@githolon/dsl 0.108.7 → 0.110.1

package/src/codegen_ts.ts

@@ -1,3 +1,4 @@
+import { refusalContracts, tsRefusalDecoder, tsRefusalDecoders } from "./codegen_refusal.js";
 // NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
 // remotes are replaceable custody/transport, not truth.  ⇒ ONE Nomos GitHolon
 // wasm32-wasip1 artifact {kernel · projection · embedded
@@ -9,7 +10,7 @@
  * TS CLIENT CODEGEN (#10) — the WEB sibling of `codegen_dart.ts`.
  *
  * Dart apps get generated payload classes / read models / typed query accessors;
- * until this file, a web app on `@githolon/client` hand-typed directive ids and
+ * until this file, a web app on `@githolon/runtime` hand-typed directive ids and
  * payload shapes against framework transport primitives. `generateTsClient(modules,
  * opts)` closes that: ONE generated `.ts` file per package, emitted by
  * `nomos-compile` AFTER the package is hashed (the deployed law's content hash is
@@ -29,12 +30,13 @@
  *   * a CLIENT FACTORY per domain — typed `offer` wrappers bound to the baked
  *     domainHash, typed declared-query accessors, and by-id read/watch helpers —
  *     over a STRUCTURAL `NomosHolon` interface, so the file has ZERO imports and
- *     binds to `@githolon/client`'s `connect()` result (browser or node) as-is.
+ *     binds to `@githolon/runtime`'s `connect()` result (browser or node) as-is.
  *
  * Like every emitter here: NO FALLBACK. An unsupported zod shape throws at compile
  * time, never degrades to `any` silently.
  */
 import type { z } from "zod";
+import { generateTsWorkspaceAccessRead } from "./codegen_workspace_access.js";
 
 import {
   BUSINESS_BIRTH_SEED_PAYLOAD_FIELD,
@@ -75,10 +77,12 @@ import {
   collectActivityDescriptors,
   type PackageActivityEntry,
 } from "./codegen_dart.js";
-import type { NomosCompat } from "./compat_manifest.js";
+import { emitApplicationCompatibilityUsda } from "./compatibility_usda.js";
+import type { OsgiContractRequirement } from "./kernel_capabilities.js";
 import type { QueryDecl } from "./query.js";
 import {
   collectPayloadValueObjectDescriptors,
+  collectSchemaValueObjectDescriptors,
   collectValueObjectDescriptors,
   idOfMetaOf,
   idOfTargetKindOf,
@@ -89,6 +93,8 @@ import {
 import { recursiveTypeBaseName, zodUnwrapLazy } from "./zod_lazy.js";
 import { finishCount } from "./count.js";
 import { finishSum } from "./sum.js";
+import { finishExtremum } from "./extremum.js";
+import { finishExists } from "./exists.js";
 import type { AnyDerivedDecl } from "./derived.js";
 import type { CombinedDecl } from "./combined.js";
 import {
@@ -107,7 +113,7 @@ import {
   isNamespacedAggregate,
   qualifyReadProjectionType,
 } from "./read_projection_namespace.js";
-import { publicClientInterface, type DomainInterface } from "./shape_compat.js";
+import { publicClientInterface, type DomainInterface } from "./compatibility_graph.js";
 import {
   buildNomosDescribeModel,
   type NomosDescribeModel,
@@ -125,7 +131,7 @@ import {
 import { contractTypeName } from "./contract.js";
 import { resolveApplicationTopology } from "./application_topology.js";
 import { recipientMetaOf } from "./recipient.js";
-import type { LawGraph } from "./law_graph.js";
+import type { LawGraph, LawRowReadNode } from "./law_graph.js";
 import {
   zodArrayElement,
   zodDef,
@@ -134,10 +140,12 @@ import {
   zodObjectShape,
 } from "./zod_introspection.js";
 import {
-  emitTsCallUsdaEncoder,
-  TS_CALL_USDA_PRELUDE,
-  type TsCallUsdaFieldAccess,
-} from "./codegen_call_usda.js";
+  emitTsCallProtoEncoder,
+  publishingIntentOf,
+  TS_CALL_PROTO_PRELUDE,
+  type TsCallProtoFieldAccess,
+} from "./codegen_call_proto.js";
+import { TS_QUERY_USDA_PRELUDE } from "./codegen_call_usda.js";
 import {
   emitTsResultDecoder,
   emitTsValueObjectDecoders,
@@ -146,9 +154,13 @@ import {
   type TsResultAggregate,
 } from "./codegen_result_usda.js";
 import {
-  emitTsQueryUsdaEncoder,
+  emitTsQueryProtoEncoder,
   type QueryScalarKind,
-} from "./codegen_query_usda.js";
+} from "./codegen_query_proto.js";
+import {
+  emitTsQueryResultProtoDecoder,
+  TS_RESULT_PROTO_PRELUDE,
+} from "./codegen_result_proto.js";
 
 const cap = (s: string) => (s.length ? s[0]!.toUpperCase() + s.slice(1) : s);
 const camel = (s: string) =>
@@ -220,11 +232,7 @@ export const tsHashConstName = (packageName: string): string =>
 
 /** `tool-library` → `TOOL_LIBRARY_INTERFACE` — the baked structural-interface const (#72). */
 export const interfaceConstName = (packageName: string): string =>
-  `${upperSnake(packageName)}_INTERFACE`;
-
-/** `tool-library` → `TOOL_LIBRARY_COMPAT` — the baked client/law compat manifest (§5). */
-export const compatConstName = (packageName: string): string =>
-  `${upperSnake(packageName)}_COMPAT`;
+  `${upperSnake(packageName)}_COMPATIBILITY_MATRIX_USDA`;
 
 /** `tool-library` → `TOOL_LIBRARY_ENCRYPTION` — the baked E2E-sealing map (the sealing client). */
 export const encryptionConstName = (packageName: string): string =>
@@ -257,7 +265,7 @@ export interface EncDomainMap {
   >;
 }
 
-/** The sid-keyed read shape of ONE domain's interface (mirrors `shape_compat.ts` DomainInterface). */
+/** The sid-keyed read shape of ONE domain's interface (mirrors `compatibility_graph.ts` DomainInterface). */
 export interface InterfaceAggShape {
   readonly sid: string;
   readonly label: string;
@@ -775,8 +783,8 @@ function payloadReferenceTypes(schema: z.ZodTypeAny): Set<string> {
  * graph fields that are not authored by this directive are compile-time omitted. */
 function operatorCallFieldAccess(
   schema?: z.ZodTypeAny
-): ReadonlyMap<string, TsCallUsdaFieldAccess> {
-  const access = new Map<string, TsCallUsdaFieldAccess>();
+): ReadonlyMap<string, TsCallProtoFieldAccess> {
+  const access = new Map<string, TsCallProtoFieldAccess>();
   const shape =
     schema !== undefined && zodKind(schema) === "object"
       ? zodObjectShape(schema)
@@ -796,6 +804,10 @@ function operatorCallFieldAccess(
     const idTarget = idOfMetaOf(fieldSchema);
     if (idTarget !== undefined) {
       const expected = JSON.stringify(idTarget);
+      // A contract is implemented by its owning domain, potentially in another
+      // workspace. It is not a concrete local-aggregate relationship.
+      const referenceWorkspace = idOfTargetKindOf(fieldSchema) === "contract"
+        ? '\"\"' : "nmsInternalWorkspace";
       const explicitOptionalChoice =
         idOfMetaOf(rawSchema) !== undefined &&
         ["optional", "default"].includes(zodKind(rawSchema));
@@ -803,18 +815,20 @@ function operatorCallFieldAccess(
         field,
         explicitOptionalChoice
           ? {
-              value: `_nmsOptionalReferenceId(${member}, ${expected}, nmsInternalWorkspace, ${JSON.stringify(
+              value: `_nmsOptionalReferenceId(${member}, ${expected}, ${referenceWorkspace}, ${JSON.stringify(
                 field
               )})!`,
-              present: `_nmsOptionalReferenceId(${member}, ${expected}, nmsInternalWorkspace, ${JSON.stringify(
+              present: `_nmsOptionalReferenceId(${member}, ${expected}, ${referenceWorkspace}, ${JSON.stringify(
                 field
               )}) !== undefined`,
+              canonical: true,
             }
           : {
-              value: `_nmsReferenceId(${value}, ${expected}, nmsInternalWorkspace, ${JSON.stringify(
+              value: `_nmsReferenceId(${value}, ${expected}, ${referenceWorkspace}, ${JSON.stringify(
                 field
               )})`,
               ...common,
+              canonical: true,
             }
       );
     } else if (refOfMetaOf(fieldSchema) !== undefined) {
@@ -824,11 +838,13 @@ function operatorCallFieldAccess(
           refTarget.aggregateType
         )}, "", ${JSON.stringify(field)})`,
         ...common,
+        canonical: true,
       });
     } else if (versionedRefOfMetaOf(fieldSchema) !== undefined) {
       access.set(field, {
         value: `({ pinned: _nmsReferenceData(${value}.pinned), series: _nmsReferenceData(${value}.series) })`,
         ...common,
+        canonical: true,
       });
     }
   }
@@ -983,7 +999,8 @@ const geometryFactoryName: Record<string, string> = {
 
 /** One descriptor field → its TS type text. NO FALLBACK (the descriptor set is closed). */
 function tsTypeOfVoField(f: ValueObjectFieldDescriptor): string {
-  switch (f.type) {
+  const value = (() => {
+    switch (f.type) {
     case "string":
       return f.idOf !== undefined
         ? `NomosRef<${
@@ -1007,7 +1024,9 @@ function tsTypeOfVoField(f: ValueObjectFieldDescriptor): string {
     case "object":
     case "geometry":
       return f.ref; // the named VO interface (emitted alongside)
-  }
+    }
+  })();
+  return f.nullable === true ? `${paren(value)} | null` : value;
 }
 
 /** Every branded-id name a VO descriptor carries (recursing arrays/maps/union arms) — one
@@ -1114,18 +1133,17 @@ export interface TsClientOptions {
   /** Sibling lossless USDZ transport carried by the generated client when its signed-in workspace
    * still serves the predecessor model. The archive is never canonical state and is not embedded. */
   readonly lawAssetName?: string;
-  /** The package's STRUCTURAL INTERFACE (#72) — directives (payload shapes) + aggregates
-   *  (read shapes, sid-keyed), keyed by domain. Baked in so `connect()` can negotiate
-   *  shape-compatibility against the workspace's installed offer — NOT by hash. */
+  /** Compiler graph used to generate the one USDA compatibility matrix. It is
+   * never emitted as a second JavaScript object or interpreted by the client. */
   readonly interface?: Record<string, unknown>;
-  /** The CLIENT/LAW COMPAT MANIFEST (§5) — baked in so the factory can hand it to the
-   *  holon's connect-time classifier (DIAGNOSIS only, never a gate). */
-  readonly compat?: NomosCompat;
+  /** Standard OSGi Contract Namespace requirements for the kernel ABI. This is
+   * separate from application/law shape compatibility, whose sole artifact is USDA. */
+  readonly kernelContracts?: readonly OsgiContractRequirement[];
   /** Explicit application home for direct/synthetic generation. The package compiler derives this from
    * business birth topology and passes it here; ambiguous multi-domain packages fail rather than flatten. */
   readonly homeDomain?: string;
-  /** Emit the structural holon factory for the compiler-owned headless artifact. The ordinary tenant
-   * client leaves this false so framework transport types never enter its public declaration graph. */
+  /** Export the holon-level factories beside the application surface: the one TypeScript Reception the
+   * compiler emits carries both (a code-mode or unattended peer binds the factories to any NomosHolon). */
   readonly exportHolonFactory?: boolean;
   /** Emit only the fixed framework operator call set (identity, lifecycle and birth). This is the
    * small server/operator companion: exact generated USDA calls, no application/read runtime. */
@@ -1140,103 +1158,6 @@ export interface TsClientOptions {
 
 type CallUsdaProjection = NonNullable<TsClientOptions["callUsda"]>;
 
-const OPERATOR_LIFECYCLE_CALLS = {
-  installDomain,
-  stageDomain,
-  promoteDomain,
-  rollbackDomain,
-} as const;
-
-/** Emit the deliberately small operator-side call factory shipped beside one law
- * package. It contains no application runtime, storage, network or authority code:
- * only compiler-expanded canonical USDA encoders derived from the package's graph. */
-export function generateTsLifecycleOperator(
-  callUsda: CallUsdaProjection
-): string | undefined {
-  const encoders = Object.entries(OPERATOR_LIFECYCLE_CALLS).flatMap(
-    ([kind, directive]) =>
-      callUsda.flatMap((law) => {
-        const declares = law.graph.nodes.some(
-          (node) =>
-            node.kind === "intent" &&
-            (node.entity.label === directive.id ||
-              node.publicRoute === directive.id)
-        );
-        if (!declares) return [];
-        const domain = law.graph.domain.entity.label;
-        return [
-          {
-            kind,
-            domain,
-            payloadType: tsTypeOfPayload(
-              directive.payloadSchema as z.ZodTypeAny,
-              []
-            ),
-            encoder: emitTsCallUsdaEncoder(
-              law.graph,
-              law.paths,
-              domain,
-              directive.id,
-              tsTypeOfPayload(directive.payloadSchema as z.ZodTypeAny, [])
-            ),
-          },
-        ];
-      })
-  );
-  if (encoders.length === 0) return undefined;
-  const methods = Object.keys(OPERATOR_LIFECYCLE_CALLS).filter((kind) =>
-    encoders.some((entry) => entry.kind === kind)
-  );
-  return [
-    `// AUTO-GENERATED by nomos-compile — canonical operator calls for this exact law package.`,
-    `// No application runtime and no authority live here. Do not edit.`,
-    ``,
-    ...TS_CALL_USDA_PRELUDE,
-    `/** A SHA-256 digest in canonical Nomos wire form. */`,
-    `export type Sha256Digest = string & { readonly __nomosSha256Digest: unique symbol };`,
-    `export const sha256Digest = (value: string): Sha256Digest => {`,
-    `  if (!/^[0-9a-f]{64}$/.test(value)) throw new TypeError("expected a 64-character lowercase hexadecimal SHA-256 digest");`,
-    `  return value as Sha256Digest;`,
-    `};`,
-    `/** A Git object address in canonical gix custody form. */`,
-    `export type GitObjectId = string & { readonly __nomosGitObjectId: unique symbol };`,
-    `export const gitObjectId = (value: string): GitObjectId => {`,
-    `  if (!/^[0-9a-f]{40}$/.test(value)) throw new TypeError("expected a 40-character lowercase hexadecimal Git object id");`,
-    `  return value as GitObjectId;`,
-    `};`,
-    `export interface NomosOperatorCall<Domain extends string = string, Directive extends string = string> {`,
-    `  readonly domain: Domain;`,
-    `  readonly directive: Directive;`,
-    `  readonly canonicalUsda: Uint8Array;`,
-    `  readonly routingCandidates: readonly string[];`,
-    `}`,
-    ``,
-    ...encoders.flatMap((entry) => entry.encoder.source),
-    `export const nomosOperatorCalls = {`,
-    ...methods.flatMap((kind) => {
-      const alternatives = encoders.filter((entry) => entry.kind === kind);
-      const payloadType = alternatives[0]!.payloadType;
-      return [
-        `  ${kind}(input: { readonly domain: string; readonly workspace: string } & ${payloadType}): NomosOperatorCall {`,
-        `    const { domain, workspace, ...payload } = input;`,
-        `    switch (domain) {`,
-        ...alternatives.map(
-          (entry) =>
-            `      case ${JSON.stringify(entry.domain)}: return ${
-              entry.encoder.functionName
-            }(payload, workspace);`
-        ),
-        `      default: throw new Error("This law package has no '${kind}' call in domain '" + domain + "'.");`,
-        `    }`,
-        `  },`,
-      ];
-    }),
-    `} as const;`,
-    ``,
-  ].join("\n");
-}
-
-/** TS string literal (JSON.stringify covers escaping). */
 const _actLit = (s: string): string => JSON.stringify(s);
 
