@githolon/dsl 0.115.0 → 0.116.4

package/dart/CHANGELOG.md

@@ -1,3 +1,22 @@
+## 0.70.2
+
+- Carries the restaged peer runner for the native host 0.68.1 selection (CAP-874); its runtime identity moves with the runtime's patch release.
+
+## 0.70.1
+
+- Carries the 2026.10.2 runtime in the bundled Node peer (CAP-870, CAP-799, CAP-689): a copy whose saved bookmark is stale first asks its workspace's stream to level from its own head, so sync never re-lists history the custodian already holds; a complete custodian answers `off_main` at once for a head it does not hold, so a device with local work offers within seconds instead of a minute; kernel selection streams the download and times fetch, verify and store separately.
+
+## 0.70.0
+
+- `WorkspaceFollowPhase.kernelRefused`: the kernel refused the follow's last round at the same local head and remote frontier, so its sync is blocked. No timer re-runs it. It runs again on new local work, an upstream head change, a socket reopen, or a changed kernel or runtime. `retryAt` is set only once such an event has made the follow due, and `detail` carries the kernel's refusal. If you switch exhaustively over `WorkspaceFollowPhase`, add this case.
+
+- The bundled Node peer (`--discovery-provider`) keeps its last verified kernel selection under `<custody>/runtime/boot`. A restart while the channel is unreachable boots from it, with the attestation chain checked again (CAP-839).
+
+- Read results decode USDA strings with OpenUSD's escape rules (CAP-862): `\a \b \f \n \r \t \v`, `\xHH`, octal `\NNN`, and any other escaped character as itself. The legacy `\uXXXX` that older kernels wrote still decodes. A raw U+2028 or U+2029 inside a string value no longer fails the parse.
+- Generated Dart call encoders write controls as `\xHH` (U+0000–U+001F except the named escapes, and U+007F) and write C1 characters raw. They throw `ArgumentError` on a lone surrogate. Before, a lone surrogate was silently replaced in the UTF-8 bytes.
+
+- The generated runtime surface exports `NmsInternalValueIdentity`, which generated value-object `==` and `hashCode` now use (CAP-853).
+
 ## 0.69.0
 
 - The test cloud's partition proxy (`NomosTestCloud`) carries live sockets: each workspace's catch-up

package/dart/lib/src/nms_generated_runtime.dart

@@ -87,3 +87,4 @@ export 'runtime_v2_transport.dart'
 export 'reception/peer_office_connection.dart' show PeerOfficeConnection;
 
 export 'admission_decision.dart';
+export 'package:nomos_types/src/vo_canonical.dart' show NmsInternalValueIdentity;

package/dart/lib/src/result_usda.dart

@@ -331,9 +331,13 @@ final class NmsUsdaResult {
 abstract final class NmsUsdaLayer {
   static NmsUsdaPrim parse(Uint8List bytes) => _parseLayer(bytes);
 
+  /// The canonical USDA string literal (CAP-862), byte-identical with the kernel's
+  /// `usda_string.rs` and the generated call encoders: `\"` `\\` `\n` `\r` `\t` `\b` `\f`; any
+  /// other U+0000–U+001F and U+007F as `\xHH`; C1 and everything else raw. A lone surrogate is
+  /// refused rather than silently replaced in the UTF-8 bytes.
   static String quote(String value) {
     final out = StringBuffer('"');
-    for (final code in value.codeUnits) {
+    for (final code in value.runes) {
       switch (code) {
         case 0x22:
           out.write(r'\"');
@@ -350,9 +354,12 @@ abstract final class NmsUsdaLayer {
         case 0x0c:
           out.write(r'\f');
         default:
-          if (code < 0x20) {
-            out.write(r'\u');
-            out.write(code.toRadixString(16).padLeft(4, '0'));
+          if (code < 0x20 || code == 0x7f) {
+            out.write(r'\x');
+            out.write(code.toRadixString(16).padLeft(2, '0'));
+          } else if (code >= 0xd800 && code <= 0xdfff) {
+            throw ArgumentError.value(
+                value, 'value', 'Nomos USDA strings cannot carry a lone surrogate');
           } else {
             out.writeCharCode(code);
           }
@@ -361,6 +368,7 @@ abstract final class NmsUsdaLayer {
     out.write('"');
     return out.toString();
   }
+
 }
 
