@githolon/dsl 0.111.0 → 0.111.1

package/dart/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 0.66.9
+
+- Prepare delayed workspace enrollment inside Peer Office and retry a proven non-admitted write once. Generated applications can observe preparation while retaining their draft.
+
+## 0.66.8
+
+- Recover expired or missing sync credentials from typed failures. Preserve authorization and domain refusals without refreshing credentials based on diagnostic wording or HTTP 403.
+
 ## 0.66.7
 
 - Recover sync after loss of the upstream bookmark by fetching provider history and allowing the kernel to verify a shared ancestor. Preserve pending local work and reject unrelated history through the existing admission gate.
@@ -18,7 +26,7 @@
 
 ## 0.66.3
 
-- Restaged the generated runtime bridge: regenerated vendored runtime assets. Published pub.dev archives are immutable, so regenerated bytes ride their own version.
+- Recover expired or missing sync credentials from typed failures. Preserve authorization and domain refusals without refreshing credentials based on diagnostic wording or HTTP 403.
 
 ## 0.66.2
 
@@ -114,11 +122,11 @@
 
 ## 0.64.47
 
-- Restaged the generated runtime bridge: regenerated vendored runtime assets. Published pub.dev archives are immutable, so regenerated bytes ride their own version.
+- Recover expired or missing sync credentials from typed failures. Preserve authorization and domain refusals without refreshing credentials based on diagnostic wording or HTTP 403.
 
 ## 0.64.46
 
-- Restaged the generated runtime bridge: regenerated vendored runtime assets. Published pub.dev archives are immutable, so regenerated bytes ride their own version.
+- Recover expired or missing sync credentials from typed failures. Preserve authorization and domain refusals without refreshing credentials based on diagnostic wording or HTTP 403.
 
 ## 0.64.45
 

package/dart/lib/src/reception/dart_reception.dart

@@ -17,6 +17,7 @@ library;
 import 'package:meta/meta.dart' show internal;
 
 import 'dart:async';
+import '../write_progress.dart';
 import 'dart:convert';
 import 'dart:developer' as developer;
 import 'dart:typed_data';
@@ -879,7 +880,16 @@ class DartReception {
     );
   }
 
+  final Map<String, void Function(NomosWriteProgress)> _writeObservers = {};
+
   void _onRuntimeEvent(nomos_protocol.RuntimeEvent event) {
+    if (event.hasWritePreparation()) {
+      final progress = event.writePreparation;
+      _eventPlane._writeObservers[progress.requestId]?.call(
+        const NomosWriteProgress(NomosWritePhase.preparing),
+      );
+      return;
+    }
     if (event.hasReady()) {
       final stale = _staleBundleError(event.ready.runtimeVersion);
       if (stale != null && !allowStaleRunnerBundle) {
@@ -1719,40 +1729,48 @@ class DartReception {
     // ignore: avoid_print
     print('[nomos-offer] dispatch ${call.domain}/${call.directive} in '
         '$workspace using ${authenticationProof.name}');
-    Future<nomos_protocol.CallResponse> attempt() {
+    Future<nomos_protocol.CallResponse> attempt() async {
       final requestNumber = ++plane._sequences.request;
-      return kernelTransport.callKernel(
-        session: runtimeSession,
-        request: nomos_protocol.CallRequest(
-          protocolVersion: 1,
-          requestId: '$runtimeSession:offer:$requestNumber',
-          offer: nomos_protocol.OfferRequest(
-            call: nomos_protocol.DirectiveCall(
-              domain: call.domain,
-              directive: call.directive,
-              operation: google_protobuf.Any(
-                typeUrl: call.protobufType,
-                value: call.protobufPayload,
+      final requestId = '$runtimeSession:offer:$requestNumber';
+      final observer = NomosWrite.captureObserver();
+      if (observer != null) plane._writeObservers[requestId] = observer;
+      try {
+        return await kernelTransport.callKernel(
+          session: runtimeSession,
+          request: nomos_protocol.CallRequest(
+            protocolVersion: 1,
+            requestId: requestId,
+            offer: nomos_protocol.OfferRequest(
+              call: nomos_protocol.DirectiveCall(
+                domain: call.domain,
+                directive: call.directive,
+                operation: google_protobuf.Any(
+                  typeUrl: call.protobufType,
+                  value: call.protobufPayload,
+                ),
               ),
+              authoring: nomos_protocol.AuthoringOptions(
+                actor: actor ?? '',
+                // Ordinary generated calls select a peer-runtime credential
+                // capability below. An explicit secret is a temporary operator
+                // compatibility lane and remains client-supplied until removed.
+                authorSecret: explicitSecret == null
+                    ? const <int>[]
+                    : base64Decode(explicitSecret),
+                deferProjection: true,
+                spans: true,
+              ),
+              controllerLawHash: domainHash,
+              conflictSnapshots: conflictSnapshots,
+              birthCertificate: birthCertificate,
             ),
-            authoring: nomos_protocol.AuthoringOptions(
-              actor: actor ?? '',
-              // Ordinary generated calls select a peer-runtime credential
-              // capability below. An explicit secret is a temporary operator
-              // compatibility lane and remains client-supplied until removed.
-              authorSecret: explicitSecret == null
-                  ? const <int>[]
-                  : base64Decode(explicitSecret),
-              deferProjection: true,
-              spans: true,
-            ),
-            controllerLawHash: domainHash,
-            conflictSnapshots: conflictSnapshots,
-            birthCertificate: birthCertificate,
           ),
-        ),
-        credentialUse: credentialUse,
-      );
+          credentialUse: credentialUse,
+        );
+      } finally {
+        plane._writeObservers.remove(requestId);
+        observer?.call(const NomosWriteProgress(NomosWritePhase.running));
+      }
     }
 
     var response = await attempt();

package/dart/lib/src/runner/node-entry.mjs

@@ -5995,7 +5995,7 @@ var CustodyBreakPolicySchema = /* @__PURE__ */ enumDesc(file_nomos_runtime_v2_re
 var CustodyBreakPolicy = /* @__PURE__ */ tsEnum(CustodyBreakPolicySchema);
 
