@githolon/dsl 0.101.6 → 0.102.0

package/src/law_check.ts

@@ -33,7 +33,12 @@ import type { DomainModule } from "./codegen_dart.js";
 import { admitsNull, type Field, type ValueObjectDescriptor, type ValueObjectFieldDescriptor } from "./fields.js";
 import type { FieldOp, PlannedOp } from "./ops.js";
 import { deterministicPorts } from "./ctx.js";
-import { synthesizePayload, withBirthProbeGlobals, type SynthesizedPayload } from "./codegen_proof.js";
+import {
+  synthesizeDirectivePayload,
+  synthesizePayload,
+  withBirthProbeGlobals,
+  type SynthesizedPayload,
+} from "./codegen_proof.js";
 import { __drainAuthoring, __resetAuthoring } from "./authoring.js";
 import { __drainReads, __resetReads } from "./read.js";
 import { __drainBirths, __resetBirths } from "./births.js";
@@ -83,6 +88,9 @@ interface ProbeResult {
   readonly error?: unknown;
   /** The FIELD ops the plan emitted (authoring sink + returned ops), when it didn't throw. */
   readonly ops: FieldOp[];
+  /** Captured reads reached before return/throw. An empty-state read may make a valid stateful plan
+   *  deliberately reject this isolated probe; the generated prerequisite journey is its positive proof. */
+  readonly reads: readonly { readonly queryId: string }[];
   /** The top-level payload keys the plan actually READ (via the tracking proxy). */
   readonly readFields: ReadonlySet<string>;
 }
@@ -93,7 +101,7 @@ interface ProbeResult {
 function probeDirective(dir: Directive<unknown>, where: string): ProbeResult | undefined {
   let synth: SynthesizedPayload;
   try {
-    synth = synthesizePayload(dir.payloadSchema as z.ZodTypeAny, where);
+    synth = synthesizeDirectivePayload(dir, where);
   } catch {
     return undefined;
   }
@@ -118,6 +126,7 @@ function probeDirective(dir: Directive<unknown>, where: string): ProbeResult | u
   let threw = false;
   let error: unknown;
   let ops: FieldOp[] = [];
+  let reads: readonly { readonly queryId: string }[] = [];
   withBirthProbeGlobals(() => {
     __resetAuthoring();
     __resetReads();
@@ -126,9 +135,11 @@ function probeDirective(dir: Directive<unknown>, where: string): ProbeResult | u
       returned = dir.plan(tracked as never, deterministicPorts({ physical: 1, replica: 1, principal: "principal:probe" }));
       const drained: PlannedOp[] = [...__drainAuthoring(), ...(Array.isArray(returned) ? returned : [])];
       ops = drained.filter((o): o is FieldOp => (o as { kind?: string }).kind !== "strike");
+      reads = __drainReads();
     } catch (e) {
       threw = true;
       error = e;
+      reads = __drainReads();
     } finally {
       // Drain the sinks on every path so a throwing probe never leaks state into the next.
       try { __drainAuthoring(); } catch { /* drained */ }
@@ -136,7 +147,7 @@ function probeDirective(dir: Directive<unknown>, where: string): ProbeResult | u
       try { __drainBirths(); } catch { /* drained */ }
     }
   });
-  return { synth, probePayload, returned, threw, error, ops, readFields };
+  return { synth, probePayload, returned, threw, error, ops, reads, readFields };
 }
 
