@githolon/dsl 0.105.3 → 0.105.5

package/dart/CHANGELOG.md

@@ -1,3 +1,22 @@
+## 0.64.20
+
+- NEW: `bridge.localWorkRejectedEvents` — a typed stream of `NomosLocalWorkRejectedEvent` (from
+  nomos_types 0.8.6) forwarded over the runner bridge, so apps render honest UX ("queued, will
+  retry" vs "preserved for review — contact support") instead of scraping raw refusal prose.
+- `parentSignerEnrollment` gains `remote: true` — force the CLOUD-gateway read even when this holon
+  IS the parent: the seated barrier's proof-by-read (enrolled there ⇒ durably in custody, not merely
+  locally folded).
+- Rebuild the bundled runner from @githolon/client 0.105.5 (the seal-obligation release: footage-first
+  offer lane, scoreboard truth, FF-only seals, seal retry, no-evict-while-dirty).
+
+## 0.64.19
+
+- Rebuild the bundled runner assets from @githolon/client 0.105.3: fixes `ensureParentSignerEnrollment`
+  routing `enrollFirstDevice` when the caller is already connected directly to the target workspace
+  (`parent === workspace`) — the local structural lookup can never find it (deliberately absent from
+  public business OpenAPI), and the framework-route fallback was previously gated to skip exactly this
+  case.
+
 ## 0.64.18
 
 - Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.

package/dart/lib/src/runner/node-entry.mjs

@@ -338,6 +338,10 @@ function createWebviewRunner({ post: post2, openRealm: openRealm2 }) {
         holon.onCustodyEvent?.((evt) => post2({ v: WEBVIEW_BRIDGE_VERSION, event: "custody", session, custody: evt }));
       } catch {
       }
+      try {
+        holon.onLocalWorkRejectedEvent?.((evt) => post2({ v: WEBVIEW_BRIDGE_VERSION, event: "localWorkRejected", session, localWorkRejected: evt }));
+      } catch {
+      }
       if (a.onCustodyBreak === "ask") {
         holon.onCustodyBreak = (brk) => new Promise((resolve) => {
           pendingCustodyAsks.set(session, resolve);
@@ -8096,7 +8100,7 @@ function createGovernanceOffers(ctx) {
      * `revoked: true` means the subject's leaf was flipped `status:revoked` (remove-wins — a lawful
      * re-enroll of the SAME key is refused; mint + enroll a new device key instead).
      */
-    parentSignerEnrollment: async ({ parent, principal, keyHash, publicKey, authToken } = {}) => {
+    parentSignerEnrollment: async ({ parent, principal, keyHash, publicKey, authToken, remote } = {}) => {
       if (!parent || typeof parent !== "string") throw new Error("parentSignerEnrollment requires `parent` (the workspace whose chain holds the signer tuple)");
       if (!principal || typeof principal !== "string") throw new Error("parentSignerEnrollment requires `principal` (the auth-provider uid)");
       const p = canonicalPrincipal(principal);
@@ -8106,7 +8110,7 @@ function createGovernanceOffers(ctx) {
       }
       const object = signerObjectOf(p);
       let rows;
-      if (parent === workspace) {
+      if (parent === workspace && !remote) {
         rows = JSON.parse(call("query", { queryBytes: qBytes2({ kind: "query", queryId: "relationTuplesByObject", paramsJson: JSON.stringify({ object }) }) })) || [];
       } else {
         const headers = authToken ? { Authorization: `Bearer ${authToken}`, "x-nomos-auth": authToken } : authHeaders;
@@ -8635,7 +8639,7 @@ function birthOutcomeFailure(birthOutcomes) {
   err.birthOutcomes = birthOutcomes;
   return err;
 }
-async function connectSingle({ cloud, workspace, clientId, authToken, restoreFrom, onSpan, authorSecret, principal, allowUnborn = false, salvageOnly = false, recover = false, mountInPlace = false, __injectCheckpoint, kernelProvider, fetchImpl, historicSnapshots, onCustodyBreak, watchRebind, openWorkspaceInPlane, __knownKernelCapabilities, __testKRootPublic, __testRootSecret }) {
+async function connectSingle({ cloud, workspace, clientId, authToken, restoreFrom, onSpan, authorSecret, principal, allowUnborn = false, salvageOnly = false, recover = false, mountInPlace = false, __injectCheckpoint, kernelProvider, fetchImpl, historicSnapshots, onCustodyBreak, onLocalWorkRejected, watchRebind, openWorkspaceInPlane, __knownKernelCapabilities, __testKRootPublic, __testRootSecret }) {
   if (salvageOnly) allowUnborn = true;
   if (!cloud || !workspace) throw new Error("connect({ cloud, workspace }) required");
   const _fetch = typeof fetchImpl === "function" ? fetchImpl : globalThis.fetch;
@@ -8797,6 +8801,47 @@ ${String(commit).toLowerCase()}`;
     }
   };
   const onCustodyBreakOpt = typeof onCustodyBreak === "function" ? onCustodyBreak : null;
+  let localWorkRejectedHook = typeof onLocalWorkRejected === "function" ? onLocalWorkRejected : null;
+  const localWorkRejectedListeners = /* @__PURE__ */ new Set();
+  const refusalIsRetryable = (error) => {
+    try {
+      const d = authzDiagnosisFromRefusal(String(error ?? ""));
+      return d?.code === "nomos.authz.signer_enrollment_missing";
+    } catch {
+      return false;
+    }
+  };
+  const emitLocalWorkRejected = (source, refused, resetTo) => {
+    if (!refused.length) return;
+    const items = refused.map((r) => ({
+      intentId: typeof r.intentId === "string" ? r.intentId : null,
+      oid: typeof r.oid === "string" ? r.oid : null,
+      domain: typeof r.domain === "string" ? r.domain : null,
+      directiveId: typeof r.directiveId === "string" ? r.directiveId : null,
+      error: String(r.error ?? "the law refused this offer").slice(0, 600),
+      retryable: refusalIsRetryable(r.error)
+    }));
+    const event = {
+      workspace,
+      refused: items,
+      parked: true,
+      resetTo,
+      retryable: items.every((i) => i.retryable),
+      source
+    };
+    if (localWorkRejectedHook) {
+      try {
+        localWorkRejectedHook(event);
+      } catch {
+      }
+    }
+    for (const l of [...localWorkRejectedListeners]) {
+      try {
+        l(event);
+      } catch {
+      }
+    }
+  };
   function captureIncarnation(j) {
     const inc = j && typeof j.incarnation === "string" && OID40_RE.test(j.incarnation) ? j.incarnation : null;
     if (inc !== null) remoteIncarnation = inc;
@@ -9383,6 +9428,7 @@ ${String(commit).toLowerCase()}`;
         }
       }
     }
+    if (deadLettered.length) emitLocalWorkRejected("sync", deadLettered.map((d) => ({ intentId: d.id, error: d.error })), remoteHead);
     invalidateInstalledLawMetadata();
     nudgeWatches();
     return {
@@ -11695,6 +11741,22 @@ ${String(commit).toLowerCase()}`;
       if (typeof cb === "function") custodyListeners.add(cb);
       return () => custodyListeners.delete(cb);
     },
+    /** THE LOCAL-WORK-REJECTED HOOK (settable; connect({onLocalWorkRejected}) is the default) — the
+     *  typed "the cloud refused work your device had accepted" lifecycle event. See
+     *  `LocalWorkRejectedEvent`: refused intents are already parked + survivors replayed when it
+     *  fires; the app's only job is honest UX (retryable ⇒ "queued, will retry"; terminal ⇒
+     *  "preserved for review — contact support"). */
+    get onLocalWorkRejected() {
+      return localWorkRejectedHook;
+    },
+    set onLocalWorkRejected(fn) {
+      localWorkRejectedHook = typeof fn === "function" ? fn : null;
+    },
+    /** Subscribe (multi-listener) to LocalWorkRejectedEvents. Returns an unsubscribe fn. */
+    onLocalWorkRejectedEvent: (cb) => {
+      if (typeof cb === "function") localWorkRejectedListeners.add(cb);
+      return () => localWorkRejectedListeners.delete(cb);
+    },
     /**
      * INTROSPECTION — where this holon sits on the custody spectrum:
      *  `{ incarnation, localGenesis, remoteIncarnation, syncPosture, pendingLocalIntents, salvagedIntents,
@@ -13164,6 +13226,10 @@ ${String(commit).toLowerCase()}`;
         });
         _convSpan.end();
         if (result && result.custodyBreak) return await resolveCustodyBreakFlow(result.custodyBreak, { operation: "sync" });
+        if (admissionRefusals && admissionRefusals.size) {
+          const refusedEntries = (admission?.sessions || []).flatMap((s) => (s.rejected || []).map((r) => ({ intentId: r.intent, oid: r.oid, error: r.error })));
+          emitLocalWorkRejected("admission", refusedEntries, result && typeof result.remoteMain === "string" ? result.remoteMain : null);
+        }
         try {
           result.stillAhead = await resolveBranchHead() !== syncedBase;
         } catch {

