@githolon/dsl 0.102.5 → 0.103.1

package/src/compile_package_main.ts

@@ -6,13 +6,13 @@
 // If a file isn't this / hosting this / authoring for this / proving this — it's gone.
 
 /**
- * `nomos-compile` — ONE COMMAND: TS DSL domains → a deployable `.package.usda` (#M4).
+ * `nomos-compile` — ONE COMMAND: TS DSL domains → a canonical typed USDA closure.
  *
  * Run from a package that depends on `@githolon/dsl` (esbuild + tsx ride along as its
- * dependencies — no devDependency setup), next to a `nomos.package.mjs` config:
+ * dependencies — no devDependency setup), next to a typed `nomos.project.ts` authoring file:
  *
  *     export default {
- *       name: "guestbook",                       // → build/guestbook.package.usda
+ *       name: "guestbook",                       // → build/guestbook.law.usdz + readable USDA
  *       domains: [
  *         { key: "guestbook", modules: ["./domains/guestbook.ts"] },
  *       ],
@@ -28,12 +28,8 @@
  * Reports: `{ reports: { my_report_v1: "./report/my_report.ts#myReportV1" } }`.
  *
  * It emits into `outDir` (default `<config dir>/build`):
- *   * `<name>.package.usda`            — the deployable package (engine bundle + USD IR);
- *     its sha256 IS the deploy `domainHash` (`policy:{hash}`).
- *   * `<name>.deploy.json`             — `{packageUsda}`: the EXACT body
- *     `POST /v2/workspaces/:ws/domains` accepts as `application/json` on Nomos Cloud.
- *     Admission/projection manifests are embedded in the package USDA and are not host
- *     sidecars.
+ *   * `<name>.law/`                     — the exact logically named, human-readable USDA stage.
+ *   * `<name>.law.usdz`                — a lossless transport archive of that closure.
  *   * `<name>.proof.mts`               — the GENERATED PROOF (codegen_proof.ts): a
  *     runnable, domain-shaped live e2e synthesized from the law's own directives /
  *     queries / counts. Run it with `githolon proof`. Never fatal: an unsampleable
@@ -46,11 +42,13 @@
  * `globalThis.plan`.
  */
 import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { expandCapabilityExports, isCapabilityDecl } from "./capability_exports.js";
 import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import ts from "typescript";
 
 import type { AggregateHandle } from "./aggregate.js";
 import {
@@ -97,10 +95,8 @@ import type { CombinedDecl } from "./combined.js";
 import type { ImpureCapabilityDecl } from "./codegen_provider_dart.js";
 import {
   aggregatesOf,
-  buildIdentity,
   composeDomainModule,
   directivesOf,
-  emitUsdJsonForModules,
   sha256HexUtf8,
   type Mod,
 } from "./build_package.js";
@@ -134,36 +130,30 @@ import {
   mergeRelationTypeDeclarations,
   type RelationTypeDecl,
 } from "./relation_schema.js";
-import {
-  emitLayeredDomain,
-  flattenLayeredUsd,
-  layeredRootUsda,
-  nativePlanPackageUsda,
-  parseUsdaDocument,
-  usdaLayerText,
-  type LayeredModuleInput,
-  type UsdPlanAsset,
-  type UsdPlanRoute,
-} from "./usd_layers.js";
-import { domainManifest, canonicalJson } from "./manifest.js";
+import { canonicalJson } from "./canonical_json.js";
+import { stableIdsForModule } from "./stable_ids_for_module.js";
 import type { WireSchema } from "./wire.js";
+import { encodeKernelSchema } from "./wire_encode.js";
 import {
   deriveStableIdContinuity,
   type InferredRename,
   type StableIds,
 } from "./stable_ids.js";
 import {
+  identityRegistryFromStableIdLockfile,
   parseStableIdLockfile,
   serializeStableIdLockfile,
   type StableIdLockfile,
 } from "./stable_id_lockfile.js";
-import { emitUsd, type UsdLayer } from "./usd.js";
-import { emitLayeredRelationUsda, type RelationLayerInput } from "./relation_composition.js";
+import { reconcileStableIdsWithIdentity } from "./stable_id_identity_bridge.js";
+import { discoverLawGraph, type LawGraph } from "./law_graph.js";
+import { emitFrameworkLawUsda, emitSparseLawGraphUsda } from "./law_graph_usda.js";
 import { assertNoDartBarrelCollisions, type BarrelExportedFile } from "./dart_barrel_guard.js";
 import { generateTsClient, tsApplicationName, tsClientFactoryName, recursiveLazyTypes } from "./codegen_ts.js";
 import { generateOpenApiFragment, mergeOpenApiFragments } from "./codegen_openapi.js";
 import { domainInterface, type DomainInterface } from "./shape_compat.js";
 import { generateTsProof, proofLegsIndex } from "./codegen_proof.js";
+import { usdzPack } from "./usdz.js";
 import { checkDomainModules, formatFindings, hasRefusal } from "./law_check.js";
 import type { NomosCompat } from "./compat_manifest.js";
 import { requiredKernelFeatures, type FeatureProbeModule } from "./kernel_capabilities.js";
@@ -176,10 +166,55 @@ import {
   packageAssetUsda,
   type PackageRootPart,
 } from "./application_composition.js";
+import {
+  packageContractUsda,
+  type RuntimePackageDependency,
+} from "./package_dependencies.js";
+import {
+  validateNomosPackageConfig,
+  type NomosPackageConfig,
+  type NomosPackageDomainConfig,
+} from "./package_config.js";
+import { assertUsdaRelationshipIntegrity } from "./usda_relationship_integrity.js";
+import { assertPublicPackageImports } from "./package_source_imports.js";
+import { packageDependencyUsageFindings } from "./package_dependency_usage.js";
+import {
+  PlanSourceSliceProgram,
+  type PlanSourceSliceTarget,
+} from "./plan_source_slice.js";
 
 const DSL_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 
-interface DomainConfig {
+/**
+ * Compiler-owned declarations injected by business-birth lowering. They are ordinary typed law, but
+ * have no tenant export from which plan provenance could be rediscovered. Keep that provenance explicit
+ * here so a generated offer can never silently fall back to initializing the whole tenant domain.
+ */
+const BUSINESS_BIRTH_FRAMEWORK_PLAN_SOURCES: Readonly<Record<string, PlanSourceSliceTarget>> = {
+  enrollSigner: {
+    modulePath: path.join(DSL_DIR, "src", "framework", "signing_identity.ts"),
+    exportName: "enrollSigner",
+  },
+  seedAuthProvider: {
+    modulePath: path.join(DSL_DIR, "src", "framework", "auth_provider_law.ts"),
+    exportName: "seedAuthProvider",
+  },
+  seedBirthAttestation: {
+    modulePath: path.join(DSL_DIR, "src", "framework", "home.ts"),
+    exportName: "seedBirthAttestation",
+  },
+  seedGenesis: {
+    modulePath: path.join(DSL_DIR, "src", "framework", "genesis.ts"),
+    exportName: "seedGenesis",
+  },
+  nomosBirthRecordEnsure: {
+    modulePath: path.join(DSL_DIR, "src", "birth_meter_ensure.ts"),
+    exportName: "nomosBirthRecordEnsure",
+  },
+};
+const BUSINESS_BIRTH_FRAMEWORK_PLAN_DOMAIN = "__nomos_birth_genesis_plan_v1";
+
+interface DomainConfig extends NomosPackageDomainConfig {
   readonly key: string;
   readonly name?: string;
   readonly modules: readonly string[];
@@ -223,8 +258,7 @@ interface DomainConfig {
 
 type DartSupportImport = "vendored" | "package";
 
-interface PackageConfig {
-  readonly name: string;
+interface PackageConfig extends NomosPackageConfig {
   readonly domains: readonly DomainConfig[];
   /** The one OpenUSD model root this independently published package exports. */
   readonly rootPart?: PackageRootPart;
@@ -323,6 +357,229 @@ function fail(msg: string): never {
   process.exit(1);
 }
 
+interface EmittedLawClosureAsset {
+  readonly logicalPath: string;
+  readonly sha256: string;
+  readonly utf8: string;
+}
+
+interface UsdPlanAsset {
+  readonly sha256: string;
+  readonly javascript: string;
+  readonly runtimeSha256: string;
+  /** Optional compiler diagnostic only; never enters package identity or custody. */
+  readonly profile?: readonly { readonly module: string; readonly bytesInOutput: number }[];
+  /** Hypothetical bytes after moving public runtime modules into one package-shared asset. */
+  readonly sharedRuntimeProfileBytes?: number;
+  /** Diagnostic-only executable paired with the shared runtime boot probe; never enters custody. */
+  readonly sharedRuntimeProfileJavascript?: string;
+}
+
+interface UsdRuntimeAsset {
+  readonly sha256: string;
+  readonly javascript: string;
+}
+
+interface UsdPlanRoute {
+  readonly selector: string;
+  readonly planSha256: string;
+}
+
+interface EmittedLawClosure {
+  readonly rootLogicalPath: "root.usda";
+  readonly identity: string;
+  readonly assets: readonly {
+    readonly logicalPath: string;
+    readonly sha256: string;
+    readonly bytes: Uint8Array;
+  }[];
+}
+
+/** Build the production-shaped v3 stage entirely from compiler-authored bytes. The deploy host may
+ * shuttle this object, but it cannot select layers, compose opinions or mint any identity: the kernel
+ * inventories the USDZ/Git tree and re-hashes every logically named layer. */
+function emitLawClosure(
+  packageName: string,
+  exportedDomains: readonly string[],
+  runtimeDependencies: readonly RuntimePackageDependency[],
+  domainAssets: readonly EmittedLawClosureAsset[],
+  runtime: UsdRuntimeAsset,
+  plans: readonly UsdPlanAsset[],
+  routes: readonly UsdPlanRoute[],
+): EmittedLawClosure {
+  const planByHash = new Map(plans.map((plan) => [plan.sha256, plan] as const));
+  if (sha256HexUtf8(runtime.javascript) !== runtime.sha256) {
+    fail(`v3 closure: runtime source bytes do not match declared digest '${runtime.sha256}'`);
+  }
+  for (const plan of plans) {
+    if (sha256HexUtf8(plan.javascript) !== plan.sha256) {
+      fail(`v3 closure: plan source bytes do not match declared digest '${plan.sha256}'`);
+    }
+  }
+  const contentAsset = (sha256: string): string => `@nomos+sha256:${sha256}@`;
+  const routeOpinions: string[] = [
+    "#usda 1.0",
+    "(",
+    "    customLayerData = {",
+    '        string "nomos:format" = "nomos.law-layer.v3"',
+    '        string "nomos:logicalPath" = "runtime/routes"',
+    "    }",
+    ")",
+    "",
+    'def Scope "__NomosRuntime_7e9c"',
+    "{",
+    '    custom string nomos:kind = "runtime"',
+    '    custom string nomos:format = "nomos.openusd-plan-metadata.v3"',
+    "",
+    '    def Scope "Routes"',
+    "    {",
+  ];
+  [...routes]
+    .sort((left, right) => left.selector.localeCompare(right.selector))
+    .forEach((route, index) => {
+      if (!planByHash.has(route.planSha256)) {
+        fail(`v3 closure: route '${route.selector}' names missing plan '${route.planSha256}'`);
+      }
+      routeOpinions.push(
+        `        def Scope "r${String(index).padStart(6, "0")}"`,
+        "        {",
+        `            custom string nomos:selector = ${JSON.stringify(route.selector)}`,
+        `            custom string nomos:plan = "${route.planSha256}"`,
+        "        }",
+        "",
+      );
+    });
+  if (routeOpinions[routeOpinions.length - 1] === "") routeOpinions.pop();
+  routeOpinions.push("    }", "}", "");
+
+  const textAsset = (logicalPath: string, utf8: string): EmittedLawClosureAsset => ({
+    logicalPath,
+    sha256: sha256HexUtf8(utf8),
+    utf8,
+  });
+  const framework = textAsset("framework.usda", emitFrameworkLawUsda());
+  const packageContract = textAsset("package.usda", packageContractUsda({
+    packageName,
+    exportedDomains,
+    runtimeDependencies,
+  }));
+  const routeLayer = textAsset("runtime/routes.usda", routeOpinions.join("\n"));
+  const runtimeSource = textAsset(`runtime/bases/${runtime.sha256}.mjs`, runtime.javascript);
+  const runtimeLayer = textAsset(`runtime/bases/${runtime.sha256}.usda`, [
+    "#usda 1.0",
+    "(",
+    "    customLayerData = {",
+    '        string "nomos:format" = "nomos.law-layer.v3"',
+    `        string "nomos:logicalPath" = "runtime/bases/${runtime.sha256}"`,
+    "    }",
+    ")",
+    "",
+    'def Scope "__NomosRuntime_7e9c"',
+    "{",
+    '    def Scope "Bases"',
+    "    {",
+    `        def Scope "b_${runtime.sha256}"`,
+    "        {",
+    `            custom string nomos:sha256 = "${runtime.sha256}"`,
+    '            custom string nomos:language = "javascript"',
+    `            custom asset nomos:source = ${contentAsset(runtime.sha256)}`,
+    "        }",
+    "    }",
+    "}",
+    "",
+  ].join("\n"));
+  const sortedPlans = [...plans]
+    .sort((left, right) => left.sha256.localeCompare(right.sha256));
+  const planSources = sortedPlans.map((plan) =>
+    textAsset(`runtime/plans/${plan.sha256}.mjs`, plan.javascript));
+  const planLayers = sortedPlans.map((plan) => textAsset(`runtime/plans/${plan.sha256}.usda`, [
+    "#usda 1.0",
+    "(",
+    "    customLayerData = {",
+    '        string "nomos:format" = "nomos.law-layer.v3"',
+    `        string "nomos:logicalPath" = "runtime/plans/${plan.sha256}"`,
+    "    }",
+    ")",
+    "",
+    'def Scope "__NomosRuntime_7e9c"',
+    "{",
+    '    def Scope "Plans"',
+    "    {",
+    `        def Scope "p_${plan.sha256}"`,
+    "        {",
+    `            custom string nomos:sha256 = "${plan.sha256}"`,
+    '            custom string nomos:language = "javascript"',
+    `            custom rel nomos:runtime = </__NomosRuntime_7e9c/Bases/b_${plan.runtimeSha256}>`,
+    `            custom asset nomos:source = ${contentAsset(plan.sha256)}`,
+    "        }",
+    "    }",
+    "}",
+    "",
+  ].join("\n")));
+  const sublayers = [packageContract, routeLayer, runtimeLayer, ...planLayers, ...domainAssets, framework];
+  // `usdcat` permits relationships to absent prims because that is valid general OpenUSD. Nomos law
+  // does not: internal typed references must resolve in the authenticated stage. Check the declarative
+  // layers before hashing or publishing them. Executable MJS is an authenticated asset rather than
+  // USDA syntax, so it is inventoried below but deliberately never parsed as a sublayer.
+  assertUsdaRelationshipIntegrity([packageContract, runtimeLayer, ...planLayers, ...domainAssets, framework]);
+  const custodyAssets = [...sublayers, runtimeSource, ...planSources]
+    .sort((left, right) => left.logicalPath.localeCompare(right.logicalPath));
+  const root = textAsset("root.usda", [
+    "#usda 1.0",
+    "(",
+    '    defaultPrim = "Nomos"',
+    "    customLayerData = {",
+    '        string "nomos:closureMode" = "content-addressed"',
+    '        string "nomos:format" = "nomos.law-stage.v3"',
+    "    }",
+    "    subLayers = [",
+    ...sublayers.map((asset, index) =>
+      `        @${asset.logicalPath}@${index + 1 === sublayers.length ? "" : ","}`),
+    "    ]",
+    ")",
+    "",
+    'def NomosLawClosure "__NomosClosure_7e9c"',
+    "{",
+    '    custom string nomos:rootLogicalPath = "root.usda"',
+    '    def Scope "Assets"',
+    "    {",
+    ...custodyAssets.flatMap((asset) => {
+      const primName = `a_${sha256HexUtf8(asset.logicalPath)}`;
+      return [
+        `        def NomosLawAsset "${primName}"`,
+        "        {",
+        `            custom string nomos:logicalPath = ${JSON.stringify(asset.logicalPath)}`,
+        `            custom string nomos:sha256 = "${asset.sha256}"`,
+        "        }",
+      ];
+    }),
+    "    }",
+    "}",
+    "",
+  ].join("\n"));
+  const assets = [root, ...custodyAssets]
+    .sort((left, right) => left.logicalPath.localeCompare(right.logicalPath));
+  const identity = createHash("sha256");
+  identity.update("nomos-law-stage-v3\0");
+  identity.update(root.logicalPath);
+  identity.update("\0");
+  for (const asset of assets) {
+    identity.update(asset.logicalPath);
+    identity.update("\0");
+    identity.update(asset.sha256);
+    identity.update("\0");
+  }
+  return {
+    rootLogicalPath: "root.usda",
+    identity: identity.digest("hex"),
+    assets: assets.map(({ logicalPath, sha256, utf8 }) => ({
+      logicalPath,
+      sha256,
+      bytes: new TextEncoder().encode(utf8),
+    })),
+  };
+}
+
 /** Locate stock OpenUSD's usdcat without making it a runtime dependency. */
 function resolveUsdcat(): string | undefined {
   const candidates = [process.env.NOMOS_USDCAT, "/usr/bin/usdcat", "usdcat"]
@@ -551,6 +808,12 @@ const DART_SUPPORT_CORE_SRC = [
   "foreign_ref.dart",
   "activity.dart",
   "nomos_ref.dart",
+  // Immutable publication pin + stable series and the required freshness sum
+  // type. Pure data; the generated application owns the effectful check.
+  "versioned_nomos_ref.dart",
+  // Optional first-class references are explicit required choices in generated
+  // action inputs: absent or present, never an accidentally omitted argument.
+  "optional_ref.dart",
   // Branded identity wrappers (NomosPrincipal/NomosDeviceSecret) — the generated cross-workspace birth
   // methods type `actor`/`authorSecret` as these (not bare strings), so both must vendor. Pure data.
   "principal.dart",
@@ -1037,7 +1300,7 @@ function emitDart(
           `import '${VENDORED_TYPES_SHIM}'`,
         )
         .replace(
-          /import 'package:nomos_types\/src\/(?:nomos_ref|foreign_ref)\.dart'/g,
+          /import 'package:nomos_types\/src\/(?:nomos_ref|foreign_ref|versioned_nomos_ref)\.dart'/g,
           `import '${VENDORED_TYPES_SHIM}'`,
         );
       writeFileSync(path.join(genDir, "src", f), src, "utf8");
@@ -1247,6 +1510,9 @@ function emitDart(
   } catch (e) {
     fail((e as Error).message);
   }
+  const sha256DigestExport = [...sourceByFile.values()].some((source) => source.includes("Sha256Digest"))
+    ? ", Sha256Digest"
+    : "";
   const barrelLines = [
     "// GENERATED by nomos-compile — the package's public entrypoint. DO NOT EDIT.",
     "// Regenerated on every compile; generated implementation lives under src/generated/.",
@@ -1270,8 +1536,8 @@ function emitDart(
     // The generated clients import their runtime support directly. Keeping it out of the public barrel is
     // the surface firewall: a tenant import receives business types and application APIs, never raw runtime.
     supportImport === "vendored"
-      ? `export '${genRel}/src/${VENDORED_TYPES_SHIM}' show NomosRef;`
-      : `export 'package:nomos_types/nomos_types.dart' show NomosRef;`,
+      ? `export '${genRel}/src/${VENDORED_TYPES_SHIM}' show NomosRef, NomosOptionalRef, VersionedNomosRef, ReferenceFreshness, ReferenceCurrent, ReferenceStale, ReferenceFreshnessUnavailable${sha256DigestExport};`
+      : `export 'package:nomos_types/nomos_types.dart' show NomosRef, NomosOptionalRef, VersionedNomosRef, ReferenceFreshness, ReferenceCurrent, ReferenceStale, ReferenceFreshnessUnavailable${sha256DigestExport};`,
     ...(contractsImportUri !== undefined
       ? tenantDartExport(`${genRel}/${CONTRACTS_FILE}.dart`, sourceByFile.get(CONTRACTS_FILE) ?? "")
       : []),
@@ -1310,6 +1576,9 @@ const dartTypesImportFor = (generatedSource: string): string => {
     ...(generatedSource.includes("NmsInternalNomosRefs.")
       ? [`import 'package:nomos_types/src/nomos_ref.dart' show NmsInternalNomosRefs;`]
       : []),
+    ...(generatedSource.includes("NmsInternalVersionedNomosRefs.")
+      ? [`import 'package:nomos_types/src/versioned_nomos_ref.dart' show NmsInternalVersionedNomosRefs;`]
+      : []),
     ...(generatedSource.includes("NmsInternalForeignRefs.")
       ? [`import 'package:nomos_types/src/foreign_ref.dart' show NmsInternalForeignRefs;`]
       : []),
@@ -1334,8 +1603,8 @@ const NOMOS_TYPES_DEP = "^0.8.0";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.64.1";
-const NOMOS_FLUTTER_DEP = "^0.63.1";
+const NOMOS_CLIENT_DEP = "^0.64.3";
+const NOMOS_FLUTTER_DEP = "^0.63.4";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).
@@ -1767,6 +2036,34 @@ function reconcilePubspec(
   return true;
 }
 
