@githolon/dsl 0.102.4 → 0.103.0

package/src/usd.ts

@@ -1,1967 +0,0 @@
-// NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
-// remotes are replaceable custody/transport, not truth.  ⇒ ONE Nomos GitHolon
-// wasm32-wasip1 artifact {kernel · projection · embedded
-// QuickJS engine} on V8 + WASI-shim, byte-identical everywhere.  V8 = portability; the one
-// wasm = determinism.  No native, no wasmtime, no 2nd artifact, no domain-JS on bare V8.
-// If a file isn't this / hosting this / authoring for this / proving this — it's gone.
-
-/**
- * TS → USD — the UNIFIED composed-IR document (stage 1, increment 1).
- *
- * Two proven-but-isolated pieces become ONE here:
- *  - `manifest.ts` (#136): encodes a `DomainModule` to a canonical flat manifest —
- *    aggregates with field→Driver schemas + directive contracts (target / marker /
- *    requiresCapability / payload-shape), hashed via `canonicalJson` / `domainHash`.
- *  - `compose.ts` (#137): the typed, MONOTONIC layer composition — `requires`/`scope`
- *    rules, `covers()`, fail-closed `CompositionViolation`, composed hash.
- *
- * The bridge is an OpenUSD-shaped IR document: a real (synthetic) `DomainModule`
- * encodes into composable typed prims arranged under a layer PATH; multiple layers
- * COMPOSE via the very same typed rules (`compose.ts`'s `mergeRequiresScope`, reused
- * — never re-implemented); the composed stage FLATTENS and HASHES. This is the
- * foundation of the certified-IR document the gate will later seal.
- *
- * SYNTHETIC framework units only — paths like `/Nomos/Prelude` and `/Sample/...`;
- * no tenant/business domain is named or imported. Build-time only (imports
- * `node:crypto` transitively via `manifest.js`); reachable via the `@githolon/dsl/usd`
- * subpath, NOT the runtime `index.ts` barrel.
- */
-import { createHash } from "node:crypto";
-import {
-  canonicalJson,
-  domainManifest,
-  type CanonicalManifest,
-  type CanonicalProjectionReturn,
-} from "./manifest.js";
-import {
-  OWNED_KEY_RELATION,
-  OWNED_READ_RELATION,
-  type AggregateHandle,
-} from "./aggregate.js";
-import {
-  mergeRequiresScope,
-  CompositionViolation,
-  type ComposeOptions,
-} from "./compose.js";
-import type { WireSchema, WireRefMode } from "./wire.js";
-import type { DomainModule } from "./codegen_dart.js";
-import { domainInterface } from "./shape_compat.js";
-import { relationType, user, key, anyUser, qualifiedTypeId, qualifyRelationType } from "./relation_schema.js";
-import { harvestPrincipalFlows } from "./wire_encode.js";
-import { zodKind, zodObjectShape } from "./codegen_ts.js";
-import { composeSharedRelationTypes } from "./relation_composition.js";
-import { collectValueObjectUsages } from "./value_object.js";
-import {
-  namespacedAggregateIds,
-  qualifyReadProjectionType,
-  READ_PROJECTION_DELIMITER,
-} from "./read_projection_namespace.js";
-import { qualifyManifestAggregateLabels } from "./read_projection_manifest.js";
-import { guardSharedReadProjectionKeys } from "./read_projection_composition.js";
-import { OWNED_RECOVERY_RELATION } from "./framework/owned_custody.js";
-
-/** The referential marker of a directive prim (kernel `RefMode` wire string). */
-export type RefMode = WireRefMode;
-
-/**
- * One prim in the USD IR — a discriminated union UNIFYING #136's manifest content
- * with #137's composable typed-rule fields.
- *
- *  - `aggregate`: an encoded aggregate, carrying its field→`WireDriver` schema (the
- *    EXACT `manifest.ts` `encodeKernelSchema` output). Aggregates do not compose-merge
- *    (an aggregate is a single-source schema); they pass through by path.
- *  - `directive`: a composable law unit. `requires` is the capability set (#137:
- *    add/narrow, never silently remove); `scope` is the optional composable scope
- *    path (#137: narrow-not-widen). `artifactRef` is the certified-artifact handle
- *    — left `undefined` here (stage 2).
- */
-export type UsdPrim =
-  | {
-      readonly kind: "aggregate";
-      /** e.g. `/Sample/SampleThingAggregate`. */
-      readonly path: string;
-      /** The aggregate type id, e.g. `SampleThingAggregate`. */
-      readonly type: string;
-      /** The encoded field→Driver schema (reused from `manifest.ts`). */
-      readonly schema: WireSchema;
-    }
-  | {
-      readonly kind: "directive";
-      /** e.g. `/Sample/createThing`. */
-      readonly path: string;
-      /** The target aggregate type id. */
-      readonly target: string;
-      readonly marker: RefMode;
-      /** Capability ids that MUST hold (a stronger layer may only ADD). */
-      readonly requires: string[];
-      /**
-       * The composable scope path (#137 narrow-not-widen). `undefined` when the DSL
-       * declares NO static scope today — we do NOT fabricate one.
-       */
-      readonly scope?: string;
-      /**
-       * The directive's DECLARED read boundary (sorted ref types) — the "IR for law
-       * boundaries" carried into the USD IR so `usdHash` reflects it. OMITTED
-       * (`undefined`) when the directive declares no reads, so boundary-free prims are
-       * byte-identical to before this field existed.
-       */
-      readonly reads?: string[];
-      /**
-       * The directive's DECLARED emit boundary: event type → `{ max? }`. OMITTED
-       * (`undefined`) when no emits are declared (omit-when-empty hash invariance).
-       */
-      readonly emits?: Record<string, { max?: number }>;
-      /**
-       * MULTI-OUTPUT: the ADDITIONAL aggregates this directive declares it writes (beyond `target`/`marker`),
-       * `{ target, marker }` sorted. OMITTED (`undefined`) for a single-output directive (omit-when-empty
-       * hash invariance). Descriptive law metadata — docs/proof/client name every output.
-       */
-      readonly secondaryOutputs?: readonly { target: string; marker: WireRefMode }[];
-      /**
-       * Standard JSON Schema for the directive payload, emitted from TS/Zod into the
-       * IR so cross-language tooling validates against the same schema source.
-       */
-      readonly payloadJsonSchema?: unknown;
-      /** Certified-artifact payload reference — `undefined` for now (stage 2). */
-      readonly artifactRef?: string;
-    };
-
-/** One captured query declaration on a USD layer (read-side closure). `key` is the
- * index column order, PRESERVED (not sorted). Mirrors `manifest.ts`'s `CanonicalQuery`. */
-export interface UsdQuery {
-  readonly id: string;
-  readonly key: string[];
-  readonly returns: string;
-}
-
-/** One captured derived read projection on a USD layer. */
-export interface UsdDerived {
-  readonly id: string;
-  readonly of: string;
-  readonly returns: CanonicalProjectionReturn;
-}
-
-/** One captured combined read projection on a USD layer. */
-export interface UsdCombined {
-  readonly id: string;
-  readonly of: string;
-  readonly refField: string;
-  readonly reads: string;
-  readonly returns: CanonicalProjectionReturn;
-}
-
-/** One field's read-projection descriptor: the field kind plus a map's value kind. */
-export interface UsdFieldKindDescriptor {
-  readonly kind: string;
-  readonly mapValueKind?: string;
-}
-
-export interface UsdReadProjection {
-  readonly aggregateFieldKinds: Record<string, Record<string, UsdFieldKindDescriptor>>;
-  readonly queries: { id: string; key: { field: string; kind: string }[]; returns: string }[];
-  readonly counts: { id: string; of: string; by: string | null; where?: unknown }[];
-  readonly spatials: { id: string; of: string; on: string }[];
-  readonly deriveds: { id: string; of: string; returns: CanonicalProjectionReturn }[];
-  readonly combineds: { id: string; of: string; refField: string; reads: string; returns: CanonicalProjectionReturn }[];
-  readonly sums?: { id: string; of: string; field: string; by: string | null; where?: unknown }[];
-  readonly mins?: { id: string; of: string; field: string; by: string | null; where?: unknown }[];
-  readonly maxes?: { id: string; of: string; field: string; by: string | null; where?: unknown }[];
-  readonly orderedReads?: {
-    id: string;
-    of: string;
-    orderKey: string;
-    orderDesc?: true;
-    where?: unknown;
-    limit: number;
-  }[];
-}
-
-/** One USD layer: a stage path + its prims (canonically sorted by prim path). */
-export interface UsdLayer {
-  readonly path: string;
-  readonly prims: UsdPrim[];
-  /**
-   * The canonical admission/merge manifest for this layer, committed inside the package.
-   * Hosts must not stage or mutate this view; holons derive it from active installed law.
-   */
-  readonly nomosIdentityManifest?: CanonicalManifest;
-  /**
-   * The projection schema/read-routing fragment for this layer, committed inside the package.
-   * It carries the projection-only field-kind data that cannot be recovered from merge drivers.
-   */
-  readonly nomosReadProjection?: UsdReadProjection;
-  /**
-   * The layer's NAMED, INDEXED read declarations (read-side closure step 1), SORTED
-   * by id. OMITTED (`undefined`) when the module declares no query, so a query-free
-   * layer is byte-identical to before this field existed (omit-when-empty hash
-   * invariance). Carried straight from the module's canonical manifest.
-   */
-  readonly queries?: UsdQuery[];
-  /** The layer's engine-projected derived read fields, sorted by id. */
-  readonly deriveds?: UsdDerived[];
-  /** The layer's engine-projected combined read fields, sorted by id. */
-  readonly combineds?: UsdCombined[];
-  /**
-   * The REFERENCE composition arc (LIVRPS: References sit just below Local). Paths of
-   * OTHER layers in the SAME document whose effective prims compose into THIS layer
-   * UNDER (weaker than) its own local prims — local is the stronger opinion. A
-   * first-class declared arc recorded in the IR so the composed identity (`usdHash`)
-   * reflects WHY a prim is present. OMITTED (`undefined`) when a layer references
-   * nothing, so a reference-free layer is byte-identical to before this field existed
-   * (omit-when-empty hash invariance — same discipline as `queries`/`reads`/`emits`).
-   */
-  readonly references?: string[];
-  /**
-   * The VARIANT composition arc (LIVRPS: Variants sit ABOVE References, BELOW Local —
-   * stronger than referenced prims, weaker than this layer's own local prims). A layer
-   * may declare named variant SETS; each set is a family of named ALTERNATIVES, each
-   * alternative ("variant") holding its OWN prims. WHICH variant of each set composes is
-   * NOT baked into the document — it is supplied as `ComposeOptions.variantSelection`
-   * (setName → chosen variantName) at flatten time, so the composed identity is a
-   * function of `(doc, selection)`.
-   *
-   * Shape: setName → variantName → that variant's prims. A reserved variant name `"*"`
-   * within a set declares that set's DEFAULT variant: when the selection names no choice
-   * for the set, the `"*"` variant's prims compose; with neither a selection nor a `"*"`
-   * default, the set contributes NOTHING. A selection naming an unknown set or an unknown
-   * variant fails closed (`variant-unresolved`) — an explicit selection that cannot be
-   * resolved is never silently a no-op.
-   *
-   * OMITTED (`undefined`) when a layer declares no variant set, so a variant-free layer
-   * is byte-identical to before this field existed (omit-when-empty hash invariance —
-   * same discipline as `queries`/`references`/`reads`/`emits`).
-   */
-  readonly variantSets?: Record<string, Record<string, UsdPrim[]>>;
-  /**
-   * THE INVARIANT-GATE DECLARATION (#41 — "the law is the era"). Present IFF the layer's
-   * module declares ≥1 invariant (aggregate or workspace): the law's EXPLICIT opt-in to
-   * invariant EXECUTION at the one gate. The wasm gate runs the engine-backed invariant
-   * oracles for an intent only when the law resolved for that intent carries this key —
-   * every bundle compiled before #41 (whose declared invariants the gate held as hashed-
-   * but-inert law) lacks it, so chains sealed under the inert gate replay green forever.
-   * OMITTED (`undefined`) for invariant-free law — byte-identical hash, same discipline
-   * as `queries`/`references`. Hand-adding it to a foreign bundle only opts IN to
-   * stricter checking; removing it makes new law, for that law's own chains (status quo).
-   */
-  /**
-   * THE ATTRIBUTED-READS DECLARATION (architecture/field_provenance.md — "the law is the
-   * era"). Present IFF the layer declares ≥1 `.attributed()` field: the law's EXPLICIT
-   * opt-in to per-field author-provenance capture at the one gate/fold. The hash-bearing
-   * enforcement rides the aggregate schema's `{"Attributed": <inner>}` wire driver (a
-   * pre-provenance kernel's strict manifest serde REFUSES it — the clean era refusal);
-   * this key is the SELF-DESCRIBING surface (which aggregates/fields are attributed)
-   * hosts and tooling read without re-deriving it from drivers. OMITTED for
-   * unattributed law — byte-identical hash, the `nomosInvariantGate` discipline.
