@githolon/dsl 0.107.4 → 0.108.1

package/dart/lib/src/webview_bridge.dart

@@ -20,7 +20,10 @@ import 'package:meta/meta.dart' show internal;
 import 'dart:async';
 import 'dart:convert';
 import 'dart:math';
+import 'dart:typed_data';
 
+import 'package:fixnum/fixnum.dart' as fixnum;
+import 'package:nomos_types/nomos_kernel_protocol.dart' as nomos_protocol;
 import 'package:nomos_types/nomos_types.dart'
     show
         nomosErrorFromInfo,
@@ -44,6 +47,14 @@ import 'package:nomos_types/src/foreign_ref.dart'
 
 import 'session_bound.dart'
     show DomainClientModelAdoptionRequired, DomainNotInstalledForSession;
+import 'generated_call.dart' show NmsGeneratedCall, NmsGeneratedQuery;
+import 'application_framework_calls.dart' show OwnedCustody, OwnedDeviceRequest;
+import 'runtime_v2_gateway.dart' show NmsRuntimeV2Gateway;
+import 'runtime_v2_transport.dart'
+    show
+        NomosKernelCallTransport,
+        NomosRuntimeV2EventTransport,
+        NomosRuntimeV2Transport;
 
 /// THE ENGINE (architecture/session_bound_clients.md): the multi-workspace RUNTIME — mount/connect,
 /// the session registry, sync, custody + recovery, the home ceremony, and [NomosBridge.follow]
@@ -66,150 +77,56 @@ final class NomosPage<T> {
   final bool done;
 }
 
-/// Typed authority evidence carried by an offer that plans exactly one child birth.
-/// It is offer metadata, never a tenant directive field. The bridge converts it to the
-/// generated protocol's JSON-shaped transport only at the WebView boundary.
-final class NomosBirthCertificate {
-  const NomosBirthCertificate({
-    required this.child,
-    required this.founder,
-    required this.verified,
-    required this.parentKey,
-    required this.parentId,
-    required this.epoch,
-    required this.signature,
-    this.verifiedVia,
-    this.idpToken,
-    this.capturedClock,
-    this.authProviderIssuer,
-    this.authProviderJwks,
-    this.authProviderAudience,
-  });
-
-  final String child;
-  final String founder;
-  final bool verified;
-  final List<int> parentKey;
-  final String parentId;
-  final int epoch;
-  final List<int> signature;
-  final String? verifiedVia;
-  final String? idpToken;
-  final int? capturedClock;
-  final String? authProviderIssuer;
-  final String? authProviderJwks;
-  final String? authProviderAudience;
-
-  static String _string(
-    Map<String, Object?> wire,
-    String camel,
-    String snake,
-  ) =>
-      (wire[camel] ?? wire[snake] ?? '').toString();
-
-  static List<int> _bytes(
-    Map<String, Object?> wire,
-    String camel,
-    String snake,
-  ) =>
-      ((wire[camel] ?? wire[snake]) as List? ?? const <Object?>[])
-          .map((value) => (value as num).toInt())
-          .toList(growable: false);
-
-  factory NomosBirthCertificate.fromWire(
-    Map<String, Object?> wire,
-  ) =>
-      NomosBirthCertificate(
-        child: _string(wire, 'child', 'child'),
-        founder: _string(wire, 'founder', 'founder'),
-        verified: wire['verified'] == true,
-        parentKey: _bytes(wire, 'parentKey', 'parent_key'),
-        parentId: _string(wire, 'parentId', 'parent_id'),
-        epoch: (wire['epoch'] as num?)?.toInt() ?? 0,
-        signature: _bytes(wire, 'signature', 'signature'),
-        verifiedVia: (wire['verifiedVia'] ?? wire['verified_via'])?.toString(),
-        idpToken: (wire['idpToken'] ?? wire['idp_token'])?.toString(),
-        capturedClock:
-            ((wire['capturedClock'] ?? wire['captured_clock']) as num?)
-                ?.toInt(),
-        authProviderIssuer:
-            (wire['authProviderIssuer'] ?? wire['auth_provider_issuer'])
-                ?.toString(),
-        authProviderJwks:
-            (wire['authProviderJwks'] ?? wire['auth_provider_jwks'])
-                ?.toString(),
-        authProviderAudience:
-            (wire['authProviderAudience'] ?? wire['auth_provider_audience'])
-                ?.toString(),
-      );
-
-  Map<String, Object?> toWire() => <String, Object?>{
-        'child': child,
-        'founder': founder,
-        'verified': verified,
-        'parentKey': parentKey,
-        'parentId': parentId,
-        'epoch': epoch,
-        'signature': signature,
-        if (verifiedVia != null) 'verifiedVia': verifiedVia,
-        if (idpToken != null) 'idpToken': idpToken,
-        if (capturedClock != null) 'capturedClock': capturedClock,
-        if (authProviderIssuer != null)
-          'authProviderIssuer': authProviderIssuer,
-        if (authProviderJwks != null) 'authProviderJwks': authProviderJwks,
-        if (authProviderAudience != null)
-          'authProviderAudience': authProviderAudience,
-      };
+/// Typed authority evidence carried by an offer that plans exactly one child birth. The protobuf
+/// declaration is the one source of truth for Rust, TypeScript and Dart; USDA is its durable state
+/// projection, not another transport type. The legacy bridge envelope carries only these protobuf bytes.
+typedef NomosBirthCertificate = nomos_protocol.BirthCertificate;
+
+/// An unsigned [NomosBirthCertificate]. [NomosBridge.signBirthCert] returns the same generated message
+/// with its signature populated; the signing secret is a separate argument and never enters the value.
+typedef NomosBirthCertificateSpec = nomos_protocol.BirthCertificate;
+
+/// Typed compare-and-merge witness carried by an offer. The protobuf schema is
+/// the only transport shape; generated conflict helpers never rebuild it as a
+/// string-keyed map.
+typedef NomosConflictSnapshot = nomos_protocol.ConflictSnapshot;
+
+/// Typed result of one child-workspace birth. The kernel protobuf is the
+/// transport authority; hosts do not reinterpret birth state through maps.
+typedef NomosBirthOutcome = nomos_protocol.BirthOutcome;
+
+typedef NomosBirthOutcomeStatus = nomos_protocol.BirthOutcomeStatus;
+
+NomosBirthOutcomeStatus _birthOutcomeStatusFromLegacyWire(Object? value) {
+  switch (value?.toString().toLowerCase()) {
+    case 'born':
+      return NomosBirthOutcomeStatus.BIRTH_OUTCOME_STATUS_BORN;
+    case 'deferred':
+      return NomosBirthOutcomeStatus.BIRTH_OUTCOME_STATUS_DEFERRED;
+    case 'failed':
+      return NomosBirthOutcomeStatus.BIRTH_OUTCOME_STATUS_FAILED;
+    case 'refused':
+      return NomosBirthOutcomeStatus.BIRTH_OUTCOME_STATUS_REFUSED;
+    case 'unwarranted_cert':
+    case 'unwarrantedcert':
+      return NomosBirthOutcomeStatus.BIRTH_OUTCOME_STATUS_UNWARRANTED_CERT;
+    default:
+      return NomosBirthOutcomeStatus.BIRTH_OUTCOME_STATUS_UNSPECIFIED;
+  }
 }
 
-/// Facts signed by [NomosBridge.signBirthCert]. The secret remains a separate argument and never
-/// enters this value, so callers cannot accidentally serialize private key material with the cert.
-final class NomosBirthCertificateSpec {
-  const NomosBirthCertificateSpec({
-    required this.child,
-    required this.founder,
-    required this.verified,
-    required this.parentKey,
-    required this.parentId,
-    required this.epoch,
-    this.verifiedVia,
-    this.idpToken,
-    this.capturedClock,
-    this.authProviderIssuer,
-    this.authProviderJwks,
-    this.authProviderAudience,
-  });
-
-  final String child;
-  final String founder;
-  final bool verified;
-  final String parentKey;
-  final String parentId;
-  final int epoch;
-  final String? verifiedVia;
-  final String? idpToken;
-  final int? capturedClock;
-  final String? authProviderIssuer;
-  final String? authProviderJwks;
-  final String? authProviderAudience;
-
-  Map<String, Object?> toWire() => <String, Object?>{
-        'child': child,
-        'founder': founder,
-        'verified': verified,
-        'parentKey': parentKey,
-        'parentId': parentId,
-        'epoch': epoch,
-        if (verifiedVia != null) 'verifiedVia': verifiedVia,
-        if (idpToken != null) 'idpToken': idpToken,
-        if (capturedClock != null) 'capturedClock': capturedClock,
-        if (authProviderIssuer != null)
-          'authProviderIssuer': authProviderIssuer,
-        if (authProviderJwks != null) 'authProviderJwks': authProviderJwks,
-        if (authProviderAudience != null)
-          'authProviderAudience': authProviderAudience,
-      };
-}
+NomosBirthOutcome _birthOutcomeFromLegacyWire(Map<dynamic, dynamic> value) =>
+    NomosBirthOutcome(
+      workspace: value['workspace']?.toString(),
+      status: _birthOutcomeStatusFromLegacyWire(value['status']),
+      reason: value['reason']?.toString(),
+      code: value['code']?.toString(),
+      replayed: value['replayed'] == true,
+      lawHash: value['lawHash']?.toString(),
+      parentWorkspace: value['parentWorkspace']?.toString(),
+      childWorkspace: value['childWorkspace']?.toString(),
+      certificateRefusalReason: value['certificateRefusalReason']?.toString(),
+    );
 
 /// The protocol version the runner and the bridge agree on (`webview-runner.mjs` `WEBVIEW_BRIDGE_VERSION`).
 const int kWebviewBridgeVersion = 1;
@@ -242,10 +159,10 @@ class StaleRunnerBundle implements Exception {
       'NomosBridge(..., allowStaleRunnerBundle: true) for a deliberate mixed-version setup.';
 }
 
-/// The platform channel to the WebView runner: send a JSON-shaped message; receive the runner's messages.
-/// Web impl jsifies/dartifies over `dart:js_util`; mobile impl JSON-encodes over a WebView JS-channel. The
-/// bridge treats messages as plain `Map<String, Object?>` — the transport owns the channel serialization.
-abstract interface class BridgeTransport {
+/// The application transport. Every host must provide the generated Runtime
+/// v2 frame lane; [send] and [messages] remain only for operations and pushed
+/// events that have not completed that migration yet.
+abstract interface class BridgeTransport implements NomosRuntimeV2Transport {
   void send(Map<String, Object?> message);
   Stream<Map<String, Object?>> get messages;
 }
@@ -267,11 +184,17 @@ class TransferProgress {
       ? null
       : (received / total!).clamp(0.0, 1.0);
   bool get done => total != null && received >= total!;
-  factory TransferProgress.fromMessage(Map<String, Object?> m) =>
+  factory TransferProgress.fromRuntime(
+    nomos_protocol.TransferProgress progress,
+  ) =>
       TransferProgress(
-        received: _wireInteger(m['received']) ?? 0,
-        total: _wireInteger(m['total']),
-        kind: m['kind']?.toString() ?? 'delta',
+        received: progress.receivedBytes.toInt(),
+        total: progress.hasTotalBytes() ? progress.totalBytes.toInt() : null,
+        kind: switch (progress.kind) {
+          nomos_protocol.TransferKind.TRANSFER_KIND_FULL => 'full',
+          nomos_protocol.TransferKind.TRANSFER_KIND_PUSH => 'push',
+          _ => 'delta',
+        },
       );
 }
 
@@ -350,46 +273,56 @@ final class KernelProgress {
   double? get fraction =>
       (total <= 0) ? null : (completed / total).clamp(0.0, 1.0);
 
-  factory KernelProgress.fromMessage(Map<String, Object?> message) =>
-      KernelProgress(
-        sequence: _wireInteger(message['sequence']) ?? 0,
-        operation: KernelProgressOperation.values.firstWhere(
-          (value) => value.name == message['operation'],
-          orElse: () => KernelProgressOperation.unspecified,
-        ),
-        phase: KernelProgressPhase.values.firstWhere(
-          (value) => value.name == message['phase'],
-          orElse: () => KernelProgressPhase.unspecified,
-        ),
-        completed: _wireInteger(message['completed']) ?? 0,
-        total: _wireInteger(message['total']) ?? 0,
-        unit: KernelProgressUnit.values.firstWhere(
-          (value) => value.name == message['unit'],
-          orElse: () => KernelProgressUnit.unspecified,
-        ),
-        terminal: message['terminal'] == true,
-        lawHydrationStep: KernelLawHydrationStep.values.firstWhere(
-          (value) => value.name == message['lawHydrationStep'],
-          orElse: () => KernelLawHydrationStep.unspecified,
-        ),
-        lawPackageSha256: message['lawPackageSha256']?.toString() ?? '',
-        hostObservedElapsedMicros:
-            _wireInteger(message['hostObservedElapsedMicros']) ?? 0,
-        hostObservedPhaseElapsedMicros:
-            _wireInteger(message['hostObservedPhaseElapsedMicros']) ?? 0,
-        kernelAllocatorLiveBytes:
-            _wireInteger(message['kernelAllocatorLiveBytes']) ?? 0,
-        kernelAllocatorPeakBytes:
-            _wireInteger(message['kernelAllocatorPeakBytes']) ?? 0,
-        processResidentBytes:
-            _wireInteger(message['processResidentBytes']) ?? 0,
-        processPeakResidentBytes:
-            _wireInteger(message['processPeakResidentBytes']) ?? 0,
-      );
+  factory KernelProgress.fromRuntime(
+    nomos_protocol.KernelProgressObserved observed,
+  ) {
+    final snapshot = observed.snapshot;
+    return KernelProgress(
+      sequence: snapshot.sequence.toInt(),
+      operation: snapshot.operation.value == 1
+          ? KernelProgressOperation.restoreMain
+          : KernelProgressOperation.unspecified,
+      phase: switch (snapshot.phase.value) {
+        1 => KernelProgressPhase.checkCustody,
+        2 => KernelProgressPhase.readChain,
+        3 => KernelProgressPhase.initializeEngine,
+        4 => KernelProgressPhase.readTimeline,
+        5 => KernelProgressPhase.hydrateLaw,
+        6 => KernelProgressPhase.recoveryPrescan,
+        7 => KernelProgressPhase.verifyIntents,
+        8 => KernelProgressPhase.promoteCustody,
+        9 => KernelProgressPhase.rebuildFrontier,
+        10 => KernelProgressPhase.complete,
+        _ => KernelProgressPhase.unspecified,
+      },
+      completed: snapshot.completedUnits.toInt(),
+      total: snapshot.totalUnits.toInt(),
+      unit: switch (snapshot.unit.value) {
+        1 => KernelProgressUnit.intent,
+        2 => KernelProgressUnit.lawPackage,
+        _ => KernelProgressUnit.unspecified,
+      },
+      terminal: snapshot.terminal,
+      lawHydrationStep: switch (snapshot.lawHydrationStep.value) {
+        1 => KernelLawHydrationStep.readClosure,
+        2 => KernelLawHydrationStep.composeStage,
+        3 => KernelLawHydrationStep.deriveSchemas,
+        4 => KernelLawHydrationStep.loadPolicyShell,
+        5 => KernelLawHydrationStep.packageComplete,
+        _ => KernelLawHydrationStep.unspecified,
+      },
+      lawPackageSha256: snapshot.lawPackageSha256,
+      hostObservedElapsedMicros: observed.hostObservedElapsedMicros.toInt(),
+      hostObservedPhaseElapsedMicros:
+          observed.hostObservedPhaseElapsedMicros.toInt(),
+      kernelAllocatorLiveBytes: snapshot.allocatorLiveBytes.toInt(),
+      kernelAllocatorPeakBytes: snapshot.allocatorPeakBytes.toInt(),
+      processResidentBytes: observed.processResidentBytes.toInt(),
+      processPeakResidentBytes: observed.processPeakResidentBytes.toInt(),
+    );
+  }
 }
 
-int? _wireInteger(Object? value) => value is num ? value.toInt() : null;
-
 /// One opaque point in this workspace's verified history. Applications use it as the handle passed to a
 /// generated client's `past.at(moment)`; [id] is framework identity, not a business field and need never be
 /// parsed. The remaining fields make a timeline useful without exposing commit or event-sourcing ceremony.
@@ -522,7 +455,7 @@ class NomosCreated {
 /// so the CANONICAL axes are axis-neutral (`[minX, minY] .. [maxX, maxY]`); the axes' meaning
 /// (earth coordinates, floor-plan mm, anything) is the tenant's business. The original geographic
 /// `minLng`/`minLat`/`maxLng`/`maxLat` named params remain accepted forever (era rule) — pass either
-/// shape. On the wire `toJson()` emits BOTH key sets, so any holon runtime (old or new) reads it.
+/// source-level shape. The exact Runtime v2 protobuf boundary carries only the canonical axes.
 class NomosBbox {
   final double minX;
   final double minY;
@@ -562,18 +495,6 @@ class NomosBbox {
     'Spatial axes are generic; use maxX/maxY. Kept for source compat.',
   )
   double get maxLat => maxY;
-
-  Map<String, Object?> toJson() => {
-        'minX': minX,
-        'minY': minY,
-        'maxX': maxX,
-        'maxY': maxY,
-        // Geographic aliases so a pre-genericisation runner (which reads minLng/…) still works.
-        'minLng': minX,
-        'minLat': minY,
-        'maxLng': maxX,
-        'maxLat': maxY,
-      };
 }
 
