@githolon/dsl 0.108.7 → 0.110.1

package/dart/test/webview_bridge_test.dart

@@ -1,1930 +0,0 @@
-// NOMOS — the WEBVIEW BRIDGE protocol test (the Dart half of the app-binding boundary). A FAKE transport
-// stands in for the WebView runner (`webview-runner.mjs`): it auto-answers each request from a stub holon,
-// exactly as the real runner would, so the bridge's request/reply correlation, reactive `watch` streams, and
-// error framing are proven in pure Dart — no browser, no MemoryPersistence. The bridge and the JS runner are
-// the two ends of ONE protocol (`kWebviewBridgeVersion`).
-import 'dart:async';
-import 'dart:convert';
-import 'dart:io';
-import 'dart:typed_data';
-
-import 'package:nomos_client/src/nms_generated_runtime.dart';
-import 'package:nomos_types/nomos_kernel_protocol.dart' as protocol;
-import 'package:fixnum/fixnum.dart' as fixnum;
-import 'package:test/test.dart';
-
-protocol.RuntimeResponse _runtimeLifecycleResponse(
-  protocol.RuntimeRequest request,
-) {
-  final response = protocol.RuntimeResponse(
-    protocolVersion: 2,
-    requestId: request.requestId,
-  );
-  switch (request.whichCommand()) {
-    case protocol.RuntimeRequest_Command.listWorkspaces:
-      response.workspaceList = protocol.WorkspaceList();
-      break;
-    case protocol.RuntimeRequest_Command.workspaceStatus:
-      response.workspaceStatus = protocol.WorkspaceStatus(
-        workspace: request.workspaceStatus.session,
-        head: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
-      );
-      break;
-    case protocol.RuntimeRequest_Command.prepareDomain:
-      response.domainPrepared = protocol.DomainPrepared(
-        domain: request.prepareDomain.domain,
-        packageSha256: request.prepareDomain.packageSha256,
-      );
-      break;
-    case protocol.RuntimeRequest_Command.resolveCustodyBreak:
-      response.custodyBreakResolved = protocol.CustodyBreakResolved(
-        session: request.resolveCustodyBreak.session,
-        decision: request.resolveCustodyBreak.decision,
-      );
-      break;
-    case protocol.RuntimeRequest_Command.startAutoSync:
-      response.autoSyncStarted =
-          protocol.AutoSyncStarted(session: request.startAutoSync.session);
-      break;
-    case protocol.RuntimeRequest_Command.stopAutoSync:
-      response.autoSyncStopped =
-          protocol.AutoSyncStopped(session: request.stopAutoSync.session);
-      break;
-    case protocol.RuntimeRequest_Command.syncWorkspace:
-      response.syncWorkspace = protocol.SyncWorkspaceResponse(
-        workspace: request.syncWorkspace.session,
-      );
-      break;
-    case protocol.RuntimeRequest_Command.unwatch:
-      response.watchStopped = protocol.WatchStopped();
-      break;
-    case protocol.RuntimeRequest_Command.closeRealm:
-      response.realmClosed = protocol.RealmClosed();
-      break;
-    case protocol.RuntimeRequest_Command.modelLifecycle:
-      final lifecycle = request.modelLifecycle;
-      switch (lifecycle.whichOperation()) {
-        case protocol.ModelLifecycleRequest_Operation.stage:
-          response.modelLifecycle = protocol.ModelLifecycleResponse(
-            stage: protocol.ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_PENDING,
-            accepted: true,
-          );
-          break;
-        case protocol.ModelLifecycleRequest_Operation.adopt:
-          response.modelLifecycle = protocol.ModelLifecycleResponse(
-            stage: protocol
-                .ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_ACCEPTANCE_REQUIRED,
-            accepted: false,
-            review: protocol.ModelReview(
-              checkedActions: fixnum.Int64(1),
-              candidateActions: fixnum.Int64(1),
-              sameOutcome: false,
-              differences: [
-                protocol.ModelDifference(
-                  kind: protocol
-                      .ModelDifferenceKind.MODEL_DIFFERENCE_KIND_OUTCOME,
-                  action: 'registerSite',
-                  summary: 'registerSite has a different outcome',
-                ),
-              ],
-            ),
-          );
-          break;
-        case protocol.ModelLifecycleRequest_Operation.restore:
-          response.modelLifecycle = protocol.ModelLifecycleResponse(
-            stage: protocol
-                .ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_ACCEPTANCE_REQUIRED,
-            accepted: false,
-            review: protocol.ModelReview(
-              checkedActions: fixnum.Int64(1),
-              candidateActions: fixnum.Int64(1),
-              sameOutcome: false,
-              differences: [
-                protocol.ModelDifference(
-                  kind:
-                      protocol.ModelDifferenceKind.MODEL_DIFFERENCE_KIND_RULES,
-                  action: 'setMood',
-                  summary: 'setMood is governed by a different rule',
-                ),
-              ],
-            ),
-          );
-          break;
-        case protocol.ModelLifecycleRequest_Operation.notSet:
-          throw StateError('Model lifecycle operation is required');
-      }
-      break;
-    default:
-      throw StateError(
-        'Fake lifecycle transport does not implement '
-        '${request.whichCommand().name}',
-      );
-  }
-  return response;
-}
-
-/// A fake runner-over-a-transport: records sent requests, replies the way `webview-runner.mjs` does, and can
-/// push reactive `watch` events. Lets us drive [NomosBridge] without a real WebView.
-class FakeRunner implements BridgeTransport {
-  final _incoming = StreamController<Map<String, Object?>>.broadcast();
-  final List<Map<String, Object?>> sent = [];
-  final List<protocol.RuntimeRequest> runtimeRequests = [];
-  String? lastWatchSubId;
-  bool acknowledgeWatch = true;
-  bool acknowledgeUnwatch = true;
-
-  FakeRunner() {
-    // the runner announces readiness at construction.
-    scheduleMicrotask(() => _incoming.add({
-          'v': kWebviewBridgeVersion,
-          'event': 'ready',
-          'bundleVersion': 'unbundled-dev'
-        }));
-  }
-
-  @override
-  Stream<Map<String, Object?>> get messages => _incoming.stream;
-
-  @override
-  Future<protocol.RuntimeResponse> invokeRuntime(
-    protocol.RuntimeRequest request,
-  ) async {
-    runtimeRequests.add(request.deepCopy());
-    if (!acknowledgeUnwatch && request.hasUnwatch()) {
-      return Completer<protocol.RuntimeResponse>().future;
-    }
-    if (request.hasSyncWorkspace() && !request.syncWorkspace.admit) {
-      return protocol.RuntimeResponse(
-        protocolVersion: 2,
-        requestId: request.requestId,
-        failure: protocol.RuntimeFailure(
-          code: 'nomos.sync.refused',
-          message: 'typed sync failed',
-          component: 'test.runner',
-          workspace: request.syncWorkspace.session,
-        ),
-      );
-    }
-    return _runtimeLifecycleResponse(request);
-  }
-
-  @override
-  void send(Map<String, Object?> message) {
-    sent.add(message);
-    final id = message['id'] as int;
-    final op = message['op'] as String;
-    final args = (message['args'] as Map).cast<String, Object?>();
-    // reply exactly as the runner's ops do (the contract both ends share).
-    Map<String, Object?> reply(Object? result) =>
-        {'v': kWebviewBridgeVersion, 'id': id, 'ok': true, 'result': result};
-    scheduleMicrotask(() {
-      switch (op) {
-        case 'connect':
-          _incoming.add(reply({'workspace': args['workspace']}));
-          break;
-        case 'offer':
-          // a directive the law refuses answers ok:false (the runner frames the gate's verdict).
-          final intentJson =
-              utf8.decode(base64Decode(args['intentBytes'] as String));
-          if (intentJson.contains('"directiveId":"refuseMe"')) {
-            _incoming.add({
-              'v': kWebviewBridgeVersion,
-              'id': id,
-              'ok': false,
-              'error': 'the law refused this intent',
-              'errorInfo': {
-                'code': 'nomos.law.refused',
-                'message': 'the law refused this intent',
-                'component': 'test.runner',
-                'operation': 'offer',
-                'domain': 'x',
-                'directiveId': 'refuseMe',
-                'trace': message['trace'],
-                'attributes': {'test.case': 'refusal'}
-              }
-            });
-          } else if (intentJson.contains('"directiveId":"custodyGap"')) {
-            // The client's typed custody error: structured errorInfo, code=nomos.custody.*.
