@githolon/dsl 0.102.1 → 0.102.3

package/src/compile_package_main.ts

@@ -262,8 +262,9 @@ interface PackageConfig {
          *   • `test`   — optional; generated business scenarios for widget/integration tests.
          * The layering line: UI code depends on `types`; composition/runtime code on `client`;
          * generated TYPES may flow to the UI, generated CLIENTS may not.
-         * Each package's `pubspec.yaml` is scaffolded ONLY IF MISSING (tenant-owned versioning);
-         * barrels + `lib/src/generated/` are generated-owned and rewritten every compile.
+         * Each package's `pubspec.yaml` keeps tenant-owned versioning/publishing metadata and custom
+         * dependencies; Nomos-owned framework dependency floors are reconciled on every compile.
+         * Barrels + `lib/src/generated/` are generated-owned and rewritten every compile.
          * Requires `support: "package"` (vendored mode contradicts pub-package layering).
          */
         readonly packages?: {
@@ -1298,12 +1299,27 @@ function emitDart(
 // ── the LAYERED-PACKAGES Dart emit (dart.packages: blast-radius isolation) ────────
 
 /** The pure-core support import generated TYPES files carry in layered-packages mode. */
-const DART_TYPES_IMPORT = [
-  `import 'package:nomos_types/nomos_types.dart';`,
-  `import 'package:nomos_types/src/nomos_ref.dart' show NmsInternalNomosRefs;`,
-  `import 'package:nomos_types/src/foreign_ref.dart' show NmsInternalForeignRefs;`,
-  `import 'package:nomos_types/src/invitation.dart' show NmsInternalInvitations, NmsInternalRecipients;`,
-].join("\n");
+const dartTypesImportFor = (generatedSource: string): string => {
+  const lines = [
+    `import 'package:nomos_types/nomos_types.dart';`,
+    ...(generatedSource.includes("NmsInternalNomosRefs.")
+      ? [`import 'package:nomos_types/src/nomos_ref.dart' show NmsInternalNomosRefs;`]
+      : []),
+    ...(generatedSource.includes("NmsInternalForeignRefs.")
+      ? [`import 'package:nomos_types/src/foreign_ref.dart' show NmsInternalForeignRefs;`]
+      : []),
+  ];
+  const invitationHelpers = [
+    ...(generatedSource.includes("NmsInternalInvitations.") ? ["NmsInternalInvitations"] : []),
+    ...(generatedSource.includes("NmsInternalRecipients.") ? ["NmsInternalRecipients"] : []),
+  ];
+  if (invitationHelpers.length > 0) {
+    lines.push(
+      `import 'package:nomos_types/src/invitation.dart' show ${invitationHelpers.join(", ")};`,
+    );
+  }
+  return lines.join("\n");
+};
 /** Version constraints the scaffolded pubspecs pin — move together with the Dart packages' releases.
  *  Caret on 0.x is EXACT-MINOR (`^0.45.0` = `<0.46.0`), so these must track the CURRENT release, not
  *  just the floor generated code needs — a lagging pin forces tenants into dependency_overrides. */
@@ -1313,8 +1329,8 @@ const NOMOS_TYPES_DEP = "^0.8.0";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.64.0";
-const NOMOS_FLUTTER_DEP = "^0.63.0";
+const NOMOS_CLIENT_DEP = "^0.64.1";
+const NOMOS_FLUTTER_DEP = "^0.63.1";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).
@@ -1690,13 +1706,59 @@ function cursedNameHints(declared: ReadonlySet<string>, names: Readonly<Record<s
     .sort((a, b) => b.length - a.length);
 }
 
