@githolon/dsl 0.108.7 → 0.110.0

package/src/compile_package_main.ts

@@ -1,3 +1,4 @@
+import type { Directive } from "./directive.js";
 // NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
 // remotes are replaceable custody/transport, not truth.  ⇒ ONE Nomos GitHolon
 // wasm32-wasip1 artifact {kernel · projection · embedded
@@ -30,6 +31,7 @@
  * It emits into `outDir` (default `<config dir>/build`):
  *   * `<name>.law/`                     — the exact logically named, human-readable USDA stage.
  *   * `<name>.law.usdz`                — a lossless transport archive of that closure.
+ *   * `<name>.compatibility.usda`       — the generated application's opaque interface requirement.
  *   * `<name>.proof.mts`               — the GENERATED PROOF (codegen_proof.ts): a
  *     runnable, domain-shaped live e2e synthesized from the law's own directives /
  *     queries / counts. Run it with `githolon proof`. Never fatal: an unsampleable
@@ -41,8 +43,18 @@
  * --platform=neutral --charset=utf8`, no minify), and refused if it does not assign
  * `globalThis.plan`.
  */
-import { execFileSync } from "node:child_process";
+import { execFile, execFileSync } from "node:child_process";
+import { promisify } from "node:util";
+import { checkOperationContracts } from "./operation_contract_check.js";
+import {
+  APPLICATION_CONTRACT_MODULE,
+  assertGeneratedClientBundleBoundary,
+  protobufPackageRoot,
+} from "./generated_client_bundle_boundary.js";
 import { createHash } from "node:crypto";
+import { tmpdir } from "node:os";
+import { inspectSqliteLayouts } from "./sqlite_layout.js";
+import { sqliteDescriptorSamples } from "./sqlite_samples.js";
 import {
   expandCapabilityExports,
   isCapabilityDecl,
@@ -51,8 +63,10 @@ import {
   copyFileSync,
   existsSync,
   mkdirSync,
+  mkdtempSync,
   readdirSync,
   readFileSync,
+  realpathSync,
   renameSync,
   rmSync,
   writeFileSync,
@@ -82,13 +96,21 @@ import {
 } from "./evolution_files.js";
 import { assertEvolutionModuleExports } from "./evolution.js";
 import { readHistoricalIdentityFrontier } from "./identity_frontier.js";
-import { generateDartBridgeClient } from "./codegen_dart_client.js";
-import { generateDartApplicationFrameworkCalls } from "./codegen_dart_framework_calls.js";
+import {
+  dartBridgeClientOperationDirectiveIds,
+  generateDartDomainClient,
+} from "./codegen_dart_client.js";
+import {
+  dartFrameworkOperationDirectiveIds,
+  generateDartApplicationFrameworkCalls,
+} from "./codegen_dart_framework_calls.js";
+import { fixedFrameworkCallDefinitions } from "./framework_call_definitions.js";
+import { BUSINESS_CORRECTION_DIRECTIVE } from "./framework/business_corrections.js";
 import {
   dartApplicationClassName,
   dartApplicationPublicClassNames,
   generateDartApplication,
-} from "./codegen_dart_application.js";
+} from "./codegen_dart_facade.js";
 import {
   dartScenarioGivenClassName,
   dartScenarioClassName,
@@ -110,6 +132,7 @@ import {
 import { isNamespacedAggregate } from "./read_projection_namespace.js";
 import {
   collectPayloadValueObjectDescriptors,
+  collectSchemaValueObjectDescriptors,
   collectValueObjectDescriptors,
 } from "./value_object.js";
 import { finishCount, type AnyCount } from "./count.js";
@@ -137,13 +160,22 @@ import {
   bindBusinessBirthPolicyDomains,
   expandBusinessBirthExports,
 } from "./business_birth.js";
-import { withOwnedCustodyExports } from "./framework/owned_custody.js";
+import {
+  OWNED_DEVICE_APPROVAL_DIRECTIVE,
+  OWNED_INITIALIZE_DIRECTIVE,
+  OWNED_RECOVERY_ACCEPT_DIRECTIVE,
+  OWNED_RECOVERY_COMPLETE_DIRECTIVE,
+  OWNED_RECOVERY_PROTECT_DIRECTIVE,
+  OWNED_RECOVERY_REQUEST_DIRECTIVE,
+  withOwnedCustodyExports,
+} from "./framework/owned_custody.js";
 import {
   OwnedCustodyValue,
   OwnedDeviceRequestValue,
 } from "./framework/owned_custody_value.js";
 import { expandRoleExports, rolesOf } from "./role.js";
 import { collectEngineRouting } from "./engine_entry.js";
+import { sqliteComputationBundle } from "./sqlite_computation_bundle.js";
 import {
   canonicalizeEngineJavascript,
   canonicalizeGeneratedClientJavascript,
@@ -154,6 +186,9 @@ import {
   isQueryDecl,
   isSpatialDecl,
   isSumDecl,
+  isExtremumDecl,
+  isExistsDecl,
+  isOrderedReadDecl,
   isWorkspaceInvariantDecl,
   type DeclBag,
 } from "./decl_shapes.js";
@@ -170,6 +205,8 @@ import {
   type ShardingLawSpec,
 } from "./workspace_sharding.js";
 import { finishExtremum, type AnyExtremum } from "./extremum.js";
+import { finishExists, type AnyExists } from "./exists.js";
+import type { OrderedReadDecl } from "./ordered_read.js";
 import type { WorkspaceInvariantDecl } from "./framework/workspace_invariant.js";
 import {
   discoverRelationTypeDeclarations,
@@ -197,6 +234,8 @@ import {
 import { reconcileStableIdsWithIdentity } from "./stable_id_identity_bridge.js";
 import { LAW_FRAMEWORK_PARENT } from "./law_identity.js";
 import { discoverLawGraph, type LawGraph } from "./law_graph.js";
+import { LawDependencyIndex, commandWorkingSetReport } from "./law_dependency_index.js";
+import { generateDartWorkspaceAccessRead } from "./codegen_workspace_access.js";
 import {
   compileSparseLawGraphUsda,
   emitFrameworkLawUsda,
@@ -207,7 +246,6 @@ import {
 } from "./dart_barrel_guard.js";
 import {
   generateTsClient,
-  generateTsLifecycleOperator,
   tsApplicationName,
   tsClientFactoryName,
   recursiveLazyTypes,
@@ -216,25 +254,54 @@ import {
   generateOpenApiFragment,
   mergeOpenApiFragments,
 } from "./codegen_openapi.js";
-import { domainInterface, type DomainInterface } from "./shape_compat.js";
-import { generateTsProof, proofLegsIndex } from "./codegen_proof.js";
+import {
+  domainInterfaceFromLawGraph,
+  publicClientInterface,
+  type DomainInterface,
+} from "./compatibility_graph.js";
+import { proofLegsIndex } from "./codegen_proof.js";
 import { usdzPack } from "./usdz.js";
+import {
+  LAW_UNIT_MANIFEST,
+  assertLawUnitsCoverPackage,
+  lawUnitDirectoryName,
+  packageRoutesLayerUsda,
+  splitLawUnits,
+} from "./law_units.js";
 import { checkDomainModules, formatFindings, hasRefusal } from "./law_check.js";
 import {
   currentEvolveLaw,
   evolveDiff,
   evolveLawFromLockfile,
 } from "./evolve_preview.js";
-import type { NomosCompat } from "./compat_manifest.js";
 import {
   requiredKernelContracts,
   type KernelContractProbeModule,
 } from "./kernel_capabilities.js";
 import { APPLICATION_HOME_DOMAIN } from "./framework/application_home_domain.js";
 import { applicationHomePolicyLaw } from "./framework/application_home.js";
+import * as childAuthenticationModule from "./framework/child_authentication.js";
+import * as receivingGroupRecoveryModule from "./framework/receiving_group_recovery.js";
+import * as modelTransitionModule from "./framework/model_transition.js";
+import * as modelAuthorityRepairModule from "./framework/model_authority_repair.js";
+import { SEAT_INHERITED_MODEL_AUTHORITY_ID } from "./framework/model_authority_seed.js";
 import { isApplicationHomeGenesis } from "./application_home_genesis.js";
 import { resolveApplicationTopology } from "./application_topology.js";
-import { isBusinessIntent } from "./intent.js";
+import {
+  isCustodyPlacementDeclaration,
+  type CustodyPlacementDeclaration,
+} from "./custody_placement.js";
+import {
+  custodyPlacementDeclarationsUsda,
+  type DomainCustodyPlacement,
+} from "./custody_placement_usda.js";
+import { isApplicationLanguage, isBusinessIntent } from "./intent.js";
+import {
+  emitTsCallProtoEncoder,
+  generateOperationProtoSchema,
+  type OperationProtoLaw,
+  TS_CALL_PROTO_PRELUDE,
+} from "./codegen_call_proto.js";
 import {
   emitTsCallUsdaEncoder,
   TS_CALL_USDA_PRELUDE,
@@ -266,6 +333,11 @@ import {
   PlanSourceSliceProgram,
   type PlanSourceSliceTarget,
 } from "./plan_source_slice.js";
+import {
+  encodeOpenUsdUsdc,
+  flattenOpenUsdToUsda,
+} from "./openusd_compiled_layer.js";
+import { emitApplicationCompatibilityUsda } from "./compatibility_usda.js";
 
 const DSL_DIR = path.resolve(
   path.dirname(fileURLToPath(import.meta.url)),
@@ -293,7 +365,7 @@ const BUSINESS_BIRTH_FRAMEWORK_PLAN_SOURCES: Readonly<
     exportName: "seedAuthProvider",
   },
   seedBirthAttestation: {
-    modulePath: path.join(DSL_DIR, "src", "framework", "home.ts"),
+    modulePath: path.join(DSL_DIR, "src", "framework", "receiving_group.ts"),
     exportName: "seedBirthAttestation",
   },
   seedGenesis: {
@@ -304,8 +376,47 @@ const BUSINESS_BIRTH_FRAMEWORK_PLAN_SOURCES: Readonly<
     modulePath: path.join(DSL_DIR, "src", "birth_meter_ensure.ts"),
     exportName: "nomosBirthRecordEnsure",
   },
+  // MODEL AUTHORITY DESCENDS (architecture/parent_directed_model_transition.md, lane A): the child-genesis
+  // seed every framework birth embeds; its plan closure is the seed module, never the whole tenant domain.
+  [SEAT_INHERITED_MODEL_AUTHORITY_ID]: {
+    modulePath: path.join(DSL_DIR, "src", "framework", "model_authority_seed.ts"),
+    exportName: "seatInheritedModelAuthority",
+  },
 };
 const BUSINESS_BIRTH_FRAMEWORK_PLAN_DOMAIN = "__nomos_birth_genesis_plan_v1";
+/** The framework child-authentication law composed into the application-home domain; its members are
+ * module-level exports so plan slicing and workspace-effect target encoders resolve them by name. */
+const CHILD_AUTHENTICATION_MODULE_PATH = path.join(
+  DSL_DIR,
+  "src",
+  "framework",
+  "child_authentication.ts"
+);
+/** The framework receiving-group recovery door (composed only when the package declares the
+ * `platform-identity-provider` posture); its members are module-level singletons for the same reason. */
+const RECEIVING_GROUP_RECOVERY_MODULE_PATH = path.join(
+  DSL_DIR,
+  "src",
+  "framework",
+  "receiving_group_recovery.ts"
+);
+/** The framework parent-directed model transition (the platform's direction + the child's attested-parent
+ * acceptor, composed whenever the package births children); module-level singletons for the same reason. */
+const MODEL_TRANSITION_MODULE_PATH = path.join(
+  DSL_DIR,
+  "src",
+  "framework",
+  "model_transition.ts"
+);
+/** The framework model-authority self-heal (the child's ask, the parent's serve and the child's
+ * attested-parent acceptor, composed whenever the package births children); module-level singletons so
+ * plan slicing and workspace-effect target encoders resolve them by name. */
+const MODEL_AUTHORITY_REPAIR_MODULE_PATH = path.join(
+  DSL_DIR,
+  "src",
+  "framework",
+  "model_authority_repair.ts"
+);
 
 interface DomainConfig extends NormalizedNomosPackageDomainConfig {
   readonly key: string;
@@ -316,9 +427,11 @@ interface DomainConfig extends NormalizedNomosPackageDomainConfig {
   readonly counts?: readonly string[];
   /** Escape hatch only since #57 — exported SumDecls auto-discover like queries/counts. */
   readonly sums?: readonly string[];
-  /** Maintained MIN/MAX reads (#47) — export names (config-named; not yet auto-discovered). */
+  /** Maintained MIN/MAX export-name escape hatches; exported declarations auto-discover. */
   readonly mins?: readonly string[];
   readonly maxes?: readonly string[];
+  readonly exists_?: readonly string[];
+  readonly orderedReads?: readonly string[];
   readonly spatials?: readonly string[];
   readonly deriveds?: readonly string[];
   readonly combineds?: readonly string[];
@@ -349,7 +462,7 @@ interface DomainConfig extends NormalizedNomosPackageDomainConfig {
   };
 }
 
-type DartSupportImport = "vendored" | "package";
+type DartSupportImport = "package";
 
 interface PackageConfig extends NomosPackageConfig {
   readonly domains: readonly DomainConfig[];
@@ -362,14 +475,13 @@ interface PackageConfig extends NomosPackageConfig {
    * Typed DART frontend (the Flutter sibling of the generated TS client; #codegen_dart).
    * `false`/absent = skip (default). `true` = emit into `<outDir>/dart/`;
    * `{ out: "relative/dir" }` = emit there (resolved against the config dir).
-   * `{ support: "package" }` keeps the framework-internal runtime import for generated Flutter applications that
-   * already depend on `nomos_client`/`nomos_flutter`. The default `"vendored"` mode preserves the old
-   * self-contained directory.
+   * Generated Flutter applications import the fixed `nomos_types` and
+   * `nomos_client` packages. Runtime implementation is never copied into a
+   * generated domain package.
    * Per composed domain one `<name>.dart` (payload classes + read models + typed read
    * accessors via the SAME `generateDartDomain` the co2 tenant emit uses), PLUS the
-   * framework `nomos_client` Dart support files vendored alongside (the generated files'
-   * `package:nomos_client/...` import is rewritten to a relative one) — so a Flutter app
-   * can vendor the directory as-is, no pub deps.
+   * A generated directory contains only domain stationery, value types,
+   * stateless facades and its compatibility matrix.
    */
   readonly dart?:
     | boolean
@@ -388,16 +500,16 @@ interface PackageConfig extends NomosPackageConfig {
          * produces THREE sibling pub packages under `out` instead of one flat tree:
          *   • `types`  — pure data (payload classes, read models, VOs/enums, typed accessors over
          *     the injected NomosReads seams, the aggregate-meta registry). Depends ONLY on the
-         *     pure `nomos_types` core — frontend-safe: no bridge, no sessions, no lifecycle.
+         *     pure `nomos_types` core — frontend-safe: no session, no sessions, no lifecycle.
          *   • `client` — the effectful runtime clients (`<name>.client.dart`, offer methods over
-         *     NomosBridge). Depends on the types package + `nomos_client`.
+         *     NomosSession). Depends on the types package + `nomos_client`.
          *   • `test`   — optional; generated business scenarios for widget/integration tests.
          * The layering line: UI code depends on `types`; composition/runtime code on `client`;
          * generated TYPES may flow to the UI, generated CLIENTS may not.
          * Each package's `pubspec.yaml` keeps tenant-owned versioning/publishing metadata and custom
          * dependencies; Nomos-owned framework dependency floors are reconciled on every compile.
          * Barrels + `lib/src/generated/` are generated-owned and rewritten every compile.
-         * Requires `support: "package"` (vendored mode contradicts pub-package layering).
+         * Uses the fixed runtime packages; generated code never vendors lifecycle machinery.
          */
         readonly packages?: {
           readonly types: string;
@@ -445,6 +557,8 @@ interface PackageConfig extends NomosPackageConfig {
   readonly compact?: boolean;
 }
 
+const execFileAsync = promisify(execFile);
+
 function fail(msg: string): never {
   console.error(`nomos-compile: ${msg}`);
   process.exit(1);
@@ -456,6 +570,12 @@ interface EmittedLawClosureAsset {
   readonly utf8: string;
 }
 
+interface EmittedBinaryLawClosureAsset {
+  readonly logicalPath: string;
+  readonly sha256: string;
+  readonly bytes: Uint8Array;
+}
+
 interface UsdPlanAsset {
   readonly sha256: string;
   readonly javascript: string;
@@ -491,6 +611,15 @@ interface EmittedLawClosure {
   }[];
 }
 
+/** Match Rust's `BTreeMap<String, _>` ordering for authenticated logical paths.
+ * `localeCompare` is collation, not byte ordering: for example it places
+ * `catalogue_directory.usda` before `catalogue.usda`, which gives the compiler
+ * and kernel different closure identities for the same package. Logical paths
+ * are restricted to ASCII by the kernel, so ordinary string comparison is the
+ * exact shared ordering here. */
+const compareLogicalPath = (left: string, right: string): number =>
+  left < right ? -1 : left > right ? 1 : 0;
+
 /** Build the production-shaped v3 stage entirely from compiler-authored bytes. The deploy host may
  * shuttle this object, but it cannot select layers, compose opinions or mint any identity: the kernel
  * inventories the USDZ/Git tree and re-hashes every logically named layer. */
@@ -501,7 +630,11 @@ function emitLawClosure(
   domainAssets: readonly EmittedLawClosureAsset[],
   runtime: UsdRuntimeAsset,
   plans: readonly UsdPlanAsset[],
-  routes: readonly UsdPlanRoute[]
+  routes: readonly UsdPlanRoute[],
+  derivedAssets: readonly (
+    | EmittedLawClosureAsset
+    | EmittedBinaryLawClosureAsset
+  )[] = []
 ): EmittedLawClosure {
   const planByHash = new Map(plans.map((plan) => [plan.sha256, plan] as const));
   if (sha256HexUtf8(runtime.javascript) !== runtime.sha256) {
@@ -517,44 +650,13 @@ function emitLawClosure(
     }
   }
   const contentAsset = (sha256: string): string => `@nomos+sha256:${sha256}@`;
-  const routeOpinions: string[] = [
-    "#usda 1.0",
-    "(",
-    "    customLayerData = {",
-    '        string "nomos:format" = "nomos.law-layer.v3"',
-    '        string "nomos:logicalPath" = "runtime/routes"',
-    "    }",
-    ")",
-    "",
-    'def Scope "__NomosRuntime_7e9c"',
-    "{",
-    '    custom string nomos:kind = "runtime"',
-    '    custom string nomos:format = "nomos.openusd-plan-metadata.v3"',
-    "",
-    '    def Scope "Routes"',
-    "    {",
-  ];
-  [...routes]
-    .sort((left, right) => left.selector.localeCompare(right.selector))
-    .forEach((route, index) => {
-      if (!planByHash.has(route.planSha256)) {
-        fail(
-          `v3 closure: route '${route.selector}' names missing plan '${route.planSha256}'`
-        );
-      }
-      routeOpinions.push(
-        `        def Scope "r${String(index).padStart(6, "0")}"`,
-        "        {",
-        `            custom string nomos:selector = ${JSON.stringify(
-          route.selector
-        )}`,
-        `            custom string nomos:plan = "${route.planSha256}"`,
-        "        }",
-        ""
+  for (const route of routes) {
+    if (!planByHash.has(route.planSha256)) {
+      fail(
+        `v3 closure: route '${route.selector}' names missing plan '${route.planSha256}'`
       );
-    });
-  if (routeOpinions[routeOpinions.length - 1] === "") routeOpinions.pop();
-  routeOpinions.push("    }", "}", "");
+    }
+  }
 
   const textAsset = (
     logicalPath: string,
@@ -573,7 +675,7 @@ function emitLawClosure(
       runtimeDependencies,
     })
   );
-  const routeLayer = textAsset("runtime/routes.usda", routeOpinions.join("\n"));
+  const routeLayer = textAsset("runtime/routes.usda", packageRoutesLayerUsda(routes));
   const runtimeSource = textAsset(
     `runtime/bases/${runtime.sha256}.mjs`,
     runtime.javascript
@@ -658,9 +760,26 @@ function emitLawClosure(
     ...domainAssets,
     framework,
   ]);
-  const custodyAssets = [...sublayers, runtimeSource, ...planSources].sort(
-    (left, right) => left.logicalPath.localeCompare(right.logicalPath)
+  // Derived assets are compiler-produced, authenticated finished goods. They are deliberately
+  // inventoried by the closure without becoming sublayers of the authoritative source stage.
+  // In particular, the runtime read projection is an OpenUSD flatten of a population-masked
+  // source stage: composing it back into that stage would duplicate every read opinion. Its USDA
+  // source remains relationship-checked; the mechanically equivalent USDC cache is binary OpenUSD.
+  assertUsdaRelationshipIntegrity(
+    derivedAssets.filter(
+      (asset): asset is EmittedLawClosureAsset => "utf8" in asset
+    ),
+    // Standard OpenUSD population masks do not pull relationship targets into the stage. The read
+    // engine consumes authored storage kinds and exact ref/field paths; nominal value-type prims
+    // remain in the full authenticated law and are intentionally absent from this acceleration view.
+    { allowMissingRelationships: new Set(["nomos:type", "nomos:returns"]) }
   );
+  const custodyAssets = [
+    ...sublayers,
+    runtimeSource,
+    ...planSources,
+    ...derivedAssets,
+  ].sort((left, right) => compareLogicalPath(left.logicalPath, right.logicalPath));
   const root = textAsset(
     "root.usda",
     [
@@ -704,7 +823,7 @@ function emitLawClosure(
     ].join("\n")
   );
   const assets = [root, ...custodyAssets].sort((left, right) =>
-    left.logicalPath.localeCompare(right.logicalPath)
+    compareLogicalPath(left.logicalPath, right.logicalPath)
   );
   const identity = createHash("sha256");
   identity.update("nomos-law-stage-v3\0");
@@ -719,10 +838,11 @@ function emitLawClosure(
   return {
     rootLogicalPath: "root.usda",
     identity: identity.digest("hex"),
-    assets: assets.map(({ logicalPath, sha256, utf8 }) => ({
-      logicalPath,
-      sha256,
-      bytes: new TextEncoder().encode(utf8),
+    assets: assets.map((asset) => ({
+      logicalPath: asset.logicalPath,
+      sha256: asset.sha256,
+      bytes:
+        "bytes" in asset ? asset.bytes : new TextEncoder().encode(asset.utf8),
     })),
   };
 }
@@ -990,142 +1110,34 @@ function resolveNamed<T>(
  * self-contained (no pub path-dependency on the framework package).
  */
 const DART_PACKAGE_IMPORT = `import 'package:nomos_client/src/nms_generated_runtime.dart';`;
-const DART_RELATIVE_IMPORT = `import 'nomos_client.dart';`;
 
-/**
- * The framework `nomos_client` Dart support files the generated code resolves through
- * the barrel (`dsl/dart/lib/`). `schema_validation.dart` is deliberately NOT
- * vendored: nothing the codegen emits references it, and it would drag the external
- * `json_schema` pub dependency into every vendoring app.
- */
-// The PURE CORE support files, vendored from the `nomos_types` package (dsl/dart_types/lib/src —
-// the layered split: wire types, offer codec, NomosReads, aggregate meta, error info). Zero
-// external pub deps. `schema_validation.dart` is deliberately NOT vendored: nothing the codegen
-// emits references it, and it would drag the external `json_schema` pub dependency into every
-// vendoring app.
-const DART_SUPPORT_CORE_SRC = [
+// Only used to delete output produced by the retired self-contained runtime generator.
+const LEGACY_VENDORED_DART_SUPPORT = [
   "wire.dart",
   "driver.dart",
   "offer.dart",
   "subscriptions.dart",
-  // Nominal custody/content identities used by generated payloads and read models.
   "sha256_digest.dart",
   "git_object_id.dart",
-  // The tri-state slot (NomosSlot<T>) for `nullable`/`clearable` fields (null_semantics.md) — the
-  // barrel re-exports it and generated read-model/payload classes reference it, so it must vendor.
   "null_slot.dart",
-  // Runtime aggregate-meta support types (NomosAggregateMeta/NomosFieldMeta) — the generated
-  // per-domain registry consts reference them through the barrel.
   "aggregate_meta.dart",
-  // The data-only error surface (NomosErrorInfo/NomosBridgeError) + the typed diagnostics
-  // (nomosErrorFromInfo / MissingOfferAuthority / …) — the vendored bridge AND the generated
-  // `<name>.client.dart` reference these through the barrel. No external pub deps.
   "error_info.dart",
   "errors.dart",
-  // The foreign-ref locator runtime (ForeignRef<T>/NomosForeignReader/…, t.foreignRef) — a generated read
-  // model with a `t.foreignRef` field references `ForeignRef<Target>` through the barrel, so it must vendor.
   "foreign_ref.dart",
   "activity.dart",
   "nomos_ref.dart",
-  // Immutable publication pin + stable series and the required version-status sum
-  // type. Pure data; the generated application owns the effectful check.
   "versioned_nomos_ref.dart",
-  // Optional first-class references are explicit required choices in generated
-  // action inputs: absent or present, never an accidentally omitted argument.
   "optional_ref.dart",
-  // Branded identity wrappers (NomosPrincipal/NomosDeviceSecret) — the generated cross-workspace birth
-  // methods type `actor`/`authorSecret` as these (not bare strings), so both must vendor. Pure data.
   "principal.dart",
-  // The custody-lifecycle types (NomosCustodyBreak/NomosCustodyStatus/CustodyBreakPolicy) — the generated
-  // client + the vendored bridge reference them through the barrel, so they must vendor. Pure data.
   "custody.dart",
-  // THE LOCAL-WORK-REJECTED LIFECYCLE (seated_barrier_and_seal_obligation.md Part 4):
-  // NomosLocalWorkRejectedEvent/NomosRejectedIntent — the vendored bridge's localWorkRejectedEvents
-  // stream types ride through the barrel, so they must vendor. Pure data.
   "local_work_rejected.dart",
-  // SURFACED MERGE CONFLICTS: SurfacedValue<T>/SurfacedObservation<T> — a generated read model with a
-  // `.merge(Surfaced(...))` field references them through the barrel, so they must vendor. Pure data.
   "surfaced.dart",
-] as const;
-// The RUNTIME support files, vendored from `nomos_client` (dsl/dart/lib/src): the async WebView
-// bridge the generated `<name>.client.dart` drives, and the provider surface. Their
-// `package:nomos_types/...` imports are rewritten to the local vendored shim (see emitDart).
-// (`home.dart` is NOT vendored — the home-onboarding runtime drags `package:crypto`; nothing the
-// codegen emits references it.)
-const DART_SUPPORT_RUNTIME_SRC = [
   "provider.dart",
-  "webview_bridge.dart",
   "session_bound.dart",
   "record_origin.dart",
-  // Canonical USDA application-call/result syntax. Generated clients refer to
-  // these through the support barrel; omitting them from a vendored package
-  // silently resurrected the old map bridge at integration time.
   "generated_call.dart",
   "result_usda.dart",
 ] as const;
-const DART_SUPPORT_SRC = [
-  ...DART_SUPPORT_CORE_SRC,
-  ...DART_SUPPORT_RUNTIME_SRC,
-] as const;
-/** The local shim replacing `package:nomos_types/nomos_types.dart` inside vendored runtime files. */
-const VENDORED_TYPES_SHIM = "nomos_types.dart";
-const VENDORED_KERNEL_PROTOCOL_SHIM = "nomos_kernel_protocol.dart";
-const VENDORED_META_DEP = "^1.12.0";
-const VENDORED_PROTOBUF_DEP = "^5.0.0";
-const VENDORED_FIXNUM_DEP = "^1.1.1";
-const VENDORED_DART_SDK_FLOOR = "3.3.0";
-
-/**
- * Vendored runtime files carry package:meta's @internal boundary. Keep the
- * containing Dart package honest by declaring that implementation dependency
- * instead of stripping the annotation from generated copies.
- */
-function ensureVendoredPackageRequirements(dartOut: string): void {
-  let dir = path.resolve(dartOut);
-  let pubspec: string | undefined;
-  for (let hops = 0; hops < 8; hops++) {
-    const candidate = path.join(dir, "pubspec.yaml");
-    if (existsSync(candidate)) {
-      pubspec = candidate;
-      break;
-    }
-    const parent = path.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  if (pubspec === undefined) return;
-  const source = readFileSync(pubspec, "utf8");
-  let next = source;
-  const sdkLine = /^(\s+sdk:\s*)([^#\r\n]+)(\s*(?:#.*)?)$/m.exec(next);
-  if (sdkLine === null) {
-    fail(
-      "generated Dart semantic types need an environment.sdk constraint in " +
-        pubspec
-    );
-  }
-  const declared = sdkLine[2]!.trim().replace(/^['"]|['"]$/g, "");
-  const firstVersion = /(\d+)\.(\d+)(?:\.\d+)?/.exec(declared);
-  if (firstVersion === null) {
-    fail(
-      `generated Dart semantic types need SDK >=${VENDORED_DART_SDK_FLOOR}; ` +
-        `cannot interpret environment.sdk '${declared}' in ${pubspec}`
-    );
-  }
-  const major = Number(firstVersion[1]);
-  const minor = Number(firstVersion[2]);
-  if (major < 3 || (major === 3 && minor < 3)) {
-    next = next.replace(
-      sdkLine[0],
-      `${sdkLine[1]}\">=${VENDORED_DART_SDK_FLOOR} <4.0.0\"${sdkLine[3] ?? ""}`
-    );
-  }
-  if (next !== source) writeFileSync(pubspec, next, "utf8");
-  reconcilePubspec(dir, "", {
-    meta: VENDORED_META_DEP,
-    protobuf: VENDORED_PROTOBUF_DEP,
-    fixnum: VENDORED_FIXNUM_DEP,
-  });
-}
 
