@githolon/dsl 0.101.6 → 0.102.0

package/src/codegen_proof.ts

@@ -7,8 +7,8 @@
 
 /**
  * GENERATED PROOF CODEGEN — `build/<name>.proof.mts`, the runnable e2e SYNTHESIZED
- * FROM THE LAW ITSELF (the field-test-6 ask: reshaping the domain meant rewriting
- * test/e2e.mts by hand; now the proof reshapes itself on every compile).
+ * FROM THE LAW ITSELF (reshaping the domain used to mean repairing a second,
+ * handwritten client story; now the proof reshapes itself on every compile).
  *
  * `generateTsProof(modules, opts)` reads the domain's ACTUAL directives / queries /
  * counts (the same composed modules every other emitter sees) and emits a
@@ -35,17 +35,17 @@
 import type { z } from "zod";
 
 import { BUSINESS_BIRTH_SEED_PAYLOAD_FIELD, type AggregateHandle } from "./aggregate.js";
-import type { Field } from "./fields.js";
-import type { Directive } from "./directive.js";
+import type { Directive, ReferentialMarker } from "./directive.js";
 import type { DomainModule } from "./codegen_dart.js";
 import type { QueryDecl } from "./query.js";
 import type { FieldOp } from "./ops.js";
+import type { Field } from "./fields.js";
 import type { RelationTypeDecl, Rewrite } from "./relation_schema.js";
 import type { WorkspaceInvariantDecl } from "./framework/workspace_invariant.js";
 import { finishCount } from "./count.js";
 import { clearDirectiveId } from "./clear_directive.js";
 import type { DomainInterface } from "./shape_compat.js";
-import { voMetaOf, voSample } from "./value_object.js";
+import { idOfMetaOf, idOfTargetKindOf, voMetaOf, voSample } from "./value_object.js";
 import { mintedCreateField } from "./workspace_routing.js";
 import { deterministicPorts } from "./ctx.js";
 import { __setDispatchDomain, __setDispatchContext } from "./framework/relations.js";
@@ -54,8 +54,8 @@ import { __resetAuthoring, __drainAuthoring } from "./authoring.js";
 import { __resetReads, __drainReads } from "./read.js";
 import {
   autoStampFields,
-  tsClientFactoryName,
-  tsHashConstName,
+  domainEncryptionMap,
+  tsApplicationName,
   zodArrayElement,
   zodDef,
   zodEnumValues,
@@ -63,6 +63,10 @@ import {
   zodObjectShape,
   zodUnwrapLazy,
 } from "./codegen_ts.js";
+import { isNamespacedAggregate, qualifyReadProjectionType } from "./read_projection_namespace.js";
+import { isBusinessIntent } from "./intent.js";
+import { zodSampleNumber, zodSampleString } from "./zod_introspection.js";
+import { generatedAggregateCollectionName } from "./generated_client_names.js";
 
 /** Shared empty visited-set for the lazy-recursion guard (no allocation on the common path). */
 const EMPTY_LAZY_VISITED: ReadonlySet<z.ZodTypeAny> = new Set();
@@ -161,37 +165,23 @@ function uniquifyBirthPayload(
   return suffixed;
 }
 
-// Constrained-string candidates probed against a field's OWN schema when the readable `sample-<field>`
-// fails it (a `.regex()/.length()/.email()/.url()` bound — co2: a locale-pattern `defaultLocale` was
-// handed `sample-defaultLocale`, violating its own schema and killing the whole leg downstream). Ordered
-// common-first; the READABLE sample stays the first try so unconstrained fields are byte-stable.
-const STRING_CANDIDATES: readonly string[] = [
-  "sample", "en", "en-GB", "AA", "A1", "a", "1", "2026-01-01", "2026-01-01T00:00:00Z",
-  "a@example.com", "https://example.com", "#000000", "00000000-0000-0000-0000-000000000000",
-  "0000000000000000000000000000000000000000000000000000000000000000", // a 64-hex digest
-];
 function sampleString(zt: z.ZodTypeAny, field: string): string {
-  const readable = `sample-${field}`;
-  if (zt.safeParse(readable).success) return readable;
-  for (const cand of SUBJECT_CANDIDATES) if (zt.safeParse(cand).success) return cand;
-  for (const cand of STRING_CANDIDATES) if (zt.safeParse(cand).success) return cand;
-  // NO INVALID SAMPLE (co2): returning a schema-violating string poisons every consumer downstream (the
-  // recipe probe, the proof leg, the generated .mts) with a mystery refusal — throw NAMED instead (the
-  // callers' try/catch degrades to the same honest skip an unsynthesizable shape gets).
-  throw new Error(
-    `codegen-proof: field '${field}': no sample satisfies its own string schema (a .regex()/.length() ` +
-      `bound none of the ${1 + SUBJECT_CANDIDATES.length + STRING_CANDIDATES.length} candidates fit) — ` +
-      `loosen the pattern, or prove that directive by hand in test/e2e.mts`,
-  );
+  try {
+    return zodSampleString(zt, field);
+  } catch {
+    throw new Error(
+      `codegen-proof: field '${field}': no sample satisfies its own string schema — ` +
+        "loosen the pattern or provide a generator-readable lawful example",
+    );
+  }
 }
 
 // Candidate numbers probed against a field's own schema (in a sensible order) so a `.min()/.max()/
 // .int()/.positive()` constraint is respected — the number sibling of SUBJECT_CANDIDATES. `1` first
 // keeps the guestbook golden output stable; the rest cover common bounds (lat/lng, non-negative, etc.).
-const NUMBER_CANDIDATES: readonly number[] = [1, 0, -1, 2, 10, 100, 0.5, -90, 90, 180, -180, 1000000];
 function sampleNumber(zt: z.ZodTypeAny): number {
-  for (const cand of NUMBER_CANDIDATES) if (zt.safeParse(cand).success) return cand;
-  return 1; // no candidate fits an exotic bound — the whole-payload safeParse / VO validate names the field
+  try { return zodSampleNumber(zt); }
+  catch { return 1; } // whole-payload validation names an exotic bound
 }
 
 /** The leaf identifier of a full path (`a.b[0].c` → `c`) — the readable `sample-<leaf>` string base. */
@@ -227,7 +217,7 @@ function sampleOfZod(
   if (zodKind(zt) === "lazy") {
     if (visited.has(zt)) {
       throw new Error(
-        `codegen-proof: ${where} — field '${path}': recursive z.lazy schema — a REQUIRED self-reference makes a finite sample impossible; make the recursive field \`.optional()\` (proof omits it) or wrap it in an array (proof emits \`[]\`), or prove this directive by hand in test/e2e.mts`,
+        `codegen-proof: ${where} — field '${path}': recursive z.lazy schema — a REQUIRED self-reference makes a finite sample impossible; make the recursive field \`.optional()\` (proof omits it) or wrap it in an array (proof emits \`[]\`)`,
       );
     }
     const next = new Set(visited);
@@ -308,7 +298,7 @@ function sampleOfZod(
     }
     default:
       throw new Error(
-        `codegen-proof: ${where} — field '${path}': cannot synthesize a sample for zod shape '${zodKind(zt)}' — reshape it to a sampleable type (string/number/boolean/enum/array/object/nested valueObject), or prove that directive by hand in test/e2e.mts`,
+        `codegen-proof: ${where} — field '${path}': cannot synthesize a sample for zod shape '${zodKind(zt)}' — reshape it to a sampleable type (string/number/boolean/enum/array/object/nested valueObject) or teach the generator that value shape`,
       );
   }
 }
@@ -318,12 +308,27 @@ function sampleOfZod(
  * optional/defaulted fields omitted, required `…At` strings omitted (auto-stamped
  * by the generated client), everything else sampled by {@link sampleOfZod}.
  */
-export function synthesizePayload(schema: z.ZodTypeAny, where: string, opts?: { voIncludeOptional?: boolean }): SynthesizedPayload {
+export function synthesizePayload(
+  schema: z.ZodTypeAny,
+  where: string,
+  opts?: { voIncludeOptional?: boolean; example?: unknown },
+): SynthesizedPayload {
   if (zodKind(schema) !== "object") {
     throw new Error(`codegen-proof: ${where} payload is not a zod object — the proof can only synthesize object payloads`);
   }
   const autoStamped = autoStampFields(schema);
   const stamped = new Set(autoStamped);
+  if (opts?.example !== undefined) {
+    const parsed = schema.safeParse(opts.example);
+    if (!parsed.success) {
+      throw new Error(
+        `codegen-proof: ${where} directive example no longer satisfies its payload schema: ${parsed.error.message}`,
+      );
+    }
+    const value = { ...(parsed.data as Record<string, unknown>) };
+    for (const field of stamped) delete value[field];
+    return { value, autoStamped };
+  }
   const value: Record<string, unknown> = {};
   for (const [name, raw] of Object.entries(zodObjectShape(schema))) {
     const f = raw as z.ZodTypeAny;
@@ -335,50 +340,72 @@ export function synthesizePayload(schema: z.ZodTypeAny, where: string, opts?: {
   return { value, autoStamped };
 }
 
-// ── shape discovery (which legs THIS law can prove) ───────────────────────────────
-
-interface ConcurrencyLeg {
-  readonly directive: Directive<unknown>;
-  /** The payload field that carries the target instance id (first required string `…Id`). */
-  readonly idField: string;
-  /** The AddWins set field the directive adds to (payload array field name === aggregate set field name). */
-  readonly setField: string;
+/** Prefer a directive's validated cross-field example, then fall back to the
+ * ordinary per-field/VO synthesizer. Keeping this in one helper prevents proof,
+ * check and precondition legs from silently choosing different samples. */
+export function synthesizeDirectivePayload(
+  directive: Directive<any>,
+  where: string,
+  opts?: { voIncludeOptional?: boolean },
+): SynthesizedPayload {
+  return synthesizePayload(directive.payloadSchema as z.ZodTypeAny, where, {
+    ...opts,
+    ...(directive.payloadExample === undefined
+      ? {}
+      : { example: directive.payloadExample }),
+  });
 }
 
-/**
- * The AddWins two-writer leg needs the law to have the shape for it: a `.mutates`
- * directive on the created aggregate whose payload carries (a) a required string
- * `…Id` field (the instance) and (b) an array-of-string field named exactly like
- * one of the aggregate's AddWins set fields (the `addToSet` signature). Absent
- * that shape, the proof prints a skip note instead of inventing law.
- */
-function findConcurrencyLeg(
-  directives: readonly Directive<unknown>[],
-  agg: AggregateHandle,
-): ConcurrencyLeg | undefined {
-  const addWinsSets = Object.entries(agg.fields)
-    .filter(([, f]) => (f as Field).kind === "set" && ((f as Field).driver as { kind?: string }).kind === "AddWins")
-    .map(([name]) => name);
-  if (addWinsSets.length === 0) return undefined;
-  for (const d of directives) {
-    if (d.marker !== "mutates" || d.aggregateId !== agg.id) continue;
-    let shape: Record<string, z.ZodTypeAny>;
-    try {
-      shape = zodObjectShape(d.payloadSchema as z.ZodTypeAny);
-    } catch {
-      continue;
-    }
-    const idField = Object.entries(shape).find(
-      ([name, f]) => name.length > 2 && name.endsWith("Id") && zodKind(f) === "string",
-    )?.[0];
-    if (idField === undefined) continue;
-    const setField = addWinsSets.find((s) => {
-      const f = shape[s];
-      return f !== undefined && zodKind(f) === "array" && zodKind(zodArrayElement(f)) === "string";
-    });
-    if (setField !== undefined) return { directive: d, idField, setField };
+/** Concrete aggregate references required by a payload. A reference is not sample data: the generated
+ * application proof must create/read the target and carry the returned `NomosRef<T>` forward. Shared
+ * contracts deliberately stay out of this map because they require a concrete implementing aggregate. */
+function aggregateReferenceFields(schema: z.ZodTypeAny): Readonly<Record<string, string>> {
+  if (zodKind(schema) !== "object") return {};
+  const out: Record<string, string> = {};
+  for (const [field, raw] of Object.entries(zodObjectShape(schema))) {
+    const target = idOfMetaOf(raw as z.ZodTypeAny);
+    if (target !== undefined && idOfTargetKindOf(raw as z.ZodTypeAny) !== "contract") out[field] = target;
   }
-  return undefined;
+  return out;
+}
+
+/** Reference fields the business payload may legitimately omit. A validated `.example()` may include an
+ * optional predecessor even when a fresh journey has not created one yet; the runner drops that one field
+ * instead of inventing a string id or blocking the rest of the business action. */
+function optionalAggregateReferenceFields(schema: z.ZodTypeAny): readonly string[] {
+  if (zodKind(schema) !== "object") return [];
+  return Object.entries(zodObjectShape(schema))
+    .filter(([, raw]) => {
+      const field = raw as z.ZodTypeAny;
+      const kind = zodKind(field);
+      return idOfMetaOf(field) !== undefined && (kind === "optional" || kind === "default");
+    })
+    .map(([field]) => field)
+    .sort();
+}
+
+const proofTypeIdent = (type: string): string => type.replace(/[^A-Za-z0-9_$]/g, "_");
+const proofRefSlot = (type: string): string => `proof${proofTypeIdent(type)}Ref`;
+const proofRefGetter = (type: string): string => `requireProof${proofTypeIdent(type)}Ref`;
+const proofResultMember = (type: string): string => {
+  const bare = type.split(".").filter(Boolean).at(-1) ?? type;
+  return lcFirst(camel(bare.replace(/[^A-Za-z0-9_$]+/g, " ")));
+};
+
+/** Emit a typed application payload. Ordinary facts remain literals; every `idOf(Aggregate)` field is an
+ * expression returning a real `NomosRef<Aggregate>` created earlier in this generated journey. */
+function typedPayloadLiteral(
+  payload: Readonly<Record<string, unknown>>,
+  referenceFields: Readonly<Record<string, string>>,
+  overrides: Readonly<Record<string, string>> = {},
+): string {
+  const keys = new Set([...Object.keys(payload), ...Object.keys(overrides)]);
+  const entries = [...keys].map((field) => {
+    const expression = overrides[field]
+      ?? (referenceFields[field] !== undefined ? `${proofRefGetter(referenceFields[field]!)}()` : JSON.stringify(payload[field]));
+    return `${JSON.stringify(field)}: ${expression}`;
+  });
+  return `{ ${entries.join(", ")} }`;
 }
 
 // ── authority-conformance discovery (the ONE-ENCODER + gate proof — actorless gated offer is impossible) ──
@@ -396,6 +423,8 @@ export interface AuthorityConformanceLeg {
   readonly relation: string;
   /** The synthesized payload the proof drives the gated directive with (auto-stamped `…At` omitted). */
   readonly payload: Record<string, unknown>;
+  /** Payload fields which must receive a previously-created typed aggregate reference. */
+  readonly referenceFields?: Readonly<Record<string, string>>;
   /** Required `…At` fields the runtime stamps at dispatch (mirrors the create leg). */
   readonly autoStamped: readonly string[];
   /** When the gated directive is a `.creates` whose own id is kernel-minted, the field to mint at runtime. */
@@ -418,7 +447,7 @@ export function discoverAuthorityConformanceLeg(mod: DomainModule): AuthorityCon
   if (gated === undefined) return undefined;
   let synth: SynthesizedPayload;
   try {
-    synth = synthesizePayload(gated.payloadSchema as z.ZodTypeAny, `${domain}/${gated.id}`);
+    synth = synthesizeDirectivePayload(gated, `${domain}/${gated.id}`);
   } catch {
     return undefined; // an exotic payload the synthesizer can't sample → no conformance leg (still gated at the kernel)
   }
@@ -431,270 +460,12 @@ export function discoverAuthorityConformanceLeg(mod: DomainModule): AuthorityCon
     directiveId: gated.id,
     relation: gated.requiresRelationGate!.relation,
     payload,
+    ...(() => { const refs = aggregateReferenceFields(gated.payloadSchema as z.ZodTypeAny); return Object.keys(refs).length > 0 ? { referenceFields: refs } : {}; })(),
     autoStamped: synth.autoStamped,
     ...(mintField !== undefined ? { mintField } : {}),
   };
 }
 