 /// One member's structural compat verdict — `ok`, plus the exact break [reason] when not.
@@ -661,7 +582,7 @@ class NomosScopeKey {
   final String? ownedKeySubject;
 
   /// Framework-private encrypted handoff, present only while seating the first device.
-  final String? ownedCustody;
+  final OwnedCustody? ownedCustody;
 
   /// Framework-private deterministic child address, present only for an unborn owned business aggregate.
   final String? workspace;
@@ -683,14 +604,18 @@ class NomosScopeKey {
       };
 }
 
-/// The entire app-facing multi-device surface for owned business state. The request is deliberately an
-/// opaque string: apps may copy, share or QR it, but never parse certificates, key material or signer law.
+/// The entire app-facing multi-device surface for owned business state. The
+/// request is one compiler-generated framework value; transport encoders may
+/// package it as USDA for QR/share without turning it into an opaque string.
 class NomosDevices {
   final NomosBridge bridge;
   final String domain;
   final String domainHash;
   final String? actor;
   final String scope;
+  final Future<NomosOfferOutcome> Function(
+    NomosOwnedDeviceApprovalPreparation preparation,
+  ) approvePrepared;
 
   const NomosDevices({
     required this.bridge,
@@ -698,11 +623,12 @@ class NomosDevices {
     required this.domainHash,
     required this.actor,
     required this.scope,
+    required this.approvePrepared,
   });
 
-  Future<String> request() => bridge.nomosOwnedDeviceRequest(scope);
+  Future<OwnedDeviceRequest> request() => bridge.nomosOwnedDeviceRequest(scope);
 
-  Future<NomosOfferOutcome> approve(String request) async {
+  Future<NomosOfferOutcome> approve(OwnedDeviceRequest request) async {
     final principal = actor ?? bridge.principal;
     if (principal == null || principal.trim().isEmpty) {
       throw StateError('devices.approve() needs a signed-in Nomos session');
@@ -711,13 +637,7 @@ class NomosDevices {
       request,
       scope,
     );
-    return bridge.offerOutcome(
-      domain: domain,
-      directiveId: 'nomos_internal_approve_owned_device_7c1f5e',
-      payload: payload,
-      actor: principal,
-      domainHash: domainHash,
-    );
+    return approvePrepared(payload);
   }
 }
 
@@ -874,8 +794,8 @@ class EncryptionRosterMismatch implements Exception {
 /// Without this, the app would open the child and poll `head:null` until timeout with no reason. Callers catch
 /// it to see the child name(s), the kernel [code], and the [reason]. [head] is the parent write that landed.
 class BirthIncomplete implements Exception {
-  /// The raw failed birth outcomes (`{ workspace, status, reason, code }`), status != "born".
-  final List<Map<String, Object?>> failedBirths;
+  /// The failed typed kernel outcomes, status != [NomosBirthOutcomeStatus.BIRTH_OUTCOME_STATUS_BORN].
+  final List<NomosBirthOutcome> failedBirths;
 
   /// The parent write's local head — the parent offer itself sealed; only the child did not come up.
   final String head;
@@ -884,28 +804,25 @@ class BirthIncomplete implements Exception {
 
   /// The first failed child's kernel code (e.g. `BirthLawPackageUnavailable`), or `BirthFailed`.
   String get code =>
-      (failedBirths.isNotEmpty
-          ? failedBirths.first['code']?.toString()
-          : null) ??
-      'BirthFailed';
+      failedBirths.isNotEmpty && failedBirths.first.code.isNotEmpty
+          ? failedBirths.first.code
+          : 'BirthFailed';
 
   /// The child workspace name(s) that did not come up.
-  List<String> get workspaces => failedBirths
-      .map((o) => (o['workspace'] ?? '').toString())
-      .where((s) => s.isNotEmpty)
-      .toList();
+  List<String> get workspaces =>
+      failedBirths.map((o) => o.workspace).where((s) => s.isNotEmpty).toList();
 
   @override
   String toString() {
     final list = failedBirths
         .map(
           (o) =>
-              '${o['workspace'] ?? '?'} [${o['status']}${o['code'] != null ? ': ${o['code']}' : ''}]'
-              '${o['reason'] != null ? ' — ${o['reason']}' : ''}',
+              '${o.workspace.isEmpty ? '?' : o.workspace} [${o.status.name}${o.code.isNotEmpty ? ': ${o.code}' : ''}]'
+              '${o.reason.isNotEmpty ? ' — ${o.reason}' : ''}',
         )
         .join('; ');
     final lawUnavailable = failedBirths.any(
-      (o) => o['code'] == 'BirthLawPackageUnavailable',
+      (o) => o.code == 'BirthLawPackageUnavailable',
     );
     return 'BirthIncomplete: ${failedBirths.length} child workspace(s) did NOT come up — $list. '
         'The parent offer admitted, but the child was not fully born, so opening it would poll head:null '
@@ -927,6 +844,254 @@ class NomosEpochResult {
   });
 }
 
+String _nomosOwnedRequiredString(
+  Map<String, Object?> source,
+  String field,
+) {
+  final value = source[field];
+  if (value is! String || value.isEmpty) {
+    throw FormatException('Nomos owned preparation is missing String $field');
+  }
+  return value;
+}
+
+int _nomosOwnedRequiredInt(Map<String, Object?> source, String field) {
+  final value = source[field];
+  if (value is! num || value.toInt() != value) {
+    throw FormatException('Nomos owned preparation is missing int $field');
+  }
+  return value.toInt();
+}
+
+List<String> _nomosOwnedRequiredStrings(
+  Map<String, Object?> source,
+  String field,
+) {
+  final value = source[field];
+  if (value is! List || value.any((item) => item is! String)) {
+    throw FormatException(
+        'Nomos owned preparation is missing List<String> $field');
+  }
+  return value.cast<String>().toList(growable: false);
+}
+
+OwnedDeviceRequest _nomosOwnedDeviceRequestFromTransport(Object? raw) {
+  if (raw is! Map) {
+    throw const FormatException('Nomos owned device request is not an object');
+  }
+  final value = Map<String, Object?>.from(raw);
+  const fields = <String>{
+    'v',
+    'workspace',
+    'principal',
+    'scope',
+    'signingPublic',
+    'wrappingPublic',
+    'signature',
+  };
+  if (value.keys.any((key) => !fields.contains(key)) ||
+      fields.any((key) => !value.containsKey(key))) {
+    throw const FormatException(
+        'Nomos owned device request has an invalid field set');
+  }
+  return OwnedDeviceRequest(
+    v: _nomosOwnedRequiredInt(value, 'v'),
+    workspace: _nomosOwnedRequiredString(value, 'workspace'),
+    principal: _nomosOwnedRequiredString(value, 'principal'),
+    scope: _nomosOwnedRequiredString(value, 'scope'),
+    signingPublic: _nomosOwnedRequiredString(value, 'signingPublic'),
+    wrappingPublic: _nomosOwnedRequiredString(value, 'wrappingPublic'),
+    signature: _nomosOwnedRequiredString(value, 'signature'),
+  );
+}
+
+OwnedCustody _nomosOwnedCustodyFromTransport(Object? raw) {
+  if (raw is! Map) {
+    throw const FormatException('Nomos owned custody is not an object');
+  }
+  final value = Map<String, Object?>.from(raw);
+  const fields = <String>{
+    'v',
+    'request',
+    'hpkeEpk',
+    'ct',
+    'keyCommitment',
+    'principalWrappingPublic',
+  };
+  if (value.keys.any((key) => !fields.contains(key)) ||
+      fields.any((key) => !value.containsKey(key))) {
+    throw const FormatException('Nomos owned custody has an invalid field set');
+  }
+  return OwnedCustody(
+    v: _nomosOwnedRequiredInt(value, 'v'),
+    request: _nomosOwnedDeviceRequestFromTransport(value['request']),
+    hpkeEpk: _nomosOwnedRequiredString(value, 'hpkeEpk'),
+    ct: _nomosOwnedRequiredString(value, 'ct'),
+    keyCommitment: _nomosOwnedRequiredString(value, 'keyCommitment'),
+    principalWrappingPublic:
+        _nomosOwnedRequiredString(value, 'principalWrappingPublic'),
+  );
+}
+
+/// One exact key wrap prepared by the framework-owned custody machinery.
+/// Generated clients lower this value directly to canonical USDA; it is never a
+/// tenant-authored dictionary.
+class NomosOwnedWrapPreparation {
+  final String recipientPrincipal;
+  final String recipientPubKey;
+  final String hpkeEpk;
+  final String ct;
+
+  const NomosOwnedWrapPreparation({
+    required this.recipientPrincipal,
+    required this.recipientPubKey,
+    required this.hpkeEpk,
+    required this.ct,
+  });
+
+  factory NomosOwnedWrapPreparation.fromTransport(
+    Map<String, Object?> value,
+  ) {
+    return NomosOwnedWrapPreparation(
+      recipientPrincipal:
+          _nomosOwnedRequiredString(value, 'recipientPrincipal'),
+      recipientPubKey: _nomosOwnedRequiredString(value, 'recipientPubKey'),
+      hpkeEpk: _nomosOwnedRequiredString(value, 'hpkeEpk'),
+      ct: _nomosOwnedRequiredString(value, 'ct'),
+    );
+  }
+}
+
+/// A wrap which explicitly identifies the historic epoch it opens.
+class NomosHistoricOwnedWrapPreparation extends NomosOwnedWrapPreparation {
+  final int epoch;
+
+  const NomosHistoricOwnedWrapPreparation({
+    required super.recipientPrincipal,
+    required super.recipientPubKey,
+    required super.hpkeEpk,
+    required super.ct,
+    required this.epoch,
+  });
+
+  factory NomosHistoricOwnedWrapPreparation.fromTransport(
+    Map<String, Object?> value,
+  ) {
+    return NomosHistoricOwnedWrapPreparation(
+      recipientPrincipal:
+          _nomosOwnedRequiredString(value, 'recipientPrincipal'),
+      recipientPubKey: _nomosOwnedRequiredString(value, 'recipientPubKey'),
+      hpkeEpk: _nomosOwnedRequiredString(value, 'hpkeEpk'),
+      ct: _nomosOwnedRequiredString(value, 'ct'),
+      epoch: _nomosOwnedRequiredInt(value, 'epoch'),
+    );
+  }
+}
+
+/// Exhaustive result of the framework-owned record preparation operation.
+/// Each subtype corresponds to one law directive and therefore one generated
+/// USDA encoder.
+sealed class NomosOwnedRecordPreparation {
+  final String ownedKeySubject;
+  final OwnedCustody? ownedCustody;
+
+  const NomosOwnedRecordPreparation({
+    required this.ownedKeySubject,
+    this.ownedCustody,
+  });
+}
+
+class NomosOwnedSharePreparation extends NomosOwnedRecordPreparation {
+  final String recordId;
+  final String peer;
+  final int epoch;
+  final String sharedAt;
+  final List<NomosHistoricOwnedWrapPreparation> wraps;
+
+  const NomosOwnedSharePreparation({
+    required super.ownedKeySubject,
+    super.ownedCustody,
+    required this.recordId,
+    required this.peer,
+    required this.epoch,
+    required this.sharedAt,
+    required this.wraps,
+  });
+}
+
+class NomosOwnedUnsharePreparation extends NomosOwnedRecordPreparation {
+  final String recordId;
+  final String peer;
+  final int epoch;
+  final String changedAt;
+  final List<NomosOwnedWrapPreparation> wraps;
+
+  const NomosOwnedUnsharePreparation({
+    required super.ownedKeySubject,
+    super.ownedCustody,
+    required this.recordId,
+    required this.peer,
+    required this.epoch,
+    required this.changedAt,
+    required this.wraps,
+  });
+}
+
+class NomosOwnedTransferPreparation extends NomosOwnedRecordPreparation {
+  final String recordId;
+  final String newOwner;
+  final List<String> previousReaders;
+  final int epoch;
+  final String changedAt;
+  final List<NomosHistoricOwnedWrapPreparation> historicWraps;
+
+  const NomosOwnedTransferPreparation({
+    required super.ownedKeySubject,
+    super.ownedCustody,
+    required this.recordId,
+    required this.newOwner,
+    required this.previousReaders,
+    required this.epoch,
+    required this.changedAt,
+    required this.historicWraps,
+  });
+}
+
+/// Exact framework preparation for the atomic device-approval directive.
+class NomosOwnedDeviceApprovalPreparation {
+  final String newKeySubject;
+  final OwnedCustody ownedCustody;
+  final String verifiedVia;
+  final int validFromEpoch;
+  final String approvedAt;
+  final String ownedKeySubject;
+
+  const NomosOwnedDeviceApprovalPreparation({
+    required this.newKeySubject,
+    required this.ownedCustody,
+    required this.verifiedVia,
+    required this.validFromEpoch,
+    required this.approvedAt,
+    required this.ownedKeySubject,
+  });
+
+  factory NomosOwnedDeviceApprovalPreparation.fromTransport(
+    Map<String, Object?> value,
+  ) {
+    return NomosOwnedDeviceApprovalPreparation(
+      newKeySubject: _nomosOwnedRequiredString(value, 'newKeySubject'),
+      ownedCustody: _nomosOwnedCustodyFromTransport(value['ownedCustody']),
+      verifiedVia: _nomosOwnedRequiredString(value, 'verifiedVia'),
+      validFromEpoch: _nomosOwnedRequiredInt(value, 'validFromEpoch'),
+      approvedAt: _nomosOwnedRequiredString(value, 'approvedAt'),
+      ownedKeySubject: _nomosOwnedRequiredString(
+        value,
+        '__nomos_owned_device_key_subject_7c1f5e',
+      ),
+    );
+  }
+}
+
 /// THE OWNER CEREMONY surface — `<Domain>Client(bridge, actor: owner).encryption`. All three verbs open a
 /// FRESH epoch (a fresh 32-byte secret) and fan the wraps to the resolved roster; the membership change (if
 /// any) is the domain grant/revoke dispatched first, in the same call.
@@ -1194,6 +1359,67 @@ class NomosEncryption {
 /// for a `.births()` directive — the child workspace(s) the offer brought into being on this local plane.
 enum NomosOperationPhase { locallyAccepted, admittedToRemoteCustody, converged }
 
+/// The proof material a generated offer presents to the kernel.
+///
+/// Generated law chooses this; application callers do not. [sessionCredentials] preserves the
+/// ordinary session posture. [enrolledDevice] deliberately withholds any provider token so a
+/// stale provider epoch cannot prevent an already enrolled device from authoring a recovery offer.
+enum NomosOfferAuthenticationProof { sessionCredentials, enrolledDevice }
+
+/// The kernel's exact diagnosis of the provider credential held by this session.
+///
+/// This deliberately does not expose protobuf names to generated application
+/// clients.  It is a typed framework fact used to decide whether a parent-law
+/// epoch recovery is applicable; callers never inspect an error string.
+enum NomosProviderTokenVerification {
+  unspecified,
+  valid,
+  noMatchingKey,
+  expired,
+  notYetValid,
+  issuerMismatch,
+  audienceMismatch,
+  badSignature,
+  malformed,
+  unsupportedAlgorithm,
+  badKey,
+  missingSubject,
+  noVerifier,
+  missingToken,
+}
+
+/// Current kernel-authenticated facts needed before retrying an ordinary offer.
+final class NomosAuthenticationPosture {
+  const NomosAuthenticationPosture({
+    required this.providerToken,
+    required this.enrolledDevice,
+    required this.resolvedPrincipal,
+  });
+
+  final NomosProviderTokenVerification providerToken;
+  final bool enrolledDevice;
+  final String resolvedPrincipal;
+
+  bool isReadyFor(String expectedPrincipal) =>
+      providerToken == NomosProviderTokenVerification.valid &&
+      enrolledDevice &&
+      expectedPrincipal.isNotEmpty &&
+      resolvedPrincipal == expectedPrincipal;
+}
+
+/// A typed kernel-call refusal. Generated clients may inspect [code] only to
+/// choose another typed kernel query; prose remains diagnostic, never control
+/// flow.
+final class NomosKernelCallFailure implements Exception {
+  const NomosKernelCallFailure({required this.code, required this.message});
+
+  final String code;
+  final String message;
+
+  @override
+  String toString() => 'NomosKernelCallFailure($code: $message)';
+}
+
 /// Product-facing progress for one accepted write. Transport topology and custody identifiers remain private.
 final class NomosOperationStatus {
   const NomosOperationStatus(this.phase, {this.updatedAt});
@@ -1261,8 +1487,8 @@ class NomosOfferOutcome {
   /// it IN-PLACE and opens it as a live sibling session — reads/writes flow into the child at once (#42).
   final List<String> born;
 