 /** Emit the ACTIVITY + SELF-DESCRIPTION block (architecture/activity_descriptors.md): the `ActivityEvent`/`ActivityRef`/
@@ -1314,164 +1235,7 @@ function emitTsActivityBlock(
       `  },`,
     ];
   };
-  return [
-    `// ── model evolution — generated business surface over exact-history proof ──`,
-    `interface NomosModelDifference {`,
-    `  kind: "rules" | "outcome" | "evidence"; area?: string; action?: string; summary: string;`,
-    `}`,
-    `interface NomosModelReview {`,
-    `  checkedActions: number; candidateActions: number; sameOutcome: boolean | null;`,
-    `  differences: NomosModelDifference[];`,
-    `}`,
-    `type NomosModelAdoption =`,
-    `  | { status: "adopted"; summary: string; review: NomosModelReview }`,
-    `  | { status: "needs-staging"; summary: string; review: NomosModelReview; stage(): Promise<NomosModelAdoption> }`,
-    `  | { status: "needs-decision"; summary: string; review: NomosModelReview; accept(because: string): Promise<NomosModelAdoption> }`,
-    `  | { status: "blocked"; summary: string; error: string; review: NomosModelReview };`,
-    `type NomosModelRestoration =`,
-    `  | { status: "restored"; summary: string; review: NomosModelReview }`,
-    `  | { status: "needs-decision"; summary: string; review: NomosModelReview; accept(because: string): Promise<NomosModelRestoration> }`,
-    `  | { status: "blocked"; summary: string; error: string; review: NomosModelReview };`,
-    `interface __NomosModelReportWire {`,
-    `  sourceVerified: boolean; complete: boolean; promotable: boolean;`,
-    `  replayedIntents: number; candidateIntents: number; evolve: { ok: boolean };`,
-    `  projection?: { equal: boolean };`,
-    `  divergences: { kind: string; domain?: string; directiveId?: string; admitted?: boolean }[];`,
-    `}`,
-    `interface __NomosModelAdoptionWire {`,
-    `  ok: boolean; stage: "promoted" | "already-current" | "identity" | "staging-required" | "preflight" | "acceptance" | "admission";`,
-    `  report?: __NomosModelReportWire; error?: string;`,
-    `}`,
-    `interface __NomosModelRestorationWire {`,
-    `  ok: boolean; stage: "restored" | "identity" | "preflight" | "acceptance" | "admission";`,
-    `  report?: __NomosModelReportWire; error?: string;`,
-    `}`,
-    `function _nomosModelReview(report?: __NomosModelReportWire): NomosModelReview {`,
-    `  const differences: NomosModelDifference[] = [];`,
-    `  for (const difference of report?.divergences ?? []) {`,
-    `    const area = typeof difference.domain === "string" && !difference.domain.includes("nomos_internal")`,
-    `      ? difference.domain : undefined;`,
-    `    const action = typeof difference.directiveId === "string" && !difference.directiveId.includes("nomos_internal")`,
-    `      ? difference.directiveId : undefined;`,
-    `    const kind: NomosModelDifference["kind"] = difference.kind === "plan-divergence" ? "outcome"`,
-    `      : difference.kind === "unsupported-premise" || difference.kind === "read-conflict" ? "evidence" : "rules";`,
-    `    const subject = action ?? (kind === "outcome" ? "A business action" : "A historical action");`,
-    `    const summary = kind === "outcome"`,
-    `      ? subject + " would produce a different result under this model."`,
-    `      : kind === "evidence"`,
-    `        ? "Nomos could not reproduce all evidence needed by " + subject + "."`,
-    `        : subject + " is not accepted by this model's rules.";`,
-    `    differences.push({ kind, ...(area === undefined ? {} : { area }), ...(action === undefined ? {} : { action }), summary });`,
-    `  }`,
-    `  if (report !== undefined && !report.evolve.ok && !differences.some((d) => d.kind === "rules")) {`,
-    `    differences.push({ kind: "rules", summary: "This model does not yet explain how to interpret every existing value." });`,
-    `  }`,
-    `  if (report !== undefined && (!report.sourceVerified || !report.complete) && !differences.some((d) => d.kind === "evidence")) {`,
-    `    differences.push({ kind: "evidence", summary: "Nomos could not re-prove every premise in the current business history." });`,
-    `  }`,
-    `  return {`,
-    `    checkedActions: report?.replayedIntents ?? 0, candidateActions: report?.candidateIntents ?? 0,`,
-    `    sameOutcome: report?.projection?.equal ?? null, differences,`,
-    `  };`,
-    `}`,
-    `async function _nomosAdoptModel(`,
-    `  holon: NomosHolon, domain: string, candidateHash: string, lawAsset?: URL, because?: string,`,
-    `): Promise<NomosModelAdoption> {`,
-    `  if (!holon.__nomosAdoptModel) {`,
-    `    const error = "This device needs the current Nomos client before it can adopt a model.";`,
-    `    return { status: "blocked", summary: error, error, review: _nomosModelReview() };`,
-    `  }`,
-    `  const raw = await holon.__nomosAdoptModel(domain, candidateHash, because === undefined ? {} : { because });`,
-    `  const review = _nomosModelReview(raw.report);`,
-    `  if ((raw.stage === "promoted" || raw.stage === "already-current") && raw.ok) {`,
-    `    const summary = raw.stage === "promoted"`,
-    `      ? "Nomos proved this model against current history and made it active."`,
-    `      : "This workspace already runs this model or a server-side successor.";`,
-    `    return { status: "adopted", summary, review };`,
-    `  }`,
-    `  if (raw.stage === "staging-required" && lawAsset !== undefined && holon.__nomosStageGeneratedModel !== undefined) {`,
-    `    return {`,
-    `      status: "needs-staging",`,
-    `      summary: "This workspace is running the previous model. Nomos can stage this generated USDA candidate through its signed author gate.",`,
-    `      review,`,
-    `      stage: async () => {`,
-    `        // Keep Node's file loader behind a runtime-only boundary: browser-generated clients`,
-    `        // must typecheck without @types/node, while the local CLI can still stage its USDA asset.`,
-    `        const dynamicImport = Function("specifier", "return import(specifier)") as (specifier: string) => Promise<{ readFile(source: URL): Promise<Uint8Array> }>;`,
-    `        const { readFile } = await dynamicImport("node:fs/promises");`,
-    `        const lawUsdz = new Uint8Array(await readFile(lawAsset));`,
-    `        const staged = await holon.__nomosStageGeneratedModel!(domain, candidateHash, lawUsdz);`,
-    `        if (staged.ok !== true) {`,
-    `          const error = staged.error ?? "The workspace refused the generated USDA candidate.";`,
-    `          return { status: "blocked", summary: error, error, review };`,
-    `        }`,
-    `        return _nomosAdoptModel(holon, domain, candidateHash, lawAsset);`,
-    `      },`,
-    `    };`,
-    `  }`,
-    `  if (raw.stage === "acceptance") {`,
-    `    return {`,
-    `      status: "needs-decision",`,
-    `      summary: "This model would change prior business outcomes. Review the differences and record why that is intended.",`,
-    `      review,`,
-    `      accept: async (reason: string) => {`,
-    `        const stated = reason.trim();`,
-    `        if (!stated) throw new Error("accept(reason) needs the business reason for changing prior outcomes");`,
-    `        return _nomosAdoptModel(holon, domain, candidateHash, lawAsset, stated);`,
-    `      },`,
-    `    };`,
-    `  }`,
-    `  const summary = raw.stage === "identity"`,
-    `    ? "Sign in before adopting this model so the decision is accountable."`,
-    `    : raw.report !== undefined && !raw.report.sourceVerified`,
-    `      ? "The current history could not be verified. Nothing changed and the current model remains active."`,
-    `      : raw.report !== undefined && !raw.report.complete`,
-    `        ? "Nomos could not re-prove every historical dependency. Nothing changed and the current model remains active."`,
-    `        : raw.report !== undefined && !raw.report.evolve.ok`,
-    `          ? "This model cannot yet interpret every existing value. Nothing changed and the current model remains active."`,
-    `          : "The workspace changed or refused this adoption. Nothing changed; ask Nomos to try again.";`,
-    `  return { status: "blocked", summary, error: raw.error ?? summary, review };`,
-    `}`,
-    `async function _nomosRestorePreviousModel(`,
-    `  holon: NomosHolon, domain: string, currentHash: string, because?: string,`,
-    `): Promise<NomosModelRestoration> {`,
-    `  if (!holon.__nomosRestorePreviousModel) {`,
-    `    const error = "This device needs the current Nomos client before it can restore a model.";`,
-    `    return { status: "blocked", summary: error, error, review: _nomosModelReview() };`,
-    `  }`,
-    `  const raw = await holon.__nomosRestorePreviousModel(domain, currentHash, because === undefined ? {} : { because });`,
-    `  const review = _nomosModelReview(raw.report);`,
-    `  if (raw.stage === "restored" && raw.ok) {`,
-    `    return { status: "restored", summary: "Nomos re-proved current history and restored the previous model.", review };`,
-    `  }`,
-    `  if (raw.stage === "acceptance") {`,
-    `    return {`,
-    `      status: "needs-decision",`,
-    `      summary: "Restoring the previous model changes which rules govern future work. Review the effects and record why restoration is intended.",`,
-    `      review,`,
-    `      accept: async (reason: string) => {`,
-    `        const stated = reason.trim();`,
-    `        if (!stated) throw new Error("accept(reason) needs the business reason for restoring the previous model");`,
-    `        return _nomosRestorePreviousModel(holon, domain, currentHash, stated);`,
-    `      },`,
-    `    };`,
-    `  }`,
-    `  const summary = raw.stage === "identity"`,
-    `    ? "Sign in before restoring a model so the decision is accountable."`,
-    `    : raw.error?.includes("restore-no-previous")`,
-    `      ? "This is the first model for this business; there is no previous model to restore."`,
-    `      : raw.error?.includes("restore-current-changed")`,
-    `        ? "The current model changed before restoration could finish. Nothing changed; ask Nomos to review again."`,
-    `        : raw.report !== undefined && !raw.report.sourceVerified`,
-    `          ? "The current history could not be verified. Nothing changed and the current model remains active."`,
-    `          : raw.report !== undefined && !raw.report.complete`,
-    `            ? "Nomos could not re-prove every historical dependency. Nothing changed and the current model remains active."`,
-    `            : raw.report !== undefined && !raw.report.evolve.ok`,
-    `              ? "The previous model cannot safely interpret every existing value. Nothing changed and the current model remains active."`,
-    `              : "The workspace refused restoration. Nothing changed and the current model remains active.";`,
-    `  return { status: "blocked", summary, error: raw.error ?? summary, review };`,
-    `}`,
-    ``,
+  const emitted = [
     `// ── activity feed (architecture/activity_descriptors.md) — typed rows folded from the intent log ──`,
     `/** A declared navigation target on an activity row: the same inspectable aggregate reference returned by`,
     ` *  generated reads and writes. A \`from: "@created"\` ref resolves the identity the law minted. */`,
@@ -1590,6 +1354,13 @@ function emitTsActivityBlock(
     `}`,
     ``,
   ];
+  // Model install/adoption/restoration is Peer Office and kernel lifecycle, not
+  // generated application behavior. Keep only the typed activity surface here.
+  const activityStart = emitted.indexOf(
+    `// ── activity feed (architecture/activity_descriptors.md) — typed rows folded from the intent log ──`
+  );
+  if (activityStart < 0) throw new Error("generated activity block lost its boundary");
+  return emitted.slice(activityStart);
 }
 