-/** Scaffold a pubspec ONLY IF MISSING — the tenant owns versioning/publishing; regeneration must
- *  never clobber their bumps. Returns true when written. */
-function scaffoldPubspec(pkgDir: string, yaml: string): boolean {
+/** Scaffold a pubspec when missing, otherwise reconcile only the dependencies owned by Nomos.
+ *  Tenant versioning, publishing metadata and application dependencies remain untouched, while a
+ *  regenerated client can never silently retain an obsolete framework floor. */
+function reconcilePubspec(
+  pkgDir: string,
+  yaml: string,
+  managedDependencies: Readonly<Record<string, string>> = {},
+): boolean {
   const p = path.join(pkgDir, "pubspec.yaml");
-  if (existsSync(p)) return false;
-  mkdirSync(pkgDir, { recursive: true });
-  writeFileSync(p, yaml, "utf8");
+  if (!existsSync(p)) {
+    mkdirSync(pkgDir, { recursive: true });
+    writeFileSync(p, yaml, "utf8");
+    return true;
+  }
+  if (Object.keys(managedDependencies).length === 0) return false;
+
+  const source = readFileSync(p, "utf8");
+  const trailingNewline = source.endsWith("\n");
+  const lines = source.split(/\r?\n/);
+  if (trailingNewline) lines.pop();
+  let dependenciesStart = lines.findIndex((line) => /^dependencies:\s*(?:#.*)?$/.test(line));
+  if (dependenciesStart < 0) {
+    const before = lines.findIndex((line) => /^dev_dependencies:\s*(?:#.*)?$/.test(line));
+    dependenciesStart = before < 0 ? lines.length : before;
+    lines.splice(dependenciesStart, 0, "dependencies:");
+  }
+  let dependenciesEnd = dependenciesStart + 1;
+  while (dependenciesEnd < lines.length) {
+    const line = lines[dependenciesEnd]!;
+    if (line.trim() !== "" && !/^\s/.test(line) && !/^\s*#/.test(line)) break;
+    dependenciesEnd += 1;
+  }
+
+  for (const [name, constraint] of Object.entries(managedDependencies)) {
+    const prefix = `  ${name}:`;
+    const existing = lines.findIndex(
+      (line, index) => index > dependenciesStart && index < dependenciesEnd && line.startsWith(prefix),
+    );
+    const replacement = `  ${name}: ${constraint}`;
+    if (existing < 0) {
+      lines.splice(dependenciesEnd, 0, replacement);
+      dependenciesEnd += 1;
+      continue;
+    }
+    let nestedEnd = existing + 1;
+    while (nestedEnd < dependenciesEnd && /^(?: {4,}|\t)/.test(lines[nestedEnd]!)) nestedEnd += 1;
+    lines.splice(existing, nestedEnd - existing, replacement);
+    dependenciesEnd -= nestedEnd - existing - 1;
+  }
+
+  const next = `${lines.join("\n")}${trailingNewline ? "\n" : ""}`;
+  if (next === source) return false;
+  writeFileSync(p, next, "utf8");
   return true;
 }
 
@@ -1705,7 +1767,8 @@ function scaffoldPubspec(pkgDir: string, yaml: string): boolean {
  * `<types>/` (pure data, depends only on `nomos_types`), `<client>/` (effectful runtime clients,
  * depends on the types package + `nomos_client`), and optionally `<test>/` (the headless-harness
  * surface). Generated code lives under each package's `lib/src/generated/` (wiped per compile)
- * behind a generated-owned barrel `lib/<pkg>.dart`; pubspecs are scaffolded only if missing.
+ * behind a generated-owned barrel `lib/<pkg>.dart`; pubspec framework floors are compiler-owned while
+ * tenant versioning, publishing metadata and application dependencies survive regeneration.
  * TYPES-FILE PURITY is enforced fail-closed: a generated types file may import ONLY the
  * `nomos_types` barrel and the relative `nomos_framework.dart` — any runtime import is a compile
  * failure here, not a review comment downstream.
@@ -1760,7 +1823,7 @@ function emitDartPackages(
     if (!src.includes(DART_PACKAGE_IMPORT)) {
       fail(`generated Dart for '${fileBase}' does not carry the expected support import — codegen_dart header drifted`);
     }
-    const pure = src.replace(DART_PACKAGE_IMPORT, DART_TYPES_IMPORT);
+    const pure = src.replace(DART_PACKAGE_IMPORT, dartTypesImportFor(src));
     // PURITY, fail-closed: only the nomos_types barrel, the framework file, and SIBLING generated type files
     // (cross-domain foreignRef targets) may be imported. Runtime/bridge surfaces (nomos_client) stay out.
     for (const line of pure.split("\n")) {
@@ -1954,7 +2017,7 @@ function emitDartPackages(
   const typesBarrelPath = path.join(pkgDir(packages.types), "lib", `${packages.types}.dart`);
   writeFileSync(typesBarrelPath, typesBarrel.join("\n"), "utf8");
   written.push(typesBarrelPath);
-  scaffoldPubspec(
+  reconcilePubspec(
     pkgDir(packages.types),
     [
       `name: ${packages.types}`,
@@ -1967,6 +2030,7 @@ function emitDartPackages(
       `  nomos_types: ${NOMOS_TYPES_DEP}`,
       ``,
     ].join("\n"),
+    { nomos_types: NOMOS_TYPES_DEP },
   );
 
