@githolon/dsl 0.108.0 → 0.108.1

package/src/codegen_dart_client.ts

@@ -14,7 +14,7 @@
  * [NomosBridge] (the WebView runner) with:
  *
  *   * a typed OFFER method per directive — takes the generated input/implementation DTO, serialises via its
- *     `nmsInternalToPayloadJson()`, auto-stamps omitted `…At` timestamps (the same caller-clock sugar the TS
+ *     canonical USDA, auto-stamps omitted `…At` timestamps (the same caller-clock sugar the TS
  *     client applies), returns the new local head;
  *   * a typed declared-QUERY accessor per `query(...)` — one-shot `Future<List<…ReadModel>>` + a
  *     reactive `watch…` `Stream<List<…ReadModel>>`, parsed off the bridge's `{type,id,data}` rows;
@@ -35,7 +35,11 @@ import {
   OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD,
   type AggregateHandle,
 } from "./aggregate.js";
-import { isGitObjectIdSchema, isSha256DigestSchema, type Field } from "./fields.js";
+import {
+  isGitObjectIdSchema,
+  isSha256DigestSchema,
+  type Field,
+} from "./fields.js";
 import type { Directive } from "./directive.js";
 import type { QueryDecl } from "./query.js";
 import type { DomainModule } from "./codegen_dart.js";
@@ -47,11 +51,30 @@ import {
   registerDartNames,
   concreteClassName,
   dartBusinessRecordInputs,
+  dartForeignReferenceInputs,
   dartActionInputClassName,
   dartMemberName,
   collectDartEnums,
   dartEnumTypeForField,
+  dartEnumLookupKey,
+  introspectPayload,
+  aggregateFieldSpecs,
+  collectOwnIdFieldsByAggregate,
+  refIdClassResolver,
+  zodNumberIsInt,
+  type AggFieldSpec,
+  type PayloadFieldSpec,
 } from "./codegen_dart.js";
+import type { LawGraph } from "./law_graph.js";
+import {
+  DART_CALL_USDA_PRELUDE,
+  emitDartCallUsdaEncoder,
+  type DartCallUsdaFieldAccess,
+} from "./codegen_call_usda.js";
+import {
+  emitDartQueryUsdaEncoder,
+  type QueryScalarKind,
+} from "./codegen_query_usda.js";
 import { finishCount } from "./count.js";
 import { finishSum } from "./sum.js";
 import {
@@ -73,15 +96,24 @@ import {
   type NomosDescribeModel,
 } from "./describe_model.js";
 import { assertModelClientMemberAvailable } from "./generated_client_names.js";
-import { ownedRecordActionDirectiveId } from "./framework/owned_custody.js";
+import {
+  OWNED_DEVICE_APPROVAL_DIRECTIVE,
+  ownedRecordActionDirectiveId,
+} from "./framework/owned_custody.js";
 import { contractTypeName } from "./contract.js";
 import { admitsNull } from "./null_meta.js";
+import { zodDef, zodKind } from "./zod_introspection.js";
+import type { WorkspaceSharingPolicy } from "./workspace_sharing.js";
 
 const camel = (s: string) =>
   s.replace(/[_\s-]+(\w)/g, (_m, c: string) => c.toUpperCase());
 const lcFirst = (s: string) =>
   s.length ? s[0]!.toLowerCase() + s.slice(1) : s;
 
+export const dartInternalWorkspaceSharingReceiptMethod = (
+  directiveId: string
+): string => `nmsInternal${cap(camel(directiveId))}`;
+
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 type AnyDirective = Directive<any>;
 
@@ -127,6 +159,11 @@ const safeMethod = (s: string): string => (DART_RESERVED.has(s) ? `${s}_` : s);
 /** `guestbook` / `tool-library` / `Tool Library` → `GuestbookClient` / `ToolLibraryClient`. */
 export const dartClientClassName = (domain: string): string =>
   `${cap(camel(domain))}Client`;
+
+/** Compiler-private, but cross-library, entry point used by the generated application
+ * when a business action first has to author one hidden source-trust directive. */
+export const dartInternalSourceTrustMethod = (directiveId: string): string =>
+  `nmsInternalOffer${cap(camel(directiveId))}`;
 /** `guestbook` → `guestbookDomainHash` — the Dart top-level const (lowerCamel by lint). */
 export const dartHashConstName = (fileBase: string): string =>
   `${lcFirst(camel(fileBase))}DomainHash`;
@@ -148,15 +185,88 @@ function dartRawJson(value: unknown): string {
 const dartStr = (s: string) =>
   `'${s.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
 
+const dartSealedValueName = (field: string): string =>
+  `nmsInternalSealed${cap(camel(field))}`;
+
+const dartSealKeyName = (field: string): string =>
+  `nmsInternalSealKey${cap(camel(field))}`;
+
+/** A schema-specific Dart expression for one public payload field. The USDA
+ * encoder consumes typed values directly; any legacy arbitrary-data shape is a
+ * compiler refusal, never a route back through JSON. */
+function dartCallUsdaFieldAccess(
+  domain: string,
+  directive: string,
+  spec: PayloadFieldSpec
+): DartCallUsdaFieldAccess {
+  const member = `payload.${dartMemberName(spec.name)}`;
+  if (spec.nullAdmits === true) {
+    return { value: member, slot: true };
+  }
+  const value = spec.optional ? `${member}!` : member;
+  switch (spec.shape) {
+    case "scalar":
+    case "enum":
+    case "strList":
+    case "wrappedList":
+    case "refList":
+    case "record":
+    case "recordList":
+    case "stringMap":
+    case "vo":
+    case "voList":
+      return {
+        value,
+        ...(spec.optional ? { present: `${member} != null` } : {}),
+      };
+    case "wrapped":
+      return {
+        value: `${value}.value`,
+        ...(spec.optional ? { present: `${member} != null` } : {}),
+      };
+    case "ref":
+      // Optional aggregate references are deliberately not nullable NomosRef<T> values at the
+      // application boundary. They are required NomosOptionalRef<T> choices, so lower only the
+      // present arm; absence omits the USDA field. Passing the wrapper itself to the internal ref
+      // codec loses both the sum's meaning and Dart's type safety.
+      if (spec.optional) {
+        const reference = `${member}.referenceOrNull`;
+        return {
+          value: `NmsInternalNomosRefs.id(${reference}!)`,
+          present: `${reference} != null`,
+        };
+      }
+      return {
+        value: `NmsInternalNomosRefs.id(${value})`,
+      };
+    case "addressRef":
+      return {
+        value: `(workspace: NmsInternalNomosRefs.workspace(${value}), type: NmsInternalNomosRefs.type(${value}), id: NmsInternalNomosRefs.id(${value}))`,
+        ...(spec.optional ? { present: `${member} != null` } : {}),
+      };
+    case "versionedRef":
+      return {
+        value: `(pinned: (workspace: NmsInternalNomosRefs.workspace(${value}.pinned), type: NmsInternalNomosRefs.type(${value}.pinned), id: NmsInternalNomosRefs.id(${value}.pinned)), series: (workspace: NmsInternalNomosRefs.workspace(${value}.series), type: NmsInternalNomosRefs.type(${value}.series), id: NmsInternalNomosRefs.id(${value}.series)))`,
+        ...(spec.optional ? { present: `${member} != null` } : {}),
+      };
+    case "recipient":
+      return {
+        value: `NmsInternalRecipients.address(${value})`,
+        ...(spec.optional ? { present: `${member} != null` } : {}),
+      };
+  }
+}
+
 /** The Dart param type for a query index key. Aggregate relations keep their canonical typed ref. */
 function dartKeyType(
   agg: AggregateHandle | undefined,
   key: string,
-  enumDartTypes: ReadonlyMap<string, string>,
+  enumDartTypes: ReadonlyMap<string, string>
 ): string {
   const lead = key.includes(".") ? key.split(".")[0]! : key;
   const f = agg?.fields[lead] as Field | undefined;
   if (f && (f.kind === "int" || f.kind === "counter")) return "int";
+  if (f?.kind === "bool") return "bool";
   if (f?.kind === "ref") {
     if (f.foreignRef !== undefined) {
       const target =
@@ -179,6 +289,29 @@ function dartKeyType(
   return "String";
 }
 
+function queryScalarKind(
+  agg: AggregateHandle | undefined,
+  key: string
+): QueryScalarKind {
+  // A nested index is a scalar leaf selected from a declared structural path. The current DSL
+  // exposes that leaf as String; its exact path still remains law-authenticated in query USDA.
+  if (key.includes(".")) return "string";
+  const field = agg?.fields[key] as Field | undefined;
+  switch (field?.kind) {
+    case "int":
+    case "counter":
+      return "integer";
+    case "bool":
+      return "boolean";
+    case "enum":
+      return "token";
+    case "ref":
+      return "reference";
+    default:
+      return "string";
+  }
+}
+
 function dartKeyExpr(agg: AggregateHandle | undefined, key: string): string {
   const lead = key.includes(".") ? key.split(".")[0]! : key;
   const field = agg?.fields[lead] as Field | undefined;
@@ -225,6 +358,339 @@ function rowToModel(model: string, rowVar: string, workspace = "_ws"): string {
   return `NmsInternalRecordOrigins.remember(${model}.fromProjected((${rowVar}['data'] as Map).cast<String, dynamic>(), (${rowVar}['id'] ?? '').toString(), ${workspace}, (${rowVar}['type'] ?? '').toString()), workspace: ${workspace}, type: (${rowVar}['type'] ?? '').toString(), id: (${rowVar}['id'] ?? '').toString())`;
 }
 
+interface DartResultField {
+  readonly spec: AggFieldSpec;
+  readonly lawPath: string;
+  readonly foreignWorkspacePath?: string;
+}
+
+function dartUsdaJsonMap(expression: string): string {
+  return `(${expression}.jsonValue() as Map).cast<String, Object?>()`;
+}
+
+function dartUsdaBasePresentValue(
+  spec: AggFieldSpec,
+  expression: string,
+  workspace: string,
+  foreignWorkspaceExpression?: string
+): string {
+  switch (spec.kind) {
+    case "string":
+    case "position": {
+      const value = `${expression}.stringValue()`;
+      if (spec.valueClass !== undefined) {
+        return `NmsInternalNomosRefs.create<${spec.valueClass}>(workspace: ${workspace}, type: '${spec.valueAggregateType}', id: ${value})`;
+      }
+      return spec.semanticString === "sha256"
+        ? `Sha256Digest(${value})`
+        : spec.semanticString === "git-object-id"
+        ? `GitObjectId(${value})`
+        : value;
+    }
+    case "ref": {
+      const value = `${expression}.stringValue()`;
+      if (spec.foreignRefTarget !== undefined) {
+        if (foreignWorkspaceExpression === undefined) {
+          throw new Error(
+            `Dart result USDA codegen: foreign reference '${spec.wireName}' has no workspace-field decoder`
+          );
+        }
+        return `NmsInternalForeignRefs.create<${spec.foreignRefTarget}>(id: ${value}, workspace: ${foreignWorkspaceExpression}, type: '${spec.foreignRefAggregateType}', fromJson: ${spec.foreignRefTarget}.fromJson)`;
+      }
+      if (spec.refIdClass !== undefined) {
+        return `NmsInternalNomosRefs.create<${spec.refIdClass}>(workspace: ${workspace}, type: '${spec.refAggregateType}', id: ${value})`;
+      }
+      if (spec.nomosRefTarget !== undefined) {
+        return `NmsInternalNomosRefs.fromJson<${spec.nomosRefTarget}>(${expression}.jsonValue())`;
+      }
+      if (spec.versionedRefTarget !== undefined) {
+        return `() { final value = ${dartUsdaJsonMap(
+          expression
+        )}; return NmsInternalVersionedNomosRefs.create<${
+          spec.versionedRefTarget
+        }, ${spec.versionedRefSeries}>(pinned: NmsInternalNomosRefs.fromJson<${
+          spec.versionedRefTarget
+        }>(value['pinned']), series: NmsInternalNomosRefs.fromJson<${
+          spec.versionedRefSeries
+        }>(value['series']), currentField: ${JSON.stringify(
+          spec.versionedRefCurrentField
+        )}); }()`;
+      }
+      return value;
+    }
+    case "int":
+    case "counter":
+      return `${expression}.numberValue().toInt()`;
+    case "bool":
+      return `${expression}.boolValue()`;
+    case "enum":
+      return `${spec.dartType}.fromWire(${expression}.stringValue())`;
+    case "json":
+      if (spec.voClass !== undefined)
+        return `${spec.voClass}.fromProjected(${dartUsdaJsonMap(expression)})`;
+      return spec.jsonShape === "object"
+        ? dartUsdaJsonMap(expression)
+        : `${expression}.jsonValue()`;
+    case "evidence":
+      return `EvidenceRef.fromProjected(${dartUsdaJsonMap(expression)})`;
+    case "set":
+      return `${expression}.children.map((value) => value.stringValue()).toSet()`;
+    case "map": {
+      if (spec.mapValueVoClass !== undefined) {
+        return `${expression}.mapValue<${spec.mapValueVoClass}>((value) => ${
+          spec.mapValueVoClass
+        }.fromProjected(${dartUsdaJsonMap("value")}))`;
+      }
+      return spec.mapValueKind === "json"
+        ? `${expression}.mapValue<Object?>((value) => value.jsonValue())`
+        : `${expression}.mapValue<String>((value) => value.stringValue())`;
+    }
+  }
+}
+
+function dartUsdaPresentValue(
+  spec: AggFieldSpec,
+  expression: string,
+  workspace: string,
+  foreignWorkspaceExpression?: string
+): string {
+  if (spec.surfaced !== true) {
+    return dartUsdaBasePresentValue(
+      spec,
+      expression,
+      workspace,
+      foreignWorkspaceExpression
+    );
+  }
+  const base = (value: string) =>
+    dartUsdaBasePresentValue(
+      spec,
+      value,
+      workspace,
+      foreignWorkspaceExpression
+    );
+  return `() {
+    final encoded = ${expression};
+    if (encoded.typeName != 'NomosRecordValue') {
+      return SurfacedResolved<${spec.dartType}>(${base("encoded")});
+    }
+    final surfaced = encoded.jsonMember('__surfaced');
+    if (surfaced != null) {
+      final pending = surfaced.requiredJsonMember('pending');
+      if (pending.typeName != 'NomosJsonArray' || pending.children.length < 2) {
+        throw const FormatException('Surfaced pending value needs at least two observations');
+      }
+      return SurfacedPending<${
+        spec.dartType
+      }>(List.unmodifiable(pending.children.map((observation) {
+        if (observation.typeName != 'NomosJsonObject') {
+          throw const FormatException('Malformed Surfaced observation');
+        }
+        final occurredAt = observation.requiredJsonMember('occurredAt');
+        final author = observation.jsonMember('author');
+        return SurfacedObservation<${spec.dartType}>(
+          value: ${base("observation.requiredJsonMember('value')")},
+          occurredAt: Hlc(
+            physical: occurredAt.requiredJsonMember('physical').intValue(),
+            logical: occurredAt.requiredJsonMember('logical').intValue(),
+            replica: int.parse(occurredAt.requiredJsonMember('replica').stringValue()),
+          ),
+          author: author == null || author.typeName == 'NomosNullValue' ? null : author.stringValue(),
+        );
+      })));
+    }
+    final evolution = encoded.jsonMember('__evolution');
+    if (evolution != null) {
+      final source = evolution.jsonMember('sourceSchema');
+      return SurfacedEvolutionRequired<${spec.dartType}>(
+        targetSchema: evolution.requiredJsonMember('targetSchema').stringValue(),
+        sourceSchemas: source == null || source.typeName == 'NomosNullValue'
+            ? const <String>[]
+            : <String>[source.stringValue()],
+        authoredUnder: const <String>[],
+        reason: evolution.requiredJsonMember('reason').stringValue(),
+      );
+    }
+    throw const FormatException('Structured Surfaced value has no recognised framework envelope');
+  }()`;
+}
+
+function dartUsdaFieldValue(
+  field: DartResultField,
+  row = "row",
+  workspace = "workspace"
+): string {
+  const selected = `${row}.field(${JSON.stringify(field.lawPath)})`;
+  const required = `${row}.requiredField(${JSON.stringify(field.lawPath)})`;
+  const foreignWorkspaceExpression = field.foreignWorkspacePath === undefined
+    ? undefined
+    : `(${row}.field(${JSON.stringify(
+        field.foreignWorkspacePath
+      )})?.stringValue() ?? '')`;
+  const present = dartUsdaPresentValue(
+    field.spec,
+    field.spec.optional ? `${selected}!` : required,
+    workspace,
+    foreignWorkspaceExpression
+  );
+  if (field.spec.nullAdmits === true) {
+    const slotType = field.spec.dartType.replace(/\?$/, "");
+    return `() { final value = ${selected}; if (value == null) return const NomosSlot<${slotType}>.omitted(); if (value.typeName == 'NomosNullValue') return const NomosSlot<${slotType}>.explicitNull(); return NomosSlot<${slotType}>.of(${dartUsdaPresentValue(
+      field.spec,
+      "value",
+      workspace,
+      foreignWorkspaceExpression
+    )}); }()`;
+  }
+  if (field.spec.kind === "set") {
+    return `(${selected} == null ? const <String>{} : ${dartUsdaPresentValue(
+      field.spec,
+      `${selected}!`,
+      workspace,
+      foreignWorkspaceExpression
+    )})`;
+  }
+  if (field.spec.kind === "map") {
+    return `(${selected} == null ? const {} : ${dartUsdaPresentValue(
+      field.spec,
+      `${selected}!`,
+      workspace,
+      foreignWorkspaceExpression
+    )})`;
+  }
+  return field.spec.optional
+    ? `(${selected} == null || ${selected}!.typeName == 'NomosNullValue' ? null : ${present})`
+    : present;
+}
+
+function dartUsdaProjectionValue(
+  schema: z.ZodTypeAny,
+  expression: string
+): string {
+  let inner = schema;
+  while (
+    zodKind(inner) === "optional" ||
+    zodKind(inner) === "default" ||
+    zodKind(inner) === "nullable"
+  ) {
+    inner = zodDef(inner).innerType!;
+  }
+  const value = `${expression}.jsonValue()`;
+  switch (zodKind(inner)) {
+    case "string":
+    case "enum":
+      return `${value} as String`;
+    case "boolean":
+      return `${value} as bool`;
+    case "number":
+      return zodNumberIsInt(inner)
+        ? `(${value} as num).toInt()`
+        : `(${value} as num).toDouble()`;
+    case "object":
+    case "record":
+      return `(${value} as Map).cast<String, Object?>()`;
+    case "array":
+      return `(${value} as List).cast<Object?>()`;
+    default:
+      return value;
+  }
+}
+
+interface DartUsdaResultDecoder {
+  readonly model: string;
+  readonly refType: string;
+  readonly aggregatePath: string;
+  readonly runtimeType: string;
+  readonly baseFields: readonly {
+    readonly name: string;
+    readonly path: string;
+    readonly spec: AggFieldSpec;
+    readonly required: boolean;
+    readonly foreignWorkspacePath?: string;
+  }[];
+  readonly computedFields: readonly {
+    readonly name: string;
+    readonly path: string;
+    readonly schema: z.ZodTypeAny;
+    readonly required: boolean;
+    readonly enumType?: string;
+  }[];
+  readonly attributedFields: readonly string[];
+}
+
+function emitDartUsdaResultDecoder(
+  decoder: DartUsdaResultDecoder
+): readonly string[] {
+  const functionName = `_nmsDecode${decoder.model}Rows`;
+  const constructorFields = decoder.baseFields.map(
+    (field) =>
+      `      ${field.spec.name}: ${dartUsdaFieldValue({
+        spec: field.spec,
+        lawPath: field.path,
+        ...(field.foreignWorkspacePath === undefined
+          ? {}
+          : { foreignWorkspacePath: field.foreignWorkspacePath }),
+      })},`
+  );
+  const computedFields = decoder.computedFields.map((field) => {
+    const selected = `row.field(${JSON.stringify(field.path)})`;
+    const required = `row.requiredField(${JSON.stringify(field.path)})`;
+    const decode = (value: string) => field.enumType === undefined
+      ? dartUsdaProjectionValue(field.schema, value)
+      : `${field.enumType}.fromWire(${value}.jsonValue() as String)`;
+    return field.required
+      ? `      ${dartMemberName(field.name)}: ${decode(required)},`
+      : `      ${dartMemberName(
+          field.name
+        )}: ${selected} == null ? null : ${decode(`${selected}!`)},`;
+  });
+  const provenanceFields = decoder.attributedFields.map((name) => {
+    const field = decoder.baseFields.find(
+      (candidate) => candidate.name === name
+    );
+    if (field === undefined) {
+      throw new Error(
+        `Dart result USDA codegen: attributed field '${decoder.model}.${name}' is not stored`
+      );
+    }
+    const selected = `row.field(${JSON.stringify(field.path)})`;
+    return `        if (${selected} != null) ${JSON.stringify(
+      name
+    )}: FieldProvenance(author: ${selected}!.property('nomos:author') is String ? ${selected}.property('nomos:author') as String : null, wasContested: ${selected}.property('nomos:wasContested') == true),`;
+  });
+  return [
+    `List<${decoder.model}> ${functionName}(Uint8List bytes, String workspace) {`,
+    `  final result = NmsUsdaResult.parse(bytes);`,
+    `  return result.rows.map((row) {`,
+    `    if (row.relationship('nomos:type') != ${JSON.stringify(
+      decoder.aggregatePath
+    )}) {`,
+    `      throw const FormatException('USDA row has the wrong law type for ${decoder.model}');`,
+    `    }`,
+    `    final id = row.property('nomos:id');`,
+    `    if (id is! String) throw const FormatException('USDA row has no string identity');`,
+    `    return ${decoder.model}(`,
+    `      ref: NmsInternalNomosRefs.create<${
+      decoder.refType
+    }>(workspace: workspace, type: ${JSON.stringify(
+      decoder.runtimeType
+    )}, id: id),`,
+    ...(provenanceFields.length > 0
+      ? [`      \$provenance: {`, ...provenanceFields, `      },`]
+      : []),
+    ...constructorFields,
+    ...computedFields,
+    `    );`,
+    `  }).toList(growable: false);`,
+    `}`,
+    `NomosPage<${decoder.model}> _nmsDecode${decoder.model}Page(Uint8List bytes, String workspace) {`,
+    `  final result = NmsUsdaResult.parse(bytes);`,
+    `  return NomosPage(rows: ${functionName}(bytes, workspace), cursor: result.cursor, done: result.done);`,
+    `}`,
+    ``,
+  ];
+}
+
 export interface DartBridgeClientOptions {
   /** Content identity of the built typed USDA closure (`.law.usdz`). */
   readonly domainHash: string;
@@ -294,6 +760,12 @@ export interface DartBridgeClientOptions {
    * directly. Empty/omitted ⇒ the barrel carries everything (the 'all' / flat path, byte-identical).