-/**
- * THE AUTHORITY-CONFORMANCE LEG (the one-encoder + gate proof). On the real LOCAL holon, with fetch trapped:
- *   (a) bind the generated client WITH an actor + drive the gated directive. SPY on `holon.offerDirective` to
- *       capture the (domain, directiveId, payload, opts) the client passes, RE-ENCODE that through the v2
- *       envelope shape (the SAME `{ v:2, intent, security:{actor} }` the one encoder emits) and DECODE it back
- *       to assert `security.actor` IS the bound actor — the produced offer envelope carries the principal.
- *   (b) bind a SECOND client WITHOUT an actor + call the gated directive — assert it THROWS
- *       MissingOfferAuthority LOCALLY (before any offerDirective/submit fires; the spy stays untouched).
- * Emits nothing when the package has no gated directive (a documented no-op note).
- */
-function authorityConformanceLegLines(
-  leg: AuthorityConformanceLeg | undefined,
-  factory: string,
-  n: () => number,
-): string[] {
-  if (leg === undefined) {
-    return [
-      `// ${n()}. authority-conformance leg: this law has no gated (\`.requires(...)\`) directive, so there is`,
-      `//    nothing to prove about actorless-gated-offer refusal (an un-gated domain authors openly).`,
-      `console.log("– authority-conformance leg SKIPPED — no .requires(...) directive (add one to prove the one-encoder threads security.actor + an actorless gated offer can't be generated)");`,
-      ``,
-    ];
-  }
-  const payloadEntries = leg.mintField !== undefined
-    ? `{ ...${JSON.stringify(leg.payload)}, ${JSON.stringify(leg.mintField)}: await holon.mint("conformance") }`
-    : JSON.stringify(leg.payload);
-  return [
-    `// ${n()}. AUTHORITY CONFORMANCE (THE ONE ENCODER + the gate): \`${leg.domain}/${leg.directiveId}\` is GATED`,
-    `//    (\`.requires("${leg.relation}")\`). (a) WITH an actor the produced offer envelope must carry`,
-    `//    security.actor; (b) WITHOUT one the generated client THROWS MissingOfferAuthority before any submit.`,
-    `{`,
-    `  const realFetch2 = globalThis.fetch;`,
-    `  globalThis.fetch = (() => { throw new Error("OFFLINE PROOF VIOLATED: authority-conformance touched the network"); }) as typeof fetch;`,
-    `  try {`,
-    `    // (a) SPY on offerDirective: capture what the generated client passes WITHOUT admitting a synthetic`,
-    `    //     business write, re-encode the v2 envelope, and assert security.actor IS the actor.`,
-    `    const ACTOR = "user:proof-conformance";`,
-    `    let captured: { domain: string; directiveId: string; payload: unknown; opts?: { domainHash?: string; actor?: string } } | undefined;`,
-    `    holon.offerDirective = (domain, directiveId, payload, opts) => {`,
-    `      captured = { domain, directiveId, payload, opts };`,
-    `      return Promise.resolve("0000000000000000000000000000000000000000");`,
-    `    };`,
-    `    try {`,
-    `      await ${factory}(holon, { actor: ACTOR }).${leg.directiveId}(${payloadEntries});`,
-    `    } finally {`,
-    `      holon.offerDirective = realOffer;`,
-    `    }`,
-    `    if (!captured) fail("authority-conformance: the gated directive did not reach holon.offerDirective");`,
-    `    const actorOnOffer = captured!.opts?.actor;`,
-    `    if (actorOnOffer !== ACTOR) fail(\`authority-conformance: the offer did not carry the actor (got \${JSON.stringify(actorOnOffer)})\`);`,
-    `    // Decode the bytes THE ONE ENCODER actually emits from these args (NOT a hand-rolled copy) — so this`,
-    `    // leg catches encoder DRIFT (a dropped/renamed/whitespace-normalized security.actor), not merely that`,
-    `    // the actor reached offerDirective. The v2 wire format lives in exactly one place: encodeIntentOfferBytes.`,
-    `    const decoded = JSON.parse(new TextDecoder().decode(encodeIntentOfferBytes({ domain: captured!.domain, directiveId: captured!.directiveId, payload: captured!.payload, domainHash: captured!.opts?.domainHash, actor: actorOnOffer })));`,
-    `    if (decoded?.security?.actor !== ACTOR) fail(\`authority-conformance: THE ONE ENCODER dropped security.actor (\${JSON.stringify(decoded?.security)})\`);`,
-    `    ok(\`authority conformance (a) — \${${JSON.stringify(`${leg.domain}/${leg.directiveId}`)}} authored WITH an actor carries security.actor through THE ONE ENCODER\`);`,
-    ``,
-    `    // (b) the SAME directive with NO actor: the generated client refuses to BUILD the offer — it throws`,
-    `    //     MissingOfferAuthority locally, BEFORE any submit (an actorless gated offer is impossible to make).`,
-    `    let threw: Error | undefined;`,
-    `    try {`,
-    `      await ${factory}(holon).${leg.directiveId}(${payloadEntries});`,
-    `    } catch (e) { threw = e as Error; }`,
-    `    if (threw === undefined) fail("authority-conformance: the gated directive with NO actor did NOT throw — an actorless gated offer must be impossible to generate");`,
-    `    if (threw.name !== "MissingOfferAuthority") fail(\`authority-conformance: expected MissingOfferAuthority, got \${threw.name}: \${threw.message}\`);`,
-    `    ok(\`authority conformance (b) — \${${JSON.stringify(`${leg.domain}/${leg.directiveId}`)}} with NO actor throws MissingOfferAuthority before any submit (gated offer impossible to generate)\`);`,
-    `  } finally {`,
-    `    globalThis.fetch = realFetch2;`,
-    `  }`,
-    `}`,
-    ``,
-  ];
-}
-
-/**
- * THE RELATION-BOOTSTRAP LEG (the seed-then-prove POSITIVE — complements the negative conformance leg). On the
- * LOCAL holon with fetch trapped: (1) dispatch the GRANT directive under the proof actor (its subject fields
- * overwritten to the actor so the relation seats ON it), then (2) dispatch the GATED directive under the SAME
- * actor and assert it SUCCEEDS — proving that once relation R is granted, an actor holding R authors the gated
- * write (the exact loop the negative leg can't cover). Emits nothing when no granter is discoverable.
- */
-/** The canonical set of relation-bootstrap legs for a domain (co2 #2 multi-target): the `relationBootstraps[]`
- *  array when present, else the singular `relationBootstrap` as a one-element list, else empty. */
-function allRelationBootstrapLegs(pl: ProofLegs): readonly RelationBootstrapLeg[] {
-  return pl.relationBootstraps ?? (pl.relationBootstrap !== undefined ? [pl.relationBootstrap] : []);
-}
-
-/** Emit the seed-then-prove lines for EVERY discovered gated-create authority leg (co2 #2), or — when the
- *  domain has a gated create but NO seedable path — the single loud gap diagnostic. */
-function relationSeedLegsLines(pl: ProofLegs, factory: string, n: () => number, gap: string | undefined): string[] {
-  const legs = allRelationBootstrapLegs(pl);
-  if (legs.length === 0) return relationSeedLegLines(undefined, factory, n, gap);
-  return legs.flatMap((leg) => relationSeedLegLines(leg, factory, n, undefined));
-}
-
-function relationSeedLegLines(
-  leg: RelationBootstrapLeg | undefined,
-  factory: string,
-  n: () => number,
-  diagnostic?: string,
-): string[] {
-  if (leg === undefined) {
-    if (diagnostic === undefined) return [];
-    // A gated directive exists but no authority could be seeded — say EXACTLY why (a useful failure, not a
-    // silent skip). The gate is still proven negatively by the conformance leg above.
-    return [
-      `// ${n()}. relation-bootstrap leg: this law has a gated directive the proof COULD NOT seed authority for.`,
-      `console.log(${JSON.stringify(`– relation-bootstrap leg SKIPPED — ${diagnostic}`)});`,
-      ``,
-    ];
-  }
-  const ACTOR = `"user:proof-conformance"`;
-  const BARE_ACTOR = `"proof-conformance"`; // the uid without the `user:` prefix — for WRAPPED subject fields
-  const speculative = leg.seedSpeculative === true;
-  // A payload literal with subject/founder-conventional fields (+ the routed set) overwritten to the actor —
-  // so a seat lands ON the actor AND every write-once/author-binding/founder-binding invariant holds. A WRAPPED
-  // subject field (the plan lifts a bare uid into `user:${field}`) gets the BARE uid — else the re-wrap yields
-  // a double-prefixed `user:user:<uid>` the gate never stamped.
-  const actorSeatLit = (payload: Record<string, unknown>, routed: readonly string[], wrapped: readonly string[] = []): string => {
-    const overwrite = new Set<string>(routed);
-    const wrappedSet = new Set<string>(wrapped);
-    const entries = Object.entries(payload).map(([k, v]) =>
-      wrappedSet.has(k)
-        ? `${JSON.stringify(k)}: ${BARE_ACTOR}`
-        : overwrite.has(k) || /^(subject|principal|grantedBy|grantee|member|user|owner|founder)$/i.test(k)
-          ? `${JSON.stringify(k)}: ${ACTOR}`
-          : `${JSON.stringify(k)}: ${JSON.stringify(v)}`,
-    );
-    return `{ ${entries.join(", ")} }`;
-  };
-  const grantPayloadLit = actorSeatLit(leg.grantPayload, [...leg.grantSubjectFields, ...leg.grantGrantedByFields], leg.grantSubjectWrappedFields ?? []);
-  // The PREREQUISITE-SEED CHAIN dispatches (each as the actor = founder) BEFORE the grant.
-  const prereqLines = (leg.prerequisiteSeeds ?? []).flatMap((seed) => [
-    `    // prerequisite: ${leg.domain}/${seed.directiveId} establishes the state the grant's invariant reads (as founder = ACTOR).`,
-    `    await ${factory}(holon, { actor: ACTOR }).${seed.directiveId}(${actorSeatLit(seed.payload, [])});`,
-    `    ok(\`relation bootstrap (prerequisite) — ${leg.domain}/${seed.directiveId} established (as founder \${ACTOR}) before the grant\`);`,
-  ]);
-  const gatedPayloadLit = leg.gatedMintField !== undefined && leg.gatedAggregateId !== undefined
-    ? `{ ...${JSON.stringify(leg.gatedPayload)}, ${JSON.stringify(leg.gatedMintField)}: await holon.mint(${JSON.stringify(leg.gatedAggregateId)}) }`
-    : JSON.stringify(leg.gatedPayload);
-  const computedNote = leg.grantedRelation !== leg.relation && !speculative
-    ? ` — a COMPUTED gate: granting "${leg.grantedRelation}" makes the actor satisfy "${leg.relation}" via the rewrite`
-    : ``;
-
-  if (leg.bornContext !== undefined) {
-    // LAYER 4 — THE BORN-DOMAIN GENESIS-AUTHORITY PATH (co2 home). R is established ONLY by the birth genesis
-    // (e.g. birthHome → seedHomeCreator seats creator), and the seed carries an owner-binding PREREQUISITE a
-    // standalone re-seed can't satisfy. This leg is proven by `githolon proof` (offline, on the local wasm):
-    // the runner BIRTHS the workspace as the proof actor (= owner), then dispatches the gated directive INSIDE
-    // the born workspace as that owner, asserting ADMITTED at the real kernel gate (a refusal degrades to a
-    // diagnostic — never a false green). The LIVE `--live` lane proves the underlying birth via the child-birth
-    // leg; the gated-directive-in-born-context proof is the offline runner's (birthing a throwaway home per
-    // gated directive live would leave orphan workspaces).
-    const bc = leg.bornContext;
-    return [
-      `// ${n()}. RELATION BOOTSTRAP — LAYER 4 (born-domain genesis authority): \`${leg.domain}/${leg.gatedDirectiveId}\``,
-      `//    is GATED (\`.requires("${leg.relation}")\`), established ONLY by the birth genesis (\`${bc.birthDirectiveId}\` →`,
-      `//    \`${bc.seatsViaDirectiveId}\` seats "${leg.relation}") — NOT a standalone-replayable seed (its owner-binding`,
-      `//    prerequisite would false-fail). Proven by \`githolon proof\` (offline): birth the workspace as the owner,`,
-      `//    then dispatch \`${leg.gatedDirectiveId}\` INSIDE the born workspace as that owner (real-gate admitted).`,
-      `console.log("– relation-bootstrap leg (born-context) — \`${leg.domain}/${leg.gatedDirectiveId}\` .requires(\\"${leg.relation}\\") is proven in the BORN workspace by \`githolon proof\` (offline); the birth is proven live by the child-birth leg");`,
-      ``,
-    ];
-  }
-
-  if (speculative) {
-    // LAYER 3 (seed-path replay). The gate relation is reachable only through ttu/intersection/exclusion — no
-    // directly-grantable base. We REPLAY the domain's declared seed and let the REAL GATE arbitrate: if the
-    // gated write is ADMITTED, it is a green positive leg; if REFUSED, it is a DIAGNOSTIC (never a false
-    // green) — the discovered seed was not the authority path. Step (2) is wrapped so a refusal degrades.
-    const seats = (leg.seedWritesRelations ?? [leg.grantedRelation]).join(", ");
-    return [
-      `// ${n()}. RELATION BOOTSTRAP — LAYER 3 (seed-path replay): \`${leg.domain}/${leg.gatedDirectiveId}\` is GATED`,
-      `//    (\`.requires("${leg.relation}")\`), reachable only via ttu/intersection (no directly-grantable base).`,
-      `//    REPLAY the declared seed \`${leg.domain}/${leg.grantDirectiveId}\` (seats [${seats}]) on the actor, then let`,
-      `//    the REAL gate decide: admitted ⇒ proven; refused ⇒ diagnostic (a speculative seed never false-greens).`,
-      `{`,
-      `  const realFetch3 = globalThis.fetch;`,
-      `  globalThis.fetch = (() => { throw new Error("OFFLINE PROOF VIOLATED: relation-bootstrap touched the network"); }) as typeof fetch;`,
-      `  try {`,
-      `    const ACTOR = ${ACTOR};`,
-      `    let seedReplayed = false;`,
-      `    try {`,
-      `      await ${factory}(holon, { actor: ACTOR }).${leg.grantDirectiveId}(${grantPayloadLit});`,
-      `      seedReplayed = true;`,
-      `    } catch (e) {`,
-      `      console.log(\`– relation-bootstrap leg SKIPPED (layer-3 seed-path) — the declared seed ${leg.domain}/${leg.grantDirectiveId} could not be replayed (\${(e as Error)?.message ?? e}); gate ${leg.gatedDirectiveId} stays proven negatively\`);`,
-      `    }`,
-      `    if (seedReplayed) {`,
-      `      try {`,
-      `        await ${factory}(holon, { actor: ACTOR }).${leg.gatedDirectiveId}(${gatedPayloadLit});`,
-      `        ok(\`relation bootstrap (seed-path) — ${leg.domain}/${leg.gatedDirectiveId} authored after replaying the declared seed ${leg.grantDirectiveId} (the REAL gate confirmed it establishes authority for "${leg.relation}")\`);`,
-      `      } catch (e) {`,
-      `        // ANTI-FALSE-GREEN: the real gate REFUSED — the discovered seed was not the authority path. Do NOT`,
-      `        // assert a passing leg; emit a diagnostic (the conformance leg still proves the gate has teeth).`,
-      `        console.log(\`– relation-bootstrap leg SKIPPED (layer-3 seed-path) — replaying ${leg.grantDirectiveId} did NOT authorize ${leg.gatedDirectiveId} .requires("${leg.relation}") on the real gate (\${(e as Error)?.message ?? e}); no seed-path is provable\`);`,
-      `      }`,
-      `    }`,
-      `  } finally {`,
-      `    globalThis.fetch = realFetch3;`,
-      `  }`,
-      `}`,
-      ``,
-    ];
-  }
-
-  const prereqNote = (leg.prerequisiteSeeds ?? []).length > 0
-    ? ` The grant needs prerequisite seed(s) [${(leg.prerequisiteSeeds ?? []).map((s) => s.directiveId).join(", ")}] run first (as the actor = founder).`
-    : ``;
-  // TARGET PRECONDITION SETUPS (co2 #3): the gated establisher(s) for the target's `.requiresExisting`/`.where`
-  // parent — dispatched AFTER the grant (the actor now holds the relation), BEFORE the target, so its declared
-  // predicate (e.g. `lifecycle == "active"`) holds against the REAL parent, not a shape-only shell.
-  const precondLines = (leg.preconditionSetups ?? []).flatMap((s) => {
-    const lit = s.autoStamped.length > 0
-      ? `(() => { const p: Record<string, unknown> = { ...${JSON.stringify(s.payload)} }; ${s.autoStamped.map((f) => `p[${JSON.stringify(f)}] = new Date().toISOString();`).join(" ")} return p; })()`
-      : JSON.stringify(s.payload);
-    return [
-      `    // precondition: dispatch the REAL ${leg.domain}/${s.directiveId} (gated by "${s.requiresRelation ?? leg.relation}", already seated) so the target's declared predicate holds against real state.`,
-      `    await ${factory}(holon, { actor: ACTOR }).${s.directiveId}(${lit});`,
-      `    ok(\`relation bootstrap (precondition) — ${leg.domain}/${s.directiveId} established before ${leg.gatedDirectiveId} (real parent state, not a shell)\`);`,
-    ];
-  });
-  return [
-    `// ${n()}. RELATION BOOTSTRAP (seed-then-prove the POSITIVE): \`${leg.domain}/${leg.gatedDirectiveId}\` is GATED`,
-    `//    (\`.requires("${leg.relation}")\`). \`${leg.domain}/${leg.grantDirectiveId}\` GRANTS "${leg.grantedRelation}" (${leg.via})${computedNote}.${prereqNote}`,
-    `//    Grant it to the proof actor, THEN prove the gated write SUCCEEDS under that actor (what the negative`,
-    `//    conformance leg above can't cover — a seeded holder authoring a gated write).`,
-    `{`,
-    `  const realFetch3 = globalThis.fetch;`,
-    `  globalThis.fetch = (() => { throw new Error("OFFLINE PROOF VIOLATED: relation-bootstrap touched the network"); }) as typeof fetch;`,
-    `  try {`,
-    `    const ACTOR = ${ACTOR};`,
-    ...prereqLines,
-    `    // (1) grant "${leg.grantedRelation}" to ACTOR (the grant folds a writeTuple; subject seated on ACTOR).`,
-    `    await ${factory}(holon, { actor: ACTOR }).${leg.grantDirectiveId}(${grantPayloadLit});`,
-    `    ok(\`relation bootstrap (grant) — ${leg.domain}/${leg.grantDirectiveId} granted "${leg.grantedRelation}" to \${ACTOR}${leg.grantedRelation !== leg.relation ? ` (⇒ satisfies "${leg.relation}" via rewrite)` : ``}\`);`,
-    ...precondLines,
-    `    // (2) the GATED write now SUCCEEDS under the seeded actor (holds "${leg.relation}"${leg.grantedRelation !== leg.relation ? ` via "${leg.grantedRelation}"` : ``}).`,
-    `    await ${factory}(holon, { actor: ACTOR }).${leg.gatedDirectiveId}(${gatedPayloadLit});`,
-    `    ok(\`relation bootstrap (prove) — ${leg.domain}/${leg.gatedDirectiveId} authored under the seeded holder of "${leg.relation}" (gated write SUCCEEDS once granted)\`);`,
-    `  } finally {`,
-    `    globalThis.fetch = realFetch3;`,
-    `  }`,
-    `}`,
-    ``,
-  ];
-}
-
-// ── relation-bootstrap discovery (seed the gate: grant relation R, then prove a .requires(R) write SUCCEEDS) ──
-//
-// The NEGATIVE conformance leg above proves an ACTORLESS gated offer can't be generated. This POSITIVE leg
-// proves the other half: with the relation GRANTED, an actor that holds it authors the gated write SUCCESS-
-// fully. It needs a sibling directive that ESTABLISHES the relation (folds a granting `writeTuple`). We find
-// it two ways: FIRST a `.grants(R)` producer marker (the static, unambiguous lane — symmetric to `.requires`);
-// ELSE plan-probe each sibling for a `writeTuple`/relation-tuple op whose `relation === R` (inference).
-
-/** A discovered RELATION-BOOTSTRAP leg: a gated (`.requires(R)`) directive plus the sibling directive that
- *  GRANTS R. The proof dispatches the grant FIRST (its subject/grantedBy set to the seeded proof actor), then
- *  dispatches the gated directive under that actor and asserts it SUCCEEDS — the seed-then-prove positive. */
 export interface RelationBootstrapLeg {
   /** The gated directive's domain. */
   readonly domain: string;
@@ -709,16 +480,31 @@ export interface RelationBootstrapLeg {
   readonly grantedRelation: string;
   /** The synthesized gated-directive payload (auto-stamped `…At` omitted; mintField removed). */
   readonly gatedPayload: Record<string, unknown>;
+  readonly gatedReferenceFields?: Readonly<Record<string, string>>;
+  readonly gatedOptionalReferenceFields?: readonly string[];
   readonly gatedAutoStamped: readonly string[];
+  /** Referential marker of the business consequence; distinguishes a fresh create from an idempotent ensure. */
+  readonly gatedMarker?: ReferentialMarker;
+  /** Application-owned identity field. The generated runner removes it from tenant input, binds it to the
+   *  connected participant, and authors this action as that same participant. */
+  readonly gatedPrincipalField?: string;
   /** When the gated directive's own id is kernel-minted, the field to mint at runtime. */
   readonly gatedMintField?: string;
-  /** The gated create's aggregate id (the mint's type tag) — present when `gatedMintField` is. */
+  /** The gated create's aggregate id. Present for every `.creates` target so its returned typed reference
+   *  can feed later generated business actions; also supplies the mint type tag when applicable. */
   readonly gatedAggregateId?: string;
+  /** Every aggregate type this business action writes, including fan-out/secondary mutations. Used only by
+   *  the generated proof scheduler to replay the target's dependency slice instead of the whole workspace. */
+  readonly gatedWrittenAggregates?: readonly string[];
+  /** Aggregate types read by invariants guarding this action. These are state dependencies even when no
+   *  payload field is a direct ref (for example a composite-key catalogue snapshot). */
+  readonly gatedReadAggregates?: readonly string[];
   /** The granting directive id (the sibling that folds the granting `writeTuple`). */
   readonly grantDirectiveId: string;
   /** The synthesized grant payload (auto-stamped `…At` omitted). The SUBJECT fields (below) are overwritten
    *  at runtime with the seeded proof actor so the grant seats authority ON that actor. */
   readonly grantPayload: Record<string, unknown>;
+  readonly grantReferenceFields?: Readonly<Record<string, string>>;
   readonly grantAutoStamped: readonly string[];
   /** The grant-payload field(s) whose value the plan routed into the tuple SUBJECT — set to the proof actor
    *  at dispatch so the granted relation lands on the actor the gated write runs as. */
@@ -736,7 +522,7 @@ export interface RelationBootstrapLeg {
    *  the REAL KERNEL GATE is the arbiter of whether it authorizes the write), or `"born-context"` (LAYER 4:
    *  R is established by the domain's BIRTH GENESIS — the gated directive is proven INSIDE the born workspace
    *  as the owner; see {@link BornContextAuthority}). Audit + runner semantics. */
-  readonly via: "marker" | "inferred" | "computed-base" | "seed-path" | "born-context";
+  readonly via: "marker" | "inferred" | "computed-base" | "seed-path" | "born-context" | "unrestricted";
   /** LAYER-3 ANTI-FALSE-GREEN FLAG. `true` ⇒ this is a SPECULATIVE seed-path leg: codegen could NOT prove
    *  (via rewrite resolution) that replaying `grantDirectiveId` authorizes the gated write — it discovered a
    *  seed that writes relation tuples and is DEFERRING to the real kernel gate. The runner replays the seed,
@@ -766,15 +552,33 @@ export interface RelationBootstrapLeg {
    *  (each as the proof actor = founder, so their own write-once/author-binding invariants hold) BEFORE the
    *  grant — then the grant + the gated write succeed. A non-birth analog of {@link BornContextAuthority}. */
   readonly prerequisiteSeeds?: readonly PrerequisiteSeed[];
-  /** THE TARGET'S OWN PRECONDITION SETUPS (co2 #3). The gated create carries a `.requiresExisting`/`.where`
+  /** THE TARGET'S OWN PRECONDITION SETUPS (co2 #3). The gated action carries a `.requiresExisting`/`.where`
    *  precondition reading ANOTHER aggregate by a payload-id field with a predicate (e.g. `createClassification
    *  Draft` needs a `ClassificationScheme` at `p.schemeId` with `lifecycle == "active"`). The establishing
-   *  create (`createClassificationScheme`) is itself GATED by the SAME relation this leg already seats, and —
-   *  because the id field synthesizes deterministically to `"sample-<field>"` in BOTH — it writes the parent
-   *  at the exact id the target reads, WITH the real lifecycle its plan sets. The runner dispatches these AFTER
-   *  the grant (the actor holds the relation) and BEFORE the target, satisfying its declared predicate — not a
-   *  shape-only shell. Dependency-ordered. */
+   *  create (`createClassificationScheme`) is itself GATED by the SAME relation this leg already seats. The
+   *  runner dispatches it AFTER the grant and BEFORE the target, then replaces the target's typed-reference
+   *  field with the real record id it established. Source and target payload field names need not coincide. */
   readonly preconditionSetups?: readonly PreconditionSetup[];
+  /** A dynamic cross-workspace business premise. The generated fixture privately builds the source's own
+   *  business history through its published actions, serves the declared query, seats the target law's
+   *  hidden trust record and carries the signed answer. Tenant examples still contain only the target
+   *  business action. */
+  readonly sourceTrust?: SourceTrustProofSetup;
+}
+
+export interface SourceTrustProofSetup {
+  readonly viaDirectiveId: string;
+  readonly fromPayload: string;
+  readonly queryId: string;
+  readonly queryArgs: Readonly<Record<string, string>>;
+  readonly copy: Readonly<Record<string, string>>;
+  readonly genesisField: string;
+  readonly keyHashesField: string;
+  readonly sourceDomain: string;
+  readonly sourceAggregateId: string;
+  readonly sourceQueryKey: readonly string[];
+  /** Smallest generated business prefix that establishes a row returned by the source query. */
+  readonly sourceJourney: readonly RelationBootstrapLeg[];
 }
 
 /** One target-precondition setup (co2 #3): a REAL create of a parent aggregate the gated target's precondition
@@ -782,9 +586,14 @@ export interface RelationBootstrapLeg {
 export interface PreconditionSetup {
   /** The establishing create directive id (e.g. `createClassificationScheme`). */
   readonly directiveId: string;
-  /** Its synthesized payload — the id field (`.withId`) is RETAINED and matches the target's (both
-   *  `"sample-<field>"`), so it writes the parent at the exact instance the target's precondition reads. */
+  /** Its synthesized payload. The runner observes the real record it establishes and binds the target's
+   *  typed-reference field to that id; no shared synthesized SQL-style key is required. */
   readonly payload: Record<string, unknown>;
+  /** Aggregate this setup establishes. A capped singleton may already exist because birth genesis created it;
+   * the runner then reuses that state instead of replaying one-time ceremony. */
+  readonly aggregateType: string;
+  readonly reuseIfPresent?: boolean;
+  readonly referenceFields?: Readonly<Record<string, string>>;
   readonly autoStamped: readonly string[];
   /** The relation the establisher is gated by (informational; the runner dispatches it as the actor already
    *  holding this leg's seated relation — the common case is the SAME relation as the target). */
@@ -799,6 +608,7 @@ export interface PrerequisiteSeed {
   /** The synthesized payload; founder/subject-conventional fields are set to the proof actor at dispatch so
    *  the seed's own write-once/author-binding invariants pass (founder == the seeding actor). */
   readonly payload: Record<string, unknown>;
+  readonly referenceFields?: Readonly<Record<string, string>>;
   readonly autoStamped: readonly string[];
 }
 
