@githolon/dsl 0.105.13 → 0.105.14

package/dart/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.64.29
+
+- Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.
+
 ## 0.64.28
 
 - Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.

package/dart/lib/src/runner/node-entry.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // <define:__NOMOS_KERNEL_RELEASE__>
-var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "64219cdd5441cd92cb08d5200a6e65e7814364cc6d1b7cd1b014322ea4372092", version: "kernel-64219cdd", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "9ca691fd3524897b2edc236167b1b490701c85b41ad066cc41041829d42357f7", version: "kernel-9ca691fd", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
+var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "d37253bcefd90a180a6a1af96422a9f0724dfca9efd9ae7cff070afa2c410f09", version: "kernel-d37253bc", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "b6bddd8d61390edbe2ee4e5f3c7f21108bdb7800af746d20f568936f63e2d517", version: "kernel-b6bddd8d", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
 
 // runner/node-entry.ts
 import { createInterface } from "node:readline";
@@ -534,7 +534,7 @@ function createWebviewRunner({ post: post2, openRealm: openRealm2 }) {
     // FRAMEWORK-PRIVATE: generated clients say model.adopt(); the runner/client owns proof + receipt assembly.
     async adoptGeneratedModel(a) {
       const rec = pickSession(a);
-      const r = await (await liveHolon(rec)).__nomosAdoptModel(a.domain, a.candidateHash, { because: a.because, dispositions: a.dispositions });
+      const r = await (await liveHolon(rec)).__nomosAdoptModel(a.domain, a.candidateHash, { because: a.because });
       if (r && r.ok && rec.autoStop && rec.autoStop.trigger) rec.autoStop.trigger("write");
       return { verdict: r };
     },
@@ -7667,7 +7667,7 @@ function prepareManagedPromotion(report, candidateHash, domain, opts = {}) {
       domainHash: candidateHash,
       ...opts.replaces ? { replaces: opts.replaces } : {},
       retireReplaced: opts.retireReplaced ?? false,
-      ...opts.dispositions ? { dispositions: opts.dispositions } : {},
+      ...report.dispositions ? { dispositions: report.dispositions } : {},
       preflight
     }
   };
@@ -7683,7 +7683,6 @@ function prepareManagedRestoration(report, currentHash, priorHash, domain, opts
   }
   const acceptanceReason = opts.acceptanceReason?.trim();
   const prepared = prepareManagedPromotion(report, priorHash, domain, {
-    dispositions: report.dispositions,
     ...acceptanceReason ? { acceptanceReason } : {}
   });
   if (!prepared.ok) {
@@ -8173,7 +8172,14 @@ function createGovernanceOffers(ctx) {
         rows = JSON.parse(call("query", { queryBytes: qBytes2({ kind: "query", queryId: "relationTuplesByObject", paramsJson: JSON.stringify({ object }) }) })) || [];
       } else {
         const headers = authToken ? { Authorization: `Bearer ${authToken}`, "x-nomos-auth": authToken } : authHeaders;
-        const r = await _fetch(`${base}/v2/workspaces/${parent}/relationTuplesByObject?object=${encodeURIComponent(object)}`, { headers });
+        const route = await resolveFrameworkRoute({
+          parent,
+          operationId: "relationTuplesByObject",
+          method: "get",
+          token: authToken,
+          principal: p
+        });
+        const r = await _fetch(`${base}/v2/workspaces/${parent}${route.path}?object=${encodeURIComponent(object)}`, { headers });
         const text = await r.text();
         let body;
         try {
@@ -8227,7 +8233,14 @@ function createGovernanceOffers(ctx) {
         rows = JSON.parse(call("query", { queryBytes: qBytes2({ kind: "query", queryId: "relationTuplesByObject", paramsJson: JSON.stringify({ object }) }) })) || [];
       } else {
         const headers = authToken ? { Authorization: `Bearer ${authToken}`, "x-nomos-auth": authToken } : authHeaders;
-        const r = await _fetch(`${base}/v2/workspaces/${ws}/relationTuplesByObject?object=${encodeURIComponent(object)}`, { headers });
+        const route = await resolveFrameworkRoute({
+          parent: ws,
+          operationId: "relationTuplesByObject",
+          method: "get",
+          token: authToken,
+          principal: subj
+        });
+        const r = await _fetch(`${base}/v2/workspaces/${ws}${route.path}?object=${encodeURIComponent(object)}`, { headers });
         const text = await r.text();
         let body;
         try {
@@ -10234,7 +10247,7 @@ ${String(commit).toLowerCase()}`;
             domain,
             candidateHash,
             atHash,
-            ...opts.dispositions ? { dispositions: opts.dispositions } : {}
+            ackBy: connectionPrincipal
           })
         }));
       });
@@ -10247,8 +10260,7 @@ ${String(commit).toLowerCase()}`;
     }
     const prepared = prepareManagedPromotion(report, candidateHash, domain, {
       ...currentHash && currentHash !== candidateHash ? { replaces: currentHash } : {},
-      ...opts.because !== void 0 ? { acceptanceReason: opts.because } : {},
-      ...opts.dispositions ? { dispositions: opts.dispositions } : {}
+      ...opts.because !== void 0 ? { acceptanceReason: opts.because } : {}
     });
     if (!prepared.ok) return prepared;
     try {

