@githolon/dsl 0.108.6 → 0.110.0

package/src/{codegen_dart_application.ts → codegen_dart_facade.ts}

@@ -1,8 +1,9 @@
-// Generated tenant-facing Dart application facade.
+import { refusalContracts, refusalType, refusalDecoder } from "./codegen_refusal.js";
+// Generated tenant-facing Dart facade.
 //
-// The bridge-bound `<domain>.client.dart` is an implementation detail. This file is the exported
+// The session-bound `<domain>.client.dart` is an implementation detail. This file is the exported
 // application contract: business inputs in, business ids/models out. It deliberately has no public
-// bridge/session/workspace/actor/sync surface.
+// session/session/workspace/actor/sync surface.
 import type { z } from "zod";
 
 import type { AggregateHandle } from "./aggregate.js";
@@ -28,12 +29,12 @@ import {
 } from "./codegen_dart.js";
 import {
   dartClientClassName,
-  dartInternalChildAuthenticationRecoveryMethod,
   dartInternalSourceTrustMethod,
-  dartInternalWorkspaceSharingReceiptMethod,
 } from "./codegen_dart_client.js";
 import { finishCount } from "./count.js";
 import { finishSum } from "./sum.js";
+import { finishExtremum } from "./extremum.js";
+import { finishExists } from "./exists.js";
 import {
   isNamespacedAggregate,
   qualifyReadProjectionType,
@@ -44,16 +45,12 @@ import {
   isFrameworkDirective,
   isFrameworkQuery,
 } from "./framework/framework_aggregates.js";
-import {
-  childAuthenticationRecoveryAggregateId,
-  isBusinessIntent,
-} from "./intent.js";
+import { isBusinessIntent } from "./intent.js";
 import { contractTypeName } from "./contract.js";
 import { admitsNull } from "./null_meta.js";
-import type {
-  WorkspaceSharingPolicy,
-  WorkspaceSharingReceipt,
-} from "./workspace_sharing.js";
+import type { WorkspaceSharingPolicy } from "./workspace_sharing.js";
+import { publishingIntentOf } from "./codegen_call_proto.js";
+import type { LawGraph } from "./law_graph.js";
 
 type AnyDirective = Directive<z.ZodTypeAny>;
 
@@ -99,7 +96,6 @@ const reserved = new Set([
 const safe = (s: string) => (reserved.has(s) ? `${s}_` : s);
 const member = (s: string) => safe(lcFirst(camel(s)));
 const TENANT_ROOT_MEMBERS = new Map<string, string>([
-  ["nomosWidget", "the generated Nomos Flutter bootstrap"],
   ["currentUser", "the generated signed-in application participant"],
   ["currentStatus", "the generated application status"],
   ["watchStatus", "the generated application status watch"],
@@ -131,6 +127,7 @@ function keyType(
   const first = key.includes(".") ? key.split(".")[0]! : key;
   const field = aggregate?.fields[first] as Field | undefined;
   if (field?.kind === "int" || field?.kind === "counter") return "int";
+  if (field?.kind === "bool") return "bool";
   if (field?.kind === "ref") {
     if (field.foreignRef !== undefined) {
       const target =
@@ -159,93 +156,6 @@ function keyType(
   return "String";
 }
 
-function sharingOrderValue(
-  policy: WorkspaceSharingPolicy,
-  fieldName: string,
-  target: "wire" | "value" = "value"
-): string {
-  const field = policy.orders.fields[fieldName];
-  if (field === undefined) {
-    throw new Error(
-      `workspaceSharing(${policy.orders.id}): unknown order field '${fieldName}'`
-    );
-  }
-  const value =
-    `(order.${member(fieldName)} ?? (throw StateError(` +
-    `'Incomplete ${policy.orders.id} ${member(fieldName)}')))`;
-  if (target === "wire" && field.kind === "enum") return `${value}.wire`;
-  if (field.kind === "ref") return `NmsInternalNomosRefs.id(${value})`;
-  return value;
-}
-
-function sharingReceiptCondition(
-  policy: WorkspaceSharingPolicy,
-  receipt: WorkspaceSharingReceipt
-): string {
-  const condition = receipt.when;
-  if (condition === undefined) return "true";
-  const field = policy.orders.fields[condition.field];
-  if (field === undefined) {
-    throw new Error(
-      `workspaceSharing(${policy.orders.id}): unknown receipt field '${condition.field}'`
-    );
-  }
-  if (!field.isOptional) {
-    if (condition.is === "absent") {
-      throw new Error(
-        `workspaceSharing(${policy.orders.id}): '${condition.field}' cannot be absent because it is required`
-      );
-    }
-    return "true";
-  }
-  return `order.${member(condition.field)} ${
-    condition.is === "present" ? "!=" : "=="
-  } null`;
-}
-
-function sharingReceiptPayload(
-  policy: WorkspaceSharingPolicy,
-  receipt: WorkspaceSharingReceipt,
-  refused: boolean,
-  enumDartTypes: ReadonlyMap<string, string>
-): string[] {
-  const fields = introspectPayload(
-    receipt.records.payloadSchema as z.ZodTypeAny,
-    new Map(enumDartTypes)
-  );
-  return fields.flatMap((target) => {
-    if (target.name === "failureReason") {
-      return refused
-        ? [
-            `            failureReason: share.message ?? 'shareDeliveryRefused',`,
-          ]
-        : target.optional
-        ? [`            ${member(target.name)}: null,`]
-        : (() => {
-            throw new Error(
-              `workspaceSharing(${policy.orders.id}): delivered receipt '${receipt.records.id}' requires failureReason`
-            );
-          })();
-    }
-    if (target.name === "deliveryHead" && target.optional) {
-      return [`            ${member(target.name)}: null,`];
-    }
-    const sourceName = receipt.payload?.[target.name] ?? target.name;
-    const source = policy.orders.fields[sourceName];
-    if (source === undefined) {
-      if (target.optional) return [`            ${member(target.name)}: null,`];
-      throw new Error(
-        `workspaceSharing(${policy.orders.id}): receipt '${receipt.records.id}' requires '${target.name}', ` +
-          `but the durable order does not record '${sourceName}'`
-      );
-    }
-    const raw = sharingOrderValue(policy, sourceName);
-    const expression =
-      source.kind === "enum" ? `${target.dartType}.fromWire(${raw}.wire)` : raw;
-    return [`            ${member(target.name)}: ${expression},`];
-  });
-}
-
 export const dartApplicationClassName = (domain: string): string =>
   `${cap(camel(domain))}Application`;
 export const dartApplicationActivityClassName = (domain: string): string =>
@@ -347,7 +257,10 @@ function dartConflictPublicClassNames(mod: DomainModule): string[] {
 
 export function dartApplicationPublicClassNames(
   mod: DomainModule,
-  opts: { readonly tenantRoot?: boolean } = {}
+  opts: {
+    readonly tenantRoot?: boolean;
+    readonly callUsda: DartApplicationOptions["callUsda"];
+  }
 ): string[] {
   registerDartNames(mod.aggregates);
   const actions = (
@@ -361,6 +274,7 @@ export function dartApplicationPublicClassNames(
       (directive as { businessBirth?: unknown }).businessBirth === undefined &&
       (directive as { birthsChild?: unknown }).birthsChild !== true &&
       !isFrameworkDirective(directive) &&
+      publishingIntentOf(opts.callUsda.graph, mod.domain ?? mod.name, directive.id) === undefined &&
       dartActionOutputs(directive, mod.aggregates).length > 0
   );
   return [
@@ -373,6 +287,10 @@ export function dartApplicationPublicClassNames(
             : []),
         ]
       : []),
+    ...((mod.workspaceInvariants ?? []).some(rule => rule.refusal) ? [
+      "AdmissionDecision", "Admitted", "DomainRefused", "FrameworkRefused", "UnsupportedRefusalContract",
+      "NomosDomainRefusalEvidence", "KernelRefusalCode",
+    ] : []),
     dartApplicationClassName(mod.domain ?? mod.name),
     dartApplicationActivityClassName(mod.domain ?? mod.name),
     ...actions.map((directive) => dartActionResultClassName(directive.id)),
@@ -401,6 +319,14 @@ export interface DartApplicationOptions {
   readonly tenantRoot?: boolean;
   /** Relative compiler-generated framework-call implementation for this exact application closure. */
   readonly applicationFrameworkCallsImportUri?: string;
+  /** Generated typed RelationTuple read; no independent bookmark index. */
+  readonly workspaceAccessReadImportUri?: string;
+  /** Canonical typed-law graph and its rendered USDA paths: the authority for which directives are
+   * business actions (a directive offered only THROUGH another intent is never a second action). */
+  readonly callUsda: {
+    readonly graph: LawGraph;
+    readonly paths: ReadonlyMap<string, string>;
+  };
 }
 
 /**
@@ -412,7 +338,7 @@ export interface DartApplicationOptions {
  */
 export function generateDartApplication(
   mod: DomainModule,
-  opts: DartApplicationOptions = {}
+  opts: DartApplicationOptions
 ): string {
   registerDartNames(mod.aggregates);
   const domain = mod.domain ?? mod.name;
@@ -431,6 +357,44 @@ export function generateDartApplication(
   );
   const packageDomains = opts.packageAggregateDomains ?? {};
   const appLines: string[] = [];
+  const foreignContractResolvers: string[] = [];
+  // A locator never owns another domain's private nominal decoder. The target
+  // application reads its declared implementing aggregate and projects only
+  // the public contract fields, after the ordinary authenticated read.