 /** The generated-owned subdirectory, relative to `dartOut` (the pub package's `lib/`). WIPED and
  *  rewritten on every compile — nothing hand-written may live in it. The stable facade (the package
@@ -1157,7 +1169,7 @@ function collectPackageContracts(
 /**
  * CROSS-DOMAIN REF TRAVERSAL map (dart_codegen_parity.md §2a follow-on): every aggregate id in the package
  * → its owning domain (`domain` for the generated client class name; `name` for the sibling
- * `<name>.client.dart` import). Handed to `generateDartBridgeClient` so a same-workspace `t.ref` whose
+ * `<name>.client.dart` import). Handed to `generateDartDomainClient` so a same-workspace `t.ref` whose
  * target lives in ANOTHER domain of the package emits a resolver taking that domain's client. A same-domain
  * ref never consults this (its target is in the local module); a foreign ref uses its own locator.
  */
@@ -1358,8 +1370,13 @@ function dartValueObjectsForModule(
   >();
   for (const descriptor of [
     ...(mod.valueObjects ?? []),
+    ...(mod.indexedVariants ?? []).flatMap((binding) => [binding.value.descriptor, ...binding.value.dependencies]),
     ...collectValueObjectDescriptors(mod.aggregates),
     ...collectPayloadValueObjectDescriptors(codegenDirectives),
+    ...collectSchemaValueObjectDescriptors([
+      ...(mod.deriveds ?? []).map((read) => read.returns),
+      ...(mod.combineds ?? []).map((read) => read.returns),
+    ]),
   ]) {
     const prior = byName.get(descriptor.name);
     if (
@@ -1508,7 +1525,7 @@ function collectDartSharedSymbols(
 }
 
 /** Per-domain skip/import options against the shared-symbol dedup — the SAME derivation the flat
- *  emit and the layered-packages emit both apply before generateDartDomain / the bridge client. */
+ *  emit and the layered-packages emit both apply before generateDartDomain / the session client. */
 function domainDedupOpts(
   mod: DomainModule,
   shared: DartSharedSymbols
@@ -1564,7 +1581,7 @@ function domainDedupOpts(
 }
 
 /** Remove the PRE-barrel flat layout's generated files from `dartOut` root (they now live under
- *  `src/generated/`): the vendored support set + the per-domain files. Targeted by exact known
+ *  `src/generated/`): retired copied support + the per-domain files. Targeted by exact known
  *  name — `dartOut` is typically the tenant package's `lib/`, so never sweep directories. */
 function removeLegacyFlatDartLayout(
   dartOut: string,
@@ -1572,7 +1589,7 @@ function removeLegacyFlatDartLayout(
 ): void {
   rmSync(path.join(dartOut, "nomos_client.dart"), { force: true });
   rmSync(path.join(dartOut, "nomos_framework.dart"), { force: true });
-  for (const f of DART_SUPPORT_SRC)
+  for (const f of LEGACY_VENDORED_DART_SUPPORT)
     rmSync(path.join(dartOut, "src", f), { force: true });
   for (const name of moduleNames) {
     rmSync(path.join(dartOut, `${name}.dart`), { force: true });
@@ -1583,8 +1600,8 @@ function removeLegacyFlatDartLayout(
 /**
  * Emit the typed Dart for the composed domain modules into `dartOut`: one
  * `<name>.dart` per domain (the SAME `generateDartDomain` path the co2 tenant's
- * `emit_dart.ts` drives) + the vendored `nomos_client.dart` barrel and its `src/`
- * support files, with the generated files' `package:` import rewritten relative.
+ * `emit_dart.ts` drives). Runtime support is always imported from the fixed
+ * `nomos_client` package.
  * Everything lands under `dartOut/src/generated/` (generated-owned, wiped per
  * compile) behind ONE generated package barrel `dartOut/<barrelName>.dart` — the
  * analyzer-clean plug-and-play entrypoint (zero `show`/`hide`; framework-shared
@@ -1644,6 +1661,491 @@ function beginAtomicGenDir(genDir: string): void {
   });
 }
 
+/** Select the operation contracts shared by both generated language bindings. */
+function operationProtoLaws(
+  modules: readonly DomainModule[],
+  lawGraphs: ReadonlyMap<string, LawGraph>,
+  lawPaths: ReadonlyMap<string, ReadonlyMap<string, string>>
+): readonly OperationProtoLaw[] {
+  const fixedDirectives = (graph: LawGraph): string[] => {
+    const selected = fixedFrameworkCallDefinitions.flatMap((definition) => {
+      const route = definition.routeId ?? definition.directive.id;
+      return graph.nodes.some(
+        (node) =>
+          node.kind === "intent" &&
+          (node.entity.label === route ||
+            node.publicRoute === route ||
+            node.entity.label === definition.directive.id ||
+            node.publicRoute === definition.directive.id)
+      )
+        ? [route]
+        : [];
+    });
+    if (
+      graph.nodes.some(
+        (node) =>
+          node.kind === "intent" &&
+          (node.entity.label === BUSINESS_CORRECTION_DIRECTIVE ||
+            node.publicRoute === BUSINESS_CORRECTION_DIRECTIVE)
+      )
+    ) {
+      selected.push(BUSINESS_CORRECTION_DIRECTIVE);
+    }
+    // Generated owned-record actions and the device approval door are emitted
+    // by the TypeScript Reception as nominal calls. Their private law routes
+    // still need operation payload messages in the packed client schema.
+    for (const node of graph.nodes) {
+      if (node.kind !== "intent") continue;
+      const route = node.publicRoute ?? node.entity.label;
+      if (/^nomos_internal_(?:share|unshare|transfer)_owned_record_[0-9a-f_]+$/.test(route)
+        || [OWNED_DEVICE_APPROVAL_DIRECTIVE, OWNED_INITIALIZE_DIRECTIVE,
+          OWNED_RECOVERY_ACCEPT_DIRECTIVE, OWNED_RECOVERY_COMPLETE_DIRECTIVE,
+          OWNED_RECOVERY_PROTECT_DIRECTIVE, OWNED_RECOVERY_REQUEST_DIRECTIVE].includes(route)) {
+        selected.push(route);
+      }
+    }
+    // The declared receiving-group recovery door lives in the compiler-owned application-home graph
+    // (no tenant DomainModule reaches this list through `dartFrameworkOperationDirectiveIds`); the
+    // generated Dart binds it like a fixed framework call, so its payload rides the same contract.
+    if (
+      graph.nodes.some(
+        (node) =>
+          node.kind === "intent" &&
+          node.entity.label === receivingGroupRecoveryModule.RECOVER_RECEIVING_GROUP_DEVICE_ID
+      )
+    ) {
+      selected.push(receivingGroupRecoveryModule.RECOVER_RECEIVING_GROUP_DEVICE_ID);
+    }
+    // The framework child-authentication repair is composed into the same graph whenever the package
+    // births children and is bound by the generated Dart the same way (by id), so its payload message
+    // must ride the operation transport contract too.
+    if (
+      graph.nodes.some(
+        (node) =>
+          node.kind === "intent" &&
+          node.entity.label === childAuthenticationModule.REPAIR_CHILD_AUTHENTICATION_ID
+      )
+    ) {
+      selected.push(childAuthenticationModule.REPAIR_CHILD_AUTHENTICATION_ID);
+    }
+    // The parent-directed model transition's PLATFORM DOOR (architecture/parent_directed_model_transition.md)
+    // is composed into the same graph whenever the package births children, and the operator CLI authors it
+    // remotely as a nominal DirectiveCall — so its payload message must ride the operation transport
+    // contract exactly as the child-authentication repair's does. The child-side acceptor needs no entry:
+    // nothing outside the kernel ever encodes it (it arrives as a carried effect, never as a client call).
+    if (
+      graph.nodes.some(
+        (node) =>
+          node.kind === "intent" &&
+          node.entity.label === modelTransitionModule.DIRECT_CHILD_MODEL_TRANSITION_ID
+      )
+    ) {
+      selected.push(modelTransitionModule.DIRECT_CHILD_MODEL_TRANSITION_ID);
+    }
+    // THE MODEL-AUTHORITY SELF-SEAT (same design, §9): the Reception offers it on the workspace itself
+    // as a nominal DirectiveCall, so its holder-set payload rides the operation transport contract too.
+    if (
+      graph.nodes.some(
+        (node) =>
+          node.kind === "intent" &&
+          node.entity.label === modelAuthorityRepairModule.SEAT_MODEL_AUTHORITY_ID
+      )
+    ) {
+      selected.push(modelAuthorityRepairModule.SEAT_MODEL_AUTHORITY_ID);
+    }
+    return [...new Set(selected)];
+  };
+  const covered = new Set<string>();
+  const laws = modules.flatMap((module) => {
+    const graph = lawGraphs.get(module.name);
+    const paths = lawPaths.get(module.name);
+    if (graph === undefined || paths === undefined) return [];
+    covered.add(module.name);
+    // The transport schema is the typed boundary between an application and
+    // the Peer Office, not a second encoding of the kernel's entire interior.
+    // generateOperationProtoSchema includes every public intent itself. Add
+    // only the private framework capabilities which the Peer Office invokes
+    // directly; private law steps remain inside the kernel and need no host
+    // transport contract.
+    const directives = new Set<string>();
+    for (const directive of dartBridgeClientOperationDirectiveIds(module, graph)) {
+      directives.add(directive);
+    }
+    for (const directive of dartFrameworkOperationDirectiveIds({
+      module,
+      graph,
+      paths,
+    })) {
+      directives.add(directive);
+    }
+    for (const directive of fixedDirectives(graph)) directives.add(directive);
+    for (const policy of module.applicationWorkspaceSharing ?? []) {
+      directives.add(policy.invitationLaw.redeem.id);
+    }
+    return [{ graph, paths, directives: [...directives] }];
+  });
+  // Dependency and compiler-owned framework graphs also participate in the
+  // generated Peer Office surface even when they have no tenant DomainModule
+  // in this package. Their public members are included automatically; retain
+  // only the fixed private capabilities that generated runtime code invokes.
+  for (const [name, graph] of lawGraphs) {
+    if (covered.has(name)) continue;
+    const paths = lawPaths.get(name);
+    if (paths === undefined) continue;
+    laws.push({ graph, paths, directives: fixedDirectives(graph) });
+  }
+  return laws;
+}
+
+function operationProtoSchema(
+  modules: readonly DomainModule[],
+  lawGraphs: ReadonlyMap<string, LawGraph>,
+  lawPaths: ReadonlyMap<string, ReadonlyMap<string, string>>
+) {
+  return generateOperationProtoSchema(
+    operationProtoLaws(modules, lawGraphs, lawPaths)
+  );
+}
+
+function protocGenEs(): string {
+  try {
+    const packageRoot = path.dirname(
+      createRequire(import.meta.url).resolve(
+        "@bufbuild/protoc-gen-es/package.json"
+      )
+    );
+    return path.join(packageRoot, "bin", "protoc-gen-es");
+  } catch {
+    throw new Error(
+      "TypeScript operation Protobuf generation requires @bufbuild/protoc-gen-es"
+    );
+  }
+}
+
+/** Emit the single application operation schema and its generated TypeScript
+ * binding. The generated application bundle consumes this module directly;
+ * no client is permitted to reproduce Protobuf field tags. */
+function emitTsOperationProto(
+  cacheRoot: string,
+  outDir: string,
+  lawPath: string,
+  modules: readonly DomainModule[],
+  lawGraphs: ReadonlyMap<string, LawGraph>,
+  lawPaths: ReadonlyMap<string, ReadonlyMap<string, string>>
+): string[] {
+  const schema = operationProtoSchema(modules, lawGraphs, lawPaths);
+  const protoPath = path.join(outDir, schema.fileName);
+  writeFileSync(protoPath, schema.source, "utf8");
+  // Standard protoc owns the descriptor format. The kernel checker compares
+  // this complete schema, not sample values or strings in a generated client.
+  execFileSync("protoc", ["-I", outDir, "--include_imports",
+    `--descriptor_set_out=${path.join(outDir, "operation_payloads.descriptor.pb")}`, protoPath], { stdio: "pipe" });
+  checkOperationContracts(lawPath, path.join(outDir, "operation_payloads.descriptor.pb"), DSL_DIR, cacheRoot);
+  const binding = path.join(outDir, "operation_payloads_pb.ts");
+  const generator = protocGenEs();
+  const protocVersion = execFileSync("protoc", ["--version"], {
+    encoding: "utf8",
+  }).trim();
+  const { cacheDir, cachedBinding } = tsOperationProtoCache(
+    cacheRoot,
+    schema.source,
+    protocVersion,
+    generator
+  );
+  if (existsSync(cachedBinding)) {
+    copyFileSync(cachedBinding, binding);
+    return [protoPath, binding];
+  }
+  try {
+    execFileSync("protoc", tsProtocArgs(outDir, protoPath, generator), {
+      stdio: "pipe",
+    });
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(
+      `TypeScript operation Protobuf generation failed. Install protoc and ` +
+        `@bufbuild/protoc-gen-es. ${detail}`
+    );
+  }
+  if (!existsSync(binding)) {
+    throw new Error(
+      "TypeScript operation Protobuf generation did not emit 'operation_payloads_pb.ts'"
+    );
+  }
+  publishCachedBinding(binding, cacheDir, cachedBinding);
+  return [protoPath, binding];
+}
+
+// protoc-gen-es / protoc-gen-dart are pure, expensive transforms over the application schema
+// (the Dart plugin is a Dart script whose JIT start alone is seconds). Their exact output is
+// cached by every input that can affect the bytes. There is no semantic cache manifest: the
+// key is content-addressed, the generated binding is disposable, and the normal TypeScript /
+// Dart compile still validates every hit. The prewarm variants below populate the same cache
+// from a scratch directory while the rest of the compile proceeds; the emit then hits it.
+function tsOperationProtoCache(
+  cacheRoot: string,
+  schemaSource: string,
+  protocVersion: string,
+  generator: string
+): { cacheDir: string; cachedBinding: string } {
+  const generatorPackage = path.join(
+    path.dirname(path.dirname(generator)),
+    "package.json"
+  );
+  const cacheIdentity = createHash("sha256")
+    .update("nomos.operation-protobuf.typescript.v1\0")
+    .update(schemaSource)
+    .update("\0")
+    .update(protocVersion)
+    .update("\0target=ts,import_extension=js\0")
+    .update(readFileSync(generatorPackage))
+    .digest("hex");
+  const cacheDir = path.join(
+    cacheRoot,
+    "node_modules",
+    ".cache",
+    "nomos",
+    "operation-protobuf",
+    "typescript"
+  );
+  return { cacheDir, cachedBinding: path.join(cacheDir, `${cacheIdentity}.ts`) };
+}
+
+function tsProtocArgs(
+  includeDir: string,
+  protoPath: string,
+  generator: string
+): string[] {
+  return [
+    "-I",
+    includeDir,
+    `--plugin=protoc-gen-es=${generator}`,
+    `--es_out=${includeDir}`,
+    "--es_opt=target=ts,import_extension=js",
+    protoPath,
+  ];
+}
+
+function dartProtocPlugin(): string | undefined {
+  const localPlugin = path.resolve(
+    DSL_DIR,
+    "..",
+    "nomos_flutter",
+    "tool",
+    "protoc-gen-dart"
+  );
+  const configuredPlugin = process.env.NOMOS_PROTOC_GEN_DART;
+  return configuredPlugin !== undefined && configuredPlugin !== ""
+    ? path.resolve(configuredPlugin)
+    : existsSync(localPlugin)
+    ? localPlugin
+    : undefined;
+}
+
+function dartProtocArgs(
+  includeDir: string,
+  protoPath: string,
+  plugin: string | undefined
+): string[] {
+  return [
+    "-I",
+    includeDir,
+    ...(plugin === undefined ? [] : [`--plugin=protoc-gen-dart=${plugin}`]),
+    `--dart_out=${includeDir}`,
+    protoPath,
+  ];
+}
+
+function dartOperationProtoCache(
+  schemaSource: string,
+  protocVersion: string,
+  plugin: string | undefined
+): { cacheDir: string; cachedBinding: string } {
+  const generatorIdentity = (() => {
+    if (plugin === undefined) return "PATH:protoc-gen-dart";
+    const files = [
+      plugin,
+      path.join(path.dirname(plugin), "protoc_plugin.dart"),
+      path.join(path.dirname(path.dirname(plugin)), "pubspec.lock"),
+    ];
+    const digest = createHash("sha256");
+    for (const file of files) {
+      digest.update(`\0${file}\0`);
+      if (existsSync(file)) digest.update(readFileSync(file));
+    }
+    return digest.digest("hex");
+  })();
+  const cacheIdentity = createHash("sha256")
+    .update("nomos.operation-protobuf.dart.v1\0")
+    .update(schemaSource)
+    .update("\0")
+    .update(protocVersion)
+    .update("\0")
+    .update(generatorIdentity)
+    .digest("hex");
+  const cacheDir = path.join(
+    process.cwd(),
+    "node_modules",
+    ".cache",
+    "nomos",
+    "operation-protobuf",
+    "dart"
+  );
+  return { cacheDir, cachedBinding: path.join(cacheDir, `${cacheIdentity}.dart`) };
+}
+
+function publishCachedBinding(
+  generated: string,
+  cacheDir: string,
+  cachedBinding: string
+): void {
+  mkdirSync(cacheDir, { recursive: true });
+  const temporaryCache = `${cachedBinding}.tmp-${process.pid}`;
+  copyFileSync(generated, temporaryCache);
+  renameSync(temporaryCache, cachedBinding);
+}
+
+/** Generate into a scratch directory beside the cache and publish only the binding the emit
+ * copies out; a failure here is silent because the real emit reports it with its own remedy. */
+async function prewarmOperationProtoCache(
+  cacheDir: string,
+  cachedBinding: string,
+  schema: { readonly fileName: string; readonly source: string },
+  generatedName: string,
+  args: (includeDir: string, protoPath: string) => string[]
+): Promise<void> {
+  if (existsSync(cachedBinding)) return;
+  mkdirSync(cacheDir, { recursive: true });
+  const scratch = mkdtempSync(path.join(cacheDir, ".prewarm-"));
+  try {
+    const protoPath = path.join(scratch, schema.fileName);
+    writeFileSync(protoPath, schema.source, "utf8");
+    await execFileAsync("protoc", args(scratch, protoPath));
+    const generated = path.join(scratch, generatedName);
+    if (existsSync(generated))
+      publishCachedBinding(generated, cacheDir, cachedBinding);
+  } catch {
+    // The emit's own protoc invocation names the remedy.
+  } finally {
+    rmSync(scratch, { recursive: true, force: true });
+  }
+}
+
+async function prewarmTsOperationProto(
+  cacheRoot: string,
+  modules: readonly DomainModule[],
+  lawGraphs: ReadonlyMap<string, LawGraph>,
+  lawPaths: ReadonlyMap<string, ReadonlyMap<string, string>>
+): Promise<void> {
+  try {
+    const schema = operationProtoSchema(modules, lawGraphs, lawPaths);
+    const generator = protocGenEs();
+    const { stdout } = await execFileAsync("protoc", ["--version"], {
+      encoding: "utf8",
+    });
+    const { cacheDir, cachedBinding } = tsOperationProtoCache(
+      cacheRoot,
+      schema.source,
+      stdout.trim(),
+      generator
+    );
+    await prewarmOperationProtoCache(
+      cacheDir,
+      cachedBinding,
+      schema,
+      "operation_payloads_pb.ts",
+      (includeDir, protoPath) => tsProtocArgs(includeDir, protoPath, generator)
+    );
+  } catch {
+    // The emit's own protoc invocation names the remedy.
+  }
+}
+
+async function prewarmDartOperationProto(
+  modules: readonly DomainModule[],
+  lawGraphs: ReadonlyMap<string, LawGraph>,
+  lawPaths: ReadonlyMap<string, ReadonlyMap<string, string>>
+): Promise<void> {
+  try {
+    const schema = operationProtoSchema(modules, lawGraphs, lawPaths);
+    const plugin = dartProtocPlugin();
+    const { stdout } = await execFileAsync("protoc", ["--version"], {
+      encoding: "utf8",
+    });
+    const { cacheDir, cachedBinding } = dartOperationProtoCache(
+      schema.source,
+      stdout.trim(),
+      plugin
+    );
+    await prewarmOperationProtoCache(
+      cacheDir,
+      cachedBinding,
+      schema,
+      schema.dartFileName,
+      (includeDir, protoPath) => dartProtocArgs(includeDir, protoPath, plugin)
+    );
+  } catch {
+    // The emit's own protoc invocation names the remedy.
+  }
+}
+
+function emitDartOperationProto(
+  genDir: string,
+  modules: readonly DomainModule[],
+  lawGraphs: ReadonlyMap<string, LawGraph>,
+  lawPaths: ReadonlyMap<string, ReadonlyMap<string, string>>
+): string[] {
+  const schema = operationProtoSchema(modules, lawGraphs, lawPaths);
+  const protoPath = path.join(genDir, schema.fileName);
+  writeFileSync(protoPath, schema.source, "utf8");
+  const plugin = dartProtocPlugin();
+  const protocVersion = execFileSync("protoc", ["--version"], {
+    encoding: "utf8",
+  }).trim();
+  const { cacheDir, cachedBinding } = dartOperationProtoCache(
+    schema.source,
+    protocVersion,
+    plugin
+  );
+  const generatedBinding = path.join(genDir, schema.dartFileName);
+  if (existsSync(cachedBinding)) {
+    copyFileSync(cachedBinding, generatedBinding);
+    return [protoPath, generatedBinding];
+  }
+  try {
+    execFileSync("protoc", dartProtocArgs(genDir, protoPath, plugin), {
+      stdio: "pipe",
+    });
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(
+      `Dart operation Protobuf generation failed. Install protoc and protoc-gen-dart ` +
+        `(or set NOMOS_PROTOC_GEN_DART). ${detail}`
+    );
+  }
+  const generated = readdirSync(genDir)
+    .filter(
+      (name) =>
+        name.startsWith("operation_payloads.pb") && name.endsWith(".dart")
+    )
+    .sort()
+    .map((name) => path.join(genDir, name));
+  if (!generated.some((file) => path.basename(file) === schema.dartFileName)) {
+    throw new Error(
+      `Dart operation Protobuf generation did not emit '${schema.dartFileName}'`
+    );
+  }
+  // Runtime clients use only the generated messages. Reflection JSON and the
+  // empty enum companion are generator by-products, not another contract or
+  // shipped source of truth.
+  for (const file of generated) {
+    if (path.basename(file) !== schema.dartFileName)
+      rmSync(file, { force: true });
+  }
+  publishCachedBinding(generatedBinding, cacheDir, cachedBinding);
+  return [protoPath, generatedBinding];
+}
+
 function emitDart(
   modules: readonly DomainModule[],
   dartOut: string,
@@ -1651,9 +2153,8 @@ function emitDart(
   lawGraphs: ReadonlyMap<string, LawGraph>,
   lawPaths: ReadonlyMap<string, ReadonlyMap<string, string>>,
   packageInterface: Record<string, DomainInterface> = {},
-  supportImport: DartSupportImport = "vendored",
+  supportImport: DartSupportImport = "package",
   barrelName = "nomos_domains",
-  compat?: NomosCompat,
   names?: Readonly<Record<string, string>>,
   describePackageName = barrelName
 ): string[] {
@@ -1667,133 +2168,8 @@ function emitDart(
   // Transactional: back the prior generated dir aside instead of destroying it (compile atomicity).
   beginAtomicGenDir(genDir);
 
-  // 1. optional vendored framework support (barrel + src/), copied byte-for-byte except
-  //    the barrel's schema_validation export (see DART_SUPPORT_SRC).
-  if (supportImport === "vendored") {
-    ensureVendoredPackageRequirements(dartOut);
-    mkdirSync(path.join(genDir, "src"), { recursive: true });
-    // Core files come from the pure `nomos_types` package, runtime files from `nomos_client`
-    // (the layered split). Runtime files import the core via `package:nomos_types/...` — the
-    // vendored copy rewrites that to the local shim so the directory stays self-contained.
-    const coreDir = path.join(DSL_DIR, "dart_types", "lib", "src");
-    const clientDir = path.join(DSL_DIR, "dart", "lib", "src");
-    for (const f of DART_SUPPORT_CORE_SRC)
-      copyFileSync(path.join(coreDir, f), path.join(genDir, "src", f));
-    for (const f of DART_SUPPORT_RUNTIME_SRC) {
-      const src = readFileSync(path.join(clientDir, f), "utf8")
-        .replace(
-          /import 'package:nomos_types\/nomos_types\.dart'/g,
-          `import '${VENDORED_TYPES_SHIM}'`
-        )
-        .replace(
-          /import 'package:nomos_types\/src\/(?:nomos_ref|foreign_ref|versioned_nomos_ref)\.dart'/g,
-          `import '${VENDORED_TYPES_SHIM}'`
-        )
-        .replace(
-          /import 'package:nomos_types\/nomos_kernel_protocol\.dart'/g,
-          `import '${VENDORED_KERNEL_PROTOCOL_SHIM}'`
-        );
-      writeFileSync(path.join(genDir, "src", f), src, "utf8");
-    }
-    // Protobuf is the sole kernel/host message schema. Flat vendored packages receive a generated
-    // projection of that schema, never a handwritten certificate mirror. The compiler copies only the
-    // generated kernel files this runtime uses; `generate:kernel-proto-dart` remains their source.
-    const generatedKernelProto = path.join(
-      DSL_DIR,
-      "dart_types",
-      "lib",
-      "src",
-      "proto",
-      "nomos",
-      "kernel",
-      "v1"
-    );
-    const vendoredKernelProto = path.join(
-      genDir,
-      "src",
-      "proto",
-      "nomos",
-      "kernel",
-      "v1"
-    );
-    mkdirSync(vendoredKernelProto, { recursive: true });
-    for (const f of [
-      "kernel.pb.dart",
-      "kernel.pbenum.dart",
-      "progress.pb.dart",
-      "progress.pbenum.dart",
-    ]) {
-      copyFileSync(
-        path.join(generatedKernelProto, f),
-        path.join(vendoredKernelProto, f)
-      );
-    }
-    const generatedRuntimeProto = path.join(
-      DSL_DIR,
-      "dart_types",
-      "lib",
-      "src",
-      "proto",
-      "nomos",
-      "runtime",
-      "v2"
-    );
-    const vendoredRuntimeProto = path.join(
-      genDir,
-      "src",
-      "proto",
-      "nomos",
-      "runtime",
-      "v2"
-    );
-    mkdirSync(vendoredRuntimeProto, { recursive: true });
-    for (const f of ["runtime.pb.dart", "runtime.pbenum.dart"]) {
-      copyFileSync(
-        path.join(generatedRuntimeProto, f),
-        path.join(vendoredRuntimeProto, f)
-      );
-    }
-    writeFileSync(
-      path.join(genDir, "src", VENDORED_KERNEL_PROTOCOL_SHIM),
-      [
-        "// GENERATED from proto/nomos/kernel/v1/kernel.proto by nomos-compile. DO NOT EDIT.",
-        "library;",
-        "",
-        "export 'proto/nomos/kernel/v1/kernel.pb.dart';",
-        "export 'proto/nomos/kernel/v1/progress.pb.dart';",
-        "export 'proto/nomos/runtime/v2/runtime.pb.dart';",
-        "",
-      ].join("\n"),
-      "utf8"
-    );
-    // The local shim the rewritten runtime imports resolve through (the vendored twin of the
-    // nomos_types barrel — core files only).
-    writeFileSync(
-      path.join(genDir, "src", VENDORED_TYPES_SHIM),
-      [
-        "// GENERATED by nomos-compile — the vendored twin of the nomos_types barrel. DO NOT EDIT.",
-        "library;",
-        "",
-        ...DART_SUPPORT_CORE_SRC.map((f) => `export '${f}';`),
-        "",
-      ].join("\n"),
-      "utf8"
-    );
-    // The vendored support barrel — explicit (never derived from the real nomos_client barrel,
-    // which post-split re-exports the nomos_types PACKAGE the vendored tree must not depend on).
-    writeFileSync(
-      path.join(genDir, "nomos_client.dart"),
-      [
-        "// GENERATED by nomos-compile — the vendored nomos_client support barrel. DO NOT EDIT.",
-        "library;",
-        "",
-        ...DART_SUPPORT_SRC.map((f) => `export 'src/${f}';`),
-        "",
-      ].join("\n"),
-      "utf8"
-    );
-  }
-  // (package-support mode vendors nothing — the genDir wipe above already cleared any prior set)
+  // Fixed runtime support is imported from nomos_client; generated packages never copy it.
+  ensureFlatDartPackageRequirements(dartOut);
 
