@githolon/dsl 0.92.0 → 0.94.0

package/dart/lib/src/dev_cloud.dart

@@ -84,7 +84,7 @@ class NomosTestCloud {
 
   /// Start the test cloud: spawn `node <serverEntry> --port <n> [--ephemeral] [--data <dir>]`, wait until its
   /// `/health` answers, then bring up the partition proxy in front of it. [serverEntry] is the dev-server
-  /// entry (`cloud/dev-server/server.mjs` in-repo, or `dist/dev-server.mjs` from a published `githolon`) — the
+  /// entry (`cloud/dev-server/server.ts` in-repo, or `dist/dev-server.mjs` from a published `githolon`) — the
   /// caller resolves it (the same seam the offline harness uses for its install helper). [node] defaults to
   /// `node` on PATH.
   static Future<NomosTestCloud> start({

package/dart/lib/src/node_runner_transport.dart

@@ -1,5 +1,5 @@
 // THE HEADLESS (NODE) TRANSPORT — a [BridgeTransport] over the `@githolon/client` node runner
-// (`runner/node-entry.mjs`), spawned as a plain child process speaking the ONE bridge protocol as
+// (`runner/node-entry.ts`), spawned as a plain child process speaking the ONE bridge protocol as
 // newline-delimited JSON on stdio. This is what lets `dart test` / `flutter test` / CI drive the REAL
 // githolon (the byte-identical wasm, the real ledger, the real gate) through [NomosBridge] and the
 // generated typed clients — no Flutter plugins, no WebView, no assets. The only environment requirement
@@ -62,8 +62,8 @@ class NodeRunnerTransport implements BridgeTransport {
   /// [NomosBridge] and `await bridge.ready` (the runner posts `{event:'ready'}`
   /// on boot), then `connect(...)` as any other transport.
   ///
-  /// [entry] — path to `node-entry.mjs`. When omitted it is resolved with
-  /// `require.resolve('@githolon/client/runner/node-entry.mjs')` from
+  /// [entry] — path to `node-entry.ts`. When omitted it is resolved with
+  /// `require.resolve('@githolon/client/runner/node-entry.ts')` from
   /// [resolveFrom] (default: the current directory), i.e. the consuming app's
   /// own `node_modules`.
   static Future<NodeRunnerTransport> start({
@@ -87,13 +87,13 @@ class NodeRunnerTransport implements BridgeTransport {
   static Future<String> _resolveEntry(String node, String from) async {
     final r = await Process.run(
       node,
-      ['-p', "require.resolve('@githolon/client/runner/node-entry.mjs')"],
+      ['-p', "require.resolve('@githolon/client/runner/node-entry.ts')"],
       workingDirectory: from,
     );
     final out = (r.stdout as String).trim();
     if (r.exitCode != 0 || out.isEmpty) {
       throw StateError(
-          'cannot resolve @githolon/client/runner/node-entry.mjs from $from — '
+          'cannot resolve @githolon/client/runner/node-entry.ts from $from — '
           'is @githolon/client installed (npm install)? stderr: ${r.stderr}');
     }
     return out;

package/dart/lib/src/test_harness.dart

@@ -16,18 +16,18 @@
 // ```
 //
 // HOW IT STAYS OFFLINE. Two node children, both talking only to the local disk:
-//   1. `offline-install.mjs` runs the PROVEN offline install lane (`githolon proof`'s adapter engine) —
+//   1. `offline-install.ts` runs the PROVEN offline install lane (`githolon proof`'s adapter engine) —
 //      genesis → framework controller → each tenant package's `installDomain`, folded through the ONE gate —
 //      and serializes the workspace tree to a snapshot in a fresh temp dir.
-//   2. the node runner (`node-entry.mjs`) boots in `NOMOS_OFFLINE=1` mode: it serves the runtime wasm from the
+//   2. the node runner (`node-entry.ts`) boots in `NOMOS_OFFLINE=1` mode: it serves the runtime wasm from the
 //      local cache (`~/.holon/runtime`, filled by any warm `githolon` run) and boots the holon from that
 //      snapshot (`restoreFrom`). Every other URL is REFUSED — a stray fetch fails loudly, never reaches the net.
 //
 // PREREQUISITES (documented so a failure is legible): `node` on PATH; a resolvable
-// `@githolon/client/runner/node-entry.mjs`; and a warm `~/.holon/runtime` cache (holon.wasm + packages.json —
+// `@githolon/client/runner/node-entry.ts`; and a warm `~/.holon/runtime` cache (holon.wasm + packages.json —
 // one `githolon` run fills it). All local; no network at test time.
 //
-// PACKAGING NOTE: `offline-install.mjs` imports the adapter engine, which today lives beside the in-repo
+// PACKAGING NOTE: `offline-install.ts` imports the adapter engine, which today lives beside the in-repo
 // runner. For a PUBLISHED harness this install belongs behind a `githolon` subcommand (the CLI already
 // bundles the engine + this exact sequence in `proof_offline`); [installHelper] is the one seam to repoint.
 import 'dart:convert';
@@ -246,10 +246,10 @@ class NomosTestHarness {
   /// framework/platform law before a domain that depends on it).
   /// [workspace] — the local workspace name (default `test-ws`; law-only, never leaves the machine).
   /// [runtimeDir] — the runtime cache (default `~/.holon/runtime`); must hold `holon.wasm` + `packages.json`.
-  /// [nodeEntry] — path to `node-entry.mjs`; when omitted it is resolved from [resolveFrom] via
-  /// `require.resolve('@githolon/client/runner/node-entry.mjs')`.
+  /// [nodeEntry] — path to `node-entry.ts`; when omitted it is resolved from [resolveFrom] via
+  /// `require.resolve('@githolon/client/runner/node-entry.ts')`.
   /// [installHelper] — the offline law-install lane. An EXISTING `.mjs` file is run as a node script (the
-  /// in-repo `offline-install.mjs`, the default when it exists beside [nodeEntry]); anything else is a
+  /// in-repo `offline-install.ts`, the default when it exists beside [nodeEntry]); anything else is a
   /// githolon COMMAND LINE whose `harness-install` subcommand is driven (the default `npx githolon` when the
   /// in-repo helper is absent — a published tenant needs nothing but `githolon`). E.g. force the subcommand
   /// with `installHelper: 'node /abs/cli/dist/cli.mjs'`.
@@ -280,14 +280,14 @@ class NomosTestHarness {
     final entry = nodeEntry ??
         await _resolveEntry(node, resolveFrom ?? Directory.current.path);
     // THE INSTALL LANE. [installHelper] is the one seam (PACKAGING NOTE above): either the in-repo
-    // `offline-install.mjs` node script, OR the published `githolon harness-install` subcommand (the CLI
+    // `offline-install.ts` node script, OR the published `githolon harness-install` subcommand (the CLI
     // bundles the engine + this exact install sequence, so a published tenant needs nothing but `githolon`).
     //  • an EXISTING `.mjs` file  ⇒ run it as a node script (the in-repo default when present);
     //  • anything else            ⇒ treat it as a githolon COMMAND LINE and drive `harness-install`
     //    (default `npx githolon` when the in-repo helper is absent; the test forces this lane by passing
     //    e.g. `installHelper: 'node /abs/cli/dist/cli.mjs'`).
     final resolvedHelper =
-        installHelper ?? '${File(entry).parent.path}/offline-install.mjs';
+        installHelper ?? '${File(entry).parent.path}/offline-install.ts';
     final useInRepoScript =
         resolvedHelper.endsWith('.mjs') && File(resolvedHelper).existsSync();
     final githolonCmd = installHelper == null ? 'npx githolon' : resolvedHelper;
@@ -303,7 +303,7 @@ class NomosTestHarness {
       final info = await _phased(
           phase: '1/4: offline law install (${deployJsonPaths.length} package(s))',
           workspace: workspace,
-          awaiting: useInRepoScript ? 'offline-install.mjs' : 'githolon harness-install',
+          awaiting: useInRepoScript ? 'offline-install.ts' : 'githolon harness-install',
           timeout: phaseTimeout ?? _kInstallDeadline,
           onDiagnostic: onDiagnostic,
           likelyCauses: const [
@@ -465,7 +465,7 @@ class NomosTestHarness {
     final entry = nodeEntry ??
         await _resolveEntry(node, resolveFrom ?? Directory.current.path);
     final resolvedHelper =
-        installHelper ?? '${File(entry).parent.path}/offline-install.mjs';
+        installHelper ?? '${File(entry).parent.path}/offline-install.ts';
     final useInRepoScript =
         resolvedHelper.endsWith('.mjs') && File(resolvedHelper).existsSync();
     final githolonCmd = installHelper == null ? 'npx githolon' : resolvedHelper;
@@ -483,7 +483,7 @@ class NomosTestHarness {
         final info = await _phased(
             phase: '1: offline law install ${++_i}/${workspaces.length}',
             workspace: e.key,
-            awaiting: useInRepoScript ? 'offline-install.mjs' : 'githolon harness-install',
+            awaiting: useInRepoScript ? 'offline-install.ts' : 'githolon harness-install',
             timeout: phaseTimeout ?? _kInstallDeadline,
             onDiagnostic: onDiagnostic,
             likelyCauses: const [
@@ -911,7 +911,7 @@ class NomosTestHarness {
     final info = await _phased(
         phase: 'seed: offline law install',
         workspace: workspace,
-        awaiting: lane.useInRepoScript ? 'offline-install.mjs' : 'githolon harness-install',
+        awaiting: lane.useInRepoScript ? 'offline-install.ts' : 'githolon harness-install',
         timeout: _phaseTimeout ?? _kInstallDeadline,
         onDiagnostic: _onDiagnostic,
         run: () => _runInstall(
@@ -1106,7 +1106,7 @@ class NomosTestHarness {
           githolonCmd.trim().split(RegExp(r'\s+')).where((t) => t.isNotEmpty).toList();
       if (tokens.isEmpty) {
         throw NomosTestHarnessException(
-            'no install helper resolved — pass installHelper: (an offline-install.mjs path, or a githolon command)');
+            'no install helper resolved — pass installHelper: (an offline-install.ts path, or a githolon command)');
       }
       executable = tokens.first;
       args = [...tokens.skip(1), 'harness-install', ...common];
@@ -1143,13 +1143,13 @@ class NomosTestHarness {
   static Future<String> _resolveEntry(String node, String from) async {
     final r = await Process.run(
       node,
-      ['-p', "require.resolve('@githolon/client/runner/node-entry.mjs')"],
+      ['-p', "require.resolve('@githolon/client/runner/node-entry.ts')"],
       workingDirectory: from,
     );
     final out = (r.stdout as String).trim();
     if (r.exitCode != 0 || out.isEmpty) {
       throw NomosTestHarnessException(
-          'cannot resolve @githolon/client/runner/node-entry.mjs from $from — '
+          'cannot resolve @githolon/client/runner/node-entry.ts from $from — '
           'is @githolon/client installed (npm install)? Pass nodeEntry: to override. stderr: ${r.stderr}');
     }
     return out;

