash != null) 'homeLawHash': homeLawHash,
+        'object': object,
+        if (asserterWorkspace != null) 'asserterWorkspace': asserterWorkspace,
+        if (attestedAt != null) 'attestedAt': attestedAt,
+        if (authToken != null) 'authToken': authToken,
+      }),
+    );
     return (r['verdict'] as Map?)?.cast<String, Object?>() ?? r;
   }
 
@@ -2714,13 +2900,14 @@ class NomosBridge {
     List<String>? actions,
     String domain = '',
     String directiveId = 'undo',
-  }) async =>
-      _asMap(await _call('undoMostRecent', {
-        'scope': scope,
-        if (actions != null) 'actions': actions,
-        'domain': domain,
-        'directiveId': directiveId,
-      }));
+  }) async => _asMap(
+    await _call('undoMostRecent', {
+      'scope': scope,
+      if (actions != null) 'actions': actions,
+      'domain': domain,
+      'directiveId': directiveId,
+    }),
+  );
 
   /// REDO the most-recent undo (strike the strike → its target re-applies). Same [scope]/[domain]/[directiveId]
   /// as [undoMostRecent]. Returns `{ok, redone, head}`.
@@ -2728,12 +2915,13 @@ class NomosBridge {
     String scope = 'all',
     String domain = '',
     String directiveId = 'undo',
-  }) async =>
-      _asMap(await _call('redoMostRecent', {
-        'scope': scope,
-        'domain': domain,
-        'directiveId': directiveId,
-      }));
+  }) async => _asMap(
+    await _call('redoMostRecent', {
+      'scope': scope,
+      'domain': domain,
+      'directiveId': directiveId,
+    }),
+  );
 
   /// Framework-private business correction seam. Generated clients bind the domain, its actions and actor;
   /// application code supplies only the correction kind and its mandatory reason.
@@ -2744,15 +2932,16 @@ class NomosBridge {
     required String reason,
     String? domainHash,
     String? actor,
-  }) async =>
-      _asMap(await _call('correctMostRecent', {
-        'kind': kind,
-        'domain': domain,
-        'actions': actions,
-        'reason': reason,
-        if (domainHash != null) 'domainHash': domainHash,
-        if (actor != null) 'actor': actor,
-      }));
+  }) async => _asMap(
+    await _call('correctMostRecent', {
+      'kind': kind,
+      'domain': domain,
+      'actions': actions,
+      'reason': reason,
+      if (domainHash != null) 'domainHash': domainHash,
+      if (actor != null) 'actor': actor,
+    }),
+  );
 
   /// Framework-private exact-history adoption seam. Generated clients expose this as
   /// `model.adopt()` and, only when prior business outcomes differ, a chained
@@ -2762,11 +2951,13 @@ class NomosBridge {
     required String candidateHash,
     String? because,
   }) async {
-    final r = _asMap(await _call('adoptGeneratedModel', {
-      'domain': domain,
-      'candidateHash': candidateHash,
-      if (because != null) 'because': because,
-    }));
+    final r = _asMap(
+      await _call('adoptGeneratedModel', {
+        'domain': domain,
+        'candidateHash': candidateHash,
+        if (because != null) 'because': because,
+      }),
+    );
     return ((r['verdict'] as Map?) ?? const <String, Object?>{})
         .cast<String, Object?>();
   }
@@ -2794,11 +2985,13 @@ class NomosBridge {
     required String currentHash,
     String? because,
   }) async {
-    final r = _asMap(await _call('restorePreviousGeneratedModel', {
-      'domain': domain,
-      'currentHash': currentHash,
-      if (because != null) 'because': because,
-    }));
+    final r = _asMap(
+      await _call('restorePreviousGeneratedModel', {
+        'domain': domain,
+        'currentHash': currentHash,
+        if (because != null) 'because': because,
+      }),
+    );
     return ((r['verdict'] as Map?) ?? const <String, Object?>{})
         .cast<String, Object?>();
   }
@@ -2820,12 +3013,16 @@ class NomosBridge {
   /// DECODED directive payload; affected = the aggregate refs its sealed events touched). `base` = a commit-
   /// oid cursor (only intents newer than it); omitted = from the tip bounded by
   /// `limit` (default 200). Generic raw rows — the typed shaping is the codegen `renderActivity`.
-  Future<List<Map<String, dynamic>>> activityLog(
-      {String? base, int? limit}) async {
-    final r = _asMap(await _call('activityLog', {
-      if (base != null) 'base': base,
-      if (limit != null) 'limit': limit,
-    }));
+  Future<List<Map<String, dynamic>>> activityLog({
+    String? base,
+    int? limit,
+  }) async {
+    final r = _asMap(
+      await _call('activityLog', {
+        if (base != null) 'base': base,
+        if (limit != null) 'limit': limit,
+      }),
+    );
     return ((r['rows'] as List?) ?? const [])
         .map((e) => (e as Map).cast<String, dynamic>())
         .toList();
@@ -2842,10 +3039,16 @@ class NomosBridge {
 
   /// Watch the RUNTIME activity feed: a stream that re-emits the newest-first activity rows on every local
   /// change (doorbell/sync tick). `base` = a commit-oid cursor. Cancelling drops the watch on the runner.
-  Stream<List<dynamic>> watchActivity(
-          {String? base, int? limit, String? session}) =>
-      _watchStream(
-          kind: 'activity', base: base, limit: limit, session: session);
+  Stream<List<dynamic>> watchActivity({
+    String? base,
+    int? limit,
+    String? session,
+  }) => _watchStream(
+    kind: 'activity',
+    base: base,
+    limit: limit,
+    session: session,
+  );
 
   /// Mint an ed25519 DEVICE KEY in-kernel → `{secret, public}` (base64). The SECRET stays on this device
   /// (persist it in secure storage); pass it to [connect] as `authorSecret` (or per-offer `signWith`) so the
@@ -2866,9 +3069,18 @@ class NomosBridge {
   /// ed25519 PUBLIC half), parentId, epoch}`; `deviceSecret` is that key's base64 SECRET half, handed to the
   /// LOCAL kernel only (it never reaches a server). Returns typed authority evidence suitable for an offer.
   Future<NomosBirthCertificate> signBirthCert(
-          NomosBirthCertificateSpec spec, String deviceSecret) async =>
-      NomosBirthCertificate.fromWire(_asMap(_asMap(await _call('signBirthCert',
-          {'fields': spec.toWire(), 'deviceSecret': deviceSecret}))['cert']));
+    NomosBirthCertificateSpec spec,
+    String deviceSecret,
+  ) async => NomosBirthCertificate.fromWire(
+    _asMap(
+      _asMap(
+        await _call('signBirthCert', {
+          'fields': spec.toWire(),
+          'deviceSecret': deviceSecret,
+        }),
+      )['cert'],
+    ),
+  );
 
   /// MINT THE KEYLESS ENROLL-ONCE DELEGATION (`enrollFirstDevice.delegationCert`, the verified-first-device
   /// lane). The device SELF-signs it; its authority is the carried `idpToken` (the kernel re-verifies that to
@@ -2877,26 +3089,33 @@ class NomosBridge {
   /// keyless home is born with a malformed cert chain (the platform_cert falls into the delegation slot →
   /// `home cert founder != delegation cert founder` at the home's own verify door).
   Future<Map<String, Object?>> mintKeylessDelegation(
-          Map<String, Object?> spec, String deviceSecret) async =>
-      _asMap(await _call('mintKeylessDelegation', {
-        'spec': spec,
-        'deviceSecret': deviceSecret,
-      }))['cert'] as Map<String, Object?>? ??
+    Map<String, Object?> spec,
+    String deviceSecret,
+  ) async =>
+      _asMap(
+            await _call('mintKeylessDelegation', {
+              'spec': spec,
+              'deviceSecret': deviceSecret,
+            }),
+          )['cert']
+          as Map<String, Object?>? ??
       const {};
 
