@githolon/dsl 0.108.7 → 0.110.0

package/src/codegen_dart_client.ts

@@ -1,3 +1,4 @@
+import { dartRefusalDecoders } from "./codegen_refusal.js";
 // NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
 // remotes are replaceable custody/transport, not truth.  ⇒ ONE Nomos GitHolon
 // wasm32-wasip1 artifact {kernel · projection · embedded QuickJS engine}.
@@ -8,25 +9,26 @@
  *
  * `codegen_dart.ts` emits the per-domain TYPES: read-model classes (`…ReadModel.fromProjected`),
  * typed action inputs (`…Input` publicly; private directives retain `…Payload`), typed ids and enums. Until this file a Flutter app
- * still hand-typed directive ids + query ids against the raw `NomosBridge` (string + Map). This closes
+ * still hand-typed directive ids + query ids against a raw runtime surface (string + Map). This closes
  * that: ONE generated `<name>.client.dart` per domain, emitted by `nomos-compile` AFTER the package is
  * hashed (the deployed law's content hash baked in), carrying a `<Domain>Client` over a connected
- * [NomosBridge] (the WebView runner) with:
+ * a connected [NomosSession] with:
  *
  *   * a typed OFFER method per directive — takes the generated input/implementation DTO, serialises via its
  *     canonical USDA, auto-stamps omitted `…At` timestamps (the same caller-clock sugar the TS
  *     client applies), returns the new local head;
  *   * a typed declared-QUERY accessor per `query(...)` — one-shot `Future<List<…ReadModel>>` + a
- *     reactive `watch…` `Stream<List<…ReadModel>>`, parsed off the bridge's `{type,id,data}` rows;
+ *     reactive `watch…` `Stream<List<…ReadModel>>`, parsed off the session's `{type,id,data}` rows;
  *   * by-id read/watch + a type-index `list…` per aggregate;
  *   * typed O(1) count/sum accessors.
  *
  * It IMPORTS the sibling `<name>.dart` (for the read-model + input classes) and either the vendored
- * `nomos_client.dart` barrel or the package `nomos_client` barrel (for `NomosBridge`). NO manifest/hash impact —
+ * `nomos_client.dart` barrel or the package `nomos_client` barrel (for `NomosSession`). NO manifest/hash impact —
  * pure frontend codegen, exactly like `codegen_dart.ts`. NO FALLBACK: an unsupported shape throws at compile
  * time.
  */
 import type { z } from "zod";
+import { MemberAuthenticationKind } from "./member_authentication.js";
 
 import {
   BUSINESS_BIRTH_SEED_PAYLOAD_FIELD,
@@ -65,18 +67,23 @@ import {
   type AggFieldSpec,
   type PayloadFieldSpec,
 } from "./codegen_dart.js";
-import type { LawGraph } from "./law_graph.js";
+import type { LawGraph, LawRowReadNode } from "./law_graph.js";
 import {
-  DART_CALL_USDA_PRELUDE,
-  emitDartCallUsdaEncoder,
-  type DartCallUsdaFieldAccess,
-} from "./codegen_call_usda.js";
+  DART_CALL_PROTO_PRELUDE,
+  emitDartCallProtoEncoder,
+  publishingIntentOf,
+  type DartCallProtoFieldAccess,
+} from "./codegen_call_proto.js";
+import { DART_CALL_USDA_PRELUDE } from "./codegen_call_usda.js";
 import {
-  emitDartQueryUsdaEncoder,
+  emitDartQueryProtoEncoder,
   type QueryScalarKind,
-} from "./codegen_query_usda.js";
+} from "./codegen_query_proto.js";
+import { emitDartQueryResultProtoDecoder } from "./codegen_result_proto.js";
 import { finishCount } from "./count.js";
 import { finishSum } from "./sum.js";
+import { finishExtremum } from "./extremum.js";
+import { finishExists } from "./exists.js";
 import {
   autoStampFields,
   domainEncryptionMap,
@@ -87,13 +94,12 @@ import {
   isNamespacedAggregate,
   qualifyReadProjectionType,
 } from "./read_projection_namespace.js";
-import {
-  childAuthenticationRecoveryAggregateId,
-  isBusinessIntent,
-} from "./intent.js";
-import { publicClientInterface, type DomainInterface } from "./shape_compat.js";
+import { isBusinessIntent } from "./intent.js";
+import { publicClientInterface, type DomainInterface } from "./compatibility_graph.js";
+import { emitApplicationCompatibilityUsda } from "./compatibility_usda.js";
 import { BUSINESS_CORRECTION_DIRECTIVE } from "./framework/business_corrections.js";
 import { deriveDirectiveRecordTarget } from "./workspace_routing.js";
+import { voMetaOf } from "./value_object.js";
 import {
   buildNomosDescribeModel,
   type NomosDescribeModel,
@@ -113,16 +119,74 @@ const camel = (s: string) =>
 const lcFirst = (s: string) =>
   s.length ? s[0]!.toLowerCase() + s.slice(1) : s;
 
-export const dartInternalWorkspaceSharingReceiptMethod = (
-  directiveId: string
-): string => `nmsInternal${cap(camel(directiveId))}`;
+type AnyDirective = Directive<unknown>;
 
-export const dartInternalChildAuthenticationRecoveryMethod = (
-  aggregateId: string,
-): string => `nmsInternalRepair${cap(camel(aggregateId))}Authentication`;
+interface DartClientOperationSelection {
+  readonly publicDirectives: readonly AnyDirective[];
+  readonly sourceTrustViaIds: ReadonlySet<string>;
+  readonly sourceTrustDirectives: readonly AnyDirective[];
+  readonly encoderDirectives: readonly AnyDirective[];
+}
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-type AnyDirective = Directive<any>;
+/**
+ * The exact operation surface for which the generated Dart session emits
+ * Protobuf encoders. Keeping this selection beside the encoder prevents the
+ * package compiler from independently guessing that every internal law
+ * directive is a client call.
+ */
+function dartClientOperationSelection(
+  mod: DomainModule,
+  graph: LawGraph,
+): DartClientOperationSelection {
+  const authoredDirectives = mod.directives as AnyDirective[];
+  const publicDirectives = (mod.applicationIntents ?? mod.directives).filter(
+    (directive): directive is AnyDirective =>
+      directive !== undefined &&
+      typeof directive.id === "string" &&
+      typeof (directive as { payloadSchema?: unknown }).payloadSchema === "object" &&
+      (directive as { businessBirthInternal?: unknown }).businessBirthInternal !== true &&
+      // A directive the law offers only THROUGH a business intent is not a second client call.
+      publishingIntentOf(graph, mod.domain ?? mod.name, directive.id) === undefined,
+  );
+  const sourceTrustViaIds = new Set(
+    publicDirectives.flatMap((directive) =>
+      directive.businessSourceTrust === undefined
+        ? []
+        : [directive.businessSourceTrust.viaDirectiveId],
+    ),
+  );
+  const sourceTrustDirectives = authoredDirectives.filter((directive) =>
+    sourceTrustViaIds.has(directive.id),
+  );
+  for (const viaDirectiveId of sourceTrustViaIds) {
+    if (!sourceTrustDirectives.some((directive) => directive.id === viaDirectiveId)) {
+      throw new Error(
+        `Dart source-trust codegen: '${mod.domain ?? mod.name}' has no hidden directive '${viaDirectiveId}'`,
+      );
+    }
+  }
+  return {
+    publicDirectives,
+    sourceTrustViaIds,
+    sourceTrustDirectives,
+    encoderDirectives: [
+      ...new Map(
+        [...publicDirectives, ...sourceTrustDirectives]
+          .map((directive) => [directive.id, directive] as const),
+      ).values(),
+    ],
+  };
+}
+
+/** Exact private/public directive ids consumed by Dart operation codegen. */
+export function dartBridgeClientOperationDirectiveIds(
+  mod: DomainModule,
+  graph: LawGraph,
+): readonly string[] {
+  return dartClientOperationSelection(mod, graph).encoderDirectives.map(
+    (directive) => directive.id,
+  );
+}
 
 /** Dart reserved words that can't be method names — suffixed `_` if one slips through. */
 const DART_RESERVED = new Set([
@@ -175,13 +239,9 @@ export const dartInternalSourceTrustMethod = (directiveId: string): string =>
 export const dartHashConstName = (fileBase: string): string =>
   `${lcFirst(camel(fileBase))}DomainHash`;
 
-/** `todo-nomos` → `todoNomosInterfaceJson` — the baked structural-interface JSON const (#72). */
+/** `todo-nomos` → `todoNomosInterface` — the generated structural contract (#72). */
 export const interfaceConstNameDart = (fileBase: string): string =>
-  `${lcFirst(camel(fileBase))}InterfaceJson`;
-
-/** `todo-nomos` → `todoNomosCompatJson` — the baked client/law compat manifest JSON const (§5). */
-export const compatConstNameDart = (fileBase: string): string =>
-  `${lcFirst(camel(fileBase))}CompatJson`;
+  `${lcFirst(camel(fileBase))}Interface`;
 
 /** Emit a Dart RAW triple-quoted string literal of an object's JSON (the interface is JSON-only
  *  data — no `'`/`$`/backslash escaping concerns under `r'''…'''`; JSON never contains `'''`). */
@@ -189,9 +249,48 @@ function dartRawJson(value: unknown): string {
   return `r'''${JSON.stringify(value)}'''`;
 }
 
+function dartRawText(value: string): string {
+  if (value.includes("'''")) {
+    throw new Error("generated Dart raw text contains its triple-quote delimiter");
+  }
+  return `r'''${value}'''`;
+}
+
 const dartStr = (s: string) =>
   `'${s.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
 
+const dartInterfaceSet = (
+  domainKey: string,
+  value: DomainInterface,
+): string => {
+  const directives = Object.entries(value.directives ?? {})
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([id, directive]) => {
+      const fields = Object.entries(directive.fields ?? {})
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([name, field]) =>
+          `InterfacePayloadField(name: ${dartStr(name)}, kind: ${dartStr(field.kind)}, optional: ${field.optional === true})`
+        );
+      return `InterfaceDirective(id: ${dartStr(id)}, fields: [${fields.join(", ")}])`;
+    });
+  const aggregates = Object.entries(value.aggregates ?? {})
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([sid, aggregate]) => {
+      const fields = Object.entries(aggregate.fields ?? {})
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([fieldSid, field]) =>
+          `InterfaceAggregateField(sid: ${dartStr(fieldSid)}, kind: ${dartStr(field.kind)}, label: ${dartStr(field.label ?? fieldSid)})`
+        );
+      return `InterfaceAggregate(sid: ${dartStr(aggregate.sid ?? sid)}, label: ${dartStr(aggregate.label ?? sid)}, fields: [${fields.join(", ")}])`;
+    });
+  const foreignReads = Object.entries(value.foreignReads ?? {})
+    .sort(([left], [right]) => left.localeCompare(right))
+    .flatMap(([directive, reads]) => reads.map((read) =>
+      `InterfaceForeignRead(directive: ${dartStr(directive)}, queryId: ${dartStr(read.queryId)}${read.from === undefined ? "" : `, source: ${dartStr(read.from)}`}${read.policy === undefined ? "" : `, policy: ${dartStr(read.policy)}`}${read.fromPayload === undefined ? "" : `, sourcePayloadField: ${dartStr(read.fromPayload)}`})`
+    ));
+  return `InterfaceSet(domains: [DomainInterface(formatVersion: ${value.v ?? 0}, domain: ${dartStr(value.domain ?? domainKey)}${value.domainSid === undefined ? "" : `, domainSid: ${dartStr(value.domainSid)}`}, directives: [${directives.join(", ")}], aggregates: [${aggregates.join(", ")}], foreignReads: [${foreignReads.join(", ")}])])`;
+};
+
 const dartSealedValueName = (field: string): string =>
   `nmsInternalSealed${cap(camel(field))}`;
 
@@ -201,11 +300,11 @@ const dartSealKeyName = (field: string): string =>
 /** A schema-specific Dart expression for one public payload field. The USDA
  * encoder consumes typed values directly; any legacy arbitrary-data shape is a
  * compiler refusal, never a route back through JSON. */
-function dartCallUsdaFieldAccess(
+function dartCallProtoFieldAccess(
   domain: string,
   directive: string,
   spec: PayloadFieldSpec
-): DartCallUsdaFieldAccess {
+): DartCallProtoFieldAccess {
   const member = `payload.${dartMemberName(spec.name)}`;
   if (spec.nullAdmits === true) {
     return { value: member, slot: true };
@@ -358,7 +457,7 @@ function dartKeyParam(key: string): string {
   return safeMethod(safe);
 }
 
