@githolon/dsl 0.117.0 → 0.119.9

package/compile_proof.mjs

@@ -94,6 +94,21 @@ function dependencyPackageFiles(dslDir, cwd) {
   return files;
 }
 
+function receptionRuntimeFiles(dslDir) {
+  // Reception's esbuild graph is loaded outside the compiler's TS import hooks.
+  // Match its compiler-owned resolution, rather than a caller's runtime package.
+  // Even tree-shaken protocol text affects esbuild's identifier frequencies.
+  try {
+    const request = createRequire(pathToFileURL(path.join(dslDir, "src", "reception_template.ts")));
+    const manifest = request.resolve("@githolon/runtime/package.json");
+    return [manifest, ...walk(path.join(path.dirname(manifest), "src"),
+      (file) => INPUT_EXTENSIONS.has(path.extname(file)))];
+  } catch {
+    // A removed dependency changes the inventory; the compiler reports its absence on a miss.
+    return [];
+  }
+}
+
 /**
  * The authored module a running compile imported, or undefined for compiler and dependency code.
  * A project may name modules outside its own directory (`../../domains/x.ts`); walking the project
@@ -141,6 +156,7 @@ export function compileInputs({ cwd, dslDir, configPath, argumentIdentity, impor
     path.join(dslDir, "operation_contract_check.mjs"),
     path.join(dslDir, "assets", "operation-contract.wasm"),
     ...dependencyPackageFiles(dslDir, cwd),
+    ...receptionRuntimeFiles(dslDir),
   ]);
   return {
     authoring,

package/dart/CHANGELOG.md

@@ -1,3 +1,48 @@
+## 0.70.10
+
+Deliver the shared runtime's owned, bounded pack import continuations and cancellation with the matching kernel protocol, preventing concurrent workspace acquisition from dropping an active import.
+
+- Release with the runtime whose held reads repay their own workspace's index first (CAP-890).
+
+- Release with the runtime whose local reads answer from the last-ready read index and type a successor-law refresh as a retryable unavailable (CAP-891).
+
+- Release with the runtime whose cold read-index rebuild keeps the last-ready frontier serving reads until the rebuilt index switches in (CAP-900).
+
+- A one-shot read whose workspace's read index is being rebuilt under the law its head just adopted waits for the rebuilt index (re-asking near the runtime's retryAfter) instead of throwing `NomosUnavailable(unknown, ...)`. On Jack's phone (1.66.17) `upsertUserEstateAccess` failed this way right after the Home pulled the 2026.10.2 law (CAP-900).
+
+- Release with the runtime whose checkpoint transfers are pipelined and run two at a time, with the checkpoint wait limit for remounts (CAP-901).
+
+- Reads never wait on the network (CAP-908). A one-shot application data read (rows, a page, by-id, by-type or spatial rows, a count, a sum, and their historic forms) of a workspace this device does not hold yet, is still opening, or is re-indexing under a law this app cannot decode, now answers at once: an empty result, with the session's `SyncStatus.localCopy` and `ApplicationStatus.localCopy` set to `LocalCopyReadiness.arriving` or `.updating` (`ApplicationStatus.localCopyArriving`, `localCopyUpdating`, `localCopyPending`). A read that answers sets it back to `ready`. A framework read with no empty form (child workspaces) reports the typed `NomosUnavailable` at once. `nmsUntilReplicaReady`, which re-asked such reads for up to 10 minutes, is gone. On Jack's iPhone (TestFlight 1334, 11 Oct 2026) a never-fetched data profile's read was held 11 s behind a full-panel spinner.
+- A watch on such a workspace emits the empty result and the status at once, then registers in the background (woken by the workspace's sync) and emits the rows; it stops re-asking as soon as the peer delivers its first result.
+
+- `LocalCopyReadiness.firstDownload` and `ApplicationStatus.localCopyFirstDownload` (CAP-913). A read of a workspace that has never been on this device answers empty at once, and says so: `firstDownload`, not merely `arriving`. Once the copy lands, the status is `arriving` while its indexes are prepared, then `ready` when a read answers from it. Admission's raw frontier index is built before the read model, so `ready` also means a write will not wait on an index. `localCopyArriving` stays true for both `firstDownload` and `arriving`. A write to such a workspace throws `NomosUnavailable(firstDownload)` at once, asked once.
+
+- `LocalCopyReadiness.repairing` (CAP-920): a workspace's copy on this device is damaged and being repaired (its local Git history is incomplete, it cannot be read, or it is being refetched). Derived from a read answering `localReplicaNotReady` with such a reason and from a sync round failing because a commit of the copy is unreadable; held per workspace until a read answers from the copy again or a refetch replaces it. `SyncStatus.repairingCopies` / `ApplicationStatus.repairingCopies` list every such workspace with when it was first seen, `ApplicationStatus.localCopyRepairing` says it of a session, and `ApplicationStatus.workspace` names a session's workspace. A completed sync round no longer resets a session's `localCopy`. Status only.
+
+## 0.70.9
+
+Carry the runtime and held-law checkpoint protocol alongside sibling law supply in the hosted-client composition.
+
+## 0.70.8
+
+- Refresh the bundled Peer Office runtime identity alongside the hosted SDK closure-hint release. Authority, signatures and runtime behavior are unchanged.
+
+## 0.70.7
+
+- Release the bundled peer runner alongside the fixed npm runtime release for held-unit source custody reads.
+
+## 0.70.6
+
+- Refresh the bundled peer runtime identity for the framework release that adds per-unit hosted Reception artifacts.
+
+## 0.70.5
+
+- Release the generated runner restaged with the CAP-888 compiler and CLI package versions.
+
+## 0.70.4
+
+- Refresh the bundled Node runner alongside the fixed npm-group release for deterministic compiler Reception encoding. Give the changed runner a new immutable client package version.
+
 ## 0.70.3
 