package/dart/lib/src/webview_bridge.dart

@@ -48,7 +48,7 @@ const int kWebviewBridgeVersion = 1;
 /// pre-stamp bundle, which reports nothing) is a stale baked asset and fails loudly at boot.
 /// MUST move with the paired @githolon/client release — a release-hygiene test pairs it with the
 /// runner stamp (the pubspec-pins pattern).
-const String kExpectedRunnerBundleVersion = '0.80.0';
+const String kExpectedRunnerBundleVersion = '0.93.0';
 
 /// A STALE BAKED RUNNER BUNDLE: the app's built assets carry an older nomos-runner.js than this
 /// nomos_client release ships — Flutter's build cache kept it across a pub upgrade. Thrown from
@@ -1592,6 +1592,20 @@ class NomosBridge {
   /// [attestorSecret] is the source's base64 read-attestor secret (from [authorKeygen]); when omitted the
   /// source session's connect-time `authorSecret` signs. [nowMs] stamps the freshness clock (defaults to the
   /// source's own clock).
+  /// RELEASE COHERENCE — assert the connected cloud's kernel supports every capability this law needs (the
+  /// generated client passes its baked `requiresKernel`, e.g. `['compoundKeys']` for a compound-key query).
+  /// Throws a typed [KernelCoherenceError] on a skew (a stale/mismatched cloud kernel) with the named reason,
+  /// instead of an opaque deep-fold refusal. A best-effort no-op when the cloud advertises no capabilities
+  /// (older worker / offline). Called automatically by the generated client at bind; safe to call directly.
+  Future<void> assertKernelCoherence(List<String> requiresKernel,
+      {String? lawHash, String? session}) async {
+    await _call('assertKernelCoherence', {
+      'requiresKernel': requiresKernel,
+      if (lawHash != null) 'lawHash': lawHash,
+      if (session != null) 'session': session,
+    });
+  }
+
   Future<Map<String, Object?>> attestedRead({
     required String from,
     required String queryId,

package/dart/pubspec.lock

@@ -191,7 +191,7 @@ packages:
       path: "../dart_types"
       relative: true
     source: path
-    version: "0.4.1"
+    version: "0.5.0"
   package_config:
     dependency: transitive
     description:

package/dart/test/acquire_session_credentials_test.dart

@@ -17,7 +17,7 @@ import 'package:nomos_client/nomos_headless.dart';
 import 'package:test/test.dart';
 
 String get _root => '${Directory.current.path}/../..';
-String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.mjs';
+String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
 String get _docsDeploy => '$_root/bench/scale/fixtures/surfaced/build/surfaced.deploy.json';
 String get _runtimeDir =>
     Platform.environment['NOMOS_DART_RUNTIME'] ??

package/dart/test/adv_realm_interference_test.dart

@@ -25,8 +25,8 @@ import 'package:nomos_types/nomos_types.dart' show NomosRef;
 import 'package:test/test.dart';
 
 String get _root => '${Directory.current.path}/../..';
-String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.mjs';
-String get _installer => '$_root/cloud/web-client/runner/offline-install.mjs';
+String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
+String get _installer => '$_root/cloud/web-client/runner/offline-install.ts';
 String get _guestbook => '$_root/examples/guestbook/build/guestbook.deploy.json';
 String get _surfaced => '$_root/bench/scale/fixtures/surfaced/build/surfaced.deploy.json';
 String get _attributed => '$_root/bench/scale/fixtures/attributed/build/attributed.deploy.json';

package/dart/test/cloud_bound_topology_test.dart

@@ -21,8 +21,8 @@ import 'package:nomos_client/nomos_headless.dart';
 import 'package:test/test.dart';
 