-/** Parse ONE bridge row (`{type,id,data}`) into a typed read model, composing the canonical `.ref` from the
+/** Parse ONE session row (`{type,id,data}`) into a typed read model, composing the canonical `.ref` from the
  * session workspace (`_ws`, a getter on the client) + the row's type/id. Works for a `Map` (one-shot
  * `query`/`queryById` rows) or a `dynamic` (`watch` stream rows) — indexing resolves on both. */
 function rowToModel(model: string, rowVar: string, workspace = "_ws"): string {
@@ -402,7 +501,10 @@ function dartUsdaBasePresentValue(
             `Dart result USDA codegen: foreign reference '${spec.wireName}' has no workspace-field decoder`
           );
         }
-        return `NmsInternalForeignRefs.create<${spec.foreignRefTarget}>(id: ${value}, workspace: ${foreignWorkspaceExpression}, type: '${spec.foreignRefAggregateType}', fromJson: ${spec.foreignRefTarget}.fromJson)`;
+        // A foreign reference is a typed, workspace-qualified locator. Decoding
+        // belongs to the generated application that owns the target domain; a
+        // source client must not capture another domain's private codec.
+        return `NmsInternalForeignRefs.create<${spec.foreignRefTarget}>(id: ${value}, workspace: ${foreignWorkspaceExpression}, type: '${spec.foreignRefAggregateType}')`;
       }
       if (spec.refIdClass !== undefined) {
         return `NmsInternalNomosRefs.create<${spec.refIdClass}>(workspace: ${workspace}, type: '${spec.refAggregateType}', id: ${value})`;
@@ -575,6 +677,10 @@ function dartUsdaProjectionValue(
   schema: z.ZodTypeAny,
   expression: string
 ): string {
+  const valueObject = voMetaOf(schema);
+  if (valueObject !== undefined) {
+    return `${valueObject.name}.fromProjected((${expression}.jsonValue() as Map).cast<String, Object?>())`;
+  }
   let inner = schema;
   while (
     zodKind(inner) === "optional" ||
@@ -615,6 +721,7 @@ interface DartUsdaResultDecoder {
     readonly spec: AggFieldSpec;
     readonly required: boolean;
     readonly foreignWorkspacePath?: string;
+    readonly foreignWorkspaceName?: string;
   }[];
   readonly computedFields: readonly {
     readonly name: string;
@@ -665,7 +772,7 @@ function emitDartUsdaResultDecoder(
     const selected = `row.field(${JSON.stringify(field.path)})`;
     return `        if (${selected} != null) ${JSON.stringify(
       name
-    )}: FieldProvenance(author: ${selected}!.property('nomos:author') is String ? ${selected}.property('nomos:author') as String : null, wasContested: ${selected}.property('nomos:wasContested') == true),`;
+    )}: FieldProvenance(author: ${selected}!.property('nomos:author') is String ? ${selected}!.property('nomos:author') as String : null, wasContested: ${selected}!.property('nomos:wasContested') == true),`;
   });
   return [
     `List<${decoder.model}> ${functionName}(Uint8List bytes, String workspace) {`,
@@ -678,7 +785,7 @@ function emitDartUsdaResultDecoder(
     `    }`,
     `    final id = row.property('nomos:id');`,
     `    if (id is! String) throw const FormatException('USDA row has no string identity');`,
-    `    return ${decoder.model}(`,
+    `    return NmsInternalRecordOrigins.remember(${decoder.model}(`,
     `      ref: NmsInternalNomosRefs.create<${
       decoder.refType
     }>(workspace: workspace, type: ${JSON.stringify(
@@ -689,32 +796,33 @@ function emitDartUsdaResultDecoder(
       : []),
     ...constructorFields,
     ...computedFields,
-    `    );`,
+    `    ), workspace: workspace, type: ${JSON.stringify(decoder.runtimeType)}, id: id);`,
     `  }).toList(growable: false);`,
     `}`,
     `NomosPage<${decoder.model}> _nmsDecode${decoder.model}Page(Uint8List bytes, String workspace) {`,
     `  final result = NmsUsdaResult.parse(bytes);`,
     `  return NomosPage(rows: ${functionName}(bytes, workspace), cursor: result.cursor, done: result.done);`,
     `}`,
+    `/// Framework-internal nominal decoder used by a typed ForeignRef.`,
+    `${decoder.model}? nmsInternalDecode${decoder.model}ById(Uint8List bytes, String workspace, String id) {`,
+    `  for (final row in ${functionName}(bytes, workspace)) {`,
+    `    if (row.ref.id == id) return row;`,
+    `  }`,
+    `  return null;`,
+    `}`,
     ``,
   ];
 }
 
-export interface DartBridgeClientOptions {
+export interface DartClientOptions {
   /** Content identity of the built typed USDA closure (`.law.usdz`). */
   readonly domainHash: string;
   /** Flutter asset key for the compiler-authored USDZ transport. Generated
    * child openers use it to inherit an accepted parent model through the
    * child's ordinary author gate. Omit for pure-Dart/vendored clients. */
-  readonly lawAssetKey?: string;
-  /** This domain's STRUCTURAL INTERFACE (#72) — directives (payload shapes) + aggregates
-   *  (read shapes, sid-keyed). Baked in as JSON so the app can negotiate shape-compatibility
-   *  against the workspace's installed offer, NOT by law hash. */
+  /** Compiler graph used to generate the one USDA compatibility matrix. */
   readonly interface?: unknown;
-  /** The CLIENT/LAW COMPAT MANIFEST (§5) — the law hash + interface hash + generator provenance
-   *  this client was generated against. Baked in as JSON (DIAGNOSIS only, never a gate). */
-  readonly compat?: unknown;
-  /** Where the bridge/runtime support types are imported from. */
+  /** Where the session/runtime support types are imported from. */
   readonly supportImport?: "vendored" | "package";
   /**
    * Relative import of the shared `nomos_framework.dart` (framework-shared aggregate types, emitted
@@ -777,10 +885,10 @@ export interface DartBridgeClientOptions {
   };
 }
 
