@githolon/dsl 0.102.1 → 0.102.2

package/src/compile_package_main.ts

@@ -262,8 +262,9 @@ interface PackageConfig {
          *   • `test`   — optional; generated business scenarios for widget/integration tests.
          * The layering line: UI code depends on `types`; composition/runtime code on `client`;
          * generated TYPES may flow to the UI, generated CLIENTS may not.
-         * Each package's `pubspec.yaml` is scaffolded ONLY IF MISSING (tenant-owned versioning);
-         * barrels + `lib/src/generated/` are generated-owned and rewritten every compile.
+         * Each package's `pubspec.yaml` keeps tenant-owned versioning/publishing metadata and custom
+         * dependencies; Nomos-owned framework dependency floors are reconciled on every compile.
+         * Barrels + `lib/src/generated/` are generated-owned and rewritten every compile.
          * Requires `support: "package"` (vendored mode contradicts pub-package layering).
          */
         readonly packages?: {
@@ -1298,12 +1299,27 @@ function emitDart(
 // ── the LAYERED-PACKAGES Dart emit (dart.packages: blast-radius isolation) ────────
 
 /** The pure-core support import generated TYPES files carry in layered-packages mode. */
-const DART_TYPES_IMPORT = [
-  `import 'package:nomos_types/nomos_types.dart';`,
-  `import 'package:nomos_types/src/nomos_ref.dart' show NmsInternalNomosRefs;`,
-  `import 'package:nomos_types/src/foreign_ref.dart' show NmsInternalForeignRefs;`,
-  `import 'package:nomos_types/src/invitation.dart' show NmsInternalInvitations, NmsInternalRecipients;`,
-].join("\n");
+const dartTypesImportFor = (generatedSource: string): string => {
+  const lines = [
+    `import 'package:nomos_types/nomos_types.dart';`,
+    ...(generatedSource.includes("NmsInternalNomosRefs.")
+      ? [`import 'package:nomos_types/src/nomos_ref.dart' show NmsInternalNomosRefs;`]
+      : []),
+    ...(generatedSource.includes("NmsInternalForeignRefs.")
+      ? [`import 'package:nomos_types/src/foreign_ref.dart' show NmsInternalForeignRefs;`]
+      : []),
+  ];
+  const invitationHelpers = [
+    ...(generatedSource.includes("NmsInternalInvitations.") ? ["NmsInternalInvitations"] : []),
+    ...(generatedSource.includes("NmsInternalRecipients.") ? ["NmsInternalRecipients"] : []),
+  ];
+  if (invitationHelpers.length > 0) {
+    lines.push(
+      `import 'package:nomos_types/src/invitation.dart' show ${invitationHelpers.join(", ")};`,
+    );
+  }
+  return lines.join("\n");
+};
 /** Version constraints the scaffolded pubspecs pin — move together with the Dart packages' releases.
  *  Caret on 0.x is EXACT-MINOR (`^0.45.0` = `<0.46.0`), so these must track the CURRENT release, not
  *  just the floor generated code needs — a lagging pin forces tenants into dependency_overrides. */
@@ -1313,8 +1329,8 @@ const NOMOS_TYPES_DEP = "^0.8.0";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.64.0";
-const NOMOS_FLUTTER_DEP = "^0.63.0";
+const NOMOS_CLIENT_DEP = "^0.64.1";
+const NOMOS_FLUTTER_DEP = "^0.63.1";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).
@@ -1690,13 +1706,59 @@ function cursedNameHints(declared: ReadonlySet<string>, names: Readonly<Record<s
     .sort((a, b) => b.length - a.length);
 }
 
