@githolon/dsl 0.101.5 → 0.102.0

package/src/compile_package_main.ts

@@ -59,7 +59,6 @@ import {
   generateDartActivityRegistry,
   collectActivityDescriptors,
   collectPayloadIdOfTargets,
-  typedIdClassForAggregateType,
   type DartImport,
   type DartRefImport,
   type DomainModule,
@@ -67,14 +66,28 @@ import {
 } from "./codegen_dart.js";
 import type { ContractHandle } from "./contract.js";
 import { generateDartBridgeClient } from "./codegen_dart_client.js";
+import {
+  dartApplicationClassName,
+  dartApplicationPublicClassNames,
+  generateDartApplication,
+} from "./codegen_dart_application.js";
+import {
+  dartScenarioGivenClassName,
+  dartScenarioClassName,
+  dartTestPersonClassName,
+  generateDartScenario,
+} from "./codegen_dart_scenario.js";
 import { buildNomosDescribeModel } from "./describe_model.js";
 import {
+  FRAMEWORK_AGGREGATE_IDS,
+  FRAMEWORK_DIRECTIVE_IDS,
   isFrameworkAggregate,
   isFrameworkDirective,
   isFrameworkQuery,
 } from "./framework/framework_aggregates.js";
 import { RelationTuple, relationTuplesByObject } from "./framework/relations.js";
 import { isNamespacedAggregate } from "./read_projection_namespace.js";
+import { collectPayloadValueObjectDescriptors } from "./value_object.js";
 import { finishCount, type AnyCount } from "./count.js";
 import type { QueryDecl } from "./query.js";
 import type { SpatialDecl } from "./spatial.js";
@@ -88,7 +101,6 @@ import {
   composeDomainModule,
   directivesOf,
   emitUsdJsonForModules,
-  packageUsda,
   sha256HexUtf8,
   type Mod,
 } from "./build_package.js";
@@ -99,6 +111,10 @@ import { expandBusinessBirthExports } from "./business_birth.js";
 import { withOwnedCustodyExports } from "./framework/owned_custody.js";
 import { expandRoleExports, rolesOf } from "./role.js";
 import { collectEngineRouting } from "./engine_entry.js";
+import {
+  canonicalizeEngineJavascript,
+  canonicalizeGeneratedClientJavascript,
+} from "./engine_javascript.js";
 import {
   discover,
   isCountDecl,
@@ -113,12 +129,21 @@ import { canonicalTaxonomyFragment, validateWorkspaceTaxonomyAndRoutes } from ".
 import { shardingLawModule, type ShardingLawSpec } from "./workspace_sharding.js";
 import { finishExtremum, type AnyExtremum } from "./extremum.js";
 import type { WorkspaceInvariantDecl } from "./framework/workspace_invariant.js";
-import { type RelationTypeDecl, isRelationTypeDecl, validateRelationType } from "./relation_schema.js";
+import {
+  discoverRelationTypeDeclarations,
+  mergeRelationTypeDeclarations,
+  type RelationTypeDecl,
+} from "./relation_schema.js";
 import {
   emitLayeredDomain,
   flattenLayeredUsd,
   layeredRootUsda,
+  nativePlanPackageUsda,
+  parseUsdaDocument,
+  usdaLayerText,
   type LayeredModuleInput,
+  type UsdPlanAsset,
+  type UsdPlanRoute,
 } from "./usd_layers.js";
 import { domainManifest, canonicalJson } from "./manifest.js";
 import type { WireSchema } from "./wire.js";
@@ -130,7 +155,7 @@ import {
 import { emitUsd, type UsdLayer } from "./usd.js";
 import { emitLayeredRelationUsda, type RelationLayerInput } from "./relation_composition.js";
 import { assertNoDartBarrelCollisions, type BarrelExportedFile } from "./dart_barrel_guard.js";
-import { generateTsClient, tsClientFactoryName, recursiveLazyTypes } from "./codegen_ts.js";
+import { generateTsClient, tsApplicationName, tsClientFactoryName, recursiveLazyTypes } from "./codegen_ts.js";
 import { generateOpenApiFragment, mergeOpenApiFragments } from "./codegen_openapi.js";
 import { domainInterface, type DomainInterface } from "./shape_compat.js";
 import { generateTsProof, proofLegsIndex } from "./codegen_proof.js";
@@ -138,6 +163,14 @@ import { checkDomainModules, formatFindings, hasRefusal } from "./law_check.js";
 import type { NomosCompat } from "./compat_manifest.js";
 import { requiredKernelFeatures, type FeatureProbeModule } from "./kernel_capabilities.js";
 import { APPLICATION_HOME_DOMAIN } from "./framework/application_home_domain.js";
+import { resolveApplicationTopology } from "./application_topology.js";
+import { isBusinessIntent } from "./intent.js";
+import {
+  compileApplicationComposition,
+  isApplicationCompositionConfig,
+  packageAssetUsda,
+  type PackageRootPart,
+} from "./application_composition.js";
 
 const DSL_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 
@@ -188,6 +221,8 @@ type DartSupportImport = "vendored" | "package";
 interface PackageConfig {
   readonly name: string;
   readonly domains: readonly DomainConfig[];
+  /** The one OpenUSD model root this independently published package exports. */
+  readonly rootPart?: PackageRootPart;
   /** reportId → "modulePath#exportName" (the export is `(actor) => Report`). */
   readonly reports?: Record<string, string>;
   readonly outDir?: string;
@@ -195,7 +230,7 @@ interface PackageConfig {
    * Typed DART frontend (the Flutter sibling of the generated TS client; #codegen_dart).
    * `false`/absent = skip (default). `true` = emit into `<outDir>/dart/`;
    * `{ out: "relative/dir" }` = emit there (resolved against the config dir).
-   * `{ support: "package" }` keeps `package:nomos_client/nomos_client.dart` imports for Flutter apps that
+   * `{ support: "package" }` keeps the framework-internal runtime import for generated Flutter applications that
    * already depend on `nomos_client`/`nomos_flutter`. The default `"vendored"` mode preserves the old
    * self-contained directory.
    * Per composed domain one `<name>.dart` (payload classes + read models + typed read
@@ -224,7 +259,7 @@ interface PackageConfig {
          *     pure `nomos_types` core — frontend-safe: no bridge, no sessions, no lifecycle.
          *   • `client` — the effectful runtime clients (`<name>.client.dart`, offer methods over
          *     NomosBridge). Depends on the types package + `nomos_client`.
-         *   • `test`   — optional; the headless-harness surface for widget/integration tests.
+         *   • `test`   — optional; generated business scenarios for widget/integration tests.
          * The layering line: UI code depends on `types`; composition/runtime code on `client`;
          * generated TYPES may flow to the UI, generated CLIENTS may not.
          * Each package's `pubspec.yaml` is scaffolded ONLY IF MISSING (tenant-owned versioning);
@@ -271,26 +306,8 @@ interface PackageConfig {
         readonly names?: Readonly<Record<string, string>>;
       };
   /**
-   * OPT-IN layered USD emission (also `--layered` on the CLI). When true, ALSO emit
-   * `build/layers/<domain>--<module>.usda` (+ `.layer.json`) — one REAL USD layer per
-   * authored MODULE — and `build/<name>.layered.usda`, a root whose subLayers stack
-   * them (USD strongest-first == Nomos module order reversed). The flattened
-   * `.package.usda` emission and the domainHash DO NOT MOVE; the compile asserts
-   * fail-closed that the layer stack flattens BYTE-IDENTICALLY to the canonical
-   * composed IR (the monoid homomorphism — see `usd_layers.ts` /
-   * `docs/usd_layered_composition.md`).
-   */
-  readonly layered?: boolean;
-  /**
-   * THE COMPACT PACKAGE ERA (opt-in; also `--compact` / NOMOS_COMPACT=1). ONE batched,
-   * NAMED domainHash move that shrinks the package ~4x (guestbook 1.48MB → ~0.35MB):
-   *   • minified engine lump (esbuild minify — string literals, and so refusal codes, unchanged);
-   *   • zod locales stripped to `en` only (the locale barrel is 35% of every lump and is
-   *     namespace-re-exported so tree-shaking can't drop it; `en` keeps error messages
-   *     byte-identical to today's default);
-   *   • base64 blob fields (`*B64`, 1.33x text) instead of hex (2x).
-   * REQUIRES the whole consuming stack (cloud kernel + clients) at ≥ the release that shipped
-   * the decode arms. Default stays off until a future major; hex packages parse forever.
+   * Minify each content-addressed execution plan asset. Native USD law remains readable and
+   * unchanged; this only changes the implementation asset bytes and therefore the package hash.
    */
   readonly compact?: boolean;
 }
@@ -300,6 +317,67 @@ function fail(msg: string): never {
   process.exit(1);
 }
 
+/** Locate stock OpenUSD's usdcat without making it a runtime dependency. */
+function resolveUsdcat(): string | undefined {
+  const candidates = [process.env.NOMOS_USDCAT, "/usr/bin/usdcat", "usdcat"]
+    .filter((candidate): candidate is string => typeof candidate === "string" && candidate.length > 0);
+  for (const candidate of [...new Set(candidates)]) {
+    try {
+      execFileSync(candidate, ["--help"], { stdio: "ignore" });
+      return candidate;
+    } catch {
+      // Try the next stock-tool location.
+    }
+  }
+  return undefined;
+}
+
+/** Name the first structural disagreement between two canonical law values. */
+function firstLawDifference(expected: unknown, actual: unknown, at = "$law"): string | undefined {
+  if (Object.is(expected, actual)) return undefined;
+  if (Array.isArray(expected) || Array.isArray(actual)) {
+    if (!Array.isArray(expected) || !Array.isArray(actual)) {
+      return `${at}: expected ${Array.isArray(expected) ? "an array" : typeof expected}, got ${Array.isArray(actual) ? "an array" : typeof actual}`;
+    }
+    if (expected.length !== actual.length) {
+      const ids = (items: unknown[]): string[] => items.flatMap((item) =>
+        item !== null && typeof item === "object" && typeof (item as { id?: unknown }).id === "string"
+          ? [(item as { id: string }).id]
+          : []);
+      const expectedIds = ids(expected);
+      const actualIds = ids(actual);
+      const missing = expectedIds.filter((id) => !actualIds.includes(id));
+      const extra = actualIds.filter((id) => !expectedIds.includes(id));
+      return `${at}.length: expected ${expected.length}, got ${actual.length}` +
+        `${missing.length > 0 ? `; missing [${missing.join(", ")}]` : ""}` +
+        `${extra.length > 0 ? `; extra [${extra.join(", ")}]` : ""}`;
+    }
+    for (let index = 0; index < expected.length; index++) {
+      const difference = firstLawDifference(expected[index], actual[index], `${at}[${index}]`);
+      if (difference !== undefined) return difference;
+    }
+    return undefined;
+  }
+  if (expected !== null && actual !== null && typeof expected === "object" && typeof actual === "object") {
+    const expectedObject = expected as Record<string, unknown>;
+    const actualObject = actual as Record<string, unknown>;
+    if (typeof expectedObject.path === "string" && expectedObject.path === actualObject.path) {
+      at = `${at}{path=${expectedObject.path}}`;
+    }
+    const expectedKeys = Object.keys(expectedObject).sort();
+    const actualKeys = Object.keys(actualObject).sort();
+    if (JSON.stringify(expectedKeys) !== JSON.stringify(actualKeys)) {
+      return `${at}: expected keys [${expectedKeys.join(", ")}], got [${actualKeys.join(", ")}]`;
+    }
+    for (const key of expectedKeys) {
+      const difference = firstLawDifference(expectedObject[key], actualObject[key], `${at}.${key}`);
+      if (difference !== undefined) return difference;
+    }
+    return undefined;
+  }
+  return `${at}: expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`;
+}
+
 // ── decl auto-discovery (by SHAPE, mirroring the engine entry's duck-types) ───────
 // The query/workspace-invariant/spatial/sum/count predicates + `discover` live in the SHARED
 // bundle-safe `decl_shapes.ts` (imported above) — the lump's self-describe verb discovers by the
@@ -432,7 +510,7 @@ function resolveNamed<T>(merged: Mod, names: readonly string[] | undefined, what
  * Vendored output rewrites it to the relative barrel so the directory is
  * self-contained (no pub path-dependency on the framework package).
  */
-const DART_PACKAGE_IMPORT = `import 'package:nomos_client/nomos_client.dart';`;
+const DART_PACKAGE_IMPORT = `import 'package:nomos_client/src/nms_generated_runtime.dart';`;
 const DART_RELATIVE_IMPORT = `import 'nomos_client.dart';`;
 
 /**
@@ -482,10 +560,50 @@ const DART_SUPPORT_CORE_SRC = [
 // `package:nomos_types/...` imports are rewritten to the local vendored shim (see emitDart).
 // (`home.dart` is NOT vendored — the home-onboarding runtime drags `package:crypto`; nothing the
 // codegen emits references it.)
-const DART_SUPPORT_RUNTIME_SRC = ["provider.dart", "webview_bridge.dart", "session_bound.dart"] as const;
+const DART_SUPPORT_RUNTIME_SRC = [
+  "provider.dart",
+  "webview_bridge.dart",
+  "session_bound.dart",
+  "record_origin.dart",
+] as const;
 const DART_SUPPORT_SRC = [...DART_SUPPORT_CORE_SRC, ...DART_SUPPORT_RUNTIME_SRC] as const;
 /** The local shim replacing `package:nomos_types/nomos_types.dart` inside vendored runtime files. */
 const VENDORED_TYPES_SHIM = "nomos_types.dart";
+const VENDORED_META_DEP = "^1.12.0";
+
+/**
+ * Vendored runtime files carry package:meta's @internal boundary. Keep the
+ * containing Dart package honest by declaring that implementation dependency
+ * instead of stripping the annotation from generated copies.
+ */
+function ensureVendoredMetaDependency(dartOut: string): void {
+  let dir = path.resolve(dartOut);
+  let pubspec: string | undefined;
+  for (let hops = 0; hops < 8; hops++) {
+    const candidate = path.join(dir, "pubspec.yaml");
+    if (existsSync(candidate)) {
+      pubspec = candidate;
+      break;
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  if (pubspec === undefined) return;
+  const source = readFileSync(pubspec, "utf8");
+  if (/^  meta:\s*/m.test(source)) return;
+  if (!/^dependencies:\s*$/m.test(source)) {
+    fail("generated Dart vendored support needs a dependencies: block in " + pubspec);
+  }
+  writeFileSync(
+    pubspec,
+    source.replace(
+      /^dependencies:\s*$/m,
+      "dependencies:\n  meta: " + VENDORED_META_DEP,
+    ),
+    "utf8",
+  );
+}
 
 /** The generated-owned subdirectory, relative to `dartOut` (the pub package's `lib/`). WIPED and
  *  rewritten on every compile — nothing hand-written may live in it. The stable facade (the package
@@ -510,14 +628,6 @@ function collectPackageContracts(modules: readonly DomainModule[]): ContractHand
   return [...byId.values()].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
 }
 
-/** Every aggregate's generated typed-id class name across the package — the collision guard for the
- *  contract typed-id emission (a contract named after a local aggregate must not re-declare `<X>Id`). */
-function packageAggregateIdClassNames(modules: readonly DomainModule[]): Set<string> {
-  const out = new Set<string>();
-  for (const m of modules) for (const a of m.aggregates) out.add(typedIdClassForAggregateType(a.id));
-  return out;
-}
-
 /**
  * CROSS-DOMAIN REF TRAVERSAL map (dart_codegen_parity.md §2a follow-on): every aggregate id in the package
  * → its owning domain (`domain` for the generated client class name; `name` for the sibling
@@ -527,11 +637,19 @@ function packageAggregateIdClassNames(modules: readonly DomainModule[]): Set<str
  */
 function buildPackageAggregateDomains(
   modules: readonly DomainModule[],
-): Record<string, { domain: string; name: string }> {
-  const map: Record<string, { domain: string; name: string }> = {};
+): Record<string, { domain: string; name: string; namespaced: boolean }> {
+  const map: Record<
+    string,
+    { domain: string; name: string; namespaced: boolean }
+  > = {};
   for (const m of modules) {
-    const owner = { domain: m.domain ?? m.name, name: m.name };
-    for (const agg of (m.aggregates as { id: string }[])) map[agg.id] = owner;
+    for (const agg of m.aggregates) {
+      map[agg.id] = {
+        domain: m.domain ?? m.name,
+        name: m.name,
+        namespaced: isNamespacedAggregate(agg),
+      };
+    }
   }
   return map;
 }
@@ -565,7 +683,7 @@ function guardNoConcreteImportCycle(
         fail(
           `domain contracts: concrete cross-domain import cycle between '${from}' and '${to}' — their ` +
             `generated Dart files would import each other (a t.foreignRef in each targets a concrete aggregate ` +
-            `owned by the other). Break it with a domain CONTRACT: declare a contract(...) for the shared shape, ` +
+            `owned by the other). Break it with a record contract: declare recordContract(...) for the shared shape, ` +
             `.implements(...) it on the owning aggregate, and point the foreignRef at the CONTRACT (it resolves ` +
             `through the shared contracts.dart, keeping the domain graph acyclic).`,
         );
@@ -574,12 +692,77 @@ function guardNoConcreteImportCycle(
   }
 }
 