package/dart/lib/src/runner/offline-install.mjs

@@ -137,6 +137,7 @@ __export(engine_exports, {
   cryptoUnwrapKey: () => cryptoUnwrapKey,
   cryptoWrapKey: () => cryptoWrapKey,
   currentLaw: () => currentLaw,
+  custodyConfirmedMain: () => custodyConfirmedMain,
   declaredCapabilities: () => declaredCapabilities,
   deepVerifyShard: () => deepVerifyShard,
   delegationCertSign: () => delegationCertSign,
@@ -163,6 +164,7 @@ __export(engine_exports, {
   ingestPackAsCustody: () => ingestPackAsCustody,
   installedLaw: () => installedLaw,
   intentOfferResidencies: () => intentOfferResidencies,
+  isDirty: () => isDirty,
   isWarranted: () => isWarranted,
   kernelStamp: () => kernelStamp,
   kgit: () => kgit,
@@ -6803,6 +6805,40 @@ async function admitIntentOffers(eng2, ws, ledger, offers, { receiptFence = null
     const s0 = Date.now();
     return (end = {}) => timings.spans.push({ id: `intent-offer-${t0}-${seq++}`, track: "cloud", name, kind, depth, t0: s0, t1: Date.now(), ...extra, ...end });
   };
+  let footageRef = null;
+  {
+    const parked = [];
+    for (const offer of Array.isArray(offers) ? offers : []) {
+      let blob = offer?.blob instanceof Uint8Array ? offer.blob : null;
+      try {
+        if (!blob && typeof offer?.changeB64 === "string") blob = Uint8Array.from(atob(offer.changeB64), (c) => c.charCodeAt(0));
+      } catch {
+      }
+      if (blob && blob.byteLength) parked.push(blob);
+    }
+    if (parked.length) {
+      footageRef = `refs/heads/parked/offered/${t0.toString(36)}-${Math.floor(Math.random() * 16777215).toString(36)}`;
+      const footageDone = span("park offer footage", "cseal", 1, { offers: parked.length });
+      try {
+        kgit.writeMetaCommit(eng2, gitdirOf(ws), {
+          parents: [],
+          files: parked.map((bytes, i) => ({ path: `${i}.change.usda`, bytes })),
+          message: `offered: ${parked.length} intent(s) parked pre-judgment (footage-first)`,
+          timeSecs: 0,
+          ref: footageRef
+        });
+        await custodyPush(eng2, ws, ledger, { remoteRef: footageRef });
+      } catch (e) {
+        try {
+          kgit.deleteRef(eng2, gitdirOf(ws), footageRef);
+        } catch {
+        }
+        throw new Error(`offer footage not durable \u2014 custody unreachable, nothing was folded; retry the batch: ${String(e).slice(0, 300)}`, { cause: e });
+      } finally {
+        footageDone();
+      }
+    }
+  }
   for (const offer of Array.isArray(offers) ? offers : []) {
     const cid = typeof offer?.session === "string" && offer.session ? offer.session : "direct";
     const rec = sessions.get(cid) || { session: cid, admitted: [], rejected: [], skipped: [] };
@@ -6878,10 +6914,13 @@ async function admitIntentOffers(eng2, ws, ledger, offers, { receiptFence = null
   }
   timings.sessions = sessions.size;
   timings.intents = admittedTotal;
+  let refusalsParked = true;
   if (deadLetters.length) {
     try {
-      await materializeRefused(eng2, ws, ledger, deadLetters);
+      const m = await materializeRefused(eng2, ws, ledger, deadLetters);
+      refusalsParked = m.unparkedSessions.size === 0;
     } catch (e) {
+      refusalsParked = false;
       log("refused-materialize-failed", { ws, error: String(e).slice(0, 200) });
     }
   }
@@ -6890,6 +6929,17 @@ async function admitIntentOffers(eng2, ws, ledger, offers, { receiptFence = null
     await commitAndPush(eng2, ws, ledger);
     sealDone();
   }
+  if (footageRef && refusalsParked) {
+    try {
+      kgit.deleteRef(eng2, gitdirOf(ws), footageRef);
+    } catch {
+    }
+    try {
+      await custodyPush(eng2, ws, ledger, { remoteRef: footageRef, del: true });
+    } catch (e) {
+      log("footage-delete-push-failed", { ws, ref: footageRef, error: String(e).slice(0, 200) });
+    }
+  }
   const gitdir = gitdirOf(ws);
   const head = kgit.resolveRef(eng2, gitdir, BRANCH) ?? main.head;
   const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore ?? "", head ?? "") : null;
@@ -6903,7 +6953,7 @@ async function admitIntentOffers(eng2, ws, ledger, offers, { receiptFence = null
   }
   log("admit-intent-offers", { ws, sessions: sessions.size, admitted: admittedTotal, rejected: [...sessions.values()].reduce((n, s) => n + s.rejected.length, 0), resultPack: resultPackB64 ? "inline" : "none" });
   const bornPacked = born.length ? packBornChildren(eng2, born) : born;
-  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...s.skipped.length ? {} : { skipped: void 0 } })), main: head, deadLetters, timings, summary: summary ?? null, born: bornPacked, birthOutcomes, ...resultPackB64 ? { resultPackB64, resultBase: clientBase } : {} };
+  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...s.skipped.length ? {} : { skipped: void 0 } })), main: head, sealed: true, sealedMain: custodyConfirmedMain(eng2, ws), deadLetters, timings, summary: summary ?? null, born: bornPacked, birthOutcomes, ...resultPackB64 ? { resultPackB64, resultBase: clientBase } : {} };
 }
 function intentOfferResidencies(eng2, offers) {
   const unique = /* @__PURE__ */ new Map();
@@ -7035,6 +7085,7 @@ async function mountWorkspace(eng2, ws, ledger) {
         throw new Error(`kernel refused restored main ${remoteMain}: ${JSON.stringify(mounted)}`);
       }
       restored = true;
+      custodyMainOf(eng2).set(ws, remoteMain);