   /// ENROLL THIS DEVICE — the LIVE gate: bind a device key's PUBLIC half to `principal` on-chain as a
   /// `signer` so the holon's gate can PROVE this device's authorship on replay (and the VA chain attest it).
   /// `publicKey` is the base64 PUBLIC half (from [mintDeviceKey]); `authToken` (defaults to the connect-time
   /// bearer) is the VERIFIED identity that authorizes the enrollment. Returns the offer verdict.
-  Future<Map<String, Object?>> enrollDevice(
-          {required String principal,
-          required String publicKey,
-          String? authToken}) async =>
-      _asMap(await _call('enrollDevice', {
-        'principal': principal,
-        'publicKey': publicKey,
-        if (authToken != null) 'authToken': authToken,
-      }));
+  Future<Map<String, Object?>> enrollDevice({
+    required String principal,
+    required String publicKey,
+    String? authToken,
+  }) async => _asMap(
+    await _call('enrollDevice', {
+      'principal': principal,
+      'publicKey': publicKey,
+      if (authToken != null) 'authToken': authToken,
+    }),
+  );
 
   /// Derive the device key's base64 PUBLIC half from its base64 SECRET seed, inside the LOCAL kernel
   /// (the secret never leaves the device). The recovery lanes use this when only the secret was
@@ -2913,21 +3132,23 @@ class NomosBridge {
   /// Pass `remote: true` to force the CLOUD-gateway read even when this holon IS the parent — the
   /// seated barrier's proof-by-read: `enrolled: true` then means the shared chain durably holds this
   /// device's signer tuple, not merely that the local fold ran.
-  Future<Map<String, Object?>> parentSignerEnrollment(
-          {required String parent,
-          required String principal,
-          String? keyHash,
-          String? publicKey,
-          String? authToken,
-          bool remote = false}) async =>
-      _asMap(await _call('parentSignerEnrollment', {
-        'parent': parent,
-        'principal': principal,
-        if (keyHash != null) 'keyHash': keyHash,
-        if (publicKey != null) 'publicKey': publicKey,
-        if (authToken != null) 'authToken': authToken,
-        if (remote) 'remote': true,
-      }));
+  Future<Map<String, Object?>> parentSignerEnrollment({
+    required String parent,
+    required String principal,
+    String? keyHash,
+    String? publicKey,
+    String? authToken,
+    bool remote = false,
+  }) async => _asMap(
+    await _call('parentSignerEnrollment', {
+      'parent': parent,
+      'principal': principal,
+      if (keyHash != null) 'keyHash': keyHash,
+      if (publicKey != null) 'publicKey': publicKey,
+      if (authToken != null) 'authToken': authToken,
+      if (remote) 'remote': true,
+    }),
+  );
 
   /// IDEMPOTENT PARENT-SIGNER RECOVERY — ensure this device key is a live `signer` on `parent`,
   /// lawfully restoring the tuple a parent custody REBIRTH lost (the device key + the born home stay
@@ -2940,27 +3161,29 @@ class NomosBridge {
   /// (+ [verifiedVia], the parent's AuthProvider issuer); a PRE-WARRANT parent admits the founding
   /// `enrollSigner` (no token needed).
   /// Returns `{parent, principal, keyHash, enrolled, repaired, domain?, directiveId?, checkedAt}`.
-  Future<Map<String, Object?>> ensureParentSignerEnrollment(
-          {required String parent,
-          required String principal,
-          String? publicKey,
-          String? authorSecret,
-          String? domain,
-          String? directiveId,
-          String? authToken,
-          String? idToken,
-          String? verifiedVia}) async =>
-      _asMap(await _call('ensureParentSignerEnrollment', {
-        'parent': parent,
-        'principal': principal,
-        if (publicKey != null) 'publicKey': publicKey,
-        if (authorSecret != null) 'authorSecret': authorSecret,
-        if (domain != null) 'domain': domain,
-        if (directiveId != null) 'directiveId': directiveId,
-        if (authToken != null) 'authToken': authToken,
-        if (idToken != null) 'idToken': idToken,
-        if (verifiedVia != null) 'verifiedVia': verifiedVia,
-      }));
+  Future<Map<String, Object?>> ensureParentSignerEnrollment({
+    required String parent,
+    required String principal,
+    String? publicKey,
+    String? authorSecret,
+    String? domain,
+    String? directiveId,
+    String? authToken,
+    String? idToken,
+    String? verifiedVia,
+  }) async => _asMap(
+    await _call('ensureParentSignerEnrollment', {
+      'parent': parent,
+      'principal': principal,
+      if (publicKey != null) 'publicKey': publicKey,
+      if (authorSecret != null) 'authorSecret': authorSecret,
+      if (domain != null) 'domain': domain,
+      if (directiveId != null) 'directiveId': directiveId,
+      if (authToken != null) 'authToken': authToken,
+      if (idToken != null) 'idToken': idToken,
+      if (verifiedVia != null) 'verifiedVia': verifiedVia,
+    }),
+  );
 
   /// AUTHORING PREFLIGHT — evaluate the SAME premises the kernel's authorization gate judges,
   /// READ-ONLY, and return a typed verdict WITHOUT authoring — so the app catches a doomed write
@@ -2969,20 +3192,23 @@ class NomosBridge {
   /// `{ok, ws, directiveId, actor, keyHash, cause, causes, domain?, relation?, object?, error?, checkedAt}`
   /// where `cause` ∈ {directive-not-found, no-signing-key, missing-signer-enrollment, revoked-signer,
   /// missing-role, null}. Use [canAuthorTyped] on a [NomosSession] for the typed-error variant.
-  Future<Map<String, Object?>> canAuthor(String directiveId,
-          {String? ws,
-          String? principal,
-          String? publicKey,
-          String? keyHash,
-          String? authToken}) async =>
-      _asMap(await _call('canAuthor', {
-        'directiveId': directiveId,
-        if (ws != null) 'ws': ws,
-        if (principal != null) 'principal': principal,
-        if (publicKey != null) 'publicKey': publicKey,
-        if (keyHash != null) 'keyHash': keyHash,
-        if (authToken != null) 'authToken': authToken,
-      }));
+  Future<Map<String, Object?>> canAuthor(
+    String directiveId, {
+    String? ws,
+    String? principal,
+    String? publicKey,
+    String? keyHash,
+    String? authToken,
+  }) async => _asMap(
+    await _call('canAuthor', {
+      'directiveId': directiveId,
+      if (ws != null) 'ws': ws,
+      if (principal != null) 'principal': principal,
+      if (publicKey != null) 'publicKey': publicKey,
+      if (keyHash != null) 'keyHash': keyHash,
+      if (authToken != null) 'authToken': authToken,
+    }),
+  );
 
   /// VERIFY_CHAIN — the kernel's from-genesis self-verification of THIS holon's folded ledger (read-only:
   /// contiguity → every intent re-admitted through the ONE gate against the state folded from the prefix). For
@@ -2995,16 +3221,16 @@ class NomosBridge {
   /// Framework-private receiving-group setup. Generated application hosts own this ceremony; tenant code
   /// receives only the resulting business application.
   Future<Map<String, Object?>> nomosInternalBirthReceivingGroup(
-          Map<String, Object?> spec) async =>
-      _asMap(await _call('nomosInternalBirthReceivingGroup', spec));
+    Map<String, Object?> spec,
+  ) async => _asMap(await _call('nomosInternalBirthReceivingGroup', spec));
 
   /// Sign a cross-custody SHARE attestation `{secret, asserterWorkspace, object, relation, subject,
   /// attestedAt}` → `{publicKey, signature}`. This is what drives `recordShare` into an invitee's home
   /// (the free global invitation system): the granting workspace signs that it shares `object#relation`
   /// with `subject`, and the invitee's home gate verifies the signature before recording it.
   Future<Map<String, Object?>> attestationSign(
-          Map<String, Object?> args) async =>
-      _asMap(await _call('attestationSign', {'args': args}));
+    Map<String, Object?> args,
+  ) async => _asMap(await _call('attestationSign', {'args': args}));
 
   /// Issue a ROLE-DELEGATION cert (the `.delegatedRole()` lane, kernel `delegationCertSign` op). A platform
   /// signs — with its grantor secret `signerSecret` (base64) — a cert granting `relation` to `subject`,
@@ -3021,33 +3247,38 @@ class NomosBridge {
     required String subject,
     int epoch = 1,
     List<Object?>? certChain,
-  }) async =>
-      _asMap(await _call('issueDelegationCert', {
-        'args': {
-          'signerSecret': signerSecret,
-          'grantorId': grantorId,
-          'relation': relation,
-          'subject': subject,
-          'epoch': epoch,
-          if (certChain != null) 'certChain': certChain,
-        },
-      }));
+  }) async => _asMap(
+    await _call('issueDelegationCert', {
+      'args': {
+        'signerSecret': signerSecret,
+        'grantorId': grantorId,
+        'relation': relation,
+        'subject': subject,
+        'epoch': epoch,
+        if (certChain != null) 'certChain': certChain,
+      },
+    }),
+  );
 
