@githolon/dsl 0.102.4 → 0.103.0

package/src/manifest.ts

@@ -1,1476 +0,0 @@
-// NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
-// remotes are replaceable custody/transport, not truth.  ⇒ ONE Nomos GitHolon
-// wasm32-wasip1 artifact {kernel · projection · embedded
-// QuickJS engine} on V8 + WASI-shim, byte-identical everywhere.  V8 = portability; the one
-// wasm = determinism.  No native, no wasmtime, no 2nd artifact, no domain-JS on bare V8.
-// If a file isn't this / hosting this / authoring for this / proving this — it's gone.
-
-/**
- * Domain identity = canonical SEMANTIC manifest hash (#136).
- *
- * "The bundle is not the law." A domain's IDENTITY in the certification gate is a
- * content hash. Historically that hash was `sha256(stripPathMarkers(esbuild_bundle))`
- * (see `golden/build_golden.mjs`): it depended on esbuild's output format — version,
- * whitespace, declaration ordering — and on the domain's file LOCATION. That is
- * fragile: a bundler upgrade or a file move changes the identity of unchanged logic.
- *
- * This module derives identity instead from the domain's CANONICAL MANIFEST — built
- * directly from the in-memory DSL objects (`DomainModule`). It captures the domain's
- * CONTRACT: its aggregates' field→driver schemas, and each directive's target /
- * marker / required capability / scope-presence / payload SHAPE. It deliberately does
- * NOT capture executable `plan`/`scopeFrom` BEHAVIOUR — that is a separate
- * `artifact_hash` (out of scope here). The consequence is the desired property:
- * refactoring a directive's `plan` body while keeping its signature identical does
- * NOT change the domain hash. The hash tracks the contract, not the code, and is
- * independent of both bundling AND file location while remaining sensitive to real
- * semantic/contract changes.
- */
-import { createHash } from "node:crypto";
-import { z } from "zod";
-import { encodeKernelSchema, encodeRefMode } from "./wire_encode.js";
-import { encodeDriver } from "./drivers.js";
-import type { WireSchema, WireRefMode } from "./wire.js";
-import type { ReferentialMarker } from "./directive.js";
-import type { DomainModule } from "./codegen_dart.js";
-import type { Field } from "./fields.js";
-import {
-  BUSINESS_BIRTH_SEED_PAYLOAD_FIELD,
-  OWNED_CUSTODY_PAYLOAD_FIELD,
-  OWNED_KEY_PAYLOAD_FIELD,
-  OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD,
-  OWNED_READ_RELATION,
-} from "./aggregate.js";
-import type { WorkspaceInvariantDecl } from "./framework/workspace_invariant.js";
-import type { QueryDecl } from "./query.js";
-import { finishCount, type AnyCount } from "./count.js";
-import type { SpatialDecl } from "./spatial.js";
-import { finishSum, type AnySum } from "./sum.js";
-import { finishExtremum, type AnyExtremum } from "./extremum.js";
-import { existsAsCount, type AnyExists } from "./exists.js";
-import type { OrderedReadDecl } from "./ordered_read.js";
-import type { CanonicalPred } from "./predicate.js";
-import { assertFlowGate } from "./flow_gate.js";
-import type { DerivedDecl } from "./derived.js";
-import type { CombinedDecl } from "./combined.js";
-import type { RelationDecl } from "./relation.js";
-import { type CanonicalWorkspaceType } from "./workspace_type.js";
-import {
-  canonicalTaxonomyFragment,
-  type CanonicalDirectiveRoute,
-} from "./workspace_routing.js";
-import {
-  mintAggregateSid,
-  mintDomainSid,
-  mintFieldSid,
-  type StableAggregateId,
-  type StableFieldId,
-  type StableFieldEvolution,
-  type StableIds,
-} from "./stable_ids.js";
-
-/** One captured `[fieldName, zodKind]` payload field, with optionality. */
-export interface CanonicalPayloadField {
-  /** The payload field name. */
-  readonly name: string;
-  /** The Zod 4 `def.type` of the field's unwrapped type, e.g. "string". */
-  readonly type: string;
-  /** True when the field is `optional` / `default` wrapped. */
-  readonly optional: boolean;
-}
-
-/** One captured projected read-field return schema. */
-export interface CanonicalProjectionReturn {
-  /** The Zod 4 `def.type` of the unwrapped return type, e.g. "boolean". */
-  readonly type: string;
-  /** True when the projected value may be null/absent. */
-  readonly nullable: boolean;
-  /** The return value as standard JSON Schema, emitted from the same TS/Zod source. */
-  readonly jsonSchema: unknown;
-}
-
-/** One captured aggregate: its id + its field→driver schema (keys SORTED). */
-export interface CanonicalAggregate {
-  readonly id: string;
-  readonly schema: WireSchema;
-  /**
-   * PRESENCE ONLY — the body is executable (like a directive `plan`), NOT hashed.
-   * OMITTED ENTIRELY when absent, so a predicate-free aggregate is byte-identical
-   * in the manifest to before this field existed (golden hashes UNCHANGED).
-   */
-  readonly hasInvariant?: true;
-  /** The LAW-DECLARED instance cap; omitted when uncapped (hash-stable). */
-  readonly cap?: number;
-  /**
-   * READ VISIBILITY (slice 5.1) — the capability a read TOUCHING this type requires.
-   * PRESENT only when the type is declared `visibility: requires(cap)` (PRIVATE);
-   * OMITTED ENTIRELY for the default `public`, so a public-only domain is
-   * byte-identical in the manifest to before this key existed (golden hashes
-   * UNCHANGED — mirrors `cap`/`hasInvariant`). It IS law (the githolon refuses an
-   * unauthorized read on it), so adding/changing it MOVES the hash.
-   */
-  readonly requiresRead?: string;
-  /**
-   * E2E ENCRYPTION (slice 2) — the STORED field names whose values are `.encrypted()`,
-   * SORTED. PRESENT only when ≥1 field is encrypted; OMITTED otherwise (a plaintext
-   * aggregate is byte-identical). It IS law (the gate enforces the envelope + the scope),
-   * so adding/changing it MOVES the hash. The scope is the aggregate's `requiresRead`.
-   */
-  readonly encryptedFields?: string[];
-  /** Secure-by-default owned lowering. Presence means `requiresRead` is a PER-RECORD relation (not a
-   * workspace-wide capability), `ownerField` is framework-stamped, and the encrypted slots use the
-   * stateful-client owned-key lane. */
-  readonly owned?: { readonly ownerField: string; readonly relation: string };
-  /** Stored framework fields intentionally hidden from generated business models. */
-  readonly internalFields?: readonly string[];
-  /**
-   * ATTRIBUTED READS (architecture/field_provenance.md) — the STORED field names whose
-   * folded values keep author provenance (`.attributed()`), SORTED. PRESENT only when
-   * ≥1 field is attributed; OMITTED otherwise (an unattributed aggregate is
-   * byte-identical). The hash-bearing LAW is the wrapped `{"Attributed": <inner>}`
-   * driver in `schema`; this key is the self-describing mirror codegen/openapi read.
-   */
-  readonly attributedFields?: string[];
-}
-
-/** One captured directive contract — NO `plan`/`scopeFrom` behaviour. */
-export interface CanonicalDirective {
-  readonly id: string;
-  /** The target aggregate id. */
-  readonly target: string;
-  readonly marker: WireRefMode;
-  /**
-   * MULTI-OUTPUT DIRECTIVES: additional aggregates this directive declares it writes, beyond the primary
-   * `target`/`marker` — `{ target, marker }` pairs SORTED by (target, marker). Descriptive law metadata
-   * (docs/proof/client name every output). OMITTED ENTIRELY when the directive declares none, so a
-   * single-output directive is byte-identical to before this key existed (pinned golden hashes unchanged).
-   */
-  readonly secondaryOutputs?: readonly { target: string; marker: WireRefMode }[];
-  /** The payload's top-level object shape as SORTED `[name, type]` pairs. */
-  readonly payload: CanonicalPayloadField[];
-  /**
-   * The directive payload as standard JSON Schema, emitted from the same TS/Zod source
-   * that the sealed GitHolon engine validates. This is the cross-language validation
-   * artifact: Dart/hosts can validate dynamic maps with a JSON Schema library without
-   * re-authoring the schema in Dart.
-   */
-  readonly payloadJsonSchema: unknown;
-  /**
-   * The directive's DECLARED read boundary (sorted ref types). The "IR for law
-   * boundaries": the boundary is part of the domain identity. OMITTED ENTIRELY when
-   * the directive declares no reads — so a boundary-free directive is byte-identical
-   * to before this key existed (pinned golden hashes stay UNCHANGED).
-   */
-  readonly reads?: string[];
-  /**
-   * The directive's DECLARED emit boundary: event type → `{ max? }`. Keys sorted by
-   * `canonicalJson`. OMITTED ENTIRELY when the directive declares no emits, for the
-   * same omit-when-empty hash-invariance reason as {@link reads}.
-   */
-  readonly emits?: Record<string, { max?: number }>;
-  /**
-   * The directive's DECLARED CAPTURED-READ queries (#58 — the captured-read lane):
-   * the O(1) DSL queries its `plan` may `read()` on the write path, each carried as
-   * `{queryId, key, returns}` (the read RECIPE is the contract — a different key or
-   * returns-type is a different read, so it moves the hash). SORTED by queryId.
