@githolon/dsl 0.106.0 → 0.107.1

package/src/compile_package_main.ts

@@ -1664,8 +1664,8 @@ const NOMOS_TYPES_DEP = "^0.8.8";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.64.40";
-const NOMOS_FLUTTER_DEP = "^0.63.68";
+const NOMOS_CLIENT_DEP = "^0.64.46";
+const NOMOS_FLUTTER_DEP = "^0.63.75";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).

package/src/framework/capability.ts

@@ -53,7 +53,7 @@
  * (`architecture/capability_credentials.md`).
  */
 import { z } from "zod";
-import { instance } from "../aggregate.js";
+import { instance, type AggregateHandle } from "../aggregate.js";
 import type { Field } from "../fields.js";
 import { set, type PlannedOp } from "../ops.js";
 import { query, type QueryDecl } from "../query.js";
@@ -218,6 +218,17 @@ export function capability<
   /** How many times an overdue-but-still-`requested` obligation may be RE-OPENED in place by
    *  the bounded `reschedule` verb before the next reschedule dead-letters it. Defaults to 5. */
   maxRescheduleAttempts?: number;
+  /**
+   * EXISTENCE PRECONDITIONS on the oblige verb: each entry names a request field carrying a
+   * referenced aggregate id; the oblige REFUSES (typed, kernel-evaluated at every gate) when
+   * that row does not exist, so a typo'd address can never seal an unfulfillable obligation.
+   * `rejectCode` defaults to `"<field>-not-found"`. Era-additive.
+   */
+  requestRefsExist?: ReadonlyArray<{
+    field: keyof Req & string;
+    aggregate: AggregateHandle;
+    rejectCode?: string;
+  }>;
   /**
    * THE ACKNOWLEDGED WAIVER — open this capability's Receipts to any authorised author.
    *
@@ -289,9 +300,15 @@ export function capability<
     // The loop is dynamic (declared field names), so the per-field `set()` typing
     // is asserted — the PUBLIC payload types stay fully inferred from the zod shape.
     writeParams: (taskId, p) =>
-      Object.keys(spec.request).map((k) =>
-        set(instance(taskAggregate, taskId), k as never, (p as Record<string, unknown>)[k] as never),
-      ),
+      Object.keys(spec.request)
+        // ABSENT OPTIONALS ARE SKIPPED, symmetrically with the receipt half below: an optional
+        // request field the caller omitted must author NO op — `undefined` can never be ledger
+        // state, and writing it deterministically halts the author plan (caught live 2026-08-19:
+        // the first tempo-less oblige after the tempo law refused on `estimatedMs`).
+        .filter((k) => (p as Record<string, unknown>)[k] !== undefined)
+        .map((k) =>
+          set(instance(taskAggregate, taskId), k as never, (p as Record<string, unknown>)[k] as never),
+        ),
     // The receipt half, symmetrical with the request half above: declared fields are merged
     // onto the complete envelope as TYPED values and written straight through. The payload
     // boundary has already validated them against the same zod the author declared, so the
@@ -315,6 +332,15 @@ export function capability<
     ...(spec.maxRescheduleAttempts !== undefined
       ? { maxRescheduleAttempts: spec.maxRescheduleAttempts }
       : {}),
+    ...(spec.requestRefsExist !== undefined
+      ? {
+          obligationRefsExist: spec.requestRefsExist.map((pre) => ({
+            aggregate: pre.aggregate,
+            idField: pre.field,
+            rejectCode: pre.rejectCode ?? `${pre.field}-not-found`,
+          })),
+        }
+      : {}),
   });
 
   const camel = pascal[0]!.toLowerCase() + pascal.slice(1);

package/src/framework/domain_lifecycle.ts

@@ -137,7 +137,7 @@ export const DomainInstallation = aggregate("DomainInstallation", {
 }).public();
 
