@githolon/dsl 0.105.6 → 0.105.8

package/dart/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.64.24
+
+- Restaged with the current kernel candidate: regenerated vendored assets (kernel release identity is baked into them). Published pub.dev archives are immutable, so regenerated bytes ride their own version.
+
 ## 0.64.23
 
 - Rebuild the self-contained runner without the retired structural-interface sidecar assumption;

package/dart/lib/src/runner/node-entry.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // <define:__NOMOS_KERNEL_RELEASE__>
-var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "796e512cf4549c7fadbb4e56248ec076bca3992258a1b5282d678cb56bf24f35", version: "kernel-796e512c", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "beaabafa0d30eb83f1e49cc9f26251996ea3ef302e24ae36180a686145b41588", version: "kernel-beaabafa", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
+var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "08719339b0ecfb39b75543bf40422e84832153cc463b00283c0e84f6e38ce359", version: "kernel-08719339", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "ab5c45c029a57b39711a559d803ed7d23e8eb94c11bbba652df7f8b3abd3c6df", version: "kernel-ab5c45c0", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
 
 // runner/node-entry.ts
 import { createInterface } from "node:readline";
@@ -7596,7 +7596,10 @@ async function pushPack(remote, headers = {}, { updates = [], pack = null } = {}
 var RELEASE_RECEIPT_PREFIX = "nomos-release-receipt:";
 function prepareManagedPromotion(report, candidateHash, domain, opts = {}) {
   if (!report.sourceVerified || !report.complete || !report.evolve?.ok) {
-    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : "the candidate fails deterministic schema evolution";
+    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : [
+      "the candidate fails deterministic schema evolution",
+      ...report.evolve.violations.map((violation) => violation.detail)
+    ].join(": ");
     return { ok: false, stage: "preflight", report, error: `promotion refused: ${reason}` };
   }
   const acceptanceReason = opts.acceptanceReason?.trim();
@@ -8496,6 +8499,9 @@ function createSerializedScheduler() {
   return scheduler;
 }
 
+// src/intent_offer_codec.ts
+var encoder = new TextEncoder();
+
 // src/index.ts
 var enc4 = new TextEncoder();
 var dec4 = new TextDecoder();

package/dart/lib/src/runner/offline-install.mjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // <define:__NOMOS_KERNEL_RELEASE__>
-var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "796e512cf4549c7fadbb4e56248ec076bca3992258a1b5282d678cb56bf24f35", version: "kernel-796e512c", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "beaabafa0d30eb83f1e49cc9f26251996ea3ef302e24ae36180a686145b41588", version: "kernel-beaabafa", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
+var define_NOMOS_KERNEL_RELEASE_default = { production: { hash: "08719339b0ecfb39b75543bf40422e84832153cc463b00283c0e84f6e38ce359", version: "kernel-08719339", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 }, testMint: { hash: "ab5c45c029a57b39711a559d803ed7d23e8eb94c11bbba652df7f8b3abd3c6df", version: "kernel-ab5c45c0", features: ["compoundKeys", "capturedReads", "invariantGate", "surfacedMerge", "fieldProvenance", "nullSemantics", "attestedReads", "conflictSnapshots", "ownedAudience", "temporalEnum"], protocol: 1 } };
 
 // runner/offline-install.ts
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync } from "node:fs";
@@ -1938,7 +1938,10 @@ async function pushPack(remote, headers = {}, { updates = [], pack = null } = {}
 var RELEASE_RECEIPT_PREFIX = "nomos-release-receipt:";
 function prepareManagedPromotion(report, candidateHash, domain, opts = {}) {
   if (!report.sourceVerified || !report.complete || !report.evolve?.ok) {
-    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : "the candidate fails deterministic schema evolution";
+    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : [
+      "the candidate fails deterministic schema evolution",
+      ...report.evolve.violations.map((violation) => violation.detail)
+    ].join(": ");
     return { ok: false, stage: "preflight", report, error: `promotion refused: ${reason}` };
   }
   const acceptanceReason = opts.acceptanceReason?.trim();
@@ -5899,17 +5902,18 @@ var protoAuthority = (principal = "", keys = [], authToken = "", nowUnix = 0, au
   }))
 });
 function applicationQueryProto(eng2, ws, query2, options = {}) {
+  const hasAuthority = options.principal !== void 0 || options.keys !== void 0 || options.authToken !== void 0 || options.nowUnix !== void 0 || options.authorSecret !== void 0;
   const response = callProto(eng2.ex, {
     case: "query",
     value: create(QueryRequestSchema, {
       target: protoTarget(ws, options.branch ?? BRANCH),
-      authority: protoAuthority(
+      authority: hasAuthority ? protoAuthority(
         options.principal,
         options.keys,
         options.authToken,
         options.nowUnix,
         options.authorSecret
-      ),
+      ) : void 0,
       spans: options.spans ?? false,
       query: query2
     })
@@ -7843,12 +7847,10 @@ var cryptoOwnedScopeKey = (eng2, workspace2, authorSecret, scope, principal = ""
   const recordObject = record === void 0 ? void 0 : `${record.type}:${record.id}`;
   const derived = namedQueryProto(eng2, workspace2, QueryOperation.CRYPTO_OWNED_SCOPE_KEY, {
     custodyWorkspace: workspace2,
-    principal,
-    authorSecret,
     scope,
     ...recordObject === void 0 ? {} : { recordObject, recordEpoch },
     ...recordWrap === void 0 ? {} : { recordWrap }
-  });
+  }, { principal, authorSecret });
   const ownedKeySubject = String(derived.ownedKeySubject || "");
   if (!requireSeat) {
     return {
@@ -7865,7 +7867,16 @@ var cryptoOwnedScopeKey = (eng2, workspace2, authorSecret, scope, principal = ""
     let hex = "";
     for (const byte of enc3.encode(principal)) hex += byte.toString(16).padStart(2, "0");
     const object = `nomos-owned-principal:${hex || "00"}`;
-    const rows = qById(eng2, workspace2, `reltuple-${object}-nomos_internal_owned_device_key_7c1f5e`);
+    const rows = qById(
+      eng2,
+      workspace2,
+      `reltuple-${object}-nomos_internal_owned_device_key_7c1f5e`,
+      principal,
+      [],
+      "",
+      0,
+      authorSecret
+    );
     const row = Array.isArray(rows) ? rows[0] : rows?.rows?.[0];
     const leaves = row?.data?.subjects ?? row?.subjects ?? {};
     const leaf = (raw) => {
@@ -7896,14 +7907,12 @@ var cryptoOwnedScopeKey = (eng2, workspace2, authorSecret, scope, principal = ""
     const custody = String(leaf(leaves[ownedKeySubject]).ownedCustody || "");
     if (!custody) throw new Error("the approved device has no owned-data handoff");
     const opened = namedQueryProto(eng2, workspace2, QueryOperation.CRYPTO_OWNED_SCOPE_KEY, {
-      workspace: workspace2,
-      principal,
-      authorSecret,
+      custodyWorkspace: workspace2,
       scope,
       ownedCustody: custody,
       ...recordObject === void 0 ? {} : { recordObject, recordEpoch },
       ...recordWrap === void 0 ? {} : { recordWrap }
-    });
+    }, { principal, authorSecret });
     return {
       scope: String(opened.scope || scope),
       epoch: Number(opened.epoch) || 0,
@@ -7924,11 +7933,8 @@ var cryptoOwnedScopeKey = (eng2, workspace2, authorSecret, scope, principal = ""
   };
 };
 var cryptoOwnedDeviceRequest = (eng2, workspace2, principal, authorSecret, scope) => String(namedQueryProto(eng2, workspace2, QueryOperation.CRYPTO_OWNED_DEVICE_REQUEST, {
-  workspace: workspace2,
-  principal,
-  authorSecret,
   scope
-}).request || "");
+}, { principal, authorSecret }).request || "");
 var cryptoOwnedPrepareApproval = (eng2, args) => namedQueryProto(eng2, args.workspace, QueryOperation.CRYPTO_OWNED_PREPARE_APPROVAL, args);
 var cryptoOwnedPrepareRecovery = (eng2, args) => namedQueryProto(eng2, args.workspace, QueryOperation.CRYPTO_OWNED_PREPARE_RECOVERY, args);
 var cryptoKeygen = (eng2) => namedQueryProto(eng2, "root", QueryOperation.CRYPTO_KEYGEN);
@@ -7969,7 +7975,10 @@ var certSign = (eng2, {
   ...authProviderJwks !== void 0 ? { authProviderJwks } : {},
   ...authProviderAudience !== void 0 ? { authProviderAudience } : {}
 }).cert;
-var cryptoWrapKey = (eng2, { recipientPub, scopeKey }) => namedQueryProto(eng2, "root", QueryOperation.CRYPTO_WRAP_KEY, { recipientPub, scopeKey });
+var cryptoWrapKey = (eng2, { recipientPub, scopeKey }) => {
+  const result = namedQueryProto(eng2, "root", QueryOperation.CRYPTO_WRAP_KEY, { recipientPub, scopeKey });
+  return { hpkeEpk: String(result.hpkeEpk ?? ""), ct: String(result.ct ?? "") };
+};
 var cryptoUnwrapKey = (eng2, { secret, hpkeEpk, ct }) => namedQueryProto(eng2, "root", QueryOperation.CRYPTO_UNWRAP_KEY, { secret, hpkeEpk, ct }).scopeKey;
 var readPosture = (eng2, ws, principal = "", authToken = "", nowUnix = 0, authorSecret = "") => namedQueryProto(
   eng2,