    */
   readonly explicitTypeImports?: readonly string[];
+  /** Canonical typed-law graph and its rendered USDA paths. Required for any
+   * generated directive: Dart authors the same NomosCall USDA as TypeScript. */
+  readonly callUsda?: {
+    readonly graph: LawGraph;
+    readonly paths: ReadonlyMap<string, string>;
+  };
 }
 
 /** Generate the `<name>.client.dart` async bridge client for one domain module. */
@@ -301,6 +773,28 @@ export function generateDartBridgeClient(
   mod: DomainModule,
   opts: DartBridgeClientOptions
 ): string {
+  const callUsda = opts.callUsda;
+  if (callUsda === undefined) {
+    throw new Error(
+      `Dart client codegen for '${
+        mod.domain ?? mod.name
+      }' requires the composed law graph; ` +
+        "application calls and results may not fall back to generic maps"
+    );
+  }
+  const authoredDirectives = mod.directives as AnyDirective[];
+  const workspaceSharingPolicies: readonly WorkspaceSharingPolicy[] =
+    mod.applicationWorkspaceSharing ?? [];
+  const workspaceSharingReceipts = [
+    ...new Map(
+      workspaceSharingPolicies
+        .flatMap((policy) => [...policy.delivered, ...policy.refused])
+        .map((receipt) => [receipt.records.id, receipt.records] as const)
+    ).values(),
+  ] as AnyDirective[];
+  const workspaceSharingReceiptIds = new Set(
+    workspaceSharingReceipts.map((directive) => directive.id)
+  );
   const publicAggregates = mod.aggregates.filter(
     (a) =>
       (a as { businessBirthInternal?: unknown }).businessBirthInternal !== true
@@ -339,7 +833,7 @@ export function generateDartBridgeClient(
     mod.directives,
     domain,
     mod.valueObjects ?? [],
-    mod.deriveds ?? [],
+    mod.deriveds ?? []
   ).dartTypes;
   assertModelClientMemberAvailable(mod);
   const describeModel =
@@ -359,6 +853,162 @@ export function generateDartBridgeClient(
       : "nomos_client.dart";
   const aggById = new Map<string, AggregateHandle>();
   for (const a of mod.aggregates) aggById.set(a.id, a);
+  const packageAggregateDomains = opts.packageAggregateDomains ?? {};
+  const refIdClassForAggregate = refIdClassResolver(mod);
+  const ownIdFieldsByAggregate = collectOwnIdFieldsByAggregate(
+    mod.aggregates,
+    authoredDirectives,
+    enumDartTypes
+  );
+  const aggregateWireTypeForAggregate = (aggregateType: string): string => {
+    const local = aggById.get(aggregateType);
+    if (local !== undefined && !isNamespacedAggregate(local))
+      return aggregateType;
+    const owner = packageAggregateDomains[aggregateType] as
+      | { domain: string; namespaced?: boolean }
+      | undefined;
+    if (owner?.namespaced === false) return aggregateType;
+    const ownerDomain =
+      owner?.domain ?? (local === undefined ? undefined : domain);
+    return ownerDomain === undefined
+      ? aggregateType
+      : qualifyReadProjectionType(ownerDomain, aggregateType);
+  };
+  const resultDecoderSources: string[] = [];
+  const resultDecoderByAggregate = new Map<string, DartUsdaResultDecoder>();
+  {
+    for (const aggregate of mod.aggregates) {
+      const aggregateNode = callUsda.graph.nodes.find(
+        (node) =>
+          node.kind === "aggregate" && node.entity.label === aggregate.id
+      );
+      if (aggregateNode === undefined) {
+        throw new Error(
+          `Dart result USDA codegen: composed law has no '${domain}.${aggregate.id}' aggregate`
+        );
+      }
+      const aggregatePath = callUsda.paths.get(aggregateNode.entity.id);
+      if (aggregatePath === undefined) {
+        throw new Error(
+          `Dart result USDA codegen: '${domain}.${aggregate.id}' has no canonical USDA path`
+        );
+      }
+      const aggregateEnumDartTypes = aggregate.framework === true
+        ? collectDartEnums([aggregate], [], "nomos_framework").dartTypes
+        : enumDartTypes;
+      const specs = aggregateFieldSpecs(
+        aggregate,
+        aggregateEnumDartTypes,
+        refIdClassForAggregate,
+        ownIdFieldsByAggregate.get(aggregate.id) ?? new Set(),
+        aggregateWireTypeForAggregate
+      );
+      const baseFields = specs.map((spec) => {
+        const fieldNode = callUsda.graph.nodes.find(
+          (node) =>
+            node.kind === "field" &&
+            node.owner.id === aggregateNode.entity.id &&
+            node.entity.label === spec.wireName
+        );
+        if (fieldNode === undefined) {
+          throw new Error(
+            `Dart result USDA codegen: composed law has no '${domain}.${aggregate.id}.${spec.wireName}' field`
+          );
+        }
+        const path = callUsda.paths.get(fieldNode.entity.id);
+        if (path === undefined) {
+          throw new Error(
+            `Dart result USDA codegen: '${domain}.${aggregate.id}.${spec.wireName}' has no canonical USDA path`
+          );
+        }
+        const field = aggregate.fields[spec.wireName] as Field;
+        let foreignWorkspacePath: string | undefined;
+        if (spec.foreignRefWorkspaceField !== undefined) {
+          const workspaceNode = callUsda.graph.nodes.find(
+            (node) =>
+              node.kind === "field" &&
+              node.owner.id === aggregateNode.entity.id &&
+              node.entity.label === spec.foreignRefWorkspaceField
+          );
+          if (workspaceNode === undefined) {
+            throw new Error(
+              `Dart result USDA codegen: '${domain}.${aggregate.id}.${spec.wireName}' has no declared workspace field '${spec.foreignRefWorkspaceField}'`
+            );
+          }
+          foreignWorkspacePath = callUsda.paths.get(workspaceNode.entity.id);
+          if (foreignWorkspacePath === undefined) {
+            throw new Error(
+              `Dart result USDA codegen: '${domain}.${aggregate.id}.${spec.foreignRefWorkspaceField}' has no canonical USDA path`
+            );
+          }
+        }
+        return {
+          name: spec.wireName,
+          path,
+          spec,
+          required: field.isFromBirth === true,
+          ...(foreignWorkspacePath === undefined
+            ? {}
+            : { foreignWorkspacePath }),
+        };
+      });
+      const computedFields = [
+        ...(mod.deriveds ?? [])
+          .filter((read) => read.of === aggregate.id)
+          .map((read) => ({
+            name: read.id,
+            schema: read.returns,
+            required: "kind" in read && read.kind === "temporalEnum",
+          })),
+        ...(mod.combineds ?? [])
+          .filter((read) => read.of === aggregate.id)
+          .map((read) => ({
+            name: read.id,
+            schema: read.returns,
+            required: false,
+          })),
+      ].map((field) => {
+        const readNode = callUsda.graph.nodes.find(
+          (node) => node.kind === "read" && node.entity.label === field.name
+        );
+        if (readNode === undefined) {
+          throw new Error(
+            `Dart result USDA codegen: composed law has no '${domain}.${field.name}' read field`
+          );
+        }
+        const path = callUsda.paths.get(readNode.entity.id);
+        if (path === undefined) {
+          throw new Error(
+            `Dart result USDA codegen: '${domain}.${field.name}' has no canonical USDA path`
+          );
+        }
+        return { ...field, path };
+      }).map((field) => {
+        const inner = (() => {
+          let schema = field.schema;
+          while (["optional", "default", "nullable"].includes(zodKind(schema))) {
+            schema = zodDef(schema).innerType!;
+          }
+          return schema;
+        })();
+        const enumType = field.required && zodKind(inner) === "enum"
+          ? enumDartTypes.get(dartEnumLookupKey(inner))
+          : undefined;
+        return enumType === undefined ? field : { ...field, enumType };
+      });
+      const decoder = {
+        model: readModelClassName(aggregate.id),
+        refType: concreteClassName(aggregate.id),
+        aggregatePath,
+        runtimeType: aggregateWireTypeForAggregate(aggregate.id),
+        baseFields,
+        computedFields,
+        attributedFields: aggregate.attributedFields ?? [],
+      } satisfies DartUsdaResultDecoder;
+      resultDecoderByAggregate.set(aggregate.id, decoder);
+      resultDecoderSources.push(...emitDartUsdaResultDecoder(decoder));
+    }
+  }
   const conflictAggregateType = (aggregateId: string): string => {
     const aggregate = aggById.get(aggregateId);
     if (aggregate === undefined) {
@@ -371,9 +1021,9 @@ export function generateDartBridgeClient(
       : aggregateId;
   };
 
-  // ROLE SUGAR — the `canEdit<Agg>`/`canView<Agg>` UI-hint helpers live HERE (the client package, which may
-  // import runtime), NOT in the pure types file: they `jsonDecode` the folded RelationTuple leaf, and the
-  // layered types-package purity gate forbids `dart:convert`. Empty ⇒ no roles (era-safe; no extra import).
+  // ROLE SUGAR — the `canEdit<Agg>`/`canView<Agg>` UI-hint helpers consume the generated
+  // RelationTuple/RelationshipSubject types from the composed framework graph. They are informational;
+  // the kernel still owns authorization.
   const roleHelpers = dartRoleHelpers(mod);
 
   // THE E2E-SEALING MAP (the sealing client) — non-null iff a field is `.encrypted()`. When null NOTHING
@@ -407,9 +1057,7 @@ export function generateDartBridgeClient(
     `[${scopes
       .map(
         (s) =>
-          `{${dartStr("scope")}: ${dartStr(s.scope)}${
-            s.owned === true ? `, ${dartStr("owned")}: true` : ""
-          }}`
+          `(scope: ${dartStr(s.scope)}, owned: ${s.owned === true})`
       )
       .join(", ")}]`;
   const needsReadPrincipal = (typeId: string): boolean => {
@@ -499,16 +1147,6 @@ export function generateDartBridgeClient(
         ];
       })
   );
-  const ownedActionsDart = `{${Object.entries(ownedActions)
-    .map(
-      ([type, actions]) =>
-        `${dartStr(type)}: {${Object.entries(actions)
-          .map(
-            ([action, directive]) => `${dartStr(action)}: ${dartStr(directive)}`
-          )
-          .join(", ")}}`
-    )
-    .join(", ")}}`;
   if (ownedScope !== undefined && Object.keys(ownedActions).length > 0) {
     methods.push(
       `  /// Share one record. The peer can read its history and future changes; Nomos owns the keys and policy.`,
@@ -531,9 +1169,8 @@ export function generateDartBridgeClient(
   )?.interfaceHash;
 
   // ── directives → typed offer ──
-  // A `.births()` directive (birthsChild === true) is NOT a same-workspace write — it is a signed
-  // cross-workspace governance offer to a PARENT. It gets a typed `bridge.createWorkspace(...)` wrapper
-  // (below), NOT an `offerOutcome`; excluded here so a frontend dev can never call it as a local write.
+  // A `.births()` directive is still authored on its bound parent workspace. It therefore uses the
+  // same typed USDA/Protobuf offer door as every other directive; only the law's effect crosses custody.
   const allDirs = (mod.directives as AnyDirective[]).filter(
     (d) =>
       d &&
@@ -547,6 +1184,410 @@ export function generateDartBridgeClient(
   const dirs = allDirs.filter(
     (d) => (d as { birthsChild?: boolean }).birthsChild !== true
   );
+  const authenticationRecoveryDirs = dirs.filter(
+    (directive) =>
+      isBusinessIntent(directive) &&
+      directive.offerAuthenticationProof === "enrolledDevice"
+  );
+  if (authenticationRecoveryDirs.length > 1) {
+    throw new Error(
+      `Dart client codegen: '${domain}' declares more than one enrolled-device authentication recovery intent; ` +
+        "the framework cannot choose a unique law-authored recovery operation"
+    );
+  }
+  const authenticationRecovery = authenticationRecoveryDirs[0];
+  if (
+    authenticationRecovery !== undefined &&
+    introspectPayload(
+      authenticationRecovery.payloadSchema as z.ZodTypeAny,
+      enumDartTypes
+    ).length !== 0
+  ) {
+    throw new Error(
+      `Dart client codegen: '${domain}/${authenticationRecovery.id}' is the automatic enrolled-device ` +
+        "authentication recovery intent and therefore must accept an empty payload"
+    );
+  }
+  const localOfferDirs = [...dirs, ...birthDirs];
+  const sourceTrustViaIds = new Set(
+    dirs.flatMap((directive) =>
+      directive.businessSourceTrust === undefined
+        ? []
+        : [directive.businessSourceTrust.viaDirectiveId]
+    )
+  );
+  const sourceTrustDirectives = authoredDirectives.filter((directive) =>
+    sourceTrustViaIds.has(directive.id)
+  );
+  for (const viaDirectiveId of sourceTrustViaIds) {
+    if (
+      !sourceTrustDirectives.some(
+        (directive) => directive.id === viaDirectiveId
+      )
+    ) {
+      throw new Error(
+        `Dart source-trust codegen: '${domain}' has no hidden directive '${viaDirectiveId}'`
+      );
+    }
+  }
+  const encoderDirs = [
+    ...new Map(
+      [
+        ...localOfferDirs,
+        ...sourceTrustDirectives,
+        ...workspaceSharingReceipts,
+      ].map((directive) => [directive.id, directive] as const)
+    ).values(),
+  ];
+  const callEncoderSources: string[] = [];
+  const callEncoderByDirective = new Map<
+    string,
+    { readonly functionName: string; readonly arguments: readonly string[] }
+  >();
+  const internalRecordTypes = new Map<string, string>();
+  for (const directive of encoderDirs) {
+    const compilerInternal =
+      sourceTrustViaIds.has(directive.id) ||
+      workspaceSharingReceiptIds.has(directive.id);
+    const businessBirth = (
+      directive as unknown as {
+        businessBirth?: { publicPayloadSchema: z.ZodTypeAny };
+      }
+    ).businessBirth;
+    const specs = introspectPayload(
+      businessBirth?.publicPayloadSchema ??
+        (directive.payloadSchema as z.ZodTypeAny),
+      enumDartTypes
+    );
+    const payloadClass = compilerInternal
+      ? `({${specs
+          .map((spec) => `${spec.dartType}${spec.optional ? "?" : ""} ${dartMemberName(spec.name)}`)
+          .join(", ")}})`
+      : dartActionInputClassName(directive);
+    if (compilerInternal) internalRecordTypes.set(directive.id, payloadClass);
+    const specsByName = new Map(specs.map((spec) => [spec.name, spec]));
+    const access = new Map<string, DartCallUsdaFieldAccess>();
+    for (const spec of specs) {
+      access.set(
+        spec.name,
+        dartCallUsdaFieldAccess(domain, directive.id, spec)
+      );
+    }
+    const extraParameters: string[] = [];
+    const arguments_: string[] = [];
+    const targetBinding = directive.targetBinding;
+    if (targetBinding !== undefined) {
+      const targetType = `NomosRef<${concreteClassName(
+        targetBinding.aggregateId
+      )}>`;
+      extraParameters.push(`${targetType} nmsInternalTarget`);
+      arguments_.push("target");
+      access.set(targetBinding.field, {
+        value: "NmsInternalNomosRefs.id(nmsInternalTarget)",
+      });
+    }
+    if (directive.businessPrincipalField !== undefined) {
+      extraParameters.push("String nmsInternalPrincipal");
+      arguments_.push("nmsInternalPrincipal");
+      access.set(directive.businessPrincipalField, {
+        value: "nmsInternalPrincipal",
+      });
+    }
+    if (businessBirth !== undefined) {
+      extraParameters.push(
+        "String nmsInternalBirthPrincipal",
+        "String nmsInternalBornAt"
+      );
+      arguments_.push("principal", "bornAt");
+      access.set("principal", { value: "nmsInternalBirthPrincipal" });
+      access.set("bornAt", { value: "nmsInternalBornAt" });
+    }
+    for (const input of dartBusinessRecordInputs(directive, mod.aggregates)) {
+      const origin = `NmsInternalRecordOrigins.require(payload.${input.argument})`;
+      access.set(input.idField, { value: `${origin}.id` });
+      access.set(input.workspaceField, { value: `${origin}.workspace` });
+    }
+    for (const input of dartForeignReferenceInputs(directive, mod.aggregates)) {
+      const member = `payload.${dartMemberName(input.idField)}`;
+      const reference = input.optional ? `${member}.referenceOrNull!` : member;
+      const present = input.optional
+        ? { present: `${member}.referenceOrNull != null` }
+        : {};
+      access.set(input.idField, {
+        value: `NmsInternalNomosRefs.id(${reference})`,
+        ...present,
+      });
+      access.set(input.workspaceField, {
+        value: `NmsInternalNomosRefs.workspace(${reference})`,
+        ...(input.optional
+          ? present
+          : specsByName.get(input.workspaceField)?.optional === true
+            ? { present: "true" }
+            : {}),
+      });
+    }
+    const stamps = autoStampFields(
+      directive.payloadSchema as z.ZodTypeAny
+    ).filter(
+      (stamp) =>
+        !(
+          (directive as { businessBirth?: unknown }).businessBirth !==
+            undefined && stamp === "bornAt"
+        )
+    );
+    if (stamps.length > 0) {
+      extraParameters.push("String nmsInternalNow");
+      arguments_.push("now");
+      for (const stamp of stamps) {
+        access.set(stamp, {
+          // Some compiler-owned birth payloads deliberately retain a required
+          // timestamp constructor even though ordinary generated action inputs
+          // expose caller-clock fields as optional sugar. Widen explicitly so
+          // the one canonical encoder is analyzer-clean in both cases.
