@githolon/dsl 0.108.7 → 0.110.1

package/src/law_graph_usda.ts

@@ -27,6 +27,7 @@ import type {
   LawWorkspaceTypeNode,
   LawWorkspaceRelationNode,
 } from "./law_graph.js";
+import { MemberAuthenticationKind, type AuthenticationProviderRef } from "./member_authentication.js";
 
 const FRAMEWORK_SCALAR: Readonly<Record<string, string>> = {
   string: "/Nomos/Framework/Types/t_0000000000000001",
@@ -35,10 +36,16 @@ const FRAMEWORK_SCALAR: Readonly<Record<string, string>> = {
 };
 
 const FRAMEWORK_RELATIONS = [
-  { key: "workspace#admin", id: "r_0000000000000001", object: "o_0000000000000001", subjects: ["user", "key"] },
+  // admin and installDomain also admit the framework's console and custodian principals: token-free
+  // genesis (D22) seats a `console:`/`custodian:` founder as admin and as model authority. These two
+  // scopes are framework vocabulary (`member_authentication.ts`); no tenant scope is ever named here.
+  // This layer is the framework unit every law composes with: changing it moves the unit, so it lands
+  // only together with a stage-zero law refreshed through `npm run prepare:kernel` (the candidate's
+  // companion and nomos_flutter/assets/nomos_kernel/bootstrap.law.usdz), never alone.
+  { key: "workspace#admin", id: "r_0000000000000001", object: "o_0000000000000001", subjects: ["user", "key", "console", "custodian"] },
   { key: "workspace#creator", id: "r_0000000000000002", object: "o_0000000000000001", subjects: ["user", "key"] },
   { key: "workspace#platformCreator", id: "r_0000000000000003", object: "o_0000000000000001", subjects: ["user", "key"] },
-  { key: "workspace#installDomain", id: "r_0000000000000004", object: "o_0000000000000001", subjects: ["user", "key"] },
+  { key: "workspace#installDomain", id: "r_0000000000000004", object: "o_0000000000000001", subjects: ["user", "key", "console", "custodian"] },
   { key: "identity#signer", id: "r_0000000000000005", object: "o_0000000000000002", subjects: ["key"] },
 ] as const;
 
@@ -146,6 +153,22 @@ export function emitFrameworkLawUsda(): string {
 }
 type ResolveDependency = (dependency: LawDependencyRef<any>) => string;
 
+/**
+ * A member's declared provider (identity target model D7, D22). An enrolled or sovereign provider is
+ * its kind and scope and nothing else: no issuer, key or token is law. The legacy digest form keeps
+ * today's scope/identity pair, which the kernel still requires paired.
+ */
+function authenticationProviderOpinions(provider: AuthenticationProviderRef, pad: string): string[] {
+  const scope = `${pad}custom uniform string nomos:authenticationProviderScope = ${quote(provider.scope)}`;
+  switch (provider.kind) {
+    case "legacySelected":
+      return [scope, `${pad}custom uniform string nomos:authenticationProviderIdentity = ${quote(provider.identitySha256)}`];
+    case "enrolled":
+    case "sovereign":
+      return [`${pad}custom uniform token nomos:authenticationProviderKind = ${quote(provider.kind)}`, scope];
+  }
+}
+
 function entityLabelOpinions(
   entity: { readonly label: string; readonly priorLabels: readonly string[] },
   indent: number,
@@ -165,6 +188,8 @@ function entityLabelOpinions(
 export interface CompiledSparseLawGraphUsda {
   readonly text: string;
   readonly paths: ReadonlyMap<string, string>;
+  /** The exact same nominal export resolution used while emitting relationship targets. */
+  readonly resolveDependency: ResolveDependency;
 }
 
