@githolon/dsl 0.74.0 → 0.75.0

package/dart/CHANGELOG.md

@@ -1,3 +1,31 @@
+## 0.51.0
+
+- **The burn-down wave.** Dead-letter queue surface on the session plane: `deadLetters()`,
+  `retryDeadLetter()`, `discardDeadLetter()`, `salvage()`, `absorbSalvage()` — with the local-only
+  retry/absorb fixes and the salvage-shape parking fix (refused work is NEVER silently dropped).
+  `nomos_headless.dart` exports the full session surface. Requires Nomos Cloud ≥ the 2026-07-11
+  burn-down deploy for the fleet DLQ sweep lanes (`/dlq-summary`, `/dlq-sweep`) and the
+  content-addressed large-deploy staging lane.
+
+## 0.50.1
+
+- **Structural: the session-delegation-gap class is closed.** All event-dispatch registries
+  (watch subscriptions, compat watches, custody/sync/signal/flame/span/transfer/status
+  controllers, span buffers, session registries) now route through one `_eventPlane` seam that
+  resolves to the plane owning the message loop — the base class is correct for `NomosSession`
+  automatically, and all 17 hand-written per-method session overrides are DELETED (including the
+  0.48.1 `watchPendingConflicts` fix, whose regression test still passes — the proof). Five
+  latent unreported instances of the same bug fixed en passant: `session.custodyEvents` (dead
+  stream), `connectedSessions` (empty), `connect()`-on-session state stamping, `checkCompat()`
+  caching, `noteLocalSpan()` (dead buffer). A source-level tripwire test fails the suite if a
+  future Stream-returning method bypasses the seam.
+- **The first-five-minutes gauntlet** — one checklist test walking the entire promised surface
+  (deviceKeyed cluster + phase diagnostics, the blessed session-bound shape, local autoSync
+  posture with zero-fetch assertion, acquireSession single-flight, reactive first-snapshots,
+  attested keyed reads, custody reset/re-seed, deadline-bounded disposal) — now runs in CI on
+  every client/runner/codegen change. Every one of this week's four tenant-reported lifecycle
+  bugs appears as an explicit leg.
+
 ## 0.50.0
 
 - **No silent hangs — the standing harness property.** Every `NomosTestHarness` lifecycle phase now

package/dart/lib/nomos_headless.dart

@@ -39,3 +39,11 @@ library;
 
 export 'src/node_runner_transport.dart';
 export 'src/test_harness.dart';
+// THE FULL SESSION SURFACE (task #86 gap 1): a headless test types everything the harness hands out —
+// [NomosSessionCredentials] (the `acquireSession` ifAbsentCredentials callback's return type),
+// [NomosBridge]/[NomosSession]/[NomosBbox]/[NomosCompat], the E2E sealing client
+// ([NomosKeyStore]/[WrappedKeyStore]/[NomosEncryption]), and the typed session-bound errors —
+// WITHOUT also importing the web barrel. Both files are web-safe (they are exported from
+// `nomos_client.dart` too); re-exporting them here just makes the headless import self-sufficient.
+export 'src/webview_bridge.dart';
+export 'src/session_bound.dart';

package/dart/lib/src/webview_bridge.dart

@@ -769,6 +769,26 @@ class NomosBridge {
 
   static String _spanIdFor(int id) => id.toRadixString(16).padLeft(16, '0');
 
+  /// THE EVENT PLANE — the ONE bridge whose mutable dispatch registries every event/push resolves against.
+  ///
+  /// WHY THIS EXISTS (the closed bug class): a [NomosSession] extends this class but shares its [parent]'s
+  /// transport + message loop — [_onMessage] only ever runs on the PARENT, so events resolve against the
+  /// PARENT's controller maps ([_watches], [_compatWatches], the broadcast StreamControllers, [_spanBuffer],
+  /// [_sessionNames], …). Any Stream-returning method / stateful getter that touched `this`'s copies on a
+  /// session registered on a DEAD registry and never emitted (real shipped instances: `watchPendingConflicts`
+  /// pre-0.48.1, and the five hand-written session watch overrides this seam retired).
+  ///
+  /// THE RULE (tripwire-enforced by `test/event_plane_seam_test.dart`): EVERY member that reads or writes
+  /// event-dispatch / plane state MUST do so via `_eventPlane.<field>` — never a bare field access. Requests
+  /// still go through `this._call` (a session's override stamps `args.session`), so a session's watch
+  /// registers its controller on the PARENT's registry while the wire op still carries the SESSION's
+  /// workspace. Chases to the root, so nested delegation stays correct.
+  NomosBridge get _eventPlane => this;
+
+  /// The session name this view is pinned to (null on the plane itself). Lets base implementations be
+  /// session-aware (per-workspace compat caching / law-change streams) with no per-method overrides.
+  String? get _sessionName => null;
+
   /// Completes once the runner has posted `{ event: "ready" }` (the wasm + client are booted).
   Future<void> get ready => _ready.future;
 
