githolon 0.110.1 → 0.111.1

package/README.md

@@ -0,0 +1,43 @@
+# Nomos developer CLI
+
+Compile a domain with `npx githolon compile` and run its generated Dart scenarios
+with `npx githolon test`. Each command has a focused `--help` page.
+
+## Check an installed stack
+
+From a consumer project with `githolon`, `@githolon/dsl` and `@githolon/testing`
+installed, run:
+
+```sh
+npx githolon conformance
+```
+
+The command reports the installed CLI, compiler, runtime and testing package
+versions and the kernel SHA-256 actually used. It compiles an isolated generated
+booking application with your installed compiler, then uses the existing real
+runtime harness to check a write, indexed and direct reads, an expected refusal
+with no effect, persisted Git history, and a cold restore followed by another
+write. It removes its temporary application and custody after the check.
+
+For CI, use `npx githolon conformance --json`. Exit status is 0 when all checks
+pass, 1 for a failed check, and 2 for invalid command options. A failure names the
+stage, diagnostic and next action. The JSON report includes `passed`, `packages`,
+`runtime`, `checks` and, on failure, `failure`.
+
+First use may download verified runtime artifacts. `--offline` forbids runtime
+acquisition from the network. To select an existing verified bundle explicitly:
+
+```sh
+npx githolon conformance --offline --runtime /path/to/runtime --json
+```
+
+The bundle contains `holon.wasm`, `kernel.repository.xml`, `bootstrap.law.usdz`
+and `nomos.law.usdz`; the existing runtime loader verifies compatibility and
+content identity. An invalid explicitly selected bundle fails rather than
+switching to a cached one.
+
+This checks the installed Node stack using a standard generated application.
+It does not run your application's own acceptance tests or qualify Flutter,
+cloud deployment or physical devices. Cold restore checks usable data and
+persisted history; the report says when deeper history verification is still
+materialising, rather than claiming a full historical audit.

package/dist/compile_mountability_entry.js

@@ -3349,7 +3349,7 @@ var init_recovery_desk_pb = __esm({
 // ../adapter/proto/nomos/runtime/v2/observability_desk_pb.js
 import { enumDesc as enumDesc15, fileDesc as fileDesc22, messageDesc as messageDesc22, tsEnum as tsEnum15 } from "@bufbuild/protobuf/codegenv2";
 import { file_google_protobuf_any as file_google_protobuf_any2 } from "@bufbuild/protobuf/wkt";
-var file_nomos_runtime_v2_observability_desk, RuntimeFailureSchema, RuntimeUnavailableSchema, RuntimeRefusalSchema, DiagnosticAttributeSchema, RuntimeEventSchema, FollowsSummarySchema, FollowObservationSchema, CredentialRefreshRequestedSchema, RuntimeReadySchema, WatchChangedSchema, SyncCompletedSchema, LinkChangedSchema, RuntimeSpanSchema, RuntimeFailureKindSchema, RuntimeFailureKind, RuntimeUnavailableReasonSchema, RuntimeUnavailableReason, RuntimeRefusalReasonSchema, RuntimeRefusalReason, FollowObservationPhaseSchema, FollowObservationPhase, LinkStatusSchema, LinkStatus;
+var file_nomos_runtime_v2_observability_desk, RuntimeFailureSchema, RuntimeUnavailableSchema, RuntimeRefusalSchema, DiagnosticAttributeSchema, RuntimeEventSchema, FollowsSummarySchema, FollowObservationSchema, CredentialRefreshRequestedSchema, RuntimeReadySchema, WatchChangedSchema, SyncCompletedSchema, LinkChangedSchema, RuntimeSpanSchema, WritePreparationSchema, RuntimeFailureKindSchema, RuntimeFailureKind, RuntimeUnavailableReasonSchema, RuntimeUnavailableReason, RuntimeRefusalReasonSchema, RuntimeRefusalReason, FollowObservationPhaseSchema, FollowObservationPhase, LinkStatusSchema, LinkStatus;
 var init_observability_desk_pb = __esm({
   "../adapter/proto/nomos/runtime/v2/observability_desk_pb.js"() {
     "use strict";
@@ -3361,7 +3361,7 @@ var init_observability_desk_pb = __esm({
     init_model_adoption_desk_pb();
     init_receiving_group_desk_pb();
     init_recovery_desk_pb();
-    file_nomos_runtime_v2_observability_desk = /* @__PURE__ */ fileDesc22("Cilub21vcy9ydW50aW1lL3YyL29ic2VydmFiaWxpdHlfZGVzay5wcm90bxIQbm9tb3MucnVudGltZS52MiJCCgxUcmFjZUNvbnRleHQSEAoIdHJhY2VfaWQYASABKAwSDwoHc3Bhbl9pZBgCIAEoDBIPCgdzYW1wbGVkGAMgASgIIp0CCg5SdW50aW1lRmFpbHVyZRIMCgRjb2RlGAEgASgJEg8KB21lc3NhZ2UYAiABKAkSEQoJY29tcG9uZW50GAMgASgJEhYKCXdvcmtzcGFjZRgEIAEoCUgAiAEBEhMKBmRvbWFpbhgFIAEoCUgBiAEBEhYKCWRpcmVjdGl2ZRgGIAEoCUgCiAEBEjkKCmF0dHJpYnV0ZXMYByADKAsyJS5ub21vcy5ydW50aW1lLnYyLkRpYWdub3N0aWNBdHRyaWJ1dGUSMgoEa2luZBgIIAEoDjIkLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZUZhaWx1cmVLaW5kQgwKCl93b3Jrc3BhY2VCCQoHX2RvbWFpbkIMCgpfZGlyZWN0aXZlIr4BChJSdW50aW1lVW5hdmFpbGFibGUSOgoGcmVhc29uGAEgASgOMioubm9tb3MucnVudGltZS52Mi5SdW50aW1lVW5hdmFpbGFibGVSZWFzb24SEQoJd29ya3NwYWNlGAIgASgJEhEKCXJldHJ5YWJsZRgDIAEoCBIfChJyZXRyeV9hZnRlcl9taWxsaXMYBCABKA1IAIgBARIOCgZkZXRhaWwYBSABKAlCFQoTX3JldHJ5X2FmdGVyX21pbGxpcyJ+Cg5SdW50aW1lUmVmdXNhbBI2CgZyZWFzb24YASABKA4yJi5ub21vcy5ydW50aW1lLnYyLlJ1bnRpbWVSZWZ1c2FsUmVhc29uEhEKCXdvcmtzcGFjZRgCIAEoCRIRCglyZXRyeWFibGUYAyABKAgSDgoGZGV0YWlsGAQgASgJIqUBChNEaWFnbm9zdGljQXR0cmlidXRlEgwKBG5hbWUYASABKAkSFgoMc3RyaW5nX3ZhbHVlGAIgASgJSAASFwoNaW50ZWdlcl92YWx1ZRgDIAEoEkgAEhYKDGRvdWJsZV92