 /** Render one sparse law layer and retain its exact identity-path projection for client codegen. */
@@ -304,10 +329,10 @@ export function compileSparseLawGraphUsda(
       candidates = dependencyPaths.get(`*:${dependency.entityKind}:${dependency.label}`) ?? [];
     }
     if (candidates.length === 0) {
-      fail(`no closure path resolves dependency '${dependency.domain ?? "?"}:${dependency.entityKind}:${dependency.label}'`);
+      fail(`domain '${graph.domain.entity.label}' has no closure path resolving dependency '${dependency.domain ?? "?"}:${dependency.entityKind}:${dependency.label}'`);
     }
     if (candidates.length > 1) {
-      fail(`dependency '${dependency.domain ?? "?"}:${dependency.entityKind}:${dependency.label}' is ambiguous in the closure`);
+      fail(`domain '${graph.domain.entity.label}' dependency '${dependency.domain ?? "?"}:${dependency.entityKind}:${dependency.label}' is ambiguous in the closure`);
     }
     return candidates[0]!;
   };
@@ -437,8 +462,12 @@ export function compileSparseLawGraphUsda(
       }
       case "nullable":
       case "default": {
-        // These wrappers already resolve to their carried type rather than owning a USDA prim.
-        key = childKey(node.expression.value.id);
+        // Wrappers do not own prims, but their meaning must survive structural
+        // interning. A nullable field is not the same contract as a non-null field.
+        const child = childKey(node.expression.value.id);
+        if (child !== undefined) key = JSON.stringify(node.expression.kind === "nullable"
+          ? ["nullable", child]
+          : ["default", child, node.expression.defaultValue]);
         break;
       }
       case "record": {
@@ -450,19 +479,25 @@ export function compileSparseLawGraphUsda(
         }
         if (members.length === (anonymousFieldsByOwner.get(id)?.length ?? 0)) {
           members.sort(([left], [right]) => left.localeCompare(right));
-          key = JSON.stringify(["record", members]);
+          key = JSON.stringify(["record", members,
+            node.expression.semantic?.kind === "value-object" ? node.expression.semantic.geometry : undefined]);
         }
         break;
       }
       case "sum": {
-        const members: string[] = [];
+        const members: Array<readonly [string, string]> = [];
         for (const variant of anonymousVariantsByOwner.get(id) ?? []) {
           const child = childKey(variant.value.id);
           if (child === undefined) break;
-          members.push(child);
+          // A union arm's discriminator is part of its wire contract. Two sums
+          // with the same carried value shapes but different arm labels cannot
+          // share one USDA prim: authoring reconstructs the nominal oneof from
+          // these labels before it decodes the generated Protobuf call.
+          members.push([variant.label ?? variant.entity.label, child]);
         }
         if (members.length === (anonymousVariantsByOwner.get(id)?.length ?? 0)) {
-          members.sort();
+          members.sort(([leftLabel, leftChild], [rightLabel, rightChild]) =>
+            leftLabel.localeCompare(rightLabel) || leftChild.localeCompare(rightChild));
           key = JSON.stringify(["sum", members]);
         }
         break;
@@ -547,14 +582,16 @@ export function compileSparseLawGraphUsda(
     for (const variant of anonymousVariantsByOwner.get(canonicalId) ?? []) {
       const child = semanticTypeKey(variant.value.id);
       if (child === undefined) continue;
-      const matches = canonicalVariants.get(child) ?? [];
+      const key = JSON.stringify([variant.label ?? variant.entity.label, child]);
+      const matches = canonicalVariants.get(key) ?? [];
       matches.push(variant);
-      canonicalVariants.set(child, matches);
+      canonicalVariants.set(key, matches);
     }
     for (const variant of anonymousVariantsByOwner.get(duplicateId) ?? []) {
       const child = semanticTypeKey(variant.value.id);
       if (child === undefined) continue;
-      const canonical = canonicalVariants.get(child)?.shift();
+      const key = JSON.stringify([variant.label ?? variant.entity.label, child]);
+      const canonical = canonicalVariants.get(key)?.shift();
       if (canonical !== undefined) {
         pathById.set(variant.entity.id, requiredPath(canonical.entity.id, pathById));
       }
@@ -631,14 +668,17 @@ export function compileSparseLawGraphUsda(
         `${" ".repeat(indent)}custom uniform token nomos:objectNamespace = ${quote(objectType.namespace)}`,
       ], undefined, () => "NomosObjectType");
   }
-  if (contracts.length > 0 || payloadContracts.length > 0) {
+  if (contracts.length > 0 || payloadContracts.length > 0 || readContracts.length > 0) {
     lines.push("");
-    const emittedContracts: Array<LawContractNode | LawPayloadContractNode> = [...contracts, ...payloadContracts]
-      .sort((a, b) => a.entity.id.localeCompare(b.entity.id));
+    const emittedContracts: Array<LawContractNode | LawPayloadContractNode | LawReadContractNode> =
+      [...contracts, ...payloadContracts, ...readContracts]
+        .sort((a, b) => a.entity.id.localeCompare(b.entity.id));
     emitContainer(lines, "Contracts", emittedContracts, 12, (contract, indent) =>
       contract.kind === "contract"
         ? emitContract(contract, fields, pathById, resolveDependency, indent)
-        : emitPayloadContract(contract, anonymousFields, anonymousTypeById, pathById, indent));
+        : contract.kind === "payload-contract"
+        ? emitPayloadContract(contract, anonymousFields, anonymousTypeById, pathById, indent)
+        : emitReadContract(contract, pathById, indent));
   }
   if (relations.length > 0) {
     lines.push("");
@@ -654,7 +694,7 @@ export function compileSparseLawGraphUsda(
   if (reads.length > 0) {
     lines.push("");
     emitContainer(lines, "Reads", reads, 12, (read, indent) =>
-      emitRead(read, readContracts, readPredicates, pathById, indent));
+      emitRead(read, readContracts, readPredicates, anonymousTypeById, pathById, indent));
   }
   if (policies.length > 0) {
     lines.push("");
@@ -683,7 +723,7 @@ export function compileSparseLawGraphUsda(
       (flow) => `w_${flow.entity.sid}`);
   }
   lines.push("        }", "    }", "}", "");
-  return { text: lines.join("\n"), paths: new Map(pathById) };
+  return { text: lines.join("\n"), paths: new Map(pathById), resolveDependency };
 }
 