-   */
-  readonly nomosAttributedGate?: {
-    readonly v: 1;
-    /** aggregate TYPE → its attributed STORED field names, keys + fields sorted. */
-    readonly aggregates: Record<string, string[]>;
-  };
-  readonly nomosInvariantGate?: {
-    readonly v: 1;
-    /** Aggregate types whose declared `invariant` bodies the gate executes, sorted. */
-    readonly aggregates?: string[];
-    /** Declared workspace invariants `{id, on}` the gate executes, sorted by id. */
-    readonly workspaceInvariants?: { id: string; on: string }[];
-  };
-  /**
-   * THE NATIVE ZANZIBAR RELATION SCHEMA (P1 — the userset-rewrite law as PURE DATA). Present IFF the
-   * layer declares ≥1 `relationType`: the law's EXPLICIT opt-in to the recursive Check/Expand gate.
-   * The Rust `RewriteEngine` READS this AST (per-type relation rewrites + fail-closed type restrictions
-   * + the schema-declared depth/fanout caps); the JS lump never runs it. OMITTED for relation-free law
-   * (byte-identical hash — the exact `nomosInvariantGate` era discipline; pre-feature chains replay
-   * green, the relation gate inert). Keys SORTED for byte-determinism (the layered flatten reproduces
-   * these bytes; see usd_layers.ts). Relation refs are NAMES in P1; the #58 stable-id swap is the
-   * localized follow-up.
-   */
-  readonly nomosRelations?: {
-    readonly v: 1;
-    /** typeName → { relations: {relName → {rewrite, allowed}}, caps? } — keys sorted. */
-    readonly types: Record<
-      string,
-      {
-        readonly relations: Record<string, { readonly rewrite: unknown; readonly allowed: unknown[] }>;
-        readonly caps?: { readonly maxDepth: number; readonly maxFanout: number };
-      }
-    >;
-  };
-  /**
-   * THE NATIVE ZANZIBAR WRITE-AUTHZ GATE (P4). Present IFF ≥1 directive declares `.requiresRelation`:
-   * the one gate (`executor::admit`) refuses an author who does not HOLD the relation the directive
-   * requires (`engine.check` over the folded tuple store). `requires` maps directiveId → {relation,
-   * object}. OMITTED for relation-gate-free law (the era rule — byte-identical hash). Keys sorted.
-   */
-  readonly nomosRelationGate?: {
-    readonly v: 1;
-    readonly requires: Record<string, { readonly relation: string; readonly object: string }>;
-  };
-  /**
-   * THE RELATION-TYPE NAMESPACE ERA KEY (relation-namespacing). Present IFF a layer qualified ≥1
-   * (non-global) `relationType` by its owning domain key (`estate` → `estate__workspace`), so two
-   * domains in one package that each declare the same bare type no longer collide at the kernel's
-   * last-wins schema merge. `types` is the SORTED set of qualified ids this layer produced; `delimiter`
-   * is the ratified colon-free `"__"` (the kernel splits object addresses on the first colon). OMITTED
-   * for a layer that declares no relation type OR only GLOBAL (kernel-coupled framework) types — those
-   * emit BYTE-IDENTICALLY to the pre-namespacing compiler (the era rule; the marker is a witness, the
-   * kernel needs no new arm because the qualification is already baked into the `nomosRelations` ids).
-   */
-  readonly nomosRelationNamespace?: {
-    readonly v: 1;
-    readonly delimiter: string;
-    readonly types: readonly string[];
-  };
-  /**
-   * THE READ-PROJECTION NAMESPACE ERA KEY (read-projection namespacing — the read-layer mirror of
-   * `nomosRelationNamespace`). Present IFF this layer qualified ≥1 (non-global) AGGREGATE TYPE by its
-   * owning domain key (`Entry` → `guestbook__Entry`), so two domains / two installs that each declare
-   * the same bare aggregate name no longer collide at the kernel's installed-read-manifest accumulator.
-   * Runtime evolution ignores superseded eras; qualification keeps independent domains distinct.
-   * `types` is the SORTED set of qualified type
-   * names this layer produced; `delimiter` is the same ratified colon-free `"__"`. OMITTED for a layer
-   * whose aggregates are all GLOBAL (the explicit framework allowlist / `{global:true}`) — the marker
-   * is a witness; the qualification itself is baked into the layer's keys.
-   */
-  readonly nomosReadProjectionNamespace?: {
-    readonly v: 1;
-    readonly delimiter: string;
-    readonly types: readonly string[];
-  };
-  /**
-   * THE CROSS-CUSTODY ATTESTATION GATE (home_holons §3/§5). Present IFF ≥1 directive declares
-   * `.attestationAuthorized()`: the SORTED set of their ids. A directive named here is authorized by a
-   * carried §3 signed quote rather than an author block — the one gate verifies the quote (bound to the
-   * home's warrant owner) + pins the captured principal to the proven attestation key, and the signed-author
-   * doors exempt it. OMITTED for law with no such directive (the era rule — byte-identical hash).
-   */
-  readonly nomosAttestationGate?: {
-    readonly v: 1;
-    readonly directives: Record<
-      string,
-      {
-        readonly ownerObject: string;
-        readonly ownerField: string;
-        readonly fields: {
-          readonly asserterWorkspace: string;
-          readonly object: string;
-          readonly relation: string;
-          readonly attestedAt: string;
-          readonly publicKey: string;
-          readonly signature: string;
-        };
-      }
-    >;
-  };
-  /**
-   * THE DELEGATED-AUTHORITY GATE (delegated_authority_births.md). Present IFF ≥1 directive declares
-   * `.delegatedRole()`: directiveId → {relation, subjectField, certField, parentKeyObject, parentKeyField}.
-   * The one gate folds the delegated tuple ONLY behind a DelegationCert P signed (rooting at K_root, binding
-   * the same relation+subject, `.delegatedFrom(parent)`). OMITTED for law with no such directive (era rule).
-   */
-  readonly nomosDelegationGate?: {
-    readonly v: 1;
-    readonly directives: Record<
-      string,
-      {
-        readonly relation: string;
-        readonly subjectField: string;
-        readonly certField: string;
-        readonly parentKeyObject: string;
-        readonly parentKeyField: string;
-      }
-    >;
-  };
-  /**
-   * THE KEYLESS VERIFIED-FIRST-DEVICE GATE (architecture/keyless_verified_onboard.md). Present IFF ≥1
-   * directive declares `.verifiedFirstDevice()`: a per-directive payload FIELD MAPPING. A principal's FIRST
-   * device-signer may then bootstrap on a WARRANTED parent from an ON-CHAIN, device-bound IdP attestation:
-   * the kernel's `nomosVerifiedFirstEnroll` arm reads THIS declaration — the directive id + the payload
-   * fields the token / seated keyHash / claimed issuer ride in — and re-verifies the carried `idpToken`
-   * against the workspace's AuthProvider IDENTICALLY on author/receive/verify_chain (self-serve +
-   * peer-to-peer, no admin/server). The KERNEL hardcodes NEITHER the directive id NOR the field names — it
-   * reads both here (the same way it reads `nomosAttestationGate`). OMITTED for law with no such directive
-   * (the era rule — byte-identical hash; the arm inert).
-   */
-  readonly nomosVerifiedFirstEnroll?: {
-    readonly v: 1;
-    readonly directives: Record<
-      string,
-      {
-        readonly tokenField: string;
-        readonly keyHashField: string;
-        readonly verifiedViaField: string;
-      }
-    >;
-  };
-  /**
-   * THE LAWFUL-RECOVERY GATE (architecture/lawful_recovery.md). Present IFF a directive declares
-   * `.certifiesEra()`: names that directive id + the payload field carrying the signed `EraCertification`.
-   * The kernel's `nomosEraCertGate` arm admits the custodian-authored intent (verified to `K_root` via the
-   * certification, not the signer roster) + the walk waives the identity attestation for the certified oids.
-   * OMITTED for law with no certifyEra directive (the era rule — byte-identical hash; the arm inert).
-   */
-  readonly nomosEraCertGate?: {
-    readonly v: 1;
-    readonly directiveId: string;
-    readonly certField: string;
-  };
-  /**
-   * THE BIRTH GATE DECLARATION (G3 — birth is a declared kernel primitive, the unix model). Present IFF ≥1
-   * directive declares `.births()`: the SORTED set of their ids. A directive named here BIRTHS a child
-   * workspace as the defined CONSEQUENCE of its offer — after the offer admits, the kernel reads THIS
-   * declaration (the SAME way it reads `nomosReadGate`/`nomosInvariantGate` — never a domain aggregate),
-   * takes the genesis recipe the intent carried (its `captured_ports.births`), spawns the child's custody,
-   * and self-validates the child's whole genesis through the child's OWN gate (the `materialize_genesis`
-   * keystone). The kernel reads NO domain schema; it reads its own manifest declaration + the carried
-   * recipe. OMITTED for law with no birth directive (the era rule — byte-identical hash; every pre-feature
-   * chain replays green, the birth effect inert). SORTED keys for byte-determinism.
-   */
-  readonly nomosBirthGate?: {
-    readonly v: 1;
-    /** The directive ids declared `.births()` — SORTED. */
-    readonly directives: string[];
-  };
-  /**
-   * THE BIRTH-RECORD GATE (metered birth, slice A1 — `architecture/metered_birth_and_attested_reads.md`).
-   * Present IFF the layer declares ≥1 `.births()` directive AND was compiled under the metered-birth
-   * compiler: the law's EXPLICIT declaration that every birth it performs ALSO writes a structural
-   * `NomosBirthRecord` event (deterministic id `<prefix><child>`) in the SAME intent as the birth
-   * effect — the `.births()` lane appends it automatically, so the declaration is self-fulfilling for
-   * honestly-compiled law and the kernel arm only ever bites a forged/hand-built lump. The kernel's
-   * `verify_births_witness` reads THIS declaration (the SAME way it reads `nomosBirthGate` — the
-   * bundle declares, the kernel honors; NO kernel version-if) and refuses a new-era birth whose
-   * re-derived events carry no record (`birth-record-missing`). OMITTED for pre-feature law — the
-   * era rule: every chain sealed before this key replays byte-identical, births exactly as today.
-   */
-  readonly nomosBirthRecordGate?: {
-    readonly v: 1;
-    /** The record aggregate TYPE name (the framework's `NomosBirthRecord`). */
-    readonly aggregate: string;
-    /** The deterministic instance-id prefix — the record for child `w` lives at `<prefix><w>`. */
-    readonly prefix: string;
-  };
-  /**
-   * THE PEER-SOVEREIGN ROOT-OF-TRUST (the BirthAttestation cert chain). Present IFF the law declares
-   * `requireParentAttestedBirth`: a warranted workspace running this law MUST travel with a SIGNED cert
-   * chain proving its founder was VERIFIED by its parent at birth, rooting at the pinned `K_root`. The
-   * kernel's verify doors (author / receive / verify_chain) verify the travelling chain OFFLINE — no
-   * cross-ws read. OMITTED for law that doesn't declare it (the era rule — byte-identical hash; every
-   * pre-feature + legacy/non-warranted chain replays green, the check inert).
-   */
-  readonly nomosParentAttestedBirth?: {
-    readonly v: 1;
-    /** The LAW-DECLARED owner + cert locators (the kernel reads them; names neither). The framework `home`
-     *  convention; a pre-declaration `{v:1}` key falls back to the kernel default (the era rule). */
-    readonly ownerObject: string;
-    readonly ownerField: string;
-    readonly certObject: string;
-    readonly certField: string;
-  };
-  /**
-   * STABLE IDENTIFIERS (#58 — names are labels, identity is minted). The layer's
-   * domain/aggregate/field sids + label lineages, carried verbatim from the canonical
-   * manifest's `stableIds`. ALWAYS present on post-#58-compiled law (the one
-   * deliberate hash-mover); ABSENT on every bundle compiled before — the era key the
-   * EVOLVE GATE and the projection's sid-lineage fold switch on. A law-upgrade deploy
-   * whose old AND new packages both carry this key is DIFFED BY SID at the one gate.
-   */
-  readonly nomosStableIds?: import("./stable_ids_types.js").StableIds;
-  /**
-   * THE STRUCTURAL INTERFACE (#72) — this domain's directives (payload shapes) + aggregates
-   * (read shapes, sid-keyed). ON-LEDGER (it rides the package, which installs as the
-   * `policy:{hash}.bundle`), so a client reads the workspace's OFFER straight from the folded
-   * law — reactively, host-blind (architecture/shape_compatibility.md). A client negotiates
-   * shape-compatibility against THIS, not the package hash. Pre-#72 bundles omit it; a client
-   * then reports `offerKnown:false` and never refuses on its absence (era-safe, graceful).
-   */
-  readonly nomosInterface?: import("./shape_compat.js").DomainInterface;
-  /**
-   * THE CAPTURED-READ GATE DECLARATION (#58). Present IFF ≥1 directive of this layer
-   * declares a captured-read query (`.reads(someQuery)`): the law's EXPLICIT opt-in
-   * to `nomos.read` at the one gate — the engine serves declared reads LIVE from the
-   * pre-apply state at author, replays the captured footprint at verify, and the gate
-   * RE-DERIVES each captured read at the pre-apply position (typed read-conflict on
-   * drift — CAS as law). OMITTED for read-free law (byte-identical hash — the exact
-   * `nomosInvariantGate` era discipline; bundles without the key behave as before).