package/dart/lib/src/runner/offline-install.mjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // <define:__NOMOS_KERNEL_RELEASE__>
-var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "64219cdd5441cd92cb08d5200a6e65e7814364cc6d1b7cd1b014322ea4372092", version: "kernel-64219cdd", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "9ca691fd3524897b2edc236167b1b490701c85b41ad066cc41041829d42357f7", version: "kernel-9ca691fd", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
+var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "d37253bcefd90a180a6a1af96422a9f0724dfca9efd9ae7cff070afa2c410f09", version: "kernel-d37253bc", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "b6bddd8d61390edbe2ee4e5f3c7f21108bdb7800af746d20f568936f63e2d517", version: "kernel-b6bddd8d", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
 
 // runner/offline-install.ts
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync } from "node:fs";
@@ -2009,7 +2009,7 @@ function prepareManagedPromotion(report, candidateHash, domain, opts = {}) {
       domainHash: candidateHash,
       ...opts.replaces ? { replaces: opts.replaces } : {},
       retireReplaced: opts.retireReplaced ?? false,
-      ...opts.dispositions ? { dispositions: opts.dispositions } : {},
+      ...report.dispositions ? { dispositions: report.dispositions } : {},
       preflight
     }
   };
@@ -2025,7 +2025,6 @@ function prepareManagedRestoration(report, currentHash, priorHash, domain, opts
   }
   const acceptanceReason = opts.acceptanceReason?.trim();
   const prepared = prepareManagedPromotion(report, priorHash, domain, {
-    dispositions: report.dispositions,
     ...acceptanceReason ? { acceptanceReason } : {}
   });
   if (!prepared.ok) {
@@ -7115,7 +7114,7 @@ async function mountWorkspace(eng2, ws, ledger) {
         throw new Error(`kernel refused restored main ${remoteMain}: ${JSON.stringify(mounted)}`);
       }
       restored = true;
-      if (!seeded?.seeded) {
+      if (!seeded?.seeded && ledger.readOnly !== true) {
         void pushCheckpoint(eng2, ws, ledger).catch(() => {
         });
       }
@@ -8580,12 +8579,12 @@ async function verifyChain(eng2, ws, ledger) {
 function verifyChainLocal(eng2, ws) {
   return namedQueryProto(eng2, ws, QueryOperation.VERIFY_CHAIN);
 }
-function historyPreflight(eng2, ws, domain, candidateHash, atHash, dispositions) {
+function historyPreflight(eng2, ws, domain, candidateHash, atHash, actor = "") {
   return namedQueryProto(eng2, ws, QueryOperation.HISTORY_PREFLIGHT, {
     domain,
     candidateHash,
     atHash,
-    ...dispositions ? { dispositions } : {}
+    ...actor.trim() ? { ackBy: actor.trim() } : {}
   });
 }
 function historyRestorePreflight(eng2, ws, domain, currentHash, priorHash, atHash, actor) {
@@ -8612,7 +8611,7 @@ function promotePreflighted(eng2, ws, domain, candidateHash, opts = {}) {
   }
   let report;
   try {
-    report = historyPreflight(eng2, ws, domain, candidateHash, atHash, opts.dispositions);
+    report = historyPreflight(eng2, ws, domain, candidateHash, atHash, actingPrincipal);
   } catch (error) {
     return { ok: false, stage: "preflight", error: String(error?.message || error) };
   }
@@ -8621,7 +8620,6 @@ function promotePreflighted(eng2, ws, domain, candidateHash, opts = {}) {
   const {
     replaces: _replaces,
     retireReplaced: _retireReplaced,
-    dispositions: _dispositions,
     acceptanceReason: _acceptance,
     ...authorOpts
   } = opts;

