@githolon/dsl 0.105.4 → 0.105.6

package/dart/lib/src/webview_bridge.dart

@@ -34,7 +34,8 @@ import 'package:nomos_types/nomos_types.dart'
         ReferenceVersionUnavailable,
         CustodyBreakPolicy,
         NomosCustodyEvent,
-        NomosCustodyStatus;
+        NomosCustodyStatus,
+        NomosLocalWorkRejectedEvent;
 import 'package:nomos_types/src/nomos_ref.dart' show NmsInternalNomosRefs;
 import 'package:nomos_types/src/versioned_nomos_ref.dart'
     show NmsInternalVersionedNomosRefs;
@@ -1230,6 +1231,11 @@ class NomosBridge {
   // [resolveCustodyBreak].
   final StreamController<NomosCustodyEvent> _custodyEvents =
       StreamController<NomosCustodyEvent>.broadcast();
+  // LOCAL-WORK-REJECTED LIFECYCLE (seated_barrier_and_seal_obligation.md Part 4): the typed "the
+  // cloud refused work this device had accepted" event — refused intents already parked (client DLQ
+  // + refused/* custody refs), survivors already replayed; the app renders honest UX from this.
+  final StreamController<NomosLocalWorkRejectedEvent> _localWorkRejectedEvents =
+      StreamController<NomosLocalWorkRejectedEvent>.broadcast();
   final StreamController<Map<String, Object?>> _flameEvents =
       StreamController<Map<String, Object?>>.broadcast();
   final StreamController<Map<String, Object?>> _spanEvents =
@@ -1505,6 +1511,17 @@ class NomosBridge {
       if (ev != null && !_custodyEvents.isClosed) _custodyEvents.add(ev);
       return;
     }
+    if (event == 'localWorkRejected') {
+      // LOCAL-WORK-REJECTED: { event:'localWorkRejected', session, localWorkRejected:{ workspace,
+      // refused, parked, resetTo, retryable, source } }. The framework already parked the refused
+      // intents + replayed survivors; the app's only job is the honest message (retryable ⇒ "queued,
+      // will retry"; terminal ⇒ "preserved for review — contact support").
+      final ev = NomosLocalWorkRejectedEvent.fromMessage(m);
+      if (ev != null && !_localWorkRejectedEvents.isClosed) {
+        _localWorkRejectedEvents.add(ev);
+      }
+      return;
+    }
     if (event == 'transfer') {
       // LIVE pack byte-progress { received, total, kind } — the real loading bar (host Content-Length).
       final tp = TransferProgress.fromMessage(m);
@@ -1585,13 +1602,27 @@ class NomosBridge {
       sampled: true,
     );
     _pendingTraces[id] = trace;
-    _transport.send({
-      'v': kWebviewBridgeVersion,
-      'id': id,
-      'op': op,
-      'args': args,
-      'trace': trace.toJson(),
-    });
+    try {
+      _transport.send({
+        'v': kWebviewBridgeVersion,
+        'id': id,
+        'op': op,
+        'args': args,
+        'trace': trace.toJson(),
+      });
+    } catch (error, stackTrace) {
+      // A transport that refuses (disposed at teardown, closed pipe) must fail
+      // THE FUTURE, not throw synchronously: a sync throw bypasses every
+      // `.catchError`/`onError` guard callers attach for exactly this case
+      // (watch re-registration and unwatch during dispose), leaks the pending
+      // completer, and lands as an unhandled error in whatever zone happened to
+      // be current — the "thrown after the test had completed" noise that buried
+      // ~100 real test results. Same loud error, delivered where errors go.
+      _pending.remove(id);
+      _pendingOps.remove(id);
+      _pendingTraces.remove(id);
+      completer.completeError(error, stackTrace);
+    }
     return completer.future;
   }
 
