@githolon/dsl 0.100.5 → 0.101.0

package/src/compile_package_main.ts

@@ -67,12 +67,14 @@ import {
 } from "./codegen_dart.js";
 import type { ContractHandle } from "./contract.js";
 import { generateDartBridgeClient } from "./codegen_dart_client.js";
+import { buildNomosDescribeModel } from "./describe_model.js";
 import {
   isFrameworkAggregate,
   isFrameworkDirective,
   isFrameworkQuery,
 } from "./framework/framework_aggregates.js";
 import { RelationTuple, relationTuplesByObject } from "./framework/relations.js";
+import { isNamespacedAggregate } from "./read_projection_namespace.js";
 import { finishCount, type AnyCount } from "./count.js";
 import type { QueryDecl } from "./query.js";
 import type { SpatialDecl } from "./spatial.js";
@@ -94,6 +96,7 @@ import { synthesizePreconditionInvariants } from "./precondition.js";
 import { BIRTH_FRAMEWORK_QUERIES, synthesizeBirthQuotaInvariants } from "./birth_meter.js";
 import { withBirthMeterExports } from "./birth_meter_ensure.js";
 import { expandBusinessBirthExports } from "./business_birth.js";
+import { withOwnedCustodyExports } from "./framework/owned_custody.js";
 import { expandRoleExports, rolesOf } from "./role.js";
 import { collectEngineRouting } from "./engine_entry.js";
 import {
@@ -134,6 +137,7 @@ import { generateTsProof, proofLegsIndex } from "./codegen_proof.js";
 import { checkDomainModules, formatFindings, hasRefusal } from "./law_check.js";
 import type { NomosCompat } from "./compat_manifest.js";
 import { requiredKernelFeatures, type FeatureProbeModule } from "./kernel_capabilities.js";
+import { APPLICATION_HOME_DOMAIN } from "./framework/application_home_domain.js";
 
 const DSL_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 
@@ -494,8 +498,8 @@ const FRAMEWORK_FILE = "nomos_framework";
 /** The shared basename of the domain-contracts DTO file emitted once per package (domain_contracts.md). */
 const CONTRACTS_FILE = "contracts";
 
-/** The shared basename of the ACTIVITY REGISTRY file emitted once per package (activity_descriptors.md).
- *  Absent when no directive declares `.activity(...)` — an activity-free package emits no `activity_registry.dart`. */
+/** The shared basename of the ACCOUNTABLE ACTIVITY REGISTRY emitted once per package when it carries at
+ *  least one public business directive. `.activity(...)` enriches the generated baseline; it does not gate it. */
 const ACTIVITY_FILE = "activity_registry";
 
 /** Collect every domain contract across the package's modules, deduped by id (later-wins). Sorted by id.
@@ -598,10 +602,13 @@ function collectDartSharedSymbols(
   const frameworkAggById = new Map<string, AggregateHandle>();
   const frameworkDirById = new Map<string, ModDirective>();
   const frameworkQueryById = new Map<string, ModQuery>();
+  const isInternal = (value: unknown): boolean =>
+    !!value && typeof value === "object"
+      && (value as { businessBirthInternal?: unknown }).businessBirthInternal === true;
   for (const mod of modules) {
-    for (const a of mod.aggregates) if (isFrameworkAggregate(a)) frameworkAggById.set(a.id, a);
-    for (const d of mod.directives) if (isFrameworkDirective(d)) frameworkDirById.set(d.id, d);
-    for (const q of mod.queries ?? []) if (isFrameworkQuery(q)) frameworkQueryById.set(q.id, q);
+    for (const a of mod.aggregates) if (!isInternal(a) && isFrameworkAggregate(a)) frameworkAggById.set(a.id, a);
+    for (const d of mod.directives) if (!isInternal(d) && isFrameworkDirective(d)) frameworkDirById.set(d.id, d);
+    for (const q of mod.queries ?? []) if (!isInternal(q) && isFrameworkQuery(q)) frameworkQueryById.set(q.id, q);
   }
   const frameworkAggs = [...frameworkAggById.values()];
   const frameworkDirs = [...frameworkDirById.values()];
@@ -780,6 +787,7 @@ function emitDart(
   barrelName = "nomos_domains",
   compat?: NomosCompat,
   names?: Readonly<Record<string, string>>,
+  describePackageName = barrelName,
 ): string[] {
   const domainSources: string[] = []; // for flat-mode alias validation (dart.names)
   const sourceByFile = new Map<string, string>(); // fileBase → src, for precise alias-import selection
@@ -886,14 +894,14 @@ function emitDart(
       aggregateIdClassNames: packageAggregateIdClassNames(modules),
     }));
   }
-  // 2a-ter. the shared ACTIVITY REGISTRY (`activity_registry.dart`) — the pure `renderActivity`, ONCE. Emitted
-  //         iff a directive opts in via `.activity(...)` (activity-free packages stay byte-identical). Pure
-  //         (nomos_types), so the client folds typed activity rows from the intent log with no runtime import.