YWx1ZRgEIAEoAUgAEhcKDWJvb2xlYW5fdmFsdWUYBSABKAhIABIVCgtieXRlc192YWx1ZRgGIAEoDEgAQgcKBXZhbHVlIuMKCgxSdW50aW1lRXZlbnQSEAoIc2VxdWVuY2UYASABKAQSFAoHc2Vzc2lvbhgCIAEoCUgBiAEBEi8KBXJlYWR5GAogASgLMh4ubm9tb3MucnVudGltZS52Mi5SdW50aW1lUmVhZHlIABI3Cg13YXRjaF9jaGFuZ2VkGAsgASgLMh4ubm9tb3MucnVudGltZS52Mi5XYXRjaENoYW5nZWRIABI5Cg5zeW5jX2NvbXBsZXRlZBgMIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU3luY0NvbXBsZXRlZEgAEjUKDGxpbmtfY2hhbmdlZBgNIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuTGlua0NoYW5nZWRIABI5Cg5zaWduYWxfY2hhbmdlZBgOIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU2lnbmFsQ2hhbmdlZEgAEjsKD2N1c3RvZHlfY2hhbmdlZBgPIAEoCzIgLm5vbW9zLnJ1bnRpbWUudjIuQ3VzdG9keUNoYW5nZWRIABJCChNsb2NhbF93b3JrX3JlamVjdGVkGBAgASgLMiMubm9tb3MucnVudGltZS52Mi5Mb2NhbFdvcmtSZWplY3RlZEgAEjMKC2xhd19jaGFuZ2VkGBEgASgLMhwubm9tb3MucnVudGltZS52Mi5MYXdDaGFuZ2VkSAASQwoPa2VybmVsX3Byb2dyZXNzGBIgASgLMigubm9tb3MucnVudGltZS52Mi5LZXJuZWxQcm9ncmVzc09ic2VydmVkSAASLQoEc3BhbhgTIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZVNwYW5IABI/ChF0cmFuc2Zlcl9wcm9ncmVzcxgUIAEoCzIiLm5vbW9zLnJ1bnRpbWUudjIuVHJhbnNmZXJQcm9ncmVzc0gAEkkKFG1haW50ZW5hbmNlX3Byb2dyZXNzGBUgASgLMikubm9tb3MucnVudGltZS52Mi5SZWFkTWFpbnRlbmFuY2VQcm9ncmVzc0gAEjsKDXNvY2tldF9lZmZlY3QYFiABKAsyIi5ub21vcy5ydW50aW1lLnYyLlBlZXJTb2NrZXRFZmZlY3RIABJUChxjcmVkZW50aWFsX3JlZnJlc2hfcmVxdWVzdGVkGBcgASgLMiwubm9tb3MucnVudGltZS52Mi5DcmVkZW50aWFsUmVmcmVzaFJlcXVlc3RlZEgAElIKG3JlY2VpdmluZ19ncm91cF9jb252ZXJnZW5jZRgYIAEoCzIrLm5vbW9zLnJ1bnRpbWUudjIuUmVjZWl2aW5nR3JvdXBDb252ZXJnZW5jZUgAEkoKF21vZGVsX2Fkb3B0aW9uX3Byb2dyZXNzGBkgASgLMicubm9tb3MucnVudGltZS52Mi5Nb2RlbEFkb3B0aW9uUHJvZ3Jlc3NIABI7Cg9mb2xsb3dzX3N1bW1hcnkYGiABKAsyIC5ub21vcy5ydW50aW1lLnYyLkZvbGxvd3NTdW1tYXJ5SAASRAoUbG9jYWxfY29weV9wcmVzZXJ2ZWQYGyABKAsyJC5ub21vcy5ydW50aW1lLnYyLlByZXNlcnZlZExvY2FsQ29weUgAEk4KGWZvcmVpZ25fcGxhY2VtZW50X2lnbm9yZWQYHCABKAsyKS5ub21vcy5ydW50aW1lLnYyLkZvcmVpZ25QbGFjZW1lbnRJZ25vcmVkSAASQwoTYmluZGluZ19xdWFyYW50aW5lZBgdIAEoCzIkLm5vbW9zLnJ1bnRpbWUudjIuUXVhcmFudGluZWRCaW5kaW5nSABCBwoFZXZlbnRCCgoIX3Nlc3Npb24ivAEKDkZvbGxvd3NTdW1tYXJ5EhAKCGZvbGxvd2VkGAEgASgNEg8KB3NldHRsZWQYAiABKA0SDAoEbGl2ZRgDIAEoDRI3Cgp3b3Jrc3BhY2VzGAQgAygLMiMubm9tb3MucnVudGltZS52Mi5Gb2xsb3dPYnNlcnZhdGlvbhIkChdvYnNlcnZlZF9hdF91bml4X21pbGxpcxgFIAEoBEgAiAEBQhoKGF9vYnNlcnZlZF9hdF91bml4X21pbGxpcyLRAgoRRm9sbG93T2JzZXJ2YXRpb24SEQoJd29ya3NwYWNlGAEgASgJEjcKBXBoYXNlGAIgASgOMigubm9tb3MucnVudGltZS52Mi5Gb2xsb3dPYnNlcnZhdGlvblBoYXNlEgwKBGxpdmUYAyABKAgSEwoGZGV0YWlsGAQgASgJSACIAQESIQoUcmV0cnlfYXRfdW5peF9taWxsaXMYBSABKARIAYgBARIfChJkdWVfYXRfdW5peF9taWxsaXMYBiABKARIAogBARIUCgdhdHRlbXB0GAcgASgNSAOIAQESGgoNYWN0aXZlX2VmZmVjdBgIIAEoCUgEiAEBQgkKB19kZXRhaWxCFwoVX3JldHJ5X2F0X3VuaXhfbWlsbGlzQhUKE19kdWVfYXRfdW5peF9taWxsaXNCCgoIX2F0dGVtcHRCEAoOX2FjdGl2ZV9lZmZlY3QiVgoaQ3JlZGVudGlhbFJlZnJlc2hSZXF1ZXN0ZWQSOAoHcGVuZGluZxgBIAEoCzInLm5vbW9zLnJ1bnRpbWUudjIuQ29ycmVzcG9uZGVuY2VQZW5kaW5nIj4KDFJ1bnRpbWVSZWFkeRIXCg9ydW50aW1lX3ZlcnNpb24YASABKAkSFQoNa2VybmVsX3NoYTI1NhgCIAEoDCL8AQoMV2F0Y2hDaGFuZ2VkEhcKD3N1YnNjcmlwdGlvbl9pZBgBIAEoCRITCgtyZXN1bHRfdXNkYRgCIAEoDBI2CgdmYWlsdXJlGAMgASgLMiAubm9tb3MucnVudGltZS52Mi5SdW50aW1lRmFpbHVyZUgAiAEBEjUKEmFwcGxpY2F0aW9uX3Jlc3VsdBgEIAEoCzIULmdvb2dsZS5wcm90b2J1Zi5BbnlIAYgBARIaCg1pbnRlZ2VyX3ZhbHVlGAUgASgDSAKIAQFCCgoIX2ZhaWx1cmVCFQoTX2FwcGxpY2F0aW9uX3Jlc3VsdEIQCg5faW50ZWdlcl92YWx1ZSKcAQoNU3luY0NvbXBsZXRlZBIOCgZyZWFzb24YASABKAkSNwoGcmVzdWx0GAIgASgLMicubm9tb3MucnVudGltZS52Mi5TeW5jV29ya3NwYWNlUmVzcG9uc2USNgoHZmFpbHVyZRgDIAEoCzIgLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZUZhaWx1cmVIAIgBAUIKCghfZmFpbHVyZSI7CgtMaW5rQ2hhbmdlZBIsCgZzdGF0dXMYASABKA4yHC5ub21vcy5ydW50aW1lLnYyLkxpbmtTdGF0dXMiOAoNU2lnbmFsQ2hhbmdlZBIOCgZkb21haW4YASABKAkSFwoPcHJvamVjdGlvbl91c2RhGAIgASgMIlAKCkxhd0NoYW5nZWQSDgoGZG9tYWluGAEgASgJEhYKDnBhY2thZ2Vfc2hhMjU2GAIgASgJEhoKEmNvbXBhdGliaWxpdHlfdXNkYRgDIAEoDCLdAQoLUnVudGltZVNwYW4SEAoIdHJhY2VfaWQYASABKAwSDwoHc3Bhbl9pZBgCIAEoDBIbCg5wYXJlbnRfc3Bhbl9pZBgDIAEoDEgAiAEBEgwKBG5hbWUYBCABKAkSGgoSc3RhcnRlZF91bml4X25hbm9zGAUgASgEEhYKDmR1cmF0aW9uX25hbm9zGAYgASgEEjkKCmF0dHJpYnV0ZXMYByADKAsyJS5ub21vcy5ydW50aW1lLnYyLkRpYWdub3N0aWNBdHRyaWJ1dGVCEQoPX3BhcmVudF9zcGFuX2lkIuoBChZLZXJuZWxQcm9ncmVzc09ic2VydmVkEjkKCHNuYXBzaG90GAEgASgLMicubm9tb3Mua2VybmVsLnYxLktlcm5lbFByb2dyZXNzU25hcHNob3QSJAocaG9zdF9vYnNlcnZlZF9lbGFwc2VkX21pY3JvcxgCIAEoBBIqCiJob3N0X29ic2VydmVkX3BoYXNlX2VsYXBzZWRfbWljcm9zGAMgASgEEh4KFnByb2Nlc3NfcmVzaWRlbnRfYnl0ZXMYBCABKAQSIwobcHJvY2Vzc19wZWFrX3Jlc2lkZW50X2J5dGVzGAUgASgEIoIBChBUcmFuc2ZlclByb2dyZXNzEhYKDnJlY2VpdmVkX2J5dGVzGAEgASgEEhgKC3RvdGFsX2J5dGVzGAIgASgESACIAQESLAoEa2luZBgDIAEoDjIeLm5vbW9zLnJ1bnRpbWUudjIuVHJhbnNmZXJLaW5kQg4KDF90b3RhbF9ieXRlcyrKAQoSUnVudGltZUZhaWx1cmVLaW5kEiQKIFJVTlRJTUVfRkFJTFVSRV9LSU5EX1VOU1BFQ0lGSUVEEAASIQodUlVOVElNRV9GQUlMVVJFX0tJTkRfSU5URVJOQUwQARIhCh1SVU5USU1FX0ZBSUxVUkVfS0lORF9QUk9UT0NPTBACEiIKHlJVTlRJTUVfRkFJTFVSRV9LSU5EX0lOVEVHUklUWRADEiQKIFJVTlRJTUVfRkFJTFVSRV9LSU5EX1VOU1VQUE9SVEVEEAQqpwMKGFJ1bnRpbWVVbmF2YWlsYWJsZVJlYXNvbhIqCiZSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9VTlNQRUNJRklFRBAAEjIKLlJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1JFTU9URV9PTkxZX09GRkxJTkUQARIxCi1SVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9SRU1PVEVfVU5SRUFDSEFCTEUQAhItCilSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