-  /// The raw per-child birth outcomes the holon reported (`{ workspace, genesisHead, … }`), when present.
-  final List<Map<String, Object?>> birthOutcomes;
+  /// Typed per-child outcomes reported by the kernel, when present.
+  final List<NomosBirthOutcome> birthOutcomes;
 
   /// LEGACY GATEWAY LANE ONLY: the parent gateway's verdict, when this outcome wraps a deprecated
   /// cross-workspace `createWorkspace` relay (the old generated-birth shape). Null on the one
@@ -1310,6 +1536,31 @@ class NomosOfferOutcome {
       .toList();
 }
 
+/// A generated protobuf offer response that did not admit the proposed
+/// change. Keeping the response typed preserves every exhaustive kernel
+/// outcome without translating it through an exception-shaped map.
+final class NomosTypedOfferFailure implements Exception {
+  const NomosTypedOfferFailure(this.response);
+
+  final nomos_protocol.OfferResponse response;
+
+  @override
+  String toString() {
+    final detail = switch (response.whichOutcome()) {
+      nomos_protocol.OfferResponse_Outcome.refused =>
+        '${response.refused.refusal.code.name}: ${response.refused.refusal.message}',
+      nomos_protocol.OfferResponse_Outcome.deadLettered =>
+        response.deadLettered.reason,
+      nomos_protocol.OfferResponse_Outcome.quarantined =>
+        response.quarantined.reason,
+      nomos_protocol.OfferResponse_Outcome.blockedOnDependency =>
+        response.blockedOnDependency.detail,
+      final outcome => outcome.name,
+    };
+    return 'NomosTypedOfferFailure($detail)';
+  }
+}
+
 /// OPEN A REF'S WORKSPACE DIRECTLY (co2 DX ask) — `await outcome.bornRefs.single.acquire(bridge)`. Sugar over
 /// [NomosBridge.acquireSession] keyed by the ref's `workspace`: an already-open session returns as-is; a
 /// device-resident/parked/just-born workspace opens LOCAL-ONLY in place (no cloud, no credentials); only a
@@ -1396,6 +1647,7 @@ class NomosBridge {
   final Map<int, Completer<Object?>> _pending = {};
   final Map<int, String> _pendingOps = {};
   final Map<int, NomosTraceContext> _pendingTraces = {};
+  final Map<int, StackTrace> _pendingCallStacks = {};
   final Map<String, StreamController<List<dynamic>>> _watches = {};
   // SHAPE COMPATIBILITY (#72): compat bindings emit a verdict MAP, not a row list.
   final Map<String, StreamController<Map<String, Object?>>> _compatWatches = {};
@@ -1407,8 +1659,8 @@ class NomosBridge {
   final Map<String, StreamController<NomosCompat>> _lawChangedBySession = {};
   final StreamController<NomosCompat> _lawChanged =
       StreamController<NomosCompat>.broadcast();
-  final StreamController<Map<String, Object?>> _syncEvents =
-      StreamController<Map<String, Object?>>.broadcast();
+  final StreamController<nomos_protocol.RuntimeEvent> _syncEvents =
+      StreamController<nomos_protocol.RuntimeEvent>.broadcast();
   final StreamController<Map<String, Object?>> _signalEvents =
       StreamController<Map<String, Object?>>.broadcast();
   // CUSTODY LIFECYCLE (rebirth_and_custody_lifecycle.md): each `custody` event carries the raw map (session +
@@ -1456,13 +1708,20 @@ class NomosBridge {
   // workspace is a live session on it. [_sessionNames] tracks what [connect] has opened; [_sessionViews]
   // caches the per-workspace [NomosSession] handle so `bridge.session(ws)` is stable + cheap.
   final Set<String> _sessionNames = {};
+  final Map<String, String> _workspaceBySession = {};
   final Map<String, NomosSession> _sessionViews = {};
   // The gate-bound identity retained from each session's auth token. Generated clients consume this so
   // application code never has to thread an actor into ordinary business methods.
   final Map<String, String> _sessionPrincipals = {};
+  // Runtime-v2 offers need the exact captured credentials, not a reconstructed
+  // JSON envelope. They remain process-local and are passed only as protobuf
+  // bytes to the resident kernel.
+  final Map<String, String> _sessionAuthTokens = {};
   // Device signing custody follows the application session internally. A generated application opening a
   // locally-born child inherits its current session's device key; tenant code never handles authorSecret.
   final Map<String, String> _sessionAuthorSecrets = {};
+  final Map<String, int> _sessionOfferSequences = {};
+  final Map<String, int> _sessionReplicas = {};
   // Stateful generated applications retain the refreshable cloud access that opened their primary
   // session. A generated read following a NomosRef can therefore mount a genuinely-absent workspace
   // without asking tenant code for cloud URLs, tokens, sessions or signing keys. Kept per source
@@ -1487,12 +1746,165 @@ class NomosBridge {
   // methods expose only the typed receipt and its product-language lifecycle.
   final Map<String, Map<String, NomosOperationReceipt>> _operationReceipts = {};
   final Map<String, NomosOperationReceipt> _birthReceipts = {};
+  final Map<String, StreamController<Uint8List>> _nominalWatchControllers = {};
   int _seq = 0;
+  late final NmsRuntimeV2Gateway _runtimeV2 = NmsRuntimeV2Gateway(_transport);
   final String _traceId = _newTraceId();
   late final StreamSubscription<Map<String, Object?>> _sub;
+  StreamSubscription<nomos_protocol.RuntimeEvent>? _runtimeEventSub;
 
   NomosBridge(this._transport, {this.allowStaleRunnerBundle = false}) {
     _sub = _transport.messages.listen(_onMessage, onError: _onTransportError);
+    final transport = _transport;
+    if (transport is NomosRuntimeV2EventTransport) {
+      final eventTransport = transport as NomosRuntimeV2EventTransport;
+      _runtimeEventSub = eventTransport.runtimeEvents.listen(
+        _onRuntimeEvent,
+        onError: _onTransportError,
+      );
+    }
+  }
+
+  void _onRuntimeEvent(nomos_protocol.RuntimeEvent event) {
+    if (event.hasReady()) {
+      final stale = _staleBundleError(event.ready.runtimeVersion);
+      if (stale != null && !allowStaleRunnerBundle) {
+        if (!_ready.isCompleted) _ready.completeError(stale);
+      } else if (!_ready.isCompleted) {
+        _ready.complete();
+      }
+      return;
+    }
+    if (event.hasWatchChanged()) {
+      final changed = event.watchChanged;
+      final controller =
+          _eventPlane._nominalWatchControllers[changed.subscriptionId];
+      if (controller == null || controller.isClosed) return;
+      if (changed.hasFailure()) {
+        controller.addError(
+          StateError('${changed.failure.code}: ${changed.failure.message}'),
+        );
+        return;
+      }
+      controller.add(Uint8List.fromList(changed.resultUsda));
+      return;
+    }
+    if (event.hasSyncCompleted()) {
+      final completed = event.syncCompleted;
+      final session = event.hasSession() ? event.session : null;
+      if (!_eventPlane._syncEvents.isClosed) {
+        _eventPlane._syncEvents.add(event);
+      }
+      if (completed.hasFailure()) {
+        if (_eventPlane._syncNeedsCredentialRefresh(completed) &&
+            session != null) {
+          unawaited(_eventPlane._refreshSessionCredential(session));
+        }
+        _eventPlane._updateScopedStatus(
+          session,
+          (current) => current.copyWith(
+            phase: SyncPhase.error,
+            clearTransfer: true,
+            lastError: completed.failure.message,
+          ),
+        );
+        return;
+      }
+      final result = completed.result;
+      if (session != null) {
+        _eventPlane._advanceOperationReceipts(session, result);
+        if (_eventPlane._syncNeedsCredentialRefresh(completed)) {
+          unawaited(_eventPlane._refreshSessionCredential(session));
+        }
+      }
+      if (result.offline) {
+        _eventPlane._updateScopedStatus(
+          session,
+          (current) => current.copyWith(
+            phase: SyncPhase.offline,
+            clearTransfer: true,
+            lastError: result.hasPushError() ? result.pushError.message : null,
+          ),
+        );
+      } else if (result.pushFailed) {
+        _eventPlane._updateScopedStatus(
+          session,
+          (current) => current.copyWith(
+            phase: SyncPhase.error,
+            clearTransfer: true,
+            lastError: _eventPlane._syncPushFailureDetail(result),
+          ),
+        );
+      } else {
+        _eventPlane._updateScopedStatus(
+          session,
+          (current) => current.copyWith(
+            phase: SyncPhase.idle,
+            clearTransfer: true,
+            clearError: true,
+            lastSyncedAt: DateTime.now(),
+          ),
+        );
+      }
+      return;
+    }
+    if (event.hasLinkChanged()) {
+      if (!_eventPlane._syncEvents.isClosed) {
+        _eventPlane._syncEvents.add(event);
+      }
+      if (event.linkChanged.status ==
+          nomos_protocol.LinkStatus.LINK_STATUS_CLOSED) {
+        _eventPlane._updateScopedStatus(
+          event.hasSession() ? event.session : null,
+          (current) => current.copyWith(phase: SyncPhase.offline),
+        );
+      }
+      return;
+    }
+    if (event.hasCustodyChanged()) {
+      if (!_eventPlane._custodyEvents.isClosed) {
+        _eventPlane._custodyEvents.add(
+          NomosCustodyEvent.fromRuntime(
+            event.custodyChanged,
+            session: event.hasSession() ? event.session : null,
+          ),
+        );
+      }
+      return;
+    }
+    if (event.hasLocalWorkRejected()) {
+      if (!_eventPlane._localWorkRejectedEvents.isClosed) {
+        _eventPlane._localWorkRejectedEvents.add(
+          NomosLocalWorkRejectedEvent.fromRuntime(
+            event.localWorkRejected,
+            session: event.hasSession() ? event.session : null,
+          ),
+        );
+      }
+      return;
+    }
+    if (event.hasTransferProgress()) {
+      final progress = TransferProgress.fromRuntime(event.transferProgress);
+      if (!_eventPlane._transferEvents.isClosed) {
+        _eventPlane._transferEvents.add(progress);
+      }
+      _eventPlane._updateScopedStatus(
+        event.hasSession() ? event.session : null,
+        (current) => current.copyWith(
+          phase: progress.done ? SyncPhase.syncing : SyncPhase.transferring,
+          transfer: progress,
+          clearTransfer: progress.done,
+        ),
+      );
+      return;
+    }
+    if (event.hasKernelProgress()) {
+      if (!_eventPlane._kernelProgressEvents.isClosed) {
+        _eventPlane._kernelProgressEvents.add(
+          KernelProgress.fromRuntime(event.kernelProgress),
+        );
+      }
+    }
   }
 
   void _onTransportError(Object error, StackTrace stackTrace) {
@@ -1501,6 +1913,7 @@ class NomosBridge {
     _pending.clear();
     _pendingOps.clear();
     _pendingTraces.clear();
+    _pendingCallStacks.clear();
     for (final completer in pending) {
       if (!completer.isCompleted) completer.completeError(error, stackTrace);
     }
@@ -1643,114 +2056,6 @@ class NomosBridge {
       }
       return;
     }
-    if (event == 'sync' || event == 'link') {
-      // autoSync telemetry: each round { event:'sync', reason, result } and socket state { event:'link', status }.
-      if (!_syncEvents.isClosed) _syncEvents.add(m);
-      if (event == 'sync') {
-        final result = (m['result'] as Map?)?.cast<String, Object?>();
-        final session = m['session']?.toString();
-        if (session != null && result != null) {
-          _advanceOperationReceipts(session, result);
-          if (_syncNeedsCredentialRefresh(m, result)) {
-            unawaited(_refreshSessionCredential(session));
-          }
-        }
-        if (m['ok'] == false) {
-          // A rejected/failed round is not a successful sync timestamp. Keep the stable typed envelope on
-          // telemetry; the app-ready status needs only one legible error and an honest error phase.
-          final detail = m['error']?.toString() ?? 'automatic sync failed';
-          _updateScopedStatus(
-            session,
-            (current) => current.copyWith(
-              phase: SyncPhase.error,
-              clearTransfer: true,
-              lastError: detail,
-            ),
-          );
-        } else if (result?['offline'] == true) {
-          // Offline is expected transport debt. The durable local branch remains ahead and autoSync owns the
-          // retry; do not claim a completed sync or overwrite the previous successful timestamp.
-          _updateScopedStatus(
-            session,
-            (current) => current.copyWith(
-              phase: SyncPhase.offline,
-              clearTransfer: true,
-              lastError: (result?['pushError'] as Map?)?['error']?.toString(),
-            ),
-          );
-        } else if (result?['pushFailed'] == true) {
-          // The sync round itself completed, but shared custody refused the
-          // push. `stillAhead` is durable debt, not success: surface the
-          // cloud's typed refusal on the owning workspace so generated
-          // `whenCurrent()` calls fail with the real cause instead of timing
-          // out behind a generic saving state.
-          final detail = _syncPushFailureDetail(result!);
-          _updateScopedStatus(
-            session,
-            (current) => current.copyWith(
-              phase: SyncPhase.error,
-              clearTransfer: true,
-              lastError: detail,
-            ),
-          );
-        } else {
-          // A completed round → idle (the next metrics poll folds in residual ahead/behind), stamp the time.
-          _updateScopedStatus(
-            session,
-            (current) => current.copyWith(
-              phase: SyncPhase.idle,
-              clearTransfer: true,
-              clearError: true,
-              lastSyncedAt: DateTime.now(),
-            ),
-          );
-        }
-      } else if (m['status'] == 'closed' || m['status'] == 'offline') {
-        _updateScopedStatus(
-          m['session']?.toString(),
-          (current) => current.copyWith(phase: SyncPhase.offline),
-        );
-      }
-      return;
-    }
-    if (event == 'custody') {
-      // Custody lifecycle: { event:'custody', session, custody:{ kind, break, … } }. Decode + fan out so the
-      // app can react (kind "ask" → show a dialog then call resolveCustodyBreak; others are informational).
-      final ev = NomosCustodyEvent.fromMessage(m);
-      if (ev != null && !_custodyEvents.isClosed) _custodyEvents.add(ev);
-      return;
-    }
-    if (event == 'localWorkRejected') {
-      // LOCAL-WORK-REJECTED: { event:'localWorkRejected', session, localWorkRejected:{ workspace,
-      // refused, parked, resetTo, retryable, source } }. The framework already parked the refused
-      // intents + replayed survivors; the app's only job is the honest message (retryable ⇒ "queued,
-      // will retry"; terminal ⇒ "preserved for review — contact support").
-      final ev = NomosLocalWorkRejectedEvent.fromMessage(m);
-      if (ev != null && !_localWorkRejectedEvents.isClosed) {
-        _localWorkRejectedEvents.add(ev);
-      }
-      return;
-    }
-    if (event == 'transfer') {
-      // LIVE pack byte-progress { received, total, kind } — the real loading bar (host Content-Length).
-      final tp = TransferProgress.fromMessage(m);
-      if (!_transferEvents.isClosed) _transferEvents.add(tp);
-      _updateScopedStatus(
-        m['session']?.toString(),
-        (current) => current.copyWith(
-          phase: tp.done ? SyncPhase.syncing : SyncPhase.transferring,
-          transfer: tp,
-          clearTransfer: tp.done,
-        ),
-      );
-      return;
-    }
-    if (event == 'kernelProgress') {
-      if (!_kernelProgressEvents.isClosed) {
-        _kernelProgressEvents.add(KernelProgress.fromMessage(m));
-      }
-      return;
-    }
     if (event == 'trace') {
       // the realtime cloud flamepath: { event:'trace', trace:{at, oid, edge, clients} } — one per admission.
       if (!_flameEvents.isClosed) _flameEvents.add(m);
@@ -1782,6 +2087,7 @@ class NomosBridge {
     final completer = _pending.remove(id);
     final op = _pendingOps.remove(id);
     final trace = _pendingTraces.remove(id) ?? const NomosTraceContext();
+    final callStack = _pendingCallStacks.remove(id) ?? StackTrace.current;
     if (completer == null) return;
     if (m['ok'] == true) {
       completer.complete(m['result']);
@@ -1791,14 +2097,15 @@ class NomosBridge {
       // [BirthIncomplete] here (apps switch on the type + entries, never scrape the prose).
       final failedBirths = ((m['errorInfo'] as Map?)?['failedBirths'] as List?)
           ?.whereType<Map>()
-          .map((e) => e.cast<String, Object?>())
-          .toList();
+          .map(_birthOutcomeFromLegacyWire)
+          .toList(growable: false);
       if (failedBirths != null && failedBirths.isNotEmpty) {
         completer.completeError(
           BirthIncomplete(
             failedBirths,
             head: ((m['errorInfo'] as Map?)?['head'] ?? '').toString(),
           ),
+          callStack,
         );
         return;
       }
@@ -1808,7 +2115,7 @@ class NomosBridge {
         fallbackTrace: trace,
         fallbackMessage: 'the githolon refused the request',
       );
-      completer.completeError(nomosErrorFromInfo(info));
+      completer.completeError(nomosErrorFromInfo(info), callStack);
     }
   }
 