-/** Scaffold a pubspec ONLY IF MISSING — the tenant owns versioning/publishing; regeneration must
- *  never clobber their bumps. Returns true when written. */
-function scaffoldPubspec(pkgDir: string, yaml: string): boolean {
+/** Scaffold a pubspec when missing, otherwise reconcile only the dependencies owned by Nomos.
+ *  Tenant versioning, publishing metadata and application dependencies remain untouched, while a
+ *  regenerated client can never silently retain an obsolete framework floor. */
+function reconcilePubspec(
+  pkgDir: string,
+  yaml: string,
+  managedDependencies: Readonly<Record<string, string>> = {},
+): boolean {
   const p = path.join(pkgDir, "pubspec.yaml");
-  if (existsSync(p)) return false;
-  mkdirSync(pkgDir, { recursive: true });
-  writeFileSync(p, yaml, "utf8");
+  if (!existsSync(p)) {
+    mkdirSync(pkgDir, { recursive: true });
+    writeFileSync(p, yaml, "utf8");
+    return true;
+  }
+  if (Object.keys(managedDependencies).length === 0) return false;
+
+  const source = readFileSync(p, "utf8");
+  const trailingNewline = source.endsWith("\n");
+  const lines = source.split(/\r?\n/);
+  if (trailingNewline) lines.pop();
+  let dependenciesStart = lines.findIndex((line) => /^dependencies:\s*(?:#.*)?$/.test(line));
+  if (dependenciesStart < 0) {
+    const before = lines.findIndex((line) => /^dev_dependencies:\s*(?:#.*)?$/.test(line));
+    dependenciesStart = before < 0 ? lines.length : before;
+    lines.splice(dependenciesStart, 0, "dependencies:");
+  }
+  let dependenciesEnd = dependenciesStart + 1;
+  while (dependenciesEnd < lines.length) {
+    const line = lines[dependenciesEnd]!;
+    if (line.trim() !== "" && !/^\s/.test(line) && !/^\s*#/.test(line)) break;
+    dependenciesEnd += 1;
+  }
+
+  for (const [name, constraint] of Object.entries(managedDependencies)) {
+    const prefix = `  ${name}:`;
+    const existing = lines.findIndex(
+      (line, index) => index > dependenciesStart && index < dependenciesEnd && line.startsWith(prefix),
+    );
+    const replacement = `  ${name}: ${constraint}`;
+    if (existing < 0) {
+      lines.splice(dependenciesEnd, 0, replacement);
+      dependenciesEnd += 1;
+      continue;
+    }
+    let nestedEnd = existing + 1;
+    while (nestedEnd < dependenciesEnd && /^(?: {4,}|\t)/.test(lines[nestedEnd]!)) nestedEnd += 1;
+    lines.splice(existing, nestedEnd - existing, replacement);
+    dependenciesEnd -= nestedEnd - existing - 1;
+  }
+
+  const next = `${lines.join("\n")}${trailingNewline ? "\n" : ""}`;
+  if (next === source) return false;
+  writeFileSync(p, next, "utf8");
   return true;
 }
 
@@ -1705,7 +1767,8 @@ function scaffoldPubspec(pkgDir: string, yaml: string): boolean {
  * `<types>/` (pure data, depends only on `nomos_types`), `<client>/` (effectful runtime clients,
  * depends on the types package + `nomos_client`), and optionally `<test>/` (the headless-harness
  * surface). Generated code lives under each package's `lib/src/generated/` (wiped per compile)
- * behind a generated-owned barrel `lib/<pkg>.dart`; pubspecs are scaffolded only if missing.
+ * behind a generated-owned barrel `lib/<pkg>.dart`; pubspec framework floors are compiler-owned while
+ * tenant versioning, publishing metadata and application dependencies survive regeneration.
  * TYPES-FILE PURITY is enforced fail-closed: a generated types file may import ONLY the
  * `nomos_types` barrel and the relative `nomos_framework.dart` — any runtime import is a compile
  * failure here, not a review comment downstream.
@@ -1760,7 +1823,7 @@ function emitDartPackages(
     if (!src.includes(DART_PACKAGE_IMPORT)) {
       fail(`generated Dart for '${fileBase}' does not carry the expected support import — codegen_dart header drifted`);
     }
-    const pure = src.replace(DART_PACKAGE_IMPORT, DART_TYPES_IMPORT);
+    const pure = src.replace(DART_PACKAGE_IMPORT, dartTypesImportFor(src));
     // PURITY, fail-closed: only the nomos_types barrel, the framework file, and SIBLING generated type files
     // (cross-domain foreignRef targets) may be imported. Runtime/bridge surfaces (nomos_client) stay out.
     for (const line of pure.split("\n")) {
@@ -1954,7 +2017,7 @@ function emitDartPackages(
   const typesBarrelPath = path.join(pkgDir(packages.types), "lib", `${packages.types}.dart`);
   writeFileSync(typesBarrelPath, typesBarrel.join("\n"), "utf8");
   written.push(typesBarrelPath);
-  scaffoldPubspec(
+  reconcilePubspec(
     pkgDir(packages.types),
     [
       `name: ${packages.types}`,
@@ -1967,6 +2030,7 @@ function emitDartPackages(
       `  nomos_types: ${NOMOS_TYPES_DEP}`,
       ``,
     ].join("\n"),
+    { nomos_types: NOMOS_TYPES_DEP },
   );
 