+  for (const contract of mod.contracts ?? []) {
+    const implementations = mod.aggregates.filter(aggregate => aggregate.implementsContracts?.includes(contract.id));
+    if (implementations.length === 0) continue;
+    const type = contractTypeName(contract.id);
+    foreignContractResolvers.push(
+      `Future<${type}?> nomosInternalResolve${application}${type}(`,
+      `    ${application} application, ForeignRef<${type}> reference) async {`,
+      `  _nmsRequireReference(reference.ref, ${JSON.stringify(contract.id)}, application._client.session.workspace);`,
+      `  final matches = <${type}>[];`,
+    );
+    for (const aggregate of implementations) {
+      foreignContractResolvers.push(
+        `  for (final row in await application._client.${member(`${concreteClassName(aggregate.id)}ById`)}(reference.id)) {`,
+        `    matches.add(${type}(`,
+        `      id: row.ref.id,`,
+        ...Object.keys(contract.fields).map((name) => {
+          const access = `row.${member(name)}`;
+          const source = aggregate.fields[name]!;
+          const value = source.kind === "enum" ? `${access}?.wire`
+            : source.kind === "ref" ? `${access}?.id`
+            : source.kind === "string" && (isSha256DigestSchema(source.zod) || isGitObjectIdSchema(source.zod)) ? `${access}?.value`
+            : access;
+          return `      ${member(name)}: ${value},`;
+        }),
+        `    ));`,
+        `  }`,
+      );
+    }
+    foreignContractResolvers.push(
+      `  if (matches.length > 1) throw StateError('Multiple nominal records implement ${type} at this address');`,
+      `  return matches.isEmpty ? null : matches.single;`,
+      `}`, ``,
+    );
+  }
   const applicationMembers = new Map<string, string>();
   const claimApplicationMember = (name: string, owner: string): void => {
     const prior = applicationMembers.get(name);
@@ -443,7 +407,6 @@ export function generateDartApplication(
     applicationMembers.set(name, owner);
   };
   claimApplicationMember("activity", "the generated business history");
-  claimApplicationMember("model", "the generated model lifecycle");
   const collectionLines = new Map<string, string[]>();
   const collectionMembers = new Map<string, Set<string>>();
   const siblingImports = new Map<string, Set<string>>();
@@ -459,6 +422,7 @@ export function generateDartApplication(
     mod.surfacedResolvers ?? [];
   const sharingPolicies: readonly WorkspaceSharingPolicy[] =
     mod.applicationWorkspaceSharing ?? [];
+  const hasWorkspaceAccessRead = opts.workspaceAccessReadImportUri !== undefined;
   const hasVersionedRefs = mod.aggregates.some((aggregate) =>
     Object.values(aggregate.fields as Record<string, Field>).some(
       (field) => field.versionedForeignRef !== undefined
@@ -600,23 +564,9 @@ export function generateDartApplication(
         "object" &&
       (directive as { businessBirthInternal?: unknown })
         .businessBirthInternal !== true &&
-      !isFrameworkDirective(directive)
+      !isFrameworkDirective(directive) &&
+      publishingIntentOf(opts.callUsda.graph, domain, directive.id) === undefined
   );
-  const childAuthenticationRecoveryByAggregate = new Map<
-    string,
-    AnyDirective
-  >();
-  for (const directive of directives) {
-    if (!isBusinessIntent(directive)) continue;
-    const aggregateId = childAuthenticationRecoveryAggregateId(directive);
-    if (aggregateId === undefined) continue;
-    if (childAuthenticationRecoveryByAggregate.has(aggregateId)) {
-      throw new Error(
-        `generated application '${domain}' has more than one child authentication recovery action for '${aggregateId}'`
-      );
-    }
-    childAuthenticationRecoveryByAggregate.set(aggregateId, directive);
-  }
   const actionReferenceChecks = (directive: AnyDirective): string[] => {
     let specs: ReturnType<typeof introspectPayload>;
     try {
@@ -644,7 +594,7 @@ export function generateDartApplication(
         : [
             `    _nmsRequireReference(target, ${JSON.stringify(
               targetBinding.aggregateId
-            )}, _client.session?.workspace ?? '');`,
+            )}, _client.session.workspace);`,
           ];
     return [
       ...targetChecks,
@@ -667,7 +617,7 @@ export function generateDartApplication(
           const expectedWorkspace =
             spec.shape === "addressRef" || foreignReferenceIds.has(spec.name)
               ? "''"
-              : "_client.session?.workspace ?? ''";
+              : "_client.session.workspace";
           const value = `facts.${member(spec.name)}`;
           const check = `_nmsRequireReference(${value}, ${JSON.stringify(
             targetWire
@@ -842,17 +792,21 @@ export function generateDartApplication(
         }' needs exactly keys ${satisfactionQuery.key.join(", ")}`
       );
     }
-    // A declared satisfaction query means trust is already a typed law fact.
-    // The kernel's foreign-read policy evaluates that fact while admitting the
-    // business offer. Do not create a second, client-side read-then-auto-grant
-    // authority ceremony.
-    if (satisfactionQuery !== undefined) {
-      return { prelude: [], call };
-    }
-    const trustIndent = "    ";
+    // The declaration names how to observe enrollment; it does not prove a
+    // row exists. Seat a missing source through the declared, gated law action.
+    // Existing rows are left for the kernel to judge, including a revoked or
+    // mismatched identity: this preflight must not silently replace them.
+    const satisfactionPrelude = satisfactionQuery === undefined ? [] : [
+      `    final sourceTrustAlreadySatisfied = (await _client.${member(satisfactionQuery.id)}(${satisfactionQuery.key
+        .map(key => `${member(key)}: ${factValue(satisfactionArgs[key]!)}`)
+        .join(", ")})).isNotEmpty;`,
+      "    if (!sourceTrustAlreadySatisfied) {",
+    ];
+    const trustIndent = satisfactionQuery === undefined ? "    " : "      ";
     return {
       prelude: [
-        `${trustIndent}final sourceGenesis = await _client.bridge.nomosWorkspaceGenesis(${factValue(
+        ...satisfactionPrelude,
+        `${trustIndent}final sourceGenesis = await _client.session.nomosWorkspaceGenesis(${factValue(
           trust.fromPayload
         )});`,
         `${trustIndent}await _client.${dartInternalSourceTrustMethod(
@@ -868,6 +822,7 @@ export function generateDartApplication(
           trust.keyHashesField
         )}: const <${keyElementType}>[],`,
         `${trustIndent}  ));`,
+        ...(satisfactionQuery === undefined ? [] : ["    }"]),
       ],
       call,
     };
@@ -880,167 +835,47 @@ export function generateDartApplication(
       `  /// A uid crosses the string boundary once. Generated invitation actions then require`,
       `  /// [Recipient<User>], so an email address, principal or record id cannot be substituted.`,
       `  Recipient<User> recipient(String uid) =>`,
-      `      NmsInternalApplicationHost.recipient<User>(uid);`,
+      `      _nmsReception.recipient<User>(uid);`,
       ``,
       `  /// Create a single-use invitation. Transport [Invitation.link] however your product chooses.`,
       `  Future<Invitation<User>> createInvitation() =>`,
-      `      NmsInternalApplicationHost.createInvitation<User>(_client.bridge);`,
+      `      _nmsReception.createInvitation<User>();`,
       ``,
-      `  /// Redeem a transported invitation link as the verified [currentUser].`,
-      `  Future<void> redeemInvitation(String link) =>`,
-      `      NmsInternalApplicationHost.redeemInvitation<User>(`,
-      `        _client.bridge,`,
-      `        frameworkCalls: nomosInternalApplicationFrameworkCalls,`,
-      `        link: link,`,
-      `        identity: _client.actor,`,
-      `        policies: [`,
+      // ONE construction site for this domain's policies. The pending lookup runs on the domain
+      // CLIENT — the framework-internal sharing query is deliberately absent from the application
+      // surface — so a multi-domain package application cannot rebuild these from outside; it
+      // composes THESE instead (compile_package_main's generatedPackageApplication).