       verificationVerdict = jsStruct(mounted.verdict);
     }
   } catch (e) {
@@ -7531,7 +7582,7 @@ async function custodyFetch(eng2, ws, ledger, { remoteRef = "refs/heads/main", l
   if (writeRef) kgit.writeRef(eng2, gitdirOf(ws), fullRef(localRef || remoteRef), tip);
   return tip;
 }
-async function custodyPush(eng2, ws, ledger, { localRef = null, remoteRef, del = false, pointer = false, newOid = null }) {
+async function custodyPush(eng2, ws, ledger, { localRef = null, remoteRef, del = false, pointer = false, newOid = null, ffOnly = false }) {
   const headers = ledger.headers || {};
   const remoteRefFull = fullRef(remoteRef);
   let remote;
@@ -7547,22 +7598,46 @@ async function custodyPush(eng2, ws, ledger, { localRef = null, remoteRef, del =
   }
   const tgt = newOid || kgit.resolveRef(eng2, gitdirOf(ws), fullRef(localRef || remoteRef));
   if (!tgt) throw new Error(`custodyPush: local ref ${localRef || remoteRef} unresolved`);
-  if (tgt === oldOid) return;
+  if (tgt === oldOid) {
+    if (remoteRefFull === fullRef(BRANCH)) custodyMainOf(eng2).set(ws, tgt);
+    return;
+  }
   let pack = null;
   if (!pointer) {
     pack = oldOid !== ZERO_OID ? packDelta(eng2, ws, oldOid, tgt) : null;
+    if (!pack && ffOnly && oldOid !== ZERO_OID) {
+      throw new Error(`custody ${remoteRefFull} regression refused: remote ${oldOid.slice(0, 12)} is not an ancestor of local ${tgt.slice(0, 12)} \u2014 this engine's view is stale; re-mount from custody instead of forcing`);
+    }
     if (!pack) pack = packDelta(eng2, ws, "", tgt);
   }
   const packBytes = pack?.byteLength ?? 0;
   try {
-    return await pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref: remoteRefFull, oldOid, newOid: tgt }], pack }));
+    const r = await pushVia(ledger, () => pushPack(ledger.remote, headers, { updates: [{ ref: remoteRefFull, oldOid, newOid: tgt }], pack }));
+    if (remoteRefFull === fullRef(BRANCH)) custodyMainOf(eng2).set(ws, tgt);
+    return r;
   } catch (error) {
     throw new Error(`custody receive-pack push failed for ${remoteRefFull} (${packBytes} pack bytes): ${String(error)}`, { cause: error });
   }
 }
+function custodyMainOf(eng2) {
+  eng2._custodyMain ??= /* @__PURE__ */ new Map();
+  return eng2._custodyMain;
+}
+function custodyConfirmedMain(eng2, ws) {
+  return custodyMainOf(eng2).get(ws) ?? null;
+}
+function isDirty(eng2, ws) {
+  try {
+    const resident = kgit.resolveRef(eng2, gitdirOf(ws), BRANCH);
+    if (!resident) return false;
+    return resident !== custodyMainOf(eng2).get(ws);
+  } catch {
+    return false;
+  }
+}
 async function commitAndPush(eng2, ws, ledger) {
   try {
-    await custodyPush(eng2, ws, ledger, { remoteRef: "refs/heads/main" });
+    await custodyPush(eng2, ws, ledger, { remoteRef: "refs/heads/main", ffOnly: true });
   } catch (e) {
     unmount(eng2, ws);
     const cause = e instanceof Error ? e.cause : void 0;
@@ -8238,6 +8313,80 @@ async function admitAll(eng2, ws, ledger, { receiptFence = null, shardRouting =
       _sessionDone();
     }
   }
+  const offeredRefPrefix = "refs/heads/parked/offered/";
+  const footageConsumed = [];
+  const footageBorn = [], footageBirthOutcomes = [];
+  try {
+    const offeredRefs = Object.entries(await custodyLsRefs(ledger, offeredRefPrefix));
+    for (const [oref, ooid] of offeredRefs) {
+      if (!oref.startsWith(offeredRefPrefix) || !ooid) continue;
+      const fcid = `offered:${oref.slice(offeredRefPrefix.length)}`;
+      const _fDone = _span(`footage ${fcid.slice(0, 24)}`, "csession", 1, { client: fcid });
+      const admitted = [], rejected = [], skipped = [];
+      try {
+        try {
+          await custodyFetch(eng2, ws, ledger, { remoteRef: oref, have: kgit.resolveRef(eng2, gitdir, BRANCH) });
+        } catch {
+          await custodyFetch(eng2, ws, ledger, { remoteRef: oref, have: null });
+        }
+        const main = await mainIntentIds(eng2, ws);
+        for (let i = 0; ; i++) {
+          let blob = null;
+          try {
+            blob = kgit.readBlob(eng2, gitdir, ooid, `${i}.change.usda`);
+          } catch {
+            blob = null;
+          }
+          if (!blob || !blob.byteLength) break;
+          try {
+            const inspected = kgit.inspectChange(eng2, blob);
+            const intentId = inspected.intentId || null;
+            const oid = String(intentId || `${fcid}#${i}`).slice(0, 10);
+            if (!inspected.authored || !inspected.call) {
+              rejected.push({ oid, error: "parked offer is not an authored nominal call" });
+              continue;
+            }
+            const { domainPath: dom, directivePath: dirId } = inspected.call;
+            if (receiptFence && dirId && Array.isArray(receiptFence[dom]) && receiptFence[dom].includes(dirId)) {
+              const error = `'${dom}/${dirId}' is a capability RECEIPT \u2014 receipts are executor/owner writes, never open-session writes`;
+              rejected.push({ oid, error, deadLettered: true });
+              deadLetters.push({ intentId, oid, session: fcid, error, blob, domain: dom, directiveId: dirId });
+              continue;
+            }
+            if (intentId && main.ids.has(intentId)) {
+              skipped.push({ oid, intent: intentId, alreadyOnMain: true });
+              continue;
+            }
+            const res = offerAdmit(eng2, ws, blob, { defer: canDeferProjection });