   // ── the CLIENT package — effectful runtime, depends on types + nomos_client ──
@@ -2110,7 +2174,7 @@ function emitDartPackages(
   const clientBarrelPath = path.join(pkgDir(packages.client), "lib", `${packages.client}.dart`);
   writeFileSync(clientBarrelPath, clientBarrel.join("\n"), "utf8");
   written.push(clientBarrelPath);
-  scaffoldPubspec(
+  reconcilePubspec(
     pkgDir(packages.client),
     [
       `name: ${packages.client}`,
@@ -2129,6 +2193,7 @@ function emitDartPackages(
       `    path: ../${packages.types} # co-emitted sibling; replace with a hosted constraint when publishing`,
       ``,
     ].join("\n"),
+    { nomos_client: NOMOS_CLIENT_DEP, nomos_flutter: NOMOS_FLUTTER_DEP },
   );
 
   // ── the TEST package (optional) — generated business scenarios, test-only dependency ──
@@ -2195,7 +2260,7 @@ function emitDartPackages(
     const testBarrelPath = path.join(pkgDir(packages.test), "lib", `${packages.test}.dart`);
     writeFileSync(testBarrelPath, testBarrel.join("\n"), "utf8");
     written.push(testBarrelPath);
-    scaffoldPubspec(
+    reconcilePubspec(
       pkgDir(packages.test),
       [
         `name: ${packages.test}`,
@@ -2217,6 +2282,7 @@ function emitDartPackages(
         `    - lib/${genRel}/${embeddedDeployName}`,
         ``,
       ].join("\n"),
+      { nomos_client: NOMOS_CLIENT_DEP },
     );
   }
 