+/**
+ * Close the duplicate direct-birth presentation lane after the whole package has been composed.
+ *
+ * A `birth(A)` declaration is reusable law. When another domain publishes
+ * `intent(...).births(thatDeclaration)`, however, the wider intent is the ONE tenant action: exposing
+ * the declaration's direct `nomosBirthA` route as well would let callers skip the intent's other
+ * consequences. `business_birth.ts` can suppress that route by object identity when module evaluation
+ * happens in the convenient order, but package domains are deliberately lazy and their order must not
+ * change the public API. Resolve the ownership semantically across the completed package instead.
+ *
+ * This is presentation-only. The direct directive remains installed law for genesis/replay; generated
+ * clients, public OpenAPI and proofs see it as an implementation detail. Authority is unaffected.
+ */
+function closeComposedBusinessBirthPresentation(
+  modules: readonly DomainModule[],
+): DomainModule[] {
+  type BirthMetadata = {
+    aggregateId?: unknown;
+    rootId?: unknown;
+    namespace?: unknown;
+    keyField?: unknown;
+  };
+  type BirthDirective = DomainModule["directives"][number] & {
+    businessBirth?: BirthMetadata;
+    businessBirthInternal?: true;
+  };
+  const keyOf = (directive: BirthDirective): string | undefined => {
+    const birth = directive.businessBirth;
+    if (
+      birth === undefined ||
+      typeof birth.aggregateId !== "string" ||
+      typeof birth.rootId !== "string" ||
+      typeof birth.namespace !== "string" ||
+      typeof birth.keyField !== "string"
+    ) return undefined;
+    return [birth.aggregateId, birth.rootId, birth.namespace, birth.keyField].join("\u0000");
+  };
+
+  const composedBirths = new Set<string>();
+  for (const mod of modules) {
+    for (const directive of mod.directives as BirthDirective[]) {
+      if (!isBusinessIntent(directive)) continue;
+      const key = keyOf(directive);
+      if (key !== undefined) composedBirths.add(key);
+    }
+  }
+  if (composedBirths.size === 0) return [...modules];
+
+  const hideDirectBirth = (directive: BirthDirective): BirthDirective => {
+    if (isBusinessIntent(directive)) return directive;
+    const key = keyOf(directive);
+    return key !== undefined && composedBirths.has(key)
+      ? { ...directive, businessBirthInternal: true }
+      : directive;
+  };
+
+  return modules.map((mod) => ({
+    ...mod,
+    directives: (mod.directives as BirthDirective[]).map(hideDirectBirth),
+    ...(mod.applicationIntents === undefined
+      ? {}
+      : { applicationIntents: (mod.applicationIntents as BirthDirective[]).map(hideDirectBirth) }),
+  }));
+}
+
 /** FRAMEWORK-SHARED symbol dedup, shared by the flat emit and the layered-packages emit (Dart-codegen
  *  hygiene): framework-owned symbols fold into MANY domains, so their generated Dart would be DEFINED
  *  once per domain — a package barrel re-exporting ≥2 domains then COLLIDES. THREE kinds are deduped,
  *  each identified by the framework BRAND (object identity, so a tenant symbol that merely shares a
  *  name is never misclassified) and emitted EXACTLY ONCE into `nomos_framework.dart`:
- *    • AGGREGATES — read-model class, typed-id class, by-id accessors;
+ *    • AGGREGATES — projection/read-model class and by-id accessors;
  *    • DIRECTIVES — the generated payload class (the domain still OFFERS them per-domain);
  *    • QUERIES — the top-level `watch<Q>`/`read<Q>` accessors.
  *  Plus VALUE OBJECTS used by ≥2 domains (same collision rule). Per-domain files SKIP each and
@@ -593,6 +776,40 @@ interface DartSharedSymbols {
   /** The synthetic module whose emit IS `nomos_framework.dart` — undefined when nothing is shared. */
   readonly frameworkMod: DomainModule | undefined;
 }
+
+/** Every named value object whose Dart type this domain needs, including payload-only VOs pulled
+ * across a domain boundary by a composed business birth. `mod.valueObjects` only sees aggregate
+ * fields; without the payload half a parent `births(childBirth)` re-emits the child's VO locally and
+ * the flat package barrel becomes ambiguous. Count once per domain, not once per use. */
+function dartValueObjectsForModule(
+  mod: DomainModule,
+): NonNullable<DomainModule["valueObjects"]> {
+  const codegenDirectives = (mod.applicationIntents ?? mod.directives)
+    .filter((d) => (d as { businessBirthInternal?: unknown }).businessBirthInternal !== true)
+    .map((d) => {
+      const birth = (d as {
+        businessBirth?: { publicPayloadSchema?: unknown };
+      }).businessBirth;
+      return birth?.publicPayloadSchema === undefined
+        ? d
+        : { ...d, payloadSchema: birth.publicPayloadSchema };
+    });
+  const byName = new Map<string, NonNullable<DomainModule["valueObjects"]>[number]>();
+  for (const descriptor of [
+    ...(mod.valueObjects ?? []),
+    ...collectPayloadValueObjectDescriptors(codegenDirectives),
+  ]) {
+    const prior = byName.get(descriptor.name);
+    if (prior !== undefined && JSON.stringify(prior) !== JSON.stringify(descriptor)) {
+      throw new Error(
+        `value object '${descriptor.name}' has DIVERGENT aggregate/payload shapes in domain '${mod.domain ?? mod.name}'`,
+      );
+    }
+    byName.set(descriptor.name, descriptor);
+  }
+  return [...byName.values()].sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+}
+
 function collectDartSharedSymbols(
   modules: readonly DomainModule[],
   packageContracts: readonly ContractHandle[] = [],
@@ -616,13 +833,13 @@ function collectDartSharedSymbols(
   const voDomainsByName = new Map<string, number>();
   const voDescriptorByName = new Map<string, NonNullable<DomainModule["valueObjects"]>[number]>();
   for (const mod of modules) {
-    for (const d of mod.valueObjects ?? []) {
+    for (const d of dartValueObjectsForModule(mod)) {
       voDomainsByName.set(d.name, (voDomainsByName.get(d.name) ?? 0) + 1);
       voDescriptorByName.set(d.name, d);
     }
   }
   // CONTRACT-USED VOs ARE LAYER-ZERO (co2 #117): a VO referenced by a contract FIELD (e.g. a
-  // `ReferenceCode.field()` inside `contract(...)`) is rendered inside `contracts.dart` — the shared layer
+  // `ReferenceCode.field()` inside `recordContract(...)`) is rendered inside `contracts.dart` — the shared layer
   // every domain imports and which may import NO domain file (the acyclic rule). So its class must live in
   // `nomos_framework.dart` REGARDLESS of how many domains use it (a single-domain VO would otherwise land in
   // that domain's file, unreachable from contracts.dart). Transitive deps included (a nested VO renders too).
@@ -694,7 +911,7 @@ function domainDedupOpts(mod: DomainModule, shared: DartSharedSymbols): {
     (modForDart.queries ?? []).filter((q) => shared.frameworkQueryIds.has(q.id)).map((q) => q.id),
   );
   const skipValueObjectNames = new Set(
-    (modForDart.valueObjects ?? []).filter((d) => shared.sharedVoNames.has(d.name)).map((d) => d.name),
+    dartValueObjectsForModule(modForDart).filter((d) => shared.sharedVoNames.has(d.name)).map((d) => d.name),
   );
   const foldsFramework =
     skipAggregateIds.size > 0 || skipDirectiveIds.size > 0 || skipQueryIds.size > 0 || skipValueObjectNames.size > 0;
@@ -799,6 +1016,7 @@ function emitDart(
   // 1. optional vendored framework support (barrel + src/), copied byte-for-byte except
   //    the barrel's schema_validation export (see DART_SUPPORT_SRC).
   if (supportImport === "vendored") {
+    ensureVendoredMetaDependency(dartOut);
     mkdirSync(path.join(genDir, "src"), { recursive: true });
     // Core files come from the pure `nomos_types` package, runtime files from `nomos_client`
     // (the layered split). Runtime files import the core via `package:nomos_types/...` — the
@@ -807,10 +1025,15 @@ function emitDart(
     const clientDir = path.join(DSL_DIR, "dart", "lib", "src");
     for (const f of DART_SUPPORT_CORE_SRC) copyFileSync(path.join(coreDir, f), path.join(genDir, "src", f));
     for (const f of DART_SUPPORT_RUNTIME_SRC) {
-      const src = readFileSync(path.join(clientDir, f), "utf8").replace(
-        /import 'package:nomos_types\/nomos_types\.dart'/g,
-        `import '${VENDORED_TYPES_SHIM}'`,
-      );
+      const src = readFileSync(path.join(clientDir, f), "utf8")
+        .replace(
+          /import 'package:nomos_types\/nomos_types\.dart'/g,
+          `import '${VENDORED_TYPES_SHIM}'`,
+        )
+        .replace(
+          /import 'package:nomos_types\/src\/(?:nomos_ref|foreign_ref)\.dart'/g,
+          `import '${VENDORED_TYPES_SHIM}'`,
+        );
       writeFileSync(path.join(genDir, "src", f), src, "utf8");
     }
     // The local shim the rewritten runtime imports resolve through (the vendored twin of the
@@ -848,7 +1071,7 @@ function emitDart(
   //    readSignerDelegationByUser, …` band-aid). THREE kinds are deduped, each identified by the
   //    framework BRAND (object identity, so a tenant symbol that merely shares a name is never
   //    misclassified) and emitted EXACTLY ONCE into `nomos_framework.dart`:
-  //      • AGGREGATES — read-model class, typed-id class, by-id accessors (`RelationTuple` auto-added
+  //      • AGGREGATES — projection/read-model class and by-id accessors (`RelationTuple` auto-added
   //        to every relation-using domain, `SignerDelegation`/`KeyScope`/… re-exported verbatim);
   //      • DIRECTIVES — the generated payload class (relate/signer/enroll family). The domain still
   //        OFFERS them (client offer methods stay per-domain); only the payload TYPE moves to the shared file;
@@ -891,7 +1114,6 @@ function emitDart(
   if (packageContracts.length > 0) {
     writeGenerated(CONTRACTS_FILE, generateDartContracts(packageContracts, {
       ...(frameworkImportUri !== undefined ? { frameworkImportUri } : {}),
-      aggregateIdClassNames: packageAggregateIdClassNames(modules),
     }));
   }
   // 2a-ter. the shared ACCOUNTABLE ACTIVITY + DESCRIPTION REGISTRY (`activity_registry.dart`) — emitted
@@ -951,7 +1173,7 @@ function emitDart(
       }
     }
     // AUTO cross-domain `idOf(Agg)` imports (dart_codegen_parity.md P2): a payload field typed with a
-    // SIBLING domain's typed id class (`ListingId`) needs that domain's generated file, exactly as a
+    // SIBLING aggregate's generated type needs that domain's generated file, exactly as a
     // foreignRef target does. Same-domain idOf targets declare their id class locally — skip them.
     for (const target of collectPayloadIdOfTargets(modForDart.directives)) {
       const targetFile = aggIdToDartFile.get(target);
@@ -967,6 +1189,7 @@ function emitDart(
     const modForDartWithImports = mergedDartImports.length > 0 ? { ...modForDart, dartImports: mergedDartImports } : modForDart;
     const src = generateDartDomain(modForDartWithImports, {
       ...skips,
+      packageAggregateDomains,
       ...(domainFrameworkImport !== undefined ? { frameworkImportUri: domainFrameworkImport } : {}),
     });
     writeGenerated(mod.name, src);
@@ -980,11 +1203,25 @@ function emitDart(
       emitActivity: true,
       activityImportUri,
       describeModel,
+    });
+    const applicationSrc = generateDartApplication(modForDart, {
+      supportImport,
       packageAggregateDomains,
     });
-    const cp = path.join(genDir, `${mod.name}.client.dart`);
-    writeFileSync(cp, clientSrc, "utf8");
+    const clientFile = `${mod.name}.client.dart`;
+    const applicationFile = `${mod.name}.application.dart`;
+    const encapsulated = encapsulateDartClient(
+      clientSrc,
+      applicationSrc,
+      clientFile,
+      applicationFile,
+    );
+    const cp = path.join(genDir, clientFile);
+    writeFileSync(cp, encapsulated.clientPart, "utf8");
     written.push(cp);
+    const ap = path.join(genDir, `${mod.name}.application.dart`);
+    writeFileSync(ap, encapsulated.applicationLibrary, "utf8");
+    written.push(ap);
   }
 
   // 3. THE PACKAGE BARREL — the stable public facade (`dartOut/<barrelName>.dart`), generated-owned
@@ -1024,15 +1261,24 @@ function emitDart(
           .map((f) => `${genRel}/${f}.dart`);
       })(),
     ),
+    // The generated clients import their runtime support directly. Keeping it out of the public barrel is
+    // the surface firewall: a tenant import receives business types and application APIs, never raw runtime.
     supportImport === "vendored"
-      ? `export '${genRel}/nomos_client.dart';`
-      : `export 'package:nomos_client/nomos_client.dart';`,
-    ...(hasFrameworkSymbols ? [`export '${genRel}/${FRAMEWORK_FILE}.dart';`] : []),
-    ...(contractsImportUri !== undefined ? [`export '${genRel}/${CONTRACTS_FILE}.dart';`] : []),
-    ...(activityImportUri !== undefined ? [`export '${genRel}/${ACTIVITY_FILE}.dart';`] : []),
+      ? `export '${genRel}/src/${VENDORED_TYPES_SHIM}' show NomosRef;`
+      : `export 'package:nomos_types/nomos_types.dart' show NomosRef;`,
+    ...(contractsImportUri !== undefined
+      ? tenantDartExport(`${genRel}/${CONTRACTS_FILE}.dart`, sourceByFile.get(CONTRACTS_FILE) ?? "")
+      : []),
+    ...(activityImportUri !== undefined
+      ? tenantDartExport(
+          `${genRel}/${ACTIVITY_FILE}.dart`,
+          sourceByFile.get(ACTIVITY_FILE) ?? "",
+          ["renderActivity", "activityNarrative"],
+        )
+      : []),
     ...modules.flatMap((m) => [
-      `export '${genRel}/${m.name}.dart';`,
-      `export '${genRel}/${m.name}.client.dart';`,
+      ...tenantDartExport(`${genRel}/${m.name}.dart`, sourceByFile.get(m.name) ?? ""),
+      `export '${genRel}/${m.name}.application.dart' show ${dartApplicationPublicClassNames(m).join(", ")};`,
     ]),
     ...dartAliasLines(
       names,
@@ -1052,17 +1298,23 @@ function emitDart(
 // ── the LAYERED-PACKAGES Dart emit (dart.packages: blast-radius isolation) ────────
 
 /** The pure-core support import generated TYPES files carry in layered-packages mode. */
-const DART_TYPES_IMPORT = `import 'package:nomos_types/nomos_types.dart';`;
+const DART_TYPES_IMPORT = [
+  `import 'package:nomos_types/nomos_types.dart';`,
+  `import 'package:nomos_types/src/nomos_ref.dart' show NmsInternalNomosRefs;`,
+  `import 'package:nomos_types/src/foreign_ref.dart' show NmsInternalForeignRefs;`,
+  `import 'package:nomos_types/src/invitation.dart' show NmsInternalInvitations, NmsInternalRecipients;`,
+].join("\n");
 /** Version constraints the scaffolded pubspecs pin — move together with the Dart packages' releases.
  *  Caret on 0.x is EXACT-MINOR (`^0.45.0` = `<0.46.0`), so these must track the CURRENT release, not
  *  just the floor generated code needs — a lagging pin forces tenants into dependency_overrides. */
 // 0.3.0: SurfacedValue<T>/SurfacedObservation/PendingConflictRow — generated Surfaced-field typing +
 //        the pendingConflicts read rows.
-const NOMOS_TYPES_DEP = "^0.7.0";
+const NOMOS_TYPES_DEP = "^0.8.0";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.63.1";
+const NOMOS_CLIENT_DEP = "^0.64.0";
+const NOMOS_FLUTTER_DEP = "^0.63.0";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).
@@ -1078,13 +1330,327 @@ const aliasImportLines = (names: Readonly<Record<string, string>> | undefined, u
  *  The alias validator and the cursed-name report both read this surface. */
 function declaredDartTypeNames(src: string): Set<string> {
   const names = new Set<string>();
-  const re = /^(?:abstract\s+|final\s+|sealed\s+)*(?:class|enum|mixin|extension type)\s+([A-Za-z][A-Za-z0-9_]*)/gm;
+  const re = /^(?:abstract\s+|base\s+|final\s+|sealed\s+|interface\s+|mixin\s+)*(?:class|enum|mixin|extension type)\s+(?:const\s+)?([A-Za-z][A-Za-z0-9_]*)/gm;
   for (let m = re.exec(src); m !== null; m = re.exec(src)) {
     if (!m[1]!.startsWith("_")) names.add(m[1]!);
   }
   return names;
 }
 