 /** First W4.4 vertical slice: render domain, aggregate, stored-field and reusable-contract opinions. */
@@ -769,7 +809,7 @@ function emitPolicy(
     if (policy.keyHashes.length > 0) {
       body.push(`${pad}custom uniform string[] nomos:keyHashes = ${stringList(policy.keyHashes)}`);
     }
-  } else {
+  } else if (policy.policyKind === "source-set") {
     body.push(
       `${pad}custom rel nomos:allowList = <${requiredPath(policy.allowList.id, paths)}>`,
       `${pad}custom rel nomos:genesisField = <${requiredPath(policy.genesisField.id, paths)}>`,
@@ -793,6 +833,9 @@ function emitInvariant(
       ? [`${pad}custom uniform token nomos:evaluator = ${quote(invariant.evaluator)}`]
       : []),
   ];
+  if (invariant.invariantKind === "workspace" && invariant.refusalType !== undefined) {
+    body.push(`${pad}custom rel nomos:refusalType = <${requiredPath(invariant.refusalType.id, paths)}>`);
+  }
   if (invariant.invariantKind === "workspace" && invariant.reads !== undefined) {
     body.push(`${pad}custom uniform token nomos:readEvaluator = "point-v1"`);
     for (const [index, read] of invariant.reads.entries()) {
@@ -916,6 +959,12 @@ function emitCapability(
     ...(capability.endpoint === undefined
       ? []
       : [`${pad}custom uniform asset nomos:endpoint = @${capability.endpoint.replaceAll("@", "@@")}@`]),
+    ...(capability.executionPlacement === undefined
+      ? []
+      : [`${pad}custom uniform token nomos:executionPlacement = ${quote(capability.executionPlacement)}`]),
+    ...(capability.executionCardinality === undefined
+      ? []
+      : [`${pad}custom uniform token nomos:executionCardinality = ${quote(capability.executionCardinality)}`]),
     `${pad}custom rel nomos:aggregate = <${requiredPath(capability.task.id, paths)}>`,
     `${pad}custom rel nomos:obligation = <${requiredPath(capability.obligation.id, paths)}>`,
     `${pad}custom rel nomos:complete = <${requiredPath(capability.complete.id, paths)}>`,
@@ -989,18 +1038,38 @@ function emitIntent(
     ...(intent.acceptsVerifiedBirthParentRecovery
       ? [`${pad}custom uniform token nomos:workspaceEffectAdmission = "VerifiedBirthParentRecovery"`]
       : []),
-    ...(intent.offerAuthenticationProof === "enrolledDevice"
+    ...(intent.acceptsVerifiedWorkspaceClaim
+      ? [`${pad}custom uniform token nomos:workspaceEffectAdmission = "VerifiedWorkspaceClaim"`]
+      : []),
+    ...(intent.authentication?.kind === MemberAuthenticationKind.EnrolledDevice
       ? [`${pad}custom uniform token nomos:offerAuthenticationProof = "EnrolledDevice"`]
       : []),
+    ...(intent.authentication?.kind === MemberAuthenticationKind.SelectedProvider
+      ? authenticationProviderOpinions(intent.authentication.provider, pad)
+      : []),
+    // D22 sovereign self-certification: the kernel admits this intent's founding signer tuple iff the
+    // signing key's sha256 is the captured principal's subject (and the payload's keyHash).
+    ...(intent.selfCertifyingPrincipal === true
+      ? [`${pad}custom uniform token nomos:selfCertifyingPrincipal = "true"`]
+      : []),
     `${pad}custom rel nomos:target = ${targets([intent.target], paths, resolveDependency)}`,
     `${pad}custom rel nomos:accepts = <${requiredPath(intent.accepts.id, paths)}>`,
     ...(intent.publicAccepts === undefined
       ? []
       : [`${pad}custom rel nomos:publicAccepts = <${requiredPath(intent.publicAccepts.id, paths)}>`]),
   ];
+  if ((intent.domainRefusals?.length ?? 0) > 0) {
+    body.push(`${pad}custom rel nomos:refusalTypes = [${intent.domainRefusals!.map(type => `<${requiredPath(type.id, paths)}>`).join(", ")}]`);
+  }
   if (intent.reads.length > 0) {