 /** TRUE when any module declares a PACKED workspace taxonomy (the routed-holon shape).
@@ -1726,15 +1497,42 @@ export function generateTsClient(
   // Business-birth framework declarations remain in the certified module, but are not application
   // vocabulary. Strip only the presentation marker here; manifests, hashes and the engine see the full law.
   modules = modules.map((mod) => {
-    const publicAggregates = mod.aggregates.filter(
+    // Workspace-sharing is framework procedure, not public application
+    // vocabulary. Its generated binding still needs the exact nominal query
+    // and result type used by the invitation desk, however. Those declarations
+    // can be absent from `mod.queries`/the public aggregate set because the DSL
+    // deliberately keeps framework law out of the tenant surface. Retain them
+    // privately for code generation and hide their methods below.
+    const invitationPendingQueries = (mod.applicationWorkspaceSharing ?? []).map(
+      (policy) => policy.invitationLaw.pendingByRecipient
+    );
+    const invitationPendingQueryIds = new Set(
+      invitationPendingQueries.map((query) => query.id)
+    );
+    const invitationPendingAggregateIds = new Set(
+      invitationPendingQueries.map((query) => query.returns)
+    );
+    const generatedAggregates = mod.aggregates.filter(
       (a) =>
         (a as { businessBirthInternal?: unknown }).businessBirthInternal !==
-          true && !isFrameworkAggregate(a)
+          true &&
+        (!isFrameworkAggregate(a) || invitationPendingAggregateIds.has(a.id))
     );
-    const publicAggregateIds = new Set(publicAggregates.map((a) => a.id));
+    const generatedAggregateIds = new Set(generatedAggregates.map((a) => a.id));
+    const generatedQueries = [
+      ...(mod.queries ?? []).filter(
+        (query) =>
+          ((query as { businessBirthInternal?: unknown }).businessBirthInternal !== true || invitationPendingQueryIds.has(query.id)) &&
+          generatedAggregateIds.has(query.returns) &&
+          (!isFrameworkQuery(query) || invitationPendingQueryIds.has(query.id))
+      ),
+      ...invitationPendingQueries.filter(
+        (query) => !(mod.queries ?? []).some((candidate) => candidate.id === query.id)
+      ),
+    ];
     return {
       ...mod,
-      aggregates: publicAggregates,
+      aggregates: generatedAggregates,
       // An explicit application language wins. Otherwise the tenant's exported,
       // non-framework directives are its business verbs. Framework directives are
       // branded by object identity and can never leak merely because they compose
@@ -1744,20 +1542,15 @@ export function generateTsClient(
           (d as { businessBirthInternal?: unknown }).businessBirthInternal !==
             true && !isFrameworkDirective(d)
       ),
-      ...(mod.queries === undefined
-        ? {}
-        : {
-            queries: mod.queries.filter(
-              (q) =>
-                (q as { businessBirthInternal?: unknown })
-                  .businessBirthInternal !== true && !isFrameworkQuery(q)
-            ),
-          }),
+      // Always overwrite the executable module's query list. Omitting the
+      // property when presentation has no queries accidentally preserves the
+      // unfiltered framework queries from `...mod` above.
+      queries: generatedQueries,
       ...(mod.readModelAggregates === undefined
         ? {}
         : {
             readModelAggregates: mod.readModelAggregates.filter((id) =>
-              publicAggregateIds.has(id)
+              generatedAggregateIds.has(id)
             ),
           }),
     };
@@ -1911,24 +1704,48 @@ export function generateTsClient(
   );
   const out: string[] = [];
   const applicationName = tsApplicationName(opts.packageName);
-  const applicationOpener = `open${applicationName}`;
+  const applicationReception = `receive${applicationName}`;
   // A signed-in person gets one application home. Other generated domain factories exist only so a
   // business birth or typed navigation can bind them to their own child workspace inside the private plane.
   const generatedDomains = [
     ...new Set(modules.map((mod) => mod.domain ?? mod.name)),
   ];
-  const invitationPolicies = modules.flatMap((module) =>
-    (module.applicationWorkspaceSharing ?? []).map((policy) => ({
-      domain: module.domain ?? module.name,
-      domainHash: opts.domainHash,
-      query: policy.invitationLaw.pendingByRecipient.id,
-      redeem: policy.invitationLaw.redeem.id,
-      personField: policy.person,
-      roleField: policy.role,
-      scopeField: policy.scope,
-    }))
-  );
+  const invitationPolicies = modules.flatMap((module) => {
+    const domain = module.domain ?? module.name;
+    const clientIndex = topology.rootDomains.indexOf(domain);
+    // The package-level application facade owns only the root clients it opens.
+    // A child workspace keeps its sharing boundary on that domain's generated
+    // typed client; it must not be rebound to an unrelated root or queried
+    // through a generic transport escape hatch.
+    if (clientIndex < 0) return [];
+    return (module.applicationWorkspaceSharing ?? []).map((policy) => {
+      return {
+        domain,
+        domainHash: opts.domainHash,
+        redeem: policy.invitationLaw.redeem.id,
+        pendingMethod: lcFirst(camel(policy.invitationLaw.pendingByRecipient.id)),
+        personField: policy.person,
+        roleField: policy.role,
+        scopeField: policy.scope,
+        clientIndex,
+      };
+    });
+  });
   const hasInvitations = invitationPolicies.length > 0;
+  const invitationPoliciesExpression = `[${invitationPolicies
+    .map(
+      (policy) =>
+        `{ domain: ${JSON.stringify(policy.domain)}, domainHash: ${JSON.stringify(
+          policy.domainHash
+        )}, redeem: ${JSON.stringify(policy.redeem)}, pending: async (address: string) => (await _nmsRoot${
+          policy.clientIndex
+        }.${policy.pendingMethod}({ ${JSON.stringify(
+          policy.personField
+        )}: address })).map((row) => ({ orderId: _nmsReferenceData(row.ref).id, object: String(row[${JSON.stringify(
+          policy.scopeField
+        )}]), relation: String(row[${JSON.stringify(policy.roleField)}]) })) }`
+    )
+    .join(", ")}]`;
   const clientDomains = topology.rootDomains;
   // The PACKAGE-LEVEL recursive-type registry: every directive payload's `z.lazy` knots mint
   // named recursive type aliases into it (deduped by lazy identity across directives); the decls
@@ -1974,6 +1791,7 @@ export function generateTsClient(
       .filter(
         (definition) =>
           definition.group === "identity" ||
+          definition.group === "governance" ||
           definition.group === "lifecycle" ||
           definition.group === "birth"
       )
@@ -2104,7 +1922,7 @@ export function generateTsClient(
             `TypeScript framework call USDA codegen: '${domain}/${directiveId}' has no authored payload schema`
           );
         }
-        const encoder = emitTsCallUsdaEncoder(
+        const encoder = emitTsCallProtoEncoder(
           law.graph,
           law.paths,
           domain,
@@ -2158,7 +1976,7 @@ export function generateTsClient(
         readonly domain: string;
         readonly directiveId: string;
         readonly payloadType: string;
-        readonly encoder: ReturnType<typeof emitTsCallUsdaEncoder>;
+        readonly encoder: ReturnType<typeof emitTsCallProtoEncoder>;
       }
     >();
     const capabilityReferenceTypes = new Set<string>();
@@ -2195,7 +2013,7 @@ export function generateTsClient(
             domain,
             directiveId: receipt.id,
             payloadType,
-            encoder: emitTsCallUsdaEncoder(
+            encoder: emitTsCallProtoEncoder(
               law.graph,
               law.paths,
               domain,
@@ -2215,7 +2033,13 @@ export function generateTsClient(
       `// AUTO-GENERATED by nomos-compile — exact framework operators for package "${opts.packageName}".`,
       `// No application runtime and no authority live here. Do not edit.`,
       ``,
-      ...TS_CALL_USDA_PRELUDE,
+      ...((operatorEncoders.length + capabilityReceipts.length) > 0 ? [
+        `import { create, toBinary } from "@bufbuild/protobuf";`,
+        `import * as _nmsop from "./operation_payloads_pb.js";`,
+      ] : []),
+      ``,
+      ...TS_CALL_PROTO_PRELUDE,
+      ...TS_QUERY_USDA_PRELUDE,
       `/** A SHA-256 digest in canonical Nomos wire form. */`,
       `export type Sha256Digest = string & { readonly __nomosSha256Digest: unique symbol };`,
       `/** A Git object address in canonical gix custody form. */`,
@@ -2224,7 +2048,8 @@ export function generateTsClient(
       `export interface NomosFrameworkCall<Domain extends string = string, Directive extends string = string> {`,
       `  readonly domain: Domain;`,
       `  readonly directive: Directive;`,
-      `  readonly canonicalUsda: Uint8Array;`,
+      `  readonly protobufType: string;`,
+      `  readonly protobufPayload: Uint8Array;`,
       `  readonly routingCandidates: readonly string[];`,
       `}`,
       `declare const _nomosAggregateType: unique symbol;`,
@@ -2327,42 +2152,34 @@ export function generateTsClient(
   }
   out.push(
     `// AUTO-GENERATED by nomos-compile — typed TS application implementation for package "${opts.packageName}".`,
-    `// Regenerated on every compile; do not edit. Framework binding types below are deliberately private:`,
+    `// Regenerated on every compile; do not edit. Peer Office desk types below are deliberately private:`,
     `// tenant application code receives the generated business API and cannot import transport machinery.`,
     ``,
-    `import { nomosInternalOpenGeneratedApplication, nomosInternalOpenGeneratedChildApplication${
-      hasInvitations
-        ? ", nomosInternalCreateInvitation, nomosInternalRedeemInvitation"
-        : ""
-    } } from "@githolon/client/_generated_application_host_7c1f5e";`,
-    ``,
-    ...(callUsdaByDomain.size > 0 ? TS_CALL_USDA_PRELUDE : []),
+    `import { ${hasSha256Digests ? "sha256Digest, type Sha256Digest, " : ""}${hasGitObjectIds ? "gitObjectId, type GitObjectId, " : ""}type ReceptionSession as _NomosReceptionSession, type GeneratedApplication as _NomosGeneratedApplication } from "@githolon/runtime/application";`,
+    ...(modules.some(mod => (mod.workspaceInvariants ?? []).some(rule => rule.refusal)) ? [
+      `import { admissionDecision as _admissionDecision, NominalValue as _NominalValue, parseNominalValue as _parseNominalValue, UnsupportedNominalRefusal as _UnsupportedNominalRefusal, type DomainRefusalEvidence as _DomainRefusalEvidence } from "@githolon/runtime/application";`,
+      `export type { AdmissionDecision, DomainRefusalEvidence } from "@githolon/runtime/application";`,
+    ] : []),
     ...(hasSha256Digests
       ? [
-          `/** A SHA-256 digest in canonical Nomos wire form: 64 lowercase hexadecimal characters. */`,
-          `export type Sha256Digest = string & { readonly __nomosSha256Digest: unique symbol };`,
-          `/** Validate and construct a Sha256Digest before an offer is assembled. */`,
-          `export const sha256Digest = (value: string): Sha256Digest => {`,
-          `  if (!/^[0-9a-f]{64}$/.test(value)) {`,
-          `    throw new TypeError("expected a 64-character lowercase hexadecimal SHA-256 digest");`,
-          `  }`,
-          `  return value as Sha256Digest;`,
-          `};`,
-          ``,
+          `export { sha256Digest };`,
+          `export type { Sha256Digest };`,
         ]
       : []),
     ...(hasGitObjectIds
       ? [
-          `/** A Git object address in the canonical gix custody spelling. */`,
-          `export type GitObjectId = string & { readonly __nomosGitObjectId: unique symbol };`,
-          `/** Validate and construct a GitObjectId before an offer is assembled. */`,
-          `export const gitObjectId = (value: string): GitObjectId => {`,
-          `  if (!/^[0-9a-f]{40}$/.test(value)) {`,
-          `    throw new TypeError("expected a 40-character lowercase hexadecimal Git object id");`,
-          `  }`,
-          `  return value as GitObjectId;`,
-          `};`,
+          `export { gitObjectId };`,
+          `export type { GitObjectId };`,
+        ]
+      : []),
+    ``,
+    ...(callUsdaByDomain.size > 0
+      ? [
+          `import { create, fromBinary, toBinary } from "@bufbuild/protobuf";`,
+          `import * as _nmsop from "./operation_payloads_pb.js";`,
           ``,
+          ...TS_CALL_PROTO_PRELUDE,
+          ...TS_QUERY_USDA_PRELUDE,
         ]
       : []),
     `interface _NomosApplicationStatus {`,
@@ -2379,12 +2196,7 @@ export function generateTsClient(
     `interface _NomosApplicationLifecycle {`,
     `  currentStatus(): Promise<_NomosApplicationStatus>;`,
     `  watchStatus(listener: (status: _NomosApplicationStatus) => void): () => void;`,
-    `}`,
-    `interface _NomosApplicationModelLifecycle {`,
-    `  readonly model: {`,
-    `    adopt(): Promise<NomosModelAdoption>;`,
-    `    restorePrevious(): Promise<NomosModelRestoration>;`,
-    `  };`,
+    `  close(): Promise<void>;`,
     `}`,
     ...(hasInvitations
       ? [
@@ -2404,25 +2216,11 @@ export function generateTsClient(
     ``,
     ...(clientInterface !== undefined
       ? [
-          `/** This client's STRUCTURAL INTERFACE REQUIREMENT (#72): the directives (payload shapes)`,
-          ` *  and aggregates (read shapes, sid-keyed) it depends on, keyed by domain. \`connect()\``,
-          ` *  negotiates this against the workspace's installed offer by SHAPE (stable-id subtyping),`,
-          ` *  not by law hash — so the domain can evolve without republishing this client. */`,
-          `const ${interfaceConstName(opts.packageName)} = ${JSON.stringify(
-            clientInterface
-          )} as const;`,
-          ``,
-        ]
-      : []),
-    ...(opts.compat !== undefined
-      ? [
-          `/** The CLIENT/LAW COMPAT MANIFEST (§5): the law hash + structural interface hash + generator`,
-          ` *  provenance this client was generated against. A DIAGNOSIS surface — the factory hands it to`,
-          ` *  the holon's connect-time classifier, which logs a warning on a law-hash mismatch. It NEVER`,
-          ` *  gates: a hash mismatch with a compatible SHAPE is normal during law evolution (#72). */`,
-          `const ${compatConstName(opts.packageName)} = ${JSON.stringify(
-            opts.compat
-          )} as const;`,
+          `/** Canonical compiler-authored USDA compatibility matrix. The application carries`,
+          ` * these bytes opaquely; only the kernel interprets them against installed law. */`,
+          `const ${interfaceConstName(opts.packageName)} = new TextEncoder().encode(${JSON.stringify(
+            emitApplicationCompatibilityUsda(clientInterface)