+/** Replace only the compiler-owned embedded-law asset in an existing generated test package.
+ * Tenant assets remain untouched; retired `.deploy.json` and prior `.law.usdz` entries under the
+ * generated directory cannot survive a USDA-native regeneration. */
+function reconcileGeneratedLawAsset(pkgDir: string, generatedAsset: string): boolean {
+  const p = path.join(pkgDir, "pubspec.yaml");
+  if (!existsSync(p)) return false;
+  const source = readFileSync(p, "utf8");
+  const lines = source.split(/\r?\n/);
+  const compilerAsset = /^\s+-\s+lib\/src\/generated\/[^\s]+\.(?:deploy\.json|law\.usdz)\s*$/;
+  const replacement = `    - ${generatedAsset}`;
+  let replaced = false;
+  const nextLines = lines.filter((line) => {
+    if (!compilerAsset.test(line)) return true;
+    if (replaced) return false;
+    replaced = true;
+    return false;
+  });
+  if (replaced) {
+    const assetHeader = nextLines.findIndex((line) => /^\s{2}assets:\s*$/.test(line));
+    if (assetHeader < 0) return false;
+    nextLines.splice(assetHeader + 1, 0, replacement);
+  }
+  const next = nextLines.join("\n");
+  if (next === source) return false;
+  writeFileSync(p, next, "utf8");
+  return true;
+}
+
 /**
  * THE LAYERED-PACKAGES EMIT (`dart.packages`) — three sibling pub packages under `dartOut`:
  * `<types>/` (pure data, depends only on `nomos_types`), `<client>/` (effectful runtime clients,
@@ -1787,7 +2084,7 @@ function emitDartPackages(
   names: Readonly<Record<string, string>> | undefined,
   compat?: NomosCompat,
   describePackageName = packages.client,
-  deployJsonPath?: string,
+  lawUsdzPath?: string,
 ): { written: string[]; cursed: string[] } {
   for (const [role, name] of Object.entries(packages)) {
     if (typeof name !== "string" || !isPubPackageName(name)) {
@@ -1842,6 +2139,7 @@ function emitDartPackages(
         !m[1]!.startsWith("dart:") &&
         m[1] !== "package:nomos_types/nomos_types.dart" &&
         m[1] !== "package:nomos_types/src/nomos_ref.dart" &&
+        m[1] !== "package:nomos_types/src/versioned_nomos_ref.dart" &&
         m[1] !== "package:nomos_types/src/foreign_ref.dart" &&
         m[1] !== "package:nomos_types/src/invitation.dart" &&
         m[1] !== `${FRAMEWORK_FILE}.dart` &&
@@ -1972,11 +2270,14 @@ function emitDartPackages(
   );
   const businessSharedFile = "business_shared.dart";
   const businessSharedPath = path.join(typesGen, businessSharedFile);
+  const sha256DigestExport = [...typesSources.values()].some((source) => source.includes("Sha256Digest"))
+    ? ", Sha256Digest"
+    : "";
   writeFileSync(
     businessSharedPath,
     [
       "// GENERATED by nomos-compile — shared business values and activity; no runtime machinery.",
-      `export 'package:nomos_types/nomos_types.dart' show NomosRef, Identity, User, Recipient, Invitation, ActivityEvent, ActivityRef, ActivitySeverity, SurfacedObservation, SurfacedValue, SurfacedResolved, SurfacedPending, SurfacedEvolutionRequired;`,
+      `export 'package:nomos_types/nomos_types.dart' show NomosRef, NomosOptionalRef, VersionedNomosRef, ReferenceFreshness, ReferenceCurrent, ReferenceStale, ReferenceFreshnessUnavailable${sha256DigestExport}, Identity, User, Recipient, Invitation, ActivityEvent, ActivityRef, ActivitySeverity, SurfacedObservation, SurfacedValue, SurfacedResolved, SurfacedPending, SurfacedEvolutionRequired;`,
       ...(sharedBusinessTypeNames.length === 0
         ? []
         : [`export '${FRAMEWORK_FILE}.dart' show ${sharedBusinessTypeNames.join(", ")};`]),
@@ -2204,11 +2505,11 @@ function emitDartPackages(
   // ── the TEST package (optional) — generated business scenarios, test-only dependency ──
   if (packages.test !== undefined) {
     const testGen = freshGenDir(packages.test);
-    if (deployJsonPath === undefined) fail("dart.packages.test requires the compiled application package");
-    const embeddedDeployName = `${describePackageName}.deploy.json`;
-    const embeddedDeployPath = path.join(testGen, embeddedDeployName);
-    copyFileSync(deployJsonPath, embeddedDeployPath);
-    written.push(embeddedDeployPath);
+    if (lawUsdzPath === undefined) fail("dart.packages.test requires the compiled canonical law archive");
+    const embeddedLawName = `${describePackageName}.law.usdz`;
+    const embeddedLawPath = path.join(testGen, embeddedLawName);
+    copyFileSync(lawUsdzPath, embeddedLawPath);
+    written.push(embeddedLawPath);
     const scenarioSurfaces = perDomain.length > 1
       ? (() => {
           const topology = resolveApplicationTopology(modules);
@@ -2241,7 +2542,7 @@ function emitDartPackages(
           dd.modForDart,
           packages.client,
           packages.test,
-          embeddedDeployName,
+          embeddedLawName,
           {
             surfaceName,
             applicationFile,
@@ -2284,11 +2585,15 @@ function emitDartPackages(
         `  test: ^1.25.0`,
         `flutter:`,
         `  assets:`,
-        `    - lib/${genRel}/${embeddedDeployName}`,
+        `    - lib/${genRel}/${embeddedLawName}`,
         ``,
       ].join("\n"),
       { nomos_client: NOMOS_CLIENT_DEP },
     );
+    reconcileGeneratedLawAsset(
+      pkgDir(packages.test),
+      `lib/${genRel}/${embeddedLawName}`,
+    );
   }
 
   // ── the COMPAT package (optional, MIGRATION-ONLY) — pure `dart.names` typedefs over the types package ──
@@ -2365,20 +2670,26 @@ function emitDartPackages(
 
 async function main(): Promise<void> {
   const argv = process.argv.slice(2);
-  const supportedFlags = new Set(["--require-usdcat", "--compact", "--analyze"]);
+  const supportedFlags = new Set(["--require-usdcat", "--compact", "--analyze", "--preflight"]);
   for (const flag of argv.filter((arg) => arg.startsWith("--"))) {
     if (supportedFlags.has(flag)) continue;
     if (flag === "--layered") {
-      fail("--layered no longer exists: every package is a USD layer stack and every compile proves its flattened law");
+      fail("--layered no longer exists: every law is a composed typed USDA layer stack");
     }
     fail(`unknown compile flag '${flag}'`);
   }
   const requireUsdcat = argv.includes("--require-usdcat") || process.env.NOMOS_REQUIRE_USDCAT === "1";
   const compactFlag = argv.includes("--compact") || process.env["NOMOS_COMPACT"] === "1";
+  // Fast source/law feedback for large tenant packages. This deliberately stops
+  // before plan bundling, USD emission, Dart generation and Dart dependency
+  // checks; it is a strict author-time gate, not a substitute for a release
+  // compile. Treat warnings as failures here so a suspect birth recipe never
+  // spends minutes producing artifacts that will immediately be discarded.
+  const preflightFlag = argv.includes("--preflight") || process.env.NOMOS_PREFLIGHT === "1";
   // §"Shipped (1–4)" follow-up: `githolon compile --analyze` (or NOMOS_ANALYZE=1) runs
   // `dart analyze` on the generated Dart package after emission and fails the compile on red.
   const analyzeFlag = argv.includes("--analyze") || process.env.NOMOS_ANALYZE === "1";
-  const configArg = argv.find((a) => !a.startsWith("--")) ?? "nomos.package.mjs";
+  const configArg = argv.find((a) => !a.startsWith("--")) ?? "nomos.project.ts";
   const configPath = path.resolve(process.cwd(), configArg);
   if (!existsSync(configPath)) fail(`config not found: ${configPath}`);
   const cfgDir = path.dirname(configPath);
@@ -2421,26 +2732,33 @@ async function main(): Promise<void> {
       fail(`application composition refused: ${(error as Error).message}`);
     }
   }
-  const cfg = configValue as PackageConfig | undefined;
-  if (!cfg || typeof cfg.name !== "string" || !Array.isArray(cfg.domains) || cfg.domains.length === 0) {
-    fail(`config must default-export { name, domains: [{ key, modules }, ...] }`);
+  let cfg: PackageConfig;
+  let runtimeDependencies: readonly RuntimePackageDependency[];
+  try {
+    const validated = validateNomosPackageConfig(configValue);
+    cfg = validated.config as PackageConfig;
+    runtimeDependencies = validated.runtimeDependencies;
+  } catch (error) {
+    fail(`package contract refused: ${(error as Error).message}`);
   }
   if (Object.prototype.hasOwnProperty.call(cfg, "layered")) {
-    fail("nomos.package.mjs no longer accepts 'layered': every package is layered, with no alternate compile lane");
+    fail("nomos.project.ts no longer accepts 'layered': every law closure is layered, with no alternate compile lane");
   }
-  // ANY readable name works ("tool-library", "tool_library", "Tool Library"):
-  // artifact FILENAMES keep it verbatim; generated SYMBOLS normalize it
-  // (toolLibraryClient, TOOL_LIBRARY_DOMAIN_HASH — see codegen_ts.ts).
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]*$/.test(cfg.name)) {
-    fail(`package name '${cfg.name}' is not a safe basename (letters, digits, spaces, '.', '-', '_')`);
+  try {
+    assertPublicPackageImports(
+      cfg.domains.flatMap((domain) => domain.modules.map((module) => path.resolve(cfgDir, module))),
+    );
+  } catch (error) {
+    fail(`package import boundary refused: ${(error as Error).message}`);
   }
-
-  // EVERY GENERATED APPLICATION IS A COMPLETE PRODUCT ENTRYPOINT. The compiler privately appends the
-  // authority bootstrap law that turns verified credential evidence into durable device authorship. Tenant
-  // config never names this domain and presentation filters it back out: a package cannot emit the generated
-  // application facade while omitting the private machinery needed to open it. The deliberately obscure key
-  // reduces collision likelihood, but collision handling is still fail-closed: never reinterpret a tenant's
-  // same-named concept as framework machinery.
+  // EVERY PUBLISHED APPLICATION IS A COMPLETE PRODUCT ENTRYPOINT. `rootPart` is the explicit OpenUSD
+  // application/package boundary: only that independently published root privately receives the authority
+  // bootstrap law which turns verified credential evidence into durable device authorship. Ordinary law
+  // dependencies (including stage-zero and the Nomos controller) must not each invent another application
+  // home; doing so makes the composed runtime expose several equally valid first-device routes. Tenant config
+  // never names the private domain and presentation filters it back out. The deliberately obscure key reduces
+  // collision likelihood, but collision handling is still fail-closed: never reinterpret a tenant's same-named
+  // concept as framework machinery.
   if (cfg.domains.some((d) => d.key === APPLICATION_HOME_DOMAIN)) {
     fail(
       `domain key '${APPLICATION_HOME_DOMAIN}' is reserved by Nomos for private application authority law; ` +
@@ -2449,14 +2767,32 @@ async function main(): Promise<void> {
   }
   const domainsToCompile: DomainConfig[] = [
     ...cfg.domains,
-    {
-      key: APPLICATION_HOME_DOMAIN,
-      modules: [path.join(DSL_DIR, "src", "framework", "application_home.ts")],
-    },
+    ...(cfg.rootPart === undefined
+      ? []
+      : [{
+          key: APPLICATION_HOME_DOMAIN,
+          modules: [path.join(DSL_DIR, "src", "framework", "application_home.ts")],
+        }]),
   ];
 
   const outDir = path.resolve(cfgDir, cfg.outDir ?? "build");
   mkdirSync(outDir, { recursive: true });
+  // Interrupted pre-cutover compiles left thousands of private source/probe files beside public
+  // artifacts. They are neither custody nor diagnostics; clear only the compiler-owned namespace.
+  for (const entry of readdirSync(outDir)) {
+    if (entry.startsWith(".nomos_")) rmSync(path.join(outDir, entry), { recursive: true, force: true });
+  }
+  // Cutover hygiene: a compiler rerun must not leave retired law representations looking current.
+  // These were produced by the pre-v3 flatten/reconstruction path and have no runtime authority.
+  for (const retired of [
+    `${cfg.name}.package.usda`,
+    `${cfg.name}.layered.usda`,
+    `${cfg.name}.law-closure.json`,
+    `${cfg.name}.deploy.json`,
+  ]) rmSync(path.join(outDir, retired), { force: true });
+  for (const retiredDir of ["layers", "v3-layers", `${cfg.name}.relation-layers`]) {
+    rmSync(path.join(outDir, retiredDir), { recursive: true, force: true });
+  }
   // The package-wide executable lane no longer exists. Remove its ignored build artifact on every
   // native compile so a developer cannot accidentally inspect or execute stale bytes as canonical law.
   rmSync(path.join(outDir, ".nomos_lump.js"), { force: true });
@@ -2471,7 +2807,30 @@ async function main(): Promise<void> {
   // Every executable is an independently addressable lazy plan asset. There is no package-wide
   // eager/monolithic execution mode: keeping that alternative would let it become canonical again.
   const entryDomainSourceByKey = new Map<string, string>();
+  const entryPreloadSourceByKey = new Map<string, string>();
   const entryMintInstallByKey = new Map<string, string>();
+  const entryGeneratedSourceExprsByKey = new Map<string, readonly string[]>();
+  const executableDirectiveIdsByDomain = new Map<string, readonly string[]>();
+  const executableDirectivesByDomain = new Map<string, ReadonlyMap<
+    string,
+    Parameters<typeof synthesizePreconditionInvariants>[0]
+  >>();
+  const offerSourceExportsByDomain = new Map<string, ReadonlyMap<string, {
+    readonly modulePath: string;
+    readonly exportName: string;
+    readonly aggregateId: string;
+  }>>();
+  const workspaceInvariantSourceExportsByDomain = new Map<string, ReadonlyMap<string, {
+    readonly on: string;
+    readonly modulePath: string;
+    readonly exportName: string;
+    readonly remappedIntent?: {
+      readonly modulePath: string;
+      readonly exportName: string;
+    };
+  }>>();
+  const nativeWorkspaceInvariantIds = new Set<string>();
+  const nativeWorkspaceInvariantReadIds = new Set<string>();
   const routingInput: Record<string, Mod[]> = {};
   const domainModules: DomainModule[] = [];
   // THE SELF-DESCRIBE DECLS (G1): per domain key, the FINISHED plain read/maintenance decls the
@@ -2480,26 +2839,61 @@ async function main(): Promise<void> {
   // pass finished decls through), serialized into the generated entry as `openapiDecls`, so the
   // kernel-run describe reproduces THIS compile's `<name>.openapi.json` byte-for-byte.
   const openapiDeclsByDomain: Record<string, unknown> = {};
-  const layeredDomains: { key: string; inputs: LayeredModuleInput[] }[] = [];
-  /**
-   * THE CAPABILITY LOWERING (capability_marketplace.md §4 — the deploy-warning
-   * prerequisite + the executor's task→capability→domain map). Rides the
-   * UNHASHED deploy sidecar only (a top-level deploy-body key, like
-   * `dispositions`) — never the read manifest the wasm parses, never any
-   * hash-bearing artifact: declaring a capability moves no identity hash, and
-   * capability-free deploy bodies stay byte-identical (omit-when-empty).
-   */
-  const capabilityLowerings: {
-    capability: string;
-    domain: string;
-    aggregateId: string;
-    obligation: string;
-    complete: string;
-    fail: string;
-    block: string;
-    deadLetter: string;
-    tasksQueryId: string | null;
-  }[] = [];
+  // A tenant module may import declarations from another configured law module (business-birth
+  // composition is the common case). Ordinary ES evaluation then initializes that entire closure
+  // inside one `require()` thunk. Discover those configured-module edges once and emit them as
+  // warm-only thunks: one dependency per maintenance quantum, never merged into the caller's domain.
+  const configuredModulePaths = new Set(
+    domainsToCompile.flatMap((domain) => domain.modules.map((rel) => path.resolve(cfgDir, rel))),
+  );
+  const configuredDependencies = new Map<string, string[]>();
+  const resolveConfiguredImport = (importer: string, specifier: string): string | undefined => {
+    if (!specifier.startsWith(".")) return undefined;
+    const raw = path.resolve(path.dirname(importer), specifier);
+    const ext = path.extname(raw);
+    const candidates = [
+      raw,
+      ...(ext === ".js" || ext === ".mjs" || ext === ".cjs"
+        ? [raw.slice(0, -ext.length) + ".ts", raw.slice(0, -ext.length) + ".tsx"]
+        : []),
+      ...(ext === "" ? [`${raw}.ts`, `${raw}.tsx`, path.join(raw, "index.ts")] : []),
+    ];
+    return candidates.find((candidate) => configuredModulePaths.has(candidate));
+  };
+  for (const modulePath of configuredModulePaths) {
+    if (!existsSync(modulePath)) continue;
+    const imports = ts.preProcessFile(readFileSync(modulePath, "utf8"), true, true).importedFiles;
+    configuredDependencies.set(
+      modulePath,
+      imports
+        .map(({ fileName }) => resolveConfiguredImport(modulePath, fileName))
+        .filter((dependency): dependency is string => dependency !== undefined),
+    );
+  }
+  const preloadDependenciesFor = (domain: DomainConfig): string[] => {
+    const roots = domain.modules.map((rel) => path.resolve(cfgDir, rel));
+    const ownIndex = new Map(roots.map((modulePath, index) => [modulePath, index]));
+    const ordered: string[] = [];
+    const added = new Set<string>();
+    const visiting = new Set<string>();
+    const visit = (modulePath: string, rootIndex: number): void => {
+      if (visiting.has(modulePath)) return;
+      visiting.add(modulePath);
+      for (const dependency of configuredDependencies.get(modulePath) ?? []) {
+        const dependencyIndex = ownIndex.get(dependency);
+        // An earlier source in this domain has already initialized by the time this source runs.
+        if (dependencyIndex !== undefined && dependencyIndex <= rootIndex) continue;
+        visit(dependency, dependencyIndex ?? rootIndex);
+        if (!added.has(dependency)) {
+          added.add(dependency);
+          ordered.push(dependency);
+        }
+      }
+      visiting.delete(modulePath);
+    };
+    roots.forEach((modulePath, index) => visit(modulePath, index));
+    return ordered;
+  };
 
   for (const d of domainsToCompile) {
     if (typeof d.key !== "string" || !Array.isArray(d.modules) || d.modules.length === 0) {
@@ -2507,12 +2901,48 @@ async function main(): Promise<void> {
     }
     const mods: Mod[] = [];
     const sourceExprs: string[] = [];
+    const directOfferExports = new Map<string, { modulePath: string; exportName: string; aggregateId: string }>();
+    const directWorkspaceInvariantExports = new Map<string, {
+      modulePath: string;
+      exportName: string;
+    }>();
     for (const rel of d.modules) {
       const abs = path.resolve(cfgDir, rel);
       if (!existsSync(abs)) fail(`domain '${d.key}': module not found: ${abs}`);
       const m = (await import(pathToFileURL(abs).href)) as Mod;
       mods.push(m);
       sourceExprs.push(`() => require(${JSON.stringify(abs)})`);
+      for (const [exportName, value] of Object.entries(m)) {
+        if (isWorkspaceInvariantDecl(value)) {
+          directWorkspaceInvariantExports.set(value.id, { modulePath: abs, exportName });
+        }
+        if (
+          value !== null && typeof value === "object" &&
+          typeof (value as { id?: unknown }).id === "string" &&
+          typeof (value as { plan?: unknown }).plan === "function" &&
+          typeof (value as { aggregateId?: unknown }).aggregateId === "string"
+        ) {
+          directOfferExports.set((value as { id: string }).id, {
+            modulePath: abs,
+            exportName,
+            aggregateId: (value as { aggregateId: string }).aggregateId,
+          });
+        }
+        // `birth(Aggregate)` is intentionally a high-level declaration. Its public parent birth and
+        // private child seed are compiler-lowered executable offers, so preserve their authored
+        // symbol origin here rather than condemning both to the whole-domain fallback plan.
+        if (
+          value !== null && typeof value === "object" &&
+          (value as { __isBusinessBirth?: unknown }).__isBusinessBirth === true &&
+          typeof (value as { aggregate?: { id?: unknown } }).aggregate?.id === "string"
+        ) {
+          const stem = ((value as { aggregate: { id: string } }).aggregate.id)
+            .replace(/[^A-Za-z0-9]/g, "");
+          const aggregateId = (value as { aggregate: { id: string } }).aggregate.id;
+          directOfferExports.set(`nomosBirth${stem}`, { modulePath: abs, exportName, aggregateId });
+          directOfferExports.set(`nomosSeed${stem}`, { modulePath: abs, exportName, aggregateId });
+        }
+      }
     }
     let merged: Mod = {};
     for (const m of mods) merged = { ...merged, ...m };
@@ -2627,12 +3057,20 @@ async function main(): Promise<void> {
 
