@githolon/dsl 0.100.6 → 0.101.1

package/dart_types/lib/src/surfaced.dart

@@ -82,6 +82,13 @@ sealed class SurfacedValue<T> {
     if (json is Map && json.containsKey(surfacedEnvelopeKey)) {
       final env =
           (json[surfacedEnvelopeKey] as Map).cast<String, dynamic>();
+      if (env['status'] == 'evolutionRequired') {
+        return SurfacedEvolutionRequired<T>(
+          targetSchema: env['targetSchema'] as String? ?? '',
+          evolution: ((env['evolution'] as Map?) ?? const {})
+              .cast<String, dynamic>(),
+        );
+      }
       final rawPending = (env['pending'] as List? ?? const []);
       return SurfacedPending<T>(List.unmodifiable(rawPending.map((o) =>
           SurfacedObservation<T>.fromJson(
@@ -141,29 +148,68 @@ class PendingConflictRow {
   /// The competing observations (2+, bounded) — value/author/occurredAt.
   final List<SurfacedObservation<Object?>> observations;
 
+  /// `ready` or `evolutionRequired`. Only ready rows carry typed observations.
+  final String status;
+
+  /// The current stable field-contract identity the merge result must target.
+  final String targetSchema;
+
+  /// Diagnostic evolution requirement for a mixed-schema pending set.
+  final Map<String, dynamic>? evolution;
+
+  /// Opaque framework identity of exactly these pending observations.
+  final String snapshot;
+
   const PendingConflictRow({
     required this.aggregateType,
     required this.aggregateId,
     required this.field,
     required this.observations,
+    required this.status,
+    required this.targetSchema,
+    this.evolution,
+    required this.snapshot,
   });
 
-  factory PendingConflictRow.fromJson(Map<String, dynamic> json) =>
-      PendingConflictRow(
+  factory PendingConflictRow.fromJson(Map<String, dynamic> json) {
+    final snapshot = json['snapshot'];
+    if (snapshot is! String || snapshot.isEmpty) {
+      throw StateError(
+          'conflicts need a Nomos runtime with immutable conflict snapshots; upgrade Nomos before merging');
+    }
+    return PendingConflictRow(
         aggregateType: json['aggregateType'] as String,
         aggregateId: json['aggregateId'] as String,
         field: json['field'] as String,
+        status: json['status'] as String? ?? 'evolutionRequired',
+        targetSchema: json['targetSchema'] as String? ?? '',
+        evolution: (json['evolution'] as Map?)?.cast<String, dynamic>(),
+        snapshot: snapshot,
         observations: List.unmodifiable(
             (json['observations'] as List? ?? const []).map((o) =>
                 SurfacedObservation<Object?>.fromJson(
                     (o as Map).cast<String, dynamic>(), (v) => v))),
       );
+  }
 
   @override
   String toString() =>
       'PendingConflictRow($aggregateType:$aggregateId.$field, ${observations.length} observations)';
 }
 
+/// A Surfaced value retained safely but not yet expressible as the current generated
+/// type. The business values remain inside Nomos until a declared deterministic
+/// evolution projects them into [targetSchema].
+final class SurfacedEvolutionRequired<T> extends SurfacedValue<T> {
+  final String targetSchema;
+  final Map<String, dynamic> evolution;
+
+  const SurfacedEvolutionRequired({
+    required this.targetSchema,
+    required this.evolution,
+  });
+}
+
 /// The steady state: the field folded to one value (never conflicted, or a
 /// resolution write superseded the pending set).
 final class SurfacedResolved<T> extends SurfacedValue<T> {

package/dart_types/lib/src/wire.dart

@@ -43,7 +43,9 @@ class Hlc {
   factory Hlc.fromJson(Map<String, dynamic> json) => Hlc(
         physical: (json['physical'] as num).toInt(),
         logical: (json['logical'] as num).toInt(),
-        replica: (json['replica'] as num).toInt(),
+        replica: json['replica'] is String
+            ? int.parse(json['replica'] as String)
+            : (json['replica'] as num).toInt(),
       );
 