 Refresh the packaged Peer Office runner from the shared client source used by the hosted headless application client. The existing text-decoder BOM behavior is explicit; the kernel and Peer Office protocols are unchanged.

package/dart/lib/src/application_status.dart

@@ -1,4 +1,5 @@
-import 'sync_status_projection.dart' show WorkspaceFollowStatus;
+import 'sync_status_projection.dart'
+    show LocalCopyReadiness, UnsharedSyncWork, WorkspaceFollowStatus;
 
 /// Read-only presentation of one Peer Office workspace handle.
 enum ApplicationStatusPhase {
@@ -33,10 +34,64 @@ final class ApplicationStatus {
     this.preparingWorkspaces = 0,
     this.retryingWorkspaces = 0,
     this.preparationActivity,
+    this.localCopy = LocalCopyReadiness.ready,
+    this.repairingCopies = const {},
+    this.unsharedWork = const {},
+    this.workspace,
   });
 
+  /// Every workspace with sync work owed between this device and its server: changes made here
+  /// that have not reached it, or the server's changes not yet taken in here. A round that did
+  /// nothing does not clear it. Status only: a presentation never counts these as in sync, says
+  /// so calmly ("N changes on this device haven't reached the server yet — retrying"), and turns
+  /// to attention once one has been owed for a few minutes ([UnsharedSyncWork.since]).
+  final Map<String, UnsharedSyncWork> unsharedWork;
+
+  /// This session's own workspace has work owed to or from its server.
+  bool get hasUnsharedWork =>
+      workspace != null ? unsharedWork.containsKey(workspace) : unsharedWork.isNotEmpty;
+
+  /// The workspace a session's status describes; null on the application's own status.
+  final String? workspace;
+
   final ApplicationStatusPhase phase;
 
+  /// Whether this workspace's reads answer from a copy on this device. Reads never wait for a copy
+  /// to arrive: while it is [LocalCopyReadiness.arriving] or [LocalCopyReadiness.updating] they
+  /// answer empty at once and answer again (watches emit again) when it is here.
+  final LocalCopyReadiness localCopy;
+
+  /// This workspace is not readable on this device yet (its first download, or a copy here whose
+  /// indexes are still being prepared); its download runs in the background as the application's
+  /// own work. Its reads answered empty, not "none".
+  bool get localCopyArriving =>
+      localCopy == LocalCopyReadiness.arriving ||
+      localCopy == LocalCopyReadiness.firstDownload;
+
+  /// This workspace has never been on this device and its first download is under way: writes to
+  /// it are refused at once (NomosUnavailableReason.firstDownload). One-time per workspace per
+  /// device. Once the copy lands this is false, [localCopyArriving] stays true while its indexes are
+  /// prepared, and editing is ready when [localCopy] is [LocalCopyReadiness.ready].
+  bool get localCopyFirstDownload =>
+      localCopy == LocalCopyReadiness.firstDownload;
+
+  /// This workspace's copy is being re-indexed under a newer law; its reads answered empty for now.
+  bool get localCopyUpdating => localCopy == LocalCopyReadiness.updating;
+
+  /// Reads of this workspace answered empty because its copy is not readable here yet.
+  bool get localCopyPending => localCopy != LocalCopyReadiness.ready;
+
+  /// This workspace's copy on this device is damaged and being repaired (its local Git history is
+  /// incomplete, it cannot be read, or it is being refetched). You can look around what it shows;
+  /// writes to it cannot be admitted until it is repaired. Never "in sync", whatever its sync
+  /// rounds report.
+  bool get localCopyRepairing => localCopy == LocalCopyReadiness.repairing;
+
+  /// Every workspace whose copy on this device is damaged and being repaired, with when this peer
+  /// first saw it so (the same on the application's status and on each session's). Status only: a
+  /// presentation does not count these as in sync and holds editing back for them.
+  final Map<String, DateTime> repairingCopies;
+
   /// Null counts have not been reported by the runtime; they are not zero.
   final int? localChanges;
   final int? availableChanges;
@@ -76,5 +131,6 @@ final class ApplicationStatus {
   bool get isCurrent =>
       phase == ApplicationStatusPhase.current &&
       localChanges == 0 &&
-      availableChanges == 0;
+      availableChanges == 0 &&
+      !hasUnsharedWork;
 }