 /**
- * The accepted, exact-history evidence for one activation. This is deliberately an
+ * The accepted current-frontier evidence for one activation. This is deliberately an
  * obscure framework concept: tenant models never author or name it. The generated
  * lifecycle client runs pre-flight and folds this receipt in the SAME intent that
  * activates the candidate, so recording evidence cannot make its own head anchor stale.
@@ -151,18 +151,7 @@ export const ReleaseReceipt = aggregate(RELEASE_RECEIPT_AGGREGATE, {
   domain: t.string().merge(Lww),
   atHash: t.gitObjectId().merge(Lww),
   atStateRoot: t.gitObjectId().merge(Lww),
-  historyHash: t.sha256Digest().merge(Lww),
-  reportHash: t.sha256Digest().merge(Lww),
-  reportJson: t.string().merge(Lww),
-  complete: t.bool(),
   evolveOk: t.bool(),
-  rawPromotable: t.bool(),
-  projectionEqual: t.bool(),
-  replayedIntents: t.int().merge(Lww),
-  candidateIntents: t.int().merge(Lww),
-  divergenceCount: t.int().merge(Lww),
-  baselineRoot: t.sha256Digest().merge(Lww),
-  candidateRoot: t.sha256Digest().merge(Lww),
   acceptanceReason: t.string().merge(Lww).optional(),
   acceptedBy: attributionField(t.string().merge(Lww)),
   acceptedAt: t.int().merge(Lww),
@@ -176,12 +165,12 @@ function domainInstallationInstance(domainHash: Sha256Digest) {
   return instance(DomainInstallation, domainInstallationAggregateId(domainHash));
 }
 
-export function releaseReceiptAggregateId(reportHash: Sha256Digest): string {
-  return `${RELEASE_RECEIPT_PREFIX}${reportHash}`;
+export function releaseReceiptAggregateId(candidateHash: Sha256Digest, atStateRoot: string): string {
+  return `${RELEASE_RECEIPT_PREFIX}${candidateHash}:${atStateRoot}`;
 }
 
-function releaseReceiptInstance(reportHash: Sha256Digest) {
-  return instance(ReleaseReceipt, releaseReceiptAggregateId(reportHash));
+function releaseReceiptInstance(candidateHash: Sha256Digest, atStateRoot: string) {
+  return instance(ReleaseReceipt, releaseReceiptAggregateId(candidateHash, atStateRoot));
 }
 
 const dispositions = z.object({
@@ -198,28 +187,9 @@ const preflightReceipt = z.object({
   domain: z.string().min(1),
   atHash: gitOid,
   atStateRoot: gitOid,
-  historyHash: lowerHex64,
-  reportHash: lowerHex64,
-  reportJson: z.string().min(2),
-  complete: z.literal(true),
   evolveOk: z.literal(true),
-  rawPromotable: z.boolean(),
-  projectionEqual: z.boolean(),
-  replayedIntents: z.number().int().nonnegative(),
-  candidateIntents: z.number().int().nonnegative(),
-  divergenceCount: z.number().int().nonnegative(),
-  baselineRoot: lowerHex64,
-  candidateRoot: lowerHex64,
   acceptanceReason: z.string().trim().min(1).optional(),
-}).superRefine((receipt, ctx) => {
-  if (!receipt.rawPromotable && receipt.acceptanceReason === undefined) {
-    ctx.addIssue({
-      code: z.ZodIssueCode.custom,
-      path: ["acceptanceReason"],
-      message: "a divergent but complete report needs an explicit business acceptance reason",
-    });
-  }
-});
+}).strict();
 