@@ -926,8 +946,8 @@ class NomosBridge {
   /// it to a generated client (`EstateClient(bridge.session('estate'))`), and `connect` the workspace when
   /// ready — reads/writes flow once it is open. A device typically holds many: `bridge.session('home')`,
   /// `bridge.session('estate-42')`, … all on ONE bridge/transport (this device's local plane).
-  NomosSession session(String workspace) =>
-      _sessionViews.putIfAbsent(workspace, () => NomosSession(this, workspace));
+  NomosSession session(String workspace) => _eventPlane._sessionViews
+      .putIfAbsent(workspace, () => NomosSession(_eventPlane, workspace));
 
   /// A [NomosForeignReader] backed by THIS bridge's multi-workspace plane — what a generated `ForeignRef`
   /// (a `t.foreignRef` cross-workspace locator) resolves against: `row.data.listing.resolve(bridge.foreignReader())`.
@@ -939,7 +959,8 @@ class NomosBridge {
   NomosForeignReader foreignReader({String? cloud}) => _BridgeForeignReader(this, cloud);
 
   /// The workspace names [connect] has opened on this plane (the live sessions).
-  List<String> get connectedSessions => List.unmodifiable(_sessionNames);
+  List<String> get connectedSessions =>
+      List.unmodifiable(_eventPlane._sessionNames);
 
   /// ENUMERATE THE LOCAL PLANE — every workspace open on this device + its sync posture:
   /// `[{ session, workspace, mounted, syncPosture: "local-only" | "cloud-bound" }]`. A local-only workspace
@@ -965,7 +986,7 @@ class NomosBridge {
       String? session,
       int? maxMounted}) async {
     final ws = session ?? workspace;
-    _sessionNames.add(ws);
+    _eventPlane._sessionNames.add(ws);
     final r = _asMap(await _call('connect', {
       // [cloud] is OPTIONAL — omit it to open a LOCAL-ONLY workspace (a local githolon with no cloud
       // counterpart; the runner uses a `local://` sentinel and sync is a no-op). Pass it to make the
@@ -992,13 +1013,13 @@ class NomosBridge {
       // fail closed (the break surfaces as an error on the sync/pull that hit it; the holon stays local).
       if (onCustodyBreak != null) 'onCustodyBreak': onCustodyBreak.wire,
     }));
-    _lastRecovery = (r['recovery'] as Map?)?.cast<String, Object?>();
+    _eventPlane._lastRecovery = (r['recovery'] as Map?)?.cast<String, Object?>();
   }
 
   /// The custody lifecycle stream (rebirth_and_custody_lifecycle.md) — a rebirth/divergence surfaces here as a
   /// typed [NomosCustodyEvent]. Bind a Flutter break dialog / posture banner to it; for a `CustodyBreakPolicy.
   /// ask` session, an event of `kind == 'ask'` awaits [resolveCustodyBreak].
-  Stream<NomosCustodyEvent> get custodyEvents => _custodyEvents.stream;
+  Stream<NomosCustodyEvent> get custodyEvents => _eventPlane._custodyEvents.stream;
 
   /// Where a session sits on the custody spectrum (incarnation, posture, pending/salvaged local work,
   /// supersession history) — for a status banner or a "you're offline on old truth" indicator.
@@ -1032,10 +1053,54 @@ class NomosBridge {
   Future<Map<String, Object?>> discardSalvaged(String id, {String? session}) async =>
       _asMap(await _call('discardSalvaged', {'id': id, if (session != null) 'session': session}));
 
