@githolon/dsl 0.105.23 → 0.106.0

package/src/aggregate.ts

@@ -61,14 +61,20 @@ const READ_CAP_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$/;
 /**
  * THE READ AUDIENCE (secure-by-default rework — `architecture/secure_by_default_dsl.md`). Every
  * aggregate DECLARES who may read it; there is no silent default (the compiler refuses an undeclared
- * aggregate). Three choices:
+ * aggregate). Four choices:
  *   • `public`        — anyone reads (plaintext). The deliberate exception.
  *   • `readableBy`    — holders of `cap` read (gate-enforced). Sugar over the shipped read-visibility
  *                       (`requires(cap)`); per-field `.secret()` escalates to team-E2E.
+ *   • `ownerReadable` — the workspace owner reads (plaintext, gate-enforced). Owner-only WITHOUT the
+ *                       confidentiality of `owned`: authorization and encryption are separable concerns,
+ *                       and a denormalised access index / discovery card needs the first, not the second.
+ *                       Gates on the framework's workspace-level owner-read relation, which every workspace
+ *                       already holds from birth — so an existing chain adopts it with no backfill and the
+ *                       operator can still serve the plaintext. This is `owned` minus the encryption pass.
  *   • `owned`         — the owner reads; owner = the verified authoring principal, stamped into the
  *                       obscure framework field. The read rule is record-grained so later sharing can
  *                       extend one record without changing this declaration; content is operator-blind.
- * `.public()`/`.readableBy(cap)`/`.owned()` are the fluent declarations on the aggregate handle.
+ * `.public()`/`.readableBy(cap)`/`.ownerReadable()`/`.owned()` are the fluent declarations on the handle.
  */
 export type Audience =
   | { readonly kind: "public" }
@@ -320,6 +326,11 @@ export interface AudienceMethods<Id extends string, F extends Record<string, Fie
   public(): NameableHandle<Id, F>;
   /** Holders of `capability` may read (gate-enforced) — sugar over `requires(cap)`. */
   readableBy(capability: string): NameableHandle<Id, F>;
+  /** The workspace owner may read (plaintext, gate-enforced). Owner-only authorization WITHOUT `owned`'s
+   *  operator-blind encryption — for a denormalised access index / discovery card the operator legitimately
+   *  serves. Gates on the framework owner-read relation every workspace holds from birth, so it adopts on an
+   *  existing chain with no backfill. Tenant code never names the framework relation. See {@link owned}. */
+  ownerReadable(): NameableHandle<Id, F>;
   /** The verified creator owns this record. Nomos stamps ownership, seats its per-record read relation and
    *  encrypts every non-`.meta()` content field; tenant code never names the framework field/relation. */
   owned(): NameableHandle<Id, F>;
@@ -679,6 +690,14 @@ export function aggregate<const Id extends string, F extends Record<string, Fiel
       const v = requires(cap); // validates the capability name
       return build({ kind: "readableBy", cap: v.requires }, v, contracts, dartNameDecl);
     },
+    // Owner-only, PLAINTEXT. Deliberately a `readableBy` audience gating on the framework owner-read
+    // relation — NOT `kind: "owned"`, so the encryption lowering below is skipped and content stays
+    // operator-readable. The relation is seated at workspace scope (`workspace:self#<rel>`) at birth
+    // (see framework/home.ts genesis), which is why an existing chain resolves it with no backfill.
+    // `owned()` is the same read gate PLUS per-record encryption; this is the confidentiality-free rung.
+    ownerReadable: () => {
+      return build({ kind: "readableBy", cap: OWNED_READ_RELATION }, requires(OWNED_READ_RELATION), contracts, dartNameDecl);
+    },
     owned: () => {
       return build({ kind: "owned", ownerField: OWNER_FIELD }, requires(OWNED_READ_RELATION), contracts, dartNameDecl);
     },

package/src/capability_exports.ts

@@ -57,7 +57,7 @@ export function capabilityDeclarationsOf(v: unknown): Record<string, unknown>[]
 // `relations` carries the receipt fence's relation SCHEMA. It MUST expand with the bundle:
 // `.requires(...)` is inert in a law that declares no relation schema, so omitting it would
 // leave every capability looking fenced while enforcing nothing.
-const PIECES = ["aggregate", "obligation", "complete", "fail", "block", "deadLetter", "tasks", "relations", "grantProvider", "revokeProvider"] as const;
+const PIECES = ["aggregate", "obligation", "complete", "fail", "block", "deadLetter", "reschedule", "tasks", "relations", "grantProvider", "revokeProvider"] as const;
 
