@githolon/dsl 0.100.5 → 0.101.0

package/src/birth_meter.ts

@@ -83,7 +83,7 @@ export const NomosBirthRecord = aggregate("NomosBirthRecord", {
   childGenesisHash: t.string().merge(Lww),
   /** Caller-stamped birth time from the payload (`bornAt`, else `requestedAt`) — the timestamp doctrine. */
   bornAt: t.string().merge(Lww),
-});
+}).public();
 
 /**
  * NomosChildLifecycle — additive lifecycle for a child witnessed by NomosBirthRecord. It is deliberately
@@ -98,7 +98,7 @@ export const NomosChildLifecycle = aggregate("NomosChildLifecycle", {
   retiredAt: t.int().merge(Lww),
   reclaimedBy: t.string().merge(Lww),
   reclaimedAt: t.int().merge(Lww),
-});
+}).public();
 
 /** BirthPolicy — the workspace's birth-allowance singleton (id `birth-policy:workspace`), the
  *  `CloudPolicy` shape one level down: the default max live births per subject in THIS workspace. */
@@ -110,7 +110,7 @@ export const BirthPolicy = aggregate("BirthPolicy", {
   setBy: t.string().merge(Lww),
   /** Caller-stamped (ISO or epoch-ms string) — the timestamp doctrine. */
   setAt: t.string().merge(Lww),
-});
+}).public();
 
 /** BirthGrant — a per-subject allowance override (id `birth-grant:<principal>`), the `QuotaGrant`
  *  shape: the LATEST grant (max grantedAt) for a subject is the allowance in force. */
@@ -123,7 +123,7 @@ export const BirthGrant = aggregate("BirthGrant", {
   grantedBy: t.string().merge(Lww),
   /** epoch-ms — the recency tiebreak (latest grant wins), caller-stamped. */
   grantedAt: t.int().merge(Lww),
-});
+}).public();
 
 // ── the meter's declared queries (the #58 captured-read recipes) ────────────────────────────────────
 

package/src/birth_meter_ensure.ts

@@ -42,6 +42,50 @@ import {
   retireChildRequiresBirth,
   retireChildNotReclaimed,
 } from "./framework/birth_meter.js";
+import { RelationTuple, relationTupleInstanceId, relationTuplesByObject } from "./framework/relations.js";
+import { GENESIS_WARRANT_ID, GenesisWarrant, seedGenesis } from "./framework/genesis.js";
+import {
+  BIRTH_ATTESTATION_ID,
+  BirthAttestation,
+  birthAttestation,
+  seedBirthAttestation,
+} from "./framework/home.js";
+import { requireParentAttestedBirth } from "./births.js";
+import {
+  SignerDelegation,
+  enrollDelegation,
+  enrollSigner,
+  identityRelations,
+  signerDelegationByUser,
+  signerObject,
+} from "./framework/signing_identity.js";
+import {
+  AuthProvider,
+  authProvider,
+  authProviderSeedBeforeWarrant,
+  seedAuthProvider,
+  setAuthProvider,
+} from "./framework/auth_provider_law.js";
+import { refAs, workspaceInvariant } from "./framework/workspace_invariant.js";
+
+/** Lightweight copy of the framework's founding-signer guard, kept here to avoid importing the whole
+ * governance module (whose unrelated captured-read laws would otherwise survive into every child lump). */
+const bornFounderSignerWriteOnce = workspaceInvariant("FounderSignerWriteOnce")
+  .on("enrollSigner")
+  .reads((ctx) => [
+    refAs(
+      "tuple",
+      "RelationTuple",
+      "pre:" + relationTupleInstanceId(signerObject(String((ctx.intent ?? {}).principal ?? "")), "signer"),
+    ),
+  ])
+  .assert(({ tuple }, ctx) => {
+    const subjects = (tuple as { subjects?: Record<string, unknown> })?.subjects ?? {};
+    const want = "key:" + String((ctx?.intent ?? {}).keyHash ?? "");
+    return Object.keys(subjects).every((key) => key === want)
+      ? { accept: true }
+      : { reject: "founding-signer-already-enrolled" };
+  });
 
