@githolon/dsl 0.108.6 → 0.110.0

package/check_package.mjs

@@ -6,10 +6,10 @@
 
 // `githolon check` launcher — the twin of `compile_package.mjs`: resolve `tsx`
 // (the caller's, else the DSL's own dependency) and run `src/check_package_main.ts`
-// under it (the main dynamically imports the caller's TS domain modules, which
-// needs the tsx ESM loader). Resolution goes through Node's resolver (createRequire),
-// NOT node_modules/.bin paths — hoisted/workspace installs put the bin shims elsewhere.
-import { execFileSync } from "node:child_process";
+// through its ESM loader in this process (the main dynamically imports the caller's
+// TS domain modules, which needs the tsx loader). Resolution goes through Node's
+// resolver (createRequire), NOT node_modules/.bin paths — hoisted/workspace installs
+// put the bin shims elsewhere.
 import { readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import path from "node:path";
@@ -32,15 +32,12 @@ if (!tsxDir) {
   console.error("githolon check: tsx not found — reinstall @githolon/dsl (tsx is one of its dependencies)");
   process.exit(1);
 }
-const tsxPkg = JSON.parse(readFileSync(path.join(tsxDir, "package.json"), "utf8"));
-const tsxBinRel = typeof tsxPkg.bin === "string" ? tsxPkg.bin : tsxPkg.bin?.tsx;
-const tsxCli = path.join(tsxDir, tsxBinRel ?? "dist/cli.mjs");
+const tsxApi = JSON.parse(readFileSync(path.join(tsxDir, "package.json"), "utf8")).exports?.["./esm/api"];
+const tsxApiEntry = path.join(
+  tsxDir,
+  (typeof tsxApi === "string" ? tsxApi : tsxApi?.import?.default ?? tsxApi?.import ?? tsxApi?.default) ?? "dist/esm/api/index.mjs"
+);
 
-try {
-  execFileSync(process.execPath, [tsxCli, MAIN, ...process.argv.slice(2)], {
-    stdio: "inherit",
-    cwd: process.cwd(),
-  });
-} catch (e) {
-  process.exit(e.status ?? 1);
-}
+const { register } = await import(pathToFileURL(tsxApiEntry).href);
+register();
+await import(pathToFileURL(MAIN).href);

package/compile_package.mjs

@@ -7,12 +7,13 @@
 
 // `nomos-compile` / `holon-compile` — the thin launcher: resolve `tsx` (the
 // caller's, else the DSL's own dependency) and run `src/compile_package_main.ts`
-// under it (the main dynamically imports the caller's TS domain modules, which
-// needs the tsx ESM loader). tsx is a regular dependency of @githolon/dsl, so a bare
-// `npx githolon compile` / `npx nomos-compile` works with zero devDependency setup.
-// Resolution goes through Node's resolver (createRequire), NOT node_modules/.bin
-// paths — hoisted/workspace installs put the bin shims elsewhere.
-import { execFileSync } from "node:child_process";
+// through its ESM loader IN THIS PROCESS (the main dynamically imports the caller's
+// TS domain modules, which needs the tsx loader). tsx is a regular dependency of
+// @githolon/dsl, so a bare `npx githolon compile` / `npx nomos-compile` works with
+// zero devDependency setup. Resolution goes through Node's resolver (createRequire),
+// NOT node_modules/.bin paths — hoisted/workspace installs put the bin shims elsewhere.
+// The former `tsx` CLI hop spawned two further node processes per compile (~0.25s
+// of pure startup on every save); `tsImport` keeps one.
 import { existsSync, readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import path from "node:path";
@@ -76,16 +77,14 @@ if (!tsxDir) {
   console.error("nomos-compile: tsx not found — reinstall @githolon/dsl (tsx is one of its dependencies)");
   process.exit(1);
 }
-const tsxPkg = JSON.parse(readFileSync(path.join(tsxDir, "package.json"), "utf8"));
-const tsxBinRel = typeof tsxPkg.bin === "string" ? tsxPkg.bin : tsxPkg.bin?.tsx;
-const tsxCli = path.join(tsxDir, tsxBinRel ?? "dist/cli.mjs");
+const tsxApi = JSON.parse(readFileSync(path.join(tsxDir, "package.json"), "utf8")).exports?.["./esm/api"];
+const tsxApiEntry = path.join(
+  tsxDir,
+  (typeof tsxApi === "string" ? tsxApi : tsxApi?.import?.default ?? tsxApi?.import ?? tsxApi?.default) ?? "dist/esm/api/index.mjs"
+);
 
