@githolon/dsl 0.108.7 → 0.110.0

package/dart/lib/src/test_harness.dart

@@ -1,8 +1,8 @@
-// NOMOS TEST HARNESS — an EPHEMERAL, FULLY-OFFLINE real-law fixture for headless app tests. One call
+// NOMOS TEST HARNESS — an EPHEMERAL, FULLY-OFFLINE real-law fixture for app tests that run without a UI. One call
 // installs a tenant's compiled law into a FRESH LOCAL application parent (no cloud contact, ever), performs
 // the same receiving-group birth a production application performs, boots the REAL githolon (the
 // byte-identical wasm, the real ledger, the real gate) over [NodeRunnerTransport], and hands
-// out a [NomosBridge] the generated Dart clients drive — the SAME surface the app UI uses — under
+// out a [DartReception] the generated Dart clients drive — the SAME surface the app UI uses — under
 // `flutter test` / `dart test` / CI.
 //
 // ```dart
@@ -10,28 +10,20 @@
 //   lawUsdzPaths: ['build/guestbook.law.usdz'],
 //   registerTearDown: addTearDown,   // auto-disposes when the test ends (see below)
 // );
-// final app = guestbookClient(harness.bridge); // the generated client — same one the app uses
+// final app = guestbookClient(harness.reception); // the generated client — same one the app uses
 // await app.signGuestbook(author: 'ada', message: 'hi', mood: 'happy', signedAt: ...);
 // final rows = await app.entriesByAuthor(author: 'ada');
 // await harness.dispose();   // DETERMINISTIC teardown (also auto-fired via registerTearDown)
 // ```
 //
-// HOW IT STAYS OFFLINE. Two node children, both talking only to the local disk:
-//   1. `offline-install.ts` runs the PROVEN offline install lane (`githolon proof`'s adapter engine) on a
-//      throwaway application parent — genesis → framework controller → each tenant package's
-//      `installDomain`, folded through the ONE gate — and serializes its tree to a fresh temp dir. Generated
-//      scenarios then birth their deterministic receiving group locally through the real declared birth.
-//   2. the node runner (`node-entry.ts`) boots in `NOMOS_OFFLINE=1` mode: it serves the runtime wasm from the
-//      local cache (`~/.holon/runtime`, filled by any warm `githolon` run) and boots the holon from that
-//      snapshot (`restoreFrom`). Every other URL is REFUSED — a stray fetch fails loudly, never reaches the net.
+// HOW IT STAYS OFFLINE. One Node test Platform Shell opens the canonical Peer Office over a temporary
+// filesystem Git custody directory. Workspace genesis and every law install cross Runtime v2 and the
+// kernel's generated Protobuf ABI. There is no private installer, serialized repository snapshot, alternate
+// engine, USDA parser, or generic command bridge in this harness.
 //
 // PREREQUISITES (documented so a failure is legible): `node` on PATH and the release-pinned runtime cache.
-// The self-contained runner + installer ship inside nomos_client; the kernel executable does not. A cold
+// The self-contained runner ships inside nomos_client; the kernel executable does not. A cold
 // runtime is acquired and content-addressed by the release tooling, then tests remain fully offline.
-//
-// PACKAGING NOTE: `offline-install.ts` imports the adapter engine, which today lives beside the in-repo
-// runner. For a PUBLISHED harness this install belongs behind a `githolon` subcommand (the CLI already
-// bundles the engine + this exact sequence in `proof_offline`); [installHelper] is the one seam to repoint.
 @internal
 library;
 
@@ -40,18 +32,28 @@ import 'package:meta/meta.dart' show internal;
 import 'dart:convert';
 import 'dart:io';
 
+import 'package:nomos_types/nomos_kernel_protocol.dart' as protocol;
+
 import 'package:crypto/crypto.dart' show sha256;
 import 'package:fixnum/fixnum.dart' show Int64;
 import 'package:nomos_types/nomos_kernel_protocol.dart'
     show BirthCertificate, SyncWorkspaceResponse;
-import 'package:nomos_types/nomos_types.dart' show Sha256Digest;
+import 'package:nomos_types/nomos_types.dart'
+    show
+        Sha256Digest,
+        NomosRuntimeFailure,
+        NomosUnavailable,
+        NomosUnavailableReason;
 import 'package:package_config/package_config.dart' show loadPackageConfigUri;
 
 import 'dev_cloud.dart';
 import 'application_framework_calls.dart';
 import 'node_runner_transport.dart';
+import 'runtime_v2_transport.dart';
 import 'session_bound.dart' show DomainNotInstalledForSession;
-import 'webview_bridge.dart' show NomosBridge, NomosSession;
+import 'reception/dart_reception.dart'
+    show DartReception, NomosBoundInteraction, NomosSession;
+import 'testing/test_peer.dart' show NmsTestPeer;
 
 enum _KernelRuntimeArtifact {
   executable('holon.wasm'),
@@ -64,38 +66,17 @@ enum _KernelRuntimeArtifact {
   final String? providerFileName;
 }
 
-enum _CandidateKernelBinary {
-  production('holon.wasm'),
-  testMint('holon-testmint.wasm');
-
-  const _CandidateKernelBinary(this.fileName);
-  final String fileName;
+/// Opaque authenticated Git point captured from one isolated local test peer.
+/// It carries no credentials and cannot be used with a production reception.
+final class NomosTestFrontier {
+  const NomosTestFrontier._(
+      this._owner, this.workspace, this.head, this._offers);
+  final Object _owner;
+  final String workspace;
+  final String head;
+  final protocol.CustodyOfferBatchRequest _offers;
 }
 
-/// Lower the generated protobuf certificate into the framework law's USDA-authored value shape. This is
-/// deliberately not a second certificate type: callers cannot construct it independently, and every field
-/// is read from the compiler-generated message.
-Map<String, Object?> _birthCertificateLawValue(BirthCertificate certificate) =>
-    <String, Object?>{
-      'child': certificate.child,
-      'founder': certificate.founder,
-      'verified': certificate.verified,
-      'parentKey': base64Encode(certificate.parentKey),
-      'parentId': certificate.parentId,
-      'epoch': certificate.epoch.toInt(),
-      'signature': base64Encode(certificate.signature),
-      if (certificate.hasVerifiedVia()) 'verifiedVia': certificate.verifiedVia,
-      if (certificate.hasIdpToken()) 'idpToken': certificate.idpToken,
-      if (certificate.hasCapturedClock())
-        'capturedClock': certificate.capturedClock.toInt(),
-      if (certificate.hasAuthProviderIssuer())
-        'authProviderIssuer': certificate.authProviderIssuer,
-      if (certificate.hasAuthProviderJwks())
-        'authProviderJwks': certificate.authProviderJwks,
-      if (certificate.hasAuthProviderAudience())
-        'authProviderAudience': certificate.authProviderAudience,
-    };
-
 /// A source checkout is itself a coordinated release candidate: compiler, framework packages and kernels
 /// move together. Generated scenarios must not combine those source-generated laws with a recently-written
 /// but older global runtime cache. Published packages have no release/ directory and keep the normal
@@ -105,9 +86,8 @@ Future<String?> _sourceCandidateRuntime(String nodeEntry) async {
   Directory? root;
   for (var depth = 0; depth < 12; depth++) {
     if (File('${cursor.path}/release/kernel-candidate.usda').existsSync() &&
-        File(
-          '${cursor.path}/cloud/dev-server/kernel-testmint.wasm',
-        ).existsSync()) {
+        File('${cursor.path}/cloud/cloudflare-shell/vendor/holon_bytes.wasmbin')
+            .existsSync()) {
       root = cursor;
       break;
     }
@@ -156,19 +136,12 @@ Future<String?> _sourceCandidateRuntime(String nodeEntry) async {
   }
 
   final productionExpected = await candidateField('production-sha256');
-  final testMintExpected = await candidateField('test-mint-sha256');
   final production = File(
     '${sourceRoot.path}/cloud/cloudflare-shell/vendor/holon_bytes.wasmbin',
   );
-  final testMint = File(
-    '${sourceRoot.path}/cloud/dev-server/kernel-testmint.wasm',
-  );
   final productionRepository = File(
     '${sourceRoot.path}/cloud/cloudflare-shell/runtime/kernel.repository.xml',
   );
-  final testMintRepository = File(
-    '${sourceRoot.path}/cloud/cloudflare-shell/runtime/kernel-testmint.repository.xml',
-  );
   final bootstrap = File(
     '${sourceRoot.path}/cloud/cloudflare-shell/domains/build/bootstrap/domain_bootstrap.law.usdz',
   );
@@ -177,9 +150,7 @@ Future<String?> _sourceCandidateRuntime(String nodeEntry) async {
   );
   for (final file in [
     production,
-    testMint,
     productionRepository,
-    testMintRepository,
     bootstrap,
     nomos,
   ]) {
@@ -190,19 +161,15 @@ Future<String?> _sourceCandidateRuntime(String nodeEntry) async {
     }
   }
   final productionBytes = await production.readAsBytes();
-  final testMintBytes = await testMint.readAsBytes();
   final productionRepositoryBytes = await productionRepository.readAsBytes();
-  final testMintRepositoryBytes = await testMintRepository.readAsBytes();
   final productionActual = sha256.convert(productionBytes).toString();
-  final testMintActual = sha256.convert(testMintBytes).toString();
   String short(String value) =>
       value.length <= 12 ? value : value.substring(0, 12);
-  if (productionActual != productionExpected ||
-      testMintActual != testMintExpected) {
+  if (productionActual != productionExpected) {
     throw NomosTestHarnessException(
       'source release candidate kernel mismatch: release/kernel-candidate.usda '
-      'expects ${short(productionExpected)}/${short(testMintExpected)}, but the staged artifacts are '
-      '${short(productionActual)}/${short(testMintActual)} — run the kernel candidate preparation before testing',
+      'expects ${short(productionExpected)}, but the staged artifact is '
+      '${short(productionActual)} — run the kernel candidate preparation before testing',
     );
   }
   final bootstrapBytes = await bootstrap.readAsBytes();
@@ -210,9 +177,8 @@ Future<String?> _sourceCandidateRuntime(String nodeEntry) async {
   final bundleIdentity = sha256
       .convert(
         utf8.encode(
-          '$productionActual:$testMintActual:'
+          '$productionActual:'
           '${sha256.convert(productionRepositoryBytes)}:'
-          '${sha256.convert(testMintRepositoryBytes)}:'
           '${sha256.convert(bootstrapBytes)}:'
           '${sha256.convert(nomosBytes)}',
         ),
@@ -242,9 +208,7 @@ Future<String?> _sourceCandidateRuntime(String nodeEntry) async {
   }
 
   await publish('holon.wasm', productionBytes);
-  await publish('holon-testmint.wasm', testMintBytes);
   await publish('kernel.repository.xml', productionRepositoryBytes);
-  await publish('kernel-testmint.repository.xml', testMintRepositoryBytes);
   await publish('bootstrap.law.usdz', bootstrapBytes);
   await publish('nomos.law.usdz', nomosBytes);
   return runtime.path;
@@ -262,25 +226,21 @@ String? nmsPermanentConvergenceFailure(SyncWorkspaceResponse result) {
       'push=${result.hasPushError() ? result.pushError.message : "none"}';
 }
 
-/// The offline-install lane configuration a harness keeps so the CUSTODY DIAGNOSTIC helpers
-/// (ask 9 of architecture/session_bound_clients.md) can re-run installs after construction:
-/// [seedWorkspaceFromLawUsdz] / [resetWorkspaceCustody].
-class _InstallLane {
-  final String node;
-  final bool useInRepoScript;
-  final String inRepoScript;
-  final String githolonCmd;
-  final String? runtimeDir;
-  final String clientId;
-  const _InstallLane({
-    required this.node,
-    required this.useInRepoScript,
-    required this.inRepoScript,
-    required this.githolonCmd,
-    required this.runtimeDir,
-    required this.clientId,
-  });
-}
+/// A missing frontier or retryable transport/discovery failure is not a
+/// successful remote convergence merely because its counters default to zero.
+bool nmsRemoteConvergenceSettled(SyncWorkspaceResponse result) =>
+    result.hasCurrentHead() &&
+    result.currentHead.isNotEmpty &&
+    !result.localOnly &&
+    !result.pushFailed &&
+    !result.stillAhead &&
+    !result.offline &&
+    !result.reconnectRequired &&
+    !result.directOfferDeferred &&
+    !result.hasPushError() &&
+    !result.hasDiscoveryError() &&
+    result.deferred == 0 &&
+    nmsPermanentConvergenceFailure(result) == null;
 
 class NomosTestHarnessException implements Exception {
   final String message;
@@ -292,7 +252,7 @@ class NomosTestHarnessException implements Exception {
 /// A TYPED per-phase deadline breach — the "NO SILENT HANGS" guarantee: every lifecycle await in
 /// [NomosTestHarness] (install, runner spawn, ready, connect, keygen, keyed reconnect, seed, dispose)
 /// runs under a generous deadline and, instead of wedging forever with no output, throws THIS —
-/// naming the phase, the workspace, how long it waited, the bridge op it was awaiting, and the
+/// naming the phase, the workspace, how long it waited, the reception op it was awaiting, and the
 /// likely causes where they are known. Subclasses [NomosTestHarnessException] so existing
 /// `on NomosTestHarnessException` handling keeps working. Tune deadlines with the harness's
 /// `phaseTimeout` parameter (it overrides EVERY phase's default when set).
@@ -306,7 +266,7 @@ class HarnessPhaseTimeout extends NomosTestHarnessException {
   /// How long the harness waited before giving up.
   final Duration elapsed;
 
-  /// What the harness was awaiting (the bridge op / subprocess), e.g. `connect`, `authorKeygen`.
+  /// What the harness was awaiting (the reception op / subprocess), e.g. `connect`, `authorKeygen`.
   final String awaiting;
 
   /// Likely causes, where the harness knows them (mirrors DomainNotInstalledForSession.possibleCauses).
@@ -332,15 +292,16 @@ class HarnessPhaseTimeout extends NomosTestHarnessException {
 const String _decoyWorkspace = '__nomos-decoy';
 
 class _CloudRestartLane {
-  const _CloudRestartLane({
+  _CloudRestartLane({
     required this.entry,
     required this.node,
     required this.cloud,
     required this.authToken,
     required this.authorSecret,
     required this.clientId,
+    required this.custodyDirectory,
     this.resolveFrom,
-    this.environment,
+    this.arguments = const <String>[],
   });
 
   final String entry;
@@ -350,15 +311,16 @@ class _CloudRestartLane {
   final String authorSecret;
   final String clientId;
   final String? resolveFrom;
-  final Map<String, String>? environment;
+  final List<String> arguments;
+  String custodyDirectory;
 }
 
 class NomosTestHarness {
-  /// The connected bridge — hand it to the generated typed clients (the same surface the app UI uses).
+  /// The connected reception — hand it to the generated typed clients (the same surface the app UI uses).
   /// For [ephemeral] this is a [NomosSession] HANDLE pinned to [workspace] (the plane underneath also
   /// holds a decoy session, so unpinned plane-level calls refuse the way they would in a real
   /// multi-workspace app); for [cluster] it is the shared plane — name sessions via [session].
-  NomosBridge bridge;
+  DartReception reception;
 
   /// The local workspace name the law was installed into.
   final String workspace;
@@ -387,15 +349,21 @@ class NomosTestHarness {
   /// package's domainHash — the `lawHash` a `.births()` recipe names for the child's law install.
   final Map<String, List<String>> _lawHashes;
 
+  /// Domain keys reported by the kernel while inspecting each installed law package.
+  final Map<String, Set<String>> _domainKeys;
+
   /// The tenant law hashes installed into [workspace] (deploy order); empty if unknown.
   List<String> lawHashes(String workspace) =>
       List.unmodifiable(_lawHashes[workspace] ?? const []);
 
