@githolon/dsl 0.106.0 → 0.107.1

package/dart/lib/src/webview_bridge.dart

@@ -104,56 +104,62 @@ final class NomosBirthCertificate {
     Map<String, Object?> wire,
     String camel,
     String snake,
-  ) => (wire[camel] ?? wire[snake] ?? '').toString();
+  ) =>
+      (wire[camel] ?? wire[snake] ?? '').toString();
 
   static List<int> _bytes(
     Map<String, Object?> wire,
     String camel,
     String snake,
-  ) => ((wire[camel] ?? wire[snake]) as List? ?? const <Object?>[])
-      .map((value) => (value as num).toInt())
-      .toList(growable: false);
+  ) =>
+      ((wire[camel] ?? wire[snake]) as List? ?? const <Object?>[])
+          .map((value) => (value as num).toInt())
+          .toList(growable: false);
 
   factory NomosBirthCertificate.fromWire(
     Map<String, Object?> wire,
-  ) => NomosBirthCertificate(
-    child: _string(wire, 'child', 'child'),
-    founder: _string(wire, 'founder', 'founder'),
-    verified: wire['verified'] == true,
-    parentKey: _bytes(wire, 'parentKey', 'parent_key'),
-    parentId: _string(wire, 'parentId', 'parent_id'),
-    epoch: (wire['epoch'] as num?)?.toInt() ?? 0,
-    signature: _bytes(wire, 'signature', 'signature'),
-    verifiedVia: (wire['verifiedVia'] ?? wire['verified_via'])?.toString(),
-    idpToken: (wire['idpToken'] ?? wire['idp_token'])?.toString(),
-    capturedClock: ((wire['capturedClock'] ?? wire['captured_clock']) as num?)
-        ?.toInt(),
-    authProviderIssuer:
-        (wire['authProviderIssuer'] ?? wire['auth_provider_issuer'])
-            ?.toString(),
-    authProviderJwks: (wire['authProviderJwks'] ?? wire['auth_provider_jwks'])
-        ?.toString(),
-    authProviderAudience:
-        (wire['authProviderAudience'] ?? wire['auth_provider_audience'])
-            ?.toString(),
-  );
+  ) =>
+      NomosBirthCertificate(
+        child: _string(wire, 'child', 'child'),
+        founder: _string(wire, 'founder', 'founder'),
+        verified: wire['verified'] == true,
+        parentKey: _bytes(wire, 'parentKey', 'parent_key'),
+        parentId: _string(wire, 'parentId', 'parent_id'),
+        epoch: (wire['epoch'] as num?)?.toInt() ?? 0,
+        signature: _bytes(wire, 'signature', 'signature'),
+        verifiedVia: (wire['verifiedVia'] ?? wire['verified_via'])?.toString(),
+        idpToken: (wire['idpToken'] ?? wire['idp_token'])?.toString(),
+        capturedClock:
+            ((wire['capturedClock'] ?? wire['captured_clock']) as num?)
+                ?.toInt(),
+        authProviderIssuer:
+            (wire['authProviderIssuer'] ?? wire['auth_provider_issuer'])
+                ?.toString(),
+        authProviderJwks:
+            (wire['authProviderJwks'] ?? wire['auth_provider_jwks'])
+                ?.toString(),
+        authProviderAudience:
+            (wire['authProviderAudience'] ?? wire['auth_provider_audience'])
+                ?.toString(),
+      );
 
   Map<String, Object?> toWire() => <String, Object?>{
-    'child': child,
-    'founder': founder,
-    'verified': verified,
-    'parentKey': parentKey,
-    'parentId': parentId,
-    'epoch': epoch,
-    'signature': signature,
-    if (verifiedVia != null) 'verifiedVia': verifiedVia,
-    if (idpToken != null) 'idpToken': idpToken,
-    if (capturedClock != null) 'capturedClock': capturedClock,
-    if (authProviderIssuer != null) 'authProviderIssuer': authProviderIssuer,
-    if (authProviderJwks != null) 'authProviderJwks': authProviderJwks,
-    if (authProviderAudience != null)
-      'authProviderAudience': authProviderAudience,
-  };
+        'child': child,
+        'founder': founder,
+        'verified': verified,
+        'parentKey': parentKey,
+        'parentId': parentId,
+        'epoch': epoch,
+        'signature': signature,
+        if (verifiedVia != null) 'verifiedVia': verifiedVia,
+        if (idpToken != null) 'idpToken': idpToken,
+        if (capturedClock != null) 'capturedClock': capturedClock,
+        if (authProviderIssuer != null)
+          'authProviderIssuer': authProviderIssuer,
+        if (authProviderJwks != null) 'authProviderJwks': authProviderJwks,
+        if (authProviderAudience != null)
+          'authProviderAudience': authProviderAudience,
+      };
 }
 
 /// Facts signed by [NomosBridge.signBirthCert]. The secret remains a separate argument and never
@@ -188,20 +194,21 @@ final class NomosBirthCertificateSpec {
   final String? authProviderAudience;
 
   Map<String, Object?> toWire() => <String, Object?>{
-    'child': child,
-    'founder': founder,
-    'verified': verified,
-    'parentKey': parentKey,
-    'parentId': parentId,
-    'epoch': epoch,
-    if (verifiedVia != null) 'verifiedVia': verifiedVia,
-    if (idpToken != null) 'idpToken': idpToken,
-    if (capturedClock != null) 'capturedClock': capturedClock,
-    if (authProviderIssuer != null) 'authProviderIssuer': authProviderIssuer,
-    if (authProviderJwks != null) 'authProviderJwks': authProviderJwks,
-    if (authProviderAudience != null)
-      'authProviderAudience': authProviderAudience,
-  };
+        'child': child,
+        'founder': founder,
+        'verified': verified,
+        'parentKey': parentKey,
+        'parentId': parentId,
+        'epoch': epoch,
+        if (verifiedVia != null) 'verifiedVia': verifiedVia,
+        if (idpToken != null) 'idpToken': idpToken,
+        if (capturedClock != null) 'capturedClock': capturedClock,
+        if (authProviderIssuer != null)
+          'authProviderIssuer': authProviderIssuer,
+        if (authProviderJwks != null) 'authProviderJwks': authProviderJwks,
+        if (authProviderAudience != null)
+          'authProviderAudience': authProviderAudience,
+      };
 }
 
 /// The protocol version the runner and the bridge agree on (`webview-runner.mjs` `WEBVIEW_BRIDGE_VERSION`).
@@ -268,6 +275,119 @@ class TransferProgress {
       );
 }
 