   /// A declared query's rows from the local projection. `keys` (E2E sealing) injects the reader's held
   /// scope keys so encrypted fields AEAD-open in-wasm; absent ⇒ they stay opaque envelopes (today's
   /// behavior). `principal` stamps the private-read gate (defaults to the connection's bound principal).
   /// Both are OMITTED from the wire when absent, so a public un-keyed read is byte-identical to before.
-  Future<List<Map<String, dynamic>>> query(String queryId,
-      [Map<String, Object?> params = const {},
-      List<NomosScopeKey>? keys,
-      String? principal,
-      String? session]) async {
-    return _asRows(await _call('query', {
-      'queryId': queryId,
-      'params': params,
-      ...?_readAuthArgs(keys, principal),
-      if (session != null) 'session': session,
-    }));
+  Future<List<Map<String, dynamic>>> query(
+    String queryId, [
+    Map<String, Object?> params = const {},
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+  ]) async {
+    return _asRows(
+      await _call('query', {
+        'queryId': queryId,
+        'params': params,
+        ...?_readAuthArgs(keys, principal),
+        if (session != null) 'session': session,
+      }),
+    );
   }
 
   /// One bounded query page. Unlike [query], this never requires the kernel to materialize or serialize
@@ -3064,14 +3295,16 @@ class NomosBridge {
     if (pageSize < 1 || pageSize > 1000) {
       throw RangeError.range(pageSize, 1, 1000, 'pageSize');
     }
-    final result = _asMap(await _call('queryPage', {
-      'queryId': queryId,
-      'params': params,
-      'pageSize': pageSize,
-      if (cursor != null) 'cursor': cursor,
-      ...?_readAuthArgs(keys, principal),
-      if (session != null) 'session': session,
-    }));
+    final result = _asMap(
+      await _call('queryPage', {
+        'queryId': queryId,
+        'params': params,
+        'pageSize': pageSize,
+        if (cursor != null) 'cursor': cursor,
+        ...?_readAuthArgs(keys, principal),
+        if (session != null) 'session': session,
+      }),
+    );
     return NomosPage<Map<String, dynamic>>(
       rows: _asRows(result),
       cursor: result['cursor'] as String?,
@@ -3080,32 +3313,39 @@ class NomosBridge {
   }
 
   /// A single aggregate by id (the by-id read). `keys`/`principal`: see [query].
-  Future<List<Map<String, dynamic>>> queryById(String id,
-          [List<NomosScopeKey>? keys,
-          String? principal,
-          String? session]) async =>
-      _asRows(await _call('queryById', {
-        'id': id,
-        ...?_readAuthArgs(keys, principal),
-        if (session != null) 'session': session,
-      }));
+  Future<List<Map<String, dynamic>>> queryById(
+    String id, [
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+  ]) async => _asRows(
+    await _call('queryById', {
+      'id': id,
+      ...?_readAuthArgs(keys, principal),
+      if (session != null) 'session': session,
+    }),
+  );
 
   /// Compare an immutable publication pin with the stable series' one compiled
   /// current pointer. This is an O(current-state) check: it neither resolves the
   /// pinned publication nor reconstructs aggregate history.
-  Future<ReferenceVersionStatus<TVersion>>
-      checkReferenceVersion<TVersion, TSeries>(
-    VersionedNomosRef<TVersion, TSeries> reference,
-  ) async {
-    final result = _asMap(await _call('checkReferenceVersions', {
-      'refs': [
-        {
-          'pinned': NmsInternalNomosRefs.toJson(reference.pinned),
-          'series': NmsInternalNomosRefs.toJson(reference.series),
-          'currentField': NmsInternalVersionedNomosRefs.currentField(reference),
-        },
-      ],
-    }));
+  Future<ReferenceVersionStatus<TVersion>> checkReferenceVersion<
+    TVersion,
+    TSeries
+  >(VersionedNomosRef<TVersion, TSeries> reference) async {
+    final result = _asMap(
+      await _call('checkReferenceVersions', {
+        'refs': [
+          {
+            'pinned': NmsInternalNomosRefs.toJson(reference.pinned),
+            'series': NmsInternalNomosRefs.toJson(reference.series),
+            'currentField': NmsInternalVersionedNomosRefs.currentField(
+              reference,
+            ),
+          },
+        ],
+      }),
+    );
     final unique = result['unique'] as List?;
     final first = unique == null || unique.isEmpty
         ? const <String, Object?>{}
@@ -3130,10 +3370,12 @@ class NomosBridge {
   /// as `client.past.moments()`; callers pass the opaque [NomosMoment] back to `past.at(moment)` and never
   /// need to know that the framework uses commit identities underneath.
   Future<List<NomosMoment>> moments({int limit = 100, String? session}) async {
-    final r = _asMap(await _call('commits', {
-      'limit': limit,
-      if (session != null) 'session': session,
-    }));
+    final r = _asMap(
+      await _call('commits', {
+        'limit': limit,
+        if (session != null) 'session': session,
+      }),
+    );
     return ((r['commits'] as List?) ?? const [])
         .map((e) => NomosMoment.fromJson((e as Map).cast<String, Object?>()))
         .toList();
@@ -3141,56 +3383,80 @@ class NomosBridge {
 
   /// Run one declared business query against the verified world at [moment], without moving the live world.
   /// `keys`/`principal` have exactly the same private/encrypted-read semantics as [query].
-  Future<List<Map<String, dynamic>>> queryAt(NomosMoment moment, String queryId,
-          [Map<String, Object?> params = const {},
-          List<NomosScopeKey>? keys,
-          String? principal,
-          String? session]) async =>
-      _asRows(await _call('queryAt', {
-        'commit': moment.id,
-        'queryId': queryId,
-        'params': params,
-        ...?_readAuthArgs(keys, principal),
-        if (session != null) 'session': session,
-      }));
+  Future<List<Map<String, dynamic>>> queryAt(
+    NomosMoment moment,
+    String queryId, [
+    Map<String, Object?> params = const {},
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+  ]) async => _asRows(
+    await _call('queryAt', {
+      'commit': moment.id,
+      'queryId': queryId,
+      'params': params,
+      ...?_readAuthArgs(keys, principal),
+      if (session != null) 'session': session,
+    }),
+  );
 
   /// Read one aggregate from the verified world at [moment]. `keys`/`principal`: see [queryAt].
-  Future<List<Map<String, dynamic>>> queryByIdAt(NomosMoment moment, String id,
-          [List<NomosScopeKey>? keys,
-          String? principal,
-          String? session]) async =>
-      _asRows(await _call('queryByIdAt', {
-        'commit': moment.id,
-        'id': id,
-        ...?_readAuthArgs(keys, principal),
-        if (session != null) 'session': session,
-      }));
+  Future<List<Map<String, dynamic>>> queryByIdAt(
+    NomosMoment moment,
+    String id, [
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+  ]) async => _asRows(
+    await _call('queryByIdAt', {
+      'commit': moment.id,
+      'id': id,
+      ...?_readAuthArgs(keys, principal),
+      if (session != null) 'session': session,
+    }),
+  );
 
   /// Maintained historic count/sum values at [moment]. These are the temporal counterparts of [count]/[sum].
-  Future<int> countAt(NomosMoment moment, String countId,
-          [String group = '', String? session]) async =>
-      ((_asMap(await _call('countAt', {
-        'commit': moment.id,
-        'countId': countId,
-        'group': group,
-        if (session != null) 'session': session,
-      }))['count']) as num)
+  Future<int> countAt(
+    NomosMoment moment,
+    String countId, [
+    String group = '',
+    String? session,
+  ]) async =>
+      ((_asMap(
+                await _call('countAt', {
+                  'commit': moment.id,
+                  'countId': countId,
+                  'group': group,
+                  if (session != null) 'session': session,
+                }),
+              )['count'])
+              as num)
           .toInt();
 