   // 2. FRAMEWORK-SHARED symbol dedup (Dart-codegen hygiene). Framework-owned symbols fold into MANY
   //    domains, so their generated Dart would be DEFINED once per domain — a package barrel re-exporting
@@ -1822,6 +2198,7 @@ function emitDart(
     : undefined;
 
   const written: string[] = [];
+  written.push(...emitDartOperationProto(genDir, modules, lawGraphs, lawPaths));
 
   const writeGenerated = (fileBase: string, src: string): string => {
     if (!src.includes(DART_PACKAGE_IMPORT)) {
@@ -1830,23 +2207,16 @@ function emitDart(
       );
     }
     const p = path.join(genDir, `${fileBase}.dart`);
-    writeFileSync(
-      p,
-      supportImport === "vendored"
-        ? src.replace(DART_PACKAGE_IMPORT, DART_RELATIVE_IMPORT)
-        : src,
-      "utf8"
-    );
+    writeFileSync(p, src, "utf8");
     domainSources.push(src);
     sourceByFile.set(fileBase, src);
     written.push(p);
     return p;
   };
 
-  // Compiler-owned framework ceremonies (birth policy, signer seating, genesis, invitation
-  // redemption) need the same generated USDA call types in flat/vendored output as in layered pub
-  // packages. Keeping this file private to `src/generated` gives tests and generated application
-  // infrastructure a typed setup lane without reintroducing raw payload maps.
+  // Compiler-owned framework ceremonies are generated stationery over the
+  // fixed nomos_client API. Keeping this file private to `src/generated` gives
+  // tests and generated facades a typed setup lane without runtime lifecycle.
   const applicationFrameworkCallsSource = generateDartApplicationFrameworkCalls(
     modules.flatMap((module) => {
       const graph = lawGraphs.get(module.name);
@@ -1854,37 +2224,22 @@ function emitDart(
       return graph === undefined || paths === undefined
         ? []
         : [{ module, graph, paths }];
-    })
+    }),
+    { lawSha256: domainHash }
   );
   if (applicationFrameworkCallsSource !== undefined) {
-    const source =
-      supportImport === "vendored"
-        ? applicationFrameworkCallsSource
-            .replace(
-              "import 'package:nomos_types/nomos_kernel_protocol.dart' show BirthCertificate;",
-              `import 'src/${VENDORED_KERNEL_PROTOCOL_SHIM}' show BirthCertificate;`
-            )
-            .replace(
-              "import 'package:nomos_types/nomos_types.dart' show NomosSlot, Sha256Digest;",
-              `import 'src/${VENDORED_TYPES_SHIM}' show NomosSlot, Sha256Digest;`
-            )
-            .replace(
-              "import 'package:nomos_client/src/application_framework_calls.dart';",
-              "import 'src/application_framework_calls.dart';"
-            )
-            .replace(
-              "import 'package:nomos_client/src/generated_call.dart';",
-              "import 'src/generated_call.dart';"
-            )
-        : applicationFrameworkCallsSource;
     const applicationFrameworkCallsPath = path.join(
       genDir,
       "application.framework_calls.dart"
     );
-    writeFileSync(applicationFrameworkCallsPath, source, "utf8");
-    written.push(applicationFrameworkCallsPath);
-  }
-
+    writeFileSync(
+      applicationFrameworkCallsPath,
+      applicationFrameworkCallsSource,
+      "utf8"
+    );
+    written.push(applicationFrameworkCallsPath);
+  }
+
   // 2a. the shared framework file — the framework aggregates + directives + queries, ONCE. Its own
   //     surface is emitted in full (no skip). Imported by every domain that folds any framework symbol.
   if (shared.frameworkMod !== undefined) {
@@ -1934,11 +2289,11 @@ function emitDart(
   // break — fail with a clear diagnostic. Contract-mediated refs go through contracts.dart (no concrete edge).
   guardNoConcreteImportCycle(modules, aggIdToDartFile);
 
-  // 2b. one generated file per composed domain — the TYPES (`<name>.dart`) + the async bridge
+  // 2b. one generated file per composed domain — the TYPES (`<name>.dart`) + the async session
   //     CLIENT (`<name>.client.dart`, the Flutter sibling of `<name>.client.ts`).
   for (const mod of modules) {
     // Default the read-model allowlist to EVERY aggregate when the domain didn't pin one, so
-    // `<name>.dart` carries a read model per aggregate — the bridge client imports them. A domain
+    // `<name>.dart` carries a read model per aggregate — the session client imports them. A domain
     // that pins `readModelAggregates` keeps its choice (byte-identical to before this default).
     // Skip framework symbols this domain folds (they live in the shared file); reference them via the
     // framework import. Only pass the import when this domain actually folds a framework symbol.
@@ -2009,14 +2364,13 @@ function emitDart(
     });
     writeGenerated(mod.name, src);
 
-    const clientSrc = generateDartBridgeClient(modForDart, {
+    const clientSrc = generateDartDomainClient(modForDart, {
       domainHash,
       callUsda: {
         graph: lawGraphs.get(mod.name)!,
         paths: lawPaths.get(mod.name)!,
       },
       interface: packageInterface[modForDart.domain ?? modForDart.name],
-      ...(compat !== undefined ? { compat } : {}),
       supportImport,
       ...(domainFrameworkImport !== undefined
         ? { frameworkImportUri: domainFrameworkImport }
@@ -2028,6 +2382,7 @@ function emitDart(
     const applicationSrc = generateDartApplication(modForDart, {
       supportImport,
       packageAggregateDomains,
+      callUsda: { graph: lawGraphs.get(mod.name)!, paths: lawPaths.get(mod.name)! },
     });
     const clientFile = `${mod.name}.client.dart`;
     const applicationFile = `${mod.name}.application.dart`;
@@ -2036,7 +2391,7 @@ function emitDart(
       applicationSrc,
       clientFile,
       applicationFile,
-      new Set(dartApplicationPublicClassNames(modForDart))
+      new Set(dartApplicationPublicClassNames(modForDart, { callUsda: { graph: lawGraphs.get(mod.name)!, paths: lawPaths.get(mod.name)! } }))
     );
     const cp = path.join(genDir, clientFile);
     writeFileSync(cp, encapsulated.clientPart, "utf8");
@@ -2101,9 +2456,7 @@ function emitDart(
     ),
     // The generated clients import their runtime support directly. Keeping it out of the public barrel is
     // the surface firewall: a tenant import receives business types and application APIs, never raw runtime.
-    supportImport === "vendored"
-      ? `export '${genRel}/src/${VENDORED_TYPES_SHIM}' show NomosRef, NomosOptionalRef, NomosSlot, VersionedNomosRef, ReferenceVersionStatus, ReferenceVersionCurrent, ReferenceVersionOutdated, ReferenceVersionUnavailable${sha256DigestExport}${gitObjectIdExport};`
-      : `export 'package:nomos_types/nomos_types.dart' show NomosRef, NomosOptionalRef, NomosSlot, VersionedNomosRef, ReferenceVersionStatus, ReferenceVersionCurrent, ReferenceVersionOutdated, ReferenceVersionUnavailable${sha256DigestExport}${gitObjectIdExport};`,
+    `export 'package:nomos_types/nomos_types.dart' show NomosRef, NomosOptionalRef, NomosSlot, VersionedNomosRef, ReferenceVersionStatus, ReferenceVersionCurrent, ReferenceVersionOutdated, ReferenceVersionUnavailable${sha256DigestExport}${gitObjectIdExport};`,
     ...(contractsImportUri !== undefined
       ? tenantDartExport(
           `${genRel}/${CONTRACTS_FILE}.dart`,
@@ -2124,7 +2477,7 @@ function emitDart(
       ),
       `export '${genRel}/${
         m.name
-      }.application.dart' show ${dartApplicationPublicClassNames(m).join(
+      }.application.dart' show ${dartApplicationPublicClassNames(m, { callUsda: { graph: lawGraphs.get(m.name)!, paths: lawPaths.get(m.name)! } }).join(
         ", "
       )};`,
     ]),
@@ -2187,18 +2540,44 @@ const dartTypesImportFor = (generatedSource: string): string => {
  *  just the floor generated code needs — a lagging pin forces tenants into dependency_overrides. */
 // 0.3.0: SurfacedValue<T>/SurfacedObservation/PendingConflictRow — generated Surfaced-field typing +
 //        the pendingConflicts read rows.
-const NOMOS_TYPES_DEP = "^0.10.1";
+const NOMOS_TYPES_DEP = "^0.11.2";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.65.3";
-const NOMOS_FLUTTER_DEP = "^0.64.3";
+const NOMOS_CLIENT_DEP = "^0.66.5";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in dsl/dart/pubspec.yaml
 // and dsl/dart_types/pubspec.yaml — a Dart release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).
 
 const isPubPackageName = (s: string): boolean => /^[a-z][a-z0-9_]*$/.test(s);
 
+/** The tenant pub package a FLAT `dart.out` writes into, if any: the nearest pubspec at or above
+ *  the output directory. ONE definition, because two places need the same answer — the dependency
+ *  reconciler that pins nomos_client into that pubspec, and the source-dogfood override that makes
+ *  the pin resolvable from a checkout. A flat `dart.out: pkg/lib` puts that pubspec ABOVE
+ *  `dart.out`, where the analyze gate's own package walk deliberately stops. */
+function flatDartPackageRoot(dartOut: string): string | undefined {
+  let directory = path.resolve(dartOut);
+  for (let hops = 0; hops < 8; hops++) {
+    if (existsSync(path.join(directory, "pubspec.yaml"))) return directory;
+    const parent = path.dirname(directory);
+    if (parent === directory) return undefined;
+    directory = parent;
+  }
+  return undefined;
+}
+
+function ensureFlatDartPackageRequirements(dartOut: string): void {
+  const directory = flatDartPackageRoot(dartOut);
+  if (directory === undefined) return;
+  reconcilePubspec(directory, "", {
+    nomos_types: NOMOS_TYPES_DEP,
+    nomos_client: NOMOS_CLIENT_DEP,
+    protobuf: "^5.0.0",
+    fixnum: "^1.1.1",
+  });
+}
+
 /** `import` lines a barrel needs so its `typedef` aliases can SEE the generated symbols
  *  (an `export` alone re-exports but does not bring names into scope). Empty when no aliases. */
 const aliasImportLines = (
@@ -2253,7 +2632,7 @@ function tenantDartExportNames(src: string): string[] {
 }
 
 /**
- * Turn the generated bridge client into a Dart `part` of the business application library.
+ * Turn the generated session client into a Dart `part` of the business application library.
  *
  * `lib/src` is only a convention: a tenant can deep-import a normal Dart library. A part file is a
  * language boundary — it cannot be imported on its own — and its underscore-prefixed declarations are
@@ -2330,7 +2709,7 @@ function encapsulateDartClient(
       continue;
     // Preserve business-type re-exports so one application import carries its
     // payloads and read models. Framework/runtime exports belonged to the retired
-    // bridge library and must not enter tenant autocomplete.
+    // session library and must not enter tenant autocomplete.
     if (
       kind === "export" &&
       client.directives.includes(line) &&
@@ -2406,7 +2785,7 @@ function generatedPackageApplication(
   }[],
   homeDomain: string,
   rootDomains: readonly string[],
-  remoteDomains: readonly string[],
+  parentWorkspaceDomains: readonly string[],
   hasApplicationFrameworkCalls: boolean
 ): string {
   const application = dartApplicationClassName(packageName);
@@ -2431,31 +2810,26 @@ function generatedPackageApplication(
       "generated Dart package application could not bind every co-resident root domain"
     );
   }
-  const remoteMembers = domains
-    .filter(({ domain }) => remoteDomains.includes(domain))
+  const parentMembers = domains
+    .filter(({ domain }) => parentWorkspaceDomains.includes(domain))
     .map(({ domain, file }, index) => ({
       domain,
       file,
-      prefix: `_nmsRemoteDomain${index}`,
+      prefix: `_nmsParentDomain${index}`,
       member: dartApplicationMember(domain),
       application: dartApplicationClassName(domain),
     }));
-  if (remoteMembers.length !== remoteDomains.length) {
+  if (parentMembers.length !== parentWorkspaceDomains.length) {
     throw new Error(
-      "generated Dart package application could not describe every verified remote ancestor domain"
+      "generated Dart package application could not describe every verified parent-workspace domain"
     );
   }
-  const invitationPolicies = members.flatMap(({ domain, invitationPolicies }) =>
-    invitationPolicies.map((policy) => ({ domain, ...policy }))
+  const invitationPolicies = members.flatMap(
+    ({ domain, member, invitationPolicies }) =>
+      invitationPolicies.map((policy) => ({ domain, member, ...policy }))
   );
   const hasInvitations = invitationPolicies.length > 0;
-  const rootMember = members.find(({ domain }) => domain === homeDomain);
-  if (rootMember === undefined) {
-    throw new Error(
-      `generated Dart package application cannot expose the model for home domain '${homeDomain}'`
-    );
-  }
-  const surfaceMembers = [...members, ...remoteMembers];
+  const surfaceMembers = [...members, ...parentMembers];
   const duplicate = surfaceMembers.find(
     (candidate, index) =>
       surfaceMembers.findIndex((other) => other.member === candidate.member) !==
@@ -2467,11 +2841,9 @@ function generatedPackageApplication(
     );
   }
   const frameworkMembers = new Map<string, string>([
-    ["nomosWidget", "the generated Nomos Flutter bootstrap"],
     ["currentUser", "the generated signed-in application participant"],
     ["currentStatus", "the generated application status"],
     ["watchStatus", "the generated application status watch"],
-    ["model", "the generated model lifecycle"],
     ["recipient", "the generated typed recipient boundary"],
     ["createInvitation", "the generated invitation capability"],
     ["redeemInvitation", "the generated invitation redemption"],
@@ -2492,16 +2864,21 @@ function generatedPackageApplication(
   }
   return [
     `// AUTO-GENERATED by nomos-compile — the one tenant application for "${packageName}".`,
-    `// Domain clients remain generated implementation details behind this stateful business surface.`,
+    `// Domain clients remain generated implementation details behind this stateless business facade.`,
     `// ignore_for_file: invalid_use_of_internal_member`,
-    `import 'package:flutter/widgets.dart';`,
-    `import 'package:nomos_flutter/src/application_status.dart' show ApplicationSignIn, ApplicationStatus;`,
-    `import 'package:nomos_client/src/nms_generated_runtime.dart' show NmsInternalUsers, NomosSession, User${
+    `import 'package:nomos_client/src/application_status.dart' show ApplicationStatus;`,
+    `import 'package:nomos_client/src/nms_generated_runtime.dart' show NmsInternalUsers, User${
       hasInvitations ? ", Invitation, Recipient" : ""
     };`,
-    `import 'package:nomos_flutter/src/generated_application_host.dart' show ApplicationModelChange, NomosApplicationStartupState, NmsInternalApplicationHost, NmsInternalApplicationUserBinding${
-      hasInvitations ? ", NmsInternalInvitationPolicy" : ""
+    `import 'package:nomos_client/src/reception/reception_session.dart' show NmsReceptionSession${
+      hasInvitations ? ", NmsReceptionInvitationPolicy" : ""
     };`,
+    ...(hasApplicationFrameworkCalls
+      ? [
+          `import 'package:nomos_client/src/application_framework_calls.dart' show NmsApplicationFrameworkCalls;`,
+          `import 'package:nomos_client/src/reception/reception_contract.dart' show NmsReceptionContract;`,
+        ]
+      : []),
     ...(hasApplicationFrameworkCalls
       ? [
           `import 'application.framework_calls.dart' show nomosInternalApplicationFrameworkCalls;`,
@@ -2510,151 +2887,116 @@ function generatedPackageApplication(
     ...members.map(
       ({ file, prefix }) => `import '${file}.application.dart' as ${prefix};`
     ),
-    ...remoteMembers.map(
+    ...parentMembers.map(
       ({ file, prefix }) => `import '${file}.application.dart' as ${prefix};`
     ),
     ``,
-    `/// The one canonical stateful application for ${packageName}.`,
+    `/// The typed ${packageName} vocabulary bound to one Peer Office handle.`,
     `///`,
     `/// Keep business UI and services on this object. Nomos owns identity, persistence,`,
     `/// synchronization, workspace navigation, access delivery and recovery underneath it;`,
     `/// do not build a second runtime host, repository, session, or application-state mirror.`,
     `///`,
-    `/// Canonical bootstrap:`,
-    "/// ```dart",
-    `/// return ${application}.nomosWidget(`,
-    `///   cloud: cloud,`,
-    `///   application: '${packageName}',`,
-    `///   signIn: signIn,`,
-    `///   builder: (context, application) => MyBusinessUi(application: application),`,
-    `/// );`,
-    "/// ```",
-    `/// Pass that same [${application}] down. It is the application state.`,
+    `/// The platform shell opens Reception, then calls [receive${application}] once.`,
+    `/// Pass that same [${application}] down; generated code never opens custody or a kernel.`,
     `final class ${application} {`,
-    `  final NomosSession _nmsSession;`,
-    ...(hasInvitations
-      ? [`  final NmsInternalApplicationUserBinding _nmsUser;`]
-      : []),
+    `  final NmsReceptionSession _nmsReception;`,
     `  final User currentUser;`,
     ...members.flatMap(({ domain, member, application: child, prefix }) => [
       `  /// Business actions, records and watches declared by ${domain}.`,
       `  final ${prefix}.${child} ${member};`,
     ]),
-    ...remoteMembers.flatMap(
+    ...parentMembers.flatMap(
       ({ domain, member, application: child, prefix }) => [
-        `  /// Typed surface for verified remote ancestor ${domain}. It is never opened in local custody.`,
-        `  /// Remote reads and offers are not yet generated for this ancestor surface.`,
+        `  /// Typed law surface for verified parent workspace domain ${domain}.`,
+        `  /// Its separate workspace is lineage; where that custody runs is an independent placement decision.`,
         `  ${prefix}.${child} get ${member} => throw StateError(`,
-        `    'The verified ancestor ${domain} is remote and cannot be opened in this device workspace.',`,
+        `    'The ${domain} domain belongs to the verified parent workspace and needs a typed remote-workspace binding.',`,
         `  );`,
       ]
     ),
-    `  const ${application}._({required NomosSession nmsSession, ${
-      hasInvitations
-        ? "required NmsInternalApplicationUserBinding nmsUser, "
-        : ""
-    }required this.currentUser, ${members
+    `  const ${application}._({required NmsReceptionSession nmsReception, required this.currentUser, ${members
       .map(({ member }) => `required this.${member}`)
-      .join(", ")}}) : _nmsSession = nmsSession${
-      hasInvitations ? ", _nmsUser = nmsUser" : ""
-    };`,
-    ``,
-    `  /// Prove, adopt or restore the package law against this workspace's exact history.`,
-    `  ${rootMember.prefix}.NomosModel get model => ${rootMember.member}.model;`,
+      .join(", ")}}) : _nmsReception = nmsReception;`,
     ``,
     `  /// Current durability and convergence for the receiving-group workspace.`,
     `  /// A slow or offline sibling never makes this workspace's readiness ambiguous.`,
-    `  ApplicationStatus get currentStatus => NmsInternalApplicationHost.currentStatus(_nmsSession);`,
+    `  ApplicationStatus get currentStatus => _nmsReception.currentStatus;`,
     ``,
     `  /// React whenever this receiving group saves, receives work, goes offline or needs attention.`,
-    `  Stream<ApplicationStatus> watchStatus() => NmsInternalApplicationHost.watchStatus(_nmsSession);`,
+    `  Stream<ApplicationStatus> watchStatus() => _nmsReception.streams.status;`,
     ``,
     `  /// Wait until this receiving group's accepted work is in custody and caught up.`,
     `  Future<void> whenCurrent({Duration timeout = const Duration(minutes: 2)}) =>`,
-    `      NmsInternalApplicationHost.whenCurrent(_nmsSession, timeout: timeout);`,
+    `      _nmsReception.whenCurrent(timeout: timeout);`,
     ``,
     `  /// Aggregate posture across every child currently owned by this generated application.`,
-    `  ApplicationStatus get applicationStatus => NmsInternalApplicationHost.currentApplicationStatus(_nmsSession);`,
+    `  ApplicationStatus get applicationStatus => _nmsReception.applicationStatus;`,
     ``,
     `  /// React to aggregate posture across every generated child currently in this application plane.`,
-    `  Stream<ApplicationStatus> watchApplicationStatus() => NmsInternalApplicationHost.watchApplicationStatus(_nmsSession);`,
+    `  Stream<ApplicationStatus> watchApplicationStatus() => _nmsReception.streams.applicationStatus;`,
     ``,
     `  /// Explicitly wait for every generated child currently owned by this application.`,
     `  Future<void> whenApplicationCurrent({Duration timeout = const Duration(minutes: 2)}) =>`,
-    `      NmsInternalApplicationHost.whenApplicationCurrent(_nmsSession, timeout: timeout);`,
+    `      _nmsReception.whenApplicationCurrent(timeout: timeout);`,
     ...(hasInvitations
       ? [
           ``,
           `  /// Turn an identity-provider uid into a typed invitation recipient.`,
-          `  Recipient<User> recipient(String uid) => NmsInternalApplicationHost.recipient<User>(uid);`,
+          `  Recipient<User> recipient(String uid) => _nmsReception.recipient<User>(uid);`,
           ``,
           `  /// Create an invitation; transport its link however your product chooses.`,
-          `  Future<Invitation<User>> createInvitation() => NmsInternalApplicationHost.createInvitation<User>(_nmsSession);`,
+          `  Future<Invitation<User>> createInvitation() => _nmsReception.createInvitation<User>();`,
           ``,
           `  /// Redeem a transported invitation as [currentUser].`,
-          `  Future<void> redeemInvitation(String link) => NmsInternalApplicationHost.redeemInvitation<User>(`,
-          `        _nmsSession,`,
+          `  Future<void> redeemInvitation(String link) => _nmsReception.redeemInvitation<User>(`,
           `        frameworkCalls: nomosInternalApplicationFrameworkCalls,`,
           `        link: link,`,
-          `        identity: _nmsUser.nmsInternalActor,`,
+          // Compose each domain application's own policies. Rebuilding them here cannot work: the
+          // pending lookup is a framework-internal sharing query that lives on the domain CLIENT
+          // and is deliberately absent from the domain APPLICATION this member holds.
           `        policies: [`,
-          ...invitationPolicies.flatMap((policy) => [
-            `          NmsInternalInvitationPolicy(`,
-            `            domain: ${JSON.stringify(policy.domain)},`,
-            `            domainHash: ${JSON.stringify(policy.domainHash)},`,
-            `            query: ${JSON.stringify(policy.query)},`,
-            `            redeem: ${JSON.stringify(policy.redeem)},`,
-            `            personField: ${JSON.stringify(policy.personField)},`,
-            `            roleField: ${JSON.stringify(policy.roleField)},`,
-            `            scopeField: ${JSON.stringify(policy.scopeField)},`,
-            `          ),`,
-          ]),
+          ...[...new Set(invitationPolicies.map((policy) => policy.member))].map(
+            (member) => `          ...${member}.nomosInternalInvitationPolicies,`
+          ),
           `        ],`,
           `      );`,
         ]
       : []),
     ``,
-    `  /// Mount the one application at the UI boundary and pass [application] down.`,
-    `  ///`,
-    `  /// This is the only application bootstrap tenant code should own.`,
-    `  ///`,
-    `  /// The object supplied to [builder] is the application state. Keep it as the only`,
-    `  /// business-state dependency; do not recreate its records in providers, repositories or caches.`,
-    `  static Widget nomosWidget({`,
-    `    Key? key,`,
-    `    required String cloud,`,
-    `    required String application,`,
-    `    required ApplicationSignIn signIn,`,
-    `    required Widget Function(BuildContext context, ${application} application) builder,`,
-    `    Widget Function(BuildContext context)? loadingBuilder,`,
-    `    Widget Function(BuildContext context, Object error, VoidCallback retry)? errorBuilder,`,
-    `    ApplicationModelChange? onModelChange,`,
-    `    ValueChanged<NomosApplicationStartupState>? onStartupStateChanged,`,
-    `    Duration startupTimeout = const Duration(minutes: 3),`,
-    `  }) => NmsInternalApplicationHost.home<${application}>(`,
-    `    key: key, cloud: cloud, application: application, signIn: signIn,`,
-    ...(hasApplicationFrameworkCalls
-      ? [`    frameworkCalls: nomosInternalApplicationFrameworkCalls,`]
-      : []),
-    `    bind: nomosInternalBind${application}, builder: builder,`,
-    `    loadingBuilder: loadingBuilder, errorBuilder: errorBuilder,`,
-    `    onModelChange: onModelChange,`,
-    `    onStartupStateChanged: onStartupStateChanged,`,
-    `    startupTimeout: startupTimeout,`,
-    `  );`,
+    `  Future<void> close() => _nmsReception.close();`,
     `}`,
     ``,
-    `Future<${application}> nomosInternalBind${application}(`,
-    `  NomosSession session, NmsInternalApplicationUserBinding user,`,
+    `Future<${application}> receive${application}(`,
+    `  NmsReceptionSession reception,`,
     `) async => ${application}._(`,
-    `  nmsSession: session,`,
-    ...(hasInvitations ? [`  nmsUser: user,`] : []),
-    `  currentUser: NmsInternalUsers.create(identityId: user.nmsInternalIdentityId, identityAddress: user.nmsInternalIdentityAddress),`,
+    `  nmsReception: reception,`,
+    `  currentUser: NmsInternalUsers.create(identityId: reception.user.identityId, identityAddress: reception.user.identityAddress),`,
     ...members.map(
       ({ member, application: child, prefix }) =>
-        `  ${member}: await ${prefix}.nomosInternalBind${child}(session, user),`
+        `  ${member}: await ${prefix}.nomosInternalReceive${child}(reception),`
     ),
     `);`,
+    ...(hasApplicationFrameworkCalls
+      ? [
+          ``,
+          `/// Static law vocabulary handed to the fixed Reception office.`,
+          `/// It owns no lifecycle, custody, kernel, credentials, timers, or sync state.`,
+          `final class ${application}Reception implements NmsReceptionContract<${application}> {`,
+          `  const ${application}Reception();`,
+          ``,
+          `  @override`,
+          `  NmsApplicationFrameworkCalls get frameworkCalls => nomosInternalApplicationFrameworkCalls;`,
+          ``,
+          `  @override`,
+          `  Future<${application}> receive(NmsReceptionSession session) => receive${application}(session);`,
+          `}`,
+          ``,
+          `const ${application}Reception ${dartApplicationMember(
+            packageName
+          )}Reception = ${application}Reception();`,
+        ]
+      : []),
     ``,
   ].join("\n");
 }
@@ -2759,7 +3101,8 @@ function cursedNameHints(
 function reconcilePubspec(
   pkgDir: string,
   yaml: string,
-  managedDependencies: Readonly<Record<string, string>> = {}
+  managedDependencies: Readonly<Record<string, string>> = {},
+  retiredDependencies: readonly string[] = []
 ): boolean {
   const p = path.join(pkgDir, "pubspec.yaml");
   if (!existsSync(p)) {
@@ -2767,7 +3110,11 @@ function reconcilePubspec(
     writeFileSync(p, yaml, "utf8");
     return true;
   }
-  if (Object.keys(managedDependencies).length === 0) return false;
+  if (
+    Object.keys(managedDependencies).length === 0 &&
+    retiredDependencies.length === 0
+  )
+    return false;
 
   const source = readFileSync(p, "utf8");
   const trailingNewline = source.endsWith("\n");
@@ -2790,6 +3137,27 @@ function reconcilePubspec(
     dependenciesEnd += 1;
   }
 