package/dart/lib/src/peer_application_streams.dart

@@ -15,6 +15,7 @@ abstract interface class NmsPeerApplicationStreams {
     String workspace,
   );
   Stream<void> get childWorkspaces;
+
   /// Any accepted local or remote change which may invalidate a generated
   /// application projection. Interpretation remains in generated law-aware code.
   Stream<void> get workspaceChanges;
@@ -31,17 +32,22 @@ final class NmsPeerApplicationStreamView implements NmsPeerApplicationStreams {
   const NmsPeerApplicationStreamView({
     required this.session,
     required this.statusProjection,
+    this.sessionStatusProjection,
     this.workspaceOpenProgressSource,
   });
 
   final NomosSession session;
   final ApplicationStatus Function(SyncStatus status) statusProjection;
+
+  /// The projection of this session's own status (it names the session's workspace); defaults to
+  /// [statusProjection].
+  final ApplicationStatus Function(SyncStatus status)? sessionStatusProjection;
   final Stream<ApplicationWorkspaceOpenProgress> Function(String workspace)?
       workspaceOpenProgressSource;
 
   @override
   Stream<ApplicationStatus> get status =>
-      session.syncStatus.map(statusProjection);
+      session.syncStatus.map(sessionStatusProjection ?? statusProjection);
 
   @override
   Stream<ApplicationStatus> get applicationStatus =>

package/dart/lib/src/reception/dart_reception.dart

@@ -68,7 +68,12 @@ import '../application_framework_calls.dart'
 import '../kernel_primitives.dart' show NmsKernelPrimitives;
 import '../nomos_trace.dart' show NomosTrace;
 import '../observed_session_directory.dart' show NmsObservedSessionDirectory;
-import '../replica_readiness.dart' show nmsUntilReplicaReady;
+import '../replica_readiness.dart'
+    show
+        NmsLocalCopyReport,
+        nmsPendingQueryResponse,
+        nmsPendingWatchChanged,
+        nmsReadNow;
 import '../rows_watch.dart' show NmsRowsMerge, nmsMergeRows;
 import '../operation_receipts.dart'
     show NmsOperationReceiptProjection, NomosOperationReceipt;
@@ -85,11 +90,17 @@ import 'progress_desk.dart'
 import '../signing_identity_kernel.dart' show NmsSigningIdentityKernel;
 import '../sync_status_reducer.dart';
 import '../sync_status_projection.dart'
-    show SyncPhase, SyncStatus, TransferProgress, WorkspaceFollowStatus;
+    show
+        LocalCopyReadiness,
+        SyncPhase,
+        SyncStatus,
+        TransferProgress,
+        WorkspaceFollowStatus;
 import '../typed_watch_registry.dart' show NmsTypedWatchHandle;
 