   Map<String, dynamic> toJson() => {

package/dart_types/pubspec.yaml

@@ -11,7 +11,7 @@ description: >-
   Pure kernel wire/data types for Nomos Dart frontends — no transport, no bridge,
   no runtime. The hand-written serde-JSON-compatible types plus the offer codec,
   reactive read engine, schema validation, and data-only error/trace types.
-version: 0.6.0
+version: 0.7.0
 
 environment:
   sdk: ^3.5.0

package/dart_types/test/surfaced_test.dart

@@ -46,6 +46,25 @@ void main() {
       expect(v, const SurfacedResolved<String>('t'));
     });
 
+    test('mixed-schema values stay withheld until field evolution is available', () {
+      final v = SurfacedValue<String>.fromJson({
+        '__surfaced': {
+          'status': 'evolutionRequired',
+          'targetSchema': 'title-v2',
+          'evolution': {
+            'sourceSchemas': ['title-v1'],
+            'authoredUnder': ['law-v1'],
+          },
+        },
+      }, (_) => throw StateError('must not cast an old value to the current type'));
+      expect(v, isA<SurfacedEvolutionRequired<String>>());
+      final blocked = v as SurfacedEvolutionRequired<String>;
+      expect(blocked.targetSchema, 'title-v2');
+      expect(blocked.evolution['sourceSchemas'], ['title-v1']);
+      expect(blocked.isPending, isFalse);
+      expect(blocked.valueOrNull, isNull);
+    });
+
     test('value equality holds on both arms', () {
       expect(const SurfacedResolved<String>('x'), const SurfacedResolved<String>('x'));
       final p1 = SurfacedValue<String>.fromJson({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.100.6",
+  "version": "0.101.1",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/activity.ts

@@ -1,5 +1,6 @@
-// NOMOS — DIRECTIVE ACTIVITY DESCRIPTORS (architecture/activity_descriptors.md). A directive OPT-IN declares
-// its own user-facing activity metadata, so a client can fold typed activity rows straight from the intent
+// NOMOS — DIRECTIVE ACTIVITY DESCRIPTORS (architecture/activity_descriptors.md). Every public business
+// directive receives a generated accountable baseline; `.activity(...)` can enrich its user-facing metadata,
+// so a client can fold typed activity rows straight from the intent
 // log — no string-enricher guessing meaning beside the truth. The kernel/ledger stays the audit truth; this
 // is a pure CLIENT-SIDE human projection, declared where the event semantics live.
 //
@@ -13,8 +14,7 @@
 //       params: { siteName: "name" },                // display value ← payload field path
 //     })
 //
-// NON-LAW, additive metadata (same class as `.doc()`): a directive that never calls `.activity()` is
-// byte-identical in the canonical manifest.
+// NON-LAW, additive metadata (same class as `.doc()`): custom prose never changes the canonical law.
 import { z } from "zod";
 import type { AggregateHandle } from "./aggregate.js";
 import { isContractHandle, type ContractHandle } from "./contract.js";
@@ -77,6 +77,45 @@ export function activityKey(kind: string, slot: "title" | "message"): string {
   return `activity.${kind}.${slot}`;
 }
 
+/**
+ * The framework-owned baseline story for a business directive that does not add a richer
+ * `.activity(...)` declaration. Accountability is not opt-in: every public business verb must remain
+ * visible in `activityLog()` / `describe()`. The fallback deliberately uses only declaration metadata
+ * and the verified author/time already carried by the intent, so it never guesses payload meaning.
+ *
+ * `.activity(...)` remains the optional polish layer for domain-specific prose, parameters, icons and
+ * navigation. It replaces this descriptor for that directive; it no longer decides whether the change
+ * exists in the human story at all.
+ */
+export function defaultActivityDescriptor(args: {
+  readonly domain: string;
+  readonly directiveId: string;
+  readonly description?: string;
+  readonly refs?: ActivityDescriptor["refs"];
+}): ActivityDescriptor {
+  const title = args.directiveId
+    .replace(/[_-]+/g, " ")
+    .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+    .replace(/\s+/g, " ")
+    .trim()
+    .replace(/^./, (c) => c.toUpperCase());
+  const description = args.description?.trim();
+  const kind = `${args.domain}.${args.directiveId}`;
+  return {
+    kind,
+    title: title || args.directiveId,
+    message: description && description.length > 0
+      ? `{actor}: ${description}`
+      : `{actor} performed “${title || args.directiveId}”`,
+    category: args.domain,
+    severity: "info",
+    refs: args.refs ?? [],
+    params: [],
+    titleKey: activityKey(kind, "title"),
+    messageKey: activityKey(kind, "message"),
+  };
+}
+
 /** Interpolate `{name}` placeholders in a template from `vars` (a missing var renders as the empty string —
  *  the compile-time validator already guarantees every placeholder is declared, so this is defensive only).
  *  The ONE render helper shared by the TS + Dart renderers (each reimplements the same trivial substitution). */