-   * OMITTED ENTIRELY when the directive declares none — a captured-read-free
-   * directive is byte-identical in the manifest to before this key existed.
-   */
-  readonly capturedReads?: CanonicalCapturedRead[];
-  /**
-   * The directive's DECLARED required HOST CAPABILITY ports (`OFFER_KERNEL_ARCHITECTURE.dot` cluster_ports;
-   * the HOST/PORT axis, invariant 3): the capability ports the host must PROVIDE for the
-   * directive to run, checked FAIL-CLOSED (`required ⊆ provided`) at policy LOAD. SORTED (the
-   * SET is the contract; order is incidental). DISTINCT from {@link requiresCapability} (the
-   * AUTHZ axis "may this actor?", a single string) — this is the HOST axis "can this host
-   * physically?" (a set of open-set port ids). Part of the domain identity: a different required
-   * port is a different contract, so adding/changing one MOVES the hash. OMITTED ENTIRELY when
-   * the directive declares no host capability — so a host-capability-free directive is
-   * byte-identical in the manifest to before this key existed (pinned golden hashes stay
-   * UNCHANGED), exactly how {@link reads}/{@link relations} stay hash-neutral.
-   */
-  readonly requiresHostCapability?: string[];
-  /**
-   * A law-declared business conflict resolver. The generated client carries an immutable
-   * framework snapshot beside this directive's payload, and every admission/replay door
-   * compare-and-sets it against the exact pending observation set. Omitted for ordinary
-   * directives, so ordinary business actions carry no conflict vocabulary.
-   */
-  readonly conflictResolution?: {
-    readonly aggregate: string;
-    readonly field: string;
-  };
-  /**
-   * The directive's DECLARED cross-workspace relations (`cross_workspace.md` §2): the relations
-   * a cross-workspace PR proposing this directive is adjudicated against. Each carries the
-   * source/target endpoints, the bounded evidence read it discloses (the disclosure contract +
-   * anti-smuggle key, §2.4), and whether an invariant guards it (PRESENCE only — the predicate
-   * body is executable behaviour, NOT hashed, exactly like a directive `plan`). SORTED BY the
-   * relation `id`. Part of the domain identity: the gate (`kernel::manifest_view`) resolves the
-   * relation by the proposed directive + verifies a carried witness against the declared evidence
-   * read; a recipe change (different aggregate/fields/predicate) MOVES the hash. OMITTED ENTIRELY
-   * when the directive declares no relation — so a relation-free directive is byte-identical in
-   * the manifest to before this key existed (pinned golden hashes stay UNCHANGED).
-   */
-  readonly relations?: CanonicalRelation[];
-}
-
-/** One captured cross-workspace relation — the SEMANTIC half of X1 in the manifest
- * (`cross_workspace.md` §2.1 / §2.4). `id`/`source`/`target`/`proposes` are the endpoints +
- * the proposed directive; `evidence` is the bounded declared read (disclosure contract +
- * anti-smuggle key); `hasInvariant` is the guard's PRESENCE (the body is executable, NOT
- * hashed). A recipe change moves the domain hash. */
-export interface CanonicalRelation {
-  readonly id: string;
-  readonly source: string;
-  readonly target: string;
-  readonly proposes: string;
-  readonly evidence: CanonicalRelationEvidence;
-  readonly hasInvariant: boolean;
-}
-
-/** The bounded evidence read a relation discloses over the SOURCE, in the manifest: the source
- * aggregate, the exact SELECT fields (SORTED — the set is the contract), the WHERE predicate,
- * and the freshness `kind`. This IS the disclosure contract + the anti-smuggle key. */
-export interface CanonicalRelationEvidence {
-  readonly aggregate: string;
-  readonly select: string[];
-  readonly where: string;
-  readonly kind: string;
-}
-
-/** One DECLARED captured-read query (#58) — the write-path `read()` recipe in the
- * manifest: the query id, its index key (DECLARED order — index column order), and the
- * aggregate TYPE it returns. */
-export interface CanonicalCapturedRead {
-  readonly queryId: string;
-  readonly key: string[];
-  readonly returns: string;
-}
-
-
-/**
- * One captured query declaration — the read-side closure's named, INDEXED read.
- * `key` is the index column order, PRESERVED (NOT sorted): the order of the index
- * key fields is part of the contract, so two queries differing only in key order
- * are distinct identities.
- */
-export interface CanonicalQuery {
-  readonly id: string;
-  /** Index key fields, in DECLARED order (index column order — preserved). */
-  readonly key: string[];
-  /** The aggregate TYPE id the query returns, e.g. `SampleThingAggregate`. */
-  readonly returns: string;
-}
-
-/**
- * One captured count declaration — the read-side closure's named, MAINTAINED tally.
- * Mirrors {@link CanonicalQuery}: a count's `of`-type + (optional) `where` predicate +
- * (optional) `by` group-by field are part of the domain CONTRACT (changing them changes
- * the maintained counter), so they are part of the identity.
- *
- * OMIT-WHEN-ABSENT:
- *   `where` is OMITTED ENTIRELY for a predicate-free count — so an unfiltered count is
- *   byte-identical in the manifest to before `where` existed (golden hashes UNCHANGED).
- *   `by` is OMITTED ENTIRELY for a grand-total count (same discipline, always was).
- */
-export interface CanonicalCount {
-  readonly id: string;
-  /** The aggregate TYPE id the count tallies, e.g. `SiteRootAggregate`. */
-  readonly of: string;
-  /**
-   * The predicate filtering which aggregates are counted. OMITTED when no predicate
-   * (an unfiltered count is byte-identical in the manifest to before this existed).
-   * The canonical form is insertion-order–independent (clauses sorted deterministically
-   * by `canonicalizePred`), so byte-identical predicate logic → byte-identical hash.
-   */
-  readonly where?: CanonicalPred;
-  /** The group-by field, in DECLARED form. OMITTED for a grand-total count. */
-  readonly by?: string;
-  /**
-   * THE ESTATE SCOPE (sharding §5, slice 3): the workspace-type id this read is
-   * lifted to via `scoped(read, Ws)` — its per-shard values ride the §5.2 delta
-   * lane as gate-recomputed coordinator subtotals. OMITTED for home-scope reads
-   * (every pre-slice-3 count is byte-identical — the `cap(n)` discipline).
-   */
-  readonly scope?: string;
-}
-
-/**
- * One captured SPATIAL index declaration — the read-side closure's named, MAINTAINED
- * GEOSPATIAL (R*Tree) index. Mirrors {@link CanonicalCount}: a spatial index's `of`-type and
- * the geometry field it indexes (`on`) are part of the domain CONTRACT (changing either
- * changes the maintained bounding-box index), so they are part of the identity. There is no
- * optional/omit-when-absent sub-field — both `id`/`of`/`on` are always present.
- */
-export interface CanonicalSpatial {
-  readonly id: string;
-  /** The aggregate TYPE id the spatial index covers, e.g. `TrackableAsset`. */
-  readonly of: string;
-  /** The GeoJSON geometry field whose bounding box is indexed, e.g. `geoPosition`. */
-  readonly on: string;
-}
-
-/**
- * One captured sum declaration — the read-side closure's named, MAINTAINED numeric
- * aggregation. Analogous to {@link CanonicalCount}: a sum's `of`-type, `sumField`,
- * optional `where` predicate, and optional `by` group-by field are all part of the
- * domain CONTRACT. Changing any of them changes the meaning of the maintained total.
- *
- * OMIT-WHEN-ABSENT: `where` and `by` are OMITTED ENTIRELY when not declared — so a
- * predicate-free, grand-total sum is byte-identical to the minimal `{id, of, sumField}`
- * form (golden hashes stable). Same discipline as {@link CanonicalCount}.
- */
-export interface CanonicalSum {
-  readonly id: string;
-  /** The aggregate TYPE id the sum tallies. */
-  readonly of: string;
-  /**
-   * The `int`-kind field whose values are accumulated, e.g. `"itemValue"`. MUST be
-   * an `int`-kind field of the `of`-aggregate (validated at manifest-load in Rust).
-   */
-  readonly sumField: string;
-  /**
-   * The predicate filtering which aggregates contribute. OMITTED when no predicate.
-   */
-  readonly where?: CanonicalPred;
-  /** The group-by field. OMITTED for a grand-total sum. */
-  readonly by?: string;
-  /** THE ESTATE SCOPE (sharding §5, slice 3) — see {@link CanonicalCount.scope}. */
-  readonly scope?: string;
-}
-
-/**
- * One captured DERIVED read field — the read-side closure's engine-projected pure field.
- * Mirrors {@link CanonicalCount}: a derived field's NAME (`id`) + the aggregate it derives
- * from (`of`) are part of the domain CONTRACT (the read schema), so they are part of the
- * identity. The fn BODY is DELIBERATELY NOT captured — it is executable behaviour, exactly
- * like a directive's `plan` (which `domainManifest` also omits), so refactoring the derive
- * fn while keeping its `(id, of)` identical does NOT change the domain hash.
