@githolon/dsl 0.100.5 → 0.101.0

package/src/codegen_ts.ts

@@ -36,10 +36,18 @@
  */
 import type { z } from "zod";
 
-import type { AggregateHandle } from "./aggregate.js";
+import {
+  BUSINESS_BIRTH_SEED_PAYLOAD_FIELD,
+  OWNED_CUSTODY_PAYLOAD_FIELD,
+  OWNED_KEY_PAYLOAD_FIELD,
+  OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD,
+  type AggregateHandle,
+} from "./aggregate.js";
 import type { Field, ValueObjectDescriptor, ValueObjectFieldDescriptor } from "./fields.js";
 import type { Directive } from "./directive.js";
 import type { DomainModule } from "./codegen_dart.js";
+import { OWNED_DEVICE_APPROVAL_DIRECTIVE, ownedRecordActionDirectiveId } from "./framework/owned_custody.js";
+import { BUSINESS_CORRECTION_DIRECTIVE } from "./framework/business_corrections.js";
 import { collectActivityDescriptors, type PackageActivityEntry } from "./codegen_dart.js";
 import type { NomosCompat } from "./compat_manifest.js";
 import type { QueryDecl } from "./query.js";
@@ -50,13 +58,21 @@ import { finishSum } from "./sum.js";
 import type { DerivedDecl } from "./derived.js";
 import type { CombinedDecl } from "./combined.js";
 import { resolveWorkspaceTypes, type ResolvedWorkspaceType, type WorkspaceTypeDecl } from "./workspace_type.js";
-import { deriveClientMintPlan, type ClientMintPlanEntry } from "./workspace_routing.js";
+import {
+  deriveClientMintPlan,
+  deriveDirectiveRecordTarget,
+  type ClientMintPlanEntry,
+} from "./workspace_routing.js";
 import { admitsNull, nullDocLine } from "./null_meta.js";
+import { isNamespacedAggregate, qualifyReadProjectionType } from "./read_projection_namespace.js";
+import { publicClientInterface, type DomainInterface } from "./shape_compat.js";
+import { buildNomosDescribeModel, type NomosDescribeModel } from "./describe_model.js";
+import { assertModelClientMemberAvailable } from "./generated_client_names.js";
 
 const cap = (s: string) => (s.length ? s[0]!.toUpperCase() + s.slice(1) : s);
 const camel = (s: string) => s.replace(/[_\s-]+(\w)/g, (_m, c: string) => c.toUpperCase());
 const lcFirst = (s: string) => (s.length ? s[0]!.toLowerCase() + s.slice(1) : s);
-const upperSnake = (s: string) => s.replace(/[-\s]+/g, "_").replace(/([a-z0-9])([A-Z])/g, "$1_$2").toUpperCase();
+const upperSnake = (s: string) => s.replace(/[^A-Za-z0-9]+/g, "_").replace(/([a-z0-9])([A-Z])/g, "$1_$2").toUpperCase();
 
 /** A count/sum group-by field → a valid TS param identifier. A DOTTED group-by (`location.source`,
  *  the #30 follow-up) camel-joins into `locationSource` (a bare `location.source` is not a legal
@@ -113,13 +129,14 @@ export interface EncFieldMap {
   readonly scope: string;
   readonly aggSid: string;
   readonly fieldSid: string;
+  readonly owned?: true;
 }
 /** Per-domain: which directive payload fields seal, and which read-model fields decrypt. */
 export interface EncDomainMap {
   /** directiveId → (payload field → seal coordinates). */
   readonly directives: Record<string, Record<string, EncFieldMap>>;
   /** aggregate type id → (field → { scope }) — the fields a read decrypts under `scope`. */
-  readonly reads: Record<string, Record<string, { scope: string }>>;
+  readonly reads: Record<string, Record<string, { scope: string; owned?: true }>>;
 }
 
 /** The sid-keyed read shape of ONE domain's interface (mirrors `shape_compat.ts` DomainInterface). */
@@ -157,13 +174,14 @@ export function domainEncryptionMap(
   const domain = mod.domain ?? mod.name;
   const aggs = mod.aggregates as AggregateHandle[];
   const directives: Record<string, Record<string, EncFieldMap>> = {};
-  const reads: Record<string, Record<string, { scope: string }>> = {};
+  const reads: Record<string, Record<string, { scope: string; owned?: true }>> = {};
   for (const agg of aggs) {
     const scope = agg.visibility?.requires;
     const encFields = agg.encryptedFields;
     if (encFields === undefined || encFields.length === 0 || scope === undefined) continue;
-    const r: Record<string, { scope: string }> = {};
-    for (const f of encFields) r[f] = { scope };
+    const r: Record<string, { scope: string; owned?: true }> = {};
+    const owned = agg.audience?.kind === "owned";
+    for (const f of encFields) r[f] = { scope, ...(owned ? { owned: true as const } : {}) };
     reads[agg.id] = r;
   }
   for (const d of mod.directives as Directive<unknown>[]) {
@@ -185,7 +203,12 @@ export function domainEncryptionMap(
             `the package structural interface (with stable ids) is required to bake the E2E-sealing map`,
         );
       }
-      fmap[f] = { scope, aggSid: sids.aggSid, fieldSid: sids.fieldSid };
+      fmap[f] = {
+        scope,
+        aggSid: sids.aggSid,
+        fieldSid: sids.fieldSid,
+        ...(agg.audience?.kind === "owned" ? { owned: true as const } : {}),
+      };
     }
     if (Object.keys(fmap).length > 0) directives[d.id] = fmap;
   }
@@ -487,7 +510,7 @@ function tsTypeOfField(field: Field): string {
   // SURFACED MERGE CONFLICTS (architecture/surfaced_merge_conflict.md): the FIRST driver that
   // changes a field's generated type. A `.merge(Surfaced(...))` field reads as the plain scalar
   // once resolved, or the `{__surfaced:{pending:[...]}}` envelope while genuinely concurrent
-  // writes await a human pick — typed as the discriminated union `SurfacedValue<T>` (emitted
+  // writes await a business merge — typed as the discriminated union `SurfacedValue<T>` (emitted
   // once per file that needs it). The client does NO transformation; this types the exact
   // read-collapse JSON.
   if ((field.driver as { kind?: string } | undefined)?.kind === "Surfaced") {
@@ -691,47 +714,183 @@ export interface TsClientOptions {
 /** TS string literal (JSON.stringify covers escaping). */
 const _actLit = (s: string): string => JSON.stringify(s);
 
-/** Emit the ACTIVITY-FEED block (architecture/activity_descriptors.md): the `ActivityEvent`/`ActivityRef`/
+/** Emit the ACTIVITY + SELF-DESCRIPTION block (architecture/activity_descriptors.md): the `ActivityEvent`/`ActivityRef`/
  *  `ActivityRawRow` runtime types, a dotted payload-path getter, the per-directive `renderActivity` registry,
  *  and the shared template renderer — inline in the generated `.client.ts` (mirrors the ForeignRef placement).
- *  Empty when no directive declares `.activity(...)` — an activity-free package stays BYTE-IDENTICAL. */
-function emitTsActivityBlock(entries: readonly PackageActivityEntry[]): string[] {
-  if (entries.length === 0) return [];
+ *  An action-free package gets an empty registry but keeps the universal describe() surface. Every public
+ *  directive receives either its declared prose or a framework-owned accountable baseline. */
+function emitTsActivityBlock(entries: readonly PackageActivityEntry[], describeModel: NomosDescribeModel): string[] {
   const arm = (e: PackageActivityEntry): string[] => {
-    const { directiveId, desc } = e;
+    const { domain, directiveId, desc } = e;
     const params = desc.params.map((p) => `${_actLit(p.name)}: _activityPayloadPath(row.payload, ${_actLit(p.from)})`).join(", ");
-    const refs = desc.refs
+    const refs = e.correction === true
+      ? `_activityCorrectionRefs(row)`
+      : `{ ${desc.refs
       .map((r) => {
         // A `from: "@created"` ref reads the id the LAW MINTED (the row's `created` list, first type match);
         // any other `from` is a payload path. Every ref carries the session workspace (the row's `workspace`).
         const id = r.from === "@created"
-          ? `_activityCreatedId(row.created, ${_actLit(r.type)})`
-          : `_activityPayloadPath(row.payload, ${_actLit(r.from)})`;
+          ? `_activityAggregateId(row.created, ${_actLit(r.type)})`
+          : r.from === "@affected"
+            ? `_activityAggregateId(row.affected, ${_actLit(r.type)})`
+            : `_activityPayloadPath(row.payload, ${_actLit(r.from)})`;
         return `${_actLit(r.name)}: { workspace: row.workspace ?? "", type: ${_actLit(r.type)}, id: ${id} }`;
       })
-      .join(", ");
+      .join(", ")} }`;
     return [
-      `  ${_actLit(directiveId)}: (row: ActivityRawRow): ActivityEvent => {`,
+      `  ${_actLit(`${domain.length}:${domain}${directiveId}`)}: (row: _CompleteActivityRawRow): ActivityEvent => {`,
       `    const params: Record<string, string> = { ${params} };`,
       `    const vars = { actor: row.actorSubject, ...params };`,
       `    return {`,
-      `      eventId: row.intentId, kind: ${_actLit(desc.kind)}, actorSubject: row.actorSubject, occurredAt: row.occurredAt,`,
+      `      eventId: ${e.correction === true ? "_activityOpaqueCorrectionId(row.intentId)" : "row.intentId"}, kind: ${_actLit(desc.kind)}, actorSubject: row.actorSubject, occurredAt: row.occurredAt,`,
       `      title: _renderActivityTemplate(${_actLit(desc.title)}, vars), message: _renderActivityTemplate(${_actLit(desc.message)}, vars),`,
       `      titleKey: ${_actLit(desc.titleKey)}, messageKey: ${_actLit(desc.messageKey)},`,
-      `      params, refs: { ${refs} },`,
+      `      params, refs: ${refs},`,
       ...(desc.category !== undefined ? [`      category: ${_actLit(desc.category)},`] : []),
       ...(desc.icon !== undefined ? [`      icon: ${_actLit(desc.icon)},`] : []),
-      `      severity: ${_actLit(desc.severity)}, domain: row.domain, directiveId: ${_actLit(directiveId)},`,
+      `      severity: ${_actLit(desc.severity)}, domain: row.domain, directiveId: ${_actLit(e.correction === true ? "correction" : directiveId)},`,
       `    };`,
       `  },`,
     ];
   };
   return [
+    `// ── model evolution — generated business surface over exact-history proof ──`,
+    `export interface NomosModelDifference {`,
+    `  kind: "rules" | "outcome" | "evidence"; area?: string; action?: string; summary: string;`,
+    `}`,
+    `export interface NomosModelReview {`,
+    `  checkedActions: number; candidateActions: number; sameOutcome: boolean | null;`,
+    `  differences: NomosModelDifference[];`,
+    `}`,
+    `export type NomosModelAdoption =`,
+    `  | { status: "adopted"; summary: string; review: NomosModelReview }`,
+    `  | { status: "needs-decision"; summary: string; review: NomosModelReview; accept(because: string): Promise<NomosModelAdoption> }`,
+    `  | { status: "blocked"; summary: string; review: NomosModelReview };`,
+    `export type NomosModelRestoration =`,
+    `  | { status: "restored"; summary: string; review: NomosModelReview }`,
+    `  | { status: "needs-decision"; summary: string; review: NomosModelReview; accept(because: string): Promise<NomosModelRestoration> }`,
+    `  | { status: "blocked"; summary: string; review: NomosModelReview };`,
+    `interface __NomosModelReportWire {`,
+    `  sourceVerified: boolean; complete: boolean; promotable: boolean;`,
+    `  replayedIntents: number; candidateIntents: number; evolve: { ok: boolean };`,
+    `  projection?: { equal: boolean };`,
+    `  divergences: { kind: string; domain?: string; directiveId?: string; admitted?: boolean }[];`,
+    `}`,
+    `interface __NomosModelAdoptionWire {`,
+    `  ok: boolean; stage: "promoted" | "identity" | "preflight" | "acceptance" | "admission";`,
+    `  report?: __NomosModelReportWire; error?: string;`,
+    `}`,
+    `interface __NomosModelRestorationWire {`,
+    `  ok: boolean; stage: "restored" | "identity" | "preflight" | "acceptance" | "admission";`,
+    `  report?: __NomosModelReportWire; error?: string;`,
+    `}`,
+    `function _nomosModelReview(report?: __NomosModelReportWire): NomosModelReview {`,
+    `  const differences: NomosModelDifference[] = [];`,
+    `  for (const difference of report?.divergences ?? []) {`,
+    `    const area = typeof difference.domain === "string" && !difference.domain.includes("nomos_internal")`,
+    `      ? difference.domain : undefined;`,
+    `    const action = typeof difference.directiveId === "string" && !difference.directiveId.includes("nomos_internal")`,
+    `      ? difference.directiveId : undefined;`,
+    `    const kind: NomosModelDifference["kind"] = difference.kind === "plan-divergence" ? "outcome"`,
+    `      : difference.kind === "unsupported-premise" || difference.kind === "read-conflict" ? "evidence" : "rules";`,
+    `    const subject = action ?? (kind === "outcome" ? "A business action" : "A historical action");`,
+    `    const summary = kind === "outcome"`,
+    `      ? subject + " would produce a different result under this model."`,
+    `      : kind === "evidence"`,
+    `        ? "Nomos could not reproduce all evidence needed by " + subject + "."`,
+    `        : subject + " is not accepted by this model's rules.";`,
+    `    differences.push({ kind, ...(area === undefined ? {} : { area }), ...(action === undefined ? {} : { action }), summary });`,
+    `  }`,
+    `  if (report !== undefined && !report.evolve.ok && !differences.some((d) => d.kind === "rules")) {`,
+    `    differences.push({ kind: "rules", summary: "This model does not yet explain how to interpret every existing value." });`,
+    `  }`,
+    `  if (report !== undefined && (!report.sourceVerified || !report.complete) && !differences.some((d) => d.kind === "evidence")) {`,
+    `    differences.push({ kind: "evidence", summary: "Nomos could not re-prove every premise in the current business history." });`,
+    `  }`,
+    `  return {`,
+    `    checkedActions: report?.replayedIntents ?? 0, candidateActions: report?.candidateIntents ?? 0,`,
+    `    sameOutcome: report?.projection?.equal ?? null, differences,`,
+    `  };`,
+    `}`,
+    `async function _nomosAdoptModel(`,
+    `  holon: NomosHolon, domain: string, candidateHash: string, because?: string,`,
+    `): Promise<NomosModelAdoption> {`,
+    `  if (!holon.__nomosAdoptModel) {`,
+    `    return { status: "blocked", summary: "This device needs the current Nomos client before it can adopt a model.", review: _nomosModelReview() };`,
+    `  }`,
+    `  const raw = await holon.__nomosAdoptModel(domain, candidateHash, because === undefined ? {} : { because });`,
+    `  const review = _nomosModelReview(raw.report);`,
+    `  if (raw.stage === "promoted" && raw.ok) {`,
+    `    return { status: "adopted", summary: "Nomos proved this model against current history and made it active.", review };`,
+    `  }`,
+    `  if (raw.stage === "acceptance") {`,
+    `    return {`,
+    `      status: "needs-decision",`,
+    `      summary: "This model would change prior business outcomes. Review the differences and record why that is intended.",`,
+    `      review,`,
+    `      accept: async (reason: string) => {`,
+    `        const stated = reason.trim();`,
+    `        if (!stated) throw new Error("accept(reason) needs the business reason for changing prior outcomes");`,
+    `        return _nomosAdoptModel(holon, domain, candidateHash, stated);`,
+    `      },`,
+    `    };`,
+    `  }`,
+    `  const summary = raw.stage === "identity"`,
+    `    ? "Sign in before adopting this model so the decision is accountable."`,
+    `    : raw.report !== undefined && !raw.report.sourceVerified`,
+    `      ? "The current history could not be verified. Nothing changed and the current model remains active."`,
+    `      : raw.report !== undefined && !raw.report.complete`,
+    `        ? "Nomos could not re-prove every historical dependency. Nothing changed and the current model remains active."`,
+    `        : raw.report !== undefined && !raw.report.evolve.ok`,
+    `          ? "This model cannot yet interpret every existing value. Nothing changed and the current model remains active."`,
+    `          : "The workspace changed or refused this adoption. Nothing changed; ask Nomos to try again.";`,
+    `  return { status: "blocked", summary, review };`,
+    `}`,
+    `async function _nomosRestorePreviousModel(`,
+    `  holon: NomosHolon, domain: string, currentHash: string, because?: string,`,