+  // 2a-ter. the shared ACCOUNTABLE ACTIVITY + DESCRIPTION REGISTRY (`activity_registry.dart`) — emitted
+  //         ONCE for every package. A read-only package has an empty activity registry but still exposes
+  //         describe(model/current/rules/history/decisions/evidence).
+  //         Pure (nomos_types), so the client folds typed rows from the intent log with no runtime import.
   const packageActivity = collectActivityDescriptors(modules);
-  const activityImportUri = packageActivity.length > 0 ? `${ACTIVITY_FILE}.dart` : undefined;
-  if (packageActivity.length > 0) {
-    writeGenerated(ACTIVITY_FILE, generateDartActivityRegistry(packageActivity));
-  }
+  const describeModel = buildNomosDescribeModel(modules, describePackageName);
+  const activityImportUri = `${ACTIVITY_FILE}.dart`;
+  writeGenerated(ACTIVITY_FILE, generateDartActivityRegistry(packageActivity));
   // CROSS-DOMAIN `t.foreignRef` (auto import). A foreignRef field typed `ForeignRef<CatalogueListing>` +
   // `CatalogueListing.fromJson` needs the TARGET aggregate's Dart class — which lives in the target DOMAIN's
   // generated file. Within ONE package the compiler knows which domain owns each aggregate, so we auto-emit
@@ -969,7 +977,9 @@ function emitDart(
       ...(compat !== undefined ? { compat } : {}),
       supportImport,
       ...(domainFrameworkImport !== undefined ? { frameworkImportUri: domainFrameworkImport } : {}),
-      ...(packageActivity.length > 0 ? { emitActivity: true, ...(activityImportUri !== undefined ? { activityImportUri } : {}) } : {}),
+      emitActivity: true,
+      activityImportUri,
+      describeModel,
       packageAggregateDomains,
     });
     const cp = path.join(genDir, `${mod.name}.client.dart`);
@@ -1048,11 +1058,11 @@ const DART_TYPES_IMPORT = `import 'package:nomos_types/nomos_types.dart';`;
  *  just the floor generated code needs — a lagging pin forces tenants into dependency_overrides. */
 // 0.3.0: SurfacedValue<T>/SurfacedObservation/PendingConflictRow — generated Surfaced-field typing +
 //        the pendingConflicts read rows.
-const NOMOS_TYPES_DEP = "^0.6.0";
+const NOMOS_TYPES_DEP = "^0.7.0";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.62.0";
+const NOMOS_CLIENT_DEP = "^0.63.0";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).
@@ -1142,6 +1152,7 @@ function emitDartPackages(
   packages: { readonly types: string; readonly client: string; readonly test?: string; readonly compat?: string; readonly barrelExports?: "all" | "explicit" },
   names: Readonly<Record<string, string>> | undefined,
   compat?: NomosCompat,
+  describePackageName = packages.client,
 ): { written: string[]; cursed: string[] } {
   for (const [role, name] of Object.entries(packages)) {
     if (typeof name !== "string" || !isPubPackageName(name)) {
@@ -1157,6 +1168,7 @@ function emitDartPackages(
   if (new Set(roleNames).size !== roleNames.length) fail(`dart.packages: types/client/test/compat names must be distinct`);
 
   const packageContracts = collectPackageContracts(modules);
+  const describeModel = buildNomosDescribeModel(modules, describePackageName);
   const shared = collectDartSharedSymbols(modules, packageContracts);
   const written: string[] = [];
   const genRel = DART_GENERATED_SUBDIR.split(path.sep).join("/");
@@ -1219,10 +1231,9 @@ function emitDartPackages(
       aggregateIdClassNames: packageAggregateIdClassNames(modules),
     }));
   }
-  // ACTIVITY REGISTRY (layered): the pure `renderActivity` in the TYPES package (nomos_types only). The
-  // client resolves it through the types-package barrel (which re-exports every types file). Opt-in only.