     const domainSource = `    ${JSON.stringify(d.key)}: [${sourceExprs.join(", ")}],`;
     entryDomainSourceByKey.set(d.key, domainSource);
+    entryGeneratedSourceExprsByKey.set(d.key, sourceExprs.slice(d.modules.length));
+    const preloadDependencies = preloadDependenciesFor(d);
+    if (preloadDependencies.length > 0) {
+      entryPreloadSourceByKey.set(
+        d.key,
+        `    ${JSON.stringify(d.key)}: [${preloadDependencies.map((abs) => `() => { require(${JSON.stringify(abs)}); }`).join(", ")}],`,
+      );
+    }
     routingInput[d.key] = mods;
     // ── THE AUX INVARIANT-ROUTING KEY (#47, sharding slice 7 — the invariant-gate
     //    flame pass): in a LAZY lump, the derived sharding law registers a SECOND
     //    time under its own domain key, and the ROUTING table points the sharding
     //    workspace-invariant ids at THAT key only. A per-write homing-invariant
-    //    dispatch (`workspaceInvariantReads`/`workspaceInvariant`) then forces ONLY
+    //    assertion dispatch then forces ONLY
     //    the small framework module — never the tenant domain's whole zod/module
     //    graph (the measured ~30 ms-per-dispatch floor on co2 estate_structures).
     //    Directive dispatch is untouched (the sharding directives stay registered
@@ -2657,6 +3095,37 @@ async function main(): Promise<void> {
       ...discover<QueryDecl>(merged, isQueryDecl),
       ...resolveNamed<QueryDecl>(merged, d.queries, "queries"),
     ];
+    // A directive's `.reads(query)` already carries the complete typed QueryDecl. Requiring the
+    // same query to be separately exported made a correct, private captured read disappear from
+    // law discovery and fail later as "reads unknown query". Seat every referenced declaration in
+    // the domain automatically. It stays implementation-private unless the author also exports it;
+    // export is presentation, `.reads(...)` is the executable-law dependency.
+    {
+      const byId = new Map(queries.map((query) => [query.id, query] as const));
+      for (const directive of directivesOf(merged)) {
+        for (const declared of directive.declaredQueryReads ?? []) {
+          const existing = byId.get(declared.id);
+          if (existing !== undefined) {
+            if (existing.returns !== declared.returns ||
+                JSON.stringify(existing.key) !== JSON.stringify(declared.key)) {
+              fail(
+                `domain '${d.key}': captured read '${declared.id}' has conflicting declarations ` +
+                  `(exported ${existing.returns}[${existing.key.join(",")}], directive ` +
+                  `${directive.id} ${declared.returns}[${declared.key.join(",")}])`,
+              );
+            }
+            continue;
+          }
+          const internal = {
+            ...declared,
+            businessBirthInternal: true as const,
+          } as QueryDecl;
+          queries.push(internal);
+          byId.set(internal.id, internal);
+        }
+      }
+      queries.sort((left, right) => left.id.localeCompare(right.id));
+    }
     // METERED BIRTH (slice A): a domain declaring ≥1 `.births()` directive gets the meter's declared
     // queries appended (dedup by id) so the openapi self-describe decls + read routing carry them —
     // the same auto-ensure `composeDomainModule` applies to the manifest half.
@@ -2750,22 +3219,6 @@ async function main(): Promise<void> {
     const capByAggregate = new Map<string, ImpureCapabilityDecl>();
     for (const c of [...discoveredCapabilities, ...namedCapabilities]) capByAggregate.set(c.aggregate.id, c);
     const impureCapabilities = [...capByAggregate.values()];
-    for (const c of impureCapabilities) {
-      const meta = c as unknown as { name?: unknown; capability?: unknown; tasks?: { id?: unknown } };
-      const cap = typeof meta.name === "string" ? meta.name : typeof meta.capability === "string" ? meta.capability : null;
-      if (cap === null) continue; // a binding-free quartet lowers nothing (omit-when-absent)
-      capabilityLowerings.push({
-        capability: cap,
-        domain: d.key,
-        aggregateId: c.aggregate.id,
-        obligation: c.obligation.id,
-        complete: c.complete.id,
-        fail: c.fail.id,
-        block: c.block.id,
-        deadLetter: c.deadLetter.id,
-        tasksQueryId: typeof meta.tasks?.id === "string" ? meta.tasks.id : null,
-      });
-    }
     const extraAggregates = resolveNamed<AggregateHandle>(merged, d.extraAggregates, "extraAggregates");
 
     // Dart-codegen hints (frontend-only — never law; see DomainConfig):
@@ -2813,6 +3266,54 @@ async function main(): Promise<void> {
     //    no-path / ambiguous / cross-home / unroutable law is a NAMED COMPILE
     //    ERROR here — never a domain silently recorded as identity-excluded.
     const composed = domainModules[domainModules.length - 1]!;
+    const executableDirectives = (composed.directives ?? []).filter(
+      (directive) => (directive as { manifestOnly?: unknown }).manifestOnly !== true,
+    );
+    const executableDirectiveIds = executableDirectives.map((directive) => directive.id).sort();
+    executableDirectiveIdsByDomain.set(d.key, executableDirectiveIds);
+    executableDirectivesByDomain.set(
+      d.key,
+      new Map(executableDirectives.map((directive) => [directive.id, directive])),
+    );
+    offerSourceExportsByDomain.set(
+      d.key,
+      new Map([...directOfferExports].filter(([directiveId]) => executableDirectiveIds.includes(directiveId))),
+    );
+    const invariantSources = new Map<string, {
+      on: string;
+      modulePath: string;
+      exportName: string;
+      remappedIntent?: { modulePath: string; exportName: string };
+    }>();
+    for (const invariant of composed.workspaceInvariants ?? []) {
+      if (invariant.__nomosEvaluator !== undefined) {
+        nativeWorkspaceInvariantIds.add(invariant.id);
+        continue;
+      }
+      if (invariant.__nomosReadBindings !== undefined) {
+        nativeWorkspaceInvariantReadIds.add(invariant.id);
+      }
+      const direct = directWorkspaceInvariantExports.get(invariant.id);
+      if (direct !== undefined) {
+        invariantSources.set(invariant.id, { ...direct, on: invariant.on });
+        continue;
+      }
+      const original = [...directWorkspaceInvariantExports].find(([id]) =>
+        invariant.id === `${invariant.on}__${id}`
+      );
+      const remappedIntent = directOfferExports.get(invariant.on);
+      if (original !== undefined && remappedIntent !== undefined) {
+        invariantSources.set(invariant.id, {
+          ...original[1],
+          on: invariant.on,
+          remappedIntent: {
+            modulePath: remappedIntent.modulePath,
+            exportName: remappedIntent.exportName,
+          },
+        });
+      }
+    }
+    workspaceInvariantSourceExportsByDomain.set(d.key, invariantSources);
 
     // ── THE SELF-DESCRIBE DECLS (G1): the FINISHED plain read/maintenance decls the lump's
     //    `describe` reconstructs the openapi fragment from. Directives + aggregates are read from
@@ -2885,169 +3386,88 @@ async function main(): Promise<void> {
       }
     }
 
-    // ── ONE USD LAYER PER MODULE (Φ applied per module, not once over the
-    //    composed fold) — the layered emission `usd_layers.ts` proves flattens back
-    //    to the EXACT canonical IR (asserted below, fail-closed). Per-module decls
-    //    are discovered the same way as above, on each module's OWN exports; config
-    //    export-names resolve on whichever module actually exports them; config
-    //    `extraAggregates` ride the FIRST (weakest) layer, prelude-style. Compiler-
-    //    discovered reads are seated beside the aggregate schema they read.
-    {
-      const usedStems = new Set<string>();
-      let inputs: LayeredModuleInput[] = mods.map((m, i) => {
-        const authoredPath = d.modules[i];
-        let stem = authoredPath === undefined
-          ? `nomos-derived-${i + 1}`
-          : path.basename(authoredPath).replace(/\.[^.]*$/, "");
-        for (let n = 2; usedStems.has(stem); n++) stem = `${stem}-${n}`;
-        usedStems.add(stem);
-
-        const presentNames = (names: readonly string[] | undefined) =>
-          (names ?? []).filter((n) => (m as Record<string, unknown>)[n] !== undefined);
-        const layerQueries = [
-          ...discover<QueryDecl>(m, isQueryDecl),
-          ...resolveNamed<QueryDecl>(m, presentNames(d.queries), "queries"),
-        ];
-        const layerDeriveds = [
-          ...discover<DerivedDecl>(m, isDerivedDecl),
-          ...resolveNamed<DerivedDecl>(m, presentNames(d.deriveds), "deriveds"),
-        ];
-        const layerCombineds = [
-          ...discover<CombinedDecl>(m, isCombinedDecl),
-          ...resolveNamed<CombinedDecl>(m, presentNames(d.combineds), "combineds"),
-        ];
-        // Lower the module through the SAME compiler-owned expansion seam as the
-        // canonical fold. A hand-built `{aggregates,directives}` approximation silently
-        // dropped relation, invariant, attestation, flow and projection opinions, so the
-        // pretty USD stack was not the law. Single-module composition retains those
-        // generated opinions in the layer where their authored cause lives.
-        const module = composeDomainModule({
-          name: d.name ?? d.key,
-          domain: d.key,
-          modules: [m],
-          ...(i === 0 && extraAggregates.length > 0 ? { extraAggregates } : {}),
-          // Compiler-synthesized/domain-wide declarations have no honest authored
-          // module owner. Seat them once in the weakest prelude layer so USD and
-          // Nomos both see one contribution instead of duplicating them per source file.
-          ...(i === 0 && (composed.workspaceInvariants?.length ?? 0) > 0
-            ? { workspaceInvariants: composed.workspaceInvariants }
-            : {}),
-          ...(i === 0 && workspaceTypes.length > 0 ? { workspaceTypes } : {}),
-          ...(i === 0 && impureCapabilities.length > 0 ? { impureCapabilities } : {}),
-          ...(layerQueries.length > 0 ? { queries: layerQueries } : {}),
-          ...(layerDeriveds.length > 0 ? { deriveds: layerDeriveds } : {}),
-          ...(layerCombineds.length > 0 ? { combineds: layerCombineds } : {}),
-        });
-        return { name: stem, module };
-      });
-      if (inputs[0] !== undefined) {
-        // Work on shallow module copies: package-owned declarations usually belong
-        // in the weakest prelude, but a read recipe belongs beside the aggregate
-        // schema it reads. Putting a compiler-added query in an unrelated prelude
-        // makes that individual USD layer ill-typed even though the whole stack has
-        // the target in a stronger layer.
-        inputs = inputs.map((input) => ({
-          ...input,
-          module: { ...input.module } as DomainModule,
-        }));
-        // Config-named and compiler-derived reads are package opinions rather than
-        // exports of one source file. Seat only declarations missing from every
-        // authored layer, once. Reads sit beside their returned aggregate; all other
-        // domain-wide declarations sit in the weakest prelude.
-        for (const field of [
-          "queries",
-          "counts",
-          "spatials",
-          "sums",
-          "mins",
-          "maxes",
-          "deriveds",
-          "combineds",
-          "workspaceTypes",
-          "workspaceInvariants",
-          "orderedReads",
-          "exists_",
-        ] as const) {
-          const canonical = (composed as unknown as Record<string, unknown>)[field];
-          if (!Array.isArray(canonical)) continue;
-          // A package-level language may be declared in a different source module from the
-          // aggregate its generated read indexes (workspaceSharing is the canonical case).
-          // Single-module composition then discovers the read in the language module even though
-          // that layer cannot type it. Move every targeted declaration beside its aggregate schema
-          // before filling genuinely missing package opinions. This changes no composed law: one
-          // declaration id still contributes once; it merely gives every authored USD layer a
-          // self-contained, valid read projection.
-          for (const value of canonical) {
-            if (value === null || typeof value !== "object") continue;
-            const id = (value as { id?: unknown }).id;
-            if (typeof id !== "string") continue;
-            const declarationTarget = field === "queries"
-              ? (value as { returns?: unknown }).returns
-              : (["counts", "spatials", "sums", "mins", "maxes", "deriveds", "combineds"] as const)
-                  .includes(field as never)
-                ? (value as { of?: unknown }).of
-                : undefined;
-            if (typeof declarationTarget !== "string") continue;
-            const ownerIndex = inputs.findIndex((input) =>
-              input.module.aggregates.some((aggregate) => aggregate.id === declarationTarget));
-            if (ownerIndex < 0) continue;
-            for (const [inputIndex, input] of inputs.entries()) {
-              if (inputIndex === ownerIndex) continue;
-              const module = input.module as DomainModule & Record<string, unknown>;
-              const existing = module[field];
-              if (!Array.isArray(existing)) continue;
-              (module as Record<string, unknown>)[field] = existing.filter((candidate) =>
-                candidate === null || typeof candidate !== "object" ||
-                (candidate as { id?: unknown }).id !== id);
-            }
-            const owner = inputs[ownerIndex]!.module as DomainModule & Record<string, unknown>;
-            const ownerValues = Array.isArray(owner[field]) ? owner[field] as unknown[] : [];
-            if (!ownerValues.some((candidate) =>
-              candidate !== null && typeof candidate === "object" &&
-              (candidate as { id?: unknown }).id === id)) {
-              (owner as Record<string, unknown>)[field] = [...ownerValues, value];
-            }
-          }
-          const present = new Set(inputs.flatMap((input) => {
-            const values = (input.module as unknown as Record<string, unknown>)[field];
-            return Array.isArray(values)
-              ? values.flatMap((value) => value !== null && typeof value === "object" && typeof (value as { id?: unknown }).id === "string"
-                  ? [(value as { id: string }).id]
-                  : [])
-              : [];
-          }));
-          const missing = canonical.filter((value) =>
-            value !== null && typeof value === "object" && typeof (value as { id?: unknown }).id === "string"
-              ? !present.has((value as { id: string }).id)
-              : true);
-          for (const value of missing) {
-            const declarationTarget = value !== null && typeof value === "object"
-              ? field === "queries"
-                ? (value as { returns?: unknown }).returns
-                : (["counts", "spatials", "sums", "mins", "maxes", "deriveds", "combineds"] as const).includes(field as never)
-                  ? (value as { of?: unknown }).of
-                  : undefined
-              : undefined;
-            const ownerIndex = typeof declarationTarget === "string"
-              ? inputs.findIndex((input) => input.module.aggregates.some((aggregate) => aggregate.id === declarationTarget))
-              : -1;
-            const targetIndex = ownerIndex >= 0 ? ownerIndex : 0;
-            const target = inputs[targetIndex]!.module as DomainModule & Record<string, unknown>;
-            const existing = target[field];
-            target[field] = [...(Array.isArray(existing) ? existing : []), value];
-          }
-        }
-      }
-      layeredDomains.push({ key: d.key, inputs });
-    }
+  }
+
+  const dependencyUseFindings = packageDependencyUsageFindings({
+    packageName: cfg.name,
+    exportedDomains: cfg.domains.map((domain) => domain.key),
+    runtimeDependencies,
+    modules: domainModules,
+  });
+  if (dependencyUseFindings.length > 0) {
+    console.error(
+      `nomos-compile: runtime package dependency contract refused ` +
+        `(${dependencyUseFindings.length} cross-package reference error(s))`,
+    );
+    for (const line of formatFindings(dependencyUseFindings)) console.error(`             ✗ ${line}`);
+    process.exitCode = 1;
+    return;
   }
 
   // Presentation is a separate concern from executable law. The private application/home domain remains
   // in `domainModules` for hashing, routing, self-description, replay and static checking, but generated
   // tenant clients/proofs/interfaces contain business vocabulary only.
-  const presentationDomainModules = closeComposedBusinessBirthPresentation(domainModules).filter(
+  const closedDomainModules = closeComposedBusinessBirthPresentation(domainModules);
+  const closedDomainModulesByName = new Map(closedDomainModules.map((module) => [module.name, module]));
+  const presentationDomainModules = closedDomainModules.filter(
     (mod) => (mod.domain ?? mod.name) !== APPLICATION_HOME_DOMAIN,
   );
+  // Run semantic author-time checks before stable-id reconciliation, plan bundling, codegen, or
+  // custody emission. A statically invalid package should fail in seconds and must never leave a
+  // plausible deployable artifact behind merely because the runtime representation changed shape.
+  const authorTimeFindings = checkDomainModules(domainModules);
+  // Self-description is a compiler-owned presentation projection, not executable law. Build it
+  // once from the same composed modules and place it only in the separately routed describe plan;
+  // exact offer/read plans must not carry OpenAPI generation and Zod JSON-Schema machinery.
+  const runtimeOpenApiDocument = mergeOpenApiFragments(
+    domainModules.map((module) => generateOpenApiFragment(module, { includeFrameworkRoutes: true })),
+    { title: `${cfg.name} (nomos package)` },
+  );
+
+  if (preflightFlag) {
+    const businessFindings = authorTimeFindings.filter(
+      (finding) =>
+        finding.domain !== APPLICATION_HOME_DOMAIN &&
+        finding.directiveId?.startsWith("nomos_internal_") !== true,
+    );
+    console.log(`nomos-preflight: ${cfg.name} (${domainModules.length} domain(s))`);
+    if (businessFindings.length === 0) {
+      console.log("  check      ✓ author-time law checks clean; full compile is justified");
+      return;
+    }
+    console.error(`  check      ${businessFindings.length} finding(s); full compile skipped:`);
+    for (const line of formatFindings(businessFindings)) {
+      const mark = line.includes("REFUSE") ? "✗" : line.includes("WARN") ? "⚠" : "•";
+      console.error(`             ${mark} ${line}`);
+    }
+    process.exitCode = 1;
+    return;
+  }
+
+  const isFrameworkAuthorTimeFinding = (finding: (typeof authorTimeFindings)[number]) =>
+    finding.domain === APPLICATION_HOME_DOMAIN || finding.directiveId?.startsWith("nomos_internal_") === true;
+  const earlyBusinessRefusals = authorTimeFindings.filter(
+    (finding) => !isFrameworkAuthorTimeFinding(finding) && finding.level === "refuse",
+  );
+  const earlyPrivateRefusals = authorTimeFindings.filter(
+    (finding) => isFrameworkAuthorTimeFinding(finding) && finding.level === "refuse",
+  );
+  if (earlyBusinessRefusals.length > 0) {
+    console.error(`nomos-compile: author-time law check refused before plan compilation:`);
+    for (const line of formatFindings(earlyBusinessRefusals)) console.error(`             ✗ ${line}`);
+    process.exitCode = 1;
+    return;
+  }
+  if (earlyPrivateRefusals.length > 0) {
+    console.error(
+      `nomos-compile: Nomos lifecycle self-check failed inside this compiler release before plan compilation`,
+    );
+    if (process.env.NOMOS_DEBUG_FRAMEWORK === "1") {
+      for (const line of formatFindings(earlyPrivateRefusals)) console.error(`             ${line}`);
+    }
+    process.exitCode = 1;
+    return;
+  }
 