-            _incoming.add({
-              'v': kWebviewBridgeVersion,
-              'id': id,
-              'ok': false,
-              'error':
-                  'shallow-insufficient: fold refs/heads/main: find commit: NotFound',
-              'errorInfo': {
-                'code': 'nomos.custody.shallow_insufficient',
-                'message':
-                    'shallow-insufficient: fold refs/heads/main: find commit: NotFound',
-                'component': 'nomos.custody',
-                'operation': 'offer',
-                'workspace': 'ws-1',
-                'trace': message['trace'],
-                'attributes': {
-                  'nomos.custody.ref': 'refs/heads/main',
-                  'nomos.custody.head':
-                      'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
-                  'nomos.custody.missing_object':
-                      'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb',
-                  'nomos.custody.phase': 'author',
-                  'nomos.custody.source': 'localSnapshot',
-                  'nomos.custody.recoverable': true,
-                  'nomos.custody.recommended_action':
-                      'quarantineLocalSnapshotAndReclone',
-                }
-              }
-            });
-          } else {
-            _incoming.add(reply({'head': 'HEAD-offer'}));
-          }
-          break;
-        case 'query':
-          _incoming.add(reply({
-            'rows': [
-              {
-                'id': 'a',
-                'data': {'q': args['queryId']}
-              }
-            ]
-          }));
-          break;
-        case 'queryPage':
-          _incoming.add(reply({
-            'rows': [
-              {
-                'id': 'page-a',
-                'data': {'q': args['queryId']}
-              }
-            ],
-            'cursor': 'opaque-next',
-            'done': false,
-          }));
-          break;
-        case 'queryById':
-          _incoming.add(reply({
-            'rows': [
-              {
-                'id': args['id'],
-                'data': {'ok': true}
-              }
-            ]
-          }));
-          break;
-        case 'checkReferenceVersions':
-          _incoming.add(reply({
-            'unique': [
-              {
-                'ref': (args['refs'] as List).single,
-                'outcome': {
-                  'status': 'outdated',
-                  'latest': {
-                    'workspace': 'catalogue',
-                    'type': 'catalogue.Publication',
-                    'id': 'publication:2',
-                  },
-                },
-              },
-            ],
-            'order': [0],
-          }));
-          break;
-        case 'count':
-          _incoming.add(reply({'count': 7}));
-          break;
-        case 'sync':
-          if (args['admit'] == false) {
-            _incoming.add({
-              'v': kWebviewBridgeVersion,
-              'id': id,
-              'ok': false,
-              'error': 'legacy sync failed'
-            });
-          } else {
-            _incoming.add(reply({'pushed': true}));
-          }
-          break;
-        case 'autoSync':
-          _incoming.add(reply({'started': true}));
-          break;
-        case 'refreshCredentials':
-          _incoming.add(reply({'refreshed': true}));
-          break;
-        case 'lawStatus':
-          _incoming.add(reply({'installed': true, 'drifted': false}));
-          break;
-        case 'metrics':
-          final session = args['session'];
-          _incoming.add(reply(session == 'home'
-              ? {
-                  'ahead': 0,
-                  'behind': false,
-                  'saved': 2,
-                  'onMain': 3,
-                  'deadLetters': 0,
-                }
-              : {
-                  'ahead': 4,
-                  'behind': true,
-                  'saved': 5,
-                  'onMain': 6,
-                  'deadLetters': 1,
-                }));
-          break;
-        case 'cryptoOwnedDeviceRequest':
-          _incoming.add(reply({
-            'request': {
-              'v': 1,
-              'workspace': 'notes',
-              'principal': 'user:alice',
-              'scope': 'nomos_internal_owned_read_7c1f5e',
-              'signingPublic': 'AA==',
-              'wrappingPublic': 'AQ==',
-              'signature': 'Ag==',
-            },
-          }));
-          break;
-        case 'cryptoOwnedPrepareApproval':
-          _incoming.add(reply({
-            'newKeySubject': 'key:${'a' * 64}',
-            'ownedCustody': {
-              'v': 1,
-              'request': args['request'],
-              'hpkeEpk': 'Aw==',
-              'ct': 'BA==',
-              'keyCommitment': '0' * 64,
-              'principalWrappingPublic': 'BQ==',
-            },
-            'verifiedVia': 'nomos:test-root',
-            'validFromEpoch': 0,
-            'approvedAt': '2026-07-18T14:20:00.000Z',
-            '__nomos_owned_device_key_subject_7c1f5e': 'key:${'b' * 64}',
-          }));
-          break;
-        case 'cryptoOwnedScopeKeys':
-          _incoming.add(reply({
-            'keys': [
-              {
-                'scope': 'notes.Note:note-1#owned-reader',
-                'epoch': 2,
-                'key': 'opaque-record-key',
-              }
-            ]
-          }));
-          break;
-        case 'cryptoOwnedEnsureIdentity':
-          _incoming.add(reply({'ready': true}));
-          break;
-        case 'cryptoOwnedPrepareRecordAction':
-          _incoming.add(reply({
-            '__nomos_owned_device_key_subject_7c1f5e': 'key:${'c' * 64}',
-            'recordId': 'note-1',
-            'peer': 'user:bob',
-            'epoch': 2,
-            'sharedAt': '2026-07-18T14:25:00.000Z',
-            'wraps': <Object?>[],
-          }));
-          break;
-        case 'adoptGeneratedModel':
-          _incoming.add(reply({
-            'verdict': {
-              'ok': false,
-              'stage': 'acceptance',
-              'report': {
-                'replayedIntents': 2,
-                'candidateIntents': 2,
-                'projection': {'equal': false},
-                'divergences': [
-                  {
-                    'kind': 'plan-divergence',
-                    'directiveId': 'registerSite',
-                  }
-                ],
-              },
-              'error': 'exact history changes under the candidate',
-            }
-          }));
-          break;
-        case 'stageGeneratedModel':
-          _incoming.add(reply({
-            'verdict': {
-              'ok': true,
-              'status': 'pending',
-              'candidateHash': 'candidate-law-hash',
-            }
-          }));
-          break;
-        case 'restorePreviousGeneratedModel':
-          _incoming.add(reply({
-            'verdict': {
-              'ok': false,
-              'stage': 'acceptance',
-              'report': {
-                'replayedIntents': 4,
-                'candidateIntents': 3,
-                'projection': {'equal': false},
-                'divergences': [
-                  {
-                    'kind': 'plan-divergence',
-                    'directiveId': 'setMood',
-                  }
-                ],
-              },
-              'error': 'restoring previous law needs a business reason',
-            }
-          }));
-          break;
-        case 'offerDirective':
-          _incoming.add(reply({
-            'head': 'HEAD-owned-approval',
-            'intentId': 'intent-owned-approval',
-            'created': <Object?>[],
-            'born': args['directiveId'] == 'birthChild'
-                ? <Object?>['notes-child']
-                : <Object?>[],
-            'workspace': 'notes',
-          }));
-          break;
-        case 'badop':
-          _incoming.add({
-            'v': kWebviewBridgeVersion,
-            'id': id,
-            'ok': false,
-            'error': 'the law refused this intent'
-          });
-          break;
-        case 'watch':
-          lastWatchSubId = args['subId'] as String;
-          if (acknowledgeWatch) {
-            _incoming.add(reply({'subId': args['subId']}));
-          }
-          break;
-        case 'unwatch':
-          if (acknowledgeUnwatch) {
-            _incoming.add(reply({'subId': args['subId']}));
-          }
-          break;
-        default:
-          _incoming.add({
-            'v': kWebviewBridgeVersion,
-            'id': id,
-            'ok': false,
-            'error': "unknown op '$op'"
-          });
-      }
-    });
-  }
-
-  /// Simulate the holon firing a reactive change to an active watch.
-  void pushWatch(String subId, List<dynamic> rows) => _incoming.add({
-        'v': kWebviewBridgeVersion,
-        'event': 'watch',
-        'subId': subId,
-        'rows': rows
-      });
-
-  /// Simulate the runner forwarding a signal holon projection.
-  void pushSignal(Map<String, Object?> signal) => _incoming
-      .add({'v': kWebviewBridgeVersion, 'event': 'signal', 'signal': signal});
-
-  /// Simulate one background-sync event from the runner.
-  void pushSync(Map<String, Object?> event) =>
-      _incoming.add({'v': kWebviewBridgeVersion, 'event': 'sync', ...event});
-
-  void pushKernelProgress({required int completed, required int total}) =>
-      _incoming.add({
-        'v': kWebviewBridgeVersion,
-        'event': 'kernelProgress',
-        'schemaVersion': 1,
-        'sequence': completed,
-        'operation': 'restoreMain',
-        'phase': 'verifyIntents',
-        'completed': completed,
-        'total': total,
-        'unit': 'intent',
-        'terminal': completed == total,
-        'kernelAllocatorLiveBytes': 384 * 1024 * 1024,
-        'kernelAllocatorPeakBytes': 512 * 1024 * 1024,
-        'processResidentBytes': 3 * 1024 * 1024 * 1024,
-        'processPeakResidentBytes': 4 * 1024 * 1024 * 1024,
-      });
-}
-
-/// Proves that generated application reads bypass the legacy operation bus.
-/// The ordinary bridge remains present for lifecycle setup, but a query can
-/// only succeed through the generated Runtime v2 kernel-call capability.
