@githolon/dsl 0.102.4 → 0.103.0

package/src/law_graph.ts

@@ -0,0 +1,2902 @@
+// NOMOS v3 transient compiler graph. This is deliberately process-local: it gives
+// the compiler one typed structure to validate and traverse, but it is never serialized
+// as a second law representation. USDA remains canonical.
+import type { DomainModule } from "./codegen_dart.js";
+import type { z } from "zod";
+import { finishCount } from "./count.js";
+import { finishExists } from "./exists.js";
+import { finishExtremum } from "./extremum.js";
+import { finishSum } from "./sum.js";
+import {
+  createLawIdentityReconciler,
+  lawEntityKey,
+  mintOwnedLawSid,
+  mintStructuralLawSid,
+  type LawEntityKind,
+  type LawIdentityCarry,
+  type LawIdentityRegistry,
+} from "./law_identity.js";
+import type { ReferentialMarker } from "./directive.js";
+import type { CanonicalPred } from "./predicate.js";
+import type { PointGuardPredicate } from "./point_guard.js";
+import {
+  DEFAULT_RELATION_CAPS,
+  qualifyRelationType,
+  type AllowedSubject,
+  type Rewrite,
+} from "./relation_schema.js";
+import type { StableFieldEvolution, StableIds } from "./stable_ids_types.js";
+import { isBusinessIntent } from "./intent.js";
+import {
+  lowerLawValueType,
+  type LawConstant,
+  type LawLiteral,
+  type LawValueConstraint,
+  type LawValueType,
+} from "./law_value_type.js";
+import { harvestPrincipalFlows } from "./wire_encode.js";
+import { admitsNull, type Field, type FieldKind, type ValueObjectFieldDescriptor } from "./fields.js";
+import type { GeometryKind } from "./value_object.js";
+import type { Driver } from "./drivers.js";
+import {
+  BUSINESS_BIRTH_SEED_PAYLOAD_FIELD,
+  OWNED_CUSTODY_PAYLOAD_FIELD,
+  OWNED_KEY_PAYLOAD_FIELD,
+  OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD,
+  OWNED_READ_RELATION,
+} from "./aggregate.js";
+import { isNamespacedAggregate, qualifyReadProjectionType } from "./read_projection_namespace.js";
+import { assertFlowGateModule } from "./flow_gate.js";
+import type { InvariantReadBinding } from "./framework/workspace_invariant.js";
+
+declare const LAW_SID: unique symbol;
+export type LawSid<K extends LawEntityKind> = string & { readonly [LAW_SID]: K };
+
+export interface LawRef<K extends LawEntityKind> {
+  readonly id: LawSid<K>;
+}
+
+export interface LawSourceSpan {
+  readonly file: string;
+  readonly line: number;
+  readonly column: number;
+  readonly endLine?: number;
+  readonly endColumn?: number;
+}
+
+export interface LawEntity<K extends LawEntityKind> {
+  readonly id: LawSid<K>;
+  readonly sid: string;
+  readonly label: string;
+  readonly priorLabels: readonly string[];
+  readonly identityClass: "declared" | "owned" | "structural";
+  readonly source?: LawSourceSpan;
+}
+
+export interface LawFieldPathRef {
+  readonly field: LawRef<"field">;
+  /** Exact authored path retained because the terminal relationship alone cannot
+   * distinguish a nested projection path such as location.point. */
+  readonly authoredPath: string;
+  /** Stable nested field identities from the aggregate field towards the terminal value. */
+  readonly path: readonly (LawRef<"field"> | LawStructuralRef<"value-field">)[];
+}
+
+export interface LawDomainNode {
+  readonly kind: "domain";
+  readonly entity: LawEntity<"domain">;
+  readonly aggregates: readonly LawRef<"aggregate">[];
+  readonly intents: readonly LawRef<"intent">[];
+  readonly reads: readonly LawRef<"read">[];
+  readonly contracts: readonly LawRef<"contract">[];
+  readonly types: readonly LawRef<"type">[];
+  readonly objectTypes: readonly LawRef<"object-type">[];
+  readonly relations: readonly LawRef<"relation">[];
+  readonly policies: readonly LawRef<"policy">[];
+  readonly invariants: readonly LawRef<"invariant">[];
+  readonly capabilities: readonly LawRef<"capability">[];
+  readonly workspaceTypes: readonly LawRef<"workspace-type">[];
+  readonly flows: readonly LawStructuralRef<"flow">[];
+  readonly parentAttestedBirth?: {
+    readonly ownerObject: string;
+    readonly ownerField: string;
+    readonly certObject: string;
+    readonly certField: string;
+  };
+}
+
+export interface LawAggregateNode {
+  readonly kind: "aggregate";
+  readonly entity: LawEntity<"aggregate">;
+  readonly domain: LawRef<"domain">;
+  readonly fields: readonly LawRef<"field">[];
+  readonly public: boolean;
+  /** Exact `__type` stamped by the compiled runtime and consumed by admission/projection. */
+  readonly wireType: string;
+  readonly cap?: number;
+  readonly implements: readonly LawTargetRef<"contract">[];
+  readonly readPolicy?: LawTargetRef<"relation" | "policy">;
+  readonly ownerField?: LawRef<"field">;
+}
+
+export interface LawFieldNode {
+  readonly kind: "field";
+  readonly entity: LawEntity<"field">;
+  readonly owner: LawRef<"aggregate"> | LawRef<"contract"> | LawRef<"type">;
+  readonly value: LawValueTypeRef;
+  /** Exact kernel/projection storage semantics. Value type + merge driver is not
+   * sufficient to distinguish e.g. string from JSON, or map<string> from map<json>. */
+  readonly storageKind?: FieldKind;
+  readonly mapValueKind?: FieldKind;
+  /** Content identity of the complete business-value contract used to interpret
+   * retained conflict observations. */
+  readonly schemaIdentity?: string;
+  /** Compiler-proven routes from still-supported historical field schemas into the current one. */
+  readonly evolutions: readonly StableFieldEvolution[];
+  readonly mergeDrivers: readonly LawMergeDriver[];
+  readonly required: boolean;
+  readonly nullable: boolean;
+  readonly encrypted: boolean;
+  readonly blindIndexed: boolean;
+  readonly refTarget?: LawTargetRef<"aggregate" | "contract">;
+  readonly referenceMode?: "current" | "versioned";
+  readonly workspaceField?: LawRef<"field">;
+  readonly seriesTarget?: LawTargetRef<"aggregate" | "contract">;
+  readonly currentField?: LawTargetRef<"field">;
+}
+
+export interface LawDependencyRef<K extends LawEntityKind> {
+  readonly kind: "dependency-export";
+  readonly entityKind: K;
+  readonly label: string;
+  readonly domain?: string;
+}
+
+export type LawTargetRef<K extends LawEntityKind> = LawRef<K> | LawDependencyRef<K>;
+export type LawValueTypeRef = LawStructuralRef<"value-type"> | LawRef<"type">;
+
+export interface LawMergeDriver {
+  readonly kind: Driver["kind"];
+  readonly principal?: string;
+}
+
+export interface LawContractNode {
+  readonly kind: "contract";
+  readonly entity: LawEntity<"contract">;
+  readonly domain: LawRef<"domain">;
+  readonly public: boolean;
+  readonly fields: readonly LawRef<"field">[];
+  readonly implementedBy: readonly LawRef<"aggregate">[];
+}
+
+export interface LawPayloadContractNode {
+  readonly kind: "payload-contract";
+  readonly entity: LawEntity<"contract">;
+  readonly owner: LawRef<"intent">;
+  readonly fields: readonly LawStructuralRef<"value-field">[];
+}
+
+export interface LawReadParameter {
+  readonly name: string;
+  readonly field?: LawFieldPathRef;
+  readonly value?: LawStructuralRef<"value-type">;
+}
+
+export type LawReadResult =
+  | {
+      readonly kind: "rows";
+      readonly aggregate: LawRef<"aggregate">;
+      readonly cardinality: "many" | "optional";
+    }
+  | { readonly kind: "scalar"; readonly value: LawStructuralRef<"value-type"> };
+
+export interface LawReadContractNode {
+  readonly kind: "read-contract";
+  readonly entity: LawEntity<"contract">;
+  readonly owner: LawRef<"read">;
+  readonly parameters: readonly LawReadParameter[];
+  readonly returns: LawReadResult;
+}
+
+export interface LawTypeNode {
+  readonly kind: "type";
+  readonly entity: LawEntity<"type">;
+  readonly domain: LawRef<"domain">;
+  readonly form: "record" | "sum" | "geometry";
+  readonly geometry?: GeometryKind;
+  readonly fields: readonly LawRef<"field">[];
+  readonly variants: readonly LawStructuralRef<"value-variant">[];
+}
+
+export interface LawRelationNode {
+  readonly kind: "relation";
+  readonly entity: LawEntity<"relation">;
+  readonly domain: LawRef<"domain">;
+  readonly objectType: string;
+  readonly object: LawRef<"aggregate"> | LawRef<"object-type">;
+  readonly relation: string;
+  readonly maxDepth: number;
+  readonly maxFanout: number;
+  readonly allowed: readonly LawAllowedSubject[];
+  readonly rewrite: LawStructuralRef<"relation-predicate">;
+}
+
+/** A Zanzibar object class which is not itself a stored aggregate schema. */
+export interface LawRelationObjectTypeNode {
+  readonly kind: "object-type";
+  readonly entity: LawEntity<"object-type">;
+  readonly domain: LawRef<"domain">;
+  /** Canonical Zanzibar object namespace. The human label may stay stable across a namespace
+   * migration; checks and tuple identities use this qualified value. */
+  readonly namespace: string;
+}
+
+declare const LAW_STRUCTURAL_SID: unique symbol;
+export type LawStructuralSid<K extends LawStructuralKind> = string & {
+  readonly [LAW_STRUCTURAL_SID]: K;
+};
+export type LawStructuralKind =
+  | "effect"
+  | "foreign-read"
+  | "flow"
+  | "predicate"
+  | "relation-predicate"
+  | "workspace-relation"
+  | "value-field"
+  | "value-type"
+  | "value-variant";
+
+export interface LawStructuralEntity<K extends LawStructuralKind> {
+  readonly id: LawStructuralSid<K>;
+  readonly sid: string;
+  readonly label: string;
+  readonly identityClass: "structural";
+}
+
+export interface LawStructuralRef<K extends LawStructuralKind> {
+  readonly id: LawStructuralSid<K>;
+}
+
+export type LawPredicateExpression =
+  | { readonly kind: "eq" | "ne"; readonly field: LawFieldPathRef; readonly value: string }
+  | { readonly kind: "and" | "or"; readonly terms: readonly LawStructuralRef<"predicate">[] };
+
+export interface LawPredicateNode {
+  readonly kind: "structural";
+  readonly structuralKind: "predicate";
+  readonly entity: LawStructuralEntity<"predicate">;
+  readonly owner: LawRef<"read">;
+  readonly expression: LawPredicateExpression;
+}
+
+export interface LawIntentEffectNode {
+  readonly kind: "structural";
+  readonly structuralKind: "effect";
+  readonly entity: LawStructuralEntity<"effect">;
+  readonly owner: LawRef<"intent">;
+  readonly marker: ReferentialMarker;
+  readonly aggregate: LawTargetRef<"aggregate">;
+  readonly cardinality: "one" | "optional" | "many";
+}
+
+export interface LawFlowNode {
+  readonly kind: "structural";
+  readonly structuralKind: "flow";
+  readonly entity: LawStructuralEntity<"flow">;
+  readonly owner: LawRef<"invariant" | "capability" | "intent">;
+  readonly flowKind: "declassify" | "endorse";
+  readonly site: string;
+  readonly reason: string | null;
+  readonly sink?: LawRef<"field">;
+  readonly facet?: string;
+}
+
+export type LawRelationPredicateExpression =
+  | { readonly kind: "this" }
+  | { readonly kind: "computed"; readonly relation: LawRef<"relation"> }
+  | {
+      readonly kind: "ttu";
+      readonly tupleset: LawRef<"relation">;
+      /** Relation(s) on the object types that the tupleset is allowed to reach. */
+      readonly computed: readonly LawRef<"relation">[];
+      readonly all: boolean;
+    }
+  | {
+      readonly kind: "union" | "intersection";
+      readonly terms: readonly LawStructuralRef<"relation-predicate">[];
+    }
+  | {
+      readonly kind: "exclusion";
+      readonly base: LawStructuralRef<"relation-predicate">;
+      readonly subtract: LawStructuralRef<"relation-predicate">;
+    };
+
+export type LawAllowedSubject =
+  | { readonly kind: "direct"; readonly type: string }
+  | { readonly kind: "wildcard" }
+  | {
+      readonly kind: "userset";
+      readonly type: string;
+      readonly relation: LawRef<"relation">;
+      readonly relationName: string;
+    };
+
+export interface LawRelationPredicateNode {
+  readonly kind: "structural";
+  readonly structuralKind: "relation-predicate";
+  readonly entity: LawStructuralEntity<"relation-predicate">;
+  readonly owner: LawRef<"relation">;
+  readonly expression: LawRelationPredicateExpression;
+}
+
+export type LawAnonymousValueTypeExpression =
+  | {
+      readonly kind: "string" | "number" | "integer";
+      readonly constraints: readonly LawValueConstraint[];
+    }
+  | { readonly kind: "boolean" | "null" | "unknown" }
+  | { readonly kind: "enum"; readonly values: readonly string[] }
+  | { readonly kind: "literal"; readonly value: LawLiteral }
+  | { readonly kind: "list"; readonly element: LawStructuralRef<"value-type"> }
+  | { readonly kind: "map"; readonly value: LawStructuralRef<"value-type"> }
+  | { readonly kind: "record"; readonly fields: readonly LawStructuralRef<"value-field">[] }
+  | { readonly kind: "sum"; readonly variants: readonly LawStructuralRef<"value-variant">[] }
+  | { readonly kind: "nullable"; readonly value: LawStructuralRef<"value-type"> }
+  | {
+      readonly kind: "default";
+      readonly value: LawStructuralRef<"value-type">;
+      readonly defaultValue: LawConstant;
+    }
+  | { readonly kind: "recursive"; readonly value: LawStructuralRef<"value-type"> };
+
+export interface LawAnonymousValueTypeNode {
+  readonly kind: "structural";
+  readonly structuralKind: "value-type";
+  readonly entity: LawStructuralEntity<"value-type">;
+  readonly owner: LawRef<LawEntityKind>;
+  readonly expression: LawAnonymousValueTypeExpression;
+}
+
+export interface LawAnonymousValueFieldNode {
+  readonly kind: "structural";
+  readonly structuralKind: "value-field";
+  readonly entity: LawStructuralEntity<"value-field">;
+  readonly owner: LawStructuralRef<"value-type"> | LawRef<"contract">;
+  readonly name: string;
+  readonly required: boolean;
+  readonly value: LawValueTypeRef;
+}
+
+export interface LawAnonymousValueVariantNode {
+  readonly kind: "structural";
+  readonly structuralKind: "value-variant";
+  readonly entity: LawStructuralEntity<"value-variant">;
+  readonly owner: LawStructuralRef<"value-type"> | LawRef<"type">;
+  readonly label?: string;
+  readonly value: LawValueTypeRef;
+}
+
+export type LawAnonymousValueNode =
+  | LawAnonymousValueTypeNode
+  | LawAnonymousValueFieldNode
+  | LawAnonymousValueVariantNode;
+
+export type LawStructuralNode =
+  | LawFlowNode
+  | LawIntentEffectNode
+  | LawForeignReadNode
+  | LawWorkspaceRelationNode
+  | LawPredicateNode
+  | LawRelationPredicateNode
+  | LawAnonymousValueNode;
+
+interface LawPolicyBase<K extends string> {
+  readonly kind: "policy";
+  readonly entity: LawEntity<"policy">;
+  readonly domain: LawRef<"domain">;
+  readonly policyKind: K;
+  readonly maxAgeMs?: number;
+  readonly minSourceEpoch?: "birth" | number;
+  readonly monotone: boolean;
+  readonly onDishonor: "refuse" | "record";
+}
+
+export interface LawPinnedTrustSourceNode extends LawPolicyBase<"pinned-source"> {
+  readonly workspace: string;
+  readonly genesis: string;
+  readonly keyHashes: readonly string[];
+  readonly roster: "pinned" | "derived" | "tracked";
+}
+
+export interface LawTrustSourceSetNode extends LawPolicyBase<"source-set"> {
+  readonly allowList: LawRef<"aggregate">;
+  readonly genesisField: LawRef<"field">;
+  readonly keysField: LawRef<"field">;
+}
+
+export type LawPolicyNode = LawPinnedTrustSourceNode | LawTrustSourceSetNode;
+
+export interface LawForeignReadNode {
+  readonly kind: "structural";
+  readonly structuralKind: "foreign-read";
+  readonly entity: LawStructuralEntity<"foreign-read">;
+  readonly owner: LawRef<"intent">;
+  readonly query: string;
+  readonly source: LawRef<"policy">;
+  readonly fromField?: LawStructuralRef<"value-field">;
+}
+
+/** A bounded, attested cross-workspace contribution contract declared by its target intent.