 /**
  * Expand every `capability()` bundle in an exports bag into discoverable

package/src/codegen_dart_client.ts

@@ -39,7 +39,7 @@ import { isGitObjectIdSchema, isSha256DigestSchema, type Field } from "./fields.
 import type { Directive } from "./directive.js";
 import type { QueryDecl } from "./query.js";
 import type { DomainModule } from "./codegen_dart.js";
-import { requiredKernelFeatures } from "./kernel_capabilities.js";
+import { requiredKernelContracts } from "./kernel_capabilities.js";
 import {
   cap,
   readModelClassName,
@@ -352,7 +352,7 @@ export function generateDartBridgeClient(
         })[domain];
   const className = dartClientClassName(domain);
   const hashConst = dartHashConstName(mod.name);
-  const requiresKernelFeats = requiredKernelFeatures([mod]);
+  const kernelContracts = requiredKernelContracts([mod]);
   const supportImport =
     opts.supportImport === "package"
       ? "package:nomos_client/src/nms_generated_runtime.dart"
@@ -2360,10 +2360,9 @@ export function generateDartBridgeClient(
     `  /// THE STATIC INTERFACE DESCRIPTOR (session_bound_clients.md asks 5/9): what this client EXPECTS`,
     `  /// of the workspace it binds to — the domain key, the law hash it was generated against, and the`,
     `  /// structural interface (#72). Consumed by [bind] and by \`session.assertCompatible(${className}.interface)\`.`,
-    `  /// The kernel capabilities this law REQUIRES (release coherence): a compound-key query needs`,
-    `  /// 'compoundKeys', etc. [bind] asserts the connected cloud's kernel advertises these.`,
-    `  static const List<String> requiresKernel = [${requiresKernelFeats
-      .map((f) => dartStr(f))
+    `  /// Standard OSGi Contract Namespace requirements derived from this law's shape.`,
+    `  static const List<Map<String, String>> kernelContracts = [${kernelContracts
+      .map((contract) => `{${dartStr("namespace")}: ${dartStr(contract.namespace)}, ${dartStr("name")}: ${dartStr(contract.name)}, ${dartStr("version")}: ${dartStr(contract.version)}}`)
       .join(", ")}];`,
     ``,
     `  static const NomosClientInterface interface = NomosClientInterface(`,
@@ -2459,10 +2458,8 @@ export function generateDartBridgeClient(
     `    final law = await session.lawStatus(interface.expectedDomainHash);`,
     `    if (law['drifted'] == true) await adoptGeneratedModel();`,
     `    await session.assertCompatible(interface);`,
-    `    // RELEASE COHERENCE: the cloud's kernel must support what this law needs (e.g. a compound-key query`,
-    `    // needs 'compoundKeys'). Throws a typed KernelCoherenceError on a stale/mismatched cloud kernel,`,
-    `    // up front — not an opaque deep-fold refusal. Best-effort (no-op if the cloud advertises no caps).`,
-    `    await session.assertKernelCoherence(requiresKernel, lawHash: ${hashConst});`,
+    `    // RELEASE COHERENCE: resolve this law's OSGi Contract Namespace requirements before use.`,
+    `    await session.assertKernelCoherence(kernelContracts, lawHash: ${hashConst});`,
     ...(ownedScope === undefined
       ? []
       : [