package/dart/lib/src/session_bound.dart

@@ -191,7 +191,7 @@ class DomainClientModelAdoptionRequired implements Exception {
   final String summary;
   final DomainModelReview review;
   final Future<void> Function()? _stage;
-  final Future<void> Function(String reason, {Map<String, Object?>? dispositions})? _accept;
+  final Future<void> Function(String reason)? _accept;
 
   const DomainClientModelAdoptionRequired({
     required this.expectedDomainKey,
@@ -200,7 +200,7 @@ class DomainClientModelAdoptionRequired implements Exception {
     required this.summary,
     required this.review,
     Future<void> Function()? stage,
-    Future<void> Function(String reason, {Map<String, Object?>? dispositions})? accept,
+    Future<void> Function(String reason)? accept,
   })  : _stage = stage,
         _accept = accept;
 
@@ -216,10 +216,10 @@ class DomainClientModelAdoptionRequired implements Exception {
 
   bool get canAccept => _accept != null;
 
-  /// [dispositions] carries only sids the kernel's OWN exact-history proof
-  /// named as truly removed (`{"retired": [sid, ...]}`) — never authored from
-  /// memory; a wrong disposition is a silent data-model error, not a waiver.
-  Future<void> accept(String reason, {Map<String, Object?>? dispositions}) {
+  /// Accept the candidate after reviewing the compiler-derived consequences.
+  /// Stable identities, retirements and value evolutions come from candidate
+  /// law; application code supplies accountability, never mechanical waivers.
+  Future<void> accept(String reason) {
     final value = reason.trim();
     if (value.isEmpty) {
       throw ArgumentError.value(
@@ -232,7 +232,7 @@ class DomainClientModelAdoptionRequired implements Exception {
     if (accept == null) {
       throw StateError('This generated model change cannot be accepted.');
     }
-    return accept(value, dispositions: dispositions);
+    return accept(value);
   }
 
   @override

package/dart/lib/src/webview_bridge.dart

@@ -2761,13 +2761,11 @@ class NomosBridge {
     required String domain,
     required String candidateHash,
     String? because,
-    Map<String, Object?>? dispositions,
   }) async {
     final r = _asMap(await _call('adoptGeneratedModel', {
       'domain': domain,
       'candidateHash': candidateHash,
       if (because != null) 'because': because,
-      if (dispositions != null) 'dispositions': dispositions,
     }));
     return ((r['verdict'] as Map?) ?? const <String, Object?>{})
         .cast<String, Object?>();
@@ -4057,7 +4055,8 @@ class NomosBridge {
     if (!_syncEvents.isClosed) await _syncEvents.close();
     if (!_signalEvents.isClosed) await _signalEvents.close();
     if (!_custodyEvents.isClosed) await _custodyEvents.close();
-    if (!_localWorkRejectedEvents.isClosed) await _localWorkRejectedEvents.close();
+    if (!_localWorkRejectedEvents.isClosed)
+      await _localWorkRejectedEvents.close();
     if (!_flameEvents.isClosed) await _flameEvents.close();
     if (!_spanEvents.isClosed) await _spanEvents.close();
     if (!_transferEvents.isClosed) await _transferEvents.close();
@@ -4382,8 +4381,8 @@ class _BridgeForeignWorkspaceReader implements NomosForeignWorkspaceReader {
 String? nomosInternalResidencyRequiredWorkspace(Object error) {
   final text = error.toString();
   if (!text.contains('foreign-read-not-ready')) return null;
-  final match = RegExp(r"source workspace '([^']+)' is not resident")
-      .firstMatch(text);
+  final match =
+      RegExp(r"source workspace '([^']+)' is not resident").firstMatch(text);
   final workspace = match?.group(1)?.trim();
   return (workspace == null || workspace.isEmpty) ? null : workspace;
 }

package/dart/pubspec.yaml

@@ -7,7 +7,7 @@ repository: https://github.com/Captain-App/nomos2
 description: >-
   Nomos 2 Dart client — generated domain values, intent payloads and application
   lifecycle types over the typed Nomos kernel protocol and USDA custody model.
-version: 0.64.28
+version: 0.64.29
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.105.13",
+  "version": "0.105.14",
   "type": "module",
   "sideEffects": false,
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",