 /**
  * The sanctioning declaration — an `ensures(NomosBirthRecord)` directive whose plan emits ZERO ops.
@@ -70,36 +114,128 @@ export function withBirthMeterExports<M extends Record<string, unknown>>(mod: M)
       (v as { birthsChild?: boolean }).birthsChild === true &&
       typeof (v as Directive<unknown>).plan === "function",
   );
-  if (!declaresBirth) return mod;
+  // A law that accepts the kernel-injected birth attestation is itself a possible CHILD even if it never
+  // births anything. Such a law must also accept the framework-owned founding signer step, otherwise the
+  // child can replay but can never sign its first write or birth a descendant without tenant recipe work.
+  const acceptsBirth = Object.values(mod).some(
+    (v) =>
+      v !== null &&
+      typeof v === "object" &&
+      (v as { id?: unknown }).id === "seedBirthAttestation" &&
+      typeof (v as Directive<unknown>).plan === "function",
+  );
+  if (!declaresBirth && !acceptsBirth) return mod;
   const out: Record<string, unknown> = { ...mod };
-  // Business birth hides framework maintenance declarations from the generated application facade while
-  // retaining them in certified law for the operator's structural offer discovery. A non-business
-  // `.births()` law keeps its existing explicit generated surface.
-  const businessInternal = Object.values(mod).some(
-    (v) => v !== null && typeof v === "object" && (v as { businessBirth?: unknown }).businessBirth !== undefined,
+  const internal = <T extends object>(v: T): T => ({ ...v, businessBirthInternal: true }) as T;
+  const hasOwn = (key: string): boolean => Object.prototype.hasOwnProperty.call(out, key);
+  const isGeneratedInternal = (value: unknown): boolean =>
+    value !== null &&
+    typeof value === "object" &&
+    (value as { businessBirthInternal?: unknown }).businessBirthInternal === true;
+  const reservedNameError = (key: string): Error => new Error(
+    `Nomos internal export name '${key}' is reserved inside a birth-capable law, but the tenant module ` +
+      "already exports a different concept there. Nomos will not silently overwrite or reroute it; rename " +
+      "the tenant export.",
   );
-  const presented = <T extends object>(v: T): T =>
-    businessInternal ? ({ ...v, businessBirthInternal: true } as T) : v;
-  if (!("nomosBirthRecordEnsure" in out)) out["nomosBirthRecordEnsure"] = presented(nomosBirthRecordEnsure);
-  if (!("NomosBirthRecord" in out)) out["NomosBirthRecord"] = presented(NomosBirthRecord);
-  if (!("NomosChildLifecycle" in out)) out["NomosChildLifecycle"] = presented(NomosChildLifecycle);
-  if (!("BirthPolicy" in out)) out["BirthPolicy"] = presented(BirthPolicy);
-  if (!("BirthGrant" in out)) out["BirthGrant"] = presented(BirthGrant);
-  if (!("retireChild" in out)) out["retireChild"] = presented(retireChild);
-  if (!("reclaimChild" in out)) out["reclaimChild"] = presented(reclaimChild);
-  if (!("retireChildAsAdmin" in out)) out["retireChildAsAdmin"] = presented(retireChildAsAdmin);
-  if (!("reclaimChildAsAdmin" in out)) out["reclaimChildAsAdmin"] = presented(reclaimChildAsAdmin);
-  if (!("reclaimChildRequiresRetired" in out)) out["reclaimChildRequiresRetired"] = reclaimChildRequiresRetired;
-  if (!("reclaimChildAsAdminRequiresRetired" in out)) {
-    out["reclaimChildAsAdminRequiresRetired"] = reclaimChildAsAdminRequiresRetired;
-  }
-  if (!("retireChildRequiresBirth" in out)) out["retireChildRequiresBirth"] = retireChildRequiresBirth;
-  if (!("retireChildNotReclaimed" in out)) out["retireChildNotReclaimed"] = retireChildNotReclaimed;
-  if (!("retireChildAsAdminRequiresBirth" in out)) {
-    out["retireChildAsAdminRequiresBirth"] = retireChildAsAdminRequiresBirth;
-  }
-  if (!("retireChildAsAdminNotReclaimed" in out)) {
-    out["retireChildAsAdminNotReclaimed"] = retireChildAsAdminNotReclaimed;
-  }
+  /** Reserve a framework-only JS export slot as well as its stable law id. The keys are deliberately obscure,
+   * but obscurity is collision avoidance, not collision handling: an occupied slot is always a loud refusal. */
+  const reserve = <T>(key: string, canonical: T): void => {
+    if (!hasOwn(key)) {
+      out[key] = canonical;
+      return;
+    }
+    const existing = out[key];
+    if (existing !== canonical && !isGeneratedInternal(existing)) throw reservedNameError(key);
+  };
+  /**
+   * Framework ownership follows the stable law id, not the tenant's export key. Older laws commonly
+   * re-exported `enrollSigner`/`seedGenesis` under their public names; merely adding a second hidden
+   * `__nomos_*` binding leaves BOTH declarations discoverable and lets codegen expose the old one. Mark
+   * every matching binding internal, and add the canonical declaration only when the law carried none.
+   */
+  const internalize = <T extends { readonly id: string }>(key: string, canonical: T): void => {
+    if (hasOwn(key)) {