+    `): Promise<NomosModelRestoration> {`,
+    `  if (!holon.__nomosRestorePreviousModel) {`,
+    `    return { status: "blocked", summary: "This device needs the current Nomos client before it can restore a model.", review: _nomosModelReview() };`,
+    `  }`,
+    `  const raw = await holon.__nomosRestorePreviousModel(domain, currentHash, because === undefined ? {} : { because });`,
+    `  const review = _nomosModelReview(raw.report);`,
+    `  if (raw.stage === "restored" && raw.ok) {`,
+    `    return { status: "restored", summary: "Nomos re-proved current history and restored the previous model.", review };`,
+    `  }`,
+    `  if (raw.stage === "acceptance") {`,
+    `    return {`,
+    `      status: "needs-decision",`,
+    `      summary: "Restoring the previous model changes which rules govern future work. Review the effects and record why restoration is intended.",`,
+    `      review,`,
+    `      accept: async (reason: string) => {`,
+    `        const stated = reason.trim();`,
+    `        if (!stated) throw new Error("accept(reason) needs the business reason for restoring the previous model");`,
+    `        return _nomosRestorePreviousModel(holon, domain, currentHash, stated);`,
+    `      },`,
+    `    };`,
+    `  }`,
+    `  const summary = raw.stage === "identity"`,
+    `    ? "Sign in before restoring a model so the decision is accountable."`,
+    `    : raw.error?.includes("restore-no-previous")`,
+    `      ? "This is the first model for this business; there is no previous model to restore."`,
+    `      : raw.error?.includes("restore-current-changed")`,
+    `        ? "The current model changed before restoration could finish. Nothing changed; ask Nomos to review again."`,
+    `        : raw.report !== undefined && !raw.report.sourceVerified`,
+    `          ? "The current history could not be verified. Nothing changed and the current model remains active."`,
+    `          : raw.report !== undefined && !raw.report.complete`,
+    `            ? "Nomos could not re-prove every historical dependency. Nothing changed and the current model remains active."`,
+    `            : raw.report !== undefined && !raw.report.evolve.ok`,
+    `              ? "The previous model cannot safely interpret every existing value. Nothing changed and the current model remains active."`,
+    `              : "The workspace refused restoration. Nothing changed and the current model remains active.";`,
+    `  return { status: "blocked", summary, review };`,
+    `}`,
+    ``,
     `// ── activity feed (architecture/activity_descriptors.md) — typed rows folded from the intent log ──`,
     `/** A declared navigation target on an activity row: the canonical [NomosRef] triple (workspace + type +`,
     ` *  resolved id). A \`from: "@created"\` ref resolves the id the LAW minted; others a payload path. */`,
     `export interface ActivityRef { workspace: string; type: string; id: string }`,
-    `/** A rendered activity row — produced by \`renderActivity\` from a directive's declared \`.activity(...)\`. */`,
+    `/** A rendered activity row — every public business directive has a framework-owned baseline;`,
+    ` *  an optional \`.activity(...)\` declaration enriches its language and references. */`,
     `export interface ActivityEvent {`,
     `  eventId: string; kind: string; actorSubject: string; occurredAt: string;`,
     `  title: string; message: string; titleKey: string; messageKey: string;`,
@@ -741,11 +900,56 @@ function emitTsActivityBlock(entries: readonly PackageActivityEntry[]): string[]
     `  domain: string; directiveId: string;`,
     `}`,
     `/** The runtime's per-committed-intent RAW ROW (the shape \`holon.watchActivity\`/\`activityLog\` yield). */`,
-    `export interface ActivityRawRow { intentId: string; domain: string; directiveId: string; actorSubject: string; occurredAt: string; payload: Record<string, unknown>; created?: { type: string; id: string }[]; workspace?: string }`,
-    `/** A NARRATIVE over the activity log (for an in-app LLM): the filtered events + a plain-English \`transcript\``,
-    ` *  (ONE LINE PER EVENT, oldest-first, \`"<occurredAt> — <title>: <message>"\`) — grounding text over the`,
-    ` *  VERIFIED log, never raw payloads. Produced by the client's \`describe\` / \`describeHistory\`. */`,
+    `export interface ActivityRawRow { intentId: string | null; domain: string | null; directiveId: string | null; actorSubject: string | null; occurredAt: string | null; payload: Record<string, unknown>; created?: { type: string; id: string }[]; affected?: { type: string; id: string }[]; workspace?: string }`,
+    `interface _CompleteActivityRawRow extends ActivityRawRow { intentId: string; domain: string; directiveId: string; actorSubject: string; occurredAt: string }`,
+    `/** A verified narrative over the activity log. \`describeHistory\` returns this narrow form;`,
+    ` *  \`describe\` returns the richer linked [NomosDescription] while preserving these two fields. */`,
     `export interface ActivityNarrative { events: ActivityEvent[]; transcript: string }`,
+    `/** The root page plus the six product questions every generated client can answer. */`,
+    `export type NomosDescribeSection = "root" | "model" | "current" | "rules" | "history" | "decisions" | "evidence";`,
+    `export interface NomosDescribeLink {`,
+    `  section: Exclude<NomosDescribeSection, "root">; label: string; question: string; summary: string;`,
+    `}`,
+    `export interface NomosDescribeItem {`,
+    `  kind: string; id: string; label: string; summary: string;`,
+    `  details?: Record<string, unknown>; refs?: NomosRef[];`,
+    `}`,
+    `/** A parent-ledger link to another part of the organisation. Open that workspace's generated client`,
+    ` *  and call describe() again; each child explains itself in its own installed business language. */`,
+    `export interface NomosDescribeChild {`,
+    `  workspace: string; status: "active" | "retired" | "reclaimed" | "unknown"; bornAt: string | null;`,
+    `  section: "root"; label: string; question: string; summary: string;`,
+    `}`,
+    `export interface NomosOrganisationDescription { complete: boolean; children: NomosDescribeChild[] }`,
+    `/** One grounded page in the hierarchical self-description. Root links to exactly six detail pages. */`,
+    `export interface NomosDescription extends ActivityNarrative {`,
+    `  section: NomosDescribeSection; title: string; summary: string;`,
+    `  items: NomosDescribeItem[]; links: NomosDescribeLink[];`,
+    `  organisation: NomosOrganisationDescription;`,
+    `}`,
+    `/** Compiler-known business language and policy. Runtime facts are joined behind \`describe()\`. */`,
+    `const _NOMOS_DESCRIBE_MODEL = ${JSON.stringify(describeModel)} as const;`,
+    `type _NomosRefusalReason = "permission" | "business-rule" | "model-change" | "evidence" | "review";`,
+    `/** Turn a kernel/runtime refusal into stable business vocabulary. The raw verdict remains in`,
+    ` *  durable custody; describe() never asks an agent to parse it or leaks it as explanation. */`,
+    `function _nomosRefusalReason(error: string): _NomosRefusalReason {`,
+    `  const text = error.toLowerCase();`,
+    `  const has = (...parts: string[]): boolean => parts.some((part) => text.includes(part));`,
+    `  if (has("evolve", "schema", "projection", "retype", "removed field", "law drift", "law-drift", "cross-version", "older model", "authored under")) return "model-change";`,
+    `  if (has("attest", "evidence", "source session", "source unreachable", "read unreachable")) return "evidence";`,
+    `  if (has("permission", "unauthor", "forbidden", "requires relation", "relation gate", "signer", "principal", "access denied", "not enrolled")) return "permission";`,
+    `  if (has("precondition", "invariant", "constraint", "validation", "invalid payload", "business rule", "required field", "must be")) return "business-rule";`,
+    `  return "review";`,
+    `}`,
+    `function _nomosRefusalSummary(reason: _NomosRefusalReason, action: string): string {`,
+    `  switch (reason) {`,
+    `    case "permission": return action + " was retained because its author did not have the required business permission.";`,
+    `    case "business-rule": return action + " was retained because it did not satisfy the business rules declared for that action.";`,
+    `    case "model-change": return action + " was created under a model the workspace cannot currently interpret. It remains available while other work continues.";`,
+    `    case "evidence": return action + " was retained because required verified business evidence was unavailable.";`,
+    `    case "review": return action + " was retained for review and has not changed the business state.";`,
+    `  }`,
+    `}`,
     `/** Build the LLM-ready transcript: one line per event, OLDEST-FIRST (the log yields newest-first). */`,
     `function _activityTranscript(events: readonly ActivityEvent[]): string {`,
     "  return [...events].reverse().map((e) => `${e.occurredAt} — ${e.title}: ${e.message}`).join(\"\\n\");",
@@ -762,23 +966,39 @@ function emitTsActivityBlock(entries: readonly PackageActivityEntry[]): string[]
     `/** The id the LAW minted for a \`from: "@created"\` ref — the first entry of the row's \`created\` list whose`,
     ` *  type matches the declared aggregate (the runtime type is uuid-stripped + may be namespaced, so match on`,
     ` *  equality OR \`<domain>.<Type>\` suffix). "" when the holon returned no created list (era-safe). */`,
-    `function _activityCreatedId(created: { type: string; id: string }[] | undefined, declared: string): string {`,
-    `  if (created === undefined) return "";`,
-    `  for (const c of created) if (c.type === declared || c.type.endsWith("." + declared)) return c.id;`,
+    `function _activityAggregateId(aggregates: { type: string; id: string }[] | undefined, declared: string): string {`,
+    `  if (aggregates === undefined) return "";`,
+    `  for (const c of aggregates) if (c.type === declared || c.type.endsWith("." + declared)) return c.id;`,
     `  return "";`,
     `}`,
+    `/** Correction refs are derived by the runtime from the corrected action's sealed events. */`,
+    `function _activityCorrectionRefs(row: ActivityRawRow): Record<string, ActivityRef> {`,
+    `  return Object.fromEntries((row.affected ?? []).map((ref, index) => [`,
+    `    \`subject\${index + 1}\`, { workspace: row.workspace ?? "", type: ref.type, id: ref.id },`,
+    `  ]));`,
+    `}`,
+    `/** Keep a framework-private correction identity stable and traceable without exposing its internal name. */`,
+    `function _activityOpaqueCorrectionId(id: string): string {`,
+    `  const hash = (seed: number): string => {`,
+    `    let h = seed >>> 0;`,
+    `    for (let i = 0; i < id.length; i++) h = Math.imul((h ^ id.charCodeAt(i)) >>> 0, 16777619) >>> 0;`,
+    `    return h.toString(16).padStart(8, "0");`,
+    `  };`,
+    `  return \`correction-\${hash(2166136261)}\${hash(2246822507)}\`;`,
+    `}`,
     `/** Interpolate \`{name}\` placeholders in a template from vars (a missing var renders empty). */`,
     `function _renderActivityTemplate(template: string, vars: Record<string, string>): string {`,
     `  return template.replace(/\\{([a-zA-Z0-9_]+)\\}/g, (_m, name: string) => vars[name] ?? "");`,
     `}`,
-    `const _ACTIVITY_REGISTRY: Record<string, (row: ActivityRawRow) => ActivityEvent> = {`,
+    `const _ACTIVITY_REGISTRY: Record<string, (row: _CompleteActivityRawRow) => ActivityEvent> = {`,
     ...entries.flatMap(arm),
     `};`,
-    `/** Fold ONE committed-intent raw row into a typed [ActivityEvent], or null when the directive declares`,
-    ` *  no \`.activity(...)\`. Pure — the kernel/ledger stays the audit truth; this is a client-side projection. */`,
+    `/** Fold ONE committed-intent raw row into a typed [ActivityEvent], or null for framework/control work`,
+    ` *  outside this generated business package. Pure — the kernel/ledger stays the audit truth. */`,
     `export function renderActivity(row: ActivityRawRow): ActivityEvent | null {`,
-    `  const f = _ACTIVITY_REGISTRY[row.directiveId];`,
-    `  return f === undefined ? null : f(row);`,
+    `  if (typeof row.intentId !== "string" || typeof row.domain !== "string" || typeof row.directiveId !== "string" || typeof row.actorSubject !== "string" || typeof row.occurredAt !== "string") return null;`,
+    `  const f = _ACTIVITY_REGISTRY[\`${"${row.domain.length}:${row.domain}${row.directiveId}"}\`];`,
+    `  return f === undefined ? null : f(row as _CompleteActivityRawRow);`,
     `}`,
     ``,
   ];
@@ -800,6 +1020,9 @@ function anyPackedTaxonomy(modules: readonly DomainModule[]): boolean {
 }
 
 export function generateTsClient(modules: readonly DomainModule[], opts: TsClientOptions): string {
+  // Collect the one framework-authored correction testimony before presentation filtering removes its
+  // private directive. Ordinary internal machinery stays absent from the registry.
+  const packageActivityEntries = collectActivityDescriptors(modules);
   // Business-birth framework declarations remain in the certified module, but are not application
   // vocabulary. Strip only the presentation marker here; manifests, hashes and the engine see the full law.
   modules = modules.map((mod) => {
@@ -821,15 +1044,38 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
         : { readModelAggregates: mod.readModelAggregates.filter((id) => publicAggregateIds.has(id)) }),
     };
   });
+  for (const mod of modules) assertModelClientMemberAvailable(mod);
+  const clientInterface = opts.interface === undefined
+    ? undefined
+    : publicClientInterface(modules, opts.interface as unknown as Record<string, DomainInterface>);
   const hashConst = tsHashConstName(opts.packageName);
   // THE E2E-SEALING MAP (the sealing client): non-null iff any field is `.encrypted()`. When null,
   // NOTHING below emits — the generated client is byte-identical to a pre-sealing compile.
   const encMap = buildEncryptionMap(
     modules,
-    opts.interface as Record<string, { aggregates?: Record<string, InterfaceAggShape> }> | undefined,
+    clientInterface as Record<string, { aggregates?: Record<string, InterfaceAggShape> }> | undefined,
   );
   const encPresent = encMap !== null;
+  const ownedPresent = encMap !== null && Object.values(encMap).some((domain) =>
+    [...Object.values(domain.directives), ...Object.values(domain.reads)].some((fields) =>
+      Object.values(fields).some((field) => field.owned === true),
+    ),
+  );
+  const manualEncryptionPresent = encMap !== null && Object.values(encMap).some((domain) =>
+    [...Object.values(domain.directives), ...Object.values(domain.reads)].some((fields) =>
+      Object.values(fields).some((field) => field.owned !== true),
+    ),
+  );
   const encConst = encryptionConstName(opts.packageName);
+  const internalFieldsByType = Object.fromEntries(
+    [...modules.flatMap((mod) => mod.aggregates)]
+      .map((aggregate) => [
+        aggregate.id,
+        [...((aggregate as { internalFields?: readonly string[] }).internalFields ?? [])].sort(),
+      ] as const)
+      .filter(([, fields]) => fields.length > 0),
+  );
+  const hasInternalFields = Object.keys(internalFieldsByType).length > 0;
   // A package declaring ≥1 `.births()` directive emits the branded identity wrappers (below) its typed
   // birth methods take for `actor`/`authorSecret`. Births-free packages emit nothing (byte-identical).
   const hasBirths = modules.some((m) =>
@@ -847,10 +1093,22 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       ),
     ),
   );
-  // ACTIVITY FEED (architecture/activity_descriptors.md): the package's declared `.activity(...)` descriptors.
