@githolon/dsl 0.71.0 → 0.72.1

package/dart/CHANGELOG.md

@@ -1,3 +1,31 @@
+## 0.48.1
+
+- **Fix: `NomosSession.watchPendingConflicts()` never emitted.** The session overrode every other
+  reactive read to register on the parent plane (which owns the message loop) but omitted this one —
+  a session-bound generated client's conflict stream registered on the session's own dead controller
+  registry and never delivered an event. Now delegates like `watch`/`watchById`/`watchActivity`.
+  Regression test: a session-level subscription must emit its first snapshot. (Reported by co2 with
+  the exact fix — thank you.)
+
+## 0.48.0
+
+- **Session-bound clients (architecture/session_bound_clients.md)** — generated clients now bind to
+  exactly ONE `NomosSession`: `XClient.bind(session)` async preflight factory (structural interface
+  compat, typed `DomainClientSessionMismatch` at construction), all dispatch through the session,
+  births infer the parent from the session (no loose parent strings), `engine.follow(NomosRef)`
+  mounts by ref, `NomosOfferOutcome.bornRefs`. The kernel's generic "no active installed law declares
+  domain 'x'" is wrapped into the context-rich `DomainNotInstalledForSession` (session identity, both
+  workspaces, active domain keys/hashes, the four possible causes).
+- Root-bridge generic writes (`offer`/`offerDirective`/`offerIntent`/`offerCreates`/`createWorkspace`)
+  are `@Deprecated` in app code — kept for CLI/admin tooling; the session-bound generated surface is
+  the path.
+- `NomosSession.pendingConflicts()` / `watchPendingConflicts()` — the maintained Surfaced-conflict
+  "decisions needed" read (derived, not drained).
+- Test harness: `resetWorkspaceCustody`, `seedWorkspaceFromDeployJson`, `assertDomainInstalled`,
+  `session.assertCompatible(XClient.interface)`.
+- Requires Nomos Cloud ≥ the 2026-07-11 deploy (wasm 72604ff7 — the Surfaced/captured-basis kernel)
+  and pairs with `@githolon/dsl` 0.72.0 codegen.
+
 ## 0.47.0
 
 - **Fix: `NomosBridge.createWorkspace` hardcoded `domain: "workspaces"`** in the underlying signed offer —

package/dart/lib/nomos_client.dart

@@ -34,6 +34,10 @@ export 'src/home.dart';
 // THE WEBVIEW BRIDGE (app-binding boundary) — the async Dart runtime that drives the REAL githolon running
 // in a WebView, so the generated typed client never needs a `MemoryPersistence` fake.
 export 'src/webview_bridge.dart';
+// SESSION-BOUND CLIENTS (architecture/session_bound_clients.md) — the typed session/client
+// contract: NomosClientInterface (`XClient.interface`), session.assertCompatible(...), and the two
+// typed mismatch errors (DomainClientSessionMismatch / DomainNotInstalledForSession).
+export 'src/session_bound.dart';
 // The PROVIDER boundary (server-side capability-provider SDK runtime: TaskOutcome /
 // TaskSuccess / TaskFailure / TaskResult / TaskProvider / HostClock). The symmetric twin
 // of `offer.dart`; the generated per-task provider classes build on it.

