@githolon/dsl 0.103.1 → 0.103.3

package/dart/CHANGELOG.md

@@ -1,3 +1,10 @@
+## 0.64.4
+
+- Require generated applications to seed explicit child-birth and workspace policies before first use;
+  missing law remains a typed kernel refusal instead of a compiled allowance or creation fallback.
+- Keep application startup single-flight and bounded through authentication, custody restore, law install
+  and client binding so concurrent UI consumers share one lifecycle and one actionable result.
+
 ## 0.64.3
 
 - Single-flight generated child-workspace acquisition and continuous sync so concurrent references share one

package/dart/lib/src/dev_cloud.dart

@@ -126,6 +126,7 @@ class NomosTestCloud {
     /// goes last and is retained as the explicit law used to birth a receiving group. A payload package is
     /// not made current on the parent merely to make it available to a child.
     List<String> lawUsdzPaths = const [],
+    int? applicationMaxChildWorkspacesPerUser,
     Duration readyTimeout = const Duration(seconds: 30),
     void Function(String line)? onDiagnostic,
   }) async {
@@ -137,6 +138,10 @@ class NomosTestCloud {
       if (ephemeral) '--ephemeral',
       if (dataDir != null) ...['--data', dataDir],
       if (platform != null) ...['--platform', platform],
+      if (applicationMaxChildWorkspacesPerUser != null) ...[
+        '--application-max-child-workspaces-per-user',
+        '$applicationMaxChildWorkspacesPerUser',
+      ],
       for (final deploy in [
         ...lawUsdzPaths,
         if (lawUsdzPath != null && !lawUsdzPaths.contains(lawUsdzPath))

package/dart/lib/src/runner/node-entry.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // <define:__NOMOS_KERNEL_RELEASE__>
-var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "efe619cbabba8f5d9d1a1309e7ab60feb489ddb4794ce5a6a95f35c7e7ae5928", version: "kernel-efe619cb", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 }, testMint: { hash: "0a801b8f40a17d3a1534d1452f0dc990f160299f6db55fe9c0c39d7aa726730b", version: "kernel-0a801b8f", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 } };
+var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "4bf8f2709135d729475c4dfbabb2014f8d1e10ff506506da1ee0299a808c415e", version: "kernel-4bf8f270", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 }, testMint: { hash: "c83316d63542760b76df0588e42c1ec34367536790bb73775694c6d167a8a87e", version: "kernel-c83316d6", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 } };
 
 // runner/node-entry.ts
 import { createInterface } from "node:readline";

package/dart/lib/src/runner/offline-install.mjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // <define:__NOMOS_KERNEL_RELEASE__>
-var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "efe619cbabba8f5d9d1a1309e7ab60feb489ddb4794ce5a6a95f35c7e7ae5928", version: "kernel-efe619cb", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 }, testMint: { hash: "0a801b8f40a17d3a1534d1452f0dc990f160299f6db55fe9c0c39d7aa726730b", version: "kernel-0a801b8f", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 } };
+var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "4bf8f2709135d729475c4dfbabb2014f8d1e10ff506506da1ee0299a808c415e", version: "kernel-4bf8f270", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 }, testMint: { hash: "c83316d63542760b76df0588e42c1ec34367536790bb73775694c6d167a8a87e", version: "kernel-c83316d6", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience"], protocol: 1 } };
 
 // runner/offline-install.ts
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync } from "node:fs";