+ * This is intentionally distinct from Zanzibar's object#relation algebra. The authoring DSL's
+ * `where` shorthand is compiled into explicit bindings here, before the graph reaches custody,
+ * so the kernel never interprets a policy expression string. */
+export interface LawWorkspaceRelationNode {
+  readonly kind: "structural";
+  readonly structuralKind: "workspace-relation";
+  readonly entity: LawStructuralEntity<"workspace-relation">;
+  readonly owner: LawRef<"intent">;
+  readonly relation: string;
+  readonly sourceType: string;
+  readonly targetType: string;
+  readonly evidenceAggregate: string;
+  readonly evidenceSelect: readonly string[];
+  readonly evidenceKind: "immutable" | "current-state";
+  readonly bindings: readonly {
+    readonly evidenceField: string;
+    readonly directiveParameter: string;
+  }[];
+  readonly hasInvariant: boolean;
+}
+
+export interface LawWorkspaceInvariantNode {
+  readonly kind: "invariant";
+  readonly entity: LawEntity<"invariant">;
+  readonly domain: LawRef<"domain">;
+  readonly invariantKind: "workspace";
+  readonly on: LawRef<"intent">;
+  readonly reads?: readonly {
+    readonly binding: string;
+    readonly aggregate: LawRef<"aggregate">;
+    readonly state: "pre" | "post";
+    readonly eachPayloadPath?: readonly string[];
+    readonly id: InvariantReadBinding["id"];
+  }[];
+  readonly evaluator?: "birth-quota-v1" | "founder-signer-write-once-v1" | "point-guard-v1";
+  readonly pointGuard?: {
+    readonly aggregate: LawRef<"aggregate">;
+    readonly binding: string;
+    readonly state: "pre" | "post";
+    readonly idPayloadPath: readonly string[];
+    readonly predicate: PointGuardPredicate;
+    readonly rejectCode: string;
+  };
+}
+
+export interface LawAggregateInvariantNode {
+  readonly kind: "invariant";
+  readonly entity: LawEntity<"invariant">;
+  readonly domain: LawRef<"domain">;
+  readonly invariantKind: "aggregate";
+  readonly onAggregate: LawRef<"aggregate">;
+}
+
+export type LawInvariantNode = LawWorkspaceInvariantNode | LawAggregateInvariantNode;
+
+export interface LawCapabilityNode {
+  readonly kind: "capability";
+  readonly entity: LawEntity<"capability">;
+  readonly domain: LawRef<"domain">;
+  readonly task: LawRef<"aggregate">;
+  readonly obligation: LawRef<"intent">;
+  readonly complete: LawRef<"intent">;
+  readonly fail: LawRef<"intent">;
+  readonly block: LawRef<"intent">;
+  readonly deadLetter: LawRef<"intent">;
+  readonly capability: string;
+  readonly endpoint?: string;
+  readonly tasks?: LawRef<"read">;
+}
+
+export interface LawWorkspaceTypeNode {
+  readonly kind: "workspace-type";
+  readonly entity: LawEntity<"workspace-type">;
+  readonly domain: LawRef<"domain">;
+  readonly root?: LawRef<"aggregate">;
+  readonly children: readonly LawRef<"workspace-type">[];
+  readonly globals: readonly LawRef<"aggregate">[];
+  readonly coordinatorLocal: readonly LawRef<"aggregate">[];
+  readonly mode: "dedicated" | "packed";
+}
+
+export interface LawIntentAuthorizationObjectFrom {
+  readonly recordType: string;
+  readonly idField: LawStructuralRef<"value-field">;
+}
+
+export interface LawIntentAuthorization {
+  readonly relation: LawTargetRef<"relation">;
+  readonly object: string;
+  readonly objectFrom?: LawIntentAuthorizationObjectFrom;
+}
+
+export interface LawIntentNode {
+  readonly kind: "intent";
+  readonly entity: LawEntity<"intent">;
+  readonly domain: LawRef<"domain">;
+  readonly marker: ReferentialMarker;
+  readonly target: LawTargetRef<"aggregate">;
+  readonly public: boolean;
+  /** Developer-facing route name. Usually the intent label; a framework-lowered business birth
+   * keeps its private directive identity while publishing the stable `birth` route. */
+  readonly publicRoute: string;
+  readonly accepts: LawRef<"contract">;
+  /** Optional public contract when the executable intent accepts a richer, kernel-supplied
+   * payload than tenant developers provide (notably workspace birth). */
+  readonly publicAccepts?: LawRef<"contract">;
+  /** Aggregate-type and indexed-query boundaries the executable plan may read. */
+  readonly reads: readonly LawTargetRef<"aggregate" | "read">[];
+  readonly foreignReads: readonly LawStructuralRef<"foreign-read">[];
+  /** Attested cross-workspace contribution contracts which may propose this intent. */
+  readonly workspaceRelations: readonly LawStructuralRef<"workspace-relation">[];
+  /** Zanzibar relation required to author this intent. */
+  readonly authorization?: LawIntentAuthorization;
+  readonly requiresHostCapabilities: readonly string[];
+  readonly resolves?: LawRef<"field">;
+  readonly births: boolean;
+  readonly birthRecord?: LawRef<"aggregate">;
+  readonly birthPrefix?: string;
+  readonly attestation?: {
+    readonly ownerObject: string;
+    readonly ownerField: string;
+    readonly asserterWorkspace: LawStructuralRef<"value-field">;
+    readonly object: LawStructuralRef<"value-field">;
+    readonly relation: LawStructuralRef<"value-field">;
+    readonly attestedAt: LawStructuralRef<"value-field">;
+    readonly publicKey: LawStructuralRef<"value-field">;
+    readonly signature: LawStructuralRef<"value-field">;
+  };
+  readonly delegation?: {
+    readonly relation: string;
+    readonly subjectField: LawStructuralRef<"value-field">;
+    readonly certField: LawStructuralRef<"value-field">;
+    readonly parentKeyObject: string;
+    readonly parentKeyField: string;
+  };
+  readonly verifiedFirstEnroll?: {
+    readonly tokenField: LawStructuralRef<"value-field">;
+    readonly keyHashField: LawStructuralRef<"value-field">;
+    readonly verifiedViaField: LawStructuralRef<"value-field">;
+  };
+  readonly eraCertification?: {
+    readonly certField: LawStructuralRef<"value-field">;
+  };
+  readonly effects: readonly LawStructuralRef<"effect">[];
+  readonly steps: readonly LawRef<"intent">[];
+  readonly refuses: readonly string[];
+}
+
+/** The public directive vocabulary carried into typed USDA and generated-client compatibility. */
+export function publicIntentRoute(intent: DomainModule["directives"][number]): string {
+  const businessBirth = (intent as { businessBirth?: unknown }).businessBirth;
+  return businessBirth === undefined || isBusinessIntent(intent) ? intent.id : "birth";
+}
+
+/**
+ * Whether an executable directive belongs to the public offer surface.
+ *
+ * `applicationIntents` is the authored business vocabulary, not an exhaustive list of
+ * compiler-expanded executable commands. Roles, framework ceremonies and other lawful
+ * expansions are added to `directives` after the language is closed. Conversely, a raw
+ * workspace-birth directive is presentation-private when a business intent wraps it.
+ * Keep this rule aligned with the generated-client/interface projection; the compiler
+ * also compares that projection with the resulting graph before it emits custody.
+ */
+function isPublicIntent(
+  module: DomainModule,
+  intent: DomainModule["directives"][number],
+): boolean {
+  if ((intent as { businessBirthInternal?: unknown }).businessBirthInternal === true) return false;
+  if (module.applicationIntents === undefined) return true;
+  if (module.applicationIntents.some((candidate) => candidate.id === intent.id)) return true;
+  return (intent as { businessBirth?: unknown }).businessBirth === undefined;
+}
+
+interface LawReadBase<K extends string> {
+  readonly kind: "read";
+  readonly readKind: K;
+  readonly entity: LawEntity<"read">;
+  readonly domain: LawRef<"domain">;
+  readonly of: LawRef<"aggregate">;
+  readonly contract: LawRef<"contract">;
+  readonly public: boolean;
+  readonly predicate?: LawStructuralRef<"predicate">;
+}
+
+export interface LawQueryReadNode extends LawReadBase<"query"> {
+  readonly key: readonly LawFieldPathRef[];
+}
+
+export interface LawCountReadNode extends LawReadBase<"count" | "exists"> {
+  readonly groupBy?: LawFieldPathRef;
+  readonly filtered: boolean;
+}
+
+export interface LawSumReadNode extends LawReadBase<"sum"> {
+  readonly value: LawFieldPathRef;
+  readonly groupBy?: LawFieldPathRef;
+  readonly filtered: boolean;
+}
+
+export interface LawExtremumReadNode extends LawReadBase<"min" | "max"> {
+  readonly value: LawFieldPathRef;
+  readonly groupBy?: LawFieldPathRef;
+  readonly filtered: boolean;
+}
+
+export interface LawOrderedReadNode extends LawReadBase<"ordered"> {
+  readonly orderBy: LawFieldPathRef;
+  readonly descending: boolean;
+  readonly limit: number;
+  readonly filtered: boolean;
+}
+
+export interface LawSpatialReadNode extends LawReadBase<"spatial"> {
+  readonly geometry: LawFieldPathRef;
+}
+
+export interface LawDerivedReadNode extends LawReadBase<"derived"> {}
+
+export interface LawCombinedReadNode extends LawReadBase<"combined"> {
+  readonly via: LawFieldPathRef;
+  readonly reads: LawRef<"aggregate">;
+}
+
+export type LawReadNode =
+  | LawQueryReadNode
+  | LawCountReadNode
+  | LawSumReadNode
+  | LawExtremumReadNode
+  | LawOrderedReadNode
+  | LawSpatialReadNode
+  | LawDerivedReadNode
+  | LawCombinedReadNode;
+
+export type DeclaredLawNode =
+  | LawDomainNode
+  | LawAggregateNode
+  | LawFieldNode
+  | LawContractNode
+  | LawPayloadContractNode
+  | LawReadContractNode
+  | LawTypeNode
+  | LawRelationObjectTypeNode
+  | LawRelationNode
+  | LawPolicyNode
+  | LawInvariantNode
+  | LawCapabilityNode
+  | LawWorkspaceTypeNode
+  | LawIntentNode
+  | LawReadNode
+  | LawStructuralNode;
+
+export interface LawGraph {
+  readonly v: 1;
+  readonly domain: LawDomainNode;
+  /** Canonically SID-ordered, so module/export discovery order cannot affect traversal. */
+  readonly nodes: readonly DeclaredLawNode[];
+}
+
+export interface DiscoverLawGraphOptions {
+  readonly intentCarries?: readonly LawIdentityCarry[];
+  readonly readCarries?: readonly LawIdentityCarry[];
+  readonly source?: (
+    kind:
+      | "domain"
+      | "aggregate"
+      | "field"
+      | "intent"
+      | "read"
+      | "contract"
+      | "type"
+      | "object-type"
+      | "relation"
+      | "policy"
+      | "invariant"
+      | "capability"
+      | "workspace-type",
+    label: string,
+    parentLabel?: string,
+  ) => LawSourceSpan | undefined;
+}
+
+export function discoverLawGraph(
+  module: DomainModule,
+  stableIds: StableIds,
+  sourceRegistry: LawIdentityRegistry,
+  options: DiscoverLawGraphOptions = {},
+): { registry: LawIdentityRegistry; graph: LawGraph } {
+  // Security analysis consumes the same live typed declarations this graph lowers. Do not reconstruct
+  // the retired canonical JSON manifest merely to run information-flow checks.