+enum KernelProgressOperation { unspecified, restoreMain }
+
+enum KernelProgressPhase {
+  unspecified,
+  checkCustody,
+  readChain,
+  initializeEngine,
+  readTimeline,
+  hydrateLaw,
+  recoveryPrescan,
+  verifyIntents,
+  promoteCustody,
+  rebuildFrontier,
+  complete,
+}
+
+enum KernelProgressUnit { unspecified, intent, lawPackage }
+
+enum KernelLawHydrationStep {
+  unspecified,
+  readClosure,
+  composeStage,
+  deriveSchemas,
+  loadPolicyShell,
+  packageComplete,
+}
+
+/// Typed, authority-free progress from a long-running kernel operation.
+///
+/// Unlike a spinner, [fraction] is derived from work the canonical kernel has
+/// actually completed. This is ephemeral execution telemetry: it cannot enter
+/// custody or authorize an effect.
+final class KernelProgress {
+  const KernelProgress({
+    required this.sequence,
+    required this.operation,
+    required this.phase,
+    required this.completed,
+    required this.total,
+    required this.unit,
+    required this.terminal,
+    required this.lawHydrationStep,
+    required this.lawPackageSha256,
+    required this.hostObservedElapsedMicros,
+    required this.hostObservedPhaseElapsedMicros,
+    required this.kernelAllocatorLiveBytes,
+    required this.kernelAllocatorPeakBytes,
+    required this.processResidentBytes,
+    required this.processPeakResidentBytes,
+  });
+
+  final int sequence;
+  final KernelProgressOperation operation;
+  final KernelProgressPhase phase;
+  final int completed;
+  final int total;
+  final KernelProgressUnit unit;
+  final bool terminal;
+  final KernelLawHydrationStep lawHydrationStep;
+  final String lawPackageSha256;
+  final int hostObservedElapsedMicros;
+  final int hostObservedPhaseElapsedMicros;
+  final int kernelAllocatorLiveBytes;
+  final int kernelAllocatorPeakBytes;
+  final int processResidentBytes;
+  final int processPeakResidentBytes;
+
+  int get unaccountedResidentBytes {
+    final remainder = processResidentBytes - kernelAllocatorLiveBytes;
+    return remainder > 0 ? remainder : 0;
+  }
+
+  double? get fraction =>
+      (total <= 0) ? null : (completed / total).clamp(0.0, 1.0);
+
+  factory KernelProgress.fromMessage(Map<String, Object?> message) =>
+      KernelProgress(
+        sequence: _wireInteger(message['sequence']) ?? 0,
+        operation: KernelProgressOperation.values.firstWhere(
+          (value) => value.name == message['operation'],
+          orElse: () => KernelProgressOperation.unspecified,
+        ),
+        phase: KernelProgressPhase.values.firstWhere(
+          (value) => value.name == message['phase'],
+          orElse: () => KernelProgressPhase.unspecified,
+        ),
+        completed: _wireInteger(message['completed']) ?? 0,
+        total: _wireInteger(message['total']) ?? 0,
+        unit: KernelProgressUnit.values.firstWhere(
+          (value) => value.name == message['unit'],
+          orElse: () => KernelProgressUnit.unspecified,
+        ),
+        terminal: message['terminal'] == true,
+        lawHydrationStep: KernelLawHydrationStep.values.firstWhere(
+          (value) => value.name == message['lawHydrationStep'],
+          orElse: () => KernelLawHydrationStep.unspecified,
+        ),
+        lawPackageSha256: message['lawPackageSha256']?.toString() ?? '',
+        hostObservedElapsedMicros:
+            _wireInteger(message['hostObservedElapsedMicros']) ?? 0,
+        hostObservedPhaseElapsedMicros:
+            _wireInteger(message['hostObservedPhaseElapsedMicros']) ?? 0,
+        kernelAllocatorLiveBytes:
+            _wireInteger(message['kernelAllocatorLiveBytes']) ?? 0,
+        kernelAllocatorPeakBytes:
+            _wireInteger(message['kernelAllocatorPeakBytes']) ?? 0,
+        processResidentBytes:
+            _wireInteger(message['processResidentBytes']) ?? 0,
+        processPeakResidentBytes:
+            _wireInteger(message['processPeakResidentBytes']) ?? 0,
+      );
+}
+
 int? _wireInteger(Object? value) => value is num ? value.toInt() : null;
 
 /// One opaque point in this workspace's verified history. Applications use it as the handle passed to a
@@ -339,17 +459,18 @@ class SyncStatus {
     DateTime? lastSyncedAt,
     String? lastError,
     bool clearError = false,
-  }) => SyncStatus(
-    phase: phase ?? this.phase,
-    ahead: ahead ?? this.ahead,
-    behind: behind ?? this.behind,
-    saved: saved ?? this.saved,
-    onMain: onMain ?? this.onMain,
-    deadLetters: deadLetters ?? this.deadLetters,
-    transfer: clearTransfer ? null : (transfer ?? this.transfer),
-    lastSyncedAt: lastSyncedAt ?? this.lastSyncedAt,
-    lastError: clearError ? null : (lastError ?? this.lastError),
-  );
+  }) =>
+      SyncStatus(
+        phase: phase ?? this.phase,
+        ahead: ahead ?? this.ahead,
+        behind: behind ?? this.behind,
+        saved: saved ?? this.saved,
+        onMain: onMain ?? this.onMain,
+        deadLetters: deadLetters ?? this.deadLetters,
+        transfer: clearTransfer ? null : (transfer ?? this.transfer),
+        lastSyncedAt: lastSyncedAt ?? this.lastSyncedAt,
+        lastError: clearError ? null : (lastError ?? this.lastError),
+      );
 }
 
 bool _sameTransferProgress(TransferProgress? left, TransferProgress? right) =>
@@ -389,10 +510,10 @@ class NomosCreated {
   /// The canonical [NomosRef] view — the `{workspace,type,id}` triple, followable/serializable
   /// (`nomos://<workspace>/<type>/<id>`). One reference, everywhere.
   NomosRef<Object?> get ref => NmsInternalNomosRefs.create<Object?>(
-    workspace: workspace,
-    type: type,
-    id: id,
-  );
+        workspace: workspace,
+        type: type,
+        id: id,
+      );
   @override
   String toString() => id;
 }
@@ -419,10 +540,10 @@ class NomosBbox {
     double? minLat,
     double? maxLng,
     double? maxLat,
-  }) : minX = (minX ?? minLng)!,
-       minY = (minY ?? minLat)!,
-       maxX = (maxX ?? maxLng)!,
-       maxY = (maxY ?? maxLat)!;
+  })  : minX = (minX ?? minLng)!,
+        minY = (minY ?? minLat)!,
+        maxX = (maxX ?? maxLng)!,
+        maxY = (maxY ?? maxLat)!;
 
   /// Deprecated geographic accessors — spatial axes are generic. Prefer [minX]/[minY]/[maxX]/[maxY].
   @Deprecated(
@@ -443,16 +564,16 @@ class NomosBbox {
   double get maxLat => maxY;
 
   Map<String, Object?> toJson() => {
-    'minX': minX,
-    'minY': minY,
-    'maxX': maxX,
-    'maxY': maxY,
-    // Geographic aliases so a pre-genericisation runner (which reads minLng/…) still works.
-    'minLng': minX,
-    'minLat': minY,
-    'maxLng': maxX,
-    'maxLat': maxY,
-  };
+        'minX': minX,
+        'minY': minY,
+        'maxX': maxX,
+        'maxY': maxY,
+        // Geographic aliases so a pre-genericisation runner (which reads minLng/…) still works.
+        'minLng': minX,
+        'minLat': minY,
+        'maxLng': maxX,
+        'maxLat': maxY,
+      };
 }
 
 /// One member's structural compat verdict — `ok`, plus the exact break [reason] when not.
@@ -513,9 +634,8 @@ class NomosCompat {
     final install = (m['install'] as Map?)?.cast<String, Object?>() ?? const {};
     return NomosCompat(
       generatedFor: (m['generatedFor'] as String?) ?? '',
-      workspaceRuns: ((m['workspaceRuns'] as List?) ?? const [])
-          .map((e) => '$e')
-          .toList(),
+      workspaceRuns:
+          ((m['workspaceRuns'] as List?) ?? const []).map((e) => '$e').toList(),
       matches: m['matches'] == true,
       offerKnown: m['offerKnown'] == true,
       structurallyCompatible: m['structurallyCompatible'] as bool?,
@@ -554,13 +674,13 @@ class NomosScopeKey {
     this.workspace,
   });
   Map<String, Object?> toJson() => {
-    'scope': scope,
-    'epoch': epoch,
-    'key': key,
-    if (ownedKeySubject != null) 'ownedKeySubject': ownedKeySubject,
-    if (ownedCustody != null) 'ownedCustody': ownedCustody,
-    if (workspace != null) 'workspace': workspace,
-  };
+        'scope': scope,
+        'epoch': epoch,
+        'key': key,
+        if (ownedKeySubject != null) 'ownedKeySubject': ownedKeySubject,
+        if (ownedCustody != null) 'ownedCustody': ownedCustody,
+        if (workspace != null) 'workspace': workspace,
+      };
 }
 