   // ── STABLE-ID CONTINUITY (#58 — names are labels, identity is minted) ──
   // Derive each composed domain's stable ids from the PRIOR compile: the committed
@@ -3063,11 +3483,17 @@ async function main(): Promise<void> {
     ? parseStableIdLockfile(JSON.parse(readFileSync(lockPath, "utf8")))
     : undefined;
   const inferredRenames: { domain: string; renames: InferredRename[] }[] = [];
+  let nextIdentity = identityRegistryFromStableIdLockfile(priorLock);
+  const typedLawGraphs = new Map<string, LawGraph>();
   // The lock is project-wide, not package-local. Several package configs commonly live beside one
   // application stage; compiling one must not erase the stable identity of domains owned by its siblings.
   // Current package domains are replaced below, while absent domains remain only as continuity metadata
   // and never leak into this package's interface, law, clients or deployment.
-  const nextLock: StableIdLockfile = { v: 1, domains: { ...(priorLock?.domains ?? {}) } };
+  const nextLock: StableIdLockfile = {
+    v: 1,
+    domains: { ...(priorLock?.domains ?? {}) },
+    identity: nextIdentity,
+  };
   for (const mod of domainModules) {
     const identityName = mod.name;
     // The CURRENT canonical aggregate schemas (a pre-continuity manifest pass —
@@ -3079,23 +3505,18 @@ async function main(): Promise<void> {
       global?: boolean;
     }[];
     try {
-      const preManifest = domainManifest(mod);
-      currentAggs = preManifest.aggregates.map((a) => ({
-        id: a.id,
-        schema: a.schema,
+      currentAggs = mod.aggregates.map((aggregate) => ({
+        id: aggregate.id,
+        schema: Object.fromEntries(
+          Object.entries(encodeKernelSchema(aggregate)).sort(([left], [right]) => left.localeCompare(right)),
+        ) as WireSchema,
         // One framework aggregate may be composed into many independently compiled
         // domain packages. Give that shared row one global stable-id scope so the
         // installed read manifest sees the same field contract from every package.
-        global: mod.aggregates.some(
-          (candidate) => candidate.id === a.id && !isNamespacedAggregate(candidate),
-        ),
-        // The CURRENT field kinds (off the pre-continuity stableIds emission) — the
-        // pair rule's kind axis ("rename + add a field" in one release still infers).
-        kinds: Object.fromEntries(
-          Object.entries(preManifest.stableIds?.aggregates[a.id]?.fields ?? {}).map(
-            ([f, v]) => [f, v.kind ?? ""] as [string, string],
-          ),
-        ),
+        global: !isNamespacedAggregate(aggregate),
+        // The CURRENT field kinds come straight from the typed field declarations. The rename
+        // pair rule needs this axis, not a serialized manifest projection of it.
+        kinds: Object.fromEntries(Object.entries(aggregate.fields).map(([field, value]) => [field, value.kind])),
       }));
     } catch {
       // A palette-gap domain has no canonical identity (recorded-and-excluded later);
@@ -3111,20 +3532,41 @@ async function main(): Promise<void> {
       prior = locked.stableIds;
       priorSchemas = locked.schemas;
     }
-    const { continuity, inferred } = deriveStableIdContinuity(
+    const proposed = deriveStableIdContinuity(
       identityName,
       currentAggs,
       prior,
       priorSchemas,
     );
+    const reconciled = reconcileStableIdsWithIdentity(
+      nextIdentity,
+      identityName,
+      currentAggs.map((aggregate) => ({
+        id: aggregate.id,
+        fields: Object.keys(aggregate.schema),
+        ...(aggregate.global === undefined ? {} : { global: aggregate.global }),
+      })),
+      proposed.continuity,
+      proposed.inferred,
+    );
+    nextIdentity = reconciled.registry;
+    nextLock.identity = nextIdentity;
+    const continuity = reconciled.continuity;
+    const inferred = proposed.inferred;
+    // W4 typed compiler graph: reconcile independently-lived intent/read identities,
+    // link every current target as a kind-safe ref, and refuse unresolved structure
+    // before any USDA string is rendered. Later W4 stages move emitters/codegen onto
+    // this same process-local graph; it is never serialized as another law IR.
+    // Package-wide business-intent composition can make a directly callable child-birth route private
+    // independently of domain declaration order. Build custody from that same closed view used by generated
+    // clients/interfaces; using the pre-closure executable module here published a USDA-only `birth` route.
+    const graphModule = closedDomainModulesByName.get(mod.name) ?? mod;
+    const discoveredGraph = discoverLawGraph(graphModule, continuity, nextIdentity);
+    nextIdentity = discoveredGraph.registry;
+    nextLock.identity = nextIdentity;
+    typedLawGraphs.set(identityName, discoveredGraph.graph);
     mod.stableIdContinuity = continuity;
-    // The layered emission's per-module layers must carry the SAME sids (the flatten
-    // homomorphism is byte-asserted), so the continuity rides every layer input too.
-    for (const ld of layeredDomains) {
-      if (ld.key === (mod.domain ?? mod.name)) {
-        for (const inp of ld.inputs) inp.module.stableIdContinuity = continuity;
-      }
-    }
+    graphModule.stableIdContinuity = continuity;
     if (inferred.length > 0) inferredRenames.push({ domain: identityName, renames: inferred });
     // ── THE fromBirth EVOLVE GUARD (dart_codegen_parity.md): birth-presence may be declared at a
     // field's FIRST appearance (fresh sid — every row of the type is born under the invariant) or
@@ -3158,7 +3600,7 @@ async function main(): Promise<void> {
     // The lockfile records the EMITTED surface (sids + lineage + kinds — the next
     // compile's pair rule reads the kinds), not the bare continuity.
     nextLock.domains[identityName] = {
-      stableIds: domainManifest(mod).stableIds ?? continuity,
+      stableIds: stableIdsForModule(mod),
       schemas: Object.fromEntries(currentAggs.map((a) => [a.id, a.schema])),
     };
   }
@@ -3177,6 +3619,34 @@ async function main(): Promise<void> {
   for (const mod of presentationDomainModules) {
     const key = mod.domain ?? mod.name;
     const di = domainInterface(mod, nextLock.domains[mod.name]?.stableIds);
+    const graph = typedLawGraphs.get(mod.name);
+    if (graph === undefined) {
+      fail(`compiler surface invariant: domain '${key}' has no typed USDA graph`);
+    }
+    const graphRoutes = graph.nodes
+      .filter((node) => node.kind === "intent" && node.public)
+      .map((node) => node.kind === "intent" ? node.publicRoute : "")
+      .sort();
+    const graphRouteSet = new Set(graphRoutes);
+    if (graphRouteSet.size !== graphRoutes.length) {
+      const duplicateRoutes = [...graphRouteSet]
+        .filter((route) => graphRoutes.filter((candidate) => candidate === route).length > 1)
+        .sort();
+      fail(
+        `compiler surface invariant: typed USDA for domain '${key}' publishes duplicate route(s): ` +
+          duplicateRoutes.join(", "),
+      );
+    }
+    const interfaceRoutes = Object.keys(di.directives).sort();
+    const missingFromLaw = interfaceRoutes.filter((route) => !graphRouteSet.has(route));
+    const missingFromClient = graphRoutes.filter((route) => !(route in di.directives));
+    if (missingFromLaw.length > 0 || missingFromClient.length > 0) {
+      fail(
+        `compiler surface invariant: generated client and typed USDA disagree for domain '${key}'` +
+          `${missingFromLaw.length === 0 ? "" : `; client-only: ${missingFromLaw.join(", ")}`}` +
+          `${missingFromClient.length === 0 ? "" : `; USDA-only: ${missingFromClient.join(", ")}`}`,
+      );
+    }
     const prior = packageInterface[key];
     packageInterface[key] = prior
       ? {
@@ -3206,6 +3676,24 @@ async function main(): Promise<void> {
     }
   }
 
+  // USDA is rendered directly from the typed graph. The final closure writer below publishes these
+  // exact texts under their logical paths; no parallel layer directory or JSON reconstruction exists.
+  const v3Closure = [...typedLawGraphs.values()];
+  const v3DomainAssets: EmittedLawClosureAsset[] = [];
+  const typedDomainIdentityByName = new Map<string, string>();
+  for (const [domain, graph] of typedLawGraphs) {
+    const safeDomain = domain.replace(/[^A-Za-z0-9._-]/g, "_");
+    const logicalPath = `domains/${safeDomain}.usda`;
+    const layerText = emitSparseLawGraphUsda(graph, logicalPath, v3Closure);
+    const sha256 = sha256HexUtf8(layerText);
+    v3DomainAssets.push({
+      logicalPath,
+      sha256,
+      utf8: layerText,
+    });
+    typedDomainIdentityByName.set(domain, sha256);
+  }
+
   // ── reports ──
   const entryReports: string[] = [];
   for (const [reportId, ref] of Object.entries(cfg.reports ?? {})) {
@@ -3225,6 +3713,18 @@ async function main(): Promise<void> {
   // law whose invariant declarations are inconsistent refuses to COMPILE, and the
   // table can never disagree with what a full force would register).
   const routing = collectEngineRouting(routingInput);
+  // Zanzibar identities are namespaced by the domain's STABLE USDA identity, not its mutable dispatch
+  // label. Carry that one label→identity table into every plan asset so writeTuple() emits the same
+  // object type the typed law graph placed on gates and relation declarations.
+  const relationNamespaceOf = Object.fromEntries(
+    domainModules.map((mod) => {
+      const graph = typedLawGraphs.get(mod.name);
+      if (graph === undefined) {
+        throw new Error(`domain '${mod.name}' has no typed law graph for its relation namespace`);
+      }
+      return [mod.domain ?? mod.name, graph.domain.entity.id] as const;
+    }),
+  );
   // AMBIENT-SLOT SEEDING (lazy boot only): zod v4 writes
   // `globalThis.__zod_global{Config,Registry}` at MODULE INIT. The sealed sandbox
   // freezes globalThis after the lump's top level — an eager lump's zod init ran
@@ -3241,7 +3741,10 @@ async function main(): Promise<void> {
   const zodSeedImports: string[] = [];
   const zodSeedNames: string[] = [];
   {
-    const zodPkgJson = [cfgDir, DSL_DIR]
+    // Runtime law imports Zod through this DSL package. Resolve that exact instance first: a tenant
+    // monorepo may hoist an unrelated Zod v3 for other tooling, and seeding that package bloats every
+    // plan while failing to initialize the Zod v4 ambient slots the domain actually uses.
+    const zodPkgJson = [DSL_DIR, cfgDir]
       .map((dir) => {
         try {
           return createRequire(pathToFileURL(path.join(dir, "noop.js"))).resolve("zod/package.json");
@@ -3282,14 +3785,12 @@ async function main(): Promise<void> {
     })
     .find((p): p is string => p !== undefined);
   if (!esbuildPkgJson) fail(`esbuild not found — reinstall @githolon/dsl (esbuild is one of its dependencies)`);
-  const esbuildPkg = JSON.parse(readFileSync(esbuildPkgJson, "utf8")) as { bin?: string | Record<string, string> };
-  const esbuildBinRel = typeof esbuildPkg.bin === "string" ? esbuildPkg.bin : esbuildPkg.bin?.["esbuild"];
-  // Exec the bin DIRECTLY (not via `node`): esbuild's postinstall replaces the
-  // JS shim with the platform-native binary, which only an exec can run.
-  const esbuildBin = path.join(path.dirname(esbuildPkgJson), esbuildBinRel ?? "bin/esbuild");
   const esbuildMod = (await import(pathToFileURL(path.join(path.dirname(esbuildPkgJson), "lib", "main.js")).href)) as typeof import("esbuild");
 
   const compact = compactFlag || cfg.compact === true;
+  const runtimeZodPath = path.join(DSL_DIR, "src", "runtime_zod.ts");
+  const runtimeZodPackage = createRequire(import.meta.url).resolve("zod/package.json");
+  const runtimeZodV4Path = path.join(path.dirname(runtimeZodPackage), "v4", "index.js");
 