 /** `zodObjectShape` with a swallow — a non-object payload yields `{}` (the return twin handles it). */
@@ -335,8 +346,24 @@ function deletedAmbientFindings(domain: string, dir: Directive<unknown>, probe:
 // `return []` after `create(...).set(...)`; a plain object) throws "not iterable" at the FIRST
 // dispatch on every peer. This is payload-INDEPENDENT (the return TYPE is fixed) ⇒ REFUSE.
 // A plan that THREW on the sample is payload-DEPENDENT (can't prove) ⇒ WARN naming the sample.
-function planReturnFindings(domain: string, dir: Directive<unknown>, probe: ProbeResult): Finding[] {
+function planReturnFindings(
+  domain: string,
+  dir: Directive<unknown>,
+  probe: ProbeResult,
+  generatedJourneyProvesDirective: boolean,
+): Finding[] {
   if (probe.threw) {
+    const declaredReadIds = new Set([
+      ...(dir.declaredQueryReads ?? []).map((query) => query.id),
+      ...(dir.declaredForeignReads ?? []).map((read) => read.queryId),
+    ]);
+    const threwAfterDeclaredRead = probe.reads.length > 0 &&
+      probe.reads.every((read) => declaredReadIds.has(read.queryId));
+    // An isolated empty projection is the wrong positive fixture for a stateful business action. When the
+    // generator has built a real prerequisite journey for this exact public directive, that journey—not a
+    // fabricated checker row—proves the plan's return shape against actual folded state. CI executes it.
+    // Keep warning for private/unproved directives and for throws before any declared read.
+    if (threwAfterDeclaredRead && generatedJourneyProvesDirective) return [];
     return [
       {
         domain,
@@ -393,6 +420,17 @@ function unreadPayloadFindings(domain: string, dir: Directive<unknown>, probe: P
     gateConsumed.add(firstDeviceGate.keyHashField);
     gateConsumed.add(firstDeviceGate.verifiedViaField);
   }
+  // A cross-custody attestation gate verifies the signed quote directly from
+  // the payload. `publicKey` and `signature` are deliberately verification
+  // inputs rather than stored business fields, so the plan must not pretend to
+  // consume them merely to placate this lint. All field names are law-declared;
+  // do not hardcode the recordShare convention here.
+  const attestationGate = (dir as {
+    attestationAuthorizedGate?: { fields?: Readonly<Record<string, string>> };
+  }).attestationAuthorizedGate;
+  for (const field of Object.values(attestationGate?.fields ?? {})) {
+    if (typeof field === "string") gateConsumed.add(field);
+  }
   // A dynamic .readsFrom(fromPayload("<wsField>"), …) edge routes the foreign read by a payload field the
   // ROUTING lane consumes (the plan may pass it straight to read(…, {from}) without a tracked property
   // read on the sampled path) — a declared trust-edge field is never a dead field.
@@ -1037,7 +1075,7 @@ function topLevelPortReadFindings(mod: DomainModule, portReadingDomains: Readonl
 function foreignReadsPerformed(dir: Directive<unknown>, where: string): Set<string> | undefined {
   let synth: SynthesizedPayload;
   try {
-    synth = synthesizePayload(dir.payloadSchema as z.ZodTypeAny, where);
+    synth = synthesizeDirectivePayload(dir, where);
   } catch {
     return undefined;
   }
@@ -1144,30 +1182,40 @@ export function checkDomainModules(
 ): Finding[] {
   const findings: Finding[] = [];
   const portReadingDomains = opts?.portReadingDomains ?? new Set<string>();
+  const generatedJourneyDirectiveIds = new Map<string, Set<string>>();
+  try {
+    const index = proofLegsIndex(modules as DomainModule[]);
+    for (const [domain, legs] of Object.entries(index?.domains ?? {})) {
+      const ids = generatedJourneyDirectiveIds.get(domain) ?? new Set<string>();
+      if (legs.directiveId !== undefined) ids.add(legs.directiveId);
+      for (const create of legs.extraCreates ?? []) ids.add(create.directiveId);
+      for (const birth of legs.childBirths ?? (legs.childBirth === undefined ? [] : [legs.childBirth])) {
+        ids.add(birth.birthDirectiveId);
+      }
+      for (const bootstrap of legs.relationBootstraps ?? (legs.relationBootstrap === undefined ? [] : [legs.relationBootstrap])) {
+        ids.add(bootstrap.gatedDirectiveId);
+      }
+      generatedJourneyDirectiveIds.set(domain, ids);
+    }
+  } catch {
+    // The ordinary findings and proof diagnostics retain their own exact failures. Never suppress from an
+    // index we could not derive.
+  }
 
   for (const mod of modules) {
     const domain = mod.domain ?? mod.name;
+    const generatedJourney = generatedJourneyDirectiveIds.get(domain) ?? new Set<string>();
     const aggById = new Map<string, AggregateHandle>();
     for (const a of mod.aggregates) aggById.set(a.id, a);
 