 /// The entire app-facing multi-device surface for owned business state. The request is deliberately an
@@ -790,7 +910,7 @@ class BirthIncomplete implements Exception {
     return 'BirthIncomplete: ${failedBirths.length} child workspace(s) did NOT come up — $list. '
         'The parent offer admitted, but the child was not fully born, so opening it would poll head:null '
         'until timeout. ${lawUnavailable ? "The child's law package is not resolvable from the parent's "
-                  "custody — deploy it to the parent (POST /v2/workspaces/<parent>/domains) BEFORE birthing." : "See the outcome's reason/code."}';
+            "custody — deploy it to the parent (POST /v2/workspaces/<parent>/domains) BEFORE birthing." : "See the outcome's reason/code."}';
   }
 }
 
@@ -852,14 +972,13 @@ class NomosEncryption {
     final subjects = rows.isEmpty
         ? const <String, dynamic>{}
         : ((rows.first['data'] as Map?)?['subjects'] as Map?) ??
-              const <String, dynamic>{};
+            const <String, dynamic>{};
     final out = <String>[];
     subjects.forEach((subj, leafRaw) {
       Map? leaf;
       try {
-        leaf = leafRaw is String
-            ? jsonDecode(leafRaw) as Map
-            : (leafRaw as Map);
+        leaf =
+            leafRaw is String ? jsonDecode(leafRaw) as Map : (leafRaw as Map);
       } catch (_) {
         leaf = null;
       }
@@ -986,7 +1105,8 @@ class NomosEncryption {
       },
       actor: actor,
       domainHash: domainHash,
-    )).head;
+    ))
+        .head;
     return NomosEpochResult(head: head, epoch: epoch, roster: members);
   }
 
@@ -1060,13 +1180,14 @@ class NomosEncryption {
     Map<String, String>? memberKeys,
     List<String>? expectRoster,
     String? openedAt,
-  }) => _advance(
-    _defScope(scope),
-    scopeKey: scopeKey,
-    memberKeys: memberKeys,
-    expectRoster: expectRoster,
-    openedAt: openedAt,
-  );
+  }) =>
+      _advance(
+        _defScope(scope),
+        scopeKey: scopeKey,
+        memberKeys: memberKeys,
+        expectRoster: expectRoster,
+        openedAt: openedAt,
+      );
 }
 
 /// The result of [NomosBridge.offerCreates]: the new local [head], every aggregate the plan minted, and —
@@ -1091,8 +1212,9 @@ final class NomosOperationStatus {
 /// adopted that shared position. Callers never inspect workspaces, URLs, credentials, headers or Git heads.
 final class NomosOperationReceipt {
   NomosOperationReceipt._()
-    : _status = const NomosOperationStatus(NomosOperationPhase.locallyAccepted),
-      _changes = StreamController<NomosOperationStatus>.broadcast();
+      : _status =
+            const NomosOperationStatus(NomosOperationPhase.locallyAccepted),
+        _changes = StreamController<NomosOperationStatus>.broadcast();
 
   NomosOperationStatus _status;
   final StreamController<NomosOperationStatus> _changes;
@@ -1307,12 +1429,14 @@ class NomosBridge {
       []; // recent span events — so BOOT spans (emitted during connect, before the UI subscribes) survive
   final StreamController<TransferProgress> _transferEvents =
       StreamController<TransferProgress>.broadcast();
+  final StreamController<KernelProgress> _kernelProgressEvents =
+      StreamController<KernelProgress>.broadcast();
   // The DERIVED app-ready sync state. seeded-on-listen with a metrics poll; updated on sync/signal/transfer.
   late final StreamController<SyncStatus> _syncStatusCtrl =
       StreamController<SyncStatus>.broadcast(
-        onListen: _startStatusPoll,
-        onCancel: _stopStatusPollIfUnused,
-      );
+    onListen: _startStatusPoll,
+    onCancel: _stopStatusPollIfUnused,
+  );
   SyncStatus _status = const SyncStatus();
   final Map<String, SyncStatus> _statusBySession = {};
   final Map<String, StreamController<SyncStatus>> _syncStatusBySession = {};
@@ -1349,7 +1473,7 @@ class NomosBridge {
   // child sessions. The callback receives only the typed review object; child
   // addresses, archives, credentials and lifecycle directives remain private.
   final Map<String, Future<void> Function(DomainClientModelAdoptionRequired)>
-  _sessionModelChangeHandlers = {};
+      _sessionModelChangeHandlers = {};
   // [acquireSession]'s per-workspace single-flight: workspace → the in-flight open every concurrent
   // acquirer joins (removed when it completes; a live session then hits the fast path instead).
   final Map<String, Future<NomosSession>> _acquiring = {};
@@ -1621,6 +1745,12 @@ class NomosBridge {
       );
       return;
     }
+    if (event == 'kernelProgress') {
+      if (!_kernelProgressEvents.isClosed) {
+        _kernelProgressEvents.add(KernelProgress.fromMessage(m));
+      }
+      return;
+    }
     if (event == 'trace') {
       // the realtime cloud flamepath: { event:'trace', trace:{at, oid, edge, clients} } — one per admission.
       if (!_flameEvents.isClosed) _flameEvents.add(m);
@@ -1801,8 +1931,8 @@ class NomosBridge {
     final push = (result['pushError'] as Map?)?.cast<String, Object?>();
     final status = push?['status'];
     if (status == 401 || status == 403) return true;
-    final text = '${message['error'] ?? ''} ${push?['error'] ?? ''}'
-        .toLowerCase();
+    final text =
+        '${message['error'] ?? ''} ${push?['error'] ?? ''}'.toLowerCase();
     return text.contains('unauthenticated') ||
         text.contains('token expired') ||
         text.contains('invalid token');
@@ -1899,21 +2029,20 @@ class NomosBridge {
             const [])
         .map((e) => (e as Map).cast<String, Object?>())
         .map((w) {
-          final ws = w['workspace']?.toString() ?? '';
-          // `connected` is the app's own connect() truth; `parked`/resident come from the runner realm.
-          w['state'] = (w['parked'] == true)
-              ? 'parked'
-              : (connected.contains(ws) ? 'connected' : 'resident');
-          return w;
-        })
-        .toList();
+      final ws = w['workspace']?.toString() ?? '';
+      // `connected` is the app's own connect() truth; `parked`/resident come from the runner realm.
+      w['state'] = (w['parked'] == true)
+          ? 'parked'
+          : (connected.contains(ws) ? 'connected' : 'resident');
+      return w;
+    }).toList();
   }
 
   /// Framework-private plane persistence primitive. It snapshots exact local custody even when [workspace]
   /// was born in the kernel but no Dart runner session has ever acquired it. This does not connect, mount a
   /// tenant session, fetch from cloud, or grant authority; the serving realm exports its resident plane view.
   Future<({String workspace, String head, String? snapshot, bool unchanged})>
-  nomosInternalSnapshotWorkspace(String workspace, {String? ifHead}) async {
+      nomosInternalSnapshotWorkspace(String workspace, {String? ifHead}) async {
     final r = _asMap(
       await _call('snapshotWorkspace', {
         'workspace': workspace,
@@ -1995,8 +2124,8 @@ class NomosBridge {
     if (authorSecret != null && authorSecret.isNotEmpty) {
       _eventPlane._sessionAuthorSecrets[ws] = authorSecret;
     }
-    _eventPlane._lastRecovery = (r['recovery'] as Map?)
-        ?.cast<String, Object?>();
+    _eventPlane._lastRecovery =
+        (r['recovery'] as Map?)?.cast<String, Object?>();
     if (_eventPlane._syncStatusCtrl.hasListener) {
       unawaited(_eventPlane._pollMetricsOnce());
     }
@@ -2032,12 +2161,13 @@ class NomosBridge {
   Future<Map<String, Object?>> resolveCustodyBreak(
     String decision, {
     String? session,
-  }) async => _asMap(
-    await _call('resolveCustodyBreak', {
-      'decision': decision,
-      if (session != null) 'session': session,
-    }),
-  );
+  }) async =>
+      _asMap(
+        await _call('resolveCustodyBreak', {
+          'decision': decision,
+          if (session != null) 'session': session,
+        }),
+      );
 
