@githolon/dsl 0.14.0 → 0.15.0

package/dart/example/nomos_webview_transport.dart

@@ -15,8 +15,8 @@
 //   final bridge = NomosBridge(transport);
 //   await bridge.ready;                                       // resolves on the runner's {event:ready}
 //   await bridge.connect(cloud: 'https://nomos.captainapp.co.uk', workspace: myWs, clientId: deviceId);
-//   final head = await bridge.dispatch(domain: 'guestbook', directiveId: 'signGuestbook',
-//       payload: {'author': 'ada', 'message': 'hi', 'mood': 'delighted'}, domainHash: GUESTBOOK_DOMAIN_HASH);
+//   final app = GuestbookClient(bridge);
+//   final head = await app.signGuestbook(SignGuestbookPayload(author: 'ada', message: 'hi', mood: 'delighted'));
 //   final rows = await bridge.query('entriesByAuthor', {'author': 'ada'});
 //
 // (Put the runner bundle at `assets/nomos/nomos-runner.{html,js}` and declare it under `flutter: assets:`.)

package/dart/lib/nomos_dsl.dart

@@ -10,7 +10,7 @@
 ///  - The hand-written kernel WIRE types (`Value`, `Field`/`WireField`, `Hlc`,
 ///    `Op`, `FieldOp`, `Event`, `Schema`/`WireDriver`) — byte-compatible with
 ///    serde_json. See `src/wire.dart`, `src/driver.dart`.
-///  - The ONE write verb `dispatch(intent)` (`src/dispatch.dart`) + the typed
+///  - The ONE effectful write verb `offer(intent)` (`src/offer.dart`) + the typed
 ///    reactive read engine `NomosReads` (`src/subscriptions.dart`).
 ///  - The framework PRIMITIVES ONLY. The CODE-GENERATED per-domain types
 ///    (aggregates + public intent payloads + enums + `watch…` read accessors) NO LONGER
@@ -18,14 +18,14 @@
 ///    `co2_nomos_domains` (`ts_packages/co2-nomos-domains/dart/`), emitted there by
 ///    `ts_packages/co2-nomos-domains/src/emit_dart.ts`. Tenant domains squatting in
 ///    the framework package was the wrong topology; this barrel now exports ONLY the
-///    hand-written framework wire/dispatch/read/provider primitives. App code that
+///    hand-written framework wire/offer/read/provider primitives. App code that
 ///    wants the typed domain surface imports `package:co2_nomos_domains/co2_nomos_domains.dart`,
 ///    which re-exports this framework barrel PLUS every generated domain.
 library;
 
 export 'src/wire.dart';
 export 'src/driver.dart';
-export 'src/dispatch.dart';
+export 'src/offer.dart';
 export 'src/subscriptions.dart';
 export 'src/schema_validation.dart';
 // THE WEBVIEW BRIDGE (app-binding boundary) — the async Dart runtime that drives the REAL githolon running
@@ -33,7 +33,7 @@ export 'src/schema_validation.dart';
 export 'src/webview_bridge.dart';
 // The PROVIDER boundary (server-side capability-provider SDK runtime: TaskOutcome /
 // TaskSuccess / TaskFailure / TaskResult / TaskProvider / HostClock). The symmetric twin
-// of `dispatch.dart`; the generated per-task provider classes build on it.
+// of `offer.dart`; the generated per-task provider classes build on it.
 export 'src/provider.dart';
 
 // ── NO generated domains here ──────────────────────────────────────────────

package/dart/lib/src/{dispatch.dart → offer.dart}

@@ -5,19 +5,19 @@
 // wasm = determinism.  No native, no wasmtime, no 2nd artifact, no domain-JS on bare V8.
 // If a file isn't this / hosting this / authoring for this / proving this — it's gone.
 