   // ── CONTENT-ADDRESSED PLAN ASSETS ─────────────────────────────────────────────
   // The ledger package no longer executes the package-wide compatibility lump above. Build the
@@ -3299,85 +3800,668 @@ async function main(): Promise<void> {
   const planAssets: UsdPlanAsset[] = [];
   const planRoutes: UsdPlanRoute[] = [];
   const planBySignature = new Map<string, UsdPlanAsset>();
+  const planByHash = new Map<string, UsdPlanAsset>();
+  const planProofCodec = await import("../compile_proof.mjs" as string) as {
+    readPlanCompileProof(options: {
+      proofPath: string;
+      baseIdentity: string;
+      runtimeSha256: string;
+      digestFile?: (file: string) => string;
+    }): { javascript: string; sha256: string } | undefined;
+    writePlanCompileProof(options: {
+      proofPath: string;
+      baseIdentity: string;
+      runtimeSha256: string;
+      plan: string;
+      planSha256: string;
+      inputs: readonly { readonly path: string; readonly sha256: string }[];
+    }): void;
+  };
+  const planCacheDir = path.join(cfgDir, "node_modules", ".cache", "nomos", "plans");
+  const planInputDigestCache = new Map<string, string>();
+  const planBytesDigest = (bytes: Uint8Array): string => createHash("sha256").update(bytes).digest("hex");
+  const planInputDigest = (file: string): string => {
+    const absolute = path.resolve(file);
+    const prior = planInputDigestCache.get(absolute);
+    if (prior !== undefined) return prior;
+    const digest = planBytesDigest(readFileSync(absolute));
+    planInputDigestCache.set(absolute, digest);
+    return digest;
+  };
+  const planCompilerIdentity = planBytesDigest(Buffer.concat([
+    Buffer.from("nomos.plan-compiler.v1\0", "utf8"),
+    readFileSync(fileURLToPath(import.meta.url)),
+    Buffer.from(`\0esbuild:${esbuildMod.version}\0`, "utf8"),
+  ]));
   let planSequence = 0;
   const orderedDomainKeys = [...entryDomainSourceByKey.keys()];
-  const planEntrySource = (domainKeys: readonly string[], includeReports: boolean): string => {
+  const frameworkPlanModulePaths = [...new Set(
+    Object.values(BUSINESS_BIRTH_FRAMEWORK_PLAN_SOURCES).map((source) => source.modulePath),
+  )];
+  const planSourceSlicer = new PlanSourceSliceProgram(
+    [...configuredModulePaths, ...frameworkPlanModulePaths],
+    cfgDir,
+  );
+  const routingFor = (domainKeys: readonly string[]) => {
     const wanted = new Set(domainKeys);
-    const decls = Object.fromEntries(Object.entries(openapiDeclsByDomain).filter(([key]) => wanted.has(key)));
+    const retain = (table: Readonly<Record<string, readonly string[]>> | undefined) =>
+      Object.fromEntries(
+        Object.entries(table ?? {}).flatMap(([id, domains]) => {
+          const selected = domains.filter((domain) => wanted.has(domain));
+          return selected.length === 0 ? [] : [[id, selected]];
+        }),
+      );
+    return {
+      derivedOf: retain(routing.derivedOf),
+      combinedOf: retain(routing.combinedOf),
+      aggregateInvariantOf: retain(routing.aggregateInvariantOf),
+      relationOf: retain(routing.relationOf),
+      workspaceInvariantOf: retain(routing.workspaceInvariantOf),
+      namespacedAggregatesOf: Object.fromEntries(
+        Object.entries(routing.namespacedAggregatesOf ?? {}).filter(([domain]) => wanted.has(domain)),
+      ),
+      qualifiableRelationsOf: Object.fromEntries(
+        Object.entries(routing.qualifiableRelationsOf ?? {}).filter(([domain]) => wanted.has(domain)),
+      ),
+      relationNamespaceOf: Object.fromEntries(
+        Object.entries(relationNamespaceOf).filter(([domain]) => wanted.has(domain)),
+      ),
+    };
+  };
+  const planEntrySource = (
+    domainKeys: readonly string[],
+    includeReports: boolean,
+    includeDescribe: boolean,
+    sourceOverrides: ReadonlyMap<string, string> = new Map(),
+    includePreloads = true,
+    routingOverride?: Record<string, unknown>,
+    routedDomainFallback?: string,
+    includeMintInstalls = true,
+    sharedRuntime = false,
+  ): string => {
     return [
       `// AUTO-GENERATED Nomos plan asset from ${path.basename(configPath)} — do not edit.`,
       `declare function require(id: string): Record<string, unknown>;`,
-      ...zodSeedImports,
+      ...(sharedRuntime ? [] : zodSeedImports),
       `import { registerEngine } from "@githolon/dsl/engine-entry";`,
       ``,
       `registerEngine({`,
       `  domains: {`,
       ...domainKeys.map((key) => {
-        const source = entryDomainSourceByKey.get(key);
+        const source = sourceOverrides.get(key) ?? entryDomainSourceByKey.get(key);
         if (source === undefined) throw new Error(`missing generated entry source for '${key}'`);
         return source;
       }),
       `  },`,
+      ...(includePreloads ? (() => {
+        const preloads = domainKeys.flatMap((key) => {
+          const source = entryPreloadSourceByKey.get(key);
+          return source === undefined ? [] : [source];
+        });
+        return preloads.length === 0 ? [] : [`  preloads: {`, ...preloads, `  },`];
+      })() : []),
       ...(includeReports && entryReports.length > 0 ? [`  reports: {`, ...entryReports, `  },`] : []),
-      `  routing: ${JSON.stringify(routing)},`,
-      ...(zodSeedNames.length > 0 ? [`  seeds: [${zodSeedNames.join(", ")}],`] : []),
-      ...(Object.keys(decls).length > 0 ? [`  openapiDecls: ${JSON.stringify(decls)},`] : []),
-      `  packageTitle: ${JSON.stringify(`${cfg.name} (nomos package)`)},`,
+      `  routing: ${JSON.stringify(routingOverride ?? routingFor(domainKeys))},`,
+      ...(routedDomainFallback === undefined
+        ? []
+        : [`  routedDomainFallback: ${JSON.stringify(routedDomainFallback)},`]),
+      ...(!sharedRuntime && zodSeedNames.length > 0 ? [`  seeds: [${zodSeedNames.join(", ")}],`] : []),
+      ...(includeDescribe ? [`  openapiDocument: ${JSON.stringify(runtimeOpenApiDocument)},`] : []),
+      ...(includeDescribe ? [`  packageTitle: ${JSON.stringify(`${cfg.name} (nomos package)`)},`] : []),
       `});`,
-      ...domainKeys.flatMap((key) => {
-        const install = entryMintInstallByKey.get(key);
-        return install === undefined ? [] : [install];
-      }),
+      ...(includeMintInstalls
+        ? domainKeys.flatMap((key) => {
+            const install = entryMintInstallByKey.get(key);
+            return install === undefined ? [] : [install];
+          })
+        : []),
       ``,
     ].join("\n");
   };
-  const compilePlan = (domainKeys: readonly string[], includeReports: boolean): UsdPlanAsset => {
+  const sharedPrivateRuntimeModules = [...new Set([
+    ...configuredModulePaths,
+    ...frameworkPlanModulePaths,
+  ])]
+    .filter((modulePath) => modulePath.startsWith(path.join(DSL_DIR, "src") + path.sep))
+    .sort()
+    .map((source) => ({
+      id: `nomos:runtime-source/${path.relative(path.join(DSL_DIR, "src"), source)
+        .replaceAll(path.sep, "/")
+        .replace(/\.[^.]+$/, "")}`,
+      source,
+    }));
+  const publicRuntimeCandidates = [
+    "@githolon/dsl",
+    "@githolon/dsl/framework/workspaces",
+    "@githolon/dsl/workspace-sharding",
+    "zod",
+  ] as const;
+  const authoredRuntimeImports = planSourceSlicer.externalRuntimeImports(publicRuntimeCandidates);
+  const sharedRuntimeModules: Array<{
+    readonly id: string;
+    readonly source: string;
+    /** Undefined retains a complete namespace; named exports let esbuild erase build-only code. */
+    readonly exports?: readonly string[];
+  }> = [
+    ...publicRuntimeCandidates.flatMap((id) => {
+      const used = authoredRuntimeImports.get(id);
+      return used === undefined ? [] : [{ id, source: id, ...(used === null ? {} : { exports: used }) }];
+    }),
+    // registerEngine is compiler-emitted into every plan entry, rather than imported by tenant
+    // source, so declare its one authenticated runtime symbol explicitly.
+    { id: "@githolon/dsl/engine-entry", source: "@githolon/dsl/engine-entry", exports: ["registerEngine"] },
+    ...sharedPrivateRuntimeModules,
+  ];
+  const sharedRuntimeModuleIds = sharedRuntimeModules.map((module) => module.id);
+  const sharedPlanEntrySource = (source: string): string => {
+    let rewritten = source;
+    for (const module of sharedPrivateRuntimeModules) {
+      rewritten = rewritten.replaceAll(JSON.stringify(module.source), JSON.stringify(module.id));
+    }
+    return rewritten;
+  };
+  let sharedRuntimeProfileBytes: number | undefined;
+  let sharedRuntimeProfileJavascript: string | undefined;
+  let sharedRuntimeProfileInputs:
+    | readonly { readonly module: string; readonly bytesInOutput: number }[]
+    | undefined;
+  const compileSharedRuntimeProfile = async (): Promise<number> => {
+    if (sharedRuntimeProfileBytes !== undefined) return sharedRuntimeProfileBytes;
+    const sourcePath = path.join(outDir, ".nomos_shared_runtime_profile.ts");
+    const bindings = sharedRuntimeModules.map((_module, index) => `__module${index}`);
+    writeFileSync(sourcePath, [
+      `// Diagnostic prototype only: the authenticated package-shared runtime proposed for typed USDA custody.`,
+      ...sharedRuntimeModules.map((module, index) => module.exports === undefined
+        ? `import * as ${bindings[index]} from ${JSON.stringify(module.source)};`
+        : `import { ${module.exports.map((name, exportIndex) =>
+            `${name} as ${bindings[index]}_${exportIndex}`).join(", ")} } from ${JSON.stringify(module.source)};`),
+      ...sharedRuntimeModules.flatMap((module, index) => module.exports === undefined
+        ? []
+        : [`const ${bindings[index]} = Object.freeze({ ${module.exports.map((name, exportIndex) =>
+            `${JSON.stringify(name)}: ${bindings[index]}_${exportIndex}`).join(", ")} });`]),
+      `const __modules: Record<string, Record<string, unknown>> = Object.freeze({`,
+      ...sharedRuntimeModules.map((module, index) =>
+        `  ${JSON.stringify(module.id)}: ${bindings[index]},`),
+      `});`,
+      `Object.defineProperty(globalThis, "require", {`,
+      `  configurable: false, enumerable: false, writable: false,`,
+      `  value: (id: string): Record<string, unknown> => {`,
+      `    const found = __modules[id];`,
+      `    if (found === undefined) throw new Error(\`unknown authenticated runtime module '\${id}'\`);`,
+      `    return found;`,
+      `  },`,
+      `});`,
+      ``,
+    ].join("\n"), "utf8");
+    const result = await esbuildMod.build({
+      entryPoints: [sourcePath],
+      absWorkingDir: cfgDir,
+      bundle: true,
+      write: false,
+      format: "iife",
+      target: "es2020",
+      platform: "neutral",
+      charset: "utf8",
+      define: { __nmsRuntimeLaw: "true" },
+      alias: { "zod/v4": runtimeZodV4Path, zod: runtimeZodPath },
+      minify: compact,
+      metafile: process.env.NOMOS_PROFILE_PLANS === "1",
+      logLevel: "silent",
+    });
+    rmSync(sourcePath, { force: true });
+    const output = result.outputFiles?.[0];
+    if (output === undefined) fail("shared runtime profile produced no JavaScript output");
+    sharedRuntimeProfileJavascript = canonicalizeEngineJavascript(output.text.trimEnd() + "\n");
+    sharedRuntimeProfileBytes = Buffer.byteLength(sharedRuntimeProfileJavascript, "utf8");
+    if (result.metafile !== undefined) {
+      const emitted = Object.values(result.metafile.outputs)[0]?.inputs ?? {};
+      sharedRuntimeProfileInputs = Object.entries(emitted)
+        .map(([module, contribution]) => ({
+          module,
+          bytesInOutput: contribution.bytesInOutput,
+        }))
+        .sort((left, right) => right.bytesInOutput - left.bytesInOutput || left.module.localeCompare(right.module));
+    }
+    return sharedRuntimeProfileBytes;
+  };
+  const compilePlan = async (
+    domainKeys: readonly string[],
+    includeReports: boolean,
+    includeDescribe: boolean,
+    options: {
+      readonly sourceOverrides?: ReadonlyMap<string, string>;
+      readonly sliceTargets?: readonly PlanSourceSliceTarget[];
+      readonly includePreloads?: boolean;
+      readonly cacheKey?: string;
+      readonly routingOverride?: Record<string, unknown>;
+      readonly routedDomainFallback?: string;
+      readonly includeMintInstalls?: boolean;
+    } = {},
+  ): Promise<UsdPlanAsset> => {
     const ordered = orderedDomainKeys.filter((key) => domainKeys.includes(key));
-    const signature = JSON.stringify({ domains: ordered, reports: includeReports });
+    const signature = JSON.stringify({
+      domains: ordered,
+      reports: includeReports,
+      describe: includeDescribe,
+      slice: options.sliceTargets?.map((target) => [target.modulePath, target.exportName]) ?? null,
+      cacheKey: options.cacheKey ?? null,
+    });
     const hit = planBySignature.get(signature);
     if (hit !== undefined) return hit;
-    const sourcePath = path.join(outDir, `.nomos_plan_${planSequence++}.ts`);
-    writeFileSync(sourcePath, planEntrySource(ordered, includeReports), "utf8");
-    const args = [
-      sourcePath,
-      "--bundle", "--format=iife", "--target=es2020", "--platform=neutral", "--charset=utf8",
-      "--define:__nmsRuntimeLaw=true",
-      ...(compact ? ["--minify"] : []),
-    ];
-    let bundled = execFileSync(esbuildBin, args, {
-      encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], cwd: cfgDir, maxBuffer: 256 * 1024 * 1024,
-    }).trimEnd() + "\n";
-    bundled = canonicalizeEngineJavascript(bundled);
-    if (!/globalThis\.plan\s*=/.test(bundled) && !/globalThis\["plan"\]\s*=/.test(bundled)) {
-      fail(`generated plan asset does not assign globalThis.plan — refusing to package`);
+    await compileSharedRuntimeProfile();
+    const entrySource = sharedPlanEntrySource(planEntrySource(
+        ordered,
+        includeReports,
+        includeDescribe,
+        options.sourceOverrides,
+        options.includePreloads ?? options.sliceTargets === undefined,
+        options.routingOverride,
+        options.routedDomainFallback,
+        options.includeMintInstalls ?? true,
+        true,
+      ));
+    let planProfile: readonly { readonly module: string; readonly bytesInOutput: number }[] | undefined;
+    const profilePlan = process.env.NOMOS_PROFILE_PLANS === "1";
+    const runtimeSha256 = sha256HexUtf8(sharedRuntimeProfileJavascript!);
+    const baseIdentity = sha256HexUtf8([
+      planCompilerIdentity,
+      runtimeSha256,
+      path.resolve(cfgDir),
+      compact ? "compact" : "readable",
+      signature,
+      entrySource,
+    ].join("\0"));
+    const cachePlanPath = path.join(planCacheDir, `${baseIdentity}.mjs`);
+    const cacheProofPath = path.join(planCacheDir, `${baseIdentity}.proof.usda`);
+    const cached = profilePlan ? undefined : planProofCodec.readPlanCompileProof({
+      proofPath: cacheProofPath,
+      baseIdentity,
+      runtimeSha256,
+      digestFile: planInputDigest,
+    });
+    let bundled: string;
+    if (cached !== undefined) {
+      bundled = cached.javascript;
+    } else {
+      const sourcePath = path.join(outDir, `.nomos_plan_${planSequence++}.ts`);
+      writeFileSync(sourcePath, entrySource, "utf8");
+      const result = await esbuildMod.build({
+        entryPoints: [sourcePath],
+        absWorkingDir: cfgDir,
+        bundle: true,
+        write: false,
+        format: "iife",
+        target: "es2020",
+        platform: "neutral",
+        charset: "utf8",
+        define: { __nmsRuntimeLaw: "true" },
+        minify: compact,
+        external: [...sharedRuntimeModuleIds],
+        metafile: true,
+        logLevel: "silent",
+        ...(options.sliceTargets === undefined
+          ? {}
+          : { plugins: [planSourceSlicer.plugin(options.sliceTargets)] }),
+      });
+      rmSync(sourcePath, { force: true });
+      const output = result.outputFiles?.[0];
+      if (output === undefined) fail("shared-runtime plan compile produced no JavaScript output");
+      bundled = canonicalizeEngineJavascript(output.text.trimEnd() + "\n");
+      const emitted = Object.values(result.metafile.outputs)[0]?.inputs ?? {};
+      if (profilePlan) {
+        planProfile = Object.entries(emitted)
+          .map(([module, contribution]) => ({
+            module,
+            bytesInOutput: contribution.bytesInOutput,
+          }))
+          .sort((left, right) => right.bytesInOutput - left.bytesInOutput || left.module.localeCompare(right.module));
+      }
+      const inputs = Object.keys(emitted)
+        .map((module) => path.isAbsolute(module) ? module : path.resolve(cfgDir, module))
+        .filter((file) => path.resolve(file) !== path.resolve(sourcePath) && existsSync(file))
+        .map((file) => ({ path: file, sha256: planInputDigest(file) }))
+        .sort((left, right) => left.path.localeCompare(right.path));
+      if (inputs.length > 0) {
+        mkdirSync(planCacheDir, { recursive: true });
+        const temporary = `${cachePlanPath}.tmp-${process.pid}`;
+        writeFileSync(temporary, bundled, "utf8");
+        renameSync(temporary, cachePlanPath);
+        planProofCodec.writePlanCompileProof({
+          proofPath: cacheProofPath,
+          baseIdentity,
+          runtimeSha256,
+          plan: cachePlanPath,
+          planSha256: sha256HexUtf8(bundled),
+          inputs,
+        });
+      }
+    }
+    const planBytes = Buffer.byteLength(bundled, "utf8");
+    // The authenticated base owns registerEngine/globalThis.plan; the selected plan is deliberately
+    // incomplete alone. Kernel execution evaluates the content-addressed base bytecode first, then
+    // this plan bytecode in the same fresh sandbox.
+    const sha256 = sha256HexUtf8(bundled);
+    const duplicate = planByHash.get(sha256);
+    if (duplicate !== undefined) {
+      planBySignature.set(signature, duplicate);
+      return duplicate;
     }
-    const asset = { sha256: sha256HexUtf8(bundled), javascript: bundled };
+    const asset = {
+      sha256,
+      javascript: bundled,
+      runtimeSha256,
+      ...(planProfile === undefined ? {} : { profile: planProfile }),
+      sharedRuntimeProfileBytes: planBytes,
+      sharedRuntimeProfileJavascript: bundled,
+    };
     planBySignature.set(signature, asset);
+    planByHash.set(sha256, asset);
     planAssets.push(asset);
     return asset;
   };
-  const routePlan = (selector: string, domainKeys: readonly string[], includeReports = false): void => {
-    const asset = compilePlan(domainKeys, includeReports);
+  const routePlan = async (
+    selector: string,
+    domainKeys: readonly string[],
+    includeReports = false,
+    includeDescribe = false,
+  ): Promise<void> => {
+    const asset = await compilePlan(domainKeys, includeReports, includeDescribe);
     planRoutes.push({ selector, planSha256: asset.sha256 });
   };
-  for (const key of orderedDomainKeys) routePlan(`plan:domain:${key}`, [key]);
-  routePlan("describe", orderedDomainKeys);
-  for (const reportId of Object.keys(cfg.reports ?? {})) routePlan(`report:report:${reportId}`, [], true);
-  const routeTable = (
+  const routeAsset = (selector: string, asset: UsdPlanAsset): void => {
+    planRoutes.push({ selector, planSha256: asset.sha256 });
+  };
+  const domainPlanByKey = new Map<string, UsdPlanAsset>();
+  const aggregateInvariantPlanOverrides = new Map<string, UsdPlanAsset>();
+  const workspaceInvariantPlanOverrides = new Map<string, UsdPlanAsset>();
+  const retainGeneratedInvariantRoutes = (
+    domain: string,
+    directiveId: string,
+    asset: UsdPlanAsset,
+  ): void => {
+    const directive = executableDirectivesByDomain.get(domain)?.get(directiveId);
+    if (directive === undefined) return;
+    for (const invariant of [
+      ...synthesizePreconditionInvariants(directive),
+      ...synthesizeBirthQuotaInvariants(directive),
+    ]) {
+      // These bodies are pure compiler desugarings of this directive and are reconstructed by
+      // buildDomainSlice from the exact offer plan. Hand-authored invariant exports are deliberately
+      // excluded: they retain their independently addressed source ownership.
+      if (!nativeWorkspaceInvariantIds.has(invariant.id)) {
+        workspaceInvariantPlanOverrides.set(invariant.id, asset);
+      }
+    }
+  };
+  for (const key of orderedDomainKeys) {
+    const asset = await compilePlan([key], false, false);
+    domainPlanByKey.set(key, asset);
+    routeAsset(`plan:domain:${key}`, asset);
+  }
+
+  // Public offers are addressed more narrowly than domains. Split direct TypeScript exports by
+  // authored source span, then symbol-slice each shard so one large domain file cannot impose one
+  // uninterruptible module initializer on every intent. The threshold is source-proportional rather
+  // than an arbitrary object count; framework-generated/unaddressable directives safely retain the
+  // domain plan while still receiving an explicit offer route.
+  const OFFER_SHARD_SOURCE_SPAN_BYTES = 8 * 1024;
+  // Generated JavaScript closure bytes are a better proxy for parse/init work than declaration count.
+  // Start with source-local shards to avoid quadratic compiles, then recursively split any executable
+  // closure above this ceiling. A single irreducible offer is retained and remains visible to profiling.
+  // Current CO2 evidence shows source initialization, not transport size alone, is the limiting
+  // quantum: a 115 KiB estate shard can still take >200 ms when it initializes many Zod/directive
+  // graphs together. Keep grouped offer closures below 48 KiB and split authored source spans at
+  // 8 KiB; an irreducible single offer remains explicit and attributable instead of being hidden
+  // inside a domain-wide fallback.
+  const OFFER_PLAN_MAX_UTF8_BYTES = 48 * 1024;
+  for (const domain of orderedDomainKeys) {
+    const fallback = domainPlanByKey.get(domain)!;
+    const exports = offerSourceExportsByDomain.get(domain) ?? new Map();
+    const routed = new Set<string>();
+
+    // Business-birth lowering injects several framework offers which execute as one child-genesis
+    // transaction. Compile their typed source closures into one shared plan: preparing any one exact
+    // route makes the whole compiler-owned genesis vocabulary resident, while every selector remains
+    // independently authenticated by the kernel. A missing source is a compiler error, never a slow
+    // whole-domain fallback.
+    const frameworkTargets = [...(executableDirectiveIdsByDomain.get(domain) ?? [])]
+      .flatMap((directiveId) => {
+        const target = BUSINESS_BIRTH_FRAMEWORK_PLAN_SOURCES[directiveId];
+        return target === undefined ? [] : [{ directiveId, ...target }];
+      });
+    if (frameworkTargets.length > 0) {
+      const selectedModules = new Map<string, Array<{ directiveId: string; exportName: string }>>();
+      for (const target of frameworkTargets) {
+        const entries = selectedModules.get(target.modulePath) ?? [];
+        entries.push({ directiveId: target.directiveId, exportName: target.exportName });
+        selectedModules.set(target.modulePath, entries);
+      }
+      const selectedSources = [...selectedModules].map(([modulePath, entries]) =>
+        `() => ({${entries.map((entry) =>
+          `${JSON.stringify(entry.exportName)}: require(${JSON.stringify(modulePath)})[${JSON.stringify(entry.exportName)}]`).join(", ")}})`,
+      );
+      const source = `    ${JSON.stringify(BUSINESS_BIRTH_FRAMEWORK_PLAN_DOMAIN)}: [${selectedSources.join(", ")}],`;
+      const asset = await compilePlan([domain], false, false, {
+        sourceOverrides: new Map([[domain, source]]),
+        includePreloads: false,
+        cacheKey: "business-birth-framework",
+        routingOverride: { relationNamespaceOf },
+        routedDomainFallback: BUSINESS_BIRTH_FRAMEWORK_PLAN_DOMAIN,
+        includeMintInstalls: false,
+      });
+      for (const target of frameworkTargets) {
+        routeAsset(`plan:offer:${domain}:${target.directiveId}`, asset);
+        retainGeneratedInvariantRoutes(domain, target.directiveId, asset);
+        routed.add(target.directiveId);
+      }
+    }
+    const byModule = new Map<string, Array<{
+      directiveId: string;
+      exportName: string;
+      aggregateId: string;
+      position: number;
+    }>>();
+    for (const [directiveId, source] of exports) {
+      if (routed.has(directiveId)) continue;
+      const position = planSourceSlicer.exportPosition({
+        modulePath: source.modulePath,
+        exportName: source.exportName,
+      });
+      if (position === undefined) continue;
+      const entries = byModule.get(source.modulePath) ?? [];
+      entries.push({ directiveId, exportName: source.exportName, aggregateId: source.aggregateId, position });
+      byModule.set(source.modulePath, entries);
+    }
+    for (const [modulePath, entries] of byModule) {
+      entries.sort((left, right) => left.position - right.position || left.directiveId.localeCompare(right.directiveId));
+      const shards: typeof entries[] = [];
+      let current: typeof entries = [];
+      let shardStart = 0;
+      for (const entry of entries) {
+        if (current.length > 0 && entry.position - shardStart >= OFFER_SHARD_SOURCE_SPAN_BYTES) {
+          shards.push(current);
+          current = [];
+        }
+        if (current.length === 0) shardStart = entry.position;
+        current.push(entry);
+      }
+      if (current.length > 0) shards.push(current);
+      const compileOfferShard = async (shard: typeof entries): Promise<void> => {
+        const selected: PlanSourceSliceTarget[] = shard.map((entry) => ({
+          modulePath,
+          exportName: entry.exportName,
+        }));
+        const selectedModule = `() => ({${shard.map((entry) =>
+          `${JSON.stringify(entry.exportName)}: require(${JSON.stringify(modulePath)})[${JSON.stringify(entry.exportName)}]`).join(", ")}})`;
+        const generated = entryGeneratedSourceExprsByKey.get(domain) ?? [];
+        const source = `    ${JSON.stringify(domain)}: [${[selectedModule, ...generated].join(", ")}],`;
+        const asset = await compilePlan([domain], false, false, {
+          sourceOverrides: new Map([[domain, source]]),
+          sliceTargets: selected,
+        });
+        if (shard.length > 1 && Buffer.byteLength(asset.javascript, "utf8") > OFFER_PLAN_MAX_UTF8_BYTES) {
+          const midpoint = (shard[0]!.position + shard[shard.length - 1]!.position) / 2;
+          let splitAt = shard.findIndex((entry) => entry.position >= midpoint);
+          if (splitAt <= 0 || splitAt >= shard.length) splitAt = Math.ceil(shard.length / 2);
+          await compileOfferShard(shard.slice(0, splitAt));
+          await compileOfferShard(shard.slice(splitAt));
+          return;
+        }
+        for (const entry of shard) {
+          routeAsset(`plan:offer:${domain}:${entry.directiveId}`, asset);
+          retainGeneratedInvariantRoutes(domain, entry.directiveId, asset);
+          if (entry.directiveId.startsWith("nomosSeed")) {
+            // The generated seed writes the born aggregate immediately. Its `.fromBirth()` / user
+            // aggregate invariant is part of the same authored symbol closure, so route that first
+            // gate check through the already-warmed slice instead of cold-loading the whole domain.
+            aggregateInvariantPlanOverrides.set(entry.aggregateId, asset);
+            aggregateInvariantPlanOverrides.set(`${domain}.${entry.aggregateId}`, asset);
+          }
+          routed.add(entry.directiveId);
+        }
+      };
+      for (const shard of shards) await compileOfferShard(shard);
+    }
+    for (const directiveId of executableDirectiveIdsByDomain.get(domain) ?? []) {
+      if (!routed.has(directiveId)) routeAsset(`plan:offer:${domain}:${directiveId}`, fallback);
+    }
+  }
+  // Hand-authored workspace invariants are independently addressable law too. The previous
+  // fallback compiled their entire domain merely to run one `reads`/`assert` pair, even though
+  // offer compilation already knows how to retain one authored export closure. Build that exact
+  // symbol slice here for invariants which could not ride their guarded offer's plan.
+  // When `language(...)` remapped private effect invariants onto public intents, retain only those
+  // public intent exports and reconstruct that language so the existing remapping machinery remains
+  // the sole owner of payload adaptation.
+  for (const domain of orderedDomainKeys) {
+    const byDirective = new Map<string, Array<[
+      string,
+      {
+        readonly on: string;
+        readonly modulePath: string;
+        readonly exportName: string;
+        readonly remappedIntent?: PlanSourceSliceTarget;
+      },
+    ]>>();
+    for (const entry of workspaceInvariantSourceExportsByDomain.get(domain) ?? []) {
+      const members = byDirective.get(entry[1].on) ?? [];
+      members.push(entry);
+      byDirective.set(entry[1].on, members);
+    }
+    for (const [directiveId, unsortedMembers] of byDirective) {
+      // Every invariant firing on one offer is evaluated consecutively. Give those routes one
+      // compiled slice so the kernel boots the shared DSL/module closure once and re-arms the
+      // same resident sandbox for each bounded reads/assert pair. Per-invariant plans duplicated
+      // that closure and paid one QuickJS heap boot per predicate on the offer flame path.
+      const members = unsortedMembers.sort(([left], [right]) => left.localeCompare(right));
+      const selectedByKey = new Map<string, PlanSourceSliceTarget>();
+      const selected = (target: PlanSourceSliceTarget): void => {
+        selectedByKey.set(`${target.modulePath}\0${target.exportName}`, target);
+      };
+      for (const [, source] of members) {
+        selected(source);
+        if (source.remappedIntent !== undefined) selected(source.remappedIntent);
+      }
+      const invariantProperties = members.map(([invariantId, source], index) =>
+        `${JSON.stringify(`nmsInvariant${index}_${invariantId}`)}: require(${JSON.stringify(source.modulePath)})[${JSON.stringify(source.exportName)}]`
+      );
+      const remappedIntents = [...new Map(
+        members.flatMap(([, source]) => source.remappedIntent === undefined
+          ? []
+          : [[`${source.remappedIntent.modulePath}\0${source.remappedIntent.exportName}`, source.remappedIntent] as const]),
+      ).values()];
+      const languageProperty = remappedIntents.length === 0
+        ? []
+        : [`__nomosInvariantLanguage: require("@githolon/dsl").language(${JSON.stringify(domain)}, [${remappedIntents.map((intent) =>
+          `require(${JSON.stringify(intent.modulePath)})[${JSON.stringify(intent.exportName)}]`
+        ).join(", ")}])`];
+      const moduleExpression = `() => ({${[...invariantProperties, ...languageProperty].join(", ")}})`;
+      const domainSource = `    ${JSON.stringify(domain)}: [${moduleExpression}],`;
+      const asset = await compilePlan([domain], false, false, {
+        sourceOverrides: new Map([[domain, domainSource]]),
+        sliceTargets: [...selectedByKey.values()],
+        cacheKey: `workspace-invariants:${directiveId}:${members.map(([id]) => id).join(",")}`,
+      });
+      for (const [invariantId] of members) {
+        workspaceInvariantPlanOverrides.set(invariantId, asset);
+      }
+    }
+  }
+  await routePlan("describe", orderedDomainKeys, false, true);
+  for (const reportId of Object.keys(cfg.reports ?? {})) await routePlan(`report:report:${reportId}`, [], true);
+  const routeTable = async (
     prefix: string,
     table: Readonly<Record<string, readonly string[]>> | undefined,
-  ): void => {
-    for (const [id, domains] of Object.entries(table ?? {})) routePlan(`${prefix}${id}`, domains);
+  ): Promise<void> => {
+    for (const [id, domains] of Object.entries(table ?? {})) await routePlan(`${prefix}${id}`, domains);
   };
-  routeTable("report:derive:", routing.derivedOf);
-  routeTable("report:combine:", routing.combinedOf);
-  routeTable("report:aggregateInvariant:", routing.aggregateInvariantOf);
-  routeTable("report:invariant:", routing.relationOf);
-  routeTable("report:workspaceInvariantReads:", routing.workspaceInvariantOf);
-  routeTable("report:workspaceInvariant:", routing.workspaceInvariantOf);
-  const workspaceInvariantDomains = [...new Set(Object.values(routing.workspaceInvariantOf ?? {}).flat())];
-  if (workspaceInvariantDomains.length > 0) {
-    routePlan("report:workspaceInvariantList", workspaceInvariantDomains);
+  await routeTable("report:derive:", routing.derivedOf);
+  await routeTable("report:combine:", routing.combinedOf);
+  for (const [id, domains] of Object.entries(routing.aggregateInvariantOf ?? {})) {
+    const override = aggregateInvariantPlanOverrides.get(id);
+    if (override !== undefined) routeAsset(`report:aggregateInvariant:${id}`, override);
+    else await routePlan(`report:aggregateInvariant:${id}`, domains);
+  }
+  await routeTable("report:invariant:", routing.relationOf);
+  for (const [id, domains] of Object.entries(routing.workspaceInvariantOf ?? {})) {
+    // Typed native evaluators are complete USDA custody interpreted by Rust. Emitting an engine route
+    // for them is not merely redundant: it falsely advertises a JavaScript fallback and keeps dead law
+    // reachable. A malformed/unknown native evaluator fails closed while parsing the installed stage.
+    if (nativeWorkspaceInvariantIds.has(id)) continue;
+    const override = workspaceInvariantPlanOverrides.get(id);
+    if (override !== undefined) {
+      if (!nativeWorkspaceInvariantReadIds.has(id)) {
+        routeAsset(`report:workspaceInvariantReads:${id}`, override);
+      }
+      routeAsset(`report:workspaceInvariant:${id}`, override);
+    } else {
+      if (!nativeWorkspaceInvariantReadIds.has(id)) {
+        await routePlan(`report:workspaceInvariantReads:${id}`, domains);
+      }
+      await routePlan(`report:workspaceInvariant:${id}`, domains);
+    }
+  }
+  // Adaptive offer splitting deliberately compiles candidate parents before retaining their children.
+  // Only route-reachable content is custody; exploratory compiler work never becomes law bytes.
+  const routedPlanHashes = new Set(planRoutes.map((route) => route.planSha256));
+  const routedPlanAssets = planAssets.filter((asset) => routedPlanHashes.has(asset.sha256));
+  const javascriptWorkspaceInvariantReadIds = [...new Set(
+    planRoutes
+      .map((route) => route.selector)
+      .filter((selector) => selector.startsWith("report:workspaceInvariantReads:"))
+      .map((selector) => selector.slice("report:workspaceInvariantReads:".length)),
+  )].sort();
+  const rustWorkspaceInvariantReadIds = [...nativeWorkspaceInvariantReadIds].sort();
+  if (process.env.NOMOS_PROFILE_PLANS === "1") {
+    const routesByPlan = new Map<string, string[]>();
+    for (const route of planRoutes) {
+      const selectors = routesByPlan.get(route.planSha256) ?? [];
+      selectors.push(route.selector);
+      routesByPlan.set(route.planSha256, selectors);
+    }
+    const profilePath = path.join(outDir, "plan-profile.json");
+    writeFileSync(profilePath, JSON.stringify({
+      package: cfg.name,
+      sharedRuntime: sharedRuntimeProfileBytes === undefined ? null : {
+        sourceBytes: sharedRuntimeProfileBytes,
+        modules: sharedRuntimeModuleIds,
+        inputs: sharedRuntimeProfileInputs ?? [],
+      },
+      workspaceInvariantReads: {
+        rustLoweredIds: rustWorkspaceInvariantReadIds,
+        javascriptFallbackIds: javascriptWorkspaceInvariantReadIds,
+      },
+      plans: routedPlanAssets
+        .map((asset) => ({
+          sha256: asset.sha256,
+          sourceBytes: Buffer.byteLength(asset.javascript, "utf8"),
+          sharedRuntimeSourceBytes: asset.sharedRuntimeProfileBytes ?? null,
+          routes: [...(routesByPlan.get(asset.sha256) ?? [])].sort(),
+          inputs: asset.profile ?? [],
+        }))
+        .sort((left, right) => right.sourceBytes - left.sourceBytes || left.sha256.localeCompare(right.sha256)),
+    }, null, 2) + "\n", "utf8");
+    console.error(`  plans      ${profilePath} (diagnostic only; excluded from custody)`);
   }
 