@@ -1774,6 +1805,23 @@ class NomosBridge {
     }).toList();
   }
 
+  /// Framework-private plane persistence primitive. It snapshots exact local custody even when [workspace]
+  /// was born in the kernel but no Dart runner session has ever acquired it. This does not connect, mount a
+  /// tenant session, fetch from cloud, or grant authority; the serving realm exports its resident plane view.
+  Future<({String workspace, String head, String? snapshot, bool unchanged})>
+      nomosInternalSnapshotWorkspace(String workspace, {String? ifHead}) async {
+    final r = _asMap(await _call('snapshotWorkspace', {
+      'workspace': workspace,
+      if (ifHead != null && ifHead.isNotEmpty) 'ifHead': ifHead,
+    }));
+    return (
+      workspace: (r['workspace'] ?? workspace).toString(),
+      head: (r['head'] ?? '').toString(),
+      snapshot: r['snapshot']?.toString(),
+      unchanged: r['unchanged'] == true,
+    );
+  }
+
   /// Open a workspace on this plane: boot its LOCAL githolon under the installed law (from [restoreFrom]
   /// custody, or a cloud pull when [cloud] is given). This is the sugar the single-workspace path uses; a
   /// multi-workspace app names a [session] per workspace and holds their [session] handles.
@@ -1850,6 +1898,15 @@ class NomosBridge {
   Stream<NomosCustodyEvent> get custodyEvents =>
       _eventPlane._custodyEvents.stream;
 
+  /// THE LOCAL-WORK-REJECTED STREAM (seated_barrier_and_seal_obligation.md Part 4): the cloud's gate
+  /// refused work this device's own kernel had accepted. Refused intents are already durably parked
+  /// (client DLQ + the workspace's refused/* refs) and surviving local work already replayed when an
+  /// event arrives — bind honest UX to it: `retryable` ⇒ "your changes are queued and will retry";
+  /// otherwise ⇒ "your changes were preserved for review — contact support". Never render the raw
+  /// refusal text as the headline.
+  Stream<NomosLocalWorkRejectedEvent> get localWorkRejectedEvents =>
+      _eventPlane._localWorkRejectedEvents.stream;
+
   /// Where a session sits on the custody spectrum (incarnation, posture, pending/salvaged local work,
   /// supersession history) — for a status banner or a "you're offline on old truth" indicator.
   Future<NomosCustodyStatus> custodyStatus({String? session}) async =>
@@ -2325,7 +2382,52 @@ class NomosBridge {
     }
     // SINGLE-FLIGHT: one in-flight open per workspace per plane; concurrent callers join it.
     return plane._acquiring.putIfAbsent(workspace, () async {
-      try {
+      // RESIDENCY IS THE KERNEL'S TO DEMAND AND OURS TO SATISFY. Replaying a chain can reach a
+      // colocated read whose source workspace is not mounted; the kernel refuses TYPED, naming it.
+      // Mount the named sibling — which consults local custody first and only then clones — and
+      // retry. Bounded, and each name is satisfied at most once, so a genuinely missing workspace
+      // fails with the kernel's own refusal instead of spinning.
+      final satisfied = <String>{};
+      for (var round = 0;; round++) {
+        try {
+          return await _acquireSessionOnce(
+            workspace,
+            ready: ready,
+            inheritPrincipal: inheritPrincipal,
+            ifAbsentCredentials: ifAbsentCredentials,
+            authorSecret: authorSecret,
+          );
+        } catch (error) {
+          final required = nomosInternalResidencyRequiredWorkspace(error);
+          if (required == null ||
+              required == workspace ||
+              !satisfied.add(required) ||
+              round >= 8) {
+            rethrow;
+          }
+          await acquireSession(
+            required,
+            ifAbsentCredentials: ifAbsentCredentials,
+            authorSecret: authorSecret,
+            inheritedPrincipal: sourcePrincipal,
+          );
+        }
+      }
+    }).whenComplete(() {
+      plane._acquiring.remove(workspace);
+    });
+  }
+
+  Future<NomosSession> _acquireSessionOnce(
+    String workspace, {
+    required Future<NomosSession> Function(NomosSession) ready,
+    required void Function() inheritPrincipal,
+    Future<NomosSessionCredentials> Function()? ifAbsentCredentials,
+    String? authorSecret,
+  }) async {
+    final plane = _eventPlane;
+    {
+      {
         if (plane._sessionNames.contains(workspace)) {
           return ready(session(workspace));
         }
@@ -2401,11 +2503,8 @@ class NomosBridge {
           allowUnborn: c.allowUnborn,
         );
         return ready(session(workspace));
-      } finally {
-        // completed (either way) — the next acquire re-evaluates fresh (a live session hits the fast path).
-        plane._acquiring.remove(workspace);
       }
-    });
+    }
   }
 