package/runtime/generated-application-host.js

@@ -6698,7 +6698,7 @@ function prepareManagedPromotion(report, candidateHash, domain, opts = {}) {
       domainHash: candidateHash,
       ...opts.replaces ? { replaces: opts.replaces } : {},
       retireReplaced: opts.retireReplaced ?? false,
-      ...opts.dispositions ? { dispositions: opts.dispositions } : {},
+      ...report.dispositions ? { dispositions: report.dispositions } : {},
       preflight
     }
   };
@@ -6714,7 +6714,6 @@ function prepareManagedRestoration(report, currentHash, priorHash, domain, opts
   }
   const acceptanceReason = opts.acceptanceReason?.trim();
   const prepared = prepareManagedPromotion(report, priorHash, domain, {
-    dispositions: report.dispositions,
     ...acceptanceReason ? { acceptanceReason } : {}
   });
   if (!prepared.ok) {
@@ -7204,7 +7203,14 @@ function createGovernanceOffers(ctx) {
         rows = JSON.parse(call("query", { queryBytes: qBytes2({ kind: "query", queryId: "relationTuplesByObject", paramsJson: JSON.stringify({ object }) }) })) || [];
       } else {
         const headers = authToken ? { Authorization: `Bearer ${authToken}`, "x-nomos-auth": authToken } : authHeaders;
-        const r = await _fetch(`${base}/v2/workspaces/${parent}/relationTuplesByObject?object=${encodeURIComponent(object)}`, { headers });
+        const route = await resolveFrameworkRoute({
+          parent,
+          operationId: "relationTuplesByObject",
+          method: "get",
+          token: authToken,
+          principal: p
+        });
+        const r = await _fetch(`${base}/v2/workspaces/${parent}${route.path}?object=${encodeURIComponent(object)}`, { headers });
         const text2 = await r.text();
         let body;
         try {
@@ -7258,7 +7264,14 @@ function createGovernanceOffers(ctx) {
         rows = JSON.parse(call("query", { queryBytes: qBytes2({ kind: "query", queryId: "relationTuplesByObject", paramsJson: JSON.stringify({ object }) }) })) || [];
       } else {
         const headers = authToken ? { Authorization: `Bearer ${authToken}`, "x-nomos-auth": authToken } : authHeaders;
-        const r = await _fetch(`${base}/v2/workspaces/${ws}/relationTuplesByObject?object=${encodeURIComponent(object)}`, { headers });
+        const route = await resolveFrameworkRoute({
+          parent: ws,
+          operationId: "relationTuplesByObject",
+          method: "get",
+          token: authToken,
+          principal: subj
+        });
+        const r = await _fetch(`${base}/v2/workspaces/${ws}${route.path}?object=${encodeURIComponent(object)}`, { headers });
         const text2 = await r.text();
         let body;
         try {
@@ -9265,7 +9278,7 @@ ${String(commit).toLowerCase()}`;
             domain,
             candidateHash,
             atHash,
-            ...opts.dispositions ? { dispositions: opts.dispositions } : {}
+            ackBy: connectionPrincipal
           })
         }));
       });
@@ -9278,8 +9291,7 @@ ${String(commit).toLowerCase()}`;
     }
     const prepared = prepareManagedPromotion(report, candidateHash, domain, {
       ...currentHash && currentHash !== candidateHash ? { replaces: currentHash } : {},
-      ...opts.because !== void 0 ? { acceptanceReason: opts.because } : {},
-      ...opts.dispositions ? { dispositions: opts.dispositions } : {}
+      ...opts.because !== void 0 ? { acceptanceReason: opts.because } : {}
     });
     if (!prepared.ok) return prepared;
     try {
@@ -13492,16 +13504,34 @@ function applicationError(message, code, cause) {
   if (cause !== void 0) error.cause = cause;
   return error;
 }
-async function ensureGeneratedModelCurrent(application) {
+async function ensureGeneratedModelCurrent(application, approveModel) {
   if (application.model?.adopt === void 0) {
     throw applicationError(
       "This generated application has no model lifecycle surface and cannot prove its plans are current.",
       "nomos.application.model_lifecycle_missing"
     );
   }
-  const adoption = await application.model.adopt();
+  let adoption = await application.model.adopt();
+  if (adoption.status === "needs-staging" && adoption.stage !== void 0) {
+    adoption = await adoption.stage();
+  }
   if (adoption.status === "adopted") return;
   if (adoption.status === "needs-decision") {
+    if (approveModel !== void 0 && adoption.accept !== void 0) {