+  // ACTIVITY + DESCRIPTION REGISTRY (layered): universal, including packages with empty history.
   const packageActivity = collectActivityDescriptors(modules);
-  if (packageActivity.length > 0) writeTypes(ACTIVITY_FILE, generateDartActivityRegistry(packageActivity));
+  writeTypes(ACTIVITY_FILE, generateDartActivityRegistry(packageActivity));
   // CROSS-DOMAIN foreignRef (layered): map aggregate id → its domain's type file, so a foreignRef field's
   // target class resolves via a sibling import (the purity gate now permits sibling type files).
   const aggIdToTypeFile = new Map<string, string>();
@@ -1354,7 +1365,8 @@ function emitDartPackages(
       ...(compat !== undefined ? { compat } : {}),
       supportImport: "package",
       typesImportUri,
-      ...(packageActivity.length > 0 ? { emitActivity: true } : {}),
+      emitActivity: true,
+      describeModel,
       packageAggregateDomains: buildPackageAggregateDomains(modules),
       // Under 'explicit' the types barrel withholds per-domain classes — import every domain's TYPES
       // file directly so the client's read-model/payload/ref/typed-id references resolve. (The no-dup-
@@ -1549,6 +1561,20 @@ async function main(): Promise<void> {
     fail(`package name '${cfg.name}' is not a safe basename (letters, digits, spaces, '.', '-', '_')`);
   }
 
+  // ONE BUSINESS BIRTH IS A COMPLETE PRODUCT ENTRYPOINT. The compiler privately appends the
+  // application/home law which turns a signed-in identity into its home workspace; that home can then
+  // call the generated business birth. Tenant config never names this domain. The deliberately obscure
+  // key reduces collision likelihood, but collision handling is still fail-closed: never reinterpret a
+  // tenant's same-named concept as framework machinery.
+  if (cfg.domains.some((d) => d.key === APPLICATION_HOME_DOMAIN)) {
+    fail(
+      `domain key '${APPLICATION_HOME_DOMAIN}' is reserved by Nomos for the private application/home law; ` +
+        `rename the tenant domain (Nomos will not silently overwrite or reroute it)`,
+    );
+  }
+  const domainsToCompile: DomainConfig[] = [...cfg.domains];
+  let applicationHomeInjected = false;
+
   const outDir = path.resolve(cfgDir, cfg.outDir ?? "build");
   mkdirSync(outDir, { recursive: true });
 
@@ -1596,7 +1622,7 @@ async function main(): Promise<void> {
     tasksQueryId: string | null;
   }[] = [];
 
-  for (const d of cfg.domains) {
+  for (const d of domainsToCompile) {
     if (typeof d.key !== "string" || !Array.isArray(d.modules) || d.modules.length === 0) {
       fail(`each domain needs { key, modules: [path, ...] }; got ${JSON.stringify(d)}`);
     }
@@ -1617,7 +1643,21 @@ async function main(): Promise<void> {
     }
     let merged: Mod = {};
     for (const m of mods) merged = { ...merged, ...m };
+    const declaresBusinessBirth = Object.values(merged).some(
+      (value) =>
+        value !== null &&
+        typeof value === "object" &&
+        (value as { __isBusinessBirth?: unknown }).__isBusinessBirth === true,
+    );
+    if (declaresBusinessBirth && !applicationHomeInjected) {
+      applicationHomeInjected = true;
+      domainsToCompile.push({
+        key: APPLICATION_HOME_DOMAIN,
+        modules: [path.join(DSL_DIR, "src", "framework", "application_home.ts")],
+      });
+    }
     merged = expandBusinessBirthExports(merged, d.key);
+    merged = withOwnedCustodyExports(merged);
     // `capability()` bundles expand into discoverable entries (the CLI plane's
     // merge point) — queries/sums/sid-minting/manifests all see the pieces.
     merged = expandCapabilityExports(merged);
@@ -1753,7 +1793,7 @@ async function main(): Promise<void> {
     //    taxonomy-free packages emit NOTHING here (the slice-1 byte-stability law).
     if (shardingModForDomain !== undefined && shardingLazyExpr !== undefined && !eagerLump) {
       const auxKey = `${d.key}/nomos-sharding`;
-      if (cfg.domains.some((x) => x.key === auxKey) || routingInput[auxKey] !== undefined) {
+      if (domainsToCompile.some((x) => x.key === auxKey) || routingInput[auxKey] !== undefined) {
         fail(
           `domain key '${auxKey}' is reserved for the derived sharding law's invariant routing — rename the domain`,
         );
@@ -1773,7 +1813,9 @@ async function main(): Promise<void> {
     if (directivesOf(merged).some((dir) => (dir as { birthsChild?: boolean }).birthsChild === true)) {
       const haveQuery = new Set(queries.map((q) => q.id));
       for (const q of BIRTH_FRAMEWORK_QUERIES) {
-        if (!haveQuery.has(q.id)) queries.push(q);
+        if (!haveQuery.has(q.id)) {
+          queries.push({ ...q, businessBirthInternal: true } as QueryDecl);
+        }
       }
     }
     // RELATION-USING LAW AUTO-COMPOSES ITS AUDIT READ (co2 recovery DX, same idiom as the birth-meter
@@ -1906,7 +1948,7 @@ async function main(): Promise<void> {
           ? { dartImports: d.dartImports }
           : {}),
         ...(d.dartRefImports !== undefined && d.dartRefImports.length > 0
-          ? { dartRefImports: d.dartRefImports }
+          ? { dartRefImports: [...d.dartRefImports] }
           : {}),
         ...(permissionVocabulary !== undefined ? { permissionVocabulary } : {}),
       }),
@@ -2037,6 +2079,13 @@ async function main(): Promise<void> {
     }
   }
 
+  // Presentation is a separate concern from executable law. The private application/home domain remains
+  // in `domainModules` for hashing, routing, self-description, replay and static checking, but generated
+  // tenant clients/proofs/interfaces contain business vocabulary only.
