@githolon/dsl 0.108.6 → 0.110.0

package/dart/lib/src/reception/dart_reception.dart

@@ -0,0 +1,4280 @@
+// NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
+// remotes are replaceable custody/transport, not truth.  ⇒ ONE Nomos GitHolon
+// wasm32-wasip1 artifact {kernel · projection · embedded QuickJS engine}.
+// If a file isn't this / hosting this / authoring for this / proving this — it's gone.
+
+/// DART RECEPTION — the language-native application boundary. A Flutter app
+/// talks to the one Peer Office implementation over one typed protocol. Which
+/// Platform Shell carries that protocol is deliberately invisible here.
+///
+/// A platform round-trip is asynchronous. Reception owns language-native
+/// reactive streams and disposable presentation projections. The typed
+/// [PeerOfficeConnection] is injected by the Platform Shell, so no platform
+/// embedding can grow its own workspace lifecycle here.
+@internal
+library;
+
+import 'package:meta/meta.dart' show internal;
+
+import 'dart:async';
+import 'dart:convert';
+import 'dart:developer' as developer;
+import 'dart:typed_data';
+
+import 'package:fixnum/fixnum.dart' as fixnum;
+import 'package:nomos_peer_host/nomos_peer_host.dart' show NomosSignIn;
+import 'package:nomos_types/nomos_kernel_protocol.dart' as nomos_protocol;
+import 'package:nomos_types/src/proto/google/protobuf/any.pb.dart'
+    as google_protobuf;
+import 'package:nomos_types/nomos_types.dart'
+    show
+        nomosErrorFromInfo,
+        NomosErrorInfo,
+        ParentSignerEnrollmentMissing,
+        NomosRef,
+        VersionedNomosRef,
+        ReferenceVersionStatus,
+        ReferenceVersionCurrent,
+        ReferenceVersionOutdated,
+        ReferenceVersionUnavailable,
+        NomosCustodyEvent,
+        NomosLocalWorkRejectedEvent;
+import 'package:nomos_types/src/nomos_ref.dart' show NmsInternalNomosRefs;
+import 'package:nomos_types/src/versioned_nomos_ref.dart'
+    show NmsInternalVersionedNomosRefs;
+import 'package:nomos_types/src/foreign_ref.dart'
+    show NomosForeignReader, NomosForeignWorkspaceReader;
+
+import '../generated_call.dart'
+    show
+        NmsGeneratedCall,
+        NmsGeneratedQuery,
+        NmsGeneratedResult,
+        NmsInternalGeneratedResults;
+import '../application_model_adoption.dart'
+    show
+        NmsApprovedModelLawPackageSource,
+        NomosApprovedModel,
+        NomosModelAdoption,
+        NomosModelAdoptionOutcome,
+        NomosModelAdoptionPhase,
+        NomosModelAdoptionProgress;
+import '../application_framework_calls.dart'
+    show OwnedCustody, OwnedDeviceRequest;
+import '../kernel_primitives.dart' show NmsKernelPrimitives;
+import '../observed_session_directory.dart' show NmsObservedSessionDirectory;
+import '../replica_readiness.dart' show nmsUntilReplicaReady;
+import '../operation_receipts.dart'
+    show NmsOperationReceiptProjection, NomosOperationReceipt;
+import 'event_desk.dart' show ReceptionEventDesk;
+import 'extremum_read.dart' as extrema;
+import 'sync_diagnostics.dart';
+import 'local_copies.dart' show NomosPreservedLocalCopy, ReceptionLocalCopies;
+import 'progress_desk.dart'
+    show
+        KernelProgress,
+        KernelProgressOperation,
+        NomosSpanEvent,
+        NomosSpanPhase;
+import '../signing_identity_kernel.dart' show NmsSigningIdentityKernel;
+import '../sync_status_reducer.dart';
+import '../sync_status_projection.dart'
+    show SyncPhase, SyncStatus, TransferProgress, WorkspaceFollowStatus;
+import '../typed_watch_registry.dart' show NmsTypedWatchHandle;
+
+export '../sync_status_projection.dart'
+    show
+        SyncPhase,
+        SyncStatus,
+        TransferProgress,
+        WorkspaceFollowStatus,
+        WorkspaceFollowPhase;
+export '../operation_receipts.dart'
+    show NomosOperationPhase, NomosOperationReceipt, NomosOperationStatus;
+export 'progress_desk.dart'
+    show
+        KernelLawHydrationStep,
+        KernelProgress,
+        KernelProgressOperation,
+        KernelProgressPhase,
+        KernelProgressUnit,
+        NomosSpanEvent,
+        NomosSpanPhase;
+import '../runtime_v2_gateway.dart' show NmsRuntimeV2Gateway;
+import '../runtime_v2_transport.dart'
+    show NomosPlatformCredentialProviders, NomosKernelCallTransport;
+import 'peer_office_connection.dart' show PeerOfficeConnection;
+
+export '../runtime_v2_transport.dart' show NomosSessionCredentials;
+
+// Watches are level-triggered by local offer acknowledgements and by remote
+// custody convergence. This is only a lost-doorbell safety poll; a short idle
+// interval repeatedly transferred whole unchanged projections across FFI.
+const int _defaultWatchSafetyPollMs = 60000;
+
+/// Language-native view of the resident Peer Runtime. It binds cheap
+/// interaction handles and transports typed application operations. Placement,
+/// Git/SQLite state, Replica Follow, credentials and recovery remain owned by
+/// the peer behind this boundary.
+
+/// One stable bounded page from an authenticated declared-query index. [cursor] is opaque framework
+/// state: pass it back unchanged to request the next page; [done] means this page exhausted the query.
+final class NomosPage<T> {
+  const NomosPage({
+    required this.rows,
+    required this.cursor,
+    required this.done,
+  });
+
+  final List<T> rows;
+  final String? cursor;
+  final bool done;
+}
+
+/// Typed authority evidence carried by an offer that plans exactly one child birth. The protobuf
+/// declaration is the one source of truth for Rust, TypeScript and Dart; USDA is its durable state
+/// projection, not another transport type. The legacy reception envelope carries only these protobuf bytes.
+typedef NomosBirthCertificate = nomos_protocol.BirthCertificate;
+
+/// Typed compare-and-merge witness carried by an offer. The protobuf schema is
+/// the only transport shape; generated conflict helpers never rebuild it as a
+/// string-keyed map.
+typedef NomosConflictSnapshot = nomos_protocol.ConflictSnapshot;
+
+/// Typed result of one child-workspace birth. The kernel protobuf is the
+/// transport authority; hosts do not reinterpret birth state through maps.
+typedef NomosBirthOutcome = nomos_protocol.BirthOutcome;
+
+typedef NomosBirthOutcomeStatus = nomos_protocol.BirthOutcomeStatus;
+
+/// THE EXPECTED RUNNER-BUNDLE VERSION FLOOR — the @githolon/runtime release this nomos_client version
+/// ships alongside. The bundle stamps its own version into the ready frame; anything OLDER (or a
+/// pre-stamp bundle, which reports nothing) is a stale baked asset and fails loudly at boot.
+/// MUST move with the paired @githolon/runtime release — a release-hygiene test pairs it with the
+/// runner stamp (the pubspec-pins pattern).
+const String kExpectedRunnerBundleVersion = '0.100.6';
+
+/// A STALE BAKED RUNNER BUNDLE: the app's built assets carry an older nomos-runner.js than this
+/// nomos_client release ships — Flutter's build cache kept it across a pub upgrade. Thrown from
+/// [DartReception.ready] at boot (loud, immediate, named) instead of letting one-version-old runtime
+/// behavior masquerade as framework bugs.
+class StaleRunnerBundle implements Exception {
+  StaleRunnerBundle({required this.found, required this.expected});
+
+  /// The bundle's self-reported version (null = a pre-stamp bundle, definitionally stale).
+  final String? found;
+
+  /// The minimum version this nomos_client release expects ([kExpectedRunnerBundleVersion]).
+  final String expected;
+
+  @override
+  String toString() =>
+      'StaleRunnerBundle: the baked nomos-runner.js is ${found ?? "un-stamped (pre-0.77.1)"} but this '
+      'nomos_client expects >= $expected. Flutter kept an old bundle across the upgrade — run '
+      '`flutter clean` and rebuild (verify with shasum of flutter_assets/.../nomos-runner.js), or pass '
+      'DartReception(..., allowStaleRunnerBundle: true) for a deliberate mixed-version setup.';
+}
+
+/// One opaque point in this workspace's verified history. Applications use it as the handle passed to a
+/// generated client's `past.at(moment)`; [id] is framework identity, not a business field and need never be
+/// parsed. The remaining fields make a timeline useful without exposing commit or event-sourcing ceremony.
+class NomosMoment {
+  final String id;
+  final DateTime? occurredAt;
+  final String? performedBy;
+  final String? domain;
+  final String? action;
+
+  const NomosMoment({
+    required this.id,
+    this.occurredAt,
+    this.performedBy,
+    this.domain,
+    this.action,
+  });
+}
+
+/// One law-minted aggregate from a `.creates(...)` offer: the full typed [id] (`<domain>.<Type>_<uuidv7>`)
+/// and its [type] (`<domain>.<Type>`).
+class NomosCreated {
+  final String type;
+  final String id;
+
+  /// The workspace the offer ran on (NomosRef). Additive — defaults to '' on older runners that
+  /// don't stamp it; then [ref] is workspace-blank (still a valid locator on the local plane).
+  final String workspace;
+  const NomosCreated({
+    required this.type,
+    required this.id,
+    this.workspace = '',
+  });
+
+  /// The canonical [NomosRef] view — the `{workspace,type,id}` triple, followable/serializable
+  /// (`nomos://<workspace>/<type>/<id>`). One reference, everywhere.
+  NomosRef<Object?> get ref => NmsInternalNomosRefs.create<Object?>(
+        workspace: workspace,
+        type: type,
+        id: id,
+      );
+  @override
+  String toString() => id;
+}
+
+/// A bounding box for spatial reads — the R*Tree probe's extent. Spatial is a GENERIC 2D index,
+/// so the CANONICAL axes are axis-neutral (`[minX, minY] .. [maxX, maxY]`); the axes' meaning
+/// (earth coordinates, floor-plan mm, anything) is the tenant's business. The original geographic
+/// `minLng`/`minLat`/`maxLng`/`maxLat` named params remain accepted forever (era rule) — pass either
+/// source-level shape. The exact Runtime v2 protobuf boundary carries only the canonical axes.
+class NomosBbox {
+  final double minX;
+  final double minY;
+  final double maxX;
+  final double maxY;
+
+  /// Construct from either the canonical generic axes (`minX`/`minY`/`maxX`/`maxY`) OR the
+  /// geographic aliases (`minLng`/`minLat`/`maxLng`/`maxLat`). Provide exactly one shape per axis.
+  NomosBbox({
+    double? minX,
+    double? minY,
+    double? maxX,
+    double? maxY,
+    double? minLng,
+    double? minLat,
+    double? maxLng,
+    double? maxLat,
+  })  : minX = (minX ?? minLng)!,
+        minY = (minY ?? minLat)!,
+        maxX = (maxX ?? maxLng)!,
+        maxY = (maxY ?? maxLat)!;
+
+  /// Deprecated geographic accessors — spatial axes are generic. Prefer [minX]/[minY]/[maxX]/[maxY].
+  @Deprecated(
+    'Spatial axes are generic; use minX/minY. Kept for source compat.',
+  )
+  double get minLng => minX;
+  @Deprecated(
+    'Spatial axes are generic; use minX/minY. Kept for source compat.',
+  )
+  double get minLat => minY;
+  @Deprecated(
+    'Spatial axes are generic; use maxX/maxY. Kept for source compat.',
+  )
+  double get maxLng => maxX;
+  @Deprecated(
+    'Spatial axes are generic; use maxX/maxY. Kept for source compat.',
+  )
+  double get maxLat => maxY;
+}
+
+// ── E2E SEALING (the sealing client) — the GENERIC key-custody surface. Generated domain clients bake the
+//   per-domain map + seal/read helpers, but these types are domain-agnostic, so they live here (in the
+//   nomos_client library) exactly like [MissingOfferAuthority] — one definition, re-exported per client. ──
+
+/// A held E2E scope key: the base64 symmetric key + the epoch it belongs to (forward-only rotation).
+class NomosScopeKey {
+  final String scope;
+  final int epoch;
+  final String key;
+
+  /// Framework-private signing-key subject used to pin `.owned()` custody to one approved device.
+  final String? ownedKeySubject;
+
+  /// Framework-private encrypted handoff, present only while seating the first device.
+  final OwnedCustody? ownedCustody;
+
+  /// Framework-private deterministic child address, present only for an unborn owned business aggregate.
+  final String? workspace;
+  const NomosScopeKey({
+    required this.scope,
+    required this.epoch,
+    required this.key,
+    this.ownedKeySubject,
+    this.ownedCustody,
+    this.workspace,
+  });
+}
+
+/// The entire app-facing multi-device surface for owned business state. The
+/// request is one compiler-generated framework value; transport encoders may
+/// package it as USDA for QR/share without turning it into an opaque string.
+class NomosDevices {
+  final NomosSession session;
+  final String domain;
+  final String domainHash;
+  final String? actor;
+  final String scope;
+  final Future<NomosOfferOutcome> Function(
+    NomosOwnedDeviceApprovalPreparation preparation,
+  ) approvePrepared;
+
+  const NomosDevices({
+    required this.session,
+    required this.domain,
+    required this.domainHash,
+    required this.actor,
+    required this.scope,
+    required this.approvePrepared,
+  });
+
+  Future<OwnedDeviceRequest> request() =>
+      session.nomosOwnedDeviceRequest(scope);
+
+  Future<NomosOfferOutcome> approve(OwnedDeviceRequest request) async {
+    final principal = actor;
+    if (principal == null || principal.trim().isEmpty) {
+      throw StateError('devices.approve() needs a signed-in Nomos session');
+    }
+    final payload = await session.nomosPrepareOwnedDeviceApproval(
+      request,
+      scope,
+    );
+    return approvePrepared(payload);
+  }
+}
+
+/// The one business-level recovery policy surface. The handoff protocol stays inside Nomos.
+class NomosRecovery {
+  final NomosSession session;
+  final String domain;
+  final String domainHash;
+  final String scope;
+
+  const NomosRecovery({
+    required this.session,
+    required this.domain,
+    required this.domainHash,
+    required this.scope,
+  });
+
+  /// Opt into all-device-loss recovery with [person]. This is intentionally one-way for a workspace:
+  /// a principal who has legitimately recovered a key cannot be made to forget it later.
+  Future<nomos_protocol.OwnedIdentityProtection> protectWith(String person) {
+    if (person.trim().isEmpty) {
+      throw ArgumentError(
+        'recovery.protectWith() needs the person who will recover you',
+      );
+    }
+    return session.nomosProtectOwnedIdentity(
+      scope: scope,
+      domain: domain,
+      domainHash: domainHash,
+      recoveryPrincipal: person,
+    );
+  }
+}
+
+/// The app-supplied KEY CUSTODY surface (E2E sealing). Supply one to a generated `<Domain>Client` and its
+/// encrypted directive fields SEAL automatically before dispatch + encrypted read fields DECRYPT
+/// automatically. [WrappedKeyStore] is the default over the on-chain WrappedKeys; an app may implement this
+/// to source keys from secure storage (the key custody policy stays the app's; the protocol plumbing does not).
+abstract class NomosKeyStore {
+  /// The CURRENT (highest-epoch) scope key, for SEALING a write. null ⇒ EncryptionKeyUnavailable.
+  Future<NomosScopeKey?> scopeKey(String scope);
+
+  /// EVERY held key for these scopes (all epochs), injected on reads so old ciphertext also decrypts.
+  Future<List<NomosScopeKey>> readKeys(List<String> scopes);
+}
+
+/// Thrown when a write must seal an encrypted field but the KeyStore holds no key for its scope — the write
+/// NEVER falls through to a plaintext dispatch (the sid-envelope gate would refuse it anyway; we pre-fire).
+class EncryptionKeyUnavailable implements Exception {
+  final String scope;
+  final String field;
+  String get code => 'nomos.crypto.key_unavailable';
+  String get recommendedAction => 'obtainScopeKey';
+  EncryptionKeyUnavailable(this.scope, this.field);
+  @override
+  String toString() =>
+      'EncryptionKeyUnavailable: cannot seal "$field": no scope key held for "$scope" (obtain the cap + wrap the scope epoch first)';
+}
+
+// ── E2E OWNER CEREMONY (the sealing client, slice 2). Domain-
+//   agnostic, so it lives here (re-exported per client) exactly like the KeyStore. It composes the framework
+//   key-epoch fan-out (`advanceKeyEpoch`, dispatched by its REAL id) with the domain's own grant/revoke
+//   directive, resolving the roster + each member's wrap-target pubkey FROM THE CHAIN — so the operator-blind
+//   handshake (grant → advance epoch → wrap to every member) is ONE call. Mirror of the TS `_ownerEncryption`. ──
+
+/// Thrown when a `.births()` offer ADMITTED on the parent (a head, a 200) but a child workspace did NOT come
+/// up — its `birthOutcomes` entry carried a `status` other than "born" (e.g. `"failed"`/`"refused"` with code
+/// `BirthLawPackageUnavailable`, when the child's law package is not resolvable from the parent's custody).
+/// Without this, the app would open the child and poll `head:null` until timeout with no reason. Callers catch
+/// it to see the child name(s), the kernel [code], and the [reason]. [head] is the parent write that landed.
+class BirthIncomplete implements Exception {
+  /// The failed typed kernel outcomes, status != [NomosBirthOutcomeStatus.BIRTH_OUTCOME_STATUS_BORN].
+  final List<NomosBirthOutcome> failedBirths;
+
+  /// The parent write's local head — the parent offer itself sealed; only the child did not come up.
+  final String head;
+
+  BirthIncomplete(this.failedBirths, {this.head = ''});
+
+  /// The first failed child's kernel code (e.g. `BirthLawPackageUnavailable`), or `BirthFailed`.
+  String get code =>
+      failedBirths.isNotEmpty && failedBirths.first.code.isNotEmpty
+          ? failedBirths.first.code
+          : 'BirthFailed';
+
+  /// The child workspace name(s) that did not come up.
+  List<String> get workspaces =>
+      failedBirths.map((o) => o.workspace).where((s) => s.isNotEmpty).toList();
+
+  @override
+  String toString() {
+    final list = failedBirths
+        .map(
+          (o) =>
+              '${o.workspace.isEmpty ? '?' : o.workspace} [${o.status.name}${o.code.isNotEmpty ? ': ${o.code}' : ''}]'
+              '${o.reason.isNotEmpty ? ' — ${o.reason}' : ''}',
+        )
+        .join('; ');
+    final lawUnavailable = failedBirths.any(
+      (o) => o.code == 'BirthLawPackageUnavailable',
+    );
+    return 'BirthIncomplete: ${failedBirths.length} child workspace(s) did NOT come up — $list. '
+        'The parent offer admitted, but the child was not fully born, so opening it would poll head:null '
+        'until timeout. ${lawUnavailable ? "The child's law package is not resolvable from the parent's "
+            "custody — deploy it to the parent (POST /v2/workspaces/<parent>/domains) BEFORE birthing." : "See the outcome's reason/code."}';
+  }
+}
+
+nomos_protocol.NomosRef _nomosRefToProtocol<TAggregate>(
+  NomosRef<TAggregate> reference,
+) =>
+    nomos_protocol.NomosRef(
+      workspace: NmsInternalNomosRefs.workspace(reference),
+      aggregateType: NmsInternalNomosRefs.type(reference),
+      aggregateId: NmsInternalNomosRefs.id(reference),
+    );
+
+/// One exact key wrap prepared by the framework-owned custody machinery.
+/// Generated clients lower this value directly to canonical USDA; it is never a
+/// tenant-authored dictionary.
+class NomosOwnedWrapPreparation {
+  final String recipientPrincipal;
+  final String recipientPubKey;
+  final String hpkeEpk;
+  final String ct;
+
+  const NomosOwnedWrapPreparation({
+    required this.recipientPrincipal,
+    required this.recipientPubKey,
+    required this.hpkeEpk,
+    required this.ct,
+  });
+}
+
+/// A wrap which explicitly identifies the historic epoch it opens.