@@ -1826,6 +2133,7 @@ class NomosBridge {
       sampled: true,
     );
     _pendingTraces[id] = trace;
+    _pendingCallStacks[id] = StackTrace.current;
     try {
       _transport.send({
         'v': kWebviewBridgeVersion,
@@ -1845,11 +2153,49 @@ class NomosBridge {
       _pending.remove(id);
       _pendingOps.remove(id);
       _pendingTraces.remove(id);
+      _pendingCallStacks.remove(id);
       completer.completeError(error, stackTrace);
     }
     return completer.future;
   }
 
+  /// Invoke one generated application-runtime command. Request correlation and
+  /// every outcome discriminator stay in generated protobuf types; callers
+  /// must exhaustively select the response arm they requested.
+  Future<nomos_protocol.RuntimeResponse> _invokeRuntimeV2(
+    nomos_protocol.RuntimeRequest request,
+  ) async {
+    return _eventPlane._runtimeV2.invoke(request);
+  }
+
+  String _runtimeSession([String? explicit]) {
+    if (explicit != null && explicit.isNotEmpty) return explicit;
+    final scoped = _sessionName;
+    if (scoped != null && scoped.isNotEmpty) return scoped;
+    final sessions = _eventPlane._sessionNames;
+    if (sessions.length == 1) return sessions.single;
+    if (sessions.isEmpty) {
+      throw StateError('No Nomos workspace is connected');
+    }
+    throw StateError(
+        'Multiple Nomos workspaces are connected; select a session');
+  }
+
+  Future<void> _unwatch(String subscriptionId) async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        unwatch: nomos_protocol.UnwatchRequest(
+          subscriptionId: subscriptionId,
+        ),
+      ),
+    );
+    if (!response.hasWatchStopped()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for unwatch',
+      );
+    }
+  }
+
   Map<String, Object?> _asMap(Object? v) =>
       (v as Map?)?.cast<String, Object?>() ?? const {};
   List<Map<String, dynamic>> _asRows(Object? v) =>
@@ -1857,23 +2203,6 @@ class NomosBridge {
           .map((e) => (e as Map).cast<String, dynamic>())
           .toList();
 
-  String? _principalFromToken(String? token) {
-    if (token == null || token.isEmpty) return null;
-    try {
-      final parts = token.split('.');
-      if (parts.length < 2) return null;
-      final payload = jsonDecode(
-        utf8.decode(base64Url.decode(base64Url.normalize(parts[1]))),
-      );
-      final sub = payload is Map ? payload['sub'] : null;
-      if (sub is! String || sub.trim().isEmpty) return null;
-      final value = sub.trim();
-      return 'user:$value';
-    } catch (_) {
-      return null;
-    }
-  }
-
   NomosOperationReceipt _registerOperationReceipt(
     String workspace,
     String intentId,
@@ -1905,19 +2234,19 @@ class NomosBridge {
 
   void _advanceOperationReceipts(
     String workspace,
-    Map<String, Object?> result,
+    nomos_protocol.SyncWorkspaceResponse result,
   ) {
     final pending = _eventPlane._operationReceipts[workspace];
     if (pending == null || pending.isEmpty) return;
 
-    Iterable<String> ids(String key) => ((result[key] as List?) ?? const [])
-        .whereType<String>()
-        .where((value) => value.isNotEmpty);
-
-    for (final intentId in ids('admittedIntentIds')) {
+    for (final intentId in result.admittedIntentIds.where(
+      (value) => value.isNotEmpty,
+    )) {
       pending[intentId]?._advance(NomosOperationPhase.admittedToRemoteCustody);
     }
-    for (final intentId in ids('convergedIntentIds')) {
+    for (final intentId in result.convergedIntentIds.where(
+      (value) => value.isNotEmpty,
+    )) {
       final receipt = pending.remove(intentId);
       receipt?._advance(NomosOperationPhase.converged);
     }
@@ -1925,24 +2254,24 @@ class NomosBridge {
   }
 
   bool _syncNeedsCredentialRefresh(
-    Map<String, Object?> message,
-    Map<String, Object?> result,
+    nomos_protocol.SyncCompleted event,
   ) {
-    final push = (result['pushError'] as Map?)?.cast<String, Object?>();
-    final status = push?['status'];
+    final status =
+        event.result.hasPushError() ? event.result.pushError.status : 0;
     if (status == 401 || status == 403) return true;
-    final text =
-        '${message['error'] ?? ''} ${push?['error'] ?? ''}'.toLowerCase();
+    final text = '${event.hasFailure() ? event.failure.message : ''} '
+            '${event.result.hasPushError() ? event.result.pushError.message : ''}'
+        .toLowerCase();
     return text.contains('unauthenticated') ||
         text.contains('token expired') ||
         text.contains('invalid token');
   }
 
-  String _syncPushFailureDetail(Map<String, Object?> result) {
-    final push = (result['pushError'] as Map?)?.cast<String, Object?>();
-    final status = push?['status'];
-    final reason = push?['error'] ?? push?['body'];
-    final prefix = status == null
+  String _syncPushFailureDetail(nomos_protocol.SyncWorkspaceResponse result) {
+    final push = result.hasPushError() ? result.pushError : null;
+    final status = push?.status;
+    final reason = push?.message;
+    final prefix = status == null || status == 0
         ? 'Shared custody refused this workspace change'
         : 'Shared custody refused this workspace change (HTTP $status)';
     return reason == null || reason.toString().trim().isEmpty
@@ -2023,19 +2352,18 @@ class NomosBridge {
   ///                     call `bridge.acquireSession(ws)` / `ref.acquire(bridge)` before using it;
   ///     • `"parked"`  — custody resident but the holon is LRU-disposed; it re-mounts on demand (acquire).
   /// `syncPosture` is `"local-only"` (no cloud counterpart) or `"cloud-bound"`.
-  Future<List<Map<String, Object?>>> listWorkspaces() async {
-    final connected = _eventPlane._sessionNames.toSet();
-    return (((_asMap(await _call('listWorkspaces'))['workspaces']) as List?) ??
-            const [])
-        .map((e) => (e as Map).cast<String, Object?>())
-        .map((w) {
-      final ws = w['workspace']?.toString() ?? '';
-      // `connected` is the app's own connect() truth; `parked`/resident come from the runner realm.
-      w['state'] = (w['parked'] == true)
-          ? 'parked'
-          : (connected.contains(ws) ? 'connected' : 'resident');
-      return w;
-    }).toList();
+  Future<List<nomos_protocol.WorkspaceSummary>> listWorkspaces() async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        listWorkspaces: nomos_protocol.ListWorkspacesRequest(),
+      ),
+    );
+    if (!response.hasWorkspaceList()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for listWorkspaces',
+      );
+    }
+    return response.workspaceList.workspaces;
   }
 
   /// Framework-private plane persistence primitive. It snapshots exact local custody even when [workspace]
@@ -2109,6 +2437,7 @@ class NomosBridge {
     _eventPlane._sessionNames.add(
       ws,
     ); // the open succeeded — the session is real now
+    _eventPlane._workspaceBySession[ws] = workspace;
     // Opening succeeded, but scoped metrics have not yet proved that this
     // workspace is current. Unknown readiness must fail closed: otherwise a
     // generated `whenCurrent()` can observe the default idle value and return
@@ -2118,9 +2447,13 @@ class NomosBridge {
       () => const SyncStatus(phase: SyncPhase.syncing),
     );
     _eventPlane._foldApplicationStatusFromSessions();
-    final boundPrincipal = _principalFromToken(authToken);
-    if (boundPrincipal != null)
-      _eventPlane._sessionPrincipals[ws] = boundPrincipal;
+    // An opaque bearer token is proof material for the kernel, not a JSON
+    // identity document for the host. The session acquires a principal claim
+    // only from an explicit generated application context; decoding `sub`
+    // here would falsely turn an unverified host observation into authority.
+    if (authToken != null && authToken.isNotEmpty) {
+      _eventPlane._sessionAuthTokens[ws] = authToken;
+    }
     if (authorSecret != null && authorSecret.isNotEmpty) {
       _eventPlane._sessionAuthorSecrets[ws] = authorSecret;
     }
@@ -2158,16 +2491,34 @@ class NomosBridge {
       );
 
   /// Continue an `ask`-policy custody break with the user's decision (adopt|reject) — the async UX lane.
-  Future<Map<String, Object?>> resolveCustodyBreak(
-    String decision, {
+  Future<nomos_protocol.CustodyBreakResolved> resolveCustodyBreak(
+    nomos_protocol.CustodyBreakDecision decision, {
     String? session,
-  }) async =>
-      _asMap(
-        await _call('resolveCustodyBreak', {
-          'decision': decision,
-          if (session != null) 'session': session,
-        }),
+  }) async {
+    if (decision ==
+        nomos_protocol
+            .CustodyBreakDecision.CUSTODY_BREAK_DECISION_UNSPECIFIED) {
+      throw ArgumentError.value(
+        decision,
+        'decision',
+        'must be ADOPT or REJECT',
+      );
+    }
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        resolveCustodyBreak: nomos_protocol.ResolveCustodyBreakRequest(
+          session: _runtimeSession(session),
+          decision: decision,
+        ),
+      ),
+    );
+    if (!response.hasCustodyBreakResolved()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for resolveCustodyBreak',
       );
+    }
+    return response.custodyBreakResolved;
+  }
 
   /// The parked salvaged intents (re-offerable local work an `adopt` rescued) — metadata only.
   Future<List<Map<String, Object?>>> salvagedIntents({String? session}) async {
@@ -2210,42 +2561,68 @@ class NomosBridge {
   //   parks the FULL intent durably in the workspace tree (it rides export()/restore); the app
   //   inspects, the domain dev ships a law fix, retry unjams. ──
 
-  /// The parked dead letters — metadata only (`{id, oid, source, error, domain, directiveId, at}`);
-  /// the intent bytes stay in the durable queue.
-  Future<List<Map<String, Object?>>> deadLetters({String? session}) async {
-    final r = _asMap(
-      await _call('deadLetters', {if (session != null) 'session': session}),
+  /// The parked dead letters; intent bytes stay in durable custody.
+  Future<List<nomos_protocol.DeadLetterEntry>> deadLetters(
+      {String? session}) async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        deadLetter: nomos_protocol.DeadLetterRequest(
+          session: _runtimeSession(session),
+          list: nomos_protocol.ListDeadLettersRequest(),
+        ),
+      ),
     );
-    return ((r['dead'] as List?) ?? const [])
-        .map((e) => (e as Map).cast<String, Object?>())
-        .toList();
+    if (!response.hasDeadLetter() || !response.deadLetter.hasList()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for deadLetters',
+      );
+    }
+    return List.unmodifiable(response.deadLetter.list.entries);
   }
 
   /// Retry one dead letter (after the law fix landed): pulls canon first (it may already be
   /// admitted), else re-offers the parked bytes locally. `{ok, head?|alreadyOnMain?|error?}` —
   /// a refusal leaves the entry parked (with the fresh error), never lost.
-  Future<Map<String, Object?>> retryDeadLetter(
+  Future<nomos_protocol.DeadLetterRetry> retryDeadLetter(
     String id, {
     String? session,
-  }) async =>
-      _asMap(
-        await _call('retryDeadLetter', {
-          'id': id,
-          if (session != null) 'session': session,
-        }),
+  }) async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        deadLetter: nomos_protocol.DeadLetterRequest(
+          session: _runtimeSession(session),
+          retry: nomos_protocol.RetryDeadLetterRequest(intentId: id),
+        ),
+      ),
+    );
+    if (!response.hasDeadLetter() || !response.deadLetter.hasRetry()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for retryDeadLetter',
       );
+    }
+    return response.deadLetter.retry;
+  }
 
   /// Discard one dead letter — the app's EXPLICIT choice to drop the work. `{ok}`.
-  Future<Map<String, Object?>> discardDeadLetter(
+  Future<nomos_protocol.DeadLetterDiscard> discardDeadLetter(
     String id, {
     String? session,
-  }) async =>
-      _asMap(
-        await _call('discardDeadLetter', {
-          'id': id,
-          if (session != null) 'session': session,
-        }),
+  }) async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        deadLetter: nomos_protocol.DeadLetterRequest(
+          session: _runtimeSession(session),
+          discard: nomos_protocol.DiscardDeadLetterRequest(intentId: id),
+        ),
+      ),
+    );
+    if (!response.hasDeadLetter() || !response.deadLetter.hasDiscard()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for discardDeadLetter',
       );
+    }
+    return response.deadLetter.discard;
+  }
 
   /// SALVAGE — best-effort extraction of this holon's local-only authored work (un-synced pending
   /// writes + the DLQ), each with its full `changeB64` bytes: `{pendingWrites, deadLetters}`. The
@@ -2327,7 +2704,8 @@ class NomosBridge {
         if (session != null) 'session': session,
         if (authorSecret != null) 'authorSecret': authorSecret,
         if (birthCertificate != null)
-          'birthCertificate': birthCertificate.toWire(),
+          'birthCertificateProtobuf':
+              base64Encode(birthCertificate.writeToBuffer()),
       }),
     );
     return r['head'].toString();
@@ -2367,6 +2745,164 @@ class NomosBridge {
         birthCertificate: birthCertificate,
       );
 