     body.push(`${pad}custom rel nomos:reads = ${targets(intent.reads, paths, resolveDependency)}`);
   }
+  // A composed business intent executes its steps, so it depends on their whole law. The edge
+  // is declared here rather than rediscovered by any consumer of the emitted law.
+  if (intent.steps.length > 0) {
+    body.push(`${pad}custom rel nomos:steps = ${relList(intent.steps
+      .map((step) => `<${requiredPath(step.id, paths)}>`))}`);
+  }
   if ((intent.directsWorkspaceEffects ?? []).length > 0) {
     body.push(
       `${pad}custom rel nomos:directsWorkspaceEffect = ${targets(intent.directsWorkspaceEffects, paths, resolveDependency)}`,
@@ -1017,6 +1086,11 @@ function emitIntent(
         `${pad}custom rel nomos:requiresObjectIdField = <${requiredPath(intent.authorization.objectFrom.idField.id, paths)}>`,
       );
     }
+    if (intent.authorization.subjectFromAttestedRead !== undefined) {
+      body.push(
+        `${pad}custom uniform token nomos:requiresSubjectFromAttestedRead = ${quote(intent.authorization.subjectFromAttestedRead)}`,
+      );
+    }
   }
   if (intent.requiresHostCapabilities.length > 0) {
     body.push(
@@ -1033,6 +1107,12 @@ function emitIntent(
       `${pad}custom uniform string nomos:birthPrefix = ${quote(intent.birthPrefix ?? "")}`,
     );
   }
+  if (intent.birthDelegations !== undefined) {
+    body.push(
+      `${pad}custom rel nomos:birthDelegations = <${requiredPath(intent.birthDelegations.id, paths)}>`,
+      `${pad}custom uniform string nomos:birthDelegationPrefix = ${quote(intent.birthDelegationPrefix ?? "")}`,
+    );
+  }
   if (intent.birthPolicySeed !== undefined) {
     body.push(
       `${pad}custom rel nomos:birthPolicySeed = <${requiredPath(intent.birthPolicySeed.id, paths)}>`,
@@ -1166,6 +1246,7 @@ function emitRead(
   read: LawReadNode,
   contracts: readonly LawReadContractNode[],
   predicates: readonly LawPredicateNode[],
+  types: ReadonlyMap<string, LawAnonymousValueTypeNode>,
   paths: ReadonlyMap<string, string>,
   indent: number,
 ): string[] {
@@ -1181,13 +1262,25 @@ function emitRead(
     `${pad}custom uniform bool nomos:public = ${read.public ?? false}`,
     `${pad}custom rel nomos:of = <${requiredPath(read.of.id, paths)}>`,
     `${pad}custom rel nomos:returns = <${requiredPath(returns, paths)}>`,
+    `${pad}custom rel nomos:contract = <${requiredPath(contract.entity.id, paths)}>`,
+    ...(read.authentication?.kind === MemberAuthenticationKind.SelectedProvider
+      ? authenticationProviderOpinions(read.authentication.provider, pad)
+      : []),
   ];
+  if (contract.returns.kind === "scalar") {
+    let type = types.get(returns);
+    while (type?.expression.kind === "default") type = types.get(type.expression.value.id);
+    if (type?.expression.kind === "nullable") body.push(`${pad}custom uniform bool nomos:nullable = true`);
+  }
   const fieldTarget = (field: { readonly field: { readonly id: string }; readonly path: readonly { readonly id: string }[] }): string => {
     const terminal = field.path[field.path.length - 1] ?? field.field;
     return `<${requiredPath(terminal.id, paths)}>`;
   };
   switch (read.readKind) {
     case "query":
+      // Interpretation is part of law identity. Never silently change historical captured
+      // witnesses when the kernel gains rename-aware domain reads.
+      body.push(`${pad}custom uniform token nomos:capturedReadSemantics = "current-labels-v1"`);
       body.push(`${pad}custom rel nomos:key = ${relList(read.key.map(fieldTarget))}`);
       body.push(`${pad}custom uniform string[] nomos:keyPath = ${stringList(read.key.map((field) => field.authoredPath))}`);
       break;
@@ -1435,6 +1528,48 @@ function emitPayloadContract(
   return body;
 }
 