+/** Public declarations safe for the generated application barrel. Runtime/framework names stay in the
+ * implementation packages even when a generated source file imports or declares them. */
+function tenantDartTypeNames(src: string): string[] {
+  return [...declaredDartTypeNames(src)]
+    // Framework-owned source files are excluded at the file boundary. Do not blanket-hide the `Nomos…`
+    // product vocabulary generated into business files: describe/activity types such as NomosModel and
+    // NomosDescription are required by the generated application. Only the parallel workspace-less ID
+    // wrappers are forbidden here.
+    .sort();
+}
+
+/** Named Dart extensions are part of the tenant API too. A `show` barrel that exports the
+ * read-model class but omits its generated conflict extension makes documented getters disappear
+ * at the canonical package import, forcing tenants to deep-import generated files. */
+function tenantDartExtensionNames(src: string): string[] {
+  const names = new Set<string>();
+  const re = /^extension\s+([A-Za-z][A-Za-z0-9_]*)\s+(?:<[^\n>]+>\s+)?on\s+/gm;
+  for (let match = re.exec(src); match !== null; match = re.exec(src)) {
+    if (!match[1]!.startsWith("_")) names.add(match[1]!);
+  }
+  return [...names].sort();
+}
+
+function tenantDartExportNames(src: string): string[] {
+  return [...new Set([...tenantDartTypeNames(src), ...tenantDartExtensionNames(src)])].sort();
+}
+
+/**
+ * Turn the generated bridge client into a Dart `part` of the business application library.
+ *
+ * `lib/src` is only a convention: a tenant can deep-import a normal Dart library. A part file is a
+ * language boundary — it cannot be imported on its own — and its underscore-prefixed declarations are
+ * private to the generated application library. This makes the raw bind/open client mechanically
+ * unavailable while leaving the business application as the sole exported entry point.
+ */
+function encapsulateDartClient(
+  clientSrc: string,
+  applicationSrc: string,
+  clientFile: string,
+  applicationFile: string,
+): { readonly clientPart: string; readonly applicationLibrary: string } {
+  const directive = /^(import|export)\s+'([^']+)'(?:\s+[^;]+)?;\s*$/;
+  const clientImportUri = clientFile.replace(/\.dart$/, "");
+  const split = (src: string) => {
+    const directives: string[] = [];
+    const body: string[] = [];
+    const ignores: string[] = [];
+    for (const line of src.split("\n")) {
+      if (line.startsWith("// ignore_for_file:")) {
+        ignores.push(line);
+      } else if (directive.test(line)) {
+        directives.push(line);
+      } else {
+        body.push(line);
+      }
+    }
+    return { directives, body, ignores };
+  };
+  const client = split(clientSrc);
+  const application = split(applicationSrc);
+
+  // Every implementation-side declared type and named extension becomes genuinely library-private.
+  const implementationNames = new Set(declaredDartTypeNames(clientSrc));
+  for (const match of clientSrc.matchAll(/^extension\s+([A-Za-z][A-Za-z0-9_]*)\s+/gm)) {
+    if (match[1] !== undefined && !match[1].startsWith("_")) implementationNames.add(match[1]);
+  }
+  for (const match of clientSrc.matchAll(/^const\s+(?:[A-Za-z][A-Za-z0-9_<>, ?]*\s+)?([a-z][A-Za-z0-9_]*)\s*=/gm)) {
+    if (match[1] !== undefined && !match[1].startsWith("_")) implementationNames.add(match[1]);
+  }
+  const privateNames = new Map(
+    [...implementationNames].map((name) => [name, `_Nms${name}`] as const),
+  );
+  const applicationNames = new Set(declaredDartTypeNames(applicationSrc));
+  const privatize = (src: string, preserve: ReadonlySet<string> = new Set()): string => {
+    let out = src;
+    for (const [name, privateName] of privateNames) {
+      if (preserve.has(name)) continue;
+      const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      out = out.replace(new RegExp(`\\b${escaped}\\b`, "g"), privateName);
+    }
+    return out;
+  };
+
+  // Merge imports/exports into the application library. Prefer an unrestricted import over a `show`
+  // import of the same URI because the client implementation necessarily uses the fuller surface.
+  const imports = new Map<string, string>();
+  const exports = new Map<string, string>();
+  for (const line of [...client.directives, ...application.directives]) {
+    const match = directive.exec(line);
+    if (match === null) continue;
+    const [, kind, uri] = match;
+    if (kind === "import" && (uri === clientFile || uri === clientImportUri)) continue;
+    // Preserve business-type re-exports so one application import carries its
+    // payloads and read models. Framework/runtime exports belonged to the retired
+    // bridge library and must not enter tenant autocomplete.
+    if (
+      kind === "export" &&
+      client.directives.includes(line) &&
+      /(?:^|\/)(?:nomos_framework|nomos_client)\.dart$/.test(uri!)
+    ) continue;
+    const target = kind === "import" ? imports : exports;
+    const prior = target.get(uri!);
+    if (prior === undefined || (/\sshow\s/.test(prior) && !/\sshow\s/.test(line))) {
+      target.set(uri!, line);
+    }
+  }
+
+  return {
+    clientPart: [
+      "// AUTO-GENERATED by nomos-compile — private implementation part; importing this file is invalid.",
+      ...client.ignores,
+      "// ignore_for_file: unused_element, unused_element_parameter",
+      `part of '${applicationFile}';`,
+      "",
+      privatize(client.body.join("\n")).trimStart(),
+      "",
+    ].join("\n"),
+    applicationLibrary: [
+      "// AUTO-GENERATED by nomos-compile — the sole importable application library.",
+      "// ignore_for_file: unused_import, unused_field, invalid_use_of_internal_member",
+      ...imports.values(),
+      ...exports.values(),
+      `part '${clientFile}';`,
+      "",
+      privatize(application.body.join("\n"), applicationNames).trimStart(),
+      "",
+    ].join("\n"),
+  };
+}
+
+const dartApplicationMember = (name: string): string => {
+  const words = name.split(/[^A-Za-z0-9]+/).filter(Boolean);
+  const joined = words.length === 0
+    ? "domain"
+    : words[0]!.toLowerCase() + words.slice(1).map((word) => word[0]!.toUpperCase() + word.slice(1)).join("");
+  return /^(?:assert|break|case|catch|class|const|continue|default|do|else|enum|extends|false|final|for|if|in|is|new|null|rethrow|return|super|switch|this|throw|true|try|var|void|while|with|dynamic)$/.test(joined)
+    ? `${joined}_`
+    : joined;
+};
+
+function generatedPackageApplication(
+  packageName: string,
+  domains: readonly {
+    readonly domain: string;
+    readonly file: string;
+    readonly invitationPolicies: readonly {
+      readonly domainHash: string;
+      readonly query: string;
+      readonly redeem: string;
+      readonly personField: string;
+      readonly roleField: string;
+      readonly scopeField: string;
+    }[];
+  }[],
+  homeDomain: string,
+  rootDomains: readonly string[],
+): string {
+  const application = dartApplicationClassName(packageName);
+  const root = domains.find(({ domain }) => domain === homeDomain);
+  if (root === undefined) {
+    throw new Error(`generated Dart package application cannot find its home domain '${homeDomain}'`);
+  }
+  const members = domains
+    .filter(({ domain }) => rootDomains.includes(domain))
+    .map(({ domain, file, invitationPolicies }, index) => ({
+    domain,
+    file,
+    prefix: `_nmsDomain${index}`,
+    member: dartApplicationMember(domain),
+    application: dartApplicationClassName(domain),
+    invitationPolicies,
+  }));
+  if (members.length !== rootDomains.length) {
+    throw new Error("generated Dart package application could not bind every co-resident root domain");
+  }
+  const invitationPolicies = members.flatMap(({ domain, invitationPolicies }) =>
+    invitationPolicies.map((policy) => ({ domain, ...policy })));
+  const hasInvitations = invitationPolicies.length > 0;
+  const duplicate = members.find((candidate, index) =>
+    members.findIndex((other) => other.member === candidate.member) !== index);
+  if (duplicate !== undefined) {
+    throw new Error(
+      `generated Dart package application member '${duplicate.member}' is ambiguous; rename one colliding domain`,
+    );
+  }
+  const frameworkMembers = new Map<string, string>([
+    ["nomosWidget", "the generated Nomos Flutter bootstrap"],
+    ["currentUser", "the generated signed-in application participant"],
+    ["currentStatus", "the generated application status"],
+    ["watchStatus", "the generated application status watch"],
+    ["recipient", "the generated typed recipient boundary"],
+    ["createInvitation", "the generated invitation capability"],
+    ["redeemInvitation", "the generated invitation redemption"],
+  ]);
+  const frameworkCollision = members.find(({ member }) => frameworkMembers.has(member));
+  if (frameworkCollision !== undefined) {
+    throw new Error(
+      `Sorry mate — domain '${frameworkCollision.domain}' claims generated Dart application member ` +
+        `'${frameworkCollision.member}', which is already owned by ${frameworkMembers.get(frameworkCollision.member)}. ` +
+        `Nomos will not silently rename or reroute it; rename the tenant domain and compile again.`,
+    );
+  }
+  return [
+    `// AUTO-GENERATED by nomos-compile — the one tenant application for "${packageName}".`,
+    `// Domain clients remain generated implementation details behind this stateful business surface.`,
+    `// ignore_for_file: invalid_use_of_internal_member`,
+    `import 'package:flutter/widgets.dart';`,
+    `import 'package:nomos_flutter/src/application_status.dart' show ApplicationSignIn, ApplicationStatus;`,
+    `import 'package:nomos_client/src/nms_generated_runtime.dart' show NmsInternalUsers, NomosSession, User${hasInvitations ? ", Invitation, Recipient" : ""};`,
+    `import 'package:nomos_flutter/src/generated_application_host.dart' show NmsInternalApplicationHost, NmsInternalApplicationUserBinding${hasInvitations ? ", NmsInternalInvitationPolicy" : ""};`,
+    ...members.map(({ file, prefix }) =>
+      `import '${file}.application.dart' as ${prefix};`),
+    ``,
+    `/// The one canonical stateful application for ${packageName}.`,
+    `///`,
+    `/// Keep business UI and services on this object. Nomos owns identity, persistence,`,
+    `/// synchronization, workspace navigation, access delivery and recovery underneath it;`,
+    `/// do not build a second runtime host, repository, session, or application-state mirror.`,
+    `///`,
+    `/// Canonical bootstrap:`,
+    "/// ```dart",
+    `/// return ${application}.nomosWidget(`,
+    `///   cloud: cloud,`,
+    `///   application: '${packageName}',`,
+    `///   signIn: signIn,`,
+    `///   builder: (context, application) => MyBusinessUi(application: application),`,
+    `/// );`,
+    "/// ```",
+    `/// Pass that same [${application}] down. It is the application state.`,
+    `final class ${application} {`,
+    `  final NomosSession _nmsSession;`,
+    ...(hasInvitations ? [`  final NmsInternalApplicationUserBinding _nmsUser;`] : []),
+    `  final User currentUser;`,
+    ...members.flatMap(({ domain, member, application: child, prefix }) => [
+      `  /// Business actions, records and watches declared by ${domain}.`,
+      `  final ${prefix}.${child} ${member};`,
+    ]),
+    `  const ${application}._({required NomosSession nmsSession, ${hasInvitations ? "required NmsInternalApplicationUserBinding nmsUser, " : ""}required this.currentUser, ${members.map(({ member }) => `required this.${member}`).join(", ")}}) : _nmsSession = nmsSession${hasInvitations ? ", _nmsUser = nmsUser" : ""};`,
+    ``,
+    `  /// Current durability and convergence across this business application.`,
+    `  ApplicationStatus get currentStatus => NmsInternalApplicationHost.currentStatus(_nmsSession);`,
+    ``,
+    `  /// React whenever this application saves, receives work, goes offline or needs attention.`,
+    `  Stream<ApplicationStatus> watchStatus() => NmsInternalApplicationHost.watchStatus(_nmsSession);`,
+    ...(hasInvitations
+      ? [
+          ``,
+          `  /// Turn an identity-provider uid into a typed invitation recipient.`,
+          `  Recipient<User> recipient(String uid) => NmsInternalApplicationHost.recipient<User>(uid);`,
+          ``,
+          `  /// Create an invitation; transport its link however your product chooses.`,
+          `  Future<Invitation<User>> createInvitation() => NmsInternalApplicationHost.createInvitation<User>(_nmsSession);`,
+          ``,
+          `  /// Redeem a transported invitation as [currentUser].`,
+          `  Future<void> redeemInvitation(String link) => NmsInternalApplicationHost.redeemInvitation<User>(`,
+          `        _nmsSession,`,
+          `        link: link,`,
+          `        identity: _nmsUser.nmsInternalActor,`,
+          `        policies: [`,
+          ...invitationPolicies.flatMap((policy) => [
+            `          NmsInternalInvitationPolicy(`,
+            `            domain: ${JSON.stringify(policy.domain)},`,
+            `            domainHash: ${JSON.stringify(policy.domainHash)},`,
+            `            query: ${JSON.stringify(policy.query)},`,
+            `            redeem: ${JSON.stringify(policy.redeem)},`,
+            `            personField: ${JSON.stringify(policy.personField)},`,
+            `            roleField: ${JSON.stringify(policy.roleField)},`,
+            `            scopeField: ${JSON.stringify(policy.scopeField)},`,
+            `          ),`,
+          ]),
+          `        ],`,
+          `      );`,
+        ]
+      : []),
+    ``,
+    `  /// Mount the one application at the UI boundary and pass [application] down.`,
+    `  ///`,
+    `  /// This is the only application bootstrap tenant code should own.`,
+    `  ///`,
+    `  /// The object supplied to [builder] is the application state. Keep it as the only`,
+    `  /// business-state dependency; do not recreate its records in providers, repositories or caches.`,
+    `  static Widget nomosWidget({`,
+    `    Key? key,`,
+    `    required String cloud,`,
+    `    required String application,`,
+    `    required ApplicationSignIn signIn,`,
+    `    required Widget Function(BuildContext context, ${application} application) builder,`,
+    `    Widget Function(BuildContext context)? loadingBuilder,`,
+    `    Widget Function(BuildContext context, Object error, VoidCallback retry)? errorBuilder,`,
+    `  }) => NmsInternalApplicationHost.home<${application}>(`,
+    `    key: key, cloud: cloud, application: application, signIn: signIn,`,
+    `    bind: nomosInternalBind${application}, builder: builder,`,
+    `    loadingBuilder: loadingBuilder, errorBuilder: errorBuilder,`,
+    `  );`,
+    `}`,
+    ``,
+    `Future<${application}> nomosInternalBind${application}(`,
+    `  NomosSession session, NmsInternalApplicationUserBinding user,`,
+    `) async => ${application}._(`,
+    `  nmsSession: session,`,
+    ...(hasInvitations ? [`  nmsUser: user,`] : []),
+    `  currentUser: NmsInternalUsers.create(identityId: user.nmsInternalIdentityId, identityAddress: user.nmsInternalIdentityAddress),`,
+    ...members.map(({ member, application: child, prefix }) =>
+      `  ${member}: await ${prefix}.nomosInternalBind${child}(session, user),`),
+    `);`,
+    ``,
+  ].join("\n");
+}
+
+function tenantDartExport(uri: string, src: string, publicFunctions: readonly string[] = []): string[] {
+  const names = [...tenantDartExportNames(src), ...publicFunctions].sort();
+  return names.length === 0 ? [] : [`export '${uri}' show ${names.join(", ")};`];
+}
+
 /** `typedef <alias> = <generated>;` lines for the barrel, validated FAIL-CLOSED against the emitted
  *  types surface: every target must exist, no alias may collide with a generated name or another alias. */
 function dartAliasLines(names: Readonly<Record<string, string>> | undefined, declared: ReadonlySet<string>): string[] {
@@ -1153,6 +1719,7 @@ function emitDartPackages(
   names: Readonly<Record<string, string>> | undefined,
   compat?: NomosCompat,
   describePackageName = packages.client,
+  deployJsonPath?: string,
 ): { written: string[]; cursed: string[] } {
   for (const [role, name] of Object.entries(packages)) {
     if (typeof name !== "string" || !isPubPackageName(name)) {
@@ -1206,6 +1773,9 @@ function emitDartPackages(
         // banning the Dart SDK. Allow every dart:* import; keep the cross-package allowlist otherwise.
         !m[1]!.startsWith("dart:") &&
         m[1] !== "package:nomos_types/nomos_types.dart" &&
+        m[1] !== "package:nomos_types/src/nomos_ref.dart" &&
+        m[1] !== "package:nomos_types/src/foreign_ref.dart" &&
+        m[1] !== "package:nomos_types/src/invitation.dart" &&
         m[1] !== `${FRAMEWORK_FILE}.dart` &&
         !siblingTypeFiles.has(m[1]!)
       ) {
@@ -1228,7 +1798,6 @@ function emitDartPackages(
   if (packageContracts.length > 0) {
     writeTypes(CONTRACTS_FILE, generateDartContracts(packageContracts, {
       ...(shared.frameworkMod !== undefined ? { frameworkImportUri: `${FRAMEWORK_FILE}.dart` } : {}),
-      aggregateIdClassNames: packageAggregateIdClassNames(modules),
     }));
   }
   // ACTIVITY + DESCRIPTION REGISTRY (layered): universal, including packages with empty history.
@@ -1258,7 +1827,7 @@ function emitDartPackages(
       }
     }
     // AUTO cross-domain `idOf(Agg)` imports (dart_codegen_parity.md P2): a payload field typed with a
-    // SIBLING domain's typed id class needs that domain's TYPES file (a permitted sibling import).
+    // SIBLING aggregate's generated type needs that domain's TYPES file (a permitted sibling import).
     for (const target of collectPayloadIdOfTargets(dd.modForDart.directives)) {
       const tf = aggIdToTypeFile.get(target);
       if (tf !== undefined && tf !== dd.modForDart.name) frImports.add(`${tf}.dart`);
@@ -1272,6 +1841,7 @@ function emitDartPackages(
       mod.name,
       generateDartDomain(modForTypes, {
         ...dd.skips,
+        packageAggregateDomains: buildPackageAggregateDomains(modules),
         ...(dd.foldsFramework ? { frameworkImportUri: `${FRAMEWORK_FILE}.dart` } : {}),
       }),
     );
@@ -1288,6 +1858,14 @@ function emitDartPackages(
   // but a file no alias references needs no import (the `export` re-exports it). Importing every file
   // produced unused_import warnings in the tenant's barrel (co2 feedback).
   const aliasTargets = new Set(Object.keys(names ?? {}));
+  const frameworkAliasTargets = [...aliasTargets].filter((name) =>
+    (declaredByFile.get(FRAMEWORK_FILE) ?? new Set<string>()).has(name));
+  if (frameworkAliasTargets.length > 0) {
+    fail(
+      `dart.names cannot publish Nomos implementation types (${frameworkAliasTargets.sort().join(", ")}) — ` +
+        `name business concepts declared by the tenant domains instead`,
+    );
+  }
   const aliasImportUris = [...typesSources.keys()]
     .filter((f) => [...(declaredByFile.get(f) ?? [])].some((n) => aliasTargets.has(n)))
     .map((f) => `${genRel}/${f}.dart`);
@@ -1308,6 +1886,37 @@ function emitDartPackages(
   const typesExportKeys = explicitBarrel
     ? [...typesSources.keys()].filter((f) => !domainFileBases.has(f))
     : [...typesSources.keys()];
+  // Framework-shared types exist only so generated implementation parts can
+  // compile. They are not tenant vocabulary and must never enter either
+  // public package barrel (SignerDelegation/EnrollDelegationPayload and the
+  // like otherwise become tempting autocomplete footguns).
+  const tenantTypesExportKeys = typesExportKeys.filter((f) => f !== FRAMEWORK_FILE);
+  const frameworkSource = typesSources.get(FRAMEWORK_FILE) ?? "";
+  // Shared business value objects may be emitted into the private framework
+  // implementation file because several domains reuse them. Promote those
+  // shared values and their transitive variant members, but mechanically
+  // exclude every framework aggregate/directive family and Nomos-prefixed type.
+  const sharedBusinessTypeNames = tenantDartTypeNames(frameworkSource).filter(
+    (name) =>
+      !name.startsWith("Nomos") &&
+      ![...FRAMEWORK_AGGREGATE_IDS].some((id) => name.startsWith(id)) &&
+      ![...FRAMEWORK_DIRECTIVE_IDS].some((id) => name === `${id[0]!.toUpperCase()}${id.slice(1)}Payload`),
+  );
+  const businessSharedFile = "business_shared.dart";
+  const businessSharedPath = path.join(typesGen, businessSharedFile);
+  writeFileSync(
+    businessSharedPath,
+    [
+      "// GENERATED by nomos-compile — shared business values and activity; no runtime machinery.",
+      `export 'package:nomos_types/nomos_types.dart' show NomosRef, Identity, User, Recipient, Invitation, ActivityEvent, ActivityRef, ActivitySeverity, SurfacedObservation, SurfacedValue, SurfacedResolved, SurfacedPending, SurfacedEvolutionRequired;`,
+      ...(sharedBusinessTypeNames.length === 0
+        ? []
+        : [`export '${FRAMEWORK_FILE}.dart' show ${sharedBusinessTypeNames.join(", ")};`]),
+      "",
+    ].join("\n"),
+    "utf8",
+  );
+  written.push(businessSharedPath);
   const explicitBarrelNote = explicitBarrel
     ? [
         `// barrelExports: 'explicit' — per-domain aggregate/read-model classes are NOT flat-exported here.`,
@@ -1319,7 +1928,7 @@ function emitDartPackages(
   // under `barrelExports: 'explicit'` per-domain files are withheld, so they cannot collide there.
   try {
     assertNoDartBarrelCollisions(
-      typesExportKeys.map((f): BarrelExportedFile => ({ label: f, src: typesSources.get(f) ?? "" })),
+      tenantTypesExportKeys.map((f): BarrelExportedFile => ({ label: f, src: typesSources.get(f) ?? "" })),
     );
   } catch (e) {
     fail((e as Error).message);
@@ -1332,8 +1941,13 @@ function emitDartPackages(
     "",
     ...explicitBarrelNote,
     ...aliasImportLines(barrelNames, barrelAliasImportUris),
-    `export 'package:nomos_types/nomos_types.dart';`,
-    ...typesExportKeys.map((f) => `export '${genRel}/${f}.dart';`),
+    `export '${genRel}/${businessSharedFile}';`,
+    ...tenantTypesExportKeys.flatMap((f) =>
+      tenantDartExport(
+        `${genRel}/${f}.dart`,
+        typesSources.get(f) ?? "",
+        f === ACTIVITY_FILE ? ["renderActivity", "activityNarrative"] : [],
+      )),
     ...dartAliasLines(barrelNames, declared),
     "",
   ];
@@ -1358,8 +1972,17 @@ function emitDartPackages(
   // ── the CLIENT package — effectful runtime, depends on types + nomos_client ──
   const clientGen = freshGenDir(packages.client);
   const typesImportUri = `package:${packages.types}/${packages.types}.dart`;
+  const implementationTypeImports = explicitBarrel
+    ? modules.map((m) => `package:${packages.types}/${genRel}/${m.name}.dart`)
+    : [];
+  const frameworkImplementationImport = typesSources.has(FRAMEWORK_FILE)
+    ? `package:${packages.types}/${genRel}/${FRAMEWORK_FILE}.dart`
+    : undefined;
+  const frameworkTypeNames = frameworkImplementationImport === undefined
+    ? []
+    : [...declaredDartTypeNames(typesSources.get(FRAMEWORK_FILE) ?? "")];
   for (const { mod, dd } of perDomain) {
-    const clientSrc = generateDartBridgeClient(dd.modForDart, {
+    const makeClient = (imports: readonly string[]) => generateDartBridgeClient(dd.modForDart, {
       domainHash,
       interface: packageInterface[dd.modForDart.domain ?? dd.modForDart.name],
       ...(compat !== undefined ? { compat } : {}),
@@ -1367,27 +1990,121 @@ function emitDartPackages(
       typesImportUri,
       emitActivity: true,
       describeModel,
-      packageAggregateDomains: buildPackageAggregateDomains(modules),
+      // Cross-domain record traversal lives on the application facade. Keeping
+      // the package map out of the private client prevents sibling client imports.
       // Under 'explicit' the types barrel withholds per-domain classes — import every domain's TYPES
       // file directly so the client's read-model/payload/ref/typed-id references resolve. (The no-dup-
       // symbol guarantee across domain files means an over-broad set never introduces ambiguity.)
-      ...(explicitBarrel
-        ? { explicitTypeImports: modules.map((m) => `package:${packages.types}/${genRel}/${m.name}.dart`) }
+      ...(imports.length > 0
+        ? { explicitTypeImports: imports }
         : {}),
     });
-    const cp = path.join(clientGen, `${mod.name}.client.dart`);
-    writeFileSync(cp, clientSrc, "utf8");
+    const makeApplication = (imports: readonly string[]) => generateDartApplication(dd.modForDart, {
+      supportImport: "package",
+      typesImportUri,
+      packageAggregateDomains: buildPackageAggregateDomains(modules),
+      flutterHost: true,
+      tenantRoot: perDomain.length === 1,
+      ...(imports.length > 0
+        ? { explicitTypeImports: imports }
+        : {}),
+    });
+    let clientSrc = makeClient(implementationTypeImports);
+    let applicationSrc = makeApplication(implementationTypeImports);
+    // Import the private framework types file only into implementation libraries
+    // that actually name one of its declarations. Ignore the embedded describe
+    // JSON while scanning so framework words in documentation do not manufacture
+    // an otherwise-unused import.
+    const implementationSource = `${clientSrc}\n${applicationSrc}`.replace(/r'''[\s\S]*?'''/g, "");
+    const needsFrameworkTypes = frameworkImplementationImport !== undefined &&
+      frameworkTypeNames.some((name) => new RegExp(`\\b${name}\\b`).test(implementationSource));
+    if (needsFrameworkTypes) {
+      const imports = [...implementationTypeImports, frameworkImplementationImport];
+      clientSrc = makeClient(imports);
+      applicationSrc = makeApplication(imports);
+    }
+    const clientFile = `${mod.name}.client.dart`;
+    const applicationFile = `${mod.name}.application.dart`;
+    const encapsulated = encapsulateDartClient(
+      clientSrc,
+      applicationSrc,
+      clientFile,
+      applicationFile,
+    );
+    const cp = path.join(clientGen, clientFile);
+    writeFileSync(cp, encapsulated.clientPart, "utf8");
     written.push(cp);
+    const ap = path.join(clientGen, applicationFile);
+    writeFileSync(ap, encapsulated.applicationLibrary, "utf8");
+    written.push(ap);
+  }
+  const packageApplicationFile = `${describePackageName}.package.application`;
+  if (perDomain.length > 1) {
+    const topology = resolveApplicationTopology(modules);
+    const packageApplicationPath = path.join(clientGen, `${packageApplicationFile}.dart`);
+    writeFileSync(
+      packageApplicationPath,
+      generatedPackageApplication(
+        describePackageName,
+        perDomain.map(({ mod, dd }) => ({
+          domain: dd.modForDart.domain ?? dd.modForDart.name,
+          file: mod.name,
+          invitationPolicies: (dd.modForDart.applicationWorkspaceSharing ?? []).map((policy) => ({
+            domainHash,
+            query: policy.invitationLaw.pendingByRecipient.id,
+            redeem: policy.invitationLaw.redeem.id,
+            personField: policy.person,
+            roleField: policy.role,
+            scopeField: policy.scope,
+          })),
+        })),
+        topology.homeDomain,
+        topology.rootDomains,
+      ),
+      "utf8",
+    );
+    written.push(packageApplicationPath);
   }
   const clientBarrel = [
     "// GENERATED by nomos-compile — the CLIENT package's public entrypoint. DO NOT EDIT.",
-    "// Effectful runtime clients (offer methods over NomosBridge). Composition/runtime layer",
-    "// only — UI code should depend on the sibling types package, not on this.",
+    `/// The generated business application for ${describePackageName}.`,
+    `///`,
+    `/// Import this library, mount [${dartApplicationClassName(describePackageName)}.nomosWidget] once, and pass the`,
+    `/// supplied [${dartApplicationClassName(describePackageName)}] through the UI. Its typed actions, records,`,
+    `/// watches, references and status are the canonical application state. Do not recreate them`,
+    `/// in tenant repositories, providers, sessions, clients or caches.`,
+    `///`,
+    `/// Nomos privately owns persistence, offline work, synchronization, identity, access,`,
+    `/// provenance, conflicts, schema evolution and recovery. Framework implementation details`,
+    `/// are deliberately not exported here.`,
     "library;",
     "",
-    `export 'package:nomos_client/nomos_client.dart';`,
-    `export '${typesImportUri}';`,
-    ...perDomain.map(({ mod }) => `export '${genRel}/${mod.name}.client.dart';`),
+    `export 'package:${packages.types}/${genRel}/${businessSharedFile}';`,
+    ...tenantTypesExportKeys
+      .map((file) => {
+        const names = tenantDartExportNames(typesSources.get(file) ?? "");
+        return names.length === 0
+          ? null
+          : `export 'package:${packages.types}/${genRel}/${file}.dart' show ${names.join(", ")};`;
+      })
+      .filter((line): line is string => line !== null),
+    ...(barrelNames !== undefined && Object.keys(barrelNames).length > 0
+      ? [`export 'package:${packages.types}/${packages.types}.dart' show ${Object.values(barrelNames).sort().join(", ")};`]
+      : []),
+    ...(perDomain.length > 1
+      ? [
+          `export 'package:nomos_flutter/src/application_status.dart' show ApplicationSignIn, ApplicationStatus, ApplicationStatusPhase;`,
+          `export '${genRel}/${packageApplicationFile}.dart' show ${dartApplicationClassName(describePackageName)};`,
+          ...perDomain.map(({ mod, dd }) => {
+            const packageClass = dartApplicationClassName(describePackageName);
+            const publicNames = dartApplicationPublicClassNames(dd.modForDart).filter(
+              (name) => name !== packageClass,
+            );
+            return `export '${genRel}/${mod.name}.application.dart' show ${publicNames.join(", ")};`;
+          }),
+        ]
+      : perDomain.map(({ mod, dd }) =>
+          `export '${genRel}/${mod.name}.application.dart' show ${dartApplicationPublicClassNames(dd.modForDart, { tenantRoot: true }).join(", ")};`)),
     "",
   ];
   const clientBarrelPath = path.join(pkgDir(packages.client), "lib", `${packages.client}.dart`);
@@ -1397,31 +2114,82 @@ function emitDartPackages(
     pkgDir(packages.client),
     [
       `name: ${packages.client}`,
-      `description: Generated Nomos domain CLIENTS — the effectful runtime layer over NomosBridge.`,
+      `description: Generated Nomos business application APIs.`,
       `version: 0.1.0`,
       `publish_to: none # tenant-owned: remove to publish`,
       `environment:`,
       `  sdk: ^3.5.0`,
+      `  flutter: ">=3.10.0"`,
       `dependencies:`,
+      `  flutter:`,
+      `    sdk: flutter`,
       `  nomos_client: ${NOMOS_CLIENT_DEP}`,
+      `  nomos_flutter: ${NOMOS_FLUTTER_DEP}`,
       `  ${packages.types}:`,
       `    path: ../${packages.types} # co-emitted sibling; replace with a hosted constraint when publishing`,
       ``,
     ].join("\n"),
   );
 