     // Slice-2 twin: the module top level read the captured ports (pristine-pool ineligibility).
     findings.push(...topLevelPortReadFindings(mod, portReadingDomains));
 
-    // The NOTE twin (unify): the auto-declared secondary ensures composeDomainModule injected.
-    for (const ty of mod.autoDeclaredEnsures ?? []) {
-      findings.push({
-        domain,
-        level: "note",
-        what: `auto-declared Ensure→${ty} from a plan's secondary ensure(...) — the id-mint gate was opened for it`,
-        fix: `no action needed; to make it explicit, export a directive that \`.ensures(${ty})\``,
-      });
-    }
-
     for (const dir of mod.directives as Directive<unknown>[]) {
       const where = `${domain}/${dir.id}`;
       const probe = probeDirective(dir, where);
       if (probe === undefined) continue; // unsynthesizable payload — proven by hand, not by check
-      findings.push(...planReturnFindings(domain, dir, probe));
+      findings.push(...planReturnFindings(domain, dir, probe, generatedJourney.has(dir.id)));
       findings.push(...unreadPayloadFindings(domain, dir, probe));
       findings.push(...opVsSchemaFindings(domain, dir, probe, aggById));
       findings.push(...deletedAmbientFindings(domain, dir, probe));

package/src/precondition.ts

@@ -78,12 +78,24 @@ export function synthesizePreconditionInvariants<P>(directive: Directive<P>): Wo
       id,
       on: directive.id,
       reads: (ctx: { intent: Record<string, unknown> }): InvariantRef[] => [
-        refAs(REF_NAME, desc.aggregateId, desc.idField(ctx.intent)),
+        // Preconditions judge the state the directive is attempting to extend.
+        // The gate's reserved `pre:` namespace resolves the committed pre-apply
+        // aggregate; an ordinary ref would resolve the directive's trial result
+        // and therefore make every successful create appear to be a duplicate.
+        refAs(REF_NAME, desc.aggregateId, `pre:${desc.idField(ctx.intent)}`),
       ],
       assert: (snapshots: Record<string, Record<string, unknown>>) => {
-        // The kernel resolves the ref into `snapshots[REF_NAME]`; an ABSENT instance leaves the key
-        // undefined (proven safe — `homeNameBindsOwner`), so `undefined` is the "row does not exist" signal.
-        const row = snapshots[REF_NAME] as Record<string, unknown> | undefined;
+        // Hosts historically represented an unresolved ref either by omitting
+        // the key or by returning an empty projection. Treat both identically;
+        // an admitted aggregate has at least one folded field after its atomic
+        // create intent, so an empty object is not a durable record.
+        const projected = snapshots[REF_NAME] as
+          | Record<string, unknown>
+          | undefined;
+        const row = projected !== undefined &&
+            desc.fieldNames.some((field) => Object.hasOwn(projected, field))
+          ? projected
+          : undefined;
         return desc.predicate(row) ? { accept: true } : { reject: desc.rejectCode };
       },
       ...(desc.declassify !== undefined ? { declassify: desc.declassify } : {}),

package/src/read_projection_namespace.ts

@@ -89,15 +89,10 @@ export const GLOBAL_READ_PROJECTION_AGGREGATE_IDS: ReadonlySet<string> = new Set
   "BirthPolicy",
   "BirthGrant",
   // home holons
-  "HomeOwner",
   "SharedWithMe",
   "BirthAttestation",
-  // identity
-  "Actor",
-  "User",
-  "DeviceKey",
-  "Organization",
-  "PublicUser",
+  "NomosInternalReceivingGroup7c1f5e",
+  "NomosInternalReceivingGroupPolicy7c1f5e",
   // native relations (the one authz spine)
   "RelationTuple",
   // repair