9SRU1PVEVfVElNRU9VVBADEjYKMlJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX0xPQ0FMX1JFUExJQ0FfTk9UX1JFQURZEAQSNQoxUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fQ1JFREVOVElBTF9VTkFWQUlMQUJMRRAFEjAKLFJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1dPUktTUEFDRV9PUEVOSU5HEAYSKAokUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fUEVFUl9CVVNZEAcq8AEKFFJ1bnRpbWVSZWZ1c2FsUmVhc29uEiYKIlJVTlRJTUVfUkVGVVNBTF9SRUFTT05fVU5TUEVDSUZJRUQQABItCilSVU5USU1FX1JFRlVTQUxfUkVBU09OX0lOVkFMSURfQ1JFREVOVElBTBABEigKJFJVTlRJTUVfUkVGVVNBTF9SRUFTT05fQUNDRVNTX0RFTklFRBACEisKJ1JVTlRJTUVfUkVGVVNBTF9SRUFTT05fUExBQ0VNRU5UX1BPTElDWRADEioKJlJVTlRJTUVfUkVGVVNBTF9SRUFTT05fU0VTU0lPTl9VTkJPVU5EEAQqlQQKFkZvbGxvd09ic2VydmF0aW9uUGhhc2USKAokRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX1VOU1BFQ0lGSUVEEAASJAogRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0RFU0lSRUQQARIgChxGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfRFVFEAISJAogRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX1JVTk5JTkcQAxIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfU0VUVExFRBAEEjAKLEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9BV0FJVElOR19ERVBFTkRFTkNZEAUSJAogRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX09GRkxJTkUQBhIvCitGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfSU5WQUxJRF9DUkVERU5USUFMEAcSJAogRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0JBQ0tPRkYQCBIsCihGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfUkVCT1JOX1JFTU9URUxZEAkSLAooRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX1JFUExBQ0lOR19MT0NBTBAKEjIKLkZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9MT0NBTF9DT1BZX1VOUkVBREFCTEUQCypXCgpMaW5rU3RhdHVzEhsKF0xJTktfU1RBVFVTX1VOU1BFQ0lGSUVEEAASFAoQTElOS19TVEFUVVNfT1BFThABEhYKEkxJTktfU1RBVFVTX0NMT1NFRBACKnYKDFRyYW5zZmVyS2luZBIdChlUUkFOU0ZFUl9LSU5EX1VOU1BFQ0lGSUVEEAASFwoTVFJBTlNGRVJfS0lORF9ERUxUQRABEhYKElRSQU5TRkVSX0tJTkRfRlVMTBACEhYKElRSQU5TRkVSX0tJTkRfUFVTSBADYgZwcm90bzM", [file_google_protobuf_any2, file_nomos_kernel_v1_progress, file_nomos_runtime_v2_correspondence_desk, file_nomos_runtime_v2_custody_desk, file_nomos_runtime_v2_placement_desk, file_nomos_runtime_v2_maintenance_desk, file_nomos_runtime_v2_model_adoption_desk, file_nomos_runtime_v2_receiving_group_desk, file_nomos_runtime_v2_recovery_desk]);
+    file_nomos_runtime_v2_observability_desk = /* @__PURE__ */ fileDesc22("Cilub21vcy9ydW50aW1lL3YyL29ic2VydmFiaWxpdHlfZGVzay5wcm90bxIQbm9tb3MucnVudGltZS52MiJCCgxUcmFjZUNvbnRleHQSEAoIdHJhY2VfaWQYASABKAwSDwoHc3Bhbl9pZBgCIAEoDBIPCgdzYW1wbGVkGAMgASgIIp0CCg5SdW50aW1lRmFpbHVyZRIMCgRjb2RlGAEgASgJEg8KB21lc3NhZ2UYAiABKAkSEQoJY29tcG9uZW50GAMgASgJEhYKCXdvcmtzcGFjZRgEIAEoCUgAiAEBEhMKBmRvbWFpbhgFIAEoCUgBiAEBEhYKCWRpcmVjdGl2ZRgGIAEoCUgCiAEBEjkKCmF0dHJpYnV0ZXMYByADKAsyJS5ub21vcy5ydW50aW1lLnYyLkRpYWdub3N0aWNBdHRyaWJ1dGUSMgoEa2luZBgIIAEoDjIkLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZUZhaWx1cmVLaW5kQgwKCl93b3Jrc3BhY2VCCQoHX2RvbWFpbkIMCgpfZGlyZWN0aXZlIr4BChJSdW50aW1lVW5hdmFpbGFibGUSOgoGcmVhc29uGAEgASgOMioubm9tb3MucnVudGltZS52Mi5SdW50aW1lVW5hdmFpbGFibGVSZWFzb24SEQoJd29ya3NwYWNlGAIgASgJEhEKCXJldHJ5YWJsZRgDIAEoCBIfChJyZXRyeV9hZnRlcl9taWxsaXMYBCABKA1IAIgBARIOCgZkZXRhaWwYBSABKAlCFQoTX3JldHJ5X2FmdGVyX21pbGxpcyJ+Cg5SdW50aW1lUmVmdXNhbBI2CgZyZWFzb24YASABKA4yJi5ub21vcy5ydW50aW1lLnYyLlJ1bnRpbWVSZWZ1c2FsUmVhc29uEhEKCXdvcmtzcGFjZRgCIAEoCRIRCglyZXRyeWFibGUYAyABKAgSDgoGZGV0YWlsGAQgASgJIqUBChNEaWFnbm9zdGljQXR0cmlidXRlEgwKBG5hbWUYASABKAkSFgoMc3RyaW5nX3ZhbHVlGAIgASgJSAASFwoNaW50ZWdlcl92YWx1ZRgDIAEoEkgAEhYKDGRvdWJsZV92YWx1ZRgEIAEoAUgAEhcKDWJvb2xlYW5fdmFsdWUYBSABKAhIABIVCgtieXRlc192YWx1ZRgGIAEoDEgAQgcKBXZhbHVlIqQLCgxSdW50aW1lRXZlbnQSEAoIc2VxdWVuY2UYASABKAQSFAoHc2Vzc2lvbhgCIAEoCUgBiAEBEi8KBXJlYWR5GAogASgLMh4ubm9tb3MucnVudGltZS52Mi5SdW50aW1lUmVhZHlIABI3Cg13YXRjaF9jaGFuZ2VkGAsgASgLMh4ubm9tb3MucnVudGltZS52Mi5XYXRjaENoYW5nZWRIABI5Cg5zeW5jX2NvbXBsZXRlZBgMIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU3luY0NvbXBsZXRlZEgAEjUKDGxpbmtfY2hhbmdlZBgNIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuTGlua0NoYW5nZWRIABI5Cg5zaWduYWxfY2hhbmdlZBgOIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU2lnbmFsQ2hhbmdlZEgAEjsKD2N1c3RvZHlfY2hhbmdlZBgPIAEoCzIgLm5vbW9zLnJ1bnRpbWUudjIuQ3VzdG9keUNoYW5nZWRIABJCChNsb2NhbF93b3JrX3JlamVjdGVkGBAgASgLMiMubm9tb3MucnVudGltZS52Mi5Mb2NhbFdvcmtSZWplY3RlZEgAEjMKC2xhd19jaGFuZ2VkGBEgASgLMhwubm9tb3MucnVudGltZS52Mi5MYXdDaGFuZ2VkSAASQwoPa2VybmVsX3Byb2dyZXNzGBIgASgLMigubm9tb3MucnVudGltZS52Mi5LZXJuZWxQcm9ncmVzc09ic2VydmVkSAASLQoEc3BhbhgTIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZVNwYW5IABI/ChF0cmFuc2Zlcl9wcm9ncmVzcxgUIAEoCzIiLm5vbW9zLnJ1bnRpbWUudjIuVHJhbnNmZXJQcm9ncmVzc0gAEkkKFG1haW50ZW5hbmNlX3Byb2dyZXNzGBUgASgLMikubm9tb3MucnVudGltZS52Mi5SZWFkTWFpbnRlbmFuY2VQcm9ncmVzc0gAEjsKDXNvY2tldF9lZmZlY3QYFiABKAsyIi5ub21vcy5ydW50aW1lLnYyLlBlZXJTb2NrZXRFZmZlY3RIABJUChxjcmVkZW50aWFsX3JlZnJlc2hfcmVxdWVzdGVkGBcgASgLMiwubm9tb3MucnVudGltZS52Mi5DcmVkZW50aWFsUmVmcmVzaFJlcXVlc3RlZEgAElIKG3JlY2VpdmluZ19ncm91cF9jb252ZXJnZW5jZRgYIAEoCzIrLm5vbW9zLnJ1bnRpbWUudjIuUmVjZWl2aW5nR3JvdXBDb252ZXJnZW5jZUgAEkoKF21vZGVsX2Fkb3B0aW9uX3Byb2dyZXNzGBkgASgLMicubm9tb3MucnVudGltZS52Mi5Nb2RlbEFkb3B0aW9uUHJvZ3Jlc3NIABI7Cg9mb2xsb3dzX3N1bW1hcnkYGiABKAsyIC5ub21vcy5ydW50aW1lLnYyLkZvbGxvd3NTdW1tYXJ5SAASRAoUbG9jYWxfY29weV9wcmVzZXJ2ZWQYGyABKAsyJC5ub21vcy5ydW50aW1lLnYyLlByZXNlcnZlZExvY2FsQ29weUgAEk4KGWZvcmVpZ25fcGxhY2VtZW50X2lnbm9yZWQYHCABKAsyKS5ub21vcy5ydW50aW1lLnYyLkZvcmVpZ25QbGFjZW1lbnRJZ25vcmVkSAASQwoTYmluZGluZ19xdWFyYW50aW5lZBgdIAEoCzIkLm5vbW9zLnJ1bnRpbWUudjIuUXVhcmFudGluZWRCaW5kaW5nSAASPwoRd3JpdGVfcHJlcGFyYXRpb24YHiABKAsyIi5ub21vcy5ydW50aW1lLnYyLldyaXRlUHJlcGFyYXRpb25IAEIHCgVldmVudEIKCghfc2Vzc2lvbiK8AQoORm9sbG93c1N1bW1hcnkSEAoIZm9sbG93ZWQYASABKA0SDwoHc2V0dGxlZBgCIAEoDRIMCgRsaXZlGAMgASgNEjcKCndvcmtzcGFjZXMYBCADKAsyIy5ub21vcy5ydW50aW1lLnYyLkZvbGxvd09ic2VydmF0aW9uEiQKF29ic2VydmVkX2F0X3VuaXhfbWlsbGlzGAUgASgESACIAQFCGgoYX29ic2VydmVkX2F0X3VuaXhfbWlsbGlzItECChFGb2xsb3dPYnNlcnZhdGlvbhIRCgl3b3Jrc3BhY2UYASABKAkSNwoFcGhhc2UYAiABKA4yKC5ub21vcy5ydW50aW1lLnYyLkZvbGxvd09ic2VydmF0aW9uUGhhc2USDAoEbGl2ZRgDIAEoCBITCgZkZXRhaWwYBCABKAlIAIgBARIhChRyZXRyeV9hdF91bml4X21pbGxpcxgFIAEoBEgBiAEBEh8KEmR1ZV9hdF91bml4X21pbGxpcxgGIAEoBEgCiAEBEhQKB2F0dGVtcHQYByABKA1IA4gBARIaCg1hY3RpdmVfZWZmZWN0GAggASgJSASIAQFCCQoHX2RldGFpbEIXChVfcmV0cnlfYXRfdW5peF9taWxsaXNCFQoTX2R1ZV9hdF91bml4X21pbGxpc0IKCghfYXR0ZW1wdEIQCg5fYWN0aXZlX2VmZmVjdCJWChpDcmVkZW50aWFsUmVmcmVzaFJlcXVlc3RlZBI4CgdwZW5kaW5nGAEgASgLMicubm9tb3MucnVudGltZS52Mi5Db3JyZXNwb25kZW5jZVBlbmRpbmciPgoMUnVudGltZVJlYWR5EhcKD3J1bnRpbWVfdmVyc2lvbhgBIAEoCRIVCg1rZXJuZWxfc2hhMjU2GAIgASgMIvwBCgxXYXRjaENoYW5nZWQSFwoPc3Vic2NyaXB0aW9uX2lkGAEgASgJEhMKC3Jlc3VsdF91c2RhGAIgASgMEjYKB2ZhaWx1cmUYAyABKAsyIC5ub21vcy5ydW50aW1lLnYyLlJ1bnRpbWVGYWlsdXJlSACIAQESNQoSYXBwbGljYXRpb25fcmVzdWx0GAQgASgLMhQuZ29vZ2xlLnByb3RvYnVmLkFueUgBiAEBEhoKDWludGVnZXJfdmFsdWUYBSABKANIAogBAUIKCghfZmFpbHVyZUIVChNfYXBwbGljYXRpb25fcmVzdWx0QhAKDl9pbnRlZ2VyX3ZhbHVlIpwBCg1TeW5jQ29tcGxldGVkEg4KBnJlYXNvbhgBIAEoCRI3CgZyZXN1bHQYAiABKAsyJy5ub21vcy5ydW50aW1lLnYyLlN5bmNXb3Jrc3BhY2VSZXNwb25zZRI2CgdmYWlsdXJlGAMgASgLMiAubm9tb3MucnVudGltZS52Mi5SdW50aW1lRmFpbHVyZUgAiAEBQgoKCF9mYWlsdXJlIjsKC0xpbmtDaGFuZ2VkEiwKBnN0YXR1cxgBIAEoDjIcLm5vbW9zLnJ1bnRpbWUudjIuTGlua1N0YXR1cyI4Cg1TaWduYWxDaGFuZ2VkEg4KBmRvbWFpbhgBIAEoCRIXCg9wcm9qZWN0aW9uX3VzZGEYAiABKAwiUAoKTGF3Q2hhbmdlZBIOCgZkb21haW4YASABKAkSFgoOcGFja2FnZV9zaGEyNTYYAiABKAkSGgoSY29tcGF0aWJpbGl0eV91c2RhGAMgASgMIt0BCgtSdW50aW1lU3BhbhIQCgh0cmFjZV9pZBgBIAEoDBIPCgdzcGFuX2lkGAIgASgMEhsKDnBhcmVudF9zcGFuX2lkGAMgASgMSACIAQESDAoEbmFtZRgEIAEoCRIaChJzdGFydGVkX3VuaXhfbmFub3MYBSABKAQSFgoOZHVyYXRpb25fbmFub3MYBiABKAQSOQoKYXR0cmlidXRlcxgHIAMoCzIlLm5vbW9zLnJ1bnRpbWUudjIuRGlhZ25vc3RpY0F0dHJpYnV0ZUIRCg9fcGFyZW50X3NwYW5faWQi6gEKFktlcm5lbFByb2dyZXNzT2JzZXJ2ZWQSOQoIc25hcHNob3QYASABKAsyJy5ub21vcy5rZXJuZWwudjEuS2VybmVsUHJvZ3Jlc3NTbmFwc2hvdBIkChxob3N0X29ic2VydmVkX2VsYXBzZWRfbWljcm9zGAIgASgEEioKImhvc3Rfb2JzZXJ2ZWRfcGhhc2VfZWxhcHNlZF9taWNyb3MYAyABKAQSHgoWcHJvY2Vzc19yZXNpZGVudF9ieXRlcxgEIAEoBBIjChtwcm9jZXNzX3BlYWtfcmVzaWRlbnRfYnl0ZXMYBSABKAQiggEKEFRyYW5zZmVyUHJvZ3Jlc3MSFgoOcmVjZWl2ZWRfYnl0ZXMYASABKAQSGAoLdG90YWxfYnl0ZXMYAiABKARIAIgBARIsCgRraW5kGAMgASgOMh4ubm9tb3MucnVudGltZS52Mi5UcmFuc2ZlcktpbmRCDgoMX3RvdGFsX2J5dGVzIjkKEFdyaXRlUHJlcGFyYXRpb24SEgoKcmVxdWVzdF9pZBgBIAEoCRIRCgl3b3Jrc3BhY2UYAiABKAkqygEKElJ1bnRpbWVGYWlsdXJlS2luZBIkCiBSVU5USU1FX0ZBSUxVUkVfS0lORF9VTlNQRUNJRklFRBAAEiEKHVJVTlRJTUVfRkFJTFVSRV9LSU5EX0lOVEVSTkFMEAESIQodUlVOVElNRV9GQUlMVVJFX0tJTkRfUFJPVE9DT0wQAhIiCh5SVU5USU1FX0ZBSUxVUkVfS0lORF9JTlRFR1JJVFkQAxIkCiBSVU5USU1FX0ZBSUxVUkVfS0lORF9VTlNVUFBPUlRFRBAEKqcDChhSdW50aW1lVW5hdmFpbGFibGVSZWFzb24SKgomUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fVU5TUEVDSUZJRUQQABIyCi5SVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9SRU1PVEVfT05MWV9PRkZMSU5FEAESMQotUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fUkVNT1RFX1VOUkVBQ0hBQkxFEAISLQopUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fUkVNT1RFX1RJTUVPVVQQAxI2CjJSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9MT0NBTF9SRVBMSUNBX05PVF9SRUFEWRAEEjUKMVJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX0NSRURFTlRJQUxfVU5BVkFJTEFCTEUQBRIwCixSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9XT1JLU1BBQ0VfT1BFTklORxAGEigKJFJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1BFRVJfQlVTWRAHKvABChRSdW50aW1lUmVmdXNhbFJlYXNvbhImCiJSVU5USU1FX1JFRlVTQUxfUkVBU09OX1VOU1BFQ0lGSUVEEAASLQopUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9JTlZBTElEX0NSRURFTlRJQUwQARIoCiRSVU5USU1FX1JFRlVTQUxfUkVBU09OX0FDQ0VTU19ERU5JRUQQAhIrCidSVU5USU1FX1JFRlVTQUxfUkVBU09OX1BMQUNFTUVOVF9QT0xJQ1kQAxIqCiZSVU5USU1FX1JFRlVTQUxfUkVBU09OX1NFU1NJT05fVU5CT1VORBAEKpUEChZGb2xsb3dPYnNlcnZhdGlvblBoYXNlEigKJEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9VTlNQRUNJRklFRBAAEiQKIEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9ERVNJUkVEEAESIAocRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0RVRRACEiQKIEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9SVU5OSU5HEAMSJAogRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX1NFVFRMRUQQBBIwCixGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfQVdBSVRJTkdfREVQRU5ERU5DWRAFEiQKIEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9PRkZMSU5FEAYSLworRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0lOVkFMSURfQ1JFREVOVElBTBAHEiQKIEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9CQUNLT0ZGEAgSLAooRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX1JFQk9STl9SRU1PVEVMWRAJEiwKKEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9SRVBMQUNJTkdfTE9DQUwQChIyCi5GT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfTE9DQUxfQ09QWV9VTlJFQURBQkxFEAsqVwoKTGlua1N0YXR1cxIbChdMSU5LX1NUQVRVU19VTlNQRUNJRklFRBAAEhQKEExJTktfU1RBVFVTX09QRU4QARIWChJMSU5LX1NUQVRVU19DTE9TRUQQAip2CgxUcmFuc2ZlcktpbmQSHQoZVFJBTlNGRVJfS0lORF9VTlNQRUNJRklFRBAAEhcKE1RSQU5TRkVSX0tJTkRfREVMVEEQARIWChJUUkFOU0ZFUl9LSU5EX0ZVTEwQAhIWChJUUkFOU0ZFUl9LSU5EX1BVU0gQA2IGcHJvdG8z", [file_google_protobuf_any2, file_nomos_kernel_v1_progress, file_nomos_runtime_v2_correspondence_desk, file_nomos_runtime_v2_custody_desk, file_nomos_runtime_v2_placement_desk, file_nomos_runtime_v2_maintenance_desk, file_nomos_runtime_v2_model_adoption_desk, file_nomos_runtime_v2_receiving_group_desk, file_nomos_runtime_v2_recovery_desk]);
     RuntimeFailureSchema = /* @__PURE__ */ messageDesc22(file_nomos_runtime_v2_observability_desk, 1);
     RuntimeUnavailableSchema = /* @__PURE__ */ messageDesc22(file_nomos_runtime_v2_observability_desk, 2);
     RuntimeRefusalSchema = /* @__PURE__ */ messageDesc22(file_nomos_runtime_v2_observability_desk, 3);
@@ -3375,6 +3375,7 @@ var init_observability_desk_pb = __esm({
     SyncCompletedSchema = /* @__PURE__ */ messageDesc22(file_nomos_runtime_v2_observability_desk, 11);
     LinkChangedSchema = /* @__PURE__ */ messageDesc22(file_nomos_runtime_v2_observability_desk, 12);
     RuntimeSpanSchema = /* @__PURE__ */ messageDesc22(file_nomos_runtime_v2_observability_desk, 15);
+    WritePreparationSchema = /* @__PURE__ */ messageDesc22(file_nomos_runtime_v2_observability_desk, 18);
     RuntimeFailureKindSchema = /* @__PURE__ */ enumDesc15(file_nomos_runtime_v2_observability_desk, 0);
     RuntimeFailureKind = /* @__PURE__ */ tsEnum15(RuntimeFailureKindSchema);
     RuntimeUnavailableReasonSchema = /* @__PURE__ */ enumDesc15(file_nomos_runtime_v2_observability_desk, 1);
@@ -8915,6 +8916,22 @@ var init_credential_sessions = __esm({
   }
 });
 
+// ../peer-office/src/runtime/credential_failure.ts
+function recoverableCredential(failure) {
+  return failure.code === "nomos.auth.token_expired" || failure.code === "nomos.auth.token_missing";
+}
+function syncNeedsCredentialRefresh(result, failure) {
+  if (failure !== void 0 && recoverableCredential(failure)) return true;
+  const offer = result?.offerReceipt?.outcome;
+  const pushNeedsRefresh = offer?.case === "failure" ? recoverableCredential(offer.value) : result?.pushError?.status === 401;
+  return pushNeedsRefresh || result?.discoveryError?.status === 401;
+}
+var init_credential_failure = __esm({
+  "../peer-office/src/runtime/credential_failure.ts"() {
+    "use strict";
+  }
+});
+
 // ../peer-office/src/runtime/credential_renewal.ts
 function identityTokenClaim(token, claim) {
   const claims = tokenClaims(token);
@@ -9113,19 +9130,11 @@ var init_sha256 = __esm({
 
 // ../peer-office/src/runtime/credential_recovery_desk.ts
 import { create as create16, fromBinary as fromBinary9, toBinary as toBinary8 } from "@bufbuild/protobuf";
-function recoverableCredential(failure) {
-  return failure.code === "nomos.auth.token_expired" || failure.code === "nomos.auth.token_missing";
-}
-function syncNeedsCredentialRefresh(event) {
-  const failures = [event.result?.pushError, event.result?.discoveryError];
-  if (failures.some((failure) => failure?.status === 401 || failure?.status === 403)) return true;
-  const text = `${event.failure?.message ?? ""} ${failures.map((failure) => failure?.message ?? "").join(" ")}`.toLowerCase();
-  return text.includes("unauthenticated") || text.includes("token expired") || text.includes("invalid token");
-}
 var CredentialRecoveryDesk;
 var init_credential_recovery_desk = __esm({
   "../peer-office/src/runtime/credential_recovery_desk.ts"() {
     "use strict";
+    init_credential_failure();
     init_kernel_pb();
     init_correspondence_desk_pb();
     init_credentials_desk_pb();
@@ -9210,7 +9219,7 @@ var init_credential_recovery_desk = __esm({
         return false;
       }
       observeSync(session, event) {
-        if (!syncNeedsCredentialRefresh(event) || this.#tokenless(session)) return;
+        if (!syncNeedsCredentialRefresh(event.result, event.failure) || this.#tokenless(session)) return;
         this.#prune();
         const capability = this.#ports.capabilityFor(session);
         const existing = this.#active.get(capability);
@@ -10417,6 +10426,7 @@ var init_receiving_group_desk = __esm({
       #accounts = /* @__PURE__ */ new Map();
       /** D22: device key hash → the workspaces the console reported this key enrolled in (this process's memory, not truth). */
       #consoleEnrolments = /* @__PURE__ */ new Map();
+      #preparingWrites = /* @__PURE__ */ new Map();
       #sequence = 0;
       #internalRequestId = 30000000000n;
       constructor(ports) {
@@ -10456,16 +10466,124 @@ var init_receiving_group_desk = __esm({
         if (head === account.observedHead) return;
         this.#tails.set(workspace, { ...account, inFlight: false, attempts: 0, notBefore: 0n });
       }
-      /** A refused nominal Home action can wait for framework recovery and retry once.