-  // ── the TEST package (optional) — the headless-harness surface, test-only dependency ──
+  // ── the TEST package (optional) — generated business scenarios, test-only dependency ──
   if (packages.test !== undefined) {
     const testGen = freshGenDir(packages.test);
-    void testGen; // generated fixtures land here as they grow; the barrel is the surface today
+    if (deployJsonPath === undefined) fail("dart.packages.test requires the compiled application package");
+    const embeddedDeployName = `${describePackageName}.deploy.json`;
+    const embeddedDeployPath = path.join(testGen, embeddedDeployName);
+    copyFileSync(deployJsonPath, embeddedDeployPath);
+    written.push(embeddedDeployPath);
+    const scenarioSurfaces = perDomain.length > 1
+      ? (() => {
+          const topology = resolveApplicationTopology(modules);
+          const home = perDomain.find(({ dd }) =>
+            (dd.modForDart.domain ?? dd.modForDart.name) === topology.homeDomain,
+          );
+          if (home === undefined) {
+            fail(`generated Dart scenario cannot find its home domain '${topology.homeDomain}'`);
+          }
+          return [{
+          mod: home.mod,
+          dd: home.dd,
+          file: describePackageName,
+          surfaceName: describePackageName,
+          applicationFile: packageApplicationFile,
+        }];
+        })()
+      : perDomain.map(({ mod, dd }) => ({
+          mod,
+          dd,
+          file: mod.name,
+          surfaceName: dd.modForDart.domain ?? dd.modForDart.name,
+          applicationFile: `${mod.name}.application`,
+        }));
+    for (const { mod, dd, file, surfaceName, applicationFile } of scenarioSurfaces) {
+      const scenarioPath = path.join(testGen, `${file}.scenario.dart`);
+      writeFileSync(
+        scenarioPath,
+        generateDartScenario(
+          dd.modForDart,
+          packages.client,
+          packages.test,
+          embeddedDeployName,
+          {
+            surfaceName,
+            applicationFile,
+            applicationModules: perDomain.map(({ dd: candidate }) => candidate.modForDart),
+          },
+        ),
+        "utf8",
+      );
+      written.push(scenarioPath);
+    }
     const testBarrel = [
       "// GENERATED by nomos-compile — the TEST package's public entrypoint. DO NOT EDIT.",
-      "// The headless-harness surface (NomosTestHarness + the node-runner transport) plus the",
-      "// full client layer, for widget/integration tests. Depend on this ONLY from dev_dependencies.",
+      "// Business scenarios drive the exact generated production application; framework machinery stays private.",
       "library;",
       "",
-      `export 'package:nomos_client/testing.dart';`,
       `export 'package:${packages.client}/${packages.client}.dart';`,
+      ...scenarioSurfaces.map(({ file, surfaceName }) =>
+        `export '${genRel}/${file}.scenario.dart' show ${dartScenarioClassName(surfaceName)}, ${dartTestPersonClassName(surfaceName)}, ${dartScenarioGivenClassName(surfaceName)};`),
       "",
     ];
     const testBarrelPath = path.join(pkgDir(packages.test), "lib", `${packages.test}.dart`);
@@ -1431,15 +2199,22 @@ function emitDartPackages(
       pkgDir(packages.test),
       [
         `name: ${packages.test}`,
-        `description: Generated Nomos test surface — headless harness + clients. dev_dependencies only.`,
+        `description: Generated business application scenarios. dev_dependencies only.`,
         `version: 0.1.0`,
         `publish_to: none # tenant-owned: remove to publish`,
         `environment:`,
         `  sdk: ^3.5.0`,
         `dependencies:`,
+        `  flutter:`,
+        `    sdk: flutter`,
         `  nomos_client: ${NOMOS_CLIENT_DEP}`,
         `  ${packages.client}:`,
         `    path: ../${packages.client} # co-emitted sibling; replace with a hosted constraint when publishing`,
+        `dev_dependencies:`,
+        `  test: ^1.25.0`,
+        `flutter:`,
+        `  assets:`,
+        `    - lib/${genRel}/${embeddedDeployName}`,
         ``,
       ].join("\n"),
     );
@@ -1519,7 +2294,15 @@ function emitDartPackages(
 
 async function main(): Promise<void> {
   const argv = process.argv.slice(2);
-  const layeredFlag = argv.includes("--layered");
+  const supportedFlags = new Set(["--require-usdcat", "--compact", "--analyze"]);
+  for (const flag of argv.filter((arg) => arg.startsWith("--"))) {
+    if (supportedFlags.has(flag)) continue;
+    if (flag === "--layered") {
+      fail("--layered no longer exists: every package is a USD layer stack and every compile proves its flattened law");
+    }
+    fail(`unknown compile flag '${flag}'`);
+  }
+  const requireUsdcat = argv.includes("--require-usdcat") || process.env.NOMOS_REQUIRE_USDCAT === "1";
   const compactFlag = argv.includes("--compact") || process.env["NOMOS_COMPACT"] === "1";
   // §"Shipped (1–4)" follow-up: `githolon compile --analyze` (or NOMOS_ANALYZE=1) runs
   // `dart analyze` on the generated Dart package after emission and fails the compile on red.
@@ -1549,11 +2332,29 @@ async function main(): Promise<void> {
     }
   } catch { /* no dsl resolvable from the law dir (vendored/workspace setups) — nothing to compare */ }
 