+  // ── THE DEAD-LETTER QUEUE (refused-but-legitimate work is NEVER lost) — the Dart mirror of the
+  //   JS holon's DLQ surface (`deadLetters()` / `retryDeadLetter()` / `discardDeadLetter()`). A
+  //   DOMAIN rejection (the law couldn't merge it — edge admission or a local replay refusal)
+  //   parks the FULL intent durably in the workspace tree (it rides export()/restore); the app
+  //   inspects, the domain dev ships a law fix, retry unjams. ──
+
+  /// The parked dead letters — metadata only (`{id, oid, source, error, domain, directiveId, at}`);
+  /// the intent bytes stay in the durable queue.
+  Future<List<Map<String, Object?>>> deadLetters({String? session}) async {
+    final r = _asMap(await _call('deadLetters', {if (session != null) 'session': session}));
+    return ((r['dead'] as List?) ?? const [])
+        .map((e) => (e as Map).cast<String, Object?>())
+        .toList();
+  }
+
+  /// Retry one dead letter (after the law fix landed): pulls canon first (it may already be
+  /// admitted), else re-offers the parked bytes locally. `{ok, head?|alreadyOnMain?|error?}` —
+  /// a refusal leaves the entry parked (with the fresh error), never lost.
+  Future<Map<String, Object?>> retryDeadLetter(String id, {String? session}) async =>
+      _asMap(await _call('retryDeadLetter', {'id': id, if (session != null) 'session': session}));
+
+  /// Discard one dead letter — the app's EXPLICIT choice to drop the work. `{ok}`.
+  Future<Map<String, Object?>> discardDeadLetter(String id, {String? session}) async =>
+      _asMap(await _call('discardDeadLetter', {'id': id, if (session != null) 'session': session}));
+
+  /// SALVAGE — best-effort extraction of this holon's local-only authored work (un-synced pending
+  /// writes + the DLQ), each with its full `intentB64` bytes: `{pendingWrites, deadLetters}`. The
+  /// read half of the recovery lane (`connect(recover: true)` runs salvage → [absorbSalvage]).
+  Future<Map<String, Object?>> salvage({String? session}) async =>
+      _asMap(await _call('salvage', {if (session != null) 'session': session}));
+
+  /// ABSORB salvaged work into THIS holon: pending writes are re-offered under the current law
+  /// (a refusal dead-letters — never lost), and dead-letter entries are re-queued into the DLQ.
+  /// Returns the recovery report `{salvagedWrites, requeuedDeadLetters, unsalvageable}`.
+  Future<Map<String, Object?>> absorbSalvage(
+      {List<Map<String, Object?>> pendingWrites = const [],
+      List<Map<String, Object?>> deadLetters = const [],
+      String? session}) async =>
+      _asMap(await _call('absorbSalvage', {
+        'pendingWrites': pendingWrites,
+        'deadLetters': deadLetters,
+        if (session != null) 'session': session,
+      }));
+
   /// The salvage report from the most recent `connect(recover: true)` — `{ salvagedWrites, requeuedDeadLetters,
   /// unsalvageable }`, or null if the connection didn't recover. Show "recovered N writes" / surface
   /// `unsalvageable` (writes the current law refused — kept in the DLQ, never dropped).
-  Map<String, Object?>? get lastRecovery => _lastRecovery;
+  Map<String, Object?>? get lastRecovery => _eventPlane._lastRecovery;
   Map<String, Object?>? _lastRecovery;
 