-/** Generate the `<name>.client.dart` async bridge client for one domain module. */
-export function generateDartBridgeClient(
+/** Generate the `<name>.client.dart` async session client for one domain module. */
+export function generateDartDomainClient(
   mod: DomainModule,
-  opts: DartBridgeClientOptions
+  opts: DartClientOptions
 ): string {
   const callUsda = opts.callUsda;
   if (callUsda === undefined) {
@@ -791,25 +899,21 @@ export function generateDartBridgeClient(
         "application calls and results may not fall back to generic maps"
     );
   }
+  const operationSelection = dartClientOperationSelection(mod, callUsda.graph);
   const authoredDirectives = mod.directives as AnyDirective[];
   const workspaceSharingPolicies: readonly WorkspaceSharingPolicy[] =
     mod.applicationWorkspaceSharing ?? [];
-  const workspaceSharingReceipts = [
-    ...new Map(
-      workspaceSharingPolicies
-        .flatMap((policy) => [...policy.delivered, ...policy.refused])
-        .map((receipt) => [receipt.records.id, receipt.records] as const)
-    ).values(),
-  ] as AnyDirective[];
-  const workspaceSharingReceiptIds = new Set(
-    workspaceSharingReceipts.map((directive) => directive.id)
+  const workspaceSharingQueryIds = new Set(
+    workspaceSharingPolicies.map(
+      (policy) => policy.invitationLaw.pendingByRecipient.id
+    )
   );
   const publicAggregates = mod.aggregates.filter(
     (a) =>
       (a as { businessBirthInternal?: unknown }).businessBirthInternal !== true
   );
   const publicAggregateIds = new Set(publicAggregates.map((a) => a.id));
-  const publicDirectives = mod.applicationIntents ?? mod.directives;
+  const publicDirectives = operationSelection.publicDirectives;
   mod = {
     ...mod,
     aggregates: publicAggregates,
@@ -824,7 +928,8 @@ export function generateDartBridgeClient(
           queries: mod.queries.filter(
             (q) =>
               (q as { businessBirthInternal?: unknown })
-                .businessBirthInternal !== true
+                .businessBirthInternal !== true ||
+              workspaceSharingQueryIds.has(q.id)
           ),
         }),
     ...(mod.readModelAggregates === undefined
@@ -884,6 +989,7 @@ export function generateDartBridgeClient(
       : qualifyReadProjectionType(ownerDomain, aggregateType);
   };
   const resultDecoderSources: string[] = [];
+  const resultProtoDecoderSources: string[] = [];
   const resultDecoderByAggregate = new Map<string, DartUsdaResultDecoder>();
   {
     for (const aggregate of mod.aggregates) {
@@ -959,7 +1065,10 @@ export function generateDartBridgeClient(
           required: field.isFromBirth === true,
           ...(foreignWorkspacePath === undefined
             ? {}
-            : { foreignWorkspacePath }),
+            : {
+                foreignWorkspacePath,
+                foreignWorkspaceName: spec.foreignRefWorkspaceField,
+              }),
         };
       });
       const computedFields = [
@@ -1094,17 +1203,6 @@ export function generateDartBridgeClient(
     }
     return needsReadPrincipal(typeId) ? ", null, _client.actor" : "";
   };
-  // The DISTINCT encryption scopes this domain defines (across encrypted reads + sealing directives) — the
-  // set the owner ceremony rotates. Empty ⇒ no `encryption` getter is emitted for this domain.
-  const domScopes: string[] = (() => {
-    if (encMap === null) return [];
-    const s = new Set<string>();
-    for (const r of Object.values(encMap.reads))
-      for (const f of Object.values(r)) if (f.owned !== true) s.add(f.scope);
-    for (const dir of Object.values(encMap.directives))
-      for (const f of Object.values(dir)) if (f.owned !== true) s.add(f.scope);
-    return [...s].sort();
-  })();
   const ownedScopes: string[] = (() => {
     if (encMap === null) return [];
     const scopes = new Set<string>();
@@ -1135,7 +1233,7 @@ export function generateDartBridgeClient(
       `  /// publication. The kernel reads one compiled current pointer; it does not resolve history.`,
       `  Future<ReferenceVersionStatus<TVersion>> referenceVersionStatus<TVersion, TSeries>(`,
       `      VersionedNomosRef<TVersion, TSeries> reference) =>`,
-      `      bridge.checkReferenceVersion(reference);`,
+      `      session.checkReferenceVersion(reference);`,
       ``
     );
   }
@@ -1176,10 +1274,6 @@ export function generateDartBridgeClient(
   // THE STATIC INTERFACE DESCRIPTOR (`XClient.interface`, session_bound_clients.md asks 5/9) —
   // what this client EXPECTS of a workspace: the domain key, the law hash it compiled under, and
   // the structural interface (#72). `bind(session)` / `session.assertCompatible(...)` consume it.
-  const compatInterfaceHash = (
-    opts.compat as { interfaceHash?: string } | undefined
-  )?.interfaceHash;
-
   // ── directives → typed offer ──
   // A `.births()` directive is still authored on its bound parent workspace. It therefore uses the
   // same typed USDA/Protobuf offer door as every other directive; only the law's effect crosses custody.
@@ -1188,7 +1282,8 @@ export function generateDartBridgeClient(
       d &&
       typeof d.id === "string" &&
       typeof (d as { payloadSchema?: unknown }).payloadSchema === "object" &&
-      (d as { businessBirthInternal?: unknown }).businessBirthInternal !== true
+      (d as { businessBirthInternal?: unknown }).businessBirthInternal !== true &&
+      publishingIntentOf(callUsda.graph, mod.domain ?? mod.name, d.id) === undefined
   );
   const birthDirs = allDirs.filter(
     (d) => (d as { birthsChild?: boolean }).birthsChild === true
@@ -1196,119 +1291,10 @@ export function generateDartBridgeClient(
   const dirs = allDirs.filter(
     (d) => (d as { birthsChild?: boolean }).birthsChild !== true
   );
-  // Only a no-argument enrolled-device intent can be the client's automatic stale-token
-  // recovery hook. Enrolled-device intents with typed inputs are explicit business operations
-  // (for example all-device-loss recovery bound to a named principal) and remain ordinary
-  // generated APIs; their proof posture does not make them automatic lifecycle hooks.
-  const authenticationRecoveryDirs = dirs.filter(
-    (directive) =>
-      isBusinessIntent(directive) &&
-      directive.offerAuthenticationProof === "enrolledDevice" &&
-      introspectPayload(directive.payloadSchema as z.ZodTypeAny, enumDartTypes)
-        .length === 0
-  );
-  if (authenticationRecoveryDirs.length > 1) {
-    throw new Error(
-      `Dart client codegen: '${domain}' declares more than one enrolled-device authentication recovery intent; ` +
-        "the framework cannot choose a unique law-authored recovery operation"
-    );
-  }
-  const authenticationRecovery = authenticationRecoveryDirs[0];
-  const childAuthenticationRecoveries = dirs.flatMap((directive) => {
-    if (!isBusinessIntent(directive)) return [];
-    const aggregateId = childAuthenticationRecoveryAggregateId(directive);
-    if (aggregateId === undefined) return [];
-    const fields = introspectPayload(
-      directive.payloadSchema as z.ZodTypeAny,
-      enumDartTypes,
-    );
-    if (
-      fields.length !== 2 ||
-      fields.some(
-        (field) =>
-          !["workspace", "user"].includes(field.name) ||
-          field.optional ||
-          field.dartType !== "String",
-      )
-    ) {
-      throw new Error(
-        `Dart child-authentication recovery '${domain}/${directive.id}' must accept exactly required string fields { workspace, user }`,
-      );
-    }
-    return [{ aggregateId, directive }];
-  });
-  for (const recovery of childAuthenticationRecoveries) {
-    if (
-      childAuthenticationRecoveries.some(
-        (candidate) =>
-          candidate !== recovery &&
-          candidate.aggregateId === recovery.aggregateId,
-      )
-    ) {
-      throw new Error(
-        `Dart client codegen: '${domain}' declares more than one authentication repair action for '${recovery.aggregateId}'`,
-      );
-    }
-    const method = safeMethod(recovery.directive.id);
-    const input = dartActionInputClassName(recovery.directive);
-    methods.push(
-      `  /// Generated child-open recovery: inspect the child's kernel posture, then ask this`,
-      `  /// authenticated parent law to send its committed signer/provider state to that exact child.`,
-      `  Future<void> ${dartInternalChildAuthenticationRecoveryMethod(
-        recovery.aggregateId,
-      )}(String workspace) async {`,
-      `    final expectedPrincipal = actor ?? bridge.principal ?? '';`,
-      `    if (expectedPrincipal.isEmpty) {`,
-      `      throw StateError('Child authentication recovery requires the signed-in principal.');`,
-      `    }`,
-      `    final child = await bridge.acquireSession(workspace);`,
-      `    final posture = await child.nmsAuthenticationPosture(principal: expectedPrincipal);`,
-      `    if (posture.isReadyFor(expectedPrincipal)) return;`,
-      `    await ${method}(${input}(`,
-      `      workspace: workspace, user: expectedPrincipal,`,
-      `    ));`,
-      `    final parentSync = await bridge.sync(admit: true);`,
-      `    if (parentSync.offline || parentSync.pushFailed) {`,
-      `      throw StateError('Parent authentication recovery could not reach custody: ' +`,
-      `        (parentSync.hasPushError() ? parentSync.pushError.message : 'workspace is offline'));`,
-      `    }`,
-      `    await child.nmsAwaitProviderTokenReady(principal: expectedPrincipal);`,
-      `    await child.nmsAwaitAuthenticationReady(principal: expectedPrincipal);`,
-      `  }`,
-      ``,
-    );
-  }
+  const sourceTrustViaIds = operationSelection.sourceTrustViaIds;
+  const sourceTrustDirectives = operationSelection.sourceTrustDirectives;
   const localOfferDirs = [...dirs, ...birthDirs];
-  const sourceTrustViaIds = new Set(
-    dirs.flatMap((directive) =>
-      directive.businessSourceTrust === undefined
-        ? []
-        : [directive.businessSourceTrust.viaDirectiveId]
-    )
-  );
-  const sourceTrustDirectives = authoredDirectives.filter((directive) =>
-    sourceTrustViaIds.has(directive.id)
-  );
-  for (const viaDirectiveId of sourceTrustViaIds) {
-    if (
-      !sourceTrustDirectives.some(
-        (directive) => directive.id === viaDirectiveId
-      )
-    ) {
-      throw new Error(
-        `Dart source-trust codegen: '${domain}' has no hidden directive '${viaDirectiveId}'`
-      );
-    }
-  }
-  const encoderDirs = [
-    ...new Map(
-      [
-        ...localOfferDirs,
-        ...sourceTrustDirectives,
-        ...workspaceSharingReceipts,
-      ].map((directive) => [directive.id, directive] as const)
-    ).values(),
-  ];
+  const encoderDirs = operationSelection.encoderDirectives;
   const callEncoderSources: string[] = [];
   const callEncoderByDirective = new Map<
     string,
@@ -1316,9 +1302,7 @@ export function generateDartBridgeClient(
   >();
   const internalRecordTypes = new Map<string, string>();
   for (const directive of encoderDirs) {
-    const compilerInternal =
-      sourceTrustViaIds.has(directive.id) ||
-      workspaceSharingReceiptIds.has(directive.id);
+    const compilerInternal = sourceTrustViaIds.has(directive.id);
     const businessBirth = (
       directive as unknown as {
         businessBirth?: { publicPayloadSchema: z.ZodTypeAny };
@@ -1341,11 +1325,11 @@ export function generateDartBridgeClient(
       : dartActionInputClassName(directive);
     if (compilerInternal) internalRecordTypes.set(directive.id, payloadClass);
     const specsByName = new Map(specs.map((spec) => [spec.name, spec]));
-    const access = new Map<string, DartCallUsdaFieldAccess>();
+    const access = new Map<string, DartCallProtoFieldAccess>();
     for (const spec of specs) {
       access.set(
         spec.name,
-        dartCallUsdaFieldAccess(domain, directive.id, spec)
+        dartCallProtoFieldAccess(domain, directive.id, spec)
       );
     }
     const extraParameters: string[] = [];
@@ -1508,7 +1492,7 @@ export function generateDartBridgeClient(
         });
       }
     }
-    const encoder = emitDartCallUsdaEncoder(
+    const encoder = emitDartCallProtoEncoder(
       callUsda.graph,
       callUsda.paths,
       domain,
@@ -1544,29 +1528,6 @@ export function generateDartBridgeClient(
       ``
     );
   }
-  for (const directive of workspaceSharingReceipts) {
-    const encoder = callEncoderByDirective.get(directive.id);
-    const payloadType = internalRecordTypes.get(directive.id);
-    if (
-      encoder === undefined ||
-      payloadType === undefined ||
-      encoder.arguments.some((argument) => argument !== "now")
-    ) {
-      throw new Error(
-        `Dart workspace-sharing codegen: hidden receipt '${domain}/${directive.id}' is not a closed typed record`
-      );
-    }
-    const method = dartInternalWorkspaceSharingReceiptMethod(directive.id);
-    const implementation =
-      encoder.arguments.length === 0
-        ? `=>\n      _offer(${encoder.functionName}(payload));`
-        : `{\n    final now = DateTime.now().toUtc().toIso8601String();\n    return _offer(${encoder.functionName}(payload, now));\n  }`;
-    methods.push(
-      `  /// @internal Compiler-generated workspace-sharing receipt. Not tenant application vocabulary.`,
-      `  Future<NomosOfferOutcome> ${method}(${payloadType} payload) ${implementation}`,
-      ``
-    );
-  }
   const ownedActionCallEncoders = new Map<
     string,
     {
@@ -1579,8 +1540,8 @@ export function generateDartBridgeClient(
   if (ownedScope !== undefined && Object.keys(ownedActions).length > 0) {
     const ownedAccess = (
       fields: readonly string[]
-    ): Map<string, DartCallUsdaFieldAccess> => {
-      const access = new Map<string, DartCallUsdaFieldAccess>();
+    ): Map<string, DartCallProtoFieldAccess> => {
+      const access = new Map<string, DartCallProtoFieldAccess>();
       for (const field of fields) {
         access.set(field, { value: `payload.${dartMemberName(field)}` });
       }
@@ -1618,7 +1579,7 @@ export function generateDartBridgeClient(
     for (const actions of Object.values(ownedActions)) {
       for (const action of ["share", "unshare", "transfer"] as const) {
         const directiveId = actions[action];
-        const encoder = emitDartCallUsdaEncoder(
+        const encoder = emitDartCallProtoEncoder(
           callUsda.graph,
           callUsda.paths,
           domain,
@@ -1634,13 +1595,13 @@ export function generateDartBridgeClient(
         });
       }
     }
-    const approvalEncoder = emitDartCallUsdaEncoder(
+    const approvalEncoder = emitDartCallProtoEncoder(
       callUsda.graph,
       callUsda.paths,
       domain,
       OWNED_DEVICE_APPROVAL_DIRECTIVE,
       "NomosOwnedDeviceApprovalPreparation",
-      new Map<string, DartCallUsdaFieldAccess>([
+      new Map<string, DartCallProtoFieldAccess>([
         ["newKeySubject", { value: "payload.newKeySubject" }],
         ["ownedCustody", { value: "payload.ownedCustody" }],
         ["verifiedVia", { value: "payload.verifiedVia" }],
@@ -1675,48 +1636,10 @@ export function generateDartBridgeClient(
   const correctionActions = dirs.filter(
     (d) => (d as { businessBirth?: unknown }).businessBirth === undefined
   );
-  if (correctionActions.length > 0) {
-    const correctionsClass = `${className}Corrections`;
-    const outcomeClass = `${className}CorrectionOutcome`;
-    methods.push(
-      `  /// Correct this principal's latest business change. The framework owns target selection and replay.`,
-      `  ${correctionsClass} get corrections => ${correctionsClass}(this);`,
-      ``
-    );
-    pastDeclarations.push(
-      `/// Result of a reasoned business correction. Framework intent and testimony ids remain private.`,
-      `class ${outcomeClass} {`,
-      `  final bool ok;`,
-      `  final String kind;`,
-      `  final String? reason;`,
-      `  final String? message;`,
-      `  final String? head;`,
-      `  const ${outcomeClass}({required this.ok, required this.kind, this.reason, this.message, this.head});`,
-      `  factory ${outcomeClass}.fromJson(Map<String, Object?> json) => ${outcomeClass}(`,
-      `      ok: json['ok'] == true, kind: (json['kind'] ?? '') as String,`,
-      `      reason: json['reason'] as String?, message: json['message'] as String?, head: json['head'] as String?);`,
-      `}`,
-      ``,
-      `/// One business correction lane. Application code provides only its reason.`,
-      `class ${correctionsClass} {`,
-      `  final ${className} _client;`,
-      `  const ${correctionsClass}(this._client);`,
-      `  Future<${outcomeClass}> undo(String reason) => _apply('undo', reason);`,
-      `  Future<${outcomeClass}> redo(String reason) => _apply('redo', reason);`,
-      `  Future<${outcomeClass}> _apply(String kind, String reason) async {`,
-      `    if (reason.trim().isEmpty) throw ArgumentError('corrections.\$kind() needs a reason');`,
-      `    final result = await _client.bridge.correctMostRecent(`,
-      `      kind: kind, domain: ${dartStr(domain)},`,
-      `      actions: const [${correctionActions
-        .map((d) => dartStr(d.id))
-        .join(", ")}],`,
-      `      reason: reason, domainHash: _client.domainHash, actor: _client.actor);`,
-      `    return ${outcomeClass}.fromJson(result);`,
-      `  }`,
-      `}`,
-      ``
-    );
-  }
+  // Corrections remain framework law, but no Dart API is emitted until the
+  // peer runtime owns a nominal Runtime v2 correction command. The removed
+  // surface called a JavaScript-only control method and decoded an anonymous
+  // map, so it was neither portable nor end-to-end typed.
   for (const d of dirs) {
     const payloadClass = dartActionInputClassName(d);
     // targetBinding is declared on AnyDirective (directive.ts) — honour it for EVERY
@@ -1740,7 +1663,7 @@ export function generateDartBridgeClient(
     // THE AUTHORITY GATE (codegen-time): a directive carrying `.requires(relation)` is GATED — its method
     // throws MissingOfferAuthority when `actor` is null/empty, BEFORE any submit, so an actorless gated
     // offer is impossible to GENERATE (the war: the gate is structural, not just kernel-side). Secrets never
-    // appear — only the actor identity (the bridge owns signing).
+    // appear — only the actor identity (the session owns signing).
     const gate = (d as { requiresRelationGate?: { relation: string } })
       .requiresRelationGate;
     const gateGuard =
@@ -1759,7 +1682,7 @@ export function generateDartBridgeClient(
     // bound [keyStore] before dispatch (a missing key throws [EncryptionKeyUnavailable] — never a plaintext
     // write). One async block covers creates + mutate + gated + stamps; `seal: false` is the escape hatch.
     // THE ONE WRITE OUTCOME (architecture/nomos_ref.md): EVERY directive method returns Future<NomosOfferOutcome>
-    // via the ONE lane `bridge.offerOutcome` — `outcome.created` carries every minted aggregate (each with its
+    // via the ONE lane `session.offerOutcome` — `outcome.created` carries every minted aggregate (each with its
     // typed `.ref`), `outcome.head` the new local head. The breaking cut: creates AND non-creates alike.
     const createsDoc =
       (d as { marker?: string }).marker === "creates"
@@ -1772,7 +1695,7 @@ export function generateDartBridgeClient(
       principalField === undefined
         ? []
         : [
-            `    final nmsInternalPrincipal = actor ?? bridge.principal;`,
+            `    final nmsInternalPrincipal = actor;`,
             `    if (nmsInternalPrincipal == null || nmsInternalPrincipal.trim().isEmpty) {`,
             `      throw MissingOfferAuthority(domain: ${dartStr(
               domain
@@ -1787,12 +1710,13 @@ export function generateDartBridgeClient(
         `Dart call USDA codegen: '${domain}/${d.id}' has no generated encoder`
       );
     }
-    const callUsda = `${callEncoder.functionName}(${[
+    const generatedCall = `${callEncoder.functionName}(${[
       "payload",
       ...callEncoder.arguments,
     ].join(", ")})`;
-    const offerCall = `_offer(${callUsda}${
-      isBusinessIntent(d) && d.offerAuthenticationProof === "enrolledDevice"
+    const offerCall = `_offer(${generatedCall}${
+      isBusinessIntent(d) &&
+      d.authentication?.kind === MemberAuthenticationKind.EnrolledDevice
         ? ", authenticationProof: NomosOfferAuthenticationProof.enrolledDevice"
         : ""
     })`;
@@ -1837,14 +1761,14 @@ export function generateDartBridgeClient(
           : recordTarget.kind === "premint"
           ? [
               `    final ownedRecordType = ${dartStr(runtimeType)};`,
-              `    final ownedRecordId = await bridge.mintId(ownedRecordType);`,
+              `    final ownedRecordId = await session.mintId(ownedRecordType);`,
               `    const ownedRecordPreMinted = true;`,
             ]
           : recordTarget.kind === "payload"
           ? [
               `    final ownedRecordType = ${dartStr(runtimeType)};`,
               `    final ownedRecordId = ${
-                dartCallUsdaFieldAccess(
+                dartCallProtoFieldAccess(
                   domain,
                   d.id,
                   encryptedSpecs.get(recordTarget.field) ??
@@ -1865,7 +1789,7 @@ export function generateDartBridgeClient(
       const ownedKeyPrelude = ownedSeal
         ? [
             ...recordPrelude,
-            `    final nmsInternalOwnedKey = await bridge.nomosOwnedScopeKey(`,
+            `    final nmsInternalOwnedKey = await session.nomosOwnedScopeKey(`,
             `        ${dartStr(Object.values(directiveEncryption)[0]!.scope)},`,
             `        recordType: ownedRecordType, recordId: ownedRecordId);`,
             `    final nmsInternalOwnedKeySubject = nmsInternalOwnedKey.ownedKeySubject;`,
@@ -1912,7 +1836,7 @@ export function generateDartBridgeClient(
             `      if (${key} == null) throw EncryptionKeyUnavailable(${dartStr(
               descriptor.scope
             )}, ${dartStr(field)});`,
-            `      ${sealed} = await bridge.cryptoSealField(`,
+            `      ${sealed} = await session.cryptoSealField(`,
             `        scopeKey: ${key}.key, scope: ${
               descriptor.owned === true
                 ? `${key}.scope`
@@ -2013,7 +1937,7 @@ export function generateDartBridgeClient(
     }
   }
 
-  // ── `.births()` directives → typed CROSS-WORKSPACE birth (bridge.createWorkspace) ──
+  // ── `.births()` directives → typed CROSS-WORKSPACE birth (session.createWorkspace) ──
   // Each births a CHILD WORKSPACE under `parent` via a signed governance offer routed by the PARENT'S
   // law (POST /v2/workspaces/<parent>/<directiveId>) — never a same-workspace write. The declaring
   // domain's key + directiveId + baked domainHash are all bound at codegen time, so a frontend dev
@@ -2090,7 +2014,7 @@ export function generateDartBridgeClient(
         ownedBirthDescriptor === undefined
           ? []
           : [
-              `    final nmsInternalOwnedKey = await bridge.nomosOwnedBirthScopeKey(`,
+              `    final nmsInternalOwnedKey = await session.nomosOwnedBirthScopeKey(`,
               `        ${dartStr(ownedBirthDescriptor.scope)}, ${dartStr(
                 businessBirth.namespace
               )}, payload.${dartMemberName(businessBirth.keyField)}, ${dartStr(
@@ -2132,7 +2056,7 @@ export function generateDartBridgeClient(
                   `      if (${key} == null) throw EncryptionKeyUnavailable(${dartStr(
                     descriptor.scope
                   )}, ${dartStr(field)});`,
-                  `      ${sealed} = await bridge.cryptoSealField(`,
+                  `      ${sealed} = await session.cryptoSealField(`,
                   `        scopeKey: ${key}.key, scope: ${
                     descriptor.owned === true
                       ? `${key}.scope`
@@ -2196,7 +2120,7 @@ export function generateDartBridgeClient(
         `  Future<NomosRef<${concreteClassName(
           businessBirth.aggregateId
         )}>> ${publicMethod}(${payloadClass} payload) async {`,
-        `    final principal = actor ?? bridge.principal;`,
+        `    final principal = actor;`,
         `    if (principal == null || principal.trim().isEmpty) {`,
         `      throw MissingOfferAuthority(domain: ${dartStr(
           domain
@@ -2204,21 +2128,19 @@ export function generateDartBridgeClient(
           d.id
         )}, requires: 'a signed-in Nomos session');`,
         `    }`,
-        `    await _preflightOnce();`,
-        `    await _prepareCommand(${dartStr(d.id)});`,
         ...(businessBirth.domain === domain
           ? []
           : [
               `    // This parent offer synchronously runs the child genesis plan. Name that exact`,
               `    // authenticated slice now so birth never composes an unrelated or cold domain.`,
-              `    await bridge.prepareDomain(domain: ${dartStr(
+              `    await session.prepareDomain(domain: ${dartStr(
                 businessBirth.domain
               )}, directiveId: ${dartStr(
                 seedDirectiveId
               )}, packageHash: ${hashConst});`,
               ...genesisDirectiveIds.map(
                 (directiveId) =>
-                  `    await bridge.prepareDomain(domain: ${dartStr(
+                  `    await session.prepareDomain(domain: ${dartStr(
                     businessBirth.domain
                   )}, directiveId: ${dartStr(
                     directiveId
@@ -2298,7 +2220,9 @@ export function generateDartBridgeClient(
   }
 