-       * Sealed/pending history is never re-signed, and no child is mistaken for Home. */
+      /** Only a proven non-admission can enter recovery. Console-enrolled children
+       * share the owning application's route, selected by credential capability and
+       * principal, never by workspace-name guessing or an unverified payload. */
       recoverOffer(request, response) {
-        if (!this.#ports.call || request.command.case !== "kernelCall" || request.command.value.credentialUse !== CredentialUse.SESSION || request.command.value.request?.operation.case !== "offer" || request.command.value.request.operation.value.intent.case !== "call" || response.outcome.case !== "failure" || !["nomos.authz.signer_enrollment_missing", "nomos.authz.device_key_revoked"].includes(response.outcome.value.code)) return;
+        if (!this.#ports.call || request.command.case !== "kernelCall" || request.command.value.credentialUse !== CredentialUse.SESSION || request.command.value.request?.operation.case !== "offer" || request.command.value.request.operation.value.intent.case !== "call") return;
+        const missing = response.outcome.case === "failure" ? response.outcome.value.code === "nomos.authz.signer_enrollment_missing" : response.outcome.case === "offer" && response.outcome.value.outcome.case === "refused" && response.outcome.value.outcome.value.refusal?.code === KernelRefusalCode.FORGED_PRINCIPAL && response.outcome.value.outcome.value.refusal.details?.fields.actor?.kind.case === "text" && response.outcome.value.outcome.value.refusal.details.fields.actor.kind.value === "unenrolled-signer-key";
+        const revoked = response.outcome.case === "failure" && response.outcome.value.code === "nomos.authz.device_key_revoked";
+        if (!missing && !revoked) return;
         const binding = this.#ports.binding(request.command.value.session);
-        const account = binding ? this.#accounts.get(binding.workspace) : void 0;
-        if (!account) return;
+        if (!binding) return;
+        const enrolled = [...this.#accounts.values()].find((account2) => {
+          const owner = this.#ports.binding(account2.session);
+          return account2.enrolment && owner?.credentialCapability === binding.credentialCapability && owner.principal === binding.principal;
+        });
         const copy3 = fromBinary14(RuntimeRequestSchema, toBinary11(RuntimeRequestSchema, request));
+        if (enrolled?.enrolment) {
+          if (revoked) return this.#writeRefused(binding.workspace, "This device's access has been revoked.");
+          return this.#begin(request, `enrolled-write-${++this.#sequence}`, (workId2) => this.#prepareEnrolledWrite(copy3, binding, enrolled.application, enrolled.enrolment, workId2));
+        }
+        const account = this.#accounts.get(binding.workspace);
+        if (!account) return;
         return this.#begin(request, `receiving-group-authoring-${++this.#sequence}`, (workId2) => this.#recoverOffer(copy3, response, account, workId2));
       }
+      #writeRefused(workspace, detail, reason = RuntimeRefusalReason.ACCESS_DENIED) {
+        return { case: "refused", value: create23(RuntimeRefusalSchema, {
+          reason,
+          workspace,
+          retryable: false,
+          detail
+        }) };
+      }
+      #writeWaiting(workspace, detail) {
+        return { case: "unavailable", value: create23(RuntimeUnavailableSchema, {
+          reason: RuntimeUnavailableReason.CREDENTIAL_UNAVAILABLE,
+          workspace,
+          retryable: true,
+          retryAfterMillis: 1e3,
+          detail
+        }) };
+      }
+      *#prepareEnrolledWrite(request, binding, application, route, workId2) {
+        if (request.command.case !== "kernelCall") throw new Error("write preparation lost its call");
+        const command = request.command.value;
+        const principal = binding.principal;
+        const unavailable = () => this.#writeWaiting(
+          binding.workspace,
+          "This device is still being prepared to save changes. Your change has not been saved. Try again when connected."
+        );
+        this.#ports.emit(binding.session, { case: "writePreparation", value: create23(WritePreparationSchema, {
+          requestId: command.request.requestId,
+          workspace: binding.workspace
+        }) });
+        const key2 = JSON.stringify([binding.credentialCapability, principal, binding.workspace]);
+        const shared = this.#preparingWrites.get(key2);
+        const deadline = this.#ports.clock.monotonicNanoseconds() + 30000000000n;
+        let wake = 0;
+        if (shared) {
+          while (!shared.settled) {
+            if (this.#ports.clock.monotonicNanoseconds() >= deadline) return unavailable();
+            const receipt = yield { case: "wake", value: create23(PeerWakeEffectSchema, {
+              effectId: `${workId2}:join-${++wake}`,
+              delayMillis: 250
+            }) };
+            if (receipt.outcome.case !== "woken") return unavailable();
+          }
+          if (shared.result) return shared.result;
+        } else {
+          const preparation = { settled: false };
+          this.#preparingWrites.set(key2, preparation);
+          try {
+            const secret = this.#ports.authorSecretIfPresent(binding.session);
+            if (!secret) return preparation.result = this.#writeRefused(binding.workspace, "Sign in again to set up this device.", RuntimeRefusalReason.INVALID_CREDENTIAL);
+            const keyHash = sha256Hex(this.#ports.deriveSigningPublicKey(secret));
+            let posture = this.#ports.posture(request, binding.session, principal, secret, false);
+            if (posture.deviceSignerStatus === DeviceSignerStatus.REVOKED) {
+              return preparation.result = this.#writeRefused(binding.workspace, "This device's access has been revoked.");
+            }
+            if (!posture.enrolledDevice || posture.deviceSignerStatus !== DeviceSignerStatus.ACTIVE) {
+              const enrolled = yield* this.#enrolAtConsole(
+                route,
+                binding,
+                `${application}|${principal}`,
+                principal,
+                keyHash,
+                [binding.workspace],
+                `${workId2}:console`
+              );
+              if (enrolled.case === "deferred") return preparation.result = enrolled.credentialRefused ? this.#writeRefused(binding.workspace, "Sign in again to set up this device.", RuntimeRefusalReason.INVALID_CREDENTIAL) : unavailable();
+              if (!(binding.workspace in enrolled.value.heads)) {
+                return preparation.result = this.#writeRefused(binding.workspace, "This device could not obtain access to save changes in this workspace.");
+              }
+              while (true) {
+                posture = this.#ports.posture(request, binding.session, principal, secret, false);
+                if (posture.deviceSignerStatus === DeviceSignerStatus.REVOKED) {
+                  return preparation.result = this.#writeRefused(binding.workspace, "This device's access has been revoked.");
+                }
+                if (posture.enrolledDevice && posture.deviceSignerStatus === DeviceSignerStatus.ACTIVE) break;
+                if (this.#ports.clock.monotonicNanoseconds() >= deadline) return preparation.result = unavailable();
+                const receipt = yield { case: "wake", value: create23(PeerWakeEffectSchema, {
+                  effectId: `${workId2}:observe-${++wake}`,
+                  delayMillis: 500
+                }) };
+                if (receipt.outcome.case !== "woken") return preparation.result = unavailable();
+              }
+            }
+          } catch (error) {
+            if (error instanceof ReceivingGroupRefusal) {
+              return preparation.result = this.#writeRefused(binding.workspace, "This device could not obtain access to save changes in this workspace.");
+            }
+            preparation.result = unavailable();
+            throw error;
+          } finally {
+            preparation.settled = true;
+            this.#preparingWrites.delete(key2);
+          }
+        }
+        return { case: "retried", request, response: this.#ports.call(request, command) };
+      }
       *#recoverOffer(request, response, account, workId2) {
         const workspace = this.#ports.binding(account.session).workspace;