   /// LOCAL-FIRST offer: carry opaque intent bytes into the GitHolon. Returns the new local head; durable on [sync].
@@ -1249,11 +1314,14 @@ class NomosBridge {
   Future<NomosSession> acquireSession(String workspace,
       {Future<NomosSessionCredentials> Function()? ifAbsentCredentials}) {
     // Fast path: a live session needs no runner round-trip (and never asks for credentials).
-    if (_sessionNames.contains(workspace)) return Future.value(session(workspace));
+    final plane = _eventPlane;
+    if (plane._sessionNames.contains(workspace)) {
+      return Future.value(session(workspace));
+    }
     // SINGLE-FLIGHT: one in-flight open per workspace per plane; concurrent callers join it.
-    return _acquiring.putIfAbsent(workspace, () async {
+    return plane._acquiring.putIfAbsent(workspace, () async {
       try {
-        if (_sessionNames.contains(workspace)) return session(workspace);
+        if (plane._sessionNames.contains(workspace)) return session(workspace);
         // Consult the plane's TRUTHFUL registry (mounted ∪ parked ∪ resident custody — the runner's
         // realm.list()): anything the device already holds opens locally, no cloud, no credentials.
         var resident = false;
@@ -1285,7 +1353,7 @@ class NomosBridge {
         return session(workspace);
       } finally {
         // completed (either way) — the next acquire re-evaluates fresh (a live session hits the fast path).
-        _acquiring.remove(workspace);
+        plane._acquiring.remove(workspace);
       }
     });
   }
@@ -1712,18 +1780,19 @@ class NomosBridge {
   }
 
   /// Background-sync telemetry: each autoSync round (`event:'sync'`) and doorbell socket state (`event:'link'`).
-  Stream<Map<String, Object?>> get syncEvents => _syncEvents.stream;
+  Stream<Map<String, Object?>> get syncEvents => _eventPlane._syncEvents.stream;
 
   /// LIVE pack byte-progress — the real loading bar. Each event carries `received`/`total` (the host's
   /// actual `Content-Length`, known before the body) + `kind` ('delta'|'full'). Emits only while a `/pack`
   /// transfer is moving (small syncs ride the inline offer-result piggyback — instant, no bar).
-  Stream<TransferProgress> get transferProgress => _transferEvents.stream;
+  Stream<TransferProgress> get transferProgress =>
+      _eventPlane._transferEvents.stream;
 
   /// THE APP-READY SYNC STATE — a truthful aggregation of sync rounds, the doorbell, transfer progress, and a
   /// periodic metrics poll. Map straight to a sync-state page. Starts a lightweight 4s metrics poll while
   /// listened to (stops on cancel). [currentStatus] is the latest snapshot for a non-stream read.
-  Stream<SyncStatus> get syncStatus => _syncStatusCtrl.stream;
-  SyncStatus get currentStatus => _status;
+  Stream<SyncStatus> get syncStatus => _eventPlane._syncStatusCtrl.stream;
+  SyncStatus get currentStatus => _eventPlane._status;
 
   void _pushStatus(SyncStatus s) {
     _status = s;
@@ -1761,20 +1830,24 @@ class NomosBridge {
   }
 
   /// Ephemeral signal-holon projections (`event:'signal'`), currently peer frontiers / lag for the workspace.
-  Stream<Map<String, Object?>> get signalEvents => _signalEvents.stream;
+  Stream<Map<String, Object?>> get signalEvents =>
+      _eventPlane._signalEvents.stream;
 
   /// THE REALTIME FLAMEPATH: one event per admission the edge broadcasts over the doorbell —
   /// `{ at, oid, edge:{totalMs,scanMs,fetchMs,gateFoldMs,sealMs,intents}, clients:[{client,n}] }`.
   /// Every subscriber sees EVERY admission (yours and your peers') — the cloud track of the flame chart.
-  Stream<Map<String, Object?>> get flameEvents => _flameEvents.stream;
+  Stream<Map<String, Object?>> get flameEvents =>
+      _eventPlane._flameEvents.stream;
 
   /// LIVE per-layer spans of the local pipeline (begin/end as they happen): mutex wait, githolon author,
   /// push, converge … The host renders in-progress bars so a hang is visible WHILE it blocks, not after.
-  Stream<Map<String, Object?>> get spanEvents => _spanEvents.stream;
+  Stream<Map<String, Object?>> get spanEvents =>
+      _eventPlane._spanEvents.stream;
 
   /// The buffered recent span events — replay these on first build to recover the BOOT flamepath
   /// (fetch wasm / clone ledger / instantiate) that streamed during connect(), before the UI subscribed.
-  List<Map<String, Object?>> get recentSpans => List.unmodifiable(_spanBuffer);
+  List<Map<String, Object?>> get recentSpans =>
+      List.unmodifiable(_eventPlane._spanBuffer);
 
   int _localSpanSeq = 0;
 