+            if (res.ok) {
+              if (intentId) main.ids.add(intentId);
+              main.oids.add(res.head);
+              main.head = res.head;
+              admitted.push({ oid, intent: intentId, head: res.head });
+              totalAdmitted += 1;
+              _intents += 1;
+              if (Array.isArray(res.born) && res.born.length) footageBorn.push(...res.born);
+              if (Array.isArray(res.birthOutcomes) && res.birthOutcomes.length) footageBirthOutcomes.push(...res.birthOutcomes);
+            } else {
+              const error = `${String(res.error || "").slice(0, 300)} \u2014 dead-lettered; fix the law (or the payload), then POST /v1/workspaces/${ws}/dead-letters/retry`;
+              rejected.push({ oid, error, deadLettered: true });
+              deadLetters.push({ intentId, oid, session: fcid, error, blob, domain: dom, directiveId: dirId });
+            }
+          } catch (e) {
+            rejected.push({ oid: `${fcid}#${i}`.slice(0, 10), error: String(e).slice(0, 200) });
+          }
+        }
+        footageConsumed.push(oref);
+        results.push({ session: fcid, admitted, rejected, ...skipped.length ? { skipped } : {} });
+      } catch (e) {
+        results.push({ session: fcid, error: String(e).slice(0, 200) });
+      } finally {
+        _fDone({ admitted: admitted.length, rejected: rejected.length });
+      }
+    }
+  } catch (e) {
+    log("footage-scan-failed", { ws, error: String(e).slice(0, 200) });
+  }
   if (canDeferProjection && totalAdmitted) {
     const _projDone = _span("projection flush (batch)", "cproject", 1, { admitted: totalAdmitted });
     try {
@@ -8261,7 +8410,8 @@ async function admitAll(eng2, ws, ledger, { receiptFence = null, shardRouting =
   const hasCoordination = !!(summaryCtx || placements.length || splits.length || globalsOut.length);
   const deferDurability = defer && !hasCoordination;
   let _sealed = true;
-  if (totalAdmitted && !deferDurability) {
+  const sealNeeded = totalAdmitted > 0 || isDirty(eng2, ws);
+  if (sealNeeded && !deferDurability) {
     const _sealDone = _span(`seal (batch)`, "cseal", 1, { sessions: consumed.length, admitted: totalAdmitted });
     const _s = Date.now();
     try {
@@ -8281,17 +8431,38 @@ async function admitAll(eng2, ws, ledger, { receiptFence = null, shardRouting =
       } catch {
       }
     }
+    for (const oref of footageConsumed) {
+      const fcid = `offered:${oref.slice(offeredRefPrefix.length)}`;
+      if (unparkedSessions.has(fcid)) continue;
+      try {
+        kgit.deleteRef(eng2, gitdir, oref);
+      } catch {
+      }
+      try {
+        await custodyPush(eng2, ws, ledger, { remoteRef: oref, del: true });
+      } catch {
+      }
+    }
   }
   const newMain = kgit.resolveRef(eng2, gitdir, BRANCH);
-  log("admit", { ws, sessions: results.length, main: newMain });
+  log("admit", { ws, sessions: results.length, main: newMain, sealed: _sealed, sealedMain: custodyConfirmedMain(eng2, ws) });
   const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore ?? "", newMain) : null;
   const _total = Date.now() - _t0;
   const timings = { totalMs: _total, scanMs: _scanMs, fetchMs: _fetchMs, sealMs: _sealMs, gateFoldMs: Math.max(0, _total - _scanMs - _fetchMs - _sealMs), intents: _intents, sessions: results.length, spans: _spans };
   return {
+    // SCOREBOARD TRUTH: `main` is the resident fold head (the ack the client converges to);
+    // `sealedMain` is the custody-confirmed head — THE ONLY head the host may advertise/cache
+    // (seated_barrier_and_seal_obligation.md Part 2). `sealed:false` ⇒ the seal obligation is
+    // outstanding and the caller must re-arm the admit alarm (retry) rather than move on.
     sessions: results,
     main: newMain,
+    sealed: _sealed,
+    sealedMain: custodyConfirmedMain(eng2, ws),
     deadLetters,
     timings,
+    // Footage-replayed `.births()` offers: the born child custody + typed verdicts, for the caller
+    // to persist exactly as the live POST lane does (packed here — the caller holds no engine FS).
+    ...footageBorn.length ? { born: packBornChildren(eng2, footageBorn), birthOutcomes: footageBirthOutcomes } : {},
     ...summary ? { summary } : {},
     ...placements.length ? { placements } : {},
     ...splits.length ? { splits } : {},
@@ -8305,7 +8476,7 @@ async function backupHead(eng2, ws, ledger, head) {
   if (!eng2.mounted.has(ws)) return { ok: false, error: "not mounted" };
   if (!head) return { ok: false, error: "no head" };
   try {
-    await custodyPush(eng2, ws, ledger, { remoteRef: "refs/heads/main", newOid: head });
+    await custodyPush(eng2, ws, ledger, { remoteRef: "refs/heads/main", newOid: head, ffOnly: true });
     return { ok: true, head };
   } catch (e) {
     return { ok: false, error: String(e?.message || e).slice(0, 200), head };
@@ -8318,7 +8489,7 @@ async function backupToCustody(eng2, ws, ledger, { consumed = [] } = {}) {
   head = kgit.resolveRef(eng2, gitdir, BRANCH);
   if (!head) return { ok: false, error: "no local main" };
   try {
-    await custodyPush(eng2, ws, ledger, { remoteRef: "refs/heads/main" });
+    await custodyPush(eng2, ws, ledger, { remoteRef: "refs/heads/main", ffOnly: true });
   } catch (e) {
     return { ok: false, error: String(e).slice(0, 200), head };
   }