+class NomosHistoricOwnedWrapPreparation extends NomosOwnedWrapPreparation {
+  final int epoch;
+
+  const NomosHistoricOwnedWrapPreparation({
+    required super.recipientPrincipal,
+    required super.recipientPubKey,
+    required super.hpkeEpk,
+    required super.ct,
+    required this.epoch,
+  });
+}
+
+/// Exhaustive result of the framework-owned record preparation operation.
+/// Each subtype corresponds to one law directive and therefore one generated
+/// USDA encoder.
+sealed class NomosOwnedRecordPreparation {
+  final String ownedKeySubject;
+  final OwnedCustody? ownedCustody;
+
+  const NomosOwnedRecordPreparation({
+    required this.ownedKeySubject,
+    this.ownedCustody,
+  });
+}
+
+class NomosOwnedSharePreparation extends NomosOwnedRecordPreparation {
+  final String recordId;
+  final String peer;
+  final int epoch;
+  final String sharedAt;
+  final List<NomosHistoricOwnedWrapPreparation> wraps;
+
+  const NomosOwnedSharePreparation({
+    required super.ownedKeySubject,
+    super.ownedCustody,
+    required this.recordId,
+    required this.peer,
+    required this.epoch,
+    required this.sharedAt,
+    required this.wraps,
+  });
+}
+
+class NomosOwnedUnsharePreparation extends NomosOwnedRecordPreparation {
+  final String recordId;
+  final String peer;
+  final int epoch;
+  final String changedAt;
+  final List<NomosOwnedWrapPreparation> wraps;
+
+  const NomosOwnedUnsharePreparation({
+    required super.ownedKeySubject,
+    super.ownedCustody,
+    required this.recordId,
+    required this.peer,
+    required this.epoch,
+    required this.changedAt,
+    required this.wraps,
+  });
+}
+
+class NomosOwnedTransferPreparation extends NomosOwnedRecordPreparation {
+  final String recordId;
+  final String newOwner;
+  final List<String> previousReaders;
+  final int epoch;
+  final String changedAt;
+  final List<NomosHistoricOwnedWrapPreparation> historicWraps;
+
+  const NomosOwnedTransferPreparation({
+    required super.ownedKeySubject,
+    super.ownedCustody,
+    required this.recordId,
+    required this.newOwner,
+    required this.previousReaders,
+    required this.epoch,
+    required this.changedAt,
+    required this.historicWraps,
+  });
+}
+
+/// Exact framework preparation for the atomic device-approval directive.
+class NomosOwnedDeviceApprovalPreparation {
+  final String newKeySubject;
+  final OwnedCustody ownedCustody;
+  final String verifiedVia;
+  final int validFromEpoch;
+  final String approvedAt;
+  final String ownedKeySubject;
+
+  const NomosOwnedDeviceApprovalPreparation({
+    required this.newKeySubject,
+    required this.ownedCustody,
+    required this.verifiedVia,
+    required this.validFromEpoch,
+    required this.approvedAt,
+    required this.ownedKeySubject,
+  });
+}
+
+/// The result of [DartReception.offerCreates]: the new local [head], every aggregate the plan minted, and —
+/// for a `.births()` directive — the child workspace(s) the offer brought into being on this local plane.
+/// The proof material a generated offer presents to the kernel.
+///
+/// Generated law chooses this; application callers do not. [sessionCredentials] preserves the
+/// ordinary session posture. [enrolledDevice] deliberately withholds any provider token so a
+/// stale provider epoch cannot prevent an already enrolled device from authoring a recovery offer.
+enum NomosOfferAuthenticationProof { sessionCredentials, enrolledDevice }
+
+/// The kernel's exact diagnosis of the provider credential held by this session.
+///
+/// This deliberately does not expose protobuf names to generated application
+/// clients.  It is a typed framework fact used to decide whether a parent-law
+/// epoch recovery is applicable; callers never inspect an error string.
+enum NomosProviderTokenVerification {
+  unspecified,
+  valid,
+  noMatchingKey,
+  expired,
+  notYetValid,
+  issuerMismatch,
+  audienceMismatch,
+  badSignature,
+  malformed,
+  unsupportedAlgorithm,
+  badKey,
+  missingSubject,
+  noVerifier,
+  missingToken,
+}
+
+/// Current kernel-authenticated facts needed before retrying an ordinary offer.
+final class NomosAuthenticationPosture {
+  const NomosAuthenticationPosture({
+    required this.providerToken,
+    required this.enrolledDevice,
+    required this.resolvedPrincipal,
+    this.birthEvidence =
+        nomos_protocol.BirthEvidenceStatus.BIRTH_EVIDENCE_STATUS_UNSPECIFIED,
+    this.birthEvidenceDetail = '',
+  });
+
+  final NomosProviderTokenVerification providerToken;
+  final bool enrolledDevice;
+  final String resolvedPrincipal;
+  final nomos_protocol.BirthEvidenceStatus birthEvidence;
+  final String birthEvidenceDetail;
+
+  bool get needsBirthDelegation =>
+      birthEvidence ==
+      nomos_protocol
+          .BirthEvidenceStatus.BIRTH_EVIDENCE_STATUS_DELEGATION_REQUIRED;
+
+  bool isReadyToBirthFor(String expectedPrincipal) =>
+      isReadyFor(expectedPrincipal) &&
+      (birthEvidence ==
+              nomos_protocol.BirthEvidenceStatus.BIRTH_EVIDENCE_STATUS_READY ||
+          birthEvidence ==
+              nomos_protocol
+                  .BirthEvidenceStatus.BIRTH_EVIDENCE_STATUS_NOT_REQUIRED);
+
+  bool isReadyFor(String expectedPrincipal) =>
+      providerToken == NomosProviderTokenVerification.valid &&
+      enrolledDevice &&
+      expectedPrincipal.isNotEmpty &&
+      resolvedPrincipal == expectedPrincipal;
+}
+
+/// A typed kernel-call refusal. Generated clients may inspect [code] only to
+/// choose another typed kernel query; prose remains diagnostic, never control
+/// flow.
+final class NomosKernelCallFailure implements Exception {
+  const NomosKernelCallFailure({required this.code, required this.message});
+
+  final String code;
+  final String message;
+
+  @override
+  String toString() => 'NomosKernelCallFailure($code: $message)';
+}
+
+class NomosOfferOutcome {
+  final String head;
+  final String intentId;
+  final List<NomosCreated> created;
+
+  /// Every business aggregate touched by the sealed intent, including creates,
+  /// mutations, deterministic ensures and archives.
+  final List<NomosCreated> affected;
+
+  /// The workspace the offer ran on (NomosRef). Additive; '' on older runners. Each [created] ref already
+  /// carries this, so `outcome.created.first.ref` is the full followable `{workspace,type,id}` locator.
+  final String workspace;
+
+  /// The born child workspace name(s), when the offer ran a `.births()`
+  /// directive (else empty). `bindWorkspace(name)` returns a stable sibling
+  /// interaction handle; the peer routes each later operation from placement.
+  final List<String> born;
+
+  /// Typed per-child outcomes reported by the kernel, when present.
+  final List<NomosBirthOutcome> birthOutcomes;
+
+  final NomosOperationReceipt? _receipt;
+
+  /// Awaitable remote-custody witness for this exact write.
+  NomosOperationReceipt get receipt =>
+      _receipt ??
+      (throw StateError(
+        'This legacy offer outcome has no operation receipt; regenerate the application client.',
+      ));
+
+  const NomosOfferOutcome({
+    required this.head,
+    this.intentId = '',
+    required this.created,
+    this.affected = const [],
+    this.workspace = '',
+    this.born = const [],
+    this.birthOutcomes = const [],
+    NomosOperationReceipt? receipt,
+  }) : _receipt = receipt;
+
+  /// TRUE when the offer COMMITTED — it advanced the ledger to a new head (a write landed and/or a child
+  /// was born). A REFUSED offer never yields an outcome (it throws / surfaces its typed law error), so a
+  /// present outcome with a head is a success. Sugar so app code writes `if (outcome.ok)` instead of
+  /// hand-checking `head`/`created`/`born` (the co2 friction: "there's no `.ok`").
+  bool get ok => head.isNotEmpty;
+
+  /// The born child workspace(s) as followable [NomosRef]s — hand one to [DartReception.follow]
+  /// (`final estate = await engine.follow(outcome.bornRefs.single);`) so app code never carries a
+  /// loose workspace string. The ref's type is the reserved `nomos.Workspace` locator tag.
+  List<NomosRef<Object?>> get bornRefs => born
+      .map(
+        (w) => NmsInternalNomosRefs.create<Object?>(
+          workspace: w,
+          type: 'nomos.Workspace',
+          id: w,
+        ),
+      )
+      .toList();
+}
+
+/// A generated protobuf offer response that did not admit the proposed
+/// change. Keeping the response typed preserves every exhaustive kernel
+/// outcome without translating it through an exception-shaped map.
+final class NomosTypedOfferFailure implements Exception {
+  const NomosTypedOfferFailure(this.response);
+
+  final nomos_protocol.OfferResponse response;
+
+  @override
+  String toString() {
+    final detail = switch (response.whichOutcome()) {
+      nomos_protocol.OfferResponse_Outcome.refused =>
+        '${response.refused.refusal.code.name}: ${response.refused.refusal.message}',
+      nomos_protocol.OfferResponse_Outcome.deadLettered =>
+        response.deadLettered.reason,
+      nomos_protocol.OfferResponse_Outcome.quarantined =>
+        response.quarantined.reason,
+      nomos_protocol.OfferResponse_Outcome.blockedOnDependency =>
+        response.blockedOnDependency.detail,
+      final outcome => outcome.name,
+    };
+    return 'NomosTypedOfferFailure($detail)';
+  }
+}
+
+/// One compiler-declared OSGi Contract Namespace requirement.
+///
+/// Generated clients carry this named value to the local kernel. The kernel
+/// describes its own capabilities through [nomos_protocol.OsgiResourceResponse];
+/// no host-fetched JSON or generic attribute map participates in the bind.
+final class NmsKernelContractRequirement {
+  const NmsKernelContractRequirement({
+    required this.namespace,
+    required this.name,
+    required this.version,
+  });
+
+  final String namespace;
+  final String name;
+  final String version;
+}
+
+final class NomosKernelContractMismatch implements Exception {
+  const NomosKernelContractMismatch(this.missing, {this.lawHash});
+
+  final List<NmsKernelContractRequirement> missing;
+  final String? lawHash;
+
+  @override
+  String toString() {
+    final contracts = missing
+        .map((requirement) => '${requirement.name}=${requirement.version}')
+        .join(', ');
+    final normalizedLaw =
+        lawHash?.replaceFirst(RegExp(r'^(sha256:|policy:)'), '');
+    final law = normalizedLaw == null || normalizedLaw.isEmpty
+        ? ''
+        : ' required by law ${normalizedLaw.substring(0, normalizedLaw.length.clamp(0, 8))}';
+    return 'NomosKernelContractMismatch($contracts$law)';
+  }
+}
+
+/// Exact read-only answer to an authoring preflight. It is runtime posture,
+/// not an authorization grant: the target kernel still judges the real offer.
+final class NmsAuthoringPreflight {
+  const NmsAuthoringPreflight({
+    required this.admissible,
+    required this.workspace,
+    required this.directive,
+    required this.cause,
+    required this.causes,
+    this.actor,
+    this.keyHash,
+    this.domain,
+    this.relation,
+    this.object,
+    this.detail,
+  });
+
+  final bool admissible;
+  final String workspace;
+  final String directive;
+  final nomos_protocol.AuthoringPreflightCause cause;
+  final List<nomos_protocol.AuthoringPreflightCause> causes;
+  final String? actor;
+  final String? keyHash;
+  final String? domain;
+  final String? relation;
+  final String? object;
+  final String? detail;
+}
+
+/// Ephemeral correlation counters owned by one Reception plane and shared by
+/// every workspace view over that plane. They are presentation/protocol state,
+/// never custody or kernel truth.
+final class _ReceptionSequences {
+  int request = 0;
+  int localSpan = 0;
+}
+
+final class _CompatibilityCacheEntry {
+  _CompatibilityCacheEntry(this.matrix, this.answer);
+
+  final Uint8List matrix;
+  final Future<nomos_protocol.InterfaceCompatibilityVerdict> answer;
+}
+
+bool _sameBytes(Uint8List left, Uint8List right) {
+  if (identical(left, right)) return true;
+  if (left.length != right.length) return false;
+  for (var index = 0; index < left.length; index += 1) {
+    if (left[index] != right[index]) return false;
+  }
+  return true;
+}
+
+/// Dart's language-native Reception. It presents typed sessions, values and
+/// streams over one [PeerOfficeConnection] supplied by the Platform Shell.
+/// A tenant-registered repair for `nomos.authz.signer_enrollment_missing`:
+/// given the typed refusal from a child workspace, author the parent's nominal
+/// child-authentication repair and resolve true once the child seats this
+/// device's key (the reception then retries the refused offer once).
+typedef NomosChildAuthenticationRepair = Future<bool> Function(
+  ParentSignerEnrollmentMissing refusal,
+);
+
+/// Proof that the Peer Office has bound one interaction and named its exact
+/// credential capability. Only [DartReception.bindSession] can create this.
+///
+/// Platform shells must carry this value to credential registration, making
+/// "register before bind" unrepresentable at the Dart API boundary.
+final class NomosBoundInteraction {
+  const NomosBoundInteraction._({
+    required this.session,
+    required this.workspace,
+    required this.credentialCapability,
+  });
+
+  final String session;
+  final String workspace;
+  final String credentialCapability;
+}
+
+class DartReception {
+  final PeerOfficeConnection _transport;
+  final ReceptionEventDesk _events;
+  // A disposable client projection of Runtime v2's live sessions. It provides
+  // stable Dart handles but is never custody or lifecycle authority.
+  final NmsObservedSessionDirectory<NomosSession> _sessions;
+  // Ephemeral application handles over stable receipt identities emitted by
+  // the kernel/runtime. No admission truth is manufactured in Dart.
+  final NmsOperationReceiptProjection _receipts;
+  final _ReceptionSequences _sequences;
+  final NmsRuntimeV2Gateway _runtimeV2;
+  final Map<String, List<_CompatibilityCacheEntry>> _compatibilityBySession =
+      <String, List<_CompatibilityCacheEntry>>{};
+  StreamSubscription<nomos_protocol.RuntimeEvent>? _runtimeEventSub;
+
+  DartReception(
+    PeerOfficeConnection transport, {
+    this.allowStaleRunnerBundle = false,
+  })  : _transport = transport,
+        _events = ReceptionEventDesk(),
+        _sessions = NmsObservedSessionDirectory<NomosSession>(),
+        _receipts = NmsOperationReceiptProjection(),
+        _sequences = _ReceptionSequences(),
+        _runtimeV2 = NmsRuntimeV2Gateway(transport) {
+    _runtimeEventSub = _transport.runtimeEvents.listen(
+      _onRuntimeEvent,
+      onError: _onTransportError,
+    );
+  }
+
+  void _onRuntimeEvent(nomos_protocol.RuntimeEvent event) {
+    if (event.hasReady()) {
+      final stale = _staleBundleError(event.ready.runtimeVersion);
+      if (stale != null && !allowStaleRunnerBundle) {
+        _events.failReady(stale);
+      } else {
+        _events.markReady();
+      }
+      return;
+    }
+    if (event.hasWatchChanged()) {
+      _eventPlane._events.typedWatches.deliver(event.watchChanged);
+      return;
+    }
+    if (event.hasModelAdoptionProgress()) {
+      // The office brings a workspace onto the application's approved law and
+      // reports each phase; this projects the observation onto the workspace's
+      // sync status and the adoption stream. No lifecycle step is chosen here.
+      final progress = NomosModelAdoptionProgress.fromRuntime(
+        event.modelAdoptionProgress,
+      );
+      _eventPlane._events.publishModelAdoption(progress);
+      _eventPlane._invalidateCompatibility(
+        event.hasSession() ? event.session : null,
+      );
+      _eventPlane._updateScopedStatus(
+        event.hasSession() ? event.session : null,
+        (current) => current.copyWith(modelAdoption: progress),
+      );
+      return;
+    }
+    if (event.hasSyncCompleted()) {
+      final completed = event.syncCompleted;
+      final session = event.hasSession() ? event.session : null;
+      _eventPlane._events.publishSync(event);
+      _eventPlane._invalidateCompatibility(session);
+      if (session != null) {
+        if (!completed.hasFailure() && completed.hasResult()) {
+          _eventPlane._advanceOperationReceipts(session, completed.result);
+        }
+      }
+      final observedAt = DateTime.now();
+      _eventPlane._updateScopedStatus(
+        session,
+        (current) => reduceSyncCompletion(current, completed, observedAt),
+      );
+      return;
+    }
+    if (event.hasLawChanged()) {
+      _eventPlane._invalidateCompatibility(
+        event.hasSession() ? event.session : null,
+      );
+      return;
+    }
+    if (event.hasLinkChanged()) {
+      _eventPlane._events.publishSync(event);
+      final session = event.hasSession() ? event.session : null;
+      if (event.linkChanged.status ==
+          nomos_protocol.LinkStatus.LINK_STATUS_CLOSED) {
+        final closedAt = DateTime.now();
+        _eventPlane._updateScopedStatus(
+          session,
+          // A settled, live workspace was known current until this moment.
+          (current) => current.copyWith(
+            phase: SyncPhase.offline,
+            live: false,
+            lastSyncedAt: current.live && current.phase == SyncPhase.idle
+                ? closedAt
+                : null,
+          ),
+        );
+      } else if (event.linkChanged.status ==
+          nomos_protocol.LinkStatus.LINK_STATUS_OPEN) {
+        _eventPlane._updateScopedStatus(
+          session,
+          (current) => current.copyWith(
+            live: true,
+            phase:
+                current.phase == SyncPhase.offline ? SyncPhase.checking : null,
+          ),
+        );
+      }
+      return;
+    }
+    if (event.hasFollowsSummary()) {
+      final summary = event.followsSummary;
+      _eventPlane._events.syncStatuses.updateFollows(
+        summary.followed,
+        summary.settled,
+        live: summary.live,
+        observedAt: summary.hasObservedAtUnixMillis()
+            ? DateTime.fromMillisecondsSinceEpoch(
+                summary.observedAtUnixMillis.toInt())
+            : null,
+        statuses: [
+          for (final follow in summary.workspaces)
+            WorkspaceFollowStatus.fromRuntime(follow),
+        ],
+      );
+      return;
+    }
+    if (event.hasCustodyChanged()) {
+      _eventPlane._events.publishCustody(
+        NomosCustodyEvent.fromRuntime(
+          event.custodyChanged,
+          session: event.hasSession() ? event.session : null,
+        ),
+      );
+      return;
+    }
+    if (event.hasForeignPlacementIgnored()) {
+      final ignored = event.foreignPlacementIgnored;
+      developer.log(
+        'ignored a ${ignored.source} placement at ${ignored.origin}'
+        '${ignored.workspace.isEmpty ? '' : ' for ${ignored.workspace}'}: '
+        'not one of this host\'s configured providers',
+        name: 'nomos.origin-fence',
+      );
+      _eventPlane._events.publishForeignPlacementIgnored(ignored);
+      return;
+    }
+    if (event.hasLocalCopyPreserved()) {
+      _eventPlane._events.publishLocalCopyPreserved(
+        NomosPreservedLocalCopy.fromRuntime(event.localCopyPreserved),
+      );
+      return;
+    }
+    if (event.hasLocalWorkRejected()) {
+      _eventPlane._events.publishLocalWorkRejected(
+        NomosLocalWorkRejectedEvent.fromRuntime(
+          event.localWorkRejected,
+          session: event.hasSession() ? event.session : null,
+        ),
+      );
+      return;
+    }
+    if (event.hasTransferProgress()) {
+      final progress = TransferProgress.fromRuntime(event.transferProgress);
+      _eventPlane._events.progress.observeTransfer(progress);
+      _eventPlane._updateScopedStatus(
+        event.hasSession() ? event.session : null,
+        (current) => reduceTransferProgress(current, progress),
+      );
+      return;
+    }
+    if (event.hasMaintenanceProgress()) {
+      _eventPlane._events.observeMaintenance(event.maintenanceProgress);
+      return;
+    }
+    if (event.hasReceivingGroupConvergence()) {
+      // The receiving-group convergence tail (posture → recovery → authentication →
+      // verification), reported by the office to every session bound to the group.