@@ -1790,14 +1863,17 @@ class NomosBridge {
     required int t1,
     String? id,
   }) {
-    final sid = id ?? 'local-${_localSpanSeq++}';
+    final plane = _eventPlane;
+    final sid = id ?? 'local-${plane._localSpanSeq++}';
     for (final m in <Map<String, Object?>>[
       {'event': 'span', 'span': {'phase': 'begin', 'id': sid, 'track': track, 'name': name, 'kind': kind, 't0': t0}},
       {'event': 'span', 'span': {'phase': 'end', 'id': sid, 't1': t1}},
     ]) {
-      _spanBuffer.add(m);
-      if (_spanBuffer.length > 400) _spanBuffer.removeRange(0, _spanBuffer.length - 400);
-      if (!_spanEvents.isClosed) _spanEvents.add(m);
+      plane._spanBuffer.add(m);
+      if (plane._spanBuffer.length > 400) {
+        plane._spanBuffer.removeRange(0, plane._spanBuffer.length - 400);
+      }
+      if (!plane._spanEvents.isClosed) plane._spanEvents.add(m);
     }
   }
 
@@ -1860,7 +1936,12 @@ class NomosBridge {
       if (requirement != null) 'requirement': requirement,
     }));
     final v = NomosCompat.fromJson((r['compat'] as Map?)?.cast<String, Object?>());
-    if (v != null) _lastCompat = v;
+    if (v != null) {
+      _eventPlane._lastCompat = v;
+      // a session's verdict is per-workspace state on the PLANE (so `session.compat` reads it back).
+      final n = _sessionName;
+      if (n != null) _eventPlane._lastCompatBySession[n] = v;
+    }
     return v;
   }
 
@@ -1892,7 +1973,15 @@ class NomosBridge {
   }
 
   /// The last computed compat verdict (set by [checkCompat] / a `lawChanged` event). Null until bind.
-  NomosCompat? get compat => _lastCompat;
+  /// LAW-scoped: a [NomosSession] answers for ITS workspace, falling back to the plane-wide value when the
+  /// runner's events carried no session key (older bundles).
+  NomosCompat? get compat {
+    final n = _sessionName;
+    if (n != null) {
+      return _eventPlane._lastCompatBySession[n] ?? _eventPlane._lastCompat;
+    }
+    return _eventPlane._lastCompat;
+  }
 
   /// THE FEATURE FLAG (dark-launch): true iff [member] exists on the workspace's offer AND is
   /// structurally compatible. Ship UI with a member dark, deploy the law, it lights up — no redeploy.
@@ -1904,7 +1993,16 @@ class NomosBridge {
 
   /// COMPAT SUPERPOWER live events: emits the fresh verdict whenever a synced install/upgrade/retire
   /// moves the workspace's offer under this live client. The app re-checks feature flags reactively.
-  Stream<NomosCompat> get onLawChanged => _lawChanged.stream;
+  /// LAW-scoped like [compat]: a [NomosSession] listens to ITS workspace's law changes only.
+  Stream<NomosCompat> get onLawChanged {
+    final n = _sessionName;
+    if (n != null) {
+      return (_eventPlane._lawChangedBySession[n] ??=
+              StreamController<NomosCompat>.broadcast())
+          .stream;
+    }
+    return _eventPlane._lawChanged.stream;
+  }
 
   /// SHAPE COMPATIBILITY as a LIVE BINDING (#72): a stream of verdicts that re-emits whenever the
   /// workspace's installed law changes (another peer installs/upgrades/retires a domain and it
@@ -1912,7 +2010,9 @@ class NomosBridge {
   Stream<Map<String, Object?>> watchCompatibility(
       Map<String, Object?> requirement,
       [String? session]) {
-    final subId = 'c${++_seq}';
+    // Controllers live on the EVENT PLANE (where _onMessage dispatches); the registration `_call` stays
+    // THIS instance's (a session's override stamps `args.session`) — see [_eventPlane].
+    final subId = 'c${++_eventPlane._seq}';
     late final StreamController<Map<String, Object?>> ctrl;
     ctrl = StreamController<Map<String, Object?>>(
       onListen: () => _call('watch', {
@@ -1922,13 +2022,13 @@ class NomosBridge {
         if (session != null) 'session': session,
       }),
       onCancel: () async {
-        _compatWatches.remove(subId);
+        _eventPlane._compatWatches.remove(subId);
         try {
           await _call('unwatch', {'subId': subId});
         } catch (_) {}
       },
     );
-    _compatWatches[subId] = ctrl;
+    _eventPlane._compatWatches[subId] = ctrl;
     return ctrl.stream;
   }
 
