@githolon/dsl 0.101.5 → 0.102.0

package/src/codegen_ts.ts

@@ -10,7 +10,7 @@
  *
  * Dart apps get generated payload classes / read models / typed query accessors;
  * until this file, a web app on `@githolon/client` hand-typed directive ids and
- * payload shapes against the raw `offer()` surface. `generateTsClient(modules,
+ * payload shapes against framework transport primitives. `generateTsClient(modules,
  * opts)` closes that: ONE generated `.ts` file per package, emitted by
  * `nomos-compile` AFTER the package is hashed (the deployed law's content hash is
  * baked in as a constant), carrying:
@@ -51,7 +51,7 @@ import { BUSINESS_CORRECTION_DIRECTIVE } from "./framework/business_corrections.
 import { collectActivityDescriptors, type PackageActivityEntry } from "./codegen_dart.js";
 import type { NomosCompat } from "./compat_manifest.js";
 import type { QueryDecl } from "./query.js";
-import { voMetaOf, collectPayloadValueObjectDescriptors } from "./value_object.js";
+import { voMetaOf, collectPayloadValueObjectDescriptors, idOfMetaOf, idOfTargetKindOf } from "./value_object.js";
 import { recursiveTypeBaseName, zodUnwrapLazy } from "./zod_lazy.js";
 import { finishCount } from "./count.js";
 import { finishSum } from "./sum.js";
@@ -61,18 +61,32 @@ import { resolveWorkspaceTypes, type ResolvedWorkspaceType, type WorkspaceTypeDe
 import {
   deriveClientMintPlan,
   deriveDirectiveRecordTarget,
+  mintedCreateField,
   type ClientMintPlanEntry,
 } from "./workspace_routing.js";
 import { admitsNull, nullDocLine } from "./null_meta.js";
 import { isNamespacedAggregate, qualifyReadProjectionType } from "./read_projection_namespace.js";
 import { publicClientInterface, type DomainInterface } from "./shape_compat.js";
 import { buildNomosDescribeModel, type NomosDescribeModel } from "./describe_model.js";
-import { assertModelClientMemberAvailable } from "./generated_client_names.js";
+import { assertModelClientMemberAvailable, generatedAggregateCollectionName } from "./generated_client_names.js";
+import { isBusinessIntent } from "./intent.js";
+import { isFrameworkAggregate, isFrameworkDirective, isFrameworkQuery } from "./framework/framework_aggregates.js";
+import { contractTypeName } from "./contract.js";
+import { resolveApplicationTopology } from "./application_topology.js";
+import { recipientMetaOf } from "./recipient.js";
+import {
+  zodArrayElement,
+  zodDef,
+  zodEnumValues,
+  zodKind,
+  zodObjectShape,
+} from "./zod_introspection.js";
 
 const cap = (s: string) => (s.length ? s[0]!.toUpperCase() + s.slice(1) : s);
 const camel = (s: string) => s.replace(/[_\s-]+(\w)/g, (_m, c: string) => c.toUpperCase());
 const lcFirst = (s: string) => (s.length ? s[0]!.toLowerCase() + s.slice(1) : s);
 const upperSnake = (s: string) => s.replace(/[^A-Za-z0-9]+/g, "_").replace(/([a-z0-9])([A-Z])/g, "$1_$2").toUpperCase();
+const tsDomainApplicationType = (domain: string) => `_${cap(camel(domain))}DomainApplication`;
 
 /** A count/sum group-by field → a valid TS param identifier. A DOTTED group-by (`location.source`,
  *  the #30 follow-up) camel-joins into `locationSource` (a bare `location.source` is not a legal
@@ -89,6 +103,15 @@ const tsGroupParam = (by: string) => {
 const tsKey = (name: string): string =>
   /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name) ? name : JSON.stringify(name);
 
+/** One stable business name for an aggregate consequence in an intent result. */
+const tsResultMemberName = (aggregateId: string): string => {
+  const bare = aggregateId.split(".").filter(Boolean).at(-1) ?? aggregateId;
+  const normalized = lcFirst(camel(bare.replace(/[^A-Za-z0-9_$]+/g, " ")));
+  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(normalized) && normalized.length > 0
+    ? normalized
+    : "record";
+};
+
 /** OPTIONAL-CHAIN member access onto a value keyed by a possibly-dotted field label,
  *  meant to follow a `?` (e.g. `x?${tsOptAccess(f)}`): `.foo` for an identifier,
  *  `.["foo.bar"]` otherwise (bracket access preserves the single property). */
@@ -103,6 +126,10 @@ const tsOptAccess = (name: string): string =>
 /** `tool-library` / `tool_library` / `Tool Library` → `toolLibraryClient` — the factory symbol. */
 export const tsClientFactoryName = (domain: string): string => `${lcFirst(camel(domain))}Client`;
 
+/** Package display names may also contain dots; generated application symbols never do. */
+export const tsApplicationName = (packageName: string): string =>
+  `${cap(camel(packageName.replace(/[^A-Za-z0-9]+/g, " ")))}Application`;
+
 /** `tool-library` / `tool_library` / `Tool Library` → `TOOL_LIBRARY_DOMAIN_HASH` — the hash const. */
 export const tsHashConstName = (packageName: string): string => `${upperSnake(packageName)}_DOMAIN_HASH`;
 
@@ -235,56 +262,10 @@ function buildEncryptionMap(
 // The walkers are exported: codegen_proof.ts synthesizes SAMPLE payloads from the
 // same zod shapes this file derives TYPES from — one introspection, two emitters.
 
-type ZodInternalDef = {
-  type?: string | z.ZodTypeAny;
-  innerType?: z.ZodTypeAny;
-  element?: z.ZodTypeAny;
-  shape?: Record<string, z.ZodTypeAny> | (() => Record<string, z.ZodTypeAny>);
-  entries?: Record<string, string | number>;
-  options?: z.ZodTypeAny[];
-  value?: unknown;
-  values?: readonly unknown[];
-  valueType?: z.ZodTypeAny;
-  getter?: () => z.ZodTypeAny; // `z.lazy(() => …)` — the deferred inner schema (zod v4)
-};
-
 // The lazy-unwrap + recursive-name helpers live in the dependency-free `zod_lazy.ts` (shared with
 // codegen_dart WITHOUT an import cycle). Re-exported so codegen_proof's existing import holds.
 export { zodUnwrapLazy };
-
-export function zodDef(zt: z.ZodTypeAny): ZodInternalDef {
-  const raw = zt as unknown as { _def?: ZodInternalDef; def?: ZodInternalDef };
-  return raw._def ?? raw.def ?? {};
-}
-
-export function zodKind(zt: z.ZodTypeAny): string {
-  const t = zodDef(zt).type;
-  return typeof t === "string" ? t : "unknown";
-}
-
-export function zodEnumValues(zt: z.ZodTypeAny): string[] {
-  const raw = zt as unknown as { options?: readonly unknown[] };
-  if (raw.options !== undefined) return raw.options.map(String);
-  const entries = zodDef(zt).entries;
-  if (entries !== undefined) return Object.values(entries).map(String);
-  throw new Error("codegen-ts: ZodEnum has no values");
-}
-
-export function zodObjectShape(zt: z.ZodTypeAny): Record<string, z.ZodTypeAny> {
-  const shape = zodDef(zt).shape;
-  if (typeof shape === "function") return shape();
-  if (shape !== undefined) return shape;
-  const raw = zt as unknown as { shape?: Record<string, z.ZodTypeAny> };
-  if (raw.shape !== undefined) return raw.shape;
-  throw new Error("codegen-ts: ZodObject has no shape");
-}
-
-export function zodArrayElement(zt: z.ZodTypeAny): z.ZodTypeAny {
-  const def = zodDef(zt);
-  if (def.element !== undefined) return def.element;
-  if (typeof def.type !== "string" && def.type !== undefined) return def.type;
-  throw new Error("codegen-ts: ZodArray has no element type");
-}
+export { zodArrayElement, zodDef, zodEnumValues, zodKind, zodObjectShape };
 
 const union = (parts: string[]) => [...new Set(parts)].join(" | ");
 const paren = (t: string) => (t.includes("|") || t.includes("&") ? `(${t})` : t);
@@ -327,6 +308,12 @@ function tsTypeOfZod(
   reg?: LazyTypeRegistry,
   path = "",
 ): string {
+  if (recipientMetaOf(zt) !== undefined) return "Recipient<User>";
+  const aggregateType = idOfMetaOf(zt);
+  if (aggregateType !== undefined) {
+    const target = idOfTargetKindOf(zt) === "contract" ? contractTypeName(aggregateType) : aggregateType;
+    return `NomosRef<${target}>`;
+  }
   // A DECLARED VALUE OBJECT keeps its NAME (vo_authoring_end_to_end.md slice B): the payload
   // references the same exported interface the read model uses — one name, both directions —
   // instead of an anonymous inline literal type. Checked on the BARE object only: optional/
@@ -377,7 +364,12 @@ function tsTypeOfZod(
     }
     case "record": {
       const vt = zodDef(zt).valueType;
-      return `Record<string, ${vt ? tsTypeOfZod(vt, indent, reg, `${path}.*`) : "unknown"}>`;
+      const value = vt ? tsTypeOfZod(vt, indent, reg, `${path}.*`) : "unknown";
+      // TypeScript permits direct structural recursion but rejects the same knot hidden behind
+      // its `Record` utility alias. A generated lazy type is necessarily already registered here.
+      return reg?.used.has(value) === true
+        ? `{ [key: string]: ${value} }`
+        : `Record<string, ${value}>`;
     }
     case "optional":
     case "default":
@@ -466,7 +458,8 @@ export function autoStampFields(schema: z.ZodTypeAny): string[] {
   return out;
 }
 
-/** The payload type text, with auto-stamped / front-door-minted / auto-placed fields optional (`?`).
+/** The payload type text, with auto-stamped / auto-placed fields optional (`?`) and front-door-minted
+ *  fields omitted entirely (they are framework implementation, returned as typed refs).
  *  `reg` collects any RECURSIVE `z.lazy` named types minted while walking (emitted once by the
  *  caller); `pathPrefix` (the directive id) scopes their names so two directives can't collide. */
 function tsTypeOfPayload(
@@ -474,16 +467,22 @@ function tsTypeOfPayload(
   autoStamped: readonly string[],
   minted: readonly string[] = [],
   autoPlaced: readonly string[] = [],
+  privateFields: readonly string[] = [],
   reg?: LazyTypeRegistry,
   pathPrefix = "",
 ): string {
-  if (zodKind(schema) !== "object" || (autoStamped.length === 0 && minted.length === 0 && autoPlaced.length === 0)) {
+  if (zodKind(schema) !== "object" || (autoStamped.length === 0 && minted.length === 0 && autoPlaced.length === 0 && privateFields.length === 0)) {
     return tsTypeOfZod(schema, "", reg, pathPrefix);
   }
   const stamped = new Set(autoStamped);
   const mintedSet = new Set(minted);
   const placedSet = new Set(autoPlaced);
-  const fields = Object.entries(zodObjectShape(schema)).map(([name, raw]) => {
+  const privateSet = new Set(privateFields);
+  const fields = Object.entries(zodObjectShape(schema))
+    // A kernel-minted create id is not optional application input; it is not application input at all.
+    // The generated method mints it internally and returns the resulting NomosRef<T> on the outcome.
+    .filter(([name]) => !mintedSet.has(name) && !privateSet.has(name))
+    .map(([name, raw]) => {
     let f = raw as z.ZodTypeAny;
     let optional = stamped.has(name) || mintedSet.has(name) || placedSet.has(name);
     while (zodKind(f) === "optional" || zodKind(f) === "default") {
@@ -492,9 +491,7 @@ function tsTypeOfPayload(
     }
     const note = stamped.has(name)
       ? " // auto-stamped with ISO now() at offer when omitted"
-      : mintedSet.has(name)
-        ? " // kernel-minted at offer when omitted (the front-door mint; returned on the result)"
-        : placedSet.has(name)
+      : placedSet.has(name)
           ? " // picked LEAST-LOADED over the coordinator's law-state at offer when omitted (sharding §3)"
           : "";
     const fieldPath = pathPrefix === "" ? name : `${pathPrefix}.${name}`;
@@ -543,16 +540,18 @@ function tsBaseTypeOfField(field: Field): string {
         return "string";
       }
     case "ref": {
-      // A `t.foreignRef` field surfaces as a TYPED cross-workspace locator (hydrated by the accessors from
-      // the raw id + the declared workspace field); a plain same-workspace `t.ref` stays the id string.
+      // Both reference shapes keep aggregate identity typed. A same-workspace edge is the canonical
+      // NomosRef<TAggregate>; a foreign edge adds its decoder/read helpers.
       const fr = (field as { foreignRef?: { targetAggregateId: string; targetIsContract?: boolean } }).foreignRef;
       // A contract target types against the shared `<ContractId>Contract` interface (the public DTO),
       // not the concrete `<Agg>Data` — that is how the reference stays acyclic.
       return fr !== undefined
         ? fr.targetIsContract === true
-          ? `ForeignRef<${fr.targetAggregateId}Contract>`
-          : `ForeignRef<${fr.targetAggregateId}Data>`
-        : "string";
+          ? `ForeignRef<${contractTypeName(fr.targetAggregateId)}>`
+          : `ForeignRef<${fr.targetAggregateId}>`
+        : field.refAggregateId !== undefined
+          ? `NomosRef<${field.refAggregateId}>`
+          : "string";
     }
     case "json":
       // A NAMED VALUE OBJECT field reads as its generated interface (`value_object.ts`);
@@ -598,7 +597,9 @@ const geometryFactoryName: Record<string, string> = {
 function tsTypeOfVoField(f: ValueObjectFieldDescriptor): string {
   switch (f.type) {
     case "string":
-      return f.brand ?? "string"; // a brandedId(...) → the emitted branded alias
+      return f.idOf !== undefined
+        ? `NomosRef<${f.idOf}>`
+        : f.brand ?? "string"; // a brandedId(...) → the emitted branded alias
     case "number":
       return "number"; // `.int()`/units are Dart-side nominal products; TS keeps one number
     case "boolean":
@@ -709,6 +710,9 @@ export interface TsClientOptions {
   /** The CLIENT/LAW COMPAT MANIFEST (§5) — baked in so the factory can hand it to the
    *  holon's connect-time classifier (DIAGNOSIS only, never a gate). */
   readonly compat?: NomosCompat;
+  /** Explicit application home for direct/synthetic generation. The package compiler derives this from
+   * business birth topology and passes it here; ambiguous multi-domain packages fail rather than flatten. */
+  readonly homeDomain?: string;
 }
 
 /** TS string literal (JSON.stringify covers escaping). */
@@ -728,13 +732,13 @@ function emitTsActivityBlock(entries: readonly PackageActivityEntry[], describeM
       : `{ ${desc.refs
       .map((r) => {
         // A `from: "@created"` ref reads the id the LAW MINTED (the row's `created` list, first type match);
-        // any other `from` is a payload path. Every ref carries the session workspace (the row's `workspace`).
+        // any other `from` is a payload path. Every ref carries the record address (the row's `workspace`).
         const id = r.from === "@created"
           ? `_activityAggregateId(row.created, ${_actLit(r.type)})`
           : r.from === "@affected"
             ? `_activityAggregateId(row.affected, ${_actLit(r.type)})`
             : `_activityPayloadPath(row.payload, ${_actLit(r.from)})`;
-        return `${_actLit(r.name)}: { workspace: row.workspace ?? "", type: ${_actLit(r.type)}, id: ${id} }`;
+        return `${_actLit(r.name)}: _nmsRef(row.workspace ?? "", ${_actLit(r.type)}, ${id})`;
       })
       .join(", ")} }`;
     return [
@@ -742,7 +746,7 @@ function emitTsActivityBlock(entries: readonly PackageActivityEntry[], describeM
       `    const params: Record<string, string> = { ${params} };`,
       `    const vars = { actor: row.actorSubject, ...params };`,
       `    return {`,
-      `      eventId: ${e.correction === true ? "_activityOpaqueCorrectionId(row.intentId)" : "row.intentId"}, kind: ${_actLit(desc.kind)}, actorSubject: row.actorSubject, occurredAt: row.occurredAt,`,
+      `      eventId: ${e.correction === true ? "_activityOpaqueCorrectionId(row.intentId)" : "row.intentId"}, kind: ${_actLit(desc.kind)}, performedBy: row.actorSubject, occurredAt: row.occurredAt,`,
       `      title: _renderActivityTemplate(${_actLit(desc.title)}, vars), message: _renderActivityTemplate(${_actLit(desc.message)}, vars),`,
       `      titleKey: ${_actLit(desc.titleKey)}, messageKey: ${_actLit(desc.messageKey)},`,
       `      params, refs: ${refs},`,
@@ -755,18 +759,18 @@ function emitTsActivityBlock(entries: readonly PackageActivityEntry[], describeM
   };
   return [
     `// ── model evolution — generated business surface over exact-history proof ──`,
-    `export interface NomosModelDifference {`,
+    `interface NomosModelDifference {`,
     `  kind: "rules" | "outcome" | "evidence"; area?: string; action?: string; summary: string;`,
     `}`,
-    `export interface NomosModelReview {`,
+    `interface NomosModelReview {`,
     `  checkedActions: number; candidateActions: number; sameOutcome: boolean | null;`,
     `  differences: NomosModelDifference[];`,
     `}`,
-    `export type NomosModelAdoption =`,
+    `type NomosModelAdoption =`,
     `  | { status: "adopted"; summary: string; review: NomosModelReview }`,
     `  | { status: "needs-decision"; summary: string; review: NomosModelReview; accept(because: string): Promise<NomosModelAdoption> }`,
     `  | { status: "blocked"; summary: string; review: NomosModelReview };`,
-    `export type NomosModelRestoration =`,
+    `type NomosModelRestoration =`,
     `  | { status: "restored"; summary: string; review: NomosModelReview }`,
     `  | { status: "needs-decision"; summary: string; review: NomosModelReview; accept(because: string): Promise<NomosModelRestoration> }`,
     `  | { status: "blocked"; summary: string; review: NomosModelReview };`,
@@ -886,13 +890,13 @@ function emitTsActivityBlock(entries: readonly PackageActivityEntry[], describeM
     `}`,
     ``,
     `// ── activity feed (architecture/activity_descriptors.md) — typed rows folded from the intent log ──`,
-    `/** A declared navigation target on an activity row: the canonical [NomosRef] triple (workspace + type +`,
-    ` *  resolved id). A \`from: "@created"\` ref resolves the id the LAW minted; others a payload path. */`,
-    `export interface ActivityRef { workspace: string; type: string; id: string }`,
+    `/** A declared navigation target on an activity row: the same inspectable aggregate reference returned by`,
+    ` *  generated reads and writes. A \`from: "@created"\` ref resolves the identity the law minted. */`,
+    `export type ActivityRef = NomosRef<_NomosAnyAggregate>;`,
     `/** A rendered activity row — every public business directive has a framework-owned baseline;`,
     ` *  an optional \`.activity(...)\` declaration enriches its language and references. */`,
     `export interface ActivityEvent {`,
-    `  eventId: string; kind: string; actorSubject: string; occurredAt: string;`,
+    `  eventId: string; kind: string; performedBy: string; occurredAt: string;`,
     `  title: string; message: string; titleKey: string; messageKey: string;`,
     `  params: Record<string, string>; refs: Record<string, ActivityRef>;`,
     `  category?: string; icon?: string;`,
@@ -900,7 +904,7 @@ function emitTsActivityBlock(entries: readonly PackageActivityEntry[], describeM
     `  domain: string; directiveId: string;`,
     `}`,
     `/** The runtime's per-committed-intent RAW ROW (the shape \`holon.watchActivity\`/\`activityLog\` yield). */`,
-    `export interface ActivityRawRow { intentId: string | null; domain: string | null; directiveId: string | null; actorSubject: string | null; occurredAt: string | null; payload: Record<string, unknown>; created?: { type: string; id: string }[]; affected?: { type: string; id: string }[]; workspace?: string }`,
+    `interface ActivityRawRow { intentId: string | null; domain: string | null; directiveId: string | null; actorSubject: string | null; occurredAt: string | null; payload: Record<string, unknown>; created?: { type: string; id: string }[]; affected?: { type: string; id: string }[]; workspace?: string }`,
     `interface _CompleteActivityRawRow extends ActivityRawRow { intentId: string; domain: string; directiveId: string; actorSubject: string; occurredAt: string }`,
     `/** A verified narrative over the activity log. \`describeHistory\` returns this narrow form;`,
     ` *  \`describe\` returns the richer linked [NomosDescription] while preserving these two fields. */`,
@@ -912,13 +916,14 @@ function emitTsActivityBlock(entries: readonly PackageActivityEntry[], describeM
     `}`,
     `export interface NomosDescribeItem {`,
     `  kind: string; id: string; label: string; summary: string;`,
-    `  details?: Record<string, unknown>; refs?: NomosRef[];`,
+    `  details?: Record<string, unknown>; refs?: NomosRef<_NomosAnyAggregate>[];`,
     `}`,
-    `/** A parent-ledger link to another part of the organisation. Open that workspace's generated client`,
-    ` *  and call describe() again; each child explains itself in its own installed business language. */`,
+    `/** A verified link to another part of the organisation. Following it returns that part's`,
+    ` *  generated explanation without exposing navigation machinery. */`,
     `export interface NomosDescribeChild {`,
-    `  workspace: string; status: "active" | "retired" | "reclaimed" | "unknown"; bornAt: string | null;`,
+    `  status: "active" | "retired" | "reclaimed" | "unknown"; bornAt: string | null;`,
     `  section: "root"; label: string; question: string; summary: string;`,
+    `  open(): Promise<NomosDescription>;`,
     `}`,
     `export interface NomosOrganisationDescription { complete: boolean; children: NomosDescribeChild[] }`,
     `/** One grounded page in the hierarchical self-description. Root links to exactly six detail pages. */`,
@@ -974,7 +979,7 @@ function emitTsActivityBlock(entries: readonly PackageActivityEntry[], describeM
     `/** Correction refs are derived by the runtime from the corrected action's sealed events. */`,
     `function _activityCorrectionRefs(row: ActivityRawRow): Record<string, ActivityRef> {`,
     `  return Object.fromEntries((row.affected ?? []).map((ref, index) => [`,
-    `    \`subject\${index + 1}\`, { workspace: row.workspace ?? "", type: ref.type, id: ref.id },`,
+    `    \`subject\${index + 1}\`, _nmsRef(row.workspace ?? "", ref.type, ref.id),`,
     `  ]));`,
     `}`,
     `/** Keep a framework-private correction identity stable and traceable without exposing its internal name. */`,
@@ -995,7 +1000,7 @@ function emitTsActivityBlock(entries: readonly PackageActivityEntry[], describeM
     `};`,
     `/** Fold ONE committed-intent raw row into a typed [ActivityEvent], or null for framework/control work`,
     ` *  outside this generated business package. Pure — the kernel/ledger stays the audit truth. */`,
-    `export function renderActivity(row: ActivityRawRow): ActivityEvent | null {`,
+    `function renderActivity(row: ActivityRawRow): ActivityEvent | null {`,
     `  if (typeof row.intentId !== "string" || typeof row.domain !== "string" || typeof row.directiveId !== "string" || typeof row.actorSubject !== "string" || typeof row.occurredAt !== "string") return null;`,
     `  const f = _ACTIVITY_REGISTRY[\`${"${row.domain.length}:${row.domain}${row.directiveId}"}\`];`,
     `  return f === undefined ? null : f(row as _CompleteActivityRawRow);`,
@@ -1020,6 +1025,25 @@ function anyPackedTaxonomy(modules: readonly DomainModule[]): boolean {
 }
 