-class FakeTypedRunner extends FakeRunner
-    implements NomosKernelCallTransport, NomosRuntimeV2Transport {
-  protocol.CallRequest? lastKernelCall;
-  String? lastKernelSession;
-  @override
-  Future<protocol.CallResponse> callKernel({
-    required String session,
-    required protocol.CallRequest request,
-  }) async {
-    lastKernelSession = session;
-    lastKernelCall = request;
-    if (request.hasQuery() && request.query.hasOwnedDeviceRequest()) {
-      final value = OwnedDeviceRequest(
-        v: 1,
-        workspace: 'home',
-        principal: 'user:alice',
-        scope: request.query.ownedDeviceRequest.scope,
-        signingPublic: 'AA==',
-        wrappingPublic: 'AQ==',
-        signature: 'Ag==',
-      );
-      return protocol.CallResponse(
-        protocolVersion: 1,
-        requestId: request.requestId,
-        query: protocol.QueryResponse(
-          ownedDeviceRequest: protocol.OwnedDeviceRequestResponse(
-            requestUsda: value.encodeUsda(),
-          ),
-        ),
-      );
-    }
-    if (request.hasQuery() && request.query.hasOwnedPrepareApproval()) {
-      final device = OwnedDeviceRequest.decodeUsda(
-        Uint8List.fromList(
-          request.query.ownedPrepareApproval.requestUsda,
-        ),
-      );
-      final custody = OwnedCustody(
-        v: 1,
-        request: device,
-        hpkeEpk: 'Aw==',
-        ct: 'BA==',
-        keyCommitment: '0' * 64,
-        principalWrappingPublic: 'BQ==',
-      );
-      return protocol.CallResponse(
-        protocolVersion: 1,
-        requestId: request.requestId,
-        query: protocol.QueryResponse(
-          ownedPrepareApproval: protocol.OwnedPrepareApprovalResponse(
-            newKeySubject: 'key:${'a' * 64}',
-            ownedCustodyUsda: custody.encodeUsda(),
-            verifiedVia: 'nomos:test-root',
-            validFromEpoch: fixnum.Int64.ZERO,
-            approvedAtUnixMillis: fixnum.Int64(1787062800000),
-            ownedKeySubject: 'key:${'b' * 64}',
-          ),
-        ),
-      );
-    }
-    return protocol.CallResponse(
-      protocolVersion: 1,
-      requestId: request.requestId,
-      query: protocol.QueryResponse(
-        resultUsda: utf8.encode('''#usda 1.0
-(
-    defaultPrim = "Result"
-)
-def NomosReadResult "Result"
-{
-    def NomosListValue "Rows"
-    {
-    }
-}
-'''),
-      ),
-    );
-  }
-
-  @override
-  Future<protocol.RuntimeResponse> invokeRuntime(
-      protocol.RuntimeRequest request) async {
-    runtimeRequests.add(request.deepCopy());
-    final response = protocol.RuntimeResponse(
-      protocolVersion: 2,
-      requestId: request.requestId,
-    );
-    switch (request.whichCommand()) {
-      case protocol.RuntimeRequest_Command.listWorkspaces:
-        response.workspaceList = protocol.WorkspaceList(workspaces: [
-          protocol.WorkspaceSummary(
-            session: 'home',
-            workspace: 'home',
-            residency: protocol.WorkspaceResidency.WORKSPACE_RESIDENCY_MOUNTED,
-            syncPosture: protocol
-                .WorkspaceSyncPosture.WORKSPACE_SYNC_POSTURE_CLOUD_BOUND,
-          ),
-        ]);
-        break;
-      case protocol.RuntimeRequest_Command.prepareDomain:
-        response.domainPrepared = protocol.DomainPrepared(
-          domain: request.prepareDomain.domain,
-          packageSha256: request.prepareDomain.packageSha256,
-        );
-        break;
-      case protocol.RuntimeRequest_Command.resolveCustodyBreak:
-        response.custodyBreakResolved = protocol.CustodyBreakResolved(
-          session: request.resolveCustodyBreak.session,
-          decision: request.resolveCustodyBreak.decision,
-        );
-        break;
-      case protocol.RuntimeRequest_Command.startAutoSync:
-        response.autoSyncStarted =
-            protocol.AutoSyncStarted(session: request.startAutoSync.session);
-        break;
-      case protocol.RuntimeRequest_Command.stopAutoSync:
-        response.autoSyncStopped =
-            protocol.AutoSyncStopped(session: request.stopAutoSync.session);
-        break;
-      case protocol.RuntimeRequest_Command.syncWorkspace:
-        response.syncWorkspace = protocol.SyncWorkspaceResponse(
-          workspace: request.syncWorkspace.session,
-        );
-        break;
-      case protocol.RuntimeRequest_Command.closeRealm:
-        response.realmClosed = protocol.RealmClosed();
-        break;
-      case protocol.RuntimeRequest_Command.modelLifecycle:
-        response.modelLifecycle =
-            _runtimeLifecycleResponse(request).modelLifecycle;
-        break;
-      default:
-        throw StateError(
-            'FakeTypedRunner does not implement ${request.whichCommand().name}');
-    }
-    return response;
-  }
-}
-
-class ErrorRunner implements BridgeTransport {
-  final _incoming = StreamController<Map<String, Object?>>.broadcast();
-
-  @override
-  Stream<Map<String, Object?>> get messages => _incoming.stream;
-
-  @override
-  Future<protocol.RuntimeResponse> invokeRuntime(
-    protocol.RuntimeRequest request,
-  ) async =>
-      _runtimeLifecycleResponse(request);
-
-  @override
-  void send(Map<String, Object?> message) {}
-
-  void fail(Object error) => _incoming.addError(error);
-  Future<void> close() => _incoming.close();
-}
-
-/// A transport that answers EVERY request with one canned `result` (the golden corpus's reply) and records
-/// the request the bridge sent — so we can assert both halves of the wire contract from the Dart side.
-class ReplayTransport implements BridgeTransport {
-  final Map<String, Object?> result;
-  final _incoming = StreamController<Map<String, Object?>>.broadcast();
-  Map<String, Object?>? lastRequest;
-  ReplayTransport(this.result) {
-    scheduleMicrotask(() => _incoming.add({
-          'v': kWebviewBridgeVersion,
-          'event': 'ready',
-          'bundleVersion': 'unbundled-dev'
-        }));
-  }
-  @override
-  Stream<Map<String, Object?>> get messages => _incoming.stream;
-  @override
-  Future<protocol.RuntimeResponse> invokeRuntime(
-    protocol.RuntimeRequest request,
-  ) async =>
-      _runtimeLifecycleResponse(request);
-  @override
-  void send(Map<String, Object?> message) {
-    lastRequest = message;
-    final id = message['id'];
-    scheduleMicrotask(() => _incoming.add(
-        {'v': kWebviewBridgeVersion, 'id': id, 'ok': true, 'result': result}));
-  }
-}
-
-/// Load the shared golden corpus (the same file the JS runner test replays). Probed across the candidate
-/// working dirs `dart test` may run from, so it doesn't depend on one invocation cwd.
-Map<String, Object?> _loadCorpus() {
-  const candidates = [
-    '../../cloud/web-client/test/fixtures/bridge-protocol.golden.json', // cwd = dsl/dart (the usual)
-    'cloud/web-client/test/fixtures/bridge-protocol.golden.json', // cwd = repo root
-    '../../../cloud/web-client/test/fixtures/bridge-protocol.golden.json',
-  ];
-  for (final p in candidates) {
-    final f = File(p);
-    if (f.existsSync())
-      return (jsonDecode(f.readAsStringSync()) as Map).cast<String, Object?>();
-  }
-  fail(
-      'golden corpus not found from ${Directory.current.path}; tried $candidates');
-}
-
-/// Drive one corpus op through the typed bridge method and return its typed result (so we can compare it to
-/// what the corpus says the unwrapped value should be).
-Future<Object?> _invoke(
-    NomosBridge b, String op, Map<String, Object?> a) async {
-  switch (op) {
-    case 'connect':
-      await b.connect(
-          cloud: a['cloud'] as String,
-          workspace: a['workspace'] as String,
-          clientId: a['clientId'] as String?);
-      return null;
-    case 'offer':
-      return b.offer(intentBytes: a['intentBytes'] as String);
-    case 'query':
-      return b.query(
-          a['queryId'] as String, (a['params'] as Map).cast<String, Object?>());
-    case 'queryById':
-      return b.queryById(a['id'] as String);
-    case 'count':
-      return b.count(a['countId'] as String, a['group'] as String);
-    case 'sum':
-      return b.sum(a['sumId'] as String, a['group'] as String);
-    case 'sync':
-      return b.sync(admit: a['admit'] as bool);
-    case 'lawStatus':
-      return b.lawStatus(a['hash'] as String);
-    case 'offerDirective':
-      return b.offerDirective(
-        domain: a['domain'] as String,
-        directiveId: a['directiveId'] as String,
-        payload: a['payload'],
-        actor: a['actor'] as String?,
-        domainHash: a['domainHash'] as String?,
-        force: a['force'] as bool?,
-      );
-    default:
-      fail('corpus op not wired into the Dart bridge: $op');
-  }
-}
-
-/// What the corpus says the typed (unwrapped) return value should be, given the reply's `result`.