@@ -865,7 +675,7 @@ export function probePlanOps(
 ): { ops: FieldOp[]; synth: SynthesizedPayload; probePayload: Record<string, unknown> } | undefined {
   let synth: SynthesizedPayload;
   try {
-    synth = synthesizePayload(dir.payloadSchema as z.ZodTypeAny, where);
+    synth = synthesizeDirectivePayload(dir, where);
   } catch {
     return undefined;
   }
@@ -1130,7 +940,7 @@ function probeBirthGenesis(
 ): { chain: Array<{ domain?: string; directiveId?: string; actor?: unknown }>; synth: SynthesizedPayload } | undefined {
   let synth: SynthesizedPayload;
   try {
-    synth = synthesizePayload(birthDir.payloadSchema as z.ZodTypeAny, where);
+    synth = synthesizeDirectivePayload(birthDir, where);
   } catch {
     return undefined;
   }
@@ -1175,8 +985,23 @@ export function discoverBornContextAuthority(
     if (probed === undefined) continue;
     const { chain, synth } = probed;
     // Find the genesis step (in THIS domain) whose directive writeTuples `relation` — that step seats R.
+    // Business birth carries the declared founder policy as private metadata, so proof discovery does not
+    // have to reverse-engineer a role from synthesized tuple payloads (which can be deliberately opaque).
     let seatsVia: string | undefined;
+    const businessPolicy = (bd as unknown as {
+      businessBirth?: { founderRoles?: readonly string[] };
+    }).businessBirth;
+    if (businessPolicy?.founderRoles?.includes(relation) === true) {
+      seatsVia = chain
+        .filter((step) => step?.domain === domain && typeof step.directiveId === "string")
+        .map((step) => step.directiveId as string)
+        .find((directiveId) =>
+          (byId.get(directiveId) as { businessBirthInternal?: unknown } | undefined)
+            ?.businessBirthInternal === true,
+        );
+    }
     for (const step of chain) {
+      if (seatsVia !== undefined) break;
       if (step === null || typeof step !== "object" || step.domain !== domain || typeof step.directiveId !== "string") continue;
       const stepDir = byId.get(step.directiveId);
       if (stepDir === undefined) continue;
@@ -1243,16 +1068,36 @@ function directiveHasPrerequisiteInvariant(mod: DomainModule, directiveId: strin
 /** The AGGREGATE TYPES a directive's plan writes (set/ensure/create ops) — used to find the sibling seed that
  *  establishes the state a prerequisite invariant reads. `[]` ⇒ not probeable / writes nothing. */
 function probeWritesAggregateTypes(dir: Directive<unknown>, where: string): Set<string> {
+  const out = new Set<string>([dir.aggregateId]);
+  for (const output of dir.secondaryOutputs ?? []) out.add(output.aggregateId);
   const probed = probePlanOps(dir, where);
+  for (const o of probed?.ops ?? []) if (typeof o.aggregateType === "string" && o.aggregateType.length > 0) out.add(o.aggregateType);
+  return out;
+}
+
+/** Aggregate types this directive can make exist when they were absent. A mutation may write every field of
+ * its target but cannot establish it; confusing those ideas made proof generation omit the prerequisite create
+ * for typed `requiresExisting` mutations. Declared and probed secondary outputs keep intent fan-out visible. */
+function probeEstablishesAggregateTypes(dir: Directive<unknown>, where: string): Set<string> {
   const out = new Set<string>();
-  if (probed === undefined) return out;
-  for (const o of probed.ops) if (typeof o.aggregateType === "string" && o.aggregateType.length > 0) out.add(o.aggregateType);
+  if (dir.marker === "creates" || dir.marker === "ensures") out.add(dir.aggregateId);
+  for (const output of dir.secondaryOutputs ?? []) {
+    if (output.marker === "creates" || output.marker === "ensures") out.add(output.aggregateId);
+  }
+  const probed = probePlanOps(dir, where);
+  for (const op of probed?.ops ?? []) {
+    const marker = (op as { marker?: string }).marker;
+    if ((marker === "creates" || marker === "ensures") && typeof op.aggregateType === "string" && op.aggregateType.length > 0) {
+      out.add(op.aggregateType);
+    }
+  }
   return out;
 }
 
 /** The aggregate TYPES a workspaceInvariant's declared reads depend on — the state its predicate needs to be
- *  established first. A `pre:`-prefixed read id is a PRE-apply self-check (write-once), NOT a cross-step
- *  dependency, so it's excluded. Best-effort: an un-callable reads fn yields none. */
+ *  established first. `pre:` says which SNAPSHOT the gate reads, not whether the dependency is self- or
+ *  cross-aggregate; callers compare these types with the directive's own writes to distinguish those cases.
+ *  Best-effort: an un-callable reads fn yields none. */
 function invariantReadAggregateTypes(inv: { reads: (ctx: { intent: Record<string, unknown>; principal?: string }) => Array<{ aggregate: string; id: string }> }): Set<string> {
   const out = new Set<string>();
   let refs: Array<{ aggregate: string; id: string }>;
@@ -1263,7 +1108,6 @@ function invariantReadAggregateTypes(inv: { reads: (ctx: { intent: Record<string
   }
   for (const r of refs) {
     if (r === null || typeof r !== "object") continue;
-    if (typeof r.id === "string" && r.id.startsWith("pre:")) continue; // write-once self-check, not a dependency
     if (typeof r.aggregate === "string" && r.aggregate.length > 0) out.add(r.aggregate);
   }
   return out;
@@ -1289,7 +1133,7 @@ export function discoverPrerequisiteChain(mod: DomainModule, granter: Directive<
   const synthSeed = (dir: Directive<unknown>): PrerequisiteSeed | undefined => {
     let synth: SynthesizedPayload;
     try {
-      synth = synthesizePayload(dir.payloadSchema as z.ZodTypeAny, `${domain}/${dir.id}`);
+      synth = synthesizeDirectivePayload(dir, `${domain}/${dir.id}`);
     } catch {
       return undefined;
     }
@@ -1297,7 +1141,13 @@ export function discoverPrerequisiteChain(mod: DomainModule, granter: Directive<
     const mintField = agg !== undefined ? mintedCreateField(dir, agg) : undefined;
     const payload: Record<string, unknown> = { ...synth.value };
     if (mintField !== undefined) delete payload[mintField];
-    return { directiveId: dir.id, payload, autoStamped: synth.autoStamped };
+    const referenceFields = aggregateReferenceFields(dir.payloadSchema as z.ZodTypeAny);
+    return {
+      directiveId: dir.id,
+      payload,
+      ...(Object.keys(referenceFields).length > 0 ? { referenceFields } : {}),
+      autoStamped: synth.autoStamped,
+    };
   };
   // Resolve `dir`'s prerequisites (a sibling seed per cross-step aggregate dependency), recursively. Returns
   // false when ANY prerequisite has no establishing sibling seed (the whole chain is then unsatisfiable).
@@ -1330,54 +1180,87 @@ export function discoverPrerequisiteChain(mod: DomainModule, granter: Directive<
 }
 
 /**
- * TARGET-PRECONDITION SETUPS (co2 #3). A gated create may carry a `.requiresExisting`/`.where` precondition
+ * TARGET-PRECONDITION SETUPS (co2 #3). A gated action may carry a `.requiresExisting`/`.where` precondition
  * reading a PARENT aggregate by a payload-id field with a predicate (e.g. `createClassificationDraft` needs a
  * `ClassificationScheme` at `p.schemeId` with `lifecycle == "active"`). The proof must ESTABLISH that parent
  * with REAL state — a shape-only shell fails the predicate (`classification-scheme-retired`). For each such
  * precondition we find the parent's own create directive (`createClassificationScheme`, itself gated) and
- * record it as a setup dispatched AFTER the grant / BEFORE the target: because the parent's id field
- * synthesizes to the SAME `"sample-<field>"` the target reads, it writes the parent at the exact instance,
- * WITH the lifecycle its real plan sets. Skips a self-precondition (the target's own aggregate) and any parent
- * with no discoverable create (the predicate then arbitrates at the real gate — never a false green).
+ * record it as a setup dispatched AFTER the grant / BEFORE the target. The runner binds the target's typed
+ * reference to the record this setup really established, so differently named or derived keys are fine. Skip
+ * only a self-precondition the target actually establishes; a mutation still needs a prior create/ensure.
  */
 function discoverPreconditionSetups(mod: DomainModule, gated: Directive<unknown>): PreconditionSetup[] {
   const domain = mod.domain ?? mod.name;
   const invariants = (mod.workspaceInvariants ?? []) as Array<WorkspaceInvariantDecl>;
   const directives = mod.directives as Directive<unknown>[];
-  const gatedWrites = probeWritesAggregateTypes(gated, `${domain}/${gated.id}`);
+  let gatedSample: Record<string, unknown> = {};
+  try {
+    gatedSample = { ...synthesizeDirectivePayload(gated, `${domain}/${gated.id}`).value };
+  } catch {
+    // The caller will already diagnose an unsampleable public action. Keep prerequisite discovery best-effort.
+  }
   const setups: PreconditionSetup[] = [];
   const seen = new Set<string>();
   for (const inv of invariants) {
     if (inv.on !== gated.id) continue; // preconditions on THIS target only
+    // An absence/write-once invariant deliberately accepts an empty pre-state; creating a sibling record
+    // would make that action fail. Only seek an establisher when the invariant itself rejects the empty
+    // snapshot, which is the semantic definition of an existing-state prerequisite.
+    let refs: Array<{ name?: string; aggregate: string }> = [];
+    try {
+      refs = inv.reads({ intent: gatedSample, principal: "user:proof-participant", principalVerified: true });
+      const empty = Object.fromEntries(refs.map((ref) => [ref.name ?? ref.aggregate, undefined]));
+      const verdict = inv.assert(empty as never, {
+        intent: gatedSample,
+        principal: "user:proof-participant",
+        principalVerified: true,
+        reads: [],
+      });
+      if ("accept" in verdict && verdict.accept === true) continue;
+    } catch {
+      // A predicate which cannot evaluate an absent snapshot is conservatively an existing-state dependency.
+    }
     for (const aggType of invariantReadAggregateTypes(inv)) {
-      if (gatedWrites.has(aggType)) continue; // self-precondition — the target establishes it in its own apply
       // The parent's own ESTABLISHER — a directive that WRITES `aggType` at a DETERMINISTIC (dev-chosen) key:
       // an `.ensures(<aggType>)` keyed upsert (the kernel's sanctioned non-minted-id lane), or a create-once
-      // (`.withId`). Its id field synthesizes to the SAME `"sample-<field>"` the target's precondition reads,
-      // so it writes the parent at the exact instance WITH the state its real plan sets. A truly MINTED
-      // `.creates` (kernel `<Type>_<uuid>`) has NO dev-chosen id to match the target's synthesized id — its
-      // raw-id create is refused by the mint gate anyway — so it is NOT a usable establisher here (the real
-      // gate then arbitrates the target, never a false green).
-      const creator = directives.find((d) => {
-        if (d === gated || typeof d?.payloadSchema !== "object" || d.birthsChild === true) return false;
-        if (!probeWritesAggregateTypes(d, `${domain}/${d.id}`).has(aggType)) return false;
-        const isEnsures = d.marker === "ensures";
-        const isCreateOnce = d.marker === "creates" && (d as { createOnceIdField?: unknown }).createOnceIdField !== undefined;
-        return isEnsures || isCreateOnce;
-      });
+      // (`.withId`). The runner observes its real output and supplies that id to the target. A truly MINTED
+      // `.creates` needs a mint recipe this setup shape does not yet carry, so deterministic ensures/creates
+      // remain the supported establishers and the real gate arbitrates anything else.
+      const creator = directives
+        .map((directive, index) => ({ directive, index }))
+        .filter(({ directive: d }) => {
+          if (d === gated || typeof d?.payloadSchema !== "object" || d.birthsChild === true) return false;
+          if (!probeWritesAggregateTypes(d, `${domain}/${d.id}`).has(aggType)) return false;
+          const isEnsures = d.marker === "ensures";
+          const isCreateOnce = d.marker === "creates" && (d as { createOnceIdField?: unknown }).createOnceIdField !== undefined;
+          return isEnsures || isCreateOnce;
+        })
+        // Prerequisites are business history. Prefer the published intent which establishes it; a private
+        // completion/recovery effect can write the same aggregate but is not a tenant-reachable producer.
+        .sort((left, right) => {
+          const publicRank = (directive: Directive<unknown>): number =>
+            isBusinessIntent(directive) && !directive.id.startsWith("_nms") ? 0 : 1;
+          return publicRank(left.directive) - publicRank(right.directive) || left.index - right.index;
+        })[0]?.directive;
       if (creator === undefined) continue;
       if (seen.has(creator.id)) continue;
       let synth: SynthesizedPayload;
       try {
-        synth = synthesizePayload(creator.payloadSchema as z.ZodTypeAny, `${domain}/${creator.id}`);
+        synth = synthesizeDirectivePayload(creator, `${domain}/${creator.id}`);
       } catch {
         continue;
       }
       const payload: Record<string, unknown> = { ...synth.value };
+      const referenceFields = aggregateReferenceFields(creator.payloadSchema as z.ZodTypeAny);
       seen.add(creator.id);
       setups.push({
         directiveId: creator.id,
         payload,
+        aggregateType: aggType,
+        ...(((mod.aggregates as AggregateHandle[]).find((aggregate) => aggregate.id === aggType)?.cap === 1)
+          ? { reuseIfPresent: true }
+          : {}),
+        ...(Object.keys(referenceFields).length > 0 ? { referenceFields } : {}),
         autoStamped: synth.autoStamped,
         ...(creator.requiresRelationGate !== undefined ? { requiresRelation: creator.requiresRelationGate.relation } : {}),
       });
@@ -1398,6 +1281,8 @@ export function discoverRelationBootstrapLeg(mod: DomainModule, gatedOverride?:
   const directives = mod.directives as Directive<unknown>[];
   const isGatedProvable = (d: Directive<unknown> | undefined): boolean =>
     d?.requiresRelationGate !== undefined &&
+    !d.id.startsWith("_nms") &&
+    (d as { businessBirthInternal?: unknown }).businessBirthInternal !== true &&
     typeof d.payloadSchema === "object" &&
     d.birthsChild !== true &&
     d.attestationAuthorizedGate === undefined;
@@ -1420,7 +1305,7 @@ export function discoverRelationBootstrapLeg(mod: DomainModule, gatedOverride?:
   // Synthesize the gated payload (mirror of the conformance leg — mintField removed, auto-stamped omitted).
   let gatedSynth: SynthesizedPayload;
   try {
-    gatedSynth = synthesizePayload(gated.payloadSchema as z.ZodTypeAny, `${domain}/${gated.id}`);
+    gatedSynth = synthesizeDirectivePayload(gated, `${domain}/${gated.id}`);
   } catch {
     return undefined;
   }
@@ -1428,6 +1313,67 @@ export function discoverRelationBootstrapLeg(mod: DomainModule, gatedOverride?:
   const gatedMintField = gatedAgg !== undefined ? mintedCreateField(gated, gatedAgg) : undefined;
   const gatedPayload: Record<string, unknown> = { ...gatedSynth.value };
   if (gatedMintField !== undefined) delete gatedPayload[gatedMintField];
+  const gatedReferenceFields = aggregateReferenceFields(gated.payloadSchema as z.ZodTypeAny);
+  const gatedOptionalReferenceFields = optionalAggregateReferenceFields(gated.payloadSchema as z.ZodTypeAny);
+  const gatedCreatesAggregate = gated.marker === "creates" || gated.marker === "ensures"
+    ? gated.aggregateId
+    : undefined;
+  const gatedWrittenAggregates = [...probeWritesAggregateTypes(gated, `${domain}/${gated.id}`)].sort();
+  const gatedReadAggregates = [...new Set(
+    (mod.workspaceInvariants ?? [])
+      .filter((invariant) => invariant.on === gated.id)
+      .flatMap((invariant) => [...invariantReadAggregateTypes(invariant)]),
+  )].sort();
+
+  // A declared business birth is the product's authority path, not merely one possible seed amongst many.
+  // Prove the gated verb in the workspace that `app.birth(...)` actually creates. Otherwise an unrelated
+  // legacy/bootstrap directive can look like a cleaner standalone granter and make the proof test a lane
+  // tenant application code can no longer call (the exact false negative the one-surface work removes).
+  const businessAuthorityRelations = [
+    relation,
+    ...resolveGrantableBaseRelations(
+      mod.relationTypes,
+      gated.requiresRelationGate!.object,
+      relation,
+    ).filter((candidate) => candidate !== relation),
+  ];
+  let businessAuthorityRelation: string | undefined;
+  let businessBornContext: BornContextAuthority | undefined;
+  for (const candidate of businessAuthorityRelations) {
+    const discovered = discoverBornContextAuthority(mod, candidate);
+    if (discovered === undefined) continue;
+    businessAuthorityRelation = candidate;
+    businessBornContext = discovered;
+    break;
+  }
+  if (businessBornContext !== undefined) {
+    const birthDirective = directives.find((d) => d.id === businessBornContext.birthDirectiveId);
+    if ((birthDirective as { businessBirth?: unknown } | undefined)?.businessBirth !== undefined) {
+      return {
+        domain,
+        gatedDirectiveId: gated.id,
+        relation,
+        grantedRelation: businessAuthorityRelation ?? relation,
+        gatedPayload,
+        ...(Object.keys(gatedReferenceFields).length > 0 ? { gatedReferenceFields } : {}),
+        ...(gatedOptionalReferenceFields.length > 0 ? { gatedOptionalReferenceFields } : {}),
+        gatedAutoStamped: gatedSynth.autoStamped,
+        gatedMarker: gated.marker,
+        ...(gatedWrittenAggregates.length > 0 ? { gatedWrittenAggregates } : {}),
+        ...(gatedReadAggregates.length > 0 ? { gatedReadAggregates } : {}),
+        ...(gated.businessPrincipalField !== undefined ? { gatedPrincipalField: gated.businessPrincipalField } : {}),
+        ...(gatedMintField !== undefined ? { gatedMintField } : {}),
+        ...(gatedCreatesAggregate !== undefined ? { gatedAggregateId: gatedCreatesAggregate } : {}),
+        grantDirectiveId: businessBornContext.seatsViaDirectiveId,
+        grantPayload: {},
+        grantAutoStamped: [],
+        grantSubjectFields: [],
+        grantGrantedByFields: [],
+        via: "born-context",
+        bornContext: businessBornContext,
+      };
+    }
+  }
 
   // Find a granter that establishes the actor's authority for the gate relation. Never the gated directive.
   //   (1) DIRECT: a `.grants(R)` marker (unambiguous), ELSE a plan-probed `writeTuple(R)`.
@@ -1520,16 +1466,33 @@ export function discoverRelationBootstrapLeg(mod: DomainModule, gatedOverride?:
   const standaloneClean =
     found !== undefined && !seedSpeculative && !directiveHasPrerequisiteInvariant(mod, found.granter.id);
   if (!standaloneClean) {
-    const bornContext = discoverBornContextAuthority(mod, relation);
+    // The birth may seat a BASE relation which satisfies this computed gate (homeCreator -> homeAdmin), not
+    // the gate's display name itself. Search the same rewrite-aware candidate set used above; the real born
+    // workspace gate remains the final arbiter, so this cannot manufacture authority.
+    let bornAuthorityRelation: string | undefined;
+    let bornContext: BornContextAuthority | undefined;
+    for (const candidate of businessAuthorityRelations) {
+      const discovered = discoverBornContextAuthority(mod, candidate);
+      if (discovered === undefined) continue;
+      bornAuthorityRelation = candidate;
+      bornContext = discovered;
+      break;
+    }
     if (bornContext !== undefined) {
       return {
         domain,
         gatedDirectiveId: gated.id,
         relation,
-        grantedRelation: relation,
+        grantedRelation: bornAuthorityRelation ?? relation,
         gatedPayload,
+        ...(Object.keys(gatedReferenceFields).length > 0 ? { gatedReferenceFields } : {}),
+        ...(gatedOptionalReferenceFields.length > 0 ? { gatedOptionalReferenceFields } : {}),
         gatedAutoStamped: gatedSynth.autoStamped,
-        ...(gatedMintField !== undefined ? { gatedMintField, gatedAggregateId: gated.aggregateId } : {}),
+        gatedMarker: gated.marker,
+        ...(gatedWrittenAggregates.length > 0 ? { gatedWrittenAggregates } : {}),
+        ...(gatedReadAggregates.length > 0 ? { gatedReadAggregates } : {}),
+        ...(gatedMintField !== undefined ? { gatedMintField } : {}),
+        ...(gatedCreatesAggregate !== undefined ? { gatedAggregateId: gatedCreatesAggregate } : {}),
         // grant fields are UNUSED for a born-context leg (the runner births + dispatches inside); populate them
         // with the genesis seed's id / empty payload so the shape stays uniform (never dispatched standalone).
         grantDirectiveId: bornContext.seatsViaDirectiveId,
@@ -1573,11 +1536,12 @@ export function discoverRelationBootstrapLeg(mod: DomainModule, gatedOverride?:
   // any field whose name looks like a subject/grantedBy anyway).
   let grantSynth: SynthesizedPayload;
   try {
-    grantSynth = synthesizePayload(granter.payloadSchema as z.ZodTypeAny, `${domain}/${granter.id}`);
+    grantSynth = synthesizeDirectivePayload(granter, `${domain}/${granter.id}`);
   } catch {
     return undefined;
   }
   const grantPayload: Record<string, unknown> = { ...grantSynth.value };
+  const grantReferenceFields = aggregateReferenceFields(granter.payloadSchema as z.ZodTypeAny);
   const probed = probePlanOps(granter, `${domain}/${granter.id}`);
   const routed = probed !== undefined ? resolveGrantSubjectFields(probed) : { subjectFields: [], grantedByFields: [], wrappedSubjectFields: [] };
 