+  /// The existing offer operation with its tenant intent authored as canonical
+  /// USDA and carried by the generated protobuf ABI. This is not a second write
+  /// endpoint: generated domain methods use it to reach the same kernel
+  /// [OfferRequest] without a generic map or JavaScript serializer.
+  @internal
+  Future<NomosOfferOutcome> offerCallUsdaOutcome({
+    required NmsGeneratedCall call,
+    String? actor,
+    String? domainHash,
+    String? session,
+    String? authorSecret,
+    NomosBirthCertificate? birthCertificate,
+    Iterable<NomosConflictSnapshot> conflictSnapshots = const [],
+    NomosOfferAuthenticationProof authenticationProof =
+        NomosOfferAuthenticationProof.sessionCredentials,
+  }) async {
+    final runtimeSession = session ?? _sessionName;
+    if (runtimeSession == null || runtimeSession.isEmpty) {
+      throw StateError(
+        'A typed offer must be bound to a connected NomosSession',
+      );
+    }
+    final transport = _transport;
+    if (transport is! NomosKernelCallTransport) {
+      throw UnsupportedError(
+        'This host does not implement the generated protobuf kernel lane',
+      );
+    }
+    final kernelTransport = transport as NomosKernelCallTransport;
+    final plane = _eventPlane;
+    final workspace =
+        plane._workspaceBySession[runtimeSession] ?? runtimeSession;
+    final sequence = (plane._sessionOfferSequences[runtimeSession] ?? 0) + 1;
+    plane._sessionOfferSequences[runtimeSession] = sequence;
+    final random = Random.secure();
+    final replica = plane._sessionReplicas.putIfAbsent(
+      workspace,
+      () => random.nextInt(0x7fffffff) + 1,
+    );
+    final now = DateTime.now().millisecondsSinceEpoch;
+    final sessionToken = plane._sessionAuthTokens[runtimeSession];
+    final secret = authorSecret ?? plane._sessionAuthorSecrets[runtimeSession];
+    if (authenticationProof == NomosOfferAuthenticationProof.enrolledDevice &&
+        (secret == null || secret.isEmpty)) {
+      throw StateError(
+        'This law requires proof from an enrolled device, but the session has no device key',
+      );
+    }
+    final token = switch (authenticationProof) {
+      NomosOfferAuthenticationProof.sessionCredentials => sessionToken,
+      NomosOfferAuthenticationProof.enrolledDevice => null,
+    };
+    final response = await kernelTransport.callKernel(
+      session: runtimeSession,
+      request: nomos_protocol.CallRequest(
+        protocolVersion: 1,
+        requestId: '$runtimeSession:offer:$sequence',
+        offer: nomos_protocol.OfferRequest(
+          target: nomos_protocol.WorkspaceTarget(
+            repo: '/work/ws/$runtimeSession',
+            workspace: workspace,
+            branch: 'main',
+          ),
+          call: nomos_protocol.DirectiveCall(
+            domain: call.domain,
+            directive: call.directive,
+            callUsda: call.canonicalUsda,
+          ),
+          authoring: nomos_protocol.AuthoringOptions(
+            actor: actor ?? principal ?? '',
+            authToken: token == null ? const <int>[] : utf8.encode(token),
+            authorSecret: secret == null ? const <int>[] : base64Decode(secret),
+            rng: List<double>.generate(64, (_) => random.nextDouble()),
+            deferProjection: true,
+            spans: true,
+            sequence: fixnum.Int64(sequence),
+            clock: nomos_protocol.CapturedClock(
+              physicalMillis: fixnum.Int64(now),
+              logical: 0,
+              replica: fixnum.Int64(replica),
+            ),
+          ),
+          controllerLawHash: domainHash,
+          conflictSnapshots: conflictSnapshots,
+          birthCertificate: birthCertificate,
+        ),
+      ),
+    );
+    if (response.hasFailure()) {
+      throw NomosKernelCallFailure(
+        code: response.failure.code,
+        message: response.failure.message,
+      );
+    }
+    if (!response.hasOffer()) {
+      throw StateError(
+        'Kernel returned ${response.whichOutcome().name} for an offer request',
+      );
+    }
+    final offer = response.offer;
+    if (!offer.hasAdmitted()) throw NomosTypedOfferFailure(offer);
+    final admitted = offer.admitted;
+    final birthOutcomes = List<NomosBirthOutcome>.unmodifiable(
+      admitted.birthOutcomes,
+    );
+    final failedBirths = birthOutcomes
+        .where(
+          (birth) =>
+              birth.status != NomosBirthOutcomeStatus.BIRTH_OUTCOME_STATUS_BORN,
+        )
+        .toList(growable: false);
+    if (failedBirths.isNotEmpty) {
+      throw BirthIncomplete(failedBirths, head: admitted.head);
+    }
+    final receipt =
+        _registerOperationReceipt(runtimeSession, admitted.intentId);
+    final born = admitted.born
+        .map((child) => child.workspace)
+        .where((child) => child.isNotEmpty)
+        .toList(growable: false);
+    for (final child in born) {
+      plane._birthReceipts[child] = receipt;
+      final offerPrincipal = actor ?? principal;
+      if (offerPrincipal != null && offerPrincipal.isNotEmpty) {
+        plane._sessionPrincipals[child] = offerPrincipal;
+      }
+      if (secret != null && secret.isNotEmpty) {
+        plane._sessionAuthorSecrets[child] = secret;
+      }
+    }
+    return NomosOfferOutcome(
+      head: admitted.head,
+      intentId: admitted.intentId,
+      receipt: receipt,
+      workspace: workspace,
+      born: born,
+      birthOutcomes: birthOutcomes,
+      created: admitted.created
+          .map(
+            (created) => NomosCreated(
+              type: created.type,
+              id: created.id,
+              workspace: workspace,
+            ),
+          )
+          .toList(growable: false),
+      affected: admitted.affected
+          .map(
+            (affected) => NomosCreated(
+              type: affected.type,
+              id: affected.id,
+              workspace: workspace,
+            ),
+          )
+          .toList(growable: false),
+    );
+  }
+
   /// THE ONE OUTCOME-RETURNING OFFER LANE — [offerDirective] answering the full typed [NomosOfferOutcome]
   /// (head + law-minted `created` NomosRefs + births), for EVERY generated method (create or mutate). A pure
   /// mutation returns `created: []`; a `.creates(...)` plan returns the minted aggregate id(s), each already
@@ -2408,15 +2944,19 @@ class NomosBridge {
           if (session != null) 'session': session,
           if (authorSecret != null) 'authorSecret': authorSecret,
           if (birthCertificate != null)
-            'birthCertificate': birthCertificate.toWire(),
+            'birthCertificateProtobuf':
+                base64Encode(birthCertificate.writeToBuffer()),
         }),
       );
-    } catch (e) {
-      throw await _wrapDomainNotInstalled(
-        e,
-        domain: domain,
-        domainHash: domainHash,
-        requestedWorkspace: session,
+    } catch (e, stack) {
+      Error.throwWithStackTrace(
+        await _wrapDomainNotInstalled(
+          e,
+          domain: domain,
+          domainHash: domainHash,
+          requestedWorkspace: session,
+        ),
+        stack,
       );
     }
     final t1 = DateTime.now().millisecondsSinceEpoch;
@@ -2447,15 +2987,18 @@ class NomosBridge {
     }
     final births = ((r['birthOutcomes'] as List?) ?? const [])
         .whereType<Map>()
-        .map((m) => m.cast<String, Object?>())
-        .toList();
+        .map(_birthOutcomeFromLegacyWire)
+        .toList(growable: false);
     // FAIL FAST on a birth that did NOT come up. The JS holon (index.mjs) already throws on this, so we
     // normally never see it here — but a runner/bundle skew (an older runner that passes birthOutcomes
     // through without throwing) must NOT let a silent partial birth reach the app to strand on head:null.
     // A `status` other than "born" is a failure; throw the typed [BirthIncomplete].
     final failedBirths = births
-        .where((m) => m['status'] != null && m['status'] != 'born')
-        .toList();
+        .where(
+          (birth) =>
+              birth.status != NomosBirthOutcomeStatus.BIRTH_OUTCOME_STATUS_BORN,
+        )
+        .toList(growable: false);
     if (failedBirths.isNotEmpty) {
       throw BirthIncomplete(failedBirths, head: (r['head'] ?? '').toString());
     }
@@ -2468,9 +3011,7 @@ class NomosBridge {
           (e) => (e is Map ? (e['workspace'] ?? '') : e).toString(),
         )
       else
-        ...births
-            .map((m) => (m['workspace'] ?? '').toString())
-            .where((s) => s.isNotEmpty),
+        ...births.map((birth) => birth.workspace).where((s) => s.isNotEmpty),
     ]..removeWhere((s) => s.isEmpty);
     final birthPrincipal = actor ?? principal;
     if (birthPrincipal != null && birthPrincipal.isNotEmpty) {
@@ -2579,11 +3120,21 @@ class NomosBridge {
     String? directiveId,
     required String packageHash,
   }) async {
-    await _call('prepareDomain', {
-      'domain': domain,
-      if (directiveId != null) 'directiveId': directiveId,
-      'packageHash': packageHash,
-    });
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        prepareDomain: nomos_protocol.PrepareDomainRequest(
+          session: _runtimeSession(),
+          domain: domain,
+          packageSha256: packageHash,
+          directive: directiveId,
+        ),
+      ),
+    );
+    if (!response.hasDomainPrepared()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for prepareDomain',
+      );
+    }
   }
 
   /// FOLLOW A [NomosRef] — THE cross-workspace primitive (session_bound_clients.md ask 8): mount
@@ -2748,7 +3299,7 @@ class NomosBridge {
         var resident = false;
         try {
           resident = (await listWorkspaces()).any(
-            (w) => w['workspace']?.toString() == workspace,
+            (candidate) => candidate.workspace == workspace,
           );
         } catch (_) {
           // a pre-connect plane has no registry yet — fall through to the credentials decision below.
@@ -2851,6 +3402,13 @@ class NomosBridge {
     // together. Otherwise home signs correctly after first-device enrolment
     // while a later catalogue/estate opens with the old empty default key.
     final session = _sessionName;
+    if (session != null && authToken != null) {
+      if (authToken.isEmpty) {
+        _eventPlane._sessionAuthTokens.remove(session);
+      } else {
+        _eventPlane._sessionAuthTokens[session] = authToken;
+      }
+    }
     if (session != null && authorSecret != null) {
       if (authorSecret.isEmpty) {
         _eventPlane._sessionAuthorSecrets.remove(session);
@@ -2969,12 +3527,15 @@ class NomosBridge {
           if (authToken != null) 'authToken': authToken,
         }),
       );
-    } catch (e) {
-      throw await _wrapDomainNotInstalled(
-        e,
-        domain: domain,
-        domainHash: domainHash,
-        requestedWorkspace: parent,
+    } catch (e, stack) {
+      Error.throwWithStackTrace(
+        await _wrapDomainNotInstalled(
+          e,
+          domain: domain,
+          domainHash: domainHash,
+          requestedWorkspace: parent,
+        ),
+        stack,
       );
     }
     final verdict = (r['verdict'] as Map?)?.cast<String, Object?>() ?? r;
@@ -3082,20 +3643,30 @@ class NomosBridge {
   /// Framework-private exact-history adoption seam. Generated clients expose this as
   /// `model.adopt()` and, only when prior business outcomes differ, a chained
   /// `decision.accept(reason)`. Candidate identities, heads and receipts stay here.
-  Future<Map<String, Object?>> nomosFrameworkAdoptGeneratedModel({
+  Future<nomos_protocol.ModelLifecycleResponse>
+      nomosFrameworkAdoptGeneratedModel({
     required String domain,
     required String candidateHash,
     String? because,
   }) async {
-    final r = _asMap(
-      await _call('adoptGeneratedModel', {
-        'domain': domain,
-        'candidateHash': candidateHash,
-        if (because != null) 'because': because,
-      }),
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        modelLifecycle: nomos_protocol.ModelLifecycleRequest(
+          session: _runtimeSession(),
+          adopt: nomos_protocol.AdoptGeneratedModelRequest(
+            domain: domain,
+            candidateHash: candidateHash,
+            acceptanceReason: because,
+          ),
+        ),
+      ),
     );
-    return ((r['verdict'] as Map?) ?? const <String, Object?>{})
-        .cast<String, Object?>();
+    if (!response.hasModelLifecycle()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for model adoption',
+      );
+    }
+    return response.modelLifecycle;
   }
 
   /// Framework-private generated-model staging seam. The generated client owns
@@ -3106,30 +3677,54 @@ class NomosBridge {
     required String candidateHash,
     required List<int> lawUsdz,
   }) async {
-    await _call('stageGeneratedModel', {
-      'domain': domain,
-      'candidateHash': candidateHash,
-      'lawUsdz': base64Encode(lawUsdz),
-    });
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        modelLifecycle: nomos_protocol.ModelLifecycleRequest(
+          session: _runtimeSession(),
+          stage: nomos_protocol.StageGeneratedModelRequest(
+            domain: domain,
+            candidateHash: candidateHash,
+            lawUsdz: lawUsdz,
+          ),
+        ),
+      ),
+    );
+    if (!response.hasModelLifecycle() || !response.modelLifecycle.accepted) {
+      throw StateError(
+        response.hasModelLifecycle() && response.modelLifecycle.hasMessage()
+            ? response.modelLifecycle.message
+            : 'Runtime v2 refused generated model staging',
+      );
+    }
   }
 
   /// Framework-private exact-history restoration seam. Generated clients expose
   /// `model.restorePrevious()` and a chained `decision.accept(reason)`; predecessor
   /// identity, derived dispositions, heads and receipts stay below this bridge.
-  Future<Map<String, Object?>> nomosFrameworkRestorePreviousGeneratedModel({
+  Future<nomos_protocol.ModelLifecycleResponse>
+      nomosFrameworkRestorePreviousGeneratedModel({
     required String domain,
     required String currentHash,
     String? because,
   }) async {
-    final r = _asMap(
-      await _call('restorePreviousGeneratedModel', {
-        'domain': domain,
-        'currentHash': currentHash,
-        if (because != null) 'because': because,
-      }),
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        modelLifecycle: nomos_protocol.ModelLifecycleRequest(
+          session: _runtimeSession(),
+          restore: nomos_protocol.RestoreGeneratedModelRequest(
+            domain: domain,
+            currentHash: currentHash,
+            acceptanceReason: because,
+          ),
+        ),
+      ),
     );
-    return ((r['verdict'] as Map?) ?? const <String, Object?>{})
-        .cast<String, Object?>();
+    if (!response.hasModelLifecycle()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for model restoration',
+      );
+    }
+    return response.modelLifecycle;
   }
 
   /// HISTORY of one aggregate (a todo) — the full action timeline from the ledger: every intent that touched
@@ -3202,23 +3797,23 @@ class NomosBridge {
       _asMap(await _call('mintDeviceKey'));
 
   /// VA ROOT-OF-TRUST: sign a BirthCert through the kernel `cert_sign` op (the SINGLE source of the cert
-  /// byte-layout — no Dart copy). `fields` = `{child, founder, verified, parentKey (this device's base64
-  /// ed25519 PUBLIC half), parentId, epoch}`; `deviceSecret` is that key's base64 SECRET half, handed to the
-  /// LOCAL kernel only (it never reaches a server). Returns typed authority evidence suitable for an offer.
+  /// byte-layout — no Dart copy). [spec] is the generated certificate message with an empty signature;
+  /// `deviceSecret` is the base64 secret half, handed to the LOCAL kernel only (it never reaches a server).
+  /// Returns the same generated type with its signature populated, suitable for an offer.
   Future<NomosBirthCertificate> signBirthCert(
     NomosBirthCertificateSpec spec,
     String deviceSecret,
-  ) async =>
-      NomosBirthCertificate.fromWire(
-        _asMap(
-          _asMap(
-            await _call('signBirthCert', {
-              'fields': spec.toWire(),
-              'deviceSecret': deviceSecret,
-            }),
-          )['cert'],
-        ),
-      );
+  ) async {
+    final result = _asMap(
+      await _call('signBirthCert', {
+        'certificateProtobuf': base64Encode(spec.writeToBuffer()),
+        'deviceSecret': deviceSecret,
+      }),
+    );
+    return nomos_protocol.BirthCertificate.fromBuffer(
+      base64Decode(result['certificateProtobuf']?.toString() ?? ''),
+    );
+  }
 
   /// MINT THE KEYLESS ENROLL-ONCE DELEGATION (`enrollFirstDevice.delegationCert`, the verified-first-device
   /// lane). The device SELF-signs it; its authority is the carried `idpToken` (the kernel re-verifies that to
@@ -3226,17 +3821,20 @@ class NomosBridge {
   /// `{user, deviceKey, childName, parentId, verifiedVia, idpToken, capturedClock, epoch}`. WITHOUT this the
   /// keyless home is born with a malformed cert chain (the platform_cert falls into the delegation slot →
   /// `home cert founder != delegation cert founder` at the home's own verify door).
-  Future<Map<String, Object?>> mintKeylessDelegation(
+  Future<NomosBirthCertificate> mintKeylessDelegation(
     Map<String, Object?> spec,
     String deviceSecret,
-  ) async =>
-      _asMap(
-        await _call('mintKeylessDelegation', {
-          'spec': spec,
-          'deviceSecret': deviceSecret,
-        }),
-      )['cert'] as Map<String, Object?>? ??
-      const {};
+  ) async {
+    final result = _asMap(
+      await _call('mintKeylessDelegation', {
+        'spec': spec,
+        'deviceSecret': deviceSecret,
+      }),
+    );
+    return nomos_protocol.BirthCertificate.fromBuffer(
+      base64Decode(result['certificateProtobuf']?.toString() ?? ''),
+    );
+  }
 
   /// ENROLL THIS DEVICE — the LIVE gate: bind a device key's PUBLIC half to `principal` on-chain as a
   /// `signer` so the holon's gate can PROVE this device's authorship on replay (and the VA chain attest it).
@@ -3361,10 +3959,62 @@ class NomosBridge {
 
   /// Framework-private receiving-group setup. Generated application hosts own this ceremony; tenant code
   /// receives only the resulting business application.
-  Future<Map<String, Object?>> nomosInternalBirthReceivingGroup(
-    Map<String, Object?> spec,
-  ) async =>
-      _asMap(await _call('nomosInternalBirthReceivingGroup', spec));
+  Future<nomos_protocol.ApplicationCustodyEstablished>
+      nomosInternalBirthReceivingGroup({
+    required String parent,
+    required String principal,
+    required String subject,
+    required Map<String, Object?> device,
+    required String authToken,
+    required String idToken,
+    required String verifiedVia,
+    required String bornAt,
+    required NmsGeneratedCall enrollFirstDeviceCall,
+    required NmsGeneratedCall birthReceivingGroupCall,
+    bool confirm = true,
+  }) async {
+    final secret = device['secret'];
+    final public = device['public'];
+    if (secret is! String || public is! String) {
+      throw ArgumentError(
+        'application custody requires a generated device keypair',
+      );
+    }
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        establishApplicationCustody:
+            nomos_protocol.EstablishApplicationCustodyRequest(
+          session: _runtimeSession(),
+          parent: parent,
+          principal: principal,
+          subject: subject,
+          deviceSecret: base64Decode(secret),
+          devicePublic: base64Decode(public),
+          authToken: authToken,
+          idToken: idToken,
+          verifiedVia: verifiedVia,
+          bornAt: bornAt,
+          enrollFirstDevice: nomos_protocol.DirectiveCall(
+            domain: enrollFirstDeviceCall.domain,
+            directive: enrollFirstDeviceCall.directive,
+            callUsda: enrollFirstDeviceCall.canonicalUsda,
+          ),
+          birthReceivingGroup: nomos_protocol.DirectiveCall(
+            domain: birthReceivingGroupCall.domain,
+            directive: birthReceivingGroupCall.directive,
+            callUsda: birthReceivingGroupCall.canonicalUsda,
+          ),
+          confirm: confirm,
+        ),
+      ),
+    );
+    if (!response.hasApplicationCustodyEstablished()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for application custody',
+      );
+    }
+    return response.applicationCustodyEstablished;
+  }
 