- */
-export interface CanonicalDerived {
-  readonly id: string;
-  /** The aggregate TYPE id the field is derived from, e.g. `SupportSessionAggregate`. */
-  readonly of: string;
-  /** The projected value schema. The fn body is not hashed; the value contract is. */
-  readonly returns: CanonicalProjectionReturn;
-}
-
-/**
- * One captured COMBINED read field — the read-side closure's engine-projected CROSS-
- * AGGREGATE JOIN field. Mirrors {@link CanonicalDerived} but with the JOIN axis: a
- * combined field's NAME (`id`), the OWNER aggregate (`of`), the REF FIELD it joins
- * through (`refField`), and the RELATED type it queries (`reads`) are all part of the
- * domain CONTRACT (the read schema + the cross-aggregate invalidation edge), so they are
- * part of the identity. The fn BODY is DELIBERATELY NOT captured — executable behaviour,
- * exactly like a directive's `plan` / a derived field's fn, so refactoring the compose fn
- * while keeping its `(id, of, refField, reads)` identical does NOT change the domain hash.
- */
-export interface CanonicalCombined {
-  readonly id: string;
-  /** The OWNER aggregate TYPE id the field lives on, e.g. `BuildingAggregate`. */
-  readonly of: string;
-  /** The owner's REF FIELD whose value is the related aggregate's id, e.g. `siteId`. */
-  readonly refField: string;
-  /** The RELATED aggregate TYPE the field reads (the invalidation key), e.g. `SiteRootAggregate`. */
-  readonly reads: string;
-  /** The projected value schema. The fn body is not hashed; the value contract is. */
-  readonly returns: CanonicalProjectionReturn;
-}
-
-/**
- * One captured MIN or MAX declaration — structurally identical to {@link CanonicalSum}
- * (same `of`/`valueField`/`where?`/`by?` shape) except it carries an explicit `kind`
- * discriminant (`"min"` | `"max"`). OMIT-WHEN-ABSENT: `where` and `by` follow the same
- * omit-when-not-declared discipline as `CanonicalSum`.
- */
-export interface CanonicalExtremum {
-  readonly id: string;
-  readonly kind: "min" | "max";
-  /** The aggregate TYPE id the extremum tallies. */
-  readonly of: string;
-  /** The `int`-kind field being extremised. */
-  readonly valueField: string;
-  /** The predicate filtering which aggregates contribute. OMITTED when no predicate. */
-  readonly where?: CanonicalPred;
-  /** The group-by field. OMITTED for a grand-total extremum. */
-  readonly by?: string;
-  /** THE ESTATE SCOPE (sharding §5, slice 8) — see {@link CanonicalCount.scope}:
-   *  per-shard extremums ride the §5.2 delta lane as gate-adjudicated coordinator
-   *  subtotals (extremize-on-monotone; retractions re-derive). OMITTED for
-   *  home-scope extremums, so an unscoped declaration is byte-identical to before
-   *  this key existed (golden hashes UNCHANGED). */
-  readonly scope?: string;
-}
-
-/**
- * One captured ORDERED READ declaration — an order-sensitive row read with a MANDATORY
- * declared total order. `orderKey` is NON-OPTIONAL (a missing key is a manifest
- * validation error, rejected LOUDLY at parse with no fallback). `limit` = 1 for `first`,
- * `n` for `take(n)`. OMIT-WHEN-ABSENT: `where` is omitted when no predicate.
- */
-export interface CanonicalOrderedRead {
-  readonly id: string;
-  /** The aggregate TYPE id the read returns. */
-  readonly of: string;
-  /** The REQUIRED total-order key (a declared scalar field of `of`). */
-  readonly orderKey: string;
-  /** Whether to sort descending. Default absent = ascending. */
-  readonly orderDesc?: true;
-  /** The optional predicate. OMITTED when no predicate. */
-  readonly where?: CanonicalPred;
-  /** LIMIT — 1 for `first`, n for `take(n)`. */
-  readonly limit: number;
-}
-
-/**
- * A workspace invariant's PRESENCE in the hashed identity surface (#266): its id + the
- * directive it fires `on`. PRESENCE ONLY — the executable `reads`/`assert` bodies are NOT
- * hashed (they ship in the engine bundle), exactly like the aggregate `hasInvariant` flag.
- * Changing a body does NOT move the domain hash; adding/removing an invariant DOES (it is law).
- */
-export interface CanonicalWorkspaceInvariant {
-  readonly id: string;
-  readonly on: string;
-}
-
-/** A domain's canonical semantic manifest — the hashed identity surface. */
-export interface CanonicalManifest {
-  readonly domain: string;
-  readonly aggregates: CanonicalAggregate[];
-  readonly directives: CanonicalDirective[];
-  /**
-   * STABLE IDENTIFIERS (#58 — the foundation: names are LABELS, identity is MINTED by
-   * the compiler at first appearance, never dev-assigned). Carries `{stableId, name}`
-   * for the domain, every aggregate, and every field — keyed by CURRENT name, each
-   * entry holding its `sid` plus the label lineage `was` (prior names, oldest first;
-   * compiler-derived from continuity, never dev-written). ALWAYS EMITTED by the post-
-   * #58 compiler — this key MOVES every enforcement-era identity hash (named and
-   * expected; inert-era artifacts already built stay byte-identical untouched). The
-   * EVOLVE GATE diffs old vs new law BY SID; the projection folds via the sid lineage
-   * so a renamed entity's old-era data coheres under the new label.
-   */
-  readonly stableIds?: StableIds;
-  /**
-   * The domain's WORKSPACE INVARIANTS (#266), SORTED by id, PRESENCE ONLY (id + `on`).
-   * OMITTED ENTIRELY when the domain declares none — so an invariant-free domain is
-   * byte-identical to before this key existed (pinned golden hashes UNCHANGED).
-   */
-  readonly workspaceInvariants?: CanonicalWorkspaceInvariant[];
-  /**
-   * The domain's NAMED, INDEXED read declarations, SORTED by id. OMITTED ENTIRELY
-   * when the domain declares no query — so a query-free domain is byte-identical to
-   * before this key existed (the pinned golden hash stays UNCHANGED). Each query's
-   * `key` preserves its DECLARED order (index column order), unlike a directive's
-   * incidental read SET.
-   */
-  readonly queries?: CanonicalQuery[];
-  /**
-   * The domain's NAMED, MAINTAINED count declarations, SORTED by id. OMITTED ENTIRELY
-   * when the domain declares no count — so a count-free domain is byte-identical to
-   * before this key existed (the pinned golden hash stays UNCHANGED), exactly like
-   * {@link queries}. The aggregation analogue of the read-side closure. Each entry may
-   * carry an optional `where` predicate (Slice 1 — omit-when-absent; predicate-free
-   * counts are byte-identical to before `where` was introduced).
-   */
-  readonly counts?: CanonicalCount[];
-  /**
-   * The domain's NAMED, MAINTAINED SPATIAL (R*Tree) index declarations, SORTED by id.
-   * OMITTED ENTIRELY when the domain declares no spatial index — so a spatial-free domain is
-   * byte-identical to before this key existed (the pinned golden hash stays UNCHANGED),
-   * exactly like {@link counts}. The geospatial analogue of the read-side closure. Each entry
-   * carries `{id, of, on}` — the geometry field whose bounding box the engine maintains.
-   */
-  readonly spatials?: CanonicalSpatial[];
-  /**
-   * The domain's NAMED, MAINTAINED sum declarations, SORTED by id. OMITTED ENTIRELY
-   * when the domain declares no sum — so a sum-free domain is byte-identical to before
-   * this key existed (the pinned golden hash stays UNCHANGED), exactly like
-   * {@link counts}. The numeric-accumulation analogue of count (Slice 1).
-   */
-  readonly sums?: CanonicalSum[];
-  /**
-   * The domain's DERIVED read-field declarations, SORTED by id. OMITTED ENTIRELY when the
-   * domain declares no derived field — so a derived-free domain is byte-identical to before
-   * this key existed (the pinned golden hash stays UNCHANGED), exactly like {@link counts}.
-   * Each carries ONLY `{id, of}` — the fn body is NOT hashed (executable behaviour, like a
-   * directive's `plan`).
-   */
-  readonly deriveds?: CanonicalDerived[];
-  /**
-   * The domain's COMBINED read-field declarations, SORTED by id. OMITTED ENTIRELY when the
-   * domain declares no combined field — so a combined-free domain is byte-identical to
-   * before this key existed (the pinned golden hash stays UNCHANGED), exactly like
-   * {@link deriveds}. Each carries `{id, of, refField, reads}` — the fn body is NOT hashed.
-   */
-  readonly combineds?: CanonicalCombined[];
-  /**
-   * The domain's MAINTAINED MIN declarations, SORTED by id. OMITTED ENTIRELY when the
-   * domain declares no min — so a min-free domain is byte-identical to before this key
-   * existed (golden hashes unchanged). Same omit-when-absent discipline as `sums`.
-   */
-  readonly mins?: CanonicalExtremum[];
-  /**
-   * The domain's MAINTAINED MAX declarations, SORTED by id. OMITTED ENTIRELY when the
-   * domain declares no max. Same discipline as `mins`.
-   */
-  readonly maxes?: CanonicalExtremum[];
-  /**
-   * The domain's ORDERED ROW READ declarations (first/take.orderBy), SORTED by id.
-   * OMITTED ENTIRELY when the domain declares none. Each carries the REQUIRED `orderKey`
-   * (non-optional at both TS and manifest levels), optional predicate, and `limit`.