package/dart/lib/src/webview_bridge.dart

@@ -34,7 +34,8 @@ import 'package:nomos_types/nomos_types.dart'
         ReferenceVersionUnavailable,
         CustodyBreakPolicy,
         NomosCustodyEvent,
-        NomosCustodyStatus;
+        NomosCustodyStatus,
+        NomosLocalWorkRejectedEvent;
 import 'package:nomos_types/src/nomos_ref.dart' show NmsInternalNomosRefs;
 import 'package:nomos_types/src/versioned_nomos_ref.dart'
     show NmsInternalVersionedNomosRefs;
@@ -1230,6 +1231,11 @@ class NomosBridge {
   // [resolveCustodyBreak].
   final StreamController<NomosCustodyEvent> _custodyEvents =
       StreamController<NomosCustodyEvent>.broadcast();
+  // LOCAL-WORK-REJECTED LIFECYCLE (seated_barrier_and_seal_obligation.md Part 4): the typed "the
+  // cloud refused work this device had accepted" event — refused intents already parked (client DLQ
+  // + refused/* custody refs), survivors already replayed; the app renders honest UX from this.
+  final StreamController<NomosLocalWorkRejectedEvent> _localWorkRejectedEvents =
+      StreamController<NomosLocalWorkRejectedEvent>.broadcast();
   final StreamController<Map<String, Object?>> _flameEvents =
       StreamController<Map<String, Object?>>.broadcast();
   final StreamController<Map<String, Object?>> _spanEvents =
@@ -1505,6 +1511,17 @@ class NomosBridge {
       if (ev != null && !_custodyEvents.isClosed) _custodyEvents.add(ev);
       return;
     }
+    if (event == 'localWorkRejected') {
+      // LOCAL-WORK-REJECTED: { event:'localWorkRejected', session, localWorkRejected:{ workspace,
+      // refused, parked, resetTo, retryable, source } }. The framework already parked the refused
+      // intents + replayed survivors; the app's only job is the honest message (retryable ⇒ "queued,
+      // will retry"; terminal ⇒ "preserved for review — contact support").
+      final ev = NomosLocalWorkRejectedEvent.fromMessage(m);
+      if (ev != null && !_localWorkRejectedEvents.isClosed) {
+        _localWorkRejectedEvents.add(ev);
+      }
+      return;
+    }
     if (event == 'transfer') {
       // LIVE pack byte-progress { received, total, kind } — the real loading bar (host Content-Length).
       final tp = TransferProgress.fromMessage(m);
@@ -1850,6 +1867,15 @@ class NomosBridge {
   Stream<NomosCustodyEvent> get custodyEvents =>
       _eventPlane._custodyEvents.stream;
 