   /// Sign a cross-custody SHARE attestation `{secret, asserterWorkspace, object, relation, subject,
   /// attestedAt}` → `{publicKey, signature}`. This is what drives `recordShare` into an invitee's home
@@ -3404,63 +4054,565 @@ class NomosBridge {
         }),
       );
 
-  /// A declared query's rows from the local projection. `keys` (E2E sealing) injects the reader's held
-  /// scope keys so encrypted fields AEAD-open in-wasm; absent ⇒ they stay opaque envelopes (today's
-  /// behavior). `principal` stamps the private-read gate (defaults to the connection's bound principal).
-  /// Both are OMITTED from the wire when absent, so a public un-keyed read is byte-identical to before.
-  Future<List<Map<String, dynamic>>> query(
-    String queryId, [
-    Map<String, Object?> params = const {},
+  nomos_protocol.QueryAuthority _nmsQueryAuthority(
     List<NomosScopeKey>? keys,
     String? principal,
     String? session,
-  ]) async {
-    return _asRows(
-      await _call('query', {
-        'queryId': queryId,
-        'params': params,
-        ...?_readAuthArgs(keys, principal),
-        if (session != null) 'session': session,
-      }),
+  ) {
+    final runtimeSession = session ?? _sessionName;
+    if (runtimeSession == null || runtimeSession.isEmpty) {
+      throw StateError(
+          'A nominal query must be bound to a connected NomosSession');
+    }
+    final plane = _eventPlane;
+    final token = plane._sessionAuthTokens[runtimeSession];
+    final secret = plane._sessionAuthorSecrets[runtimeSession];
+    return nomos_protocol.QueryAuthority(
+      principalClaim:
+          principal ?? plane._sessionPrincipals[runtimeSession] ?? '',
+      authToken: token == null ? const <int>[] : utf8.encode(token),
+      nowUnix: fixnum.Int64(
+        DateTime.now().millisecondsSinceEpoch ~/ 1000,
+      ),
+      authorSecret: secret == null ? const <int>[] : base64Decode(secret),
+      keys: (keys ?? const <NomosScopeKey>[]).map(
+        (key) => nomos_protocol.InjectedKey(
+          scope: key.scope,
+          epoch: fixnum.Int64(key.epoch),
+          key: base64Decode(key.key),
+        ),
+      ),
     );
   }
 
-  /// One bounded query page. Unlike [query], this never requires the kernel to materialize or serialize
-  /// the complete result set merely to show the first screen.
-  Future<NomosPage<Map<String, dynamic>>> queryPage(
-    String queryId, {
-    Map<String, Object?> params = const {},
-    int pageSize = 100,
-    String? cursor,
-    List<NomosScopeKey>? keys,
-    String? principal,
-    String? session,
+  Future<Uint8List> _nmsKernelQueryUsda({
+    required String? session,
+    required nomos_protocol.QueryAuthority authority,
+    required nomos_protocol.QueryRequest query,
   }) async {
-    if (pageSize < 1 || pageSize > 1000) {
-      throw RangeError.range(pageSize, 1, 1000, 'pageSize');
-    }
-    final result = _asMap(
-      await _call('queryPage', {
-        'queryId': queryId,
-        'params': params,
-        'pageSize': pageSize,
-        if (cursor != null) 'cursor': cursor,
-        ...?_readAuthArgs(keys, principal),
-        if (session != null) 'session': session,
-      }),
-    );
-    return NomosPage<Map<String, dynamic>>(
-      rows: _asRows(result),
-      cursor: result['cursor'] as String?,
-      done: result['done'] == true,
+    final response = await _nmsKernelQuery(
+      session: session,
+      authority: authority,
+      query: query,
     );
+    if (!response.hasResultUsda()) {
+      throw StateError(
+        'Kernel returned ${response.whichResult().name} without a nominal USDA query result',
+      );
+    }
+    return Uint8List.fromList(response.resultUsda);
   }
 
-  /// A single aggregate by id (the by-id read). `keys`/`principal`: see [query].
-  Future<List<Map<String, dynamic>>> queryById(
-    String id, [
-    List<NomosScopeKey>? keys,
-    String? principal,
+  Future<nomos_protocol.QueryResponse> _nmsKernelQuery({
+    required String? session,
+    required nomos_protocol.QueryAuthority authority,
+    required nomos_protocol.QueryRequest query,
+  }) async {
+    final runtimeSession = session ?? _sessionName;
+    if (runtimeSession == null || runtimeSession.isEmpty) {
+      throw StateError(
+          'A nominal query must be bound to a connected NomosSession');
+    }
+    final workspace =
+        _eventPlane._workspaceBySession[runtimeSession] ?? runtimeSession;
+    final transport = _transport;
+    if (transport is! NomosKernelCallTransport) {
+      throw UnsupportedError(
+        'This host does not implement the generated Runtime v2 protobuf lane',
+      );
+    }
+    query
+      ..target = nomos_protocol.WorkspaceTarget(
+        repo: '/work/ws/$runtimeSession',
+        workspace: workspace,
+        branch: 'main',
+      )
+      ..authority = authority
+      ..spans = true
+      ..resultFormat =
+          nomos_protocol.QueryResultFormat.QUERY_RESULT_FORMAT_NOMINAL_USDA;
+    final requestNumber = ++_seq;
+    final response = await (transport as NomosKernelCallTransport).callKernel(
+      session: runtimeSession,
+      request: nomos_protocol.CallRequest(
+        protocolVersion: 1,
+        requestId: '$runtimeSession:query:$requestNumber',
+        query: query,
+      ),
+    );
+    if (response.hasFailure()) {
+      throw StateError('${response.failure.code}: ${response.failure.message}');
+    }
+    if (!response.hasQuery()) {
+      throw StateError(
+        'Kernel returned ${response.whichOutcome().name} without a query result',
+      );
+    }
+    return response.query;
+  }
+
+  NomosProviderTokenVerification _providerTokenVerification(
+    nomos_protocol.ProviderTokenVerificationStatus status,
+  ) =>
+      switch (status) {
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_VALID =>
+          NomosProviderTokenVerification.valid,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_NO_MATCHING_KEY =>
+          NomosProviderTokenVerification.noMatchingKey,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_EXPIRED =>
+          NomosProviderTokenVerification.expired,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_NOT_YET_VALID =>
+          NomosProviderTokenVerification.notYetValid,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_ISSUER_MISMATCH =>
+          NomosProviderTokenVerification.issuerMismatch,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_AUDIENCE_MISMATCH =>
+          NomosProviderTokenVerification.audienceMismatch,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_BAD_SIGNATURE =>
+          NomosProviderTokenVerification.badSignature,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_MALFORMED =>
+          NomosProviderTokenVerification.malformed,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_UNSUPPORTED_ALGORITHM =>
+          NomosProviderTokenVerification.unsupportedAlgorithm,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_BAD_KEY =>
+          NomosProviderTokenVerification.badKey,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_MISSING_SUBJECT =>
+          NomosProviderTokenVerification.missingSubject,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_NO_VERIFIER =>
+          NomosProviderTokenVerification.noVerifier,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_MISSING_TOKEN =>
+          NomosProviderTokenVerification.missingToken,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_UNSPECIFIED =>
+          NomosProviderTokenVerification.unspecified,
+        _ => NomosProviderTokenVerification.unspecified,
+      };
+
+  /// Ask the kernel—not the host—to verify the session's current provider
+  /// token and enrolled-device relation against the workspace's current law.
+  @internal
+  Future<NomosAuthenticationPosture> nmsAuthenticationPosture({
+    String? session,
+    String? principal,
+  }) async {
+    final response = await _nmsKernelQuery(
+      session: session,
+      authority: _nmsQueryAuthority(null, principal, session),
+      query: nomos_protocol.QueryRequest(
+        authenticationPosture: nomos_protocol.AuthenticationPostureQuery(),
+      ),
+    );
+    if (!response.hasAuthenticationPosture()) {
+      throw StateError(
+        'Kernel returned ${response.whichResult().name}, expected authenticationPosture',
+      );
+    }
+    final posture = response.authenticationPosture;
+    return NomosAuthenticationPosture(
+      providerToken: _providerTokenVerification(posture.providerToken),
+      enrolledDevice: posture.enrolledDevice,
+      resolvedPrincipal: posture.resolvedPrincipal,
+    );
+  }
+
+  /// Drive actual custody synchronization until the kernel proves that the
+  /// provider token verifies, the device remains enrolled, and the resolved
+  /// principal is the session principal. No timer or receipt is treated as the
+  /// business postcondition.
+  @internal
+  Future<NomosAuthenticationPosture> nmsAwaitAuthenticationReady({
+    String? session,
+    String? principal,
+    int maximumSyncRounds = 4,
+  }) async {
+    final runtimeSession = session ?? _sessionName;
+    final expectedPrincipal = principal ??
+        this.principal ??
+        (runtimeSession == null
+            ? null
+            : _eventPlane._sessionPrincipals[runtimeSession]) ??
+        '';
+    var posture = await nmsAuthenticationPosture(
+      session: session,
+      principal: expectedPrincipal,
+    );
+    if (posture.isReadyFor(expectedPrincipal)) return posture;
+
+    for (var round = 0; round < maximumSyncRounds; round++) {
+      final result = await sync(admit: true, session: session);
+      if (result.offline || result.pushFailed) {
+        throw StateError(
+          'Authentication recovery could not converge custody: '
+          '${result.hasPushError() ? result.pushError.message : 'workspace is offline'}',
+        );
+      }
+      posture = await nmsAuthenticationPosture(
+        session: session,
+        principal: expectedPrincipal,
+      );
+      if (posture.isReadyFor(expectedPrincipal)) return posture;
+    }
+    throw StateError(
+      'Authentication recovery did not establish a valid provider token and enrolled device '
+      'for $expectedPrincipal after $maximumSyncRounds custody rounds '
+      '(token: ${posture.providerToken.name}, enrolled: ${posture.enrolledDevice}, '
+      'resolved: ${posture.resolvedPrincipal})',
+    );
+  }
+
+  Future<nomos_protocol.QueryResponse> _nmsKernelHistoricQuery({
+    required NomosMoment moment,
+    required String? session,
+    required nomos_protocol.QueryAuthority authority,
+    required nomos_protocol.QueryRequest query,
+  }) async {
+    final runtimeSession = session ?? _sessionName;
+    if (runtimeSession == null || runtimeSession.isEmpty) {
+      throw StateError(
+          'A nominal historic query must be bound to a connected NomosSession');
+    }
+    final workspace =
+        _eventPlane._workspaceBySession[runtimeSession] ?? runtimeSession;
+    query
+      ..target = nomos_protocol.WorkspaceTarget(
+        repo: '/work/ws/$runtimeSession',
+        workspace: workspace,
+        branch: 'main',
+      )
+      ..authority = authority
+      ..spans = true
+      ..resultFormat =
+          nomos_protocol.QueryResultFormat.QUERY_RESULT_FORMAT_NOMINAL_USDA;
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        historicQuery: nomos_protocol.HistoricQueryRequest(
+          session: runtimeSession,
+          moment: moment.id,
+          query: query,
+        ),
+      ),
+    );
+    if (response.hasFailure()) {
+      throw StateError('${response.failure.code}: ${response.failure.message}');
+    }
+    if (!response.hasKernelCall()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for a historic query',
+      );
+    }
+    final kernel = response.kernelCall;
+    if (kernel.hasFailure()) {
+      throw StateError('${kernel.failure.code}: ${kernel.failure.message}');
+    }
+    if (!kernel.hasQuery()) {
+      throw StateError(
+        'Kernel returned ${kernel.whichOutcome().name} without a historic query result',
+      );
+    }
+    return kernel.query;
+  }
+
+  Future<Uint8List> _nmsKernelHistoricQueryUsda({
+    required NomosMoment moment,
+    required String? session,
+    required nomos_protocol.QueryAuthority authority,
+    required nomos_protocol.QueryRequest query,
+  }) async {
+    final response = await _nmsKernelHistoricQuery(
+      moment: moment,
+      session: session,
+      authority: authority,
+      query: query,
+    );
+    if (!response.hasResultUsda()) {
+      throw StateError(
+        'Kernel returned ${response.whichResult().name} without a nominal historic USDA result',
+      );
+    }
+    return Uint8List.fromList(response.resultUsda);
+  }
+
+  /// A declared query's rows from the local projection. `keys` (E2E sealing) injects the reader's held
+  /// scope keys so encrypted fields AEAD-open in-wasm; absent ⇒ they stay opaque envelopes (today's
+  /// behavior). `principal` stamps the private-read gate (defaults to the connection's bound principal).
+  /// Both are OMITTED from the wire when absent, so a public un-keyed read is byte-identical to before.
+  Future<List<Map<String, dynamic>>> query(
+    String queryId, [
+    Map<String, Object?> params = const {},
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+  ]) async {
+    return _asRows(
+      await _call('query', {
+        'queryId': queryId,
+        'params': params,
+        ...?_readAuthArgs(keys, principal),
+        if (session != null) 'session': session,
+      }),
+    );
+  }
+
+  /// Framework-private tenant read lane. The command crosses the resident host
+  /// as one generated Runtime v2/Kernel v1 protobuf frame and the domain result
+  /// returns as canonical USDA bytes for the generated domain decoder.
+  Future<Uint8List> nmsQueryUsda(
+    NmsGeneratedQuery query, [
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+  ]) =>
+      _nmsKernelQueryUsda(
+        session: session,
+        authority: _nmsQueryAuthority(keys, principal, session),
+        query: nomos_protocol.QueryRequest(
+          rows: nomos_protocol.RowsQuery(
+            id: query.query,
+            principal: principal ?? '',
+            argumentsUsda: query.canonicalArgumentsUsda,
+          ),
+        ),
+      );
+
+  /// The same generated declared query at one authenticated historic moment.
+  /// Runtime v2 pins custody; the kernel still owns query semantics and emits
+  /// the same nominal USDA result schema as the live read.
+  Future<Uint8List> nmsQueryAtUsda(
+    NomosMoment moment,
+    NmsGeneratedQuery query, [
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+  ]) =>
+      _nmsKernelHistoricQueryUsda(
+        moment: moment,
+        session: session,
+        authority: _nmsQueryAuthority(keys, principal, session),
+        query: nomos_protocol.QueryRequest(
+          rows: nomos_protocol.RowsQuery(
+            id: query.query,
+            principal: principal ?? '',
+            argumentsUsda: query.canonicalArgumentsUsda,
+          ),
+        ),
+      );
+
+  /// Reactive form of [nmsQueryUsda]. Subscription mechanics are Runtime v2
+  /// protobuf; each emission is the kernel's nominal USDA result and is decoded
+  /// only by the generated domain client which owns [query].
+  Stream<Uint8List> nmsWatchUsda(
+    NmsGeneratedQuery query, {
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+    int intervalMs = 2000,
+  }) =>
+      _nmsWatchQueryUsda(
+        nomos_protocol.QueryRequest(
+          rows: nomos_protocol.RowsQuery(
+            id: query.query,
+            principal: principal ?? '',
+            argumentsUsda: query.canonicalArgumentsUsda,
+          ),
+        ),
+        keys: keys,
+        principal: principal,
+        session: session,
+        intervalMs: intervalMs,
+      );
+
+  /// Reactive by-id read. The generated domain decoder supplies the nominal
+  /// aggregate type; this framework method owns only the protobuf mechanics.
+  Stream<Uint8List> nmsWatchByIdUsda(
+    String aggregateType,
+    String id, {
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+    int intervalMs = 2000,
+  }) =>
+      _nmsWatchQueryUsda(
+        nomos_protocol.QueryRequest(
+          byId: nomos_protocol.ByIdQuery(
+            aggregateType: aggregateType,
+            aggregateId: id,
+            principal: principal ?? '',
+          ),
+        ),
+        keys: keys,
+        principal: principal,
+        session: session,
+        intervalMs: intervalMs,
+      );
+
+  /// Reactive type-index read. The aggregate type is a dedicated protobuf
+  /// field, never a magic application query name or argument bag.
+  Stream<Uint8List> nmsWatchByTypeUsda(
+    String aggregateType, {
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+    int intervalMs = 2000,
+  }) =>
+      _nmsWatchQueryUsda(
+        nomos_protocol.QueryRequest(
+          byType: nomos_protocol.ByTypeQuery(
+            aggregateType: aggregateType,
+            principal: principal ?? '',
+          ),
+        ),
+        keys: keys,
+        principal: principal,
+        session: session,
+        intervalMs: intervalMs,
+      );
+
+  Stream<Uint8List> _nmsWatchQueryUsda(
+    nomos_protocol.QueryRequest request, {
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+    int intervalMs = 2000,
+  }) {
+    final runtimeSession = session ?? _sessionName;
+    if (runtimeSession == null || runtimeSession.isEmpty) {
+      throw StateError(
+          'A nominal watch must be bound to a connected NomosSession');
+    }
+    final transport = _transport;
+    if (transport is! NomosRuntimeV2EventTransport) {
+      throw UnsupportedError(
+          'This host does not implement Runtime v2 event frames');
+    }
+    final plane = _eventPlane;
+    final workspace =
+        plane._workspaceBySession[runtimeSession] ?? runtimeSession;
+    final subscriptionId = '$runtimeSession:watch:${++plane._seq}';
+    late final StreamController<Uint8List> controller;
+    controller = StreamController<Uint8List>.broadcast(
+      onCancel: () async {
+        plane._nominalWatchControllers.remove(subscriptionId);
+        try {
+          await _unwatch(subscriptionId);
+        } finally {
+          if (!controller.isClosed) await controller.close();
+        }
+      },
+    );
+    plane._nominalWatchControllers[subscriptionId] = controller;
+    request
+      ..target = nomos_protocol.WorkspaceTarget(
+        repo: '/work/ws/$runtimeSession',
+        workspace: workspace,
+        branch: 'main',
+      )
+      ..authority = _nmsQueryAuthority(keys, principal, runtimeSession)
+      ..spans = true
+      ..resultFormat =
+          nomos_protocol.QueryResultFormat.QUERY_RESULT_FORMAT_NOMINAL_USDA;
+    unawaited(() async {
+      try {
+        final response = await _invokeRuntimeV2(
+          nomos_protocol.RuntimeRequest(
+            watch: nomos_protocol.WatchRequest(
+              session: runtimeSession,
+              subscriptionId: subscriptionId,
+              kind: nomos_protocol.WatchKind.WATCH_KIND_QUERY,
+              query: request,
+              intervalMillis: intervalMs,
+            ),
+          ),
+        );
+        if (!response.hasWatchStarted() ||
+            response.watchStarted.subscriptionId != subscriptionId) {
+          throw StateError(
+            'Runtime v2 returned ${response.whichOutcome().name} for nominal watch',
+          );
+        }
+      } catch (error, stackTrace) {
+        plane._nominalWatchControllers.remove(subscriptionId);
+        if (!controller.isClosed) controller.addError(error, stackTrace);
+      }
+    }());
+    return controller.stream;
+  }
+
+  /// One bounded query page. Unlike [query], this never requires the kernel to materialize or serialize
+  /// the complete result set merely to show the first screen.
+  Future<NomosPage<Map<String, dynamic>>> queryPage(
+    String queryId, {
+    Map<String, Object?> params = const {},
+    int pageSize = 100,
+    String? cursor,
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+  }) async {
+    if (pageSize < 1 || pageSize > 1000) {
+      throw RangeError.range(pageSize, 1, 1000, 'pageSize');
+    }
+    final result = _asMap(
+      await _call('queryPage', {
+        'queryId': queryId,
+        'params': params,
+        'pageSize': pageSize,
+        if (cursor != null) 'cursor': cursor,
+        ...?_readAuthArgs(keys, principal),
+        if (session != null) 'session': session,
+      }),
+    );
+    return NomosPage<Map<String, dynamic>>(
+      rows: _asRows(result),
+      cursor: result['cursor'] as String?,
+      done: result['done'] == true,
+    );
+  }
+
+  /// Framework-private bounded form of [nmsQueryUsda]. Page metadata lives in
+  /// the same USDA result; no object envelope is reconstructed in the host.
+  Future<Uint8List> nmsQueryPageUsda(
+    NmsGeneratedQuery query, {
+    int pageSize = 100,
+    String? cursor,
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+  }) {
+    if (pageSize < 1 || pageSize > 1000) {
+      throw RangeError.range(pageSize, 1, 1000, 'pageSize');
+    }
+    return _nmsKernelQueryUsda(
+      session: session,
+      authority: _nmsQueryAuthority(keys, principal, session),
+      query: nomos_protocol.QueryRequest(
+        page: nomos_protocol.PageQuery(
+          id: query.query,
+          limit: pageSize,
+          after: cursor ?? '',
+          principal: principal ?? '',
+          argumentsUsda: query.canonicalArgumentsUsda,
+        ),
+      ),
+    );
+  }
+
+  /// A single aggregate by id (the by-id read). `keys`/`principal`: see [query].
+  Future<List<Map<String, dynamic>>> queryById(
+    String id, [
+    List<NomosScopeKey>? keys,
+    String? principal,
     String? session,
   ]) async =>
       _asRows(
@@ -3471,6 +4623,201 @@ class NomosBridge {
         }),
       );
 