 export function generateTsClient(modules: readonly DomainModule[], opts: TsClientOptions): string {
+  const topologyModules = modules;
+  // A public business birth can target a deliberately hidden root aggregate. Its private binder still
+  // needs a nominal type, but unrelated framework records must remain absent even from generated source.
+  const publicBusinessAggregateIds = new Set(modules.flatMap((mod) => mod.aggregates
+    .filter((aggregate) =>
+      (aggregate as { businessBirthInternal?: unknown }).businessBirthInternal !== true
+        && !isFrameworkAggregate(aggregate))
+    .map((aggregate) => aggregate.id)));
+  const internalBirthAggregateIds = [...new Set(modules.flatMap((mod) =>
+    (mod.applicationIntents ?? mod.directives).flatMap((directive) => {
+      if ((directive as { businessBirthInternal?: unknown }).businessBirthInternal === true) return [];
+      const aggregateId = (directive as { businessBirth?: { aggregateId?: unknown } }).businessBirth?.aggregateId;
+      return typeof aggregateId === "string" && !publicBusinessAggregateIds.has(aggregateId) ? [aggregateId] : [];
+    })))].sort();
+  const topology = resolveApplicationTopology(topologyModules);
+  const homeDomain = opts.homeDomain ?? topology.homeDomain;
+  if (!topology.rootDomains.includes(homeDomain)) {
+    throw new Error(`generated TypeScript application cannot use child domain '${homeDomain}' as its primary facet`);
+  }
   // Collect the one framework-authored correction testimony before presentation filtering removes its
   // private directive. Ordinary internal machinery stays absent from the registry.
   const packageActivityEntries = collectActivityDescriptors(modules);
@@ -1027,23 +1051,43 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
   // vocabulary. Strip only the presentation marker here; manifests, hashes and the engine see the full law.
   modules = modules.map((mod) => {
     const publicAggregates = mod.aggregates.filter(
-      (a) => (a as { businessBirthInternal?: unknown }).businessBirthInternal !== true,
+      (a) => (a as { businessBirthInternal?: unknown }).businessBirthInternal !== true && !isFrameworkAggregate(a),
     );
     const publicAggregateIds = new Set(publicAggregates.map((a) => a.id));
     return {
       ...mod,
       aggregates: publicAggregates,
-      directives: mod.directives.filter(
-        (d) => (d as { businessBirthInternal?: unknown }).businessBirthInternal !== true,
-      ),
+      // An explicit application language wins. Otherwise the tenant's exported,
+      // non-framework directives are its business verbs. Framework directives are
+      // branded by object identity and can never leak merely because they compose
+      // into the same law.
+      directives: (mod.applicationIntents ?? mod.directives).filter((d) =>
+        (d as { businessBirthInternal?: unknown }).businessBirthInternal !== true
+          && !isFrameworkDirective(d)),
       ...(mod.queries === undefined
         ? {}
-        : { queries: mod.queries.filter((q) => (q as { businessBirthInternal?: unknown }).businessBirthInternal !== true) }),
+        : { queries: mod.queries.filter((q) => (q as { businessBirthInternal?: unknown }).businessBirthInternal !== true && !isFrameworkQuery(q)) }),
       ...(mod.readModelAggregates === undefined
         ? {}
         : { readModelAggregates: mod.readModelAggregates.filter((id) => publicAggregateIds.has(id)) }),
     };
   });
+  const aggregateOwners = new Map<string, string[]>();
+  for (const module of modules) {
+    const domain = module.domain ?? module.name;
+    for (const aggregate of module.aggregates) {
+      aggregateOwners.set(aggregate.id, [...(aggregateOwners.get(aggregate.id) ?? []), domain]);
+    }
+  }
+  const aggregateIdentityTypes = [
+    ...new Set(modules.flatMap((mod) => mod.aggregates.map((aggregate) => aggregate.id))),
+  ].sort();
+  const publicAggregateIds = new Set(aggregateIdentityTypes);
+  // A law-only package can legitimately expose no business aggregate while still receiving the
+  // universal description/application implementation. `never` makes internal generic helpers
+  // uncallable and produces invalid declarations; `unknown` preserves the sealed brand without
+  // inventing a public aggregate identity.
+  const anyAggregateType = aggregateIdentityTypes.length === 0 ? "unknown" : aggregateIdentityTypes.join(" | ");
   for (const mod of modules) assertModelClientMemberAvailable(mod);
   const clientInterface = opts.interface === undefined
     ? undefined
@@ -1061,11 +1105,14 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       Object.values(fields).some((field) => field.owned === true),
     ),
   );
-  const manualEncryptionPresent = encMap !== null && Object.values(encMap).some((domain) =>
-    [...Object.values(domain.directives), ...Object.values(domain.reads)].some((fields) =>
-      Object.values(fields).some((field) => field.owned !== true),
-    ),
+  const sourceTrustPresent = modules.some((mod) =>
+    (mod.directives as Directive<unknown>[]).some((directive) => directive.businessSourceTrust !== undefined),
   );
+  // The old generic owner ceremony accepted raw scopes, directive ids, payloads and key material. It was a
+  // complete second framework API hiding inside every encrypted generated client. Never emit it: ordinary
+  // encryption remains statefully owned by the connected application, while record sharing is exposed only
+  // through generated share/unshare/transfer business methods for aggregates that declare that policy.
+  const manualEncryptionPresent = false;
   const encConst = encryptionConstName(opts.packageName);
   const internalFieldsByType = Object.fromEntries(
     [...modules.flatMap((mod) => mod.aggregates)]
@@ -1076,14 +1123,10 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       .filter(([, fields]) => fields.length > 0),
   );
   const hasInternalFields = Object.keys(internalFieldsByType).length > 0;
-  // A package declaring ≥1 `.births()` directive emits the branded identity wrappers (below) its typed
-  // birth methods take for `actor`/`authorSecret`. Births-free packages emit nothing (byte-identical).
-  const hasBirths = modules.some((m) =>
-    (m.directives as Directive<unknown>[]).some((d) =>
-      (d as { birthsChild?: boolean })?.birthsChild === true
-        && (d as { businessBirth?: unknown }).businessBirth === undefined,
-    ),
-  );
+  // Raw `.births()` directives are framework/operator law, not an alternative tenant API. Only an explicit
+  // businessBirth declaration receives a generated application method; therefore no principal/secret/parent
+  // wrappers are emitted here.
+  const hasBirths = false;
   // SURFACED MERGE CONFLICTS: a package declaring ≥1 `.merge(Surfaced(...))` field emits the
   // `SurfacedValue<T>` union + guard (below). Surfaced-free packages emit nothing (byte-identical).
   const hasSurfaced = modules.some((m) =>
@@ -1110,22 +1153,65 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     ),
   );
   const out: string[] = [];
+  const applicationName = tsApplicationName(opts.packageName);
+  const applicationOpener = `open${applicationName}`;
+  // A signed-in person gets one application home. Other generated domain factories exist only so a
+  // business birth or typed navigation can bind them to their own child workspace inside the private plane.
+  const generatedDomains = [...new Set(modules.map((mod) => mod.domain ?? mod.name))];
+  const invitationPolicies = modules.flatMap((module) =>
+    (module.applicationWorkspaceSharing ?? []).map((policy) => ({
+      domain: module.domain ?? module.name,
+      domainHash: opts.domainHash,
+      query: policy.invitationLaw.pendingByRecipient.id,
+      redeem: policy.invitationLaw.redeem.id,
+      personField: policy.person,
+      roleField: policy.role,
+      scopeField: policy.scope,
+    }))
+  );
+  const hasInvitations = invitationPolicies.length > 0;
+  const clientDomains = topology.rootDomains;
   // The PACKAGE-LEVEL recursive-type registry: every directive payload's `z.lazy` knots mint
   // named recursive type aliases into it (deduped by lazy identity across directives); the decls
   // are emitted once, after the payload types (TS hoists type aliases, so order is free).
   const lazyReg = newLazyRegistry();
   out.push(
-    `// AUTO-GENERATED by nomos-compile — typed TS client for package "${opts.packageName}".`,
-    `// Regenerated on every compile; do not edit. Zero imports: bind it to any holon`,
-    `// exposing the @githolon/client surface (the structural NomosHolon below), e.g.`,
-    `//`,
-    `//   import { connect } from "@githolon/client";`,
-    `//   import { ${tsClientFactoryName(modules[0]?.domain ?? "domain")} } from "./build/${opts.packageName}.client.js";`,
-    `//   const holon = await connect({ cloud, workspace, clientId });`,
-    `//   const app = ${tsClientFactoryName(modules[0]?.domain ?? "domain")}(holon);`,
+    `// AUTO-GENERATED by nomos-compile — typed TS application implementation for package "${opts.packageName}".`,
+    `// Regenerated on every compile; do not edit. Framework binding types below are deliberately private:`,
+    `// tenant application code receives the generated business API and cannot import transport machinery.`,
+    ``,
+    `import { nomosInternalOpenGeneratedApplication, nomosInternalOpenGeneratedChildApplication${hasInvitations ? ", nomosInternalCreateInvitation, nomosInternalRedeemInvitation" : ""} } from "@githolon/client/_generated_application_host_7c1f5e";`,
+    ``,
+    `interface _NomosApplicationStatus {`,
+    `  readonly phase: "opening" | "current" | "saving" | "receiving" | "catching-up" | "offline" | "attention";`,
+    `  readonly localChanges: number;`,
+    `  readonly acceptedChanges: number;`,
+    `  readonly decisionsNeeded: number;`,
+    `  readonly lastUpdatedAt: Date | null;`,
+    `  readonly message: string | null;`,
+    `}`,
+    `interface _NomosApplicationParticipant {`,
+    `  readonly currentUser: User;`,
+    `}`,
+    `interface _NomosApplicationLifecycle {`,
+    `  currentStatus(): Promise<_NomosApplicationStatus>;`,
+    `  watchStatus(listener: (status: _NomosApplicationStatus) => void): () => void;`,
+    `}`,
+    ...(hasInvitations
+      ? [
+          `interface _NomosApplicationInvitations {`,
+          `  /** Cross an identity-provider uid into Nomos once; business actions accept only this typed recipient. */`,
+          `  recipient(uid: string): Recipient<User>;`,
+          `  /** Create an invitation; transport its link however your product chooses. */`,
+          `  createInvitation(): Promise<Invitation<User>>;`,
+          `  /** Redeem a transported invitation as currentUser. */`,
+          `  redeemInvitation(link: string): Promise<void>;`,
+          `}`,
+        ]
+      : []),
     ``,
     `/** sha256 of the deployed \`.package.usda\` — the installed law this client offers under. */`,
-    `export const ${hashConst} = ${JSON.stringify(opts.domainHash)};`,
+    `const ${hashConst} = ${JSON.stringify(opts.domainHash)};`,
     ``,
     ...(clientInterface !== undefined
       ? [
@@ -1133,7 +1219,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           ` *  and aggregates (read shapes, sid-keyed) it depends on, keyed by domain. \`connect()\``,
           ` *  negotiates this against the workspace's installed offer by SHAPE (stable-id subtyping),`,
           ` *  not by law hash — so the domain can evolve without republishing this client. */`,
-          `export const ${interfaceConstName(opts.packageName)} = ${JSON.stringify(clientInterface)} as const;`,
+          `const ${interfaceConstName(opts.packageName)} = ${JSON.stringify(clientInterface)} as const;`,
           ``,
         ]
       : []),
@@ -1143,139 +1229,222 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           ` *  provenance this client was generated against. A DIAGNOSIS surface — the factory hands it to`,
           ` *  the holon's connect-time classifier, which logs a warning on a law-hash mismatch. It NEVER`,
           ` *  gates: a hash mismatch with a compatible SHAPE is normal during law evolution (#72). */`,
-          `export const ${compatConstName(opts.packageName)} = ${JSON.stringify(opts.compat)} as const;`,
+          `const ${compatConstName(opts.packageName)} = ${JSON.stringify(opts.compat)} as const;`,
           ``,
         ]
       : []),
-    `/** THE ONE REFERENCE (architecture/nomos_ref.md) — the canonical, workspace-qualified identity of an`,
-    ` *  aggregate instance: \`{ workspace, type, id }\`, with the stable interop string`,
-    ` *  \`nomos://<workspace>/<type>/<id>\`. Carried on every read \`Row.ref\` + write outcome + activity ref. */`,
-    `export interface NomosRef { workspace: string; type: string; id: string }`,
-    `/** A newly born business root. The phantom type makes the returned reference aggregate-specific while`,
-    ` *  its runtime identity stays the one canonical {workspace,type,id} NomosRef. */`,
-    `export type NomosBorn<TData> = NomosRef & { readonly __nomosData?: TData };`,
+    `/** THE ONE REFERENCE (architecture/nomos_ref.md) — a framework-created, aggregate-typed identity`,
+    ` *  returned by generated reads and writes. Its identity is inspectable and serialisable; its brand`,
+    ` *  prevents tenant code from constructing an untrusted replacement. */`,
+    `declare const _nomosAggregateType: unique symbol;`,
+    `type _NomosAnyAggregate = ${anyAggregateType};`,
+    ...internalBirthAggregateIds.map((id) => `type ${id} = { readonly [_nomosAggregateType]?: ${JSON.stringify(id)} };`),
+    `export interface NomosRef<TAggregate> {`,
+    `  /** Compile-time aggregate identity only. Invariant so wrong aggregate refs fail. */`,
+    `  readonly [_nomosAggregateType]: (aggregate: TAggregate) => TAggregate;`,
+    `  readonly workspace: string;`,
+    `  readonly type: string;`,
+    `  readonly id: string;`,
+    `  /** Stable, portable nomos:// address. An address identifies a record; it never grants authority. */`,
+    `  readonly address: string;`,
+    `}`,
+    `interface _NomosReferenceData<TAggregate> extends NomosRef<TAggregate> { workspace: string; type: string; id: string; address: string }`,
+    `const _nmsReferenceData = <TAggregate>(ref: NomosRef<TAggregate>): _NomosReferenceData<TAggregate> => ref as _NomosReferenceData<TAggregate>;`,
+    `const _nmsRef = <TAggregate>(workspace: string, type: string, id: string): NomosRef<TAggregate> => ({`,
+    `  workspace, type, id,`,
+    `  address: "nomos://" + encodeURIComponent(workspace) + "/" + encodeURIComponent(type) + "/" + encodeURIComponent(id),`,
+    `} as unknown as NomosRef<TAggregate>);`,
+    `/** A framework-owned authority coordinate. Identity is not an aggregate or application row; it is`,
+    ` *  established by Nomos from the verified signer, representation and custody graph. */`,
+    `declare const _nomosIdentityType: unique symbol;`,
+    `export interface Identity<TSubject> {`,
+    `  readonly [_nomosIdentityType]: (subject: TSubject) => TSubject;`,
+    `  readonly id: string;`,
+    `  readonly address: string;`,
+    `}`,
+    `/** The durable, independently attributable participant currently using this application.`,
+    ` *  A User is a capability over a Nomos Identity, not a tenant Person, record or login token. */`,
+    `declare const _nomosUserType: unique symbol;`,
+    `export interface User {`,
+    `  readonly [_nomosUserType]: "Nomos.User";`,
+    `  readonly identity: Identity<User>;`,
+    `}`,
+    `/** A framework-created address for a User. It carries no authority and tenant code cannot construct it. */`,
+    `declare const _nomosRecipientType: unique symbol;`,
+    `export interface Recipient<TSubject> {`,
+    `  readonly [_nomosRecipientType]: (subject: TSubject) => TSubject;`,
+    `}`,
+    `/** A single-use invitation. Transport its link however your product chooses; transport is not identity. */`,
+    `export interface Invitation<TSubject> {`,
+    `  readonly recipient: Recipient<TSubject>;`,
+    `  link(baseUrl: string): string;`,
+    `}`,
+    `const _nmsRecipientAddresses = new WeakMap<object, string>();`,
+    `const _nmsRecipient = <TSubject>(address: string): Recipient<TSubject> => {`,
+    `  const value = Object.freeze({}) as Recipient<TSubject>;`,
+    `  _nmsRecipientAddresses.set(value as object, address);`,
+    `  return value;`,
+    `};`,
+    `const _nmsRecipientAddress = (value: unknown, field = "recipient"): string => {`,
+    `  if (typeof value !== "object" || value === null) throw new TypeError(field + " must be a Recipient<User> returned by this application");`,
+    `  const address = _nmsRecipientAddresses.get(value);`,
+    `  if (!address) throw new TypeError(field + " must be a Recipient<User> returned by this application");`,
+    `  return address;`,
+    `};`,
+    `const _nmsInvitation = <TSubject>(material: { address: string; token: string }): Invitation<TSubject> => {`,
+    `  const recipient = _nmsRecipient<TSubject>(material.address);`,
+    `  return Object.freeze({`,
+    `    recipient,`,
+    `    link(baseUrl: string): string {`,
+    `      const url = new URL(baseUrl);`,
+    `      url.hash = "nomos-invitation=" + material.token;`,
+    `      return url.toString();`,
+    `    },`,
+    `  });`,
+    `};`,
+    `/** Compare two public record addresses. Neither reference carries or grants authority. */`,
+    `export function sameRecord<TAggregate>(a: NomosRef<TAggregate>, b: NomosRef<TAggregate>): boolean {`,
+    `  const left = _nmsReferenceData(a); const right = _nmsReferenceData(b);`,
+    `  return left.workspace === right.workspace && left.type === right.type && left.id === right.id;`,
+    `}`,
     `/** The stable \`nomos://<workspace>/<type>/<id>\` string form (each segment URI-encoded — a workspace/`,
     ` *  type/id containing \`/\` or spaces round-trips). Survives URLs, nav params, JSON, logs. */`,
-    `export function nomosRefUri(ref: NomosRef): string {`,
-    `  return "nomos://" + encodeURIComponent(ref.workspace) + "/" + encodeURIComponent(ref.type) + "/" + encodeURIComponent(ref.id);`,
+    `function nomosRefUri<TAggregate>(ref: NomosRef<TAggregate>): string {`,
+    `  return _nmsReferenceData(ref).address;`,
     `}`,
     `/** Parse a \`nomos://<workspace>/<type>/<id>\` string back into a [NomosRef] (the inverse of [nomosRefUri]);`,
     ` *  throws on anything else. */`,
-    `export function parseNomosRef(uri: string): NomosRef {`,
+    `function parseNomosRef<TAggregate>(uri: string): NomosRef<TAggregate> {`,
     "  const m = /^nomos:\\/\\/([^/]+)\\/([^/]+)\\/([^/]+)$/.exec(uri);",
     `  if (m === null) throw new Error("parseNomosRef: expected nomos://<workspace>/<type>/<id>: " + uri);`,
-    `  return { workspace: decodeURIComponent(m[1]!), type: decodeURIComponent(m[2]!), id: decodeURIComponent(m[3]!) };`,
+    `  return _nmsRef(decodeURIComponent(m[1]!), decodeURIComponent(m[2]!), decodeURIComponent(m[3]!));`,
     `}`,
-    `/** One projection row: the aggregate's wire type, its id, the folded fields, and the canonical [NomosRef]`,
-    ` *  (composed at decode from the session workspace + the row's type/id — additive, the \`data\` is untouched). */`,
-    `export interface Row<T> { type: string; id: string; data: T; ref: NomosRef }`,
-    `/** Stamp each row's canonical [NomosRef] from the session \`ws\` + the row's type/id (additive — already-`,
+    `/** One business record with the canonical reference Nomos returned for it. */`,
+    `export type NomosRecord<TAggregate> = TAggregate & { readonly ref: NomosRef<TAggregate> };`,
+    `/** Framework-private projection envelope. It is flattened before any application read resolves. */`,
+    `interface Row<TAggregate> { data: TAggregate; ref: NomosRef<TAggregate> }`,
+    `/** Stamp each row's canonical [NomosRef] from its verified address (additive — already-`,
     ` *  stamped rows pass through).${hasInternalFields ? " Framework-owned fields are removed at this decode boundary." : ""} */`,
     ...(hasInternalFields
       ? [
           `const _INTERNAL_FIELDS: Record<string, readonly string[]> = ${JSON.stringify(internalFieldsByType)};`,
-          `function _stampRefs<T>(ws: string, rows: Row<T>[]): Row<T>[] {`,
+          `function _stampRefs<TAggregate>(ws: string, rows: Row<TAggregate>[]): Row<TAggregate>[] {`,
           `  return rows.map((r) => {`,
-          `    const fields = _INTERNAL_FIELDS[r.type] ?? _INTERNAL_FIELDS[r.type.slice(r.type.lastIndexOf(".") + 1)];`,
+          `    const raw = r as Row<TAggregate> & { type: string; id: string };`,
+          `    const fields = _INTERNAL_FIELDS[raw.type] ?? _INTERNAL_FIELDS[raw.type.slice(raw.type.lastIndexOf(".") + 1)];`,
           `    let row = r;`,
           `    if (fields !== undefined && fields.length > 0 && r.data !== null && typeof r.data === "object") {`,
           `      const data = { ...(r.data as Record<string, unknown>) };`,
           `      for (const field of fields) delete data[field];`,
-          `      row = { ...r, data: data as T };`,
+          `      row = { ...r, data: data as TAggregate };`,
           `    }`,
-          `    return row.ref !== undefined ? row : { ...row, ref: { workspace: ws, type: row.type, id: row.id } };`,
+          `    const decoded = row as Row<TAggregate> & { type: string; id: string };`,
+          `    return row.ref !== undefined ? row : { ...row, ref: _nmsRef(ws, decoded.type, decoded.id) };`,
           `  });`,
           `}`,
         ]
       : [
-          `function _stampRefs<T>(ws: string, rows: Row<T>[]): Row<T>[] {`,
-          `  return rows.map((r) => (r.ref !== undefined ? r : { ...r, ref: { workspace: ws, type: r.type, id: r.id } }));`,
+          `function _stampRefs<TAggregate>(ws: string, rows: Row<TAggregate>[]): Row<TAggregate>[] {`,
+          `  return rows.map((r) => { const raw = r as Row<TAggregate> & { type: string; id: string }; return r.ref !== undefined ? r : { ...r, ref: _nmsRef(ws, raw.type, raw.id) }; });`,
           `}`,
         ]),
-    `function _stampRefsP<T>(ws: string, p: Promise<Row<T>[]>): Promise<Row<T>[]> { return p.then((rows) => _stampRefs(ws, rows)); }`,
-    `/** THE TYPED WRITE OUTCOME (architecture/nomos_ref.md) — every generated directive method returns this.`,
-    ` *  \`created\` is EVERY aggregate the plan minted (typed [NomosRef]s, composed with the session workspace;`,
-    ` *  \`[]\` on a holon too old to return them — never a fake id). \`target\` is the addressed instance for a`,
-    ` *  front-door-mint lane (statically known); omitted otherwise. \`head\` is the new local head. */`,
-    `export interface NomosOutcome { head: string; created: NomosRef[]; target?: NomosRef }`,
-    `/** Fold a holon offer result (a bare head, or \`{ head, created }\` under returnCreated) into a [NomosOutcome]`,
-    ` *  — composing each created \`{type,id}\` with the session \`ws\`. \`target\` rides through when the caller`,
-    ` *  statically knows the addressed instance (the front-door mint). */`,
-    `async function _outcome(ws: string, r: Promise<string | { head: string; created?: { type: string; id: string }[] }>, target?: NomosRef): Promise<NomosOutcome> {`,
-    `  const v = await r;`,
-    `  const obj = typeof v === "object" && v !== null;`,
-    `  const head = obj ? v.head : String(v);`,
-    `  const created = (obj ? v.created ?? [] : []).map((c) => ({ workspace: ws, type: c.type, id: c.id }));`,
-    `  return target !== undefined ? { head, created, target } : { head, created };`,
+    `function _stampRefsP<TAggregate>(ws: string, p: Promise<Row<TAggregate>[]>): Promise<Row<TAggregate>[]> { return p.then((rows) => _stampRefs(ws, rows)); }`,
+    `function _businessRecords<TAggregate>(rows: Row<TAggregate>[]): NomosRecord<TAggregate>[] {`,
+    `  return rows.map((row) => ({ ...(row.data as object), ref: row.ref } as NomosRecord<TAggregate>));`,
+    `}`,
+    `function _businessRecordsP<TAggregate>(p: Promise<Row<TAggregate>[]>): Promise<NomosRecord<TAggregate>[]> {`,
+    `  return p.then(_businessRecords);`,
+    `}`,
+    `type _NomosRawReference = { type: string; id: string };`,
+    `type _NomosRawWriteResult = string | { head: string; created?: _NomosRawReference[]; affected?: _NomosRawReference[] };`,
+    `/** Finish a business action without leaking ledger heads or framework write envelopes. */`,
+    `async function _commit(r: Promise<_NomosRawWriteResult>): Promise<void> { void await r; }`,
+    `/** Turn the sealed intent's complete affected set into its generated, business-named result. */`,
+    `async function _businessResult<TResult>(ws: string, outputs: readonly { member: string; type: string; many?: boolean }[], r: Promise<_NomosRawWriteResult>): Promise<TResult> {`,
+    `  const result = await r;`,
+    `  if (typeof result === "string" || !Array.isArray(result.affected)) {`,
+    `    throw new Error("Nomos committed the business action without returning its affected records");`,
+    `  }`,
+    `  const answer: Record<string, NomosRef<_NomosAnyAggregate> | readonly NomosRef<_NomosAnyAggregate>[]> = {};`,
+    `  for (const output of outputs) {`,
+    `    const matches = result.affected.filter((affected) => affected.type === output.type || affected.type.endsWith("." + output.type));`,
+    `    if (output.many) {`,
+    `      answer[output.member] = matches.map((match) => _nmsRef<_NomosAnyAggregate>(ws, match.type, match.id));`,
+    `      continue;`,
+    `    }`,
+    `    if (matches.length !== 1) throw new Error(\`Nomos expected one affected ${"${output.type}"} record, received ${"${matches.length}"}\`);`,
+    `    answer[output.member] = _nmsRef<_NomosAnyAggregate>(ws, matches[0]!.type, matches[0]!.id);`,
+    `  }`,
+    `  return answer as TResult;`,
     `}`,
     // MULTI-WORKSPACE LOCATORS (t.foreignRef): a TYPED cross-workspace edge — the foreign aggregate's id +
     // the foreign workspace id (from a sibling field). NOT an atomic FK: it does not clone/open the other
-    // holon; `resolve`/`watch` open it ON DEMAND over a realm (openRealm's `.workspace(ws)` surface).
-    // The reader `resolve`/`watch`/`attest` need: the multi-workspace `.workspace(ws)` surface `openRealm()`
-    // returns (a plain `connect()` holon is single-workspace — pass a Realm). `attestForeign` is the attested-
-    // read extension (present only when your law declares `trustSource` + `.readsFrom`). ANY object with this
-    // shape works — the generated client is import-free and binds structurally to your @githolon/client.
-    `export interface NomosForeignReader { workspace(ws: string): { queryById(id: string): Promise<{ type: string; id: string; data: unknown }[]>; watchById?(id: string, cb: (rows: { type: string; id: string; data: unknown }[]) => void, opts?: { intervalMs?: number }): () => void }; attestForeign?(workspace: string, id: string, type: string): Promise<{ id: string; workspace: string; exists: boolean; attestation: string }>; }`,
+    // holon; `resolve`/`watch` use the application's captured shared-plane navigator.
+    // The reader is captured by the generated application. Tenant code receives navigation, never a reader.
+    `interface _NomosForeignWorkspace { queryById(id: string): Promise<unknown>; watchById?(id: string, cb: (rows: unknown) => void, opts?: { intervalMs?: number }): () => void }`,
+    `interface NomosForeignReader { __nomosOpenChild?(workspace: string): Promise<_NomosForeignWorkspace> }`,
+    `async function _openForeign(nomos: NomosForeignReader, workspace: string): Promise<_NomosForeignWorkspace> {`,
+    `  if (nomos.__nomosOpenChild === undefined) throw new Error("Nomos cannot follow this business reference on the installed runtime");`,
+    `  return nomos.__nomosOpenChild(workspace);`,
+    `}`,
+    `function _foreignRow<TAggregate>(workspace: string, row: { type: string; id: string; data: unknown }): NomosRecord<TAggregate> {`,
+    `  return { ...(row.data as object), ref: _nmsRef<TAggregate>(workspace, row.type, row.id) } as NomosRecord<TAggregate>;`,
+    `}`,
     // resolve() collapses "not there" to undefined for the 99% lookup; resolveResult() names WHY — a foreign
     // read can come back empty because the target does not exist, you lack read access, or the holon is
     // unreachable, and those are very different. `denied`/`unreachable` are best-effort from the reader's
     // error (an error whose message mentions auth/permission/forbidden ⇒ denied; else unreachable).
-    `export type ForeignResolveResult<TData> = { status: "found"; row: Row<TData> } | { status: "not-found" } | { status: "denied"; error: unknown } | { status: "unreachable"; error: unknown };`,
+    `export type ForeignResolveResult<TAggregate> = { status: "found"; row: NomosRecord<TAggregate> } | { status: "not-found" } | { status: "denied"; error: unknown } | { status: "unreachable"; error: unknown };`,
     // A ForeignRef is a TYPED CROSS-WORKSPACE LOCATOR, not an atomic FK. In ~99% of cases you use it as a
     // lookup — `resolve`/`watch` open the foreign holon on demand so you can do more reads. `exists` is the
-    // cheap "is the target still there?" check. `attest` is the LAW-GRADE one — signed evidence that the
-    // reference resolves — and only works when your law DECLARES the dependency (`trustSource` + a
-    // `.readsFrom(...)` on the directive); it is deliberately NOT a free method, because attesting has cost
-    // and law meaning. Resolving/existence are informational; attestation is what you reach for when the
-    // current workspace's LAW depends on the foreign fact.
-    `export interface ForeignRef<TData> {`,
-    `  /** The foreign aggregate's id (this field's stored value). */`,
-    `  readonly id: string;`,
-    `  /** The foreign workspace id (from the declared sibling workspace field). */`,
+    // cheap "is the target still there?" check. Law-grade evidence is obtained privately when a declared
+    // business action needs it; it is not a callable tenant capability.
+    `export interface ForeignRef<TAggregate> {`,
     `  readonly workspace: string;`,
-    `  /** The foreign aggregate type this locator points at. */`,
     `  readonly type: string;`,
+    `  readonly id: string;`,
+    `  /** The same locator as the one canonical aggregate-typed reference. */`,
+    `  readonly ref: NomosRef<TAggregate>;`,
     `  /** THE LOOKUP (the 99% case): open the foreign workspace + read the target by id — on demand, no clone.`,
     `   *  Returns undefined for ANY empty outcome; use resolveResult() when you need to know WHY. */`,
-    `  resolve(nomos: NomosForeignReader): Promise<Row<TData> | undefined>;`,
+    `  resolve(): Promise<NomosRecord<TAggregate> | undefined>;`,
     `  /** The lookup with the OUTCOME named — found / not-found / denied / unreachable (a foreign read can be`,
     `   *  empty for very different reasons; do not collapse them when it matters). */`,
-    `  resolveResult(nomos: NomosForeignReader): Promise<ForeignResolveResult<TData>>;`,
+    `  resolveResult(): Promise<ForeignResolveResult<TAggregate>>;`,
     `  /** Subscribe to the target's read model across the workspace boundary (returns an unsubscribe fn). */`,
-    `  watch(nomos: NomosForeignReader, cb: (row: Row<TData> | undefined) => void, opts?: { intervalMs?: number }): () => void;`,
+    `  watch(cb: (row: NomosRecord<TAggregate> | undefined) => void, opts?: { intervalMs?: number }): () => void;`,
     `  /** Cheap existence check — does the referenced target still exist? (found ⇒ true; anything else ⇒ false). */`,
-    `  exists(nomos: NomosForeignReader): Promise<boolean>;`,
-    `  /** LAW-GRADE: signed evidence that the reference resolves, for when your law DEPENDS on the foreign fact.`,
-    `   *  Requires the attested-read lane — declare \`trustSource(workspace, ...)\` + \`.readsFrom(...)\` on the`,
-    `   *  directive; without it (no \`attestForeign\` on the reader) this throws, by design (a locator is not an FK). */`,
-    `  attest(nomos: NomosForeignReader): Promise<{ id: string; workspace: string; exists: boolean; attestation: string }>;`,
+    `  exists(): Promise<boolean>;`,
     `}`,
-    `/** Build a typed foreign-ref locator from a row's id + workspace-id values. The generated \`<domain>ForeignRefs\` factory calls this with the declared fields. */`,
-    `export function foreignRef<TData>(type: string, id: string, workspace: string): ForeignRef<TData> {`,
+    `/** Build a typed foreign-ref locator behind the generated application. Navigation and workspace`,
+    ` *  selection are captured here and never become application arguments. */`,
+    `function foreignRef<TAggregate>(nomos: NomosForeignReader, type: string, id: string, workspace: string): ForeignRef<TAggregate> {`,
     `  return {`,
-    `    id, workspace, type,`,
-    `    async resolveResult(nomos) {`,
+    `    workspace, type, id,`,
+    `    ref: _nmsRef<TAggregate>(workspace, type, id),`,
+    `    async resolveResult() {`,
     `      if (!id || !workspace) return { status: "not-found" };`,
     `      try {`,
-    `        const rows = await nomos.workspace(workspace).queryById(id);`,
-    `        const row = (rows.find((r) => r.id === id) ?? rows[0]) as Row<TData> | undefined;`,
-    `        return row !== undefined ? { status: "found", row } : { status: "not-found" };`,
+    `        const rows = await (await _openForeign(nomos, workspace)).queryById(id) as { type: string; id: string; data: unknown }[];`,
+    `        const raw = rows.find((r) => r.id === id) ?? rows[0];`,
+    `        return raw !== undefined ? { status: "found", row: _foreignRow<TAggregate>(workspace, raw) } : { status: "not-found" };`,
     `      } catch (error) {`,
     `        const m = String((error as { message?: unknown })?.message ?? error).toLowerCase();`,
     `        return { status: /forbid|denied|permission|unauthor|not permitted|403|401/.test(m) ? "denied" : "unreachable", error };`,
     `      }`,
     `    },`,
-    `    async resolve(nomos) { const r = await this.resolveResult(nomos); return r.status === "found" ? r.row : undefined; },`,
-    `    watch(nomos, cb, opts) {`,
-    `      const w = nomos.workspace(workspace).watchById;`,
-    `      if (!w || !id || !workspace) { cb(undefined); return () => {}; }`,
-    `      return w(id, (rows) => cb((rows.find((r) => r.id === id) ?? rows[0]) as Row<TData> | undefined), opts);`,
-    `    },`,
-    `    async exists(nomos) { return (await this.resolveResult(nomos)).status === "found"; },`,
-    `    async attest(nomos) {`,
-    `      if (!nomos.attestForeign) throw new Error("attest() needs the attested-read lane — declare trustSource(" + JSON.stringify(workspace) + ", …) + .readsFrom(…) on the directive whose law depends on this reference (a foreignRef is a locator, not an atomic foreign key)");`,
-    `      return nomos.attestForeign(workspace, id, type);`,
+    `    async resolve() { const r = await this.resolveResult(); return r.status === "found" ? r.row : undefined; },`,
+    `    watch(cb, opts) {`,
+    `      if (!id || !workspace) { cb(undefined); return () => {}; }`,
+    `      let stopped = false; let stop = () => {};`,
+    `      void _openForeign(nomos, workspace).then((foreign) => {`,
+    `        if (stopped) return; const watch = foreign.watchById;`,
+    `        if (watch === undefined) { cb(undefined); return; }`,
+    `        stop = watch(id, (value) => { const rows = value as { type: string; id: string; data: unknown }[]; const raw = rows.find((r) => r.id === id) ?? rows[0]; cb(raw === undefined ? undefined : _foreignRow<TAggregate>(workspace, raw)); }, opts);`,
+    `      }).catch(() => { if (!stopped) cb(undefined); });`,
+    `      return () => { stopped = true; stop(); };`,
     `    },`,
+    `    async exists() { return (await this.resolveResult()).status === "found"; },`,
     `  };`,
     `}`,
     ``,
@@ -1305,14 +1474,14 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           `export interface SurfacedPending<T> { __surfaced: { status: "pending"; pending: SurfacedObservation<T>[] } }`,
           `/** A retained value authored under a different field contract. Nomos withholds the value`,
           ` *  until a declared deterministic evolution can produce the current generated type. */`,
-          `export interface SurfacedEvolutionRequired { __surfaced: { status: "evolutionRequired"; targetSchema: string; evolution: { sourceSchemas: string[]; authoredUnder: string[] } } }`,
+          `export interface SurfacedEvolutionRequired { __surfaced: { status: "evolutionRequired"; reason?: string } }`,
           `/** A Surfaced field's read value: resolved, pending, or awaiting schema evolution. */`,
           `export type SurfacedValue<T> = T | SurfacedPending<T> | SurfacedEvolutionRequired;`,
           `/** True iff \`v\` is the pending-conflict envelope (narrows to [SurfacedPending]). */`,
-          `export function isSurfacedPending<T>(v: SurfacedValue<T> | null | undefined): v is SurfacedPending<T> {`,
+          `function isSurfacedPending<T>(v: SurfacedValue<T> | null | undefined): v is SurfacedPending<T> {`,
           `  return typeof v === "object" && v !== null && (v as { __surfaced?: { status?: unknown } }).__surfaced?.status === "pending";`,
           `}`,
-          `export function isSurfacedEvolutionRequired<T>(v: SurfacedValue<T> | null | undefined): v is SurfacedEvolutionRequired {`,
+          `function isSurfacedEvolutionRequired<T>(v: SurfacedValue<T> | null | undefined): v is SurfacedEvolutionRequired {`,
           `  return typeof v === "object" && v !== null && (v as { __surfaced?: { status?: unknown } }).__surfaced?.status === "evolutionRequired";`,
           `}`,
           `/** ONE row of Nomos's maintained conflict index (reserved id \`nomosPendingConflicts\`):`,
@@ -1320,7 +1489,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           ` *  (fold-time, O(pending) to read) and DERIVED, NOT DRAINED — a resolution write folding in removes`,
           ` *  the row by derivation. The workspace-wide surface is HETEROGENEOUS, so each observation's`,
           ` *  \`value\` is \`unknown\` here — the per-field typed seam stays on the read models (\`SurfacedValue<T>\`). */`,
-          `export interface PendingConflictRow {`,
+          `interface PendingConflictRow {`,
           `  aggregateType: string;`,
           `  aggregateId: string;`,
           `  field: string;`,
@@ -1336,9 +1505,10 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           `export interface ConflictSummary {`,
           `  total: number;`,
           `  ready: number;`,
-          `  evolutionRequired: number;`,
+          `  modelUpdatesRequired: number;`,
           `  byAggregate: Readonly<Record<string, number>>;`,
           `}`,
+          `interface _NomosRawConflictSummary { total: number; ready: number; evolutionRequired: number; byAggregate: Readonly<Record<string, number>> }`,
           ``,
         ]
       : []),
@@ -1347,7 +1517,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     `export interface NomosMoment {`,
     `  readonly id: string;`,
     `  readonly occurredAt: string | null;`,
-    `  readonly actorSubject: string | null;`,
+    `  readonly performedBy: string | null;`,
     `  readonly domain: string | null;`,
     `  readonly action: string | null;`,
     `}`,
@@ -1356,31 +1526,36 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           `/** Result of a reasoned business correction. Framework target and testimony ids remain private. */`,
           `export interface NomosCorrectionOutcome {`,
           `  readonly ok: boolean; readonly kind: "undo" | "redo";`,
-          `  readonly reason?: string; readonly message?: string; readonly head?: string;`,
+          `  readonly reason?: string; readonly message?: string;`,
           `}`,
         ]
       : []),
     `/** Read-only primitive used behind the generated, business-shaped historic view. */`,
-    `export interface NomosHistoricHolon {`,
+    `interface NomosHistoricHolon {`,
     `  query(queryId: string, params?: Record<string, unknown>, keys?: unknown): Promise<unknown>;`,
     `  queryById(aggregateId: string, keys?: unknown): Promise<unknown>;`,
     `  count(countId: string, groupKey?: string): Promise<number>;`,
     `  sum(sumId: string, groupKey?: string): Promise<number>;`,
     `}`,
     `/** The holon surface this client binds to (structurally satisfied by @githolon/client). */`,
-    `export interface NomosHolon {`,
+    `interface NomosHolon {`,
     `  /** THE ONE ENCODER offer (the single v2-envelope codec lives in @githolon/client \`encodeIntentOfferBytes\`):`,
     `   *  hand the holon a PLANNED directive + the verified \`actor\`; the holon encodes + offers. The generated`,
     `   *  client calls THIS, never building offer bytes itself — so there is exactly ONE copy of the wire format. */`,
-    `  offerDirective(domain: string, directiveId: string, payload: unknown, opts?: { domainHash?: string; actor?: string; returnCreated?: boolean; attestations?: readonly { queryId: string; result: unknown; attestation: unknown }[] }): Promise<string | { head: string; created?: { type: string; id: string }[]; workspace?: string; born?: unknown; birthOutcomes?: unknown }>;`,
+    `  offerDirective(domain: string, directiveId: string, payload: unknown, opts?: { domainHash?: string; actor?: string; returnCreated?: boolean; attestations?: readonly { queryId: string; result: unknown; attestation: unknown }[] }): Promise<string | { head: string; created?: { type: string; id: string }[]; affected?: { type: string; id: string }[]; workspace?: string; born?: unknown; birthOutcomes?: unknown }>;`,
+    ...(sourceTrustPresent
+      ? [
+          `  /** FRAMEWORK-INTERNAL: obtain the source workspace's signed answer. Generated business`,
+          `   *  actions privately establish trust and carry it; application code never receives this seam. */`,
+          `  fetchAttestedRead(from: string, queryId: string, args?: Record<string, unknown>): Promise<{ queryId: string; result: unknown; attestation: unknown }>;`,
+        ]
+      : []),
     ...(hasCorrections
       ? [
           `  /** Framework-private seam used by generated \`corrections\`; apps never supply an intent id. */`,
           `  correctMostRecent?(opts: { kind: "undo" | "redo"; domain: string; actions: string[]; reason: string; domainHash?: string; actor?: string }): Promise<NomosCorrectionOutcome>;`,
         ]
       : []),
-    `  /** Opaque-bytes offer — retained for carriers that already hold an encoded envelope (back-compat). */`,
-    `  offer(intentBytes: string | Uint8Array): Promise<string>;`,
     ...(hasBirths
       ? [
           `  /** BIRTH A CHILD WORKSPACE (a signed CROSS-WORKSPACE governance offer to \`parent\`) — OPTIONAL:`,
@@ -1401,6 +1576,8 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       : []),
     `  /** FRAMEWORK-INTERNAL verified child graph. Generated describe() exposes only business-safe links. */`,
     `  __nomosChildWorkspaces?(): Promise<readonly { workspace: string; status: "active" | "retired" | "reclaimed" | "unknown"; bornAt: string | null }[]>;`,
+    `  /** FRAMEWORK-INTERNAL child navigation captured by generated description links. */`,
+    `  __nomosOpenChild?(workspace: string): Promise<NomosHolon>;`,
     `  /** FRAMEWORK-INTERNAL exact-history adoption seam. Generated clients expose only`,
     `   *  \`model.adopt()\` and a chained \`decision.accept(reason)\`. */`,
     `  __nomosAdoptModel?(domain: string, candidateHash: string, opts?: { because?: string }): Promise<__NomosModelAdoptionWire>;`,
@@ -1425,6 +1602,10 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           `   *  (bound to the scope + stable sids). OPTIONAL: structural binding tolerates a pre-sealing holon`,
           `   *  (the write path then throws with an upgrade hint before any plaintext dispatch). */`,
           `  cryptoSealField?(args: { scopeKey: string; scope: string; epoch: number; aggSid: string; fieldSid: string; plaintext: string }): Promise<string>;`,
+          `  /** FRAMEWORK-INTERNAL: current held key for an ordinary law-declared encryption scope. */`,
+          `  __nomosScopeKey?(args: { scope: string }): Promise<NomosScopeKey | undefined>;`,
+          `  /** FRAMEWORK-INTERNAL: every held epoch for ordinary law-declared encryption scopes. */`,
+          `  __nomosScopeKeys?(args: { scopes: readonly string[] }): Promise<NomosScopeKey[]>;`,
           `  /** FRAMEWORK-INTERNAL: derive an owned aggregate's current record key from this session's private custody. */`,
           `  __nomosOwnedScopeKey?(args: { scope: string; record?: { type: string; id: string } }): Promise<NomosScopeKey>;`,
           `  /** FRAMEWORK-INTERNAL: every held key epoch for one record, including shared and rotated history. */`,
@@ -1434,7 +1615,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           `  /** FRAMEWORK-INTERNAL: atomically enable the opt-in recovery policy. */`,
           `  __nomosProtectOwnedIdentity?(args: { scope: string; domain: string; domainHash?: string; recoveryPrincipal: string }): Promise<{ status: "protected"; recoveryPrincipal: string; unchanged?: boolean }>;`,
           `  /** FRAMEWORK-INTERNAL: prepare the atomic law payload behind share/unshare/transfer. */`,
-          `  __nomosPrepareOwnedRecordAction?(args: { action: "share" | "unshare" | "transfer"; scope: string; record: NomosRef; peer: string }): Promise<Record<string, unknown>>;`,
+          `  __nomosPrepareOwnedRecordAction?(args: { action: "share" | "unshare" | "transfer"; scope: string; record: NomosRef<_NomosAnyAggregate>; peer: string }): Promise<Record<string, unknown>>;`,
           `  /** FRAMEWORK-INTERNAL: derive the deterministic unborn child's owned key before atomic genesis. */`,
           `  __nomosOwnedBirthScopeKey?(args: { scope: string; namespace: string; key: unknown }): Promise<NomosScopeKey & { workspace: string }>;`,
           ...(ownedPresent
@@ -1465,7 +1646,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           `   *  OPTIONAL member: structural binding tolerates a pre-Surfaced holon (the accessor throws at call). */`,
           `  pendingConflicts?(aggregateType?: string): Promise<PendingConflictRow[]>;`,
           `  /** Counts-only workspace view; competing business values do not cross this call. */`,
-          `  pendingConflictSummary?(): Promise<ConflictSummary>;`,
+          `  pendingConflictSummary?(): Promise<_NomosRawConflictSummary>;`,
         ]
       : []),
     `  /** Declared-count / declared-sum O(1) reads (maintained by the read engine). */`,
@@ -1522,7 +1703,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     `/** THE LIVE COMPAT VERDICT (#72b) stashed on \`holon.compat\`. \`verdict\` is the three-state roll-up;`,
     ` *  \`members\` names each directive/aggregate's own \`{ ok, reason? }\`; \`install\` is the deployed law's`,
     ` *  lifecycle phase. \`has(id)\` = the feature flag; \`refresh()\` re-evaluates against the projection. */`,
-    `export interface NomosCompatVerdict {`,
+    `interface NomosCompatVerdict {`,
     `  generatedFor: string;`,
     `  workspaceRuns: string[];`,
     `  matches: boolean;`,
@@ -1537,11 +1718,11 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     ``,
     `/** AUTHORITY IS UNFORGEABLE-BY-CONSTRUCTION: a GATED directive (one carrying a \`.requires(relation)\` write`,
     ` *  gate) authored with NO \`actor\` cannot produce an offer — it throws THIS before any submit, so an`,
-    ` *  actorless gated offer is impossible to GENERATE, never merely refused at the kernel gate. Bind the`,
-    ` *  client with \`{ actor }\` (the verified principal) to author a gated directive. */`,
-    `export class MissingOfferAuthority extends Error {`,
+    ` *  actorless gated offer is impossible to GENERATE, never merely refused at the kernel gate. The`,
+    ` *  verified principal comes only from the signed-in application session. */`,
+    `class MissingOfferAuthority extends Error {`,
     `  constructor(readonly domain: string, readonly directiveId: string, readonly requires: string) {`,
-    `    super(\`\${domain}/\${directiveId} requires the "\${requires}" relation — bind the client with { actor } (the verified principal) to author it; a gated offer cannot be made without an authority\`);`,
+    `    super(\`\${domain}/\${directiveId} requires the "\${requires}" relation, but the signed-in application session has no verified principal; reopen the generated application after sign-in\`);`,
     `    this.name = "MissingOfferAuthority";`,
     `  }`,
     `}`,
@@ -1555,14 +1736,14 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     out.push(
       `/** A verified principal identity (\`user:<uid>\` on the wire) — construct with [nomosPrincipal]. A distinct`,
       ` *  branded type from [NomosDeviceSecret] so the two birth-method params can never be transposed. */`,
-      `export type NomosPrincipal = string & { readonly __nomosPrincipal: unique symbol };`,
+      `type NomosPrincipal = string & { readonly __nomosPrincipal: unique symbol };`,
       `/** A device signing secret (base64) — construct with [nomosDeviceSecret]. Distinct from [NomosPrincipal]. */`,
-      `export type NomosDeviceSecret = string & { readonly __nomosDeviceSecret: unique symbol };`,
+      `type NomosDeviceSecret = string & { readonly __nomosDeviceSecret: unique symbol };`,
       `/** Brand a principal: a bare uid (\`ada\`) or a wire string (\`user:ada\`) → \`user:ada\`. */`,
-      `export const nomosPrincipal = (uidOrWire: string): NomosPrincipal =>`,
+      `const nomosPrincipal = (uidOrWire: string): NomosPrincipal =>`,
       `  (uidOrWire.startsWith("user:") ? uidOrWire : \`user:\${uidOrWire}\`) as NomosPrincipal;`,
       `/** Brand a device signing secret (base64). */`,
-      `export const nomosDeviceSecret = (base64: string): NomosDeviceSecret => base64 as NomosDeviceSecret;`,
+      `const nomosDeviceSecret = (base64: string): NomosDeviceSecret => base64 as NomosDeviceSecret;`,
       ``,
     );
   }
@@ -1575,7 +1756,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       ``,
       `/** Per directive: which payload fields seal → their { scope, aggSid, fieldSid }. Per aggregate: which`,
       ` *  read-model fields are encrypted (+ their scope). Keyed by domain. */`,
-      `export const ${encConst} = ${JSON.stringify(encMap)} as const;`,
+      `const ${encConst} = ${JSON.stringify(encMap)} as const;`,
       ``,
       `/** A held scope key: the base64 symmetric key + the epoch it belongs to (forward-only rotation). */`,
       `${manualEncryptionPresent ? "export " : ""}interface NomosScopeKey { scope: string; epoch: number; key: string; ownedKeySubject?: string; ownedCustody?: string }`,
@@ -1589,10 +1770,9 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       `const _OWNED_CUSTODY_PAYLOAD_FIELD = ${JSON.stringify(OWNED_CUSTODY_PAYLOAD_FIELD)};`,
       `const _OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD = ${JSON.stringify(OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD)};`,
       ``,
-      `/** The app-supplied KEY CUSTODY surface. Supply one to \`<domain>Client(holon, { keyStore })\` and the`,
-      ` *  generated methods seal writes + decrypt reads automatically. \`wrappedKeyStore\` is the default over`,
-      ` *  the on-chain WrappedKeys; an app may implement this to source keys from a secure enclave. */`,
-      `${manualEncryptionPresent ? "export " : ""}interface NomosKeyStore {`,
+      `/** Framework-private key custody used by generated methods. The connected client owns device`,
+      ` *  credentials, wrapped-key discovery and all epochs; applications never supply this object. */`,
+      `interface NomosKeyStore {`,
       `  /** The CURRENT (highest-epoch) scope key, for SEALING a write. undefined ⇒ EncryptionKeyUnavailable. */`,
       `  scopeKey(scope: string): Promise<NomosScopeKey | undefined>;`,
       `  /** EVERY held key for these scopes (all epochs), injected on reads so old ciphertext also decrypts. */`,
@@ -1610,8 +1790,8 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       `  }`,
       `}`,
       ``,
-      `/** Seal the mapped encrypted fields of a payload before dispatch. No keyStore / \`seal:false\` ⇒ passthrough`,
-      ` *  (today's behavior). A held key seals; a missing key throws EncryptionKeyUnavailable (never plaintext). */`,
+      `/** Seal mapped encrypted fields before dispatch. A held key seals; a missing key throws`,
+      ` *  EncryptionKeyUnavailable and never falls through to plaintext. */`,
       `const _sealFields = async (`,
       `  holon: NomosHolon,`,
       `  keyStore: NomosKeyStore | undefined,`,
@@ -1672,7 +1852,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       ``,
       `/** Owned multi-row reads stay business-shaped: first fetch the authorized ciphertext rows locally,`,
       ` *  derive only those record keys, then repeat the same local indexed read with decryption injected. */`,
-      `const _readWithOwnedKeys = async <T extends { type: string; id: string }>(`,
+      `const _readWithOwnedKeys = async <T>(`,
       `  holon: NomosHolon,`,
       `  keyStore: NomosKeyStore | undefined,`,
       `  scopes: readonly { scope: string; owned?: true }[],`,
@@ -1681,13 +1861,17 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       `  const firstKeys = await _readKeys(holon, keyStore, scopes);`,
       `  const first = await read(firstKeys);`,
       `  if (!scopes.some((scope) => scope.owned === true) || first.length === 0) return first;`,
-      `  const keys = await _readKeys(holon, keyStore, scopes, first.map(({ type, id }) => ({ type, id })));`,
+      `  const records = first.map((row) => {`,
+      `    const raw = row as T & { type: string; id: string };`,
+      `    return { type: raw.type, id: raw.id };`,
+      `  });`,
+      `  const keys = await _readKeys(holon, keyStore, scopes, records);`,
       `  return read(keys);`,
       `};`,
       ``,
       `/** Reactive owned reads use the exact same two-pass, record-key-aware read as one-shot reads.`,
       ` *  The raw watch is only a local change signal; ciphertext rows never reach application callbacks. */`,
-      `const _watchWithOwnedKeys = <T extends { type: string; id: string }>(`,
+      `const _watchWithOwnedKeys = <T>(`,
       `  subscribe: (changed: () => void) => () => void,`,
       `  read: () => Promise<T[]>,`,
       `  cb: (rows: T[]) => void,`,
@@ -1712,37 +1896,6 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       `};`,
       ``,
       ...(manualEncryptionPresent ? [
-      `/** THE DEFAULT KeyStore — unwraps this principal's on-chain WrappedKeys with its device secret, caching`,
-      ` *  per scope. Mirror of the documented reader handshake (e2e_encryption.md): the secret stays client-side,`,
-      ` *  the operator stays blind. Key custody (where \`deviceSecret\` lives) remains the app's concern. */`,
-      `export function wrappedKeyStore(opts: { holon: NomosHolon; principal: string; deviceSecret: string }): NomosKeyStore {`,
-      `  const { holon, principal, deviceSecret } = opts;`,
-      `  const cache = new Map<string, Promise<NomosScopeKey[]>>();`,
-      `  const loadScope = (scope: string): Promise<NomosScopeKey[]> => {`,
-      `    let p = cache.get(scope);`,
-      `    if (p !== undefined) return p;`,
-      `    p = (async () => {`,
-      `      const rows = (await holon.query("wrappedKeysByRecipient", { recipientPrincipal: principal })) as { data?: Record<string, unknown> }[];`,
-      `      const held: NomosScopeKey[] = [];`,
-      `      for (const row of rows ?? []) {`,
-      `        const d = (row.data ?? row) as Record<string, unknown>;`,
-      `        if (String(d.scope) !== scope) continue;`,
-      `        if (!holon.cryptoUnwrapKey) throw new Error("this holon predates E2E unwrap — upgrade @githolon/client");`,
-      `        const key = await holon.cryptoUnwrapKey({ secret: deviceSecret, hpkeEpk: String(d.hpkeEpk), ct: String(d.ct) });`,
-      `        held.push({ scope, epoch: Number(d.epoch) || 0, key });`,
-      `      }`,
-      `      held.sort((a, b) => b.epoch - a.epoch);`,
-      `      return held;`,
-      `    })();`,
-      `    cache.set(scope, p);`,
-      `    return p;`,
-      `  };`,
-      `  return {`,
-      `    async scopeKey(scope) { return (await loadScope(scope))[0]; },`,
-      `    async readKeys(scopes) { const all: NomosScopeKey[] = []; for (const s of scopes) all.push(...(await loadScope(s))); return all; },`,
-      `  };`,
-      `}`,
-      ``,
       `// ── E2E OWNER CEREMONY (the sealing client, slice 2) — grantAndWrap / revokeAndRotate / rotate ──`,
       `// The owner-side twin of the KeyStore. It composes the framework key-epoch fan-out (\`advanceKeyEpoch\`,`,
       `// dispatched by its REAL id — never an \`export const alias\`) with the domain's own grant/revoke`,
@@ -1775,7 +1928,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       `/** Thrown when the resolved roster != the caller's declared \`expectRoster\` BEFORE dispatch — pre-firing`,
       ` *  the kernel fan-out gate (wrap set == roster) so a rotation against a stale roster view never spends`,
       ` *  an epoch on the chain. */`,
-      `export class EncryptionRosterMismatch extends Error {`,
+      `class EncryptionRosterMismatch extends Error {`,
       `  readonly code = "nomos.crypto.roster_mismatch";`,
       `  readonly recommendedAction = "reconcileRoster";`,
       `  constructor(readonly scope: string, readonly missing: readonly string[], readonly extra: readonly string[]) {`,
@@ -1787,7 +1940,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       `/** The owner-ceremony surface — attached as \`<domain>Client(holon, { actor }).encryption\`. All three`,
       ` *  verbs open a FRESH epoch (a fresh 32-byte secret) and fan the wraps to the resolved roster; the`,
       ` *  membership change (if any) is the domain grant/revoke dispatched first, in the same call. */`,
-      `export interface NomosEncryption {`,
+      `interface NomosEncryption {`,
       `  /** The encryption scopes this domain defines (each a \`requires(cap)\`). */`,
       `  readonly scopes: readonly string[];`,
       `  /** The CURRENT roster of a scope (active direct-grant members, principal-form). Defaults to the sole scope. */`,
@@ -1906,6 +2059,11 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     );
   }
 