-   */
-  readonly nomosReadGate?: {
-    readonly v: 1;
-    /** Every declared read query's recipe, keyed by query id. */
-    readonly queries: Record<string, { key: string[]; returns: string }>;
-    /** directive id → the SORTED query ids its plan may read. */
-    readonly directives: Record<string, string[]>;
-  };
-  /**
-   * THE ATTESTED-READ GATE DECLARATION (slice B — attested cross-workspace reads,
-   * `architecture/attested_reads_design.md` §3.2). Present IFF ≥1 directive declares a
-   * foreign read (`.readsFrom(ws, query)` + a module-level `trustSource(ws, …)`): the
-   * reader's law names, per trusted source, the source's IDENTITY (genesis), the accepted
-   * attestor keyHashes (K1 pins), and its freshness/dishonor vocabulary; and per directive,
-   * the `(queryId, from)` edges its plan may consume. The QUERY SPEC is NOT emitted here —
-   * the query is the SOURCE's law; the reader declares only the trust edge + the id.
-   * OMITTED for foreign-read-free law (byte-identical hash — the exact `nomosReadGate` era
-   * discipline). The `roster` mode names the §1.3 layer (`pinned`=K1, `derived`=K2,
-   * `tracked`=K3) — one era key from stage 1; later stages ADD modes, never re-shape.
-   */
-  readonly nomosAttestedReadGate?: {
-    readonly v: 1;
-    readonly sources: Record<
-      string,
-      {
-        genesis: string;
-        keyHashes?: string[];
-        maxAgeMs?: number;
-        minSourceEpoch?: "birth" | number;
-        monotone?: boolean;
-        roster: "pinned" | "derived" | "tracked";
-        onDishonor: "refuse" | "record";
-      }
-    >;
-    /**
-     * DYNAMIC-SOURCE trust POLICIES (dynamic_source_attested_reads.md): the acceptable-source SET is
-     * law-state — a reader-side allow-list aggregate. A directive edge may route through a policy
-     * (`{queryId, policy}`) instead of a fixed workspace; the gate resolves the envelope's genesis
-     * against the folded `allowList` rows (genesis field) → the row's `keysField` accepted keys.
-     * OMITTED when no policy is declared (byte-identical to a policy-free bundle — the era rule).
-     */
-    readonly policies?: Record<
-      string,
-      {
-        allowList: string;
-        genesisField: string;
-        keysField: string;
-        maxAgeMs?: number;
-        minSourceEpoch?: "birth" | number;
-        monotone?: boolean;
-        onDishonor?: "refuse" | "record";
-      }
-    >;
-    readonly directives: Record<
-      string,
-      ({ queryId: string; from: string } | { queryId: string; policy: string })[]
-    >;
-  };
-  /**
-   * THE READ-VISIBILITY GATE DECLARATION (the native-relations read gate).
-   * Present IFF ≥1 aggregate of this layer is declared PRIVATE (`visibility:
-   * requires(cap)`): the law's EXPLICIT opt-in to the githolon gating its own
-   * reads. The one wasm read boundary serves a read touching a private type ONLY to
-   * a principal that holds the read RELATION `cap` on the workspace-scope object —
-   * decided by the native `RewriteEngine.check` over this workspace's own folded
-   * relation tuples (the compiler ALSO synthesizes a `workspace#<cap>` relation into
-   * `nomosRelations`). OMITTED for all-public law (byte-identical hash — the EXACT
-   * `nomosReadGate`/`nomosInvariantGate` era discipline; every pre-feature chain
-   * serves reads exactly as before, and a public type is never gated). Keyed by
-   * aggregate TYPE name → required capability (= read relation).
-   */
-  readonly nomosReadVisibility?: {
-    readonly v: 1;
-    /** Aggregate TYPE name → the capability a read touching it requires. SORTED by type name. */
-    readonly aggregates: Record<string, { requires: string; ownerField?: string }>;
-  };
-  /**
-   * THE ENCRYPTION GATE DECLARATION (e2e_encryption.md slice 2). Present IFF ≥1 field of
-   * this layer is `.encrypted()`: the law's EXPLICIT opt-in to at-rest field ciphertext.
-   * The gate enforces the envelope structure + `scope == the aggregate's read cap` +
-   * `epoch ≤ active` on every encrypted-field write (key-free, every peer); a key-holder
-   * decrypts at read time. OMITTED for plaintext law (byte-identical hash — the EXACT
-   * `nomosReadVisibility` era discipline; every pre-encryption chain replays as before).
-   * `scope` is the aggregate's `requires(cap)`; `delegatable:false` — an encrypted scope
-   * is NON-DELEGATABLE (the adversarial-review fix: a delegated read cap must NOT mint a
-   * key), so the key roster is direct grants only. Keyed by aggregate TYPE, SORTED.
-   */
-  readonly nomosEncryption?: {
-    readonly v: 1;
-    readonly aggregates: Record<string, { scope: string; fields: string[]; delegatable: false; owned?: true; ownerField?: string }>;
-  };
-  /**
-   * THE CAPABILITY DECLARATION IN LAW (Full-A — capability_marketplace.md §4): the impure-
-   * capability quartets (obligation/complete/fail/block/deadLetter) lowered into the SEALED
-   * law, so the holon SURFACES them on the `declared_capabilities` read and the host relays a
-   * deploy-time "declared — bind it or obligations wait" notice without reaching into root
-   * law-state (boundness stays P6 — it is cross-holon root state). OMITTED for capability-free
-   * law (byte-identical hash — the era rule); declaring a capability MOVES the domainHash
-   * (named, expected). SORTED by aggregateId.
-   */
-  readonly nomosCapabilities?: {
-    readonly v: 1;
-    readonly capabilities: readonly {
-      readonly capability: string;
-      readonly aggregateId: string;
-      readonly obligation: string;
-      readonly complete: string;
-      readonly fail: string;
-      readonly block: string;
-      readonly deadLetter: string;
-      readonly tasksQueryId: string | null;
-      /** The HTTPS endpoint the obligation is offered to (outbox); absent ⇒ no destination. */
-      readonly endpoint?: string;
-    }[];
-  };
-  /**
-   * THE FLOW GATE WAIVERS (architecture/security_model.md) — both halves of the audit surface,
-   * hashed into the law + replay-verified. `declassify` (confidentiality, rule 4): every acknowledged
-   * secret-correlated refusal. `endorse` (the integrity dual): every harvested PrincipalEvidence flow
-   * into an authority/standing/attribution sink — discovery IS law, witnessed fail-closed at runtime.
-   * Each half is OMITTED when empty (the era rule — a flow-free domain is byte-identical).
-   */
-  readonly nomosFlowGate?: {
-    readonly v: 1;
-    readonly declassify?: readonly { readonly site: string; readonly reason: string }[];
-    readonly endorse?: readonly {
-      readonly directiveId: string;
-      readonly sink: string;
-      readonly facet: string;
-      readonly reason: string | null;
-    }[];
-  };
-  /**
-   * FIRST-CLASS VALUE OBJECTS (`value_object.ts`) — the canonical descriptors of every
-   * named value object this layer's aggregates carry (deduped, SORTED by name, nested
-   * VOs included), so tooling/visualizers SEE the structure a VO field stores. PURELY
-   * DESCRIPTIVE: the kernel reads no gate off it (a VO field folds exactly like a
-   * `t.jsonObject()` leaf — one wholesale-replace json value). OMITTED for VO-free law
-   * (byte-identical hash — the era rule); declaring a VO moves the PACKAGE hash only
-   * (the canonical manifest/domainHash is untouched — the VO is not wire law).
-   */
-  /**
-   * MULTI-WORKSPACE LOCATORS (`t.foreignRef`) — the self-describing cross-workspace edges this domain
-   * declares: `{aggregate, field, workspaceField, target, targetDomain?}` sorted by (aggregate, field).
-   * Descriptive law metadata (codegen emits a typed `ForeignRef` locator + resolve/watch; proof knows the
-   * edge shape without proving the concrete foreign workspace). A LOCATOR, not an atomic FK — law that
-   * depends on the foreign fact opts into attested evidence separately (`nomosAttestedReadGate`). OMITTED
-   * when the domain declares no foreignRef (era-safe — hash-identical to before this key existed).
-   */
-  readonly nomosForeignRefs?: {
-    readonly v: 1;
-    readonly refs: readonly {
-      readonly aggregate: string;
-      readonly field: string;
-      readonly workspaceField: string;
-      readonly target: string;
-      readonly targetDomain?: string;
-    }[];
-  };
-  readonly nomosValueObjects?: {
-    readonly v: 1;
-    readonly valueObjects: readonly import("./fields.js").ValueObjectDescriptor[];
-    /**
-     * THE VO↔FIELD ATTACHMENT (additive, hash-inert): which aggregate FIELD carries
-     * which VO — `{aggregate, field, vo}` sorted by aggregate then field. Rides THIS
-     * key (never the aggregate prim's wire schema) so the canonical manifest/domainHash
-     * of a VO field stays byte-equal to a plain `t.jsonObject()` field. Optional for
-     * era tolerance: a 0.33.0-compiled package's key parses unchanged without it.
-     */
-    readonly usages?: readonly import("./value_object.js").ValueObjectUsage[];
-  };
-  /**
-   * DOMAIN CONTRACTS (`architecture/domain_contracts.md`) — the public DTO shapes the domain declares.
-   * ADDITIVE + hash-inert (like `nomosValueObjects`): omit-when-empty, so a contract-free domain is
-   * byte-identical. Each contract carries its public field shapes (name/kind, VO name, ref target) and
-   * the concrete aggregate ids that `.implements(...)` it. Drives the shared `contracts.dart` + TS interfaces.
-   */
-  readonly nomosContracts?: {
-    readonly v: 1;
-    readonly contracts: readonly {
-      readonly id: string;
-      readonly fields: readonly { readonly name: string; readonly kind: string; readonly vo?: string; readonly refTarget?: string }[];
-      readonly implementedBy: readonly string[];
-    }[];
-  };
-}
-
-/** The `nomosContracts` descriptor type — a domain's public DTO shapes (era-safe, hash-inert). */
-export type NomosContracts = NonNullable<UsdLayer["nomosContracts"]>;
-
-/**
- * Build the additive `nomosContracts` descriptor for a module: each declared contract's public field
- * shapes + the concrete aggregate ids that `.implements(...)` it. Returns undefined when the module
- * declares no contract (omit-when-empty — a contract-free domain is byte-identical). SHARED by the
- * whole-doc emit (`usd.ts`) and the layered emit (`usd_layers.ts`) so both produce identical bytes.
- */
-export function buildNomosContracts(module: {
-  readonly aggregates: readonly { id: string; implementsContracts?: readonly string[] }[];
-  readonly contracts?: readonly import("./contract.js").ContractHandle[];
-}): NomosContracts | undefined {
-  const declared = module.contracts;
-  if (declared === undefined || declared.length === 0) return undefined;
-  // implementedBy: aggregate ids per contract id (from `.implements(...)`), sorted for determinism.
-  const implByContract = new Map<string, string[]>();
-  for (const agg of module.aggregates) {
-    for (const cid of agg.implementsContracts ?? []) {
-      const l = implByContract.get(cid) ?? [];
-      l.push(agg.id);
-      implByContract.set(cid, l);
-    }
-  }
-  const contracts = [...declared]
-    .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))
-    .map((c) => ({
-      id: c.id,
-      fields: Object.entries(c.fields).map(([name, f]) => {
-        const field = f as import("./fields.js").Field;
-        const vo = field.valueObject?.name;
-        const refTarget = field.foreignRef?.targetAggregateId ?? field.refAggregateId;
-        return {
-          name,
-          kind: field.kind,
-          ...(vo !== undefined ? { vo } : {}),
-          ...(refTarget !== undefined ? { refTarget } : {}),
-        };
-      }),
-      implementedBy: (implByContract.get(c.id) ?? []).slice().sort(),
-    }));
-  return { v: 1 as const, contracts };
-}
-
-/** The reserved variant name declaring a set's DEFAULT (USD has a default variant). */
-const DEFAULT_VARIANT = "*";
-
-/** The unified USD IR document: ordered (strength) layers. */
-export interface UsdDocument {
-  readonly layers: UsdLayer[];
-}
-
-/** The payload field kinds of a directive — `"string-required"` for a required `z.string()`, else the
- *  zod kind (`"optional"`, `"number"`, …). Used to validate a `fromPayload` routing field. Empty when
- *  the payload isn't a plain object (a shape the check can't reason about — the runtime gate arbitrates). */
-function payloadFieldKinds(dir: { payloadSchema?: unknown } | undefined): Map<string, string> {
-  const m = new Map<string, string>();
-  const schema = dir?.payloadSchema as Parameters<typeof zodKind>[0] | undefined;
-  if (schema === undefined) return m;
-  let shape: Record<string, Parameters<typeof zodKind>[0]>;
-  try {
-    if (zodKind(schema) !== "object") return m;
-    shape = zodObjectShape(schema);
-  } catch {
-    return m;
-  }
-  for (const [name, f] of Object.entries(shape)) {
-    const k = zodKind(f);
-    m.set(name, k === "string" ? "string-required" : k);
-  }
-  return m;
-}
-
-/** Sort prims by their `path` (canonical structure). */
-function sortPrims(prims: UsdPrim[]): UsdPrim[] {
-  return [...prims].sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
-}
-
-/**
- * Encode ONE `DomainModule` into the `UsdPrim`s sitting under `layerPath`. Reuses
- * `manifest.ts`'s `domainManifest` (and therefore its `encodeKernelSchema` driver encoding)
- * — no driver-encoding logic is duplicated here. Aggregate prims carry the exact
- * encoded schema; directive prims map `requiresCapability` → `requires: [cap]`, leave
- * `scope`/`artifactRef` `undefined` (no static scope or certified artifact today).