+      _eventPlane._events
+          .publishReceivingGroupConvergence(event.receivingGroupConvergence);
+      return;
+    }
+    if (event.hasKernelProgress()) {
+      final progress = KernelProgress.fromRuntime(event.kernelProgress);
+      _eventPlane._events.progress.observeKernel(progress);
+      final session = event.hasSession()
+          ? event.session
+          : _eventPlane._sessions.boundCount == 1
+              ? _eventPlane._sessions.soleBoundSession
+              : null;
+      if (progress.operation == KernelProgressOperation.restoreMain &&
+          session != null &&
+          _eventPlane._sessions.isBound(session)) {
+        _eventPlane._events.observeRestore(
+          _eventPlane._sessions.workspaceFor(session),
+          progress,
+        );
+      }
+      return;
+    }
+    if (event.hasSpan()) {
+      final message = NomosSpanEvent.fromRuntime(
+        event.span,
+        session: event.hasSession() ? event.session : null,
+      );
+      _eventPlane._events.progress.observeSpan(message);
+    }
+  }
+
+  void _onTransportError(Object error, StackTrace stackTrace) {
+    _events.failReady(error, stackTrace);
+  }
+
+  void _invalidateCompatibility(String? session) {
+    final cache = _eventPlane._compatibilityBySession;
+    if (session == null || session.isEmpty) {
+      cache.clear();
+    } else {
+      cache.remove(session);
+    }
+  }
+
+  /// Escape hatch for DELIBERATE mixed-version setups (framework dev, A/B probes): accept a runner
+  /// bundle older than [kExpectedRunnerBundleVersion] instead of failing [ready].
+  final bool allowStaleRunnerBundle;
+
+  /// null = acceptable; otherwise the typed boot error. "unbundled-dev" (the in-repo source lane)
+  /// always passes; a missing stamp means a pre-stamp (definitionally stale) bundle.
+  StaleRunnerBundle? _staleBundleError(Object? bundleVersion) {
+    final v = bundleVersion is String ? bundleVersion : null;
+    if (v == 'unbundled-dev') return null;
+    if (v != null && _semverAtLeast(v, kExpectedRunnerBundleVersion))
+      return null;
+    return StaleRunnerBundle(found: v, expected: kExpectedRunnerBundleVersion);
+  }
+
+  static bool _semverAtLeast(String v, String min) {
+    List<int> parse(String s) =>
+        s.split('-').first.split('.').map((p) => int.tryParse(p) ?? 0).toList();
+    final a = parse(v), b = parse(min);
+    for (var i = 0; i < 3; i++) {
+      final x = i < a.length ? a[i] : 0, y = i < b.length ? b[i] : 0;
+      if (x != y) return x > y;
+    }
+    return true;
+  }
+
+  /// A SESSION VIEW's super-constructor: shares the parent's [_transport] but does NOT subscribe (the parent
+  /// owns the one message loop + all correlation). Only [NomosSession] uses it.
+  /// CHILD AUTHENTICATION REPAIR — the tenant-registered lane behind
+  /// `nomos.authz.signer_enrollment_missing`. A child workspace judges a device
+  /// key it has never seen (a key enrolled into the parent AFTER the child was
+  /// born, or a child born on another device). The parent's law already owns the
+  /// nominal repair (`repairsChildAuthenticationFor`: an enrolled-device intent
+  /// that emits one signer effect into the child). The framework cannot name
+  /// that tenant intent, so the application registers it here once; the
+  /// reception then invokes it on the refusal, single-flight per workspace,
+  /// and retries the refused offer exactly once when the repair reports that
+  /// the child now seats this key. Absent a registration the refusal surfaces
+  /// untouched, as before.
+  NomosChildAuthenticationRepair? _childAuthenticationRepair;
+  final Map<String, Future<bool>> _childAuthenticationRepairs = {};
+
+  /// Register (or clear with null) the child-authentication repair for every
+  /// session on this plane. Views delegate to the root, so registering on any
+  /// session covers all workspaces.
+  void adoptChildAuthenticationRepair(NomosChildAuthenticationRepair? repair) {
+    _eventPlane._childAuthenticationRepair = repair;
+  }
+
+  Future<bool> _repairChildAuthentication(
+    String workspace,
+    ParentSignerEnrollmentMissing refusal,
+  ) {
+    final plane = _eventPlane;
+    final repair = plane._childAuthenticationRepair;
+    if (repair == null) return Future<bool>.value(false);
+    return plane._childAuthenticationRepairs.putIfAbsent(workspace, () {
+      // ignore: avoid_print
+      print('[nomos-offer] repairing child authentication for $workspace');
+      return repair(refusal).then((repaired) {
+        // ignore: avoid_print
+        print('[nomos-offer] child authentication repair for $workspace: '
+            '${repaired ? 'seated' : 'not seated'}');
+        return repaired;
+      }, onError: (Object error, StackTrace stackTrace) {
+        // ignore: avoid_print
+        print('[nomos-offer] child authentication repair for $workspace '
+            'failed: $error');
+        return false;
+      }).whenComplete(() {
+        // Block body on purpose: `remove` returns the stored future and a
+        // returned future would make whenComplete wait on itself.
+        plane._childAuthenticationRepairs.remove(workspace);
+      });
+    });
+  }
+
+  DartReception._view(DartReception parent)
+      : _transport = parent._transport,
+        _events = parent._events,
+        _sessions = parent._sessions,
+        _receipts = parent._receipts,
+        _sequences = parent._sequences,
+        _runtimeV2 = parent._runtimeV2,
+        allowStaleRunnerBundle = false;
+
+  /// THE EVENT PLANE — the ONE reception whose mutable dispatch registries every event/push resolves against.
+  ///
+  /// WHY THIS EXISTS (the closed bug class): a [NomosSession] extends this class but shares its [parent]'s
+  /// transport + message loop — [_onMessage] only ever runs on the PARENT, so events resolve against the
+  /// PARENT's controller maps ([_watches], [_compatWatches], the progress desk,
+  /// [_sessions], …). Any Stream-returning method / stateful getter that touched `this`'s copies on a
+  /// session registered on a DEAD registry and never emitted (real shipped instances: `watchPendingConflicts`
+  /// pre-0.48.1, and the five hand-written session watch overrides this seam retired).
+  ///
+  /// THE RULE (tripwire-enforced by `test/event_plane_seam_test.dart`): EVERY member that reads or writes
+  /// event-dispatch / plane state MUST do so via `_eventPlane.<field>` — never a bare field access. Requests
+  /// still go through `this._call` (a session's override stamps `args.session`), so a session's watch
+  /// registers its controller on the PARENT's registry while the wire op still carries the SESSION's
+  /// workspace. Chases to the root, so nested delegation stays correct.
+  DartReception get _eventPlane => this;
+
+  /// The session name this view is pinned to (null on the plane itself). Lets base implementations be
+  /// session-aware (per-workspace compat caching / law-change streams) with no per-method overrides.
+  String? get _sessionName => null;
+
+  /// Completes once the runner has posted `{ event: "ready" }` (the wasm + client are booted).
+  Future<void> get ready => _events.ready;
+
+  /// Invoke one generated application-runtime command. Request correlation and
+  /// every outcome discriminator stay in generated protobuf types; callers
+  /// must exhaustively select the response arm they requested.
+  Future<nomos_protocol.RuntimeResponse> _invokeRuntimeV2(
+    nomos_protocol.RuntimeRequest request,
+  ) async {
+    final plane = _eventPlane;
+    final id = 'reception-${plane._sequences.localSpan++}';
+    final operation = request.whichCommand().name;
+    final started = DateTime.now().millisecondsSinceEpoch;
+    void observe(NomosSpanPhase phase) => plane._events.progress.observeSpan(
+          NomosSpanEvent(
+            phase: phase,
+            id: id,
+            name: operation,
+            track: 'reception',
+            session: _sessionName,
+            startedAtMillis: started,
+            endedAtMillis: phase == NomosSpanPhase.end
+                ? DateTime.now().millisecondsSinceEpoch
+                : null,
+          ),
+        );
+    observe(NomosSpanPhase.begin);
+    try {
+      return await plane._runtimeV2.invoke(request);
+    } finally {
+      observe(NomosSpanPhase.end);
+    }
+  }
+
+  Future<nomos_protocol.FrameworkResponse> _invokeFramework(
+    nomos_protocol.FrameworkRequest request,
+  ) async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(framework: request),
+    );
+    if (!response.hasFramework()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for a framework operation',
+      );
+    }
+    return response.framework;
+  }
+
+  String _runtimeSession([String? explicit]) {
+    if (explicit != null && explicit.isNotEmpty) return explicit;
+    final scoped = _sessionName;
+    if (scoped != null && scoped.isNotEmpty) return scoped;
+    final sessions = _eventPlane._sessions;
+    if (sessions.boundCount == 1) return sessions.soleBoundSession;
+    if (!sessions.hasBoundSessions) {
+      throw StateError('No Nomos workspace is connected');
+    }
+    throw StateError(
+        'Multiple Nomos workspaces are connected; select a session');
+  }
+
+  String _workspaceForSession(String session) =>
+      _eventPlane._sessions.workspaceFor(session);
+
+  NomosPlatformCredentialProviders? get _platformCredentialProviders {
+    final Object transport = _eventPlane._transport;
+    return transport is NomosPlatformCredentialProviders ? transport : null;
+  }
+
+  /// The law model this application release approves, retained on the plane
+  /// for every workspace it opens. Not a callback and not lifecycle state: the
+  /// office decides whether a workspace needs anything.
+  NomosApprovedModel? _approvedApplicationModel;
+
+  // Transport single-flight only: repeated acquisitions must not submit the
+  // same background paper while its first invocation is still running. The
+  // office still owns lifecycle, authority, outcomes and bulk-work limits.
+  // Key by session AND immutable approved-model input, never workspace alone
+  // across planes/identities. Terminal outcomes are not cached.
+  late final Map<(String, NomosApprovedModel), Future<void>>
+      _backgroundModelAdoptions = {};
+
+  NomosApprovedModel? get nomosInternalApprovedApplicationModel =>
+      _eventPlane._approvedApplicationModel;
+
+  /// Retain the application's approved law model and register its package
+  /// with the platform transport, so the runtime can stage the exact package
+  /// on a workspace that still serves the previous law. Every workspace this
+  /// plane opens afterwards (home, estate, catalogue) is offered to the
+  /// model-adoption desk once it is ready.
+  void retainApprovedApplicationModel(NomosApprovedModel model) {
+    final providers = _platformCredentialProviders;
+    if (providers == null) {
+      throw UnsupportedError(
+        'This Nomos platform transport cannot supply the application law package',
+      );
+    }
+    _eventPlane._approvedApplicationModel = model;
+    providers.registerLawPackageSource(
+      NmsApprovedModelLawPackageSource(model),
+    );
+  }
+
+  Future<void> _unwatch(String subscriptionId) async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        unwatch: nomos_protocol.UnwatchRequest(
+          subscriptionId: subscriptionId,
+        ),
+      ),
+    );
+    if (!response.hasWatchStopped()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for unwatch',
+      );
+    }
+  }
+
+  NomosOperationReceipt _registerOperationReceipt(
+    String workspace,
+    String intentId,
+  ) {
+    final plane = _eventPlane;
+    // A locally accepted write is not current until custody convergence
+    // advances its receipt. Mark its workspace immediately so a same-tick
+    // `whenCurrent()` cannot return using the previous metrics snapshot.
+    final current = plane._currentSessionStatus(workspace);
+    plane._pushSessionStatus(
+      workspace,
+      locallyAdmitted(current),
+    );
+    plane._foldApplicationStatusFromSessions();
+    return plane._receipts.register(workspace, intentId);
+  }
+
+  void _advanceOperationReceipts(
+    String workspace,
+    nomos_protocol.SyncWorkspaceResponse result,
+  ) {
+    _eventPlane._receipts.advance(workspace, result);
+  }
+
+  /// The parent-write receipt which brought this child workspace into being.
+  /// Ordinary bindings of pre-existing workspaces have no creation receipt.
+  NomosOperationReceipt? nomosInternalWorkspaceCreationReceipt() {
+    final workspace = _sessionName;
+    return workspace == null ? null : _eventPlane._receipts.birthFor(workspace);
+  }
+
+  // ── the runtime-aware surface (the boundary the generated Dart client wraps) ──
+
+  /// Return a stable, cheap [NomosSession] handle pinned to [workspace]. A
+  /// handle may be created before it is bound; [bindSession] attaches only the
+  /// application identity. The first read or write is routed independently by
+  /// the resident peer.
+  NomosSession session(String workspace) => _eventPlane._sessions.handle(
+        workspace,
+        () => NomosSession(_eventPlane, workspace),
+      );
+
+  /// A [NomosForeignReader] backed by this reception's multi-workspace plane. Generated application methods
+  /// use it privately to follow a declared cross-workspace business reference.
+  /// `foreignWorkspace(ws).queryById(id)` binds a cheap interaction handle on
+  /// demand and reads it. Placement and remote routing
+  /// remain decisions of the peer runtime; the application supplies no cloud
+  /// locator or custody policy. This is a locator resolver, not a foreign key.
+  NomosForeignReader foreignReader() => _ReceptionForeignReader(this);
+
+  /// The workspace session names currently bound to this language view.
+  List<String> get boundSessions => _eventPlane._sessions.boundSnapshot();
+
+  ReceptionSyncDiagnostics get syncDiagnostics => ReceptionSyncDiagnostics(
+        read: () => List.unmodifiable([
+          for (final session in _eventPlane._sessions.boundNames)
+            WorkspaceSyncObservation(
+              session: session,
+              workspace: _eventPlane._sessions.workspaceFor(session),
+              status: _eventPlane._events.syncStatuses.statusFor(session),
+            ),
+        ]),
+        changes: _eventPlane._events.syncStatuses.changes,
+      );
+
+  /// This device's local workspace copies: their reborn state, and a preview
+  /// and drop of one copy so it is refetched from its current provider.
+  ReceptionLocalCopies get localCopies => ReceptionLocalCopies(
+        invoke: _invokeRuntimeV2,
+        changes: _eventPlane._events.copyChanges,
+        preparationFor: _eventPlane._events.preparationFor,
+        statusesFor: (sessions) => List.unmodifiable([
+          for (final session in sessions)
+            _eventPlane._events.syncStatuses.statusFor(session),
+        ]),
+        preservations: _eventPlane._events.localCopiesPreserved,
+        recentPreservations: () =>
+            _eventPlane._events.recentLocalCopiesPreserved,
+      );
+
+  /// Observe the peer's local physical workspace inventory. This is not an
+  /// interaction-session list and performs no open, acquisition or sync work.
+  Future<List<nomos_protocol.WorkspaceSummary>> listWorkspaces() async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        listWorkspaces: nomos_protocol.ListWorkspacesRequest(),
+      ),
+    );
+    if (!response.hasWorkspaceList()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for listWorkspaces',
+      );
+    }
+    return response.workspaceList.workspaces;
+  }
+
+  /// THE OFFICE ANSWERS A BIRTH'S WORKSPACE NAME; the client never re-derives it.
+  ///
+  /// A keyed birth's workspace name is a pure function of a key the caller already
+  /// owns (`birth.keyed({ namespace, key })`), so a born workspace is addressable
+  /// with zero persistence. That function is LAW (`dsl/src/births.ts`), and a second
+  /// copy of it here would be a second implementation of a law fact: change either
+  /// side and the two silently address different workspaces. The paper binds no
+  /// session and mounts nothing, so it can be asked before the first workspace is
+  /// open.
+  Future<String> nmsKeyedBirthWorkspace({
+    required String namespace,
+    required String key,
+  }) =>
+      _resolveWorkspaceName(
+        nomos_protocol.ResolveWorkspaceNameRequest(
+          keyed: nomos_protocol.KeyedBirthName(namespace: namespace, key: key),
+        ),
+      );
+
+  /// Fetch [workspace] onto this device now, reading nothing (the explicit form of
+  /// what a read of an unheld workspace reaches): placement discovery, then the
+  /// Replica Follow that placement retains, which mounts the provider's head alone.
+  /// Completes once the follow exists; the fetch itself runs in the background.
+  Future<void> nmsFetchWorkspace(String workspace) async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        fetchWorkspace:
+            nomos_protocol.FetchWorkspaceRequest(workspace: workspace),
+      ),
+    );
+    if (!response.hasWorkspaceFetch()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for a workspace fetch',
+      );
+    }
+  }
+
+  /// The framework's identity anchor for [principal], as the office names it.
+  Future<String> nmsReceivingGroupWorkspace(String principal) =>
+      _resolveWorkspaceName(
+        nomos_protocol.ResolveWorkspaceNameRequest(
+          receivingGroup: nomos_protocol.ReceivingGroupName(
+            principal: principal,
+          ),
+        ),
+      );
+
+  Future<String> _resolveWorkspaceName(
+    nomos_protocol.ResolveWorkspaceNameRequest request,
+  ) async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(resolveWorkspaceName: request),
+    );
+    if (!response.hasResolvedWorkspaceName()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for a workspace name',
+      );
+    }
+    return response.resolvedWorkspaceName.workspace;
+  }
+
+  /// Bind one ephemeral application interaction to a workspace identity.
+  ///
+  /// This does not inspect placement, mount Git, attach SQLite, authenticate a
+  /// remote or start Replica Follow work. Each operation is routed by the Peer
+  /// Runtime when it is executed.
+  Future<NomosBoundInteraction> bindSession({
+    required String workspace,
+    String? credentialSourceSession,
+    String? principal,
+    String? session,
+  }) async {
+    final ws = session ?? workspace;
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        bindSession: nomos_protocol.BindSessionRequest(
+          workspace: workspace,
+          session: ws,
+          credentialSourceSession: credentialSourceSession,
+          principal: principal,
+        ),
+      ),
+    );
+    if (!response.hasSessionBound()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for session binding',
+      );
+    }
+    final bound = response.sessionBound;
+    _eventPlane._sessions.observeBound(
+      session: bound.session,
+      workspace: bound.workspace,
+      credentialCapability: bound.credentialCapability,
+    );
+    _eventPlane._events.syncStatuses.ensureSession(
+      ws,
+      const SyncStatus(),
+    );
+    _eventPlane._foldApplicationStatusFromSessions();
+    // Binding a workspace is where its ONE device-signed model transition is offered
+    // (nomos2 architecture/old_law_child_bootstrap.md). This is deliberately the lowest
+    // binding primitive and not `bindWorkspace`: a child reached through a foreign read
+    // or a credential-less follow binds HERE and never through that door, so a trigger
+    // one layer up silently skips exactly the workspaces the lane exists for.
+    // The office refuses cheaply and locally — an unseated session never reaches a kernel
+    // read — so this never gates the caller on the outcome.
+    this
+        .session(bound.session)
+        .nomosInternalAdoptApplicationModelInBackground();
+    return NomosBoundInteraction._(
+      session: bound.session,
+      workspace: bound.workspace,
+      credentialCapability: bound.credentialCapability,
+    );
+  }
+
+  /// Register a renewable credential provider for one already-bound
+  /// interaction capability.
+  ///
+  /// This is a Platform Shell capability, not placement or Replica Follow
+  /// state. The peer remains the sole owner of deciding when the capability is
+  /// used by background work.
+  void nomosInternalRegisterCredentialProvider({
+    required NomosBoundInteraction interaction,
+    required String cloud,
+    required NomosSignIn signIn,
+  }) {
+    if (cloud.trim().isEmpty) {
+      throw ArgumentError.value(
+        cloud,
+        'cloud',
+        'Nomos credential provider URL cannot be empty',
+      );
+    }
+    final providers = _platformCredentialProviders;
+    if (providers == null) {
+      throw UnsupportedError(
+        'This Nomos platform transport cannot provide renewable credentials',
+      );
+    }
+    final sessions = _eventPlane._sessions;
+    if (!sessions.isBound(interaction.session) ||
+        sessions.workspaceFor(interaction.session) != interaction.workspace ||
+        sessions.credentialCapabilityFor(interaction.session) !=
+            interaction.credentialCapability) {
+      throw StateError(
+        "Cannot register credentials for stale interaction "
+        "'${interaction.session}'",
+      );
+    }
+    providers.registerCredentialProvider(
+      capability: interaction.credentialCapability,
+      cloud: cloud,
+      signIn: signIn,
+    );
+  }
+
+  /// Custody discontinuities surface here as typed observations. They do not
+  /// create a second interactive controller lifecycle in the peer runtime.