package/dart/lib/src/webview_bridge.dart

@@ -1254,6 +1254,14 @@ class NomosBridge {
   final Map<String, SyncStatus> _statusBySession = {};
   final Map<String, StreamController<SyncStatus>> _syncStatusBySession = {};
   Timer? _metricsTimer;
+  // The zone this bridge was CONSTRUCTED in. The metrics poll belongs to the
+  // bridge (a long-lived, often file-shared object in tests), yet it used to be
+  // created in whichever zone the first status LISTENER attached from — in
+  // widget tests that is a per-test FakeAsync zone, so a file-shared bridge's
+  // periodic poll became a fake timer owned by ONE test and tripped
+  // flutter_test's '!timersPending' invariant at that test's teardown. Timers
+  // run in their owner's zone, not their caller's.
+  final Zone _creationZone = Zone.current;
   Future<void>? _metricsPoll;
   bool _metricsPollAgain = false;
   final Completer<void> _ready = Completer<void>();
@@ -3579,8 +3587,12 @@ class NomosBridge {
     // metrics snapshot.
     if (!_syncStatusCtrl.isClosed) _syncStatusCtrl.add(_status);
     _pollMetricsOnce();
-    _metricsTimer ??=
-        Timer.periodic(const Duration(seconds: 4), (_) => _pollMetricsOnce());
+    _metricsTimer ??= _creationZone.run(
+      () => Timer.periodic(
+        const Duration(seconds: 4),
+        (_) => _creationZone.run(_pollMetricsOnce),
+      ),
+    );
   }
 
   void _startSessionStatusPoll(String session) {
@@ -3589,8 +3601,12 @@ class NomosBridge {
       controller.add(_currentSessionStatus(session));
     }
     _pollMetricsOnce();
-    _metricsTimer ??=
-        Timer.periodic(const Duration(seconds: 4), (_) => _pollMetricsOnce());
+    _metricsTimer ??= _creationZone.run(
+      () => Timer.periodic(
+        const Duration(seconds: 4),
+        (_) => _creationZone.run(_pollMetricsOnce),
+      ),
+    );
   }
 
   void _stopStatusPollIfUnused() {

package/dart/pubspec.yaml

@@ -7,7 +7,7 @@ repository: https://github.com/Captain-App/nomos2
 description: >-
   Nomos 2 Dart client — generated domain values, intent payloads and application
   lifecycle types over the typed Nomos kernel protocol and USDA custody model.
-version: 0.64.23
+version: 0.64.24
 
 environment:
   sdk: ^3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.105.6",
+  "version": "0.105.8",
   "type": "module",
   "sideEffects": false,
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",

package/runtime/generated-application-host.js

@@ -6627,7 +6627,10 @@ async function pushPack(remote, headers = {}, { updates = [], pack = null } = {}
 var RELEASE_RECEIPT_PREFIX = "nomos-release-receipt:";
 function prepareManagedPromotion(report, candidateHash, domain, opts = {}) {
   if (!report.sourceVerified || !report.complete || !report.evolve?.ok) {
-    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : "the candidate fails deterministic schema evolution";
+    const reason = !report.sourceVerified ? "the source ledger did not verify" : !report.complete ? "some historical premises could not be re-derived" : [
+      "the candidate fails deterministic schema evolution",
+      ...report.evolve.violations.map((violation) => violation.detail)
+    ].join(": ");
     return { ok: false, stage: "preflight", report, error: `promotion refused: ${reason}` };
   }
   const acceptanceReason = opts.acceptanceReason?.trim();
@@ -7527,6 +7530,9 @@ function createSerializedScheduler() {
   return scheduler;
 }
 
+// ../cloud/web-client/src/intent_offer_codec.ts
+var encoder = new TextEncoder();
+
 // ../cloud/web-client/src/index.ts
 var enc4 = new TextEncoder();
 var dec4 = new TextDecoder();

package/src/aggregate.ts

@@ -84,6 +84,7 @@ export type Audience =
 export const OWNER_FIELD = "__nomos_owner_principal_7c1f5e";
 export const OWNED_READ_RELATION = "nomos_internal_owned_reader_7c1f5e";
 export const OWNED_KEY_RELATION = "nomos_internal_owned_device_key_7c1f5e";
+export const OWNED_PRINCIPAL_OBJECT_TYPE = "nomos-owned-principal";
 export const OWNED_KEY_PAYLOAD_FIELD = "__nomos_owned_device_key_subject_7c1f5e";
 export const OWNED_CUSTODY_PAYLOAD_FIELD = "__nomos_owned_device_custody_7c1f5e";
 /** Framework-carried record identities reserved by the client before an owned create is planned.
@@ -114,7 +115,7 @@ export function ownedKeyObject(principal: string): string {
           : [0xf0 | (cp >> 18), 0x80 | ((cp >> 12) & 0x3f), 0x80 | ((cp >> 6) & 0x3f), 0x80 | (cp & 0x3f)];
     for (const byte of bytes) hex += byte.toString(16).padStart(2, "0");
   }
-  return `nomos-owned-principal:${hex || "00"}`;
+  return `${OWNED_PRINCIPAL_OBJECT_TYPE}:${hex || "00"}`;
 }
 
 /**

package/src/birth_meter_ensure.ts

@@ -58,6 +58,8 @@ import {
   SignerDelegation,
   enrollDelegation,
   enrollSigner,
+  enrollSignerSelf,
+  enrollSignerSelfRequiresVerified,
   identityRelations,
   signerDelegationByUser,
   signerObject,
@@ -70,6 +72,7 @@ import {
   setAuthProvider,
 } from "./framework/auth_provider_law.js";
 import { refAs, workspaceInvariant } from "./framework/workspace_invariant.js";
+import { isRelationTypeDecl, type RelationTypeDecl } from "./relation_schema.js";
 
 /** Lightweight copy of the framework's founding-signer guard, kept here to avoid importing the whole
  * governance module (whose unrelated captured-read laws would otherwise survive into every child lump). */
@@ -201,6 +204,34 @@ export function withBirthMeterExports<M extends Record<string, unknown>>(mod: M)
     }
     if (!found) out[key] = internal(canonical);
   };
+  /** Relation schemas have a typed object address rather than an `id`. Treat an explicit re-export
+   * of the canonical framework singleton exactly like `internalize()` treats directives: replace
+   * every canonical binding with one branded copy, but never annex a tenant-authored fragment that
+   * merely happens to extend the same object type. */
+  const internalizeRelationType = (key: string, canonical: RelationTypeDecl): void => {
+    if (hasOwn(key)) {
+      const existing = out[key];
+      const sameGeneratedType =
+        isGeneratedInternal(existing) &&
+        isRelationTypeDecl(existing) &&
+        existing.type === canonical.type &&
+        existing.global === canonical.global;
+      if (existing !== canonical && !sameGeneratedType) throw reservedNameError(key);
+    }
+    let found = false;
+    for (const [exportName, value] of Object.entries(out)) {
+      if (value === canonical || (
+        isGeneratedInternal(value) &&
+        isRelationTypeDecl(value) &&
+        value.type === canonical.type &&
+        value.global === canonical.global
+      )) {
+        out[exportName] = internal(value as RelationTypeDecl);
+        found = true;
+      }
+    }
+    if (!found) out[key] = internal(canonical);
+  };
   if (governsBirth && !declaresBirth && !acceptsBirth) {
     if (exportedDirectiveIds.has("setBirthPolicy")) internalize("__nomos_BirthPolicy", BirthPolicy);
     if (exportedDirectiveIds.has("grantBirthAllowance")) internalize("__nomos_BirthGrant", BirthGrant);
@@ -210,8 +241,14 @@ export function withBirthMeterExports<M extends Record<string, unknown>>(mod: M)
   // Carry the law needed to judge that internal step in every possible child, plus the write-once guard that
   // keeps the founding lane a genesis primitive. These declarations are certified but never tenant-facing.
   internalize("__nomos_RelationTuple", RelationTuple);
-  reserve("__nomos_identityRelations", identityRelations);
+  // Keep the framework brand when this declaration is injected under a second private export key.
+  // Owned-custody law already carries the same signer schema under its own internal key; an unbranded
+  // clone makes the relation merger correctly treat it as a tenant-authored duplicate and refuse the
+  // package. Two framework paths naming one byte-identical relation are one declaration, not two authors.
+  internalizeRelationType("__nomos_identityRelations", identityRelations);
   internalize("__nomos_enrollSigner", enrollSigner);
+  internalize("__nomos_enrollSignerSelf", enrollSignerSelf);
+  internalize("__nomos_enrollSignerSelfRequiresVerified", enrollSignerSelfRequiresVerified);
   internalize("__nomos_relationTuplesByObject", relationTuplesByObject);
   internalize("__nomos_GenesisWarrant", GenesisWarrant);
   internalize("__nomos_seedGenesis", seedGenesis);