-   */
-  readonly orderedReads?: CanonicalOrderedRead[];
-  /**
-   * The domain's FIRST-CLASS WORKSPACE TYPES (sharding §10 RATIFIED, slice 1), SORTED
-   * by id. OMITTED ENTIRELY when the domain declares none — so a taxonomy-free domain
-   * is byte-identical to before this key existed (pinned golden hashes UNCHANGED; the
-   * `cap(n)` discipline). The taxonomy IS law: a type's root/mode/children/globals/
-   * pool/cap all move the domain hash (per-type optional keys omitted-when-absent).
-   */
-  readonly workspaceTypes?: CanonicalWorkspaceType[];
-  /**
-   * The DERIVED HOMING TABLE (aggregate wire id → workspace-type id) — present iff
-   * {@link workspaceTypes} is. Derived (never hand-written) by the fail-closed homing
-   * walk over the aggregates' `t.ref` chains, and HASH-BEARING: a homing move is a
-   * law change (placement of FACTS is custody, but which chain a fact is BORN into
-   * is law — the shard gate's `wrong-home` invariant pins to this table).
-   */
-  readonly homes?: Record<string, string>;
-  /**
-   * THE DERIVED DIRECTIVE ROUTING TABLE (sharding slice 2) — present only when the
-   * domain declares a taxonomy with at least one packed-homed directive, SORTED by
-   * directive id, HASH-BEARING (the client routes by it; the shard gate's typed
-   * `wrong-home` refusal pins to it). OMITTED ENTIRELY otherwise (hash-stable).
-   */
-  readonly routes?: CanonicalDirectiveRoute[];
-}
-
-/** Minimal structural view of Zod 4 schema internals we read deterministically. */
-interface ZodLike {
-  _def?: {
-    type?: string;
-    innerType?: ZodLike;
-    shape?: Record<string, ZodLike> | (() => Record<string, ZodLike>);
-  };
-  def?: {
-    type?: string;
-    innerType?: ZodLike;
-    shape?: Record<string, ZodLike> | (() => Record<string, ZodLike>);
-  };
-  shape?: Record<string, ZodLike>;
-}
-
-function zodDef(zod: ZodLike): NonNullable<ZodLike["_def"]> {
-  return zod._def ?? zod.def ?? {};
-}
-
-function zodTypeName(zod: ZodLike): string {
-  const def = zodDef(zod);
-  return def.type ?? "unknown";
-}
-
-function zodObjectShape(zod: ZodLike): Record<string, ZodLike> | undefined {
-  const shape = zodDef(zod).shape;
-  if (typeof shape === "function") return shape();
-  if (shape !== undefined) return shape;
-  return zod.shape;
-}
-
-/**
- * Sort an object's keys so the schema's field order is irrelevant to identity. The
- * authored field order on an aggregate or payload is incidental; only the SET of
- * field→driver / field→type pairs is the contract.
- */
-function sortedSchema(schema: WireSchema): WireSchema {
-  const out: WireSchema = {};
-  for (const key of Object.keys(schema).sort()) out[key] = schema[key]!;
-  return out;
-}
-
-/**
- * Unwrap ZodOptional / ZodDefault to recover `{ optional, type }`. The OPTIONALITY
- * is part of the contract (an optional field is a different shape); the wrapper
- * identity (Optional vs Default) is NOT — both mean "may be absent" to a caller.
- */
-function unwrapPayloadType(zod: ZodLike): { optional: boolean; type: string } {
-  let cur = zod;
-  let optional = false;
-  // Peel optional/default wrappers (possibly nested) to the inner contract type.
-  while (zodTypeName(cur) === "optional" || zodTypeName(cur) === "default") {
-    optional = true;
-    const inner = zodDef(cur).innerType;
-    if (inner === undefined) break;
-    cur = inner;
-  }
-  return { optional, type: zodTypeName(cur) };
-}
-
-function unwrapProjectionReturn(zod: ZodLike): { nullable: boolean; type: string } {
-  let cur = zod;
-  let nullable = false;
-  while (
-    zodTypeName(cur) === "optional" ||
-    zodTypeName(cur) === "default" ||
-    zodTypeName(cur) === "nullable"
-  ) {
-    nullable = true;
-    const inner = zodDef(cur).innerType;
-    if (inner === undefined) break;
-    cur = inner;
-  }
-  return { nullable, type: zodTypeName(cur) };
-}
-
-function canonicalProjectionReturn(schema: unknown): CanonicalProjectionReturn {
-  const { nullable, type } = unwrapProjectionReturn(schema as ZodLike);
-  return {
-    type,
-    nullable,
-    jsonSchema: z.toJSONSchema(schema as z.ZodTypeAny),
-  };
-}
-
-/**
- * Canonically capture a directive's payload: the top-level object's fields as
- * SORTED `[name, type]` pairs (with optionality). A non-object top-level schema
- * (rare) captures as a single synthetic field carrying its type name.
- */
-function canonicalPayload(payloadSchema: unknown): CanonicalPayloadField[] {
-  const zod = payloadSchema as ZodLike;
-  const shape = zodObjectShape(zod);
-  if (zodTypeName(zod) !== "object" || shape === undefined) {
-    // Not a top-level object: thing the bare type so a shape change still moves
-    // the hash, without inventing field structure.
-    return [{ name: "", type: zodTypeName(zod), optional: false }];
-  }
-  return Object.keys(shape)
-    .sort()
-    .map((name) => {
-      const { optional, type } = unwrapPayloadType(shape[name]!);
-      return { name, type, optional };
-    });
-}
-
-function canonicalPayloadJsonSchema(payloadSchema: unknown): unknown {
-  return z.toJSONSchema(payloadSchema as z.ZodTypeAny);
-}
-
-/**
- * Canonicalize a directive's declared READ boundary into a manifest fragment.
- * OMIT-WHEN-EMPTY: returns `{}` (no `reads` key at all) when nothing is declared —
- * the omission, not an empty array, is what keeps boundary-free hashes unchanged.
- * When non-empty, returns a SORTED `reads` array (order is incidental to the boundary).
- */
-function canonicalReads(declared: string[]): { reads?: string[] } {
-  if (declared.length === 0) return {};
-  return { reads: [...declared].sort() };
-}
-
-/** Canonicalize a directive's MULTI-OUTPUT secondary writes → `{ target, marker }` sorted by (target,
- *  marker). Omit-when-empty (the era rule — a single-output directive contributes no key). */
-function canonicalSecondaryOutputs(
-  declared: readonly { marker: ReferentialMarker; aggregateId: string }[] | undefined,
-): { secondaryOutputs?: { target: string; marker: WireRefMode }[] } {
-  if (declared === undefined || declared.length === 0) return {};
-  const out = declared
-    .map((s) => ({ target: s.aggregateId, marker: encodeRefMode(s.marker) }))
-    .sort((a, b) => (a.target !== b.target ? (a.target < b.target ? -1 : 1) : a.marker < b.marker ? -1 : a.marker > b.marker ? 1 : 0));
-  return { secondaryOutputs: out };
-}
-
-/**
- * Canonicalize a directive's declared required HOST CAPABILITY ports into a manifest fragment
- * (the HOST/PORT axis, invariant 3). OMIT-WHEN-EMPTY: returns `{}` (no `requiresHostCapability`
- * key at all) when the directive declares none — the omission, not an empty array, is what keeps
- * host-capability-free hashes UNCHANGED. When non-empty, returns a SORTED `requiresHostCapability`
- * array (order is incidental to the port SET). DISTINCT from `canonicalReads`/`requiresCapability`
- * (the two axes — HOST vs AUTHZ — never conflate in the manifest).
- */
-function canonicalHostCapabilities(declared: string[]): { requiresHostCapability?: string[] } {
-  if (declared.length === 0) return {};
-  return { requiresHostCapability: [...declared].sort() };
-}
-
-/**
- * Canonicalize a directive's declared EMIT boundary into a manifest fragment.
- * OMIT-WHEN-EMPTY: returns `{}` (no `emits` key) when nothing is declared. When
- * non-empty, returns an `emits` object whose keys `canonicalJson` will sort, each
- * value `{ max }` only when a bound is set (so `{}` vs `{max}` differs in identity).
- */
-function canonicalEmits(
-  declared: Record<string, { max?: number }>,
-): { emits?: Record<string, { max?: number }> } {
-  const keys = Object.keys(declared);
-  if (keys.length === 0) return {};
-  const emits: Record<string, { max?: number }> = {};
-  for (const key of keys.sort()) {
-    const max = declared[key]!.max;
-    emits[key] = max !== undefined ? { max } : {};
-  }
-  return { emits };
-}
-
-/**
- * Canonicalize a directive's DECLARED captured-read queries (#58) into a manifest
- * fragment. OMIT-WHEN-EMPTY: returns `{}` (no `capturedReads` key) when the directive
- * declares none — the omission keeps read-free hashes unchanged. When non-empty,
- * returns a `capturedReads` array SORTED by queryId, each carrying the read recipe
- * `{queryId, key, returns}` (key in DECLARED order — index column order).