-  const cfgModule = (await import(pathToFileURL(configPath).href)) as { default?: PackageConfig };
-  const cfg = cfgModule.default;
+  const cfgModule = (await import(pathToFileURL(configPath).href)) as { default?: unknown };
+  const configValue = cfgModule.default;
+  if (isApplicationCompositionConfig(configValue)) {
+    try {
+      const emitted = compileApplicationComposition(configValue, configPath, { requireUsdcat });
+      console.log([
+        `${configValue.application} — compiled Nomos application composition`,
+        `stage: ${emitted.outputPath}`,
+        `assets: ${emitted.referencedAssets.length} local content-addressed reference(s)`,
+        `runtime configuration: USD (the authoring .mjs does not travel)`,
+      ].join("\n"));
+      return;
+    } catch (error) {
+      fail(`application composition refused: ${(error as Error).message}`);
+    }
+  }
+  const cfg = configValue as PackageConfig | undefined;
   if (!cfg || typeof cfg.name !== "string" || !Array.isArray(cfg.domains) || cfg.domains.length === 0) {
     fail(`config must default-export { name, domains: [{ key, modules }, ...] }`);
   }
+  if (Object.prototype.hasOwnProperty.call(cfg, "layered")) {
+    fail("nomos.package.mjs no longer accepts 'layered': every package is layered, with no alternate compile lane");
+  }
   // ANY readable name works ("tool-library", "tool_library", "Tool Library"):
   // artifact FILENAMES keep it verbatim; generated SYMBOLS normalize it
   // (toolLibraryClient, TOOL_LIBRARY_DOMAIN_HASH — see codegen_ts.ts).
@@ -1561,22 +2362,31 @@ async function main(): Promise<void> {
     fail(`package name '${cfg.name}' is not a safe basename (letters, digits, spaces, '.', '-', '_')`);
   }
 
-  // ONE BUSINESS BIRTH IS A COMPLETE PRODUCT ENTRYPOINT. The compiler privately appends the
-  // application/home law which turns a signed-in identity into its home workspace; that home can then
-  // call the generated business birth. Tenant config never names this domain. The deliberately obscure
-  // key reduces collision likelihood, but collision handling is still fail-closed: never reinterpret a
-  // tenant's same-named concept as framework machinery.
+  // EVERY GENERATED APPLICATION IS A COMPLETE PRODUCT ENTRYPOINT. The compiler privately appends the
+  // authority bootstrap law that turns verified credential evidence into durable device authorship. Tenant
+  // config never names this domain and presentation filters it back out: a package cannot emit the generated
+  // application facade while omitting the private machinery needed to open it. The deliberately obscure key
+  // reduces collision likelihood, but collision handling is still fail-closed: never reinterpret a tenant's
+  // same-named concept as framework machinery.
   if (cfg.domains.some((d) => d.key === APPLICATION_HOME_DOMAIN)) {
     fail(
-      `domain key '${APPLICATION_HOME_DOMAIN}' is reserved by Nomos for the private application/home law; ` +
+      `domain key '${APPLICATION_HOME_DOMAIN}' is reserved by Nomos for private application authority law; ` +
         `rename the tenant domain (Nomos will not silently overwrite or reroute it)`,
     );
   }
-  const domainsToCompile: DomainConfig[] = [...cfg.domains];
-  let applicationHomeInjected = false;
+  const domainsToCompile: DomainConfig[] = [
+    ...cfg.domains,
+    {
+      key: APPLICATION_HOME_DOMAIN,
+      modules: [path.join(DSL_DIR, "src", "framework", "application_home.ts")],
+    },
+  ];
 
   const outDir = path.resolve(cfgDir, cfg.outDir ?? "build");
   mkdirSync(outDir, { recursive: true });
+  // The package-wide executable lane no longer exists. Remove its ignored build artifact on every
+  // native compile so a developer cannot accidentally inspect or execute stale bytes as canonical law.
+  rmSync(path.join(outDir, ".nomos_lump.js"), { force: true });
 
   // ── import + compose each domain ──
   // LAZY PER-DOMAIN BOOT (#34): the generated entry registers each domain's modules
@@ -1585,12 +2395,10 @@ async function main(): Promise<void> {
   // per-plan sandbox boots ONLY the domain the dispatched intent touches. The
   // routing table for type/relation-keyed dispatches is computed below by the
   // SAME scans the engine registries run (`collectEngineRouting` — one machinery).
-  // `NOMOS_LUMP_BOOT=eager` keeps the pre-#34 whole-law top-level boot (static
-  // imports, no routing) — the equivalence baseline the #34 suite compares against.
-  const eagerLump = process.env.NOMOS_LUMP_BOOT === "eager";
-  const entryImports: string[] = [];
-  const entryDomains: string[] = [];
-  const entryMintInstalls: string[] = []; // route-tagged in-plan mints (taxonomy packages only)
+  // Every executable is an independently addressable lazy plan asset. There is no package-wide
+  // eager/monolithic execution mode: keeping that alternative would let it become canonical again.
+  const entryDomainSourceByKey = new Map<string, string>();
+  const entryMintInstallByKey = new Map<string, string>();
   const routingInput: Record<string, Mod[]> = {};
   const domainModules: DomainModule[] = [];
   // THE SELF-DESCRIBE DECLS (G1): per domain key, the FINISHED plain read/maintenance decls the
@@ -1599,9 +2407,7 @@ async function main(): Promise<void> {
   // pass finished decls through), serialized into the generated entry as `openapiDecls`, so the
   // kernel-run describe reproduces THIS compile's `<name>.openapi.json` byte-for-byte.
   const openapiDeclsByDomain: Record<string, unknown> = {};
-  const layered = layeredFlag || cfg.layered === true;
   const layeredDomains: { key: string; inputs: LayeredModuleInput[] }[] = [];
-  let importSeq = 0;
   /**
    * THE CAPABILITY LOWERING (capability_marketplace.md §4 — the deploy-warning
    * prerequisite + the executor's task→capability→domain map). Rides the
@@ -1633,29 +2439,10 @@ async function main(): Promise<void> {
       if (!existsSync(abs)) fail(`domain '${d.key}': module not found: ${abs}`);
       const m = (await import(pathToFileURL(abs).href)) as Mod;
       mods.push(m);
-      if (eagerLump) {
-        const v = `m${importSeq++}`;
-        sourceExprs.push(v);
-        entryImports.push(`import * as ${v} from ${JSON.stringify(abs)};`);
-      } else {
-        sourceExprs.push(`() => require(${JSON.stringify(abs)})`);
-      }
+      sourceExprs.push(`() => require(${JSON.stringify(abs)})`);
     }
     let merged: Mod = {};
     for (const m of mods) merged = { ...merged, ...m };
-    const declaresBusinessBirth = Object.values(merged).some(
-      (value) =>
-        value !== null &&
-        typeof value === "object" &&
-        (value as { __isBusinessBirth?: unknown }).__isBusinessBirth === true,
-    );
-    if (declaresBusinessBirth && !applicationHomeInjected) {
-      applicationHomeInjected = true;
-      domainsToCompile.push({
-        key: APPLICATION_HOME_DOMAIN,
-        modules: [path.join(DSL_DIR, "src", "framework", "application_home.ts")],
-      });
-    }
     merged = expandBusinessBirthExports(merged, d.key);
     merged = withOwnedCustodyExports(merged);
     // `capability()` bundles expand into discoverable entries (the CLI plane's
@@ -1755,29 +2542,18 @@ async function main(): Promise<void> {
         shardingMins = shardingExtrema("min");
         shardingMaxes = shardingExtrema("max");
         const specJson = JSON.stringify(spec);
-        if (eagerLump) {
-          if (!entryImports.some((l) => l.includes("workspace-sharding"))) {
-            entryImports.push(
-              `import { shardingLawModule as __nomosShardingLaw, installRouteTaggedMint as __nomosInstallMint } from "@githolon/dsl/workspace-sharding";`,
-            );
-          }
-          sourceExprs.push(`__nomosShardingLaw(${specJson})`);
-        } else {
-          shardingLazyExpr = `() => (require("@githolon/dsl/workspace-sharding") as any).shardingLawModule(${specJson})`;
-          sourceExprs.push(shardingLazyExpr);
-        }
+        shardingLazyExpr = `() => (require("@githolon/dsl/workspace-sharding") as any).shardingLawModule(${specJson})`;
+        sourceExprs.push(shardingLazyExpr);
         // ROUTE-TAGGED IN-PLAN MINTS (§4, slice 3): installed AFTER registerEngine at
         // the lump's top level — pre-freeze, taxonomy packages only (a taxonomy-free
         // lump never imports the module: the slice-1 hash-stability law).
-        entryMintInstalls.push(
-          eagerLump
-            ? `__nomosInstallMint(${specJson});`
-            : `(require("@githolon/dsl/workspace-sharding") as any).installRouteTaggedMint(${specJson});`,
-        );
+        const mintInstall = `(require("@githolon/dsl/workspace-sharding") as any).installRouteTaggedMint(${specJson});`;
+        entryMintInstallByKey.set(d.key, mintInstall);
       }
     }
 
-    entryDomains.push(`    ${JSON.stringify(d.key)}: [${sourceExprs.join(", ")}],`);
+    const domainSource = `    ${JSON.stringify(d.key)}: [${sourceExprs.join(", ")}],`;
+    entryDomainSourceByKey.set(d.key, domainSource);
     routingInput[d.key] = mods;
     // ── THE AUX INVARIANT-ROUTING KEY (#47, sharding slice 7 — the invariant-gate
     //    flame pass): in a LAZY lump, the derived sharding law registers a SECOND
@@ -1791,14 +2567,15 @@ async function main(): Promise<void> {
     //    canonical manifests are untouched (identity hashes do not move); eager
     //    lumps are untouched (no routing table — the pre-#34 equivalence shape);
     //    taxonomy-free packages emit NOTHING here (the slice-1 byte-stability law).
-    if (shardingModForDomain !== undefined && shardingLazyExpr !== undefined && !eagerLump) {
+    if (shardingModForDomain !== undefined && shardingLazyExpr !== undefined) {
       const auxKey = `${d.key}/nomos-sharding`;
       if (domainsToCompile.some((x) => x.key === auxKey) || routingInput[auxKey] !== undefined) {
         fail(
           `domain key '${auxKey}' is reserved for the derived sharding law's invariant routing — rename the domain`,
         );
       }
-      entryDomains.push(`    ${JSON.stringify(auxKey)}: [${shardingLazyExpr}],`);
+      const auxSource = `    ${JSON.stringify(auxKey)}: [${shardingLazyExpr}],`;
+      entryDomainSourceByKey.set(auxKey, auxSource);
       routingInput[d.key] = mods.filter((m) => m !== shardingModForDomain);
       routingInput[auxKey] = [shardingModForDomain];
     }
@@ -1833,7 +2610,7 @@ async function main(): Promise<void> {
       const usesRelations =
         dirsAll.some((dir) => (dir as { requiresRelationGate?: unknown }).requiresRelationGate !== undefined) ||
         dirsAll.some((dir) => (dir as { aggregateId?: string }).aggregateId === RelationTuple.id) ||
-        discover<RelationTypeDecl>(merged, isRelationTypeDecl).length > 0;
+        discoverRelationTypeDeclarations(merged).length > 0;
       if (usesRelations && !queries.some((q) => q.id === relationTuplesByObject.id)) {
         queries.push(relationTuplesByObject);
       }
@@ -1870,11 +2647,11 @@ async function main(): Promise<void> {
       ...directivesOf(merged).flatMap((dir) => synthesizeBirthQuotaInvariants(dir)),
     ];
     // Native Zanzibar relation schema (P1) — auto-discovered by brand, like workspaceInvariants.
-    const relationTypes = [
-      ...discover<RelationTypeDecl>(merged, isRelationTypeDecl),
+    const relationTypeFragments = [
+      ...discoverRelationTypeDeclarations(merged),
       ...resolveNamed<RelationTypeDecl>(merged, d.relationTypes, "relationTypes"),
     ];
-    for (const rt of relationTypes) validateRelationType(rt); // DX fast-fail (Rust resolve is authoritative)
+    const relationTypes = mergeRelationTypeDeclarations(relationTypeFragments);
     // Sums are AUTO-DISCOVERED like queries/counts (#57 — an exported SumDecl used to be
     // SILENTLY DROPPED unless config-named; the config lane stays as the escape hatch).
     // Reference-dedupe: a sum that is BOTH exported and config-named is the same object.
@@ -1942,7 +2719,9 @@ async function main(): Promise<void> {
         ...(maxes.length > 0 ? { maxes } : {}),
         ...(workspaceTypes.length > 0 ? { workspaceTypes } : {}),
         ...(workspaceInvariants.length > 0 ? { workspaceInvariants } : {}),
-        ...(relationTypes.length > 0 ? { relationTypes } : {}),
+        // Relation declarations are already present in `modules` (including config-named exports), and
+        // composeDomainModule performs the authoritative discovery + fragment union after expanding role
+        // sugar. Re-threading the compiler's independently expanded copy here would invent a second author.
         ...(spatials.length > 0 ? { spatials } : {}),
         ...(d.dartImports !== undefined && d.dartImports.length > 0
           ? { dartImports: d.dartImports }
@@ -2033,17 +2812,20 @@ async function main(): Promise<void> {
       }
     }
 
-    // ── opt-in: ONE USD LAYER PER MODULE (Φ applied per module, not once over the
+    // ── ONE USD LAYER PER MODULE (Φ applied per module, not once over the
     //    composed fold) — the layered emission `usd_layers.ts` proves flattens back
     //    to the EXACT canonical IR (asserted below, fail-closed). Per-module decls
     //    are discovered the same way as above, on each module's OWN exports; config
     //    export-names resolve on whichever module actually exports them; config
-    //    `extraAggregates` ride the FIRST (weakest) layer, prelude-style. Counts /
-    //    sums / spatials never enter the USD IR, so they have no layer placement.
-    if (layered) {
+    //    `extraAggregates` ride the FIRST (weakest) layer, prelude-style. Compiler-
+    //    discovered reads are seated beside the aggregate schema they read.
+    {
       const usedStems = new Set<string>();
-      const inputs: LayeredModuleInput[] = mods.map((m, i) => {
-        let stem = path.basename(d.modules[i]!).replace(/\.[^.]*$/, "");
+      let inputs: LayeredModuleInput[] = mods.map((m, i) => {
+        const authoredPath = d.modules[i];
+        let stem = authoredPath === undefined
+          ? `nomos-derived-${i + 1}`
+          : path.basename(authoredPath).replace(/\.[^.]*$/, "");
         for (let n = 2; usedStems.has(stem); n++) stem = `${stem}-${n}`;
         usedStems.add(stem);
 