-try {
-  execFileSync(process.execPath, [tsxCli, MAIN, ...args], {
-    stdio: "inherit",
-    cwd: process.cwd(),
-    env: process.env,
-  });
-} catch (e) {
-  process.exit(e.status ?? 1);
-}
+// Global hooks (not a namespaced `tsImport`): the compiler's `import.meta.url` and every
+// `createRequire` must stay plain file URLs, exactly as under the tsx CLI.
+const { register } = await import(pathToFileURL(tsxApiEntry).href);
+register();
+await import(pathToFileURL(MAIN).href);

package/compile_proof.mjs

@@ -70,7 +70,17 @@ function inventoryIdentity(kind, entries) {
 
 function dependencyPackageFiles(dslDir, cwd) {
   const files = [];
-  for (const name of ["esbuild", "tsx", "typescript", "zod"]) {
+  // These packages contribute executable bytes or generated bindings to compiler output.
+  // Omitting @bufbuild here let an unchanged proof reuse operator bundles produced by an
+  // older Protobuf runtime, even though the newly generated application used the newer one.
+  for (const name of [
+    "@bufbuild/protobuf",
+    "@bufbuild/protoc-gen-es",
+    "esbuild",
+    "tsx",
+    "typescript",
+    "zod",
+  ]) {
     for (const base of [cwd, dslDir]) {
       try {
         const request = createRequire(pathToFileURL(path.join(base, "noop.js")));
@@ -87,6 +97,9 @@ function dependencyPackageFiles(dslDir, cwd) {
 export function compileInputs({ cwd, dslDir, configPath, argumentIdentity }) {
   const authoring = inventory([
     configPath,
+    // An operator may compile an absolute project path from a different repo.
+    // Its sibling sources are inputs too; cwd alone can falsely certify stale law.
+    ...walk(path.dirname(path.resolve(configPath)), (file) => INPUT_EXTENSIONS.has(path.extname(file)), { excludeDefaultBuild: true }),
     ...walk(cwd, (file) => INPUT_EXTENSIONS.has(path.extname(file)), { excludeDefaultBuild: true }),
   ]);
   const compiler = inventory([
@@ -95,6 +108,8 @@ export function compileInputs({ cwd, dslDir, configPath, argumentIdentity }) {
     path.join(dslDir, "package.json"),
     path.join(dslDir, "compile_package.mjs"),
     path.join(dslDir, "compile_proof.mjs"),
+    path.join(dslDir, "operation_contract_check.mjs"),
+    path.join(dslDir, "assets", "operation-contract.wasm"),
     ...dependencyPackageFiles(dslDir, cwd),
   ]);
   return {