+          value: `(payload.${dartMemberName(
+            stamp
+          )} as String?) ?? nmsInternalNow`,
+          present: "true",
+        });
+      }
+    }
+    const directiveEncryption = encMap?.directives?.[directive.id];
+    if (directiveEncryption !== undefined) {
+      for (const field of Object.keys(directiveEncryption).sort()) {
+        const spec = specsByName.get(field);
+        if (spec === undefined) {
+          throw new Error(
+            `Dart call USDA codegen: encrypted field '${domain}/${directive.id}.${field}' is absent from its typed payload`
+          );
+        }
+        if (spec.dartType.replace("?", "") !== "String") {
+          throw new Error(
+            `Dart call USDA codegen: encrypted field '${domain}/${directive.id}.${field}' has Dart type '${spec.dartType}'. ` +
+              "Ciphertext is a string, so the law must declare a string-valued encrypted boundary."
+          );
+        }
+        const sealed = dartSealedValueName(field);
+        extraParameters.push(
+          `${spec.optional ? "String?" : "String"} ${sealed}`
+        );
+        arguments_.push(sealed);
+        access.set(field, {
+          value: spec.optional ? `${sealed}!` : sealed,
+          ...(spec.optional ? { present: `${sealed} != null` } : {}),
+        });
+      }
+      if (
+        Object.values(directiveEncryption).some((field) => field.owned === true)
+      ) {
+        extraParameters.push(
+          "String? nmsInternalOwnedKeySubject",
+          "OwnedCustody? nmsInternalOwnedCustody",
+          "List<({String type, String id})>? nmsInternalOwnedPreMintedRecords"
+        );
+        arguments_.push(
+          "nmsInternalOwnedKeySubject",
+          "nmsInternalOwnedCustody",
+          "nmsInternalOwnedPreMintedRecords"
+        );
+        access.set(OWNED_KEY_PAYLOAD_FIELD, {
+          value: "nmsInternalOwnedKeySubject!",
+          present: "nmsInternalOwnedKeySubject != null",
+        });
+        access.set(OWNED_CUSTODY_PAYLOAD_FIELD, {
+          value: "nmsInternalOwnedCustody!",
+          present: "nmsInternalOwnedCustody != null",
+        });
+        access.set(OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD, {
+          value: "nmsInternalOwnedPreMintedRecords!",
+          present: "nmsInternalOwnedPreMintedRecords != null",
+        });
+      }
+      if (businessBirth !== undefined) {
+        const carrierFields = [
+          ...specs.map(
+            (spec) => `${spec.dartType} ${dartMemberName(spec.name)}`
+          ),
+          "String principal",
+          "String bornAt",
+          `String? ${dartMemberName(OWNED_KEY_PAYLOAD_FIELD)}`,
+          `OwnedCustody? ${dartMemberName(OWNED_CUSTODY_PAYLOAD_FIELD)}`,
+          `List<({String type, String id})>? ${dartMemberName(
+            OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD
+          )}`,
+        ];
+        extraParameters.push(
+          `({${carrierFields.join(", ")}}) nmsInternalBirthSeed`
+        );
+        arguments_.push("nmsInternalBirthSeed");
+        access.set(BUSINESS_BIRTH_SEED_PAYLOAD_FIELD, {
+          value: "nmsInternalBirthSeed",
+        });
+      }
+    }
+    const encoder = emitDartCallUsdaEncoder(
+      callUsda.graph,
+      callUsda.paths,
+      domain,
+      directive.id,
+      payloadClass,
+      access,
+      extraParameters
+    );
+    callEncoderSources.push(...encoder.source);
+    callEncoderByDirective.set(directive.id, {
+      functionName: encoder.functionName,
+      arguments: arguments_,
+    });
+  }
+  for (const directive of sourceTrustDirectives) {
+    const encoder = callEncoderByDirective.get(directive.id);
+    const payloadType = internalRecordTypes.get(directive.id);
+    if (
+      encoder === undefined ||
+      payloadType === undefined ||
+      encoder.arguments.length !== 0
+    ) {
+      throw new Error(
+        `Dart source-trust codegen: hidden directive '${domain}/${directive.id}' is not a closed typed record`
+      );
+    }
+    methods.push(
+      `  /// @internal Compiler-generated source-trust offer. Domain code supplies one exact typed record.`,
+      `  Future<NomosOfferOutcome> ${dartInternalSourceTrustMethod(
+        directive.id
+      )}(${payloadType} payload) =>`,
+      `      _offer(${encoder.functionName}(payload));`,
+      ``
+    );
+  }
+  for (const directive of workspaceSharingReceipts) {
+    const encoder = callEncoderByDirective.get(directive.id);
+    const payloadType = internalRecordTypes.get(directive.id);
+    if (
+      encoder === undefined ||
+      payloadType === undefined ||
+      encoder.arguments.some((argument) => argument !== "now")
+    ) {
+      throw new Error(
+        `Dart workspace-sharing codegen: hidden receipt '${domain}/${directive.id}' is not a closed typed record`
+      );
+    }
+    const method = dartInternalWorkspaceSharingReceiptMethod(directive.id);
+    const implementation =
+      encoder.arguments.length === 0
+        ? `=>\n      _offer(${encoder.functionName}(payload));`
+        : `{\n    final now = DateTime.now().toUtc().toIso8601String();\n    return _offer(${encoder.functionName}(payload, now));\n  }`;
+    methods.push(
+      `  /// @internal Compiler-generated workspace-sharing receipt. Not tenant application vocabulary.`,
+      `  Future<NomosOfferOutcome> ${method}(${payloadType} payload) ${implementation}`,
+      ``
+    );
+  }
+  const ownedActionCallEncoders = new Map<
+    string,
+    {
+      readonly action: "share" | "unshare" | "transfer";
+      readonly functionName: string;
+      readonly payloadType: string;
+    }
+  >();
+  let ownedDeviceApprovalCallEncoder: string | undefined;
+  if (ownedScope !== undefined && Object.keys(ownedActions).length > 0) {
+    const ownedAccess = (
+      fields: readonly string[]
+    ): Map<string, DartCallUsdaFieldAccess> => {
+      const access = new Map<string, DartCallUsdaFieldAccess>();
+      for (const field of fields) {
+        access.set(field, { value: `payload.${dartMemberName(field)}` });
+      }
+      access.set(OWNED_KEY_PAYLOAD_FIELD, {
+        value: "payload.ownedKeySubject",
+        present: "true",
+      });
+      access.set(OWNED_CUSTODY_PAYLOAD_FIELD, {
+        value: "payload.ownedCustody!",
+        present: "payload.ownedCustody != null",
+      });
+      access.set(OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD, {
+        value: "const <({String type, String id})>[]",
+        omit: true,
+      });
+      return access;
+    };
+    const payloadTypes = {
+      share: "NomosOwnedSharePreparation",
+      unshare: "NomosOwnedUnsharePreparation",
+      transfer: "NomosOwnedTransferPreparation",
+    } as const;
+    const payloadFields = {
+      share: ["recordId", "peer", "epoch", "sharedAt", "wraps"],
+      unshare: ["recordId", "peer", "epoch", "changedAt", "wraps"],
+      transfer: [
+        "recordId",
+        "newOwner",
+        "previousReaders",
+        "epoch",
+        "changedAt",
+        "historicWraps",
+      ],
+    } as const;
+    for (const actions of Object.values(ownedActions)) {
+      for (const action of ["share", "unshare", "transfer"] as const) {
+        const directiveId = actions[action];
+        const encoder = emitDartCallUsdaEncoder(
+          callUsda.graph,
+          callUsda.paths,
+          domain,
+          directiveId,
+          payloadTypes[action],
+          ownedAccess(payloadFields[action])
+        );
+        callEncoderSources.push(...encoder.source);
+        ownedActionCallEncoders.set(directiveId, {
+          action,
+          functionName: encoder.functionName,
+          payloadType: payloadTypes[action],
+        });
+      }
+    }
+    const approvalEncoder = emitDartCallUsdaEncoder(
+      callUsda.graph,
+      callUsda.paths,
+      domain,
+      OWNED_DEVICE_APPROVAL_DIRECTIVE,
+      "NomosOwnedDeviceApprovalPreparation",
+      new Map<string, DartCallUsdaFieldAccess>([
+        ["newKeySubject", { value: "payload.newKeySubject" }],
+        ["ownedCustody", { value: "payload.ownedCustody" }],
+        ["verifiedVia", { value: "payload.verifiedVia" }],
+        ["validFromEpoch", { value: "payload.validFromEpoch" }],
+        ["approvedAt", { value: "payload.approvedAt" }],
+        [
+          OWNED_KEY_PAYLOAD_FIELD,
+          {
+            value: "payload.ownedKeySubject",
+            present: "true",
+          },
+        ],
+        [
+          OWNED_CUSTODY_PAYLOAD_FIELD,
+          {
+            value: "payload.ownedCustody",
+            present: "true",
+          },
+        ],
+        [
+          OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD,
+          {
+            value: "const <({String type, String id})>[]",
+            omit: true,
+          },
+        ],
+      ])
+    );
+    callEncoderSources.push(...approvalEncoder.source);
+    ownedDeviceApprovalCallEncoder = approvalEncoder.functionName;
+  }
   const correctionActions = dirs.filter(
     (d) => (d as { businessBirth?: unknown }).businessBirth === undefined
   );
@@ -597,13 +1638,17 @@ export function generateDartBridgeClient(
     // targetBinding is declared on AnyDirective (directive.ts) — honour it for EVERY
     // directive, exactly as the application surface does (a split here emits a 2-arg
     // application call against a 1-arg client method: generated Dart that cannot compile).
-    const targetBinding = (d as { targetBinding?: import("./directive.js").DirectiveTargetBinding }).targetBinding;
-    const targetType = targetBinding === undefined
-      ? undefined
-      : `NomosRef<${concreteClassName(targetBinding.aggregateId)}>`;
-    const actionParameters = targetBinding === undefined
-      ? `${payloadClass} payload`
-      : `${targetType} target, ${payloadClass} payload`;
+    const targetBinding = (
+      d as { targetBinding?: import("./directive.js").DirectiveTargetBinding }
+    ).targetBinding;
+    const targetType =
+      targetBinding === undefined
+        ? undefined
+        : `NomosRef<${concreteClassName(targetBinding.aggregateId)}>`;
+    const actionParameters =
+      targetBinding === undefined
+        ? `${payloadClass} payload`
+        : `${targetType} target, ${payloadClass} payload`;
     const stamps = autoStampFields(
       (d as unknown as { payloadSchema: z.ZodTypeAny }).payloadSchema
     );
@@ -638,7 +1683,6 @@ export function generateDartBridgeClient(
             (d as { aggregateId?: string }).aggregateId ?? "aggregate"
           } id inside the sealed intent — it rides back on \`outcome.created\` (no id in the payload, no query-after).`
         : "";
-    const recordInputs = dartBusinessRecordInputs(d, mod.aggregates);
     const principalField = d.businessPrincipalField;
     const principalPrelude =
       principalField === undefined
@@ -653,24 +1697,21 @@ export function generateDartBridgeClient(
             )}, requires: 'the signed-in Nomos principal');`,
             `    }`,
           ];
-    const payloadJsonArgs = [
-      ...(targetBinding === undefined
-        ? []
-        : ["nmsInternalTarget: target"]),
-      ...(principalField === undefined
-        ? []
-        : ["nmsInternalPrincipal: nmsInternalPrincipal"]),
-      ...(recordInputs.length === 0
-        ? []
-        : [
-            "nmsInternalLocationOf: (record) => NmsInternalRecordOrigins.require(record).workspace",
-            "nmsInternalIdOf: (record) => NmsInternalRecordOrigins.require(record).id",
-          ]),
-    ];
-    const payloadJson =
-      payloadJsonArgs.length === 0
-        ? "payload.nmsInternalToPayloadJson()"
-        : `payload.nmsInternalToPayloadJson(${payloadJsonArgs.join(", ")})`;
+    const callEncoder = callEncoderByDirective.get(d.id);
+    if (callEncoder === undefined) {
+      throw new Error(
+        `Dart call USDA codegen: '${domain}/${d.id}' has no generated encoder`
+      );
+    }
+    const callUsda = `${callEncoder.functionName}(${[
+      "payload",
+      ...callEncoder.arguments,
+    ].join(", ")})`;
+    const offerCall = `_offer(${callUsda}${
+      isBusinessIntent(d) && d.offerAuthenticationProof === "enrolledDevice"
+        ? ", authenticationProof: NomosOfferAuthenticationProof.enrolledDevice"
+        : ""
+    })`;
     const stampsDoc =
       stamps.length > 0
         ? `\n  /// Omitted ${stamps
@@ -701,6 +1742,11 @@ export function generateDartBridgeClient(
           : isNamespacedAggregate(targetAggregate)
           ? qualifyReadProjectionType(domain, targetAggregate.id)
           : targetAggregate.id;
+      const encryptedSpecs = new Map(
+        introspectPayload(d.payloadSchema as z.ZodTypeAny, enumDartTypes).map(
+          (spec) => [spec.name, spec]
+        )
+      );
       const recordPrelude =
         recordTarget === undefined || runtimeType === undefined
           ? []
@@ -713,9 +1759,18 @@ export function generateDartBridgeClient(
           : recordTarget.kind === "payload"
           ? [
               `    final ownedRecordType = ${dartStr(runtimeType)};`,
-              `    final ownedRecordId = (data[${dartStr(
-                recordTarget.field
-              )}] ?? '').toString();`,
+              `    final ownedRecordId = ${
+                dartCallUsdaFieldAccess(
+                  domain,
+                  d.id,
+                  encryptedSpecs.get(recordTarget.field) ??
+                    (() => {
+                      throw new Error(
+                        `dart codegen: owned record field '${domain}/${d.id}.${recordTarget.field}' is absent from the typed payload`
+                      );
+                    })()
+                ).value
+              }.toString();`,
               `    const ownedRecordPreMinted = false;`,
             ]
           : [
@@ -723,6 +1778,97 @@ export function generateDartBridgeClient(
               `    final ownedRecordId = ${dartStr(recordTarget.id)};`,
               `    const ownedRecordPreMinted = false;`,
             ];
+      const ownedKeyPrelude = ownedSeal
+        ? [
+            ...recordPrelude,
+            `    final nmsInternalOwnedKey = await bridge.nomosOwnedScopeKey(`,
+            `        ${dartStr(Object.values(directiveEncryption)[0]!.scope)},`,
+            `        recordType: ownedRecordType, recordId: ownedRecordId);`,
+            `    final nmsInternalOwnedKeySubject = nmsInternalOwnedKey.ownedKeySubject;`,
+            `    if (nmsInternalOwnedKeySubject == null || nmsInternalOwnedKeySubject.isEmpty) {`,
+            `      throw StateError('Nomos did not return the framework-owned device identity for .owned() custody');`,
+            `    }`,
+            `    final nmsInternalOwnedCustody = nmsInternalOwnedKey.ownedCustody;`,
+            ...(recordTarget?.kind === "premint"
+              ? [
+                  `    final nmsInternalOwnedPreMintedRecords = <({String type, String id})>[`,
+                  `      (type: ownedRecordType, id: ownedRecordId),`,
+                  `    ];`,
+                ]
+              : [
+                  `    const List<({String type, String id})>? nmsInternalOwnedPreMintedRecords = null;`,
+                ]),
+          ]
+        : [];
+      const sealPrelude = Object.entries(directiveEncryption)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .flatMap(([field, descriptor]) => {
+          const spec = encryptedSpecs.get(field);
+          if (spec === undefined) {
+            throw new Error(
+              `dart codegen: encrypted field '${domain}/${d.id}.${field}' is absent from the typed payload`
+            );
+          }
+          if (spec.dartType.replace("?", "") !== "String") {
+            throw new Error(
+              `dart codegen: encrypted field '${domain}/${d.id}.${field}' must be String, got '${spec.dartType}'`
+            );
+          }
+          const member = `payload.${dartMemberName(field)}`;
+          const sealed = dartSealedValueName(field);
+          const key = dartSealKeyName(field);
+          const sealValue = [
+            `      final ${key} = ${
+              descriptor.owned === true
+                ? "nmsInternalOwnedKey"
+                : `keyStore == null ? null : await keyStore!.scopeKey(${dartStr(
+                    descriptor.scope
+                  )})`
+            };`,
+            `      if (${key} == null) throw EncryptionKeyUnavailable(${dartStr(
+              descriptor.scope
+            )}, ${dartStr(field)});`,
+            `      ${sealed} = await bridge.cryptoSealField(`,
+            `        scopeKey: ${key}.key, scope: ${
+              descriptor.owned === true
+                ? `${key}.scope`
+                : dartStr(descriptor.scope)
+            }, epoch: ${key}.epoch,`,
+            `        aggSid: ${dartStr(descriptor.aggSid)}, fieldSid: ${dartStr(
+              descriptor.fieldSid
+            )},`,
+            `        plaintext: ${member},`,
+            `      );`,
+          ];
+          if (spec.optional) {
+            return [
+              `    String? ${sealed};`,
+              `    if (${member} != null) {`,
+              ...(ownedSeal
+                ? sealValue
+                : [
+                    `      if (!seal) {`,
+                    `        ${sealed} = ${member};`,
+                    `      } else {`,
+                    ...sealValue.map((line) => `  ${line}`),
+                    `      }`,
+                  ]),
+              `    }`,
+            ];
+          }
+          return [
+            `    late final String ${sealed};`,
+            ...(ownedSeal
+              ? [`    {`, ...sealValue, `    }`]
+              : [
+                  `    if (!seal) {`,
+                  `      ${sealed} = ${member};`,
+                  `    } else {`,
+                  ...sealValue.map((line) => `  ${line}`),
+                  `    }`,
+                ]),
+          ];
+        });
       methods.push(
         `  /// Author \`${domain}/${d.id}\` locally under the installed law; returns the typed [NomosOfferOutcome].${createsDoc}`,
         `  /// ${
@@ -736,24 +1882,12 @@ export function generateDartBridgeClient(
         }) async {`,
         ...(gateGuard ? [gateGuard] : []),
         ...principalPrelude,
-        `    final data = ${payloadJson};`,
         ...(stamps.length > 0
-          ? [
-              `    final now = DateTime.now().toUtc().toIso8601String();`,
-              ...stamps.map(
-                (s) => `    data.putIfAbsent(${dartStr(s)}, () => now);`
-              ),
-            ]
+          ? [`    final now = DateTime.now().toUtc().toIso8601String();`]
           : []),
-        ...recordPrelude,
-        `    await _sealPayload(data, ${dartStr(d.id)}, ${
-          ownedSeal ? "true" : "seal"
-        }${
-          ownedSeal
-            ? ", null, ownedRecordType, ownedRecordId, ownedRecordPreMinted"
-            : ""
-        });`,
-        `    return _offer(${dartStr(d.id)}, data);`,
+        ...ownedKeyPrelude,
+        ...sealPrelude,
+        `    return ${offerCall};`,
         `  }`,
         ``
       );
@@ -766,10 +1900,8 @@ export function generateDartBridgeClient(
         `  Future<NomosOfferOutcome> ${method}(${actionParameters}) {`,
         ...(gateGuard ? [gateGuard] : []),
         ...principalPrelude,
-        `    final data = ${payloadJson};`,
         `    final now = DateTime.now().toUtc().toIso8601String();`,
-        ...stamps.map((s) => `    data.putIfAbsent(${dartStr(s)}, () => now);`),
-        `    return _offer(${dartStr(d.id)}, data);`,
+        `    return ${offerCall};`,
         `  }`,
         ``
       );
@@ -782,7 +1914,7 @@ export function generateDartBridgeClient(
         `  Future<NomosOfferOutcome> ${method}(${actionParameters}) {`,
         ...(gateGuard ? [gateGuard] : []),
         ...principalPrelude,
-        `    return _offer(${dartStr(d.id)}, ${payloadJson});`,
+        `    return ${offerCall};`,
         `  }`,
         ``
       );
@@ -791,7 +1923,7 @@ export function generateDartBridgeClient(
         `  /// Author \`${domain}/${d.id}\` locally under the installed law; returns the typed [NomosOfferOutcome].${createsDoc}`,
         ...(gateDoc ? [gateDoc] : []),
         `  Future<NomosOfferOutcome> ${method}(${actionParameters}) =>`,
-        `      _offer(${dartStr(d.id)}, ${payloadJson});`,
+        `      ${offerCall};`,
         ``
       );
     }
@@ -823,6 +1955,16 @@ export function generateDartBridgeClient(
     ).businessBirth;
     const payloadClass = dartActionInputClassName(d);
     if (businessBirth !== undefined) {
+      const birthCallEncoder = callEncoderByDirective.get(d.id);
+      if (birthCallEncoder === undefined) {
+        throw new Error(
+          `Dart call USDA codegen: '${domain}/${d.id}' has no generated birth encoder`
+        );
+      }
+      const birthCallUsda = `${birthCallEncoder.functionName}(${[
+        "payload",
+        ...birthCallEncoder.arguments,
+      ].join(", ")})`;
       const seedDirectiveId =
         businessBirth.seedDirectiveId ??