   // ── the CLIENT package — effectful runtime, depends on types + nomos_client ──
@@ -2110,7 +2174,7 @@ function emitDartPackages(
   const clientBarrelPath = path.join(pkgDir(packages.client), "lib", `${packages.client}.dart`);
   writeFileSync(clientBarrelPath, clientBarrel.join("\n"), "utf8");
   written.push(clientBarrelPath);
-  scaffoldPubspec(
+  reconcilePubspec(
     pkgDir(packages.client),
     [
       `name: ${packages.client}`,
@@ -2129,6 +2193,7 @@ function emitDartPackages(
       `    path: ../${packages.types} # co-emitted sibling; replace with a hosted constraint when publishing`,
       ``,
     ].join("\n"),
+    { nomos_client: NOMOS_CLIENT_DEP, nomos_flutter: NOMOS_FLUTTER_DEP },
   );
 
   // ── the TEST package (optional) — generated business scenarios, test-only dependency ──
@@ -2195,7 +2260,7 @@ function emitDartPackages(
     const testBarrelPath = path.join(pkgDir(packages.test), "lib", `${packages.test}.dart`);
     writeFileSync(testBarrelPath, testBarrel.join("\n"), "utf8");
     written.push(testBarrelPath);
-    scaffoldPubspec(
+    reconcilePubspec(
       pkgDir(packages.test),
       [
         `name: ${packages.test}`,
@@ -2217,6 +2282,7 @@ function emitDartPackages(
         `    - lib/${genRel}/${embeddedDeployName}`,
         ``,
       ].join("\n"),
+      { nomos_client: NOMOS_CLIENT_DEP },
     );
   }
 