+  /// THE LOCAL-WORK-REJECTED STREAM (seated_barrier_and_seal_obligation.md Part 4): the cloud's gate
+  /// refused work this device's own kernel had accepted. Refused intents are already durably parked
+  /// (client DLQ + the workspace's refused/* refs) and surviving local work already replayed when an
+  /// event arrives — bind honest UX to it: `retryable` ⇒ "your changes are queued and will retry";
+  /// otherwise ⇒ "your changes were preserved for review — contact support". Never render the raw
+  /// refusal text as the headline.
+  Stream<NomosLocalWorkRejectedEvent> get localWorkRejectedEvents =>
+      _eventPlane._localWorkRejectedEvents.stream;
+
   /// Where a session sits on the custody spectrum (incarnation, posture, pending/salvaged local work,
   /// supersession history) — for a status banner or a "you're offline on old truth" indicator.
   Future<NomosCustodyStatus> custodyStatus({String? session}) async =>
@@ -2805,18 +2831,23 @@ class NomosBridge {
   /// `principal` on `parent`'s chain (`identity:<principal>#signer@key:<sha256(publicKey)>`)? One O(1)
   /// relation read over the open gateway; nothing is authored. Returns
   /// `{parent, principal, keyHash, object, relation, enrolled, revoked, checkedAt}`.
+  /// Pass `remote: true` to force the CLOUD-gateway read even when this holon IS the parent — the
+  /// seated barrier's proof-by-read: `enrolled: true` then means the shared chain durably holds this
+  /// device's signer tuple, not merely that the local fold ran.
   Future<Map<String, Object?>> parentSignerEnrollment(
           {required String parent,
           required String principal,
           String? keyHash,
           String? publicKey,
-          String? authToken}) async =>
+          String? authToken,
+          bool remote = false}) async =>
       _asMap(await _call('parentSignerEnrollment', {
         'parent': parent,
         'principal': principal,
         if (keyHash != null) 'keyHash': keyHash,
         if (publicKey != null) 'publicKey': publicKey,
         if (authToken != null) 'authToken': authToken,
+        if (remote) 'remote': true,
       }));
 
   /// IDEMPOTENT PARENT-SIGNER RECOVERY — ensure this device key is a live `signer` on `parent`,
@@ -3927,6 +3958,7 @@ class NomosBridge {
     if (!_syncEvents.isClosed) await _syncEvents.close();
     if (!_signalEvents.isClosed) await _signalEvents.close();
     if (!_custodyEvents.isClosed) await _custodyEvents.close();
+    if (!_localWorkRejectedEvents.isClosed) await _localWorkRejectedEvents.close();
     if (!_flameEvents.isClosed) await _flameEvents.close();
     if (!_spanEvents.isClosed) await _spanEvents.close();
     if (!_transferEvents.isClosed) await _transferEvents.close();

package/dart/pubspec.lock

@@ -191,7 +191,7 @@ packages:
       path: "../dart_types"
       relative: true
     source: path
-    version: "0.8.4"
+    version: "0.8.5"
   package_config:
     dependency: "direct main"
     description:

package/dart/pubspec.yaml

@@ -7,7 +7,7 @@ repository: https://github.com/Captain-App/nomos2
 description: >-
   Nomos 2 Dart client — generated domain values, intent payloads and application
   lifecycle types over the typed Nomos kernel protocol and USDA custody model.
-version: 0.64.18
+version: 0.64.20
 
 environment:
   sdk: ^3.5.0
@@ -16,7 +16,7 @@ dependencies:
   # The pure-data core (wire types, offer codec, NomosReads, schema validation, error
   # info). nomos_client depends on and re-exports it, so existing imports are unchanged.
   # For local monorepo dev, pubspec_overrides.yaml points this at ../dart_types.
-  nomos_types: ^0.8.4
+  nomos_types: ^0.8.6
   json_schema: ^5.2.2
   crypto: ^3.0.0
   package_config: ^2.1.0

package/dart_types/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 0.8.6
+
+- NEW: `NomosLocalWorkRejectedEvent` / `NomosRejectedIntent` — the typed "the cloud refused work your
+  device had accepted" lifecycle event (architecture/seated_barrier_and_seal_obligation.md Part 4).
+  By the time it fires, refused intents are durably parked on BOTH sides (client DLQ + workspace
+  refused/* refs) and surviving local work is rebase-replayed — no work is ever lost. `retryable`
+  distinguishes transient-premise refusals (auto-retry clears them) from terminal ones.
+
 ## 0.8.5
 
 - Expose bounded generated-startup and referenced-workspace custody failures as typed data so applications

package/dart_types/lib/nomos_types.dart

@@ -50,6 +50,10 @@ export 'src/git_object_id.dart';
 // The CUSTODY-LIFECYCLE types (rebirth_and_custody_lifecycle.md): NomosCustodyBreak / NomosCustodyStatus /
 // CustodyBreakPolicy — custody incompatibility as a first-class, typed, app-decidable event. Pure data.
 export 'src/custody.dart';
+// THE LOCAL-WORK-REJECTED LIFECYCLE (seated_barrier_and_seal_obligation.md Part 4):
+// NomosLocalWorkRejectedEvent / NomosRejectedIntent — "the cloud refused work your device had
+// accepted" as a first-class, typed, app-renderable event (refused work is parked, never lost).
+export 'src/local_work_rejected.dart';
 // SURFACED MERGE CONFLICTS (architecture/surfaced_merge_conflict.md): the read-collapse types for a
 // `.merge(Surfaced(...))` field — SurfacedValue<T> (resolved scalar | pending observations). Pure data.
 export 'src/surfaced.dart';