+      const existing = out[key];
+      const sameGeneratedId =
+        isGeneratedInternal(existing) &&
+        (existing as { id?: unknown }).id === canonical.id;
+      if (existing !== canonical && !sameGeneratedId) throw reservedNameError(key);
+    }
+    let found = false;
+    for (const [exportName, value] of Object.entries(out)) {
+      if (
+        value !== null &&
+        typeof value === "object" &&
+        (value as { id?: unknown }).id === canonical.id
+      ) {
+        const isCanonicalSingleton = value === canonical;
+        const isNomosGeneratedBinding =
+          (value as { businessBirthInternal?: unknown }).businessBirthInternal === true;
+        if (!isCanonicalSingleton && !isNomosGeneratedBinding) {
+          throw new Error(
+            `Nomos framework id '${canonical.id}' is reserved inside a birth-capable law, but export ` +
+              `'${exportName}' declares a different tenant-owned concept with that id. Nomos will not ` +
+              `silently reinterpret it as framework machinery; rename the tenant concept.`,
+          );
+        }
+        out[exportName] = internal(value);
+        found = true;
+      }
+    }
+    if (!found) out[key] = internal(canonical);
+  };
+  // THE BORN-WORKSPACE CORE: the kernel appends enrollSigner -> attestation -> warrant to every valid birth.
+  // Carry the law needed to judge that internal step in every possible child, plus the write-once guard that
+  // keeps the founding lane a genesis primitive. These declarations are certified but never tenant-facing.
+  internalize("__nomos_RelationTuple", RelationTuple);
+  reserve("__nomos_identityRelations", identityRelations);
+  internalize("__nomos_enrollSigner", enrollSigner);
+  internalize("__nomos_relationTuplesByObject", relationTuplesByObject);
+  internalize("__nomos_GenesisWarrant", GenesisWarrant);
+  internalize("__nomos_seedGenesis", seedGenesis);
+  internalize("__nomos_BirthAttestation", BirthAttestation);
+  internalize("__nomos_seedBirthAttestation", seedBirthAttestation);
+  internalize("__nomos_birthAttestation", birthAttestation);
+  internalize("__nomos_AuthProvider", AuthProvider);
+  internalize("__nomos_seedAuthProvider", seedAuthProvider);
+  reserve("__nomos_authProviderSeedBeforeWarrant", authProviderSeedBeforeWarrant);
+  internalize("__nomos_setAuthProvider", setAuthProvider);
+  internalize("__nomos_authProvider", authProvider);
+  reserve("__nomos_founderSignerWriteOnce", bornFounderSignerWriteOnce);
+  if (!declaresBirth) return out as M;
+  // Birth lifecycle is Nomos machinery for every birth-capable law. It remains certified/routable law,
+  // but no generated tenant API gets a second maintenance lane beside business `birth(...)`.
+  internalize("__nomos_nomosBirthRecordEnsure", nomosBirthRecordEnsure);
+  internalize("__nomos_NomosBirthRecord", NomosBirthRecord);
+  internalize("__nomos_NomosChildLifecycle", NomosChildLifecycle);
+  internalize("__nomos_BirthPolicy", BirthPolicy);
+  internalize("__nomos_BirthGrant", BirthGrant);
+  internalize("__nomos_retireChild", retireChild);
+  internalize("__nomos_reclaimChild", reclaimChild);
+  internalize("__nomos_retireChildAsAdmin", retireChildAsAdmin);
+  internalize("__nomos_reclaimChildAsAdmin", reclaimChildAsAdmin);
+  reserve("__nomos_reclaimChildRequiresRetired", reclaimChildRequiresRetired);
+  reserve("__nomos_reclaimChildAsAdminRequiresRetired", reclaimChildAsAdminRequiresRetired);
+  reserve("__nomos_retireChildRequiresBirth", retireChildRequiresBirth);
+  reserve("__nomos_retireChildNotReclaimed", retireChildNotReclaimed);
+  reserve("__nomos_retireChildAsAdminRequiresBirth", retireChildAsAdminRequiresBirth);
+  reserve("__nomos_retireChildAsAdminNotReclaimed", retireChildAsAdminNotReclaimed);
+  // ONE BIRTH LANE ALSO MEANS ONE PRIVATE SIGNING LANE. The client completes a `.births()` offer's signer
+  // enrollment, delegation and cert retry internally; therefore every birth-declaring parent law must carry
+  // the declarations that make those framework writes lawful. Previously only the newer `businessBirth`
+  // helper composed them, while an ordinary `.births()` directive forced the harness/app to understand
+  // `enrollDelegation` (or failed as an unverifiable black box). Auto-compose the exact same framework
+  // declarations for ALL births and mark them presentation-internal: they remain certified/routable law,
+  // but never appear in TS/Dart/OpenAPI tenant surfaces.
+  internalize("__nomos_SignerDelegation", SignerDelegation);
+  internalize("__nomos_enrollDelegation", enrollDelegation);
+  internalize("__nomos_signerDelegationByUser", signerDelegationByUser);
+  reserve("__nomos_parentAttestedBirth", internal({
+    ...requireParentAttestedBirth,
+    ownerObject: GENESIS_WARRANT_ID,
+    ownerField: "principal",
+    certObject: BIRTH_ATTESTATION_ID,
+    certField: "certChain",
+  }));
   return out as M;
 }