-/// The ONE write verb: `dispatch(intent)`.
+/// The ONE effectful write verb: `offer(intent)`.
 ///
-/// END-STATE (the "dispatch(intent) purge", Jack 2026-06-01): app code's only
-/// write verb is `dispatch(intent)`. The frontend constructs ONLY a typed
+/// END-STATE (the "offer(intent) purge", Jack 2026-06-18): app code's only
+/// effectful write verb is `offer(intent)`. The frontend constructs ONLY a typed
 /// generated intent DTO (a [NomosIntent]) — it never hand-types an engine rule
-/// id, never builds an `Event`, never holds an `Hlc`. `dispatch` ships the
+/// id, never builds an `Event`, never holds an `Hlc`. `offer` ships the
 /// intent payload as DATA to the kernel's FRB `author(domain, directiveId, payloadJson,
 /// actor)`; the sealed engine runs the REAL `.plan()` and is the SOLE lowering
 /// authority (HLC + intent id are kernel-allocated host-side).
 ///
 /// This file is HAND-WRITTEN and domain-AGNOSTIC (declared ONCE, here): the
 /// generated per-domain intent classes `implements NomosIntent`, so a single
-/// generic `dispatch` covers every public intent of every domain — replacing the
+/// generic `offer` covers every public intent of every domain — replacing the
 /// ~63-method write façade.
 library;
 
@@ -39,7 +39,7 @@ abstract interface class NomosIntent {
 }
 
 /// The kernel write seam: the FRB `NomosClient.author` signature, as a function
-/// type. `dispatch` takes this (rather than importing the FRB client) so the
+/// type. `offer` takes this (rather than importing the FRB client) so the
 /// generated `nomos_dsl` package stays free of a `flutter_rust_bridge` dependency
 /// — the app threads `client.author` in. Returns the new HEAD commit oid (hex).
 typedef Authorer = String Function({
@@ -54,7 +54,7 @@ typedef Authorer = String Function({
 /// intent object — nothing is hand-typed. Builds NO `Event` and NO `Hlc`: the
 /// engine lowers. [actor] is the authenticated actor the caller threads from auth.
 /// Returns the new HEAD commit oid (hex).
-String dispatch(NomosIntent intent,
+String offer(NomosIntent intent,
         {required Authorer author, required String actor}) =>
     author(
       domain: intent.domain,

package/dart/lib/src/provider.dart

@@ -7,22 +7,22 @@
 
 /// The PROVIDER boundary: the typed server-side capability-provider SDK runtime.
 ///
-/// This is the SYMMETRIC TWIN of `dispatch.dart` (the peer write boundary). Where
-/// the peer authors an Order (`createTranscribeVoiceNote(...)` -> `dispatch`), a
+/// This is the SYMMETRIC TWIN of `offer.dart` (the peer write boundary). Where
+/// the peer authors an Obligation (`createTranscribeVoiceNote(...)` -> `offer`), a
 /// PROVIDER (Whisper, a renderer, a multi-target PR transporter) is the
-/// other end of the framework `impureCapability` Order→Receipt pair: it WATCHES `requested`
+/// other end of the framework `impureCapability` Obligation→Receipt pair: it WATCHES `requested`
 /// task rows, performs the impure side-effect OUTSIDE the fold, and authors the RECEIPT
 /// (`complete…`/`fail…`/`block…`/`deadLetter…`) back through the SAME write path. The receipt is an ordinary
 /// intent — the provider is a Nomos author, NOT a bypass (ONE-WRITE-PATH).
-/// Order and Receipt are intent roles, not provider-owned jobs or privileged server
+/// Obligation and Receipt are intent roles, not provider-owned jobs or privileged server
 /// mutation channels.
 ///
 /// PRINCIPLE (Jack 2026-06-04): code is ~free; INTEGRATION POINTS are expensive +
 /// fuckup-guaranteed. So the generated provider SDK is fully TYPED to the boundary —
-/// the dev writes a typed `handler(Order) -> Result | Failure | Blocked | DeadLetter`; the generated
-/// dispatcher DECODES the incoming Order JSON into the typed Order and ENCODES the typed
+/// the dev writes a typed `handler(Obligation) -> Result | Failure | Blocked | DeadLetter`; the generated
+/// dispatcher DECODES the incoming Obligation JSON into the typed Obligation and ENCODES the typed
 /// outcome into the ordinary Receipt intent. NO dynamic / `Map<String, dynamic>` / raw-JSON leaks
-/// into the dev-facing API; the types stop ONLY at the actual JSON serde (`handleOrder`).
+/// into the dev-facing API; the types stop ONLY at the actual JSON serde (`handleObligation`).
 ///
 /// This file is HAND-WRITTEN and domain-AGNOSTIC (declared ONCE, here): the generated
 /// per-task provider classes build on these interfaces, so the round-trip mechanism is
@@ -31,9 +31,9 @@ library;
 