+  const aggByType = new Map<string, AggregateHandle>();
+  for (const mod of modules) {
+    for (const agg of mod.aggregates as AggregateHandle[]) aggByType.set(agg.id, agg);
+  }
+
   const anyAutoStamp = modules.some((mod) =>
     (mod.directives as Directive<unknown>[]).some(
       (d) =>
@@ -1918,21 +2076,128 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     out.push(
       `/** Caller-side clock sugar: fill omitted \`…At\` timestamp payload fields with ISO now().`,
       ` *  The stamp rides IN the payload, so plans stay pure and replay byte-identical. */`,
-      `const stampNow = <T extends object>(payload: T, fields: string[]): T => {`,
+      `const stampNow = <T extends object, const K extends string>(payload: T, fields: readonly K[]): T & Record<K, string> => {`,
       `  const now = new Date().toISOString();`,
       `  const out = { ...payload } as Record<string, unknown>;`,
       `  for (const f of fields) if (out[f] === undefined) out[f] = now;`,
+      `  return out as T & Record<K, string>;`,
+      `};`,
+      ``,
+    );
+  }
+
+  const anyPrincipalBinding = modules.some((mod) =>
+    (mod.directives as Directive<unknown>[]).some((directive) => directive.businessPrincipalField !== undefined),
+  );
+  if (anyPrincipalBinding) {
+    out.push(
+      `/** Bind identity from the verified application session. Tenant facts can never impersonate another principal. */`,
+      `const _nmsBindCurrentPrincipal = <T extends object>(payload: T, field: string, principal: string | undefined): T & Record<string, string> => {`,
+      `  if (!principal || !principal.trim()) throw new Error("this action needs a signed-in Nomos application");`,
+      `  return { ...payload, [field]: principal };`,
+      `};`,
+      ``,
+    );
+  }
+
+  const anyRecipientPayload = modules.some((mod) =>
+    (mod.directives as Directive<unknown>[]).some((directive) => {
+      const birth = (directive as { businessBirth?: { publicPayloadSchema?: z.ZodTypeAny } }).businessBirth;
+      const schema = birth?.publicPayloadSchema ?? (directive as { payloadSchema?: z.ZodTypeAny }).payloadSchema;
+      return schema !== undefined && zodKind(schema) === "object" &&
+        Object.values(zodObjectShape(schema)).some((field) => recipientMetaOf(field) !== undefined);
+    }),
+  );
+  // Every generated record accessor accepts NomosRef<T>, even when the domain has no ref-valued
+  // payload/query fields of its own. Keep the lowering/checker available for those accessors too.
+  {
+    out.push(
+      `/** Internal wire lowering: tenant inputs must carry genuine, workspace-bound business references;`,
+      ` *  law/query wires receive only their stable ids. Runtime checks preserve this boundary even from JS`,
+      ` *  or from TypeScript code that deliberately defeats the generated types. */`,
+      `const _nmsReferenceTypeMatches = (actual: string, expected: string): boolean =>`,
+      `  expected === "" || actual === expected || actual.endsWith("." + expected);`,
+      `const _nmsReferenceId = (value: unknown, expectedType: string, workspace: string, field: string): string => {`,
+      `  if (typeof value !== "object" || value === null) {`,
+      `    throw new TypeError(field + " must be a NomosRef returned by the generated application; plain record ids are not accepted");`,
+      `  }`,
+      `  const ref = value as { workspace?: unknown; type?: unknown; id?: unknown };`,
+      `  if (typeof ref.id !== "string" || ref.id.length === 0 || typeof ref.type !== "string" || ref.type.length === 0 || typeof ref.workspace !== "string" || ref.workspace.length === 0) {`,
+      `    throw new TypeError(field + " must carry a complete NomosRef { workspace, type, id }");`,
+      `  }`,
+      `  if (!_nmsReferenceTypeMatches(ref.type, expectedType)) {`,
+      `    throw new TypeError(field + " refers to " + ref.type + "; expected " + expectedType);`,
+      `  }`,
+      `  if (workspace !== "" && ref.workspace !== workspace) {`,
+      `    throw new TypeError(field + " belongs to workspace " + ref.workspace + "; this application is bound to " + workspace);`,
+      `  }`,
+      `  return ref.id;`,
+      `};`,
+      `const _nmsWireReferences = <T extends object>(payload: T, fields: Readonly<Record<string, string>>, workspace: string): T => {`,
+      `  const out = { ...payload } as Record<string, unknown>;`,
+      `  for (const [field, expectedType] of Object.entries(fields)) {`,
+      `    const value = out[field];`,
+      `    if (value !== undefined) out[field] = _nmsReferenceId(value, expectedType, workspace, field);`,
+      `  }`,
+      `  return out as T;`,
+      `};`,
+      ``,
+    );
+  }
+  if (anyRecipientPayload) {
+    out.push(
+      `const _nmsWireRecipients = <T extends object>(payload: T, fields: readonly string[]): T => {`,
+      `  const out = { ...payload } as Record<string, unknown>;`,
+      `  for (const field of fields) {`,
+      `    const value = out[field];`,
+      `    if (value !== undefined) out[field] = _nmsRecipientAddress(value, field);`,
+      `  }`,
       `  return out as T;`,
       `};`,
       ``,
     );
   }
 