+      const approval = await approveModel({
+        summary: adoption.summary,
+        review: adoption.review
+      });
+      const because = approval.because.trim();
+      if (!because) {
+        throw applicationError(
+          "Model approval must state the business reason for the change.",
+          "nomos.application.model_decision_reason_missing"
+        );
+      }
+      adoption = await adoption.accept(because);
+      if (adoption.status === "adopted") return;
+    }
     throw applicationError(
       "This application model changes prior business outcomes and needs an attributed migration decision before the app can write.",
       "nomos.application.model_decision_required",
@@ -13624,7 +13654,7 @@ async function nomosInternalOpenGeneratedApplication(options, bind, internals =
       ...environment?.NOMOS_TEST_K_ROOT_PUBLIC ? { __testKRootPublic: environment.NOMOS_TEST_K_ROOT_PUBLIC } : {}
     });
     const applicationObject = measureOpenSync("bind generated business API", () => bind(holon2, user));
-    await ensureGeneratedModelCurrent(applicationObject);
+    await ensureGeneratedModelCurrent(applicationObject, options.approveModel);
     await measureOpen("prepare generated entry commands", () => prepareGeneratedEntryCommands(holon2, options.readyCommands, options.onPerformance));
     const stop = holon2.autoSync({
       onResult: (result) => {
@@ -13871,7 +13901,6 @@ async function nomosInternalOpenGeneratedApplication(options, bind, internals =
           parent: application,
           principal,
           subject,
-          lawHash: options.lawHash,
           device: { secret, public: publicKey },
           authToken,
           idToken: authToken,
@@ -13882,9 +13911,13 @@ async function nomosInternalOpenGeneratedApplication(options, bind, internals =
         const verdict = birth.verify;
         if (verdict !== void 0 && verdict.valid !== true) throw new Error(`the born application failed replay verification: ${String(verdict.error ?? "unknown")}`);
       } else if (!hadDurableSecret) {
-        await measureOpen("enrol application device with its parent", () => authorityHolon.ensureParentSignerEnrollment({
-          parent: application,
-          principal,
+        await measureOpen("enrol application device in its private custody", () => authorityHolon.ensureParentSignerEnrollment({
+          // The write gate that this device will use is the receiving-group workspace itself.
+          // The application root authorises/births that home; it is not a substitute signer index.
+          parent: receivingGroup,
+          // The author gate speaks canonical Nomos principals. A provider subject is deliberately
+          // opaque and may contain its own namespace separators; never enrol that raw value as the actor.
+          principal: subject,
           publicKey,
           authorSecret: secret,
           authToken,
@@ -13904,8 +13937,8 @@ async function nomosInternalOpenGeneratedApplication(options, bind, internals =
       if (verified.valid !== true) throw new Error(`the private authority context failed replay verification: ${String(verified.error ?? "unknown")}`);
       await measureOpen("save application bootstrap progress", () => store.saveText(journalState, "verified"));
       try {
-        await measureOpen("confirm parent signer enrolment", () => authorityHolon.ensureParentSignerEnrollment({
-          parent: application,
+        await measureOpen("confirm private-custody signer enrolment", () => authorityHolon.ensureParentSignerEnrollment({
+          parent: receivingGroup,
           principal: subject,
           authorSecret: secret,
           authToken,
@@ -13930,7 +13963,7 @@ async function nomosInternalOpenGeneratedApplication(options, bind, internals =
     } catch {
     }
     const applicationObject = measureOpenSync("bind generated business API", () => bind(holon, user));
-    await measureOpen("confirm generated model is current", () => ensureGeneratedModelCurrent(applicationObject));
+    await measureOpen("confirm generated model is current", () => ensureGeneratedModelCurrent(applicationObject, options.approveModel));
     await measureOpen("prepare generated entry commands", () => prepareGeneratedEntryCommands(holon, options.readyCommands, options.onPerformance));
     phase = "current";
     autoSync = holon.autoSync({