package/src/aggregate.ts

@@ -14,7 +14,7 @@
  * string: a typo'd handle is a compile error.
  */
 import type { Field } from "./fields.js";
-import { admitsNull } from "./fields.js";
+import { admitsNull, attributionField, t } from "./fields.js";
 import { satisfiesContract, type ContractHandle } from "./contract.js";
 
 /**
@@ -63,8 +63,9 @@ const READ_CAP_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$/;
  *   • `public`        — anyone reads (plaintext). The deliberate exception.
  *   • `readableBy`    — holders of `cap` read (gate-enforced). Sugar over the shipped read-visibility
  *                       (`requires(cap)`); per-field `.secret()` escalates to team-E2E.
- *   • `owned`         — the owner (+ per-record grantees) read; owner = the verified authoring principal,
- *                       stamped into the `ownerField` (default `__owner`); operator-blind by definition.
+ *   • `owned`         — the owner reads; owner = the verified authoring principal, stamped into the
+ *                       obscure framework field. The read rule is record-grained so later sharing can
+ *                       extend one record without changing this declaration; content is operator-blind.
  * `.public()`/`.readableBy(cap)`/`.owned()` are the fluent declarations on the aggregate handle.
  */
 export type Audience =
@@ -72,9 +73,47 @@ export type Audience =
   | { readonly kind: "readableBy"; readonly cap: string }
   | { readonly kind: "owned"; readonly ownerField: string };
 
-/** The framework-reserved OWNERSHIP field (`.owned()`) — the verified authoring principal, kernel-style
- *  like `__type`/`__id`. The admission gate enforces it is never set to a non-author (slice 0). */
-export const OWNER_FIELD = "__owner";
+/**
+ * Framework-private names used to lower `.owned()`. They are deliberately obscure: a business model is
+ * unlikely to want either spelling accidentally. If it does, `owned()` fails loudly rather than silently
+ * capturing the tenant's concept. They remain constants (rather than magic strings spread through codegen,
+ * USD and the gate) so the public declaration and every enforcement lane cannot drift.
+ */
+export const OWNER_FIELD = "__nomos_owner_principal_7c1f5e";
+export const OWNED_READ_RELATION = "nomos_internal_owned_reader_7c1f5e";
+export const OWNED_KEY_RELATION = "nomos_internal_owned_device_key_7c1f5e";
+export const OWNED_KEY_PAYLOAD_FIELD = "__nomos_owned_device_key_subject_7c1f5e";
+export const OWNED_CUSTODY_PAYLOAD_FIELD = "__nomos_owned_device_custody_7c1f5e";
+/** Framework-carried record identities reserved by the client before an owned create is planned.
+ *  The tenant payload never sees this field; replay consumes the same typed id deterministically. */
+export const OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD = "__nomos_owned_pre_minted_records_7c1f5e";
+export const BUSINESS_BIRTH_SEED_PAYLOAD_FIELD = "__nomos_birth_seed_payload_7c1f5e";
+
+/** Framework-private, deterministic relation object that seats one active `.owned()` device per principal. */
+export function ownedKeyObject(principal: string): string {
+  let hex = "";
+  // Pure UTF-8 encoding because the sealed QuickJS plan sandbox intentionally exposes no ambient
+  // TextEncoder. This matches Rust's `principal.as_bytes()` and browser TextEncoder for valid strings.
+  for (let i = 0; i < principal.length; i += 1) {
+    let cp = principal.charCodeAt(i);
+    if (cp >= 0xd800 && cp <= 0xdbff && i + 1 < principal.length) {
+      const low = principal.charCodeAt(i + 1);
+      if (low >= 0xdc00 && low <= 0xdfff) {
+        cp = 0x10000 + ((cp - 0xd800) << 10) + (low - 0xdc00);
+        i += 1;
+      }
+    }
+    const bytes = cp <= 0x7f
+      ? [cp]
+      : cp <= 0x7ff
+        ? [0xc0 | (cp >> 6), 0x80 | (cp & 0x3f)]
+        : cp <= 0xffff
+          ? [0xe0 | (cp >> 12), 0x80 | ((cp >> 6) & 0x3f), 0x80 | (cp & 0x3f)]
+          : [0xf0 | (cp >> 18), 0x80 | ((cp >> 12) & 0x3f), 0x80 | ((cp >> 6) & 0x3f), 0x80 | (cp & 0x3f)];
+    for (const byte of bytes) hex += byte.toString(16).padStart(2, "0");
+  }
+  return `nomos-owned-principal:${hex || "00"}`;
+}
 