@@ -2270,7 +2336,7 @@ function emitDartPackages(
     const compatBarrelPath = path.join(pkgDir(compatName), "lib", `${compatName}.dart`);
     writeFileSync(compatBarrelPath, compatBarrel.join("\n"), "utf8");
     written.push(compatBarrelPath);
-    scaffoldPubspec(
+    reconcilePubspec(
       pkgDir(compatName),
       [
         `name: ${compatName}`,
@@ -2341,6 +2407,8 @@ async function main(): Promise<void> {
         `${configValue.application} — compiled Nomos application composition`,
         `stage: ${emitted.outputPath}`,
         `assets: ${emitted.referencedAssets.length} local content-addressed reference(s)`,
+        `deployment: ${emitted.deploymentPackages.filter((p) => p.placement === "reference").length} serving reference package(s), ` +
+          `${emitted.deploymentPackages.filter((p) => p.placement === "payload").length} deferred payload package(s) — derived from the stage`,
         `runtime configuration: USD (the authoring .mjs does not travel)`,
       ].join("\n"));
       return;
@@ -2897,6 +2965,44 @@ async function main(): Promise<void> {
         ] as const) {
           const canonical = (composed as unknown as Record<string, unknown>)[field];
           if (!Array.isArray(canonical)) continue;
+          // A package-level language may be declared in a different source module from the
+          // aggregate its generated read indexes (workspaceSharing is the canonical case).
+          // Single-module composition then discovers the read in the language module even though
+          // that layer cannot type it. Move every targeted declaration beside its aggregate schema
+          // before filling genuinely missing package opinions. This changes no composed law: one
+          // declaration id still contributes once; it merely gives every authored USD layer a
+          // self-contained, valid read projection.
+          for (const value of canonical) {
+            if (value === null || typeof value !== "object") continue;
+            const id = (value as { id?: unknown }).id;
+            if (typeof id !== "string") continue;
+            const declarationTarget = field === "queries"
+              ? (value as { returns?: unknown }).returns
+              : (["counts", "spatials", "sums", "mins", "maxes", "deriveds", "combineds"] as const)
+                  .includes(field as never)
+                ? (value as { of?: unknown }).of
+                : undefined;
+            if (typeof declarationTarget !== "string") continue;
+            const ownerIndex = inputs.findIndex((input) =>
+              input.module.aggregates.some((aggregate) => aggregate.id === declarationTarget));
+            if (ownerIndex < 0) continue;
+            for (const [inputIndex, input] of inputs.entries()) {
+              if (inputIndex === ownerIndex) continue;
+              const module = input.module as DomainModule & Record<string, unknown>;
+              const existing = module[field];
+              if (!Array.isArray(existing)) continue;
+              (module as Record<string, unknown>)[field] = existing.filter((candidate) =>
+                candidate === null || typeof candidate !== "object" ||
+                (candidate as { id?: unknown }).id !== id);
+            }
+            const owner = inputs[ownerIndex]!.module as DomainModule & Record<string, unknown>;
+            const ownerValues = Array.isArray(owner[field]) ? owner[field] as unknown[] : [];
+            if (!ownerValues.some((candidate) =>
+              candidate !== null && typeof candidate === "object" &&
+              (candidate as { id?: unknown }).id === id)) {
+              (owner as Record<string, unknown>)[field] = [...ownerValues, value];
+            }
+          }
           const present = new Set(inputs.flatMap((input) => {
             const values = (input.module as unknown as Record<string, unknown>)[field];
             return Array.isArray(values)
@@ -2956,7 +3062,11 @@ async function main(): Promise<void> {
     ? (JSON.parse(readFileSync(lockPath, "utf8")) as StableIdLock)
     : undefined;
   const inferredRenames: { domain: string; renames: InferredRename[] }[] = [];
-  const nextLock: StableIdLock = { v: 1, domains: {} };
+  // The lock is project-wide, not package-local. Several package configs commonly live beside one
+  // application stage; compiling one must not erase the stable identity of domains owned by its siblings.
+  // Current package domains are replaced below, while absent domains remain only as continuity metadata
+  // and never leak into this package's interface, law, clients or deployment.
+  const nextLock: StableIdLock = { v: 1, domains: { ...(priorLock?.domains ?? {}) } };
   for (const mod of domainModules) {
     const identityName = mod.name;
     // The CURRENT canonical aggregate schemas (a pre-continuity manifest pass —
@@ -3052,7 +3162,9 @@ async function main(): Promise<void> {
     };
   }
   // Persist the lockfile (commit it with the law: it is how a rename keeps its
-  // identity across clean clones). Deterministic — re-compiles rewrite the same bytes.
+  // identity across clean clones). Existing project-domain order is retained, so once sibling
+  // packages are registered, recompiling them in any order rewrites the same bytes without a
+  // giant formatting-only diff in an established lock.
   writeFileSync(lockPath, JSON.stringify(nextLock, null, 2) + "\n", "utf8");
 