@@ -2270,7 +2336,7 @@ function emitDartPackages(
     const compatBarrelPath = path.join(pkgDir(compatName), "lib", `${compatName}.dart`);
     writeFileSync(compatBarrelPath, compatBarrel.join("\n"), "utf8");
     written.push(compatBarrelPath);
-    scaffoldPubspec(
+    reconcilePubspec(
       pkgDir(compatName),
       [
         `name: ${compatName}`,
@@ -2341,6 +2407,8 @@ async function main(): Promise<void> {
         `${configValue.application} — compiled Nomos application composition`,
         `stage: ${emitted.outputPath}`,
         `assets: ${emitted.referencedAssets.length} local content-addressed reference(s)`,
+        `deployment: ${emitted.deploymentPackages.filter((p) => p.placement === "reference").length} serving reference package(s), ` +
+          `${emitted.deploymentPackages.filter((p) => p.placement === "payload").length} deferred payload package(s) — derived from the stage`,
         `runtime configuration: USD (the authoring .mjs does not travel)`,
       ].join("\n"));
       return;
@@ -2897,6 +2965,44 @@ async function main(): Promise<void> {
         ] as const) {
           const canonical = (composed as unknown as Record<string, unknown>)[field];
           if (!Array.isArray(canonical)) continue;
+          // A package-level language may be declared in a different source module from the
+          // aggregate its generated read indexes (workspaceSharing is the canonical case).
+          // Single-module composition then discovers the read in the language module even though
+          // that layer cannot type it. Move every targeted declaration beside its aggregate schema
+          // before filling genuinely missing package opinions. This changes no composed law: one
+          // declaration id still contributes once; it merely gives every authored USD layer a
+          // self-contained, valid read projection.
+          for (const value of canonical) {
+            if (value === null || typeof value !== "object") continue;
+            const id = (value as { id?: unknown }).id;
+            if (typeof id !== "string") continue;
+            const declarationTarget = field === "queries"
+              ? (value as { returns?: unknown }).returns
+              : (["counts", "spatials", "sums", "mins", "maxes", "deriveds", "combineds"] as const)
+                  .includes(field as never)
+                ? (value as { of?: unknown }).of
+                : undefined;
+            if (typeof declarationTarget !== "string") continue;
+            const ownerIndex = inputs.findIndex((input) =>
+              input.module.aggregates.some((aggregate) => aggregate.id === declarationTarget));
+            if (ownerIndex < 0) continue;
+            for (const [inputIndex, input] of inputs.entries()) {
+              if (inputIndex === ownerIndex) continue;
+              const module = input.module as DomainModule & Record<string, unknown>;
+              const existing = module[field];
+              if (!Array.isArray(existing)) continue;
+              (module as Record<string, unknown>)[field] = existing.filter((candidate) =>
+                candidate === null || typeof candidate !== "object" ||
+                (candidate as { id?: unknown }).id !== id);
+            }
+            const owner = inputs[ownerIndex]!.module as DomainModule & Record<string, unknown>;
+            const ownerValues = Array.isArray(owner[field]) ? owner[field] as unknown[] : [];
+            if (!ownerValues.some((candidate) =>
+              candidate !== null && typeof candidate === "object" &&
+              (candidate as { id?: unknown }).id === id)) {
+              (owner as Record<string, unknown>)[field] = [...ownerValues, value];
+            }
+          }
           const present = new Set(inputs.flatMap((input) => {
             const values = (input.module as unknown as Record<string, unknown>)[field];
             return Array.isArray(values)
@@ -2956,7 +3062,11 @@ async function main(): Promise<void> {
     ? (JSON.parse(readFileSync(lockPath, "utf8")) as StableIdLock)
     : undefined;
   const inferredRenames: { domain: string; renames: InferredRename[] }[] = [];
-  const nextLock: StableIdLock = { v: 1, domains: {} };
+  // The lock is project-wide, not package-local. Several package configs commonly live beside one
+  // application stage; compiling one must not erase the stable identity of domains owned by its siblings.
+  // Current package domains are replaced below, while absent domains remain only as continuity metadata
+  // and never leak into this package's interface, law, clients or deployment.
+  const nextLock: StableIdLock = { v: 1, domains: { ...(priorLock?.domains ?? {}) } };
   for (const mod of domainModules) {
     const identityName = mod.name;
     // The CURRENT canonical aggregate schemas (a pre-continuity manifest pass —
@@ -3052,7 +3162,9 @@ async function main(): Promise<void> {
     };
   }
   // Persist the lockfile (commit it with the law: it is how a rename keeps its
-  // identity across clean clones). Deterministic — re-compiles rewrite the same bytes.
+  // identity across clean clones). Existing project-domain order is retained, so once sibling
+  // packages are registered, recompiling them in any order rewrites the same bytes without a
+  // giant formatting-only diff in an established lock.
   writeFileSync(lockPath, JSON.stringify(nextLock, null, 2) + "\n", "utf8");
 