+  const presentationDomainModules = domainModules.filter(
+    (mod) => (mod.domain ?? mod.name) !== APPLICATION_HOME_DOMAIN,
+  );
+
   // ── STABLE-ID CONTINUITY (#58 — names are labels, identity is minted) ──
   // Derive each composed domain's stable ids from the PRIOR compile: the committed
   // `nomos.stable-ids.json` lockfile beside the config (the durable source — survives
@@ -2060,12 +2109,23 @@ async function main(): Promise<void> {
     const identityName = mod.name;
     // The CURRENT canonical aggregate schemas (a pre-continuity manifest pass —
     // aggregates/schemas do not depend on continuity).
-    let currentAggs: { id: string; schema: WireSchema; kinds?: Record<string, string> }[];
+    let currentAggs: {
+      id: string;
+      schema: WireSchema;
+      kinds?: Record<string, string>;
+      global?: boolean;
+    }[];
     try {
       const preManifest = domainManifest(mod);
       currentAggs = preManifest.aggregates.map((a) => ({
         id: a.id,
         schema: a.schema,
+        // One framework aggregate may be composed into many independently compiled
+        // domain packages. Give that shared row one global stable-id scope so the
+        // installed read manifest sees the same field contract from every package.
+        global: mod.aggregates.some(
+          (candidate) => candidate.id === a.id && !isNamespacedAggregate(candidate),
+        ),
         // The CURRENT field kinds (off the pre-continuity stableIds emission) — the
         // pair rule's kind axis ("rename + add a field" in one release still infers).
         kinds: Object.fromEntries(
@@ -2149,7 +2209,7 @@ async function main(): Promise<void> {
   // `connect()` negotiates compatibility by SHAPE (stable-id subtyping), not by law hash.
   // architecture/shape_compatibility.md. Multiple modules sharing a domain key merge.
   const packageInterface: Record<string, DomainInterface> = {};
-  for (const mod of domainModules) {
+  for (const mod of presentationDomainModules) {
     const key = mod.domain ?? mod.name;
     const di = domainInterface(mod, nextLock.domains[mod.name]?.stableIds);
     const prior = packageInterface[key];
@@ -2171,7 +2231,7 @@ async function main(): Promise<void> {
   // supported: each codegen layer mints a named recursive type for it (TS `type <Name>`, Dart
   // recursive class). Surfaced here so the tenant sees which fields became which named types.
   const recursiveNotes: string[] = [];
-  for (const mod of domainModules) {
+  for (const mod of presentationDomainModules) {
     for (const d of (mod.directives ?? []) as Array<{ id?: unknown; payloadSchema?: unknown }>) {
       if (!d || typeof d.id !== "string" || !d.payloadSchema || typeof d.payloadSchema !== "object") continue;
       for (const { path, name } of recursiveLazyTypes(d.payloadSchema as Parameters<typeof recursiveLazyTypes>[0], d.id)) {
@@ -2306,6 +2366,24 @@ async function main(): Promise<void> {
   // JS shim with the platform-native binary, which only an exec can run.
   const esbuildBin = path.join(path.dirname(esbuildPkgJson), esbuildBinRel ?? "bin/esbuild");
 
+  const canonicalizeEngineJavascript = (source: string): string => {
+    // esbuild includes module labels derived from the package's install topology in
+    // non-minified bundles. The same law therefore used to hash differently when the
+    // DSL was reached through this monorepo (../../dsl/src/...) and through a packed
+    // dependency (node_modules/@githolon/dsl/src/...). Canonicalise only esbuild's
+    // generated comment/function labels: tenant strings and executable imports are
+    // deliberately outside these narrow replacements.