   // ── THE STRUCTURAL INTERFACE (#72) — directives (payload shapes) + aggregates (read
@@ -3434,24 +3546,21 @@ async function main(): Promise<void> {
     for (const ld of layeredDomains) {
       const authored = emitLayeredDomain(ld.key, ld.inputs, { applyBusinessCorrectionLayer: false });
       const canonicalLayer = canonicalLayers.get(`/Nomos/${ld.key}`);
-      // Workspace invariants include compiler-owned consequences of the complete
-      // application language (birth quota, receiving-group policy, recovery). They
-      // are not owned by one source file, so seat the canonical declaration once in
-      // the weakest package prelude instead of losing it or duplicating it. Contract
-      // implementation links are likewise a cross-module fact: the contract may be
-      // declared in one layer and implemented by an aggregate in another.
-      const emittedLayers = authored.map((emitted, index) => {
-        if (index !== 0 || canonicalLayer === undefined) return emitted;
-        const needsPackagePrelude = canonicalLayer.nomosInvariantGate !== undefined || canonicalLayer.nomosContracts !== undefined;
-        if (!needsPackagePrelude) return emitted;
+      // Authored layers carry structural declarations (aggregate/directive/query prims).
+      // Domain-level `nomos:*` values are the compiler's closure over the complete package
+      // (relation namespaces, read projections, invariant gates, contracts and language
+      // consequences), so placing partial versions on source layers lets weaker generated
+      // facts show through. Strip those derived attributes from source layers and append one
+      // explicit strongest closure layer. This is ordinary OpenUSD composition: source
+      // opinions remain inspectable and the compiler-owned overlay is the one canonical law.
+      const structuralLayers = authored.map((emitted, index) => {
+        const { path: layerPath, prims, queries, deriveds, combineds } = emitted.layer;
         const layer: UsdLayer = {
-          ...emitted.layer,
-          ...(canonicalLayer.nomosInvariantGate !== undefined
-            ? { nomosInvariantGate: canonicalLayer.nomosInvariantGate }
-            : {}),
-          ...(canonicalLayer.nomosContracts !== undefined
-            ? { nomosContracts: canonicalLayer.nomosContracts }
-            : {}),
+          path: layerPath,
+          prims,
+          ...(queries !== undefined ? { queries } : {}),
+          ...(deriveds !== undefined ? { deriveds } : {}),
+          ...(combineds !== undefined ? { combineds } : {}),
         };
         return {
           ...emitted,
@@ -3459,6 +3568,20 @@ async function main(): Promise<void> {
           usda: usdaLayerText(ld.key, emitted.name, layer, ld.inputs[index]!.module, new Set()),
         };
       });
+      const closureLayers = canonicalLayer === undefined
+        ? []
+        : (() => {
+            const layer: UsdLayer = canonicalLayer;
+            const name = "__nomos_package_closure";
+            const canonicalModule = domainModules.find((module) =>
+              (module.domain ?? module.name) === ld.key);
+            return [{
+              name,
+              layer,
+              usda: usdaLayerText(ld.key, name, layer, canonicalModule, new Set()),
+            }];
+          })();
+      const emittedLayers = [...structuralLayers, ...closureLayers];
       for (const emitted of emittedLayers) {
         const base = `${safe(ld.key)}--${safe(emitted.name)}`;
         pendingWrites.push({ path: path.join(layersDir, `${base}.usda`), text: emitted.usda });
@@ -3485,7 +3608,7 @@ async function main(): Promise<void> {
     }
     for (const w of pendingWrites) writeFileSync(w.path, w.text, "utf8");
     layeredRootPath = path.join(outDir, `${cfg.name}.layered.usda`);
-    writeFileSync(layeredRootPath, layeredRootUsda(relPaths, flat), "utf8");
+    writeFileSync(layeredRootPath, layeredRootUsda(relPaths), "utf8");
     layeredFileCount = relPaths.length;
 
     const usdcat = resolveUsdcat();
@@ -3634,6 +3757,9 @@ async function main(): Promise<void> {
   // agent who simply cats the build output.
   const summary = {
     package: cfg.name,
+    // Binds the deploy body to the published package asset consumed by an application stage. This is the
+    // content identity of the composed source layers; domainHash below is the runtime package-law hash.
+    sourceIdentity: composedUsdIdentity!,
     domainHash,
     domains: presentationDomainModules.map((m) => ({
       domain: m.domain ?? m.name,

package/src/framework/home.ts

@@ -81,7 +81,11 @@ export const ReceivingGroup = aggregate("NomosInternalReceivingGroup7c1f5e", {
   workspaceName: t.string().merge(Lww),
   /** ISO-8601, caller-stamped (determinism — no clock in the plan). */
   bornAt: t.string().merge(Lww),
-}, { cap: 1 }).public();
+// The group's genesis seats its controller in OWNED_READ_RELATION below. Declaring that same capability
+// here makes the law's coarse pack gate recognise the seat, so a newly enrolled device can clone its own
+// receiving group before any tenant records or tenant-authored grants exist. This remains ordinary,
+// replayable Zanzibar state: revocation removes the seat; there is no kernel-level founder bypass.
+}, { cap: 1 }).readableBy(OWNED_READ_RELATION);
 
 /**
  * The framework-owned device lifecycle policy for one receiving group. This is deliberately data, not a
@@ -177,6 +181,7 @@ export const seedReceivingGroup = directive("nomosInternalSeedReceivingGroup7c1f
 export const receivingGroupNameBindsPrincipal = workspaceInvariant("ReceivingGroupNameBindsPrincipal")
   .on("nomosInternalSeedReceivingGroup7c1f5e")
   .reads(() => [refAs("group", "NomosInternalReceivingGroup7c1f5e", RECEIVING_GROUP_ID)])
+  .declassify("the receiving-group address is a public hash of its stable principal; refusing a mismatch reveals no private field")
   .assert(({ group }) => {
     const g = (group ?? {}) as { principal?: string; workspaceName?: string };
     const expected = RECEIVING_GROUP_NAME_PREFIX
@@ -196,6 +201,7 @@ const receivingGroupPolicyRefs = () => [
 export const receivingGroupRejectsKeylessAdditionalDevice = workspaceInvariant("ReceivingGroupRejectsKeylessAdditionalDevice")
   .on("enrollFirstDevice")
   .reads(receivingGroupPolicyRefs)
+  .declassify("device enrollment deliberately reveals that this receiving group has already completed first-device bootstrap")
   .assert(({ group }) => typeof group?.principal !== "string" || group.principal.length === 0
     ? { accept: true }
     : { reject: "receiving-group-additional-device-requires-current-device-or-guardian" });

