@githolon/dsl 0.108.6 → 0.110.0

package/dart/test/admission_decision_test.dart

@@ -0,0 +1,48 @@
+import 'dart:convert';
+import 'package:nomos_client/src/admission_decision.dart';
+import 'package:nomos_client/src/reception/dart_reception.dart';
+import 'package:nomos_types/nomos_kernel_protocol.dart' as p;
+import 'package:test/test.dart';
+
+p.OfferResponse refusal({bool domain = true}) => p.OfferResponse(refused: p.OfferRefused(
+  refusal: p.KernelRefusal(code: domain ? p.KernelRefusalCode.KERNEL_REFUSAL_CODE_DOMAIN_REFUSED
+    : p.KernelRefusalCode.KERNEL_REFUSAL_CODE_INVARIANT_EXECUTION_FAULT, message: 'test'),
+  domainRefusal: domain ? p.DomainRefusal(lawSha256: List.filled(32, 7), invariant: '/Rule',
+    typeIdentity: '/Problem', valueUsda: utf8.encode('#usda 1.0')) : null));
+void main() {
+  test('preserves the successful business result', () async {
+    final result = await nmsAdmissionDecision(() async => 42, (_) => 'unused');
+    expect(result, isA<Admitted<int, String>>().having((value) => value.value, 'value', 42));
+  });
+  test('decodes declared refusal and copies its ephemeral evidence', () async {
+    final reply = refusal();
+    final result = await nmsAdmissionDecision<int, String>(() async => throw NomosTypedOfferFailure(reply), (_) => 'tooShort');
+    expect(result, isA<DomainRefused<int, String>>().having((value) => value.reason, 'reason', 'tooShort'));
+    reply.refused.domainRefusal.lawSha256[0] = 1;
+    final evidence = (result as DomainRefused).evidence;
+    expect(evidence.lawSha256[0], 7);
+    expect(() => evidence.lawSha256[0] = 0, throwsUnsupportedError);
+  });
+  test('framework rejection is separate from tenant refusal', () async {
+    final result = await nmsAdmissionDecision<int, String>(() async => throw NomosTypedOfferFailure(refusal(domain: false)), (_) => throw StateError('must not decode'));
+    expect(result, isA<FrameworkRefused<int, String>>());
+  });
+  test('unknown family and unknown arm preserve an explicit unsupported result', () async {
+    for (final decoder in <String? Function(NomosDomainRefusalEvidence)>[
+      (_) => null, (_) => throw const NmsUnsupportedNominalRefusal(),
+    ]) {
+      expect(await nmsAdmissionDecision<int, String>(() async => throw NomosTypedOfferFailure(refusal()), decoder), isA<UnsupportedRefusalContract<int, String>>());
+    }
+  });
+  test('malformed evidence and invalid codec output remain protocol faults', () async {
+    final bad = refusal()..refused.domainRefusal.lawSha256 = [1];
+    await expectLater(nmsAdmissionDecision<int, String>(() async => throw NomosTypedOfferFailure(bad), (_) => 'bad'), throwsFormatException);
+    await expectLater(nmsAdmissionDecision<int, String>(() async => throw NomosTypedOfferFailure(refusal()), (_) => throw const FormatException('bad body')), throwsFormatException);
+  });
+  test('transport and dependency failures are never disguised as business outcomes', () async {
+    final transport = StateError('offline');
+    await expectLater(nmsAdmissionDecision<int, String>(() async => throw transport, (_) => 'unused'), throwsA(same(transport)));
+    final blocked = NomosTypedOfferFailure(p.OfferResponse());
+    await expectLater(nmsAdmissionDecision<int, String>(() async => throw blocked, (_) => 'unused'), throwsA(same(blocked)));
+  });
+}

package/dart/test/background_model_adoption_test.dart

@@ -0,0 +1,228 @@
+import 'dart:async';
+import 'dart:typed_data';
+
+import 'package:nomos_client/src/nms_generated_runtime.dart';
+import 'package:nomos_types/nomos_kernel_protocol.dart' as p;
+import 'package:test/test.dart';
+
+// The real Reception, with delayed typed replies instead of a network. No
+// lifecycle decisions belong here; the shared office tests cover those.