- */
-function encodeModuleToPrims(layerPath: string, manifest: CanonicalManifest): UsdPrim[] {
-  const prims: UsdPrim[] = [];
-
-  for (const agg of manifest.aggregates) {
-    prims.push({
-      kind: "aggregate",
-      // The IR prim path carries the (possibly dotted-qualified) type verbatim; the `.usda`
-      // TEXT lane sanitizes the prim NAME (`usd_layers.ts::primName`) and round-trips the raw
-      // id via `nomos:id`, so real-USD identifier rules are already satisfied downstream.
-      path: `${layerPath}/${agg.id}`,
-      type: agg.id,
-      schema: agg.schema,
-    });
-  }
-
-  for (const d of manifest.directives) {
-    prims.push({
-      kind: "directive",
-      path: `${layerPath}/${d.id}`,
-      target: d.target,
-      marker: d.marker,
-      // The legacy RBAC capability set is GONE (full-native teardown) — native write-authz is the
-      // `nomosRelationGate` era key (a directive's `.requires(relation)`), read by the one gate, not
-      // this prim field. Kept empty so the #137 layer-composition shape is unchanged.
-      requires: [],
-      // Carry the declared law boundary straight from the canonical manifest, which
-      // already applies omit-when-empty: `reads`/`emits` are present here ONLY when the
-      // directive declared them, so a boundary-free prim is byte-identical to before.
-      ...(d.reads !== undefined ? { reads: d.reads } : {}),
-      ...(d.emits !== undefined ? { emits: d.emits } : {}),
-      // MULTI-OUTPUT: the additional aggregates this directive declares it writes (self-describing law).
-      // Omit-when-empty from the manifest, so a single-output prim is byte-identical to before.
-      ...(d.secondaryOutputs !== undefined ? { secondaryOutputs: d.secondaryOutputs } : {}),
-      payloadJsonSchema: d.payloadJsonSchema,
-      // `scope`/`artifactRef` deliberately omitted (undefined): no static scope in
-      // the DSL today, payload is the stage-2 certified artifact.
-    });
-  }
-
-  return sortPrims(prims);
-}
-
-function aggregateFieldKindsForModule(
-  mod: DomainModule,
-  qa: (type: string) => string = (n) => n,
-): Record<string, Record<string, UsdFieldKindDescriptor>> {
-  const out: Record<string, Record<string, UsdFieldKindDescriptor>> = {};
-  for (const agg of [...(mod.aggregates as AggregateHandle[])].sort((a, b) =>
-    a.id < b.id ? -1 : a.id > b.id ? 1 : 0,
-  )) {
-    const fields: Record<string, UsdFieldKindDescriptor> = {};
-    for (const name of Object.keys(agg.fields).sort()) {
-      const field = agg.fields[name]!;
-      fields[name] = {
-        kind: field.kind,
-        ...(field.mapValueKind !== undefined ? { mapValueKind: field.mapValueKind } : {}),
-      };
-    }
-    out[qa(agg.id)] = fields;
-  }
-  return out;
-}
-
-function readKeyFieldKind(
-  byType: Record<string, Record<string, UsdFieldKindDescriptor>>,
-  queryId: string,
-  returns: string,
-  keyField: string,
-): string {
-  const schema = byType[returns];
-  if (schema === undefined) {
-    throw new Error(
-      `usd: query '${queryId}' returns '${returns}', which has no field schema in nomosReadProjection`,
-    );
-  }
-  const lookup = keyField.includes(".") ? keyField.split(".")[0]! : keyField;
-  const descriptor = schema[lookup];
-  if (descriptor === undefined) {
-    throw new Error(
-      `usd: query '${queryId}' is keyed on '${keyField}' (field '${lookup}'), which '${returns}' does not declare`,
-    );
-  }
-  return descriptor.kind;
-}
-
-function readProjectionForModule(
-  mod: DomainModule,
-  manifest: CanonicalManifest,
-  qa: (type: string) => string = (n) => n,
-): UsdReadProjection {
-  const aggregateFieldKinds = aggregateFieldKindsForModule(mod, qa);
-  return {
-    aggregateFieldKinds,
-    queries: (manifest.queries ?? []).map((q) => ({
-      id: q.id,
-      key: q.key.map((field) => ({
-        field,
-        kind: readKeyFieldKind(aggregateFieldKinds, q.id, q.returns, field),
-      })),
-      returns: q.returns,
-    })),
-    counts: (manifest.counts ?? []).map((c) => ({
-      id: c.id,
-      of: c.of,
-      by: c.by ?? null,
-      ...(c.where !== undefined ? { where: c.where } : {}),
-    })),
-    spatials: (manifest.spatials ?? []).map((s) => ({ id: s.id, of: s.of, on: s.on })),
-    deriveds: (manifest.deriveds ?? []).map((d) => ({ id: d.id, of: d.of, returns: d.returns })),
-    combineds: (manifest.combineds ?? []).map((c) => ({
-      id: c.id,
-      of: c.of,
-      refField: c.refField,
-      reads: c.reads,
-      returns: c.returns,
-    })),
-    ...((manifest.sums ?? []).length > 0
-      ? {
-          sums: manifest.sums!.map((s) => ({
-            id: s.id,
-            of: s.of,
-            field: s.sumField,
-            by: s.by ?? null,
-            ...(s.where !== undefined ? { where: s.where } : {}),
-          })),
-        }
-      : {}),
-    ...((manifest.mins ?? []).length > 0
-      ? {
-          mins: manifest.mins!.map((e) => ({
-            id: e.id,
-            of: e.of,
-            field: e.valueField,
-            by: e.by ?? null,
-            ...(e.where !== undefined ? { where: e.where } : {}),
-          })),
-        }
-      : {}),
-    ...((manifest.maxes ?? []).length > 0
-      ? {
-          maxes: manifest.maxes!.map((e) => ({
-            id: e.id,
-            of: e.of,
-            field: e.valueField,
-            by: e.by ?? null,
-            ...(e.where !== undefined ? { where: e.where } : {}),
-          })),
-        }
-      : {}),
-    ...((manifest.orderedReads ?? []).length > 0
-      ? {
-          orderedReads: manifest.orderedReads!.map((r) => ({
-            id: r.id,
-            of: r.of,
-            orderKey: r.orderKey,
-            ...(r.orderDesc ? { orderDesc: true as const } : {}),
-            ...(r.where !== undefined ? { where: r.where } : {}),
-            limit: r.limit,
-          })),
-        }
-      : {}),
-  };
-}
-
-/**
- * Lower a layer's `relationType` decls into the canonical `nomosRelations` wire object (P1) —
- * keys SORTED for byte-determinism, omit-when-empty (the era rule). Multiple decls for one type
- * MERGE their relations (a relation-name collision is an author error); a caps conflict on one
- * type is an error. Rewrite-child ORDER is authored (semantic); `allowed` is sorted (it is a set).
- */
-function serializeRelationSchema(
-  decls: readonly import("./relation_schema.js").RelationTypeDecl[],
-  domainKey: string,
-): UsdLayer["nomosRelations"] {
-  if (decls.length === 0) return undefined;
-  const namespacedTypes = new Set(decls.filter((decl) => decl.global !== true).map((decl) => decl.type));
-  type AllowedW = { kind: string; type?: string; ns?: string; relation?: string };
-  const allowedKey = (a: AllowedW): string =>
-    a.kind === "direct" ? `direct:${a.type}` : a.kind === "wildcard" ? "wildcard" : `userset:${a.type}#${a.relation}`;
-  const byType = new Map<string, { relations: Map<string, { rewrite: unknown; allowed: unknown[] }>; caps?: { maxDepth: number; maxFanout: number } }>();
-  for (const d of decls) {
-    // RELATION-TYPE NAMESPACING: a tenant type keys under `<domainKey>__<type>` so two domains that each
-    // declare the same bare type never collide at the kernel's last-wins schema merge; a `global` type
-    // (kernel-coupled framework type) keys BARE. `computed`/`ttu` targets inside a rewrite are
-    // type-RELATIVE relation names resolved on the (now-qualified) type — so no rewrite rewrite is needed.
-    const typeId = qualifiedTypeId(domainKey, d);
-    let entry = byType.get(typeId);
-    if (entry === undefined) {
-      entry = { relations: new Map(), ...(d.caps ? { caps: d.caps } : {}) };
-      byType.set(typeId, entry);
-    } else if (d.caps !== undefined) {
-      if (entry.caps !== undefined && (entry.caps.maxDepth !== d.caps.maxDepth || entry.caps.maxFanout !== d.caps.maxFanout)) {
-        throw new Error(`relationType("${d.type}"): conflicting caps across declarations`);
-      }
-      entry.caps = d.caps;
-    }
-    for (const [rel, def] of d.relations) {
-      if (entry.relations.has(rel)) throw new Error(`relationType("${d.type}"): relation "${rel}" declared in two relationType() blocks`);
-      // An allowed object/userset subject names another relation type. When that target is local to this
-      // domain it must carry the SAME qualifier as the schema key and objectOf(...) tuple subject; otherwise
-      // a perfectly typed parent edge is stored under `<domain>__Parent` while the gate only permits bare
-      // `Parent`, making tuple-to-userset inheritance silently dead. Framework-global user/key types stay bare.
-      const allowed = [...def.allowed]
-        .map((subject) => {
-          if ((subject.kind === "direct" || subject.kind === "userset") && namespacedTypes.has(subject.type)) {
-            return { ...subject, type: qualifyRelationType(domainKey, subject.type) };
-          }
-          return subject;
-        })
-        .sort((x, y) => (allowedKey(x as AllowedW) < allowedKey(y as AllowedW) ? -1 : 1));
-      entry.relations.set(rel, { rewrite: def.rewrite, allowed });
-    }
-  }
-  const types: Record<string, { relations: Record<string, { rewrite: unknown; allowed: unknown[] }>; caps?: { maxDepth: number; maxFanout: number } }> = {};
-  for (const type of [...byType.keys()].sort()) {
-    const entry = byType.get(type)!;
-    const relations: Record<string, { rewrite: unknown; allowed: unknown[] }> = {};
-    for (const rel of [...entry.relations.keys()].sort()) relations[rel] = entry.relations.get(rel)!;
-    types[type] = { relations, ...(entry.caps ? { caps: entry.caps } : {}) };
-  }
-  return { v: 1 as const, types };
-}
-
-/**
- * Synthesize the NATIVE read relations a layer's private aggregates imply. Each distinct
- * `requires(cap)` becomes ONE relation `cap` on the workspace-scope object, allowing the leaf
- * subject classes a read principal can be (`user:<uid>`, the `key:<hash>` control-plane subject,
- * and the `user:*` public wildcard). The read gate's `RewriteEngine.check(workspace:self, cap,
- * Subject::parse(principal))` resolves THIS relation against the tuples a `relateSubject` grant
- * folds — so a granted reader is admitted and a non-grantee fail-closes (no tuple). Pure-direct
- * `this` rewrite (a flat membership relation — the read-cap is just "who was granted it").
- */
-function synthesizeReadRelationTypes(
-  manifest: CanonicalManifest,
-): import("./relation_schema.js").RelationTypeDecl[] {
-  const caps = new Set<string>();
-  for (const a of manifest.aggregates) {
-    if (a.requiresRead !== undefined && a.owned === undefined) caps.add(a.requiresRead);
-  }
-  // Pack acquisition happens before per-record filtering/decryption. Any law with owned state therefore
-  // needs the same obscure capability at workspace grain, and the receiving-group genesis always writes
-  // that seat so a standalone group law remains self-consistent too. This grants ciphertext transport;
-  // each owned record still has its separately synthesized aggregate-grain relation below.
-  if (
-    manifest.aggregates.some((aggregate) => aggregate.owned !== undefined) ||
-    manifest.aggregates.some((aggregate) => aggregate.id === "NomosInternalReceivingGroup7c1f5e")
-  ) {
-    caps.add(OWNED_READ_RELATION);
-  }
-  const out: import("./relation_schema.js").RelationTypeDecl[] = [];
-  // GLOBAL (un-namespaced): the read gate hardcodes `ObjectRef::new("workspace","self")` in Rust
-  // (`wasm_git_holon.rs`), so the synthesized read-visibility `workspace` type MUST stay bare — it is
-  // NOT namespaced by the owning domain (site-6 exemption; a Rust change would be needed to qualify it).
-  const builder = relationType("workspace").asGlobal();
-  // Sorted for byte-determinism (the serializer also sorts, but keep the source stable). PURE
-  // DIRECT (`rewrite` omitted ⇒ `null`, not `self()`): a flat membership relation — the read-cap is
-  // exactly "who was granted it". (`self()`/`Rewrite::This` inside a rewrite expands to an EMPTY
-  // leaf in v1, which would zero the encryption fan-out roster — the direct form is what Expand reads.)
-  for (const cap of [...caps].sort()) {
-    builder.relation(cap, { allow: [user(), key(), anyUser()] });
-  }
-  if (caps.size > 0) out.push(builder);
-  // `.owned()` is record-grained: its read relation lives on the aggregate object itself, so the
-  // existing row filter checks `<qualified-type>:<record-id>#<relation>`. The type remains local and is
-  // therefore qualified by the same domain key as the aggregate; only direct user principals may sit it.