         `nomosSeed${businessBirth.aggregateId.replace(/[^A-Za-z0-9]/g, "")}`;
@@ -839,16 +1981,131 @@ export function generateDartBridgeClient(
       const birthAggregate = (mod.aggregates as AggregateHandle[]).find(
         (aggregate) => aggregate.id === businessBirth.aggregateId
       );
-      const birthRuntimeType = birthAggregate === undefined
-        ? undefined
-        : isNamespacedAggregate(birthAggregate)
+      const birthRuntimeType =
+        birthAggregate === undefined
+          ? undefined
+          : isNamespacedAggregate(birthAggregate)
           ? qualifyReadProjectionType(domain, birthAggregate.id)
           : birthAggregate.id;
-      if (ownedBirthDescriptor !== undefined && birthRuntimeType === undefined) {
+      if (
+        ownedBirthDescriptor !== undefined &&
+        birthRuntimeType === undefined
+      ) {
         throw new Error(
           `codegen: cannot derive the record identity for encrypted owned birth '${domain}/${d.id}'`
         );
       }
+      const birthSpecs = introspectPayload(
+        businessBirth.publicPayloadSchema,
+        enumDartTypes
+      );
+      const birthSpecsByName = new Map(
+        birthSpecs.map((spec) => [spec.name, spec])
+      );
+      const ownedBirthPrelude =
+        ownedBirthDescriptor === undefined
+          ? []
+          : [
+              `    final nmsInternalOwnedKey = await bridge.nomosOwnedBirthScopeKey(`,
+              `        ${dartStr(ownedBirthDescriptor.scope)}, ${dartStr(
+                businessBirth.namespace
+              )}, payload.${dartMemberName(businessBirth.keyField)}, ${dartStr(
+                birthRuntimeType!
+              )}, ${dartStr(businessBirth.rootId)});`,
+              `    final nmsInternalOwnedKeySubject = nmsInternalOwnedKey.ownedKeySubject;`,
+              `    if (nmsInternalOwnedKeySubject == null || nmsInternalOwnedKeySubject.isEmpty) {`,
+              `      throw StateError('Nomos did not return the framework-owned device identity for .owned() custody');`,
+              `    }`,
+              `    final nmsInternalOwnedCustody = nmsInternalOwnedKey.ownedCustody;`,
+              `    const List<({String type, String id})>? nmsInternalOwnedPreMintedRecords = null;`,
+            ];
+      const birthSealPrelude =
+        birthEncryption === undefined
+          ? []
+          : Object.entries(birthEncryption)
+              .sort(([left], [right]) => left.localeCompare(right))
+              .flatMap(([field, descriptor]) => {
+                const spec = birthSpecsByName.get(field);
+                if (
+                  spec === undefined ||
+                  spec.dartType.replace("?", "") !== "String"
+                ) {
+                  throw new Error(
+                    `dart codegen: encrypted birth field '${domain}/${d.id}.${field}' must be a typed String payload field`
+                  );
+                }
+                const member = `payload.${dartMemberName(field)}`;
+                const sealed = dartSealedValueName(field);
+                const key = dartSealKeyName(field);
+                const sealValue = [
+                  `      final ${key} = ${
+                    descriptor.owned === true
+                      ? "nmsInternalOwnedKey"
+                      : `keyStore == null ? null : await keyStore!.scopeKey(${dartStr(
+                          descriptor.scope
+                        )})`
+                  };`,
+                  `      if (${key} == null) throw EncryptionKeyUnavailable(${dartStr(
+                    descriptor.scope
+                  )}, ${dartStr(field)});`,
+                  `      ${sealed} = await bridge.cryptoSealField(`,
+                  `        scopeKey: ${key}.key, scope: ${
+                    descriptor.owned === true
+                      ? `${key}.scope`
+                      : dartStr(descriptor.scope)
+                  }, epoch: ${key}.epoch,`,
+                  `        aggSid: ${dartStr(
+                    descriptor.aggSid
+                  )}, fieldSid: ${dartStr(descriptor.fieldSid)},`,
+                  `        plaintext: ${member},`,
+                  `      );`,
+                ];
+                if (spec.optional) {
+                  return [
+                    `    String? ${sealed};`,
+                    `    if (${member} != null) {`,
+                    ...sealValue,
+                    `    }`,
+                  ];
+                }
+                return [
+                  `    late final String ${sealed};`,
+                  `    {`,
+                  ...sealValue,
+                  `    }`,
+                ];
+              });
+      const birthSeedFields =
+        birthEncryption === undefined
+          ? []
+          : [
+              ...birthSpecs.map((spec) => {
+                const value =
+                  birthEncryption[spec.name] === undefined
+                    ? `payload.${dartMemberName(spec.name)}`
+                    : dartSealedValueName(spec.name);
+                return `      ${dartMemberName(spec.name)}: ${value},`;
+              }),
+              `      principal: principal,`,
+              `      bornAt: bornAt,`,
+              `      ${dartMemberName(OWNED_KEY_PAYLOAD_FIELD)}: ${
+                ownedBirthDescriptor === undefined
+                  ? "null"
+                  : "nmsInternalOwnedKeySubject"
+              },`,
+              `      ${dartMemberName(OWNED_CUSTODY_PAYLOAD_FIELD)}: ${
+                ownedBirthDescriptor === undefined
+                  ? "null"
+                  : "nmsInternalOwnedCustody"
+              },`,
+              `      ${dartMemberName(
+                OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD
+              )}: ${
+                ownedBirthDescriptor === undefined
+                  ? "null"
+                  : "nmsInternalOwnedPreMintedRecords"
+              },`,
+            ];
       methods.push(
         `  /// Give one ${businessBirth.aggregateId} its own durable life. Nomos owns identity, authorship,`,
         `  /// provenance, persistence and recovery; the app supplies only business facts.`,
@@ -884,38 +2141,17 @@ export function generateDartBridgeClient(
                   )}, packageHash: ${hashConst});`
               ),
             ]),
-        `    final data = payload.nmsInternalToPayloadJson();`,
-        ...(ownedBirthDescriptor === undefined
-          ? []
-          : [
-              `    final ownedBirthKey = await bridge.nomosOwnedBirthScopeKey(`,
-              `        ${dartStr(ownedBirthDescriptor.scope)}, ${dartStr(
-                businessBirth.namespace
-              )}, data[${dartStr(businessBirth.keyField)}], ${dartStr(
-                birthRuntimeType!
-              )}, ${dartStr(businessBirth.rootId)});`,
-            ]),
+        `    final bornAt = DateTime.now().toUtc().toIso8601String();`,
+        ...ownedBirthPrelude,
+        ...birthSealPrelude,
         ...(birthEncryption === undefined
           ? []
           : [
-              `    final sealedGenesis = Map<String, dynamic>.from(data);`,
-              `    await _sealPayload(sealedGenesis, ${dartStr(d.id)}, true${
-                ownedBirthDescriptor === undefined ? "" : ", ownedBirthKey"
-              });`,
-              `    data[${dartStr(
-                BUSINESS_BIRTH_SEED_PAYLOAD_FIELD
-              )}] = jsonEncode(sealedGenesis);`,
-              ...(ownedBirthDescriptor === undefined
-                ? []
-                : [
-                    `    data[${dartStr(
-                      OWNED_KEY_PAYLOAD_FIELD
-                    )}] = ownedBirthKey.ownedKeySubject;`,
-                  ]),
+              `    final nmsInternalBirthSeed = (`,
+              ...birthSeedFields,
+              `    );`,
             ]),
-        `    data['principal'] = principal;`,
-        `    data['bornAt'] = DateTime.now().toUtc().toIso8601String();`,
-        `    final outcome = await _offer(${dartStr(d.id)}, data);`,
+        `    final outcome = await _offer(${birthCallUsda});`,
         `    if (outcome.born.length != 1) {`,
         `      throw StateError('birth() committed without returning exactly one born workspace '
             '(born: \${outcome.born}, birthOutcomes: \${outcome.birthOutcomes}, head: \${outcome.head})');`,
@@ -923,7 +2159,7 @@ export function generateDartBridgeClient(
         ...(ownedBirthDescriptor === undefined
           ? []
           : [
-              `    if (ownedBirthKey.workspace == null || outcome.born.single != ownedBirthKey.workspace) {`,
+              `    if (nmsInternalOwnedKey.workspace == null || outcome.born.single != nmsInternalOwnedKey.workspace) {`,
               `      throw StateError('birth() returned a workspace different from the deterministic owned-custody address');`,
               `    }`,
             ]),
@@ -940,78 +2176,38 @@ export function generateDartBridgeClient(
       );
       continue;
     }
+    const ordinaryBirthEncoder = callEncoderByDirective.get(d.id);
+    if (ordinaryBirthEncoder === undefined) {
+      throw new Error(
+        `Dart call USDA codegen: '${domain}/${d.id}' has no generated birth encoder`
+      );
+    }
+    const ordinaryBirthCallUsda = `${ordinaryBirthEncoder.functionName}(${[
+      "payload",
+      ...ordinaryBirthEncoder.arguments,
+    ].join(", ")})`;
+    const ordinaryBirthStamps = autoStampFields(
+      d.payloadSchema as z.ZodTypeAny
+    );
     methods.push(
-      `  /// Births a CHILD WORKSPACE named by \`${payloadClass}\` — a \`.births()\` offer on THIS client's`,
-      `  /// session, whose workspace IS the parent (session_bound_clients.md ask 4: no loose parent string).`,
-      `  /// Returns the typed [NomosOfferOutcome]: \`outcome.born\` names the child, \`outcome.bornRefs\` are`,
-      `  /// followable — \`final child = await engine.follow(outcome.bornRefs.single);\` mounts it, typed`,
-      `  /// client construction is then \`await ChildClient.bind(child)\`. [actor] (a [NomosPrincipal])`,
-      `  /// overrides this client's own \`actor\` for the offer.`,
-      `  ///`,
-      `  /// COMPATIBILITY SHIM (one minor version): passing the deprecated [parent] with a workspace that is`,
-      `  /// NOT this session's routes the old SIGNED cross-workspace gateway relay`,
-      `  /// (POST /v2/workspaces/<parent>/${d.id}); its verdict rides \`outcome.gatewayVerdict\`. [authorSecret]/`,
-      `  /// [authToken] only apply on that legacy lane.`,
-      `  Future<NomosOfferOutcome> ${method}({`,
-      `    required ${payloadClass} payload,`,
-      `    NomosPrincipal? actor,`,
-      `    @Deprecated('the birth parent IS the session workspace — bind this client to the PARENT session '`,
-      `        '(session_bound_clients.md ask 4); an explicit different parent rides the legacy gateway relay '`,
-      `        'one more minor version') String? parent,`,
-      `    NomosDeviceSecret? authorSecret,`,
-      `    String? authToken,`,
-      `  }) async {`,
-      `    final ws = _ws;`,
-      `    final explicitParent = parent;`,
-      `    if (explicitParent != null && explicitParent.isNotEmpty && explicitParent != ws) {`,
-      `      // LEGACY GATEWAY SHIM — the pre-session-bound cross-workspace relay, delegated unchanged.`,
-      `      if (actor == null) {`,
-      `        throw MissingOfferAuthority(domain: ${dartStr(
-        domain
-      )}, directiveId: ${dartStr(
-        d.id
-      )}, requires: 'a requesting principal (actor) on the legacy parent-relay lane');`,
-      `      }`,
-      `      final verdict = await bridge.createWorkspace(`,
-      `        domain: ${dartStr(domain)},`,
-      `        directiveId: ${dartStr(d.id)},`,
-      `        domainHash: domainHash,`,
-      `        parent: explicitParent,`,
-      `        actor: actor.wire,`,
-      `        authorSecret: authorSecret?.wire,`,
-      `        payload: payload.nmsInternalToPayloadJson(),`,
-      `        authToken: authToken,`,
-      `      );`,
-      `      return NomosOfferOutcome(`,
-      `          head: (verdict['head'] ?? '').toString(),`,
-      `          created: const [],`,
-      `          workspace: explicitParent,`,
-      `          gatewayVerdict: verdict);`,
-      `    }`,
-      `    if (ws.isEmpty) {`,
-      `      throw StateError(`,
-      `          '${method}: bind this client to the PARENT NomosSession (${className}.bind(session)) — '`,
-      `          'the birth parent IS the session workspace, never a loose string');`,
-      `    }`,
-      `    final effActor = actor?.wire ?? this.actor;`,
-      ...(gate !== undefined
-        ? [
-            `    if (effActor == null || effActor.trim().isEmpty) {`,
+      `  /// Birth a child from this client's bound parent session through the same typed offer door as`,
+      `  /// every other directive. Parent address, signing authority and custody stay session-bound.`,
+      `  Future<NomosOfferOutcome> ${method}(${payloadClass} payload) async {`,
+      ...(gate === undefined
+        ? []
+        : [
+            `    if (actor == null || actor!.trim().isEmpty) {`,
             `      throw MissingOfferAuthority(domain: ${dartStr(
               domain
             )}, directiveId: ${dartStr(d.id)}, requires: ${dartStr(
               gate.relation
             )});`,
             `    }`,
-          ]
-        : []),
-      `    await _preflightOnce();`,
-      `    await _prepareCommand(${dartStr(d.id)});`,
-      `    return bridge.offerOutcome(domain: ${dartStr(
-        domain
-      )}, directiveId: ${dartStr(
-        d.id
-      )}, payload: payload.nmsInternalToPayloadJson(), actor: effActor, domainHash: domainHash);`,
+          ]),
+      ...(ordinaryBirthStamps.length === 0
+        ? []
+        : [`    final now = DateTime.now().toUtc().toIso8601String();`]),
+      `    return _offer(${ordinaryBirthCallUsda});`,
       `  }`,
       ``
     );
@@ -1022,27 +2218,56 @@ export function generateDartBridgeClient(
     const model = readModelClassName(q.returns);
     const agg = aggById.get(q.returns);
     const params = q.key
-      .map((k) => `required ${dartKeyType(agg, k, enumDartTypes)} ${dartKeyParam(k)}`)
+      .map(
+        (k) =>
+          `required ${dartKeyType(agg, k, enumDartTypes)} ${dartKeyParam(k)}`
+      )
       .join(", ");
-    const argMap = `{${q.key
-      .map((k) => `${dartStr(k)}: ${dartKeyExpr(agg, k)}`)
-      .join(", ")}}`;
+    const queryEncoder = emitDartQueryUsdaEncoder(
+      callUsda.graph,
+      callUsda.paths,
+      domain,
+      q.id,
+      q.key.map((key) => ({
+        authoredPath: key,
+        name: dartKeyParam(key),
+        type:
+          dartKeyType(agg, key, enumDartTypes) === "int"
+            ? "int"
+            : dartKeyType(agg, key, enumDartTypes) === "bool"
+            ? "bool"
+            : "String",
+        value: dartKeyExpr(agg, key),
+        kind: queryScalarKind(agg, key),
+      }))
+    );
+    callEncoderSources.push(...queryEncoder.source);
+    const queryCall = queryEncoder.call;
     const m = safeMethod(lcFirst(camel(q.id)));
     const qScopes = readScopesFor(q.returns);
     const qOwned = qScopes.some((scope) => scope.owned === true);
     const qPrivate = needsReadPrincipal(q.returns);
     const qScopesExpr = scopesExpr(qScopes);
+    const nominalWatch = qOwned
+      ? `bridge.nmsWatchUsda(${queryCall}${
+          qPrivate ? ", principal: actor" : ""
+        }).asyncMap((_) => _readWithOwnedKeys(${qScopesExpr}, (keys) async => _nmsDecode${model}Rows(await bridge.nmsQueryUsda(${queryCall}, keys${
+          qPrivate ? ", actor" : ""
+        }), _ws), (row) => row.ref))`
+      : qScopes.length
+      ? `Stream.fromFuture(_readKeys(${qScopesExpr})).asyncExpand((keys) => bridge.nmsWatchUsda(${queryCall}, keys: keys${
+          qPrivate ? ", principal: actor" : ""
+        }).map((usda) => _nmsDecode${model}Rows(usda, _ws)))`
+      : `bridge.nmsWatchUsda(${queryCall}${
+          qPrivate ? ", principal: actor" : ""
+        }).map((usda) => _nmsDecode${model}Rows(usda, _ws))`;
     const pageRead = qOwned
-      ? `_readWithOwnedKeys(${qScopesExpr}, (keys) => bridge.queryPage(${dartStr(
-          q.id
-        )}, params: ${argMap}, pageSize: pageSize, cursor: cursor, keys: keys${
+      ? `_readPageWithOwnedKeys(${qScopesExpr}, (keys) async => _nmsDecode${model}Page(await bridge.nmsQueryPageUsda(${queryCall}, pageSize: pageSize, cursor: cursor, keys: keys${
           qPrivate ? ", principal: actor" : ""
-        }))`
-      : `bridge.queryPage(${dartStr(
-          q.id
-        )}, params: ${argMap}, pageSize: pageSize, cursor: cursor${
+        }), _ws), (row) => row.ref)`
+      : `_nmsDecode${model}Page(await bridge.nmsQueryPageUsda(${queryCall}, pageSize: pageSize, cursor: cursor${
           qScopes.length ? `, keys: await _readKeys(${qScopesExpr})` : ""
-        }${qPrivate ? ", principal: actor" : ""})`;
+        }${qPrivate ? ", principal: actor" : ""}), _ws)`;
     methods.push(
       `  /// Declared query \`${q.id}\` as one complete result set.${
         readScopesFor(q.returns).length
@@ -1052,64 +2277,36 @@ export function generateDartBridgeClient(
       `  @Deprecated('Whole-result reads scale with result size; use ${m}Page().')`,
       `  Future<List<${model}>> ${m}({${params}}) async =>`,
       qOwned
-        ? `      (await _readWithOwnedKeys(${qScopesExpr}, (keys) => bridge.query(${dartStr(
-            q.id
-          )}, ${argMap}, keys${
+        ? `      _readWithOwnedKeys(${qScopesExpr}, (keys) async => _nmsDecode${model}Rows(await bridge.nmsQueryUsda(${queryCall}, keys${
             qPrivate ? ", actor" : ""
-          }))).map((r) => ${rowToModel(model, "r")}).toList();`
-        : `      (await bridge.query(${dartStr(q.id)}, ${argMap}${keysArg(
+          }), _ws), (row) => row.ref);`
+        : `      _nmsDecode${model}Rows(await bridge.nmsQueryUsda(${queryCall}${keysArg(
             q.returns
-          )})).map((r) => ${rowToModel(model, "r")}).toList();`,
+          )}), _ws);`,
       ``,
       `  /// One bounded \`${q.id}\` page. The opaque [cursor] is returned unchanged by [NomosPage].`,
       `  Future<NomosPage<${model}>> ${m}Page({${params}${
         params ? ", " : ""
       }int pageSize = 100, String? cursor}) async {`,
       `    final page = await ${pageRead};`,
-      `    return NomosPage<${model}>(`,
-      `      rows: page.rows.map((r) => ${rowToModel(model, "r")}).toList(),`,
-      `      cursor: page.cursor,`,
-      `      done: page.done,`,
-      `    );`,
+      `    return page;`,
       `  }`,
       ``,
       `  /// Reactive \`${q.id}\` — re-emits on every local change (cancel the subscription to stop).`,
       `  Stream<List<${model}>> watch${cap(camel(q.id))}({${params}}) =>`,
-      qOwned
-        ? `      bridge.watch(${dartStr(q.id)}, ${argMap}, null${
-            qPrivate ? ", actor" : ""
-          }).asyncMap((_) => _readWithOwnedKeys(${qScopesExpr}, (keys) => bridge.query(${dartStr(
-            q.id
-          )}, ${argMap}, keys${
-            qPrivate ? ", actor" : ""
-          }))).map((rows) => rows.map((r) => ${rowToModel(
-            model,
-            "r"
-          )}).toList());`