package/src/recipient.ts

@@ -0,0 +1,33 @@
+import { z } from "zod";
+import { zodDef, zodKind } from "./zod_introspection.js";
+
+/**
+ * A business invitation recipient. It is wire-compatible with a string because
+ * law records the durable address, but generated applications expose the value
+ * as `Recipient<User>` so a UID, email address, principal, or record id cannot
+ * accidentally be passed in its place.
+ */
+export const NOMOS_RECIPIENT_BRAND: unique symbol = Symbol.for("nomos.recipient");
+
+export function recipient(): z.ZodType<string> {
+  const schema = z.string().min(1);
+  Object.defineProperty(schema, NOMOS_RECIPIENT_BRAND, {
+    value: "User",
+    enumerable: false,
+  });
+  return schema;
+}
+
+/** Resolve a recipient annotation through Zod's omission/null wrappers. */
+export function recipientMetaOf(zt: z.ZodTypeAny): "User" | undefined {
+  let current: z.ZodTypeAny | undefined = zt;
+  for (let hops = 0; current !== undefined && hops < 16; hops += 1) {
+    if ((current as unknown as Record<symbol, unknown>)[NOMOS_RECIPIENT_BRAND] === "User") {
+      return "User";
+    }
+    const kind = zodKind(current);
+    if (kind !== "optional" && kind !== "default" && kind !== "nullable") return undefined;
+    current = zodDef(current).innerType;
+  }
+  return undefined;
+}

package/src/relation_schema.ts

@@ -112,6 +112,99 @@ export function isRelationTypeDecl(v: unknown): v is RelationTypeDecl {
   return typeof v === "object" && v !== null && (v as { __isRelationType?: unknown }).__isRelationType === true;
 }
 
+/**
+ * Discover authored relation fragments without the generic declaration scanner's JSON
+ * deduplication. A relation declaration stores its relations in a Map, and every Map
+ * stringifies as `{}`; JSON deduplication therefore made two distinct fragments of the
+ * same type look identical and silently discarded one of them.
+ */
+export function discoverRelationTypeDeclarations(
+  bag: Readonly<Record<string, unknown>>,
+): RelationTypeDecl[] {
+  const seen = new Set<RelationTypeDecl>();
+  const declarations: RelationTypeDecl[] = [];
+  const add = (value: unknown): void => {
+    if (!isRelationTypeDecl(value) || seen.has(value)) return;
+    seen.add(value);
+    declarations.push(value);
+  };
+  for (const value of Object.values(bag)) {
+    if (Array.isArray(value)) for (const entry of value) add(entry);
+    else add(value);
+  }
+  return declarations;
+}
+
+/**
+ * Compose independently authored fragments of one relation type into one complete
+ * declaration. Distinct relation names union; duplicate names and conflicting caps
+ * hard-fail. Validation happens on the complete type so a policy fragment may safely
+ * use `computed("owner")` when the owner relation is declared by another module in the
+ * same domain.
+ */
+export function mergeRelationTypeDeclarations(
+  declarations: readonly RelationTypeDecl[],
+): RelationTypeDecl[] {
+  const unique = [...new Set(declarations)];
+  const groups = new Map<string, RelationTypeDecl[]>();
+  for (const declaration of unique) {
+    const key = `${declaration.global === true ? "global" : "local"}:${declaration.type}`;
+    const group = groups.get(key) ?? [];
+    group.push(declaration);
+    groups.set(key, group);
+  }
+
+  const merged: RelationTypeDecl[] = [];
+  for (const group of groups.values()) {
+    const first = group[0]!;
+    if (group.length === 1) {
+      validateRelationType(first);
+      merged.push(first);
+      continue;
+    }
+    const relations = new Map<string, RelationDefAst>();
+    let caps: RelationCaps | undefined;
+    for (const declaration of group) {
+      if (declaration.caps !== undefined) {
+        if (
+          caps !== undefined &&
+          (caps.maxDepth !== declaration.caps.maxDepth || caps.maxFanout !== declaration.caps.maxFanout)
+        ) {
+          throw new Error(`relationType("${declaration.type}"): conflicting caps across declarations`);
+        }
+        caps = declaration.caps;
+      }
+      for (const [relation, definition] of declaration.relations) {
+        const existing = relations.get(relation);
+        if (existing !== undefined) {
+          // Framework-owned declarations can cross the published-CLI/package bundle boundary as
+          // distinct object identities. The private brand plus byte-identical definition identifies
+          // that one canonical concept; tenant-authored collisions remain a loud hard failure.
+          const repeatedFrameworkDeclaration =
+            (first as RelationTypeDecl & { businessBirthInternal?: boolean }).businessBirthInternal === true &&
+            (declaration as RelationTypeDecl & { businessBirthInternal?: boolean }).businessBirthInternal === true &&
+            JSON.stringify(existing) === JSON.stringify(definition);
+          if (repeatedFrameworkDeclaration) continue;
+          throw new Error(
+            `relationType("${declaration.type}"): relation "${relation}" declared in two relationType() blocks`,
+          );
+        }
+        relations.set(relation, definition);
+      }
+    }
+    const declaration: RelationTypeDecl = {
+      type: first.type,
+      relations,
+      ...(caps === undefined ? {} : { caps }),
+      ...(first.global === true ? { global: true } : {}),
+      __isRelationType: true,
+    };
+    validateRelationType(declaration);
+    merged.push(declaration);
+  }
+  return merged;
+}
+
 // ─────────────────────────────── relation-type NAMESPACING ───────────────────────────────
 