   // ── THE STRUCTURAL INTERFACE (#72) — directives (payload shapes) + aggregates (read
@@ -3434,24 +3546,21 @@ async function main(): Promise<void> {
     for (const ld of layeredDomains) {
       const authored = emitLayeredDomain(ld.key, ld.inputs, { applyBusinessCorrectionLayer: false });
       const canonicalLayer = canonicalLayers.get(`/Nomos/${ld.key}`);
-      // Workspace invariants include compiler-owned consequences of the complete
-      // application language (birth quota, receiving-group policy, recovery). They
-      // are not owned by one source file, so seat the canonical declaration once in
-      // the weakest package prelude instead of losing it or duplicating it. Contract
-      // implementation links are likewise a cross-module fact: the contract may be
-      // declared in one layer and implemented by an aggregate in another.
-      const emittedLayers = authored.map((emitted, index) => {
-        if (index !== 0 || canonicalLayer === undefined) return emitted;
-        const needsPackagePrelude = canonicalLayer.nomosInvariantGate !== undefined || canonicalLayer.nomosContracts !== undefined;
-        if (!needsPackagePrelude) return emitted;
+      // Authored layers carry structural declarations (aggregate/directive/query prims).
+      // Domain-level `nomos:*` values are the compiler's closure over the complete package
+      // (relation namespaces, read projections, invariant gates, contracts and language
+      // consequences), so placing partial versions on source layers lets weaker generated
+      // facts show through. Strip those derived attributes from source layers and append one
+      // explicit strongest closure layer. This is ordinary OpenUSD composition: source
+      // opinions remain inspectable and the compiler-owned overlay is the one canonical law.
+      const structuralLayers = authored.map((emitted, index) => {
+        const { path: layerPath, prims, queries, deriveds, combineds } = emitted.layer;
         const layer: UsdLayer = {
-          ...emitted.layer,
-          ...(canonicalLayer.nomosInvariantGate !== undefined
-            ? { nomosInvariantGate: canonicalLayer.nomosInvariantGate }
-            : {}),
-          ...(canonicalLayer.nomosContracts !== undefined
-            ? { nomosContracts: canonicalLayer.nomosContracts }
-            : {}),
+          path: layerPath,
+          prims,
+          ...(queries !== undefined ? { queries } : {}),
+          ...(deriveds !== undefined ? { deriveds } : {}),
+          ...(combineds !== undefined ? { combineds } : {}),
         };
         return {
           ...emitted,
@@ -3459,6 +3568,20 @@ async function main(): Promise<void> {
           usda: usdaLayerText(ld.key, emitted.name, layer, ld.inputs[index]!.module, new Set()),
         };
       });
+      const closureLayers = canonicalLayer === undefined
+        ? []
+        : (() => {
+            const layer: UsdLayer = canonicalLayer;
+            const name = "__nomos_package_closure";
+            const canonicalModule = domainModules.find((module) =>
+              (module.domain ?? module.name) === ld.key);
+            return [{
+              name,
+              layer,
+              usda: usdaLayerText(ld.key, name, layer, canonicalModule, new Set()),
+            }];
+          })();
+      const emittedLayers = [...structuralLayers, ...closureLayers];
       for (const emitted of emittedLayers) {
         const base = `${safe(ld.key)}--${safe(emitted.name)}`;
         pendingWrites.push({ path: path.join(layersDir, `${base}.usda`), text: emitted.usda });
@@ -3485,7 +3608,7 @@ async function main(): Promise<void> {
     }
     for (const w of pendingWrites) writeFileSync(w.path, w.text, "utf8");
     layeredRootPath = path.join(outDir, `${cfg.name}.layered.usda`);
-    writeFileSync(layeredRootPath, layeredRootUsda(relPaths, flat), "utf8");
+    writeFileSync(layeredRootPath, layeredRootUsda(relPaths), "utf8");
     layeredFileCount = relPaths.length;
 
     const usdcat = resolveUsdcat();
@@ -3634,6 +3757,9 @@ async function main(): Promise<void> {
   // agent who simply cats the build output.
   const summary = {
     package: cfg.name,
+    // Binds the deploy body to the published package asset consumed by an application stage. This is the
+    // content identity of the composed source layers; domainHash below is the runtime package-law hash.
+    sourceIdentity: composedUsdIdentity!,
     domainHash,
     domains: presentationDomainModules.map((m) => ({
       domain: m.domain ?? m.name,

package/src/framework/home.ts

@@ -81,7 +81,11 @@ export const ReceivingGroup = aggregate("NomosInternalReceivingGroup7c1f5e", {
   workspaceName: t.string().merge(Lww),
   /** ISO-8601, caller-stamped (determinism — no clock in the plan). */
   bornAt: t.string().merge(Lww),
-}, { cap: 1 }).public();
+// The group's genesis seats its controller in OWNED_READ_RELATION below. Declaring that same capability
+// here makes the law's coarse pack gate recognise the seat, so a newly enrolled device can clone its own
+// receiving group before any tenant records or tenant-authored grants exist. This remains ordinary,
+// replayable Zanzibar state: revocation removes the seat; there is no kernel-level founder bypass.
+}, { cap: 1 }).readableBy(OWNED_READ_RELATION);
 