+          )});`,
           ``,
         ]
       : []),
@@ -2518,7 +2316,8 @@ export function generateTsClient(
     `/** Compare two public record addresses. Neither reference carries or grants authority. */`,
     `export function sameRecord<TAggregate>(a: NomosRef<TAggregate>, b: NomosRef<TAggregate>): boolean {`,
     `  const left = _nmsReferenceData(a); const right = _nmsReferenceData(b);`,
-    `  return left.workspace === right.workspace && left.type === right.type && left.id === right.id;`,
+    `  const sameType = _nmsReferenceTypeMatches(left.type, right.type) || _nmsReferenceTypeMatches(right.type, left.type);`,
+    `  return left.workspace === right.workspace && sameType && left.id === right.id;`,
     `}`,
     `/** The stable \`nomos://<workspace>/<type>/<id>\` string form (each segment URI-encoded — a workspace/`,
     ` *  type/id containing \`/\` or spaces round-trips). Survives URLs, nav params, JSON, logs. */`,
@@ -2759,9 +2558,9 @@ export function generateTsClient(
     `/** Read-only primitive used behind the generated, business-shaped historic view. */`,
     `interface NomosHistoricHolon {`,
     `  /** Compiler-generated declared query. Routing identity and USDA arguments remain one nominal value. */`,
-    `  __nomosQueryUsda(query: NmsGeneratedQuery, keys?: ${
+    `  __nomosQuery(query: NmsGeneratedQuery, keys?: ${
       encPresent ? "readonly NomosScopeKey[]" : "never"
-    }): Promise<Uint8Array>;`,
+    }): Promise<NmsGeneratedResult>;`,
     `  /** Compiler-generated historic identity lookup returning canonical USDA. */`,
     `  __nomosQueryByIdUsda(aggregateType: string, aggregateId: string, keys?: ${
       encPresent ? "readonly NomosScopeKey[]" : "never"
@@ -2772,8 +2571,12 @@ export function generateTsClient(
     }): Promise<Uint8Array>;`,
     `  count(countId: string, groupKey?: string): Promise<number>;`,
     `  sum(sumId: string, groupKey?: string): Promise<number>;`,
+    `  __nomosExtremum?(id: string, kind: "min" | "max", groupKey?: string): Promise<number | null>;`,
     `}`,
-    `/** The holon surface this client binds to (structurally satisfied by @githolon/client). */`,
+    `/** The holon surface this client binds to (structurally satisfied by @githolon/runtime). */`,
+    `/** The peer's holon as the runtime binds it. Tenant code never constructs one; the generated`,
+    ` *  factories and receiver take it from the runtime. Its members are deliberately not declared here. */`,
+    `export interface NomosHolonBinding { readonly workspace: string }`,
     `interface NomosHolon {`,
     `  /** Carry one compiler-generated nominal USDA call. Routing identity and bytes cannot be paired independently. */`,
     `  offerCall(call: NmsGeneratedCall, opts?: { domainHash?: string; actor?: string; returnCreated?: boolean; __nomosConflictSnapshots?: readonly { aggregateType: string; aggregateId: string; field: string; targetSchema: string; token: string }[] }): Promise<string | { head: string; created?: { type: string; id: string }[]; affected?: { type: string; id: string }[]; workspace?: string; born?: unknown; birthOutcomes?: unknown }>;`,
@@ -2793,7 +2596,7 @@ export function generateTsClient(
     ...(hasBirths
       ? [
           `  /** BIRTH A CHILD WORKSPACE (a signed CROSS-WORKSPACE governance offer to \`parent\`) — OPTIONAL:`,
-          `   *  @githolon/client's connect() attaches it. The generated \`.births()\` methods call this, binding`,
+          `   *  @githolon/runtime's connect() attaches it. The generated \`.births()\` methods call this, binding`,
           `   *  the declaring domain/directiveId/law hash so a frontend dev never hand-writes those raw strings. */`,
           `  createWorkspace?(opts: { domain: string; directiveId: string; domainHash?: string; parent: string; actor: string; authorSecret?: string; payload?: unknown; name?: string; authToken?: string }): Promise<{ ok?: boolean; status?: number; body?: unknown }>;`,
         ]
@@ -2803,6 +2606,9 @@ export function generateTsClient(
     ...(callUsdaByDomain.size > 0
       ? [
           `  /** Framework-private nominal read lane. Generated code decodes only exact law relationships. */`,
+          `  __nomosQuery(query: NmsGeneratedQuery, keys?: ${
+            encPresent ? "readonly NomosScopeKey[]" : "never"
+          }): Promise<NmsGeneratedResult>;`,
           `  __nomosQueryUsda(query: NmsGeneratedQuery, keys?: ${
             encPresent ? "readonly NomosScopeKey[]" : "never"
           }): Promise<Uint8Array>;`,
@@ -2815,6 +2621,13 @@ export function generateTsClient(
           `  __nomosQueryPageUsda(query: NmsGeneratedQuery, page: { pageSize?: number; cursor?: string | null }, keys?: ${
             encPresent ? "readonly NomosScopeKey[]" : "never"
           }): Promise<Uint8Array>;`,
+          `  __nomosQueryPage(query: NmsGeneratedQuery, page: { pageSize?: number; cursor?: string | null }, keys?: ${
+            encPresent ? "readonly NomosScopeKey[]" : "never"
+          }): Promise<NmsGeneratedResult>;`,
+          `  __nomosWatch(query: NmsGeneratedQuery, changed: (result: NmsGeneratedResult) => void, failed: (failure: { code: string; message: string; component: string }) => void, opts?: { intervalMs?: number }): () => void;`,
+          `  __nomosWatchRows<T>(subscribe: (changed: () => void) => () => void, read: () => Promise<T[]>, cb: (rows: T[]) => void): () => void;`,
+          `  __nomosWatchResults<TResult, TRows>(subscribe: (changed: (result: TResult) => void, failed: (failure: { code: string; message: string }) => void) => () => void, decode: (result: TResult) => TRows[] | Promise<TRows[]>, cb: (rows: TRows[]) => void): () => void;`,
+          `  __nomosWatchFollow<T>(open: Promise<T>, subscribe: (opened: T) => () => void, unavailable: () => void): () => void;`,
           `  __nomosWatchUsda(query: NmsGeneratedQuery, cb: (resultUsda: Uint8Array) => void, opts?: { intervalMs?: number }, keys?: ${
             encPresent ? "readonly NomosScopeKey[]" : "never"
           }): () => void;`,
@@ -2844,18 +2657,6 @@ export function generateTsClient(
           `  checkReferenceVersions?(refs: readonly { pinned: _NomosRawAddress; series: _NomosRawAddress; currentField: string }[]): Promise<{ unique: { outcome: { status: string; latest?: _NomosRawAddress } }[]; order: number[] }>;`,
         ]
       : []),
-    `  /** FRAMEWORK-INTERNAL exact-history adoption seam. Generated clients expose only`,
-    `   *  \`model.adopt()\` and a chained \`decision.accept(reason)\`. */`,
-    `  __nomosAdoptModel?(domain: string, candidateHash: string, opts?: { because?: string }): Promise<__NomosModelAdoptionWire>;`,
-    `  /** FRAMEWORK-INTERNAL signed lifecycle offer used by generated model staging. */`,
-    `  __nomosStageGeneratedModel?(domain: string, candidateHash: string, lawUsdz: Uint8Array): Promise<{ ok?: boolean; error?: string }>;`,
-    `  /** FRAMEWORK-INTERNAL exact-history restoration seam. Generated clients expose only`,
-    `   *  \`model.restorePrevious()\` and a chained \`decision.accept(reason)\`. */`,
-    `  __nomosRestorePreviousModel?(domain: string, currentHash: string, opts?: { because?: string }): Promise<__NomosModelRestorationWire>;`,
-    `  /** Persist local custody and reconcile its configured remote. Business birth awaits this when available. */`,
-    `  sync?(): Promise<unknown>;`,
-    `  /** Complete durable custody and cold-chain verification for a newly born aggregate. */`,
-    `  settleBirth?(workspace: string, opts?: { timeoutMs?: number; pollMs?: number }): Promise<unknown>;`,
     `  /** Verified points in local history. Optional only so a pre-history runtime fails at the named call. */`,
     `  commits?(opts?: { limit?: number }): Promise<{ oid: string; at: number | null; actorSubject: string | null; domain: string | null; directiveId: string | null }[]>;`,
     `  /** Read the verified projection at one opaque moment without moving the live world. */`,
@@ -2923,10 +2724,13 @@ export function generateTsClient(
       : []),
     `  /** Declared-count / declared-sum O(1) reads (maintained by the read engine). */`,
     `  count(countId: string, groupKey?: string): Promise<number>;`,
-    `  /** THE SPATIAL READ (R*Tree probe): rows intersecting the bbox — same row shape as query().`,
-    `   *  OPTIONAL member: structural binding tolerates a pre-spatial holon (the accessor then throws at call). */`,
-    `  spatialWithin?(spatialId: string, bbox: { minX: number; minY: number; maxX: number; maxY: number } | { minLng: number; minLat: number; maxLng: number; maxLat: number }): Promise<unknown>;`,
+    ...(modules.some((module) => (module.spatials?.length ?? 0) > 0) ? [
+      `  /** Framework-private R*Tree read. Only the generated law decoder interprets tenant rows. */`,
+      `  __nomosSpatialWithinUsda(spatialId: string, bbox: { minX: number; minY: number; maxX: number; maxY: number } | { minLng: number; minLat: number; maxLng: number; maxLat: number }): Promise<Uint8Array>;`,
+    ] : []),
     `  sum(sumId: string, groupKey?: string): Promise<number>;`,
+    `  /** Declared maintained extrema. Optional only to diagnose missing runtime support, never to return a fabricated value. */`,
+    `  __nomosExtremum?(id: string, kind: "min" | "max", groupKey?: string): Promise<number | null>;`,
     `  /** Bounded authenticated query page. Optional only so generated clients diagnose an old runtime cleanly. */`,
     `  queryPage?(queryId: string, params?: Record<string, unknown>, page?: { pageSize?: number; cursor?: string | null }, keys?: readonly unknown[], principal?: string): Promise<{ rows: unknown[]; cursor: string | null; done: boolean }>;`,
     `  /** The DEAD-LETTER QUEUE — refused-but-legitimate intents the app must handle`,
@@ -2944,11 +2748,11 @@ export function generateTsClient(
           `  activityLog?(opts?: { base?: string; limit?: number }): Promise<ActivityRawRow[]>;`,
         ]
       : []),
-    `  /** THE COMPAT SUPERPOWER (#72b) — OPTIONAL: a holon from @githolon/client's connect() attaches it.`,
+    `  /** THE COMPAT SUPERPOWER (#72b) — OPTIONAL: a holon from @githolon/runtime's connect() attaches it.`,
     `   *  The factory hands over this client's baked compat manifest + structural interface (the requirement),`,
     `   *  and the holon computes the LIVE per-member verdict on \`holon.compat\`. A KNOWN-incompatible directive`,
     `   *  then refuses CLIENT-SIDE at write time (LawMismatchError), never as a server 422. */`,
-    `  checkCompat?(compat: { lawHash: string; interfaceHash: string; packageName: string }, requirement?: unknown): NomosCompatVerdict | null;`,
+    `  checkCompat?(matrixUsda: Uint8Array): NomosCompatVerdict | null;`,
     `  /** Framework-private readiness hint; generated domain bindings keep first-use plan work off the offer path. */`,
     `  prepareDomain?(domain: string, packageHash: string): void;`,
     `  /** Resolve the law's standard OSGi Contract Namespace requirements before bind. */`,
@@ -3086,7 +2890,7 @@ export function generateTsClient(
       `  const keys = keyStore == null || ordinary.length === 0 ? [] : await keyStore.readKeys(ordinary);`,
       `  for (const s of scopes) {`,
       `    if (s.owned !== true) continue;`,
-      `    if (!holon.__nomosOwnedScopeKeys) throw new Error("owned record reads need the current @githolon/client");`,
+      `    if (!holon.__nomosOwnedScopeKeys) throw new Error("owned record reads need the current @githolon/runtime");`,
       `    for (const record of records) {`,
       `      for (const held of await holon.__nomosOwnedScopeKeys({ scope: s.scope, record })) {`,
       `        if (!keys.some((key) => key.scope === held.scope && key.epoch === held.epoch)) keys.push(held);`,
@@ -3134,32 +2938,6 @@ export function generateTsClient(
       `  return read(keys);`,
       `};`,
       ``,
-      `/** Reactive owned reads use the exact same two-pass, record-key-aware read as one-shot reads.`,
-      ` *  The raw watch is only a local change signal; ciphertext rows never reach application callbacks. */`,
-      `const _watchWithOwnedKeys = <T>(`,
-      `  subscribe: (changed: () => void) => () => void,`,
-      `  read: () => Promise<T[]>,`,
-      `  cb: (rows: T[]) => void,`,
-      `): (() => void) => {`,
-      `  let active = true;`,
-      `  let pending = Promise.resolve();`,
-      `  const changed = () => {`,
-      `    pending = pending.catch(() => undefined).then(async () => {`,
-      `      try {`,
-      `        const rows = await read();`,
-      `        if (active) cb(rows);`,
-      `      } catch (error) {`,
-      `        if (!active) return;`,
-      `        const message = String((error as { message?: unknown })?.message ?? error).toLowerCase();`,
-      `        if (/forbid|denied|not been shared|not currently sharing|no longer shared/.test(message)) { cb([]); return; }`,
-      `        throw error;`,
-      `      }`,
-      `    });`,
-      `  };`,
-      `  const stop = subscribe(changed);`,
-      `  return () => { active = false; stop(); };`,
-      `};`,
-      ``,
       ...(manualEncryptionPresent
         ? [
             `// ── E2E OWNER CEREMONY (the sealing client, slice 2) — grantAndWrap / revokeAndRotate / rotate ──`,
@@ -3254,7 +3032,7 @@ export function generateTsClient(
             `    return typeof e === "number" ? e : -1;`,
             `  };`,
             `  const freshScopeKey = async (): Promise<string> => {`,
-            `    if (!holon.cryptoKeygen) throw new Error("this holon predates E2E keygen — upgrade @githolon/client");`,
+            `    if (!holon.cryptoKeygen) throw new Error("this holon predates E2E keygen — upgrade @githolon/runtime");`,
             `    const kp = await holon.cryptoKeygen();`,
             `    return _bytesToB64(_b64ToBytes(kp.secret).subarray(0, 32)); // the 32-byte epoch secret; NEVER lands on chain`,
             `  };`,
@@ -3289,7 +3067,7 @@ export function generateTsClient(
             `      if (missing.length || extra.length) throw new EncryptionRosterMismatch(scope, missing, extra);`,
             `    }`,
             `    const key = opts.scopeKey ?? await freshScopeKey();`,
-            `    if (!holon.cryptoWrapKey) throw new Error("this holon predates E2E wrap — upgrade @githolon/client");`,
+            `    if (!holon.cryptoWrapKey) throw new Error("this holon predates E2E wrap — upgrade @githolon/runtime");`,
             `    const wraps: { recipientPrincipal: string; recipientPubKey: string; hpkeEpk: string; ct: string }[] = [];`,
             `    for (const principal of members) {`,
             `      const pub = await memberPubKey(principal, { publicKey: opts.add?.publicKey, principal: opts.add?.principal, memberKeys: opts.memberKeys });`,
@@ -3326,6 +3104,11 @@ export function generateTsClient(
     );
   }
 