 // ../../adapter/proto/nomos/runtime/v2/observability_desk_pb.js
-var file_nomos_runtime_v2_observability_desk = /* @__PURE__ */ fileDesc("Cilub21vcy9ydW50aW1lL3YyL29ic2VydmFiaWxpdHlfZGVzay5wcm90bxIQbm9tb3MucnVudGltZS52MiJCCgxUcmFjZUNvbnRleHQSEAoIdHJhY2VfaWQYASABKAwSDwoHc3Bhbl9pZBgCIAEoDBIPCgdzYW1wbGVkGAMgASgIIp0CCg5SdW50aW1lRmFpbHVyZRIMCgRjb2RlGAEgASgJEg8KB21lc3NhZ2UYAiABKAkSEQoJY29tcG9uZW50GAMgASgJEhYKCXdvcmtzcGFjZRgEIAEoCUgAiAEBEhMKBmRvbWFpbhgFIAEoCUgBiAEBEhYKCWRpcmVjdGl2ZRgGIAEoCUgCiAEBEjkKCmF0dHJpYnV0ZXMYByADKAsyJS5ub21vcy5ydW50aW1lLnYyLkRpYWdub3N0aWNBdHRyaWJ1dGUSMgoEa2luZBgIIAEoDjIkLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZUZhaWx1cmVLaW5kQgwKCl93b3Jrc3BhY2VCCQoHX2RvbWFpbkIMCgpfZGlyZWN0aXZlIr4BChJSdW50aW1lVW5hdmFpbGFibGUSOgoGcmVhc29uGAEgASgOMioubm9tb3MucnVudGltZS52Mi5SdW50aW1lVW5hdmFpbGFibGVSZWFzb24SEQoJd29ya3NwYWNlGAIgASgJEhEKCXJldHJ5YWJsZRgDIAEoCBIfChJyZXRyeV9hZnRlcl9taWxsaXMYBCABKA1IAIgBARIOCgZkZXRhaWwYBSABKAlCFQoTX3JldHJ5X2FmdGVyX21pbGxpcyJ+Cg5SdW50aW1lUmVmdXNhbBI2CgZyZWFzb24YASABKA4yJi5ub21vcy5ydW50aW1lLnYyLlJ1bnRpbWVSZWZ1c2FsUmVhc29uEhEKCXdvcmtzcGFjZRgCIAEoCRIRCglyZXRyeWFibGUYAyABKAgSDgoGZGV0YWlsGAQgASgJIqUBChNEaWFnbm9zdGljQXR0cmlidXRlEgwKBG5hbWUYASABKAkSFgoMc3RyaW5nX3ZhbHVlGAIgASgJSAASFwoNaW50ZWdlcl92YWx1ZRgDIAEoEkgAEhYKDGRvdWJsZV92YWx1ZRgEIAEoAUgAEhcKDWJvb2xlYW5fdmFsdWUYBSABKAhIABIVCgtieXRlc192YWx1ZRgGIAEoDEgAQgcKBXZhbHVlIuMKCgxSdW50aW1lRXZlbnQSEAoIc2VxdWVuY2UYASABKAQSFAoHc2Vzc2lvbhgCIAEoCUgBiAEBEi8KBXJlYWR5GAogASgLMh4ubm9tb3MucnVudGltZS52Mi5SdW50aW1lUmVhZHlIABI3Cg13YXRjaF9jaGFuZ2VkGAsgASgLMh4ubm9tb3MucnVudGltZS52Mi5XYXRjaENoYW5nZWRIABI5Cg5zeW5jX2NvbXBsZXRlZBgMIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU3luY0NvbXBsZXRlZEgAEjUKDGxpbmtfY2hhbmdlZBgNIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuTGlua0NoYW5nZWRIABI5Cg5zaWduYWxfY2hhbmdlZBgOIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU2lnbmFsQ2hhbmdlZEgAEjsKD2N1c3RvZHlfY2hhbmdlZBgPIAEoCzIgLm5vbW9zLnJ1bnRpbWUudjIuQ3VzdG9keUNoYW5nZWRIABJCChNsb2NhbF93b3JrX3JlamVjdGVkGBAgASgLMiMubm9tb3MucnVudGltZS52Mi5Mb2NhbFdvcmtSZWplY3RlZEgAEjMKC2xhd19jaGFuZ2VkGBEgASgLMhwubm9tb3MucnVudGltZS52Mi5MYXdDaGFuZ2VkSAASQwoPa2VybmVsX3Byb2dyZXNzGBIgASgLMigubm9tb3MucnVudGltZS52Mi5LZXJuZWxQcm9ncmVzc09ic2VydmVkSAASLQoEc3BhbhgTIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZVNwYW5IABI/ChF0cmFuc2Zlcl9wcm9ncmVzcxgUIAEoCzIiLm5vbW9zLnJ1bnRpbWUudjIuVHJhbnNmZXJQcm9ncmVzc0gAEkkKFG1haW50ZW5hbmNlX3Byb2dyZXNzGBUgASgLMikubm9tb3MucnVudGltZS52Mi5SZWFkTWFpbnRlbmFuY2VQcm9ncmVzc0gAEjsKDXNvY2tldF9lZmZlY3QYFiABKAsyIi5ub21vcy5ydW50aW1lLnYyLlBlZXJTb2NrZXRFZmZlY3RIABJUChxjcmVkZW50aWFsX3JlZnJlc2hfcmVxdWVzdGVkGBcgASgLMiwubm9tb3MucnVudGltZS52Mi5DcmVkZW50aWFsUmVmcmVzaFJlcXVlc3RlZEgAElIKG3JlY2VpdmluZ19ncm91cF9jb252ZXJnZW5jZRgYIAEoCzIrLm5vbW9zLnJ1bnRpbWUudjIuUmVjZWl2aW5nR3JvdXBDb252ZXJnZW5jZUgAEkoKF21vZGVsX2Fkb3B0aW9uX3Byb2dyZXNzGBkgASgLMicubm9tb3MucnVudGltZS52Mi5Nb2RlbEFkb3B0aW9uUHJvZ3Jlc3NIABI7Cg9mb2xsb3dzX3N1bW1hcnkYGiABKAsyIC5ub21vcy5ydW50aW1lLnYyLkZvbGxvd3NTdW1tYXJ5SAASRAoUbG9jYWxfY29weV9wcmVzZXJ2ZWQYGyABKAsyJC5ub21vcy5ydW50aW1lLnYyLlByZXNlcnZlZExvY2FsQ29weUgAEk4KGWZvcmVpZ25fcGxhY2VtZW50X2lnbm9yZWQYHCABKAsyKS5ub21vcy5ydW50aW1lLnYyLkZvcmVpZ25QbGFjZW1lbnRJZ25vcmVkSAASQwoTYmluZGluZ19xdWFyYW50aW5lZBgdIAEoCzIkLm5vbW9zLnJ1bnRpbWUudjIuUXVhcmFudGluZWRCaW5kaW5nSABCBwoFZXZlbnRCCgoIX3Nlc3Npb24ivAEKDkZvbGxvd3NTdW1tYXJ5EhAKCGZvbGxvd2VkGAEgASgNEg8KB3NldHRsZWQYAiABKA0SDAoEbGl2ZRgDIAEoDRI3Cgp3b3Jrc3BhY2VzGAQgAygLMiMubm9tb3MucnVudGltZS52Mi5Gb2xsb3dPYnNlcnZhdGlvbhIkChdvYnNlcnZlZF9hdF91bml4X21pbGxpcxgFIAEoBEgAiAEBQhoKGF9vYnNlcnZlZF9hdF91bml4X21pbGxpcyLRAgoRRm9sbG93T2JzZXJ2YXRpb24SEQoJd29ya3NwYWNlGAEgASgJEjcKBXBoYXNlGAIgASgOMigubm9tb3MucnVudGltZS52Mi5Gb2xsb3dPYnNlcnZhdGlvblBoYXNlEgwKBGxpdmUYAyABKAgSEwoGZGV0YWlsGAQgASgJSACIAQESIQoUcmV0cnlfYXRfdW5peF9taWxsaXMYBSABKARIAYgBARIfChJkdWVfYXRfdW5peF9taWxsaXMYBiABKARIAogBARIUCgdhdHRlbXB0GAcgASgNSAOIAQESGgoNYWN0aXZlX2VmZmVjdBgIIAEoCUgEiAEBQgkKB19kZXRhaWxCFwoVX3JldHJ5X2F0X3VuaXhfbWlsbGlzQhUKE19kdWVfYXRfdW5peF9taWxsaXNCCgoIX2F0dGVtcHRCEAoOX2FjdGl2ZV9lZmZlY3QiVgoaQ3JlZGVudGlhbFJlZnJlc2hSZXF1ZXN0ZWQSOAoHcGVuZGluZxgBIAEoCzInLm5vbW9zLnJ1bnRpbWUudjIuQ29ycmVzcG9uZGVuY2VQZW5kaW5nIj4KDFJ1bnRpbWVSZWFkeRIXCg9ydW50aW1lX3ZlcnNpb24YASABKAkSFQoNa2VybmVsX3NoYTI1NhgCIAEoDCL8AQoMV2F0Y2hDaGFuZ2VkEhcKD3N1YnNjcmlwdGlvbl9pZBgBIAEoCRITCgtyZXN1bHRfdXNkYRgCIAEoDBI2CgdmYWlsdXJlGAMgASgLMiAubm9tb3MucnVudGltZS52Mi5SdW50aW1lRmFpbHVyZUgAiAEBEjUKEmFwcGxpY2F0aW9uX3Jlc3VsdBgEIAEoCzIULmdvb2dsZS5wcm90b2J1Zi5BbnlIAYgBARIaCg1pbnRlZ2VyX3ZhbHVlGAUgASgDSAKIAQFCCgoIX2ZhaWx1cmVCFQoTX2FwcGxpY2F0aW9uX3Jlc3VsdEIQCg5faW50ZWdlcl92YWx1ZSKcAQoNU3luY0NvbXBsZXRlZBIOCgZyZWFzb24YASABKAkSNwoGcmVzdWx0GAIgASgLMicubm9tb3MucnVudGltZS52Mi5TeW5jV29ya3NwYWNlUmVzcG9uc2USNgoHZmFpbHVyZRgDIAEoCzIgLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZUZhaWx1cmVIAIgBAUIKCghfZmFpbHVyZSI7CgtMaW5rQ2hhbmdlZBIsCgZzdGF0dXMYASABKA4yHC5ub21vcy5ydW50aW1lLnYyLkxpbmtTdGF0dXMiOAoNU2lnbmFsQ2hhbmdlZBIOCgZkb21haW4YASABKAkSFwoPcHJvamVjdGlvbl91c2RhGAIgASgMIlAKCkxhd0NoYW5nZWQSDgoGZG9tYWluGAEgASgJEhYKDnBhY2thZ2Vfc2hhMjU2GAIgASgJEhoKEmNvbXBhdGliaWxpdHlfdXNkYRgDIAEoDCLdAQoLUnVudGltZVNwYW4SEAoIdHJhY2VfaWQYASABKAwSDwoHc3Bhbl9pZBgCIAEoDBIbCg5wYXJlbnRfc3Bhbl9pZBgDIAEoDEgAiAEBEgwKBG5hbWUYBCABKAkSGgoSc3RhcnRlZF91bml4X25hbm9zGAUgASgEEhYKDmR1cmF0aW9uX25hbm9zGAYgASgEEjkKCmF0dHJpYnV0ZXMYByADKAsyJS5ub21vcy5ydW50aW1lLnYyLkRpYWdub3N0aWNBdHRyaWJ1dGVCEQoPX3BhcmVudF9zcGFuX2lkIuoBChZLZXJuZWxQcm9ncmVzc09ic2VydmVkEjkKCHNuYXBzaG90GAEgASgLMicubm9tb3Mua2VybmVsLnYxLktlcm5lbFByb2dyZXNzU25hcHNob3QSJAocaG9zdF9vYnNlcnZlZF9lbGFwc2VkX21pY3JvcxgCIAEoBBIqCiJob3N0X29ic2VydmVkX3BoYXNlX2VsYXBzZWRfbWljcm9zGAMgASgEEh4KFnByb2Nlc3NfcmVzaWRlbnRfYnl0ZXMYBCABKAQSIwobcHJvY2Vzc19wZWFrX3Jlc2lkZW50X2J5dGVzGAUgASgEIoIBChBUcmFuc2ZlclByb2dyZXNzEhYKDnJlY2VpdmVkX2J5dGVzGAEgASgEEhgKC3RvdGFsX2J5dGVzGAIgASgESACIAQESLAoEa2luZBgDIAEoDjIeLm5vbW9zLnJ1bnRpbWUudjIuVHJhbnNmZXJLaW5kQg4KDF90b3RhbF9ieXRlcyrKAQoSUnVudGltZUZhaWx1cmVLaW5kEiQKIFJVTlRJTUVfRkFJTFVSRV9LSU5EX1VOU1BFQ0lGSUVEEAASIQodUlVOVElNRV9GQUlMVVJFX0tJTkRfSU5URVJOQUwQARIhCh1SVU5USU1FX0ZBSUxVUkVfS0lORF9QUk9UT0NPTBACEiIKHlJVTlRJTUVfRkFJTFVSRV9LSU5EX0lOVEVHUklUWRADEiQKIFJVTlRJTUVfRkFJTFVSRV9LSU5EX1VOU1VQUE9SVEVEEAQqpwMKGFJ1bnRpbWVVbmF2YWlsYWJsZVJlYXNvbhIqCiZSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9VTlNQRUNJRklFRBAAEjIKLlJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1JFTU9URV9PTkxZX09GRkxJTkUQARIxCi1SVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9SRU1PVEVfVU5SRUFDSEFCTEUQAhItCilSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9SRU1PVEVfVElNRU9VVBADEjYKMlJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX0xPQ0FMX1JFUExJQ0FfTk9UX1JFQURZEAQSNQoxUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fQ1JFREVOVElBTF9VTkFWQUlMQUJMRRAFEjAKLFJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1dPUktTUEFDRV9PUEVOSU5HEAYSKAokUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fUEVFUl9CVVNZEAcq8AEKFFJ1bnRpbWVSZWZ1c2FsUmVhc29uEiYKIlJVTlRJTUVfUkVGVVNBTF9SRUFTT05fVU5TUEVDSUZJRUQQABItCilSVU5USU1FX1JFRlVTQUxfUkVBU09OX0lOVkFMSURfQ1JFREVOVElBTBABEigKJFJVTlRJTUVfUkVGVVNBTF9SRUFTT05fQUNDRVNTX0RFTklFRBACEisKJ1JVTlRJTUVfUkVGVVNBTF9SRUFTT05fUExBQ0VNRU5UX1BPTElDWRADEioKJlJVTlRJTUVfUkVGVVNBTF9SRUFTT05fU0VTU0lPTl9VTkJPVU5EEAQqlQQKFkZvbGxvd09ic2VydmF0aW9uUGhhc2USKAokRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX1VOU1BFQ0lGSUVEEAASJAogRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0RFU0lSRUQQARIgChxGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfRFVFEAISJAogRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX1JVTk5JTkcQAxIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfU0VUVExFRBAEEjAKLEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9BV0FJVElOR19ERVBFTkRFTkNZEAUSJAogRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX09GRkxJTkUQBhIvCitGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfSU5WQUxJRF9DUkVERU5USUFMEAcSJAogRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0JBQ0tPRkYQCBIsCihGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfUkVCT1JOX1JFTU9URUxZEAkSLAooRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX1JFUExBQ0lOR19MT0NBTBAKEjIKLkZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9MT0NBTF9DT1BZX1VOUkVBREFCTEUQCypXCgpMaW5rU3RhdHVzEhsKF0xJTktfU1RBVFVTX1VOU1BFQ0lGSUVEEAASFAoQTElOS19TVEFUVVNfT1BFThABEhYKEkxJTktfU1RBVFVTX0NMT1NFRBACKnYKDFRyYW5zZmVyS2luZBIdChlUUkFOU0ZFUl9LSU5EX1VOU1BFQ0lGSUVEEAASFwoTVFJBTlNGRVJfS0lORF9ERUxUQRABEhYKElRSQU5TRkVSX0tJTkRfRlVMTBACEhYKElRSQU5TRkVSX0tJTkRfUFVTSBADYgZwcm90bzM", [file_google_protobuf_any, file_nomos_kernel_v1_progress, file_nomos_runtime_v2_correspondence_desk, file_nomos_runtime_v2_custody_desk, file_nomos_runtime_v2_placement_desk, file_nomos_runtime_v2_maintenance_desk, file_nomos_runtime_v2_model_adoption_desk, file_nomos_runtime_v2_receiving_group_desk, file_nomos_runtime_v2_recovery_desk]);