package/dart/lib/src/session_bound.dart

@@ -0,0 +1,309 @@
+// NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
+// remotes are replaceable custody/transport, not truth.  ⇒ ONE Nomos GitHolon
+// wasm32-wasip1 artifact {kernel · projection · embedded QuickJS engine}.
+// If a file isn't this / hosting this / authoring for this / proving this — it's gone.
+
+/// SESSION-BOUND CLIENTS (architecture/session_bound_clients.md) — the typed contract between a
+/// generated `<Domain>Client` and the [NomosSession] it is constructed with.
+///
+/// THE FOUR-LAYER SPLIT: the ENGINE ([NomosBridge]/[NomosEngine]) is ONLY the multi-workspace
+/// runtime (mount/connect/session registry/sync/custody/follow-ref); a SESSION is exactly one
+/// workspace; a GENERATED CLIENT is exactly one session + one domain interface expectation + one
+/// actor context; everything else is a stateless value. This file carries:
+///
+///  * [NomosClientInterface] — the static descriptor every generated client exposes
+///    (`XClient.interface`): the domain key + law hash + structural interface (#72) it expects.
+///  * [NomosSessionCompat.assertCompatible] — the ONE preflight (used by `XClient.bind(session)`
+///    and by test harnesses) that verifies the session's workspace serves this client's law,
+///    distinguishing the four mismatch causes.
+///  * [DomainClientSessionMismatch] — thrown at client construction (bind / first dispatch) when
+///    the session's workspace does not serve the expected domain compatibly.
+///  * [DomainNotInstalledForSession] — the context-rich replacement for the kernel's generic
+///    "no active installed law declares domain 'x'" refusal, thrown wherever that error used to
+///    surface (bridge dispatch, birth lanes) with the full session context.
+library;
+
+import 'dart:convert';
+
+import 'webview_bridge.dart';
+
+/// The STATIC INTERFACE DESCRIPTOR a generated client exposes as `XClient.interface` — what the
+/// client EXPECTS of the workspace it binds to: the domain key, the law hash it was generated
+/// against (advisory — shape wins), and the structural interface (#72) it negotiates by.
+class NomosClientInterface {
+  /// The domain key this client dispatches under (e.g. `co2_platform`).
+  final String domain;
+
+  /// sha256 of the `.package.usda` this client was generated against (advisory provenance).
+  final String expectedDomainHash;
+
+  /// sha256 of the canonical structural interface JSON (from the baked compat manifest), when known.
+  final String? expectedInterfaceHash;
+
+  /// The structural interface (#72) as JSON — the directives + read shapes this client depends
+  /// on. Empty ⇒ no structural requirement was baked (hash-only provenance).
+  final String interfaceJson;
+
+  /// The compiler-baked compat manifest (§5) as JSON, when present — diagnosis only, never a gate.
+  final String? compatJson;
+
+  const NomosClientInterface({
+    required this.domain,
+    required this.expectedDomainHash,
+    this.expectedInterfaceHash,
+    this.interfaceJson = '',
+    this.compatJson,
+  });
+
+  /// The `{domain: interface}` requirement map the shape-compat check consumes, or null when no
+  /// structural interface was baked.
+  Map<String, Object?>? get requirement => interfaceJson.isEmpty
+      ? null
+      : {domain: (jsonDecode(interfaceJson) as Map).cast<String, Object?>()};
+}
+
+/// The four distinguishable causes of a session/client mismatch (ask 9 of
+/// architecture/session_bound_clients.md). Carried on [DomainClientSessionMismatch.cause].
+enum SessionMismatchCause {
+  /// The cloud (or a peer) holds the law but this session's LOCAL custody has not synced it yet —
+  /// pull/sync and re-bind.
+  liveCloudHasLawButLocalStale,
+
+  /// The session's workspace runs law, but not THIS domain — the client is bound to the wrong
+  /// session (a different package is mounted here).
+  wrongPackageMounted,
+
+  /// No installed law anywhere serves this domain — deploy the domain package first.
+  trulyNotDeployed,
+
+  /// The domain IS installed but its shape is older than what this client requires — the client
+  /// expects a newer interface (recompile against the deployed law, or evolve the law).
+  clientExpectsNewerInterface,
+}
+
+/// Thrown by `XClient.bind(session)` (and by the lazy first-dispatch check of the synchronous
+/// constructor) when the session's workspace does not serve the client's expected domain
+/// compatibly — at PROVIDER CONSTRUCTION, not two clicks into the app.
+class DomainClientSessionMismatch implements Exception {
+  /// The runner-level session name the client was bound to.
+  final String? sessionId;
+
+  /// The workspace that session is pinned to.
+  final String? sessionWorkspace;
+
+  /// The domain key the client expects installed.