 import 'dart:convert';
 
-import 'dispatch.dart' show NomosIntent;
+import 'offer.dart' show NomosIntent;
 
-/// The typed OUTCOME a provider handler returns for one Order: success, failure, blocked,
+/// The typed OUTCOME a provider handler returns for one Obligation: success, failure, blocked,
 /// or dead-lettered.
 /// SEALED so a generated dispatcher's `switch` is EXHAUSTIVE — a new outcome variant is
 /// a compile error at every dispatcher, never a silent fall-through. The mirror of the
@@ -44,7 +44,7 @@ sealed class TaskOutcome<R> {
 
 /// The SUCCESS outcome: the typed [result] the handler produced. The generated
 /// dispatcher maps this → the `complete…` Receipt directive (status:completed +
-/// resultRef + closesOrder).
+/// resultRef + closesObligation).
 final class TaskSuccess<R> extends TaskOutcome<R> {
   /// The typed result the handler produced (e.g. a transcription's `resultRef`).
   final R result;
@@ -53,7 +53,7 @@ final class TaskSuccess<R> extends TaskOutcome<R> {
 
 /// The FAILURE outcome: the [failureReason] the handler recorded. The generated
 /// dispatcher maps this → the `fail…` Receipt directive (status:failed + failureReason +
-/// closesOrder). A recorded failure is the terminal state — NOT a retry storm
+/// closesObligation). A recorded failure is the terminal state — NOT a retry storm
 /// (conformance X1's "declined is recorded" discipline at the task scale).
 final class TaskFailure<R> extends TaskOutcome<R> {
   /// Why the side-effect failed (recorded onto the task, never re-thrown into the fold).
@@ -63,13 +63,13 @@ final class TaskFailure<R> extends TaskOutcome<R> {
 
 /// The BLOCKED outcome: the provider cannot proceed until an external condition changes.
 /// The generated dispatcher maps this -> the `block...` Receipt directive
-/// (status:blocked + blockedReason + nextAction + closesOrder). This is terminal for this
-/// order; recovery is a fresh explicit Order after the next action is satisfied.
+/// (status:blocked + blockedReason + nextAction + closesObligation). This is terminal for this
+/// obligation; recovery is a fresh explicit Obligation after the next action is satisfied.
 final class TaskBlocked<R> extends TaskOutcome<R> {
   /// Why the provider cannot proceed.
   final String blockedReason;
 
-  /// What the host/human must do before a fresh order can proceed.
+  /// What the host/human must do before a fresh obligation can proceed.
   final String nextAction;
 
   const TaskBlocked({
@@ -78,11 +78,11 @@ final class TaskBlocked<R> extends TaskOutcome<R> {
   });
 }
 
-/// The DEAD-LETTER outcome: stop retrying this order and park it in the DLQ. The generated
+/// The DEAD-LETTER outcome: stop retrying this obligation and park it in the DLQ. The generated
 /// dispatcher maps this -> the `deadLetter...` Receipt directive
-/// (status:deadLettered + deadLetterReason + closesOrder).
+/// (status:deadLettered + deadLetterReason + closesObligation).
 final class TaskDeadLetter<R> extends TaskOutcome<R> {
-  /// Why this order was moved to the DLQ.
+  /// Why this obligation was moved to the DLQ.
   final String deadLetterReason;
   const TaskDeadLetter(this.deadLetterReason);
 }
@@ -106,34 +106,34 @@ abstract interface class TaskResult {
 typedef HostClock = int Function();
 