@@ -2061,20 +2843,90 @@ async function main(): Promise<void> {
           ...discover<CombinedDecl>(m, isCombinedDecl),
           ...resolveNamed<CombinedDecl>(m, presentNames(d.combineds), "combineds"),
         ];
-        const byId = new Map<string, AggregateHandle>();
-        for (const a of [...aggregatesOf(m), ...(i === 0 ? extraAggregates : [])]) byId.set(a.id, a);
-
-        const module: DomainModule = {
+        // Lower the module through the SAME compiler-owned expansion seam as the
+        // canonical fold. A hand-built `{aggregates,directives}` approximation silently
+        // dropped relation, invariant, attestation, flow and projection opinions, so the
+        // pretty USD stack was not the law. Single-module composition retains those
+        // generated opinions in the layer where their authored cause lives.
+        const module = composeDomainModule({
           name: d.name ?? d.key,
           domain: d.key,
-          aggregates: [...byId.values()],
-          directives: directivesOf(m),
+          modules: [m],
+          ...(i === 0 && extraAggregates.length > 0 ? { extraAggregates } : {}),
+          // Compiler-synthesized/domain-wide declarations have no honest authored
+          // module owner. Seat them once in the weakest prelude layer so USD and
+          // Nomos both see one contribution instead of duplicating them per source file.
+          ...(i === 0 && (composed.workspaceInvariants?.length ?? 0) > 0
+            ? { workspaceInvariants: composed.workspaceInvariants }
+            : {}),
+          ...(i === 0 && workspaceTypes.length > 0 ? { workspaceTypes } : {}),
+          ...(i === 0 && impureCapabilities.length > 0 ? { impureCapabilities } : {}),
           ...(layerQueries.length > 0 ? { queries: layerQueries } : {}),
           ...(layerDeriveds.length > 0 ? { deriveds: layerDeriveds } : {}),
           ...(layerCombineds.length > 0 ? { combineds: layerCombineds } : {}),
-        };
+        });
         return { name: stem, module };
       });
+      if (inputs[0] !== undefined) {
+        // Work on shallow module copies: package-owned declarations usually belong
+        // in the weakest prelude, but a read recipe belongs beside the aggregate
+        // schema it reads. Putting a compiler-added query in an unrelated prelude
+        // makes that individual USD layer ill-typed even though the whole stack has
+        // the target in a stronger layer.
+        inputs = inputs.map((input) => ({
+          ...input,
+          module: { ...input.module } as DomainModule,
+        }));
+        // Config-named and compiler-derived reads are package opinions rather than
+        // exports of one source file. Seat only declarations missing from every
+        // authored layer, once. Reads sit beside their returned aggregate; all other
+        // domain-wide declarations sit in the weakest prelude.
+        for (const field of [
+          "queries",
+          "counts",
+          "spatials",
+          "sums",
+          "mins",
+          "maxes",
+          "deriveds",
+          "combineds",
+          "workspaceTypes",
+          "workspaceInvariants",
+          "orderedReads",
+          "exists_",
+        ] as const) {
+          const canonical = (composed as unknown as Record<string, unknown>)[field];
+          if (!Array.isArray(canonical)) continue;
+          const present = new Set(inputs.flatMap((input) => {
+            const values = (input.module as unknown as Record<string, unknown>)[field];
+            return Array.isArray(values)
+              ? values.flatMap((value) => value !== null && typeof value === "object" && typeof (value as { id?: unknown }).id === "string"
+                  ? [(value as { id: string }).id]
+                  : [])
+              : [];
+          }));
+          const missing = canonical.filter((value) =>
+            value !== null && typeof value === "object" && typeof (value as { id?: unknown }).id === "string"
+              ? !present.has((value as { id: string }).id)
+              : true);
+          for (const value of missing) {
+            const declarationTarget = value !== null && typeof value === "object"
+              ? field === "queries"
+                ? (value as { returns?: unknown }).returns
+                : (["counts", "spatials", "sums", "mins", "maxes", "deriveds", "combineds"] as const).includes(field as never)
+                  ? (value as { of?: unknown }).of
+                  : undefined
+              : undefined;
+            const ownerIndex = typeof declarationTarget === "string"
+              ? inputs.findIndex((input) => input.module.aggregates.some((aggregate) => aggregate.id === declarationTarget))
+              : -1;
+            const targetIndex = ownerIndex >= 0 ? ownerIndex : 0;
+            const target = inputs[targetIndex]!.module as DomainModule & Record<string, unknown>;
+            const existing = target[field];
+            target[field] = [...(Array.isArray(existing) ? existing : []), value];
+          }
+        }
+      }
       layeredDomains.push({ key: d.key, inputs });
     }
   }
@@ -2082,7 +2934,7 @@ async function main(): Promise<void> {
   // Presentation is a separate concern from executable law. The private application/home domain remains
   // in `domainModules` for hashing, routing, self-description, replay and static checking, but generated
   // tenant clients/proofs/interfaces contain business vocabulary only.
-  const presentationDomainModules = domainModules.filter(
+  const presentationDomainModules = closeComposedBusinessBirthPresentation(domainModules).filter(
     (mod) => (mod.domain ?? mod.name) !== APPLICATION_HOME_DOMAIN,
   );
 
@@ -2248,16 +3100,10 @@ async function main(): Promise<void> {
     if (!rel || !exportName) fail(`report '${reportId}' must be "modulePath#exportName"; got '${ref}'`);
     const abs = path.resolve(cfgDir, rel);
     if (!existsSync(abs)) fail(`report '${reportId}': module not found: ${abs}`);
-    if (eagerLump) {
-      const v = `r${importSeq++}`;
-      entryImports.push(`import * as ${v} from ${JSON.stringify(abs)};`);
-      entryReports.push(`    ${JSON.stringify(reportId)}: ${v}.${exportName},`);
-    } else {
-      // A lazy report factory: the module's `__esm` init runs on first render call.
-      entryReports.push(
-        `    ${JSON.stringify(reportId)}: (actor: string) => (require(${JSON.stringify(abs)}) as any).${exportName}(actor),`,
-      );
-    }
+    // A lazy report factory: the module's init runs only when this report asset is selected.
+    entryReports.push(
+      `    ${JSON.stringify(reportId)}: (actor: string) => (require(${JSON.stringify(abs)}) as any).${exportName}(actor),`,
+    );
   }
 
   // ── 1. generate + bundle the engine entry ──
@@ -2281,7 +3127,7 @@ async function main(): Promise<void> {
   // entry's top level — pre-freeze, exactly where the eager lump ran them.
   const zodSeedImports: string[] = [];
   const zodSeedNames: string[] = [];
-  if (!eagerLump) {
+  {
     const zodPkgJson = [cfgDir, DSL_DIR]
       .map((dir) => {
         try {
@@ -2308,43 +3154,6 @@ async function main(): Promise<void> {
       zodSeedNames.push(v);
     }
   }
-  const entrySource = [
-    `// AUTO-GENERATED by nomos-compile from ${path.basename(configPath)} — do not edit.`,
-    ...(eagerLump
-      ? []
-      : [
-          `// LAZY PER-DOMAIN BOOT (#34): each domain registers as require-thunks; esbuild`,
-          `// defers every module's init to its first dispatch touch inside the fresh sandbox.`,
-          `declare function require(id: string): Record<string, unknown>;`,
-          ...zodSeedImports,
-        ]),
-    ...entryImports,
-    `import { registerEngine } from "@githolon/dsl/engine-entry";`,
-    ``,
-    `registerEngine({`,
-    `  domains: {`,
-    ...entryDomains,
-    `  },`,
-    ...(entryReports.length > 0 ? [`  reports: {`, ...entryReports, `  },`] : []),
-    ...(eagerLump ? [] : [`  routing: ${JSON.stringify(routing)},`]),
-    ...(zodSeedNames.length > 0 ? [`  seeds: [${zodSeedNames.join(", ")}],`] : []),
-    // THE SELF-DESCRIBE INPUTS (G1): the finished read/maintenance decls + the package title, baked
-    // into the lump so `globalThis.describe` reproduces this compile's `<name>.openapi.json` over the
-    // FOLDED LAW — the kernel serves the spec, the host stages nothing. Omit-when-empty (decl-free
-    // packages: offers still derive from directives; the title default is the workspace-level title).
-    ...(Object.keys(openapiDeclsByDomain).length > 0
-      ? [`  openapiDecls: ${JSON.stringify(openapiDeclsByDomain)},`]
-      : []),
-    `  packageTitle: ${JSON.stringify(`${cfg.name} (nomos package)`)},`,
-    `});`,
-    // ROUTE-TAGGED IN-PLAN MINTS (sharding §4, slice 3): wraps globalThis.plan +
-    // globalThis.nomos.mint at top-level eval — pre-freeze, after registerEngine's
-    // own assignments. Empty (and therefore byte-absent) for taxonomy-free packages.
-    ...entryMintInstalls,
-    ``,
-  ].join("\n");
-  const entryPath = path.join(outDir, ".nomos_entry.ts");
-  writeFileSync(entryPath, entrySource, "utf8");
 
   // Resolve esbuild through Node's resolver (caller's copy first, else the DSL's
   // own dependency) — NOT node_modules/.bin paths, which hoisted/workspace
@@ -2367,64 +3176,95 @@ async function main(): Promise<void> {
   const esbuildBin = path.join(path.dirname(esbuildPkgJson), esbuildBinRel ?? "bin/esbuild");
   const esbuildMod = (await import(pathToFileURL(path.join(path.dirname(esbuildPkgJson), "lib", "main.js")).href)) as typeof import("esbuild");
 
-  const canonicalizeEngineJavascript = (source: string): string => {
-    // esbuild includes module labels derived from the package's install topology in
-    // non-minified bundles. The same law therefore used to hash differently when the
-    // DSL was reached through this monorepo (../../dsl/src/...) and through a packed
-    // dependency (node_modules/@githolon/dsl/src/...). Canonicalise only esbuild's
-    // generated comment/function labels: tenant strings and executable imports are
-    // deliberately outside these narrow replacements.
-    const body = source
-      .replace(/^\s*"use strict";\s*$/gm, "")
-      .replace(/^(\s*\/\/ )(?:(?:\.\.\/)+dsl\/src\/|node_modules\/@githolon\/dsl\/src\/)/gm, "$1@githolon/dsl/src/")
-      .replace(/"(?:(?:\.\.\/)+dsl\/src\/|node_modules\/@githolon\/dsl\/src\/)([^"]+)"\(\) \{/g, '"@githolon/dsl/src/$1"() {')
-      .replace(/^(\s*\/\/ )(?:(?:\.\.\/)+node_modules\/zod\/|node_modules\/zod\/)/gm, "$1zod/")
-      .replace(/"(?:(?:\.\.\/)+node_modules\/zod\/|node_modules\/zod\/)([^"]+)"\(\) \{/g, '"zod/$1"() {')
-      .replace(/\n[ \t]*\n/g, "\n")
-      .trimEnd();
-    return `"use strict";\n${body}\n`;
-  };
-
   const compact = compactFlag || cfg.compact === true;
-  let javascript: string;
-  if (compact) {
-    // COMPACT LUMP (see PackageConfig.compact): the programmatic esbuild API (same pinned
-    // package as the binary) so a resolve-plugin can stub zod's locale barrel to en-only —
-    // the CLI binary has no plugin surface. Same bundle options + minify; deterministic
-    // (pinned esbuild version, deterministic minifier).
-    const localeStripToEn = {
-      name: "nomos-zod-locales-en-only",
-      setup(build: import("esbuild").PluginBuild) {
-        build.onResolve({ filter: /locales\/index\.js$/ }, (args) => {
-          const resolved = path.resolve(args.resolveDir, args.path);
-          if (!/[\/\\]zod[\/\\]/.test(resolved)) return null; // only zod's own barrel
-          return { path: resolved, namespace: "nomos-zod-locales-en" };
-        });
-        build.onLoad({ filter: /.*/, namespace: "nomos-zod-locales-en" }, (args) => ({
-          // en ONLY: the default error map — messages stay byte-identical to today's default,
-          // so typed refusal payloads (which carry codes + en text) replay unchanged.
-          contents: 'export { default as en } from "./en.js";',
-          resolveDir: path.dirname(args.path),
-          loader: "js" as const,
-        }));
-      },
-    };
-    const built = await esbuildMod.build({
-      entryPoints: [entryPath], bundle: true, format: "iife", target: "es2020",
-      platform: "neutral", charset: "utf8", minify: true, write: false,
-      absWorkingDir: cfgDir, plugins: [localeStripToEn], logLevel: "silent",
-    });
-    javascript = built.outputFiles![0]!.text.trimEnd() + "\n";
-  } else {
-    javascript = execFileSync(
-      esbuildBin,
-      [entryPath, "--bundle", "--format=iife", "--target=es2020", "--platform=neutral", "--charset=utf8"],
-      { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], cwd: cfgDir, maxBuffer: 256 * 1024 * 1024 },
-    ).trimEnd() + "\n";
-  }
-  javascript = canonicalizeEngineJavascript(javascript);
-  if (!/globalThis\.plan\s*=/.test(javascript) && !/globalThis\["plan"\]\s*=/.test(javascript)) {
-    fail(`bundled engine entry does not assign globalThis.plan — refusing to package`);
+
+  // ── CONTENT-ADDRESSED PLAN ASSETS ─────────────────────────────────────────────
+  // The ledger package no longer executes the package-wide compatibility lump above. Build the
+  // smallest domain set each dispatch class needs, index it by a typed selector, and let the kernel
+  // cache/pool the selected plan by its own content hash. Identical domain sets compile once and are
+  // shared by every selector that needs them.
+  const planAssets: UsdPlanAsset[] = [];
+  const planRoutes: UsdPlanRoute[] = [];
+  const planBySignature = new Map<string, UsdPlanAsset>();
+  let planSequence = 0;
+  const orderedDomainKeys = [...entryDomainSourceByKey.keys()];
+  const planEntrySource = (domainKeys: readonly string[], includeReports: boolean): string => {
+    const wanted = new Set(domainKeys);
+    const decls = Object.fromEntries(Object.entries(openapiDeclsByDomain).filter(([key]) => wanted.has(key)));
+    return [
+      `// AUTO-GENERATED Nomos plan asset from ${path.basename(configPath)} — do not edit.`,
+      `declare function require(id: string): Record<string, unknown>;`,
+      ...zodSeedImports,
+      `import { registerEngine } from "@githolon/dsl/engine-entry";`,
+      ``,
+      `registerEngine({`,
+      `  domains: {`,
+      ...domainKeys.map((key) => {
+        const source = entryDomainSourceByKey.get(key);
+        if (source === undefined) throw new Error(`missing generated entry source for '${key}'`);
+        return source;
+      }),
+      `  },`,
+      ...(includeReports && entryReports.length > 0 ? [`  reports: {`, ...entryReports, `  },`] : []),
+      `  routing: ${JSON.stringify(routing)},`,
+      ...(zodSeedNames.length > 0 ? [`  seeds: [${zodSeedNames.join(", ")}],`] : []),
+      ...(Object.keys(decls).length > 0 ? [`  openapiDecls: ${JSON.stringify(decls)},`] : []),
+      `  packageTitle: ${JSON.stringify(`${cfg.name} (nomos package)`)},`,
+      `});`,
+      ...domainKeys.flatMap((key) => {
+        const install = entryMintInstallByKey.get(key);
+        return install === undefined ? [] : [install];
+      }),
+      ``,
+    ].join("\n");
+  };
+  const compilePlan = (domainKeys: readonly string[], includeReports: boolean): UsdPlanAsset => {
+    const ordered = orderedDomainKeys.filter((key) => domainKeys.includes(key));
+    const signature = JSON.stringify({ domains: ordered, reports: includeReports });
+    const hit = planBySignature.get(signature);
+    if (hit !== undefined) return hit;
+    const sourcePath = path.join(outDir, `.nomos_plan_${planSequence++}.ts`);
+    writeFileSync(sourcePath, planEntrySource(ordered, includeReports), "utf8");
+    const args = [
+      sourcePath,
+      "--bundle", "--format=iife", "--target=es2020", "--platform=neutral", "--charset=utf8",
+      "--define:__nmsRuntimeLaw=true",
+      ...(compact ? ["--minify"] : []),
+    ];
+    let bundled = execFileSync(esbuildBin, args, {
+      encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], cwd: cfgDir, maxBuffer: 256 * 1024 * 1024,
+    }).trimEnd() + "\n";
+    bundled = canonicalizeEngineJavascript(bundled);
+    if (!/globalThis\.plan\s*=/.test(bundled) && !/globalThis\["plan"\]\s*=/.test(bundled)) {
+      fail(`generated plan asset does not assign globalThis.plan — refusing to package`);
+    }
+    const asset = { sha256: sha256HexUtf8(bundled), javascript: bundled };
+    planBySignature.set(signature, asset);
+    planAssets.push(asset);
+    return asset;
+  };
+  const routePlan = (selector: string, domainKeys: readonly string[], includeReports = false): void => {
+    const asset = compilePlan(domainKeys, includeReports);
+    planRoutes.push({ selector, planSha256: asset.sha256 });
+  };
+  for (const key of orderedDomainKeys) routePlan(`plan:domain:${key}`, [key]);
+  routePlan("describe", orderedDomainKeys);
+  for (const reportId of Object.keys(cfg.reports ?? {})) routePlan(`report:report:${reportId}`, [], true);
+  const routeTable = (
+    prefix: string,
+    table: Readonly<Record<string, readonly string[]>> | undefined,
+  ): void => {
+    for (const [id, domains] of Object.entries(table ?? {})) routePlan(`${prefix}${id}`, domains);
+  };
+  routeTable("report:derive:", routing.derivedOf);
+  routeTable("report:combine:", routing.combinedOf);
+  routeTable("report:aggregateInvariant:", routing.aggregateInvariantOf);
+  routeTable("report:invariant:", routing.relationOf);
+  routeTable("report:workspaceInvariantReads:", routing.workspaceInvariantOf);
+  routeTable("report:workspaceInvariant:", routing.workspaceInvariantOf);
+  const workspaceInvariantDomains = [...new Set(Object.values(routing.workspaceInvariantOf ?? {}).flat())];
+  if (workspaceInvariantDomains.length > 0) {
+    routePlan("report:workspaceInvariantList", workspaceInvariantDomains);
   }
 
   // ── 1a. THE CAPTURED-READ GATE (#57, lifted-when-declared since #58) ──
@@ -2441,14 +3281,18 @@ async function main(): Promise<void> {
   // Slice B: a FOREIGN (attested) read declaration ALSO opts the law into the read lane —
   // `read(q, args, {from})` is served from the verified injected envelope, so a law whose
   // only reads are foreign is just as declared as a local-read law.
-  const declaresCapturedReads = domainModules.some((m) =>
+  // Framework-private authority law has its own declared read. It must not globally bless an undeclared
+  // tenant `read()` merely because both happen to share one package lump. Only presented business law can
+  // satisfy the tenant captured-read declaration gate; the private law uses `readFrameworkDeclared` and
+  // deliberately does not carry the tenant marker.
+  const declaresCapturedReads = presentationDomainModules.some((m) =>
     m.directives.some(
       (d) =>
         ((d as { declaredQueryReads?: unknown[] }).declaredQueryReads ?? []).length > 0 ||
         ((d as { declaredForeignReads?: unknown[] }).declaredForeignReads ?? []).length > 0,
     ),
   );
-  if (javascript.includes(CAPTURED_READ_LUMP_MARKER) && !declaresCapturedReads) {
+  if (planAssets.some((asset) => asset.javascript.includes(CAPTURED_READ_LUMP_MARKER)) && !declaresCapturedReads) {
     fail(
       `this law references read() — the CAPTURED-READ lane — but NO directive declares a ` +
         `captured-read query, so the sealed engine would provide no nomos.read and every ` +
@@ -2480,62 +3324,67 @@ async function main(): Promise<void> {
     }
   }
 