+  final String expectedDomainKey;
+
+  /// The law hash the client was generated against (advisory).
+  final String expectedDomainHash;
+
+  /// The structural interface hash the client was generated against, when known.
+  final String? expectedInterfaceHash;
+
+  /// The domain keys the session's workspace ACTUALLY serves (best-effort; empty when the
+  /// workspace exposes no on-ledger interface yet).
+  final List<String> activeDomainKeys;
+
+  /// The law hashes actually installed on the session's workspace (best-effort).
+  final List<String> activeDomainHashes;
+
+  /// The classified cause, when the preflight could distinguish one.
+  final SessionMismatchCause? cause;
+
+  /// A human hint naming the fix (sync, re-bind, deploy, recompile), plus the raw shape verdict.
+  final String hint;
+
+  const DomainClientSessionMismatch({
+    required this.expectedDomainKey,
+    required this.expectedDomainHash,
+    this.expectedInterfaceHash,
+    this.sessionId,
+    this.sessionWorkspace,
+    this.activeDomainKeys = const [],
+    this.activeDomainHashes = const [],
+    this.cause,
+    required this.hint,
+  });
+
+  @override
+  String toString() =>
+      'DomainClientSessionMismatch: session "${sessionId ?? '(unbound)'}" (workspace '
+      '"${sessionWorkspace ?? '?'}") does not serve domain "$expectedDomainKey" compatibly'
+      '${cause != null ? ' [${cause!.name}]' : ''} — $hint '
+      '(expected law $expectedDomainHash'
+      '${expectedInterfaceHash != null ? ' / interface $expectedInterfaceHash' : ''}; '
+      'active domains: ${activeDomainKeys.isEmpty ? '(unknown)' : activeDomainKeys.join(', ')}; '
+      'active law: ${activeDomainHashes.isEmpty ? '(unknown)' : activeDomainHashes.join(', ')})';
+}
+
+/// The context-rich replacement for the kernel's generic
+/// `no active installed law declares domain 'x' … deploy the domain package first` refusal —
+/// thrown wherever that error used to surface (bridge dispatch, birth lanes) so an app dev sees
+/// WHICH session refused, what it actually runs, and the likely causes.
+class DomainNotInstalledForSession implements Exception {
+  /// The domain key the dispatch named.
+  final String expectedDomainKey;
+
+  /// The law hash the dispatch carried (advisory), when any.
+  final String? expectedDomainHash;
+
+  /// The runner session the dispatch routed to (null on a bare single-session bridge).
+  final String? sessionId;
+
+  /// The workspace that session is pinned to.
+  final String? sessionWorkspace;
+
+  /// The workspace the caller believed it was writing to (usually == [sessionWorkspace];
+  /// divergence is itself the diagnosis).
+  final String? requestedWorkspace;
+
+  /// The domain keys the session's workspace ACTUALLY serves (best-effort).
+  final List<String> activeDomainKeys;
+
+  /// The law hashes actually installed on the session's workspace (best-effort).
+  final List<String> activeDomainHashes;
+
+  /// The candidate explanations, most likely first.
+  final List<String> possibleCauses;
+
+  /// The original kernel refusal.
+  final Object underlying;
+
+  const DomainNotInstalledForSession({
+    required this.expectedDomainKey,
+    this.expectedDomainHash,
+    this.sessionId,
+    this.sessionWorkspace,
+    this.requestedWorkspace,
+    this.activeDomainKeys = const [],
+    this.activeDomainHashes = const [],
+    this.possibleCauses = defaultPossibleCauses,
+    required this.underlying,
+  });
+
+  /// The four causes the spec names, most likely first.
+  static const List<String> defaultPossibleCauses = [
+    'the client is bound to the WRONG session (another workspace holds this domain)',
+    'a birth/write targeted a parent workspace that is not this session\'s workspace',
+    'local custody is STALE — the cloud holds the law but this session has not synced it (pull/sync)',
+    'the domain is truly not deployed to this workspace yet (deploy the domain package)',
+  ];
+
+  @override
+  String toString() =>
+      'DomainNotInstalledForSession: domain "$expectedDomainKey" is not installed on session '
+      '"${sessionId ?? '(default)'}" (workspace "${sessionWorkspace ?? '?'}"'
+      '${requestedWorkspace != null && requestedWorkspace != sessionWorkspace ? ', requested "$requestedWorkspace"' : ''}). '
+      'Active domains: ${activeDomainKeys.isEmpty ? '(unknown)' : activeDomainKeys.join(', ')}; '
+      'active law: ${activeDomainHashes.isEmpty ? '(unknown)' : activeDomainHashes.join(', ')}. '
+      'Possible causes: ${possibleCauses.map((c) => '• $c').join(' ')} '
+      '[underlying: $underlying]';
+}
+
+/// THE ONE PREFLIGHT — `session.assertCompatible(XClient.interface)`. Used by the generated
+/// `XClient.bind(session)` async factory, by the lazy first-dispatch check of the synchronous