 String get _root => '${Directory.current.path}/../..';
-String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.mjs';
-String get _devServer => '$_root/cloud/dev-server/server.mjs';
+String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
+String get _devServer => '$_root/cloud/dev-server/server.ts';
 String get _deploy =>
     '$_root/bench/scale/fixtures/cloud-topology/build/cloud-topology.deploy.json';
 const _subject = 'user:topology-test';

package/dart/test/cluster_attested_test.dart

@@ -26,7 +26,7 @@ import 'package:test/test.dart';
 import '../../../bench/scale/fixtures/catalogue-reader/build/dart/src/generated/estate.client.dart';
 
 String get _root => '${Directory.current.path}/../..';
-String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.mjs';
+String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
 String get _catDeploy => '$_root/bench/scale/fixtures/catalogue-src/build/cat.deploy.json';
 String get _estateDeploy => '$_root/bench/scale/fixtures/catalogue-reader/build/estate.deploy.json';
 String get _estateClientDart =>

package/dart/test/cluster_births_test.dart

@@ -27,7 +27,7 @@ import 'package:nomos_client/nomos_headless.dart';
 import 'package:test/test.dart';
 
 String get _root => '${Directory.current.path}/../..';
-String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.mjs';
+String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
 String get _birthDeploy =>
     '$_root/bench/scale/fixtures/estate-birth/build/estate-birth.deploy.json';
 String get _runtimeDir => '${Platform.environment['HOME'] ?? ''}/.holon/runtime';

package/dart/test/cluster_device_keyed_acceptance_test.dart

@@ -17,7 +17,7 @@ import 'package:nomos_client/nomos_headless.dart';
 import 'package:test/test.dart';
 
 String get _root => '${Directory.current.path}/../..';
-String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.mjs';
+String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
 String get _catDeploy => '$_root/bench/scale/fixtures/catalogue-src/build/cat.deploy.json';
 String get _estateDeploy => '$_root/bench/scale/fixtures/catalogue-reader/build/estate.deploy.json';
 String get _runtimeDir => '${Platform.environment['HOME'] ?? ''}/.holon/runtime';

package/dart/test/cluster_local_autosync_test.dart

@@ -15,7 +15,7 @@ import 'package:nomos_client/nomos_headless.dart';
 import 'package:test/test.dart';
 
 String get _root => '${Directory.current.path}/../..';
-String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.mjs';
+String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
 String get _guestbookDeploy => '$_root/examples/guestbook/build/guestbook.deploy.json';
 String get _runtimeDir => '${Platform.environment['HOME'] ?? ''}/.holon/runtime';
 

package/dart/test/cluster_scale_test.dart

@@ -15,7 +15,7 @@ import 'package:nomos_client/nomos_headless.dart';
 import 'package:test/test.dart';
 
 String get _root => '${Directory.current.path}/../..';
-String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.mjs';
+String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
 String get _guestbookDeploy => '$_root/examples/guestbook/build/guestbook.deploy.json';
 String get _runtimeDir => '${Platform.environment['HOME'] ?? ''}/.holon/runtime';
 

package/dart/test/co2_acceptance_test.dart

@@ -13,7 +13,7 @@ import 'package:test/test.dart';
 import '../../../bench/scale/fixtures/co2-acceptance/build/dart/src/generated/estate.client.dart';
 
 String get _root => '${Directory.current.path}/../..';
-String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.mjs';
+String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
 String get _deployJson =>
     '$_root/bench/scale/fixtures/co2-acceptance/build/co2-acceptance.deploy.json';
 String get _runtimeDir => '${Platform.environment['HOME'] ?? ''}/.holon/runtime';

package/dart/test/dlq_session_surface_test.dart

@@ -19,7 +19,7 @@ import 'package:nomos_client/nomos_headless.dart';
 import 'package:test/test.dart';
 
 String get _root => '${Directory.current.path}/../..';
-String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.mjs';
+String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
 String get _geoDeploy => '$_root/bench/scale/fixtures/estate-geo/build/estate-geo.deploy.json';
 String get _docsDeploy => '$_root/bench/scale/fixtures/surfaced/build/surfaced.deploy.json';
 String get _runtimeDir =>

package/dart/test/first_app_gauntlet_test.dart

@@ -24,7 +24,7 @@ import '../../../bench/scale/fixtures/estate-birth/build/dart/src/generated/esta
     show EstateClient, SeedEstateWorkspacePayload;
 
 String get _root => '${Directory.current.path}/../..';
-String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.mjs';
+String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
 String get _homeDeploy =>
     '$_root/bench/scale/fixtures/estate-birth/build/estate-birth.deploy.json';
 String get _docsDeploy => '$_root/bench/scale/fixtures/surfaced/build/surfaced.deploy.json';

package/dart/test/local_sync_inert_test.dart

@@ -13,7 +13,7 @@ import 'package:test/test.dart';
 import '../../../bench/scale/fixtures/estate-birth/build/dart/src/generated/home.client.dart';
 
 String get _root => '${Directory.current.path}/../..';
-String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.mjs';
+String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
 String get _deployJson =>
     '$_root/bench/scale/fixtures/estate-birth/build/estate-birth.deploy.json';
 String get _runtimeDir =>

package/dart/test/node_runner_transport_test.dart

@@ -1,4 +1,4 @@
-// The headless transport against the REAL node runner (`cloud/web-client/runner/node-entry.mjs`):
+// The headless transport against the REAL node runner (`cloud/web-client/runner/node-entry.ts`):
 // protocol round-trip through NomosBridge without touching the cloud — ready handshake, typed refusal
 // on a pre-connect op, unknown-op error. The live connect path is covered by the env-gated smoke below.
 @TestOn('vm')
@@ -13,9 +13,9 @@ import 'package:test/test.dart';
 String _repoEntry() {
   // In-repo the runner lives beside us; consumers resolve it from node_modules instead.
   final here = Directory.current.path;
-  final p = '$here/../../cloud/web-client/runner/node-entry.mjs';
+  final p = '$here/../../cloud/web-client/runner/node-entry.ts';
   if (!File(p).existsSync()) {
-    throw StateError('node-entry.mjs not found at $p');
+    throw StateError('node-entry.ts not found at $p');
   }
   return p;
 }

package/dart/test/parent_signer_recovery_test.dart

@@ -22,7 +22,7 @@ import 'package:nomos_types/nomos_types.dart'
 import 'package:test/test.dart';
 
 String get _root => '${Directory.current.path}/../..';
-String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.mjs';
+String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
 String get _deploy =>
     '$_root/bench/scale/fixtures/estate-birth-signed/build/estate-birth-signed.deploy.json';
 String get _runtimeDir => '${Platform.environment['HOME'] ?? ''}/.holon/runtime';

package/dart/test/sealing_client_test.dart

@@ -16,7 +16,7 @@ import 'package:nomos_client/nomos_headless.dart';
 import 'package:test/test.dart';
 