package/src/law_check.ts

@@ -409,6 +409,14 @@ function unreadPayloadFindings(domain: string, dir: Directive<unknown>, probe: P
   // the gate object from a named payload id field (per-record authz). Excluding it keeps a real
   // gate-consumed field from being flagged dead (the todo-pro `shareTodo.listId` case).
   const gateConsumed = new Set<string>();
+  // Compiler-owned law may deliberately consume proof material only in an invariant. The
+  // plan must not persist a signature merely to satisfy this lint, and the tenant must not
+  // receive a warning about private security machinery. This is internal lowering metadata,
+  // not an authored escape hatch.
+  for (const field of (dir as { nomosInvariantConsumedPayloadFields?: readonly string[] })
+    .nomosInvariantConsumedPayloadFields ?? []) {
+    gateConsumed.add(field);
+  }
   const objectFromField = (dir as { requiresRelationGate?: { objectFrom?: { idField?: string } } })
     .requiresRelationGate?.objectFrom?.idField;
   if (typeof objectFromField === "string") gateConsumed.add(objectFromField);

package/src/usd_layers.ts

@@ -83,6 +83,11 @@ export const NOMOS_USD_LAYERED_PACKAGE_FORMAT = "nomos.usd-layered-package.v1";
 /** The self-contained ledger/runtime stage: native law plus indexed executable plan assets. */
 export const NOMOS_USD_PLAN_PACKAGE_FORMAT = "nomos.openusd-plan-package.v2";
 
+/** Append generated lines without turning a large law into function arguments. */
+function appendLines(target: string[], lines: readonly string[]): void {
+  for (const line of lines) target.push(line);
+}
+
 // ── small codecs ───────────────────────────────────────────────────────────────────
 
 /** Escape a string for a double-quoted usda string literal. */
@@ -201,7 +206,8 @@ export function nativeValueLines(name: string, value: unknown, indent: string):
       const position = `i${String(index).padStart(6, "0")}`;
       const identity = key === undefined ? position : `${position}:k${keyHex(key)}`;
       if (child !== null && typeof child === "object") {
-        lines.push("", ...emitContainer(identity.replace(/:/g, "_"), child, `${at}    `));
+        lines.push("");
+        appendLines(lines, emitContainer(identity.replace(/:/g, "_"), child, `${at}    `));
       } else {
         lines.push(scalarLine(child, identity, `${at}    `));
       }
@@ -210,11 +216,9 @@ export function nativeValueLines(name: string, value: unknown, indent: string):
     return lines;
   };
   const rootName = `__nms_${primName(name)}_${hash}`;
-  return [
-    `${indent}custom string nomos:value:${name} = ${usdaString(hash)}`,
-    "",
-    ...emitContainer(rootName, value, indent),
-  ];
+  const lines = [`${indent}custom string nomos:value:${name} = ${usdaString(hash)}`, ""];
+  appendLines(lines, emitContainer(rootName, value, indent));
+  return lines;
 }
 
 /** Field→driver map with keys sorted (the canonical schema shape `manifest.ts` emits). */
@@ -243,7 +247,11 @@ function domainLayerAttrLines(domain: string, layer: UsdLayer, indent: string):
     ["eraCertGate", layer.nomosEraCertGate], ["valueObjects", layer.nomosValueObjects],
     ["contracts", layer.nomosContracts], ["foreignRefs", layer.nomosForeignRefs], ["flowGate", layer.nomosFlowGate],
   ];
-  for (const [name, value] of values) if (value !== undefined) attrs.push("", ...nativeValueLines(name, value, indent));
+  for (const [name, value] of values) {
+    if (value === undefined) continue;
+    attrs.push("");
+    appendLines(attrs, nativeValueLines(name, value, indent));
+  }
   return attrs;
 }
 