+  assertFlowGateModule(module);
+  const domainKey = lawEntityKey("domain", stableIds.domain);
+  const domainEntity = entity(sourceRegistry, domainKey, "domain", options.source?.("domain", module.name));
+  const domainRef = ref(domainEntity);
+  const aggregateByLabel = new Map<string, { node: LawAggregateNode; fields: Map<string, LawFieldNode> }>();
+  const aggregateNodes: LawAggregateNode[] = [];
+  const fieldNodes: LawFieldNode[] = [];
+  const anonymousValueNodes = new Map<string, LawAnonymousValueNode>();
+  const identities = createLawIdentityReconciler(sourceRegistry);
+  let registry = sourceRegistry;
+
+  for (const aggregate of [...module.aggregates].sort((a, b) => compareText(a.id, b.id))) {
+    if (aggregate.audience === undefined) {
+      fail(
+        `aggregate '${aggregate.id}' has no audience. Nomos will not guess who may read business state: ` +
+          `finish the declaration with .owned(), .readableBy("<business relation>"), or the deliberate ` +
+          `.public() exception.`,
+      );
+    }
+    const ids = stableIds.aggregates[aggregate.id];
+    if (ids === undefined) fail(`aggregate '${aggregate.id}' has no stable identity`);
+    const aggregateKey = lawEntityKey("aggregate", ids.sid);
+    const aggregateEntity = entity(
+      sourceRegistry,
+      aggregateKey,
+      "aggregate",
+      options.source?.("aggregate", aggregate.id, module.name),
+    );
+    const aggregateRef = ref(aggregateEntity);
+    const fields = new Map<string, LawFieldNode>();
+    for (const [fieldName, field] of Object.entries(aggregate.fields).sort(([a], [b]) =>
+      compareText(a, b),
+    )) {
+      const fieldIds = ids.fields[fieldName];
+      if (fieldIds === undefined) fail(`field '${aggregate.id}.${fieldName}' has no stable identity`);
+      const fieldEntity = entity(
+        sourceRegistry,
+        lawEntityKey("field", fieldIds.sid),
+        "field",
+        options.source?.("field", fieldName, aggregate.id),
+      );
+      const value = lowerAnonymousValueGraph(storedFieldValue(field), fieldEntity);
+      for (const structural of value.nodes) anonymousValueNodes.set(structural.entity.id, structural);
+      const node: LawFieldNode = {
+        kind: "field",
+        entity: fieldEntity,
+        owner: aggregateRef,
+        value: value.root,
+        storageKind: field.kind,
+        ...(field.mapValueKind === undefined ? {} : { mapValueKind: field.mapValueKind }),
+        ...(fieldIds.schema === undefined ? {} : { schemaIdentity: fieldIds.schema }),
+        evolutions: [...(fieldIds.evolutions ?? [])].sort((left, right) => compareText(left.from, right.from)),
+        mergeDrivers: mergeDrivers(field.driver),
+        required: !field.isOptional,
+        nullable: admitsNull(field),
+        encrypted: field.isEncrypted === true,
+        blindIndexed: field.isBlindIndexed === true,
+      };
+      fields.set(fieldName, node);
+      fieldNodes.push(node);
+    }
+    let ownerFieldRef: LawRef<"field"> | undefined;
+    if (aggregate.audience?.kind === "owned") {
+      const ownerField = fields.get(aggregate.audience.ownerField);
+      if (ownerField === undefined) {
+        fail(`aggregate '${aggregate.id}' owns through unknown field '${aggregate.audience.ownerField}'`);
+      }
+      ownerFieldRef = ref(ownerField.entity);
+    }
+    const node: LawAggregateNode = {
+      kind: "aggregate",
+      entity: aggregateEntity,
+      domain: domainRef,
+      fields: sortedRefs(fields.values()),
+      public: aggregate.audience?.kind === "public",
+      wireType: isNamespacedAggregate(aggregate)
+        // Runtime type names are qualified by the authored domain name. `domainKey` is the
+        // stable USDA identity path (`d_<sid>`), which must never leak into event `__type`.
+        ? qualifyReadProjectionType(module.name, aggregate.id)
+        : aggregate.id,
+      ...(aggregate.cap === undefined ? {} : { cap: aggregate.cap }),
+      implements: [],
+      ...(ownerFieldRef === undefined ? {} : { ownerField: ownerFieldRef }),
+    };
+    aggregateByLabel.set(aggregate.id, { node, fields });
+    aggregateNodes.push(node);
+  }
+
+  const contracts = [...(module.contracts ?? [])].sort((a, b) => compareText(a.id, b.id));
+  let reconciled = identities.reconcile({
+    kind: "contract",
+    parent: domainKey,
+    labels: contracts.map((contract) => contract.id),
+  });
+  registry = reconciled.registry;
+  const contractNodes: LawContractNode[] = [];
+  const contractEntitiesByLabel = new Map<string, LawEntity<"contract">>();
+  for (const contract of contracts) {
+    const contractEntity = entity(
+      registry,
+      reconciled.resolved[contract.id]!,
+      "contract",
+      options.source?.("contract", contract.id, module.name),
+    );
+    const contractRef = ref(contractEntity);
+    contractEntitiesByLabel.set(contract.id, contractEntity);
+    const fields = Object.entries(contract.fields).sort(([a], [b]) => compareText(a, b));
+    const fieldResult = identities.reconcile({
+      kind: "field",
+      parent: contractEntity.id,
+      labels: fields.map(([fieldName]) => fieldName),
+    });
+    registry = fieldResult.registry;
+    const ownedFields: LawFieldNode[] = fields.map(([fieldName, field]) => {
+      const fieldEntity = entity(
+        registry,
+        fieldResult.resolved[fieldName]!,
+        "field",
+        options.source?.("field", fieldName, contract.id),
+      );
+      const value = lowerAnonymousValueGraph(storedFieldValue(field), fieldEntity);
+      for (const structural of value.nodes) anonymousValueNodes.set(structural.entity.id, structural);
+      return {
+        kind: "field",
+        entity: fieldEntity,
+        owner: contractRef,
+        value: value.root,
+        storageKind: field.kind,
+        ...(field.mapValueKind === undefined ? {} : { mapValueKind: field.mapValueKind }),
+        evolutions: [],
+        mergeDrivers: mergeDrivers(field.driver),
+        required: !field.isOptional,
+        nullable: admitsNull(field),
+        encrypted: field.isEncrypted === true,
+        blindIndexed: field.isBlindIndexed === true,
+      };
+    });
+    fieldNodes.push(...ownedFields);
+    contractNodes.push({
+      kind: "contract",
+      entity: contractEntity,
+      domain: domainRef,
+      public: true,
+      fields: sortedRefs(ownedFields),
+      implementedBy: sortLawRefs(module.aggregates
+        .filter((aggregate) => aggregate.implementsContracts?.includes(contract.id) === true)
+        .map((aggregate) => aggregateRef(aggregateByLabel, aggregate.id, `contract '${contract.id}'`))),
+    });
+  }
+
+  for (const aggregate of module.aggregates) {
+    const aggregateEntry = aggregateByLabel.get(aggregate.id)!;
+    for (const [fieldName, field] of Object.entries(aggregate.fields)) {
+      const prior = aggregateEntry.fields.get(fieldName);
+      if (prior === undefined) continue;
+      const linked = linkStoredField(
+        prior,
+        field,
+        aggregate.id,
+        aggregateEntry.fields,
+        aggregateByLabel,
+        contractEntitiesByLabel,
+      );
+      aggregateEntry.fields.set(fieldName, linked);
+      const index = fieldNodes.findIndex((candidate) => candidate.entity.id === prior.entity.id);
+      if (index >= 0) fieldNodes[index] = linked;
+    }
+    const contractRefs = [...(aggregate.implementsContracts ?? [])]
+      .sort(compareText)
+      .map((label): LawTargetRef<"contract"> => {
+        const local = contractEntitiesByLabel.get(label);
+        return local === undefined
+          ? { kind: "dependency-export", entityKind: "contract", label }
+          : ref(local);
+      });
+    const updatedAggregate = { ...aggregateEntry.node, implements: contractRefs };
+    aggregateEntry.node = updatedAggregate;
+    const aggregateIndex = aggregateNodes.findIndex(
+      (candidate) => candidate.entity.id === updatedAggregate.entity.id,
+    );
+    if (aggregateIndex >= 0) aggregateNodes[aggregateIndex] = updatedAggregate;
+  }
+
+  const types = [...(module.valueObjects ?? [])].sort((a, b) => compareText(a.name, b.name));
+  reconciled = identities.reconcile({
+    kind: "type",
+    parent: domainKey,
+    labels: types.map((type) => type.name),
+  });
+  registry = reconciled.registry;
+  const typeEntitiesByLabel = new Map(types.map((type) => [
+    type.name,
+    entity(
+      registry,
+      reconciled.resolved[type.name]!,
+      "type",
+      options.source?.("type", type.name, module.name),
+    ),
+  ] as const));
+  const linkValueObjectField = (node: LawFieldNode, field: Field, owner: string): LawFieldNode => {
+    const valueObject = field.valueObject;
+    if (valueObject === undefined) return node;
+    const target = typeEntitiesByLabel.get(valueObject.name);
+    if (target === undefined) fail(`field '${owner}.${node.entity.label}' targets unknown type '${valueObject.name}'`);
+    for (const [id, structural] of anonymousValueNodes) {
+      if (structural.structuralKind === "value-type" && structural.owner.id === node.entity.id) {
+        anonymousValueNodes.delete(id);
+      }
+    }
+    return { ...node, value: ref(target) };
+  };
+  for (const aggregate of module.aggregates) {
+    const entry = aggregateByLabel.get(aggregate.id)!;
+    for (const [fieldName, field] of Object.entries(aggregate.fields)) {
+      const prior = entry.fields.get(fieldName);
+      if (prior === undefined) continue;
+      const linked = linkValueObjectField(prior, field, aggregate.id);
+      if (linked === prior) continue;
+      entry.fields.set(fieldName, linked);
+      const index = fieldNodes.findIndex((candidate) => candidate.entity.id === prior.entity.id);
+      if (index >= 0) fieldNodes[index] = linked;
+    }
+  }
+  for (const contract of contracts) {
+    const owner = contractEntitiesByLabel.get(contract.id)!;
+    for (const [fieldName, field] of Object.entries(contract.fields)) {
+      const index = fieldNodes.findIndex((candidate) =>
+        candidate.owner.id === owner.id && candidate.entity.label === fieldName);
+      if (index < 0) continue;
+      fieldNodes[index] = linkValueObjectField(fieldNodes[index]!, field, contract.id);
+    }
+  }
+  const typeNodes: LawTypeNode[] = [];
+  for (const type of types) {
+    const typeEntity = typeEntitiesByLabel.get(type.name)!;
+    const typeRef = ref(typeEntity);
+    const fields = Object.entries(type.fields ?? {}).sort(([a], [b]) => compareText(a, b));
+    const fieldResult = identities.reconcile({
+      kind: "field",
+      parent: typeEntity.id,
+      labels: fields.map(([fieldName]) => fieldName),
+    });
+    registry = fieldResult.registry;
+    const ownedFields: LawFieldNode[] = fields.map(([fieldName, field]) => {
+      const fieldEntity = entity(
+        registry,
+        fieldResult.resolved[fieldName]!,
+        "field",
+        options.source?.("field", fieldName, type.name),
+      );
+      let value: LawValueTypeRef;
+      if (field.type === "object" || field.type === "geometry") {
+        const target = typeEntitiesByLabel.get(field.ref);
+        if (target === undefined) fail(`type '${type.name}' field '${fieldName}' targets unknown type '${field.ref}'`);
+        value = ref(target);
+      } else {
+        const lowered = lowerAnonymousValueGraph(descriptorValue(field), fieldEntity);
+        for (const structural of lowered.nodes) anonymousValueNodes.set(structural.entity.id, structural);
+        value = lowered.root;
+      }
+      return {
+        kind: "field",
+        entity: fieldEntity,
+        owner: typeRef,
+        value,
+        evolutions: [],
+        mergeDrivers: [],
+        required: field.optional !== true,
+        nullable: false,
+        encrypted: false,
+        blindIndexed: false,
+      };
+    });
+    fieldNodes.push(...ownedFields);
+    const variants: LawStructuralRef<"value-variant">[] = [];
+    for (const [variantName, variant] of Object.entries(type.union ?? {}).sort(([a], [b]) => compareText(a, b))) {
+      let target: LawStructuralRef<"value-type"> | LawRef<"type">;
+      if ("ref" in variant) {
+        const referenced = typeEntitiesByLabel.get(variant.ref);
+        if (referenced === undefined) fail(`type '${type.name}' variant '${variantName}' targets unknown type '${variant.ref}'`);
+        target = ref(referenced);
+      } else {
+        const value: LawValueType = {
+          kind: "record",
+          fields: Object.entries(variant.fields).sort(([a], [b]) => compareText(a, b)).map(([name, field]) => ({
+            name,
+            required: field.optional !== true,
+            value: descriptorValue(field),
+          })),
+        };
+        const lowered = lowerAnonymousValueGraph(value, typeEntity);
+        for (const structural of lowered.nodes) anonymousValueNodes.set(structural.entity.id, structural);
+        target = lowered.root;
+      }
+      const variantEntity = structuralEntity(
+        typeEntity,
+        "value-variant",
+        { label: variantName, value: target.id },
+        `${type.name}#${variantName}`,
+      );
+      anonymousValueNodes.set(variantEntity.id, {
+        kind: "structural",
+        structuralKind: "value-variant",
+        entity: variantEntity,
+        owner: typeRef,
+        label: variantName,
+        value: target,
+      });
+      variants.push(structuralRef(variantEntity));
+    }
+    typeNodes.push({
+      kind: "type",
+      entity: typeEntity,
+      domain: domainRef,
+      form: type.union !== undefined ? "sum" : type.geometry !== undefined ? "geometry" : "record",
+      ...(type.geometry === undefined ? {} : { geometry: type.geometry }),
+      fields: sortedRefs(ownedFields),
+      variants: variants.sort((a, b) => compareText(a.id, b.id)),
+    });
+  }
+
+  // Public routes come from the package-closed module surface. The graph also carries private directives
+  // reached only through a business intent's step closure; those must remain executable without becoming
+  // independently callable client routes.
+  const publicIntentIds = new Set(
+    module.directives.filter((intent) => isPublicIntent(module, intent)).map((intent) => intent.id),
+  );
+  const publishedIntents = new Set(module.applicationIntents ?? []);
+  const intentClosure = [...module.directives, ...(module.applicationIntents ?? [])];
+  for (let index = 0; index < intentClosure.length; index += 1) {
+    const intent = intentClosure[index]!;
+    if (!isBusinessIntent(intent)) continue;
+    for (const step of intent.steps) intentClosure.push(step.directive);
+  }
+  const intentsByLabel = new Map<string, typeof intentClosure[number]>();
+  for (const intent of intentClosure) {
+    const prior = intentsByLabel.get(intent.id);
+    if (prior !== undefined && prior !== intent) {
+      const priorPublished = publishedIntents.has(prior);
+      const currentPublished = publishedIntents.has(intent);
+      // Package composition may retain the executable lowering in `directives` and publish a
+      // distinct business-intent object with the same route id in `applicationIntents`. They are
+      // one authored intent, not two law identities; the published declaration carries the full
+      // public contract and its private consequence graph, so it is the canonical graph node.