 /**

package/src/secondary_ensure.ts

@@ -57,6 +57,10 @@ export function sanctioningEnsureDirective(agg: AggregateHandle): Directive<unkn
     .ensures(agg)
     .payload(z.object({}).strict())
     .plan(() => []) as unknown as Directive<unknown>;
+  // This declaration exists only to certify the id-mint lane. It is never a
+  // tenant action and must not appear in generated clients, applications, or
+  // OpenAPI, irrespective of whether the aggregate itself is framework-owned.
+  (dir as { businessBirthInternal?: true }).businessBirthInternal = true;
   // FRAMEWORK-SHARED DEDUP (Dart codegen): when the sanctioned aggregate is a FRAMEWORK singleton
   // (e.g. RelationTuple — auto-ensured into EVERY relation-using domain), this directive is injected
   // per-domain but its payload class (`NomosEnsure_<Agg>Payload`, zero-field) is byte-identical across
@@ -73,8 +77,10 @@ export function sanctioningEnsureDirective(agg: AggregateHandle): Directive<unkn
 
 /**
  * Discover the secondary-ensured types a domain's directives introduce that NO directive already
- * declares `.ensures()` for — the SORTED gap set the compose seam must sanction. Pure discovery:
- * probes every directive, unions the ensured types, subtracts the domain-wide DECLARED-ensures set.
+ * declares as its PRIMARY `.ensures()` target — the SORTED gap set the compose seam must sanction.
+ * Declared `.alsoEnsures()` outputs are included directly as well as plan-probed ensures. New kernels
+ * understand `secondaryOutputs`, but older supported kernels only open the deterministic-id lane from
+ * a primary Ensure marker; the hidden sanction keeps one compiled package portable across both.
  */
 export function discoverUnsanctionedEnsures(
   directives: readonly Directive<unknown>[],
@@ -87,6 +93,9 @@ export function discoverUnsanctionedEnsures(
   }
   const gap = new Set<string>();
   for (const d of directives) {
+    for (const output of (d as { secondaryOutputs?: readonly { aggregateId: string; marker: string }[] }).secondaryOutputs ?? []) {
+      if (output.marker === "ensures" && !declared.has(output.aggregateId)) gap.add(output.aggregateId);
+    }
     // A `.births()` directive's genesis-recipe plan runs under a different probe surface; its meter
     // record is sanctioned by `birth_meter_ensure.ts`, so leave it to that lane (avoid double probing).
     if ((d as { birthsChild?: boolean }).birthsChild === true) continue;

package/src/shape_compat.ts

@@ -26,6 +26,7 @@ import { z } from "zod";
 import { introspectPayload, type DomainModule, type PayloadFieldSpec } from "./codegen_dart.js";
 import type { StableIds } from "./stable_ids_types.js";
 import type { Field } from "./fields.js";
+import { isBusinessIntent } from "./intent.js";
 