@@ -1587,10 +1551,18 @@ export function discoverRelationBootstrapLeg(mod: DomainModule, gatedOverride?:
     relation,
     grantedRelation,
     gatedPayload,
+    ...(Object.keys(gatedReferenceFields).length > 0 ? { gatedReferenceFields } : {}),
+    ...(gatedOptionalReferenceFields.length > 0 ? { gatedOptionalReferenceFields } : {}),
     gatedAutoStamped: gatedSynth.autoStamped,
-    ...(gatedMintField !== undefined ? { gatedMintField, gatedAggregateId: gated.aggregateId } : {}),
+    gatedMarker: gated.marker,
+    ...(gatedWrittenAggregates.length > 0 ? { gatedWrittenAggregates } : {}),
+    ...(gatedReadAggregates.length > 0 ? { gatedReadAggregates } : {}),
+    ...(gated.businessPrincipalField !== undefined ? { gatedPrincipalField: gated.businessPrincipalField } : {}),
+    ...(gatedMintField !== undefined ? { gatedMintField } : {}),
+    ...(gatedCreatesAggregate !== undefined ? { gatedAggregateId: gatedCreatesAggregate } : {}),
     grantDirectiveId: granter.id,
     grantPayload,
+    ...(Object.keys(grantReferenceFields).length > 0 ? { grantReferenceFields } : {}),
     grantAutoStamped: grantSynth.autoStamped,
     grantSubjectFields: routed.subjectFields,
     grantGrantedByFields: routed.grantedByFields,
@@ -1604,6 +1576,137 @@ export function discoverRelationBootstrapLeg(mod: DomainModule, gatedOverride?:
   };
 }
 
+/** A principal-bound action has no grant to bootstrap: its authority is the verified application identity
+ * itself. It still needs a real born business workspace and any declared prerequisite records, so represent
+ * it in the same stateful journey shape while marking the identity field explicitly for the runner. */
+function discoverPrincipalBoundLeg(
+  mod: DomainModule,
+  target: Directive<unknown>,
+): RelationBootstrapLeg | undefined {
+  const principalField = target.businessPrincipalField;
+  if (principalField === undefined || target.requiresRelationGate !== undefined) return undefined;
+  const domain = mod.domain ?? mod.name;
+  let synth: SynthesizedPayload;
+  try {
+    synth = synthesizeDirectivePayload(target, `${domain}/${target.id}`);
+  } catch {
+    return undefined;
+  }
+  const birthDirectives = (mod.directives as Directive<unknown>[]).filter(
+    (directive) => directive.birthsChild === true &&
+      (directive as { businessBirth?: { founderRoles?: readonly string[] } }).businessBirth !== undefined,
+  );
+  let bornContext: BornContextAuthority | undefined;
+  for (const birth of birthDirectives) {
+    const roles = (birth as { businessBirth?: { founderRoles?: readonly string[] } }).businessBirth?.founderRoles ?? [];
+    for (const role of roles) {
+      bornContext = discoverBornContextAuthority(mod, role);
+      if (bornContext !== undefined && bornContext.birthDirectiveId === birth.id) break;
+    }
+    if (bornContext !== undefined) break;
+  }
+  if (bornContext === undefined) return undefined;
+
+  const aggregate = (mod.aggregates as AggregateHandle[]).find((candidate) => candidate.id === target.aggregateId);
+  const mintField = aggregate === undefined ? undefined : mintedCreateField(target, aggregate);
+  const payload: Record<string, unknown> = { ...synth.value };
+  if (mintField !== undefined) delete payload[mintField];
+  const referenceFields = aggregateReferenceFields(target.payloadSchema as z.ZodTypeAny);
+  const optionalReferenceFields = optionalAggregateReferenceFields(target.payloadSchema as z.ZodTypeAny);
+  const establishesAggregate = target.marker === "creates" || target.marker === "ensures"
+    ? target.aggregateId
+    : undefined;
+  const writtenAggregates = [...probeWritesAggregateTypes(target, `${domain}/${target.id}`)].sort();
+  const readAggregates = [...new Set(
+    (mod.workspaceInvariants ?? [])
+      .filter((invariant) => invariant.on === target.id)
+      .flatMap((invariant) => [...invariantReadAggregateTypes(invariant)]),
+  )].sort();
+  const preconditionSetups = discoverPreconditionSetups(mod, target);
+  return {
+    domain,
+    gatedDirectiveId: target.id,
+    relation: "currentPrincipal",
+    grantedRelation: "currentPrincipal",
+    gatedPayload: payload,
+    ...(Object.keys(referenceFields).length > 0 ? { gatedReferenceFields: referenceFields } : {}),
+    ...(optionalReferenceFields.length > 0 ? { gatedOptionalReferenceFields: optionalReferenceFields } : {}),
+    gatedAutoStamped: synth.autoStamped,
+    gatedMarker: target.marker,
+    ...(writtenAggregates.length > 0 ? { gatedWrittenAggregates: writtenAggregates } : {}),
+    ...(readAggregates.length > 0 ? { gatedReadAggregates: readAggregates } : {}),
+    gatedPrincipalField: principalField,
+    ...(mintField !== undefined ? { gatedMintField: mintField } : {}),
+    ...(establishesAggregate !== undefined ? { gatedAggregateId: establishesAggregate } : {}),
+    grantDirectiveId: bornContext.seatsViaDirectiveId,
+    grantPayload: {},
+    grantAutoStamped: [],
+    grantSubjectFields: [],
+    grantGrantedByFields: [],
+    via: "born-context",
+    bornContext,
+    ...(preconditionSetups.length > 0 ? { preconditionSetups } : {}),
+  };
+}
+
+/** An ordinary business action may intentionally need no role gate. It is still part of the same generated
+ * stateful application journey: its inputs are typed refs produced by earlier intents, and a business-birth
+ * domain must run it inside that born workspace. Treating it as "not proofable" merely because no authority
+ * ceremony is required left conflict merge policies public but unexecuted. */
+function discoverUnrestrictedBusinessLeg(
+  mod: DomainModule,
+  target: Directive<unknown>,
+  bornContext?: BornContextAuthority,
+): RelationBootstrapLeg | undefined {
+  if (target.requiresRelationGate !== undefined || target.businessPrincipalField !== undefined) return undefined;
+  const domain = mod.domain ?? mod.name;
+  let synth: SynthesizedPayload;
+  try {
+    synth = synthesizeDirectivePayload(target, `${domain}/${target.id}`);
+  } catch {
+    return undefined;
+  }
+  const aggregate = (mod.aggregates as AggregateHandle[]).find((candidate) => candidate.id === target.aggregateId);
+  const mintField = aggregate === undefined ? undefined : mintedCreateField(target, aggregate);
+  const payload: Record<string, unknown> = { ...synth.value };
+  if (mintField !== undefined) delete payload[mintField];
+  const referenceFields = aggregateReferenceFields(target.payloadSchema as z.ZodTypeAny);
+  const optionalReferenceFields = optionalAggregateReferenceFields(target.payloadSchema as z.ZodTypeAny);
+  const establishesAggregate = target.marker === "creates" || target.marker === "ensures"
+    ? target.aggregateId
+    : undefined;
+  const writtenAggregates = [...probeWritesAggregateTypes(target, `${domain}/${target.id}`)].sort();
+  const readAggregates = [...new Set(
+    (mod.workspaceInvariants ?? [])
+      .filter((invariant) => invariant.on === target.id)
+      .flatMap((invariant) => [...invariantReadAggregateTypes(invariant)]),
+  )].sort();
+  const preconditionSetups = discoverPreconditionSetups(mod, target);
+  return {
+    domain,
+    gatedDirectiveId: target.id,
+    relation: "unrestricted",
+    grantedRelation: "unrestricted",
+    gatedPayload: payload,
+    ...(Object.keys(referenceFields).length > 0 ? { gatedReferenceFields: referenceFields } : {}),
+    ...(optionalReferenceFields.length > 0 ? { gatedOptionalReferenceFields: optionalReferenceFields } : {}),
+    gatedAutoStamped: synth.autoStamped,
+    gatedMarker: target.marker,
+    ...(writtenAggregates.length > 0 ? { gatedWrittenAggregates: writtenAggregates } : {}),
+    ...(readAggregates.length > 0 ? { gatedReadAggregates: readAggregates } : {}),
+    ...(mintField !== undefined ? { gatedMintField: mintField } : {}),
+    ...(establishesAggregate !== undefined ? { gatedAggregateId: establishesAggregate } : {}),
+    grantDirectiveId: "",
+    grantPayload: {},
+    grantAutoStamped: [],
+    grantSubjectFields: [],
+    grantGrantedByFields: [],
+    via: bornContext === undefined ? "unrestricted" : "born-context",
+    ...(bornContext === undefined ? {} : { bornContext }),
+    ...(preconditionSetups.length > 0 ? { preconditionSetups } : {}),
+  };
+}
+
 /**
  * MULTI-TARGET relation-bootstrap discovery (co2 ask #2). The singular {@link discoverRelationBootstrapLeg}
  * proves ONE gated create per domain; this runs TARGET-SPECIFIC discovery for EVERY gated create/write, so a
@@ -1613,20 +1716,48 @@ export function discoverRelationBootstrapLeg(mod: DomainModule, gatedOverride?:
  * discoverable path is simply absent from the result (the taxonomy audit then names ONLY the real gaps).
  * De-duplicated by `gatedDirectiveId` (a target proven once is not re-emitted).
  */
-export function discoverRelationBootstrapLegs(mod: DomainModule): RelationBootstrapLeg[] {
+export function discoverRelationBootstrapLegs(
+  mod: DomainModule,
+  unrestrictedBornContext?: BornContextAuthority,
+): RelationBootstrapLeg[] {
   const directives = mod.directives as Directive<unknown>[];
-  const isGatedProvable = (d: Directive<unknown> | undefined): boolean =>
-    d?.requiresRelationGate !== undefined &&
+  const isBusinessJourneyProvable = (d: Directive<unknown> | undefined): boolean =>
+    (d?.requiresRelationGate !== undefined || d?.businessPrincipalField !== undefined || isBusinessIntent(d)) &&
+    !d.id.startsWith("_nms") &&
+    (d as { businessBirthInternal?: unknown }).businessBirthInternal !== true &&
     typeof d.payloadSchema === "object" &&
     d.birthsChild !== true &&
     d.attestationAuthorizedGate === undefined;
   const legs: RelationBootstrapLeg[] = [];
   const seen = new Set<string>();
-  for (const target of directives.filter(isGatedProvable)) {
+  // This is a generated STATEFUL business journey, not a bag of CRUD probes. Establish root records before
+  // actions that consume typed references, and keep framework-generated clear utilities behind authored
+  // business intents. Stable source order is the final tie-breaker.
+  const targets = directives
+    .map((directive, index) => ({ directive, index }))
+    .filter(({ directive }) => isBusinessJourneyProvable(directive))
+    .sort((a, b) => {
+      const authoredA = isBusinessIntent(a.directive) ? 0 : 1;
+      const authoredB = isBusinessIntent(b.directive) ? 0 : 1;
+      // A declared application language is already the tenant's readable business sequence. Preserve that
+      // order among authored intents; only place compiler-generated utilities behind it.
+      if (authoredA === 0 && authoredB === 0) return a.index - b.index;
+      const markerRank = (directive: Directive<unknown>): number =>
+        directive.marker === "creates" ? 0 : directive.marker === "ensures" ? 1 : 2;
+      const refsA = Object.keys(aggregateReferenceFields(a.directive.payloadSchema as z.ZodTypeAny)).length;
+      const refsB = Object.keys(aggregateReferenceFields(b.directive.payloadSchema as z.ZodTypeAny)).length;
+      return authoredA - authoredB || markerRank(a.directive) - markerRank(b.directive) || refsA - refsB || a.index - b.index;
+    })
+    .map(({ directive }) => directive);
+  for (const target of targets) {
     if (seen.has(target.id)) continue;
     let leg: RelationBootstrapLeg | undefined;
     try {
-      leg = discoverRelationBootstrapLeg(mod, target);
+      leg = target.requiresRelationGate !== undefined
+        ? discoverRelationBootstrapLeg(mod, target)
+        : target.businessPrincipalField !== undefined
+          ? discoverPrincipalBoundLeg(mod, target)
+          : discoverUnrestrictedBusinessLeg(mod, target, unrestrictedBornContext);
     } catch {
       leg = undefined;
     }
@@ -1635,7 +1766,97 @@ export function discoverRelationBootstrapLegs(mod: DomainModule): RelationBootst
       seen.add(leg.gatedDirectiveId);
     }
   }
-  return legs;
+
+  // Source order is the readable default, but it cannot override the type system: an action accepting a
+  // NomosRef<T> must run after some generated action has actually established T. Build the smallest stable
+  // dependency graph over the discovered business legs. This is not CRUD ordering; an intent may establish
+  // several aggregates, and every declared/probed output participates as a possible producer.
+  const byId = new Map(directives.map((directive, index) => [directive.id, { directive, index }]));
+  const businessOrder = new Map(legs.map((leg, index) => [leg.gatedDirectiveId, index]));
+  const establishes = new Map<string, Set<string>>();
+  const requiredReferences = new Map<string, Set<string>>();
+  for (const leg of legs) {
+    const directive = byId.get(leg.gatedDirectiveId)?.directive;
+    if (directive === undefined) continue;
+    establishes.set(
+      leg.gatedDirectiveId,
+      probeEstablishesAggregateTypes(directive, `${mod.domain ?? mod.name}/${directive.id}`),
+    );
+    const optional = new Set(leg.gatedOptionalReferenceFields ?? []);
+    requiredReferences.set(
+      leg.gatedDirectiveId,
+      new Set(Object.entries(leg.gatedReferenceFields ?? {})
+        .filter(([field]) => !optional.has(field))
+        .map(([, aggregate]) => aggregate)),
+    );
+  }
+  const dependencies = new Map(legs.map((leg) => [leg.gatedDirectiveId, new Set<string>()]));
+  for (const consumer of legs) {
+    for (const aggregate of requiredReferences.get(consumer.gatedDirectiveId) ?? []) {
+      const candidates = legs
+        .filter((producer) =>
+          producer.gatedDirectiveId !== consumer.gatedDirectiveId &&
+          establishes.get(producer.gatedDirectiveId)?.has(aggregate) === true)
+        .sort((a, b) => {
+          const da = byId.get(a.gatedDirectiveId)!;
+          const db = byId.get(b.gatedDirectiveId)!;
+          const markerRank = (directive: Directive<unknown>): number =>
+            directive.marker === "creates" ? 0 : directive.marker === "ensures" ? 1 : 2;
+          const selfReferenceRank = (leg: RelationBootstrapLeg): number =>
+            requiredReferences.get(leg.gatedDirectiveId)?.has(aggregate) === true ? 1 : 0;
+          return selfReferenceRank(a) - selfReferenceRank(b) ||
+            markerRank(da.directive) - markerRank(db.directive) ||
+            (requiredReferences.get(a.gatedDirectiveId)?.size ?? 0) - (requiredReferences.get(b.gatedDirectiveId)?.size ?? 0) ||
+            (businessOrder.get(a.gatedDirectiveId) ?? da.index) - (businessOrder.get(b.gatedDirectiveId) ?? db.index);
+        });
+      const producer = candidates[0];
+      if (producer !== undefined) dependencies.get(consumer.gatedDirectiveId)!.add(producer.gatedDirectiveId);
+    }
+    const consumerDirective = byId.get(consumer.gatedDirectiveId)?.directive;
+    if (consumerDirective?.marker === "mutates" || consumerDirective?.marker === "archives") {
+      // A deterministic/composite-id mutation often has no explicit NomosRef<T> field: the plan derives its
+      // instance id from ordinary business coordinates (site + feature key, listing + version). It still
+      // cannot precede the action that establishes T. Treat the directive's declared target type as a
+      // dependency whenever the business language exposes a positive creator/ensurer for that type.
+      const targetProducer = legs
+        .filter((candidate) => candidate.gatedDirectiveId !== consumer.gatedDirectiveId)
+        .filter((candidate) => {
+          const candidateDirective = byId.get(candidate.gatedDirectiveId)?.directive;
+          return candidateDirective !== undefined &&
+            (candidateDirective.marker === "creates" || candidateDirective.marker === "ensures") &&
+            establishes.get(candidate.gatedDirectiveId)?.has(consumerDirective.aggregateId) === true;
+        })
+        .sort((left, right) => {
+          const leftDirective = byId.get(left.gatedDirectiveId)!.directive;
+          const rightDirective = byId.get(right.gatedDirectiveId)!.directive;
+          const rank = (directive: Directive<unknown>): number => directive.marker === "creates" ? 0 : 1;
+          return rank(leftDirective) - rank(rightDirective) ||
+            (businessOrder.get(left.gatedDirectiveId) ?? 0) - (businessOrder.get(right.gatedDirectiveId) ?? 0);
+        })[0];
+      if (targetProducer !== undefined) {
+        dependencies.get(consumer.gatedDirectiveId)!.add(targetProducer.gatedDirectiveId);
+      }
+    }
+  }
+  const remaining = new Map(legs.map((leg) => [leg.gatedDirectiveId, leg]));
+  const ordered: RelationBootstrapLeg[] = [];
+  while (remaining.size > 0) {
+    const ready = [...remaining.values()]
+      .filter((leg) => [...(dependencies.get(leg.gatedDirectiveId) ?? [])].every((id) => !remaining.has(id)))
+      .sort((a, b) => (businessOrder.get(a.gatedDirectiveId) ?? 0) - (businessOrder.get(b.gatedDirectiveId) ?? 0));
+    if (ready.length === 0) {
+      // A genuine required-reference cycle cannot be linearized. Preserve the deterministic source suffix;
+      // the proof will name the missing real reference rather than silently dropping business actions.
+      ordered.push(...[...remaining.values()].sort((a, b) =>
+        (businessOrder.get(a.gatedDirectiveId) ?? 0) - (businessOrder.get(b.gatedDirectiveId) ?? 0)));
+      break;
+    }
+    for (const leg of ready) {
+      ordered.push(leg);
+      remaining.delete(leg.gatedDirectiveId);
+    }
+  }
+  return ordered;
 }
 
 /** A discovered layer-3 SEED directive: a sibling (non-gated, non-birth) whose plan writes relation tuples,
@@ -1687,7 +1908,7 @@ export function diagnoseRelationBootstrapGap(mod: DomainModule): string | undefi
     const inv = (mod.workspaceInvariants ?? []).find((i) => i.on === prereqGranter.id);
     return `${domain}/${gated.id} is gated by .requires("${relation}") but the proof cannot seed authority: the only granter of "${relation}" is `
       + `${domain}/${prereqGranter.id}, which carries the prerequisite invariant '${inv?.id ?? "?"}' (it reads state an EARLIER step must establish), so a standalone re-seed FALSE-fails — and no \`.births()\` genesis seats "${relation}" to prove it in a born workspace. `
-      + `Establish "${relation}" via a birth genesis (a \`.births()\` whose chain runs ${prereqGranter.id} after seeding its prerequisite), or prove ${gated.id} by hand. (The negative conformance leg still proves the gate refuses an actorless offer.)`;
+      + `Establish "${relation}" via a birth genesis (a \`.births()\` whose chain runs ${prereqGranter.id} after seeding its prerequisite) so the generator can produce the positive journey. (The negative conformance leg still proves the gate refuses an actorless offer.)`;
   }
   const bases = resolveGrantableBaseRelations(mod.relationTypes, object, relation).filter((b) => b !== relation);
   const tried = bases.length > 0
@@ -1937,7 +2158,7 @@ export function discoverChildBirthLegOrReason(
   let recipe: { workspace?: unknown; genesisChain?: unknown } | undefined;
   let synth: SynthesizedPayload;
   try {
-    synth = synthesizePayload(birthDir.payloadSchema as z.ZodTypeAny, `${parentDomain}/${birthDir.id}`);
+    synth = synthesizeDirectivePayload(birthDir, `${parentDomain}/${birthDir.id}`);
   } catch (e) {
     return { reason: `${who}: the payload could not be synthesized for the compile probe (${(e as Error)?.message ?? e}) — the offline proof needs a sampleable payload (strings/numbers/enums; exotic shapes drop the leg)` };
   }
@@ -2119,7 +2340,7 @@ function discoverSingletonInstanceId(seedDir: Directive<unknown>, ownerMod?: Dom
   const idsFor = (seed: number): string | undefined => {
     let synth: SynthesizedPayload;
     try {
-      synth = synthesizePayload(seedDir.payloadSchema as z.ZodTypeAny, `seed/${seedDir.id}`);
+      synth = synthesizeDirectivePayload(seedDir, `seed/${seedDir.id}`);
     } catch {
       return undefined;
     }
@@ -2190,6 +2411,8 @@ export interface ProofLegs {
   readonly payload?: Record<string, unknown>;
   readonly autoStamped?: readonly string[];
   readonly mintField?: string;
+  /** Hidden owned-record sealing coordinates used by the local product proof. Tenant tests never see them. */
+  readonly ownedEncryption?: ProofOwnedEncryption;
   readonly query?: { readonly id: string; readonly params: Record<string, unknown> };
   readonly count?: { readonly id: string; readonly group: string };
   /** BIRTHS DX DIAGNOSTICS: present when this domain declares ≥1 `.births()` directive whose child-birth
@@ -2215,6 +2438,7 @@ export interface ProofLegs {
     readonly payload: Record<string, unknown>;
     readonly autoStamped: readonly string[];
     readonly mintField?: string;
+    readonly ownedEncryption?: ProofOwnedEncryption;
     readonly query?: { readonly id: string; readonly params: Record<string, unknown> };
     readonly count?: { readonly id: string; readonly group: string };
     readonly spatial?: { readonly id: string };
@@ -2237,12 +2461,20 @@ export interface ProofLegs {
   readonly relationBootstraps?: readonly RelationBootstrapLeg[];
 }
 