package/src/codegen_dart.ts

@@ -575,7 +575,7 @@ function introspectField(
     case "ZodArray": {
       const elem = zodArrayElement(zt);
       // A `string[]` is a typed `List<String>`. A list of DECLARED VALUE OBJECTS is typed
-      // with the generated VO class (vo_authoring_end_to_end.md slice B). ANY other element
+      // with the generated VO class (vo_first_class.md). ANY other element
       // type is arbitrary JSON DATA to the engine, modelled as `List<Object?>`.
       if (zodTypeName(elem) === "ZodString") {
         return { name, dartType: "List<String>", toJson: "strList" };

package/src/codegen_proof.ts

@@ -239,7 +239,7 @@ function sampleOfZod(
     next.add(zt);
     return sampleOfZod(zodUnwrapLazy(zt), path, where, voIncludeOptional, next);
   }
-  // VALUE OBJECTS FIRST (vo_authoring_end_to_end.md slice C): a declared VO carries its own lawful
+  // VALUE OBJECTS FIRST (vo_first_class.md): a declared VO carries its own lawful
   // sample (the author's validated `example`, the blessed geometry sample, or per-field descriptor
   // synthesis, recursing through nested VOs / arrays-of-VOs / unions). The raw-zod walk below cannot
   // see interior constraints (geo's min-2 coordinates, a `.min()` on a subfield), so after building the

package/src/codegen_ts.ts

@@ -333,7 +333,7 @@ function tsTypeOfZod(
     const target = idOfTargetKindOf(zt) === "contract" ? contractTypeName(aggregateType) : aggregateType;
     return `NomosRef<${target}>`;
   }
-  // A DECLARED VALUE OBJECT keeps its NAME (vo_authoring_end_to_end.md slice B): the payload
+  // A DECLARED VALUE OBJECT keeps its NAME (vo_first_class.md): the payload
   // references the same exported interface the read model uses — one name, both directions —
   // instead of an anonymous inline literal type. Checked on the BARE object only: optional/
   // default wrappers must keep flowing through the switch so `| undefined` survives.
@@ -761,6 +761,9 @@ export interface TsClientOptions {
   /** Explicit application home for direct/synthetic generation. The package compiler derives this from
    * business birth topology and passes it here; ambiguous multi-domain packages fail rather than flatten. */
   readonly homeDomain?: string;
+  /** Emit the structural holon factory for the compiler-owned headless artifact. The ordinary tenant
+   * client leaves this false so framework transport types never enter its public declaration graph. */
+  readonly exportHolonFactory?: boolean;
 }
 
 /** TS string literal (JSON.stringify covers escaping). */
@@ -1890,9 +1893,9 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
           `  /** THE ACTIVITY FEED (declared \`.activity(...)\`): subscribe to per-committed-intent RAW ROWS`,
           `   *  (the runtime folds the intent log). \`cb\` fires with the current rows + on every new intent;`,
           `   *  returns an unsubscribe fn. The generated client maps these through \`renderActivity\`. */`,
-          `  watchActivity(cb: (rows: ActivityRawRow[]) => void, opts?: { base?: string; intervalMs?: number }): () => void;`,
+          `  watchActivity?(cb: (rows: ActivityRawRow[]) => void, opts?: { base?: string; intervalMs?: number }): () => void;`,
           `  /** One-shot: the current committed activity log as RAW ROWS (folded to typed rows by the client). */`,
-          `  activityLog(opts?: { base?: string; limit?: number }): Promise<ActivityRawRow[]>;`,
+          `  activityLog?(opts?: { base?: string; limit?: number }): Promise<ActivityRawRow[]>;`,
         ]
       : []),
     `  /** THE COMPAT SUPERPOWER (#72b) — OPTIONAL: a holon from @githolon/client's connect() attaches it.`,
@@ -2090,6 +2093,25 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       `  return read(keys);`,
       `};`,
       ``,
+      `/** Owned bounded reads perform the same record-key-aware second pass without erasing`,
+      ` *  the page envelope. Keeping this distinct from the array helper makes cursor semantics explicit. */`,
+      `const _readPageWithOwnedKeys = async <T>(`,
+      `  holon: NomosHolon,`,
+      `  keyStore: NomosKeyStore | undefined,`,
+      `  scopes: readonly { scope: string; owned?: true }[],`,
+      `  read: (keys: readonly NomosScopeKey[] | undefined) => Promise<{ rows: T[]; cursor: string | null; done: boolean }>,`,
+      `): Promise<{ rows: T[]; cursor: string | null; done: boolean }> => {`,
+      `  const firstKeys = await _readKeys(holon, keyStore, scopes);`,
+      `  const first = await read(firstKeys);`,
+      `  if (!scopes.some((scope) => scope.owned === true) || first.rows.length === 0) return first;`,
+      `  const records = first.rows.map((row) => {`,
+      `    const raw = row as T & { type: string; id: string };`,
+      `    return { type: raw.type, id: raw.id };`,
+      `  });`,
+      `  const keys = await _readKeys(holon, keyStore, scopes, records);`,
+      `  return read(keys);`,
+      `};`,
+      ``,
       `/** Reactive owned reads use the exact same two-pass, record-key-aware read as one-shot reads.`,
       ` *  The raw watch is only a local change signal; ciphertext rows never reach application callbacks. */`,
       `const _watchWithOwnedKeys = <T>(`,
@@ -3375,7 +3397,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
       );
       const queryPageCall = qScopes.length
         ? qOwned
-          ? `_readWithOwnedKeys(holon, keyStore, ${qScopeJson}, (keys) => (holon.queryPage ?? (() => { throw new Error("bounded reads need a current @githolon/client"); }))(${JSON.stringify(q.id)}, ${wireParams}, page, keys) as Promise<{ rows: Row<${q.returns}>[]; cursor: string | null; done: boolean }>)`
+          ? `_readPageWithOwnedKeys(holon, keyStore, ${qScopeJson}, (keys) => (holon.queryPage ?? (() => { throw new Error("bounded reads need a current @githolon/client"); }))(${JSON.stringify(q.id)}, ${wireParams}, page, keys) as Promise<{ rows: Row<${q.returns}>[]; cursor: string | null; done: boolean }>)`
           : `(holon.queryPage ?? (() => { throw new Error("bounded reads need a current @githolon/client"); }))(${JSON.stringify(q.id)}, ${wireParams}, page, await _readKeys(holon, keyStore, ${qScopeJson})) as Promise<{ rows: Row<${q.returns}>[]; cursor: string | null; done: boolean }>`
         : `(holon.queryPage ?? (() => { throw new Error("bounded reads need a current @githolon/client"); }))(${JSON.stringify(q.id)}, ${wireParams}, page) as Promise<{ rows: Row<${q.returns}>[]; cursor: string | null; done: boolean }>`;
       methods.push(
@@ -3639,15 +3661,15 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
         `     *  Every public directive has a baseline; \`.activity(...)\` enriches it. Framework/control work`,
         `     *  outside this generated package is dropped. Returns stop(). */`,
         `    watchActivity: (cb: (events: ActivityEvent[]) => void, opts?: { base?: string }) =>`,
-        `      holon.watchActivity((rows) => cb(rows.map(renderActivity).filter((e): e is ActivityEvent => e !== null)), opts),`,
+        `      _nomosWatchActivity((rows) => cb(rows.map(renderActivity).filter((e): e is ActivityEvent => e !== null)), opts),`,
         `    /** One-shot: the current committed activity log, folded to typed [ActivityEvent]s. */`,
         `    activityLog: async (opts?: { base?: string; limit?: number }): Promise<ActivityEvent[]> =>`,
-        `      (await holon.activityLog(opts)).map(renderActivity).filter((e): e is ActivityEvent => e !== null),`,
+        `      (await _nomosActivityLog(opts)).map(renderActivity).filter((e): e is ActivityEvent => e !== null),`,
         `    /** THE SELF-DESCRIPTION: root links to exactly six grounded pages — model, current state, rules,`,
         `     *  history, decisions and evidence. The old \`events\` / \`transcript\` fields remain, so this is a`,
         `     *  strict enrichment of the activity narrative. \`section\` selects one page. */`,
         `    describe: async (opts: { section?: NomosDescribeSection; since?: string; performedBy?: string; category?: string; limit?: number } = {}): Promise<NomosDescription> => {`,
-        `      const raw = await holon.activityLog(opts.limit !== undefined ? { limit: opts.limit } : {});`,
+        `      const raw = await _nomosActivityLog(opts.limit !== undefined ? { limit: opts.limit } : {});`,
         `      let events = raw.map(renderActivity).filter((e): e is ActivityEvent => e !== null);`,
         `      if (opts.performedBy !== undefined) events = events.filter((e) => e.performedBy === opts.performedBy);`,
         `      if (opts.category !== undefined) events = events.filter((e) => e.category === opts.category);`,
@@ -3759,7 +3781,7 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
         `     *  point at it (only directives declaring a ref to the aggregate appear in its story) + a transcript. */`,
         `    describeHistory: async <TAggregate>(record: NomosRef<TAggregate>, opts: { limit?: number } = {}): Promise<ActivityNarrative> => {`,
         `      const aggregateId = _nmsReferenceId(record, "", holon.workspace, "record");`,
-        `      const raw = await holon.activityLog(opts.limit !== undefined ? { limit: opts.limit } : {});`,
+        `      const raw = await _nomosActivityLog(opts.limit !== undefined ? { limit: opts.limit } : {});`,
         `      const events = raw.map(renderActivity).filter((e): e is ActivityEvent => e !== null)`,
         `        .filter((e) => Object.values(e.refs).some((r) => _nmsReferenceData(r).id === aggregateId));`,
         `      return { events, transcript: _activityTranscript(events) };`,
@@ -3770,9 +3792,19 @@ export function generateTsClient(modules: readonly DomainModule[], opts: TsClien
     out.push(
       `/** Framework binding for the generated application. Law identity, author identity and key custody`,
       ` *  are captured from the connected stateful client; callers cannot override them. */`,
-      `function ${tsClientFactoryName(domain)}(holon: NomosHolon) {`,
+      `/** THE HOLON-LEVEL FACTORY — the headless/code-mode binding (headless-operation.md). Binds`,
+      ` *  structurally to any NomosHolon: a full \`connect()\` holon, or the thin remote holon`,
+      ` *  (\`connectRemote\`) for isolates that live beside the edge. The application surface`,
+      ` *  (\`open<Name>Application\`) remains the batteries-included entry for devices. */`,
+      `${opts.exportHolonFactory === true ? "export " : ""}function ${tsClientFactoryName(domain)}(holon: NomosHolon) {`,
       `  const domainHash = ${hashConst};`,
       `  const actor = holon.principal;`,
+      ...(activityPresent
+        ? [
+            `  const _nomosActivityLog = (opts?: { base?: string; limit?: number }) => { if (!holon.activityLog) throw new Error("activity reads need a custody-capable @githolon/client binding"); return holon.activityLog(opts); };`,
+            `  const _nomosWatchActivity = (cb: (rows: ActivityRawRow[]) => void, opts?: { base?: string; intervalMs?: number }) => { if (!holon.watchActivity) throw new Error("activity watches need a custody-capable @githolon/client binding"); return holon.watchActivity(cb, opts); };`,
+          ]
+        : []),
       `  holon.prepareDomain?.(${JSON.stringify(domain)}, domainHash);`,
       ...(encPresent ? [`  const keyStore: NomosKeyStore | undefined = ${domScopes.length > 0 ? `{ scopeKey: async (scope) => { if (!holon.__nomosScopeKey) throw new Error("encrypted business data needs the current @githolon/client"); return holon.__nomosScopeKey({ scope }); }, readKeys: async (scopes) => { if (!holon.__nomosScopeKeys) throw new Error("encrypted business data needs the current @githolon/client"); return holon.__nomosScopeKeys({ scopes }); } }` : "undefined"};`] : []),
       ...(ownedScope !== undefined && Object.keys(ownedActions).length > 0