+  if (sourceTrustPresent) {
+    out.push(
+      `/** Private dynamic-source composition. A business action names a source record; Nomos fetches its`,
+      ` *  signed answer, derives the portable source identity, seats the law-declared trust policy and`,
+      ` *  carries the envelope on the offer. None of these values are application arguments. */`,
+      `type _NomosAttestedEntry = { queryId: string; result: unknown; attestation: Record<string, unknown> };`,
+      `const _nmsAttestedEntry = (value: unknown): _NomosAttestedEntry => {`,
+      `  const raw = typeof value === "object" && value !== null && "entry" in value`,
+      `    ? (value as { entry?: unknown }).entry`,
+      `    : value;`,
+      `  if (typeof raw !== "object" || raw === null) throw new Error("Nomos source did not return an attested business record");`,
+      `  const entry = raw as { queryId?: unknown; result?: unknown; attestation?: unknown };`,
+      `  if (typeof entry.queryId !== "string" || typeof entry.attestation !== "object" || entry.attestation === null) {`,
+      `    throw new Error("Nomos source omitted its signed identity");`,
+      `  }`,
+      `  return entry as _NomosAttestedEntry;`,
+      `};`,
+      `const _nmsSourceGenesis = (entry: _NomosAttestedEntry): string => {`,
+      `  const value = entry.attestation.source_genesis;`,
+      `  if (typeof value !== "string" || value.length === 0) throw new Error("Nomos source omitted its genesis identity");`,
+      `  return value;`,
+      `};`,
+      `const _nmsSourceKeyHash = async (entry: _NomosAttestedEntry): Promise<string> => {`,
+      `  const publicKey = entry.attestation.public_key;`,
+      `  if (typeof publicKey !== "string" || publicKey.length === 0) throw new Error("Nomos source omitted its attestation key");`,
+      `  let bytes: Uint8Array;`,
+      `  try {`,
+      `    if (typeof atob === "function") bytes = Uint8Array.from(atob(publicKey), (character) => character.charCodeAt(0));`,
+      `    else bytes = Uint8Array.from((globalThis as unknown as { Buffer: { from(value: string, encoding: string): Uint8Array } }).Buffer.from(publicKey, "base64"));`,
+      `  } catch { throw new Error("Nomos source returned an invalid attestation key"); }`,
+      `  const digest = await crypto.subtle.digest("SHA-256", bytes as unknown as BufferSource);`,
+      `  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");`,
+      `};`,
+      ``,
+    );
+  }
+
   // ── read models: one interface per aggregate wire type (deduped), deriveds/combineds merged ──
-  const aggByType = new Map<string, AggregateHandle>();
   const extrasByType = new Map<string, string[]>();
   for (const mod of modules) {
-    for (const agg of mod.aggregates as AggregateHandle[]) aggByType.set(agg.id, agg);
     for (const d of (mod.deriveds ?? []) as DerivedDecl[]) {
       (extrasByType.get(d.of) ?? extrasByType.set(d.of, []).get(d.of)!).push(
         `  /** derived read field (engine-projected) */\n  ${d.id}?: ${tsTypeOfReturns(d.returns)};`,
@@ -1976,7 +2241,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     }
   }
 
-  // ── domain contracts: one `<Id>Contract` interface per public DTO shape, deduped across domains ──
+  // ── domain contracts: one stable public DTO interface per contract, deduped across domains ──
   const contractByIdTs = new Map<string, import("./contract.js").ContractHandle>();
   for (const mod of modules) {
     for (const c of ((mod as { contracts?: readonly import("./contract.js").ContractHandle[] }).contracts ?? [])) {
@@ -1986,7 +2251,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
   if (contractByIdTs.size > 0) {
     out.push(`// ── domain contracts (public DTO shapes — architecture/domain_contracts.md) ──`, ``);
     for (const [, c] of [...contractByIdTs].sort(([a], [b]) => a.localeCompare(b))) {
-      out.push(`export interface ${c.id}Contract {`);
+      out.push(`export interface ${contractTypeName(c.id)} {`);
       for (const [name, field] of Object.entries(c.fields)) {
         out.push(`  ${tsKey(name)}?: ${tsTypeOfField(field as Field)};`);
       }
@@ -2001,9 +2266,9 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
   // Every read accessor's rows get their canonical `.ref` stamped from `holon.workspace` (additive); a
   // foreignRef-declaring package ALSO hydrates its foreignRef fields into typed locators first.
   const wrapP = (expr: string): string =>
-    `_stampRefsP(holon.workspace, ${foreignRefFields.length > 0 ? `_hydrateP(${expr})` : expr})`;
+    `_businessRecordsP(_stampRefsP(holon.workspace, ${foreignRefFields.length > 0 ? `_hydrateP(holon, ${expr})` : expr}))`;
   const wrapRows = (expr: string): string =>
-    `_stampRefs(holon.workspace, ${foreignRefFields.length > 0 ? `_hydrateRows(${expr})` : expr})`;
+    `_businessRecords(_stampRefs(holon.workspace, ${foreignRefFields.length > 0 ? `_hydrateRows(holon, ${expr})` : expr}))`;
   // ATTRIBUTED READS (architecture/field_provenance.md): the shared provenance shape +
   // per-aggregate accessors — emitted ONLY when the package declares ≥1 `.attributed()`
   // field, so a provenance-free package's client is byte-identical (the era rule).
@@ -2040,7 +2305,12 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       );
     }
     for (const extra of extrasByType.get(typeId) ?? []) out.push(extra);
-    out.push(`}`, ``);
+    out.push(
+      `}`,
+      `/** Aggregate identity type for NomosRef<${typeId}>. The symbol brand never appears on the wire. */`,
+      `export type ${typeId} = ${typeId}Data & { readonly [_nomosAggregateType]?: ${JSON.stringify(typeId)} };`,
+      ``,
+    );
     if (attributed.length > 0) {
       const ns = camel(typeId);
       out.push(
@@ -2064,20 +2334,20 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     }
   }
   // MULTI-WORKSPACE LOCATOR FACTORY (t.foreignRef): per aggregate, a typed builder that turns a projection
-  // row into a `ForeignRef<TargetData>` — reading the foreign id (the field) + the foreign workspace id (the
+  // row into a `ForeignRef<TargetAggregate>` — reading the foreign id (the field) + the foreign workspace id (the
   // declared sibling field). The read model stays honest (the field is the raw stored id string); this gives
   // the TYPED locator with resolve/watch on top, without cloning the other holon.
   if (foreignRefFields.length > 0) {
     const byAgg = new Map<string, typeof foreignRefFields>();
     for (const f of foreignRefFields) { const l = byAgg.get(f.agg) ?? []; l.push(f); byAgg.set(f.agg, l); }
     out.push(`// ── foreign-ref locators (t.foreignRef): typed cross-workspace edges (resolve/watch on demand) ──`);
-    out.push(`export const ${camel(opts.packageName)}ForeignRefs = {`);
+    out.push(`const ${camel(opts.packageName)}ForeignRefs = {`);
     for (const [agg, fields] of [...byAgg].sort(([a], [b]) => a.localeCompare(b))) {
       out.push(`  ${agg}: {`);
       for (const f of fields) {
         out.push(
           `    /** \`${agg}.${f.field}\` → \`${f.target}\` in the workspace named by \`${f.workspaceField}\`. */`,
-          `    ${f.field}: (row: ${agg}Data): ForeignRef<${f.target}Data> => foreignRef(${JSON.stringify(f.target)}, String(row.${f.field} ?? ""), String((row as Record<string, unknown>)[${JSON.stringify(f.workspaceField)}] ?? "")),`,
+          `    ${f.field}: (nomos: NomosForeignReader, row: ${agg}Data): ForeignRef<${f.target}> => foreignRef(nomos, ${JSON.stringify(f.target)}, String(row.${f.field} ?? ""), String((row as Record<string, unknown>)[${JSON.stringify(f.workspaceField)}] ?? "")),`,
         );
       }
       out.push(`  },`);
@@ -2092,16 +2362,17 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     for (const f of foreignRefFields) { (hydrateSpecs[f.agg] ??= []).push({ field: f.field, wsField: f.workspaceField, target: f.target }); }
     out.push(
       `const _FOREIGN_REFS: Record<string, { field: string; wsField: string; target: string }[]> = ${JSON.stringify(hydrateSpecs)};`,
-      `function _hydrateRows<T>(rows: Row<T>[]): Row<T>[] {`,
+      `function _hydrateRows<T>(nomos: NomosForeignReader, rows: Row<T>[]): Row<T>[] {`,
       `  return rows.map((row) => {`,
-      `    const specs = _FOREIGN_REFS[row.type];`,
+      `    const raw = row as Row<T> & { type: string };`,
+      `    const specs = _FOREIGN_REFS[raw.type];`,
       `    if (specs === undefined || row.data == null) return row;`,
       `    const data: Record<string, unknown> = { ...(row.data as Record<string, unknown>) };`,
-      `    for (const s of specs) { const v = data[s.field]; if (typeof v === "string") data[s.field] = foreignRef(s.target, v, String(data[s.wsField] ?? "")); }`,
+      `    for (const s of specs) { const v = data[s.field]; if (typeof v === "string") data[s.field] = foreignRef(nomos, s.target, v, String(data[s.wsField] ?? "")); }`,
       `    return { ...row, data: data as T };`,
       `  });`,
       `}`,
-      `const _hydrateP = <T>(p: Promise<Row<T>[]>): Promise<Row<T>[]> => p.then(_hydrateRows);`,
+      `const _hydrateP = <T>(nomos: NomosForeignReader, p: Promise<Row<T>[]>): Promise<Row<T>[]> => p.then((rows) => _hydrateRows(nomos, rows));`,
       ``,
     );
   }
@@ -2115,17 +2386,22 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
   // plumbing — the composed workspace name comes back on the result for `connect()`.
   // PACKED child types derive NO holon-birth helper: a packed birth is a shard-map
   // PLACEMENT (slice 2's lane).
-  const birthModules = modules.filter(
-    (m) => m.workspaceTypes !== undefined && m.workspaceTypes.length > 0,
-  );
-  // THE FRONT-DOOR MINT PLAN (sharding slice 2; taxonomy packages ONLY — a
-  // taxonomy-free package's generated client is byte-identical to before this
-  // existed): routed `.creates` directives whose target id rides the payload mint
-  // it through the holon's kernel mint with the home's ROUTE TAG folded in
-  // (self-routing ids, §4); the derived placement directives mint the axis-root id.
+  // Taxonomy birth helpers used to be exported as free functions taking cloud/workspace/auth machinery.
+  // Keep that lane closed until each birth is surfaced through a declared business intent.
+  const birthModules: DomainModule[] = [];
+  // THE FRONT-DOOR MINT PLAN: any `.creates` directive whose target id rides the sealed payload gets that
+  // id minted INSIDE the generated client and omitted from application input. Taxonomy routes enrich the
+  // same plan with home/tag placement; there is still one mechanism and one returned NomosRef<T>.
   const mintPlans = new Map<DomainModule, Map<string, ClientMintPlanEntry>>();
-  for (const mod of birthModules) {
-    const plan = deriveClientMintPlan(
+  for (const mod of modules) {
+    const aggregates = new Map(mod.aggregates.map((aggregate) => [aggregate.id, aggregate]));
+    const generic = (mod.directives as Directive<unknown>[]).flatMap((directive): ClientMintPlanEntry[] => {
+      const aggregate = aggregates.get(directive.aggregateId);
+      if (aggregate === undefined) return [];
+      const field = mintedCreateField(directive, aggregate);
+      return field === undefined ? [] : [{ directive: directive.id, field, mintType: aggregate.id }];
+    });
+    const routed = deriveClientMintPlan(
       mod as {
         name: string;
         aggregates: AggregateHandle[];
@@ -2135,34 +2411,42 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
         workspaceTypes?: any[];
       },
     );
-    if (plan.length > 0) mintPlans.set(mod, new Map(plan.map((e) => [e.directive, e])));
+    const plan = new Map(generic.map((entry) => [entry.directive, entry]));
+    for (const entry of routed) plan.set(entry.directive, entry);
+    if (plan.size > 0) mintPlans.set(mod, plan);
   }
   if (mintPlans.size > 0) {
     out.push(
-      `// ── the front-door kernel mint (routed creates — ids are internal plumbing) ──`,
+      `// ── the front-door kernel mint (create ids are internal plumbing) ──`,
       ``,
-      `/** The ROUTED holon surface (@githolon/client with a taxonomy law): the kernel mint. */`,
-      `export interface NomosRoutedHolon extends NomosHolon {`,
+      `/** Framework minting surface used only inside generated create methods. */`,
+      `interface NomosMintingHolon extends NomosHolon {`,
       `  /** Reserve a kernel-minted typed id; \`homeKey\`/\`tagHex\` fold the home's route tag in. */`,
       `  mint(typeTag: string, opts?: { homeKey?: string; tagHex?: string }): Promise<string>;`,
       `}`,
       ``,
-      `/** The 48-bit route-tag slot of a kernel-minted id (the UUIDv7 leading 12 hex chars). */`,
-      `const routeTagOfId = (id: string): string | undefined => {`,
-      `  const i = id.indexOf("_");`,
-      `  if (i <= 0) return undefined;`,
-      `  const body = id.slice(i + 1).replace(/-/g, "").toLowerCase();`,
-      `  return /^[0-9a-f]{32}$/.test(body) ? body.slice(0, 12) : undefined;`,
-      `};`,
-      ``,
     );
+    const needsRouteTag = [...mintPlans.values()].some((plan) =>
+      [...plan.values()].some((entry) => entry.tagFromIdField !== undefined));
+    if (needsRouteTag) {
+      out.push(
+        `/** The 48-bit route-tag slot of a kernel-minted id (the UUIDv7 leading 12 hex chars). */`,
+        `const routeTagOfId = (id: string): string | undefined => {`,
+        `  const i = id.indexOf("_");`,
+        `  if (i <= 0) return undefined;`,
+        `  const body = id.slice(i + 1).replace(/-/g, "").toLowerCase();`,
+        `  return /^[0-9a-f]{32}$/.test(body) ? body.slice(0, 12) : undefined;`,
+        `};`,
+        ``,
+      );
+    }
   }
   if (birthModules.length > 0) {
     out.push(
       `// ── derived birth lanes (workspace taxonomy → the EXISTING platform lanes) ──`,
       ``,
       `/** Auth a birth presents — every birth needs a principal (the cloud's law). */`,
-      `export interface NomosBirthAuth {`,
+      `interface NomosBirthAuth {`,
       `  /** Auth-provider access token, sent as \`x-nomos-auth\` (verified by the cloud). */`,
       `  authToken?: string;`,
       `  /** Transitional bare principal uid, sent as \`x-nomos-principal\` (no token). */`,
@@ -2175,7 +2459,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       `}`,
       ``,
       `/** A birth lane's response — \`workspace\` is the born holon's addressable name. */`,
-      `export interface NomosBirthResult {`,
+      `interface NomosBirthResult {`,
       `  ok: boolean;`,
       `  /** The addressable workspace name (pass it to \`connect({ workspace })\`). */`,
       `  workspace?: string;`,
@@ -2298,11 +2582,21 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
 
