githolon 0.111.0 → 0.111.1

package/dist/full-cli.mjs

@@ -9279,7 +9279,7 @@ var init_recovery_desk_pb = __esm({
 // ../adapter/proto/nomos/runtime/v2/observability_desk_pb.js
 import { enumDesc as enumDesc15, fileDesc as fileDesc22, messageDesc as messageDesc22, tsEnum as tsEnum15 } from "@bufbuild/protobuf/codegenv2";
 import { file_google_protobuf_any as file_google_protobuf_any2 } from "@bufbuild/protobuf/wkt";
-var file_nomos_runtime_v2_observability_desk, RuntimeFailureSchema, RuntimeUnavailableSchema, RuntimeRefusalSchema, DiagnosticAttributeSchema, RuntimeEventSchema, FollowsSummarySchema, FollowObservationSchema, CredentialRefreshRequestedSchema, RuntimeReadySchema, WatchChangedSchema, SyncCompletedSchema, LinkChangedSchema, RuntimeSpanSchema, RuntimeFailureKindSchema, RuntimeFailureKind, RuntimeUnavailableReasonSchema, RuntimeUnavailableReason, RuntimeRefusalReasonSchema, RuntimeRefusalReason, FollowObservationPhaseSchema, FollowObservationPhase, LinkStatusSchema, LinkStatus;
+var file_nomos_runtime_v2_observability_desk, RuntimeFailureSchema, RuntimeUnavailableSchema, RuntimeRefusalSchema, DiagnosticAttributeSchema, RuntimeEventSchema, FollowsSummarySchema, FollowObservationSchema, CredentialRefreshRequestedSchema, RuntimeReadySchema, WatchChangedSchema, SyncCompletedSchema, LinkChangedSchema, RuntimeSpanSchema, WritePreparationSchema, RuntimeFailureKindSchema, RuntimeFailureKind, RuntimeUnavailableReasonSchema, RuntimeUnavailableReason, RuntimeRefusalReasonSchema, RuntimeRefusalReason, FollowObservationPhaseSchema, FollowObservationPhase, LinkStatusSchema, LinkStatus;
 var init_observability_desk_pb = __esm({
   "../adapter/proto/nomos/runtime/v2/observability_desk_pb.js"() {
     "use strict";
@@ -9291,7 +9291,7 @@ var init_observability_desk_pb = __esm({
     init_model_adoption_desk_pb();
     init_receiving_group_desk_pb();
     init_recovery_desk_pb();
-    file_nomos_runtime_v2_observability_desk = /* @__PURE__ */ fileDesc22("Cilub21vcy9ydW50aW1lL3YyL29ic2VydmFiaWxpdHlfZGVzay5wcm90bxIQbm9tb3MucnVudGltZS52MiJCCgxUcmFjZUNvbnRleHQSEAoIdHJhY2VfaWQYASABKAwSDwoHc3Bhbl9pZBgCIAEoDBIPCgdzYW1wbGVkGAMgASgIIp0CCg5SdW50aW1lRmFpbHVyZRIMCgRjb2RlGAEgASgJEg8KB21lc3NhZ2UYAiABKAkSEQoJY29tcG9uZW50GAMgASgJEhYKCXdvcmtzcGFjZRgEIAEoCUgAiAEBEhMKBmRvbWFpbhgFIAEoCUgBiAEBEhYKCWRpcmVjdGl2ZRgGIAEoCUgCiAEBEjkKCmF0dHJpYnV0ZXMYByADKAsyJS5ub21vcy5ydW50aW1lLnYyLkRpYWdub3N0aWNBdHRyaWJ1dGUSMgoEa2luZBgIIAEoDjIkLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZUZhaWx1cmVLaW5kQgwKCl93b3Jrc3BhY2VCCQoHX2RvbWFpbkIMCgpfZGlyZWN0aXZlIr4BChJSdW50aW1lVW5hdmFpbGFibGUSOgoGcmVhc29uGAEgASgOMioubm9tb3MucnVudGltZS52Mi5SdW50aW1lVW5hdmFpbGFibGVSZWFzb24SEQoJd29ya3NwYWNlGAIgASgJEhEKCXJldHJ5YWJsZRgDIAEoCBIfChJyZXRyeV9hZnRlcl9taWxsaXMYBCABKA1IAIgBARIOCgZkZXRhaWwYBSABKAlCFQoTX3JldHJ5X2FmdGVyX21pbGxpcyJ+Cg5SdW50aW1lUmVmdXNhbBI2CgZyZWFzb24YASABKA4yJi5ub21vcy5ydW50aW1lLnYyLlJ1bnRpbWVSZWZ1c2FsUmVhc29uEhEKCXdvcmtzcGFjZRgCIAEoCRIRCglyZXRyeWFibGUYAyABKAgSDgoGZGV0YWlsGAQgASgJIqUBChNEaWFnbm9zdGljQXR0cmlidXRlEgwKBG5hbWUYASABKAkSFgoMc3RyaW5nX3ZhbHVlGAIgASgJSAASFwoNaW50ZWdlcl92YWx1ZRgDIAEoEkgAEhYKDGRvdWJsZV92YWx1ZRgEIAEoAUgAEhcKDWJvb2xlYW5fdmFsdWUYBSABKAhIABIVCgtieXRlc192YWx1ZRgGIAEoDEgAQgcKBXZhbHVlIuMKCgxSdW50aW1lRXZlbnQSEAoIc2VxdWVuY2UYASABKAQSFAoHc2Vzc2lvbhgCIAEoCUgBiAEBEi8KBXJlYWR5GAogASgLMh4ubm9tb3MucnVudGltZS52Mi5SdW50aW1lUmVhZHlIABI3Cg13YXRjaF9jaGFuZ2VkGAsgASgLMh4ubm9tb3MucnVudGltZS52Mi5XYXRjaENoYW5nZWRIABI5Cg5zeW5jX2NvbXBsZXRlZBgMIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU3luY0NvbXBsZXRlZEgAEjUKDGxpbmtfY2hhbmdlZBgNIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuTGlua0NoYW5nZWRIABI5Cg5zaWduYWxfY2hhbmdlZBgOIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU2lnbmFsQ2hhbmdlZEgAEjsKD2N1c3RvZHlfY2hhbmdlZBgPIAEoCzIgLm5vbW9zLnJ1bnRpbWUudjIuQ3VzdG9keUNoYW5nZWRIABJCChNsb2NhbF93b3JrX3JlamVjdGVkGBAgASgLMiMubm9tb3MucnVudGltZS52Mi5Mb2NhbFdvcmtSZWplY3RlZEgAEjMKC2xhd19jaGFuZ2VkGBEgASgLMhwubm9tb3MucnVudGltZS52Mi5MYXdDaGFuZ2VkSAASQwoPa2VybmVsX3Byb2dyZXNzGBIgASgLMigubm9tb3MucnVudGltZS52Mi5LZXJuZWxQcm9ncmVzc09ic2VydmVkSAASLQoEc3BhbhgTIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZVNwYW5IABI/ChF0cmFuc2Zlcl9wcm9ncmVzcxgUIAEoCzIiLm5vbW9zLnJ1bnRpbWUudjIuVHJhbnNmZXJQcm9ncmVzc0gAEkkKFG1haW50ZW5hbmNlX3Byb2dyZXNzGBUgASgLMikubm9tb3MucnVudGltZS52Mi5SZWFkTWFpbnRlbmFuY2VQcm9ncmVzc0gAEjsKDXNvY2tldF9lZmZlY3QYFiABKAsyIi5ub21vcy5ydW50aW1lLnYyLlBlZXJTb2NrZXRFZmZlY3RIABJUChxjcmVkZW50aWFsX3JlZnJlc2hfcmVxdWVzdGVkGBcgASgLMiwubm9tb3MucnVudGltZS52Mi5DcmVkZW50aWFsUmVmcmVzaFJlcXVlc3RlZEgAElIKG3JlY2VpdmluZ19ncm91cF9jb252ZXJnZW5jZRgYIAEoCzIrLm5vbW9zLnJ1bnRpbWUudjIuUmVjZWl2aW5nR3JvdXBDb252ZXJnZW5jZUgAEkoKF21vZGVsX2Fkb3B0aW9uX3Byb2dyZXNzGBkgASgLMicubm9tb3MucnVudGltZS52Mi5Nb2RlbEFkb3B0aW9uUHJvZ3Jlc3NIABI7Cg9mb2xsb3dzX3N1bW1hcnkYGiABKAsyIC5ub21vcy5ydW50aW1lLnYyLkZvbGxvd3NTdW1tYXJ5SAASRAoUbG9jYWxfY29weV9wcmVzZXJ2ZWQYGyABKAsyJC5ub21vcy5ydW50aW1lLnYyLlByZXNlcnZlZExvY2FsQ29weUgAEk4KGWZvcmVpZ25fcGxhY2VtZW50X2lnbm9yZWQYHCABKAsyKS5ub21vcy5ydW50aW1lLnYyLkZvcmVpZ25QbGFjZW1lbnRJZ25vcmVkSAASQwoTYmluZGluZ19xdWFyYW50aW5lZBgdIAEoCzIkLm5vbW9zLnJ1bnRpbWUudjIuUXVhcmFudGluZWRCaW5kaW5nSABCBwoFZXZlbnRCCgoIX3Nlc3Npb24ivAEKDkZvbGxvd3NTdW1tYXJ5EhAKCGZvbGxvd2VkGAEgASgNEg8KB3NldHRsZWQYAiABKA0SDAoEbGl2ZRgDIAEoDRI3Cgp3b3Jrc3BhY2VzGAQgAygLMiMubm9tb3MucnVudGltZS52Mi5Gb2xsb3dPYnNlcnZhdGlvbhIkChdvYnNlcnZlZF9hdF91bml4X21pbGxpcxgFIAEoBEgAiAEBQhoKGF9vYnNlcnZlZF9hdF91bml4X21pbGxpcyLRAgoRRm9sbG93T2JzZXJ2YXRpb24SEQoJd29ya3NwYWNlGAEgASgJEjcKBXBoYXNlGAIgASgOMigubm9tb3MucnVudGltZS52Mi5Gb2xsb3dPYnNlcnZhdGlvblBoYXNlEgwKBGxpdmUYAyABKAgSEwoGZGV0YWlsGAQgASgJSACIAQESIQoUcmV0cnlfYXRfdW5peF9taWxsaXMYBSABKARIAYgBARIfChJkdWVfYXRfdW5peF9taWxsaXMYBiABKARIAogBARIUCgdhdHRlbXB0GAcgASgNSAOIAQESGgoNYWN0aXZlX2VmZmVjdBgIIAEoCUgEiAEBQgkKB19kZXRhaWxCFwoVX3JldHJ5X2F0X3VuaXhfbWlsbGlzQhUKE19kdWVfYXRfdW5peF9taWxsaXNCCgoIX2F0dGVtcHRCEAoOX2FjdGl2ZV9lZmZlY3QiVgoaQ3JlZGVudGlhbFJlZnJlc2hSZXF1ZXN0ZWQSOAoHcGVuZGluZxgBIAEoCzInLm5vbW9zLnJ1bnRpbWUudjIuQ29ycmVzcG9uZGVuY2VQZW5kaW5nIj4KDFJ1bnRpbWVSZWFkeRIXCg9ydW50aW1lX3ZlcnNpb24YASABKAkSFQoNa2VybmVsX3NoYTI1NhgCIAEoDCL8AQoMV2F0Y2hDaGFuZ2VkEhcKD3N1YnNjcmlwdGlvbl9pZBgBIAEoCRITCgtyZXN1bHRfdXNkYRgCIAEoDBI2CgdmYWlsdXJlGAMgASgLMiAubm9tb3MucnVudGltZS52Mi5SdW50aW1lRmFpbHVyZUgAiAEBEjUKEmFwcGxpY2F0aW9uX3Jlc3VsdBgEIAEoCzIULmdvb2dsZS5wcm90b2J1Zi5BbnlIAYgBARIaCg1pbnRlZ2VyX3ZhbHVlGAUgASgDSAKIAQFCCgoIX2ZhaWx1cmVCFQoTX2FwcGxpY2F0aW9uX3Jlc3VsdEIQCg5faW50ZWdlcl92YWx1ZSKcAQoNU3luY0NvbXBsZXRlZBIOCgZyZWFzb24YASABKAkSNwoGcmVzdWx0GAIgASgLMicubm9tb3MucnVudGltZS52Mi5TeW5jV29ya3NwYWNlUmVzcG9uc2USNgoHZmFpbHVyZRgDIAEoCzIgLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZUZhaWx1cmVIAIgBAUIKCghfZmFpbHVyZSI7CgtMaW5rQ2hhbmdlZBIsCgZzdGF0dXMYASABKA4yHC5ub21vcy5ydW50aW1lLnYyLkxpbmtTdGF0dXMiOAoNU2lnbmFsQ2hhbmdlZBIOCgZkb21haW4YASABKAkSFwoPcHJvamVjdGlvbl91c2RhGAIgASgMIlAKCkxhd0NoYW5nZWQSDgoGZG9tYWluGAEgASgJEhYKDnBhY2thZ2Vfc2hhMjU2GAIgASgJEhoKEmNvbXBhdGliaWxpdHlfdXNkYRgDIAEoDCLdAQoLUnVudGltZVNwYW4SEAoIdHJhY2VfaWQYASABKAwSDwoHc3Bhbl9pZBgCIAEoDBIbCg5wYXJlbnRfc3Bhbl9pZBgDIAEoDEgAiAEBEgwKBG5hbWUYBCABKAkSGgoSc3RhcnRlZF91bml4X25hbm9zGAUgASgEEhYKDmR1cmF0aW9uX25hbm9zGAYgASgEEjkKCmF0dHJpYnV0ZXMYByADKAsyJS5ub21vcy5ydW50aW1lLnYyLkRpYWdub3N0aWNBdHRyaWJ1dGVCEQoPX3BhcmVudF9zcGFuX2lkIuoBChZLZXJuZWxQcm9ncmVzc09ic2VydmVkEjkKCHNuYXBzaG90GAEgASgLMicubm9tb3Mua2VybmVsLnYxLktlcm5lbFByb2dyZXNzU25hcHNob3QSJAocaG9zdF9vYnNlcnZlZF9lbGFwc2VkX21pY3JvcxgCIAEoBBIqCiJob3N0X29ic2VydmVkX3BoYXNlX2VsYXBzZWRfbWljcm9zGAMgASgEEh4KFnByb2Nlc3NfcmVzaWRlbnRfYnl0ZXMYBCABKAQSIwobcHJvY2Vzc19wZWFrX3Jlc2lkZW50X2J5dGVzGAUgASgEIoIBChBUcmFuc2ZlclByb2dyZXNzEhYKDnJlY2VpdmVkX2J5dGVzGAEgASgEEhgKC3RvdGFsX2J5dGVzGAIgASgESACIAQESLAoEa2luZBgDIAEoDjIeLm5vbW9zLnJ1bnRpbWUudjIuVHJhbnNmZXJLaW5kQg4KDF90b3RhbF9ieXRlcyrKAQoSUnVudGltZUZhaWx1cmVLaW5kEiQKIFJVTlRJTUVfRkFJTFVSRV9LSU5EX1VOU1BFQ0lGSUVEEAASIQodUlVOVElNRV9GQUlMVVJFX0tJTkRfSU5URVJOQUwQARIhCh1SVU5USU1FX0ZBSUxVUkVfS0lORF9QUk9UT0NPTBACEiIKHlJVTlRJTUVfRkFJTFVSRV9LSU5EX0lOVEVHUklUWRADEiQKIFJVTlRJTUVfRkFJTFVSRV9LSU5EX1VOU1VQUE9SVEVEEAQqpwMKGFJ1bnRpbWVVbmF2YWlsYWJsZVJlYXNvbhIqCiZSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9VTlNQRUNJRklFRBAAEjIKLlJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1JFTU9URV9PTkxZX09GRkxJTkUQARIxCi1SVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9SRU1PVEVfVU5SRUFDSEFCTEUQAhItCilSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9SRU1PVEVfVElNRU9VVBADEjYKMlJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX0xPQ0FMX1JFUExJQ0FfTk9UX1JFQURZEAQSNQoxUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fQ1JFREVOVElBTF9VTkFWQUlMQUJMRRAFEjAKLFJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1dPUktTUEFDRV9PUEVOSU5HEAYSKAokUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fUEVFUl9CVVNZEAcq8AEKFFJ1bnRpbWVSZWZ1c2FsUmVhc29uEiYKIlJVTlRJTUVfUkVGVVNBTF9SRUFTT05fVU5TUEVDSUZJRUQQABItCilSVU5USU1FX1JFRlVTQUxfUkVBU09OX0lOVkFMSURfQ1JFREVOVElBTBABEigKJFJVTlRJTUVfUkVGVVNBTF9SRUFTT05fQUNDRVNTX0RFTklFRBACEisKJ1JVTlRJTUVfUkVGVVNBTF9SRUFTT05fUExBQ0VNRU5UX1BPTElDWRADEioKJlJVTlRJTUVfUkVGVVNBTF9SRUFTT05fU0VTU0lPTl9VTkJPVU5EEAQqlQQKFkZvbGxvd09ic2VydmF0aW9uUGhhc2USKAokRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX1VOU1BFQ0lGSUVEEAASJAogRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0RFU0lSRUQQARIgChxGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfRFVFEAISJAogRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX1JVTk5JTkcQAxIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfU0VUVExFRBAEEjAKLEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9BV0FJVElOR19ERVBFTkRFTkNZEAUSJAogRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX09GRkxJTkUQBhIvCitGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfSU5WQUxJRF9DUkVERU5USUFMEAcSJAogRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0JBQ0tPRkYQCBIsCihGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfUkVCT1JOX1JFTU9URUxZEAkSLAooRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX1JFUExBQ0lOR19MT0NBTBAKEjIKLkZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9MT0NBTF9DT1BZX1VOUkVBREFCTEUQCypXCgpMaW5rU3RhdHVzEhsKF0xJTktfU1RBVFVTX1VOU1BFQ0lGSUVEEAASFAoQTElOS19TVEFUVVNfT1BFThABEhYKEkxJTktfU1RBVFVTX0NMT1NFRBACKnYKDFRyYW5zZmVyS2luZBIdChlUUkFOU0ZFUl9LSU5EX1VOU1BFQ0lGSUVEEAASFwoTVFJBTlNGRVJfS0lORF9ERUxUQRABEhYKElRSQU5TRkVSX0tJTkRfRlVMTBACEhYKElRSQU5TRkVSX0tJTkRfUFVTSBADYgZwcm90bzM", [file_google_protobuf_any2, file_nomos_kernel_v1_progress, file_nomos_runtime_v2_correspondence_desk, file_nomos_runtime_v2_custody_desk, file_nomos_runtime_v2_placement_desk, file_nomos_runtime_v2_maintenance_desk, file_nomos_runtime_v2_model_adoption_desk, file_nomos_runtime_v2_receiving_group_desk, file_nomos_runtime_v2_recovery_desk]);
+    file_nomos_runtime_v2_observability_desk = /* @__PURE__ */ fileDesc22("Cilub21vcy9ydW50aW1lL3YyL29ic2VydmFiaWxpdHlfZGVzay5wcm90bxIQbm9tb3MucnVudGltZS52MiJCCgxUcmFjZUNvbnRleHQSEAoIdHJhY2VfaWQYASABKAwSDwoHc3Bhbl9pZBgCIAEoDBIPCgdzYW1wbGVkGAMgASgIIp0CCg5SdW50aW1lRmFpbHVyZRIMCgRjb2RlGAEgASgJEg8KB21lc3NhZ2UYAiABKAkSEQoJY29tcG9uZW50GAMgASgJEhYKCXdvcmtzcGFjZRgEIAEoCUgAiAEBEhMKBmRvbWFpbhgFIAEoCUgBiAEBEhYKCWRpcmVjdGl2ZRgGIAEoCUgCiAEBEjkKCmF0dHJpYnV0ZXMYByADKAsyJS5ub21vcy5ydW50aW1lLnYyLkRpYWdub3N0aWNBdHRyaWJ1dGUSMgoEa2luZBgIIAEoDjIkLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZUZhaWx1cmVLaW5kQgwKCl93b3Jrc3BhY2VCCQoHX2RvbWFpbkIMCgpfZGlyZWN0aXZlIr4BChJSdW50aW1lVW5hdmFpbGFibGUSOgoGcmVhc29uGAEgASgOMioubm9tb3MucnVudGltZS52Mi5SdW50aW1lVW5hdmFpbGFibGVSZWFzb24SEQoJd29ya3NwYWNlGAIgASgJEhEKCXJldHJ5YWJsZRgDIAEoCBIfChJyZXRyeV9hZnRlcl9taWxsaXMYBCABKA1IAIgBARIOCgZkZXRhaWwYBSABKAlCFQoTX3JldHJ5X2FmdGVyX21pbGxpcyJ+Cg5SdW50aW1lUmVmdXNhbBI2CgZyZWFzb24YASABKA4yJi5ub21vcy5ydW50aW1lLnYyLlJ1bnRpbWVSZWZ1c2FsUmVhc29uEhEKCXdvcmtzcGFjZRgCIAEoCRIRCglyZXRyeWFibGUYAyABKAgSDgoGZGV0YWlsGAQgASgJIqUBChNEaWFnbm9zdGljQXR0cmlidXRlEgwKBG5hbWUYASABKAkSFgoMc3RyaW5nX3ZhbHVlGAIgASgJSAASFwoNaW50ZWdlcl92YWx1ZRgDIAEoEkgAEhYKDGRvdWJsZV92YWx1ZRgEIAEoAUgAEhcKDWJvb2xlYW5fdmFsdWUYBSABKAhIABIVCgtieXRlc192YWx1ZRgGIAEoDEgAQgcKBXZhbHVlIqQLCgxSdW50aW1lRXZlbnQSEAoIc2VxdWVuY2UYASABKAQSFAoHc2Vzc2lvbhgCIAEoCUgBiAEBEi8KBXJlYWR5GAogASgLMh4ubm9tb3MucnVudGltZS52Mi5SdW50aW1lUmVhZHlIABI3Cg13YXRjaF9jaGFuZ2VkGAsgASgLMh4ubm9tb3MucnVudGltZS52Mi5XYXRjaENoYW5nZWRIABI5Cg5zeW5jX2NvbXBsZXRlZBgMIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU3luY0NvbXBsZXRlZEgAEjUKDGxpbmtfY2hhbmdlZBgNIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuTGlua0NoYW5nZWRIABI5