 export '../sync_status_projection.dart'
     show
+        LocalCopyReadiness,
         SyncPhase,
         SyncStatus,
         TransferProgress,
@@ -964,6 +975,28 @@ class DartReception {
         session,
         (current) => reduceSyncCompletion(current, completed, observedAt),
       );
+      // A round may "complete" over a damaged copy (nothing pulled, head unchanged) while its
+      // kernel cannot read a commit of it; that is reported as a separate failure. Either says
+      // the copy is being repaired, and a refetch that replaced it says it is repaired.
+      final syncStatuses = _eventPlane._events.syncStatuses;
+      final damaged = nmsDamagedCopyOf(completed, session: session);
+      if (damaged != null) {
+        syncStatuses.markRepairing(damaged, at: observedAt);
+      } else if (completed.hasResult() &&
+          completed.result.custodyReplaced &&
+          completed.result.workspace.isNotEmpty) {
+        syncStatuses.markRepaired(completed.result.workspace);
+      }
+      // Work a round leaves owed stays owed until a round shows progress (CAP-923).
+      if (!completed.hasFailure() && completed.hasResult()) {
+        final result = completed.result;
+        final workspace =
+            result.workspace.isNotEmpty ? result.workspace : session;
+        if (workspace != null) {
+          syncStatuses.observeRound(workspace, result,
+              at: observedAt, detail: nmsOwedWorkDetail(result));
+        }
+      }
       return;
     }
     if (event.hasLawChanged()) {
@@ -2136,12 +2169,13 @@ class DartReception {
   /// ledger's verified birth witnesses and lifecycle facts; tenant code only receives safe child links.
   ///
   /// On a cold mount the office answers "not ready yet" while it prepares the parent's birth
-  /// records (CAP-824); this waits that out like every other one-shot read, so a caller sees the
-  /// children or a real error, never an empty list that fills in by itself a moment later.
+  /// records (CAP-824). That answer is reported at once as the typed [NomosUnavailable], never
+  /// waited out and never an empty list: the children are not "none", they are not readable here
+  /// yet, and the session's [SyncStatus.localCopy] says so.
   Future<List<nomos_protocol.ChildWorkspace>> nomosFrameworkChildWorkspaces(
       {String? namespace}) async {
     final session = _runtimeSession();
-    final response = await nmsUntilReplicaReady(
+    final response = await nmsReadNow<nomos_protocol.RuntimeResponse>(
       () => _invokeRuntimeV2(
         nomos_protocol.RuntimeRequest(
           listChildWorkspaces: nomos_protocol.ListChildWorkspacesRequest(
@@ -2150,7 +2184,8 @@ class DartReception {
           ),
         ),
       ),
-      synced: _eventPlane._events.workspacesSynced,
+      pending: (_) => null,
+      report: _localCopyReport(session),
     );
     if (!response.hasChildWorkspaces()) {
       throw StateError(
@@ -2598,6 +2633,36 @@ class DartReception {
     );
   }
 
