@githolon/dsl 0.113.4 → 0.115.0

package/dart/pubspec.yaml

@@ -7,7 +7,7 @@ repository: https://github.com/Captain-App/nomos2
 description: >-
   Nomos 2 Dart client — generated domain values, intent payloads and application
   lifecycle types over the typed Nomos kernel protocol and USDA custody model.
-version: 0.67.2
+version: 0.69.0
 
 environment:
   sdk: ^3.5.0
@@ -18,7 +18,7 @@ dependencies:
   # The pure-data core (wire types, offer codec, NomosReads, schema validation, error
   # info). nomos_client depends on and re-exports it, so existing imports are unchanged.
   # For local monorepo dev, pubspec_overrides.yaml points this at ../dart_types.
-  nomos_types: ^0.12.0
+  nomos_types: ^0.14.0
   fixnum: ^1.1.1
   json_schema: ^5.2.2
   crypto: ^3.0.0

package/dart/test/background_model_adoption_test.dart

@@ -87,6 +87,7 @@ final class _BindingOffice
 }
 
 NomosApprovedModel _model([String digit = '1']) => NomosApprovedModel(
+    unitSet: 'a' * 64,
     lawSha256: digit * 64,
     reason: 'test release',
     domainKeys: const ['test'],

package/dart/test/console_enrolment_test.dart

@@ -1,9 +1,11 @@
+import 'dart:async';
 import 'dart:convert';
 import 'dart:io';
 import 'dart:typed_data';
 
 import 'package:fixnum/fixnum.dart';
 import 'package:nomos_client/src/console_enrolment.dart';
+import 'package:nomos_client/src/console_http_io.dart';
 import 'package:nomos_client/src/runtime_v2_transport.dart';
 import 'package:nomos_peer_host/nomos_peer_host.dart'
     show NomosDeviceIdentityStore, NomosProviderCredentialStore;
@@ -224,4 +226,49 @@ void main() {
     final receipt = await noKey.performConsoleEnrolment(effect);
     expect(receipt.failure.message, contains('no usable identity'));
   });
+
+  test(
+      'a console that does not answer is a bounded, retryable transport failure (CAP-807)',
+      () async {
+    // The default transport gives up on its own deadline instead of holding the write.
+    final silent = await ServerSocket.bind(InternetAddress.loopbackIPv4, 0);
+    final held = <Socket>[];
+    silent.listen(held.add);
+    try {
+      final started = DateTime.now();
+      await expectLater(
+          nomosDefaultConsolePost(
+              Uri.parse('http://127.0.0.1:${silent.port}/v1/enrol'), '{}',
+              timeout: const Duration(milliseconds: 300)),
+          throwsA(isA<TimeoutException>()));
+      expect(DateTime.now().difference(started).inSeconds, lessThan(5));
+    } finally {
+      for (final socket in held) {
+        socket.destroy();
+      }
+      await silent.close();
+    }
+    // The shell reports it typed, as a failure Peer Office asks again after.
+    final seed = Uint8List(32)..[0] = 7;
+    final platform = _Platform([])
+      ..registerDeviceIdentityStore(_Store({'device': seed}))
+      ..registerCredentialProvider(
+          capability: 'home',
+          cloud: 'x',
+          signIn: ({String? deviceChallenge}) async => 'token')
+      ..registerConsolePost(
+          (url, text) async => throw TimeoutException('slow'));
+    final receipt = await platform.performConsoleEnrolment(
+        p.PeerConsoleEnrolmentEffect(
+            effectId: 'e',
+            deviceIdentity: 'device',
+            capability: 'home',
+            console: 'http://console.test',
+            tenant: 't',
+            scope: 'user',
+            workspaces: ['estate-a']));
+    expect(receipt.hasFailure(), isTrue);
+    expect(receipt.failure.message,
+        'the console did not answer within 20 s; asking again');
+  });
 }