 /// The minimal contract a generated per-task provider exposes. Generic in the typed
-/// Order/Result; the generated subtype binds them. `handleOrder` is the ONE seam a host
+/// Obligation/Result; the generated subtype binds them. `handleObligation` is the ONE seam a host
 /// loop calls per `requested` row.
 abstract interface class TaskProvider<O, R> {
   /// The framework `impureCapability` ids this provider is bound to (provenance — the host
   /// can assert it is draining the right capability). Carried as DATA, never hand-typed.
-  String get orderDirectiveId;
+  String get obligationDirectiveId;
   String get completeDirectiveId;
   String get failDirectiveId;
   String get blockDirectiveId;
   String get deadLetterDirectiveId;
 
-  /// DECODE an incoming Order intent's payload JSON into the typed [O], run the
+  /// DECODE an incoming Obligation intent's payload JSON into the typed [O], run the
   /// registered typed handler, and ENCODE the outcome into the ordinary Receipt intent — a
-  /// [NomosIntent] ready for the ONE write path (`dispatch`). `now` stamps the
+  /// [NomosIntent] ready for the ONE write path (`offer`). `now` stamps the
   /// terminal time. Decoding raw JSON happens HERE and only here; the handler the dev
   /// writes sees ONLY the typed [O] and returns ONLY a typed [TaskOutcome].
-  NomosIntent handleOrder(String orderPayloadJson, {required HostClock now});
+  NomosIntent handleObligation(String obligationPayloadJson, {required HostClock now});
 
-  /// Convenience: decode an Order payload from an already-parsed map (the host may have
-  /// the row's `data` map in hand from a read). Same path as [handleOrder].
-  NomosIntent handleOrderMap(
-    Map<String, Object?> orderPayload, {
+  /// Convenience: decode an Obligation payload from an already-parsed map (the host may have
+  /// the row's `data` map in hand from a read). Same path as [handleObligation].
+  NomosIntent handleObligationMap(
+    Map<String, Object?> obligationPayload, {
     required HostClock now,
   });
 }
 
-/// Decode an Order payload JSON string to a map for a generated `…Order.fromJson`.
-/// Shared so every generated provider decodes Orders identically (the symmetry of the
+/// Decode an Obligation payload JSON string to a map for a generated `…Obligation.fromJson`.
+/// Shared so every generated provider decodes Obligations identically (the symmetry of the
 /// client's `jsonEncode(toPayloadJson())`).
-Map<String, Object?> decodeOrderPayload(String orderPayloadJson) =>
-    (jsonDecode(orderPayloadJson) as Map<String, Object?>);
+Map<String, Object?> decodeObligationPayload(String obligationPayloadJson) =>
+    (jsonDecode(obligationPayloadJson) as Map<String, Object?>);

package/dart/lib/src/subscriptions.dart

@@ -7,8 +7,8 @@
 
 /// The READ half of the client boundary: typed, reactive subscriptions.
 ///
-/// END-STATE (the "dispatch(intent) purge", Jack 2026-06-01): the app's ONLY
-/// Nomos surface is `dispatch(intent)` (write — see `dispatch.dart`) + TYPED
+/// END-STATE (the "offer(intent) purge", Jack 2026-06-18): the app's ONLY
+/// Nomos surface is `offer(intent)` (write — see `offer.dart`) + TYPED
 /// PUB/SUB SUBSCRIPTIONS (read — here + the generated per-domain accessors). The
 /// app reads ONLY through generated typed accessors (`watchSites()`,
 /// `watchSite(id)`, indexed-field queries → typed results); it never hand-writes a
@@ -75,7 +75,7 @@ typedef Summer = int Function(String sumId, String groupKey);
 /// A "projection changed" tick: fires (any value) whenever a write may have
 /// advanced the projection, so the subscription re-runs its indexed read. The
 /// `query()`/`query_by_id()` closures are SYNCHRONOUS point-in-time reads; this tick is what
-/// makes a typed accessor REACTIVE. The app threads its existing post-`dispatch`
+/// makes a typed accessor REACTIVE. The app threads its existing post-`offer`
 /// invalidation signal in here (today the runtime's ~750ms projection poll / the
 /// write-completion broadcast). A read with no live tick is a one-shot current read.
 typedef ReadTick = Stream<void>;