 const installPackagePayload = {
   domainHash: lowerHex64,
@@ -317,7 +287,7 @@ export const promoteDomain = directive(DOMAIN_LIFECYCLE_DIRECTIVES.Promote)
   }))
   .plan((p, ctx): PlannedOp[] => {
     const promoted = domainInstallationInstance(p.domainHash);
-    const receipt = releaseReceiptInstance(p.preflight.reportHash);
+    const receipt = releaseReceiptInstance(p.domainHash, p.preflight.atStateRoot);
     const ops: PlannedOp[] = [
       set(promoted, "status.phase", DomainInstallationPhase.Active),
       set(promoted, "status.observedGeneration", 1),
@@ -326,18 +296,7 @@ export const promoteDomain = directive(DOMAIN_LIFECYCLE_DIRECTIVES.Promote)
       set(receipt, "domain", p.preflight.domain),
       set(receipt, "atHash", p.preflight.atHash),
       set(receipt, "atStateRoot", p.preflight.atStateRoot),
-      set(receipt, "historyHash", p.preflight.historyHash),
-      set(receipt, "reportHash", p.preflight.reportHash),
-      set(receipt, "reportJson", p.preflight.reportJson),
-      set(receipt, "complete", true),
       set(receipt, "evolveOk", true),
-      set(receipt, "rawPromotable", p.preflight.rawPromotable),
-      set(receipt, "projectionEqual", p.preflight.projectionEqual),
-      set(receipt, "replayedIntents", p.preflight.replayedIntents),
-      set(receipt, "candidateIntents", p.preflight.candidateIntents),
-      set(receipt, "divergenceCount", p.preflight.divergenceCount),
-      set(receipt, "baselineRoot", p.preflight.baselineRoot),
-      set(receipt, "candidateRoot", p.preflight.candidateRoot),
       ...(p.preflight.acceptanceReason !== undefined
         ? [set(receipt, "acceptanceReason", p.preflight.acceptanceReason)]
         : []),
@@ -380,7 +339,7 @@ export const rollbackDomain = directive(DOMAIN_LIFECYCLE_DIRECTIVES.Rollback)
   .plan((p, ctx): PlannedOp[] => {
     const candidate = domainInstallationInstance(p.candidateHash);
     const prior = domainInstallationInstance(p.priorHash);
-    const receipt = releaseReceiptInstance(p.preflight.reportHash);
+    const receipt = releaseReceiptInstance(p.priorHash, p.preflight.atStateRoot);
     return [
       set(candidate, "status.phase", DomainInstallationPhase.Disabled),
       set(candidate, "status.supersededBy", p.priorHash),
@@ -391,18 +350,7 @@ export const rollbackDomain = directive(DOMAIN_LIFECYCLE_DIRECTIVES.Rollback)
       set(receipt, "domain", p.preflight.domain),
       set(receipt, "atHash", p.preflight.atHash),
       set(receipt, "atStateRoot", p.preflight.atStateRoot),
-      set(receipt, "historyHash", p.preflight.historyHash),
-      set(receipt, "reportHash", p.preflight.reportHash),
-      set(receipt, "reportJson", p.preflight.reportJson),
-      set(receipt, "complete", true),
       set(receipt, "evolveOk", true),
-      set(receipt, "rawPromotable", p.preflight.rawPromotable),
-      set(receipt, "projectionEqual", p.preflight.projectionEqual),
-      set(receipt, "replayedIntents", p.preflight.replayedIntents),
-      set(receipt, "candidateIntents", p.preflight.candidateIntents),
-      set(receipt, "divergenceCount", p.preflight.divergenceCount),
-      set(receipt, "baselineRoot", p.preflight.baselineRoot),
-      set(receipt, "candidateRoot", p.preflight.candidateRoot),
       ...(p.preflight.acceptanceReason !== undefined
         ? [set(receipt, "acceptanceReason", p.preflight.acceptanceReason)]
         : []),

package/src/framework/governance_relations.ts

@@ -0,0 +1,10 @@
+// NOMOS — canonical framework governance relation identities.
+//
+// These names are global, kernel-coupled vocabulary. Coin them once so DSL
+// sugar cannot accidentally redeclare them as tenant-local relations and cause
+// the compiler to namespace gates away from the framework's founding tuples.
+import { relationRef } from "../relation_schema.js";
+
+/** The global workspace authority seated at `workspace:self#admin`. */
+export const WORKSPACE_ADMIN_RELATION = relationRef("admin");
+

package/src/framework/impure_capability.ts

@@ -160,6 +160,13 @@ export const IMPURE_CAPABILITY_ENVELOPE = {
   // (read as 0); making it required would break decode of every pre-existing task AND the era
   // rule (old chains fold no `attempts`). Judged against `maxRescheduleAttempts` to bound retries.
   attempts: t.int().merge(Lww).optional(),
+  // TEMPO LIMIT-BREACH facts (OPTIONAL — era-safe): stamped by the bounded `reschedule` verb
+  // when the drum judges a still-`requested` task past its DECLARED `limitMs` (a tenant request
+  // field, when the capability declares one). Lww-last is enough for the projection — every
+  // stamp is an ordinary Intent in the chain, so the full breach history stays auditable.
+  // Limits are law; ESTIMATE breaches are read-side telemetry and never fold here.
+  limitBreachedAt: t.int().merge(Lww).optional(),
+  limitBreachElapsedMs: t.int().merge(Lww).optional(),
   // The FRAMEWORK Obligation↔Receipt CLOSURE link (OPTIONAL): the id of the Obligation this
   // RECEIPT closes (== the task's own requestId — the reactor mutates the task instance).
   // GENERIC, written by every impureCapability Receipt (complete OR fail), so the read
@@ -411,7 +418,14 @@ export function deadLetterOps(
  */
 export function rescheduleOps(
   aggregateId: string,
-  p: { requestId: string; scheduledAt: number; deadlineAt: number; attempts: number },
+  p: {
+    requestId: string;
+    scheduledAt: number;
+    deadlineAt: number;
+    attempts: number;
+    /** Present iff this re-open was forced by a DECLARED-LIMIT breach (not the deadline). */
+    limitBreach?: { at: number; elapsedMs: number };
+  },
 ): PlannedOp[] {
   const taskInstance = envelopeInstance(aggregateId, p.requestId);
   return [
@@ -420,6 +434,12 @@ export function rescheduleOps(
     set(taskInstance, "attempts", p.attempts),
     // KEEP status:'requested' — re-opening a non-terminal task, never a terminal transition.
     set(taskInstance, "status", "requested"),
+    ...(p.limitBreach !== undefined
+      ? [
+          set(taskInstance, "limitBreachedAt", p.limitBreach.at),
+          set(taskInstance, "limitBreachElapsedMs", p.limitBreach.elapsedMs),
+        ]
+      : []),
   ];
 }
 