package/dart/test/custodian_warming_test.dart

@@ -0,0 +1,105 @@
+import 'package:fixnum/fixnum.dart' as fixnum;
+import 'package:nomos_client/src/sync_status_projection.dart';
+import 'package:nomos_client/src/sync_status_reducer.dart';
+import 'package:nomos_types/nomos_kernel_protocol.dart' as protocol;
+import 'package:test/test.dart';
+
+void main() {
+  final since = DateTime.utc(2026, 10, 4, 9);
+  protocol.FollowObservation backoff({protocol.CustodianWarming? warming}) =>
+      protocol.FollowObservation(
+        workspace: 'estate',
+        phase: protocol.FollowObservationPhase.FOLLOW_OBSERVATION_PHASE_BACKOFF,
+        detail: 'the custodian is opening this workspace from verified custody',
+        retryAtUnixMillis: fixnum.Int64(
+            since.add(const Duration(seconds: 3)).millisecondsSinceEpoch),
+        attempt: 1,
+        custodianWarming: warming,
+      );
+  protocol.CustodianWarming warming({bool stalled = false}) =>
+      protocol.CustodianWarming(
+        sinceUnixMillis: fixnum.Int64(since.millisecondsSinceEpoch),
+        expectedReadyUnixMillis: fixnum.Int64(
+            since.add(const Duration(seconds: 3)).millisecondsSinceEpoch),
+        stalledAfterUnixMillis: fixnum.Int64(
+            since.add(const Duration(seconds: 15)).millisecondsSinceEpoch),
+        stalled: stalled,
+      );
+
+  test('an opening answer is a warming posture with its expected-ready time',
+      () {
+    final status =
+        WorkspaceFollowStatus.fromRuntime(backoff(warming: warming()));
+    final posture = status.custodianWarming!;
+    expect(posture.since, since.toLocal());
+    expect(posture.expectedReadyAt,
+        since.add(const Duration(seconds: 3)).toLocal());
+    final now = since.add(const Duration(seconds: 1));
+    expect(posture.remaining(now), const Duration(seconds: 2));
+    expect(posture.elapsed(now), const Duration(seconds: 1));
+    expect(status.isWarming(now), isTrue);
+    expect(status.isWarmingStalled(now), isFalse);
+  });
+
+  test('an ordinary error retry carries no warming posture', () {
+    final status = WorkspaceFollowStatus.fromRuntime(backoff());
+    expect(status.phase, WorkspaceFollowPhase.backoff);
+    expect(status.custodianWarming, isNull);
+    expect(status.isWarming(since), isFalse);
+    expect(status.isWarmingStalled(since), isFalse);
+  });
+
+  test('warming past its bound is stalled, by the peer report or by the clock',
+      () {
+    final reported = WorkspaceFollowStatus.fromRuntime(
+        backoff(warming: warming(stalled: true)));
+    expect(reported.isWarmingStalled(since), isTrue);
+    expect(reported.isWarming(since), isFalse);
+
+    final quiet =
+        WorkspaceFollowStatus.fromRuntime(backoff(warming: warming()));
+    final late = since.add(const Duration(seconds: 16));
+    expect(quiet.isWarmingStalled(late), isTrue,
+        reason: 'a quiet report still escalates once the bound has passed');
+    expect(quiet.isWarming(late), isFalse);
+  });
+
+  test('a changed warming posture is a changed follow report', () {
+    final projection = NmsSyncStatusProjection();
+    final seen = <SyncStatus>[];
+    final subscription = projection.applicationStream.listen(seen.add);
+    addTearDown(subscription.cancel);
+    final plain = WorkspaceFollowStatus.fromRuntime(backoff());
+    final warm = WorkspaceFollowStatus.fromRuntime(backoff(warming: warming()));
+    projection.updateFollows(1, 0, statuses: [plain]);
+    projection.updateFollows(1, 0, statuses: [warm]);
+    final status = projection.applicationStatus;
+    expect(status.followStatuses.single.custodianWarming, isNotNull);
+    final now = since.add(const Duration(seconds: 1));
+    expect(status.warmingFollows(now).map((f) => f.workspace), ['estate']);
+    expect(status.stalledWarmingFollows(now), isEmpty);
+    expect(status.stalledWarmingFollows(since.add(const Duration(minutes: 1))),
+        hasLength(1));
+  });
+
+  test('a warming sync round is still owed: neither settled nor an error', () {
+    final at = DateTime.utc(2026, 10, 4);
+    for (final offering in [true, false]) {
+      final status = reduceSyncCompletion(
+        const SyncStatus(),
+        protocol.SyncCompleted(
+          result: protocol.SyncWorkspaceResponse(
+            workspace: 'estate',
+            currentHead: 'head',
+            directOfferDeferred: offering,
+            custodianWarmingRetryAfterMillis: 3000,
+          ),
+        ),
+        at,
+      );
+      expect(status.phase, SyncPhase.syncing);
+      expect(status.lastError, isNull);
+      expect(status.lastSyncedAt, isNull);
+    }
+  });
+}