package/dart/lib/src/webview_bridge.dart

@@ -8,7 +8,7 @@
 /// stable message protocol, so the generated typed Dart client drives the real kernel — never a
 /// `MemoryPersistence` pretending to be a GitHolon.
 ///
-/// A WebView round-trip is ASYNC, so the bridge is async (unlike the sync FRB `Authorer` in `dispatch.dart`).
+/// A WebView round-trip is ASYNC, so the bridge is async (unlike the sync FRB `Authorer` in `offer.dart`).
 /// The generated per-domain Dart client wraps a [NomosBridge]; the bridge owns request/reply correlation +
 /// reactive `watch` streams. The platform TRANSPORT ([BridgeTransport]) is injected — `dart:js_util` on web,
 /// a WebView JS-channel on mobile — so this protocol logic is pure Dart + fully unit-testable.
@@ -153,26 +153,9 @@ class NomosBridge {
     });
   }
 
-  /// LOCAL-FIRST write: author `directiveId` under `domainHash`. Returns the new local head; durable on [sync].
-  Future<String> dispatch(
-      {required String domain,
-      required String directiveId,
-      required Map<String, Object?> payload,
-      required String domainHash}) async {
-    final r = _asMap(await _call('dispatch', {
-      'domain': domain,
-      'directiveId': directiveId,
-      'payload': payload,
-      'domainHash': domainHash
-    }));
-    return r['head'].toString();
-  }
-
-  /// §5 cross-custody delivery: a `recordShare` carrying a pre-signed §3 quote into a home holon.
-  Future<String> deliverShare(
-      {required Map<String, Object?> quote, required String domainHash}) async {
-    final r = _asMap(await _call(
-        'deliverShare', {'quote': quote, 'domainHash': domainHash}));
+  /// LOCAL-FIRST offer: carry opaque intent bytes into the GitHolon. Returns the new local head; durable on [sync].
+  Future<String> offer({required String intentBytes}) async {
+    final r = _asMap(await _call('offer', {'intentBytes': intentBytes}));
     return r['head'].toString();
   }
 

package/dart/test/webview_bridge_test.dart

@@ -40,9 +40,11 @@ class FakeRunner implements BridgeTransport {
         case 'connect':
           _incoming.add(reply({'workspace': args['workspace']}));
           break;
-        case 'dispatch':
+        case 'offer':
           // a directive the law refuses answers ok:false (the runner frames the gate's verdict).
-          if (args['directiveId'] == 'refuseMe') {
+          final intentJson =
+              utf8.decode(base64Decode(args['intentBytes'] as String));
+          if (intentJson.contains('"directiveId":"refuseMe"')) {
             _incoming.add({
               'v': kWebviewBridgeVersion,
               'id': id,
@@ -50,12 +52,9 @@ class FakeRunner implements BridgeTransport {
               'error': 'the law refused this intent'
             });
           } else {
-            _incoming.add(reply({'head': 'HEAD-${args['directiveId']}'}));
+            _incoming.add(reply({'head': 'HEAD-offer'}));
           }
           break;
-        case 'deliverShare':
-          _incoming.add(reply({'head': 'HEAD-share'}));
-          break;
         case 'query':
           _incoming.add(reply({
             'rows': [
@@ -176,16 +175,8 @@ Future<Object?> _invoke(
           workspace: a['workspace'] as String,
           clientId: a['clientId'] as String?);
       return null;
-    case 'dispatch':
-      return b.dispatch(
-          domain: a['domain'] as String,
-          directiveId: a['directiveId'] as String,
-          payload: (a['payload'] as Map).cast<String, Object?>(),
-          domainHash: a['domainHash'] as String);
-    case 'deliverShare':
-      return b.deliverShare(
-          quote: (a['quote'] as Map).cast<String, Object?>(),
-          domainHash: a['domainHash'] as String);
+    case 'offer':
+      return b.offer(intentBytes: a['intentBytes'] as String);
     case 'query':
       return b.query(
           a['queryId'] as String, (a['params'] as Map).cast<String, Object?>());
@@ -207,8 +198,9 @@ Future<Object?> _invoke(
 /// What the corpus says the typed (unwrapped) return value should be, given the reply's `result`.
 Object? _expectedTyped(String op, Map<String, Object?> result) {
   switch (op) {
-    case 'dispatch':
-    case 'deliverShare':
+    case 'offer':
+      return result['head'];
+    case 'offer':
       return result['head'];
     case 'query':
     case 'queryById':
@@ -267,28 +259,29 @@ void main() {
     await bridge.ready.timeout(const Duration(seconds: 1));
   });
 