Cg5zaWduYWxfY2hhbmdlZBgOIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU2lnbmFsQ2hhbmdlZEgAEjsKD2N1c3RvZHlfY2hhbmdlZBgPIAEoCzIgLm5vbW9zLnJ1bnRpbWUudjIuQ3VzdG9keUNoYW5nZWRIABJCChNsb2NhbF93b3JrX3JlamVjdGVkGBAgASgLMiMubm9tb3MucnVudGltZS52Mi5Mb2NhbFdvcmtSZWplY3RlZEgAEjMKC2xhd19jaGFuZ2VkGBEgASgLMhwubm9tb3MucnVudGltZS52Mi5MYXdDaGFuZ2VkSAASQwoPa2VybmVsX3Byb2dyZXNzGBIgASgLMigubm9tb3MucnVudGltZS52Mi5LZXJuZWxQcm9ncmVzc09ic2VydmVkSAASLQoEc3BhbhgTIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZVNwYW5IABI/ChF0cmFuc2Zlcl9wcm9ncmVzcxgUIAEoCzIiLm5vbW9zLnJ1bnRpbWUudjIuVHJhbnNmZXJQcm9ncmVzc0gAEkkKFG1haW50ZW5hbmNlX3Byb2dyZXNzGBUgASgLMikubm9tb3MucnVudGltZS52Mi5SZWFkTWFpbnRlbmFuY2VQcm9ncmVzc0gAEjsKDXNvY2tldF9lZmZlY3QYFiABKAsyIi5ub21vcy5ydW50aW1lLnYyLlBlZXJTb2NrZXRFZmZlY3RIABJUChxjcmVkZW50aWFsX3JlZnJlc2hfcmVxdWVzdGVkGBcgASgLMiwubm9tb3MucnVudGltZS52Mi5DcmVkZW50aWFsUmVmcmVzaFJlcXVlc3RlZEgAElIKG3JlY2VpdmluZ19ncm91cF9jb252ZXJnZW5jZRgYIAEoCzIrLm5vbW9zLnJ1bnRpbWUudjIuUmVjZWl2aW5nR3JvdXBDb252ZXJnZW5jZUgAEkoKF21vZGVsX2Fkb3B0aW9uX3Byb2dyZXNzGBkgASgLMicubm9tb3MucnVudGltZS52Mi5Nb2RlbEFkb3B0aW9uUHJvZ3Jlc3NIABI7Cg9mb2xsb3dzX3N1bW1hcnkYGiABKAsyIC5ub21vcy5ydW50aW1lLnYyLkZvbGxvd3NTdW1tYXJ5SAASRAoUbG9jYWxfY29weV9wcmVzZXJ2ZWQYGyABKAsyJC5ub21vcy5ydW50aW1lLnYyLlByZXNlcnZlZExvY2FsQ29weUgAEk4KGWZvcmVpZ25fcGxhY2VtZW50X2lnbm9yZWQYHCABKAsyKS5ub21vcy5ydW50aW1lLnYyLkZvcmVpZ25QbGFjZW1lbnRJZ25vcmVkSAASQwoTYmluZGluZ19xdWFyYW50aW5lZBgdIAEoCzIkLm5vbW9zLnJ1bnRpbWUudjIuUXVhcmFudGluZWRCaW5kaW5nSAASPwoRd3JpdGVfcHJlcGFyYXRpb24YHiABKAsyIi5ub21vcy5ydW50aW1lLnYyLldyaXRlUHJlcGFyYXRpb25IAEIHCgVldmVudEIKCghfc2Vzc2lvbiK8AQoORm9sbG93c1N1bW1hcnkSEAoIZm9sbG93ZWQYASABKA0SDwoHc2V0dGxlZBgCIAEoDRIMCgRsaXZlGAMgASgNEjcKCndvcmtzcGFjZXMYBCADKAsyIy5ub21vcy5ydW50aW1lLnYyLkZvbGxvd09ic2VydmF0aW9uEiQKF29ic2VydmVkX2F0X3VuaXhfbWlsbGlzGAUgASgESACIAQFCGgoYX29ic2VydmVkX2F0X3VuaXhfbWlsbGlzItECChFGb2xsb3dPYnNlcnZhdGlvbhIRCgl3b3Jrc3BhY2UYASABKAkSNwoFcGhhc2UYAiABKA4yKC5ub21vcy5ydW50aW1lLnYyLkZvbGxvd09ic2VydmF0aW9uUGhhc2USDAoEbGl2ZRgDIAEoCBITCgZkZXRhaWwYBCABKAlIAIgBARIhChRyZXRyeV9hdF91bml4X21pbGxpcxgFIAEoBEgBiAEBEh8KEmR1ZV9hdF91bml4X21pbGxpcxgGIAEoBEgCiAEBEhQKB2F0dGVtcHQYByABKA1IA4gBARIaCg1hY3RpdmVfZWZmZWN0GAggASgJSASIAQFCCQoHX2RldGFpbEIXChVfcmV0cnlfYXRfdW5peF9taWxsaXNCFQoTX2R1ZV9hdF91bml4X21pbGxpc0IKCghfYXR0ZW1wdEIQCg5fYWN0aXZlX2VmZmVjdCJWChpDcmVkZW50aWFsUmVmcmVzaFJlcXVlc3RlZBI4CgdwZW5kaW5nGAEgASgLMicubm9tb3MucnVudGltZS52Mi5Db3JyZXNwb25kZW5jZVBlbmRpbmciPgoMUnVudGltZVJlYWR5EhcKD3J1bnRpbWVfdmVyc2lvbhgBIAEoCRIVCg1rZXJuZWxfc2hhMjU2GAIgASgMIvwBCgxXYXRjaENoYW5nZWQSFwoPc3Vic2NyaXB0aW9uX2lkGAEgASgJEhMKC3Jlc3VsdF91c2RhGAIgASgMEjYKB2ZhaWx1cmUYAyABKAsyIC5ub21vcy5ydW50aW1lLnYyLlJ1bnRpbWVGYWlsdXJlSACIAQESNQoSYXBwbGljYXRpb25fcmVzdWx0GAQgASgLMhQuZ29vZ2xlLnByb3RvYnVmLkFueUgBiAEBEhoKDWludGVnZXJfdmFsdWUYBSABKANIAogBAUIKCghfZmFpbHVyZUIVChNfYXBwbGljYXRpb25fcmVzdWx0QhAKDl9pbnRlZ2VyX3ZhbHVlIpwBCg1TeW5jQ29tcGxldGVkEg4KBnJlYXNvbhgBIAEoCRI3CgZyZXN1bHQYAiABKAsyJy5ub21vcy5ydW50aW1lLnYyLlN5bmNXb3Jrc3BhY2VSZXNwb25zZRI2CgdmYWlsdXJlGAMgASgLMiAubm9tb3MucnVudGltZS52Mi5SdW50aW1lRmFpbHVyZUgAiAEBQgoKCF9mYWlsdXJlIjsKC0xpbmtDaGFuZ2VkEiwKBnN0YXR1cxgBIAEoDjIcLm5vbW9zLnJ1bnRpbWUudjIuTGlua1N0YXR1cyI4Cg1TaWduYWxDaGFuZ2VkEg4KBmRvbWFpbhgBIAEoCRIXCg9wcm9qZWN0aW9uX3VzZGEYAiABKAwiUAoKTGF3Q2hhbmdlZBIOCgZkb21haW4YASABKAkSFgoOcGFja2FnZV9zaGEyNTYYAiABKAkSGgoSY29tcGF0aWJpbGl0eV91c2RhGAMgASgMIt0BCgtSdW50aW1lU3BhbhIQCgh0cmFjZV9pZBgBIAEoDBIPCgdzcGFuX2lkGAIgASgMEhsKDnBhcmVudF9zcGFuX2lkGAMgASgMSACIAQESDAoEbmFtZRgEIAEoCRIaChJzdGFydGVkX3VuaXhfbmFub3MYBSABKAQSFgoOZHVyYXRpb25fbmFub3MYBiABKAQSOQoKYXR0cmlidXRlcxgHIAMoCzIlLm5vbW9zLnJ1bnRpbWUudjIuRGlhZ25vc3RpY0F0dHJpYnV0ZUIRCg9fcGFyZW50X3NwYW5faWQi6gEKFktlcm5lbFByb2dyZXNzT2JzZXJ2ZWQSOQoIc25hcHNob3QYASABKAsyJy5ub21vcy5rZXJuZWwudjEuS2VybmVsUHJvZ3Jlc3NTbmFwc2hvdBIkChxob3N0X29ic2VydmVkX2VsYXBzZWRfbWljcm9zGAIgASgEEioKImhvc3Rfb2JzZXJ2ZWRfcGhhc2VfZWxhcHNlZF9taWNyb3MYAyABKAQSHgoWcHJvY2Vzc19yZXNpZGVudF9ieXRlcxgEIAEoBBIjChtwcm9jZXNzX3BlYWtfcmVzaWRlbnRfYnl0ZXMYBSABKAQiggEKEFRyYW5zZmVyUHJvZ3Jlc3MSFgoOcmVjZWl2ZWRfYnl0ZXMYASABKAQSGAoLdG90YWxfYnl0ZXMYAiABKARIAIgBARIsCgRraW5kGAMgASgOMh4ubm9tb3MucnVudGltZS52Mi5UcmFuc2ZlcktpbmRCDgoMX3RvdGFsX2J5dGVzIjkKEFdyaXRlUHJlcGFyYXRpb24SEgoKcmVxdWVzdF9pZBgBIAEoCRIRCgl3b3Jrc3BhY2UYAiABKAkqygEKElJ1bnRpbWVGYWlsdXJlS2luZBIkCiBSVU5USU1FX0ZBSUxVUkVfS0lORF9VTlNQRUNJRklFRBAAEiEKHVJVTlRJTUVfRkFJTFVSRV9LSU5EX0lOVEVSTkFMEAESIQodUlVOVElNRV9GQUlMVVJFX0tJTkRfUFJPVE9DT0wQAhIiCh5SVU5USU1FX0ZBSUxVUkVfS0lORF9JTlRFR1JJVFkQAxIkCiBSVU5USU1FX0ZBSUxVUkVfS0lORF9VTlNVUFBPUlRFRBAEKqcDChhSdW50aW1lVW5hdmFpbGFibGVSZWFzb24SKgomUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fVU5TUEVDSUZJRUQQABIyCi5SVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9SRU1PVEVfT05MWV9PRkZMSU5FEAESMQotUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fUkVNT1RFX1VOUkVBQ0hBQkxFEAISLQopUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fUkVNT1RFX1RJTUVPVVQQAxI2CjJSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9MT0NBTF9SRVBMSUNBX05PVF9SRUFEWRAEEjUKMVJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX0NSRURFTlRJQUxfVU5BVkFJTEFCTEUQBRIwCixSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9XT1JLU1BBQ0VfT1BFTklORxAGEigKJFJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1BFRVJfQlVTWRAHKvABChRSdW50aW1lUmVmdXNhbFJlYXNvbhImCiJSVU5USU1FX1JFRlVTQUxfUkVBU09OX1VOU1BFQ0lGSUVEEAASLQopUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9JTlZBTElEX0NSRURFTlRJQUwQARIoCiRSVU5USU1FX1JFRlVTQUxfUkVBU09OX0FDQ0VTU19ERU5JRUQQAhIrCidSVU5USU1FX1JFRlVTQUxfUkVBU09OX1BMQUNFTUVOVF9QT0xJQ1kQAxIqCiZSVU5USU1FX1JFRlVTQUxfUkVBU09OX1NFU1NJT05fVU5CT1VORBAEKpUEChZGb2xsb3dPYnNlcnZhdGlvblBoYXNlEigKJEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9VTlNQRUNJRklFRBAAEiQKIEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9ERVNJUkVEEAESIAocRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0RVRRACEiQKIEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9SVU5OSU5HEAMSJAogRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX1NFVFRMRUQQBBIwCixGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfQVdBSVRJTkdfREVQRU5ERU5DWRAFEiQKIEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9PRkZMSU5FEAYSLworRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0lOVkFMSURfQ1JFREVOVElBTBAHEiQKIEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9CQUNLT0ZGEAgSLAooRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX1JFQk9STl9SRU1PVEVMWRAJEiwKKEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9SRVBMQUNJTkdfTE9DQUwQChIyCi5GT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfTE9DQUxfQ09QWV9VTlJFQURBQkxFEAsqVwoKTGlua1N0YXR1cxIbChdMSU5LX1NUQVRVU19VTlNQRUNJRklFRBAAEhQKEExJTktfU1RBVFVTX09QRU4QARIWChJMSU5LX1NUQVRVU19DTE9TRUQQAip2CgxUcmFuc2ZlcktpbmQSHQoZVFJBTlNGRVJfS0lORF9VTlNQRUNJRklFRBAAEhcKE1RSQU5TRkVSX0tJTkRfREVMVEEQARIWChJUUkFOU0ZFUl9LSU5EX0ZVTEwQAhIWChJUUkFOU0ZFUl9LSU5EX1BVU0gQA2IGcHJvdG8z", [file_google_protobuf_any2, file_nomos_kernel_v1_progress, file_nomos_runtime_v2_correspondence_desk, file_nomos_runtime_v2_custody_desk, file_nomos_runtime_v2_placement_desk, file_nomos_runtime_v2_maintenance_desk, file_nomos_runtime_v2_model_adoption_desk, file_nomos_runtime_v2_receiving_group_desk, file_nomos_runtime_v2_recovery_desk]);
     RuntimeFailureSchema = /* @__PURE__ */ messageDesc22(file_nomos_runtime_v2_observability_desk, 1);
     RuntimeUnavailableSchema = /* @__PURE__ */ messageDesc22(file_nomos_runtime_v2_observability_desk, 2);
     RuntimeRefusalSchema = /* @__PURE__ */ messageDesc22(file_nomos_runtime_v2_observability_desk, 3);
@@ -9305,6 +9305,7 @@ var init_observability_desk_pb = __esm({
     SyncCompletedSchema = /* @__PURE__ */ messageDesc22(file_nomos_runtime_v2_observability_desk, 11);
     LinkChangedSchema = /* @__PURE__ */ messageDesc22(file_nomos_runtime_v2_observability_desk, 12);
     RuntimeSpanSchema = /* @__PURE__ */ messageDesc22(file_nomos_runtime_v2_observability_desk, 15);
+    WritePreparationSchema = /* @__PURE__ */ messageDesc22(file_nomos_runtime_v2_observability_desk, 18);
     RuntimeFailureKindSchema = /* @__PURE__ */ enumDesc15(file_nomos_runtime_v2_observability_desk, 0);
     RuntimeFailureKind = /* @__PURE__ */ tsEnum15(RuntimeFailureKindSchema);
     RuntimeUnavailableReasonSchema = /* @__PURE__ */ enumDesc15(file_nomos_runtime_v2_observability_desk, 1);
@@ -11691,7 +11692,7 @@ function filesystemCustodyFetch(dataDir, origin, options = {}, networkFetch = fe
 async function runGitHttpBackend(projectRoot, { method, pathInfo, query: query2, contentType, body }, options = {}) {
   const stdin = body && body.length ? await requestBodyStdin(body) : void 0;
   try {
-    return await new Promise((resolve8, reject) => {
+    return await new Promise((resolve9, reject) => {
       const env = {
         ...process.env,
         GIT_PROJECT_ROOT: projectRoot,
@@ -11766,7 +11767,7 @@ async function runGitHttpBackend(projectRoot, { method, pathInfo, query: query2,
           }
           headers[k] = v;
         }
-        resolve8({ status: status2, headers, body: payload });
+        resolve9({ status: status2, headers, body: payload });
       });
     });
   } finally {
@@ -14850,6 +14851,22 @@ var init_credential_sessions = __esm({
   }
 });
 
+// ../peer-office/src/runtime/credential_failure.ts
+function recoverableCredential(failure) {
+  return failure.code === "nomos.auth.token_expired" || failure.code === "nomos.auth.token_missing";
+}
+function syncNeedsCredentialRefresh(result, failure) {
+  if (failure !== void 0 && recoverableCredential(failure)) return true;
+  const offer = result?.offerReceipt?.outcome;
+  const pushNeedsRefresh = offer?.case === "failure" ? recoverableCredential(offer.value) : result?.pushError?.status === 401;
+  return pushNeedsRefresh || result?.discoveryError?.status === 401;
+}
+var init_credential_failure = __esm({
+  "../peer-office/src/runtime/credential_failure.ts"() {
+    "use strict";
+  }
+});
+
 // ../peer-office/src/runtime/credential_renewal.ts
 function identityTokenClaim(token, claim) {
   const claims = tokenClaims(token);
@@ -15048,19 +15065,11 @@ var init_sha256 = __esm({
 
 // ../peer-office/src/runtime/credential_recovery_desk.ts
 import { create as create17, fromBinary as fromBinary9, toBinary as toBinary8 } from "@bufbuild/protobuf";
-function recoverableCredential(failure) {
-  return failure.code === "nomos.auth.token_expired" || failure.code === "nomos.auth.token_missing";
-}
-function syncNeedsCredentialRefresh(event) {
-  const failures = [event.result?.pushError, event.result?.discoveryError];
-  if (failures.some((failure) => failure?.status === 401 || failure?.status === 403)) return true;
-  const text2 = `${event.failure?.message ?? ""} ${failures.map((failure) => failure?.message ?? "").join(" ")}`.toLowerCase();
-  return text2.includes("unauthenticated") || text2.includes("token expired") || text2.includes("invalid token");
-}
 var CredentialRecoveryDesk;
 var init_credential_recovery_desk = __esm({
   "../peer-office/src/runtime/credential_recovery_desk.ts"() {
     "use strict";
+    init_credential_failure();
     init_kernel_pb();
     init_correspondence_desk_pb();
     init_credentials_desk_pb();
@@ -15145,7 +15154,7 @@ var init_credential_recovery_desk = __esm({
         return false;
       }
       observeSync(session, event) {
-        if (!syncNeedsCredentialRefresh(event) || this.#tokenless(session)) return;
+        if (!syncNeedsCredentialRefresh(event.result, event.failure) || this.#tokenless(session)) return;
         this.#prune();
         const capability = this.#ports.capabilityFor(session);
         const existing = this.#active.get(capability);
@@ -16352,6 +16361,7 @@ var init_receiving_group_desk = __esm({
       #accounts = /* @__PURE__ */ new Map();
       /** D22: device key hash → the workspaces the console reported this key enrolled in (this process's memory, not truth). */
       #consoleEnrolments = /* @__PURE__ */ new Map();
+      #preparingWrites = /* @__PURE__ */ new Map();
       #sequence = 0;
       #internalRequestId = 30000000000n;
       constructor(ports) {
@@ -16391,16 +16401,124 @@ var init_receiving_group_desk = __esm({
         if (head === account.observedHead) return;
         this.#tails.set(workspace, { ...account, inFlight: false, attempts: 0, notBefore: 0n });
       }
-      /** A refused nominal Home action can wait for framework recovery and retry once.