-  Future<int> sumAt(NomosMoment moment, String sumId,
-          [String group = '', String? session]) async =>
-      ((_asMap(await _call('sumAt', {
-        'commit': moment.id,
-        'sumId': sumId,
-        'group': group,
-        if (session != null) 'session': session,
-      }))['sum']) as num)
+  Future<int> sumAt(
+    NomosMoment moment,
+    String sumId, [
+    String group = '',
+    String? session,
+  ]) async =>
+      ((_asMap(
+                await _call('sumAt', {
+                  'commit': moment.id,
+                  'sumId': sumId,
+                  'group': group,
+                  if (session != null) 'session': session,
+                }),
+              )['sum'])
+              as num)
           .toInt();
 
   /// The read auth sidecar (private reads + E2E): `keys`/`principal` as top-level call args, or null when
   /// neither is present (so the wire is byte-identical to before this existed).
   Map<String, Object?>? _readAuthArgs(
-      List<NomosScopeKey>? keys, String? principal) {
+    List<NomosScopeKey>? keys,
+    String? principal,
+  ) {
     final out = <String, Object?>{};
     if (principal != null && principal.isNotEmpty) out['principal'] = principal;
     if (keys != null && keys.isNotEmpty)
@@ -3207,33 +3473,41 @@ class NomosBridge {
 
   /// AUTHOR-SIDE SEAL: encrypt `plaintext` into its on-chain ciphertext envelope, bound to the scope + #58
   /// stable sids (rename-safe). Returns the envelope string the encrypted field value is written as.
-  Future<String> cryptoSealField(
-          {required String scopeKey,
-          required String scope,
-          required int epoch,
-          required String aggSid,
-          required String fieldSid,
-          required String plaintext}) async =>
-      (_asMap(await _call('cryptoSealField', {
-                'scopeKey': scopeKey,
-                'scope': scope,
-                'epoch': epoch,
-                'aggSid': aggSid,
-                'fieldSid': fieldSid,
-                'plaintext': plaintext,
-              }))['envelope'] ??
+  Future<String> cryptoSealField({
+    required String scopeKey,
+    required String scope,
+    required int epoch,
+    required String aggSid,
+    required String fieldSid,
+    required String plaintext,
+  }) async =>
+      (_asMap(
+                await _call('cryptoSealField', {
+                  'scopeKey': scopeKey,
+                  'scope': scope,
+                  'epoch': epoch,
+                  'aggSid': aggSid,
+                  'fieldSid': fieldSid,
+                  'plaintext': plaintext,
+                }),
+              )['envelope'] ??
               '')
           .toString();
 
   /// FRAMEWORK-INTERNAL `.owned()` key lane. The connected JS holon derives epoch 0 from its
   /// already-persisted device credential; generated clients call this without exposing key custody to apps.
-  Future<NomosScopeKey> nomosOwnedScopeKey(String scope,
-      {String? recordType, String? recordId}) async {
-    final out = _asMap(await _call('cryptoOwnedScopeKey', {
-      'scope': scope,
-      if (recordType != null && recordId != null)
-        'record': {'type': recordType, 'id': recordId},
-    }));
+  Future<NomosScopeKey> nomosOwnedScopeKey(
+    String scope, {
+    String? recordType,
+    String? recordId,
+  }) async {
+    final out = _asMap(
+      await _call('cryptoOwnedScopeKey', {
+        'scope': scope,
+        if (recordType != null && recordId != null)
+          'record': {'type': recordType, 'id': recordId},
+      }),
+    );
     return NomosScopeKey(
       scope: (out['scope'] ?? scope).toString(),
       epoch: (out['epoch'] as num?)?.toInt() ?? 0,
@@ -3245,30 +3519,38 @@ class NomosBridge {
 
   /// Every key epoch this principal currently holds for one owned record. Generated reads use the
   /// complete set so history remains readable after rotations, shares and transfers.
-  Future<List<NomosScopeKey>> nomosOwnedScopeKeys(String scope,
-      {required String recordType, required String recordId}) async {
-    final out = _asMap(await _call('cryptoOwnedScopeKeys', {
-      'scope': scope,
-      'record': {'type': recordType, 'id': recordId},
-    }));
+  Future<List<NomosScopeKey>> nomosOwnedScopeKeys(
+    String scope, {
+    required String recordType,
+    required String recordId,
+  }) async {
+    final out = _asMap(
+      await _call('cryptoOwnedScopeKeys', {
+        'scope': scope,
+        'record': {'type': recordType, 'id': recordId},
+      }),
+    );
     return (out['keys'] as List? ?? const [])
         .map((raw) => _asMap(raw))
-        .map((key) => NomosScopeKey(
-              scope: (key['scope'] ?? scope).toString(),
-              epoch: (key['epoch'] as num?)?.toInt() ?? 0,
-              key: (key['key'] ?? '').toString(),
-              ownedKeySubject: key['ownedKeySubject']?.toString(),
-              ownedCustody: key['ownedCustody']?.toString(),
-            ))
+        .map(
+          (key) => NomosScopeKey(
+            scope: (key['scope'] ?? scope).toString(),
+            epoch: (key['epoch'] as num?)?.toInt() ?? 0,
+            key: (key['key'] ?? '').toString(),
+            ownedKeySubject: key['ownedKeySubject']?.toString(),
+            ownedCustody: key['ownedCustody']?.toString(),
+          ),
+        )
         .toList();
   }
 
   /// Make this signed-in principal ready to receive record shares. Generated clients call this while
   /// binding; tenant code never handles a key, certificate or identity tuple.
-  Future<void> nomosEnsureOwnedIdentity(
-      {required String scope,
-      required String domain,
-      String? domainHash}) async {
+  Future<void> nomosEnsureOwnedIdentity({
+    required String scope,
+    required String domain,
+    String? domainHash,
+  }) async {
     await _call('cryptoOwnedEnsureIdentity', {
       'scope': scope,
       'domain': domain,
@@ -3282,39 +3564,49 @@ class NomosBridge {
     required String domain,
     required String domainHash,
     required String recoveryPrincipal,
-  }) async =>
-      _asMap(await _call('cryptoOwnedProtectIdentity', {
-        'scope': scope,
-        'domain': domain,
-        'domainHash': domainHash,
-        'recoveryPrincipal': recoveryPrincipal,
-      }));
+  }) async => _asMap(
+    await _call('cryptoOwnedProtectIdentity', {
+      'scope': scope,
+      'domain': domain,
+      'domainHash': domainHash,
+      'recoveryPrincipal': recoveryPrincipal,
+    }),
+  );
 
   /// Prepare the private framework payload behind generated share/unshare/transfer methods.
-  Future<Map<String, Object?>> nomosPrepareOwnedRecordAction<TAggregate>(
-          {required String action,
-          required String scope,
-          required NomosRef<TAggregate> record,
-          required String peer}) async =>
-      _asMap(await _call('cryptoOwnedPrepareRecordAction', {
-        'action': action,
-        'scope': scope,
-        'record': {
-          'type': NmsInternalNomosRefs.type(record),
-          'id': NmsInternalNomosRefs.id(record),
-        },
-        'peer': peer,
-      }));
+  Future<Map<String, Object?>> nomosPrepareOwnedRecordAction<TAggregate>({
+    required String action,
+    required String scope,
+    required NomosRef<TAggregate> record,
+    required String peer,
+  }) async => _asMap(
+    await _call('cryptoOwnedPrepareRecordAction', {
+      'action': action,
+      'scope': scope,
+      'record': {
+        'type': NmsInternalNomosRefs.type(record),
+        'id': NmsInternalNomosRefs.id(record),
+      },
+      'peer': peer,
+    }),
+  );
 
   /// FRAMEWORK-INTERNAL business birth: derive the unborn child's owned key from its deterministic address.
-  Future<NomosScopeKey> nomosOwnedBirthScopeKey(String scope, String namespace,
-      Object? key, String recordType, String recordId) async {
-    final out = _asMap(await _call('cryptoOwnedBirthScopeKey', {
-      'scope': scope,
-      'namespace': namespace,
-      'key': key,
-      'record': {'type': recordType, 'id': recordId},
-    }));
+  Future<NomosScopeKey> nomosOwnedBirthScopeKey(
+    String scope,
+    String namespace,
+    Object? key,
+    String recordType,
+    String recordId,
+  ) async {
+    final out = _asMap(
+      await _call('cryptoOwnedBirthScopeKey', {
+        'scope': scope,
+        'namespace': namespace,
+        'key': key,
+        'record': {'type': recordType, 'id': recordId},
+      }),
+    );
     return NomosScopeKey(
       scope: (out['scope'] ?? scope).toString(),
       epoch: (out['epoch'] as num?)?.toInt() ?? 0,
@@ -3327,64 +3619,88 @@ class NomosBridge {
 