   /// @internal Attach the generated application's opaque local-custody store
@@ -2805,18 +2904,23 @@ class NomosBridge {
   /// `principal` on `parent`'s chain (`identity:<principal>#signer@key:<sha256(publicKey)>`)? One O(1)
   /// relation read over the open gateway; nothing is authored. Returns
   /// `{parent, principal, keyHash, object, relation, enrolled, revoked, checkedAt}`.
+  /// Pass `remote: true` to force the CLOUD-gateway read even when this holon IS the parent — the
+  /// seated barrier's proof-by-read: `enrolled: true` then means the shared chain durably holds this
+  /// device's signer tuple, not merely that the local fold ran.
   Future<Map<String, Object?>> parentSignerEnrollment(
           {required String parent,
           required String principal,
           String? keyHash,
           String? publicKey,
-          String? authToken}) async =>
+          String? authToken,
+          bool remote = false}) async =>
       _asMap(await _call('parentSignerEnrollment', {
         'parent': parent,
         'principal': principal,
         if (keyHash != null) 'keyHash': keyHash,
         if (publicKey != null) 'publicKey': publicKey,
         if (authToken != null) 'authToken': authToken,
+        if (remote) 'remote': true,
       }));
 
   /// IDEMPOTENT PARENT-SIGNER RECOVERY — ensure this device key is a live `signer` on `parent`,
@@ -3623,24 +3727,34 @@ class NomosBridge {
     required int t0,
     required int t1,
     String? id,
+    String? session,
+    String? head,
   }) {
     final plane = _eventPlane;
     final sid = id ?? 'local-${plane._localSpanSeq++}';
     for (final m in <Map<String, Object?>>[
       {
         'event': 'span',
+        if (session != null && session.isNotEmpty) 'session': session,
         'span': {
           'phase': 'begin',
           'id': sid,
           'track': track,
           'name': name,
           'kind': kind,
-          't0': t0
+          't0': t0,
+          if (head != null && head.isNotEmpty) 'head': head,
         }
       },
       {
         'event': 'span',
-        'span': {'phase': 'end', 'id': sid, 't1': t1}
+        if (session != null && session.isNotEmpty) 'session': session,
+        'span': {
+          'phase': 'end',
+          'id': sid,
+          't1': t1,
+          if (head != null && head.isNotEmpty) 'head': head,
+        }
       },
     ]) {
       plane._spanBuffer.add(m);
@@ -3927,6 +4041,7 @@ class NomosBridge {
     if (!_syncEvents.isClosed) await _syncEvents.close();
     if (!_signalEvents.isClosed) await _signalEvents.close();
     if (!_custodyEvents.isClosed) await _custodyEvents.close();
+    if (!_localWorkRejectedEvents.isClosed) await _localWorkRejectedEvents.close();
     if (!_flameEvents.isClosed) await _flameEvents.close();
     if (!_spanEvents.isClosed) await _spanEvents.close();
     if (!_transferEvents.isClosed) await _transferEvents.close();
@@ -4238,3 +4353,21 @@ class _BridgeForeignWorkspaceReader implements NomosForeignWorkspaceReader {
     return ctrl.stream;
   }
 }
+
+/// THE KERNEL NAMES WHAT IT NEEDS. When a chain replay reaches a colocated foreign read whose
+/// source workspace is not mounted, the kernel refuses with a typed, machine-readable message
+/// naming that workspace. The cloud has satisfied this since the requirement was introduced; the
+/// client never learned to, so an estate whose history reads a catalogue simply could not open on a
+/// device — the same kernel, the same rule, only one implementer.
+///
+/// Parses the workspace name out of the refusal, or null when this is some other failure. Matching
+/// on the message is deliberate and narrow: the refusal is kernel-authored and stable, and the
+/// alternative — treating every open failure as a residency miss — would retry real errors forever.
+String? nomosInternalResidencyRequiredWorkspace(Object error) {
+  final text = error.toString();
+  if (!text.contains('foreign-read-not-ready')) return null;
+  final match = RegExp(r"source workspace '([^']+)' is not resident")
+      .firstMatch(text);
+  final workspace = match?.group(1)?.trim();
+  return (workspace == null || workspace.isEmpty) ? null : workspace;
+}