package/dart/CHANGELOG.md

@@ -1,7 +1,82 @@
+## 0.66.5
+
+- Resolve the Node runtime runner through `@githolon/runtime`, the public name for the application runtime package.
+
+## 0.66.4
+
+- Consume the current `nomos_types` protocol and deliver the source-matched
+  Reception and runtime bridge used by the generated Dart application proofs.
+
+## 0.66.3
+
+- Restaged the generated runtime bridge: regenerated vendored runtime assets. Published pub.dev archives are immutable, so regenerated bytes ride their own version.
+
+## 0.66.2
+
+- Move platform-supplied capability ports into the independent
+  `nomos_peer_host` contract package; the client runtime consumes those ports
+  without exposing peer lifecycle control.
+
+## 0.66.1
+
+- Requires `nomos_types` 0.11.1, whose `HostHealth` carries custody-open and provider-request telemetry.
+
+## 0.66.0
+
+- THIN-CLIENT AUDIT (2026-09-12). Every unit of `lib/src` was classified against the thin-client
+  line in `architecture/reception_peer_office_boundary.md`; what no caller reached is gone. There
+  are no compat shims — a removed symbol breaks its callers at compile, by design.
+
+  BREAKING — removed, all with zero references in this package, its tests, `nomos_flutter`, the
+  nomos2 examples/bench, the generated Dart facades, or the CO2 applications:
+  - The superseded client-side model-decision lane, replaced by the office's model-adoption desk:
+    `application_model_policy.dart` in full (`DomainClientModelAdoptionRequired`,
+    `DomainModelReview`, `DomainModelDifference`, `DomainModelDifferenceKind`,
+    `NomosModelDecisionHandler`, `NomosApplicationModelPolicies`,
+    `NmsApplicationModelPolicyHost`), plus `nmsInternalConvergeGeneratedModel`,
+    `DomainClientModelLifecycleStalled`, `DomainClientSessionMismatch.canAttemptGeneratedModelAdoption`,
+    `nmsInternalMaySkipShapeCompatibility`, `nmsInternalClientExpectsNewerInterface`,
+    `nomosInternalRetainModelChangeHandler` and `nomosInternalHandleModelChange`. Adoption is the
+    office's answer, observed as `NomosModelAdoptionProgress`. A platform transport that mixed in
+    `NmsApplicationModelPolicyHost` simply drops the mixin.
+  - The cross-custody share pair `NomosSession.attestationSign` and `DartReception.shareWith`, and
+    with them `authority_attestation_kernel.dart` (`NmsAuthorityAttestationKernel`, their only
+    consumer).
+  - `source_trust.dart` (`NmsInternalSourceTrust`).
+  - `NomosEpochResult`, `EncryptionMemberKeyMissing`, `EncryptionRosterMismatch`,
+    `NomosBirthCertificateSpec` (a duplicate alias — `signBirthCert` now names
+    `NomosBirthCertificate`), the `NomosRefAcquire` extension (`ref.acquire(reception)`; use
+    `reception.acquireSession(ref.workspace)`), and `NmsInvitationMaterial`.
+  - `lastRecovery`, `mintDeviceKey` (use `authorKeygen`), `nmsQueryUsda`, `nmsQueryAtUsda`,
+    `nmsQueryPageUsda` (the compiler no longer emits them; `nmsQueryByIdUsda` remains),
+    `noteLocalSpan`, `assertConnected`, `canAuthorTyped` (use `canAuthor`, which returns the
+    kernel's typed answer), `nomosInternalDeliverLocalWorkspaceEffectsTo`,
+    `nmsAwaitProviderTokenReady` and `nomosInternalResidencyRequiredWorkspace`.
+
+  Still resident and named as office work, not to be worked around locally: the source-less path of
+  `acquireSession` (residency probe, connect fallback, credential retry) belongs to
+  `WorkspaceAcquisitionDesk`; `assertKernelCoherence`'s OSGi contract comparison belongs to
+  `CompatibilityDesk`; the foreign `watchById` re-read-per-sync-tick belongs to the watch desk.
+
+
+- The receiving-group gate from Dart (`architecture/receiving_group_lifecycle.md` cut 4):
+  `NomosSession.nmsOpenReceivingGroup(...)` transports one `OpenReceivingGroupRequest` to the
+  shared Peer Office desk and returns its `ReceivingGroupOpened` (MOUNTED_LOCAL | ACQUIRED | BORN);
+  `receivingGroupConvergence` streams the desk's convergence tail (`ReceivingGroupConvergence`
+  runtime events), scoped to the session's workspace. Reception owns no ceremony: device identity,
+  born-ness, acquisition, birth, recovery and verification are the office's.
+- `NmsApplicationFrameworkCalls.applicationBirthContract` (LOUD REQUIRED, compiler-emitted): the
+  application's law package identity for the receiving-group desk. Regenerate generated Dart
+  packages with the matching compiler. The parent platform's Nomos controller identity is
+  per-platform installed state the desk observes at birth; the descriptor never carries it.
+
 ## 0.65.3
 
 - Generate parent-law authentication cascades that wait for both provider and signer custody, without a child self-enrolment shortcut.
 - Preserve nominal USDA calls and typed Runtime v2 results across local and remote workspace boundaries.
+- Replace the abandoned whole-history model-review shape with a current-frontier decision: generated
+  clients expose `ready` plus stable-identity differences, while explicit counterfactual results remain
+  outside ordinary law adoption.
 