-  // Empty ⇒ NOTHING activity-related emits (byte-identical to a pre-activity compile).
-  const activityEntries = collectActivityDescriptors(modules);
-  const activityPresent = activityEntries.length > 0;
+  const hasConflictResolvers = modules.some(
+    (m) => ((m as { surfacedResolvers?: readonly unknown[] }).surfacedResolvers?.length ?? 0) > 0,
+  );
+  // ACTIVITY + SELF-DESCRIPTION: public actions populate the registry; an action-free package keeps an empty
+  // registry because the other five questions still have answers.
+  const activityEntries = packageActivityEntries;
+  // Self-description is universal. A read-only/empty-history package still has a
+  // model, current state, rules and evidence; its activity registry is simply empty.
+  const activityPresent = true;
+  const hasCorrections = modules.some((m) =>
+    (m.directives as Directive<unknown>[]).some((d) =>
+      (d as { businessBirthInternal?: unknown }).businessBirthInternal !== true
+      && (d as { birthsChild?: unknown }).birthsChild !== true
+      && (d as { businessBirth?: unknown }).businessBirth === undefined,
+    ),
+  );
   const out: string[] = [];
   // The PACKAGE-LEVEL recursive-type registry: every directive payload's `z.lazy` knots mint
   // named recursive type aliases into it (deduped by lazy identity across directives); the decls
@@ -869,13 +1127,13 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     `/** sha256 of the deployed \`.package.usda\` — the installed law this client offers under. */`,
     `export const ${hashConst} = ${JSON.stringify(opts.domainHash)};`,
     ``,
-    ...(opts.interface !== undefined
+    ...(clientInterface !== undefined
       ? [
           `/** This client's STRUCTURAL INTERFACE REQUIREMENT (#72): the directives (payload shapes)`,
           ` *  and aggregates (read shapes, sid-keyed) it depends on, keyed by domain. \`connect()\``,
           ` *  negotiates this against the workspace's installed offer by SHAPE (stable-id subtyping),`,
           ` *  not by law hash — so the domain can evolve without republishing this client. */`,
-          `export const ${interfaceConstName(opts.packageName)} = ${JSON.stringify(opts.interface)} as const;`,
+          `export const ${interfaceConstName(opts.packageName)} = ${JSON.stringify(clientInterface)} as const;`,
           ``,
         ]
       : []),
@@ -912,10 +1170,28 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     ` *  (composed at decode from the session workspace + the row's type/id — additive, the \`data\` is untouched). */`,
     `export interface Row<T> { type: string; id: string; data: T; ref: NomosRef }`,
     `/** Stamp each row's canonical [NomosRef] from the session \`ws\` + the row's type/id (additive — already-`,
-    ` *  stamped rows pass through). */`,
-    `function _stampRefs<T>(ws: string, rows: Row<T>[]): Row<T>[] {`,
-    `  return rows.map((r) => (r.ref !== undefined ? r : { ...r, ref: { workspace: ws, type: r.type, id: r.id } }));`,
-    `}`,
+    ` *  stamped rows pass through).${hasInternalFields ? " Framework-owned fields are removed at this decode boundary." : ""} */`,
+    ...(hasInternalFields
+      ? [
+          `const _INTERNAL_FIELDS: Record<string, readonly string[]> = ${JSON.stringify(internalFieldsByType)};`,
+          `function _stampRefs<T>(ws: string, rows: Row<T>[]): Row<T>[] {`,
+          `  return rows.map((r) => {`,
+          `    const fields = _INTERNAL_FIELDS[r.type] ?? _INTERNAL_FIELDS[r.type.slice(r.type.lastIndexOf(".") + 1)];`,
+          `    let row = r;`,
+          `    if (fields !== undefined && fields.length > 0 && r.data !== null && typeof r.data === "object") {`,
+          `      const data = { ...(r.data as Record<string, unknown>) };`,
+          `      for (const field of fields) delete data[field];`,
+          `      row = { ...r, data: data as T };`,
+          `    }`,
+          `    return row.ref !== undefined ? row : { ...row, ref: { workspace: ws, type: row.type, id: row.id } };`,
+          `  });`,
+          `}`,
+        ]
+      : [
+          `function _stampRefs<T>(ws: string, rows: Row<T>[]): Row<T>[] {`,
+          `  return rows.map((r) => (r.ref !== undefined ? r : { ...r, ref: { workspace: ws, type: r.type, id: r.id } }));`,
+          `}`,
+        ]),
     `function _stampRefsP<T>(ws: string, p: Promise<Row<T>[]>): Promise<Row<T>[]> { return p.then((rows) => _stampRefs(ws, rows)); }`,
     `/** THE TYPED WRITE OUTCOME (architecture/nomos_ref.md) — every generated directive method returns this.`,
     ` *  \`created\` is EVERY aggregate the plan minted (typed [NomosRef]s, composed with the session workspace;`,
@@ -1010,7 +1286,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     ``,
     // SURFACED MERGE CONFLICTS (architecture/surfaced_merge_conflict.md): the read-collapse union for a
     // `.merge(Surfaced(...))` field — the plain scalar once resolved, or the pending envelope while
-    // genuinely concurrent writes await a human pick. Emitted ONLY when the package declares one.
+    // genuinely concurrent writes await a business merge. Emitted ONLY when the package declares one.
     ...(hasSurfaced
       ? [
           `/** One competing observation on a PENDING Surfaced field. \`author\` is the writer principal —`,
@@ -1018,7 +1294,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           ` *  JSON key is pinned in ONE place: this property name (kernel b215430d — exactly "author"). */`,
           `export interface SurfacedObservation<T> {`,
           `  value: T;`,
-          `  occurredAt: { physical: number; logical: number; replica: number };`,
+          `  occurredAt: { physical: number; logical: number; replica: string };`,
           `  author?: string | null;`,
           `}`,
           `/** The PENDING read-collapse of a \`.merge(Surfaced(...))\` field: the kernel retained BOTH sides`,
@@ -1026,15 +1302,21 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           ` *  to the plain scalar; bounded, cap 8) instead of silently picking a winner. Resolve`,
           ` *  it with an ORDINARY next write (a \`.mutates()\` directive that set()s the field) — the field`,
           ` *  then reads as the plain scalar again, indistinguishable from any other field. */`,
-          `export interface SurfacedPending<T> { __surfaced: { pending: SurfacedObservation<T>[] } }`,
-          `/** A Surfaced field's read value: the resolved scalar, or the pending envelope under conflict. */`,
-          `export type SurfacedValue<T> = T | SurfacedPending<T>;`,
+          `export interface SurfacedPending<T> { __surfaced: { status: "pending"; pending: SurfacedObservation<T>[] } }`,
+          `/** A retained value authored under a different field contract. Nomos withholds the value`,
+          ` *  until a declared deterministic evolution can produce the current generated type. */`,
+          `export interface SurfacedEvolutionRequired { __surfaced: { status: "evolutionRequired"; targetSchema: string; evolution: { sourceSchemas: string[]; authoredUnder: string[] } } }`,
+          `/** A Surfaced field's read value: resolved, pending, or awaiting schema evolution. */`,
+          `export type SurfacedValue<T> = T | SurfacedPending<T> | SurfacedEvolutionRequired;`,
           `/** True iff \`v\` is the pending-conflict envelope (narrows to [SurfacedPending]). */`,
           `export function isSurfacedPending<T>(v: SurfacedValue<T> | null | undefined): v is SurfacedPending<T> {`,
-          `  return typeof v === "object" && v !== null && "__surfaced" in (v as Record<string, unknown>);`,
+          `  return typeof v === "object" && v !== null && (v as { __surfaced?: { status?: unknown } }).__surfaced?.status === "pending";`,
+          `}`,
+          `export function isSurfacedEvolutionRequired<T>(v: SurfacedValue<T> | null | undefined): v is SurfacedEvolutionRequired {`,
+          `  return typeof v === "object" && v !== null && (v as { __surfaced?: { status?: unknown } }).__surfaced?.status === "evolutionRequired";`,
           `}`,
-          `/** ONE row of the workspace-wide \`pendingConflicts()\` read (reserved id \`nomosPendingConflicts\`):`,
-          ` *  a (aggregate, field) whose folded state awaits a human pick. MAINTAINED like counts/sums`,
+          `/** ONE row of Nomos's maintained conflict index (reserved id \`nomosPendingConflicts\`):`,
+          ` *  a (aggregate, field) whose folded state awaits a business merge. MAINTAINED like counts/sums`,
           ` *  (fold-time, O(pending) to read) and DERIVED, NOT DRAINED — a resolution write folding in removes`,
           ` *  the row by derivation. The workspace-wide surface is HETEROGENEOUS, so each observation's`,
           ` *  \`value\` is \`unknown\` here — the per-field typed seam stays on the read models (\`SurfacedValue<T>\`). */`,
@@ -1042,17 +1324,61 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           `  aggregateType: string;`,
           `  aggregateId: string;`,
           `  field: string;`,
-          `  observations: SurfacedObservation<unknown>[];`,
+          `  status: "ready" | "evolutionRequired";`,
+          `  targetSchema: string;`,
+          `  observations?: SurfacedObservation<unknown>[];`,
+          `  evolution?: { sourceSchemas: string[]; authoredUnder: string[]; reason: string };`,
+          `  /** Opaque Nomos identity of exactly this observation set. */`,
+          `  snapshot: string;`,
+          `}`,
+          `/** A counts-only view over the maintained pending-conflict index. Aggregate keys are generated`,
+          ` *  from this law; absent keys have zero pending merges. */`,
+          `export interface ConflictSummary {`,
+          `  total: number;`,
+          `  ready: number;`,
+          `  evolutionRequired: number;`,
+          `  byAggregate: Readonly<Record<string, number>>;`,
           `}`,
           ``,
         ]
       : []),
+    `/** One opaque, verified point in this workspace's history. Applications pass it back to`,
+    ` *  \`client.past.at(moment)\`; its framework identity is never parsed as business data. */`,
+    `export interface NomosMoment {`,
+    `  readonly id: string;`,
+    `  readonly occurredAt: string | null;`,
+    `  readonly actorSubject: string | null;`,
+    `  readonly domain: string | null;`,
+    `  readonly action: string | null;`,
+    `}`,
+    ...(hasCorrections
+      ? [
+          `/** Result of a reasoned business correction. Framework target and testimony ids remain private. */`,
+          `export interface NomosCorrectionOutcome {`,
+          `  readonly ok: boolean; readonly kind: "undo" | "redo";`,
+          `  readonly reason?: string; readonly message?: string; readonly head?: string;`,
+          `}`,
+        ]
+      : []),
+    `/** Read-only primitive used behind the generated, business-shaped historic view. */`,
+    `export interface NomosHistoricHolon {`,
+    `  query(queryId: string, params?: Record<string, unknown>, keys?: unknown): Promise<unknown>;`,
+    `  queryById(aggregateId: string, keys?: unknown): Promise<unknown>;`,
+    `  count(countId: string, groupKey?: string): Promise<number>;`,
+    `  sum(sumId: string, groupKey?: string): Promise<number>;`,
+    `}`,
     `/** The holon surface this client binds to (structurally satisfied by @githolon/client). */`,
     `export interface NomosHolon {`,
     `  /** THE ONE ENCODER offer (the single v2-envelope codec lives in @githolon/client \`encodeIntentOfferBytes\`):`,
     `   *  hand the holon a PLANNED directive + the verified \`actor\`; the holon encodes + offers. The generated`,
     `   *  client calls THIS, never building offer bytes itself — so there is exactly ONE copy of the wire format. */`,
     `  offerDirective(domain: string, directiveId: string, payload: unknown, opts?: { domainHash?: string; actor?: string; returnCreated?: boolean; attestations?: readonly { queryId: string; result: unknown; attestation: unknown }[] }): Promise<string | { head: string; created?: { type: string; id: string }[]; workspace?: string; born?: unknown; birthOutcomes?: unknown }>;`,
+    ...(hasCorrections
+      ? [
+          `  /** Framework-private seam used by generated \`corrections\`; apps never supply an intent id. */`,
+          `  correctMostRecent?(opts: { kind: "undo" | "redo"; domain: string; actions: string[]; reason: string; domainHash?: string; actor?: string }): Promise<NomosCorrectionOutcome>;`,
+        ]
+      : []),
     `  /** Opaque-bytes offer — retained for carriers that already hold an encoded envelope (back-compat). */`,
     `  offer(intentBytes: string | Uint8Array): Promise<string>;`,
     ...(hasBirths
@@ -1067,10 +1393,28 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     `  workspace: string;`,
     `  /** The identity already proved by this bound session (explicit principal or token subject). */`,
     `  principal?: string;`,
+    ...(ownedPresent
+      ? [
+          `  /** FRAMEWORK-INTERNAL: reserve the typed record identity before record-bound owned sealing. */`,
+          `  mint?(typeTag: string): Promise<string>;`,
+        ]
+      : []),
+    `  /** FRAMEWORK-INTERNAL verified child graph. Generated describe() exposes only business-safe links. */`,
+    `  __nomosChildWorkspaces?(): Promise<readonly { workspace: string; status: "active" | "retired" | "reclaimed" | "unknown"; bornAt: string | null }[]>;`,
+    `  /** FRAMEWORK-INTERNAL exact-history adoption seam. Generated clients expose only`,
+    `   *  \`model.adopt()\` and a chained \`decision.accept(reason)\`. */`,