   /// FRAMEWORK-INTERNAL: issue an opaque request for this session's current device.
   Future<String> nomosOwnedDeviceRequest(String scope) async =>
-      (_asMap(await _call('cryptoOwnedDeviceRequest', {'scope': scope}))[
-                  'request'] ??
+      (_asMap(
+                await _call('cryptoOwnedDeviceRequest', {'scope': scope}),
+              )['request'] ??
               '')
           .toString();
 
   /// FRAMEWORK-INTERNAL: validate an opaque request and prepare the atomic signer + custody offer.
   Future<Map<String, Object?>> nomosPrepareOwnedDeviceApproval(
-          String request, String scope) async =>
-      _asMap(await _call('cryptoOwnedPrepareApproval', {
-        'request': request,
-        'scope': scope,
-      }));
+    String request,
+    String scope,
+  ) async => _asMap(
+    await _call('cryptoOwnedPrepareApproval', {
+      'request': request,
+      'scope': scope,
+    }),
+  );
 
   /// Wrap a scope key TO a recipient's public key (committer side): `{hpkeEpk, ct}` base64 ciphertext.
-  Future<Map<String, Object?>> cryptoWrapKey(
-          {required String recipientPub, required String scopeKey}) async =>
-      _asMap(await _call('cryptoWrapKey',
-          {'recipientPub': recipientPub, 'scopeKey': scopeKey}));
+  Future<Map<String, Object?>> cryptoWrapKey({
+    required String recipientPub,
+    required String scopeKey,
+  }) async => _asMap(
+    await _call('cryptoWrapKey', {
+      'recipientPub': recipientPub,
+      'scopeKey': scopeKey,
+    }),
+  );
 
   /// Unwrap an on-chain WrappedKey with this device's secret → the base64 scope key (reader side).
-  Future<String> cryptoUnwrapKey(
-          {required String secret,
-          required String hpkeEpk,
-          required String ct}) async =>
-      (_asMap(await _call('cryptoUnwrapKey', {
-                'secret': secret,
-                'hpkeEpk': hpkeEpk,
-                'ct': ct
-              }))['scopeKey'] ??
+  Future<String> cryptoUnwrapKey({
+    required String secret,
+    required String hpkeEpk,
+    required String ct,
+  }) async =>
+      (_asMap(
+                await _call('cryptoUnwrapKey', {
+                  'secret': secret,
+                  'hpkeEpk': hpkeEpk,
+                  'ct': ct,
+                }),
+              )['scopeKey'] ??
               '')
           .toString();
 
   /// THE SPATIAL READ: rows of the declared spatial index's of-type whose geometry
   /// intersects [bbox] — an R*Tree probe on the local projection, same row shape as [query].
   Future<List<Map<String, dynamic>>> spatialWithin(
-          String spatialId, NomosBbox bbox,
-          [String? session]) async =>
-      _asRows(await _call('spatialWithin', {
-        'spatialId': spatialId,
-        'bbox': bbox.toJson(),
-        if (session != null) 'session': session,
-      }));
+    String spatialId,
+    NomosBbox bbox, [
+    String? session,
+  ]) async => _asRows(
+    await _call('spatialWithin', {
+      'spatialId': spatialId,
+      'bbox': bbox.toJson(),
+      if (session != null) 'session': session,
+    }),
+  );
 
   /// A maintained O(1) count / sum.
-  Future<int> count(String countId,
-          [String group = '', String? session]) async =>
-      ((_asMap(await _call('count', {
-        'countId': countId,
-        'group': group,
-        if (session != null) 'session': session,
-      }))['count']) as num)
+  Future<int> count(
+    String countId, [
+    String group = '',
+    String? session,
+  ]) async =>
+      ((_asMap(
+                await _call('count', {
+                  'countId': countId,
+                  'group': group,
+                  if (session != null) 'session': session,
+                }),
+              )['count'])
+              as num)
           .toInt();
   Future<int> sum(String sumId, [String group = '', String? session]) async =>
-      ((_asMap(await _call('sum', {
-        'sumId': sumId,
-        'group': group,
-        if (session != null) 'session': session,
-      }))['sum']) as num)
+      ((_asMap(
+                await _call('sum', {
+                  'sumId': sumId,
+                  'group': group,
+                  if (session != null) 'session': session,
+                }),
+              )['sum'])
+              as num)
           .toInt();
 
   /// THE PENDING-CONFLICTS READ (Surfaced merge conflicts — the DX layer): the MAINTAINED,
@@ -3394,35 +3710,43 @@ class NomosBridge {
   /// DERIVED, NOT DRAINED: a resolution write folding in removes its row by derivation.
   /// Empty for a Surfaced-free workspace. (The generated typed client wraps these rows as
   /// `PendingConflictRow` and pairs them with the designated `resolve…` helpers.)
-  Future<List<Map<String, dynamic>>> pendingConflicts(
-          [String? session]) async =>
-      _asRows(await _call('pendingConflicts', {
-        if (session != null) 'session': session,
-      }));
+  Future<List<Map<String, dynamic>>> pendingConflicts([
+    String? session,
+  ]) async => _asRows(
+    await _call('pendingConflicts', {if (session != null) 'session': session}),
+  );
 
   /// Framework-filtered pending conflicts for one generated aggregate type. This is the
   /// primitive generated clients use; application code never filters the heterogeneous queue.
-  Future<List<Map<String, dynamic>>> pendingConflictsFor(String aggregateType,
-          [String? session]) async =>
-      _asRows(await _call('pendingConflicts', {
-        'aggregateType': aggregateType,
-        if (session != null) 'session': session,
-      }));
+  Future<List<Map<String, dynamic>>> pendingConflictsFor(
+    String aggregateType, [
+    String? session,
+  ]) async => _asRows(
+    await _call('pendingConflicts', {
+      'aggregateType': aggregateType,
+      if (session != null) 'session': session,
+    }),
+  );
 
   /// Counts-only workspace summary over the maintained conflict index.
-  Future<Map<String, Object?>> pendingConflictSummary(
-          [String? session]) async =>
-      _asMap(await _call('pendingConflictSummary', {
-        if (session != null) 'session': session,
-      }));
+  Future<Map<String, Object?>> pendingConflictSummary([
+    String? session,
+  ]) async => _asMap(
+    await _call('pendingConflictSummary', {
+      if (session != null) 'session': session,
+    }),
+  );
 
   /// Push local writes → the session branch → cloud admission, and pull canonical main back.
-  Future<Map<String, Object?>> sync(
-          {bool admit = true, String? session}) async =>
-      _asMap(await _call('sync', {
-        'admit': admit,
-        if (session != null) 'session': session,
-      }));
+  Future<Map<String, Object?>> sync({
+    bool admit = true,
+    String? session,
+  }) async => _asMap(
+    await _call('sync', {
+      'admit': admit,
+      if (session != null) 'session': session,
+    }),
+  );
 
   /// PERSIST: a base64 snapshot of the whole local holon (the bare nomos.git incl. un-synced writes + the
   /// DLQ). Store it on disk and pass it back as `connect(restoreFrom:)` next launch — the app then boots from
@@ -3439,12 +3763,15 @@ class NomosBridge {
   /// local write flushes the up leg at once; `fallbackMs` is only a just-in-case safety pull (default 60s).
   /// Each round arrives on [syncEvents] as `{ event:'sync', reason, result }`; socket state as `{event:'link'}`.
   /// Call once after [connect] — then the app never polls.
-  Future<void> autoSync(
-      {int? debounceMs, int? fallbackMs, String? signalId}) async {
+  Future<void> autoSync({
+    int? debounceMs,
+    int? fallbackMs,
+    String? signalId,
+  }) async {
     await _call('autoSync', {
       if (debounceMs != null) 'debounceMs': debounceMs,
       if (fallbackMs != null) 'fallbackMs': fallbackMs,
-      if (signalId != null) 'signalId': signalId
+      if (signalId != null) 'signalId': signalId,
     });
     final workspace = _sessionName;
     if (workspace != null) _eventPlane._autoSyncSessions.add(workspace);
@@ -3482,16 +3809,16 @@ class NomosBridge {
         : _eventPlane._currentSessionStatus(session);
   }
 