 String get _root => '${Directory.current.path}/../..';
-String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.mjs';
+String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
 String get _fixture => '$_root/cloud/web-client/test/fixtures/encrypted-notes';
 String get _deploy => '$_fixture/build/encrypted-notes.deploy.json';
 String get _lockfile => '$_fixture/nomos.stable-ids.json';

package/dart/test/session_bound_test.dart

@@ -27,7 +27,7 @@ import '../../../bench/scale/fixtures/estate-birth/build/dart/src/generated/esta
     show EstateClient, SeedEstateWorkspacePayload;
 
 String get _root => '${Directory.current.path}/../..';
-String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.mjs';
+String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
 String get _deployJson =>
     '$_root/bench/scale/fixtures/estate-birth/build/estate-birth.deploy.json';
 String get _otherDeployJson =>

package/dart/test/test_harness_test.dart

@@ -15,7 +15,7 @@ import 'package:nomos_client/nomos_headless.dart';
 import 'package:test/test.dart';
 
 String get _repoEntry =>
-    '${Directory.current.path}/../../cloud/web-client/runner/node-entry.mjs';
+    '${Directory.current.path}/../../cloud/web-client/runner/node-entry.ts';
 String get _guestbookDeployJson =>
     '${Directory.current.path}/../../examples/guestbook/build/guestbook.deploy.json';
 String get _runtimeDir =>

package/dart/test/vo_read_typing_test.dart

@@ -19,7 +19,7 @@ import 'package:test/test.dart';
 import '../../../bench/scale/fixtures/vo-read-typing/build/dart/src/generated/estate.dart';
 
 String get _root => '${Directory.current.path}/../..';
-String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.mjs';
+String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
 String get _deployJson =>
     '$_root/bench/scale/fixtures/vo-read-typing/build/vo-read-typing.deploy.json';
 String get _runtimeDir => '${Platform.environment['HOME'] ?? ''}/.holon/runtime';

package/dart/test/watch_after_offer_stall_test.dart

@@ -12,7 +12,7 @@ import 'package:nomos_client/nomos_headless.dart';
 import 'package:test/test.dart';
 
 String get _root => '${Directory.current.path}/../..';
-String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.mjs';
+String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
 String get _gbDeploy => '$_root/examples/guestbook/build/guestbook.deploy.json';
 String get _runtimeDir =>
     Platform.environment['NOMOS_DART_RUNTIME'] ??

package/dart/test/watch_surfaces_test.dart

@@ -20,7 +20,7 @@ import 'package:test/test.dart';
 import '../../../bench/scale/fixtures/co2-acceptance/build/dart/src/generated/estate.client.dart';
 
 String get _root => '${Directory.current.path}/../..';
-String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.mjs';
+String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
 String get _geoDeploy =>
     '$_root/bench/scale/fixtures/co2-acceptance/build/co2-acceptance.deploy.json';
 String get _actsDeploy =>

package/dart_types/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.5.0
+
+- Add typed `SourceSessionNotMounted` error (code `nomos.attested_read.source_not_mounted`) for the colocated attested-read fix — a foreign `read(q, {from})` whose source workspace isn't mounted now fails fast with a typed error + `mountSourceSession` remedy.
+
 ## 0.4.1
 
 - `canonicalPrincipal` / `signerObjectOf` — THE one principal normalizer (kernel truth:

package/dart_types/lib/src/errors.dart

@@ -29,6 +29,9 @@ NomosBridgeError nomosErrorFromInfo(NomosErrorInfo info) {
   if (info.code == 'nomos.attested_read.source_not_mounted') {
     return SourceSessionNotMounted.fromInfo(info);
   }
+  if (info.code == 'kernel-capability-skew') {
+    return KernelCoherenceError.fromInfo(info);
+  }
   return NomosBridgeError(info.message, info: info);
 }
 
@@ -480,6 +483,30 @@ class SourceSessionNotMounted extends NomosBridgeError {
       '${queryId != null ? ', query: $queryId' : ''}, recommendedAction: $recommendedAction): $message';
 }
 
+/// KERNEL COHERENCE SKEW (`kernel-capability-skew`) — the cloud this client connected to runs a kernel that
+/// does NOT support a capability this law requires (e.g. a compound-key query `.key(a, b)` needs
+/// `compoundKeys`, and the cloud's kernel is a STALE build that predates the compound-key read router). The
+/// generated client asserts this at bind (from its baked `requiresKernel`) against the cloud's advertised
+/// `/v1/runtime/capabilities`, so a stale/mismatched kernel is caught UP FRONT with a named reason — instead
+/// of the opaque "the read router supports exactly one" refusal deep in a law fold. Remedy: point at a cloud
+/// whose kernel is coherent with this release, or upgrade the cloud's kernel.
+class KernelCoherenceError extends NomosBridgeError {
+  /// The stable machine code — always `kernel-capability-skew`.
+  final String code;
+
+  KernelCoherenceError({
+    this.code = 'kernel-capability-skew',
+    required String message,
+    NomosErrorInfo? info,
+  }) : super(message, info: info);
+
+  factory KernelCoherenceError.fromInfo(NomosErrorInfo info) =>
+      KernelCoherenceError(code: info.code, message: info.message, info: info);
+
+  @override
+  String toString() => 'KernelCoherenceError: $message';
+}
+
 /// The custody phase a [CustodyError] was raised in.
 enum CustodyPhase { fold, author, fetch, unknown }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.92.0",
+  "version": "0.94.0",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/build_package.ts

@@ -237,7 +237,19 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   // byte-identical; a domain that DOES could not have deployed before without the author hand-writing this.
   const autoDeclaredEnsures: string[] = [];
   for (const ty of discoverUnsanctionedEnsures(directives, spec.domain ?? spec.name)) {
-    const agg = byId.get(ty);
+    let agg = byId.get(ty);
+    // SELF-CONTAINED FRAMEWORK RELATIONS: `seedHomeOwner`/`writeTuple` (and any `relateSubject`-style seat)
+    // upsert the canonical framework `RelationTuple` aggregate at a DETERMINISTIC id. A tenant that re-exports
+    // ONLY the seating directive (e.g. `seedHomeOwner`) — without also re-exporting `RelationTuple` + a
+    // `.ensures(RelationTuple)` directive — carries no RelationTuple handle, so the id-mint gate would refuse
+    // its reltuple id. RelationTuple is a UNIVERSAL framework aggregate (one canonical shape), so supply its
+    // handle here and carry it, making the seat self-contained. Narrow + regression-free: this fires ONLY when
+    // a domain writes RelationTuple WITHOUT carrying it — which fails today — so no already-compiling domain
+    // (which must already carry it) changes. Any OTHER uncarried type stays deferred to the runtime gate.
+    if (agg === undefined && ty === RelationTuple.id) {
+      agg = RelationTuple;
+      byId.set(RelationTuple.id, RelationTuple);
+    }
     // Only sanction a type whose handle this domain actually carries (its schema must be present for the
     // upsert to fold); a probe pointing at a foreign/unknown type is left to the runtime gate (no schema).
     if (agg === undefined) continue;