package/src/compat_manifest.ts

@@ -1,4 +1,4 @@
-// The CLIENT/LAW COMPATIBILITY MANIFEST (§5, architecture/plug_and_play_dx.md).
+// The CLIENT/LAW COMPATIBILITY MANIFEST (architecture/shape_compatibility.md).
 //
 // A DIAGNOSIS surface, NEVER a gate. Clients fit workspaces by STRUCTURAL INTERFACE
 // (stable-id subtyping, #72), not by law-hash pin — the hash pin was a bug we removed.

package/src/compile_package_main.ts

@@ -1660,8 +1660,8 @@ const NOMOS_TYPES_DEP = "^0.8.7";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.64.23";
-const NOMOS_FLUTTER_DEP = "^0.63.44";
+const NOMOS_CLIENT_DEP = "^0.64.24";
+const NOMOS_FLUTTER_DEP = "^0.63.46";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).
@@ -5080,7 +5080,7 @@ async function main(): Promise<void> {
     identityHashes[module.domain ?? module.name] = hash;
   }
 
-  // ── 3a. the CLIENT/LAW COMPATIBILITY MANIFEST (§5, architecture/plug_and_play_dx.md).
+  // ── 3a. the CLIENT/LAW COMPATIBILITY MANIFEST (architecture/shape_compatibility.md).
   // A DIAGNOSIS surface, NEVER a gate: the shape-compat arc (#72) established that clients
   // fit workspaces by STRUCTURAL INTERFACE (stable-id subtyping), not by law-hash pin. This
   // block is baked into both generated clients (TS + Dart) and mirrored into the deploy JSON
@@ -5253,20 +5253,29 @@ async function main(): Promise<void> {
   //       deployed law's content hash baked in (emitted AFTER the package is hashed) ──
   const clientPath = path.join(outDir, `${cfg.name}.client.mjs`);
   const clientDeclarationPath = path.join(outDir, `${cfg.name}.client.d.mts`);
-  const clientSource = generateTsClient(presentationDomainModules, {
+  const headlessClientPath = path.join(outDir, `${cfg.name}.headless.mjs`);
+  const headlessClientDeclarationPath = path.join(outDir, `${cfg.name}.headless.d.mts`);
+  const clientOptions = {
     packageName: cfg.name,
     domainHash,
     interface: packageInterface,
     compat: nomosCompat,
     homeDomain: resolveApplicationTopology(presentationDomainModules).homeDomain,
+  } as const;
+  const clientSource = generateTsClient(presentationDomainModules, clientOptions);
+  const headlessClientSource = generateTsClient(presentationDomainModules, {
+    ...clientOptions,
+    exportHolonFactory: true,
   });
   const runtimePath = path.join(DSL_DIR, "runtime", "generated-application-host.js");
   if (!existsSync(runtimePath)) {
     fail("the compiler-private generated application runtime is missing — reinstall @githolon/dsl");
   }
   const temporaryClientPath = path.join(outDir, `.${cfg.name}.client.source.ts`);
+  const temporaryHeadlessClientPath = path.join(outDir, `.${cfg.name}.headless.source.ts`);
   const temporaryRuntimeTypesPath = path.join(outDir, `.${cfg.name}.application-runtime.d.ts`);
   const temporaryDeclarationPath = temporaryClientPath.replace(/\.ts$/, ".d.ts");
+  const temporaryHeadlessDeclarationPath = temporaryHeadlessClientPath.replace(/\.ts$/, ".d.ts");
   const runtimeTypesSource = [
     `export declare function nomosInternalOpenGeneratedApplication<T extends object>(`,
     `  options: { cloud: string; application: string; signIn: (request?: { readonly deviceChallenge?: string }) => Promise<string>; onPerformance?: (sample: { readonly operation: "open" | "offer" | "birth" | "read" | "sync" | "maintenance"; readonly name: string; readonly durationMs: number; readonly domain?: string; readonly directive?: string }) => void; lawHash: string; readyCommands?: readonly { readonly domain: string; readonly packageHash: string; readonly directiveId: string }[] },`,
@@ -5306,6 +5315,8 @@ async function main(): Promise<void> {
     .update(`${declarationProofFormat}\0`)
     .update(normalizedClientSource)
     .update("\0")
+    .update(headlessClientSource.replaceAll(domainHash, "<nomos-composed-law-identity>"))
+    .update("\0")
     .update(runtimeTypesSource)
     .update("\0")
     .update(ts.version)
@@ -5313,25 +5324,37 @@ async function main(): Promise<void> {
     .update(readFileSync(fileURLToPath(import.meta.url)))
     .digest("hex");
   const declarationCacheDir = path.join(cfgDir, "node_modules", ".cache", "nomos", "typescript-declarations");
-  const declarationCachePath = path.join(declarationCacheDir, `${declarationInputIdentity}.d.mts`);
-  const declarationCacheProofPath = path.join(declarationCacheDir, `${declarationInputIdentity}.proof.usda`);
-  const declarationProofKey = (bytes: Buffer): string => createHash("sha256")
-    .update(`${declarationProofFormat}\0${declarationInputIdentity}\0`)
+  const declarationCachePath = path.join(declarationCacheDir, `${declarationInputIdentity}.client.d.mts`);
+  const headlessDeclarationCachePath = path.join(declarationCacheDir, `${declarationInputIdentity}.headless.d.mts`);
+  const declarationCacheProofPath = path.join(declarationCacheDir, `${declarationInputIdentity}.client.proof.usda`);
+  const headlessDeclarationCacheProofPath = path.join(declarationCacheDir, `${declarationInputIdentity}.headless.proof.usda`);
+  const declarationProofKey = (artifact: "client" | "headless", bytes: Buffer): string => createHash("sha256")
+    .update(`${declarationProofFormat}\0${declarationInputIdentity}\0${artifact}\0`)
     .update(bytes)
     .digest("hex");
   const cachedDeclaration = existsSync(declarationCachePath) ? readFileSync(declarationCachePath) : undefined;
+  const cachedHeadlessDeclaration = existsSync(headlessDeclarationCachePath)
+    ? readFileSync(headlessDeclarationCachePath)
+    : undefined;
   const declarationCacheHit = cachedDeclaration !== undefined &&
+    cachedHeadlessDeclaration !== undefined &&
     declarationProofCodec.readKeyProofUsda(declarationCacheProofPath, declarationProofFormat) ===
-      declarationProofKey(cachedDeclaration);
-  if (declarationCacheHit) copyFileSync(declarationCachePath, clientDeclarationPath);
+      declarationProofKey("client", cachedDeclaration) &&
+    declarationProofCodec.readKeyProofUsda(headlessDeclarationCacheProofPath, declarationProofFormat) ===
+      declarationProofKey("headless", cachedHeadlessDeclaration);
+  if (declarationCacheHit) {
+    copyFileSync(declarationCachePath, clientDeclarationPath);
+    copyFileSync(headlessDeclarationCachePath, headlessClientDeclarationPath);
+  }
   try {
     if (!declarationCacheHit) {
       writeFileSync(temporaryClientPath, clientSource, "utf8");
+      writeFileSync(temporaryHeadlessClientPath, headlessClientSource, "utf8");
       writeFileSync(temporaryRuntimeTypesPath, runtimeTypesSource, "utf8");