-  Stream<SyncStatus> _sessionSyncStatus(String session) =>
-      _eventPlane._syncStatusBySession
-          .putIfAbsent(
-            session,
-            () => StreamController<SyncStatus>.broadcast(
-              onListen: () => _eventPlane._startSessionStatusPoll(session),
-              onCancel: _eventPlane._stopStatusPollIfUnused,
-            ),
-          )
-          .stream;
+  Stream<SyncStatus> _sessionSyncStatus(String session) => _eventPlane
+      ._syncStatusBySession
+      .putIfAbsent(
+        session,
+        () => StreamController<SyncStatus>.broadcast(
+          onListen: () => _eventPlane._startSessionStatusPoll(session),
+          onCancel: _eventPlane._stopStatusPollIfUnused,
+        ),
+      )
+      .stream;
 
   SyncStatus _currentSessionStatus(String session) =>
       _eventPlane._statusBySession[session] ?? const SyncStatus();
@@ -3534,14 +3861,17 @@ class NomosBridge {
       phase = SyncPhase.error;
     } else if (statuses.any((status) => status.phase == SyncPhase.offline)) {
       phase = SyncPhase.offline;
-    } else if (statuses
-        .any((status) => status.phase == SyncPhase.transferring)) {
+    } else if (statuses.any(
+      (status) => status.phase == SyncPhase.transferring,
+    )) {
       phase = SyncPhase.transferring;
     } else if (statuses.any(
-        (status) => status.phase == SyncPhase.behind || status.behind > 0)) {
+      (status) => status.phase == SyncPhase.behind || status.behind > 0,
+    )) {
       phase = SyncPhase.behind;
     } else if (statuses.any(
-        (status) => status.phase == SyncPhase.syncing || status.ahead > 0)) {
+      (status) => status.phase == SyncPhase.syncing || status.ahead > 0,
+    )) {
       phase = SyncPhase.syncing;
     } else {
       phase = SyncPhase.idle;
@@ -3553,9 +3883,10 @@ class NomosBridge {
         .map((status) => status.lastSyncedAt)
         .whereType<DateTime>()
         .fold<DateTime?>(
-            null,
-            (oldest, value) =>
-                oldest == null || value.isBefore(oldest) ? value : oldest);
+          null,
+          (oldest, value) =>
+              oldest == null || value.isBefore(oldest) ? value : oldest,
+        );
     final error = statuses
         .map((status) => status.lastError)
         .whereType<String>()
@@ -3565,17 +3896,19 @@ class NomosBridge {
         .whereType<TransferProgress>()
         .firstOrNull;
 
-    _pushStatus(SyncStatus(
-      phase: phase,
-      ahead: total((status) => status.ahead),
-      behind: total((status) => status.behind),
-      saved: total((status) => status.saved),
-      onMain: total((status) => status.onMain),
-      deadLetters: total((status) => status.deadLetters),
-      transfer: transfer,
-      lastSyncedAt: lastSynced,
-      lastError: error,
-    ));
+    _pushStatus(
+      SyncStatus(
+        phase: phase,
+        ahead: total((status) => status.ahead),
+        behind: total((status) => status.behind),
+        saved: total((status) => status.saved),
+        onMain: total((status) => status.onMain),
+        deadLetters: total((status) => status.deadLetters),
+        transfer: transfer,
+        lastSyncedAt: lastSynced,
+        lastError: error,
+      ),
+    );
   }
 
   void _startStatusPoll() {
@@ -3609,8 +3942,9 @@ class NomosBridge {
 
   void _stopStatusPollIfUnused() {
     if (_syncStatusCtrl.hasListener ||
-        _syncStatusBySession.values
-            .any((controller) => controller.hasListener)) {
+        _syncStatusBySession.values.any(
+          (controller) => controller.hasListener,
+        )) {
       return;
     }
     _stopStatusPoll();
@@ -3682,13 +4016,14 @@ class NomosBridge {
         // Counters prove custody debt, but they do not prove that a failed or
         // offline transport recovered. Only a subsequent successful sync/link
         // event may clear those lifecycle states.
-        final phase = current.transfer != null ||
+        final phase =
+            current.transfer != null ||
                 current.phase == SyncPhase.error ||
                 current.phase == SyncPhase.offline
             ? current.phase
             : (behind > 0
-                ? SyncPhase.behind
-                : (ahead > 0 ? SyncPhase.syncing : SyncPhase.idle));
+                  ? SyncPhase.behind
+                  : (ahead > 0 ? SyncPhase.syncing : SyncPhase.idle));
         _pushSessionStatus(
           session,
           current.copyWith(
@@ -3705,7 +4040,8 @@ class NomosBridge {
       _foldApplicationStatusFromSessions();
     } catch (e) {
       _pushStatus(
-          _status.copyWith(phase: SyncPhase.error, lastError: e.toString()));
+        _status.copyWith(phase: SyncPhase.error, lastError: e.toString()),
+      );
     }
   }
 
@@ -3758,7 +4094,7 @@ class NomosBridge {
           'kind': kind,
           't0': t0,
           if (head != null && head.isNotEmpty) 'head': head,
-        }
+        },
       },
       {
         'event': 'span',
@@ -3768,7 +4104,7 @@ class NomosBridge {
           'id': sid,
           't1': t1,
           if (head != null && head.isNotEmpty) 'head': head,
-        }
+        },
       },
     ]) {
       plane._spanBuffer.add(m);
@@ -3781,9 +4117,7 @@ class NomosBridge {
 
   /// Ledger size (commits) + branch-vs-main (ahead) + projection bytes — the dashboard's slow state.
   Future<Map<String, Object?>> metrics([String? session]) async =>
-      _asMap(await _call('metrics', {
-        if (session != null) 'session': session,
-      }));
+      _asMap(await _call('metrics', {if (session != null) 'session': session}));
 
   /// TIER-2 SYNC SIZE — how many bytes this workspace would transfer to catch up to main, WITHOUT downloading
   /// them (a HEAD on the serving pack; the host answers Content-Length only, cached ~15s). Sum across your open
@@ -3799,28 +4133,42 @@ class NomosBridge {
 
   /// Reactive local read: a stream of row-sets that re-emits on every local change. Cancelling the
   /// subscription tells the runner to drop the watch.
-  Stream<List<dynamic>> watch(String queryId,
-          [Map<String, Object?> params = const {},
-          String? session,
-          String? principal,
-          int? intervalMs]) =>
-      _watchStream(
-          kind: 'query',
-          queryId: queryId,
-          params: params,
-          session: session,
-          principal: principal,
-          intervalMs: intervalMs);
-  Stream<List<dynamic>> watchById(String id,
-          [String? session, String? principal]) =>
-      _watchStream(
-          kind: 'byId', id: id, session: session, principal: principal);
+  Stream<List<dynamic>> watch(
+    String queryId, [
+    Map<String, Object?> params = const {},
+    String? session,
+    String? principal,
+    int? intervalMs,
+  ]) => _watchStream(
+    kind: 'query',
+    queryId: queryId,
+    params: params,
+    session: session,
+    principal: principal,
+    intervalMs: intervalMs,
+  );
+  Stream<List<dynamic>> watchById(
+    String id, [
+    String? session,
+    String? principal,
+  ]) => _watchStream(
+    kind: 'byId',
+    id: id,
+    session: session,
+    principal: principal,
+  );
 
   /// Reactive SPATIAL read: re-emits the R*Tree probe's rows whenever they change locally.
-  Stream<List<dynamic>> watchSpatial(String spatialId, NomosBbox bbox,
-          [String? session]) =>
-      _watchStream(
-          kind: 'spatial', spatialId: spatialId, bbox: bbox, session: session);
+  Stream<List<dynamic>> watchSpatial(
+    String spatialId,
+    NomosBbox bbox, [
+    String? session,
+  ]) => _watchStream(
+    kind: 'spatial',
+    spatialId: spatialId,
+    bbox: bbox,
+    session: session,
+  );
 