   // ── payload types + per-domain client factories ──
   const usedPayloadNames = new Set<string>();
+  const usedResultNames = new Set<string>();
+  const applicationBirths: Array<{
+    sourceDomain: string;
+    method: string;
+    payloadName: string;
+    aggregateId: string;
+    targetDomain: string;
+    applicationType: string;
+  }> = [];
   for (const mod of modules) {
     const domain = mod.domain ?? mod.name;
     const dirs = (mod.directives as Directive<unknown>[]).filter(
       (d) => d && typeof d.id === "string" && typeof (d as { payloadSchema?: unknown }).payloadSchema === "object"
-        && (d as { businessBirthInternal?: unknown }).businessBirthInternal !== true,
+        && (d as { businessBirthInternal?: unknown }).businessBirthInternal !== true
+        && ((d as { birthsChild?: unknown }).birthsChild !== true || (d as { businessBirth?: unknown }).businessBirth !== undefined),
     );
     const correctionActions = dirs.filter((d) =>
       (d as { birthsChild?: unknown }).birthsChild !== true
@@ -2371,11 +2665,11 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     if (ownedScope !== undefined && Object.keys(ownedActions).length > 0) {
       methods.push(
         `    /** Share one record. The peer can read its history and future changes; Nomos owns the keys and policy. */`,
-        `    share: (record: NomosRef, peer: string): Promise<NomosOutcome> => _ownedRecordAction("share", record, peer),`,
+        `    share: (record: NomosRef<_NomosAnyAggregate>, peer: string): Promise<void> => _ownedRecordAction("share", record, peer),`,
         `    /** Stop sharing one record. Earlier knowledge cannot be erased; future changes use a fresh private key. */`,
-        `    unshare: (record: NomosRef, peer: string): Promise<NomosOutcome> => _ownedRecordAction("unshare", record, peer),`,
+        `    unshare: (record: NomosRef<_NomosAnyAggregate>, peer: string): Promise<void> => _ownedRecordAction("unshare", record, peer),`,
         `    /** Hand ownership, readable history and future authority for one record to another person. */`,
-        `    transfer: (record: NomosRef, peer: string): Promise<NomosOutcome> => _ownedRecordAction("transfer", record, peer),`,
+        `    transfer: (record: NomosRef<_NomosAnyAggregate>, peer: string): Promise<void> => _ownedRecordAction("transfer", record, peer),`,
       );
     }
     if (correctionActions.length > 0) {
@@ -2397,19 +2691,74 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     }
     // directiveId → its emitted payload TYPE name (the generated conflict references use it).
     const dirPayloadNames = new Map<string, string>();
+    const dirById = new Map(dirs.map((directive) => [directive.id, directive] as const));
     for (const d of dirs) {
-      let payloadName = `${cap(d.id)}Payload`;
-      if (usedPayloadNames.has(payloadName)) payloadName = `${cap(camel(domain))}${cap(d.id)}Payload`;
-      usedPayloadNames.add(payloadName);
-      dirPayloadNames.set(d.id, payloadName);
       const businessBirth = (d as unknown as {
         businessBirth?: { aggregateId: string; publicPayloadSchema: z.ZodTypeAny; rootId: string; namespace: string; keyField: string };
       }).businessBirth;
+      const inputSuffix = isBusinessIntent(d) || businessBirth !== undefined ? "Input" : "Payload";
+      const publicBusinessName = businessBirth !== undefined && !isBusinessIntent(d)
+        ? `Create${cap(camel(businessBirth.aggregateId))}Input`
+        : `${cap(d.id)}${inputSuffix}`;
+      let payloadName = publicBusinessName;
+      if (usedPayloadNames.has(payloadName)) payloadName = `${cap(camel(domain))}${publicBusinessName}`;
+      usedPayloadNames.add(payloadName);
+      dirPayloadNames.set(d.id, payloadName);
+      const businessBirthTargetDomain = businessBirth === undefined
+        ? undefined
+        : (() => {
+            const owners = [...new Set(aggregateOwners.get(businessBirth.aggregateId) ?? [])];
+            if (owners.length !== 1) {
+              throw new Error(
+                `codegen: business birth '${domain}/${d.id}' must target one generated domain owning ` +
+                  `'${businessBirth.aggregateId}', found ${owners.length === 0 ? "none" : owners.join(", ")}`,
+              );
+            }
+            return owners[0]!;
+          })();
       const schema = businessBirth?.publicPayloadSchema
         ?? (d as unknown as { payloadSchema: z.ZodTypeAny }).payloadSchema;
-      const stamps = autoStampFields(schema);
       const mint = mintPlan?.get(d.id);
+      const referencePayloadFields = zodKind(schema) === "object"
+        ? Object.entries(zodObjectShape(schema))
+            .filter(([name, field]) => name !== mint?.field && idOfMetaOf(field) !== undefined)
+            .map(([name]) => name)
+        : [];
+      const referencePayloadTypes = zodKind(schema) === "object"
+        ? Object.fromEntries(
+            Object.entries(zodObjectShape(schema))
+              .filter(([name, field]) => name !== mint?.field && idOfMetaOf(field) !== undefined)
+              .map(([name, field]) => [
+                name,
+                idOfTargetKindOf(field) === "contract" ? "" : idOfMetaOf(field)!,
+              ]),
+          )
+        : {};
+      const recipientPayloadFields = zodKind(schema) === "object"
+        ? Object.entries(zodObjectShape(schema))
+            .filter(([name, field]) => name !== mint?.field && recipientMetaOf(field) !== undefined)
+            .map(([name]) => name)
+        : [];
+      const wireReferences = (expr: string): string => {
+        const references = referencePayloadFields.length === 0
+          ? expr
+          : `_nmsWireReferences(${expr}, ${JSON.stringify(referencePayloadTypes)}, holon.workspace)`;
+        return recipientPayloadFields.length === 0
+          ? references
+          : `_nmsWireRecipients(${references}, ${JSON.stringify(recipientPayloadFields)})`;
+      };
+      const stamps = autoStampFields(schema);
       const placed = placementDirs.has(d.id) ? ["shard"] : [];
+      const principalField = d.businessPrincipalField;
+      // Business births are public application actions even when they are synthesized from
+      // `birth(Aggregate, spec)` rather than explicitly wrapped in `intent(...)`. Their generated
+      // method is therefore `birth(input)`, and every hidden custody/sealing prelude must bind the
+      // same name. Calling it `payload` here emitted an undeclared identifier for owned births.
+      const argumentName = isBusinessIntent(d) || businessBirth !== undefined ? "input" : "payload";
+      const principalPrelude = principalField === undefined
+        ? []
+        : [`      const _businessPayload = _nmsBindCurrentPrincipal(${argumentName}, ${JSON.stringify(principalField)}, actor ?? holon.principal);`];
+      const inputPayload = principalField === undefined ? argumentName : "_businessPayload";
       // THE AUTHORITY GATE (codegen-time): a directive carrying `.requires(relation)` is GATED — its
       // generated method refuses to encode an offer without an `actor` (throws MissingOfferAuthority
       // BEFORE any submit), so an actorless gated offer is impossible to GENERATE, not merely refused.
@@ -2423,14 +2772,13 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       // are byte-identical (wantSeal === false ⇒ no prelude, no extra param, plain `payload`).
       const encFields = encMap?.[domain]?.directives?.[d.id];
       const wantSeal = encFields !== undefined;
-      // FALLBACK ATTESTATION INJECTION (co2): a directive whose law declares a foreign read
-      // (`.readsFrom(...)`) accepts pre-fetched signed envelopes as `callOpts.attestations` — the manual
-      // escape hatch when the colocation resolver can't serve the read (the source isn't on the plane). The
-      // in-engine colocation path (the offer resolves the read from the mounted source, zero HTTP) remains
-      // the default; this is the explicit override a caller reaches for. Emitted ONLY for foreign-read
-      // directives (an ordinary directive's signature is byte-identical).
-      const wantAttest = (((d as { declaredForeignReads?: unknown[] }).declaredForeignReads?.length ?? 0) > 0);
-      const attTy = `readonly { queryId: string; result: unknown; attestation: unknown }[]`;
+      // A dynamic foreign source is a BUSINESS input, but attestation transport and trust seating are not.
+      // `.trustsSource(...)` gives codegen the whole private recipe: fetch the signed declared read, derive
+      // the source identity/key, author the hidden trust directive, then carry the envelope. Directives with
+      // an ordinary declared foreign read need no public override either: the bound client follows the
+      // kernel's typed missing-evidence refusal automatically. There is therefore no `callOpts.attestations`
+      // lane on any generated tenant method.
+      const sourceTrust = d.businessSourceTrust;
       const ownedSeal = encFields !== undefined && Object.values(encFields).every((field) => field.owned === true);
       const ownedTargetAggregate = ownedSeal
         ? (mod.aggregates as AggregateHandle[]).find((aggregate) => aggregate.id === (d as { aggregateId?: string }).aggregateId)
@@ -2451,7 +2799,11 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           ? `      if (!holon.mint) throw new Error("this holon predates record-bound .owned() identity — upgrade @githolon/client");\n` +
             `      const _ownedRecord = { type: ${JSON.stringify(ownedRuntimeType)}, id: await holon.mint(${JSON.stringify(ownedRuntimeType)}), preMinted: true as const };`
           : ownedRecordTarget.kind === "payload"
-            ? `      const _ownedRecord = { type: ${JSON.stringify(ownedRuntimeType)}, id: String((payload as Record<string, unknown>)[${JSON.stringify(ownedRecordTarget.field)}] ?? "") };`
+            ? `      const _ownedRecord = { type: ${JSON.stringify(ownedRuntimeType)}, id: ${
+                referencePayloadFields.includes(ownedRecordTarget.field)
+                  ? `_nmsReferenceId((${inputPayload} as Record<string, unknown>)[${JSON.stringify(ownedRecordTarget.field)}], ${JSON.stringify(referencePayloadTypes[ownedRecordTarget.field] ?? "")}, holon.workspace, ${JSON.stringify(ownedRecordTarget.field)})`
+                  : `String((${inputPayload} as Record<string, unknown>)[${JSON.stringify(ownedRecordTarget.field)}] ?? "")`
+              } };`
             : `      const _ownedRecord = { type: ${JSON.stringify(ownedRuntimeType)}, id: ${JSON.stringify(ownedRecordTarget.id)} };`;
       const ownedBirthDescriptor = businessBirth === undefined || encFields === undefined
         ? undefined
@@ -2459,43 +2811,115 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       const ownedBirthPrelude = ownedBirthDescriptor === undefined
         ? ""
         : `      if (!holon.__nomosOwnedBirthScopeKey) throw new Error("this holon predates automatic .owned() birth custody — upgrade @githolon/client");\n` +
-          `      const _ownedBirthKey = await holon.__nomosOwnedBirthScopeKey({ scope: ${JSON.stringify(ownedBirthDescriptor.scope)}, namespace: ${JSON.stringify(businessBirth!.namespace)}, key: (payload as Record<string, unknown>)[${JSON.stringify(businessBirth!.keyField)}] });`;
-      const callOptsFields = [
-        ...(wantSeal && !ownedSeal ? ["seal?: boolean"] : []),
-        ...(wantAttest ? [`attestations?: ${attTy}`] : []),
-      ];
-      const paramSig = callOptsFields.length
-        ? `payload: ${payloadName}, callOpts?: { ${callOptsFields.join("; ")} }`
-        : `payload: ${payloadName}`;
-      const offerExtra = wantAttest ? ", attestations: callOpts?.attestations" : "";
+          `      const _ownedBirthKey = await holon.__nomosOwnedBirthScopeKey({ scope: ${JSON.stringify(ownedBirthDescriptor.scope)}, namespace: ${JSON.stringify(businessBirth!.namespace)}, key: (${inputPayload} as Record<string, unknown>)[${JSON.stringify(businessBirth!.keyField)}] });`;
+      const paramSig = `${argumentName}: ${payloadName}`;
+      const sourceQueryArgs = sourceTrust === undefined
+        ? ""
+        : Object.entries(sourceTrust.queryArgs)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([argument, field]) => `${JSON.stringify(argument)}: (${argumentName} as Record<string, unknown>)[${JSON.stringify(field)}]`)
+            .join(", ");
+      const sourceQueryReferenceTypes = sourceTrust === undefined
+        ? {}
+        : Object.fromEntries(Object.entries(sourceTrust.queryArgs).flatMap(([argument, field]) => {
+            const type = referencePayloadTypes[field];
+            return type === undefined ? [] : [[argument, type]];
+          }));
+      const copiedTrustFields = sourceTrust === undefined
+        ? []
+        : Object.entries(sourceTrust.copy)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([target, field]) =>
+              `        ${JSON.stringify(target)}: (${inputPayload} as Record<string, unknown>)[${JSON.stringify(field)}],`);
+      const copiedTrustReferenceTypes = sourceTrust === undefined
+        ? {}
+        : Object.fromEntries(Object.entries(sourceTrust.copy).flatMap(([target, field]) => {
+            const type = referencePayloadTypes[field];
+            return type === undefined ? [] : [[target, type]];
+          }));
+      const sourceTrustPrelude = sourceTrust === undefined
+        ? []
+        : [
+            `      const _sourceWorkspace = String((${inputPayload} as Record<string, unknown>)[${JSON.stringify(sourceTrust.fromPayload)}] ?? "");`,
+            `      if (!_sourceWorkspace.trim()) throw new Error(${JSON.stringify(`${d.id} needs a source workspace`)});`,
+            `      const _sourceQueryArgs = _nmsWireReferences({ ${sourceQueryArgs} }, ${JSON.stringify(sourceQueryReferenceTypes)}, _sourceWorkspace);`,
+            `      const _sourceEntry = _nmsAttestedEntry(await holon.fetchAttestedRead(_sourceWorkspace, ${JSON.stringify(sourceTrust.queryId)}, _sourceQueryArgs));`,
+            `      await _commit(holon.offerDirective(${JSON.stringify(domain)}, ${JSON.stringify(sourceTrust.viaDirectiveId)}, _nmsWireReferences({`,
+            ...copiedTrustFields,
+            `        ${JSON.stringify(sourceTrust.genesisField)}: _nmsSourceGenesis(_sourceEntry),`,
+            `        ${JSON.stringify(sourceTrust.keyHashesField)}: [await _nmsSourceKeyHash(_sourceEntry)],`,
+            `      }, ${JSON.stringify(copiedTrustReferenceTypes)}, _sourceWorkspace), { domainHash, actor, returnCreated: true }) as Promise<_NomosRawWriteResult>);`,
+          ];
+      const offerExtra = sourceTrust === undefined ? "" : ", attestations: [_sourceEntry]";
       const sealPrelude = wantSeal
-        ? `      const _sealed = await _sealFields(holon, keyStore, ${encConst}[${JSON.stringify(domain)}].directives[${JSON.stringify(d.id)}] as Record<string, { scope: string; aggSid: string; fieldSid: string; owned?: true }>, payload as Record<string, unknown>, ${businessBirth !== undefined || ownedSeal ? "true" : "callOpts?.seal !== false"}${ownedBirthDescriptor !== undefined ? ", _ownedBirthKey" : ", undefined"}${ownedRecordPrelude ? ", _ownedRecord" : ""}) as ${payloadName};`
+        ? `      const _sealed = await _sealFields(holon, keyStore, ${encConst}[${JSON.stringify(domain)}].directives[${JSON.stringify(d.id)}] as Record<string, { scope: string; aggSid: string; fieldSid: string; owned?: true }>, ${inputPayload} as Record<string, unknown>, true${ownedBirthDescriptor !== undefined ? ", _ownedBirthKey" : ", undefined"}${ownedRecordPrelude ? ", _ownedRecord" : ""}) as ${payloadName};`
         : "";
-      const pv = wantSeal ? "_sealed" : "payload";
+      const pv = wantSeal ? "_sealed" : inputPayload;
       // MULTI-OUTPUT: name every aggregate this directive writes (primary marker target + declared
       // secondaryOutputs), so the frontend dev sees "writes A + B" at the call site (not one by convention).
-      const dd = d as unknown as { aggregateId: string; marker: string; secondaryOutputs?: readonly { aggregateId: string; marker: string }[] };
-      const allOutputs = [{ aggregateId: dd.aggregateId, marker: dd.marker }, ...(dd.secondaryOutputs ?? [])];
+      const dd = d as unknown as { aggregateId: string; marker: string; secondaryOutputs?: readonly { aggregateId: string; marker: string; many?: true }[] };
+      const allOutputs = [{ aggregateId: dd.aggregateId, marker: dd.marker, many: false }, ...(dd.secondaryOutputs ?? []).map((output) => ({ ...output, many: output.many === true }))]
+        .filter((output) => publicAggregateIds.has(output.aggregateId))
+        .filter((output, index, outputs) =>
+          outputs.findIndex((candidate) => candidate.aggregateId === output.aggregateId) === index);
       const writesClause = allOutputs.length > 1
         ? ` Writes ${allOutputs.map((o) => `\`${o.aggregateId}\` (${o.marker})`).join(" + ")}.`
         : "";
       out.push(
-        `/** \`${domain}/${d.id}\` payload (mirrors the engine's zod schema).${writesClause}${stamps.length ? ` Omitted ${stamps.map((s) => `\`${s}\``).join("/")} auto-stamp(s) ISO now() at offer.` : ""}${mint ? ` Omitted \`${mint.field}\` is KERNEL-MINTED at offer (returned on the result).` : ""}${placed.length ? " Omitted `shard` is picked LEAST-LOADED at offer (the routed holon)." : ""} */`,
-        `export type ${payloadName} = ${tsTypeOfPayload(schema, stamps, mint ? [mint.field] : [], placed, lazyReg, d.id)};`,
+        `/** \`${domain}/${d.id}\` ${isBusinessIntent(d) ? "business input contract" : "private directive payload"}.${writesClause}${stamps.length ? ` Omitted ${stamps.map((s) => `\`${s}\``).join("/")} auto-stamp(s) ISO now() at offer.` : ""}${mint ? ` Omitted \`${mint.field}\` is KERNEL-MINTED at offer (returned on the result).` : ""}${placed.length ? " Omitted `shard` is picked LEAST-LOADED at offer (the routed holon)." : ""} */`,
+        `export type ${payloadName} = ${tsTypeOfPayload(schema, stamps, mint ? [mint.field] : [], placed, principalField === undefined ? [] : [principalField], lazyReg, d.id)};`,
         ``,
       );
+      let resultName = `${cap(camel(d.id))}Result`;
+      if (usedResultNames.has(resultName)) resultName = `${cap(camel(domain))}${resultName}`;
+      usedResultNames.add(resultName);
+      if (businessBirth === undefined && allOutputs.length > 0) {
+        const resultMembers = new Set<string>();
+        const fields = allOutputs.map((output) => {
+          const field = tsResultMemberName(output.aggregateId);
+          if (resultMembers.has(field)) {
+            throw new Error(
+              `codegen: action '${domain}/${d.id}' has two aggregate consequences named '${field}'; ` +
+                `rename one aggregate so its generated business result is unambiguous`,
+            );
+          }
+          resultMembers.add(field);
+          return output.many
+            ? `  readonly ${tsKey(field)}: readonly NomosRef<${output.aggregateId}>[];`
+            : `  readonly ${tsKey(field)}: NomosRef<${output.aggregateId}>;`;
+        });
+        out.push(
+          `/** Every business record affected by \`${domain}/${d.id}\`. No ledger or transport receipt leaks through this type. */`,
+          `export interface ${resultName} {`,
+          ...fields,
+          `}`,
+          ``,
+        );
+      }
       // ONE BUSINESS BIRTH: the session is the parent; identity, timestamp, child addressing, law selection,
       // provenance and device seating are internal. The app supplies only the declared business payload and
-      // receives the born root's typed NomosRef.
+      // receives the born root's typed NomosRef inside the private domain binder. The one public application
+      // wrapper below immediately follows that reference and returns the opened child business application.
       if (businessBirth !== undefined) {
+        const birthMethod = isBusinessIntent(d) ? JSON.stringify(d.id) : "birth";
+        const applicationMethod = isBusinessIntent(d) ? d.id : "birth";
+        applicationBirths.push({
+          sourceDomain: domain,
+          method: applicationMethod,
+          payloadName,
+          aggregateId: businessBirth.aggregateId,
+          targetDomain: businessBirthTargetDomain!,
+          applicationType: `${cap(camel(businessBirth.aggregateId))}Application`,
+        });
         methods.push(
           `    /** Give one ${businessBirth.aggregateId} its own durable life. Nomos owns identity, provenance, persistence and recovery. */`,
-          `    birth: async (payload: ${payloadName}): Promise<NomosBorn<${businessBirth.aggregateId}Data>> => {`,
+          `    ${birthMethod}: async (input: ${payloadName}): Promise<NomosRef<${businessBirth.aggregateId}>> => {`,
           `      const principal = actor ?? holon.principal;`,
           `      if (!principal || !principal.trim()) throw new Error("birth() needs a signed-in Nomos session");`,
+          ...principalPrelude,
           ...(ownedBirthPrelude ? [ownedBirthPrelude] : []),
           ...(wantSeal ? [sealPrelude] : []),
-          `      const result = await holon.offerDirective(${JSON.stringify(domain)}, ${JSON.stringify(d.id)}, { ...payload, principal, bornAt: new Date().toISOString()${wantSeal ? `, ${JSON.stringify(BUSINESS_BIRTH_SEED_PAYLOAD_FIELD)}: JSON.stringify(_sealed)` : ""}${ownedBirthDescriptor !== undefined ? `, [_OWNED_KEY_PAYLOAD_FIELD]: _ownedBirthKey.ownedKeySubject` : ""} }, { domainHash, actor: principal, returnCreated: true });`,
+          `      const result = await holon.offerDirective(${JSON.stringify(domain)}, ${JSON.stringify(d.id)}, { ...${wireReferences("input")}, principal, bornAt: new Date().toISOString()${wantSeal ? `, ${JSON.stringify(BUSINESS_BIRTH_SEED_PAYLOAD_FIELD)}: JSON.stringify(${wireReferences("_sealed")})` : ""}${ownedBirthDescriptor !== undefined ? `, [_OWNED_KEY_PAYLOAD_FIELD]: _ownedBirthKey.ownedKeySubject` : ""} }, { domainHash, actor: principal, returnCreated: true });`,
           `      const born = typeof result === "object" && result !== null && Array.isArray(result.born) ? result.born[0] : undefined;`,
           `      if (typeof born !== "object" || born === null || typeof born.workspace !== "string" || !born.workspace) throw new Error("birth() committed without returning the born workspace");`,
           ...(ownedBirthDescriptor !== undefined
@@ -2504,7 +2928,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           `      await holon.sync?.();`,
           `      if (!holon.settleBirth) throw new Error("birth() requires the current @githolon/client to complete durable recovery");`,
           `      await holon.settleBirth(born.workspace);`,
-          `      return { workspace: born.workspace, type: ${JSON.stringify(businessBirth.aggregateId)}, id: ${JSON.stringify(businessBirth.rootId)} };`,
+          `      return _nmsRef<${businessBirth.aggregateId}>(born.workspace, ${JSON.stringify(businessBirth.aggregateId)}, ${JSON.stringify(businessBirth.rootId)});`,
           `    },`,
         );
         continue;
@@ -2514,7 +2938,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       // directiveId + baked domainHash bound at codegen time), NOT an `offerDirective`, so a frontend dev
       // never hand-writes the four raw strings this replaces (the co2 production bug).
       if ((d as { birthsChild?: boolean }).birthsChild === true) {
-        const birthPayload = stamps.length ? `stampNow(payload, ${JSON.stringify(stamps)})` : "payload";
+        const birthPayload = wireReferences(stamps.length ? `stampNow(payload, ${JSON.stringify(stamps)})` : "payload");
         const gateBirthDoc = gate ? ` GATED: needs \`actor\` (\`${gate.relation}\`).` : "";
         methods.push(
           `    /** Births a CHILD WORKSPACE (named by \`${payloadName}\`) under \`parent\`, via a SIGNED cross-workspace`,
@@ -2530,54 +2954,77 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
         );
         continue;
       }
-      // THE ONE WRITE OUTCOME (architecture/nomos_ref.md): EVERY directive method returns Promise<NomosOutcome>
-      // — `created` (typed refs of all minted aggregates, from returnCreated) + `head`, plus `target` for the
-      // front-door-mint lane (the one statically-known addressed instance). One async block covers every case.
+      // BUSINESS RESULTS: every action returns the generated set of aggregate references its law says it
+      // affected. The framework receipt, ledger head and transport mechanics remain private.
       if (mint !== undefined) {
         const mintOpts =
           mint.homeKeyField !== undefined
-            ? `, { homeKey: payload.${mint.homeKeyField} }`
+            ? `, { homeKey: ${argumentName}.${mint.homeKeyField} }`
             : mint.tagFromIdField !== undefined
-              ? `, { tagHex: routeTagOfId(payload.${mint.tagFromIdField}) }`
+              ? `, { tagHex: routeTagOfId(${argumentName}.${mint.tagFromIdField}) }`
               : "";
-        const body = stamps.length
+        const body = wireReferences(stamps.length
           ? `stampNow({ ...${pv}, ${mint.field} }, ${JSON.stringify(stamps)})`
-          : `{ ...${pv}, ${mint.field} }`;
+          : `{ ...${pv}, ${mint.field} }`);
         const ownedMintTarget = ownedSeal
           && ownedRecordTarget?.kind === "payload"
           && ownedRecordTarget.field === mint.field
           && ownedRuntimeType !== undefined;
+        const hasBusinessResult = allOutputs.length > 0;
+        const mintedReturnType = hasBusinessResult ? resultName : "void";
+        const resultSpec = JSON.stringify(allOutputs.map((output) => ({
+          member: tsResultMemberName(output.aggregateId),
+          type: output.aggregateId,
+          ...(output.many ? { many: true } : {}),
+        })));
+        const mintedCall = hasBusinessResult
+          ? `_businessResult<${resultName}>(holon.workspace, ${resultSpec}, holon.offerDirective(${JSON.stringify(domain)}, ${JSON.stringify(d.id)}, ${body}, { domainHash, actor, returnCreated: true${offerExtra} }) as Promise<_NomosRawWriteResult>)`
+          : `_commit(holon.offerDirective(${JSON.stringify(domain)}, ${JSON.stringify(d.id)}, ${body}, { domainHash, actor, returnCreated: true${offerExtra} }) as Promise<_NomosRawWriteResult>)`;
         methods.push(
-          `    /** Author \`${domain}/${d.id}\`: the front-door MINTS \`${mint.field}\` (route-tagged) when omitted`,
-          `     *  — ids stay internal plumbing — and returns the outcome (\`target\` = the minted ${dd.aggregateId ?? "aggregate"}).${gate ? ` GATED: needs \`{ actor }\` (\`${gate.relation}\`).` : ""} */`,
-          `    ${d.id}: async (${paramSig}): Promise<NomosOutcome> => {`,
+          `    /** Author \`${domain}/${d.id}\`: the generated client MINTS \`${mint.field}\` internally`,
+          `     *  — ids are not application input — ${hasBusinessResult ? `and returns its typed ${resultName}` : "and keeps framework write details private"}.${gate ? ` GATED: needs \`{ actor }\` (\`${gate.relation}\`).` : ""} */`,
+          `    ${d.id}: async (${paramSig}): Promise<${mintedReturnType}> => {`,
           ...(gateGuard ? [gateGuard.replace(/\n$/, "")] : []),
-          `      const ${mint.field} = payload.${mint.field} ?? (await (holon as NomosRoutedHolon).mint(${JSON.stringify(mint.mintType)}${mintOpts}));`,
+          ...principalPrelude,
+          ...sourceTrustPrelude,
+          `      const ${mint.field} = await (holon as NomosMintingHolon).mint(${JSON.stringify(mint.mintType)}${mintOpts});`,
           ...(ownedMintTarget
             ? [`      const _ownedRecord = { type: ${JSON.stringify(ownedRuntimeType)}, id: String(${mint.field}) };`]
             : ownedRecordPrelude ? [ownedRecordPrelude] : []),
           ...(sealPrelude ? [sealPrelude] : []),
-          `      return _outcome(holon.workspace, holon.offerDirective(${JSON.stringify(domain)}, ${JSON.stringify(d.id)}, ${body}, { domainHash, actor, returnCreated: true${offerExtra} }) as Promise<string | { head: string; created?: { type: string; id: string }[] }>, { workspace: holon.workspace, type: ${JSON.stringify(dd.aggregateId ?? mint.mintType)}, id: ${mint.field} });`,
+          `      return ${mintedCall};`,
           `    },`,
         );
         continue;
       }
-      const offerPayload = stamps.length ? `stampNow(${pv}, ${JSON.stringify(stamps)})` : pv;
+      const offerPayload = wireReferences(stamps.length ? `stampNow(${pv}, ${JSON.stringify(stamps)})` : pv);
+      const hasBusinessResult = allOutputs.length > 0;
+      const returnType = hasBusinessResult ? resultName : "void";
+      const resultSpec = JSON.stringify(allOutputs.map((output) => ({
+        member: tsResultMemberName(output.aggregateId),
+        type: output.aggregateId,
+        ...(output.many ? { many: true } : {}),
+      })));
+      const commitCall = hasBusinessResult
+        ? `_businessResult<${resultName}>(holon.workspace, ${resultSpec}, holon.offerDirective(${JSON.stringify(domain)}, ${JSON.stringify(d.id)}, ${offerPayload}, { domainHash, actor, returnCreated: true${offerExtra} }) as Promise<_NomosRawWriteResult>)`
+        : `_commit(holon.offerDirective(${JSON.stringify(domain)}, ${JSON.stringify(d.id)}, ${offerPayload}, { domainHash, actor, returnCreated: true${offerExtra} }) as Promise<_NomosRawWriteResult>)`;
       const outcomeDoc =
         d.marker === "creates"
-          ? `Author \`${domain}/${d.id}\`: the LAW mints the ${d.aggregateId ?? "aggregate"} id inside the sealed intent; it rides back on \`outcome.created\` — no id in the payload, no query-after.`
-          : `Author \`${domain}/${d.id}\` locally under the installed law; returns the typed [NomosOutcome] (\`head\` + any \`created\` refs).`;
+          ? `Author \`${domain}/${d.id}\`: the LAW mints the ${d.aggregateId ?? "aggregate"} identity and returns every affected business reference — no id input and no query-after.`
+          : `Author \`${domain}/${d.id}\` locally under the installed law and return every affected business reference. Framework write details remain private.`;
       const sealDoc = ownedSeal
         ? " Owned content is encrypted automatically by Nomos."
-        : wantSeal ? " Encrypted field(s) are SEALED via the bound { keyStore } before dispatch (pass { seal: false } to skip)." : "";
-      const gateDoc = gate ? ` GATED: needs \`{ actor }\` (\`${gate.relation}\`) — throws MissingOfferAuthority otherwise.` : "";
+        : wantSeal ? " Encrypted fields are sealed automatically from framework-owned custody before dispatch." : "";
+      const gateDoc = gate ? ` GATED: the signed-in person must hold \`${gate.relation}\`; an unauthenticated application refuses locally.` : "";
       methods.push(
         `    /** ${outcomeDoc}${sealDoc}${gateDoc} */`,
-        `    ${d.id}: async (${paramSig}): Promise<NomosOutcome> => {`,
+        `    ${d.id}: async (${paramSig}): Promise<${returnType}> => {`,
         ...(gateGuard ? [gateGuard.replace(/\n$/, "")] : []),
+        ...principalPrelude,
+        ...sourceTrustPrelude,
         ...(ownedRecordPrelude ? [ownedRecordPrelude] : []),
         ...(sealPrelude ? [sealPrelude] : []),
-        `      return _outcome(holon.workspace, holon.offerDirective(${JSON.stringify(domain)}, ${JSON.stringify(d.id)}, ${offerPayload}, { domainHash, actor, returnCreated: true${offerExtra} }) as Promise<string | { head: string; created?: { type: string; id: string }[] }>);`,
+        `      return ${commitCall};`,
         `    },`,
       );
     }
@@ -2585,7 +3032,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     for (const sp of (mod.spatials ?? []) as { id: string; of: string; on: string }[]) {
       methods.push(
         `    /** Declared spatial index \`${sp.id}\` — rows of \`${sp.of}\` whose \`${sp.on}\` geometry intersects the bbox (R*Tree probe). */`,
-        `    ${lcFirst(camel(sp.id))}: (bbox: { minX: number; minY: number; maxX: number; maxY: number } | { minLng: number; minLat: number; maxLng: number; maxLat: number }) => ${wrapP(`(holon.spatialWithin ?? (() => { throw new Error("this holon predates spatial reads — upgrade @githolon/client"); }))(${JSON.stringify(sp.id)}, bbox) as Promise<Row<${sp.of}Data>[]>`)},`,
+        `    ${lcFirst(camel(sp.id))}: (bbox: { minX: number; minY: number; maxX: number; maxY: number } | { minLng: number; minLat: number; maxLng: number; maxLat: number }) => ${wrapP(`(holon.spatialWithin ?? (() => { throw new Error("this holon predates spatial reads — upgrade @githolon/client"); }))(${JSON.stringify(sp.id)}, bbox) as Promise<Row<${sp.of}>[]>`)},`,
       );
     }
     for (const q of (mod.queries ?? []) as QueryDecl[]) {
@@ -2594,32 +3041,49 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
         .map((k) => {
           const lead = k.includes(".") ? k.split(".")[0]! : k;
           const f = agg?.fields[lead] as Field | undefined;
-          const t = f ? (f.kind === "int" ? "number" : "string") : "string";
+          const t = f
+            ? f.kind === "int" || f.kind === "counter"
+              ? "number"
+              : f.kind === "ref"
+                ? tsBaseTypeOfField(f)
+                : "string"
+            : "string";
           return `${JSON.stringify(k)}: ${t}`;
         })
         .join("; ");
+      const referenceKeys = q.key.filter((key) => {
+        const lead = key.includes(".") ? key.split(".")[0]! : key;
+        return (agg?.fields[lead] as Field | undefined)?.kind === "ref";
+      });
+      const referenceKeyTypes = Object.fromEntries(referenceKeys.map((key) => {
+        const lead = key.includes(".") ? key.split(".")[0]! : key;
+        return [key, (agg?.fields[lead] as Field | undefined)?.refAggregateId ?? ""];
+      }));
+      const wireParams = referenceKeys.length > 0
+        ? `_nmsWireReferences(params, ${JSON.stringify(referenceKeyTypes)}, holon.workspace)`
+        : "params";
       const qScopes = readScopesFor(q.returns);
       const qOwned = qScopes.some((scope) => scope.owned === true);
       const qScopeJson = JSON.stringify(qScopes);
       methods.push(
-        `    /** Declared query \`${q.id}\` (indexed probe — routed by the read manifest).${qScopes.length ? " Encrypted field(s) decrypt when the bound { keyStore } holds the scope key; else they stay opaque envelopes." : ""} */`,
+        `    /** Declared query \`${q.id}\` (indexed probe — routed by the read manifest).${qScopes.length ? " Encrypted fields decrypt automatically when this signed-in application holds their keys." : ""} */`,
         qScopes.length
           ? qOwned
-            ? `    ${lcFirst(camel(q.id))}: async (params: { ${params} }) => ${wrapP(`_readWithOwnedKeys(holon, keyStore, ${qScopeJson}, (keys) => holon.query(${JSON.stringify(q.id)}, params, keys) as Promise<Row<${q.returns}Data>[]>)`)},`
-            : `    ${lcFirst(camel(q.id))}: async (params: { ${params} }) => ${wrapP(`holon.query(${JSON.stringify(q.id)}, params, await _readKeys(holon, keyStore, ${qScopeJson})) as Promise<Row<${q.returns}Data>[]>`)},`
-          : `    ${lcFirst(camel(q.id))}: (params: { ${params} }) => ${wrapP(`holon.query(${JSON.stringify(q.id)}, params) as Promise<Row<${q.returns}Data>[]>`)},`,
+            ? `    ${lcFirst(camel(q.id))}: async (params: { ${params} }) => ${wrapP(`_readWithOwnedKeys(holon, keyStore, ${qScopeJson}, (keys) => holon.query(${JSON.stringify(q.id)}, ${wireParams}, keys) as Promise<Row<${q.returns}>[]>)`)},`
+            : `    ${lcFirst(camel(q.id))}: async (params: { ${params} }) => ${wrapP(`holon.query(${JSON.stringify(q.id)}, ${wireParams}, await _readKeys(holon, keyStore, ${qScopeJson})) as Promise<Row<${q.returns}>[]>`)},`
+          : `    ${lcFirst(camel(q.id))}: (params: { ${params} }) => ${wrapP(`holon.query(${JSON.stringify(q.id)}, ${wireParams}) as Promise<Row<${q.returns}>[]>`)},`,
         `    /** Reactive \`${q.id}\` — re-emits typed rows on every local change; returns stop(). */`,
         qOwned
-          ? `    watch${cap(camel(q.id))}: (params: { ${params} }, cb: (rows: Row<${q.returns}Data>[]) => void, opts?: { intervalMs?: number }) => _watchWithOwnedKeys((changed) => holon.watch(${JSON.stringify(q.id)}, params, changed as (rows: unknown) => void, opts), () => ${wrapP(`_readWithOwnedKeys(holon, keyStore, ${qScopeJson}, (keys) => holon.query(${JSON.stringify(q.id)}, params, keys) as Promise<Row<${q.returns}Data>[]>)`)}, cb),`
-          : `    watch${cap(camel(q.id))}: (params: { ${params} }, cb: (rows: Row<${q.returns}Data>[]) => void, opts?: { intervalMs?: number }) => holon.watch(${JSON.stringify(q.id)}, params, ((rows: Row<${q.returns}Data>[]) => cb(${wrapRows("rows")})) as (rows: unknown) => void, opts),`,
+          ? `    watch${cap(camel(q.id))}: (params: { ${params} }, cb: (records: NomosRecord<${q.returns}>[]) => void, opts?: { intervalMs?: number }) => _watchWithOwnedKeys((changed) => holon.watch(${JSON.stringify(q.id)}, ${wireParams}, changed as (rows: unknown) => void, opts), () => ${wrapP(`_readWithOwnedKeys(holon, keyStore, ${qScopeJson}, (keys) => holon.query(${JSON.stringify(q.id)}, ${wireParams}, keys) as Promise<Row<${q.returns}>[]>)`)}, cb),`
+          : `    watch${cap(camel(q.id))}: (params: { ${params} }, cb: (records: NomosRecord<${q.returns}>[]) => void, opts?: { intervalMs?: number }) => holon.watch(${JSON.stringify(q.id)}, ${wireParams}, ((rows: Row<${q.returns}>[]) => cb(${wrapRows("rows")})) as (rows: unknown) => void, opts),`,
       );
       pastMethods.push(
         `        /** Declared query \`${q.id}\` in the verified world at this moment. */`,
         qScopes.length
           ? qOwned
-            ? `        ${lcFirst(camel(q.id))}: async (params: { ${params} }) => ${wrapP(`_readWithOwnedKeys(holon, keyStore, ${qScopeJson}, (keys) => historic.query(${JSON.stringify(q.id)}, params, keys) as Promise<Row<${q.returns}Data>[]>)`)},`
-            : `        ${lcFirst(camel(q.id))}: async (params: { ${params} }) => ${wrapP(`historic.query(${JSON.stringify(q.id)}, params, await _readKeys(holon, keyStore, ${qScopeJson})) as Promise<Row<${q.returns}Data>[]>`)},`
-          : `        ${lcFirst(camel(q.id))}: (params: { ${params} }) => ${wrapP(`historic.query(${JSON.stringify(q.id)}, params) as Promise<Row<${q.returns}Data>[]>`)},`,
+            ? `        ${lcFirst(camel(q.id))}: async (params: { ${params} }) => ${wrapP(`_readWithOwnedKeys(holon, keyStore, ${qScopeJson}, (keys) => historic.query(${JSON.stringify(q.id)}, ${wireParams}, keys) as Promise<Row<${q.returns}>[]>)`)},`
+            : `        ${lcFirst(camel(q.id))}: async (params: { ${params} }) => ${wrapP(`historic.query(${JSON.stringify(q.id)}, ${wireParams}, await _readKeys(holon, keyStore, ${qScopeJson})) as Promise<Row<${q.returns}>[]>`)},`
+          : `        ${lcFirst(camel(q.id))}: (params: { ${params} }) => ${wrapP(`historic.query(${JSON.stringify(q.id)}, ${wireParams}) as Promise<Row<${q.returns}>[]>`)},`,
       );
       // THE LOGICAL PAGED ROW SURFACE (sharding §5.3, ruling 2 — slice 4): emitted
       // ONLY for packed-taxonomy domains (taxonomy-free clients stay byte-identical).
@@ -2629,7 +3093,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           `    /** \`${q.id}\`, paged at estate width (ruling 2): ordinary pagination, stable cursor. */`,
           `    ${lcFirst(camel(q.id))}Pages: (params: { ${params} }, page?: { pageSize?: number; cursor?: string | null }) => {`,
           `      if (!holon.pages) throw new Error("pages() needs the ROUTED holon - connect() to the logical (coordinator) workspace, not a shard");`,
-          `      return holon.pages(${JSON.stringify(q.id)}, params, page) as Promise<{ rows: Row<${q.returns}Data>[]; cursor: string | null; done: boolean }>;`,
+          `      return (holon.pages(${JSON.stringify(q.id)}, ${wireParams}, page) as Promise<{ rows: Row<${q.returns}>[]; cursor: string | null; done: boolean }>).then((result) => ({ ...result, rows: ${wrapRows("result.rows")} }));`,
           `    },`,
         );
       }
@@ -2638,32 +3102,44 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     for (const c of (mod.counts ?? []).map((raw) => finishCount(raw))) {
       const grouped = c.by != null;
       const p = grouped ? tsGroupParam(c.by!) : "";
+      const lead = grouped ? (c.by!.includes(".") ? c.by!.split(".")[0]! : c.by!) : "";
+      const groupField = grouped ? aggByType.get(c.of)?.fields[lead] as Field | undefined : undefined;
+      const groupType = groupField?.kind === "ref" ? tsBaseTypeOfField(groupField) : "string";
+      const groupWire = groupField?.kind === "ref"
+        ? `_nmsReferenceId(${p}, ${JSON.stringify(groupField.refAggregateId ?? "")}, holon.workspace, ${JSON.stringify(c.by)})`
+        : p;
       methods.push(
         `    /** Declared count \`${c.id}\` — the maintained O(1) ${grouped ? `tally per \`${c.by}\`` : "grand total"}. */`,
         grouped
-          ? `    ${lcFirst(camel(c.id))}: (${p}: string) => holon.count(${JSON.stringify(c.id)}, ${p}),`
+          ? `    ${lcFirst(camel(c.id))}: (${p}: ${groupType}) => holon.count(${JSON.stringify(c.id)}, ${groupWire}),`
           : `    ${lcFirst(camel(c.id))}: () => holon.count(${JSON.stringify(c.id)}),`,
       );
       pastMethods.push(
         `        /** Declared count \`${c.id}\` at this moment. */`,
         grouped
-          ? `        ${lcFirst(camel(c.id))}: (${p}: string) => historic.count(${JSON.stringify(c.id)}, ${p}),`
+          ? `        ${lcFirst(camel(c.id))}: (${p}: ${groupType}) => historic.count(${JSON.stringify(c.id)}, ${groupWire}),`
           : `        ${lcFirst(camel(c.id))}: () => historic.count(${JSON.stringify(c.id)}),`,
       );
     }
     for (const s of (mod.sums ?? []).map((raw) => finishSum(raw))) {
       const grouped = s.by != null;
       const p = grouped ? tsGroupParam(s.by!) : "";
+      const lead = grouped ? (s.by!.includes(".") ? s.by!.split(".")[0]! : s.by!) : "";
+      const groupField = grouped ? aggByType.get(s.of)?.fields[lead] as Field | undefined : undefined;
+      const groupType = groupField?.kind === "ref" ? tsBaseTypeOfField(groupField) : "string";
+      const groupWire = groupField?.kind === "ref"
+        ? `_nmsReferenceId(${p}, ${JSON.stringify(groupField.refAggregateId ?? "")}, holon.workspace, ${JSON.stringify(s.by)})`
+        : p;
       methods.push(
         `    /** Declared sum \`${s.id}\` — the maintained O(1) ${grouped ? `total per \`${s.by}\`` : "grand total"}. */`,
         grouped
-          ? `    ${lcFirst(camel(s.id))}: (${p}: string) => holon.sum(${JSON.stringify(s.id)}, ${p}),`
+          ? `    ${lcFirst(camel(s.id))}: (${p}: ${groupType}) => holon.sum(${JSON.stringify(s.id)}, ${groupWire}),`
           : `    ${lcFirst(camel(s.id))}: () => holon.sum(${JSON.stringify(s.id)}),`,
       );
       pastMethods.push(
         `        /** Declared sum \`${s.id}\` at this moment. */`,
         grouped
-          ? `        ${lcFirst(camel(s.id))}: (${p}: string) => historic.sum(${JSON.stringify(s.id)}, ${p}),`
+          ? `        ${lcFirst(camel(s.id))}: (${p}: ${groupType}) => historic.sum(${JSON.stringify(s.id)}, ${groupWire}),`
           : `        ${lcFirst(camel(s.id))}: () => historic.sum(${JSON.stringify(s.id)}),`,
       );
     }
@@ -2694,50 +3170,83 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
         `    conflicts: {`,
         `      summary: async (): Promise<ConflictSummary> => {`,
         `        if (!holon.pendingConflictSummary) throw new Error("conflicts need the current @githolon/client");`,
-        `        return holon.pendingConflictSummary();`,
+        `        const summary = await holon.pendingConflictSummary();`,
+        `        return { total: summary.total, ready: summary.ready, modelUpdatesRequired: summary.evolutionRequired, byAggregate: summary.byAggregate };`,
         `      },`,
       );
       for (const [aggregateId, bindings] of byAggregate) {
         const runtimeAggregateType = conflictAggregateType(aggregateId);
+        const typedBindings = bindings.flatMap((binding) => {
+          if (binding.valuePayloadField === undefined || binding.idPayloadField === undefined) return [];
+          const payloadName = dirPayloadNames.get(binding.directiveId);
+          return payloadName === undefined ? [] : [{ binding, payloadName }];
+        });
+        const pendingType = typedBindings.flatMap(({ binding: b, payloadName }) => {
+          const valueType = `${payloadName}[${JSON.stringify(b.valuePayloadField!)}]`;
+          const restType = `Omit<${payloadName}, ${[b.valuePayloadField!, b.idPayloadField!].map((field) => JSON.stringify(field)).join(" | ")}>`;
+          const common = `record: NomosRef<${aggregateId}>; field: ${JSON.stringify(b.field)}`;
+          return [
+            `{ ${common}; status: "modelUpdateRequired"; reason: string }`,
+            `{ ${common}; status: "ready"; versions: SurfacedObservation<${valueType}>[]; merge: (reconcile: (versions: readonly SurfacedObservation<${valueType}>[]) => ${valueType}, rest?: ${restType}) => Promise<void> }`,
+          ];
+        }).join(" | ") || "never";
         methods.push(
           `      ${lcFirst(camel(aggregateId))}: {`,
           `        /** Pending merges for ${aggregateId}. Querying creates typed merge references;`,
           `         *  no aggregate id, field name, or directive id is supplied by the app. */`,
-          `        pending: async () => {`,
+          `        pending: async (): Promise<Array<${pendingType}>> => {`,
           `          if (!holon.pendingConflicts) throw new Error("conflicts need the current @githolon/client");`,
           `          const rows = await holon.pendingConflicts(${JSON.stringify(runtimeAggregateType)});`,
-          `          return rows.flatMap((conflict) => {`,
+          `          return rows.flatMap((conflict): Array<${pendingType}> => {`,
           `            if (conflict.aggregateType !== ${JSON.stringify(runtimeAggregateType)}) return [];`,
           `            if (typeof conflict.snapshot !== "string" || conflict.snapshot.length === 0 || typeof conflict.targetSchema !== "string" || conflict.targetSchema.length === 0) {`,
           `              throw new Error("conflicts need a runtime with immutable conflict snapshots; upgrade Nomos before merging");`,
           `            }`,
+          `            const record: NomosRef<${aggregateId}> = _nmsRef(holon.workspace, conflict.aggregateType, conflict.aggregateId);`,
           `            switch (conflict.field) {`,
         );
-        for (const b of bindings) {
-          if (b.valuePayloadField === undefined || b.idPayloadField === undefined) continue;
-          const payloadName = dirPayloadNames.get(b.directiveId);
-          if (payloadName === undefined) continue;
-          const valueType = `${payloadName}[${JSON.stringify(b.valuePayloadField)}]`;
-          const bound = [b.valuePayloadField, b.idPayloadField];
+        for (const { binding: b, payloadName } of typedBindings) {
+          const valuePayloadField = b.valuePayloadField!;
+          const idPayloadField = b.idPayloadField!;
+          const valueType = `${payloadName}[${JSON.stringify(valuePayloadField)}]`;
+          const bound = [valuePayloadField, idPayloadField];
           const restType = `Omit<${payloadName}, ${bound.map((f) => JSON.stringify(f)).join(" | ")}>`;
-          const payloadExpr = `{ ...(rest ?? {}), ${JSON.stringify(b.idPayloadField)}: conflict.aggregateId, ${JSON.stringify(b.valuePayloadField)}: merged } as ${payloadName}`;
+          const referenceMap = JSON.stringify({ [idPayloadField]: aggregateId });
+          const resolverDirective = dirById.get(b.directiveId);
+          if (resolverDirective === undefined) {
+            throw new Error(`generated conflict policy refers to unknown directive '${b.directiveId}' in domain '${domain}'`);
+          }
+          const resolverSchema = (resolverDirective as unknown as { payloadSchema: z.ZodTypeAny }).payloadSchema;
+          const conflictTimeDefaults = zodKind(resolverSchema) === "object"
+            ? Object.entries(zodObjectShape(resolverSchema)).flatMap(([name, field]) => {
+                if (bound.includes(name) || !name.endsWith("At")) return [];
+                const kind = zodKind(field as z.ZodTypeAny);
+                return kind === "string"
+                  ? [`${JSON.stringify(name)}: rest?.[${JSON.stringify(name)}] ?? new Date().toISOString()`]
+                  : kind === "number"
+                    ? [`${JSON.stringify(name)}: rest?.[${JSON.stringify(name)}] ?? Date.now()`]
+                    : [];
+              })
+            : [];
+          const resolutionLiteral = `{ ...(rest ?? {}), ${conflictTimeDefaults.length > 0 ? `${conflictTimeDefaults.join(", ")}, ` : ""}${JSON.stringify(idPayloadField)}: record, ${JSON.stringify(valuePayloadField)}: merged }`;
           methods.push(
             `              case ${JSON.stringify(b.field)}: {`,
             `                if (conflict.status === "evolutionRequired") {`,
-            `                  return [{ aggregateId: conflict.aggregateId, field: ${JSON.stringify(b.field)} as const, status: "evolutionRequired" as const, evolution: conflict.evolution! }];`,
+            `                  return [{ record, field: ${JSON.stringify(b.field)} as const, status: "modelUpdateRequired" as const, reason: conflict.evolution?.reason ?? "The business model cannot yet compare every retained version. Update its evolution policy; unrelated work can continue." }];`,
             `                }`,
             `                if (!Array.isArray(conflict.observations)) throw new Error("Nomos returned a ready conflict without projected versions");`,
             `                const versions = conflict.observations as SurfacedObservation<${valueType}>[];`,
             `                return [{`,
-            `                  aggregateId: conflict.aggregateId,`,
+            `                  record,`,
             `                  field: ${JSON.stringify(b.field)} as const,`,
             `                  status: "ready" as const,`,
             `                  versions,`,
             `                  /** Produce and commit a merge result from the competing versions. The result`,
             `                   *  may equal either side or be a new business value, exactly like a Git merge. */`,
-            `                  merge: (reconcile: (versions: readonly SurfacedObservation<${valueType}>[]) => ${valueType}, rest?: ${restType}): Promise<NomosOutcome> => {`,
+            `                  merge: (reconcile: (versions: readonly SurfacedObservation<${valueType}>[]) => ${valueType}, rest?: ${restType}): Promise<void> => {`,
             `                    const merged = reconcile(versions);`,
-            `                    return _outcome(holon.workspace, (holon.offerDirective as __NomosConflictOffer)(${JSON.stringify(domain)}, ${JSON.stringify(b.directiveId)}, ${payloadExpr}, { domainHash, actor, returnCreated: true, __nomosConflictSnapshots: [{ aggregateType: conflict.aggregateType, aggregateId: conflict.aggregateId, field: conflict.field, targetSchema: conflict.targetSchema, token: conflict.snapshot }] }) as Promise<string | { head: string; created?: { type: string; id: string }[] }>);`,
+            `                    const resolution = ${resolutionLiteral} satisfies ${payloadName};`,
+            `                    return _commit((holon.offerDirective as __NomosConflictOffer)(${JSON.stringify(domain)}, ${JSON.stringify(b.directiveId)}, _nmsWireReferences(resolution, ${referenceMap}, holon.workspace), { domainHash, actor, returnCreated: true, __nomosConflictSnapshots: [{ aggregateType: conflict.aggregateType, aggregateId: conflict.aggregateId, field: conflict.field, targetSchema: conflict.targetSchema, token: conflict.snapshot }] }) as Promise<_NomosRawWriteResult>);`,
             `                  },`,
             `                }];`,
             `              }`,
@@ -2758,33 +3267,52 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       const aOwned = aScopes.some((scope) => scope.owned === true);
       const aScopeJson = JSON.stringify(aScopes);
       const runtimeType = runtimeTypeOf(agg);
+      const collection = generatedAggregateCollectionName(agg.id);
+      const findRows = aScopes.length
+        ? `holon.queryById(id, await _readKeys(holon, keyStore, ${aScopeJson}${aOwned ? `, [{ type: ${JSON.stringify(runtimeType)}, id }]` : ""})) as Promise<Row<${agg.id}>[]>`
+        : `holon.queryById(id) as Promise<Row<${agg.id}>[]>`;
+      const allRows = aScopes.length
+        ? aOwned
+          ? `_readWithOwnedKeys(holon, keyStore, ${aScopeJson}, (keys) => holon.query("aggregatesByType", { __type: ${JSON.stringify(runtimeType)} }, keys) as Promise<Row<${agg.id}>[]>)`
+          : `holon.query("aggregatesByType", { __type: ${JSON.stringify(runtimeType)} }, await _readKeys(holon, keyStore, ${aScopeJson})) as Promise<Row<${agg.id}>[]>`
+        : `holon.query("aggregatesByType", { __type: ${JSON.stringify(runtimeType)} }) as Promise<Row<${agg.id}>[]>`;
       methods.push(
-        `    /** Read one ${agg.id} by aggregate id.${aScopes.length ? " Encrypted field(s) decrypt when the bound { keyStore } holds the scope key." : ""} */`,
-        aScopes.length
-          ? `    ${lcFirst(camel(agg.id))}ById: async (id: string) => ${wrapP(`holon.queryById(id, await _readKeys(holon, keyStore, ${aScopeJson}${aOwned ? `, [{ type: ${JSON.stringify(runtimeType)}, id }]` : ""})) as Promise<Row<${agg.id}Data>[]>`)},`
-          : `    ${lcFirst(camel(agg.id))}ById: (id: string) => ${wrapP(`holon.queryById(id) as Promise<Row<${agg.id}Data>[]>`)},`,
-        `    /** Every ${agg.id} (the type-index probe — O(result), not a scan). */`,
-        aScopes.length
-          ? aOwned
-            ? `    list${agg.id}s: async () => ${wrapP(`_readWithOwnedKeys(holon, keyStore, ${aScopeJson}, (keys) => holon.query("aggregatesByType", { __type: ${JSON.stringify(agg.id)} }, keys) as Promise<Row<${agg.id}Data>[]>)`)},`
-            : `    list${agg.id}s: async () => ${wrapP(`holon.query("aggregatesByType", { __type: ${JSON.stringify(agg.id)} }, await _readKeys(holon, keyStore, ${aScopeJson})) as Promise<Row<${agg.id}Data>[]>`)},`
-          : `    list${agg.id}s: () => ${wrapP(`holon.query("aggregatesByType", { __type: ${JSON.stringify(agg.id)} }) as Promise<Row<${agg.id}Data>[]>`)},`,
-        `    /** Watch one ${agg.id} by aggregate id (local reactive read; returns stop()). */`,
-        aOwned
-          ? `    watch${agg.id}ById: (id: string, cb: (rows: Row<${agg.id}Data>[]) => void, opts?: { intervalMs?: number }) => _watchWithOwnedKeys((changed) => holon.watchById(id, changed as (rows: unknown) => void, opts), async () => ${wrapP(`holon.queryById(id, await _readKeys(holon, keyStore, ${aScopeJson}, [{ type: ${JSON.stringify(runtimeType)}, id }])) as Promise<Row<${agg.id}Data>[]>`)}, cb),`
-          : `    watch${agg.id}ById: (id: string, cb: (rows: Row<${agg.id}Data>[]) => void, opts?: { intervalMs?: number }) => holon.watchById(id, ((rows: Row<${agg.id}Data>[]) => cb(${wrapRows("rows")})) as (rows: unknown) => void, opts),`,
+        `    /** ${agg.id} identity and reads. Business actions remain application-level because one action may change many aggregate kinds. */`,
+        `    ${collection}: {`,
+        `      /** Recover a typed reference from its stable public address. This identifies a record; it never grants authority. */`,
+        `      fromAddress: (address: string): NomosRef<${agg.id}> => { const record = parseNomosRef<${agg.id}>(address); _nmsReferenceId(record, ${JSON.stringify(agg.id)}, "", "address"); return record; },`,
+        `      /** Read one record. Nomos follows the reference's workspace privately when needed. */`,
+        `      find: async (record: NomosRef<${agg.id}>): Promise<NomosRecord<${agg.id}> | undefined> => {`,
+        `        const ref = _nmsReferenceData(record); _nmsReferenceId(record, ${JSON.stringify(agg.id)}, "", "record");`,
+        `        if (ref.workspace !== holon.workspace) {`,
+        `          if (!holon.__nomosOpenChild) throw new Error("opening this record needs the current @githolon/client");`,
+        `          return (await ${tsClientFactoryName(domain)}(await holon.__nomosOpenChild(ref.workspace)).${collection}.find(record));`,
+        `        }`,
+        `        const id = ref.id; const records = await ${wrapP(findRows)}; return records[0];`,
+        `      },`,
+        `      /** Every ${agg.id} visible to the signed-in application. */`,
+        `      all: async (): Promise<NomosRecord<${agg.id}>[]> => ${wrapP(allRows)},`,
+        `      /** Watch one record; returns stop(). */`,
+        `      watchOne: (record: NomosRef<${agg.id}>, cb: (record: NomosRecord<${agg.id}> | undefined) => void, opts?: { intervalMs?: number }): (() => void) => {`,
+        `        const ref = _nmsReferenceData(record); _nmsReferenceId(record, ${JSON.stringify(agg.id)}, "", "record");`,
+        `        if (ref.workspace !== holon.workspace) {`,
+        `          let active = true; let stop = () => {};`,
+        `          if (!holon.__nomosOpenChild) throw new Error("opening this record needs the current @githolon/client");`,
+        `          void holon.__nomosOpenChild(ref.workspace).then((child) => { if (active) stop = ${tsClientFactoryName(domain)}(child).${collection}.watchOne(record, cb, opts); }).catch(() => { if (active) cb(undefined); });`,
+        `          return () => { active = false; stop(); };`,
+        `        }`,
+        `        const id = ref.id;`,
+        ...(aOwned
+          ? [`        return _watchWithOwnedKeys((changed) => holon.watchById(id, changed as (rows: unknown) => void, opts), async () => ${wrapP(`holon.queryById(id, await _readKeys(holon, keyStore, ${aScopeJson}, [{ type: ${JSON.stringify(runtimeType)}, id }])) as Promise<Row<${agg.id}>[]>`)}, (records) => cb(records[0]));`]
+          : [`        return holon.watchById(id, ((rows: Row<${agg.id}>[]) => { const records = ${wrapRows("rows")}; cb(records[0]); }) as (rows: unknown) => void, opts);`]),
+        `      },`,
+        `    },`,
       );
       pastMethods.push(
-        `        /** Read one ${agg.id} by aggregate id at this moment. */`,
-        aScopes.length
-          ? `        ${lcFirst(camel(agg.id))}ById: async (id: string) => ${wrapP(`historic.queryById(id, await _readKeys(holon, keyStore, ${aScopeJson}${aOwned ? `, [{ type: ${JSON.stringify(runtimeType)}, id }]` : ""})) as Promise<Row<${agg.id}Data>[]>`)},`
-          : `        ${lcFirst(camel(agg.id))}ById: (id: string) => ${wrapP(`historic.queryById(id) as Promise<Row<${agg.id}Data>[]>`)},`,
-        `        /** Every ${agg.id} at this moment. */`,
-        aScopes.length
-          ? aOwned
-            ? `        list${agg.id}s: async () => ${wrapP(`_readWithOwnedKeys(holon, keyStore, ${aScopeJson}, (keys) => historic.query("aggregatesByType", { __type: ${JSON.stringify(agg.id)} }, keys) as Promise<Row<${agg.id}Data>[]>)`)},`
-            : `        list${agg.id}s: async () => ${wrapP(`historic.query("aggregatesByType", { __type: ${JSON.stringify(agg.id)} }, await _readKeys(holon, keyStore, ${aScopeJson})) as Promise<Row<${agg.id}Data>[]>`)},`
-          : `        list${agg.id}s: () => ${wrapP(`historic.query("aggregatesByType", { __type: ${JSON.stringify(agg.id)} }) as Promise<Row<${agg.id}Data>[]>`)},`,
+        `        ${collection}: {`,
+        `          find: async (record: NomosRef<${agg.id}>): Promise<NomosRecord<${agg.id}> | undefined> => { const id = _nmsReferenceId(record, ${JSON.stringify(agg.id)}, holon.workspace, "record"); const records = await ${wrapP(aScopes.length ? `historic.queryById(id, await _readKeys(holon, keyStore, ${aScopeJson}${aOwned ? `, [{ type: ${JSON.stringify(runtimeType)}, id }]` : ""})) as Promise<Row<${agg.id}>[]>` : `historic.queryById(id) as Promise<Row<${agg.id}>[]>`)}; return records[0]; },`,
+        `          all: async (): Promise<NomosRecord<${agg.id}>[]> => ${wrapP(aScopes.length ? (aOwned ? `_readWithOwnedKeys(holon, keyStore, ${aScopeJson}, (keys) => historic.query("aggregatesByType", { __type: ${JSON.stringify(runtimeType)} }, keys) as Promise<Row<${agg.id}>[]>)` : `historic.query("aggregatesByType", { __type: ${JSON.stringify(runtimeType)} }, await _readKeys(holon, keyStore, ${aScopeJson})) as Promise<Row<${agg.id}>[]>`) : `historic.query("aggregatesByType", { __type: ${JSON.stringify(runtimeType)} }) as Promise<Row<${agg.id}>[]>`)},`,
+        `        },`,
       );
     }
 