+/** A read's signature: its parameters and its result. The read names it with `nomos:contract`.
+ * Parameter value types (a spatial read's bounds union, for example) are declared nowhere else,
+ * so without this prim nothing in the emitted law would say the read depends on them. */
+function emitReadContract(
+  contract: LawReadContractNode,
+  paths: ReadonlyMap<string, string>,
+  indent: number,
+): string[] {
+  const pad = " ".repeat(indent);
+  const returns = contract.returns.kind === "rows"
+    ? contract.returns.aggregate.id
+    : contract.returns.value.id;
+  const body = [
+    ...entityLabelOpinions(contract.entity, indent),
+    `${pad}custom rel nomos:returns = <${requiredPath(returns, paths)}>`,
+  ];
+  if (contract.parameters.length > 0) {
+    body.push("", `${pad}def Scope "Parameters"`, `${pad}{`);
+    for (const [index, parameter] of contract.parameters.entries()) {
+      if (index > 0) body.push("");
+      body.push(
+        `${pad}    def Scope "Parameter_${String(index).padStart(4, "0")}"`,
+        `${pad}    {`,
+        `${pad}        custom uniform string nomos:name = ${quote(parameter.name)}`,
+      );
+      if (parameter.field !== undefined) {
+        const terminal = parameter.field.path[parameter.field.path.length - 1] ?? parameter.field.field;
+        body.push(
+          `${pad}        custom rel nomos:field = <${requiredPath(terminal.id, paths)}>`,
+          `${pad}        custom uniform string nomos:fieldPath = ${quote(parameter.field.authoredPath)}`,
+        );
+      }
+      if (parameter.value !== undefined) {
+        body.push(`${pad}        custom rel nomos:type = <${requiredPath(parameter.value.id, paths)}>`);
+      }
+      body.push(`${pad}    }`);
+    }
+    body.push(`${pad}}`);
+  }
+  return body;
+}
+
 function emitType(
   type: LawTypeNode,
   fields: readonly LawFieldNode[],
@@ -1619,6 +1754,7 @@ function emitAnonymousType(
           body.push(
             `${pad}    def Scope "v_${variant.entity.sid}"`,
             `${pad}    {`,
+            `${pad}        custom uniform string nomos:label = ${quote(variant.label ?? variant.entity.label)}`,
             `${pad}        custom rel nomos:type = <${requiredPath(variant.value.id, paths)}>`,
             `${pad}    }`,
           );
@@ -1652,6 +1788,11 @@ function emitAnonymousValueSemantic(
     case "unit":
     case "value-object":
       body.push(`${pad}custom uniform string nomos:semanticName = ${quote(semantic.name)}`);
+      if (semantic.kind === "value-object" && semantic.geometry !== undefined) {
+        // Geometry remains an ordinary typed record in custody. Its explicit
+        // RFC 7946 meaning permits the operation boundary to pack coordinates.
+        body.push(`${pad}custom uniform token nomos:geometry = ${quote(semantic.geometry)}`);
+      }
       break;
     case "recipient":
       body.push(`${pad}custom uniform token nomos:subject = ${quote(semantic.subject)}`);
@@ -1687,6 +1828,11 @@ function emitAnonymousField(
     `${pad}def Scope "f_${field.entity.sid}"`,
     `${pad}{`,
     `${pad}    custom uniform string nomos:label = ${quote(field.name)}`,
+    `${pad}    custom uniform string nomos:wireKey = ${quote(field.entity.wireKey ?? field.entity.sid)}`,
+    ...(field.entity.wireAliases === undefined || field.entity.wireAliases.length === 0
+      ? []
+      : [`${pad}    custom uniform string[] nomos:wireAliases = ${stringList(field.entity.wireAliases)}`]),
+    `${pad}    custom uniform string nomos:schemaIdentity = ${quote(field.entity.sid)}`,
     `${pad}    custom uniform bool nomos:required = ${field.required}`,
     `${pad}    custom rel nomos:type = <${requiredPath(field.value.id, paths)}>`,
   ];
@@ -1847,9 +1993,9 @@ function emitField(
   if (field.nullable) body.push(`${pad}    custom uniform bool nomos:nullable = true`);
   if (field.encrypted) body.push(`${pad}    custom uniform bool nomos:encrypted = true`);
   if (field.blindIndexed) body.push(`${pad}    custom uniform bool nomos:blindIndexed = true`);
-  if (field.refTarget === undefined) {
-    body.push(`${pad}    custom rel nomos:type = <${requiredPath(field.value.id, paths)}>`);
-  }
+  // Shape and reference target are independent. Atomic workspace/type/id addresses and
+  // versioned references retain their structural type just like every other value object.
+  body.push(`${pad}    custom rel nomos:type = <${requiredPath(field.value.id, paths)}>`);
   if (field.refTarget !== undefined) {
     body.push(`${pad}    custom rel nomos:refTarget = ${targets([field.refTarget], paths, resolveDependency)}`);
     body.push(`${pad}    custom uniform token nomos:referenceMode = ${quote(field.referenceMode ?? "current")}`);