package/dart/test/fixtures/offer_watch_order_peer.dart

@@ -0,0 +1,74 @@
+// A stand-in Node runner for own_offer_watch_order_test.dart. It speaks the runner's stdio framing
+// (`runtime-v2:` requests in, `runtime-v2-event:` events and `runtime-v2:` replies out) and answers a
+// local offer exactly as the Peer Office does since CAP-755: the change of the watch the offer
+// affected first, then the offer's reply, both in ONE stdout write so they share a chunk.
+import 'dart:convert';
+import 'dart:io';
+
+import 'package:nomos_types/nomos_kernel_protocol.dart' as p;
+import 'package:nomos_types/src/proto/google/protobuf/any.pb.dart' as protobuf;
+
+const _rows = 'type.nomos.dev/estate.CanvasRowsResult';
+
+void main() {
+  final subscriptions = <String>[];
+  var version = 0;
+  String position() => 'f$version';
+  stdin
+      .transform(utf8.decoder)
+      .transform(const LineSplitter())
+      .listen((line) {
+    if (!line.startsWith('runtime-v2:')) return;
+    final request = p.RuntimeRequest.fromBuffer(
+        base64Decode(line.substring('runtime-v2:'.length)));
+    final response =
+        p.RuntimeResponse(protocolVersion: 2, requestId: request.requestId);
+    final out = StringBuffer();
+    void event(p.WatchChanged changed) => out.writeln('runtime-v2-event:'
+        '${base64Encode(p.RuntimeEvent(watchChanged: changed).writeToBuffer())}');
+    if (request.hasWatch()) {
+      final id = request.watch.subscriptionId;
+      subscriptions.add(id);
+      event(p.WatchChanged(
+        subscriptionId: id,
+        applicationResult:
+            protobuf.Any(typeUrl: _rows, value: utf8.encode('row=v$version')),
+        resultFrontier: position(),
+      ));
+      response.watchStarted = p.WatchStarted(subscriptionId: id);
+    } else if (request.hasUnwatch()) {
+      subscriptions.remove(request.unwatch.subscriptionId);
+      response.watchStopped =
+          p.WatchStopped(subscriptionId: request.unwatch.subscriptionId);
+    } else if (request.hasCloseRealm()) {
+      response.realmClosed = p.RealmClosed();
+    } else if (request.hasKernelCall() &&
+        request.kernelCall.request.hasOffer()) {
+      final base = position();
+      version += 1;
+      for (final id in subscriptions) {
+        event(p.WatchChanged(
+          subscriptionId: id,
+          applicationDelta: p.ApplicationResultDelta(
+            baseFrontier: base,
+            frontier: position(),
+            changedRows: protobuf.Any(
+                typeUrl: _rows, value: utf8.encode('row=v$version')),
+          ),
+        ));
+      }
+      response.kernelCall = p.CallResponse(
+        protocolVersion: 1,
+        requestId: request.kernelCall.request.requestId,
+        offer: p.OfferResponse(
+            admitted: p.OfferAdmitted(head: 'head-$version')),
+      );
+    } else {
+      response.failure = p.RuntimeFailure(
+          code: 'test.unexpected',
+          message: 'unexpected ${request.whichCommand().name}');
+    }
+    out.writeln('runtime-v2:${base64Encode(response.writeToBuffer())}');
+    stdout.write(out.toString());
+  });
+}