package/src/codegen_ts.ts

@@ -1931,9 +1931,8 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     `  checkCompat?(compat: { lawHash: string; interfaceHash: string; packageName: string }, requirement?: unknown): NomosCompatVerdict | null;`,
     `  /** Framework-private readiness hint; generated domain bindings keep first-use plan work off the offer path. */`,
     `  prepareDomain?(domain: string, packageHash: string): void;`,
-    `  /** RELEASE COHERENCE: throws a typed KernelCoherenceError at bind if the cloud's kernel lacks a`,
-    `   *  capability this law requires (e.g. \`compoundKeys\`) — instead of an opaque deep fold refusal. */`,
-    `  assertKernelCoherence?(requiresKernel: readonly string[], opts?: { lawHash?: string }): unknown;`,
+    `  /** Resolve the law's standard OSGi Contract Namespace requirements before bind. */`,
+    `  assertKernelCoherence?(requirements: readonly { namespace: "osgi.contract"; name: string; version: string }[], opts?: { lawHash?: string }): unknown;`,
     `  /** The live compat verdict (set by checkCompat). \`has(memberId)\` is the dark-launch feature flag;`,
     `   *  \`refresh()\` re-derives against the current projection. Absent until the factory binds. */`,
     `  compat?: NomosCompatVerdict;`,
@@ -3893,9 +3892,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
             clientInterface !== undefined
               ? `  holon.checkCompat?.(${compatConstName(opts.packageName)}, ${interfaceConstName(opts.packageName)});`
               : `  holon.checkCompat?.(${compatConstName(opts.packageName)});`,
-            // RELEASE COHERENCE: throw a typed skew error AT BIND if the cloud's kernel lacks a capability
-            // this law requires (e.g. compoundKeys) — instead of the opaque deep fold refusal later.
-            `  holon.assertKernelCoherence?.(${compatConstName(opts.packageName)}.requiresKernel ?? [], { lawHash: ${compatConstName(opts.packageName)}.lawHash });`,
+            `  holon.assertKernelCoherence?.(${compatConstName(opts.packageName)}.kernelContracts ?? [], { lawHash: ${compatConstName(opts.packageName)}.lawHash });`,
           ]
         : []),
       `  return {`,

package/src/compat_manifest.ts

@@ -17,11 +17,10 @@ export interface NomosCompat {
   readonly domains: Record<string, { readonly identityHash?: string }>;
   /** The generator provenance — the `@githolon/dsl` version + this manifest's schema. */
   readonly generator: { readonly dsl: string; readonly schema: number };
-  /** RELEASE COHERENCE (kernel_capabilities.ts): the named kernel capabilities this law
-   *  REQUIRES to fold (derived from its shape — e.g. `compoundKeys` for a `.key(a, b)` query).
-   *  connect() / deploy compares this against the target kernel's advertised capabilities and
-   *  fails with a TYPED message naming the mismatch, INSTEAD of the opaque deep-fold refusal.
-   *  Empty ⇒ no special capability needed (byte-identical to before this field for such a law
-   *  — but note: this manifest is frontend-only, never in the USD IR / domainHash). */
-  readonly requiresKernel: readonly string[];
+  /** Standard OSGi Contract Namespace requirements derived from the law shape. */
+  readonly kernelContracts: readonly {
+    readonly namespace: "osgi.contract";
+    readonly name: string;
+    readonly version: string;
+  }[];
 }

package/src/compile_package_main.ts

@@ -168,7 +168,7 @@ import { usdzPack } from "./usdz.js";
 import { checkDomainModules, formatFindings, hasRefusal } from "./law_check.js";
 import { currentEvolveLaw, evolveDiff, evolveLawFromLockfile } from "./evolve_preview.js";
 import type { NomosCompat } from "./compat_manifest.js";
-import { requiredKernelFeatures, type FeatureProbeModule } from "./kernel_capabilities.js";
+import { requiredKernelContracts, type KernelContractProbeModule } from "./kernel_capabilities.js";
 import { APPLICATION_HOME_DOMAIN } from "./framework/application_home_domain.js";
 import { applicationHomePolicyLaw } from "./framework/application_home.js";
 import { isApplicationHomeGenesis } from "./application_home_genesis.js";
@@ -1660,12 +1660,12 @@ const dartTypesImportFor = (generatedSource: string): string => {
  *  just the floor generated code needs — a lagging pin forces tenants into dependency_overrides. */
 // 0.3.0: SurfacedValue<T>/SurfacedObservation/PendingConflictRow — generated Surfaced-field typing +
 //        the pendingConflicts read rows.
-const NOMOS_TYPES_DEP = "^0.8.7";
+const NOMOS_TYPES_DEP = "^0.8.8";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.64.37";
-const NOMOS_FLUTTER_DEP = "^0.63.62";
+const NOMOS_CLIENT_DEP = "^0.64.40";
+const NOMOS_FLUTTER_DEP = "^0.63.68";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).
@@ -5193,17 +5193,15 @@ async function main(): Promise<void> {
     const identityHash = identityHashes[key];
     compatDomains[key] = identityHash === undefined ? {} : { identityHash };
   }
-  // RELEASE COHERENCE — the kernel capabilities this law REQUIRES (compound-key queries +
-  // era-key features). Baked into the client so connect() can check it against the target
-  // kernel's advertised capabilities BEFORE the law folds (kernel_capabilities.ts).
-  const requiresKernel = ((): string[] => {
-    const probes: FeatureProbeModule[] = domainModules.map((m) => ({
+  // RELEASE COHERENCE — typed OSGi Contract Namespace requirements derived from law shape.
+  const kernelContracts = (() => {
+    const probes: KernelContractProbeModule[] = domainModules.map((m) => ({
       ...(m.queries ? { queries: m.queries } : {}),
       ...(m.deriveds ? { deriveds: m.deriveds } : {}),
       ...(m.surfacedResolvers ? { surfacedResolvers: m.surfacedResolvers } : {}),
       ...(m.aggregates ? { aggregates: m.aggregates } : {}),
     }));
-    return requiredKernelFeatures(probes);
+    return requiredKernelContracts(probes);
   })();
   const nomosCompat: NomosCompat = {
     packageName: cfg.name,
@@ -5211,7 +5209,7 @@ async function main(): Promise<void> {
     interfaceHash: sha256HexUtf8(canonicalJson(packageInterface)),
     domains: compatDomains,
     generator: { dsl: dslVersion, schema: 1 },
-    requiresKernel,
+    kernelContracts,
   };
 