   // ── 1a. THE CAPTURED-READ GATE (#57, lifted-when-declared since #58) ──
@@ -3405,7 +4489,7 @@ async function main(): Promise<void> {
         ((d as { declaredForeignReads?: unknown[] }).declaredForeignReads ?? []).length > 0,
     ),
   );
-  if (planAssets.some((asset) => asset.javascript.includes(CAPTURED_READ_LUMP_MARKER)) && !declaresCapturedReads) {
+  if (routedPlanAssets.some((asset) => asset.javascript.includes(CAPTURED_READ_LUMP_MARKER)) && !declaresCapturedReads) {
     fail(
       `this law references read() — the CAPTURED-READ lane — but NO directive declares a ` +
         `captured-read query, so the sealed engine would provide no nomos.read and every ` +
@@ -3446,207 +4530,218 @@ async function main(): Promise<void> {
   // fresh frozen context, then force every domain — and refuse to package on any
   // failure that is not the expected unknown-directive refusal.
   {
-    // A CHILD process: the probe must freeze a REAL global object (a `vm` context
-    // global refuses Object.freeze), and the lump must run STRICT (the engine
-    // evals it with the STRICT flag — sloppy mode would silently no-op the very
-    // frozen-global writes the probe exists to catch).
+    // Worker isolates in ONE child process: every plan must still freeze a REAL
+    // global object (a `vm` context global refuses Object.freeze), and the lump
+    // must run STRICT (the engine evals it with the STRICT flag — sloppy mode
+    // would silently no-op the very frozen-global writes the probe exists to
+    // catch). A prior implementation started one OS process per plan, serially;
+    // on substantial law that made process startup, rather than law checking,
+    // the dominant compile cost.
     const probePath = path.join(outDir, ".nomos_boot_probe.cjs");
     writeFileSync(
       probePath,
       [
         `// AUTO-GENERATED by nomos-compile — the frozen-sandbox lazy-boot probe.`,
         `const fs = require("node:fs");`,
-        `const plan = fs.readFileSync(process.argv[2], "utf8");`,
-        `const key = process.argv[3];`,
-        `(0, eval)('"use strict";\\n' + plan); // indirect eval → real global scope, strict like the engine`,
-        `Object.freeze(globalThis);            // the sealed sandbox freezes before dispatch`,
-        `let msg;`,
-        `try { globalThis.plan({ intent: { domain: key, directiveId: "__nomos_boot_probe__" } }); msg = "unexpected-success"; }`,
-        `catch (e) { msg = String((e && e.message) || e); }`,
-        `if (!/no directive registered/.test(msg)) { console.error(key + "\\u0000" + msg); process.exit(3); }`,
+        `const os = require("node:os");`,
+        `const { Worker, isMainThread, parentPort, workerData } = require("node:worker_threads");`,
+        `if (!isMainThread) {`,
+        `  const plan = fs.readFileSync(workerData.planPath, "utf8");`,
+        `  try {`,
+        `    (0, eval)('"use strict";\\n' + plan); // indirect eval → real global scope, strict like the engine`,
+        `    Object.freeze(globalThis);            // the sealed sandbox freezes before dispatch`,
+        `    for (const [domain, directiveId] of workerData.checks) {`,
+        `      let found;`,
+        `      try { found = globalThis.__nomosHasDirective(domain, directiveId); }`,
+        `      catch (e) { parentPort.postMessage({ domain, error: String((e && e.message) || e) }); return; }`,
+        `      if (directiveId !== "" && found !== true) {`,
+        `        parentPort.postMessage({ domain, error: "routed offer '" + directiveId + "' is absent from its selected plan registry" });`,
+        `        return;`,
+        `      }`,
+        `    }`,
+        `    parentPort.postMessage({ ok: true });`,
+        `  } catch (e) {`,
+        `    parentPort.postMessage({ domain: workerData.checks[0]?.[0] || "?", error: String((e && e.message) || e) });`,
+        `  }`,
+        `} else {`,
+        `  const jobs = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));`,
+        `  const requested = Number(process.env.NOMOS_BOOT_PROBE_CONCURRENCY || os.availableParallelism());`,
+        `  const concurrency = Math.max(1, Math.min(jobs.length, Number.isFinite(requested) ? Math.floor(requested) : 1));`,
+        `  let cursor = 0;`,
+        `  let failure;`,
+        `  const run = (job) => new Promise((resolve) => {`,
+        `    const worker = new Worker(__filename, { workerData: job });`,
+        `    let result;`,
+        `    worker.once("message", (message) => { result = message; });`,
+        `    worker.once("error", (error) => { result = { domain: job.checks[0]?.[0] || "?", error: error.message }; });`,
+        `    worker.once("exit", (code) => resolve(result || { domain: job.checks[0]?.[0] || "?", error: "probe worker exited " + code + " without a result" }));`,
+        `  });`,
+        `  const drain = async () => {`,
+        `    while (failure === undefined) {`,
+        `      const index = cursor++;`,
+        `      if (index >= jobs.length) return;`,
+        `      const result = await run(jobs[index]);`,
+        `      if (result.ok !== true) failure = result;`,
+        `    }`,
+        `  };`,
+        `  Promise.all(Array.from({ length: concurrency }, () => drain())).then(() => {`,
+        `    if (failure !== undefined) {`,
+        `      console.error(failure.domain + "\\u0000" + failure.error);`,
+        `      process.exitCode = 3;`,
+        `    }`,
+        `  }).catch((error) => { console.error("?\\u0000" + error.message); process.exitCode = 3; });`,
+        `  }`,
         ``,
       ].join("\n"),
       "utf8",
     );
-    for (const route of planRoutes.filter((candidate) => candidate.selector.startsWith("plan:domain:"))) {
-      const domainKey = route.selector.slice("plan:domain:".length);
-      const asset = planAssets.find((candidate) => candidate.sha256 === route.planSha256)!;
+    const checksByPlan = new Map<string, Set<string>>();
+    const addCheck = (planSha256: string, domain: string, directiveId: string): void => {
+      const checks = checksByPlan.get(planSha256) ?? new Set<string>();
+      checks.add(`${domain}\0${directiveId}`);
+      checksByPlan.set(planSha256, checks);
+    };
+    for (const route of planRoutes) {
+      if (route.selector.startsWith("plan:domain:")) {
+        addCheck(route.planSha256, route.selector.slice("plan:domain:".length), "");
+        continue;
+      }
+      const match = /^plan:offer:([^:]+):(.+)$/.exec(route.selector);
+      if (match !== null) addCheck(route.planSha256, match[1]!, match[2]!);
+    }
+    const probeJobsPath = path.join(outDir, ".nomos_boot_jobs.json");
+    const probePlanPaths: string[] = [];
+    const probeJobs = [...checksByPlan].map(([planSha256, encodedChecks]) => {
+      const checks = [...encodedChecks].map((encoded) => {
+        const separator = encoded.indexOf("\0");
+        return [encoded.slice(0, separator), encoded.slice(separator + 1)] as const;
+      });
+      const asset = routedPlanAssets.find((candidate) => candidate.sha256 === planSha256)!;
       const planPath = path.join(outDir, `.nomos_boot_${planSequence++}.js`);
-      writeFileSync(planPath, asset.javascript, "utf8");
-      try {
-        execFileSync(process.execPath, [probePath, planPath, domainKey], {
-          encoding: "utf8", stdio: ["ignore", "ignore", "pipe"],
-        });
-      } catch (e) {
-        const stderr = String((e as { stderr?: string }).stderr ?? "").trim();
-        const [, msg = stderr] = stderr.includes("\u0000") ? stderr.split("\u0000") : ["?", stderr];
-        fail(
-          `domain '${domainKey}' failed its frozen-sandbox plan probe — a module initializer ` +
-            `touches ambient globals after the freeze (the engine would refuse its first dispatch): ${msg}`,
-        );
+      if (sharedRuntimeProfileJavascript === undefined) {
+        fail("canonical shared runtime was not compiled before the boot probe");
       }
+      writeFileSync(planPath, sharedRuntimeProfileJavascript + asset.javascript, "utf8");
+      probePlanPaths.push(planPath);
+      return { planPath, checks };
+    });
+    writeFileSync(probeJobsPath, JSON.stringify(probeJobs), "utf8");
+    try {
+      execFileSync(process.execPath, [probePath, probeJobsPath], {
+        encoding: "utf8", stdio: ["ignore", "ignore", "pipe"],
+      });
+    } catch (e) {
+      const stderr = String((e as { stderr?: string }).stderr ?? "").trim();
+      const [domainKey = "?", msg = stderr] = stderr.includes("\u0000") ? stderr.split("\u0000") : ["?", stderr];
+      fail(
+        `domain '${domainKey}' failed its selected-plan registry probe — the compiler routed an ` +
+          `offer to a plan that cannot dispatch it, or a module initializer failed after the ` +
+          `sandbox freeze: ${msg}`,
+      );
+    } finally {
+      rmSync(probePath, { force: true });
+      rmSync(probeJobsPath, { force: true });
+      for (const planPath of probePlanPaths) rmSync(planPath, { force: true });
     }
   }
 