package/src/births.ts

@@ -3,10 +3,10 @@
 // wasm32-wasip1 artifact {kernel · projection · embedded
 // QuickJS engine}.  If a file isn't this / hosting this / authoring for this / proving this — it's gone.
 
-import type { z } from "zod";
+import { z } from "zod";
 import type { AggregateHandle } from "./aggregate.js";
 import type { AggregateRef } from "./authoring.js";
-import type { Field } from "./fields.js";
+import type { Field, FieldValue } from "./fields.js";
 
 /**
  * THE BIRTH EFFECT — birth is an EXPLICIT, DECLARED kernel primitive (G3, the unix model).
@@ -75,19 +75,29 @@ export interface BusinessBirthDecl<
   readonly payloadSchema: z.ZodObject<z.ZodRawShape>;
   /** A stable business key the caller already knows (an estate reference, account number, etc.). */
   readonly key: (payload: P) => string;
-  /** Author the born thing's initial business facts. Nomos supplies the durable identity and lifecycle. */
+  /** The declared business fact used by {@link key}; retained for generated clients to pre-address custody. */
+  readonly keyField: string;
+  /** Framework-derived initial authoring. Tenant code marks aggregate fields `.fromBirth()` instead. */
   readonly plan: (root: AggregateRef<F>, payload: P) => unknown;
   /** Optional business noun used only to make the durable address readable. Defaults to the aggregate id. */
   readonly namespace?: string;
 }
 
-export interface BusinessBirthSpec<
-  P extends Record<string, unknown>,
-  F extends Record<string, Field>,
-> {
-  readonly payload: z.ZodType<P> & z.ZodObject<z.ZodRawShape>;
-  readonly key: (payload: P) => string;
-  readonly plan: (root: AggregateRef<F>, payload: P) => unknown;
+export type BirthFactKeys<F extends Record<string, Field>> = {
+  [K in keyof F]-?: F[K] extends { readonly isFromBirth: true } ? K : never;
+}[keyof F] & string;
+
+export type BirthStringFactKeys<F extends Record<string, Field>> = {
+  [K in BirthFactKeys<F>]: FieldValue<F[K]> extends string ? K : never;
+}[BirthFactKeys<F>] & string;
+
+export type BusinessBirthPayload<F extends Record<string, Field>> = {
+  readonly [K in BirthFactKeys<F>]: FieldValue<F[K]>;
+};
+
+export interface BusinessBirthSpec<F extends Record<string, Field>> {
+  /** One declared birth fact that gives this business life its stable address. */
+  readonly key: BirthStringFactKeys<F>;
   readonly namespace?: string;
 }
 