-  for (const a of [...manifest.aggregates].filter((x) => x.owned !== undefined).sort((x, y) => x.id.localeCompare(y.id))) {
-    const owned = a.owned!;
-    // `manifest` already carries the read-projection-qualified type (`domain.Note`). Keep that exact
-    // spelling global here rather than applying the relation namespace (`domain__Note`): the read gate
-    // constructs its per-record object from the projected row type, so schema, tuple and row must agree.
-    out.push(relationType(a.id).asGlobal().relation(owned.relation, { allow: [user()] }));
-  }
-  if (manifest.aggregates.some((x) => x.owned !== undefined)) {
-    out.push(
-      relationType("nomos-owned-principal")
-        .asGlobal()
-        .relation(OWNED_KEY_RELATION, { allow: [key()] })
-        .relation(OWNED_RECOVERY_RELATION, { allow: [user()] }),
-    );
-  }
-  return out;
-}
-
-/**
- * Encode each `{ path, module }` into a `UsdLayer` of prims under that path, returning
- * the canonical `UsdDocument`: layers SORTED by path, prims SORTED by path.
- */
-export function emitUsd(
-  layers: { path: string; module: DomainModule }[],
-): UsdDocument {
-  const out: UsdLayer[] = layers
-    .map((l) => {
-      // Carry the domain's declared queries straight from the canonical manifest,
-      // which already applies omit-when-empty: `queries` is present here ONLY when the
-      // module declared them, so a query-free layer is byte-identical to before.
-      const bareManifest = domainManifest(l.module);
-      // READ-PROJECTION NAMESPACING: every NON-GLOBAL aggregate's type name is qualified by the
-      // owning domain key — on the prims, the identity manifest, the stable-ids labels (bare name
-      // appended to `was` — the rename lineage), the read projection, and every `of`/`returns`
-      // reference — so two domains / two installs that each declare the same bare name never share
-      // an installed-read-manifest accumulator key. GLOBAL (framework allowlist / `{global:true}`)
-      // aggregates stay bare (the kernel addresses them by bare name). The engine stamps the SAME
-      // qualified name at plan runtime (`wire_encode.ts` via the dispatch context), so rows and
-      // schema keys agree by construction. `module.domain ?? module.name` — the SAME qualifier key
-      // relation namespacing uses (=== `intent.domain` at plan runtime).
-      const rpDomainKey = l.module.domain ?? l.module.name;
-      const namespacedAggs = namespacedAggregateIds(
-        l.module.aggregates as unknown as readonly { id: string; global?: boolean }[],
-      );
-      const qaType = (n: string): string =>
-        namespacedAggs.has(n) ? qualifyReadProjectionType(rpDomainKey, n) : n;
-      const manifest = qualifyManifestAggregateLabels(bareManifest, rpDomainKey, namespacedAggs);
-      // `.owned()` reserves its deliberately obscure relation spelling. If tenant law nevertheless reaches
-      // for it, fail here instead of merging, qualifying or shadowing the declaration: a collision is useful
-      // evidence that the tenant is modelling the same concept, but silently capturing it would make their
-      // code mean something they did not write.
-      const ownedRelations = new Set([OWNED_READ_RELATION, OWNED_KEY_RELATION, OWNED_RECOVERY_RELATION]);
-      for (const d of l.module.relationTypes ?? []) {
-        for (const relation of d.relations.keys()) {
-          if (!ownedRelations.has(relation)) continue;
-          throw new Error(
-            `relationType(${JSON.stringify(d.type)}): relation ${JSON.stringify(relation)} is reserved by ` +
-              `Nomos .owned(). Sorry mate, that concept is already taken by the framework; give the ` +
-              `business relation a different name.`,
-          );
-        }
-      }
-      // THE READ-PROJECTION NAMESPACE ERA KEY: present iff ≥1 aggregate was qualified (the witness
-      // marker — mirrors `nomosRelationNamespace`; the qualification itself is baked into the keys).
-      const nomosReadProjectionNamespace =
-        namespacedAggs.size > 0
-          ? { v: 1 as const, delimiter: READ_PROJECTION_DELIMITER, types: [...namespacedAggs].map(qaType).sort() }
-          : undefined;
-      // THE INVARIANT-GATE DECLARATION (#41): presence-only, derived from the SAME module
-      // the lump's executable bodies come from — sorted, omit-when-empty (hash-stable for
-      // invariant-free law; see the `UsdLayer.nomosInvariantGate` banner for the era rule).
-      const invariantAggregates = l.module.aggregates
-        .filter((a) => a.hasInvariant === true)
-        .map((a) => qaType(a.id))
-        .sort();
-      const wsInvariants = [...(l.module.workspaceInvariants ?? [])]
-        .map((w) => ({ id: w.id, on: w.on }))
-        .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
-      // THE READ-VISIBILITY → NATIVE RELATION lowering (the one-model teardown): a private
-      // aggregate's `requires(cap)` IS a native read relation on the workspace-scope object. Each
-      // distinct read cap synthesizes a `relationType("workspace").relation(cap, { allow:[user, key,
-      // anyUser] })` so the ONE evaluator (`RewriteEngine.check`) resolves it at the read gate — the
-      // SAME relation a `relateSubject({ object:"workspace:self", relation:cap, ... })` grant folds
-      // into. The `nomosReadVisibility` key (type → cap) is RETAINED as the type-to-relation map; the
-      // synthesized schema is what makes that cap a checkable relation. SORTED + omit-when-empty.
-      const readRelationTypes = synthesizeReadRelationTypes(manifest);
-      // THE OWNING DOMAIN KEY — the relation-namespacing qualifier (the SAME key the openapi routes
-      // dispatch by, `module.domain ?? module.name`, so `intent.domain` at plan runtime === the key the
-      // schema/gate qualified under; the tuple object a token produces then lines up by construction).
-      const domainKey = l.module.domain ?? l.module.name;
-      // The NON-GLOBAL (namespaced) relation type names this layer declares — the set whose gate objects
-      // must be qualified. A `global` type (governance `workspace`, signer `identity`, read-visibility
-      // `workspace`) stays bare on BOTH the schema and the gate side, so it is excluded here.
-      const namespacedTypes = new Set(
-        [...(l.module.relationTypes ?? []), ...readRelationTypes]
-          .filter((d) => d.global !== true)
-          .map((d) => d.type),
-      );
-      // THE AMBIGUITY GUARD (relation-namespacing): a bare `writeTuple({object:"workspace:self", relation:R})`
-      // is auto-qualified iff `(type,R)` is a LOCAL non-global authored relation, and left BARE iff it is a
-      // GLOBAL / read-visibility cap. If ONE `(type,R)` is BOTH — a non-global authored relation AND a
-      // synthesized read-visibility cap (always on type `workspace`) — the bare object is genuinely
-      // ambiguous. Refuse at compile with a clear message (the maintainer's rule: never silently pick).
-      {
-        const readCaps = new Set(readRelationTypes.flatMap((rt) => [...rt.relations.keys()]));
-        for (const d of l.module.relationTypes ?? []) {
-          if (d.global === true || d.type !== "workspace") continue;
-          for (const rel of d.relations.keys()) {
-            if (readCaps.has(rel)) {
-              throw new Error(
-                `relation-namespacing conflict in domain "${domainKey}": relation "workspace#${rel}" is ` +
-                  `declared BOTH as a local authored relationType("workspace") relation AND as a ` +
-                  `read-visibility cap (a requires("${rel}") aggregate). A bare writeTuple object for ` +
-                  `"${rel}" would be ambiguous (qualify vs stay bare). Rename one of them.`,
-              );
-            }
-          }
-        }
-      }
-      // THE RELATION-NAMESPACE ERA KEY (`nomosRelationNamespace`): present IFF this layer qualified ≥1
-      // (non-global) relation type — the marker that this bundle's relation ids are domain-qualified.
-      // Absent when a layer declares no relation type OR only global ones ⇒ byte-identical to the
-      // pre-namespacing compiler (the `nomosRelations`/`nomosInvariantGate` era discipline).
-      const qualifiedTypeIds = [...namespacedTypes].map((t) => qualifyRelationType(domainKey, t)).sort();
-      const nomosRelationNamespace =
-        qualifiedTypeIds.length > 0 ? { v: 1 as const, delimiter: "__", types: qualifiedTypeIds } : undefined;
-      // Qualify the TYPE half of a gate object by the owning domain — but ONLY when this layer declares
-      // that type as a NON-GLOBAL relation type (so the gate object matches its qualified schema id). A
-      // global-type object (`workspace:self` for governance/read-visibility) or a type this layer doesn't
-      // declare passes through BARE — byte-identical to the pre-namespacing compiler.
-      const qualifyGateObject = (obj: string): string => {
-        const colon = obj.indexOf(":");
-        if (colon < 0) return obj;
-        const ty = obj.slice(0, colon);
-        return namespacedTypes.has(ty) ? `${qualifyRelationType(domainKey, ty)}${obj.slice(colon)}` : obj;
-      };
-      // THE RELATION SCHEMA (P1): per-type rewrites lowered to the nomosRelations AST, UNIONED with the
-      // synthesized read relations. Keys are QUALIFIED by the owning domain (namespacing) except global
-      // types. SORTED keys (byte-determinism); omit-when-empty (era rule). A read-cap name colliding with
-      // an authored `workspace` relation is an author error (caught in the merge).
-      const nomosRelations = serializeRelationSchema(
-        [...(l.module.relationTypes ?? []), ...readRelationTypes],
-        domainKey,
-      );
-      // THE RELATION GATE (P4): directives declaring `.requiresRelation` → directiveId → {relation,
-      // object}. The object's TYPE half is qualified to match the (now-namespaced) schema id. SORTED
-      // keys; omit-when-empty (era rule — a relation-gate-free layer is byte-identical).
-      const relationGateReq: Record<
-        string,
-        { relation: string; object: string; objectFrom?: { recordType: string; idField: string } }
-      > = {};
-      for (const d of [...l.module.directives].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))) {
-        if (d.requiresRelationGate !== undefined) {
-          const objectFrom = d.requiresRelationGate.objectFrom;
-          relationGateReq[d.id] = {
-            relation: d.requiresRelationGate.relation,
-            object: qualifyGateObject(d.requiresRelationGate.object),
-            // PER-RECORD object (home_holons §6): carried through to the wasm gate; omitted when absent
-            // so a self-relative directive's USD is byte-identical (the era rule). The recordType is the
-            // object type of the per-record tuple, so it namespaces exactly like the gate object type.
-            ...(objectFrom !== undefined
-              ? {
-                  objectFrom: {
-                    recordType: namespacedTypes.has(objectFrom.recordType)
-                      ? qualifyRelationType(domainKey, objectFrom.recordType)
-                      : objectFrom.recordType,
-                    idField: objectFrom.idField,
-                  },
-                }
-              : {}),
-          };
-        }
-      }
-      const nomosRelationGate =
-        Object.keys(relationGateReq).length > 0 ? { v: 1 as const, requires: relationGateReq } : undefined;
-      // THE CROSS-CUSTODY ATTESTATION GATE (home_holons §3/§5): directives declaring `.attestationAuthorized()`
-      // → directiveId → its LAW-DECLARED owner-source {ownerObject, ownerField}. SORTED keys (byte-
-      // determinism). Omit-when-empty (era rule). The one gate verifies the carried §3 quote (binding its
-      // subject to the named owner) + pins the principal to the attestation key — the kernel hardcodes no id.
-      const attestationReq: Record<
-        string,
-        {
-          ownerObject: string;
-          ownerField: string;
-          fields: { asserterWorkspace: string; object: string; relation: string; attestedAt: string; publicKey: string; signature: string };
-        }
-      > = {};
-      for (const d of [...l.module.directives].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))) {
-        if (d.attestationAuthorizedGate !== undefined) {
-          attestationReq[d.id] = {
-            ownerObject: d.attestationAuthorizedGate.ownerObject,
-            ownerField: d.attestationAuthorizedGate.ownerField,
-            fields: { ...d.attestationAuthorizedGate.fields },
-          };
-        }
-      }
-      const nomosAttestationGate =
-        Object.keys(attestationReq).length > 0 ? { v: 1 as const, directives: attestationReq } : undefined;
-      // THE DELEGATED-AUTHORITY GATE (delegated_authority_births.md): directives declaring `.delegatedRole()`
-      // → directiveId → its {relation, subjectField, certField, parentKeyObject, parentKeyField}. SORTED keys
-      // (byte-determinism). Omit-when-empty (era rule) — a law with no delegation is byte-identical. The one
-      // gate verifies the carried DelegationCert to K_root + binds (relation, subject) + `.delegatedFrom(parent)`.