+      if (priorPublished !== currentPublished) {
+        if (currentPublished) intentsByLabel.set(intent.id, intent);
+        continue;
+      }
+      fail(`intent label '${intent.id}' resolves to more than one declaration`);
+    }
+    intentsByLabel.set(intent.id, intent);
+  }
+  const intents = [...intentsByLabel.values()].sort((a, b) => compareText(a.id, b.id));
+  reconciled = identities.reconcile({
+    kind: "intent",
+    parent: domainKey,
+    labels: intents.map((intent) => intent.id),
+    ...(options.intentCarries === undefined ? {} : { carries: options.intentCarries }),
+  });
+  registry = reconciled.registry;
+  const intentEntities = new Map(intents.map((intent) => [
+    intent.id,
+    entity(
+      registry,
+      reconciled.resolved[intent.id]!,
+      "intent",
+      options.source?.("intent", intent.id, module.name),
+    ),
+  ] as const));
+  const payloadContractNodes: LawPayloadContractNode[] = [];
+  const payloadFieldsByIntent = new Map<string, Map<string, LawStructuralRef<"value-field">>>();
+  const effectNodes: LawIntentEffectNode[] = [];
+  const workspaceRelationNodes: LawWorkspaceRelationNode[] = [];
+  const intentAggregateTarget = (
+    intent: typeof intents[number],
+    aggregateId: string,
+  ): LawTargetRef<"aggregate"> => {
+    const local = aggregateByLabel.get(aggregateId);
+    if (local !== undefined) return ref(local.node.entity);
+    const birth = (intent as { businessBirth?: { aggregateId?: unknown; domain?: unknown } }).businessBirth;
+    if (birth?.aggregateId === aggregateId && typeof birth.domain === "string") {
+      return { kind: "dependency-export", entityKind: "aggregate", label: aggregateId, domain: birth.domain };
+    }
+    fail(`intent '${intent.id}' in domain '${module.domain ?? module.name}' targets unknown aggregate '${aggregateId}'`);
+  };
+  const intentNodes: LawIntentNode[] = intents.map((intent) => {
+    const intentEntity = intentEntities.get(intent.id)!;
+    const businessBirth = (intent as {
+      businessBirth?: { publicPayloadSchema?: z.ZodTypeAny };
+    }).businessBirth;
+    const payloadContractEntity = ownedEntity(
+      "contract",
+      intentEntity,
+      "contract",
+      "accepts",
+      `${intent.id}#accepts`,
+      options.source?.("intent", intent.id, module.name),
+    );
+    const payloadShape = lowerAnonymousContractFields(
+      lowerLawValueType(isBusinessIntent(intent) ? intent.contract.accepts : intent.payloadSchema),
+      payloadContractEntity,
+    );
+    for (const node of payloadShape.nodes) anonymousValueNodes.set(node.entity.id, node);
+    for (const fieldRef of payloadShape.fields) {
+      const field = anonymousValueNodes.get(fieldRef.id);
+      if (field?.structuralKind !== "value-field") continue;
+      const reserved = [
+        OWNED_KEY_PAYLOAD_FIELD,
+        OWNED_CUSTODY_PAYLOAD_FIELD,
+        OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD,
+        BUSINESS_BIRTH_SEED_PAYLOAD_FIELD,
+      ];
+      if (!reserved.includes(field.name)) continue;
+      const frameworkBirthCarrier = field.name === BUSINESS_BIRTH_SEED_PAYLOAD_FIELD && businessBirth !== undefined;
+      if (frameworkBirthCarrier) continue;
+      fail(
+        `directive '${intent.id}': payload field '${field.name}' is reserved by Nomos ownership. ` +
+          `Sorry mate, that concept is already taken by the framework; give the business payload field ` +
+          `a different name.`,
+      );
+    }
+    payloadContractNodes.push({
+      kind: "payload-contract",
+      entity: payloadContractEntity,
+      owner: ref(intentEntity),
+      fields: payloadShape.fields,
+    });
+    let publicPayloadContractEntity: LawEntity<"contract"> | undefined;
+    if (businessBirth?.publicPayloadSchema !== undefined) {
+      publicPayloadContractEntity = ownedEntity(
+        "contract",
+        intentEntity,
+        "contract",
+        "public-accepts",
+        `${intent.id}#publicAccepts`,
+        options.source?.("intent", intent.id, module.name),
+      );
+      const publicPayloadShape = lowerAnonymousContractFields(
+        lowerLawValueType(businessBirth.publicPayloadSchema),
+        publicPayloadContractEntity,
+      );
+      for (const node of publicPayloadShape.nodes) anonymousValueNodes.set(node.entity.id, node);
+      payloadContractNodes.push({
+        kind: "payload-contract",
+        entity: publicPayloadContractEntity,
+        owner: ref(intentEntity),
+        fields: publicPayloadShape.fields,
+      });
+    }
+    const payloadFields = new Map<string, LawStructuralRef<"value-field">>();
+    const indexPayloadValue = (
+      valueRef: LawValueTypeRef,
+      prefix: string,
+      seen: ReadonlySet<string>,
+    ): void => {
+      if (seen.has(valueRef.id)) return;
+      const value = anonymousValueNodes.get(valueRef.id);
+      if (value?.structuralKind !== "value-type") return;
+      const nextSeen = new Set(seen).add(valueRef.id);
+      switch (value.expression.kind) {
+        case "record":
+          for (const child of value.expression.fields) indexPayloadField(child, prefix, nextSeen);
+          break;
+        case "nullable":
+        case "default":
+        case "recursive":
+          indexPayloadValue(value.expression.value, prefix, nextSeen);
+          break;
+        case "sum":
+          for (const variantRef of value.expression.variants) {
+            const variant = anonymousValueNodes.get(variantRef.id);
+            if (variant?.structuralKind === "value-variant") {
+              indexPayloadValue(variant.value, prefix, nextSeen);
+            }
+          }
+          break;
+        default:
+          break;
+      }
+    };
+    const indexPayloadField = (
+      fieldRef: LawStructuralRef<"value-field">,
+      prefix: string,
+      seen: ReadonlySet<string>,
+    ): void => {
+      const field = anonymousValueNodes.get(fieldRef.id);
+      if (field?.structuralKind !== "value-field") return;
+      const path = prefix === "" ? field.name : `${prefix}.${field.name}`;
+      payloadFields.set(path, fieldRef);
+      indexPayloadValue(field.value, path, seen);
+    };
+    for (const fieldRef of payloadShape.fields) {
+      indexPayloadField(fieldRef, "", new Set());
+    }
+    payloadFieldsByIntent.set(intent.id, payloadFields);
+    const outputs: Array<Pick<LawIntentEffectNode, "marker" | "aggregate" | "cardinality">> = [
+      {
+        marker: intent.marker,
+        aggregate: intentAggregateTarget(intent, intent.aggregateId),
+        cardinality: intent.outputCardinality ?? "one",
+      },
+      ...(intent.secondaryOutputs ?? []).map((output) => ({
+        marker: output.marker,
+        aggregate: aggregateRef(aggregateByLabel, output.aggregateId, `intent '${intent.id}'`),
+        cardinality: output.many === true ? "many" as const : output.optional === true ? "optional" as const : "one" as const,
+      })),
+    ];
+    const effectsById = new Map<string, LawStructuralRef<"effect">>();
+    for (const output of outputs) {
+      const aggregateIdentity = "kind" in output.aggregate
+        ? `${output.aggregate.domain ?? "?"}:${output.aggregate.entityKind}:${output.aggregate.label}`
+        : output.aggregate.id;
+      const effectEntity = structuralEntity(
+        intentEntity,
+        "effect",
+        output,
+        `${intent.id}#${output.marker}:${aggregateIdentity}:${output.cardinality}`,
+      );
+      if (!effectsById.has(effectEntity.id)) {
+        effectNodes.push({
+          kind: "structural",
+          structuralKind: "effect",
+          entity: effectEntity,
+          owner: ref(intentEntity),
+          ...output,
+        });
+        effectsById.set(effectEntity.id, structuralRef(effectEntity));
+      }
+    }
+    const effects = [...effectsById.values()].sort((a, b) => compareText(a.id, b.id));
+    const payloadField = (name: string, purpose: string): LawStructuralRef<"value-field"> => {
+      const field = payloadFields.get(name);
+      if (field === undefined) fail(`intent '${intent.id}' ${purpose} names missing payload field '${name}'`);
+      return field;
+    };
+    const relationDeclarations = [...(intent.declaredRelations ?? [])];
+    if (relationDeclarations.length > 1) {
+      fail(
+        `intent '${intent.id}' declares ${relationDeclarations.length} cross-workspace relations, but ` +
+          "one proposed intent has exactly one attested contribution contract",
+      );
+    }
+    const workspaceRelations = relationDeclarations.map((relation) => {
+      if (relation.proposes !== intent.id) {
+        fail(
+          `intent '${intent.id}' declares relation '${relation.id}' for proposed intent ` +
+            `'${relation.proposes}'; declare it on the target intent itself`,
+        );
+      }
+      if (relation.target !== intent.aggregateId) {
+        fail(
+          `intent '${intent.id}' relation '${relation.id}' targets '${relation.target}', but the ` +
+            `intent targets '${intent.aggregateId}'`,
+        );
+      }
+      if (relation.evidence.aggregate !== relation.source) {
+        fail(
+          `intent '${intent.id}' relation '${relation.id}' reads '${relation.evidence.aggregate}', ` +
+            `but its source endpoint is '${relation.source}'`,
+        );
+      }
+      const evidenceSelect = [...new Set(relation.evidence.select)].sort(compareText);
+      const bindings = relation.evidence.where.trim() === ""
+        ? []
+        : relation.evidence.where.split("&&").map((authoredClause) => {
+            const clause = authoredClause.trim();
+            const match = /^([A-Za-z_][A-Za-z0-9_.]*)\s*==\s*\$([A-Za-z_][A-Za-z0-9_]*)$/.exec(clause);
+            if (match === null) {
+              fail(
+                `intent '${intent.id}' relation '${relation.id}' has an unenforceable evidence scope ` +
+                  `${JSON.stringify(clause)}; use '<evidenceField> == $<directiveParameter>' clauses joined by &&`,
+              );
+            }
+            const evidenceField = match[1]!;
+            const directiveParameter = match[2]!;
+            if (!evidenceSelect.includes(evidenceField)) {
+              fail(
+                `intent '${intent.id}' relation '${relation.id}' binds evidence field '${evidenceField}', ` +
+                  "but that field is absent from its disclosed select set",
+              );
+            }
+            payloadField(directiveParameter, `relation '${relation.id}'`);
+            return { evidenceField, directiveParameter };
+          }).sort((left, right) =>
+            compareText(left.evidenceField, right.evidenceField) ||
+            compareText(left.directiveParameter, right.directiveParameter));
+      const canonical = {
+        relation: relation.id,
+        sourceType: relation.source,
+        targetType: relation.target,
+        evidenceAggregate: relation.evidence.aggregate,
+        evidenceSelect,
+        evidenceKind: relation.evidence.kind,
+        bindings,
+        hasInvariant: relation.hasInvariant,
+      } as const;
+      const relationEntity = structuralEntity(
+        intentEntity,
+        "workspace-relation",
+        canonical,
+        `${intent.id}#${relation.id}`,
+      );
+      workspaceRelationNodes.push({
+        kind: "structural",
+        structuralKind: "workspace-relation",
+        entity: relationEntity,
+        owner: ref(intentEntity),
+        ...canonical,
+      });
+      return structuralRef(relationEntity);
+    });
+    const targetEntry = aggregateByLabel.get(intent.aggregateId);
+    const resolvedField = intent.resolvesField === undefined
+      ? undefined
+      : targetEntry?.fields.get(intent.resolvesField);
+    if (intent.resolvesField !== undefined && resolvedField === undefined) {
+      fail(`intent '${intent.id}' resolves unknown field '${intent.resolvesField}' on '${intent.aggregateId}'`);
+    }
+    return {
+      kind: "intent",
+      entity: intentEntity,
+      domain: domainRef,
+      marker: intent.marker,
+      target: intentAggregateTarget(intent, intent.aggregateId),
+      public: publicIntentIds.has(intent.id),
+      // An authored business intent may compose a child birth while retaining its own public
+      // vocabulary (`birthEstateWorkspace`, `birthCatalogueWorkspace`, ...). Only the private
+      // compiler-lowered business-birth directive publishes the generic framework `birth` route.
+      // Keep this identical to domainInterface/codegen so the typed USDA is sufficient to
+      // reconstruct the generated-client compatibility surface.
+      publicRoute: publicIntentRoute(intent),
+      accepts: ref(payloadContractEntity),
+      ...(publicPayloadContractEntity === undefined ? {} : {
+        publicAccepts: ref(publicPayloadContractEntity),
+      }),
+      reads: [],
+      foreignReads: [],
+      workspaceRelations,
+      requiresHostCapabilities: [...new Set(intent.declaredHostCapabilities ?? [])].sort(compareText),
+      ...(resolvedField === undefined ? {} : { resolves: ref(resolvedField.entity) }),
+      births: intent.birthsChild === true,
+      ...(intent.birthsChild !== true || aggregateByLabel.get("NomosBirthRecord") === undefined ? {} : {
+        birthRecord: ref(aggregateByLabel.get("NomosBirthRecord")!.node.entity),
+        birthPrefix: "nomos-birth-record:",
+      }),
+      ...(intent.attestationAuthorizedGate === undefined ? {} : {
+        attestation: {
+          ownerObject: intent.attestationAuthorizedGate.ownerObject,
+          ownerField: intent.attestationAuthorizedGate.ownerField,
+          asserterWorkspace: payloadField(intent.attestationAuthorizedGate.fields.asserterWorkspace, "attestation"),
+          object: payloadField(intent.attestationAuthorizedGate.fields.object, "attestation"),
+          relation: payloadField(intent.attestationAuthorizedGate.fields.relation, "attestation"),
+          attestedAt: payloadField(intent.attestationAuthorizedGate.fields.attestedAt, "attestation"),
+          publicKey: payloadField(intent.attestationAuthorizedGate.fields.publicKey, "attestation"),
+          signature: payloadField(intent.attestationAuthorizedGate.fields.signature, "attestation"),
+        },
+      }),
+      ...(intent.delegatedRoleGate === undefined ? {} : {
+        delegation: {
+          relation: intent.delegatedRoleGate.relation,
+          subjectField: payloadField(intent.delegatedRoleGate.subjectField, "delegation"),
+          certField: payloadField(intent.delegatedRoleGate.certField, "delegation"),
+          parentKeyObject: intent.delegatedRoleGate.parentKeyObject,
+          parentKeyField: intent.delegatedRoleGate.parentKeyField,
+        },
+      }),
+      ...(intent.firstDeviceEnrollGate === undefined ? {} : {
+        verifiedFirstEnroll: {
+          tokenField: payloadField(intent.firstDeviceEnrollGate.tokenField, "verified-first enrollment"),
+          keyHashField: payloadField(intent.firstDeviceEnrollGate.keyHashField, "verified-first enrollment"),
+          verifiedViaField: payloadField(intent.firstDeviceEnrollGate.verifiedViaField, "verified-first enrollment"),
+        },
+      }),