+  // Retire dependencies emitted by an older compiler without disturbing any
+  // tenant-owned metadata or unrelated dependency.
+  for (const name of retiredDependencies) {
+    const prefix = `  ${name}:`;
+    const existing = lines.findIndex(
+      (line, index) =>
+        index > dependenciesStart &&
+        index < dependenciesEnd &&
+        line.startsWith(prefix)
+    );
+    if (existing < 0) continue;
+    let nestedEnd = existing + 1;
+    while (
+      nestedEnd < dependenciesEnd &&
+      /^(?: {4,}|\t)/.test(lines[nestedEnd]!)
+    )
+      nestedEnd += 1;
+    lines.splice(existing, nestedEnd - existing);
+    dependenciesEnd -= nestedEnd - existing;
+  }
+
   for (const [name, constraint] of Object.entries(managedDependencies)) {
     const prefix = `  ${name}:`;
     const existing = lines.findIndex(
@@ -2869,6 +3237,34 @@ function reconcileGeneratedLawAsset(
   return true;
 }
 
+/** Remove compiler-owned law assets from a generated client package.
+ * Workspace law is rolled out by its cloud host/operator; a consumer must not
+ * carry a candidate capable of mutating shared custody during application open. */
+function removeGeneratedClientLawAssets(pkgDir: string): boolean {
+  const p = path.join(pkgDir, "pubspec.yaml");
+  if (!existsSync(p)) return false;
+  const source = readFileSync(p, "utf8");
+  const withoutGeneratedAssets = source
+    .split(/(?<=\n)/)
+    .filter(
+      (line) =>
+        !/^\s+-\s+lib\/src\/generated\/[^\s]+\.(?:deploy\.json|law\.usdz)\s*$/.test(
+          line.trimEnd()
+        )
+    )
+    .join("");
+  // A previously generated client may contain no tenant Flutter settings once
+  // its embedded law is removed. Do not leave an empty `assets:` mapping: it
+  // is invalid pubspec YAML and makes the generated package fail analysis.
+  const next = withoutGeneratedAssets.replace(
+    /(?:^|\n)flutter:\s*\n\s{2}assets:\s*\n?$/,
+    "\n"
+  );
+  if (next === source) return false;
+  writeFileSync(p, next, "utf8");
+  return true;
+}
+
 /**
  * THE LAYERED-PACKAGES EMIT (`dart.packages`) — three sibling pub packages under `dartOut`:
  * `<types>/` (pure data, depends only on `nomos_types`), `<client>/` (effectful runtime clients,
@@ -2895,7 +3291,6 @@ function emitDartPackages(
     readonly barrelExports?: "all" | "explicit";
   },
   names: Readonly<Record<string, string>> | undefined,
-  compat?: NomosCompat,
   describePackageName = packages.client,
   lawUsdzPath?: string,
   applicationMaxChildWorkspacesPerUser?: number,
@@ -2917,7 +3312,7 @@ function emitDartPackages(
     ...(packages.compat !== undefined ? [packages.compat] : []),
   ];
   if (new Set(roleNames).size !== roleNames.length)
-    fail(`dart.packages: types/client/test/compat names must be distinct`);
+    fail(`dart.packages: types/peer-office/test/compat names must be distinct`);
 
   const packageContracts = collectPackageContracts(modules);
   const describeModel = buildNomosDescribeModel(modules, describePackageName);
@@ -2938,7 +3333,7 @@ function emitDartPackages(
   const typesSources = new Map<string, string>(); // fileBase → src (for alias validation + purity)
   // The SIBLING generated type files a types-package file MAY import (a cross-domain `t.foreignRef` types its
   // field as the target aggregate's class, which lives in the target domain's file). A sibling types file is
-  // still PURE (no runtime/bridge surface — the purity gate exists to keep nomos_client out, not to isolate
+  // still PURE (no runtime/session surface — the purity gate exists to keep nomos_client out, not to isolate
   // domain files from each other; Dart allows type-import cycles for mutual refs).
   const siblingTypeFiles = new Set<string>([
     ...modules.map((m) => `${m.name}.dart`),
@@ -2954,14 +3349,14 @@ function emitDartPackages(
     }
     const pure = src.replace(DART_PACKAGE_IMPORT, dartTypesImportFor(src));
     // PURITY, fail-closed: only the nomos_types barrel, the framework file, and SIBLING generated type files
-    // (cross-domain foreignRef targets) may be imported. Runtime/bridge surfaces (nomos_client) stay out.
+    // (cross-domain foreignRef targets) may be imported. Runtime/session surfaces (nomos_client) stay out.
     for (const line of pure.split("\n")) {
       const m = /^import\s+'([^']+)'/.exec(line.trim());
       if (
         m !== null &&
         // `dart:*` is a pure SDK library (dart:convert for jsonEncode of a json field, dart:math, …) — it
         // carries NO cross-PACKAGE coupling, which is the only thing this gate exists to prevent. The
-        // purpose is keeping nomos_client (the runtime/bridge surface) out of the pure types layer, not
+        // purpose is keeping nomos_client (the runtime/session surface) out of the pure types layer, not
         // banning the Dart SDK. Allow every dart:* import; keep the cross-package allowlist otherwise.
         !m[1]!.startsWith("dart:") &&
         m[1] !== "package:nomos_types/nomos_types.dart" &&
@@ -3214,7 +3609,7 @@ function emitDartPackages(
   const typesBarrel = [
     "// GENERATED by nomos-compile — the TYPES package's public entrypoint. DO NOT EDIT.",
     "// Pure data: payload classes, read models, VOs/enums, typed read accessors over the",
-    "// injected NomosReads seams. Frontend-safe — no bridge, no sessions, no lifecycle.",
+    "// injected NomosReads seams. Frontend-safe — no session, no sessions, no lifecycle.",
     "library;",
     "",
     ...explicitBarrelNote,
@@ -3241,7 +3636,7 @@ function emitDartPackages(
     pkgDir(packages.types),
     [
       `name: ${packages.types}`,
-      `description: Generated Nomos domain TYPES — pure data, frontend-safe (no bridge, no runtime).`,
+      `description: Generated Nomos domain TYPES — pure data, frontend-safe (no session, no runtime).`,
       `version: 0.1.0`,
       `publish_to: none # tenant-owned: remove to publish`,
       `environment:`,
@@ -3255,6 +3650,21 @@ function emitDartPackages(
 
   // ── the CLIENT package — effectful runtime, depends on types + nomos_client ──
   const clientGen = freshGenDir(packages.client);
+  const operationProtoModules = [
+    ...new Map(
+      [...modules, ...frameworkModules].map(
+        (module) => [module.name, module] as const
+      )
+    ).values(),
+  ];
+  written.push(
+    ...emitDartOperationProto(
+      clientGen,
+      operationProtoModules,
+      lawGraphs,
+      lawPaths
+    )
+  );
   const applicationFrameworkCallsFile = "application.framework_calls";
   const applicationFrameworkCallsSource = generateDartApplicationFrameworkCalls(
     frameworkModules.flatMap((module) => {
@@ -3263,8 +3673,21 @@ function emitDartPackages(
       return graph === undefined || paths === undefined
         ? []
         : [{ module, graph, paths }];
-    })
+    }),
+    { lawSha256: domainHash }
   );
+  const workspaceAccessReadImports = new Map<string, string>();
+    for (const module of operationProtoModules) {
+      const graph = lawGraphs.get(module.name);
+      const paths = lawPaths.get(module.name);
+      if (graph === undefined || paths === undefined) continue;
+      if (!graph.nodes.some(node => node.kind === "read" && node.entity.label === "receivedWorkspaceAccess")) continue;
+      const file = `${module.name}.workspace_access.dart`;
+      const target = path.join(clientGen, file);
+      writeFileSync(target, generateDartWorkspaceAccessRead(graph, paths), "utf8");
+      written.push(target);
+      workspaceAccessReadImports.set(module.name, file);
+    }
   if (applicationFrameworkCallsSource !== undefined) {
     const applicationFrameworkCallsPath = path.join(
       clientGen,
@@ -3278,18 +3701,6 @@ function emitDartPackages(
     written.push(applicationFrameworkCallsPath);
   }
   const embeddedLawName = `${describePackageName}.law.usdz`;
-  const applicationLawPath =
-    lawUsdzPath === undefined
-      ? undefined
-      : path.join(clientGen, embeddedLawName);
-  if (applicationLawPath !== undefined) {
-    copyFileSync(lawUsdzPath!, applicationLawPath);
-    written.push(applicationLawPath);
-  }
-  const applicationLawAssetKey =
-    applicationLawPath === undefined
-      ? undefined
-      : `packages/${packages.client}/lib/${genRel}/${embeddedLawName}`;
   const typesImportUri = `package:${packages.types}/${packages.types}.dart`;
   const implementationTypeImports = explicitBarrel
     ? modules.map((m) => `package:${packages.types}/${genRel}/${m.name}.dart`)
@@ -3310,18 +3721,15 @@ function emitDartPackages(
               name !== OwnedDeviceRequestValue.name
           );
   for (const { mod, dd } of perDomain) {
+    const workspaceAccessReadImportUri = workspaceAccessReadImports.get(mod.name);
     const makeClient = (imports: readonly string[]) =>
-      generateDartBridgeClient(dd.modForDart, {
+      generateDartDomainClient(dd.modForDart, {
         domainHash,
         callUsda: {
           graph: lawGraphs.get(mod.name)!,
           paths: lawPaths.get(mod.name)!,
         },
-        ...(applicationLawAssetKey !== undefined
-          ? { lawAssetKey: applicationLawAssetKey }
-          : {}),
         interface: packageInterface[dd.modForDart.domain ?? dd.modForDart.name],
-        ...(compat !== undefined ? { compat } : {}),
         supportImport: "package",
         typesImportUri,
         emitActivity: true,
@@ -3336,6 +3744,7 @@ function emitDartPackages(
     const makeApplication = (imports: readonly string[]) =>
       generateDartApplication(dd.modForDart, {
         supportImport: "package",
+        callUsda: { graph: lawGraphs.get(mod.name)!, paths: lawPaths.get(mod.name)! },
         typesImportUri,
         packageAggregateDomains: buildPackageAggregateDomains(modules),
         flutterHost: true,
@@ -3345,6 +3754,9 @@ function emitDartPackages(
           : {
               applicationFrameworkCallsImportUri: `${applicationFrameworkCallsFile}.dart`,
             }),
+        ...(workspaceAccessReadImportUri === undefined
+          ? {}
+          : { workspaceAccessReadImportUri }),
         ...(imports.length > 0 ? { explicitTypeImports: imports } : {}),
       });
     let clientSrc = makeClient(implementationTypeImports);
@@ -3377,7 +3789,7 @@ function emitDartPackages(
       applicationSrc,
       clientFile,
       applicationFile,
-      new Set(dartApplicationPublicClassNames(dd.modForDart))
+      new Set(dartApplicationPublicClassNames(dd.modForDart, { callUsda: { graph: lawGraphs.get(mod.name)!, paths: lawPaths.get(mod.name)! } }))
     );
     const cp = path.join(clientGen, clientFile);
     writeFileSync(cp, encapsulated.clientPart, "utf8");
@@ -3413,7 +3825,7 @@ function emitDartPackages(
         })),
         topology.homeDomain,
         topology.rootDomains,
-        topology.remoteDomains,
+        topology.parentWorkspaceDomains,
         applicationFrameworkCallsSource !== undefined
       ),
       "utf8"
@@ -3424,10 +3836,8 @@ function emitDartPackages(
     "// GENERATED by nomos-compile — the CLIENT package's public entrypoint. DO NOT EDIT.",
     `/// The generated business application for ${describePackageName}.`,
     `///`,
-    `/// Import this library, mount [${dartApplicationClassName(
-      describePackageName
-    )}.nomosWidget] once, and pass the`,
-    `/// supplied [${dartApplicationClassName(
+    `/// Import this library, bind one Peer Office handle, and pass the supplied`,
+    `/// [${dartApplicationClassName(
       describePackageName
     )}] through the UI. Its typed actions, records,`,
     `/// watches, references and status are the canonical application state. Do not recreate them`,
@@ -3439,7 +3849,7 @@ function emitDartPackages(
     "library;",
     "",
     `export 'package:${packages.types}/${genRel}/${businessSharedFile}';`,
-    `export 'package:nomos_flutter/src/generated_application_host.dart' show ApplicationModelApproval, ApplicationModelDecision, ApplicationModelPolicy, ApplicationModelReview, ApplicationWorkspaceOpenProgress, NomosApplicationStartupPhase, NomosApplicationStartupState, NomosApplicationStartupTimeout, NomosWorkspaceOpenTimeout;`,
+    `export 'package:nomos_client/src/workspace_open_progress.dart' show ApplicationWorkspaceOpenProgress;`,
     `export 'package:nomos_types/nomos_types.dart' show CustodyError, CustodyPhase, CustodySource, NomosRecommendedAction;`,
     ...tenantTypesExportKeys
       .map((file) => {
@@ -3460,14 +3870,23 @@ function emitDartPackages(
       : []),
     ...(perDomain.length > 1
       ? [
-          `export 'package:nomos_flutter/src/application_status.dart' show ApplicationSignIn, ApplicationStatus, ApplicationStatusPhase;`,
+          `export 'package:nomos_client/src/application_status.dart' show ApplicationStatus, ApplicationStatusPhase;`,
           `export '${genRel}/${packageApplicationFile}.dart' show ${dartApplicationClassName(
             describePackageName
-          )};`,
+          )}${
+            applicationFrameworkCallsSource === undefined
+              ? ""
+              : `, ${dartApplicationClassName(
+                  describePackageName
+                )}Reception, ${dartApplicationMember(
+                  describePackageName
+                )}Reception`
+          };`,
           ...perDomain.map(({ mod, dd }) => {
             const packageClass = dartApplicationClassName(describePackageName);
             const publicNames = dartApplicationPublicClassNames(
-              dd.modForDart
+              dd.modForDart,
+              { callUsda: { graph: lawGraphs.get(mod.name)!, paths: lawPaths.get(mod.name)! } }
             ).filter((name) => name !== packageClass);
             return `export '${genRel}/${
               mod.name
@@ -3480,7 +3899,7 @@ function emitDartPackages(
               mod.name
             }.application.dart' show ${dartApplicationPublicClassNames(
               dd.modForDart,
-              { tenantRoot: true }
+              { tenantRoot: true, callUsda: { graph: lawGraphs.get(mod.name)!, paths: lawPaths.get(mod.name)! } }
             ).join(", ")};`
         )),
     "",
@@ -3501,27 +3920,22 @@ function emitDartPackages(
       `publish_to: none # tenant-owned: remove to publish`,
       `environment:`,
       `  sdk: ^3.5.0`,
-      `  flutter: ">=3.10.0"`,
       `dependencies:`,
-      `  flutter:`,
-      `    sdk: flutter`,
       `  nomos_client: ${NOMOS_CLIENT_DEP}`,
-      `  nomos_flutter: ${NOMOS_FLUTTER_DEP}`,
+      `  protobuf: ^5.0.0`,
+      `  fixnum: ^1.1.1`,
       `  ${packages.types}:`,
       `    path: ../${packages.types} # co-emitted sibling; replace with a hosted constraint when publishing`,
-      ...(applicationLawPath === undefined
-        ? []
-        : [`flutter:`, `  assets:`, `    - lib/${genRel}/${embeddedLawName}`]),
       ``,
     ].join("\n"),
-    { nomos_client: NOMOS_CLIENT_DEP, nomos_flutter: NOMOS_FLUTTER_DEP }
+    {
+      nomos_client: NOMOS_CLIENT_DEP,
+      protobuf: "^5.0.0",
+      fixnum: "^1.1.1",
+    },
+    ["flutter", "nomos_flutter"]
   );
-  if (applicationLawPath !== undefined) {
-    reconcileGeneratedLawAsset(
-      pkgDir(packages.client),
-      `lib/${genRel}/${embeddedLawName}`
-    );
-  }
+  removeGeneratedClientLawAssets(pkgDir(packages.client));
 
   // ── the TEST package (optional) — generated business scenarios, test-only dependency ──
   if (packages.test !== undefined) {
@@ -3726,6 +4140,45 @@ function emitDartPackages(
 
 // ── main ──────────────────────────────────────────────────────────────────────────
 
+/**
+ * Fail unless the `@githolon/dsl` the law in `lawDir` resolves is this compiler's own module instance:
+ * the same package directory, and the same loaded module (namespace identity), so the law and the
+ * compiler share one authoring drain and one endorsement registry.
+ */
+async function assertOneDslInstance(lawDir: string): Promise<void> {
+  const ownPackage = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "package.json");
+  let lawPackage: string;
+  let lawEntry: string;
+  try {
+    const lawRequire = createRequire(pathToFileURL(path.join(lawDir, "noop.js")));
+    lawPackage = realpathSync(lawRequire.resolve("@githolon/dsl/package.json"));
+    lawEntry = realpathSync(path.join(path.dirname(lawPackage), "src", "index.ts"));
+  } catch {
+    // The law cannot resolve the DSL by name (a workspace law importing framework sources by path):
+    // the compiler's own instance is the only one its modules can reach.
+    return;
+  }
+  const versionOf = (file: string): string => {
+    try {
+      return (JSON.parse(readFileSync(file, "utf8")) as { version?: string }).version ?? "?";
+    } catch {
+      return "?";
+    }
+  };
+  const split = (why: string): never =>
+    fail(
+      `TWO @githolon/dsl instances (${why}): the law resolves ${versionOf(lawPackage)} at ` +
+        `${path.dirname(lawPackage)}, this compiler runs ${versionOf(ownPackage)} at ${path.dirname(ownPackage)}. ` +
+        `Split instances split the DSL's registries, so plan probes come back empty and authority flows are not ` +
+        `harvested: the law would compile weaker than written. Run the law package's own \`npx githolon compile\`, ` +
+        `or make its @githolon/dsl resolve to this compiler's.`
+    );
+  if (realpathSync(ownPackage) !== lawPackage) split("two package directories");
+  const own = await import(pathToFileURL(realpathSync(fileURLToPath(new URL("./index.ts", import.meta.url)))).href);
+  const law = await import(pathToFileURL(lawEntry).href);
+  if (own !== law) split("two loaded module instances");
+}
+
 async function main(): Promise<void> {
   const argv = process.argv.slice(2);
   const supportedFlags = new Set([
@@ -3733,6 +4186,8 @@ async function main(): Promise<void> {
     "--compact",
     "--analyze",
     "--preflight",
+    "--inspect-sqlite",
+    "--inspect-law",
   ]);
   for (const flag of argv.filter((arg) => arg.startsWith("--"))) {
     if (supportedFlags.has(flag)) continue;
@@ -3755,6 +4210,15 @@ async function main(): Promise<void> {
   // spends minutes producing artifacts that will immediately be discarded.
   const preflightFlag =
     argv.includes("--preflight") || process.env.NOMOS_PREFLIGHT === "1";
+  const sqliteInspection = argv.includes("--inspect-sqlite");
+  const lawInspection = argv.includes("--inspect-law");
+  const graphInspection = sqliteInspection || lawInspection;
+  if (graphInspection && preflightFlag) {
+    fail("graph inspection requires the typed graph; do not combine it with --preflight");
+  }
+  if (sqliteInspection && lawInspection) {
+    fail("select one graph inspection: --inspect-law or --inspect-sqlite");
+  }
   // §"Shipped (1–4)" follow-up: `githolon compile --analyze` (or NOMOS_ANALYZE=1) runs
   // `dart analyze` on the generated Dart package after emission and fails the compile on red.
   const analyzeFlag =
@@ -3763,51 +4227,45 @@ async function main(): Promise<void> {
   const configPath = path.resolve(process.cwd(), configArg);
   if (!existsSync(configPath)) fail(`config not found: ${configPath}`);
   const cfgDir = path.dirname(configPath);
-
-  // DUAL-INSTANCE GUARD (DX): the law's `import "@githolon/dsl"` resolves from the LAW's own node_modules,
-  // while this compiler runs from wherever it was invoked. Two DIFFERENT dsl instances silently split every
-  // module-level registry (the fluent-authoring drain, brands, markers) — plans probe empty, lints
-  // false-fire, ids drift. Detect the skew and WARN LOUDLY with the two paths (never fail — a
-  // deliberately-vendored setup may be intentional, and same-version split instances still work for
-  // compilation itself, which imports the law through the compiler's own module graph).
-  try {
-    const lawReq = createRequire(pathToFileURL(path.join(cfgDir, "noop.js")));
-    const lawDslPkg = lawReq.resolve("@githolon/dsl/package.json");
-    const ownDslPkg = path.join(
-      path.dirname(fileURLToPath(import.meta.url)),
-      "..",
-      "package.json"
-    );
-    if (path.resolve(lawDslPkg) !== path.resolve(ownDslPkg)) {
-      const vOf = (p: string): string => {
-        try {
-          return (
-            (JSON.parse(readFileSync(p, "utf8")) as { version?: string })
-              .version ?? "?"
-          );
-        } catch {
-          return "?";
-        }
-      };
-      console.error(
-        `⚠ nomos-compile: TWO @githolon/dsl instances — the law resolves ${vOf(
-          lawDslPkg
-        )} at ${path.dirname(lawDslPkg)}, but this compiler runs ${vOf(
-          path.resolve(ownDslPkg)
-        )} at ${path.dirname(path.resolve(ownDslPkg))}. ` +
-          `Split instances split the DSL's module registries (phantom lint errors, empty plan probes, id drift) — even at the same version string when the code differs. ` +
-          `Run the law package's OWN \`npx githolon compile\`, or align the two installs.`
-      );
-    }
-  } catch {
-    /* no dsl resolvable from the law dir (vendored/workspace setups) — nothing to compare */
+  const timing = process.env.NOMOS_COMPILE_TIMING === "1";
+  const timingStart = performance.now();
+  let timingLast = timingStart;
+  const stage = (label: string): void => {
+    if (!timing) return;
+    const now = performance.now();
+    console.error(
+      `[nomos-timing] ${label.padEnd(36)} +${((now - timingLast) / 1000)
+        .toFixed(3)
+        .padStart(6)}s   t=${((now - timingStart) / 1000).toFixed(3)}s`
+    );
+    timingLast = now;
+  };
+  if (timing) {
+    console.error(
+      `[nomos-timing] ${"process boot → main()".padEnd(36)} +${(
+        timingStart / 1000
+      )
+        .toFixed(3)
+        .padStart(6)}s`
+    );
   }
 
+  // ONE DSL INSTANCE, OR NO COMPILE. The law's `import "@githolon/dsl"` resolves from the LAW's own
+  // node_modules, while this compiler runs from wherever it was invoked. Two instances split every
+  // module-level registry (the fluent-authoring drain, the endorsement records, brands): plan probes come
+  // back empty, authority flows are silently not harvested, and the compiled law is weaker than the one
+  // written. That is a different law, so it is an error, never a warning.
+  await assertOneDslInstance(cfgDir);
+
   const cfgModule = (await import(pathToFileURL(configPath).href)) as {
     default?: unknown;
   };
   const configValue = cfgModule.default;
+  stage("config import");
   if (isApplicationCompositionConfig(configValue)) {
+    if (graphInspection) {
+      fail("graph inspection requires a law package, not an application composition; nothing was emitted");
+    }
     try {
       const emitted = compileApplicationComposition(configValue, configPath, {
         requireUsdcat,
@@ -3949,6 +4407,7 @@ async function main(): Promise<void> {
       applicationBirthPolicyDomains.push(domain.key);
     }
   }
+  stage("domain discovery imports");
   if (
     cfg.application?.homeGenesis !== undefined &&
     applicationHomeGenesisSource === undefined
@@ -3980,7 +4439,11 @@ async function main(): Promise<void> {
         ]),
   ];
 