-  // ── 2. USD IR + the package envelope ──
-  const usdJson = emitUsdJsonForModules(domainModules);
-  const text = nativePlanPackageUsda(
+  // ── 2. Canonical typed USDA closure ──
+  // There is no flattened package and no JSON law intermediate. Sparse typed source opinions plus
+  // compiler-owned plan/framework layers are the package; composition is deferred to LawStage.
+  if (sharedRuntimeProfileJavascript === undefined) {
+    fail("canonical shared runtime was not compiled");
+  }
+  const sharedRuntimeAsset: UsdRuntimeAsset = {
+    sha256: sha256HexUtf8(sharedRuntimeProfileJavascript),
+    javascript: sharedRuntimeProfileJavascript,
+  };
+  const lawClosure = emitLawClosure(
     cfg.name,
-    JSON.parse(usdJson),
-    domainModules,
-    planAssets,
+    domainModules.map((module) => module.domain ?? module.name),
+    runtimeDependencies,
+    v3DomainAssets,
+    sharedRuntimeAsset,
+    routedPlanAssets,
     planRoutes,
   );
-  const pkgPath = path.join(outDir, `${cfg.name}.package.usda`);
-  const domainHash = sha256HexUtf8(text);
-
-  // ── 2a. the REAL layered RELATION `.usda` set — an additive, deterministic visualization +
-  //        cross-check artifact (usdview / `usdcat --flatten`). One sublayer per domain carrying its
-  //        relation opinions as PRIMS + a root with `subLayers` STRONGEST-FIRST; usdcat composes the
-  //        shared relation types, the compiler's `composeSharedRelationTypes` is the fail-closed guard
-  //        on top. Emitted iff ANY domain declares a relation type. Never feeds the package hash.
-  {
-    const relInputs: RelationLayerInput[] = [];
-    for (const mod of domainModules) {
-      // Per-domain UNCOMPOSED relation types: emit the single module alone (single-domain ⇒ no shared
-      // type ⇒ its own decls, un-unioned — the layers ARE the sublayers usdcat will compose).
-      const one = emitUsd([{ path: `/Nomos/${mod.domain ?? mod.name}`, module: mod }]);
-      const types = one.layers[0]?.nomosRelations?.types;
-      if (types !== undefined && Object.keys(types).length > 0) {
-        relInputs.push({ domain: mod.domain ?? mod.name, types });
-      }
-    }
-    if (relInputs.length > 0) {
-      const emit = emitLayeredRelationUsda(relInputs, cfg.name);
-      const relDir = path.join(outDir, `${cfg.name}.relation-layers`);
-      mkdirSync(relDir, { recursive: true });
-      for (const f of emit.files) writeFileSync(path.join(relDir, f.name), f.text, "utf8");
-      writeFileSync(path.join(relDir, "root.usda"), emit.root, "utf8");
-    }
+  // The composed USDA closure is the law. Generated clients, lifecycle rows and
+  // compatibility metadata all bind this identity, never the retired flattened envelope.
+  const domainHash = lawClosure.identity;
+  const lawClosureAssetsPath = path.join(outDir, `${cfg.name}.law`);
+  const lawUsdzPath = path.join(outDir, `${cfg.name}.law.usdz`);
+  rmSync(path.join(outDir, `${cfg.name}.law-closure.usda`), { force: true });
+  rmSync(path.join(outDir, `${cfg.name}.law-closure.assets`), { recursive: true, force: true });
+  rmSync(lawClosureAssetsPath, { recursive: true, force: true });
+  mkdirSync(lawClosureAssetsPath, { recursive: true });
+  for (const asset of lawClosure.assets) {
+    const assetPath = path.join(lawClosureAssetsPath, asset.logicalPath);
+    mkdirSync(path.dirname(assetPath), { recursive: true });
+    writeFileSync(assetPath, asset.bytes);
   }
-
-  // ── 2b. REQUIRED LAYERED emission — the executable envelope above retains the
-  //        canonical resolved law, while these are the authored/composable source layers. The
-  //        homomorphism is ASSERTED fail-closed on every compile: the
-  //        per-module layer stack must resolve to the same canonical law embedded
-  //        in the package, or compilation refuses.
-  let layeredRootPath: string | undefined;
-  let layeredFileCount = 0;
+  const rootAsset = lawClosure.assets.find((asset) => asset.logicalPath === lawClosure.rootLogicalPath);
+  if (rootAsset === undefined) fail("v3 closure: root.usda is missing from the emitted law stage");
+  const lawUsdz = usdzPack([
+    [`layers/${rootAsset.logicalPath}`, rootAsset.bytes],
+    ...lawClosure.assets
+      .filter((asset) => asset !== rootAsset)
+      .map((asset) => [`layers/${asset.logicalPath}`, asset.bytes] as const),
+  ]);
+  writeFileSync(lawUsdzPath, lawUsdz);
+  const layeredRootPath = path.join(lawClosureAssetsPath, lawClosure.rootLogicalPath);
+  const closureAssetCount = lawClosure.assets.length;
   let usdcatFlattenVerified = false;
-  let composedUsdIdentity: string | undefined;
-  {
-    const safe = (s: string) => s.replace(/[^A-Za-z0-9._-]/g, "_");
-    const layersDir = path.join(outDir, "layers");
-    mkdirSync(layersDir, { recursive: true });
-    const allLayers: UsdLayer[] = [];
-    const relPaths: string[] = [];
-    const pendingWrites: { path: string; text: string }[] = [];
-    const canonicalLayers = new Map(
-      (JSON.parse(usdJson) as { layers: UsdLayer[] }).layers.map((layer) => [layer.path, layer] as const),
-    );
-    for (const ld of layeredDomains) {
-      const authored = emitLayeredDomain(ld.key, ld.inputs, { applyBusinessCorrectionLayer: false });
-      const canonicalLayer = canonicalLayers.get(`/Nomos/${ld.key}`);
-      // Authored layers carry structural declarations (aggregate/directive/query prims).
-      // Domain-level `nomos:*` values are the compiler's closure over the complete package
-      // (relation namespaces, read projections, invariant gates, contracts and language
-      // consequences), so placing partial versions on source layers lets weaker generated
-      // facts show through. Strip those derived attributes from source layers and append one
-      // explicit strongest closure layer. This is ordinary OpenUSD composition: source
-      // opinions remain inspectable and the compiler-owned overlay is the one canonical law.
-      const structuralLayers = authored.map((emitted, index) => {
-        const { path: layerPath, prims, queries, deriveds, combineds } = emitted.layer;
-        const layer: UsdLayer = {
-          path: layerPath,
-          prims,
-          ...(queries !== undefined ? { queries } : {}),
-          ...(deriveds !== undefined ? { deriveds } : {}),
-          ...(combineds !== undefined ? { combineds } : {}),
-        };
-        return {
-          ...emitted,
-          layer,
-          usda: usdaLayerText(ld.key, emitted.name, layer, ld.inputs[index]!.module, new Set()),
-        };
-      });
-      const closureLayers = canonicalLayer === undefined
-        ? []
-        : (() => {
-            const layer: UsdLayer = canonicalLayer;
-            const name = "__nomos_package_closure";
-            const canonicalModule = domainModules.find((module) =>
-              (module.domain ?? module.name) === ld.key);
-            return [{
-              name,
-              layer,
-              usda: usdaLayerText(ld.key, name, layer, canonicalModule, new Set()),
-            }];
-          })();
-      const emittedLayers = [...structuralLayers, ...closureLayers];
-      for (const emitted of emittedLayers) {
-        const base = `${safe(ld.key)}--${safe(emitted.name)}`;
-        pendingWrites.push({ path: path.join(layersDir, `${base}.usda`), text: emitted.usda });
-        pendingWrites.push({
-          path: path.join(layersDir, `${base}.layer.json`),
-          text: JSON.stringify(emitted.layer) + "\n",
-        });
-        allLayers.push(emitted.layer);
-        relPaths.push(`layers/${base}.usda`);
-      }
-    }
-    const flat = flattenLayeredUsd(allLayers);
-    composedUsdIdentity = sha256HexUtf8(canonicalJson(flat));
-    const canonicalLaw = JSON.parse(usdJson);
-    if (canonicalJson(flat) !== canonicalJson(canonicalLaw)) {
-      const difference = firstLawDifference(canonicalLaw, flat) ?? "canonical law differs";
+  let usdcatFlattenCached = false;
+  const composedUsdIdentity = domainHash;
+  const usdcat = resolveUsdcat();
+  if (usdcat === undefined) {
+    if (requireUsdcat) {
       fail(
-        `layered emission does not flatten to the canonical composed IR — the module fold and ` +
-          `the layer-stack fold DISAGREE for this package (usually a re-declared directive ` +
-          `silently dropping an omit-when-empty reads/emits boundary, or a re-declared ` +
-          `aggregate dropping a field: USD shows the weaker opinion through; the module fold ` +
-          `does not). First difference: ${difference}. Refusing to emit the package.`,
+        "stock OpenUSD `usdcat` is required for this compile but was not found. " +
+          "Install OpenUSD or set NOMOS_USDCAT to the executable path.",
       );
     }
-    for (const w of pendingWrites) writeFileSync(w.path, w.text, "utf8");
-    layeredRootPath = path.join(outDir, `${cfg.name}.layered.usda`);
-    writeFileSync(layeredRootPath, layeredRootUsda(relPaths), "utf8");
-    layeredFileCount = relPaths.length;
-
-    const usdcat = resolveUsdcat();
-    if (usdcat === undefined) {
-      if (requireUsdcat) {
-        fail(
-          "stock OpenUSD `usdcat` is required for this compile but was not found. " +
-            "Install OpenUSD or set NOMOS_USDCAT to the executable path.",
-        );
-      }
+  } else {
+    const usdcatProofPath = path.join(outDir, `.${cfg.name}.usdcat-proof.usda`);
+    // Retired cache encoding: proof metadata follows the same inspectable USDA
+    // vocabulary as the closure it witnesses.
+    rmSync(path.join(outDir, `.${cfg.name}.usdcat-proof.json`), { force: true });
+    const proofKey = createHash("sha256")
+      .update("nomos-usda-v3-load\0")
+      .update(domainHash)
+      .update("\0")
+      .update(String(usdcat))
+      .digest("hex");
+    const proofCodec = await import("../compile_proof.mjs" as string) as {
+      readKeyProofUsda(file: string, format: string): string | undefined;
+      writeKeyProofUsda(file: string, format: string, key: string): void;
+    };
+    const priorProofKey = proofCodec.readKeyProofUsda(
+      usdcatProofPath,
+      "nomos.usdcat-load-proof.v1",
+    );
+    if (priorProofKey === proofKey) {
+      usdcatFlattenVerified = true;
+      usdcatFlattenCached = true;
     } else {
-      let flattenedText: string;
       try {
-        flattenedText = execFileSync(usdcat, ["--flatten", layeredRootPath], {
+        execFileSync(usdcat, ["--loadOnly", layeredRootPath], {
           encoding: "utf8",
-          stdio: ["ignore", "pipe", "pipe"],
+          stdio: ["ignore", "ignore", "pipe"],
           maxBuffer: 256 * 1024 * 1024,
         });
       } catch (error) {
         const stderr = String((error as { stderr?: string }).stderr ?? "").trim();
-        fail(`stock OpenUSD refused the generated layer stack: ${stderr || String(error)}`);
-      }
-      const openUsdLaw = parseUsdaDocument(flattenedText);
-      if (canonicalJson(openUsdLaw) !== canonicalJson(canonicalLaw)) {
-        const difference = firstLawDifference(canonicalLaw, openUsdLaw) ?? "canonical law differs";
-        fail(
-          `stock OpenUSD and Nomos resolve different effective law. First difference: ${difference}. ` +
-            `Refusing to emit the package.`,
-        );
+        rmSync(lawUsdzPath, { force: true });
+        fail(`stock OpenUSD refused the canonical typed USDA closure: ${stderr || String(error)}`);
       }
+      proofCodec.writeKeyProofUsda(
+        usdcatProofPath,
+        "nomos.usdcat-load-proof.v1",
+        proofKey,
+      );
       usdcatFlattenVerified = true;
     }
   }
-  // The executable package is the COMMITTED result of composition. Do not leave
-  // a newly-written package behind when either Nomos or stock OpenUSD rejects its
-  // source stack; rejected layer artifacts remain useful diagnostics, not runnable law.
-  writeFileSync(pkgPath, text, "utf8");
 
   // ── 2c. THE PUBLISHED OPENUSD PACKAGE ASSET ──
   // `rootPart` is the explicit package/application boundary from the OpenUSD composition ADR.
@@ -3661,7 +4756,7 @@ async function main(): Promise<void> {
         packageIdentity: composedUsdIdentity!,
         domains: presentationDomainModules.map((module) => module.domain ?? module.name),
         root: cfg.rootPart,
-        lawAsset: `./${cfg.name}.layered.usda`,
+        lawAsset: `./${cfg.name}.law/root.usda`,
       });
       packageAssetPath = path.join(outDir, `${cfg.name}.asset.usda`);
       const candidateAssetPath = path.join(outDir, `.${cfg.name}.asset.candidate.usda`);
@@ -3680,13 +4775,16 @@ async function main(): Promise<void> {
     }
   }
 
-  // ── 3. the IDENTITY emit (for the summary's per-domain identityHash) ──
-  // The admission identity is carried INSIDE the package USD IR (emitUsd) + the committed
-  // nomos.stable-ids.json lockfile; the deploy/cloud/runtime contract uses neither a read-manifest nor an
-  // identity-manifest sidecar. The old domain_manifests.json / domain_identity_*.json build files were
-  // local diagnostics the contract ignored — REMOVED (they only confused /build consumers). We still
-  // compute the identity to surface its per-domain hash in the summary below.
-  const identity = buildIdentity(domainModules);
+  // ── 3. typed per-domain identity (diagnostic/client compatibility metadata) ──
+  // A domain's identity is the digest of its canonical sparse USDA layer. Do not rebuild the retired
+  // canonical JSON manifest merely to print or embed a second, competing identity.
+  const identityHashes: Record<string, string> = {};
+  for (const module of domainModules) {
+    const hash = typedDomainIdentityByName.get(module.name);
+    if (hash === undefined) fail(`typed USDA identity is missing for domain '${module.name}'`);
+    identityHashes[module.name] = hash;
+    identityHashes[module.domain ?? module.name] = hash;
+  }
 
   // ── 3a. the CLIENT/LAW COMPATIBILITY MANIFEST (§5, architecture/plug_and_play_dx.md).
   // A DIAGNOSIS surface, NEVER a gate: the shape-compat arc (#72) established that clients
@@ -3705,7 +4803,7 @@ async function main(): Promise<void> {
   const compatDomains: NomosCompat["domains"] = {};
   for (const m of presentationDomainModules) {
     const key = m.domain ?? m.name;
-    const identityHash = identity.hashes[key];
+    const identityHash = identityHashes[key];
     compatDomains[key] = identityHash === undefined ? {} : { identityHash };
   }
   // RELEASE COHERENCE — the kernel capabilities this law REQUIRES (compound-key queries +
@@ -3717,12 +4815,6 @@ async function main(): Promise<void> {
       ...(m.surfacedResolvers ? { surfacedResolvers: m.surfacedResolvers } : {}),
       ...(m.aggregates ? { aggregates: m.aggregates } : {}),
     }));
-    try {
-      const parsed = JSON.parse(usdJson) as { layers?: Record<string, unknown>[] };
-      for (const layer of parsed.layers ?? []) probes.push({ layer });
-    } catch {
-      /* shape-derived features (compoundKeys) still apply from the queries above */
-    }
     return requiredKernelFeatures(probes);
   })();
   const nomosCompat: NomosCompat = {
@@ -3734,34 +4826,24 @@ async function main(): Promise<void> {
     requiresKernel,
   };
 
-  // ── 3b. the OpenAPI spec — THE PACKAGE'S SELF-DESCRIPTION (the host's runtime routing table;
-  // architecture/githolon_host_contract.md "The Self-Describing API"). Each domain emits its fragment
-  // from its OWN zod (z.toJSONSchema); the package's spec is the law-blind merge. Deploy STAGES it like
-  // the read overlay; the workspace's full spec is the runtime merge of installed packages' specs
-  // (currentLaw); the host ingests it and builds its router from it — no domain/directive name in host
-  // source. Self-describing for the whole web ecosystem (Swagger/codegen/Hono/agent tool-calling).
+  // ── 3b. public OpenAPI diagnostic/codegen projection. This JSON document is not law, install input,
+  // a runtime route table, or host authority. Kernel execution and current-law description derive from
+  // the installed typed USDA stage; this projection exists only for Swagger, client generators and agent
+  // tooling that consume OpenAPI.
   const publicOpenapi = mergeOpenApiFragments(
     presentationDomainModules.map((m) => generateOpenApiFragment(m, { lawHash: domainHash })),
     { title: `${cfg.name} (nomos package)`, lawHash: domainHash },
   );
-  const runtimeOpenapi = mergeOpenApiFragments(
-    domainModules.map((m) => generateOpenApiFragment(m, { lawHash: domainHash, includeFrameworkRoutes: true })),
-    { title: `${cfg.name} (nomos package)`, lawHash: domainHash },
-  );
   const openapiPath = path.join(outDir, `${cfg.name}.openapi.json`);
   writeFileSync(openapiPath, JSON.stringify(publicOpenapi, null, 2) + "\n", "utf8");
 
-  // ── 4. the one-call deploy body (package only) ──
-  // SELF-DESCRIBING: `summary` states what the (otherwise hex-opaque) package
-  // contains — purely derived from the inputs (no timestamps), ignored by the
-  // deploy endpoint, and mirrored as build/<name>.summary.txt for a human or
-  // agent who simply cats the build output.
+  // ── 4. human build summary (diagnostic only; never deployment input) ──
   const summary = {
     package: cfg.name,
-    // Binds the deploy body to the published package asset consumed by an application stage. This is the
-    // content identity of the composed source layers; domainHash below is the runtime package-law hash.
+    // Binds the summary to the published package asset consumed by an application stage.
     sourceIdentity: composedUsdIdentity!,
     domainHash,
+    lawClosureIdentity: lawClosure.identity,
     domains: presentationDomainModules.map((m) => ({
       domain: m.domain ?? m.name,
       aggregates: m.aggregates.map((a) => a.id),
@@ -3769,29 +4851,9 @@ async function main(): Promise<void> {
       queries: (m.queries ?? []).map((q) => q.id),
       counts: (m.counts ?? []).map((c) => c.id),
       sums: (m.sums ?? []).map((s) => s.id),
-      identityHash: identity.hashes[m.domain ?? m.name],
+      identityHash: identityHashes[m.domain ?? m.name],
     })),
   };
-  const deployBody = {
-    summary,
-    packageUsda: text,
-    // The capability lowering (unhashed sidecar; omit-when-empty — see the
-    // collector's doc above). The worker stages it on the manifest overlay:
-    // the deploy-time binding warning + the executor's scan map read it there.
-    ...(capabilityLowerings.length > 0 ? { capabilities: capabilityLowerings } : {}),
-    // THE STRUCTURAL OFFER (#72): the per-domain interface, staged on the manifest overlay so
-    // `connect()` pulls the workspace's installed shapes and negotiates by structural subtyping.
-    interface: packageInterface,
-    // THE SELF-DESCRIBING API: this package's OpenAPI spec (law-derived). The worker stages it on the
-    // manifest overlay; a read serves the workspace's merged spec; the host builds its router from it.
-    openapi: runtimeOpenapi,
-    // THE CLIENT/LAW COMPAT MANIFEST (§5): a DIAGNOSIS surface (law hash + interface hash + generator
-    // provenance) the connect-time classifier reads. Frontend-only — the package bytes above ignore it.
-    nomosCompat,
-  };
-  const deployPath = path.join(outDir, `${cfg.name}.deploy.json`);
-  writeFileSync(deployPath, JSON.stringify(deployBody) + "\n", "utf8");
-
   // ── 4b. the GENERATED PROOF — a runnable, domain-shaped e2e synthesized from the
   //        law itself (codegen_proof.ts): reshape the law, recompile, the proof
   //        reshapes itself — no test rewriting. NEVER FATAL: a domain the
@@ -3840,14 +4902,16 @@ async function main(): Promise<void> {
 