package/dart_types/lib/src/local_work_rejected.dart

@@ -0,0 +1,117 @@
+// THE LOCAL-WORK-REJECTED LIFECYCLE EVENT (architecture/seated_barrier_and_seal_obligation.md Part 4).
+//
+// Fired when work THIS device authored locally — and which its OWN kernel admitted — is REFUSED by the
+// shared workspace's gate on sync/admission. Local-first means local acceptance is a real, honest
+// verdict; the shared chain's gate re-judges from ITS state, and the two can disagree (a premise the
+// device relied on hadn't landed yet, or the write genuinely violates shared law). By the time this
+// event fires the framework has already done the right thing:
+//
+//   • every refused intent is durably PARKED on BOTH sides (the client dead-letter queue AND the
+//     workspace's refused/* custody refs) — inspectable, re-offerable, NEVER lost;
+//   • every surviving unrefused local intent was rebase-replayed onto canonical main;
+//   • local state converged to [resetTo].
+//
+// The app's ONLY job is honest UX. [retryable] is the fork in the message:
+//   true  ⇒ "Your changes are queued and will be retried automatically." (transient premise — e.g.
+//            this device's signer enrollment hadn't landed on the chain yet)
+//   false ⇒ "Your changes couldn't be accepted and have been preserved for review — contact support."
+// Never show [NomosRejectedIntent.error] raw to an end user — it is the gate's diagnostic text.
+class NomosRejectedIntent {
+  final String? intentId;
+  final String? oid;
+  final String? domain;
+  final String? directiveId;
+
+  /// The gate's own refusal text (diagnostic — for logs/support disclosure, never the headline).
+  final String error;
+
+  /// Transient-premise refusal that auto-retry can clear.
+  final bool retryable;
+
+  const NomosRejectedIntent({
+    this.intentId,
+    this.oid,
+    this.domain,
+    this.directiveId,
+    required this.error,
+    required this.retryable,
+  });
+
+  factory NomosRejectedIntent.fromJson(Map<String, dynamic> j) =>
+      NomosRejectedIntent(
+        intentId: j['intentId'] as String?,
+        oid: j['oid'] as String?,
+        domain: j['domain'] as String?,
+        directiveId: j['directiveId'] as String?,
+        error: (j['error'] ?? '') as String,
+        retryable: j['retryable'] == true,
+      );
+
+  Map<String, dynamic> toJson() => {
+        'intentId': intentId,
+        'oid': oid,
+        'domain': domain,
+        'directiveId': directiveId,
+        'error': error,
+        'retryable': retryable,
+      };
+}
+
+/// The typed "the cloud refused work your device had accepted" event. See library docs above —
+/// refused work is already parked and survivors replayed when this fires; render honest UX only.
+class NomosLocalWorkRejectedEvent {
+  final String workspace;
+  final String? session;
+  final List<NomosRejectedIntent> refused;
+
+  /// Always true when the event fires: the refused intents are durably parked (client DLQ +
+  /// workspace refused/* refs).
+  final bool parked;
+
+  /// The canonical main local state converged to.
+  final String? resetTo;
+
+  /// True iff EVERY refusal in the batch is retryable.
+  final bool retryable;
+
+  /// "admission" (the edge refused our offers) or "sync" (the offer-gated converge dead-lettered
+  /// local tail intents).
+  final String source;
+
+  const NomosLocalWorkRejectedEvent({
+    required this.workspace,
+    this.session,
+    required this.refused,
+    required this.parked,
+    this.resetTo,
+    required this.retryable,
+    required this.source,
+  });
+
+  static NomosLocalWorkRejectedEvent? fromMessage(Map<String, dynamic> m) {
+    final e = (m['localWorkRejected'] as Map?)?.cast<String, dynamic>();
+    if (e == null) return null;
+    return NomosLocalWorkRejectedEvent(
+      workspace: (e['workspace'] ?? '') as String,
+      session: m['session'] as String?,
+      refused: ((e['refused'] as List?) ?? const [])
+          .whereType<Map>()
+          .map((r) => NomosRejectedIntent.fromJson(r.cast<String, dynamic>()))
+          .toList(growable: false),
+      parked: e['parked'] != false,
+      resetTo: e['resetTo'] as String?,
+      retryable: e['retryable'] == true,
+      source: (e['source'] ?? 'sync') as String,
+    );
+  }
+
+  Map<String, dynamic> toJson() => {
+        'workspace': workspace,
+        'session': session,
+        'refused': refused.map((r) => r.toJson()).toList(growable: false),
+        'parked': parked,
+        'resetTo': resetTo,
+        'retryable': retryable,
+        'source': source,
+      };
+}

package/dart_types/pubspec.yaml

@@ -9,7 +9,7 @@ description: >-
   Pure kernel wire/data types for Nomos Dart frontends — no transport, no bridge,
   no runtime. Typed protobuf and USDA boundary values plus the offer codec,
   reactive read engine, schema validation, and data-only error/trace types.
-version: 0.8.5
+version: 0.8.6
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.105.3",
+  "version": "0.105.5",
   "type": "module",
   "sideEffects": false,
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",