package/dart/pubspec.lock

@@ -191,7 +191,7 @@ packages:
       path: "../dart_types"
       relative: true
     source: path
-    version: "0.8.4"
+    version: "0.8.7"
   package_config:
     dependency: "direct main"
     description:

package/dart/pubspec.yaml

@@ -7,7 +7,7 @@ repository: https://github.com/Captain-App/nomos2
 description: >-
   Nomos 2 Dart client — generated domain values, intent payloads and application
   lifecycle types over the typed Nomos kernel protocol and USDA custody model.
-version: 0.64.19
+version: 0.64.23
 
 environment:
   sdk: ^3.5.0
@@ -16,7 +16,7 @@ dependencies:
   # The pure-data core (wire types, offer codec, NomosReads, schema validation, error
   # info). nomos_client depends on and re-exports it, so existing imports are unchanged.
   # For local monorepo dev, pubspec_overrides.yaml points this at ../dart_types.
-  nomos_types: ^0.8.4
+  nomos_types: ^0.8.7
   json_schema: ^5.2.2
   crypto: ^3.0.0
   package_config: ^2.1.0

package/dart/test/acquire_session_test.dart

@@ -70,6 +70,17 @@ class FakeRunner implements BridgeTransport {
             ]
           };
           break;
+        case 'snapshotWorkspace':
+          result = {
+            'workspace': args['workspace'],
+            'head': 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+            if (args['ifHead'] ==
+                'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa')
+              'unchanged': true
+            else
+              'snapshot': 'resident-snapshot-b64',
+          };
+          break;
         default:
           result = {};
       }
@@ -392,6 +403,32 @@ void main() {
     await bridge.dispose();
   });
 
+  test(
+      'plane snapshot exports resident custody without manufacturing a Dart session',
+      () async {
+    final runner = FakeRunner(resident: ['born-child']);
+    final bridge = NomosBridge(runner);
+    await bridge.ready;
+
+    final saved =
+        await bridge.nomosInternalSnapshotWorkspace('born-child');
+    expect(saved.workspace, 'born-child');
+    expect(saved.head, 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa');
+    expect(saved.snapshot, 'resident-snapshot-b64');
+    expect(saved.unchanged, isFalse);
+    expect(runner.connectCount, 0,
+        reason:
+            'save-all must not acquire an unopened child or invent host authority');
+
+    final unchanged = await bridge.nomosInternalSnapshotWorkspace(
+        'born-child',
+        ifHead: saved.head);
+    expect(unchanged.unchanged, isTrue);
+    expect(unchanged.snapshot, isNull);
+    expect(runner.connectCount, 0);
+    await bridge.dispose();
+  });
+
   test(
       'NomosSession.isConnected + assertConnected: fail at BIND, not on first query',
       () async {