+  /// The empty answer of an application data read whose copy is not readable here yet (see
+  /// replica_readiness.dart), as the kernel call response the read decodes. Null when the query
+  /// has no empty form: the typed "not ready" is then reported as it is.
+  nomos_protocol.CallResponse? _pendingKernelCall(
+    nomos_protocol.QueryRequest query,
+  ) {
+    final empty = nmsPendingQueryResponse(query);
+    return empty == null ? null : nomos_protocol.CallResponse(query: empty);
+  }
+
+  /// Records what a read found of [session]'s local copy on its sync status, so the application's
+  /// status says "arriving" or "updating" while its reads answer empty, and "ready" once a read
+  /// answers from the copy. Only a change is pushed.
+  NmsLocalCopyReport _localCopyReport(String session) => (readiness) {
+        final projection = _eventPlane._events.syncStatuses;
+        // A session is pinned to its workspace by name. A damaged copy is recorded per workspace
+        // (it is held "repairing" until a read answers from it again); see markRepairing.
+        if (readiness == LocalCopyReadiness.repairing) {
+          projection.markRepairing(session);
+          return;
+        }
+        if (readiness == LocalCopyReadiness.ready)
+          projection.markRepaired(session);
+        if (projection.statusFor(session).localCopy == readiness) return;
+        _updateScopedStatus(
+          session,
+          (current) => current.copyWith(localCopy: readiness),
+        );
+      };
+
   Future<nomos_protocol.QueryResponse> _nmsKernelQuery({
     required String? session,
     required nomos_protocol.QueryAuthority authority,
@@ -2624,15 +2689,15 @@ class DartReception {
     // Correlation therefore belongs to the plane just like watches and legacy
     // reception calls. Keeping this counter on a child view lets two views mint
     // overlapping logical request identities despite sharing one executor.
-    // A copy still being fetched or opened answers "not ready yet": ask again
-    // rather than hand every caller a state that passes by itself.
+    // A copy not readable here yet answers at once: empty for an application data
+    // read, with the session's local copy reported arriving or updating, never a wait.
     final traceCall = NomosTrace.enabled ? NomosTrace.nextCall() : 0;
     final traceBegin = NomosTrace.enabled ? NomosTrace.now() : 0;
     if (NomosTrace.enabled) {
       NomosTrace.emit('dart', 'call.begin',
           'c=$traceCall op=${NomosTrace.describeCall(nomos_protocol.CallRequest(query: query))}');
     }
-    final response = await nmsUntilReplicaReady(
+    final response = await nmsReadNow<nomos_protocol.CallResponse>(
       () {
         final requestNumber = ++plane._sequences.request;
         if (NomosTrace.enabled) {
@@ -2656,7 +2721,8 @@ class DartReception {
           ),
         );
       },
-      synced: _eventPlane._events.workspacesSynced,
+      pending: (_) => _pendingKernelCall(query),
+      report: _localCopyReport(runtimeSession),
     );
     if (NomosTrace.enabled) {
       NomosTrace.emit(
@@ -2888,7 +2954,7 @@ class DartReception {
       ..authority = authority
       ..spans = true
       ..resultFormat = resultFormat;
-    final response = await nmsUntilReplicaReady(
+    final response = await nmsReadNow<nomos_protocol.RuntimeResponse>(
       () => _invokeRuntimeV2(
         nomos_protocol.RuntimeRequest(
           historicQuery: nomos_protocol.HistoricQueryRequest(
@@ -2898,7 +2964,16 @@ class DartReception {
           ),
         ),
       ),
-      synced: _eventPlane._events.workspacesSynced,
+      pending: (_) {
+        final empty = _pendingKernelCall(query);
+        return empty == null
+            ? null
+            : nomos_protocol.RuntimeResponse(
+                protocolVersion: 2,
+                kernelCall: empty,
+              );
+      },
+      report: _localCopyReport(runtimeSession),
     );
     if (response.hasFailure()) {
       throw StateError('${response.failure.code}: ${response.failure.message}');
@@ -3221,6 +3296,11 @@ class DartReception {
           : '',
       decode: decode,
       stop: _unwatch,
+      // A copy not readable here yet: the watch shows this empty answer at once and the
+      // session's local copy as arriving or updating, then its registration's first result.
+      pending: (subscriptionId) =>
+          nmsPendingWatchChanged(request, subscriptionId),
+      report: _localCopyReport(runtimeSession),
       start: (subscriptionId) async {
         final response = await _invokeRuntimeV2(
           nomos_protocol.RuntimeRequest(

package/dart/lib/src/reception/reception_session.dart

@@ -127,6 +127,8 @@ final class NmsReceptionSessionView implements NmsReceptionSession {
         streams = NmsPeerApplicationStreamView(
           session: desk,
           statusProjection: _applicationStatus,
+          sessionStatusProjection: (status) =>
+              _applicationStatus(status, workspace: desk.workspace),
           workspaceOpenProgressSource: watchOpenProgressCapability,
         );
 
@@ -143,7 +145,8 @@ final class NmsReceptionSessionView implements NmsReceptionSession {
   final Future<void> Function()? closeCapability;
 
   @override
-  ApplicationStatus get currentStatus => _applicationStatus(desk.currentStatus);
+  ApplicationStatus get currentStatus =>
+      _applicationStatus(desk.currentStatus, workspace: desk.workspace);
 
   @override
   Future<void> whenCurrent({required Duration timeout}) =>
@@ -237,7 +240,9 @@ final class NmsReceptionSessionView implements NmsReceptionSession {
   Future<void> close() => closeCapability?.call() ?? Future<void>.value();
 }
 
-ApplicationStatus _applicationStatus(SyncStatus status) => ApplicationStatus(
+ApplicationStatus _applicationStatus(SyncStatus status, {String? workspace}) =>
+    ApplicationStatus(
+      workspace: workspace,
       phase: switch (status.presentationPhase) {
         SyncPhase.checking => ApplicationStatusPhase.checking,
         SyncPhase.idle => ApplicationStatusPhase.current,
@@ -267,6 +272,9 @@ ApplicationStatus _applicationStatus(SyncStatus status) => ApplicationStatus(
       preparingWorkspaces: status.preparingWorkspaces,
       retryingWorkspaces: status.retryingWorkspaces,
       preparationActivity: status.preparationActivity,
+      localCopy: status.localCopy,
+      repairingCopies: status.repairingCopies,
+      unsharedWork: status.unsharedWork,
     );
 
 Future<void> _whenCurrent(DartReception application, Duration timeout) async {