-  test('dispatch round-trips a typed head; args reach the runner verbatim',
+  test('offer round-trips a typed head; args reach the runner verbatim',
       () async {
     await bridge.ready;
-    final head = await bridge.dispatch(
-        domain: 'guestbook',
-        directiveId: 'signGuestbook',
-        payload: {'author': 'ada'},
-        domainHash: 'abc');
-    expect(head, 'HEAD-signGuestbook');
-    final req = runner.sent.firstWhere((m) => m['op'] == 'dispatch');
-    expect((req['args'] as Map)['payload'], {'author': 'ada'});
-    expect((req['args'] as Map)['domainHash'], 'abc');
+    final intentBytes = base64Encode(utf8.encode(jsonEncode({
+      'v': 2,
+      'intent': {
+        'domain': 'guestbook',
+        'directiveId': 'signGuestbook',
+        'payload': {'author': 'ada'},
+        'domainHash': 'abc'
+      }
+    })));
+    final head = await bridge.offer(intentBytes: intentBytes);
+    expect(head, 'HEAD-offer');
+    final req = runner.sent.firstWhere((m) => m['op'] == 'offer');
+    expect((req['args'] as Map)['intentBytes'], intentBytes);
   });
 
   test(
-      'connect / deliverShare / query / queryById / count / sync / lawStatus all wrap the runner',
+      'connect / query / queryById / count / sync / lawStatus all wrap the runner',
       () async {
     await bridge.ready;
     await bridge.connect(cloud: 'https://c', workspace: 'ws', clientId: 'c1');
-    expect(
-        await bridge.deliverShare(quote: {'publicKey': 'k'}, domainHash: 'h'),
-        'HEAD-share');
     expect((await bridge.query('byAuthor', {'author': 'ada'})).first['data'],
         {'q': 'byAuthor'});
     expect((await bridge.queryById('Entry_1')).first['id'], 'Entry_1');
@@ -356,8 +349,16 @@ void main() {
     await bridge.ready;
     Object? err;
     try {
-      await bridge.dispatch(
-          domain: 'x', directiveId: 'refuseMe', payload: {}, domainHash: 'h');
+      await bridge.offer(
+          intentBytes: base64Encode(utf8.encode(jsonEncode({
+        'v': 2,
+        'intent': {
+          'domain': 'x',
+          'directiveId': 'refuseMe',
+          'payload': {},
+          'domainHash': 'h'
+        }
+      }))));
     } on NomosBridgeError catch (e) {
       err = e;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -11,8 +11,8 @@
   },
   "main": "src/index.ts",
   "bin": {
-    "nomos-compile": "./compile_package.mjs",
-    "holon-compile": "./compile_package.mjs"
+    "nomos-compile": "compile_package.mjs",
+    "holon-compile": "compile_package.mjs"
   },
   "exports": {
     ".": "./src/index.ts",
@@ -44,6 +44,8 @@
     "src",
     "!src/**/*.test.ts",
     "dart",
+    "!dart/.dart_tool",
+    "!dart/build",
     "compile_package.mjs"
   ],
   "publishConfig": {