   /// The parked salvaged intents (re-offerable local work an `adopt` rescued) — metadata only.
   Future<List<Map<String, Object?>>> salvagedIntents({String? session}) async {
@@ -2054,23 +2184,25 @@ class NomosBridge {
   Future<Map<String, Object?>> reofferSalvaged({
     String? id,
     String? session,
-  }) async => _asMap(
-    await _call('reofferSalvaged', {
-      if (id != null) 'id': id,
-      if (session != null) 'session': session,
-    }),
-  );
+  }) async =>
+      _asMap(
+        await _call('reofferSalvaged', {
+          if (id != null) 'id': id,
+          if (session != null) 'session': session,
+        }),
+      );
 
   /// Discard one parked salvaged intent — the app's explicit choice.
   Future<Map<String, Object?>> discardSalvaged(
     String id, {
     String? session,
-  }) async => _asMap(
-    await _call('discardSalvaged', {
-      'id': id,
-      if (session != null) 'session': session,
-    }),
-  );
+  }) async =>
+      _asMap(
+        await _call('discardSalvaged', {
+          'id': id,
+          if (session != null) 'session': session,
+        }),
+      );
 
   // ── THE DEAD-LETTER QUEUE (refused-but-legitimate work is NEVER lost) — the Dart mirror of the
   //   JS holon's DLQ surface (`deadLetters()` / `retryDeadLetter()` / `discardDeadLetter()`). A
@@ -2095,23 +2227,25 @@ class NomosBridge {
   Future<Map<String, Object?>> retryDeadLetter(
     String id, {
     String? session,
-  }) async => _asMap(
-    await _call('retryDeadLetter', {
-      'id': id,
-      if (session != null) 'session': session,
-    }),
-  );
+  }) async =>
+      _asMap(
+        await _call('retryDeadLetter', {
+          'id': id,
+          if (session != null) 'session': session,
+        }),
+      );
 
   /// Discard one dead letter — the app's EXPLICIT choice to drop the work. `{ok}`.
   Future<Map<String, Object?>> discardDeadLetter(
     String id, {
     String? session,
-  }) async => _asMap(
-    await _call('discardDeadLetter', {
-      'id': id,
-      if (session != null) 'session': session,
-    }),
-  );
+  }) async =>
+      _asMap(
+        await _call('discardDeadLetter', {
+          'id': id,
+          if (session != null) 'session': session,
+        }),
+      );
 
   /// SALVAGE — best-effort extraction of this holon's local-only authored work (un-synced pending
   /// writes + the DLQ), each with its full `changeB64` bytes: `{pendingWrites, deadLetters}`. The
@@ -2126,13 +2260,14 @@ class NomosBridge {
     List<Map<String, Object?>> pendingWrites = const [],
     List<Map<String, Object?>> deadLetters = const [],
     String? session,
-  }) async => _asMap(
-    await _call('absorbSalvage', {
-      'pendingWrites': pendingWrites,
-      'deadLetters': deadLetters,
-      if (session != null) 'session': session,
-    }),
-  );
+  }) async =>
+      _asMap(
+        await _call('absorbSalvage', {
+          'pendingWrites': pendingWrites,
+          'deadLetters': deadLetters,
+          if (session != null) 'session': session,
+        }),
+      );
 
   /// The salvage report from the most recent `connect(recover: true)` — `{ salvagedWrites, requeuedDeadLetters,
   /// unsalvageable }`, or null if the connection didn't recover. Show "recovered N writes" / surface
@@ -2218,18 +2353,19 @@ class NomosBridge {
     String? session,
     String? authorSecret,
     NomosBirthCertificate? birthCertificate,
-  }) => offerOutcome(
-    domain: domain,
-    directiveId: directiveId,
-    payload: payload,
-    actor: actor,
-    domainHash: domainHash,
-    nomosConflictSnapshots: nomosConflictSnapshots,
-    force: force,
-    session: session,
-    authorSecret: authorSecret,
-    birthCertificate: birthCertificate,
-  );
+  }) =>
+      offerOutcome(
+        domain: domain,
+        directiveId: directiveId,
+        payload: payload,
+        actor: actor,
+        domainHash: domainHash,
+        nomosConflictSnapshots: nomosConflictSnapshots,
+        force: force,
+        session: session,
+        authorSecret: authorSecret,
+        birthCertificate: birthCertificate,
+      );
 
   /// THE ONE OUTCOME-RETURNING OFFER LANE — [offerDirective] answering the full typed [NomosOfferOutcome]
   /// (head + law-minted `created` NomosRefs + births), for EVERY generated method (create or mutate). A pure
@@ -2343,8 +2479,7 @@ class NomosBridge {
       }
     }
     final sourceSession = session ?? _sessionName;
-    final birthAuthorSecret =
-        authorSecret ??
+    final birthAuthorSecret = authorSecret ??
         (sourceSession == null
             ? null
             : _eventPlane._sessionAuthorSecrets[sourceSession]);
@@ -2403,8 +2538,7 @@ class NomosBridge {
   }) async {
     if (!RegExp(
       r"no active installed law declares domain '",
-    ).hasMatch(e.toString()))
-      return e;
+    ).hasMatch(e.toString())) return e;
     final self = this;
     final sessionWs = self is NomosSession ? self.workspace : null;
     var activeKeys = const <String>[];
@@ -2557,43 +2691,41 @@ class NomosBridge {
       return ready(session(workspace));
     }
     // SINGLE-FLIGHT: one in-flight open per workspace per plane; concurrent callers join it.
-    return plane._acquiring
-        .putIfAbsent(workspace, () async {
-          // RESIDENCY IS THE KERNEL'S TO DEMAND AND OURS TO SATISFY. Replaying a chain can reach a
-          // colocated read whose source workspace is not mounted; the kernel refuses TYPED, naming it.
-          // Mount the named sibling — which consults local custody first and only then clones — and
-          // retry. Bounded, and each name is satisfied at most once, so a genuinely missing workspace
-          // fails with the kernel's own refusal instead of spinning.
-          final satisfied = <String>{};
-          for (var round = 0; ; round++) {
-            try {
-              return await _acquireSessionOnce(
-                workspace,
-                ready: ready,
-                inheritPrincipal: inheritPrincipal,
-                ifAbsentCredentials: ifAbsentCredentials,
-                authorSecret: authorSecret,
-              );
-            } catch (error) {
-              final required = nomosInternalResidencyRequiredWorkspace(error);
-              if (required == null ||
-                  required == workspace ||
-                  !satisfied.add(required) ||
-                  round >= 8) {
-                rethrow;
-              }
-              await acquireSession(
-                required,
-                ifAbsentCredentials: ifAbsentCredentials,
-                authorSecret: authorSecret,
-                inheritedPrincipal: sourcePrincipal,
-              );
-            }
+    return plane._acquiring.putIfAbsent(workspace, () async {
+      // RESIDENCY IS THE KERNEL'S TO DEMAND AND OURS TO SATISFY. Replaying a chain can reach a
+      // colocated read whose source workspace is not mounted; the kernel refuses TYPED, naming it.
+      // Mount the named sibling — which consults local custody first and only then clones — and
+      // retry. Bounded, and each name is satisfied at most once, so a genuinely missing workspace
+      // fails with the kernel's own refusal instead of spinning.
+      final satisfied = <String>{};
+      for (var round = 0;; round++) {
+        try {
+          return await _acquireSessionOnce(
+            workspace,
+            ready: ready,
+            inheritPrincipal: inheritPrincipal,
+            ifAbsentCredentials: ifAbsentCredentials,
+            authorSecret: authorSecret,
+          );
+        } catch (error) {
+          final required = nomosInternalResidencyRequiredWorkspace(error);
+          if (required == null ||
+              required == workspace ||
+              !satisfied.add(required) ||
+              round >= 8) {
+            rethrow;
           }
-        })
-        .whenComplete(() {
-          plane._acquiring.remove(workspace);
-        });
+          await acquireSession(
+            required,
+            ifAbsentCredentials: ifAbsentCredentials,
+            authorSecret: authorSecret,
+            inheritedPrincipal: sourcePrincipal,
+          );
+        }
+      }
+    }).whenComplete(() {
+      plane._acquiring.remove(workspace);
+    });
   }
 