+export interface ProofOwnedEncryption {
+  readonly scope: string;
+  readonly recordType: string;
+  readonly fields: Readonly<Record<string, { readonly aggSid: string; readonly fieldSid: string }>>;
+}
+
 /** Synthesize the standalone-create offline legs for one domain module, or `null` when it has no
  *  creating write (nothing to prove standalone — it may still be child-birth-provable / compile-valid).
  *  The SINGLE source of the create-leg selection — `generateTsProof` (the .mts marker) and
  *  `proofLegsIndex` (the per-domain index) both call this, so the offline lane proves any domain the
  *  same way the generated proof proves its primary one. */
-/** A `.creates` directive the proof can DRIVE from a synthesized sample offline WITH NO SEEDED AUTHORITY: not
+/** An ungated `.creates` or `.ensures` directive the proof can DRIVE from a synthesized sample offline WITH
+ * NO SEEDED AUTHORITY. Ensures matter for singleton/upsert business laws: they still return a typed affected
+ * reference and can be reopened through the same generated application journey. Excludes
  *  a `.births()` (a birth is the child-birth lane), not ATTESTATION-AUTHORIZED (needs a signed §3 quote no
  *  synthesizer can produce — e.g. the home law's `recordShare`), and NOT AUTHZ-GATED (`.requires(R)` — a
  *  gated create dispatched with no seeded authority is REFUSED at the gate; its metadata already says it
@@ -2250,7 +2482,9 @@ export interface ProofLegs {
  *  relation-bootstrap leg / the born-child genesis instead). Those are NOT standalone-provable offline; the
  *  domain proves via its bootstrap / child-birth / compile-valid legs instead. */
 function isStandaloneCreate(d: Directive<unknown> | undefined): boolean {
-  return d?.marker === "creates" && typeof d.payloadSchema === "object"
+  return (d?.marker === "creates" ||
+      (d?.marker === "ensures" && isBusinessIntent(d))) &&
+    typeof d.payloadSchema === "object"
     // Framework lifecycle directives are installed in the certified law so the generated client can
     // drive them behind its managed methods, but they are not tenant vocabulary. Selecting one here
     // makes the generated proof call a method that the public generated client correctly does not expose.
@@ -2265,11 +2499,89 @@ function isStandaloneCreate(d: Directive<unknown> | undefined): boolean {
     && (((d as { declaredForeignReads?: readonly unknown[] }).declaredForeignReads?.length ?? 0) === 0);
 }
 
-/** Does this module carry ≥1 foreign-read directive (a static or dynamic-policy `.readsFrom`)? */
-function hasForeignReadDirective(mod: DomainModule): boolean {
-  return (mod.directives as Directive<unknown>[]).some(
-    (d) => ((d as { declaredForeignReads?: readonly unknown[] }).declaredForeignReads?.length ?? 0) > 0,
-  );
+/**
+ * A shape-level Create/Ensure is only a standalone business journey when no declared invariant fires on it.
+ * Invariants are arbitrary policy: even a same-aggregate Ensure may require an earlier state (for example,
+ * accepting an invitation requires that invitation to be pending and the current principal to be its
+ * invitee). Treating the marker as CRUD and dispatching it into an empty workspace is a false proof.
+ * Stateful actions belong in a generated prerequisite journey; until one is synthesized they remain named,
+ * not misclassified as independently provable.
+ */
+function isStandaloneProofSafe(mod: DomainModule, directive: Directive<unknown> | undefined): boolean {
+  return isStandaloneCreate(directive) &&
+    !(mod.workspaceInvariants ?? []).some((invariant) => invariant.on === directive!.id);
+}
+
+/** Prefer the business create which demonstrates the richest typed relationship journey. Its prerequisites
+ * are generated automatically, so a join/create that consumes two NomosRefs is a better canonical example
+ * than an isolated leaf create. Stable source order breaks ties. */
+function orderedStandaloneCreates(mod: DomainModule): Directive<unknown>[] {
+  return (mod.directives as Directive<unknown>[])
+    .map((directive, index) => ({ directive, index }))
+    .filter(({ directive }) => isStandaloneProofSafe(mod, directive))
+    .sort((a, b) => {
+      const refsA = Object.keys(aggregateReferenceFields(a.directive.payloadSchema as z.ZodTypeAny)).length;
+      const refsB = Object.keys(aggregateReferenceFields(b.directive.payloadSchema as z.ZodTypeAny)).length;
+      return refsB - refsA || a.index - b.index;
+    })
+    .map(({ directive }) => directive);
+}
+
+interface ProofReferenceSeed {
+  readonly directive: Directive<unknown>;
+  readonly aggregate: AggregateHandle;
+  readonly payload: Record<string, unknown>;
+  readonly referenceFields: Readonly<Record<string, string>>;
+  readonly mintField?: string;
+}
+
+/** Build the prerequisite-create graph for one generated business action. SQL-style fake foreign keys are
+ * forbidden: if an action needs `NomosRef<A>`, the generated journey first runs an ungated create for A,
+ * retains the returned reference, and only then invokes the action. Cycles and missing creators fail compile
+ * with the business types named instead of leaking a stringly proof. */
+function discoverProofReferenceSeeds(mod: DomainModule, target: Directive<unknown>): ProofReferenceSeed[] {
+  const domain = mod.domain ?? mod.name;
+  const directives = mod.directives as Directive<unknown>[];
+  const aggregates = mod.aggregates as AggregateHandle[];
+  const emitted = new Set<string>();
+  const visiting = new Set<string>();
+  const out: ProofReferenceSeed[] = [];
+
+  const visitType = (aggregateId: string): void => {
+    if (emitted.has(aggregateId)) return;
+    if (visiting.has(aggregateId)) {
+      throw new Error(`codegen-proof: ${domain}/${target.id} has a cyclic typed-reference prerequisite through '${aggregateId}'`);
+    }
+    visiting.add(aggregateId);
+    const directive = directives.find((candidate) =>
+      candidate !== target && candidate.aggregateId === aggregateId && isStandaloneProofSafe(mod, candidate));
+    const aggregate = aggregates.find((candidate) => candidate.id === aggregateId);
+    if (directive === undefined || aggregate === undefined) {
+      throw new Error(
+        `codegen-proof: ${domain}/${target.id} needs NomosRef<${aggregateId}> but the law has no ungated ` +
+          `.creates(${aggregateId}) action from which the generated journey can obtain one`,
+      );
+    }
+    const mintField = mintedCreateField(directive, aggregate);
+    const referenceFields: Record<string, string> = { ...aggregateReferenceFields(directive.payloadSchema as z.ZodTypeAny) };
+    if (mintField !== undefined) delete referenceFields[mintField];
+    for (const prerequisite of Object.values(referenceFields)) visitType(prerequisite);
+    const synth = synthesizeDirectivePayload(directive, `${domain}/${directive.id}`);
+    const payload: Record<string, unknown> = { ...synth.value };
+    if (mintField !== undefined) delete payload[mintField];
+    out.push({ directive, aggregate, payload, referenceFields, ...(mintField !== undefined ? { mintField } : {}) });
+    visiting.delete(aggregateId);
+    emitted.add(aggregateId);
+  };
+
+  const targetReferences = { ...aggregateReferenceFields(target.payloadSchema as z.ZodTypeAny) };
+  const targetAggregate = aggregates.find((aggregate) => aggregate.id === target.aggregateId);
+  const targetMintField = targetAggregate === undefined ? undefined : mintedCreateField(target, targetAggregate);
+  if (targetMintField !== undefined) delete targetReferences[targetMintField];
+  for (const aggregateId of Object.values(targetReferences)) {
+    visitType(aggregateId);
+  }
+  return out;
 }
 
 /** Does `v` carry an RFC 7946 geometry object at `segs` (walked into the composite)? */
@@ -2293,9 +2605,11 @@ function createLegFor(
   mod: DomainModule,
   createDir: Directive<unknown>,
   domain: string,
+  domainInterface?: DomainInterface,
 ): {
   directiveId: string; aggregateId: string; payload: Record<string, unknown>;
   autoStamped: readonly string[]; mintField?: string;
+  ownedEncryption?: ProofOwnedEncryption;
   query?: { id: string; params: Record<string, unknown> };
   count?: { id: string; group: string };
   spatial?: { id: string };
@@ -2303,7 +2617,7 @@ function createLegFor(
   const agg = (mod.aggregates as AggregateHandle[]).find((a) => a.id === createDir.aggregateId);
   if (agg === undefined) return null;
   const where = `${domain}/${createDir.id}`;
-  let synth = synthesizePayload(createDir.payloadSchema as z.ZodTypeAny, where);
+  let synth = synthesizeDirectivePayload(createDir, where);
   const mintField = mintedCreateField(createDir, agg);
 
   // SPATIAL MEMBERSHIP: probe the plan — does the create set the indexed head field with a geometry
@@ -2327,7 +2641,7 @@ function createLegFor(
     let ops = probeWith(synth);
     let matched = spatials.find((sp) => hits(ops, sp));
     if (matched === undefined) {
-      const richer = synthesizePayload(createDir.payloadSchema as z.ZodTypeAny, where, { voIncludeOptional: true });
+      const richer = synthesizeDirectivePayload(createDir, where, { voIncludeOptional: true });
       ops = probeWith(richer);
       matched = spatials.find((sp) => hits(ops, sp));
       if (matched !== undefined) synth = richer; // the geometry-bearing sample becomes the leg's payload
@@ -2343,23 +2657,36 @@ function createLegFor(
   const count = (mod.counts ?? [])
     .map((raw) => finishCount(raw))
     .find((c) => c.of === agg.id && (c as { where?: unknown }).where == null && (c.by == null || baseValue[c.by] !== undefined));
+  const encryption = domainInterface === undefined ? null : domainEncryptionMap(mod, domainInterface);
+  const ownedFields = encryption?.directives[createDir.id];
+  const ownedEncryption = agg.audience?.kind === "owned" && ownedFields !== undefined
+    ? {
+        scope: Object.values(ownedFields)[0]!.scope,
+        recordType: isNamespacedAggregate(agg) ? qualifyReadProjectionType(domain, agg.id) : agg.id,
+        fields: Object.fromEntries(Object.entries(ownedFields).map(([field, slot]) => [
+          field,
+          { aggSid: slot.aggSid, fieldSid: slot.fieldSid },
+        ])),
+      }
+    : undefined;
   return {
     directiveId: createDir.id,
     aggregateId: agg.id,
     payload: baseValue,
     autoStamped: synth.autoStamped,
     ...(mintField !== undefined ? { mintField } : {}),
+    ...(ownedEncryption !== undefined ? { ownedEncryption } : {}),
     ...(query ? { query: { id: query.id, params: Object.fromEntries(query.key.map((k) => [k, baseValue[k]])) } } : {}),
     ...(count ? { count: { id: count.id, group: count.by != null ? String(baseValue[count.by]) : "" } } : {}),
     ...(spatial !== undefined ? { spatial } : {}),
   };
 }
 
-export function proofLegsForModule(mod: DomainModule): ProofLegs | null {
+export function proofLegsForModule(mod: DomainModule, domainInterface?: DomainInterface): ProofLegs | null {
   const domain = mod.domain ?? mod.name;
-  const creates = (mod.directives as Directive<unknown>[]).filter((d) => isStandaloneCreate(d));
+  const creates = orderedStandaloneCreates(mod);
   const legsBuilt = creates
-    .map((d) => { try { return createLegFor(mod, d, domain); } catch { return null; } })
+    .map((d) => { try { return createLegFor(mod, d, domain, domainInterface); } catch { return null; } })
     .filter((l): l is NonNullable<typeof l> => l !== null);
   if (legsBuilt.length === 0) return null;
   const [primary, ...extras] = legsBuilt;
@@ -2422,6 +2749,133 @@ function attachBusinessEncryption(
   };
 }
 
+/** Resolve `.trustsSource(...)` against the package's actual source query and published business language.
+ * The proof recipe contains no raw row seeding: it replays the smallest prefix ending at an action that
+ * establishes the query's returned aggregate. If that business path cannot be found, compilation names the
+ * missing feature instead of generating a target action that can only fail with an opaque attestation error. */
+function attachSourceTrustProofSetup(
+  leg: RelationBootstrapLeg,
+  target: Directive<unknown>,
+  modules: readonly DomainModule[],
+): RelationBootstrapLeg {
+  const trust = target.businessSourceTrust;
+  if (trust === undefined) return leg;
+  const candidates = modules.flatMap((sourceModule) =>
+    ((sourceModule.queries ?? []) as QueryDecl[])
+      .filter((query) => query.id === trust.queryId)
+      .map((query) => ({ sourceModule, query })),
+  );
+  if (candidates.length !== 1) {
+    throw new Error(
+      `${leg.domain}/${leg.gatedDirectiveId}: dynamic source query '${trust.queryId}' resolved to ${candidates.length} package queries; ` +
+        `the generated application needs exactly one source business domain`,
+    );
+  }
+  const { sourceModule, query } = candidates[0]!;
+  const sourceLegs = discoverRelationBootstrapLegs(sourceModule);
+  const sourceDirectives = new Map(
+    (sourceModule.directives as Directive<unknown>[]).map((directive) => [directive.id, directive] as const),
+  );
+  const producerIndex = sourceLegs.findIndex((sourceLeg) => {
+    const directive = sourceDirectives.get(sourceLeg.gatedDirectiveId);
+    return directive !== undefined &&
+      probeEstablishesAggregateTypes(
+        directive,
+        `${sourceModule.domain ?? sourceModule.name}/${directive.id}`,
+      ).has(query.returns);
+  });
+  if (producerIndex < 0) {
+    throw new Error(
+      `${leg.domain}/${leg.gatedDirectiveId}: source query '${trust.queryId}' returns ${query.returns}, but ` +
+        `${sourceModule.domain ?? sourceModule.name} exposes no generated business action that establishes it`,
+    );
+  }
+  const producer = sourceLegs[producerIndex]!;
+  const sourceQueryReturns = new Map(
+    ((sourceModule.queries ?? []) as QueryDecl[]).map((declared) => [declared.id, declared.returns] as const),
+  );
+  // Build the dependency closure, not a source-order prefix. A prefix contains perfectly valid but mutually
+  // exclusive actions (archive before publish, revoke before use) and would turn a business language into one
+  // impossible CRUD script. Dependencies are positive record producers referenced by the action or returned
+  // by its declared reads; born-context roots are already established by the first selected action's birth.
+  const selected = new Set<string>([producer.gatedDirectiveId]);
+  const queue = [producer];
+  while (queue.length > 0) {
+    const consumer = queue.shift()!;
+    const directive = sourceDirectives.get(consumer.gatedDirectiveId);
+    if (directive === undefined) continue;
+    const optionalReferences = new Set(consumer.gatedOptionalReferenceFields ?? []);
+    const neededTypes = new Set([
+      ...Object.entries(consumer.gatedReferenceFields ?? {})
+        .filter(([field]) => !optionalReferences.has(field))
+        .map(([, aggregate]) => aggregate),
+      ...(consumer.gatedDirectiveId === producer.gatedDirectiveId ? (directive.declaredQueryReads ?? []) : []).flatMap((read) => {
+        const returns = sourceQueryReturns.get(read.id);
+        return returns === undefined ? [] : [returns];
+      }),
+    ]);
+    for (const aggregateType of neededTypes) {
+      const alreadySelected = [...selected].some((directiveId) => {
+        if (directiveId === consumer.gatedDirectiveId) return false;
+        const selectedLeg = sourceLegs.find((candidate) => candidate.gatedDirectiveId === directiveId);
+        const selectedDirective = sourceDirectives.get(directiveId);
+        return selectedLeg !== undefined && selectedDirective !== undefined &&
+          (selectedLeg.gatedAggregateId === aggregateType ||
+            probeEstablishesAggregateTypes(
+              selectedDirective,
+              `${sourceModule.domain ?? sourceModule.name}/${selectedDirective.id}`,
+            ).has(aggregateType));
+      });
+      if (alreadySelected) continue;
+      const candidate = sourceLegs
+        .filter((sourceLeg) => sourceLeg.gatedDirectiveId !== consumer.gatedDirectiveId)
+        .map((sourceLeg, index) => ({
+          sourceLeg,
+          index,
+          directive: sourceDirectives.get(sourceLeg.gatedDirectiveId),
+        }))
+        .filter(({ sourceLeg, directive: sourceDirective }) =>
+          sourceDirective !== undefined &&
+          (sourceDirective.marker === "creates" || sourceDirective.marker === "ensures") &&
+          (sourceLeg.gatedAggregateId === aggregateType ||
+            probeEstablishesAggregateTypes(
+              sourceDirective,
+              `${sourceModule.domain ?? sourceModule.name}/${sourceDirective.id}`,
+            ).has(aggregateType)))
+        .sort((left, right) => {
+          const rank = (candidateDirective: Directive<unknown>): number =>
+            candidateDirective.marker === "creates" ? 0 : 1;
+          const primaryRank = (candidate: { sourceLeg: RelationBootstrapLeg }): number =>
+            candidate.sourceLeg.gatedAggregateId === aggregateType ? 0 : 1;
+          return primaryRank(left) - primaryRank(right) ||
+            rank(left.directive!) - rank(right.directive!) ||
+            left.index - right.index;
+        })[0]?.sourceLeg;
+      if (candidate !== undefined && !selected.has(candidate.gatedDirectiveId)) {
+        selected.add(candidate.gatedDirectiveId);
+        queue.push(candidate);
+      }
+    }
+  }
+  const sourceJourney = sourceLegs
+    .filter((sourceLeg) => selected.has(sourceLeg.gatedDirectiveId))
+    .sort((left, right) => {
+      if (left.gatedDirectiveId === producer.gatedDirectiveId) return 1;
+      if (right.gatedDirectiveId === producer.gatedDirectiveId) return -1;
+      return sourceLegs.indexOf(left) - sourceLegs.indexOf(right);
+    });
+  return {
+    ...leg,
+    sourceTrust: {
+      ...trust,
+      sourceDomain: sourceModule.domain ?? sourceModule.name,
+      sourceAggregateId: query.returns,
+      sourceQueryKey: [...query.key],
+      sourceJourney,
+    },
+  };
+}
+
 /** Build the legs for ONE domain module — every leg it carries (compile-valid always; standalone-provable
  *  when it has a `.creates`; child-birth-provable when it has a `.births()`). NEVER null: every compiled
  *  domain is at least `compile-valid` (gaps 1+3 — every domain is proof-addressable). */
@@ -2430,6 +2884,7 @@ export function legsForDomain(
   modules: readonly DomainModule[],
   packageInterface?: Readonly<Record<string, DomainInterface>>,
 ): ProofLegs {
+  const executableLaw = mod;
   // Business-birth control declarations are proofed as part of the birth's child genesis, not as
   // tenant-authored standalone/gated actions. Keep the full `modules` below for recipe resolution while
   // removing the presentation-only internals from leg selection and diagnostics.
@@ -2446,7 +2901,7 @@ export function legsForDomain(
   // child-birth-provable), never loses the index.
   let standalone: ProofLegs | null = null;
   try {
-    standalone = proofLegsForModule(mod);
+    standalone = proofLegsForModule(mod, packageInterface?.[domain]);
   } catch {
     standalone = null;
   }
@@ -2487,7 +2942,29 @@ export function legsForDomain(
   // MULTI-TARGET (co2 #2): discover one authority leg per gated create/write, not just the first.
   let relationBootstraps: RelationBootstrapLeg[] = [];
   try {
-    relationBootstraps = discoverRelationBootstrapLegs(mod);
+    const publicDirectiveIds = new Set(
+      (mod.directives as Directive<unknown>[]).map((directive) => directive.id),
+    );
+    const executableById = new Map(
+      (executableLaw.directives as Directive<unknown>[]).map((directive) => [directive.id, directive] as const),
+    );
+    const unrestrictedBornContext: BornContextAuthority | undefined = childBirthWithSetup === undefined
+      ? undefined
+      : {
+          birthDirectiveId: childBirthWithSetup.birthDirectiveId,
+          birthPayload: childBirthWithSetup.birthPayload,
+          birthAutoStamped: childBirthWithSetup.birthAutoStamped,
+          ...(childBirthWithSetup.birthActorField === undefined ? {} : { ownerField: childBirthWithSetup.birthActorField }),
+          ...(childBirthWithSetup.frameworkHashField === undefined ? {} : { frameworkHashField: childBirthWithSetup.frameworkHashField }),
+          ...(childBirthWithSetup.lawHashField === undefined ? {} : { lawHashField: childBirthWithSetup.lawHashField }),
+          seatsViaDirectiveId: childBirthWithSetup.childSeedDirectiveId ?? "business birth",
+        };
+    relationBootstraps = discoverRelationBootstrapLegs(executableLaw, unrestrictedBornContext)
+      .filter((leg) => publicDirectiveIds.has(leg.gatedDirectiveId))
+      .map((leg) => {
+        const target = executableById.get(leg.gatedDirectiveId);
+        return target === undefined ? leg : attachSourceTrustProofSetup(leg, target, modules);
+      });
   } catch {
     relationBootstraps = [];
   }
@@ -2508,19 +2985,42 @@ export function legsForDomain(
     for (const issue of r.leg?.recipeIssues ?? []) birthDiagnostics.push(`${domain}/${d.id}: ${issue}`);
   }
 