@@ -1941,7 +2041,9 @@ class NomosBridge {
       NomosBbox? bbox,
       String? base,
       String? session}) {
-    final subId = 'w${++_seq}';
+    // Controllers live on the EVENT PLANE (where _onMessage dispatches); the registration `_call` stays
+    // THIS instance's (a session's override stamps `args.session`) — see [_eventPlane].
+    final subId = 'w${++_eventPlane._seq}';
     late final StreamController<List<dynamic>> ctrl;
     ctrl = StreamController<List<dynamic>>(
       onListen: () => _call('watch', {
@@ -1956,13 +2058,13 @@ class NomosBridge {
         if (session != null) 'session': session,
       }),
       onCancel: () async {
-        _watches.remove(subId);
+        _eventPlane._watches.remove(subId);
         try {
           await _call('unwatch', {'subId': subId});
         } catch (_) {}
       },
     );
-    _watches[subId] = ctrl;
+    _eventPlane._watches[subId] = ctrl;
     return ctrl.stream;
   }
 
@@ -2027,6 +2129,16 @@ class NomosSession extends NomosBridge {
 
   NomosSession(this.parent, this.workspace) : super._view(parent._transport);
 
+  /// THE SEAM (see [NomosBridge._eventPlane]): all event dispatch + plane state resolves on the PARENT's
+  /// registries (chased to the root, so nested delegation stays correct). This ONE override is why the base
+  /// class's Stream-returning methods work unmodified on a session — no per-method overrides.
+  @override
+  NomosBridge get _eventPlane => parent._eventPlane;
+
+  /// Base implementations scope law-state (compat / onLawChanged) to THIS workspace via this.
+  @override
+  String? get _sessionName => workspace;
+
   /// Sibling workspaces resolve on the shared plane — delegate to the parent's registry (never nest a
   /// session inside a session).
   @override
@@ -2058,58 +2170,11 @@ class NomosSession extends NomosBridge {
   @override
   Future<void> dispose() async {}
 
-  // Reactive reads register on the PARENT (which listens) so watch events land — route with our session.
-  @override
-  Stream<List<dynamic>> watch(String queryId,
-          [Map<String, Object?> params = const {}, String? session]) =>
-      parent.watch(queryId, params, session ?? workspace);
-  @override
-  Stream<List<dynamic>> watchById(String id, [String? session]) =>
-      parent.watchById(id, session ?? workspace);
-  @override
-  Stream<List<dynamic>> watchSpatial(String spatialId, NomosBbox bbox,
-          [String? session]) =>
-      parent.watchSpatial(spatialId, bbox, session ?? workspace);
-  @override
-  Stream<List<dynamic>> watchActivity({String? base, String? session}) =>
-      parent.watchActivity(base: base, session: session ?? workspace);
-  @override
-  Stream<Map<String, Object?>> watchCompatibility(
-          Map<String, Object?> requirement,
-          [String? session]) =>
-      parent.watchCompatibility(requirement, session ?? workspace);
-  @override
-  Stream<List<dynamic>> watchPendingConflicts([String? session]) =>
-      parent.watchPendingConflicts(session ?? workspace);
-
-  // Live snapshots / streams reflect the shared plane — read them off the parent's controllers.
-  // compat/onLawChanged are LAW-scoped, so a session answers for ITS workspace (falling back to the
-  // plane-wide value when the runner's events carry no session key — older bundles).
-  @override
-  NomosCompat? get compat =>
-      parent._lastCompatBySession[workspace] ?? parent.compat;
-  @override
-  Stream<NomosCompat> get onLawChanged => (parent._lawChangedBySession[
-          workspace] ??=
-      StreamController<NomosCompat>.broadcast()).stream;
-  @override
-  Map<String, Object?>? get lastRecovery => parent.lastRecovery;
-  @override
-  Stream<Map<String, Object?>> get syncEvents => parent.syncEvents;
-  @override
-  Stream<TransferProgress> get transferProgress => parent.transferProgress;
-  @override
-  Stream<SyncStatus> get syncStatus => parent.syncStatus;
-  @override
-  SyncStatus get currentStatus => parent.currentStatus;
-  @override
-  Stream<Map<String, Object?>> get signalEvents => parent.signalEvents;
-  @override
-  Stream<Map<String, Object?>> get flameEvents => parent.flameEvents;
-  @override
-  Stream<Map<String, Object?>> get spanEvents => parent.spanEvents;
-  @override
-  List<Map<String, Object?>> get recentSpans => parent.recentSpans;
+  // NO per-method Stream/watch/snapshot overrides live here anymore — the base class routes ALL event
+  // dispatch + plane state through [_eventPlane] (and law-scopes compat/onLawChanged via [_sessionName]),
+  // and the watch ops still carry this session's workspace because their registration goes through the
+  // overridden [_call]. Adding a `Stream`-returning override below is almost certainly re-opening the
+  // dead-registry bug class — see `test/event_plane_seam_test.dart`.
 }
 