+var file_nomos_runtime_v2_observability_desk = /* @__PURE__ */ fileDesc("Cilub21vcy9ydW50aW1lL3YyL29ic2VydmFiaWxpdHlfZGVzay5wcm90bxIQbm9tb3MucnVudGltZS52MiJCCgxUcmFjZUNvbnRleHQSEAoIdHJhY2VfaWQYASABKAwSDwoHc3Bhbl9pZBgCIAEoDBIPCgdzYW1wbGVkGAMgASgIIp0CCg5SdW50aW1lRmFpbHVyZRIMCgRjb2RlGAEgASgJEg8KB21lc3NhZ2UYAiABKAkSEQoJY29tcG9uZW50GAMgASgJEhYKCXdvcmtzcGFjZRgEIAEoCUgAiAEBEhMKBmRvbWFpbhgFIAEoCUgBiAEBEhYKCWRpcmVjdGl2ZRgGIAEoCUgCiAEBEjkKCmF0dHJpYnV0ZXMYByADKAsyJS5ub21vcy5ydW50aW1lLnYyLkRpYWdub3N0aWNBdHRyaWJ1dGUSMgoEa2luZBgIIAEoDjIkLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZUZhaWx1cmVLaW5kQgwKCl93b3Jrc3BhY2VCCQoHX2RvbWFpbkIMCgpfZGlyZWN0aXZlIr4BChJSdW50aW1lVW5hdmFpbGFibGUSOgoGcmVhc29uGAEgASgOMioubm9tb3MucnVudGltZS52Mi5SdW50aW1lVW5hdmFpbGFibGVSZWFzb24SEQoJd29ya3NwYWNlGAIgASgJEhEKCXJldHJ5YWJsZRgDIAEoCBIfChJyZXRyeV9hZnRlcl9taWxsaXMYBCABKA1IAIgBARIOCgZkZXRhaWwYBSABKAlCFQoTX3JldHJ5X2FmdGVyX21pbGxpcyJ+Cg5SdW50aW1lUmVmdXNhbBI2CgZyZWFzb24YASABKA4yJi5ub21vcy5ydW50aW1lLnYyLlJ1bnRpbWVSZWZ1c2FsUmVhc29uEhEKCXdvcmtzcGFjZRgCIAEoCRIRCglyZXRyeWFibGUYAyABKAgSDgoGZGV0YWlsGAQgASgJIqUBChNEaWFnbm9zdGljQXR0cmlidXRlEgwKBG5hbWUYASABKAkSFgoMc3RyaW5nX3ZhbHVlGAIgASgJSAASFwoNaW50ZWdlcl92YWx1ZRgDIAEoEkgAEhYKDGRvdWJsZV92YWx1ZRgEIAEoAUgAEhcKDWJvb2xlYW5fdmFsdWUYBSABKAhIABIVCgtieXRlc192YWx1ZRgGIAEoDEgAQgcKBXZhbHVlIqQLCgxSdW50aW1lRXZlbnQSEAoIc2VxdWVuY2UYASABKAQSFAoHc2Vzc2lvbhgCIAEoCUgBiAEBEi8KBXJlYWR5GAogASgLMh4ubm9tb3MucnVudGltZS52Mi5SdW50aW1lUmVhZHlIABI3Cg13YXRjaF9jaGFuZ2VkGAsgASgLMh4ubm9tb3MucnVudGltZS52Mi5XYXRjaENoYW5nZWRIABI5Cg5zeW5jX2NvbXBsZXRlZBgMIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU3luY0NvbXBsZXRlZEgAEjUKDGxpbmtfY2hhbmdlZBgNIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuTGlua0NoYW5nZWRIABI5Cg5zaWduYWxfY2hhbmdlZBgOIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU2lnbmFsQ2hhbmdlZEgAEjsKD2N1c3RvZHlfY2hhbmdlZBgPIAEoCzIgLm5vbW9zLnJ1bnRpbWUudjIuQ3VzdG9keUNoYW5nZWRIABJCChNsb2NhbF93b3JrX3JlamVjdGVkGBAgASgLMiMubm9tb3MucnVudGltZS52Mi5Mb2NhbFdvcmtSZWplY3RlZEgAEjMKC2xhd19jaGFuZ2VkGBEgASgLMhwubm9tb3MucnVudGltZS52Mi5MYXdDaGFuZ2VkSAASQwoPa2VybmVsX3Byb2dyZXNzGBIgASgLMigubm9tb3MucnVudGltZS52Mi5LZXJuZWxQcm9ncmVzc09ic2VydmVkSAASLQoEc3BhbhgTIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZVNwYW5IABI/ChF0cmFuc2Zlcl9wcm9ncmVzcxgUIAEoCzIiLm5vbW9zLnJ1bnRpbWUudjIuVHJhbnNmZXJQcm9ncmVzc0gAEkkKFG1haW50ZW5hbmNlX3Byb2dyZXNzGBUgASgLMikubm9tb3MucnVudGltZS52Mi5SZWFkTWFpbnRlbmFuY2VQcm9ncmVzc0gAEjsKDXNvY2tldF9lZmZlY3QYFiABKAsyIi5ub21vcy5ydW50aW1lLnYyLlBlZXJTb2NrZXRFZmZlY3RIABJUChxjcmVkZW50aWFsX3JlZnJlc2hfcmVxdWVzdGVkGBcgASgLMiwubm9tb3MucnVudGltZS52Mi5DcmVkZW50aWFsUmVmcmVzaFJlcXVlc3RlZEgAElIKG3JlY2VpdmluZ19ncm91cF9jb252ZXJnZW5jZRgYIAEoCzIrLm5vbW9zLnJ1bnRpbWUudjIuUmVjZWl2aW5nR3JvdXBDb252ZXJnZW5jZUgAEkoKF21vZGVsX2Fkb3B0aW9uX3Byb2dyZXNzGBkgASgLMicubm9tb3MucnVudGltZS52Mi5Nb2RlbEFkb3B0aW9uUHJvZ3Jlc3NIABI7Cg9mb2xsb3dzX3N1bW1hcnkYGiABKAsyIC5ub21vcy5ydW50aW1lLnYyLkZvbGxvd3NTdW1tYXJ5SAASRAoUbG9jYWxfY29weV9wcmVzZXJ2ZWQYGyABKAsyJC5ub21vcy5ydW50aW1lLnYyLlByZXNlcnZlZExvY2FsQ29weUgAEk4KGWZvcmVpZ25fcGxhY2VtZW50X2lnbm9yZWQYHCABKAsyKS5ub21vcy5ydW50aW1lLnYyLkZvcmVpZ25QbGFjZW1lbnRJZ25vcmVkSAASQwoTYmluZGluZ19xdWFyYW50aW5lZBgdIAEoCzIkLm5vbW9zLnJ1bnRpbWUudjIuUXVhcmFudGluZWRCaW5kaW5nSAASPwoRd3JpdGVfcHJlcGFyYXRpb24YHiABKAsyIi5ub21vcy5ydW50aW1lLnYyLldyaXRlUHJlcGFyYXRpb25IAEIHCgVldmVudEIKCghfc2Vzc2lvbiK8AQoORm9sbG93c1N1bW1hcnkSEAoIZm9sbG93ZWQYASABKA0SDwoHc2V0dGxlZBgCIAEoDRIMCgRsaXZlGAMgASgNEjcKCndvcmtzcGFjZXMYBCADKAsyIy5ub21vcy5ydW50aW1lLnYyLkZvbGxvd09ic2VydmF0aW9uEiQKF29ic2VydmVkX2F0X3VuaXhfbWlsbGlzGAUgASgESACIAQFCGgoYX29ic2VydmVkX2F0X3VuaXhfbWlsbGlzItECChFGb2xsb3dPYnNlcnZhdGlvbhIRCgl3b3Jrc3BhY2UYASABKAkSNwoFcGhhc2UYAiABKA4yKC5ub21vcy5ydW50aW1lLnYyLkZvbGxvd09ic2VydmF0aW9uUGhhc2USDAoEbGl2ZRgDIAEoCBITCgZkZXRhaWwYBCABKAlIAIgBARIhChRyZXRyeV9hdF91bml4X21pbGxpcxgFIAEoBEgBiAEBEh8KEmR1ZV9hdF91bml4X21pbGxpcxgGIAEoBEgCiAEBEhQKB2F0dGVtcHQYByABKA1IA4gBARIaCg1hY3RpdmVfZWZmZWN0GAggASgJSASIAQFCCQoHX2RldGFpbEIXChVfcmV0cnlfYXRfdW5peF9taWxsaXNCFQoTX2R1ZV9hdF91bml4X21pbGxpc0IKCghfYXR0ZW1wdEIQCg5fYWN0aXZlX2VmZmVjdCJWChpDcmVkZW50aWFsUmVmcmVzaFJlcXVlc3RlZBI4CgdwZW5kaW5nGAEgASgLMicubm9tb3MucnVudGltZS52Mi5Db3JyZXNwb25kZW5jZVBlbmRpbmciPgoMUnVudGltZVJlYWR5EhcKD3J1bnRpbWVfdmVyc2lvbhgBIAEoCRIVCg1rZXJuZWxfc2hhMjU2GAIgASgMIvwBCgxXYXRjaENoYW5nZWQSFwoPc3Vic2NyaXB0aW9uX2lkGAEgASgJEhMKC3Jlc3VsdF91c2RhGAIgASgMEjYKB2ZhaWx1cmUYAyABKAsyIC5ub21vcy5ydW50aW1lLnYyLlJ1bnRpbWVGYWlsdXJlSACIAQESNQoSYXBwbGljYXRpb25fcmVzdWx0GAQgASgLMhQuZ29vZ2xlLnByb3RvYnVmLkFueUgBiAEBEhoKDWludGVnZXJfdmFsdWUYBSABKANIAogBAUIKCghfZmFpbHVyZUIVChNfYXBwbGljYXRpb25fcmVzdWx0QhAKDl9pbnRlZ2VyX3ZhbHVlIpwBCg1TeW5jQ29tcGxldGVkEg4KBnJlYXNvbhgBIAEoCRI3CgZyZXN1bHQYAiABKAsyJy5ub21vcy5ydW50aW1lLnYyLlN5bmNXb3Jrc3BhY2VSZXNwb25zZRI2CgdmYWlsdXJlGAMgASgLMiAubm9tb3MucnVudGltZS52Mi5SdW50aW1lRmFpbHVyZUgAiAEBQgoKCF9mYWlsdXJlIjsKC0xpbmtDaGFuZ2VkEiwKBnN0YXR1cxgBIAEoDjIcLm5vbW9zLnJ1bnRpbWUudjIuTGlua1N0YXR1cyI4Cg1TaWduYWxDaGFuZ2VkEg4KBmRvbWFpbhgBIAEoCRIXCg9wcm9qZWN0aW9uX3VzZGEYAiABKAwiUAoKTGF3Q2hhbmdlZBIOCgZkb21haW4YASABKAkSFgoOcGFja2FnZV9zaGEyNTYYAiABKAkSGgoSY29tcGF0aWJpbGl0eV91c2RhGAMgASgMIt0BCgtSdW50aW1lU3BhbhIQCgh0cmFjZV9pZBgBIAEoDBIPCgdzcGFuX2lkGAIgASgMEhsKDnBhcmVudF9zcGFuX2lkGAMgASgMSACIAQESDAoEbmFtZRgEIAEoCRIaChJzdGFydGVkX3VuaXhfbmFub3MYBSABKAQSFgoOZHVyYXRpb25fbmFub3MYBiABKAQSOQoKYXR0cmlidXRlcxgHIAMoCzIlLm5vbW9zLnJ1bnRpbWUudjIuRGlhZ25vc3RpY0F0dHJpYnV0ZUIRCg9fcGFyZW50X3NwYW5faWQi6gEKFktlcm5lbFByb2dyZXNzT2JzZXJ2ZWQSOQoIc25hcHNob3QYASABKAsyJy5ub21vcy5rZXJuZWwudjEuS2VybmVsUHJvZ3Jlc3NTbmFwc2hvdBIkChxob3N0X29ic2VydmVkX2VsYXBzZWRfbWljcm9zGAIgASgEEioKImhvc3Rfb2JzZXJ2ZWRfcGhhc2VfZWxhcHNlZF9taWNyb3MYAyABKAQSHgoWcHJvY2Vzc19yZXNpZGVudF9ieXRlcxgEIAEoBBIjChtwcm9jZXNzX3BlYWtfcmVzaWRlbnRfYnl0ZXMYBSABKAQiggEKEFRyYW5zZmVyUHJvZ3Jlc3MSFgoOcmVjZWl2ZWRfYnl0ZXMYASABKAQSGAoLdG90YWxfYnl0ZXMYAiABKARIAIgBARIsCgRraW5kGAMgASgOMh4ubm9tb3MucnVudGltZS52Mi5UcmFuc2ZlcktpbmRCDgoMX3RvdGFsX2J5dGVzIjkKEFdyaXRlUHJlcGFyYXRpb24SEgoKcmVxdWVzdF9pZBgBIAEoCRIRCgl3b3Jrc3BhY2UYAiABKAkqygEKElJ1bnRpbWVGYWlsdXJlS2luZBIkCiBSVU5USU1FX0ZBSUxVUkVfS0lORF9VTlNQRUNJRklFRBAAEiEKHVJVTlRJTUVfRkFJTFVSRV9LSU5EX0lOVEVSTkFMEAESIQodUlVOVElNRV9GQUlMVVJFX0tJTkRfUFJPVE9DT0wQAhIiCh5SVU5USU1FX0ZBSUxVUkVfS0lORF9JTlRFR1JJVFkQAxIkCiBSVU5USU1FX0ZBSUxVUkVfS0lORF9VTlNVUFBPUlRFRBAEKqcDChhSdW50aW1lVW5hdmFpbGFibGVSZWFzb24SKgomUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fVU5TUEVDSUZJRUQQABIyCi5SVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9SRU1PVEVfT05MWV9PRkZMSU5FEAESMQotUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fUkVNT1RFX1VOUkVBQ0hBQkxFEAISLQopUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fUkVNT1RFX1RJTUVPVVQQAxI2CjJSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9MT0NBTF9SRVBMSUNBX05PVF9SRUFEWRAEEjUKMVJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX0NSRURFTlRJQUxfVU5BVkFJTEFCTEUQBRIwCixSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9XT1JLU1BBQ0VfT1BFTklORxAGEigKJFJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1BFRVJfQlVTWRAHKvABChRSdW50aW1lUmVmdXNhbFJlYXNvbhImCiJSVU5USU1FX1JFRlVTQUxfUkVBU09OX1VOU1BFQ0lGSUVEEAASLQopUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9JTlZBTElEX0NSRURFTlRJQUwQARIoCiRSVU5USU1FX1JFRlVTQUxfUkVBU09OX0FDQ0VTU19ERU5JRUQQAhIrCidSVU5USU1FX1JFRlVTQUxfUkVBU09OX1BMQUNFTUVOVF9QT0xJQ1kQAxIqCiZSVU5USU1FX1JFRlVTQUxfUkVBU09OX1NFU1NJT05fVU5CT1VORBAEKpUEChZGb2xsb3dPYnNlcnZhdGlvblBoYXNlEigKJEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9VTlNQRUNJRklFRBAAEiQKIEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9ERVNJUkVEEAESIAocRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0RVRRACEiQKIEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9SVU5OSU5HEAMSJAogRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX1NFVFRMRUQQBBIwCixGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfQVdBSVRJTkdfREVQRU5ERU5DWRAFEiQKIEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9PRkZMSU5FEAYSLworRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0lOVkFMSURfQ1JFREVOVElBTBAHEiQKIEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9CQUNLT0ZGEAgSLAooRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX1JFQk9STl9SRU1PVEVMWRAJEiwKKEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9SRVBMQUNJTkdfTE9DQUwQChIyCi5GT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfTE9DQUxfQ09QWV9VTlJFQURBQkxFEAsqVwoKTGlua1N0YXR1cxIbChdMSU5LX1NUQVRVU19VTlNQRUNJRklFRBAAEhQKEExJTktfU1RBVFVTX09QRU4QARIWChJMSU5LX1NUQVRVU19DTE9TRUQQAip2CgxUcmFuc2ZlcktpbmQSHQoZVFJBTlNGRVJfS0lORF9VTlNQRUNJRklFRBAAEhcKE1RSQU5TRkVSX0tJTkRfREVMVEEQARIWChJUUkFOU0ZFUl9LSU5EX0ZVTEwQAhIWChJUUkFOU0ZFUl9LSU5EX1BVU0gQA2IGcHJvdG8z", [file_google_protobuf_any, file_nomos_kernel_v1_progress, file_nomos_runtime_v2_correspondence_desk, file_nomos_runtime_v2_custody_desk, file_nomos_runtime_v2_placement_desk, file_nomos_runtime_v2_maintenance_desk, file_nomos_runtime_v2_model_adoption_desk, file_nomos_runtime_v2_receiving_group_desk, file_nomos_runtime_v2_recovery_desk]);
 var RuntimeFailureSchema = /* @__PURE__ */ messageDesc(file_nomos_runtime_v2_observability_desk, 1);
 var RuntimeUnavailableSchema = /* @__PURE__ */ messageDesc(file_nomos_runtime_v2_observability_desk, 2);
 var RuntimeRefusalSchema = /* @__PURE__ */ messageDesc(file_nomos_runtime_v2_observability_desk, 3);
@@ -6009,6 +6009,7 @@ var WatchChangedSchema = /* @__PURE__ */ messageDesc(file_nomos_runtime_v2_obser
 var SyncCompletedSchema = /* @__PURE__ */ messageDesc(file_nomos_runtime_v2_observability_desk, 11);
 var LinkChangedSchema = /* @__PURE__ */ messageDesc(file_nomos_runtime_v2_observability_desk, 12);
 var RuntimeSpanSchema = /* @__PURE__ */ messageDesc(file_nomos_runtime_v2_observability_desk, 15);
+var WritePreparationSchema = /* @__PURE__ */ messageDesc(file_nomos_runtime_v2_observability_desk, 18);
 var RuntimeFailureKindSchema = /* @__PURE__ */ enumDesc(file_nomos_runtime_v2_observability_desk, 0);
 var RuntimeFailureKind = /* @__PURE__ */ tsEnum(RuntimeFailureKindSchema);
 var RuntimeUnavailableReasonSchema = /* @__PURE__ */ enumDesc(file_nomos_runtime_v2_observability_desk, 1);
@@ -16356,6 +16357,18 @@ var CredentialSessions = class {
 // ../src/runtime/credential_recovery_desk.ts
 init_define_NOMOS_KERNEL_RELEASE();
 