       const typescriptEntry = createRequire(import.meta.url).resolve("typescript/lib/typescript.js");
       const ts = (await import(pathToFileURL(typescriptEntry).href)) as typeof import("typescript");
       const program = ts.createProgram(
-      [temporaryClientPath, temporaryRuntimeTypesPath],
+      [temporaryClientPath, temporaryHeadlessClientPath, temporaryRuntimeTypesPath],
       {
         target: ts.ScriptTarget.ES2022,
         module: ts.ModuleKind.NodeNext,
@@ -5351,7 +5374,10 @@ async function main(): Promise<void> {
     );
     const emit = program.emit();
     const diagnostics = [...ts.getPreEmitDiagnostics(program), ...emit.diagnostics];
-    if (diagnostics.length > 0 || emit.emitSkipped || !existsSync(temporaryDeclarationPath)) {
+    if (
+      diagnostics.length > 0 || emit.emitSkipped ||
+      !existsSync(temporaryDeclarationPath) || !existsSync(temporaryHeadlessDeclarationPath)
+    ) {
       const detail = diagnostics.map((diagnostic) => {
         const message = ts.flattenDiagnosticMessageText(diagnostic.messageText, "\n");
         if (diagnostic.file === undefined || diagnostic.start === undefined) return message;
@@ -5497,14 +5523,23 @@ async function main(): Promise<void> {
     ].join("\n");
       writeFileSync(temporaryDeclarationPath, declarationSource, "utf8");
       renameSync(temporaryDeclarationPath, clientDeclarationPath);
+      renameSync(temporaryHeadlessDeclarationPath, headlessClientDeclarationPath);
       mkdirSync(declarationCacheDir, { recursive: true });
       const declarationCacheTemporaryPath = `${declarationCachePath}.tmp-${process.pid}`;
+      const headlessDeclarationCacheTemporaryPath = `${headlessDeclarationCachePath}.tmp-${process.pid}`;
       copyFileSync(clientDeclarationPath, declarationCacheTemporaryPath);
+      copyFileSync(headlessClientDeclarationPath, headlessDeclarationCacheTemporaryPath);
       renameSync(declarationCacheTemporaryPath, declarationCachePath);
+      renameSync(headlessDeclarationCacheTemporaryPath, headlessDeclarationCachePath);
       declarationProofCodec.writeKeyProofUsda(
         declarationCacheProofPath,
         declarationProofFormat,
-        declarationProofKey(readFileSync(declarationCachePath)),
+        declarationProofKey("client", readFileSync(declarationCachePath)),
+      );
+      declarationProofCodec.writeKeyProofUsda(
+        headlessDeclarationCacheProofPath,
+        declarationProofFormat,
+        declarationProofKey("headless", readFileSync(headlessDeclarationCachePath)),
       );
     }
     await esbuildMod.build({
@@ -5540,12 +5575,44 @@ async function main(): Promise<void> {
     ) {
       fail("generated TypeScript application did not seal its private runtime binding");
     }
+    await esbuildMod.build({
+      stdin: {
+        contents: headlessClientSource,
+        loader: "ts",
+        resolveDir: outDir,
+        sourcefile: `${cfg.name}.headless.ts`,
+      },
+      outfile: headlessClientPath,
+      bundle: true,
+      packages: "bundle",
+      platform: "node",
+      format: "esm",
+      target: "node20",
+      legalComments: "none",
+      logLevel: "silent",
+      plugins: [{
+        name: "nomos-generated-headless-runtime",
+        setup(build) {
+          build.onResolve(
+            { filter: /^@githolon\/client\/_generated_application_host_7c1f5e$/ },
+            () => ({ path: runtimePath }),
+          );
+        },
+      }],
+    });
+    const headlessBundled = canonicalizeGeneratedClientJavascript(readFileSync(headlessClientPath, "utf8"));
+    writeFileSync(headlessClientPath, headlessBundled, "utf8");
+    if (!new RegExp(`export\\s*\\{[^}]*${tsClientFactoryName(resolveApplicationTopology(presentationDomainModules).homeDomain)}`, "s").test(headlessBundled)) {
+      fail("generated headless application omitted its structural holon factory");
+    }
   } catch (e) {
     fail(`generated TypeScript application could not be sealed — this is a Nomos codegen bug: ${(e as Error).message}`);
   } finally {
     rmSync(temporaryClientPath, { force: true });
+    rmSync(temporaryHeadlessClientPath, { force: true });
     rmSync(temporaryRuntimeTypesPath, { force: true });
     rmSync(temporaryDeclarationPath, { force: true });
+    rmSync(temporaryHeadlessDeclarationPath, { force: true });
     rmSync(path.join(outDir, `${cfg.name}.client.ts`), { force: true });
   }
 
@@ -5903,6 +5970,7 @@ async function main(): Promise<void> {
     }
   }
   console.log(`  client     ${rel(clientPath)} (typed TS client — payloads, read models, query accessors)`);
+  console.log(`  headless   ${rel(headlessClientPath)} + ${rel(headlessClientDeclarationPath)} (typed business binding for code-mode/edge holons)`);
   for (const note of recursiveNotes) console.log(`  note       ${note}`);
   console.log(`  openapi    served by the holon from installed USDA (GET /v2/workspaces/<ws>/openapi.json) — no build-time copy to drift`);
   if (proofPath !== undefined) {

package/src/framework/home.ts

@@ -96,12 +96,11 @@ export const ReceivingGroup = aggregate("NomosInternalReceivingGroup7c1f5e", {
  * and secure: a live, verified device may add or revoke another device; keyless IdP enrolment is only the
  * pre-group bootstrap lane.
  *
- * ALL-DEVICE-LOSS RECOVERY — design done, NOT YET SHIPPED (`architecture/guardian_device_recovery.md`,
- * 2026-08-06). DO NOT re-derive this from scratch under a live incident again — read that doc first. The
- * primitives already exist (`enrollDelegation` + `birthReceivingGroup` + `revokeSigner`); what's missing is
- * a kernel-side closure (birth-repeat currently accepts a SELF-signed delegation onto an already-founded
- * group — a live gap, not a feature, until closed) plus client wiring. `guardianQuorum`/`recovery` below are
- * the policy fields that design reads.
+ * ALL-DEVICE-LOSS RECOVERY — CO2 already recovers through its platform AuthProvider, but the implementation
+ * reaches that result by repeating birth after this home's direct enrollment policy refuses. The corrected
+ * design (`architecture/guardian_device_recovery.md`, reconciled 2026-08-10) makes recovery authority an
+ * explicit tenant-selected policy: platform identity provider or guardian quorum. The missing work is to
+ * evaluate that choice at the existing child's frontier and delete the client-side birth-repeat bypass.
  */
 export const ReceivingGroupPolicy = aggregate("NomosInternalReceivingGroupPolicy7c1f5e", {
   additionalDevice: t.string().merge(Lww),
@@ -207,15 +206,15 @@ const receivingGroupPolicyRefs = readSet(
 );
 