 /**
  * Declare an aggregate PRIVATE behind a capability — the value for
@@ -248,15 +287,20 @@ export interface AggregateHandle<
    * otherwise (era-safe). Indexing/grouping/summing is restricted to these on an owned/secret aggregate.
    */
   readonly metaFields?: string[];
+  /** Framework-managed stored fields that are law/projection inputs but are intentionally absent from the
+   *  generated business model. Present only for synthesized surfaces such as `.owned()`; a tenant collision
+   *  is refused before this list can be created. */
+  readonly internalFields?: readonly string[];
 }
 
 /** The fluent AUDIENCE declarations returned by {@link aggregate} (secure-by-default). Each returns a
  *  copy of the handle with the read audience set; you call exactly one at the declaration site. */
-/** A settled aggregate handle that STILL accepts the cosmetic `.dartName()` (so it chains after a
- *  terminal audience declaration — `aggregate(...).public().dartName("Site")`), but not another
- *  audience choice. `.dartName()` itself returns the full fluent surface (so either order works). */
+/** A settled aggregate handle. Audience is terminal, but the two audience-independent declarations
+ *  remain composable in either order: `.public().dartName("Site").implements(Contract)` and
+ *  `.implements(Contract).dartName("Site").public()` mean the same thing. */
 export type NameableHandle<Id extends string, F extends Record<string, Field>> = AggregateHandle<Id, F> & {
-  dartName(name: string): AggregateHandle<Id, F> & AudienceMethods<Id, F>;
+  implements(contract: ContractHandle): NameableHandle<Id, F>;
+  dartName(name: string): NameableHandle<Id, F>;
 };
 