+      `  /// Framework-internal: the invitation policies declared by this domain.`,
+      `  List<NmsReceptionInvitationPolicy> get nomosInternalInvitationPolicies => [`,
       ...sharingPolicies
         .map((policy) => [
-          `          NmsInternalInvitationPolicy(`,
+          `          NmsReceptionInvitationPolicy(`,
           `            domain: ${JSON.stringify(domain)},`,
           `            domainHash: _client.domainHash,`,
-          `            query: ${JSON.stringify(
-            policy.invitationLaw.pendingByRecipient.id
-          )},`,
           `            redeem: ${JSON.stringify(
             policy.invitationLaw.redeem.id
           )},`,
-          `            personField: ${JSON.stringify(policy.person)},`,
-          `            roleField: ${JSON.stringify(policy.role)},`,
-          `            scopeField: ${JSON.stringify(policy.scope)},`,
+          `            pending: (address) async => (await _client.${member(
+            policy.invitationLaw.pendingByRecipient.id
+          )}(${member(
+            policy.person
+          )}: address)).map((row) => NmsReceptionInvitationMatch(`,
+          `              orderId: row.ref.id,`,
+          `              object: row.${member(policy.scope)}.toString(),`,
+          `              relation: row.${member(policy.role)}.toString(),`,
+          `            )).toList(growable: false),`,
           `          ),`,
         ])
         .flat(),
-      `        ],`,
-      `      );`,
-      ``
-    );
-    for (const [index, policy] of sharingPolicies.entries()) {
-      const pendingKey = policy.pending.key[0]!;
-      const pendingMethod = member(policy.pending.id);
-      const pendingAggregate = aggregates.get(policy.pending.returns);
-      const pendingField = pendingAggregate?.fields[pendingKey] as
-        | Field
-        | undefined;
-      const pendingValue =
-        pendingField?.kind === "enum"
-          ? `${keyType(
-              pendingAggregate,
-              pendingKey,
-              enumDartTypes
-            )}.fromWire(${JSON.stringify(policy.pendingValue)})`
-          : JSON.stringify(policy.pendingValue);
-      const person = sharingOrderValue(policy, policy.person, "wire");
-      const role = sharingOrderValue(policy, policy.role, "wire");
-      const scope = sharingOrderValue(policy, policy.scope, "wire");
-      const receiptLines = (
-        receipt: WorkspaceSharingReceipt,
-        refused: boolean
-      ): string[] => {
-        const condition = sharingReceiptCondition(policy, receipt);
-        const body = [
-          `        await _client.${dartInternalWorkspaceSharingReceiptMethod(
-            receipt.records.id
-          )}((`,
-          ...sharingReceiptPayload(policy, receipt, refused, enumDartTypes),
-          `        ));`,
-          `        continue;`,
-        ];
-        // A receipt with no `when` is the policy's exhaustive fallback. Emitting `if (true)` makes both
-        // the following fallback error and any later receipt dead Dart code, turning generated code into an
-        // analyzer warning. Keep the same semantics but emit the exhaustive body directly.
-        return condition === "true"
-          ? body
-          : [`      if (${condition}) {`, ...body, `      }`];
-      };
-      const delivered = policy.delivered.flatMap((receipt) =>
-        receiptLines(receipt, false)
-      );
-      const refused = policy.refused.flatMap((receipt) =>
-        receiptLines(receipt, true)
-      );
-      const deliveredExhaustive = policy.delivered.some(
-        (receipt) => sharingReceiptCondition(policy, receipt) === "true"
-      );
-      const refusedExhaustive = policy.refused.some(
-        (receipt) => sharingReceiptCondition(policy, receipt) === "true"
-      );
-      appLines.push(
-        `  Future<void>? _nmsWorkspaceSharingDrain${index};`,
-        `  StreamSubscription<Object?>? _nmsWorkspaceSharingSync${index};`,
-        `  bool _nmsWorkspaceSharingNeedsRetry${index} = false;`,
-        ``,
-        `  Future<void> _nmsStartWorkspaceSharing${index}() async {`,
-        `    await _nmsDrainWorkspaceSharing${index}();`,
-        `    _nmsWorkspaceSharingSync${index} ??= _client.bridge.syncStatus.map<Object?>((status) {`,
-        `      if (_nmsWorkspaceSharingDrain${index} == null &&`,
-        `          (status.phase == SyncPhase.offline || status.phase == SyncPhase.error || status.behind > 0)) {`,
-        `        _nmsWorkspaceSharingNeedsRetry${index} = true;`,
-        `      } else if (status.phase == SyncPhase.idle && _nmsWorkspaceSharingNeedsRetry${index}) {`,
-        `        _nmsWorkspaceSharingNeedsRetry${index} = false;`,
-        `        unawaited(_nmsDrainWorkspaceSharing${index}());`,
-        `      }`,
-        `      return status;`,
-        `    }).listen((_) {});`,
-        `  }`,
-        ``,
-        `  Future<void> _nmsDrainWorkspaceSharing${index}() {`,
-        `    final active = _nmsWorkspaceSharingDrain${index};`,
-        `    if (active != null) return active;`,
-        `    final started = _nmsDrainWorkspaceSharingOnce${index}();`,
-        `    _nmsWorkspaceSharingDrain${index} = started;`,
-        `    return started.whenComplete(() {`,
-        `      if (identical(_nmsWorkspaceSharingDrain${index}, started)) {`,
-        `        _nmsWorkspaceSharingDrain${index} = null;`,
-        `      }`,
-        `    });`,
-        `  }`,
-        ``,
-        `  Future<void> _nmsDrainWorkspaceSharingOnce${index}() async {`,
-        `    final orders = await _client.${pendingMethod}(`,
-        `      ${member(pendingKey)}: ${pendingValue},`,
-        `    );`,
-        `    for (final order in orders) {`,
-        `      late final ApplicationShareResult share;`,
-        `      try {`,
-        `        share = await NmsInternalApplicationHost.shareWith(`,
-        `          _client.bridge, person: ${person}, role: ${role}, scope: ${scope}, identity: _client.actor,`,
-        `        );`,
-        `      } catch (_) {`,
-        `        continue;`,
-        `      }`,
-        `      if (share.awaitingRecipient) continue;`,
-        `      if (share.delivered) {`,
-        ...delivered,
-        ...(deliveredExhaustive
-          ? []
-          : [
-              `        throw StateError('No delivered receipt matches ${policy.orders.id} \${NmsInternalNomosRefs.id(order.ref)}');`,
-            ]),
-        `      }`,
-        ...refused,
-        ...(refusedExhaustive
-          ? []
-          : [
-              `      throw StateError('No refused receipt matches ${policy.orders.id} \${NmsInternalNomosRefs.id(order.ref)}');`,
-            ]),
-        `    }`,
-        `  }`,
-        ``
-      );
-    }
-    appLines.push(
-      `  Future<void> _nmsStartWorkspaceSharing() async {`,
-      ...sharingPolicies.map(
-        (_policy, index) => `    await _nmsStartWorkspaceSharing${index}();`
-      ),
-      `  }`,
+      `      ];`,
       ``,
-      `  Future<void> _nmsDrainWorkspaceSharing() async {`,
-      ...sharingPolicies.map(
-        (_policy, index) => `    await _nmsDrainWorkspaceSharing${index}();`
-      ),
-      `  }`,
+      `  /// Redeem a transported invitation link as the verified [currentUser].`,
+      `  Future<void> redeemInvitation(String link) =>`,
+      `      _nmsReception.redeemInvitation<User>(`,
+      `        frameworkCalls: nomosInternalApplicationFrameworkCalls,`,
+      `        link: link,`,
+      `        policies: nomosInternalInvitationPolicies,`,
+      `      );`,
       ``
     );
   }
@@ -1050,13 +885,10 @@ export function generateDartApplication(
       policy.initiatedBy.map((intent) => intent.id)
     )
   );
-  const afterBusinessWrite = (directive: AnyDirective): string[] =>
-    sharingInitiatorIds.has(directive.id)
-      ? [`    await _nmsDrainWorkspaceSharing();`]
-      : [];
+  const afterBusinessWrite = (_directive: AnyDirective): string[] => [];
   const businessActionDoc = (directive: AnyDirective): string => {
     return sharingInitiatorIds.has(directive.id)
-      ? "One business action. Nomos durably delivers its access change and retries after restart or reconnect; do not mirror delivery in application state."