         const deadline = this.#ports.clock.monotonicNanoseconds() + 60000000000n;
@@ -10533,6 +10651,7 @@ var init_receiving_group_desk = __esm({
         this.#opening.clear();
         this.#accounts.clear();
         this.#consoleEnrolments.clear();
+        this.#preparingWrites.clear();
       }
       #begin(request, workId2, procedure) {
         const held = {
@@ -14424,6 +14543,7 @@ var init_replica_follow_controller = __esm({
     init_replica_follow_state();
     init_local_copy_readability();
     init_placement_desk();
+    init_credential_failure();
     ReplicaFollowReconciliationKind = Object.freeze({
       Following: "following",
       NotFollowing: "not_following"
@@ -14691,12 +14811,12 @@ var init_replica_follow_controller = __esm({
           this.#desk.transition(result.workspace, { case: ReplicaFollowEventKind.WentOffline, nowUnixMillis });
           return delayUntilDue(this.#desk.get(result.workspace), nowUnixMillis);
         }
-        const credentialFailure = [result.pushError, result.discoveryError].find((failure) => failure?.status === 401 || failure?.status === 403);
-        if (credentialFailure) {
+        if (syncNeedsCredentialRefresh(result)) {
+          const offer = result.offerReceipt?.outcome;
           const transition = this.#desk.transition(result.workspace, {
             case: ReplicaFollowEventKind.CredentialRejected,
             nowUnixMillis,
-            failure: credentialFailure.message || `remote rejected credential with HTTP ${credentialFailure.status}`
+            failure: (offer?.case === "failure" ? offer.value.message : void 0) || result.pushError?.message || result.discoveryError?.message || "remote requires a refreshed credential"
           });
           if (transition.effects.some((effect) => effect.case === ReplicaFollowEffectKind.RefreshCredential)) {
             return 0;
@@ -16883,7 +17003,7 @@ import { create as create54, fromBinary as fromBinary20 } from "@bufbuild/protob
 function releaseSyncJudgment(workspace) {
   judgedThisLifetime.delete(workspace);
 }
-var PLACEMENT_REF3, LAW_PRODUCTS_MEDIA_TYPE, WorkspaceSyncPhase, trackedMain, NO_COMMON_BASE, deferredRemote, deferredLocal, judgedThisLifetime, MAX_REBASES_PER_ROUND, elapsedMillis, WorkspaceSyncWork;
+var PLACEMENT_REF3, LAW_PRODUCTS_MEDIA_TYPE, WorkspaceSyncPhase, trackedMain, deferredRemote, deferredLocal, judgedThisLifetime, MAX_REBASES_PER_ROUND, elapsedMillis, WorkspaceSyncWork;
 var init_workspace_sync = __esm({
   "../peer-office/src/runtime/workspace_sync.ts"() {
     "use strict";
@@ -16909,7 +17029,6 @@ var init_workspace_sync = __esm({
       Done: "done"
     });
     trackedMain = "refs/remotes/nomos/main";
-    NO_COMMON_BASE = "this replica holds local history with no frontier its upstream ever confirmed; convergence needs a common admitted base \u2014 drop the local copy to refetch it, or re-discover a provider holding this lineage";
     deferredRemote = "refs/remotes/nomos/deferred";
     deferredLocal = "refs/nomos/sync-deferred-local";
     judgedThisLifetime = /* @__PURE__ */ new Map();
@@ -17117,38 +17236,13 @@ var init_workspace_sync = __esm({
         }), { case: "awaiting", requestId });
       }
       /**
-       * NO COMMON BASE — a round that cannot converge, and must not pay for history to find out.
-       *
-       * This replica holds a non-empty ledger but has never recorded a frontier its upstream
-       * confirmed (`refs/remotes/nomos/main` is absent). The kernel refuses convergence in that
-       * state ("a non-empty live ledger requires a common admitted base"), so every step after the
-       * O(1) frontier probe is wasted work — and it is not cheap waste: the fetch negotiates with
-       * no `have` (a full-history pack), and the dependency planner decodes EVERY intent from
-       * genesis and inspects every change, once per round. That is O(history) per follow round,
-       * repeated at every retry, for a round that can only end in a refusal.
-       *
-       * The one base this round can establish costs nothing and is established before this is
-       * asked: an upstream holding exactly this replica's head (the probe's answer) converges it
-       * and records the tracking frontier. Anything else needs the local copy to be dropped and
-       * refetched (an application decision, which preserves the copy), or a re-discovery that
-       * names a provider holding this lineage. Both are reported, at O(1), as this failure.
-       */
-      /**
-       * Establish this round's base when none is tracked, without walking any history it can avoid.
-       *
-       * The upstream just named its own frontier. If that commit is in THIS replica's lineage, it is
-       * a common admitted base by definition — both sides hold it — and adopting it turns the round
-       * into an ordinary fast-forward: the offer carries only the suffix above it, the fetch can name
-       * it as a truthful `have`, and convergence has the base the kernel requires. One commit walk
-       * (no change decoding, no pack, no network) decides it.
-       *
-       * If it is not in this replica's lineage, no base exists to establish and the round is refused
-       * (#noCommonBase) before it leases, fetches or plans anything.
-       *
-       * A kernel without the commit walk cannot be asked, so it keeps the previous behaviour.
+       * Establish a cheap base when the provider's current tip is in our local chain.
+       * A negative answer means the base is unknown: both sides may have advanced from
+       * an earlier shared commit. Acquire the candidate and let the kernel discover
+       * and judge that history. A tracking bookmark is not an admission prerequisite.
        */
       #establishBase(upstreamHead) {
-        if (!this.#noCommonBase() || !this.#kernel.historySummary) return true;
+        if (!this.#missingTrackedBase() || !this.#kernel.historySummary) return true;
         const summary = this.#kernel.historySummary(this.#mount, this.#requestId, upstreamHead, this.#localHead);
         if (!summary.reachedBase) return false;
         this.#previousHead = upstreamHead;
@@ -17163,26 +17257,9 @@ var init_workspace_sync = __esm({
       get establishedBase() {
         return this.#establishedBase;
       }
-      #noCommonBase() {
+      #missingTrackedBase() {
         return this.#previousHead === void 0 && this.#localHead !== void 0 && this.#replaceLocalHead === void 0;
       }
-      #noCommonBaseResult() {
-        return this.#finish(create54(SyncWorkspaceResponseSchema, {
-          workspace: this.#mount.workspace,
-          ...this.#localHead === void 0 ? {} : { currentHead: this.#localHead },
-          stillAhead: true,
-          ...this.#offerReceipt === void 0 ? {} : { offerReceipt: this.#offerReceipt },
-          pushError: create54(RuntimeTransportFailureSchema, {
-            endpoint: this.#offerEndpoint(),
-            status: 409,
-            refused: true,
-            message: NO_COMMON_BASE
-          }),
-          timings: create54(SyncPhaseTimingsSchema, {
-            convergeMillis: elapsedMillis(this.#clock, this.#started)
-          })
-        }));
-      }
       #holdsLocalWork() {
         return this.#command.admit && !!this.#localHead && this.#localHead !== this.#previousHead;
       }
@@ -17334,7 +17411,6 @@ var init_workspace_sync = __esm({
         if (!this.#desiredHead) return this.#transportFailure("resident peer returned no admitted frontier", false);
         this.#candidateDurable = admission.sealedMain === this.#desiredHead;
         if (state.phase === WorkspaceSyncPhase.Probe && this.#desiredHead !== this.#localHead) {
-          if (!this.#establishBase(this.#desiredHead)) return this.#noCommonBaseResult();
           if (this.#alreadyJudged(this.#desiredHead)) {
             return this.#finish(create54(SyncWorkspaceResponseSchema, {
               workspace: this.#mount.workspace,
@@ -17346,6 +17422,22 @@ var init_workspace_sync = __esm({
               offerReceipt: this.#offerReceipt
             }));
           }
+          if (!this.#establishBase(this.#desiredHead)) {
+            this.#offerAfterConverge = this.#command.admit;
+            this.#rebaseFrom = void 0;
+            return this.#leaseEffect();
+          }