+/// constructor, and directly from tests (ask 9). Throws [DomainClientSessionMismatch] with the
+/// cause classified; returns normally when the session serves the client's law compatibly.
+extension NomosSessionCompat on NomosSession {
+  Future<void> assertCompatible(NomosClientInterface iface) async {
+    // 1. REACHABILITY — the session's workspace must answer a read at all.
+    List<String> activeKeys = const [];
+    try {
+      final offer = await interfaceOffer();
+      if (offer != null) activeKeys = offer.keys.toList()..sort();
+    } catch (e) {
+      throw DomainClientSessionMismatch(
+        expectedDomainKey: iface.domain,
+        expectedDomainHash: iface.expectedDomainHash,
+        expectedInterfaceHash: iface.expectedInterfaceHash,
+        sessionId: workspace,
+        sessionWorkspace: workspace,
+        hint: 'the session workspace is not reachable/mounted on this plane: $e',
+      );
+    }
+
+    // 2. HASH AXIS (diagnosis) — the installed law hashes, via the baked compat manifest when present.
+    List<String> activeHashes = const [];
+    if (iface.compatJson != null && iface.compatJson!.isNotEmpty) {
+      try {
+        final c = await checkCompat(
+            (jsonDecode(iface.compatJson!) as Map).cast<String, Object?>(),
+            iface.requirement);
+        if (c != null) activeHashes = c.workspaceRuns;
+      } catch (_) {/* diagnosis only — never fail the preflight on the hash axis */}
+    }
+
+    // 3. THE SHAPE AXIS (#72) — the one compatibility notion. No baked interface ⇒ nothing more to check.
+    final requirement = iface.requirement;
+    if (requirement == null) return;
+    Map<String, Object?> verdict;
+    try {
+      final raw = await checkCompatibility(requirement);
+      verdict = (raw['verdict'] is Map)
+          ? (raw['verdict'] as Map).cast<String, Object?>()
+          : raw;
+    } catch (e) {
+      throw DomainClientSessionMismatch(
+        expectedDomainKey: iface.domain,
+        expectedDomainHash: iface.expectedDomainHash,
+        expectedInterfaceHash: iface.expectedInterfaceHash,
+        sessionId: workspace,
+        sessionWorkspace: workspace,
+        activeDomainKeys: activeKeys,
+        activeDomainHashes: activeHashes,
+        hint: 'the shape-compatibility check itself failed: $e',
+      );
+    }
+    if (verdict['ok'] == true) return;
+
+    final missing =
+        ((verdict['missing'] as List?) ?? const []).map((e) => '$e').toList();
+    final incompatible =
+        ((verdict['incompatible'] as List?) ?? const []).map((e) => '$e').toList();
+
+    // 4. CLASSIFY the four causes (ask 9).
+    SessionMismatchCause cause;
+    String hint;
+    if (incompatible.isNotEmpty) {
+      cause = SessionMismatchCause.clientExpectsNewerInterface;
+      hint = 'the domain is installed but type-divergent from what this client requires '
+          '(${incompatible.join('; ')}) — recompile the client against the deployed law, or evolve the law';
+    } else if (activeKeys.isNotEmpty && !activeKeys.contains(iface.domain)) {
+      cause = SessionMismatchCause.wrongPackageMounted;
+      hint = 'this workspace runs a DIFFERENT package (${activeKeys.join(', ')}) — '
+          'bind this client to the session whose workspace holds "${iface.domain}"';
+    } else {
+      // The domain (or its whole offer) is absent here. Stale-vs-never-deployed: if this session is
+      // cloud-bound and behind, a sync may bring the law; otherwise it was never deployed.
+      var behind = 0;
+      var cloudBound = false;
+      try {
+        final m = await metrics();
+        behind = ((m['behind'] as num?) ?? 0).toInt();
+        final listed = await listWorkspaces();
+        cloudBound = listed.any((w) =>
+            w['workspace'] == workspace && w['syncPosture'] == 'cloud-bound');
+      } catch (_) {/* best-effort */}
+      if (cloudBound && behind > 0) {
+        cause = SessionMismatchCause.liveCloudHasLawButLocalStale;
+        hint = 'local custody is $behind commit(s) behind its cloud — sync/pull, then re-bind '
+            '(missing: ${missing.join('; ')})';
+      } else {
+        cause = SessionMismatchCause.trulyNotDeployed;
+        hint = 'no installed law on this workspace declares "${iface.domain}" — '
+            'deploy the domain package first (missing: ${missing.join('; ')})';
+      }
+    }
+    throw DomainClientSessionMismatch(
+      expectedDomainKey: iface.domain,
+      expectedDomainHash: iface.expectedDomainHash,
+      expectedInterfaceHash: iface.expectedInterfaceHash,
+      sessionId: workspace,
+      sessionWorkspace: workspace,
+      activeDomainKeys: activeKeys,
+      activeDomainHashes: activeHashes,
+      cause: cause,
+      hint: hint,
+    );
+  }
+}