-Object? _expectedTyped(String op, Map<String, Object?> result) {
-  switch (op) {
-    case 'offer':
-    case 'offerDirective':
-      return result['head'];
-    case 'query':
-    case 'queryById':
-      return result['rows'];
-    case 'count':
-      return result['count'];
-    case 'sum':
-      return result['sum'];
-    case 'sync':
-      return isA<protocol.SyncWorkspaceResponse>();
-    case 'lawStatus':
-      return result;
-    default:
-      return null; // connect: void
-  }
-}
-
-void main() {
-  test('transport failure fails readiness immediately', () async {
-    final transport = ErrorRunner();
-    final bridge = NomosBridge(transport);
-    final failure = StateError('runner exited');
-    transport.fail(failure);
-    await expectLater(
-      bridge.ready,
-      throwsA(isA<StateError>()
-          .having((e) => e.message, 'message', 'runner exited')),
-    );
-    await bridge.dispose();
-    await transport.close();
-  });
-
-  // ── THE GOLDEN CORPUS — the cross-language conformance the JS runner replays too ──
-  // For each case: call the typed bridge method with the corpus `args`, then assert (1) the request the bridge
-  // SENT carries exactly those args, and (2) the typed value the bridge parsed from the corpus `result` matches.
-  // The JS runner asserts the SAME corpus from the other side — so neither end can drift the wire alone.
-  group('golden corpus (shared with the JS runner)', () {
-    final corpus = _loadCorpus();
-    final cases = (corpus['cases'] as List).cast<Map<String, Object?>>();
-    test('version pins the bridge version',
-        () => expect(corpus['version'], kWebviewBridgeVersion));
-    for (final c in cases) {
-      final op = c['op'] as String;
-      if (op == 'sync')
-        continue; // Runtime v2 has its own protobuf conformance tests.
-      final args = (c['args'] as Map).cast<String, Object?>();
-      final result = (c['result'] as Map).cast<String, Object?>();
-      test("'$op' request args + parsed result match the corpus", () async {
-        final transport = ReplayTransport(result);
-        final bridge = NomosBridge(transport);
-        await bridge.ready;
-        final typed = await _invoke(bridge, op, args);
-        expect((transport.lastRequest!['args'] as Map).cast<String, Object?>(),
-            equals(args),
-            reason: 'sent request args');
-        if (op != 'connect')
-          expect(typed, equals(_expectedTyped(op, result)),
-              reason: 'parsed typed result');
-        await bridge.dispose();
-      });
-    }
-  });
-
-  group('offer span taxonomy (bridge legs)', () {
-    test(
-        'offerOutcome turns the runner timing stamps into bridge-ipc + response-delivery spans on recentSpans',
-        () async {
-      final now = DateTime.now().millisecondsSinceEpoch;
-      final transport = ReplayTransport({
-        'head': 'H1',
-        'intentId': 'intent-span',
-        'created': <Object?>[],
-        'workspace': 'ws',
-        // the runner's op-pickup + durable-ack instants (additive `timing` field)
-        'timing': {'recv': now, 'done': now},
-      });
-      final bridge = NomosBridge(transport);
-      await bridge.ready;
-      await bridge.offerOutcome(
-          domain: 'guestbook',
-          directiveId: 'signGuestbook',
-          payload: {'author': 'ada'});
-      final kinds = bridge.recentSpans
-          .map((m) => ((m['span'] as Map?)?['kind'] ?? '').toString())
-          .toSet();
-      expect(kinds, contains('bridge-ipc'),
-          reason: 'up-leg transport attributed as a span');
-      expect(kinds, contains('response-delivery'),
-          reason: 'post-ack down-leg attributed as a span');
-      await bridge.dispose();
-    });
-
-    test(
-        'a runner without timing (older bundle) emits no bridge-leg spans and still answers',
-        () async {
-      final transport = ReplayTransport({
-        'head': 'H1',
-        'intentId': 'intent-old-runner',
-        'created': <Object?>[],
-        'workspace': 'ws'
-      });
-      final bridge = NomosBridge(transport);
-      await bridge.ready;
-      final out = await bridge.offerOutcome(
-          domain: 'guestbook',
-          directiveId: 'signGuestbook',
-          payload: {'author': 'ada'});
-      expect(out.head, 'H1');
-      final kinds = bridge.recentSpans
-          .map((m) => ((m['span'] as Map?)?['kind'] ?? '').toString())
-          .toSet();
-      expect(kinds, isNot(contains('bridge-ipc')));
-      await bridge.dispose();
-    });
-  });
-
-  // ── #9 — a per-offer authorSecret reaches the runner op (so the runner maps it onto opts.signWith → the
-  // author path signs THIS offer with the intended enrolled key, not the connect-time one). Both offer lanes. ──
-  group('per-offer authorSecret threads to the runner op (#9)', () {
-    test('offerOutcome carries authorSecret to the runner op args', () async {
-      final transport = ReplayTransport({
-        'head': 'H1',
-        'intentId': 'intent-secret',
-        'created': <Object?>[],
-        'workspace': 'ws'
-      });
-      final bridge = NomosBridge(transport);
-      await bridge.ready;
-      await bridge.offerOutcome(
-          domain: 'home',
-          directiveId: 'writeNote',
-          payload: {'author': 'ada'},
-          authorSecret: 'ENROLLED-KEY-B64');
-      final args =
-          (transport.lastRequest!['args'] as Map).cast<String, Object?>();
-      expect(transport.lastRequest!['op'], 'offerDirective');
-      expect(args['authorSecret'], 'ENROLLED-KEY-B64',
-          reason:
-              'the per-offer signing key must reach the runner op (→ opts.signWith)');
-      await bridge.dispose();
-    });
-
-    test('offerDirective carries authorSecret to the runner op args', () async {
-      final transport = ReplayTransport({'head': 'H1'});
-      final bridge = NomosBridge(transport);
-      await bridge.ready;
-      await bridge.offerDirective(
-          domain: 'home',
-          directiveId: 'writeNote',
-          payload: {'author': 'ada'},
-          authorSecret: 'ENROLLED-KEY-B64');
-      final args =
-          (transport.lastRequest!['args'] as Map).cast<String, Object?>();
-      expect(args['authorSecret'], 'ENROLLED-KEY-B64');
-      await bridge.dispose();
-    });
-
-    test(
-        'no authorSecret ⇒ the op omits it (byte-identical to the pre-#9 contract)',
-        () async {
-      final transport = ReplayTransport({
-        'head': 'H1',
-        'intentId': 'intent-no-secret',
-        'created': <Object?>[],
-        'workspace': 'ws'
-      });
-      final bridge = NomosBridge(transport);
-      await bridge.ready;
-      await bridge.offerOutcome(
-          domain: 'home', directiveId: 'writeNote', payload: {'author': 'ada'});
-      final args =
-          (transport.lastRequest!['args'] as Map).cast<String, Object?>();
-      expect(args.containsKey('authorSecret'), isFalse);
-      await bridge.dispose();
-    });
-  });
-
-  late FakeRunner runner;
-  late NomosBridge bridge;
-  setUp(() {
-    runner = FakeRunner();
-    bridge = NomosBridge(runner);
-  });
-  tearDown(() => bridge.dispose());
-
-  test('ready completes once the runner boots', () async {
-    await bridge.ready.timeout(const Duration(seconds: 1));
-  });
-
-  test('nominal queries use Runtime v2 protobuf and return USDA bytes',
-      () async {
-    final typedRunner = FakeTypedRunner();
-    final typedBridge = NomosBridge(typedRunner);
-    addTearDown(typedBridge.dispose);
-    await typedBridge.ready;
-    await typedBridge.connect(
-      cloud: 'https://c',
-      workspace: 'home',
-      session: 'home',
-    );
-    typedRunner.sent.clear();
-
-    final result = await typedBridge.nmsQueryUsda(
-      NmsInternalGeneratedQueries.create(
-        domain: 'entries',
-        query: 'entriesByOwner',
-        canonicalArgumentsUsda: Uint8List.fromList(utf8.encode('''#usda 1.0
-(
-    defaultPrim = "Arguments"
-)
-def NomosQueryArguments "Arguments"
-{
-    custom string nomos:owner = "user:ada"
-}
-''')),
-      ),
-      null,
-      'user:ada',
-      'home',
-    );
-
-    expect(result, isA<Uint8List>());
-    expect(utf8.decode(result), startsWith('#usda 1.0'));
-    expect(typedRunner.sent, isEmpty,
-        reason: 'the JSON-shaped BridgeTransport must not carry the query');