-  // PROOF TAXONOMY AUDIT (co2 ask: every creating directive is PROVEN or NAMED-WHY). Walk every `.creates`
-  // directive; if it is NOT represented by a proven leg, say exactly why — the synthesis failure names the
-  // EXACT unsampleable field path; an attestation/gated create names the lane that DOES prove it.
+  // PROOF TAXONOMY AUDIT. Every PUBLIC business action is executable proof, not merely emitted TypeScript.
+  // This deliberately includes `.ensures` and mutations: silently dropping an unsampleable ensure leaves a
+  // later typed-ref consumer with no producer and turns the framework's omission into an opaque tenant error.
+  // Internal effects remain implementation detail; their published intent is the unit we promise and prove.
   const proofDiagnostics: string[] = [];
-  const provenCreateIds = new Set<string>();
+  const provenDirectiveIds = new Set<string>();
   if (standalone !== null) {
-    if (standalone.directiveId !== undefined) provenCreateIds.add(standalone.directiveId);
-    for (const ec of standalone.extraCreates ?? []) provenCreateIds.add(ec.directiveId);
+    if (standalone.directiveId !== undefined) provenDirectiveIds.add(standalone.directiveId);
+    for (const ec of standalone.extraCreates ?? []) provenDirectiveIds.add(ec.directiveId);
+  }
+  for (const rb of relationBootstraps) provenDirectiveIds.add(rb.gatedDirectiveId);
+  for (const birth of childBirths) provenDirectiveIds.add(birth.birthDirectiveId);
+
+  const publishedIntentIds = new Set((mod.applicationIntents ?? []).map((intent) => intent.id));
+  const diagnosedDirectiveIds = new Set<string>();
+  for (const d of mod.directives as Directive<unknown>[]) {
+    if (!publishedIntentIds.has(d.id) || provenDirectiveIds.has(d.id)) continue;
+    const who = `${domain}/${d.id}`;
+    try {
+      synthesizeDirectivePayload(d, who);
+      proofDiagnostics.push(
+        `${who}: public business action has no generated executable proof — fix its authority, prerequisite, or journey dependency; Nomos will not publish an unexercised tenant method`,
+      );
+    } catch (e) {
+      proofDiagnostics.push(
+        `${who}: public business action could not be generated as an executable example — ${(e as Error)?.message ?? e}`,
+      );
+    }
+    diagnosedDirectiveIds.add(d.id);
   }
-  for (const rb of relationBootstraps) provenCreateIds.add(rb.gatedDirectiveId);
+
+  // Retain the lower-level law audit for raw `.creates` effects that are not part of an application language.
+  // Those are framework/law diagnostics; public actions above are a hard executable-surface promise.
   for (const d of mod.directives as Directive<unknown>[]) {
     if (d?.marker !== "creates" || typeof d.payloadSchema !== "object" || d.birthsChild === true) continue;
-    if (provenCreateIds.has(d.id)) continue; // proven by some leg — nothing to name
+    if (provenDirectiveIds.has(d.id) || diagnosedDirectiveIds.has(d.id)) continue;
     const who = `${domain}/${d.id}`;
     if (d.attestationAuthorizedGate !== undefined) {
       proofDiagnostics.push(
@@ -2532,15 +3032,22 @@ export function legsForDomain(
       // A gated create with no discoverable authority path (else it would be in provenCreateIds via the
       // relation-bootstrap leg) — name the exact seeding gap (the negative conformance leg still proves the gate).
       const gap = diagnoseRelationBootstrapGap(mod);
-      proofDiagnostics.push(gap ?? `${who}: creates ${d.aggregateId} gated by .requires("${d.requiresRelationGate.relation}") — no seedable authority path found; prove it by hand or expose a granter/seed`);
+      proofDiagnostics.push(gap ?? `${who}: creates ${d.aggregateId} gated by .requires("${d.requiresRelationGate.relation}") — no seedable authority path found; expose the business granter/seed so the generated journey can prove it`);
+      continue;
+    }
+    const governingInvariants = (mod.workspaceInvariants ?? []).filter((invariant) => invariant.on === d.id);
+    if (governingInvariants.length > 0) {
+      proofDiagnostics.push(
+        `${who}: creates ${d.aggregateId} under declared policy ${governingInvariants.map((invariant) => `'${invariant.id}'`).join(", ")} — it is state-dependent, so the generator will not pretend it is a standalone CRUD write; add or generate the prerequisite business journey`,
+      );
       continue;
     }
     // An UNGATED standalone create that still isn't proven ⇒ its payload could not be synthesized. Re-run the
     // synthesis to capture the exact-path reason (createLegFor swallowed it to keep the index resilient).
     try {
-      synthesizePayload(d.payloadSchema as z.ZodTypeAny, who);
+      synthesizeDirectivePayload(d, who);
       // Synthesis succeeded but the leg was still dropped (e.g. the aggregate isn't composed) — name that.
-      proofDiagnostics.push(`${who}: creates ${d.aggregateId} but no offline leg was built (its aggregate '${d.aggregateId}' is not composed in this package, or its create-leg probe failed) — prove it by hand in test/e2e.mts`);
+      proofDiagnostics.push(`${who}: creates ${d.aggregateId} but no generated leg was built (its aggregate '${d.aggregateId}' is not composed in this package, or its create-leg probe failed) — fix the law/generator mismatch; there is no handwritten client-proof lane`);
     } catch (e) {
       proofDiagnostics.push(`${who}: creates ${d.aggregateId} but its payload could not be synthesized for the offline proof — ${(e as Error)?.message ?? e}`);
     }
@@ -2558,6 +3065,7 @@ export function legsForDomain(
           payload: standalone.payload,
           autoStamped: standalone.autoStamped,
           ...(standalone.mintField !== undefined ? { mintField: standalone.mintField } : {}),
+          ...(standalone.ownedEncryption !== undefined ? { ownedEncryption: standalone.ownedEncryption } : {}),
           ...(standalone.query !== undefined ? { query: standalone.query } : {}),
           ...(standalone.count !== undefined ? { count: standalone.count } : {}),
           ...(standalone.spatial !== undefined ? { spatial: standalone.spatial } : {}),
@@ -2615,378 +3123,210 @@ export function proofLegsIndex(
   return { default: def, domains };
 }
 
-// ── shared `.mts` fragments (the v2 contract — G1: no host secret; deploy is OPEN + kernel-gated) ─────────
-
-/**
- * THE LIVE PREAMBLE: `githolon proof --live` has already established the signed session home and deployed
- * this package into it. Generated proof code receives only that ready session and drives the application verb.
- * The old raw create/deploy lane was a second product model and could only create registry/custody orphans.
- */
-function v2IdentityAndCleanupPreamble(opts: TsProofOptions, hashConst: string, n: () => number): string[] {
-  void opts;
-  void hashConst;
-  return [
-    `// Nomos prepared an isolated signed application workspace and installed the package before entering generated application code.`,
-    `// The application proof supplies business facts only; identity/custody/law selection stay underneath.`,
-    `const fail: (m: string) => never = (m) => { throw new Error(m); };`,
-    `const ok = (m: string) => console.log("✓ " + m);`,
-    `const PRINCIPAL = process.env.NOMOS_PRINCIPAL || "githolon-proof";`,
-    `const AUTHOR_SECRET = process.env.NOMOS_AUTHOR_SECRET || "";`,
-    ``,
-    `let d: any;`,
-    `let runError: unknown = null;`,
-    `try {`,
-    ``,
-    `// ${n()}. the one managed entry: an isolated application beneath the logged-in user's durable Nomos home`,
-    `if (process.env.NOMOS_PROOF_MANAGED !== "1" || !AUTHOR_SECRET) fail("run this cloud proof through: githolon proof --live");`,
-    `ok(\`Nomos application ready — \${WS}\`);`,
-  ];
-}
-
-/**
- * The generated cloud proof only owns its application call. Its durable signed home is framework state,
- * so there is no parallel throwaway-provisioning or cleanup protocol to expose here.
- */
-function v2CatchFinally(): string[] {
-  return [
-    `} catch (e) {`,
-    `  runError = e;`,
-    `  console.error("✗ " + ((e as Error)?.message ?? e));`,
-    `} finally {`,
-    `  process.exit(runError ? 1 : 0);`,
-    `}`,
-  ];
-}
-
-/**
- * THE LIVE CHILD-BIRTH LEG (G3, gap 2): drive the parent `.births()` directive against the cloud workspace,
- * then read the BORN CHILD workspace it spawned (the kernel's offer-effect installs the child law in-chain +
- * folds the child genesis through the child's OWN gate). Verifies the child came up BORN (its read model has
- * the seeded record) — the cloud's offer response surfaces `born: [{workspace, head}]`. The frameworkHash +
- * lawHash are injected from the deployed law (the child install resolves bytes by hash from the parent's
- * custody; a `sample-*` hash would fail). The dispatch rides the gateway offer lane (authenticated principal).
- */
-/**
- * THE LIVE AUTHORITY-CHAIN SEATING for a GATED `.births()` leg (the co2 case). A birth gated by
- * `.requires(R)` needs its actor to HOLD R before the birth admits — and R may itself be reachable only
- * through a RECURSIVE chain of grants (co2: seedPlatformFounder → seedPlatformAdmin [grants co2Admin] →
- * grantCo2EstateCreator [grants co2EstateCreator] → birthEstateWorkspace). This walks the discovered
- * `relationSetup` chain and emits each step as a cloud dispatch under the SAME `birthActor`, seating every
- * relation ON that actor (subject/founder/grantedBy fields overwritten to it) — so one actor plays founder,
- * admin, and creator, ending holding R. Recurses granter-authority-first (deepest prerequisite runs first).
- * `actorVar`/`wsVar` are the runtime var names the birth leg already binds.
- */
-function liveAuthorityChainLines(setup: RelationBootstrapLeg, actorVar: string, wsVar: string): string[] {
-  const lines: string[] = [];
-  // 1. the granter's OWN authority first (recursive — the deepest prerequisite is seated before its dependents).
-  if (setup.granterAuthority !== undefined) {
-    lines.push(...liveAuthorityChainLines(setup.granterAuthority, actorVar, wsVar));
-  }
-  // A runtime dispatch: build the payload literal, overwrite subject/founder/grantedBy/routed fields to the
-  // actor (seat the relation ON it), stamp the auto-stamped fields, POST to the parent ws as the actor.
-  const dispatch = (
-    directiveId: string,
-    payload: Record<string, unknown>,
-    routed: readonly string[],
-    autoStamped: readonly string[],
-    label: string,
-  ): string[] => {
-    const overwrite = new Set<string>(routed);
-    const entries = Object.entries(payload).map(([k, v]) =>
-      overwrite.has(k) || /^(subject|principal|grantedBy|grantee|member|user|owner|founder)$/i.test(k)
-        ? `${JSON.stringify(k)}: ${actorVar}`
-        : `${JSON.stringify(k)}: ${JSON.stringify(v)}`,
-    );
-    return [
-      `  {`,
-      `    const cp: Record<string, unknown> = { ${entries.join(", ")} };`,
-      ...autoStamped.map((f) => `    cp[${JSON.stringify(f)}] = new Date().toISOString();`),
-      `    const cr = await fetch(\`\${CLOUD}/v2/workspaces/\${${wsVar}}/${directiveId}\`, { method: "POST", headers: { "content-type": "application/json", "x-nomos-principal": ${actorVar} }, body: JSON.stringify(cp) });`,
-      `    const cd = await cr.json();`,
-      `    if (!cd.ok) fail(\`authority chain (${label}) ${directiveId} refused: \${JSON.stringify(cd)}\`);`,
-      `    ok(\`authority chain — ${directiveId} seated (as \${${actorVar}})\`);`,
-      `  }`,
-    ];
-  };
-  // 2. this leg's prerequisite seeds (as the actor = founder).
-  for (const seed of setup.prerequisiteSeeds ?? []) {
-    lines.push(...dispatch(seed.directiveId, seed.payload, [], seed.autoStamped, "prerequisite"));
-  }
-  // 3. the grant that seats this leg's relation ON the actor (subject = actor).
-  lines.push(
-    ...dispatch(
-      setup.grantDirectiveId,
-      setup.grantPayload,
-      [...setup.grantSubjectFields, ...setup.grantGrantedByFields],
-      setup.grantAutoStamped,
-      "grant",
-    ),
-  );
-  return lines;
-}
-
-function liveBusinessBirthLegLines(cb: ChildBirthLeg, factory: string, n: () => number): string[] {
-  const businessPayload = Object.fromEntries(
-    Object.entries(cb.birthPayload).filter(([field]) => !["principal", "bornAt", "ownerKeyHash", "birthCert"].includes(field)),
-  );
-  return [
-    `// ${n()}. THE APPLICATION SURFACE: one generated business birth`,
-    `{`,
-    `  const holon = await connect({ cloud: CLOUD, workspace: WS, clientId: "business-birth-proof", principal: PRINCIPAL, authorSecret: AUTHOR_SECRET });`,
-    `  const app = ${factory}(holon, { actor: PRINCIPAL });`,
-    `  const facts: Record<string, unknown> = ${JSON.stringify(businessPayload)};`,
-    `  const run = Date.now().toString(36) + Math.random().toString(36).slice(2, 8);`,
-    `  for (const [field, value] of Object.entries(facts)) {`,
-    `    if (typeof value === "string" && value.startsWith("sample-") && value.length > 7) {`,
-    `      facts[field] = ("sample-" + run).slice(0, value.length);`,
-    `    }`,
-    `  }`,
-    `  const born = await app.birth(facts as never);`,
-    `  const childWs = born.workspace;`,
-    `  if (!childWs) fail("app.birth committed without returning the born workspace");`,
-    `  ok(\`app.birth(${cb.businessAggregateId}) — business facts became \${childWs}\`);`,
-    `  ok("identity, provenance, persistence and recovery verified before app.birth resolved");`,
-    ...(cb.childSeedInstanceId !== undefined
-      ? [
-          `  const restored = await fetch(\`\${CLOUD}/v2/workspaces/\${childWs}/aggregates/\${encodeURIComponent(${JSON.stringify(cb.childSeedInstanceId)})}\`).then((r) => r.json());`,
-          `  if (!(restored.rows?.length >= 1)) fail(\`recovered ${cb.businessAggregateId} has no business root: \${JSON.stringify(restored)}\`);`,
-          `  ok("business root read back from durable custody");`,
-        ]
-      : []),
-    `}`,
-    ``,
-  ];
-}
-
-function liveChildBirthLegLines(cb: ChildBirthLeg, opts: TsProofOptions, n: () => number): string[] {
-  const hashConst = tsHashConstName(opts.packageName);
-  // The birth payload literal: the synthesized values + the REAL hashes onto the discovered fields + the
-  // auto-stamped `…At` fields stamped now.
-  const lines: string[] = [];
-  const setup = cb.parentSetup;
-  const actorExpr = (field: string | undefined, payloadVar: string): string | undefined =>
-    field !== undefined ? `String(${payloadVar}[${JSON.stringify(field)}] ?? "")` : undefined;
-  const birthActorExpr = actorExpr(cb.birthActorField, "birthPayload");
-  lines.push(
-    `// ${n()}. CHILD BIRTH (G3 — birth is the defined consequence of an offer): drive \`${cb.parentDomain}/${cb.birthDirectiveId}\``,
-    `//    against the cloud; the kernel's offer-effect installs the child law in-chain + folds the child's`,
-    `//    genesis (estate/${cb.childSeedDirectiveId}) through the CHILD's own gate, then BORNS the child workspace.`,
-    `{`,
-    `  const frameworkHashFor = async (workspace: string) => {`,
-    `    const st = await (await fetch(\`\${CLOUD}/v2/workspaces/\${workspace}\`)).json().catch(() => ({}));`,
-    `    const frameworkHash = st.controller?.domainHash ?? st.controllerHash ?? "";`,
-    `    if (!frameworkHash) fail(\`could not resolve the framework controller hash from workspace \${workspace} — needed for the child's in-chain installDomain\`);`,
-    `    return frameworkHash;`,
-    `  };`,
-    `  const birthPayload: Record<string, unknown> = { ...${JSON.stringify(cb.birthPayload)} };`,
-    ...(
-      birthActorExpr !== undefined && cb.birthRequiresRelation !== undefined
-        ? [
-            `  const birthActor = ${birthActorExpr};`,
-            `  if (!birthActor) fail(${JSON.stringify(`child birth ${cb.parentDomain}/${cb.birthDirectiveId} is gated by .requires("${cb.birthRequiresRelation}") but the proof could not derive an actor from ${cb.birthActorField}`)});`,
-          ]
-        : [
-            `  const birthActor = PRINCIPAL;`,
-          ]
-    ),
-    ...(setup !== undefined
-      ? [
-          `  // Parent setup: this child birth is gated by authority seeded when the parent workspace is born.`,
-          `  const setupPayload: Record<string, unknown> = { ...${JSON.stringify(setup.birthPayload)} };`,
-          ...(setup.birthActorField !== undefined && cb.birthActorField !== undefined
-            ? [`  setupPayload[${JSON.stringify(setup.birthActorField)}] = birthPayload[${JSON.stringify(cb.birthActorField)}];`]
-            : []),
-          ...(setup.frameworkHashField !== undefined ? [`  setupPayload[${JSON.stringify(setup.frameworkHashField)}] = await frameworkHashFor(WS);`] : []),
-          ...(setup.lawHashField !== undefined ? [`  setupPayload[${JSON.stringify(setup.lawHashField)}] = ${hashConst};`] : []),
-          ...setup.birthAutoStamped.map((f) => `  setupPayload[${JSON.stringify(f)}] = new Date().toISOString();`),
-          `  const setupActor = ${actorExpr(setup.birthActorField, "setupPayload") ?? "birthActor"} || birthActor;`,
-          `  const sr = await fetch(\`\${CLOUD}/v2/workspaces/\${WS}/${setup.birthDirectiveId}\`, { method: "POST", headers: { "content-type": "application/json", "x-nomos-principal": setupActor }, body: JSON.stringify(setupPayload) });`,
-          `  const sd = await sr.json();`,
-          `  if (!sd.ok) fail(\`parent setup ${setup.parentDomain}/${setup.birthDirectiveId} refused: \${JSON.stringify(sd)}\`);`,
-          `  const setupBorn: Array<{ workspace?: string }> = sd.born ?? [];`,
-          `  const birthParentWs = setupBorn[0]?.workspace;`,
-          `  if (!birthParentWs) fail(\`parent setup admitted but spawned no workspace (born=\${JSON.stringify(setupBorn)})\`);`,
-          `  ok(\`parent setup — \${birthParentWs} born by ${setup.parentDomain}/${setup.birthDirectiveId} before gated child birth\`);`,
-        ]
-      : [
-          `  const birthParentWs = WS;`,
-        ]),
-    ...(cb.frameworkHashField !== undefined
-      ? [
-          `  // The framework CONTROLLER hash (the bootstrap install-target the child runs as intent 0) — read it`,
-          `  // from the workspace's own status (the kernel's controllerHash); the child install resolves the bytes`,
-          `  // by hash from the parent's custody, so this MUST be the real framework hash (a guess would fail).`,
-          `  birthPayload[${JSON.stringify(cb.frameworkHashField)}] = await frameworkHashFor(birthParentWs);`,
-        ]
-      : []),
-    `  birthPayload[${JSON.stringify(cb.lawHashField ?? "lawHash")}] = ${hashConst};`,
-    ...cb.birthAutoStamped.map((f) => `  birthPayload[${JSON.stringify(f)}] = new Date().toISOString();`),
-    // GATED BIRTH: seat the FULL authority chain on birthActor before the birth (co2: seedPlatformFounder →
-    // seedPlatformAdmin → grantCo2EstateCreator → the birth). Without this the .requires(R) birth is refused.
-    ...(cb.relationSetup !== undefined
-      ? [
-          `  // seat the .requires("${cb.birthRequiresRelation}") authority chain on birthActor before the gated birth:`,
-          ...liveAuthorityChainLines(cb.relationSetup, "birthActor", "birthParentWs"),
-        ]
-      : []),
-    `  const br = await fetch(\`\${CLOUD}/v2/workspaces/\${birthParentWs}/${cb.birthDirectiveId}\`, { method: "POST", headers: { "content-type": "application/json", "x-nomos-principal": birthActor }, body: JSON.stringify(birthPayload) });`,
-    `  const bd = await br.json();`,
-    `  if (!bd.ok) fail(\`child birth offer ${cb.parentDomain}/${cb.birthDirectiveId} refused: \${JSON.stringify(bd)}\`);`,
-    `  const born: Array<{ workspace?: string }> = bd.born ?? [];`,
-    `  const childWs = born[0]?.workspace;`,
-    `  if (!childWs) fail(\`birth admitted but the offer-effect spawned no child (born=\${JSON.stringify(born)})\`);`,
-    `  ok(\`child birth — \${childWs} born by ${cb.parentDomain}/${cb.birthDirectiveId} (the offer-effect installed the child law + folded its genesis)\`);`,
-    `  // The BORN child runs its OWN law: read the seeded ${cb.childSeedAggregateId ?? "record"} back from the child workspace.`,
-    ...(cb.childSeedInstanceId !== undefined
-      ? [
-          `  const cr = await fetch(\`\${CLOUD}/v2/workspaces/\${childWs}/aggregates/\${encodeURIComponent(${JSON.stringify(cb.childSeedInstanceId)})}\`).then((x) => x.json()).catch(() => ({}));`,
-          `  if (!(cr.rows?.length >= 1)) fail(\`the born child did not seed ${cb.childSeedAggregateId ?? "its record"} (${cb.childSeedInstanceId}): \${JSON.stringify(cr)}\`);`,
-          `  ok(\`the born child's read model has the genesis seed — ${cb.childSeedDirectiveId} ran inside \${childWs}\`);`,
-        ]
-      : cb.childQuery !== undefined
-        ? [
-            `  const cr = await fetch(\`\${CLOUD}/v2/workspaces/\${childWs}/${cb.childQuery.id}?${cb.childQuery.key.map((k) => `${encodeURIComponent(k)}=\${encodeURIComponent(String(birthPayload[${JSON.stringify(k)}] ?? ""))}`).join("&")}\`).then((x) => x.json()).catch(() => ({}));`,
-            `  if (!(cr.ok && cr.rows?.length >= 1)) fail(\`the born child's declared query ${cb.childQuery.id} returned nothing: \${JSON.stringify(cr)}\`);`,
-            `  ok(\`the born child's declared query ${cb.childQuery.id} returns the genesis seed — ${cb.childSeedDirectiveId} ran inside \${childWs}\`);`,
-          ]
-        : [
-            `  ok(\`the child \${childWs} is born (no declared read on its seed aggregate — declare a query to read it back)\`);`,
-          ]),
-    `}`,
-    ``,
-  );
-  return lines;
-}
-
 /**
- * THE BIRTH-ONLY PROOF (gap 2): a package whose primary write is a `.births()` directive (no standalone
- * create — the home/estate composable shape). Deploy the parent law, drive the birth, verify the born child.
- * (The offline runner proves the same legs LOCALLY on the vendored wasm — that is the default `githolon
- * proof` lane; this `.mts` is the live `--live` lane.)
+ * The generated file is application documentation, not a kernel conformance harness. Deep authority,
+ * relation, birth-recipe and concurrency legs remain in the metadata-driven local proof runner; the live
+ * TypeScript story uses only the same generated application object tenant code receives.
  */
-function generateBirthOnlyProof(
+function generateSealedApplicationProof(
   mod: DomainModule,
-  modules: readonly DomainModule[],
   opts: TsProofOptions,
   primaryLegs: ProofLegs,
 ): string {
-  void modules;
   const domain = mod.domain ?? mod.name;
-  const factory = tsClientFactoryName(domain);
-  const hashConst = tsHashConstName(opts.packageName);
-  const cb = primaryLegs.childBirth;
-  if (cb === undefined) {
-    throw new Error(
-      `domain '${domain}' has a .births() directive but its child-birth leg could not be discovered (the plan did not record a leaf genesis recipe: bootstrap/installDomain → nomos/installDomain → <child>/<seed>) — prove it by hand in test/e2e.mts`,
-    );
-  }
-  const slug =
-    opts.packageName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 24) || "domain";
-  const legsMarker = JSON.stringify(primaryLegs);
-  let step = 0;
-  const n = () => ++step;
-  const out: string[] = [];
-  out.push(
-    `// AUTO-GENERATED by nomos-compile — the RUNNABLE PROOF for package "${opts.packageName}",`,
-    `// synthesized from the domain's OWN law. This package's primary write is a BIRTH (a .births()`,
-    `// directive), so the proof drives the birth end-to-end into the BORN child. Reshape the law,`,
-    `// recompile, and this proof reshapes itself — no test rewriting. Run it:`,
-    `//`,
-    `//   npx githolon proof        (offline legs on a local holon)`,
-    `//   npx githolon proof --live (the same application proof in durable Nomos custody)`,
-    `//`,
-    `// Regenerated on every compile; do not edit.`,
-    `// @nomos-proof-legs ${legsMarker}`,
-    `import { connect, encodeIntentOfferBytes } from "@githolon/client";`,
-    `import { ${factory}, ${hashConst} } from "./${opts.packageName}.client.ts";`,
-    `void connect; void encodeIntentOfferBytes; void ${factory};`,
-    ``,
-    `const CLOUD = (process.env.NOMOS_CLOUD || "https://nomos.captainapp.co.uk").replace(/\\/+$/, "");`,
-    `const WS = process.env.NOMOS_WS || ${JSON.stringify(slug + "-proof-")} + Math.random().toString(36).slice(2, 8);`,
-    ``,
-    ...v2IdentityAndCleanupPreamble(opts, hashConst, n),
-    ``,
-    ...(cb.businessAggregateId !== undefined
-      ? liveBusinessBirthLegLines(cb, factory, n)
-      : liveChildBirthLegLines(cb, opts, n)),
-    // THE RELATION-BOOTSTRAP LEG (incl. LAYER 4 born-context): a birth-only domain may ALSO carry a gated
-    // non-birth directive whose authority is established by the birth genesis (co2 home's updateHomeProfile
-    // via birthHome→seedHomeCreator). Emit it so the birth-only proof names it (the born-context proof itself
-    // runs in the offline `githolon proof` lane). No-op when the domain has no gated directive.
-    ...relationSeedLegsLines(primaryLegs, factory, n, diagnoseRelationBootstrapGap(mod)),
-    `console.log(\`\\nALL GREEN — generated proof for "${opts.packageName}": deploy → child birth (\${WS} → the born child) → verified\`);`,
+  const applicationName = tsApplicationName(opts.packageName);
+  const opener = `open${applicationName}`;
+  const marker = JSON.stringify(primaryLegs);
+  const standalone = orderedStandaloneCreates(mod)[0];
+  const businessBirth = primaryLegs.childBirth?.businessAggregateId !== undefined
+    ? primaryLegs.childBirth
+    : undefined;
+  const businessBirthFollowup = businessBirth === undefined
+    ? undefined
+    : (mod.applicationIntents ?? mod.directives).flatMap((candidate) => {
+        const directive = candidate as Directive<unknown>;
+        if (
+          (directive as { businessBirthInternal?: unknown }).businessBirthInternal === true ||
+          (directive as { businessBirth?: unknown }).businessBirth !== undefined ||
+          (directive as { birthsChild?: unknown }).birthsChild === true ||
+          typeof directive.id !== "string" ||
+          typeof directive.aggregateId !== "string" ||
+          Object.keys(aggregateReferenceFields(directive.payloadSchema as z.ZodTypeAny)).length > 0
+        ) return [];
+        const target = (mod.aggregates as AggregateHandle[]).find((aggregate) => aggregate.id === directive.aggregateId);
+        if (target === undefined) return [];
+        try {
+          const synth = synthesizeDirectivePayload(directive, `${domain}/${directive.id}`);
+          const payload = { ...synth.value };
+          const mintField = mintedCreateField(directive, target);
+          if (mintField !== undefined) delete payload[mintField];
+          return [{ directive, target, payload }];
+        } catch {
+          return [];
+        }
+      })[0];
+  const gated = standalone === undefined && businessBirth === undefined && primaryLegs.relationBootstrap !== undefined
+    ? (mod.directives as Directive<unknown>[]).find((directive) => directive.id === primaryLegs.relationBootstrap!.gatedDirectiveId)
+    : undefined;
+  const action = standalone ?? gated;
+  const aggregate = action === undefined
+    ? undefined
+    : (mod.aggregates as AggregateHandle[]).find((candidate) => candidate.id === action.aggregateId);
+  const referenceSeeds = action === undefined ? [] : discoverProofReferenceSeeds(mod, action);
+  const referenceTypes = [...new Set([
+    ...(aggregate === undefined ? [] : [aggregate.id]),
+    ...referenceSeeds.map((seed) => seed.aggregate.id),
+    ...referenceSeeds.flatMap((seed) => Object.values(seed.referenceFields)),
+    ...(action === undefined ? [] : Object.values(aggregateReferenceFields(action.payloadSchema as z.ZodTypeAny))),
+  ])].filter((type) => /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(type)).sort();
+  const typeImports = referenceTypes.length > 0
+    ? `, type NomosRef, ${referenceTypes.map((type) => `type ${type}`).join(", ")}`
+    : "";
+  const refDeclarations = referenceTypes.flatMap((type) => [
+    `let ${proofRefSlot(type)}: NomosRef<${type}> | undefined;`,
+    `const ${proofRefGetter(type)} = (): NomosRef<${type}> => ${proofRefSlot(type)} ?? fail(${JSON.stringify(`generated proof ordering error: NomosRef<${type}> is not available yet`)});`,
+  ]);
+  const out = [
+    `// AUTO-GENERATED by nomos-compile — the canonical application journey for "${opts.packageName}".`,
+    `// Regenerated from the business law; do not edit or maintain a second client example.`,
+    `// The local proof runner executes every deep framework leg without exposing it here.`,
+    `// @nomos-proof-legs ${marker}`,
+    `import { ${opener}, sameRecord${typeImports} } from "./${opts.packageName}.client.mjs";`,
     ``,
-    ...v2CatchFinally(),
+    `const fail: (message: string) => never = (message) => { throw new Error(message); };`,
+    `const ok = (message: string) => console.log("✓ " + message);`,
+    `if (process.env.NOMOS_PROOF_MANAGED !== "1") fail("run the live journey through: githolon proof --live");`,
+    `const cloud = (process.env.NOMOS_CLOUD || "https://nomos.captainapp.co.uk").replace(/\\/+$/, "");`,
+    `const applicationName = process.env.NOMOS_APPLICATION || ${JSON.stringify(opts.packageName)};`,
+    `const signIn = async (request: { readonly deviceChallenge?: string } = {}) => {`,
+    `  if (!request.deviceChallenge) return process.env.NOMOS_AUTH_TOKEN || "";`,
+    `  const subject = process.env.NOMOS_PROOF_SUBJECT || "";`,
+    `  if (!subject) fail("the generated blank-user proof has no authority subject");`,
+    `  const response = await fetch(cloud + "/dev/mint-token", {`,
+    `    method: "POST", headers: { "content-type": "application/json" },`,
+    `    body: JSON.stringify({ sub: subject, nonce: request.deviceChallenge }),`,
+    `  });`,
+    `  const body = await response.json() as { token?: string; error?: string };`,
+    `  if (!response.ok || !body.token) fail("the generated application could not attest its private device: " + (body.error || response.status));`,
+    `  return body.token;`,
+    `};`,
+    `const application = await ${opener}({ cloud, application: applicationName, signIn });`,
+    `ok("opened the generated ${applicationName}; identity, custody, recovery and sync stay inside Nomos");`,
+    `const waitUntilSaved = async (): Promise<void> => {`,
+    `  const current = await application.currentStatus();`,
+    `  if (current.phase === "attention") fail(current.message ?? "the application needs attention");`,
+    `  if (current.phase === "current") return;`,
+    `  await new Promise<void>((resolve, reject) => {`,
+    `    const timer = setTimeout(() => { stop(); reject(new Error("the saved application did not become current")); }, 30_000);`,
+    `    const stop = application.watchStatus((status) => {`,
+    `      if (status.phase === "attention") { clearTimeout(timer); stop(); reject(new Error(status.message ?? "the application needs attention")); }`,
+    `      if (status.phase === "current") { clearTimeout(timer); stop(); resolve(); }`,
+    `    });`,
+    `  });`,
+    `};`,
+    ...refDeclarations,
     ``,
-  );
-  return out.join("\n");
-}
+  ];
 