 /** An IdP token may bootstrap the parent before the group exists; it may never bypass an existing group's
- * device policy. A new group device must be approved by a current device or, later, guardian evidence.
+ * device policy. An existing group chooses whether recovery is delegated to its platform AuthProvider or to
+ * guardians; the current default below says guardian, while CO2's current product behaviour is platform IdP.
  *
  * KNOWN GAP (`architecture/guardian_device_recovery.md`): this invariant is declared `.on("enrollFirstDevice")`
  * and only fires when that directive targets THIS home directly. It is NOT re-applied when the birth
  * offer-effect (`run_birth_effect`, repeating `nomosInternalBirthReceivingGroup` against an ALREADY-founded
- * home) folds a signer seat via the SAME underlying mechanism — a self-signed keyless delegation currently
- * reseats a device there with no guardian, no approval, no delay. Verified live 2026-08-06. Fix belongs in
- * the kernel's keyless `verify_to_root` branch (refuse a self-signed cert onto an already-warranted signer
- * roster); do not paper over it in the DSL only. */
+ * home) folds a signer seat via the SAME underlying mechanism. That is how CO2 recovery works today, but its
+ * home frontier still says `guardian-quorum`. The fix is not to ban platform recovery: add the explicit
+ * platform-identity-provider policy, make CO2 choose it, and have the child gate verify the chosen evidence. */
 export const receivingGroupRejectsKeylessAdditionalDevice = workspaceInvariant("ReceivingGroupRejectsKeylessAdditionalDevice")
   .on("enrollFirstDevice")
   .reads(receivingGroupPolicyRefs)

package/src/framework/owned_custody.ts

@@ -2,11 +2,11 @@
 // Tenant code sees only generated `devices.request()` / `devices.approve(request)`.
 
 import { z } from "zod";
-import { OWNED_KEY_RELATION, OWNED_READ_RELATION, aggregate, instance, ownedKeyObject, type AggregateHandle } from "../aggregate.js";
+import { OWNED_KEY_RELATION, OWNED_PRINCIPAL_OBJECT_TYPE, OWNED_READ_RELATION, aggregate, instance, ownedKeyObject, type AggregateHandle } from "../aggregate.js";
 import { Lww } from "../drivers.js";
 import { directive } from "../directive.js";
 import { endorsementOf } from "../principal_evidence.js";
-import { isRelationTypeDecl } from "../relation_schema.js";
+import { isRelationTypeDecl, key, relationType, self, user } from "../relation_schema.js";
 import { t } from "../fields.js";
 import { set, withMarker } from "../ops.js";
 import { query } from "../query.js";
@@ -19,6 +19,7 @@ import {
   writeWrap,
 } from "./encryption_scope.js";
 import { GenesisWarrant, seedGenesis } from "./genesis.js";
+import { BirthAttestation, seedBirthAttestation } from "./home.js";
 import { RelationTuple, __qualifyAggregateType, removeTuple, writeTuple } from "./relations.js";
 import { SIGNER_RELATION, enrollSigner, signerObject, identityRelations } from "./signing_identity.js";
 import { impureCapability, impureCapabilityAggregate } from "./impure_capability.js";
@@ -27,6 +28,10 @@ import { impureCapability, impureCapabilityAggregate } from "./impure_capability
 export const OWNED_DEVICE_APPROVAL_DIRECTIVE = "nomos_internal_approve_owned_device_7c1f5e";
 export const OWNED_INITIALIZE_DIRECTIVE = "nomos_internal_initialize_owned_identity_7c1f5e";
 export const OWNED_RECOVERY_RELATION = "nomos_internal_owned_recovery_principal_7c1f5e";
+export const ownedCustodyRelations = relationType(OWNED_PRINCIPAL_OBJECT_TYPE)
+  .asGlobal()
+  .relation(OWNED_KEY_RELATION, { rewrite: self(), allow: [key()] })
+  .relation(OWNED_RECOVERY_RELATION, { rewrite: self(), allow: [user()] });
 export const OWNED_RECOVERY_PROTECT_DIRECTIVE = "nomos_internal_protect_owned_identity_7c1f5e";
 export const OWNED_RECOVERY_REQUEST_DIRECTIVE = "nomos_internal_request_owned_recovery_7c1f5e";
 export const OWNED_RECOVERY_COMPLETE_DIRECTIVE = "nomos_internal_complete_owned_recovery_7c1f5e";
@@ -109,7 +114,33 @@ const ownedRecoveryLifecycle = impureCapability({
   writeReceipt: (id, r) => [
     set(instance(OwnedRecoveryOrder, id), "ownedCustody", r.ownedCustody as string),
   ],
+  // This is intentionally unaddressed: opening the designated principal's ordinary generated
+  // client is the provider. Declaring the capability still matters because every durable Order must
+  // have one typed provider contract; the kernel may then retain the sealed obligation locally until
+  // that principal opens the workspace, rather than inventing an untyped host work description.
+  capability: "nomos.owned-recovery",
 });
+const hiddenRecoveryLifecycle = {
+  aggregate: hidden(OwnedRecoveryOrder),
+  obligation: hidden(ownedRecoveryLifecycle.obligation),
+  complete: hidden(ownedRecoveryLifecycle.complete),
+  fail: hidden(ownedRecoveryLifecycle.fail),
+  block: hidden(ownedRecoveryLifecycle.block),
+  deadLetter: hidden(ownedRecoveryLifecycle.deadLetter),
+};
+const ownedRecoveryCapability = {
+  ...ownedRecoveryLifecycle,
+  // Capability expansion deliberately re-seats the lifecycle quartet after application-language
+  // closure. Carry the private declarations there too; pointing back at the raw impure-capability
+  // declarations silently reintroduced framework verbs into proof selection and generated names.
+  aggregate: hiddenRecoveryLifecycle.aggregate,
+  obligation: hiddenRecoveryLifecycle.obligation,
+  complete: hiddenRecoveryLifecycle.complete,
+  fail: hiddenRecoveryLifecycle.fail,
+  block: hiddenRecoveryLifecycle.block,
+  deadLetter: hiddenRecoveryLifecycle.deadLetter,
+  __isCapabilityDecl: true as const,
+};
 
 export const ownedRecoveryOrdersByRecoveryPrincipal = query("nomosOwnedRecoveryOrdersByRecoveryPrincipal")
   .key("recoveryPrincipal")
@@ -157,7 +188,7 @@ const protectOwnedIdentity = Object.assign(
     .alsoEnsures(RelationTuple)
     .alsoEnsures(KeyScope)
     .alsoEnsures(WrappedKey),
-  { businessBirthInternal: true as const },
+  { businessBirthInternal: true as const, ownedAuthoringInternal: true as const },
 );
 
 const acceptOwnedRecovery = Object.assign(
@@ -181,18 +212,9 @@ const acceptOwnedRecovery = Object.assign(
         ownedCustody: p.ownedCustody,
       });
     }),
-  { businessBirthInternal: true as const },
+  { businessBirthInternal: true as const, ownedAuthoringInternal: true as const },
 );
 
-const hiddenRecoveryLifecycle = {
-  aggregate: hidden(OwnedRecoveryOrder),
-  obligation: hidden(ownedRecoveryLifecycle.obligation),
-  complete: hidden(ownedRecoveryLifecycle.complete),
-  fail: hidden(ownedRecoveryLifecycle.fail),
-  block: hidden(ownedRecoveryLifecycle.block),
-  deadLetter: hidden(ownedRecoveryLifecycle.deadLetter),
-};
-
 export type OwnedRecordAction = "share" | "unshare" | "transfer";
 
 /** One collision-resistant framework id per aggregate/action. Tenant code never sees these ids. */
@@ -256,6 +278,7 @@ const approval = directive(OWNED_DEVICE_APPROVAL_DIRECTIVE)
 /** Branded internal so ordinary directive codegen never exposes its cryptographic payload. */
 export const approveOwnedDevice = Object.assign(approval, {
   businessBirthInternal: true as const,
+  ownedAuthoringInternal: true as const,
 });
 
 /** Establish this principal's shared owned-data root before another principal shares to them. */
@@ -281,7 +304,7 @@ const initializeOwnedIdentity = Object.assign(
         ownedCustody: p.ownedCustody,
       });
     }),
-  { businessBirthInternal: true as const },
+  { businessBirthInternal: true as const, ownedAuthoringInternal: true as const },
 );
 
 function recordScope(aggregate: AggregateHandle, recordId: string): string {
@@ -295,7 +318,10 @@ function recordObject(aggregate: AggregateHandle, recordId: string): string {
 function ownedRecordActionDirectives(aggregate: AggregateHandle) {
   const share = Object.assign(
     directive(ownedRecordActionDirectiveId("share", aggregate.id))
-      .ensures(WrappedKey)
+      // The owned business record is the semantic target. Relation tuples and wraps are framework
+      // effects of sharing it; making a wrap the primary target causes authenticated law to describe
+      // this as a key action and the kernel correctly refuses `share(record, person)`.
+      .mutates(aggregate)
       .payload(z.object({
         recordId: z.string().min(1),
         peer: principal,
@@ -313,13 +339,14 @@ function ownedRecordActionDirectives(aggregate: AggregateHandle) {
         }),
         ...p.wraps.flatMap((entry) => writeWrap(recordScope(aggregate, p.recordId), entry.epoch, entry)),
       ])
-      .alsoEnsures(RelationTuple),
-    { businessBirthInternal: true as const },
+      .alsoEnsures(RelationTuple)
+      .alsoEnsuresMany(WrappedKey),
+    { businessBirthInternal: true as const, ownedAuthoringInternal: true as const },
   );
 