+final class _Office
+    with NmsPlatformCredentialProviderHost
+    implements PeerOfficeConnection {
+  final calls = <p.RuntimeRequest>[];
+  final replies = <Completer<p.RuntimeResponse>>[];
+  int _sequence = 0;
+
+  @override
+  Stream<p.RuntimeEvent> get runtimeEvents => const Stream.empty();
+  @override
+  int nextRuntimeRequestId() => ++_sequence;
+
+  @override
+  Future<p.RuntimeResponse> invokeRuntime(p.RuntimeRequest request) {
+    if (request.hasCloseRealm()) {
+      return Future.value(p.RuntimeResponse(
+          protocolVersion: 2,
+          requestId: request.requestId,
+          realmClosed: p.RealmClosed()));
+    }
+    expect(request.hasAdoptApplicationModel(), isTrue);
+    calls.add(request.deepCopy());
+    final reply = Completer<p.RuntimeResponse>();
+    replies.add(reply);
+    return reply.future;
+  }
+
+  void finish(int index) => replies[index].complete(p.RuntimeResponse(
+      protocolVersion: 2,
+      requestId: calls[index].requestId,
+      applicationModelAdopted: p.ApplicationModelAdopted(
+          workspace: calls[index].adoptApplicationModel.session,
+          outcome: p.ModelAdoptionOutcome.MODEL_ADOPTION_OUTCOME_CURRENT)));
+}
+
+// A Reception whose office answers session binding as well, so a real
+// `bindWorkspace` — the door the generated client opens a child through —
+// can be driven end to end.
+final class _BindingOffice
+    with NmsPlatformCredentialProviderHost
+    implements PeerOfficeConnection {
+  final adoptions = <p.RuntimeRequest>[];
+  final binds = <p.RuntimeRequest>[];
+  int _sequence = 0;
+
+  @override
+  Stream<p.RuntimeEvent> get runtimeEvents => const Stream.empty();
+  @override
+  int nextRuntimeRequestId() => ++_sequence;
+
+  @override
+  Future<p.RuntimeResponse> invokeRuntime(p.RuntimeRequest request) async {
+    if (request.hasCloseRealm()) {
+      return p.RuntimeResponse(
+          protocolVersion: 2,
+          requestId: request.requestId,
+          realmClosed: p.RealmClosed());
+    }
+    if (request.hasBindSession()) {
+      binds.add(request.deepCopy());
+      return p.RuntimeResponse(
+          protocolVersion: 2,
+          requestId: request.requestId,
+          sessionBound: p.SessionBound(
+              session: request.bindSession.session,
+              workspace: request.bindSession.workspace,
+              credentialCapability: 'capability:test'));
+    }
+    expect(request.hasAdoptApplicationModel(), isTrue);
+    adoptions.add(request.deepCopy());
+    return p.RuntimeResponse(
+        protocolVersion: 2,
+        requestId: request.requestId,
+        applicationModelAdopted: p.ApplicationModelAdopted(
+            workspace: request.adoptApplicationModel.session,
+            outcome: p.ModelAdoptionOutcome.MODEL_ADOPTION_OUTCOME_CURRENT));
+  }
+}
+
+NomosApprovedModel _model([String digit = '1']) => NomosApprovedModel(
+    lawSha256: digit * 64,
+    reason: 'test release',
+    domainKeys: const ['test'],
+    loadPackage: () async => Uint8List(0));
+
+Future<void> _settle() => Future<void>.delayed(Duration.zero);
+
+DartReception _reception(_Office office, NomosApprovedModel model) {
+  final reception = DartReception(office)
+    ..retainApprovedApplicationModel(model);
+  addTearDown(reception.dispose);
+  return reception;
+}
+
+void main() {
+  test(
+      'repeated background requests share one invocation, not a cached verdict',
+      () async {
+    final office = _Office();
+    final reception = _reception(office, _model());
+    final session = reception.session('estate');
+    for (var count = 0; count < 20; count++) {
+      session.nomosInternalAdoptApplicationModelInBackground();
+    }
+    // Even another view of the same plane must not allocate another flight.