   // ── 3b. NO OPENAPI SIDECAR. OpenAPI remains the sanctioned standard for describing this package's

package/src/framework/capability.ts

@@ -215,6 +215,9 @@ export function capability<
   scheduleAfterMs?: number;
   /** Time from acceptance until the obligation is overdue. Defaults to 24h. */
   deadlineAfterMs?: number;
+  /** How many times an overdue-but-still-`requested` obligation may be RE-OPENED in place by
+   *  the bounded `reschedule` verb before the next reschedule dead-letters it. Defaults to 5. */
+  maxRescheduleAttempts?: number;
   /**
    * THE ACKNOWLEDGED WAIVER — open this capability's Receipts to any authorised author.
    *
@@ -280,6 +283,7 @@ export function capability<
     failDirectiveId: `fail${pascal}`,
     blockDirectiveId: `block${pascal}`,
     deadLetterDirectiveId: `deadLetter${pascal}`,
+    rescheduleDirectiveId: `reschedule${pascal}`,
     params,
     paramsSchema: requestShape,
     // The loop is dynamic (declared field names), so the per-field `set()` typing
@@ -308,6 +312,9 @@ export function capability<
     ...(spec.deadlineAfterMs !== undefined
       ? { deadlineAfterMs: spec.deadlineAfterMs }
       : {}),
+    ...(spec.maxRescheduleAttempts !== undefined
+      ? { maxRescheduleAttempts: spec.maxRescheduleAttempts }
+      : {}),
   });
 
   const camel = pascal[0]!.toLowerCase() + pascal.slice(1);
@@ -382,6 +389,18 @@ export function capability<
     fail: fenced(quartet.fail),
     block: fenced(quartet.block),
     deadLetter: fenced(quartet.deadLetter),
+    // The bounded `reschedule` verb is a DRUM-OPERATOR action: the operator decides to retry (or
+    // dead-letter) a stuck obligation; the provider merely FULFILS. So fence it on the SAME
+    // authority as the obligation REQUEST (`requestRequires`, e.g. admin) — NOT the provider
+    // receipt relation. Otherwise the operator who is allowed to REQUEST work cannot re-open it
+    // when the provider stalls, which is exactly the drum's job. Falls back to provider-fenced
+    // (like the receipts) when the capability declares no `requestRequires`.
+    reschedule: spec.requestRequires === undefined
+      ? fenced(quartet.reschedule)
+      : quartet.reschedule.requires(spec.requestRequires.relation, {
+          ...(spec.requestRequires.object !== undefined ? { object: spec.requestRequires.object } : {}),
+          ...(spec.requestRequires.objectFrom !== undefined ? { objectFrom: spec.requestRequires.objectFrom } : {}),
+        }),
     // The relation SCHEMA rides with the bundle so the gate can never be inert (a law without
     // a relation schema does not enforce `.requires` at all).
     relations: capabilityProviderRelations,
@@ -412,6 +431,7 @@ export function capability<
     declaration.fail,
     declaration.block,
     declaration.deadLetter,
+    declaration.reschedule,
   ]) {
     Object.defineProperty(lifecycle, NOMOS_CAPABILITY_DECLARATIONS, {
       value: Object.freeze([declaration]),