- */
-function canonicalCapturedReads(
-  declared: QueryDecl[],
-): { capturedReads?: CanonicalCapturedRead[] } {
-  if (declared.length === 0) return {};
-  const capturedReads: CanonicalCapturedRead[] = declared
-    .map((q) => ({ queryId: q.id, key: [...q.key], returns: q.returns }))
-    .sort((a, b) => (a.queryId < b.queryId ? -1 : a.queryId > b.queryId ? 1 : 0));
-  return { capturedReads };
-}
-
-/**
- * Canonicalize a directive's declared cross-workspace relations into a manifest fragment
- * (`cross_workspace.md` §2). OMIT-WHEN-EMPTY: returns `{}` (no `relations` key) when the
- * directive declares none — the omission keeps relation-free hashes unchanged. When non-empty,
- * a `relations` array SORTED BY relation `id`, each carrying the endpoints + the bounded
- * evidence read (SELECT fields SORTED) + `hasInvariant` (presence only). A recipe change
- * (aggregate/fields/predicate) MOVES the domain hash — a different relation is a different
- * contract. The invariant PREDICATE body is NOT captured (executable behaviour, like `plan`).
- */
-function canonicalRelations(
-  declared: RelationDecl[],
-): { relations?: CanonicalRelation[] } {
-  if (declared.length === 0) return {};
-  const relations: CanonicalRelation[] = declared
-    .map((r) => ({
-      id: r.id,
-      source: r.source,
-      target: r.target,
-      proposes: r.proposes,
-      evidence: {
-        aggregate: r.evidence.aggregate,
-        select: [...r.evidence.select].sort(),
-        where: r.evidence.where,
-        kind: r.evidence.kind,
-      },
-      hasInvariant: r.hasInvariant,
-    }))
-    .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
-  return { relations };
-}
-
-/**
- * Canonicalize a domain's declared QUERIES into a manifest fragment.
- * OMIT-WHEN-EMPTY: returns `{}` (no `queries` key at all) when the domain declares
- * none — the omission, not an empty array, is what keeps query-free hashes unchanged.
- * When non-empty, returns a `queries` array SORTED by id (the SET of queries is the
- * contract), each carrying its `key` in DECLARED order (index column order, NOT
- * sorted) and its `returns` aggregate type id.
- */
-function canonicalQueries(
-  declared: QueryDecl[] | undefined,
-): { queries?: CanonicalQuery[] } {
-  if (declared === undefined || declared.length === 0) return {};
-  const queries: CanonicalQuery[] = [...declared]
-    .map((q) => ({ id: q.id, key: [...q.key], returns: q.returns }))
-    .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
-  return { queries };
-}
-
-/**
- * Canonicalize a domain's WORKSPACE INVARIANTS into a manifest fragment (#266) — the
- * presence-only analogue of {@link canonicalQueries}. OMIT-WHEN-EMPTY: returns `{}` (no key)
- * when none are declared, so an invariant-free domain hashes identically to before. Each entry
- * is PRESENCE ONLY (id + the directive it is `on`), SORTED by id; the executable `reads`/
- * `assert` bodies are NEVER hashed (they ship in the engine bundle). So changing a body leaves
- * the hash unchanged, while adding/removing an invariant moves it (it is law — #131).
- */
-function canonicalWorkspaceInvariants(
-  declared: WorkspaceInvariantDecl[] | undefined,
-): { workspaceInvariants?: CanonicalWorkspaceInvariant[] } {
-  if (declared === undefined || declared.length === 0) return {};
-  const workspaceInvariants: CanonicalWorkspaceInvariant[] = [...declared]
-    .map((wi) => ({ id: wi.id, on: wi.on }))
-    .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
-  return { workspaceInvariants };
-}
-
-/**
- * Canonicalize a domain's declared COUNTS into a manifest fragment — the aggregation
- * analogue of {@link canonicalQueries}.
- * OMIT-WHEN-EMPTY: returns `{}` (no `counts` key at all) when the domain declares none —
- * the omission, not an empty array, is what keeps count-free hashes unchanged. When
- * non-empty, returns a `counts` array SORTED by id (the SET of counts is the contract),
- * each carrying its `of`-type and — only when declared — its `by` group-by field (a
- * grand-total count omits `by` entirely, so it adds no phantom key to the hash).
- */
-function canonicalCounts(
-  declared: AnyCount[] | undefined,
-): { counts?: CanonicalCount[] } {
-  if (declared === undefined || declared.length === 0) return {};
-  const counts: CanonicalCount[] = [...declared]
-    .map((raw) => ({ finished: finishCount(raw), scope: (raw as { scope?: unknown }).scope }))
-    .map(({ finished: c, scope }) => ({
-      id: c.id,
-      of: c.of,
-      // OMIT-WHEN-ABSENT: `where`, `by` and `scope` are omitted when not declared so
-      // a predicate-free / grand-total / home-scope count is byte-identical to the
-      // legacy form (hash-stable — the same discipline as every other optional key).
-      ...(c.where !== undefined ? { where: c.where } : {}),
-      ...(c.by !== undefined ? { by: c.by } : {}),
-      ...(typeof scope === "string" ? { scope } : {}),
-    }))
-    .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
-  return { counts };
-}
-
-/**
- * Canonicalize a domain's declared SPATIAL indexes into a manifest fragment — the
- * geospatial analogue of {@link canonicalCounts}.
- * OMIT-WHEN-EMPTY: returns `{}` (no `spatials` key at all) when the domain declares none —
- * the omission, not an empty array, is what keeps spatial-free hashes unchanged. When
- * non-empty, returns a `spatials` array SORTED by id (the SET of spatial indexes is the
- * contract), each carrying its `of`-type and the `on` geometry field whose bounding box is
- * indexed.
- */
-function canonicalSpatials(
-  declared: SpatialDecl[] | undefined,
-): { spatials?: CanonicalSpatial[] } {
-  if (declared === undefined || declared.length === 0) return {};
-  const spatials: CanonicalSpatial[] = [...declared]
-    .map((s) => ({ id: s.id, of: s.of, on: s.on }))
-    .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
-  return { spatials };
-}
-
-/**
- * Canonicalize a domain's declared SUMS into a manifest fragment — the numeric-
- * accumulation analogue of {@link canonicalCounts}.
- * OMIT-WHEN-EMPTY: returns `{}` (no `sums` key at all) when the domain declares none.
- * When non-empty, returns a `sums` array SORTED by id. `where` and `by` are omitted
- * when not declared (same omit-when-absent discipline as `CanonicalCount`).
- */
-function canonicalSums(declared: AnySum[] | undefined): { sums?: CanonicalSum[] } {
-  if (declared === undefined || declared.length === 0) return {};
-  const sums: CanonicalSum[] = [...declared]
-    .map((raw) => ({ finished: finishSum(raw), scope: (raw as { scope?: unknown }).scope }))
-    .map(({ finished: s, scope }) => ({
-      id: s.id,
-      of: s.of,
-      sumField: s.sumField,
-      ...(s.where !== undefined ? { where: s.where } : {}),
-      ...(s.by !== undefined ? { by: s.by } : {}),
-      ...(typeof scope === "string" ? { scope } : {}),
-    }))
-    .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
-  return { sums };
-}
-
-/**
- * Canonicalize a domain's declared DERIVED read fields into a manifest fragment — the
- * engine-projected analogue of {@link canonicalCounts}.
- * OMIT-WHEN-EMPTY: returns `{}` (no `deriveds` key at all) when the domain declares none —
- * the omission, not an empty array, is what keeps derived-free hashes unchanged. When
- * non-empty, returns a `deriveds` array SORTED by id (the SET of derived fields is the
- * contract), each carrying ONLY its `{id, of}` — the fn BODY is NOT hashed (executable
- * behaviour, exactly like a directive's `plan` body, which this manifest also omits).
- */
-function canonicalDeriveds(
-  declared: DerivedDecl[] | undefined,
-): { deriveds?: CanonicalDerived[] } {
-  if (declared === undefined || declared.length === 0) return {};
-  const deriveds: CanonicalDerived[] = [...declared]
-    .map((d) => ({ id: d.id, of: d.of, returns: canonicalProjectionReturn(d.returns) }))
-    .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
-  return { deriveds };
-}
-
-/**
- * Canonicalize a domain's declared COMBINED read fields into a manifest fragment — the
- * cross-aggregate JOIN analogue of {@link canonicalDeriveds}.
- * OMIT-WHEN-EMPTY: returns `{}` (no `combineds` key at all) when the domain declares none —
- * the omission, not an empty array, is what keeps combined-free hashes unchanged. When
- * non-empty, returns a `combineds` array SORTED by id (the SET of combined fields is the
- * contract), each carrying `{id, of, refField, reads}` — the JOIN edge + invalidation key
- * are part of the contract; the fn BODY is NOT hashed (executable behaviour, like a
- * directive's `plan` body, which this manifest also omits).
- */
-function canonicalCombineds(
-  declared: CombinedDecl[] | undefined,
-): { combineds?: CanonicalCombined[] } {
-  if (declared === undefined || declared.length === 0) return {};
-  const combineds: CanonicalCombined[] = [...declared]
-    .map((c) => ({
-      id: c.id,
-      of: c.of,
-      refField: c.refField,
-      reads: c.reads,
-      returns: canonicalProjectionReturn(c.returns),
-    }))
-    .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
-  return { combineds };
-}
-
-/**
- * Canonicalize a domain's declared MINS or MAXES into a manifest fragment.
- * OMIT-WHEN-EMPTY: returns `{}` (no key at all) when the domain declares none.
- * When non-empty, returns the array SORTED by id. `where` and `by` follow the same
- * omit-when-not-declared discipline as {@link canonicalSums}.