package/dart/lib/src/test_harness.dart

@@ -519,6 +519,7 @@ class NomosTestHarness {
   /// [autoTearDown] — when true (default) and [registerTearDown] is given, registers [dispose] as a teardown.
   static Future<NomosTestHarness> ephemeral({
     required List<String> lawUsdzPaths,
+    int? applicationMaxChildWorkspacesPerUser,
     String? ownerSubject,
     String workspace = 'test-ws',
     String clientId = 'test-runner',
@@ -670,6 +671,14 @@ class NomosTestHarness {
         ),
       );
       if (birthsApplicationHome) {
+        final maxChildWorkspaces = applicationMaxChildWorkspacesPerUser;
+        if (maxChildWorkspaces == null || maxChildWorkspaces < 0) {
+          throw NomosTestHarnessException(
+            'a generated application scenario must carry its law-declared '
+            'application.maxChildWorkspacesPerUser into the test ceremony; '
+            'Nomos has no test-only birth-policy fallback',
+          );
+        }
         final devicePublic = info['devicePublic']?.toString();
         final deviceSecret = info['deviceSecret']?.toString();
         final framework = info['frameworkHash']?.toString();
@@ -689,6 +698,29 @@ class NomosTestHarness {
           );
         }
         final keyHash = sha256.convert(base64Decode(devicePublic)).toString();
+        final bornAt = DateTime.now().toUtc().toIso8601String();
+        await _phased(
+          phase: 'application: establish the parent birth policy',
+          workspace: installWorkspace,
+          awaiting: 'law-declared seedBirthPolicy offer',
+          timeout: phaseTimeout ?? _kOtherDeadline,
+          onDiagnostic: onDiagnostic,
+          // This throwaway parent is still on its warrant-free founding prefix. The generated
+          // scenario carries the value from the same package declaration that compiled the
+          // receiving-group plan; the harness does not choose or default it. The ordinary
+          // seed offer crosses the kernel author gate before the first birth is attempted.
+          run: () => plane.session(installWorkspace).offerOutcome(
+            domain: '__nomos_application_home_v1',
+            directiveId: 'seedBirthPolicy',
+            actor: owner,
+            authorSecret: deviceSecret,
+            payload: <String, Object?>{
+              'maxBirthsPerPrincipal': maxChildWorkspaces,
+              'setBy': owner,
+              'setAt': bornAt,
+            },
+          ),
+        );
         final outcome = await _phased(
           phase: 'application: birth the signed-in application',
           workspace: workspace,
@@ -707,7 +739,7 @@ class NomosTestHarness {
               // Ordered application deployment is reference packages first, deferred child payload last.
               // The parent serves the references; the receiving group is born with only its payload law.
               'lawHash': laws.last,
-              'bornAt': DateTime.now().toUtc().toIso8601String(),
+              'bornAt': bornAt,
             },
           ),
         );

package/dart/pubspec.lock

@@ -191,7 +191,7 @@ packages:
       path: "../dart_types"
       relative: true
     source: path
-    version: "0.8.1"
+    version: "0.8.2"
   package_config:
     dependency: "direct main"
     description:

package/dart/pubspec.yaml

@@ -8,7 +8,7 @@ description: >-
   Nomos 2 Dart frontend types — the hand-written kernel wire types plus the
   code-generated per-domain aggregate + directive-payload types. (De)serializes
   the EXACT serde JSON the Rust kernel + projection produce/consume.
-version: 0.64.3
+version: 0.64.4
 
 environment:
   sdk: ^3.5.0
@@ -17,7 +17,7 @@ dependencies:
   # The pure-data core (wire types, offer codec, NomosReads, schema validation, error
   # info). nomos_client depends on and re-exports it, so existing imports are unchanged.
   # For local monorepo dev, pubspec_overrides.yaml points this at ../dart_types.
-  nomos_types: ^0.8.1
+  nomos_types: ^0.8.2
   json_schema: ^5.2.2
   crypto: ^3.0.0
   package_config: ^2.1.0