+    const body = source
+      .replace(/^\s*"use strict";\s*$/gm, "")
+      .replace(/^(\s*\/\/ )(?:(?:\.\.\/)+dsl\/src\/|node_modules\/@githolon\/dsl\/src\/)/gm, "$1@githolon/dsl/src/")
+      .replace(/"(?:(?:\.\.\/)+dsl\/src\/|node_modules\/@githolon\/dsl\/src\/)([^"]+)"\(\) \{/g, '"@githolon/dsl/src/$1"() {')
+      .replace(/^(\s*\/\/ )(?:(?:\.\.\/)+node_modules\/zod\/|node_modules\/zod\/)/gm, "$1zod/")
+      .replace(/"(?:(?:\.\.\/)+node_modules\/zod\/|node_modules\/zod\/)([^"]+)"\(\) \{/g, '"zod/$1"() {')
+      .replace(/\n[ \t]*\n/g, "\n")
+      .trimEnd();
+    return `"use strict";\n${body}\n`;
+  };
+
   const compact = compactFlag || cfg.compact === true;
   let javascript: string;
   if (compact) {
@@ -2344,6 +2422,7 @@ async function main(): Promise<void> {
       { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], cwd: cfgDir, maxBuffer: 256 * 1024 * 1024 },
     ).trimEnd() + "\n";
   }
+  javascript = canonicalizeEngineJavascript(javascript);
   if (!/globalThis\.plan\s*=/.test(javascript) && !/globalThis\["plan"\]\s*=/.test(javascript)) {
     fail(`bundled engine entry does not assign globalThis.plan — refusing to package`);
   }
@@ -2437,7 +2516,7 @@ async function main(): Promise<void> {
       "utf8",
     );
     try {
-      execFileSync(process.execPath, [probePath, lumpPath, JSON.stringify(cfg.domains.map((d) => d.key))], {
+      execFileSync(process.execPath, [probePath, lumpPath, JSON.stringify(domainsToCompile.map((d) => d.key))], {
         encoding: "utf8",
         stdio: ["ignore", "ignore", "pipe"],
       });
@@ -2550,7 +2629,7 @@ async function main(): Promise<void> {
     }
   })();
   const compatDomains: NomosCompat["domains"] = {};
-  for (const m of domainModules) {
+  for (const m of presentationDomainModules) {
     const key = m.domain ?? m.name;
     const identityHash = identity.hashes[key];
     compatDomains[key] = identityHash === undefined ? {} : { identityHash };
@@ -2559,7 +2638,11 @@ async function main(): Promise<void> {
   // era-key features). Baked into the client so connect() can check it against the target
   // kernel's advertised capabilities BEFORE the law folds (kernel_capabilities.ts).
   const requiresKernel = ((): string[] => {
-    const probes: FeatureProbeModule[] = domainModules.map((m) => (m.queries ? { queries: m.queries } : {}));
+    const probes: FeatureProbeModule[] = domainModules.map((m) => ({
+      ...(m.queries ? { queries: m.queries } : {}),
+      ...(m.surfacedResolvers ? { surfacedResolvers: m.surfacedResolvers } : {}),
+      ...(m.aggregates ? { aggregates: m.aggregates } : {}),
+    }));
     try {
       const parsed = JSON.parse(usdJson) as { layers?: Record<string, unknown>[] };
       for (const layer of parsed.layers ?? []) probes.push({ layer });
@@ -2583,12 +2666,16 @@ async function main(): Promise<void> {
   // the read overlay; the workspace's full spec is the runtime merge of installed packages' specs
   // (currentLaw); the host ingests it and builds its router from it — no domain/directive name in host
   // source. Self-describing for the whole web ecosystem (Swagger/codegen/Hono/agent tool-calling).
-  const openapi = mergeOpenApiFragments(
+  const publicOpenapi = mergeOpenApiFragments(
     domainModules.map((m) => generateOpenApiFragment(m, { lawHash: domainHash })),
     { title: `${cfg.name} (nomos package)`, lawHash: domainHash },
   );
+  const runtimeOpenapi = mergeOpenApiFragments(
+    domainModules.map((m) => generateOpenApiFragment(m, { lawHash: domainHash, includeFrameworkRoutes: true })),
+    { title: `${cfg.name} (nomos package)`, lawHash: domainHash },
+  );
   const openapiPath = path.join(outDir, `${cfg.name}.openapi.json`);
-  writeFileSync(openapiPath, JSON.stringify(openapi, null, 2) + "\n", "utf8");
+  writeFileSync(openapiPath, JSON.stringify(publicOpenapi, null, 2) + "\n", "utf8");
 
   // ── 4. the one-call deploy body (package only) ──
   // SELF-DESCRIBING: `summary` states what the (otherwise hex-opaque) package
@@ -2598,7 +2685,7 @@ async function main(): Promise<void> {
   const summary = {
     package: cfg.name,
     domainHash,
-    domains: domainModules.map((m) => ({
+    domains: presentationDomainModules.map((m) => ({
       domain: m.domain ?? m.name,
       aggregates: m.aggregates.map((a) => a.id),
       directives: m.directives.map((d) => d.id),
@@ -2620,7 +2707,7 @@ async function main(): Promise<void> {
     interface: packageInterface,
     // THE SELF-DESCRIBING API: this package's OpenAPI spec (law-derived). The worker stages it on the
     // manifest overlay; a read serves the workspace's merged spec; the host builds its router from it.