+      ? "One business action. Peer Office durably delivers its correspondence in the background; do not mirror delivery in application state."
       : "One business action; every consequence commits atomically.";
   };
 
@@ -1096,8 +928,6 @@ export function generateDartApplication(
             : concreteClassName(rootAggregate.id)
         )
       );
-      const childAuthenticationRecovery =
-        childAuthenticationRecoveryByAggregate.get(birth.aggregateId);
       if (targetFile !== mod.name) {
         addSibling(`${targetFile}.application.dart`, targetApplication);
         addSibling(`${targetFile}.application.dart`, opener);
@@ -1118,7 +948,7 @@ export function generateDartApplication(
           `    final reference = await _client.${method}(facts);`,
           opts.supportImport === "package"
             ? `    return ${rootCollection}._nmsOpenReference(reference);`
-            : `    return ${opener}(_client.bridge, reference, _client.actor);`,
+            : `    return ${opener}(_nmsReception, reference);`,
           `  }`,
           ``
         );
@@ -1131,7 +961,7 @@ export function generateDartApplication(
           `    final reference = await _client.birth(facts);`,
           opts.supportImport === "package"
             ? `    return _nmsOpenReference(reference);`
-            : `    return ${opener}(_client.bridge, reference, _client.actor);`,
+            : `    return ${opener}(_nmsReception, reference);`,
           `  }`,
           ``,
         ]);
@@ -1143,44 +973,12 @@ export function generateDartApplication(
             ? `${concreteClassName(birth.aggregateId)}ReadModel`
             : readModelClassName(rootAggregate.id);
         addCollectionMember(birth.aggregateId, "open", [
-          `  final Map<String, Future<${targetApplication}>> _nmsApplications = {};`,
-          ``,
-          `  Future<${targetApplication}> _nmsOpenReference(NomosRef<${rootType}> reference) {`,
-          `    final workspace = NmsInternalNomosRefs.workspace(reference);`,
-          `    final existing = _nmsApplications[workspace];`,
-          `    if (existing != null) {`,
-          `      return NmsInternalApplicationHost.nmsInternalAwaitReferencedApplication(`,
-          `        workspace: workspace, opening: existing,`,
-          `      );`,
-          `    }`,
-          `    late final Future<${targetApplication}> opened;`,
-          `    opened = (() async {`,
-          `      try {`,
-          `        return await ${opener}(`,
-          `          _client.bridge, reference, _client.actor,`,
-          ...(childAuthenticationRecovery === undefined
-            ? []
-            : [
-                `          recoverAuthentication: () => _client.${dartInternalChildAuthenticationRecoveryMethod(
-                  birth.aggregateId
-                )}(workspace),`,
-              ]),
-          `        );`,
-          `      } catch (_) {`,
-          `        if (identical(_nmsApplications[workspace], opened)) {`,
-          `          _nmsApplications.remove(workspace);`,
-          `        }`,
-          `        rethrow;`,
-          `      }`,
-          `    })();`,
-          `    _nmsApplications[workspace] = opened;`,
-          `    return NmsInternalApplicationHost.nmsInternalAwaitReferencedApplication(`,
-          `      workspace: workspace, opening: opened,`,
-          `    );`,
-          `  }`,
+          `  Future<${targetApplication}> _nmsOpenReference(NomosRef<${rootType}> reference) =>`,
+          `      ${opener}(_nmsReception, reference);`,
           ``,
           `  /// Open the workspace named by a typed ${rootType} custody reference.`,
-          `  /// The reference supplies identity and routing only; normal authority checks still apply.`,
+          `  /// The reference supplies stable identity only; the peer runtime resolves placement,`,
+          `  /// and normal authority checks still apply.`,
           `  Future<${targetApplication}> openReference(NomosRef<${rootType}> reference) {`,
           `    _nmsRequireReference(reference, ${JSON.stringify(
             birth.aggregateId
@@ -1188,32 +986,45 @@ export function generateDartApplication(
           `    return _nmsOpenReference(reference);`,
           `  }`,
           ``,
+          `  /// Follow the workspace named by a typed ${rootType} reference without opening`,
+          `  /// or reading it. The peer fetches and prepares its local copy in the background.`,
+          `  Future<void> fetchReference(NomosRef<${rootType}> reference) {`,
+          `    _nmsRequireReference(reference, ${JSON.stringify(birth.aggregateId)}, '');`,
+          `    return _nmsReception.fetchWorkspace(reference.workspace);`,
+          `  }`,
+          ``,
           `  /// Open the ${birth.aggregateId} whose ${birth.keyField} is [key].`,
-          `  Future<${targetApplication}> open(String key) => _nmsOpenReference(`,
+          `  /// THE OFFICE NAMES THE WORKSPACE this key addresses: the derivation is law,`,
+          `  /// and a generated copy of it would silently address a different workspace`,
+          `  /// the moment either side moved.`,
+          `  Future<${targetApplication}> open(String key) async => _nmsOpenReference(`,
           `    NmsInternalNomosRefs.create<${rootType}>(`,
-          `      workspace: deriveWorkspaceName(${JSON.stringify(
-            birth.namespace
-          )}, key),`,
+          `      workspace: await _nmsReception.keyedBirthWorkspace(`,
+          `        namespace: ${JSON.stringify(birth.namespace)}, key: key,`,
+          `      ),`,
           `      type: ${JSON.stringify(birth.aggregateId)},`,
           `      id: ${JSON.stringify(birth.rootId)},`,
           `    ),`,
           `  );`,
           ``,
-          `  /// Current kernel-owned progress while [open] prepares this workspace.`,
-          `  ApplicationWorkspaceOpenProgress? openProgress(String key) =>`,
-          `      NomosApplicationObservability.workspaceOpenProgress(`,
-          `        deriveWorkspaceName(${JSON.stringify(
-            birth.namespace
-          )}, key),`,
-          `      );`,
+          `  /// Fetch the ${birth.aggregateId} whose ${birth.keyField} is [key] onto this device now,`,
+          `  /// opening and reading nothing: its placement's follow mounts the provider's head in`,
+          `  /// the background. Completes once that follow exists (e.g. prefetching every workspace`,
+          `  /// a list names, all at once, so each is local before it is tapped).`,
+          `  Future<void> fetch(String key) async => _nmsReception.fetchWorkspace(`,
+          `    await _nmsReception.keyedBirthWorkspace(`,
+          `      namespace: ${JSON.stringify(birth.namespace)}, key: key,`,
+          `    ),`,
+          `  );`,
           ``,
           `  /// Kernel-owned progress updates while [open] prepares this workspace.`,
+          `  /// ONE LANE: the stream is the whole surface. A synchronous snapshot`,
+          `  /// would have to answer before the office has named the workspace, so`,
+          `  /// it could only ever answer null or hold a cached name of its own.`,
           `  Stream<ApplicationWorkspaceOpenProgress> watchOpenProgress(String key) =>`,
-          `      NomosApplicationObservability.watchWorkspaceOpenProgress(`,
-          `        deriveWorkspaceName(${JSON.stringify(
-            birth.namespace
-          )}, key),`,
-          `      );`,
+          `      Stream<String>.fromFuture(_nmsReception.keyedBirthWorkspace(`,
+          `        namespace: ${JSON.stringify(birth.namespace)}, key: key,`,
+          `      )).asyncExpand(_nmsReception.streams.workspaceOpenProgress);`,
           ``,
         ]);
         addCollectionMember(birth.aggregateId, "mine", [
@@ -1224,18 +1035,11 @@ export function generateDartApplication(
           `    if (principal == null || principal.trim().isEmpty) {`,
           `      throw StateError('The signed-in person is not available.');`,
           `    }`,
-          `    final births = await _client.bridge.query(`,
-          `      'birthRecordsByPrincipal',`,
-          `      {'principal': principal},`,
-          `    );`,
+          `    final births = await _nmsReception.activeChildWorkspaces(namespace: ${JSON.stringify(
+            birth.namespace
+          )});`,
           `    final records = <${rootModel}>[];`,
-          `    for (final row in births) {`,
-          `      final raw = row['data'];`,
-          `      if (raw is! Map) continue;`,
-          `      final child = (raw['child'] ?? '').toString();`,
-          `      if (!child.startsWith(${JSON.stringify(
-            `${birth.namespace}-`
-          )})) continue;`,
+          `    for (final child in births) {`,
           `      final reference = NmsInternalNomosRefs.create<${rootType}>(workspace: child, type: ${JSON.stringify(
             birth.aggregateId
           )}, id: ${JSON.stringify(birth.rootId)});`,
@@ -1252,9 +1056,10 @@ export function generateDartApplication(
           `    if (principal == null || principal.trim().isEmpty) {`,
           `      throw StateError('The signed-in person is not available.');`,
           `    }`,
-          `    return _client.bridge`,
-          `        .watch('birthRecordsByPrincipal', {'principal': principal})`,
-          `        .asyncMap((_) => mine());`,
+          `    return _nmsReception.streams.refreshOn(`,
+          `      read: mine,`,
+          `      changes: [_nmsReception.streams.childWorkspaces],`,
+          `    );`,
           `  }`,
           ``,
           `  /// Every ${birth.aggregateId} the signed-in person can use, whether founded or shared.`,
@@ -1272,29 +1077,40 @@ export function generateDartApplication(
           `    return records;`,
           `  }`,
           ``,
-          `  /// The ${birth.aggregateId} lives shared with the signed-in person.`,