+    NomosSession(reception, 'estate')
+        .nomosInternalAdoptApplicationModelInBackground();
+    expect(office.calls, hasLength(1));
+    office.finish(0);
+    await _settle();
+    session.nomosInternalAdoptApplicationModelInBackground();
+    expect(office.calls, hasLength(2));
+    office.finish(1);
+    await _settle();
+  });
+
+  test('failed transport releases the flight and keeps the failure observable',
+      () async {
+    final office = _Office();
+    final reception = _reception(office, _model());
+    final session = reception.session('estate');
+    session.nomosInternalAdoptApplicationModelInBackground();
+    office.replies[0].completeError(StateError('offline'));
+    await _settle();
+    expect(session.currentStatus.modelAdoption?.detail, contains('offline'));
+    session.nomosInternalAdoptApplicationModelInBackground();
+    expect(office.calls, hasLength(2));
+    office.finish(1);
+    await _settle();
+  });
+
+  test('sessions, approved models and identity planes do not share flights',
+      () async {
+    final firstOffice = _Office();
+    final secondOffice = _Office();
+    final approved = _model();
+    final first = _reception(firstOffice, approved);
+    final second = _reception(secondOffice, approved);
+    first.session('estate').nomosInternalAdoptApplicationModelInBackground();
+    first.session('catalogue').nomosInternalAdoptApplicationModelInBackground();
+    second.session('estate').nomosInternalAdoptApplicationModelInBackground();
+    first.retainApprovedApplicationModel(_model('2'));
+    first.session('estate').nomosInternalAdoptApplicationModelInBackground();
+    expect(firstOffice.calls, hasLength(3));
+    expect(secondOffice.calls, hasLength(1));
+    expect(firstOffice.calls[2].adoptApplicationModel.lawSha256, '2' * 64);
+    for (var index = 0; index < 3; index++) {
+      firstOffice.finish(index);
+    }
+    secondOffice.finish(0);
+    await _settle();
+  });
+
+  test(
+      'an explicit adoption remains an independent request with its own result',
+      () async {
+    final office = _Office();
+    final session = _reception(office, _model()).session('estate');
+    session.nomosInternalAdoptApplicationModelInBackground();
+    final explicit = session.adoptApplicationModel(dryRun: true);
+    expect(office.calls, hasLength(2));
+    expect(office.calls[1].adoptApplicationModel.dryRun, isTrue);
+    office.finish(1);
+    expect((await explicit).outcome, NomosModelAdoptionOutcome.current);
+    office.finish(0);
+    await _settle();
+  });
+
+  // THE OLD-LAW CHILD BOOTSTRAP TRIGGER (nomos2 architecture/old_law_child_bootstrap.md).
+  // A child whose law predates the parent-directed acceptor refuses every new device and has
+  // no operator door; the only key it accepts belongs to a device already seated in it. So
+  // BINDING the child IS the trigger, and it must not gate the caller on the outcome.
+  test('opening a child offers it to the model-adoption desk, once', () async {
+    final office = _BindingOffice();
+    final reception = DartReception(office)
+      ..retainApprovedApplicationModel(_model());
+    addTearDown(reception.dispose);
+
+    final child = await reception.bindWorkspace('estate-9c3d');
+    await _settle();
+    expect(office.binds.single.bindSession.workspace, 'estate-9c3d');
+    expect(office.adoptions.single.adoptApplicationModel.session, 'estate-9c3d');
+    expect(office.adoptions.single.adoptApplicationModel.dryRun, isFalse);
+
+    // Re-opening an already-bound child neither re-binds nor re-offers: the
+    // transition runs once, and afterwards the workspace carries the acceptor.
+    expect(identical(await reception.bindWorkspace('estate-9c3d'), child), isTrue);
+    await _settle();
+    expect(office.binds, hasLength(1));
+    expect(office.adoptions, hasLength(1));
+  });
+
+  test('a plane with no approved model opens children without offering any',
+      () async {
+    final office = _BindingOffice();
+    final reception = DartReception(office);
+    addTearDown(reception.dispose);
+    await reception.bindWorkspace('estate-9c3d');
+    await _settle();
+    expect(office.binds, hasLength(1));
+    expect(office.adoptions, isEmpty);
+  });
+  // Measured on a real device: only 2 of 8 workspace bindings went through `bindWorkspace`.