+  Stream<NomosCustodyEvent> get custodyEvents =>
+      _eventPlane._events.custodyEvents;
+
+  /// THE LOCAL-WORK-REJECTED STREAM (seated_barrier_and_seal_obligation.md Part 4): the cloud's gate
+  /// refused work this device's own kernel had accepted. Refused intents are already durably parked
+  /// (client DLQ + the workspace's refused/* refs) and surviving local work already replayed when an
+  /// event arrives — bind honest UX to it: `retryable` ⇒ "your changes are queued and will retry";
+  /// otherwise ⇒ "your changes were preserved for review — contact support". Never render the raw
+  /// refusal text as the headline.
+  Stream<NomosLocalWorkRejectedEvent> get localWorkRejectedEvents =>
+      _eventPlane._events.localWorkRejectedEvents;
+
+  // ── THE DEAD-LETTER QUEUE (refused-but-legitimate work is NEVER lost) — the Dart mirror of the
+  //   JS holon's DLQ surface (`deadLetters()` / `retryDeadLetter()` / `discardDeadLetter()`). A
+  //   DOMAIN rejection (the law couldn't merge it — edge admission or a local replay refusal)
+  //   parks the FULL intent durably in the workspace tree (it rides export()/restore); the app
+  //   inspects, the domain dev ships a law fix, retry unjams. ──
+
+  /// The parked dead letters; intent bytes stay in durable custody.
+  Future<List<nomos_protocol.DeadLetterEntry>> deadLetters(
+      {String? session}) async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        deadLetter: nomos_protocol.DeadLetterRequest(
+          session: _runtimeSession(session),
+          list: nomos_protocol.ListDeadLettersRequest(),
+        ),
+      ),
+    );
+    if (!response.hasDeadLetter() || !response.deadLetter.hasList()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for deadLetters',
+      );
+    }
+    return List.unmodifiable(response.deadLetter.list.entries);
+  }
+
+  /// Retry one dead letter (after the law fix landed): pulls canon first (it may already be
+  /// admitted), else re-offers the parked bytes locally. `{ok, head?|alreadyOnMain?|error?}` —
+  /// a refusal leaves the entry parked (with the fresh error), never lost.
+  Future<nomos_protocol.DeadLetterRetry> retryDeadLetter(
+    String id, {
+    String? session,
+  }) async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        deadLetter: nomos_protocol.DeadLetterRequest(
+          session: _runtimeSession(session),
+          retry: nomos_protocol.RetryDeadLetterRequest(intentId: id),
+        ),
+      ),
+    );
+    if (!response.hasDeadLetter() || !response.deadLetter.hasRetry()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for retryDeadLetter',
+      );
+    }
+    return response.deadLetter.retry;
+  }
+
+  /// Discard one dead letter — the app's EXPLICIT choice to drop the work. `{ok}`.
+  Future<nomos_protocol.DeadLetterDiscard> discardDeadLetter(
+    String id, {
+    String? session,
+  }) async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        deadLetter: nomos_protocol.DeadLetterRequest(
+          session: _runtimeSession(session),
+          discard: nomos_protocol.DiscardDeadLetterRequest(intentId: id),
+        ),
+      ),
+    );
+    if (!response.hasDeadLetter() || !response.deadLetter.hasDiscard()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for discardDeadLetter',
+      );
+    }
+    return response.deadLetter.discard;
+  }
+
+  /// The existing offer operation carrying one exact compiler-generated
+  /// Protobuf message. This is not a second write endpoint: generated domain
+  /// methods use it to reach the same kernel [OfferRequest] without a generic
+  /// map or JavaScript serializer. The kernel alone authors canonical USDA.
+  NomosErrorInfo _offerFailureInfo(
+    nomos_protocol.CallResponse response,
+    String workspace,
+    NmsGeneratedCall call,
+  ) =>
+      NomosErrorInfo(
+        code: response.failure.code,
+        message: response.failure.message,
+        component: 'nomos.kernel',
+        workspace: workspace,
+        domain: call.domain,
+        directiveId: call.directive,
+        operation: call.directive,
+      );
+
+  /// The kernel's author gate reports an unenrolled child signer as an offer
+  /// refusal. Only that exact verified-key verdict may enter the parent's
+  /// existing repair lane; other forged-principal refusals remain terminal.
+  ParentSignerEnrollmentMissing? _missingChildSignerFromOffer(
+    nomos_protocol.CallResponse response,
+    String workspace,
+    NmsGeneratedCall call,
+  ) {
+    if (!response.hasOffer() || !response.offer.hasRefused()) return null;
+    final refusal = response.offer.refused.refusal;
+    if (refusal.code !=
+            nomos_protocol
+                .KernelRefusalCode.KERNEL_REFUSAL_CODE_FORGED_PRINCIPAL ||
+        !refusal.hasDetails() ||
+        refusal.details.fields['actor']?.text != 'unenrolled-signer-key') {
+      return null;
+    }
+    return ParentSignerEnrollmentMissing(
+      message: refusal.message,
+      workspace: workspace,
+      actor: refusal.details.fields['claimed']?.text,
+      directiveId: call.directive,
+    );
+  }
+
+  @internal
+  Future<NomosOfferOutcome> offerGeneratedCallOutcome({
+    required NmsGeneratedCall call,
+    String? actor,
+    String? domainHash,
+    String? session,
+    String? authorSecret,
+    NomosBirthCertificate? birthCertificate,
+    Iterable<NomosConflictSnapshot> conflictSnapshots = const [],
+    NomosOfferAuthenticationProof authenticationProof =
+        NomosOfferAuthenticationProof.sessionCredentials,
+  }) async {
+    final runtimeSession = session ?? _sessionName;
+    if (runtimeSession == null || runtimeSession.isEmpty) {
+      throw StateError(
+        'A typed offer must be bound to a NomosSession',
+      );
+    }
+    final transport = _transport;
+    if (transport is! NomosKernelCallTransport) {
+      throw UnsupportedError(
+        'This host does not implement the generated protobuf kernel lane',
+      );
+    }
+    final kernelTransport = transport as NomosKernelCallTransport;
+    final plane = _eventPlane;
+    final workspace = _workspaceForSession(runtimeSession);
+    final explicitSecret = authorSecret;
+    final credentialUse = explicitSecret != null
+        ? nomos_protocol.CredentialUse.CREDENTIAL_USE_CALL_PROVIDED
+        : switch (authenticationProof) {
+            NomosOfferAuthenticationProof.sessionCredentials =>
+              nomos_protocol.CredentialUse.CREDENTIAL_USE_SESSION,
+            NomosOfferAuthenticationProof.enrolledDevice =>
+              nomos_protocol.CredentialUse.CREDENTIAL_USE_ENROLLED_DEVICE,
+          };
+    // Intentionally visible in device logs: this is the OBD port for a failed
+    // lawful dispatch. It names no token, device secret or tenant payload.
+    // ignore: avoid_print
+    print('[nomos-offer] dispatch ${call.domain}/${call.directive} in '
+        '$workspace using ${authenticationProof.name}');
+    Future<nomos_protocol.CallResponse> attempt() {
+      final requestNumber = ++plane._sequences.request;
+      return kernelTransport.callKernel(
+        session: runtimeSession,
+        request: nomos_protocol.CallRequest(
+          protocolVersion: 1,
+          requestId: '$runtimeSession:offer:$requestNumber',
+          offer: nomos_protocol.OfferRequest(
+            call: nomos_protocol.DirectiveCall(
+              domain: call.domain,
+              directive: call.directive,
+              operation: google_protobuf.Any(
+                typeUrl: call.protobufType,
+                value: call.protobufPayload,
+              ),
+            ),
+            authoring: nomos_protocol.AuthoringOptions(
+              actor: actor ?? '',
+              // Ordinary generated calls select a peer-runtime credential
+              // capability below. An explicit secret is a temporary operator
+              // compatibility lane and remains client-supplied until removed.
+              authorSecret: explicitSecret == null
+                  ? const <int>[]
+                  : base64Decode(explicitSecret),
+              deferProjection: true,
+              spans: true,
+            ),
+            controllerLawHash: domainHash,
+            conflictSnapshots: conflictSnapshots,
+            birthCertificate: birthCertificate,
+          ),
+        ),
+        credentialUse: credentialUse,
+      );
+    }
+
+    var response = await attempt();
+    if (response.hasFailure() &&
+        response.failure.code == 'nomos.authz.signer_enrollment_missing') {
+      final refusal = nomosErrorFromInfo(
+        _offerFailureInfo(response, workspace, call),
+      );
+      if (refusal is ParentSignerEnrollmentMissing &&
+          await _repairChildAuthentication(workspace, refusal)) {
+        response = await attempt();
+      }
+    }
+    final childSignerRefusal =
+        _missingChildSignerFromOffer(response, workspace, call);
+    if (childSignerRefusal != null &&
+        await _repairChildAuthentication(workspace, childSignerRefusal)) {
+      response = await attempt();
+    }
+    if (response.hasFailure()) {
+      // ignore: avoid_print
+      print('[nomos-offer] refused ${call.domain}/${call.directive} in '
+          '$workspace: ${response.failure.code}: ${response.failure.message}');
+      if (response.failure.code.startsWith('nomos.auth.') ||
+          response.failure.code.startsWith('nomos.authz.')) {
+        throw nomosErrorFromInfo(_offerFailureInfo(response, workspace, call));
+      }
+      throw NomosKernelCallFailure(
+        code: response.failure.code,
+        message: response.failure.message,
+      );
+    }
+    if (!response.hasOffer()) {
+      throw StateError(
+        'Kernel returned ${response.whichOutcome().name} for an offer request',
+      );
+    }
+    final offer = response.offer;
+    if (!offer.hasAdmitted()) throw NomosTypedOfferFailure(offer);
+    final admitted = offer.admitted;
+    if (admitted.hasKernelSpans()) {
+      for (final span in admitted.kernelSpans.operations) {
+        final phases = span.phases
+            .map((phase) => '${phase.name}=${phase.value}us')
+            .join(',');
+        final notes =
+            span.notes.map((note) => '${note.name}=${note.value}').join(',');
+        // Deliberately emitted as diagnostics rather than exposed as application
+        // state. This is the native OBD port for finding work that escaped the
+        // local-first foreground budget without inventing another wire format.
+        // ignore: avoid_print
+        print('[nomos-kernel-perf] ${span.label} total=${span.totalUs}us '
+            'phases={$phases} notes={$notes}');
+      }
+    }
+    // ignore: avoid_print
+    print('[nomos-offer] admitted ${call.domain}/${call.directive} in '
+        '$workspace as ${admitted.intentId} at ${admitted.head}');
+    final birthOutcomes = List<NomosBirthOutcome>.unmodifiable(
+      admitted.birthOutcomes,
+    );
+    final failedBirths = birthOutcomes
+        .where(
+          (birth) =>
+              birth.status != NomosBirthOutcomeStatus.BIRTH_OUTCOME_STATUS_BORN,
+        )
+        .toList(growable: false);
+    if (failedBirths.isNotEmpty) {
+      throw BirthIncomplete(failedBirths, head: admitted.head);
+    }
+    final receipt =
+        _registerOperationReceipt(runtimeSession, admitted.intentId);
+    final born = admitted.born
+        .map((child) => child.workspace)
+        .where((child) => child.isNotEmpty)
+        .toList(growable: false);
+    for (final child in born) {
+      plane._receipts.rememberBirth(child, receipt);
+    }
+    return NomosOfferOutcome(
+      head: admitted.head,
+      intentId: admitted.intentId,
+      receipt: receipt,
+      workspace: workspace,
+      born: born,
+      birthOutcomes: birthOutcomes,
+      created: admitted.created
+          .map(
+            (created) => NomosCreated(
+              type: created.type,
+              id: created.id,
+              workspace: workspace,
+            ),
+          )
+          .toList(growable: false),
+      affected: admitted.affected
+          .map(
+            (affected) => NomosCreated(
+              type: affected.type,
+              id: affected.id,
+              workspace: workspace,
+            ),
+          )
+          .toList(growable: false),
+    );
+  }
+
+  /// Prepare the exact authenticated execution slice a generated client is about to use. This is
+  /// a readiness hint only: compilation, composition, cache custody and all trust decisions remain
+  /// inside the kernel. Generated `bind` calls it so first-use cost is paid before the client becomes
+  /// interactive, rather than on the person's first button press.
+  Future<void> prepareDomain({
+    required String domain,
+    String? directiveId,
+    required String packageHash,
+  }) async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        prepareDomain: nomos_protocol.PrepareDomainRequest(
+          session: _runtimeSession(),
+          domain: domain,
+          packageSha256: packageHash,
+          directive: directiveId,
+        ),
+      ),
+    );
+    if (!response.hasDomainPrepared()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for prepareDomain',
+      );
+    }
+  }
+
+  /// FOLLOW A [NomosRef] — bind the referenced workspace to an interaction
+  /// session and hand back its stable language-native handle. No custody or
+  /// replica lifecycle is started by this method. Typed client construction is:
+  /// `final estate = await engine.follow(outcome.bornRefs.single); final app = await EstateClient.bind(estate);`
+  /// No loose `{workspaceId, aggregateId}` string pairs in app code.
+  Future<NomosSession> follow<TAggregate>(
+    NomosRef<TAggregate> ref, {
+    String? credentialSourceSession,
+  }) async {
+    final ws = NmsInternalNomosRefs.workspace(ref);
+    if (ws.isEmpty) {
+      throw ArgumentError.value(
+        ref,
+        'ref',
+        'follow: the NomosRef carries no workspace — only a workspace-complete ref is followable',
+      );
+    }
+    final source = credentialSourceSession ?? _sessionName;
+    if (source != null && source.isNotEmpty) {
+      return bindWorkspace(
+        ws,
+        credentialSourceSession: source,
+      );
+    }
+    if (!_eventPlane._sessions.isBound(ws)) {
+      await bindSession(
+        workspace: ws,
+        session: ws,
+      );
+    }
+    return session(ws);
+  }
+
+  /// Bind another workspace interaction. Placement and Replica Follow remain
+  /// entirely peer-owned and are evaluated only when an operation is executed.
+  ///
+  Future<NomosSession> bindWorkspace(
+    String workspace, {
+    String? credentialSourceSession,
+  }) async {
+    if (!_eventPlane._sessions.isBound(workspace)) {
+      await bindSession(
+        workspace: workspace,
+        session: workspace,
+        credentialSourceSession: credentialSourceSession ?? _sessionName,
+      );
+    }
+    return session(workspace);
+  }
+
+  /// Reserve a KERNEL-MINTED typed id (`<TypeTag>_<uuidv7>`) via the holon's front-door mint — for app-side
+  /// references (routing keys, optimistic UI). `.creates` payloads still carry NO id: the LAW mints those
+  /// (see [offerCreates], which returns them).
+  Future<String> mintId(String typeTag) async =>
+      (await _kernelPrimitives().mintTypedId(
+        typeTag: typeTag,
+        capturedUnixMillis: DateTime.now().millisecondsSinceEpoch,
+      ))
+          .id;
+
+  /// Refresh client-held credentials on this already-open workspace without
+  /// replacing its resident holon or refolding custody. This grants no
+  /// authority: every offer is still judged by the kernel's author gate.
+  Future<void> refreshCredentials({
+    String? authToken,
+    String? authorSecret,
+  }) async {
+    if (authToken == null && authorSecret == null) return;
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        refreshCredentials: nomos_protocol.RefreshCredentialsRequest(
+          session: _runtimeSession(),
+          authToken: authToken == null ? null : utf8.encode(authToken),
+          authorSecret:
+              authorSecret == null ? null : base64Decode(authorSecret),
+        ),
+      ),
+    );
+    if (!response.hasCredentialsRefreshed()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for credential refresh',
+      );
+    }
+  }
+
+  /// @internal The immutable genesis of a sibling custody chain. This is observational metadata used to
+  /// compose an ordinary source-enrolment offer; the kernel still reopens and proves every foreign read.
+  Future<String> nomosWorkspaceGenesis(
+    String workspace, {
+    String? session,
+  }) async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        readWorkspaceGenesis: nomos_protocol.ReadWorkspaceGenesisRequest(
+          session: _runtimeSession(session),
+          workspace: workspace,
+        ),
+      ),
+    );
+    if (!response.hasWorkspaceGenesis()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for workspace genesis',
+      );
+    }
+    return response.workspaceGenesis.genesis;
+  }
+
+  /// Carry the generated law's OSGi Contract Namespace requirements to THE DESK
+  /// THAT OWNS COMPATIBILITY, and raise its verdict.
+  ///
+  /// Whether this kernel provides a required contract is a compatibility
+  /// judgement, and compatibility has one owner (`CompatibilityDesk`). Comparing
+  /// the kernel's `OsgiResourceResponse` attribute by attribute here made this
+  /// client a second compatibility engine — and the TypeScript client's
+  /// equivalent was an empty method, so the two disagreed about the same law.
+  /// Reception now transports the requirements and renders the answer.
+  Future<void> assertKernelCoherence(
+    List<NmsKernelContractRequirement> kernelContracts, {
+    String? lawHash,
+    String? session,
+  }) async {
+    if (kernelContracts.isEmpty) return;
+    final runtimeSession = _runtimeSession(session);
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        framework: nomos_protocol.FrameworkRequest(
+          session: runtimeSession,
+          checkKernelContracts: nomos_protocol.CheckKernelContractsRequest(
+            session: runtimeSession,
+            requirements: kernelContracts.map(
+              (requirement) => nomos_protocol.KernelContractRequirement(
+                namespace: requirement.namespace,
+                name: requirement.name,
+                version: requirement.version,
+              ),
+            ),
+            lawHash: lawHash,
+          ),
+        ),
+      ),
+    );
+    if (!response.hasFramework() || !response.framework.hasKernelContracts()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for the kernel contract verdict',
+      );
+    }
+    final verdict = response.framework.kernelContracts;
+    if (verdict.coherent) return;
+    throw NomosKernelContractMismatch(
+      verdict.missing
+          .map((requirement) => NmsKernelContractRequirement(
+                namespace: requirement.namespace,
+                name: requirement.name,
+                version: requirement.version,
+              ))
+          .toList(growable: false),
+      lawHash: verdict.hasLawHash() ? verdict.lawHash : lawHash,
+    );
+  }
+
+  /// Framework-private organisational read used by generated `describe()`. The runner joins the parent
+  /// ledger's verified birth witnesses and lifecycle facts; tenant code only receives safe child links.
+  Future<List<nomos_protocol.ChildWorkspace>> nomosFrameworkChildWorkspaces(
+      {String? namespace}) async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        listChildWorkspaces: nomos_protocol.ListChildWorkspacesRequest(
+          session: _runtimeSession(),
+          namespace: namespace,
+        ),
+      ),
+    );
+    if (!response.hasChildWorkspaces()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for child workspaces',
+      );
+    }
+    return List.unmodifiable(response.childWorkspaces.children);
+  }
+
+  /// Mint an ed25519 DEVICE KEY in-kernel → `{secret, public}` (base64). The SECRET stays on this device
+  /// (persist it in secure storage); pass it to [bindSession] as `authorSecret` (or per-offer `signWith`) so the
+  /// holon SIGNS each intent. The PUBLIC half is what gets enrolled so the gate re-verifies the signature on
+  /// replay — the durable, cryptographic answer to "who authored this?" (the warrant). Mint once per device.
+  Future<nomos_protocol.SigningKeyPair> authorKeygen() async =>
+      _signingIdentityKernel().generate(
+        requestId:
+            '${_runtimeSession()}:signing-key:${++_eventPlane._sequences.request}',
+      );
+
+  /// VA ROOT-OF-TRUST: sign a BirthCert through the kernel `cert_sign` op (the SINGLE source of the cert
+  /// byte-layout — no Dart copy). [spec] is the generated certificate message with an empty signature;
+  /// `deviceSecret` is the secret half, handed to the LOCAL kernel only (it never reaches a remote peer).
+  /// Returns the same generated type with its signature populated, suitable for an offer.