package/src/codegen_dart_client.ts

@@ -33,6 +33,7 @@ import type { Field } from "./fields.js";
 import type { Directive } from "./directive.js";
 import type { QueryDecl } from "./query.js";
 import type { DomainModule } from "./codegen_dart.js";
+import { requiredKernelFeatures } from "./kernel_capabilities.js";
 import {
   cap,
   readModelClassName,
@@ -170,6 +171,7 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
   const domain = mod.domain ?? mod.name;
   const className = dartClientClassName(domain);
   const hashConst = dartHashConstName(mod.name);
+  const requiresKernelFeats = requiredKernelFeatures([mod]);
   const supportImport =
     opts.supportImport === "package"
       ? "package:nomos_client/nomos_client.dart"
@@ -824,6 +826,10 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     `  /// THE STATIC INTERFACE DESCRIPTOR (session_bound_clients.md asks 5/9): what this client EXPECTS`,
     `  /// of the workspace it binds to — the domain key, the law hash it was generated against, and the`,
     `  /// structural interface (#72). Consumed by [bind] and by \`session.assertCompatible(${className}.interface)\`.`,
+    `  /// The kernel capabilities this law REQUIRES (release coherence): a compound-key query needs`,
+    `  /// 'compoundKeys', etc. [bind] asserts the connected cloud's kernel advertises these.`,
+    `  static const List<String> requiresKernel = [${requiresKernelFeats.map((f) => dartStr(f)).join(", ")}];`,
+    ``,
     `  static const NomosClientInterface interface = NomosClientInterface(`,
     `    domain: ${dartStr(domain)},`,
     `    expectedDomainHash: ${hashConst},`,
@@ -841,6 +847,10 @@ export function generateDartBridgeClient(mod: DomainModule, opts: DartBridgeClie
     `  /// first dispatch.`,
     `  static Future<${className}> bind(NomosSession session, {String? actor${encPresent ? ", NomosKeyStore? keyStore" : ""}}) async {`,
     `    await session.assertCompatible(interface);`,
+    `    // RELEASE COHERENCE: the cloud's kernel must support what this law needs (e.g. a compound-key query`,
+    `    // needs 'compoundKeys'). Throws a typed KernelCoherenceError on a stale/mismatched cloud kernel,`,
+    `    // up front — not an opaque deep-fold refusal. Best-effort (no-op if the cloud advertises no caps).`,
+    `    await session.assertKernelCoherence(requiresKernel, lawHash: ${hashConst});`,
     `    return ${className}(session, actor: actor${encPresent ? ", keyStore: keyStore" : ""}).._preflighted = true;`,
     `  }`,
     ``,

package/src/codegen_ts.ts

@@ -66,6 +66,19 @@ const tsGroupParam = (by: string) => {
   return parts.length <= 1 ? by : parts[0]! + parts.slice(1).map((p) => p[0]!.toUpperCase() + p.slice(1)).join("");
 };
 
+/** An object-literal / interface member KEY. Field LABELS may be dotted structural paths
+ *  (`spec.domainHash`, `status.phase`) or otherwise non-identifier — emitted bare they'd
+ *  parse as member access and break the file. A valid JS identifier is emitted verbatim;
+ *  anything else is quoted as a string-literal key (same runtime property, valid TS). */
+const tsKey = (name: string): string =>
+  /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name) ? name : JSON.stringify(name);
+
+/** OPTIONAL-CHAIN member access onto a value keyed by a possibly-dotted field label,
+ *  meant to follow a `?` (e.g. `x?${tsOptAccess(f)}`): `.foo` for an identifier,
+ *  `.["foo.bar"]` otherwise (bracket access preserves the single property). */
+const tsOptAccess = (name: string): string =>
+  /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name) ? `.${name}` : `.[${JSON.stringify(name)}]`;
+
 // ── NAME NORMALIZATION (no naming convention to learn) ────────────────────────────
 // `nomos.package.mjs` names and domain keys may be ANY string — kebab-case,
 // snake_case, space-separated, PascalCase. Artifact FILENAMES keep the raw name
@@ -1086,6 +1099,9 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     `   *  and the holon computes the LIVE per-member verdict on \`holon.compat\`. A KNOWN-incompatible directive`,
     `   *  then refuses CLIENT-SIDE at write time (LawMismatchError), never as a server 422. */`,
     `  checkCompat?(compat: { lawHash: string; interfaceHash: string; packageName: string }, requirement?: unknown): NomosCompatVerdict | null;`,
+    `  /** RELEASE COHERENCE: throws a typed KernelCoherenceError at bind if the cloud's kernel lacks a`,
+    `   *  capability this law requires (e.g. \`compoundKeys\`) — instead of an opaque deep fold refusal. */`,
+    `  assertKernelCoherence?(requiresKernel: readonly string[], opts?: { lawHash?: string }): unknown;`,
     `  /** The live compat verdict (set by checkCompat). \`has(memberId)\` is the dark-launch feature flag;`,
     `   *  \`refresh()\` re-derives against the current projection. Absent until the factory binds. */`,
     `  compat?: NomosCompatVerdict;`,
@@ -1483,7 +1499,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     for (const [, c] of [...contractByIdTs].sort(([a], [b]) => a.localeCompare(b))) {
       out.push(`export interface ${c.id}Contract {`);
       for (const [name, field] of Object.entries(c.fields)) {
-        out.push(`  ${name}?: ${tsTypeOfField(field as Field)};`);
+        out.push(`  ${tsKey(name)}?: ${tsTypeOfField(field as Field)};`);
       }
       out.push(`}`, ``);
     }
@@ -1522,14 +1538,14 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       const required = (field as Field).isFromBirth === true;
       const doc = nullDocLine(field);
       if (doc !== undefined) out.push(`  /** ${doc} */`);
-      out.push(`  ${name}${required ? "" : "?"}: ${tsTypeOfField(field as Field)};`);
+      out.push(`  ${tsKey(name)}${required ? "" : "?"}: ${tsTypeOfField(field as Field)};`);
       const fr = (field as { foreignRef?: { workspaceField: string; targetAggregateId: string } }).foreignRef;
       if (fr !== undefined) foreignRefFields.push({ agg: typeId, field: name, workspaceField: fr.workspaceField, target: fr.targetAggregateId });
     }
     if (attributed.length > 0) {
       out.push(
         `  /** attributed-read provenance (the reserved per-row map; prefer the generated accessors) */`,
-        `  "__prov"?: { ${attributed.map((f) => `${f}?: FieldProvenance`).join("; ")} };`,
+        `  "__prov"?: { ${attributed.map((f) => `${tsKey(f)}?: FieldProvenance`).join("; ")} };`,
       );
     }
     for (const extra of extrasByType.get(typeId) ?? []) out.push(extra);
@@ -1542,7 +1558,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
         ` * unknown-author fields omitted). */`,
         `export const ${ns}Provenance = {`,
         ...attributed.map(
-          (f) => `  ${f}: (data: ${typeId}Data): FieldProvenance | undefined => data.__prov?.${f},`,
+          (f) => `  ${tsKey(f)}: (data: ${typeId}Data): FieldProvenance | undefined => data.__prov?${tsOptAccess(f)},`,
         ),
         `  lastAuthors: (data: ${typeId}Data): Record<string, string> => {`,
         `    const out: Record<string, string> = {};`,
@@ -2109,6 +2125,9 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
             opts.interface !== undefined
               ? `  holon.checkCompat?.(${compatConstName(opts.packageName)}, ${interfaceConstName(opts.packageName)});`
               : `  holon.checkCompat?.(${compatConstName(opts.packageName)});`,
+            // RELEASE COHERENCE: throw a typed skew error AT BIND if the cloud's kernel lacks a capability
+            // this law requires (e.g. compoundKeys) — instead of the opaque deep fold refusal later.
+            `  holon.assertKernelCoherence?.(${compatConstName(opts.packageName)}.requiresKernel ?? [], { lawHash: ${compatConstName(opts.packageName)}.lawHash });`,
           ]
         : []),
       `  return {`,