+  // A child reached by a foreign read or a credential-less follow binds through the raw
+  // primitive, and a trigger on `bindWorkspace` skipped exactly those — including the estate
+  // whose refusal started this work.
+  test('a child bound through the raw primitive is offered too, not only bindWorkspace',
+      () async {
+    final office = _BindingOffice();
+    final reception = DartReception(office)
+      ..retainApprovedApplicationModel(_model());
+    addTearDown(reception.dispose);
+
+    await reception.bindSession(
+        workspace: 'estate-9c3d', session: 'estate-9c3d');
+    await _settle();
+    expect(office.adoptions.single.adoptApplicationModel.session, 'estate-9c3d');
+  });
+}

package/dart/test/bundle_version_pairing_test.dart

@@ -1,4 +1,4 @@
-// THE VERSION-FLOOR TRIPWIRE: the @githolon/client built by this checkout must satisfy the minimum
+// THE VERSION-FLOOR TRIPWIRE: the @githolon/runtime built by this checkout must satisfy the minimum
 // runner version declared by nomos_client. Changesets may advance the npm package metadata without
 // changing its protocol, so a newer runner is valid; an older runner than the Dart floor is not.
 import 'dart:convert';
@@ -8,8 +8,8 @@ import 'package:nomos_client/src/nms_conformance_runtime.dart';
 import 'package:test/test.dart';
 
 void main() {
-  test('kExpectedRunnerBundleVersion pairs with cloud/web-client/package.json', () {
-    final f = File('${Directory.current.path}/../../cloud/web-client/package.json');
+  test('kExpectedRunnerBundleVersion pairs with peer-office/package/package.json', () {
+    final f = File('${Directory.current.path}/../../peer-office/package/package.json');
     if (!f.existsSync()) {
       markTestSkipped('monorepo layout not present (published-package test run)');
       return;
@@ -23,7 +23,7 @@ void main() {
             (runner[1] > floor[1] ||
                 (runner[1] == floor[1] && runner[2] >= floor[2])));
     expect(runnerMeetsFloor, isTrue,
-        reason: '@githolon/client $v is older than nomos_client runner floor '
+        reason: '@githolon/runtime $v is older than nomos_client runner floor '
             '$kExpectedRunnerBundleVersion');
   });
 }

package/dart/test/child_authentication_repair_test.dart

@@ -0,0 +1,359 @@
+import 'dart:async';
+import 'dart:convert';
+import 'dart:typed_data';
+
+import 'package:nomos_client/src/nms_generated_runtime.dart';
+import 'package:nomos_types/nomos_kernel_protocol.dart' as protocol;
+import 'package:test/test.dart';
+
+final class _RepairTransport
+    with NmsPlatformCredentialProviderHost
+    implements
+        PeerOfficeConnection,
+        NomosKernelCallTransport,
+        NomosRuntimeV2EventTransport {
+  final _runtimeEvents = StreamController<protocol.RuntimeEvent>.broadcast();
+  protocol.CallRequest? lastCall;
+  protocol.CredentialUse? lastCredentialUse;
+  var providerToken = protocol.ProviderTokenVerificationStatus
+      .PROVIDER_TOKEN_VERIFICATION_STATUS_NO_MATCHING_KEY;
+  var enrolledDevice = true;
+  var resolvedPrincipal = 'user:jack';
+  var syncCalls = 0;
+  final syncSessions = <String>[];
+  var offerCalls = 0;
+  var expireNextSessionOffer = false;
+  var refuseSignerEnrollmentOffers = 0;
+  var refuseKernelSignerOffers = 0;
+  String kernelRefusalActor = 'unenrolled-signer-key';
+  final refusedWorkspaces = <String>[];
+  final refreshedTokens = <String>[];
+  final authenticationRequests = <protocol.AwaitAuthenticationRequest>[];
+  protocol.AuthenticationReadiness? authenticationResult;
+
+  _RepairTransport() {
+    scheduleMicrotask(
+      () => _runtimeEvents.add(
+        protocol.RuntimeEvent(
+          ready: protocol.RuntimeReady(runtimeVersion: 'unbundled-dev'),
+        ),
+      ),
+    );
+  }
+
+  @override
+  Stream<protocol.RuntimeEvent> get runtimeEvents => _runtimeEvents.stream;
+
+  void pushRuntime(protocol.RuntimeEvent event) => _runtimeEvents.add(event);
+
+  int _requests = 0;
+  @override
+  int nextRuntimeRequestId() => ++_requests;
+
+  @override
+  Future<protocol.RuntimeResponse> invokeRuntime(
+    protocol.RuntimeRequest request,
+  ) async {
+    if (request.hasAwaitAuthentication()) {
+      authenticationRequests.add(request.awaitAuthentication.deepCopy());
+      return protocol.RuntimeResponse(
+        protocolVersion: 2,
+        requestId: request.requestId,
+        authenticationReadiness: authenticationResult ??