-  const outDir = path.resolve(cfgDir, cfg.outDir ?? "build");
+  // Inspection executes normal declaration/composition/identity resolution but
+  // NEVER cleans tenant build output, writes its identity, or emits a release.
+  const outDir = graphInspection
+    ? mkdtempSync(path.join(tmpdir(), lawInspection ? "nomos-law-inspect-" : "nomos-sqlite-inspect-"))
+    : path.resolve(cfgDir, cfg.outDir ?? "build");
   mkdirSync(outDir, { recursive: true });
   // Interrupted pre-cutover compiles left thousands of private source/probe files beside public
   // artifacts. They are neither custody nor diagnostics; clear only the compiler-owned namespace.
@@ -4058,6 +4521,7 @@ async function main(): Promise<void> {
   const nativeWorkspaceInvariantReadIds = new Set<string>();
   const routingInput: Record<string, Mod[]> = {};
   const domainModules: DomainModule[] = [];
+  const custodyPlacementDeclarations: DomainCustodyPlacement[] = [];
   const directiveExportSources: Array<{
     readonly directive: object;
     readonly domainKey: string;
@@ -4170,6 +4634,10 @@ async function main(): Promise<void> {
         exportName: string;
       }
     >();
+    const sharingRedeems: Array<{
+      readonly directive: object & { readonly id: string };
+      readonly modulePath: string;
+    }> = [];
     for (const rel of d.modules) {
       const abs = path.resolve(cfgDir, rel);
       if (isEvolutionModulePath(abs)) {
@@ -4210,6 +4678,19 @@ async function main(): Promise<void> {
             aggregateId: (value as { aggregateId: string }).aggregateId,
           });
         }
+        // A `workspaceSharing(...)` policy LOWERS an invitation-redeem directive that carries a
+        // workspace effect (it publishes the received access into the recipient's Home). Collect
+        // them here and register after the whole domain is loaded — a tenant MAY also export the
+        // same object directly (`export const redeem = sharing.invitationLaw.redeem`), and two
+        // entries for one directive is the same refusal as none.
+        if (isApplicationLanguage(value)) {
+          for (const policy of value.workspaceSharing) {
+            sharingRedeems.push({
+              directive: policy.invitationLaw.redeem,
+              modulePath: abs,
+            });
+          }
+        }
         // `birth(Aggregate)` is intentionally a high-level declaration. Its public parent birth and
         // private child seed are compiler-lowered executable offers, so preserve their authored
         // symbol origin here rather than condemning both to the whole-domain fallback plan.
@@ -4239,6 +4720,26 @@ async function main(): Promise<void> {
         }
       }
     }
+    // The lowered redeem has no authored export of its own — `withWorkspaceSharingInvitationExports`
+    // folds it into the merged bag under a synthetic name so custody and the executable engine
+    // registry see the one seam. Register that same synthetic name, or the workspace effect it
+    // carries resolves to zero configured exports and the compile refuses law the tenant never
+    // wrote, with an instruction ("export it once") they cannot follow.
+    for (const redeem of sharingRedeems) {
+      if (
+        directiveExportSources.some(
+          (candidate) => candidate.directive === redeem.directive
+        )
+      )
+        continue;
+      directiveExportSources.push({
+        directive: redeem.directive,
+        domainKey: d.key,
+        graphName: d.name ?? d.key,
+        modulePath: redeem.modulePath,
+        exportName: `__nomosWorkspaceSharingDirective:${redeem.directive.id}`,
+      });
+    }
     const configuredPaths = new Set(
       d.modules.map((rel) => path.resolve(cfgDir, rel))
     );
@@ -4272,19 +4773,58 @@ async function main(): Promise<void> {
         );
       }
       const homeGenesis = cfg.application?.homeGenesis;
-      const homeParentWorkspaceRoles =
-        cfg.application?.parentWorkspaceRoles ?? [];
+      const receivingGroupRecovery = cfg.application?.receivingGroup?.recovery;
       const policyMod = applicationHomePolicyLaw(
         max,
         applicationBirthPolicyDomains,
         homeGenesis,
-        homeParentWorkspaceRoles,
+        receivingGroupRecovery,
       ) as Mod;
       mods.push(policyMod);
-      const homeGenesisExpr = applicationHomeGenesisSource === undefined
-        ? "undefined"
-        : `require(${JSON.stringify(applicationHomeGenesisSource.modulePath)})` +
-          `[${JSON.stringify(applicationHomeGenesisSource.exportName)}]`;
+      // The composed policy law composes the framework's child-authentication singletons into THIS
+      // domain (`childAuthenticationExports`). Each is a module-level export of
+      // `framework/child_authentication.ts`, so it is a declaration export of this domain exactly like an
+      // authored module export: the workspace effects it authors (verifier-epoch pair, child repair) resolve
+      // to one owning domain, and the runtime target encoder can `require` the very object by name.
+      // The receiving-group recovery door (`receivingGroupRecoveryLaw`, composed only under the declared
+      // `platform-identity-provider` posture) is registered the same way: its members are module-level
+      // singletons of `framework/receiving_group_recovery.ts`, never function-scoped copies.
+      const composedPolicyValues = new Set(Object.values(policyMod));
+      const registeredComposedDirectives = new Set<object>();
+      for (const [modulePath, frameworkModule] of [
+        [CHILD_AUTHENTICATION_MODULE_PATH, childAuthenticationModule],
+        [RECEIVING_GROUP_RECOVERY_MODULE_PATH, receivingGroupRecoveryModule],
+        [MODEL_TRANSITION_MODULE_PATH, modelTransitionModule],
+        [MODEL_AUTHORITY_REPAIR_MODULE_PATH, modelAuthorityRepairModule],
+      ] as const) {
+        for (const [exportName, value] of Object.entries(frameworkModule)) {
+          if (
+            composedPolicyValues.has(value) &&
+            value !== null &&
+            typeof value === "object" &&
+            typeof (value as { id?: unknown }).id === "string" &&
+            typeof (value as { plan?: unknown }).plan === "function" &&
+            typeof (value as { aggregateId?: unknown }).aggregateId === "string" &&
+            !registeredComposedDirectives.has(value)
+          ) {
+            registeredComposedDirectives.add(value);
+            directiveExportSources.push({
+              directive: value,
+              domainKey: d.key,
+              graphName: d.name ?? d.key,
+              modulePath,
+              exportName,
+            });
+          }
+        }
+      }
+      const homeGenesisExpr =
+        applicationHomeGenesisSource === undefined
+          ? "undefined"
+          : `require(${JSON.stringify(
+              applicationHomeGenesisSource.modulePath
+            )})` +
+            `[${JSON.stringify(applicationHomeGenesisSource.exportName)}]`;
       sourceExprs.push(
         `() => require(${JSON.stringify(
           path.join(DSL_DIR, "src", "framework", "application_home.ts")
@@ -4292,7 +4832,10 @@ async function main(): Promise<void> {
           `.applicationHomePolicyLaw(` +
           `${JSON.stringify(max)}, ${JSON.stringify(
             applicationBirthPolicyDomains
-          )}, ${homeGenesisExpr}, ${JSON.stringify(homeParentWorkspaceRoles)})`
+          )}, ${homeGenesisExpr}` +
+          // A declared posture rides the re-emitted source as a JSON string; an undeclared one is
+          // omitted (not `undefined`), keeping the emitted expression byte-identical for older packages.
+          `${receivingGroupRecovery === undefined ? "" : `, ${JSON.stringify(receivingGroupRecovery)}`})`
       );
     }
     let merged: Mod = {};
@@ -4315,6 +4858,19 @@ async function main(): Promise<void> {
     // `relationType("workspace")` (the same seam composeDomainModule expands) so this plane's openapi /
     // relation-schema discovery sees the grant/revoke/seed directives + the teeth-bearing schema.
     merged = expandRoleExports(merged);
+
+    // Placement is intentionally discovered beside law, never composed into it.
+    // The compiler ships these typed options as a separate finished good. A
+    // workspace must explicitly adopt one on its placement frontier; installing
+    // or evolving main law can therefore never relocate custody as a side effect.
+    for (const declaration of Object.values(merged).filter(
+      isCustodyPlacementDeclaration
+    ) as CustodyPlacementDeclaration[]) {
+      custodyPlacementDeclarations.push({
+        domain: d.key,
+        declaration,
+      });
+    }
     let shardingSums: AnySum[] = [];
     let shardingMins: AnyExtremum[] = [];
     let shardingMaxes: AnyExtremum[] = [];
@@ -4561,7 +5117,14 @@ async function main(): Promise<void> {
         usesRelations &&
         !queries.some((q) => q.id === relationTuplesByObject.id)
       ) {
-        queries.push(relationTuplesByObject);
+        // The audit query is framework law carried by the package, not tenant
+        // application vocabulary. Keep it available to the Peer Office while
+        // preventing the generated reception facade from treating it as a
+        // public realm member.
+        queries.push({
+          ...relationTuplesByObject,
+          businessBirthInternal: true,
+        } as QueryDecl);
       }
     }
     const counts = [
@@ -4623,14 +5186,25 @@ async function main(): Promise<void> {
         ...shardingSums,
       ]),
     ];
-    const mins = [
+    const extrema = discover<AnyExtremum>(merged, isExtremumDecl);
+    const exists_ = [...new Set([
+      ...discover<AnyExists>(merged, isExistsDecl),
+      ...resolveNamed<AnyExists>(merged, d.exists_, "exists_"),
+    ])];
+    const orderedReads = [...new Set([
+      ...discover<OrderedReadDecl>(merged, isOrderedReadDecl),
+      ...resolveNamed<OrderedReadDecl>(merged, d.orderedReads, "orderedReads"),
+    ])];
+    const mins = [...new Set([
+      ...extrema.filter((read) => read.kind === "min"),
       ...resolveNamed<AnyExtremum>(merged, d.mins, "mins"),
       ...shardingMins,
-    ];
-    const maxes = [
+    ])];
+    const maxes = [...new Set([
+      ...extrema.filter((read) => read.kind === "max"),
       ...resolveNamed<AnyExtremum>(merged, d.maxes, "maxes"),
       ...shardingMaxes,
-    ];
+    ])];
     // `capability()` declarations AUTO-DISCOVER (the marketplace lane, M2 —
     // "declare ONE thing"); the config-named lane stays for hand-rolled
     // impureCapability quartets. Deduped by task-aggregate id (a config-named
@@ -4679,6 +5253,8 @@ async function main(): Promise<void> {
         ...(sums.length > 0 ? { sums } : {}),
         ...(mins.length > 0 ? { mins } : {}),
         ...(maxes.length > 0 ? { maxes } : {}),
+        ...(exists_.length > 0 ? { exists_ } : {}),
+        ...(orderedReads.length > 0 ? { orderedReads } : {}),
         ...(workspaceTypes.length > 0 ? { workspaceTypes } : {}),
         ...(workspaceInvariants.length > 0 ? { workspaceInvariants } : {}),
         // Relation declarations are already present in `modules` (including config-named exports), and
@@ -4716,12 +5292,25 @@ async function main(): Promise<void> {
         executableDirectives.map((directive) => [directive.id, directive])
       )
     );
+    const publicIntentSourceFor = (directiveId: string) => {
+      const publicIntent = (composed.applicationIntents ?? []).find(
+        (intent) =>
+          isBusinessIntent(intent) &&
+          intent.steps.length === 1 &&
+          intent.steps[0]?.directive.id === directiveId
+      );
+      return (
+        directOfferExports.get(publicIntent?.id ?? directiveId) ??
+        directOfferExports.get(directiveId)
+      );
+    };
     offerSourceExportsByDomain.set(
       d.key,
       new Map(
-        [...directOfferExports].filter(([directiveId]) =>
-          executableDirectiveIds.includes(directiveId)
-        )
+        executableDirectiveIds.flatMap((directiveId) => {
+          const source = publicIntentSourceFor(directiveId);
+          return source === undefined ? [] : [[directiveId, source] as const];
+        })
       )
     );
     const invariantSources = new Map<
@@ -4765,8 +5354,8 @@ async function main(): Promise<void> {
 
     // ── THE SELF-DESCRIBE DECLS (G1): the FINISHED plain read/maintenance decls the lump's
     //    `describe` reconstructs the openapi fragment from. Directives + aggregates are read from
-    //    the live module exports IN the lump; these ride alongside (mins/maxes are config-named +
-    //    sharding sums are framework-appended — not shape-rediscoverable). Omit-when-empty so a
+    //    the live module exports IN the lump; these ride alongside (sharding reads are
+    //    framework-appended — not shape-rediscoverable). Omit-when-empty so a
     //    decl-free domain contributes nothing (and offers still derive from its directives).
     {
       const declsForDomain: Record<string, unknown[]> = {};
@@ -4783,6 +5372,10 @@ async function main(): Promise<void> {
         declsForDomain.mins = mins.map((e) => finishExtremum(e));
       if (maxes.length > 0)
         declsForDomain.maxes = maxes.map((e) => finishExtremum(e));
+      if (exists_.length > 0)
+        declsForDomain.exists_ = exists_.map(finishExists);
+      if (orderedReads.length > 0)
+        declsForDomain.orderedReads = orderedReads;
       if (spatials.length > 0)
         declsForDomain.spatials = spatials.map((s) => ({
           id: s.id,
@@ -4871,6 +5464,22 @@ async function main(): Promise<void> {
     }
   }
 
+  const custodyPlacementDeclarationsPath = path.join(
+    outDir,
+    `${cfg.name}.custody-placement.usda`
+  );
+  if (custodyPlacementDeclarations.length > 0) {
+    writeFileSync(
+      custodyPlacementDeclarationsPath,
+      custodyPlacementDeclarationsUsda(custodyPlacementDeclarations),
+      "utf8"
+    );
+  } else {
+    // A recompile after declarations are removed must not leave an apparently
+    // current operational-policy artifact beside the package.
+    rmSync(custodyPlacementDeclarationsPath, { force: true });
+  }
+
   const dependencyUseFindings = packageDependencyUsageFindings({
     packageName: cfg.name,
     exportedDomains: cfg.domains.map((domain) => domain.key),
@@ -4903,6 +5512,20 @@ async function main(): Promise<void> {
   // custody emission. A statically invalid package should fail in seconds and must never leave a
   // plausible deployable artifact behind merely because the runtime representation changed shape.
   const authorTimeFindings = checkDomainModules(domainModules);
+  // Framework machinery composed into an application is not that application's business law: the private
+  // receiving group, nomos_internal_ ids, and every directive a birth-capable law received from the framework
+  // (marked businessBirthInternal). Their refusals still surface, as private refusals, below.
+  const frameworkComposedDirectives = new Set(domainModules.flatMap((mod) =>
+    (mod.directives as readonly { readonly id: string; readonly businessBirthInternal?: unknown }[])
+      .filter((directive) => directive.businessBirthInternal === true)
+      .map((directive) => `${mod.domain ?? mod.name}\0${directive.id}`)));
+  const isFrameworkAuthorTimeFinding = (
+    finding: (typeof authorTimeFindings)[number]
+  ) =>
+    finding.domain === APPLICATION_HOME_DOMAIN ||
+    finding.directiveId?.startsWith("nomos_internal_") === true ||
+    (finding.directiveId !== undefined &&
+      frameworkComposedDirectives.has(`${finding.domain}\0${finding.directiveId}`));
   // Self-description is a compiler-owned presentation projection, not executable law. Build it
   // once from the same composed modules and place it only in the separately routed describe plan;
   // exact offer/read plans must not carry OpenAPI generation and Zod JSON-Schema machinery.
@@ -4915,9 +5538,7 @@ async function main(): Promise<void> {
 
   if (preflightFlag) {
     const businessFindings = authorTimeFindings.filter(
-      (finding) =>
-        finding.domain !== APPLICATION_HOME_DOMAIN &&
-        finding.directiveId?.startsWith("nomos_internal_") !== true
+      (finding) => !isFrameworkAuthorTimeFinding(finding)
     );
     console.log(
       `nomos-preflight: ${cfg.name} (${domainModules.length} domain(s))`
@@ -4943,11 +5564,6 @@ async function main(): Promise<void> {
     return;
   }
 
-  const isFrameworkAuthorTimeFinding = (
-    finding: (typeof authorTimeFindings)[number]
-  ) =>
-    finding.domain === APPLICATION_HOME_DOMAIN ||
-    finding.directiveId?.startsWith("nomos_internal_") === true;
   const earlyBusinessRefusals = authorTimeFindings.filter(
     (finding) =>
       !isFrameworkAuthorTimeFinding(finding) && finding.level === "refuse"
@@ -4976,6 +5592,7 @@ async function main(): Promise<void> {
     process.exitCode = 1;
     return;
   }
+  stage("import + compose domains");
 
   // ── STABLE-ID CONTINUITY (#58 — names are labels, identity is minted) ──
   // Derive each composed domain's stable ids from the PRIOR compile: the committed
@@ -5093,7 +5710,12 @@ async function main(): Promise<void> {
     const discoveredGraph = discoverLawGraph(
       graphModule,
       emittedStableIds,
-      nextIdentity
+      nextIdentity,
+      { workspaceEffectDomain: (target) => {
+        const owners = directiveExportSources.filter(candidate => candidate.directive === target);
+        if (owners.length !== 1) fail(`workspace effect '${target.id}' must have exactly one declaration export; found ${owners.length}`);
+        return owners[0]!.domainKey;
+      } }
     );
     for (const node of discoveredGraph.graph.nodes) {
       if (
@@ -5155,6 +5777,53 @@ async function main(): Promise<void> {
     };
   }
 
+  if (lawInspection) {
+    const graphs = [...typedLawGraphs.values()];
+    const paths = new Map<LawGraph["nodes"][number], string>();
+    const compiledGraphs = new Map<LawGraph, ReturnType<typeof compileSparseLawGraphUsda>>();
+    for (const graph of graphs) {
+      const compiled = compileSparseLawGraphUsda(graph, `domains/${graph.domain.entity.label}.usda`, graphs);
+      compiledGraphs.set(graph, compiled);
+      for (const node of graph.nodes) {
+        const lawPath = compiled.paths.get(node.entity.id);
+        if (lawPath !== undefined) paths.set(node, lawPath);
+      }
+    }
+    const report = {
+      ...commandWorkingSetReport(graphs, new LawDependencyIndex(graphs, paths,
+        (graph, dependency) => compiledGraphs.get(graph)!.resolveDependency(dependency))),
+      packageName: cfg.name, configPath,
+      identitySha256: existsSync(lockPath)
+        ? createHash("sha256").update(readFileSync(lockPath)).digest("hex") : null,
+    };
+    const reportPath = path.join(outDir, "command-working-sets.json");
+    writeFileSync(reportPath, JSON.stringify(report, null, 2) + "\n");
+    console.log(JSON.stringify({ kind: report.kind, graphNodes: report.graphNodes,
+      commands: report.commands.length, reportPath }));
+    return;
+  }
+
+  if (sqliteInspection) {
+    const report = {
+      ...inspectSqliteLayouts([...typedLawGraphs.values()]),
+      computationEngine: await sqliteComputationBundle(
+        entryDomainSourceByKey,
+        collectEngineRouting(routingInput)
+      ),
+      packageName: cfg.name,
+      configPath,
+      descriptorSamples: sqliteDescriptorSamples(domainModules, typedLawGraphs),
+      identitySha256: existsSync(lockPath)
+        ? createHash("sha256").update(readFileSync(lockPath)).digest("hex")
+        : null,
+      scope: "declaration/storage mapping only; not runtime reads, query coverage or release approval",
+    };
+    const reportPath = path.join(outDir, "sqlite-layout-report.json");
+    writeFileSync(reportPath, JSON.stringify(report, null, 2) + "\n");
+    console.log(JSON.stringify({ kind: report.kind, ...report.summary, reportPath }));
+    return;
+  }
+
   // ── ORDINARY-COMPILE EVOLUTION GATE ──────────────────────────────────────────────
   // Agents reliably run `compile`; they do not reliably discover an optional migration command.
   // Compare the candidate against the committed identity frontier here, after stable-id
@@ -5182,25 +5851,13 @@ async function main(): Promise<void> {
       const locked =
         historicalLock.domains[mod.name] ?? historicalLock.domains[domainKey];
       if (locked !== undefined) {
-        const currentImplementationDetailAggregateIds = new Set(
-          mod.aggregates
-            .filter(
-              (aggregate) =>
-                (aggregate as { businessBirthInternal?: unknown })
-                  .businessBirthInternal === true
-            )
-            .map((aggregate) => aggregate.id)
-        );
         // Framework aggregates are shared implementation law, reconciled under @framework rather
         // than owned by this tenant domain. Domain-scoped implementation aggregates such as
-        // NomosSourceFrontier deliberately retain the tenant domain's law namespace, but are still
-        // hidden from its structural interface. A package may compose a different framework subset
-        // as its topology changes; never instruct a tenant to author a retirement for Nomos internals.
+        // NomosSourceFrontier still hold durable state even when hidden from the public interface.
+        // Keep them in the evolution check: hiding an aggregate is not authority to replace its SID.
         const localAggregates = Object.fromEntries(
           Object.entries(locked.stableIds.aggregates).filter(
-            ([aggregateId, aggregate]) =>
-              !frameworkAggregateSids.has(aggregate.sid) &&
-              !currentImplementationDetailAggregateIds.has(aggregateId)
+            ([, aggregate]) => !frameworkAggregateSids.has(aggregate.sid)
           )
         );
         priorDomainsForPackage[domainKey] = {
@@ -5253,13 +5910,14 @@ async function main(): Promise<void> {
   const packageInterface: Record<string, DomainInterface> = {};
   for (const mod of presentationDomainModules) {
     const key = mod.domain ?? mod.name;
-    const di = domainInterface(mod, nextLock.domains[mod.name]?.stableIds);
     const graph = typedLawGraphs.get(mod.name);
     if (graph === undefined) {
       fail(
         `compiler surface invariant: domain '${key}' has no typed USDA graph`
       );
     }
+    const offeredInterface = domainInterfaceFromLawGraph(graph);
+    const di = publicClientInterface([mod], { [key]: offeredInterface })[key]!;
     const graphRoutes = graph.nodes
       .filter((node) => node.kind === "intent" && node.public)
       .map((node) => (node.kind === "intent" ? node.publicRoute : ""))
@@ -5308,12 +5966,16 @@ async function main(): Promise<void> {
         }
       : di;
   }
-  // NO INTERFACE SIDECAR. The structural interface is an in-memory codegen model only: it is baked
-  // INTO the generated clients where compiler tooling can inspect the requirement that will ship.
-  // Emitting it as JSON created a second representation of law that DRIFTED: the prior sidecar
-  // omitted `principal` and `bornAt`, two fields the USDA declares
-  // `nomos:required = true`, so anything reading it saw a contract the kernel would refuse.
-  // One fact, one representation: the typed USDA closure is the contract.
+  // The application compatibility requirement is a first-class USDA build artifact. It is deliberately
+  // NOT installed law: clients carry these opaque bytes to the kernel, which compares the requirement
+  // against authenticated installed-law stages. The compiler and generated clients all derive it from
+  // this same in-memory graph; no JSON/hash compatibility twin exists.
+  const compatibilityUsda = emitApplicationCompatibilityUsda(packageInterface);
+  const compatibilityUsdaPath = path.join(
+    outDir,
+    `${cfg.name}.compatibility.usda`
+  );
+  writeFileSync(compatibilityUsdaPath, compatibilityUsda, "utf8");
 
   // ── RECURSIVE-PAYLOAD NOTES (z.lazy) — a self-referencing tree/JSON payload field is FULLY
   // supported: each codegen layer mints a named recursive type for it (TS `type <Name>`, Dart
@@ -5351,6 +6013,9 @@ async function main(): Promise<void> {
   // exact texts under their logical paths; no parallel layer directory or JSON reconstruction exists.
   const v3Closure = [...typedLawGraphs.values()];
   const v3DomainAssets: EmittedLawClosureAsset[] = [];
+  const v3DomainRoots: string[] = [];
+  const v3LawPathByNode = new Map<LawGraph["nodes"][number], string>();
+  const v3CompiledGraphs = new Map<LawGraph, ReturnType<typeof compileSparseLawGraphUsda>>();
   const typedDomainIdentityByName = new Map<string, string>();
   const typedLawPathsByName = new Map<string, ReadonlyMap<string, string>>();
   for (const [domain, graph] of typedLawGraphs) {
@@ -5361,6 +6026,7 @@ async function main(): Promise<void> {
       logicalPath,
       v3Closure
     );
+    v3CompiledGraphs.set(graph, compiledLayer);
     const layerText = compiledLayer.text;
     const sha256 = sha256HexUtf8(layerText);
     v3DomainAssets.push({
@@ -5368,10 +6034,51 @@ async function main(): Promise<void> {
       sha256,
       utf8: layerText,
     });
+    const domainRoot = compiledLayer.paths.get(graph.domain.entity.id);
+    if (domainRoot === undefined) {
+      fail(`domain '${domain}' did not emit its canonical OpenUSD root path`);
+    }
+    v3DomainRoots.push(domainRoot);
+    for (const node of graph.nodes) {
+      const lawPath = compiledLayer.paths.get(node.entity.id);
+      if (lawPath !== undefined) v3LawPathByNode.set(node, lawPath);
+    }
     typedDomainIdentityByName.set(domain, sha256);
     typedLawPathsByName.set(domain, compiledLayer.paths);
   }
 
+  // Index the transient graph once. Both projections follow the same nominal edges, including
+  // transitive cross-domain dependencies. Per-command selection also follows reverse guard edges;
+  // the retained package command projection remains the compatibility consumer until the runtime
+  // can carry a member-scoped contract without presenting it as a complete package.
+  const lawDependencies = new LawDependencyIndex(v3Closure, v3LawPathByNode,
+    (graph, dependency) => v3CompiledGraphs.get(graph)!.resolveDependency(dependency));
+  const commonProjectionPaths = [
+    "/Nomos/Package",
+    "/Nomos/Framework",
+    "/__NomosRuntime_7e9c/Routes",
+    ...v3DomainRoots.map((root) => `${root}/Retirements`),
+  ];
+  const readSeeds = v3Closure.flatMap(graph => graph.nodes.filter(node =>
+    node.kind === "aggregate" || node.kind === "read" ||
+    node.kind === "relation" || node.kind === "object-type"));
+  const commandSeeds = v3Closure.flatMap(graph => graph.nodes.filter(node =>
+    node.kind === "intent" || node.kind === "policy" || node.kind === "invariant" ||
+    node.kind === "capability" || node.kind === "workspace-type" ||
+    (node.kind === "structural" && node.structuralKind === "flow")));
+  const readProjectionPaths = new Set([
+    ...commonProjectionPaths, ...lawDependencies.select(readSeeds).paths,
+  ]);
+  const commandProjectionPaths = new Set([
+    ...commonProjectionPaths, ...lawDependencies.select(commandSeeds, true).paths,
+  ]);
+  // Diagnostic only: these paths are not executable authority or a new law file format. A future
+  // member-scoped USD artifact must prove its complete semantic contract before replacing the
+  // package-wide runtime view. In particular USD masks include descendants, so node counts alone
+  // are not a claim about materialized prim count, file I/O, RSS, or first-command latency.
+  writeFileSync(path.join(outDir, "command-working-sets.json"),
+    JSON.stringify(commandWorkingSetReport(v3Closure, lawDependencies), null, 2) + "\n");
+
   // Some exact directives are deliberately private implementation details: they must not appear in
   // the tenant's generated client, but typed application-law edges can still require the kernel to
   // execute them. Preserve that distinction here. The exact Directive object and its one configured
@@ -5380,39 +6087,44 @@ async function main(): Promise<void> {
   const retainExactExecutableDirective = (
     edge: string,
     declaredDomain: string | undefined,
-    directive: Parameters<typeof synthesizePreconditionInvariants>[0],
+    directive: Parameters<typeof synthesizePreconditionInvariants>[0]
   ) => {
     const matches = directiveExportSources.filter(
-      (candidate) => candidate.directive === directive,
+      (candidate) => candidate.directive === directive
     );
     if (matches.length !== 1) {
       fail(
-        `${edge} targets '${declaredDomain === undefined ? directive.id : `${declaredDomain}/${directive.id}`}', ` +
+        `${edge} targets '${
+          declaredDomain === undefined
+            ? directive.id
+            : `${declaredDomain}/${directive.id}`
+        }', ` +
           `but that exact Directive object is ` +
-          `exported by ${matches.length} configured law modules; export it once`,
+          `exported by ${matches.length} configured law modules; export it once`
       );
     }
     const target = matches[0]!;
     if (declaredDomain !== undefined && target.domainKey !== declaredDomain) {
       fail(
         `${edge} declares '${declaredDomain}/${directive.id}', but the exact Directive export belongs ` +
-          `to domain '${target.domainKey}'`,
+          `to domain '${target.domainKey}'`
       );
     }
-    const targetIds = executableDirectiveIdsByDomain.get(target.domainKey) ?? [];
+    const targetIds =
+      executableDirectiveIdsByDomain.get(target.domainKey) ?? [];
     if (!targetIds.includes(directive.id)) {
       executableDirectiveIdsByDomain.set(
         target.domainKey,
-        [...targetIds, directive.id].sort(),
+        [...targetIds, directive.id].sort()
       );
     }
     const targetDirectives = new Map(
-      executableDirectivesByDomain.get(target.domainKey) ?? [],
+      executableDirectivesByDomain.get(target.domainKey) ?? []
     );
     targetDirectives.set(directive.id, directive);
     executableDirectivesByDomain.set(target.domainKey, targetDirectives);
     const targetExports = new Map(
-      offerSourceExportsByDomain.get(target.domainKey) ?? [],
+      offerSourceExportsByDomain.get(target.domainKey) ?? []
     );
     targetExports.set(directive.id, {
       modulePath: target.modulePath,
@@ -5430,7 +6142,7 @@ async function main(): Promise<void> {
     retainExactExecutableDirective(
       "application home genesis",
       step.domain,
-      step.directive,
+      step.directive
     );
   }
 