   const unshare = Object.assign(
     directive(ownedRecordActionDirectiveId("unshare", aggregate.id))
-      .ensures(KeyScope)
+      .mutates(aggregate)
       .payload(z.object({
         recordId: z.string().min(1),
         peer: principal,
@@ -340,14 +367,15 @@ function ownedRecordActionDirectives(aggregate: AggregateHandle) {
         ...writeKeyEpoch(recordScope(aggregate, p.recordId), p.epoch, p.changedAt, p.wraps),
       ])
       .alsoEnsures(RelationTuple)
+      .alsoEnsures(KeyScope)
       .alsoEnsuresMany(WrappedKey),
-    { businessBirthInternal: true as const },
+    { businessBirthInternal: true as const, ownedAuthoringInternal: true as const },
   );
 
   const ownerField = aggregate.audience?.kind === "owned" ? aggregate.audience.ownerField : "";
   const transfer = Object.assign(
     directive(ownedRecordActionDirectiveId("transfer", aggregate.id))
-      .ensures(KeyScope)
+      .mutates(aggregate)
       .payload(z.object({
         recordId: z.string().min(1),
         newOwner: principal,
@@ -383,9 +411,9 @@ function ownedRecordActionDirectives(aggregate: AggregateHandle) {
         return ops;
       })
       .alsoEnsuresMany(RelationTuple)
-      .alsoMutates(aggregate)
+      .alsoEnsures(KeyScope)
       .alsoEnsuresMany(WrappedKey),
-    { businessBirthInternal: true as const },
+    { businessBirthInternal: true as const, ownedAuthoringInternal: true as const },
   );
 
   return { share, unshare, transfer };
@@ -393,8 +421,11 @@ function ownedRecordActionDirectives(aggregate: AggregateHandle) {
 
 const APPROVAL_EXPORT = "__nomos_owned_device_approval_7c1f5e";
 const IDENTITY_EXPORT = "__nomos_owned_identity_relations_7c1f5e";
+const CUSTODY_RELATIONS_EXPORT = "__nomos_owned_custody_relations_7c1f5e";
 const WARRANT_EXPORT = "__nomos_owned_genesis_warrant_7c1f5e";
 const SEED_EXPORT = "__nomos_owned_seed_genesis_7c1f5e";
+const BIRTH_ATTESTATION_EXPORT = "__nomos_owned_birth_attestation_7c1f5e";
+const BIRTH_ATTESTATION_SEED_EXPORT = "__nomos_owned_seed_birth_attestation_7c1f5e";
 const ENROLL_EXPORT = "__nomos_owned_enroll_signer_7c1f5e";
 const INITIALIZE_EXPORT = "__nomos_owned_initialize_identity_7c1f5e";
 const KEY_SCOPE_EXPORT = "__nomos_owned_key_scope_7c1f5e";
@@ -411,11 +442,15 @@ const RECOVERY_FAIL_EXPORT = "__nomos_owned_recovery_fail_7c1f5e";
 const RECOVERY_BLOCK_EXPORT = "__nomos_owned_recovery_block_7c1f5e";
 const RECOVERY_DEAD_LETTER_EXPORT = "__nomos_owned_recovery_dead_letter_7c1f5e";
 const RECOVERY_QUERY_EXPORT = "__nomos_owned_recovery_query_7c1f5e";
+const RECOVERY_CAPABILITY_EXPORT = "__nomos_owned_recovery_capability_7c1f5e";
 
 const ownedGenesisWarrant = hidden(GenesisWarrant);
 const ownedSeedGenesis = hidden(seedGenesis);
+const ownedBirthAttestation = hidden(BirthAttestation);
+const ownedSeedBirthAttestation = hidden(seedBirthAttestation);
 const ownedEnrollSigner = hidden(enrollSigner);
 const ownedIdentityRelations = hidden(identityRelations);
+const ownedCustodyRelationLaw = hidden(ownedCustodyRelations);
 
 /**
  * The published CLI bundles its compiler while a tenant module imports declarations from the separately
@@ -476,6 +511,7 @@ export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod:
     [RECOVERY_BLOCK_EXPORT, hiddenRecoveryLifecycle.block],
     [RECOVERY_DEAD_LETTER_EXPORT, hiddenRecoveryLifecycle.deadLetter],
     [RECOVERY_QUERY_EXPORT, hidden(ownedRecoveryOrdersByRecoveryPrincipal)],
+    [RECOVERY_CAPABILITY_EXPORT, hidden(ownedRecoveryCapability)],
   ] as const;
 
   // These names are deliberately obscure, not magical. A tenant can still reach one accidentally or
@@ -489,6 +525,10 @@ export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod:
       && !sameFrameworkDeclaration(mod[IDENTITY_EXPORT], ownedIdentityRelations)) {
     reservedCollision(IDENTITY_EXPORT);
   }
+  if (Object.prototype.hasOwnProperty.call(mod, CUSTODY_RELATIONS_EXPORT)
+      && !sameFrameworkDeclaration(mod[CUSTODY_RELATIONS_EXPORT], ownedCustodyRelationLaw)) {
+    reservedCollision(CUSTODY_RELATIONS_EXPORT);
+  }
   for (const [key, generated] of recoveryInjections) {
     if (Object.prototype.hasOwnProperty.call(mod, key) && !sameFrameworkDeclaration(mod[key], generated)) {
       reservedCollision(key);
@@ -497,6 +537,8 @@ export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod:
   for (const [key, generated] of [
     [WARRANT_EXPORT, ownedGenesisWarrant],
     [SEED_EXPORT, ownedSeedGenesis],
+    [BIRTH_ATTESTATION_EXPORT, ownedBirthAttestation],
+    [BIRTH_ATTESTATION_SEED_EXPORT, ownedSeedBirthAttestation],
     [ENROLL_EXPORT, ownedEnrollSigner],
   ] as const) {
     if (Object.prototype.hasOwnProperty.call(mod, key) && !sameFrameworkDeclaration(mod[key], generated)) {
@@ -526,6 +568,8 @@ export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod:
     for (const [framework, generated] of [
       [GenesisWarrant, ownedGenesisWarrant],
       [seedGenesis, ownedSeedGenesis],
+      [BirthAttestation, ownedBirthAttestation],
+      [seedBirthAttestation, ownedSeedBirthAttestation],
       [enrollSigner, ownedEnrollSigner],
     ] as const) {
       if (
@@ -546,6 +590,14 @@ export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod:
     ) {
       reservedCollision(`global relation type '${identityRelations.type}'`);
     }
+    if (
+      !sameFrameworkDeclaration(value, ownedCustodyRelationLaw)
+      && isRelationTypeDecl(value)
+      && value.global === true
+      && value.type === ownedCustodyRelations.type
+    ) {
+      reservedCollision(`global relation type '${ownedCustodyRelations.type}'`);
+    }
     if (value !== null && typeof value === "object" && typeof (value as { id?: unknown }).id === "string") {
       const id = (value as { id: string }).id;
       const generated = actions.flatMap((entry) => [entry.share, entry.unshare, entry.transfer]);
@@ -560,6 +612,7 @@ export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod:
     [APPROVAL_EXPORT]: approveOwnedDevice,
     [INITIALIZE_EXPORT]: initializeOwnedIdentity,
     [IDENTITY_EXPORT]: ownedIdentityRelations,
+    [CUSTODY_RELATIONS_EXPORT]: ownedCustodyRelationLaw,
     [KEY_SCOPE_EXPORT]: hidden(KeyScope),
     [WRAPPED_KEY_EXPORT]: hidden(WrappedKey),
     [KEY_SCOPE_QUERY_EXPORT]: hidden(keyScopeByScope),
@@ -574,11 +627,14 @@ export function withOwnedCustodyExports<M extends Record<string, unknown>>(mod:
     [RECOVERY_BLOCK_EXPORT]: hiddenRecoveryLifecycle.block,
     [RECOVERY_DEAD_LETTER_EXPORT]: hiddenRecoveryLifecycle.deadLetter,
     [RECOVERY_QUERY_EXPORT]: hidden(ownedRecoveryOrdersByRecoveryPrincipal),
+    [RECOVERY_CAPABILITY_EXPORT]: hidden(ownedRecoveryCapability),
     // A local law test starts from an empty root, while production business state is normally born into a
     // warranted child. Keep the same lawful bootstrap machinery available in both cases, but framework-only:
     // the harness can seat its test identity and warrant the root without adding a tenant-facing lane.
     [WARRANT_EXPORT]: ownedGenesisWarrant,
     [SEED_EXPORT]: ownedSeedGenesis,
+    [BIRTH_ATTESTATION_EXPORT]: ownedBirthAttestation,
+    [BIRTH_ATTESTATION_SEED_EXPORT]: ownedSeedBirthAttestation,
     [ENROLL_EXPORT]: ownedEnrollSigner,
   };
   for (const { aggregate, share, unshare, transfer } of actions) {

package/src/framework/workspaces.ts

@@ -104,7 +104,7 @@ export { enrollFirstDevice, revokeSigner } from "./signing_identity.js";
 // (this trio) but DELIBERATELY does NOT export the `parentAttestedBirth` era marker — a platform's own 1-link
 // `[platform_cert]` chain would fail `verify_to_root` (>=2 links), so its own verify doors must stay inert
 // while it still carries the cert for its children. Fully additive (new aggregate + directive, no era key ⇒
-// pre-existing chains replay byte-identical). architecture/co2_attestation_spine.md.
+// pre-existing chains replay byte-identical). See architecture/verified_auth_from_genesis.md.
 export { BIRTH_ATTESTATION_ID, BirthAttestation, birthAttestation, seedBirthAttestation } from "./home.js";
 // THE ENROLL-ONCE DELEGATION LANE — a platform records each tenant's device-key delegation (signed by its
 // onboarding signer S_P) so the kernel reads it at `signer-delegation:<user>` when assembling a home's chain.