-      const delegationReq: Record<
-        string,
-        { relation: string; subjectField: string; certField: string; parentKeyObject: string; parentKeyField: string }
-      > = {};
-      for (const d of [...l.module.directives].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))) {
-        const g = (d as { delegatedRoleGate?: {
-          relation: string; subjectField: string; certField: string; parentKeyObject: string; parentKeyField: string;
-        } }).delegatedRoleGate;
-        if (g !== undefined) {
-          delegationReq[d.id] = {
-            relation: g.relation,
-            subjectField: g.subjectField,
-            certField: g.certField,
-            parentKeyObject: g.parentKeyObject,
-            parentKeyField: g.parentKeyField,
-          };
-        }
-      }
-      const nomosDelegationGate =
-        Object.keys(delegationReq).length > 0 ? { v: 1 as const, directives: delegationReq } : undefined;
-      // THE ATTESTED-READ GATE (slice B): per-directive `(queryId, from)` edges + the module's
-      // trustSource declarations. Emitted iff ≥1 directive declares a foreign read (the era
-      // rule). A declared `from` with NO matching trustSource is a NAMED COMPILE ERROR — the
-      // kernel would fail it closed anyway; refuse loudly at build instead.
-      type ForeignEdgeInternal =
-        | { queryId: string; from: string }
-        | { queryId: string; policy: string; fromPayload: string };
-      type ForeignEdgeEmit = { queryId: string; from: string } | { queryId: string; policy: string };
-      const foreignDirectives: Record<string, ForeignEdgeInternal[]> = {};
-      for (const d of [...l.module.directives].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))) {
-        const fr = (d as { declaredForeignReads?: ForeignEdgeInternal[] }).declaredForeignReads;
-        if (fr !== undefined && fr.length > 0) foreignDirectives[d.id] = fr.map((e) => ({ ...e }));
-      }
-      let nomosAttestedReadGate: UsdLayer["nomosAttestedReadGate"];
-      if (Object.keys(foreignDirectives).length > 0) {
-        const trust = (l.module as { trustSources?: readonly import("./attested.js").TrustSourceDecl[] }).trustSources ?? [];
-        const trustByWs = new Map(trust.map((tsrc) => [tsrc.workspace, tsrc]));
-        const policies = (l.module as { trustPolicies?: readonly import("./attested.js").TrustPolicyDecl[] }).trustPolicies ?? [];
-        const policyById = new Map(policies.map((p) => [p.policyId, p]));
-        const aggIds = new Set(l.module.aggregates.map((a) => a.id));
-        // A policy-referenced allow-list must be a real aggregate of THIS module (the fold happens in
-        // the reader's own state) — else the gate could never resolve it (fail-closed at build).
-        for (const p of policies) {
-          if (!aggIds.has(p.allowListType)) {
-            throw new Error(
-              `trustPolicy('${p.policyId}'): its allowList aggregate '${p.allowListType}' is not an ` +
-                `aggregate of this domain — the acceptable-source set is the reader's OWN folded state, ` +
-                `so the allow-list must be declared (and written by a gated enrolment directive) here.`,
-            );
-          }
-        }
-        const sourcesRec: NonNullable<UsdLayer["nomosAttestedReadGate"]>["sources"] = {};
-        const policiesRec: NonNullable<NonNullable<UsdLayer["nomosAttestedReadGate"]>["policies"]> = {};
-        const emitDirectives: Record<string, ForeignEdgeEmit[]> = {};
-        for (const [dirId, edges] of Object.entries(foreignDirectives)) {
-          const dir = l.module.directives.find((d) => d.id === dirId);
-          const payloadShape = payloadFieldKinds(dir);
-          const emitted: ForeignEdgeEmit[] = [];
-          for (const e of edges) {
-            if ("from" in e) {
-              const tsrc = trustByWs.get(e.from);
-              if (tsrc === undefined) {
-                throw new Error(
-                  `directive '${dirId}' declares .readsFrom('${e.from}', '${e.queryId}') but the ` +
-                    `module exports no trustSource('${e.from}', …) — the trust edge must be declared ` +
-                    `in law (attested_reads_design.md §3.1)`,
-                );
-              }
-              if (sourcesRec[e.from] === undefined) {
-                sourcesRec[e.from] = {
-                  genesis: tsrc.genesis,
-                  ...(tsrc.keyHashes !== undefined && tsrc.keyHashes.length > 0
-                    ? { keyHashes: [...tsrc.keyHashes].sort() }
-                    : {}),
-                  ...(tsrc.maxAgeMs !== undefined ? { maxAgeMs: tsrc.maxAgeMs } : {}),
-                  ...(tsrc.minSourceEpoch !== undefined ? { minSourceEpoch: tsrc.minSourceEpoch } : {}),
-                  ...(tsrc.monotone === true ? { monotone: true } : {}),
-                  roster: tsrc.roster ?? "pinned",
-                  onDishonor: tsrc.onDishonor ?? "refuse",
-                };
-              }
-              emitted.push({ queryId: e.queryId, from: e.from });
-            } else {
-              const pol = policyById.get(e.policy);
-              if (pol === undefined) {
-                throw new Error(
-                  `directive '${dirId}' declares .readsFrom(fromPayload('${e.fromPayload}'), '${e.queryId}', ` +
-                    `{ policy: '${e.policy}' }) but the module exports no trustPolicy('${e.policy}', …) — the ` +
-                    `policy must be declared in law (dynamic_source_attested_reads.md).`,
-                );
-              }
-              // The routing field must be a REQUIRED string in the directive's payload (the workspace
-              // name is chosen at runtime; a missing/optional/non-string field could never route).
-              const kind = payloadShape.get(e.fromPayload);
-              if (kind === undefined) {
-                throw new Error(
-                  `directive '${dirId}': .readsFrom(fromPayload('${e.fromPayload}'), …) names a payload ` +
-                    `field that is not declared in the directive's payload — add a required z.string() ` +
-                    `'${e.fromPayload}' to the payload (it carries the routed source workspace name).`,
-                );
-              }
-              if (kind !== "string-required") {
-                throw new Error(
-                  `directive '${dirId}': the fromPayload routing field '${e.fromPayload}' must be a ` +
-                    `REQUIRED z.string() in the payload (it names the routed source workspace) — got '${kind}'.`,
-                );
-              }
-              if (policiesRec[e.policy] === undefined) {
-                policiesRec[e.policy] = {
-                  // Qualify the allow-list type by the owning domain iff it is namespaced — the
-                  // gate scans rows by their stored `__type`, which the engine stamps qualified
-                  // (`qaType`, the SAME read-projection namespacing rows/schema keys use). A bare
-                  // (unqualified) allowList would match no folded row → every dynamic read refuses.
-                  allowList: qaType(pol.allowListType),
-                  genesisField: pol.genesisField,
-                  keysField: pol.keysField,
-                  ...(pol.maxAgeMs !== undefined ? { maxAgeMs: pol.maxAgeMs } : {}),
-                  ...(pol.minSourceEpoch !== undefined ? { minSourceEpoch: pol.minSourceEpoch } : {}),
-                  ...(pol.monotone === true ? { monotone: true } : {}),
-                  ...(pol.onDishonor !== undefined ? { onDishonor: pol.onDishonor } : {}),
-                };
-              }
-              emitted.push({ queryId: e.queryId, policy: e.policy });
-            }
-          }
-          emitDirectives[dirId] = emitted;
-        }
-        // SORTED-KEY records (byte-determinism — matching the layered flatten).
-        const sortedSources: typeof sourcesRec = {};
-        for (const k of Object.keys(sourcesRec).sort()) sortedSources[k] = sourcesRec[k]!;
-        const sortedPolicies: typeof policiesRec = {};
-        for (const k of Object.keys(policiesRec).sort()) sortedPolicies[k] = policiesRec[k]!;
-        const sortedDirectives: Record<string, ForeignEdgeEmit[]> = {};
-        for (const k of Object.keys(emitDirectives).sort()) sortedDirectives[k] = emitDirectives[k]!;
-        nomosAttestedReadGate = {
-          v: 1 as const,
-          sources: sortedSources,
-          ...(Object.keys(sortedPolicies).length > 0 ? { policies: sortedPolicies } : {}),
-          directives: sortedDirectives,
-        };
-      }
-      // THE BIRTH GATE (G3 — birth is a declared kernel primitive): the SORTED set of directive ids
-      // declaring `.births()`. The kernel reads this off the manifest (never a domain aggregate) to know an
-      // admitted directive births, then folds the recipe the intent carried. Omit-when-empty (era rule —
-      // a birth-free layer is byte-identical apart from the always-on stableIds key).
-      const birthDirectives = [...l.module.directives]
-        .filter((d) => (d as { birthsChild?: boolean }).birthsChild === true)
-        .map((d) => d.id)
-        .sort();
-      const nomosBirthGate =
-        birthDirectives.length > 0 ? { v: 1 as const, directives: birthDirectives } : undefined;
-      // THE BIRTH-RECORD GATE (metered birth, slice A1 — the framework's new era key). Present IFF
-      // this layer declares ≥1 `.births()` directive AND was compiled under this compiler: the law's
-      // EXPLICIT declaration that every birth it performs ALSO writes a structural NomosBirthRecord
-      // in the SAME intent (the `.births()` lane appends it automatically). The kernel's
-      // `verify_births_witness` reads THIS key (never a version-if): a carried birth whose re-derived
-      // events contain no `<prefix><child>` record event is a typed refusal (`birth-record-missing`).
-      // Omit-when-empty (the era rule): every pre-feature bundle lacks the key and births as today.
-      const nomosBirthRecordGate =
-        birthDirectives.length > 0
-          ? { v: 1 as const, aggregate: "NomosBirthRecord", prefix: "nomos-birth-record:" }
-          : undefined;
-      // THE PEER-SOVEREIGN ROOT-OF-TRUST: the home/child law declared it requires a parent-attested-birth
-      // cert chain (the `requireParentAttestedBirth` sentinel). Emit the era key with the LAW-DECLARED owner +
-      // cert locators (so the kernel reads them, names neither); a bare marker (no locators) falls back to the
-      // framework `home` convention. Omit when absent (a law that doesn't require it is byte-identical).
-      const pabSrc = (
-        l.module as {
-          parentAttestedBirth?: boolean | { ownerObject?: string; ownerField?: string; certObject?: string; certField?: string };
-        }
-      ).parentAttestedBirth;
-      const nomosParentAttestedBirth = pabSrc
-        ? {
-            v: 1 as const,
-            ownerObject: (typeof pabSrc === "object" && pabSrc.ownerObject) || "home-owner:self",
-            ownerField: (typeof pabSrc === "object" && pabSrc.ownerField) || "principal",
-            certObject: (typeof pabSrc === "object" && pabSrc.certObject) || "birth-attestation:self",
-            certField: (typeof pabSrc === "object" && pabSrc.certField) || "certChain",
-          }
-        : undefined;
-      // THE KEYLESS VERIFIED-FIRST-DEVICE GATE (keyless_verified_onboard.md): collect each directive declaring
-      // `.verifiedFirstDevice()` → its payload FIELD MAPPING (where the token / seated keyHash / claimed issuer
-      // ride). The kernel's nomosVerifiedFirstEnroll arm reads the directive id + field names from THIS
-      // declaration (hardcoding neither) and bootstraps a first device-signer from the carried device-bound
-      // IdP attestation. Omit-when-empty (the era rule — byte-identical hash; the arm inert).
-      const firstEnrollReq: Record<
-        string,
-        { tokenField: string; keyHashField: string; verifiedViaField: string }
-      > = {};
-      for (const d of [...l.module.directives].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))) {
-        if (d.firstDeviceEnrollGate !== undefined) {
-          firstEnrollReq[d.id] = {
-            tokenField: d.firstDeviceEnrollGate.tokenField,
-            keyHashField: d.firstDeviceEnrollGate.keyHashField,
-            verifiedViaField: d.firstDeviceEnrollGate.verifiedViaField,
-          };
-        }
-      }
-      const nomosVerifiedFirstEnroll =
-        Object.keys(firstEnrollReq).length > 0 ? { v: 1 as const, directives: firstEnrollReq } : undefined;
-      // LAWFUL RECOVERY: the sole `.certifiesEra()` directive (if any) → the `nomosEraCertGate` era key.
-      // (One certifyEra verb per controller law; the last declared wins — the framework declares exactly one.)
-      let eraCertGate: UsdLayer["nomosEraCertGate"];
-      for (const d of [...l.module.directives].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))) {
-        if (d.certifiesEraGate !== undefined) {
-          eraCertGate = { v: 1 as const, directiveId: d.id, certField: d.certifiesEraGate.certField };
-        }
-      }
-      // THE CAPTURED-READ GATE DECLARATION (#58): collected from the canonical
-      // manifest's per-directive `capturedReads` (omit-when-empty — read-free law's
-      // USD is byte-identical apart from the always-on stableIds key).
-      const rgQueries = new Map<string, { key: string[]; returns: string }>();
-      const rgDirectives = new Map<string, string[]>();
-      for (const d of manifest.directives) {
-        if (d.capturedReads === undefined || d.capturedReads.length === 0) continue;
-        rgDirectives.set(d.id, d.capturedReads.map((r) => r.queryId));
-        for (const r of d.capturedReads) {
-          rgQueries.set(r.queryId, { key: [...r.key], returns: r.returns });
-        }
-      }
-      // SORTED-KEY records (byte-determinism — the layered flatten must reproduce
-      // these bytes exactly; see usd_layers.ts).
-      const readGateQueries: Record<string, { key: string[]; returns: string }> = {};
-      for (const k of [...rgQueries.keys()].sort()) readGateQueries[k] = rgQueries.get(k)!;
-      const readGateDirectives: Record<string, string[]> = {};
-      for (const k of [...rgDirectives.keys()].sort()) readGateDirectives[k] = rgDirectives.get(k)!;
-      // THE READ-VISIBILITY GATE (slice 5.1): every aggregate the manifest carries a
-      // `requiresRead` for, keyed by TYPE name → required cap. SORTED keys
-      // (byte-determinism); omit-when-empty so an all-public layer is byte-identical.