package/src/compat_manifest.ts

@@ -17,4 +17,11 @@ export interface NomosCompat {
   readonly domains: Record<string, { readonly identityHash?: string }>;
   /** The generator provenance — the `@githolon/dsl` version + this manifest's schema. */
   readonly generator: { readonly dsl: string; readonly schema: number };
+  /** RELEASE COHERENCE (kernel_capabilities.ts): the named kernel capabilities this law
+   *  REQUIRES to fold (derived from its shape — e.g. `compoundKeys` for a `.key(a, b)` query).
+   *  connect() / deploy compares this against the target kernel's advertised capabilities and
+   *  fails with a TYPED message naming the mismatch, INSTEAD of the opaque deep-fold refusal.
+   *  Empty ⇒ no special capability needed (byte-identical to before this field for such a law
+   *  — but note: this manifest is frontend-only, never in the USD IR / domainHash). */
+  readonly requiresKernel: readonly string[];
 }

package/src/compile_package_main.ts

@@ -132,6 +132,7 @@ import { domainInterface, type DomainInterface } from "./shape_compat.js";
 import { generateTsProof, proofLegsIndex } from "./codegen_proof.js";
 import { checkDomainModules, formatFindings, hasRefusal } from "./law_check.js";
 import type { NomosCompat } from "./compat_manifest.js";
+import { requiredKernelFeatures, type FeatureProbeModule } from "./kernel_capabilities.js";
 
 const DSL_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 
@@ -2552,12 +2553,26 @@ async function main(): Promise<void> {
     const identityHash = identity.hashes[key];
     compatDomains[key] = identityHash === undefined ? {} : { identityHash };
   }
+  // RELEASE COHERENCE — the kernel capabilities this law REQUIRES (compound-key queries +
+  // era-key features). Baked into the client so connect() can check it against the target
+  // kernel's advertised capabilities BEFORE the law folds (kernel_capabilities.ts).
+  const requiresKernel = ((): string[] => {
+    const probes: FeatureProbeModule[] = domainModules.map((m) => (m.queries ? { queries: m.queries } : {}));
+    try {
+      const parsed = JSON.parse(usdJson) as { layers?: Record<string, unknown>[] };
+      for (const layer of parsed.layers ?? []) probes.push({ layer });
+    } catch {
+      /* shape-derived features (compoundKeys) still apply from the queries above */
+    }
+    return requiredKernelFeatures(probes);
+  })();
   const nomosCompat: NomosCompat = {
     packageName: cfg.name,
     lawHash: domainHash,
     interfaceHash: sha256HexUtf8(canonicalJson(packageInterface)),
     domains: compatDomains,
     generator: { dsl: dslVersion, schema: 1 },
+    requiresKernel,
   };
 
   // ── 3b. the OpenAPI spec — THE PACKAGE'S SELF-DESCRIPTION (the host's runtime routing table;
@@ -2766,9 +2781,34 @@ async function main(): Promise<void> {
       // files would false-fail every vendored fixture. Analyze the in-package set; note the loose remainder.
       const inPackage = emittedDart.filter((f) => pkgDirOf(f) !== undefined);
       const pkgDirs = [...new Set(inPackage.map(pkgDirOf).filter((d): d is string => d !== undefined))];
+      // DEV DOGFOOD LINK: when this compiler is running FROM SOURCE (a nomos2 checkout, NOT an installed
+      // node_modules copy), the emitted layered packages pin the PUBLISHED nomos_client/nomos_types — which
+      // necessarily LAG the local source the compiler was built alongside (tooling+client move in lockstep,
+      // CLAUDE.md). So the analyze gate must resolve against the LOCAL Dart source, else it judges freshly-
+      // emitted client code against a stale hosted runtime (e.g. a method the current codegen calls that the
+      // last publish predates). We write a `pubspec_overrides.yaml` pointing nomos_client/nomos_types at the
+      // repo's own `dsl/dart` / `dsl/dart_types`. An INSTALLED tenant (`npx githolon`, compiler under
+      // node_modules) gets NO override — it verifies against exactly the hosted runtime it will ship against.
+      const localDart = (() => {
+        const selfDir = path.dirname(fileURLToPath(import.meta.url));
+        if (selfDir.includes(`${path.sep}node_modules${path.sep}`)) return undefined;
+        const client = path.resolve(selfDir, "..", "dart");
+        const types = path.resolve(selfDir, "..", "dart_types");
+        if (existsSync(path.join(client, "pubspec.yaml")) && existsSync(path.join(types, "pubspec.yaml"))) {
+          return { client, types };
+        }
+        return undefined;
+      })();
       let dartMissing = false;
       let unresolved: string | undefined;
       for (const pkg of pkgDirs) {
+        if (localDart) {
+          const spec = readFileSync(path.join(pkg, "pubspec.yaml"), "utf8");
+          const lines = ["dependency_overrides:"];
+          if (/(^|\n)\s+nomos_client\s*:/.test(spec)) lines.push(`  nomos_client:`, `    path: ${localDart.client}`);
+          if (/(^|\n)\s+nomos_types\s*:/.test(spec)) lines.push(`  nomos_types:`, `    path: ${localDart.types}`);
+          if (lines.length > 1) writeFileSync(path.join(pkg, "pubspec_overrides.yaml"), lines.join("\n") + "\n", "utf8");
+        }
         try {
           execFileSync("dart", ["pub", "get"], { cwd: pkg, stdio: "pipe", encoding: "utf8" });
         } catch (e) {

package/src/framework/birth_meter.ts

@@ -15,7 +15,7 @@
  *   - {@link seedBirthPolicy}     — THE GENESIS SEED (A3, ungated like `seedGenesis`): the step a
  *       parent's birth recipe threads (`buildGenesisChain`'s `descendantPool`) so the child is BORN
  *       BOUNDED — the pool chains to root by induction (root bounds platforms, platforms bound
- *       homes, homes bound estates). Control-plane protected exactly like `seedGenesis`: the open
+ *       homes, homes bound projects). Control-plane protected exactly like `seedGenesis`: the open
  *       session lane structurally refuses control-plane intents, and post-genesis writes on a
  *       warranted workspace require signed authorship.
  *

package/src/framework/home.ts

@@ -84,7 +84,7 @@ export const HomeOwner = aggregate("HomeOwner", {
  * ownership RECORD; this relation is the AUTHORIZATION spine a tenant can compute from. `seedHomeOwner` seats
  * `(home:self, homeOwner, user:<owner>)` ATOMICALLY inside the same child genesis (before the warrant closes
  * bootstrap), so a canonical `birthHome` yields a home whose owner passes role gates from intent 0 — a tenant
- * declares `estateCreator = computed(homeOwner)` WITHOUT copying birth mechanics. Self-bound (object `home:
+ * declares `projectCreator = computed(homeOwner)` WITHOUT copying birth mechanics. Self-bound (object `home:
  * self`, subject the owner) — the {@link homeNameBindsOwner} squat invariant already proves the owner is the
  * rightful one, so no separate grant is needed.
  */