+  out.push(
+    `/** Reactive typed reads use the raw watch only as a local invalidation signal, then`,
+    ` *  re-read through the generated operation-specific result contract. */`,
+  );
+
   const aggByType = new Map<string, AggregateHandle>();
   const runtimeTypeByAggregate = new Map<string, string>();
   const resultUsdaByAggregate = new Map<string, TsResultAggregate>();
@@ -3445,7 +3228,7 @@ export function generateTsClient(
     readonly result: TsResultAggregate;
     readonly query?: {
       readonly id: string;
-      readonly encoder: ReturnType<typeof emitTsQueryUsdaEncoder>;
+      readonly encoder: ReturnType<typeof emitTsQueryProtoEncoder>;
     };
   }
   const frameworkReadEmissions: FrameworkReadEmission[] =
@@ -3556,7 +3339,7 @@ export function generateTsClient(
         if (queryLaw !== undefined) {
           query = {
             id: definition.query.id,
-            encoder: emitTsQueryUsdaEncoder(
+            encoder: emitTsQueryProtoEncoder(
               queryLaw.graph,
               queryLaw.paths,
               queryLaw.graph.domain.entity.label,
@@ -3649,7 +3432,8 @@ export function generateTsClient(
   if (resultUsdaByAggregate.size > 0 || frameworkReadEmissions.length > 0) {
     out.push(
       `// Canonical USDA result syntax plus graph-generated nominal decoders.`,
-      ...TS_RESULT_USDA_PRELUDE
+      ...TS_RESULT_USDA_PRELUDE,
+      ...TS_RESULT_PROTO_PRELUDE,
     );
     if (hasSurfaced) {
       out.push(
@@ -3885,11 +3669,16 @@ export function generateTsClient(
         .directives ?? []
     );
     const aggregateVos = collectValueObjectDescriptors(mod.aggregates);
+    const readVos = collectSchemaValueObjectDescriptors([
+      ...(mod.deriveds ?? []).map((read) => read.returns),
+      ...(mod.combineds ?? []).map((read) => read.returns),
+    ]);
     for (const d of [
       ...((mod as { valueObjects?: readonly ValueObjectDescriptor[] })
         .valueObjects ?? []),
       ...aggregateVos,
       ...payloadVos,
+      ...readVos,
     ]) {
       const existing = voByName.get(d.name);
       if (
@@ -4604,6 +4393,7 @@ export function generateTsClient(
     targetDomain: string;
     applicationType: string;
   }> = [];
+  const emittedResultRowDecoders = new Set<string>();
   for (const mod of modules) {
     const domain = mod.domain ?? mod.name;
     const domainCallUsda = callUsdaByDomain.get(domain);
@@ -4615,7 +4405,11 @@ export function generateTsClient(
         (d as { businessBirthInternal?: unknown }).businessBirthInternal !==
           true &&
         ((d as { birthsChild?: unknown }).birthsChild !== true ||
-          (d as { businessBirth?: unknown }).businessBirth !== undefined)
+          (d as { businessBirth?: unknown }).businessBirth !== undefined) &&
+        // A directive the law offers only THROUGH a business intent (a capability obligation that
+        // intent `.directs`) is not a second client call: its route and contract are the publisher's.
+        (domainCallUsda === undefined ||
+          publishingIntentOf(domainCallUsda.graph, domain, d.id) === undefined)
     );
     if (dirs.length > 0 && domainCallUsda === undefined) {
       throw new Error(
@@ -4629,6 +4423,7 @@ export function generateTsClient(
         (d as { businessBirth?: unknown }).businessBirth === undefined
     );
     out.push(`// ── domain "${domain}" ──`, ``);
+    if (domainCallUsda) out.push(...tsRefusalDecoders(mod, domainCallUsda.graph, domainCallUsda.paths));
 