@@ -5450,10 +6162,19 @@ async function main(): Promise<void> {
   for (const module of domainModules) {
     const sourceDomain = module.domain ?? module.name;
     for (const directive of module.directives ?? []) {
-      if (!isBusinessIntent(directive)) continue;
-      for (const effect of directive.workspaceEffects) {
+      for (const effect of directive.workspaceEffects ?? []) {
         const sourceMatches = directiveExportSources.filter(
-          (candidate) => candidate.directive === directive
+          (candidate) => {
+            if (candidate.directive === directive) return true;
+            // Composition may add static read/auth requirements by copying a declaration.
+            // Its executable plan, payload contract and outbound papers remain the exact
+            // source objects; do not confuse that with an unrelated same-named command.
+            const source = candidate.directive as Directive<unknown>;
+            return candidate.domainKey === sourceDomain &&
+              source.id === directive.id && source.plan === directive.plan &&
+              source.payloadSchema === directive.payloadSchema &&
+              source.workspaceEffects === directive.workspaceEffects;
+          }
         );
         if (sourceMatches.length !== 1) {
           fail(
@@ -5465,7 +6186,7 @@ async function main(): Promise<void> {
         const target = retainExactExecutableDirective(
           `workspace effect '${sourceDomain}/${directive.id}'`,
           undefined,
-          effect.target,
+          effect.target
         );
         const graph = typedLawGraphs.get(target.graphName);
         const paths = typedLawPathsByName.get(target.graphName);
@@ -5474,6 +6195,9 @@ async function main(): Promise<void> {
             `workspace effect target '${target.graphName}/${effect.target.id}' has no canonical law graph`
           );
         }
+        // This call is authored by authenticated source law inside the kernel
+        // plan and becomes a carried Layer. It does not cross the public client
+        // ABI whose operation payload is Protobuf.
         const generated = emitTsCallUsdaEncoder(
           graph,
           paths,
@@ -5493,6 +6217,7 @@ async function main(): Promise<void> {
       }
     }
   }
+  stage("stable ids + evolve gate + interface");
 
   // ── reports ──
   const entryReports: string[] = [];
@@ -5521,6 +6246,67 @@ async function main(): Promise<void> {
   // law whose invariant declarations are inconsistent refuses to COMPILE, and the
   // table can never disagree with what a full force would register).
   const routing = collectEngineRouting(routingInput);
+  stage("  ↳ collectEngineRouting");
+  const dartCfg = cfg.dart ?? false;
+  if (
+    dartCfg !== false &&
+    dartCfg !== true &&
+    (typeof dartCfg !== "object" ||
+      dartCfg === null ||
+      (dartCfg.out !== undefined && typeof dartCfg.out !== "string") ||
+      (dartCfg.support !== undefined && dartCfg.support !== "package") ||
+      (dartCfg.barrel !== undefined &&
+        !/^[a-z][a-z0-9_]*$/.test(String(dartCfg.barrel))) ||
+      (dartCfg.names !== undefined &&
+        (typeof dartCfg.names !== "object" ||
+          dartCfg.names === null ||
+          Array.isArray(dartCfg.names))) ||
+      (dartCfg.packages !== undefined &&
+        (typeof dartCfg.packages !== "object" ||
+          dartCfg.packages === null ||
+          typeof dartCfg.packages.types !== "string" ||
+          typeof dartCfg.packages.client !== "string")))
+  ) {
+    fail(
+      `config key 'dart' must be false, true, or { out?: "relative/dir", support?: "package", barrel?: "snake_case_name", packages?: { types, client, test?, compat? }, names?: { Generated: "Alias" } }; got ${JSON.stringify(
+        dartCfg
+      )}`
+    );
+  }
+  const dartPackages =
+    typeof dartCfg === "object" ? dartCfg.packages : undefined;
+  const dartNames = typeof dartCfg === "object" ? dartCfg.names : undefined;
+  // The operation Protobuf bindings depend only on the composed law, so start their generators
+  // now: protoc-gen-dart alone costs seconds of JIT start on a cold cache, and nothing below
+  // needs the bindings until the TypeScript and Dart emits await these.
+  const tsOperationProtoPrewarm = prewarmTsOperationProto(
+    cfgDir,
+    [
+      ...new Map(
+        [...closedDomainModules, ...presentationDomainModules].map(
+          (module) => [module.name, module] as const
+        )
+      ).values(),
+    ],
+    typedLawGraphs,
+    typedLawPathsByName
+  );
+  const dartOperationProtoPrewarm =
+    dartCfg === false
+      ? Promise.resolve()
+      : prewarmDartOperationProto(
+          dartPackages === undefined
+            ? presentationDomainModules
+            : [
+                ...new Map(
+                  [...presentationDomainModules, ...closedDomainModules].map(
+                    (module) => [module.name, module] as const
+                  )
+                ).values(),
+              ],
+          typedLawGraphs,
+          typedLawPathsByName
+        );
   // Zanzibar identities are namespaced by the domain's STABLE USDA identity, not its mutable dispatch
   // label. Carry that one label→identity table into every plan asset so writeTuple() emits the same
   // object type the typed law graph placed on gates and relation declarations.
@@ -5610,6 +6396,7 @@ async function main(): Promise<void> {
     pathToFileURL(path.join(path.dirname(esbuildPkgJson), "lib", "main.js"))
       .href
   )) as typeof import("esbuild");
+  stage("  ↳ esbuild import");
 
   const compact =
     process.env.NOMOS_READABLE === "1"
@@ -5687,18 +6474,25 @@ async function main(): Promise<void> {
     ])
   );
   let planSequence = 0;
+  const PLAN_ENTRY_SOURCEFILE = ".nomos_plan.ts";
   const orderedDomainKeys = [...entryDomainSourceByKey.keys()];
   const frameworkPlanModulePaths = [
-    ...new Set(
-      Object.values(BUSINESS_BIRTH_FRAMEWORK_PLAN_SOURCES).map(
+    ...new Set([
+      ...Object.values(BUSINESS_BIRTH_FRAMEWORK_PLAN_SOURCES).map(
         (source) => source.modulePath
-      )
-    ),
+      ),
+      CHILD_AUTHENTICATION_MODULE_PATH,
+      RECEIVING_GROUP_RECOVERY_MODULE_PATH,
+      MODEL_TRANSITION_MODULE_PATH,
+      MODEL_AUTHORITY_REPAIR_MODULE_PATH,
+    ]),
   ];
+  stage("  ↳ plan compiler identity");
   const planSourceSlicer = new PlanSourceSliceProgram(
     [...configuredModulePaths, ...frameworkPlanModulePaths],
     cfgDir
   );
+  stage("  ↳ PlanSourceSliceProgram (ts.createProgram)");
   const routingFor = (domainKeys: readonly string[]) => {
     const wanted = new Set(domainKeys);
     const retain = (
@@ -5886,6 +6680,7 @@ async function main(): Promise<void> {
   const authoredRuntimeImports = planSourceSlicer.externalRuntimeImports(
     publicRuntimeCandidates
   );
+  stage("  ↳ externalRuntimeImports");
   const sharedRuntimeModules: Array<{
     readonly id: string;
     readonly source: string;
@@ -5925,7 +6720,10 @@ async function main(): Promise<void> {
   let sharedRuntimeProfileInputs:
     | readonly { readonly module: string; readonly bytesInOutput: number }[]
     | undefined;
-  const compileSharedRuntimeProfile = async (): Promise<number> => {
+  let sharedRuntimeProfileCompilation: Promise<number> | undefined;
+  const compileSharedRuntimeProfile = (): Promise<number> =>
+    (sharedRuntimeProfileCompilation ??= compileSharedRuntimeProfileOnce());
+  const compileSharedRuntimeProfileOnce = async (): Promise<number> => {
     if (sharedRuntimeProfileBytes !== undefined)
       return sharedRuntimeProfileBytes;
     const sourcePath = path.join(outDir, ".nomos_shared_runtime_profile.ts");
@@ -6120,10 +6918,16 @@ async function main(): Promise<void> {
     if (cached !== undefined) {
       bundled = cached.javascript;
     } else {
-      const sourcePath = path.join(outDir, `.nomos_plan_${planSequence++}.ts`);
-      writeFileSync(sourcePath, entrySource, "utf8");
+      // The entry rides esbuild's stdin under one constant name: a numbered temp file put its
+      // sequence number into the bundle's module header, so identical law could hash differently
+      // depending on how many plans a warm cache had skipped before it.
       const result = await esbuildMod.build({
-        entryPoints: [sourcePath],
+        stdin: {
+          contents: entrySource,
+          loader: "ts",
+          resolveDir: cfgDir,
+          sourcefile: PLAN_ENTRY_SOURCEFILE,
+        },
         absWorkingDir: cfgDir,
         bundle: true,
         write: false,
@@ -6140,7 +6944,6 @@ async function main(): Promise<void> {
           ? {}
           : { plugins: [planSourceSlicer.plugin(effectiveSliceTargets)] }),
       });
-      rmSync(sourcePath, { force: true });
       const output = result.outputFiles?.[0];
       if (output === undefined)
         fail("shared-runtime plan compile produced no JavaScript output");
@@ -6159,13 +6962,11 @@ async function main(): Promise<void> {
           );
       }
       const inputs = Object.keys(emitted)
+        .filter((module) => module !== PLAN_ENTRY_SOURCEFILE)
         .map((module) =>
           path.isAbsolute(module) ? module : path.resolve(cfgDir, module)
         )
-        .filter(
-          (file) =>
-            path.resolve(file) !== path.resolve(sourcePath) && existsSync(file)
-        )
+        .filter((file) => existsSync(file))
         .map((file) => ({ path: file, sha256: planInputDigest(file) }))
         .sort((left, right) => left.path.localeCompare(right.path));
       if (inputs.length > 0) {
@@ -6246,11 +7047,28 @@ async function main(): Promise<void> {
       }
     }
   };
-  for (const key of orderedDomainKeys) {
-    const asset = await compilePlan([key], false, false);
+  const publicOfferSelector = (domain: string, directiveId: string): string => {
+    const graph = typedLawGraphs.get(domain);
+    const intent = graph?.nodes.find(
+      (node) => node.kind === "intent" && node.entity.label === directiveId
+    );
+    return `plan:offer:${domain}:${
+      intent?.kind === "intent" ? intent.publicRoute : directiveId
+    }`;
+  };
+  stage("engine entry + routing");
+  // Every plan below is an independent esbuild bundle (memoized by signature, deduplicated by
+  // content hash, and emitted sorted by selector/hash), so compile them concurrently and bind
+  // routes afterwards in declaration order.
+  const domainPlans = await Promise.all(
+    orderedDomainKeys.map((key) => compilePlan([key], false, false))
+  );
+  orderedDomainKeys.forEach((key, index) => {
+    const asset = domainPlans[index]!;
     domainPlanByKey.set(key, asset);
     routeAsset(`plan:domain:${key}`, asset);
-  }
+  });
+  stage("shared runtime + domain plans");
 
   // Public offers are addressed more narrowly than domains. Split direct TypeScript exports by
   // authored source span, then symbol-slice each shard so one large domain file cannot impose one
@@ -6267,10 +7085,14 @@ async function main(): Promise<void> {
   // 8 KiB; an irreducible single offer remains explicit and attributable instead of being hidden
   // inside a domain-wide fallback.
   const OFFER_PLAN_MAX_UTF8_BYTES = 48 * 1024;
-  for (const domain of orderedDomainKeys) {
-    const fallback = domainPlanByKey.get(domain)!;
+  interface OfferShardEntry {
+    directiveId: string;
+    exportName: string;
+    aggregateId: string;
+    position: number;
+  }
+  const domainOfferPlans = await Promise.all(orderedDomainKeys.map(async (domain) => {
     const exports = offerSourceExportsByDomain.get(domain) ?? new Map();
-    const routed = new Set<string>();
 
     // Business-birth lowering injects several framework offers which execute as one child-genesis
     // transaction. Compile their typed source closures into one shared plan: preparing any one exact
@@ -6283,6 +7105,7 @@ async function main(): Promise<void> {
       const target = BUSINESS_BIRTH_FRAMEWORK_PLAN_SOURCES[directiveId];
       return target === undefined ? [] : [{ directiveId, ...target }];
     });
+    let frameworkPlan: Promise<UsdPlanAsset> | undefined;
     if (frameworkTargets.length > 0) {
       const selectedModules = new Map<
         string,
@@ -6310,7 +7133,7 @@ async function main(): Promise<void> {
       const source = `    ${JSON.stringify(
         BUSINESS_BIRTH_FRAMEWORK_PLAN_DOMAIN
       )}: [${selectedSources.join(", ")}],`;
-      const asset = await compilePlan([domain], false, false, {
+      frameworkPlan = compilePlan([domain], false, false, {
         sourceOverrides: new Map([[domain, source]]),
         includePreloads: false,
         cacheKey: "business-birth-framework",
@@ -6318,23 +7141,13 @@ async function main(): Promise<void> {
         routedDomainFallback: BUSINESS_BIRTH_FRAMEWORK_PLAN_DOMAIN,
         includeMintInstalls: false,
       });
-      for (const target of frameworkTargets) {
-        routeAsset(`plan:offer:${domain}:${target.directiveId}`, asset);
-        retainGeneratedInvariantRoutes(domain, target.directiveId, asset);
-        routed.add(target.directiveId);
-      }
     }
-    const byModule = new Map<
-      string,
-      Array<{
-        directiveId: string;
-        exportName: string;
-        aggregateId: string;
-        position: number;
-      }>
-    >();
+    const routedByFramework = new Set(
+      frameworkTargets.map((target) => target.directiveId)
+    );
+    const byModule = new Map<string, OfferShardEntry[]>();
     for (const [directiveId, source] of exports) {
-      if (routed.has(directiveId)) continue;
+      if (routedByFramework.has(directiveId)) continue;
       const position = planSourceSlicer.exportPosition({
         modulePath: source.modulePath,
         exportName: source.exportName,
@@ -6349,14 +7162,14 @@ async function main(): Promise<void> {
       });
       byModule.set(source.modulePath, entries);
     }
-    for (const [modulePath, entries] of byModule) {
+    const offers = await Promise.all([...byModule].map(async ([modulePath, entries]) => {
       entries.sort(
         (left, right) =>
           left.position - right.position ||
           left.directiveId.localeCompare(right.directiveId)
       );
-      const shards: (typeof entries)[] = [];
-      let current: typeof entries = [];
+      const shards: OfferShardEntry[][] = [];
+      let current: OfferShardEntry[] = [];
       let shardStart = 0;
       for (const entry of entries) {
         if (
@@ -6371,8 +7184,8 @@ async function main(): Promise<void> {
       }
       if (current.length > 0) shards.push(current);
       const compileOfferShard = async (
-        shard: typeof entries
-      ): Promise<void> => {
+        shard: OfferShardEntry[]
+      ): Promise<Array<{ entry: OfferShardEntry; asset: UsdPlanAsset }>> => {
         const selected: PlanSourceSliceTarget[] = shard.map((entry) => ({
           modulePath,
           exportName: entry.exportName,
@@ -6404,34 +7217,55 @@ async function main(): Promise<void> {
           let splitAt = shard.findIndex((entry) => entry.position >= midpoint);
           if (splitAt <= 0 || splitAt >= shard.length)
             splitAt = Math.ceil(shard.length / 2);
-          await compileOfferShard(shard.slice(0, splitAt));
-          await compileOfferShard(shard.slice(splitAt));
-          return;
-        }
-        for (const entry of shard) {
-          routeAsset(`plan:offer:${domain}:${entry.directiveId}`, asset);
-          retainGeneratedInvariantRoutes(domain, entry.directiveId, asset);
-          if (entry.directiveId.startsWith("nomosSeed")) {
-            // The generated seed writes the born aggregate immediately. Its `.fromBirth()` / user
-            // aggregate invariant is part of the same authored symbol closure, so route that first
-            // gate check through the already-warmed slice instead of cold-loading the whole domain.
-            aggregateInvariantPlanOverrides.set(entry.aggregateId, asset);
-            aggregateInvariantPlanOverrides.set(
-              `${domain}.${entry.aggregateId}`,
-              asset
-            );
-          }
-          routed.add(entry.directiveId);
+          const [left, right] = await Promise.all([
+            compileOfferShard(shard.slice(0, splitAt)),
+            compileOfferShard(shard.slice(splitAt)),
+          ]);
+          return [...left, ...right];
         }
+        return shard.map((entry) => ({ entry, asset }));
       };
-      for (const shard of shards) await compileOfferShard(shard);
+      return (await Promise.all(shards.map(compileOfferShard))).flat();
+    }));
+    return {
+      domain,
+      frameworkTargets,
+      frameworkAsset: frameworkPlan === undefined ? undefined : await frameworkPlan,
+      offers: offers.flat(),
+    };
+  }));
+  for (const { domain, frameworkTargets, frameworkAsset, offers } of domainOfferPlans) {
+    const fallback = domainPlanByKey.get(domain)!;
+    const routed = new Set<string>();
+    if (frameworkAsset !== undefined) {
+      for (const target of frameworkTargets) {
+        routeAsset(publicOfferSelector(domain, target.directiveId), frameworkAsset);
+        retainGeneratedInvariantRoutes(domain, target.directiveId, frameworkAsset);
+        routed.add(target.directiveId);
+      }
+    }
+    for (const { entry, asset } of offers) {
+      routeAsset(publicOfferSelector(domain, entry.directiveId), asset);
+      retainGeneratedInvariantRoutes(domain, entry.directiveId, asset);
+      if (entry.directiveId.startsWith("nomosSeed")) {
+        // The generated seed writes the born aggregate immediately. Its `.fromBirth()` / user
+        // aggregate invariant is part of the same authored symbol closure, so route that first
+        // gate check through the already-warmed slice instead of cold-loading the whole domain.
+        aggregateInvariantPlanOverrides.set(entry.aggregateId, asset);
+        aggregateInvariantPlanOverrides.set(
+          `${domain}.${entry.aggregateId}`,
+          asset
+        );
+      }
+      routed.add(entry.directiveId);
     }
     for (const directiveId of executableDirectiveIdsByDomain.get(domain) ??
       []) {
       if (!routed.has(directiveId))
-        routeAsset(`plan:offer:${domain}:${directiveId}`, fallback);
+        routeAsset(publicOfferSelector(domain, directiveId), fallback);
     }
   }
+  stage("offer shard plans");
   // Hand-authored workspace invariants are independently addressable law too. The previous
   // fallback compiled their entire domain merely to run one `reads`/`assert` pair, even though
   // offer compilation already knows how to retain one authored export closure. Build that exact
@@ -6439,6 +7273,10 @@ async function main(): Promise<void> {
   // When `language(...)` remapped private effect invariants onto public intents, retain only those
   // public intent exports and reconstruct that language so the existing remapping machinery remains
   // the sole owner of payload adaptation.
+  const workspaceInvariantPlans: Array<{
+    readonly invariantIds: readonly string[];
+    readonly plan: Promise<UsdPlanAsset>;
+  }> = [];
   for (const domain of orderedDomainKeys) {
     const byDirective = new Map<
       string,
@@ -6521,39 +7359,48 @@ async function main(): Promise<void> {
       const domainSource = `    ${JSON.stringify(
         domain
       )}: [${moduleExpression}],`;
-      const asset = await compilePlan([domain], false, false, {
-        sourceOverrides: new Map([[domain, domainSource]]),
-        sliceTargets: [...selectedByKey.values()],
-        cacheKey: `workspace-invariants:${directiveId}:${members
-          .map(([id]) => id)
-          .join(",")}`,
+      workspaceInvariantPlans.push({
+        invariantIds: members.map(([id]) => id),
+        plan: compilePlan([domain], false, false, {
+          sourceOverrides: new Map([[domain, domainSource]]),
+          sliceTargets: [...selectedByKey.values()],
+          cacheKey: `workspace-invariants:${directiveId}:${members
+            .map(([id]) => id)
+            .join(",")}`,
+        }),
       });
-      for (const [invariantId] of members) {
-        workspaceInvariantPlanOverrides.set(invariantId, asset);
-      }
     }
   }
-  await routePlan("describe", orderedDomainKeys, false, true);
+  for (const { invariantIds, plan } of workspaceInvariantPlans) {
+    const asset = await plan;
+    for (const invariantId of invariantIds) {
+      workspaceInvariantPlanOverrides.set(invariantId, asset);
+    }
+  }
+  stage("workspace invariant plans");
+  const reportRoutes: Promise<void>[] = [
+    routePlan("describe", orderedDomainKeys, false, true),
+  ];
   for (const reportId of Object.keys(cfg.reports ?? {}))
-    await routePlan(`report:report:${reportId}`, [], true);
-  const routeTable = async (
+    reportRoutes.push(routePlan(`report:report:${reportId}`, [], true));
+  const routeTable = (
     prefix: string,
     table: Readonly<Record<string, readonly string[]>> | undefined
-  ): Promise<void> => {
+  ): void => {
     for (const [id, domains] of Object.entries(table ?? {}))
-      await routePlan(`${prefix}${id}`, domains);
+      reportRoutes.push(routePlan(`${prefix}${id}`, domains));
   };
-  await routeTable("report:derive:", routing.derivedOf);
-  await routeTable("report:combine:", routing.combinedOf);
+  routeTable("report:derive:", routing.derivedOf);
+  routeTable("report:combine:", routing.combinedOf);
   for (const [id, domains] of Object.entries(
     routing.aggregateInvariantOf ?? {}
   )) {
     const override = aggregateInvariantPlanOverrides.get(id);
     if (override !== undefined)
       routeAsset(`report:aggregateInvariant:${id}`, override);
-    else await routePlan(`report:aggregateInvariant:${id}`, domains);
+    else reportRoutes.push(routePlan(`report:aggregateInvariant:${id}`, domains));
   }
-  await routeTable("report:invariant:", routing.relationOf);
+  routeTable("report:invariant:", routing.relationOf);
   for (const [id, domains] of Object.entries(
     routing.workspaceInvariantOf ?? {}
   )) {
@@ -6569,11 +7416,13 @@ async function main(): Promise<void> {
       routeAsset(`report:workspaceInvariant:${id}`, override);
     } else {
       if (!nativeWorkspaceInvariantReadIds.has(id)) {
-        await routePlan(`report:workspaceInvariantReads:${id}`, domains);
+        reportRoutes.push(routePlan(`report:workspaceInvariantReads:${id}`, domains));
       }
-      await routePlan(`report:workspaceInvariant:${id}`, domains);
+      reportRoutes.push(routePlan(`report:workspaceInvariant:${id}`, domains));
     }
   }
+  await Promise.all(reportRoutes);
+  stage("describe + report plans");
   // Adaptive offer splitting deliberately compiles candidate parents before retaining their children.
   // Only route-reachable content is custody; exploratory compiler work never becomes law bytes.
   const routedPlanHashes = new Set(planRoutes.map((route) => route.planSha256));
@@ -6711,6 +7560,8 @@ async function main(): Promise<void> {
     }
   }
 
+  stage("captured-read gate");
+  let bootProbeFailure: Promise<string | undefined> | undefined;
   // ── 1b. THE FROZEN-SANDBOX BOOT PROBE (fail-closed) ──
   // The sealed engine freezes globalThis after a plan asset's top level; a lazy
   // domain's module init runs LATER, inside the dispatch. Any module that writes
@@ -6833,28 +7684,32 @@ async function main(): Promise<void> {
       return { planPath, checks };
     });
     writeFileSync(probeJobsPath, JSON.stringify(probeJobs), "utf8");
-    try {
-      execFileSync(process.execPath, [probePath, probeJobsPath], {
-        encoding: "utf8",
-        stdio: ["ignore", "ignore", "pipe"],
-      });
-    } catch (e) {
+    // The probe is its own child process: let it run while the law closure is composed and
+    // usdcat projects it, and judge its verdict before the package is sealed.
+    bootProbeFailure = execFileAsync(process.execPath, [probePath, probeJobsPath], {
+      encoding: "utf8",
+      maxBuffer: 64 * 1024 * 1024,
+    })
+      .then(() => undefined)
+      .catch((e: unknown) => {
       const stderr = String((e as { stderr?: string }).stderr ?? "").trim();
       const [domainKey = "?", msg = stderr] = stderr.includes("\u0000")
         ? stderr.split("\u0000")
         : ["?", stderr];
-      fail(
+      return (
         `domain '${domainKey}' failed its selected-plan registry probe — the compiler routed an ` +
           `offer to a plan that cannot dispatch it, or a module initializer failed after the ` +
           `sandbox freeze: ${msg}`
       );
-    } finally {
-      rmSync(probePath, { force: true });
-      rmSync(probeJobsPath, { force: true });
-      for (const planPath of probePlanPaths) rmSync(planPath, { force: true });
-    }
+      })
+      .finally(() => {
+        rmSync(probePath, { force: true });
+        rmSync(probeJobsPath, { force: true });
+        for (const planPath of probePlanPaths) rmSync(planPath, { force: true });
+      });
   }
 