package/src/framework/workspaces.ts

@@ -582,7 +582,7 @@ export function buildGenesisChain(p: {
   // child is BORN BOUNDED — a `seedBirthPolicy` genesis step writes the child's own BirthPolicy singleton
   // (its default birth allowance) BEFORE the warrant lands, exactly like every other genesis seed (the
   // still-warrant-free prefix runs unsigned). Root bounds platforms (this pool), platforms bound homes,
-  // homes bound estates — the tree meters by induction, with zero cross-workspace reads on any gate.
+  // homes bound projects — the tree meters by induction, with zero cross-workspace reads on any gate.
   // OPT-IN (deliberate): the step folds through the CHILD'S OWN gate under the law hash the order names,
   // so it may only be threaded when that law carries `seedBirthPolicy` (a law compiled under this DSL) —
   // an unconditional default would refuse the genesis of every birth pinning an OLDER law hash. V1

package/src/index.ts

@@ -148,6 +148,20 @@ export { repair, repairsOf, isRepairDecl, type RepairDecl, type RepairMatcher, t
 // `nomos-compile` REFUSES law that references read() (a named compile error, never a runtime halt).
 // The captured-reads wave (task #58) wires the capability in and lifts the refusal.
 export { read } from "./read.js";
+// RELEASE COHERENCE — the kernel capability stamp + law↔kernel fit check (kernel_capabilities.ts).
+export {
+  requiredKernelFeatures,
+  capabilitiesForKernelHash,
+  assessKernelCoherence,
+  KernelCoherenceError,
+  KERNEL_CAPABILITY_REGISTRY,
+  ERA_KEY_TO_FEATURE,
+  type KernelFeature,
+  type KernelStamp,
+  type KernelCoherenceVerdict,
+  type KernelRegistryEntry,
+  type FeatureProbeModule,
+} from "./kernel_capabilities.js";
 // ATTESTED CROSS-WORKSPACE READS (slice B — attested_reads_design.md): the declared trust
 // surface (`trustSource`), the foreign query reference, and the reader-side SourceFrontier.
 export {