-  // ── 1b. THE FROZEN-SANDBOX BOOT PROBE (lazy boot only, fail-closed) ──
-  // The sealed engine freezes globalThis after the lump's top level; a lazy
+  // ── 1b. THE FROZEN-SANDBOX BOOT PROBE (fail-closed) ──
+  // The sealed engine freezes globalThis after a plan asset's top level; a lazy
   // domain's module init runs LATER, inside the dispatch. Any module that writes
   // an ambient global at init (the zod slots are pre-seeded above; this guards
   // everything else) would deterministically throw at FIRST DISPATCH in
   // production. Reproduce the sandbox order here — eval the real bundle in a
   // fresh frozen context, then force every domain — and refuse to package on any
   // failure that is not the expected unknown-directive refusal.
-  if (!eagerLump) {
+  {
     // A CHILD process: the probe must freeze a REAL global object (a `vm` context
     // global refuses Object.freeze), and the lump must run STRICT (the engine
     // evals it with the STRICT flag — sloppy mode would silently no-op the very
     // frozen-global writes the probe exists to catch).
-    const lumpPath = path.join(outDir, ".nomos_lump.js");
-    writeFileSync(lumpPath, javascript, "utf8");
     const probePath = path.join(outDir, ".nomos_boot_probe.cjs");
     writeFileSync(
       probePath,
       [
         `// AUTO-GENERATED by nomos-compile — the frozen-sandbox lazy-boot probe.`,
         `const fs = require("node:fs");`,
-        `const lump = fs.readFileSync(process.argv[2], "utf8");`,
-        `const domains = JSON.parse(process.argv[3]);`,
-        `(0, eval)('"use strict";\\n' + lump); // indirect eval → real global scope, strict like the engine`,
+        `const plan = fs.readFileSync(process.argv[2], "utf8");`,
+        `const key = process.argv[3];`,
+        `(0, eval)('"use strict";\\n' + plan); // indirect eval → real global scope, strict like the engine`,
         `Object.freeze(globalThis);            // the sealed sandbox freezes before dispatch`,
-        `for (const key of domains) {`,
-        `  let msg;`,
-        `  try { globalThis.plan({ intent: { domain: key, directiveId: "__nomos_boot_probe__" } }); msg = "unexpected-success"; }`,
-        `  catch (e) { msg = String((e && e.message) || e); }`,
-        `  if (!/no directive registered/.test(msg)) { console.error(key + "\\u0000" + msg); process.exit(3); }`,
-        `}`,
+        `let msg;`,
+        `try { globalThis.plan({ intent: { domain: key, directiveId: "__nomos_boot_probe__" } }); msg = "unexpected-success"; }`,
+        `catch (e) { msg = String((e && e.message) || e); }`,
+        `if (!/no directive registered/.test(msg)) { console.error(key + "\\u0000" + msg); process.exit(3); }`,
         ``,
       ].join("\n"),
       "utf8",
     );
-    try {
-      execFileSync(process.execPath, [probePath, lumpPath, JSON.stringify(domainsToCompile.map((d) => d.key))], {
-        encoding: "utf8",
-        stdio: ["ignore", "ignore", "pipe"],
-      });
-    } catch (e) {
-      const stderr = String((e as { stderr?: string }).stderr ?? "").trim();
-      const [domainKey, msg] = stderr.includes("\u0000") ? stderr.split("\u0000") : ["?", stderr];
-      fail(
-        `domain '${domainKey}' failed its frozen-sandbox lazy-boot probe — a module ` +
-          `initializer touches ambient globals after the freeze (the engine would ` +
-          `refuse its first dispatch): ${msg}`,
-      );
+    for (const route of planRoutes.filter((candidate) => candidate.selector.startsWith("plan:domain:"))) {
+      const domainKey = route.selector.slice("plan:domain:".length);
+      const asset = planAssets.find((candidate) => candidate.sha256 === route.planSha256)!;
+      const planPath = path.join(outDir, `.nomos_boot_${planSequence++}.js`);
+      writeFileSync(planPath, asset.javascript, "utf8");
+      try {
+        execFileSync(process.execPath, [probePath, planPath, domainKey], {
+          encoding: "utf8", stdio: ["ignore", "ignore", "pipe"],
+        });
+      } catch (e) {
+        const stderr = String((e as { stderr?: string }).stderr ?? "").trim();
+        const [, msg = stderr] = stderr.includes("\u0000") ? stderr.split("\u0000") : ["?", stderr];
+        fail(
+          `domain '${domainKey}' failed its frozen-sandbox plan probe — a module initializer ` +
+            `touches ambient globals after the freeze (the engine would refuse its first dispatch): ${msg}`,
+        );
+      }
     }
   }
 
   // ── 2. USD IR + the package envelope ──
   const usdJson = emitUsdJsonForModules(domainModules);
-  const text = packageUsda(usdJson, javascript, { compact });
+  const text = nativePlanPackageUsda(
+    cfg.name,
+    JSON.parse(usdJson),
+    domainModules,
+    planAssets,
+    planRoutes,
+  );
   const pkgPath = path.join(outDir, `${cfg.name}.package.usda`);
-  writeFileSync(pkgPath, text, "utf8");
   const domainHash = sha256HexUtf8(text);
 
   // ── 2a. the REAL layered RELATION `.usda` set — an additive, deterministic visualization +
@@ -2563,22 +3412,54 @@ async function main(): Promise<void> {
     }
   }
 
-  // ── 2b. opt-in LAYERED emission — additive artifacts ONLY (the flattened package
-  //        above and its domainHash are already written and do not move). The
-  //        homomorphism is ASSERTED fail-closed on every layered compile: the
-  //        per-module layer stack must flatten BYTE-IDENTICALLY to the canonical
-  //        composed IR embedded in the package, or nothing layered is emitted.
+  // ── 2b. REQUIRED LAYERED emission — the executable envelope above retains the
+  //        canonical resolved law, while these are the authored/composable source layers. The
+  //        homomorphism is ASSERTED fail-closed on every compile: the
+  //        per-module layer stack must resolve to the same canonical law embedded
+  //        in the package, or compilation refuses.
   let layeredRootPath: string | undefined;
   let layeredFileCount = 0;
-  if (layered) {
+  let usdcatFlattenVerified = false;
+  let composedUsdIdentity: string | undefined;
+  {
     const safe = (s: string) => s.replace(/[^A-Za-z0-9._-]/g, "_");
     const layersDir = path.join(outDir, "layers");
     mkdirSync(layersDir, { recursive: true });
     const allLayers: UsdLayer[] = [];
     const relPaths: string[] = [];
     const pendingWrites: { path: string; text: string }[] = [];
+    const canonicalLayers = new Map(
+      (JSON.parse(usdJson) as { layers: UsdLayer[] }).layers.map((layer) => [layer.path, layer] as const),
+    );
     for (const ld of layeredDomains) {
-      for (const emitted of emitLayeredDomain(ld.key, ld.inputs)) {
+      const authored = emitLayeredDomain(ld.key, ld.inputs, { applyBusinessCorrectionLayer: false });
+      const canonicalLayer = canonicalLayers.get(`/Nomos/${ld.key}`);
+      // Workspace invariants include compiler-owned consequences of the complete
+      // application language (birth quota, receiving-group policy, recovery). They
+      // are not owned by one source file, so seat the canonical declaration once in
+      // the weakest package prelude instead of losing it or duplicating it. Contract
+      // implementation links are likewise a cross-module fact: the contract may be
+      // declared in one layer and implemented by an aggregate in another.
+      const emittedLayers = authored.map((emitted, index) => {
+        if (index !== 0 || canonicalLayer === undefined) return emitted;
+        const needsPackagePrelude = canonicalLayer.nomosInvariantGate !== undefined || canonicalLayer.nomosContracts !== undefined;
+        if (!needsPackagePrelude) return emitted;
+        const layer: UsdLayer = {
+          ...emitted.layer,
+          ...(canonicalLayer.nomosInvariantGate !== undefined
+            ? { nomosInvariantGate: canonicalLayer.nomosInvariantGate }
+            : {}),
+          ...(canonicalLayer.nomosContracts !== undefined
+            ? { nomosContracts: canonicalLayer.nomosContracts }
+            : {}),
+        };
+        return {
+          ...emitted,
+          layer,
+          usda: usdaLayerText(ld.key, emitted.name, layer, ld.inputs[index]!.module, new Set()),
+        };
+      });
+      for (const emitted of emittedLayers) {
         const base = `${safe(ld.key)}--${safe(emitted.name)}`;
         pendingWrites.push({ path: path.join(layersDir, `${base}.usda`), text: emitted.usda });
         pendingWrites.push({
@@ -2590,20 +3471,89 @@ async function main(): Promise<void> {
       }
     }
     const flat = flattenLayeredUsd(allLayers);
-    const flatJson = JSON.stringify(flat);
-    if (flatJson !== usdJson) {
+    composedUsdIdentity = sha256HexUtf8(canonicalJson(flat));
+    const canonicalLaw = JSON.parse(usdJson);
+    if (canonicalJson(flat) !== canonicalJson(canonicalLaw)) {
+      const difference = firstLawDifference(canonicalLaw, flat) ?? "canonical law differs";
       fail(
         `layered emission does not flatten to the canonical composed IR — the module fold and ` +
           `the layer-stack fold DISAGREE for this package (usually a re-declared directive ` +
           `silently dropping an omit-when-empty reads/emits boundary, or a re-declared ` +
           `aggregate dropping a field: USD shows the weaker opinion through; the module fold ` +
-          `does not). Refusing to emit the layered artifact (the flattened package is unaffected).`,
+          `does not). First difference: ${difference}. Refusing to emit the package.`,
       );
     }
     for (const w of pendingWrites) writeFileSync(w.path, w.text, "utf8");
     layeredRootPath = path.join(outDir, `${cfg.name}.layered.usda`);
     writeFileSync(layeredRootPath, layeredRootUsda(relPaths, flat), "utf8");
     layeredFileCount = relPaths.length;
+
+    const usdcat = resolveUsdcat();
+    if (usdcat === undefined) {
+      if (requireUsdcat) {
+        fail(
+          "stock OpenUSD `usdcat` is required for this compile but was not found. " +
+            "Install OpenUSD or set NOMOS_USDCAT to the executable path.",
+        );
+      }
+    } else {
+      let flattenedText: string;
+      try {
+        flattenedText = execFileSync(usdcat, ["--flatten", layeredRootPath], {
+          encoding: "utf8",
+          stdio: ["ignore", "pipe", "pipe"],
+          maxBuffer: 256 * 1024 * 1024,
+        });
+      } catch (error) {
+        const stderr = String((error as { stderr?: string }).stderr ?? "").trim();
+        fail(`stock OpenUSD refused the generated layer stack: ${stderr || String(error)}`);
+      }
+      const openUsdLaw = parseUsdaDocument(flattenedText);
+      if (canonicalJson(openUsdLaw) !== canonicalJson(canonicalLaw)) {
+        const difference = firstLawDifference(canonicalLaw, openUsdLaw) ?? "canonical law differs";
+        fail(
+          `stock OpenUSD and Nomos resolve different effective law. First difference: ${difference}. ` +
+            `Refusing to emit the package.`,
+        );
+      }
+      usdcatFlattenVerified = true;
+    }
+  }
+  // The executable package is the COMMITTED result of composition. Do not leave
+  // a newly-written package behind when either Nomos or stock OpenUSD rejects its
+  // source stack; rejected layer artifacts remain useful diagnostics, not runnable law.
+  writeFileSync(pkgPath, text, "utf8");
+
+  // ── 2c. THE PUBLISHED OPENUSD PACKAGE ASSET ──
+  // `rootPart` is the explicit package/application boundary from the OpenUSD composition ADR.
+  // The asset references the REAL authored layer stack. It deliberately contains neither the
+  // legacy executable lump nor a hidden JSON copy of the law: this is the source of truth the
+  // application composer consumes, and the shape the ledger/runtime migration targets.
+  let packageAssetPath: string | undefined;
+  if (cfg.rootPart !== undefined) {
+    try {
+      const packageAsset = packageAssetUsda({
+        packageName: cfg.name,
+        packageIdentity: composedUsdIdentity!,
+        domains: presentationDomainModules.map((module) => module.domain ?? module.name),
+        root: cfg.rootPart,
+        lawAsset: `./${cfg.name}.layered.usda`,
+      });
+      packageAssetPath = path.join(outDir, `${cfg.name}.asset.usda`);
+      const candidateAssetPath = path.join(outDir, `.${cfg.name}.asset.candidate.usda`);
+      writeFileSync(candidateAssetPath, packageAsset, "utf8");
+      const usdcat = resolveUsdcat();
+      if (usdcat !== undefined) {
+        execFileSync(usdcat, ["--loadOnly", candidateAssetPath], {
+          encoding: "utf8",
+          stdio: ["ignore", "ignore", "pipe"],
+        });
+      }
+      renameSync(candidateAssetPath, packageAssetPath);
+    } catch (error) {
+      rmSync(path.join(outDir, `.${cfg.name}.asset.candidate.usda`), { force: true });
+      fail(`published OpenUSD package asset refused: ${(error as Error).message}`);
+    }
   }
 
   // ── 3. the IDENTITY emit (for the summary's per-domain identityHash) ──
@@ -2667,7 +3617,7 @@ async function main(): Promise<void> {
   // (currentLaw); the host ingests it and builds its router from it — no domain/directive name in host
   // source. Self-describing for the whole web ecosystem (Swagger/codegen/Hono/agent tool-calling).
   const publicOpenapi = mergeOpenApiFragments(
-    domainModules.map((m) => generateOpenApiFragment(m, { lawHash: domainHash })),
+    presentationDomainModules.map((m) => generateOpenApiFragment(m, { lawHash: domainHash })),
     { title: `${cfg.name} (nomos package)`, lawHash: domainHash },
   );
   const runtimeOpenapi = mergeOpenApiFragments(
@@ -2743,6 +3693,10 @@ async function main(): Promise<void> {
     }
   } catch (e) {
     proofSkip = (e as Error).message;
+    // A skipped generation must not leave yesterday's client story in build/. Otherwise editors and CI
+    // typecheck a stale proof which no longer describes the compiled law — worse than having no proof.
+    rmSync(path.join(outDir, `${cfg.name}.proof.mts`), { force: true });
+    rmSync(path.join(outDir, `${cfg.name}.proof-legs.json`), { force: true });
   }
   // BIRTHS DX: a `.births()` directive that can't be (or can only shakily be) proven says WHY here —
   // never a silent skip, never an opaque runtime `born=[]` first contact. When the .mts generation
@@ -2767,7 +3721,10 @@ async function main(): Promise<void> {
       `  queries: ${d.queries.join(", ") || "—"}   counts: ${d.counts.join(", ") || "—"}   sums: ${d.sums.join(", ") || "—"}`,
     ]),
     `deploy: POST ${cfg.name}.deploy.json to /v2/workspaces/<ws>/domains (or: githolon deploy <ws>)`,
-    `typed client: ${cfg.name}.client.ts — ${tsClientFactoryName(presentationDomainModules[0]?.domain ?? presentationDomainModules[0]?.name ?? cfg.name)}(holon), law hash baked in`,
+    packageAssetPath !== undefined
+      ? `package asset: ${path.basename(packageAssetPath)} — the real USD package root consumed by application composition`
+      : `package asset: NOT EMITTED — declare rootPart: { name, kind: "component" | "assembly" }`,
+    `typed application: ${cfg.name}.client.mjs — open${cfg.name.split(/[^A-Za-z0-9]+/).filter(Boolean).map((part) => part[0]!.toUpperCase() + part.slice(1)).join("")}Application({ cloud, signIn })`,
     proofPath !== undefined
       ? `generated proof: ${cfg.name}.proof.mts — run: githolon proof (live; ends ALL GREEN or names the jam)`
       : `generated proof: SKIPPED — ${proofSkip}`,
@@ -2777,14 +3734,257 @@ async function main(): Promise<void> {
 