@@ -591,6 +611,19 @@ export function impureCapability<
   /** How many times an overdue-but-still-`requested` obligation may be RE-OPENED in place by
    *  `reschedule` before the next reschedule dead-letters it instead. Defaults to 5. */
   maxRescheduleAttempts?: number;
+  /**
+   * OPTIONAL EXISTENCE PRECONDITIONS on the Obligation verb (kernel-lowered point guards):
+   * each entry refuses the oblige when the row the named request field references is ABSENT,
+   * so a typo'd address can never seal an unfulfillable obligation that only surfaces as
+   * tempo-breach noise later. Era-additive — declaring nothing changes nothing on the wire.
+   */
+  obligationRefsExist?: ReadonlyArray<{
+    aggregate: AggregateHandle;
+    /** The obligation request field carrying the referenced aggregate's id. */
+    idField: string;
+    /** The typed refusal code (e.g. `"delivery-product-not-found"`). */
+    rejectCode: string;
+  }>;
 }): ImpureCapability<Id, ParamsShape, F, ReceiptShape> {
   const taskAggregate = impureCapabilityAggregate(spec.aggregateId, spec.params);
   const obligationPayload = z.object(spec.paramsSchema);
@@ -626,12 +659,25 @@ export function impureCapability<
     .returns(taskAggregate);
   const maxRescheduleAttempts = spec.maxRescheduleAttempts ?? 5;
 
-  const obligation: RequirableDirective<ObligationPayload<ParamsShape>> = directive(
+  let obligationBuilder = directive(
     spec.obligationDirectiveId,
   )
     .creates(taskAggregate)
-    .payload(obligationPayload)
-    .plan((p, ctx) => {
+    .payload(obligationPayload);
+  // THE EXISTENCE FENCE (CO2-1624): refuse an oblige whose request references a row that does
+  // not exist. Chained BEFORE `.plan` so each guard lowers into the manifest as a typed point
+  // precondition the kernel evaluates at every gate — author, edge admission, verify_chain.
+  for (const pre of spec.obligationRefsExist ?? []) {
+    obligationBuilder = obligationBuilder.precondition(
+      pre.aggregate,
+      ({ row, intent }) => ({
+        id: intent.field(pre.idField as never) as never,
+        holds: row.exists(),
+      }),
+      pre.rejectCode,
+    );
+  }
+  const obligationDirective = obligationBuilder.plan((p, ctx) => {
       // The caller supplies BUSINESS PARAMS only. Nomos owns the task identity,
       // provenance and lifecycle clock so generated clients cannot accidentally
       // spoof or hand-roll the obligation envelope.
@@ -654,6 +700,7 @@ export function impureCapability<
         .set("status", "requested");
       return spec.writeParams(impureCapabilityInstanceId(requestId), params);
     });
+  const obligation = obligationDirective as RequirableDirective<ObligationPayload<ParamsShape>>;
 