 /** One payload field's normalized shape: its kind + whether the schema makes it optional. */
 export interface PayloadFieldShape {
@@ -126,6 +127,12 @@ function payloadFieldKind(spec: PayloadFieldSpec): string {
     case "wrapped":
       // typed-id (string wire) or unit (number wire) — the interface sees the WIRE kind.
       return spec.dartType.endsWith("Id") ? "string" : "double";
+    case "ref":
+      // NomosRef<T> is aggregate-typed in the client and remains a string id on the wire.
+      return "string";
+    case "recipient":
+      // Recipient<User> is nominal in clients and an opaque delivery address on the law wire.
+      return "string";
     case "vo":
     case "voList":
       // Interface kinds stay at the base lane for now (slice D of vo_authoring_end_to_end.md
@@ -192,7 +199,10 @@ export function domainInterface(mod: DomainModule, stableIds?: StableIds): Domai
         fieldEntries.push([spec.name, { kind: payloadFieldKind(spec), optional: !!spec.optional }]);
       }
     }
-    dirEntries.push([d.businessBirth === undefined ? d.id : "birth", { fields: sortedRec(fieldEntries) }]);
+    dirEntries.push([
+      d.businessBirth === undefined || isBusinessIntent(d) ? d.id : "birth",
+      { fields: sortedRec(fieldEntries) },
+    ]);
   }
   Object.assign(directives, sortedRec(dirEntries));
   const aggregates: Record<string, AggregateReadShape> = {};

package/src/usd.ts

@@ -72,7 +72,7 @@ export type RefMode = WireRefMode;
  *    (an aggregate is a single-source schema); they pass through by path.
  *  - `directive`: a composable law unit. `requires` is the capability set (#137:
  *    add/narrow, never silently remove); `scope` is the optional composable scope
- *    path (#137: narrow-not-widen). `payloadRef` is the certified-artifact handle
+ *    path (#137: narrow-not-widen). `artifactRef` is the certified-artifact handle
  *    — left `undefined` here (stage 2).
  */
 export type UsdPrim =
@@ -123,7 +123,7 @@ export type UsdPrim =
        */
       readonly payloadJsonSchema?: unknown;
       /** Certified-artifact payload reference — `undefined` for now (stage 2). */
-      readonly payloadRef?: string;
+      readonly artifactRef?: string;
     };
 