package/src/build_package.ts

@@ -27,6 +27,7 @@ import { createHash } from "node:crypto";
 import { z } from "zod";
 
 import type { AggregateHandle } from "./aggregate.js";
+import type { Field } from "./fields.js";
 import type { Directive } from "./directive.js";
 import type { DomainModule, PermissionVocabulary, DartImport } from "./codegen_dart.js";
 import type { AnyCount } from "./count.js";
@@ -83,6 +84,11 @@ import {
   applyConflictPolicyResolvers,
   conflictPoliciesOf,
 } from "./conflicts.js";
+import {
+  applyFieldEvolutionsToAggregates,
+  fieldEvolutionsOf,
+  retirementsOf,
+} from "./evolution.js";
 import {
   expandBusinessBirthExports,
   isBusinessBirthDirective,
@@ -200,6 +206,8 @@ export interface DomainModuleSpec {
 export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   const domain = spec.domain ?? spec.name;
   const conflictPolicies = conflictPoliciesOf(spec.modules, domain);
+  const fieldEvolutions = fieldEvolutionsOf(spec.modules);
+  const retirements = retirementsOf(spec.modules, domain);
   const applicationLanguage = applicationLanguageOf(spec.modules, domain);
   let merged: Mod = {};
   for (const m of spec.modules) merged = { ...merged, ...m };
@@ -520,11 +528,34 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
     directives.push(dir);
     autoDeclaredEnsures.push(ty);
   }
-  const aggregates = applyConflictPoliciesToAggregates(
-    [...byId.values()],
-    conflictPolicies,
+  const aggregates = applyFieldEvolutionsToAggregates(
+    applyConflictPoliciesToAggregates(
+      [...byId.values()],
+      conflictPolicies,
+      domain,
+    ),
+    fieldEvolutions,
     domain,
   );
+  const currentAggregates = new Map(aggregates.map((aggregate) => [aggregate.id, aggregate]));
+  for (const retired of retirements) {
+    const current = currentAggregates.get(retired.aggregate);
+    if (retired.kind === "aggregate" && current !== undefined) {
+      throw new Error(
+        `domain '${domain}' declares '${retired.aggregate}' both current and retired`,
+      );
+    }
+    if (
+      retired.kind === "field" &&
+      current !== undefined &&
+      retired.field !== undefined &&
+      (current.fields as Record<string, Field>)[retired.field] !== undefined
+    ) {
+      throw new Error(
+        `domain '${domain}' declares '${retired.aggregate}.${retired.field}' both current and retired`,
+      );
+    }
+  }
   const directiveIds = new Set(directives.map((d) => d.id));
   for (const task of declaredCapabilities) {
     for (const directive of [task.obligation, task.complete, task.fail, task.block, task.deadLetter]) {
@@ -855,6 +886,9 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
     // hash-bearing manifest; payload-field tracing also drives generated typed references.
     // Omit-when-empty because ordinary domains need no resolver metadata.
     ...(surfacedResolvers.length > 0 ? { surfacedResolvers } : {}),
+    // Explicit authored tombstones are law. The compiler identity registry may remember
+    // every disappearance, but only these declarations permit an activation to retire it.
+    ...(retirements.length > 0 ? { retirements } : {}),
     ...(queries.length > 0 ? { queries } : {}),
     ...(counts.length > 0 ? { counts } : {}),
     ...(spatials.length > 0 ? { spatials } : {}),

package/src/check_package_main.ts

@@ -17,6 +17,8 @@ import { pathToFileURL } from "node:url";
 import { composeDomainModule, type Mod } from "./build_package.js";
 import type { DomainModule } from "./codegen_dart.js";
 import { bindEnumTypeExports } from "./enum_type.js";
+import { discoverEvolutionModulePaths, isEvolutionModulePath } from "./evolution_files.js";
+import { assertEvolutionModuleExports } from "./evolution.js";
 import { checkDomainModules, formatFindings, hasRefusal, type Finding } from "./law_check.js";
 import { LawSourceMap } from "./law_source_map.js";
 import {
@@ -105,9 +107,18 @@ export async function loadComposedModulesWithSources(
     const files: string[] = [];
     for (const rel of d.modules) {
       const abs = path.resolve(cfgDir, rel);
+      if (isEvolutionModulePath(abs)) {
+        fail(
+          `domain '${d.key}': ${rel} is an evolution concern; move it under ` +
+            `evolutions/${d.key}/ and remove it from feature modules so it cannot enter QuickJS`,
+        );
+      }
       if (!existsSync(abs)) fail(`domain '${d.key}': module not found: ${abs}`);
       files.push(abs);
     }
+    for (const abs of discoverEvolutionModulePaths(cfgDir, d.key)) {
+      if (!files.includes(abs)) files.push(abs);
+    }
     try {
       assertPublicPackageImports(files);
     } catch (error) {
@@ -116,6 +127,7 @@ export async function loadComposedModulesWithSources(
     for (const abs of files) {
       // Cache-bust so a re-import (the LSP re-check after an edit) re-evaluates the edited module.
       const mod = (await import(`${pathToFileURL(abs).href}?t=${Date.now()}`)) as Mod;
+      if (isEvolutionModulePath(abs)) assertEvolutionModuleExports(mod, abs);
       bindEnumTypeExports(mod, abs);
       mods.push(mod);
     }
@@ -201,7 +213,6 @@ async function main(): Promise<void> {
   const findings: Finding[] = [...dependencyFindings, ...checkDomainModules(modules)];
 