package/dart/lib/src/test_harness.dart

@@ -36,6 +36,26 @@ import 'dart:io';
 import 'node_runner_transport.dart';
 import 'webview_bridge.dart' show NomosBridge, NomosSession;
 
+/// The offline-install lane configuration a harness keeps so the CUSTODY DIAGNOSTIC helpers
+/// (ask 9 of architecture/session_bound_clients.md) can re-run installs after construction:
+/// [seedWorkspaceFromDeployJson] / [resetWorkspaceCustody].
+class _InstallLane {
+  final String node;
+  final bool useInRepoScript;
+  final String inRepoScript;
+  final String githolonCmd;
+  final String? runtimeDir;
+  final String clientId;
+  const _InstallLane({
+    required this.node,
+    required this.useInRepoScript,
+    required this.inRepoScript,
+    required this.githolonCmd,
+    required this.runtimeDir,
+    required this.clientId,
+  });
+}
+
 class NomosTestHarnessException implements Exception {
   final String message;
   NomosTestHarnessException(this.message);
@@ -81,13 +101,23 @@ class NomosTestHarness {
   List<String> lawHashes(String workspace) =>
       List.unmodifiable(_lawHashes[workspace] ?? const []);
 
+  /// workspace → the base64 restore snapshot it was seeded from (for [resetWorkspaceCustody]).
+  final Map<String, String> _snapshots;
+
+  /// The offline-install lane config (for [seedWorkspaceFromDeployJson]); null when unknown.
+  final _InstallLane? _installLane;
+
   NomosTestHarness._(this.bridge, this.workspace, this._transport, this._workdir,
       this._onDiagnostic, this._sessionNames,
       {Map<String, String> devicePublics = const {},
       this.frameworkHash,
-      Map<String, List<String>> lawHashes = const {}})
+      Map<String, List<String>> lawHashes = const {},
+      Map<String, String> snapshots = const {},
+      _InstallLane? installLane})
       : _devicePublics = devicePublics,
-        _lawHashes = lawHashes;
+        _lawHashes = Map.of(lawHashes),
+        _snapshots = Map.of(snapshots),
+        _installLane = installLane;
 
   /// The base64 device PUBLIC key a `deviceKeyed` [cluster] session was opened with (null otherwise). Its
   /// `sha256(base64decode(...))` is the attestor keyHash a reader enrols to trust this source's signed reads.
@@ -233,7 +263,15 @@ class NomosTestHarness {
             workspace: ((info['lawHashes'] as List?) ?? const [])
                 .map((e) => e.toString())
                 .toList()
-          });
+          },
+          snapshots: {workspace: base64Encode(await File(snapshot).readAsBytes())},
+          installLane: _InstallLane(
+              node: node,
+              useInRepoScript: useInRepoScript,
+              inRepoScript: resolvedHelper,
+              githolonCmd: githolonCmd,
+              runtimeDir: runtimeDir,
+              clientId: clientId));
       if (autoTearDown && registerTearDown != null) {
         registerTearDown(harness.dispose);
       }
@@ -386,7 +424,15 @@ class NomosTestHarness {
           bridge, names.first, transport, workdir, onDiagnostic, names,
           devicePublics: devicePublics,
           frameworkHash: frameworkHash,
-          lawHashes: lawHashesByWs);
+          lawHashes: lawHashesByWs,
+          snapshots: snapshotB64,
+          installLane: _InstallLane(
+              node: node,
+              useInRepoScript: useInRepoScript,
+              inRepoScript: resolvedHelper,
+              githolonCmd: githolonCmd,
+              runtimeDir: runtimeDir,
+              clientId: clientId));
       if (autoTearDown && registerTearDown != null) {
         registerTearDown(harness.dispose);
       }
@@ -404,6 +450,92 @@ class NomosTestHarness {
     }
   }
 