package/dart/test/residency_refusal_test.dart

@@ -0,0 +1,49 @@
+// THE KERNEL NAMES WHAT IT NEEDS; EVERY HOST MUST SATISFY IT.
+//
+// The colocated-read residency rule is enforced by the KERNEL, so it fires identically in the cloud
+// container and on a phone — the whole point of one artifact everywhere. It shipped with only the
+// cloud taught to satisfy it, so an estate whose history reads a catalogue could not open on a
+// device at all. These tests pin the client's half: the exact refusal the kernel emits must be
+// recognised, and nothing else must be mistaken for it.
+import 'package:test/test.dart';
+import 'package:nomos_client/src/webview_bridge.dart'
+    show nomosInternalResidencyRequiredWorkspace;
+
+void main() {
+  test('recognises the kernel refusal and names the workspace to mount', () {
+    // Verbatim from a device, 2026-08-07 (build 1182, opening an estate).
+    const refusal =
+        'NomosBridgeError: NMS-KERNEL-CALL: restore_main: imported custody was refused: '
+        '{"atCommit":"2059537e7c7d1dcaa9b4f6f4ac2ded2ae59b53a5","atIndex":20,'
+        '"check":"colocated-read","error":"foreign-read-not-ready: source workspace '
+        "'catalogue-531e3764f974ff741be62b119a28f0a9dbf396d7' is not resident in this kernel\","
+        '"mode":"verify_chain","ok":true,"valid":false,"walk":"full"}';
+    expect(
+      nomosInternalResidencyRequiredWorkspace(refusal),
+      'catalogue-531e3764f974ff741be62b119a28f0a9dbf396d7',
+    );
+  });
+
+  test('does not mistake other failures for a residency miss', () {
+    // If any of these were read as "mount something and retry", a real error would retry forever.
+    for (final other in <String>[
+      'NomosBridgeError: NMS-KERNEL-CALL: restore_main: verification failed: bad signature',
+      'NomosSeatingPendingFailure: signer enrollment is not yet provably durable',
+      'StateError: the workspace is not on this device\'s plane',
+      '',
+    ]) {
+      expect(nomosInternalResidencyRequiredWorkspace(other), isNull,
+          reason: 'must not treat "$other" as a residency requirement');
+    }
+  });
+
+  test('the sibling refusal that names no workspace is not actionable', () {
+    // The kernel has a second foreign-read-not-ready shape for an unsafe path. There is nothing to
+    // mount, so it must fall through to the caller rather than being retried.
+    expect(
+      nomosInternalResidencyRequiredWorkspace(
+          "foreign-read-not-ready: source workspace '../escape' is not a safe internal custody path"),
+      isNull,
+    );
+  });
+}

package/dart/test/sealing_client_test.dart

@@ -19,7 +19,7 @@ String get _root => '${Directory.current.path}/../..';
 String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
 String get _fixture => '$_root/cloud/web-client/test/fixtures/encrypted-notes';
 String get _deploy => '$_fixture/build/encrypted-notes.law.usdz';
-String get _lockfile => '$_fixture/nomos.stable-ids.json';
+String get _lockfile => '$_fixture/nomos.identity.usda';
 String get _runtimeDir =>
     Platform.environment['NOMOS_DART_RUNTIME'] ??
     Platform.environment['NOMOS_OFFLINE_RUNTIME'] ??

package/dart/test/webview_bridge_test.dart

@@ -618,6 +618,25 @@ void main() {
     await bridge.ready.timeout(const Duration(seconds: 1));
   });
 
+  test('a local durability span remains workspace/head specific', () async {
+    await bridge.ready;
+    bridge.noteLocalSpan(
+      track: 'submit',
+      name: 'durable save (disk)',
+      kind: 'persist',
+      t0: 100,
+      t1: 120,
+      session: 'born-child',
+      head: '2222222222222222222222222222222222222222',
+    );
+    final saved = bridge.recentSpans
+        .where((event) => event['session'] == 'born-child')
+        .toList();
+    expect(saved, hasLength(2));
+    expect((saved.last['span'] as Map)['head'],
+        '2222222222222222222222222222222222222222');
+  });
+
   test('dispose closes active watches without mutating its iteration',
       () async {
     await bridge.ready;