-  /// workspace → the base64 restore snapshot it was seeded from (for [resetWorkspaceCustody]).
-  final Map<String, String> _snapshots;
+  /// Present for local harnesses so a later scenario workspace uses the same
+  /// canonical Peer Office and real Git custody, rather than another installer.
+  final NmsTestPeer? _testPeer;
 
-  /// The offline-install lane config (for [seedWorkspaceFromLawUsdz]); null when unknown.
-  final _InstallLane? _installLane;
+  /// Sessions used only to establish the test application. They share the
+  /// kernel plane while setup runs, but are not part of the application's
+  /// durable working set and must never be reopened as though they were.
+  final Set<String> _setupSessions;
 
   /// When set, overrides EVERY phase's default deadline (see [HarnessPhaseTimeout]).
   final Duration? _phaseTimeout;
@@ -424,7 +392,7 @@ class NomosTestHarness {
   }
 
   NomosTestHarness._(
-    this.bridge,
+    this.reception,
     this.workspace,
     this._transport,
     this._workdir,
@@ -434,8 +402,9 @@ class NomosTestHarness {
     Map<String, String> deviceSecrets = const {},
     this.frameworkHash,
     Map<String, List<String>> lawHashes = const {},
-    Map<String, String> snapshots = const {},
-    _InstallLane? installLane,
+    Map<String, Set<String>> domainKeys = const {},
+    NmsTestPeer? testPeer,
+    Set<String> setupSessions = const {},
     Duration? phaseTimeout,
     _CloudRestartLane? cloudRestartLane,
     this.testCloud,
@@ -446,8 +415,9 @@ class NomosTestHarness {
         _devicePublics = devicePublics,
         _deviceSecrets = deviceSecrets,
         _lawHashes = Map.of(lawHashes),
-        _snapshots = Map.of(snapshots),
-        _installLane = installLane,
+        _domainKeys = Map.of(domainKeys),
+        _testPeer = testPeer,
+        _setupSessions = Set.unmodifiable(setupSessions),
         _phaseTimeout = phaseTimeout,
         _cloudRestartLane = cloudRestartLane;
 
@@ -476,18 +446,26 @@ class NomosTestHarness {
     final where = workspace != null ? ' "$workspace"' : '';
     log('phase $phase$where (≤${timeout.inSeconds}s) …');
     final sw = Stopwatch()..start();
-    final r = await run().timeout(
-      timeout,
-      onTimeout: () => throw HarnessPhaseTimeout(
-        phase: phase,
-        workspace: workspace,
-        elapsed: timeout,
-        awaiting: awaiting,
-        likelyCauses: likelyCauses,
-      ),
-    );
-    log('phase $phase$where done (${sw.elapsedMilliseconds}ms)');
-    return r;
+    try {
+      final r = await run().timeout(
+        timeout,
+        onTimeout: () => throw HarnessPhaseTimeout(
+          phase: phase,
+          workspace: workspace,
+          elapsed: timeout,
+          awaiting: awaiting,
+          likelyCauses: likelyCauses,
+        ),
+      );
+      log('phase $phase$where done (${sw.elapsedMilliseconds}ms)');
+      return r;
+    } on NomosRuntimeFailure catch (failure) {
+      // The presentation-safe exception deliberately omits diagnostic prose. Test fixtures
+      // still need the runtime's actual reason, without changing production UI rendering.
+      log('phase $phase$where failed (${sw.elapsedMilliseconds}ms): '
+          '${failure.code}: ${failure.message}');
+      rethrow;
+    }
   }
 
   /// The base64 device PUBLIC key a `deviceKeyed` [cluster] session was opened with (null otherwise). Its
@@ -504,76 +482,14 @@ class NomosTestHarness {
 
   /// The base64 device SECRET a session was opened with (TEST HARNESS ONLY — the harness IS the device;
   /// a real app keeps this in secure storage). Sign writes to locally-born children with it, e.g.
-  /// `bridge.acquireSession(childWs, authorSecret: harness.deviceSecret(home))`.
+  /// `reception.acquireSession(childWs, authorSecret: harness.deviceSecret(home))`.
   String? deviceSecret(String workspace) => _deviceSecrets[workspace];
 
-  /// Framework-private scenario setup for a business intent guarded by a delegated role.
-  /// Generated `scenario.given(person).mayX()` methods are the only caller: they name the
-  /// business permission while this harness mints and admits the real parent-rooted delegation.
-  /// Tenant tests never handle relation names, certificate bytes, signer secrets, or raw offers.
-  Future<void> nomosInternalAllowDelegatedScenarioAction({
-    required String domain,
-    required String acceptanceIntent,
-    required String relation,
-    required String subject,
-    required String subjectField,
-    required String certificateField,
-    Map<String, Object?> facts = const {},
-  }) async {
-    final secret = _deviceSecrets[workspace];
-    if (secret == null || secret.isEmpty) {
-      throw NomosTestHarnessException(
-        'the generated scenario cannot establish its business permission because the test device secret is unavailable',
-      );
-    }
-    final rows = await session(
-      workspace,
-    ).queryById('birth-attestation:self', null, subject);
-    if (rows.length != 1) {
-      throw NomosTestHarnessException(
-        'the generated scenario expected one verified birth attestation before establishing business permission; found ${rows.length}',
-      );
-    }
-    final row = rows.single;
-    final data = row['data'] is Map
-        ? (row['data'] as Map).cast<String, Object?>()
-        : row.cast<String, Object?>();
-    final rawChain = data['certChain'];
-    final decodedChain = rawChain is String ? jsonDecode(rawChain) : rawChain;
-    final links = decodedChain is Map && decodedChain['links'] is List
-        ? List<Object?>.from(decodedChain['links'] as List)
-        : const <Object?>[];
-    final issued = await session(workspace).issueDelegationCert(
-      signerSecret: secret,
-      grantorId: (data['parentId'] ?? workspace).toString(),
-      relation: relation,
-      subject: subject,
-      certChain: links,
-    );
-    final certificate = issued['certString']?.toString();
-    if (certificate == null || certificate.isEmpty) {
-      throw NomosTestHarnessException(
-        'the generated scenario could not mint the parent-rooted business delegation',
-      );
-    }
-    await session(workspace).offerOutcome(
-      domain: domain,
-      directiveId: acceptanceIntent,
-      actor: subject,
-      authorSecret: secret,
-      payload: <String, Object?>{
-        ...facts,
-        subjectField: subject,
-        certificateField: certificate,
-      },
-    );
-  }
-
   /// The workspace names on this device's local plane (one for [ephemeral], N for [cluster]).
   List<String> get sessions => List.unmodifiable(_sessionNames);
 
   /// A [NomosSession] handle pinned to one connected [workspace] — hand it to a generated typed client
-  /// (`EstateClient(harness.session('estate'))`). A THIN delegate to the production [NomosBridge.session]:
+  /// (`EstateClient(harness.session('estate'))`). A THIN delegate to the production [DartReception.session]:
   /// the harness owns no session logic, it just installs the laws + opens the sessions on the one plane.
   NomosSession session(String workspace) {
     if (!_sessionNames.contains(workspace)) {
@@ -581,23 +497,18 @@ class NomosTestHarness {
         'no session "$workspace" on this harness — connected sessions: $_sessionNames',
       );
     }
-    return bridge.session(workspace);
+    return reception.session(workspace);
   }
 
-  /// Install [lawUsdzPaths] into a fresh LOCAL workspace and boot a bridge over it — NO cloud contact.
+  /// Install [lawUsdzPaths] into a fresh LOCAL workspace and boot a reception over it — NO cloud contact.
   ///
   /// [lawUsdzPaths] — the `build/<name>.law.usdz` files `nomos-compile` emits (installed in order;
   /// framework/platform law before a domain that depends on it).
   /// [workspace] — the local workspace name (default `test-ws`; law-only, never leaves the machine).
-  /// [runtimeDir] — the runtime cache (default `~/.holon/runtime`); must hold `holon-testmint.wasm` +
+  /// [runtimeDir] — the runtime cache (default `~/.holon/runtime`); must hold `holon.wasm` +
   /// `bootstrap.law.usdz` + `nomos.law.usdz`. The harness owns a throwaway test root; app code never handles its key material.
-  /// [nodeEntry] — path to `node-entry.ts`; when omitted it is resolved from [resolveFrom] via
-  /// `require.resolve('@githolon/client/runner/node-entry.ts')`.
-  /// [installHelper] — the offline law-install lane. An EXISTING `.ts` or `.mjs` file is run as a node script (the
-  /// in-repo `offline-install.ts`, the default when it exists beside [nodeEntry]); anything else is a
-  /// githolon COMMAND LINE whose `harness-install` subcommand is driven (the default `npx githolon` when the
-  /// in-repo helper is absent — a published tenant needs nothing but `githolon`). E.g. force the subcommand
-  /// with `installHelper: 'node /abs/cli/dist/cli.mjs'`.
+  /// [nodeEntry] — path to the bundled test Platform Shell; normally resolved
+  /// from `package:nomos_client/src/runner/node-entry.mjs` (the stdio node peer, given --custody).
   /// [registerTearDown] — pass the test framework's `addTearDown` to auto-[dispose] when the test ends
   /// (feature-detecting `package:test` from a library is not clean in Dart, so this is explicit and safe).
   /// [autoTearDown] — when true (default) and [registerTearDown] is given, registers [dispose] as a teardown.
@@ -606,11 +517,15 @@ class NomosTestHarness {
     NmsApplicationFrameworkCalls? applicationFrameworkCalls,
     int? applicationMaxChildWorkspacesPerUser,
     String? ownerSubject,
-    String workspace = 'test-ws',
+
+    /// The raw law-focused lane's workspace. It is REFUSED alongside
+    /// [ownerSubject]: naming an owner declares the application-home lane, whose
+    /// workspace is the office's receiving-group address, not a name a caller
+    /// (or this harness) derives.
+    String? workspace,
     String clientId = 'test-runner',
     String? runtimeDir,
     String? nodeEntry,
-    String? installHelper,
     String? resolveFrom,
     String node = 'node',
     bool autoTearDown = true,
@@ -627,33 +542,24 @@ class NomosTestHarness {
       );
     }
     final entry = nodeEntry ??
-        await _resolveEntry(node, resolveFrom ?? Directory.current.path);
+        await _resolveTestEntry(node, resolveFrom ?? Directory.current.path);
     final effectiveRuntimeDir = runtimeDir ??
         Platform.environment['NOMOS_CANDIDATE_RUNTIME'] ??
         Platform.environment['NOMOS_DART_RUNTIME'] ??
         Platform.environment['NOMOS_OFFLINE_RUNTIME'] ??
-        await _sourceCandidateRuntime(entry);
-    // THE INSTALL LANE. [installHelper] is the one seam (PACKAGING NOTE above): either the in-repo
-    // `offline-install.mjs` node script, OR the published `githolon harness-install` subcommand (the CLI
-    // bundles the engine + this exact install sequence, so a published tenant needs nothing but `githolon`).
-    //  • an EXISTING `.ts`/`.mjs` file ⇒ run it as a node script (the in-repo default when present);
-    //  • anything else            ⇒ treat it as a githolon COMMAND LINE and drive `harness-install`
-    //    (default `npx githolon` when the in-repo helper is absent; the test forces this lane by passing
-    //    e.g. `installHelper: 'node /abs/cli/dist/cli.mjs'`).
-    final adjacentInstaller = '${File(entry).parent.path}/offline-install.mjs';
-    final resolvedHelper = installHelper ??
-        (File(adjacentInstaller).existsSync()
-            ? adjacentInstaller
-            : '${File(entry).parent.path}/offline-install.ts');
-    final useInRepoScript =
-        (resolvedHelper.endsWith('.ts') || resolvedHelper.endsWith('.mjs')) &&
-            File(resolvedHelper).existsSync();
-    final githolonCmd = installHelper == null ? 'npx githolon' : resolvedHelper;
-
+        await _sourceCandidateRuntime(entry) ??
+        '${Platform.environment['HOME'] ?? ''}/.holon/runtime';
     final owner = ownerSubject?.trim();
-    final birthsApplicationHome = owner != null &&
-        owner.isNotEmpty &&
-        workspace == _receivingGroupNameOf(owner);
+    // THE CALLER DECLARES ITS LANE. Naming an owner IS the application-home lane;
+    // the harness no longer re-derives a receiving-group name to recognise one by
+    // comparison. The office answers that name once the peer is up.
+    final birthsApplicationHome = owner != null && owner.isNotEmpty;
+    if (birthsApplicationHome && workspace != null) {
+      throw NomosTestHarnessException(
+        'ownerSubject declares the application-home lane, whose workspace is the '
+        'office\'s receiving-group address for that owner — do not name `workspace` too',
+      );
+    }
     if (birthsApplicationHome && applicationFrameworkCalls == null) {
       throw NomosTestHarnessException(
         'a generated application scenario must pass its compiler-generated framework calls; '
@@ -666,101 +572,71 @@ class NomosTestHarness {
     // birth machinery production uses. Raw/law-focused harness callers keep their explicitly named workspace.
     final installWorkspace = birthsApplicationHome
         ? 'nms-app-${DateTime.now().microsecondsSinceEpoch.toRadixString(36)}'
-        : workspace;
+        : (workspace ?? 'test-ws');
 