package/src/framework/impure_capability.ts

@@ -72,6 +72,8 @@ import { attributionField, t, type Field } from "../fields.js";
 import { Lww } from "../drivers.js";
 import { set, type PlannedOp } from "../ops.js";
 import { directive, type RequirableDirective } from "../directive.js";
+import { query, type QueryDecl } from "../query.js";
+import { readFrameworkDeclared } from "../read.js";
 import { executeDirectiveToIntent } from "../wire_encode.js";
 import type { WireIntent } from "../wire.js";
 import type { Ports } from "../ctx.js";
@@ -124,6 +126,14 @@ export type ImpureCapabilityStatus = (typeof IMPURE_CAPABILITY_STATUSES)[number]
  *  - nextAction     Lww (OPTIONAL) — human/host-action hint, e.g. refreshAuth.
  *  - deadLetterReason Lww (OPTIONAL) — why the obligation was moved to the DLQ.
  *  - deadLetteredAt Int (OPTIONAL) — epoch-ms the obligation entered the DLQ.
+ *  - attempts       Int (OPTIONAL) — how many times an overdue-but-still-`requested`
+ *                   obligation has been RESCHEDULED in place (the bounded in-law
+ *                   `reschedule` verb). Folded ONLY by a reschedule that re-opens the
+ *                   task, so a freshly-obligated task never writes it — ABSENT decodes as
+ *                   0 (the same read-decode discipline as the other optionals). It is the
+ *                   bound the DLQ cap (`maxRescheduleAttempts`) is judged against: once an
+ *                   overdue task has already been rescheduled that many times, the next
+ *                   reschedule dead-letters it instead of re-opening.
  *
  * The OPTIONALs are `.optional()` so a freshly-obligated task (which folds none of them)
  * decodes on the generated read type — the same read-decode discipline the rest of the
@@ -144,6 +154,12 @@ export const IMPURE_CAPABILITY_ENVELOPE = {
   nextAction: t.string().merge(Lww).optional(),
   deadLetterReason: t.string().merge(Lww).optional(),
   deadLetteredAt: t.int().merge(Lww).optional(),
+  // The RESCHEDULE ATTEMPTS counter (OPTIONAL): how many times an overdue-but-non-terminal
+  // (`requested`) obligation has been re-opened in place by the bounded `reschedule` verb.
+  // MUST be `.optional()` — a freshly-obligated task folds it NEVER, so it decodes as ABSENT
+  // (read as 0); making it required would break decode of every pre-existing task AND the era
+  // rule (old chains fold no `attempts`). Judged against `maxRescheduleAttempts` to bound retries.
+  attempts: t.int().merge(Lww).optional(),
   // The FRAMEWORK Obligation↔Receipt CLOSURE link (OPTIONAL): the id of the Obligation this
   // RECEIPT closes (== the task's own requestId — the reactor mutates the task instance).
   // GENERIC, written by every impureCapability Receipt (complete OR fail), so the read
@@ -246,6 +262,18 @@ const deadLetterSchema = z.object({
   deadLetteredAt: z.number().int(),
 });
 
+/**
+ * The RESCHEDULE payload: which obligation to judge. Deliberately carries ONLY the requestId
+ * — the reschedule verb reads the task's OWN committed lifecycle state (status / deadlineAt /
+ * attempts) through the captured-read lane and reads "now" from the deterministic captured
+ * clock, so a caller cannot spoof the overdue-ness verdict or the fresh timing. The provider /
+ * drum authority authors it; the plan decides in-law whether it is a no-op, an in-place
+ * re-open, or a dead-letter.
+ */
+const rescheduleSchema = z.object({
+  requestId: z.string(),
+});
+
 /**
  * The three plan builders. Each takes the task aggregate handle + the (already
  * Zod-validated) payload and returns the `PlannedOp[]` writing the envelope. A tenant
@@ -372,6 +400,29 @@ export function deadLetterOps(
   ];
 }
 