+      ...(intent.certifiesEraGate === undefined ? {} : {
+        eraCertification: {
+          certField: payloadField(intent.certifiesEraGate.certField, "era certification"),
+        },
+      }),
+      effects,
+      steps: isBusinessIntent(intent)
+        ? sortLawRefs(intent.steps.map((step) => {
+            const target = intentEntities.get(step.directive.id);
+            if (target === undefined) fail(`intent '${intent.id}' targets unknown effect '${step.directive.id}'`);
+            return ref(target);
+          }))
+        : [],
+      refuses: isBusinessIntent(intent) ? [...intent.contract.refuses].sort(compareText) : [],
+    };
+  });
+  const intentByLabel = new Map(intentNodes.map((node) => [node.entity.label, node] as const));
+
+  const namespacedRelationTypes = new Set(
+    (module.relationTypes ?? [])
+      .filter((type) => type.global !== true)
+      .map((type) => type.type),
+  );
+  const authoredRelationDecls = (module.relationTypes ?? []).flatMap((type) =>
+    [...type.relations.entries()].map(([relation, definition]) => ({
+      label: `${type.type}#${relation}`,
+      authoredObjectType: type.type,
+      objectType: type.global === true ? type.type : qualifyRelationType(domainKey, type.type),
+      global: type.global === true,
+      caps: type.caps ?? DEFAULT_RELATION_CAPS,
+      relation,
+      definition,
+    })),
+  );
+  const authoredRelationLabels = new Set(authoredRelationDecls.map((relation) => relation.label));
+  const synthesizedReadRelations = new Map<string, (typeof authoredRelationDecls)[number]>();
+  for (const aggregate of module.aggregates) {
+    if (aggregate.audience === undefined || aggregate.audience.kind === "public") continue;
+    const relation = aggregate.audience.kind === "owned"
+      ? OWNED_READ_RELATION
+      : aggregate.audience.cap;
+    const label = `workspace#${relation}`;
+    if (authoredRelationLabels.has(label) || synthesizedReadRelations.has(label)) continue;
+    synthesizedReadRelations.set(label, {
+      label,
+      authoredObjectType: "workspace",
+      objectType: "workspace",
+      global: true,
+      caps: DEFAULT_RELATION_CAPS,
+      relation,
+      definition: {
+        rewrite: null,
+        allowed: [
+          { kind: "direct", type: "key" },
+          { kind: "direct", type: "user" },
+          { kind: "wildcard" },
+        ],
+      },
+    });
+  }
+  const relationDecls = [...authoredRelationDecls, ...synthesizedReadRelations.values()]
+    .sort((a, b) => compareText(a.label, b.label));
+  const relationObjectLabels = [...new Set(relationDecls
+    .filter((relation) =>
+      relationObjectAggregate(relation.authoredObjectType, aggregateByLabel, module) === undefined)
+    .map((relation) => relation.authoredObjectType))]
+    .sort(compareText);
+  const objectTypeIdentity = identities.reconcile({
+    kind: "object-type",
+    parent: domainKey,
+    labels: relationObjectLabels,
+  });
+  registry = objectTypeIdentity.registry;
+  const relationObjectTypeNodes: LawRelationObjectTypeNode[] = relationObjectLabels.map((label) => ({
+    kind: "object-type",
+    entity: entity(
+      registry,
+      objectTypeIdentity.resolved[label]!,
+      "object-type",
+      options.source?.("object-type", label, module.name),
+    ),
+    domain: domainRef,
+    namespace: namespacedRelationTypes.has(label) ? qualifyRelationType(domainKey, label) : label,
+  }));
+  const relationObjectTypes = new Map(
+    relationObjectTypeNodes.map((node) => [node.entity.label, node] as const),
+  );
+  reconciled = identities.reconcile({
+    kind: "relation",
+    parent: domainKey,
+    labels: relationDecls.map((relation) => relation.label),
+  });
+  registry = reconciled.registry;
+  const relationEntities = new Map(relationDecls.map((relation) => [
+    relation.label,
+    entity(
+      registry,
+      reconciled.resolved[relation.label]!,
+      "relation",
+      options.source?.("relation", relation.label, module.name),
+    ),
+  ] as const));
+  const relationEntitiesByAddress = new Map(relationEntities);
+  for (const relation of relationDecls) {
+    relationEntitiesByAddress.set(
+      `${relation.objectType}#${relation.relation}`,
+      relationEntities.get(relation.label)!,
+    );
+  }
+  const relationAllowed = new Map(relationDecls.map((relation) => [
+    relation.label,
+    linkRelationAllowed(
+      relation.definition.allowed,
+      relationEntitiesByAddress,
+      relation.label,
+      namespacedRelationTypes,
+      domainKey,
+    ),
+  ] as const));
+  const relationPredicateNodes = new Map<LawStructuralSid<"relation-predicate">, LawRelationPredicateNode>();
+  const relationNodes: LawRelationNode[] = relationDecls.map((relation) => {
+    const relationEntity = relationEntities.get(relation.label)!;
+    const object = relationObjectAggregate(relation.authoredObjectType, aggregateByLabel, module)
+      ?? ref(relationObjectTypes.get(relation.authoredObjectType)!.entity);
+    const allowed = relationAllowed.get(relation.label)!;
+    const rewrite = lowerRelationPredicate(
+      relation.definition.rewrite ?? { kind: "this" },
+      relationEntity,
+      relation.authoredObjectType,
+      relationEntitiesByAddress,
+      relationAllowed,
+      relationPredicateNodes,
+    );
+    return {
+      kind: "relation",
+      entity: relationEntity,
+      domain: domainRef,
+      objectType: relation.objectType,
+      object,
+      relation: relation.relation,
+      maxDepth: relation.caps.maxDepth,
+      maxFanout: relation.caps.maxFanout,
+      allowed,
+      rewrite,
+    };
+  });
+  for (const [index, intentNode] of intentNodes.entries()) {
+    const declaration = intents.find((intent) => intent.id === intentNode.entity.label)!;
+    const gate = declaration.requiresRelationGate;
+    if (gate === undefined) continue;
+    const objectType = gate.objectFrom?.recordType ?? gate.object.split(":", 1)[0]!;
+    const exactLabel = gate.relation.includes("#") ? gate.relation : `${objectType}#${gate.relation}`;
+    const candidates = relationNodes.filter((relation) =>
+      relation.entity.label === exactLabel ||
+      (relation.relation === gate.relation &&
+        relation.entity.label.split("#", 1)[0]!.toLocaleLowerCase("en-US") ===
+          objectType.toLocaleLowerCase("en-US"))
+    );
+    if (candidates.length > 1) {
+      fail(
+        `intent '${declaration.id}' authorization relation '${gate.relation}' on '${objectType}' ` +
+          `resolved to ${candidates.length} declarations`,
+      );
+    }
+    let objectFrom: LawIntentAuthorizationObjectFrom | undefined;
+    if (gate.objectFrom !== undefined) {
+      const idField = payloadFieldsByIntent.get(declaration.id)?.get(gate.objectFrom.idField);
+      if (idField === undefined) {
+        fail(
+          `intent '${declaration.id}' authorization object id field '${gate.objectFrom.idField}' ` +
+            `is not present in its payload contract`,
+        );
+      }
+      objectFrom = {
+        recordType: candidates[0]?.objectType ?? gate.objectFrom.recordType,
+        idField,
+      };
+    }
+    const authorizationObject = (() => {
+      const canonicalType = candidates[0]?.objectType;
+      const colon = gate.object.indexOf(":");
+      return canonicalType === undefined || colon < 0
+        ? gate.object
+        : `${canonicalType}${gate.object.slice(colon)}`;
+    })();
+    intentNodes[index] = {
+      ...intentNode,
+      authorization: {
+        relation: candidates[0] === undefined
+          ? { kind: "dependency-export", entityKind: "relation", label: exactLabel }
+          : ref(candidates[0].entity),
+        object: authorizationObject,
+        ...(objectFrom === undefined ? {} : { objectFrom }),
+      },
+    };
+  }
+  for (const aggregate of module.aggregates) {
+    if (aggregate.audience === undefined || aggregate.audience.kind === "public") continue;
+    const relationName = aggregate.audience.kind === "owned"
+      ? OWNED_READ_RELATION
+      : aggregate.audience.cap;
+    const candidates = relationNodes.filter((candidate) =>
+      candidate.entity.label === `workspace#${relationName}`);
+    if (candidates.length > 1) {
+      fail(`aggregate '${aggregate.id}' read relation '${relationName}' is ambiguous across relation types`);
+    }
+    const readPolicy: LawTargetRef<"relation" | "policy"> = candidates[0] === undefined
+      ? { kind: "dependency-export", entityKind: "relation", label: `workspace#${relationName}` }
+      : ref(candidates[0].entity);
+    const entry = aggregateByLabel.get(aggregate.id)!;
+    const updated = { ...entry.node, readPolicy };
+    entry.node = updated;
+    const index = aggregateNodes.findIndex((candidate) => candidate.entity.id === updated.entity.id);
+    if (index >= 0) aggregateNodes[index] = updated;
+  }
+
+  const pinnedSources = [...(module.trustSources ?? [])].sort((a, b) => compareText(a.workspace, b.workspace));
+  const sourceSets = [...(module.trustPolicies ?? [])].sort((a, b) => compareText(a.policyId, b.policyId));
+  const policyLabels = [
+    ...pinnedSources.map((source) => `source:${source.workspace}`),
+    ...sourceSets.map((policy) => policy.policyId),
+  ];
+  reconciled = identities.reconcile({
+    kind: "policy",
+    parent: domainKey,
+    labels: policyLabels,
+  });
+  registry = reconciled.registry;
+  const policyNodes: LawPolicyNode[] = [
+    ...pinnedSources.map((source): LawPinnedTrustSourceNode => {
+      const label = `source:${source.workspace}`;
+      return {
+        kind: "policy",
+        entity: entity(registry, reconciled.resolved[label]!, "policy", options.source?.("policy", label, module.name)),
+        domain: domainRef,
+        policyKind: "pinned-source",
+        workspace: source.workspace,
+        genesis: source.genesis,
+        keyHashes: [...new Set(source.keyHashes ?? [])].sort(compareText),
+        roster: source.roster ?? "pinned",
+        ...(source.maxAgeMs === undefined ? {} : { maxAgeMs: source.maxAgeMs }),
+        ...(source.minSourceEpoch === undefined ? {} : { minSourceEpoch: source.minSourceEpoch }),
+        monotone: source.monotone === true,
+        onDishonor: source.onDishonor ?? "refuse",
+      };
+    }),
+    ...sourceSets.map((policy): LawTrustSourceSetNode => {
+      const allowList = aggregateByLabel.get(policy.allowListType);
+      if (allowList === undefined) fail(`policy '${policy.policyId}' targets unknown aggregate '${policy.allowListType}'`);
+      const genesisField = allowList.fields.get(policy.genesisField);
+      const keysField = allowList.fields.get(policy.keysField);
+      if (genesisField === undefined || keysField === undefined) {
+        fail(`policy '${policy.policyId}' targets missing allow-list fields '${policy.genesisField}'/'${policy.keysField}'`);
+      }
+      return {
+        kind: "policy",
+        entity: entity(registry, reconciled.resolved[policy.policyId]!, "policy", options.source?.("policy", policy.policyId, module.name)),
+        domain: domainRef,
+        policyKind: "source-set",
+        allowList: ref(allowList.node.entity),
+        genesisField: ref(genesisField.entity),
+        keysField: ref(keysField.entity),
+        ...(policy.maxAgeMs === undefined ? {} : { maxAgeMs: policy.maxAgeMs }),
+        ...(policy.minSourceEpoch === undefined ? {} : { minSourceEpoch: policy.minSourceEpoch }),
+        monotone: policy.monotone === true,
+        onDishonor: policy.onDishonor ?? "refuse",
+      };
+    }),
+  ];
+  const pinnedPolicyByWorkspace = new Map(
+    policyNodes.filter((node): node is LawPinnedTrustSourceNode => node.policyKind === "pinned-source")
+      .map((node) => [node.workspace, node] as const),
+  );
+  const sourceSetByLabel = new Map(
+    policyNodes.filter((node): node is LawTrustSourceSetNode => node.policyKind === "source-set")
+      .map((node) => [node.entity.label, node] as const),
+  );
+  const foreignReadNodes: LawForeignReadNode[] = [];
+  for (const [index, intentNode] of intentNodes.entries()) {
+    const declaration = intents.find((intent) => intent.id === intentNode.entity.label)!;
+    const refs: LawStructuralRef<"foreign-read">[] = [];
+    for (const edge of declaration.declaredForeignReads ?? []) {
+      const source = "from" in edge
+        ? pinnedPolicyByWorkspace.get(edge.from)
+        : sourceSetByLabel.get(edge.policy);
+      if (source === undefined) {
+        fail(
+          `intent '${declaration.id}' foreign read '${edge.queryId}' targets undeclared ` +
+            `${"from" in edge ? `source '${edge.from}'` : `policy '${edge.policy}'`}`,
+        );
+      }
+      const fromField = "fromPayload" in edge
+        ? payloadFieldsByIntent.get(declaration.id)?.get(edge.fromPayload)
+        : undefined;
+      if ("fromPayload" in edge && fromField === undefined) {
+        fail(`intent '${declaration.id}' foreign source field '${edge.fromPayload}' is absent from its payload`);
+      }
+      const foreignEntity = structuralEntity(
+        intentNode.entity,
+        "foreign-read",
+        {
+          query: edge.queryId,
+          source: source.entity.id,
+          ...(fromField === undefined ? {} : { fromField: fromField.id }),
+        },
+        `${declaration.id}#foreign-read:${edge.queryId}`,
+      );
+      foreignReadNodes.push({
+        kind: "structural",
+        structuralKind: "foreign-read",
+        entity: foreignEntity,
+        owner: ref(intentNode.entity),
+        query: edge.queryId,
+        source: ref(source.entity),
+        ...(fromField === undefined ? {} : { fromField }),
+      });
+      refs.push(structuralRef(foreignEntity));
+    }
+    intentNodes[index] = { ...intentNode, foreignReads: refs.sort((a, b) => compareText(a.id, b.id)) };
+  }
+
+  const invariants = [...(module.workspaceInvariants ?? [])].sort((a, b) => compareText(a.id, b.id));
+  reconciled = identities.reconcile({
+    kind: "invariant",
+    parent: domainKey,
+    labels: invariants.map((invariant) => invariant.id),
+  });
+  registry = reconciled.registry;
+  const invariantNodes: LawInvariantNode[] = invariants.map((invariant) => {
+    const point = invariant.__nomosPointGuard;
+    const pointAggregate = point === undefined ? undefined : aggregateByLabel.get(point.aggregateId)?.node;
+    if (point !== undefined && pointAggregate === undefined) {
+      fail(`invariant '${invariant.id}' point guard targets unknown aggregate '${point.aggregateId}'`);
+    }
+    const nativeReads = invariant.__nomosReadBindings?.map((read) => {
+      const aggregate = aggregateByLabel.get(read.aggregate)?.node;
+      if (aggregate === undefined) {
+        fail(`invariant '${invariant.id}' native read targets unknown aggregate '${read.aggregate}'`);
+      }
+      return {
+        binding: read.binding,
+        aggregate: ref(aggregate.entity),
+        state: read.state,
+        ...(read.eachPayloadPath === undefined ? {} : { eachPayloadPath: read.eachPayloadPath }),
+        id: read.id,
+      };
+    });
+    return {
+      kind: "invariant",
+      entity: entity(
+        registry,
+        reconciled.resolved[invariant.id]!,