     const mintPlan = mintPlans.get(mod);
     // PLACEMENT directives (packed taxonomy births): their `shard` is AUTO-PICKED
@@ -4649,6 +4444,12 @@ export function generateTsClient(
       }
     }
     const methods: string[] = [];
+    if (domainCallUsda?.graph.nodes.some(node => node.kind === "read" && node.entity.label === "receivedWorkspaceAccess")) {
+      const read = generateTsWorkspaceAccessRead(domainCallUsda.graph, domainCallUsda.paths);
+      out.push(...read.source);
+      methods.push(`    /** Source-qualified access discovered entirely from this Home's local Zanzibar graph. */`,
+        `    receivedAccess: () => ${read.functionName}(holon),`);
+    }
     const callEncoderByDirective = new Map<string, string>();
     const internalCallTypeByDirective = new Map<string, string>();
     const sourceTrustViaIds = new Set(
@@ -4671,7 +4472,7 @@ export function generateTsClient(
         via.payloadSchema as z.ZodTypeAny,
         []
       );
-      const encoder = emitTsCallUsdaEncoder(
+      const encoder = emitTsCallProtoEncoder(
         domainCallUsda.graph,
         domainCallUsda.paths,
         domain,
@@ -4822,7 +4623,7 @@ export function generateTsClient(
       for (const actions of Object.values(ownedActions)) {
         for (const action of ["share", "unshare", "transfer"] as const) {
           const directiveId = actions[action];
-          const encoder = emitTsCallUsdaEncoder(
+          const encoder = emitTsCallProtoEncoder(
             domainCallUsda!.graph,
             domainCallUsda!.paths,
             domain,
@@ -4836,7 +4637,7 @@ export function generateTsClient(
           out.push(...encoder.source);
         }
       }
-      const approvalEncoder = emitTsCallUsdaEncoder(
+      const approvalEncoder = emitTsCallProtoEncoder(
         domainCallUsda!.graph,
         domainCallUsda!.paths,
         domain,
@@ -4862,7 +4663,7 @@ export function generateTsClient(
         `    corrections: {`,
         `      undo: async (reason: string): Promise<NomosCorrectionOutcome> => {`,
         `        if (!reason.trim()) throw new Error("corrections.undo() needs a reason");`,
-        `        if (!holon.correctMostRecent) throw new Error("corrections need the current @githolon/client");`,
+        `        if (!holon.correctMostRecent) throw new Error("corrections need the current @githolon/runtime");`,
         `        return holon.correctMostRecent({ kind: "undo", domain: ${JSON.stringify(
           domain
         )}, actions: ${JSON.stringify(
@@ -4871,7 +4672,7 @@ export function generateTsClient(
         `      },`,
         `      redo: async (reason: string): Promise<NomosCorrectionOutcome> => {`,
         `        if (!reason.trim()) throw new Error("corrections.redo() needs a reason");`,
-        `        if (!holon.correctMostRecent) throw new Error("corrections need the current @githolon/client");`,
+        `        if (!holon.correctMostRecent) throw new Error("corrections need the current @githolon/runtime");`,
         `        return holon.correctMostRecent({ kind: "redo", domain: ${JSON.stringify(
           domain
         )}, actions: ${JSON.stringify(
@@ -5094,7 +4895,7 @@ export function generateTsClient(
         ownedRuntimeType === undefined
           ? ""
           : ownedRecordTarget.kind === "premint"
-          ? `      if (!holon.mint) throw new Error("this holon predates record-bound .owned() identity — upgrade @githolon/client");\n` +
+          ? `      if (!holon.mint) throw new Error("this holon predates record-bound .owned() identity — upgrade @githolon/runtime");\n` +
             `      const _ownedRecord = { type: ${JSON.stringify(
               ownedRuntimeType
             )}, id: await holon.mint(${JSON.stringify(
@@ -5126,7 +4927,7 @@ export function generateTsClient(
       const ownedBirthPrelude =
         ownedBirthDescriptor === undefined
           ? ""
-          : `      if (!holon.__nomosOwnedBirthScopeKey) throw new Error("this holon predates automatic .owned() birth custody — upgrade @githolon/client");\n` +
+          : `      if (!holon.__nomosOwnedBirthScopeKey) throw new Error("this holon predates automatic .owned() birth custody — upgrade @githolon/runtime");\n` +
             `      const _ownedBirthKey = await holon.__nomosOwnedBirthScopeKey({ scope: ${JSON.stringify(
               ownedBirthDescriptor.scope
             )}, namespace: ${JSON.stringify(
@@ -5216,12 +5017,18 @@ export function generateTsClient(
                   `TypeScript source-trust codegen: '${domain}/${d.id}' satisfaction query '${satisfactionQuery.id}' has mismatched keys`
                 );
               }
-              // A typed satisfaction query makes source trust a law fact. The
-              // kernel's foreign-read policy gates the single business offer;
-              // the client must not query and silently grant authority first.
-              if (satisfactionQuery !== undefined) return [];
-              const indent = "      ";
+              // A satisfaction query observes enrollment; declaring it does
+              // not create a trust row. Only an absent row invokes the declared
+              // gated enrollment. Existing identities remain the kernel's call.
+              const satisfactionPrelude = satisfactionQuery === undefined ? [] : [
+                `      const _sourceTrustAlreadySatisfied = (await _application.${satisfactionQuery.id}({ ${satisfactionQuery.key
+                  .map(key => `${JSON.stringify(key)}: ${payloadPath(inputPayload, satisfactionArgs[key]!)}`)
+                  .join(", ")} })).length > 0;`,
+                "      if (!_sourceTrustAlreadySatisfied) {",
+              ];
+              const indent = satisfactionQuery === undefined ? "      " : "        ";
               return [
+                ...satisfactionPrelude,
                 `${indent}const _sourceWorkspace = String(${payloadPath(
                   inputPayload,
                   sourceTrust.fromPayload
@@ -5238,6 +5045,7 @@ export function generateTsClient(
                 `${indent}  ${JSON.stringify(sourceTrust.keyHashesField)}: [],`,
                 `${indent}} satisfies ${payloadType};`,
                 `${indent}await _commit(holon.offerCall(${encoder}(_sourceTrustCall, holon.workspace), { domainHash, actor, returnCreated: true }) as Promise<_NomosRawWriteResult>);`,
+                ...(satisfactionQuery === undefined ? [] : ["      }"]),
               ];
             })();
       const sealPrelude =
@@ -5248,7 +5056,7 @@ export function generateTsClient(
                 ? businessBirth !== undefined
                   ? [`      const _ownedKey = _ownedBirthKey;`]
                   : [
-                      `      if (!holon.__nomosOwnedScopeKey) throw new Error("this holon predates automatic .owned() key custody — upgrade @githolon/client");`,
+                      `      if (!holon.__nomosOwnedScopeKey) throw new Error("this holon predates automatic .owned() key custody — upgrade @githolon/runtime");`,
                       `      const _ownedKey = await holon.__nomosOwnedScopeKey({ scope: ${JSON.stringify(
                         Object.values(encFields)[0]!.scope
                       )}, record: _ownedRecord });`,
@@ -5277,7 +5085,7 @@ export function generateTsClient(
                     `      if (!${key}) throw new EncryptionKeyUnavailable(${JSON.stringify(
                       descriptor.scope
                     )}, ${JSON.stringify(field)});`,
-                    `      if (!holon.cryptoSealField) throw new Error("this holon predates E2E sealing — upgrade @githolon/client");`,
+                    `      if (!holon.cryptoSealField) throw new Error("this holon predates E2E sealing — upgrade @githolon/runtime");`,
                     `      const ${sealed} = ${value} == null ? ${value} : await holon.cryptoSealField({`,
                     `        scopeKey: ${key}.key, scope: ${
                       descriptor.owned === true
@@ -5357,7 +5165,7 @@ export function generateTsClient(
               .map((o) => `\`${o.aggregateId}\` (${o.marker})`)
               .join(" + ")}.`
           : "";
-      const callAccess = new Map<string, TsCallUsdaFieldAccess>();
+      const callAccess = new Map<string, TsCallProtoFieldAccess>();
       const callExtraFields = new Map<
         string,
         { readonly type: string; readonly optional?: true }
@@ -5392,6 +5200,8 @@ export function generateTsClient(
           const idTarget = idOfMetaOf(fieldSchema);
           if (idTarget !== undefined) {
             const expected = JSON.stringify(idTarget);
+            const referenceWorkspace = idOfTargetKindOf(fieldSchema) === "contract"
+              ? '\"\"' : "nmsInternalWorkspace";
             const explicitOptionalChoice =
               idOfMetaOf(rawSchema) !== undefined &&
               ["optional", "default"].includes(zodKind(rawSchema));
@@ -5399,18 +5209,20 @@ export function generateTsClient(
               field,
               explicitOptionalChoice
                 ? {
-                    value: `_nmsOptionalReferenceId(${member}, ${expected}, nmsInternalWorkspace, ${JSON.stringify(
+                    value: `_nmsOptionalReferenceId(${member}, ${expected}, ${referenceWorkspace}, ${JSON.stringify(
                       field
                     )})!`,
-                    present: `_nmsOptionalReferenceId(${member}, ${expected}, nmsInternalWorkspace, ${JSON.stringify(
+                    present: `_nmsOptionalReferenceId(${member}, ${expected}, ${referenceWorkspace}, ${JSON.stringify(
                       field
                     )}) !== undefined`,
+                    canonical: true,
                   }
                 : {
-                    value: `_nmsReferenceId(${value}, ${expected}, nmsInternalWorkspace, ${JSON.stringify(
+                    value: `_nmsReferenceId(${value}, ${expected}, ${referenceWorkspace}, ${JSON.stringify(
                       field
                     )})`,
                     ...common,
+                    canonical: true,
                   }
             );
           } else if (refOfMetaOf(fieldSchema) !== undefined) {
@@ -5420,16 +5232,19 @@ export function generateTsClient(
                 refTarget.aggregateType
               )}, "", ${JSON.stringify(field)})`,
               ...common,
+              canonical: true,
             });
           } else if (versionedRefOfMetaOf(fieldSchema) !== undefined) {
             callAccess.set(field, {
               value: `({ pinned: _nmsReferenceData(${value}.pinned), series: _nmsReferenceData(${value}.series) })`,
               ...common,
+              canonical: true,
             });
           } else if (recipientMetaOf(fieldSchema) !== undefined) {
             callAccess.set(field, {
               value: `_nmsRecipientAddress(${value}, ${JSON.stringify(field)})`,
               ...common,
+              canonical: true,
             });
           } else {
             callAccess.set(field, { value, ...common });
@@ -5487,7 +5302,7 @@ export function generateTsClient(
                   }: ${descriptor.type}`
               )
               .join("; ")} }`;
-      const callEncoder = emitTsCallUsdaEncoder(
+      const callEncoder = emitTsCallProtoEncoder(
         domainCallUsda!.graph,
         domainCallUsda!.paths,
         domain,
@@ -5767,13 +5582,14 @@ export function generateTsClient(
         `    ${lcFirst(
           camel(sp.id)
         )}: (bbox: { minX: number; minY: number; maxX: number; maxY: number } | { minLng: number; minLat: number; maxLng: number; maxLat: number }) => ${wrapP(
-          `(holon.spatialWithin ?? (() => { throw new Error("this holon predates spatial reads — upgrade @githolon/client"); }))(${JSON.stringify(
-            sp.id
-          )}, bbox) as Promise<Row<${sp.of}>[]>`
+          nominalRows(sp.of, `holon.__nomosSpatialWithinUsda(${JSON.stringify(sp.id)}, bbox)`)
         )},`
       );
     }
-    for (const q of (mod.queries ?? []) as QueryDecl[]) {
+    for (const read of [...(mod.queries ?? []), ...(mod.orderedReads ?? [])]) {
+      const ordered = "orderKey" in read ? read : undefined;
+      // Shared row codecs; selection and cardinality remain properties of the law node.
+      const q = "orderKey" in read ? { id: read.id, returns: read.of, key: [] as string[] } : read;
       const agg = aggByType.get(q.returns);
       const params = q.key
         .map((k) => {
@@ -5797,7 +5613,7 @@ export function generateTsClient(
           `TypeScript query USDA codegen: composed law is missing domain '${domain}'`
         );
       }
-      const queryEncoder = emitTsQueryUsdaEncoder(
+      const queryEncoder = emitTsQueryProtoEncoder(
         renderedQueryLaw.graph,
         renderedQueryLaw.paths,
         domain,
@@ -5836,30 +5652,72 @@ export function generateTsClient(
         })
       );
       out.push(...queryEncoder.source);
+      const queryNode = renderedQueryLaw.graph.nodes.find(
+        (node): node is LawRowReadNode =>
+          node.kind === "read" &&
+          (node.readKind === "query" || node.readKind === "ordered") &&
+          node.entity.label === q.id,
+      );
+      const resultAggregate = resultUsdaByAggregate.get(q.returns);
+      if (queryNode === undefined || resultAggregate === undefined) {
+        throw new Error(
+          `TypeScript query result codegen: '${domain}.${q.id}' has no generated realm result contract`,
+        );
+      }
+      const resultRowKey = `${domain}\0${q.returns}`;
+      const emitResultRowDecoder = !emittedResultRowDecoders.has(resultRowKey);
+      const queryResultDecoder = emitTsQueryResultProtoDecoder(
+        renderedQueryLaw.graph,
+        renderedQueryLaw.paths,
+        queryNode,
+        resultAggregate,
+        emitResultRowDecoder,
+      );
+      emittedResultRowDecoders.add(resultRowKey);
+      out.push(...queryResultDecoder.source);
       const nominalQuery = queryEncoder.call;
       const qScopes = readScopesFor(q.returns);
       const qOwned = qScopes.some((scope) => scope.owned === true);
       const qScopeJson = JSON.stringify(qScopes);
       const liveQueryRows = (keys?: string): string =>
-        nominalRows(
-          q.returns,
-          `holon.__nomosQueryUsda(${nominalQuery}${
-            keys === undefined ? "" : `, ${keys}`
-          })`
-        );
+        `(async () => ${queryResultDecoder.rowsFunction}(await holon.__nomosQuery(${nominalQuery}${
+          keys === undefined ? "" : `, ${keys}`
+        }), holon))()`;
+      const historicQueryRows = (keys?: string): string =>
+        `(async () => ${queryResultDecoder.rowsFunction}(await historic.__nomosQuery(${nominalQuery}${
+          keys === undefined ? "" : `, ${keys}`
+        }), holon))()`;
+      const rowCallback = ordered?.limit === 1
+        ? `(records: NomosRecord<${q.returns}>[]) => cb(records[0] ?? null)` : "cb";
       const nominalWatch = qScopes.length
         ? qOwned
-          ? `_watchWithOwnedKeys((changed) => holon.__nomosWatchUsda(${nominalQuery}, () => changed(), opts), () => ${wrapP(
-              `_readWithOwnedKeys(holon, keyStore, ${qScopeJson}, (keys) => ${liveQueryRows(
-                "keys"
-              )})`
-            )}, cb)`
-          : `_watchWithOwnedKeys((changed) => holon.__nomosWatchUsda(${nominalQuery}, () => changed(), opts), async () => ${wrapP(
+          ? `holon.__nomosWatchRows((changed) => holon.__nomosWatchUsda(${nominalQuery}, () => changed(), opts), () => ${wrapP(
+              `_readWithOwnedKeys(holon, keyStore, ${qScopeJson}, (keys) => ${liveQueryRows("keys")})`
+            )}, ${rowCallback})`
+          : `holon.__nomosWatchRows((changed) => holon.__nomosWatchUsda(${nominalQuery}, () => changed(), opts), async () => ${wrapP(
               liveQueryRows(`await _readKeys(holon, keyStore, ${qScopeJson})`)
-            )}, cb)`
-        : `holon.__nomosWatchUsda(${nominalQuery}, (resultUsda) => cb(${wrapRows(
-            `_nmsDecode${q.returns}Rows(resultUsda, holon.workspace)`
-          )}), opts)`;
+            )}, ${rowCallback})`
+        : `holon.__nomosWatchResults<NmsGeneratedResult, NomosRecord<${q.returns}>>((changed, failed) => holon.__nomosWatch(${nominalQuery}, changed, failed, opts), (result) => ${wrapRows(
+            `${queryResultDecoder.rowsFunction}(result, holon)`
+          )}, ${rowCallback})`;
+      if (ordered !== undefined) {
+        const resultType = ordered.limit === 1 ? `NomosRecord<${q.returns}> | null` : `NomosRecord<${q.returns}>[]`;
+        const select = ordered.limit === 1 ? "rows[0] ?? null" : "rows";
+        const withKeys = (rows: (keys?: string) => string): string => wrapP(qScopes.length
+          ? qOwned
+            ? `_readWithOwnedKeys(holon, keyStore, ${qScopeJson}, (keys) => ${rows("keys")})`
+            : rows(`await _readKeys(holon, keyStore, ${qScopeJson})`)
+          : rows());
+        methods.push(
+          `    /** Declared ordered read, at most ${ordered.limit} visible records; no caller override. */`,
+          `    ${lcFirst(camel(q.id))}: async (): Promise<${resultType}> => { const rows = await (${withKeys(liveQueryRows)}); return ${select}; },`,
+          `    watch${cap(camel(q.id))}: (cb: (records: ${resultType}) => void, opts?: { intervalMs?: number }) => ${nominalWatch},`,
+        );
+        pastMethods.push(
+          `        ${lcFirst(camel(q.id))}: async (): Promise<${resultType}> => { const rows = await (${withKeys(historicQueryRows)}); return ${select}; },`,
+        );
+        continue; // ID-key pagination is not a value-order cursor.
+      }
       methods.push(
         `    /** @deprecated Whole-result reads scale with result size. Use ${lcFirst(
           camel(q.id)
@@ -5899,42 +5757,24 @@ export function generateTsClient(
             ? `        ${lcFirst(
                 camel(q.id)
               )}: async (params: { ${params} }) => ${wrapP(
-                `_readWithOwnedKeys(holon, keyStore, ${qScopeJson}, (keys) => ${nominalRows(
-                  q.returns,
-                  `historic.__nomosQueryUsda(${nominalQuery}, keys)`
-                )})`
+                `_readWithOwnedKeys(holon, keyStore, ${qScopeJson}, (keys) => ${historicQueryRows("keys")})`
               )},`
             : `        ${lcFirst(
                 camel(q.id)
               )}: async (params: { ${params} }) => ${wrapP(
-                nominalRows(
-                  q.returns,
-                  `historic.__nomosQueryUsda(${nominalQuery}, await _readKeys(holon, keyStore, ${qScopeJson}))`
-                )
+                historicQueryRows(`await _readKeys(holon, keyStore, ${qScopeJson})`)
               )},`
           : `        ${lcFirst(
               camel(q.id)
             )}: (params: { ${params} }) => ${wrapP(
-              nominalRows(
-                q.returns,
-                `historic.__nomosQueryUsda(${nominalQuery})`
-              )
+              historicQueryRows()
             )},`
       );
       const queryPageCall = qScopes.length
         ? qOwned
-          ? `_readPageWithOwnedKeys(holon, keyStore, ${qScopeJson}, (keys) => ${nominalPage(
-              q.returns,
-              `holon.__nomosQueryPageUsda(${nominalQuery}, page, keys)`
-            )})`
-          : nominalPage(
-              q.returns,
-              `holon.__nomosQueryPageUsda(${nominalQuery}, page, await _readKeys(holon, keyStore, ${qScopeJson}))`
-            )
-        : nominalPage(
-            q.returns,
-            `holon.__nomosQueryPageUsda(${nominalQuery}, page)`
-          );
+          ? `_readPageWithOwnedKeys(holon, keyStore, ${qScopeJson}, async (keys) => ${queryResultDecoder.pageFunction}(await holon.__nomosQueryPage(${nominalQuery}, page, keys), holon))`
+          : `(async () => ${queryResultDecoder.pageFunction}(await holon.__nomosQueryPage(${nominalQuery}, page, await _readKeys(holon, keyStore, ${qScopeJson})), holon))()`
+        : `(async () => ${queryResultDecoder.pageFunction}(await holon.__nomosQueryPage(${nominalQuery}, page), holon))()`;
       methods.push(
         `    /** Bounded \`${q.id}\` read. This is the default estate-scale surface: stable opaque cursor, no whole-result hydration. */`,
         `    ${lcFirst(
@@ -5995,6 +5835,30 @@ export function generateTsClient(
             )}: () => historic.count(${JSON.stringify(c.id)}),`
       );
     }
+    for (const membership of (mod.exists_ ?? []).map(finishExists)) {
+      const key = membership.by;
+      const parameter = key == null ? "" : tsGroupParam(key);
+      const field = key == null ? undefined : aggByType.get(membership.of)?.fields[key.split(".")[0]!];
+      const groupType = field?.kind === "ref" ? tsBaseTypeOfField(field) : "string";
+      const wire = field?.kind === "ref"
+        ? `_nmsReferenceId(${parameter}, ${JSON.stringify(field.refAggregateId ?? "")}, holon.workspace, ${JSON.stringify(key)})`
+        : parameter;
+      const args = `${JSON.stringify(membership.id)}${key == null ? "" : `, ${wire}`}`;
+      const signature = `${lcFirst(camel(membership.id))}: async (${key == null ? "" : `${parameter}: ${groupType}`}): Promise<boolean>`;
+      methods.push(
+        `    /** Declared membership, backed by the maintained count, never a row scan. */`,
+        `    ${signature} => {`,
+        `      if (typeof holon.count !== "function") throw new Error("Nomos runtime does not support declared membership reads");`,
+        `      return (await holon.count(${args})) > 0;`,
+        `    },`,
+      );
+      pastMethods.push(
+        `        ${signature} => {`,
+        `          if (typeof historic.count !== "function") throw new Error("Nomos runtime does not support historic declared membership reads");`,
+        `          return (await historic.count(${args})) > 0;`,
+        `        },`,
+      );
+    }
     for (const s of (mod.sums ?? []).map((raw) => finishSum(raw))) {
       const grouped = s.by != null;
       const p = grouped ? tsGroupParam(s.by!) : "";
@@ -6042,6 +5906,35 @@ export function generateTsClient(
       );
     }
 