package/src/law_identity.ts

@@ -18,6 +18,7 @@ export const LAW_ENTITY_KINDS = [
   "flow",
   "workspace-type",
   "contract",
+  "operation-field",
   "type",
   "object-type",
 ] as const;
@@ -25,6 +26,19 @@ export const LAW_ENTITY_KINDS = [
 export type LawEntityKind = (typeof LAW_ENTITY_KINDS)[number];
 export type LawIdentityStatus = "active" | "retired";
 
+/**
+ * Durable transport allocation for one named operation field.
+ *
+ * These are wire keys, not identities. `canonical` is used by newly generated
+ * clients; aliases remain decodable during an explicitly managed overlap window.
+ */
+export interface LawOperationFieldWire {
+  readonly protobuf: {
+    readonly canonical: string;
+    readonly aliases?: readonly string[];
+  };
+}
+
 export interface LawIdentityEntity {
   readonly kind: LawEntityKind;
   readonly sid: string;
@@ -34,6 +48,8 @@ export interface LawIdentityEntity {
   readonly priorLabels?: readonly string[];
   readonly generation: number;
   readonly status: LawIdentityStatus;
+  /** Present only on an operation-field ledger row. The row's label + lineage carry meaning. */
+  readonly operationFieldWire?: LawOperationFieldWire;
 }
 
 export interface LawIdentityRegistry {
@@ -54,6 +70,8 @@ export interface ReconcileLawIdentityScopeInput {
   readonly carries?: readonly LawIdentityCarry[];
   /** Used only while importing an existing compiler-minted identity byte-for-byte. */
   readonly preferredSids?: Readonly<Record<string, string>>;
+  /** First-appearance transport allocations for named operation fields. */
+  readonly preferredOperationFieldWire?: Readonly<Record<string, LawOperationFieldWire>>;
   /**
    * Defaults to true. Set false only when this compile sees a non-exhaustive slice of
    * a shared scope (currently project-root domains and framework declarations).
@@ -95,6 +113,7 @@ const KIND_PREFIX: Readonly<Record<LawEntityKind, string>> = {
   flow: "w",
   "workspace-type": "x",
   contract: "c",
+  "operation-field": "u",
   type: "t",
   "object-type": "o",
 };
@@ -191,97 +210,105 @@ export function createLawIdentityReconciler(
       const carriedTo = new Set<string>();
 