-    expect(typedRunner.lastKernelSession, 'home');
-    expect(typedRunner.lastKernelCall!.hasQuery(), isTrue);
-    expect(typedRunner.lastKernelCall!.query.rows.id, 'entriesByOwner');
-    expect(
-      typedRunner.lastKernelCall!.query.resultFormat,
-      protocol.QueryResultFormat.QUERY_RESULT_FORMAT_NOMINAL_USDA,
-    );
-  });
-
-  test('steady-state lifecycle uses generated Runtime v2 commands', () async {
-    final typedRunner = FakeTypedRunner();
-    final typedBridge = NomosBridge(typedRunner);
-    await typedBridge.ready;
-    await typedBridge.connect(
-      cloud: 'https://c',
-      workspace: 'home',
-      session: 'home',
-    );
-    typedRunner.sent.clear();
-
-    final workspaces = await typedBridge.listWorkspaces();
-    await typedBridge.session('home').prepareDomain(
-          domain: 'guestbook',
-          packageHash: 'a' * 64,
-        );
-    await typedBridge.session('home').autoSync(fallbackMs: 60000);
-    await typedBridge.session('home').stopAutoSync();
-    final custody = await typedBridge.session('home').resolveCustodyBreak(
-          protocol.CustodyBreakDecision.CUSTODY_BREAK_DECISION_ADOPT,
-        );
-
-    expect(workspaces.single.workspace, 'home');
-    expect(
-      custody.decision,
-      protocol.CustodyBreakDecision.CUSTODY_BREAK_DECISION_ADOPT,
-    );
-    expect(
-      typedRunner.runtimeRequests.map((request) => request.whichCommand()),
-      [
-        protocol.RuntimeRequest_Command.listWorkspaces,
-        protocol.RuntimeRequest_Command.prepareDomain,
-        protocol.RuntimeRequest_Command.startAutoSync,
-        protocol.RuntimeRequest_Command.stopAutoSync,
-        protocol.RuntimeRequest_Command.resolveCustodyBreak,
-      ],
-    );
-    expect(typedRunner.sent, isEmpty,
-        reason: 'no JSON command envelope carries steady-state lifecycle');
-    await typedBridge.dispose();
-  });
-
-  test('a local durability span remains workspace/head specific', () async {
-    await bridge.ready;
-    bridge.noteLocalSpan(
-      track: 'submit',
-      name: 'durable save (disk)',
-      kind: 'persist',
-      t0: 100,
-      t1: 120,
-      session: 'born-child',
-      head: '2222222222222222222222222222222222222222',
-    );
-    final saved = bridge.recentSpans
-        .where((event) => event['session'] == 'born-child')
-        .toList();
-    expect(saved, hasLength(2));
-    expect((saved.last['span'] as Map)['head'],
-        '2222222222222222222222222222222222222222');
-  });
-
-  test('dispose closes active watches without mutating its iteration',
-      () async {
-    await bridge.ready;
-    final subscription =
-        bridge.watch('entriesByOwner', {'owner': 'user:ada'}).listen((_) {});
-    await Future<void>.delayed(Duration.zero);
-
-    await bridge.dispose();
-    await subscription.cancel();
-  });
-
-  test('dispose does not wait for a paused watch consumer', () async {
-    await bridge.ready;
-    final subscription =
-        bridge.watch('entriesByOwner', {'owner': 'user:ada'}).listen((_) {});
-    await Future<void>.delayed(Duration.zero);
-    subscription.pause();
-
-    await bridge.dispose().timeout(const Duration(seconds: 1));
-    await subscription.cancel();
-  });
-
-  test('dispose contains an unacknowledged watch registration error', () async {
-    await bridge.ready;
-    runner.acknowledgeWatch = false;
-    final subscription =
-        bridge.watch('entriesByOwner', {'owner': 'user:ada'}).listen((_) {});
-    await Future<void>.delayed(Duration.zero);
-
-    await bridge.dispose();
-    await subscription.cancel();
-  });
-
-  test('offer round-trips a typed head; args reach the runner verbatim',
-      () async {
-    await bridge.ready;
-    final intentBytes = base64Encode(utf8.encode(jsonEncode({
-      'v': 2,
-      'intent': {
-        'domain': 'guestbook',
-        'directiveId': 'signGuestbook',
-        'payload': {'author': 'ada'},
-        'domainHash': 'abc'
-      }
-    })));
-    final head = await bridge.offer(intentBytes: intentBytes);
-    expect(head, 'HEAD-offer');
-    final req = runner.sent.firstWhere((m) => m['op'] == 'offer');
-    expect((req['args'] as Map)['intentBytes'], intentBytes);
-  });
-
-  test('requests carry OpenTelemetry-shaped trace context', () async {
-    await bridge.ready;
-    await bridge.connect(cloud: 'https://c', workspace: 'ws', clientId: 'c1');
-    final req = runner.sent.firstWhere((m) => m['op'] == 'connect');
-    final trace = (req['trace'] as Map).cast<String, Object?>();
-    expect(trace['traceId'], isA<String>());
-    expect((trace['traceId'] as String).length, 32);
-    expect(trace['spanId'], isA<String>());
-    expect((trace['spanId'] as String).length, 16);
-    expect(trace['sampled'], isTrue);
-  });
-
-  test('connect only sends allowUnborn when explicitly opted in', () async {
-    await bridge.ready;
-    await bridge.connect(cloud: 'https://c', workspace: 'strict');
-    var req = runner.sent.lastWhere((m) => m['op'] == 'connect');
-    expect((req['args'] as Map).containsKey('allowUnborn'), isFalse);
-
-    await bridge.connect(
-      cloud: 'https://c',
-      workspace: 'home-unborn',
-      allowUnborn: true,
-    );
-    req = runner.sent.lastWhere((m) => m['op'] == 'connect');
-    expect((req['args'] as Map)['allowUnborn'], isTrue);
-  });
-
-  test(
-      'a session retains the authenticated token subject as its default principal',
-      () async {
-    await bridge.ready;
-    final payload = base64Url
-        .encode(utf8.encode(jsonEncode({'sub': 'ada'})))
-        .replaceAll('=', '');
-    await bridge.connect(
-      cloud: 'https://c',
-      workspace: 'authenticated',
-      authToken: 'header.$payload.signature',
-    );
-
-    expect(bridge.session('authenticated').principal, 'user:ada');
-    expect(bridge.principal, 'user:ada');
-  });
-
-  test('generated model restoration uses one exact Runtime v2 command',
-      () async {
-    await bridge.ready;
-    await bridge.connect(cloud: 'https://c', workspace: 'evo');
-    runner.runtimeRequests.clear();
-    final verdict = await bridge.nomosFrameworkRestorePreviousGeneratedModel(
-      domain: 'evo',
-      currentHash: 'current-law-hash',
-      because: 'the previous operating policy is required',
-    );
-
-    expect(verdict.accepted, isFalse);
-    expect(
-      verdict.stage,
-      protocol.ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_ACCEPTANCE_REQUIRED,
-    );
-    expect(verdict.review.differences.single.action, 'setMood');
-    final request = runner.runtimeRequests.singleWhere(
-      (request) =>
-          request.hasModelLifecycle() && request.modelLifecycle.hasRestore(),
-    );
-    expect(request.modelLifecycle.restore.domain, 'evo');
-    expect(request.modelLifecycle.restore.currentHash, 'current-law-hash');
-    expect(request.modelLifecycle.restore.acceptanceReason,
-        'the previous operating policy is required');
-    expect(
-        runner.sent.where(
-            (message) => message['op'] == 'restorePreviousGeneratedModel'),
-        isEmpty);
-  });
-
-  test(
-      'connect / query / queryPage / queryById / count / sync / lawStatus all wrap the runner',
-      () async {
-    await bridge.ready;
-    await bridge.connect(cloud: 'https://c', workspace: 'ws', clientId: 'c1');
-    expect((await bridge.query('byAuthor', {'author': 'ada'})).first['data'],
-        {'q': 'byAuthor'});
-    final page = await bridge.queryPage('byAuthor',
-        params: {'author': 'ada'}, pageSize: 1);
-    expect(page.rows.single['id'], 'page-a');
-    expect(page.cursor, 'opaque-next');
-    expect(page.done, isFalse);
-    expect((await bridge.queryById('Entry_1')).first['id'], 'Entry_1');
-    expect(await bridge.count('entries'), 7);
-    expect((await bridge.sync()).workspace, 'ws');
-    expect(
-        await bridge.lawStatus('abc'), {'installed': true, 'drifted': false});
-  });
-
-  test('version status returns the required sum type without resolving history',
-      () async {
-    await bridge.ready;
-    final reference = NmsInternalVersionedNomosRefs.create<Object, Object>(
-      pinned: NmsInternalNomosRefs.create<Object>(
-        workspace: 'catalogue',
-        type: 'catalogue.Publication',
-        id: 'publication:1',
-      ),
-      series: NmsInternalNomosRefs.create<Object>(