   // ── declared queries → one-shot + reactive ──
-  for (const q of (mod.queries ?? []) as QueryDecl[]) {
+  for (const read of [...(mod.queries ?? []), ...(mod.orderedReads ?? [])]) {
+    const ordered = "orderKey" in read ? read : undefined;
+    const q = "orderKey" in read ? { id: read.id, returns: read.of, key: [] as string[] } : read;
     const model = readModelClassName(q.returns);
     const agg = aggById.get(q.returns);
     const params = q.key
@@ -2307,7 +2231,7 @@ export function generateDartBridgeClient(
           `required ${dartKeyType(agg, k, enumDartTypes)} ${dartKeyParam(k)}`
       )
       .join(", ");
-    const queryEncoder = emitDartQueryUsdaEncoder(
+    const queryEncoder = emitDartQueryProtoEncoder(
       callUsda.graph,
       callUsda.paths,
       domain,
@@ -2327,29 +2251,82 @@ export function generateDartBridgeClient(
     );
     callEncoderSources.push(...queryEncoder.source);
     const queryCall = queryEncoder.call;
+    const queryNode = callUsda.graph.nodes.find(
+      (node): node is LawRowReadNode =>
+        node.kind === "read" &&
+        (node.readKind === "query" || node.readKind === "ordered") &&
+        node.entity.label === q.id
+    );
+    if (queryNode === undefined) {
+      throw new Error(
+        `Dart result Protobuf codegen: composed law has no '${domain}.${q.id}' query`
+      );
+    }
+    const aggregateDecoder = resultDecoderByAggregate.get(q.returns);
+    if (aggregateDecoder === undefined) {
+      throw new Error(
+        `Dart result Protobuf codegen: '${domain}.${q.id}' has no '${q.returns}' result model`
+      );
+    }
+    const resultProtoDecoder = emitDartQueryResultProtoDecoder(
+      callUsda.graph,
+      callUsda.paths,
+      queryNode,
+      aggregateDecoder
+    );
+    resultProtoDecoderSources.push(...resultProtoDecoder.source);
+    const decodeRows = resultProtoDecoder.rowsFunction;
+    const decodePage = resultProtoDecoder.pageFunction;
     const m = safeMethod(lcFirst(camel(q.id)));
     const qScopes = readScopesFor(q.returns);
     const qOwned = qScopes.some((scope) => scope.owned === true);
     const qPrivate = needsReadPrincipal(q.returns);
     const qScopesExpr = scopesExpr(qScopes);
     const nominalWatch = qOwned
-      ? `bridge.nmsWatchUsda(${queryCall}${
+      ? `session.nmsWatch(${queryCall}${
           qPrivate ? ", principal: actor" : ""
-        }).asyncMap((_) => _readWithOwnedKeys(${qScopesExpr}, (keys) async => _nmsDecode${model}Rows(await bridge.nmsQueryUsda(${queryCall}, keys${
+        }).asyncMap((result) async => _readWithOwnedKeys(${qScopesExpr}, (keys) async => ${decodeRows}(await session.nmsQuery(${queryCall}, keys${
           qPrivate ? ", actor" : ""
-        }), _ws), (row) => row.ref))`
+        }), _ws), (row) => row.ref, initial: await ${decodeRows}(result, _ws)))`
       : qScopes.length
-      ? `Stream.fromFuture(_readKeys(${qScopesExpr})).asyncExpand((keys) => bridge.nmsWatchUsda(${queryCall}, keys: keys${
+      ? `Stream.fromFuture(_readKeys(${qScopesExpr})).asyncExpand((keys) => session.nmsWatch(${queryCall}, keys: keys${
           qPrivate ? ", principal: actor" : ""
-        }).map((usda) => _nmsDecode${model}Rows(usda, _ws)))`
-      : `bridge.nmsWatchUsda(${queryCall}${
+        }).asyncMap((result) => ${decodeRows}(result, _ws)))`
+      : `session.nmsWatch(${queryCall}${
           qPrivate ? ", principal: actor" : ""
-        }).map((usda) => _nmsDecode${model}Rows(usda, _ws))`;
+        }).asyncMap((result) => ${decodeRows}(result, _ws))`;
+    if (ordered !== undefined) {
+      const resultType = ordered.limit === 1 ? `${model}?` : `List<${model}>`;
+      const select = ordered.limit === 1 ? "rows.isEmpty ? null : rows.single" : "rows";
+      const live = qOwned
+        ? `_readWithOwnedKeys(${qScopesExpr}, (keys) async => ${decodeRows}(await session.nmsQuery(${queryCall}, keys${qPrivate ? ", actor" : ""}), _ws), (row) => row.ref)`
+        : `${decodeRows}(await session.nmsQuery(${queryCall}${keysArg(q.returns)}), _ws)`;
+      const past = qOwned
+        ? `_client._readWithOwnedKeys(${qScopesExpr}, (keys) async => ${decodeRows}(await _client.session.nmsQueryAt(moment, ${queryCall}, keys${qPrivate ? ", _client.actor" : ""}), _client._ws), (row) => row.ref)`
+        : `${decodeRows}(await _client.session.nmsQueryAt(moment, ${queryCall}${pastKeysArg(q.returns)}), _client._ws)`;
+      methods.push(
+        `  /// Ordered by installed law, limited to ${ordered.limit} visible records.`,
+        `  Future<${resultType}> ${m}() async {`,
+        `    final rows = await ${live};`,
+        `    return ${select};`,
+        `  }`,
+        `  Stream<${resultType}> watch${cap(camel(q.id))}() => (${nominalWatch}).map((rows) => ${select});`,
+        ``,
+      );
+      pastMethods.push(
+        `  Future<${resultType}> ${m}() async {`,
+        `    final rows = await ${past};`,
+        `    return ${select};`,
+        `  }`,
+        ``,
+      );
+      continue;
+    }
     const pageRead = qOwned
-      ? `_readPageWithOwnedKeys(${qScopesExpr}, (keys) async => _nmsDecode${model}Page(await bridge.nmsQueryPageUsda(${queryCall}, pageSize: pageSize, cursor: cursor, keys: keys${
+      ? `_readPageWithOwnedKeys(${qScopesExpr}, (keys) async => ${decodePage}(await session.nmsQueryPage(${queryCall}, pageSize: pageSize, cursor: cursor, keys: keys${
           qPrivate ? ", principal: actor" : ""
         }), _ws), (row) => row.ref)`
-      : `_nmsDecode${model}Page(await bridge.nmsQueryPageUsda(${queryCall}, pageSize: pageSize, cursor: cursor${
+      : `${decodePage}(await session.nmsQueryPage(${queryCall}, pageSize: pageSize, cursor: cursor${
           qScopes.length ? `, keys: await _readKeys(${qScopesExpr})` : ""
         }${qPrivate ? ", principal: actor" : ""}), _ws)`;
     methods.push(
@@ -2361,10 +2338,10 @@ export function generateDartBridgeClient(
       `  @Deprecated('Whole-result reads scale with result size; use ${m}Page().')`,
       `  Future<List<${model}>> ${m}({${params}}) async =>`,
       qOwned
-        ? `      _readWithOwnedKeys(${qScopesExpr}, (keys) async => _nmsDecode${model}Rows(await bridge.nmsQueryUsda(${queryCall}, keys${
+        ? `      _readWithOwnedKeys(${qScopesExpr}, (keys) async => ${decodeRows}(await session.nmsQuery(${queryCall}, keys${
             qPrivate ? ", actor" : ""
           }), _ws), (row) => row.ref);`
-        : `      _nmsDecode${model}Rows(await bridge.nmsQueryUsda(${queryCall}${keysArg(
+        : `      ${decodeRows}(await session.nmsQuery(${queryCall}${keysArg(
             q.returns
           )}), _ws);`,
       ``,
@@ -2385,10 +2362,10 @@ export function generateDartBridgeClient(
       `  /// Declared query \`${q.id}\` in the verified world at [moment].`,
       `  Future<List<${model}>> ${m}({${params}}) async =>`,
       qOwned
-        ? `      _client._readWithOwnedKeys(${qScopesExpr}, (keys) async => _nmsDecode${model}Rows(await _client.bridge.nmsQueryAtUsda(moment, ${queryCall}, keys${
+        ? `      _client._readWithOwnedKeys(${qScopesExpr}, (keys) async => ${decodeRows}(await _client.session.nmsQueryAt(moment, ${queryCall}, keys${
             qPrivate ? ", _client.actor" : ""
           }), _client._ws), (row) => row.ref);`
-        : `      _nmsDecode${model}Rows(await _client.bridge.nmsQueryAtUsda(moment, ${queryCall}${pastKeysArg(
+        : `      ${decodeRows}(await _client.session.nmsQueryAt(moment, ${queryCall}${pastKeysArg(
             q.returns
           )}), _client._ws);`,
       ``
@@ -2407,7 +2384,7 @@ export function generateDartBridgeClient(
       `  /// Declared spatial index \`${sp.id}\` — rows of \`${sp.of}\` whose \`${sp.on}\` geometry`,
       `  /// intersects [bbox] (an R*Tree probe on the local projection, never a scan).`,
       `  Future<List<${model}>> ${m}({required NomosBbox bbox}) async =>`,
-      `      _nmsDecode${model}Rows(await bridge.nmsSpatialWithinUsda(${dartStr(
+      `      _nmsDecode${model}Rows(await session.nmsSpatialWithinUsda(${dartStr(
         sp.id
       )}, bbox), _ws);`,
       ``,
@@ -2415,7 +2392,7 @@ export function generateDartBridgeClient(
       `  Stream<List<${model}>> watch${cap(
         camel(sp.id)
       )}({required NomosBbox bbox}) =>`,
-      `      bridge.nmsWatchSpatialUsda(${dartStr(
+      `      session.nmsWatchSpatialUsda(${dartStr(
         sp.id
       )}, bbox).map((usda) => _nmsDecode${model}Rows(usda, _ws));`,
       ``
@@ -2435,10 +2412,10 @@ export function generateDartBridgeClient(
             c.by
           }\`.\n  Future<int> ${m}(${groupType} ${dartKeyParam(
             c.by
-          )}) => bridge.nmsCount(${dartStr(c.id)}, ${groupValue});`
+          )}) => session.nmsCount(${dartStr(c.id)}, ${groupValue});`
         : `  /// Declared count \`${
             c.id
-          }\` — the maintained O(1) grand total.\n  Future<int> ${m}() => bridge.nmsCount(${dartStr(
+          }\` — the maintained O(1) grand total.\n  Future<int> ${m}() => session.nmsCount(${dartStr(
             c.id
           )});`,
       ``
@@ -2449,16 +2426,31 @@ export function generateDartBridgeClient(
             c.id
           }\` at [moment].\n  Future<int> ${m}(${groupType} ${dartKeyParam(
             c.by
-          )}) => _client.bridge.nmsCountAt(moment, ${dartStr(
+          )}) => _client.session.nmsCountAt(moment, ${dartStr(
             c.id
           )}, ${groupValue});`
         : `  /// Declared count \`${
             c.id
-          }\` at [moment].\n  Future<int> ${m}() => _client.bridge.nmsCountAt(moment, ${dartStr(
+          }\` at [moment].\n  Future<int> ${m}() => _client.session.nmsCountAt(moment, ${dartStr(
             c.id
           )});`,
       ``
     );
+    methods.push(
+      `  /// Observe the maintained tally; unchanged counts emit no new value.`,
+      `  Stream<int> watch${cap(camel(c.id))}(${c.by == null ? "" : `${groupType} ${dartKeyParam(c.by)}`}) => session.nmsWatchCount(${dartStr(c.id)}${c.by == null ? "" : `, ${groupValue}`});`,
+      ``,
+    );
+  }
+  for (const membership of (mod.exists_ ?? []).map(finishExists)) {
+    const method = safeMethod(lcFirst(camel(membership.id)));
+    const aggregate = aggById.get(membership.of);
+    const parameter = membership.by == null ? ""
+      : `${dartKeyType(aggregate, membership.by, enumDartTypes)} ${dartKeyParam(membership.by)}`;
+    const args = `${dartStr(membership.id)}${membership.by == null ? "" : `, ${dartKeyExpr(aggregate, membership.by)}`}`;
+    methods.push(`  /// Declared membership over the maintained count, never a row scan.`,
+      `  Future<bool> ${method}(${parameter}) async => (await session.nmsCount(${args})) > 0;`, ``);
+    pastMethods.push(`  Future<bool> ${method}(${parameter}) async => (await _client.session.nmsCountAt(moment, ${args})) > 0;`, ``);
   }
   for (const s of (mod.sums ?? []).map((raw) => finishSum(raw))) {
     const m = safeMethod(lcFirst(camel(s.id)));
@@ -2472,10 +2464,10 @@ export function generateDartBridgeClient(
             s.by
           }\`.\n  Future<int> ${m}(${groupType} ${dartKeyParam(
             s.by
-          )}) => bridge.nmsSum(${dartStr(s.id)}, ${groupValue});`
+          )}) => session.nmsSum(${dartStr(s.id)}, ${groupValue});`
         : `  /// Declared sum \`${
             s.id
-          }\` — the maintained O(1) grand total.\n  Future<int> ${m}() => bridge.nmsSum(${dartStr(
+          }\` — the maintained O(1) grand total.\n  Future<int> ${m}() => session.nmsSum(${dartStr(
             s.id
           )});`,
       ``
@@ -2486,18 +2478,36 @@ export function generateDartBridgeClient(
             s.id
           }\` at [moment].\n  Future<int> ${m}(${groupType} ${dartKeyParam(
             s.by
-          )}) => _client.bridge.nmsSumAt(moment, ${dartStr(
+          )}) => _client.session.nmsSumAt(moment, ${dartStr(
             s.id
           )}, ${groupValue});`
         : `  /// Declared sum \`${
             s.id
-          }\` at [moment].\n  Future<int> ${m}() => _client.bridge.nmsSumAt(moment, ${dartStr(
+          }\` at [moment].\n  Future<int> ${m}() => _client.session.nmsSumAt(moment, ${dartStr(
             s.id
           )});`,
       ``
     );
   }
 