       for (const carry of [...(input.carries ?? [])].sort((a, b) => compareText(a.to, b.to))) {
-    if (carry.from === carry.to) {
-      throw new Error(`NMS-ID-004 identity carry '${carry.from}' -> '${carry.to}' is not a rename`);
-    }
-    if (carriedFrom.has(carry.from) || carriedTo.has(carry.to)) {
-      throw new Error(`NMS-ID-004 duplicate identity carry involving '${carry.from}' or '${carry.to}'`);
-    }
-    const key = activeByLabel.get(carry.from);
-    if (key === undefined) {
-      throw new Error(
-        `NMS-ID-004 cannot carry missing active ${input.kind} '${carry.from}' in ${scopeName(input.parent)}`,
-      );
-    }
-    if (!requested.has(carry.to)) {
-      throw new Error(`NMS-ID-004 carry target '${carry.to}' is not a current ${input.kind} declaration`);
-    }
-    const occupied = activeByLabel.get(carry.to);
-    if (occupied !== undefined && occupied !== key) {
-      throw new Error(`NMS-ID-003 active ${input.kind} label '${carry.to}' already owns another SID`);
-    }
-    const entity = entities[key]!;
-    entities[key] = {
-      ...entity,
-      label: carry.to,
-      priorLabels: appendUnique(entity.priorLabels, carry.from),
-    };
-    activeByLabel.delete(carry.from);
-    activeByLabel.set(carry.to, key);
-    carriedFrom.add(carry.from);
-    carriedTo.add(carry.to);
-    carried.push({ ...carry, key });
+        if (carry.from === carry.to) {
+          throw new Error(`NMS-ID-004 identity carry '${carry.from}' -> '${carry.to}' is not a rename`);
+        }
+        if (carriedFrom.has(carry.from) || carriedTo.has(carry.to)) {
+          throw new Error(`NMS-ID-004 duplicate identity carry involving '${carry.from}' or '${carry.to}'`);
+        }
+        const key = activeByLabel.get(carry.from);
+        if (key === undefined) {
+          throw new Error(
+            `NMS-ID-004 cannot carry missing active ${input.kind} '${carry.from}' in ${scopeName(input.parent)}`,
+          );
+        }
+        if (!requested.has(carry.to)) {
+          throw new Error(`NMS-ID-004 carry target '${carry.to}' is not a current ${input.kind} declaration`);
+        }
+        const occupied = activeByLabel.get(carry.to);
+        if (occupied !== undefined && occupied !== key) {
+          throw new Error(`NMS-ID-003 active ${input.kind} label '${carry.to}' already owns another SID`);
+        }
+        const entity = entities[key]!;
+        entities[key] = {
+          ...entity,
+          label: carry.to,
+          priorLabels: appendUnique(entity.priorLabels, carry.from),
+        };
+        activeByLabel.delete(carry.from);
+        activeByLabel.set(carry.to, key);
+        carriedFrom.add(carry.from);
+        carriedTo.add(carry.to);
+        carried.push({ ...carry, key });
       }
 