-    // A FRESH temp dir per harness — the snapshot + any transient runner state live here and nowhere else,
-    // so dispose() leaves nothing behind.
-    final workdir = await Directory.systemTemp.createTemp('nomos-harness-');
-    // Total-ordered teardown even on a mid-setup failure: build the transport lazily and clean up on throw.
+    Directory? workdir;
     NodeRunnerTransport? transport;
     final phase = (String m) {
       if (onDiagnostic != null) onDiagnostic('[nomos-test-harness] $m');
     };
     try {
-      final snapshot = '${workdir.path}/snapshot.bin';
-      final info = await _phased(
-        phase: '1/4: offline law install (${lawUsdzPaths.length} package(s))',
-        workspace: installWorkspace,
-        awaiting:
-            useInRepoScript ? 'offline-install.ts' : 'githolon harness-install',
-        timeout: phaseTimeout ?? _kInstallDeadline,
-        onDiagnostic: onDiagnostic,
-        likelyCauses: const [
-          'a cold npx download of githolon (pre-warm with any `githolon` run)',
-          'a very large law package folding through the offline gate — raise phaseTimeout',
-        ],
-        run: () => _runInstall(
-          node: node,
-          useInRepoScript: useInRepoScript,
-          inRepoScript: resolvedHelper,
-          githolonCmd: githolonCmd,
-          lawUsdzPaths: lawUsdzPaths,
-          workspace: installWorkspace,
-          snapshot: snapshot,
-          runtimeDir: effectiveRuntimeDir,
-          onDiagnostic: onDiagnostic,
-        ),
-      );
-
-      final runnerEnvironment = <String, String>{
-        'NOMOS_OFFLINE': '1',
-        'NOMOS_OFFLINE_RESTORE': snapshot,
-        'NOMOS_OFFLINE_WASM': 'holon-testmint.wasm',
-        if (info['devicePublic'] != null)
-          'NOMOS_TEST_K_ROOT_PUBLIC': info['devicePublic'].toString(),
-        if (info['deviceSecret'] != null)
-          'NOMOS_TEST_ROOT_SECRET': info['deviceSecret'].toString(),
-        if (effectiveRuntimeDir != null)
-          'NOMOS_OFFLINE_RUNTIME': effectiveRuntimeDir,
-      };
-      transport = await _phased(
-        phase: '2/4: spawn the node runner',
-        awaiting: 'Process.start($node)',
+      final peer = await _phased(
+        phase: '1/2: open canonical test peer',
+        awaiting: 'Peer Office + filesystem Git custody',
         timeout: phaseTimeout ?? _kSpawnDeadline,
         onDiagnostic: onDiagnostic,
-        run: () => NodeRunnerTransport.start(
+        run: () => NmsTestPeer.start(
           entry: entry,
+          runtimeDirectory: effectiveRuntimeDir,
           resolveFrom: resolveFrom,
           node: node,
-          environment: runnerEnvironment,
           onDiagnostic: onDiagnostic,
         ),
       );
-      final plane = NomosBridge(transport!);
-      await _phased(
-        phase: '3/4: runner ready',
-        awaiting: "event:'ready'",
-        timeout: phaseTimeout ?? readyTimeout,
-        onDiagnostic: onDiagnostic,
-        likelyCauses: const [
-          'node is not on PATH, or ~/.holon/runtime is cold (holon-testmint.wasm + framework law archives)',
-          'the runner process failed to boot the engine — run with onDiagnostic to see its stderr',
-        ],
-        run: () => plane.ready,
-      );
-      await _phased(
-        phase: '4/4: connect session',
+      transport = peer.transport;
+      workdir = peer.custody.directory;
+      var plane = peer.reception;
+      // An application home is warranted by certificates the founding device signs, so that key is
+      // minted FIRST and the peer is booted to trust it (typed boot configuration) before genesis.
+      protocol.SigningKeyPair? founder;
+      if (birthsApplicationHome) {
+        founder = await _phased(
+          phase: '1b/2: mint the founding device and boot the peer to trust it',
+          awaiting: 'authorKeygen + peer reboot with --trust-root-public-key',
+          timeout: phaseTimeout ?? _kSpawnDeadline,
+          onDiagnostic: onDiagnostic,
+          run: () async {
+            final key = await peer.mintFoundingDevice();
+            await peer.reboot(trustRootPublicKey: key.publicKey);
+            return key;
+          },
+        );
+        transport = peer.transport;
+        plane = peer.reception;
+      }
+      // THE OFFICE NAMES THE APPLICATION HOME. The harness holds no copy of the
+      // receiving-group derivation; it asks the peer it just started.
+      final openWorkspace = birthsApplicationHome
+          ? await plane.nmsReceivingGroupWorkspace(owner)
+          : installWorkspace;
+      final installed = await _phased(
+        phase: '2/2: create Git custody and install law',
         workspace: installWorkspace,
-        awaiting: 'connect',
+        awaiting: 'genesis offer + ordinary lifecycle offers',
         timeout: phaseTimeout ?? connectTimeout,
         onDiagnostic: onDiagnostic,
-        likelyCauses: const [
-          'a large ledger converge-fold can be slow — raise connectTimeout/phaseTimeout',
-          'run with onDiagnostic to see where the runner blocked',
-        ],
-        run: () => plane.connect(
-          cloud:
-              'https://offline.invalid', // ignored: the offline runner serves everything locally
+        run: () => peer.installWorkspace(
           workspace: installWorkspace,
-          session: installWorkspace,
-          clientId: clientId,
-          allowUnborn: true,
-          // THE HARNESS DEVICE (era-0): the install lane mints one device key per plane — sessions
-          // sign with it, and the client completes the self-serve birth ceremony (enrol + cert)
-          // with the SAME key, so offline `.births()` offers Just Work.
-          authorSecret: info['deviceSecret']?.toString(),
+          lawUsdzPaths: lawUsdzPaths,
+          deviceKey: founder,
         ),
       );
+      final info = <String, Object?>{
+        'devicePublic': base64Encode(installed.deviceKey.publicKey),
+        'deviceSecret': base64Encode(installed.deviceKey.secret),
+        'frameworkHash': installed.controllerHash,
+        'lawHashes': installed.lawHashes,
+      };
       if (birthsApplicationHome) {
         final maxChildWorkspaces = applicationMaxChildWorkspacesPerUser;
         if (maxChildWorkspaces == null || maxChildWorkspaces < 0) {
@@ -799,7 +675,7 @@ class NomosTestHarness {
           // scenario carries the value from the same package declaration that compiled the
           // receiving-group plan; the harness does not choose or default it. The ordinary
           // seed offer crosses the kernel author gate before the first birth is attempted.
-          run: () => plane.session(installWorkspace).offerCallUsdaOutcome(
+          run: () => plane.session(installWorkspace).offerGeneratedCallOutcome(
                 call: applicationFrameworkCalls!.seedBirthPolicy(
                   domain: '__nomos_application_home_v1',
                   workspace: installWorkspace,
@@ -808,6 +684,7 @@ class NomosTestHarness {
                   setAt: bornAt,
                 ),
                 actor: owner,
+                authorSecret: deviceSecret,
               ),
         );
         final keyHash = sha256.convert(base64Decode(devicePublic)).toString();
@@ -817,29 +694,30 @@ class NomosTestHarness {
           awaiting: 'law-declared enrollSigner offer',
           timeout: phaseTimeout ?? _kOtherDeadline,
           onDiagnostic: onDiagnostic,
-          run: () => plane.session(installWorkspace).offerCallUsdaOutcome(
+          run: () => plane.session(installWorkspace).offerGeneratedCallOutcome(
                 call: applicationFrameworkCalls!.enrollSigner(
                   domain: '__nomos_application_home_v1',
                   workspace: installWorkspace,
                   keyHash: keyHash,
                   grantedBy: owner,
                   grantedAt: 1,
-                  verifiedVia: 'nomos:test-mint',
+                  verifiedVia: 'nomos:harness-root',
                 ),
                 actor: owner,
+                authorSecret: deviceSecret,
               ),
         );
         final delegationCert =
             await plane.session(installWorkspace).signBirthCert(
                   BirthCertificate(
-                    child: workspace,
+                    child: openWorkspace,
                     founder: owner,
                     verified: true,
                     parentKey: base64Decode(devicePublic),
                     parentId: 'root',
                     epoch: Int64.ZERO,
                   ),
-                  deviceSecret,
+                  base64Decode(deviceSecret),
                 );
         await _phased(
           phase: 'application: record the parent-signed device delegation',
@@ -847,16 +725,17 @@ class NomosTestHarness {
           awaiting: 'law-declared enrollDelegation offer',
           timeout: phaseTimeout ?? _kOtherDeadline,
           onDiagnostic: onDiagnostic,
-          run: () => plane.session(installWorkspace).offerCallUsdaOutcome(
+          run: () => plane.session(installWorkspace).offerGeneratedCallOutcome(
                 call: applicationFrameworkCalls!.enrollDelegation(
                   domain: '__nomos_application_home_v1',
                   workspace: installWorkspace,
                   user: owner,
-                  deviceKey: devicePublic,
+                  deviceKey: 'key:$keyHash',
                   certificate: delegationCert,
                   enrolledAt: '1970-01-01T00:00:00.000Z',
                 ),
                 actor: owner,
+                authorSecret: deviceSecret,
               ),
         );
         final parentCert = await plane.session(installWorkspace).signBirthCert(
@@ -868,7 +747,7 @@ class NomosTestHarness {
                 parentId: 'root',
                 epoch: Int64.ZERO,
               ),
-              deviceSecret,
+              base64Decode(deviceSecret),
             );
         await _phased(
           phase: 'application: attest and warrant the application parent',
@@ -877,7 +756,7 @@ class NomosTestHarness {
           timeout: phaseTimeout ?? _kOtherDeadline,
           onDiagnostic: onDiagnostic,
           run: () async {
-            await plane.session(installWorkspace).offerCallUsdaOutcome(
+            await plane.session(installWorkspace).offerGeneratedCallOutcome(
                   call: applicationFrameworkCalls!.seedBirthAttestation(
                     domain: '__nomos_application_home_v1',
                     workspace: installWorkspace,
@@ -890,8 +769,9 @@ class NomosTestHarness {
                     links: <BirthCertificate>[parentCert],
                   ),
                   actor: owner,
+                  authorSecret: deviceSecret,
                 );
-            await plane.session(installWorkspace).offerCallUsdaOutcome(
+            await plane.session(installWorkspace).offerGeneratedCallOutcome(
                   call: applicationFrameworkCalls.seedGenesis(
                     domain: '__nomos_application_home_v1',
                     workspace: installWorkspace,
@@ -900,27 +780,28 @@ class NomosTestHarness {
                     bornAt: '1970-01-01T00:00:00.000Z',
                   ),
                   actor: owner,
+                  authorSecret: deviceSecret,
                 );
           },
         );
         final homeCert = await plane.session(installWorkspace).signBirthCert(
               BirthCertificate(
-                child: workspace,
+                child: openWorkspace,
                 founder: owner,
                 verified: true,
                 parentKey: base64Decode(devicePublic),
                 parentId: installWorkspace,
                 epoch: Int64.ZERO,
               ),
-              deviceSecret,
+              base64Decode(deviceSecret),
             );
         final outcome = await _phased(
           phase: 'application: birth the signed-in application',
-          workspace: workspace,
+          workspace: openWorkspace,
           awaiting: 'attested receiving-group birth',
           timeout: phaseTimeout ?? _kOtherDeadline,
           onDiagnostic: onDiagnostic,
-          run: () => plane.session(installWorkspace).offerCallUsdaOutcome(
+          run: () => plane.session(installWorkspace).offerGeneratedCallOutcome(
                 call: applicationFrameworkCalls!.birthReceivingGroup(
                   domain: '__nomos_application_home_v1',
                   workspace: installWorkspace,
@@ -936,32 +817,34 @@ class NomosTestHarness {
         );
         String? bornStatus;
         for (final entry in outcome.birthOutcomes) {
-          if (entry.workspace == workspace) {
+          if (entry.workspace == openWorkspace) {
             bornStatus = entry.status.name;
             break;
           }
         }
         if (outcome.born.length != 1 ||
-            outcome.born.single != workspace ||
+            outcome.born.single != openWorkspace ||
             bornStatus != 'BIRTH_OUTCOME_STATUS_BORN') {
           throw NomosTestHarnessException(
-            'the offline application parent did not birth "$workspace" cleanly '
+            'the offline application parent did not birth "$openWorkspace" cleanly '
             '(born=${outcome.born}, birthOutcomes=${outcome.birthOutcomes})',
           );
         }
         await _phased(
           phase: 'application: mount the signed-in application',
-          workspace: workspace,
+          workspace: openWorkspace,
           awaiting: 'connect born receiving group',
           timeout: phaseTimeout ?? connectTimeout,
           onDiagnostic: onDiagnostic,
-          run: () => plane.connect(
-            cloud: 'https://offline.invalid',
-            workspace: workspace,
-            session: workspace,
-            clientId: '$clientId-home',
-            authorSecret: deviceSecret,
-          ),
+          run: () async {
+            await plane.bindSession(
+              workspace: openWorkspace,
+              session: openWorkspace,
+            );
+            await plane.session(openWorkspace).refreshCredentials(
+                  authorSecret: deviceSecret,
+                );
+          },
         );
       } else if (owner != null && owner.isNotEmpty) {
         final devicePublic = info['devicePublic']?.toString();
@@ -978,22 +861,22 @@ class NomosTestHarness {
           final keyHash = sha256.convert(base64Decode(devicePublic)).toString();
           await _phased(
             phase: 'owner: seat the test device signer',
-            workspace: workspace,
+            workspace: openWorkspace,
             awaiting: 'verified test-root signer enrollment',
             timeout: phaseTimeout ?? _kOtherDeadline,
             onDiagnostic: onDiagnostic,
             // A generated TestPerson stands in for a real signed-in person. Seat the throwaway
             // harness device through the installed framework law with the same verified provenance
             // that the private test root later attests. Production clients never manufacture this
-            // marker; it exists only inside the offline test-mint ceremony.
-            run: () => plane.session(workspace).offerCallUsdaOutcome(
+            // marker; it exists only inside the offline harness ceremony.
+            run: () => plane.session(openWorkspace).offerGeneratedCallOutcome(
                   call: applicationFrameworkCalls!.enrollSigner(
                     domain: '__nomos_application_home_v1',
-                    workspace: workspace,
+                    workspace: openWorkspace,
                     keyHash: keyHash,
                     grantedBy: owner,
                     grantedAt: 1,
-                    verifiedVia: 'nomos:test-mint',
+                    verifiedVia: 'nomos:harness-root',
                   ),
                   actor: owner,
                 ),
@@ -1012,25 +895,25 @@ class NomosTestHarness {
           final bornAt = DateTime.now().toUtc().toIso8601String();
           await _phased(
             phase: 'owner: make the test application ready',
-            workspace: workspace,
+            workspace: openWorkspace,
             awaiting: 'framework owner birth',
             timeout: phaseTimeout ?? _kOtherDeadline,
             onDiagnostic: onDiagnostic,
             run: () async {
-              await plane.session(workspace).offerCallUsdaOutcome(
+              await plane.session(openWorkspace).offerGeneratedCallOutcome(
                     call: applicationFrameworkCalls!.seedReceivingGroupPolicy(
                       domain: '__nomos_application_home_v1',
-                      workspace: workspace,
+                      workspace: openWorkspace,
                       setAt: bornAt,
                     ),
                     actor: 'host-birth',
                   );
-              await plane.session(workspace).offerCallUsdaOutcome(
+              await plane.session(openWorkspace).offerGeneratedCallOutcome(
                     call: applicationFrameworkCalls.seedReceivingGroup(
                       domain: '__nomos_application_home_v1',
-                      workspace: workspace,
+                      workspace: openWorkspace,
                       principal: owner,
-                      workspaceName: _receivingGroupNameOf(owner),
+                      workspaceName: openWorkspace,
                       bornAt: bornAt,
                     ),
                     actor: 'host-birth',
@@ -1039,52 +922,48 @@ class NomosTestHarness {
           );
           final parentCert = await plane.signBirthCert(
             BirthCertificate(
-              child: workspace,
+              child: openWorkspace,
               founder: owner,
               verified: true,
               parentKey: base64Decode(devicePublic),
               parentId: 'root',
               epoch: Int64.ZERO,
             ),
-            deviceSecret,
+            base64Decode(deviceSecret),
           );
           await _phased(
             phase: 'owner: establish the verified test application root',
-            workspace: workspace,
+            workspace: openWorkspace,
             awaiting: 'birth attestation then genesis warrant',
             timeout: phaseTimeout ?? _kOtherDeadline,
             onDiagnostic: onDiagnostic,
             run: () async {
-              await plane.session(workspace).offerOutcome(
-                domain: '__nomos_application_home_v1',
-                directiveId: 'seedBirthAttestation',
-                actor: owner,
-                authorSecret: deviceSecret,
-                payload: <String, Object?>{
-                  'child': workspace,
-                  'founder': owner,
-                  'verified': 'true',
-                  'parentId': 'root',
-                  'parentKey': devicePublic,
-                  'epoch': 0,
-                  'certChain': jsonEncode(<String, Object?>{
-                    'links': <Object?>[
-                      _birthCertificateLawValue(parentCert),
-                    ],
-                  }),
-                },
-              );
-              await plane.session(workspace).offerOutcome(
-                domain: '__nomos_application_home_v1',
-                directiveId: 'seedGenesis',
-                actor: owner,
-                authorSecret: deviceSecret,
-                payload: <String, Object?>{
-                  'principal': owner,
-                  'workspaceId': workspace,
-                  'bornAt': '2000-01-01T00:00:00.000Z',
-                },
-              );
+              await plane.session(openWorkspace).offerGeneratedCallOutcome(
+                    call: applicationFrameworkCalls!.seedBirthAttestation(
+                      domain: '__nomos_application_home_v1',
+                      workspace: openWorkspace,
+                      child: openWorkspace,
+                      founder: owner,
+                      verified: 'true',
+                      parentId: 'root',
+                      parentKey: devicePublic,
+                      epoch: 0,
+                      links: <BirthCertificate>[parentCert],
+                    ),
+                    actor: owner,
+                    authorSecret: deviceSecret,
+                  );
+              await plane.session(openWorkspace).offerGeneratedCallOutcome(
+                    call: applicationFrameworkCalls.seedGenesis(
+                      domain: '__nomos_application_home_v1',
+                      workspace: openWorkspace,
+                      principal: owner,
+                      workspaceId: openWorkspace,
+                      bornAt: '2000-01-01T00:00:00.000Z',
+                    ),
+                    actor: owner,
+                    authorSecret: deviceSecret,
+                  );
             },
           );
         } on DomainNotInstalledForSession {
@@ -1105,12 +984,12 @@ class NomosTestHarness {
                   ? installedHashes.last
                   : installedHashes.first)
               .substring(0, 12);
-      phase('ready — session "$workspace" connected (law $sessionLaw)');
+      phase('ready — session "$openWorkspace" connected (law $sessionLaw)');
       // THE DECOY SESSION (multi-workspace by default in tests): sole-session inference is how
       // single-workspace assumptions ship — with one session connected, an op that forgot its session
       // silently works in tests and only refuses in production when the app connects its second
       // workspace. The decoy keeps the plane at ≥2 sessions so any unpinned op refuses HERE, in the
-      // dev's first test. [bridge] is a SESSION HANDLE pinned to [workspace], so tenant code written
+      // dev's first test. [reception] is a SESSION HANDLE pinned to the opened workspace, so tenant code written
       // against the harness keeps working unchanged; only code that grabs the raw plane and assumes
       // single-session trips. Opt out with `decoySession: false` (please don't).
       if (decoySession && !birthsApplicationHome) {
@@ -1120,60 +999,42 @@ class NomosTestHarness {
           awaiting: 'connect',
           timeout: phaseTimeout ?? connectTimeout,
           onDiagnostic: onDiagnostic,
-          run: () async => plane.connect(
-            cloud: 'https://offline.invalid',
+          run: () async => plane.bindSession(
             workspace: _decoyWorkspace,
             session: _decoyWorkspace,
-            clientId: '$clientId-decoy',
-            allowUnborn: true,
-            restoreFrom: base64Encode(await File(snapshot).readAsBytes()),
           ),
         );
       }
       final harness = NomosTestHarness._(
-        plane.session(workspace),
-        workspace,
+        plane.session(openWorkspace),
+        openWorkspace,
         transport,
         workdir,
         onDiagnostic,
-        [workspace],
+        [openWorkspace],
         devicePublics: {
           if (info['devicePublic'] != null)
-            workspace: info['devicePublic'].toString(),
+            openWorkspace: info['devicePublic'].toString(),
         },
         deviceSecrets: {
           if (info['deviceSecret'] != null)
-            workspace: info['deviceSecret'].toString(),
+            openWorkspace: info['deviceSecret'].toString(),
         },
         frameworkHash: info['frameworkHash']?.toString(),
         lawHashes: {
-          workspace: ((info['lawHashes'] as List?) ?? const [])
+          openWorkspace: ((info['lawHashes'] as List?) ?? const [])
               .map((e) => e.toString())
               .toList(),
         },
-        snapshots: {
-          workspace: base64Encode(await File(snapshot).readAsBytes()),
+        domainKeys: {
+          openWorkspace: installed.domainKeys,
+        },
+        testPeer: peer,
+        setupSessions: {
+          if (birthsApplicationHome) installWorkspace,
         },
-        installLane: _InstallLane(
-          node: node,
-          useInRepoScript: useInRepoScript,
-          inRepoScript: resolvedHelper,
-          githolonCmd: githolonCmd,
-          runtimeDir: effectiveRuntimeDir,
-          clientId: clientId,
-        ),
         phaseTimeout: phaseTimeout,
-        cloudRestartLane: _CloudRestartLane(
-          entry: entry,
-          node: node,
-          cloud: 'https://offline.invalid',
-          authToken: '',
-          authorSecret: info['deviceSecret']?.toString() ?? '',
-          clientId: clientId,
-          resolveFrom: resolveFrom,
-          environment: runnerEnvironment,
-        ),
-        homeWorkspace: workspace,
+        homeWorkspace: openWorkspace,
       );
       if (autoTearDown && registerTearDown != null) {
         registerTearDown(harness.dispose);
@@ -1187,17 +1048,16 @@ class NomosTestHarness {
         } catch (_) {}
       }
       try {
-        await workdir.delete(recursive: true);
+        await workdir?.delete(recursive: true);
       } catch (_) {}
       rethrow;
     }
   }
 