@@ -95,30 +105,51 @@ export interface BusinessBirthSpec<
  * declares `birth(Aggregate, spec)` and leaves the recipe, identity, and recovery machinery to Nomos. */
 export function birth(recipe: BirthRecipe): void;
 /** Declare that one business aggregate is given its own durable life. */
-export function birth<P extends Record<string, unknown>, F extends Record<string, Field>>(
+export function birth<F extends Record<string, Field>>(
   aggregate: AggregateHandle<string, F>,
-  spec: BusinessBirthSpec<P, F>,
-): BusinessBirthDecl<P, F>;
-export function birth<P extends Record<string, unknown>, F extends Record<string, Field>>(
+  spec: BusinessBirthSpec<F>,
+): BusinessBirthDecl<BusinessBirthPayload<F>, F>;
+export function birth<F extends Record<string, Field>>(
   recipeOrAggregate: BirthRecipe | AggregateHandle<string, F>,
-  spec?: BusinessBirthSpec<P, F>,
-): void | BusinessBirthDecl<P, F> {
+  spec?: BusinessBirthSpec<F>,
+): void | BusinessBirthDecl<BusinessBirthPayload<F>, F> {
   if (spec !== undefined) {
     const aggregate = recipeOrAggregate as AggregateHandle<string, F>;
     if (!aggregate || aggregate.__isAggregateHandle !== true) {
       throw new Error("birth(Aggregate, spec): the first argument must be an aggregate handle");
     }
-    if (!spec.payload || typeof (spec.payload as { safeParse?: unknown }).safeParse !== "function") {
-      throw new Error("birth(Aggregate, spec): spec.payload must be a z.object(...) schema");
+    const internalFields = new Set(aggregate.internalFields ?? []);
+    const facts = Object.entries(aggregate.fields as Record<string, Field>).filter(
+      ([name, field]) => field.isFromBirth === true && !internalFields.has(name),
+    );
+    if (facts.length === 0) {
+      throw new Error(
+        `birth(${aggregate.id}): no birth facts are declared — mark every required initial business field with .fromBirth()`,
+      );
+    }
+    const keyField = (aggregate.fields as Record<string, Field>)[spec.key];
+    if (keyField === undefined || keyField.isFromBirth !== true) {
+      throw new Error(`birth(${aggregate.id}): key '${String(spec.key)}' must be a declared .fromBirth() field`);
+    }
+    if (keyField.kind !== "string" && keyField.kind !== "enum" && keyField.kind !== "ref") {
+      throw new Error(
+        `birth(${aggregate.id}): key '${String(spec.key)}' must be a string-like business fact; got ${keyField.kind}`,
+      );
     }
+    const payloadSchema = z.object(Object.fromEntries(facts.map(([name, field]) => [name, field.zod])));
+    type Payload = BusinessBirthPayload<F>;
     return {
       __isBusinessBirth: true,
       aggregate,
-      payloadSchema: spec.payload,
-      key: spec.key,
-      plan: spec.plan,
+      payloadSchema,
+      key: (payload: Payload) => String(payload[spec.key]),
+      keyField: spec.key,
+      plan: (root: AggregateRef<F>, payload: Payload) => {
+        const writable = root as unknown as { set(field: string, value: unknown): unknown };
+        for (const [name] of facts) writable.set(name, payload[name as keyof Payload]);
+      },
       ...(spec.namespace !== undefined ? { namespace: spec.namespace } : {}),
-    };
+    } as BusinessBirthDecl<Payload, F>;
   }
   footprint.push(recipeOrAggregate as BirthRecipe);
 }