 export interface AudienceMethods<Id extends string, F extends Record<string, Field>> {
@@ -264,9 +308,9 @@ export interface AudienceMethods<Id extends string, F extends Record<string, Fie
   public(): NameableHandle<Id, F>;
   /** Holders of `capability` may read (gate-enforced) — sugar over `requires(cap)`. */
   readableBy(capability: string): NameableHandle<Id, F>;
-  /** The owner (+ per-record grantees) read; owner = the verified author, stamped into `ownerField`
-   *  (default `__owner`); operator-blind. NOTE: full owned read-scoping + E2E land in the next slice. */
-  owned(ownerField?: string): NameableHandle<Id, F>;
+  /** The verified creator owns this record. Nomos stamps ownership, seats its per-record read relation and
+   *  encrypts every non-`.meta()` content field; tenant code never names the framework field/relation. */
+  owned(): NameableHandle<Id, F>;
   /** DOMAIN CONTRACTS: assert this aggregate satisfies `contract`'s public shape (compile-checked — a
    *  mismatch throws naming the field). Chainable; records the contract so cross-domain refs can target it. */
   implements(contract: ContractHandle): AggregateHandle<Id, F> & AudienceMethods<Id, F>;
@@ -285,6 +329,19 @@ export function aggregate<const Id extends string, F extends Record<string, Fiel
   fields: F,
   opts?: { invariant?: AggregateInvariantFn; invariantDeclassify?: string; cap?: number; visibility?: ReadVisibility; global?: boolean; attributed?: boolean },
 ): AggregateHandle<Id, F> & AudienceMethods<Id, F> {
+  for (const reserved of [
+    OWNER_FIELD,
+    OWNED_KEY_PAYLOAD_FIELD,
+    OWNED_CUSTODY_PAYLOAD_FIELD,
+    OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD,
+    BUSINESS_BIRTH_SEED_PAYLOAD_FIELD,
+  ]) {
+    if (!Object.prototype.hasOwnProperty.call(fields, reserved)) continue;
+    throw new Error(
+      `aggregate '${id}': field '${reserved}' is reserved by Nomos ownership. Sorry mate, that ` +
+        `concept is already taken by the framework; give the business field a different name.`,
+    );
+  }
   const { stored, hasMany } = partitionFields(fields);
   // FOREIGN-REF SIBLING CHECK (pain point #4): a `t.foreignRef({ workspace, target })` field names a
   // SIBLING string field (`workspaceField`) that holds the foreign workspace id — the target workspace is
@@ -336,10 +393,10 @@ export function aggregate<const Id extends string, F extends Record<string, Fiel
     }
   }
   // SURFACED MERGE CONFLICTS (architecture/surfaced_merge_conflict.md): `.merge(Surfaced(inner))`
-  // is v1-scoped to Lww-class SCALAR fields — the pending set holds competing scalar values a
-  // human picks between. The factory already refuses a non-Lww-class INNER; this refuses the
+  // is v1-scoped to scalar fields — the pending set holds competing business versions until a
+  // resolver produces one merged result. The factory already refuses a non-scalar INNER; this refuses the
   // wrapper on a field whose VALUE isn't a wholesale-replace scalar (a set/map/counter/position
-  // field's value space has no "pick one of two scalars" meaning) and on a null-admitting field
+  // field's value space already has a compositional merge law) and on a null-admitting field
   // (the tri-state NomosSlot and the pending envelope would fight over the same read surface).
   for (const [name, f] of Object.entries(stored)) {
     const field = f as Field;
@@ -368,7 +425,7 @@ export function aggregate<const Id extends string, F extends Record<string, Fiel
   // can be attributed"). Each attributed field's wire driver is wrapped
   // `{"Attributed": <inner>}` — the law-era mechanism (old kernels refuse it cleanly;
   // unattributed fields/domains stay byte-identical).
-  const LWW_CLASS_KINDS = new Set(["Lww", "LwwCausal", "LwwBy"]);
+  const LWW_CLASS_KINDS = new Set(["FirstWriterWins", "Lww", "LwwCausal", "LwwBy"]);
   const attributableDriver = (f: Field) => LWW_CLASS_KINDS.has((f.driver as { kind?: string }).kind ?? "");
   const attributableKind = (f: Field) =>
     f.kind !== "set" && f.kind !== "map" && f.kind !== "counter" && f.kind !== "position";
@@ -382,7 +439,7 @@ export function aggregate<const Id extends string, F extends Record<string, Fiel
     }
     if (!attributableDriver(field) || !attributableKind(field)) {
       throw new Error(
-        `aggregate '${id}': field '${name}' is .attributed() but attribution needs an Lww-class SCALAR (Lww/LwwCausal/LwwBy) — a '${field.kind}' field under '${(field.driver as { kind?: string }).kind}' has no single last author`,