+        "invariant",
+        options.source?.("invariant", invariant.id, module.name),
+      ),
+      domain: domainRef,
+      invariantKind: "workspace",
+      on: intentRef(intentByLabel, invariant.on, `invariant '${invariant.id}'`),
+      ...(nativeReads === undefined ? {} : { reads: nativeReads }),
+      ...(invariant.__nomosEvaluator === undefined
+        ? {}
+        : { evaluator: invariant.__nomosEvaluator }),
+      ...(point === undefined || pointAggregate === undefined
+        ? {}
+        : {
+            pointGuard: {
+              aggregate: ref(pointAggregate.entity),
+              binding: point.binding,
+              state: point.state,
+              idPayloadPath: point.idPayloadPath,
+              predicate: point.predicate,
+              rejectCode: point.rejectCode,
+            },
+          }),
+    };
+  });
+  for (const aggregate of module.aggregates.filter((candidate) => candidate.hasInvariant === true)) {
+    const aggregateNode = aggregateByLabel.get(aggregate.id)?.node;
+    if (aggregateNode === undefined) fail(`aggregate invariant targets unknown aggregate '${aggregate.id}'`);
+    invariantNodes.push({
+      kind: "invariant",
+      entity: ownedEntity(
+        "invariant",
+        aggregateNode.entity,
+        "invariant",
+        "aggregate",
+        `${aggregate.id}#invariant`,
+        options.source?.("aggregate", aggregate.id, module.name),
+      ),
+      domain: domainRef,
+      invariantKind: "aggregate",
+      onAggregate: ref(aggregateNode.entity),
+    });
+  }
+
+  const capabilities = [...(module.impureCapabilities ?? [])].sort((a, b) =>
+    compareText(a.aggregate.id, b.aggregate.id),
+  );
+  reconciled = identities.reconcile({
+    kind: "capability",
+    parent: domainKey,
+    labels: capabilities.map((capability) => capability.aggregate.id),
+  });
+  registry = reconciled.registry;
+  let capabilityNodes: LawCapabilityNode[] = capabilities.map((capability) => {
+    const metadata = capability as typeof capability & {
+      readonly name?: unknown;
+      readonly capability?: unknown;
+      readonly endpoint?: unknown;
+    };
+    return {
+      kind: "capability",
+      entity: entity(
+        registry,
+        reconciled.resolved[capability.aggregate.id]!,
+        "capability",
+        options.source?.("capability", capability.aggregate.id, module.name),
+      ),
+      domain: domainRef,
+      task: aggregateRef(aggregateByLabel, capability.aggregate.id, `capability '${capability.aggregate.id}'`),
+      obligation: intentRef(intentByLabel, capability.obligation.id, `capability '${capability.aggregate.id}'`),
+      complete: intentRef(intentByLabel, capability.complete.id, `capability '${capability.aggregate.id}'`),
+      fail: intentRef(intentByLabel, capability.fail.id, `capability '${capability.aggregate.id}'`),
+      block: intentRef(intentByLabel, capability.block.id, `capability '${capability.aggregate.id}'`),
+      deadLetter: intentRef(intentByLabel, capability.deadLetter.id, `capability '${capability.aggregate.id}'`),
+      capability: typeof metadata.name === "string"
+        ? metadata.name
+        : typeof metadata.capability === "string"
+          ? metadata.capability
+          : capability.aggregate.id,
+      ...(typeof metadata.endpoint === "string" ? { endpoint: metadata.endpoint } : {}),
+    };
+  });
+
+  const flowNodes: LawFlowNode[] = [];
+  const addDeclassify = (
+    owner: LawEntity<"invariant"> | LawEntity<"capability">,
+    reason: string | undefined,
+  ): void => {
+    if (reason === undefined) return;
+    const semantic = { flowKind: "declassify" as const, site: `${owner.label}:refusal`, reason };
+    const entity = structuralEntity(owner, "flow", semantic, `${owner.label}#declassify`);
+    flowNodes.push({
+      kind: "structural",
+      structuralKind: "flow",
+      entity,
+      owner: ref(owner),
+      ...semantic,
+    });
+  };
+  for (const invariant of invariants) {
+    const node = invariantNodes.find(
+      (candidate) => candidate.invariantKind === "workspace" && candidate.entity.label === invariant.id,
+    );
+    if (node !== undefined) addDeclassify(node.entity, invariant.declassify);
+  }
+  for (const aggregate of module.aggregates) {
+    const node = invariantNodes.find(
+      (candidate) => candidate.invariantKind === "aggregate" && candidate.onAggregate.id ===
+        aggregateByLabel.get(aggregate.id)?.node.entity.id,
+    );
+    if (node !== undefined) addDeclassify(node.entity, aggregate.invariantDeclassify);
+  }
+  for (const capability of capabilities) {
+    const node = capabilityNodes.find((candidate) => candidate.entity.label === capability.aggregate.id);
+    if (node !== undefined) {
+      addDeclassify(node.entity, (capability as { readonly declassify?: string }).declassify);
+    }
+  }
+  for (const intent of intents) {
+    const owner = intentEntities.get(intent.id)!;
+    const seen = new Set<string>();
+    for (const flow of harvestPrincipalFlows(intent, module.domain ?? module.name)) {
+      const sinkParts = flow.sink.split(".");
+      const sinkFieldName = sinkParts.pop();
+      const sinkAggregateName = sinkParts.pop();
+      const sinkField = sinkAggregateName === undefined || sinkFieldName === undefined
+        ? undefined
+        : aggregateByLabel.get(sinkAggregateName)?.fields.get(sinkFieldName);
+      if (sinkField === undefined) fail(`intent '${intent.id}' endorsement targets unknown field '${flow.sink}'`);
+      const semantic = {
+        flowKind: "endorse" as const,
+        site: `${intent.id}:${flow.sink}:${flow.facet}`,
+        sink: ref(sinkField.entity),
+        facet: flow.facet,
+        reason: flow.reason,
+      };
+      const entity = structuralEntity(
+        owner,
+        "flow",
+        semantic,
+        `${intent.id}#endorse:${flow.sink}:${flow.facet}`,
+      );
+      if (seen.has(entity.id)) continue;
+      seen.add(entity.id);
+      flowNodes.push({
+        kind: "structural",
+        structuralKind: "flow",
+        entity,
+        owner: ref(owner),
+        ...semantic,
+      });
+    }
+  }
+
+  const workspaceTypes = [...(module.workspaceTypes ?? [])].sort((a, b) => compareText(a.id, b.id));
+  reconciled = identities.reconcile({
+    kind: "workspace-type",
+    parent: domainKey,
+    labels: workspaceTypes.map((workspaceType) => workspaceType.id),
+  });
+  registry = reconciled.registry;
+  const workspaceTypeEntities = new Map(
+    workspaceTypes.map((workspaceType) => [
+      workspaceType.id,
+      entity(
+        registry,
+        reconciled.resolved[workspaceType.id]!,
+        "workspace-type",
+        options.source?.("workspace-type", workspaceType.id, module.name),
+      ),
+    ] as const),
+  );
+  const workspaceTypeNodes: LawWorkspaceTypeNode[] = workspaceTypes.map((workspaceType) => {
+    const workspaceTypeEntity = workspaceTypeEntities.get(workspaceType.id)!;
+    return {
+      kind: "workspace-type",
+      entity: workspaceTypeEntity,
+      domain: domainRef,
+      ...(workspaceType.rootAggregate === undefined
+        ? {}
+        : { root: aggregateRef(aggregateByLabel, workspaceType.rootAggregate.id, `workspace type '${workspaceType.id}'`) }),
+      children: sortLawRefs(workspaceType.childRefs.map((childRef) => {
+        const child = typeof childRef === "function" ? childRef() : childRef;
+        const childEntity = workspaceTypeEntities.get(child.id);
+        if (childEntity === undefined) fail(`workspace type '${workspaceType.id}' targets unknown child '${child.id}'`);
+        return ref(childEntity);
+      })),
+      globals: sortLawRefs(workspaceType.globalAggregates.map((aggregate) =>
+        aggregateRef(aggregateByLabel, aggregate.id, `workspace type '${workspaceType.id}'`))),
+      coordinatorLocal: sortLawRefs(workspaceType.coordinatorLocalAggregates.map((aggregate) =>
+        aggregateRef(aggregateByLabel, aggregate.id, `workspace type '${workspaceType.id}'`))),
+      mode: workspaceType.mode,
+    };
+  });
+
+  const reads = readInputs(module);
+  reconciled = identities.reconcile({
+    kind: "read",
+    parent: domainKey,
+    labels: reads.map((read) => read.id),
+    ...(options.readCarries === undefined ? {} : { carries: options.readCarries }),
+  });
+  registry = reconciled.registry;
+  const predicateNodes = new Map<LawStructuralSid<"predicate">, LawPredicateNode>();
+  const readContractNodes: LawReadContractNode[] = [];
+  const resolveReadFieldPath = (
+    fields: ReadonlyMap<string, LawFieldNode>,
+    aggregate: string,
+    path: string,
+  ): LawFieldPathRef => fieldPath(fields, aggregate, path, fieldNodes, anonymousValueNodes);
+  const readNodes = reads.map((read): LawReadNode => {
+    const readEntity = entity(
+      registry,
+      reconciled.resolved[read.id]!,
+      "read",
+      options.source?.("read", read.id, module.name),
+    );
+    const fields = aggregateByLabel.get(read.of)?.fields;
+    if (fields === undefined) fail(`read '${read.id}' targets unknown aggregate '${read.of}'`);
+    const readAggregate = aggregateRef(aggregateByLabel, read.of, `read '${read.id}'`);
+    const readContractEntity = ownedEntity(
+      "contract",
+      readEntity,
+      "contract",
+      "returns",
+      `${read.id}#contract`,
+      options.source?.("read", read.id, module.name),
+    );
+    const lowerReadValue = (value: LawValueType): LawStructuralRef<"value-type"> => {
+      const lowered = lowerAnonymousValueGraph(value, readContractEntity);
+      for (const node of lowered.nodes) anonymousValueNodes.set(node.entity.id, node);
+      return lowered.root;
+    };
+    const rawParameters = readParameters(read, fields, read.of, resolveReadFieldPath);
+    const rawResult = readResult(read, readAggregate);
+    readContractNodes.push({
+      kind: "read-contract",
+      entity: readContractEntity,
+      owner: ref(readEntity),
+      parameters: rawParameters.map((parameter) => ({
+        name: parameter.name,
+        ...(parameter.field === undefined ? {} : { field: parameter.field }),
+        ...(parameter.value === undefined ? {} : { value: lowerReadValue(parameter.value) }),
+      })),
+      returns: rawResult.kind === "rows"
+        ? rawResult
+        : { kind: "scalar", value: lowerReadValue(rawResult.value) },
+    });
+    let predicate: LawStructuralRef<"predicate"> | undefined;
+    if ("where" in read && read.where !== undefined) {
+      predicate = lowerReadPredicate(
+        read.where,
+        readEntity,
+        fields,
+        read.of,
+        predicateNodes,
+        resolveReadFieldPath,
+      );
+    }
+    const base = {
+      kind: "read" as const,
+      entity: readEntity,
+      domain: domainRef,
+      of: readAggregate,
+      contract: ref(readContractEntity),
+      public: read.public,
+      ...(predicate === undefined ? {} : { predicate }),
+    };
+    switch (read.readKind) {
+      case "query":
+        return { ...base, readKind: "query", key: read.key.map((path) => resolveReadFieldPath(fields, read.of, path)) };
+      case "count":
+      case "exists":
+        return {
+          ...base,
+          readKind: read.readKind,
+          ...(read.by === undefined ? {} : { groupBy: resolveReadFieldPath(fields, read.of, read.by) }),
+          filtered: read.filtered,
+        };
+      case "sum":
+        return {
+          ...base,
+          readKind: "sum",
+          value: resolveReadFieldPath(fields, read.of, read.value),
+          ...(read.by === undefined ? {} : { groupBy: resolveReadFieldPath(fields, read.of, read.by) }),
+          filtered: read.filtered,
+        };
+      case "min":
+      case "max":
+        return {
+          ...base,
+          readKind: read.readKind,
+          value: resolveReadFieldPath(fields, read.of, read.value),
+          ...(read.by === undefined ? {} : { groupBy: resolveReadFieldPath(fields, read.of, read.by) }),
+          filtered: read.filtered,
+        };
+      case "ordered":
+        return {
+          ...base,
+          readKind: "ordered",
+          orderBy: resolveReadFieldPath(fields, read.of, read.orderBy),
+          descending: read.descending,
+          limit: read.limit,
+          filtered: read.filtered,
+        };
+      case "spatial":
+        return { ...base, readKind: "spatial", geometry: resolveReadFieldPath(fields, read.of, read.geometry) };
+      case "derived":
+        return { ...base, readKind: "derived" };
+      case "combined":
+        return {
+          ...base,
+          readKind: "combined",
+          via: resolveReadFieldPath(fields, read.of, read.via),
+          reads: aggregateRef(aggregateByLabel, read.reads, `combined read '${read.id}'`),
+        };
+    }
+  });
+  const readByLabel = new Map(readNodes.map((read) => [read.entity.label, read] as const));
+  capabilityNodes = capabilityNodes.map((node, index) => {
+    const tasksLabel = (capabilities[index] as { readonly tasks?: { readonly id?: unknown } } | undefined)
+      ?.tasks?.id;
+    if (typeof tasksLabel !== "string") return node;
+    const tasks = readByLabel.get(tasksLabel);
+    if (tasks === undefined) {
+      fail(`capability '${node.entity.label}' targets unknown tasks query '${tasksLabel}'`);
+    }
+    return { ...node, tasks: ref(tasks.entity) };
+  });
+  for (const [index, intentNode] of intentNodes.entries()) {
+    const declaration = intents.find((intent) => intent.id === intentNode.entity.label)!;
+    const aggregateReads = [...new Set(declaration.declaredReads ?? [])].map((label) =>
+      aggregateRef(aggregateByLabel, label, `intent '${declaration.id}' read boundary`));
+    const queryReads = [...new Set((declaration.declaredQueryReads ?? []).map((read) => read.id))].map((label) => {
+      const read = readByLabel.get(label);
+      if (read === undefined) fail(`intent '${declaration.id}' reads unknown query '${label}'`);
+      return ref(read.entity);
+    });
+    const intentReads: LawTargetRef<"aggregate" | "read">[] = [...aggregateReads, ...queryReads];
+    intentNodes[index] = {
+      ...intentNode,
+      reads: intentReads.sort((a, b) => compareText(lawTargetKey(a), lawTargetKey(b))),
+    };
+  }
+
+  const domainNode: LawDomainNode = {
+    kind: "domain",
+    entity: domainEntity,
+    aggregates: sortedRefs(aggregateNodes),
+    intents: sortedRefs(intentNodes),
+    reads: sortedRefs(readNodes),
+    contracts: sortedRefs([...contractNodes, ...payloadContractNodes, ...readContractNodes]),
+    types: sortedRefs(typeNodes),
+    objectTypes: sortedRefs(relationObjectTypeNodes),
+    relations: sortedRefs(relationNodes),
+    policies: sortedRefs(policyNodes),
+    invariants: sortedRefs(invariantNodes),
+    capabilities: sortedRefs(capabilityNodes),
+    workspaceTypes: sortedRefs(workspaceTypeNodes),
+    flows: flowNodes.map((node) => structuralRef(node.entity)).sort((a, b) => compareText(a.id, b.id)),
+    ...(module.parentAttestedBirth === undefined || module.parentAttestedBirth === false ? {} : {
+      parentAttestedBirth: {
+        ownerObject: typeof module.parentAttestedBirth === "object" && module.parentAttestedBirth.ownerObject !== undefined