-        workspace: 'catalogue',
-        type: 'catalogue.Series',
-        id: 'series:1',
-      ),
-      currentField: 'currentPublication',
-    );
-
-    final versionStatus = await bridge.checkReferenceVersion(reference);
-    expect(versionStatus, isA<ReferenceVersionOutdated<Object>>());
-    expect(
-      (versionStatus as ReferenceVersionOutdated<Object>).latest.id,
-      'publication:2',
-    );
-    final request = runner.sent.last;
-    expect(request['op'], 'checkReferenceVersions');
-    final args = (request['args'] as Map).cast<String, Object?>();
-    final check =
-        ((args['refs'] as List).single as Map).cast<String, Object?>();
-    expect(check['currentField'], 'currentPublication');
-    expect((check['pinned'] as Map)['id'], 'publication:1');
-    expect((check['series'] as Map)['id'], 'series:1');
-  });
-
-  test(
-      'moments and historic reads keep commit plumbing behind an opaque handle',
-      () async {
-    final momentsTransport = ReplayTransport({
-      'commits': [
-        {
-          'oid': 'abc123',
-          'at': 1784383200000,
-          'actorSubject': 'user:ada',
-          'domain': 'estate',
-          'directiveId': 'createSite',
-        }
-      ]
-    });
-    final momentsBridge = NomosBridge(momentsTransport);
-    await momentsBridge.ready;
-    final moments = await momentsBridge.moments(limit: 12);
-    expect(moments, hasLength(1));
-    expect(moments.single.id, 'abc123');
-    expect(moments.single.performedBy, 'user:ada');
-    expect(moments.single.action, 'createSite');
-    expect((momentsTransport.lastRequest!['args'] as Map)['limit'], 12);
-    await momentsBridge.dispose();
-
-    final readTransport = ReplayTransport({
-      'rows': [
-        {
-          'id': 'EstateSite_1',
-          'data': {'name': 'HQ'}
-        }
-      ]
-    });
-    final readBridge = NomosBridge(readTransport);
-    await readBridge.ready;
-    final rows = await readBridge.queryByIdAt(moments.single, 'EstateSite_1');
-    expect(rows.single['data'], {'name': 'HQ'});
-    expect(readTransport.lastRequest!['op'], 'queryByIdAt');
-    expect((readTransport.lastRequest!['args'] as Map),
-        containsPair('commit', 'abc123'));
-    await readBridge.dispose();
-  });
-
-  test(
-      'devices retain nominal request and custody types through one atomic approval',
-      () async {
-    final typedRunner = FakeTypedRunner();
-    final typedBridge = NomosBridge(typedRunner);
-    addTearDown(typedBridge.dispose);
-    await typedBridge.ready;
-    await typedBridge.connect(
-      cloud: 'https://c',
-      workspace: 'home',
-      session: 'home',
-      authorSecret: base64Encode(List<int>.filled(32, 7)),
-      authToken: 'e30.eyJzdWIiOiJhbGljZSJ9.',
-    );
-    NomosOwnedDeviceApprovalPreparation? approved;
-    final devices = NomosDevices(
-      bridge: typedBridge.session('home'),
-      domain: 'notes',
-      domainHash: 'a' * 64,
-      actor: 'user:alice',
-      scope: 'nomos_internal_owned_read_7c1f5e',
-      approvePrepared: (preparation) async {
-        approved = preparation;
-        return const NomosOfferOutcome(
-          head: 'HEAD-owned-approval',
-          created: [],
-          workspace: 'notes',
-        );
-      },
-    );
-
-    final request = await devices.request();
-    expect(request.workspace, 'home');
-    expect(request.principal, 'user:alice');
-    expect(request.scope, 'nomos_internal_owned_read_7c1f5e');
-    expect(typedRunner.lastKernelCall!.query.hasOwnedDeviceRequest(), isTrue);
-
-    final outcome = await devices.approve(request);
-    expect(outcome.head, 'HEAD-owned-approval');
-    expect(typedRunner.lastKernelCall!.query.hasOwnedPrepareApproval(), isTrue);
-    expect(approved?.newKeySubject, 'key:${'a' * 64}');
-    expect(approved?.ownedCustody.request.workspace, 'home');
-    expect(approved?.ownedCustody.keyCommitment, '0' * 64);
-    expect(approved?.verifiedVia, 'nomos:test-root');
-    expect(approved?.validFromEpoch, 0);
-    expect(approved?.approvedAt, '2026-08-18T14:20:00.000Z');
-    expect(approved?.ownedKeySubject, 'key:${'b' * 64}');
-  });
-
-  test(
-      'record sharing keeps keys, identity and action payloads behind the bridge',
-      () async {
-    await bridge.ready;
-    final keys = await bridge.nomosOwnedScopeKeys(
-      'owned-reader',
-      recordType: 'notes.Note',
-      recordId: 'note-1',
-    );
-    expect(keys.single.epoch, 2);
-    expect(keys.single.key, 'opaque-record-key');
-
-    await bridge.nomosEnsureOwnedIdentity(
-      scope: 'owned-reader',
-      domain: 'notes',
-      domainHash: 'a' * 64,
-    );
-    final payload = await bridge.nomosPrepareOwnedRecordAction(
-      action: 'share',
-      scope: 'owned-reader',
-      record: NmsInternalNomosRefs.create<Object?>(
-        workspace: 'ws-1',
-        type: 'notes.Note',
-        id: 'note-1',
-      ),
-      peer: 'user:bob',
-    );
-    expect(payload, isA<NomosOwnedSharePreparation>());
-    expect((payload as NomosOwnedSharePreparation).recordId, 'note-1');
-    expect(payload.ownedKeySubject, 'key:${'c' * 64}');
-
-    final keyCall = runner.sent.firstWhere(
-      (message) => message['op'] == 'cryptoOwnedScopeKeys',
-    );
-    expect((keyCall['args'] as Map).cast<String, Object?>(), {
-      'scope': 'owned-reader',
-      'record': {'type': 'notes.Note', 'id': 'note-1'},
-    });
-    final identityCall = runner.sent.firstWhere(
-      (message) => message['op'] == 'cryptoOwnedEnsureIdentity',
-    );
-    expect((identityCall['args'] as Map).cast<String, Object?>(), {
-      'scope': 'owned-reader',
-      'domain': 'notes',
-      'domainHash': 'a' * 64,
-    });
-    final actionCall = runner.sent.firstWhere(
-      (message) => message['op'] == 'cryptoOwnedPrepareRecordAction',
-    );
-    expect((actionCall['args'] as Map).cast<String, Object?>(), {
-      'action': 'share',
-      'scope': 'owned-reader',
-      'record': {'type': 'notes.Note', 'id': 'note-1'},
-      'peer': 'user:bob',
-    });
-  });
-
-  test('generated model adoption uses one exact Runtime v2 command', () async {
-    await bridge.ready;
-    await bridge.connect(cloud: 'https://c', workspace: 'evo');
-    runner.runtimeRequests.clear();
-    final verdict = await bridge.nomosFrameworkAdoptGeneratedModel(
-      domain: 'evo',
-      candidateHash: 'candidate-law-hash',
-      because: 'the renamed business action is intentional',
-    );
-
-    expect(verdict.accepted, isFalse);
-    expect(
-      verdict.stage,
-      protocol.ModelLifecycleStage.MODEL_LIFECYCLE_STAGE_ACCEPTANCE_REQUIRED,
-    );
-    expect(verdict.review.differences.single.action, 'registerSite');
-    final request = runner.runtimeRequests.singleWhere(
-      (request) =>
-          request.hasModelLifecycle() && request.modelLifecycle.hasAdopt(),
-    );
-    expect(request.modelLifecycle.adopt.domain, 'evo');
-    expect(request.modelLifecycle.adopt.candidateHash, 'candidate-law-hash');
-    expect(request.modelLifecycle.adopt.acceptanceReason,
-        'the renamed business action is intentional');
-    expect(
-        runner.sent.where((message) => message['op'] == 'adoptGeneratedModel'),
-        isEmpty);
-  });
-
-  test(
-      'generated model staging carries USDA bytes in one exact Runtime v2 command',
-      () async {
-    await bridge.ready;
-    await bridge.connect(cloud: 'https://c', workspace: 'evo');
-    runner.runtimeRequests.clear();
-    await bridge.nomosInternalStageGeneratedModel(
-      domain: 'evo',
-      candidateHash: 'candidate-law-hash',
-      lawUsdz: const [1, 2, 3],
-    );
-
-    final request = runner.runtimeRequests.singleWhere(
-      (request) =>
-          request.hasModelLifecycle() && request.modelLifecycle.hasStage(),
-    );
-    expect(request.modelLifecycle.stage.domain, 'evo');
-    expect(request.modelLifecycle.stage.candidateHash, 'candidate-law-hash');
-    expect(request.modelLifecycle.stage.lawUsdz, [1, 2, 3]);
-    expect(
-        runner.sent.where((message) => message['op'] == 'stageGeneratedModel'),
-        isEmpty);
-  });
-
-  test(
-      'watch is a reactive stream; a runner push reaches the listener; cancel unwatches',
-      () async {
-    await bridge.ready;
-    final got = <List<dynamic>>[];
-    final sub = bridge.watch('byAuthor', {'author': 'ada'}).listen(got.add);