package/dart/test/kernel_author_after_read_test.dart

@@ -23,6 +23,8 @@ import 'dart:math';
 import 'package:fixnum/fixnum.dart';
 
 import 'package:nomos_client/src/testing/test_peer.dart';
+import 'package:nomos_client/src/testing/test_peer_host.dart'
+    show NmsTestPeerHostKind;
 import 'package:nomos_types/nomos_kernel_protocol.dart' as nomos_protocol;
 import 'package:nomos_types/src/proto/google/protobuf/any.pb.dart'
     as google_protobuf;
@@ -62,6 +64,7 @@ void main() {
         fail('NOMOS_CANDIDATE_RUNTIME must point at a staged runtime');
       }
       final peer = await NmsTestPeer.start(
+        kind: NmsTestPeerHostKind.node,
         entry: await _testEntry(),
         runtimeDirectory: runtime,
         resolveFrom: Directory.current.path,
@@ -69,7 +72,7 @@ void main() {
       );
       addTearDown(peer.dispose);
 
-      final custodyDir = Directory('${peer.custody.directory.path}/custody');
+      final custodyDir = Directory('${peer.custodyDirectory.path}/custody');
       await custodyDir.create(recursive: true);
       for (final ws in [_workspace, _home]) {
         if (!Directory('$custodyRoot/holon-$ws.git').existsSync()) {
@@ -92,7 +95,7 @@ void main() {
 
       var sequence = 0;
       Future<nomos_protocol.CallResponse> describe(String session) =>
-          peer.transport.callKernel(
+          peer.host.kernelCalls.callKernel(
             session: session,
             request: nomos_protocol.CallRequest(
               protocolVersion: 1,
@@ -115,7 +118,7 @@ void main() {
           String typeUrl) async {
         final nomos_protocol.CallResponse offered;
         try {
-          offered = await peer.transport.callKernel(
+          offered = await peer.host.kernelCalls.callKernel(
             session: session,
             request: nomos_protocol.CallRequest(
               protocolVersion: 1,

package/dart/test/kernel_fence_test.dart

@@ -20,6 +20,8 @@ import 'dart:io';
 import 'dart:isolate';
 
 import 'package:nomos_client/src/testing/test_peer.dart';
+import 'package:nomos_client/src/testing/test_peer_host.dart'
+    show NmsTestPeerHostKind;
 import 'package:test/test.dart';
 
 Future<String> _testEntry() async {
@@ -68,6 +70,7 @@ void main() {
               .first;
 
       final peer = await NmsTestPeer.start(
+        kind: NmsTestPeerHostKind.node,
         entry: await _testEntry(),
         runtimeDirectory: runtime,
         resolveFrom: Directory.current.path,
@@ -75,7 +78,7 @@ void main() {
       );
       addTearDown(peer.dispose);
 