package/dart/test/first_app_gauntlet_test.dart

@@ -148,6 +148,21 @@ void main() {
       final home = harness.session('home');
       final bornEstate = await _leg(
           'leg 2: internal CO2 law setup (Estate → Site → Asset)', () async {
+        // This is an internal framework-conformance setup, so declare its parent allowance explicitly
+        // through the same offer a compiled application ceremony uses. There is deliberately no harness
+        // or kernel fallback for a birth-capable workspace with missing policy.
+        final bornAt = DateTime.now().toUtc().toIso8601String();
+        await home.offerOutcome(
+          domain: 'co2',
+          directiveId: 'seedBirthPolicy',
+          payload: {
+            'maxBirthsPerPrincipal': 1,
+            'setBy': _owner,
+            'setAt': bornAt,
+          },
+          actor: _owner,
+          authorSecret: harness.deviceSecret(home.workspace),
+        );
         final birth = await home.offerOutcome(
           domain: 'co2',
           directiveId: 'nomosBirthEstate',
@@ -157,7 +172,7 @@ void main() {
             'country': 'GB',
             'baselineTonnesCo2e': 4200,
             'principal': _owner,
-            'bornAt': DateTime.now().toUtc().toIso8601String(),
+            'bornAt': bornAt,
           },
           actor: _owner,
         );

package/dart_types/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 0.8.2
+
+- Carry the typed bounded-startup, missing-law and governed child-policy errors used by the USDA-native
+  application lifecycle, preserving kernel refusals as actionable frontend states.
+
 ## 0.8.1
 
 - Carry the typed USDA-native kernel protocol, plan diagnostics, reference freshness and application

package/dart_types/pubspec.yaml

@@ -9,7 +9,7 @@ description: >-
   Pure kernel wire/data types for Nomos Dart frontends — no transport, no bridge,
   no runtime. The hand-written serde-JSON-compatible types plus the offer codec,
   reactive read engine, schema validation, and data-only error/trace types.
-version: 0.8.1
+version: 0.8.2
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.103.1",
+  "version": "0.103.3",
   "type": "module",
   "sideEffects": false,
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",

package/src/application_home_genesis.ts

@@ -0,0 +1,73 @@
+// NOMOS — explicit application-home founding ceremony.
+
+import type { Directive } from "./directive.js";
+
+const APPLICATION_HOME_GENESIS_BRAND = "__nomos_application_home_genesis_v1" as const;
+
+/** Facts fixed by the canonical receiving-group birth. Tenant law may derive founding offers
+ * from these facts; the host supplies none of them and cannot append an initializer. */
+export interface ApplicationHomeGenesisFacts {
+  readonly owner: string;
+  readonly workspaceName: string;
+  readonly bornAt: string;
+}
+
+export interface ApplicationHomeGenesisStep<
+  P extends Record<string, unknown> = Record<string, unknown>,
+> {
+  readonly domain: string;
+  readonly directive: Directive<P>;
+  readonly payload: (facts: ApplicationHomeGenesisFacts) => P;
+}
+
+export interface ApplicationHomeGenesis {
+  readonly [APPLICATION_HOME_GENESIS_BRAND]: true;
+  readonly steps: readonly ApplicationHomeGenesisStep<any>[];
+}
+
+/** Declare one ordinary offer which must run during application-home genesis. The directive's
+ * own schema and invariants remain the authority over its payload; this helper only binds the
+ * canonical founder facts to that offer and names the law namespace which owns it. */
+export function offerAtHomeGenesis<P extends Record<string, unknown>>(
+  domain: string,
+  directive: Directive<P>,
+  payload: (facts: ApplicationHomeGenesisFacts) => P,
+): ApplicationHomeGenesisStep<P> {
+  const namespace = domain.trim();
+  if (!/^[a-z][a-z0-9_-]*$/.test(namespace)) {
+    throw new Error(`offerAtHomeGenesis: '${domain}' is not a law domain name`);
+  }
+  if (directive === null || typeof directive !== "object" || typeof directive.id !== "string") {
+    throw new Error("offerAtHomeGenesis expects a finished intent or directive");
+  }
+  return Object.freeze({ domain: namespace, directive, payload });
+}
+
+/** The complete tenant-declared extension to the canonical application-home ceremony.
+ * An empty declaration is deliberate; omission means there are no tenant founding offers. */
+export function applicationHomeGenesis<
+  const Steps extends readonly ApplicationHomeGenesisStep<any>[],
+>(
+  ...steps: Steps
+): ApplicationHomeGenesis {
+  const seen = new Set<string>();
+  for (const step of steps) {
+    const key = `${step.domain}\u001f${step.directive.id}`;
+    if (seen.has(key)) {
+      throw new Error(
+        `applicationHomeGenesis repeats '${step.domain}/${step.directive.id}'; ` +
+          "one founding offer must have one accountable position",
+      );
+    }
+    seen.add(key);
+  }
+  return Object.freeze({
+    [APPLICATION_HOME_GENESIS_BRAND]: true,
+    steps: Object.freeze([...steps]),
+  });
+}
+
+export function isApplicationHomeGenesis(value: unknown): value is ApplicationHomeGenesis {
+  return value !== null && typeof value === "object" &&
+    (value as Record<string, unknown>)[APPLICATION_HOME_GENESIS_BRAND] === true;
+}