   /// A COLOCATED TEST CLUSTER — install MANY workspaces' law offline and connect one SESSION per workspace on
-  /// ONE engine plane (one runner, one transport, one [bridge]), so a cross-workspace scenario (attested
-  /// reads, foreign-source imports) runs in-process with ZERO network. Each workspace's law is installed via
-  /// the SAME offline lane [ephemeral] uses (one snapshot per workspace), then `connect`ed as its own session;
-  /// the per-connect restore snapshot loads it into the shared plane.
+  /// ONE kernel host (one runner, one transport, one [reception]), so a cross-workspace scenario (attested
+  /// reads, foreign-source imports) runs in-process with ZERO network. Each workspace has separate real Git
+  /// custody, while every operation enters the same Peer Office and kernel.
   ///
   /// [workspaces] — `{ workspaceName: [lawUsdzPaths] }` (installed in order per workspace). Get a
   /// session-scoped view with [session] and bind it to a generated client: `EstateClient(harness.session(
@@ -1212,7 +1072,6 @@ class NomosTestHarness {
     String clientId = 'test-runner',
     String? runtimeDir,
     String? nodeEntry,
-    String? installHelper,
     String? resolveFrom,
     String node = 'node',
     bool autoTearDown = true,
@@ -1234,218 +1093,75 @@ class NomosTestHarness {
         );
       }
     }
+    for (final workspace in deviceKeyed) {
+      if (!workspaces.containsKey(workspace)) {
+        throw NomosTestHarnessException(
+          'deviceKeyed names "$workspace" but it is not a workspace of this cluster — '
+          'workspaces: ${workspaces.keys.toList()}',
+        );
+      }
+    }
     final entry = nodeEntry ??
-        await _resolveEntry(node, resolveFrom ?? Directory.current.path);
+        await _resolveTestEntry(node, resolveFrom ?? Directory.current.path);
     final effectiveRuntimeDir = runtimeDir ??
         Platform.environment['NOMOS_CANDIDATE_RUNTIME'] ??
         Platform.environment['NOMOS_DART_RUNTIME'] ??
         Platform.environment['NOMOS_OFFLINE_RUNTIME'] ??
-        await _sourceCandidateRuntime(entry);
-    final adjacentInstaller = '${File(entry).parent.path}/offline-install.mjs';
-    final resolvedHelper = installHelper ??
-        (File(adjacentInstaller).existsSync()
-            ? adjacentInstaller
-            : '${File(entry).parent.path}/offline-install.ts');
-    final useInRepoScript =
-        (resolvedHelper.endsWith('.ts') || resolvedHelper.endsWith('.mjs')) &&
-            File(resolvedHelper).existsSync();
-    final githolonCmd = installHelper == null ? 'npx githolon' : resolvedHelper;
-
-    final workdir = await Directory.systemTemp.createTemp('nomos-cluster-');
-    NodeRunnerTransport? transport;
+        await _sourceCandidateRuntime(entry) ??
+        '${Platform.environment['HOME'] ?? ''}/.holon/runtime';
+    NmsTestPeer? peer;
     try {
-      // 1. install each workspace's law offline → one snapshot per workspace (colocated, still separate law).
-      final snapshots = <String, String>{};
-      final lawHashesByWs = <String, List<String>>{};
-      final installDevicePublics = <String, String>{};
-      final installDeviceSecrets = <String, String>{};
-      String? planeTestRootPublic;
-      String? planeTestRootSecret;
-      String? frameworkHash;
-      var _i = 0;
-      for (final e in workspaces.entries) {
-        final snap = '${workdir.path}/${e.key}.bin';
-        final info = await _phased(
-          phase: '1: offline law install ${++_i}/${workspaces.length}',
-          workspace: e.key,
-          awaiting: useInRepoScript
-              ? 'offline-install.ts'
-              : 'githolon harness-install',
-          timeout: phaseTimeout ?? _kInstallDeadline,
-          onDiagnostic: onDiagnostic,
-          likelyCauses: const [
-            'a cold npx download of githolon (pre-warm with any `githolon` run)',
-            'a very large law package folding through the offline gate — raise phaseTimeout',
-          ],
-          run: () => _runInstall(
-            node: node,
-            useInRepoScript: useInRepoScript,
-            inRepoScript: resolvedHelper,
-            githolonCmd: githolonCmd,
-            lawUsdzPaths: e.value,
-            workspace: e.key,
-            snapshot: snap,
-            runtimeDir: effectiveRuntimeDir,
-            onDiagnostic: onDiagnostic,
-          ),
-        );
-        snapshots[e.key] = snap;
-        lawHashesByWs[e.key] = ((info['lawHashes'] as List?) ?? const [])
-            .map((x) => x.toString())
-            .toList();
-        frameworkHash ??= info['frameworkHash']?.toString();
-        // THE HARNESS DEVICE (era-0): the install lane mints one device key per workspace — sessions sign
-        // with it and the client completes the self-serve birth ceremony (enrol + cert) with the SAME key.
-        if (info['devicePublic'] != null)
-          installDevicePublics[e.key] = info['devicePublic'].toString();
-        if (info['deviceSecret'] != null)
-          installDeviceSecrets[e.key] = info['deviceSecret'].toString();
-        planeTestRootPublic ??= info['devicePublic']?.toString();
-        planeTestRootSecret ??= info['deviceSecret']?.toString();
-      }
-
-      // 2. ONE runner / ONE bridge for the whole plane — no env restore default; each connect brings its own.
-      final phase = (String m) {
-        if (onDiagnostic != null) onDiagnostic('[nomos-test-harness] $m');
-      };
-      transport = await _phased(
-        phase: '2: spawn the node runner (${workspaces.length} workspace(s))',
-        awaiting: 'Process.start($node)',
+      peer = await _phased(
+        phase: '1/2: open canonical test peer',
+        awaiting: 'Peer Office + filesystem Git custody',
         timeout: phaseTimeout ?? _kSpawnDeadline,
         onDiagnostic: onDiagnostic,
-        run: () => NodeRunnerTransport.start(
+        run: () => NmsTestPeer.start(
           entry: entry,
+          runtimeDirectory: effectiveRuntimeDir,
           resolveFrom: resolveFrom,
           node: node,
-          environment: {
-            'NOMOS_OFFLINE': '1',
-            'NOMOS_OFFLINE_WASM': 'holon-testmint.wasm',
-            if (planeTestRootPublic != null)
-              'NOMOS_TEST_K_ROOT_PUBLIC': planeTestRootPublic,
-            if (planeTestRootSecret != null)
-              'NOMOS_TEST_ROOT_SECRET': planeTestRootSecret,
-            if (effectiveRuntimeDir != null)
-              'NOMOS_OFFLINE_RUNTIME': effectiveRuntimeDir,
-          },
           onDiagnostic: onDiagnostic,
         ),
       );
-      final bridge = NomosBridge(transport!);
-      await _phased(
-        phase: '2: runner ready',
-        awaiting: "event:'ready'",
-        timeout: phaseTimeout ?? readyTimeout,
-        onDiagnostic: onDiagnostic,
-        likelyCauses: const [
-          'node is not on PATH, or ~/.holon/runtime is cold (holon-testmint.wasm + framework law archives)',
-          'the runner process failed to boot the engine — run with onDiagnostic to see its stderr',
-        ],
-        run: () => bridge.ready,
-      );
-
-      // 3. connect one SESSION per workspace, each restoring its OWN snapshot — LOCAL-ONLY (no cloud;
-      //    these are local githolons on the device plane, offline by nature).
-      final snapshotB64 = <String, String>{};
-      var _n = 0;
+      final lawHashesByWs = <String, List<String>>{};
+      final domainKeysByWs = <String, Set<String>>{};
+      final devicePublics = <String, String>{};
+      final deviceSecrets = <String, String>{};
+      String? frameworkHash;
+      var index = 0;
       for (final e in workspaces.entries) {
-        snapshotB64[e.key] = base64Encode(
-          await File(snapshots[e.key]!).readAsBytes(),
-        );
-        await _phased(
-          phase: '3: connect session ${++_n}/${workspaces.length}',
+        final installed = await _phased(
+          phase: '2/2: install workspace ${++index}/${workspaces.length}',
           workspace: e.key,
-          awaiting: 'connect',
-          timeout: phaseTimeout ?? connectTimeout,
+          awaiting: 'genesis offer + ordinary lifecycle offers',
+          timeout: phaseTimeout ?? _kInstallDeadline,
           onDiagnostic: onDiagnostic,
-          likelyCauses: const [
-            'a large ledger converge-fold can be slow — raise connectTimeout/phaseTimeout',
-            'run with onDiagnostic to see where the runner blocked',
-          ],
-          run: () => bridge.connect(
+          run: () => peer!.installWorkspace(
             workspace: e.key,
-            session: e.key,
-            clientId: '$clientId-${e.key}',
-            restoreFrom: snapshotB64[e.key],
-            allowUnborn: true,
-            // signed with the install-lane harness device (era-0 self-serve birth ceremony key)
-            authorSecret: installDeviceSecrets[e.key],
-          ),
-        );
-      }
-      phase('cluster: ${workspaces.length} session(s) connected');
-
-      // 3b. DEVICE-KEY the named sessions: mint a fresh in-kernel key on each (now that it is mounted) and
-      //     RE-OPEN it with that key as its signing authorSecret — the resolver's attested-read signing key.
-      //     The re-open is the runner's ATOMIC session replace (dispose-then-connect under the hood); each
-      //     leg runs as a named, deadlined phase so a wedge is a typed HarnessPhaseTimeout, never a hang.
-      final devicePublics = <String, String>{};
-      final deviceSecretsKeyed = <String, String>{};
-      for (final ws in deviceKeyed) {
-        if (!workspaces.containsKey(ws)) {
-          throw NomosTestHarnessException(
-            'deviceKeyed names "$ws" but it is not a workspace of this cluster — '
-            'workspaces: ${workspaces.keys.toList()}',
-          );
-        }
-        final kp = await _phased(
-          phase: '3b: device keygen',
-          workspace: ws,
-          awaiting: 'authorKeygen',
-          timeout: phaseTimeout ?? _kOtherDeadline,
-          onDiagnostic: onDiagnostic,
-          run: () => bridge.session(ws).authorKeygen(),
-        );
-        devicePublics[ws] = (kp['public'] ?? '').toString();
-        deviceSecretsKeyed[ws] = (kp['secret'] ?? '').toString();
-        await _phased(
-          phase: "3b: keyed reconnect of '$ws'",
-          workspace: ws,
-          awaiting: 'connect',
-          timeout: phaseTimeout ?? connectTimeout,
-          onDiagnostic: onDiagnostic,
-          likelyCauses: const [
-            'the runner never answered the re-connect of an already-open session — '
-                'update @githolon/client (the session re-open is an atomic replace)',
-            'a large ledger re-fold on the re-mount — raise connectTimeout/phaseTimeout',
-          ],
-          run: () => bridge.connect(
-            workspace: ws,
-            session: ws,
-            clientId: '$clientId-$ws',
-            restoreFrom: snapshotB64[ws],
-            authorSecret: (kp['secret'] ?? '').toString(),
-            allowUnborn: true,
+            lawUsdzPaths: e.value,
           ),
         );
+        lawHashesByWs[e.key] = installed.lawHashes;
+        domainKeysByWs[e.key] = installed.domainKeys;
+        frameworkHash ??= installed.controllerHash;
+        devicePublics[e.key] = base64Encode(installed.deviceKey.publicKey);
+        deviceSecrets[e.key] = base64Encode(installed.deviceKey.secret);
       }
-      if (deviceKeyed.isNotEmpty) {
-        phase(
-          'cluster: ${deviceKeyed.length} device-keyed session(s) re-opened',
-        );
-      }
-
       final names = workspaces.keys.toList();
       final harness = NomosTestHarness._(
-        bridge,
+        peer!.reception,
         names.first,
-        transport,
-        workdir,
+        peer.transport,
+        peer.custody.directory,
         onDiagnostic,
         names,
-        // install-lane harness devices under; explicit deviceKeyed re-opens override for their ws
-        devicePublics: {...installDevicePublics, ...devicePublics},
-        deviceSecrets: {...installDeviceSecrets, ...deviceSecretsKeyed},
+        devicePublics: devicePublics,
+        deviceSecrets: deviceSecrets,
         frameworkHash: frameworkHash,
         lawHashes: lawHashesByWs,
-        snapshots: snapshotB64,
-        installLane: _InstallLane(
-          node: node,
-          useInRepoScript: useInRepoScript,
-          inRepoScript: resolvedHelper,
-          githolonCmd: githolonCmd,
-          runtimeDir: effectiveRuntimeDir,
-          clientId: clientId,
-        ),
+        domainKeys: domainKeysByWs,
+        testPeer: peer,
         phaseTimeout: phaseTimeout,
       );
       if (autoTearDown && registerTearDown != null) {
@@ -1453,23 +1169,16 @@ class NomosTestHarness {
       }
       return harness;
     } catch (_) {
-      if (transport != null) {
-        try {
-          await transport.dispose();
-        } catch (_) {}
-      }
-      try {
-        await workdir.delete(recursive: true);
-      } catch (_) {}
+      await peer?.dispose();
       rethrow;
     }
   }
 