-    openapi,
+    openapi: runtimeOpenapi,
     // THE CLIENT/LAW COMPAT MANIFEST (§5): a DIAGNOSIS surface (law hash + interface hash + generator
     // provenance) the connect-time classifier reads. Frontend-only — the package bytes above ignore it.
     nomosCompat,
@@ -2638,14 +2725,14 @@ async function main(): Promise<void> {
   let birthWarnings: string[] = [];
   let proofNotes: string[] = [];
   try {
-    const proofSrc = generateTsProof(domainModules, { packageName: cfg.name, domainHash });
+    const proofSrc = generateTsProof(presentationDomainModules, { packageName: cfg.name, domainHash, interface: packageInterface });
     proofPath = path.join(outDir, `${cfg.name}.proof.mts`);
     writeFileSync(proofPath, proofSrc, "utf8");
     // THE PER-DOMAIN LEGS INDEX: every domain with a creating write, so
     // `githolon proof --domain <key>` proves ANY of them offline (the .mts
     // proves the primary one live). A multi-domain package no longer locks the
     // proof to whichever domain happens to be first.
-    const legsIndex = proofLegsIndex(domainModules);
+    const legsIndex = proofLegsIndex(presentationDomainModules, packageInterface);
     if (legsIndex !== null) {
       writeFileSync(path.join(outDir, `${cfg.name}.proof-legs.json`), JSON.stringify(legsIndex, null, 2) + "\n", "utf8");
       proofDomains = Object.keys(legsIndex.domains);
@@ -2662,7 +2749,7 @@ async function main(): Promise<void> {
   // itself failed, still derive the per-domain diagnostics (best-effort).
   if (proofSkip !== undefined && birthWarnings.length === 0) {
     try {
-      const idx = proofLegsIndex(domainModules);
+      const idx = proofLegsIndex(presentationDomainModules, packageInterface);
       if (idx !== null) {
         birthWarnings = Object.values(idx.domains).flatMap((l) => l.birthDiagnostics ?? []);
         proofNotes = Object.values(idx.domains).flatMap((l) => l.proofDiagnostics ?? []);
@@ -2680,7 +2767,7 @@ async function main(): Promise<void> {
       `  queries: ${d.queries.join(", ") || "—"}   counts: ${d.counts.join(", ") || "—"}   sums: ${d.sums.join(", ") || "—"}`,
     ]),
     `deploy: POST ${cfg.name}.deploy.json to /v2/workspaces/<ws>/domains (or: githolon deploy <ws>)`,
-    `typed client: ${cfg.name}.client.ts — ${tsClientFactoryName(domainModules[0]?.domain ?? domainModules[0]?.name ?? cfg.name)}(holon), law hash baked in`,
+    `typed client: ${cfg.name}.client.ts — ${tsClientFactoryName(presentationDomainModules[0]?.domain ?? presentationDomainModules[0]?.name ?? cfg.name)}(holon), law hash baked in`,
     proofPath !== undefined
       ? `generated proof: ${cfg.name}.proof.mts — run: githolon proof (live; ends ALL GREEN or names the jam)`
       : `generated proof: SKIPPED — ${proofSkip}`,
@@ -2691,7 +2778,7 @@ async function main(): Promise<void> {
   // ── 5. the typed TS client (#10 — the web sibling of codegen_dart), with the
   //       deployed law's content hash baked in (emitted AFTER the package is hashed) ──
   const clientPath = path.join(outDir, `${cfg.name}.client.ts`);
-  writeFileSync(clientPath, generateTsClient(domainModules, { packageName: cfg.name, domainHash, interface: packageInterface, compat: nomosCompat }), "utf8");
+  writeFileSync(clientPath, generateTsClient(presentationDomainModules, { packageName: cfg.name, domainHash, interface: packageInterface, compat: nomosCompat }), "utf8");
 
   // ── 6. the typed Dart frontend (opt-in; the Flutter sibling of step 5, emitted
   //       after the package hash like the TS client) ──
@@ -2737,7 +2824,7 @@ async function main(): Promise<void> {
     // COMPILE ATOMICITY (co2): the Dart emit is transactional (beginAtomicGenDir) — a mid-emit fail()/throw
     // restores the prior good packages instead of leaving them wiped/partial. Finalized at process exit.