package/runtime/generated-application-host.js

@@ -7147,7 +7147,7 @@ function createGovernanceOffers(ctx) {
      * `revoked: true` means the subject's leaf was flipped `status:revoked` (remove-wins — a lawful
      * re-enroll of the SAME key is refused; mint + enroll a new device key instead).
      */
-    parentSignerEnrollment: async ({ parent, principal, keyHash, publicKey, authToken } = {}) => {
+    parentSignerEnrollment: async ({ parent, principal, keyHash, publicKey, authToken, remote } = {}) => {
       if (!parent || typeof parent !== "string") throw new Error("parentSignerEnrollment requires `parent` (the workspace whose chain holds the signer tuple)");
       if (!principal || typeof principal !== "string") throw new Error("parentSignerEnrollment requires `principal` (the auth-provider uid)");
       const p = canonicalPrincipal(principal);
@@ -7157,7 +7157,7 @@ function createGovernanceOffers(ctx) {
       }
       const object = signerObjectOf(p);
       let rows;
-      if (parent === workspace) {
+      if (parent === workspace && !remote) {
         rows = JSON.parse(call("query", { queryBytes: qBytes2({ kind: "query", queryId: "relationTuplesByObject", paramsJson: JSON.stringify({ object }) }) })) || [];
       } else {
         const headers = authToken ? { Authorization: `Bearer ${authToken}`, "x-nomos-auth": authToken } : authHeaders;
@@ -7686,7 +7686,7 @@ function birthOutcomeFailure(birthOutcomes) {
   err.birthOutcomes = birthOutcomes;
   return err;
 }
-async function connectSingle({ cloud, workspace, clientId, authToken, restoreFrom, onSpan, authorSecret, principal, allowUnborn = false, salvageOnly = false, recover = false, mountInPlace = false, __injectCheckpoint, kernelProvider, fetchImpl, historicSnapshots, onCustodyBreak, watchRebind, openWorkspaceInPlane, __knownKernelCapabilities, __testKRootPublic, __testRootSecret }) {
+async function connectSingle({ cloud, workspace, clientId, authToken, restoreFrom, onSpan, authorSecret, principal, allowUnborn = false, salvageOnly = false, recover = false, mountInPlace = false, __injectCheckpoint, kernelProvider, fetchImpl, historicSnapshots, onCustodyBreak, onLocalWorkRejected, watchRebind, openWorkspaceInPlane, __knownKernelCapabilities, __testKRootPublic, __testRootSecret }) {
   if (salvageOnly) allowUnborn = true;
   if (!cloud || !workspace) throw new Error("connect({ cloud, workspace }) required");
   const _fetch = typeof fetchImpl === "function" ? fetchImpl : globalThis.fetch;
@@ -7848,6 +7848,47 @@ ${String(commit).toLowerCase()}`;
     }
   };
   const onCustodyBreakOpt = typeof onCustodyBreak === "function" ? onCustodyBreak : null;
+  let localWorkRejectedHook = typeof onLocalWorkRejected === "function" ? onLocalWorkRejected : null;
+  const localWorkRejectedListeners = /* @__PURE__ */ new Set();
+  const refusalIsRetryable = (error) => {
+    try {
+      const d = authzDiagnosisFromRefusal(String(error ?? ""));
+      return d?.code === "nomos.authz.signer_enrollment_missing";
+    } catch {
+      return false;
+    }
+  };
+  const emitLocalWorkRejected = (source, refused, resetTo) => {
+    if (!refused.length) return;
+    const items = refused.map((r) => ({
+      intentId: typeof r.intentId === "string" ? r.intentId : null,
+      oid: typeof r.oid === "string" ? r.oid : null,
+      domain: typeof r.domain === "string" ? r.domain : null,
+      directiveId: typeof r.directiveId === "string" ? r.directiveId : null,
+      error: String(r.error ?? "the law refused this offer").slice(0, 600),
+      retryable: refusalIsRetryable(r.error)
+    }));
+    const event = {
+      workspace,
+      refused: items,
+      parked: true,
+      resetTo,
+      retryable: items.every((i) => i.retryable),
+      source
+    };
+    if (localWorkRejectedHook) {
+      try {
+        localWorkRejectedHook(event);
+      } catch {
+      }
+    }
+    for (const l of [...localWorkRejectedListeners]) {
+      try {
+        l(event);
+      } catch {
+      }
+    }
+  };
   function captureIncarnation(j) {
     const inc = j && typeof j.incarnation === "string" && OID40_RE.test(j.incarnation) ? j.incarnation : null;
     if (inc !== null) remoteIncarnation = inc;
@@ -8434,6 +8475,7 @@ ${String(commit).toLowerCase()}`;
         }
       }
     }
+    if (deadLettered.length) emitLocalWorkRejected("sync", deadLettered.map((d) => ({ intentId: d.id, error: d.error })), remoteHead);
     invalidateInstalledLawMetadata();
     nudgeWatches();
     return {
@@ -10746,6 +10788,22 @@ ${String(commit).toLowerCase()}`;
       if (typeof cb === "function") custodyListeners.add(cb);
       return () => custodyListeners.delete(cb);
     },
+    /** THE LOCAL-WORK-REJECTED HOOK (settable; connect({onLocalWorkRejected}) is the default) — the
+     *  typed "the cloud refused work your device had accepted" lifecycle event. See
+     *  `LocalWorkRejectedEvent`: refused intents are already parked + survivors replayed when it
+     *  fires; the app's only job is honest UX (retryable ⇒ "queued, will retry"; terminal ⇒
+     *  "preserved for review — contact support"). */
+    get onLocalWorkRejected() {
+      return localWorkRejectedHook;
+    },
+    set onLocalWorkRejected(fn) {
+      localWorkRejectedHook = typeof fn === "function" ? fn : null;
+    },
+    /** Subscribe (multi-listener) to LocalWorkRejectedEvents. Returns an unsubscribe fn. */
+    onLocalWorkRejectedEvent: (cb) => {
+      if (typeof cb === "function") localWorkRejectedListeners.add(cb);
+      return () => localWorkRejectedListeners.delete(cb);
+    },
     /**
      * INTROSPECTION — where this holon sits on the custody spectrum:
      *  `{ incarnation, localGenesis, remoteIncarnation, syncPosture, pendingLocalIntents, salvagedIntents,
@@ -12215,6 +12273,10 @@ ${String(commit).toLowerCase()}`;
         });
         _convSpan.end();
         if (result && result.custodyBreak) return await resolveCustodyBreakFlow(result.custodyBreak, { operation: "sync" });
+        if (admissionRefusals && admissionRefusals.size) {
+          const refusedEntries = (admission?.sessions || []).flatMap((s) => (s.rejected || []).map((r) => ({ intentId: r.intent, oid: r.oid, error: r.error })));
+          emitLocalWorkRejected("admission", refusedEntries, result && typeof result.remoteMain === "string" ? result.remoteMain : null);
+        }
         try {
           result.stillAhead = await resolveBranchHead() !== syncedBase;
         } catch {

package/src/compile_package_main.ts

@@ -836,6 +836,10 @@ const DART_SUPPORT_CORE_SRC = [
   // The custody-lifecycle types (NomosCustodyBreak/NomosCustodyStatus/CustodyBreakPolicy) — the generated
   // client + the vendored bridge reference them through the barrel, so they must vendor. Pure data.
   "custody.dart",
+  // THE LOCAL-WORK-REJECTED LIFECYCLE (seated_barrier_and_seal_obligation.md Part 4):
+  // NomosLocalWorkRejectedEvent/NomosRejectedIntent — the vendored bridge's localWorkRejectedEvents
+  // stream types ride through the barrel, so they must vendor. Pure data.
+  "local_work_rejected.dart",
   // SURFACED MERGE CONFLICTS: SurfacedValue<T>/SurfacedObservation<T> — a generated read model with a
   // `.merge(Surfaced(...))` field references them through the barrel, so they must vendor. Pure data.
   "surfaced.dart",
@@ -1649,12 +1653,12 @@ const dartTypesImportFor = (generatedSource: string): string => {
  *  just the floor generated code needs — a lagging pin forces tenants into dependency_overrides. */
 // 0.3.0: SurfacedValue<T>/SurfacedObservation/PendingConflictRow — generated Surfaced-field typing +
 //        the pendingConflicts read rows.
-const NOMOS_TYPES_DEP = "^0.8.5";
+const NOMOS_TYPES_DEP = "^0.8.6";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.64.18";
-const NOMOS_FLUTTER_DEP = "^0.63.30";
+const NOMOS_CLIENT_DEP = "^0.64.20";
+const NOMOS_FLUTTER_DEP = "^0.63.31";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).