   // The two branches above are distinct object schemas; the declared payload TYPE is the
   // `CompletePayload<ReceiptShape>` conditional, so name it once here rather than leaking a
@@ -696,7 +743,7 @@ export function impureCapability<
   // outcomes, mirroring the consequent-outbox cap discipline (never touch a terminal task; only
   // re-open genuinely-overdue work; dead-letter once the retry budget is exhausted):
   //   1. status !== "requested"          → NO-OP (never mutate a terminal task).
-  //   2. now <= deadlineAt               → NO-OP (not overdue yet).
+  //   2. now <= deadlineAt AND no declared-limit breach → NO-OP (not overdue yet).
   //   3. overdue & attempts < cap        → RE-OPEN in place (rescheduleOps): fresh window +
   //                                        attempts+1, KEEP status:'requested' (kernel-legal —
   //                                        a still-`requested` task is non-terminal).
@@ -723,23 +770,36 @@ export function impureCapability<
       // (1) NEVER touch a terminal task — only `requested` is non-terminal.
       if (status !== "requested") return [];
       const deadlineAt = Number(data?.deadlineAt ?? 0);
-      // (2) Not overdue yet — the deterministic clock has not passed the committed deadline.
-      if (now <= deadlineAt) return [];
+      // THE DECLARED-LIMIT JUDGMENT (tempo): a capability whose request declares `limitMs`
+      // folds it onto this same task row, and elapsed time past that limit is judged exactly
+      // like overdue-ness — in-law, from the deterministic captured clock, against the task's
+      // own committed `scheduledAt`. Absent `limitMs` (legacy work) ≡ no limit — era-safe.
+      const limitMsRaw = data?.limitMs;
+      const limitMs = typeof limitMsRaw === "number" && limitMsRaw >= 0 ? limitMsRaw : undefined;
+      const scheduledAt = Number(data?.scheduledAt ?? 0);
+      const elapsedMs = now - scheduledAt;
+      const pastLimit = limitMs !== undefined && scheduledAt > 0 && elapsedMs > limitMs;
+      // (2) Neither past the committed deadline NOR past the declared limit — no-op.
+      if (now <= deadlineAt && !pastLimit) return [];
       const attempts = Number(data?.attempts ?? 0);
       // (4) Overdue AND the retry budget is exhausted → terminal dead-letter (reuse deadLetterOps).
       if (attempts >= maxRescheduleAttempts) {
         return deadLetterOps(spec.aggregateId, {
           requestId: p.requestId,
-          deadLetterReason: `overdue: exhausted ${maxRescheduleAttempts} reschedule attempts`,
+          deadLetterReason: pastLimit
+            ? `overdue: exhausted ${maxRescheduleAttempts} reschedule attempts (declared limit ${limitMs}ms breached; elapsed ${elapsedMs}ms)`
+            : `overdue: exhausted ${maxRescheduleAttempts} reschedule attempts`,
           deadLetteredAt: now,
         });
       }
-      // (3) Overdue but under the cap → RE-OPEN in place with a fresh window + bumped attempts.
+      // (3) Overdue (or limit-breached) but under the cap → RE-OPEN in place with a fresh
+      // window + bumped attempts; a limit breach additionally stamps the breach fact.
       return rescheduleOps(spec.aggregateId, {
         requestId: p.requestId,
         scheduledAt: now + (spec.scheduleAfterMs ?? 0),
         deadlineAt: now + (spec.deadlineAfterMs ?? 24 * 60 * 60 * 1000),
         attempts: attempts + 1,
+        ...(pastLimit ? { limitBreach: { at: now, elapsedMs } } : {}),
       });
     })
     .reads(taskById);

package/src/framework/workspaces.ts

@@ -77,6 +77,7 @@ import { read } from "../read.js";
 import { readRef, readSet, workspaceInvariant, refAs, type WorkspaceInvariantVerdict } from "./workspace_invariant.js";
 import { writeTuple, removeTuple, RelationTuple, relationTupleInstanceId } from "./relations.js";
 import { relationType, self, user, key } from "../relation_schema.js";
+import { WORKSPACE_ADMIN_RELATION } from "./governance_relations.js";
 import { GENESIS_WARRANT_ID } from "./genesis.js";
 import { idOf } from "../value_object.js";
 import { enrollSigner, signerObject, SIGNER_RELATION } from "./signing_identity.js";
@@ -191,7 +192,7 @@ export const workspaceRelations = relationType("workspace")
   // migration. (A TENANT that wants a workspace-scoped role uses a namespaced `relationType("workspace")`
   // + a `selfWorkspace()` seed; only THIS framework governance type is global.)
   .asGlobal()
-  .relation("admin", { rewrite: self(), allow: [user(), key()] })
+  .relation(WORKSPACE_ADMIN_RELATION, { rewrite: self(), allow: [user(), key()] })
   .relation("creator", { rewrite: self(), allow: [user(), key()] })
   .relation("platformCreator", { rewrite: self(), allow: [user(), key()] });
 