- */
-function canonicalExtrema(
-  declared: AnyExtremum[] | undefined,
-  keyName: "mins" | "maxes",
-): { mins?: CanonicalExtremum[] } | { maxes?: CanonicalExtremum[] } {
-  if (declared === undefined || declared.length === 0) return {};
-  const items: CanonicalExtremum[] = [...declared]
-    .map((raw) => ({ finished: finishExtremum(raw), scope: (raw as { scope?: unknown }).scope }))
-    .map(({ finished: e, scope }) => ({
-      id: e.id,
-      kind: e.kind,
-      of: e.of,
-      valueField: e.valueField,
-      ...(e.where !== undefined ? { where: e.where } : {}),
-      ...(e.by !== undefined ? { by: e.by } : {}),
-      // OMIT-WHEN-ABSENT (the canonicalSums discipline): a home-scope extremum is
-      // byte-identical to before the scope key existed — hash-stable by default.
-      ...(typeof scope === "string" ? { scope } : {}),
-    }))
-    .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
-  return { [keyName]: items };
-}
-
-/**
- * Canonicalize a domain's declared ORDERED READS (first/take) into a manifest fragment.
- * OMIT-WHEN-EMPTY: returns `{}` (no key at all) when the domain declares none.
- * When non-empty, returns an `orderedReads` array SORTED by id. `where` is omitted when
- * not declared; `orderDesc` is omitted when false (default = ascending). `orderKey` is
- * ALWAYS present (it is required — never optional).
- */
-function canonicalOrderedReads(
-  declared: OrderedReadDecl[] | undefined,
-): { orderedReads?: CanonicalOrderedRead[] } {
-  if (declared === undefined || declared.length === 0) return {};
-  const items: CanonicalOrderedRead[] = [...declared]
-    .map((d) => ({
-      id: d.id,
-      of: d.of,
-      orderKey: d.orderKey,
-      // OMIT-WHEN-DEFAULT: only include `orderDesc` when it is `true` (non-default).
-      ...(d.orderDesc ? { orderDesc: true as const } : {}),
-      ...(d.where !== undefined ? { where: d.where } : {}),
-      limit: d.limit,
-    }))
-    .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
-  return { orderedReads: items };
-}
-
-/**
- * The domain's STABLE-ID surface (#58): continuity-carried when the compiler attached
- * `mod.stableIdContinuity` (renames resolved, sids + lineage carried), deterministic
- * first-appearance minting otherwise — so the manifest stays a pure function of the
- * module (+ its attached continuity). Any aggregate/field the continuity does not
- * cover (a genuinely new appearance) mints fresh.
- */
-function stableIdsForModule(
-  mod: DomainModule,
-  aggregates: CanonicalAggregate[],
-): StableIds {
-  const continuity = mod.stableIdContinuity;
-  const domainSid = continuity?.domain ?? mintDomainSid(mod.name);
-  // The CURRENT field KINDS off the live handles (the retype arm's identity input —
-  // a `t.string()` → `t.int()` retype moves `kind` while the driver stays Lww).
-  const handlesById = new Map(mod.aggregates.map((a) => [a.id, a]));
-  const out: Record<string, StableAggregateId> = {};
-  for (const agg of aggregates) {
-    const prior = continuity?.aggregates[agg.id];
-    const aggSid = prior?.sid ?? mintAggregateSid(domainSid, agg.id);
-    const handleFields = (handlesById.get(agg.id)?.fields ?? {}) as Record<string, Field | undefined>;
-    const fields: Record<string, StableFieldId> = {};
-    for (const fieldName of Object.keys(agg.schema).sort()) {
-      const pf = prior?.fields[fieldName];
-      const kind = handleFields[fieldName]?.kind;
-      const handle = handleFields[fieldName];
-      const details = handle === undefined ? undefined : fieldValueContractDetails(handle);
-      const driver = handle === undefined ? undefined : encodeDriver(handle.driver);
-      const schema =
-        handle === undefined || kind === undefined || details === undefined || driver === undefined
-          ? undefined
-          : fieldSchemaIdentity(aggSid, pf?.sid ?? mintFieldSid(aggSid, fieldName), kind, details.contract, driver);
-      const evolutions =
-        handle === undefined || schema === undefined || driver === undefined || details === undefined
-          ? []
-          : fieldEvolutionRules(handle, pf, aggSid, pf?.sid ?? mintFieldSid(aggSid, fieldName), details, driver, schema);
-      fields[fieldName] = {
-        sid: pf?.sid ?? mintFieldSid(aggSid, fieldName),
-        ...(pf?.was !== undefined && pf.was.length > 0 ? { was: pf.was } : {}),
-        // The CURRENT kind, always from the live module (continuity never supplies it).
-        ...(kind !== undefined ? { kind } : {}),
-        ...(details !== undefined ? { contract: details.contract, shape: details.shape } : {}),
-        ...(schema !== undefined ? { schema } : {}),
-        ...(driver !== undefined ? { driver } : {}),
-        ...(evolutions.length > 0 ? { evolutions } : {}),
-        // Birth-presence law rides identity: the evolve guard reads it (fromBirth may not be
-        // NEWLY declared on a sid that existed without it).
-        ...(handleFields[fieldName]?.isFromBirth === true ? { fromBirth: true as const } : {}),
-      };
-    }
-    out[agg.id] = {
-      sid: aggSid,
-      ...(prior?.was !== undefined && prior.was.length > 0 ? { was: prior.was } : {}),
-      fields,
-    };
-  }
-  return { v: 1, domain: domainSid, aggregates: out };
-}
-
-/**
- * Identity of the value a generated TS/Dart conflict resolver is allowed to call `T`.
- * This is deliberately narrower than the domain hash (unrelated law may roll out without
- * invalidating a conflict) and richer than `Field.kind` (enum arms, value-object members,
- * nullability, references and encrypted/plain decoding all matter to the public type).
- */
-function fieldValueContractDetails(field: Field): { contract: string; shape: unknown } {
-  const valueObjectContract = (meta: NonNullable<Field["valueObject"]>) => ({
-    descriptor: meta.descriptor,
-    dependencies: meta.dependencies,
-    ...(meta.geometry !== undefined ? { geometry: meta.geometry } : {}),
-  });
-  const contractShape = normalizeFieldContract({
-    v: "nomos-field-value-contract-v1",
-    kind: field.kind,
-    jsonSchema: z.toJSONSchema(field.zod as z.ZodTypeAny),
-    ...(field.mapValueKind !== undefined ? { mapValueKind: field.mapValueKind } : {}),
-    ...(field.jsonShape !== undefined ? { jsonShape: field.jsonShape } : {}),
-    ...(field.valueObject !== undefined
-      ? { valueObject: valueObjectContract(field.valueObject) }
-      : {}),
-    ...(field.mapValueVo !== undefined
-      ? { mapValueVo: valueObjectContract(field.mapValueVo) }
-      : {}),
-    ...(field.refAggregateId !== undefined ? { refAggregateId: field.refAggregateId } : {}),
-    ...(field.foreignRef !== undefined ? { foreignRef: field.foreignRef } : {}),
-    ...(field.nullSemantic !== undefined ? { nullSemantic: field.nullSemantic } : {}),
-    ...(field.isClearable === true ? { clearable: true } : {}),
-    ...(field.isEncrypted === true ? { encrypted: true } : {}),
-  });
-  const contract = createHash("sha256")
-    .update(
-      `nomos-field-value-contract:v1:${canonicalJson(contractShape)}`,
-      "utf8",
-    )
-    .digest("hex");
-  return { contract, shape: contractShape };
-}
-
-function fieldSchemaIdentity(
-  aggregateSid: string,
-  fieldSid: string,
-  kind: string,
-  valueContract: string,
-  driver: unknown,
-): string {
-  return createHash("sha256")
-    .update(
-      canonicalJson({
-        v: "nomos-field-schema-v2",
-        aggregate: aggregateSid,
-        field: fieldSid,
-        kind,
-        valueContract,
-        driver,
-      }),
-      "utf8",
-    )
-    .digest("hex");
-}
-
-function fieldEvolutionRules(
-  field: Field,
-  prior: StableFieldId | undefined,
-  aggregateSid: string,
-  fieldSid: string,
-  target: { contract: string; shape: unknown },
-  driver: unknown,
-  targetSchema: string,
-): StableFieldEvolution[] {
-  const bySource = new Map<string, StableFieldEvolution>();
-  const add = (rule: StableFieldEvolution, origin: string) => {
-    if (rule.from === rule.to) return;
-    const existing = bySource.get(rule.from);
-    if (existing !== undefined && canonicalJson(existing) !== canonicalJson(rule)) {
-      throw new Error(
-        `field evolution collision for source contract ${rule.from}: ${origin} disagrees with an existing route. ` +
-          `One source contract must have exactly one deterministic destination.`,
-      );
-    }
-    bySource.set(rule.from, rule);
-  };
-
-  for (const rule of prior?.evolutions ?? []) add(rule, "the prior release");
-
-  for (const declaration of field.evolutions ?? []) {
-    const source = fieldValueContractDetails(declaration.source);
-    const sourceSchema = fieldSchemaIdentity(
-      aggregateSid,
-      fieldSid,
-      declaration.source.kind,
-      source.contract,
-      driver,
-    );
-    if (declaration.mode === "identity" && !safeIdentityProjection(source.shape, target.shape)) {
-      throw new Error(
-        `.evolvesFrom(source) is not a safe identity widening: some source values are not valid ` +
-          `under the target field. Supply a finite business transform as the second argument.`,
-      );
-    }
-    add(
-      {
-        from: sourceSchema,
-        to: targetSchema,
-        source: {
-          kind: declaration.source.kind,
-          ...(declaration.source.mapValueKind !== undefined
-            ? { mapValueKind: declaration.source.mapValueKind }
-            : {}),
-        },
-        mode: declaration.mode,
-        ...(declaration.cases !== undefined ? { cases: declaration.cases } : {}),
-      },
-      ".evolvesFrom()",
-    );
-  }
-
-  // The compiler silently owns genuinely compatible widening between consecutive releases.