 NmsUsdaPrim _parseLayer(Uint8List bytes) {
@@ -406,6 +414,8 @@ NmsUsdaPrim _parseLayer(Uint8List bytes) {
     }
     final property = RegExp(
       r'^custom(?:\s+uniform)?\s+(?:rel|[A-Za-z0-9_\[\]]+)\s+([A-Za-z0-9_:]+)\s*=\s*(.+)$',
+      // A raw U+2028/U+2029 inside a string literal is value, not a line break.
+      dotAll: true,
     ).firstMatch(line);
     if (property != null) {
       if (stack.isEmpty)
@@ -439,48 +449,75 @@ Object _atom(String source) {
   throw FormatException('Unsupported USDA value $value');
 }
 
+/// Decodes one quoted USDA string with OpenUSD's escape rules (`TfEscapeString`): `\a \b \f \n \r
+/// \t \v`, `\x` with up to two hex digits, `\NNN` with up to three octal digits, and any other
+/// escaped character as itself. A LEGACY `\uXXXX` (written by pre-CAP-862 kernels; OpenUSD has no
+/// `\u`) reads as the scalar it names, as the kernel normalises it.
 String _unquote(String source) {
   if (source.length < 2 || !source.startsWith('"') || !source.endsWith('"')) {
     throw const FormatException('Invalid USDA string');
   }
+  final body = source.substring(1, source.length - 1);
   final out = StringBuffer();
-  for (var index = 1; index < source.length - 1; index++) {
-    final character = source[index];
+  int digitsAt(int start, int max, int radix) {
+    var count = 0;
+    while (count < max &&
+        start + count < body.length &&
+        int.tryParse(body[start + count], radix: radix) != null) {
+      count++;
+    }
+    return count;
+  }
+
+  for (var index = 0; index < body.length; index++) {
+    final character = body[index];
     if (character != r'\') {
       out.write(character);
       continue;
     }
-    if (++index >= source.length - 1) {
-      throw const FormatException('Truncated USDA escape');
-    }
-    final escaped = source[index];
+    if (++index >= body.length) break;
+    final escaped = body[index];
     switch (escaped) {
+      case 'a':
+        out.writeCharCode(0x07);
+      case 'b':
+        out.write('\b');
+      case 'f':
+        out.write('\f');
       case 'n':
         out.write('\n');
       case 'r':
         out.write('\r');
       case 't':
         out.write('\t');
-      case 'b':
-        out.write('\b');
-      case 'f':
-        out.write('\f');
-      case '"':
-        out.write('"');
-      case r'\':
-        out.write(r'\');
+      case 'v':
+        out.writeCharCode(0x0b);
+      case 'x':
+        final count = digitsAt(index + 1, 2, 16);
+        out.writeCharCode(count == 0
+            ? 0
+            : int.parse(body.substring(index + 1, index + 1 + count), radix: 16));
+        index += count;
       case 'u':
-        if (index + 4 >= source.length) {
-          throw const FormatException('Truncated USDA unicode escape');
+        final count = digitsAt(index + 1, 4, 16);
+        final code = count == 4
+            ? int.parse(body.substring(index + 1, index + 5), radix: 16)
+            : null;
+        if (code != null && (code < 0xd800 || code > 0xdfff)) {
+          out.writeCharCode(code);
+          index += 4;
+        } else {
+          out.write('u');
         }
-        final digits = source.substring(index + 1, index + 5);
-        final code = int.tryParse(digits, radix: 16);
-        if (code == null)
-          throw const FormatException('Invalid USDA unicode escape');
-        out.writeCharCode(code);
-        index += 4;
       default:
-        throw FormatException('Unsupported USDA escape $escaped');
+        if (escaped.codeUnitAt(0) >= 0x30 && escaped.codeUnitAt(0) <= 0x37) {
+          final count = digitsAt(index, 3, 8);
+          out.writeCharCode(
+              int.parse(body.substring(index, index + count), radix: 8));
+          index += count - 1;
+        } else {
+          out.write(escaped);
+        }
     }
   }
   return out.toString();