package/src/build_package.ts

@@ -157,7 +157,7 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   const aggregates = [...byId.values()];
   const directiveIds = new Set(directives.map((d) => d.id));
   for (const task of spec.impureCapabilities ?? []) {
-    for (const directive of [task.order, task.complete, task.fail, task.block, task.deadLetter]) {
+    for (const directive of [task.obligation, task.complete, task.fail, task.block, task.deadLetter]) {
       if (!directiveIds.has(directive.id)) {
         throw new Error(
           `domain '${spec.domain ?? spec.name}' declares impureCapability '${task.aggregate.id}' ` +

package/src/capability_exports.ts

@@ -16,7 +16,7 @@
  * properties — invisible to those walks. This helper, applied at each plane's
  * merge point (the engine lump's `mergeModules`, the package composer's merge,
  * the compile CLI's merge), ADDS the bundle's pieces to the exports bag under
- * synthetic names (`<export>$aggregate`, `<export>$order`, …) so every
+ * synthetic names (`<export>$aggregate`, `<export>$obligation`, …) so every
  * existing shape-walk discovers them with ZERO new walk semantics. The
  * original bundle export stays (config-named lanes still resolve it); the
  * walks ignore its unmatched shape exactly as before.
@@ -34,7 +34,7 @@ export function isCapabilityDecl(v: unknown): v is Record<string, unknown> {
   );
 }
 
-const PIECES = ["aggregate", "order", "complete", "fail", "block", "deadLetter", "tasks"] as const;
+const PIECES = ["aggregate", "obligation", "complete", "fail", "block", "deadLetter", "tasks"] as const;
 
 /**
  * Expand every `capability()` bundle in an exports bag into discoverable

package/src/codegen_dart.ts

@@ -15,13 +15,13 @@
  *     emit (e.g. `{name:"HQ", createdAt:1000}`);
  *   - typed READ accessors per aggregate + per declared query — reactive
  *     `watch…`/one-shot `read…` over the GitHolon `query()`/`query_by_id()`
- *     surface (the read half of the dispatch(intent) boundary);
+ *     surface (the read half of the offer/query boundary);
  *   - a Dart enum per `t.enum([...])` field;
  *   - a Dart intent class per domain action — a pure typed DTO. Each class exposes its
  *     `domain` / `intentType` (so the call site never hand-types a string) and a
  *     `toPayloadJson()` that serialises only its typed fields to data. It builds no
  *     `Event` and no `Hlc`: the GitHolon executes the installed domain plan.
- *   - a single generic write verb [`dispatch`] that ships {domain, intentType,
+ *   - a single generic effectful write verb [`offer`] that ships {domain, intentType,
  *     toPayloadJson()} to the GitHolon `author(domain, intentType, payloadJson, actor)`.
  *
  * It does NOT hand-write the fixed wire types (`Value`/`Op`/`Event`/...): those
@@ -828,7 +828,7 @@ function emitPermissionVocabulary(vocab: PermissionVocabulary | undefined): stri
   return [
     `/// Generated permission vocabulary from the domain role catalogue.`,
     `///`,
-    `/// This is frontend read/dispatch vocabulary only. Domain execution and`,
+    `/// This is frontend read/offer vocabulary only. Domain execution and`,
     `/// admission still happen inside the installed GitHolon domain law.`,
     `class PermissionRole {`,
     `  const PermissionRole(this.value, this.capabilities);`,
@@ -1125,7 +1125,7 @@ function emitEvidenceRefClass(): string {
     `    );`,
     `  }`,
     ``,
-    `  /// The authored payload shape (for dispatch): the typed value-object the DSL`,
+    `  /// The authored payload shape (for offer): the typed value-object the DSL`,
     `  /// \`t.evidence()\` field lowers to a kernel \`Value::Evidence\`.`,
     `  Map<String, Object?> toJson() => <String, Object?>{`,
     `        'hash': hash,`,
@@ -1536,7 +1536,7 @@ function emitDirective(
     `/// Generated typed intent DTO for '${d.id}' (marker: ${d.marker},`,
     `/// aggregate: ${d.aggregateId}). It carries its [domain] + [intentType] and a`,
     `/// [toPayloadJson] that ships only typed fields as data. It builds no`,
-    `/// \`Event\` and no \`Hlc\`. Pass it to [dispatch]; the GitHolon executes`,
+    `/// \`Event\` and no \`Hlc\`. Pass it to [offer]; the GitHolon executes`,
     `/// the installed domain plan.`,
     `class ${className} implements NomosIntent {`,
     `  /// The policy domain this intent belongs to (the kernel \`author\` \`domain\`).`,
@@ -1587,7 +1587,7 @@ export function toJsonExpr(spec: PayloadFieldSpec, accessor: string): string {
 