package/src/build_package.ts

@@ -69,18 +69,26 @@ import {
   type TrustSourceDecl,
   type TrustPolicyDecl,
 } from "./attested.js";
-import type { RelationTypeDecl } from "./relation_schema.js";
+import { isRelationTypeDecl, type RelationTypeDecl } from "./relation_schema.js";
 import { domainHash, emitManifestBytes } from "./manifest.js";
 import { collectValueObjectDescriptors } from "./value_object.js";
 import { emitUsd } from "./usd.js";
 import { expandCapabilityExports } from "./capability_exports.js";
 import { RelationTuple, relationTuplesByObject } from "./framework/relations.js";
+import { signerDelegationByUser } from "./framework/signing_identity.js";
 import { AuthProvider, setAuthProvider, authProvider } from "./framework/workspaces.js";
 import { parentAttestedBirthMarker } from "./births.js";
 import { discoverUnsanctionedEnsures, sanctioningEnsureDirective } from "./secondary_ensure.js";
 import { assertIdOfLint } from "./idof_lint.js";
 import { assertSurfacedResolvers } from "./surfaced_lint.js";
+import {
+  applyConflictPoliciesToAggregates,
+  applyConflictPolicyResolvers,
+  conflictPoliciesOf,
+} from "./conflicts.js";
 import { expandBusinessBirthExports } from "./business_birth.js";
+import { withOwnedCustodyExports } from "./framework/owned_custody.js";
+import { withBusinessCorrectionExports } from "./framework/business_corrections.js";
 import {
   reclaimChildAsAdminRequiresRetired,
   reclaimChildRequiresRetired,
@@ -125,7 +133,10 @@ export function contractsOf(mod: Mod): import("./contract.js").ContractHandle[]
 
 /** Collect every exported `Directive` ({id, plan, aggregateId} duck-type). */
 export function directivesOf(mod: Mod): Directive<any>[] {
-  const out: Directive<any>[] = [];
+  // One wire directive id is one law declaration. Merge seams may retain both an old tenant re-export and
+  // Nomos's presentation-internal wrapper under different JS keys; later wins so the framework wrapper
+  // controls codegen without duplicating the hashed/routable law.
+  const byId = new Map<string, Directive<any>>();
   for (const v of Object.values(mod)) {
     if (
       v &&
@@ -134,10 +145,10 @@ export function directivesOf(mod: Mod): Directive<any>[] {
       typeof (v as { plan?: unknown }).plan === "function" &&
       typeof (v as { aggregateId?: unknown }).aggregateId === "string"
     ) {
-      out.push(v as Directive<any>);
+      byId.set((v as { id: string }).id, v as Directive<any>);
     }
   }
-  return out;
+  return [...byId.values()];
 }
 
 /** The NAMED-KEYS spec for one engine domain (the serialization of `module(...)`). */
@@ -180,9 +191,13 @@ export interface DomainModuleSpec {
  * (an empty optional key must be ABSENT or every domain's canonical manifest hash drifts).
  */
 export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
+  const domain = spec.domain ?? spec.name;
+  const conflictPolicies = conflictPoliciesOf(spec.modules, domain);
   let merged: Mod = {};
   for (const m of spec.modules) merged = { ...merged, ...m };
   merged = expandBusinessBirthExports(merged, spec.domain ?? spec.name);
+  merged = withOwnedCustodyExports(merged);
+  merged = withBusinessCorrectionExports(merged);
   // `capability()` bundles expand into discoverable entries (the package plane's
   // merge point) — the quartet validation below then passes without re-exports.
   merged = expandCapabilityExports(merged);
@@ -207,7 +222,7 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
 