package/dart_types/CHANGELOG.md

@@ -1,3 +1,16 @@
+## 0.8.7
+
+- Decode only the kernel's stamped structural map-entry envelope as an envelope. Ordinary domain
+  objects that happen to contain a `value` field now retain all of their fields.
+
+## 0.8.6
+
+- NEW: `NomosLocalWorkRejectedEvent` / `NomosRejectedIntent` — the typed "the cloud refused work your
+  device had accepted" lifecycle event (architecture/seated_barrier_and_seal_obligation.md Part 4).
+  By the time it fires, refused intents are durably parked on BOTH sides (client DLQ + workspace
+  refused/* refs) and surviving local work is rebase-replayed — no work is ever lost. `retryable`
+  distinguishes transient-premise refusals (auto-retry clears them) from terminal ones.
+
 ## 0.8.5
 
 - Expose bounded generated-startup and referenced-workspace custody failures as typed data so applications

package/dart_types/lib/nomos_types.dart

@@ -50,6 +50,10 @@ export 'src/git_object_id.dart';
 // The CUSTODY-LIFECYCLE types (rebirth_and_custody_lifecycle.md): NomosCustodyBreak / NomosCustodyStatus /
 // CustodyBreakPolicy — custody incompatibility as a first-class, typed, app-decidable event. Pure data.
 export 'src/custody.dart';
+// THE LOCAL-WORK-REJECTED LIFECYCLE (seated_barrier_and_seal_obligation.md Part 4):
+// NomosLocalWorkRejectedEvent / NomosRejectedIntent — "the cloud refused work your device had
+// accepted" as a first-class, typed, app-renderable event (refused work is parked, never lost).
+export 'src/local_work_rejected.dart';
 // SURFACED MERGE CONFLICTS (architecture/surfaced_merge_conflict.md): the read-collapse types for a
 // `.merge(Surfaced(...))` field — SurfacedValue<T> (resolved scalar | pending observations). Pure data.
 export 'src/surfaced.dart';