-      final custodyDir = Directory('${peer.custody.directory.path}/custody');
+      final custodyDir = Directory('${peer.custodyDirectory.path}/custody');
       await custodyDir.create(recursive: true);
       final answers = <String, Object?>{};
       for (final workspace in workspaces) {

package/dart/test/model_adoption_test.dart

@@ -11,9 +11,13 @@ import 'package:nomos_client/src/application_model_adoption.dart';
 import 'package:nomos_client/src/runtime_v2_transport.dart';
 import 'package:nomos_client/src/sync_status_projection.dart';
 import 'package:nomos_types/nomos_kernel_protocol.dart' as p;
+import 'package:nomos_types/nomos_types.dart' show NomosDomainRequirement;
 import 'package:test/test.dart';
 
 const lawSha = '5efef545fdadae764e29ba678833073e0245b1b76e315d3a5fe71c6a65240a45';
+/// The approved law (CAP-773): the unit set identity of the compiled units.
+const unitSet =
+    'a40efb425bc4de94dacaadfdff69633d300c8fb25a2701e78d592f9fab5e75cb';
 const otherSha =
     '48f3b1810000000000000000000000000000000000000000000000000000abcd';
 
@@ -30,6 +34,7 @@ class _Platform
 
 NomosApprovedModel model({List<String> keys = const ['home']}) =>
     NomosApprovedModel(
+      unitSet: unitSet,
       lawSha256: lawSha,
       reason: '2026-09-11: retire the value fields; decided by Jack',
       domainKeys: keys,
@@ -45,6 +50,15 @@ void main() {
       expect(model().domainKeys, ['home']);
       expect(
           () => NomosApprovedModel(
+              unitSet: 'not-a-hash',
+              lawSha256: lawSha,
+              reason: 'r',
+              domainKeys: const ['home'],
+              loadPackage: () async => Uint8List(0)),
+          throwsArgumentError);
+      expect(
+          () => NomosApprovedModel(
+              unitSet: unitSet,
               lawSha256: 'not-a-hash',
               reason: 'r',
               domainKeys: const ['home'],
@@ -52,6 +66,7 @@ void main() {
           throwsArgumentError);
       expect(
           () => NomosApprovedModel(
+              unitSet: unitSet,
               lawSha256: lawSha,
               reason: '   ',
               domainKeys: const ['home'],
@@ -59,6 +74,7 @@ void main() {
           throwsArgumentError);
       expect(
           () => NomosApprovedModel(
+              unitSet: unitSet,
               lawSha256: lawSha,
               reason: 'r',
               domainKeys: const [],
@@ -66,6 +82,7 @@ void main() {
           throwsArgumentError);
       expect(
           () => NomosApprovedModel(
+              unitSet: unitSet,
               lawSha256: lawSha,
               reason: 'r',
               domainKeys: const ['home', ' '],
@@ -73,6 +90,54 @@ void main() {
           throwsArgumentError);
     });
 
+    test('per-domain requirements (CAP-666) are optional, keyed and checked',
+        () {
+      expect(model().domainRequirements, isEmpty);
+      final pinned = NomosApprovedModel(
+          unitSet: unitSet,
+          lawSha256: lawSha,
+          reason: 'r',
+          domainKeys: const ['home'],
+          loadPackage: () async => Uint8List(0),
+          domainRequirements: {
+            'home': NomosDomainRequirement(
+                domainKey: 'home',
+                unitSha256: '3' * 64,
+                requirementSha256: '4' * 64),
+          });
+      expect(pinned.domainRequirements['home']!.unitSha256, '3' * 64);
+      expect(() => pinned.domainRequirements['x'] = pinned.domainRequirements['home']!,
+          throwsUnsupportedError);
+      expect(
+          () => NomosApprovedModel(
+              unitSet: unitSet,
+              lawSha256: lawSha,
+              reason: 'r',
+              domainKeys: const ['home'],
+              loadPackage: () async => Uint8List(0),
+              domainRequirements: {
+                'estate': NomosDomainRequirement(
+                    domainKey: 'home',
+                    unitSha256: '3' * 64,
+                    requirementSha256: '4' * 64),
+              }),
+          throwsArgumentError);
+      expect(
+          () => NomosApprovedModel(
+              unitSet: unitSet,
+              lawSha256: lawSha,
+              reason: 'r',
+              domainKeys: const ['home'],
+              loadPackage: () async => Uint8List(0),
+              domainRequirements: {
+                'home': NomosDomainRequirement(
+                    domainKey: 'home',
+                    unitSha256: 'nope',
+                    requirementSha256: '4' * 64),
+              }),
+          throwsArgumentError);
+    });
+
     test('its package source answers only the identity it was released with',
         () async {
       final source = NmsApprovedModelLawPackageSource(model());
@@ -109,6 +174,7 @@ void main() {
       final broken = _Platform()
         ..registerLawPackageSource(NmsApprovedModelLawPackageSource(
             NomosApprovedModel(
+                unitSet: unitSet,
                 lawSha256: lawSha,
                 reason: 'r',
                 domainKeys: const ['home'],