+// ../src/runtime/credential_failure.ts
+init_define_NOMOS_KERNEL_RELEASE();
+function recoverableCredential(failure) {
+  return failure.code === "nomos.auth.token_expired" || failure.code === "nomos.auth.token_missing";
+}
+function syncNeedsCredentialRefresh(result, failure) {
+  if (failure !== void 0 && recoverableCredential(failure)) return true;
+  const offer = result?.offerReceipt?.outcome;
+  const pushNeedsRefresh = offer?.case === "failure" ? recoverableCredential(offer.value) : result?.pushError?.status === 401;
+  return pushNeedsRefresh || result?.discoveryError?.status === 401;
+}
+
 // ../src/runtime/credential_renewal.ts
 init_define_NOMOS_KERNEL_RELEASE();
 var RENEW_BEFORE_MILLIS = 5 * 6e4;
@@ -16621,7 +16634,7 @@ var CredentialRecoveryDesk = class {
     return false;
   }
   observeSync(session, event) {
-    if (!syncNeedsCredentialRefresh(event) || this.#tokenless(session)) return;
+    if (!syncNeedsCredentialRefresh(event.result, event.failure) || this.#tokenless(session)) return;
     this.#prune();
     const capability = this.#ports.capabilityFor(session);
     const existing = this.#active.get(capability);
@@ -16823,15 +16836,6 @@ var CredentialRecoveryDesk = class {
     this.#completed.clear();
   }
 };
-function recoverableCredential(failure) {
-  return failure.code === "nomos.auth.token_expired" || failure.code === "nomos.auth.token_missing";
-}
-function syncNeedsCredentialRefresh(event) {
-  const failures = [event.result?.pushError, event.result?.discoveryError];
-  if (failures.some((failure) => failure?.status === 401 || failure?.status === 403)) return true;
-  const text = `${event.failure?.message ?? ""} ${failures.map((failure) => failure?.message ?? "").join(" ")}`.toLowerCase();
-  return text.includes("unauthenticated") || text.includes("token expired") || text.includes("invalid token");
-}
 