   const summaryTxt = [
     `${cfg.name} — compiled Nomos domain package`,
-    `law (domainHash): ${domainHash}   # sha256(${cfg.name}.package.usda) — content-addressed`,
+    `law (domainHash): ${domainHash}   # composed typed USDA closure identity`,
+    `law transport: ${path.basename(lawUsdzPath)}   # lossless one-file USDZ envelope; not canonical custody`,
+    `canonical law: ${path.basename(lawClosureAssetsPath)}/   # exact logically named, human-readable USDA`,
     ...summary.domains.flatMap((d) => [
       `domain '${d.domain}'${d.identityHash ? `  (identity ${d.identityHash.slice(0, 12)}…)` : "  (EXCLUDED from identity manifest)"}`,
       `  aggregates: ${d.aggregates.join(", ") || "—"}`,
       `  directives: ${d.directives.join(", ") || "—"}`,
       `  queries: ${d.queries.join(", ") || "—"}   counts: ${d.counts.join(", ") || "—"}   sums: ${d.sums.join(", ") || "—"}`,
     ]),
-    `deploy: POST ${cfg.name}.deploy.json to /v2/workspaces/<ws>/domains (or: githolon deploy <ws>)`,
+    `deploy: githolon deploy <ws> --file ${cfg.name}.law.usdz`,
     packageAssetPath !== undefined
       ? `package asset: ${path.basename(packageAssetPath)} — the real USD package root consumed by application composition`
       : `package asset: NOT EMITTED — declare rootPart: { name, kind: "component" | "assembly" }`,
@@ -3877,10 +4941,9 @@ async function main(): Promise<void> {
   const temporaryClientPath = path.join(outDir, `.${cfg.name}.client.source.ts`);
   const temporaryRuntimeTypesPath = path.join(outDir, `.${cfg.name}.application-runtime.d.ts`);
   const temporaryDeclarationPath = temporaryClientPath.replace(/\.ts$/, ".d.ts");
-  writeFileSync(temporaryClientPath, clientSource, "utf8");
-  writeFileSync(temporaryRuntimeTypesPath, [
+  const runtimeTypesSource = [
     `export declare function nomosInternalOpenGeneratedApplication<T extends object>(`,
-    `  options: { cloud: string; application: string; signIn: (request?: { readonly deviceChallenge?: string }) => Promise<string> },`,
+    `  options: { cloud: string; application: string; signIn: (request?: { readonly deviceChallenge?: string }) => Promise<string>; lawHash: string },`,
     `  bind: (holon: unknown, user: { readonly identityId: string; readonly identityAddress: string }) => T,`,
     `): Promise<T & {`,
     `  currentStatus(): Promise<any>;`,
@@ -3900,11 +4963,48 @@ async function main(): Promise<void> {
     `  policies: readonly { readonly domain: string; readonly domainHash: string; readonly query: string; readonly redeem: string; readonly personField: string; readonly roleField: string; readonly scopeField: string }[],`,
     `): Promise<void>;`,
     ``,
-  ].join("\n"), "utf8");
+  ].join("\n");
+  // Declaration generation used to ask TypeScript to rebuild and reduce the same 800 KiB public type graph
+  // on every law compile, even when an implementation-only plan edit left that graph byte-identical. Cache
+  // the result by the exact generated source, runtime declaration boundary, TypeScript version and pruning
+  // algorithm. The installed law hash is normalized because it changes runtime compatibility identity but
+  // has type `string` in every public declaration. A typed USDA proof binds the cached declaration bytes;
+  // there is no JSON cache manifest and no cached file can become runtime or custody authority.
+  const declarationProofCodec = await import("../compile_proof.mjs" as string) as {
+    readKeyProofUsda(file: string, format: string): string | undefined;
+    writeKeyProofUsda(file: string, format: string, key: string): void;
+  };
+  const declarationProofFormat = "nomos.typescript-declaration-proof.v1";
+  const normalizedClientSource = clientSource.replaceAll(domainHash, "<nomos-composed-law-identity>");
+  const declarationInputIdentity = createHash("sha256")
+    .update(`${declarationProofFormat}\0`)
+    .update(normalizedClientSource)
+    .update("\0")
+    .update(runtimeTypesSource)
+    .update("\0")
+    .update(ts.version)
+    .update("\0")
+    .update(readFileSync(fileURLToPath(import.meta.url)))
+    .digest("hex");
+  const declarationCacheDir = path.join(cfgDir, "node_modules", ".cache", "nomos", "typescript-declarations");
+  const declarationCachePath = path.join(declarationCacheDir, `${declarationInputIdentity}.d.mts`);
+  const declarationCacheProofPath = path.join(declarationCacheDir, `${declarationInputIdentity}.proof.usda`);
+  const declarationProofKey = (bytes: Buffer): string => createHash("sha256")
+    .update(`${declarationProofFormat}\0${declarationInputIdentity}\0`)
+    .update(bytes)
+    .digest("hex");
+  const cachedDeclaration = existsSync(declarationCachePath) ? readFileSync(declarationCachePath) : undefined;
+  const declarationCacheHit = cachedDeclaration !== undefined &&
+    declarationProofCodec.readKeyProofUsda(declarationCacheProofPath, declarationProofFormat) ===
+      declarationProofKey(cachedDeclaration);
+  if (declarationCacheHit) copyFileSync(declarationCachePath, clientDeclarationPath);
   try {
-    const typescriptEntry = createRequire(import.meta.url).resolve("typescript/lib/typescript.js");
-    const ts = (await import(pathToFileURL(typescriptEntry).href)) as typeof import("typescript");
-    const program = ts.createProgram(
+    if (!declarationCacheHit) {
+      writeFileSync(temporaryClientPath, clientSource, "utf8");
+      writeFileSync(temporaryRuntimeTypesPath, runtimeTypesSource, "utf8");
+      const typescriptEntry = createRequire(import.meta.url).resolve("typescript/lib/typescript.js");
+      const ts = (await import(pathToFileURL(typescriptEntry).href)) as typeof import("typescript");
+      const program = ts.createProgram(
       [temporaryClientPath, temporaryRuntimeTypesPath],
       {
         target: ts.ScriptTarget.ES2022,
@@ -4069,8 +5169,18 @@ async function main(): Promise<void> {
         .map((statement) => printer.printNode(ts.EmitHint.Unspecified, statement, declarationFile)),
       "",
     ].join("\n");
-    writeFileSync(temporaryDeclarationPath, declarationSource, "utf8");
-    renameSync(temporaryDeclarationPath, clientDeclarationPath);
+      writeFileSync(temporaryDeclarationPath, declarationSource, "utf8");
+      renameSync(temporaryDeclarationPath, clientDeclarationPath);
+      mkdirSync(declarationCacheDir, { recursive: true });
+      const declarationCacheTemporaryPath = `${declarationCachePath}.tmp-${process.pid}`;
+      copyFileSync(clientDeclarationPath, declarationCacheTemporaryPath);
+      renameSync(declarationCacheTemporaryPath, declarationCachePath);
+      declarationProofCodec.writeKeyProofUsda(
+        declarationCacheProofPath,
+        declarationProofFormat,
+        declarationProofKey(readFileSync(declarationCachePath)),
+      );
+    }
     await esbuildMod.build({
       stdin: {
         contents: clientSource,
@@ -4159,7 +5269,7 @@ async function main(): Promise<void> {
     if (dartPackages !== undefined) {
       const r = emitDartPackages(
         presentationDomainModules, dartOut, domainHash, packageInterface, dartPackages,
-        dartNames, nomosCompat, cfg.name, deployPath,
+        dartNames, nomosCompat, cfg.name, lawUsdzPath,
       );
       dartFiles = r.written;
       dartCursedHints = r.cursed;
@@ -4228,6 +5338,10 @@ async function main(): Promise<void> {
       // Package generation must not depend on which SDKs happen to be installed on the compiler's
       // machine. Write every source-dogfood override first; the analyzer loop may legitimately stop
       // at the first missing `dart`, but that must not leave later solve roots pinned to hosted code.
+      const writeTextIfChanged = (file: string, text: string): void => {
+        if (existsSync(file) && readFileSync(file, "utf8") === text) return;
+        writeFileSync(file, text, "utf8");
+      };
       for (const pkg of pkgDirs) {
         if (localDart) {
           const spec = readFileSync(path.join(pkg, "pubspec.yaml"), "utf8");
@@ -4248,27 +5362,124 @@ async function main(): Promise<void> {
           // so every local nomos_client solve root must also seat the matching local Flutter host even
           // when its own pubspec does not name nomos_flutter directly.
           if ((usesFlutter || usesClient) && localDart.flutter) lines.push(`  nomos_flutter:`, `    path: ${localDart.flutter}`);
-          if (lines.length > 1) writeFileSync(path.join(pkg, "pubspec_overrides.yaml"), lines.join("\n") + "\n", "utf8");
+          if (lines.length > 1) {
+            writeTextIfChanged(path.join(pkg, "pubspec_overrides.yaml"), lines.join("\n") + "\n");
+          }
         }
       }
+      // `dart pub get` is a dependency-resolution operation, not a generated-source validator. Re-running
+      // it for every package on every compile bought no additional proof: the analyzer consumes the exact
+      // package_config produced from these pub inputs. Dart deliberately preserves package_config's mtime
+      // when the resolution is unchanged, so timestamps cannot establish that relationship. Bind the exact
+      // input and output bytes in a disposable USDA proof instead. The Dart-owned package_config may be JSON
+      // internally, but it is third-party tooling output, never Nomos law or a Nomos manifest.
+      const dartResolutionProof = await import("../compile_proof.mjs" as string) as {
+        readKeyProofUsda(file: string, format: string): string | undefined;
+        writeKeyProofUsda(file: string, format: string, key: string): void;
+      };
+      const dartResolutionFormat = "nomos.dart-package-resolution-proof.v1";
+      const dartResolutionProofPath = (pkg: string): string =>
+        path.join(pkg, ".dart_tool", ".nomos-pub-resolution-proof.usda");
+      const dartResolutionKey = (pkg: string): string | undefined => {
+        const files = [
+          "pubspec.yaml",
+          "pubspec.lock",
+          "pubspec_overrides.yaml",
+          path.join(".dart_tool", "package_config.json"),
+        ].map((name) => ({ name, file: path.join(pkg, name) }));
+        if (files.some(({ file }) => !existsSync(file))) return undefined;
+        const hash = createHash("sha256").update(`${dartResolutionFormat}\0`);
+        for (const { name, file } of files) hash.update(name).update("\0").update(readFileSync(file)).update("\0");
+        return hash.digest("hex");
+      };
+      const dartPackageResolutionCurrent = (pkg: string): boolean => {
+        const key = dartResolutionKey(pkg);
+        return key !== undefined &&
+          dartResolutionProof.readKeyProofUsda(dartResolutionProofPath(pkg), dartResolutionFormat) === key;
+      };
       let dartMissing = false;
       let unresolved: string | undefined;
       for (const pkg of pkgDirs) {
+        if (dartPackageResolutionCurrent(pkg)) continue;
         try {
           execFileSync("dart", ["pub", "get"], { cwd: pkg, stdio: "pipe", encoding: "utf8" });
+          const key = dartResolutionKey(pkg);
+          if (key !== undefined) {
+            dartResolutionProof.writeKeyProofUsda(dartResolutionProofPath(pkg), dartResolutionFormat, key);
+          }
         } catch (e) {
           const err = e as { code?: string; stdout?: string; stderr?: string };
           if (err.code === "ENOENT") { dartMissing = true; break; }
           unresolved = `${path.relative(process.cwd(), pkg)}: ${`${err.stdout ?? ""}${err.stderr ?? ""}`.trim().split("\n").slice(-3).join(" ")}`;
         }
       }
-      // Only analyze when EVERY package's deps resolved: `dart analyze` against an unresolved package reports
-      // every framework symbol (NomosRef, …) as undefined — a meaningless flood, not a real defect. An
-      // unresolved dep is already surfaced as UNVERIFIED below (e.g. a fixture pinning an as-yet-unpublished
-      // nomos_client — it verifies for real the moment that version lands).
+      // The analyzer is a real codegen gate, but an identical generated Dart graph against identical
+      // resolved packages and framework sources does not become more valid by launching another analyzer
+      // process. Content-address that verdict as USDA. Any generated type/client change, pub resolution,
+      // local dogfood runtime change, or Dart SDK version change produces a different key and runs the real
+      // analyzer before the proof is written.
+      const collectDartAnalysisFiles = (root: string): string[] => {
+        const found: string[] = [];
+        const visit = (directory: string): void => {
+          if (!existsSync(directory)) return;
+          for (const entry of readdirSync(directory, { withFileTypes: true })) {
+            if (entry.name === ".dart_tool" || entry.name === "build") continue;
+            const file = path.join(directory, entry.name);
+            if (entry.isDirectory()) visit(file);
+            else if (entry.isFile() && (entry.name.endsWith(".dart") || entry.name === "pubspec.yaml")) found.push(file);
+          }
+        };
+        visit(root);
+        return found.sort();
+      };
+      let dartAnalysisKey: string | undefined;
+      let dartAnalysisCached = false;
       if (!dartMissing && unresolved === undefined && inPackage.length > 0) {
         try {
-          execFileSync("dart", ["analyze", "--no-fatal-warnings", ...inPackage], { stdio: "pipe", encoding: "utf8" });
+          const dartVersion = execFileSync("dart", ["--version"], { stdio: "pipe", encoding: "utf8" }).trim();
+          const inputs = new Map<string, string>();
+          for (const file of [...inPackage].sort()) {
+            inputs.set(`generated/${path.relative(dOut, file).replaceAll(path.sep, "/")}`, file);
+          }
+          for (const pkg of [...pkgDirs].sort()) {
+            for (const relative of [
+              "pubspec.yaml",
+              "pubspec.lock",
+              "pubspec_overrides.yaml",
+              path.join(".dart_tool", "package_config.json"),
+            ]) {
+              const file = path.join(pkg, relative);
+              if (existsSync(file)) {
+                inputs.set(`resolution/${path.relative(dOut, pkg).replaceAll(path.sep, "/")}/${relative.replaceAll(path.sep, "/")}`, file);
+              }
+            }
+          }
+          if (localDart !== undefined) {
+            for (const [role, root] of Object.entries(localDart)) {
+              for (const file of collectDartAnalysisFiles(root)) {
+                inputs.set(`framework/${role}/${path.relative(root, file).replaceAll(path.sep, "/")}`, file);
+              }
+            }
+          }
+          const hash = createHash("sha256")
+            .update("nomos.dart-analysis-proof.v1\0")
+            .update(dartVersion)
+            .update("\0");
+          for (const [logical, file] of [...inputs].sort(([left], [right]) => left.localeCompare(right))) {
+            hash.update(logical).update("\0").update(readFileSync(file)).update("\0");
+          }
+          dartAnalysisKey = hash.digest("hex");
+          const proofDir = path.join(cfgDir, "node_modules", ".cache", "nomos", "dart-analysis");
+          const proofPath = path.join(proofDir, `${dartAnalysisKey}.proof.usda`);
+          dartAnalysisCached = dartResolutionProof.readKeyProofUsda(
+            proofPath,
+            "nomos.dart-analysis-proof.v1",
+          ) === dartAnalysisKey;
+          if (!dartAnalysisCached) {
+            execFileSync("dart", ["analyze", "--no-fatal-warnings", ...inPackage], { stdio: "pipe", encoding: "utf8" });
+            mkdirSync(proofDir, { recursive: true });
+            dartResolutionProof.writeKeyProofUsda(proofPath, "nomos.dart-analysis-proof.v1", dartAnalysisKey);
+          }
         } catch (e) {
           const err = e as { code?: string; stdout?: string; stderr?: string };
           if (err.code === "ENOENT") { dartMissing = true; }
@@ -4278,6 +5489,10 @@ async function main(): Promise<void> {
           }
         }
       }
+      // Only analyze when EVERY package's deps resolved: `dart analyze` against an unresolved package reports
+      // every framework symbol (NomosRef, …) as undefined — a meaningless flood, not a real defect. An
+      // unresolved dep is already surfaced as UNVERIFIED below (e.g. a fixture pinning an as-yet-unpublished
+      // nomos_client — it verifies for real the moment that version lands).
       if (dartMissing) {
         // No `dart` on PATH — we genuinely cannot verify. Say so LOUDLY (never a `✓`), so a broken client is
         // NOT reported as a clean compile; installing dart turns this into a real gate.
@@ -4285,7 +5500,7 @@ async function main(): Promise<void> {
       } else if (unresolved !== undefined) {
         console.log(`  dart ⚠     UNVERIFIED — \`dart pub get\` failed, so analysis is incomplete (${unresolved})`);
       } else if (inPackage.length > 0) {
-        console.log(`  dart ✓     generated Dart analyzes clean (compile-valid ⇒ compilable)`);
+        console.log(`  dart ✓     generated Dart analyzes clean (compile-valid ⇒ compilable)${dartAnalysisCached ? " — content-addressed USDA proof reused" : ""}`);
       } else if (emittedDart.length > 0) {
         console.log(`  dart —     vendored (no pub package) emit — runtime package imports are unverifiable without a pubspec; analysis skipped (use dart.packages for a fully-gated pub package)`);
       }
@@ -4295,34 +5510,40 @@ async function main(): Promise<void> {
   // ── summary ──
   const rel = (p: string) => path.relative(process.cwd(), p);
   console.log(`nomos-compile: ${cfg.name}`);
-  console.log(`  package    ${rel(pkgPath)} (${text.length} bytes)`);
+  console.log(`  law        ${rel(lawUsdzPath)} (${lawUsdz.byteLength} transport bytes)`);
   console.log(`  domainHash ${domainHash}`);
-  if (layeredRootPath !== undefined) {
-    console.log(
-      `  layered    ${rel(layeredRootPath)} (${layeredFileCount} module layer(s) in build/layers/ — Nomos flatten resolves the canonical law)`,
-    );
-    console.log(
-      usdcatFlattenVerified
-        ? `  usdcat     ✓ stock OpenUSD --flatten resolves the same canonical law`
-        : `  usdcat     ⚠ unavailable — set NOMOS_REQUIRE_USDCAT=1 in release CI to make this proof mandatory`,
-    );
-  }
+  console.log(`  custody    ${rel(layeredRootPath)} (${closureAssetCount} exact named USDA/MJS asset(s))`);
+  console.log(
+    usdcatFlattenVerified
+      ? `  usdcat     ✓ stock OpenUSD loads the canonical typed USDA closure${usdcatFlattenCached ? " (content-addressed proof reused)" : ""}`
+      : `  usdcat     ⚠ unavailable — set NOMOS_REQUIRE_USDCAT=1 in release CI to make this proof mandatory`,
+  );
   {
     const sum = (pick: (m: (typeof domainModules)[number]) => readonly unknown[] | undefined) =>
       presentationDomainModules.reduce((n, m) => n + (pick(m)?.length ?? 0), 0);
     console.log(`  reads      ${sum((m) => m.queries)} quer(y/ies), ${sum((m) => m.counts)} count(s), ${sum((m) => m.sums)} sum(s) — declared (routed via the openapi)`);
   }
+  console.log(
+    `  lowering   workspace-invariant reads: ${rustWorkspaceInvariantReadIds.length} Rust, ` +
+      `${javascriptWorkspaceInvariantReadIds.length} deterministic JavaScript fallback`,
+  );
+  if (javascriptWorkspaceInvariantReadIds.length > 0) {
+    const shown = javascriptWorkspaceInvariantReadIds.slice(0, 8);
+    const remainder = javascriptWorkspaceInvariantReadIds.length - shown.length;
+    console.log(
+      `             JS fallback: ${shown.join(", ")}${remainder > 0 ? ` (+${remainder} more)` : ""}; ` +
+        `legal tenant code, measurable via NOMOS_PROFILE_PLANS=1`,
+    );
+  }
   // SECONDARY-CREATE AUTO-DECLARE (secondary_ensure.ts): surface every type the compiler sanctioned
   // from a plan's deterministic secondary `ensure(...)` — the id-mint-gate DX made visible (the author
   // wrote `ensure(B, …)`; the compiler declared `Ensure → B` so the deterministic id admits).
   for (const m of presentationDomainModules) {
   }
   const presentedIdentityNames = new Set(presentationDomainModules.map((m) => m.domain ?? m.name));
-  const presentedHashes = Object.entries(identity.hashes).filter(([domain]) => presentedIdentityNames.has(domain));
-  const presentedExcluded = identity.excluded.filter((entry) => presentedIdentityNames.has(entry.domain));
-  console.log(`  identity   ${presentedHashes.length} business domain(s) (private Nomos lifecycle law included but not exposed)${presentedExcluded.length ? ` — ${presentedExcluded.length} EXCLUDED (palette gap)` : ""}`);
+  const presentedHashes = Object.entries(identityHashes).filter(([domain]) => presentedIdentityNames.has(domain));
+  console.log(`  identity   ${presentedHashes.length} business domain(s) (private Nomos lifecycle law included but not exposed)`);
   for (const [dom, h] of presentedHashes) console.log(`             ${dom.padEnd(20)} ${h}`);
-  for (const ex of presentedExcluded) console.log(`             EXCLUDED ${ex.domain}: ${ex.reason}`);
   // STABLE IDS (#58): the minted/carried identity surface + every INFERRED rename —
   // the silent lane made visible (if an inference is wrong — you meant remove+add —
   // split the edit into two compiles, or answer the evolve gate with a disposition).
@@ -4343,7 +5564,7 @@ async function main(): Promise<void> {
   }
   console.log(`  client     ${rel(clientPath)} (typed TS client — payloads, read models, query accessors)`);
   for (const note of recursiveNotes) console.log(`  note       ${note}`);
-  console.log(`  openapi    ${rel(openapiPath)} (${Object.keys(publicOpenapi.paths).length} operation(s) — the public business API; private framework routes ride only in the deploy manifest)`);
+  console.log(`  openapi    ${rel(openapiPath)} (${Object.keys(publicOpenapi.paths).length} operation(s) — public diagnostic sidecar; runtime self-description comes from installed USDA)`);
   if (proofPath !== undefined) {
     console.log(`  proof      ${rel(proofPath)} (a runnable e2e GENERATED from your law — run: githolon proof)`);
   } else {
@@ -4359,7 +5580,7 @@ async function main(): Promise<void> {
   //    gate's refusal vocabulary, unified into ONE report. `githolon check` runs the same pass;
   //    compile runs it implicitly and REFUSES on any refuse-level finding (a statically-provable
   //    runtime refusal shipped as law). Warns/notes are printed but never block the compile.
-  const allCheckFindings = checkDomainModules(domainModules);
+  const allCheckFindings = authorTimeFindings;
   const isFrameworkFinding = (finding: (typeof allCheckFindings)[number]) =>
     finding.domain === APPLICATION_HOME_DOMAIN || finding.directiveId?.startsWith("nomos_internal_") === true;
   const checkFindings = allCheckFindings.filter((finding) => !isFrameworkFinding(finding));
@@ -4410,7 +5631,7 @@ async function main(): Promise<void> {
       console.log(`  dart       ${rel(dartOut)}${path.sep} (${dartFiles.length} domain file(s) + ${supportText} — typed Dart for Flutter)`);
     }
   }
-  console.log(`  deploy     ${rel(deployPath)}`);
+  console.log(`  deploy     githolon deploy <workspace> --file ${rel(lawUsdzPath)}`);
   console.log(``);
   console.log(`your business path:`);
   if (proofPath !== undefined) {
@@ -4425,6 +5646,53 @@ async function main(): Promise<void> {
   }
 
   if (analyzeFlag) runDartAnalyze(dartOut);
+
+  // The unchanged lane is itself USDA: a disposable content proof under
+  // node_modules/.cache relates authored/compiler inputs to every generated
+  // artifact. It is not another law manifest and carries no semantic opinions.
+  const compileProofPath = process.env.NOMOS_COMPILE_PROOF_PATH;
+  const compileArgumentIdentity = process.env.NOMOS_COMPILE_ARGUMENT_IDENTITY;
+  if (
+    process.exitCode !== 1 &&
+    compileProofPath !== undefined &&
+    compileArgumentIdentity !== undefined
+  ) {
+    const proof = await import("../compile_proof.mjs" as string) as {
+      compileInputs(options: {
+        cwd: string;
+        dslDir: string;
+        configPath: string;
+        argumentIdentity: string;
+      }): unknown;
+      generatedOutputFiles(outDir: string, additional: readonly string[]): readonly { path: string; sha256: string }[];
+      writeCompileProof(options: {
+        proofPath: string;
+        inputs: unknown;
+        outputs: readonly { path: string; sha256: string }[];
+        name: string;
+        domainHash: string;
+        law: string;
+      }): void;
+    };
+    const inputs = proof.compileInputs({
+      cwd: process.cwd(),
+      dslDir: DSL_DIR,
+      configPath,
+      argumentIdentity: compileArgumentIdentity,
+    });
+    const outputs = proof.generatedOutputFiles(outDir, [
+      lockPath,
+      ...dartFiles,
+    ]);
+    proof.writeCompileProof({
+      proofPath: compileProofPath,
+      inputs,
+      outputs,
+      name: cfg.name,
+      domainHash,
+      law: lawUsdzPath,
+    });
+  }
 }
 
 /**