 /// THE BRIDGE-BACKED FOREIGN READER — a [NomosForeignReader] over a device's multi-workspace [NomosBridge]

package/dart/pubspec.yaml

@@ -11,7 +11,7 @@ description: >-
   Nomos 2 Dart frontend types — the hand-written kernel wire types plus the
   code-generated per-domain aggregate + directive-payload types. (De)serializes
   the EXACT serde JSON the Rust kernel + projection produce/consume.
-version: 0.50.0
+version: 0.51.0
 
 environment:
   sdk: ^3.5.0

package/dart/test/acquire_session_credentials_test.dart

@@ -0,0 +1,132 @@
+// ACQUIRE-SESSION: THE GENUINE CLOUD-OPEN LANE (task #86 gaps 1+2). The gauntlet proved the
+// credential-FREE lanes (known workspace, single-flight); this test drives the one lane it could
+// not: a workspace that is NOWHERE on the local plane, where [ifAbsentCredentials] MUST be invoked
+// — exactly once, even under a concurrent double-acquire — and the connect is made with what it
+// returns. Runs hermetically on the offline runner (the "cloud" is the runner's offline shim, so
+// no network is ever contacted; what is under test is the acquire protocol, not the transport).
+//
+// This file also IS the gap-1 regression: it imports ONLY `nomos_headless.dart` and TYPES a
+// `Future<NomosSessionCredentials> Function()` callback — before the barrel fix that did not compile.
+@TestOn('vm')
+library;
+
+import 'dart:async';
+import 'dart:io';
+
+import 'package:nomos_client/nomos_headless.dart';
+import 'package:test/test.dart';
+
+String get _root => '${Directory.current.path}/../..';
+String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.mjs';
+String get _docsDeploy => '$_root/bench/scale/fixtures/surfaced/build/surfaced.deploy.json';
+String get _runtimeDir =>
+    Platform.environment['NOMOS_DART_RUNTIME'] ??
+    '${Platform.environment['HOME'] ?? ''}/.holon/runtime';
+
+String? _missingPrereq() {
+  if (!File(_repoEntry).existsSync()) return 'in-repo runner not found at $_repoEntry';
+  if (!File(_docsDeploy).existsSync()) {
+    return 'missing fixture $_docsDeploy — compile it: '
+        '(cd bench/scale/fixtures/surfaced && node ../../../../dsl/compile_package.mjs)';
+  }
+  if (!File('$_runtimeDir/holon.wasm').existsSync() ||
+      !File('$_runtimeDir/packages.json').existsSync()) {
+    return 'warm ~/.holon/runtime first (run any `githolon` command once)';
+  }
+  return null;
+}
+
+Future<T> _leg<T>(String name, Future<T> Function() body) async {
+  final sw = Stopwatch()..start();
+  // ignore: avoid_print
+  print('▶ ACQUIRE $name …');
+  try {
+    final r = await body();
+    // ignore: avoid_print
+    print('✔ ACQUIRE $name (${sw.elapsedMilliseconds}ms)');
+    return r;
+  } catch (e, st) {
+    throw TestFailure('ACQUIRE $name FAILED after ${sw.elapsedMilliseconds}ms:\n$e\n$st');
+  }
+}
+
+void main() {
+  test('acquireSession: the absent-workspace lane invokes ifAbsentCredentials exactly once',
+      () async {
+    final missing = _missingPrereq();
+    if (missing != null) {
+      markTestSkipped(missing);
+      return;
+    }
+    final harness = await NomosTestHarness.ephemeral(
+      deployJsonPaths: [_docsDeploy],
+      workspace: 'acquire-home',
+      nodeEntry: _repoEntry,
+      runtimeDir: _runtimeDir,
+      phaseTimeout: const Duration(seconds: 120),
+    );
+    try {
+      final plane = harness.bridge;
+
+      // ── LEG 1 (gap 1, compile-time + runtime): the callback TYPE is reachable from the headless
+      //    barrel alone, and a credentials object constructs with the documented fields. ──