package/src/birth_meter.ts

@@ -28,7 +28,8 @@
  *       CAS-re-derived on every lane), and a synthesized framework `workspaceInvariant` (the exact
  *       WorkspaceQuota shape) refuses `birth-quota-exceeded` once the subject already holds its
  *       allowance. Allowance resolution: the latest {@link BirthGrant} for the subject if any, else
- *       the workspace's {@link BirthPolicy} singleton, else {@link DEFAULT_MAX_BIRTHS_PER_PRINCIPAL}.
+ *       the workspace's REQUIRED {@link BirthPolicy} singleton. There is no compiled allowance:
+ *       missing policy is invalid state and fails closed as `birth-policy-not-configured`.
  *
  *  A3 — THE POOL CHAINS TO ROOT. A parent births a child WITH the child's own descendant budget
  *       (`buildGenesisChain`'s `descendantPool` threads a `seedBirthPolicy` genesis step), so every
@@ -164,15 +165,6 @@ export const BIRTH_FRAMEWORK_QUERIES: readonly QueryDecl[] = [
   childLifecyclesByStatus,
 ];
 
-/**
- * THE DEFAULT BIRTH ALLOWANCE when a workspace carries neither a BirthPolicy singleton nor a grant
- * for the subject: a CONSERVATIVE floor for non-root workspaces (a home births a handful of estate
- * children; a platform that needs more seeds a BirthPolicy at its own genesis — the A3 induction —
- * or grants per-subject allowances). Root/platform governance already carries the 50-workspace
- * `WorkspaceQuota`; THIS default only ever binds law that never set its own policy.
- */
-export const DEFAULT_MAX_BIRTHS_PER_PRINCIPAL = 5;
-
 // ── the meter subject + the auto-record/auto-capture halves the `.births()` lane calls ─────────────
 
 /** The payload-carried birth SUBJECT the meter counts under: `principal`, else `owner`, else `""`
@@ -257,9 +249,9 @@ type MeterRow = { id?: string; data?: Record<string, unknown> };
  * THE BIRTH-QUOTA VERDICT — the PURE predicate over the COMMITTED captured reads (the same
  * `{queryId,args,result}` the plan recorded, CAS-re-derived on every lane). Counts the subject's
  * birth records and compares against its allowance (the latest BirthGrant.maxBirths if any, else
- * BirthPolicy.maxBirthsPerPrincipal, else {@link DEFAULT_MAX_BIRTHS_PER_PRINCIPAL}). The NEW birth's
- * record is NOT yet in the pre-apply state, so `count < allowance` (strict) is the correct test. A
- * subject-less birth fails CLOSED. Identical on author, edge admission, and verify_chain.
+ * BirthPolicy.maxBirthsPerPrincipal). The NEW birth's record is NOT yet in the pre-apply state, so
+ * `count < allowance` (strict) is the correct test. A subject-less birth and a workspace with no
+ * configured policy both fail CLOSED. Identical on author, edge admission, and verify_chain.
  */
 export function birthQuotaVerdict(
   reads: readonly { queryId: string; args: Record<string, string>; result: unknown }[],
@@ -277,7 +269,7 @@ export function birthQuotaVerdict(
     .filter((r) => r.data?.status === "retired" || r.data?.status === "reclaimed")
     .length;
   const count = Math.max(0, born - terminal);
-  // ALLOWANCE: the LATEST BirthGrant (max grantedAt) wins; else the BirthPolicy singleton; else the floor.
+  // ALLOWANCE: the LATEST BirthGrant (max grantedAt) wins; else the REQUIRED BirthPolicy singleton.
   let allowance: number | undefined;
   let latestGrantedAt = -Infinity;
   for (const g of rowsOf(birthGrantByPrincipal.id, "principal", subject)) {
@@ -293,7 +285,7 @@ export function birthQuotaVerdict(
     const max = Number(policyRows[0]?.data?.maxBirthsPerPrincipal ?? NaN);
     if (Number.isFinite(max)) allowance = max;
   }
-  if (allowance === undefined) allowance = DEFAULT_MAX_BIRTHS_PER_PRINCIPAL;
+  if (allowance === undefined) return { reject: "birth-policy-not-configured" };
   return count < allowance ? { accept: true } : { reject: "birth-quota-exceeded" };
 }
 