package/src/index.ts

@@ -464,7 +464,7 @@ export {
 // a `requires(cap)` aggregate's cap IS a read relation (synthesized into nomosRelations at compile),
 // and a grant is a `relateSubject({ object:"workspace:self", relation:cap, ... })` tuple. See
 // framework/relations.ts + relation_schema.ts below.
-// NATIVE ZANZIBAR / ReBAC (architecture/zanzibar_native_plan.md, slice 1) — object-keyed
+// NATIVE ZANZIBAR / ReBAC (architecture/authz_relationship_spine.md) — object-keyed
 // relation-tuple events `object#relation@subject`, the clean-slate-native authz spine.
 export {
   RELATION_STATUSES,

package/src/law_check.ts

@@ -1351,7 +1351,7 @@ export function checkDomainModules(
             domain,
             level: "warn",
             what: `birth recipe: ${diag}`,
-            fix: `see architecture/g3_kernel_fulfils_birth.md / the births DX — the recipe must install both framework + child law and seed genesis`,
+            fix: `see create-githolon/template/docs/08-births.md — the recipe must install both framework + child law and seed genesis`,
           });
         }
       }

package/src/law_graph.ts

@@ -1221,6 +1221,7 @@ export function discoverLawGraph(
     const frameworkCapabilities = new Set<"owned-authoring">();
     if (
       businessBirth?.owned === true ||
+      (intent as { ownedAuthoringInternal?: unknown }).ownedAuthoringInternal === true ||
       affectedAggregateIds.some((aggregateId) =>
         aggregateByLabel.get(aggregateId)?.node.ownerField !== undefined)
     ) {
@@ -1537,16 +1538,23 @@ export function discoverLawGraph(
   const synthesizedReadRelations = new Map<string, (typeof authoredRelationDecls)[number]>();
   for (const aggregate of module.aggregates) {
     if (aggregate.audience === undefined || aggregate.audience.kind === "public") continue;
-    const relation = aggregate.audience.kind === "owned"
-      ? OWNED_READ_RELATION
-      : aggregate.audience.cap;
-    const label = `workspace#${relation}`;
+    const owned = aggregate.audience.kind === "owned";
+    const relation = owned ? OWNED_READ_RELATION : aggregate.audience.cap;
+    // A normal capability is a workspace role. `.owned()` is deliberately different: Nomos seats the
+    // creator on each record's own relation so sharing one record grants no sibling. The old synthesis
+    // declared the owned relation on `workspace:self` while the framework correctly wrote
+    // `<domain>.<Aggregate>:<id>#reader`; every lawful owner read was consequently denied.
+    const authoredObjectType = owned ? aggregate.id : "workspace";
+    const objectType = owned
+      ? aggregateByLabel.get(aggregate.id)!.node.wireType
+      : "workspace";
+    const label = `${authoredObjectType}#${relation}`;
     if (authoredRelationLabels.has(label) || synthesizedReadRelations.has(label)) continue;
     synthesizedReadRelations.set(label, {
       label,
-      authoredObjectType: "workspace",
-      objectType: "workspace",
-      global: true,
+      authoredObjectType,
+      objectType,
+      global: !owned,
       caps: DEFAULT_RELATION_CAPS,
       relation,
       definition: {
@@ -1697,16 +1705,17 @@ export function discoverLawGraph(
   }
   for (const aggregate of module.aggregates) {
     if (aggregate.audience === undefined || aggregate.audience.kind === "public") continue;
-    const relationName = aggregate.audience.kind === "owned"
-      ? OWNED_READ_RELATION
-      : aggregate.audience.cap;
+    const owned = aggregate.audience.kind === "owned";
+    const relationName = owned ? OWNED_READ_RELATION : aggregate.audience.cap;
+    const objectType = owned ? aggregate.id : "workspace";
+    const relationLabel = `${objectType}#${relationName}`;
     const candidates = relationNodes.filter((candidate) =>
-      candidate.entity.label === `workspace#${relationName}`);
+      candidate.entity.label === relationLabel);
     if (candidates.length > 1) {
       fail(`aggregate '${aggregate.id}' read relation '${relationName}' is ambiguous across relation types`);
     }
     const readPolicy: LawTargetRef<"relation" | "policy"> = candidates[0] === undefined
-      ? { kind: "dependency-export", entityKind: "relation", label: `workspace#${relationName}` }
+      ? { kind: "dependency-export", entityKind: "relation", label: relationLabel }
       : ref(candidates[0].entity);
     const entry = aggregateByLabel.get(aggregate.id)!;
     const updated = { ...entry.node, readPolicy };

package/src/relation_schema.ts

@@ -6,7 +6,7 @@
 /**
  * relation_schema — THE NATIVE ZANZIBAR RELATION SCHEMA (the userset-rewrite law).
  *
- * This is layer 2 of the three-layer authz design (see `architecture/zanzibar_native_plan.md`):
+ * This is the schema layer of the authorization design (see `architecture/authz_relationship_spine.md`):
  *   1. TUPLES  = ledger events (`relateSubject`/`RelationTuple`, framework/relations.ts).
  *   2. SCHEMA  = THIS FILE — per-type relation REWRITES authored as PURE DATA, lowered to the
  *      `nomosRelations` USD era key. NO JavaScript on the schema path: a `.relation(...)` produces

package/src/relation_sugar.ts

@@ -27,7 +27,7 @@
  *        directly(user(), key())  → { rewrite: this, allow:[...] }  — the this+allow PAIR so the
  *                                    type restriction CAN'T be forgotten (the #1 footgun).
  *
- *   2. SECURE-BY-DEFAULT AUDIENCES (the PRIMARY surface; `zanzibar_native_plan.md` F2). Builder
+ *   2. SECURE-BY-DEFAULT AUDIENCES (the PRIMARY surface; `authz_relationship_spine.md`). Builder
  *      methods that lower to a relation (or a small set of relations) with the SAFE default baked in:
  *        .public(rel)            → rel = directly(anyUser())              (user:* ONLY — never key:*)
  *        .owned(rel?)            → owner = directly(user()); rel = directly(self) ∪ computed(owner)

package/src/shape_compat.ts

@@ -138,7 +138,7 @@ function payloadFieldKind(spec: PayloadFieldSpec): string {
       return "string";
     case "vo":
     case "voList":
-      // Interface kinds stay at the base lane for now (slice D of vo_authoring_end_to_end.md
+      // Interface kinds stay at the base lane for now (the remaining parity work in dart_codegen_parity.md
       // upgrades these to a first-class "vo" kind) — a VO IS a json leaf structurally.
       return "json";
     case "scalar":

package/src/value_object.ts

@@ -608,7 +608,7 @@ function describeZod(
 const VO_NAME_RE = /^[A-Za-z][A-Za-z0-9_]*$/;
 
 /**
- * THE VO BRAND (slice A of vo_authoring_end_to_end.md) — `valueObject()` stamps its zod schema
+ * THE VO BRAND (vo_first_class.md) — `valueObject()` stamps its zod schema
  * with the VO's {@link ValueObjectFieldMeta} under this symbol. The property itself is
  * non-enumerable, never serialized and never read by the engine's validation path. When attached
  * to an aggregate field, its canonical descriptor deliberately enters that field's stable value contract.
@@ -1036,7 +1036,7 @@ export const geo = {
 /**
  * Collect the value objects referenced by DIRECTIVE PAYLOADS (top-level fields + array
  * elements), via the {@link NOMOS_VO_BRAND} the schemas carry. CODEGEN-ONLY (slice B of
- * vo_authoring_end_to_end.md): the result feeds the generated Dart/TS surfaces so a
+ * vo_first_class.md): the result feeds the generated Dart/TS surfaces so a
  * payload-only VO still gets its class/interface — it does NOT enter the `nomosValueObjects`
  * IR key (that stays aggregate-derived, keeping package bytes / domainHash untouched).
  */