 ## 0.65.2
 
@@ -201,7 +276,7 @@
 
 ## 0.64.16
 
-- Rebundle the runner runtime (`node-entry.mjs`, `offline-install.mjs`) generated from `@githolon/client` 0.103.19, which carries the evolve-gate fix: `promoteDomain` dispositions are read from the law that DECLARES the call, so a law upgrade with a genuine field/aggregate removal is promotable through the offer lane.
+- Rebundle the runner runtime (`node-entry.mjs`, `offline-install.mjs`) generated from `@githolon/client` 0.103.19, which carries the evolve-gate fix: `promoteDomain` dispositions are read from the law that DECLARES the call, so a law upgrade with a genuine field/aggregate removal can pass the offer lane.
 
 ## 0.64.15
 

package/dart/README.md

@@ -2,8 +2,31 @@
 
 Dart frontend types for [Nomos](https://github.com/Captain-App/nomos2) — the hand-written kernel
 wire types plus the code-generated per-domain aggregate + directive-payload types. (De)serializes
-the exact serde JSON the Rust kernel + projection produce/consume, and defines the `NomosBridge`
+the exact typed protocol the Rust kernel + projection produce/consume, and defines Dart Reception
 protocol the runtime ([`nomos_flutter`](https://pub.dev/packages/nomos_flutter)) drives.
 
-You normally depend on `nomos_flutter` (which re-exports the bridge surface) rather than this package
+You normally depend on `nomos_flutter` (which re-exports Reception) rather than this package
 directly. Licensed under the Nomos Pre-Release License — see `LICENSE`.
+
+## What belongs in this package
+
+`nomos_client` is a THIN client. It is the language-native presentation of a Peer Office, and it
+decides nothing the office decides. Only these belong here:
+
+- the generated protobuf types and the `RuntimeRequest` / `RuntimeResponse` / `RuntimeEvent`
+  transport to a Peer Office (`runtime_v2_transport.dart`, `reception/peer_office_connection.dart`,
+  `node_runner_transport.dart`);
+- the physical effect executors a platform shell answers — HTTP, git smart-HTTP, custody probes,
+  device identity, credential refresh, law package;
+- the generated facade binding (`generated_call.dart`, `nms_generated_runtime.dart`,
+  `application_framework_calls.dart`);
+- typed refusal decoding, and the projections that only fold events the office already published
+  (`sync_status_projection.dart`, `operation_receipts.dart`, `result_usda.dart`);
+- the test harness (`test_harness.dart`, `dev_cloud.dart`, `testing/`).
+
+These do NOT belong here, and a review should refuse them: workspace lifecycle decisions, ceremony
+sequencing, retry/fallback/backoff policy, custody or sync orchestration, model-lifecycle decisions,
+workspace name-prefix logic, and JSON probes of the host. They belong to a named Peer Office desk.
+`architecture/reception_peer_office_boundary.md` carries the trap table of patterns already removed
+and the short list of office procedure still resident here; add to that list rather than adding a
+second client-side lane.