+    `  __nomosAdoptModel?(domain: string, candidateHash: string, opts?: { because?: string }): Promise<__NomosModelAdoptionWire>;`,
+    `  /** FRAMEWORK-INTERNAL exact-history restoration seam. Generated clients expose only`,
+    `   *  \`model.restorePrevious()\` and a chained \`decision.accept(reason)\`. */`,
+    `  __nomosRestorePreviousModel?(domain: string, currentHash: string, opts?: { because?: string }): Promise<__NomosModelRestorationWire>;`,
     `  /** Persist local custody and reconcile its configured remote. Business birth awaits this when available. */`,
     `  sync?(): Promise<unknown>;`,
     `  /** Complete durable custody and cold-chain verification for a newly born aggregate. */`,
     `  settleBirth?(workspace: string, opts?: { timeoutMs?: number; pollMs?: number }): Promise<unknown>;`,
+    `  /** Verified points in local history. Optional only so a pre-history runtime fails at the named call. */`,
+    `  commits?(opts?: { limit?: number }): Promise<{ oid: string; at: number | null; actorSubject: string | null; domain: string | null; directiveId: string | null }[]>;`,
+    `  /** Read the verified projection at one opaque moment without moving the live world. */`,
+    `  at?(momentId: string): NomosHistoricHolon;`,
     ...(encPresent
       ? [
           `  /** \`keys\` (E2E sealing): the reader's held scope keys, injected so encrypted fields decrypt;`,
@@ -1081,6 +1425,26 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           `   *  (bound to the scope + stable sids). OPTIONAL: structural binding tolerates a pre-sealing holon`,
           `   *  (the write path then throws with an upgrade hint before any plaintext dispatch). */`,
           `  cryptoSealField?(args: { scopeKey: string; scope: string; epoch: number; aggSid: string; fieldSid: string; plaintext: string }): Promise<string>;`,
+          `  /** FRAMEWORK-INTERNAL: derive an owned aggregate's current record key from this session's private custody. */`,
+          `  __nomosOwnedScopeKey?(args: { scope: string; record?: { type: string; id: string } }): Promise<NomosScopeKey>;`,
+          `  /** FRAMEWORK-INTERNAL: every held key epoch for one record, including shared and rotated history. */`,
+          `  __nomosOwnedScopeKeys?(args: { scope: string; record: { type: string; id: string } }): Promise<NomosScopeKey[]>;`,
+          `  /** FRAMEWORK-INTERNAL: make this principal ready to receive generated record shares. */`,
+          `  __nomosEnsureOwnedIdentity?(args: { scope: string; domain: string; domainHash?: string }): Promise<void>;`,
+          `  /** FRAMEWORK-INTERNAL: atomically record the opt-in recovery policy and escrow wrap. */`,
+          `  __nomosProtectOwnedIdentity?(args: { scope: string; domain: string; domainHash?: string; recoveryPrincipal: string }): Promise<{ status: "protected"; recoveryPrincipal: string; unchanged?: boolean }>;`,
+          `  /** FRAMEWORK-INTERNAL: prepare the atomic law payload behind share/unshare/transfer. */`,
+          `  __nomosPrepareOwnedRecordAction?(args: { action: "share" | "unshare" | "transfer"; scope: string; record: NomosRef; peer: string }): Promise<Record<string, unknown>>;`,
+          `  /** FRAMEWORK-INTERNAL: derive the deterministic unborn child's owned key before atomic genesis. */`,
+          `  __nomosOwnedBirthScopeKey?(args: { scope: string; namespace: string; key: unknown }): Promise<NomosScopeKey & { workspace: string }>;`,
+          ...(ownedPresent
+            ? [
+                `  /** FRAMEWORK-INTERNAL: make the opaque request for this session's not-yet-approved device. */`,
+                `  __nomosOwnedDeviceRequest?(args: { scope: string }): Promise<string>;`,
+                `  /** FRAMEWORK-INTERNAL: validate a request and prepare the one atomic approval payload. */`,
+                `  __nomosPrepareOwnedDeviceApproval?(args: { request: string; scope: string }): Promise<Record<string, unknown>>;`,
+              ]
+            : []),
           `  /** Unwrap an on-chain WrappedKey with this device's secret → the base64 scope key (default KeyStore). */`,
           `  cryptoUnwrapKey?(args: { secret: string; hpkeEpk: string; ct: string }): Promise<string>;`,
           `  /** OWNER CEREMONY (slice 2): HPKE-wrap a scope epoch secret TO a member's published X25519 pubkey. */`,
@@ -1092,12 +1456,16 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           `  query(queryId: string, params?: Record<string, unknown>): Promise<unknown>;`,
           `  queryById(aggregateId: string): Promise<unknown>;`,
         ]),
+    `  /** Watch a declared query in the local verified projection; returns stop(). Sync is runtime-owned. */`,
+    `  watch(queryId: string, params: Record<string, unknown> | undefined, cb: (rows: unknown) => void, opts?: { intervalMs?: number }): () => void;`,
     `  watchById(aggregateId: string, cb: (rows: unknown) => void, opts?: { intervalMs?: number }): () => void;`,
     ...(hasSurfaced
       ? [
-          `  /** The workspace-wide pending Surfaced-conflict read (reserved id \`nomosPendingConflicts\`).`,
+          `  /** A framework-filtered pending Surfaced-conflict read (reserved id \`nomosPendingConflicts\`).`,
           `   *  OPTIONAL member: structural binding tolerates a pre-Surfaced holon (the accessor throws at call). */`,
-          `  pendingConflicts?(): Promise<PendingConflictRow[]>;`,
+          `  pendingConflicts?(aggregateType?: string): Promise<PendingConflictRow[]>;`,
+          `  /** Counts-only workspace view; competing business values do not cross this call. */`,
+          `  pendingConflictSummary?(): Promise<ConflictSummary>;`,
         ]
       : []),
     `  /** Declared-count / declared-sum O(1) reads (maintained by the read engine). */`,
@@ -1122,7 +1490,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           `  /** THE ACTIVITY FEED (declared \`.activity(...)\`): subscribe to per-committed-intent RAW ROWS`,
           `   *  (the runtime folds the intent log). \`cb\` fires with the current rows + on every new intent;`,
           `   *  returns an unsubscribe fn. The generated client maps these through \`renderActivity\`. */`,
-          `  watchActivity(cb: (rows: ActivityRawRow[]) => void, opts?: { base?: string }): () => void;`,
+          `  watchActivity(cb: (rows: ActivityRawRow[]) => void, opts?: { base?: string; intervalMs?: number }): () => void;`,
           `  /** One-shot: the current committed activity log as RAW ROWS (folded to typed rows by the client). */`,
           `  activityLog(opts?: { base?: string; limit?: number }): Promise<ActivityRawRow[]>;`,
         ]
@@ -1143,6 +1511,14 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     `  on?(event: "lawChanged", cb: (compat: NomosCompatVerdict) => void): () => void;`,
     `}`,
     ``,
+    ...(hasConflictResolvers
+      ? [
+          `/** Framework-private merge lane used only by generated conflict capabilities. The snapshot`,
+          ` *  proves the exact observation set being merged; application code never supplies it. */`,
+          `type __NomosConflictOffer = (domain: string, directiveId: string, payload: unknown, opts: { domainHash?: string; actor?: string; returnCreated: true; __nomosConflictSnapshots: readonly { aggregateType: string; aggregateId: string; field: string; targetSchema: string; token: string }[] }) => ReturnType<NomosHolon["offerDirective"]>;`,
+          ``,
+        ]
+      : []),
     `/** THE LIVE COMPAT VERDICT (#72b) stashed on \`holon.compat\`. \`verdict\` is the three-state roll-up;`,
     ` *  \`members\` names each directive/aggregate's own \`{ ok, reason? }\`; \`install\` is the deployed law's`,
     ` *  lifecycle phase. \`has(id)\` = the feature flag; \`refresh()\` re-evaluates against the projection. */`,
@@ -1202,12 +1578,21 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       `export const ${encConst} = ${JSON.stringify(encMap)} as const;`,
       ``,
       `/** A held scope key: the base64 symmetric key + the epoch it belongs to (forward-only rotation). */`,
-      `export interface NomosScopeKey { scope: string; epoch: number; key: string }`,
+      `${manualEncryptionPresent ? "export " : ""}interface NomosScopeKey { scope: string; epoch: number; key: string; ownedKeySubject?: string; ownedCustody?: string }`,
+      ...(ownedPresent
+        ? [
+            `/** An opaque request copied from a new device to an already-working one. */`,
+            `export type NomosDeviceRequest = string & { readonly __nomosDeviceRequest: unique symbol };`,
+          ]
+        : []),
+      `const _OWNED_KEY_PAYLOAD_FIELD = ${JSON.stringify(OWNED_KEY_PAYLOAD_FIELD)};`,
+      `const _OWNED_CUSTODY_PAYLOAD_FIELD = ${JSON.stringify(OWNED_CUSTODY_PAYLOAD_FIELD)};`,
+      `const _OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD = ${JSON.stringify(OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD)};`,
       ``,
       `/** The app-supplied KEY CUSTODY surface. Supply one to \`<domain>Client(holon, { keyStore })\` and the`,
       ` *  generated methods seal writes + decrypt reads automatically. \`wrappedKeyStore\` is the default over`,
       ` *  the on-chain WrappedKeys; an app may implement this to source keys from a secure enclave. */`,
-      `export interface NomosKeyStore {`,
+      `${manualEncryptionPresent ? "export " : ""}interface NomosKeyStore {`,
       `  /** The CURRENT (highest-epoch) scope key, for SEALING a write. undefined ⇒ EncryptionKeyUnavailable. */`,
       `  scopeKey(scope: string): Promise<NomosScopeKey | undefined>;`,
       `  /** EVERY held key for these scopes (all epochs), injected on reads so old ciphertext also decrypts. */`,
@@ -1216,7 +1601,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       ``,
       `/** Thrown when a write must seal an encrypted field but the KeyStore holds no key for its scope — the`,
       ` *  write NEVER falls through to a plaintext dispatch (the sid-envelope gate would refuse it anyway). */`,
-      `export class EncryptionKeyUnavailable extends Error {`,
+      `${manualEncryptionPresent ? "export " : ""}class EncryptionKeyUnavailable extends Error {`,
       `  readonly code = "nomos.crypto.key_unavailable";`,
       `  readonly recommendedAction = "obtainScopeKey";`,
       `  constructor(readonly scope: string, readonly field: string) {`,
@@ -1230,20 +1615,38 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       `const _sealFields = async (`,
       `  holon: NomosHolon,`,
       `  keyStore: NomosKeyStore | undefined,`,
-      `  fieldMap: Record<string, { scope: string; aggSid: string; fieldSid: string }>,`,
+      `  fieldMap: Record<string, { scope: string; aggSid: string; fieldSid: string; owned?: true }>,`,
       `  payload: Record<string, unknown>,`,
       `  seal: boolean,`,
+      `  ownedKeyOverride?: NomosScopeKey,`,
+      `  ownedRecord?: { type: string; id: string; preMinted?: true },`,
       `): Promise<Record<string, unknown>> => {`,
-      `  if (seal === false || keyStore == null) return payload;`,
+      `  if (seal === false) {`,
+      `    if (Object.values(fieldMap).some((m) => m.owned === true)) throw new Error(".owned() encryption cannot be disabled");`,
+      `    return payload;`,
+      `  }`,
       `  let out: Record<string, unknown> | undefined;`,
+      `  let ownedKey: NomosScopeKey | undefined = ownedKeyOverride;`,
+      `  const owned = Object.values(fieldMap).find((m) => m.owned === true);`,
+      `  if (owned) {`,
+      `    if (!ownedKey) {`,
+      `      if (!holon.__nomosOwnedScopeKey) throw new Error("this holon predates automatic .owned() key custody — upgrade @githolon/client");`,
+      `      if (!ownedRecord || !ownedRecord.type || !ownedRecord.id) throw new Error("Nomos could not derive the owned record identity before sealing; recompile the client and law together");`,
+      `      ownedKey = await holon.__nomosOwnedScopeKey({ scope: owned.scope, record: ownedRecord });`,
+      `    }`,
+      `    if (!ownedKey.ownedKeySubject) throw new Error("Nomos did not return the framework-owned device identity for .owned() custody");`,
+      `    (out ??= { ...payload })[_OWNED_KEY_PAYLOAD_FIELD] = ownedKey.ownedKeySubject;`,
+      `    if (ownedKey.ownedCustody) (out ??= { ...payload })[_OWNED_CUSTODY_PAYLOAD_FIELD] = ownedKey.ownedCustody;`,
+      `    if (ownedRecord?.preMinted === true) (out ??= { ...payload })[_OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD] = [{ type: ownedRecord.type, id: ownedRecord.id }];`,
+      `  }`,
       `  for (const field of Object.keys(fieldMap)) {`,
       `    const v = payload[field];`,
       `    if (v === undefined || v === null) continue;`,
       `    const m = fieldMap[field]!;`,
-      `    const sk = await keyStore.scopeKey(m.scope);`,
+      `    const sk = m.owned === true ? ownedKey : (keyStore != null ? await keyStore.scopeKey(m.scope) : undefined);`,
       `    if (!sk) throw new EncryptionKeyUnavailable(m.scope, field);`,
       `    if (!holon.cryptoSealField) throw new Error("this holon predates E2E sealing — upgrade @githolon/client");`,
-      `    const envelope = await holon.cryptoSealField({ scopeKey: sk.key, scope: m.scope, epoch: sk.epoch, aggSid: m.aggSid, fieldSid: m.fieldSid, plaintext: String(v) });`,
+      `    const envelope = await holon.cryptoSealField({ scopeKey: sk.key, scope: m.owned === true ? sk.scope : m.scope, epoch: sk.epoch, aggSid: m.aggSid, fieldSid: m.fieldSid, plaintext: String(v) });`,
       `    (out ??= { ...payload })[field] = envelope;`,
       `  }`,
       `  return out ?? payload;`,
@@ -1251,12 +1654,64 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       ``,