   Future<NomosSession> _acquireSessionOnce(
@@ -2765,16 +2897,17 @@ class NomosBridge {
     List<Map<String, Object?>>? nomosConflictSnapshots,
     bool? force,
     String? session,
-  }) => offerDirective(
-    domain: domain,
-    directiveId: directiveId,
-    payload: payload,
-    actor: actor,
-    domainHash: domainHash,
-    nomosConflictSnapshots: nomosConflictSnapshots,
-    force: force,
-    session: session,
-  );
+  }) =>
+      offerDirective(
+        domain: domain,
+        directiveId: directiveId,
+        payload: payload,
+        actor: actor,
+        domainHash: domainHash,
+        nomosConflictSnapshots: nomosConflictSnapshots,
+        force: force,
+        session: session,
+      );
 
   /// Resolve the generated law's standard OSGi Contract Namespace requirements before bind.
   Future<void> assertKernelCoherence(
@@ -2900,14 +3033,15 @@ class NomosBridge {
     List<String>? actions,
     String domain = '',
     String directiveId = 'undo',
-  }) async => _asMap(
-    await _call('undoMostRecent', {
-      'scope': scope,
-      if (actions != null) 'actions': actions,
-      'domain': domain,
-      'directiveId': directiveId,
-    }),
-  );
+  }) async =>
+      _asMap(
+        await _call('undoMostRecent', {
+          'scope': scope,
+          if (actions != null) 'actions': actions,
+          'domain': domain,
+          'directiveId': directiveId,
+        }),
+      );
 
   /// REDO the most-recent undo (strike the strike → its target re-applies). Same [scope]/[domain]/[directiveId]
   /// as [undoMostRecent]. Returns `{ok, redone, head}`.
@@ -2915,13 +3049,14 @@ class NomosBridge {
     String scope = 'all',
     String domain = '',
     String directiveId = 'undo',
-  }) async => _asMap(
-    await _call('redoMostRecent', {
-      'scope': scope,
-      'domain': domain,
-      'directiveId': directiveId,
-    }),
-  );
+  }) async =>
+      _asMap(
+        await _call('redoMostRecent', {
+          'scope': scope,
+          'domain': domain,
+          'directiveId': directiveId,
+        }),
+      );
 
   /// Framework-private business correction seam. Generated clients bind the domain, its actions and actor;
   /// application code supplies only the correction kind and its mandatory reason.
@@ -2932,16 +3067,17 @@ class NomosBridge {
     required String reason,
     String? domainHash,
     String? actor,
-  }) async => _asMap(
-    await _call('correctMostRecent', {
-      'kind': kind,
-      'domain': domain,
-      'actions': actions,
-      'reason': reason,
-      if (domainHash != null) 'domainHash': domainHash,
-      if (actor != null) 'actor': actor,
-    }),
-  );
+  }) async =>
+      _asMap(
+        await _call('correctMostRecent', {
+          'kind': kind,
+          'domain': domain,
+          'actions': actions,
+          'reason': reason,
+          if (domainHash != null) 'domainHash': domainHash,
+          if (actor != null) 'actor': actor,
+        }),
+      );
 
   /// Framework-private exact-history adoption seam. Generated clients expose this as
   /// `model.adopt()` and, only when prior business outcomes differ, a chained
@@ -3043,12 +3179,13 @@ class NomosBridge {
     String? base,
     int? limit,
     String? session,
-  }) => _watchStream(
-    kind: 'activity',
-    base: base,
-    limit: limit,
-    session: session,
-  );
+  }) =>
+      _watchStream(
+        kind: 'activity',
+        base: base,
+        limit: limit,
+        session: session,
+      );
 
   /// Mint an ed25519 DEVICE KEY in-kernel → `{secret, public}` (base64). The SECRET stays on this device
   /// (persist it in secure storage); pass it to [connect] as `authorSecret` (or per-offer `signWith`) so the
@@ -3071,16 +3208,17 @@ class NomosBridge {
   Future<NomosBirthCertificate> signBirthCert(
     NomosBirthCertificateSpec spec,
     String deviceSecret,
-  ) async => NomosBirthCertificate.fromWire(
-    _asMap(
-      _asMap(
-        await _call('signBirthCert', {
-          'fields': spec.toWire(),
-          'deviceSecret': deviceSecret,
-        }),
-      )['cert'],
-    ),
-  );
+  ) async =>
+      NomosBirthCertificate.fromWire(
+        _asMap(
+          _asMap(
+            await _call('signBirthCert', {
+              'fields': spec.toWire(),
+              'deviceSecret': deviceSecret,
+            }),
+          )['cert'],
+        ),
+      );
 
   /// MINT THE KEYLESS ENROLL-ONCE DELEGATION (`enrollFirstDevice.delegationCert`, the verified-first-device
   /// lane). The device SELF-signs it; its authority is the carried `idpToken` (the kernel re-verifies that to
@@ -3093,12 +3231,11 @@ class NomosBridge {
     String deviceSecret,
   ) async =>
       _asMap(
-            await _call('mintKeylessDelegation', {
-              'spec': spec,
-              'deviceSecret': deviceSecret,
-            }),
-          )['cert']
-          as Map<String, Object?>? ??
+        await _call('mintKeylessDelegation', {
+          'spec': spec,
+          'deviceSecret': deviceSecret,
+        }),
+      )['cert'] as Map<String, Object?>? ??
       const {};
 
   /// ENROLL THIS DEVICE — the LIVE gate: bind a device key's PUBLIC half to `principal` on-chain as a
@@ -3109,13 +3246,14 @@ class NomosBridge {
     required String principal,
     required String publicKey,
     String? authToken,
-  }) async => _asMap(
-    await _call('enrollDevice', {
-      'principal': principal,
-      'publicKey': publicKey,
-      if (authToken != null) 'authToken': authToken,
-    }),
-  );
+  }) async =>
+      _asMap(
+        await _call('enrollDevice', {
+          'principal': principal,
+          'publicKey': publicKey,
+          if (authToken != null) 'authToken': authToken,
+        }),
+      );
 
   /// Derive the device key's base64 PUBLIC half from its base64 SECRET seed, inside the LOCAL kernel
   /// (the secret never leaves the device). The recovery lanes use this when only the secret was
@@ -3139,16 +3277,17 @@ class NomosBridge {
     String? publicKey,
     String? authToken,
     bool remote = false,
-  }) async => _asMap(
-    await _call('parentSignerEnrollment', {
-      'parent': parent,
-      'principal': principal,
-      if (keyHash != null) 'keyHash': keyHash,
-      if (publicKey != null) 'publicKey': publicKey,
-      if (authToken != null) 'authToken': authToken,
-      if (remote) 'remote': true,
-    }),
-  );
+  }) async =>
+      _asMap(
+        await _call('parentSignerEnrollment', {
+          'parent': parent,
+          'principal': principal,
+          if (keyHash != null) 'keyHash': keyHash,
+          if (publicKey != null) 'publicKey': publicKey,
+          if (authToken != null) 'authToken': authToken,
+          if (remote) 'remote': true,
+        }),
+      );
 