   /// CLOUD-BOUND HARNESS (co2's real-app topology): a [NomosTestCloud] plays the remote control plane, the
   /// REAL authenticated home-birth ceremony runs REMOTELY on [platformWorkspace], and the born home is
-  /// mounted into ONE local engine plane as a normal cloud-bound [NomosSession] ([homeSession]). From there
+  /// mounted into ONE local kernel host as a normal cloud-bound [NomosSession] ([homeSession]). From there
   /// the app shape holds exactly: generated `.births()` directives run LOCALLY (the app never clones the
-  /// platform), children open as sibling sessions (`outcome.bornRefs.single.acquire(harness.bridge)`),
+  /// platform), children open as sibling sessions (`outcome.bornRefs.single.acquire(harness.reception)`),
   /// writes/projections work offline, and [converge] establishes remote custody parent-first when
   /// connectivity returns ([NomosTestCloud.setOnline]). Entirely inside the test cloud's trust universe.
   ///
@@ -1503,6 +1212,11 @@ class NomosTestHarness {
     Duration connectTimeout = const Duration(seconds: 120),
     Duration? phaseTimeout,
     bool decoySession = true,
+
+    /// Where the spawned node peer keeps its Git custody. A directory here makes that custody durable
+    /// across the peer's restarts (the local-first restart lane); absent, the peer uses a temporary
+    /// directory it removes on exit. NOMOS_NODE_PEER_CUSTODY names one for a whole test run.
+    String? nodePeerCustody,
   }) async {
     if (lawUsdzPaths.isEmpty) {
       throw NomosTestHarnessException(
@@ -1520,6 +1234,26 @@ class NomosTestHarness {
         await _resolveEntry(node, resolveFrom ?? Directory.current.path);
     final bareUid =
         subject.startsWith('user:') ? subject.substring(5) : subject;
+    // THE OPERATOR SEAM, AND THE ONLY RAW HOST LANE LEFT IN THIS FILE.
+    //
+    // `cloudBound` stands a REMOTE test cloud up before any custody exists on
+    // this device. In that moment the harness is acting as an OPERATOR, not as a
+    // client: there is no session, no mounted workspace, and therefore no typed
+    // office paper that could carry these — every Runtime v2 read answers from
+    // local custody the harness does not yet have. Exactly three calls remain,
+    // and each is a host control-plane route with no client equivalent:
+    //
+    //   POST /v2/workspaces/<platform>     boot the born platform (idempotent)
+    //   GET  /v2/workspaces/<platform>/domains   its installed law, before custody
+    //   POST /dev/mint-token               the LOCAL dev server's test identity
+    //                                      provider — a fixture route, not a
+    //                                      Nomos host route at all
+    //
+    // What was here and is gone: a `GET /openapi.json` scrape whose only product
+    // was a domain name the compiled framework calls already carry. Everything
+    // after this phase — every offer, every read, the whole birth ceremony —
+    // goes through the office. Nothing below may grow a fourth probe: if a
+    // client would need it, it belongs on a desk.
     final http = HttpClient();
     Future<Map<String, Object?>> post(
       String path,
@@ -1569,13 +1303,12 @@ class NomosTestHarness {
       //       server's in-process operator lane). Booting a born workspace is idempotent; an unborn one
       //       refuses 409, surfaced here with the fix.
       String? frameworkHash;
-      final frameworkPostRoutes =
-          <({String domain, String directive, String path})>[];
       final lawHashes = <String>[];
+      late NomosBoundInteraction applicationInteraction;
       await _phased(
         phase: '1/6: boot the born platform + inspect installed law',
         workspace: platformWorkspace,
-        awaiting: 'POST /v2/workspaces + GET /domains + /openapi.json',
+        awaiting: 'boot the born platform + read its installed law',
         timeout: phaseTimeout ?? _kInstallDeadline,
         onDiagnostic: onDiagnostic,
         run: () async {
@@ -1623,30 +1356,6 @@ class NomosTestHarness {
               in (((existing['currentLaw'] as Map?) ?? const {}).values)) {
             rememberLaw(hash);
           }
-          final openapi = await get(
-            '/v2/workspaces/$platformWorkspace/openapi.json',
-          );
-          final pathSets = <Map>[
-            (openapi['paths'] as Map?) ?? const {},
-            (((openapi['x-nomos-framework-routes'] as Map?)?['paths'])
-                    as Map?) ??
-                const {},
-          ];
-          for (final paths in pathSets) {
-            for (final entry in paths.entries) {
-              final operation = (entry.value as Map?)?['post'] as Map?;
-              final route = operation?['x-nomos'] as Map?;
-              final domain = route?['domain']?.toString() ?? '';
-              final directive = route?['directiveId']?.toString() ?? '';
-              if (domain.isNotEmpty && directive.isNotEmpty) {
-                frameworkPostRoutes.add((
-                  domain: domain,
-                  directive: directive,
-                  path: entry.key.toString(),
-                ));
-              }
-            }
-          }
         },
       );
       if (frameworkHash == null || frameworkHash!.isEmpty) {
@@ -1659,19 +1368,13 @@ class NomosTestHarness {
           'cloudBound: the born test platform reported no installed application law — cannot run the birth ceremony',
         );
       }
-      final birthRoutes = frameworkPostRoutes
-          .where(
-            (route) =>
-                route.directive == 'nomosInternalBirthReceivingGroup7c1f5e',
-          )
-          .toSet()
-          .toList();
-      if (birthRoutes.length != 1) {
-        throw NomosTestHarnessException(
-          'cloudBound: the deployed package must expose exactly one framework receiving-group route; found ${birthRoutes.length}',
-        );
-      }
-      final applicationHomeDomain = birthRoutes.single.domain;
+      // THE COMPILED DESCRIPTOR NAMES ITS OWN DOMAIN. This used to scrape the
+      // platform's `/openapi.json` for the framework birth route and read the
+      // domain off it — a raw JSON probe of the host to learn a fact the
+      // application's generated framework calls already carry, and whose scraped
+      // paths were never sent anything: remote offers go through
+      // `nomosInternalOfferRemoteGeneratedCall`, which routes by generated call.
+      final applicationHomeDomain = frameworkCalls.applicationHomeDomain;
       // A composed application has two distinct laws at this seam:
       //   * the parent's CURRENT control law authors enrollFirstDevice + the birth offer;
       //   * the application's final PAYLOAD package is the law installed into the born receiving group.
@@ -1697,25 +1400,7 @@ class NomosTestHarness {
         );
       }
       final applicationHomeLawHash = lawHashes.last;
-      final enrollmentRoutes = frameworkPostRoutes
-          .where(
-            (route) =>
-                route.directive == 'enrollFirstDevice' &&
-                route.domain == applicationHomeDomain,
-          )
-          .toSet()
-          .toList();
-      if (enrollmentRoutes.length != 1) {
-        throw NomosTestHarnessException(
-          "cloudBound: application/home domain '$applicationHomeDomain' must expose exactly one semantic enrollFirstDevice route; found ${enrollmentRoutes.length}",
-        );
-      }
-      if (enrollmentRoutes.single.path.isEmpty) {
-        throw NomosTestHarnessException(
-          'cloudBound: enrollFirstDevice generated an empty relay path',
-        );
-      }
-      // 2/6 — the LOCAL engine plane, CLOUD-BOUND, spawned BEFORE the birth: the runner's local kernel is
+      // 2/6 — the LOCAL kernel host, CLOUD-BOUND, spawned BEFORE the birth: the runner's local kernel is
       //       what mints the device key + signs the birth cert (era-0: a birth is ATTESTED or not at all).
       // The executable AND its framework-law packages are one runtime bundle in device custody. A process
       // restart while offline must not fetch any member before it can replay the persisted ledger. Release CI
@@ -1724,18 +1409,15 @@ class NomosTestHarness {
       final candidateRuntimeDir = Platform.environment['NOMOS_DART_RUNTIME'] ??
           Platform.environment['NOMOS_OFFLINE_RUNTIME'];
       final localRuntime = await Directory(
-        '${workdir.path}/client-runtime',
+        '${workdir.path}/peer-office-runtime',
       ).create(recursive: true);
-      final selectedKernel = cloud.testKRootPublic == null
-          ? _CandidateKernelBinary.production
-          : _CandidateKernelBinary.testMint;
       final candidateArtifacts = candidateRuntimeDir == null
           ? const <_KernelRuntimeArtifact, String>{}
           : <_KernelRuntimeArtifact, String>{
               _KernelRuntimeArtifact.executable:
-                  '$candidateRuntimeDir/${selectedKernel.fileName}',
+                  '$candidateRuntimeDir/holon.wasm',
               _KernelRuntimeArtifact.repository:
-                  '$candidateRuntimeDir/${selectedKernel == _CandidateKernelBinary.production ? 'kernel.repository.xml' : 'kernel-testmint.repository.xml'}',
+                  '$candidateRuntimeDir/kernel.repository.xml',
               _KernelRuntimeArtifact.stageZeroLaw:
                   '$candidateRuntimeDir/${_KernelRuntimeArtifact.stageZeroLaw.fileName}',
               _KernelRuntimeArtifact.controllerLaw:
@@ -1781,12 +1463,22 @@ class NomosTestHarness {
           },
         );
       }
-      final runnerEnvironment = <String, String>{
-        ...Platform.environment,
+      final custodyDirectory = nodePeerCustody ??
+          Platform.environment['NOMOS_NODE_PEER_CUSTODY'] ??
+          '${workdir.path}/device';
+      final runnerArguments = <String>[
+        '--runtime-bundle=${localRuntime.path}',
+        '--discovery-provider=${cloud.origin}',
         if (cloud.testKRootPublic != null)
-          'NOMOS_TEST_K_ROOT_PUBLIC': cloud.testKRootPublic!,
-        'NOMOS_LOCAL_RUNTIME_DIR': localRuntime.path,
-      };
+          '--trust-root-public-key=${cloud.testKRootPublic}',
+        // Under --diagnostics the spawned peer narrates every frame (command → outcome) to its stderr,
+        // which this harness relays as `Shell:` lines.
+        if (Platform.environment['NOMOS_TEST_DIAGNOSTICS'] == '1')
+          '--trace=frames',
+        // Process memory is disposable; restart must reuse this device's disk.
+        // Keep default custody under the harness-owned root until dispose.
+        '--custody=$custodyDirectory',
+      ];
       transport = await _phased(
         phase: '2/6: spawn the node runner (cloud-bound)',
         awaiting: 'Process.start($node)',
@@ -1796,11 +1488,11 @@ class NomosTestHarness {
           entry: entry,
           resolveFrom: resolveFrom,
           node: node,
-          environment: runnerEnvironment,
+          arguments: runnerArguments,
           onDiagnostic: onDiagnostic,
         ),
       );
-      final plane = NomosBridge(transport!);
+      final plane = DartReception(transport!);
       await _phased(
         phase: '3/6: runner ready',
         awaiting: "event:'ready'",
@@ -1826,21 +1518,18 @@ class NomosTestHarness {
           // tolerated): a PRIVATE platform (declared read caps — co2's shape) refuses an
           // unauthenticated ledger clone, and the ceremony never needs the platform's ledger anyway
           // (its writes go over the HTTP gateway below).
-          await plane.connect(
-            cloud: cloud.origin,
+          await plane.bindSession(
             workspace: '$clientId-onboard-scratch',
             session: '$clientId-onboard-scratch',
-            clientId: '$clientId-onboard',
-            allowUnborn: true,
           );
           final kp = await plane.authorKeygen();
-          final publicB64 = (kp['public'] ?? '').toString();
-          final secret = (kp['secret'] ?? '').toString();
-          if (publicB64.isEmpty || secret.isEmpty) {
+          if (kp.publicKey.length != 32 || kp.secret.length != 32) {
             throw NomosTestHarnessException(
               'cloudBound: authorKeygen returned no device key',
             );
           }
+          final publicB64 = base64Encode(kp.publicKey);
+          final secret = base64Encode(kp.secret);
           final keyHash = sha256.convert(base64Decode(publicB64)).toString();
           final minted = await post('/dev/mint-token', {
             'sub': bareUid,
@@ -1859,16 +1548,16 @@ class NomosTestHarness {
           // WITHOUT it the platform holds no delegation for the owner, the assembly falls to the
           // no-delegation branch, the platform_cert lands in the delegation slot, and the home refuses at
           // its OWN verify door ("home cert founder != delegation cert founder").
-          final delegationCert = await plane.mintKeylessDelegation({
-            'user': subject,
-            'deviceKey': publicB64,
-            'childName': _receivingGroupNameOf(subject),
-            'parentId': platformWorkspace,
-            'verifiedVia': issuer,
-            'idpToken': idpToken,
-            'capturedClock': DateTime.now().toUtc().millisecondsSinceEpoch,
-            'epoch': 0,
-          }, secret);
+          final delegationCert = await plane.mintKeylessDelegation(
+            user: subject,
+            devicePublic: kp.publicKey,
+            childName: await plane.nmsReceivingGroupWorkspace(subject),
+            parentId: platformWorkspace,
+            verifiedVia: issuer,
+            idpToken: idpToken,
+            capturedClock: DateTime.now().toUtc().millisecondsSinceEpoch,
+            deviceSecret: kp.secret,
+          );
           return (
             publicB64: publicB64,
             secret: secret,
@@ -1889,85 +1578,109 @@ class NomosTestHarness {
         timeout: phaseTimeout ?? _kInstallDeadline,
         onDiagnostic: onDiagnostic,
         run: () async {
-          final homeName = _receivingGroupNameOf(subject);
+          final homeName = await plane.nmsReceivingGroupWorkspace(subject);
           final bornAt = DateTime.now().toUtc().toIso8601String();
-          final result = await plane
-              .session('$clientId-onboard-scratch')
-              .nomosInternalBirthReceivingGroup(
-                parent: platformWorkspace,
-                principal: bareUid,
-                subject: subject,
-                device: {
-                  'public': device.publicB64,
-                  'secret': device.secret,
-                },
-                authToken: device.idpToken,
-                idToken: device.idpToken,
-                verifiedVia: device.issuer,
-                bornAt: bornAt,
-                enrollFirstDeviceCall: frameworkCalls.enrollFirstDevice(
-                  domain: applicationHomeDomain,
-                  workspace: platformWorkspace,
-                  keyHash: device.keyHash,
-                  verifiedVia: device.issuer,
-                  validFromEpoch: 0,
-                  grantedAt: bornAt,
-                  idpToken: device.idpToken,
-                  delegationCertificate: device.delegationCert,
-                ),
-                birthReceivingGroupCall: frameworkCalls.birthReceivingGroup(
-                  domain: applicationHomeDomain,
-                  workspace: platformWorkspace,
-                  owner: subject,
-                  frameworkHash: Sha256Digest(frameworkHash!),
-                  lawHash: Sha256Digest(applicationHomeLawHash),
-                  bornAt: bornAt,
-                ),
-                confirm: true,
-              );
-          if (result.home != homeName) {
-            throw NomosTestHarnessException(
-              'cloudBound: production custody ceremony returned ${result.home} instead of "$homeName"',
-            );
-          }
-          if (!result.verified) {
-            throw NomosTestHarnessException(
-              'cloudBound: born Home failed kernel verification: ${result.verificationError}',
-            );
-          }
+          final scratch = plane.session('$clientId-onboard-scratch');
+          final enrolled = await scratch.nomosInternalOfferRemoteGeneratedCall(
+            targetWorkspace: platformWorkspace,
+            actor: subject,
+            authorSecret: device.secret,
+            authToken: device.idpToken,
+            call: frameworkCalls.enrollFirstDevice(
+              domain: applicationHomeDomain,
+              workspace: platformWorkspace,
+              keyHash: device.keyHash,
+              verifiedVia: device.issuer,
+              validFromEpoch: 0,
+              grantedAt: bornAt,
+              idpToken: device.idpToken,
+              delegationCertificate: device.delegationCert,
+            ),
+          );
+          // The Home's OWN certificate: plain, device-signed, no keyless fields — the delegation
+          // enrolled above rides the chain as its own link (see mintHomeBirthCertificate).
+          final homeCert = await plane.mintHomeBirthCertificate(
+            user: subject,
+            devicePublic: base64Decode(device.publicB64),
+            childName: homeName,
+            parentId: platformWorkspace,
+            deviceSecret: base64Decode(device.secret),
+          );
+          await scratch.nomosInternalOfferRemoteGeneratedCall(
+            targetWorkspace: platformWorkspace,
+            actor: subject,
+            authorSecret: device.secret,
+            authToken: device.idpToken,
+            call: frameworkCalls.birthReceivingGroup(
+              domain: applicationHomeDomain,
+              workspace: platformWorkspace,
+              owner: subject,
+              frameworkHash: Sha256Digest(frameworkHash!),
+              lawHash: Sha256Digest(applicationHomeLawHash),
+              bornAt: bornAt,
+            ),
+            birthCertificate: homeCert,
+            requiredTargetHead: enrolled.head,
+          );
           home = homeName;
         },
       );
-      // 6/6 — mount the born home as a normal cloud-bound session (clone from the test cloud).
+      // 6/6 — bind the interaction, then observe the local verification postcondition.
+      // Binding owns no custody. The cloud's published retained placement independently
+      // drives Replica Follow; this test barrier observes readiness and never starts sync.
       await _phased(
         phase: '6/6: mount the born home',
         workspace: home,
-        awaiting: 'connect(cloud:, workspace: $home)',
+        awaiting: 'retained Home custody and local chain verification',
         timeout: phaseTimeout ?? connectTimeout,
         onDiagnostic: onDiagnostic,
-        run: () => plane.connect(
-          cloud: cloud.origin,
-          workspace: home!,
-          clientId: clientId,
+        run: () async {
           // A PRIVATE home (declared read caps — co2's shape) serves its ledger only to a VERIFIED
           // principal: ride the caller's token when given, else the dev-IdP token the ceremony minted.
-          authToken: authToken ?? device.idpToken,
-          // The home was born WARRANTED with THIS device enrolled by the kernel-owned attestation step —
-          // connect with the same key so every write is signed and the home's own `.births()` offers
-          // (estates/catalogues) are device-attested (the client signs the birth cert automatically).
-          authorSecret: device.secret,
-        ),
-      );
-      // A cloud-bound generated application owns continuous convergence from the moment its home is
-      // mounted. Starting it here makes the harness exercise the product lifecycle: local writes flush,
-      // transport debt survives a partition, and reconnect settles exact operation receipts without tenant
-      // code calling sync(). Child sessions take the same path in acquireSession().
-      final applicationSession = plane.session(home!);
-      applicationSession.nomosInternalRetainCloudAccess(
-        cloud: cloud.origin,
-        signIn: () async => authToken ?? device.idpToken,
+          // The home was born WARRANTED with THIS device enrolled by the kernel-owned attestation step,
+          // so the same key signs every later write and its own `.births()` offers.
+          await plane.session('$clientId-onboard-scratch').refreshCredentials(
+                authToken: authToken ?? device.idpToken,
+                authorSecret: device.secret,
+              );
+          applicationInteraction = await plane.bindSession(
+            workspace: home!,
+            session: home!,
+            credentialSourceSession: '$clientId-onboard-scratch',
+          );
+          plane.nomosInternalRegisterCredentialProvider(
+            interaction: applicationInteraction,
+            cloud: cloud.origin,
+            signIn: ({deviceChallenge}) async => authToken ?? device.idpToken,
+          );
+          final deadline = DateTime.now().add(phaseTimeout ?? connectTimeout);
+          while (true) {
+            try {
+              final verdict = await plane.session(home!).verifyChain();
+              if (!verdict.valid) {
+                throw NomosTestHarnessException(
+                  'cloudBound: born Home failed kernel verification: '
+                  '${verdict.hasError() ? verdict.error : 'unknown refusal'}',
+                );
+              }
+              break;
+            } on NomosUnavailable catch (unavailable) {
+              if (!unavailable.retryable ||
+                  !{
+                    NomosUnavailableReason.localReplicaNotReady,
+                    NomosUnavailableReason.workspaceOpening,
+                  }.contains(unavailable.reason) ||
+                  DateTime.now().isAfter(deadline)) rethrow;
+              onDiagnostic?.call(
+                '[nomos-test-harness] waiting for retained Home: ${unavailable.reason.name}',
+              );
+              await Future<void>.delayed(
+                unavailable.retryAfter ?? const Duration(milliseconds: 100),
+              );
+            }
+          }
+        },
       );
-      await applicationSession.autoSync(fallbackMs: 60000);
       // NO DECOY on a cloudBound harness: the app is genuinely multi-workspace (the home plus every
       // locally-born child), so the plane is never sole-session — the decoy the offline  harness
       // needs (to break single-session inference) would just be a spurious local-only workspace here.
@@ -1994,7 +1707,10 @@ class NomosTestHarness {
           entry: entry,
           resolveFrom: resolveFrom,
           node: node,
-          environment: runnerEnvironment,
+          arguments: runnerArguments
+              .where((arg) => !arg.startsWith('--custody='))
+              .toList(),
+          custodyDirectory: custodyDirectory,
           cloud: cloud.origin,
           authToken: authToken ?? device.idpToken,
           authorSecret: device.secret,
@@ -2020,10 +1736,6 @@ class NomosTestHarness {
     }
   }
 