package/src/kernel_capabilities.ts

@@ -0,0 +1,245 @@
+// RELEASE COHERENCE — the kernel capability stamp + the law↔kernel fit check.
+//
+// THE PROBLEM THIS SOLVES (the co2 skew, 2026-07): a published release can be
+// internally inconsistent. The production kernel accepts law that a compiler emits;
+// the DEV/test-mint kernel a `githolon cloud dev` serves can be STALE and REFUSE the
+// same law — but only at runtime, deep in a law fold ("query declares 2 index keys;
+// the read router supports exactly one"). Four artifacts drift independently:
+//   · the compiler (@githolon/dsl) that EMITS the law,
+//   · the runner bundle (@githolon/client) that RUNS it,
+//   · the production kernel wasm the cloud serves,
+//   · the test-mint kernel wasm the dev cloud serves.
+// There is NO version/hash check that catches the skew before the opaque refusal.
+//
+// THE FIX: a kernel advertises a VERSION + a set of named CAPABILITIES (feature flags
+// keyed to the era keys / read-router lanes it implements). A package DECLARES the
+// kernel capabilities its law REQUIRES (derived from its shape — e.g. a compound-key
+// query needs `compoundKeys`). Before the law ever folds, we compare the two and fail
+// with a TYPED, human-legible message NAMING the mismatch — not the deep refusal.
+//
+// This module is the SINGLE SOURCE OF TRUTH for: the capability vocabulary, deriving a
+// package's requirements from its shape, the known-kernel registry (keyed by wasm
+// sha256), and the coherence assessment. The CLI (`githolon doctor`, deploy), the
+// generated client (baked `requiresKernel`), and the cloud worker's
+// `/v1/runtime/capabilities` endpoint all draw on it.
+
+import type { QueryDecl } from "./query.js";
+
+/** A named kernel capability — a feature/lane the wasm kernel must implement for a law
+ *  that uses it to fold. Each maps to a read-router lane or an era key. Additive: a new
+ *  capability name is minted here the same day the kernel arm ships. */
+export type KernelFeature =
+  /** The read router accepts a query with MORE THAN ONE index key (`.key(a, b, …)`),
+   *  routing it as a compound (AND) intersection. Pre-this kernels refuse >1 index key
+   *  ("the read router supports exactly one"). THE CONCRETE co2 SKEW. */
+  | "compoundKeys"
+  /** The #58 captured-read lane (`read()` in deployable law + `.reads(query)`). */
+  | "capturedReads"
+  /** The #41 declared-invariant gate (`invariant` / `workspaceInvariant`). */
+  | "invariantGate"
+  /** Surfaced(inner) — retained concurrent competing values as a pending set. */
+  | "surfacedMerge"
+  /** `.attributed()` / aggregate `{attributed:true}` per-field provenance. */
+  | "fieldProvenance"
+  /** Null as an opt-in named capability (`admitsNull()`). */
+  | "nullSemantics"
+  /** Dynamic attested reads under a trustPolicy allowList. */
+  | "attestedReads";
+
+/** The USD-IR era key each derived-from-law capability rides on, for the requirement
+ *  derivation below (a package that emits the era key needs the capability). */
+export const ERA_KEY_TO_FEATURE: Readonly<Record<string, KernelFeature>> = {
+  nomosReadGate: "capturedReads",
+  nomosInvariantGate: "invariantGate",
+  nomosSurfaced: "surfacedMerge",
+  nomosAttributed: "fieldProvenance",
+  nomosNullable: "nullSemantics",
+  nomosAttestedReads: "attestedReads",
+};
+
+/** A minimal shape of a compiled domain module — enough to derive its kernel needs. */
+export interface FeatureProbeModule {
+  readonly queries?: readonly QueryDecl[];
+  /** The domain's USD-IR layer (the era keys ride here). Optional — shape-derived
+   *  features (compoundKeys) work without it. */
+  readonly layer?: Record<string, unknown>;
+}
+
+/** DERIVE the kernel capabilities a package's law REQUIRES, from its shape + era keys.
+ *  The result is a sorted, de-duped list baked into the client compat manifest and
+ *  checked against a target kernel's advertised capabilities before the law folds.
+ *
+ *  The load-bearing case: ANY query with a compound (`.key(a, b)`) index needs
+ *  `compoundKeys` — exactly the lane the stale test-mint kernel lacked. */
+export function requiredKernelFeatures(modules: readonly FeatureProbeModule[]): KernelFeature[] {
+  const needs = new Set<KernelFeature>();
+  for (const m of modules) {
+    for (const q of m.queries ?? []) {
+      if (Array.isArray(q.key) && q.key.length > 1) needs.add("compoundKeys");
+    }
+    if (m.layer) {
+      for (const [eraKey, feature] of Object.entries(ERA_KEY_TO_FEATURE)) {
+        if (m.layer[eraKey] !== undefined) needs.add(feature);
+      }
+    }
+  }
+  return [...needs].sort();
+}
+
+/** A kernel's self-description: its version tag + the capabilities it implements. This is
+ *  the shape the kernel stamps (see `kernelStamp` op in wasm_git_holon.rs) AND the shape
+ *  the host `/v1/runtime/capabilities` endpoint synthesizes for the deployed wasm it can't
+ *  yet ask (keyed by the wasm sha256 in the registry below). */
+export interface KernelStamp {
+  /** The kernel semver-ish version tag baked into the wasm at build. */
+  readonly version: string;
+  /** The wasm artifact sha256 (64-hex), when known. */
+  readonly hash?: string;
+  /** The named capabilities this kernel implements. */
+  readonly features: readonly KernelFeature[];
+  /** Human note (e.g. "production", "test-mint (DEV ONLY)") — surfaced in the skew message. */
+  readonly note?: string;
+}
+
+/** THE KNOWN-KERNEL REGISTRY — maps a kernel wasm sha256 PREFIX to its capability stamp.
+ *  Keyed by prefix so a short hash (the co2 report cites `846c6bf8` / `f81cb952`) resolves.
+ *
+ *  WHY host-side and not only asked of the kernel: the CURRENTLY-DEPLOYED stale kernel
+ *  predates the stamp op — it cannot answer "what are your capabilities?". Until every
+ *  serving kernel carries the in-wasm stamp, this registry lets the host + client resolve
+ *  a deployed wasm's capabilities from its BYTES, which is always available. A kernel that
+ *  DOES carry the stamp op is preferred; this is the fallback that works today.
+ *
+ *  Add an entry the moment a new kernel wasm is cut (its sha256 + the features it gained). */
+export interface KernelRegistryEntry extends KernelStamp {
+  readonly prefix: string;
+  /** Human note (e.g. "production", "test-mint (DEV ONLY)"). */
+  readonly note?: string;
+}
+
+export const KERNEL_CAPABILITY_REGISTRY: readonly KernelRegistryEntry[] = [
+  {
+    prefix: "846c6bf8",
+    version: "kernel-846c6bf8",
+    note: "production (accepts compound-key law)",
+    features: [
+      "compoundKeys",
+      "capturedReads",
+      "invariantGate",
+      "surfacedMerge",
+      "fieldProvenance",
+      "nullSemantics",
+      "attestedReads",
+    ],
+  },
+  {
+    // CURRENT test-mint kernel (rebuilt from the SAME source as prod 846c6bf8, 2026-07-14; staged to R2 +
+    // built/staged by deploy.sh every release). Feature-equivalent to production — the dev cloud is coherent.
+    prefix: "f6e44b3a",
+    version: "kernel-f6e44b3a",
+    note: "test-mint (DEV) — current, feature-equivalent to production",
+    features: [
+      "compoundKeys",
+      "capturedReads",
+      "invariantGate",
+      "surfacedMerge",
+      "fieldProvenance",
+      "nullSemantics",
+      "attestedReads",
+    ],
+  },
+  {
+    prefix: "f81cb952",
+    version: "kernel-f81cb952",
+    note: "test-mint (DEV ONLY — STALE: predates compound-key read router; superseded by f6e44b3a)",
+    features: [
+      "capturedReads",
+      "invariantGate",
+      "surfacedMerge",
+      "fieldProvenance",
+      "nullSemantics",
+      "attestedReads",
+    ],
+  },
+];
+
+/** Resolve a kernel wasm hash (full or short) to its known capability stamp, or `null`
+ *  when the hash is unknown to the registry (a kernel we've never catalogued). */
+export function capabilitiesForKernelHash(hash: string | undefined | null): KernelStamp | null {
+  if (typeof hash !== "string" || hash.length < 6) return null;
+  const h = hash.toLowerCase().replace(/^sha256:|^policy:/, "");
+  const hit = KERNEL_CAPABILITY_REGISTRY.find((e) => h.startsWith(e.prefix) || e.prefix.startsWith(h));
+  return hit
+    ? { version: hit.version, hash: h, features: hit.features, ...(hit.note ? { note: hit.note } : {}) }
+    : null;
+}
+
+/** The verdict of a law↔kernel coherence assessment. */
+export interface KernelCoherenceVerdict {
+  readonly ok: boolean;
+  /** The required features the target kernel does NOT advertise. Empty ⇒ coherent. */
+  readonly missing: KernelFeature[];
+  /** A human-legible one-line message — the thing surfaced INSTEAD of the deep fold refusal. */
+  readonly message: string;
+}
+
+/** ASSESS whether a target kernel can fold a package's law. `requires` is the package's
+ *  derived requirement ({@link requiredKernelFeatures}); `kernel` is the target's stamp
+ *  (from its stamp op, or {@link capabilitiesForKernelHash}). A `null` kernel stamp means
+ *  the target's capabilities are UNKNOWN — reported distinctly (can't prove coherence).
+ *
+ *  The message names BOTH hashes and the offending capability — the co2 skew, legibly. */
+export function assessKernelCoherence(params: {
+  requires: readonly KernelFeature[];
+  kernel: KernelStamp | null;
+  /** The target kernel's hash, for the message even when the stamp is unknown. */
+  kernelHash?: string;
+  /** The law's hash, for the message. */
+  lawHash?: string;
+}): KernelCoherenceVerdict {
+  const { requires, kernel } = params;
+  const short = (h?: string) => (h ? `${String(h).replace(/^sha256:|^policy:/, "").slice(0, 8)}` : "<unknown>");
+  const lawH = short(params.lawHash);
+  const kernH = short(params.kernelHash ?? kernel?.hash);
+  if (requires.length === 0) {
+    return { ok: true, missing: [], message: `law ${lawH} requires no special kernel capabilities` };
+  }
+  if (kernel === null) {
+    return {
+      ok: false,
+      missing: [...requires],
+      message:
+        `cannot verify release coherence — this cloud's kernel ${kernH} is UNKNOWN to the ` +
+        `capability registry, so it cannot be confirmed to support [${requires.join(", ")}] that ` +
+        `law ${lawH} requires. Update the kernel registry or upgrade the cloud's kernel.`,
+    };
+  }
+  const missing = requires.filter((f) => !kernel.features.includes(f)) as KernelFeature[];
+  if (missing.length === 0) {
+    return { ok: true, missing: [], message: `kernel ${kernH} supports all capabilities law ${lawH} requires` };
+  }
+  return {
+    ok: false,
+    missing,
+    message:
+      `this cloud's kernel ${kernH} lacks capability '${missing.join("', '")}' that law ${lawH} requires — ` +
+      `the cloud is running a STALE kernel (${kernel.note ?? kernel.version}). ` +
+      (missing.includes("compoundKeys")
+        ? `A compound-key query (\`.key(a, b, …)\`) will be refused deep in a law fold with ` +
+          `"query declares N index keys; the read router supports exactly one". `
+        : ``) +
+      `Upgrade the cloud's kernel (or point at a cloud whose kernel is coherent with this release).`,
+  };
+}
+
+/** A typed error thrown when a coherence assertion fails — carries the structured verdict so
+ *  callers can render it or branch, instead of parsing a message. */
+export class KernelCoherenceError extends Error {
+  readonly verdict: KernelCoherenceVerdict;
+  readonly code = "kernel-capability-skew";
+  constructor(verdict: KernelCoherenceVerdict) {
+    super(verdict.message);
+    this.name = "KernelCoherenceError";
+    this.verdict = verdict;
+  }
+}