-       * Sealed/pending history is never re-signed, and no child is mistaken for Home. */
+      /** Only a proven non-admission can enter recovery. Console-enrolled children
+       * share the owning application's route, selected by credential capability and
+       * principal, never by workspace-name guessing or an unverified payload. */
       recoverOffer(request, response) {
-        if (!this.#ports.call || request.command.case !== "kernelCall" || request.command.value.credentialUse !== CredentialUse.SESSION || request.command.value.request?.operation.case !== "offer" || request.command.value.request.operation.value.intent.case !== "call" || response.outcome.case !== "failure" || !["nomos.authz.signer_enrollment_missing", "nomos.authz.device_key_revoked"].includes(response.outcome.value.code)) return;
+        if (!this.#ports.call || request.command.case !== "kernelCall" || request.command.value.credentialUse !== CredentialUse.SESSION || request.command.value.request?.operation.case !== "offer" || request.command.value.request.operation.value.intent.case !== "call") return;
+        const missing = response.outcome.case === "failure" ? response.outcome.value.code === "nomos.authz.signer_enrollment_missing" : response.outcome.case === "offer" && response.outcome.value.outcome.case === "refused" && response.outcome.value.outcome.value.refusal?.code === KernelRefusalCode.FORGED_PRINCIPAL && response.outcome.value.outcome.value.refusal.details?.fields.actor?.kind.case === "text" && response.outcome.value.outcome.value.refusal.details.fields.actor.kind.value === "unenrolled-signer-key";
+        const revoked = response.outcome.case === "failure" && response.outcome.value.code === "nomos.authz.device_key_revoked";
+        if (!missing && !revoked) return;
         const binding = this.#ports.binding(request.command.value.session);
-        const account = binding ? this.#accounts.get(binding.workspace) : void 0;
-        if (!account) return;
+        if (!binding) return;
+        const enrolled = [...this.#accounts.values()].find((account2) => {
+          const owner = this.#ports.binding(account2.session);
+          return account2.enrolment && owner?.credentialCapability === binding.credentialCapability && owner.principal === binding.principal;
+        });
         const copy3 = fromBinary14(RuntimeRequestSchema, toBinary11(RuntimeRequestSchema, request));
+        if (enrolled?.enrolment) {
+          if (revoked) return this.#writeRefused(binding.workspace, "This device's access has been revoked.");
+          return this.#begin(request, `enrolled-write-${++this.#sequence}`, (workId2) => this.#prepareEnrolledWrite(copy3, binding, enrolled.application, enrolled.enrolment, workId2));
+        }
+        const account = this.#accounts.get(binding.workspace);
+        if (!account) return;
         return this.#begin(request, `receiving-group-authoring-${++this.#sequence}`, (workId2) => this.#recoverOffer(copy3, response, account, workId2));
       }
+      #writeRefused(workspace, detail, reason = RuntimeRefusalReason.ACCESS_DENIED) {
+        return { case: "refused", value: create24(RuntimeRefusalSchema, {
+          reason,
+          workspace,
+          retryable: false,
+          detail
+        }) };
+      }
+      #writeWaiting(workspace, detail) {
+        return { case: "unavailable", value: create24(RuntimeUnavailableSchema, {
+          reason: RuntimeUnavailableReason.CREDENTIAL_UNAVAILABLE,
+          workspace,
+          retryable: true,
+          retryAfterMillis: 1e3,
+          detail
+        }) };
+      }
+      *#prepareEnrolledWrite(request, binding, application, route, workId2) {
+        if (request.command.case !== "kernelCall") throw new Error("write preparation lost its call");
+        const command = request.command.value;
+        const principal = binding.principal;
+        const unavailable = () => this.#writeWaiting(
+          binding.workspace,
+          "This device is still being prepared to save changes. Your change has not been saved. Try again when connected."
+        );
+        this.#ports.emit(binding.session, { case: "writePreparation", value: create24(WritePreparationSchema, {
+          requestId: command.request.requestId,
+          workspace: binding.workspace
+        }) });
+        const key2 = JSON.stringify([binding.credentialCapability, principal, binding.workspace]);
+        const shared = this.#preparingWrites.get(key2);
+        const deadline = this.#ports.clock.monotonicNanoseconds() + 30000000000n;
+        let wake = 0;
+        if (shared) {
+          while (!shared.settled) {
+            if (this.#ports.clock.monotonicNanoseconds() >= deadline) return unavailable();
+            const receipt = yield { case: "wake", value: create24(PeerWakeEffectSchema, {
+              effectId: `${workId2}:join-${++wake}`,
+              delayMillis: 250
+            }) };
+            if (receipt.outcome.case !== "woken") return unavailable();
+          }
+          if (shared.result) return shared.result;
+        } else {
+          const preparation = { settled: false };
+          this.#preparingWrites.set(key2, preparation);
+          try {
+            const secret = this.#ports.authorSecretIfPresent(binding.session);
+            if (!secret) return preparation.result = this.#writeRefused(binding.workspace, "Sign in again to set up this device.", RuntimeRefusalReason.INVALID_CREDENTIAL);
+            const keyHash = sha256Hex6(this.#ports.deriveSigningPublicKey(secret));
+            let posture = this.#ports.posture(request, binding.session, principal, secret, false);
+            if (posture.deviceSignerStatus === DeviceSignerStatus.REVOKED) {
+              return preparation.result = this.#writeRefused(binding.workspace, "This device's access has been revoked.");
+            }
+            if (!posture.enrolledDevice || posture.deviceSignerStatus !== DeviceSignerStatus.ACTIVE) {
+              const enrolled = yield* this.#enrolAtConsole(
+                route,
+                binding,
+                `${application}|${principal}`,
+                principal,
+                keyHash,
+                [binding.workspace],
+                `${workId2}:console`
+              );
+              if (enrolled.case === "deferred") return preparation.result = enrolled.credentialRefused ? this.#writeRefused(binding.workspace, "Sign in again to set up this device.", RuntimeRefusalReason.INVALID_CREDENTIAL) : unavailable();
+              if (!(binding.workspace in enrolled.value.heads)) {
+                return preparation.result = this.#writeRefused(binding.workspace, "This device could not obtain access to save changes in this workspace.");
+              }
+              while (true) {
+                posture = this.#ports.posture(request, binding.session, principal, secret, false);
+                if (posture.deviceSignerStatus === DeviceSignerStatus.REVOKED) {
+                  return preparation.result = this.#writeRefused(binding.workspace, "This device's access has been revoked.");
+                }
+                if (posture.enrolledDevice && posture.deviceSignerStatus === DeviceSignerStatus.ACTIVE) break;
+                if (this.#ports.clock.monotonicNanoseconds() >= deadline) return preparation.result = unavailable();
+                const receipt = yield { case: "wake", value: create24(PeerWakeEffectSchema, {
+                  effectId: `${workId2}:observe-${++wake}`,
+                  delayMillis: 500
+                }) };
+                if (receipt.outcome.case !== "woken") return preparation.result = unavailable();
+              }
+            }
+          } catch (error) {
+            if (error instanceof ReceivingGroupRefusal) {
+              return preparation.result = this.#writeRefused(binding.workspace, "This device could not obtain access to save changes in this workspace.");
+            }
+            preparation.result = unavailable();
+            throw error;
+          } finally {
+            preparation.settled = true;
+            this.#preparingWrites.delete(key2);
+          }
+        }
+        return { case: "retried", request, response: this.#ports.call(request, command) };
+      }
       *#recoverOffer(request, response, account, workId2) {
         const workspace = this.#ports.binding(account.session).workspace;
         const deadline = this.#ports.clock.monotonicNanoseconds() + 60000000000n;
@@ -16468,6 +16586,7 @@ var init_receiving_group_desk = __esm({
         this.#opening.clear();
         this.#accounts.clear();
         this.#consoleEnrolments.clear();
+        this.#preparingWrites.clear();
       }
       #begin(request, workId2, procedure) {
         const held = {
@@ -20359,6 +20478,7 @@ var init_replica_follow_controller = __esm({
     init_replica_follow_state();
     init_local_copy_readability();
     init_placement_desk();
+    init_credential_failure();
     ReplicaFollowReconciliationKind = Object.freeze({
       Following: "following",
       NotFollowing: "not_following"
@@ -20626,12 +20746,12 @@ var init_replica_follow_controller = __esm({
           this.#desk.transition(result.workspace, { case: ReplicaFollowEventKind.WentOffline, nowUnixMillis });
           return delayUntilDue(this.#desk.get(result.workspace), nowUnixMillis);
         }
-        const credentialFailure = [result.pushError, result.discoveryError].find((failure) => failure?.status === 401 || failure?.status === 403);
-        if (credentialFailure) {
+        if (syncNeedsCredentialRefresh(result)) {
+          const offer = result.offerReceipt?.outcome;
           const transition = this.#desk.transition(result.workspace, {
             case: ReplicaFollowEventKind.CredentialRejected,
             nowUnixMillis,