-  /// Compiler/runtime-only receiving-group address. The law independently re-derives the same value.
-  static String _receivingGroupNameOf(String principal) =>
-      'nomos-rg-${sha256.convert(utf8.encode(principal)).toString().substring(0, 40)}';
-
   /// CONVERGE local custody with the test cloud (co2 topology step 8): sync every connected session —
   /// PARENT-FIRST by connect order, so the home's chain lands remotely and its birth offer-effects create
   /// each locally-born child's remote custody BEFORE that child's own sync converges against it. Repeats
@@ -2047,7 +1759,7 @@ class NomosTestHarness {
     while (pending.isNotEmpty) {
       for (final ws in List.of(pending)) {
         try {
-          final r = await bridge.session(ws).sync(admit: true);
+          final r = await _syncForTest(ws);
           last[ws] = r;
           lastErrors.remove(ws);
           final permanentFailure = nmsPermanentConvergenceFailure(r);
@@ -2056,8 +1768,7 @@ class NomosTestHarness {
               'converge: $ws rejected or dead-lettered business work — $permanentFailure',
             );
           }
-          if (!r.pushFailed && !r.stillAhead && !r.offline && r.deferred == 0)
-            pending.remove(ws);
+          if (nmsRemoteConvergenceSettled(r)) pending.remove(ws);
         } on NomosTestHarnessException {
           rethrow;
         } catch (e) {
@@ -2076,12 +1787,119 @@ class NomosTestHarness {
     return last;
   }
 
+  /// Test-only convergence control. Production application sessions cannot
+  /// drive Replica Follow; cloud fixtures need an explicit completion barrier.
+  Future<SyncWorkspaceResponse> _syncForTest(String workspace) async {
+    final runtime = _transport as NomosRuntimeV2Transport;
+    final response = await runtime.invokeRuntime(protocol.RuntimeRequest(
+      protocolVersion: 2,
+      requestId: Int64(runtime.nextRuntimeRequestId()),
+      syncWorkspace: protocol.SyncWorkspaceRequest(
+        workspace: workspace,
+        admit: true,
+      ),
+    ));
+    if (!response.hasSyncWorkspace()) {
+      throw StateError(
+        'Test convergence returned ${response.whichOutcome().name}'
+        '${response.hasFailure() ? ': ${response.failure.code}: ${response.failure.message}' : ''}',
+      );
+    }
+    return response.syncWorkspace;
+  }
+
   // ── CUSTODY DIAGNOSTIC HELPERS (architecture/session_bound_clients.md ask 9) ──
 
-  /// The raw multi-workspace plane under [bridge] (the session handle a single-workspace harness
+  /// Capture a point for a retained-upgrade fixture in this throwaway peer.
+  Future<NomosTestFrontier> captureLocalFrontier(String workspace,
+      {NomosTestFrontier? after}) async {
+    if (_testPeer == null || testCloud != null) {
+      throw StateError(
+          'Retained frontier fixtures require an isolated local test peer.');
+    }
+    if (!_plane.boundSessions.contains(workspace)) {
+      throw StateError('Capture requires an already-open local workspace.');
+    }
+    if (after != null) {
+      _requireLocalFrontier(after);
+      if (after.workspace != workspace)
+        throw StateError('Fixture base belongs to another workspace.');
+    }
+    final runtime = _transport as NomosRuntimeV2Transport;
+    final exported = await runtime.invokeRuntime(protocol.RuntimeRequest(
+      protocolVersion: 2,
+      requestId: Int64(runtime.nextRuntimeRequestId()),
+      exportLiveOffers: protocol.ExportLiveOffersRequest(
+          session: workspace, baseHead: after?.head ?? ''),
+    ));
+    if (!exported.hasLiveOffers()) {
+      // The office answers a refusal as a typed failure, not as an absent field. Reporting only
+      // "not exported" threw that away and every caller — the bench bridge included — saw a
+      // sentence that named neither the workspace nor the reason.
+      final because = exported.hasFailure()
+          ? '${exported.failure.code}: ${exported.failure.message}'
+          : 'the office answered ${exported.whichOutcome().name}';
+      throw StateError(
+          "Test frontier offers were not exported for '$workspace' — $because");
+    }
+    return NomosTestFrontier._(this, workspace,
+        await _plane.session(workspace).head(), exported.liveOffers);
+  }
+
+  /// Arrange a stale retained target before opening the presentation under test.
+  /// The test process stops before selecting an earlier already-authenticated
+  /// Git point. Restart uses ordinary authenticated custody open; production
+  /// and connected peers are ineligible. This is fixture arrangement, not sync.
+  Future<void> arrangeRetainedFrontier(NomosTestFrontier frontier) async {
+    _requireLocalFrontier(frontier);
+    await restart(retainedFixture: frontier);
+  }
+
+  /// Deliver already retained Git history through ordinary offer-gated sync.
+  /// Reception owns subscription invalidation; the test cannot fabricate rows.
+  Future<String> admitRetainedAdvance(NomosTestFrontier frontier) async {
+    _requireLocalFrontier(frontier);
+    if (!frontier._offers.hasInline() ||
+        frontier._offers.inline.offers.isEmpty) {
+      throw StateError(
+          'Capture the advancing frontier with its earlier fixture base.');
+    }
+    final runtime = _transport as NomosRuntimeV2Transport;
+    final response = await runtime.invokeRuntime(protocol.RuntimeRequest(
+      protocolVersion: 2,
+      requestId: Int64(runtime.nextRuntimeRequestId()),
+      target: protocol.InvocationTarget(
+          workspace: frontier.workspace, session: frontier.workspace),
+      admitCustodyOffers: frontier._offers,
+    ));
+    if (!response.hasCustodyOffersAdmitted() ||
+        response.custodyOffersAdmitted.sessions
+                .expand((session) => session.intents)
+                .length !=
+            frontier._offers.inline.offers.length ||
+        response.custodyOffersAdmitted.sessions
+            .expand((session) => session.intents)
+            .any((intent) => !intent.hasAdmitted() && !intent.hasSkipped()) ||
+        await _plane.session(frontier.workspace).head() !=
+            response.custodyOffersAdmitted.main) {
+      throw StateError('Retained fixture advance was not admitted: $response');
+    }
+    return response.custodyOffersAdmitted.main;
+  }
+
+  void _requireLocalFrontier(NomosTestFrontier frontier) {
+    if (_testPeer == null ||
+        testCloud != null ||
+        !identical(frontier._owner, this)) {
+      throw StateError(
+          'Frontier belongs to another or non-isolated test peer.');
+    }
+  }
+
+  /// The raw multi-workspace plane under [reception] (the session handle a single-workspace harness
   /// hands out is a view on it).
-  NomosBridge get _plane {
-    final b = bridge;
+  DartReception get _plane {
+    final b = reception;
     return b is NomosSession ? b.parent : b;
   }
 
@@ -2094,52 +1912,56 @@ class NomosTestHarness {
     final lane = _cloudRestartLane;
     final ceremonySessions = <String>{
       _decoyWorkspace,
+      ..._setupSessions,
       if (lane != null) '${lane.clientId}-onboard-scratch',
       if (lane != null) '${lane.clientId}-platform-author',
     };
-    return _plane.connectedSessions
+    return _plane.boundSessions
         .where((session) => !ceremonySessions.contains(session))
         .toList();
   }
 