 /**
  * The framework-owned device lifecycle policy for one receiving group. This is deliberately data, not a
@@ -177,6 +181,7 @@ export const seedReceivingGroup = directive("nomosInternalSeedReceivingGroup7c1f
 export const receivingGroupNameBindsPrincipal = workspaceInvariant("ReceivingGroupNameBindsPrincipal")
   .on("nomosInternalSeedReceivingGroup7c1f5e")
   .reads(() => [refAs("group", "NomosInternalReceivingGroup7c1f5e", RECEIVING_GROUP_ID)])
+  .declassify("the receiving-group address is a public hash of its stable principal; refusing a mismatch reveals no private field")
   .assert(({ group }) => {
     const g = (group ?? {}) as { principal?: string; workspaceName?: string };
     const expected = RECEIVING_GROUP_NAME_PREFIX
@@ -196,6 +201,7 @@ const receivingGroupPolicyRefs = () => [
 export const receivingGroupRejectsKeylessAdditionalDevice = workspaceInvariant("ReceivingGroupRejectsKeylessAdditionalDevice")
   .on("enrollFirstDevice")
   .reads(receivingGroupPolicyRefs)
+  .declassify("device enrollment deliberately reveals that this receiving group has already completed first-device bootstrap")
   .assert(({ group }) => typeof group?.principal !== "string" || group.principal.length === 0
     ? { accept: true }
     : { reject: "receiving-group-additional-device-requires-current-device-or-guardian" });

package/src/law_check.ts

@@ -409,6 +409,14 @@ function unreadPayloadFindings(domain: string, dir: Directive<unknown>, probe: P
   // the gate object from a named payload id field (per-record authz). Excluding it keeps a real
   // gate-consumed field from being flagged dead (the todo-pro `shareTodo.listId` case).
   const gateConsumed = new Set<string>();
+  // Compiler-owned law may deliberately consume proof material only in an invariant. The
+  // plan must not persist a signature merely to satisfy this lint, and the tenant must not
+  // receive a warning about private security machinery. This is internal lowering metadata,
+  // not an authored escape hatch.
+  for (const field of (dir as { nomosInvariantConsumedPayloadFields?: readonly string[] })
+    .nomosInvariantConsumedPayloadFields ?? []) {
+    gateConsumed.add(field);
+  }
   const objectFromField = (dir as { requiresRelationGate?: { objectFrom?: { idField?: string } } })
     .requiresRelationGate?.objectFrom?.idField;
   if (typeof objectFromField === "string") gateConsumed.add(objectFromField);
@@ -721,7 +729,7 @@ function dottedQueryKeyFindings(mod: DomainModule, aggById: ReadonlyMap<string,
 // admits before a null is lawful (t.optional / t.clearable / t.nullable / t.json({null})). These
 // twins pre-fire the three refusals the gate would raise: (a) a payload field that ADMITS null with
 // no null-admitting receiver; (b) a null-admitting field used where a null is structurally illegal
-// (authority gate, identity ref, spatial index, read key); (c) a plan op writing literal null into a
+// (authority gate, spatial index, read key); (c) a plan op writing literal null into a
 // field that never declared null a meaning. All PAYLOAD-INDEPENDENT (pure declarations) ⇒ REFUSE.
 
 /** The verbatim null-semantics guidance (`null_semantics.md`) — the `fix` on twin N-a/N-c. */
@@ -835,7 +843,10 @@ function nullBanFindings(mod: DomainModule, aggById: ReadonlyMap<string, Aggrega
     });
   };
 
-  // Facet gates (authority/standing) + identity refs — a null in these breaks the very thing they decide.
+  // Facet gates (authority/standing) — a null in these breaks the very thing they decide. A plain
+  // typed ref is an association, not structural identity: clearing `asset.spaceId`, for example,
+  // means the asset is no longer in a space. If a ref participates in a query/group/spatial key the
+  // corresponding structural check below still refuses it.
   for (const agg of mod.aggregates) {
     for (const [name, f0] of Object.entries(agg.fields)) {
       const f = f0 as Field;
@@ -843,9 +854,6 @@ function nullBanFindings(mod: DomainModule, aggById: ReadonlyMap<string, Aggrega
       if (f.facet === "authority" || f.facet === "standing") {
         ban(agg.id, name, "an authority/standing gate", "drop the null semantic — an authority sink must always resolve to a subject.");
       }
-      if (f.kind === "ref") {
-        ban(agg.id, name, "an identity reference", "an identity ref must always point somewhere — model absence with a separate presence flag, not a null ref.");
-      }
     }
   }
   // Read keys / group-bys / spatial indexes — a null key row is a silent dead index.