   /// Reactive PENDING-CONFLICTS read: re-emits the maintained Surfaced "decisions needed"
   /// rows whenever the index changes (derived, not drained — a resolution write clears its row).
@@ -3831,12 +4179,14 @@ class NomosBridge {
   /// (its baked `…InterfaceJson`, decoded) against the workspace's ON-LEDGER offer (auto-sourced).
   /// `{ ok, missing[], incompatible[] }` — names the exact directive/aggregate/field, not a hash.
   Future<Map<String, Object?>> checkCompatibility(
-          Map<String, Object?> requirement,
-          [Map<String, Object?>? offer]) async =>
-      _asMap(await _call('checkCompatibility', {
-        'requirement': requirement,
-        if (offer != null) 'offer': offer,
-      }));
+    Map<String, Object?> requirement, [
+    Map<String, Object?>? offer,
+  ]) async => _asMap(
+    await _call('checkCompatibility', {
+      'requirement': requirement,
+      if (offer != null) 'offer': offer,
+    }),
+  );
 
   /// THE COMPAT SUPERPOWER (#72b): compute the LIVE per-member verdict for this client's baked
   /// [compat] manifest + structural [requirement] against the workspace's on-ledger offer. The
@@ -3844,14 +4194,19 @@ class NomosBridge {
   /// CLIENT-SIDE at write time ([LawMismatchError] surfaced through `offerDirective`) — the JS
   /// runtime holds the verdict + the pre-call guard, and a Dart offer through this bridge is guarded
   /// too. Returns the verdict (also cached on [compat]) with per-member `{ ok, reason? }`.
-  Future<NomosCompat?> checkCompat(Map<String, Object?> compat,
-      [Map<String, Object?>? requirement]) async {
-    final r = _asMap(await _call('checkCompat', {
-      'compat': compat,
-      if (requirement != null) 'requirement': requirement,
-    }));
-    final v =
-        NomosCompat.fromJson((r['compat'] as Map?)?.cast<String, Object?>());
+  Future<NomosCompat?> checkCompat(
+    Map<String, Object?> compat, [
+    Map<String, Object?>? requirement,
+  ]) async {
+    final r = _asMap(
+      await _call('checkCompat', {
+        'compat': compat,
+        if (requirement != null) 'requirement': requirement,
+      }),
+    );
+    final v = NomosCompat.fromJson(
+      (r['compat'] as Map?)?.cast<String, Object?>(),
+    );
     if (v != null) {
       _eventPlane._lastCompat = v;
       // a session's verdict is per-workspace state on the PLANE (so `session.compat` reads it back).
@@ -3865,26 +4220,28 @@ class NomosBridge {
   /// the opened session in one call — `final home = await bridge.open(workspace: 'home-…');` then
   /// `HomeClient(home)`. The bare [NomosBridge] methods remain the ONE-workspace sugar over an inferred
   /// default session; an app that opens a second workspace should hold handles, not call the plane.
-  Future<NomosSession> open(
-      {String? cloud,
-      required String workspace,
-      String? clientId,
-      String? authToken,
-      String? authorSecret,
-      String? restoreFrom,
-      bool allowUnborn = false,
-      bool recover = false,
-      String? session}) async {
+  Future<NomosSession> open({
+    String? cloud,
+    required String workspace,
+    String? clientId,
+    String? authToken,
+    String? authorSecret,
+    String? restoreFrom,
+    bool allowUnborn = false,
+    bool recover = false,
+    String? session,
+  }) async {
     await connect(
-        cloud: cloud,
-        workspace: workspace,
-        clientId: clientId,
-        authToken: authToken,
-        authorSecret: authorSecret,
-        restoreFrom: restoreFrom,
-        allowUnborn: allowUnborn,
-        recover: recover,
-        session: session);
+      cloud: cloud,
+      workspace: workspace,
+      clientId: clientId,
+      authToken: authToken,
+      authorSecret: authorSecret,
+      restoreFrom: restoreFrom,
+      allowUnborn: allowUnborn,
+      recover: recover,
+      session: session,
+    );
     return this.session(session ?? workspace);
   }
 
@@ -3924,24 +4281,30 @@ class NomosBridge {
   /// workspace's installed law changes (another peer installs/upgrades/retires a domain and it
   /// syncs in). The verdict carries `offerKnown`. The app degrades/prompts on `ok:false`.
   Stream<Map<String, Object?>> watchCompatibility(
-      Map<String, Object?> requirement,
-      [String? session]) {
+    Map<String, Object?> requirement, [
+    String? session,
+  ]) {
     // Controllers live on the EVENT PLANE (where _onMessage dispatches); the registration `_call` stays
     // THIS instance's (a session's override stamps `args.session`) — see [_eventPlane].
     final subId = 'c${++_eventPlane._seq}';
     late final StreamController<Map<String, Object?>> ctrl;
     ctrl = StreamController<Map<String, Object?>>(
       onListen: () {
-        unawaited(_call('watch', {
-          'subId': subId,
-          'kind': 'compat',
-          'requirement': requirement,
-          if (session != null) 'session': session,
-        }).then<void>((_) {}, onError: (Object error, StackTrace stackTrace) {
-          if (!ctrl.isClosed && ctrl.hasListener) {
-            ctrl.addError(error, stackTrace);
-          }
-        }));
+        unawaited(
+          _call('watch', {
+            'subId': subId,
+            'kind': 'compat',
+            'requirement': requirement,
+            if (session != null) 'session': session,
+          }).then<void>(
+            (_) {},
+            onError: (Object error, StackTrace stackTrace) {
+              if (!ctrl.isClosed && ctrl.hasListener) {
+                ctrl.addError(error, stackTrace);
+              }
+            },
+          ),
+        );
       },
       onCancel: () {
         _eventPlane._compatWatches.remove(subId);
@@ -3955,42 +4318,48 @@ class NomosBridge {
     return ctrl.stream;
   }
 