-        : `      bridge.watch(${dartStr(q.id)}, ${argMap}${
-            qPrivate ? ", null, actor" : ""
-          }).map((rows) => rows.map((r) => ${rowToModel(
-            model,
-            "r"
-          )}).toList());`,
+      `      ${nominalWatch};`,
       ``
     );
     pastMethods.push(
       `  /// Declared query \`${q.id}\` in the verified world at [moment].`,
       `  Future<List<${model}>> ${m}({${params}}) async =>`,
       qOwned
-        ? `      (await _client._readWithOwnedKeys(${qScopesExpr}, (keys) => _client.bridge.queryAt(moment, ${dartStr(
-            q.id
-          )}, ${argMap}, keys${
+        ? `      _client._readWithOwnedKeys(${qScopesExpr}, (keys) async => _nmsDecode${model}Rows(await _client.bridge.nmsQueryAtUsda(moment, ${queryCall}, keys${
             qPrivate ? ", _client.actor" : ""
-          }))).map((r) => ${rowToModel(model, "r", "_client._ws")}).toList();`
-        : `      (await _client.bridge.queryAt(moment, ${dartStr(
-            q.id
-          )}, ${argMap}${pastKeysArg(q.returns)})).map((r) => ${rowToModel(
-            model,
-            "r",
-            "_client._ws"
-          )}).toList();`,
+          }), _client._ws), (row) => row.ref);`
+        : `      _nmsDecode${model}Rows(await _client.bridge.nmsQueryAtUsda(moment, ${queryCall}${pastKeysArg(
+            q.returns
+          )}), _client._ws);`,
       ``
     );
   }
@@ -1126,20 +2323,17 @@ export function generateDartBridgeClient(
       `  /// Declared spatial index \`${sp.id}\` — rows of \`${sp.of}\` whose \`${sp.on}\` geometry`,
       `  /// intersects [bbox] (an R*Tree probe on the local projection, never a scan).`,
       `  Future<List<${model}>> ${m}({required NomosBbox bbox}) async =>`,
-      `      (await bridge.spatialWithin(${dartStr(
+      `      _nmsDecode${model}Rows(await bridge.nmsSpatialWithinUsda(${dartStr(
         sp.id
-      )}, bbox)).map((r) => ${rowToModel(model, "r")}).toList();`,
+      )}, bbox), _ws);`,
       ``,
       `  /// Reactive \`${sp.id}\` — re-emits when the probe's rows change locally.`,
       `  Stream<List<${model}>> watch${cap(
         camel(sp.id)
       )}({required NomosBbox bbox}) =>`,
-      `      bridge.watchSpatial(${dartStr(
+      `      bridge.nmsWatchSpatialUsda(${dartStr(
         sp.id
-      )}, bbox).map((rows) => rows.map((r) => ${rowToModel(
-        model,
-        "r"
-      )}).toList());`,
+      )}, bbox).map((usda) => _nmsDecode${model}Rows(usda, _ws));`,
       ``
     );
   }
@@ -1157,10 +2351,10 @@ export function generateDartBridgeClient(
             c.by
           }\`.\n  Future<int> ${m}(${groupType} ${dartKeyParam(
             c.by
-          )}) => bridge.count(${dartStr(c.id)}, ${groupValue});`
+          )}) => bridge.nmsCount(${dartStr(c.id)}, ${groupValue});`
         : `  /// Declared count \`${
             c.id
-          }\` — the maintained O(1) grand total.\n  Future<int> ${m}() => bridge.count(${dartStr(
+          }\` — the maintained O(1) grand total.\n  Future<int> ${m}() => bridge.nmsCount(${dartStr(
             c.id
           )});`,
       ``
@@ -1171,12 +2365,12 @@ export function generateDartBridgeClient(
             c.id
           }\` at [moment].\n  Future<int> ${m}(${groupType} ${dartKeyParam(
             c.by
-          )}) => _client.bridge.countAt(moment, ${dartStr(
+          )}) => _client.bridge.nmsCountAt(moment, ${dartStr(
             c.id
           )}, ${groupValue});`
         : `  /// Declared count \`${
             c.id
-          }\` at [moment].\n  Future<int> ${m}() => _client.bridge.countAt(moment, ${dartStr(
+          }\` at [moment].\n  Future<int> ${m}() => _client.bridge.nmsCountAt(moment, ${dartStr(
             c.id
           )});`,
       ``
@@ -1194,10 +2388,10 @@ export function generateDartBridgeClient(
             s.by
           }\`.\n  Future<int> ${m}(${groupType} ${dartKeyParam(
             s.by
-          )}) => bridge.sum(${dartStr(s.id)}, ${groupValue});`
+          )}) => bridge.nmsSum(${dartStr(s.id)}, ${groupValue});`
         : `  /// Declared sum \`${
             s.id
-          }\` — the maintained O(1) grand total.\n  Future<int> ${m}() => bridge.sum(${dartStr(
+          }\` — the maintained O(1) grand total.\n  Future<int> ${m}() => bridge.nmsSum(${dartStr(
             s.id
           )});`,
       ``
@@ -1208,10 +2402,12 @@ export function generateDartBridgeClient(
             s.id
           }\` at [moment].\n  Future<int> ${m}(${groupType} ${dartKeyParam(
             s.by
-          )}) => _client.bridge.sumAt(moment, ${dartStr(s.id)}, ${groupValue});`
+          )}) => _client.bridge.nmsSumAt(moment, ${dartStr(
+            s.id
+          )}, ${groupValue});`
         : `  /// Declared sum \`${
             s.id
-          }\` at [moment].\n  Future<int> ${m}() => _client.bridge.sumAt(moment, ${dartStr(
+          }\` at [moment].\n  Future<int> ${m}() => _client.bridge.nmsSumAt(moment, ${dartStr(
             s.id
           )});`,
       ``
@@ -1231,6 +2427,7 @@ export function generateDartBridgeClient(
     const conflictsClass = `${cap(camel(domain))}Conflicts`;
     const summaryClass = `${cap(camel(domain))}ConflictSummary`;
     const rowClass = `_${cap(camel(domain))}PendingConflictRow`;
+    const evolutionDetailsClass = `${cap(camel(domain))}ConflictEvolution`;
     const aggregateConflictsClass = (aggregateId: string) => {
       const aggregateName = cap(camel(concreteClassName(aggregateId)));
       return aggregateName === cap(camel(domain))
@@ -1250,32 +2447,107 @@ export function generateDartBridgeClient(
       ``,
       `  /// Nomos-internal aggregate-filtered index used only by generated conflict references.`,
       `  Future<List<${rowClass}>> _pendingConflictRows(String aggregateType) async =>`,
-      `      (await bridge.pendingConflictsFor(aggregateType)).map(${rowClass}.fromJson).toList();`,
+      `      NmsUsdaConflictResult.parse(await bridge.nmsPendingConflictsUsda(aggregateType))`,
+      `          .rows.map(${rowClass}.fromUsda).toList(growable: false);`,
       ``
     );
     for (const b of resolverBindings) {
       if (b.valuePayloadField === undefined || b.idPayloadField === undefined)
         continue; // probe couldn't bind — dispatch the directive method directly.
-      const agg = aggById.get(b.aggregateId);
-      const fieldKind = (agg?.fields[b.field] as Field | undefined)?.kind;
-      const mergedType =
-        fieldKind === "string" || fieldKind === "ref" || fieldKind === "enum"
-          ? "String"
-          : fieldKind === "int"
-          ? "int"
-          : fieldKind === "bool"
-          ? "bool"
-          : "Object?";
       const helper = `_merge${cap(
         camel(concreteClassName(b.aggregateId))
       )}${cap(camel(b.field))}`;
       const dir = allDirs.find((d) => d.id === b.directiveId);
-      const gate = (
-        dir as { requiresRelationGate?: { relation: string } } | undefined
-      )?.requiresRelationGate;
+      if (dir === undefined) {
+        throw new Error(
+          `Dart conflict codegen: missing directive '${domain}/${b.directiveId}'`
+        );
+      }
+      const gate = (dir as { requiresRelationGate?: { relation: string } })
+        ?.requiresRelationGate;
+      const targetBinding = dir.targetBinding;
+      if (
+        targetBinding === undefined ||
+        targetBinding.field !== b.idPayloadField
+      ) {
+        throw new Error(
+          `Dart conflict codegen: '${domain}/${b.directiveId}' must expose '${b.idPayloadField}' as its typed target`
+        );
+      }
+      const payloadClass = dartActionInputClassName(dir);
+      const payloadSpecs = introspectPayload(
+        dir.payloadSchema as z.ZodTypeAny,
+        enumDartTypes
+      );
+      const mergedSpec = payloadSpecs.find(
+        (spec) => spec.name === b.valuePayloadField
+      );
+      if (mergedSpec === undefined) {
+        throw new Error(
+          `Dart conflict codegen: '${domain}/${b.directiveId}' has no typed '${b.valuePayloadField}' fact`
+        );
+      }
+      const otherPublicFacts = payloadSpecs.filter(
+        (spec) =>
+          spec.name !== b.valuePayloadField &&
+          spec.name !== b.idPayloadField &&
+          !autoStampFields(dir.payloadSchema as z.ZodTypeAny).includes(spec.name)
+      );
+      const needsTypedDecision = otherPublicFacts.some(
+        (spec) => !spec.optional
+      );
+      const decisionClass = `${cap(
+        camel(concreteClassName(b.aggregateId))
+      )}${cap(camel(b.field))}MergeDecision`;
+      if (needsTypedDecision) {
+        conflictDeclarations.push(
+          `/// Complete typed facts required by \`${domain}/${b.directiveId}\` to resolve one conflict.`,
+          `final class ${decisionClass} {`,
+          `  final ${mergedSpec.dartType} merged;`,
+          ...otherPublicFacts.map(
+            (spec) =>
+              `  final ${spec.dartType} ${dartMemberName(spec.name)};`
+          ),
+          `  const ${decisionClass}({required this.merged, ${otherPublicFacts
+            .map((spec) => `required this.${dartMemberName(spec.name)}`)
+            .join(", ")}});`,
+          `}`,
+          ``
+        );
+      }
+      const encoder = callEncoderByDirective.get(b.directiveId);
+      if (
+        encoder === undefined ||
+        !encoder.arguments.includes("target") ||
+        encoder.arguments.some(
+          (argument) => argument !== "target" && argument !== "now"
+        )
+      ) {
+        throw new Error(
+          `Dart conflict codegen: '${domain}/${b.directiveId}' cannot be reconstructed from one typed target and value`
+        );
+      }
+      const targetClass = concreteClassName(targetBinding.aggregateId);
+      const conflictCall = `${encoder.functionName}(${[
+        "payload",
+        ...encoder.arguments,
+      ].join(", ")})`;
+      const mergedExpression = needsTypedDecision ? "decision.merged" : "merged";
+      const payloadArguments = [
+        `${dartMemberName(b.valuePayloadField)}: ${mergedExpression}`,
+        ...(needsTypedDecision
+          ? otherPublicFacts.map(
+              (spec) =>
+                `${dartMemberName(spec.name)}: decision.${dartMemberName(
+                  spec.name
+                )}`
+            )
+          : []),
+      ];
       methods.push(
-        `  Future<NomosOfferOutcome> ${helper}(${rowClass} conflict, ${mergedType} merged,`,
-        `      {Map<String, Object?> rest = const {}}) {`,
+        `  Future<NomosOfferOutcome> ${helper}(${rowClass} conflict, ${
+          needsTypedDecision ? decisionClass : mergedSpec.dartType
+        } ${needsTypedDecision ? "decision" : "merged"}) {`,
         ...(gate !== undefined
           ? [
               `    if (actor == null || actor!.trim().isEmpty) {`,
@@ -1287,56 +2559,101 @@ export function generateDartBridgeClient(
               `    }`,
             ]
           : []),
-        `    final data = <String, Object?>{...rest, ${dartStr(
-          b.idPayloadField
-        )}: conflict.aggregateId, ${dartStr(b.valuePayloadField)}: merged};`,
-        `    return _offer(${dartStr(
-          b.directiveId
-        )}, data, conflictSnapshots: [<String, Object?>{`,
-        `      'aggregateType': conflict.aggregateType, 'aggregateId': conflict.aggregateId,`,
-        `      'field': conflict.field, 'targetSchema': conflict.targetSchema, 'token': conflict.snapshot,`,
-        `    }]);`,
+        `    final target = NmsInternalNomosRefs.create<${targetClass}>(`,
+        `        workspace: _ws, type: ${dartStr(
+          conflictAggregateType(b.aggregateId)
+        )}, id: conflict.aggregateId);`,
+        `    final payload = ${payloadClass}(${payloadArguments.join(", ")});`,
+        ...(encoder.arguments.includes("now")
+          ? [`    final now = DateTime.now().toUtc().toIso8601String();`]
+          : []),
+        `    return _offer(${conflictCall},`,
+        `      conflictSnapshots: [NomosConflictSnapshot(`,
+        `        aggregateType: ${dartStr(
+          conflictAggregateType(b.aggregateId)
+        )}, aggregateId: conflict.aggregateId,`,
+        `        field_3: ${dartStr(
+          b.field
+        )}, targetSchema: conflict.targetSchema, token: conflict.snapshot,`,
+        `      )],`,
+        `    );`,
         `  }`,
         ``
       );
     }
 
+    const summaryAggregates = [...byAggregate.keys()].map((aggregateId) => {
+      const decoder = resultDecoderByAggregate.get(aggregateId);
+      if (decoder === undefined) {
+        throw new Error(
+          `Dart conflict codegen: '${domain}.${aggregateId}' has no nominal result decoder`
+        );
+      }
+      return {
+        property: safeMethod(lcFirst(camel(concreteClassName(aggregateId)))),
+        aggregatePath: decoder.aggregatePath,
+      };
+    });
     conflictDeclarations.push(
-      `/// Framework conflict row decoded by this generated client. It is local to the`,
-      `/// generated release so schema-aware conflict DX never waits on a core package cast.`,
+      `/// Exact model-evolution evidence for a conflict whose older values cannot yet be`,
+      `/// interpreted as the current generated field type.`,
+      `final class ${evolutionDetailsClass} {`,
+      `  final List<String> sourceSchemas;`,
+      `  final List<String> authoredUnder;`,
+      `  final String reason;`,
+      `  const ${evolutionDetailsClass}({required this.sourceSchemas, required this.authoredUnder, required this.reason});`,
+      `}`,
+      ``,
+      `/// Framework conflict metadata decoded from authenticated USDA. Application values`,
+      `/// remain inside [source] until a generated field decoder consumes them.`,
       `class ${rowClass} {`,
-      `  final String aggregateType;`,
+      `  final String aggregatePath;`,
+      `  final String fieldPath;`,
       `  final String aggregateId;`,
-      `  final String field;`,
       `  final String status;`,
       `  final String targetSchema;`,
-      `  final List<SurfacedObservation<Object?>> observations;`,
-      `  final Map<String, dynamic>? evolution;`,
+      `  final ${evolutionDetailsClass}? evolution;`,
       `  final String snapshot;`,
-      `  const ${rowClass}({required this.aggregateType, required this.aggregateId, required this.field, required this.status, required this.targetSchema, required this.observations, required this.evolution, required this.snapshot});`,
-      `  factory ${rowClass}.fromJson(Map<String, dynamic> json) {`,
-      `    final snapshot = json['snapshot'];`,
-      `    final targetSchema = json['targetSchema'];`,
-      `    if (snapshot is! String || snapshot.isEmpty || targetSchema is! String || targetSchema.isEmpty) {`,
-      `      throw StateError('conflicts need a Nomos runtime with schema-pinned immutable snapshots');`,
+      `  final NmsUsdaPrim source;`,
+      `  const ${rowClass}({required this.aggregatePath, required this.fieldPath, required this.aggregateId, required this.status, required this.targetSchema, required this.evolution, required this.snapshot, required this.source});`,
+      `  factory ${rowClass}.fromUsda(NmsUsdaPrim row) {`,
+      `    if (row.typeName != 'NomosPendingConflict') throw const FormatException('Expected NomosPendingConflict');`,
+      `    final aggregatePath = row.relationship('nomos:type');`,
+      `    final fieldPath = row.relationship('nomos:field');`,
+      `    if (aggregatePath == null || fieldPath == null) throw const FormatException('Conflict has no authenticated law identity');`,
+      `    final status = row.requiredStringProperty('nomos:status');`,
+      `    ${evolutionDetailsClass}? evolution;`,
+      `    if (status == 'evolutionRequired') {`,
+      `      final value = row.requiredChild('Evolution');`,
+      `      evolution = ${evolutionDetailsClass}(`,
+      `        sourceSchemas: value.requiredStringArrayProperty('nomos:sourceSchemas'),`,
+      `        authoredUnder: value.requiredStringArrayProperty('nomos:authoredUnder'),`,
+      `        reason: value.requiredStringProperty('nomos:reason'),`,
+      `      );`,
+      `    } else if (status != 'ready') {`,
+      `      throw FormatException('Unknown conflict status: $status');`,
       `    }`,
       `    return ${rowClass}(`,
-      `      aggregateType: json['aggregateType'] as String, aggregateId: json['aggregateId'] as String,`,
-      `      field: json['field'] as String, status: json['status'] as String? ?? 'evolutionRequired',`,
-      `      targetSchema: targetSchema, snapshot: snapshot,`,
-      `      evolution: (json['evolution'] as Map?)?.cast<String, dynamic>(),`,
-      `      observations: List.unmodifiable((json['observations'] as List? ?? const []).map((o) => SurfacedObservation<Object?>.fromJson((o as Map).cast<String, dynamic>(), (v) => v))),`,
+      `      aggregatePath: aggregatePath, fieldPath: fieldPath,`,
+      `      aggregateId: row.requiredStringProperty('nomos:aggregateId'),`,
+      `      status: status,`,
+      `      targetSchema: row.requiredStringProperty('nomos:targetSchema'),`,
+      `      snapshot: row.requiredStringProperty('nomos:snapshot'),`,
+      `      evolution: evolution, source: row,`,
       `    );`,
       `  }`,
       `}`,
       ``,
-      `/// Workspace-wide pending-merge totals, derived from Nomos's maintained conflict index.`,
+      `/// Workspace-wide pending-merge totals with generated aggregate identities.`,
       `class ${summaryClass} {`,
       `  final int total;`,
       `  final int ready;`,
       `  final int evolutionRequired;`,
-      `  final Map<String, int> byAggregate;`,
-      `  const ${summaryClass}({required this.total, required this.ready, required this.evolutionRequired, required this.byAggregate});`,
+      ...summaryAggregates.map(({ property }) => `  final int ${property};`),
+      `  const ${summaryClass}({required this.total, required this.ready, required this.evolutionRequired, ${summaryAggregates
+        .map(({ property }) => `required this.${property}`)
+        .join(", ")}});`,
+      `  int get modelUpdatesRequired => evolutionRequired;`,
       `}`,
       ``,
       `/// Chained conflict API for the \`${domain}\` domain.`,
@@ -1345,14 +2662,21 @@ export function generateDartBridgeClient(
       `  const ${conflictsClass}(this._client);`,
       ``,
       `  Future<${summaryClass}> summary() async {`,
-      `    final summary = await _client.bridge.pendingConflictSummary();`,
-      `    final byAggregate = (summary['byAggregate'] as Map? ?? const {}).map(`,
-      `        (key, value) => MapEntry(key.toString(), (value as num).toInt()));`,
+      `    final summary = NmsUsdaConflictSummaryResult.parse(`,
+      `        await _client.bridge.nmsPendingConflictSummaryUsda());`,
+      `    int count(String aggregatePath) {`,
+      `      for (final entry in summary.byAggregate) {`,
+      `        if (entry.aggregatePath == aggregatePath) return entry.count;`,
+      `      }`,
+      `      return 0;`,
+      `    }`,
       `    return ${summaryClass}(`,
-      `      total: (summary['total'] as num? ?? 0).toInt(),`,
-      `      ready: (summary['ready'] as num? ?? 0).toInt(),`,
-      `      evolutionRequired: (summary['evolutionRequired'] as num? ?? 0).toInt(),`,