+  stage("boot probe (started)");
   // ── 2. Canonical typed USDA closure ──
   // There is no flattened package and no JSON law intermediate. Sparse typed source opinions plus
   // compiler-owned plan/framework layers are the package; composition is deferred to LawStage.
@@ -6865,7 +7720,7 @@ async function main(): Promise<void> {
     sha256: sha256HexUtf8(sharedRuntimeProfileJavascript),
     javascript: sharedRuntimeProfileJavascript,
   };
-  const lawClosure = emitLawClosure(
+  let lawClosure = emitLawClosure(
     cfg.name,
     domainModules.map((module) => module.domain ?? module.name),
     runtimeDependencies,
@@ -6874,9 +7729,6 @@ async function main(): Promise<void> {
     routedPlanAssets,
     planRoutes
   );
-  // The composed USDA closure is the law. Generated clients, lifecycle rows and
-  // compatibility metadata all bind this identity, never the retired flattened envelope.
-  const domainHash = lawClosure.identity;
   const lawClosureAssetsPath = path.join(outDir, `${cfg.name}.law`);
   const lawUsdzPath = path.join(outDir, `${cfg.name}.law.usdz`);
   rmSync(path.join(outDir, `${cfg.name}.law-closure.usda`), { force: true });
@@ -6884,13 +7736,166 @@ async function main(): Promise<void> {
     recursive: true,
     force: true,
   });
-  rmSync(lawClosureAssetsPath, { recursive: true, force: true });
-  mkdirSync(lawClosureAssetsPath, { recursive: true });
-  for (const asset of lawClosure.assets) {
-    const assetPath = path.join(lawClosureAssetsPath, asset.logicalPath);
-    mkdirSync(path.dirname(assetPath), { recursive: true });
-    writeFileSync(assetPath, asset.bytes);
+  const writeClosureAssets = (closure: EmittedLawClosure): void => {
+    rmSync(lawClosureAssetsPath, { recursive: true, force: true });
+    mkdirSync(lawClosureAssetsPath, { recursive: true });
+    for (const asset of closure.assets) {
+      const assetPath = path.join(lawClosureAssetsPath, asset.logicalPath);
+      mkdirSync(path.dirname(assetPath), { recursive: true });
+      writeFileSync(assetPath, asset.bytes);
+    }
+  };
+  writeClosureAssets(lawClosure);
+
+  // Package standard OpenUSD finished goods once. Sparse USDA remains the authored, inspectable
+  // source law. The full USDC layer is its reversible compiled form for one-time installation;
+  // the smaller read projection is the population-masked form used for ordinary reopen. Both are
+  // covered by the final closure inventory, so a host can never substitute an unbound cache.
+  const usdcat = resolveUsdcat();
+  let compiledReadProjection = false;
+  let compiledCommandProjection = false;
+  if (usdcat !== undefined) {
+    const provisionalRootPath = path.join(
+      lawClosureAssetsPath,
+      lawClosure.rootLogicalPath
+    );
+    let composedLawText: string;
+    try {
+      composedLawText = await flattenOpenUsdToUsda({
+        usdcat,
+        sourcePath: provisionalRootPath,
+        description: "the complete authenticated law stage",
+      });
+    } catch (error) {
+      fail(error instanceof Error ? error.message : String(error));
+    }
+    // The composed stage feeds three independent usdcat pipelines — its own USDC encoding, and the
+    // read and command projections (a masked flatten, then an encoding). Each step is a separate
+    // stock-OpenUSD process with its own temporary files, so run the pipelines concurrently.
+    const temporaryComposedLaw = path.join(
+      outDir,
+      ".nomos-composed-law.mask-source.usda"
+    );
+    let composedLawUsdc: Uint8Array;
+    let readProjectionText: string;
+    let readProjectionUsdc: Uint8Array;
+    let commandProjectionText: string;
+    let commandProjectionUsdc: Uint8Array;
+    try {
+      writeFileSync(temporaryComposedLaw, composedLawText);
+      const project = async (
+        populationMask: readonly string[],
+        temporaryStem: string,
+        description: string
+      ): Promise<[string, Uint8Array]> => {
+        const usda = await flattenOpenUsdToUsda({
+          usdcat,
+          sourcePath: temporaryComposedLaw,
+          populationMask,
+          description,
+        });
+        return [
+          usda,
+          await encodeOpenUsdUsdc({
+            usdcat,
+            usda,
+            temporaryDirectory: outDir,
+            temporaryStem,
+            description,
+          }),
+        ];
+      };
+      [
+        composedLawUsdc,
+        [readProjectionText, readProjectionUsdc],
+        [commandProjectionText, commandProjectionUsdc],
+      ] = await Promise.all([
+        encodeOpenUsdUsdc({
+          usdcat,
+          usda: composedLawText,
+          temporaryDirectory: outDir,
+          temporaryStem: "nomos-composed-law",
+          description: "the complete authenticated law stage",
+        }),
+        project(
+          [...readProjectionPaths],
+          "nomos-read-projection",
+          "the authenticated read projection"
+        ),
+        project(
+          [...commandProjectionPaths],
+          "nomos-command-projection",
+          "the authenticated command projection"
+        ),
+      ]);
+    } catch (error) {
+      fail(error instanceof Error ? error.message : String(error));
+    } finally {
+      rmSync(temporaryComposedLaw, { force: true });
+    }
+    const composedLawCache: EmittedBinaryLawClosureAsset = {
+      logicalPath: "runtime/composed-law.usdc",
+      sha256: createHash("sha256").update(composedLawUsdc).digest("hex"),
+      bytes: composedLawUsdc,
+    };
+    const readProjection: EmittedLawClosureAsset = {
+      logicalPath: "runtime/read-projection.usda",
+      sha256: sha256HexUtf8(readProjectionText),
+      utf8: readProjectionText,
+    };
+    // Unlike the command acceleration view, the read projection is a complete nominal contract:
+    // it must be able to encode every declared result without consulting the full package. Catch a
+    // missing transitive value type at compile time rather than during an application's first read.
+    assertUsdaRelationshipIntegrity([readProjection]);
+    // USDA remains the canonical, inspectable derived layer. USDC is the OpenUSD-standard parsed
+    // cache of those exact bytes, produced by the same stock tool during package compilation. Every
+    // Nomos host executes the same WASM kernel containing mxpv/openusd, so this cache crosses no
+    // language boundary and requires no second runtime implementation.
+    const readProjectionCache: EmittedBinaryLawClosureAsset = {
+      logicalPath: "runtime/read-projection.usdc",
+      sha256: createHash("sha256").update(readProjectionUsdc).digest("hex"),
+      bytes: readProjectionUsdc,
+    };
+    const commandProjection: EmittedLawClosureAsset = {
+      logicalPath: "runtime/command-projection.usda",
+      sha256: sha256HexUtf8(commandProjectionText),
+      utf8: commandProjectionText,
+    };
+    const commandProjectionCache: EmittedBinaryLawClosureAsset = {
+      logicalPath: "runtime/command-projection.usdc",
+      sha256: createHash("sha256").update(commandProjectionUsdc).digest("hex"),
+      bytes: commandProjectionUsdc,
+    };
+    lawClosure = emitLawClosure(
+      cfg.name,
+      domainModules.map((module) => module.domain ?? module.name),
+      runtimeDependencies,
+      v3DomainAssets,
+      sharedRuntimeAsset,
+      routedPlanAssets,
+      planRoutes,
+      [
+        composedLawCache,
+        readProjection,
+        readProjectionCache,
+        commandProjection,
+        commandProjectionCache,
+      ]
+    );
+    writeClosureAssets(lawClosure);
+    compiledReadProjection = true;
+    compiledCommandProjection = true;
+  }
+
+  stage("law closure + usdcat projections");
+  {
+    const probeFailure = await bootProbeFailure;
+    if (probeFailure !== undefined) fail(probeFailure);
   }
+  stage("boot probe (verdict)");
+  // The composed USDA closure is the law. Generated clients, lifecycle rows and
+  // compatibility metadata all bind this identity, never the retired flattened envelope.
+  const domainHash = lawClosure.identity;
   const rootAsset = lawClosure.assets.find(
     (asset) => asset.logicalPath === lawClosure.rootLogicalPath
   );
@@ -6903,6 +7908,33 @@ async function main(): Promise<void> {
       .map((asset) => [`layers/${asset.logicalPath}`, asset.bytes] as const),
   ]);
   writeFileSync(lawUsdzPath, lawUsdz);
+  // The compiled law's identity on its own line, for release gates that need the hash and nothing else.
+  writeFileSync(path.join(outDir, `${cfg.name}.law.sha256`), `${domainHash}\n`, "utf8");
+  // D21: the same law, authored as per-domain units the kernel composes. Split from the closure just
+  // emitted (its bytes and identity are untouched), previewed for exact coverage, and written as plain
+  // trees: in custody each unit is a git tree, so git owns compression and deduplication.
+  {
+    const lawUnits = (() => {
+      try {
+        const units = splitLawUnits(lawClosure.assets, planRoutes);
+        assertLawUnitsCoverPackage(units, lawClosure.assets, planRoutes);
+        return units;
+      } catch (error) {
+        return fail(error instanceof Error ? error.message : String(error));
+      }
+    })();
+    const unitsPath = path.join(outDir, `${cfg.name}.units`);
+    rmSync(unitsPath, { recursive: true, force: true });
+    for (const unit of lawUnits) {
+      const unitPath = path.join(unitsPath, lawUnitDirectoryName(unit));
+      for (const asset of unit.assets) {
+        const assetPath = path.join(unitPath, asset.logicalPath);
+        mkdirSync(path.dirname(assetPath), { recursive: true });
+        writeFileSync(assetPath, asset.bytes);
+      }
+      writeFileSync(path.join(unitPath, LAW_UNIT_MANIFEST), unit.manifest);
+    }
+  }
   const layeredRootPath = path.join(
     lawClosureAssetsPath,
     lawClosure.rootLogicalPath
@@ -6911,7 +7943,6 @@ async function main(): Promise<void> {
   let usdcatFlattenVerified = false;
   let usdcatFlattenCached = false;
   const composedUsdIdentity = domainHash;
-  const usdcat = resolveUsdcat();
   if (usdcat === undefined) {
     if (requireUsdcat) {
       fail(
@@ -6970,6 +8001,7 @@ async function main(): Promise<void> {
     }
   }
 
+  stage("usdz pack + usdcat load proof");
   // ── 2c. THE PUBLISHED OPENUSD PACKAGE ASSET ──
   // `rootPart` is the explicit package/application boundary from the OpenUSD composition ADR.
   // The asset references the REAL authored layer stack. It deliberately contains neither the
@@ -7011,7 +8043,7 @@ async function main(): Promise<void> {
     }
   }
 
-  // ── 3. typed per-domain identity (diagnostic/client compatibility metadata) ──
+  // ── 3. typed per-domain identity (diagnostic/peer-office compatibility metadata) ──
   // A domain's identity is the digest of its canonical sparse USDA layer. Do not rebuild the retired
   // canonical JSON manifest merely to print or embed a second, competing identity.
   const identityHashes: Record<string, string> = {};
@@ -7023,13 +8055,9 @@ async function main(): Promise<void> {
     identityHashes[module.domain ?? module.name] = hash;
   }
 
-  // ── 3a. the CLIENT/LAW COMPATIBILITY MANIFEST (architecture/shape_compatibility.md).
-  // A DIAGNOSIS surface, NEVER a gate: the shape-compat arc (#72) established that clients
-  // fit workspaces by STRUCTURAL INTERFACE (stable-id subtyping), not by law-hash pin. This
-  // block is baked into both generated clients (TS + Dart) and mirrored into the deploy JSON
-  // so a connect() can classify silent / shape-compat / incompatible. FRONTEND-ONLY: it is
-  // emitted like the dart codegen hints — it does NOT enter the USD IR / package bytes /
-  // domainHash (the package `text` above is already hashed and does not move).
+  // ── 3a. CLIENT/LAW compatibility is emitted solely as a USDA matrix from the
+  // canonical compiled interface graph by each language generator. There is deliberately
+  // no parallel JSON/hash manifest: the kernel compares that matrix with authenticated law.
   const dslVersion = ((): string => {
     try {
       return (
@@ -7040,12 +8068,6 @@ async function main(): Promise<void> {
       return "unknown";
     }
   })();
-  const compatDomains: NomosCompat["domains"] = {};
-  for (const m of presentationDomainModules) {
-    const key = m.domain ?? m.name;
-    const identityHash = identityHashes[key];
-    compatDomains[key] = identityHash === undefined ? {} : { identityHash };
-  }
   // RELEASE COHERENCE — typed OSGi Contract Namespace requirements derived from law shape.
   const kernelContracts = (() => {
     const probes: KernelContractProbeModule[] = domainModules.map((m) => ({
@@ -7058,14 +8080,6 @@ async function main(): Promise<void> {
     }));
     return requiredKernelContracts(probes);
   })();
-  const nomosCompat: NomosCompat = {
-    packageName: cfg.name,
-    lawHash: domainHash,
-    interfaceHash: sha256HexUtf8(canonicalJson(packageInterface)),
-    domains: compatDomains,
-    generator: { dsl: dslVersion, schema: 1 },
-    kernelContracts,
-  };
 
   // ── 3b. NO OPENAPI SIDECAR. OpenAPI remains the sanctioned standard for describing this package's
   // API — but it is SERVED, not stored: the kernel derives it from the installed typed USDA IR
@@ -7090,78 +8104,26 @@ async function main(): Promise<void> {
       identityHash: identityHashes[m.domain ?? m.name],
     })),
   };
-  // ── 4b. the GENERATED PROOF — a runnable, domain-shaped e2e synthesized from the
-  //        law itself (codegen_proof.ts): reshape the law, recompile, the proof
-  //        reshapes itself — no test rewriting. NEVER FATAL: a domain the
-  //        synthesizer can't sample yet still compiles — the skip names its remedy.
-  let proofPath: string | undefined;
-  let proofSkip: string | undefined;
-  let proofDomains: string[] = [];
+  // ── 4b. BIRTHS DX — the per-domain legs index (codegen_proof.ts) is the compiler's audit of every
+  //        creating directive: a `.births()` directive that can't be proven says WHY here — never a
+  //        silent skip. (The runnable `<name>.proof.mts` this once emitted is gone with its proof cloud.)
   let birthWarnings: string[] = [];
   let proofNotes: string[] = [];
   try {
-    const proofSrc = generateTsProof(presentationDomainModules, {
-      packageName: cfg.name,
-      domainHash,
-      interface: packageInterface,
-      ...(cfg.application?.maxChildWorkspacesPerUser === undefined
-        ? {}
-        : {
-            applicationMaxChildWorkspacesPerUser:
-              cfg.application.maxChildWorkspacesPerUser,
-          }),
-    });
-    proofPath = path.join(outDir, `${cfg.name}.proof.mts`);
-    writeFileSync(proofPath, proofSrc, "utf8");
-    // THE PER-DOMAIN LEGS INDEX: every domain with a creating write, so
-    // `githolon proof --domain <key>` proves ANY of them offline (the .mts
-    // proves the primary one live). A multi-domain package no longer locks the
-    // proof to whichever domain happens to be first.
-    const legsIndex = proofLegsIndex(
-      presentationDomainModules,
-      packageInterface
-    );
-    if (legsIndex !== null) {
-      writeFileSync(
-        path.join(outDir, `${cfg.name}.proof-legs.json`),
-        JSON.stringify(legsIndex, null, 2) + "\n",
-        "utf8"
-      );
-      proofDomains = Object.keys(legsIndex.domains);
-      birthWarnings = Object.values(legsIndex.domains).flatMap(
+    const idx = proofLegsIndex(presentationDomainModules, packageInterface);
+    if (idx !== null) {
+      birthWarnings = Object.values(idx.domains).flatMap(
         (l) => l.birthDiagnostics ?? []
       );
-      // TAXONOMY AUDIT: every creating directive not covered by a leg is NAMED-WHY (exact-path synthesis
-      // failure / attestation lane / gated-create authority gap) — never a silent drop.
-      proofNotes = Object.values(legsIndex.domains).flatMap(
+      proofNotes = Object.values(idx.domains).flatMap(
         (l) => l.proofDiagnostics ?? []
       );
     }
-  } catch (e) {
-    proofSkip = (e as Error).message;
-    // A skipped generation must not leave yesterday's client story in build/. Otherwise editors and CI
-    // typecheck a stale proof which no longer describes the compiled law — worse than having no proof.
-    rmSync(path.join(outDir, `${cfg.name}.proof.mts`), { force: true });
-    rmSync(path.join(outDir, `${cfg.name}.proof-legs.json`), { force: true });
-  }
-  // BIRTHS DX: a `.births()` directive that can't be (or can only shakily be) proven says WHY here —
-  // never a silent skip, never an opaque runtime `born=[]` first contact. When the .mts generation
-  // itself failed, still derive the per-domain diagnostics (best-effort).
-  if (proofSkip !== undefined && birthWarnings.length === 0) {
-    try {
-      const idx = proofLegsIndex(presentationDomainModules, packageInterface);
-      if (idx !== null) {
-        birthWarnings = Object.values(idx.domains).flatMap(
-          (l) => l.birthDiagnostics ?? []
-        );
-        proofNotes = Object.values(idx.domains).flatMap(
-          (l) => l.proofDiagnostics ?? []
-        );
-      }
-    } catch {
-      /* diagnostics are best-effort */
-    }
+  } catch {
+    /* diagnostics are best-effort */
   }
+  rmSync(path.join(outDir, `${cfg.name}.proof.mts`), { force: true });
+  rmSync(path.join(outDir, `${cfg.name}.proof-legs.json`), { force: true });
 
   const summaryTxt = [
     `${cfg.name} — compiled Nomos domain package`,
@@ -7172,6 +8134,9 @@ async function main(): Promise<void> {
     `canonical law: ${path.basename(
       lawClosureAssetsPath
     )}/   # exact logically named, human-readable USDA`,
+    `client compatibility: ${path.basename(
+      compatibilityUsdaPath
+    )}   # opaque USDA requirement; the kernel compares it with installed law`,
     ...summary.domains.flatMap((d) => [
       `domain '${d.domain}'${
         d.identityHash
@@ -7190,14 +8155,11 @@ async function main(): Promise<void> {
           packageAssetPath
         )} — the real USD package root consumed by application composition`
       : `package asset: NOT EMITTED — declare rootPart: { name, kind: "component" | "assembly" }`,
-    `typed application: ${cfg.name}.client.mjs — open${cfg.name
+    `typed application: ${cfg.name}.reception.mjs — bind${cfg.name
       .split(/[^A-Za-z0-9]+/)
       .filter(Boolean)
       .map((part) => part[0]!.toUpperCase() + part.slice(1))
-      .join("")}Application({ cloud, signIn })`,
-    proofPath !== undefined
-      ? `generated proof: ${cfg.name}.proof.mts — fresh: githolon proof; existing custody: githolon proof --upgrade`
-      : `generated proof: SKIPPED — ${proofSkip}`,
+      .join("")}Application(peerOfficeBinding)`,
     ...(priorLock === undefined
       ? []
       : [
@@ -7221,6 +8183,10 @@ async function main(): Promise<void> {
     domainHash,
     artifacts: [
       { name: path.basename(lawUsdzPath) },
+      {
+        name: path.basename(compatibilityUsdaPath),
+        sha256: createHash("sha256").update(compatibilityUsda).digest("hex"),
+      },
       ...(packageAssetPath === undefined
         ? []
         : [{ name: path.basename(packageAssetPath) }]),
@@ -7245,20 +8211,15 @@ async function main(): Promise<void> {
     "utf8"
   );
 
+  stage("package asset + identity + summary");
   // ── 5. the typed TS client (#10 — the web sibling of codegen_dart), with the
   //       deployed law's content hash baked in (emitted AFTER the package is hashed) ──
-  const clientPath = path.join(outDir, `${cfg.name}.client.mjs`);
-  const clientDeclarationPath = path.join(outDir, `${cfg.name}.client.d.mts`);
-  const headlessClientPath = path.join(outDir, `${cfg.name}.headless.mjs`);
-  const headlessClientDeclarationPath = path.join(
-    outDir,
-    `${cfg.name}.headless.d.mts`
-  );
-  const operatorPath = path.join(outDir, `${cfg.name}.operator.mjs`);
-  const operatorDeclarationPath = path.join(
-    outDir,
-    `${cfg.name}.operator.d.mts`
-  );
+  // ONE TypeScript Reception per application: the typed surface tenant code binds
+  // (`receive<Name>Application`) and, in the same file, the holon-level factories a code-mode or
+  // unattended peer binds to any NomosHolon. It was two artifacts (".client" + ".headless") that
+  // differed only in whether those factories were exported.
+  const clientPath = path.join(outDir, `${cfg.name}.reception.mjs`);
+  const clientDeclarationPath = path.join(outDir, `${cfg.name}.reception.d.mts`);
   const frameworkOperatorPath = path.join(outDir, `${cfg.name}.framework.mjs`);
   const frameworkOperatorDeclarationPath = path.join(
     outDir,
@@ -7273,7 +8234,7 @@ async function main(): Promise<void> {
     domainHash,
     lawAssetName: `${cfg.name}.law.usdz`,
     interface: packageInterface,
-    compat: nomosCompat,
+    kernelContracts,
     homeDomain: resolveApplicationTopology(presentationDomainModules)
       .homeDomain,
     callUsda: [...typedLawGraphs].map(([name, graph]) => {
@@ -7283,84 +8244,94 @@ async function main(): Promise<void> {
       return { graph, paths };
     }),
   } as const;
-  const clientSource = generateTsClient(
-    presentationDomainModules,
-    clientOptions
+  // Both language clients are generated from this one composed application
+  // schema. The TypeScript binding is bundled into the application client;
+  // Dart's generated binding is emitted into its package below.
+  await tsOperationProtoPrewarm;
+  emitTsOperationProto(
+    cfgDir,
+    outDir,
+    lawUsdzPath,
+    [
+      ...new Map(
+        [...closedDomainModules, ...presentationDomainModules].map(
+          (module) => [module.name, module] as const
+        )
+      ).values(),
+    ],
+    typedLawGraphs,
+    typedLawPathsByName
   );
-  const headlessClientSource = generateTsClient(presentationDomainModules, {
+  const clientSource = generateTsClient(presentationDomainModules, {
     ...clientOptions,
     exportHolonFactory: true,
   });
-  const operatorSource = generateTsLifecycleOperator(clientOptions.callUsda);
   const frameworkOperatorSource = generateTsClient(presentationDomainModules, {
     ...clientOptions,
     frameworkOperatorOnly: true,
   });
-  const runtimePath = path.join(
-    DSL_DIR,
-    "runtime",
-    "generated-application-host.js"
+  // Generated bundles consume the compiler's declared Protobuf runtime. Do not rely on
+  // npm incidentally hoisting @bufbuild/protobuf into the tenant package: linked packages,
+  // pnpm and isolated installs are all entitled to use a different node_modules layout.
+  const compilerRequire = createRequire(import.meta.url);
+  const protobufEntry = compilerRequire.resolve("@bufbuild/protobuf");
+  const protobufCodegenEntry = compilerRequire.resolve(
+    "@bufbuild/protobuf/codegenv2"
+  );
+  const protobufTypes = protobufEntry.replace(/\.js$/, ".d.ts");
+  const protobufCodegenTypes = protobufCodegenEntry.replace(/\.js$/, ".d.ts");
+  const nodeModulesMarker = `${path.sep}node_modules${path.sep}`;
+  const nodeModulesIndex = protobufEntry.lastIndexOf(nodeModulesMarker);
+  if (nodeModulesIndex < 0) {
+    fail(`@bufbuild/protobuf resolved outside node_modules: ${protobufEntry}`);
+  }
+  const compilerNodeModules = protobufEntry.slice(
+    0,
+    nodeModulesIndex + nodeModulesMarker.length - 1
   );
-  if (!existsSync(runtimePath)) {
+  const protobufRuntimePlugin: import("esbuild").Plugin = {
+    name: "nomos-compiler-protobuf-runtime",
+    setup(build) {
+      build.onResolve({ filter: /^@bufbuild\/protobuf(?:\/.*)?$/ }, (args) => ({
+        path: compilerRequire.resolve(args.path),
+      }));
+    },
+  };
+  let runtimeTypesPath: string;
+  try {
+    runtimeTypesPath = path.join(
+      path.dirname(
+        createRequire(import.meta.url).resolve(
+          "@githolon/runtime/package.json"
+        )
+      ),
+      "src",
+      "application_reception.ts"
+    );
+  } catch {
     fail(
-      "the compiler-private generated application runtime is missing — reinstall @githolon/dsl"
+      "generated TypeScript applications require @githolon/runtime so they can link the shared Peer Office runtime"
     );
   }
   // Validate the generated ESM clients as ESM even when the tenant project has no package.json yet.
   // NodeNext classifies a plain `.ts` file from the nearest package boundary, so a freshly scaffolded
-  // or fixture-only project would otherwise be treated as CommonJS and reject the intentional
-  // `import.meta.url` used to locate its adjacent law asset. The compiler options below describe the
+  // or fixture-only project would otherwise be treated as CommonJS. The compiler options below describe the
   // generated `.mjs` runtime contract directly instead of inheriting unrelated tenant metadata.
   const temporaryClientPath = path.join(
     outDir,
-    `.${cfg.name}.client.source.ts`
-  );
-  const temporaryHeadlessClientPath = path.join(
-    outDir,
-    `.${cfg.name}.headless.source.ts`
-  );
-  const temporaryRuntimeTypesPath = path.join(
-    outDir,
-    `.${cfg.name}.application-runtime.d.ts`
+    `.${cfg.name}.reception.source.ts`
   );
   const temporaryDeclarationPath = temporaryClientPath.replace(
     /\.ts$/,
     ".d.ts"
   );
-  const temporaryHeadlessDeclarationPath = temporaryHeadlessClientPath.replace(
-    /\.ts$/,
-    ".d.ts"
-  );
-  const runtimeTypesSource = [
-    `export declare function nomosInternalOpenGeneratedApplication<T extends object>(`,
-    `  options: { cloud: string; application: string; signIn: (request?: { readonly deviceChallenge?: string }) => Promise<string>; onPerformance?: (sample: { readonly operation: "open" | "offer" | "birth" | "read" | "sync" | "maintenance"; readonly name: string; readonly durationMs: number; readonly domain?: string; readonly directive?: string }) => void; approveModel?: (decision: { readonly summary: string; readonly review: { checkedActions: number; candidateActions: number; sameOutcome: boolean | null; differences: { kind: "rules" | "outcome" | "evidence"; area?: string; action?: string; summary: string }[] } }) => Promise<{ readonly because: string }>; lawHash: string; readyCommands?: readonly { readonly domain: string; readonly packageHash: string; readonly directiveId: string }[]; frameworkCalls: unknown },`,
-    `  bind: (holon: unknown, user: { readonly identityId: string; readonly identityAddress: string }) => T,`,
-    `): Promise<T & {`,
-    `  currentStatus(): Promise<any>;`,
-    `  watchStatus(listener: (status: any) => void): () => void;`,
-    `}>;`,
-    `export declare function nomosInternalOpenGeneratedChildApplication<T extends object>(`,
-    `  parent: unknown,`,
-    `  workspace: string,`,
-    `  bind: (holon: unknown) => T,`,
-    `): Promise<T>;`,
-    `export declare function nomosInternalCreateInvitation(`,
-    `  holon: unknown,`,
-    `): Promise<{ readonly address: string; readonly token: string }>;`,
-    `export declare function nomosInternalRedeemInvitation(`,
-    `  holon: unknown,`,
-    `  link: string,`,
-    `  policies: readonly { readonly domain: string; readonly domainHash: string; readonly query: string; readonly redeem: string; readonly personField: string; readonly roleField: string; readonly scopeField: string }[],`,
-    `  frameworkCalls: unknown,`,
-    `): Promise<void>;`,
-    ``,
-  ].join("\n");
   // Declaration generation used to ask TypeScript to rebuild and reduce the same 800 KiB public type graph
   // on every law compile, even when an implementation-only plan edit left that graph byte-identical. Cache
   // the result by the exact generated source, runtime declaration boundary, TypeScript version and pruning
   // algorithm. The installed law hash is normalized because it changes runtime compatibility identity but
   // has type `string` in every public declaration. A typed USDA proof binds the cached declaration bytes;
   // there is no JSON cache manifest and no cached file can become runtime or custody authority.
+  stage("ts client source gen");
   const declarationProofCodec = (await import(
     "../compile_proof.mjs" as string
   )) as {
@@ -7376,14 +8347,7 @@ async function main(): Promise<void> {
     .update(`${declarationProofFormat}\0`)
     .update(normalizedClientSource)
     .update("\0")
-    .update(
-      headlessClientSource.replaceAll(
-        domainHash,
-        "<nomos-composed-law-identity>"
-      )
-    )
-    .update("\0")
-    .update(runtimeTypesSource)
+    .update(readFileSync(runtimeTypesPath))
     .update("\0")
     .update(ts.version)
     .update("\0")
@@ -7398,22 +8362,14 @@ async function main(): Promise<void> {
   );
   const declarationCachePath = path.join(
     declarationCacheDir,
-    `${declarationInputIdentity}.client.d.mts`
-  );
-  const headlessDeclarationCachePath = path.join(
-    declarationCacheDir,
-    `${declarationInputIdentity}.headless.d.mts`
+    `${declarationInputIdentity}.reception.d.mts`
   );
   const declarationCacheProofPath = path.join(
     declarationCacheDir,
-    `${declarationInputIdentity}.client.proof.usda`
-  );
-  const headlessDeclarationCacheProofPath = path.join(
-    declarationCacheDir,
-    `${declarationInputIdentity}.headless.proof.usda`
+    `${declarationInputIdentity}.reception.proof.usda`
   );
   const declarationProofKey = (
-    artifact: "client" | "headless",
+    artifact: "reception",
     bytes: Buffer
   ): string =>
     createHash("sha256")
@@ -7425,29 +8381,18 @@ async function main(): Promise<void> {
   const cachedDeclaration = existsSync(declarationCachePath)
     ? readFileSync(declarationCachePath)
     : undefined;
-  const cachedHeadlessDeclaration = existsSync(headlessDeclarationCachePath)
-    ? readFileSync(headlessDeclarationCachePath)
-    : undefined;
   const declarationCacheHit =
     cachedDeclaration !== undefined &&
-    cachedHeadlessDeclaration !== undefined &&
     declarationProofCodec.readKeyProofUsda(
       declarationCacheProofPath,
       declarationProofFormat
-    ) === declarationProofKey("client", cachedDeclaration) &&
-    declarationProofCodec.readKeyProofUsda(
-      headlessDeclarationCacheProofPath,
-      declarationProofFormat
-    ) === declarationProofKey("headless", cachedHeadlessDeclaration);
+    ) === declarationProofKey("reception", cachedDeclaration);
   if (declarationCacheHit) {
     copyFileSync(declarationCachePath, clientDeclarationPath);
-    copyFileSync(headlessDeclarationCachePath, headlessClientDeclarationPath);
   }
   try {
     if (!declarationCacheHit) {
       writeFileSync(temporaryClientPath, clientSource, "utf8");
-      writeFileSync(temporaryHeadlessClientPath, headlessClientSource, "utf8");
-      writeFileSync(temporaryRuntimeTypesPath, runtimeTypesSource, "utf8");
       const typescriptEntry = createRequire(import.meta.url).resolve(
         "typescript/lib/typescript.js"
       );
@@ -7455,11 +8400,7 @@ async function main(): Promise<void> {
         pathToFileURL(typescriptEntry).href
       )) as typeof import("typescript");
       const program = ts.createProgram(
-        [
-          temporaryClientPath,
-          temporaryHeadlessClientPath,
-          temporaryRuntimeTypesPath,
-        ],
+        [temporaryClientPath],
         {
           target: ts.ScriptTarget.ES2022,
           module: ts.ModuleKind.ESNext,
@@ -7472,14 +8413,28 @@ async function main(): Promise<void> {
           allowImportingTsExtensions: true,
           baseUrl: outDir,
           paths: {
-            "@githolon/client/_generated_application_host_7c1f5e": [
-              temporaryRuntimeTypesPath,
-            ],
+            "@githolon/runtime/application": [runtimeTypesPath],
+            "@bufbuild/protobuf": [protobufTypes],
+            "@bufbuild/protobuf/codegenv2": [protobufCodegenTypes],
           },
           outDir,
         }
       );
-      const emit = program.emit();
+      // The runtime contract deliberately imports its generated framework types from the client package.
+      // Those are dependencies, not compiler output. Capture only declarations whose source is one of the
+      // two generated application roots; otherwise TypeScript mirrors the client package's source tree under
+      // the tenant build directory and makes a second apparent type system.
+      const emit = program.emit(
+        undefined,
+        (_fileName, data, _writeByteOrderMark, _onError, sourceFiles) => {
+          const sourceNames = (sourceFiles ?? []).map((source) =>
+            path.resolve(source.fileName)
+          );
+          if (sourceNames.includes(path.resolve(temporaryClientPath))) {
+            writeFileSync(temporaryDeclarationPath, data, "utf8");
+          }
+        }
+      );
       const diagnostics = [
         ...ts.getPreEmitDiagnostics(program),
         ...emit.diagnostics,
@@ -7487,8 +8442,7 @@ async function main(): Promise<void> {
       if (
         diagnostics.length > 0 ||
         emit.emitSkipped ||
-        !existsSync(temporaryDeclarationPath) ||
-        !existsSync(temporaryHeadlessDeclarationPath)
+        !existsSync(temporaryDeclarationPath)
       ) {
         const detail = diagnostics
           .map((diagnostic) => {
@@ -7706,38 +8660,18 @@ async function main(): Promise<void> {
       ].join("\n");
       writeFileSync(temporaryDeclarationPath, declarationSource, "utf8");
       renameSync(temporaryDeclarationPath, clientDeclarationPath);
-      renameSync(
-        temporaryHeadlessDeclarationPath,
-        headlessClientDeclarationPath
-      );
       mkdirSync(declarationCacheDir, { recursive: true });
       const declarationCacheTemporaryPath = `${declarationCachePath}.tmp-${process.pid}`;
-      const headlessDeclarationCacheTemporaryPath = `${headlessDeclarationCachePath}.tmp-${process.pid}`;
       copyFileSync(clientDeclarationPath, declarationCacheTemporaryPath);
-      copyFileSync(
-        headlessClientDeclarationPath,
-        headlessDeclarationCacheTemporaryPath
-      );
       renameSync(declarationCacheTemporaryPath, declarationCachePath);
-      renameSync(
-        headlessDeclarationCacheTemporaryPath,
-        headlessDeclarationCachePath
-      );
       declarationProofCodec.writeKeyProofUsda(
         declarationCacheProofPath,
         declarationProofFormat,
-        declarationProofKey("client", readFileSync(declarationCachePath))
-      );
-      declarationProofCodec.writeKeyProofUsda(
-        headlessDeclarationCacheProofPath,
-        declarationProofFormat,
-        declarationProofKey(
-          "headless",
-          readFileSync(headlessDeclarationCachePath)
-        )
+        declarationProofKey("reception", readFileSync(declarationCachePath))
       );
     }
-    await esbuildMod.build({
+    stage("ts declarations");
+    const clientBundle = await esbuildMod.build({
       stdin: {
         contents: clientSource,
         loader: "ts",
@@ -7745,6 +8679,8 @@ async function main(): Promise<void> {
         sourcefile: `${cfg.name}.client.ts`,
       },
       outfile: clientPath,
+      write: false,
+      metafile: true,
       bundle: true,
       packages: "bundle",
       platform: "node",
@@ -7752,132 +8688,42 @@ async function main(): Promise<void> {
       target: "node20",
       legalComments: "none",
       logLevel: "silent",
-      plugins: [
-        {
-          name: "nomos-generated-application-runtime",
-          setup(build) {
-            build.onResolve(
-              {
-                filter:
-                  /^@githolon\/client\/_generated_application_host_7c1f5e$/,
-              },
-              () => ({ path: runtimePath })
-            );
-          },
-        },
-      ],
+      nodePaths: [compilerNodeModules],
+      plugins: [protobufRuntimePlugin],
+      external: [APPLICATION_CONTRACT_MODULE],
+    });
+    assertGeneratedClientBundleBoundary(clientBundle.metafile, {
+      workingDirectory: process.cwd(),
+      generatedEntry: path.join(outDir, `${cfg.name}.client.ts`),
+      operationCodec: path.join(outDir, "operation_payloads_pb.ts"),
+      protobufPackageRoot: protobufPackageRoot(protobufEntry),
     });
     const bundled = canonicalizeGeneratedClientJavascript(
-      readFileSync(clientPath, "utf8")
+      clientBundle.outputFiles[0]!.text
     );
     writeFileSync(clientPath, bundled, "utf8");
     if (
-      /^import\s+.*["']@githolon\/client/m.test(bundled) ||
-      /export\s*\{[^}]*nomosInternalOpenGeneratedApplication/s.test(bundled)
+      !/^import\s+.*["']@githolon\/runtime\/application["']/m.test(bundled)
     ) {
       fail(
-        "generated TypeScript application did not seal its private runtime binding"
+        "generated TypeScript application did not link the shared Peer Office runtime"
       );
     }
-    await esbuildMod.build({
-      stdin: {
-        contents: headlessClientSource,
-        loader: "ts",
-        resolveDir: outDir,
-        sourcefile: `${cfg.name}.headless.ts`,
-      },
-      outfile: headlessClientPath,
-      bundle: true,
-      packages: "bundle",
-      platform: "node",
-      format: "esm",
-      target: "node20",
-      legalComments: "none",
-      logLevel: "silent",
-      plugins: [
-        {
-          name: "nomos-generated-headless-runtime",
-          setup(build) {
-            build.onResolve(
-              {
-                filter:
-                  /^@githolon\/client\/_generated_application_host_7c1f5e$/,
-              },
-              () => ({ path: runtimePath })
-            );
-          },
-        },
-      ],
-    });
-    const headlessBundled = canonicalizeGeneratedClientJavascript(
-      readFileSync(headlessClientPath, "utf8")
-    );
-    writeFileSync(headlessClientPath, headlessBundled, "utf8");
     if (
       !new RegExp(
         `export\\s*\\{[^}]*${tsClientFactoryName(
           resolveApplicationTopology(presentationDomainModules).homeDomain
         )}`,
         "s"
-      ).test(headlessBundled)
+      ).test(bundled)
     ) {
-      fail(
-        "generated headless application omitted its structural holon factory"
-      );
-    }
-    if (operatorSource !== undefined) {
-      const operatorDeclaration = ts.transpileDeclaration(operatorSource, {
-        fileName: `${cfg.name}.operator.ts`,
-        compilerOptions: {
-          target: ts.ScriptTarget.ES2022,
-          module: ts.ModuleKind.ESNext,
-          strict: true,
-        },
-        reportDiagnostics: true,
-      });
-      const operatorErrors = (operatorDeclaration.diagnostics ?? []).filter(
-        (diagnostic) => diagnostic.category === ts.DiagnosticCategory.Error
-      );
-      if (operatorErrors.length > 0) {
-        fail(
-          `generated TypeScript lifecycle operator declarations are invalid — this is a Nomos codegen bug:\n${operatorErrors
-            .map((diagnostic) =>
-              ts.flattenDiagnosticMessageText(diagnostic.messageText, "\n")
-            )
-            .join("\n")}`
-        );
-      }
-      writeFileSync(
-        operatorDeclarationPath,
-        operatorDeclaration.outputText,
-        "utf8"
-      );
-      await esbuildMod.build({
-        stdin: {
-          contents: operatorSource,
-          loader: "ts",
-          resolveDir: outDir,
-          sourcefile: `${cfg.name}.operator.ts`,
-        },
-        outfile: operatorPath,
-        bundle: true,
-        platform: "neutral",
-        format: "esm",
-        target: "es2022",
-        legalComments: "none",
-        logLevel: "silent",
-      });
-      writeFileSync(
-        operatorPath,
-        canonicalizeGeneratedClientJavascript(
-          readFileSync(operatorPath, "utf8")
-        ),
-        "utf8"
-      );
-    } else {
-      rmSync(operatorPath, { force: true });
-      rmSync(operatorDeclarationPath, { force: true });
+      fail("generated Reception omitted its structural holon factory");
     }
+    stage("client bundle");
+    // Lifecycle belongs to Peer Office. Remove outputs from older compiler
+    // versions instead of generating a tenant-specific operator runtime.
+    rmSync(path.join(outDir, `${cfg.name}.operator.mjs`), { force: true });
+    rmSync(path.join(outDir, `${cfg.name}.operator.d.mts`), { force: true });
     const frameworkOperatorDeclaration = ts.transpileDeclaration(
       frameworkOperatorSource,
       {
@@ -7910,7 +8756,7 @@ async function main(): Promise<void> {
       "utf8"
     );
     writeFileSync(frameworkOperatorSourcePath, frameworkOperatorSource, "utf8");
-    await esbuildMod.build({
+    const frameworkBundle = await esbuildMod.build({
       stdin: {
         contents: frameworkOperatorSource,
         loader: "ts",
@@ -7918,17 +8764,28 @@ async function main(): Promise<void> {
         sourcefile: `${cfg.name}.framework.ts`,
       },
       outfile: frameworkOperatorPath,
+      write: false,
+      metafile: true,
       bundle: true,
       platform: "neutral",
       format: "esm",
       target: "es2022",
       legalComments: "none",
       logLevel: "silent",
+      nodePaths: [compilerNodeModules],
+      plugins: [protobufRuntimePlugin],
+      external: [APPLICATION_CONTRACT_MODULE],
+    });
+    assertGeneratedClientBundleBoundary(frameworkBundle.metafile, {
+      workingDirectory: process.cwd(),
+      generatedEntry: path.join(outDir, `${cfg.name}.framework.ts`),
+      operationCodec: path.join(outDir, "operation_payloads_pb.ts"),
+      protobufPackageRoot: protobufPackageRoot(protobufEntry),
     });
     writeFileSync(
       frameworkOperatorPath,
       canonicalizeGeneratedClientJavascript(
-        readFileSync(frameworkOperatorPath, "utf8")
+        frameworkBundle.outputFiles[0]!.text
       ),
       "utf8"
     );
@@ -7940,62 +8797,18 @@ async function main(): Promise<void> {
     );
   } finally {
     rmSync(temporaryClientPath, { force: true });
-    rmSync(temporaryHeadlessClientPath, { force: true });
-    rmSync(temporaryRuntimeTypesPath, { force: true });
     rmSync(temporaryDeclarationPath, { force: true });
-    rmSync(temporaryHeadlessDeclarationPath, { force: true });
-    rmSync(path.join(outDir, `${cfg.name}.client.ts`), { force: true });
+    // Outputs of earlier compiler versions: the two-artifact split and its source sidecar.
+    for (const stale of [".client.ts", ".client.mjs", ".client.d.mts", ".headless.mjs", ".headless.d.mts"]) {
+      rmSync(path.join(outDir, `${cfg.name}${stale}`), { force: true });
+    }
   }
 