 // ../src/runtime/device_identity_desk.ts
 init_define_NOMOS_KERNEL_RELEASE();
@@ -17750,6 +17754,7 @@ var ReceivingGroupDesk = class {
   #accounts = /* @__PURE__ */ new Map();
   /** D22: device key hash → the workspaces the console reported this key enrolled in (this process's memory, not truth). */
   #consoleEnrolments = /* @__PURE__ */ new Map();
+  #preparingWrites = /* @__PURE__ */ new Map();
   #sequence = 0;
   #internalRequestId = 30000000000n;
   constructor(ports) {
@@ -17789,16 +17794,124 @@ var ReceivingGroupDesk = class {
     if (head === account.observedHead) return;
     this.#tails.set(workspace, { ...account, inFlight: false, attempts: 0, notBefore: 0n });
   }
-  /** A refused nominal Home action can wait for framework recovery and retry once.
-   * Sealed/pending history is never re-signed, and no child is mistaken for Home. */
+  /** Only a proven non-admission can enter recovery. Console-enrolled children
+   * share the owning application's route, selected by credential capability and
+   * principal, never by workspace-name guessing or an unverified payload. */
   recoverOffer(request, response) {
-    if (!this.#ports.call || request.command.case !== "kernelCall" || request.command.value.credentialUse !== CredentialUse.SESSION || request.command.value.request?.operation.case !== "offer" || request.command.value.request.operation.value.intent.case !== "call" || response.outcome.case !== "failure" || !["nomos.authz.signer_enrollment_missing", "nomos.authz.device_key_revoked"].includes(response.outcome.value.code)) return;
+    if (!this.#ports.call || request.command.case !== "kernelCall" || request.command.value.credentialUse !== CredentialUse.SESSION || request.command.value.request?.operation.case !== "offer" || request.command.value.request.operation.value.intent.case !== "call") return;
+    const missing = response.outcome.case === "failure" ? response.outcome.value.code === "nomos.authz.signer_enrollment_missing" : response.outcome.case === "offer" && response.outcome.value.outcome.case === "refused" && response.outcome.value.outcome.value.refusal?.code === KernelRefusalCode.FORGED_PRINCIPAL && response.outcome.value.outcome.value.refusal.details?.fields.actor?.kind.case === "text" && response.outcome.value.outcome.value.refusal.details.fields.actor.kind.value === "unenrolled-signer-key";
+    const revoked = response.outcome.case === "failure" && response.outcome.value.code === "nomos.authz.device_key_revoked";
+    if (!missing && !revoked) return;
     const binding = this.#ports.binding(request.command.value.session);
-    const account = binding ? this.#accounts.get(binding.workspace) : void 0;
-    if (!account) return;
+    if (!binding) return;
+    const enrolled = [...this.#accounts.values()].find((account2) => {
+      const owner = this.#ports.binding(account2.session);
+      return account2.enrolment && owner?.credentialCapability === binding.credentialCapability && owner.principal === binding.principal;
+    });
     const copy3 = fromBinary(RuntimeRequestSchema, toBinary(RuntimeRequestSchema, request));
+    if (enrolled?.enrolment) {
+      if (revoked) return this.#writeRefused(binding.workspace, "This device's access has been revoked.");
+      return this.#begin(request, `enrolled-write-${++this.#sequence}`, (workId2) => this.#prepareEnrolledWrite(copy3, binding, enrolled.application, enrolled.enrolment, workId2));
+    }
+    const account = this.#accounts.get(binding.workspace);
+    if (!account) return;
     return this.#begin(request, `receiving-group-authoring-${++this.#sequence}`, (workId2) => this.#recoverOffer(copy3, response, account, workId2));
   }
+  #writeRefused(workspace, detail, reason = RuntimeRefusalReason.ACCESS_DENIED) {
+    return { case: "refused", value: create(RuntimeRefusalSchema, {
+      reason,
+      workspace,
+      retryable: false,
+      detail
+    }) };
+  }
+  #writeWaiting(workspace, detail) {
+    return { case: "unavailable", value: create(RuntimeUnavailableSchema, {
+      reason: RuntimeUnavailableReason.CREDENTIAL_UNAVAILABLE,
+      workspace,
+      retryable: true,
+      retryAfterMillis: 1e3,
+      detail
+    }) };
+  }
+  *#prepareEnrolledWrite(request, binding, application, route, workId2) {
+    if (request.command.case !== "kernelCall") throw new Error("write preparation lost its call");
+    const command = request.command.value;
+    const principal = binding.principal;
+    const unavailable = () => this.#writeWaiting(
+      binding.workspace,
+      "This device is still being prepared to save changes. Your change has not been saved. Try again when connected."
+    );
+    this.#ports.emit(binding.session, { case: "writePreparation", value: create(WritePreparationSchema, {
+      requestId: command.request.requestId,
+      workspace: binding.workspace
+    }) });
+    const key = JSON.stringify([binding.credentialCapability, principal, binding.workspace]);
+    const shared = this.#preparingWrites.get(key);
+    const deadline = this.#ports.clock.monotonicNanoseconds() + 30000000000n;
+    let wake = 0;
+    if (shared) {
+      while (!shared.settled) {
+        if (this.#ports.clock.monotonicNanoseconds() >= deadline) return unavailable();
+        const receipt = yield { case: "wake", value: create(PeerWakeEffectSchema, {
+          effectId: `${workId2}:join-${++wake}`,
+          delayMillis: 250
+        }) };
+        if (receipt.outcome.case !== "woken") return unavailable();
+      }
+      if (shared.result) return shared.result;
+    } else {
+      const preparation = { settled: false };
+      this.#preparingWrites.set(key, preparation);
+      try {
+        const secret = this.#ports.authorSecretIfPresent(binding.session);
+        if (!secret) return preparation.result = this.#writeRefused(binding.workspace, "Sign in again to set up this device.", RuntimeRefusalReason.INVALID_CREDENTIAL);
+        const keyHash = sha256Hex(this.#ports.deriveSigningPublicKey(secret));
+        let posture = this.#ports.posture(request, binding.session, principal, secret, false);
+        if (posture.deviceSignerStatus === DeviceSignerStatus.REVOKED) {
+          return preparation.result = this.#writeRefused(binding.workspace, "This device's access has been revoked.");
+        }
+        if (!posture.enrolledDevice || posture.deviceSignerStatus !== DeviceSignerStatus.ACTIVE) {
+          const enrolled = yield* this.#enrolAtConsole(
+            route,
+            binding,
+            `${application}|${principal}`,
+            principal,
+            keyHash,
+            [binding.workspace],
+            `${workId2}:console`
+          );
+          if (enrolled.case === "deferred") return preparation.result = enrolled.credentialRefused ? this.#writeRefused(binding.workspace, "Sign in again to set up this device.", RuntimeRefusalReason.INVALID_CREDENTIAL) : unavailable();
+          if (!(binding.workspace in enrolled.value.heads)) {
+            return preparation.result = this.#writeRefused(binding.workspace, "This device could not obtain access to save changes in this workspace.");
+          }
+          while (true) {
+            posture = this.#ports.posture(request, binding.session, principal, secret, false);
+            if (posture.deviceSignerStatus === DeviceSignerStatus.REVOKED) {
+              return preparation.result = this.#writeRefused(binding.workspace, "This device's access has been revoked.");
+            }
+            if (posture.enrolledDevice && posture.deviceSignerStatus === DeviceSignerStatus.ACTIVE) break;
+            if (this.#ports.clock.monotonicNanoseconds() >= deadline) return preparation.result = unavailable();
+            const receipt = yield { case: "wake", value: create(PeerWakeEffectSchema, {
+              effectId: `${workId2}:observe-${++wake}`,
+              delayMillis: 500
+            }) };
+            if (receipt.outcome.case !== "woken") return preparation.result = unavailable();
+          }
+        }
+      } catch (error) {
+        if (error instanceof ReceivingGroupRefusal) {
+          return preparation.result = this.#writeRefused(binding.workspace, "This device could not obtain access to save changes in this workspace.");
+        }
+        preparation.result = unavailable();
+        throw error;
+      } finally {
+        preparation.settled = true;
+        this.#preparingWrites.delete(key);
+      }
+    }
+    return { case: "retried", request, response: this.#ports.call(request, command) };
+  }
   *#recoverOffer(request, response, account, workId2) {
     const workspace = this.#ports.binding(account.session).workspace;
     const deadline = this.#ports.clock.monotonicNanoseconds() + 60000000000n;
@@ -17866,6 +17979,7 @@ var ReceivingGroupDesk = class {
     this.#opening.clear();
     this.#accounts.clear();
     this.#consoleEnrolments.clear();
+    this.#preparingWrites.clear();
   }
   #begin(request, workId2, procedure) {
     const held = {
@@ -21821,12 +21935,12 @@ var ReplicaFollowController = class {
       this.#desk.transition(result.workspace, { case: ReplicaFollowEventKind.WentOffline, nowUnixMillis });
       return delayUntilDue(this.#desk.get(result.workspace), nowUnixMillis);
     }
-    const credentialFailure = [result.pushError, result.discoveryError].find((failure) => failure?.status === 401 || failure?.status === 403);
-    if (credentialFailure) {
+    if (syncNeedsCredentialRefresh(result)) {
+      const offer = result.offerReceipt?.outcome;
       const transition = this.#desk.transition(result.workspace, {
         case: ReplicaFollowEventKind.CredentialRejected,
         nowUnixMillis,
-        failure: credentialFailure.message || `remote rejected credential with HTTP ${credentialFailure.status}`
+        failure: (offer?.case === "failure" ? offer.value.message : void 0) || result.pushError?.message || result.discoveryError?.message || "remote requires a refreshed credential"
       });
       if (transition.effects.some((effect) => effect.case === ReplicaFollowEffectKind.RefreshCredential)) {
         return 0;
@@ -30152,6 +30266,7 @@ var PeerOffice = class {
     return this.#responses.modelAdoption(request, step);
   }
   #receivingGroupResponse(request, step) {
+    if (step.case === "refused") return this.#response(request, { case: "refused", value: step.value });
     if (step.case === "retried") return this.#birthCustodyResponse(step.request, this.#birthCustody.afterKernelCall(step.request, step.response));
     if (step.case === "pending") return this.#response(request, { case: "correspondencePending", value: step.value });
     if (step.case === "failure") return this.#failure(request, step.code, step.message);