+    for (const extremum of [...(mod.mins ?? []), ...(mod.maxes ?? [])].map(finishExtremum)) {
+      const grouped = extremum.by != null;
+      const parameter = grouped ? tsGroupParam(extremum.by!) : "";
+      const groupField = grouped
+        ? aggByType.get(extremum.of)?.fields[extremum.by!.split(".")[0]!] as Field | undefined
+        : undefined;
+      const groupType = groupField?.kind === "ref" ? tsBaseTypeOfField(groupField) : "string";
+      const groupWire = groupField?.kind === "ref"
+        ? `_nmsReferenceId(${parameter}, ${JSON.stringify(groupField.refAggregateId ?? "")}, holon.workspace, ${JSON.stringify(extremum.by)})`
+        : parameter;
+      const parameters = grouped ? `${parameter}: ${groupType}` : "";
+      const arguments_ = `${JSON.stringify(extremum.id)}, ${JSON.stringify(extremum.kind)}${grouped ? `, ${groupWire}` : ""}`;
+      const method = lcFirst(camel(extremum.id));
+      methods.push(
+        `    /** Declared ${extremum.kind} \`${extremum.id}\`. Null means no contributing member; zero is a value. */`,
+        `    ${method}: async (${parameters}): Promise<number | null> => {`,
+        `      if (!holon.__nomosExtremum) throw new Error("Nomos runtime does not support declared extrema reads");`,
+        `      return holon.__nomosExtremum(${arguments_});`,
+        `    },`,
+      );
+      pastMethods.push(
+        `        /** Declared ${extremum.kind} \`${extremum.id}\` at this moment. */`,
+        `        ${method}: async (${parameters}): Promise<number | null> => {`,
+        `          if (!historic.__nomosExtremum) throw new Error("Nomos runtime does not support historic declared extrema reads");`,
+        `          return historic.__nomosExtremum(${arguments_});`,
+        `        },`,
+      );
+    }
+
     // ── BUSINESS MERGE CONFLICT DX: Nomos keeps its heterogeneous workspace index private. The
     // generated surface exposes a summary, then aggregate-specific pending conflict references.
     // Each reference owns the one lawful `merge(...)` action for its field — Git semantics: inspect
@@ -6108,7 +6001,7 @@ export function generateTsClient(
         `     *  conflict is the typed capability that can merge itself. Nomos's raw index stays private. */`,
         `    conflicts: {`,
         `      summary: async (): Promise<${conflictSummaryType}> => {`,
-        `        if (!holon.__nomosPendingConflictSummaryUsda) throw new Error("conflicts need the current @githolon/client");`,
+        `        if (!holon.__nomosPendingConflictSummaryUsda) throw new Error("conflicts need the current @githolon/runtime");`,
         `        const summary = _nmsConflictUsdaSummary(await holon.__nomosPendingConflictSummaryUsda());`,
         `        const count = (aggregatePath: string): number => summary.byAggregate.find((entry) => entry.aggregatePath === aggregatePath)?.count ?? 0;`,
         `        return {`,
@@ -6165,7 +6058,7 @@ export function generateTsClient(
           `        /** Pending merges for ${aggregateId}. Querying creates typed merge references;`,
           `         *  no aggregate id, field name, or directive id is supplied by the app. */`,
           `        pending: async (): Promise<Array<${pendingType}>> => {`,
-          `          if (!holon.__nomosPendingConflictsUsda) throw new Error("conflicts need the current @githolon/client");`,
+          `          if (!holon.__nomosPendingConflictsUsda) throw new Error("conflicts need the current @githolon/runtime");`,
           `          const rows = _nmsConflictUsdaRows(await holon.__nomosPendingConflictsUsda(${JSON.stringify(
             runtimeAggregateType
           )}));`,
@@ -6348,6 +6241,13 @@ export function generateTsClient(
       methods.push(
         `    /** ${agg.id} identity and reads. Business actions remain application-level because one action may change many aggregate kinds. */`,
         `    ${collection}: {`,
+        ...(agg.implementsContracts ?? []).flatMap((contractId) => [
+          `      /** Expose the contract this aggregate declares, preserving its workspace and record id. This grants no access. */`,
+          `      as${contractTypeName(contractId)}: (record: NomosRecord<${agg.id}>): NomosRef<${contractTypeName(contractId)}> => {`,
+          `        const reference = record.ref; _nmsReferenceId(reference, ${JSON.stringify(agg.id)}, "", "record");`,
+          `        return _nmsRef<${contractTypeName(contractId)}>(reference.workspace, ${JSON.stringify(contractId)}, reference.id);`,
+          `      },`,
+        ]),
         `      /** Recover a typed reference from its stable public address. This identifies a record; it never grants authority. */`,
         `      fromAddress: (address: string): NomosRef<${
           agg.id
@@ -6362,7 +6262,7 @@ export function generateTsClient(
           agg.id
         )}, "", "record");`,
         `        if (ref.workspace !== holon.workspace) {`,
-        `          if (!holon.__nomosOpenChild) throw new Error("opening this record needs the current @githolon/client");`,
+        `          if (!holon.__nomosOpenChild) throw new Error("opening this record needs the current @githolon/runtime");`,
         `          return (await ${tsClientFactoryName(
           domain
         )}(await holon.__nomosOpenChild(ref.workspace)).${collection}.find(record));`,
@@ -6381,17 +6281,15 @@ export function generateTsClient(
           agg.id
         )}, "", "record");`,
         `        if (ref.workspace !== holon.workspace) {`,
-        `          let active = true; let stop = () => {};`,
-        `          if (!holon.__nomosOpenChild) throw new Error("opening this record needs the current @githolon/client");`,
-        `          void holon.__nomosOpenChild(ref.workspace).then((child) => { if (active) stop = ${tsClientFactoryName(
+        `          if (!holon.__nomosOpenChild) throw new Error("opening this record needs the current @githolon/runtime");`,
+        `          return holon.__nomosWatchFollow(holon.__nomosOpenChild(ref.workspace), (child) => ${tsClientFactoryName(
           domain
-        )}(child).${collection}.watchOne(record, cb, opts); }).catch(() => { if (active) cb(undefined); });`,
-        `          return () => { active = false; stop(); };`,
+        )}(child).${collection}.watchOne(record, cb, opts), () => cb(undefined));`,
         `        }`,
         `        const id = ref.id;`,
         ...(aScopes.length
           ? [
-              `        return _watchWithOwnedKeys((changed) => holon.__nomosWatchByIdUsda(${JSON.stringify(
+              `        return holon.__nomosWatchRows((changed) => holon.__nomosWatchByIdUsda(${JSON.stringify(
                 runtimeType
               )}, id, () => changed(), opts), async () => ${wrapP(
                 findRows
@@ -6461,7 +6359,7 @@ export function generateTsClient(
       `    /** Historic scrubbing in the same generated business language as live reads. */`,
       `    past: {`,
       `      moments: async (opts: { limit?: number } = {}): Promise<NomosMoment[]> => {`,
-      `        if (!holon.commits) throw new Error("past.moments() needs the current @githolon/client");`,
+      `        if (!holon.commits) throw new Error("past.moments() needs the current @githolon/runtime");`,
       `        const actions = new Set<string>(${JSON.stringify([
         ...dirs.map((directive) => directive.id),
         ...(correctionActions.length > 0
@@ -6483,7 +6381,7 @@ export function generateTsClient(
       `          }));`,
       `      },`,
       `      at: (moment: NomosMoment) => {`,
-      `        if (!holon.at) throw new Error("past.at() needs the current @githolon/client");`,
+      `        if (!holon.at) throw new Error("past.at() needs the current @githolon/runtime");`,
       `        const historic = holon.at(moment.id);`,
       `        return {`,
       ...pastMethods,
@@ -6526,7 +6424,7 @@ export function generateTsClient(
         `                  ? "This part of the organisation was reclaimed. Its birth remains part of this workspace's history."`,
         `                  : "This part of the organisation has a newer lifecycle this client does not understand. Its link remains visible.",`,
         `            open: async (): Promise<NomosDescription> => {`,
-        `              if (!holon.__nomosOpenChild) throw new Error("opening an organisation link needs the current @githolon/client");`,
+        `              if (!holon.__nomosOpenChild) throw new Error("opening an organisation link needs the current @githolon/runtime");`,
         `              return ${tsClientFactoryName(
           domain
         )}(await holon.__nomosOpenChild(child.workspace)).describe();`,
@@ -6662,19 +6560,21 @@ export function generateTsClient(
     out.push(
       `/** Framework binding for the generated application. Law identity, author identity and key custody`,
       ` *  are captured from the connected stateful client; callers cannot override them. */`,
-      `/** THE HOLON-LEVEL FACTORY — the headless/code-mode binding (headless-operation.md). Binds`,
-      ` *  structurally to any NomosHolon: a full \`connect()\` holon, or the thin remote holon`,
+      `/** THE HOLON-LEVEL FACTORY — the code-mode binding of this application's Reception. Binds`,
+      ` *  to the peer's holon however it was opened: a full \`connect()\` holon, or the thin remote holon`,
       ` *  (\`connectRemote\`) for isolates that live beside the edge. The application surface`,
-      ` *  (\`open<Name>Application\`) remains the batteries-included entry for devices. */`,
+      ` *  (\`receive<Name>Application\`) remains the batteries-included entry for devices. The binding is`,
+      ` *  opaque to tenant code: the peer runtime hands it in; its members are not a tenant surface. */`,
       `${
         opts.exportHolonFactory === true ? "export " : ""
-      }function ${tsClientFactoryName(domain)}(holon: NomosHolon) {`,
+      }function ${tsClientFactoryName(domain)}(binding: NomosHolonBinding) {`,
+      `  const holon = binding as unknown as NomosHolon;`,
       `  const domainHash = ${hashConst};`,
       `  const actor = holon.principal;`,
       ...(activityPresent
         ? [
-            `  const _nomosActivityLog = (opts?: { base?: string; limit?: number }) => { if (!holon.activityLog) throw new Error("activity reads need a custody-capable @githolon/client binding"); return holon.activityLog(opts); };`,
-            `  const _nomosWatchActivity = (cb: (rows: ActivityRawRow[]) => void, opts?: { base?: string; intervalMs?: number }) => { if (!holon.watchActivity) throw new Error("activity watches need a custody-capable @githolon/client binding"); return holon.watchActivity(cb, opts); };`,
+            `  const _nomosActivityLog = (opts?: { base?: string; limit?: number }) => { if (!holon.activityLog) throw new Error("activity reads need a custody-capable @githolon/runtime binding"); return holon.activityLog(opts); };`,
+            `  const _nomosWatchActivity = (cb: (rows: ActivityRawRow[]) => void, opts?: { base?: string; intervalMs?: number }) => { if (!holon.watchActivity) throw new Error("activity watches need a custody-capable @githolon/runtime binding"); return holon.watchActivity(cb, opts); };`,
           ]
         : []),
       `  holon.prepareDomain?.(${JSON.stringify(domain)}, domainHash);`,
@@ -6682,7 +6582,7 @@ export function generateTsClient(
         ? [
             `  const keyStore: NomosKeyStore | undefined = ${
               domScopes.length > 0
-                ? `{ scopeKey: async (scope) => { if (!holon.__nomosScopeKey) throw new Error("encrypted business data needs the current @githolon/client"); return holon.__nomosScopeKey({ scope }); }, readKeys: async (scopes) => { if (!holon.__nomosScopeKeys) throw new Error("encrypted business data needs the current @githolon/client"); return holon.__nomosScopeKeys({ scopes }); } }`
+                ? `{ scopeKey: async (scope) => { if (!holon.__nomosScopeKey) throw new Error("encrypted business data needs the current @githolon/runtime"); return holon.__nomosScopeKey({ scope }); }, readKeys: async (scopes) => { if (!holon.__nomosScopeKeys) throw new Error("encrypted business data needs the current @githolon/runtime"); return holon.__nomosScopeKeys({ scopes }); } }`
                 : "undefined"
             };`,
           ]
@@ -6699,7 +6599,7 @@ export function generateTsClient(
             )}, domain: ${JSON.stringify(
               domain
             )}, domainHash }).catch((error) => { _ownedReadyError = error; })`,
-            `    : Promise.resolve().then(() => { _ownedReadyError = new Error("owned records need the current @githolon/client"); });`,
+            `    : Promise.resolve().then(() => { _ownedReadyError = new Error("owned records need the current @githolon/runtime"); });`,
             `  const _ownedRecordAction = async (action: "share" | "unshare" | "transfer", record: NomosRef<_NomosAnyAggregate>, peer: string): Promise<void> => {`,
             `    await _ownedReady;`,
             `    if (_ownedReadyError !== undefined) throw _ownedReadyError;`,
@@ -6708,7 +6608,7 @@ export function generateTsClient(
             `    const directiveId = _ownedActions[recordData.type]?.[action];`,
             `    if (directiveId === undefined) throw new Error(\`${"${action}()"} needs a generated owned record reference\`);`,
             `    if (!peer.trim()) throw new Error(\`${"${action}()"} needs the person to act with\`);`,
-            `    if (!holon.__nomosPrepareOwnedRecordAction) throw new Error("record sharing needs the current @githolon/client");`,
+            `    if (!holon.__nomosPrepareOwnedRecordAction) throw new Error("record sharing needs the current @githolon/runtime");`,
             `    switch (directiveId) {`,
             ...[...ownedActionCallEncoders]
               .sort(([left], [right]) => left.localeCompare(right))
@@ -6725,53 +6625,25 @@ export function generateTsClient(
             `  };`,
           ]
         : []),
-      ...(opts.compat !== undefined
+      ...(opts.kernelContracts !== undefined
         ? [
             clientInterface !== undefined
-              ? `  holon.checkCompat?.(${compatConstName(
-                  opts.packageName
-                )}, ${interfaceConstName(opts.packageName)});`
-              : `  holon.checkCompat?.(${compatConstName(opts.packageName)});`,
-            `  holon.assertKernelCoherence?.(${compatConstName(
-              opts.packageName
-            )}.kernelContracts ?? [], { lawHash: ${compatConstName(
-              opts.packageName
-            )}.lawHash });`,
+              ? `  holon.checkCompat?.(${interfaceConstName(opts.packageName)});`
+              : `  void 0;`,
+            `  holon.assertKernelCoherence?.(${JSON.stringify(
+              opts.kernelContracts
+            )}, { lawHash: ${hashConst} });`,
           ]
         : []),