+  stage("framework bundle");
   // ── 6. the typed Dart frontend (opt-in; the Flutter sibling of step 5, emitted
   //       after the package hash like the TS client) ──
-  const dartCfg = cfg.dart ?? false;
-  if (
-    dartCfg !== false &&
-    dartCfg !== true &&
-    (typeof dartCfg !== "object" ||
-      dartCfg === null ||
-      (dartCfg.out !== undefined && typeof dartCfg.out !== "string") ||
-      (dartCfg.support !== undefined &&
-        dartCfg.support !== "vendored" &&
-        dartCfg.support !== "package") ||
-      (dartCfg.barrel !== undefined &&
-        !/^[a-z][a-z0-9_]*$/.test(String(dartCfg.barrel))) ||
-      (dartCfg.names !== undefined &&
-        (typeof dartCfg.names !== "object" ||
-          dartCfg.names === null ||
-          Array.isArray(dartCfg.names))) ||
-      (dartCfg.packages !== undefined &&
-        (typeof dartCfg.packages !== "object" ||
-          dartCfg.packages === null ||
-          typeof dartCfg.packages.types !== "string" ||
-          typeof dartCfg.packages.client !== "string")))
-  ) {
-    fail(
-      `config key 'dart' must be false, true, or { out?: "relative/dir", support?: "vendored" | "package", barrel?: "snake_case_name", packages?: { types, client, test?, compat? }, names?: { Generated: "Alias" } }; got ${JSON.stringify(
-        dartCfg
-      )}`
-    );
-  }
-  const dartPackages =
-    typeof dartCfg === "object" ? dartCfg.packages : undefined;
-  const dartNames = typeof dartCfg === "object" ? dartCfg.names : undefined;
-  if (
-    dartPackages !== undefined &&
-    typeof dartCfg === "object" &&
-    dartCfg.support === "vendored"
-  ) {
-    fail(
-      `dart.packages requires support: "package" — layered pub packages depend on the published ` +
-        `nomos_types/nomos_client cores; vendoring contradicts the package boundary`
-    );
-  }
-  const dartSupportImport: DartSupportImport =
-    typeof dartCfg === "object" && dartCfg.support !== undefined
-      ? dartCfg.support
-      : dartPackages !== undefined
-      ? "package"
-      : "vendored";
+  await dartOperationProtoPrewarm;
+  const dartSupportImport: DartSupportImport = "package";
   let dartOut: string | undefined;
   let dartFiles: string[] = [];
   let dartCursedHints: string[] = [];
@@ -8018,7 +8831,6 @@ async function main(): Promise<void> {
         packageInterface,
         dartPackages,
         dartNames,
-        nomosCompat,
         cfg.name,
         lawUsdzPath,
         cfg.application?.maxChildWorkspacesPerUser,
@@ -8047,11 +8859,11 @@ async function main(): Promise<void> {
         packageInterface,
         dartSupportImport,
         dartBarrel,
-        nomosCompat,
         dartNames,
         cfg.name
       );
     }
+    stage("dart emit");
     // COMPILE-VALID MUST MEAN COMPILABLE (co2): `githolon compile` reported success while the generated Dart
     // had hard compiler errors (a duplicate id symbol, missing contract-id defs). Run `dart analyze` over the
     // emitted Dart as a SYMBOL-RESOLUTION GATE — a real analysis ERROR fails the compile (with the analyzer's
@@ -8067,7 +8879,7 @@ async function main(): Promise<void> {
       // Analyze exactly THE FILES THIS COMPILE EMITTED (`dartFiles`) — never the whole dir, which would
       // sweep in the transactional `.nomos-bak` backup and any stale legacy-layout leftovers and judge the
       // compile on files it did not write. First `dart pub get` each emitted PACKAGE (a dir up-chain with a
-      // pubspec) so `package:` imports resolve; a self-contained vendored emit has no pubspec (no get needed).
+      // pubspec) so fixed `package:` imports resolve.
       const emittedDart = dartFiles.filter((f) => f.endsWith(".dart"));
       const pkgDirOf = (file: string): string | undefined => {
         let dir = path.dirname(file);
@@ -8082,9 +8894,9 @@ async function main(): Promise<void> {
         }
         return undefined;
       };
-      // Only files under a PUB PACKAGE (a pubspec up-chain) are verifiable — a VENDORED no-pubspec emit's
-      // runtime `package:nomos_client` imports cannot resolve without a package config, so judging those
-      // files would false-fail every vendored fixture. Analyze the in-package set; note the loose remainder.
+      // Only files under a PUB PACKAGE (a pubspec up-chain) are verifiable.
+      // A loose output directory has no package configuration against which
+      // `nomos_client` can be resolved; note it rather than inventing runtime copies.
       const inPackage = emittedDart.filter((f) => pkgDirOf(f) !== undefined);
       const pkgDirs = [
         ...new Set(
@@ -8096,8 +8908,8 @@ async function main(): Promise<void> {
       // necessarily LAG the local source the compiler was built alongside (tooling+client move in lockstep,
       // CLAUDE.md). So the analyze gate must resolve against the LOCAL Dart source, else it judges freshly-
       // emitted client code against a stale hosted runtime (e.g. a method the current codegen calls that the
-      // last publish predates). We write a `pubspec_overrides.yaml` pointing nomos_client/nomos_types at the
-      // repo's own `dsl/dart` / `dsl/dart_types`. An INSTALLED tenant (`npx githolon`, compiler under
+      // last publish predates). We write a `pubspec_overrides.yaml` pointing the runtime packages at this
+      // checkout's `dsl/dart`, `dsl/dart_types` and `nomos_peer_host`. An INSTALLED tenant (`npx githolon`, compiler under
       // node_modules) gets NO override — it verifies against exactly the hosted runtime it will ship against.
       const localDart = (() => {
         const selfDir = path.dirname(fileURLToPath(import.meta.url));
@@ -8105,18 +8917,13 @@ async function main(): Promise<void> {
           return undefined;
         const client = path.resolve(selfDir, "..", "dart");
         const types = path.resolve(selfDir, "..", "dart_types");
-        const flutter = path.resolve(selfDir, "..", "..", "nomos_flutter");
+        const peerHost = path.resolve(selfDir, "..", "..", "nomos_peer_host");
         if (
           existsSync(path.join(client, "pubspec.yaml")) &&
-          existsSync(path.join(types, "pubspec.yaml"))
+          existsSync(path.join(types, "pubspec.yaml")) &&
+          existsSync(path.join(peerHost, "pubspec.yaml"))
         ) {
-          return {
-            client,
-            types,
-            ...(existsSync(path.join(flutter, "pubspec.yaml"))
-              ? { flutter }
-              : {}),
-          };
+          return { client, types, peerHost };
         }
         return undefined;
       })();
@@ -8127,7 +8934,21 @@ async function main(): Promise<void> {
         if (existsSync(file) && readFileSync(file, "utf8") === text) return;
         writeFileSync(file, text, "utf8");
       };
-      for (const pkg of pkgDirs) {
+      // The dependency reconciler pins nomos_client/nomos_types into the tenant package a FLAT
+      // `dart.out` writes into, which for `dart.out: pkg/lib` sits ABOVE `dart.out` and so is
+      // invisible to `pkgDirOf`. Pinning a dep there while withholding the override left a source
+      // checkout emitting a package that cannot `pub get` at all (the pinned version is the one
+      // this compiler is being released WITH, so it is not on pub yet). Override it too. It is not
+      // added to `pkgDirs`: the analyze gate judges what the compiler emitted, never a tenant
+      // package's own hand-written code.
+      const overrideDirs = [
+        ...new Set(
+          [...pkgDirs, flatDartPackageRoot(dOut)].filter(
+            (dir): dir is string => dir !== undefined
+          )
+        ),
+      ];
+      for (const pkg of overrideDirs) {
         // Layered Dart output is generated-owned, including the compiler's temporary source-dogfood
         // override. A package may have been generated previously by a source checkout and then rebuilt
         // by the published compiler. In that transition, doing nothing here leaves the old absolute
@@ -8140,7 +8961,6 @@ async function main(): Promise<void> {
           const lines = ["dependency_overrides:"];
           const usesClient = /(^|\n)\s+nomos_client\s*:/.test(spec);
           const usesTypes = /(^|\n)\s+nomos_types\s*:/.test(spec);
-          const usesFlutter = /(^|\n)\s+nomos_flutter\s*:/.test(spec);
           if (usesClient)
             lines.push(`  nomos_client:`, `    path: ${localDart.client}`);
           // A generated CLIENT or TEST package may only mention nomos_client directly, but that local
@@ -8151,12 +8971,13 @@ async function main(): Promise<void> {
           // to absorb for tenant developers.
           if (usesTypes || usesClient)
             lines.push(`  nomos_types:`, `    path: ${localDart.types}`);
-          // The generated client application imports nomos_flutter, and a TEST package reaches that
-          // application transitively through its generated client sibling. Overrides do not propagate,
-          // so every local nomos_client solve root must also seat the matching local Flutter host even
-          // when its own pubspec does not name nomos_flutter directly.
-          if ((usesFlutter || usesClient) && localDart.flutter)
-            lines.push(`  nomos_flutter:`, `    path: ${localDart.flutter}`);
+          // nomos_client consumes the peer-driven shell capability contract.
+          // Overrides do not propagate into this package's solve root.
+          if (usesClient)
+            lines.push(
+              `  nomos_peer_host:`,
+              `    path: ${localDart.peerHost}`
+            );
           if (lines.length > 1) {
             writeTextIfChanged(overrideFile, lines.join("\n") + "\n");
           }
@@ -8246,9 +9067,10 @@ async function main(): Promise<void> {
             .join(" ")}`;
         }
       }
+      stage("dart pub get");
       // The analyzer is a real codegen gate, but an identical generated Dart graph against identical
       // resolved packages and framework sources does not become more valid by launching another analyzer
-      // process. Content-address that verdict as USDA. Any generated type/client change, pub resolution,
+      // process. Content-address that verdict as USDA. Any generated type/peer-office change, pub resolution,
       // local dogfood runtime change, or Dart SDK version change produces a different key and runs the real
       // analyzer before the proof is written.
       const collectDartAnalysisFiles = (root: string): string[] => {
@@ -8374,6 +9196,7 @@ async function main(): Promise<void> {
           }
         }
       }
+      stage("dart analyze");
       // Only analyze when EVERY package's deps resolved: `dart analyze` against an unresolved package reports
       // every framework symbol (NomosRef, …) as undefined — a meaningless flood, not a real defect. An
       // unresolved dep is already surfaced as UNVERIFIED below (e.g. a fixture pinning an as-yet-unpublished
@@ -8396,7 +9219,7 @@ async function main(): Promise<void> {
         );
       } else if (emittedDart.length > 0) {
         console.log(
-          `  dart —     vendored (no pub package) emit — runtime package imports are unverifiable without a pubspec; analysis skipped (use dart.packages for a fully-gated pub package)`
+          `  dart ⚠     UNVERIFIED — generated output has no pubspec, so fixed nomos_client imports cannot be analyzed (emit a Dart package to enable the gate)`
         );
       }
     }
@@ -8409,6 +9232,13 @@ async function main(): Promise<void> {
     `  law        ${rel(lawUsdzPath)} (${lawUsdz.byteLength} transport bytes)`
   );
   console.log(`  domainHash ${domainHash}`);
+  console.log(
+    custodyPlacementDeclarations.length > 0
+      ? `  placement  ${rel(custodyPlacementDeclarationsPath)} (${
+          custodyPlacementDeclarations.length
+        } explicit declaration(s); separate frontier)`
+      : "  placement  — no custody-placement declarations"
+  );
   console.log(
     `  custody    ${rel(
       layeredRootPath
@@ -8421,6 +9251,17 @@ async function main(): Promise<void> {
         }`
       : `  usdcat     ⚠ unavailable — set NOMOS_REQUIRE_USDCAT=1 in release CI to make this proof mandatory`
   );
+  console.log("  contracts  ✓ generated Protobuf query results and public payloads match the kernel's law-derived contracts");
+  console.log(
+    compiledReadProjection
+      ? "  read-law   ✓ authenticated OpenUSD read projection packaged"
+      : "  read-law   ⚠ compiler unavailable; runtime will compose source law on first open"
+  );
+  console.log(
+    compiledCommandProjection
+      ? "  commands   ✓ authenticated OpenUSD command projection packaged"
+      : "  commands   ⚠ compiler unavailable; runtime will compose source law before first command"
+  );
   {
     const sum = (
       pick: (
@@ -8490,28 +9331,14 @@ async function main(): Promise<void> {
     }
   }
   console.log(
-    `  client     ${rel(
-      clientPath
-    )} (typed TS client — payloads, read models, query accessors)`
-  );
-  console.log(
-    `  headless   ${rel(headlessClientPath)} + ${rel(
-      headlessClientDeclarationPath
-    )} (typed business binding for code-mode/edge holons)`
+    `  reception  ${rel(clientPath)} + ${rel(
+      clientDeclarationPath
+    )} (the application's TypeScript Reception: typed surface + holon-level factories)`
   );
   for (const note of recursiveNotes) console.log(`  note       ${note}`);
   console.log(
     `  openapi    served by the holon from installed USDA (GET /v2/workspaces/<ws>/openapi.json) — no build-time copy to drift`
   );
-  if (proofPath !== undefined) {
-    console.log(
-      `  proof      ${rel(
-        proofPath
-      )} (a runnable e2e GENERATED from your law — run: githolon proof)`
-    );
-  } else {
-    console.log(`  proof      SKIPPED — ${proofSkip}`);
-  }
   for (const w of birthWarnings) {
     console.log(`  ⚠ births   ${w}`);
   }
@@ -8523,9 +9350,7 @@ async function main(): Promise<void> {
   //    compile runs it implicitly and REFUSES on any refuse-level finding (a statically-provable
   //    runtime refusal shipped as law). Warns/notes are printed but never block the compile.
   const allCheckFindings = authorTimeFindings;
-  const isFrameworkFinding = (finding: (typeof allCheckFindings)[number]) =>
-    finding.domain === APPLICATION_HOME_DOMAIN ||
-    finding.directiveId?.startsWith("nomos_internal_") === true;
+  const isFrameworkFinding = isFrameworkAuthorTimeFinding;
   const checkFindings = allCheckFindings.filter(
     (finding) => !isFrameworkFinding(finding)
   );
@@ -8594,14 +9419,10 @@ async function main(): Promise<void> {
         );
       }
     } else {
-      const supportText =
-        dartSupportImport === "vendored"
-          ? "vendored nomos_client support"
-          : "package nomos_client imports";
       console.log(
         `  dart       ${rel(dartOut)}${path.sep} (${
           dartFiles.length
-        } domain file(s) + ${supportText} — typed Dart for Flutter)`
+        } domain file(s) + package nomos_client imports — typed Dart for Flutter)`
       );
     }
   }
@@ -8610,34 +9431,17 @@ async function main(): Promise<void> {
   );
   console.log(``);
   console.log(`your business path:`);
-  if (priorLock !== undefined) {
-    console.log(
-      `  npx githolon proof --upgrade  # candidate -> exact existing history -> disposable promotion -> cold restart`
-    );
-  }
-  if (proofPath !== undefined) {
-    console.log(
-      `  npx githolon proof         # generated birth -> verify -> durable restore -> business read-back`
-    );
-    console.log(
-      `  npx githolon dev           # rerun that proof on every save`
-    );
-    console.log(
-      `  npx githolon proof --live  # the same business proof against Nomos Cloud`
-    );
-    if (proofDomains.length > 1) {
-      console.log(
-        `  this package proves all ${
-          proofDomains.length
-        } business areas together (${proofDomains.join(", ")})`
-      );
-    }
-  } else {
-    console.log(
-      `  add a business birth declaration to generate an end-to-end proof`
-    );
-  }
+  console.log(
+    `  npx githolon test          # generated Dart scenarios against the real local custody plane`
+  );
+  console.log(
+    `  vitest + @githolon/testing # drive ${cfg.name}.reception.mjs through the real kernel from TypeScript`
+  );
+  console.log(
+    `  npx githolon dev           # recompile and re-check on every save`
+  );
 
+  stage("summary + author-time gate");
   if (analyzeFlag) runDartAnalyze(dartOut);
 
   // The unchanged lane is itself USDA: a disposable content proof under
@@ -8689,6 +9493,7 @@ async function main(): Promise<void> {
       law: lawUsdzPath,
     });
   }
+  stage("compile proof");
 }
 
 /**