@@ -2793,13 +3321,13 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       `    past: {`,
       `      moments: async (opts: { limit?: number } = {}): Promise<NomosMoment[]> => {`,
       `        if (!holon.commits) throw new Error("past.moments() needs the current @githolon/client");`,
-      `        const actions = new Set(${JSON.stringify([...dirs.map((directive) => directive.id), ...(correctionActions.length > 0 ? [BUSINESS_CORRECTION_DIRECTIVE] : [])])});`,
+      `        const actions = new Set<string>(${JSON.stringify([...dirs.map((directive) => directive.id), ...(correctionActions.length > 0 ? [BUSINESS_CORRECTION_DIRECTIVE] : [])])});`,
       `        return (await holon.commits(opts))`,
       `          .filter((commit) => commit.domain === ${JSON.stringify(domain)} && commit.directiveId !== null && actions.has(commit.directiveId))`,
       `          .map((commit) => ({`,
       `          id: commit.oid,`,
       `          occurredAt: commit.at == null ? null : new Date(commit.at).toISOString(),`,
-      `          actorSubject: commit.actorSubject,`,
+      `          performedBy: commit.actorSubject,`,
       `          domain: commit.domain,`,
       `          action: commit.directiveId === ${JSON.stringify(BUSINESS_CORRECTION_DIRECTIVE)} ? "correction" : commit.directiveId,`,
       `          }));`,
@@ -2827,27 +3355,31 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
         `    /** THE SELF-DESCRIPTION: root links to exactly six grounded pages — model, current state, rules,`,
         `     *  history, decisions and evidence. The old \`events\` / \`transcript\` fields remain, so this is a`,
         `     *  strict enrichment of the activity narrative. \`section\` selects one page. */`,
-        `    describe: async (opts: { section?: NomosDescribeSection; since?: string; actor?: string; category?: string; limit?: number } = {}): Promise<NomosDescription> => {`,
+        `    describe: async (opts: { section?: NomosDescribeSection; since?: string; performedBy?: string; category?: string; limit?: number } = {}): Promise<NomosDescription> => {`,
         `      const raw = await holon.activityLog(opts.limit !== undefined ? { limit: opts.limit } : {});`,
         `      let events = raw.map(renderActivity).filter((e): e is ActivityEvent => e !== null);`,
-        `      if (opts.actor !== undefined) events = events.filter((e) => e.actorSubject === opts.actor);`,
+        `      if (opts.performedBy !== undefined) events = events.filter((e) => e.performedBy === opts.performedBy);`,
         `      if (opts.category !== undefined) events = events.filter((e) => e.category === opts.category);`,
         `      if (opts.since !== undefined) events = events.filter((e) => e.occurredAt >= opts.since!);`,
         `      let organisation: NomosOrganisationDescription = { complete: false, children: [] };`,
         `      if (holon.__nomosChildWorkspaces !== undefined) {`,
         `        try {`,
         `          const children = await holon.__nomosChildWorkspaces();`,
-        `          organisation = { complete: children.every((child) => child.status !== "unknown"), children: children.map((child) => ({`,
-        `            ...child, section: "root" as const, label: child.workspace,`,
-        `            question: "What does this part of the organisation do, and what has happened there?",`,
+          `          organisation = { complete: children.every((child) => child.status !== "unknown"), children: children.map((child) => ({`,
+          `            status: child.status, bornAt: child.bornAt, section: "root" as const, label: "Part of the organisation",`,
+          `            question: "What does this part of the organisation do, and what has happened there?",`,
         `            summary: child.status === "active"`,
         `              ? "This part of the organisation is active. Follow its generated description to continue."`,
         `              : child.status === "retired"`,
         `                ? "This part of the organisation is retired. Its recorded history remains explainable."`,
         `                : child.status === "reclaimed"`,
         `                  ? "This part of the organisation was reclaimed. Its birth remains part of this workspace's history."`,
-        `                  : "This part of the organisation has a newer lifecycle this client does not understand. Its link remains visible.",`,
-        `          })) };`,
+          `                  : "This part of the organisation has a newer lifecycle this client does not understand. Its link remains visible.",`,
+          `            open: async (): Promise<NomosDescription> => {`,
+          `              if (!holon.__nomosOpenChild) throw new Error("opening an organisation link needs the current @githolon/client");`,
+          `              return ${tsClientFactoryName(domain)}(await holon.__nomosOpenChild(child.workspace)).describe();`,
+          `            },`,
+          `          })) };`,
         `        } catch {`,
         `          // An old/unavailable runtime cannot prove a leaf. Keep incompleteness explicit.`,
         `        }`,
@@ -2863,10 +3395,10 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
         `      } else if (section === "current") {`,
         `        title = "Current state";`,
         `        summary = "The business records this session is allowed to read now. An unavailable type stays named without leaking its contents.";`,
-        `        items = await Promise.all(_NOMOS_DESCRIBE_MODEL.aggregateTypes.map(async (aggregate): Promise<NomosDescribeItem> => {`,
+        `        items = await Promise.all((_NOMOS_DESCRIBE_MODEL.aggregateTypes as readonly { queryType: string; audience: string; domain: string; type: string; label: string }[]).map(async (aggregate): Promise<NomosDescribeItem> => {`,
         `          try {`,
         `            const rows = await holon.query("aggregatesByType", { __type: aggregate.queryType }) as { type: string; id: string }[];`,
-        `            const refs = rows.map((row) => ({ workspace: holon.workspace, type: row.type, id: row.id }));`,
+        `            const refs = rows.map((row) => _nmsRef<_NomosAnyAggregate>(holon.workspace, row.type, row.id));`,
         `            const exact = rows.length > 0 || (aggregate.audience as string) === "public";`,
         `            return { kind: "current", id: \`${"${aggregate.domain}.${aggregate.type}"}\`, label: aggregate.label,`,
         `              summary: exact ? \`${"${rows.length} ${aggregate.label} record${rows.length === 1 ? \"\" : \"s\"} visible now."}\` : \`${"No ${aggregate.label} records are visible to this session."}\`,`,
@@ -2880,17 +3412,17 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
         `      } else if (section === "history") {`,
         `        title = "Verified business history"; summary = "What changed, who changed it and when, read from verified committed testimony.";`,
         `        items = events.map((event) => ({ kind: "change", id: event.eventId, label: event.title, summary: event.message,`,
-        `          details: { actor: event.actorSubject, occurredAt: event.occurredAt, domain: event.domain, kind: event.kind },`,
+        `          details: { performedBy: event.performedBy, occurredAt: event.occurredAt, domain: event.domain, kind: event.kind },`,
         `          refs: Object.values(event.refs) }));`,
         `      } else if (section === "decisions") {`,
         `        title = "Decisions and work needing attention"; summary = "Recorded business reasons, pending merges and retained rejected work, plus the model's declared conflict policy.";`,
         `        const decisions: NomosDescribeItem[] = events.filter((event) => event.kind.endsWith(".correction"))`,
         `          .map((event) => ({ kind: "decision", id: event.eventId, label: event.title, summary: event.message,`,
-        `            details: { actor: event.actorSubject, occurredAt: event.occurredAt, domain: event.domain }, refs: Object.values(event.refs) }));`,
+        `            details: { performedBy: event.performedBy, occurredAt: event.occurredAt, domain: event.domain }, refs: Object.values(event.refs) }));`,
         ...(hasSurfaced
           ? [
               `        const pending: NomosDescribeItem[] = (holon.pendingConflicts ? await holon.pendingConflicts() : []).flatMap((conflict) => {`,
-              `          const aggregate = _NOMOS_DESCRIBE_MODEL.aggregateTypes.find((candidate) => candidate.queryType === conflict.aggregateType);`,
+              `          const aggregate = (_NOMOS_DESCRIBE_MODEL.aggregateTypes as readonly { queryType: string; audience: string; domain: string; type: string; label: string }[]).find((candidate) => candidate.queryType === conflict.aggregateType);`,
               `          if (aggregate === undefined) return [];`,
               `          const rule = (_NOMOS_DESCRIBE_MODEL.pages.rules.items as readonly NomosDescribeItem[])`,
               `            .find((item) => item.id === \`${"${aggregate.domain}.${aggregate.type}.${conflict.field}.merge"}\`);`,
@@ -2902,7 +3434,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
               `          return [{ kind: conflict.status === "ready" ? "pending-merge" : "evolution-required",`,
               `            id: \`${"decision:${aggregate.domain}.${aggregate.type}:${conflict.aggregateId}:${conflict.field}"}\`, label: "Review " + subject, summary,`,
               `            details: { domain: aggregate.domain, type: aggregate.type, field: conflict.field, status: conflict.status, versions, next: conflict.status === "ready" ? "merge" : "update-model" },`,
-              `            refs: [{ workspace: holon.workspace, type: aggregate.type, id: conflict.aggregateId }] }];`,
+              `            refs: [_nmsRef<_NomosAnyAggregate>(holon.workspace, aggregate.type, conflict.aggregateId)] }];`,
               `        });`,
             ]
           : []),
@@ -2923,35 +3455,34 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
         `        title = "Evidence"; summary = "Opaque identities tying this answer to one workspace, one generated law and its verified business history.";`,
         `        const latestMoment = events[0];`,
         `        items = [`,
-        `          { kind: "evidence", id: "workspace", label: "Workspace", summary: holon.workspace, details: { workspace: holon.workspace } },`,
-        `          { kind: "evidence", id: "law", label: "Generated law", summary: domainHash, details: { domainHash } },`,
-        `          { kind: "evidence", id: "reader", label: "Verified reader", summary: actor ?? "anonymous", details: { actor: actor ?? null } },`,
+        `          { kind: "evidence", id: "application", label: "Application", summary: "This answer is bound to one verified local application.", details: { verified: true } },`,
+        `          { kind: "evidence", id: "model", label: "Business model", summary: "The installed model was checked before this application opened.", details: { compatible: true } },`,
+        `          { kind: "evidence", id: "reader", label: "Verified reader", summary: holon.principal ?? "anonymous", details: { reader: holon.principal ?? null } },`,
         `          ...(latestMoment === undefined ? [] : [{ kind: "evidence", id: latestMoment.eventId, label: "Latest verified moment",`,
-        `            summary: latestMoment.eventId, details: { occurredAt: latestMoment.occurredAt, actor: latestMoment.actorSubject, domain: latestMoment.domain, kind: latestMoment.kind } }]),`,
+        `            summary: latestMoment.eventId, details: { occurredAt: latestMoment.occurredAt, performedBy: latestMoment.performedBy, domain: latestMoment.domain, kind: latestMoment.kind } }]),`,
         `        ];`,
         `      }`,
         `      return { section, title, summary, items, links: _NOMOS_DESCRIBE_MODEL.links.map((link) => ({ ...link })), organisation, events, transcript: _activityTranscript(events) };`,
         `    },`,
-        `    /** NARRATIVE for ONE thing: the story of the aggregate \`aggregateId\` — events whose declared refs`,
+        `    /** NARRATIVE for ONE thing: the story of a generated record reference — events whose declared refs`,
         `     *  point at it (only directives declaring a ref to the aggregate appear in its story) + a transcript. */`,
-        `    describeHistory: async (aggregateId: string, opts: { limit?: number } = {}): Promise<ActivityNarrative> => {`,
+        `    describeHistory: async <TAggregate>(record: NomosRef<TAggregate>, opts: { limit?: number } = {}): Promise<ActivityNarrative> => {`,
+        `      const aggregateId = _nmsReferenceId(record, "", holon.workspace, "record");`,
         `      const raw = await holon.activityLog(opts.limit !== undefined ? { limit: opts.limit } : {});`,
         `      const events = raw.map(renderActivity).filter((e): e is ActivityEvent => e !== null)`,
-        `        .filter((e) => Object.values(e.refs).some((r) => r.id === aggregateId));`,
+        `        .filter((e) => Object.values(e.refs).some((r) => _nmsReferenceData(r).id === aggregateId));`,
         `      return { events, transcript: _activityTranscript(events) };`,
         `    },`,
       );
     }
 