-            failure: credentialFailure.message || `remote rejected credential with HTTP ${credentialFailure.status}`
+            failure: (offer?.case === "failure" ? offer.value.message : void 0) || result.pushError?.message || result.discoveryError?.message || "remote requires a refreshed credential"
           });
           if (transition.effects.some((effect) => effect.case === ReplicaFollowEffectKind.RefreshCredential)) {
             return 0;
@@ -23855,9 +23975,9 @@ var init_workspace_sync = __esm({
         return this.#route?.receptionUrl || `${this.#cloudBase()}/v2/workspaces/${encodeURIComponent(this.#mount.workspace)}`;
       }
       #authToken() {
-        const resolve8 = this.#credentials.authTokenForCapability ?? this.#credentials.authToken;
-        if (!resolve8) throw new Error("workspace sync has no credential capability resolver");
-        return resolve8.call(this.#credentials, this.#binding.credentialCapability);
+        const resolve9 = this.#credentials.authTokenForCapability ?? this.#credentials.authToken;
+        if (!resolve9) throw new Error("workspace sync has no credential capability resolver");
+        return resolve9.call(this.#credentials, this.#binding.credentialCapability);
       }
     };
   }
@@ -29347,6 +29467,7 @@ var init_peer_office = __esm({
         return this.#responses.modelAdoption(request, step);
       }
       #receivingGroupResponse(request, step) {
+        if (step.case === "refused") return this.#response(request, { case: "refused", value: step.value });
         if (step.case === "retried") return this.#birthCustodyResponse(step.request, this.#birthCustody.afterKernelCall(step.request, step.response));
         if (step.case === "pending") return this.#response(request, { case: "correspondencePending", value: step.value });
         if (step.case === "failure") return this.#failure(request, step.code, step.message);
@@ -29640,7 +29761,7 @@ function createPeerOfficeFrameRunner(kernel, credentials, profile, observations,
       const deadline = Date.now() + Math.max(0, withinMillis);
       while (outstanding() > 0 && Date.now() < deadline) {
         lanes.wake(0);
-        await new Promise((resolve8) => setTimeout(resolve8, 10));
+        await new Promise((resolve9) => setTimeout(resolve9, 10));
       }
       return outstanding();
     },
@@ -29701,7 +29822,7 @@ async function drivePeerFrame(runner, initialFrame, fetchImpl = globalThis.fetch
     if (response.outcome.case === "localReadPending") {
       if (yieldLocalReadToCaller) return responseFrame;
       const pending2 = response.outcome.value;
-      await new Promise((resolve8) => setTimeout(resolve8, pending2.resumeAfterMillis));
+      await new Promise((resolve9) => setTimeout(resolve9, pending2.resumeAfterMillis));
       responseFrame = runner.handleFrame(toBinary26(RuntimeRequestSchema, create72(RuntimeRequestSchema, {
         protocolVersion: response.protocolVersion,
         requestId: response.requestId,
@@ -29871,7 +29992,7 @@ async function executeHistoryAcquisitionEffect(effect, custody) {
   }
 }
 async function executeWakeEffect(effect) {
-  await new Promise((resolve8) => setTimeout(resolve8, effect.delayMillis));
+  await new Promise((resolve9) => setTimeout(resolve9, effect.delayMillis));
   return create72(PeerEffectReceiptSchema, { effectId: effect.effectId, outcome: { case: "woken", value: create72(PeerWokenSchema) } });
 }
 async function executeCredentialRefreshEffect(effect, provider) {
@@ -31188,7 +31309,7 @@ async function prepareRemoteModelTransition(cloud, input) {
     }
     atHash = status2.outcome.value.head ?? "";
     if (atHash || Date.now() >= deadline) break;
-    await new Promise((resolve8) => setTimeout(resolve8, 1e3));
+    await new Promise((resolve9) => setTimeout(resolve9, 1e3));
   }
   if (!atHash) {
     throw new Error("workspace has no current Git frontier to prove after pulling it");
@@ -31234,8 +31355,8 @@ async function prepareRemoteModelTransition(cloud, input) {
       target3
     );
     if (response.outcome.case !== "unavailable" || !response.outcome.value.retryable || Date.now() >= proofDeadline) break;
-    await new Promise((resolve8) => setTimeout(
-      resolve8,
+    await new Promise((resolve9) => setTimeout(
+      resolve9,
       Math.max(500, response.outcome.case === "unavailable" ? response.outcome.value.retryAfterMillis ?? 1e3 : 1e3)
     ));
   }
@@ -32088,7 +32209,7 @@ async function waitForWorkspaceMain(cloud, workspace, timeoutMs = 3e4) {
   while (Date.now() < deadline) {
     const head = await workspaceMainHead(cloud, workspace);
     if (head !== void 0) return head;
-    await new Promise((resolve8) => setTimeout(resolve8, 250));
+    await new Promise((resolve9) => setTimeout(resolve9, 250));
   }
   return void 0;
 }
@@ -32309,7 +32430,7 @@ async function ensureSovereignHome(opts = {}) {
     const deadline = Date.now() + 3e4;
     while (Date.now() < deadline) {
       if (await fetch(`${cloud}/v2/workspaces/${encodeURIComponent(home)}`).then((r) => r.ok).catch(() => false)) break;
-      await new Promise((resolve8) => setTimeout(resolve8, 250));
+      await new Promise((resolve9) => setTimeout(resolve9, 250));
     }
     if (!await fetch(`${cloud}/v2/workspaces/${encodeURIComponent(home)}`).then((r) => r.ok).catch(() => false)) {
       throw new Error(`Nomos admitted the birth of '${home}' but its custody did not become readable`);
@@ -32357,7 +32478,7 @@ async function ensureSovereignHome(opts = {}) {
         return typeof leaf?.verifiedVia === "string" && leaf.verifiedVia.length > 0;
       }).catch(() => false);
       if (visible) break;
-      await new Promise((resolve8) => setTimeout(resolve8, 250));
+      await new Promise((resolve9) => setTimeout(resolve9, 250));
     }
     if (!visible) throw new Error(`the session home's verified device enrollment did not become readable`);
   }
@@ -33741,7 +33862,7 @@ async function waitForDurableMainAdvance(cloud, ws2, previousHead, opts = {}) {
   while (Date.now() < deadline) {
     const head = await durableMainHead(cloud, ws2, fetchImpl);
     if (head !== void 0 && head !== previousHead) return head;
-    await new Promise((resolve8) => setTimeout(resolve8, pollMs));
+    await new Promise((resolve9) => setTimeout(resolve9, pollMs));
   }
   return void 0;
 }
@@ -34297,6 +34418,7 @@ var init_commands = __esm({
       "mcp",
       "init-editor",
       "test",
+      "conformance",
       "doctor",
       "cloud",
       "console",
@@ -34428,6 +34550,16 @@ var init_help = __esm({
         ],
         examples: ["githolon cloud dev", "githolon cloud dev --port 8787 --ephemeral", "githolon cloud dev --platform my-platform --law build/my.law.usdz"]
       },
+      conformance: {
+        usage: "githolon conformance [--json] [--offline] [--runtime <directory>]",
+        what: "Check the installed Node packages with an isolated generated application and the real test harness.\nProves write, read, refusal without mutation, persisted history and cold restore. Reports package versions\nand the kernel identity. First use may download verified runtime artifacts; no cloud workspace is changed.",
+        flags: [
+          ["--json", "emit one report for CI; exit nonzero if any check fails"],
+          ["--offline", "use local runtime artifacts only; fail if unavailable"],
+          ["--runtime <directory>", "use this verified runtime bundle"]
+        ],
+        examples: ["githolon conformance", "githolon conformance --offline --json"]
+      },
       test: {
         usage: "githolon test [test-file-or-flutter-test-flags] [--diagnostics]",
         what: "Run generated Dart application scenarios through Flutter with the real local Nomos custody plane.\nThe server rides inside githolon; connected scenarios, partitions, restarts and fresh reinstalls need no\nserver path, environment variables, certificates, workspace setup or separate application state.",
@@ -35040,35 +35172,171 @@ var init_mcp = __esm({
   }
 });
 
+// src/conformance.ts
+var conformance_exports = {};
+__export(conformance_exports, {
+  runConformance: () => runConformance
+});
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { cpSync, existsSync as existsSync13, mkdirSync as mkdirSync11, mkdtempSync as mkdtempSync4, readFileSync as readFileSync12, rmSync as rmSync6, symlinkSync, writeFileSync as writeFileSync12 } from "node:fs";
+import { createRequire as createRequire3 } from "node:module";
+import { tmpdir as tmpdir3 } from "node:os";
+import { dirname as dirname4, join as join17, resolve as resolve5 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+function installedPackage(name, from) {
+  const require2 = createRequire3(join17(from, "package.json"));
+  const entry = require2.resolve(name === "@githolon/testing" ? name : `${name}/package.json`);
+  for (let directory2 = dirname4(entry); ; directory2 = dirname4(directory2)) {
+    const manifest = join17(directory2, "package.json");
+    if (existsSync13(manifest)) {
+      const pkg = JSON.parse(readFileSync12(manifest, "utf8"));
+      if (pkg.name === name) return { name, version: pkg.version, directory: directory2 };
+    }
+    if (dirname4(directory2) === directory2) throw new Error(`Cannot identify installed ${name}`);
+  }
+}
+function runConformance(args, cwd = process.cwd()) {
+  let json = false, offline = false, runtime;
+  for (let index = 0; index < args.length; index++) {
+    const arg = args[index];
+    if (arg === "--json") json = true;
+    else if (arg === "--offline") offline = true;
+    else if (arg === "--runtime" && args[index + 1] && !args[index + 1].startsWith("--")) runtime = resolve5(cwd, args[++index]);
+    else {
+      process.stderr.write(`error: unknown or incomplete conformance option: ${arg}. See githolon conformance --help.