+          if (this.#establishedBase && !this.#candidateDurable && this.#kernel.resolveRef(this.#mount, this.#requestId, trackedMain) === void 0) {
+            return this.#finish(create54(SyncWorkspaceResponseSchema, {
+              workspace: this.#mount.workspace,
+              currentHead: this.#localHead,
+              previousHead: this.#previousHead,
+              stillAhead: true,
+              directOfferDeferred: true,
+              reconnectRequired: false,
+              offerReceipt: this.#offerReceipt
+            }));
+          }
           if (this.#probeOnly) {
             this.#needsReconciliation = true;
             return this.#finish(create54(SyncWorkspaceResponseSchema, {
@@ -17391,7 +17483,7 @@ var init_workspace_sync = __esm({
           return this.#converge(this.#desiredHead, admission.resultPack.byteLength, 0);
         }
         if (this.#desiredHead === this.#previousHead) return this.#converge(this.#desiredHead, 0, 0);
-        if (!this.#establishBase(this.#desiredHead)) return this.#noCommonBaseResult();
+        this.#establishBase(this.#desiredHead);
         if (admission.recoveryRequired !== false) return this.#leaseEffect();
         return this.#transportFailure("resident peer supplied neither the missing delta nor a history gap", false);
       }
@@ -17614,7 +17706,7 @@ var init_workspace_sync = __esm({
         }
       }
       #converge(candidateHead, receivedBytes, prefetchMillis) {
-        if (!this.#establishBase(candidateHead)) return this.#noCommonBaseResult();
+        this.#establishBase(candidateHead);
         this.#beforeConverge?.(candidateHead, this.#previousHead);
         const convergeStarted = this.#clock.monotonicNanoseconds();
         let judged;
@@ -20148,13 +20240,21 @@ var init_correspondence_desk = __esm({
       }
       #observeSyncResult(requestId, workId2, result) {
         const timings = result.timings;
+        const receipt = result.offerReceipt?.outcome;
+        const admission = receipt?.case === "admission" ? receipt.value : void 0;
         this.#events.instant("peer.follow.sync-result", {
           request: create59(RuntimeRequestSchema, { protocolVersion: 2, requestId }),
           workspace: result.workspace
         }, {
           "sync.workId": workId2,
           ...result.currentHead ? { "sync.head": result.currentHead } : {},
+          ...result.previousHead ? { "sync.previousHead": result.previousHead } : {},
+          ...admission?.main ? { "sync.providerHead": admission.main } : {},
+          ...admission?.sealedMain ? { "sync.sealedHead": admission.sealedMain } : {},
           "sync.stillAhead": result.stillAhead,
+          "sync.reconnectRequired": result.reconnectRequired,
+          "sync.refused": result.refused,
+          "sync.deferred": result.deferred,
           "sync.directOfferDeferred": result.directOfferDeferred,
           "sync.offline": result.offline,
           ...timings ? {
@@ -23432,6 +23532,7 @@ var init_peer_office = __esm({
         return this.#responses.modelAdoption(request, step);
       }
       #receivingGroupResponse(request, step) {
+        if (step.case === "refused") return this.#response(request, { case: "refused", value: step.value });
         if (step.case === "retried") return this.#birthCustodyResponse(step.request, this.#birthCustody.afterKernelCall(step.request, step.response));
         if (step.case === "pending") return this.#response(request, { case: "correspondencePending", value: step.value });
         if (step.case === "failure") return this.#failure(request, step.code, step.message);
@@ -26456,8 +26557,19 @@ async function ensureApplicationWorkspace(application, opts = {}) {
   }
   const statusUrl = `${cloud}/v2/workspaces/${encodeURIComponent(application)}`;
   const current = await fetch(statusUrl).catch(() => null);
-  if (current?.ok) {
-    const status = await current.json().catch(() => null);
+  const status = current?.ok ? await current.json().catch(() => null) : null;
+  let unborn = false;
+  if (current?.ok && !status?.lineage && !status?.durableHead && !status?.sealedHead) {
+    const domains2 = await fetch(`${statusUrl}/domains`);
+    if (domains2.status === 409) {
+      const body2 = await domains2.json().catch(() => null);
+      unborn = typeof body2?.error === "string" && body2.error.includes("unborn");
+    }
+    if (!unborn && !domains2.ok) {
+      throw new Error(`could not establish whether application '${application}' has custody (${domains2.status})`);
+    }
+  }
+  if (current?.ok && !unborn) {
     const principal = String(status?.lineage?.principal ?? "");
     const actualParent = String(status?.lineage?.parent ?? "");
     const expectedParent = requestedParent === "root" ? "" : requestedParent;
@@ -26493,7 +26605,7 @@ async function ensureApplicationWorkspace(application, opts = {}) {
       ...principal !== "" && session !== "" && sameIdentity(principal, session) ? { deployPrincipal: principal } : {}
     };
   }
-  if (current !== null && current.status !== 404 && current.status !== 409) {
+  if (current !== null && !unborn && current.status !== 404 && current.status !== 409) {
     throw new Error(`could not inspect deploy target '${application}' (${current.status}); refusing to guess that it is unborn`);
   }
   if (requestedParent !== void 0) {

package/dist/conformance-fixture/domains/booking.ts

@@ -0,0 +1,72 @@
+// THE HEADLINE FIXTURE — a law with a REAL aggregate invariant (#41: declared
+// invariants run at the gate). `@githolon/testing`'s own tests prove the
+// promise: `expect(app.takeSeat(...)).rejects.toThrow(/seats-exceed-capacity/)`.
+import { z, aggregate, t, Lww, MapOf, directive, create, idOf, refOf, instance, setEntry, query, valueObject } from "@githolon/dsl";
+
+const Seat = valueObject("Seat", {
+  status: z.enum(["active", "cancelled"]),
+  takenAt: z.string(),
+});
+
+export const Booking = aggregate(
+  "Booking",
+  {
+    label: t.string().merge(Lww),
+    capacity: t.int().merge(Lww),
+    seats: t.map(Seat.field()).merge(MapOf(Lww)),
+  },
+  {
+    /** ACTIVE SEATS ≤ CAPACITY — the declared aggregate invariant. */
+    invariant: (snap) => {
+      const capacity = typeof snap["capacity"] === "number" ? (snap["capacity"] as number) : 0;
+      const seats = snap["seats"];
+      let active = 0;
+      if (seats && typeof seats === "object") {
+        for (const seat of Object.values(seats as Record<string, { status?: string }>)) {
+          if (seat.status === "active") active += 1;
+        }
+      }
+      return active > capacity ? { reject: "seats-exceed-capacity" } : { accept: true };
+    },
+  },
+).public();
+
+export const openBooking = directive("openBooking")
+  .creates(Booking)
+  .payload(z.object({ label: z.string().min(1), capacity: z.number().int() }))
+  .plan((p) => {
+    create(Booking).set("label", p.label).set("capacity", p.capacity);
+    return [];
+  });
+
+export const takeSeat = directive("takeSeat")
+  .mutates(Booking)
+  .payload(z.object({ bookingId: idOf(Booking), attendee: z.string().min(1), takenAt: z.string() }))
+  .plan((p) => [
+    setEntry(
+      instance(Booking, p.bookingId),
+      "seats",
+      p.attendee,
+      { status: "active", takenAt: p.takenAt },
+    ),
+  ]);
+
+export const bookingsByLabel = query("bookingsByLabel").key("label").returns(Booking);
+
+// Exercise full addresses and explicit null through the generated facade,
+// real offers, custody and query-result decoder, not a hand-built response.
+export const ReferenceCard = aggregate("ReferenceCard", {
+  label: t.string().merge(Lww),
+  booking: t.nomosRef(Booking).merge(Lww),
+  note: t.nullable(t.string().merge(Lww), { reason: "A card may explicitly have no note" }),
+}).public();
+
+export const createReferenceCard = directive("createReferenceCard")
+  .creates(ReferenceCard)
+  .payload(z.object({ label: z.string(), booking: refOf(Booking), note: z.string().nullable() }))
+  .plan((p) => {
+    create(ReferenceCard).set("label", p.label).set("booking", p.booking).set("note", p.note);
+    return [];
+  });
+
+export const referenceCardsByLabel = query("referenceCardsByLabel").key("label").returns(ReferenceCard);

package/dist/conformance-fixture/nomos.project.ts

@@ -0,0 +1 @@
+export default { name: "seats", domains: [{ key: "seats", features: [{ key: "seats", modules: ["./domains/booking.ts"] }] }] };