-          `  /// Unlike [available], this does not open lives founded by that person.`,
-          `  Future<List<${rootModel}>> shared() async {`,
-          `    final records = <${rootModel}>[];`,
-          `    final seen = <String>{};`,
-          `    final shares = await _client.bridge.query('sharedByObject', {'object': 'workspace:self'}, null, _client.actor);`,
-          `    for (final row in shares) {`,
-          `      final raw = row['data'];`,
-          `      if (raw is! Map) continue;`,
-          `      final workspace = (raw['asserterWorkspace'] ?? '').toString();`,
-          `      final object = (raw['object'] ?? '').toString();`,
-          `      final prunedAt = (raw['prunedAt'] ?? '').toString();`,
+          `  /// Home-local Zanzibar discovery. Does not open or contact any shared workspace.`,
+          `  Future<List<({NomosRef<${rootType}> reference, String object, String relation})>> sharedReferences() async {`,
+          ...(!hasWorkspaceAccessRead
+            ? [`    throw StateError('This application has no compiled received-access query');`]
+            : [
+                `    final principal = _client.actor;`,
+                `    if (principal == null || principal.isEmpty) throw StateError('No signed-in principal');`,
+                `    final shares = await nomosInternalReadReceivedAccess(_client.session, principal);`,
+                `    final references = <({NomosRef<${rootType}> reference, String object, String relation})>[];`,
+                `    for (final share in shares) {`,
+                `      final workspace = share.workspace;`,
           `      if (!workspace.startsWith(${JSON.stringify(
             `${birth.namespace}-`
-          )}) ||`,
-          `          object != 'workspace:self' ||`,
-          `          prunedAt.isNotEmpty ||`,
-          `          !seen.add(workspace)) continue;`,
+          )})) continue;`,
           `      final reference = NmsInternalNomosRefs.create<${rootType}>(workspace: workspace, type: ${JSON.stringify(
             birth.aggregateId
           )}, id: ${JSON.stringify(birth.rootId)});`,
-          `      final application = await _nmsOpenReference(reference);`,
-          `      final record = await application.${rootCollection}.find(reference);`,
+                `      references.add((reference: reference, object: share.object, relation: share.relation));`,
+                `    }`,
+                `    return references;`,
+              ]),
+          `  }`,
+          ``,
+          `  Stream<List<({NomosRef<${rootType}> reference, String object, String relation})>> watchSharedReferences() =>`,
+          `      _nmsReception.streams.refreshOn(read: sharedReferences, changes: [_nmsReception.streams.workspaceChanges]);`,
+          ``,
+          `  /// Explicitly resolve shared references to full business records. Lists should use [sharedReferences].`,
+          `  Future<List<${rootModel}>> shared() async {`,
+          `    final records = <${rootModel}>[];`,
+          `    final seen = <String>{};`,
+          `    for (final share in await sharedReferences()) {`,
+          `      if (!seen.add(NmsInternalNomosRefs.workspace(share.reference))) continue;`,
+          `      final application = await _nmsOpenReference(share.reference);`,
+          `      final record = await application.${rootCollection}.find(share.reference);`,
           `      if (record != null) records.add(record);`,
           `    }`,
           `    return records;`,
@@ -1302,46 +1118,17 @@ export function generateDartApplication(
           ``,
           `  /// React when this person's shared ${birth.aggregateId} lives change.`,
           `  Stream<List<${rootModel}>> watchShared() =>`,
-          `      _client.bridge`,
-          `          .watch('sharedByObject', {'object': 'workspace:self'}, null, _client.actor, 60000)`,
-          `          .asyncMap((_) => shared());`,
+          `      _nmsReception.streams.workspaceChanges.asyncMap((_) => shared());`,
           ``,
           `  /// React when this person's available ${birth.aggregateId} lives change.`,
           `  Stream<List<${rootModel}>> watchAvailable() =>`,
-          `      Stream<List<${rootModel}>>.multi((events) {`,
-          `        var reading = false;`,
-          `        var reread = false;`,
-          `        Future<void> refresh() async {`,
-          `          if (reading) {`,
-          `            reread = true;`,
-          `            return;`,
-          `          }`,
-          `          reading = true;`,
-          `          do {`,
-          `            reread = false;`,
-          `            try {`,
-          `              final records = await available();`,
-          `              if (!events.isClosed) events.add(records);`,
-          `            } catch (error, stackTrace) {`,
-          `              if (!events.isClosed) events.addError(error, stackTrace);`,
-          `            }`,
-          `          } while (reread && !events.isClosed);`,
-          `          reading = false;`,
-          `        }`,
-          `        final birthChanges = _client.bridge`,
-          `            .watch('birthRecordsByPrincipal', {'principal': _client.actor}, null, null, 60000)`,
-          `            .skip(1)`,
-          `            .listen((_) { refresh(); }, onError: events.addError);`,
-          `        final shareChanges = _client.bridge`,
-          `            .watch('sharedByObject', {'object': 'workspace:self'}, null, _client.actor, 60000)`,
-          `            .skip(1)`,
-          `            .listen((_) { refresh(); }, onError: events.addError);`,
-          `        events.onCancel = () async {`,
-          `          await birthChanges.cancel();`,
-          `          await shareChanges.cancel();`,
-          `        };`,
-          `        refresh();`,
-          `      });`,
+          `      _nmsReception.streams.refreshOn(`,
+          `        read: available,`,
+          `        changes: [`,
+          `          _nmsReception.streams.childWorkspaces,`,
+          `          _nmsReception.streams.workspaceChanges.skip(1),`,
+          `        ],`,
+          `      );`,
           ``,
           `  /// Continue working in the business application that produced [record].`,
           `  Future<${targetApplication}> applicationOf(${rootModel} record) {`,
@@ -1453,6 +1240,20 @@ export function generateDartApplication(
                   }>(change, ${JSON.stringify(output.aggregateId)})`
             )
             .join(", ")})`;
+    const contracts = refusalContracts(mod, directive.id);
+    if (contracts.length > 0) {
+      const decisionMethod = `decide${cap(camel(directive.id))}`;
+      const returnType = resultExpression === undefined ? "NomosOperationReceipt" : resultClass;
+      const args = emptyPayload ? "" : directive.targetBinding === undefined ? "facts" : targetOnly ? "target" : "target, facts";
+      const lines = [
+        `  /// Exhaustive admission decision; operational failures keep their runtime meaning.`,
+        `  Future<AdmissionDecision<${returnType}, ${refusalType(directive.id, contracts)}>> ${decisionMethod}(${targetParameter}) =>`,
+        `      nmsAdmissionDecision(() => ${method}(${args}), ${refusalDecoder(directive.id)});`,
+        ``,
+      ];
+      if (isBusinessIntent(directive)) { claimApplicationMember(decisionMethod, `admission decision '${directive.id}'`); appLines.push(...lines); }
+      else addCollectionMember(directive.aggregateId, decisionMethod, lines);
+    }
     if (isBusinessIntent(directive)) {
       claimApplicationMember(method, `business intent '${directive.id}'`);
       const sourceTrust = sourceTrustAction(directive);
@@ -1768,9 +1569,8 @@ export function generateDartApplication(
                 `    final id = ${sourceFieldValue};`,
                 `    if (id == null) return null;`,
                 `    final application = await ${opener}(`,
-                `      _client.bridge,`,
+                `      _nmsReception,`,
                 `      id,`,
-                `      _client.actor,`,
                 `    );`,
                 `    return application.${targetCollection}.find(`,
                 `      id,`,
@@ -1779,9 +1579,8 @@ export function generateDartApplication(
             : [
                 `    final id = ${sourceFieldValue};`,
                 `    final application = await ${opener}(`,
-                `      _client.bridge,`,
+                `      _nmsReception,`,
                 `      id,`,
-                `      _client.actor,`,
                 `    );`,
                 `    return application.${targetCollection}.find(`,
                 `      id,`,
@@ -1799,17 +1598,15 @@ export function generateDartApplication(
                 `    final id = ${sourceFieldValue};`,
                 `    if (id == null) return Future<${targetApplication}?>.value(null);`,
                 `    return ${opener}(`,
-                `      _client.bridge,`,
+                `      _nmsReception,`,
                 `      id,`,
-                `      _client.actor,`,
                 `    );`,
               ]
             : [
                 `    final id = record.${sourceFieldMember};`,
                 `    return ${opener}(`,
-                `      _client.bridge,`,
+                `      _nmsReception,`,
                 `      id,`,
-                `      _client.actor,`,
                 `    );`,
               ]),
           `  }`,
@@ -1820,7 +1617,23 @@ export function generateDartApplication(
       const target =
         foreign.targetIsContract === true
           ? contractTypeName(foreign.targetAggregateId)
-          : concreteClassName(foreign.targetAggregateId);
+          : readModelClassName(foreign.targetAggregateId);
+      const targetOwner =
+        packageDomains[foreign.targetAggregateId] ??