@@ -379,7 +387,7 @@ export function usdaLayerText(
       for (const [field, driver] of Object.entries(prim.schema)) {
         body.push(`${ind3}custom string nomos:driver:${fieldToken(field)} = ${usdaString(driverToken(driver))}`);
       }
-      body.push(...relationLines(domainScope, aggById.get(prim.type), ind3));
+      appendLines(body, relationLines(domainScope, aggById.get(prim.type), ind3));
     } else {
       body.push(
         `${ind3}custom string nomos:kind = "directive"`,
@@ -392,13 +400,16 @@ export function usdaLayerText(
         body.push(`${ind3}custom string[] nomos:reads = ${usdaStringArray(prim.reads)}`);
       }
       if (prim.emits !== undefined) {
-        body.push("", ...nativeValueLines("emits", prim.emits, ind3));
+        body.push("");
+        appendLines(body, nativeValueLines("emits", prim.emits, ind3));
       }
       if (prim.secondaryOutputs !== undefined) {
-        body.push("", ...nativeValueLines("secondaryOutputs", prim.secondaryOutputs, ind3));
+        body.push("");
+        appendLines(body, nativeValueLines("secondaryOutputs", prim.secondaryOutputs, ind3));
       }
       if (prim.payloadJsonSchema !== undefined) {
-        body.push("", ...nativeValueLines("payloadJsonSchema", prim.payloadJsonSchema, ind3));
+        body.push("");
+        appendLines(body, nativeValueLines("payloadJsonSchema", prim.payloadJsonSchema, ind3));
       }
     }
     body.push(`${ind2}}`, ``);
@@ -424,7 +435,9 @@ export function usdaLayerText(
       `${ind3}custom string nomos:id = ${usdaString(d.id)}`,
       `${ind3}custom string nomos:of = ${usdaString(d.of)}`,
       ``,
-      ...nativeValueLines("returns", d.returns, ind3),
+    );
+    appendLines(body, nativeValueLines("returns", d.returns, ind3));
+    body.push(
       `${ind2}}`,
       ``,
     );
@@ -439,7 +452,9 @@ export function usdaLayerText(
       `${ind3}custom string nomos:refField = ${usdaString(c.refField)}`,
       `${ind3}custom string nomos:readsFrom = ${usdaString(c.reads)}`,
       ``,
-      ...nativeValueLines("returns", c.returns, ind3),
+    );
+    appendLines(body, nativeValueLines("returns", c.returns, ind3));
+    body.push(
       `${ind2}}`,
       ``,
     );
@@ -447,7 +462,7 @@ export function usdaLayerText(
   // Drop the trailing blank line inside the scope.
   if (body[body.length - 1] === "") body.pop();
 
-  return [
+  const lines = [
     `#usda 1.0`,
     `(`,
     `    customLayerData = {`,
@@ -461,14 +476,17 @@ export function usdaLayerText(
     `{`,
     `    def Scope ${usdaString(primName(domain))}`,
     `    {`,
-    // Stable ids + holon-owned manifests: native layer-level law values.
-    ...domainLayerAttrLines(domain, layer, "        "),
-    ``,
-    ...body,
+  ];
+  // Stable ids + holon-owned manifests: native layer-level law values.
+  appendLines(lines, domainLayerAttrLines(domain, layer, "        "));
+  lines.push(``);
+  appendLines(lines, body);
+  lines.push(
     `    }`,
     `}`,
     ``,
-  ].join("\n");
+  );
+  return lines.join("\n");
 }
 