-  // The prior lock carries the full value descriptor, so this is a proof, not a cast.
-  if (
-    prior?.schema !== undefined &&
-    prior.schema !== targetSchema &&
-    prior.shape !== undefined &&
-    canonicalJson(prior.driver) === canonicalJson(driver) &&
-    safeAutomaticWidening(prior.shape, target.shape) &&
-    !bySource.has(prior.schema)
-  ) {
-    add(
-      {
-        from: prior.schema,
-        to: targetSchema,
-        source: {
-          kind: prior.kind ?? field.kind,
-          ...((prior.shape as { mapValueKind?: string } | undefined)?.mapValueKind !== undefined
-            ? { mapValueKind: (prior.shape as { mapValueKind: string }).mapValueKind }
-            : {}),
-        },
-        mode: "identity",
-      },
-      "the compiler's compatible-widening proof",
-    );
-  }
-
-  // Every retained source route must reach the one current target. This is the compile-time
-  // completeness gate for all still-supported eras, not merely the immediately prior law.
-  for (const source of bySource.keys()) {
-    const seen = new Set<string>();
-    let cursor = source;
-    while (cursor !== targetSchema) {
-      if (seen.has(cursor)) {
-        throw new Error(`field evolution graph cycles at ${cursor}; every source must terminate at ${targetSchema}`);
-      }
-      seen.add(cursor);
-      const next = bySource.get(cursor);
-      if (next === undefined) {
-        throw new Error(
-          `field evolution route from ${source} stops at ${cursor}, not the current contract ${targetSchema}. ` +
-            `Carry the intermediate source with .evolvesFrom(...) before this rollout.`,
-        );
-      }
-      cursor = next.to;
-    }
-  }
-
-  return [...bySource.values()].sort((a, b) => (a.from < b.from ? -1 : a.from > b.from ? 1 : 0));
-}
-
-/** Explicit identity projection: the tenant declares the business meaning is continuous;
- * the compiler still proves every old value is accepted and its physical decoding is unchanged. */
-function safeIdentityProjection(sourceShape: unknown, targetShape: unknown): boolean {
-  if (sourceShape === null || targetShape === null || typeof sourceShape !== "object" || typeof targetShape !== "object") {
-    return canonicalJson(sourceShape) === canonicalJson(targetShape);
-  }
-  const source = sourceShape as Record<string, unknown>;
-  const target = targetShape as Record<string, unknown>;
-  const physical = (shape: Record<string, unknown>) => {
-    const { kind, mapValueKind, jsonShape, encrypted } = shape;
-    return { kind, mapValueKind, jsonShape, encrypted };
-  };
-  return canonicalJson(physical(source)) === canonicalJson(physical(target))
-    && jsonSchemaSubset(source.jsonSchema, target.jsonSchema);
-}
-
-/** Automatic widening is stricter: every non-schema business descriptor must remain
- * identical. Brands, units, references and null meaning require an explicit declaration. */
-function safeAutomaticWidening(sourceShape: unknown, targetShape: unknown): boolean {
-  if (sourceShape === null || targetShape === null || typeof sourceShape !== "object" || typeof targetShape !== "object") {
-    return canonicalJson(sourceShape) === canonicalJson(targetShape);
-  }
-  const source = sourceShape as Record<string, unknown>;
-  const target = targetShape as Record<string, unknown>;
-  const metadata = (shape: Record<string, unknown>) => {
-    const { jsonSchema: _jsonSchema, ...rest } = shape;
-    return rest;
-  };
-  return canonicalJson(metadata(source)) === canonicalJson(metadata(target))
-    && jsonSchemaSubset(source.jsonSchema, target.jsonSchema);
-}
-
-function jsonSchemaSubset(source: unknown, target: unknown): boolean {
-  if (canonicalJson(source) === canonicalJson(target)) return true;
-  if (source === null || target === null || typeof source !== "object" || typeof target !== "object") return false;
-  const s = source as Record<string, unknown>;
-  const t = target as Record<string, unknown>;
-  if (Array.isArray(s.enum)) return s.enum.every((value) => jsonSchemaAcceptsLiteral(t, value));
-  if (Object.prototype.hasOwnProperty.call(s, "const")) return jsonSchemaAcceptsLiteral(t, s.const);
-  const sUnion = (Array.isArray(s.anyOf) ? s.anyOf : Array.isArray(s.oneOf) ? s.oneOf : undefined);
-  if (sUnion !== undefined) return sUnion.every((arm) => jsonSchemaSubset(arm, target));
-  const tUnion = (Array.isArray(t.anyOf) ? t.anyOf : Array.isArray(t.oneOf) ? t.oneOf : undefined);
-  if (tUnion !== undefined) return tUnion.some((arm) => jsonSchemaSubset(source, arm));
-  const sourceTypes = new Set(Array.isArray(s.type) ? s.type : s.type === undefined ? [] : [s.type]);
-  const targetTypes = new Set(Array.isArray(t.type) ? t.type : t.type === undefined ? [] : [t.type]);
-  if ([...sourceTypes].some((type) => !targetTypes.has(type))) return false;
-  if (sourceTypes.has("object")) {
-    const sp = (s.properties ?? {}) as Record<string, unknown>;
-    const tp = (t.properties ?? {}) as Record<string, unknown>;
-    const sr = new Set(Array.isArray(s.required) ? s.required as string[] : []);
-    const tr = new Set(Array.isArray(t.required) ? t.required as string[] : []);
-    if ([...tr].some((name) => !sr.has(name))) return false;
-    for (const [name, schema] of Object.entries(sp)) {
-      if (tp[name] === undefined) {
-        if (t.additionalProperties === false) return false;
-      } else if (!jsonSchemaSubset(schema, tp[name])) {
-        return false;
-      }
-    }
-    if (s.additionalProperties !== false && t.additionalProperties === false) return false;
-  }
-  if (sourceTypes.has("array") && s.items !== undefined && t.items !== undefined) {
-    if (!jsonSchemaSubset(s.items, t.items)) return false;
-  }
-  return sourceTypes.size > 0 && [...sourceTypes].every((type) => targetTypes.has(type));
-}
-
-function jsonSchemaAcceptsLiteral(schema: Record<string, unknown>, value: unknown): boolean {
-  if (Array.isArray(schema.enum)) return schema.enum.some((candidate) => canonicalJson(candidate) === canonicalJson(value));
-  if (Object.prototype.hasOwnProperty.call(schema, "const")) return canonicalJson(schema.const) === canonicalJson(value);
-  const union = Array.isArray(schema.anyOf) ? schema.anyOf : Array.isArray(schema.oneOf) ? schema.oneOf : undefined;
-  if (union !== undefined) return union.some((arm) => arm !== null && typeof arm === "object" && jsonSchemaAcceptsLiteral(arm as Record<string, unknown>, value));
-  const actual = value === null ? "null" : Array.isArray(value) ? "array" : typeof value === "number" ? "number" : typeof value;
-  const types = new Set(Array.isArray(schema.type) ? schema.type : schema.type === undefined ? [] : [schema.type]);
-  return types.has(actual) || (actual === "number" && types.has("integer") && Number.isInteger(value));
-}
-
-/** JSON Schema contains a handful of set-valued arrays whose authored order is not part
- * of the accepted value language. Normalize those (and VO enum `values`) so a cosmetic
- * enum/union reorder does not manufacture an N/N+1 incompatibility. */
-function normalizeFieldContract(value: unknown, parentKey = ""): unknown {
-  if (Array.isArray(value)) {
-    const items = value.map((item) => normalizeFieldContract(item));
-    if (["enum", "required", "type", "values", "oneOf", "anyOf", "allOf"].includes(parentKey)) {
-      return items.sort((a, b) => {
-        const left = canonicalJson(a);
-        const right = canonicalJson(b);
-        return left < right ? -1 : left > right ? 1 : 0;
-      });
-    }
-    return items;
-  }
-  if (value !== null && typeof value === "object") {
-    return Object.fromEntries(
-      Object.entries(value as Record<string, unknown>).map(([key, child]) => [
-        key,
-        normalizeFieldContract(child, key),
-      ]),
-    );
-  }
-  return value;
-}
-
-/**
- * Build the canonical semantic manifest for a domain module — purely from the
- * in-memory DSL objects. No file reads, no bundle, no esbuild: the manifest is a
- * function of the module alone, so it is bundler- AND location-independent.