   // ── EVOLVE PREVIEW (--against): diff the current build against a prior law + pre-fire the gate. ──
-  let evolveDispositions: Record<string, unknown> | undefined;
   if (againstIdx >= 0 || againstArg !== undefined) {
     if (againstArg === undefined || againstArg.startsWith("--")) {
       fail(`--against needs a path: --against <${NOMOS_IDENTITY_FILENAME} | package dir>`);
@@ -218,7 +229,6 @@ async function main(): Promise<void> {
     const current = currentEvolveLaw(modules, lock);
     const diff = evolveDiff(prior.law, current);
     findings.push(...diff.findings);
-    if (Object.keys(diff.dispositions).length > 0) evolveDispositions = diff.dispositions;
     if (!asJson) console.log(`githolon check: evolve preview against ${prior.source}`);
   }
 
@@ -255,14 +265,6 @@ async function main(): Promise<void> {
   }
   if (findings.length === 0) console.log("  all clear — no static twin flagged anything");
 
-  // The consolidated, pasteable dispositions the destructive evolves demand (per domain).
-  if (evolveDispositions !== undefined) {
-    console.log(
-      "\ngitholon check: to admit the destructive evolve, include `dispositions` in the installation offer:",
-    );
-    console.log(JSON.stringify(evolveDispositions, null, 2));
-  }
-
   process.exit(hasRefusal(findings) ? 1 : 0);
 }
 

package/src/codegen_dart.ts

@@ -2742,14 +2742,14 @@ export function generateDartActivityRegistry(entries: readonly PackageActivityEn
     `  final String summary;`,
     `  final NomosModelReview review;`,
     `  final Future<NomosModelAdoption> Function()? _stage;`,
-    `  final Future<NomosModelAdoption> Function(String, {Map<String, Object?>? dispositions})? _accept;`,
+    `  final Future<NomosModelAdoption> Function(String)? _accept;`,
     `  const NomosModelAdoption.adopted({required this.summary, required this.review})`,
     `      : status = NomosModelAdoptionStatus.adopted, _stage = null, _accept = null;`,
     `  const NomosModelAdoption.blocked({required this.summary, required this.review})`,
     `      : status = NomosModelAdoptionStatus.blocked, _stage = null, _accept = null;`,
     `  NomosModelAdoption.needsStaging({required this.summary, required this.review, required Future<NomosModelAdoption> Function() stage})`,
     `      : status = NomosModelAdoptionStatus.needsStaging, _stage = stage, _accept = null;`,
-    `  NomosModelAdoption.needsDecision({required this.summary, required this.review, required Future<NomosModelAdoption> Function(String, {Map<String, Object?>? dispositions}) accept})`,
+    `  NomosModelAdoption.needsDecision({required this.summary, required this.review, required Future<NomosModelAdoption> Function(String) accept})`,
     `      : status = NomosModelAdoptionStatus.needsDecision, _stage = null, _accept = accept;`,
     `  Future<NomosModelAdoption> stage() {`,
     `    final stageCandidate = _stage;`,
@@ -2758,14 +2758,14 @@ export function generateDartActivityRegistry(entries: readonly PackageActivityEn
     `    }`,
     `    return stageCandidate();`,
     `  }`,
-    `  Future<NomosModelAdoption> accept(String because, {Map<String, Object?>? dispositions}) {`,
+    `  Future<NomosModelAdoption> accept(String because) {`,
     `    final reason = because.trim();`,
     `    final acceptDecision = _accept;`,
     `    if (status != NomosModelAdoptionStatus.needsDecision || acceptDecision == null) {`,
     `      throw StateError('This model change is not waiting for a business decision.');`,
     `    }`,
     `    if (reason.isEmpty) throw ArgumentError('accept(reason) needs the business reason for changing prior outcomes');`,
-    `    return acceptDecision(reason, dispositions: dispositions);`,
+    `    return acceptDecision(reason);`,
     `  }`,
     `}`,
     ``,
@@ -4788,6 +4788,9 @@ export interface DomainModule {
    * Absent when the domain declares no Surfaced field (byte-identical — the era rule).
    */
   surfacedResolvers?: import("./surfaced_lint.js").SurfacedResolverBinding[];
+  /** Explicit tombstones authored in separate evolution files. These compile into
+   * candidate USDA and are never exposed through generated tenant clients. */
+  retirements?: import("./evolution.js").Retirement[];
   /**
    * STABLE-ID CONTINUITY (#58 — names are labels, identity is minted). When present
    * (attached by `nomos-compile` from the PRIOR build's identity manifests), the