-    await Future<void>.delayed(Duration.zero); // let the watch register
-    runner.pushWatch(runner.lastWatchSubId!, [
-      {
-        'id': 'a',
-        'data': {'n': 2}
-      }
-    ]);
-    await Future<void>.delayed(Duration.zero);
-    expect(got, [
-      [
-        {
-          'id': 'a',
-          'data': {'n': 2}
-        }
-      ]
-    ]);
-    await sub.cancel();
-    expect(
-        runner.runtimeRequests.any((request) => request.hasUnwatch()), isTrue);
-  });
-
-  test('watch cancellation is local and never waits for the runner', () async {
-    await bridge.ready;
-    runner.acknowledgeUnwatch = false;
-    final sub = bridge.watch('byAuthor', {'author': 'ada'}).listen((_) {});
-    await Future<void>.delayed(Duration.zero);
-
-    await sub.cancel().timeout(const Duration(milliseconds: 100));
-    expect(
-        runner.runtimeRequests.any((request) => request.hasUnwatch()), isTrue);
-  });
-
-  test('signal events are forwarded on their own stream', () async {
-    await bridge.ready;
-    final got = <Map<String, Object?>>[];
-    final sub = bridge.signalEvents.listen(got.add);
-    runner.pushSignal({
-      'type': 'signal.projection',
-      'domain': 'presence',
-      'projection': {
-        'peers': [
-          {'clientId': 'prof-a', 'behindBest': 141},
-        ],
-      },
-    });
-    await Future<void>.delayed(Duration.zero);
-    expect(got.single['signal'], isA<Map>());
-    expect(((got.single['signal'] as Map)['projection'] as Map)['peers'],
-        isA<List>());
-    await sub.cancel();
-  });
-
-  test('autoSync forwards a scoped signal id', () async {
-    await bridge.ready;
-    await bridge.session('ws').autoSync(signalId: 'signal:ws:list:main');
-    final request = runner.runtimeRequests
-        .firstWhere((request) => request.hasStartAutoSync());
-    expect(request.startAutoSync.signalId, 'signal:ws:list:main');
-  });
-
-  test(
-      'an exact write receipt advances from local acceptance to remote convergence',
-      () async {
-    await bridge.ready;
-    final outcome = await bridge.offerOutcome(
-      domain: 'notes',
-      directiveId: 'writeNote',
-      payload: {'text': 'hello'},
-    );
-    expect(outcome.receipt.current.phase, NomosOperationPhase.locallyAccepted);
-    expect(
-      bridge.session('notes').currentStatus.phase,
-      SyncPhase.syncing,
-      reason: 'a locally accepted write cannot remain falsely current',
-    );
-    expect(bridge.session('notes').currentStatus.ahead, 1);
-
-    runner.pushSync({
-      'session': 'notes',
-      'reason': 'write',
-      'result': {
-        'admittedIntentIds': ['intent-owned-approval'],
-      },
-    });
-    await outcome.receipt.admitted.timeout(const Duration(seconds: 1));
-    expect(outcome.receipt.current.phase,
-        NomosOperationPhase.admittedToRemoteCustody);
-
-    runner.pushSync({
-      'session': 'notes',
-      'reason': 'drain-read',
-      'result': {
-        'convergedIntentIds': ['intent-owned-approval'],
-      },
-    });
-    await outcome.receipt.converged.timeout(const Duration(seconds: 1));
-    expect(outcome.receipt.current.isConverged, isTrue);
-    expect(bridge.session('notes').currentStatus.phase, SyncPhase.idle);
-  });
-
-  test('offline debt leaves a receipt pending and reconnect settles it',
-      () async {
-    await bridge.ready;
-    final outcome = await bridge.offerOutcome(
-      domain: 'notes',
-      directiveId: 'writeNote',
-      payload: {'text': 'offline'},
-    );
-    runner.pushSync({
-      'session': 'notes',
-      'reason': 'write',
-      'result': {'offline': true, 'stillAhead': true},
-    });
-    await Future<void>.delayed(Duration.zero);
-    expect(outcome.receipt.current.phase, NomosOperationPhase.locallyAccepted);
-
-    runner.pushSync({
-      'session': 'notes',
-      'reason': 'reconnect',
-      'result': {
-        'admittedIntentIds': ['intent-owned-approval'],
-        'convergedIntentIds': ['intent-owned-approval'],
-      },
-    });
-    await outcome.receipt.converged.timeout(const Duration(seconds: 1));
-  });
-
-  test('a generated child workspace inherits the parent birth receipt',
-      () async {
-    await bridge.ready;
-    final outcome = await bridge.offerOutcome(
-      domain: 'notes',
-      directiveId: 'birthChild',
-      payload: {'name': 'child'},
-    );
-    final childReceipt =
-        bridge.session('notes-child').nomosInternalWorkspaceCreationReceipt();
-    expect(childReceipt, same(outcome.receipt));
-  });
-
-  test(
-      'background authentication failure refreshes through the retained application session',
-      () async {
-    String token(String marker) =>
-        '${base64Url.encode(utf8.encode('{"alg":"none"}')).replaceAll('=', '')}.'
-        '${base64Url.encode(utf8.encode('{"sub":"alice","iss":"test","marker":"$marker"}')).replaceAll('=', '')}.x';
-    await bridge.ready;
-    await bridge.connect(
-      cloud: 'https://cloud.example',
-      workspace: 'notes',
-      session: 'notes',
-      authToken: token('initial'),
-    );
-    bridge.session('notes').nomosInternalRetainCloudAccess(
-          cloud: 'https://cloud.example',
-          signIn: () async => token('refreshed'),
-        );
-
-    runner.pushSync({
-      'session': 'notes',
-      'reason': 'reconnect',
-      'result': {
-        'pushFailed': true,
-        'pushError': {'status': 401, 'error': 'token expired'},
-      },
-    });
-    await Future<void>.delayed(const Duration(milliseconds: 10));
-    final refresh = runner.sent
-        .lastWhere((message) => message['op'] == 'refreshCredentials');
-    expect((refresh['args'] as Map)['authToken'], token('refreshed'));
-  });
-
-  test(
-      'background sync status never calls an offline or failed round successful',
-      () async {
-    await bridge.ready;
-
-    runner.pushSync({
-      'reason': 'reconnect',
-      'result': {
-        'offline': true,
-        'pushError': {'error': 'network unavailable'}
-      }
-    });
-    await Future<void>.delayed(Duration.zero);
-    expect(bridge.currentStatus.phase, SyncPhase.offline);
-    expect(bridge.currentStatus.lastSyncedAt, isNull);
-    expect(bridge.currentStatus.lastError, 'network unavailable');
-
-    runner.pushSync({
-      'reason': 'reconnect',
-      'ok': false,
-      'error': 'kernel capability skew',
-    });
-    await Future<void>.delayed(Duration.zero);
-    expect(bridge.currentStatus.phase, SyncPhase.error);
-    expect(bridge.currentStatus.lastSyncedAt, isNull);
-    expect(bridge.currentStatus.lastError, 'kernel capability skew');
-
-    runner.pushSync({
-      'reason': 'reconnect',
-      'result': {'stillAhead': false}
-    });
-    await Future<void>.delayed(Duration.zero);
-    expect(bridge.currentStatus.phase, SyncPhase.idle);
-    expect(bridge.currentStatus.lastSyncedAt, isNotNull);
-    expect(bridge.currentStatus.lastError, isNull);
-  });
-
-  test('application sync status scopes and folds every connected workspace',
-      () async {
-    await bridge.ready;
-    await bridge.connect(cloud: 'https://c', workspace: 'home');
-    await bridge.connect(cloud: 'https://c', workspace: 'estate');
-
-    final status = await bridge.syncStatus.firstWhere(
-      (value) => value.ahead == 4 && value.behind == 1,
-    );
-
-    expect(status.saved, 7);
-    expect(status.onMain, 9);
-    expect(status.deadLetters, 1);
-    final metricRequests =
-        runner.sent.where((message) => message['op'] == 'metrics').toList();
-    expect(metricRequests, hasLength(2));
-    expect(
-      metricRequests
-          .map((message) => (message['args'] as Map)['session'])
-          .toSet(),
-      {'home', 'estate'},
-    );
-  });
-
-  test('workspace application status is isolated from sibling workspace debt',
-      () async {
-    await bridge.ready;
-    await bridge.connect(cloud: 'https://c', workspace: 'home');
-    await bridge.connect(cloud: 'https://c', workspace: 'estate');
-
-    expect(
-      bridge.session('home').currentStatus.phase,
-      SyncPhase.syncing,
-      reason: 'an unmeasured session must not claim to be current',
-    );
-
-    final home = await bridge.session('home').syncStatus.firstWhere(
-          (value) => value.saved == 2,
-        );
-    final estate = await bridge.session('estate').syncStatus.firstWhere(