       `/** The read keys to inject for the given scopes, or undefined when there is nothing to inject`,
       ` *  (no keyStore, or no held keys) — the read then behaves exactly as today (opaque envelopes). */`,
-      `const _readKeys = async (keyStore: NomosKeyStore | undefined, scopes: readonly string[]): Promise<NomosScopeKey[] | undefined> => {`,
-      `  if (keyStore == null || scopes.length === 0) return undefined;`,
-      `  const keys = await keyStore.readKeys(scopes);`,
+      `const _readKeys = async (holon: NomosHolon, keyStore: NomosKeyStore | undefined, scopes: readonly { scope: string; owned?: true }[], records: readonly { type: string; id: string }[] = []): Promise<NomosScopeKey[] | undefined> => {`,
+      `  if (scopes.length === 0) return undefined;`,
+      `  const ordinary = [...new Set(scopes.filter((s) => s.owned !== true).map((s) => s.scope))];`,
+      `  const keys = keyStore == null || ordinary.length === 0 ? [] : await keyStore.readKeys(ordinary);`,
+      `  for (const s of scopes) {`,
+      `    if (s.owned !== true) continue;`,
+      `    if (!holon.__nomosOwnedScopeKeys) throw new Error("owned record reads need the current @githolon/client");`,
+      `    for (const record of records) {`,
+      `      for (const held of await holon.__nomosOwnedScopeKeys({ scope: s.scope, record })) {`,
+      `        if (!keys.some((key) => key.scope === held.scope && key.epoch === held.epoch)) keys.push(held);`,
+      `      }`,
+      `    }`,
+      `  }`,
       `  return keys.length ? keys : undefined;`,
       `};`,
       ``,
+      `/** Owned multi-row reads stay business-shaped: first fetch the authorized ciphertext rows locally,`,
+      ` *  derive only those record keys, then repeat the same local indexed read with decryption injected. */`,
+      `const _readWithOwnedKeys = async <T extends { type: string; id: string }>(`,
+      `  holon: NomosHolon,`,
+      `  keyStore: NomosKeyStore | undefined,`,
+      `  scopes: readonly { scope: string; owned?: true }[],`,
+      `  read: (keys: readonly NomosScopeKey[] | undefined) => Promise<T[]>,`,
+      `): Promise<T[]> => {`,
+      `  const firstKeys = await _readKeys(holon, keyStore, scopes);`,
+      `  const first = await read(firstKeys);`,
+      `  if (!scopes.some((scope) => scope.owned === true) || first.length === 0) return first;`,
+      `  const keys = await _readKeys(holon, keyStore, scopes, first.map(({ type, id }) => ({ type, id })));`,
+      `  return read(keys);`,
+      `};`,
+      ``,
+      `/** Reactive owned reads use the exact same two-pass, record-key-aware read as one-shot reads.`,
+      ` *  The raw watch is only a local change signal; ciphertext rows never reach application callbacks. */`,
+      `const _watchWithOwnedKeys = <T extends { type: string; id: string }>(`,
+      `  subscribe: (changed: () => void) => () => void,`,
+      `  read: () => Promise<T[]>,`,
+      `  cb: (rows: T[]) => void,`,
+      `): (() => void) => {`,
+      `  let active = true;`,
+      `  let pending = Promise.resolve();`,
+      `  const changed = () => {`,
+      `    pending = pending.catch(() => undefined).then(async () => {`,
+      `      try {`,
+      `        const rows = await read();`,
+      `        if (active) cb(rows);`,
+      `      } catch (error) {`,
+      `        if (!active) return;`,
+      `        const message = String((error as { message?: unknown })?.message ?? error).toLowerCase();`,
+      `        if (/forbid|denied|not been shared|not currently sharing|no longer shared/.test(message)) { cb([]); return; }`,
+      `        throw error;`,
+      `      }`,
+      `    });`,
+      `  };`,
+      `  const stop = subscribe(changed);`,
+      `  return () => { active = false; stop(); };`,
+      `};`,
+      ``,
+      ...(manualEncryptionPresent ? [
       `/** THE DEFAULT KeyStore — unwraps this principal's on-chain WrappedKeys with its device secret, caching`,
       ` *  per scope. Mirror of the documented reader handshake (e2e_encryption.md): the secret stays client-side,`,
       ` *  the operator stays blind. Key custody (where \`deviceSecret\` lives) remains the app's concern. */`,
@@ -1447,6 +1902,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       `  };`,
       `}`,
       ``,
+      ] : []),
     );
   }
 
@@ -1566,8 +2022,10 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
   }
   for (const [typeId, agg] of [...aggByType].sort(([a], [b]) => a.localeCompare(b))) {
     const attributed = (agg as { attributedFields?: readonly string[] }).attributedFields ?? [];
+    const internal = new Set((agg as { internalFields?: readonly string[] }).internalFields ?? []);
     out.push(`export interface ${typeId}Data {`);
     for (const [name, field] of Object.entries(agg.fields)) {
+      if (internal.has(name)) continue;
       const required = (field as Field).isFromBirth === true;
       const doc = nullDocLine(field);
       if (doc !== undefined) out.push(`  /** ${doc} */`);
@@ -1833,8 +2291,10 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     }
   }
 
-  // ── activity feed (declared `.activity(...)`) — types + `renderActivity` registry (empty ⇒ nothing) ──
-  out.push(...emitTsActivityBlock(activityEntries));
+  // ── accountable activity feed (automatic baseline; `.activity(...)` enriches) ──
+  if (activityPresent) {
+    out.push(...emitTsActivityBlock(activityEntries, buildNomosDescribeModel(modules, opts.packageName)));
+  }
 
   // ── payload types + per-domain client factories ──
   const usedPayloadNames = new Set<string>();
@@ -1844,6 +2304,10 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       (d) => d && typeof d.id === "string" && typeof (d as { payloadSchema?: unknown }).payloadSchema === "object"
         && (d as { businessBirthInternal?: unknown }).businessBirthInternal !== true,
     );
+    const correctionActions = dirs.filter((d) =>
+      (d as { birthsChild?: unknown }).birthsChild !== true
+      && (d as { businessBirth?: unknown }).businessBirth === undefined,
+    );
     out.push(`// ── domain "${domain}" ──`, ``);
 
     const mintPlan = mintPlans.get(mod);
@@ -1859,12 +2323,19 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       } catch { /* the compile gate already failed a bad taxonomy loudly */ }
     }
     const methods: string[] = [];
+    const pastMethods: string[] = [];
+    const runtimeTypeOf = (aggregate: AggregateHandle): string => isNamespacedAggregate(aggregate)
+      ? qualifyReadProjectionType(domain, aggregate.id)
+      : aggregate.id;
     // E2E READ INJECTION: the distinct encryption scopes a read of `typeId` must inject keys for (empty
     // ⇒ nothing encrypted on that type ⇒ the accessor is emitted plain, unchanged). The `_readKeys` helper
     // returns undefined when no keyStore is bound, so an injected accessor still behaves as today offline.
-    const readScopesFor = (typeId: string): string[] => {
+    const readScopesFor = (typeId: string): { scope: string; owned?: true }[] => {
       const r = encMap?.[domain]?.reads?.[typeId];
-      return r === undefined ? [] : [...new Set(Object.values(r).map((x) => x.scope))].sort();
+      if (r === undefined) return [];
+      const byKey = new Map<string, { scope: string; owned?: true }>();
+      for (const x of Object.values(r)) byKey.set(`${x.scope}:${x.owned === true}`, x);
+      return [...byKey.values()].sort((a, b) => a.scope.localeCompare(b.scope));
     };
     // The DISTINCT encryption scopes this domain defines (across encrypted reads + sealing directives) —
     // the set the owner ceremony rotates. Empty ⇒ no `encryption` surface is emitted for this domain.
@@ -1872,11 +2343,59 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       const dm = encMap?.[domain];
       if (dm === undefined) return [];
       const s = new Set<string>();
-      for (const r of Object.values(dm.reads)) for (const f of Object.values(r)) s.add(f.scope);
-      for (const dir of Object.values(dm.directives)) for (const f of Object.values(dir)) s.add(f.scope);
+      for (const r of Object.values(dm.reads)) for (const f of Object.values(r)) if (f.owned !== true) s.add(f.scope);
+      for (const dir of Object.values(dm.directives)) for (const f of Object.values(dir)) if (f.owned !== true) s.add(f.scope);
       return [...s].sort();
     })();
-    // directiveId → its emitted payload TYPE name (the surfaced `resolve…` helpers reference it).
+    const ownedScopes: string[] = (() => {
+      const dm = encMap?.[domain];
+      if (dm === undefined) return [];
+      const scopes = new Set<string>();
+      for (const r of Object.values(dm.reads)) for (const f of Object.values(r)) if (f.owned === true) scopes.add(f.scope);
+      for (const dir of Object.values(dm.directives)) for (const f of Object.values(dir)) if (f.owned === true) scopes.add(f.scope);
+      return [...scopes].sort();
+    })();
+    if (ownedScopes.length > 1) {
+      throw new Error(`codegen: owned business state in domain '${domain}' unexpectedly uses more than one framework scope`);
+    }
+    const ownedScope = ownedScopes[0];
+    const ownedActions = Object.fromEntries(
+      (mod.aggregates as AggregateHandle[])
+        .filter((aggregate) => aggregate.audience?.kind === "owned")
+        .map((aggregate) => [runtimeTypeOf(aggregate), {
+          share: ownedRecordActionDirectiveId("share", aggregate.id),
+          unshare: ownedRecordActionDirectiveId("unshare", aggregate.id),
+          transfer: ownedRecordActionDirectiveId("transfer", aggregate.id),
+        }]),
+    );
+    if (ownedScope !== undefined && Object.keys(ownedActions).length > 0) {
+      methods.push(
+        `    /** Share one record. The peer can read its history and future changes; Nomos owns the keys and policy. */`,
+        `    share: (record: NomosRef, peer: string): Promise<NomosOutcome> => _ownedRecordAction("share", record, peer),`,
+        `    /** Stop sharing one record. Earlier knowledge cannot be erased; future changes use a fresh private key. */`,
+        `    unshare: (record: NomosRef, peer: string): Promise<NomosOutcome> => _ownedRecordAction("unshare", record, peer),`,
+        `    /** Hand ownership, readable history and future authority for one record to another person. */`,
+        `    transfer: (record: NomosRef, peer: string): Promise<NomosOutcome> => _ownedRecordAction("transfer", record, peer),`,
+      );
+    }
+    if (correctionActions.length > 0) {
+      methods.push(
+        `    /** Correct this principal's latest business change. Nomos owns target selection, testimony and replay. */`,
+        `    corrections: {`,
+        `      undo: async (reason: string): Promise<NomosCorrectionOutcome> => {`,
+        `        if (!reason.trim()) throw new Error("corrections.undo() needs a reason");`,
+        `        if (!holon.correctMostRecent) throw new Error("corrections need the current @githolon/client");`,
+        `        return holon.correctMostRecent({ kind: "undo", domain: ${JSON.stringify(domain)}, actions: ${JSON.stringify(correctionActions.map((d) => d.id))}, reason, domainHash, actor: actor ?? holon.principal });`,
+        `      },`,
+        `      redo: async (reason: string): Promise<NomosCorrectionOutcome> => {`,
+        `        if (!reason.trim()) throw new Error("corrections.redo() needs a reason");`,
+        `        if (!holon.correctMostRecent) throw new Error("corrections need the current @githolon/client");`,
+        `        return holon.correctMostRecent({ kind: "redo", domain: ${JSON.stringify(domain)}, actions: ${JSON.stringify(correctionActions.map((d) => d.id))}, reason, domainHash, actor: actor ?? holon.principal });`,
+        `      },`,
+        `    },`,
+      );
+    }
+    // directiveId → its emitted payload TYPE name (the generated conflict references use it).
     const dirPayloadNames = new Map<string, string>();
     for (const d of dirs) {
       let payloadName = `${cap(d.id)}Payload`;
@@ -1884,7 +2403,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       usedPayloadNames.add(payloadName);
       dirPayloadNames.set(d.id, payloadName);
       const businessBirth = (d as unknown as {
-        businessBirth?: { aggregateId: string; publicPayloadSchema: z.ZodTypeAny; rootId: string; namespace: string };
+        businessBirth?: { aggregateId: string; publicPayloadSchema: z.ZodTypeAny; rootId: string; namespace: string; keyField: string };
       }).businessBirth;
       const schema = businessBirth?.publicPayloadSchema
         ?? (d as unknown as { payloadSchema: z.ZodTypeAny }).payloadSchema;
@@ -1902,7 +2421,8 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       // (via the KeyStore) BEFORE dispatch. `wantSeal` forces an async block body + a `callOpts.seal`
       // escape hatch, and `pv` (the sealed copy) replaces `payload` downstream. Non-encrypted directives
       // are byte-identical (wantSeal === false ⇒ no prelude, no extra param, plain `payload`).
-      const wantSeal = encMap?.[domain]?.directives?.[d.id] !== undefined;
+      const encFields = encMap?.[domain]?.directives?.[d.id];
+      const wantSeal = encFields !== undefined;
       // FALLBACK ATTESTATION INJECTION (co2): a directive whose law declares a foreign read
       // (`.readsFrom(...)`) accepts pre-fetched signed envelopes as `callOpts.attestations` — the manual
       // escape hatch when the colocation resolver can't serve the read (the source isn't on the plane). The
@@ -1911,8 +2431,37 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       // directives (an ordinary directive's signature is byte-identical).