       const resolved: Record<string, string> = {};
       const allocated: { label: string; key: string; generation: number }[] = [];
       for (const label of labels) {
-    const existing = activeByLabel.get(label);
-    if (existing !== undefined) {
-      resolved[label] = existing;
-      continue;
-    }
-
-    const historic = Object.values(entities).filter(
-      (entity) =>
-        entity.kind === input.kind &&
-        entity.parent === input.parent &&
-        (entity.label === label || entity.priorLabels?.includes(label) === true),
-    );
-    const generation = historic.reduce((max, entity) => Math.max(max, entity.generation), -1) + 1;
-    const preferredSid = generation === 0 ? input.preferredSids?.[label] : undefined;
-    // A compatibility proposal may repeat a deterministic legacy SID whose former
-    // owner is now a tombstone (most visibly a field beneath a recreated aggregate).
-    // That is evidence to allocate afresh, never authority to reuse the old identity.
-    const preferredKey = preferredSid === undefined ? undefined : lawEntityKey(input.kind, preferredSid);
-    const preferredAvailable =
-      preferredSid !== undefined && preferredKey !== undefined && entities[preferredKey] === undefined;
-    const sid =
-      preferredAvailable
-        ? preferredSid
-        : mintStableId(
-            `law-entity:${input.kind}:${input.parent ?? "@root"}:${label}:generation:${generation}`,
+        const existing = activeByLabel.get(label);
+        if (existing !== undefined) {
+          const preferredWire = input.preferredOperationFieldWire?.[label];
+          if (preferredWire !== undefined && entities[existing]!.operationFieldWire === undefined) {
+            entities[existing] = { ...entities[existing]!, operationFieldWire: preferredWire };
+          }
+          resolved[label] = existing;
+          continue;
+        }
+
+        const historic = Object.values(entities).filter(
+          (entity) =>
+            entity.kind === input.kind &&
+            entity.parent === input.parent &&
+            (entity.label === label || entity.priorLabels?.includes(label) === true),
+        );
+        const generation = historic.reduce((max, entity) => Math.max(max, entity.generation), -1) + 1;
+        const preferredSid = generation === 0 ? input.preferredSids?.[label] : undefined;
+        // A compatibility proposal may repeat a deterministic legacy SID whose former
+        // owner is now a tombstone (most visibly a field beneath a recreated aggregate).
+        // That is evidence to allocate afresh, never authority to reuse the old identity.
+        const preferredKey = preferredSid === undefined
+          ? undefined
+          : lawEntityKey(input.kind, preferredSid);
+        const preferredAvailable =
+          preferredSid !== undefined && preferredKey !== undefined && entities[preferredKey] === undefined;
+        const sid = preferredAvailable
+          ? preferredSid
+          : mintStableId(
+              `law-entity:${input.kind}:${input.parent ?? "@root"}:${label}:generation:${generation}`,
+            );
+        const key = lawEntityKey(input.kind, sid);
+        if (entities[key] !== undefined) {
+          throw new Error(
+            `NMS-ID-002 SID collision: ${key} is already ${describeEntity(entities[key]!)}`,
           );
-    const key = lawEntityKey(input.kind, sid);
-    if (entities[key] !== undefined) {
-      throw new Error(
-        `NMS-ID-002 SID collision: ${key} is already ${describeEntity(entities[key]!)}`,
-      );
-    }
-    entities[key] = {
-      kind: input.kind,
-      sid,
-      ...(input.parent === undefined ? {} : { parent: input.parent }),
-      label,
-      generation,
-      status: "active",
-    };
-    activeByLabel.set(label, key);
-    resolved[label] = key;
-    allocated.push({ label, key, generation });
+        }
+        entities[key] = {
+          kind: input.kind,
+          sid,
+          ...(input.parent === undefined ? {} : { parent: input.parent }),
+          label,
+          generation,
+          status: "active",
+          ...(input.preferredOperationFieldWire?.[label] === undefined
+            ? {}
+            : { operationFieldWire: input.preferredOperationFieldWire[label] }),
+        };
+        activeByLabel.set(label, key);
+        resolved[label] = key;
+        allocated.push({ label, key, generation });
       }
 
       const retired: string[] = [];
       if (input.retireAbsent !== false) {
-    for (const [key, entity] of scopeEntries) {
-      if (carriedFrom.has(entity.label)) continue;
-      if (requested.has(entity.label)) continue;
-      if (entities[key]?.status === "active") {
-        entities[key] = { ...entities[key]!, status: "retired" };
-        retired.push(key);
-        retireDescendants(entities, key, retired);
-      }
-    }
+        for (const [key, entity] of scopeEntries) {
+          if (carriedFrom.has(entity.label)) continue;
+          if (requested.has(entity.label)) continue;
+          if (entities[key]?.status === "active") {
+            entities[key] = { ...entities[key]!, status: "retired" };
+            retired.push(key);
+            retireDescendants(entities, key, retired);
+          }
+        }
       }
 
       return {
@@ -320,6 +347,17 @@ export function validateLawIdentityRegistry(registry: LawIdentityRegistry): void
     if (entity.status !== "active" && entity.status !== "retired") {
       throw new Error(`NMS-ID-001 ${key} has invalid status`);
     }
+    if (entity.operationFieldWire !== undefined) {
+      if (entity.kind !== "operation-field") {
+        throw new Error(`NMS-ID-001 ${key} carries operation-field wire custody but is not an operation field`);
+      }
+      const keys = [
+        entity.operationFieldWire.protobuf.canonical,
+        ...(entity.operationFieldWire.protobuf.aliases ?? []),
+      ];
+      assertUniqueNonEmpty(keys, `${key} protobuf wire keys`);
+      for (const wireKey of keys) assertSid(wireKey, `${key} protobuf wire key`);
+    }
     if (entity.priorLabels !== undefined) {
       assertUniqueNonEmpty([...entity.priorLabels], `${key} prior labels`);
       if (entity.priorLabels.includes(entity.label)) {