+            protocol.AuthenticationReadiness(
+              outcome: protocol.AuthenticationReadinessOutcome
+                  .AUTHENTICATION_READINESS_OUTCOME_READY,
+              posture: protocol.AuthenticationPostureResponse(
+                providerToken: protocol.ProviderTokenVerificationStatus
+                    .PROVIDER_TOKEN_VERIFICATION_STATUS_VALID,
+                enrolledDevice: true,
+                resolvedPrincipal: 'user:jack',
+              ),
+            ),
+      );
+    }
+    if (request.hasBindSession()) {
+      return protocol.RuntimeResponse(
+        protocolVersion: 2,
+        requestId: request.requestId,
+        sessionBound: protocol.SessionBound(
+          workspace: request.bindSession.workspace,
+          session: request.bindSession.hasSession()
+              ? request.bindSession.session
+              : request.bindSession.workspace,
+          credentialCapability: request.bindSession.hasSession()
+              ? request.bindSession.session
+              : request.bindSession.workspace,
+        ),
+      );
+    }
+    if (request.hasSyncWorkspace()) {
+      syncCalls += 1;
+      syncSessions.add(request.syncWorkspace.workspace);
+      providerToken = protocol.ProviderTokenVerificationStatus
+          .PROVIDER_TOKEN_VERIFICATION_STATUS_VALID;
+      return protocol.RuntimeResponse(
+        protocolVersion: 2,
+        requestId: request.requestId,
+        syncWorkspace: protocol.SyncWorkspaceResponse(
+          workspace: request.syncWorkspace.workspace,
+        ),
+      );
+    }
+    if (request.hasRefreshCredentials()) {
+      refreshedTokens.add(utf8.decode(request.refreshCredentials.authToken));
+      return protocol.RuntimeResponse(
+        protocolVersion: 2,
+        requestId: request.requestId,
+        credentialsRefreshed: protocol.CredentialsRefreshed(
+          session: request.refreshCredentials.session,
+          hasAuthToken: request.refreshCredentials.authToken.isNotEmpty,
+        ),
+      );
+    }
+    return protocol.RuntimeResponse(
+      protocolVersion: 2,
+      requestId: request.requestId,
+      realmClosed: protocol.RealmClosed(),
+    );
+  }
+
+  @override
+  Future<protocol.CallResponse> callKernel({
+    required String session,
+    required protocol.CallRequest request,
+    protocol.CredentialUse credentialUse =
+        protocol.CredentialUse.CREDENTIAL_USE_UNSPECIFIED,
+  }) async {
+    lastCall = request.deepCopy();
+    lastCredentialUse = credentialUse;
+    if (request.hasQuery() && request.query.hasAuthenticationPosture()) {
+      return protocol.CallResponse(
+        protocolVersion: 1,
+        requestId: request.requestId,
+        query: protocol.QueryResponse(
+          authenticationPosture: protocol.AuthenticationPostureResponse(
+            providerToken: providerToken,
+            enrolledDevice: enrolledDevice,
+            resolvedPrincipal: resolvedPrincipal,
+          ),
+        ),
+      );
+    }
+    if (request.hasOffer()) {
+      offerCalls += 1;
+      if (refuseKernelSignerOffers > 0) {
+        refuseKernelSignerOffers -= 1;
+        return protocol.CallResponse(
+          protocolVersion: 1,
+          requestId: request.requestId,
+          offer: protocol.OfferResponse(
+            refused: protocol.OfferRefused(
+              refusal: protocol.KernelRefusal(
+                code: protocol
+                    .KernelRefusalCode.KERNEL_REFUSAL_CODE_FORGED_PRINCIPAL,
+                terminal: true,
+                message: 'verified author is $kernelRefusalActor',
+                details: protocol.NomosStruct(fields: [
+                  MapEntry(