       const wantAttest = (((d as { declaredForeignReads?: unknown[] }).declaredForeignReads?.length ?? 0) > 0);
       const attTy = `readonly { queryId: string; result: unknown; attestation: unknown }[]`;
+      const ownedSeal = encFields !== undefined && Object.values(encFields).every((field) => field.owned === true);
+      const ownedTargetAggregate = ownedSeal
+        ? (mod.aggregates as AggregateHandle[]).find((aggregate) => aggregate.id === (d as { aggregateId?: string }).aggregateId)
+        : undefined;
+      const ownedRecordTarget = ownedTargetAggregate === undefined
+        ? undefined
+        : deriveDirectiveRecordTarget(d, ownedTargetAggregate);
+      if (ownedSeal && businessBirth === undefined && ownedRecordTarget === undefined) {
+        throw new Error(
+          `codegen: cannot derive the record targeted by encrypted owned directive '${domain}/${d.id}'. ` +
+            `Address the record from one string payload field, one deterministic instance, or create it with create(Aggregate).`,
+        );
+      }
+      const ownedRuntimeType = ownedTargetAggregate === undefined ? undefined : runtimeTypeOf(ownedTargetAggregate);
+      const ownedRecordPrelude = businessBirth !== undefined || ownedRecordTarget === undefined || ownedRuntimeType === undefined
+        ? ""
+        : ownedRecordTarget.kind === "premint"
+          ? `      if (!holon.mint) throw new Error("this holon predates record-bound .owned() identity — upgrade @githolon/client");\n` +
+            `      const _ownedRecord = { type: ${JSON.stringify(ownedRuntimeType)}, id: await holon.mint(${JSON.stringify(ownedRuntimeType)}), preMinted: true as const };`
+          : ownedRecordTarget.kind === "payload"
+            ? `      const _ownedRecord = { type: ${JSON.stringify(ownedRuntimeType)}, id: String((payload as Record<string, unknown>)[${JSON.stringify(ownedRecordTarget.field)}] ?? "") };`
+            : `      const _ownedRecord = { type: ${JSON.stringify(ownedRuntimeType)}, id: ${JSON.stringify(ownedRecordTarget.id)} };`;
+      const ownedBirthDescriptor = businessBirth === undefined || encFields === undefined
+        ? undefined
+        : Object.values(encFields).find((field) => field.owned === true);
+      const ownedBirthPrelude = ownedBirthDescriptor === undefined
+        ? ""
+        : `      if (!holon.__nomosOwnedBirthScopeKey) throw new Error("this holon predates automatic .owned() birth custody — upgrade @githolon/client");\n` +
+          `      const _ownedBirthKey = await holon.__nomosOwnedBirthScopeKey({ scope: ${JSON.stringify(ownedBirthDescriptor.scope)}, namespace: ${JSON.stringify(businessBirth!.namespace)}, key: (payload as Record<string, unknown>)[${JSON.stringify(businessBirth!.keyField)}] });`;
       const callOptsFields = [
-        ...(wantSeal ? ["seal?: boolean"] : []),
+        ...(wantSeal && !ownedSeal ? ["seal?: boolean"] : []),
         ...(wantAttest ? [`attestations?: ${attTy}`] : []),
       ];
       const paramSig = callOptsFields.length
@@ -1920,7 +2469,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
         : `payload: ${payloadName}`;
       const offerExtra = wantAttest ? ", attestations: callOpts?.attestations" : "";
       const sealPrelude = wantSeal
-        ? `      const _sealed = await _sealFields(holon, keyStore, ${encConst}[${JSON.stringify(domain)}].directives[${JSON.stringify(d.id)}] as Record<string, { scope: string; aggSid: string; fieldSid: string }>, payload as Record<string, unknown>, callOpts?.seal !== false) as ${payloadName};`
+        ? `      const _sealed = await _sealFields(holon, keyStore, ${encConst}[${JSON.stringify(domain)}].directives[${JSON.stringify(d.id)}] as Record<string, { scope: string; aggSid: string; fieldSid: string; owned?: true }>, payload as Record<string, unknown>, ${businessBirth !== undefined || ownedSeal ? "true" : "callOpts?.seal !== false"}${ownedBirthDescriptor !== undefined ? ", _ownedBirthKey" : ", undefined"}${ownedRecordPrelude ? ", _ownedRecord" : ""}) as ${payloadName};`
         : "";
       const pv = wantSeal ? "_sealed" : "payload";
       // MULTI-OUTPUT: name every aggregate this directive writes (primary marker target + declared
@@ -1944,9 +2493,14 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           `    birth: async (payload: ${payloadName}): Promise<NomosBorn<${businessBirth.aggregateId}Data>> => {`,
           `      const principal = actor ?? holon.principal;`,
           `      if (!principal || !principal.trim()) throw new Error("birth() needs a signed-in Nomos session");`,
-          `      const result = await holon.offerDirective(${JSON.stringify(domain)}, ${JSON.stringify(d.id)}, { ...payload, principal, bornAt: new Date().toISOString() }, { domainHash, actor: principal, returnCreated: true });`,
+          ...(ownedBirthPrelude ? [ownedBirthPrelude] : []),
+          ...(wantSeal ? [sealPrelude] : []),
+          `      const result = await holon.offerDirective(${JSON.stringify(domain)}, ${JSON.stringify(d.id)}, { ...payload, principal, bornAt: new Date().toISOString()${wantSeal ? `, ${JSON.stringify(BUSINESS_BIRTH_SEED_PAYLOAD_FIELD)}: JSON.stringify(_sealed)` : ""}${ownedBirthDescriptor !== undefined ? `, [_OWNED_KEY_PAYLOAD_FIELD]: _ownedBirthKey.ownedKeySubject` : ""} }, { domainHash, actor: principal, returnCreated: true });`,
           `      const born = typeof result === "object" && result !== null && Array.isArray(result.born) ? result.born[0] : undefined;`,
           `      if (typeof born !== "object" || born === null || typeof born.workspace !== "string" || !born.workspace) throw new Error("birth() committed without returning the born workspace");`,
+          ...(ownedBirthDescriptor !== undefined
+            ? [`      if (born.workspace !== _ownedBirthKey.workspace) throw new Error("birth() returned a workspace different from the deterministic owned-custody address");`]
+            : []),
           `      await holon.sync?.();`,
           `      if (!holon.settleBirth) throw new Error("birth() requires the current @githolon/client to complete durable recovery");`,
           `      await holon.settleBirth(born.workspace);`,
@@ -1989,13 +2543,20 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
         const body = stamps.length
           ? `stampNow({ ...${pv}, ${mint.field} }, ${JSON.stringify(stamps)})`
           : `{ ...${pv}, ${mint.field} }`;
+        const ownedMintTarget = ownedSeal
+          && ownedRecordTarget?.kind === "payload"
+          && ownedRecordTarget.field === mint.field
+          && ownedRuntimeType !== undefined;
         methods.push(
           `    /** Author \`${domain}/${d.id}\`: the front-door MINTS \`${mint.field}\` (route-tagged) when omitted`,
           `     *  — ids stay internal plumbing — and returns the outcome (\`target\` = the minted ${dd.aggregateId ?? "aggregate"}).${gate ? ` GATED: needs \`{ actor }\` (\`${gate.relation}\`).` : ""} */`,
           `    ${d.id}: async (${paramSig}): Promise<NomosOutcome> => {`,
           ...(gateGuard ? [gateGuard.replace(/\n$/, "")] : []),
-          ...(sealPrelude ? [sealPrelude] : []),
           `      const ${mint.field} = payload.${mint.field} ?? (await (holon as NomosRoutedHolon).mint(${JSON.stringify(mint.mintType)}${mintOpts}));`,
+          ...(ownedMintTarget
+            ? [`      const _ownedRecord = { type: ${JSON.stringify(ownedRuntimeType)}, id: String(${mint.field}) };`]
+            : ownedRecordPrelude ? [ownedRecordPrelude] : []),
+          ...(sealPrelude ? [sealPrelude] : []),
           `      return _outcome(holon.workspace, holon.offerDirective(${JSON.stringify(domain)}, ${JSON.stringify(d.id)}, ${body}, { domainHash, actor, returnCreated: true${offerExtra} }) as Promise<string | { head: string; created?: { type: string; id: string }[] }>, { workspace: holon.workspace, type: ${JSON.stringify(dd.aggregateId ?? mint.mintType)}, id: ${mint.field} });`,
           `    },`,
         );
@@ -2006,12 +2567,15 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
         d.marker === "creates"
           ? `Author \`${domain}/${d.id}\`: the LAW mints the ${d.aggregateId ?? "aggregate"} id inside the sealed intent; it rides back on \`outcome.created\` — no id in the payload, no query-after.`
           : `Author \`${domain}/${d.id}\` locally under the installed law; returns the typed [NomosOutcome] (\`head\` + any \`created\` refs).`;
-      const sealDoc = wantSeal ? " Encrypted field(s) are SEALED via the bound { keyStore } before dispatch (pass { seal: false } to skip)." : "";
+      const sealDoc = ownedSeal
+        ? " Owned content is encrypted automatically by Nomos."
+        : wantSeal ? " Encrypted field(s) are SEALED via the bound { keyStore } before dispatch (pass { seal: false } to skip)." : "";
       const gateDoc = gate ? ` GATED: needs \`{ actor }\` (\`${gate.relation}\`) — throws MissingOfferAuthority otherwise.` : "";
       methods.push(
         `    /** ${outcomeDoc}${sealDoc}${gateDoc} */`,
         `    ${d.id}: async (${paramSig}): Promise<NomosOutcome> => {`,
         ...(gateGuard ? [gateGuard.replace(/\n$/, "")] : []),
+        ...(ownedRecordPrelude ? [ownedRecordPrelude] : []),
         ...(sealPrelude ? [sealPrelude] : []),
         `      return _outcome(holon.workspace, holon.offerDirective(${JSON.stringify(domain)}, ${JSON.stringify(d.id)}, ${offerPayload}, { domainHash, actor, returnCreated: true${offerExtra} }) as Promise<string | { head: string; created?: { type: string; id: string }[] }>);`,
         `    },`,
@@ -2035,11 +2599,27 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
         })
         .join("; ");
       const qScopes = readScopesFor(q.returns);
+      const qOwned = qScopes.some((scope) => scope.owned === true);
+      const qScopeJson = JSON.stringify(qScopes);
       methods.push(
         `    /** Declared query \`${q.id}\` (indexed probe — routed by the read manifest).${qScopes.length ? " Encrypted field(s) decrypt when the bound { keyStore } holds the scope key; else they stay opaque envelopes." : ""} */`,
         qScopes.length
-          ? `    ${lcFirst(camel(q.id))}: async (params: { ${params} }) => ${wrapP(`holon.query(${JSON.stringify(q.id)}, params, await _readKeys(keyStore, ${JSON.stringify(qScopes)})) as Promise<Row<${q.returns}Data>[]>`)},`
+          ? qOwned
+            ? `    ${lcFirst(camel(q.id))}: async (params: { ${params} }) => ${wrapP(`_readWithOwnedKeys(holon, keyStore, ${qScopeJson}, (keys) => holon.query(${JSON.stringify(q.id)}, params, keys) as Promise<Row<${q.returns}Data>[]>)`)},`
+            : `    ${lcFirst(camel(q.id))}: async (params: { ${params} }) => ${wrapP(`holon.query(${JSON.stringify(q.id)}, params, await _readKeys(holon, keyStore, ${qScopeJson})) as Promise<Row<${q.returns}Data>[]>`)},`
           : `    ${lcFirst(camel(q.id))}: (params: { ${params} }) => ${wrapP(`holon.query(${JSON.stringify(q.id)}, params) as Promise<Row<${q.returns}Data>[]>`)},`,
+        `    /** Reactive \`${q.id}\` — re-emits typed rows on every local change; returns stop(). */`,
+        qOwned
+          ? `    watch${cap(camel(q.id))}: (params: { ${params} }, cb: (rows: Row<${q.returns}Data>[]) => void, opts?: { intervalMs?: number }) => _watchWithOwnedKeys((changed) => holon.watch(${JSON.stringify(q.id)}, params, changed as (rows: unknown) => void, opts), () => ${wrapP(`_readWithOwnedKeys(holon, keyStore, ${qScopeJson}, (keys) => holon.query(${JSON.stringify(q.id)}, params, keys) as Promise<Row<${q.returns}Data>[]>)`)}, cb),`
+          : `    watch${cap(camel(q.id))}: (params: { ${params} }, cb: (rows: Row<${q.returns}Data>[]) => void, opts?: { intervalMs?: number }) => holon.watch(${JSON.stringify(q.id)}, params, ((rows: Row<${q.returns}Data>[]) => cb(${wrapRows("rows")})) as (rows: unknown) => void, opts),`,
+      );
+      pastMethods.push(
+        `        /** Declared query \`${q.id}\` in the verified world at this moment. */`,
+        qScopes.length
+          ? qOwned
+            ? `        ${lcFirst(camel(q.id))}: async (params: { ${params} }) => ${wrapP(`_readWithOwnedKeys(holon, keyStore, ${qScopeJson}, (keys) => historic.query(${JSON.stringify(q.id)}, params, keys) as Promise<Row<${q.returns}Data>[]>)`)},`
+            : `        ${lcFirst(camel(q.id))}: async (params: { ${params} }) => ${wrapP(`historic.query(${JSON.stringify(q.id)}, params, await _readKeys(holon, keyStore, ${qScopeJson})) as Promise<Row<${q.returns}Data>[]>`)},`
+          : `        ${lcFirst(camel(q.id))}: (params: { ${params} }) => ${wrapP(`historic.query(${JSON.stringify(q.id)}, params) as Promise<Row<${q.returns}Data>[]>`)},`,
       );
       // THE LOGICAL PAGED ROW SURFACE (sharding §5.3, ruling 2 — slice 4): emitted
       // ONLY for packed-taxonomy domains (taxonomy-free clients stay byte-identical).
@@ -2064,6 +2644,12 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           ? `    ${lcFirst(camel(c.id))}: (${p}: string) => holon.count(${JSON.stringify(c.id)}, ${p}),`
           : `    ${lcFirst(camel(c.id))}: () => holon.count(${JSON.stringify(c.id)}),`,
       );
+      pastMethods.push(
+        `        /** Declared count \`${c.id}\` at this moment. */`,
+        grouped
+          ? `        ${lcFirst(camel(c.id))}: (${p}: string) => historic.count(${JSON.stringify(c.id)}, ${p}),`
+          : `        ${lcFirst(camel(c.id))}: () => historic.count(${JSON.stringify(c.id)}),`,
+      );
     }
     for (const s of (mod.sums ?? []).map((raw) => finishSum(raw))) {
       const grouped = s.by != null;
@@ -2074,89 +2660,277 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           ? `    ${lcFirst(camel(s.id))}: (${p}: string) => holon.sum(${JSON.stringify(s.id)}, ${p}),`
           : `    ${lcFirst(camel(s.id))}: () => holon.sum(${JSON.stringify(s.id)}),`,
       );
+      pastMethods.push(
+        `        /** Declared sum \`${s.id}\` at this moment. */`,
+        grouped
+          ? `        ${lcFirst(camel(s.id))}: (${p}: string) => historic.sum(${JSON.stringify(s.id)}, ${p}),`
+          : `        ${lcFirst(camel(s.id))}: () => historic.sum(${JSON.stringify(s.id)}),`,
+      );
     }
 
-    // ── SURFACED CONFLICT DX (surfaced_merge_conflict.md): the workspace-wide pendingConflicts
-    // accessor + one typed `resolve…` helper per designated `.resolves()` directive. Emitted iff
-    // this domain declares a Surfaced field (byte-identical otherwise — the era rule).
+    // ── BUSINESS MERGE CONFLICT DX: Nomos keeps its heterogeneous workspace index private. The
+    // generated surface exposes a summary, then aggregate-specific pending conflict references.
+    // Each reference owns the one lawful `merge(...)` action for its field — Git semantics: inspect
+    // the competing versions, produce a merged result (which may be either side or a third value),
+    // and commit it as a causally-later write.
     const resolverBindings = (mod as { surfacedResolvers?: import("./surfaced_lint.js").SurfacedResolverBinding[] }).surfacedResolvers ?? [];
     if (resolverBindings.length > 0) {
+      const conflictAggregateType = (aggregateId: string): string => {
+        const aggregate = mod.aggregates.find((candidate) => candidate.id === aggregateId);
+        if (aggregate === undefined) {
+          throw new Error(`generated conflict policy refers to unknown aggregate '${aggregateId}' in domain '${domain}'`);
+        }
+        return isNamespacedAggregate(aggregate)
+          ? qualifyReadProjectionType(domain, aggregateId)
+          : aggregateId;
+      };
+      const byAggregate = new Map<string, typeof resolverBindings>();
+      for (const binding of resolverBindings) {
+        byAggregate.set(binding.aggregateId, [...(byAggregate.get(binding.aggregateId) ?? []), binding]);
+      }
       methods.push(
-        `    /** PENDING SURFACED CONFLICTS across the workspace — the maintained "decisions needed" read`,
-        `     *  (reserved id \`nomosPendingConflicts\`; derived, not drained: a resolution write removes its`,
-        `     *  row by derivation). Pair each row with its typed \`resolve…\` helper below. */`,
-        `    pendingConflicts: () => {`,
-        `      if (!holon.pendingConflicts) throw new Error("this holon predates pendingConflicts reads — upgrade @githolon/client");`,
-        `      return holon.pendingConflicts();`,
-        `    },`,
-        `    /** Watch the pending Surfaced conflicts (local reactive read; returns stop()). */`,
-        `    watchPendingConflicts: (cb: (rows: PendingConflictRow[]) => void, opts?: { intervalMs?: number }) => {`,
-        `      if (!holon.pendingConflicts) throw new Error("this holon predates pendingConflicts reads — upgrade @githolon/client");`,
-        `      let stopped = false;`,
-        `      let last = "";`,
-        `      const tick = async () => { try { const rows = await holon.pendingConflicts!(); const j = JSON.stringify(rows); if (!stopped && j !== last) { last = j; cb(rows); } } catch { /* projection catching up */ } };`,
-        `      void tick();`,
-        `      const t = setInterval(tick, opts?.intervalMs ?? 1000);`,
-        `      return () => { stopped = true; clearInterval(t); };`,
-        `    },`,
+        `    /** Pending business merges. Start at summary, then query one aggregate; the returned`,
+        `     *  conflict is the typed capability that can merge itself. Nomos's raw index stays private. */`,
+        `    conflicts: {`,
+        `      summary: async (): Promise<ConflictSummary> => {`,
+        `        if (!holon.pendingConflictSummary) throw new Error("conflicts need the current @githolon/client");`,
+        `        return holon.pendingConflictSummary();`,
+        `      },`,
       );
-      for (const b of resolverBindings) {
-        if (b.valuePayloadField === undefined) continue; // probe couldn't bind — dispatch the directive directly.