-/**
- * THE BOOTSTRAP-ONLY PROOF (gated-create isolation): a package whose ONLY creating write is AUTHZ-GATED
- * (`.creates(...).requires(R)` — co2's estate `createSite`). It has no ungated standalone create to dispatch
- * naively (that would be REFUSED at the gate with no seeded authority) and no `.births()` genesis. So the
- * proof deploys the law, connects, and drives the RELATION-BOOTSTRAP leg as its primary write: seed authority
- * (layers 1-3), THEN prove the gated create is ADMITTED — the ordering (seed BEFORE the gated dispatch) is
- * correct by construction. If authority genuinely can't be seeded, the leg emits the loud diagnostic (never a
- * false green). The offline runner proves the same leg locally (`githolon proof`); this `.mts` is `--live`.
- */
-function generateBootstrapOnlyProof(
-  mod: DomainModule,
-  opts: TsProofOptions,
-  primaryLegs: ProofLegs,
-): string {
-  const domain = mod.domain ?? mod.name;
-  const factory = tsClientFactoryName(domain);
-  const hashConst = tsHashConstName(opts.packageName);
-  const rb = primaryLegs.relationBootstrap;
-  if (rb === undefined) {
-    // Only reached defensively — the caller gates on relationBootstrap !== undefined.
-    throw new Error(`domain '${domain}' has a gated create but no relation-bootstrap leg to prove it (no seedable authority)`);
-  }
-  const slug =
-    opts.packageName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 24) || "domain";
-  const legsMarker = JSON.stringify(primaryLegs);
-  let step = 0;
-  const n = () => ++step;
-  const out: string[] = [];
+  if (businessBirth !== undefined) {
+    const businessPayload = Object.fromEntries(
+      Object.entries(businessBirth.birthPayload).filter(([field]) => !["principal", "bornAt", "ownerKeyHash", "birthCert"].includes(field)),
+    );
+    out.push(
+      `const facts = ${JSON.stringify(businessPayload)};`,
+      `const born = await application.birth(facts);`,
+      `if (born === undefined) fail("business birth returned no child application");`,
+      `await waitUntilSaved();`,
+      `ok(${JSON.stringify(`birth(${businessBirth.businessAggregateId}) saved through the generated application`)});`,
+    );
+    if (businessBirthFollowup !== undefined) {
+      const { directive, target, payload } = businessBirthFollowup;
+      const resultMember = proofResultMember(target.id);
+      const collection = generatedAggregateCollectionName(target.id);
+      out.push(
+        `const childResult = await born.${directive.id}(${JSON.stringify(payload)});`,
+        `const childReference = childResult.${resultMember};`,
+        `const childRecord = await born.${collection}.find(childReference);`,
+        `if (childRecord === undefined) fail(${JSON.stringify(`the born application could not read its ${target.id} consequence`)});`,
+        `ok(${JSON.stringify(`${directive.id} changed the born ${businessBirth.businessAggregateId} application through generated business code`)});`,
+      );
+    }
+  } else if (action !== undefined && aggregate !== undefined) {
+    for (const seed of referenceSeeds) {
+      const payload = typedPayloadLiteral(seed.payload, seed.referenceFields);
+      const variable = `seed${proofTypeIdent(seed.aggregate.id)}`;
+      out.push(
+        `const ${variable}Result = await application.${seed.directive.id}(${payload});`,
+        `const ${variable}Ref = ${variable}Result.${proofResultMember(seed.aggregate.id)};`,
+        `${proofRefSlot(seed.aggregate.id)} = ${variable}Ref;`,
+      );
+    }
+    const synth = synthesizeDirectivePayload(action, `${domain}/${action.id}`);
+    const refs = aggregateReferenceFields(action.payloadSchema as z.ZodTypeAny);
+    const mintField = mintedCreateField(action, aggregate);
+    const payload = { ...synth.value };
+    if (mintField !== undefined) delete payload[mintField];
+    const payloadLiteral = typedPayloadLiteral(payload, refs);
+    const nullArmLines = nullablePayloadFields(action.payloadSchema as z.ZodTypeAny).flatMap((field) => {
+      const nullPayload = { ...payload, [field]: null };
+      return [
+        `await application.${action.id}(${typedPayloadLiteral(nullPayload, refs)});`,
+        `ok(${JSON.stringify(`NULL-ARM PROOF — ${domain}/${action.id} accepted ${field}=null`)});`,
+      ];
+    });
+    const clearLegs = Object.entries(aggregate.fields as Record<string, Field>)
+      .filter(([, field]) => field.isClearable === true)
+      .map(([field]) => ({
+        field,
+        directiveId: clearDirectiveId(aggregate.id, field),
+      }))
+      .filter(({ directiveId }) => {
+        const directive = (mod.directives as Directive<unknown>[]).find((candidate) => candidate.id === directiveId);
+        return directive !== undefined
+          && (directive as { requiresRelationGate?: unknown }).requiresRelationGate === undefined;
+      });
+    const aggregateCollection = generatedAggregateCollectionName(aggregate.id);
+    const clearWriteLines = clearLegs.flatMap(({ field, directiveId }) => [
+      `await application.${directiveId}({ id: created });`,
+      `ok(${JSON.stringify(`CLEAR-LANE PROOF — ${domain}/${directiveId} accepted the typed ${aggregate.id} reference`)});`,
+    ]);
+    const clearReadLines = clearLegs.flatMap(({ field }) => [
+      `const cleared${proofTypeIdent(field)} = await application.${aggregateCollection}.find(created);`,
+      `if (cleared${proofTypeIdent(field)}?.[${JSON.stringify(field)}] !== null) fail(${JSON.stringify(`CLEAR-LANE PROOF — ${aggregate.id}.${field} did not read back as explicit null`)});`,
+    ]);
+    out.push(
+      `const result = await application.${action.id}(${payloadLiteral});`,
+      `const created = result.${proofResultMember(aggregate.id)};`,
+      `${proofRefSlot(aggregate.id)} = created;`,
+      `ok(${JSON.stringify(`${domain}/${action.id} accepted business facts and returned a typed reference`)});`,
+      ...nullArmLines,
+      ...clearWriteLines,
+      `await waitUntilSaved();`,
+      ...clearReadLines,
+      `const reopened = await ${opener}({ cloud, application: applicationName, signIn });`,
+      `const rows = await reopened.${generatedAggregateCollectionName(aggregate.id)}.all();`,
+      `if (!rows.some((row) => sameRecord(row.ref, created))) fail("a fresh generated application could not read the saved record");`,
+      `ok("a fresh generated application read the saved record after synchronization");`,
+    );
+  } else {
+    out.push(
+      `const status = await application.currentStatus();`,
+      `if (status.phase === "attention") fail(status.message || "the generated application needs attention");`,
+      `ok("the generated application opened and verified its durable local state");`,
+    );
+  }
   out.push(
-    `// AUTO-GENERATED by nomos-compile — the RUNNABLE PROOF for package "${opts.packageName}",`,
-    `// synthesized from the domain's OWN law. This package's ONLY creating write is AUTHZ-GATED`,
-    `// (\`${domain}/${rb.gatedDirectiveId}\` .requires("${rb.relation}")), so the proof SEEDS authority first,`,
-    `// then proves the gated create is admitted — never a naive dispatch the gate would refuse. Reshape the`,
-    `// law, recompile, and this proof reshapes itself — no test rewriting. Run it:`,
-    `//`,
-    `//   npx githolon proof        (offline legs on a local holon)`,
-    `//   npx githolon proof --live (the same application proof in durable Nomos custody)`,
-    `//`,
-    `// Regenerated on every compile; do not edit.`,
-    `// @nomos-proof-legs ${legsMarker}`,
-    `import { readFileSync } from "node:fs";`,
-    `import { connect, encodeIntentOfferBytes } from "@githolon/client";`,
-    `import { ${factory}, ${hashConst} } from "./${opts.packageName}.client.ts";`,
-    `void connect; void encodeIntentOfferBytes; void ${factory};`,
-    ``,
-    `const CLOUD = (process.env.NOMOS_CLOUD || "https://nomos.captainapp.co.uk").replace(/\\/+$/, "");`,
-    `const WS = process.env.NOMOS_WS || ${JSON.stringify(slug + "-proof-")} + Math.random().toString(36).slice(2, 8);`,
-    ``,
-    ...v2IdentityAndCleanupPreamble(opts, hashConst, n),
-    ``,
-    `// ${n()}. connect + bind the GENERATED typed client (the relation-bootstrap leg drives it with an actor)`,
-    `const holon = await connect({ cloud: CLOUD, workspace: WS, clientId: "proof-1", principal: PRINCIPAL, authorSecret: AUTHOR_SECRET });`,
-    `ok(\`web client connected — ${factory} bound (replica \${holon.replica.slice(0, 6)}…)\`);`,
-    ``,
-    // The SAME relation-bootstrap emitter the standalone proof uses — seed authority, then prove the GATED
-    // CREATE is admitted (layers 1-3; a speculative seed-path degrades to a diagnostic, never a false green).
-    ...relationSeedLegLines(rb, factory, n),
-    `console.log(\`\\nALL GREEN — generated proof for "${opts.packageName}": deploy → seed authority → gated create ${rb.gatedDirectiveId} admitted (\${WS})\`);`,
-    ``,
-    ...v2CatchFinally(),
+    `console.log(${JSON.stringify(`\nALL GREEN — ${opts.packageName} used only its generated application surface`)});`,
+    `const _proofDisposable = application as unknown as { [Symbol.asyncDispose]?: () => Promise<void> };`,
+    `const _proofDispose = _proofDisposable[Symbol.asyncDispose];`,
+    `if (_proofDispose) await Promise.race([_proofDispose(), new Promise<void>((resolve) => setTimeout(resolve, 1_000))]);`,
+    `process.exit(0);`,
     ``,
   );
   return out.join("\n");
 }
 