-      const visAggregates: Record<string, { requires: string; ownerField?: string }> = {};
-      const encAggregates: Record<string, { scope: string; fields: string[]; delegatable: false; owned?: true; ownerField?: string }> = {};
-      // ATTRIBUTED READS (field_provenance.md): aggregate TYPE → its attributed field
-      // names — the self-describing nomosAttributedGate era key. Omit-when-empty.
-      const attrAggregates: Record<string, string[]> = {};
-      for (const a of [...manifest.aggregates].sort((x, y) => (x.id < y.id ? -1 : x.id > y.id ? 1 : 0))) {
-        if (a.requiresRead !== undefined) {
-          visAggregates[a.id] = {
-            requires: a.requiresRead,
-            ...(a.owned !== undefined ? { ownerField: a.owned.ownerField } : {}),
-          };
-        }
-        if (a.attributedFields !== undefined && a.attributedFields.length > 0) {
-          attrAggregates[a.id] = [...a.attributedFields];
-        }
-        // THE ENCRYPTION GATE (slice 2): an aggregate with encrypted field(s) — its scope
-        // is its read cap (aggregate()/the gate guarantee they coincide). delegatable:false.
-        if (a.encryptedFields !== undefined && a.encryptedFields.length > 0 && a.requiresRead !== undefined) {
-          encAggregates[a.id] = {
-            scope: a.requiresRead,
-            fields: [...a.encryptedFields],
-            delegatable: false,
-            ...(a.owned !== undefined ? { owned: true as const, ownerField: a.owned.ownerField } : {}),
-          };
-        }
-      }
-      // THE CAPABILITY DECLARATION IN LAW (Full-A — capability_marketplace.md §4): the
-      // impure-capability quartets lowered into the SEALED law, so the holon can SURFACE
-      // them on a read (`declared_capabilities`) and the host RELAYS a deploy-time notice
-      // ("declares 'x' — bind it or obligations wait") WITHOUT reaching into root law-state.
-      // Mirrors the deploy-sidecar `capabilityLowerings` extraction; SORTED by aggregate id;
-      // omit-when-empty so capability-free law is byte-identical (the era rule). Declaring a
-      // capability now MOVES the domainHash (named, expected — like the stable-ids key).
-      const nomosCapabilities = [...((l.module as { impureCapabilities?: readonly unknown[] }).impureCapabilities ?? [])]
-        .map((c) => {
-          const k = c as {
-            aggregate: { id: string };
-            obligation: { id: string };
-            complete: { id: string };
-            fail: { id: string };
-            block: { id: string };
-            deadLetter: { id: string };
-            name?: unknown;
-            capability?: unknown;
-            endpoint?: unknown;
-            tasks?: { id?: unknown };
-          };
-          const cap = typeof k.name === "string" ? k.name : typeof k.capability === "string" ? k.capability : null;
-          if (cap === null) return null; // a binding-free quartet declares nothing (omit-when-absent)
-          return {
-            capability: cap,
-            aggregateId: k.aggregate.id,
-            obligation: k.obligation.id,
-            complete: k.complete.id,
-            fail: k.fail.id,
-            block: k.block.id,
-            deadLetter: k.deadLetter.id,
-            tasksQueryId: typeof k.tasks?.id === "string" ? k.tasks.id : null,
-            ...(typeof k.endpoint === "string" ? { endpoint: k.endpoint } : {}),
-          };
-        })
-        .filter((c): c is NonNullable<typeof c> => c !== null)
-        .sort((a, b) => (a.aggregateId < b.aggregateId ? -1 : a.aggregateId > b.aggregateId ? 1 : 0));
-      // THE DECLASSIFY SITES (nomosFlowGate rule 4 — security_model.md): every acknowledged
-      // intended secret-correlated refusal, with its human reason. Hashed into the law (it IS
-      // a law-declared waiver) + replay-verified — "the set of declassify sites is the entire
-      // audit surface". Omit-when-empty: a domain with no declassify is byte-identical.
-      const flowDeclassify = [
-        ...[...(l.module.workspaceInvariants ?? [])]
-          .filter((wi) => typeof (wi as { declassify?: unknown }).declassify === "string")
-          .map((wi) => ({ site: `workspaceInvariant:${wi.id}`, reason: (wi as { declassify: string }).declassify })),
-        ...[...(l.module.aggregates as { id: string; invariantDeclassify?: unknown }[])]
-          .filter((a) => typeof a.invariantDeclassify === "string")
-          .map((a) => ({ site: `aggregateInvariant:${a.id}`, reason: a.invariantDeclassify as string })),
-        ...[...((l.module as { impureCapabilities?: readonly { name?: string; capability?: string; aggregate: { id: string }; declassify?: unknown }[] }).impureCapabilities ?? [])]
-          .filter((c) => typeof c.declassify === "string")
-          .map((c) => ({ site: `capability:${c.name ?? c.capability ?? c.aggregate.id}`, reason: c.declassify as string })),
-      ].sort((a, b) => (a.site < b.site ? -1 : a.site > b.site ? 1 : 0));
-      // THE ENDORSE FLOWS (the integrity dual — security_model.md): discovery IS law. Run each
-      // directive's pure plan with a probe principal + payload and harvest every PrincipalEvidence
-      // conversion's declared flow {directiveId, sink, facet, reason}. Hashed into nomosFlowGate +
-      // witnessed fail-closed at runtime (Slice B). Omit-when-empty (a principal-free domain is
-      // byte-identical). SORTED for determinism.
-      // FIRST-CLASS VALUE OBJECTS: the module's collected descriptors (composeDomainModule
-      // dedupes + sorts them). Omit-when-empty (era rule — VO-free law is byte-identical).
-      const moduleValueObjects = (l.module as { valueObjects?: readonly import("./fields.js").ValueObjectDescriptor[] }).valueObjects;
-      // THE VO↔FIELD ATTACHMENT: the usage pointers ride the SAME additive key (see
-      // the UsdLayer type) — computed from the live Field metas, sorted, omit-when-empty.
-      const voUsages = collectValueObjectUsages(
-        l.module.aggregates as unknown as readonly { id: string; fields: Record<string, import("./fields.js").Field> }[],
-      );
-      // MULTI-WORKSPACE LOCATORS: collect every `t.foreignRef` field across the module's aggregates.
-      const foreignRefList: { aggregate: string; field: string; workspaceField: string; target: string; targetDomain?: string }[] = [];
-      for (const agg of l.module.aggregates) {
-        for (const [fname, f] of Object.entries((agg as { fields: Record<string, { foreignRef?: { workspaceField: string; targetAggregateId: string; targetDomain?: string } }> }).fields)) {
-          const fr = f.foreignRef;
-          if (fr === undefined) continue;
-          foreignRefList.push({ aggregate: agg.id, field: fname, workspaceField: fr.workspaceField, target: fr.targetAggregateId, ...(fr.targetDomain !== undefined ? { targetDomain: fr.targetDomain } : {}) });
-        }
-      }
-      foreignRefList.sort((a, b) => (a.aggregate !== b.aggregate ? (a.aggregate < b.aggregate ? -1 : 1) : a.field < b.field ? -1 : a.field > b.field ? 1 : 0));
-      const nomosForeignRefs = foreignRefList.length > 0 ? { v: 1 as const, refs: foreignRefList } : undefined;
-      const nomosValueObjects =
-        moduleValueObjects !== undefined && moduleValueObjects.length > 0
-          ? {
-              v: 1 as const,
-              valueObjects: [...moduleValueObjects],
-              ...(voUsages.length > 0 ? { usages: voUsages } : {}),
-            }
-          : undefined;
-      // DOMAIN CONTRACTS: the additive `nomosContracts` descriptor (hash-inert, omit-when-empty).
-      const nomosContracts = buildNomosContracts(l.module);
-      const flowEndorse = [...l.module.directives]
-        .flatMap((d) => harvestPrincipalFlows(d as never, l.module.domain ?? l.module.name).map((f) => ({ directiveId: d.id, sink: f.sink, facet: f.facet, reason: f.reason })))
-        .sort((a, b) =>
-          a.directiveId !== b.directiveId ? (a.directiveId < b.directiveId ? -1 : 1)
-            : a.sink !== b.sink ? (a.sink < b.sink ? -1 : 1)
-              : a.facet < b.facet ? -1 : a.facet > b.facet ? 1 : 0,
-        );
-      return {
-        path: l.path,
-        prims: encodeModuleToPrims(l.path, manifest),
-        nomosIdentityManifest: manifest,
-        nomosReadProjection: readProjectionForModule(l.module, manifest, qaType),
-        ...(manifest.queries !== undefined ? { queries: manifest.queries } : {}),
-        ...(manifest.deriveds !== undefined ? { deriveds: manifest.deriveds } : {}),
-        ...(manifest.combineds !== undefined ? { combineds: manifest.combineds } : {}),
-        // STABLE IDS (#58): every post-#58 compile carries them (the era key).
-        ...(manifest.stableIds !== undefined ? { nomosStableIds: manifest.stableIds } : {}),
-        // THE STRUCTURAL INTERFACE (#72): the on-ledger OFFER — a client negotiates shape-
-        // compatibility against this, reactively, straight from the folded `policy:{hash}.bundle`.
-        // The client-facing structural offer stays BARE-labelled (labels are cosmetic there;
-        // shape-compat negotiates by sid) — pass the pre-namespacing stable-ids.
-        nomosInterface: domainInterface(l.module, bareManifest.stableIds),
-        ...(Object.keys(readGateDirectives).length > 0
-          ? {
-              nomosReadGate: {
-                v: 1 as const,
-                queries: readGateQueries,
-                directives: readGateDirectives,
-              },
-            }
-          : {}),
-        ...(invariantAggregates.length > 0 || wsInvariants.length > 0
-          ? {
-              nomosInvariantGate: {
-                v: 1 as const,
-                ...(invariantAggregates.length > 0 ? { aggregates: invariantAggregates } : {}),
-                ...(wsInvariants.length > 0 ? { workspaceInvariants: wsInvariants } : {}),
-              },
-            }
-          : {}),
-        ...(nomosRelations !== undefined ? { nomosRelations } : {}),
-        ...(nomosRelationNamespace !== undefined ? { nomosRelationNamespace } : {}),
-        ...(nomosReadProjectionNamespace !== undefined ? { nomosReadProjectionNamespace } : {}),
-        ...(nomosRelationGate !== undefined ? { nomosRelationGate } : {}),
-        ...(nomosAttestationGate !== undefined ? { nomosAttestationGate } : {}),
-        ...(nomosDelegationGate !== undefined ? { nomosDelegationGate } : {}),
-        ...(nomosAttestedReadGate !== undefined ? { nomosAttestedReadGate } : {}),
-        ...(nomosBirthGate !== undefined ? { nomosBirthGate } : {}),
-        ...(nomosBirthRecordGate !== undefined ? { nomosBirthRecordGate } : {}),
-        ...(nomosParentAttestedBirth !== undefined ? { nomosParentAttestedBirth } : {}),
-        ...(nomosVerifiedFirstEnroll !== undefined ? { nomosVerifiedFirstEnroll } : {}),
-        ...(eraCertGate !== undefined ? { nomosEraCertGate: eraCertGate } : {}),
-        ...(nomosForeignRefs !== undefined ? { nomosForeignRefs } : {}),
-        ...(nomosValueObjects !== undefined ? { nomosValueObjects } : {}),
-        ...(nomosContracts !== undefined ? { nomosContracts } : {}),
-        ...(Object.keys(visAggregates).length > 0
-          ? { nomosReadVisibility: { v: 1 as const, aggregates: visAggregates } }
-          : {}),
-        ...(Object.keys(encAggregates).length > 0
-          ? { nomosEncryption: { v: 1 as const, aggregates: encAggregates } }
-          : {}),
-        ...(Object.keys(attrAggregates).length > 0
-          ? { nomosAttributedGate: { v: 1 as const, aggregates: attrAggregates } }
-          : {}),
-        ...(nomosCapabilities.length > 0
-          ? { nomosCapabilities: { v: 1 as const, capabilities: nomosCapabilities } }
-          : {}),
-        ...(flowDeclassify.length > 0 || flowEndorse.length > 0
-          ? {
-              nomosFlowGate: {
-                v: 1 as const,
-                ...(flowDeclassify.length > 0 ? { declassify: flowDeclassify } : {}),
-                ...(flowEndorse.length > 0 ? { endorse: flowEndorse } : {}),
-              },
-            }
-          : {}),
-      };
-    })
-    .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
-  // COMPILE-TIME COMPOSITION + fail-closed GUARD for SHARED (global) relation types across the
-  // package's per-domain layers: UNION every domain's relations on a shared bare-id type (so nothing
-  // is silently dropped) and REFUSE on a divergent shared rewrite (the scalpel). Non-shared /
-  // auto-qualified types are untouched → a package with no shared global type is byte-identical.
-  // THE READ-PROJECTION DIVERGENCE GUARD (the scalpel, extended to the read layer): for keys that
-  // remain SHARED across this package's domains (GLOBAL framework aggregates / same-named declared
-  // reads), identical declarations dedupe at the kernel accumulator; a DIVERGENT shared key would
-  // wedge the workspace at serve time — refuse it AT COMPILE instead, naming the key and each
-  // domain's shape. Validation only (never transforms), so a conflict-free package is untouched.