package/dart/test/nomos_trace_test.dart

@@ -0,0 +1,91 @@
+import 'dart:async';
+
+import 'package:fixnum/fixnum.dart' as fixnum;
+import 'package:nomos_client/src/nomos_trace.dart';
+import 'package:nomos_types/nomos_kernel_protocol.dart' as nomos_protocol;
+import 'package:nomos_types/src/proto/google/protobuf/any.pb.dart'
+    as google_protobuf;
+import 'package:test/test.dart';
+
+void main() {
+  test('the timeline is off unless NOMOS_TRACE is defined', () {
+    expect(NomosTrace.enabled, isFalse);
+  });
+
+  test('requests are described by operation kind, never by argument values',
+      () {
+    final offer = nomos_protocol.RuntimeRequest(
+      protocolVersion: 2,
+      requestId: fixnum.Int64(7),
+      kernelCall: nomos_protocol.KernelCallRequest(
+        session: 'estate-1',
+        request: nomos_protocol.CallRequest(
+          requestId: 'estate-1:offer:3',
+          offer: nomos_protocol.OfferRequest(
+            call: nomos_protocol.DirectiveCall(
+              domain: 'estate',
+              directive: 'placeAssetOnDrawing',
+              operation: google_protobuf.Any(
+                typeUrl: 'type.nomos.dev/secret',
+                value: [1, 2, 3],
+              ),
+            ),
+          ),
+        ),
+      ),
+    );
+    expect(NomosTrace.describeRequest(offer),
+        'kernelCall/offer:estate/placeAssetOnDrawing');
+    final watch = nomos_protocol.RuntimeRequest(
+      watch: nomos_protocol.WatchRequest(
+        query: nomos_protocol.QueryRequest(
+          rows: nomos_protocol.RowsQuery(id: 'assetsByAssetId'),
+        ),
+      ),
+    );
+    expect(
+        NomosTrace.describeRequest(watch), 'watch/query:rows:assetsByAssetId');
+    expect(
+      NomosTrace.describeCall(nomos_protocol.CallRequest(
+        query: nomos_protocol.QueryRequest(
+          byType: nomos_protocol.ByTypeQuery(aggregateType: 'estate.Asset'),
+        ),
+      )),
+      'query:byType:estate.Asset',
+    );
+  });
+
+  test('a sampled context carries no ids, so span ids stay request-derived',
+      () {
+    final context = NomosTrace.sampledContext();
+    expect(context.sampled, isTrue);
+    expect(context.traceId, isEmpty);
+    expect(context.spanId, isEmpty);
+  });
+
+  test('listener timing leaves the stream untouched while tracing is off',
+      () async {
+    final source = Stream<int>.fromIterable([1, 2, 3]);
+    expect(identical(NomosTrace.timedListener(source, 'q=x'), source), isTrue);
+  });
+
+  test('listener timing forwards every event and error when on', () async {
+    NomosTrace.enabled = true;
+    addTearDown(() => NomosTrace.enabled = false);
+    final controller = StreamController<int>();
+    final seen = <Object>[];
+    final done = Completer<void>();
+    NomosTrace.timedListener(controller.stream, 'q=x').listen(
+      seen.add,
+      onError: (Object error) => seen.add('error:$error'),
+      onDone: done.complete,
+    );
+    controller
+      ..add(1)
+      ..addError('boom')
+      ..add(2);
+    await controller.close();
+    await done.future;
+    expect(seen, [1, 'error:boom', 2]);
+  });
+}