+/**
+ * rescheduleOps — the IN-PLACE RE-OPEN half of the bounded `reschedule` verb (NOT a receipt,
+ * NOT terminal). Advances the timing window (`scheduledAt`/`deadlineAt`), bumps the `attempts`
+ * counter, and KEEPS `status:'requested'`. Because the task stays `requested` (non-terminal),
+ * the kernel's terminal-once gate does NOT treat this as a terminal transition — it is the one
+ * legal in-place mutation of a live obligation's timing (kernel-verified: mutating a
+ * still-`requested` task is not a receipt against a terminal obligation). Symmetrical with the
+ * terminal op-builders above: it writes ONLY envelope fields, bound to the task instance (#105).
+ */
+export function rescheduleOps(
+  aggregateId: string,
+  p: { requestId: string; scheduledAt: number; deadlineAt: number; attempts: number },
+): PlannedOp[] {
+  const taskInstance = envelopeInstance(aggregateId, p.requestId);
+  return [
+    set(taskInstance, "scheduledAt", p.scheduledAt),
+    set(taskInstance, "deadlineAt", p.deadlineAt),
+    set(taskInstance, "attempts", p.attempts),
+    // KEEP status:'requested' — re-opening a non-terminal task, never a terminal transition.
+    set(taskInstance, "status", "requested"),
+  ];
+}
+
 /**
  * The generated directive QUARTET for a impure capability. A domain dev calls
  * {@link impureCapability} ONCE and gets:
@@ -412,6 +463,15 @@ export interface ImpureCapability<
   readonly fail: RequirableDirective<z.infer<typeof failSchema>>;
   readonly block: RequirableDirective<z.infer<typeof blockSchema>>;
   readonly deadLetter: RequirableDirective<z.infer<typeof deadLetterSchema>>;
+  /**
+   * The bounded IN-LAW `reschedule` lifecycle verb (provider / drum-authority action). Its plan
+   * reads the task's OWN committed `{status, deadlineAt, attempts}` through the captured-read
+   * lane and judges overdue-ness against the deterministic captured clock, then either NO-OPs
+   * (terminal, or not yet overdue), RE-OPENS in place (`rescheduleOps`, bumping `attempts` +
+   * advancing the window, keeping `status:'requested'`), or DEAD-LETTERS when at/over the
+   * `maxRescheduleAttempts` cap (reusing `deadLetterOps`). Kernel-legal without any kernel change.
+   */
+  readonly reschedule: RequirableDirective<z.infer<typeof rescheduleSchema>>;
   readonly instanceId: (requestId: string) => string;
   /**
    * The CAPABILITY CREDENTIAL this task's provider must hold to fulfil Orders
@@ -485,6 +545,8 @@ export function impureCapability<
   failDirectiveId: FailId;
   blockDirectiveId: string;
   deadLetterDirectiveId: string;
+  /** The wire id for the bounded `reschedule` verb — caller-supplied, like the DLQ id. */
+  rescheduleDirectiveId: string;
   /** The task's request-param FIELDS (merged onto the envelope for the aggregate shape). */
   params: F;
   /** The task's request-param Zod SHAPE (merged onto the obligation envelope schema). */
@@ -526,6 +588,9 @@ export function impureCapability<
   scheduleAfterMs?: number;
   /** Time from acceptance until the task is overdue. Defaults to 24 hours. */
   deadlineAfterMs?: number;
+  /** How many times an overdue-but-still-`requested` obligation may be RE-OPENED in place by
+   *  `reschedule` before the next reschedule dead-letters it instead. Defaults to 5. */
+  maxRescheduleAttempts?: number;
 }): ImpureCapability<Id, ParamsShape, F, ReceiptShape> {
   const taskAggregate = impureCapabilityAggregate(spec.aggregateId, spec.params);
   const obligationPayload = z.object(spec.paramsSchema);
@@ -549,6 +614,17 @@ export function impureCapability<
   const typedFailSchema = failSchema.extend(typedRequestId);
   const typedBlockSchema = blockSchema.extend(typedRequestId);
   const typedDeadLetterSchema = deadLetterSchema.extend(typedRequestId);
+  const typedRescheduleSchema = rescheduleSchema.extend(typedRequestId);
+  // THE BY-ID SELF-READ (the #58 captured-read lane): the reschedule plan reads the task's OWN
+  // committed lifecycle state by its requestId (== the instance id), keyed on the envelope's
+  // indexed `requestId` field. Declared here in the factory (the `tasks`/TasksByStatus query is
+  // keyed on `status`, so this is the by-id variant the reschedule verb needs) and DECLARED on
+  // the directive via `.reads(...)`; the compiler seats it in the domain automatically off that
+  // declaration, so it is routable even though it is not separately exported.
+  const taskById: QueryDecl = query(`${spec.aggregateId}ById`)
+    .key("requestId")
+    .returns(taskAggregate);
+  const maxRescheduleAttempts = spec.maxRescheduleAttempts ?? 5;
 
   const obligation: RequirableDirective<ObligationPayload<ParamsShape>> = directive(
     spec.obligationDirectiveId,
@@ -614,6 +690,60 @@ export function impureCapability<
     .payload(typedDeadLetterSchema)
     .plan((p) => deadLetterOps(spec.aggregateId, p));
 