+`);
+      return 2;
+    }
+  }
+  const report = { passed: false, packages: [], checks: [] };
+  let scratch;
+  let stage = "installed packages";
+  let action = "Run npm install in this project. Install githolon, @githolon/dsl and @githolon/testing as development dependencies if absent.";
+  try {
+    const packages = ["githolon", "@githolon/dsl", "@githolon/testing"].map((name) => {
+      const pkg = installedPackage(name, cwd);
+      report.packages.push({ name, version: pkg.version });
+      return pkg;
+    });
+    const [cli, dsl] = packages;
+    const peer2 = installedPackage("@githolon/runtime", dsl.directory);
+    report.packages.push({ name: peer2.name, version: peer2.version });
+    report.checks.push({ name: stage, passed: true });
+    if (!json) {
+      process.stdout.write("Nomos conformance \u2014 isolated generated application, real local runtime\n");
+      for (const pkg of report.packages) process.stdout.write(`  ${pkg.name} ${pkg.version}
+`);
+    }
+    scratch = mkdtempSync4(join17(tmpdir3(), "nomos-conformance-"));
+    const here = dirname4(fileURLToPath2(import.meta.url));
+    const distribution = existsSync13(join17(here, "conformance-probe.mjs")) ? here : resolve5(here, "../dist");
+    cpSync(join17(distribution, "conformance-fixture"), scratch, { recursive: true });
+    writeFileSync12(join17(scratch, "package.json"), '{"name":"nomos-conformance-probe","private":true,"type":"module"}\n');
+    const modules = join17(scratch, "node_modules");
+    mkdirSync11(join17(modules, "@githolon"), { recursive: true });
+    for (const pkg of [dsl, peer2]) {
+      symlinkSync(pkg.directory, join17(modules, pkg.name), process.platform === "win32" ? "junction" : "dir");
+    }
+    const environment = { ...process.env, TMPDIR: scratch, TMP: scratch, TEMP: scratch };
+    const run2 = (argv) => {
+      const result = spawnSync5(process.execPath, argv, {
+        cwd: scratch,
+        env: environment,
+        encoding: "utf8",
+        timeout: 18e4,
+        maxBuffer: 8 * 1024 * 1024
+      });
+      if (result.error) throw result.error;
+      if (result.status !== 0) throw new Error((result.stderr || result.stdout || `Exited ${result.status}`).slice(-6e3));
+    };
+    stage = "compile generated application";
+    action = "Reinstall compatible githolon and @githolon/dsl versions from your lockfile. If this bundled fixture still fails, report the diagnostic and package versions to Nomos.";
+    if (!json) process.stdout.write(`Checking ${stage}\u2026
+`);
+    run2([join17(cli.directory, "dist/cli.mjs"), "compile", "--no-mount-check"]);
+    report.checks.push({ name: stage, passed: true });
+    stage = "runtime and application behavior";
+    action = "Check the selected runtime and installed @githolon/testing version. For an uncached runtime, run once online or supply a verified runtime directory with --runtime. Report repeatable behavior failures with this report.";
+    if (!json) process.stdout.write(`Checking ${stage}\u2026
+`);
+    const resultFile = join17(scratch, "result.json");
+    const testingEntry = createRequire3(join17(cwd, "package.json")).resolve("@githolon/testing");
+    const probe = spawnSync5(process.execPath, [
+      join17(distribution, "conformance-probe.mjs"),
+      testingEntry,
+      scratch,
+      resultFile,
+      runtime ?? "",
+      String(offline)
+    ], {
+      cwd: scratch,
+      env: environment,
+      encoding: "utf8",
+      timeout: 18e4,
+      maxBuffer: 8 * 1024 * 1024
+    });
+    if (existsSync13(resultFile)) {
+      const result = JSON.parse(readFileSync12(resultFile, "utf8"));
+      report.checks.push(...result.checks);
+      if (result.runtime) report.runtime = result.runtime;
+      if (result.failure) report.failure = result.failure;
+      report.passed = result.passed && probe.status === 0;
+    }
+    if (!report.passed && !report.failure) throw probe.error ?? new Error((probe.stderr || probe.stdout || `Probe exited ${probe.status}`).slice(-6e3));
+  } catch (error) {
+    report.checks.push({ name: stage, passed: false });
+    report.failure = { stage, detail: error instanceof Error ? error.message : String(error), action };
+  } finally {
+    if (scratch) rmSync6(scratch, { recursive: true, force: true });
+  }
+  if (json) process.stdout.write(JSON.stringify(report, null, 2) + "\n");
+  else {
+    if (report.runtime) process.stdout.write(`Kernel SHA-256: ${report.runtime.kernelSha256}
+`);
+    for (const check2 of report.checks) process.stdout.write(`${check2.passed ? "PASS" : "FAIL"} ${check2.name}${check2.detail ? ` \u2014 ${check2.detail}` : ""}
+`);
+    if (report.failure) process.stderr.write(`${report.failure.detail}
+Next: ${report.failure.action}
+`);
+    process.stdout.write(report.passed ? "PASS \u2014 installed Node stack conforms.\n" : "FAIL \u2014 conformance did not pass.\n");
+  }
+  return report.passed ? 0 : 1;
+}
+var init_conformance = __esm({
+  "src/conformance.ts"() {
+    "use strict";
+  }
+});
+
 // src/test.ts
 var test_exports = {};
 __export(test_exports, {
   resolveTestCloudEntry: () => resolveTestCloudEntry,
   runDartTests: () => runDartTests
 });
-import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync13 } from "node:fs";
-import { dirname as dirname4, resolve as resolve5 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { spawnSync as spawnSync6 } from "node:child_process";
+import { existsSync as existsSync14 } from "node:fs";
+import { dirname as dirname5, resolve as resolve6 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 function resolveTestCloudEntry(options = {}) {
   const cwd = options.cwd ?? process.cwd();
   const environment = options.environment ?? process.env;
   const explicit = environment.NOMOS_TEST_CLOUD_ENTRY;
   if (explicit !== void 0) {
-    const candidate = resolve5(cwd, explicit);
-    if (!existsSync13(candidate)) {
+    const candidate = resolve6(cwd, explicit);
+    if (!existsSync14(candidate)) {
       throw new Error(`NOMOS_TEST_CLOUD_ENTRY does not exist: ${candidate}`);
     }
     return candidate;
   }
-  const here = dirname4(fileURLToPath2(options.moduleUrl ?? import.meta.url));
+  const here = dirname5(fileURLToPath3(options.moduleUrl ?? import.meta.url));
   const candidates = [
-    resolve5(here, "dev-server.mjs"),
-    resolve5(here, "../dist/dev-server.mjs"),
-    resolve5(here, "../../platform-shells/node/local-development/server.ts"),
-    resolve5(cwd, "platform-shells/node/local-development/server.ts")
+    resolve6(here, "dev-server.mjs"),
+    resolve6(here, "../dist/dev-server.mjs"),
+    resolve6(here, "../../platform-shells/node/local-development/server.ts"),
+    resolve6(cwd, "platform-shells/node/local-development/server.ts")
   ];
-  const server = candidates.find((candidate) => existsSync13(candidate));
+  const server = candidates.find((candidate) => existsSync14(candidate));
   if (server === void 0) {
     throw new Error("the bundled local Nomos cloud is missing \u2014 rebuild or reinstall githolon");
   }
@@ -35086,7 +35354,7 @@ function runDartTests(args) {
     return 1;
   }
   process.stdout.write("githolon test \u2014 generated application scenarios with real local custody\n");
-  const result = spawnSync5("flutter", ["test", ...forwarded], {
+  const result = spawnSync6("flutter", ["test", ...forwarded], {
     cwd: process.cwd(),
     stdio: "inherit",
     env: {
@@ -35702,7 +35970,7 @@ var init_law_command_projection = __esm({
 });
 
 // src/law_encoder.ts
-import { readFileSync as readFileSync12 } from "node:fs";
+import { readFileSync as readFileSync13 } from "node:fs";
 async function loadInstalledLaw(input) {
   const file = discoverLawUsdz(input.cwd ?? process.cwd(), input.file);
   const inspected = await inspectLawArchive(input.cloud, file);
@@ -35714,7 +35982,7 @@ async function loadInstalledLaw(input) {
     );
   }
   const projection = parseLawCommandProjection(
-    readLawClosureAsset(new Uint8Array(readFileSync12(file)), COMMAND_PROJECTION)
+    readLawClosureAsset(new Uint8Array(readFileSync13(file)), COMMAND_PROJECTION)
   );
   return { identity: inspected.identity, servedDomains: served, projection, file };
 }
@@ -36010,7 +36278,7 @@ var init_model_children = __esm({
     init_law_directive_call();
     init_law_command_projection();
     init_law_encoder();
-    sleep = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
+    sleep = (ms) => new Promise((resolve9) => setTimeout(resolve9, ms));
   }
 });
 
@@ -36135,7 +36403,7 @@ async function modelAdopt(workspace, opts) {
         inventory = observed;
         break;
       }
-      await new Promise((resolve8) => setTimeout(resolve8, 250));
+      await new Promise((resolve9) => setTimeout(resolve9, 250));
     } while (Date.now() < deadline);
     if (inventory === void 0) throw new Error("the active-law projection did not converge within 30 seconds");
     const candidate = inventory.domains.find((installed) => installed.domainHash === identity);
@@ -36200,8 +36468,8 @@ __export(platform_exports, {
   storeSeatDevice: () => storeSeatDevice
 });
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync14, mkdirSync as mkdirSync11, readFileSync as readFileSync13, writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join17 } from "node:path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync12, readFileSync as readFileSync14, writeFileSync as writeFileSync13 } from "node:fs";
+import { join as join18 } from "node:path";
 function refuse(message) {
   throw new PlatformRefusal(message);
 }
@@ -36274,8 +36542,8 @@ async function readModelAuthority(cloud, platform, seatedAt) {
 }
 function loadSeatDevice(workspace) {
   const path4 = seatDevicePath(workspace);
-  if (!existsSync14(path4)) return void 0;
-  const stored = JSON.parse(readFileSync13(path4, "utf8"));
+  if (!existsSync15(path4)) return void 0;
+  const stored = JSON.parse(readFileSync14(path4, "utf8"));