+  Future<NomosBirthCertificate> signBirthCert(
+    NomosBirthCertificate spec,
+    List<int> deviceSecret,
+  ) async {
+    final runtimeSession = _runtimeSession();
+    final transport = _eventPlane._transport;
+    if (transport is! NomosKernelCallTransport) {
+      throw UnsupportedError(
+        'This peer does not expose generated kernel calls',
+      );
+    }
+    final requestId =
+        '$runtimeSession:sign-birth:${++_eventPlane._sequences.request}';
+    final response = await (transport as NomosKernelCallTransport).callKernel(
+      session: runtimeSession,
+      credentialUse: nomos_protocol.CredentialUse.CREDENTIAL_USE_NONE,
+      request: nomos_protocol.CallRequest(
+        protocolVersion: 1,
+        requestId: requestId,
+        signBirthCertificate: nomos_protocol.SignBirthCertificateRequest(
+          certificate: spec,
+          signerSecret: deviceSecret,
+        ),
+      ),
+    );
+    if (response.hasFailure()) {
+      throw StateError('${response.failure.code}: ${response.failure.message}');
+    }
+    if (!response.hasSignBirthCertificate()) {
+      throw StateError(
+        'Kernel returned ${response.whichOutcome().name} for birth-certificate signing',
+      );
+    }
+    return response.signBirthCertificate.certificate;
+  }
+
+  /// Compose and sign the enroll-once delegation using exact generated
+  /// fields. This is ordinary certificate construction followed by the
+  /// Runtime v2 signing operation; there is no separate command protocol.
+  Future<NomosBirthCertificate> mintKeylessDelegation({
+    required String user,
+    required List<int> devicePublic,
+    required String childName,
+    required String parentId,
+    required String verifiedVia,
+    required String idpToken,
+    required int capturedClock,
+    int epoch = 0,
+    required List<int> deviceSecret,
+  }) =>
+      signBirthCert(
+        nomos_protocol.BirthCertificate(
+          child: childName.isEmpty ? user : childName,
+          founder: user,
+          verified: true,
+          parentKey: devicePublic,
+          parentId: parentId,
+          epoch: fixnum.Int64(epoch),
+          verifiedVia: verifiedVia,
+          idpToken: idpToken,
+          capturedClock: fixnum.Int64(capturedClock),
+        ),
+        deviceSecret,
+      );
+
+  /// Mint the child's OWN birth certificate for a Home birth: a plain device-signed cert
+  /// `{child, founder, verified, parentKey: P_U, parentId: platform, epoch}` with NO keyless fields.
+  /// The keyless delegation ([mintKeylessDelegation]) rides the chain as its own link above this one;
+  /// passing the delegation itself as the birth certificate stores the chain as
+  /// `[delegation, delegation, platform]`, and every grandchild the Home births then seats a keyless
+  /// link under a keyless link — a shape the kernel's verify walk refuses.
+  Future<NomosBirthCertificate> mintHomeBirthCertificate({
+    required String user,
+    required List<int> devicePublic,
+    required String childName,
+    required String parentId,
+    int epoch = 0,
+    required List<int> deviceSecret,
+  }) =>
+      signBirthCert(
+        nomos_protocol.BirthCertificate(
+          child: childName,
+          founder: user,
+          verified: true,
+          parentKey: devicePublic,
+          parentId: parentId,
+          epoch: fixnum.Int64(epoch),
+        ),
+        deviceSecret,
+      );
+
+  /// Derive the device key's base64 PUBLIC half from its base64 SECRET seed, inside the LOCAL kernel
+  /// (the secret never leaves the device). The recovery lanes use this when only the secret was
+  /// persisted (the device-key store keeps just the seed), including low-level device-bound enrollment.
+  Future<nomos_protocol.SigningPublicKey> devicePublicOf(
+    Uint8List secret,
+  ) async =>
+      _signingIdentityKernel().derivePublic(
+        requestId:
+            '${_runtimeSession()}:signing-public:${++_eventPlane._sequences.request}',
+        secret: secret,
+      );
+
+  NmsSigningIdentityKernel _signingIdentityKernel() {
+    final transport = _eventPlane._transport;
+    if (transport is! NomosKernelCallTransport) {
+      throw UnsupportedError(
+        'This peer does not expose generated kernel calls',
+      );
+    }
+    return NmsSigningIdentityKernel(
+      transport: transport as NomosKernelCallTransport,
+      session: _runtimeSession(),
+    );
+  }
+
+  /// PARENT-AUTHORITY POSTURE (read-only diagnostic): is this device key a LIVE `signer` for
+  /// `principal` on `parent`'s chain (`identity:<principal>#signer@key:<sha256(publicKey)>`)? One O(1)
+  /// relation read over the open gateway; nothing is authored. Returns
+  /// `{parent, principal, keyHash, object, relation, enrolled, revoked, checkedAt}`.
+  /// Pass `remote: true` to force the CLOUD-gateway read even when this holon IS the parent — the
+  /// seated barrier's proof-by-read: `enrolled: true` then means the shared chain durably holds this
+  /// device's signer tuple, not merely that the local fold ran.
+  Future<nomos_protocol.ParentSignerEnrollment> parentSignerEnrollment({
+    required String parent,
+    required String principal,
+    String? keyHash,
+    String? publicKey,
+    String? authToken,
+    bool remote = false,
+  }) async {
+    final response = await _invokeFramework(
+      nomos_protocol.FrameworkRequest(
+        session: _runtimeSession(),
+        parentSignerEnrollment: nomos_protocol.ParentSignerEnrollmentRequest(
+          parent: parent,
+          principal: principal,
+          keySha256: keyHash,
+          publicKey: publicKey == null ? null : base64Decode(publicKey),
+          authToken: authToken == null ? null : utf8.encode(authToken),
+          remote: remote,
+        ),
+      ),
+    );
+    if (!response.hasParentSignerEnrollment()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichResult().name} for parent signer posture',
+      );
+    }
+    return response.parentSignerEnrollment;
+  }
+
+  /// IDEMPOTENT PARENT-SIGNER RECOVERY — ensure this device key is a live `signer` on `parent`,
+  /// lawfully restoring the tuple a parent custody REBIRTH lost (the device key + the born home stay
+  /// valid; no home rebirth, no hand-posted secrets). Already enrolled ⇒ pure no-op (`repaired:false`).
+  /// Absent ⇒ re-authors the enrollment via the parent's OWN installed signing directive, DISCOVERED
+  /// from its law (never a hardcoded framework domain — a tenant-composed `co2_platform` works);
+  /// `domain`/`directiveId` override the discovery. A REVOKED key is never silently re-enrolled.
+  /// TWO LAWFUL LANES, kernel-decided: a WARRANTED parent (the reborn-platform case) admits a fresh
+  /// device-signer only via the keyless `enrollFirstDevice` — pass the device-bound [idToken]
+  /// (+ [verifiedVia], the parent's AuthProvider issuer); a PRE-WARRANT parent admits the founding
+  /// `enrollSigner` (no token needed).
+  /// Returns `{parent, principal, keyHash, enrolled, repaired, domain?, directiveId?, checkedAt}`.
+  Future<nomos_protocol.EnsureParentSignerEnrollmentResult>
+      ensureParentSignerEnrollment({
+    required String parent,
+    required String principal,
+    String? publicKey,
+    String? authorSecret,
+    String? domain,
+    String? directiveId,
+    String? authToken,
+    String? idToken,
+    String? verifiedVia,
+  }) async {
+    final response = await _invokeFramework(
+      nomos_protocol.FrameworkRequest(
+        session: _runtimeSession(),
+        repairParentSignerEnrollment:
+            nomos_protocol.EnsureParentSignerEnrollmentRequest(
+          parent: parent,
+          principal: principal,
+          publicKey: publicKey == null ? null : base64Decode(publicKey),
+          authorSecret:
+              authorSecret == null ? null : base64Decode(authorSecret),
+          domain: domain,
+          directive: directiveId,
+          authToken: authToken == null ? null : utf8.encode(authToken),
+          idToken: idToken == null ? null : utf8.encode(idToken),
+          verifiedVia: verifiedVia,
+        ),
+      ),
+    );
+    if (!response.hasRepairedParentSignerEnrollment()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichResult().name} for parent signer repair',
+      );
+    }
+    return response.repairedParentSignerEnrollment;
+  }
+
+  /// Read-only, exact Runtime v2 authoring preflight. [ws] may select a
+  /// colocated or remote target; live credentials stay in the peer session.
+  Future<NmsAuthoringPreflight> canAuthor(
+    String directiveId, {
+    String? ws,
+    String? principal,
+    String? publicKey,
+    String? keyHash,
+  }) async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        authoringPreflight: nomos_protocol.AuthoringPreflightRequest(
+          session: _runtimeSession(),
+          directive: directiveId,
+          targetWorkspace: ws,
+          principal: principal,
+          publicKey: publicKey == null ? null : base64Decode(publicKey),
+          keyHash: keyHash,
+        ),
+      ),
+    );
+    if (!response.hasAuthoringPreflight()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for authoring preflight',
+      );
+    }
+    final result = response.authoringPreflight;
+    return NmsAuthoringPreflight(
+      admissible: result.admissible,
+      workspace: result.workspace,
+      directive: result.directive,
+      cause: result.cause,
+      causes: List.unmodifiable(result.causes),
+      actor: result.hasActor() ? result.actor : null,
+      keyHash: result.hasKeyHash() ? result.keyHash : null,
+      domain: result.hasDomain() ? result.domain : null,
+      relation: result.hasRelation() ? result.relation : null,
+      object: result.hasObject() ? result.object : null,
+      detail: result.hasDetail() ? result.detail : null,
+    );
+  }
+
+  /// VERIFY_CHAIN — the kernel's from-genesis self-verification of THIS holon's folded ledger (read-only:
+  /// contiguity → every intent re-admitted through the ONE gate against the state folded from the prefix). For
+  /// a WARRANTED home this RE-FIRES the parent-attested-birth cert door on the cold-replay lane — so a
+  /// freshly-connected peer that CLONES a home and runs this IS the offline peer-verify (replay IS validation;
+  /// no new op). Returns the kernel verdict `{valid, error?, plansRerun?}`.
+  Future<nomos_protocol.VerifyWorkspaceChainResult> verifyChain() async {
+    final response = await _invokeFramework(
+      nomos_protocol.FrameworkRequest(
+        session: _runtimeSession(),
+        verifyWorkspaceChain: nomos_protocol.VerifyWorkspaceChainRequest(),
+      ),
+    );
+    if (!response.hasVerifyWorkspaceChain()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichResult().name} for chain verification',
+      );
+    }
+    return response.verifyWorkspaceChain;
+  }
+
+  /// Offer one compiler-generated call to a remote workspace without cloning
+  /// that workspace onto this device. The resident source session signs the
+  /// target-kernel-prepared USDA; Runtime v2 carries the nominal call and the
+  /// admitted target head without a command string or tenant map.
+  Future<nomos_protocol.RemoteGeneratedOfferAccepted>
+      nomosInternalOfferRemoteGeneratedCall({
+    required String targetWorkspace,
+    required String actor,
+    required String authorSecret,
+    String? authToken,
+    required NmsGeneratedCall call,
+    NomosBirthCertificate? birthCertificate,
+    String? requiredTargetHead,
+  }) async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        remoteGeneratedOffer: nomos_protocol.RemoteGeneratedOfferRequest(
+          sourceSession: _runtimeSession(),
+          targetWorkspace: targetWorkspace,
+          actor: actor,
+          authorSecret: base64Decode(authorSecret),
+          authToken: utf8.encode(authToken ?? ''),
+          call: nomos_protocol.DirectiveCall(
+            domain: call.domain,
+            directive: call.directive,
+            operation: google_protobuf.Any(
+              typeUrl: call.protobufType,
+              value: call.protobufPayload,
+            ),
+          ),
+          birthCertificate: birthCertificate,
+          requiredTargetHead: requiredTargetHead,
+        ),
+      ),
+    );
+    if (!response.hasRemoteGeneratedOffer()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for a remote generated offer',
+      );
+    }
+    return response.remoteGeneratedOffer;
+  }
+
+  nomos_protocol.QueryAuthority _nmsQueryAuthority(
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session, {
+    String? authorSecret,
+  }) {
+    final runtimeSession = session ?? _sessionName;
+    if (runtimeSession == null || runtimeSession.isEmpty) {
+      throw StateError('A nominal query must be bound to a NomosSession');
+    }
+    return nomos_protocol.QueryAuthority(
+      principalClaim: principal ?? '',
+      // The runtime supplies the live session token, device capability and
+      // observation time immediately before dispatch. Only explicit operator
+      // overrides remain embedded during the compatibility cutover.
+      authorSecret:
+          authorSecret == null ? const <int>[] : base64Decode(authorSecret),
+      keys: (keys ?? const <NomosScopeKey>[]).map(
+        (key) => nomos_protocol.InjectedKey(
+          scope: key.scope,
+          epoch: fixnum.Int64(key.epoch),
+          key: base64Decode(key.key),
+        ),
+      ),
+    );
+  }
+
+  Future<Uint8List> _nmsKernelQueryUsda({
+    required String? session,
+    required nomos_protocol.QueryAuthority authority,
+    required nomos_protocol.QueryRequest query,
+  }) async {
+    final elapsed = Stopwatch()..start();
+    // ignore: avoid_print
+    print(
+      '[nomos-local-read] begin session=${session ?? _sessionName ?? ''} '
+      'query=${query.hasRows() ? query.rows.id : query.whichQuery().name}',
+    );
+    late final nomos_protocol.QueryResponse response;
+    try {
+      response = await _nmsKernelQuery(
+        session: session,
+        authority: authority,
+        query: query,
+      );
+    } catch (error, stackTrace) {
+      elapsed.stop();
+      // Keep local-read refusals in ordinary device logs. Generated streams
+      // may deliver errors without a visible widget, so developer.log alone
+      // is not an adequate operator diagnostic on iOS.
+      // ignore: avoid_print
+      print(
+        '[nomos-local-read] failed '
+        'session=${session ?? _sessionName ?? ''} '
+        'query=${query.hasRows() ? query.rows.id : query.whichQuery().name} '
+        'elapsedUs=${elapsed.elapsedMicroseconds} error=$error',
+      );
+      developer.log(
+        'Local nominal query failed',
+        name: 'nomos.local_read',
+        error: error,
+        stackTrace: stackTrace,
+        time: DateTime.now(),
+        sequenceNumber: elapsed.elapsedMicroseconds,
+      );
+      rethrow;
+    }
+    elapsed.stop();
+    if (!response.hasResultUsda()) {
+      throw StateError(
+        'Kernel returned ${response.whichResult().name} without a nominal USDA query result',
+      );
+    }
+    final result = Uint8List.fromList(response.resultUsda);
+    // This is the local read-plane equivalent of an OBD port: keep the
+    // workspace/query binding and result size visible in ordinary host logs.
+    // ignore: avoid_print
+    print(
+      '[nomos-local-read] session=${session ?? _sessionName ?? ''} '
+      'query=${query.hasRows() ? query.rows.id : query.whichQuery().name} '
+      'resultBytes=${result.length} elapsedUs=${elapsed.elapsedMicroseconds}',
+    );
+    developer.log(
+      'Local nominal query completed '
+      'session=${session ?? _sessionName ?? ''} '
+      'query=${query.hasRows() ? query.rows.id : query.whichQuery().name} '
+      'resultBytes=${result.length} elapsedUs=${elapsed.elapsedMicroseconds}',
+      name: 'nomos.local_read',
+      time: DateTime.now(),
+      sequenceNumber: elapsed.elapsedMicroseconds,
+    );
+    return result;
+  }
+
+  Future<NmsGeneratedResult> _nmsKernelApplicationQuery({
+    required String? session,
+    required nomos_protocol.QueryAuthority authority,
+    required nomos_protocol.QueryRequest query,
+  }) async {
+    final response = await _nmsKernelQuery(
+      session: session,
+      authority: authority,
+      query: query,
+      resultFormat: nomos_protocol
+          .QueryResultFormat.QUERY_RESULT_FORMAT_APPLICATION_PROTOBUF,
+    );
+    if (!response.hasApplicationResult()) {
+      throw StateError(
+        'Kernel returned ${response.whichResult().name} without the generated application result',
+      );
+    }
+    final result = response.applicationResult;
+    return NmsInternalGeneratedResults.create(
+      protobufType: result.typeUrl,
+      protobufPayload: Uint8List.fromList(result.value),
+    );
+  }
+
+  Future<nomos_protocol.QueryResponse> _nmsKernelQuery({
+    required String? session,
+    required nomos_protocol.QueryAuthority authority,
+    required nomos_protocol.QueryRequest query,
+    nomos_protocol.QueryResultFormat resultFormat =
+        nomos_protocol.QueryResultFormat.QUERY_RESULT_FORMAT_NOMINAL_USDA,
+  }) async {
+    final runtimeSession = session ?? _sessionName;
+    if (runtimeSession == null || runtimeSession.isEmpty) {
+      throw StateError('A nominal query must be bound to a NomosSession');
+    }
+    final plane = _eventPlane;
+    final transport = plane._transport;
+    if (transport is! NomosKernelCallTransport) {
+      throw UnsupportedError(
+        'This host does not implement the generated Runtime v2 protobuf lane',
+      );
+    }
+    query
+      ..authority = authority
+      ..spans = true
+      ..resultFormat = resultFormat;
+    // NomosSession is a view over one local plane, not an independent runtime.
+    // Correlation therefore belongs to the plane just like watches and legacy
+    // reception calls. Keeping this counter on a child view lets two views mint
+    // overlapping logical request identities despite sharing one executor.
+    // A copy still being fetched or opened answers "not ready yet": ask again
+    // rather than hand every caller a state that passes by itself.
+    final response = await nmsUntilReplicaReady(
+      () {
+        final requestNumber = ++plane._sequences.request;
+        return (transport as NomosKernelCallTransport).callKernel(
+          session: runtimeSession,
+          // An explicit device key is an additional proof, not a replacement for
+          // the session's renewable provider credential. The peer office owns
+          // the live credential capability and must still attach it before the
+          // kernel judges the query.
+          credentialUse: nomos_protocol.CredentialUse.CREDENTIAL_USE_SESSION,
+          request: nomos_protocol.CallRequest(
+            protocolVersion: 1,
+            requestId: '$runtimeSession:query:$requestNumber',
+            query: query,
+          ),
+        );
+      },
+      synced: _eventPlane._events.workspacesSynced,
+    );
+    if (response.hasFailure()) {
+      throw StateError('${response.failure.code}: ${response.failure.message}');
+    }
+    if (!response.hasQuery()) {
+      throw StateError(
+        'Kernel returned ${response.whichOutcome().name} without a query result',
+      );
+    }
+    return response.query;
+  }
+
+  NomosProviderTokenVerification _providerTokenVerification(
+    nomos_protocol.ProviderTokenVerificationStatus status,
+  ) =>
+      switch (status) {
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_VALID =>
+          NomosProviderTokenVerification.valid,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_NO_MATCHING_KEY =>
+          NomosProviderTokenVerification.noMatchingKey,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_EXPIRED =>
+          NomosProviderTokenVerification.expired,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_NOT_YET_VALID =>
+          NomosProviderTokenVerification.notYetValid,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_ISSUER_MISMATCH =>
+          NomosProviderTokenVerification.issuerMismatch,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_AUDIENCE_MISMATCH =>
+          NomosProviderTokenVerification.audienceMismatch,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_BAD_SIGNATURE =>
+          NomosProviderTokenVerification.badSignature,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_MALFORMED =>
+          NomosProviderTokenVerification.malformed,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_UNSUPPORTED_ALGORITHM =>
+          NomosProviderTokenVerification.unsupportedAlgorithm,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_BAD_KEY =>
+          NomosProviderTokenVerification.badKey,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_MISSING_SUBJECT =>
+          NomosProviderTokenVerification.missingSubject,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_NO_VERIFIER =>
+          NomosProviderTokenVerification.noVerifier,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_MISSING_TOKEN =>
+          NomosProviderTokenVerification.missingToken,
+        nomos_protocol.ProviderTokenVerificationStatus
+              .PROVIDER_TOKEN_VERIFICATION_STATUS_UNSPECIFIED =>
+          NomosProviderTokenVerification.unspecified,
+        _ => NomosProviderTokenVerification.unspecified,
+      };
+
+  /// Ask the kernel—not the host—to verify the session's current provider
+  /// token and enrolled-device relation against the workspace's current law.