package/src/codegen_dart_client.ts

@@ -1673,11 +1673,11 @@ export function generateDartBridgeClient(
       `      sameOutcome: projection?['equal'] as bool?, differences: differences);`,
       `  }`,
       ``,
-      `  Future<NomosModelAdoption> _adoptGeneratedModel([String? because, Map<String, Object?>? dispositions]) async {`,
+      `  Future<NomosModelAdoption> _adoptGeneratedModel([String? because]) async {`,
       `    final raw = await bridge.nomosFrameworkAdoptGeneratedModel(`,
       `      domain: ${dartStr(
         domain
-      )}, candidateHash: domainHash, because: because, dispositions: dispositions);`,
+      )}, candidateHash: domainHash, because: because);`,
       `    final reportRaw = raw['report'];`,
       `    final report = reportRaw is Map ? reportRaw.cast<String, Object?>() : null;`,
       `    final review = _nomosModelReview(report);`,
@@ -1703,20 +1703,9 @@ export function generateDartBridgeClient(
       `    if (stage == 'acceptance') {`,
       `      return NomosModelAdoption.needsDecision(`,
       `        summary: 'This model would change prior business outcomes. Review the differences and record why that is intended.',`,
-      `        review: review, accept: (reason, {dispositions}) => _adoptGeneratedModel(reason, dispositions));`,
+      `        review: review, accept: (reason) => _adoptGeneratedModel(reason));`,
       `    }`,
       `    final evolve = (report?['evolve'] as Map?)?.cast<String, Object?>();`,
-      `    // A field/aggregate the candidate genuinely removed is a #58 disposition decision, not a`,
-      `    // dead end: retry with the SAME accept/dispositions seam so the tenant's own policy can`,
-      `    // supply dispositions.retired. Every prior stage (promoted/staging-required/acceptance) is`,
-      `    // already handled above; 'identity' (needs sign-in) is the one remaining stage this must NOT`,
-      `    // paper over, so it is the sole exclusion rather than requiring an exact 'preflight' match or`,
-      `    // exact boolean report fields, which may not round-trip identically across every bridge.`,
-      `    if (stage != 'identity') {`,
-      `      return NomosModelAdoption.needsDecision(`,
-      `        summary: 'This model cannot yet interpret every existing value without a declared disposition. Review the differences and record why that is intended.',`,
-      `        review: review, accept: (reason, {dispositions}) => _adoptGeneratedModel(reason, dispositions));`,
-      `    }`,
       `    final rawError = raw['error']?.toString().trim();`,
       `    final summary = rawError != null && rawError.isNotEmpty`,
       `        ? rawError`,
@@ -2436,8 +2425,8 @@ export function generateDartBridgeClient(
           `            : null,`,
         ]),
     `        accept: adoption.status == NomosModelAdoptionStatus.needsDecision`,
-    `            ? (reason, {dispositions}) async {`,
-    `                final accepted = await adoption.accept(reason, dispositions: dispositions);`,
+    `            ? (reason) async {`,
+    `                final accepted = await adoption.accept(reason);`,
     `                // A retry that still isn't adopted (a transient business-outcome/history race,`,
     `                // e.g. concurrent writes landing between the bare preflight and this accept) must`,
     `                // NOT be swallowed as a terminal StateError: re-throw the SAME typed exception so`,