   /// IDEMPOTENT PARENT-SIGNER RECOVERY — ensure this device key is a live `signer` on `parent`,
   /// lawfully restoring the tuple a parent custody REBIRTH lost (the device key + the born home stay
@@ -3171,19 +3310,20 @@ class NomosBridge {
     String? authToken,
     String? idToken,
     String? verifiedVia,
-  }) async => _asMap(
-    await _call('ensureParentSignerEnrollment', {
-      'parent': parent,
-      'principal': principal,
-      if (publicKey != null) 'publicKey': publicKey,
-      if (authorSecret != null) 'authorSecret': authorSecret,
-      if (domain != null) 'domain': domain,
-      if (directiveId != null) 'directiveId': directiveId,
-      if (authToken != null) 'authToken': authToken,
-      if (idToken != null) 'idToken': idToken,
-      if (verifiedVia != null) 'verifiedVia': verifiedVia,
-    }),
-  );
+  }) async =>
+      _asMap(
+        await _call('ensureParentSignerEnrollment', {
+          'parent': parent,
+          'principal': principal,
+          if (publicKey != null) 'publicKey': publicKey,
+          if (authorSecret != null) 'authorSecret': authorSecret,
+          if (domain != null) 'domain': domain,
+          if (directiveId != null) 'directiveId': directiveId,
+          if (authToken != null) 'authToken': authToken,
+          if (idToken != null) 'idToken': idToken,
+          if (verifiedVia != null) 'verifiedVia': verifiedVia,
+        }),
+      );
 
   /// AUTHORING PREFLIGHT — evaluate the SAME premises the kernel's authorization gate judges,
   /// READ-ONLY, and return a typed verdict WITHOUT authoring — so the app catches a doomed write
@@ -3199,16 +3339,17 @@ class NomosBridge {
     String? publicKey,
     String? keyHash,
     String? authToken,
-  }) async => _asMap(
-    await _call('canAuthor', {
-      'directiveId': directiveId,
-      if (ws != null) 'ws': ws,
-      if (principal != null) 'principal': principal,
-      if (publicKey != null) 'publicKey': publicKey,
-      if (keyHash != null) 'keyHash': keyHash,
-      if (authToken != null) 'authToken': authToken,
-    }),
-  );
+  }) async =>
+      _asMap(
+        await _call('canAuthor', {
+          'directiveId': directiveId,
+          if (ws != null) 'ws': ws,
+          if (principal != null) 'principal': principal,
+          if (publicKey != null) 'publicKey': publicKey,
+          if (keyHash != null) 'keyHash': keyHash,
+          if (authToken != null) 'authToken': authToken,
+        }),
+      );
 
   /// VERIFY_CHAIN — the kernel's from-genesis self-verification of THIS holon's folded ledger (read-only:
   /// contiguity → every intent re-admitted through the ONE gate against the state folded from the prefix). For
@@ -3222,7 +3363,8 @@ class NomosBridge {
   /// receives only the resulting business application.
   Future<Map<String, Object?>> nomosInternalBirthReceivingGroup(
     Map<String, Object?> spec,
-  ) async => _asMap(await _call('nomosInternalBirthReceivingGroup', spec));
+  ) async =>
+      _asMap(await _call('nomosInternalBirthReceivingGroup', spec));
 
   /// Sign a cross-custody SHARE attestation `{secret, asserterWorkspace, object, relation, subject,
   /// attestedAt}` → `{publicKey, signature}`. This is what drives `recordShare` into an invitee's home
@@ -3230,7 +3372,8 @@ class NomosBridge {
   /// with `subject`, and the invitee's home gate verifies the signature before recording it.
   Future<Map<String, Object?>> attestationSign(
     Map<String, Object?> args,
-  ) async => _asMap(await _call('attestationSign', {'args': args}));
+  ) async =>
+      _asMap(await _call('attestationSign', {'args': args}));
 
   /// Issue a ROLE-DELEGATION cert (the `.delegatedRole()` lane, kernel `delegationCertSign` op). A platform
   /// signs — with its grantor secret `signerSecret` (base64) — a cert granting `relation` to `subject`,
@@ -3247,18 +3390,19 @@ class NomosBridge {
     required String subject,
     int epoch = 1,
     List<Object?>? certChain,
-  }) async => _asMap(
-    await _call('issueDelegationCert', {
-      'args': {
-        'signerSecret': signerSecret,
-        'grantorId': grantorId,
-        'relation': relation,
-        'subject': subject,
-        'epoch': epoch,
-        if (certChain != null) 'certChain': certChain,
-      },
-    }),
-  );
+  }) async =>
+      _asMap(
+        await _call('issueDelegationCert', {
+          'args': {
+            'signerSecret': signerSecret,
+            'grantorId': grantorId,
+            'relation': relation,
+            'subject': subject,
+            'epoch': epoch,
+            if (certChain != null) 'certChain': certChain,
+          },
+        }),
+      );
 
   /// A declared query's rows from the local projection. `keys` (E2E sealing) injects the reader's held
   /// scope keys so encrypted fields AEAD-open in-wasm; absent ⇒ they stay opaque envelopes (today's
@@ -3318,21 +3462,21 @@ class NomosBridge {
     List<NomosScopeKey>? keys,
     String? principal,
     String? session,
-  ]) async => _asRows(
-    await _call('queryById', {
-      'id': id,
-      ...?_readAuthArgs(keys, principal),
-      if (session != null) 'session': session,
-    }),
-  );
+  ]) async =>
+      _asRows(
+        await _call('queryById', {
+          'id': id,
+          ...?_readAuthArgs(keys, principal),
+          if (session != null) 'session': session,
+        }),
+      );
 
   /// Compare an immutable publication pin with the stable series' one compiled
   /// current pointer. This is an O(current-state) check: it neither resolves the
   /// pinned publication nor reconstructs aggregate history.
-  Future<ReferenceVersionStatus<TVersion>> checkReferenceVersion<
-    TVersion,
-    TSeries
-  >(VersionedNomosRef<TVersion, TSeries> reference) async {
+  Future<ReferenceVersionStatus<TVersion>>
+      checkReferenceVersion<TVersion, TSeries>(
+          VersionedNomosRef<TVersion, TSeries> reference) async {
     final result = _asMap(
       await _call('checkReferenceVersions', {
         'refs': [
@@ -3390,15 +3534,16 @@ class NomosBridge {
     List<NomosScopeKey>? keys,
     String? principal,
     String? session,
-  ]) async => _asRows(
-    await _call('queryAt', {
-      'commit': moment.id,
-      'queryId': queryId,
-      'params': params,
-      ...?_readAuthArgs(keys, principal),
-      if (session != null) 'session': session,
-    }),
-  );
+  ]) async =>
+      _asRows(
+        await _call('queryAt', {
+          'commit': moment.id,
+          'queryId': queryId,
+          'params': params,
+          ...?_readAuthArgs(keys, principal),
+          if (session != null) 'session': session,
+        }),
+      );
 
   /// Read one aggregate from the verified world at [moment]. `keys`/`principal`: see [queryAt].
   Future<List<Map<String, dynamic>>> queryByIdAt(
@@ -3407,14 +3552,15 @@ class NomosBridge {
     List<NomosScopeKey>? keys,
     String? principal,
     String? session,
-  ]) async => _asRows(
-    await _call('queryByIdAt', {
-      'commit': moment.id,
-      'id': id,
-      ...?_readAuthArgs(keys, principal),
-      if (session != null) 'session': session,
-    }),
-  );
+  ]) async =>
+      _asRows(
+        await _call('queryByIdAt', {
+          'commit': moment.id,
+          'id': id,
+          ...?_readAuthArgs(keys, principal),
+          if (session != null) 'session': session,
+        }),
+      );
 
   /// Maintained historic count/sum values at [moment]. These are the temporal counterparts of [count]/[sum].
   Future<int> countAt(
@@ -3424,14 +3570,13 @@ class NomosBridge {
     String? session,
   ]) async =>
       ((_asMap(
-                await _call('countAt', {
-                  'commit': moment.id,
-                  'countId': countId,
-                  'group': group,
-                  if (session != null) 'session': session,
-                }),
-              )['count'])
-              as num)
+        await _call('countAt', {
+          'commit': moment.id,
+          'countId': countId,
+          'group': group,
+          if (session != null) 'session': session,
+        }),
+      )['count']) as num)
           .toInt();
 