package/src/birth_meter_ensure.ts

@@ -31,6 +31,7 @@ import {
   BirthGrant,
 } from "./birth_meter.js";
 import {
+  grantBirthAllowance,
   reclaimChild,
   reclaimChildAsAdmin,
   reclaimChildAsAdminRequiresRetired,
@@ -41,6 +42,8 @@ import {
   retireChildAsAdminRequiresBirth,
   retireChildRequiresBirth,
   retireChildNotReclaimed,
+  seedBirthPolicy,
+  setBirthPolicy,
 } from "./framework/birth_meter.js";
 import { RelationTuple, relationTupleInstanceId, relationTuplesByObject } from "./framework/relations.js";
 import { GENESIS_WARRANT_ID, GenesisWarrant, seedGenesis } from "./framework/genesis.js";
@@ -236,6 +239,12 @@ export function withBirthMeterExports<M extends Record<string, unknown>>(mod: M)
   internalize("__nomos_NomosChildLifecycle", NomosChildLifecycle);
   internalize("__nomos_BirthPolicy", BirthPolicy);
   internalize("__nomos_BirthGrant", BirthGrant);
+  // A birth-capable workspace is never allowed to depend on a compiled allowance. Its law must
+  // carry both the genesis seed and the governed amendment verbs; presentation codegen keeps these
+  // framework controls private while the kernel can still route and authorize them normally.
+  internalize("__nomos_seedBirthPolicy", seedBirthPolicy);
+  internalize("__nomos_setBirthPolicy", setBirthPolicy);
+  internalize("__nomos_grantBirthAllowance", grantBirthAllowance);
   internalize("__nomos_retireChild", retireChild);
   internalize("__nomos_reclaimChild", reclaimChild);
   internalize("__nomos_retireChildAsAdmin", retireChildAsAdmin);