- */
-export function domainManifest(mod: DomainModule): CanonicalManifest {
-  for (const agg of mod.aggregates) {
-    if (agg.audience === undefined) {
-      throw new Error(
-        `aggregate '${agg.id}' has no audience. Nomos will not guess who may read business state: ` +
-          `finish the declaration with .owned(), .readableBy("<business relation>"), or the deliberate ` +
-          `.public() exception.`,
-      );
-    }
-  }
-  for (const directive of mod.directives) {
-    const shape = zodObjectShape(directive.payloadSchema as ZodLike);
-    if (shape === undefined) continue;
-    for (const reserved of [
-      OWNED_KEY_PAYLOAD_FIELD,
-      OWNED_CUSTODY_PAYLOAD_FIELD,
-      OWNED_PREMINTED_RECORDS_PAYLOAD_FIELD,
-      BUSINESS_BIRTH_SEED_PAYLOAD_FIELD,
-    ]) {
-      if (!Object.prototype.hasOwnProperty.call(shape, reserved)) continue;
-      const frameworkBirthCarrier = reserved === BUSINESS_BIRTH_SEED_PAYLOAD_FIELD
-        && (directive as { businessBirth?: unknown }).businessBirth !== undefined;
-      if (frameworkBirthCarrier) continue;
-      throw new Error(
-        `directive '${directive.id}': payload field '${reserved}' is reserved by Nomos ownership. ` +
-          `Sorry mate, that concept is already taken by the framework; give the business payload field ` +
-          `a different name.`,
-      );
-    }
-  }
-  const aggregates: CanonicalAggregate[] = mod.aggregates
-    .map((agg) => {
-      return {
-      id: agg.id,
-      schema: sortedSchema(encodeKernelSchema(agg)),
-      // OMIT-WHEN-ABSENT: only emit `hasInvariant` when the aggregate declares one,
-      // so a predicate-free aggregate is byte-identical in the manifest to before this
-      // key existed (golden hashes UNCHANGED — mirrors directive `plan` omission).
-      ...(agg.hasInvariant === true ? { hasInvariant: true as const } : {}),
-      // The LAW-DECLARED instance cap — hash-bearing (it IS law), omit-when-absent.
-      ...(agg.cap !== undefined ? { cap: agg.cap } : {}),
-      // READ VISIBILITY (slice 5.1) — the capability a read of this type requires.
-      // Hash-bearing (it IS law); omit-when-public so all-public domains are byte-stable.
-      ...(agg.visibility !== undefined ? { requiresRead: agg.visibility.requires } : {}),
-      // E2E ENCRYPTION (slice 2) — the encrypted field names. Hash-bearing law;
-      // omit-when-none so plaintext aggregates are byte-stable.
-      ...(agg.encryptedFields !== undefined ? { encryptedFields: [...agg.encryptedFields] } : {}),
-      ...(agg.audience?.kind === "owned"
-        ? { owned: { ownerField: agg.audience.ownerField, relation: OWNED_READ_RELATION } }
-        : {}),
-      ...(agg.internalFields !== undefined ? { internalFields: [...agg.internalFields].sort() } : {}),
-      // ATTRIBUTED READS — the attributed field names (the driver wrap in `schema` is
-      // the hash-bearing law; this mirror is what codegen reads). Omit-when-none.
-      ...(agg.attributedFields !== undefined ? { attributedFields: [...agg.attributedFields] } : {}),
-      };
-    })
-    .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
-
-  const conflictResolutionByDirective = new Map(
-    (mod.surfacedResolvers ?? []).map((binding) => [binding.directiveId, binding] as const),
-  );
-  const directives: CanonicalDirective[] = mod.directives
-    .map((d) => ({
-      id: d.id,
-      target: d.aggregateId,
-      marker: encodeRefMode(d.marker),
-      ...canonicalSecondaryOutputs(d.secondaryOutputs),
-      payload: canonicalPayload(d.payloadSchema),
-      payloadJsonSchema: canonicalPayloadJsonSchema(d.payloadSchema),
-      // Omit-when-empty: a directive declaring NO boundary contributes neither key,
-      // so its canonical manifest is byte-identical to before the boundary existed.
-      ...canonicalReads(d.declaredReads),
-      ...canonicalCapturedReads(d.declaredQueryReads ?? []),
-      ...canonicalEmits(d.declaredEmits),
-      ...canonicalRelations(d.declaredRelations),
-      ...canonicalHostCapabilities(d.declaredHostCapabilities),
-      ...(conflictResolutionByDirective.has(d.id)
-        ? {
-            conflictResolution: {
-              aggregate: conflictResolutionByDirective.get(d.id)!.aggregateId,
-              field: conflictResolutionByDirective.get(d.id)!.field,
-            },
-          }
-        : {}),
-    }))
-    .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
-
-  // THE INFORMATION-FLOW GATE (architecture/security_model.md): rule 2 (no private
-  // captured read on the chain) + rule 1 (no encrypt-then-index) are enforced as ONE
-  // pass over the assembled canonical manifest, just before return (see assertFlowGate).
-  // E2E ENCRYPTION — critical #5 (e2e_encryption.md §5): the captured-read seal is rule 2.
-
-  // exists_ entries are COUNT declarations in the IR — merge them into `counts` so the
-  // Rust engine sees them as ordinary counts (the marker lives only in the DSL/codegen
-  // layer). Combine mod.counts + normalized exists_ before canonicalizing counts.
-  const existsAsCountDecls: AnyCount[] = (mod.exists_ ?? []).map(existsAsCount);
-  const allCounts: AnyCount[] = [...(mod.counts ?? []), ...existsAsCountDecls];
-
-  // Omit-when-empty: a domain declaring NO query / NO count / NO sum contributes neither
-  // key, so its canonical manifest is byte-identical to before the read-closure layer
-  // existed. `sums` follows the same omit-when-empty discipline as `counts`.
-  const manifest: CanonicalManifest = {
-    domain: mod.name,
-    aggregates,
-    directives,
-    // STABLE IDS (#58): always emitted by this compiler — the one deliberate
-    // hash-mover (enforcement-era identity hashes move; named + expected).
-    stableIds: stableIdsForModule(mod, aggregates),
-    ...canonicalWorkspaceInvariants(mod.workspaceInvariants),
-    ...canonicalQueries(mod.queries),
-    ...canonicalCounts(allCounts.length > 0 ? allCounts : undefined),
-    ...canonicalSpatials(mod.spatials),
-    ...canonicalSums(mod.sums),
-    ...canonicalDeriveds(mod.deriveds),
-    ...canonicalCombineds(mod.combineds),
-    ...(canonicalExtrema(mod.mins, "mins") as { mins?: CanonicalExtremum[] }),
-    ...(canonicalExtrema(mod.maxes, "maxes") as { maxes?: CanonicalExtremum[] }),
-    ...canonicalOrderedReads(mod.orderedReads),
-    // Omit-when-empty: a taxonomy-free domain contributes NO taxonomy key (hash-
-    // stable). When declared, this RUNS the fail-closed homing walk AND the slice-2
-    // route derivation — an unhomeable or unroutable taxonomy never produces an
-    // identity (workspace_type.ts + workspace_routing.ts).
-    ...canonicalTaxonomyFragment({
-      name: mod.name,
-      aggregates: mod.aggregates,
-      directives: mod.directives,
-      ...(mod.workspaceTypes !== undefined ? { workspaceTypes: mod.workspaceTypes } : {}),
-    }),
-  };
-  // THE STATIC INFORMATION-FLOW GATE — leaky law is unrepresentable (a typed compile
-  // error naming the field, the sink, and the rule). Rules 1/2/5 read the manifest IR;
-  // rule 4 also needs the raw module (the executable invariant reads + declassify waivers).
-  assertFlowGate(manifest, mod as never);
-  return manifest;
-}
-
-/** Recursively sort object keys; arrays are already in sorted/stable order. */
-function canonicalize(value: unknown): unknown {
-  if (Array.isArray(value)) return value.map(canonicalize);
-  if (value !== null && typeof value === "object") {
-    const obj = value as Record<string, unknown>;
-    const out: Record<string, unknown> = {};
-    for (const key of Object.keys(obj).sort()) out[key] = canonicalize(obj[key]);
-    return out;
-  }
-  return value;
-}
-
-/**
- * Serialize ANY value to JSON with recursively SORTED object keys (byte-stable).
- * Used for the domain manifest here AND reused by the composed-IR layer (#137) to
- * hash a flattened stage — the canonicalizer is value-generic, so the input type is
- * `unknown` rather than narrowed to `CanonicalManifest`.
- */
-export function canonicalJson(manifest: unknown): string {
-  return JSON.stringify(canonicalize(manifest));
-}
-
-/** The domain's content-hash identity: sha256 hex of its canonical manifest JSON. */
-export function domainHash(mod: DomainModule): string {
-  return createHash("sha256").update(canonicalJson(domainManifest(mod)), "utf8").digest("hex");
-}
-
-/**
- * The SHIPPED ARTIFACT bytes for a domain (#136) — the EXACT canonical-manifest JSON
- * bytes whose sha256 IS the domain's identity. This is the byte string an emit step
- * writes to `<domain>.manifest.json` and the gate's reproducibility check recomputes
- * `hash_code` over. The invariant the whole gate rests on:
- *
- *   sha256(emitManifestBytes(mod)) === domainHash(mod)
- *
- * i.e. the file bytes equal the bytes `domainHash` hashes (compact, recursively
- * sorted keys, UTF-8). "The bundle is not the law" — THIS is.
- */
-export function emitManifestBytes(mod: DomainModule): Buffer {
-  return Buffer.from(canonicalJson(domainManifest(mod)), "utf8");
-}