+  /// Framework-private by-id form of [nmsQueryUsda].
+  Future<Uint8List> nmsQueryByIdUsda(
+    String aggregateType,
+    String id, [
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+  ]) =>
+      _nmsKernelQueryUsda(
+        session: session,
+        authority: _nmsQueryAuthority(keys, principal, session),
+        query: nomos_protocol.QueryRequest(
+          byId: nomos_protocol.ByIdQuery(
+            aggregateType: aggregateType,
+            aggregateId: id,
+            principal: principal ?? '',
+          ),
+        ),
+      );
+
+  Future<Uint8List> nmsQueryByIdAtUsda(
+    NomosMoment moment,
+    String aggregateType,
+    String id, [
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+  ]) =>
+      _nmsKernelHistoricQueryUsda(
+        moment: moment,
+        session: session,
+        authority: _nmsQueryAuthority(keys, principal, session),
+        query: nomos_protocol.QueryRequest(
+          byId: nomos_protocol.ByIdQuery(
+            aggregateType: aggregateType,
+            aggregateId: id,
+            principal: principal ?? '',
+          ),
+        ),
+      );
+
+  /// Framework-private type-index read. Aggregate type is a fixed protobuf field, not a fake
+  /// application query argument.
+  Future<Uint8List> nmsQueryByTypeUsda(
+    String aggregateType, [
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+  ]) =>
+      _nmsKernelQueryUsda(
+        session: session,
+        authority: _nmsQueryAuthority(keys, principal, session),
+        query: nomos_protocol.QueryRequest(
+          byType: nomos_protocol.ByTypeQuery(
+            aggregateType: aggregateType,
+            principal: principal ?? '',
+          ),
+        ),
+      );
+
+  Future<Uint8List> nmsQueryByTypeAtUsda(
+    NomosMoment moment,
+    String aggregateType, [
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+  ]) =>
+      _nmsKernelHistoricQueryUsda(
+        moment: moment,
+        session: session,
+        authority: _nmsQueryAuthority(keys, principal, session),
+        query: nomos_protocol.QueryRequest(
+          byType: nomos_protocol.ByTypeQuery(
+            aggregateType: aggregateType,
+            principal: principal ?? '',
+          ),
+        ),
+      );
+
+  /// Exact spatial-index read for generated domain clients. [spatialId] is
+  /// generated from the installed DSL graph; the application supplies only
+  /// the typed [bbox]. Rows remain canonical USDA until its generated decoder.
+  Future<Uint8List> nmsSpatialWithinUsda(
+    String spatialId,
+    NomosBbox bbox, [
+    String? session,
+  ]) =>
+      _nmsKernelQueryUsda(
+        session: session,
+        authority: _nmsQueryAuthority(null, null, session),
+        query: nomos_protocol.QueryRequest(
+          spatial: nomos_protocol.SpatialQuery(
+            id: spatialId,
+            minX: bbox.minX,
+            minY: bbox.minY,
+            maxX: bbox.maxX,
+            maxY: bbox.maxY,
+          ),
+        ),
+      );
+
+  /// Reactive counterpart of [nmsSpatialWithinUsda]. Runtime v2 owns the
+  /// subscription; every value is still the kernel's canonical USDA image.
+  Stream<Uint8List> nmsWatchSpatialUsda(
+    String spatialId,
+    NomosBbox bbox, {
+    String? session,
+    int intervalMs = 2000,
+  }) =>
+      _nmsWatchQueryUsda(
+        nomos_protocol.QueryRequest(
+          spatial: nomos_protocol.SpatialQuery(
+            id: spatialId,
+            minX: bbox.minX,
+            minY: bbox.minY,
+            maxX: bbox.maxX,
+            maxY: bbox.maxY,
+          ),
+        ),
+        session: session,
+        intervalMs: intervalMs,
+      );
+
+  Future<int> _nmsTally(
+    String id,
+    String? groupKey, {
+    required bool sum,
+    String? session,
+    NomosMoment? moment,
+  }) async {
+    final tally = nomos_protocol.TallyQuery(
+      id: id,
+      groupKey: groupKey,
+    );
+    final query = nomos_protocol.QueryRequest();
+    if (sum) {
+      query.sum = tally;
+    } else {
+      query.count = tally;
+    }
+    final authority = _nmsQueryAuthority(null, null, session);
+    final result = moment == null
+        ? await _nmsKernelQuery(
+            session: session,
+            authority: authority,
+            query: query,
+          )
+        : await _nmsKernelHistoricQuery(
+            moment: moment,
+            session: session,
+            authority: authority,
+            query: query,
+          );
+    if (!result.hasIntegerValue()) {
+      throw StateError(
+        'Kernel returned ${result.whichResult().name} without an exact integer tally',
+      );
+    }
+    return result.integerValue.toInt();
+  }
+
+  Future<int> nmsCount(String countId, [String? groupKey, String? session]) =>
+      _nmsTally(countId, groupKey, sum: false, session: session);
+
+  Future<int> nmsCountAt(
+    NomosMoment moment,
+    String countId, [
+    String? groupKey,
+    String? session,
+  ]) =>
+      _nmsTally(
+        countId,
+        groupKey,
+        sum: false,
+        session: session,
+        moment: moment,
+      );
+
+  Future<int> nmsSum(String sumId, [String? groupKey, String? session]) =>
+      _nmsTally(sumId, groupKey, sum: true, session: session);
+
+  Future<int> nmsSumAt(
+    NomosMoment moment,
+    String sumId, [
+    String? groupKey,
+    String? session,
+  ]) =>
+      _nmsTally(
+        sumId,
+        groupKey,
+        sum: true,
+        session: session,
+        moment: moment,
+      );
+
   /// Compare an immutable publication pin with the stable series' one compiled
   /// current pointer. This is an O(current-state) check: it neither resolves the
   /// pinned publication nor reconstructs aggregate history.
@@ -3562,39 +4909,6 @@ class NomosBridge {
         }),
       );
 
-  /// Maintained historic count/sum values at [moment]. These are the temporal counterparts of [count]/[sum].
-  Future<int> countAt(
-    NomosMoment moment,
-    String countId, [
-    String group = '',
-    String? session,
-  ]) async =>
-      ((_asMap(
-        await _call('countAt', {
-          'commit': moment.id,
-          'countId': countId,
-          'group': group,
-          if (session != null) 'session': session,
-        }),
-      )['count']) as num)
-          .toInt();
-
-  Future<int> sumAt(
-    NomosMoment moment,
-    String sumId, [
-    String group = '',
-    String? session,
-  ]) async =>
-      ((_asMap(
-        await _call('sumAt', {
-          'commit': moment.id,
-          'sumId': sumId,
-          'group': group,
-          if (session != null) 'session': session,
-        }),
-      )['sum']) as num)
-          .toInt();
-
   /// The read auth sidecar (private reads + E2E): `keys`/`principal` as top-level call args, or null when
   /// neither is present (so the wire is byte-identical to before this existed).
   Map<String, Object?>? _readAuthArgs(
@@ -3657,7 +4971,9 @@ class NomosBridge {
       epoch: (out['epoch'] as num?)?.toInt() ?? 0,
       key: (out['key'] ?? '').toString(),
       ownedKeySubject: out['ownedKeySubject']?.toString(),
-      ownedCustody: out['ownedCustody']?.toString(),
+      ownedCustody: out['ownedCustody'] == null
+          ? null
+          : _nomosOwnedCustodyFromTransport(out['ownedCustody']),
     );
   }
 
@@ -3682,7 +4998,9 @@ class NomosBridge {
             epoch: (key['epoch'] as num?)?.toInt() ?? 0,
             key: (key['key'] ?? '').toString(),
             ownedKeySubject: key['ownedKeySubject']?.toString(),
-            ownedCustody: key['ownedCustody']?.toString(),
+            ownedCustody: key['ownedCustody'] == null
+                ? null
+                : _nomosOwnedCustodyFromTransport(key['ownedCustody']),
           ),
         )
         .toList();
@@ -3719,23 +5037,95 @@ class NomosBridge {
       );
 
   /// Prepare the private framework payload behind generated share/unshare/transfer methods.
-  Future<Map<String, Object?>> nomosPrepareOwnedRecordAction<TAggregate>({
+  Future<NomosOwnedRecordPreparation>
+      nomosPrepareOwnedRecordAction<TAggregate>({
     required String action,
     required String scope,
     required NomosRef<TAggregate> record,
     required String peer,
-  }) async =>
-      _asMap(
-        await _call('cryptoOwnedPrepareRecordAction', {
-          'action': action,
-          'scope': scope,
-          'record': {
-            'type': NmsInternalNomosRefs.type(record),
-            'id': NmsInternalNomosRefs.id(record),
-          },
-          'peer': peer,
-        }),
-      );
+  }) async {
+    final value = _asMap(
+      await _call('cryptoOwnedPrepareRecordAction', {
+        'action': action,
+        'scope': scope,
+        'record': {
+          'type': NmsInternalNomosRefs.type(record),
+          'id': NmsInternalNomosRefs.id(record),
+        },
+        'peer': peer,
+      }),
+    );
+    final ownedKeySubject = _nomosOwnedRequiredString(
+      value,
+      '__nomos_owned_device_key_subject_7c1f5e',
+    );
+    final ownedCustodyRaw = value['__nomos_owned_device_custody_7c1f5e'];
+    final ownedCustody = ownedCustodyRaw == null
+        ? null
+        : _nomosOwnedCustodyFromTransport(ownedCustodyRaw);
+    switch (action) {
+      case 'share':
+        final wraps = value['wraps'];
+        if (wraps is! List) {
+          throw const FormatException(
+            'Nomos share preparation is missing its wraps',
+          );
+        }
+        return NomosOwnedSharePreparation(
+          ownedKeySubject: ownedKeySubject,
+          ownedCustody: ownedCustody,
+          recordId: _nomosOwnedRequiredString(value, 'recordId'),
+          peer: _nomosOwnedRequiredString(value, 'peer'),
+          epoch: _nomosOwnedRequiredInt(value, 'epoch'),
+          sharedAt: _nomosOwnedRequiredString(value, 'sharedAt'),
+          wraps: wraps
+              .map(_asMap)
+              .map(NomosHistoricOwnedWrapPreparation.fromTransport)
+              .toList(growable: false),
+        );
+      case 'unshare':
+        final wraps = value['wraps'];
+        if (wraps is! List) {
+          throw const FormatException(
+            'Nomos unshare preparation is missing its wraps',
+          );
+        }
+        return NomosOwnedUnsharePreparation(
+          ownedKeySubject: ownedKeySubject,
+          ownedCustody: ownedCustody,
+          recordId: _nomosOwnedRequiredString(value, 'recordId'),
+          peer: _nomosOwnedRequiredString(value, 'peer'),
+          epoch: _nomosOwnedRequiredInt(value, 'epoch'),
+          changedAt: _nomosOwnedRequiredString(value, 'changedAt'),
+          wraps: wraps
+              .map(_asMap)
+              .map(NomosOwnedWrapPreparation.fromTransport)
+              .toList(growable: false),
+        );
+      case 'transfer':
+        final wraps = value['historicWraps'];
+        if (wraps is! List) {
+          throw const FormatException(
+            'Nomos transfer preparation is missing its historic wraps',
+          );
+        }
+        return NomosOwnedTransferPreparation(
+          ownedKeySubject: ownedKeySubject,
+          ownedCustody: ownedCustody,
+          recordId: _nomosOwnedRequiredString(value, 'recordId'),
+          newOwner: _nomosOwnedRequiredString(value, 'newOwner'),
+          previousReaders: _nomosOwnedRequiredStrings(value, 'previousReaders'),
+          epoch: _nomosOwnedRequiredInt(value, 'epoch'),
+          changedAt: _nomosOwnedRequiredString(value, 'changedAt'),
+          historicWraps: wraps
+              .map(_asMap)
+              .map(NomosHistoricOwnedWrapPreparation.fromTransport)
+              .toList(growable: false),
+        );
+      default:
+        throw ArgumentError.value(action, 'action', 'unknown owned action');
+    }
+  }
 