-      `      byAggregate: Map.unmodifiable(byAggregate),`,
+      `      total: summary.total, ready: summary.ready,`,
+      `      evolutionRequired: summary.evolutionRequired,`,
+      ...summaryAggregates.map(
+        ({ property, aggregatePath }) =>
+          `      ${property}: count(${dartStr(aggregatePath)}),`
+      ),
       `    );`,
       `  }`,
       ...[...byAggregate.keys()].map(
@@ -1369,53 +2693,120 @@ export function generateDartBridgeClient(
       const runtimeAggregateType = conflictAggregateType(aggregateId);
       const aggregateName = cap(camel(concreteClassName(aggregateId)));
       const aggregateConflict = `${aggregateName}PendingConflict`;
+      const aggregateDecoder = resultDecoderByAggregate.get(aggregateId);
+      if (aggregateDecoder === undefined) {
+        throw new Error(
+          `Dart conflict codegen: '${domain}.${aggregateId}' has no nominal decoder`
+        );
+      }
       conflictDeclarations.push(
         `/// One pending merge on \`${aggregateId}\`; narrow by subtype to call its typed merge.`,
         `sealed class ${aggregateConflict} {`,
         `  const ${aggregateConflict}();`,
+        `  String get aggregateType => ${dartStr(runtimeAggregateType)};`,
         `  String get aggregateId;`,
         `  String get field;`,
+        `  String get targetSchema;`,
+        `  String get snapshot;`,
         `}`,
         ``
       );
       for (const b of bindings) {
         if (b.valuePayloadField === undefined || b.idPayloadField === undefined)
           continue;
-        const agg = aggById.get(b.aggregateId);
-        const fieldKind = (agg?.fields[b.field] as Field | undefined)?.kind;
-        const mergedType =
-          fieldKind === "string" || fieldKind === "ref" || fieldKind === "enum"
-            ? "String"
-            : fieldKind === "int"
-            ? "int"
-            : fieldKind === "bool"
-            ? "bool"
-            : "Object?";
+        const fieldDecoder = aggregateDecoder.baseFields.find(
+          (field) => field.name === b.field
+        );
+        if (fieldDecoder === undefined) {
+          throw new Error(
+            `Dart conflict codegen: '${domain}.${aggregateId}.${b.field}' has no nominal field decoder`
+          );
+        }
+        const mergedType = fieldDecoder.spec.dartType;
         const typeName = `${aggregateName}${cap(camel(b.field))}Conflict`;
+        const decisionClass = `${aggregateName}${cap(
+          camel(b.field)
+        )}MergeDecision`;
+        const dir = allDirs.find((candidate) => candidate.id === b.directiveId);
+        if (dir === undefined) {
+          throw new Error(
+            `Dart conflict codegen: missing directive '${domain}/${b.directiveId}'`
+          );
+        }
+        const decisionSpecs = introspectPayload(
+          dir.payloadSchema as z.ZodTypeAny,
+          enumDartTypes
+        );
+        const needsTypedDecision = decisionSpecs.some(
+          (spec) =>
+            spec.name !== b.valuePayloadField &&
+            spec.name !== b.idPayloadField &&
+            !autoStampFields(dir.payloadSchema as z.ZodTypeAny).includes(
+              spec.name
+            ) &&
+            !spec.optional
+        );
         const evolutionTypeName = `${aggregateName}${cap(
           camel(b.field)
         )}ConflictEvolutionRequired`;
         const helper = `_merge${aggregateName}${cap(camel(b.field))}`;
+        const versionsDecoder = `_nmsDecode${aggregateName}${cap(
+          camel(b.field)
+        )}ConflictVersions`;
         conflictDeclarations.push(
+          `List<SurfacedObservation<${mergedType}>> ${versionsDecoder}(${rowClass} details, String workspace) {`,
+          `  if (details.status != 'ready' || details.fieldPath != ${dartStr(
+            fieldDecoder.path
+          )}) {`,
+          `    throw const FormatException('Conflict does not match the generated field contract');`,
+          `  }`,
+          `  final observations = details.source.requiredChild('Observations');`,
+          `  if (observations.typeName != 'NomosListValue') throw const FormatException('Conflict observations are not a list');`,
+          `  return List.unmodifiable(observations.children.map((observation) {`,
+          `    if (observation.typeName != 'NomosConflictObservation') throw const FormatException('Malformed conflict observation');`,
+          `    final value = observation.requiredChild('Value');`,
+          `    if (value.relationship('nomos:field') != ${dartStr(
+            fieldDecoder.path
+          )}) throw const FormatException('Conflict value has the wrong law field');`,
+          `    return SurfacedObservation<${mergedType}>(`,
+          `      value: ${dartUsdaBasePresentValue(
+            fieldDecoder.spec,
+            "value",
+            "workspace"
+          )},`,
+          `      occurredAt: Hlc(`,
+          `        physical: observation.requiredIntProperty('nomos:physical'),`,
+          `        logical: observation.requiredIntProperty('nomos:logical'),`,
+          `        replica: observation.requiredIntProperty('nomos:replica'),`,
+          `      ),`,
+          `      author: observation.optionalStringProperty('nomos:author'),`,
+          `    );`,
+          `  }));`,
+          `}`,
+          ``,
           `/// Pending versions of \`${aggregateId}.${b.field}\`. [merge] commits a result that may`,
           `/// equal either version or be a new reconciled business value.`,
           `final class ${typeName} extends ${aggregateConflict} {`,
           `  final ${rowClass} _details;`,
           `  final ${className} _client;`,
-          `  const ${typeName}._(this._details, this._client);`,
+          `  final List<SurfacedObservation<${mergedType}>> versions;`,
+          `  const ${typeName}._(this._details, this._client, this.versions);`,
           `  @override`,
           `  String get aggregateId => _details.aggregateId;`,
           `  @override`,
-          `  String get field => _details.field;`,
-          ``,
-          `  List<SurfacedObservation<${mergedType}>> get versions => List.unmodifiable(`,
-          `      _details.observations.map((o) => SurfacedObservation<${mergedType}>(`,
-          `          value: o.value as ${mergedType}, occurredAt: o.occurredAt, author: o.author)));`,
+          `  String get field => ${dartStr(b.field)};`,
+          `  @override`,
+          `  String get targetSchema => _details.targetSchema;`,
+          `  @override`,
+          `  String get snapshot => _details.snapshot;`,
           ``,
-          `  Future<NomosOfferOutcome> merge(`,
-          `      ${mergedType} Function(List<SurfacedObservation<${mergedType}>> versions) reconcile,`,
-          `      {Map<String, Object?> rest = const {}}) =>`,
-          `      _client.${helper}(_details, reconcile(versions), rest: rest);`,
+          `  Future<void> merge(`,
+          `      ${
+            needsTypedDecision ? decisionClass : mergedType
+          } Function(List<SurfacedObservation<${mergedType}>> versions) reconcile,`,
+          `      ) async {`,
+          `    await _client.${helper}(_details, reconcile(versions));`,
+          `  }`,
           `}`,
           ``,
           `/// The pending values span field schemas. No merge method exists until Nomos can`,
@@ -1426,8 +2817,12 @@ export function generateDartBridgeClient(
           `  @override`,
           `  String get aggregateId => _details.aggregateId;`,
           `  @override`,
-          `  String get field => _details.field;`,
-          `  Map<String, dynamic> get evolution => _details.evolution ?? const {};`,
+          `  String get field => ${dartStr(b.field)};`,
+          `  @override`,
+          `  String get targetSchema => _details.targetSchema;`,
+          `  @override`,
+          `  String get snapshot => _details.snapshot;`,
+          `  ${evolutionDetailsClass} get evolution => _details.evolution!;`,
           `}`,
           ``
         );
@@ -1444,10 +2839,12 @@ export function generateDartBridgeClient(
         )});`,
         `    final out = <${aggregateConflict}>[];`,
         `    for (final row in rows) {`,
-        `      if (row.aggregateType != ${dartStr(runtimeAggregateType)}) {`,
+        `      if (row.aggregatePath != ${dartStr(
+          aggregateDecoder.aggregatePath
+        )}) {`,
         `        throw StateError('Nomos returned a conflict outside the generated aggregate filter');`,
         `      }`,
-        `      switch (row.field) {`,
+        `      switch (row.fieldPath) {`,
         ...bindings.flatMap((b) => {
           if (
             b.valuePayloadField === undefined ||
@@ -1458,10 +2855,21 @@ export function generateDartBridgeClient(
           const evolutionTypeName = `${aggregateName}${cap(
             camel(b.field)
           )}ConflictEvolutionRequired`;
+          const fieldDecoder = aggregateDecoder.baseFields.find(
+            (field) => field.name === b.field
+          );
+          if (fieldDecoder === undefined) {
+            throw new Error(
+              `Dart conflict codegen: '${domain}.${aggregateId}.${b.field}' has no nominal field decoder`
+            );
+          }
+          const versionsDecoder = `_nmsDecode${aggregateName}${cap(
+            camel(b.field)
+          )}ConflictVersions`;
           return [
-            `        case ${dartStr(b.field)}:`,
+            `        case ${dartStr(fieldDecoder.path)}:`,
             `          if (row.status == 'ready') {`,
-            `            out.add(${typeName}._(row, _client));`,
+            `            out.add(${typeName}._(row, _client, ${versionsDecoder}(row, _client._ws)));`,
             `          } else if (row.status == 'evolutionRequired') {`,
             `            out.add(${evolutionTypeName}._(row));`,
             `          } else {`,
@@ -1469,6 +2877,8 @@ export function generateDartBridgeClient(
             `          }`,
           ];
         }),
+        `        default:`,
+        `          throw StateError('Nomos returned a conflict outside the generated field set');`,
         `      }`,
         `    }`,
         `    return List.unmodifiable(out);`,
@@ -1500,9 +2910,9 @@ export function generateDartBridgeClient(
           ? ", null, actor"
           : ""
         : aOwned
-        ? `, await _readKeys(${aScopesExpr}, [{${dartStr("type")}: ${dartStr(
+        ? `, await _readKeys(${aScopesExpr}, [(type: ${dartStr(
             runtimeType
-          )}, ${dartStr("id")}: id}])${aPrivate ? ", actor" : ""}`
+          )}, id: id)])${aPrivate ? ", actor" : ""}`
         : keysArg(agg.id);
     const pastByIdKeys =
       aScopes.length === 0
@@ -1510,12 +2920,40 @@ export function generateDartBridgeClient(
           ? ", null, _client.actor"
           : ""
         : aOwned
-        ? `, await _client._readKeys(${aScopesExpr}, [{${dartStr(
-            "type"
-          )}: ${dartStr(runtimeType)}, ${dartStr("id")}: id}])${
+        ? `, await _client._readKeys(${aScopesExpr}, [(type: ${dartStr(
+            runtimeType
+          )}, id: id)])${
             aPrivate ? ", _client.actor" : ""
           }`
         : pastKeysArg(agg.id);
+    const nominalByIdWatch = aScopes.length
+      ? `Stream.fromFuture(_readKeys(${aScopesExpr}${
+          aOwned
+            ? `, [(type: ${dartStr(runtimeType)}, id: id)]`
+            : ""
+        })).asyncExpand((keys) => bridge.nmsWatchByIdUsda(${dartStr(
+          runtimeType
+        )}, id, keys: keys${
+          aPrivate ? ", principal: actor" : ""
+        }).map((usda) => _nmsDecode${model}Rows(usda, _ws)))`
+      : `bridge.nmsWatchByIdUsda(${dartStr(runtimeType)}, id${
+          aPrivate ? ", principal: actor" : ""
+        }).map((usda) => _nmsDecode${model}Rows(usda, _ws))`;
+    const nominalByTypeWatch = aOwned
+      ? `bridge.nmsWatchByTypeUsda(${dartStr(runtimeType)}${
+          aPrivate ? ", principal: actor" : ""
+        }).asyncMap((_) => _readWithOwnedKeys(${aScopesExpr}, (keys) async => _nmsDecode${model}Rows(await bridge.nmsQueryByTypeUsda(${dartStr(
+          runtimeType
+        )}, keys${aPrivate ? ", actor" : ""}), _ws), (row) => row.ref))`
+      : aScopes.length
+      ? `Stream.fromFuture(_readKeys(${aScopesExpr})).asyncExpand((keys) => bridge.nmsWatchByTypeUsda(${dartStr(
+          runtimeType
+        )}, keys: keys${
+          aPrivate ? ", principal: actor" : ""
+        }).map((usda) => _nmsDecode${model}Rows(usda, _ws)))`
+      : `bridge.nmsWatchByTypeUsda(${dartStr(runtimeType)}${
+          aPrivate ? ", principal: actor" : ""
+        }).map((usda) => _nmsDecode${model}Rows(usda, _ws))`;
     methods.push(
       `  /// Read one ${agg.id} by aggregate id.${
         readScopesFor(agg.id).length
@@ -1523,96 +2961,45 @@ export function generateDartBridgeClient(
           : ""
       }`,
       `  Future<List<${model}>> ${safeMethod(`${lc}ById`)}(String id) async =>`,
-      `      (await bridge.queryById(id${byIdKeys})).map((r) => ${rowToModel(
-        model,
-        "r"
-      )}).toList();`,
+      `      _nmsDecode${model}Rows(await bridge.nmsQueryByIdUsda(${dartStr(
+        runtimeType
+      )}, id${byIdKeys}), _ws);`,
       ``,
       `  /// Watch one ${agg.id} by aggregate id (local reactive read).`,
       `  Stream<List<${model}>> watch${Cap}ById(String id) =>`,
-      aOwned
-        ? `      bridge.watchById(id, null${
-            aPrivate ? ", actor" : ""
-          }).asyncMap((_) async => bridge.queryById(id, await _readKeys(${aScopesExpr}, [{${dartStr(
-            "type"
-          )}: ${dartStr(runtimeType)}, ${dartStr("id")}: id}])${
-            aPrivate ? ", actor" : ""
-          })).map((rows) => rows.map((r) => ${rowToModel(
-            model,
-            "r"
-          )}).toList());`
-        : `      bridge.watchById(id${
-            aPrivate ? ", null, actor" : ""
-          }).map((rows) => rows.map((r) => ${rowToModel(
-            model,
-            "r"
-          )}).toList());`,
+      `      ${nominalByIdWatch};`,
       ``,
       `  /// Every ${agg.id} (the type-index probe — O(result), not a scan).`,
       `  Future<List<${model}>> ${safeMethod(`list${Cap}s`)}() async =>`,
       aOwned
-        ? `      (await _readWithOwnedKeys(${aScopesExpr}, (keys) => bridge.query('aggregatesByType', {'__type': ${dartStr(
+        ? `      _readWithOwnedKeys(${aScopesExpr}, (keys) async => _nmsDecode${model}Rows(await bridge.nmsQueryByTypeUsda(${dartStr(
             runtimeType
-          )}}, keys${aPrivate ? ", actor" : ""}))).map((r) => ${rowToModel(
-            model,
-            "r"
-          )}).toList();`
-        : `      (await bridge.query('aggregatesByType', {'__type': ${dartStr(
+          )}, keys${aPrivate ? ", actor" : ""}), _ws), (row) => row.ref);`
+        : `      _nmsDecode${model}Rows(await bridge.nmsQueryByTypeUsda(${dartStr(
             runtimeType
-          )}}${keysArg(agg.id)})).map((r) => ${rowToModel(
-            model,
-            "r"
-          )}).toList();`,
+          )}${keysArg(agg.id)}), _ws);`,
       ``,
       `  /// Watch every ${agg.id} (the same indexed local read, re-emitted after each change).`,
       `  Stream<List<${model}>> ${safeMethod(`watchAll${Cap}s`)}() =>`,
-      aOwned
-        ? `      bridge.watch('aggregatesByType', {'__type': ${dartStr(
-            runtimeType
-          )}}, null${
-            aPrivate ? ", actor" : ""
-          }).asyncMap((_) => _readWithOwnedKeys(${aScopesExpr}, (keys) => bridge.query('aggregatesByType', {'__type': ${dartStr(
-            runtimeType
-          )}}, keys${
-            aPrivate ? ", actor" : ""
-          }))).map((rows) => rows.map((r) => ${rowToModel(
-            model,
-            "r"
-          )}).toList());`
-        : `      bridge.watch('aggregatesByType', {'__type': ${dartStr(
-            runtimeType
-          )}}${
-            aPrivate ? ", null, actor" : ""
-          }).map((rows) => rows.map((r) => ${rowToModel(
-            model,
-            "r"
-          )}).toList());`,
+      `      ${nominalByTypeWatch};`,
       ``
     );
     pastMethods.push(
       `  /// Read one ${agg.id} by aggregate id in the verified world at [moment].`,
       `  Future<List<${model}>> ${safeMethod(`${lc}ById`)}(String id) async =>`,
-      `      (await _client.bridge.queryByIdAt(moment, id${pastByIdKeys})).map((r) => ${rowToModel(
-        model,
-        "r",
-        "_client._ws"
-      )}).toList();`,
+      `      _nmsDecode${model}Rows(await _client.bridge.nmsQueryByIdAtUsda(moment, ${dartStr(
+        runtimeType
+      )}, id${pastByIdKeys}), _client._ws);`,
       ``,
       `  /// Every ${agg.id} in the verified world at [moment].`,
       `  Future<List<${model}>> ${safeMethod(`list${Cap}s`)}() async =>`,
       aOwned
-        ? `      (await _client._readWithOwnedKeys(${aScopesExpr}, (keys) => _client.bridge.queryAt(moment, 'aggregatesByType', {'__type': ${dartStr(
+        ? `      _client._readWithOwnedKeys(${aScopesExpr}, (keys) async => _nmsDecode${model}Rows(await _client.bridge.nmsQueryByTypeAtUsda(moment, ${dartStr(
             runtimeType
-          )}}, keys${
-            aPrivate ? ", _client.actor" : ""
-          }))).map((r) => ${rowToModel(model, "r", "_client._ws")}).toList();`
-        : `      (await _client.bridge.queryAt(moment, 'aggregatesByType', {'__type': ${dartStr(
+          )}, keys${aPrivate ? ", _client.actor" : ""}), _client._ws), (row) => row.ref);`
+        : `      _nmsDecode${model}Rows(await _client.bridge.nmsQueryByTypeAtUsda(moment, ${dartStr(
             runtimeType
-          )}}${pastKeysArg(agg.id)})).map((r) => ${rowToModel(
-            model,
-            "r",
-            "_client._ws"
-          )}).toList();`,
+          )}${pastKeysArg(agg.id)}), _client._ws);`,
       ``
     );
   }
@@ -1623,73 +3010,48 @@ export function generateDartBridgeClient(
       `  /// difference returns a decision whose accept(reason) re-proves and records the reason.`,
       `  NomosModel get model => NomosModel(_adoptGeneratedModel, _restorePreviousGeneratedModel);`,
       ``,
-      `  NomosModelReview _nomosModelReview(Map<String, Object?>? report) {`,
-      `    final differences = <NomosModelDifference>[];`,
-      `    for (final raw in ((report?['divergences'] as List?) ?? const [])) {`,
-      `      final difference = (raw as Map).cast<String, Object?>();`,
-      `      final rawArea = difference['domain'];`,
-      `      final area = rawArea is String && !rawArea.contains('nomos_internal') ? rawArea : null;`,
-      `      final rawAction = difference['directiveId'];`,
-      `      final action = rawAction is String && !rawAction.contains('nomos_internal') ? rawAction : null;`,
-      `      final rawKind = difference['kind']?.toString();`,
-      `      final kind = rawKind == 'plan-divergence'`,
-      `          ? NomosModelDifferenceKind.outcome`,
-      `          : rawKind == 'unsupported-premise' || rawKind == 'read-conflict'`,
-      `              ? NomosModelDifferenceKind.evidence`,
-      `              : NomosModelDifferenceKind.rules;`,
-      `      final subject = action ?? (kind == NomosModelDifferenceKind.outcome ? 'A business action' : 'A historical action');`,
-      `      final summary = kind == NomosModelDifferenceKind.outcome`,