-        const payloadName = dirPayloadNames.get(b.directiveId);
-        if (payloadName === undefined) continue;
-        const helper = `resolve${cap(camel(b.aggregateId))}${cap(camel(b.field))}`;
-        const idField = b.idPayloadField;
-        const bound = [b.valuePayloadField, ...(idField !== undefined ? [idField] : [])];
-        const restType = `Omit<${payloadName}, ${bound.map((f) => JSON.stringify(f)).join(" | ")}>`;
-        const conflictParam = idField !== undefined ? `conflict: string | PendingConflictRow, ` : ``;
-        const payloadExpr = `{ ...(rest ?? {}), ${idField !== undefined ? `${JSON.stringify(idField)}: typeof conflict === "string" ? conflict : conflict.aggregateId, ` : ``}${JSON.stringify(b.valuePayloadField)}: chosen } as ${payloadName}`;
+      for (const [aggregateId, bindings] of byAggregate) {
+        const runtimeAggregateType = conflictAggregateType(aggregateId);
         methods.push(
-          `    /** RESOLVE a pending conflict on \`${b.aggregateId}.${b.field}\` by dispatching the DESIGNATED`,
-          `     *  resolver \`${b.directiveId}\` with the chosen value${idField !== undefined ? ` (the conflict row — or the bare aggregate id — names the instance)` : ""}.`,
-          `     *  ESCAPE HATCH: any gated directive that sets the field still resolves the conflict in the`,
-          `     *  kernel sense; \`.resolves()\` only designates which one THIS typed helper dispatches. */`,
-          `    ${helper}: (${conflictParam}chosen: ${payloadName}[${JSON.stringify(b.valuePayloadField)}], rest?: ${restType}): Promise<NomosOutcome> =>`,
-          `      _outcome(holon.workspace, holon.offerDirective(${JSON.stringify(domain)}, ${JSON.stringify(b.directiveId)}, ${payloadExpr}, { domainHash, actor, returnCreated: true }) as Promise<string | { head: string; created?: { type: string; id: string }[] }>),`,
+          `      ${lcFirst(camel(aggregateId))}: {`,
+          `        /** Pending merges for ${aggregateId}. Querying creates typed merge references;`,
+          `         *  no aggregate id, field name, or directive id is supplied by the app. */`,
+          `        pending: async () => {`,
+          `          if (!holon.pendingConflicts) throw new Error("conflicts need the current @githolon/client");`,
+          `          const rows = await holon.pendingConflicts(${JSON.stringify(runtimeAggregateType)});`,
+          `          return rows.flatMap((conflict) => {`,
+          `            if (conflict.aggregateType !== ${JSON.stringify(runtimeAggregateType)}) return [];`,
+          `            if (typeof conflict.snapshot !== "string" || conflict.snapshot.length === 0 || typeof conflict.targetSchema !== "string" || conflict.targetSchema.length === 0) {`,
+          `              throw new Error("conflicts need a runtime with immutable conflict snapshots; upgrade Nomos before merging");`,
+          `            }`,
+          `            switch (conflict.field) {`,
+        );
+        for (const b of bindings) {
+          if (b.valuePayloadField === undefined || b.idPayloadField === undefined) continue;
+          const payloadName = dirPayloadNames.get(b.directiveId);
+          if (payloadName === undefined) continue;
+          const valueType = `${payloadName}[${JSON.stringify(b.valuePayloadField)}]`;
+          const bound = [b.valuePayloadField, b.idPayloadField];
+          const restType = `Omit<${payloadName}, ${bound.map((f) => JSON.stringify(f)).join(" | ")}>`;
+          const payloadExpr = `{ ...(rest ?? {}), ${JSON.stringify(b.idPayloadField)}: conflict.aggregateId, ${JSON.stringify(b.valuePayloadField)}: merged } as ${payloadName}`;
+          methods.push(
+            `              case ${JSON.stringify(b.field)}: {`,
+            `                if (conflict.status === "evolutionRequired") {`,
+            `                  return [{ aggregateId: conflict.aggregateId, field: ${JSON.stringify(b.field)} as const, status: "evolutionRequired" as const, evolution: conflict.evolution! }];`,
+            `                }`,
+            `                if (!Array.isArray(conflict.observations)) throw new Error("Nomos returned a ready conflict without projected versions");`,
+            `                const versions = conflict.observations as SurfacedObservation<${valueType}>[];`,
+            `                return [{`,
+            `                  aggregateId: conflict.aggregateId,`,
+            `                  field: ${JSON.stringify(b.field)} as const,`,
+            `                  status: "ready" as const,`,
+            `                  versions,`,
+            `                  /** Produce and commit a merge result from the competing versions. The result`,
+            `                   *  may equal either side or be a new business value, exactly like a Git merge. */`,
+            `                  merge: (reconcile: (versions: readonly SurfacedObservation<${valueType}>[]) => ${valueType}, rest?: ${restType}): Promise<NomosOutcome> => {`,
+            `                    const merged = reconcile(versions);`,
+            `                    return _outcome(holon.workspace, (holon.offerDirective as __NomosConflictOffer)(${JSON.stringify(domain)}, ${JSON.stringify(b.directiveId)}, ${payloadExpr}, { domainHash, actor, returnCreated: true, __nomosConflictSnapshots: [{ aggregateType: conflict.aggregateType, aggregateId: conflict.aggregateId, field: conflict.field, targetSchema: conflict.targetSchema, token: conflict.snapshot }] }) as Promise<string | { head: string; created?: { type: string; id: string }[] }>);`,
+            `                  },`,
+            `                }];`,
+            `              }`,
+          );
+        }
+        methods.push(
+          `              default: return [];`,
+          `            }`,
+          `          });`,
+          `        },`,
+          `      },`,
         );
       }
+      methods.push(`    },`);
     }
     for (const agg of mod.aggregates as AggregateHandle[]) {
       const aScopes = readScopesFor(agg.id);
+      const aOwned = aScopes.some((scope) => scope.owned === true);
+      const aScopeJson = JSON.stringify(aScopes);
+      const runtimeType = runtimeTypeOf(agg);
       methods.push(
         `    /** Read one ${agg.id} by aggregate id.${aScopes.length ? " Encrypted field(s) decrypt when the bound { keyStore } holds the scope key." : ""} */`,
         aScopes.length
-          ? `    ${lcFirst(camel(agg.id))}ById: async (id: string) => ${wrapP(`holon.queryById(id, await _readKeys(keyStore, ${JSON.stringify(aScopes)})) as Promise<Row<${agg.id}Data>[]>`)},`
+          ? `    ${lcFirst(camel(agg.id))}ById: async (id: string) => ${wrapP(`holon.queryById(id, await _readKeys(holon, keyStore, ${aScopeJson}${aOwned ? `, [{ type: ${JSON.stringify(runtimeType)}, id }]` : ""})) as Promise<Row<${agg.id}Data>[]>`)},`
           : `    ${lcFirst(camel(agg.id))}ById: (id: string) => ${wrapP(`holon.queryById(id) as Promise<Row<${agg.id}Data>[]>`)},`,
         `    /** Every ${agg.id} (the type-index probe — O(result), not a scan). */`,
         aScopes.length
-          ? `    list${agg.id}s: async () => ${wrapP(`holon.query("aggregatesByType", { __type: ${JSON.stringify(agg.id)} }, await _readKeys(keyStore, ${JSON.stringify(aScopes)})) as Promise<Row<${agg.id}Data>[]>`)},`
+          ? aOwned
+            ? `    list${agg.id}s: async () => ${wrapP(`_readWithOwnedKeys(holon, keyStore, ${aScopeJson}, (keys) => holon.query("aggregatesByType", { __type: ${JSON.stringify(agg.id)} }, keys) as Promise<Row<${agg.id}Data>[]>)`)},`
+            : `    list${agg.id}s: async () => ${wrapP(`holon.query("aggregatesByType", { __type: ${JSON.stringify(agg.id)} }, await _readKeys(holon, keyStore, ${aScopeJson})) as Promise<Row<${agg.id}Data>[]>`)},`
           : `    list${agg.id}s: () => ${wrapP(`holon.query("aggregatesByType", { __type: ${JSON.stringify(agg.id)} }) as Promise<Row<${agg.id}Data>[]>`)},`,
         `    /** Watch one ${agg.id} by aggregate id (local reactive read; returns stop()). */`,
-        `    watch${agg.id}ById: (id: string, cb: (rows: Row<${agg.id}Data>[]) => void, opts?: { intervalMs?: number }) =>`,
-        `      holon.watchById(id, ((rows: Row<${agg.id}Data>[]) => cb(${wrapRows("rows")})) as (rows: unknown) => void, opts),`,
+        aOwned
+          ? `    watch${agg.id}ById: (id: string, cb: (rows: Row<${agg.id}Data>[]) => void, opts?: { intervalMs?: number }) => _watchWithOwnedKeys((changed) => holon.watchById(id, changed as (rows: unknown) => void, opts), async () => ${wrapP(`holon.queryById(id, await _readKeys(holon, keyStore, ${aScopeJson}, [{ type: ${JSON.stringify(runtimeType)}, id }])) as Promise<Row<${agg.id}Data>[]>`)}, cb),`
+          : `    watch${agg.id}ById: (id: string, cb: (rows: Row<${agg.id}Data>[]) => void, opts?: { intervalMs?: number }) => holon.watchById(id, ((rows: Row<${agg.id}Data>[]) => cb(${wrapRows("rows")})) as (rows: unknown) => void, opts),`,
+      );
+      pastMethods.push(
+        `        /** Read one ${agg.id} by aggregate id at this moment. */`,
+        aScopes.length
+          ? `        ${lcFirst(camel(agg.id))}ById: async (id: string) => ${wrapP(`historic.queryById(id, await _readKeys(holon, keyStore, ${aScopeJson}${aOwned ? `, [{ type: ${JSON.stringify(runtimeType)}, id }]` : ""})) as Promise<Row<${agg.id}Data>[]>`)},`
+          : `        ${lcFirst(camel(agg.id))}ById: (id: string) => ${wrapP(`historic.queryById(id) as Promise<Row<${agg.id}Data>[]>`)},`,
+        `        /** Every ${agg.id} at this moment. */`,
+        aScopes.length
+          ? aOwned
+            ? `        list${agg.id}s: async () => ${wrapP(`_readWithOwnedKeys(holon, keyStore, ${aScopeJson}, (keys) => historic.query("aggregatesByType", { __type: ${JSON.stringify(agg.id)} }, keys) as Promise<Row<${agg.id}Data>[]>)`)},`
+            : `        list${agg.id}s: async () => ${wrapP(`historic.query("aggregatesByType", { __type: ${JSON.stringify(agg.id)} }, await _readKeys(holon, keyStore, ${aScopeJson})) as Promise<Row<${agg.id}Data>[]>`)},`
+          : `        list${agg.id}s: () => ${wrapP(`historic.query("aggregatesByType", { __type: ${JSON.stringify(agg.id)} }) as Promise<Row<${agg.id}Data>[]>`)},`,
       );
     }
 
+    methods.push(
+      `    /** Historic scrubbing in the same generated business language as live reads. */`,
+      `    past: {`,
+      `      moments: async (opts: { limit?: number } = {}): Promise<NomosMoment[]> => {`,
+      `        if (!holon.commits) throw new Error("past.moments() needs the current @githolon/client");`,
+      `        const actions = new Set(${JSON.stringify([...dirs.map((directive) => directive.id), ...(correctionActions.length > 0 ? [BUSINESS_CORRECTION_DIRECTIVE] : [])])});`,
+      `        return (await holon.commits(opts))`,
+      `          .filter((commit) => commit.domain === ${JSON.stringify(domain)} && commit.directiveId !== null && actions.has(commit.directiveId))`,
+      `          .map((commit) => ({`,
+      `          id: commit.oid,`,
+      `          occurredAt: commit.at == null ? null : new Date(commit.at).toISOString(),`,
+      `          actorSubject: commit.actorSubject,`,
+      `          domain: commit.domain,`,
+      `          action: commit.directiveId === ${JSON.stringify(BUSINESS_CORRECTION_DIRECTIVE)} ? "correction" : commit.directiveId,`,
+      `          }));`,
+      `      },`,
+      `      at: (moment: NomosMoment) => {`,
+      `        if (!holon.at) throw new Error("past.at() needs the current @githolon/client");`,
+      `        const historic = holon.at(moment.id);`,
+      `        return {`,
+      ...pastMethods,
+      `        };`,
+      `      },`,
+      `    },`,
+    );
+
     if (activityPresent) {
       methods.push(
-        `    /** THE ACTIVITY FEED (declared \`.activity(...)\`): typed activity rows folded from the intent log.`,
-        `     *  \`cb\` fires with the current rows + on every new committed intent; returns stop(). Directives with`,
-        `     *  no declared activity are dropped. */`,
+        `    /** THE ACCOUNTABLE ACTIVITY FEED: typed business rows folded from the verified intent log.`,
+        `     *  Every public directive has a baseline; \`.activity(...)\` enriches it. Framework/control work`,
+        `     *  outside this generated package is dropped. Returns stop(). */`,
         `    watchActivity: (cb: (events: ActivityEvent[]) => void, opts?: { base?: string }) =>`,
         `      holon.watchActivity((rows) => cb(rows.map(renderActivity).filter((e): e is ActivityEvent => e !== null)), opts),`,
         `    /** One-shot: the current committed activity log, folded to typed [ActivityEvent]s. */`,
         `    activityLog: async (opts?: { base?: string; limit?: number }): Promise<ActivityEvent[]> =>`,
         `      (await holon.activityLog(opts)).map(renderActivity).filter((e): e is ActivityEvent => e !== null),`,
-        `    /** NARRATIVE (for an in-app LLM): the workspace story — the activity log folded to typed events +`,
-        `     *  a plain-English \`transcript\` grounded in the VERIFIED log. Filter by \`actor\` / \`category\` /`,
-        `     *  \`since\` (ISO occurredAt lower bound); \`limit\` caps the rows pulled. Events are newest-first. */`,
-        `    describe: async (opts: { since?: string; actor?: string; category?: string; limit?: number } = {}): Promise<ActivityNarrative> => {`,
+        `    /** THE SELF-DESCRIPTION: root links to exactly six grounded pages — model, current state, rules,`,
+        `     *  history, decisions and evidence. The old \`events\` / \`transcript\` fields remain, so this is a`,
+        `     *  strict enrichment of the activity narrative. \`section\` selects one page. */`,
+        `    describe: async (opts: { section?: NomosDescribeSection; since?: string; actor?: string; category?: string; limit?: number } = {}): Promise<NomosDescription> => {`,
         `      const raw = await holon.activityLog(opts.limit !== undefined ? { limit: opts.limit } : {});`,
         `      let events = raw.map(renderActivity).filter((e): e is ActivityEvent => e !== null);`,
         `      if (opts.actor !== undefined) events = events.filter((e) => e.actorSubject === opts.actor);`,
         `      if (opts.category !== undefined) events = events.filter((e) => e.category === opts.category);`,
         `      if (opts.since !== undefined) events = events.filter((e) => e.occurredAt >= opts.since!);`,
-        `      return { events, transcript: _activityTranscript(events) };`,
+        `      let organisation: NomosOrganisationDescription = { complete: false, children: [] };`,
+        `      if (holon.__nomosChildWorkspaces !== undefined) {`,
+        `        try {`,
+        `          const children = await holon.__nomosChildWorkspaces();`,
+        `          organisation = { complete: children.every((child) => child.status !== "unknown"), children: children.map((child) => ({`,
+        `            ...child, section: "root" as const, label: child.workspace,`,
+        `            question: "What does this part of the organisation do, and what has happened there?",`,
+        `            summary: child.status === "active"`,
+        `              ? "This part of the organisation is active. Follow its generated description to continue."`,
+        `              : child.status === "retired"`,
+        `                ? "This part of the organisation is retired. Its recorded history remains explainable."`,
+        `                : child.status === "reclaimed"`,