package/dart/lib/src/runtime_v2_gateway.dart

@@ -7,7 +7,6 @@ import 'package:nomos_types/nomos_kernel_protocol.dart' as nomos_protocol;
 import 'package:nomos_types/nomos_types.dart'
     show
         NomosErrorInfo,
-        NomosRefusalReason,
         NomosRefused,
         NomosRuntimeFailure,
         NomosRuntimeFailureKind,
@@ -46,27 +45,7 @@ final class NmsRuntimeV2Gateway {
       throw NomosUnavailable.fromRuntime(response.unavailable);
     }
     if (response.hasRefused()) {
-      final refused = response.refused;
-      throw NomosRefused(
-        reason: switch (refused.reason) {
-          nomos_protocol.RuntimeRefusalReason
-                .RUNTIME_REFUSAL_REASON_INVALID_CREDENTIAL =>
-            NomosRefusalReason.invalidCredential,
-          nomos_protocol
-                .RuntimeRefusalReason.RUNTIME_REFUSAL_REASON_ACCESS_DENIED =>
-            NomosRefusalReason.accessDenied,
-          nomos_protocol
-                .RuntimeRefusalReason.RUNTIME_REFUSAL_REASON_PLACEMENT_POLICY =>
-            NomosRefusalReason.placementPolicy,
-          nomos_protocol
-                .RuntimeRefusalReason.RUNTIME_REFUSAL_REASON_SESSION_UNBOUND =>
-            NomosRefusalReason.sessionUnbound,
-          _ => NomosRefusalReason.unknown,
-        },
-        workspace: refused.workspace,
-        retryable: refused.retryable,
-        detail: refused.detail,
-      );
+      throw NomosRefused.fromRuntime(response.refused);
     }
     if (response.hasFailure()) {
       final failure = response.failure;

package/dart/lib/src/runtime_v2_transport.dart

@@ -16,7 +16,8 @@ import 'package:nomos_peer_host/nomos_peer_host.dart'
         NomosProviderCredentialStore,
         NomosSignIn;
 import 'package:nomos_types/nomos_kernel_protocol.dart' as nomos_protocol;
-import 'package:nomos_types/nomos_types.dart' show NomosUnavailable;
+import 'package:nomos_types/nomos_types.dart'
+    show NomosUnavailable, NomosRefused;
 
 import 'console_enrolment.dart';
 import 'console_http_stub.dart' if (dart.library.io) 'console_http_io.dart'
@@ -648,6 +649,9 @@ mixin NomosRuntimeV2KernelCalls
     if (response.hasUnavailable()) {
       throw NomosUnavailable.fromRuntime(response.unavailable);
     }
+    if (response.hasRefused()) {
+      throw NomosRefused.fromRuntime(response.refused);
+    }
     if (!response.hasKernelCall()) {
       throw StateError(
         'Runtime v2 returned ${response.whichOutcome().name} for a kernel call',

package/dart/lib/src/write_progress.dart

@@ -0,0 +1,48 @@
+import 'dart:async';
+
+/// Presentation of one application action. Completion is the action's local
+/// result; remote durability remains on its existing operation receipt.
+enum NomosWritePhase { running, preparing, completed, failed }
+
+final class NomosWriteProgress {
+  const NomosWriteProgress(this.phase);
+  final NomosWritePhase phase;
+}
+
+/// Optional observation around a generated business action, including any
+/// prerequisite calls it makes. Ordinary unobserved calls recover identically.
+/// This holds no queue, credentials, authority or retry policy. It does not
+/// persist a pending action across process death or cancel an accepted write.
+abstract final class NomosWrite {
+  static final Object _observerKey = Object();
+
+  static Future<T> observe<T>(
+    Future<T> Function() action, {
+    required void Function(NomosWriteProgress) onProgress,
+  }) async {
+    void report(NomosWritePhase phase) {
+      try {
+        onProgress(NomosWriteProgress(phase));
+      } catch (_) {
+        // Presentation cannot change the operation's outcome.
+      }
+    }
+
+    report(NomosWritePhase.running);
+    try {
+      final result = await runZoned(action, zoneValues: {
+        _observerKey: (NomosWriteProgress progress) => report(progress.phase),
+      });
+      report(NomosWritePhase.completed);
+      return result;
+    } catch (_) {
+      report(NomosWritePhase.failed);
+      rethrow;
+    }
+  }
+
+  /// Framework projection seam. Capture before dispatch so an event delivered
+  /// outside the calling zone still reaches only its own action's observer.
+  static void Function(NomosWriteProgress)? captureObserver() =>
+      Zone.current[_observerKey] as void Function(NomosWriteProgress)?;
+}

package/dart/pubspec.lock

@@ -222,7 +222,7 @@ packages:
       path: "../dart_types"
       relative: true
     source: path
-    version: "0.11.2"
+    version: "0.11.3"
   package_config:
     dependency: "direct main"
     description:

package/dart/pubspec.yaml

@@ -7,7 +7,7 @@ repository: https://github.com/Captain-App/nomos2
 description: >-
   Nomos 2 Dart client — generated domain values, intent payloads and application
   lifecycle types over the typed Nomos kernel protocol and USDA custody model.
-version: 0.66.7
+version: 0.66.9
 
 environment:
   sdk: ^3.5.0
@@ -18,7 +18,7 @@ dependencies:
   # The pure-data core (wire types, offer codec, NomosReads, schema validation, error
   # info). nomos_client depends on and re-exports it, so existing imports are unchanged.
   # For local monorepo dev, pubspec_overrides.yaml points this at ../dart_types.
-  nomos_types: ^0.11.2
+  nomos_types: ^0.11.3
   fixnum: ^1.1.1
   json_schema: ^5.2.2
   crypto: ^3.0.0

package/dart/test/child_authentication_repair_test.dart

@@ -3,6 +3,7 @@ import 'dart:convert';
 import 'dart:typed_data';
 
 import 'package:nomos_client/src/nms_generated_runtime.dart';
+import 'package:nomos_client/src/write_progress.dart';
 import 'package:nomos_types/nomos_kernel_protocol.dart' as protocol;
 import 'package:test/test.dart';
 