+        (aggregates.has(foreign.targetAggregateId) ? { domain, name: mod.name } : undefined) ??
+        (foreign.targetDomain === undefined
+          ? undefined
+          : Object.values(packageDomains).find(
+              (candidate) => candidate.domain === foreign.targetDomain
+            ));
+      const targetApplication = targetOwner === undefined ? undefined : dartApplicationClassName(targetOwner.domain);
+      const opener = targetApplication === undefined ? undefined : `nomosInternalOpen${targetApplication}`;
+      const resolver = targetApplication === undefined ? undefined : `nomosInternalResolve${targetApplication}${target}`;
+      if (targetOwner !== undefined && targetOwner.domain !== domain) {
+        addSibling(`${targetOwner.name}.application.dart`, targetApplication!);
+        addSibling(`${targetOwner.name}.application.dart`, opener!);
+        if (foreign.targetIsContract === true) addSibling(`${targetOwner.name}.application.dart`, resolver!);
+      }
       const fieldMember = member(fieldName);
       const fieldValue = admitsNull(field)
         ? `record.${fieldMember}.valueOrNull`
@@ -1834,7 +1647,14 @@ export function generateDartApplication(
         `  Future<${target}?> ${method}(${sourceModel} record) async {`,
         `    final reference = ${fieldValue};`,
         `    if (reference == null) return null;`,
-        `    final target = await NmsInternalForeignRefs.resolve(reference, _client.bridge.foreignReader());`,
+        ...(targetOwner !== undefined ? [
+          `    final application = await ${opener}(_nmsReception, reference.ref);`,
+          foreign.targetIsContract === true
+            ? `    final target = await ${resolver}(application, reference);`
+            : `    final target = await application.${member(plural(concreteClassName(foreign.targetAggregateId)))}.find(NmsInternalNomosRefs.create<${concreteClassName(foreign.targetAggregateId)}>(workspace: reference.workspace, type: ${JSON.stringify(foreign.targetAggregateId)}, id: reference.id));`,
+        ] : [
+          `    final target = await NmsInternalForeignRefs.resolve(reference, _client.session.foreignReader());`,
+        ]),
         `    if (target == null) return null;`,
         `    return NmsInternalRecordOrigins.remember(target, workspace: NmsInternalNomosRefs.workspace(reference.ref), type: ${JSON.stringify(
           foreign.targetAggregateId
@@ -1842,13 +1662,6 @@ export function generateDartApplication(
         `  }`,
         ``,
       ]);
-      const targetOwner =
-        packageDomains[foreign.targetAggregateId] ??
-        (foreign.targetDomain === undefined
-          ? undefined
-          : Object.values(packageDomains).find(
-              (candidate) => candidate.domain === foreign.targetDomain
-            ));
       if (targetOwner !== undefined && targetOwner.domain !== domain) {
         const targetApplication = dartApplicationClassName(targetOwner.domain);
         const opener = `nomosInternalOpen${targetApplication}`;
@@ -1861,9 +1674,8 @@ export function generateDartApplication(
           `    final reference = ${fieldValue};`,
           `    if (reference == null) return Future<${targetApplication}?>.value(null);`,
           `    return ${opener}(`,
-          `      _client.bridge,`,
+          `      _nmsReception,`,
           `      reference.ref,`,
-          `      _client.actor,`,
           `    );`,
           `  }`,
           ``,
@@ -1872,8 +1684,21 @@ export function generateDartApplication(
     }
   }
 
+  for (const ordered of mod.orderedReads ?? []) {
+    const model = readModelClassName(ordered.of);
+    const result = ordered.limit === 1 ? `${model}?` : `List<${model}>`;
+    const method = member(ordered.id);
+    const watch = `watch${cap(camel(ordered.id))}`;
+    addCollectionMember(ordered.of, method, [
+      `  Future<${result}> ${method}() => _client.${method}();`,
+      `  Stream<${result}> ${watch}() => _client.${watch}();`,
+      ``,
+    ]);
+  }
+
   for (const count of (mod.counts ?? []).map((raw) => finishCount(raw))) {
     const method = member(count.id);
+    const watch = `watch${cap(camel(count.id))}`;
     const groupType =
       count.by == null
         ? ""
@@ -1884,6 +1709,17 @@ export function generateDartApplication(
         : `  Future<int> ${method}(${groupType} ${keyParam(
             count.by
           )}) => _client.${method}(${keyParam(count.by)});`,
+      count.by == null
+        ? `  Stream<int> ${watch}() => _client.${watch}();`
+        : `  Stream<int> ${watch}(${groupType} ${keyParam(count.by)}) => _client.${watch}(${keyParam(count.by)});`,
+    ]);
+  }
+  for (const membership of (mod.exists_ ?? []).map(finishExists)) {
+    const method = member(membership.id);
+    const parameter = membership.by == null ? ""
+      : `${keyType(aggregates.get(membership.of), membership.by, enumDartTypes)} ${keyParam(membership.by)}`;
+    addCollectionMember(membership.of, method, [
+      `  Future<bool> ${method}(${parameter}) => _client.${method}(${membership.by == null ? "" : keyParam(membership.by)});`,
     ]);
   }
   for (const sum of (mod.sums ?? []).map((raw) => finishSum(raw))) {
@@ -1901,6 +1737,15 @@ export function generateDartApplication(
     ]);
   }
 
+  for (const extremum of [...(mod.mins ?? []), ...(mod.maxes ?? [])].map(finishExtremum)) {
+    const method = member(extremum.id);
+    const parameter = extremum.by == null ? ""
+      : `${keyType(aggregates.get(extremum.of), extremum.by, enumDartTypes)} ${keyParam(extremum.by)}`;
+    addCollectionMember(extremum.of, method, [
+      `  Future<int?> ${method}(${parameter}) => _client.${method}(${extremum.by == null ? "" : keyParam(extremum.by)});`,
+    ]);
+  }
+
   for (const aggregate of mod.aggregates) {
     if (
       (aggregate as { businessBirthInternal?: unknown })
@@ -1920,7 +1765,7 @@ export function generateDartApplication(
       `  /// Use this at UI boundaries such as route parameters that intentionally retain only`,
       `  /// the local aggregate id. Use [fromAddress] when the workspace is part of the value.`,
       `  ${aggregateRefType} ref(String id) {`,
-      `    final workspace = _client.session?.workspace ?? '';`,
+      `    final workspace = _client.session.workspace;`,
       `    if (workspace.isEmpty) {`,
       `      throw StateError('Cannot qualify a ${concrete} id before its application workspace is open.');`,
       `    }`,
@@ -1955,10 +1800,10 @@ export function generateDartApplication(
         aggregate.id
       )}, '');`,
       `    final targetWorkspace = NmsInternalNomosRefs.workspace(reference);`,
-      `    final currentWorkspace = _client.session?.workspace ?? '';`,
+      `    final currentWorkspace = _client.session.workspace;`,
       `    if (currentWorkspace.isNotEmpty && targetWorkspace != currentWorkspace) {`,
       `      final application = await nomosInternalOpen${application}(`,
-      `        _client.bridge, reference, _client.actor,`,
+      `        _nmsReception, reference,`,
       `      );`,
       `      return application.${member(plural(concrete))}.find(reference);`,
       `    }`,
@@ -1975,10 +1820,10 @@ export function generateDartApplication(
         aggregate.id
       )}, '');`,
       `    final targetWorkspace = NmsInternalNomosRefs.workspace(reference);`,
-      `    final currentWorkspace = _client.session?.workspace ?? '';`,
+      `    final currentWorkspace = _client.session.workspace;`,
       `    if (currentWorkspace.isNotEmpty && targetWorkspace != currentWorkspace) {`,
       `      return Stream.fromFuture(nomosInternalOpen${application}(`,
-      `        _client.bridge, reference, _client.actor,`,