+
 export function generateTsProof(modules: readonly DomainModule[], opts: TsProofOptions): string {
   // PRIMARY-DOMAIN SELECTION: a declared BUSINESS birth is always first because `proof --live` promises the
   // product's one `app.birth(facts)` surface, not a convenient auxiliary create from the same law. Without
@@ -2997,7 +3337,7 @@ export function generateTsProof(modules: readonly DomainModule[], opts: TsProofO
       (d) => (d as { businessBirth?: unknown }).businessBirth !== undefined,
     );
   const hasStandaloneCreate = (m: DomainModule): boolean =>
-    (m.directives as Directive<unknown>[]).some((d) => isStandaloneCreate(d));
+    orderedStandaloneCreates(m).length > 0;
   const hasBirth = (m: DomainModule): boolean => hasBirthDirective(m);
   const isBootstrapProvable = (m: DomainModule): boolean => {
     try {
@@ -3018,376 +3358,12 @@ export function generateTsProof(modules: readonly DomainModule[], opts: TsProofO
     throw new Error(
       gap !== undefined
         ? `no proof could be synthesized: ${gap}`
-        : `no .creates directive in any domain — a generated proof needs one creating write (or a .births() birth directive); add a directive(...).creates(...) (test/e2e.mts remains the hand-authored lane)`,
+        : `no .creates/.ensures directive in any domain — a generated proof needs one business write (or a .births() birth directive); add a business action that creates or ensures a record so the canonical generated journey can exist`,
     );
   }
-  const domain = mod.domain ?? mod.name;
-  const factory = tsClientFactoryName(domain);
-  const hashConst = tsHashConstName(opts.packageName);
   // THE MARKER (since 0.5.0) + the per-domain index are ONE synthesis (`legsForDomain`) — the proof body, its
   // marker, and the index can never describe different directives. The primary domain's legs carry whichever
   // of standalone / child-birth / relation-bootstrap it has.
   const primaryLegs = legsForDomain(mod, modules, opts.interface);
-  const childBirth = primaryLegs.childBirth;
-
-  // A business-birth domain may also contain `addSite`-style standalone creates. Those are useful secondary
-  // verbs, but they must never steal the live acceptance proof from the one public application birth.
-  if (childBirth?.businessAggregateId !== undefined) {
-    return generateBirthOnlyProof(mod, modules, opts, primaryLegs);
-  }
-
-  // The standalone-create lane needs an UNGATED create (isStandaloneCreate — never a gated/birth/attestation
-  // create, which the gate would refuse dispatched with no seeded authority). Absent one, the primary write
-  // is the birth leg (a `.births()` domain) or the relation-bootstrap leg (a gated-create domain).
-  const createDir = (mod.directives as Directive<unknown>[]).find((d) => isStandaloneCreate(d));
-  if (createDir === undefined) {
-    // BIRTH-ONLY PRIMARY: emit a birth-shaped proof (the birth replays genesis, seating authority, then the
-    // born child self-validates — a gated child-domain create is proven INSIDE the born child context).
-    if (primaryLegs.childBirth !== undefined) return generateBirthOnlyProof(mod, modules, opts, primaryLegs);
-    // BOOTSTRAP-ONLY PRIMARY: the only creating write is GATED — deploy, then seed authority + prove the
-    // gated create is admitted (the relation-bootstrap leg is its ONLY positive proof).
-    if (primaryLegs.relationBootstrap !== undefined) return generateBootstrapOnlyProof(mod, opts, primaryLegs);
-    // A gated create with no seedable authority: loud diagnostic (compile skips the proof, law still ships).
-    const gap = diagnoseRelationBootstrapGap(mod);
-    throw new Error(gap !== undefined ? `no proof could be synthesized for '${domain}': ${gap}` : `domain '${domain}' has no provable creating write`);
-  }
-  const agg = (mod.aggregates as AggregateHandle[]).find((a) => a.id === createDir.aggregateId);
-  if (agg === undefined) {
-    throw new Error(
-      `directive '${createDir.id}' creates '${createDir.aggregateId}' but no such aggregate is composed — export the aggregate from a listed module`,
-    );
-  }
-  const synth = synthesizePayload(createDir.payloadSchema as z.ZodTypeAny, `${domain}/${createDir.id}`);
-
-  // THE MINTED-ID RULE (the gate's `check_create_ids`): a `.creates` payload field
-  // that IS the target's own id must be KERNEL-MINTED — a hand-written sample id
-  // refuses typed at admission (`NotMinted`). The marker-driven trace names the
-  // field (never name-guessed); the generated proof MINTS it at runtime
-  // (`holon.mint`) instead of synthesizing a sample, so the proof admits
-  // everywhere the law does.
-  const mintField = mintedCreateField(createDir, agg);
-  const baseValue: Record<string, unknown> = { ...synth.value };
-  if (mintField !== undefined) delete baseValue[mintField];
-
-  // The first declared query that can READ BACK the create: returns the created
-  // aggregate and every key field has a synthesized payload value to probe with
-  // (a query keyed on the MINTED field is skipped — its value exists only at runtime).
-  const query = ((mod.queries ?? []) as QueryDecl[]).find(
-    (q) => q.returns === agg.id && q.key.length > 0 && q.key.every((k) => !k.includes(".") && baseValue[k] !== undefined),
-  );
-
-  // The first declared count the create moves: counts the created aggregate,
-  // unpredicated (a .where can't be evaluated at codegen time), and — when
-  // grouped — grouped by a field the synthesized payload carries.
-  const count = (mod.counts ?? [])
-    .map((raw) => finishCount(raw))
-    .find(
-      (c) =>
-        c.of === agg.id &&
-        (c as { where?: unknown }).where == null &&
-        (c.by == null || baseValue[c.by] !== undefined),
-    );
-
-  const concurrency = findConcurrencyLeg(mod.directives as Directive<unknown>[], agg);
-
-  // THE AUTHORITY-CONFORMANCE LEG (the one-encoder + gate proof): the first gated (`.requires(...)`) directive
-  // in the primary domain, proven locally — actor threads through the one encoder; an actorless gated offer
-  // throws MissingOfferAuthority. `undefined` ⇒ a documented no-op (the domain authors openly).
-  const conformance = discoverAuthorityConformanceLeg({
-    ...mod,
-    directives: (mod.directives as Directive<unknown>[]).filter(
-      (d) => (d as { businessBirthInternal?: unknown }).businessBirthInternal !== true,
-    ),
-  });
-
-  // THE RELATION-BOOTSTRAP LEG (the seed-then-prove positive): grant relation R to the proof actor, then prove
-  // a `.requires(R)`-gated write SUCCEEDS under that actor. `undefined` ⇒ no gated directive or no discoverable
-  // granter (the negative conformance leg still runs). Comes from the SAME `legsForDomain` synthesis (marker).
-  // Workspace-name slug: any package name → a safe, recognizable ws prefix.
-  const slug =
-    opts.packageName
-      .toLowerCase()
-      .replace(/[^a-z0-9]+/g, "-")
-      .replace(/^-+|-+$/g, "")
-      .slice(0, 24) || "domain";
-
-  const payloadLit =
-    mintField !== undefined
-      ? `{ ...${JSON.stringify(baseValue)}, ${JSON.stringify(mintField)}: __minted }`
-      : JSON.stringify(baseValue);
-  const queryParamsObj = query ? Object.fromEntries(query.key.map((k) => [k, baseValue[k]])) : undefined;
-  const queryParams = queryParamsObj ? JSON.stringify(queryParamsObj) : "";
-  // The gateway routes a declared query by its id: GET /v2/workspaces/<ws>/<queryId>?<key>=<val>
-  // (the host reads each declared key from the querystring — never a generic /query?params= lane).
-  const queryQs =
-    query && queryParamsObj
-      ? query.key.map((k) => `${encodeURIComponent(k)}=${encodeURIComponent(String(queryParamsObj[k]))}`).join("&")
-      : "";
-  const listAccessor = `list${agg.id}s`;
-
-  // THE MACHINE-READABLE LEGS (parsed by `githolon`'s offline proof runner —
-  // cli/src/proof_offline.ts). The ONE leg-synthesis (`legsForDomain`) feeds
-  // both this marker and the per-domain `proof-legs.json` index, so they never drift.
-  const legsMarker = JSON.stringify(primaryLegs);
-
-  let step = 0;
-  const n = () => ++step;
-  const out: string[] = [];
-
-  out.push(
-    `// AUTO-GENERATED by nomos-compile — the RUNNABLE PROOF for package "${opts.packageName}",`,
-    `// synthesized from the domain's OWN directives/queries/counts. Reshape the law,`,
-    `// recompile, and this proof reshapes itself — no test rewriting. Run it:`,
-    `//`,
-    `//   npx githolon proof        (or: npx tsx build/${opts.packageName}.proof.mts)`,
-    `//`,
-    `// The flow mirrors the scaffold's test/e2e.mts (docs/ in a scaffolded app explains`,
-    `// every call — start at docs/01-mental-model.md). Regenerated on every compile; do not edit.`,
-    `// @nomos-proof-legs ${legsMarker}`,
-    `import { connect, encodeIntentOfferBytes } from "@githolon/client";`,
-    `import { ${factory}, ${hashConst} } from "./${opts.packageName}.client.ts";`,
-    ``,
-    `const CLOUD = (process.env.NOMOS_CLOUD || "https://nomos.captainapp.co.uk").replace(/\\/+$/, "");`,
-    `const WS = process.env.NOMOS_WS || ${JSON.stringify(slug + "-proof-")} + Math.random().toString(36).slice(2, 8);`,
-    ``,
-    ...v2IdentityAndCleanupPreamble(opts, hashConst, n),
-    ``,
-    `// ${n()}. connect + bind the GENERATED typed client`,
-    `const holon = await connect({ cloud: CLOUD, workspace: WS, clientId: "proof-1", principal: PRINCIPAL, authorSecret: AUTHOR_SECRET });`,
-    `const app = ${factory}(holon);`,
-    `ok(\`web client connected — ${factory} bound (replica \${holon.replica.slice(0, 6)}…)\`);`,
-    ``,
-    `// ${n()}. OFFLINE write — the proof is ENFORCED, not narrated: while we author and`,
-    `//    read LOCALLY, fetch THROWS. The payload below was SYNTHESIZED from the zod`,
-    `//    schema of \`${domain}/${createDir.id}\`${synth.autoStamped.length ? ` (${synth.autoStamped.map((s) => `\`${s}\``).join("/")} omitted — the client auto-stamps ISO now())` : ``}.`,
-    `const realFetch = globalThis.fetch;`,
-    `globalThis.fetch = (() => { throw new Error("OFFLINE PROOF VIOLATED: local authoring touched the network"); }) as typeof fetch;`,
-    ``,
-    ...(mintField !== undefined
-      ? [
-          `// the target's own id is KERNEL-MINTED (never hand-written — the gate's`,
-          `// check_create_ids refuses sample ids typed): the local wasm mints, the id`,
-          `// rides the payload, replay reads the capture.`,
-          `const __minted = await holon.mint(${JSON.stringify(agg.id)});`,
-        ]
-      : []),
-    `await app.${createDir.id}(${payloadLit});`,
-    `ok("dispatch ${domain}/${createDir.id} — offline write under the pulled law (payload synthesized from YOUR schema${mintField !== undefined ? `; \`${mintField}\` kernel-minted` : ``})");`,
-    ``,
-  );
-
-  if (query) {
-    out.push(
-      `// ${n()}. the first declared query routes LOCALLY (params from the synthesized payload)`,
-      `const rows = await app.${lcFirst(camel(query.id))}(${queryParams});`,
-      `if (rows.length !== 1) fail(\`local declared query ${query.id}: \${JSON.stringify(rows)}\`);`,
-      `const createdId = rows[0]!.id;`,
-      `ok(\`declared query ${query.id} answers locally — ${agg.id} \${createdId}\`);`,
-      ``,
-    );
-  } else {
-    out.push(
-      `// ${n()}. no declared query reads this create back (declare a query(...) keyed on a`,
-      `//    payload field to see one proved here) — the type-index probe captures the id.`,
-      `const rows = await app.${listAccessor}();`,
-      `if (rows.length !== 1) fail(\`local ${listAccessor}: \${JSON.stringify(rows)}\`);`,
-      `const createdId = rows[0]!.id;`,
-      `console.log("– declared-query leg SKIPPED — no query(...) returns ${agg.id} keyed on a synthesized payload field");`,
-      `ok(\`local read answers — ${agg.id} \${createdId}\`);`,
-      ``,
-    );
-  }
-
-  if (count) {
-    const accessor = lcFirst(camel(count.id));
-    const callArg = count.by != null ? JSON.stringify(String(baseValue[count.by])) : "";
-    out.push(
-      `// ${n()}. the first declared count — the maintained O(1) tally, locally`,
-      `const localCount = await app.${accessor}(${callArg});`,
-      `if (localCount !== 1) fail(\`local declared count ${count.id}: \${localCount}\`);`,
-      `ok("declared count ${count.id}${count.by != null ? `(${callArg.replace(/"/g, "'")})` : `()`} = 1 locally");`,
-      ``,
-    );
-  }
-
-  // NULL SEMANTICS BOTH-ARM PROOF (null_semantics.md): the primary dispatch above already proved the
-  // VALUE arm (a nullable field synthesizes to a sampled value); here we prove the NULL arm — the law
-  // ADMITS an explicit `null` for each nullable field, so it is provably total over null. Each create
-  // arm mints a fresh id. Empty for a null-free payload (byte-identical proof).
-  const nullArms = nullablePayloadFields(createDir.payloadSchema as z.ZodTypeAny);
-  for (const field of nullArms) {
-    const armMint = mintField !== undefined ? `, ${JSON.stringify(mintField)}: await holon.mint(${JSON.stringify(agg.id)})` : "";
-    out.push(
-      `// ${n()}. NULL-ARM PROOF — \`${field}\` is nullable: the law must ADMIT an explicit null (both arms proven).`,
-      `try {`,
-      `  await app.${createDir.id}({ ...${JSON.stringify(baseValue)}${armMint}, ${JSON.stringify(field)}: null });`,
-      `  ok(${JSON.stringify(`null-arm — ${domain}/${createDir.id} admitted with \`${field}\`=null (the law handles the explicit-null arm)`)});`,
-      `} catch (e) {`,
-      `  fail(\`null-arm ${field}=null was REFUSED — a nullable field's null arm must be admitted: \${(e as Error).message}\`);`,
-      `}`,
-      ``,
-    );
-  }
-
-  // CLEAR-LANE PROOF (null_semantics.md): a `t.clearable(...)` field's compose-injected clear directive
-  // (`clearDirectiveId(agg, field)`) LOWERS to a Set of json null — dispatch it on the created instance
-  // and read the field back as null (ExplicitNull). Only UN-GATED clear directives (the proof binds no
-  // actor); a gated clear needs authority the negative/positive gate legs already cover. Empty for a
-  // clearable-free aggregate (byte-identical proof).
-  const clearLegs = Object.entries(agg.fields as Record<string, Field>)
-    .filter(([, f]) => f.isClearable === true)
-    .map(([field]) => ({ field, dirId: clearDirectiveId(agg.id, field) }))
-    .filter(({ dirId }) => {
-      const cd = (mod.directives as Directive<unknown>[]).find((d) => d.id === dirId);
-      return cd !== undefined && (cd as { requiresRelationGate?: unknown }).requiresRelationGate === undefined;
-    });
-  for (const { field, dirId } of clearLegs) {
-    out.push(
-      `// ${n()}. CLEAR-LANE PROOF — \`${field}\` is clearable: \`${dirId}\` lowers to Set(json null); after it,`,
-      `//    the field reads back null (ExplicitNull), never omitted.`,
-      `try {`,
-      `  await app.${dirId}({ id: createdId });`,
-      `} catch (e) {`,
-      `  fail(\`clear-lane ${dirId} was REFUSED — an un-gated clear of a clearable field must be admitted: \${(e as Error).message}\`);`,
-      `}`,
-      `{`,
-      `  const clearedRows = await holon.queryById(createdId) as { data?: Record<string, unknown> }[];`,
-      `  const clearedRow = clearedRows[0];`,
-      `  if (clearedRow !== undefined && clearedRow.data !== undefined && clearedRow.data[${JSON.stringify(field)}] != null) {`,
-      `    fail(\`clear-lane ${field}: expected null after clear, got \${JSON.stringify(clearedRow.data[${JSON.stringify(field)}])}\`);`,
-      `  }`,
-      `  ok(${JSON.stringify(`clear-lane — ${domain}/${dirId} admitted; \`${field}\` reads back null (ExplicitNull)`)});`,
-      `}`,
-      ``,
-    );
-  }
-
-  out.push(
-    `globalThis.fetch = realFetch;`,
-    `ok("offline proof ENFORCED — fetch was trapped: local write/read touched no network");`,
-    ``,
-    `// ${n()}. sync: push the session branch; edge admission re-verifies and merges to main`,
-    `const s = await holon.sync();`,
-    `if (!s.admission?.ok) fail(\`sync/admit: \${JSON.stringify(s)}\`);`,
-    `const admitted = (s.admission.sessions || []).flatMap((x: { admitted?: unknown[] }) => x.admitted || []);`,
-    `if (admitted.length < 1) fail(\`edge admitted \${admitted.length} intent(s): \${JSON.stringify(s.admission)}\`);`,
-    `ok(\`synced — edge admission merged \${admitted.length} intent(s) to main\`);`,
-    ``,
-  );
-
-  if (query) {
-    out.push(
-      `// ${n()}. the CLOUD answers the SAME declared query — routed by the workspace's OWN OpenAPI`,
-      `//    (GET /v2/workspaces/<ws>/${query.id}?${queryQs}); the host learns the route from the law's spec.`,
-      `d = await (await fetch(\`\${CLOUD}/v2/workspaces/\${WS}/${query.id}${queryQs ? `?${queryQs}` : ``}\`)).json();`,
-      `if (!(d.ok && d.rows.length === 1 && d.rows[0].id === createdId)) fail(\`cloud declared query: \${JSON.stringify(d)}\`);`,
-      `ok("cloud declared query ${query.id} returns the admitted row — full loop closed");`,
-      ``,
-    );
-  } else {
-    out.push(
-      `// ${n()}. the CLOUD answers the by-id read (edge projection of the admitted write)`,
-      `d = await (await fetch(\`\${CLOUD}/v2/workspaces/\${WS}/aggregates/\${encodeURIComponent(createdId)}\`)).json();`,
-      `if (!(d.rows?.length === 1 && d.rows[0].id === createdId)) fail(\`cloud by-id read: \${JSON.stringify(d)}\`);`,
-      `ok("cloud read returns the admitted row — full loop closed");`,
-      ``,
-    );
-  }
-
-  if (count) {
-    out.push(
-      `// ${n()}. the EDGE maintains the same count (same wasm, same law)`,
-      `d = await (await fetch(\`\${CLOUD}/v2/workspaces/\${WS}/${count.id}${count.by != null ? `?group=\${encodeURIComponent(${JSON.stringify(String(baseValue[count.by]))})}` : ``}\`)).json();`,
-      `if (!(d.ok && d.count === 1)) fail(\`cloud count ${count.id}: \${JSON.stringify(d)}\`);`,
-      `ok("cloud count ${count.id} = 1 — the O(1) maintained read, at the edge too");`,
-      ``,
-    );
-  }
-
-  if (concurrency) {
-    const { directive: cd, idField, setField } = concurrency;
-    const cSynth = synthesizePayload(cd.payloadSchema as z.ZodTypeAny, `${domain}/${cd.id}`);
-    const concPayload = (writer: string): string => {
-      const entries = Object.entries({ ...cSynth.value, [idField]: 0, [setField]: 0 }).map(([k]) => {
-        if (k === idField) return `${JSON.stringify(k)}: createdId`;
-        if (k === setField) return `${JSON.stringify(k)}: ${JSON.stringify([`proof-${writer}`])}`;
-        return `${JSON.stringify(k)}: ${JSON.stringify(cSynth.value[k])}`;
-      });
-      return `{ ${entries.join(", ")} }`;
-    };
-    out.push(
-      `// ${n()}. CONCURRENCY — two writers, two clientIds, BLIND to each other: each adds to`,
-      `//    the AddWins set \`${agg.id}.${setField}\` via \`${domain}/${cd.id}\` offline; admission`,
-      `//    merges both and the union keeps every add.`,
-      `const writerA = await connect({ cloud: CLOUD, workspace: WS, clientId: "proof-a", principal: PRINCIPAL, authorSecret: AUTHOR_SECRET });`,
-      `const writerB = await connect({ cloud: CLOUD, workspace: WS, clientId: "proof-b", principal: PRINCIPAL, authorSecret: AUTHOR_SECRET });`,
-      `await ${factory}(writerA).${cd.id}(${concPayload("a")});`,
-      `await ${factory}(writerB).${cd.id}(${concPayload("b")});`,
-      `await writerA.sync();`,
-      `await writerB.sync();`,
-      `d = await (await fetch(\`\${CLOUD}/v2/workspaces/\${WS}/aggregates/\${encodeURIComponent(createdId)}\`)).json();`,
-      `const merged: string[] = d.rows?.[0]?.data?.[${JSON.stringify(setField)}] ?? [];`,
-      `if (!(merged.includes("proof-a") && merged.includes("proof-b"))) fail(\`AddWins union lost an add: \${JSON.stringify(merged)}\`);`,
-      `ok(\`two blind writers' concurrent adds BOTH survive the merge — ${setField} [\${[...merged].sort().join(", ")}]\`);`,
-      ``,
-    );
-  } else {
-    out.push(
-      `// ${n()}. concurrency leg: this law has no addToSet-capable .mutates directive on an`,
-      `//    AddWins set field, so there is nothing honest to race.`,
-      `console.log("– concurrency leg SKIPPED — add a .mutates directive carrying an array field named like an AddWins set (the addToSet shape) to see two blind writers merge");`,
-      ``,
-    );
-  }
-
-  // THE ATTESTED / DYNAMIC-POLICY FOREIGN-READ LEG — named, honestly SKIPPED here. A `.readsFrom(...)`
-  // directive's plan reads a SIGNED cross-workspace attestation; proving it needs a SECOND source
-  // workspace, its read-attestor key, and a served+signed envelope — none of which the single-workspace,
-  // client-driven offline proof plane can mint (the client has no `attestedRead` serving op). The full
-  // offline two-workspace proof (birth a scratch source → seed a row → enrol its genesis → attested read
-  // through the policy edge → admitted, plus the wrong-genesis/unenrolled negative + revocation +
-  // verify_chain) lives in the bench harness against the real wasm.
-  if (hasForeignReadDirective(mod)) {
-    out.push(
-      `// ${n()}. attested foreign-read leg: a .readsFrom(...) directive reads a SIGNED cross-workspace`,
-      `//    attestation — proving it needs a second SOURCE workspace + its attestor key, which this`,
-      `//    single-workspace client proof cannot mint. Proven in the two-workspace bench smoke.`,
-      `console.log("– attested foreign-read leg SKIPPED — a .readsFrom(...) attested/policy read is proven in the two-workspace bench harness (bench/scale/{attested_reads.test,dynamic_attested_reads.smoke}.mjs), not this single-workspace offline proof");`,
-      ``,
-    );
-  }
-
-  // THE AUTHORITY-CONFORMANCE LEG (the one-encoder + gate proof): runs on the LOCAL holon (fetch re-trapped),
-  // proving the generated client threads security.actor through THE ONE ENCODER and that an actorless gated
-  // offer is impossible to GENERATE (throws MissingOfferAuthority before any submit). No-op when un-gated.
-  out.push(...authorityConformanceLegLines(conformance, factory, n));
-
-  // THE RELATION-BOOTSTRAP LEG (seed-then-prove the POSITIVE): grant relation R (or a rewrite base of it) to
-  // the proof actor, then prove the gated write SUCCEEDS under that actor. Runs on the LOCAL holon (fetch
-  // re-trapped). When no granter is discoverable but a gated directive exists, emits a CLEAR diagnostic naming
-  // exactly what's missing (the negative conformance leg still covers the gate).
-  out.push(...relationSeedLegsLines(primaryLegs, factory, n, diagnoseRelationBootstrapGap(mod)));
-
-  // THE CHILD-BIRTH LEG (G3, gap 2): when the primary domain has a `.births()` directive, prove the birth
-  // END-TO-END against the cloud — drive the parent birth offer, then read the BORN child workspace it spawns.
-  if (childBirth !== undefined) {
-    out.push(...liveChildBirthLegLines(childBirth, opts, n));
-  }
-
-  out.push(
-    `// ${n()}. CONVERGENCE: the original instance adopts canonical main in place — no reconnect`,
-    `await holon.pull();`,
-    `const head = await holon.head();`,
-    `const refsAdv = await (await fetch(\`\${CLOUD}/v2/workspaces/\${WS}/git/info/refs?service=git-upload-pack\`)).text();`,
-    `const remoteMain = (refsAdv.match(/([0-9a-f]{40}) refs\\/heads\\/main/) || [])[1];`,
-    `if (head !== remoteMain) fail(\`not converged in place: local \${head?.slice(0, 10)} vs main \${remoteMain?.slice(0, 10)}\`);`,
-    `ok("converged in place — local head == canonical main");`,
-    ``,
-    `console.log(\`\\nALL GREEN — generated proof for "${opts.packageName}": deploy → offline write → local reads → admission → cloud reads${concurrency ? ` → AddWins merge` : ``}${childBirth !== undefined ? ` → child birth` : ``} → convergence (\${WS})\`);`,
-    ``,
-    ...v2CatchFinally(),
-    ``,
-  );
-
-  return out.join("\n");
+  return generateSealedApplicationProof(mod, opts, primaryLegs);
 }