package/dart/lib/src/admission_decision.dart

@@ -0,0 +1,41 @@
+import 'package:nomos_types/nomos_types.dart';
+import 'package:nomos_types/nomos_kernel_protocol.dart' as protocol;
+import 'reception/dart_reception.dart' show NomosTypedOfferFailure;
+export 'package:nomos_types/nomos_types.dart' show AdmissionDecision, Admitted,
+    DomainRefused, FrameworkRefused, UnsupportedRefusalContract, NomosDomainRefusalEvidence;
+
+/// Generated decoders distinguish a newer nominal shape from malformed values.
+final class NmsUnsupportedNominalRefusal implements Exception {
+  const NmsUnsupportedNominalRefusal();
+}
+
+/// Stateless adaptation of the existing offer lane. No retry, policy, pending
+/// state, persistence or tenant validation is owned here.
+Future<AdmissionDecision<S, R>> nmsAdmissionDecision<S, R>(Future<S> Function() command,
+    R? Function(NomosDomainRefusalEvidence) decode) async {
+  try {
+    return Admitted<S, R>(await command());
+  } on NomosTypedOfferFailure catch (failure) {
+    if (failure.response.whichOutcome() != protocol.OfferResponse_Outcome.refused) rethrow;
+    final reply = failure.response.refused;
+    if (!reply.hasDomainRefusal()) {
+      if (reply.refusal.code == protocol.KernelRefusalCode.KERNEL_REFUSAL_CODE_DOMAIN_REFUSED) {
+        throw const FormatException('Kernel domain refusal omitted its nominal value');
+      }
+      return FrameworkRefused<S, R>(reply.refusal.code, reply.refusal.message);
+    }
+    final value = reply.domainRefusal;
+    if (value.lawSha256.length != 32 || value.invariant.isEmpty || value.typeIdentity.isEmpty
+        || value.valueUsda.isEmpty || value.valueUsda.length > 65536 || reply.refusal.code != protocol.KernelRefusalCode.KERNEL_REFUSAL_CODE_DOMAIN_REFUSED) {
+      throw const FormatException('Invalid kernel domain-refusal envelope');
+    }
+    final evidence = NomosDomainRefusalEvidence(lawSha256: value.lawSha256,
+      invariant: value.invariant, typeIdentity: value.typeIdentity, valueUsda: value.valueUsda);
+    try {
+      final reason = decode(evidence);
+      return reason == null ? UnsupportedRefusalContract<S, R>(evidence) : DomainRefused<S, R>(reason, evidence);
+    } on NmsUnsupportedNominalRefusal {
+      return UnsupportedRefusalContract<S, R>(evidence);
+    }
+  }
+}

package/dart/lib/src/application_framework_calls.dart

@@ -4,7 +4,7 @@ import 'dart:convert' show utf8;
 import 'dart:typed_data' show Uint8List;
 import 'package:meta/meta.dart' show internal;
 import 'package:nomos_types/nomos_types.dart' show Sha256Digest;
-import 'package:nomos_types/nomos_kernel_protocol.dart' show BirthCertificate;
+import 'package:nomos_types/nomos_kernel_protocol.dart' show ApplicationBirthContract, BirthCertificate;
 
 import 'generated_call.dart';
 import 'result_usda.dart' show NmsUsdaLayer, NmsUsdaPrim;
@@ -210,8 +210,35 @@ final class NmsInvitationMaterial {
 }
 
 @internal
+/// One device that may author as a model-lifecycle holder, as the birth seed records it.
+typedef NmsModelAuthoritySigner = ({
+  String deviceKeySubject,
+  String grantedAt,
+  String? verifiedVia,
+  int? validFromEpoch,
+});
+
+/// One principal that may install law into a workspace, and the devices that may author as it.
+typedef NmsModelAuthorityHolder = ({
+  String principal,
+  List<NmsModelAuthoritySigner> signers,
+});
+
 abstract interface class NmsApplicationFrameworkCalls {
   String get applicationHomeDomain;
+  String get applicationAuthorityDomain;
+
+  /// The framework record the model-authority self-heal writes when this workspace seats its parent's
+  /// model-lifecycle holders (`ParentModelAuthoritySeat` at a constant id — the in-history fact, and the
+  /// peer's own answer to "is my parent seated here yet"). The Reception reads it before offering the
+  /// self-heal, so the law's own identity is the only representation of it.
+  String get parentModelAuthoritySeatAggregate;
+  String get parentModelAuthoritySeatId;
+
+  /// The application's birth contract for the receiving-group desk: the compiled law package identity
+  /// (the closure serving the injected application-home domain). The parent platform's controller is
+  /// per-platform installed state the desk observes at birth, never a value the descriptor carries.
+  ApplicationBirthContract get applicationBirthContract;
 
   NmsGeneratedCall enrollFirstDevice({
     required String domain,
@@ -221,7 +248,6 @@ abstract interface class NmsApplicationFrameworkCalls {
     required int validFromEpoch,
     required String grantedAt,
     required String idpToken,
-    String? delegationCert,
     BirthCertificate delegationCertificate,
   });
 