+        `                  ? "This part of the organisation was reclaimed. Its birth remains part of this workspace's history."`,
+        `                  : "This part of the organisation has a newer lifecycle this client does not understand. Its link remains visible.",`,
+        `          })) };`,
+        `        } catch {`,
+        `          // An old/unavailable runtime cannot prove a leaf. Keep incompleteness explicit.`,
+        `        }`,
+        `      }`,
+        `      const section = opts.section ?? "root";`,
+        `      let title: string = _NOMOS_DESCRIBE_MODEL.title;`,
+        `      let summary: string = _NOMOS_DESCRIBE_MODEL.summary;`,
+        `      let items: NomosDescribeItem[] = [];`,
+        `      if (section === "model" || section === "rules") {`,
+        `        const page = _NOMOS_DESCRIBE_MODEL.pages[section];`,
+        `        title = page.title; summary = page.summary;`,
+        `        items = (page.items as readonly NomosDescribeItem[]).map((item) => ({ ...item }));`,
+        `      } else if (section === "current") {`,
+        `        title = "Current state";`,
+        `        summary = "The business records this session is allowed to read now. An unavailable type stays named without leaking its contents.";`,
+        `        items = await Promise.all(_NOMOS_DESCRIBE_MODEL.aggregateTypes.map(async (aggregate): Promise<NomosDescribeItem> => {`,
+        `          try {`,
+        `            const rows = await holon.query("aggregatesByType", { __type: aggregate.queryType }) as { type: string; id: string }[];`,
+        `            const refs = rows.map((row) => ({ workspace: holon.workspace, type: row.type, id: row.id }));`,
+        `            const exact = rows.length > 0 || (aggregate.audience as string) === "public";`,
+        `            return { kind: "current", id: \`${"${aggregate.domain}.${aggregate.type}"}\`, label: aggregate.label,`,
+        `              summary: exact ? \`${"${rows.length} ${aggregate.label} record${rows.length === 1 ? \"\" : \"s\"} visible now."}\` : \`${"No ${aggregate.label} records are visible to this session."}\`,`,
+        `              details: { domain: aggregate.domain, type: aggregate.type, audience: aggregate.audience, ...(exact ? { count: rows.length } : { status: "none-visible" }) }, refs };`,
+        `          } catch (error) {`,
+        `            return { kind: "current", id: \`${"${aggregate.domain}.${aggregate.type}"}\`, label: aggregate.label,`,
+        `              summary: \`${"${aggregate.label} exists in the model, but this session cannot read its current records."}\`,`,
+        `              details: { domain: aggregate.domain, type: aggregate.type, audience: aggregate.audience, status: "unavailable" } };`,
+        `          }`,
+        `        }));`,
+        `      } else if (section === "history") {`,
+        `        title = "Verified business history"; summary = "What changed, who changed it and when, read from verified committed testimony.";`,
+        `        items = events.map((event) => ({ kind: "change", id: event.eventId, label: event.title, summary: event.message,`,
+        `          details: { actor: event.actorSubject, occurredAt: event.occurredAt, domain: event.domain, kind: event.kind },`,
+        `          refs: Object.values(event.refs) }));`,
+        `      } else if (section === "decisions") {`,
+        `        title = "Decisions and work needing attention"; summary = "Recorded business reasons, pending merges and retained rejected work, plus the model's declared conflict policy.";`,
+        `        const decisions: NomosDescribeItem[] = events.filter((event) => event.kind.endsWith(".correction"))`,
+        `          .map((event) => ({ kind: "decision", id: event.eventId, label: event.title, summary: event.message,`,
+        `            details: { actor: event.actorSubject, occurredAt: event.occurredAt, domain: event.domain }, refs: Object.values(event.refs) }));`,
+        ...(hasSurfaced
+          ? [
+              `        const pending: NomosDescribeItem[] = (holon.pendingConflicts ? await holon.pendingConflicts() : []).flatMap((conflict) => {`,
+              `          const aggregate = _NOMOS_DESCRIBE_MODEL.aggregateTypes.find((candidate) => candidate.queryType === conflict.aggregateType);`,
+              `          if (aggregate === undefined) return [];`,
+              `          const rule = (_NOMOS_DESCRIBE_MODEL.pages.rules.items as readonly NomosDescribeItem[])`,
+              `            .find((item) => item.id === \`${"${aggregate.domain}.${aggregate.type}.${conflict.field}.merge"}\`);`,
+              `          const subject = rule?.label ?? aggregate.label + " " + conflict.field;`,
+              `          const versions = conflict.status === "ready" ? conflict.observations?.length ?? 0 : conflict.evolution?.sourceSchemas?.length ?? 0;`,
+              `          const summary = conflict.status === "ready"`,
+              `            ? subject + " has " + versions + " competing versions waiting for one business merge."`,
+              `            : subject + " cannot yet be compared because the model does not explain every earlier value. The disagreement remains pending while unrelated work continues.";`,
+              `          return [{ kind: conflict.status === "ready" ? "pending-merge" : "evolution-required",`,
+              `            id: \`${"decision:${aggregate.domain}.${aggregate.type}:${conflict.aggregateId}:${conflict.field}"}\`, label: "Review " + subject, summary,`,
+              `            details: { domain: aggregate.domain, type: aggregate.type, field: conflict.field, status: conflict.status, versions, next: conflict.status === "ready" ? "merge" : "update-model" },`,
+              `            refs: [{ workspace: holon.workspace, type: aggregate.type, id: conflict.aggregateId }] }];`,
+              `        });`,
+            ]
+          : []),
+        `        const actions = (_NOMOS_DESCRIBE_MODEL.pages.model.items as readonly NomosDescribeItem[]).filter((item) => item.kind === "verb");`,
+        `        const rejected: NomosDescribeItem[] = (await holon.deadLetters()).flatMap((entry) => {`,
+        `          if (typeof entry.domain !== "string" || typeof entry.directiveId !== "string") return [];`,
+        `          const action = actions.find((item) => item.id === entry.domain + "." + entry.directiveId);`,
+        `          if (action === undefined) return [];`,
+        `          const reason = _nomosRefusalReason(entry.error);`,
+        `          return [{ kind: "rejected-action", id: "rejected:" + (entry.id ?? entry.oid), label: "Review " + action.label,`,
+        `            summary: _nomosRefusalSummary(reason, action.label),`,
+        `            details: { domain: entry.domain, action: entry.directiveId, status: "retained", reason, refusedAt: entry.at, canRetry: true } }];`,
+        `        });`,
+        `        const policies = (_NOMOS_DESCRIBE_MODEL.pages.rules.items as readonly NomosDescribeItem[]).filter((item) => item.kind === "conflict-rule" || item.kind === "merge-rule")`,
+        `          .map((item) => ({ ...item }));`,
+        `        items = [...decisions, ${hasSurfaced ? "...pending, " : ""}...rejected, ...policies];`,
+        `      } else if (section === "evidence") {`,
+        `        title = "Evidence"; summary = "Opaque identities tying this answer to one workspace, one generated law and its verified business history.";`,
+        `        const latestMoment = events[0];`,
+        `        items = [`,
+        `          { kind: "evidence", id: "workspace", label: "Workspace", summary: holon.workspace, details: { workspace: holon.workspace } },`,
+        `          { kind: "evidence", id: "law", label: "Generated law", summary: domainHash, details: { domainHash } },`,
+        `          { kind: "evidence", id: "reader", label: "Verified reader", summary: actor ?? "anonymous", details: { actor: actor ?? null } },`,
+        `          ...(latestMoment === undefined ? [] : [{ kind: "evidence", id: latestMoment.eventId, label: "Latest verified moment",`,
+        `            summary: latestMoment.eventId, details: { occurredAt: latestMoment.occurredAt, actor: latestMoment.actorSubject, domain: latestMoment.domain, kind: latestMoment.kind } }]),`,
+        `        ];`,
+        `      }`,
+        `      return { section, title, summary, items, links: _NOMOS_DESCRIBE_MODEL.links.map((link) => ({ ...link })), organisation, events, transcript: _activityTranscript(events) };`,
         `    },`,
         `    /** NARRATIVE for ONE thing: the story of the aggregate \`aggregateId\` — events whose declared refs`,
         `     *  point at it (only directives declaring a ref to the aggregate appear in its story) + a transcript. */`,
@@ -2174,13 +2948,33 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       ` *  Pass \`{ actor }\` (the verified principal uid) to author AS that user — every write seals it as`,
       ` *  the captured principal, so the ReBAC \`.requires(...)\` gate + the integrity-dual endorse model`,
       ` *  judge the real author. Omit it for open (un-gated) domains. */`,
-      `export function ${tsClientFactoryName(domain)}(holon: NomosHolon, opts: { domainHash?: string; actor?: string${encPresent ? "; keyStore?: NomosKeyStore" : ""} } = {}) {`,
+      `export function ${tsClientFactoryName(domain)}(holon: NomosHolon, opts: { domainHash?: string; actor?: string${domScopes.length > 0 ? "; keyStore?: NomosKeyStore" : ""} } = {}) {`,
       `  const domainHash = opts.domainHash ?? ${hashConst};`,
       `  const actor = opts.actor ?? holon.principal;`,
-      ...(encPresent ? [`  const keyStore = opts.keyStore;`] : []),
+      ...(encPresent ? [`  const keyStore: NomosKeyStore | undefined = ${domScopes.length > 0 ? "opts.keyStore" : "undefined"};`] : []),
+      ...(ownedScope !== undefined && Object.keys(ownedActions).length > 0
+        ? [
+            `  const _ownedActions: Record<string, Record<"share" | "unshare" | "transfer", string>> = ${JSON.stringify(ownedActions)};`,
+            `  let _ownedReadyError: unknown;`,
+            `  const _ownedReady = holon.__nomosEnsureOwnedIdentity`,
+            `    ? holon.__nomosEnsureOwnedIdentity({ scope: ${JSON.stringify(ownedScope)}, domain: ${JSON.stringify(domain)}, domainHash }).catch((error) => { _ownedReadyError = error; })`,
+            `    : Promise.resolve().then(() => { _ownedReadyError = new Error("owned records need the current @githolon/client"); });`,
+            `  const _ownedRecordAction = async (action: "share" | "unshare" | "transfer", record: NomosRef, peer: string): Promise<NomosOutcome> => {`,
+            `    await _ownedReady;`,
+            `    if (_ownedReadyError !== undefined) throw _ownedReadyError;`,
+            `    if (record.workspace !== holon.workspace) throw new Error(\`${"${action}()"} cannot use a record from another workspace\`);`,
+            `    const directiveId = _ownedActions[record.type]?.[action];`,
+            `    if (directiveId === undefined) throw new Error(\`${"${action}()"} needs a generated owned record reference\`);`,
+            `    if (!peer.trim()) throw new Error(\`${"${action}()"} needs the person to act with\`);`,
+            `    if (!holon.__nomosPrepareOwnedRecordAction) throw new Error("record sharing needs the current @githolon/client");`,
+            `    const payload = await holon.__nomosPrepareOwnedRecordAction({ action, scope: ${JSON.stringify(ownedScope)}, record, peer });`,
+            `    return _outcome(holon.workspace, holon.offerDirective(${JSON.stringify(domain)}, directiveId, payload, { domainHash, actor, returnCreated: true }) as Promise<string | { head: string; created?: { type: string; id: string }[] }>, record);`,
+            `  };`,
+          ]
+        : []),
       ...(opts.compat !== undefined
         ? [
-            opts.interface !== undefined
+            clientInterface !== undefined
               ? `  holon.checkCompat?.(${compatConstName(opts.packageName)}, ${interfaceConstName(opts.packageName)});`
               : `  holon.checkCompat?.(${compatConstName(opts.packageName)});`,
             // RELEASE COHERENCE: throw a typed skew error AT BIND if the cloud's kernel lacks a capability
@@ -2191,9 +2985,41 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       `  return {`,
       `    domain: ${JSON.stringify(domain)} as const,`,
       `    domainHash,`,
-      ...(opts.interface !== undefined
+      `    /** Adopt THIS generated model. Nomos proves it against current history; a deliberate`,
+      `     *  difference returns a decision whose accept(reason) re-proves and records the reason. */`,
+      `    model: {`,
+      `      adopt: (): Promise<NomosModelAdoption> => _nomosAdoptModel(holon, ${JSON.stringify(domain)}, domainHash),`,
+      `      restorePrevious: (): Promise<NomosModelRestoration> => _nomosRestorePreviousModel(holon, ${JSON.stringify(domain)}, domainHash),`,
+      `    },`,
+      ...(clientInterface !== undefined
         ? [`    interface: ${interfaceConstName(opts.packageName)}[${JSON.stringify(domain)}],`]
         : []),
+      ...(ownedScope !== undefined
+        ? [
+            `    /** Opt into all-device-loss recovery with one explicitly designated person. Nomos owns the escrow and audit protocol. */`,
+            `    recovery: {`,
+            `      protectWith: async (person: string): Promise<{ status: "protected"; recoveryPrincipal: string; unchanged?: boolean }> => {`,
+            `        if (!person.trim()) throw new Error("recovery.protectWith() needs the person who will recover you");`,
+            `        if (!holon.__nomosProtectOwnedIdentity) throw new Error("recovery.protectWith() needs the current @githolon/client");`,
+            `        return holon.__nomosProtectOwnedIdentity({ scope: ${JSON.stringify(ownedScope)}, domain: ${JSON.stringify(domain)}, domainHash, recoveryPrincipal: person });`,
+            `      },`,
+            `    },`,
+            `    /** Add another of this person's devices without exposing keys, certificates or signer law. */`,
+            `    devices: {`,
+            `      request: async (): Promise<NomosDeviceRequest> => {`,
+            `        if (!holon.__nomosOwnedDeviceRequest) throw new Error("devices.request() needs the current @githolon/client");`,
+            `        return await holon.__nomosOwnedDeviceRequest({ scope: ${JSON.stringify(ownedScope)} }) as NomosDeviceRequest;`,
+            `      },`,
+            `      approve: async (request: NomosDeviceRequest): Promise<NomosOutcome> => {`,
+            `        const principal = actor ?? holon.principal;`,
+            `        if (!principal || !principal.trim()) throw new Error("devices.approve() needs a signed-in Nomos session");`,
+            `        if (!holon.__nomosPrepareOwnedDeviceApproval) throw new Error("devices.approve() needs the current @githolon/client");`,
+            `        const payload = await holon.__nomosPrepareOwnedDeviceApproval({ request, scope: ${JSON.stringify(ownedScope)} });`,
+            `        return _outcome(holon.workspace, holon.offerDirective(${JSON.stringify(domain)}, ${JSON.stringify(OWNED_DEVICE_APPROVAL_DIRECTIVE)}, payload, { domainHash, actor: principal, returnCreated: true }) as Promise<string | { head: string; created?: { type: string; id: string }[] }>);`,
+            `      },`,
+            `    },`,
+          ]
+        : []),
       // THE OWNER CEREMONY (slice 2): only for a domain that actually defines an encryption scope.
       ...(domScopes.length > 0
         ? [