+  for (const extremum of [...(mod.mins ?? []), ...(mod.maxes ?? [])].map(finishExtremum)) {
+    const method = safeMethod(lcFirst(camel(extremum.id)));
+    const aggregate = aggById.get(extremum.of);
+    const parameter = extremum.by == null ? ""
+      : `${dartKeyType(aggregate, extremum.by, enumDartTypes)} ${dartKeyParam(extremum.by)}`;
+    const args = `${dartStr(extremum.id)}, ${dartStr(extremum.kind)}${extremum.by == null ? "" : `, ${dartKeyExpr(aggregate, extremum.by)}`}`;
+    methods.push(
+      `  /// Declared ${extremum.kind}. Null means no contributing member; zero is a value.`,
+      `  Future<int?> ${method}(${parameter}) => session.nmsExtremum(${args});`,
+      ``,
+    );
+    pastMethods.push(
+      `  /// Declared ${extremum.kind} at [moment].`,
+      `  Future<int?> ${method}(${parameter}) => _client.session.nmsExtremumAt(moment, ${args});`,
+      ``,
+    );
+  }
+
   // ── BUSINESS MERGE CONFLICT DX: keep the heterogeneous Nomos index behind an aggregate-specific,
   // chained API. A pending conflict is a typed reference to its own `merge(...)` capability; callers
   // inspect all versions and produce a merge result rather than choosing a winner.
@@ -2531,7 +2541,7 @@ export function generateDartBridgeClient(
       ``,
       `  /// Nomos-internal aggregate-filtered index used only by generated conflict references.`,
       `  Future<List<${rowClass}>> _pendingConflictRows(String aggregateType) async =>`,
-      `      NmsUsdaConflictResult.parse(await bridge.nmsPendingConflictsUsda(aggregateType))`,
+      `      NmsUsdaConflictResult.parse(await session.nmsPendingConflictsUsda(aggregateType))`,
       `          .rows.map(${rowClass}.fromUsda).toList(growable: false);`,
       ``
     );
@@ -2750,7 +2760,7 @@ export function generateDartBridgeClient(
       ``,
       `  Future<${summaryClass}> summary() async {`,
       `    final summary = NmsUsdaConflictSummaryResult.parse(`,
-      `        await _client.bridge.nmsPendingConflictSummaryUsda());`,
+      `        await _client.session.nmsPendingConflictSummaryUsda());`,
       `    int count(String aggregatePath) {`,
       `      for (final entry in summary.byAggregate) {`,
       `        if (entry.aggregatePath == aggregatePath) return entry.count;`,
@@ -3014,27 +3024,27 @@ export function generateDartBridgeClient(
     const nominalByIdWatch = aScopes.length
       ? `Stream.fromFuture(_readKeys(${aScopesExpr}${
           aOwned ? `, [(type: ${dartStr(runtimeType)}, id: id)]` : ""
-        })).asyncExpand((keys) => bridge.nmsWatchByIdUsda(${dartStr(
+        })).asyncExpand((keys) => session.nmsWatchByIdUsda(${dartStr(
           runtimeType
         )}, id, keys: keys${
           aPrivate ? ", principal: actor" : ""
         }).map((usda) => _nmsDecode${model}Rows(usda, _ws)))`
-      : `bridge.nmsWatchByIdUsda(${dartStr(runtimeType)}, id${
+      : `session.nmsWatchByIdUsda(${dartStr(runtimeType)}, id${
           aPrivate ? ", principal: actor" : ""
         }).map((usda) => _nmsDecode${model}Rows(usda, _ws))`;
     const nominalByTypeWatch = aOwned
-      ? `bridge.nmsWatchByTypeUsda(${dartStr(runtimeType)}${
+      ? `session.nmsWatchByTypeUsda(${dartStr(runtimeType)}${
           aPrivate ? ", principal: actor" : ""
-        }).asyncMap((_) => _readWithOwnedKeys(${aScopesExpr}, (keys) async => _nmsDecode${model}Rows(await bridge.nmsQueryByTypeUsda(${dartStr(
+        }).asyncMap((usda) => _readWithOwnedKeys(${aScopesExpr}, (keys) async => _nmsDecode${model}Rows(await session.nmsQueryByTypeUsda(${dartStr(
           runtimeType
-        )}, keys${aPrivate ? ", actor" : ""}), _ws), (row) => row.ref))`
+        )}, keys${aPrivate ? ", actor" : ""}), _ws), (row) => row.ref, initial: _nmsDecode${model}Rows(usda, _ws)))`
       : aScopes.length
-      ? `Stream.fromFuture(_readKeys(${aScopesExpr})).asyncExpand((keys) => bridge.nmsWatchByTypeUsda(${dartStr(
+      ? `Stream.fromFuture(_readKeys(${aScopesExpr})).asyncExpand((keys) => session.nmsWatchByTypeUsda(${dartStr(
           runtimeType
         )}, keys: keys${
           aPrivate ? ", principal: actor" : ""
         }).map((usda) => _nmsDecode${model}Rows(usda, _ws)))`
-      : `bridge.nmsWatchByTypeUsda(${dartStr(runtimeType)}${
+      : `session.nmsWatchByTypeUsda(${dartStr(runtimeType)}${
           aPrivate ? ", principal: actor" : ""
         }).map((usda) => _nmsDecode${model}Rows(usda, _ws))`;
     methods.push(
@@ -3044,7 +3054,7 @@ export function generateDartBridgeClient(
           : ""
       }`,
       `  Future<List<${model}>> ${safeMethod(`${lc}ById`)}(String id) async =>`,
-      `      _nmsDecode${model}Rows(await bridge.nmsQueryByIdUsda(${dartStr(
+      `      _nmsDecode${model}Rows(await session.nmsQueryByIdUsda(${dartStr(
         runtimeType
       )}, id${byIdKeys}), _ws);`,
       ``,
@@ -3055,10 +3065,10 @@ export function generateDartBridgeClient(
       `  /// Every ${agg.id} (the type-index probe — O(result), not a scan).`,
       `  Future<List<${model}>> ${safeMethod(`list${Cap}s`)}() async =>`,
       aOwned
-        ? `      _readWithOwnedKeys(${aScopesExpr}, (keys) async => _nmsDecode${model}Rows(await bridge.nmsQueryByTypeUsda(${dartStr(
+        ? `      _readWithOwnedKeys(${aScopesExpr}, (keys) async => _nmsDecode${model}Rows(await session.nmsQueryByTypeUsda(${dartStr(
             runtimeType
           )}, keys${aPrivate ? ", actor" : ""}), _ws), (row) => row.ref);`
-        : `      _nmsDecode${model}Rows(await bridge.nmsQueryByTypeUsda(${dartStr(
+        : `      _nmsDecode${model}Rows(await session.nmsQueryByTypeUsda(${dartStr(
             runtimeType
           )}${keysArg(agg.id)}), _ws);`,
       ``,
@@ -3070,184 +3080,25 @@ export function generateDartBridgeClient(
     pastMethods.push(
       `  /// Read one ${agg.id} by aggregate id in the verified world at [moment].`,
       `  Future<List<${model}>> ${safeMethod(`${lc}ById`)}(String id) async =>`,
-      `      _nmsDecode${model}Rows(await _client.bridge.nmsQueryByIdAtUsda(moment, ${dartStr(
+      `      _nmsDecode${model}Rows(await _client.session.nmsQueryByIdAtUsda(moment, ${dartStr(
         runtimeType
       )}, id${pastByIdKeys}), _client._ws);`,
       ``,
       `  /// Every ${agg.id} in the verified world at [moment].`,
       `  Future<List<${model}>> ${safeMethod(`list${Cap}s`)}() async =>`,
       aOwned
-        ? `      _client._readWithOwnedKeys(${aScopesExpr}, (keys) async => _nmsDecode${model}Rows(await _client.bridge.nmsQueryByTypeAtUsda(moment, ${dartStr(
+        ? `      _client._readWithOwnedKeys(${aScopesExpr}, (keys) async => _nmsDecode${model}Rows(await _client.session.nmsQueryByTypeAtUsda(moment, ${dartStr(
             runtimeType
           )}, keys${
             aPrivate ? ", _client.actor" : ""
           }), _client._ws), (row) => row.ref);`
-        : `      _nmsDecode${model}Rows(await _client.bridge.nmsQueryByTypeAtUsda(moment, ${dartStr(
+        : `      _nmsDecode${model}Rows(await _client.session.nmsQueryByTypeAtUsda(moment, ${dartStr(
             runtimeType
           )}${pastKeysArg(agg.id)}), _client._ws);`,
       ``
     );
   }
 