   const publicKey = stored.publicKey ?? (stored.publicKeyHex === void 0 ? void 0 : Buffer.from(stored.publicKeyHex, "hex").toString("base64"));
   if (typeof stored.secret !== "string" || publicKey === void 0 || typeof stored.keyHash !== "string") {
     refuse(`${path4} is not a stored device key {secret, publicKey, keyHash}`);
@@ -36284,8 +36552,8 @@ function loadSeatDevice(workspace) {
 }
 function storeSeatDevice(workspace, device) {
   const path4 = seatDevicePath(workspace);
-  mkdirSync11(join17(path4, ".."), { recursive: true });
-  writeFileSync12(path4, JSON.stringify(device, null, 2) + "\n", { mode: 384 });
+  mkdirSync12(join18(path4, ".."), { recursive: true });
+  writeFileSync13(path4, JSON.stringify(device, null, 2) + "\n", { mode: 384 });
 }
 async function mintSeatDevice(cloud) {
   const generated = await generateDeviceKey(cloud);
@@ -36508,7 +36776,7 @@ async function platformAuthor(workspace, directiveId, opts) {
   }
 }
 function readPayload(opts) {
-  const raw = opts.payloadFile !== void 0 ? readFileSync13(opts.payloadFile, "utf8") : opts.payload;
+  const raw = opts.payloadFile !== void 0 ? readFileSync14(opts.payloadFile, "utf8") : opts.payload;
   if (raw === void 0 || raw.trim() === "") refuse("author needs --payload <json> or --payload-file <file>");
   let parsed;
   try {
@@ -36700,7 +36968,7 @@ async function waitFor(condition, deadlineMillis, report) {
       announced = elapsed;
       report(elapsed);
     }
-    await new Promise((resolve8) => setTimeout(resolve8, 1e3));
+    await new Promise((resolve9) => setTimeout(resolve9, 1e3));
   }
   return false;
 }
@@ -36720,7 +36988,7 @@ var init_platform = __esm({
     PlatformRefusal = class extends Error {
     };
     ws = (name) => encodeURIComponent(name);
-    seatDevicePath = (workspace) => join17(configDir(), `seat-device-${workspace}.json`);
+    seatDevicePath = (workspace) => join18(configDir(), `seat-device-${workspace}.json`);
     SEAT_CONVERGENCE_MILLIS = 18e4;
   }
 });
@@ -36786,9 +37054,9 @@ var init_dlq = __esm({
 
 // src/custodian.ts
 import { createHash as createHash7, createPrivateKey as createPrivateKey2, createPublicKey as createPublicKey2 } from "node:crypto";
-import { existsSync as existsSync15, readFileSync as readFileSync14 } from "node:fs";
-import { dirname as dirname5, isAbsolute as isAbsolute3, join as join18, resolve as resolve6 } from "node:path";
-import { fileURLToPath as fileURLToPath3, pathToFileURL as pathToFileURL3 } from "node:url";
+import { existsSync as existsSync16, readFileSync as readFileSync15 } from "node:fs";
+import { dirname as dirname6, isAbsolute as isAbsolute3, join as join19, resolve as resolve7 } from "node:path";
+import { fileURLToPath as fileURLToPath4, pathToFileURL as pathToFileURL3 } from "node:url";
 import { create as create80 } from "@bufbuild/protobuf";
 import { AnySchema as AnySchema3 } from "@bufbuild/protobuf/wkt";
 function custodianKeyHash(seed) {
@@ -36834,8 +37102,8 @@ async function resolveCustodianCredential(reference) {
     return fromSeed(custodianSeedFromText(device.secret, `~/.holon device key for ${rest}`), reference);
   }
   if (scheme === "file") {
-    if (rest === "" || !existsSync15(rest)) throw new Error(`--custodian-key file:<path> \u2014 no file at '${rest}'`);
-    return fromSeed(custodianSeedFromText(readFileSync14(rest, "utf8"), rest), `file:${rest}`);
+    if (rest === "" || !existsSync16(rest)) throw new Error(`--custodian-key file:<path> \u2014 no file at '${rest}'`);
+    return fromSeed(custodianSeedFromText(readFileSync15(rest, "utf8"), rest), `file:${rest}`);
   }
   if (scheme === "env") {
     const value = process.env[rest];
@@ -36861,8 +37129,8 @@ async function resolveCustodianCredential(reference) {
 }
 function readCustodianChain(file) {
   if (file === void 0) return [];
-  if (!existsSync15(file)) throw new Error(`--chain <file> \u2014 no file at '${file}'`);
-  const parsed = JSON.parse(readFileSync14(file, "utf8"));
+  if (!existsSync16(file)) throw new Error(`--chain <file> \u2014 no file at '${file}'`);
+  const parsed = JSON.parse(readFileSync15(file, "utf8"));
   const links = Array.isArray(parsed) ? parsed : typeof parsed === "object" && parsed !== null && Array.isArray(parsed.certChain) ? parsed.certChain : void 0;
   if (links === void 0) {
     throw new Error(
@@ -36912,10 +37180,10 @@ function scarFromVerdict(verdict) {
 }
 function frameworkReceptionPath(here = moduleDirectory()) {
   const candidates = [
-    join18(here, "framework", "nomos.reception.mjs"),
-    resolve6(here, "../../cloud/cloudflare-shell/domains/build/nomos/nomos.reception.mjs")
+    join19(here, "framework", "nomos.reception.mjs"),
+    resolve7(here, "../../cloud/cloudflare-shell/domains/build/nomos/nomos.reception.mjs")
   ];
-  const found = candidates.find((candidate) => existsSync15(candidate));
+  const found = candidates.find((candidate) => existsSync16(candidate));
   if (found === void 0) {
     throw new Error(
       "the framework controller's compiled Reception is missing \u2014 reinstall `githolon`, or compile it with `node dsl/compile_package.mjs domain_nomos.nomos.project.ts` in cloud/cloudflare-shell/domains"
@@ -36924,8 +37192,8 @@ function frameworkReceptionPath(here = moduleDirectory()) {
   return found;
 }
 async function encodeDirectiveCall(receptionPath, domain, directiveId, workspace, payload) {
-  const absolute = isAbsolute3(receptionPath) ? receptionPath : resolve6(process.cwd(), receptionPath);
-  if (!existsSync15(absolute)) throw new Error(`--reception <path> \u2014 no compiled Reception at '${absolute}'`);
+  const absolute = isAbsolute3(receptionPath) ? receptionPath : resolve7(process.cwd(), receptionPath);
+  if (!existsSync16(absolute)) throw new Error(`--reception <path> \u2014 no compiled Reception at '${absolute}'`);
   const module = await import(pathToFileURL3(absolute).href);
   const frameworkCalls = module["nomosFrameworkCalls"];
   if (typeof frameworkCalls === "object" && frameworkCalls !== null) {
@@ -36990,7 +37258,7 @@ async function encodeDirectiveCall(receptionPath, domain, directiveId, workspace
   return captured;
 }
 function readPayload2(opts) {
-  const text2 = opts.payloadFile !== void 0 ? readFileSync14(opts.payloadFile, "utf8") : opts.payload;
+  const text2 = opts.payloadFile !== void 0 ? readFileSync15(opts.payloadFile, "utf8") : opts.payload;
   if (text2 === void 0) throw new Error("pass the directive's payload with --payload <json> or --payload-file <file>");
   const parsed = JSON.parse(text2);
   if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
@@ -37204,7 +37472,7 @@ var init_custodian = __esm({
       [/forged-principal|ForgedPrincipal|VERIFIED author/i, "ForgedPrincipal"],
       [/bad-signature|BadSignature/i, "BadSignature"]
     ];
-    moduleDirectory = () => dirname5(fileURLToPath3(import.meta.url));
+    moduleDirectory = () => dirname6(fileURLToPath4(import.meta.url));
     CapturedCall = class extends Error {
       constructor() {
         super("call captured");
@@ -37330,9 +37598,9 @@ Options
 });
 
 // src/cli.ts
-import { existsSync as existsSync16, readFileSync as readFileSync15 } from "node:fs";
-import { dirname as dirname6, join as join19, resolve as resolve7 } from "node:path";
-import { pathToFileURL as pathToFileURL4, fileURLToPath as fileURLToPath4 } from "node:url";
+import { existsSync as existsSync17, readFileSync as readFileSync16 } from "node:fs";
+import { dirname as dirname7, join as join20, resolve as resolve8 } from "node:path";
+import { pathToFileURL as pathToFileURL4, fileURLToPath as fileURLToPath5 } from "node:url";
 
 // src/generate.ts
 import { mkdirSync, existsSync, writeFileSync } from "node:fs";
@@ -37844,6 +38112,7 @@ var USAGE2 = `githolon \u2014 model a business; Nomos owns the compute science
 Start here:
   githolon compile                 compile aggregates, birth, directives, and reads into law + a typed client
   githolon test                    run generated Dart scenarios with real local custody
+  githolon conformance             check the installed stack with an isolated generated application
   githolon check                   explain anything the law can already prove it would refuse
 
 The application surface is one idea:
@@ -38052,6 +38321,9 @@ async function main(argv) {
     const { initEditor: initEditor2 } = await Promise.resolve().then(() => (init_editor(), editor_exports));
     return initEditor2(process.cwd());
   }
+  if (argv[0] === "conformance") {
+    return (await Promise.resolve().then(() => (init_conformance(), conformance_exports))).runConformance(argv.slice(1));
+  }
   if (argv[0] === "test") {
     const { runDartTests: runDartTests2 } = await Promise.resolve().then(() => (init_test(), test_exports));
     return runDartTests2(argv.slice(1));
@@ -38075,18 +38347,18 @@ async function main(argv) {
 ${commandHelp("cloud") ?? USAGE2}`);
       return 1;
     }
-    const { spawnSync: spawnSync6 } = await import("node:child_process");
-    const here = dirname6(fileURLToPath4(import.meta.url));
+    const { spawnSync: spawnSync7 } = await import("node:child_process");
+    const here = dirname7(fileURLToPath5(import.meta.url));
     const candidates = [
-      resolve7(here, "dev-server.mjs")
+      resolve8(here, "dev-server.mjs")
       // published: dist/dev-server.mjs
     ];
-    const serverPath = candidates.find((p) => existsSync16(p));
+    const serverPath = candidates.find((p) => existsSync17(p));
     if (!serverPath) {
       process.stderr.write("error: dev-server not found \u2014 reinstall `githolon` or run `npm run build` in the cli package\n");
       return 1;
     }
-    const r = spawnSync6(process.execPath, [serverPath, ...argv.slice(2)], { stdio: "inherit" });
+    const r = spawnSync7(process.execPath, [serverPath, ...argv.slice(2)], { stdio: "inherit" });
     return r.status ?? 0;
   }
   if (argv[0] === "status") {