package/src/births.ts

@@ -84,6 +84,11 @@ export interface BusinessBirthDecl<
   readonly founderRoles: readonly string[];
   /** The business noun those founder roles govern. */
   readonly founderScope: string;
+  /** Explicit policy inherited by the BORN workspace. Zero declares a leaf workspace. */
+  readonly maxChildWorkspacesPerUser: number;
+  /** @internal Compiler-derived namespaces installed into the born workspace. The declaration owns
+   * the value; this list only repeats that value wherever the composed law requires its own state. */
+  __nomosBirthPolicyDomains?: readonly string[];
   /** Optional business noun used only to make the durable address readable. Defaults to the aggregate id. */
   readonly namespace?: string;
   /** Owning business domain, needed only when another domain composes this birth into a wider intent. */
@@ -114,6 +119,11 @@ export interface BusinessBirthSpec<F extends Record<string, Field>> {
     /** Business noun governed by those roles. Defaults to the born aggregate noun. */
     readonly scope?: string;
   };
+  /** Law for the workspace being born. This is mandatory because silence must not become a
+   * compiler-chosen quota; zero explicitly declares that the born workspace is a leaf. */
+  readonly children: {
+    readonly maxWorkspacesPerUser: number;
+  };
   /** Additional atomic business initialization which belongs to the same birth. */
   readonly initialise?: (
     root: AggregateRef<F>,
@@ -174,6 +184,13 @@ export function birth<F extends Record<string, Field>>(
         `birth(${aggregate.id}): founder scope '${founderScope}' is not a business noun`,
       );
     }
+    const maxChildWorkspacesPerUser = spec.children?.maxWorkspacesPerUser;
+    if (!Number.isInteger(maxChildWorkspacesPerUser) || maxChildWorkspacesPerUser < 0) {
+      throw new Error(
+        `birth(${aggregate.id}): children.maxWorkspacesPerUser must be an explicit non-negative integer; ` +
+          "zero declares a leaf workspace and Nomos has no compiled fallback",
+      );
+    }
     type Payload = BusinessBirthPayload<F>;
     const declaration = {
       __isBusinessBirth: true,
@@ -188,6 +205,7 @@ export function birth<F extends Record<string, Field>>(
       },
       founderRoles,
       founderScope,
+      maxChildWorkspacesPerUser,
       ...(spec.namespace !== undefined ? { namespace: spec.namespace } : {}),
     };
     const inDomain = (domain: string): BusinessBirthDecl<Payload, F> => {

package/src/business_birth.ts

@@ -51,6 +51,8 @@ import {
 
 /** Private recipe selectors. The kernel resolves these against the parent's current installed law. */
 export const CURRENT_LAW_PREFIX = "nomos:current-law:";
+/** @internal Compiler-only domain enumeration. It carries no allowance or authority. */
+export const BUSINESS_BIRTH_POLICY_DOMAINS_EXPORT = "__nomos_birth_policy_domains_c9f14a";
 
 export interface BusinessBirthMetadata {
   readonly aggregateId: string;
@@ -124,6 +126,7 @@ const applicationIntentOnlyBirths = new WeakSet<object>();
 function lowerOne<P extends Record<string, unknown>, F extends Record<string, Field>>(
   decl: BusinessBirthDecl<P, F>,
   domain: string,
+  initialBirthPolicyDomains: readonly string[] = [domain],
 ): Record<string, unknown> {
   const fields = (decl.payloadSchema as z.ZodObject<z.ZodRawShape>).shape;
   for (const field of INTERNAL_FIELDS) {
@@ -245,6 +248,16 @@ function lowerOne<P extends Record<string, unknown>, F extends Record<string, Fi
           payload: { domainHash: `${CURRENT_LAW_PREFIX}${domain}` },
           domainHash: `${CURRENT_LAW_PREFIX}${domain}`,
         },
+        ...(decl.__nomosBirthPolicyDomains ?? initialBirthPolicyDomains).map((policyDomain) => ({
+          domain: policyDomain,
+          directiveId: "seedBirthPolicy",
+          actor: founder,
+          payload: {
+            maxBirthsPerPrincipal: decl.maxChildWorkspacesPerUser,
+            setBy: founder,
+            setAt: p.bornAt,
+          },
+        })),
         {
           domain,
           directiveId: seedId,
@@ -396,10 +409,29 @@ export function businessBirthConsequence<
   return lowered;
 }
 