+  // THE BOUNDED `reschedule` VERB. It `.mutates` the task and reads THAT SAME task's committed
+  // lifecycle state by id (the captured-read lane, declared via `.reads(taskById)`), judging
+  // overdue-ness IN-LAW against the deterministic captured clock — never `Date.now()`. Three
+  // outcomes, mirroring the consequent-outbox cap discipline (never touch a terminal task; only
+  // re-open genuinely-overdue work; dead-letter once the retry budget is exhausted):
+  //   1. status !== "requested"          → NO-OP (never mutate a terminal task).
+  //   2. now <= deadlineAt               → NO-OP (not overdue yet).
+  //   3. overdue & attempts < cap        → RE-OPEN in place (rescheduleOps): fresh window +
+  //                                        attempts+1, KEEP status:'requested' (kernel-legal —
+  //                                        a still-`requested` task is non-terminal).
+  //   4. overdue & attempts >= cap       → DEAD-LETTER (deadLetterOps, terminal) with the
+  //                                        overdue reason.
+  const reschedule = directive(spec.rescheduleDirectiveId)
+    .mutates(taskAggregate)
+    .payload(typedRescheduleSchema)
+    .plan((p, ctx) => {
+      const now = ctx.clock().physical;
+      // Read the task's OWN committed state by id off the #58 captured-read lane. A framework
+      // plan bundled via the `@githolon/dsl` barrel reads through `readFrameworkDeclared` (the
+      // declared-by-construction twin of `read()`), so it never pins the tenant captured-read
+      // compile marker into the barrel lump; the directive DECLARES `taskById` below.
+      const rows = readFrameworkDeclared<Array<Record<string, unknown>>>(taskById.id, {
+        requestId: p.requestId,
+      });
+      const raw = Array.isArray(rows) && rows.length > 0 ? rows[0] : undefined;
+      // Projected rows are `{type,id,data:{…fields}}`; folded shapes may be flat — accept both.
+      const data = (raw && typeof raw === "object" && typeof (raw as { data?: unknown }).data === "object"
+        ? (raw as { data: Record<string, unknown> }).data
+        : raw) as Record<string, unknown> | undefined;
+      const status = data?.status as string | undefined;
+      // (1) NEVER touch a terminal task — only `requested` is non-terminal.
+      if (status !== "requested") return [];
+      const deadlineAt = Number(data?.deadlineAt ?? 0);
+      // (2) Not overdue yet — the deterministic clock has not passed the committed deadline.
+      if (now <= deadlineAt) return [];
+      const attempts = Number(data?.attempts ?? 0);
+      // (4) Overdue AND the retry budget is exhausted → terminal dead-letter (reuse deadLetterOps).
+      if (attempts >= maxRescheduleAttempts) {
+        return deadLetterOps(spec.aggregateId, {
+          requestId: p.requestId,
+          deadLetterReason: `overdue: exhausted ${maxRescheduleAttempts} reschedule attempts`,
+          deadLetteredAt: now,
+        });
+      }
+      // (3) Overdue but under the cap → RE-OPEN in place with a fresh window + bumped attempts.
+      return rescheduleOps(spec.aggregateId, {
+        requestId: p.requestId,
+        scheduledAt: now + (spec.scheduleAfterMs ?? 0),
+        deadlineAt: now + (spec.deadlineAfterMs ?? 24 * 60 * 60 * 1000),
+        attempts: attempts + 1,
+      });
+    })
+    .reads(taskById);
+
   return {
     aggregate: taskAggregate,
     obligation,
@@ -622,6 +752,7 @@ export function impureCapability<
     fail,
     block,
     deadLetter,
+    reschedule,
     instanceId: impureCapabilityInstanceId,
     // Omit-when-absent (hash discipline): a capability-free declaration carries
     // NO key at all, so its bundled source — and the package hash — is unchanged.