+      await _leg('leg 1: NomosSessionCredentials is exported from nomos_headless', () async {
+        // ignore: prefer_function_declarations_over_variables
+        final Future<NomosSessionCredentials> Function() typedCallback = () async =>
+            const NomosSessionCredentials(cloud: 'https://offline.invalid', allowUnborn: true);
+        final c = await typedCallback();
+        expect(c.cloud, 'https://offline.invalid');
+        expect(c.allowUnborn, isTrue);
+      });
+
+      // ── LEG 2: a genuinely-absent workspace WITHOUT a callback is a NAMED StateError, never a
+      //    silent cloudless mount. ──
+      await _leg('leg 2: absent workspace without credentials refuses (StateError)', () async {
+        await expectLater(
+            plane.acquireSession('nowhere-at-all'),
+            throwsA(isA<StateError>().having((e) => e.toString(), 'message',
+                contains('ifAbsentCredentials'))));
+      });
+
+      // ── LEG 3: THE CLOUD-OPEN LANE — an absent workspace + a concurrent double-acquire: the
+      //    callback fires EXACTLY ONCE (single-flight), the connect is made with its credentials,
+      //    and both callers get the SAME mounted session. ──
+      var invocations = 0;
+      await _leg('leg 3: concurrent double-acquire → one credentials invocation, one handle',
+          () async {
+        Future<NomosSessionCredentials> creds() async {
+          invocations++;
+          return const NomosSessionCredentials(
+              cloud: 'https://offline.invalid', clientId: 'acquired-client', allowUnborn: true);
+        }
+
+        final acquired = await Future.wait([
+          plane.acquireSession('cloud-opened-ws', ifAbsentCredentials: creds),
+          plane.acquireSession('cloud-opened-ws', ifAbsentCredentials: creds),
+        ]).timeout(const Duration(seconds: 60),
+            onTimeout: () => throw StateError('the cloud-open acquire never completed'));
+        expect(invocations, 1,
+            reason: 'a concurrent double-acquire must invoke the credentials callback ONCE');
+        expect(identical(acquired[0], acquired[1]), isTrue,
+            reason: 'both concurrent acquirers get the SAME session handle');
+        expect(acquired[0].workspace, 'cloud-opened-ws');
+        final listed = await plane.listWorkspaces();
+        expect(listed.map((w) => w['session'].toString()), contains('cloud-opened-ws'),
+            reason: 'the acquired workspace is mounted on the plane');
+      });
+
+      // ── LEG 4: a re-acquire of the now-mounted workspace hits the fast path — the callback is
+      //    NEVER invoked again. ──
+      await _leg('leg 4: re-acquire is credential-free (fast path)', () async {
+        final again = await plane.acquireSession('cloud-opened-ws',
+            ifAbsentCredentials: () async =>
+                fail('the workspace is mounted — credentials must not be requested'));
+        expect(again.workspace, 'cloud-opened-ws');
+        expect(invocations, 1);
+      });
+    } finally {
+      await harness.dispose().timeout(const Duration(seconds: 30),
+          onTimeout: () => throw StateError('harness disposal hung'));
+    }
+  }, timeout: const Timeout(Duration(minutes: 5)));
+}

package/dart/test/cluster_births_test.dart

@@ -23,7 +23,6 @@ library;
 
 import 'dart:io';
 
-import 'package:nomos_client/nomos_client.dart' show NomosOfferOutcome;
 import 'package:nomos_client/nomos_headless.dart';
 import 'package:test/test.dart';