-  /// RESET a workspace's LOCAL custody to the snapshot it was seeded from — the "stale/corrupt
-  /// local custody" repair move in tests. Reconnects the session in place (watches on the old
-  /// holon are stopped by the runner's re-connect semantics).
-  Future<void> resetWorkspaceCustody(String workspace) async {
-    final snap = _snapshots[workspace];
-    if (snap == null) {
+  /// Cold-reopen a workspace from the same real Git custody directory.
+  ///
+  /// This deliberately does not reset or deserialize custody. Git is the
+  /// durable test state; reopening proves the Peer Office can remount it.
+  Future<void> reopenWorkspaceCustody(String workspace) async {
+    if (!_sessionNames.contains(workspace)) {
       throw NomosTestHarnessException(
-        'resetWorkspaceCustody("$workspace"): no seed snapshot held for this workspace — '
-        'seeded workspaces: ${_snapshots.keys.toList()}',
+        'reopenWorkspaceCustody("$workspace"): workspace is not mounted',
       );
     }
     await _phased(
-      phase: 'resetWorkspaceCustody: reconnect from seed snapshot',
+      phase: 'reopenWorkspaceCustody: remount Git custody',
       workspace: workspace,
       awaiting: 'connect',
       timeout: _phaseTimeout ?? const Duration(seconds: 60),
       onDiagnostic: _onDiagnostic,
-      run: () => _plane.connect(
-        workspace: workspace,
-        session: workspace,
-        clientId: '${_installLane?.clientId ?? 'test-runner'}-$workspace',
-        restoreFrom: snap,
-        allowUnborn: true,
-      ),
+      run: () async {
+        await _plane.bindSession(
+          workspace: workspace,
+          session: workspace,
+        );
+        final authorSecret = _deviceSecrets[workspace];
+        if (authorSecret != null) {
+          await _plane.session(workspace).refreshCredentials(
+                authorSecret: authorSecret,
+              );
+        }
+      },
     );
   }
 
-  /// SEED a NEW workspace on this plane from `build/<name>.law.usdz` law packages — the
-  /// mid-test twin of [cluster]'s per-workspace install: runs the SAME offline install lane,
-  /// then connects the workspace as its own session. Returns its [NomosSession].
+  /// Seed a new workspace through the same Peer Office and kernel used by the
+  /// rest of this test. The resulting state is ordinary Git custody.
   Future<NomosSession> seedWorkspaceFromLawUsdz({
     required String workspace,
     required List<String> lawUsdzPaths,
   }) async {
-    final lane = _installLane;
-    if (lane == null) {
+    final peer = _testPeer;
+    if (peer == null) {
       throw NomosTestHarnessException(
-        'seedWorkspaceFromLawUsdz: this harness holds no install-lane config',
+        'seedWorkspaceFromLawUsdz requires a local canonical test peer',
       );
     }
     if (lawUsdzPaths.isEmpty) {
@@ -2147,46 +1969,21 @@ class NomosTestHarness {
         'seedWorkspaceFromLawUsdz("$workspace"): pass the build/<name>.law.usdz paths',
       );
     }
-    final snap = '${_workdir.path}/$workspace.bin';
-    final info = await _phased(
-      phase: 'seed: offline law install',
+    final installed = await _phased(
+      phase: 'seed: initialize Git custody and install law',
       workspace: workspace,
-      awaiting: lane.useInRepoScript
-          ? 'offline-install.ts'
-          : 'githolon harness-install',
+      awaiting: 'genesis offer + ordinary lifecycle offers',
       timeout: _phaseTimeout ?? _kInstallDeadline,
       onDiagnostic: _onDiagnostic,
-      run: () => _runInstall(
-        node: lane.node,
-        useInRepoScript: lane.useInRepoScript,
-        inRepoScript: lane.inRepoScript,
-        githolonCmd: lane.githolonCmd,
-        lawUsdzPaths: lawUsdzPaths,
-        workspace: workspace,
-        snapshot: snap,
-        runtimeDir: lane.runtimeDir,
-        onDiagnostic: _onDiagnostic,
-      ),
-    );
-    final b64 = base64Encode(await File(snap).readAsBytes());
-    _snapshots[workspace] = b64;
-    _lawHashes[workspace] = ((info['lawHashes'] as List?) ?? const [])
-        .map((e) => e.toString())
-        .toList();
-    await _phased(
-      phase: 'seed: connect session',
-      workspace: workspace,
-      awaiting: 'connect',
-      timeout: _phaseTimeout ?? const Duration(seconds: 60),
-      onDiagnostic: _onDiagnostic,
-      run: () => _plane.connect(
+      run: () => peer.installWorkspace(
         workspace: workspace,
-        session: workspace,
-        clientId: '${lane.clientId}-$workspace',
-        restoreFrom: b64,
-        allowUnborn: true,
+        lawUsdzPaths: lawUsdzPaths,
       ),
     );
+    _lawHashes[workspace] = installed.lawHashes;
+    _domainKeys[workspace] = installed.domainKeys;
+    _devicePublics[workspace] = base64Encode(installed.deviceKey.publicKey);
+    _deviceSecrets[workspace] = base64Encode(installed.deviceKey.secret);
     if (!_sessionNames.contains(workspace)) _sessionNames.add(workspace);
     return _plane.session(workspace);
   }
@@ -2199,15 +1996,7 @@ class NomosTestHarness {
     required String workspace,
     required String domain,
   }) async {
-    final offer = await _phased(
-      phase: 'assertDomainInstalled: read the interface offer',
-      workspace: workspace,
-      awaiting: 'interfaceOffer',
-      timeout: _phaseTimeout ?? _kOtherDeadline,
-      onDiagnostic: _onDiagnostic,
-      run: () => _plane.session(workspace).interfaceOffer(),
-    );
-    final keys = (offer?.keys.toList() ?? const <String>[])..sort();
+    final keys = (_domainKeys[workspace]?.toList() ?? const <String>[])..sort();
     if (!keys.contains(domain)) {
       throw NomosTestHarnessException(
         'domain "$domain" is NOT installed on workspace "$workspace" — active domains: '
@@ -2216,189 +2005,137 @@ class NomosTestHarness {
     }
   }
 
-  // ── SNAPSHOT LIFECYCLE (co2 #5) — a typed async snapshot API over the per-workspace export()/restoreFrom
-  //    primitives, so staged AppSim snapshots migrate mechanically without reaching into custody internals. ──
-
-  /// Capture a typed [WorkspaceSnapshot] of one workspace's whole local holon (the bare nomos.git incl.
-  /// un-synced writes + the DLQ), with its head + law hashes + capture time. The bytes are the SAME
-  /// base64 `connect(restoreFrom:)` consumes — [restoreWorkspace] round-trips it. O(1)-ish (a tree serialize).
-  Future<WorkspaceSnapshot> snapshotWorkspace(String workspace) async {
-    final connected = _plane.connectedSessions;
-    if (!connected.contains(workspace)) {
+  /// Reopen the application from durable LOCAL custody. The canonical runner spawned for a
+  /// local scenario owns a filesystem Git directory independently of the Node process. Restarting
+  /// replaces Reception, Peer Office and kernel memory, then reconnects the same workspace names
+  /// against that directory. No snapshot or remote fetch participates.
+  Future<void> restart({NomosTestFrontier? retainedFixture}) async {
+    if (_disposed) {
       throw NomosTestHarnessException(
-        'snapshotWorkspace("$workspace"): no connected session; connected workspaces: $connected',
+        'restart(): this test device has already been disposed',
       );
     }
-    final s = _plane.session(workspace);
-    return _phased(
-      phase: 'snapshotWorkspace',
-      workspace: workspace,
-      awaiting: 'export',
-      timeout: _phaseTimeout ?? _kOtherDeadline,
-      onDiagnostic: _onDiagnostic,
-      run: () async {
-        final b64 = await s.export();
-        final head = await s.head();
-        return WorkspaceSnapshot(
-          workspace: workspace,
-          snapshotB64: b64,
-          head: head,
-          lawHashes: lawHashes(workspace),
-          capturedAt: DateTime.now().toUtc(),
+    final peer = _testPeer;
+    final home = homeWorkspace;
+    final cloudLane = _cloudRestartLane;
+    if (cloudLane != null && home != null) {
+      if (retainedFixture != null) {
+        throw NomosTestHarnessException(
+          'restart(): retained frontier fixtures require an isolated local test peer',
         );
-      },
-    );
-  }
-
-  /// Snapshot EVERY connected workspace on this plane into a typed [PlaneSnapshot] (session/workspace metadata
-  /// carried per entry). The plane-level twin of [snapshotWorkspace] — migrate a whole staged AppSim plane.
-  Future<PlaneSnapshot> snapshotPlane() async {
-    final out = <String, WorkspaceSnapshot>{};
-    final connected = _applicationConnectedSessions();
-    for (final ws in connected) {
-      out[ws] = await snapshotWorkspace(ws);
-    }
-    return PlaneSnapshot(
-      workspaces: Map.unmodifiable(out),
-      capturedAt: DateTime.now().toUtc(),
-    );
-  }
-
-  /// Restore a workspace FROM a [WorkspaceSnapshot] — re-open its session on this plane from the snapshot's
-  /// LOCAL CUSTODY (no network clone), replacing the resident holon. The workspace need not currently be a
-  /// session (a fresh restore is allowed); its name is taken from [snapshot] unless [into] overrides it.
-  Future<NomosSession> restoreWorkspace(
-    WorkspaceSnapshot snapshot, {
-    String? into,
-  }) async {
-    final ws = into ?? snapshot.workspace;
-    await _phased(
-      phase: 'restoreWorkspace',
-      workspace: ws,
-      awaiting: 'connect(restoreFrom:)',
-      timeout: _phaseTimeout ?? const Duration(seconds: 60),
-      onDiagnostic: _onDiagnostic,
-      run: () => _plane.connect(
-        workspace: ws,
-        session: ws,
-        clientId: '${_installLane?.clientId ?? 'test-runner'}-$ws',
-        restoreFrom: snapshot.snapshotB64,
-        allowUnborn: true,
-      ),
-    );
-    if (!_sessionNames.contains(ws)) _sessionNames.add(ws);
-    return bridge.session(ws);
-  }
-
-  /// Restore an entire [PlaneSnapshot] — every workspace re-opened from its snapshot. Migrates a staged plane
-  /// wholesale (the mechanical AppSim-snapshot migration co2 #5 asks for).
-  Future<void> restorePlane(PlaneSnapshot plane) async {
-    for (final entry in plane.workspaces.values) {
-      await restoreWorkspace(entry);
+      }
+      await _reopenCloudDevice(cloudLane, home);
+      return;
     }
-  }
-
-  /// Simulate an app process restart from its durably persisted local custody. This is deliberately one
-  /// harness verb: snapshots, runner replacement, credentials, workspace ordering and auto-sync registration
-  /// remain Nomos concerns. The caller reacquires generated clients from [homeSession]/[bridge] afterward.
-  Future<void> restart() async {
-    if (_disposed) {
+    if (peer == null || home == null) {
       throw NomosTestHarnessException(
-        'restart(): this test device has already been disposed',
+        'restart() requires a local canonical test peer and primary application workspace',
       );
     }
-    final lane = _cloudRestartLane;
-    final home = homeWorkspace;
-    if (lane == null || home == null) {
+    final publicKey = _devicePublics[home];
+    final homeSecret = _deviceSecrets[home];
+    if (publicKey == null ||
+        publicKey.isEmpty ||
+        homeSecret == null ||
+        homeSecret.isEmpty) {
       throw NomosTestHarnessException(
-        'restart() requires a harness with one primary application session',
+        'restart(): the local device has no retained signing identity for "$home"',
       );
     }
-
-    final oldPlane = _plane;
     final targets = _applicationConnectedSessions();
     if (targets.remove(home)) targets.insert(0, home);
-    final snapshots = <String, String>{};
-    for (final ws in targets) {
-      final session = oldPlane.session(ws);
-      await _phased(
-        phase: 'restart: stop automatic sync',
-        workspace: ws,
-        awaiting: 'stopAutoSync',
-        timeout: _phaseTimeout ?? _kOtherDeadline,
-        onDiagnostic: _onDiagnostic,
-        run: session.stopAutoSync,
-      );
-      snapshots[ws] = await _phased(
-        phase: 'restart: persist local custody',
-        workspace: ws,
-        awaiting: 'export',
-        timeout: _phaseTimeout ?? _kOtherDeadline,
-        onDiagnostic: _onDiagnostic,
-        run: session.export,
-      );
-    }
-
+    final secrets = <String, String>{
+      for (final workspace in targets)
+        workspace: _deviceSecrets[workspace] ?? homeSecret,
+    };
+    final prior = retainedFixture == null
+        ? null
+        : await _plane.session(retainedFixture.workspace).head();
+    if (retainedFixture != null) _requireLocalFrontier(retainedFixture);
     await _phased(
-      phase: 'restart: terminate old runner',
-      awaiting: 'NodeRunnerTransport.dispose',
-      timeout: _phaseTimeout ?? _kOtherDeadline,
-      onDiagnostic: _onDiagnostic,
-      run: _transport.dispose,
-    );
-    _transport = await _phased(
-      phase: 'restart: spawn runner',
-      awaiting: 'Process.start(${lane.node})',
-      timeout: _phaseTimeout ?? _kSpawnDeadline,
+      phase: 'restart: reopen Peer Office from Git custody',
+      workspace: home,
+      awaiting: 'process reboot + custody remount',
+      timeout: _phaseTimeout ?? _kInstallDeadline,
       onDiagnostic: _onDiagnostic,
-      run: () => NodeRunnerTransport.start(
-        entry: lane.entry,
-        resolveFrom: lane.resolveFrom,
-        node: lane.node,
-        environment: lane.environment,
-        onDiagnostic: _onDiagnostic,
+      run: () => peer.reboot(
+        trustRootPublicKey: base64Decode(publicKey),
+        authorSecrets: secrets,
+        arrangeStoppedCustody: retainedFixture == null
+            ? null
+            : () async {
+                final fixture = retainedFixture;
+                // Exact existing workspace beneath this peer-owned temporary root.
+                if (!RegExp(r'^[A-Za-z0-9_-]+$').hasMatch(fixture.workspace)) {
+                  throw StateError('Invalid fixture workspace');
+                }
+                final repo =
+                    '${peer.custody.directory.path}/custody/holon-${fixture.workspace}.git';
+                // `update-ref <new> <old>` is a compare-and-swap, and git reads an
+                // EMPTY <old> as "the ref must not exist". `prior` comes from the
+                // plane's workspace status, which answers '' whenever the workspace
+                // is not resident at that moment — after a page crawl has released
+                // it, for instance — so the rewind failed with "cannot lock ref
+                // 'refs/heads/main': reference already exists". The peer is stopped
+                // and this repo is its own temporary custody, so what the repo holds
+                // IS the truth: use it whenever the plane had no answer.
+                var expected = prior ?? '';
+                if (expected.isEmpty) {
+                  final current = await Process.run('git', [
+                    '--git-dir=$repo',
+                    'rev-parse',
+                    '--verify',
+                    'refs/heads/main',
+                  ]);
+                  if (current.exitCode != 0) {
+                    throw StateError(
+                        'Could not read the retained Git point to rewind from: ${current.stderr}');
+                  }
+                  expected = (current.stdout as String).trim();
+                }
+                final selected = await Process.run('git', [
+                  '--git-dir=$repo',
+                  'update-ref',
+                  'refs/heads/main',
+                  fixture.head,
+                  expected,
+                ]);
+                if (selected.exitCode != 0)
+                  throw StateError(
+                      'Could not arrange isolated retained Git point: ${selected.stderr}');
+              },
       ),
     );
-    final restarted = NomosBridge(_transport);
-    await _phased(
-      phase: 'restart: runner ready',
-      awaiting: "event:'ready'",
-      timeout: _phaseTimeout ?? _kOtherDeadline,
-      onDiagnostic: _onDiagnostic,
-      run: () => restarted.ready,
-    );
-    for (final ws in targets) {
-      await _phased(
-        phase: 'restart: reopen local custody',
-        workspace: ws,
-        awaiting: 'connect(restoreFrom:)',
-        timeout: _phaseTimeout ?? const Duration(seconds: 60),
-        onDiagnostic: _onDiagnostic,
-        run: () => restarted.connect(
-          cloud: lane.cloud,
-          workspace: ws,
-          session: ws,
-          clientId: '${lane.clientId}-$ws',
-          authToken: lane.authToken,
-          authorSecret: lane.authorSecret,
-          restoreFrom: snapshots[ws],
-          allowUnborn: true,
-        ),
-      );
-    }
-    bridge = restarted.session(home);
+    _transport = peer.transport;
+    reception = peer.reception.session(home);
     _sessionNames
       ..clear()
       ..addAll(targets);
-    _snapshots.addAll(snapshots);
-    for (final ws in targets) {
-      await restarted.session(ws).autoSync(fallbackMs: 60000);
-    }
   }
 