@@ -22,6 +23,7 @@ final class _RepairTransport
   var syncCalls = 0;
   final syncSessions = <String>[];
   var offerCalls = 0;
+  Completer<void>? holdOffer;
   var expireNextSessionOffer = false;
   var refuseSignerEnrollmentOffers = 0;
   var refuseKernelSignerOffers = 0;
@@ -142,6 +144,14 @@ final class _RepairTransport
     }
     if (request.hasOffer()) {
       offerCalls += 1;
+      if (holdOffer != null) {
+        pushRuntime(protocol.RuntimeEvent(
+            writePreparation: protocol.WritePreparation(
+          requestId: request.requestId,
+          workspace: session,
+        )));
+        await holdOffer!.future;
+      }
       if (refuseKernelSignerOffers > 0) {
         refuseKernelSignerOffers -= 1;
         return protocol.CallResponse(
@@ -225,6 +235,42 @@ Future<DartReception> _connected(_RepairTransport transport) async {
 }
 
 void main() {
+  test('runtime preparation reaches only its pending generated action observer',
+      () async {
+    final transport = _RepairTransport()..holdOffer = Completer<void>();
+    final bridge = await _connected(transport);
+    addTearDown(bridge.dispose);
+    final phases = <NomosWritePhase>[];
+    final pending = NomosWrite.observe(
+        () => bridge
+            .session('estate-1')
+            .offerGeneratedCallOutcome(call: _estateCall()),
+        onProgress: (progress) => phases.add(progress.phase));
+    await Future<void>.delayed(Duration.zero);
+    expect(phases, [NomosWritePhase.running, NomosWritePhase.preparing]);
+    transport.pushRuntime(protocol.RuntimeEvent(
+        writePreparation: protocol.WritePreparation(
+      requestId: 'another-action',
+      workspace: 'estate-1',
+    )));
+    await Future<void>.delayed(Duration.zero);
+    expect(phases.length, 2);
+    final requestId = transport.lastCall!.requestId;
+    transport.holdOffer!.complete();
+    await pending;
+    expect(phases.last, NomosWritePhase.completed);
+    expect(transport.offerCalls, 1);
+    final completed = List<NomosWritePhase>.of(phases);
+    transport.pushRuntime(protocol.RuntimeEvent(
+        writePreparation: protocol.WritePreparation(
+      requestId: requestId,
+      workspace: 'estate-1',
+    )));
+    await Future<void>.delayed(Duration.zero);
+    expect(phases, completed,
+        reason: 'completed operations detach their observers');
+  });
+
   test('kernel unenrolled signer refusal repairs the child and retries once',
       () async {
     final transport = _RepairTransport()..refuseKernelSignerOffers = 1;

package/dart/test/runtime_v2_gateway_test.dart

@@ -30,6 +30,35 @@ final class _ScriptedKernelCalls extends _ScriptedRuntime
 }
 
 void main() {
+  test('a refused generated write preserves typed sign-in and access outcomes',
+      () async {
+    for (final reason in [
+      protocol.RuntimeRefusalReason.RUNTIME_REFUSAL_REASON_INVALID_CREDENTIAL,
+      protocol.RuntimeRefusalReason.RUNTIME_REFUSAL_REASON_ACCESS_DENIED,
+    ]) {
+      final runtime =
+          _ScriptedKernelCalls((request) => protocol.RuntimeResponse(
+                protocolVersion: 2,
+                requestId: request.requestId,
+                refused: protocol.RuntimeRefusal(
+                    reason: reason, workspace: 'estate', retryable: false),
+              ));
+      await expectLater(
+          runtime.callKernel(
+              session: 'estate',
+              request: protocol.CallRequest(),
+              credentialUse: protocol.CredentialUse.CREDENTIAL_USE_SESSION),
+          throwsA(isA<NomosRefused>().having(
+              (e) => e.reason,
+              'reason',
+              reason ==
+                      protocol.RuntimeRefusalReason
+                          .RUNTIME_REFUSAL_REASON_INVALID_CREDENTIAL
+                  ? NomosRefusalReason.invalidCredential
+                  : NomosRefusalReason.accessDenied)));
+    }
+  });
+
   test('a kernel call on a copy not ready yet is the typed wait reads sit out',
       () async {
     // A fresh device's first read of a workspace it is still fetching (node, web and in-app

package/dart/test/write_progress_test.dart

@@ -0,0 +1,56 @@
+import 'dart:async';
+import 'package:nomos_client/src/write_progress.dart';
+import 'package:test/test.dart';
+
+void main() {
+  test('observation spans prerequisites and preserves the result', () async {
+    final phases = <NomosWritePhase>[];
+    final result = await NomosWrite.observe(() async {
+      NomosWrite.captureObserver()!(
+          const NomosWriteProgress(NomosWritePhase.preparing));
+      await Future<void>.delayed(Duration.zero);
+      return 42;
+    }, onProgress: (p) => phases.add(p.phase));
+    expect(result, 42);
+    expect(phases, [
+      NomosWritePhase.running,
+      NomosWritePhase.preparing,
+      NomosWritePhase.completed
+    ]);
+    expect(NomosWrite.captureObserver(), isNull);
+  });
+  test('concurrent observers do not receive each other\'s progress', () async {
+    final first = <NomosWritePhase>[], second = <NomosWritePhase>[];
+    final gate = Completer<void>();
+    final one = NomosWrite.observe(() async {
+      final observer = NomosWrite.captureObserver()!;
+      await gate.future;
+      observer(const NomosWriteProgress(NomosWritePhase.preparing));
+    }, onProgress: (p) => first.add(p.phase));
+    await NomosWrite.observe(() async {},
+        onProgress: (p) => second.add(p.phase));
+    gate.complete();
+    await one;
+    expect(first, contains(NomosWritePhase.preparing));
+    expect(second, [NomosWritePhase.running, NomosWritePhase.completed]);
+  });
+  test('observer exceptions cannot reject or retry an action', () async {
+    var calls = 0;
+    expect(
+        await NomosWrite.observe(() async {
+          calls++;
+          return 7;
+        }, onProgress: (_) => throw StateError('widget gone')),
+        7);
+    expect(calls, 1);
+  });
+  test('typed failure is preserved without retry', () async {
+    final failure = StateError('refused');
+    final phases = <NomosWritePhase>[];
+    await expectLater(
+        NomosWrite.observe(() async => throw failure,
+            onProgress: (p) => phases.add(p.phase)),
+        throwsA(same(failure)));
+    expect(phases, [NomosWritePhase.running, NomosWritePhase.failed]);
+  });
+}

package/dart_types/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.11.3
+
+- Add the optional per-call write preparation observation.
+
 ## 0.11.2
 
 - Carry the current generated kernel and Runtime v2 Protobuf contracts used by the

package/dart_types/lib/src/proto/nomos/runtime/v2/observability_desk.pb.dart

@@ -617,6 +617,7 @@ enum RuntimeEvent_Event {
   localCopyPreserved,
   foreignPlacementIgnored,
   bindingQuarantined,
+  writePreparation,
   notSet
 }
 
@@ -644,6 +645,7 @@ class RuntimeEvent extends $pb.GeneratedMessage {
     $5.PreservedLocalCopy? localCopyPreserved,
     $6.ForeignPlacementIgnored? foreignPlacementIgnored,
     $6.QuarantinedBinding? bindingQuarantined,
+    WritePreparation? writePreparation,
   }) {
     final result = create();
     if (sequence != null) result.sequence = sequence;
@@ -675,6 +677,7 @@ class RuntimeEvent extends $pb.GeneratedMessage {
       result.foreignPlacementIgnored = foreignPlacementIgnored;
     if (bindingQuarantined != null)
       result.bindingQuarantined = bindingQuarantined;
+    if (writePreparation != null) result.writePreparation = writePreparation;
     return result;
   }
 
@@ -709,6 +712,7 @@ class RuntimeEvent extends $pb.GeneratedMessage {
     27: RuntimeEvent_Event.localCopyPreserved,
     28: RuntimeEvent_Event.foreignPlacementIgnored,
     29: RuntimeEvent_Event.bindingQuarantined,
+    30: RuntimeEvent_Event.writePreparation,
     0: RuntimeEvent_Event.notSet
   };
   static final $pb.BuilderInfo _i = $pb.BuilderInfo(
@@ -736,7 +740,8 @@ class RuntimeEvent extends $pb.GeneratedMessage {
       26,
       27,
       28,
-      29
+      29,
+      30
     ])
     ..a<$fixnum.Int64>(
         1, _omitFieldNames ? '' : 'sequence', $pb.PbFieldType.OU6,
@@ -789,6 +794,8 @@ class RuntimeEvent extends $pb.GeneratedMessage {
     ..aOM<$6.QuarantinedBinding>(
         29, _omitFieldNames ? '' : 'bindingQuarantined',
         subBuilder: $6.QuarantinedBinding.create)
+    ..aOM<WritePreparation>(30, _omitFieldNames ? '' : 'writePreparation',
+        subBuilder: WritePreparation.create)
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -830,6 +837,7 @@ class RuntimeEvent extends $pb.GeneratedMessage {
   @$pb.TagNumber(27)
   @$pb.TagNumber(28)
   @$pb.TagNumber(29)
+  @$pb.TagNumber(30)
   RuntimeEvent_Event whichEvent() => _RuntimeEvent_EventByTag[$_whichOneof(0)]!;
   @$pb.TagNumber(10)
   @$pb.TagNumber(11)
@@ -851,6 +859,7 @@ class RuntimeEvent extends $pb.GeneratedMessage {
   @$pb.TagNumber(27)
   @$pb.TagNumber(28)
   @$pb.TagNumber(29)
+  @$pb.TagNumber(30)
   void clearEvent() => $_clearField($_whichOneof(0));
 
   @$pb.TagNumber(1)
@@ -1099,6 +1108,17 @@ class RuntimeEvent extends $pb.GeneratedMessage {
   void clearBindingQuarantined() => $_clearField(29);
   @$pb.TagNumber(29)
   $6.QuarantinedBinding ensureBindingQuarantined() => $_ensure(21);
+
+  @$pb.TagNumber(30)
+  WritePreparation get writePreparation => $_getN(22);
+  @$pb.TagNumber(30)
+  set writePreparation(WritePreparation value) => $_setField(30, value);
+  @$pb.TagNumber(30)
+  $core.bool hasWritePreparation() => $_has(22);
+  @$pb.TagNumber(30)
+  void clearWritePreparation() => $_clearField(30);
+  @$pb.TagNumber(30)
+  WritePreparation ensureWritePreparation() => $_ensure(22);
 }
 
 /// Application-wide (no session): the replica follows this peer keeps up with in the background.
@@ -2225,6 +2245,75 @@ class TransferProgress extends $pb.GeneratedMessage {
   void clearKind() => $_clearField(3);
 }
 