 /**
@@ -482,26 +500,18 @@ export function layeredRootUsda(
   composed?: UsdDocument,
 ): string {
   const strongestFirst = [...sublayerRelPathsWeakToStrong].reverse();
-  const composedDomainOpinions =
-    composed === undefined || composed.layers.length === 0
-      ? []
-      : [
-          ``,
-          `over "Nomos"`,
-          `{`,
-          ...composed.layers.flatMap((layer) => {
-            const domain = layer.path.slice(layer.path.lastIndexOf("/") + 1);
-            return [
-              `    over ${usdaString(primName(domain))}`,
-              `    {`,
-              ...domainLayerAttrLines(domain, layer, "        "),
-              `    }`,
-            ];
-          }),
-          `}`,
-          ``,
-        ];
-  return [
+  const composedDomainOpinions: string[] = [];
+  if (composed !== undefined && composed.layers.length > 0) {
+    composedDomainOpinions.push(``, `over "Nomos"`, `{`);
+    for (const layer of composed.layers) {
+      const domain = layer.path.slice(layer.path.lastIndexOf("/") + 1);
+      composedDomainOpinions.push(`    over ${usdaString(primName(domain))}`, `    {`);
+      appendLines(composedDomainOpinions, domainLayerAttrLines(domain, layer, "        "));
+      composedDomainOpinions.push(`    }`);
+    }
+    composedDomainOpinions.push(`}`, ``);
+  }
+  const lines = [
     `#usda 1.0`,
     `(`,
     `    doc = """Nomos layered domain package. subLayers are STRONGEST-FIRST (USD layer-stack`,
@@ -512,14 +522,17 @@ export function layeredRootUsda(
     `        string "nomos:format" = ${usdaString(NOMOS_USD_LAYERED_PACKAGE_FORMAT)}`,
     `    }`,
     `    subLayers = [`,
-    ...strongestFirst.map(
-      (p, i) => `        @${p}@${i < strongestFirst.length - 1 ? "," : ""}`,
-    ),
+  ];
+  strongestFirst.forEach((p, index) => {
+    lines.push(`        @${p}@${index < strongestFirst.length - 1 ? "," : ""}`);
+  });
+  lines.push(
     `    ]`,
     `)`,
-    ...composedDomainOpinions,
-    ``,
-  ].join("\n");
+  );
+  appendLines(lines, composedDomainOpinions);
+  lines.push(``);
+  return lines.join("\n");
 }
 
 export interface UsdPlanAsset {
@@ -579,7 +592,8 @@ export function nativePlanPackageUsda(
       if (opened && balance === 0) { end = index; break; }
     }
     if (end < 0) throw new Error(`usd-layers: native domain '${domain}' has unbalanced scopes`);
-    domainBlocks.push(...lines.slice(start, end + 1), "");
+    appendLines(domainBlocks, lines.slice(start, end + 1));
+    domainBlocks.push("");
   }
   if (domainBlocks[domainBlocks.length - 1] === "") domainBlocks.pop();
 
@@ -617,7 +631,7 @@ export function nativePlanPackageUsda(
   if (runtime[runtime.length - 1] === "") runtime.pop();
   runtime.push(`    }`, `}`);
 
-  return [
+  const lines = [
     `#usda 1.0`,
     `(`,
     `    customLayerData = {`,
@@ -627,12 +641,15 @@ export function nativePlanPackageUsda(
     ``,
     `def Scope "Nomos"`,
     `{`,
-    ...domainBlocks,
+  ];
+  appendLines(lines, domainBlocks);
+  lines.push(
     `}`,
     ``,
-    ...runtime,
-    ``,
-  ].join("\n");
+  );
+  appendLines(lines, runtime);
+  lines.push(``);
+  return lines.join("\n");
 }
 
 // ── the ordered opinion-map fold (flatten) ───────────────────────────────────────────

package/src/workspace_sharing.ts

@@ -166,8 +166,8 @@ export function workspaceSharing(options: WorkspaceSharingOptions): WorkspaceSha
     businessBirthInternal: true as const,
   };
   const b64 = z.string().regex(/^[A-Za-z0-9+/]+={0,2}$/, "expected base64");
-  const redeem = nomosImplementationDetail(
-    directive(redeemId)
+  const redeem = nomosImplementationDetail({
+    ...directive(redeemId)
       .mutates(options.orders)
       .payload(z.object({
         orderId: z.string().min(1),
@@ -199,7 +199,9 @@ export function workspaceSharing(options: WorkspaceSharingOptions): WorkspaceSha
       })
       .alsoEnsures(RelationTuple)
       .alsoEnsures(NomosInvitationClaim),
-  );
+    // Possession proof is verified by NomosInvitationGate and intentionally never persisted.
+    nomosInvariantConsumedPayloadFields: ["invitationSignature"] as const,
+  });
   const gate = workspaceInvariant(`NomosInvitationGate:${options.orders.id}`)
     .on(redeemId)
     .reads(({ intent }) => [