-  if (opts.emitActivity === true)
-    methods.push(
-      `  /// Adopt THIS generated model. Nomos proves it against current history; a deliberate`,
-      `  /// difference returns a decision whose accept(reason) re-proves and records the reason.`,
-      `  NomosModel get model => NomosModel(_adoptGeneratedModel, _restorePreviousGeneratedModel);`,
-      ``,
-      `  NomosModelReview _nomosModelReview(ModelLifecycleResponse result) {`,
-      `    final report = result.hasReview() ? result.review : null;`,
-      `    return NomosModelReview(`,
-      `      checkedActions: report?.checkedActions.toInt() ?? 0,`,
-      `      candidateActions: report?.candidateActions.toInt() ?? 0,`,
-      `      sameOutcome: report?.hasSameOutcome() == true ? report!.sameOutcome : null,`,
-      `      differences: [`,
-      `        for (final difference in report?.differences ?? const [])`,
-      `          NomosModelDifference(`,
-      `            kind: switch (difference.kind) {`,
-      `              ModelDifferenceKind.MODEL_DIFFERENCE_KIND_RULES => NomosModelDifferenceKind.rules,`,
-      `              ModelDifferenceKind.MODEL_DIFFERENCE_KIND_OUTCOME => NomosModelDifferenceKind.outcome,`,
-      `              ModelDifferenceKind.MODEL_DIFFERENCE_KIND_EVIDENCE => NomosModelDifferenceKind.evidence,`,
-      `              _ => NomosModelDifferenceKind.rules,`,
-      `            },`,
-      `            area: difference.hasArea() ? difference.area : null,`,
-      `            action: difference.hasAction() ? difference.action : null,`,
-      `            summary: difference.summary,`,
-      `          ),`,
-      `      ],`,
-      `    );`,
-      `  }`,
-      ``,
-      ...(authenticationRecovery === undefined
-        ? [`  Future<NomosModelAdoption> _adoptGeneratedModel([String? because]) async {`]
-        : [
-            `  Future<NomosModelAdoption> _adoptGeneratedModel([String? because]) =>`,
-            `      _adoptGeneratedModelAttempt(because, false);`,
-            `  Future<NomosModelAdoption> _adoptGeneratedModelAttempt(`,
-            `      String? because, bool recoveredProviderEpoch) async {`,
-          ]),
-      `    final result = await bridge.nomosFrameworkAdoptGeneratedModel(`,
-      `      domain: ${dartStr(
-        domain
-      )}, candidateHash: domainHash, because: because);`,
-      `    final review = _nomosModelReview(result);`,
-      `    final stage = result.stage;`,
-      ...(authenticationRecovery === undefined
-        ? []
-        : [
-            `    if (!result.accepted && !recoveredProviderEpoch) {`,
-            `      final posture = await bridge.nmsAuthenticationPosture(principal: actor);`,
-            `      if (posture.providerToken == NomosProviderTokenVerification.noMatchingKey) {`,
-            `        print('[nomos-model-recovery] local ${domain} posture=' + posture.providerToken.name);`,
-            `        await ${safeMethod(
-              authenticationRecovery.id
-            )}(const ${dartActionInputClassName(authenticationRecovery)}());`,
-            `        await bridge.nmsAwaitAuthenticationReady(principal: actor);`,
-            `        return _adoptGeneratedModelAttempt(because, true);`,
-            `      }`,
-            `    }`,
-          ]),
-      `    if ((stage == ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_PROMOTED ||`,
-      `         stage == ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_ALREADY_CURRENT) && result.accepted) {`,
-      `      return NomosModelAdoption.adopted(`,
-      `        summary: stage == ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_PROMOTED`,
-      `            ? 'Nomos proved this model against current history and made it active.'`,
-      `            : 'This workspace already runs this model or a server-side successor.',`,
-      `        review: review);`,
-      `    }`,
-      ...(opts.lawAssetKey === undefined
-        ? []
-        : [
-            `    if (stage == ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_STAGING_REQUIRED) {`,
-            `      return NomosModelAdoption.needsStaging(`,
-            `        summary: 'This workspace is running an older model. Stage this generated USDA candidate through the signed workspace gate before reviewing it.',`,
-            `        review: review,`,
-            `        stage: () async {`,
-            `          await _stageGeneratedModel();`,
-            `          return _adoptGeneratedModel();`,
-            `        },`,
-            `      );`,
-            `    }`,
-          ]),
-      `    if (stage == ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_ACCEPTANCE_REQUIRED) {`,
-      `      return NomosModelAdoption.needsDecision(`,
-      `        summary: 'This model would change prior business outcomes. Review the differences and record why that is intended.',`,
-      `        review: review, accept: (reason) => _adoptGeneratedModel(reason));`,
-      `    }`,
-      `    final rawError = result.hasMessage() ? result.message.trim() : '';`,
-      `    final summary = rawError.isNotEmpty`,
-      `        ? rawError`,
-      `        : stage == ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_IDENTITY_REQUIRED`,
-      `        ? 'Sign in before adopting this model so the decision is accountable.'`,
-      `        : 'The workspace changed or refused this adoption. Nothing changed; ask Nomos to try again.';`,
-      `    return NomosModelAdoption.blocked(summary: summary, review: review);`,
-      `  }`,
-      ``,
-      ...(opts.lawAssetKey === undefined
-        ? []
-        : [
-            `  Future<void> _stageGeneratedModel() async {`,
-            `    final archive = await rootBundle.load(${dartStr(
-              opts.lawAssetKey
-            )});`,
-            `    Future<void> attempt() => bridge.nomosInternalStageGeneratedModel(`,
-            `      domain: ${dartStr(domain)},`,
-            `      candidateHash: domainHash,`,
-            `      lawUsdz: archive.buffer.asUint8List(`,
-            `        archive.offsetInBytes, archive.lengthInBytes),`,
-            `    );`,
-            ...(authenticationRecovery === undefined
-              ? [`    await attempt();`]
-              : [
-                  `    try {`,
-                  `      await attempt();`,
-                  `    } on NomosModelStageFailure {`,
-                  `      final posture = await bridge.nmsAuthenticationPosture(principal: actor);`,
-                  `      print('[nomos-model-recovery] local ${domain} posture=' + posture.providerToken.name);`,
-                  `      if (posture.providerToken != NomosProviderTokenVerification.noMatchingKey) rethrow;`,
-                  `      await ${safeMethod(
-                    authenticationRecovery.id
-                  )}(const ${dartActionInputClassName(
-                    authenticationRecovery
-                  )}());`,
-                  `      await bridge.nmsAwaitAuthenticationReady(principal: actor);`,
-                  `      await attempt();`,
-                  `    }`,
-                ]),
-            `  }`,
-            ``,
-          ]),
-      `  Future<NomosModelRestoration> _restorePreviousGeneratedModel([String? because]) async {`,
-      `    final result = await bridge.nomosFrameworkRestorePreviousGeneratedModel(`,
-      `      domain: ${dartStr(
-        domain
-      )}, currentHash: domainHash, because: because);`,
-      `    final review = _nomosModelReview(result);`,
-      `    final stage = result.stage;`,
-      `    if (stage == ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_RESTORED && result.accepted) {`,
-      `      return NomosModelRestoration.restored(`,
-      `        summary: 'Nomos re-proved current history and restored the previous model.', review: review);`,
-      `    }`,
-      `    if (stage == ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_ACCEPTANCE_REQUIRED) {`,
-      `      return NomosModelRestoration.needsDecision(`,
-      `        summary: 'Restoring the previous model changes which rules govern future work. Review the effects and record why restoration is intended.',`,
-      `        review: review, accept: (reason) => _restorePreviousGeneratedModel(reason));`,
-      `    }`,
-      `    final error = result.hasMessage() ? result.message : '';`,
-      `    final summary = stage == ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_IDENTITY_REQUIRED`,
-      `        ? 'Sign in before restoring a model so the decision is accountable.'`,
-      `        : error.contains('restore-no-previous')`,
-      `            ? 'This is the first model for this business; there is no previous model to restore.'`,
-      `            : error.contains('restore-current-changed')`,
-      `                ? 'The current model changed before restoration could finish. Nothing changed; ask Nomos to review again.'`,
-      `                : error.isNotEmpty`,
-      `                    ? error`,
-      `                    : 'The workspace refused restoration. Nothing changed and the current model remains active.';`,
-      `    return NomosModelRestoration.blocked(summary: summary, review: review);`,
-      `  }`,
-      ``
-    );
-
   const pastClass = `${className}Past`;
   const atClass = `${className}At`;
   methods.push(
@@ -3262,7 +3113,7 @@ export function generateDartBridgeClient(
     `  const ${pastClass}(this._client);`,
     ``,
     `  Future<List<NomosMoment>> moments({int limit = 100}) async {`,
-    `    final moments = await _client.bridge.moments(limit: limit);`,
+    `    final moments = await _client.session.moments(limit: limit);`,
     `    const actions = <String>{${[
       ...allDirs.map((directive) => directive.id),
       ...(correctionActions.length > 0 ? [BUSINESS_CORRECTION_DIRECTIVE] : []),
@@ -3295,7 +3146,7 @@ export function generateDartBridgeClient(
   // ── REF-TRAVERSAL ACCESSORS (dart_codegen_parity.md P2 + §2a follow-on — ref ergonomics) ──
   // For every reference field on a read model, emit a companion extension method that resolves the
   // stored locator to the actual target row, composed ONLY from surface that already exists (no new
-  // read path, no new bridge op). THREE kinds, one grammar (`<Model>Refs on <Model>`):
+  // read path, no new session op). THREE kinds, one grammar (`<Model>Refs on <Model>`):
   //   1. SAME-DOMAIN `t.ref(Target)` (target in THIS module) — resolver takes THIS client, dispatches
   //      to its own `<target>ById` accessor. (The #72 original.)
   //   2. CROSS-DOMAIN same-workspace `t.ref(Target)` (target in ANOTHER domain of the package) — the
@@ -3436,46 +3287,9 @@ export function generateDartBridgeClient(
         ``
       );
     }
-    for (const [fieldName, f] of foreignRefs) {
-      const fr = f.foreignRef!;
-      const targetType = fr.targetAggregateId;
-      // The resolver returns the target's CONCRETE class. We can
-      // only reference it when it is reachable from this file: SAME-domain (already in the imported types),
-      // or a CROSS-DOMAIN concrete target in the package (import its sibling `<name>.dart` `show`-limited).
-      // A contract target (its DTO lives in the shared contracts file) or an unmapped target is left as the
-      // raw `ForeignRef<T>` field — no resolver, no dangling type reference.
-      if (fr.targetIsContract === true) continue;
-      const owner = pkgDomains[targetType];
-      const targetInThisDomain =
-        aggById.has(targetType) || owner?.name === thisDomainName;
-      if (!targetInThisDomain) {
-        if (owner === undefined) continue; // target not in this package — unreachable, skip the resolver
-        // LAYERED-packages mode: the sibling domain's TYPES file lives in the TYPES package, not
-        // beside this client file — a relative `<name>.dart` import points at a nonexistent path in
-        // the client package (the co2 0.75.0 regression). The types-barrel import above already
-        // re-exports every generated concrete class, so the extra import is only needed FLAT.
-        if (opts.typesImportUri === undefined)
-          addImport(`${owner.name}.dart`, concreteClassName(targetType));
-      }
-      const targetConcrete = concreteClassName(targetType);
-      const member = dartMemberName(fieldName);
-      const memberValue = admitsNull(f) ? `${member}.valueOrNull` : member;
-      // The stored locator member is a typed `ForeignRef<Target>?` getter, so the resolver takes a
-      // `remote…` name to avoid colliding with it (and to read as "the far side of the reference").
-      const method = safeMethod(`remote${cap(camel(member))}`);
-      lines.push(
-        `  /// Resolve \`${fieldName}\` (${agg.id}.${fieldName} -> ${targetType} @ another workspace, a`,
-        `  /// \`t.foreignRef\` locator) over the session-bound multi-workspace plane. The generated`,
-        `  /// implementation opens the foreign workspace on demand; tenant code sees only this business method.`,
-        `  /// Null locator (absent / empty id or workspace) ⇒ null.`,
-        `  Future<${targetConcrete}?> ${method}(NomosEngine engine, {String? cloud}) {`,
-        `    final ref = ${memberValue};`,
-        `    if (ref == null) return Future<${targetConcrete}?>.value(null);`,
-        `    return NmsInternalForeignRefs.resolve(ref, engine.foreignReader(cloud: cloud));`,
-        `  }`,
-        ``
-      );
-    }
+    // Cross-workspace resolution belongs to the stateless application facade,
+    // which receives Peer Office's binding. Read-model values never accept a
+    // runtime/reception object or open custody themselves.
     lines.push(`}`);
     refExtensions.push(lines.join("\n"));
   }
@@ -3488,18 +3302,32 @@ export function generateDartBridgeClient(
       `  /// committed intent; a directive`,
       `  /// outside this generated business package is dropped. Cancel the subscription to stop.`,
       `  /// A bounded recent activity feed. [limit] is required and kernel-capped.`,
-      `  Stream<List<ActivityEvent>> watchRecentActivity({required int limit}) =>`,
-      `      bridge.watchActivity(limit: limit).map((rows) => rows`,
-      `          .map((r) => renderActivity((r as Map).cast<String, dynamic>()))`,
-      `          .whereType<ActivityEvent>()`,
-      `          .toList());`,
+      `  Stream<List<ActivityEvent>> watchRecentActivity({required int limit}) async* {`,
+      `    yield await recentActivity(limit: limit);`,
+      `    await for (final _ in session.syncEvents) {`,
+      `      yield await recentActivity(limit: limit);`,
+      `    }`,
+      `  }`,
       ``,
       `  /// A bounded one-shot recent activity feed. [limit] is required and kernel-capped.`,
-      `  Future<List<ActivityEvent>> recentActivity({String? base, required int limit}) async =>`,
-      `      (await bridge.activityLog(base: base, limit: limit))`,
-      `          .map((r) => renderActivity(r.cast<String, dynamic>()))`,
-      `          .whereType<ActivityEvent>()`,
-      `          .toList();`,
+      `  Future<List<ActivityEvent>> recentActivity({String? base, required int limit}) async {`,
+      `    if (base != null) {`,
+      `      throw UnsupportedError('Historic activity cursors need a nominal Runtime v2 contract.');`,
+      `    }`,
+      `    return (await session.moments(limit: limit)).map((moment) {`,
+      `      final action = moment.action ?? 'recordedChange';`,
+      `      final eventDomain = moment.domain ?? ${dartStr(domain)};`,
+      `      final kind = '\$eventDomain.\$action';`,
+      `      return ActivityEvent(`,
+      `        eventId: moment.id, kind: kind, performedBy: moment.performedBy ?? '',`,
+      `        occurredAt: moment.occurredAt?.toUtc().toIso8601String() ?? '',`,
+      `        title: action, message: 'Recorded \$action in \$eventDomain',`,
+      `        titleKey: 'activity.\$kind.title', messageKey: 'activity.\$kind.message',`,
+      `        params: const <String, String>{}, refs: const <String, ActivityRef>{},`,
+      `        severity: ActivitySeverity.info, domain: eventDomain, directiveId: action,`,
+      `      );`,
+      `    }).toList(growable: false);`,
+      `  }`,
       ``,
       `  @Deprecated('Reconstructs ledger history. Use recentActivity with an explicit bounded limit, or a DSL managed count for quantities.')`,
       `  Future<List<ActivityEvent>> activityLog({String? base, int? limit}) =>`,
@@ -3515,20 +3343,21 @@ export function generateDartBridgeClient(
       `    NomosDescribeSection section = NomosDescribeSection.root,`,
       `    String? since, String? performedBy, String? category, int? limit,`,
       `  }) async {`,
-      `    final raw = await bridge.activityLog(limit: limit);`,
-      `    var events = raw`,
-      `        .map((r) => renderActivity(r.cast<String, dynamic>()))`,
-      `        .whereType<ActivityEvent>()`,
-      `        .toList();`,
+      `    var events = await recentActivity(limit: limit ?? 50);`,
       `    if (performedBy != null) events = events.where((e) => e.performedBy == performedBy).toList();`,
       `    if (category != null) events = events.where((e) => e.category == category).toList();`,
       `    if (since != null) events = events.where((e) => e.occurredAt.compareTo(since) >= 0).toList();`,
       `    final narrative = activityNarrative(events);`,
       `    var organisation = const NomosOrganisationDescription(complete: false, children: []);`,
       `    try {`,
-      `      final children = (await bridge.nomosFrameworkChildWorkspaces()).map((child) {`,
-      `        final workspace = child['workspace']?.toString() ?? '';`,