     out.push(
-      `/** Typed client for the \`${domain}\` domain, bound to a connected holon.`,
-      ` *  Pass \`{ actor }\` (the verified principal uid) to author AS that user — every write seals it as`,
-      ` *  the captured principal, so the ReBAC \`.requires(...)\` gate + the integrity-dual endorse model`,
-      ` *  judge the real author. Omit it for open (un-gated) domains. */`,
-      `export function ${tsClientFactoryName(domain)}(holon: NomosHolon, opts: { domainHash?: string; actor?: string${domScopes.length > 0 ? "; keyStore?: NomosKeyStore" : ""} } = {}) {`,
-      `  const domainHash = opts.domainHash ?? ${hashConst};`,
-      `  const actor = opts.actor ?? holon.principal;`,
-      ...(encPresent ? [`  const keyStore: NomosKeyStore | undefined = ${domScopes.length > 0 ? "opts.keyStore" : "undefined"};`] : []),
+      `/** Framework binding for the generated application. Law identity, author identity and key custody`,
+      ` *  are captured from the connected stateful client; callers cannot override them. */`,
+      `function ${tsClientFactoryName(domain)}(holon: NomosHolon) {`,
+      `  const domainHash = ${hashConst};`,
+      `  const actor = holon.principal;`,
+      ...(encPresent ? [`  const keyStore: NomosKeyStore | undefined = ${domScopes.length > 0 ? `{ scopeKey: async (scope) => { if (!holon.__nomosScopeKey) throw new Error("encrypted business data needs the current @githolon/client"); return holon.__nomosScopeKey({ scope }); }, readKeys: async (scopes) => { if (!holon.__nomosScopeKeys) throw new Error("encrypted business data needs the current @githolon/client"); return holon.__nomosScopeKeys({ scopes }); } }` : "undefined"};`] : []),
       ...(ownedScope !== undefined && Object.keys(ownedActions).length > 0
         ? [
             `  const _ownedActions: Record<string, Record<"share" | "unshare" | "transfer", string>> = ${JSON.stringify(ownedActions)};`,
@@ -2959,16 +3490,17 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
             `  const _ownedReady = holon.__nomosEnsureOwnedIdentity`,
             `    ? holon.__nomosEnsureOwnedIdentity({ scope: ${JSON.stringify(ownedScope)}, domain: ${JSON.stringify(domain)}, domainHash }).catch((error) => { _ownedReadyError = error; })`,
             `    : Promise.resolve().then(() => { _ownedReadyError = new Error("owned records need the current @githolon/client"); });`,
-            `  const _ownedRecordAction = async (action: "share" | "unshare" | "transfer", record: NomosRef, peer: string): Promise<NomosOutcome> => {`,
+            `  const _ownedRecordAction = async (action: "share" | "unshare" | "transfer", record: NomosRef<_NomosAnyAggregate>, peer: string): Promise<void> => {`,
             `    await _ownedReady;`,
             `    if (_ownedReadyError !== undefined) throw _ownedReadyError;`,
-            `    if (record.workspace !== holon.workspace) throw new Error(\`${"${action}()"} cannot use a record from another workspace\`);`,
-            `    const directiveId = _ownedActions[record.type]?.[action];`,
+            `    const recordData = _nmsReferenceData(record);`,
+            `    if (recordData.workspace !== holon.workspace) throw new Error(\`${"${action}()"} cannot use a record from another workspace\`);`,
+            `    const directiveId = _ownedActions[recordData.type]?.[action];`,
             `    if (directiveId === undefined) throw new Error(\`${"${action}()"} needs a generated owned record reference\`);`,
             `    if (!peer.trim()) throw new Error(\`${"${action}()"} needs the person to act with\`);`,
             `    if (!holon.__nomosPrepareOwnedRecordAction) throw new Error("record sharing needs the current @githolon/client");`,
             `    const payload = await holon.__nomosPrepareOwnedRecordAction({ action, scope: ${JSON.stringify(ownedScope)}, record, peer });`,
-            `    return _outcome(holon.workspace, holon.offerDirective(${JSON.stringify(domain)}, directiveId, payload, { domainHash, actor, returnCreated: true }) as Promise<string | { head: string; created?: { type: string; id: string }[] }>, record);`,
+            `    return _commit(holon.offerDirective(${JSON.stringify(domain)}, directiveId, payload, { domainHash, actor, returnCreated: true }) as Promise<_NomosRawWriteResult>);`,
             `  };`,
           ]
         : []),
@@ -3010,21 +3542,20 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
             `        if (!holon.__nomosOwnedDeviceRequest) throw new Error("devices.request() needs the current @githolon/client");`,
             `        return await holon.__nomosOwnedDeviceRequest({ scope: ${JSON.stringify(ownedScope)} }) as NomosDeviceRequest;`,
             `      },`,
-            `      approve: async (request: NomosDeviceRequest): Promise<NomosOutcome> => {`,
+            `      approve: async (request: NomosDeviceRequest): Promise<void> => {`,
             `        const principal = actor ?? holon.principal;`,
             `        if (!principal || !principal.trim()) throw new Error("devices.approve() needs a signed-in Nomos session");`,
             `        if (!holon.__nomosPrepareOwnedDeviceApproval) throw new Error("devices.approve() needs the current @githolon/client");`,
             `        const payload = await holon.__nomosPrepareOwnedDeviceApproval({ request, scope: ${JSON.stringify(ownedScope)} });`,
-            `        return _outcome(holon.workspace, holon.offerDirective(${JSON.stringify(domain)}, ${JSON.stringify(OWNED_DEVICE_APPROVAL_DIRECTIVE)}, payload, { domainHash, actor: principal, returnCreated: true }) as Promise<string | { head: string; created?: { type: string; id: string }[] }>);`,
+            `        return _commit(holon.offerDirective(${JSON.stringify(domain)}, ${JSON.stringify(OWNED_DEVICE_APPROVAL_DIRECTIVE)}, payload, { domainHash, actor: principal, returnCreated: true }) as Promise<_NomosRawWriteResult>);`,
             `      },`,
             `    },`,
           ]
         : []),
       // THE OWNER CEREMONY (slice 2): only for a domain that actually defines an encryption scope.
-      ...(domScopes.length > 0
+      ...(manualEncryptionPresent && domScopes.length > 0
         ? [
-            `    /** OWNER CEREMONY (slice 2): grantAndWrap / revokeAndRotate / rotate — the operator-blind`,
-            `     *  key-epoch handshake as one call. Bind \`{ actor }\` (the owner) to author the fan-out. */`,
+            `    /** Owner policy: grant, revoke and rotate under the signed-in identity. */`,
             `    encryption: _ownerEncryption(holon, { domain: ${JSON.stringify(domain)}, domainHash, actor, scopes: ${JSON.stringify(domScopes)} }) as NomosEncryption,`,
           ]
         : []),
@@ -3035,64 +3566,213 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     );
   }
 