 // ---- read accessors (typed subscriptions) ----------------------------------
 //
-// The READ half of the peer dispatch surface (Jack 2026-06-01): the app reads ONLY via
+// The READ half of the peer query surface (Jack 2026-06-18): the app reads ONLY via
 // these generated typed accessors over the GitHolon read surface
 // (`query(query_id, params_json)` + `query_by_id(aggregate_id)`, #140's indexed/PK
 // read-closure). It invents NO new Rust read primitive. Two emitters:
@@ -2503,11 +2503,11 @@ export interface DomainModule {
    */
   readModelAggregates?: string[];
   /**
-   * The domain's `impureCapability` capabilities (framework Order→Receipt; `impure_capability.ts`)
+   * The domain's `impureCapability` capabilities (framework Obligation→Receipt; `impure_capability.ts`)
    * for which to ALSO emit the typed PROVIDER SDK — the symmetric twin of the peer
-   * payload classes. For each declared task the codegen emits a typed `XOrder` (+
+   * payload classes. For each declared task the codegen emits a typed `XObligation` (+
    * `fromJson`), `XResult`/`XFailure`, a `XHandler` typedef and a `XProvider` dispatcher
-   * that decodes the incoming Order JSON and encodes the Receipt (reusing the
+   * that decodes the incoming Obligation JSON and encodes the Receipt (reusing the
    * peer-codegen `CompleteXPayload`/`FailXPayload`, so the Receipt is an ordinary
    * intent through the ONE write path). ADDITIVE + OPTIONAL: a domain that omits this is
    * byte-identical to before. NOT carried into any manifest/hash — a pure provider-side
@@ -2571,10 +2571,10 @@ export function generateDartDomain(mod: DomainModule): string {
   const mintedBlock = emitMintedCreates(mod.aggregates, mod.directives, domainKey, dartTypes);
 
   // PROVIDER SDK (the symmetric twin of the peer payload classes): for each declared
-  // `impureCapability` capability, a typed Order/Result/Failure + handler typedef + dispatcher.
+  // `impureCapability` capability, a typed Obligation/Result/Failure + handler typedef + dispatcher.
   // ADDITIVE + omit-when-empty: a domain with no `impureCapabilities` emits nothing (and the
   // `provider.dart` import is omitted), so it is byte-identical to before. The enum map is
-  // SHARED with the directive/aggregate codegen so an enum-typed order param references the
+  // SHARED with the directive/aggregate codegen so an enum-typed obligation param references the
   // already-emitted domain enum (no duplicate decl).
   const providerBlock = emitProviderSdk(mod.impureCapabilities ?? [], dartTypes);
 
@@ -2766,7 +2766,7 @@ export function generateDartDomain(mod: DomainModule): string {
           ``,
         ]
       : []),
-    `// ---- public intents (typed DTOs; ship via the generic dispatch() verb) ----`,
+    `// ---- public intents (typed DTOs; ship via the generic offer() verb) ----`,
     dirBlock,
     ``,
     ...(mintedBlock !== ""