   /// FRAMEWORK-INTERNAL business birth: derive the unborn child's owned key from its deterministic address.
   Future<NomosScopeKey> nomosOwnedBirthScopeKey(
@@ -3758,29 +5148,68 @@ class NomosBridge {
       epoch: (out['epoch'] as num?)?.toInt() ?? 0,
       key: (out['key'] ?? '').toString(),
       ownedKeySubject: out['ownedKeySubject']?.toString(),
-      ownedCustody: out['ownedCustody']?.toString(),
+      ownedCustody: out['ownedCustody'] == null
+          ? null
+          : _nomosOwnedCustodyFromTransport(out['ownedCustody']),
       workspace: out['workspace']?.toString(),
     );
   }
 
   /// FRAMEWORK-INTERNAL: issue an opaque request for this session's current device.
-  Future<String> nomosOwnedDeviceRequest(String scope) async => (_asMap(
-            await _call('cryptoOwnedDeviceRequest', {'scope': scope}),
-          )['request'] ??
-          '')
-      .toString();
+  Future<OwnedDeviceRequest> nomosOwnedDeviceRequest(String scope) async {
+    final response = await _nmsKernelQuery(
+      session: _sessionName,
+      authority: _nmsQueryAuthority(null, null, _sessionName),
+      query: nomos_protocol.QueryRequest(
+        ownedDeviceRequest:
+            nomos_protocol.OwnedDeviceRequestQuery(scope: scope),
+      ),
+    );
+    if (!response.hasOwnedDeviceRequest()) {
+      throw StateError(
+        'Kernel returned ${response.whichResult().name}, expected ownedDeviceRequest',
+      );
+    }
+    return OwnedDeviceRequest.decodeUsda(
+      Uint8List.fromList(response.ownedDeviceRequest.requestUsda),
+    );
+  }
 
   /// FRAMEWORK-INTERNAL: validate an opaque request and prepare the atomic signer + custody offer.
-  Future<Map<String, Object?>> nomosPrepareOwnedDeviceApproval(
-    String request,
+  Future<NomosOwnedDeviceApprovalPreparation> nomosPrepareOwnedDeviceApproval(
+    OwnedDeviceRequest request,
     String scope,
-  ) async =>
-      _asMap(
-        await _call('cryptoOwnedPrepareApproval', {
-          'request': request,
-          'scope': scope,
-        }),
+  ) async {
+    final response = await _nmsKernelQuery(
+      session: _sessionName,
+      authority: _nmsQueryAuthority(null, null, _sessionName),
+      query: nomos_protocol.QueryRequest(
+        ownedPrepareApproval: nomos_protocol.OwnedPrepareApprovalQuery(
+          scope: scope,
+          requestUsda: request.encodeUsda(),
+        ),
+      ),
+    );
+    if (!response.hasOwnedPrepareApproval()) {
+      throw StateError(
+        'Kernel returned ${response.whichResult().name}, expected ownedPrepareApproval',
       );
+    }
+    final prepared = response.ownedPrepareApproval;
+    return NomosOwnedDeviceApprovalPreparation(
+      newKeySubject: prepared.newKeySubject,
+      ownedCustody: OwnedCustody.decodeUsda(
+        Uint8List.fromList(prepared.ownedCustodyUsda),
+      ),
+      verifiedVia: prepared.verifiedVia,
+      validFromEpoch: prepared.validFromEpoch.toInt(),
+      approvedAt: DateTime.fromMillisecondsSinceEpoch(
+        prepared.approvedAtUnixMillis.toInt(),
+        isUtc: true,
+      ).toIso8601String(),
+      ownedKeySubject: prepared.ownedKeySubject,
+    );
+  }
 
   /// Wrap a scope key TO a recipient's public key (committer side): `{hpkeEpk, ct}` base64 ciphertext.
   Future<Map<String, Object?>> cryptoWrapKey({
@@ -3810,94 +5239,54 @@ class NomosBridge {
               '')
           .toString();
 
-  /// THE SPATIAL READ: rows of the declared spatial index's of-type whose geometry
-  /// intersects [bbox] — an R*Tree probe on the local projection, same row shape as [query].
-  Future<List<Map<String, dynamic>>> spatialWithin(
-    String spatialId,
-    NomosBbox bbox, [
-    String? session,
-  ]) async =>
-      _asRows(
-        await _call('spatialWithin', {
-          'spatialId': spatialId,
-          'bbox': bbox.toJson(),
-          if (session != null) 'session': session,
-        }),
-      );
-
-  /// A maintained O(1) count / sum.
-  Future<int> count(
-    String countId, [
-    String group = '',
-    String? session,
-  ]) async =>
-      ((_asMap(
-        await _call('count', {
-          'countId': countId,
-          'group': group,
-          if (session != null) 'session': session,
-        }),
-      )['count']) as num)
-          .toInt();
-  Future<int> sum(String sumId, [String group = '', String? session]) async =>
-      ((_asMap(
-        await _call('sum', {
-          'sumId': sumId,
-          'group': group,
-          if (session != null) 'session': session,
-        }),
-      )['sum']) as num)
-          .toInt();
-
-  /// THE PENDING-CONFLICTS READ (Surfaced merge conflicts — the DX layer): the MAINTAINED,
-  /// workspace-wide "decisions needed" index (reserved id `nomosPendingConflicts`). One row per
-  /// (aggregate, field) whose folded state carries a Surfaced pending set of 2+ observations —
-  /// `{aggregateType, aggregateId, field, observations: [{value, author, occurredAt}]}`.
-  /// DERIVED, NOT DRAINED: a resolution write folding in removes its row by derivation.
-  /// Empty for a Surfaced-free workspace. (The generated typed client wraps these rows as
-  /// `PendingConflictRow` and pairs them with the designated `resolve…` helpers.)
-  Future<List<Map<String, dynamic>>> pendingConflicts([
-    String? session,
-  ]) async =>
-      _asRows(
-        await _call(
-            'pendingConflicts', {if (session != null) 'session': session}),
-      );
-
-  /// Framework-filtered pending conflicts for one generated aggregate type. This is the
-  /// primitive generated clients use; application code never filters the heterogeneous queue.
-  Future<List<Map<String, dynamic>>> pendingConflictsFor(
-    String aggregateType, [
+  /// Framework-filtered maintained conflicts. The kernel returns authenticated
+  /// USDA; only the generated client knows the composed application field types.
+  Future<Uint8List> nmsPendingConflictsUsda(
+    String? aggregateType, [
     String? session,
-  ]) async =>
-      _asRows(
-        await _call('pendingConflicts', {
-          'aggregateType': aggregateType,
-          if (session != null) 'session': session,
-        }),
+  ]) =>
+      _nmsKernelQueryUsda(
+        session: session,
+        authority: _nmsQueryAuthority(null, null, session),
+        query: nomos_protocol.QueryRequest(
+          pendingConflicts: nomos_protocol.PendingConflictsQuery(
+            aggregateType: aggregateType,
+          ),
+        ),
       );
 
   /// Counts-only workspace summary over the maintained conflict index.
-  Future<Map<String, Object?>> pendingConflictSummary([
+  Future<Uint8List> nmsPendingConflictSummaryUsda([
     String? session,
-  ]) async =>
-      _asMap(
-        await _call('pendingConflictSummary', {
-          if (session != null) 'session': session,
-        }),
+  ]) =>
+      _nmsKernelQueryUsda(
+        session: session,
+        authority: _nmsQueryAuthority(null, null, session),
+        query: nomos_protocol.QueryRequest(
+          pendingConflictSummary: nomos_protocol.PendingConflictSummaryQuery(),
+        ),
       );
 
   /// Push local writes → the session branch → cloud admission, and pull canonical main back.
-  Future<Map<String, Object?>> sync({
+  Future<nomos_protocol.SyncWorkspaceResponse> sync({
     bool admit = true,
     String? session,
-  }) async =>
-      _asMap(
-        await _call('sync', {
-          'admit': admit,
-          if (session != null) 'session': session,
-        }),
+  }) async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        syncWorkspace: nomos_protocol.SyncWorkspaceRequest(
+          session: _runtimeSession(session),
+          admit: admit,
+        ),
+      ),
+    );
+    if (!response.hasSyncWorkspace()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for sync',
       );
+    }
+    return response.syncWorkspace;
+  }
 
   /// PERSIST: a base64 snapshot of the whole local holon (the bare nomos.git incl. un-synced writes + the
   /// DLQ). Store it on disk and pass it back as `connect(restoreFrom:)` next launch — the app then boots from
@@ -3919,23 +5308,46 @@ class NomosBridge {
     int? fallbackMs,
     String? signalId,
   }) async {
-    await _call('autoSync', {
-      if (debounceMs != null) 'debounceMs': debounceMs,
-      if (fallbackMs != null) 'fallbackMs': fallbackMs,
-      if (signalId != null) 'signalId': signalId,
-    });
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        startAutoSync: nomos_protocol.StartAutoSyncRequest(
+          session: _runtimeSession(),
+          debounceMillis: debounceMs,
+          fallbackMillis: fallbackMs,
+          signalId: signalId,
+        ),
+      ),
+    );
+    if (!response.hasAutoSyncStarted()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for autoSync',
+      );
+    }
     final workspace = _sessionName;
     if (workspace != null) _eventPlane._autoSyncSessions.add(workspace);
   }
 
   Future<void> stopAutoSync() async {
-    await _call('stopAutoSync');
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        stopAutoSync: nomos_protocol.StopAutoSyncRequest(
+          session: _runtimeSession(),
+        ),
+      ),
+    );
+    if (!response.hasAutoSyncStopped()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for stopAutoSync',
+      );
+    }
     final workspace = _sessionName;
     if (workspace != null) _eventPlane._autoSyncSessions.remove(workspace);
   }
 
-  /// Background-sync telemetry: each autoSync round (`event:'sync'`) and doorbell socket state (`event:'link'`).
-  Stream<Map<String, Object?>> get syncEvents => _eventPlane._syncEvents.stream;
+  /// Generated background-sync telemetry. Each item is a Runtime v2 event
+  /// whose exact arm is either [SyncCompleted] or [LinkChanged].
+  Stream<nomos_protocol.RuntimeEvent> get syncEvents =>
+      _eventPlane._syncEvents.stream;
 
   /// LIVE pack byte-progress — the real loading bar. Each event carries `received`/`total` (the host's
   /// actual `Content-Length`, known before the body) + `kind` ('delta'|'full'). Emits only while a `/pack`
@@ -4315,24 +5727,6 @@ class NomosBridge {
         principal: principal,
       );
 
-  /// Reactive SPATIAL read: re-emits the R*Tree probe's rows whenever they change locally.
-  Stream<List<dynamic>> watchSpatial(
-    String spatialId,
-    NomosBbox bbox, [
-    String? session,
-  ]) =>
-      _watchStream(
-        kind: 'spatial',
-        spatialId: spatialId,
-        bbox: bbox,
-        session: session,
-      );
-
-  /// Reactive PENDING-CONFLICTS read: re-emits the maintained Surfaced "decisions needed"
-  /// rows whenever the index changes (derived, not drained — a resolution write clears its row).
-  Stream<List<dynamic>> watchPendingConflicts([String? session]) =>
-      _watchStream(kind: 'pendingConflicts', session: session);
-
   /// SHAPE COMPATIBILITY (#72): one-shot verdict for this client's structural [requirement]
   /// (its baked `…InterfaceJson`, decoded) against the workspace's ON-LEDGER offer (auto-sourced).
   /// `{ ok, missing[], incompatible[] }` — names the exact directive/aggregate/field, not a hash.
@@ -4470,7 +5864,7 @@ class NomosBridge {
         // Cancellation is a local lifecycle boundary and must complete even if the runner is slow,
         // disconnected, or being disposed. The remote release remains best-effort; bridge/runner disposal
         // also drops every outstanding watch, so awaiting this acknowledgement only creates teardown hangs.
-        unawaited(_call('unwatch', {'subId': subId}).catchError((_) => null));
+        unawaited(_unwatch(subId).catchError((_) => null));
       },
     );
     _eventPlane._compatWatches[subId] = ctrl;
@@ -4482,8 +5876,6 @@ class NomosBridge {
     String? queryId,
     Map<String, Object?>? params,
     String? id,
-    String? spatialId,
-    NomosBbox? bbox,
     String? base,
     int? limit,
     String? session,
@@ -4503,8 +5895,6 @@ class NomosBridge {
             if (queryId != null) 'queryId': queryId,
             if (params != null) 'params': params,
             if (id != null) 'id': id,
-            if (spatialId != null) 'spatialId': spatialId,
-            if (bbox != null) 'bbox': bbox.toJson(),
             if (base != null) 'base': base,
             if (limit != null) 'limit': limit,
             if (principal != null) 'principal': principal,
@@ -4524,7 +5914,7 @@ class NomosBridge {
         _eventPlane._watches.remove(subId);
         // A caller owns its local subscription; it must never need a healthy transport in order to release
         // it. Runner-side cleanup is still requested immediately and is made total by runner disposal.
-        unawaited(_call('unwatch', {'subId': subId}).catchError((_) => null));
+        unawaited(_unwatch(subId).catchError((_) => null));
       },
     );
     _eventPlane._watches[subId] = ctrl;
@@ -4537,13 +5927,24 @@ class NomosBridge {
   /// watches and continuous-sync loops must not survive this client.
   Future<void> dispose() async {
     try {
-      await _call('disposeRealm').timeout(const Duration(seconds: 10));
+      final response = await _invokeRuntimeV2(
+        nomos_protocol.RuntimeRequest(
+          closeRealm: nomos_protocol.CloseRealmRequest(),
+        ),
+      ).timeout(const Duration(seconds: 10));
+      if (!response.hasRealmClosed()) {
+        throw StateError(
+          'Runtime v2 returned ${response.whichOutcome().name} for closeRealm',
+        );
+      }
     } catch (_) {
       // A dead/unstarted embedding has no reachable runner to release. The
       // enclosing engine host is still disposed below by NomosScope; never let
       // teardown strand the Flutter lifecycle on an unavailable transport.
     }
     await _sub.cancel();
+    await _runtimeEventSub?.cancel();
+    _runtimeEventSub = null;
     final pending = _pending.entries
         .map(
           (entry) => (
@@ -4556,6 +5957,7 @@ class NomosBridge {
     _pending.clear();
     _pendingOps.clear();
     _pendingTraces.clear();
+    _pendingCallStacks.clear();
     for (final entry in pending) {
       final c = entry.completer;
       if (!c.isCompleted) {
@@ -4577,6 +5979,12 @@ class NomosBridge {
       // let its done event complete if/when that consumer resumes.
       if (!w.isClosed) unawaited(w.close());
     }
+    final nominalWatches =
+        _nominalWatchControllers.values.toList(growable: false);
+    _nominalWatchControllers.clear();
+    for (final watch in nominalWatches) {
+      if (!watch.isClosed) unawaited(watch.close());
+    }
     final compatWatches = _compatWatches.values.toList(growable: false);
     _compatWatches.clear();
     for (final w in compatWatches) {
@@ -4711,13 +6119,26 @@ class NomosSession extends NomosBridge {
         'Generated child model inheritance needs a bound parent session.',
       );
     }
-    await _call('stageGeneratedModelFromParent', {
-      'sourceSession': source,
-      'session': childWorkspace,
-      'domain': domain,
-      'candidateHash': candidateHash,
-      'lawUsdz': base64Encode(lawUsdz),
-    });
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        modelLifecycle: nomos_protocol.ModelLifecycleRequest(
+          session: childWorkspace,
+          stage: nomos_protocol.StageGeneratedModelRequest(
+            domain: domain,
+            candidateHash: candidateHash,
+            lawUsdz: lawUsdz,
+            sourceSession: source,
+          ),
+        ),
+      ),
+    );
+    if (!response.hasModelLifecycle() || !response.modelLifecycle.accepted) {
+      throw StateError(
+        response.hasModelLifecycle() && response.modelLifecycle.hasMessage()
+            ? response.modelLifecycle.message
+            : 'Runtime v2 refused generated child model staging',
+      );
+    }
   }
 
   /// Retain the application's typed model-decision policy for generated child