+  @internal
+  Future<NomosAuthenticationPosture> nmsAuthenticationPosture({
+    String? session,
+    String? principal,
+    String? authorSecret,
+    bool includeBirthEvidence = false,
+  }) async {
+    final response = await _nmsKernelQuery(
+      session: session,
+      authority: _nmsQueryAuthority(
+        null,
+        principal,
+        session,
+        authorSecret: authorSecret,
+      ),
+      query: nomos_protocol.QueryRequest(
+        authenticationPosture: nomos_protocol.AuthenticationPostureQuery(
+            includeBirthEvidence: includeBirthEvidence),
+      ),
+    );
+    if (!response.hasAuthenticationPosture()) {
+      throw StateError(
+        'Kernel returned ${response.whichResult().name}, expected authenticationPosture',
+      );
+    }
+    final posture = response.authenticationPosture;
+    final result = NomosAuthenticationPosture(
+      providerToken: _providerTokenVerification(posture.providerToken),
+      enrolledDevice: posture.enrolledDevice,
+      resolvedPrincipal: posture.resolvedPrincipal,
+      birthEvidence: posture.birthEvidence.status,
+      birthEvidenceDetail: posture.birthEvidence.detail,
+    );
+    print(
+        '[nomos-auth-posture] workspace=${_eventPlane._sessions.workspaceFor(session ?? _sessionName ?? '')} '
+        'token=${result.providerToken.name} enrolled=${result.enrolledDevice} '
+        'principal=${result.resolvedPrincipal.isEmpty ? 'unresolved' : 'resolved'}');
+    return result;
+  }
+
+  /// THE RECEIVING-GROUP GATE — one Runtime v2 paper (`OpenReceivingGroupRequest`,
+  /// `architecture/receiving_group_lifecycle.md` cut 3). The session named here
+  /// must already be bound to the principal's receiving-group workspace. The
+  /// shared desk owns whatever placement, identity and birth work the operation
+  /// requires. Its convergence tail runs as background correspondence and reports on
+  /// [receivingGroupConvergence]. [contract] is the application's law identity
+  /// from the compiled descriptor; tenant seed steps are law, never carried
+  /// here. A typed refusal surfaces as a [NomosRuntimeError] carrying the
+  /// desk's own code (`nomos.runtime.receiving_group_*`).
+  @internal
+  Future<nomos_protocol.ReceivingGroupOpened> nmsOpenReceivingGroup({
+    required String application,
+    required String principal,
+    required String authToken,
+    required nomos_protocol.ApplicationBirthContract contract,
+    bool verifyHistory = false,
+    String? session,
+    nomos_protocol.ConsoleEnrolmentRoute? enrolment,
+  }) async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        openReceivingGroup: nomos_protocol.OpenReceivingGroupRequest(
+          session: _runtimeSession(session),
+          application: application,
+          principal: principal,
+          authToken: utf8.encode(authToken),
+          contract: contract,
+          verifyHistory: verifyHistory,
+          enrolment: enrolment,
+        ),
+      ),
+    );
+    if (!response.hasReceivingGroupOpened()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for openReceivingGroup',
+      );
+    }
+    return response.receivingGroupOpened;
+  }
+
+  /// Wait until the kernel proves that the provider token verifies, the device
+  /// is enrolled, and the resolved principal is the session principal — or
+  /// until [patience] runs out, in which case the LAST OBSERVED posture is
+  /// returned and the caller judges it. No timer or receipt is the business
+  /// postcondition; only the kernel's own reading of custody is.
+  ///
+  /// Peer Office owns repeated local observations, backoff and the deadline.
+  /// Its retained-follow lifecycle independently owns convergence; Reception
+  /// submits one desired postcondition and maps its terminal result.
+  @internal
+  Future<NomosAuthenticationPosture> nmsAwaitAuthenticationReady({
+    String? session,
+    String? principal,
+    String? authorSecret,
+    bool requireBirthEvidence = false,
+    Duration patience = const Duration(seconds: 60),
+    Duration initialBackoff = const Duration(milliseconds: 500),
+    Duration maximumBackoff = const Duration(seconds: 8),
+  }) async {
+    final result =
+        await _awaitAuthentication(nomos_protocol.AwaitAuthenticationRequest(
+      session: _runtimeSession(session),
+      principal: principal ?? '',
+      criterion: requireBirthEvidence
+          ? nomos_protocol.AuthenticationReadinessCriterion
+              .AUTHENTICATION_READINESS_CRITERION_BIRTH_EVIDENCE
+          : nomos_protocol.AuthenticationReadinessCriterion
+              .AUTHENTICATION_READINESS_CRITERION_ENROLLED_DEVICE,
+      patienceMillis: patience.inMilliseconds,
+      initialBackoffMillis: initialBackoff.inMilliseconds,
+      maximumBackoffMillis: maximumBackoff.inMilliseconds,
+      authorSecret: authorSecret == null ? null : base64Decode(authorSecret),
+    ));
+    return _authenticationPostureView(result.posture);
+  }
+
+  Future<nomos_protocol.AuthenticationReadiness> _awaitAuthentication(
+    nomos_protocol.AwaitAuthenticationRequest command,
+  ) async {
+    final response = await _invokeRuntimeV2(
+        nomos_protocol.RuntimeRequest(awaitAuthentication: command));
+    if (!response.hasAuthenticationReadiness() ||
+        !response.authenticationReadiness.hasPosture()) {
+      throw StateError(
+          'Runtime v2 returned ${response.whichOutcome().name} without an authentication posture');
+    }
+    return response.authenticationReadiness;
+  }
+
+  NomosAuthenticationPosture _authenticationPostureView(
+    nomos_protocol.AuthenticationPostureResponse posture,
+  ) =>
+      NomosAuthenticationPosture(
+        providerToken: _providerTokenVerification(posture.providerToken),
+        enrolledDevice: posture.enrolledDevice,
+        resolvedPrincipal: posture.resolvedPrincipal,
+        birthEvidence: posture.birthEvidence.status,
+        birthEvidenceDetail: posture.birthEvidence.detail,
+      );
+
+  Future<nomos_protocol.QueryResponse> _nmsKernelHistoricQuery({
+    required NomosMoment moment,
+    required String? session,
+    required nomos_protocol.QueryAuthority authority,
+    required nomos_protocol.QueryRequest query,
+    nomos_protocol.QueryResultFormat resultFormat =
+        nomos_protocol.QueryResultFormat.QUERY_RESULT_FORMAT_NOMINAL_USDA,
+  }) async {
+    final runtimeSession = session ?? _sessionName;
+    if (runtimeSession == null || runtimeSession.isEmpty) {
+      throw StateError(
+          'A nominal historic query must be bound to a NomosSession');
+    }
+    query
+      ..authority = authority
+      ..spans = true
+      ..resultFormat = resultFormat;
+    final response = await nmsUntilReplicaReady(
+      () => _invokeRuntimeV2(
+        nomos_protocol.RuntimeRequest(
+          historicQuery: nomos_protocol.HistoricQueryRequest(
+            session: runtimeSession,
+            moment: moment.id,
+            query: query,
+          ),
+        ),
+      ),
+      synced: _eventPlane._events.workspacesSynced,
+    );
+    if (response.hasFailure()) {
+      throw StateError('${response.failure.code}: ${response.failure.message}');
+    }
+    if (!response.hasKernelCall()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for a historic query',
+      );
+    }
+    final kernel = response.kernelCall;
+    if (kernel.hasFailure()) {
+      throw StateError('${kernel.failure.code}: ${kernel.failure.message}');
+    }
+    if (!kernel.hasQuery()) {
+      throw StateError(
+        'Kernel returned ${kernel.whichOutcome().name} without a historic query result',
+      );
+    }
+    return kernel.query;
+  }
+
+  Future<Uint8List> _nmsKernelHistoricQueryUsda({
+    required NomosMoment moment,
+    required String? session,
+    required nomos_protocol.QueryAuthority authority,
+    required nomos_protocol.QueryRequest query,
+  }) async {
+    final response = await _nmsKernelHistoricQuery(
+      moment: moment,
+      session: session,
+      authority: authority,
+      query: query,
+    );
+    if (!response.hasResultUsda()) {
+      throw StateError(
+        'Kernel returned ${response.whichResult().name} without a nominal historic USDA result',
+      );
+    }
+    return Uint8List.fromList(response.resultUsda);
+  }
+
+  Future<NmsGeneratedResult> _nmsKernelHistoricApplicationQuery({
+    required NomosMoment moment,
+    required String? session,
+    required nomos_protocol.QueryAuthority authority,
+    required nomos_protocol.QueryRequest query,
+  }) async {
+    final response = await _nmsKernelHistoricQuery(
+      moment: moment,
+      session: session,
+      authority: authority,
+      query: query,
+      resultFormat: nomos_protocol
+          .QueryResultFormat.QUERY_RESULT_FORMAT_APPLICATION_PROTOBUF,
+    );
+    if (!response.hasApplicationResult()) {
+      throw StateError(
+        'Kernel returned ${response.whichResult().name} without the generated historic application result',
+      );
+    }
+    final result = response.applicationResult;
+    return NmsInternalGeneratedResults.create(
+      protobufType: result.typeUrl,
+      protobufPayload: Uint8List.fromList(result.value),
+    );
+  }
+
+  /// Declared application query over the shared typed peer-office boundary.
+  ///
+  /// The peer office transports an operation-specific Protobuf result. Only
+  /// the generated application client owns the corresponding decoder.
+  Future<NmsGeneratedResult> nmsQuery(
+    NmsGeneratedQuery query, [
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+  ]) =>
+      _nmsKernelApplicationQuery(
+        session: session,
+        authority: _nmsQueryAuthority(keys, principal, session),
+        query: nomos_protocol.QueryRequest(
+          rows: nomos_protocol.RowsQuery(
+            id: query.query,
+            principal: principal ?? '',
+            applicationArguments: google_protobuf.Any(
+              typeUrl: query.protobufType,
+              value: query.protobufPayload,
+            ),
+          ),
+        ),
+      );
+
+  /// The same declared application query at one authenticated historic moment.
+  Future<NmsGeneratedResult> nmsQueryAt(
+    NomosMoment moment,
+    NmsGeneratedQuery query, [
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+  ]) =>
+      _nmsKernelHistoricApplicationQuery(
+        moment: moment,
+        session: session,
+        authority: _nmsQueryAuthority(keys, principal, session),
+        query: nomos_protocol.QueryRequest(
+          rows: nomos_protocol.RowsQuery(
+            id: query.query,
+            principal: principal ?? '',
+            applicationArguments: google_protobuf.Any(
+              typeUrl: query.protobufType,
+              value: query.protobufPayload,
+            ),
+          ),
+        ),
+      );
+
+  /// Reactive form of [nmsQuery]. Decode the exact result delivered by the
+  /// kernel watch; the notification is data, not a request to query it again.
+  Stream<NmsGeneratedResult> nmsWatch(
+    NmsGeneratedQuery query, {
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+    int intervalMs = _defaultWatchSafetyPollMs,
+  }) =>
+      _nmsWatchQuery(
+        nomos_protocol.QueryRequest(
+          rows: nomos_protocol.RowsQuery(
+            id: query.query,
+            principal: principal ?? '',
+            applicationArguments: google_protobuf.Any(
+              typeUrl: query.protobufType,
+              value: query.protobufPayload,
+            ),
+          ),
+        ),
+        resultFormat: nomos_protocol
+            .QueryResultFormat.QUERY_RESULT_FORMAT_APPLICATION_PROTOBUF,
+        decode: (changed) {
+          if (!changed.hasApplicationResult()) {
+            throw StateError(
+                'Generated watch returned no typed application result');
+          }
+          return NmsInternalGeneratedResults.create(
+            protobufType: changed.applicationResult.typeUrl,
+            protobufPayload:
+                Uint8List.fromList(changed.applicationResult.value),
+          );
+        },
+        keys: keys,
+        principal: principal,
+        session: session,
+        intervalMs: intervalMs,
+      );
+
+  /// Reactive form of [nmsQueryUsda]. Subscription mechanics are Runtime v2
+  /// protobuf; each emission is the kernel's nominal USDA result and is decoded
+  /// only by the generated domain client which owns [query].
+  Stream<Uint8List> nmsWatchUsda(
+    NmsGeneratedQuery query, {
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+    int intervalMs = _defaultWatchSafetyPollMs,
+  }) =>
+      _nmsWatchQueryUsda(
+        nomos_protocol.QueryRequest(
+          rows: nomos_protocol.RowsQuery(
+            id: query.query,
+            principal: principal ?? '',
+            applicationArguments: google_protobuf.Any(
+              typeUrl: query.protobufType,
+              value: query.protobufPayload,
+            ),
+          ),
+        ),
+        keys: keys,
+        principal: principal,
+        session: session,
+        intervalMs: intervalMs,
+      );
+
+  /// Reactive by-id read. The generated domain decoder supplies the nominal
+  /// aggregate type; this framework method owns only the protobuf mechanics.
+  Stream<Uint8List> nmsWatchByIdUsda(
+    String aggregateType,
+    String id, {
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+    int intervalMs = _defaultWatchSafetyPollMs,
+  }) =>
+      _nmsWatchQueryUsda(
+        nomos_protocol.QueryRequest(
+          byId: nomos_protocol.ByIdQuery(
+            aggregateType: aggregateType,
+            aggregateId: id,
+            principal: principal ?? '',
+          ),
+        ),
+        keys: keys,
+        principal: principal,
+        session: session,
+        intervalMs: intervalMs,
+      );
+
+  /// Reactive type-index read. The aggregate type is a dedicated protobuf
+  /// field, never a magic application query name or argument bag.
+  Stream<Uint8List> nmsWatchByTypeUsda(
+    String aggregateType, {
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+    int intervalMs = _defaultWatchSafetyPollMs,
+  }) =>
+      _nmsWatchQueryUsda(
+        nomos_protocol.QueryRequest(
+          byType: nomos_protocol.ByTypeQuery(
+            aggregateType: aggregateType,
+            principal: principal ?? '',
+          ),
+        ),
+        keys: keys,
+        principal: principal,
+        session: session,
+        intervalMs: intervalMs,
+      );
+
+  Stream<Uint8List> _nmsWatchQueryUsda(
+    nomos_protocol.QueryRequest request, {
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+    int intervalMs = _defaultWatchSafetyPollMs,
+  }) =>
+      _nmsWatchQuery(
+        request,
+        resultFormat:
+            nomos_protocol.QueryResultFormat.QUERY_RESULT_FORMAT_NOMINAL_USDA,
+        decode: (changed) {
+          if (changed.hasApplicationResult()) {
+            throw StateError('Nominal watch returned an application result');
+          }
+          return Uint8List.fromList(changed.resultUsda);
+        },
+        keys: keys,
+        principal: principal,
+        session: session,
+        intervalMs: intervalMs,
+      );
+
+  Stream<T> _nmsWatchQuery<T>(
+    nomos_protocol.QueryRequest request, {
+    required nomos_protocol.QueryResultFormat resultFormat,
+    required T Function(nomos_protocol.WatchChanged) decode,
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+    int intervalMs = _defaultWatchSafetyPollMs,
+  }) {
+    final runtimeSession = session ?? _sessionName;
+    if (runtimeSession == null || runtimeSession.isEmpty) {
+      throw StateError('A nominal watch must be bound to a NomosSession');
+    }
+    final plane = _eventPlane;
+    request
+      ..authority = _nmsQueryAuthority(keys, principal, runtimeSession)
+      ..spans = true
+      ..resultFormat = resultFormat;
+    final NmsTypedWatchHandle<T> watch = plane._events.typedWatches.open<T>(
+      session: runtimeSession,
+      decode: decode,
+      stop: _unwatch,
+      start: (subscriptionId) async {
+        final response = await _invokeRuntimeV2(
+          nomos_protocol.RuntimeRequest(
+            watch: nomos_protocol.WatchRequest(
+              session: runtimeSession,
+              subscriptionId: subscriptionId,
+              kind: nomos_protocol.WatchKind.WATCH_KIND_QUERY,
+              query: request,
+              intervalMillis: intervalMs,
+            ),
+          ),
+        );
+        if (!response.hasWatchStarted() ||
+            response.watchStarted.subscriptionId != subscriptionId) {
+          throw StateError(
+            'Runtime v2 returned ${response.whichOutcome().name} for nominal watch',
+          );
+        }
+      },
+    );
+    return watch.stream;
+  }
+
+  /// Bounded declared application query over the shared typed peer-office
+  /// boundary. Cursor and completion are fields of the generated result type.
+  Future<NmsGeneratedResult> nmsQueryPage(
+    NmsGeneratedQuery query, {
+    int pageSize = 100,
+    String? cursor,
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+  }) {
+    if (pageSize < 1 || pageSize > 1000) {
+      throw RangeError.range(pageSize, 1, 1000, 'pageSize');
+    }
+    return _nmsKernelApplicationQuery(
+      session: session,
+      authority: _nmsQueryAuthority(keys, principal, session),
+      query: nomos_protocol.QueryRequest(
+        page: nomos_protocol.PageQuery(
+          id: query.query,
+          limit: pageSize,
+          after: cursor ?? '',
+          principal: principal ?? '',
+          applicationArguments: google_protobuf.Any(
+            typeUrl: query.protobufType,
+            value: query.protobufPayload,
+          ),
+        ),
+      ),
+    );
+  }
+
+  /// Framework-private by-id form of [nmsQueryUsda].
+  Future<Uint8List> nmsQueryByIdUsda(
+    String aggregateType,
+    String id, [
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+  ]) =>
+      _nmsKernelQueryUsda(
+        session: session,
+        authority: _nmsQueryAuthority(keys, principal, session),
+        query: nomos_protocol.QueryRequest(
+          byId: nomos_protocol.ByIdQuery(
+            aggregateType: aggregateType,
+            aggregateId: id,
+            principal: principal ?? '',
+          ),
+        ),
+      );
+
+  Future<Uint8List> nmsQueryByIdAtUsda(
+    NomosMoment moment,
+    String aggregateType,
+    String id, [
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+  ]) =>
+      _nmsKernelHistoricQueryUsda(
+        moment: moment,
+        session: session,
+        authority: _nmsQueryAuthority(keys, principal, session),
+        query: nomos_protocol.QueryRequest(
+          byId: nomos_protocol.ByIdQuery(
+            aggregateType: aggregateType,
+            aggregateId: id,
+            principal: principal ?? '',
+          ),
+        ),
+      );
+
+  /// Framework-private type-index read. Aggregate type is a fixed protobuf field, not a fake
+  /// application query argument.
+  Future<Uint8List> nmsQueryByTypeUsda(
+    String aggregateType, [
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+  ]) =>
+      _nmsKernelQueryUsda(
+        session: session,
+        authority: _nmsQueryAuthority(keys, principal, session),
+        query: nomos_protocol.QueryRequest(
+          byType: nomos_protocol.ByTypeQuery(
+            aggregateType: aggregateType,
+            principal: principal ?? '',
+          ),
+        ),
+      );
+
+  Future<Uint8List> nmsQueryByTypeAtUsda(
+    NomosMoment moment,
+    String aggregateType, [
+    List<NomosScopeKey>? keys,
+    String? principal,
+    String? session,
+  ]) =>
+      _nmsKernelHistoricQueryUsda(
+        moment: moment,
+        session: session,
+        authority: _nmsQueryAuthority(keys, principal, session),
+        query: nomos_protocol.QueryRequest(
+          byType: nomos_protocol.ByTypeQuery(
+            aggregateType: aggregateType,
+            principal: principal ?? '',
+          ),
+        ),
+      );
+
+  /// Exact spatial-index read for generated domain clients. [spatialId] is
+  /// generated from the installed DSL graph; the application supplies only
+  /// the typed [bbox]. Rows remain canonical USDA until its generated decoder.
+  Future<Uint8List> nmsSpatialWithinUsda(
+    String spatialId,
+    NomosBbox bbox, [
+    String? session,
+  ]) =>
+      _nmsKernelQueryUsda(
+        session: session,
+        authority: _nmsQueryAuthority(null, null, session),
+        query: nomos_protocol.QueryRequest(
+          spatial: nomos_protocol.SpatialQuery(
+            id: spatialId,
+            minX: bbox.minX,
+            minY: bbox.minY,
+            maxX: bbox.maxX,
+            maxY: bbox.maxY,
+          ),
+        ),
+      );
+
+  /// Reactive counterpart of [nmsSpatialWithinUsda]. Runtime v2 owns the
+  /// subscription; every value is still the kernel's canonical USDA image.