-      `        final status = child['status']?.toString() ?? 'unknown';`,
+      `      final children = (await session.nomosFrameworkChildWorkspaces()).map((child) {`,
+      `        final workspace = child.workspace;`,
+      `        final status = switch (child.status) {`,
+      `          ChildWorkspaceStatus.CHILD_WORKSPACE_STATUS_ACTIVE => 'active',`,
+      `          ChildWorkspaceStatus.CHILD_WORKSPACE_STATUS_RETIRED => 'retired',`,
+      `          ChildWorkspaceStatus.CHILD_WORKSPACE_STATUS_RECLAIMED => 'reclaimed',`,
+      `          _ => 'unknown',`,
+      `        };`,
       `        final summary = status == 'active'`,
       `            ? 'This part of the organisation is active. Follow its generated description to continue.'`,
       `            : status == 'retired'`,
@@ -3537,7 +3366,7 @@ export function generateDartBridgeClient(
       `                    ? "This part of the organisation was reclaimed. Its birth remains part of this workspace's history."`,
       `                    : 'This part of the organisation has a newer lifecycle this client does not understand. Its link remains visible.';`,
       `        return NomosDescribeChild(`,
-      `          workspace: workspace, status: status, bornAt: child['bornAt']?.toString(), label: workspace,`,
+      `          workspace: workspace, status: status, bornAt: child.hasBornAt() ? child.bornAt : null, label: workspace,`,
       `          question: 'What does this part of the organisation do, and what has happened there?', summary: summary);`,
       `      }).where((child) => child.workspace.isNotEmpty).toList();`,
       `      organisation = NomosOrganisationDescription(complete: children.every((child) => child.status != 'unknown'), children: children);`,
@@ -3594,23 +3423,11 @@ export function generateDartBridgeClient(
       `      for (final rawAggregate in ((model['aggregateTypes'] as List?) ?? const [])) {`,
       `        final aggregate = (rawAggregate as Map).cast<String, dynamic>();`,
       `        final type = aggregate['type'] as String;`,
-      `        final queryType = aggregate['queryType'] as String;`,
       `        final label = aggregate['label'] as String;`,
-      `        try {`,
-      `          final rows = await bridge.query('aggregatesByType', {'__type': queryType});`,
-      `          final refs = rows.map((row) => NmsInternalNomosRefs.create<Object?>(`,
-      `            workspace: _ws, type: (row['type'] ?? type).toString(), id: (row['id'] ?? '').toString())).toList();`,
-      `          final exact = aggregate['audience'] == 'public' || rows.isNotEmpty;`,
-      `          items.add(NomosDescribeItem(`,
-      `            kind: 'current', id: '\${aggregate['domain']}.\$type', label: label,`,
-      `            summary: exact ? '\${rows.length} \$label record\${rows.length == 1 ? '' : 's'} visible now.' : 'No \$label records are visible to this session.',`,
-      `            details: {'domain': aggregate['domain'], 'type': type, 'audience': aggregate['audience'], if (exact) 'count': rows.length else 'status': 'none-visible'}, refs: refs));`,
-      `        } catch (_) {`,
-      `          items.add(NomosDescribeItem(`,
-      `            kind: 'current', id: '\${aggregate['domain']}.\$type', label: label,`,
-      `            summary: '\$label exists in the model, but this session cannot read its current records.',`,
-      `            details: {'domain': aggregate['domain'], 'type': type, 'audience': aggregate['audience'], 'status': 'unavailable'}));`,
-      `        }`,
+      `        items.add(NomosDescribeItem(`,
+      `          kind: 'current', id: '\${aggregate['domain']}.\$type', label: label,`,
+      `          summary: '\$label records are read through the generated typed application API.',`,
+      `          details: {'domain': aggregate['domain'], 'type': type, 'audience': aggregate['audience'], 'status': 'typed-read'}));`,
       `      }`,
       `    } else if (section == NomosDescribeSection.history) {`,
       `      title = 'Verified business history';`,
@@ -3657,7 +3474,7 @@ export function generateDartBridgeClient(
       `        return null;`,
       `      }`,
       `      final pendingConflicts = NmsUsdaConflictResult.parse(`,
-      `          await bridge.nmsPendingConflictsUsda(null));`,
+      `          await session.nmsPendingConflictsUsda(null));`,
       `      for (final conflict in pendingConflicts.rows) {`,
       `        final aggregatePath = conflict.relationship('nomos:type');`,
       `        final fieldPath = conflict.relationship('nomos:field');`,
@@ -3693,7 +3510,7 @@ export function generateDartBridgeClient(
       `      }`,
       `      final modelPageItems = ((((model['pages'] as Map)['model'] as Map)['items'] as List?) ?? const [])`,
       `          .map((raw) => (raw as Map).cast<String, dynamic>()).where((item) => item['kind'] == 'verb').toList();`,
-      `      for (final entry in await bridge.deadLetters()) {`,
+      `      for (final entry in await session.deadLetters()) {`,
       `        if (!entry.hasDomain() || !entry.hasDirective()) continue;`,
       `        final domain = entry.domain; final directive = entry.directive;`,
       `        Map<String, dynamic>? action;`,
@@ -3714,7 +3531,7 @@ export function generateDartBridgeClient(
       `      items = [`,
       `        NomosDescribeItem(kind: 'evidence', id: 'workspace', label: 'Workspace', summary: _ws, details: {'workspace': _ws}),`,
       `        NomosDescribeItem(kind: 'evidence', id: 'law', label: 'Generated law', summary: domainHash, details: {'domainHash': domainHash}),`,
-      `        NomosDescribeItem(kind: 'evidence', id: 'reader', label: 'Verified reader', summary: this.actor ?? bridge.principal ?? 'anonymous', details: {'actor': this.actor ?? bridge.principal}),`,
+      `        NomosDescribeItem(kind: 'evidence', id: 'reader', label: 'Verified reader', summary: this.actor ?? 'anonymous', details: {'actor': this.actor}),`,
       `        if (latest != null) NomosDescribeItem(kind: 'evidence', id: latest.eventId, label: 'Latest verified moment', summary: latest.eventId,`,
       `          details: {'occurredAt': latest.occurredAt, 'performedBy': latest.performedBy, 'domain': latest.domain, 'kind': latest.kind}),`,
       `      ];`,
@@ -3727,10 +3544,7 @@ export function generateDartBridgeClient(
       `  /// NARRATIVE for ONE thing: the story of the aggregate [aggregateId] — events whose declared refs`,
       `  /// point at it (only directives declaring a ref to the aggregate appear in its story) + a transcript.`,
       `  Future<ActivityNarrative> describeHistory(String aggregateId, {int? limit}) async {`,
-      `    final raw = await bridge.activityLog(limit: limit);`,
-      `    final events = raw`,
-      `        .map((r) => renderActivity(r.cast<String, dynamic>()))`,
-      `        .whereType<ActivityEvent>()`,
+      `    final events = (await recentActivity(limit: limit ?? 50))`,
       `        .where((e) => e.refs.values.any((ref) => ref.id == aggregateId))`,
       `        .toList();`,
       `    return activityNarrative(events);`,
@@ -3742,30 +3556,38 @@ export function generateDartBridgeClient(
   return [
     `// AUTO-GENERATED by nomos-compile — private runtime implementation for domain "${domain}".`,
     `// Regenerated every compile; do not edit or teach this file as an application entry point.`,
-    // GENERATED-CODE lints: the bridge read/watch surface returns dynamic (JSON rows), so typed accessors
+    // GENERATED-CODE lints: the session read/watch surface returns dynamic (JSON rows), so typed accessors
     // do dynamic member access + casts by construction. Silence the lints that only make sense for
     // hand-written code, so this file never adds noise to a tenant's analyzer output (co2 feedback).
     // (deprecated_member_use*: the compatibility shims intentionally delegate to the deprecated
     // engine-level lanes for one minor version.)
-    `// ignore_for_file: avoid_dynamic_calls, unnecessary_this, unnecessary_cast, prefer_const_constructors, unused_import, unused_local_variable, type_annotate_public_apis, always_specify_types, deprecated_member_use, deprecated_member_use_from_same_package, invalid_use_of_internal_member`,
+    `// ignore_for_file: avoid_dynamic_calls, unnecessary_this, unnecessary_cast, prefer_const_constructors, unused_import, unused_local_variable, type_annotate_public_apis, always_specify_types, deprecated_member_use, deprecated_member_use_from_same_package, invalid_use_of_internal_member, unnecessary_non_null_assertion, unnecessary_null_comparison`,
+    ``,
+    `import 'dart:async' show unawaited;`,
     ``,
     // `dart:convert` is needed ONLY for the interface block's `jsonDecode` — the offer lane no longer encodes
-    // any envelope (it routes through `bridge.offerDirective` → THE ONE ENCODER). Omit it when no interface.
+    // any envelope (it routes through `session.offerDirective` → THE ONE ENCODER). Omit it when no interface.
     ...(clientInterface !== undefined ||
     opts.emitActivity === true ||
     localOfferDirs.length > 0 ||
     callEncoderSources.length > 0
       ? [`import 'dart:convert';`, ``]
       : []),
-    ...(localOfferDirs.length > 0 ||
+    ...(clientInterface !== undefined ||
+    localOfferDirs.length > 0 ||
     resultDecoderSources.length > 0 ||
+    resultProtoDecoderSources.length > 0 ||
     callEncoderSources.length > 0
       ? [`import 'dart:typed_data';`, ``]
       : []),
-    `import '${supportImport}';`,
-    ...(opts.lawAssetKey !== undefined
-      ? [`import 'package:flutter/services.dart' show rootBundle;`]
+    ...(callEncoderSources.length > 0 || resultProtoDecoderSources.length > 0
+      ? [
+          `import 'package:fixnum/fixnum.dart' show Int64;`,
+          `import 'operation_payloads.pb.dart' as _nmsop;`,
+          ``,
+        ]
       : []),
+    `import '${supportImport}'${opts.typesImportUri === undefined ? ' hide OwnedCustody, OwnedDeviceRequest' : ''};`,
     // Layered-packages mode: the sibling types live in their OWN package — one barrel import
     // replaces both the relative types import and the relative framework import.
     ...(opts.typesImportUri !== undefined
@@ -3799,7 +3621,7 @@ export function generateDartBridgeClient(
           `import '${uri}' show ${[...names].sort().join(", ")};`
       ),
     `// Re-export business types only. The runtime import above is an implementation dependency, never`,
-    `// a tenant API: exporting it would create a second raw bridge/session/sync application lane.`,
+    `// a tenant API: exporting it would create a second raw session/session/sync application lane.`,
     ...(opts.typesImportUri !== undefined
       ? [`export '${opts.typesImportUri}';`]
       : [`export '${mod.name}.dart';`]),
@@ -3822,43 +3644,35 @@ export function generateDartBridgeClient(
       : []),
     ...(clientInterface !== undefined
       ? [
-          `/// This client's STRUCTURAL INTERFACE REQUIREMENT (#72) as JSON — the directives (payload`,
-          `/// shapes) + aggregates (read shapes, sid-keyed) it depends on. \`connect()\` negotiates this`,
-          `/// against the workspace's installed offer by SHAPE (stable-id subtyping), not by law hash,`,
-          `/// so the domain can evolve without republishing this client.`,
-          `const String ${interfaceConstNameDart(mod.name)} = ${dartRawJson(
-            clientInterface
-          )};`,
+          `/// Canonical compiler-authored USDA compatibility matrix. Dart carries`,
+          `/// these bytes opaquely; only the kernel interprets them.`,
+          `final Uint8List ${interfaceConstNameDart(mod.name)} = Uint8List.fromList(utf8.encode(${dartRawText(
+            emitApplicationCompatibilityUsda({ [domain]: clientInterface })
+          )}));`,
           ``,
         ]
       : []),
-    ...(opts.compat !== undefined
+    ...(callEncoderSources.length > 0 || resultProtoDecoderSources.length > 0
       ? [
-          `/// The CLIENT/LAW COMPAT MANIFEST (§5) as JSON — the law hash, structural interface hash, and`,
-          `/// generator provenance this client was generated against. A DIAGNOSIS surface for connect-time`,
-          `/// classification (silent / shape-compatible / incompatible); it NEVER gates.`,
-          `const String ${compatConstNameDart(mod.name)} = ${dartRawJson(
-            opts.compat
-          )};`,
-          ``,
+          ...DART_CALL_PROTO_PRELUDE,
+          ...DART_CALL_USDA_PRELUDE,
+          ...callEncoderSources,
+          ...resultProtoDecoderSources,
         ]
       : []),
-    ...(callEncoderSources.length > 0
-      ? [...DART_CALL_USDA_PRELUDE, ...callEncoderSources]
-      : []),
     ...resultDecoderSources,
     ...pastDeclarations,
     ...conflictDeclarations,
-    `/// Typed async client for the \`${domain}\` domain, bound to a connected [NomosBridge].`,
+    `/// Typed async client for the \`${domain}\` domain, bound to one connected [NomosSession].`,
     `///`,
-    `/// Pass \`actor\` (the verified principal uid) to author AS that user — the bridge's \`offerDirective\` op`,
+    `/// Pass \`actor\` (the verified principal uid) to author AS that user — the generated client owns`,
     `/// carries it with the compiler-generated canonical USDA call as the captured principal,`,
     `/// so the kernel seals it as the captured principal and the ReBAC \`.requires(...)\` gate judges the real`,
     `/// author. A GATED directive (one whose law declares \`.requires(relation)\`) authored with no actor throws`,
-    `/// [MissingOfferAuthority] BEFORE any submit — an actorless gated offer can't be constructed. The bridge`,
-    `/// owns SIGNING (a device secret on \`connect\`); only the actor IDENTITY is passed here, never a secret.`,
+    `/// [MissingOfferAuthority] BEFORE any submit — an actorless gated offer can't be constructed. The peer`,
+    `/// runtime owns the renewable proof capability; only the actor IDENTITY is bound here, never a secret.`,
     `class ${className} {`,
-    `  final NomosBridge bridge;`,
+    `  final NomosSession session;`,
     `  final String domainHash;`,
     ``,
     `  /// The verified principal uid every offer is authored as (sealed as \`security.actor\` by the one encoder).`,
@@ -3873,68 +3687,36 @@ export function generateDartBridgeClient(
           `  final NomosKeyStore? keyStore;`,
         ]
       : []),
-    `  ${className}(this.bridge, {this.domainHash = ${hashConst}, this.actor${
+    `  ${className}(this.session, {this.domainHash = ${hashConst}, this.actor${
       manualEncryptionPresent ? ", this.keyStore" : ""
     }});`,
     ``,
-    `  /// THE STATIC INTERFACE DESCRIPTOR (session_bound_clients.md asks 5/9): what this client EXPECTS`,
-    `  /// of the workspace it binds to — the domain key, the law hash it was generated against, and the`,
-    `  /// structural interface (#72). Consumed by [bind] and by \`session.assertCompatible(${className}.interface)\`.`,
-    `  /// Standard OSGi Contract Namespace requirements derived from this law's shape.`,
-    `  static const List<Map<String, String>> kernelContracts = [${kernelContracts
+    `  /// Standard OSGi Contract Namespace requirements derived from this law's shape, resolved by`,
+    `  /// [bind]. The client's own compatibility matrix is served by [compatibilityMatrixUsda]; there`,
+    `  /// is no separate static descriptor, because this class is a library-private part of the`,
+    `  /// generated application and nothing — inside it or outside — could read one.`,
+    `  static const List<NmsKernelContractRequirement> kernelContracts = [${kernelContracts
       .map(
         (contract) =>
-          `{${dartStr("namespace")}: ${dartStr(contract.namespace)}, ${dartStr(
-            "name"
-          )}: ${dartStr(contract.name)}, ${dartStr("version")}: ${dartStr(
+          `NmsKernelContractRequirement(namespace: ${dartStr(
+            contract.namespace
+          )}, name: ${dartStr(contract.name)}, version: ${dartStr(
             contract.version
-          )}}`
+          )})`
       )
       .join(", ")}];`,
     ``,
-    `  static const NomosClientInterface interface = NomosClientInterface(`,
-    `    domain: ${dartStr(domain)},`,
-    `    expectedDomainHash: ${hashConst},`,
-    ...(compatInterfaceHash !== undefined
-      ? [`    expectedInterfaceHash: ${dartStr(compatInterfaceHash)},`]
-      : []),
-    ...(clientInterface !== undefined
-      ? [`    interfaceJson: ${interfaceConstNameDart(mod.name)},`]
-      : []),
-    ...(opts.compat !== undefined
-      ? [`    compatJson: ${compatConstNameDart(mod.name)},`]
-      : []),
-    `  );`,
-    ``,
-    `  /// THE SESSION-BOUND CONSTRUCTION PATH (session_bound_clients.md asks 2/5): bind this client to`,
-    `  /// [session] with an ASYNC PREFLIGHT — the session's workspace must be reachable, hold the`,
-    `  /// \`${domain}\` domain, and serve a structurally compatible interface (#72 shape-compat, the ONE`,
-    `  /// compatibility notion). An incompatible session throws [DomainClientSessionMismatch]`,
-    `  /// IMMEDIATELY — at provider construction, not two clicks into the app. The synchronous`,
-    `  /// constructor remains for codepaths that can't await; it lazily runs the SAME preflight on the`,
-    `  /// first dispatch.`,
-    `  static Future<void> _catchUpBeforeModelPreparation(NomosSession session) async {`,
-    `    try {`,
-    `      await session.sync(admit: true);`,
-    `    } catch (error) {`,