-  Stream<List<dynamic>> _watchStream(
-      {required String kind,
-      String? queryId,
-      Map<String, Object?>? params,
-      String? id,
-      String? spatialId,
-      NomosBbox? bbox,
-      String? base,
-      int? limit,
-      String? session,
-      String? principal,
-      int? intervalMs}) {
+  Stream<List<dynamic>> _watchStream({
+    required String kind,
+    String? queryId,
+    Map<String, Object?>? params,
+    String? id,
+    String? spatialId,
+    NomosBbox? bbox,
+    String? base,
+    int? limit,
+    String? session,
+    String? principal,
+    int? intervalMs,
+  }) {
     // Controllers live on the EVENT PLANE (where _onMessage dispatches); the registration `_call` stays
     // THIS instance's (a session's override stamps `args.session`) — see [_eventPlane].
     final subId = 'w${++_eventPlane._seq}';
     late final StreamController<List<dynamic>> ctrl;
     ctrl = StreamController<List<dynamic>>(
       onListen: () {
-        unawaited(_call('watch', {
-          'subId': subId,
-          'kind': kind,
-          if (queryId != null) 'queryId': queryId,
-          if (params != null) 'params': params,
-          if (id != null) 'id': id,
-          if (spatialId != null) 'spatialId': spatialId,
-          if (bbox != null) 'bbox': bbox.toJson(),
-          if (base != null) 'base': base,
-          if (limit != null) 'limit': limit,
-          if (principal != null) 'principal': principal,
-          if (intervalMs != null) 'intervalMs': intervalMs,
-          if (session != null) 'session': session,
-        }).then<void>((_) {}, onError: (Object error, StackTrace stackTrace) {
-          if (!ctrl.isClosed && ctrl.hasListener) {
-            ctrl.addError(error, stackTrace);
-          }
-        }));
+        unawaited(
+          _call('watch', {
+            'subId': subId,
+            'kind': kind,
+            if (queryId != null) 'queryId': queryId,
+            if (params != null) 'params': params,
+            if (id != null) 'id': id,
+            if (spatialId != null) 'spatialId': spatialId,
+            if (bbox != null) 'bbox': bbox.toJson(),
+            if (base != null) 'base': base,
+            if (limit != null) 'limit': limit,
+            if (principal != null) 'principal': principal,
+            if (intervalMs != null) 'intervalMs': intervalMs,
+            if (session != null) 'session': session,
+          }).then<void>(
+            (_) {},
+            onError: (Object error, StackTrace stackTrace) {
+              if (!ctrl.isClosed && ctrl.hasListener) {
+                ctrl.addError(error, stackTrace);
+              }
+            },
+          ),
+        );
       },
       onCancel: () {
         _eventPlane._watches.remove(subId);
@@ -4017,11 +4386,13 @@ class NomosBridge {
     }
     await _sub.cancel();
     final pending = _pending.entries
-        .map((entry) => (
-              completer: entry.value,
-              trace: _pendingTraces[entry.key] ?? const NomosTraceContext(),
-              operation: _pendingOps[entry.key],
-            ))
+        .map(
+          (entry) => (
+            completer: entry.value,
+            trace: _pendingTraces[entry.key] ?? const NomosTraceContext(),
+            operation: _pendingOps[entry.key],
+          ),
+        )
         .toList(growable: false);
     _pending.clear();
     _pendingOps.clear();
@@ -4031,10 +4402,11 @@ class NomosBridge {
       if (!c.isCompleted) {
         final operation = entry.operation ?? 'unknown';
         final info = NomosErrorInfo.legacy(
-            'bridge disposed while $operation was pending',
-            code: 'nomos.bridge.disposed',
-            operation: entry.operation,
-            trace: entry.trace);
+          'bridge disposed while $operation was pending',
+          code: 'nomos.bridge.disposed',
+          operation: entry.operation,
+          trace: entry.trace,
+        );
         c.completeError(nomosErrorFromInfo(info));
       }
     }
@@ -4132,15 +4504,18 @@ class NomosSession extends NomosBridge {
   /// An acquired session mounts on the SHARED plane — delegate to the parent (the plane owns the
   /// single-flight registry; a session never owns mounts).
   @override
-  Future<NomosSession> acquireSession(String workspace,
-      {Future<NomosSessionCredentials> Function()? ifAbsentCredentials,
-      String? authorSecret,
-      String? inheritedPrincipal}) {
+  Future<NomosSession> acquireSession(
+    String workspace, {
+    Future<NomosSessionCredentials> Function()? ifAbsentCredentials,
+    String? authorSecret,
+    String? inheritedPrincipal,
+  }) {
     final retained = parent._sessionCloudAccess[this.workspace];
     final modelChange = parent._sessionModelChangeHandlers[this.workspace];
     final opened = parent.acquireSession(
       workspace,
-      ifAbsentCredentials: ifAbsentCredentials ??
+      ifAbsentCredentials:
+          ifAbsentCredentials ??
           (retained == null ? null : retained.credentials),
       authorSecret:
           authorSecret ?? parent._sessionAuthorSecrets[this.workspace],
@@ -4174,7 +4549,8 @@ class NomosSession extends NomosBridge {
     final source = _sessionName;
     if (source == null || source.isEmpty) {
       throw StateError(
-          'Generated child model inheritance needs a bound parent session.');
+        'Generated child model inheritance needs a bound parent session.',
+      );
     }
     await _call('stageGeneratedModelFromParent', {
       'sourceSession': source,
@@ -4193,7 +4569,8 @@ class NomosSession extends NomosBridge {
     final workspace = _sessionName;
     if (workspace == null || workspace.isEmpty) {
       throw StateError(
-          'Model change handling needs a bound application session.');
+        'Model change handling needs a bound application session.',
+      );
     }
     _eventPlane._sessionModelChangeHandlers[workspace] = handler;
   }
@@ -4220,32 +4597,41 @@ class NomosSession extends NomosBridge {
   }) {
     if (cloud.trim().isEmpty) {
       throw ArgumentError.value(
-          cloud, 'cloud', 'Nomos cloud URL cannot be empty');
+        cloud,
+        'cloud',
+        'Nomos cloud URL cannot be empty',
+      );
     }
-    parent._sessionCloudAccess[workspace] =
-        _NomosRetainedCloudAccess(cloud: cloud, signIn: signIn);
+    parent._sessionCloudAccess[workspace] = _NomosRetainedCloudAccess(
+      cloud: cloud,
+      signIn: signIn,
+    );
   }
 
   /// A followed ref mounts on the SHARED plane — delegate to the parent (a session never owns mounts).
   @override
-  Future<NomosSession> follow<TAggregate>(NomosRef<TAggregate> ref,
-          {String? cloud,
-          String? clientId,
-          String? authToken,
-          bool allowUnborn = false,
-          String? authorSecret}) =>
-      parent.follow(ref,
-          cloud: cloud,
-          clientId: clientId,
-          authToken: authToken,
-          allowUnborn: allowUnborn,
-          authorSecret:
-              authorSecret ?? parent._sessionAuthorSecrets[workspace]);
+  Future<NomosSession> follow<TAggregate>(
+    NomosRef<TAggregate> ref, {
+    String? cloud,
+    String? clientId,
+    String? authToken,
+    bool allowUnborn = false,
+    String? authorSecret,
+  }) => parent.follow(
+    ref,
+    cloud: cloud,
+    clientId: clientId,
+    authToken: authToken,
+    allowUnborn: allowUnborn,
+    authorSecret: authorSecret ?? parent._sessionAuthorSecrets[workspace],
+  );
 
   @override
   Future<Object?> _call(String op, [Map<String, Object?> args = const {}]) =>
-      parent._call(op,
-          args.containsKey('session') ? args : {...args, 'session': workspace});
+      parent._call(
+        op,
+        args.containsKey('session') ? args : {...args, 'session': workspace},
+      );
 
   // The parent owns the ONE message loop + lifecycle; a session never subscribes, never signals ready of its
   // own, and never tears the plane down (the harness owns `parent.dispose()`).
@@ -4259,18 +4645,22 @@ class NomosSession extends NomosBridge {
   /// tuple throws [ParentSignerEnrollmentMissing] (its `recommendedAction` names the ONE remedy —
   /// [ensureParentSignerEnrollment]); any other failing premise throws [AuthzRefusedError] carrying
   /// the evaluated {workspace, actor, keyHash, object, relation, cause}. Nothing is authored.
-  Future<Map<String, Object?>> canAuthorTyped(String directiveId,
-      {String? ws,
-      String? principal,
-      String? publicKey,
-      String? keyHash,
-      String? authToken}) async {
-    final v = await canAuthor(directiveId,
-        ws: ws,
-        principal: principal,
-        publicKey: publicKey,
-        keyHash: keyHash,
-        authToken: authToken);
+  Future<Map<String, Object?>> canAuthorTyped(
+    String directiveId, {
+    String? ws,
+    String? principal,
+    String? publicKey,
+    String? keyHash,
+    String? authToken,
+  }) async {
+    final v = await canAuthor(
+      directiveId,
+      ws: ws,
+      principal: principal,
+      publicKey: publicKey,
+      keyHash: keyHash,
+      authToken: authToken,
+    );
     if (v['ok'] == true) return v;
     final cause = v['cause']?.toString();
     final target = v['ws']?.toString() ?? ws ?? workspace;
@@ -4327,11 +4717,11 @@ class _BridgeForeignWorkspaceReader implements NomosForeignWorkspaceReader {
   // workspace reads empty (→ ForeignNotFound) rather than throwing. A genuinely unreachable cloud throws,
   // which resolveResult classifies as ForeignUnreachable.
   Future<void> _ensureMounted() => _mounting ??= _bridge.connect(
-        cloud: _cloud,
-        workspace: _workspace,
-        session: _workspace,
-        allowUnborn: true,
-      );
+    cloud: _cloud,
+    workspace: _workspace,
+    session: _workspace,
+    allowUnborn: true,
+  );
 
   @override
   Future<List<Map<String, dynamic>>> queryById(String id) async {
@@ -4381,8 +4771,9 @@ class _BridgeForeignWorkspaceReader implements NomosForeignWorkspaceReader {
 String? nomosInternalResidencyRequiredWorkspace(Object error) {
   final text = error.toString();
   if (!text.contains('foreign-read-not-ready')) return null;
-  final match =
-      RegExp(r"source workspace '([^']+)' is not resident").firstMatch(text);
+  final match = RegExp(
+    r"source workspace '([^']+)' is not resident",
+  ).firstMatch(text);
   final workspace = match?.group(1)?.trim();
   return (workspace == null || workspace.isEmpty) ? null : workspace;
 }