+/** @internal Bind the compiler-derived composed-law namespaces to declarations already captured by
+ * wider business intents. This chooses no policy value; it only repeats the tenant-declared value
+ * across the namespaces whose USDA says they can birth. */
+export function bindBusinessBirthPolicyDomains(
+  mod: Record<string, unknown>,
+  domains: readonly string[],
+): void {
+  const declarations = businessBirthsOf(mod);
+  if (declarations.length === 0) return;
+  const unique = [...new Set(domains)];
+  if (unique.length === 0 || unique.some((value) => value.trim().length === 0)) {
+    throw new Error("birth policy namespaces must be a non-empty list of domain names");
+  }
+  for (const declaration of declarations) {
+    declaration.__nomosBirthPolicyDomains = unique;
+  }
+}
+
 /** Lower the one tenant-facing birth declaration into ordinary, gate-visible framework directives. */
 export function expandBusinessBirthExports<M extends Record<string, unknown>>(
   mod: M,
   domain: string,
+  birthPolicyDomains?: readonly string[],
 ): Record<string, unknown> {
   const declarations = businessBirthsOf(mod);
   if (declarations.length === 0) return mod;
@@ -409,7 +441,18 @@ export function expandBusinessBirthExports<M extends Record<string, unknown>>(
         "ambiguous — model one born aggregate root per domain",
     );
   }
-  const lowered = lowerOne(declarations[0]!, domain);
+  const compiledDomains = mod[BUSINESS_BIRTH_POLICY_DOMAINS_EXPORT];
+  const selectedDomains = birthPolicyDomains ?? (
+    Array.isArray(compiledDomains) && compiledDomains.every((value) => typeof value === "string")
+      ? compiledDomains as string[]
+      : [domain]
+  );
+  const policyDomains = [...new Set(selectedDomains)];
+  if (policyDomains.length === 0 || policyDomains.some((value) => value.trim().length === 0)) {
+    throw new Error(`birth(${declarations[0]!.aggregate.id}): compiled law declares no policy namespaces`);
+  }
+  bindBusinessBirthPolicyDomains(mod, policyDomains);
+  const lowered = lowerOne(declarations[0]!, domain, policyDomains);
   for (const [key, generated] of Object.entries(lowered)) {
     if (!Object.prototype.hasOwnProperty.call(mod, key)) continue;
     const existing = mod[key];

package/src/codegen_dart_application.ts

@@ -405,6 +405,7 @@ export function generateDartApplication(
     applicationMembers.set(name, owner);
   };
   claimApplicationMember("activity", "the generated business history");
+  claimApplicationMember("model", "the generated model lifecycle");
   const collectionLines = new Map<string, string[]>();
   const collectionMembers = new Map<string, Set<string>>();
   const siblingImports = new Map<string, Set<string>>();
@@ -1922,7 +1923,9 @@ export function generateDartApplication(
                 `import 'package:nomos_flutter/src/application_status.dart' show ApplicationSignIn, ApplicationStatus;`,
               ]
             : []),
-          `import 'package:nomos_flutter/src/generated_application_host.dart' show NmsInternalApplicationUserBinding${
+          `import 'package:nomos_flutter/src/generated_application_host.dart' show ${
+            tenantRoot ? "NomosApplicationStartupState, " : ""
+          }NmsInternalApplicationUserBinding${
             tenantRoot || sharingPolicies.length > 0
               ? ", NmsInternalApplicationHost"
               : ""
@@ -1972,6 +1975,9 @@ export function generateDartApplication(
     `  ${application}._(${client} client${
       tenantRoot ? ", User currentUser" : ""
     }) : ${applicationInitializers.join(", ")};`,
+    ``,
+    `  /// Prove, adopt or restore the law this application was generated against.`,
+    `  NomosModel get model => _client.model;`,
     ...(opts.flutterHost === true && tenantRoot
       ? [
           ``,
@@ -1995,10 +2001,12 @@ export function generateDartApplication(
           `    required Widget Function(BuildContext context, ${application} application) builder,`,
           `    Widget Function(BuildContext context)? loadingBuilder,`,
           `    Widget Function(BuildContext context, Object error, VoidCallback retry)? errorBuilder,`,
+          `    ValueChanged<NomosApplicationStartupState>? onStartupStateChanged,`,
           `  }) => NmsInternalApplicationHost.home<${application}>(`,
           `    key: key, cloud: cloud, application: application, signIn: signIn,`,
           `    bind: nomosInternalBind${application}, builder: builder,`,
           `    loadingBuilder: loadingBuilder, errorBuilder: errorBuilder,`,
+          `    onStartupStateChanged: onStartupStateChanged,`,
           `  );`,
         ]
       : []),