-      `  return {`,
+      `  const _application = {`,
       `    domain: ${JSON.stringify(domain)} as const,`,
-      `    domainHash,`,
-      `    /** Adopt THIS generated model. Nomos proves it against current history; a deliberate`,
-      `     *  difference returns a decision whose accept(reason) re-proves and records the reason. */`,
-      `    model: {`,
-      `      adopt: (): Promise<NomosModelAdoption> => _nomosAdoptModel(holon, ${JSON.stringify(
-        domain
-      )}, domainHash${
-        opts.lawAssetName === undefined
-          ? ""
-          : `, new URL(${JSON.stringify(
-              `./${opts.lawAssetName}`
-            )}, import.meta.url)`
-      }),`,
-      `      restorePrevious: (): Promise<NomosModelRestoration> => _nomosRestorePreviousModel(holon, ${JSON.stringify(
-        domain
-      )}, domainHash),`,
-      `    },`,
-      ...(clientInterface !== undefined
-        ? [
-            `    interface: ${interfaceConstName(
-              opts.packageName
-            )}[${JSON.stringify(domain)}],`,
-          ]
-        : []),
       ...(ownedScope !== undefined && ownedWritesAvailable
         ? [
             `    /** Opt into all-device-loss recovery with one explicitly designated person. Nomos owns the handoff. */`,
             `    recovery: {`,
             `      protectWith: async (person: string): Promise<{ status: "protected"; recoveryPrincipal: string; unchanged?: boolean }> => {`,
             `        if (!person.trim()) throw new Error("recovery.protectWith() needs the person who will recover you");`,
-            `        if (!holon.__nomosProtectOwnedIdentity) throw new Error("recovery.protectWith() needs the current @githolon/client");`,
+            `        if (!holon.__nomosProtectOwnedIdentity) throw new Error("recovery.protectWith() needs the current @githolon/runtime");`,
             `        return holon.__nomosProtectOwnedIdentity({ scope: ${JSON.stringify(
               ownedScope
             )}, domain: ${JSON.stringify(
@@ -6782,7 +6654,7 @@ export function generateTsClient(
             `    /** Add another of this person's devices through one opaque request and approval. */`,
             `    devices: {`,
             `      request: async (): Promise<NomosDeviceRequest> => {`,
-            `        if (!holon.__nomosOwnedDeviceRequest) throw new Error("devices.request() needs the current @githolon/client");`,
+            `        if (!holon.__nomosOwnedDeviceRequest) throw new Error("devices.request() needs the current @githolon/runtime");`,
             `        return await holon.__nomosOwnedDeviceRequest({ scope: ${JSON.stringify(
               ownedScope
             )} });`,
@@ -6790,7 +6662,7 @@ export function generateTsClient(
             `      approve: async (request: NomosDeviceRequest): Promise<void> => {`,
             `        const principal = actor ?? holon.principal;`,
             `        if (!principal || !principal.trim()) throw new Error("devices.approve() needs a signed-in Nomos session");`,
-            `        if (!holon.__nomosPrepareOwnedDeviceApproval) throw new Error("devices.approve() needs the current @githolon/client");`,
+            `        if (!holon.__nomosPrepareOwnedDeviceApproval) throw new Error("devices.approve() needs the current @githolon/runtime");`,
             `        const payload = await holon.__nomosPrepareOwnedDeviceApproval({ request, scope: ${JSON.stringify(
               ownedScope
             )} });`,
@@ -6812,6 +6684,14 @@ export function generateTsClient(
         : []),
       ...methods,
       `  };`,
+      ...(dirs.some(command => refusalContracts(mod, command.id).length > 0) ? [
+        `  return { ..._application,`,
+        ...dirs.filter(command => refusalContracts(mod, command.id).length > 0).map(command => {
+          const method = (command as { businessBirth?: unknown }).businessBirth !== undefined && !isBusinessIntent(command) ? "birth" : command.id;
+          return `    decide${cap(camel(command.id))}: (...args: Parameters<typeof _application.${method}>) => _admissionDecision(() => _application.${method}(...args), ${tsRefusalDecoder(mod, command.id)}),`;
+        }),
+        `  };`,
+      ] : [`  return _application;`]),
       `}`,
       ``
     );
@@ -6881,6 +6761,7 @@ export function generateTsClient(
       "encryption",
       "recovery",
       "devices",
+      ...invitationPolicies.map((policy) => policy.pendingMethod),
       ...internalApplicationDirectiveMembers,
       ...applicationBirths.map((birth) => birth.method),
     ] as const;
@@ -6923,25 +6804,9 @@ export function generateTsClient(
       ),
       `type _${applicationName}Business = ${applicationType};`,
       `export type ${applicationName}Status = _NomosApplicationStatus;`,
-      `export interface ${applicationName}PerformanceSample {`,
-      `  readonly operation: "open" | "offer" | "birth" | "read" | "sync" | "maintenance";`,
-      `  readonly name: string; readonly durationMs: number; readonly domain?: string; readonly directive?: string;`,
-      `}`,
-      `export type ${applicationName} = _${applicationName}Business & _NomosApplicationParticipant & _NomosApplicationLifecycle & _NomosApplicationModelLifecycle${
+      `export type ${applicationName} = _${applicationName}Business & _NomosApplicationParticipant & _NomosApplicationLifecycle${
         hasInvitations ? " & _NomosApplicationInvitations" : ""
       };`,
-      `export interface ${applicationName}OpenOptions {`,
-      `  /** Nomos Cloud serving this deployed application. Configure it once at the app boundary. */`,
-      `  readonly cloud: string;`,
-      `  /** The deployed business application anchor, configured once at the app boundary. */`,
-      `  readonly application: string;`,
-      `  /** Return the signed-in authority credential; when supplied, bind its opaque device challenge. */`,
-      `  readonly signIn: (request?: { readonly deviceChallenge?: string }) => Promise<string>;`,
-      `  /** Typed timings for developer tooling; Nomos routing, credentials and Git custody remain private. */`,
-      `  readonly onPerformance?: (sample: ${applicationName}PerformanceSample) => void;`,
-      `  /** Supply the accountable business decision when this client intentionally changes the deployed model. */`,
-      `  readonly approveModel?: (decision: { readonly summary: string; readonly review: NomosModelReview }) => Promise<{ readonly because: string }>;`,
-      `}`,
       `function _nomosPublicDomain<T extends Record<string, unknown>>(domain: T): _NomosPublicDomain<T> {`,
       `  const application: Record<string, unknown> = {};`,
       `  const privateMembers = new Set<string>(${JSON.stringify(
@@ -6950,10 +6815,11 @@ export function generateTsClient(
       `  for (const [name, value] of Object.entries(domain)) if (!privateMembers.has(name)) application[name] = value;`,
       `  return application as _NomosPublicDomain<T>;`,
       `}`,
-      `function _nomosBind${applicationName}(`,
+      `function _nomosReceive${applicationName}(`,
       `  holon: NomosHolon,`,
       `  user: { readonly identityId: string; readonly identityAddress: string },`,
-      `): _${applicationName}Business & _NomosApplicationParticipant & _NomosApplicationModelLifecycle${
+      `  reception: _NomosReceptionSession<NomosHolon>,`,
+      `): _${applicationName}Business & _NomosApplicationParticipant${
         hasInvitations ? " & _NomosApplicationInvitations" : ""
       } {`,
       ...clientDomains.map(
@@ -6965,9 +6831,6 @@ export function generateTsClient(
         .join(", ")}] as const;`,
       `  const application: Record<string, unknown> = {};`,
       `  application.currentUser = { identity: { id: user.identityId, address: user.identityAddress } } as User;`,
-      `  application.model = _nmsRoot${clientDomains.indexOf(
-        homeDomain
-      )}.model;`,
       ...(hasInvitations
         ? [
             `  for (const reserved of ["recipient", "createInvitation", "redeemInvitation"] as const) {`,
@@ -6978,12 +6841,10 @@ export function generateTsClient(
             `    if (!value) throw new TypeError("recipient(uid) needs the identity provider user id");`,
             `    return _nmsRecipient<User>("user:" + value);`,
             `  };`,
-            `  application.createInvitation = async (): Promise<Invitation<User>> =>`,
-            `    _nmsInvitation<User>(await nomosInternalCreateInvitation(holon));`,
-            `  application.redeemInvitation = (link: string): Promise<void> =>`,
-            `    nomosInternalRedeemInvitation(holon, link, ${JSON.stringify(
-              invitationPolicies
-            )}, _nmsFrameworkCalls);`,
+          `  application.createInvitation = async (): Promise<Invitation<User>> =>`,
+          `    _nmsInvitation<User>(await reception.createInvitation());`,
+          `  application.redeemInvitation = (link: string): Promise<void> =>`,
+          `    reception.redeemInvitation(link, ${invitationPoliciesExpression}, _nmsFrameworkCalls);`,
           ]
         : []),
       `  const privateMembers = new Set<string>(${JSON.stringify(
@@ -7025,18 +6886,11 @@ export function generateTsClient(
             birth.method
           )}](input);`,
           `    const address = _nmsReferenceData(root);`,
-          `    const child = await nomosInternalOpenGeneratedChildApplication(`,
-          `      holon,`,
-          `      address.workspace,`,
-          `      (child) => _nomosPublicDomain(${tsClientFactoryName(
+          `    const followed = await reception.follow(address.workspace);`,
+          `    const child = _nomosPublicDomain(${tsClientFactoryName(
             birth.targetDomain
-          )}(child as NomosHolon)),`,
-          `    );`,
-          `    const creationReceipt = (async (): Promise<void> => {`,
-          `      await holon.sync?.();`,
-          `      if (!holon.settleBirth) throw new Error("birth() requires the current @githolon/client to prove remote custody convergence");`,
-          `      await holon.settleBirth(address.workspace);`,
-          `    })();`,
+          )}(followed.reception.desk));`,
+          `    const creationReceipt = followed.settled;`,
           `    void creationReceipt.catch(() => {});`,
           `    Object.defineProperty(child, "creationReceipt", { value: creationReceipt, enumerable: true, configurable: false, writable: false });`,
           `    return child as ${birth.applicationType};`,
@@ -7093,7 +6947,7 @@ export function generateTsClient(
       `    }`,
       `    throw unsupported ?? new Error(name + " needs a generated owned record reference");`,
       `  };`,
-      `  return application as unknown as _${applicationName}Business & _NomosApplicationParticipant & _NomosApplicationModelLifecycle${
+      `  return application as unknown as _${applicationName}Business & _NomosApplicationParticipant${
         hasInvitations ? " & _NomosApplicationInvitations" : ""
       };`,
       `}`,
@@ -7204,41 +7058,35 @@ export function generateTsClient(
             `  },`,
           ]),
       `};`,
-      ...(opts.exportHolonFactory === true
-        ? [
-            `/** Compiler/runtime integration only. The ordinary application client does not export`,
-            ` * framework operators; the headless artifact exposes them so host conformance can exercise`,
-            ` * the exact composed law without rebuilding payload schemas by hand. */`,
-            `export const nomosInternalFrameworkCalls = _nmsFrameworkCalls;`,
-          ]
-        : []),
-      `/** Open the one durable, signed-in ${opts.packageName} business application.`,
-      ` *  Keep and pass this object down as application state; do not create a repository, runtime host`,
-      ` *  or parallel cache around it. Nomos owns offline custody and synchronization. */`,
-      `export function ${applicationOpener}(options: ${applicationName}OpenOptions): Promise<${applicationName}> {`,
-      `  return nomosInternalOpenGeneratedApplication(`,
-      `    { cloud: options.cloud, application: options.application, signIn: options.signIn, onPerformance: options.onPerformance, approveModel: options.approveModel, lawHash: ${hashConst}, readyCommands: [${rootBirths
+      `/** Reception presents the generated business vocabulary for one Peer Office application desk.`,
+      ` *  The compiler contributes no custody, sync, credential, placement or law lifecycle. */`,
+      `export function ${applicationReception}(reception: _NomosReceptionSession<NomosHolonBinding>): ${applicationName} {`,
+      `  const session = reception as unknown as _NomosReceptionSession<NomosHolon>;`,
+      `  const application = _nomosReceive${applicationName}(session.desk, session.user, session) as ${applicationName};`,
+      `  Object.defineProperty(application, "currentStatus", { value: () => reception.status.current(), enumerable: false });`,
+      `  Object.defineProperty(application, "watchStatus", { value: (listener: (status: _NomosApplicationStatus) => void) => reception.status.watch(listener), enumerable: false });`,
+      `  Object.defineProperty(application, "close", { value: () => reception.close(), enumerable: false });`,
+      `  return application;`,
+      `}`,
+      `/** Immutable compiler output. Peer Office compares this requirement with each workspace's current law. */`,
+      `export const ${applicationName}Definition = {`,
+      `  name: ${JSON.stringify(opts.packageName)},`,
+      `  compatibility: {`,
+      `    lawIdentity: sha256Digest(${hashConst}),`,
+      `    matrixUsda: ${clientInterface === undefined ? "new Uint8Array()" : interfaceConstName(opts.packageName)},`,
+      `    readyCommands: [${rootBirths
         .map(
           (birth) =>
             `{ domain: ${JSON.stringify(
               birth.sourceDomain
-            )}, packageHash: ${hashConst}, directiveId: ${JSON.stringify(
+            )}, packageHash: sha256Digest(${hashConst}), directiveId: ${JSON.stringify(
               birth.directiveId
             )} }`
         )
-        .join(", ")}], frameworkCalls: _nmsFrameworkCalls },`,
-      `    (holon, user) => _nomosBind${applicationName}(holon as NomosHolon, user),`,
-      `  );`,
-      `}`,
-      ...(clientInterface === undefined
-        ? []
-        : [
-            `// Compiler tooling compares the requirement carried by the client that will actually ship.`,
-            `// A global symbol keeps this off tenant autocomplete while avoiding a duplicate sidecar.`,
-            `Object.defineProperty(${applicationOpener}, Symbol.for("nomos.generated-interface"), { value: ${interfaceConstName(
-              opts.packageName
-            )}, enumerable: false });`,
-          ]),
+        .join(", ")}],`,
+      `  },`,
+      `  receive: ${applicationReception},`,
+      `} satisfies _NomosGeneratedApplication<NomosHolon, ${applicationName}>;`,
       ``
     );
   }