-      `          ? '\$subject would produce a different result under this model.'`,
-      `          : kind == NomosModelDifferenceKind.evidence`,
-      `              ? 'Nomos could not reproduce all evidence needed by \$subject.'`,
-      `              : "\$subject is not accepted by this model's rules.";`,
-      `      differences.add(NomosModelDifference(kind: kind, area: area, action: action, summary: summary));`,
-      `    }`,
-      `    final evolve = (report?['evolve'] as Map?)?.cast<String, Object?>();`,
-      `    for (final raw in ((evolve?['violations'] as List?) ?? const [])) {`,
-      `      if (raw is! Map) continue;`,
-      `      final violation = raw.cast<String, Object?>();`,
-      `      final rawDomain = violation['domain']?.toString().trim();`,
-      `      final rawDetail = violation['detail']?.toString().trim();`,
-      `      differences.add(NomosModelDifference(`,
-      `        kind: NomosModelDifferenceKind.rules,`,
-      `        area: rawDomain == null || rawDomain.isEmpty ? null : rawDomain,`,
-      `        summary: rawDetail == null || rawDetail.isEmpty`,
-      `            ? 'This model does not declare how to interpret an existing value.'`,
-      `            : rawDetail,`,
-      `      ));`,
-      `    }`,
-      `    if (report != null && evolve?['ok'] != true && !differences.any((d) => d.kind == NomosModelDifferenceKind.rules)) {`,
-      `      differences.add(const NomosModelDifference(kind: NomosModelDifferenceKind.rules, summary: 'This model does not yet explain how to interpret every existing value.'));`,
-      `    }`,
-      `    if (report != null && (report['sourceVerified'] != true || report['complete'] != true)`,
-      `        && !differences.any((d) => d.kind == NomosModelDifferenceKind.evidence)) {`,
-      `      differences.add(const NomosModelDifference(kind: NomosModelDifferenceKind.evidence, summary: 'Nomos could not re-prove every premise in the current business history.'));`,
-      `    }`,
-      `    final projection = (report?['projection'] as Map?)?.cast<String, Object?>();`,
-      `    int number(String name) => (report?[name] as num?)?.toInt() ?? 0;`,
+      `  NomosModelReview _nomosModelReview(ModelLifecycleResponse result) {`,
+      `    final report = result.hasReview() ? result.review : null;`,
       `    return NomosModelReview(`,
-      `      checkedActions: number('replayedIntents'), candidateActions: number('candidateIntents'),`,
-      `      sameOutcome: projection?['equal'] as bool?, differences: differences);`,
+      `      checkedActions: report?.checkedActions.toInt() ?? 0,`,
+      `      candidateActions: report?.candidateActions.toInt() ?? 0,`,
+      `      sameOutcome: report?.hasSameOutcome() == true ? report!.sameOutcome : null,`,
+      `      differences: [`,
+      `        for (final difference in report?.differences ?? const [])`,
+      `          NomosModelDifference(`,
+      `            kind: switch (difference.kind) {`,
+      `              ModelDifferenceKind.MODEL_DIFFERENCE_KIND_RULES => NomosModelDifferenceKind.rules,`,
+      `              ModelDifferenceKind.MODEL_DIFFERENCE_KIND_OUTCOME => NomosModelDifferenceKind.outcome,`,
+      `              ModelDifferenceKind.MODEL_DIFFERENCE_KIND_EVIDENCE => NomosModelDifferenceKind.evidence,`,
+      `              _ => NomosModelDifferenceKind.rules,`,
+      `            },`,
+      `            area: difference.hasArea() ? difference.area : null,`,
+      `            action: difference.hasAction() ? difference.action : null,`,
+      `            summary: difference.summary,`,
+      `          ),`,
+      `      ],`,
+      `    );`,
       `  }`,
       ``,
       `  Future<NomosModelAdoption> _adoptGeneratedModel([String? because]) async {`,
-      `    final raw = await bridge.nomosFrameworkAdoptGeneratedModel(`,
+      `    final result = await bridge.nomosFrameworkAdoptGeneratedModel(`,
       `      domain: ${dartStr(
         domain
       )}, candidateHash: domainHash, because: because);`,
-      `    final reportRaw = raw['report'];`,
-      `    final report = reportRaw is Map ? reportRaw.cast<String, Object?>() : null;`,
-      `    final review = _nomosModelReview(report);`,
-      `    final stage = raw['stage']?.toString();`,
-      `    if (stage == 'promoted' && raw['ok'] == true) {`,
+      `    final review = _nomosModelReview(result);`,
+      `    final stage = result.stage;`,
+      `    if ((stage == ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_PROMOTED ||`,
+      `         stage == ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_ALREADY_CURRENT) && result.accepted) {`,
       `      return NomosModelAdoption.adopted(`,
-      `        summary: 'Nomos proved this model against current history and made it active.', review: review);`,
+      `        summary: stage == ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_PROMOTED`,
+      `            ? 'Nomos proved this model against current history and made it active.'`,
+      `            : 'This workspace already runs this model or a server-side successor.',`,
+      `        review: review);`,
       `    }`,
       ...(opts.lawAssetKey === undefined
         ? []
         : [
-            `    if (stage == 'staging-required') {`,
+            `    if (stage == ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_STAGING_REQUIRED) {`,
             `      return NomosModelAdoption.needsStaging(`,
             `        summary: 'This workspace is running an older model. Stage this generated USDA candidate through the signed workspace gate before reviewing it.',`,
             `        review: review,`,
@@ -1700,24 +3062,17 @@ export function generateDartBridgeClient(
             `      );`,
             `    }`,
           ]),
-      `    if (stage == 'acceptance') {`,
+      `    if (stage == ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_ACCEPTANCE_REQUIRED) {`,
       `      return NomosModelAdoption.needsDecision(`,
       `        summary: 'This model would change prior business outcomes. Review the differences and record why that is intended.',`,
       `        review: review, accept: (reason) => _adoptGeneratedModel(reason));`,
       `    }`,
-      `    final evolve = (report?['evolve'] as Map?)?.cast<String, Object?>();`,
-      `    final rawError = raw['error']?.toString().trim();`,
-      `    final summary = rawError != null && rawError.isNotEmpty`,
+      `    final rawError = result.hasMessage() ? result.message.trim() : '';`,
+      `    final summary = rawError.isNotEmpty`,
       `        ? rawError`,
-      `        : stage == 'identity'`,
+      `        : stage == ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_IDENTITY_REQUIRED`,
       `        ? 'Sign in before adopting this model so the decision is accountable.'`,
-      `        : report != null && report['sourceVerified'] != true`,
-      `            ? 'The current history could not be verified. Nothing changed and the current model remains active.'`,
-      `            : report != null && report['complete'] != true`,
-      `                ? 'Nomos could not re-prove every historical dependency. Nothing changed and the current model remains active.'`,
-      `                : report != null && evolve?['ok'] != true`,
-      `                    ? 'This model cannot yet interpret every existing value. Nothing changed and the current model remains active.'`,
-      `                    : 'The workspace changed or refused this adoption. Nothing changed; ask Nomos to try again.';`,
+      `        : 'The workspace changed or refused this adoption. Nothing changed; ask Nomos to try again.';`,
       `    return NomosModelAdoption.blocked(summary: summary, review: review);`,
       `  }`,
       ``,
@@ -1725,7 +3080,9 @@ export function generateDartBridgeClient(
         ? []
         : [
             `  Future<void> _stageGeneratedModel() async {`,
-            `    final archive = await rootBundle.load(${dartStr(opts.lawAssetKey)});`,
+            `    final archive = await rootBundle.load(${dartStr(
+              opts.lawAssetKey
+            )});`,
             `    await bridge.nomosInternalStageGeneratedModel(`,
             `      domain: ${dartStr(domain)},`,
             `      candidateHash: domainHash,`,
@@ -1736,38 +3093,31 @@ export function generateDartBridgeClient(
             ``,
           ]),
       `  Future<NomosModelRestoration> _restorePreviousGeneratedModel([String? because]) async {`,
-      `    final raw = await bridge.nomosFrameworkRestorePreviousGeneratedModel(`,
+      `    final result = await bridge.nomosFrameworkRestorePreviousGeneratedModel(`,
       `      domain: ${dartStr(
         domain
       )}, currentHash: domainHash, because: because);`,
-      `    final reportRaw = raw['report'];`,
-      `    final report = reportRaw is Map ? reportRaw.cast<String, Object?>() : null;`,
-      `    final review = _nomosModelReview(report);`,
-      `    final stage = raw['stage']?.toString();`,
-      `    if (stage == 'restored' && raw['ok'] == true) {`,
+      `    final review = _nomosModelReview(result);`,
+      `    final stage = result.stage;`,
+      `    if (stage == ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_RESTORED && result.accepted) {`,
       `      return NomosModelRestoration.restored(`,
       `        summary: 'Nomos re-proved current history and restored the previous model.', review: review);`,
       `    }`,
-      `    if (stage == 'acceptance') {`,
+      `    if (stage == ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_ACCEPTANCE_REQUIRED) {`,
       `      return NomosModelRestoration.needsDecision(`,
       `        summary: 'Restoring the previous model changes which rules govern future work. Review the effects and record why restoration is intended.',`,
       `        review: review, accept: (reason) => _restorePreviousGeneratedModel(reason));`,
       `    }`,
-      `    final evolve = (report?['evolve'] as Map?)?.cast<String, Object?>();`,
-      `    final error = raw['error']?.toString();`,
-      `    final summary = stage == 'identity'`,
+      `    final error = result.hasMessage() ? result.message : '';`,
+      `    final summary = stage == ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_IDENTITY_REQUIRED`,
       `        ? 'Sign in before restoring a model so the decision is accountable.'`,
-      `        : error?.contains('restore-no-previous') == true`,
+      `        : error.contains('restore-no-previous')`,
       `            ? 'This is the first model for this business; there is no previous model to restore.'`,
-      `            : error?.contains('restore-current-changed') == true`,
+      `            : error.contains('restore-current-changed')`,
       `                ? 'The current model changed before restoration could finish. Nothing changed; ask Nomos to review again.'`,
-      `                : report != null && report['sourceVerified'] != true`,
-      `                    ? 'The current history could not be verified. Nothing changed and the current model remains active.'`,
-      `                    : report != null && report['complete'] != true`,
-      `                        ? 'Nomos could not re-prove every historical dependency. Nothing changed and the current model remains active.'`,
-      `                        : report != null && evolve?['ok'] != true`,
-      `                            ? 'The previous model cannot safely interpret every existing value. Nothing changed and the current model remains active.'`,
-      `                            : 'The workspace refused restoration. Nothing changed and the current model remains active.';`,
+      `                : error.isNotEmpty`,
+      `                    ? error`,
+      `                    : 'The workspace refused restoration. Nothing changed and the current model remains active.';`,
       `    return NomosModelRestoration.blocked(summary: summary, review: review);`,
       `  }`,
       ``
@@ -2153,13 +3503,48 @@ export function generateDartBridgeClient(
       `        refs: eventRefs(event))).toList();`,
       `      final aggregateTypes = ((model['aggregateTypes'] as List?) ?? const [])`,
       `          .map((raw) => (raw as Map).cast<String, dynamic>()).toList();`,
-      `      for (final conflict in await bridge.pendingConflicts()) {`,
+      `      String? aggregateTypeForConflictPath(String aggregatePath) {`,
+      `        switch (aggregatePath) {`,
+      ...[...resultDecoderByAggregate.values()].map(
+        (decoder) =>
+          `          case ${dartStr(decoder.aggregatePath)}: return ${dartStr(
+            decoder.runtimeType
+          )};`
+      ),
+      `        }`,
+      `        return null;`,
+      `      }`,
+      `      String? fieldNameForConflictPath(String aggregatePath, String fieldPath) {`,
+      `        switch (aggregatePath) {`,
+      ...[...resultDecoderByAggregate.values()].flatMap((decoder) => [
+        `          case ${dartStr(decoder.aggregatePath)}:`,
+        `            switch (fieldPath) {`,
+        ...decoder.baseFields.map(
+          (field) =>
+            `              case ${dartStr(field.path)}: return ${dartStr(
+              field.name
+            )};`
+        ),
+        `            }`,
+        `            return null;`,
+      ]),
+      `        }`,
+      `        return null;`,
+      `      }`,
+      `      final pendingConflicts = NmsUsdaConflictResult.parse(`,
+      `          await bridge.nmsPendingConflictsUsda(null));`,
+      `      for (final conflict in pendingConflicts.rows) {`,
+      `        final aggregatePath = conflict.relationship('nomos:type');`,
+      `        final fieldPath = conflict.relationship('nomos:field');`,
+      `        if (aggregatePath == null || fieldPath == null) continue;`,
+      `        final conflictAggregateType = aggregateTypeForConflictPath(aggregatePath);`,
+      `        final field = fieldNameForConflictPath(aggregatePath, fieldPath);`,
+      `        if (conflictAggregateType == null || field == null) continue;`,
       `        Map<String, dynamic>? aggregate;`,
       `        for (final candidate in aggregateTypes) {`,
-      `          if (candidate['queryType'] == conflict['aggregateType']) { aggregate = candidate; break; }`,
+      `          if (candidate['queryType'] == conflictAggregateType) { aggregate = candidate; break; }`,
       `        }`,
       `        if (aggregate == null) continue;`,
-      `        final field = (conflict['field'] ?? '').toString();`,
       `        final pages = (model['pages'] as Map).cast<String, dynamic>();`,
       `        final ruleItems = (((pages['rules'] as Map)['items'] as List?) ?? const [])`,
       `            .map((raw) => (raw as Map).cast<String, dynamic>());`,
@@ -2167,32 +3552,32 @@ export function generateDartBridgeClient(
       `        final ruleId = '\${aggregate['domain']}.\${aggregate['type']}.$field.merge';`,
       `        for (final candidate in ruleItems) { if (candidate['id'] == ruleId) { rule = candidate; break; } }`,
       `        final subject = rule?['label']?.toString() ?? '\${aggregate['label']} $field';`,
-      `        final status = conflict['status']?.toString() ?? 'ready';`,
+      `        final status = conflict.requiredStringProperty('nomos:status');`,
       `        final versions = status == 'ready'`,
-      `            ? ((conflict['observations'] as List?)?.length ?? 0)`,
-      `            : ((((conflict['evolution'] as Map?)?['sourceSchemas']) as List?)?.length ?? 0);`,
+      `            ? conflict.requiredChild('Observations').children.length`,
+      `            : conflict.requiredChild('Evolution').requiredStringArrayProperty('nomos:sourceSchemas').length;`,
       `        final conflictSummary = status == 'ready'`,
       `            ? '$subject has $versions competing versions waiting for one business merge.'`,
       `            : '$subject cannot yet be compared because the model does not explain every earlier value. The disagreement remains pending while unrelated work continues.';`,
       `        items.add(NomosDescribeItem(`,
       `          kind: status == 'ready' ? 'pending-merge' : 'evolution-required',`,
-      `          id: 'decision:\${aggregate['domain']}.\${aggregate['type']}:\${conflict['aggregateId']}:$field',`,
+      `          id: 'decision:\${aggregate['domain']}.\${aggregate['type']}:\${conflict.requiredStringProperty('nomos:aggregateId')}:$field',`,
       `          label: 'Review $subject', summary: conflictSummary,`,
       `          details: {'domain': aggregate['domain'], 'type': aggregate['type'], 'field': field, 'status': status, 'versions': versions, 'next': status == 'ready' ? 'merge' : 'update-model'},`,
-      `          refs: [NmsInternalNomosRefs.create<Object?>(workspace: _ws, type: aggregate['type'].toString(), id: conflict['aggregateId'].toString())]));`,
+      `          refs: [NmsInternalNomosRefs.create<Object?>(workspace: _ws, type: aggregate['type'].toString(), id: conflict.requiredStringProperty('nomos:aggregateId'))]));`,
       `      }`,
       `      final modelPageItems = ((((model['pages'] as Map)['model'] as Map)['items'] as List?) ?? const [])`,
       `          .map((raw) => (raw as Map).cast<String, dynamic>()).where((item) => item['kind'] == 'verb').toList();`,
       `      for (final entry in await bridge.deadLetters()) {`,
-      `        final domain = entry['domain']; final directive = entry['directiveId'];`,
-      `        if (domain is! String || directive is! String) continue;`,
+      `        if (!entry.hasDomain() || !entry.hasDirective()) continue;`,
+      `        final domain = entry.domain; final directive = entry.directive;`,
       `        Map<String, dynamic>? action;`,
       `        for (final candidate in modelPageItems) { if (candidate['id'] == '$domain.$directive') { action = candidate; break; } }`,
       `        if (action == null) continue;`,
-      `        final reason = refusalReason(entry['error']); final actionLabel = action['label'].toString();`,
-      `        items.add(NomosDescribeItem(kind: 'rejected-action', id: 'rejected:\${entry['id'] ?? entry['oid']}',`,
+      `        final reason = refusalReason(entry.message); final actionLabel = action['label'].toString();`,
+      `        items.add(NomosDescribeItem(kind: 'rejected-action', id: 'rejected:\${entry.hasId() ? entry.id : entry.commitOid}',`,
       `          label: 'Review $actionLabel', summary: refusalSummary(reason, actionLabel),`,
-      `          details: {'domain': domain, 'action': directive, 'status': 'retained', 'reason': reason, 'refusedAt': entry['at'], 'canRetry': true}));`,
+      `          details: {'domain': domain, 'action': directive, 'status': 'retained', 'reason': reason, 'refusedAt': entry.recordedAt, 'canRetry': true}));`,
       `      }`,
       `      final pages = (model['pages'] as Map).cast<String, dynamic>();`,
       `      final rules = ((pages['rules'] as Map)['items'] as List?) ?? const [];`,
@@ -2237,15 +3622,21 @@ export function generateDartBridgeClient(
     // hand-written code, so this file never adds noise to a tenant's analyzer output (co2 feedback).