package/src/codegen_dart_scenario.ts

@@ -90,6 +90,7 @@ export function generateDartScenario(
     readonly surfaceName?: string;
     readonly applicationFile?: string;
     readonly applicationModules?: readonly DomainModule[];
+    readonly applicationMaxChildWorkspacesPerUser?: number;
   } = {},
 ): string {
   const domain = options.surfaceName ?? mod.domain ?? mod.name;
@@ -195,6 +196,9 @@ export function generateDartScenario(
     `    final packageFiles = await _applicationPackages();`,
     `    final environment = await NomosTestHarness.ephemeral(`,
     `      lawUsdzPaths: packageFiles.map((file) => file.path).toList(growable: false),`,
+    ...(options.applicationMaxChildWorkspacesPerUser === undefined
+      ? []
+      : [`      applicationMaxChildWorkspacesPerUser: ${options.applicationMaxChildWorkspacesPerUser},`]),
     `      ownerSubject: person._principal,`,
     `      workspace: nmsInternalReceivingGroupNameOf(person._principal),`,
     `      nodeEntry: Platform.environment['NOMOS_NODE_ENTRY'],`,
@@ -224,6 +228,9 @@ export function generateDartScenario(
     `    final cloud = await NomosTestCloud.start(`,
     `      serverEntry: serverEntry, platform: applicationName,`,
     `      lawUsdzPaths: packageFiles.map((file) => file.path).toList(growable: false),`,
+    ...(options.applicationMaxChildWorkspacesPerUser === undefined
+      ? []
+      : [`      applicationMaxChildWorkspacesPerUser: ${options.applicationMaxChildWorkspacesPerUser},`]),
     `      onDiagnostic: Platform.environment['NOMOS_TEST_DIAGNOSTICS'] == '1' ? stderr.writeln : null,`,
     `    );`,
     `    late final NomosTestHarness environment;`,

package/src/codegen_proof.ts

@@ -2441,6 +2441,9 @@ export interface TsProofOptions {
   readonly domainHash: string;
   /** Stable-id structural interface used to teach the offline harness the hidden owned-birth seal slots. */
   readonly interface?: Readonly<Record<string, DomainInterface>>;
+  /** Compiled application-home child allowance. The local proof cloud seeds this exact law fact before
+   * warranting its throwaway platform; absent means this is a domain package, not an application root. */
+  readonly applicationMaxChildWorkspacesPerUser?: number;
 }
 
 /** THE PROOF TAXONOMY (co2 feedback): which legs a domain carries.
@@ -2455,6 +2458,8 @@ export type ProofKind = "compile-valid" | "standalone-provable" | "child-birth-p
  *  marker shape; the `proof-legs.json` index is a map of these by domain key). */
 export interface ProofLegs {
   readonly domain: string;
+  /** Application policy carried to the local proof ceremony; never a runner default. */
+  readonly applicationMaxChildWorkspacesPerUser?: number;
   /** THE TAXONOMY (co2 feedback) — the legs this domain has, in proof order. EVERY domain has at least
    *  `compile-valid`. OPTIONAL + ADDITIVE: an older-compiler legs file without it is treated as
    *  `["standalone-provable"]` (it only emitted standalone-provable domains). */
@@ -3223,7 +3228,12 @@ function generateSealedApplicationProof(
   const domain = mod.domain ?? mod.name;
   const applicationName = tsApplicationName(opts.packageName);
   const opener = `open${applicationName}`;
-  const marker = JSON.stringify(primaryLegs);
+  const marker = JSON.stringify({
+    ...primaryLegs,
+    ...(opts.applicationMaxChildWorkspacesPerUser === undefined
+      ? {}
+      : { applicationMaxChildWorkspacesPerUser: opts.applicationMaxChildWorkspacesPerUser }),
+  });
   const standalone = orderedStandaloneCreates(mod)[0];
   const businessBirth = primaryLegs.childBirth?.businessAggregateId !== undefined
     ? primaryLegs.childBirth