-    `      // Offline-first: inability to reach shared custody does not revoke the local workspace.`,
-    `      // The subsequent typed compatibility/model gate remains authoritative and will either`,
-    `      // accept the local law or surface the precise governed action still required.`,
-    `      print('[nomos-model-catch-up] ${domain} continuing from local custody: ' + error.toString());`,
-    `    }`,
-    `  }`,
-    ``,
+    `  /// Bind this stateless domain facade to one already-open local workspace.`,
+    `  /// Binding never synchronises custody and never rejects the whole domain because an unrelated`,
+    `  /// member evolved. Each real query or offer is validated by the kernel against the law installed`,
+    `  /// at this workspace's current local frontier. Compatibility is the kernel's verdict, never an`,
+    `  /// application-start lifecycle gate.`,
     `  static Future<${className}> bind(NomosSession session, {String? actor${
       manualEncryptionPresent ? ", NomosKeyStore? keyStore" : ""
     }}) async {`,
     `    final candidate = ${className}(session, actor: actor${
       manualEncryptionPresent ? ", keyStore: keyStore" : ""
     });`,
-    `    // Binding proves that this client can read and author against the law the`,
-    `    // workspace already runs. It never deploys, stages, promotes, or rewrites`,
-    `    // workspace law. Model rollout is an explicit operator action through`,
-    `    // [model], outside application startup.`,
-    `    await session.assertCompatible(interface);`,
     `    // RELEASE COHERENCE: resolve this law's OSGi Contract Namespace requirements before use.`,
     `    await session.assertKernelCoherence(kernelContracts, lawHash: ${hashConst});`,
     ...(ownedScope === undefined
@@ -3944,80 +3726,13 @@ export function generateDartBridgeClient(
             ownedScope
           )}, domain: ${dartStr(domain)}, domainHash: ${hashConst});`,
         ]),
-    `    return candidate.._preflighted = true${
+    `    return candidate${
       ownedScope === undefined ? "" : ".._ownedIdentityReady = true"
     };`,
     `  }`,
     ``,
-    `  /// OPEN-THEN-BIND (session_bound_clients.md ask 3) — the ONE-CALL path for a born/resident workspace:`,
-    `  /// \`await ${className}.open(bridge, ref: outcome.bornRefs.single)\` (or \`workspace: 'estate-42'\`).`,
-    `  /// It ACQUIRES the workspace's session on [bridge] first (an already-open one is reused; a device-`,
-    `  /// resident/parked/just-born one opens local-only in place) and THEN binds — so a not-open workspace`,
-    `  /// fails HERE, at open, never later on the client's first query. The generated stateful application`,
-    `  /// privately retains refreshable cloud access for a genuinely-absent authorized workspace.`,
-    `  static Future<${className}> open<TAggregate>(NomosBridge bridge, {NomosRef<TAggregate>? ref, String? workspace, String? actor${
-      manualEncryptionPresent ? ", NomosKeyStore? keyStore" : ""
-    }, Future<void> Function()? recoverAuthentication}) async {`,
-    `    final ws = ref == null ? workspace : NmsInternalNomosRefs.workspace(ref);`,
-    `    if (ws == null || ws.isEmpty) {`,
-    `      throw ArgumentError('${className}.open: pass a workspace: or ref: — the workspace to open and bind');`,
-    `    }`,
-    `    final session = await bridge.acquireSession(ws);`,
-    ...(authenticationRecovery === undefined
-      ? []
-      : [
-          `    if (recoverAuthentication != null) {`,
-          `      final posture = await session.nmsAuthenticationPosture(principal: actor);`,
-          `      if (!posture.isReadyFor(actor ?? '')) {`,
-          `        await recoverAuthentication();`,
-          `        await session.nmsAwaitAuthenticationReady(principal: actor);`,
-          `      }`,
-          `    }`,
-        ]),
-    `    return bind(session, actor: actor${
-      manualEncryptionPresent ? ", keyStore: keyStore" : ""
-    });`,
-    `  }`,
-    ``,
-    `  /// The session workspace this client is bound to (from the [NomosSession] handle, when constructed with`,
-    `  /// one) — the \`workspace\` of every read row's canonical [NomosRef]. '' on a bare (non-session) bridge.`,
-    `  String get _ws {`,
-    `    final b = bridge;`,
-    `    return b is NomosSession ? b.workspace : '';`,
-    `  }`,
-    ``,
-    `  /// The [NomosSession] this client dispatches through, when session-bound (the blessed shape);`,
-    `  /// null on a bare (non-session) bridge. Inspectable context: \`client.session?.workspace\`.`,
-    `  NomosSession? get session {`,
-    `    final b = bridge;`,
-    `    return b is NomosSession ? b : null;`,
-    `  }`,
-    ``,
-    `  // LAZY PREFLIGHT (the can't-await constructor path): the first dispatch runs the same`,
-    `  // assertCompatible check bind() runs eagerly. Only when session-bound; a bare bridge keeps the`,
-    `  // pre-session behavior (the kernel gate remains the fail-closed floor either way).`,
-    `  bool _preflighted = false;`,
-    `  Future<void> _preflightOnce() async {`,
-    `    if (_preflighted) return;`,
-    `    _preflighted = true;`,
-    `    final b = bridge;`,
-    `    if (b is NomosSession) {`,
-    `      await b.assertCompatible(interface);`,
-    `    }`,
-    `  }`,
-    ``,
-    `  // Command readiness is deliberately separate from client/read compatibility. Binding a`,
-    `  // generated application may construct clients for every installed domain; compiling every`,
-    `  // offer plan at that point recreates whole-law runtime work. The first actual offer prepares`,
-    `  // exactly this authenticated package/domain slice, once, before dispatch.`,
-    `  final Set<String> _preparedCommands = <String>{};`,
-    `  Future<void> _prepareCommand(String directiveId) async {`,
-    `    if (_preparedCommands.contains(directiveId)) return;`,
-    `    await bridge.prepareDomain(domain: ${dartStr(
-      domain
-    )}, directiveId: directiveId, packageHash: ${hashConst});`,
-    `    _preparedCommands.add(directiveId);`,
-    `  }`,
+    `  /// Workspace of every canonical [NomosRef] returned by this client.`,
+    `  String get _ws => session.workspace;`,
     ``,
     ...(ownedScope === undefined || Object.keys(ownedActions).length === 0
       ? []
@@ -4036,62 +3751,52 @@ export function generateDartBridgeClient(
           `  bool _ownedIdentityReady = false;`,
           `  Future<void> _ensureOwnedIdentity() async {`,
           `    if (_ownedIdentityReady) return;`,
-          `    await bridge.nomosEnsureOwnedIdentity(scope: ${dartStr(
+          `    await session.nomosEnsureOwnedIdentity(scope: ${dartStr(
             ownedScope
           )}, domain: ${dartStr(domain)}, domainHash: domainHash);`,
           `    _ownedIdentityReady = true;`,
           `  }`,
           ``,
           `  Future<NomosOfferOutcome> _ownedRecordAction<TAggregate>(String action, NomosRef<TAggregate> record, String peer) async {`,
-          `    await _preflightOnce();`,
           `    await _ensureOwnedIdentity();`,
           `    if (NmsInternalNomosRefs.workspace(record) != _ws) throw ArgumentError('$action() cannot use a record from another workspace');`,
           `    final directiveId = _ownedDirectiveId(NmsInternalNomosRefs.type(record), action);`,
           `    if (directiveId == null) throw ArgumentError('$action() needs a generated owned record reference');`,
-          `    await _prepareCommand(directiveId);`,
           `    if (peer.trim().isEmpty) throw ArgumentError('$action() needs the person to act with');`,
-          `    final payload = await bridge.nomosPrepareOwnedRecordAction(action: action, scope: ${dartStr(
+          `    final payload = await session.nomosPrepareOwnedRecordAction(action: action, scope: ${dartStr(
             ownedScope
           )}, record: record, peer: peer);`,
-          `    final callUsda = switch (directiveId) {`,
+          `    final generatedCall = switch (directiveId) {`,
           ...[...ownedActionCallEncoders.entries()].map(
             ([directiveId, encoder]) =>
               `      ${dartStr(directiveId)} => ${
                 encoder.functionName
               }(payload as ${encoder.payloadType}),`
           ),
-          `      _ => throw StateError('No generated USDA encoder for owned directive $directiveId'),`,
+          `      _ => throw StateError('No generated Protobuf encoder for owned directive $directiveId'),`,
           `    };`,
-          `    return _offer(callUsda);`,
+          `    return _offer(generatedCall);`,
           `  }`,
           ``,
         ]),
     ...(callEncoderSources.length > 0
       ? [
-          `  /// THE ONE DISPATCH LANE every generated directive method routes through: lazy preflight, then`,
-          `  /// the session's offer (the generated-internal use of the engine-level lane).`,
+          `  /// THE ONE DISPATCH LANE every generated directive method routes through.`,
+          `  /// The kernel prepares and validates the exact authenticated command`,
+          `  /// route inside the offer gate, where readiness is shared by every host and cannot become a`,
+          `  /// second foreground ceremony maintained by generated clients.`,
           `  Future<NomosOfferOutcome> _offer(NmsGeneratedCall call, {List<NomosConflictSnapshot> conflictSnapshots = const [], NomosOfferAuthenticationProof authenticationProof = NomosOfferAuthenticationProof.sessionCredentials}) async {`,
-          `    await _preflightOnce();`,
-          `    await _prepareCommand(call.directive);`,
-    `    Future<NomosOfferOutcome> attempt() => bridge.offerCallUsdaOutcome(call: call, actor: actor, conflictSnapshots: conflictSnapshots, authenticationProof: authenticationProof);`,
-          ...(authenticationRecovery === undefined
-            ? [`    return attempt();`]
+          ...(clientInterface === undefined
+            ? []
             : [
-                `    if (authenticationProof != NomosOfferAuthenticationProof.sessionCredentials) return attempt();`,
-                `    try {`,
-                `      return await attempt();`,
-                `    } on NomosKernelCallFailure {`,
-                `      final posture = await bridge.nmsAuthenticationPosture(principal: actor);`,
-                `      if (posture.providerToken != NomosProviderTokenVerification.noMatchingKey) rethrow;`,
-                `      await ${safeMethod(
-                  authenticationRecovery.id
-                )}(const ${dartActionInputClassName(
-                  authenticationRecovery
-                )}());`,
-                `      await bridge.nmsAwaitAuthenticationReady(principal: actor);`,
-                `      return attempt();`,
-                `    }`,
+                `    // PARTIAL COMPATIBILITY: examine the exact directive before dispatch. The`,
+                `    // session caches this compiler matrix until Peer Office reports law/custody`,
+                `    // movement, so repeated writes do no compatibility work. Unrelated reads and`,
+                `    // writes remain usable when another member is incompatible.`,
+                `    await session.assertOperationCompatible(compatibilityMatrixUsda, domain: call.domain, directive: call.directive);`,
               ]),
+    `    Future<NomosOfferOutcome> attempt() => session.offerGeneratedCallOutcome(call: call, actor: actor, conflictSnapshots: conflictSnapshots, authenticationProof: authenticationProof);`,
+          `    return attempt();`,
           `  }`,
           ``,
         ]
@@ -4102,13 +3807,13 @@ export function generateDartBridgeClient(
       : [
           `  /// Opt into all-device-loss recovery with one explicitly designated person.`,
           `  NomosRecovery get recovery => NomosRecovery(`,
-          `      bridge: bridge, domain: ${dartStr(
+          `      session: session, domain: ${dartStr(
             domain
           )}, domainHash: domainHash, scope: ${dartStr(ownedScope)});`,
           ``,
           `  /// Add another of this person's devices. Requests are opaque; Nomos owns the handoff.`,
           `  NomosDevices get devices => NomosDevices(`,
-          `      bridge: bridge, domain: ${dartStr(
+          `      session: session, domain: ${dartStr(
             domain
           )}, domainHash: domainHash, actor: actor, scope: ${dartStr(
             ownedScope
@@ -4118,64 +3823,16 @@ export function generateDartBridgeClient(
           `      ));`,
           ``,
         ]),
-    // THE OWNER CEREMONY (slice 2): grantAndWrap / revokeAndRotate / rotate — the operator-blind key-epoch
-    // handshake as one call. Bind `actor` (the owner) to author the fan-out. Only for a domain with a scope.
-    ...(domScopes.length > 0
-      ? [
-          `  /// OWNER CEREMONY (slice 2): \`grantAndWrap\` / \`revokeAndRotate\` / \`rotate\` — the operator-blind`,
-          `  /// key-epoch handshake as one call. Bind \`actor\` (the owner) to author the fan-out.`,
-          `  NomosEncryption get encryption => NomosEncryption(`,
-          `      bridge: bridge, domain: ${dartStr(
-            domain
-          )}, domainHash: domainHash, actor: actor,`,
-          `      scopes: const [${domScopes
-            .map((s) => dartStr(s))
-            .join(", ")}]);`,
-          ``,
-        ]
-      : []),
     ...(clientInterface !== undefined
       ? [
-          `  /// This client's structural interface requirement (#72) as JSON — hand it to the`,
-          `  /// bridge's compatibility check to negotiate by SHAPE against the workspace's offer.`,
-          `  String get interfaceJson => ${interfaceConstNameDart(mod.name)};`,
+          `  /// This client's exact compiler-authored USDA compatibility matrix.`,
+          `  Uint8List get compatibilityMatrixUsda => ${interfaceConstNameDart(mod.name)};`,
           ``,
-          `  Map<String, Object?> get _requirement =>`,
-          `      {${dartStr(
-            domain
-          )}: (jsonDecode(interfaceJson) as Map).cast<String, Object?>()};`,
-          ``,
-          `  /// SHAPE COMPATIBILITY (#72): one-shot verdict for THIS client against the workspace's`,
-          `  /// ON-LEDGER offer — \`{ ok, missing[], incompatible[] }\`, by shape not law hash.`,
-          `  Future<Map<String, Object?>> checkCompatibility() => bridge.checkCompatibility(_requirement);`,
-          ``,
-          `  /// SHAPE COMPATIBILITY as a LIVE BINDING (#72): a stream of verdicts that re-emits whenever`,
-          `  /// the workspace's installed law changes (a synced install/upgrade from another peer).`,
-          `  Stream<Map<String, Object?>> watchCompatibility() => bridge.watchCompatibility(_requirement);`,
-          ``,
-          ...(opts.compat !== undefined
-            ? [
-                `  /// THE COMPAT SUPERPOWER (#72b): compute the LIVE per-member verdict for THIS client against the`,
-                `  /// workspace's on-ledger offer + arm the pre-call refusal. Await it after connect so a KNOWN-`,
-                `  /// incompatible directive throws [LawMismatchError] CLIENT-SIDE at write time (never a server 422).`,
-                `  Future<NomosCompat?> checkCompat() => bridge.checkCompat(`,
-                `      (jsonDecode(${compatConstNameDart(
-                  mod.name
-                )}) as Map).cast<String, Object?>(), _requirement);`,
-                ``,
-                `  /// THE FEATURE FLAG (dark-launch): true iff [member] exists on the offer AND is compatible — ship`,
-                `  /// UI with a member dark, deploy the law, it lights up. Await [checkCompat] once first to arm it.`,
-                `  Future<bool> has(String member) => bridge.compatHas(member);`,
-                ``,
-                `  /// COMPAT SUPERPOWER live events: emits the fresh verdict when a synced law change moves the offer.`,
-                `  Stream<NomosCompat> get onLawChanged => bridge.onLawChanged;`,
-                ``,
-              ]
-            : []),
         ]
       : []),
     ...methods,
     `}`,
+    ...dartRefusalDecoders(mod, callUsda.graph, callUsda.paths),
     ``,
     ...(refExtensions.length > 0
       ? [
@@ -4218,7 +3875,7 @@ function dartEncClassMembers(manualEncryptionPresent: boolean): string[] {
     `      for (final record in records) {`,
     `        final type = record.type;`,
     `        final id = record.id;`,
-    `        final held = await bridge.nomosOwnedScopeKeys(scope, recordType: type, recordId: id);`,
+    `        final held = await session.nomosOwnedScopeKeys(scope, recordType: type, recordId: id);`,
     `        for (final key in held) {`,
     `          if (!keys.any((candidate) => candidate.scope == key.scope && candidate.epoch == key.epoch)) keys.add(key);`,
     `        }`,
@@ -4232,9 +3889,10 @@ function dartEncClassMembers(manualEncryptionPresent: boolean): string[] {
     `  Future<List<TModel>> _readWithOwnedKeys<TModel, TAggregate>(`,
     `    List<({String scope, bool owned})> scopes,`,
     `    Future<List<TModel>> Function(List<NomosScopeKey>? keys) read,`,
-    `    NomosRef<TAggregate> Function(TModel row) reference,`,
-    `  ) async {`,
-    `    final first = await read(await _readKeys(scopes));`,
+    `    NomosRef<TAggregate> Function(TModel row) reference, {`,
+    `    List<TModel>? initial,`,
+    `  }) async {`,
+    `    final first = initial ?? await read(await _readKeys(scopes));`,
     `    if (!scopes.any((scope) => scope.owned) || first.isEmpty) return first;`,
     `    final records = first.map(reference).map((record) => (`,
     `      type: NmsInternalNomosRefs.type(record),`,