+        `aggregate '${id}': field '${name}' is .attributed() but attribution needs a wholesale scalar driver (FirstWriterWins/Lww/LwwCausal/LwwBy) — a '${field.kind}' field under '${(field.driver as { kind?: string }).kind}' has no single author`,
       );
     }
   }
@@ -483,8 +540,58 @@ export function aggregate<const Id extends string, F extends Record<string, Fiel
     visibility: ReadVisibility | undefined,
     contracts: readonly string[] = [],
     dartNameDecl: string | undefined = undefined,
-  ): AggregateHandle<Id, F> & AudienceMethods<Id, F> => ({
+  ): AggregateHandle<Id, F> & AudienceMethods<Id, F> => {
+    const owned = audience?.kind === "owned";
+    let ownedFields: Record<string, Field> | undefined;
+    let ownedEncrypted: string[] | undefined;
+    let ownedInvariant: AggregateInvariantFn | undefined;
+    if (owned) {
+      ownedFields = { ...stored };
+      ownedEncrypted = [];
+      for (const [name, field] of Object.entries(stored)) {
+        if (field.isMeta === true) {
+          if (field.isEncrypted === true) {
+            throw new Error(
+              `aggregate '${id}': field '${name}' is both .meta() and .encrypted(); metadata is the ` +
+                `explicit plaintext exception on .owned() data, so choose one.`,
+            );
+          }
+          continue;
+        }
+        if (!isLwwClass(field.driver)) {
+          throw new Error(
+            `aggregate '${id}': .owned() encrypts content field '${name}', but its merge driver is not ` +
+              `Lww-class. Mark it .meta() to make the value deliberately plaintext, or model the ` +
+              `encrypted value as a scalar until encrypted collection merges are supported.`,
+          );
+        }
+        ownedFields[name] = field.isEncrypted === true ? field : field.encrypted();
+        ownedEncrypted.push(name);
+      }
+      // The owner is framework state, not a business field. First-writer-wins makes ownership immutable;
+      // `.fromBirth()` plus the composed invariant means even a hand-authored create cannot omit it.
+      ownedFields[OWNER_FIELD] = attributionField(t.string().fromBirth());
+      ownedEncrypted.sort();
+      ownedInvariant = (snapshot) => {
+        const owner = snapshot[OWNER_FIELD];
+        if (typeof owner !== "string" || owner.length === 0) {
+          return { reject: `${id} is .owned() — Nomos must stamp its verified creator` };
+        }
+        return composedInvariant !== undefined ? composedInvariant(snapshot) : { accept: true };
+      };
+    }
+
+    return ({
     ...base,
+    ...(ownedFields !== undefined ? { fields: ownedFields } : {}),
+    ...(ownedEncrypted !== undefined ? { encryptedFields: ownedEncrypted } : {}),
+    ...(owned ? {
+      hasInvariant: true as const,
+      invariant: ownedInvariant!,
+      fromBirthFields: [...fromBirthFields, OWNER_FIELD].sort(),
+      internalFields: [OWNER_FIELD],
+      ...(userInvariant === undefined ? { invariantValueFree: true as const } : {}),
+    } : {}),
     ...(audience !== undefined ? { audience } : {}),
     ...(visibility !== undefined ? { visibility } : {}),
     ...(contracts.length > 0 ? { implementsContracts: contracts } : {}),
@@ -494,7 +601,9 @@ export function aggregate<const Id extends string, F extends Record<string, Fiel
       const v = requires(cap); // validates the capability name
       return build({ kind: "readableBy", cap: v.requires }, v, contracts, dartNameDecl);
     },
-    owned: (ownerField: string = OWNER_FIELD) => build({ kind: "owned", ownerField }, undefined, contracts, dartNameDecl),
+    owned: () => {
+      return build({ kind: "owned", ownerField: OWNER_FIELD }, requires(OWNED_READ_RELATION), contracts, dartNameDecl);
+    },
     // DOMAIN CONTRACTS: assert this aggregate satisfies `contractHandle`'s public shape — compile-checked
     // NOW (a mismatch throws a typed error naming the field). Records the contract so cross-domain refs may
     // target it. Chainable (`.implements(A).implements(B)`); the aggregate keeps its concrete fields.
@@ -513,7 +622,8 @@ export function aggregate<const Id extends string, F extends Record<string, Fiel
       }
       return build(audience, visibility, contracts, name);
     },
-  });
+    }) as unknown as AggregateHandle<Id, F> & AudienceMethods<Id, F>;
+  };
 