+  Stream<Uint8List> nmsWatchSpatialUsda(
+    String spatialId,
+    NomosBbox bbox, {
+    String? session,
+    int intervalMs = _defaultWatchSafetyPollMs,
+  }) =>
+      _nmsWatchQueryUsda(
+        nomos_protocol.QueryRequest(
+          spatial: nomos_protocol.SpatialQuery(
+            id: spatialId,
+            minX: bbox.minX,
+            minY: bbox.minY,
+            maxX: bbox.maxX,
+            maxY: bbox.maxY,
+          ),
+        ),
+        session: session,
+        intervalMs: intervalMs,
+      );
+
+  Future<int> _nmsTally(
+    String id,
+    String? groupKey, {
+    required bool sum,
+    String? session,
+    NomosMoment? moment,
+  }) async {
+    final tally = nomos_protocol.TallyQuery(
+      id: id,
+      groupKey: groupKey,
+    );
+    final query = nomos_protocol.QueryRequest();
+    if (sum) {
+      query.sum = tally;
+    } else {
+      query.count = tally;
+    }
+    final authority = _nmsQueryAuthority(null, null, session);
+    final result = moment == null
+        ? await _nmsKernelQuery(
+            session: session,
+            authority: authority,
+            query: query,
+          )
+        : await _nmsKernelHistoricQuery(
+            moment: moment,
+            session: session,
+            authority: authority,
+            query: query,
+          );
+    if (!result.hasIntegerValue()) {
+      throw StateError(
+        'Kernel returned ${result.whichResult().name} without an exact integer tally',
+      );
+    }
+    return result.integerValue.toInt();
+  }
+
+  Future<int> nmsCount(String countId, [String? groupKey, String? session]) =>
+      _nmsTally(countId, groupKey, sum: false, session: session);
+
+  /// Observe the kernel's maintained tally; no row transfer or client recount.
+  Stream<int> nmsWatchCount(String countId, [String? groupKey]) =>
+      _nmsWatchQuery(
+        nomos_protocol.QueryRequest(
+          count: nomos_protocol.TallyQuery(id: countId, groupKey: groupKey),
+        ),
+        resultFormat:
+            nomos_protocol.QueryResultFormat.QUERY_RESULT_FORMAT_LEGACY_VALUE,
+        decode: (changed) {
+          if (!changed.hasIntegerValue()) {
+            throw StateError('Count watch returned no integer tally');
+          }
+          return changed.integerValue.toInt();
+        },
+      );
+
+  Future<int> nmsCountAt(
+    NomosMoment moment,
+    String countId, [
+    String? groupKey,
+    String? session,
+  ]) =>
+      _nmsTally(
+        countId,
+        groupKey,
+        sum: false,
+        session: session,
+        moment: moment,
+      );
+
+  Future<int> nmsSum(String sumId, [String? groupKey, String? session]) =>
+      _nmsTally(sumId, groupKey, sum: true, session: session);
+
+  /// Read an installed min/max declaration through the ordinary authenticated pipe.
+  Future<int?> nmsExtremum(String id, String kind, [String? groupKey]) =>
+      _nmsExtremum(id, kind, groupKey);
+
+  Future<int?> nmsExtremumAt(NomosMoment moment, String id, String kind,
+          [String? groupKey]) =>
+      _nmsExtremum(id, kind, groupKey, moment: moment);
+
+  Future<int?> _nmsExtremum(String id, String kind, String? groupKey,
+      {NomosMoment? moment}) async {
+    final query = extrema.extremumQuery(id, kind, groupKey);
+    final authority = _nmsQueryAuthority(null, null, null);
+    const format =
+        nomos_protocol.QueryResultFormat.QUERY_RESULT_FORMAT_LEGACY_VALUE;
+    final result = moment == null
+        ? await _nmsKernelQuery(
+            session: null,
+            authority: authority,
+            query: query,
+            resultFormat: format)
+        : await _nmsKernelHistoricQuery(
+            moment: moment,
+            session: null,
+            authority: authority,
+            query: query,
+            resultFormat: format);
+    return extrema.extremumValue(result);
+  }
+
+  Future<int> nmsSumAt(
+    NomosMoment moment,
+    String sumId, [
+    String? groupKey,
+    String? session,
+  ]) =>
+      _nmsTally(
+        sumId,
+        groupKey,
+        sum: true,
+        session: session,
+        moment: moment,
+      );
+
+  /// Compare an immutable publication pin with the stable series' one compiled
+  /// current pointer. This is an O(current-state) check: it neither resolves the
+  /// pinned publication nor reconstructs aggregate history.
+  ///
+  /// THE OFFICE STATES THE STATUS. This used to walk the kernel's transitional
+  /// `LEGACY_VALUE` object — `unique[0].outcome.status`, then `latest`'s string
+  /// fields — which made the client responsible for a shape the kernel had not
+  /// yet given a generated response. The desk decodes it once and answers a typed
+  /// report; Reception only renders the arm it names.
+  Future<ReferenceVersionStatus<TVersion>>
+      checkReferenceVersion<TVersion, TSeries>(
+          VersionedNomosRef<TVersion, TSeries> reference) async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        checkReferenceVersions: nomos_protocol.CheckReferenceVersionsRequest(
+          session: _runtimeSession(),
+          refs: [
+            nomos_protocol.ReferenceVersionCheck(
+              pinned: _nomosRefToProtocol(reference.pinned),
+              series: _nomosRefToProtocol(reference.series),
+              currentField: NmsInternalVersionedNomosRefs.currentField(
+                reference,
+              ),
+            ),
+          ],
+        ),
+      ),
+    );
+    if (!response.hasReferenceVersions() ||
+        response.referenceVersions.outcomes.isEmpty) {
+      return ReferenceVersionUnavailable<TVersion>(
+        'Runtime v2 returned ${response.whichOutcome().name} for reference versions',
+      );
+    }
+    final outcome = response.referenceVersions.outcomes.first;
+    switch (outcome.status) {
+      case nomos_protocol
+            .ReferenceVersionStatus.REFERENCE_VERSION_STATUS_CURRENT:
+        return ReferenceVersionCurrent<TVersion>(reference.pinned);
+      case nomos_protocol
+            .ReferenceVersionStatus.REFERENCE_VERSION_STATUS_OUTDATED:
+        final latest = outcome.latest;
+        return ReferenceVersionOutdated<TVersion>(
+          NmsInternalNomosRefs.create<TVersion>(
+            workspace: latest.workspace,
+            type: latest.aggregateType,
+            id: latest.aggregateId,
+          ),
+        );
+      default:
+        return ReferenceVersionUnavailable<TVersion>(
+          outcome.hasDetail() ? outcome.detail : 'unknown',
+        );
+    }
+  }
+
+  /// Verified points in this workspace's history, oldest to newest. The generated client presents these
+  /// as `client.past.moments()`; callers pass the opaque [NomosMoment] back to `past.at(moment)` and never
+  /// need to know that the framework uses commit identities underneath.
+  Future<List<NomosMoment>> moments({int limit = 100, String? session}) async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        listWorkspaceMoments: nomos_protocol.ListWorkspaceMomentsRequest(
+          session: _runtimeSession(session),
+          limit: limit,
+        ),
+      ),
+    );
+    if (!response.hasWorkspaceMoments()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for workspace moments',
+      );
+    }
+    return response.workspaceMoments.moments
+        .map(
+          (moment) => NomosMoment(
+            id: moment.id,
+            occurredAt: moment.hasOccurredAtUnixMillis()
+                ? DateTime.fromMillisecondsSinceEpoch(
+                    moment.occurredAtUnixMillis.toInt(),
+                    isUtc: true,
+                  )
+                : null,
+            performedBy: moment.hasPerformedBy() ? moment.performedBy : null,
+            domain: moment.hasDomain() ? moment.domain : null,
+            action: moment.hasAction() ? moment.action : null,
+          ),
+        )
+        .toList(growable: false);
+  }
+
+  NomosScopeKey _scopeKeyFromFramework(
+    nomos_protocol.OwnedScopeKey key, {
+    required String fallbackScope,
+  }) =>
+      NomosScopeKey(
+        scope: key.scope.isEmpty ? fallbackScope : key.scope,
+        epoch: key.epoch.toInt(),
+        key: base64Encode(key.key),
+        ownedKeySubject: key.hasOwnedKeySubject() ? key.ownedKeySubject : null,
+        ownedCustody: key.hasOwnedCustodyUsda()
+            ? OwnedCustody.decodeUsda(
+                Uint8List.fromList(key.ownedCustodyUsda),
+              )
+            : null,
+        workspace: key.hasWorkspace() ? key.workspace : null,
+      );
+
+  /// Mint an X25519 device keypair through the exact generated kernel frame.
+  Future<nomos_protocol.EncryptionIdentityResponse> cryptoKeygen() =>
+      _kernelPrimitives().generateEncryptionIdentity();
+
+  /// AUTHOR-SIDE SEAL: encrypt `plaintext` into its on-chain ciphertext envelope, bound to the scope + #58
+  /// stable sids (rename-safe). Returns the envelope string the encrypted field value is written as.
+  Future<String> cryptoSealField({
+    required String scopeKey,
+    required String scope,
+    required int epoch,
+    required String aggSid,
+    required String fieldSid,
+    required String plaintext,
+  }) async {
+    final response = await _invokeFramework(
+      nomos_protocol.FrameworkRequest(
+        session: _runtimeSession(),
+        sealField: nomos_protocol.SealFieldRequest(
+          scopeKey: base64Decode(scopeKey),
+          scope: scope,
+          epoch: fixnum.Int64(epoch),
+          aggregateSid: aggSid,
+          fieldSid: fieldSid,
+          plaintext: plaintext,
+        ),
+      ),
+    );
+    if (!response.hasSealField()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichResult().name} for field sealing',
+      );
+    }
+    return response.sealField.envelope;
+  }
+
+  /// FRAMEWORK-INTERNAL `.owned()` key lane. The connected JS holon derives epoch 0 from its
+  /// already-persisted device credential; generated clients call this without exposing key custody to apps.
+  Future<NomosScopeKey> nomosOwnedScopeKey(
+    String scope, {
+    String? recordType,
+    String? recordId,
+  }) async {
+    final response = await _invokeFramework(
+      nomos_protocol.FrameworkRequest(
+        session: _runtimeSession(),
+        ownedScopeKey: nomos_protocol.OwnedScopeKeyRequest(
+          scope: scope,
+          record: recordType != null && recordId != null
+              ? nomos_protocol.OwnedRecordRef(
+                  type: recordType,
+                  id: recordId,
+                )
+              : null,
+        ),
+      ),
+    );
+    if (!response.hasOwnedScopeKey()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichResult().name} for owned scope key',
+      );
+    }
+    return _scopeKeyFromFramework(response.ownedScopeKey, fallbackScope: scope);
+  }
+
+  /// Every key epoch this principal currently holds for one owned record. Generated reads use the
+  /// complete set so history remains readable after rotations, shares and transfers.
+  Future<List<NomosScopeKey>> nomosOwnedScopeKeys(
+    String scope, {
+    required String recordType,
+    required String recordId,
+  }) async {
+    final response = await _invokeFramework(
+      nomos_protocol.FrameworkRequest(
+        session: _runtimeSession(),
+        ownedScopeKeys: nomos_protocol.OwnedScopeKeysRequest(
+          scope: scope,
+          record: nomos_protocol.OwnedRecordRef(
+            type: recordType,
+            id: recordId,
+          ),
+        ),
+      ),
+    );
+    if (!response.hasOwnedScopeKeys()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichResult().name} for owned scope keys',
+      );
+    }
+    return response.ownedScopeKeys.keys
+        .map((key) => _scopeKeyFromFramework(key, fallbackScope: scope))
+        .toList(growable: false);
+  }
+
+  /// Make this signed-in principal ready to receive record shares. Generated clients call this while
+  /// binding; tenant code never handles a key, certificate or identity tuple.
+  Future<void> nomosEnsureOwnedIdentity({
+    required String scope,
+    required String domain,
+    String? domainHash,
+  }) async {
+    final response = await _invokeFramework(
+      nomos_protocol.FrameworkRequest(
+        session: _runtimeSession(),
+        ensureOwnedIdentity: nomos_protocol.EnsureOwnedIdentityRequest(
+          scope: scope,
+          domain: domain,
+          domainSha256: domainHash,
+        ),
+      ),
+    );
+    if (!response.hasOwnedIdentityEnsured()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichResult().name} while ensuring owned identity',
+      );
+    }
+  }
+
+  /// Opt into designated-peer all-device-loss recovery. All protocol fields remain in the JS/kernel client.
+  Future<nomos_protocol.OwnedIdentityProtection> nomosProtectOwnedIdentity({
+    required String scope,
+    required String domain,
+    required String domainHash,
+    required String recoveryPrincipal,
+  }) async {
+    final response = await _invokeFramework(
+      nomos_protocol.FrameworkRequest(
+        session: _runtimeSession(),
+        protectOwnedIdentity: nomos_protocol.ProtectOwnedIdentityRequest(
+          scope: scope,
+          domain: domain,
+          domainSha256: domainHash,
+          recoveryPrincipal: recoveryPrincipal,
+        ),
+      ),
+    );
+    if (!response.hasProtectOwnedIdentity()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichResult().name} while protecting owned identity',
+      );
+    }
+    return response.protectOwnedIdentity;
+  }
+
+  /// Prepare the private framework payload behind generated share/unshare/transfer methods.
+  Future<NomosOwnedRecordPreparation>
+      nomosPrepareOwnedRecordAction<TAggregate>({
+    required String action,
+    required String scope,
+    required NomosRef<TAggregate> record,
+    required String peer,
+  }) async {
+    final protocolAction = switch (action) {
+      'share' => nomos_protocol.OwnedRecordAction.OWNED_RECORD_ACTION_SHARE,
+      'unshare' => nomos_protocol.OwnedRecordAction.OWNED_RECORD_ACTION_UNSHARE,
+      'transfer' =>
+        nomos_protocol.OwnedRecordAction.OWNED_RECORD_ACTION_TRANSFER,
+      _ => throw ArgumentError.value(action, 'action', 'unknown owned action'),
+    };
+    final response = await _invokeFramework(
+      nomos_protocol.FrameworkRequest(
+        session: _runtimeSession(),
+        prepareOwnedRecordAction:
+            nomos_protocol.PrepareOwnedRecordActionRequest(
+          action: protocolAction,
+          scope: scope,
+          record: nomos_protocol.OwnedRecordRef(
+            type: NmsInternalNomosRefs.type(record),
+            id: NmsInternalNomosRefs.id(record),
+          ),
+          peer: peer,
+        ),
+      ),
+    );
+    if (!response.hasPrepareOwnedRecordAction()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichResult().name} for owned record preparation',
+      );
+    }
+    final value = response.prepareOwnedRecordAction;
+    final ownedCustody = value.hasOwnedCustodyUsda()
+        ? OwnedCustody.decodeUsda(
+            Uint8List.fromList(value.ownedCustodyUsda),
+          )
+        : null;
+    NomosOwnedWrapPreparation wrap(nomos_protocol.OwnedKeyWrap value) =>
+        NomosOwnedWrapPreparation(
+          recipientPrincipal: value.recipientPrincipal,
+          recipientPubKey: value.recipientPublicKey,
+          hpkeEpk: base64Encode(value.ephemeralPublicKey),
+          ct: base64Encode(value.ciphertext),
+        );
+    NomosHistoricOwnedWrapPreparation historicWrap(
+      nomos_protocol.OwnedKeyWrap value,
+    ) =>
+        NomosHistoricOwnedWrapPreparation(
+          recipientPrincipal: value.recipientPrincipal,
+          recipientPubKey: value.recipientPublicKey,
+          hpkeEpk: base64Encode(value.ephemeralPublicKey),
+          ct: base64Encode(value.ciphertext),
+          epoch: value.hasEpoch() ? value.epoch.toInt() : 0,
+        );
+    switch (value.whichAction()) {
+      case nomos_protocol.OwnedRecordPreparation_Action.share:
+        final prepared = value.share;
+        return NomosOwnedSharePreparation(
+          ownedKeySubject: value.ownedKeySubject,
+          ownedCustody: ownedCustody,
+          recordId: prepared.recordId,
+          peer: prepared.peer,
+          epoch: prepared.epoch.toInt(),
+          sharedAt: prepared.sharedAt,
+          wraps: prepared.wraps.map(historicWrap).toList(growable: false),
+        );
+      case nomos_protocol.OwnedRecordPreparation_Action.unshare:
+        final prepared = value.unshare;
+        return NomosOwnedUnsharePreparation(
+          ownedKeySubject: value.ownedKeySubject,
+          ownedCustody: ownedCustody,
+          recordId: prepared.recordId,
+          peer: prepared.peer,
+          epoch: prepared.epoch.toInt(),
+          changedAt: prepared.changedAt,
+          wraps: prepared.wraps.map(wrap).toList(growable: false),
+        );
+      case nomos_protocol.OwnedRecordPreparation_Action.transfer:
+        final prepared = value.transfer;
+        return NomosOwnedTransferPreparation(
+          ownedKeySubject: value.ownedKeySubject,
+          ownedCustody: ownedCustody,
+          recordId: prepared.recordId,
+          newOwner: prepared.newOwner,
+          previousReaders: List.unmodifiable(prepared.previousReaders),
+          epoch: prepared.epoch.toInt(),
+          changedAt: prepared.changedAt,
+          historicWraps:
+              prepared.historicWraps.map(historicWrap).toList(growable: false),
+        );
+      case nomos_protocol.OwnedRecordPreparation_Action.notSet:
+        throw const FormatException(
+          'Nomos owned record preparation has no result arm',
+        );
+    }
+  }
+
+  /// FRAMEWORK-INTERNAL business birth: derive the unborn child's owned key from its deterministic address.
+  Future<NomosScopeKey> nomosOwnedBirthScopeKey(
+    String scope,
+    String namespace,
+    Object? key,
+    String recordType,
+    String recordId,
+  ) async {
+    final response = await _invokeFramework(
+      nomos_protocol.FrameworkRequest(
+        session: _runtimeSession(),
+        ownedBirthScopeKey: nomos_protocol.OwnedBirthScopeKeyRequest(
+          scope: scope,
+          namespace: namespace,
+          key: key.toString(),
+          record: nomos_protocol.OwnedRecordRef(
+            type: recordType,
+            id: recordId,
+          ),
+        ),
+      ),
+    );
+    if (!response.hasOwnedBirthScopeKey()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichResult().name} for owned birth scope key',
+      );
+    }
+    return _scopeKeyFromFramework(response.ownedBirthScopeKey,
+        fallbackScope: scope);
+  }
+
+  /// FRAMEWORK-INTERNAL: issue an opaque request for this session's current device.
+  Future<OwnedDeviceRequest> nomosOwnedDeviceRequest(String scope) async {
+    final response = await _nmsKernelQuery(
+      session: _sessionName,
+      authority: _nmsQueryAuthority(null, null, _sessionName),
+      query: nomos_protocol.QueryRequest(
+        ownedDeviceRequest:
+            nomos_protocol.OwnedDeviceRequestQuery(scope: scope),
+      ),
+    );
+    if (!response.hasOwnedDeviceRequest()) {
+      throw StateError(
+        'Kernel returned ${response.whichResult().name}, expected ownedDeviceRequest',
+      );
+    }
+    return OwnedDeviceRequest.decodeUsda(
+      Uint8List.fromList(response.ownedDeviceRequest.requestUsda),
+    );
+  }
+
+  /// FRAMEWORK-INTERNAL: validate an opaque request and prepare the atomic signer + custody offer.
+  Future<NomosOwnedDeviceApprovalPreparation> nomosPrepareOwnedDeviceApproval(
+    OwnedDeviceRequest request,
+    String scope,
+  ) async {
+    final response = await _nmsKernelQuery(
+      session: _sessionName,
+      authority: _nmsQueryAuthority(null, null, _sessionName),
+      query: nomos_protocol.QueryRequest(
+        ownedPrepareApproval: nomos_protocol.OwnedPrepareApprovalQuery(
+          scope: scope,
+          requestUsda: request.encodeUsda(),
+        ),
+      ),
+    );
+    if (!response.hasOwnedPrepareApproval()) {
+      throw StateError(
+        'Kernel returned ${response.whichResult().name}, expected ownedPrepareApproval',
+      );
+    }
+    final prepared = response.ownedPrepareApproval;
+    return NomosOwnedDeviceApprovalPreparation(
+      newKeySubject: prepared.newKeySubject,
+      ownedCustody: OwnedCustody.decodeUsda(
+        Uint8List.fromList(prepared.ownedCustodyUsda),
+      ),
+      verifiedVia: prepared.verifiedVia,
+      validFromEpoch: prepared.validFromEpoch.toInt(),
+      approvedAt: DateTime.fromMillisecondsSinceEpoch(
+        prepared.approvedAtUnixMillis.toInt(),
+        isUtc: true,
+      ).toIso8601String(),
+      ownedKeySubject: prepared.ownedKeySubject,
+    );
+  }
+
+  /// Wrap a scope key to a recipient using the exact generated kernel frame.