+  // ── CUSTODY DIAGNOSTIC HELPERS (architecture/session_bound_clients.md ask 9) ──
+
+  /// The raw multi-workspace plane under [bridge] (the session handle a single-workspace harness
+  /// hands out is a view on it).
+  NomosBridge get _plane {
+    final b = bridge;
+    return b is NomosSession ? b.parent : b;
+  }
+
+  /// RESET a workspace's LOCAL custody to the snapshot it was seeded from — the "stale/corrupt
+  /// local custody" repair move in tests. Reconnects the session in place (watches on the old
+  /// holon are stopped by the runner's re-connect semantics).
+  Future<void> resetWorkspaceCustody(String workspace) async {
+    final snap = _snapshots[workspace];
+    if (snap == null) {
+      throw NomosTestHarnessException(
+          'resetWorkspaceCustody("$workspace"): no seed snapshot held for this workspace — '
+          'seeded workspaces: ${_snapshots.keys.toList()}');
+    }
+    await _plane.connect(
+      workspace: workspace,
+      session: workspace,
+      clientId: '${_installLane?.clientId ?? 'test-runner'}-$workspace',
+      restoreFrom: snap,
+      allowUnborn: true,
+    );
+  }
+
+  /// SEED a NEW workspace on this plane from `build/<name>.deploy.json` law packages — the
+  /// mid-test twin of [cluster]'s per-workspace install: runs the SAME offline install lane,
+  /// then connects the workspace as its own session. Returns its [NomosSession].
+  Future<NomosSession> seedWorkspaceFromDeployJson({
+    required String workspace,
+    required List<String> deployJsonPaths,
+  }) async {
+    final lane = _installLane;
+    if (lane == null) {
+      throw NomosTestHarnessException(
+          'seedWorkspaceFromDeployJson: this harness holds no install-lane config');
+    }
+    if (deployJsonPaths.isEmpty) {
+      throw NomosTestHarnessException(
+          'seedWorkspaceFromDeployJson("$workspace"): pass the build/<name>.deploy.json paths');
+    }
+    final snap = '${_workdir.path}/$workspace.bin';
+    final info = await _runInstall(
+        node: lane.node,
+        useInRepoScript: lane.useInRepoScript,
+        inRepoScript: lane.inRepoScript,
+        githolonCmd: lane.githolonCmd,
+        deployJsonPaths: deployJsonPaths,
+        workspace: workspace,
+        snapshot: snap,
+        runtimeDir: lane.runtimeDir,
+        onDiagnostic: _onDiagnostic);
+    final b64 = base64Encode(await File(snap).readAsBytes());
+    _snapshots[workspace] = b64;
+    _lawHashes[workspace] = ((info['lawHashes'] as List?) ?? const [])
+        .map((e) => e.toString())
+        .toList();
+    await _plane.connect(
+      workspace: workspace,
+      session: workspace,
+      clientId: '${lane.clientId}-$workspace',
+      restoreFrom: b64,
+      allowUnborn: true,
+    );
+    if (!_sessionNames.contains(workspace)) _sessionNames.add(workspace);
+    return _plane.session(workspace);
+  }
+
+  /// ASSERT a domain key is INSTALLED on a workspace of this plane — the cheap, named diagnostic
+  /// for "why does my dispatch refuse". Throws [NomosTestHarnessException] naming the ACTIVE
+  /// domain keys when absent. (For the full shape check use
+  /// `harness.session(ws).assertCompatible(XClient.interface)`.)
+  Future<void> assertDomainInstalled(
+      {required String workspace, required String domain}) async {
+    final offer = await _plane.session(workspace).interfaceOffer();
+    final keys = (offer?.keys.toList() ?? const <String>[])..sort();
+    if (!keys.contains(domain)) {
+      throw NomosTestHarnessException(
+          'domain "$domain" is NOT installed on workspace "$workspace" — active domains: '
+          '${keys.isEmpty ? '(none observable — no on-ledger interface yet, or law truly not deployed)' : keys.join(', ')}');
+    }
+  }
+
   /// Deterministic, idempotent, total-ordered teardown: stop the runner (SIGTERM → 5s deadline → SIGKILL,
   /// via [NodeRunnerTransport.dispose]), then delete the temp dir. Safe to call twice; safe to call after a
   /// failed setup. Nothing left running, nothing left on disk.