   Future<int> sumAt(
@@ -3441,14 +3586,13 @@ class NomosBridge {
     String? session,
   ]) async =>
       ((_asMap(
-                await _call('sumAt', {
-                  'commit': moment.id,
-                  'sumId': sumId,
-                  'group': group,
-                  if (session != null) 'session': session,
-                }),
-              )['sum'])
-              as num)
+        await _call('sumAt', {
+          'commit': moment.id,
+          'sumId': sumId,
+          'group': group,
+          if (session != null) 'session': session,
+        }),
+      )['sum']) as num)
           .toInt();
 
   /// The read auth sidecar (private reads + E2E): `keys`/`principal` as top-level call args, or null when
@@ -3564,14 +3708,15 @@ class NomosBridge {
     required String domain,
     required String domainHash,
     required String recoveryPrincipal,
-  }) async => _asMap(
-    await _call('cryptoOwnedProtectIdentity', {
-      'scope': scope,
-      'domain': domain,
-      'domainHash': domainHash,
-      'recoveryPrincipal': recoveryPrincipal,
-    }),
-  );
+  }) async =>
+      _asMap(
+        await _call('cryptoOwnedProtectIdentity', {
+          'scope': scope,
+          'domain': domain,
+          'domainHash': domainHash,
+          'recoveryPrincipal': recoveryPrincipal,
+        }),
+      );
 
   /// Prepare the private framework payload behind generated share/unshare/transfer methods.
   Future<Map<String, Object?>> nomosPrepareOwnedRecordAction<TAggregate>({
@@ -3579,17 +3724,18 @@ class NomosBridge {
     required String scope,
     required NomosRef<TAggregate> record,
     required String peer,
-  }) async => _asMap(
-    await _call('cryptoOwnedPrepareRecordAction', {
-      'action': action,
-      'scope': scope,
-      'record': {
-        'type': NmsInternalNomosRefs.type(record),
-        'id': NmsInternalNomosRefs.id(record),
-      },
-      'peer': peer,
-    }),
-  );
+  }) async =>
+      _asMap(
+        await _call('cryptoOwnedPrepareRecordAction', {
+          'action': action,
+          'scope': scope,
+          'record': {
+            'type': NmsInternalNomosRefs.type(record),
+            'id': NmsInternalNomosRefs.id(record),
+          },
+          'peer': peer,
+        }),
+      );
 
   /// FRAMEWORK-INTERNAL business birth: derive the unborn child's owned key from its deterministic address.
   Future<NomosScopeKey> nomosOwnedBirthScopeKey(
@@ -3618,34 +3764,35 @@ class NomosBridge {
   }
 
   /// FRAMEWORK-INTERNAL: issue an opaque request for this session's current device.
-  Future<String> nomosOwnedDeviceRequest(String scope) async =>
-      (_asMap(
-                await _call('cryptoOwnedDeviceRequest', {'scope': scope}),
-              )['request'] ??
-              '')
-          .toString();
+  Future<String> nomosOwnedDeviceRequest(String scope) async => (_asMap(
+            await _call('cryptoOwnedDeviceRequest', {'scope': scope}),
+          )['request'] ??
+          '')
+      .toString();
 
   /// FRAMEWORK-INTERNAL: validate an opaque request and prepare the atomic signer + custody offer.
   Future<Map<String, Object?>> nomosPrepareOwnedDeviceApproval(
     String request,
     String scope,
-  ) async => _asMap(
-    await _call('cryptoOwnedPrepareApproval', {
-      'request': request,
-      'scope': scope,
-    }),
-  );
+  ) async =>
+      _asMap(
+        await _call('cryptoOwnedPrepareApproval', {
+          'request': request,
+          'scope': scope,
+        }),
+      );
 
   /// Wrap a scope key TO a recipient's public key (committer side): `{hpkeEpk, ct}` base64 ciphertext.
   Future<Map<String, Object?>> cryptoWrapKey({
     required String recipientPub,
     required String scopeKey,
-  }) async => _asMap(
-    await _call('cryptoWrapKey', {
-      'recipientPub': recipientPub,
-      'scopeKey': scopeKey,
-    }),
-  );
+  }) async =>
+      _asMap(
+        await _call('cryptoWrapKey', {
+          'recipientPub': recipientPub,
+          'scopeKey': scopeKey,
+        }),
+      );
 
   /// Unwrap an on-chain WrappedKey with this device's secret → the base64 scope key (reader side).
   Future<String> cryptoUnwrapKey({
@@ -3669,13 +3816,14 @@ class NomosBridge {
     String spatialId,
     NomosBbox bbox, [
     String? session,
-  ]) async => _asRows(
-    await _call('spatialWithin', {
-      'spatialId': spatialId,
-      'bbox': bbox.toJson(),
-      if (session != null) 'session': session,
-    }),
-  );
+  ]) async =>
+      _asRows(
+        await _call('spatialWithin', {
+          'spatialId': spatialId,
+          'bbox': bbox.toJson(),
+          if (session != null) 'session': session,
+        }),
+      );
 
   /// A maintained O(1) count / sum.
   Future<int> count(
@@ -3684,23 +3832,21 @@ class NomosBridge {
     String? session,
   ]) async =>
       ((_asMap(
-                await _call('count', {
-                  'countId': countId,
-                  'group': group,
-                  if (session != null) 'session': session,
-                }),
-              )['count'])
-              as num)
+        await _call('count', {
+          'countId': countId,
+          'group': group,
+          if (session != null) 'session': session,
+        }),
+      )['count']) as num)
           .toInt();
   Future<int> sum(String sumId, [String group = '', String? session]) async =>
       ((_asMap(
-                await _call('sum', {
-                  'sumId': sumId,
-                  'group': group,
-                  if (session != null) 'session': session,
-                }),
-              )['sum'])
-              as num)
+        await _call('sum', {
+          'sumId': sumId,
+          'group': group,
+          if (session != null) 'session': session,
+        }),
+      )['sum']) as num)
           .toInt();
 
   /// THE PENDING-CONFLICTS READ (Surfaced merge conflicts — the DX layer): the MAINTAINED,
@@ -3712,41 +3858,46 @@ class NomosBridge {
   /// `PendingConflictRow` and pairs them with the designated `resolve…` helpers.)
   Future<List<Map<String, dynamic>>> pendingConflicts([
     String? session,
-  ]) async => _asRows(
-    await _call('pendingConflicts', {if (session != null) 'session': session}),
-  );
+  ]) async =>
+      _asRows(
+        await _call(
+            'pendingConflicts', {if (session != null) 'session': session}),
+      );
 
   /// Framework-filtered pending conflicts for one generated aggregate type. This is the
   /// primitive generated clients use; application code never filters the heterogeneous queue.
   Future<List<Map<String, dynamic>>> pendingConflictsFor(
     String aggregateType, [
     String? session,
-  ]) async => _asRows(
-    await _call('pendingConflicts', {
-      'aggregateType': aggregateType,
-      if (session != null) 'session': session,
-    }),
-  );
+  ]) async =>
+      _asRows(
+        await _call('pendingConflicts', {
+          'aggregateType': aggregateType,
+          if (session != null) 'session': session,
+        }),
+      );
 
   /// Counts-only workspace summary over the maintained conflict index.
   Future<Map<String, Object?>> pendingConflictSummary([
     String? session,
-  ]) async => _asMap(
-    await _call('pendingConflictSummary', {
-      if (session != null) 'session': session,
-    }),
-  );
+  ]) async =>
+      _asMap(
+        await _call('pendingConflictSummary', {
+          if (session != null) 'session': session,
+        }),
+      );
 