-  // ROLE SUGAR — the per-(role × aggregate) `canEdit<Agg>` / `canView<Agg>` UI-HINT helpers. They
-  // evaluate LOCALLY against the folded RelationTuple projection (the client-side MIRROR of
-  // `engine.check`) — INFORMATIONAL only; THE KERNEL GATE REMAINS THE AUTHORITY and refuses regardless.
+  // THE ONE APPLICATION ENTRY. Domain factories remain implementation detail; this package-level opener
+  // owns identity, home binding, durable custody, continuous sync, compatibility and recovery. Multi-domain
+  // applications are flattened into one business vocabulary and collision-check rather than silently choosing.
   {
-    const editRels = new Map<string, Set<string>>(); // aggregate id → the edit relations that cover it
-    const viewRels = new Map<string, Set<string>>(); // aggregate id → the view relations that cover it
-    for (const m of modules) {
-      for (const r of m.roles ?? []) {
-        if (r.editRelation) for (const agg of r.editAggregates) (editRels.get(agg) ?? editRels.set(agg, new Set()).get(agg)!).add(r.editRelation);
-        // A role-holder granted `.canView` holds BOTH its view relation AND (when it can edit) its edit
-        // relation — an editor can always read what it edits, so canView accepts either.
-        if (r.viewRelation) for (const agg of r.viewAggregates) {
-          const s = viewRels.get(agg) ?? viewRels.set(agg, new Set()).get(agg)!;
-          s.add(r.viewRelation);
-          if (r.editRelation && r.editAggregates.includes(agg)) s.add(r.editRelation);
-        }
-      }
+    const rootBirths = applicationBirths.filter((birth) => clientDomains.includes(birth.sourceDomain));
+    const childApplicationTypes = applicationBirths.filter((birth, index) =>
+      applicationBirths.findIndex((candidate) => candidate.applicationType === birth.applicationType) === index);
+    const ambiguousChildApplication = childApplicationTypes.find((birth) =>
+      applicationBirths.some((candidate) =>
+        candidate.applicationType === birth.applicationType && candidate.targetDomain !== birth.targetDomain));
+    if (ambiguousChildApplication !== undefined) {
+      throw new Error(
+        `generated TypeScript child application '${ambiguousChildApplication.applicationType}' names more than one domain; rename the born aggregate`,
+      );
     }
-    if (editRels.size > 0 || viewRels.size > 0) {
-      out.push(
-        `// ── ROLE POLICY (UI hints — the KERNEL GATE is the authority) ─────────────────────────────`,
-        `/** One folded RelationTuple row (as \`relationTuplesByObject\`/\`queryById("reltuple-…")\` yields). */`,
-        `export interface NomosRoleRelationRow { data?: { relation?: string; subjects?: Record<string, unknown> } }`,
-        `/** True iff \`principal\` holds ANY of \`relations\` as an ACTIVE tuple in \`rows\` (or a \`user:*\` wildcard). */`,
-        `function _holdsAnyRelation(rows: readonly NomosRoleRelationRow[] | undefined, relations: readonly string[], principal: string): boolean {`,
-        `  const want = new Set(relations);`,
-        `  for (const r of rows ?? []) {`,
-        `    if (r?.data?.relation === undefined || !want.has(r.data.relation)) continue;`,
-        `    for (const [subj, leafRaw] of Object.entries(r.data.subjects ?? {})) {`,
-        `      let leaf: { status?: string };`,
-        `      try { leaf = typeof leafRaw === "string" ? JSON.parse(leafRaw) : (leafRaw as { status?: string }); } catch { leaf = {}; }`,
-        `      if (leaf?.status !== undefined && leaf.status !== "active") continue;`,
-        `      if (subj === \`user:\${principal}\` || subj === "user:*") return true;`,
-        `    }`,
-        `  }`,
-        `  return false;`,
-        `}`,
+    if (childApplicationTypes.some((birth) => birth.applicationType === applicationName)) {
+      throw new Error(
+        `Sorry mate — a born aggregate claims generated TypeScript application type '${applicationName}', which is already owned by the package application. ` +
+          `Nomos will not silently rename it; rename the aggregate and compile again.`,
       );
-      for (const [agg, rels] of [...editRels].sort((a, b) => (a[0] < b[0] ? -1 : 1))) {
-        out.push(
-          `/** UI HINT — may \`principal\` EDIT a ${agg}? Mirrors the kernel's ReBAC check over the folded`,
-          ` *  tuples; INFORMATIONAL only (the one wasm gate is the authority and refuses regardless). */`,
-          `export function canEdit${cap(agg)}(relations: readonly NomosRoleRelationRow[] | undefined, principal: string): boolean {`,
-          `  return _holdsAnyRelation(relations, ${JSON.stringify([...rels].sort())}, principal);`,
-          `}`,
-        );
-      }
-      for (const [agg, rels] of [...viewRels].sort((a, b) => (a[0] < b[0] ? -1 : 1))) {
-        out.push(
-          `/** UI HINT — may \`principal\` VIEW a ${agg}? Mirrors the kernel's ReBAC read gate;`,
-          ` *  INFORMATIONAL only (the one wasm read boundary is the authority). */`,
-          `export function canView${cap(agg)}(relations: readonly NomosRoleRelationRow[] | undefined, principal: string): boolean {`,
-          `  return _holdsAnyRelation(relations, ${JSON.stringify([...rels].sort())}, principal);`,
-          `}`,
-        );
-      }
-      out.push(``);
     }
+    const duplicateRootBirth = rootBirths.find((birth, index) =>
+      rootBirths.findIndex((candidate) => candidate.method === birth.method) !== index);
+    if (duplicateRootBirth !== undefined) {
+      throw new Error(
+        `generated TypeScript application birth '${duplicateRootBirth.method}' is declared by more than one co-resident root domain`,
+      );
+    }
+    const internalApplicationDirectiveMembers = modules.flatMap((module) =>
+      (module.directives as Directive<unknown>[])
+        .filter((directive) =>
+          (directive as { birthsChild?: boolean }).birthsChild === true &&
+          (directive as { businessBirth?: unknown }).businessBirth === undefined
+        )
+        .map((directive) => directive.id)
+    );
+    const privateApplicationMembers = [
+      "domain",
+      "domainHash",
+      "interface",
+      "model",
+      "encryption",
+      "recovery",
+      "devices",
+      ...internalApplicationDirectiveMembers,
+      ...applicationBirths.map((birth) => birth.method),
+    ] as const;
+    const baseApplicationType = clientDomains
+      .map((domain) => tsDomainApplicationType(domain))
+      .join(" & ") || "Record<never, never>";
+    const birthApplicationType = rootBirths.length === 0
+      ? "Record<never, never>"
+      : `{ ${rootBirths.map((birth) =>
+          `readonly ${JSON.stringify(birth.method)}: (input: ${birth.payloadName}) => Promise<${birth.applicationType}>`
+        ).join("; ")} }`;
+    const applicationType = `${baseApplicationType} & ${birthApplicationType}`;
+    out.push(
+      `type _NomosPrivateApplicationMember = ${privateApplicationMembers.map((name) => JSON.stringify(name)).join(" | ")};`,
+      `type _NomosPublicDomain<T> = Omit<T, _NomosPrivateApplicationMember>;`,
+      ...generatedDomains.map((domain) =>
+        `type ${tsDomainApplicationType(domain)} = _NomosPublicDomain<ReturnType<typeof ${tsClientFactoryName(domain)}>>;`
+      ),
+      ...childApplicationTypes.map((birth) =>
+        `export type ${birth.applicationType} = _NomosPublicDomain<ReturnType<typeof ${tsClientFactoryName(birth.targetDomain)}>>;`
+      ),
+      `type _${applicationName}Business = ${applicationType};`,
+      `export type ${applicationName}Status = _NomosApplicationStatus;`,
+      `export type ${applicationName} = _${applicationName}Business & _NomosApplicationParticipant & _NomosApplicationLifecycle${hasInvitations ? " & _NomosApplicationInvitations" : ""};`,
+      `export interface ${applicationName}OpenOptions {`,
+      `  /** Nomos Cloud serving this deployed application. Configure it once at the app boundary. */`,
+      `  readonly cloud: string;`,
+      `  /** The deployed business application anchor, configured once at the app boundary. */`,
+      `  readonly application: string;`,
+      `  /** Return the signed-in authority credential; when supplied, bind its opaque device challenge. */`,
+      `  readonly signIn: (request?: { readonly deviceChallenge?: string }) => Promise<string>;`,
+      `}`,
+      `function _nomosPublicDomain<T extends Record<string, unknown>>(domain: T): _NomosPublicDomain<T> {`,
+      `  const application: Record<string, unknown> = {};`,
+      `  const privateMembers = new Set<string>(${JSON.stringify(privateApplicationMembers)});`,
+      `  for (const [name, value] of Object.entries(domain)) if (!privateMembers.has(name)) application[name] = value;`,
+      `  return application as _NomosPublicDomain<T>;`,
+      `}`,
+      `function _nomosBind${applicationName}(`,
+      `  holon: NomosHolon,`,
+      `  user: { readonly identityId: string; readonly identityAddress: string },`,
+      `): _${applicationName}Business & _NomosApplicationParticipant${hasInvitations ? " & _NomosApplicationInvitations" : ""} {`,
+      ...clientDomains.map((domain, index) =>
+        `  const _nmsRoot${index} = ${tsClientFactoryName(domain)}(holon);`),
+      `  const domains = [${clientDomains.map((_domain, index) => `_nmsRoot${index}`).join(", ")}] as const;`,
+      `  const application: Record<string, unknown> = {};`,
+      `  application.currentUser = { identity: { id: user.identityId, address: user.identityAddress } } as User;`,
+      ...(hasInvitations
+        ? [
+            `  for (const reserved of ["recipient", "createInvitation", "redeemInvitation"] as const) {`,
+            `    if (domains.some((domain) => reserved in domain)) throw new Error("Sorry mate — '" + reserved + "' is a Nomos application concept; rename the tenant action");`,
+            `  }`,
+            `  application.recipient = (uid: string): Recipient<User> => {`,
+            `    const value = uid.trim();`,
+            `    if (!value) throw new TypeError("recipient(uid) needs the identity provider user id");`,
+            `    return _nmsRecipient<User>("user:" + value);`,
+            `  };`,
+            `  application.createInvitation = async (): Promise<Invitation<User>> =>`,
+            `    _nmsInvitation<User>(await nomosInternalCreateInvitation(holon));`,
+            `  application.redeemInvitation = (link: string): Promise<void> =>`,
+            `    nomosInternalRedeemInvitation(holon, link, ${JSON.stringify(invitationPolicies)});`,
+          ]
+        : []),
+      `  const privateMembers = new Set<string>(${JSON.stringify(privateApplicationMembers)});`,
+      `  const singletonMembers = new Set<string>(["watchActivity", "activityLog", "describe", "describeHistory"]);`,
+      `  const pasts: Array<{ moments: (opts?: { limit?: number }) => Promise<NomosMoment[]>; at: (moment: NomosMoment) => Record<string, unknown> }> = [];`,
+      `  const conflictSets: Array<Record<string, unknown>> = [];`,
+      ...(hasCorrections
+        ? [`  const correctionSets: Array<{ domain: string; value: { undo(reason: string): Promise<NomosCorrectionOutcome>; redo(reason: string): Promise<NomosCorrectionOutcome> } }> = [];`]
+        : []),
+      `  const routedOwnedActions = new Map<string, Array<(...args: unknown[]) => Promise<unknown>>>();`,
+      `  for (const domain of domains) for (const [name, value] of Object.entries(domain)) {`,
+      `    if (privateMembers.has(name)) continue;`,
+      `    if (name === "past") { pasts.push(value as typeof pasts[number]); continue; }`,
+      `    if (name === "conflicts") { conflictSets.push(value as Record<string, unknown>); continue; }`,
+      ...(hasCorrections
+        ? [`    if (name === "corrections") { correctionSets.push({ domain: String(domain.domain), value: value as typeof correctionSets[number]["value"] }); continue; }`]
+        : []),
+      `    if (name === "share" || name === "unshare" || name === "transfer") {`,
+      `      const candidates = routedOwnedActions.get(name) ?? [];`,
+      `      candidates.push(value as (...args: unknown[]) => Promise<unknown>); routedOwnedActions.set(name, candidates); continue;`,
+      `    }`,
+      `    if (singletonMembers.has(name) && name in application) continue;`,
+      `    if (name in application) throw new Error("Nomos application member collision: '" + name + "' is declared by more than one business domain; rename one of them");`,
+      `    application[name] = value;`,
+      `  }`,
+      ...rootBirths.flatMap((birth) => {
+        const rootIndex = clientDomains.indexOf(birth.sourceDomain);
+        return [
+        `  application[${JSON.stringify(birth.method)}] = async (input: ${birth.payloadName}): Promise<${birth.applicationType}> => {`,
+        `    const root = await _nmsRoot${rootIndex}[${JSON.stringify(birth.method)}](input);`,
+        `    const address = _nmsReferenceData(root);`,
+        `    return nomosInternalOpenGeneratedChildApplication(`,
+        `      holon,`,
+        `      address.workspace,`,
+        `      (child) => _nomosPublicDomain(${tsClientFactoryName(birth.targetDomain)}(child as NomosHolon)),`,
+        `    );`,
+        `  };`,
+        ];
+      }),
+      `  if (pasts.length > 0) application.past = {`,
+      `    moments: async (opts: { limit?: number } = {}): Promise<NomosMoment[]> => {`,
+      `      const moments = (await Promise.all(pasts.map((past) => past.moments(opts)))).flat();`,
+      `      moments.sort((a, b) => (b.occurredAt ?? "").localeCompare(a.occurredAt ?? ""));`,
+      `      return opts.limit === undefined ? moments : moments.slice(0, opts.limit);`,
+      `    },`,
+      `    at: (moment: NomosMoment): Record<string, unknown> => {`,
+      `      const historic: Record<string, unknown> = {};`,
+      `      for (const past of pasts) for (const [name, value] of Object.entries(past.at(moment))) {`,
+      `        if (name in historic) throw new Error("Nomos historic member collision: '" + name + "' is declared by more than one business domain; rename the aggregate");`,
+      `        historic[name] = value;`,
+      `      }`,
+      `      return historic;`,
+      `    },`,
+      `  };`,
+      `  if (conflictSets.length > 0) {`,
+      `    const conflicts: Record<string, unknown> = {};`,
+      `    for (const set of conflictSets) for (const [name, value] of Object.entries(set)) {`,
+      `      if (name === "summary" && name in conflicts) continue;`,
+      `      if (name in conflicts) throw new Error("Nomos conflict member collision: '" + name + "' is declared by more than one business domain; rename the aggregate");`,
+      `      conflicts[name] = value;`,
+      `    }`,
+      `    application.conflicts = conflicts;`,
+      `  }`,
+      ...(hasCorrections
+        ? [
+            `  if (correctionSets.length > 0) {`,
+            `    const currentCorrections = async () => {`,
+            `      if (!holon.commits) throw new Error("corrections need verified application history");`,
+            `      const supported = new Set(correctionSets.map((entry) => entry.domain));`,
+            `      const latest = (await holon.commits({ limit: 1000 })).find((commit) => commit.domain !== null && supported.has(commit.domain));`,
+            `      const selected = correctionSets.find((entry) => entry.domain === latest?.domain);`,
+            `      if (selected === undefined) throw new Error("there is no business change to correct yet");`,
+            `      return selected.value;`,
+            `    };`,
+            `    application.corrections = {`,
+            `      undo: async (reason: string) => (await currentCorrections()).undo(reason),`,
+            `      redo: async (reason: string) => (await currentCorrections()).redo(reason),`,
+            `    };`,
+            `  }`,
+          ]
+        : []),
+      `  for (const [name, candidates] of routedOwnedActions) application[name] = async (...args: unknown[]): Promise<unknown> => {`,
+      `    let unsupported: unknown;`,
+      `    for (const candidate of candidates) try { return await candidate(...args); } catch (error) {`,
+      `      if (!(error instanceof Error) || !error.message.includes("needs a generated owned record reference")) throw error;`,
+      `      unsupported = error;`,
+      `    }`,
+      `    throw unsupported ?? new Error(name + " needs a generated owned record reference");`,
+      `  };`,
+      `  return application as unknown as _${applicationName}Business & _NomosApplicationParticipant${hasInvitations ? " & _NomosApplicationInvitations" : ""};`,
+      `}`,
+      `/** Open the one durable, signed-in ${opts.packageName} business application.`,
+      ` *  Keep and pass this object down as application state; do not create a repository, runtime host`,
+      ` *  or parallel cache around it. Nomos owns offline custody and synchronization. */`,
+      `export function ${applicationOpener}(options: ${applicationName}OpenOptions): Promise<${applicationName}> {`,
+      `  return nomosInternalOpenGeneratedApplication(`,
+      `    { cloud: options.cloud, application: options.application, signIn: options.signIn },`,
+      `    (holon, user) => _nomosBind${applicationName}(holon as NomosHolon, user),`,
+      `  );`,
+      `}`,
+      ``,
+    );
   }
 
   // RECURSIVE PAYLOAD TYPES (`z.lazy`): emit each minted named alias once. Sorted by name for