-  /// Simulate reinstalling the application with no local ledger custody. Every application workspace must
-  /// reopen from remote custody; a successful business read afterward is therefore a replay proof, not a
-  /// read from the old process snapshot.
+  /// The scenario-side delegated-permission lane (a test device minting a delegation cert and
+  /// authoring the acceptance intent on the person's behalf) was retired with the local-tooling
+  /// cutover (2026-09-03): it was host-side orchestration outside the one Peer Office. Generated
+  /// `may…()` helpers still call here; the honest answer is a typed refusal naming the intent, so
+  /// the scenario establishes authority through the generated business API instead.
+  Future<void> nomosInternalAllowDelegatedScenarioAction({
+    required String domain,
+    required String acceptanceIntent,
+    required String relation,
+    required String subject,
+    required String subjectField,
+    required String certificateField,
+    Map<String, Object?> facts = const {},
+  }) async {
+    throw NomosTestHarnessException(
+      'delegated scenario permissions are not available in the canonical harness: '
+      'establish "$relation" for $subject through the generated business API '
+      '(domain $domain, acceptance intent $acceptanceIntent)',
+    );
+  }
+
+  /// Reinstall with empty local custody; subsequent reads must reacquire the
+  /// remotely retained frontier. Restart, in contrast, preserves device disk.
   Future<void> reinstall() async {
     if (_disposed) {
       throw NomosTestHarnessException(
@@ -2413,43 +2150,69 @@ class NomosTestHarness {
       );
     }
 
-    final oldPlane = _plane;
+    // LOCAL-FIRST REINSTALL: a fresh install restores from the cloud, so what survives is exactly what
+    // this peer had SYNCED — the Home's births are re-admitted by the cloud through its own gate (which
+    // births the children there), then each child's own work follows. Converge first, parent leading;
+    // an unsynced push failure surfaces here instead of as a silent loss after the restart.
+    await converge();
+    // createTemp's argument is the PREFIX; the receiver is the parent directory.
+    final freshCustody = await _workdir.createTemp('reinstall-');
+    await _reopenCloudDevice(lane, home, custody: freshCustody.path);
+  }
+
+  /// Replace only the process and its bindings. Placement/follow scheduling
+  /// stays in Peer Office; the harness supplies credentials, never sync flags.
+  Future<void> _reopenCloudDevice(
+    _CloudRestartLane lane,
+    String home, {
+    String? custody,
+  }) async {
     final targets = _applicationConnectedSessions();
     if (targets.remove(home)) targets.insert(0, home);
-    for (final ws in targets) {
-      await oldPlane.session(ws).stopAutoSync();
-    }
+    await _plane.dispose();
     await _transport.dispose();
 
     _transport = await NodeRunnerTransport.start(
       entry: lane.entry,
       resolveFrom: lane.resolveFrom,
       node: lane.node,
-      environment: lane.environment,
+      arguments: [
+        ...lane.arguments,
+        '--custody=${custody ?? lane.custodyDirectory}'
+      ],
       onDiagnostic: _onDiagnostic,
     );
-    final reinstalled = NomosBridge(_transport);
+    if (custody != null) lane.custodyDirectory = custody;
+    final reinstalled = DartReception(_transport);
     await reinstalled.ready;
+    final scratch = '${lane.clientId}-onboard-scratch';
+    await reinstalled.bindSession(
+      workspace: scratch,
+      session: scratch,
+    );
+    await reinstalled.session(scratch).refreshCredentials(
+          authToken: lane.authToken,
+          authorSecret: lane.authorSecret,
+        );
     for (final ws in targets) {
-      await reinstalled.connect(
-        cloud: lane.cloud,
+      final interaction = await reinstalled.bindSession(
         workspace: ws,
         session: ws,
-        clientId: '${lane.clientId}-reinstall-$ws',
-        authToken: lane.authToken,
-        authorSecret: lane.authorSecret,
+        credentialSourceSession: scratch,
+      );
+      reinstalled.nomosInternalRegisterCredentialProvider(
+        interaction: interaction,
+        cloud: lane.cloud,
+        signIn: ({deviceChallenge}) async => lane.authToken,
       );
     }
-    bridge = reinstalled.session(home);
+    reception = reinstalled.session(home);
     _sessionNames
       ..clear()
       ..addAll(targets);
-    for (final ws in targets) {
-      await reinstalled.session(ws).autoSync(fallbackMs: 60000);
-    }
   }
 
-  /// Deterministic, idempotent, total-ordered teardown: close the bridge and all live watches, stop the runner
+  /// Deterministic, idempotent, total-ordered teardown: close the reception and all live watches, stop the runner
   /// (SIGTERM → 5s deadline → SIGKILL, via [NodeRunnerTransport.dispose]), then delete the temp dir. Safe to
   /// call twice; safe to call after a failed setup. Nothing left running, nothing left on disk.
   /// Disposal must ALWAYS complete (never leave a hung teardown holding the test runner): the transport
@@ -2464,21 +2227,21 @@ class NomosTestHarness {
         '[nomos-test-harness] phase dispose (≤${(_phaseTimeout ?? _kOtherDeadline).inSeconds}s) …',
       );
     try {
-      // The bridge owns the transport's one message subscription and every watch controller. Closing the
+      // The reception owns the transport's one message subscription and every watch controller. Closing the
       // transport first makes its incoming stream wait on consumers that can no longer receive their
       // unwatch/done messages—a deterministic teardown deadlock in reactive Flutter tests.
       await _plane.dispose().timeout(
             _phaseTimeout ?? _kOtherDeadline,
             onTimeout: () => throw HarnessPhaseTimeout(
-              phase: 'dispose: close bridge watches',
+              phase: 'dispose: close reception watches',
               workspace: workspace,
               elapsed: _phaseTimeout ?? _kOtherDeadline,
-              awaiting: 'NomosBridge.dispose',
+              awaiting: 'DartReception.dispose',
             ),
           );
     } catch (e) {
       _diag(
-        '[nomos-test-harness] bridge dispose error (continuing to runner cleanup): $e',
+        '[nomos-test-harness] reception dispose error (continuing to runner cleanup): $e',
       );
     }
     try {
@@ -2513,79 +2276,46 @@ class NomosTestHarness {
     }
   }
 
-  // ── offline install (a short-lived node child; produces the restore snapshot) ──
-
-  static Future<Map<String, Object?>> _runInstall({
-    required String node,
-    required bool useInRepoScript,
-    required String inRepoScript,
-    required String githolonCmd,
-    required List<String> lawUsdzPaths,
-    required String workspace,
-    required String snapshot,
-    String? runtimeDir,
-    void Function(String line)? onDiagnostic,
-  }) async {
-    // Both lanes take the SAME flags (--law/--workspace/--out/--runtime) and print the SAME one-line JSON
-    // contract; only the leading command differs (node <script> vs `<githolon...> harness-install`).
-    final common = <String>[
-      '--law',
-      lawUsdzPaths.join(','),
-      '--workspace',
-      workspace,
-      '--out',
-      snapshot,
-      if (runtimeDir != null) ...['--runtime', runtimeDir],
-    ];
-    final String executable;
-    final List<String> args;
-    if (useInRepoScript) {
-      executable = node;
-      args = [inRepoScript, ...common];
-    } else {
-      // `githolonCmd` is a command line (e.g. `npx githolon` or `node /abs/cli.mjs`) — split into tokens.
-      final tokens = githolonCmd
-          .trim()
-          .split(RegExp(r'\s+'))
-          .where((t) => t.isNotEmpty)
-          .toList();
-      if (tokens.isEmpty) {
-        throw NomosTestHarnessException(
-          'no install helper resolved — pass installHelper: (an offline-install.ts path, or a githolon command)',
+  static Future<String> _resolveTestEntry(String node, String from) async {
+    String? packageConfigPath = Platform.packageConfig;
+    if (packageConfigPath == null) {
+      var directory = Directory(from).absolute;
+      while (true) {
+        final candidate = File(
+          '${directory.path}${Platform.pathSeparator}.dart_tool${Platform.pathSeparator}package_config.json',
         );
-      }
-      executable = tokens.first;
-      args = [...tokens.skip(1), 'harness-install', ...common];
-    }
-    final tag = useInRepoScript ? 'offline-install' : 'harness-install';
-    final r = await Process.run(executable, args);
-    final err = (r.stderr as String).trim();
-    if (err.isNotEmpty) {
-      for (final line in err.split('\n')) {
-        (onDiagnostic ?? stderr.writeln)('[$tag] $line');
+        if (candidate.existsSync()) {
+          packageConfigPath = candidate.uri.toString();
+          break;
+        }
+        final parent = directory.parent;
+        if (parent.path == directory.path) break;
+        directory = parent;
       }
     }
-    if (r.exitCode != 0) {
-      throw NomosTestHarnessException(
-        'offline law install for "$workspace" failed (exit ${r.exitCode}): ${err.isEmpty ? "(no stderr)" : err}',
+    if (packageConfigPath != null) {
+      final packages = await loadPackageConfigUri(
+        Uri.base.resolve(packageConfigPath),
       );
-    }
-    // The helper prints one JSON line on success; verify it before spawning the runner.
-    final out = (r.stdout as String).trim();
-    final last = out.isEmpty ? '' : out.split('\n').last;
-    Map<String, Object?> decoded = const {};
-    try {
-      final d = jsonDecode(last);
-      if (d is Map) decoded = d.cast<String, Object?>();
-    } catch (_) {}
-    if (decoded['ok'] != true || !File(snapshot).existsSync()) {
-      throw NomosTestHarnessException(
-        'offline law install produced no snapshot (stdout: ${out.isEmpty ? "(empty)" : out})',
+      final bundled = packages.resolve(
+        Uri.parse('package:nomos_client/src/runner/node-entry.mjs'),
       );
+      if (bundled != null && bundled.scheme == 'file') {
+        final path = bundled.toFilePath();
+        if (File(path).existsSync()) return path;
+      }
     }
-    // { ok, snapshot, workspace, lawHashes, frameworkHash } — the caller keeps lawHashes/frameworkHash so a
-    // `.births()` directive can be driven (its genesis installs the framework + law by hash).
-    return decoded;
+    final result = await Process.run(
+      node,
+      ['-p', "require.resolve('@githolon/runtime/runner/node-entry.mjs')"],
+      workingDirectory: from,
+    );
+    final resolved = result.stdout.toString().trim();
+    if (result.exitCode == 0 && resolved.isNotEmpty) return resolved;
+    throw NomosTestHarnessException(
+      'the Nomos release contains no bundled node peer. '
+      'Build @githolon/runtime, reinstall nomos_client, or pass nodeEntry only while developing Nomos.',
+    );
   }
 
   static Future<String> _resolveEntry(String node, String from) async {
@@ -2619,10 +2349,10 @@ class NomosTestHarness {
     }
     // PREFER the BUILT .mjs (the published-consumer entry): node refuses type-stripping under node_modules
     // (ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING — co2 DEFECT P3-002), so the raw .ts entry only boots
-    // in-repo. The .mjs ships from @githolon/client ≥0.97.2; the .ts fallback keeps in-repo dev working.
+    // in-repo. The .mjs ships from @githolon/runtime ≥0.97.2; the .ts fallback keeps in-repo dev working.
     for (final entry in const [
-      '@githolon/client/runner/node-entry.mjs',
-      '@githolon/client/runner/node-entry.ts',
+      '@githolon/runtime/runner/node-entry.mjs',
+      '@githolon/runtime/runner/node-entry.ts',
     ]) {
       final r = await Process.run(
           node,
@@ -2636,82 +2366,8 @@ class NomosTestHarness {
     }
     throw NomosTestHarnessException(
       'the Nomos release contains no bundled node runner and '
-      '@githolon/client/runner/node-entry.{mjs,ts} cannot be resolved from $from. '
+      '@githolon/runtime/runner/node-entry.{mjs,ts} cannot be resolved from $from. '
       'Reinstall nomos_client, or pass nodeEntry: only when developing Nomos itself.',
     );
   }
 }
-
-/// A typed, self-describing snapshot of ONE workspace's local holon (co2 #5). [snapshotB64] is the exact
-/// base64 `connect(restoreFrom:)` consumes — the whole nomos.git incl. un-synced writes + the DLQ — plus the
-/// metadata that makes a staged snapshot mechanically migratable: the [workspace], its ledger [head] at
-/// capture, its installed [lawHashes], and [capturedAt] (UTC).
-class WorkspaceSnapshot {
-  final String workspace;
-  final String snapshotB64;
-  final String head;
-  final List<String> lawHashes;
-  final DateTime capturedAt;
-
-  const WorkspaceSnapshot({
-    required this.workspace,
-    required this.snapshotB64,
-    required this.head,
-    required this.lawHashes,
-    required this.capturedAt,
-  });
-
-  /// JSON round-trip so a staged snapshot persists to disk verbatim (the bytes + provenance).
-  Map<String, Object?> toJson() => {
-        'workspace': workspace,
-        'snapshotB64': snapshotB64,
-        'head': head,
-        'lawHashes': lawHashes,
-        'capturedAt': capturedAt.toUtc().toIso8601String(),
-      };
-
-  factory WorkspaceSnapshot.fromJson(Map<String, Object?> j) =>
-      WorkspaceSnapshot(
-        workspace: j['workspace'] as String,
-        snapshotB64: j['snapshotB64'] as String,
-        head: (j['head'] ?? '') as String,
-        lawHashes:
-            ((j['lawHashes'] as List?) ?? const []).map((e) => '$e').toList(),
-        capturedAt: DateTime.parse(
-          (j['capturedAt'] ?? DateTime.now().toUtc().toIso8601String())
-              as String,
-        ),
-      );
-
-  @override
-  String toString() =>
-      'WorkspaceSnapshot($workspace @ ${head.isEmpty ? "∅" : head.substring(0, head.length.clamp(0, 10))}, '
-      '${lawHashes.length} law(s), ${capturedAt.toIso8601String()})';
-}
-
-/// A typed snapshot of a WHOLE plane — every connected workspace keyed by name (co2 #5). Restore it with
-/// [NomosTestHarness.restorePlane] to migrate a staged multi-workspace AppSim scene wholesale.
-class PlaneSnapshot {
-  final Map<String, WorkspaceSnapshot> workspaces;
-  final DateTime capturedAt;
-
-  const PlaneSnapshot({required this.workspaces, required this.capturedAt});
-
-  Map<String, Object?> toJson() => {
-        'workspaces': workspaces.map((k, v) => MapEntry(k, v.toJson())),
-        'capturedAt': capturedAt.toUtc().toIso8601String(),
-      };
-
-  factory PlaneSnapshot.fromJson(Map<String, Object?> j) => PlaneSnapshot(
-        workspaces: ((j['workspaces'] as Map?) ?? const {}).map(
-          (k, v) => MapEntry(
-            '$k',
-            WorkspaceSnapshot.fromJson((v as Map).cast<String, Object?>()),
-          ),
-        ),
-        capturedAt: DateTime.parse(
-          (j['capturedAt'] ?? DateTime.now().toUtc().toIso8601String())
-              as String,
-        ),
-      );
-}