package/dart_types/lib/src/local_work_rejected.dart

@@ -0,0 +1,117 @@
+// THE LOCAL-WORK-REJECTED LIFECYCLE EVENT (architecture/seated_barrier_and_seal_obligation.md Part 4).
+//
+// Fired when work THIS device authored locally — and which its OWN kernel admitted — is REFUSED by the
+// shared workspace's gate on sync/admission. Local-first means local acceptance is a real, honest
+// verdict; the shared chain's gate re-judges from ITS state, and the two can disagree (a premise the
+// device relied on hadn't landed yet, or the write genuinely violates shared law). By the time this
+// event fires the framework has already done the right thing:
+//
+//   • every refused intent is durably PARKED on BOTH sides (the client dead-letter queue AND the
+//     workspace's refused/* custody refs) — inspectable, re-offerable, NEVER lost;
+//   • every surviving unrefused local intent was rebase-replayed onto canonical main;
+//   • local state converged to [resetTo].
+//
+// The app's ONLY job is honest UX. [retryable] is the fork in the message:
+//   true  ⇒ "Your changes are queued and will be retried automatically." (transient premise — e.g.
+//            this device's signer enrollment hadn't landed on the chain yet)
+//   false ⇒ "Your changes couldn't be accepted and have been preserved for review — contact support."
+// Never show [NomosRejectedIntent.error] raw to an end user — it is the gate's diagnostic text.
+class NomosRejectedIntent {
+  final String? intentId;
+  final String? oid;
+  final String? domain;
+  final String? directiveId;
+
+  /// The gate's own refusal text (diagnostic — for logs/support disclosure, never the headline).
+  final String error;
+
+  /// Transient-premise refusal that auto-retry can clear.
+  final bool retryable;
+
+  const NomosRejectedIntent({
+    this.intentId,
+    this.oid,
+    this.domain,
+    this.directiveId,
+    required this.error,
+    required this.retryable,
+  });
+
+  factory NomosRejectedIntent.fromJson(Map<String, dynamic> j) =>
+      NomosRejectedIntent(
+        intentId: j['intentId'] as String?,
+        oid: j['oid'] as String?,
+        domain: j['domain'] as String?,
+        directiveId: j['directiveId'] as String?,
+        error: (j['error'] ?? '') as String,
+        retryable: j['retryable'] == true,
+      );
+
+  Map<String, dynamic> toJson() => {
+        'intentId': intentId,
+        'oid': oid,
+        'domain': domain,
+        'directiveId': directiveId,
+        'error': error,
+        'retryable': retryable,
+      };
+}
+
+/// The typed "the cloud refused work your device had accepted" event. See library docs above —
+/// refused work is already parked and survivors replayed when this fires; render honest UX only.
+class NomosLocalWorkRejectedEvent {
+  final String workspace;
+  final String? session;
+  final List<NomosRejectedIntent> refused;
+
+  /// Always true when the event fires: the refused intents are durably parked (client DLQ +
+  /// workspace refused/* refs).
+  final bool parked;
+
+  /// The canonical main local state converged to.
+  final String? resetTo;
+
+  /// True iff EVERY refusal in the batch is retryable.
+  final bool retryable;
+
+  /// "admission" (the edge refused our offers) or "sync" (the offer-gated converge dead-lettered
+  /// local tail intents).
+  final String source;
+
+  const NomosLocalWorkRejectedEvent({
+    required this.workspace,
+    this.session,
+    required this.refused,
+    required this.parked,
+    this.resetTo,
+    required this.retryable,
+    required this.source,
+  });
+
+  static NomosLocalWorkRejectedEvent? fromMessage(Map<String, dynamic> m) {
+    final e = (m['localWorkRejected'] as Map?)?.cast<String, dynamic>();
+    if (e == null) return null;
+    return NomosLocalWorkRejectedEvent(
+      workspace: (e['workspace'] ?? '') as String,
+      session: m['session'] as String?,
+      refused: ((e['refused'] as List?) ?? const [])
+          .whereType<Map>()
+          .map((r) => NomosRejectedIntent.fromJson(r.cast<String, dynamic>()))
+          .toList(growable: false),
+      parked: e['parked'] != false,
+      resetTo: e['resetTo'] as String?,
+      retryable: e['retryable'] == true,
+      source: (e['source'] ?? 'sync') as String,
+    );
+  }
+
+  Map<String, dynamic> toJson() => {
+        'workspace': workspace,
+        'session': session,
+        'refused': refused.map((r) => r.toJson()).toList(growable: false),
+        'parked': parked,
+        'resetTo': resetTo,
+        'retryable': retryable,
+        'source': source,
+      };
+}

package/dart_types/lib/src/subscriptions.dart

@@ -524,13 +524,17 @@ Map<String, Object?> readJsonMapOrEmpty(
 /// container (the flat projection re-parsed it) is returned as-is. A bare scalar (int
 /// from a spike path) is returned unchanged.
 Object? _decodeJsonMapValue(Object? val) {
+  // ONLY the kernel's structural entry shape `{value: {Str|Int: ...}, stamp: ...}`
+  // may be unwrapped. Keying the check on `value` alone ate any legitimate
+  // domain object that happens to carry a `value` field (a custom-field entry
+  // `{fieldId, status, updatedAt, value}` lost everything but its value).
   if (val is Map && val.containsKey('value')) {
     final value = val['value'];
     if (value is Map && value.containsKey('Str')) {
       return _maybeJsonDecode(value['Str']);
     }
     if (value is Map && value.containsKey('Int')) return value['Int'];
-    return value;
+    if (val.containsKey('stamp')) return value;
   }
   return _maybeJsonDecode(val);
 }

package/dart_types/pubspec.yaml

@@ -9,7 +9,7 @@ description: >-
   Pure kernel wire/data types for Nomos Dart frontends — no transport, no bridge,
   no runtime. Typed protobuf and USDA boundary values plus the offer codec,
   reactive read engine, schema validation, and data-only error/trace types.
-version: 0.8.5
+version: 0.8.7
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.105.4",
+  "version": "0.105.6",
   "type": "module",
   "sideEffects": false,
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",