   const byId = new Map<string, AggregateHandle>();
   for (const a of [...aggregatesOf(merged), ...(spec.extraAggregates ?? [])]) byId.set(a.id, a);
-  const directives = directivesOf(merged);
+  const directives = applyConflictPolicyResolvers(directivesOf(merged), conflictPolicies);
   // RELATIONS AUTO-ENSURE + AUTO-COMPOSE (co2 recovery DX): a domain that USES relation law — declares a
   // relation schema, a `.requires(...)`-gated directive, or relate-family/signer directives ensuring
   // RelationTuple — needs the framework RelationTuple aggregate IN the schema on TWO counts: (1) the deploy
@@ -232,9 +247,20 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   const declaresPrivateRead = [...byId.values()].some(
     (a) => (a as { visibility?: unknown }).visibility !== undefined,
   );
+  const declaresOwnedRead = [...byId.values()].some(
+    (a) => (a as { audience?: { kind?: unknown } }).audience?.kind === "owned",
+  );
   if (declaresPrivateRead) {
-    if (!byId.has(AuthProvider.id)) byId.set(AuthProvider.id, AuthProvider);
-    if (!directives.some((d) => d.id === setAuthProvider.id)) directives.push(setAuthProvider);
+    if (!byId.has(AuthProvider.id)) {
+      byId.set(AuthProvider.id, declaresOwnedRead
+        ? { ...AuthProvider, businessBirthInternal: true } as AggregateHandle
+        : AuthProvider);
+    }
+    if (!directives.some((d) => d.id === setAuthProvider.id)) {
+      directives.push(declaresOwnedRead
+        ? { ...setAuthProvider, businessBirthInternal: true } as Directive<any>
+        : setAuthProvider);
+    }
   }
   const usesRelations =
     declaresPrivateRead ||
@@ -242,7 +268,9 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
     directives.some((d) => (d as { requiresRelationGate?: unknown }).requiresRelationGate !== undefined) ||
     directives.some((d) => d.aggregateId === RelationTuple.id);
   if (usesRelations && !byId.has(RelationTuple.id)) {
-    byId.set(RelationTuple.id, RelationTuple);
+    byId.set(RelationTuple.id, declaresOwnedRead
+      ? { ...RelationTuple, businessBirthInternal: true } as AggregateHandle
+      : RelationTuple);
   }
   // BIRTH-METER AUTO-ENSURE (metered birth, slice A — the same "discoverable without re-exports"
   // courtesy as RelationTuple): a domain declaring ≥1 `.births()` directive gets the meter aggregates
@@ -292,7 +320,11 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
     directives.push(dir);
     autoDeclaredEnsures.push(ty);
   }
-  const aggregates = [...byId.values()];
+  const aggregates = applyConflictPoliciesToAggregates(
+    [...byId.values()],
+    conflictPolicies,
+    domain,
+  );
   const directiveIds = new Set(directives.map((d) => d.id));
   for (const task of spec.impureCapabilities ?? []) {
     for (const directive of [task.obligation, task.complete, task.fail, task.block, task.deadLetter]) {
@@ -306,7 +338,11 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   }
   const readModels = spec.readModelAggregates ?? aggregates.map((a) => a.id);
 