     // (deprecated_member_use*: the compatibility shims intentionally delegate to the deprecated
     // engine-level lanes for one minor version.)
-    `// ignore_for_file: avoid_dynamic_calls, unnecessary_this, prefer_const_constructors, unused_import, type_annotate_public_apis, always_specify_types, deprecated_member_use, deprecated_member_use_from_same_package, invalid_use_of_internal_member`,
+    `// ignore_for_file: avoid_dynamic_calls, unnecessary_this, unnecessary_cast, prefer_const_constructors, unused_import, unused_local_variable, type_annotate_public_apis, always_specify_types, deprecated_member_use, deprecated_member_use_from_same_package, invalid_use_of_internal_member`,
     ``,
     // `dart:convert` is needed ONLY for the interface block's `jsonDecode` — the offer lane no longer encodes
     // any envelope (it routes through `bridge.offerDirective` → THE ONE ENCODER). Omit it when no interface.
     ...(clientInterface !== undefined ||
-    roleHelpers !== "" ||
-    opts.emitActivity === true
+    opts.emitActivity === true ||
+    localOfferDirs.length > 0 ||
+    callEncoderSources.length > 0
       ? [`import 'dart:convert';`, ``]
       : []),
+    ...(localOfferDirs.length > 0 ||
+    resultDecoderSources.length > 0 ||
+    callEncoderSources.length > 0
+      ? [`import 'dart:typed_data';`, ``]
+      : []),
     `import '${supportImport}';`,
     ...(opts.lawAssetKey !== undefined
       ? [`import 'package:flutter/services.dart' show rootBundle;`]
@@ -2327,12 +3718,16 @@ export function generateDartBridgeClient(
           ``,
         ]
       : []),
+    ...(callEncoderSources.length > 0
+      ? [...DART_CALL_USDA_PRELUDE, ...callEncoderSources]
+      : []),
+    ...resultDecoderSources,
     ...pastDeclarations,
     ...conflictDeclarations,
     `/// Typed async client for the \`${domain}\` domain, bound to a connected [NomosBridge].`,
     `///`,
     `/// Pass \`actor\` (the verified principal uid) to author AS that user — the bridge's \`offerDirective\` op`,
-    `/// carries it through THE ONE ENCODER (\`encodeIntentOfferBytes\` in @githolon/client) as \`security.actor\`,`,
+    `/// carries it with the compiler-generated canonical USDA call as the captured principal,`,
     `/// so the kernel seals it as the captured principal and the ReBAC \`.requires(...)\` gate judges the real`,
     `/// author. A GATED directive (one whose law declares \`.requires(relation)\`) authored with no actor throws`,
     `/// [MissingOfferAuthority] BEFORE any submit — an actorless gated offer can't be constructed. The bridge`,
@@ -2362,7 +3757,14 @@ export function generateDartBridgeClient(
     `  /// structural interface (#72). Consumed by [bind] and by \`session.assertCompatible(${className}.interface)\`.`,
     `  /// Standard OSGi Contract Namespace requirements derived from this law's shape.`,
     `  static const List<Map<String, String>> kernelContracts = [${kernelContracts
-      .map((contract) => `{${dartStr("namespace")}: ${dartStr(contract.namespace)}, ${dartStr("name")}: ${dartStr(contract.name)}, ${dartStr("version")}: ${dartStr(contract.version)}}`)
+      .map(
+        (contract) =>
+          `{${dartStr("namespace")}: ${dartStr(contract.namespace)}, ${dartStr(
+            "name"
+          )}: ${dartStr(contract.name)}, ${dartStr("version")}: ${dartStr(
+            contract.version
+          )}}`
+      )
       .join(", ")}];`,
     ``,
     `  static const NomosClientInterface interface = NomosClientInterface(`,
@@ -2494,7 +3896,9 @@ export function generateDartBridgeClient(
           `      if (bridge is! NomosSession) {`,
           `        throw StateError('Generated child model inheritance needs a bound parent session.');`,
           `      }`,
-          `      final archive = await rootBundle.load(${dartStr(opts.lawAssetKey)});`,
+          `      final archive = await rootBundle.load(${dartStr(
+            opts.lawAssetKey
+          )});`,
           `      await bridge.nomosInternalEnsureGeneratedModelInChild(`,
           `        childWorkspace: ws,`,
           `        domain: interface.domain,`,
@@ -2555,7 +3959,17 @@ export function generateDartBridgeClient(
     ...(ownedScope === undefined || Object.keys(ownedActions).length === 0
       ? []
       : [
-          `  static const Map<String, Map<String, String>> _ownedRecordActions = ${ownedActionsDart};`,
+          `  String? _ownedDirectiveId(String type, String action) => switch ((type, action)) {`,
+          ...Object.entries(ownedActions).flatMap(([type, actions]) =>
+            Object.entries(actions).map(
+              ([action, directiveId]) =>
+                `    (${dartStr(type)}, ${dartStr(action)}) => ${dartStr(
+                  directiveId
+                )},`
+            )
+          ),
+          `    _ => null,`,
+          `  };`,
           `  bool _ownedIdentityReady = false;`,
           `  Future<void> _ensureOwnedIdentity() async {`,
           `    if (_ownedIdentityReady) return;`,
@@ -2569,39 +3983,55 @@ export function generateDartBridgeClient(
           `    await _preflightOnce();`,
           `    await _ensureOwnedIdentity();`,
           `    if (NmsInternalNomosRefs.workspace(record) != _ws) throw ArgumentError('$action() cannot use a record from another workspace');`,
-          `    final directiveId = _ownedRecordActions[NmsInternalNomosRefs.type(record)]?[action];`,
+          `    final directiveId = _ownedDirectiveId(NmsInternalNomosRefs.type(record), action);`,
           `    if (directiveId == null) throw ArgumentError('$action() needs a generated owned record reference');`,
           `    await _prepareCommand(directiveId);`,
           `    if (peer.trim().isEmpty) throw ArgumentError('$action() needs the person to act with');`,
           `    final payload = await bridge.nomosPrepareOwnedRecordAction(action: action, scope: ${dartStr(
             ownedScope
           )}, record: record, peer: peer);`,
-          `    return bridge.offerOutcome(domain: ${dartStr(
-            domain
-          )}, directiveId: directiveId, payload: payload, actor: actor, domainHash: domainHash);`,
+          `    final callUsda = switch (directiveId) {`,
+          ...[...ownedActionCallEncoders.entries()].map(
+            ([directiveId, encoder]) =>
+              `      ${dartStr(directiveId)} => ${
+                encoder.functionName
+              }(payload as ${encoder.payloadType}),`
+          ),
+          `      _ => throw StateError('No generated USDA encoder for owned directive $directiveId'),`,
+          `    };`,
+          `    return _offer(callUsda);`,
           `  }`,
           ``,
         ]),
-    ...(dirs.length > 0 ||
-    birthDirs.some(
-      (d) => (d as { businessBirth?: unknown }).businessBirth !== undefined
-    )
+    ...(callEncoderSources.length > 0
       ? [
           `  /// THE ONE DISPATCH LANE every generated directive method routes through: lazy preflight, then`,
           `  /// the session's offer (the generated-internal use of the engine-level lane).`,
-          `  Future<NomosOfferOutcome> _offer(String directiveId, Object? payload, {List<Map<String, Object?>>? conflictSnapshots}) async {`,
+          `  Future<NomosOfferOutcome> _offer(NmsGeneratedCall call, {List<NomosConflictSnapshot> conflictSnapshots = const [], NomosOfferAuthenticationProof authenticationProof = NomosOfferAuthenticationProof.sessionCredentials}) async {`,
           `    await _preflightOnce();`,
-          `    await _prepareCommand(directiveId);`,
-          `    return bridge.offerOutcome(domain: ${dartStr(
-            domain
-          )}, directiveId: directiveId, payload: payload, actor: actor, domainHash: domainHash, nomosConflictSnapshots: conflictSnapshots);`,
+          `    await _prepareCommand(call.directive);`,
+          `    Future<NomosOfferOutcome> attempt() => bridge.offerCallUsdaOutcome(call: call, actor: actor, domainHash: domainHash, conflictSnapshots: conflictSnapshots, authenticationProof: authenticationProof);`,
+          ...(authenticationRecovery === undefined
+            ? [`    return attempt();`]
+            : [
+                `    if (authenticationProof != NomosOfferAuthenticationProof.sessionCredentials) return attempt();`,
+                `    try {`,
+                `      return await attempt();`,
+                `    } on NomosKernelCallFailure {`,
+                `      final posture = await bridge.nmsAuthenticationPosture(principal: actor);`,
+                `      if (posture.providerToken != NomosProviderTokenVerification.noMatchingKey) rethrow;`,
+                `      await ${safeMethod(authenticationRecovery.id)}(const ${dartActionInputClassName(
+                  authenticationRecovery
+                )}());`,
+                `      await bridge.nmsAwaitAuthenticationReady(principal: actor);`,
+                `      return attempt();`,
+                `    }`,
+              ]),
           `  }`,
           ``,
         ]
       : []),
-    ...(encPresent
-      ? dartEncClassMembers(encMap!, manualEncryptionPresent)
-      : []),
+    ...(encPresent ? dartEncClassMembers(manualEncryptionPresent) : []),
     ...(ownedScope === undefined
       ? []
       : [
@@ -2617,7 +4047,10 @@ export function generateDartBridgeClient(
             domain
           )}, domainHash: domainHash, actor: actor, scope: ${dartStr(
             ownedScope
-          )});`,
+          )},`,
+          `      approvePrepared: (payload) => _offer(`,
+          `        ${ownedDeviceApprovalCallEncoder!}(payload),`,
+          `      ));`,
           ``,
         ]),
     // THE OWNER CEREMONY (slice 2): grantAndWrap / revokeAndRotate / rotate — the operator-blind key-epoch
@@ -2696,80 +4129,17 @@ export function generateDartBridgeClient(
 }
 
 /** The in-class E2E-sealing members: the baked map + the seal/read private helpers. */
-function dartEncClassMembers(
-  encMap: EncDomainMap,
-  manualEncryptionPresent: boolean
-): string[] {
+function dartEncClassMembers(manualEncryptionPresent: boolean): string[] {
   return [
-    `  /// The baked E2E-sealing map (compile-time, from the SAME sids the law was compiled with): which`,
-    `  /// directive payload fields seal → { scope, aggSid, fieldSid }, and which read-model fields decrypt.`,
-    `  static final Map<String, dynamic> encryptionMap = (jsonDecode(${dartRawJson(
-      encMap
-    )}) as Map).cast<String, dynamic>();`,
-    ``,
-    `  /// Seal the mapped encrypted fields of \`data\` in place before dispatch. Ordinary encryption may`,
-    `  /// use the bound keyStore; .owned() keys are held internally by the connected Nomos client.`,
-    `  Future<void> _sealPayload(Map<String, dynamic> data, String directiveId, bool seal, [NomosScopeKey? ownedKeyOverride, String? ownedRecordType, String? ownedRecordId, bool ownedRecordPreMinted = false]) async {`,
-    `    final fields = (encryptionMap['directives'] as Map)[directiveId] as Map?;`,
-    `    if (fields == null) return;`,
-    `    if (!seal) {`,
-    `      if (fields.values.any((raw) => (raw as Map)['owned'] == true)) {`,
-    `        throw StateError('.owned() encryption cannot be disabled');`,
-    `      }`,
-    `      return;`,
-    `    }`,
-    `    NomosScopeKey? ownedKey = ownedKeyOverride;`,
-    `    Map? owned;`,
-    `    for (final raw in fields.values) {`,
-    `      final candidate = raw as Map;`,
-    `      if (candidate['owned'] == true) { owned = candidate; break; }`,
-    `    }`,
-    `    if (owned != null) {`,
-    `      if (ownedKey == null && (ownedRecordType == null || ownedRecordType.isEmpty || ownedRecordId == null || ownedRecordId.isEmpty)) {`,
-    `        throw StateError('Nomos could not derive the owned record identity before sealing; recompile the client and law together');`,
-    `      }`,
-    `      ownedKey ??= await bridge.nomosOwnedScopeKey(owned['scope'] as String, recordType: ownedRecordType, recordId: ownedRecordId);`,
-    `      final subject = ownedKey.ownedKeySubject;`,
-    `      if (subject == null || subject.isEmpty) {`,
-    `        throw StateError('Nomos did not return the framework-owned device identity for .owned() custody');`,
-    `      }`,
-    `      data[${JSON.stringify(OWNED_KEY_PAYLOAD_FIELD)}] = subject;`,
-    `      if (ownedKey.ownedCustody != null && ownedKey.ownedCustody!.isNotEmpty) {`,
-    `        data[${JSON.stringify(
-      OWNED_CUSTODY_PAYLOAD_FIELD
-    )}] = ownedKey.ownedCustody;`,
-    `      }`,
-    `      if (ownedRecordPreMinted) {`,
-    `        data[${JSON.stringify(
-      OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD
-    )}] = [{'type': ownedRecordType, 'id': ownedRecordId}];`,
-    `      }`,
-    `    }`,
-    `    for (final entry in fields.entries) {`,
-    `      final field = entry.key as String;`,
-    `      final m = entry.value as Map;`,
-    `      if (data[field] == null) continue;`,
-    `      final scope = m['scope'] as String;`,
-    `      NomosScopeKey? sk = m['owned'] == true ? ownedKey : ${
-      manualEncryptionPresent
-        ? "keyStore == null ? null : await keyStore!.scopeKey(scope)"
-        : "null"
-    };`,
-    `      if (sk == null) throw EncryptionKeyUnavailable(scope, field);`,
-    `      data[field] = await bridge.cryptoSealField(`,
-    `        scopeKey: sk.key, scope: m['owned'] == true ? sk.scope : scope, epoch: sk.epoch,`,
-    `        aggSid: m['aggSid'] as String, fieldSid: m['fieldSid'] as String,`,
-    `        plaintext: data[field].toString(),`,
-    `      );`,
-    `    }`,
-    `  }`,
-    ``,
     `  /// Read keys for ordinary app-custodied scopes plus framework-custodied .owned() scopes.`,
-    `  Future<List<NomosScopeKey>?> _readKeys(List<Map<String, Object?>> scopes, [List<Map<String, String>> records = const []]) async {`,
+    `  Future<List<NomosScopeKey>?> _readKeys(`,
+    `    List<({String scope, bool owned})> scopes, [`,
+    `    List<({String type, String id})> records = const [],`,
+    `  ]) async {`,
     `    if (scopes.isEmpty) return null;`,
     ...(manualEncryptionPresent
       ? [
-          `    final ordinary = scopes.where((s) => s['owned'] != true).map((s) => s['scope']! as String).toSet().toList();`,
+          `    final ordinary = scopes.where((scope) => !scope.owned).map((scope) => scope.scope).toSet().toList();`,
         ]
       : []),
     `    final keys = ${
@@ -2778,11 +4148,11 @@ function dartEncClassMembers(
         : "<NomosScopeKey>[]"
     };`,
     `    for (final descriptor in scopes) {`,
-    `      if (descriptor['owned'] != true) continue;`,
-    `      final scope = descriptor['scope']! as String;`,
+    `      if (!descriptor.owned) continue;`,
+    `      final scope = descriptor.scope;`,
     `      for (final record in records) {`,
-    `        final type = record['type']!;`,
-    `        final id = record['id']!;`,
+    `        final type = record.type;`,
+    `        final id = record.id;`,
     `        final held = await bridge.nomosOwnedScopeKeys(scope, recordType: type, recordId: id);`,
     `        for (final key in held) {`,
     `          if (!keys.any((candidate) => candidate.scope == key.scope && candidate.epoch == key.epoch)) keys.add(key);`,
@@ -2794,16 +4164,31 @@ function dartEncClassMembers(
     ``,
     `  /// Multi-row owned reads are two local indexed reads: discover only authorized ciphertext rows,`,
     `  /// derive those record keys, then repeat with decryption. No key or crypto concept reaches the app.`,
-    `  Future<List<Map<String, dynamic>>> _readWithOwnedKeys(`,
-    `    List<Map<String, Object?>> scopes,`,
-    `    Future<List<Map<String, dynamic>>> Function(List<NomosScopeKey>? keys) read,`,
+    `  Future<List<TModel>> _readWithOwnedKeys<TModel, TAggregate>(`,
+    `    List<({String scope, bool owned})> scopes,`,
+    `    Future<List<TModel>> Function(List<NomosScopeKey>? keys) read,`,
+    `    NomosRef<TAggregate> Function(TModel row) reference,`,
+    `  ) async {`,
+    `    final first = await read(await _readKeys(scopes));`,
+    `    if (!scopes.any((scope) => scope.owned) || first.isEmpty) return first;`,
+    `    final records = first.map(reference).map((record) => (`,
+    `      type: NmsInternalNomosRefs.type(record),`,
+    `      id: NmsInternalNomosRefs.id(record),`,
+    `    )).toList(growable: false);`,
+    `    return read(await _readKeys(scopes, records));`,
+    `  }`,
+    ``,
+    `  Future<NomosPage<TModel>> _readPageWithOwnedKeys<TModel, TAggregate>(`,
+    `    List<({String scope, bool owned})> scopes,`,
+    `    Future<NomosPage<TModel>> Function(List<NomosScopeKey>? keys) read,`,
+    `    NomosRef<TAggregate> Function(TModel row) reference,`,
     `  ) async {`,
     `    final first = await read(await _readKeys(scopes));`,
-    `    if (!scopes.any((scope) => scope['owned'] == true) || first.isEmpty) return first;`,
-    `    final records = first.map((row) => {`,
-    `      'type': (row['type'] ?? row['__type'] ?? '').toString(),`,
-    `      'id': (row['id'] ?? row['__id'] ?? '').toString(),`,
-    `    }).where((record) => record['type']!.isNotEmpty && record['id']!.isNotEmpty).toList();`,
+    `    if (!scopes.any((scope) => scope.owned) || first.rows.isEmpty) return first;`,
+    `    final records = first.rows.map(reference).map((record) => (`,
+    `      type: NmsInternalNomosRefs.type(record),`,
+    `      id: NmsInternalNomosRefs.id(record),`,
+    `    )).toList(growable: false);`,
     `    return read(await _readKeys(scopes, records));`,
     `  }`,
     ``,