   // Legacy `{ visibility: requires(cap) }` IS `readableBy(cap)` — carry both so existing law is unchanged.
   const initialAudience: Audience | undefined =
@@ -523,7 +633,7 @@ export function aggregate<const Id extends string, F extends Record<string, Fiel
 
 /** Lww-class driver: a wholesale-replace merge (`Lww`, or `MapOf` wrapping an Lww-class inner). */
 function isLwwClass(driver: { kind: string; inner?: { kind: string } }): boolean {
-  if (driver.kind === "Lww") return true;
+  if (driver.kind === "FirstWriterWins" || driver.kind === "Lww") return true;
   if (driver.kind === "MapOf" && driver.inner) return isLwwClass(driver.inner as { kind: string });
   return false;
 }

package/src/attested_core.ts

@@ -350,7 +350,7 @@ export const NomosSourceFrontier = aggregate("NomosSourceFrontier", {
   maxAttestedAtSeen: t.int().merge(Lww),
   /** The source head oid at the highest-seen position (diagnostics/audit). */
   headAtMax: t.string().merge(Lww),
-});
+}).public();
 
 
 // ── the ensure() hook — breaks the read.ts → authoring.ts module-init cycle ────────────────────

package/src/authoring.ts

@@ -23,22 +23,64 @@
  * resets it before the plan and drains it after, merging the authored ops with whatever the plan returns.
  * So a `.plan` that fluently authors and `return []`s still emits its events — the recorded ops are real.
  */
-import type { AggregateHandle } from "./aggregate.js";
+import {
+  OWNED_KEY_RELATION,
+  OWNED_READ_RELATION,
+  ownedKeyObject,
+  type AggregateHandle,
+} from "./aggregate.js";
 import type { Field, FieldValue } from "./fields.js";
 import type { AcceptedValue, FieldOp, PlannedOp, PlannedEventMarker } from "./ops.js";
-import { endorsementOf } from "./principal_evidence.js";
-import { __qualifyAggregateType } from "./framework/relations.js";
+import { endorsementOf, principalEvidence } from "./principal_evidence.js";
+import type { PrincipalEvidence } from "./principal_evidence.js";
+import type { Ports } from "./ctx.js";
+import { __qualifyAggregateType, writeTuple } from "./framework/relations.js";
 import { __registerEnsure } from "./attested_core.js";
 
 // ── the per-dispatch authoring sink — library state the engine never sees (NOT a side channel out of
 //    the sandbox; it is internal to the directive runtime, drained synchronously by `executeDirectiveToIntent`). ──
 let sink: PlannedOp[] = [];
+let authoringContext: {
+  principal: PrincipalEvidence;
+  principalRaw: string;
+  stamp: string;
+  ownedKeySubject: string;
+  ownedCustody?: string;
+  preMintedRecords: { type: string; id: string }[];
+} | undefined;
 /** Clear the sink before a plan runs (called by `executeDirectiveToIntent`). */
-export function __resetAuthoring(): void {
+export function __resetAuthoring(
+  ctx?: Partial<Pick<Ports, "principal">>,
+  stamp = "0",
+  ownedKeySubject = `key:${"0".repeat(64)}`,
+  ownedCustody: string | null = "{\"nomosProbe\":true}",
+  preMintedRecords: readonly { type: string; id: string }[] = [],
+): void {
   sink = [];
+  // Compile/proof lanes call the internal reset without live ports; give those deterministic probe evidence
+  // so discovery sees the exact synthesized owner + relation writes. The real authoring lane always passes
+  // its captured ports below, and the executor binds that value to the verified signer before admission.
+  const principalRaw = typeof ctx?.principal === "function"
+    ? endorsementOf(ctx.principal().asAttribution())?.principal ?? ""
+    : "user:nomos-probe";
+  authoringContext = {
+    principal: principalEvidence(principalRaw),
+    principalRaw,
+    stamp,
+    ownedKeySubject,
+    ...(ownedCustody !== null ? { ownedCustody } : {}),
+    preMintedRecords: preMintedRecords.map((record) => ({ ...record })),
+  };
 }
 /** Take + clear the ops authored via the fluent surface during a plan (called by `executeDirectiveToIntent`). */
 export function __drainAuthoring(): PlannedOp[] {
+  if (authoringContext !== undefined && authoringContext.preMintedRecords.length > 0) {
+    const remaining = authoringContext.preMintedRecords.map((record) => `${record.type}:${record.id}`).join(", ");
+    throw new Error(
+      `Nomos reserved owned record identity ${remaining}, but the law did not consume it. ` +
+        `The generated client and installed law disagree about this create; recompile them together.`,
+    );
+  }
   const s = sink;
   sink = [];
   return s;
@@ -52,6 +94,28 @@ function mint(typeTag: string): string {
   return (globalThis as unknown as { nomos: NomosMint }).nomos.mint(typeTag);
 }
 