+      `        _nmsReception, reference,`,
       `      )).asyncExpand(`,
       `        (application) => application.${member(
         plural(concrete)
@@ -2021,7 +1866,7 @@ export function generateDartApplication(
     const property = member(plural(concrete));
     claimApplicationMember(property, `aggregate collection '${aggregateId}'`);
     appLines.push(`  final ${collection} ${property};`);
-    initializers.push(`${property} = ${collection}._(client)`);
+    initializers.push(`${property} = ${collection}._(client, reception)`);
     collections.push(
       `/// The canonical generated surface for ${concrete} records and navigation.`,
       `///`,
@@ -2030,7 +1875,8 @@ export function generateDartApplication(
       `/// a repository or parallel application state.`,
       `final class ${collection} {`,
       `  final ${client} _client;`,
-      `  ${collection}._(this._client);`,
+      `  final NmsReceptionSession _nmsReception;`,
+      `  ${collection}._(this._client, this._nmsReception);`,
       ``,
       ...members,
       `}`,
@@ -2051,6 +1897,7 @@ export function generateDartApplication(
       : "nomos_client.dart";
   const applicationInitializers = [
     "_client = client",
+    "_nmsReception = reception",
     ...(tenantRoot ? ["currentUser = currentUser"] : []),
     `activity = ${activity}._(client)`,
     ...(resolverBindings.length > 0 ? [`conflicts = client.conflicts`] : []),
@@ -2059,48 +1906,34 @@ export function generateDartApplication(
   return [
     `// AUTO-GENERATED by nomos-compile — the tenant application surface for "${domain}".`,
     `// Business facts in, business records out. Runtime lifecycle is deliberately absent.`,
-    ...(sharingPolicies.length > 0
-      ? [`import 'dart:async' show StreamSubscription, unawaited;`]
-      : []),
-    `import '${runtimeImport}' show NmsInternalForeignRefs, NmsInternalNomosRefs, NmsInternalRecordOrigins, NomosBridge, NomosOfferOutcome, NomosOperationReceipt, NomosRef, NomosSession${
-      usesWorkspaceName ? ", deriveWorkspaceName" : ""
-    }${
+    ...((mod.workspaceInvariants ?? []).some(rule => rule.refusal) ? [
+      `export 'package:nomos_types/nomos_types.dart' show AdmissionDecision, Admitted, DomainRefused, FrameworkRefused, UnsupportedRefusalContract, NomosDomainRefusalEvidence, KernelRefusalCode;`,
+    ] : []),
+    ...(opts.workspaceAccessReadImportUri === undefined ? [] : [
+      `import '${opts.workspaceAccessReadImportUri}' show nomosInternalReadReceivedAccess;`,
+    ]),
+    `import '${runtimeImport}' show NmsInternalForeignRefs, NmsInternalNomosRefs, NmsInternalRecordOrigins, NmsUsdaResult, NomosOfferOutcome, NomosOperationReceipt, NomosRef${(mod.workspaceInvariants ?? []).some(rule => rule.refusal) ? ", AdmissionDecision, nmsAdmissionDecision" : ""}${sharingPolicies.length > 0 ? ", Invitation, Recipient, User" : ""}${
+      tenantRoot ? ", NmsInternalUsers" : ""
+    };`,
+    `import 'package:nomos_client/src/reception/reception_session.dart' show NmsReceptionSession${
       sharingPolicies.length > 0
-        ? ", Invitation, Recipient, SyncPhase, User"
+        ? ", NmsReceptionInvitationPolicy, NmsReceptionInvitationMatch"
         : ""
-    }${
-      tenantRoot ? ", NmsInternalUsers, nmsInternalReceivingGroupNameOf" : ""
     };`,
-    ...(opts.flutterHost === true || sharingPolicies.length > 0
+    ...(usesWorkspaceName
+      ? [
+          `import 'package:nomos_client/src/workspace_open_progress.dart' show ApplicationWorkspaceOpenProgress;`,
+        ]
+      : []),
+    ...(opts.flutterHost === true ||
+    sharingPolicies.length > 0 ||
+    usesWorkspaceName
       ? [
-          ...(tenantRoot ? [`import 'package:flutter/widgets.dart';`] : []),
-          ...(sharingPolicies.length > 0
-            ? [
-                `import 'package:nomos_flutter/src/application_share.dart' show ApplicationShareResult;`,
-              ]
-            : []),
           ...(opts.flutterHost === true
             ? [
-                `import 'package:nomos_flutter/src/application_status.dart' show ${
-                  tenantRoot ? "ApplicationSignIn, " : ""
-                }ApplicationStatus;`,
+                `import 'package:nomos_client/src/application_status.dart' show ApplicationStatus;`,
               ]
             : []),
-          `import 'package:nomos_flutter/src/generated_application_host.dart' show ${
-            tenantRoot
-              ? "ApplicationModelChange, NomosApplicationStartupState, "
-              : ""
-          }${
-            usesWorkspaceName
-              ? "ApplicationWorkspaceOpenProgress, NomosApplicationObservability, "
-              : ""
-          }NmsInternalApplicationUserBinding${
-            opts.flutterHost === true || sharingPolicies.length > 0
-              ? ", NmsInternalApplicationHost"
-              : ""
-          }${
-            sharingPolicies.length > 0 ? ", NmsInternalInvitationPolicy" : ""
-          };`,
         ]
       : []),
     `import '${typesImport}';`,
@@ -2112,31 +1945,21 @@ export function generateDartApplication(
     ...[...explicitTypeImportUris].sort().map((uri) => `import '${uri}';`),
     `import '${mod.name}.client.dart' show ${client}${
       resolverBindings.length > 0 ? `, ${cap(camel(domain))}Conflicts` : ""
-    };`,
+    }${mod.directives.filter(command => refusalContracts(mod, command.id).length > 0).map(command => `, ${refusalDecoder(command.id)}`).join("")};`,
     ...imports,
     ``,
     ...(tenantRoot
-      ? [`/// The canonical stateful entry point for this business domain.`]
+      ? [`/// The canonical typed facade for this business domain.`]
       : [
           `/// A business domain handle owned by the generated package application.`,
         ]),
     `///`,
-    `/// Use its business actions, records, watches, status and decisions directly. Nomos owns`,
-    `/// persistence, synchronization, access delivery and recovery underneath this object;`,
-    `/// do not create a parallel repository, runtime host, session, or application-state copy.`,
+    `/// Use its business actions, records, watches, status and decisions directly. Peer Office`,
+    `/// owns persistence, synchronization, access delivery and recovery underneath this object.`,
     ...(tenantRoot
       ? [
           `///`,
-          `/// Canonical bootstrap:`,
-          "/// ```dart",
-          `/// return ${application}.nomosWidget(`,
-          `///   cloud: cloud,`,
-          `///   application: '${domain}',`,
-          `///   signIn: signIn,`,
-          `///   builder: (context, application) => MyBusinessUi(application: application),`,
-          `/// );`,
-          "/// ```",
-          `/// Pass that same [${application}] down. It is the application state.`,
+          `/// Reception supplies this facade once for the Peer Office application desk.`,
         ]
       : [
           `///`,
@@ -2145,63 +1968,29 @@ export function generateDartApplication(
         ]),
     `final class ${application} {`,
     `  final ${client} _client;`,
+    `  final NmsReceptionSession _nmsReception;`,
     ...(tenantRoot ? [`  final User currentUser;`] : []),
     `  final ${activity} activity;`,
     ...appLines,
-    `  ${application}._(${client} client${
+    `  ${application}._(${client} client, NmsReceptionSession reception${
       tenantRoot ? ", User currentUser" : ""
     }) : ${applicationInitializers.join(", ")};`,
     ``,
-    `  /// Prove, adopt or restore the law this application was generated against.`,
-    `  NomosModel get model => _client.model;`,
     ...(opts.flutterHost === true
       ? [
           ``,
           `  /// Current durability and convergence for this workspace in product language.`,