+                      'actor', protocol.NomosValue(text: kernelRefusalActor)),
+                  MapEntry('claimed', protocol.NomosValue(text: 'user:jack')),
+                ]),
+              ),
+            ),
+          ),
+        );
+      }
+      if (refuseSignerEnrollmentOffers > 0) {
+        refuseSignerEnrollmentOffers -= 1;
+        refusedWorkspaces.add(session);
+        return protocol.CallResponse(
+          protocolVersion: 1,
+          requestId: request.requestId,
+          failure: protocol.Failure(
+            code: 'nomos.authz.signer_enrollment_missing',
+            message:
+                'auth: ordinary user offers require both a valid provider token and an active enrolled device',
+          ),
+        );
+      }
+      if (expireNextSessionOffer &&
+          credentialUse == protocol.CredentialUse.CREDENTIAL_USE_SESSION) {
+        expireNextSessionOffer = false;
+        return protocol.CallResponse(
+          protocolVersion: 1,
+          requestId: request.requestId,
+          failure: protocol.Failure(
+            code: 'nomos.auth.token_expired',
+            message: 'auth: token verification failed (Expired)',
+          ),
+        );
+      }
+    }
+    return protocol.CallResponse(
+      protocolVersion: 1,
+      requestId: request.requestId,
+      offer: protocol.OfferResponse(
+        admitted: protocol.OfferAdmitted(
+          head: 'HEAD-offer',
+          intentId: 'intent-offer',
+        ),
+      ),
+    );
+  }
+}
+
+NmsGeneratedCall _estateCall() => NmsInternalGeneratedCalls.create(
+      domain: 'estate',
+      directive: 'ensureSiteComplianceFolders',
+      protobufType:
+          'type.nomos.dev/nomos.operation.v1.Payload_ensure_site_compliance_test',
+      protobufPayload: Uint8List.fromList([1]),
+    );
+
+Future<DartReception> _connected(_RepairTransport transport) async {
+  final bridge = DartReception(transport);
+  await bridge.ready;
+  await bridge.bindSession(workspace: 'home', session: 'home');
+  await bridge.session('home').refreshCredentials(authToken: 'token');
+  await bridge.bindSession(
+    workspace: 'estate-1',
+    session: 'estate-1',
+  );
+  await bridge.session('estate-1').refreshCredentials(authToken: 'token');
+  return bridge;
+}
+
+void main() {
+  test('kernel unenrolled signer refusal repairs the child and retries once',
+      () async {
+    final transport = _RepairTransport()..refuseKernelSignerOffers = 1;
+    final bridge = await _connected(transport);
+    addTearDown(bridge.dispose);
+    final repairs = <ParentSignerEnrollmentMissing>[];
+    bridge.adoptChildAuthenticationRepair((refusal) async {
+      repairs.add(refusal);
+      return true;
+    });
+    await bridge
+        .session('estate-1')
+        .offerGeneratedCallOutcome(call: _estateCall());
+    expect(transport.offerCalls, 2);
+    expect(repairs.single.workspace, 'estate-1');
+    expect(repairs.single.actor, 'user:jack');
+    expect(repairs.single.directiveId, 'ensureSiteComplianceFolders');
+  });
+
+  test('other forged-principal refusals never trigger child repair', () async {
+    final transport = _RepairTransport()
+      ..refuseKernelSignerOffers = 1
+      ..kernelRefusalActor = 'different-author';
+    final bridge = await _connected(transport);
+    addTearDown(bridge.dispose);
+    var repairs = 0;
+    bridge.adoptChildAuthenticationRepair((_) async {
+      repairs += 1;
+      return true;
+    });
+    await expectLater(
+      bridge.session('estate-1').offerGeneratedCallOutcome(call: _estateCall()),
+      throwsA(isA<NomosTypedOfferFailure>()),
+    );
+    expect(repairs, 0);
+    expect(transport.offerCalls, 1);
+  });
+
+  test('failed kernel signer repair preserves the original refusal', () async {