+/// Transient observation for one refused, not-yet-admitted generated call. The
+/// office owns recovery; observing this event is never required for correctness.
+class WritePreparation extends $pb.GeneratedMessage {
+  factory WritePreparation({
+    $core.String? requestId,
+    $core.String? workspace,
+  }) {
+    final result = create();
+    if (requestId != null) result.requestId = requestId;
+    if (workspace != null) result.workspace = workspace;
+    return result;
+  }
+
+  WritePreparation._();
+
+  factory WritePreparation.fromBuffer($core.List<$core.int> data,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromBuffer(data, registry);
+  factory WritePreparation.fromJson($core.String json,
+          [$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
+      create()..mergeFromJson(json, registry);
+
+  static final $pb.BuilderInfo _i = $pb.BuilderInfo(
+      _omitMessageNames ? '' : 'WritePreparation',
+      package:
+          const $pb.PackageName(_omitMessageNames ? '' : 'nomos.runtime.v2'),
+      createEmptyInstance: create)
+    ..aOS(1, _omitFieldNames ? '' : 'requestId')
+    ..aOS(2, _omitFieldNames ? '' : 'workspace')
+    ..hasRequiredFields = false;
+
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  WritePreparation clone() => deepCopy();
+  @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
+  WritePreparation copyWith(void Function(WritePreparation) updates) =>
+      super.copyWith((message) => updates(message as WritePreparation))
+          as WritePreparation;
+
+  @$core.override
+  $pb.BuilderInfo get info_ => _i;
+
+  @$core.pragma('dart2js:noInline')
+  static WritePreparation create() => WritePreparation._();
+  @$core.override
+  WritePreparation createEmptyInstance() => create();
+  @$core.pragma('dart2js:noInline')
+  static WritePreparation getDefault() => _defaultInstance ??=
+      $pb.GeneratedMessage.$_defaultFor<WritePreparation>(create);
+  static WritePreparation? _defaultInstance;
+
+  @$pb.TagNumber(1)
+  $core.String get requestId => $_getSZ(0);
+  @$pb.TagNumber(1)
+  set requestId($core.String value) => $_setString(0, value);
+  @$pb.TagNumber(1)
+  $core.bool hasRequestId() => $_has(0);
+  @$pb.TagNumber(1)
+  void clearRequestId() => $_clearField(1);
+
+  @$pb.TagNumber(2)
+  $core.String get workspace => $_getSZ(1);
+  @$pb.TagNumber(2)
+  set workspace($core.String value) => $_setString(1, value);
+  @$pb.TagNumber(2)
+  $core.bool hasWorkspace() => $_has(1);
+  @$pb.TagNumber(2)
+  void clearWorkspace() => $_clearField(2);
+}
+
 const $core.bool _omitFieldNames =
     $core.bool.fromEnvironment('protobuf.omit_field_names');
 const $core.bool _omitMessageNames =

package/dart_types/lib/src/runtime_outcome.dart

@@ -6,9 +6,9 @@
 library;
 
 import 'proto/nomos/runtime/v2/observability_desk.pb.dart'
-    show RuntimeUnavailable;
+    show RuntimeUnavailable, RuntimeRefusal;
 import 'proto/nomos/runtime/v2/observability_desk.pbenum.dart'
-    show RuntimeUnavailableReason;
+    show RuntimeUnavailableReason, RuntimeRefusalReason;
 
 enum NomosUnavailableReason {
   remoteOnlyOffline,
@@ -39,35 +39,33 @@ final class NomosUnavailable implements Exception {
   final String detail;
 
   /// The one translation of the generated `unavailable` arm, for every transport.
-  factory NomosUnavailable.fromRuntime(RuntimeUnavailable unavailable) =>
-      NomosUnavailable(
-        reason: switch (unavailable.reason) {
-          RuntimeUnavailableReason
-                .RUNTIME_UNAVAILABLE_REASON_REMOTE_ONLY_OFFLINE =>
-            NomosUnavailableReason.remoteOnlyOffline,
-          RuntimeUnavailableReason
-                .RUNTIME_UNAVAILABLE_REASON_REMOTE_UNREACHABLE =>
-            NomosUnavailableReason.remoteUnreachable,
-          RuntimeUnavailableReason.RUNTIME_UNAVAILABLE_REASON_REMOTE_TIMEOUT =>
-            NomosUnavailableReason.remoteTimeout,
-          RuntimeUnavailableReason
-                .RUNTIME_UNAVAILABLE_REASON_LOCAL_REPLICA_NOT_READY =>
-            NomosUnavailableReason.localReplicaNotReady,
-          RuntimeUnavailableReason
-                .RUNTIME_UNAVAILABLE_REASON_CREDENTIAL_UNAVAILABLE =>
-            NomosUnavailableReason.credentialUnavailable,
-          RuntimeUnavailableReason
-                .RUNTIME_UNAVAILABLE_REASON_WORKSPACE_OPENING =>
-            NomosUnavailableReason.workspaceOpening,
-          _ => NomosUnavailableReason.unknown,
-        },
-        workspace: unavailable.workspace,
-        retryable: unavailable.retryable,
-        retryAfter: unavailable.hasRetryAfterMillis()
-            ? Duration(milliseconds: unavailable.retryAfterMillis)
-            : null,
-        detail: unavailable.detail,
-      );
+  factory NomosUnavailable.fromRuntime(
+    RuntimeUnavailable unavailable,
+  ) => NomosUnavailable(
+    reason: switch (unavailable.reason) {
+      RuntimeUnavailableReason.RUNTIME_UNAVAILABLE_REASON_REMOTE_ONLY_OFFLINE =>
+        NomosUnavailableReason.remoteOnlyOffline,
+      RuntimeUnavailableReason.RUNTIME_UNAVAILABLE_REASON_REMOTE_UNREACHABLE =>
+        NomosUnavailableReason.remoteUnreachable,
+      RuntimeUnavailableReason.RUNTIME_UNAVAILABLE_REASON_REMOTE_TIMEOUT =>
+        NomosUnavailableReason.remoteTimeout,
+      RuntimeUnavailableReason
+          .RUNTIME_UNAVAILABLE_REASON_LOCAL_REPLICA_NOT_READY =>
+        NomosUnavailableReason.localReplicaNotReady,
+      RuntimeUnavailableReason
+          .RUNTIME_UNAVAILABLE_REASON_CREDENTIAL_UNAVAILABLE =>
+        NomosUnavailableReason.credentialUnavailable,
+      RuntimeUnavailableReason.RUNTIME_UNAVAILABLE_REASON_WORKSPACE_OPENING =>
+        NomosUnavailableReason.workspaceOpening,
+      _ => NomosUnavailableReason.unknown,
+    },
+    workspace: unavailable.workspace,
+    retryable: unavailable.retryable,
+    retryAfter: unavailable.hasRetryAfterMillis()
+        ? Duration(milliseconds: unavailable.retryAfterMillis)
+        : null,
+    detail: unavailable.detail,
+  );
 
   @override
   String toString() =>
@@ -91,6 +89,23 @@ final class NomosRefused implements Exception {
     this.detail = '',
   });
 
+  factory NomosRefused.fromRuntime(RuntimeRefusal refused) => NomosRefused(
+    reason: switch (refused.reason) {
+      RuntimeRefusalReason.RUNTIME_REFUSAL_REASON_INVALID_CREDENTIAL =>
+        NomosRefusalReason.invalidCredential,
+      RuntimeRefusalReason.RUNTIME_REFUSAL_REASON_ACCESS_DENIED =>
+        NomosRefusalReason.accessDenied,
+      RuntimeRefusalReason.RUNTIME_REFUSAL_REASON_PLACEMENT_POLICY =>
+        NomosRefusalReason.placementPolicy,
+      RuntimeRefusalReason.RUNTIME_REFUSAL_REASON_SESSION_UNBOUND =>
+        NomosRefusalReason.sessionUnbound,
+      _ => NomosRefusalReason.unknown,
+    },
+    workspace: refused.workspace,
+    retryable: refused.retryable,
+    detail: refused.detail,
+  );
+
   final NomosRefusalReason reason;
   final String workspace;
   final bool retryable;

package/dart_types/pubspec.yaml

@@ -9,7 +9,7 @@ description: >-
   Pure kernel wire/data types for Nomos Dart frontends — no transport, no bridge,
   no runtime. Typed protobuf and USDA boundary values plus the offer codec,
   reactive read engine, schema validation, and data-only error/trace types.
-version: 0.11.2
+version: 0.11.3
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.111.0",
+  "version": "0.111.1",
   "type": "module",
   "sideEffects": false,
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
@@ -72,7 +72,7 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@githolon/runtime": "^0.111.0",
+    "@githolon/runtime": "^0.111.1",
     "@bufbuild/protobuf": "^2.13.0",
     "@bufbuild/protoc-gen-es": "^2.13.0",
     "esbuild": "0.24.2",

package/src/codegen_dart_facade.ts

@@ -1906,6 +1906,7 @@ export function generateDartApplication(
   return [
     `// AUTO-GENERATED by nomos-compile — the tenant application surface for "${domain}".`,
     `// Business facts in, business records out. Runtime lifecycle is deliberately absent.`,
+    `export 'package:nomos_client/src/write_progress.dart' show NomosWrite, NomosWriteProgress, NomosWritePhase;`,
     ...((mod.workspaceInvariants ?? []).some(rule => rule.refusal) ? [
       `export 'package:nomos_types/nomos_types.dart' show AdmissionDecision, Admitted, DomainRefused, FrameworkRefused, UnsupportedRefusalContract, NomosDomainRefusalEvidence, KernelRefusalCode;`,
     ] : []),

package/src/compile_package_main.ts

@@ -2540,12 +2540,12 @@ const dartTypesImportFor = (generatedSource: string): string => {
  *  just the floor generated code needs — a lagging pin forces tenants into dependency_overrides. */
 // 0.3.0: SurfacedValue<T>/SurfacedObservation/PendingConflictRow — generated Surfaced-field typing +
 //        the pendingConflicts read rows.
-const NOMOS_TYPES_DEP = "^0.11.2";
+const NOMOS_TYPES_DEP = "^0.11.3";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.66.7";
-const NOMOS_FLUTTER_DEP = "^0.65.9";
+const NOMOS_CLIENT_DEP = "^0.66.9";
+const NOMOS_FLUTTER_DEP = "^0.65.13";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in the Dart and Flutter
 // package pubspecs — a release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).
@@ -3854,6 +3854,7 @@ function emitDartPackages(
     "",
     `export 'package:${packages.types}/${genRel}/${businessSharedFile}';`,
     `export 'package:nomos_client/src/workspace_open_progress.dart' show ApplicationWorkspaceOpenProgress;`,
+    `export 'package:nomos_client/src/write_progress.dart' show NomosWrite, NomosWriteProgress, NomosWritePhase;`,
     `export 'package:nomos_types/nomos_types.dart' show CustodyError, CustodyPhase, CustodySource, NomosRecommendedAction;`,
     ...tenantTypesExportKeys
       .map((file) => {