-          `  ApplicationStatus get currentStatus => NmsInternalApplicationHost.currentStatus(_client.bridge);`,
+          `  ApplicationStatus get currentStatus => _nmsReception.currentStatus;`,
           ``,
           `  /// React whenever this workspace saves, receives work, goes offline or needs attention.`,
-          `  Stream<ApplicationStatus> watchStatus() => NmsInternalApplicationHost.watchStatus(_client.bridge);`,
+          `  Stream<ApplicationStatus> watchStatus() => _nmsReception.streams.status;`,
           ``,
           `  /// Wait until accepted local work is in shared custody and this workspace has caught up.`,
           `  Future<void> whenCurrent({Duration timeout = const Duration(minutes: 2)}) =>`,
-          `      NmsInternalApplicationHost.whenCurrent(_client.bridge, timeout: timeout);`,
+          `      _nmsReception.whenCurrent(timeout: timeout);`,
           ``,
           `  /// The parent operation which created this workspace during this application run, if any.`,
-          `  NomosOperationReceipt? get creationReceipt => NmsInternalApplicationHost.creationReceipt(_client.bridge);`,
-        ]
-      : []),
-    ...(opts.flutterHost === true && tenantRoot
-      ? [
-          ``,
-          `  /// Mount the one application at the UI boundary and pass [application] down.`,
-          `  ///`,
-          `  /// This is the only application bootstrap tenant code should own.`,
-          `  ///`,
-          `  /// The object supplied to [builder] is the application state. Keep it as the only`,
-          `  /// business-state dependency; do not recreate its records in providers, repositories or caches.`,
-          `  static Widget nomosWidget({`,
-          `    Key? key,`,
-          `    required String cloud,`,
-          `    required String application,`,
-          `    required ApplicationSignIn signIn,`,
-          `    required Widget Function(BuildContext context, ${application} application) builder,`,
-          `    Widget Function(BuildContext context)? loadingBuilder,`,
-          `    Widget Function(BuildContext context, Object error, VoidCallback retry)? errorBuilder,`,
-          `    ApplicationModelChange? onModelChange,`,
-          `    ValueChanged<NomosApplicationStartupState>? onStartupStateChanged,`,
-          `    Duration startupTimeout = const Duration(minutes: 3),`,
-          `  }) => NmsInternalApplicationHost.home<${application}>(`,
-          `    key: key, cloud: cloud, application: application, signIn: signIn,`,
-          ...(opts.applicationFrameworkCallsImportUri === undefined
-            ? []
-            : [`    frameworkCalls: nomosInternalApplicationFrameworkCalls,`]),
-          `    bind: nomosInternalBind${application}, builder: builder,`,
-          `    loadingBuilder: loadingBuilder, errorBuilder: errorBuilder,`,
-          `    onModelChange: onModelChange,`,
-          `    onStartupStateChanged: onStartupStateChanged,`,
-          `    startupTimeout: startupTimeout,`,
-          `  );`,
+          `  NomosOperationReceipt? get creationReceipt => _nmsReception.creationReceipt;`,
         ]
       : []),
     `}`,
@@ -2228,6 +2017,7 @@ export function generateDartApplication(
     ``,
     ...actionResultDeclarations,
     ...collections,
+    ...foreignContractResolvers,
     ...conflictDeclarations,
     `bool _nmsReferenceTypeMatches(String actual, String expected) =>`,
     `    actual == expected || actual.endsWith('.\$expected');`,
@@ -2300,76 +2090,35 @@ export function generateDartApplication(
             : []),
         ]
       : []),
-    ...(opts.flutterHost === true
+    `Future<${application}> nomosInternalReceive${application}(`,
+    `    NmsReceptionSession reception) async {`,
+    `  final application = ${application}._(`,
+    `    await ${client}.bind(reception.desk, actor: reception.user.actor),`,
+    `    reception${tenantRoot ? "," : ""}`,
+    ...(tenantRoot
       ? [
-          `Future<${application}> nomosInternalBind${application}(`,
-          `    NomosSession session, NmsInternalApplicationUserBinding user) async {`,
-          `  final application = ${application}._(`,
-          `    await ${client}.bind(session, actor: user.nmsInternalActor)${
-            tenantRoot ? "," : ""
-          }`,
-          ...(tenantRoot
-            ? [
-                `    NmsInternalUsers.create(identityId: user.nmsInternalIdentityId, identityAddress: user.nmsInternalIdentityAddress),`,
-              ]
-            : []),
-          `  );`,
+          `    NmsInternalUsers.create(identityId: reception.user.identityId, identityAddress: reception.user.identityAddress),`,
         ]
-      : [
-          `Future<${application}> nomosInternalBind${application}(NomosSession session, String? actor) async {`,
-          `  final application = ${application}._(await ${client}.bind(session, actor: actor));`,
-        ]),
-    ...(sharingPolicies.length > 0
-      ? [`  await application._nmsStartWorkspaceSharing();`]
       : []),
+    `  );`,
     `  return application;`,
     `}`,
     ``,
-    `Future<${application}> nomosInternalOpen${application}<TAggregate>(`,
-    `    NomosBridge bridge, NomosRef<TAggregate> reference, String? actor,`,
-    `    {Future<void> Function()? recoverAuthentication}) async {`,
-    ...(opts.flutterHost === true
-      ? [
-          `  return NmsInternalApplicationHost.nmsInternalOpenReferencedApplication<${application}>(`,
-          `    parent: bridge,`,
-          `    workspace: NmsInternalNomosRefs.workspace(reference),`,
-          `    open: () async {`,
-        ]
-      : []),
     ...(tenantRoot
       ? [
-          `  final signedIn = actor?.trim() ?? '';`,
-          `  if (signedIn.isEmpty) throw StateError('Nomos could not identify the signed-in application user.');`,
-          `  final client = await ${client}.open(`,
-          `    bridge, ref: reference, actor: signedIn,`,
-          `    recoverAuthentication: recoverAuthentication,`,
-          `  );`,
-          `  final application = ${application}._(`,
-          `    client,`,
-          `    NmsInternalUsers.create(`,
-          `      identityId: nmsInternalReceivingGroupNameOf(signedIn),`,
-          `      identityAddress: 'nomos-identity:\${Uri.encodeComponent(nmsInternalReceivingGroupNameOf(signedIn))}',`,
-          `    ),`,
-          `  );`,
-        ]
-      : [
-          `  final client = await ${client}.open(`,
-          `    bridge, ref: reference, actor: actor,`,
-          `    recoverAuthentication: recoverAuthentication,`,
-          `  );`,
-          `  final application = ${application}._(client);`,
-        ]),
-    ...(sharingPolicies.length > 0
-      ? [`  await application._nmsStartWorkspaceSharing();`]
-      : []),
-    `  return application;`,
-    ...(opts.flutterHost === true
-      ? [
-          `    },`,
-          `    bridgeOf: (application) => application._client.bridge,`,
-          `  );`,
+          `/// Receive the generated application vocabulary from an already-open Reception session.`,
+          `/// This binds types only; Peer Office retains every lifecycle responsibility.`,
+          `Future<${application}> receive${application}(`,
+          `    NmsReceptionSession reception) =>`,
+          `  nomosInternalReceive${application}(reception);`,
+          ``,
         ]
       : []),
+    `Future<${application}> nomosInternalOpen${application}<TAggregate>(`,
+    `    NmsReceptionSession reception, NomosRef<TAggregate> reference,`,
+    `) async {`,
+    `  final child = await reception.follow(NmsInternalNomosRefs.workspace(reference));`,
+    `  return nomosInternalReceive${application}(child);`,
     `}`,
     ``,
   ].join("\n");