package/dart/test/own_offer_watch_order_test.dart

@@ -0,0 +1,90 @@
+// CAP-755: a local offer's call returns only after its affected watches have delivered.
+//
+// The Peer Office queues the change of every watch a local offer affected before the offer's reply,
+// and the runner writes both to stdout in order, often in one chunk. Their Dart listeners run as
+// microtasks, so without care the awaiting caller could resume first and see its own offer missing
+// from the watch. This drives the real NodeRunnerTransport and DartReception rows watch against a
+// stand-in runner that writes the change and the reply in one stdout write.
+@TestOn('vm')
+library;
+
+import 'dart:async';
+import 'dart:convert';
+import 'dart:io';
+import 'dart:isolate';
+import 'dart:typed_data';
+
+import 'package:nomos_client/src/nms_generated_runtime.dart';
+import 'package:nomos_client/src/node_runner_transport.dart';
+import 'package:nomos_types/nomos_kernel_protocol.dart' as p;
+import 'package:test/test.dart';
+
+final _query = NmsInternalGeneratedQueries.create(
+  domain: 'estate',
+  query: 'canvasRows',
+  protobufType: 'type.nomos.dev/estate.CanvasRowsArgs',
+  protobufPayload: Uint8List.fromList([8, 1]),
+);
+
+Future<String> _fixture() async {
+  final library = await Isolate.resolvePackageUri(
+      Uri.parse('package:nomos_client/src/node_runner_transport.dart'));
+  // dsl/dart/lib/src/node_runner_transport.dart -> dsl/dart/test/fixtures/...
+  return library!
+      .resolve('../../test/fixtures/offer_watch_order_peer.dart')
+      .toFilePath();
+}
+
+void main() {
+  test('each local offer\'s watch change reaches its listener before the offer\'s call returns',
+      () async {
+    final transport = await NodeRunnerTransport.start(
+      entry: await _fixture(),
+      node: Platform.resolvedExecutable,
+    );
+    final reception = DartReception(transport);
+    addTearDown(() async {
+      await reception.dispose();
+      await transport.dispose();
+    });
+
+    final timeline = <String>[];
+    final first = Completer<void>();
+    final watch = reception
+        .session('estate')
+        .nmsWatchRows<String>(
+          _query,
+          decode: (result) => [utf8.decode(result.protobufPayload)],
+          idOf: (row) => row.split('=').first,
+        )
+        .listen((rows) {
+      timeline.add('watch ${rows.single}');
+      if (!first.isCompleted) first.complete();
+    });
+    addTearDown(watch.cancel);
+    await first.future.timeout(const Duration(seconds: 30));
+
+    // A group of sequential offers, as an application issues them: each awaits the last.
+    for (var offer = 1; offer <= 20; offer += 1) {
+      final reply = await transport.callKernel(
+        session: 'estate',
+        request: p.CallRequest(
+          protocolVersion: 1,
+          requestId: 'offer-$offer',
+          offer: p.OfferRequest(),
+        ),
+        credentialUse: p.CredentialUse.CREDENTIAL_USE_SESSION,
+      );
+      expect(reply.offer.hasAdmitted(), isTrue);
+      timeline.add('returned $offer');
+    }
+
+    expect(timeline, [
+      'watch row=v0',
+      for (var offer = 1; offer <= 20; offer += 1) ...[
+        'watch row=v$offer',
+        'returned $offer',
+      ],
+    ], reason: 'every offer\'s own change is delivered once, before its call returns');
+  }, timeout: const Timeout(Duration(minutes: 2)));
+}