+          ? module.parentAttestedBirth.ownerObject : "home-owner:self",
+        ownerField: typeof module.parentAttestedBirth === "object" && module.parentAttestedBirth.ownerField !== undefined
+          ? module.parentAttestedBirth.ownerField : "principal",
+        certObject: typeof module.parentAttestedBirth === "object" && module.parentAttestedBirth.certObject !== undefined
+          ? module.parentAttestedBirth.certObject : "birth-attestation:self",
+        certField: typeof module.parentAttestedBirth === "object" && module.parentAttestedBirth.certField !== undefined
+          ? module.parentAttestedBirth.certField : "certChain",
+      },
+    }),
+  };
+  const nodes: DeclaredLawNode[] = [
+    domainNode,
+    ...aggregateNodes,
+    ...fieldNodes,
+    ...contractNodes,
+    ...payloadContractNodes,
+    ...anonymousValueNodes.values(),
+    ...readContractNodes,
+    ...typeNodes,
+    ...relationObjectTypeNodes,
+    ...intentNodes,
+    ...effectNodes,
+    ...foreignReadNodes,
+    ...workspaceRelationNodes,
+    ...relationNodes,
+    ...relationPredicateNodes.values(),
+    ...policyNodes,
+    ...invariantNodes,
+    ...capabilityNodes,
+    ...flowNodes,
+    ...workspaceTypeNodes,
+    ...readNodes,
+    ...predicateNodes.values(),
+  ].sort((a, b) => compareText(a.entity.id, b.entity.id));
+  registry = identities.finish();
+  return { registry, graph: { v: 1, domain: domainNode, nodes } };
+}
+
+type ReadInputBase = { id: string; public: boolean };
+type ReadInput =
+  | (ReadInputBase & { readKind: "query"; of: string; key: readonly string[] })
+  | (ReadInputBase & { readKind: "count" | "exists"; of: string; by?: string; where?: CanonicalPred; filtered: boolean })
+  | (ReadInputBase & { readKind: "sum" | "min" | "max"; of: string; value: string; by?: string; where?: CanonicalPred; filtered: boolean })
+  | (ReadInputBase & { readKind: "ordered"; of: string; orderBy: string; descending: boolean; limit: number; where?: CanonicalPred; filtered: boolean })
+  | (ReadInputBase & { readKind: "spatial"; of: string; geometry: string })
+  | (ReadInputBase & { readKind: "derived"; of: string; returns: z.ZodTypeAny })
+  | (ReadInputBase & { readKind: "combined"; of: string; via: string; reads: string; returns: z.ZodTypeAny });
+
+interface RawLawReadParameter {
+  readonly name: string;
+  readonly field?: LawFieldPathRef;
+  readonly value?: LawValueType;
+}
+
+type ResolveFieldPath = (
+  fields: ReadonlyMap<string, LawFieldNode>,
+  aggregate: string,
+  path: string,
+) => LawFieldPathRef;
+
+type RawLawReadResult =
+  | { readonly kind: "rows"; readonly aggregate: LawRef<"aggregate">; readonly cardinality: "many" | "optional" }
+  | { readonly kind: "scalar"; readonly value: LawValueType };
+
+function readInputs(module: DomainModule): ReadInput[] {
+  const isPublic = (value: unknown): boolean =>
+    !(value && typeof value === "object" &&
+      (value as { businessBirthInternal?: unknown }).businessBirthInternal === true);
+  const reads: ReadInput[] = [
+    ...(module.queries ?? []).map((read) => ({ id: read.id, public: isPublic(read), readKind: "query" as const, of: read.returns, key: read.key })),
+    ...(module.counts ?? []).map((value) => {
+      const read = finishCount(value);
+      return { id: read.id, public: isPublic(value), readKind: "count" as const, of: read.of, ...(read.by === undefined ? {} : { by: read.by }), ...(read.where === undefined ? {} : { where: read.where }), filtered: read.where !== undefined };
+    }),
+    ...(module.exists_ ?? []).map((value) => {
+      const read = finishExists(value);
+      return { id: read.id, public: isPublic(value), readKind: "exists" as const, of: read.of, ...(read.by === undefined ? {} : { by: read.by }), ...(read.where === undefined ? {} : { where: read.where }), filtered: read.where !== undefined };
+    }),
+    ...(module.sums ?? []).map((value) => {
+      const read = finishSum(value);
+      return { id: read.id, public: isPublic(value), readKind: "sum" as const, of: read.of, value: read.sumField, ...(read.by === undefined ? {} : { by: read.by }), ...(read.where === undefined ? {} : { where: read.where }), filtered: read.where !== undefined };
+    }),
+    ...(module.mins ?? []).map((value) => {
+      const read = finishExtremum(value);
+      return { id: read.id, public: isPublic(value), readKind: "min" as const, of: read.of, value: read.valueField, ...(read.by === undefined ? {} : { by: read.by }), ...(read.where === undefined ? {} : { where: read.where }), filtered: read.where !== undefined };
+    }),
+    ...(module.maxes ?? []).map((value) => {
+      const read = finishExtremum(value);
+      return { id: read.id, public: isPublic(value), readKind: "max" as const, of: read.of, value: read.valueField, ...(read.by === undefined ? {} : { by: read.by }), ...(read.where === undefined ? {} : { where: read.where }), filtered: read.where !== undefined };
+    }),
+    ...(module.orderedReads ?? []).map((read) => ({ id: read.id, public: isPublic(read), readKind: "ordered" as const, of: read.of, orderBy: read.orderKey, descending: read.orderDesc, limit: read.limit, ...(read.where === undefined ? {} : { where: read.where }), filtered: read.where !== undefined })),
+    ...(module.spatials ?? []).map((read) => ({ id: read.id, public: isPublic(read), readKind: "spatial" as const, of: read.of, geometry: read.on })),
+    ...(module.deriveds ?? []).map((read) => ({ id: read.id, public: isPublic(read), readKind: "derived" as const, of: read.of, returns: read.returns })),
+    ...(module.combineds ?? []).map((read) => ({ id: read.id, public: isPublic(read), readKind: "combined" as const, of: read.of, via: read.refField, reads: read.reads, returns: read.returns })),
+  ];
+  return reads.sort((a, b) => compareText(a.id, b.id));
+}
+
+function readParameters(
+  read: ReadInput,
+  fields: ReadonlyMap<string, LawFieldNode>,
+  aggregate: string,
+  resolveFieldPath: ResolveFieldPath,
+): RawLawReadParameter[] {
+  if (read.readKind === "query") {
+    return read.key.map((name) => ({ name, field: resolveFieldPath(fields, aggregate, name) }));
+  }
+  if (
+    (read.readKind === "count" || read.readKind === "exists" || read.readKind === "sum" ||
+      read.readKind === "min" || read.readKind === "max") && read.by !== undefined
+  ) {
+    return [{ name: read.by, field: resolveFieldPath(fields, aggregate, read.by) }];
+  }
+  if (read.readKind === "spatial") {
+    const coordinate = { kind: "number" as const, constraints: [] };
+    return [{
+      name: "bounds",
+      value: {
+        kind: "sum",
+        options: [
+          {
+            kind: "record",
+            fields: ["maxX", "maxY", "minX", "minY"].map((name) => ({
+              name,
+              required: true,
+              value: coordinate,
+            })),
+          },
+          {
+            kind: "record",
+            fields: ["maxLat", "maxLng", "minLat", "minLng"].map((name) => ({
+              name,
+              required: true,
+              value: coordinate,
+            })),
+          },
+        ],
+      },
+    }];
+  }
+  return [];
+}
+
+function readResult(read: ReadInput, aggregate: LawRef<"aggregate">): RawLawReadResult {
+  switch (read.readKind) {
+    case "query":
+    case "spatial":
+      return { kind: "rows", aggregate, cardinality: "many" };
+    case "ordered":
+      return { kind: "rows", aggregate, cardinality: read.limit === 1 ? "optional" : "many" };
+    case "count":
+    case "sum":
+      return { kind: "scalar", value: { kind: "integer", constraints: [] } };
+    case "exists":
+      return { kind: "scalar", value: { kind: "boolean" } };
+    case "min":
+    case "max":
+      return {
+        kind: "scalar",
+        value: { kind: "nullable", value: { kind: "integer", constraints: [] } },
+      };
+    case "derived":
+    case "combined":
+      return { kind: "scalar", value: lowerLawValueType(read.returns) };
+  }
+}
+
+function storedFieldValue(field: Field): LawValueType {
+  if (field.kind === "json") return { kind: "unknown" };
+  if (field.kind === "ref" || field.kind === "position") {
+    return { kind: "string", constraints: [] };
+  }
+  if (field.kind === "counter") return { kind: "integer", constraints: [] };
+  if (field.kind === "hasMany") return { kind: "unknown" };
+  return lowerLawValueType(field.zod);
+}
+
+function linkStoredField(
+  node: LawFieldNode,
+  field: Field,
+  owner: string,
+  siblings: ReadonlyMap<string, LawFieldNode>,
+  aggregates: ReadonlyMap<string, { node: LawAggregateNode; fields: Map<string, LawFieldNode> }>,
+  contracts: ReadonlyMap<string, LawEntity<"contract">>,
+): LawFieldNode {
+  const target = (
+    label: string,
+    targetIsContract: boolean | undefined,
+    domain?: string,
+  ): LawTargetRef<"aggregate" | "contract"> => {
+    if (targetIsContract === true) {
+      const local = contracts.get(label);
+      return local === undefined
+        ? { kind: "dependency-export", entityKind: "contract", label, ...(domain === undefined ? {} : { domain }) }
+        : ref(local);
+    }
+    const local = aggregates.get(label);
+    return local === undefined
+      ? { kind: "dependency-export", entityKind: "aggregate", label, ...(domain === undefined ? {} : { domain }) }
+      : ref(local.node.entity);
+  };
+  if (field.versionedForeignRef !== undefined) {
+    const versioned = field.versionedForeignRef;
+    const seriesAggregate = aggregates.get(versioned.seriesAggregateId);
+    const current = seriesAggregate?.fields.get(versioned.currentField);
+    return {
+      ...node,
+      refTarget: target(
+        versioned.targetAggregateId,
+        versioned.targetIsContract,
+        versioned.targetDomain,
+      ),
+      referenceMode: "versioned",
+      seriesTarget: target(
+        versioned.seriesAggregateId,
+        versioned.seriesIsContract,
+        versioned.targetDomain,
+      ),
+      currentField: current === undefined
+        ? {
+            kind: "dependency-export",
+            entityKind: "field",
+            label: `${versioned.seriesAggregateId}.${versioned.currentField}`,
+            ...(versioned.targetDomain === undefined ? {} : { domain: versioned.targetDomain }),
+          }
+        : ref(current.entity),
+    };
+  }
+  const declared = field.nomosRef ?? field.foreignRef;
+  const targetLabel = declared?.targetAggregateId ?? field.refAggregateId;
+  if (targetLabel === undefined) return node;
+  let workspaceField: LawRef<"field"> | undefined;
+  if (field.foreignRef !== undefined) {
+    const workspace = siblings.get(field.foreignRef.workspaceField);
+    if (workspace === undefined) {
+      fail(`field '${owner}.${node.entity.label}' targets unknown workspace field '${field.foreignRef.workspaceField}'`);
+    }
+    workspaceField = ref(workspace.entity);
+  }
+  return {
+    ...node,
+    refTarget: target(
+      targetLabel,
+      declared?.targetIsContract,
+      field.foreignRef?.targetDomain,
+    ),
+    referenceMode: "current",
+    ...(workspaceField === undefined ? {} : { workspaceField }),
+  };
+}
+
+function descriptorValue(field: ValueObjectFieldDescriptor): LawValueType {
+  switch (field.type) {
+    case "string":
+      return { kind: "string", constraints: [] };
+    case "number":
+      return { kind: field.int === true ? "integer" : "number", constraints: [] };
+    case "boolean":
+      return { kind: "boolean" };
+    case "enum":
+      return { kind: "enum", values: [...field.values].sort(compareText) };
+    case "literal":
+      return { kind: "literal", value: field.value };
+    case "array":
+      return { kind: "list", element: descriptorValue(field.items) };
+    case "map":
+      return { kind: "map", value: descriptorValue(field.values) };
+    case "object":
+    case "geometry":
+      return { kind: "unknown" };
+  }
+}
+
+function mergeDrivers(driver: Driver): LawMergeDriver[] {
+  const drivers: LawMergeDriver[] = [];
+  let current: Driver | undefined = driver;
+  while (current !== undefined) {
+    drivers.push({
+      kind: current.kind,
+      ...(current.principal === undefined ? {} : { principal: current.principal }),
+    });
+    current = current.inner;
+  }
+  return drivers;
+}
+
+function entity<K extends LawEntityKind>(
+  registry: LawIdentityRegistry,
+  key: string,
+  expected: K,
+  source: LawSourceSpan | undefined,
+): LawEntity<K> {
+  const stored = registry.entities[key];
+  if (stored === undefined) fail(`${expected} identity '${key}' is missing`);
+  if (stored.kind !== expected) fail(`identity '${key}' is ${stored.kind}, expected ${expected}`);
+  if (stored.status !== "active") fail(`${expected} identity '${key}' is retired`);
+  return {
+    id: key as LawSid<K>,
+    sid: stored.sid,
+    label: stored.label,
+    priorLabels: [...(stored.priorLabels ?? [])],
+    identityClass: "declared",
+    ...(source === undefined ? {} : { source }),
+  };
+}
+
+function ownedEntity<K extends LawEntityKind, O extends LawEntityKind>(
+  kind: K,
+  owner: LawEntity<O>,
+  slotKind: string,
+  slot: string,
+  label: string,
+  source: LawSourceSpan | undefined,
+): LawEntity<K> {
+  const sid = mintOwnedLawSid(owner.sid, slotKind, slot);
+  return {
+    id: lawEntityKey(kind, sid) as LawSid<K>,
+    sid,
+    label,
+    priorLabels: [],
+    identityClass: "owned",
+    ...(source === undefined ? {} : { source }),
+  };
+}
+
+function structuralEntity<K extends LawStructuralKind, O extends LawEntityKind>(
+  owner: LawEntity<O>,
+  structuralKind: K,
+  canonicalValue: unknown,
+  label: string,
+): LawStructuralEntity<K> {
+  const sid = mintStructuralLawSid(owner.sid, structuralKind, canonicalValue);
+  return {
+    id: `s_${sid}` as LawStructuralSid<K>,
+    sid,
+    label,
+    identityClass: "structural",
+  };
+}
+
+function structuralRef<K extends LawStructuralKind>(
+  value: LawStructuralEntity<K>,
+): LawStructuralRef<K> {
+  return { id: value.id };
+}
+
+/** Lower one anonymous contract/value shape into content-addressed graph nodes under its stable owner. */
+export function lowerAnonymousValueGraph<K extends LawEntityKind>(
+  source: LawValueType,
+  owner: LawEntity<K>,
+): { readonly root: LawStructuralRef<"value-type">; readonly nodes: readonly LawAnonymousValueNode[] } {
+  const nodes = new Map<string, LawAnonymousValueNode>();
+  const anchors = new Map<string, LawStructuralRef<"value-type">>();
+
+  const lower = (input: LawValueType): LawStructuralRef<"value-type"> => {
+    if (input.kind === "recursive-ref") {
+      const target = anchors.get(input.anchor);
+      if (target === undefined) fail(`anonymous value type references unknown recursion anchor '${input.anchor}'`);
+      return target;
+    }
+    const value = canonicalValueType(input);
+    const entity = structuralEntity(owner, "value-type", value, `${owner.label}#value-type`);
+    const existing = nodes.get(entity.id);
+    if (existing !== undefined) return structuralRef(entity);
+    // Reserve recursive roots before walking their body so a back-edge resolves to this exact node.