+  Future<nomos_protocol.WrapScopeKeyResponse> cryptoWrapKey({
+    required String recipientPub,
+    required String scopeKey,
+  }) =>
+      _kernelPrimitives().wrapScopeKey(
+        recipientPublicKey: base64Decode(recipientPub),
+        scopeKey: base64Decode(scopeKey),
+      );
+
+  /// Unwrap an on-chain key using the exact generated kernel frame.
+  Future<Uint8List> cryptoUnwrapKey({
+    required String secret,
+    required String hpkeEpk,
+    required String ct,
+  }) async =>
+      Uint8List.fromList(
+        (await _kernelPrimitives().unwrapScopeKey(
+          recipientSecretKey: base64Decode(secret),
+          ephemeralPublicKey: base64Decode(hpkeEpk),
+          ciphertext: base64Decode(ct),
+        ))
+            .scopeKey,
+      );
+
+  NmsKernelPrimitives _kernelPrimitives() {
+    final transport = _eventPlane._transport;
+    if (transport is! NomosKernelCallTransport) {
+      throw UnsupportedError(
+        'This peer does not expose generated kernel calls',
+      );
+    }
+    return NmsKernelPrimitives(
+      transport: transport as NomosKernelCallTransport,
+      session: _runtimeSession(),
+    );
+  }
+
+  /// Framework-filtered maintained conflicts. The kernel returns authenticated
+  /// USDA; only the generated client knows the composed application field types.
+  Future<Uint8List> nmsPendingConflictsUsda(
+    String? aggregateType, [
+    String? session,
+  ]) =>
+      _nmsKernelQueryUsda(
+        session: session,
+        authority: _nmsQueryAuthority(null, null, session),
+        query: nomos_protocol.QueryRequest(
+          pendingConflicts: nomos_protocol.PendingConflictsQuery(
+            aggregateType: aggregateType,
+          ),
+        ),
+      );
+
+  /// Counts-only workspace summary over the maintained conflict index.
+  Future<Uint8List> nmsPendingConflictSummaryUsda([
+    String? session,
+  ]) =>
+      _nmsKernelQueryUsda(
+        session: session,
+        authority: _nmsQueryAuthority(null, null, session),
+        query: nomos_protocol.QueryRequest(
+          pendingConflictSummary: nomos_protocol.PendingConflictSummaryQuery(),
+        ),
+      );
+
+  /// The local ledger tip (an O(1) ref read). Cheap change signal — persistence skips re-exporting an
+  /// unchanged snapshot when [head] matches the last saved tip. Runtime v2 carries this as an optional
+  /// protobuf field so an unborn workspace is distinct from a malformed reception result.
+  Future<String> head() async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        workspaceStatus: nomos_protocol.WorkspaceStatusRequest(
+          session: _runtimeSession(),
+        ),
+      ),
+    );
+    if (!response.hasWorkspaceStatus()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name}, expected workspaceStatus',
+      );
+    }
+    return response.workspaceStatus.hasHead()
+        ? response.workspaceStatus.head
+        : '';
+  }
+
+  /// Generated background-sync telemetry. Each item is a Runtime v2 event
+  /// whose exact arm is either [SyncCompleted] or [LinkChanged].
+  Stream<nomos_protocol.RuntimeEvent> get syncEvents =>
+      _eventPlane._events.syncEvents;
+
+  /// LIVE pack byte-progress — the real loading bar. Each event carries `received`/`total` (the host's
+  /// actual `Content-Length`, known before the body) + `kind` ('delta'|'full'). Emits only while a `/pack`
+  /// transfer is moving (small syncs ride the inline offer-result piggyback — instant, no bar).
+  Stream<TransferProgress> get transferProgress =>
+      _eventPlane._events.progress.transfers;
+
+  /// Live typed progress from the canonical kernel while a long synchronous
+  /// operation is in flight (currently cold custody verification/replay).
+  Stream<KernelProgress> get kernelProgress =>
+      _eventPlane._events.progress.kernel;
+
+  /// THE APP-READY SYNC STATE — a truthful aggregation of sync rounds, the doorbell, transfer progress, and a
+  /// typed sync/link/transfer events. Map straight to a sync-state page. Reading
+  /// this stream has no kernel or network side effect. [currentStatus] is the
+  /// latest snapshot for a non-stream read.
+  Stream<SyncStatus> get syncStatus {
+    final session = _sessionName;
+    return session == null
+        ? _eventPlane._events.syncStatuses.applicationStream
+        : _eventPlane._events.syncStatuses.sessionStream(session);
+  }
+
+  SyncStatus get currentStatus {
+    final session = _sessionName;
+    return session == null
+        ? _eventPlane._events.syncStatuses.applicationStatus
+        : _eventPlane._events.syncStatuses.statusFor(session);
+  }
+
+  SyncStatus _currentSessionStatus(String session) =>
+      _eventPlane._events.syncStatuses.statusFor(session);
+
+  void _pushSessionStatus(String session, SyncStatus status) {
+    _eventPlane._events.syncStatuses.pushSession(session, status);
+  }
+
+  void _updateScopedStatus(
+    String? session,
+    SyncStatus Function(SyncStatus current) update,
+  ) {
+    _eventPlane._events.syncStatuses.update(
+      session: session,
+      connectedSessions: _eventPlane._sessions.boundNames,
+      change: update,
+    );
+  }
+
+  void _foldApplicationStatusFromSessions() {
+    _eventPlane._events.syncStatuses.foldApplication(
+      _eventPlane._sessions.boundNames,
+    );
+  }
+
+  /// THE RECEIVING-GROUP CONVERGENCE TAIL as the office reports it (`ReceivingGroupConvergence`
+  /// runtime events): the phase in progress, then one terminal CONVERGED or DEFERRED. A workspace
+  /// session sees only its own group's events; the root reception sees the whole plane. Presentation
+  /// only — the tail never fails the gate and the office retries it on the next open.
+  Stream<nomos_protocol.ReceivingGroupConvergence>
+      get receivingGroupConvergence {
+    final session = _sessionName;
+    final all = _eventPlane._events.receivingGroupConvergence;
+    if (session == null) return all;
+    return all.where((event) =>
+        event.workspace ==
+        (_eventPlane._sessions.isBound(session)
+            ? _eventPlane._sessions.workspaceFor(session)
+            : session));
+  }
+
+  /// LIVE per-layer spans of the local pipeline (begin/end as they happen): mutex wait, githolon author,
+  /// push, converge … The host renders in-progress bars so a hang is visible WHILE it blocks, not after.
+  Stream<NomosSpanEvent> get spanEvents => _eventPlane._events.progress.spans;
+
+  /// The buffered recent span events — replay these on first build to recover the BOOT flamepath
+  /// (fetch wasm / open local custody / instantiate) that streamed before the UI subscribed.
+  List<NomosSpanEvent> get recentSpans =>
+      _eventPlane._events.progress.recentSpans;
+
+  /// TIER-2 SYNC SIZE — how many bytes this workspace would transfer to catch up to main, WITHOUT downloading
+  /// them (a HEAD on the serving pack; the host answers Content-Length only, cached ~15s). Sum across your open
+  /// workspaces for an aggregate "X MB to sync" total BEFORE downloading. `{ bytes, kind:'delta'|'full'|
+  /// 'up-to-date' }`; `bytes` is null if the host omitted the length.
+  Future<nomos_protocol.WorkspaceTransferEstimate> syncSize() async {
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        estimateWorkspaceTransfer:
+            nomos_protocol.EstimateWorkspaceTransferRequest(
+          session: _runtimeSession(),
+        ),
+      ),
+    );
+    if (!response.hasWorkspaceTransferEstimate()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for transfer estimate',
+      );
+    }
+    return response.workspaceTransferEstimate;
+  }
+
+  /// Carry one compiler-authored USDA matrix to the kernel and receive the
+  /// desk's complete verdict: the kernel's per-member examination, plus the one
+  /// correspondence fact — whether missing law might still arrive — that a client
+  /// would otherwise be tempted to infer from a commit count.
+  Future<nomos_protocol.InterfaceCompatibilityVerdict> checkCompatibility(
+    List<int> applicationMatrixUsda,
+  ) {
+    final session = _runtimeSession();
+    final matrix = Uint8List.fromList(applicationMatrixUsda);
+    final entries = _eventPlane._compatibilityBySession.putIfAbsent(
+      session,
+      () => <_CompatibilityCacheEntry>[],
+    );
+    for (final entry in entries) {
+      if (_sameBytes(entry.matrix, matrix)) return entry.answer;
+    }
+    late final _CompatibilityCacheEntry entry;
+    final answer = _checkCompatibility(session, matrix).catchError(
+      (Object error, StackTrace stackTrace) {
+        entries.remove(entry);
+        Error.throwWithStackTrace(error, stackTrace);
+      },
+    );
+    entry = _CompatibilityCacheEntry(matrix, answer);
+    entries.add(entry);
+    return answer;
+  }
+
+  Future<nomos_protocol.InterfaceCompatibilityVerdict> _checkCompatibility(
+    String session,
+    Uint8List applicationMatrixUsda,
+  ) async {
+    final response = await _invokeFramework(
+      nomos_protocol.FrameworkRequest(
+        session: session,
+        checkInterfaceCompatibility:
+            nomos_protocol.CheckInterfaceCompatibilityRequest(
+          applicationMatrixUsda: applicationMatrixUsda,
+        ),
+      ),
+    );
+    if (!response.hasInterfaceCompatibilityVerdict()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichResult().name} for interface compatibility',
+      );
+    }
+    return response.interfaceCompatibilityVerdict;
+  }
+
+  /// Bind and return one stable language-native session handle.
+  Future<NomosSession> open({
+    required String workspace,
+    String? credentialSourceSession,
+    String? principal,
+    String? session,
+  }) async {
+    await bindSession(
+      workspace: workspace,
+      credentialSourceSession: credentialSourceSession,
+      principal: principal,
+      session: session,
+    );
+    return this.session(session ?? workspace);
+  }
+
+  /// Tear down the application realm, then stop the transport subscription and
+  /// fail any remaining in-flight calls. The native kernel plane may remain
+  /// resident for custody/cache reuse, but its application-owned sessions,
+  /// watches and continuous-sync loops must not survive this client.
+  Future<void> dispose() async {
+    try {
+      // Stop every typed watch first, while the realm and transport can still
+      // answer the unwatch; closing the realm underneath live watches leaves
+      // their cancellations racing the transport teardown.
+      await _events.typedWatches.close().timeout(const Duration(seconds: 10));
+    } catch (_) {
+      // A dead peer cannot acknowledge unwatch; the realm close below (or the
+      // host's transport disposal) releases the subscriptions regardless.
+    }
+    try {
+      final response = await _invokeRuntimeV2(
+        nomos_protocol.RuntimeRequest(
+          closeRealm: nomos_protocol.CloseRealmRequest(),
+        ),
+      ).timeout(const Duration(seconds: 10));
+      if (!response.hasRealmClosed()) {
+        throw StateError(
+          'Runtime v2 returned ${response.whichOutcome().name} for closeRealm',
+        );
+      }
+    } catch (_) {
+      // A dead/unstarted embedding has no reachable runner to release. The
+      // enclosing engine host is still disposed below by NomosScope; never let
+      // teardown strand the Flutter lifecycle on an unavailable transport.
+    }
+    await _runtimeEventSub?.cancel();
+    _runtimeEventSub = null;
+    await _events.close();
+    _receipts.close();
+  }
+}
+
+/// A LIVE WORKSPACE on a device's local plane — the FIRST-CLASS multi-workspace object. Everything about
+/// Nomos is multi-workspace: a running app holds ONE [DartReception] (this device's local holarchy plane) and
+/// MANY [NomosSession]s on it — the user's home, each estate, each catalogue, any locally-born child — a
+/// dozen or hundreds, interacting offline. Get one with `reception.session('estate')` and hand it to a generated
+/// typed client: `EstateClient(reception.session('estate'))`.
+///
+/// A session is an ephemeral interaction view pinned to one workspace. It is
+/// not custody, placement, a Replica Follow or a cloud connection. The peer
+/// owns those durable lifecycles independently; this view only addresses
+/// application operations and observations.
+///
+/// Implementation: it EXTENDS [DartReception] but holds no state of its own: it shares the [parent]
+/// plane's ONE transport, correlation, and watch streams, and overrides the sole low-level [_call] to stamp
+/// `args.session` and route through the parent — so request/reply, watches, and telemetry all resolve on the
+/// one message loop with no aliasing. The single-workspace [DartReception] methods are documented sugar over an
+/// inferred default session; a multi-workspace app works through session handles.
+class NomosSession extends DartReception {
+  /// The device's local plane every op routes through (the shared [DartReception]).
+  final DartReception parent;
+
+  /// The workspace name this session is pinned to.
+  final String workspace;
+
+  NomosSession(this.parent, this.workspace) : super._view(parent);
+
+  /// THE SEAM (see [DartReception._eventPlane]): all event dispatch + plane state resolves on the PARENT's
+  /// registries (chased to the root, so nested delegation stays correct). This ONE override is why the base
+  /// class's Stream-returning methods work unmodified on a session — no per-method overrides.
+  @override
+  DartReception get _eventPlane => parent._eventPlane;
+
+  /// Base implementations scope law-state (compat / onLawChanged) to THIS workspace via this.
+  @override
+  String? get _sessionName => workspace;
+
+  /// Whether this interaction handle has been bound to the resident peer.
+  bool get isBound => parent.boundSessions.contains(workspace);
+
+  /// Sibling workspaces resolve on the shared plane — delegate to the parent's registry (never nest a
+  /// session inside a session).
+  @override
+  NomosSession session(String workspace) => parent.session(workspace);
+
+  /// Offer this workspace to the Peer Office model-adoption desk: observe its
+  /// current law for the application's domain keys, and when it still serves
+  /// the previous law, stage the approved package, prove the transition and
+  /// promote it through the ordinary signed lifecycle offers. The office runs
+  /// the whole procedure and answers `current`, `adopted`, a typed `deferred`
+  /// or — with [dryRun] — `previewed`; this only transports the paper.
+  Future<NomosModelAdoption> adoptApplicationModel(
+      {bool dryRun = false}) async {
+    final model = nomosInternalApprovedApplicationModel;
+    if (model == null) {
+      throw StateError(
+        'No approved application model is retained on this plane; supply one at the application Reception.',
+      );
+    }
+    final response = await _invokeRuntimeV2(
+      nomos_protocol.RuntimeRequest(
+        adoptApplicationModel: nomos_protocol.AdoptApplicationModelRequest(
+          session: workspace,
+          lawSha256: model.lawSha256,
+          domainKeys: model.domainKeys,
+          acceptanceReason: model.reason,
+          dryRun: dryRun,
+        ),
+      ),
+    );
+    if (response.hasFailure()) {
+      throw StateError(
+        '${response.failure.code}: ${response.failure.message}',
+      );
+    }
+    if (!response.hasApplicationModelAdopted()) {
+      throw StateError(
+        'Runtime v2 returned ${response.whichOutcome().name} for model adoption',
+      );
+    }
+    return NomosModelAdoption.fromRuntime(response.applicationModelAdopted);
+  }
+
+  /// The model-adoption desk's observations for this workspace.
+  Stream<NomosModelAdoptionProgress> get modelAdoptionProgress =>
+      _eventPlane._events.modelAdoption
+          .where((progress) => progress.workspace == workspace);
+
+  /// Framework seam: offer this workspace to the model-adoption desk without
+  /// gating the caller on it. A transport failure is projected as a deferred
+  /// observation so the sync-status surface shows it; nothing is retried.
+  void nomosInternalAdoptApplicationModelInBackground() {
+    final plane = _eventPlane;
+    final model = nomosInternalApprovedApplicationModel;
+    if (model == null) return;
+    final key = (workspace, model);
+    unawaited(plane._backgroundModelAdoptions.putIfAbsent(
+        key,
+        () =>
+            adoptApplicationModel().then<void>((_) {}, onError: (Object error) {
+              final progress = NomosModelAdoptionProgress(
+                workspace: workspace,
+                phase: NomosModelAdoptionPhase.observe,
+                outcome: NomosModelAdoptionOutcome.deferred,
+                detail: 'the adoption paper could not be transported: $error',
+              );
+              plane._events.publishModelAdoption(progress);
+              plane._updateScopedStatus(
+                workspace,
+                (current) => current.copyWith(modelAdoption: progress),
+              );
+            }).whenComplete(() {
+              plane._backgroundModelAdoptions.remove(key);
+            })));
+  }
+
+  /// Bind a sibling interaction on the shared language view. The sibling may
+  /// share this session's credential capability; it inherits no placement,
+  /// custody or synchronization lifecycle.
+  @override
+  Future<NomosSession> bindWorkspace(
+    String workspace, {
+    String? credentialSourceSession,
+  }) =>
+      parent.bindWorkspace(
+        workspace,
+        credentialSourceSession: credentialSourceSession ?? this.workspace,
+      );
+
+  /// A followed ref binds on the shared language view; the peer routes its operations.
+  @override
+  Future<NomosSession> follow<TAggregate>(
+    NomosRef<TAggregate> ref, {
+    String? credentialSourceSession,
+  }) =>
+      parent.follow(
+        ref,
+        credentialSourceSession: credentialSourceSession ?? workspace,
+      );
+
+  // The parent owns the ONE message loop + lifecycle; a session never subscribes, never signals ready of its
+  // own, and never tears the plane down (the harness owns `parent.dispose()`).
+  @override
+  Future<void> get ready => parent.ready;
+  @override
+  Future<void> dispose() async {}
+
+  // NO per-method Stream/watch/snapshot overrides live here anymore — the base class routes ALL event
+  // dispatch + plane state through [_eventPlane] (and law-scopes compat/onLawChanged via [_sessionName]),
+  // and the watch ops still carry this session's workspace because their registration goes through the
+  // overridden [_call]. Adding a `Stream`-returning override below is almost certainly re-opening the
+  // dead-registry bug class — see `test/event_plane_seam_test.dart`.
+}
+
+/// A Reception-backed foreign reader over a peer's multi-workspace [DartReception]
+/// plane. Constructed via `reception.foreignReader()`; a generated `ForeignRef`
+/// resolves against it. The peer runtime decides how the target is served.
+class _ReceptionForeignReader implements NomosForeignReader {
+  _ReceptionForeignReader(this._reception);
+  final DartReception _reception;
+
+  @override
+  NomosForeignWorkspaceReader foreignWorkspace(String workspace) =>
+      _ReceptionForeignWorkspaceReader(_reception, workspace);
+}
+
+/// A per-workspace read handle which binds [_workspace] lazily on first use.
+class _ReceptionForeignWorkspaceReader implements NomosForeignWorkspaceReader {
+  _ReceptionForeignWorkspaceReader(this._reception, this._workspace);
+  final DartReception _reception;
+  final String _workspace;
+  Future<void>? _binding;
+
+  // Bind once. The first read is then routed by the runtime according to the
+  // target's placement; typed unavailability distinguishes an absent local
+  // replica from a remote peer that cannot currently be reached.
+  Future<void> _ensureBound() => _binding ??= _reception.bindSession(
+        workspace: _workspace,
+        session: _workspace,
+      );
+
+  @override
+  Future<Uint8List> queryById(String aggregateType, String id) async {
+    await _ensureBound();
+    return _reception.session(_workspace).nmsQueryByIdUsda(aggregateType, id);
+  }
+
+  // A FOREIGN WATCH IS AN ORDINARY WATCH. It used to re-read the record on every
+  // plane sync tick — a polling policy chosen in one client, so a foreign ref
+  // behaved differently here than anywhere else and than it does in TypeScript.
+  // Once bound, the foreign workspace is a session like any other, so the watch
+  // goes down the office's own lane: the subscription, its interval, its
+  // invalidation and its failure handling all belong to the desks that own them.
+  @override
+  Stream<Uint8List>? watchById(String aggregateType, String id) =>
+      Stream<void>.fromFuture(_ensureBound()).asyncExpand(
+        (_) =>
+            _reception.session(_workspace).nmsWatchByIdUsda(aggregateType, id),
+      );
+}