     if (dartPackages !== undefined) {
-      const r = emitDartPackages(domainModules, dartOut, domainHash, packageInterface, dartPackages, dartNames, nomosCompat);
+      const r = emitDartPackages(presentationDomainModules, dartOut, domainHash, packageInterface, dartPackages, dartNames, nomosCompat, cfg.name);
       dartFiles = r.written;
       dartCursedHints = r.cursed;
     } else {
@@ -2750,7 +2837,7 @@ async function main(): Promise<void> {
         .replace(/^(?=[0-9])/, "n");
       const dartBarrel =
         typeof dartCfg === "object" && dartCfg.barrel !== undefined ? dartCfg.barrel : defaultBarrel;
-      dartFiles = emitDart(domainModules, dartOut, domainHash, packageInterface, dartSupportImport, dartBarrel, nomosCompat, dartNames);
+      dartFiles = emitDart(presentationDomainModules, dartOut, domainHash, packageInterface, dartSupportImport, dartBarrel, nomosCompat, dartNames, cfg.name);
     }
     // COMPILE-VALID MUST MEAN COMPILABLE (co2): `githolon compile` reported success while the generated Dart
     // had hard compiler errors (a duplicate id symbol, missing contract-id defs). Run `dart analyze` over the
@@ -2801,16 +2888,29 @@ async function main(): Promise<void> {
         }
         return undefined;
       })();
-      let dartMissing = false;
-      let unresolved: string | undefined;
+      // Package generation must not depend on which SDKs happen to be installed on the compiler's
+      // machine. Write every source-dogfood override first; the analyzer loop may legitimately stop
+      // at the first missing `dart`, but that must not leave later solve roots pinned to hosted code.
       for (const pkg of pkgDirs) {
         if (localDart) {
           const spec = readFileSync(path.join(pkg, "pubspec.yaml"), "utf8");
           const lines = ["dependency_overrides:"];
-          if (/(^|\n)\s+nomos_client\s*:/.test(spec)) lines.push(`  nomos_client:`, `    path: ${localDart.client}`);
-          if (/(^|\n)\s+nomos_types\s*:/.test(spec)) lines.push(`  nomos_types:`, `    path: ${localDart.types}`);
+          const usesClient = /(^|\n)\s+nomos_client\s*:/.test(spec);
+          const usesTypes = /(^|\n)\s+nomos_types\s*:/.test(spec);
+          if (usesClient) lines.push(`  nomos_client:`, `    path: ${localDart.client}`);
+          // A generated CLIENT or TEST package may only mention nomos_client directly, but that local
+          // package depends on the simultaneously-developed nomos_types. Pub overrides do not propagate
+          // from dependencies, so override the transitive core at THIS solve root as well. Otherwise a
+          // perfectly ordinary recompile of an older generated package can fail version solving before
+          // analyzer ever sees the code — exactly the package-skew ceremony this local dogfood gate exists
+          // to absorb for tenant developers.
+          if (usesTypes || usesClient) lines.push(`  nomos_types:`, `    path: ${localDart.types}`);
           if (lines.length > 1) writeFileSync(path.join(pkg, "pubspec_overrides.yaml"), lines.join("\n") + "\n", "utf8");
         }
+      }
+      let dartMissing = false;
+      let unresolved: string | undefined;
+      for (const pkg of pkgDirs) {
         try {
           execFileSync("dart", ["pub", "get"], { cwd: pkg, stdio: "pipe", encoding: "utf8" });
         } catch (e) {
@@ -2861,20 +2961,23 @@ async function main(): Promise<void> {
   }
   {
     const sum = (pick: (m: (typeof domainModules)[number]) => readonly unknown[] | undefined) =>
-      domainModules.reduce((n, m) => n + (pick(m)?.length ?? 0), 0);
+      presentationDomainModules.reduce((n, m) => n + (pick(m)?.length ?? 0), 0);
     console.log(`  reads      ${sum((m) => m.queries)} quer(y/ies), ${sum((m) => m.counts)} count(s), ${sum((m) => m.sums)} sum(s) — declared (routed via the openapi)`);
   }
   // SECONDARY-CREATE AUTO-DECLARE (secondary_ensure.ts): surface every type the compiler sanctioned
   // from a plan's deterministic secondary `ensure(...)` — the id-mint-gate DX made visible (the author
   // wrote `ensure(B, …)`; the compiler declared `Ensure → B` so the deterministic id admits).