+/** Consume the generated client's hidden, kernel-minted identity for an owned create. Keeping this in
+ *  the plan input makes replay reproduce the exact id while letting the client bind ciphertext to the
+ *  record before dispatch. A mismatched type is a loud framework/version error, never a reroute. */
+function recordIdentity(typeTag: string): string {
+  const queued = authoringContext?.preMintedRecords;
+  if (queued === undefined || queued.length === 0) return mint(typeTag);
+  const record = queued.shift()!;
+  if (record.type !== typeTag) {
+    throw new Error(
+      `Nomos reserved an owned '${record.type}' identity, but the law tried to create '${typeTag}'. ` +
+        `The generated client and installed law disagree; recompile them together.`,
+    );
+  }
+  if (!record.id.startsWith(`${typeTag}_`)) {
+    throw new Error(
+      `Nomos reserved owned '${typeTag}' identity '${record.id}', but that id belongs to another type. ` +
+        `The generated client and installed law disagree; recompile them together.`,
+    );
+  }
+  return record.id;
+}
+
 /**
  * `true` iff `F` is the WIDE, un-inferred field map (`Record<string, Field>`) — i.e. the ref
  * came from an untyped handle. Used to DEGRADE the typed member signatures back to today's
@@ -197,7 +261,54 @@ export function create<Id extends string, F extends Record<string, Field>>(
 ): AggregateRef<F> {
   // READ-PROJECTION NAMESPACING: mint under the QUALIFIED type tag — the kernel's id-mint gate
   // verifies a Create's id was minted for EXACTLY the declared (qualified) `__type`.
-  return new Ref(agg, mint(__qualifyAggregateType(agg.id)), "creates") as unknown as AggregateRef<F>;
+  const id = recordIdentity(__qualifyAggregateType(agg.id));
+  const ref = new Ref(agg, id, "creates");
+  seatOwned(ref, agg, "create");
+  return ref as unknown as AggregateRef<F>;
+}
+
+/** Lower the framework-owned half of an owned birth. `create()` and `ensure()` differ only in how the
+ *  record id is chosen; when either one births a record, ownership and both seats must be byte-identical.
+ *  Re-ensuring an existing owned record reasserts the same immutable owner/seat and is admitted only for
+ *  that owner on the already-approved device. The executor judges existence and rejects any change. */
+function seatOwned<Id extends string, F extends Record<string, Field>>(
+  ref: Ref,
+  agg: AggregateHandle<Id, F>,
+  operation: "create" | "ensure",
+): void {
+  if (agg.audience?.kind === "owned") {
+    if (authoringContext === undefined) {
+      throw new Error(
+        `${operation}(${agg.id}): .owned() needs Nomos's verified authoring context. Run the plan through ` +
+          `the Nomos authoring lane; tenant code must never supply an owner.`,
+      );
+    }
+    const { principal, principalRaw, stamp, ownedKeySubject, ownedCustody } = authoringContext;
+    // Ownership and its per-record read seat are part of the SAME intent as the business create. The owner
+    // is opaque evidence, not a payload string: the gate binds it to the verified author on every lane.
+    ref.set(agg.audience.ownerField, principal.asAttribution());
+    sink.push(
+      ...writeTuple({
+        object: `${__qualifyAggregateType(agg.id)}:${ref.__id}`,
+        relation: OWNED_READ_RELATION,
+        subject: principal.asAuthoritySubject(
+          "Nomos seats the verified creator as the initial reader of their owned record",
+        ),
+        grantedBy: principal.asAttribution(),
+        grantedAt: stamp,
+      }),
+      ...(ownedCustody === undefined
+        ? []
+        : writeTuple({
+            object: ownedKeyObject(principalRaw),
+            relation: OWNED_KEY_RELATION,
+            subject: ownedKeySubject,
+            grantedBy: principal.asAttribution(),
+            grantedAt: stamp,
+            ownedCustody,
+          })),
+    );
+  }
 }
 
 /** A reference to an EXISTING aggregate the dev already holds an id for (e.g. from the payload / a read).
@@ -219,7 +330,9 @@ export function ensure<Id extends string, F extends Record<string, Field>>(
   agg: AggregateHandle<Id, F>,
   id: string,
 ): AggregateRef<F> {
-  return new Ref(agg, id, "ensures") as unknown as AggregateRef<F>;
+  const ref = new Ref(agg, id, "ensures");
+  seatOwned(ref, agg, "ensure");
+  return ref as unknown as AggregateRef<F>;
 }
 
 // Register ensure() for the foreign read lane (attested reads — see attested_core.ts; the