@@ -242,6 +268,7 @@ abstract interface class NmsApplicationFrameworkCalls {
     required Sha256Digest lawHash,
     required String bornAt,
     bool? inheritAuthProvider,
+    Sha256Digest? foundingKeyHash,
   });
 
   NmsGeneratedCall seedBirthPolicy({
@@ -302,6 +329,29 @@ abstract interface class NmsApplicationFrameworkCalls {
   /// The generated implementation binds this semantic capability to one exact nominal application intent.
   NmsGeneratedCall recoverExistingReceivingGroupDevice({
     required String user,
+    String? deviceKeySubject,
+  });
+
+  /// The framework child-authentication repair (`nomosInternalRepairChildAuthentication7c1f5e`), composed
+  /// into the application-home domain whenever the application births children: the ONE parent action
+  /// that seats this device and the current verifier into the child that refused the key, addressed by
+  /// workspace. The Reception's repair lane calls it; an application that births nothing has no such law.
+  NmsGeneratedCall repairChildAuthentication({
+    required String workspace,
+    required String user,
+    String? deviceKeySubject,
+  });
+
+  /// The framework model-authority self-seat (`nomosInternalSeatModelAuthority7c1f5e`), composed into
+  /// the application-home domain whenever the application births children: the ONE action by which a
+  /// workspace's own model-lifecycle holder names who ELSE may install law here, so the platform can
+  /// ship law without the signed-in person's device signing every time. Gated on
+  /// `workspace:self#installDomain` and nothing else — whoever may install law here may say who else
+  /// may, and grants no privilege they do not already hold. The Reception offers it when the workspace
+  /// records no seat; an application that births nothing has no such law.
+  NmsGeneratedCall seatParentModelAuthority({
+    required List<NmsModelAuthorityHolder> holders,
+    required String seatedAt,
   });
 