-          (value) => value.saved == 5,
-        );
-
-    expect(home.ahead, 0);
-    expect(home.behind, 0);
-    expect(estate.ahead, 4);
-    expect(estate.behind, 1);
-
-    runner.pushSync({
-      'session': 'estate',
-      'reason': 'reconnect',
-      'ok': false,
-      'error': 'estate only failed',
-    });
-    await Future<void>.delayed(Duration.zero);
-    expect(bridge.session('home').currentStatus.phase, SyncPhase.idle);
-    expect(bridge.session('estate').currentStatus.phase, SyncPhase.error);
-    expect(bridge.currentStatus.phase, SyncPhase.error);
-  });
-
-  test('unchanged workspace metrics do not fan out duplicate status events',
-      () async {
-    await bridge.ready;
-    await bridge.connect(cloud: 'https://c', workspace: 'home');
-
-    final firstStatuses = <SyncStatus>[];
-    final first = bridge.session('home').syncStatus.listen(firstStatuses.add);
-    for (var attempt = 0;
-        attempt < 20 && !firstStatuses.any((status) => status.saved == 2);
-        attempt += 1) {
-      await Future<void>.delayed(const Duration(milliseconds: 10));
-    }
-    expect(firstStatuses.any((status) => status.saved == 2), isTrue);
-    await first.cancel();
-
-    final repeatedStatuses = <SyncStatus>[];
-    final repeated =
-        bridge.session('home').syncStatus.listen(repeatedStatuses.add);
-    await Future<void>.delayed(const Duration(milliseconds: 30));
-
-    expect(
-      repeatedStatuses,
-      hasLength(1),
-      reason: 'the listener gets one seed; the identical metrics poll is quiet',
-    );
-    expect(repeatedStatuses.single.saved, 2);
-    await repeated.cancel();
-  });
-
-  test('custody push refusal is scoped, actionable, and cleared by recovery',
-      () async {
-    await bridge.ready;
-    await bridge.connect(cloud: 'https://c', workspace: 'home');
-    await bridge.connect(cloud: 'https://c', workspace: 'estate');
-
-    runner.pushSync({
-      'session': 'estate',
-      'reason': 'local-write',
-      'result': {
-        'stillAhead': true,
-        'pushFailed': true,
-        'pushError': {
-          'status': 409,
-          'refused': true,
-          'error': 'candidate law is not admitted',
-        },
-      },
-    });
-    await Future<void>.delayed(Duration.zero);
-
-    expect(bridge.session('home').currentStatus.phase, isNot(SyncPhase.error));
-    expect(bridge.session('estate').currentStatus.phase, SyncPhase.error);
-    expect(
-      bridge.session('estate').currentStatus.lastError,
-      'Shared custody refused this workspace change (HTTP 409): '
-      'candidate law is not admitted',
-    );
-    expect(bridge.currentStatus.phase, SyncPhase.error);
-
-    runner.pushSync({
-      'session': 'estate',
-      'reason': 'retry',
-      'result': {'stillAhead': false},
-    });
-    await Future<void>.delayed(Duration.zero);
-
-    expect(bridge.session('estate').currentStatus.phase, SyncPhase.idle);
-    expect(bridge.session('estate').currentStatus.lastError, isNull);
-  });
-
-  test('status listener attached before connect never sends ambiguous metrics',
-      () async {
-    await bridge.ready;
-    final statuses = <SyncStatus>[];
-    final subscription = bridge.syncStatus.listen(statuses.add);
-    await Future<void>.delayed(Duration.zero);
-
-    expect(
-      runner.sent.where((message) => message['op'] == 'metrics'),
-      isEmpty,
-    );
-
-    await bridge.connect(cloud: 'https://c', workspace: 'home');
-    await bridge.connect(cloud: 'https://c', workspace: 'estate');
-    for (var attempt = 0;
-        attempt < 20 &&
-            !statuses.any((status) => status.ahead == 4 && status.behind == 1);
-        attempt += 1) {
-      await Future<void>.delayed(const Duration(milliseconds: 10));
-    }
-
-    final metricRequests =
-        runner.sent.where((message) => message['op'] == 'metrics').toList();
-    expect(metricRequests, isNotEmpty);
-    expect(
-      metricRequests.every(
-        (message) =>
-            (message['args'] as Map)['session'] is String &&
-            ((message['args'] as Map)['session'] as String).isNotEmpty,
-      ),
-      isTrue,
-    );
-    expect(
-      statuses.any((status) => status.ahead == 4 && status.behind == 1),
-      isTrue,
-    );
-    expect(statuses.last.lastError, isNull);
-    await subscription.cancel();
-  });
-
-  test('a law refusal throws NomosBridgeError with the verbatim message',
-      () async {
-    await bridge.ready;
-    Object? err;
-    try {
-      await bridge.offer(
-          intentBytes: base64Encode(utf8.encode(jsonEncode({
-        'v': 2,
-        'intent': {
-          'domain': 'x',
-          'directiveId': 'refuseMe',
-          'payload': {},
-          'domainHash': 'h'
-        }
-      }))));
-    } on NomosBridgeError catch (e) {
-      err = e;
-    }
-    expect(err, isA<NomosBridgeError>());
-    final e = err as NomosBridgeError;
-    expect(e.message, contains('law refused'));
-    expect(e.info.code, 'nomos.law.refused');
-    expect(e.info.component, 'test.runner');
-    expect(e.info.operation, 'offer');
-    expect(e.info.domain, 'x');
-    expect(e.info.directiveId, 'refuseMe');
-    expect(e.info.trace.traceId, isNotEmpty);
-    expect(e.info.toTelemetryAttributes()['nomos.error.code'],
-        'nomos.law.refused');
-    expect(e.info.toTelemetryAttributes()['nomos.operation'], 'offer');
-  });
-
-  test(
-      'a custody fault surfaces as the TYPED CustodyError (switch on code, never scrape prose)',
-      () async {
-    await bridge.ready;
-    Object? err;
-    try {
-      await bridge.offer(
-          intentBytes: base64Encode(utf8.encode(jsonEncode({
-        'v': 2,
-        'intent': {
-          'domain': 'x',
-          'directiveId': 'custodyGap',
-          'payload': {},
-          'domainHash': 'h'
-        }
-      }))));
-    } on NomosBridgeError catch (e) {
-      err = e; // still catchable as the generic bridge error
-    }
-    expect(err, isA<CustodyError>());
-    final e = err as CustodyError;
-    expect(e.code, 'nomos.custody.shallow_insufficient');
-    expect(e.workspace, 'ws-1');
-    expect(e.ref, 'refs/heads/main');
-    expect(e.head, 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa');
-    expect(e.missingObject, 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb');
-    expect(e.phase, CustodyPhase.author);
-    expect(e.source, CustodySource.localSnapshot);
-    expect(e.recoverable, isTrue);
-    expect(e.recommendedAction, 'quarantineLocalSnapshotAndReclone');
-    expect(e.shouldEvictLocalCustody, isTrue);
-    expect(e.info.trace.traceId,
-        isNotEmpty); // trace IDs ride as on every bridge error
-    expect(e.message, contains('shallow-insufficient'));
-  });
-
-  test('Runtime v2 failures preserve their generated error identity', () async {
-    await bridge.ready;
-    await bridge.connect(
-      cloud: 'https://c',
-      workspace: 'ws-1',
-      session: 'ws-1',
-    );
-    Object? err;
-    try {
-      await bridge.sync(admit: false);
-    } on NomosBridgeError catch (e) {
-      err = e;
-    }
-    expect(err, isA<NomosBridgeError>());
-    final e = err as NomosBridgeError;
-    expect(e.message, 'typed sync failed');
-    expect(e.info.code, 'nomos.sync.refused');
-    expect(e.info.component, 'test.runner');
-    expect(e.info.workspace, 'ws-1');
-  });
-
-  test('typed kernel progress preserves the measured verification fraction',
-      () async {
-    await bridge.ready;
-    final next = bridge.kernelProgress.first;
-    runner.pushKernelProgress(completed: 2081, total: 4162);
-    final progress = await next;
-    expect(progress.operation, KernelProgressOperation.restoreMain);
-    expect(progress.phase, KernelProgressPhase.verifyIntents);
-    expect(progress.unit, KernelProgressUnit.intent);
-    expect(progress.completed, 2081);
-    expect(progress.total, 4162);
-    expect(progress.fraction, 0.5);
-    expect(progress.terminal, isFalse);
-    expect(progress.kernelAllocatorLiveBytes, 384 * 1024 * 1024);
-    expect(progress.kernelAllocatorPeakBytes, 512 * 1024 * 1024);
-    expect(progress.processResidentBytes, 3 * 1024 * 1024 * 1024);
-    expect(progress.processPeakResidentBytes, 4 * 1024 * 1024 * 1024);
-    expect(progress.unaccountedResidentBytes, (3 * 1024 - 384) * 1024 * 1024);
-  });
-}