   /// Push local writes → the session branch → cloud admission, and pull canonical main back.
   Future<Map<String, Object?>> sync({
     bool admit = true,
     String? session,
-  }) async => _asMap(
-    await _call('sync', {
-      'admit': admit,
-      if (session != null) 'session': session,
-    }),
-  );
+  }) async =>
+      _asMap(
+        await _call('sync', {
+          'admit': admit,
+          if (session != null) 'session': session,
+        }),
+      );
 
   /// PERSIST: a base64 snapshot of the whole local holon (the bare nomos.git incl. un-synced writes + the
   /// DLQ). Store it on disk and pass it back as `connect(restoreFrom:)` next launch — the app then boots from
@@ -3792,6 +3943,11 @@ class NomosBridge {
   Stream<TransferProgress> get transferProgress =>
       _eventPlane._transferEvents.stream;
 
+  /// Live typed progress from the canonical kernel while a long synchronous
+  /// operation is in flight (currently cold custody verification/replay).
+  Stream<KernelProgress> get kernelProgress =>
+      _eventPlane._kernelProgressEvents.stream;
+
   /// THE APP-READY SYNC STATE — a truthful aggregation of sync rounds, the doorbell, transfer progress, and a
   /// periodic metrics poll. Map straight to a sync-state page. Starts a lightweight 4s metrics poll while
   /// listened to (stops on cancel). [currentStatus] is the latest snapshot for a non-stream read.
@@ -3809,16 +3965,16 @@ class NomosBridge {
         : _eventPlane._currentSessionStatus(session);
   }
 
-  Stream<SyncStatus> _sessionSyncStatus(String session) => _eventPlane
-      ._syncStatusBySession
-      .putIfAbsent(
-        session,
-        () => StreamController<SyncStatus>.broadcast(
-          onListen: () => _eventPlane._startSessionStatusPoll(session),
-          onCancel: _eventPlane._stopStatusPollIfUnused,
-        ),
-      )
-      .stream;
+  Stream<SyncStatus> _sessionSyncStatus(String session) =>
+      _eventPlane._syncStatusBySession
+          .putIfAbsent(
+            session,
+            () => StreamController<SyncStatus>.broadcast(
+              onListen: () => _eventPlane._startSessionStatusPoll(session),
+              onCancel: _eventPlane._stopStatusPollIfUnused,
+            ),
+          )
+          .stream;
 
   SyncStatus _currentSessionStatus(String session) =>
       _eventPlane._statusBySession[session] ?? const SyncStatus();
@@ -4016,14 +4172,13 @@ class NomosBridge {
         // Counters prove custody debt, but they do not prove that a failed or
         // offline transport recovered. Only a subsequent successful sync/link
         // event may clear those lifecycle states.
-        final phase =
-            current.transfer != null ||
+        final phase = current.transfer != null ||
                 current.phase == SyncPhase.error ||
                 current.phase == SyncPhase.offline
             ? current.phase
             : (behind > 0
-                  ? SyncPhase.behind
-                  : (ahead > 0 ? SyncPhase.syncing : SyncPhase.idle));
+                ? SyncPhase.behind
+                : (ahead > 0 ? SyncPhase.syncing : SyncPhase.idle));
         _pushSessionStatus(
           session,
           current.copyWith(
@@ -4139,36 +4294,39 @@ class NomosBridge {
     String? session,
     String? principal,
     int? intervalMs,
-  ]) => _watchStream(
-    kind: 'query',
-    queryId: queryId,
-    params: params,
-    session: session,
-    principal: principal,
-    intervalMs: intervalMs,
-  );
+  ]) =>
+      _watchStream(
+        kind: 'query',
+        queryId: queryId,
+        params: params,
+        session: session,
+        principal: principal,
+        intervalMs: intervalMs,
+      );
   Stream<List<dynamic>> watchById(
     String id, [
     String? session,
     String? principal,
-  ]) => _watchStream(
-    kind: 'byId',
-    id: id,
-    session: session,
-    principal: principal,
-  );
+  ]) =>
+      _watchStream(
+        kind: 'byId',
+        id: id,
+        session: session,
+        principal: principal,
+      );
 
   /// Reactive SPATIAL read: re-emits the R*Tree probe's rows whenever they change locally.
   Stream<List<dynamic>> watchSpatial(
     String spatialId,
     NomosBbox bbox, [
     String? session,
-  ]) => _watchStream(
-    kind: 'spatial',
-    spatialId: spatialId,
-    bbox: bbox,
-    session: session,
-  );
+  ]) =>
+      _watchStream(
+        kind: 'spatial',
+        spatialId: spatialId,
+        bbox: bbox,
+        session: session,
+      );
 
   /// Reactive PENDING-CONFLICTS read: re-emits the maintained Surfaced "decisions needed"
   /// rows whenever the index changes (derived, not drained — a resolution write clears its row).
@@ -4181,12 +4339,13 @@ class NomosBridge {
   Future<Map<String, Object?>> checkCompatibility(
     Map<String, Object?> requirement, [
     Map<String, Object?>? offer,
-  ]) async => _asMap(
-    await _call('checkCompatibility', {
-      'requirement': requirement,
-      if (offer != null) 'offer': offer,
-    }),
-  );
+  ]) async =>
+      _asMap(
+        await _call('checkCompatibility', {
+          'requirement': requirement,
+          if (offer != null) 'offer': offer,
+        }),
+      );
 
   /// THE COMPAT SUPERPOWER (#72b): compute the LIVE per-member verdict for this client's baked
   /// [compat] manifest + structural [requirement] against the workspace's on-ledger offer. The
@@ -4432,6 +4591,7 @@ class NomosBridge {
     if (!_flameEvents.isClosed) await _flameEvents.close();
     if (!_spanEvents.isClosed) await _spanEvents.close();
     if (!_transferEvents.isClosed) await _transferEvents.close();
+    if (!_kernelProgressEvents.isClosed) await _kernelProgressEvents.close();
     final sessionStatuses = _syncStatusBySession.values.toList(growable: false);
     _syncStatusBySession.clear();
     for (final status in sessionStatuses) {
@@ -4514,8 +4674,7 @@ class NomosSession extends NomosBridge {
     final modelChange = parent._sessionModelChangeHandlers[this.workspace];
     final opened = parent.acquireSession(
       workspace,
-      ifAbsentCredentials:
-          ifAbsentCredentials ??
+      ifAbsentCredentials: ifAbsentCredentials ??
           (retained == null ? null : retained.credentials),
       authorSecret:
           authorSecret ?? parent._sessionAuthorSecrets[this.workspace],
@@ -4617,14 +4776,15 @@ class NomosSession extends NomosBridge {
     String? authToken,
     bool allowUnborn = false,
     String? authorSecret,
-  }) => parent.follow(
-    ref,
-    cloud: cloud,
-    clientId: clientId,
-    authToken: authToken,
-    allowUnborn: allowUnborn,
-    authorSecret: authorSecret ?? parent._sessionAuthorSecrets[workspace],
-  );
+  }) =>
+      parent.follow(
+        ref,
+        cloud: cloud,
+        clientId: clientId,
+        authToken: authToken,
+        allowUnborn: allowUnborn,
+        authorSecret: authorSecret ?? parent._sessionAuthorSecrets[workspace],
+      );
 
   @override
   Future<Object?> _call(String op, [Map<String, Object?> args = const {}]) =>
@@ -4717,11 +4877,11 @@ class _BridgeForeignWorkspaceReader implements NomosForeignWorkspaceReader {
   // workspace reads empty (→ ForeignNotFound) rather than throwing. A genuinely unreachable cloud throws,
   // which resolveResult classifies as ForeignUnreachable.
   Future<void> _ensureMounted() => _mounting ??= _bridge.connect(
-    cloud: _cloud,
-    workspace: _workspace,
-    session: _workspace,
-    allowUnborn: true,
-  );
+        cloud: _cloud,
+        workspace: _workspace,
+        session: _workspace,
+        allowUnborn: true,
+      );
 
   @override
   Future<List<Map<String, dynamic>>> queryById(String id) async {