-  for (const m of domainModules) {
+  for (const m of presentationDomainModules) {
     for (const ty of m.autoDeclaredEnsures ?? []) {
       console.log(`  ensure     auto-declared Ensure→${ty} in '${m.domain ?? m.name}' from a plan's secondary ensure(...) (id-mint gate opened)`);
     }
   }
-  console.log(`  identity   ${Object.keys(identity.manifests).length} domain(s) (carried in the package IR + nomos.stable-ids.json; no sidecar files)${identity.excluded.length ? ` — ${identity.excluded.length} EXCLUDED (palette gap)` : ""}`);
-  for (const [dom, h] of Object.entries(identity.hashes)) console.log(`             ${dom.padEnd(20)} ${h}`);
-  for (const ex of identity.excluded) console.log(`             EXCLUDED ${ex.domain}: ${ex.reason}`);
+  const presentedIdentityNames = new Set(presentationDomainModules.map((m) => m.domain ?? m.name));
+  const presentedHashes = Object.entries(identity.hashes).filter(([domain]) => presentedIdentityNames.has(domain));
+  const presentedExcluded = identity.excluded.filter((entry) => presentedIdentityNames.has(entry.domain));
+  console.log(`  identity   ${presentedHashes.length} business domain(s) (private Nomos lifecycle law included but not exposed)${presentedExcluded.length ? ` — ${presentedExcluded.length} EXCLUDED (palette gap)` : ""}`);
+  for (const [dom, h] of presentedHashes) console.log(`             ${dom.padEnd(20)} ${h}`);
+  for (const ex of presentedExcluded) console.log(`             EXCLUDED ${ex.domain}: ${ex.reason}`);
   // STABLE IDS (#58): the minted/carried identity surface + every INFERRED rename —
   // the silent lane made visible (if an inference is wrong — you meant remove+add —
   // split the edit into two compiles, or answer the evolve gate with a disposition).
@@ -2886,7 +2989,7 @@ async function main(): Promise<void> {
       );
     }
   }
-  for (const m of domainModules) {
+  for (const m of presentationDomainModules) {
     if (m.workspaceTypes !== undefined && m.workspaceTypes.length > 0) {
       console.log(
         `  taxonomy   ${m.domain ?? m.name}: ${m.workspaceTypes.length} workspace type(s) — homing derived from t.ref chains; birth lanes typed in the client`,
@@ -2895,7 +2998,7 @@ async function main(): Promise<void> {
   }
   console.log(`  client     ${rel(clientPath)} (typed TS client — payloads, read models, query accessors)`);
   for (const note of recursiveNotes) console.log(`  note       ${note}`);
-  console.log(`  openapi    ${rel(openapiPath)} (${Object.keys(openapi.paths).length} operation(s) — the law's self-describing API; the host's runtime routing table)`);
+  console.log(`  openapi    ${rel(openapiPath)} (${Object.keys(publicOpenapi.paths).length} operation(s) — the public business API; private framework routes ride only in the deploy manifest)`);
   if (proofPath !== undefined) {
     console.log(`  proof      ${rel(proofPath)} (a runnable e2e GENERATED from your law — run: githolon proof)`);
   } else {
@@ -2911,9 +3014,15 @@ async function main(): Promise<void> {
   //    gate's refusal vocabulary, unified into ONE report. `githolon check` runs the same pass;
   //    compile runs it implicitly and REFUSES on any refuse-level finding (a statically-provable
   //    runtime refusal shipped as law). Warns/notes are printed but never block the compile.
-  const checkFindings = checkDomainModules(domainModules);
+  const allCheckFindings = checkDomainModules(domainModules);
+  const isFrameworkFinding = (finding: (typeof allCheckFindings)[number]) =>
+    finding.domain === APPLICATION_HOME_DOMAIN || finding.directiveId?.startsWith("nomos_internal_") === true;
+  const checkFindings = allCheckFindings.filter((finding) => !isFrameworkFinding(finding));
+  const privateRefusals = allCheckFindings.filter(
+    (finding) => isFrameworkFinding(finding) && finding.level === "refuse",
+  );
   if (checkFindings.length > 0) {
-    console.log(`  check      ${checkFindings.length} finding(s) (githolon check):`);
+    console.log(`  check      ${checkFindings.length} business-law finding(s) (githolon check):`);
     for (const line of formatFindings(checkFindings)) {
       const mark = line.includes("REFUSE") ? "✗" : line.includes("WARN") ? "⚠" : "•";
       console.log(`             ${mark} ${line}`);
@@ -2925,6 +3034,16 @@ async function main(): Promise<void> {
       process.exitCode = 1;
     }
   }
+  if (privateRefusals.length > 0) {
+    console.error(
+      `  ✗ Nomos lifecycle self-check failed inside this compiler release. Tenant law is not at fault; ` +
+        `upgrade @githolon/dsl or report the compiler version.`,
+    );
+    if (process.env.NOMOS_DEBUG_FRAMEWORK === "1") {
+      for (const line of formatFindings(privateRefusals)) console.error(`             ${line}`);
+    }
+    process.exitCode = 1;
+  }
   if (dartOut !== undefined) {
     if (dartPackages !== undefined) {
       const pkgList = [