+    if (value.kind === "recursive") anchors.set(value.anchor, structuralRef(entity));
+
+    let expression: LawAnonymousValueTypeExpression;
+    switch (value.kind) {
+      case "string":
+      case "number":
+      case "integer":
+        expression = { kind: value.kind, constraints: value.constraints };
+        break;
+      case "boolean":
+      case "null":
+      case "unknown":
+        expression = { kind: value.kind };
+        break;
+      case "enum":
+        expression = { kind: "enum", values: value.values };
+        break;
+      case "literal":
+        expression = { kind: "literal", value: value.value };
+        break;
+      case "list":
+        expression = { kind: "list", element: lower(value.element) };
+        break;
+      case "map":
+        expression = { kind: "map", value: lower(value.value) };
+        break;
+      case "nullable":
+        expression = { kind: "nullable", value: lower(value.value) };
+        break;
+      case "default":
+        expression = { kind: "default", value: lower(value.value), defaultValue: value.defaultValue };
+        break;
+      case "recursive":
+        expression = { kind: "recursive", value: lower(value.value) };
+        anchors.delete(value.anchor);
+        break;
+      case "record": {
+        const fields = value.fields.map((member) => {
+          const child = lower(member.value);
+          const fieldEntity = structuralEntity(
+            owner,
+            "value-field",
+            { parent: entity.id, name: member.name, required: member.required, value: child.id },
+            `${owner.label}#${member.name}`,
+          );
+          if (!nodes.has(fieldEntity.id)) {
+            nodes.set(fieldEntity.id, {
+              kind: "structural",
+              structuralKind: "value-field",
+              entity: fieldEntity,
+              owner: structuralRef(entity),
+              name: member.name,
+              required: member.required,
+              value: child,
+            });
+          }
+          return structuralRef(fieldEntity);
+        }).sort((a, b) => compareText(a.id, b.id));
+        expression = { kind: "record", fields };
+        break;
+      }
+      case "sum": {
+        const variants = value.options.map((option) => {
+          const child = lower(option);
+          const variantEntity = structuralEntity(
+            owner,
+            "value-variant",
+            { parent: entity.id, value: child.id },
+            `${owner.label}#${child.id}`,
+          );
+          if (!nodes.has(variantEntity.id)) {
+            nodes.set(variantEntity.id, {
+              kind: "structural",
+              structuralKind: "value-variant",
+              entity: variantEntity,
+              owner: structuralRef(entity),
+              value: child,
+            });
+          }
+          return structuralRef(variantEntity);
+        }).sort((a, b) => compareText(a.id, b.id));
+        expression = { kind: "sum", variants };
+        break;
+      }
+      case "recursive-ref":
+        throw new Error("unreachable recursive-ref lowering");
+    }
+    nodes.set(entity.id, {
+      kind: "structural",
+      structuralKind: "value-type",
+      entity: { ...entity, label: `${owner.label}#${entity.id}` },
+      owner: ref(owner),
+      expression,
+    });
+    return structuralRef(entity);
+  };
+
+  const root = lower(source);
+  return { root, nodes: [...nodes.values()].sort((a, b) => compareText(a.entity.id, b.entity.id)) };
+}
+
+/** A generated payload contract is itself the record; only its member value types are anonymous. */
+export function lowerAnonymousContractFields(
+  source: LawValueType,
+  owner: LawEntity<"contract">,
+): { readonly fields: readonly LawStructuralRef<"value-field">[]; readonly nodes: readonly LawAnonymousValueNode[] } {
+  const value = canonicalValueType(source);
+  if (value.kind !== "record") {
+    fail(`payload contract '${owner.label}' must lower to a record, received '${value.kind}'`);
+  }
+  const nodes = new Map<string, LawAnonymousValueNode>();
+  const fields = value.fields.map((member) => {
+    const lowered = lowerAnonymousValueGraph(member.value, owner);
+    for (const node of lowered.nodes) nodes.set(node.entity.id, node);
+    const entity = structuralEntity(
+      owner,
+      "value-field",
+      { name: member.name, required: member.required, value: lowered.root.id },
+      `${owner.label}#${member.name}`,
+    );
+    nodes.set(entity.id, {
+      kind: "structural",
+      structuralKind: "value-field",
+      entity,
+      owner: ref(owner),
+      name: member.name,
+      required: member.required,
+      value: lowered.root,
+    });
+    return structuralRef(entity);
+  }).sort((a, b) => compareText(a.id, b.id));
+  return { fields, nodes: [...nodes.values()].sort((a, b) => compareText(a.entity.id, b.entity.id)) };
+}
+
+function canonicalValueType(value: LawValueType): LawValueType {
+  switch (value.kind) {
+    case "record":
+      return {
+        kind: "record",
+        fields: value.fields.map((field) => ({ ...field, value: canonicalValueType(field.value) }))
+          .sort((a, b) => compareText(a.name, b.name)),
+      };
+    case "sum":
+      return {
+        kind: "sum",
+        options: value.options.map(canonicalValueType)
+          .sort((a, b) => compareText(JSON.stringify(a), JSON.stringify(b))),
+      };
+    case "list":
+      return { kind: "list", element: canonicalValueType(value.element) };
+    case "map":
+      return { kind: "map", value: canonicalValueType(value.value) };
+    case "nullable":
+      return { kind: "nullable", value: canonicalValueType(value.value) };
+    case "default":
+      return { ...value, value: canonicalValueType(value.value) };
+    case "recursive":
+      return { ...value, value: canonicalValueType(value.value) };
+    default:
+      return value;
+  }
+}
+
+function lowerReadPredicate(
+  predicate: CanonicalPred,
+  owner: LawEntity<"read">,
+  fields: ReadonlyMap<string, LawFieldNode>,
+  aggregate: string,
+  nodes: Map<LawStructuralSid<"predicate">, LawPredicateNode>,
+  resolveFieldPath: ResolveFieldPath,
+): LawStructuralRef<"predicate"> {
+  let expression: LawPredicateExpression;
+  if (predicate.kind === "eq" || predicate.kind === "ne") {
+    expression = {
+      kind: predicate.kind,
+      field: resolveFieldPath(fields, aggregate, predicate.field),
+      value: predicate.value,
+    };
+  } else {
+    expression = {
+      kind: predicate.kind,
+      terms: predicate.clauses.map((clause) =>
+        lowerReadPredicate(clause, owner, fields, aggregate, nodes, resolveFieldPath))
+        .sort((a, b) => compareText(a.id, b.id)),
+    };
+  }
+  const entity = structuralEntity(owner, "predicate", expression, `${owner.label}#predicate`);
+  if (!nodes.has(entity.id)) {
+    nodes.set(entity.id, {
+      kind: "structural",
+      structuralKind: "predicate",
+      entity: { ...entity, label: `${owner.label}#${entity.id}` },
+      owner: ref(owner),
+      expression,
+    });
+  }
+  return structuralRef(entity);
+}
+
+function lowerRelationPredicate(
+  rewrite: Rewrite,
+  owner: LawEntity<"relation">,
+  objectType: string,
+  relations: ReadonlyMap<string, LawEntity<"relation">>,
+  allowedByRelation: ReadonlyMap<string, readonly LawAllowedSubject[]>,
+  nodes: Map<LawStructuralSid<"relation-predicate">, LawRelationPredicateNode>,
+): LawStructuralRef<"relation-predicate"> {
+  const local = (relation: string): LawRef<"relation"> => {
+    const target = relations.get(`${objectType}#${relation}`);
+    if (target === undefined) {
+      fail(`relation '${owner.label}' targets unknown sibling relation '${objectType}#${relation}'`);
+    }
+    return ref(target);
+  };
+  let expression: LawRelationPredicateExpression;
+  switch (rewrite.kind) {
+    case "this":
+      expression = { kind: "this" };
+      break;
+    case "computed":
+      expression = { kind: "computed", relation: local(rewrite.relation) };
+      break;
+    case "ttu":
+      const tupleset = local(rewrite.tupleset);
+      const reachedTypes = new Set((allowedByRelation.get(`${objectType}#${rewrite.tupleset}`) ?? [])
+        .filter((subject) => subject.kind !== "wildcard")
+        .map((subject) => subject.type));
+      const computed = [...reachedTypes]
+        .map((type) => relations.get(`${type}#${rewrite.computed}`))
+        .filter((target): target is LawEntity<"relation"> => target !== undefined)
+        .map(ref)
+        .sort((a, b) => compareText(a.id, b.id));
+      if (computed.length === 0) {
+        fail(
+          `relation '${owner.label}' tuple-to-userset '${rewrite.tupleset}' cannot resolve ` +
+          `computed relation '${rewrite.computed}' on any allowed object type`,
+        );
+      }
+      expression = {
+        kind: "ttu",
+        tupleset,
+        computed,
+        all: rewrite.all,
+      };
+      break;
+    case "union":
+    case "intersection":
+      expression = {
+        kind: rewrite.kind,
+        terms: rewrite.children.map((child) =>
+          lowerRelationPredicate(child, owner, objectType, relations, allowedByRelation, nodes))
+          .sort((a, b) => compareText(a.id, b.id)),
+      };
+      break;
+    case "exclusion":
+      expression = {
+        kind: "exclusion",
+        base: lowerRelationPredicate(rewrite.base, owner, objectType, relations, allowedByRelation, nodes),
+        subtract: lowerRelationPredicate(rewrite.subtract, owner, objectType, relations, allowedByRelation, nodes),
+      };
+      break;
+  }
+  const minted = structuralEntity(owner, "relation-predicate", expression, owner.label);
+  const entity: LawStructuralEntity<"relation-predicate"> = {
+    ...minted,
+    label: `${owner.label}#${minted.id}`,
+  };
+  if (!nodes.has(entity.id)) {
+    nodes.set(entity.id, {
+      kind: "structural",
+      structuralKind: "relation-predicate",
+      entity,
+      owner: ref(owner),
+      expression,
+    });
+  }
+  return structuralRef(entity);
+}
+
+function linkRelationAllowed(
+  allowed: readonly AllowedSubject[],
+  relations: ReadonlyMap<string, LawEntity<"relation">>,
+  owner: string,
+  namespacedTypes: ReadonlySet<string>,
+  domainKey: string,
+): LawAllowedSubject[] {
+  return sortStructuralValues(allowed.map((subject): LawAllowedSubject => {
+    if (subject.kind === "wildcard") return { kind: "wildcard" };
+    const subjectType = namespacedTypes.has(subject.type)
+      ? qualifyRelationType(domainKey, subject.type)
+      : subject.type;
+    if (subject.kind === "direct") return { kind: "direct", type: subjectType };
+    const target = relations.get(`${subject.type}#${subject.relation}`);
+    if (target === undefined) {
+      fail(`relation '${owner}' allows unknown userset relation '${subject.type}#${subject.relation}'`);
+    }
+    return {
+      kind: "userset",
+      type: subjectType,
+      relation: ref(target),
+      relationName: subject.relation,
+    };
+  }));
+}
+
+function sortStructuralValues<T>(values: readonly T[]): T[] {
+  return [...values].sort((a, b) => compareText(JSON.stringify(a), JSON.stringify(b)));
+}
+
+function lawTargetKey(target: LawTargetRef<LawEntityKind>): string {
+  return "kind" in target
+    ? `${target.domain ?? ""}:${target.entityKind}:${target.label}`
+    : target.id;
+}
+
+function ref<K extends LawEntityKind>(value: LawEntity<K>): LawRef<K> {
+  return { id: value.id };
+}
+
+function sortedRefs<K extends LawEntityKind>(
+  values: Iterable<{ readonly entity: LawEntity<K> }>,
+): LawRef<K>[] {
+  return [...values].map((node) => ref(node.entity)).sort((a, b) => compareText(a.id, b.id));
+}
+
+function aggregateRef(
+  aggregates: ReadonlyMap<string, { node: LawAggregateNode }>,
+  label: string,
+  owner: string,
+): LawRef<"aggregate"> {
+  const aggregate = aggregates.get(label);
+  if (aggregate === undefined) fail(`${owner} targets unknown aggregate '${label}'`);
+  return ref(aggregate.node.entity);
+}
+
+function relationObjectAggregate(
+  objectType: string,
+  aggregates: ReadonlyMap<string, { node: LawAggregateNode }>,
+  module: DomainModule,
+): LawRef<"aggregate"> | undefined {
+  const exact = aggregates.get(objectType);
+  if (exact !== undefined) return ref(exact.node.entity);
+  const folded = [...aggregates.entries()].filter(([label]) =>
+    label.toLocaleLowerCase("en-US") === objectType.toLocaleLowerCase("en-US"));
+  if (folded.length === 1) return ref(folded[0]![1].node.entity);
+  if (folded.length > 1) fail(`relation object type '${objectType}' ambiguously matches several aggregates`);
+  if (objectType !== "workspace") return undefined;
+  const roots = new Map<string, LawRef<"aggregate">>();
+  for (const workspaceType of module.workspaceTypes ?? []) {
+    if (workspaceType.rootAggregate === undefined) continue;
+    const root = aggregates.get(workspaceType.rootAggregate.id);
+    if (root !== undefined) roots.set(root.node.entity.id, ref(root.node.entity));
+  }
+  if (roots.size === 1) return [...roots.values()][0];
+  if (roots.size > 1) fail("relation object type 'workspace' has several possible workspace roots");
+  return undefined;
+}
+
+function intentRef(
+  intents: ReadonlyMap<string, LawIntentNode>,
+  label: string,
+  owner: string,
+): LawRef<"intent"> {
+  const direct = intents.get(label);
+  const short = label.includes(".") ? intents.get(label.slice(label.lastIndexOf(".") + 1)) : undefined;
+  const intent = direct ?? short;
+  if (intent === undefined) fail(`${owner} targets unknown intent '${label}'`);
+  return ref(intent.entity);
+}
+
+function sortLawRefs<K extends LawEntityKind>(values: readonly LawRef<K>[]): LawRef<K>[] {
+  return [...values].sort((a, b) => compareText(a.id, b.id));
+}
+
+function fieldPath(
+  fields: ReadonlyMap<string, LawFieldNode>,
+  aggregate: string,
+  path: string,
+  allFields: readonly LawFieldNode[],
+  anonymousNodes: ReadonlyMap<string, LawAnonymousValueNode>,
+): LawFieldPathRef {
+  const [head, ...tail] = path.split(".");
+  const field = head === undefined ? undefined : fields.get(head);
+  if (field === undefined) fail(`read field path '${aggregate}.${path}' targets an unknown field`);
+  const nested: Array<LawRef<"field"> | LawStructuralRef<"value-field">> = [];
+  let value: LawValueTypeRef = field.value;
+  const unwrap = (): void => {
+    const seen = new Set<string>();
+    while (true) {
+      if (seen.has(value.id)) fail(`read field path '${aggregate}.${path}' crosses a wrapper cycle`);
+      seen.add(value.id);
+      const node = anonymousNodes.get(value.id);
+      if (node?.structuralKind !== "value-type") return;
+      if (
+        node.expression.kind !== "nullable" &&
+        node.expression.kind !== "default" &&
+        node.expression.kind !== "recursive"
+      ) return;
+      value = node.expression.value;
+    }
+  };
+  for (const segment of tail) {
+    unwrap();
+    const declared = allFields.find((candidate) =>
+      candidate.owner.id === value.id && candidate.entity.label === segment);
+    if (declared !== undefined) {
+      nested.push(ref(declared.entity));
+      value = declared.value;
+      continue;
+    }
+    const structural = [...anonymousNodes.values()].find((candidate): candidate is LawAnonymousValueFieldNode =>
+      candidate.structuralKind === "value-field" &&
+      candidate.owner.id === value.id &&
+      candidate.name === segment);
+    if (structural !== undefined) {
+      nested.push(structuralRef(structural.entity));
+      value = structural.value;
+      continue;
+    }
+    fail(`read field path '${aggregate}.${path}' targets unknown nested field '${segment}'`);
+  }
+  return { field: ref(field.entity), authoredPath: path, path: nested };
+}
+
+function fail(message: string): never {
+  throw new Error(`NMS-GRAPH-001 ${message}`);
+}
+
+function compareText(a: string, b: string): number {
+  return a < b ? -1 : a > b ? 1 : 0;
+}