   NmsGeneratedCall redeemInvitation({

package/dart/lib/src/application_model_adoption.dart

@@ -0,0 +1,187 @@
+/// The application's approved law model and the typed observations of the
+/// Peer Office model-adoption desk.
+///
+/// An application is released against one compiled law package. Deploying and
+/// adopting that package on the platform leaves every existing child workspace
+/// (a receiving group, an estate, a catalogue) on its previous law; the shared
+/// Peer Office brings each workspace the application opens onto the approved
+/// package through the ordinary signed lifecycle offers, and reports what it
+/// did here. Nothing in this file decides a lifecycle step: the office observes,
+/// stages, proves and promotes; Reception transports the paper and presents the
+/// typed outcome.
+library;
+
+import 'dart:typed_data';
+
+import 'package:nomos_types/nomos_types.dart' show NomosApprovedModel;
+import 'package:nomos_types/nomos_kernel_protocol.dart' as nomos_protocol;
+
+import 'package:nomos_peer_host/nomos_peer_host.dart'
+    show NomosLawPackageSource;
+
+// The approved model is an INPUT a release declares, so it is pure data and lives
+// in `nomos_types` beside `CustodyBreakPolicy`. Re-exported here so this file
+// remains the one place to read the whole model-adoption vocabulary.
+export 'package:nomos_types/nomos_types.dart' show NomosApprovedModel;
+
+/// The shell-side answer to the runtime's law-package effect for one approved
+/// model: the package for its identity, and nothing for any other identity.
+final class NmsApprovedModelLawPackageSource implements NomosLawPackageSource {
+  const NmsApprovedModelLawPackageSource(this.model);
+
+  final NomosApprovedModel model;
+
+  @override
+  Future<Uint8List?> load(String lawSha256) async =>
+      lawSha256 == model.lawSha256 ? await model.loadPackage() : null;
+}
+
+enum NomosModelAdoptionPhase { observe, stage, promote, sync }
+
+enum NomosModelAdoptionOutcome {
+  inProgress,
+
+  /// Every served domain key already resolves to the approved package.
+  current,
+
+  /// The approved package is now the workspace's current law.
+  adopted,
+
+  /// Not adopted on this run; [NomosModelAdoptionDeferred] carries the typed
+  /// detail. The application keeps working on the law the workspace serves.
+  deferred,
+
+  /// A dry run: the kernel's preflight is reported; nothing was written.
+  previewed,
+}
+
+NomosModelAdoptionPhase _phaseOf(nomos_protocol.ModelAdoptionPhase phase) =>
+    switch (phase) {
+      nomos_protocol.ModelAdoptionPhase.MODEL_ADOPTION_PHASE_STAGE =>
+        NomosModelAdoptionPhase.stage,
+      nomos_protocol.ModelAdoptionPhase.MODEL_ADOPTION_PHASE_PROMOTE =>
+        NomosModelAdoptionPhase.promote,
+      nomos_protocol.ModelAdoptionPhase.MODEL_ADOPTION_PHASE_SYNC =>
+        NomosModelAdoptionPhase.sync,
+      _ => NomosModelAdoptionPhase.observe,
+    };
+
+NomosModelAdoptionOutcome _outcomeOf(
+        nomos_protocol.ModelAdoptionOutcome outcome) =>
+    switch (outcome) {
+      nomos_protocol.ModelAdoptionOutcome.MODEL_ADOPTION_OUTCOME_CURRENT =>
+        NomosModelAdoptionOutcome.current,
+      nomos_protocol.ModelAdoptionOutcome.MODEL_ADOPTION_OUTCOME_ADOPTED =>
+        NomosModelAdoptionOutcome.adopted,
+      nomos_protocol.ModelAdoptionOutcome.MODEL_ADOPTION_OUTCOME_DEFERRED =>
+        NomosModelAdoptionOutcome.deferred,
+      nomos_protocol.ModelAdoptionOutcome.MODEL_ADOPTION_OUTCOME_PREVIEWED =>
+        NomosModelAdoptionOutcome.previewed,
+      _ => NomosModelAdoptionOutcome.inProgress,
+    };
+
+/// The typed condition of an adoption the office deferred: the workspace keeps
+/// serving [currentLawSha256] and [detail] is the kernel's or the shell's own
+/// refusal, verbatim. Render it; do not interpret it into a repair.
+final class NomosModelAdoptionDeferred {
+  const NomosModelAdoptionDeferred({
+    required this.workspace,
+    required this.phase,
+    required this.detail,
+    this.currentLawSha256,
+  });
+
+  final String workspace;
+  final NomosModelAdoptionPhase phase;
+  final String detail;
+  final String? currentLawSha256;
+
+  @override
+  String toString() =>
+      'NomosModelAdoptionDeferred($workspace at ${phase.name}: $detail)';
+}
+
+/// One observation of the model-adoption desk for a workspace: progress while
+/// it runs, then the terminal outcome. Presentation data only.
+final class NomosModelAdoptionProgress {
+  const NomosModelAdoptionProgress({
+    required this.workspace,
+    required this.phase,
+    required this.outcome,
+    this.detail,
+    this.currentLawSha256,
+  });
+
+  factory NomosModelAdoptionProgress.fromRuntime(
+    nomos_protocol.ModelAdoptionProgress progress,
+  ) =>
+      NomosModelAdoptionProgress(
+        workspace: progress.workspace,
+        phase: _phaseOf(progress.phase),
+        outcome: _outcomeOf(progress.outcome),
+        detail: progress.hasDetail() ? progress.detail : null,
+        currentLawSha256:
+            progress.hasCurrentLawSha256() ? progress.currentLawSha256 : null,
+      );
+
+  final String workspace;
+  final NomosModelAdoptionPhase phase;
+  final NomosModelAdoptionOutcome outcome;
+  final String? detail;
+  final String? currentLawSha256;
+
+  bool get isTerminal => outcome != NomosModelAdoptionOutcome.inProgress;
+
+  /// The typed deferred condition, when this observation is one.
+  NomosModelAdoptionDeferred? get deferred =>
+      outcome == NomosModelAdoptionOutcome.deferred
+          ? NomosModelAdoptionDeferred(
+              workspace: workspace,
+              phase: phase,
+              detail: detail ?? 'the office deferred the adoption',
+              currentLawSha256: currentLawSha256,
+            )
+          : null;
+}
+
+/// The desk's answer to one adoption paper.
+final class NomosModelAdoption {
+  const NomosModelAdoption({
+    required this.workspace,
+    required this.outcome,
+    this.detail,
+    this.currentLawSha256,
+    this.transitionReady,
+  });
+
+  factory NomosModelAdoption.fromRuntime(
+    nomos_protocol.ApplicationModelAdopted adopted,
+  ) =>
+      NomosModelAdoption(
+        workspace: adopted.workspace,
+        outcome: _outcomeOf(adopted.outcome),
+        detail: adopted.hasDetail() ? adopted.detail : null,
+        currentLawSha256:
+            adopted.hasCurrentLawSha256() ? adopted.currentLawSha256 : null,
+        transitionReady:
+            adopted.hasTransition() ? adopted.transition.ready : null,
+      );
+
+  final String workspace;
+  final NomosModelAdoptionOutcome outcome;
+  final String? detail;
+  final String? currentLawSha256;
+
+  /// The kernel's current-frontier verdict, when one was derived.
+  final bool? transitionReady;
+
+  NomosModelAdoptionDeferred? get deferred =>
+      outcome == NomosModelAdoptionOutcome.deferred
+          ? NomosModelAdoptionDeferred(
+              workspace: workspace,
+              phase: NomosModelAdoptionPhase.observe,
+              detail: detail ?? 'the office deferred the adoption',
+              currentLawSha256: currentLawSha256,
+            )
+          : null;
+}