 /** One captured query declaration on a USD layer (read-side closure). `key` is the
@@ -753,7 +753,7 @@ function sortPrims(prims: UsdPrim[]): UsdPrim[] {
  * `manifest.ts`'s `domainManifest` (and therefore its `encodeKernelSchema` driver encoding)
  * — no driver-encoding logic is duplicated here. Aggregate prims carry the exact
  * encoded schema; directive prims map `requiresCapability` → `requires: [cap]`, leave
- * `scope`/`payloadRef` `undefined` (no static scope today; payload is stage 2).
+ * `scope`/`artifactRef` `undefined` (no static scope or certified artifact today).
  */
 function encodeModuleToPrims(layerPath: string, manifest: CanonicalManifest): UsdPrim[] {
   const prims: UsdPrim[] = [];
@@ -789,7 +789,7 @@ function encodeModuleToPrims(layerPath: string, manifest: CanonicalManifest): Us
       // Omit-when-empty from the manifest, so a single-output prim is byte-identical to before.
       ...(d.secondaryOutputs !== undefined ? { secondaryOutputs: d.secondaryOutputs } : {}),
       payloadJsonSchema: d.payloadJsonSchema,
-      // `scope`/`payloadRef` deliberately omitted (undefined): no static scope in
+      // `scope`/`artifactRef` deliberately omitted (undefined): no static scope in
       // the DSL today, payload is the stage-2 certified artifact.
     });
   }
@@ -930,6 +930,7 @@ function serializeRelationSchema(
   domainKey: string,
 ): UsdLayer["nomosRelations"] {
   if (decls.length === 0) return undefined;
+  const namespacedTypes = new Set(decls.filter((decl) => decl.global !== true).map((decl) => decl.type));
   type AllowedW = { kind: string; type?: string; ns?: string; relation?: string };
   const allowedKey = (a: AllowedW): string =>
     a.kind === "direct" ? `direct:${a.type}` : a.kind === "wildcard" ? "wildcard" : `userset:${a.type}#${a.relation}`;
@@ -952,7 +953,18 @@ function serializeRelationSchema(
     }
     for (const [rel, def] of d.relations) {
       if (entry.relations.has(rel)) throw new Error(`relationType("${d.type}"): relation "${rel}" declared in two relationType() blocks`);
-      const allowed = [...def.allowed].sort((x, y) => (allowedKey(x as AllowedW) < allowedKey(y as AllowedW) ? -1 : 1));
+      // An allowed object/userset subject names another relation type. When that target is local to this
+      // domain it must carry the SAME qualifier as the schema key and objectOf(...) tuple subject; otherwise
+      // a perfectly typed parent edge is stored under `<domain>__Parent` while the gate only permits bare
+      // `Parent`, making tuple-to-userset inheritance silently dead. Framework-global user/key types stay bare.
+      const allowed = [...def.allowed]
+        .map((subject) => {
+          if ((subject.kind === "direct" || subject.kind === "userset") && namespacedTypes.has(subject.type)) {
+            return { ...subject, type: qualifyRelationType(domainKey, subject.type) };
+          }
+          return subject;
+        })
+        .sort((x, y) => (allowedKey(x as AllowedW) < allowedKey(y as AllowedW) ? -1 : 1));
       entry.relations.set(rel, { rewrite: def.rewrite, allowed });
     }
   }
@@ -982,6 +994,16 @@ function synthesizeReadRelationTypes(
   for (const a of manifest.aggregates) {
     if (a.requiresRead !== undefined && a.owned === undefined) caps.add(a.requiresRead);
   }
+  // Pack acquisition happens before per-record filtering/decryption. Any law with owned state therefore
+  // needs the same obscure capability at workspace grain, and the receiving-group genesis always writes
+  // that seat so a standalone group law remains self-consistent too. This grants ciphertext transport;
+  // each owned record still has its separately synthesized aggregate-grain relation below.
+  if (
+    manifest.aggregates.some((aggregate) => aggregate.owned !== undefined) ||
+    manifest.aggregates.some((aggregate) => aggregate.id === "NomosInternalReceivingGroup7c1f5e")
+  ) {
+    caps.add(OWNED_READ_RELATION);
+  }
   const out: import("./relation_schema.js").RelationTypeDecl[] = [];
   // GLOBAL (un-namespaced): the read gate hardcodes `ObjectRef::new("workspace","self")` in Rust
   // (`wasm_git_holon.rs`), so the synthesized read-visibility `workspace` type MUST stay bare — it is
@@ -1542,7 +1564,7 @@ export function emitUsd(
       // DOMAIN CONTRACTS: the additive `nomosContracts` descriptor (hash-inert, omit-when-empty).
       const nomosContracts = buildNomosContracts(l.module);
       const flowEndorse = [...l.module.directives]
-        .flatMap((d) => harvestPrincipalFlows(d as never).map((f) => ({ directiveId: d.id, sink: f.sink, facet: f.facet, reason: f.reason })))
+        .flatMap((d) => harvestPrincipalFlows(d as never, l.module.domain ?? l.module.name).map((f) => ({ directiveId: d.id, sink: f.sink, facet: f.facet, reason: f.reason })))
         .sort((a, b) =>
           a.directiveId !== b.directiveId ? (a.directiveId < b.directiveId ? -1 : 1)
             : a.sink !== b.sink ? (a.sink < b.sink ? -1 : 1)
@@ -1645,7 +1667,7 @@ function aggregateEqual(
  * Merge a stronger `over` prim onto a `base` prim at the SAME path, per the #137
  * typed rules — reusing `compose.ts`'s `mergeRequiresScope` for directive prims
  * (requires add/narrow-not-remove; scope narrow-not-widen; widen/remove need
- * `authority`). An uncertified payload would always be refused — but `payloadRef`
+ * `authority`). An uncertified artifact would always be refused — but `artifactRef`
  * is unset here (stage 2), so there is nothing to refuse yet.
  *
  * Mixing prim KINDS at one path, or redefining an aggregate's schema across layers,
@@ -1720,7 +1742,7 @@ function mergeUsdPrim(base: UsdPrim, over: UsdPrim, opts: ComposeOptions): UsdPr
         : base.emits !== undefined
           ? { emits: base.emits }
           : {}),
-      // payloadRef stays unset (stage 2).
+      // artifactRef stays unset (a later certified-artifact slice).
     };
     return out;
   }