-  guardSharedReadProjectionKeys(out);
-  return { layers: composeSharedRelationTypes(out) };
-}
-
-/** Two aggregate prims at the same path are identical iff same type + same schema. */
-function aggregateEqual(
-  a: Extract<UsdPrim, { kind: "aggregate" }>,
-  b: Extract<UsdPrim, { kind: "aggregate" }>,
-): boolean {
-  return a.type === b.type && canonicalJson(a.schema) === canonicalJson(b.schema);
-}
-
-/**
- * Merge a stronger `over` prim onto a `base` prim at the SAME path, per the #137
- * typed rules — reusing `compose.ts`'s `mergeRequiresScope` for directive prims
- * (requires add/narrow-not-remove; scope narrow-not-widen; widen/remove need
- * `authority`). An uncertified artifact would always be refused — but `artifactRef`
- * is unset here (stage 2), so there is nothing to refuse yet.
- *
- * Mixing prim KINDS at one path, or redefining an aggregate's schema across layers,
- * is not a typed monotonic move — it is a structural conflict, surfaced fail-closed.
- */
-function mergeUsdPrim(base: UsdPrim, over: UsdPrim, opts: ComposeOptions): UsdPrim {
-  if (base.kind !== over.kind) {
-    throw new Error(
-      `USD composition conflict at ${over.path}: cannot merge a ${base.kind} prim ` +
-        `with a ${over.kind} prim.`,
-    );
-  }
-
-  if (base.kind === "aggregate" && over.kind === "aggregate") {
-    // Aggregates are single-source schemas: an identical re-declaration is a no-op
-    // pass-through; a divergent one is a structural conflict (not a monotonic move).
-    if (!aggregateEqual(base, over)) {
-      throw new Error(
-        `USD composition conflict at ${over.path}: aggregate schema redefined ` +
-          `across layers.`,
-      );
-    }
-    return over;
-  }
-
-  // Both directive prims — apply the shared typed requires+scope rule core (#137).
-  if (base.kind === "directive" && over.kind === "directive") {
-    if (base.target !== over.target) {
-      throw new Error(
-        `USD composition conflict at ${over.path}: directive target changed from ` +
-          `"${base.target}" to "${over.target}".`,
-      );
-    }
-    if (base.marker !== over.marker) {
-      throw new Error(
-        `USD composition conflict at ${over.path}: directive marker changed from ` +
-          `"${base.marker}" to "${over.marker}".`,
-      );
-    }
-    if (
-      base.payloadJsonSchema !== undefined &&
-      over.payloadJsonSchema !== undefined &&
-      canonicalJson(base.payloadJsonSchema) !== canonicalJson(over.payloadJsonSchema)
-    ) {
-      throw new Error(
-        `USD composition conflict at ${over.path}: directive payload schema changed.`,
-      );
-    }
-    const merged = mergeRequiresScope(over.path, base, over, opts);
-    const out: Extract<UsdPrim, { kind: "directive" }> = {
-      kind: "directive",
-      path: over.path,
-      target: over.target,
-      marker: over.marker,
-      requires: merged.requires,
-      ...(over.payloadJsonSchema !== undefined
-        ? { payloadJsonSchema: over.payloadJsonSchema }
-        : base.payloadJsonSchema !== undefined
-          ? { payloadJsonSchema: base.payloadJsonSchema }
-          : {}),
-      ...(merged.scope !== undefined ? { scope: merged.scope } : {}),
-      // Preserve the declared law boundary across a monotonic merge (omit-when-empty):
-      // the stronger layer's declaration wins when present, else the base's carries
-      // through; a boundary-free pair stays byte-identical to before this field existed.
-      ...(over.reads !== undefined
-        ? { reads: over.reads }
-        : base.reads !== undefined
-          ? { reads: base.reads }
-          : {}),
-      ...(over.emits !== undefined
-        ? { emits: over.emits }
-        : base.emits !== undefined
-          ? { emits: base.emits }
-          : {}),
-      // artifactRef stays unset (a later certified-artifact slice).
-    };
-    return out;
-  }
-
-  // Unreachable (kinds proven equal above) — exhaustiveness guard.
-  throw new Error(`USD composition: unhandled prim kind at ${over.path}.`);
-}
-
-/** Canonicalize a standalone prim — sort a directive's `requires`. */
-function canonicalizeStandalone(prim: UsdPrim): UsdPrim {
-  if (prim.kind === "directive") {
-    return { ...prim, requires: [...prim.requires].sort() };
-  }
-  return prim;
-}
-
-/**
- * Fold a stream of prims (already in weak→strong order) into an effective prim map
- * keyed by path: a path's first contributor passes through (canonicalized); each
- * later (stronger) contributor MERGES per the #137 typed rules (fail-closed
- * `CompositionViolation` on any rule it cannot satisfy).
- */
-function foldPrims(
-  acc: Map<string, UsdPrim>,
-  prims: Iterable<UsdPrim>,
-  opts: ComposeOptions,
-): void {
-  for (const prim of prims) {
-    const existing = acc.get(prim.path);
-    if (existing === undefined) {
-      acc.set(prim.path, canonicalizeStandalone(prim));
-    } else {
-      acc.set(prim.path, mergeUsdPrim(existing, prim, opts));
-    }
-  }
-}
-
-/**
- * Resolve ONE layer's EFFECTIVE prims (the REFERENCE arc, LIVRPS: References below
- * Local). Each referenced layer's effective prims are composed FIRST (weaker base),
- * in declared `references[]` order, then THIS layer's own LOCAL prims fold OVER them
- * (stronger) via the same typed `mergeUsdPrim`. Resolution is deterministic and
- * DETECTS CYCLES (A→B→A) via the `stack` of layer paths currently being resolved,
- * failing closed with a `CompositionViolation`. `byPath` indexes the document's
- * layers; a reference to an unknown layer path also fails closed.
- *
- * VARIANTS (LIVRPS: Variants sit ABOVE References, BELOW Local) resolve AFTER the
- * reference fold and BEFORE the local fold: the SELECTED variant of each declared set
- * (or its `"*"` default, else nothing) folds OVER the referenced base (variants are
- * stronger than references) and UNDER the local prims (local is the strongest), all
- * through the same monotonic `mergeUsdPrim`. The selection is `opts.variantSelection`,
- * an explicit flatten input — so the composed identity reflects it. A selection naming
- * an unknown set or variant fails closed (`variant-unresolved`).
- */
-function resolveLayerEffective(
-  layer: UsdLayer,
-  byPath: Map<string, UsdLayer>,
-  opts: ComposeOptions,
-  stack: string[],
-): UsdPrim[] {
-  if (stack.includes(layer.path)) {
-    throw new CompositionViolation(
-      "reference-cycle",
-      layer.path,
-      `reference cycle detected: ${[...stack, layer.path].join(" -> ")}`,
-    );
-  }
-
-  const acc = new Map<string, UsdPrim>();
-
-  // References first (weaker), in declared order — each resolved recursively so
-  // transitive references compose and cycles are caught at any depth.
-  if (layer.references !== undefined) {
-    const nextStack = [...stack, layer.path];
-    for (const refPath of layer.references) {
-      const refLayer = byPath.get(refPath);
-      if (refLayer === undefined) {
-        throw new CompositionViolation(
-          "reference-unresolved",
-          layer.path,
-          `references unknown layer path "${refPath}"`,
-        );
-      }
-      foldPrims(acc, resolveLayerEffective(refLayer, byPath, opts, nextStack), opts);
-    }
-  }
-
-  // Variants fold OVER references, UNDER local (LIVRPS variant strength). The selected
-  // variant of each declared set — or its `"*"` default — contributes its prims; an
-  // unselected, default-less set contributes nothing. A selection for an unknown set or
-  // an unknown variant fails closed.
-  foldPrims(acc, selectedVariantPrims(layer, opts), opts);
-
-  // Local prims fold OVER the referenced + variant base (strongest opinion wins).
-  foldPrims(acc, layer.prims, opts);
-
-  return [...acc.keys()].sort().map((path) => acc.get(path)!);
-}
-
-/**
- * The prims contributed by THIS layer's variant sets under the active selection
- * (`opts.variantSelection`). For each declared set, in canonical (sorted) set-name
- * order: if the selection names a variant, that variant's prims are used (unknown set
- * or unknown variant → `variant-unresolved`, fail-closed); otherwise the set's `"*"`
- * DEFAULT variant is used when declared, else the set contributes nothing. The
- * selection is also validated against the layer's declared sets so a selection naming
- * a set this layer does not declare fails closed too.
- *
- * Returns the contributed prims in canonical order (set-name, then prim-path) so the
- * fold input is deterministic — the fold itself is order-stable for non-overlapping
- * paths, and any overlap within the variant arc is resolved by the same monotonic rule.
- */
-function selectedVariantPrims(layer: UsdLayer, opts: ComposeOptions): UsdPrim[] {
-  const sets = layer.variantSets;
-  const selection = opts.variantSelection ?? {};
-
-  if (sets === undefined) return [];
-
-  const out: UsdPrim[] = [];
-  for (const setName of Object.keys(sets).sort()) {
-    const variants = sets[setName]!;
-    const chosen = selection[setName];
-    let variantPrims: UsdPrim[] | undefined;
-    if (chosen !== undefined) {
-      // A selection naming a variant THIS layer's set does not hold fails closed — an
-      // explicit choice that cannot bind to a declared alternative is never silently
-      // dropped to the default / nothing.
-      variantPrims = variants[chosen];
-      if (variantPrims === undefined) {
-        throw new CompositionViolation(
-          "variant-unresolved",
-          layer.path,
-          `variant set "${setName}" has no variant named "${chosen}"`,
-        );
-      }
-    } else {
-      // No explicit choice: the declared default variant, else nothing.
-      variantPrims = variants[DEFAULT_VARIANT];
-    }
-    if (variantPrims !== undefined) {
-      for (const prim of sortPrims(variantPrims)) out.push(prim);
-    }
-  }
-  return out;
-}
-
-/**
- * Validate the WHOLE selection against the document: each selected set name MUST be
- * declared by at least ONE layer. A selection naming a set NO layer declares fails
- * closed (`variant-unresolved`) — an explicit choice that can never bind is never a
- * silent no-op. (The per-variant check — an unknown variant WITHIN a declared set —
- * is enforced per-layer in `selectedVariantPrims`, where the set is in scope.) This is
- * document-scoped because the selection is a single global input to the flatten, while
- * a given set may be declared on only some of the document's layers.
- */
-function assertSelectionResolvable(doc: UsdDocument, opts: ComposeOptions): void {
-  const selection = opts.variantSelection;
-  if (selection === undefined) return;
-  const declared = new Set<string>();
-  for (const layer of doc.layers) {
-    if (layer.variantSets !== undefined) {
-      for (const setName of Object.keys(layer.variantSets)) declared.add(setName);
-    }
-  }
-  for (const setName of Object.keys(selection)) {
-    if (!declared.has(setName)) {
-      throw new CompositionViolation(
-        "variant-unresolved",
-        setName,
-        `selection names variant set "${setName}" not declared by any layer`,
-      );
-    }
-  }
-}
-
-/**
- * Fold the document's layers IN ORDER into the effective flattened prim set.
- *
- * Per layer, the REFERENCE arc resolves FIRST (weakest), then the VARIANT arc (the
- * selected variant of each declared set per `opts.variantSelection`, stronger than
- * references, weaker than local), then this layer's LOCAL prims (strongest) fold OVER
- * both (LIVRPS), producing the layer's effective prim set; resolution is deterministic
- * and fails closed on cycles / unknown reference paths / unresolved variant selections.
- * Then the existing SUBLAYER fold composes those per-layer
- * effective prim sets in `layers[]` (strength) order, unchanged: a prim present in
- * only one layer passes through; a prim a later layer contributes at a path an earlier
- * layer already defined is MERGED per the #137 typed rules (fail-closed
- * `CompositionViolation`). Returns the prim set SORTED by path.
- */
-export function flattenUsd(
-  doc: UsdDocument,
-  opts: ComposeOptions = {},
-): UsdPrim[] {
-  // Fail closed on a selection naming a set NO layer declares (document-scoped — the
-  // selection is a single global input; a set may live on only some layers).
-  assertSelectionResolvable(doc, opts);
-
-  const byPath = new Map<string, UsdLayer>();
-  for (const layer of doc.layers) byPath.set(layer.path, layer);
-
-  const acc = new Map<string, UsdPrim>();
-
-  for (const layer of doc.layers) {
-    const effective = resolveLayerEffective(layer, byPath, opts, []);
-    foldPrims(acc, effective, opts);
-  }
-
-  return [...acc.keys()]
-    .sort()
-    .map((path) => acc.get(path)!);
-}
-
-/**
- * The composed-IR identity: sha256 hex of `canonicalJson(flattenUsd(doc, opts))`.
- * Extends #136 (the manifest hash) to a flattened MULTI-LAYER stage, reusing the
- * same byte-stable canonicalizer.
- */
-export function usdHash(doc: UsdDocument, opts: ComposeOptions = {}): string {
-  return createHash("sha256")
-    .update(canonicalJson(flattenUsd(doc, opts)), "utf8")
-    .digest("hex");
-}