package/src/framework/owned_custody.ts

@@ -39,6 +39,7 @@ export const OWNED_RECOVERY_ACCEPT_DIRECTIVE = "nomos_internal_accept_owned_reco
 const OWNED_RECOVERY_FAIL_DIRECTIVE = "nomos_internal_fail_owned_recovery_7c1f5e";
 const OWNED_RECOVERY_BLOCK_DIRECTIVE = "nomos_internal_block_owned_recovery_7c1f5e";
 const OWNED_RECOVERY_DEAD_LETTER_DIRECTIVE = "nomos_internal_dead_letter_owned_recovery_7c1f5e";
+const OWNED_RECOVERY_RESCHEDULE_DIRECTIVE = "nomos_internal_reschedule_owned_recovery_7c1f5e";
 const keySubject = z.string().regex(/^key:[0-9a-f]{64}$/);
 const principal = z.string().regex(/^user:[A-Za-z0-9][A-Za-z0-9_.-]*$/);
 const b64 = z.string().regex(/^[A-Za-z0-9+/]+={0,2}$/);
@@ -99,6 +100,7 @@ const ownedRecoveryLifecycle = impureCapability({
   failDirectiveId: OWNED_RECOVERY_FAIL_DIRECTIVE,
   blockDirectiveId: OWNED_RECOVERY_BLOCK_DIRECTIVE,
   deadLetterDirectiveId: OWNED_RECOVERY_DEAD_LETTER_DIRECTIVE,
+  rescheduleDirectiveId: OWNED_RECOVERY_RESCHEDULE_DIRECTIVE,
   params: recoveryOrderFields,
   paramsSchema: {
     ownerPrincipal: principal,
@@ -128,6 +130,7 @@ const hiddenRecoveryLifecycle = {
   fail: hidden(ownedRecoveryLifecycle.fail),
   block: hidden(ownedRecoveryLifecycle.block),
   deadLetter: hidden(ownedRecoveryLifecycle.deadLetter),
+  reschedule: hidden(ownedRecoveryLifecycle.reschedule),
 };
 const ownedRecoveryCapability = {
   ...ownedRecoveryLifecycle,
@@ -140,6 +143,7 @@ const ownedRecoveryCapability = {
   fail: hiddenRecoveryLifecycle.fail,
   block: hiddenRecoveryLifecycle.block,
   deadLetter: hiddenRecoveryLifecycle.deadLetter,
+  reschedule: hiddenRecoveryLifecycle.reschedule,
   __isCapabilityDecl: true as const,
 };
 

package/src/framework/sync_lifecycle.ts

@@ -98,6 +98,7 @@ const workspaceSyncTask = impureCapability({
   failDirectiveId: "failWorkspaceSync",
   blockDirectiveId: "blockWorkspaceSync",
   deadLetterDirectiveId: "deadLetterWorkspaceSync",
+  rescheduleDirectiveId: "rescheduleWorkspaceSync",
   params: syncParams,
   paramsSchema: {
     workspaceId: z.string(),

package/src/index.ts

@@ -255,19 +255,17 @@ export { repair, repairsOf, isRepairDecl, type RepairDecl, type RepairMatcher, t
 // `nomos-compile` REFUSES law that references read() (a named compile error, never a runtime halt).
 // The captured-reads wave (task #58) wires the capability in and lifts the refusal.
 export { read } from "./read.js";
-// RELEASE COHERENCE — the kernel capability stamp + law↔kernel fit check (kernel_capabilities.ts).
+// RELEASE COHERENCE — standard OSGi Contract Namespace requirements derived from law shape.
 export {
-  requiredKernelFeatures,
-  capabilitiesForKernelHash,
-  assessKernelCoherence,
+  requiredKernelContracts,
+  assessKernelContracts,
   KernelCoherenceError,
-  KERNEL_CAPABILITY_REGISTRY,
-  ERA_KEY_TO_FEATURE,
-  type KernelFeature,
-  type KernelStamp,
-  type KernelCoherenceVerdict,
-  type KernelRegistryEntry,
-  type FeatureProbeModule,
+  NOMOS_KERNEL_CONTRACT,
+  NOMOS_KERNEL_CONTRACT_VERSION,
+  type OsgiContractRequirement,
+  type OsgiContractCapability,
+  type KernelContractVerdict,
+  type KernelContractProbeModule,
 } from "./kernel_capabilities.js";
 // ATTESTED CROSS-WORKSPACE READS (slice B — attested_reads_design.md): the declared trust
 // surface (`trustSource`), the foreign query reference, and the reader-side SourceFrontier.