+    final transport = _RepairTransport()..refuseKernelSignerOffers = 1;
+    final bridge = await _connected(transport);
+    addTearDown(bridge.dispose);
+    bridge.adoptChildAuthenticationRepair((_) async => false);
+    await expectLater(
+      bridge.session('estate-1').offerGeneratedCallOutcome(call: _estateCall()),
+      throwsA(isA<NomosTypedOfferFailure>()),
+    );
+    expect(transport.offerCalls, 1);
+  });
+
+  test('a registered repair that seats the key makes the offer succeed once',
+      () async {
+    final transport = _RepairTransport()..refuseSignerEnrollmentOffers = 1;
+    final bridge = await _connected(transport);
+    addTearDown(bridge.dispose);
+    final repairs = <ParentSignerEnrollmentMissing>[];
+    bridge.session('home').adoptChildAuthenticationRepair((refusal) async {
+      repairs.add(refusal);
+      return true;
+    });
+    final outcome = await bridge
+        .session('estate-1')
+        .offerGeneratedCallOutcome(call: _estateCall());
+    expect(outcome, isNotNull);
+    expect(transport.offerCalls, 2);
+    expect(repairs, hasLength(1));
+    expect(repairs.single.workspace, 'estate-1');
+    expect(repairs.single.code, 'nomos.authz.signer_enrollment_missing');
+  });
+
+  test('a repair that cannot seat the key surfaces the original refusal',
+      () async {
+    final transport = _RepairTransport()..refuseSignerEnrollmentOffers = 1;
+    final bridge = await _connected(transport);
+    addTearDown(bridge.dispose);
+    bridge.adoptChildAuthenticationRepair((_) async => false);
+    await expectLater(
+      bridge.session('estate-1').offerGeneratedCallOutcome(call: _estateCall()),
+      throwsA(isA<ParentSignerEnrollmentMissing>()
+          .having((error) => error.workspace, 'workspace', 'estate-1')),
+    );
+    expect(transport.offerCalls, 1);
+  });
+
+  test('a repair that throws never masks the refusal or retries', () async {
+    final transport = _RepairTransport()..refuseSignerEnrollmentOffers = 1;
+    final bridge = await _connected(transport);
+    addTearDown(bridge.dispose);
+    bridge.adoptChildAuthenticationRepair(
+      (_) async => throw StateError('home is offline'),
+    );
+    await expectLater(
+      bridge.session('estate-1').offerGeneratedCallOutcome(call: _estateCall()),
+      throwsA(isA<ParentSignerEnrollmentMissing>()),
+    );
+    expect(transport.offerCalls, 1);
+  });
+
+  test('without a registration the refusal is untouched', () async {
+    final transport = _RepairTransport()..refuseSignerEnrollmentOffers = 1;
+    final bridge = await _connected(transport);
+    addTearDown(bridge.dispose);
+    await expectLater(
+      bridge.session('estate-1').offerGeneratedCallOutcome(call: _estateCall()),
+      throwsA(isA<ParentSignerEnrollmentMissing>()),
+    );
+    expect(transport.offerCalls, 1);
+  });
+
+  test('concurrent refusals for one workspace share a single repair', () async {
+    final transport = _RepairTransport()..refuseSignerEnrollmentOffers = 2;
+    final bridge = await _connected(transport);
+    addTearDown(bridge.dispose);
+    var repairs = 0;
+    final gate = Completer<bool>();
+    bridge.adoptChildAuthenticationRepair((_) {
+      repairs += 1;
+      return gate.future;
+    });
+    final first = bridge
+        .session('estate-1')
+        .offerGeneratedCallOutcome(call: _estateCall());
+    final second = bridge
+        .session('estate-1')
+        .offerGeneratedCallOutcome(call: _estateCall());
+    await Future<void>.delayed(Duration.zero);
+    gate.complete(true);
+    await Future.wait([first, second]);
+    expect(repairs, 1);
+    expect(transport.offerCalls, 4);
+  });
+}