package/dart/lib/src/application_status.dart

@@ -0,0 +1,73 @@
+import 'sync_status_projection.dart' show WorkspaceFollowStatus;
+
+/// Read-only presentation of one Peer Office workspace handle.
+enum ApplicationStatusPhase {
+  checking,
+  current,
+  saving,
+  awaitingRemoteDurability,
+  receiving,
+  catchingUp,
+  offline,
+  attention,
+}
+
+final class ApplicationStatus {
+  const ApplicationStatus({
+    required this.phase,
+    required this.localChanges,
+    required this.availableChanges,
+    required this.savedChanges,
+    required this.acceptedChanges,
+    required this.decisionsNeeded,
+    this.receivedBytes,
+    this.totalBytes,
+    this.lastUpdatedAt,
+    this.message,
+    this.live = false,
+    this.followedWorkspaces,
+    this.workspacesInSync,
+    this.workspacesLive,
+    this.workspaceFollows = const [],
+    this.followReportAt,
+    this.preparingWorkspaces = 0,
+    this.retryingWorkspaces = 0,
+    this.preparationActivity,
+  });
+
+  final ApplicationStatusPhase phase;
+
+  /// Null counts have not been reported by the runtime; they are not zero.
+  final int? localChanges;
+  final int? availableChanges;
+  final int? savedChanges;
+  final int? acceptedChanges;
+  final int? decisionsNeeded;
+  final int? receivedBytes;
+  final int? totalBytes;
+  final DateTime? lastUpdatedAt;
+  final String? message;
+
+  /// Every workspace this handle depends on is settled and its live link is open: current NOW,
+  /// not as of [lastUpdatedAt]. A presentation shows "just now" rather than the age of that stamp.
+  final bool live;
+
+  /// The replica follows the peer keeps up with in the background, and how many are in sync.
+  /// Null until the runtime reports its follow inventory; never zero-filled.
+  final int? followedWorkspaces;
+  final int? workspacesInSync;
+  final int? workspacesLive;
+  final List<WorkspaceFollowStatus> workspaceFollows;
+
+  /// Peer-authored timestamp of the latest changed follow observation.
+  final DateTime? followReportAt;
+  final int preparingWorkspaces;
+  final int retryingWorkspaces;
+  final String? preparationActivity;
+
+  bool get isUsable => phase != ApplicationStatusPhase.attention;
+  bool get isCurrent =>
+      phase == ApplicationStatusPhase.current &&
+      localChanges == 0 &&
+      availableChanges == 0;
+}