   // ── 5. the typed TS client (#10 — the web sibling of codegen_dart), with the
   //       deployed law's content hash baked in (emitted AFTER the package is hashed) ──
-  const clientPath = path.join(outDir, `${cfg.name}.client.ts`);
-  const clientSource = generateTsClient(presentationDomainModules, { packageName: cfg.name, domainHash, interface: packageInterface, compat: nomosCompat });
+  const clientPath = path.join(outDir, `${cfg.name}.client.mjs`);
+  const clientDeclarationPath = path.join(outDir, `${cfg.name}.client.d.mts`);
+  const clientSource = generateTsClient(presentationDomainModules, {
+    packageName: cfg.name,
+    domainHash,
+    interface: packageInterface,
+    compat: nomosCompat,
+    homeDomain: resolveApplicationTopology(presentationDomainModules).homeDomain,
+  });
+  const runtimePath = path.join(DSL_DIR, "runtime", "generated-application-host.js");
+  if (!existsSync(runtimePath)) {
+    fail("the compiler-private generated application runtime is missing — reinstall @githolon/dsl");
+  }
+  const temporaryClientPath = path.join(outDir, `.${cfg.name}.client.source.ts`);
+  const temporaryRuntimeTypesPath = path.join(outDir, `.${cfg.name}.application-runtime.d.ts`);
+  const temporaryDeclarationPath = temporaryClientPath.replace(/\.ts$/, ".d.ts");
+  writeFileSync(temporaryClientPath, clientSource, "utf8");
+  writeFileSync(temporaryRuntimeTypesPath, [
+    `export declare function nomosInternalOpenGeneratedApplication<T extends object>(`,
+    `  options: { cloud: string; application: string; signIn: (request?: { readonly deviceChallenge?: string }) => Promise<string> },`,
+    `  bind: (holon: unknown, user: { readonly identityId: string; readonly identityAddress: string }) => T,`,
+    `): Promise<T & {`,
+    `  currentStatus(): Promise<any>;`,
+    `  watchStatus(listener: (status: any) => void): () => void;`,
+    `}>;`,
+    `export declare function nomosInternalOpenGeneratedChildApplication<T extends object>(`,
+    `  parent: unknown,`,
+    `  workspace: string,`,
+    `  bind: (holon: unknown) => T,`,
+    `): Promise<T>;`,
+    `export declare function nomosInternalCreateInvitation(`,
+    `  holon: unknown,`,
+    `): Promise<{ readonly address: string; readonly token: string }>;`,
+    `export declare function nomosInternalRedeemInvitation(`,
+    `  holon: unknown,`,
+    `  link: string,`,
+    `  policies: readonly { readonly domain: string; readonly domainHash: string; readonly query: string; readonly redeem: string; readonly personField: string; readonly roleField: string; readonly scopeField: string }[],`,
+    `): Promise<void>;`,
+    ``,
+  ].join("\n"), "utf8");
   try {
-    await esbuildMod.transform(clientSource, { loader: "ts", format: "esm", target: "es2020", logLevel: "silent" });
+    const typescriptEntry = createRequire(import.meta.url).resolve("typescript/lib/typescript.js");
+    const ts = (await import(pathToFileURL(typescriptEntry).href)) as typeof import("typescript");
+    const program = ts.createProgram(
+      [temporaryClientPath, temporaryRuntimeTypesPath],
+      {
+        target: ts.ScriptTarget.ES2022,
+        module: ts.ModuleKind.NodeNext,
+        moduleResolution: ts.ModuleResolutionKind.NodeNext,
+        declaration: true,
+        emitDeclarationOnly: true,
+        noEmitOnError: true,
+        strict: true,
+        skipLibCheck: true,
+        allowImportingTsExtensions: true,
+        baseUrl: outDir,
+        paths: {
+          "@githolon/client/_generated_application_host_7c1f5e": [temporaryRuntimeTypesPath],
+        },
+        outDir,
+      },
+    );
+    const emit = program.emit();
+    const diagnostics = [...ts.getPreEmitDiagnostics(program), ...emit.diagnostics];
+    if (diagnostics.length > 0 || emit.emitSkipped || !existsSync(temporaryDeclarationPath)) {
+      const detail = diagnostics.map((diagnostic) => {
+        const message = ts.flattenDiagnosticMessageText(diagnostic.messageText, "\n");
+        if (diagnostic.file === undefined || diagnostic.start === undefined) return message;
+        const point = diagnostic.file.getLineAndCharacterOfPosition(diagnostic.start);
+        return `${path.basename(diagnostic.file.fileName)}:${point.line + 1}:${point.character + 1}: ${message}`;
+      }).join("\n");
+      fail(`generated TypeScript application declarations are invalid — this is a Nomos codegen bug:\n${detail}`);
+    }
+    const sourceFile = program.getSourceFile(temporaryClientPath);
+    const applicationBusinessName = `_${tsApplicationName(cfg.name)}Business`;
+    const businessAlias = sourceFile?.statements.find(
+      (statement): statement is import("typescript").TypeAliasDeclaration =>
+        ts.isTypeAliasDeclaration(statement) && statement.name.text === applicationBusinessName,
+    );
+    if (sourceFile === undefined || businessAlias === undefined) {
+      fail(`generated TypeScript application has no ${applicationBusinessName} type`);
+    }
+    const checker = program.getTypeChecker();
+    const structuralAliases = sourceFile.statements.filter(
+      (statement): statement is import("typescript").TypeAliasDeclaration =>
+        ts.isTypeAliasDeclaration(statement) &&
+        (statement.name.text === applicationBusinessName ||
+          (statement.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.ExportKeyword) === true &&
+            statement.getText(sourceFile).includes("_NomosPublicDomain<"))),
+    );
+    const expansions = new Map<string, { exported: boolean; body: string }>();
+    for (const alias of structuralAliases) {
+      const aliasType = checker.getTypeFromTypeNode(alias.type);
+      const publicProperties = checker.getPropertiesOfType(aliasType);
+      if (alias.name.text === applicationBusinessName && publicProperties.length === 0) {
+        fail(`generated TypeScript application has no public business members`);
+      }
+      // `typeToString(theWholeAlias)` is not a public-boundary operation. For a large intersection TypeScript
+      // deliberately preserves `_NomosPublicDomain<{ domain; domainHash; interface; ... }>` rather than
+      // reducing Omit, which makes every private property textually reachable from the declaration pruner.
+      // Ask the checker for the alias's ACTUAL properties first, then render each public member independently.
+      // This applies equally to the root application and every child application returned by a business birth.
+      const body = `{\n${publicProperties.map((property) => {
+        const propertyType = checker.getTypeOfSymbolAtLocation(property, alias);
+        const rendered = checker.typeToString(
+          propertyType,
+          alias,
+          ts.TypeFormatFlags.NoTruncation | ts.TypeFormatFlags.InTypeAlias,
+        );
+        const optional = (property.flags & ts.SymbolFlags.Optional) !== 0 ? "?" : "";
+        return `  readonly ${JSON.stringify(property.getName())}${optional}: ${rendered};`;
+      }).join("\n")}\n}`;
+      expansions.set(alias.name.text, {
+        exported: alias.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.ExportKeyword) === true,
+        body,
+      });
+    }
+    if (!expansions.has(applicationBusinessName)) {
+      fail(`generated TypeScript application has no public business members`);
+    }
+    let declarationSource = readFileSync(temporaryDeclarationPath, "utf8");
+    const emittedDeclaration = ts.createSourceFile(
+      temporaryDeclarationPath,
+      declarationSource,
+      ts.ScriptTarget.Latest,
+      true,
+      ts.ScriptKind.TS,
+    );
+    // A type alias may contain hundreds of semicolon-delimited object members. The previous regexp stopped
+    // at the first one, so a real multi-domain application silently retained ReturnType<privateFactory>
+    // dependencies and dragged raw domain hashes, binders and compatibility manifests into the tenant .d.mts.
+    // Replace complete declaration nodes from the end of the file backward; the reachability pass below can
+    // then discard private factories and every framework-only type they were keeping alive.
+    const structuralDeclarations = emittedDeclaration.statements
+      .filter((statement): statement is import("typescript").TypeAliasDeclaration =>
+        ts.isTypeAliasDeclaration(statement) && expansions.has(statement.name.text))
+      .sort((left, right) => right.getStart(emittedDeclaration) - left.getStart(emittedDeclaration));
+    if (!structuralDeclarations.some((statement) => statement.name.text === applicationBusinessName)) {
+      fail(`generated TypeScript declaration has no ${applicationBusinessName} type`);
+    }
+    for (const declaration of structuralDeclarations) {
+      const expansion = expansions.get(declaration.name.text)!;
+      declarationSource =
+        declarationSource.slice(0, declaration.getStart(emittedDeclaration)) +
+        `${expansion.exported ? "export " : ""}type ${declaration.name.text} = ${expansion.body};` +
+        declarationSource.slice(declaration.end);
+    }
+
+    // Declaration emit follows private aliases that appear in exported type expressions. Replace the one
+    // application alias with its already-filtered structural business type, then retain only declarations
+    // reachable from real exports. The resulting .d.mts cannot teach or autocomplete NomosHolon, raw offers,
+    // binders or compatibility machinery because none are part of the public graph. Record coordinates remain
+    // deliberately reachable through NomosRef<T>: addresses are public and portable; authority stays private.
+    const declarationFile = ts.createSourceFile(
+      clientDeclarationPath,
+      declarationSource,
+      ts.ScriptTarget.Latest,
+      true,
+      ts.ScriptKind.TS,
+    );
+    const namesOf = (statement: import("typescript").Statement): readonly string[] => {
+      if (
+        ts.isInterfaceDeclaration(statement) || ts.isTypeAliasDeclaration(statement) ||
+        ts.isClassDeclaration(statement) || ts.isEnumDeclaration(statement) ||
+        ts.isFunctionDeclaration(statement)
+      ) return statement.name === undefined ? [] : [statement.name.text];
+      if (ts.isVariableStatement(statement)) {
+        return statement.declarationList.declarations.flatMap((declaration) =>
+          ts.isIdentifier(declaration.name) ? [declaration.name.text] : []
+        );
+      }
+      return [];
+    };
+    const exported = (statement: import("typescript").Statement): boolean =>
+      ts.isExportDeclaration(statement) || ts.isExportAssignment(statement) ||
+      (ts.canHaveModifiers(statement) &&
+        (ts.getModifiers(statement)?.some((modifier) => modifier.kind === ts.SyntaxKind.ExportKeyword) ?? false));
+    const declarations = new Map<string, number>();
+    declarationFile.statements.forEach((statement, index) => {
+      for (const name of namesOf(statement)) declarations.set(name, index);
+    });
+    const keep = new Set<number>();
+    const queue: number[] = [];
+    declarationFile.statements.forEach((statement, index) => {
+      if (exported(statement)) { keep.add(index); queue.push(index); }
+    });
+    while (queue.length > 0) {
+      const index = queue.pop()!;
+      const visit = (node: import("typescript").Node): void => {
+        if (ts.isIdentifier(node)) {
+          const dependency = declarations.get(node.text);
+          if (dependency !== undefined && !keep.has(dependency)) {
+            keep.add(dependency);
+            queue.push(dependency);
+          }
+        }
+        ts.forEachChild(node, visit);
+      };
+      visit(declarationFile.statements[index]!);
+    }
+    const printer = ts.createPrinter({ newLine: ts.NewLineKind.LineFeed, removeComments: false });
+    declarationSource = [
+      "// GENERATED by nomos-compile — the only TypeScript tenant surface. DO NOT EDIT.",
+      ...declarationFile.statements
+        .filter((_statement, index) => keep.has(index))
+        .map((statement) => printer.printNode(ts.EmitHint.Unspecified, statement, declarationFile)),
+      "",
+    ].join("\n");
+    writeFileSync(temporaryDeclarationPath, declarationSource, "utf8");
+    renameSync(temporaryDeclarationPath, clientDeclarationPath);
+    await esbuildMod.build({
+      stdin: {
+        contents: clientSource,
+        loader: "ts",
+        resolveDir: outDir,
+        sourcefile: `${cfg.name}.client.ts`,
+      },
+      outfile: clientPath,
+      bundle: true,
+      packages: "bundle",
+      platform: "node",
+      format: "esm",
+      target: "node20",
+      legalComments: "none",
+      logLevel: "silent",
+      plugins: [{
+        name: "nomos-generated-application-runtime",
+        setup(build) {
+          build.onResolve(
+            { filter: /^@githolon\/client\/_generated_application_host_7c1f5e$/ },
+            () => ({ path: runtimePath }),
+          );
+        },
+      }],
+    });
+    const bundled = canonicalizeGeneratedClientJavascript(readFileSync(clientPath, "utf8"));
+    writeFileSync(clientPath, bundled, "utf8");
+    if (
+      /^import\s+.*["']@githolon\/client/m.test(bundled) ||
+      /export\s*\{[^}]*nomosInternalOpenGeneratedApplication/s.test(bundled)
+    ) {
+      fail("generated TypeScript application did not seal its private runtime binding");
+    }
   } catch (e) {
-    fail(`generated TypeScript client is not syntactically valid — this is a Nomos codegen bug: ${(e as Error).message}`);
+    fail(`generated TypeScript application could not be sealed — this is a Nomos codegen bug: ${(e as Error).message}`);
+  } finally {
+    rmSync(temporaryClientPath, { force: true });
+    rmSync(temporaryRuntimeTypesPath, { force: true });
+    rmSync(temporaryDeclarationPath, { force: true });
+    rmSync(path.join(outDir, `${cfg.name}.client.ts`), { force: true });
   }
-  writeFileSync(clientPath, clientSource, "utf8");
 
   // ── 6. the typed Dart frontend (opt-in; the Flutter sibling of step 5, emitted
   //       after the package hash like the TS client) ──
@@ -2830,7 +4030,10 @@ async function main(): Promise<void> {
     // COMPILE ATOMICITY (co2): the Dart emit is transactional (beginAtomicGenDir) — a mid-emit fail()/throw
     // restores the prior good packages instead of leaving them wiped/partial. Finalized at process exit.
     if (dartPackages !== undefined) {
-      const r = emitDartPackages(presentationDomainModules, dartOut, domainHash, packageInterface, dartPackages, dartNames, nomosCompat, cfg.name);
+      const r = emitDartPackages(
+        presentationDomainModules, dartOut, domainHash, packageInterface, dartPackages,
+        dartNames, nomosCompat, cfg.name, deployPath,
+      );
       dartFiles = r.written;
       dartCursedHints = r.cursed;
     } else {
@@ -2889,8 +4092,9 @@ async function main(): Promise<void> {
         if (selfDir.includes(`${path.sep}node_modules${path.sep}`)) return undefined;
         const client = path.resolve(selfDir, "..", "dart");
         const types = path.resolve(selfDir, "..", "dart_types");
+        const flutter = path.resolve(selfDir, "..", "..", "nomos_flutter");
         if (existsSync(path.join(client, "pubspec.yaml")) && existsSync(path.join(types, "pubspec.yaml"))) {
-          return { client, types };
+          return { client, types, ...(existsSync(path.join(flutter, "pubspec.yaml")) ? { flutter } : {}) };
         }
         return undefined;
       })();
@@ -2903,6 +4107,7 @@ async function main(): Promise<void> {
           const lines = ["dependency_overrides:"];
           const usesClient = /(^|\n)\s+nomos_client\s*:/.test(spec);
           const usesTypes = /(^|\n)\s+nomos_types\s*:/.test(spec);
+          const usesFlutter = /(^|\n)\s+nomos_flutter\s*:/.test(spec);
           if (usesClient) lines.push(`  nomos_client:`, `    path: ${localDart.client}`);
           // A generated CLIENT or TEST package may only mention nomos_client directly, but that local
           // package depends on the simultaneously-developed nomos_types. Pub overrides do not propagate
@@ -2911,6 +4116,11 @@ async function main(): Promise<void> {
           // analyzer ever sees the code — exactly the package-skew ceremony this local dogfood gate exists
           // to absorb for tenant developers.
           if (usesTypes || usesClient) lines.push(`  nomos_types:`, `    path: ${localDart.types}`);
+          // The generated client application imports nomos_flutter, and a TEST package reaches that
+          // application transitively through its generated client sibling. Overrides do not propagate,
+          // so every local nomos_client solve root must also seat the matching local Flutter host even
+          // when its own pubspec does not name nomos_flutter directly.
+          if ((usesFlutter || usesClient) && localDart.flutter) lines.push(`  nomos_flutter:`, `    path: ${localDart.flutter}`);
           if (lines.length > 1) writeFileSync(path.join(pkg, "pubspec_overrides.yaml"), lines.join("\n") + "\n", "utf8");
         }
       }
@@ -2962,7 +4172,12 @@ async function main(): Promise<void> {
   console.log(`  domainHash ${domainHash}`);
   if (layeredRootPath !== undefined) {
     console.log(
-      `  layered    ${rel(layeredRootPath)} (${layeredFileCount} module layer(s) in build/layers/ — flatten-verified byte-identical to the canonical IR)`,
+      `  layered    ${rel(layeredRootPath)} (${layeredFileCount} module layer(s) in build/layers/ — Nomos flatten resolves the canonical law)`,
+    );
+    console.log(
+      usdcatFlattenVerified
+        ? `  usdcat     ✓ stock OpenUSD --flatten resolves the same canonical law`
+        : `  usdcat     ⚠ unavailable — set NOMOS_REQUIRE_USDCAT=1 in release CI to make this proof mandatory`,
     );
   }
   {
@@ -2974,9 +4189,6 @@ async function main(): Promise<void> {
   // from a plan's deterministic secondary `ensure(...)` — the id-mint-gate DX made visible (the author
   // wrote `ensure(B, …)`; the compiler declared `Ensure → B` so the deterministic id admits).
   for (const m of presentationDomainModules) {
-    for (const ty of m.autoDeclaredEnsures ?? []) {
-      console.log(`  ensure     auto-declared Ensure→${ty} in '${m.domain ?? m.name}' from a plan's secondary ensure(...) (id-mint gate opened)`);
-    }
   }
   const presentedIdentityNames = new Set(presentationDomainModules.map((m) => m.domain ?? m.name));
   const presentedHashes = Object.entries(identity.hashes).filter(([domain]) => presentedIdentityNames.has(domain));
@@ -3072,19 +4284,6 @@ async function main(): Promise<void> {
     }
   }
   console.log(`  deploy     ${rel(deployPath)}`);
-  if (compact) {
-    // COMPACT PACKAGES ride a base64 blob (nomos:usdJsonB64) — a peer needs the b64 decode arm
-    // (kernel ≥ the 2026-07-04 release; every current cloud/browser/node runtime has it). A NATIVE
-    // (iOS/macOS AOT) client pins its OWN kernel binary: if that xcframework predates the arm, install
-    // fails with `parse embedded USDA IR: domain package missing USDA field nomos:usdJsonHex`. Flag it
-    // so the tenant isn't surprised (the requested "flag compact when targeting native").
-    console.log(``);
-    console.log(`  ⚠ compact package (base64 blob): requires a kernel with the b64 decode arm (≥ 2026-07-04).`);
-    console.log(`    Current cloud/browser/node runtimes have it. A NATIVE client (nomos_flutter iOS/macOS)`);
-    console.log(`    pins its OWN kernel — refetch the current NomosKernel.xcframework (rm ios/Frameworks/`);
-    console.log(`    NomosKernel.xcframework && pod install), or set { compact: false } for a hex package that`);
-    console.log(`    parses on every kernel (larger deploy body; may need the signed-upload deploy lane).`);
-  }
   console.log(``);
   console.log(`your business path:`);
   if (proofPath !== undefined) {