package/src/role.ts

@@ -14,8 +14,9 @@
  *      `relationType("workspace")` block (the fail-open footgun is CLOSED — a `.requires(role.edit)`
  *      always finds a declared relation), and the `<role>View` relation is a READ-VISIBILITY cap
  *      (used as an aggregate `requires(role.view)` — usd.ts synthesizes the global workspace read
- *      relation, exactly as any private aggregate does). The grant-authority relation (`grantableBy`,
- *      default `admin`) is likewise authored into the schema so the gate on the grant directive has teeth.
+ *      relation, exactly as any private aggregate does). A custom grant-authority relation is likewise
+ *      authored locally. The default `admin` instead refers to the framework's existing GLOBAL
+ *      `workspace:self#admin`; redeclaring it locally would namespace the gate away from its founding tuple.
  *
  *   2. GRANT / SEED DIRECTIVES per role — `grant<Role>` / `revoke<Role>` fold the relation TUPLE via
  *      the existing `writeTuple`/`removeTuple` primitives (a grant seats `<role>Edit` + `<role>View`
@@ -41,6 +42,7 @@ import type { AggregateHandle } from "./aggregate.js";
 import type { Directive, RequirableDirective } from "./directive.js";
 import { directive } from "./directive.js";
 import { RelationTuple, writeTuple, removeTuple } from "./framework/relations.js";
+import { WORKSPACE_ADMIN_RELATION } from "./framework/governance_relations.js";
 import { relationType, self, user, key, type RelationTypeDecl } from "./relation_schema.js";
 
 /** A role name: kebab-case (`editor`, `site-admin`) — lowered to relation/directive labels. */
@@ -234,7 +236,7 @@ export function role(name: string): RoleBuilder {
     name,
     editRelation: `${base}Edit`,
     viewRelation: `${base}View`,
-    grantableBy: "admin",
+    grantableBy: WORKSPACE_ADMIN_RELATION,
     editAggregates: [],
     viewAggregates: [],
     canEdit: false,
@@ -256,8 +258,10 @@ const ROLE_RELATIONS_KEY = "__nomosRoleRelations";
  * EXPANDER (the `capability()`/birth-meter seam): given a module's exports bag, LIFT every `RoleEmission`
  * into discoverable entries — the grant/revoke/seed directives become top-level exports (so `directivesOf`
  * finds them), and ONE synthesized `relationType("workspace")` (the `<role>Edit` write relations + the
- * distinct `grantableBy` grant-authority relations, deduped) becomes a discoverable relation type (so
- * `.requires(role.edit)` / `.requires(grantableBy)` have TEETH — the fail-open footgun is closed). The
+ * distinct LOCAL `grantableBy` grant-authority relations, deduped) becomes a discoverable relation type
+ * (so `.requires(role.edit)` / `.requires(customGrantAuthority)` have TEETH — the fail-open footgun is
+ * closed). The default framework `admin` authority is already declared by the global governance schema
+ * and MUST NOT be redeclared here as tenant-local. The
  * `<role>View` read relations are NOT authored here: they are read-visibility caps, synthesized by usd.ts
  * from the aggregates that declare `requires(role.view)`. IDEMPOTENT + additive: a bag with no role is
  * returned unchanged (byte-identical), and re-running on an already-expanded bag is a no-op.
@@ -281,12 +285,14 @@ export function expandRoleExports(mod: Record<string, unknown>): Record<string,
   };
   for (const e of emissions) {
     if (e.meta.editRelation) declare(e.meta.editRelation);
-    declare(e.meta.grantableBy);
+    if (e.meta.grantableBy !== WORKSPACE_ADMIN_RELATION) declare(e.meta.grantableBy);
     for (const dir of e.directives) {
       const anyDir = dir as { id: string };
       out[`__role_${anyDir.id}`] = dir;
     }
   }
-  out[ROLE_RELATIONS_KEY] = builder as unknown as RelationTypeDecl;
+  // Keep the marker even for a view-only role using global admin so expansion stays idempotent without
+  // publishing an empty relation schema declaration.
+  out[ROLE_RELATIONS_KEY] = declared.size > 0 ? builder as unknown as RelationTypeDecl : true;
   return out;
 }