-  const queries = [...(spec.queries ?? [])];
+  // As with directives, one stable query id is one declaration. This also makes an internal framework
+  // wrapper win over an older public re-export discovered earlier in the module bag.
+  const queryById = new Map<string, QueryDecl>();
+  for (const query of spec.queries ?? []) queryById.set(query.id, query);
+  const queries = [...queryById.values()];
   const counts = [...(spec.counts ?? [])];
   const spatials = [...(spec.spatials ?? [])];
   const deriveds = [...(spec.deriveds ?? [])];
@@ -316,7 +352,23 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   const mins = [...(spec.mins ?? [])];
   const maxes = [...(spec.maxes ?? [])];
   const workspaceTypes = [...(spec.workspaceTypes ?? [])];
-  const workspaceInvariants = [...(spec.workspaceInvariants ?? [])];
+  // Invariants exported by framework auto-composition must enter the manifest at this same seam; callers of
+  // composeDomainModule (tests and package builders alike) should not need to rediscover/rethread them.
+  const workspaceInvariantById = new Map<string, WorkspaceInvariantDecl>();
+  for (const value of Object.values(merged)) {
+    if (
+      value !== null &&
+      typeof value === "object" &&
+      (value as { __isWorkspaceInvariant?: unknown }).__isWorkspaceInvariant === true
+    ) {
+      const invariant = value as WorkspaceInvariantDecl;
+      workspaceInvariantById.set(invariant.id, invariant);
+    }
+  }
+  for (const invariant of spec.workspaceInvariants ?? []) {
+    workspaceInvariantById.set(invariant.id, invariant);
+  }
+  const workspaceInvariants = [...workspaceInvariantById.values()];
   if (declaresBirth) {
     const haveInvariant = new Set(workspaceInvariants.map((w) => w.id));
     for (const lifecycle of [
@@ -343,12 +395,30 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   if (declaresBirth) {
     const haveQuery = new Set(queries.map((q) => q.id));
     for (const q of BIRTH_FRAMEWORK_QUERIES) {
-      if (!haveQuery.has(q.id)) queries.push(q);
+      if (!haveQuery.has(q.id)) {
+        queries.push({ ...q, businessBirthInternal: true } as QueryDecl);
+      }
     }
     // The inheritance read (`.reads("authProvider")` on birthHome) routes like any declared query.
     if (!haveQuery.has(authProvider.id)) queries.push(authProvider);
+    // The client's private birth ceremony checks the actor's delegation before creating it. Carry the
+    // structural read in certified routing law for every `.births()` domain, but keep it off tenant codegen.
+    if (!haveQuery.has(signerDelegationByUser.id)) {
+      const internalDelegationQuery: QueryDecl & { readonly businessBirthInternal: true } = {
+        ...signerDelegationByUser,
+        businessBirthInternal: true,
+      };
+      queries.push(internalDelegationQuery);
+    }
+  }
+  const relationTypeByKey = new Map<string, RelationTypeDecl>();
+  for (const value of Object.values(merged)) {
+    if (isRelationTypeDecl(value)) relationTypeByKey.set(`${value.global === true ? "global" : "local"}:${value.type}`, value);
+  }
+  for (const value of spec.relationTypes ?? []) {
+    relationTypeByKey.set(`${value.global === true ? "global" : "local"}:${value.type}`, value);
   }
-  const relationTypes = [...(spec.relationTypes ?? [])];
+  const relationTypes = [...relationTypeByKey.values()];
   // RELATION-USING LAW AUTO-COMPOSES ITS AUDIT READ (co2 recovery DX — same idiom as the meter
   // queries above): a domain that declares relation law (a relation schema, a `.requires(...)` gated
   // directive, or relate-family/signer directives ensuring RelationTuple) gets the framework's
@@ -363,10 +433,14 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   // Auth-provider auto-compose (sibling of the RelationTuple query carry): a private package gets the
   // `authProvider` read so the workspace can surface its declared verifier.
   if (declaresPrivateRead && !queries.some((q) => q.id === authProvider.id)) {
-    queries.push(authProvider);
+    queries.push(declaresOwnedRead
+      ? { ...authProvider, businessBirthInternal: true } as QueryDecl
+      : authProvider);
   }
   if (usesRelations && !queries.some((q) => q.id === relationTuplesByObject.id)) {
-    queries.push(relationTuplesByObject);
+    queries.push(declaresOwnedRead
+      ? { ...relationTuplesByObject, businessBirthInternal: true } as QueryDecl
+      : relationTuplesByObject);
   }
   // FIRST-CLASS VALUE OBJECTS (value_object.ts): the deduped, sorted descriptors of every
   // named VO the domain's aggregates carry (transitive nested VOs included) — the input to
@@ -492,10 +566,11 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   // closed is dissolved by construction. See `dsl/src/framework/signing_identity.ts::enrollSigner`.)
 
   // THE SURFACED-RESOLVER LINT (surfaced_lint.ts — the fail-closed teeth): every
-  // `.merge(Surfaced(...))` field must have EXACTLY ONE `.resolves()` directive, whose plan
+  // Surfaced field must have EXACTLY ONE designated merge directive, whose plan
   // provably set()s the field from a payload field. Returns the resolver bindings the typed
-  // `resolve…` helper codegen consumes. Compile-time only — no manifest/wire/hash effect;
-  // a Surfaced-free domain runs zero checks (byte-identical).
+  // chained conflict-reference codegen consumes AND the canonical manifest records as the
+  // hash-bearing conflictResolution contract. A Surfaced-free domain runs zero checks and is
+  // byte-identical; a resolver policy deliberately becomes part of business law.
   const surfacedResolvers = assertSurfacedResolvers(
     aggregates,
     directives,
@@ -512,8 +587,9 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
     // ROLE SUGAR codegen metadata — NOT law (not hashed): drives the `canEdit<Agg>`/`canView<Agg>`
     // UI-hint helpers. Omit-when-empty (a role-free domain is byte-identical).
     ...(roles.length > 0 ? { roles } : {}),
-    // SURFACED RESOLVER BINDINGS — NOT law (not hashed, like `roles`): drives the generated
-    // typed `resolve…` helpers + the `pendingConflicts` accessor. Omit-when-empty (era rule).
+    // SURFACED RESOLVER BINDINGS — the aggregate/field/directive tuple is lowered into the
+    // hash-bearing manifest; payload-field tracing also drives generated typed references.
+    // Omit-when-empty because ordinary domains need no resolver metadata.
     ...(surfacedResolvers.length > 0 ? { surfacedResolvers } : {}),
     ...(queries.length > 0 ? { queries } : {}),
     ...(counts.length > 0 ? { counts } : {}),