@githolon/dsl 0.115.0 → 0.116.2

package/src/codegen_call_usda.ts

@@ -200,7 +200,8 @@ export const TS_CALL_USDA_PRELUDE = [
   `    else if (character === "\\t") out += "\\\\t";`,
   `    else if (character === "\\b") out += "\\\\b";`,
   `    else if (character === "\\f") out += "\\\\f";`,
-  `    else if (point < 0x20 || (point >= 0x7f && point <= 0x9f)) out += "\\\\u" + point.toString(16).padStart(4, "0");`,
+  `    else if (point < 0x20 || point === 0x7f) out += "\\\\x" + point.toString(16).padStart(2, "0");`,
+  `    else if (point >= 0xd800 && point <= 0xdfff) throw new TypeError("Nomos USDA strings cannot carry a lone surrogate");`,
   `    else out += character;`,
   `  }`,
   `  return out + "\\\"";`,
@@ -254,8 +255,10 @@ export const DART_CALL_USDA_PRELUDE = [
   `      case 0x08: out.write(r'\\b');`,
   `      case 0x0c: out.write(r'\\f');`,
   `      default:`,
-  `        if (point < 0x20 || (point >= 0x7f && point <= 0x9f)) {`,
-  `          out.write('\\\\u\${point.toRadixString(16).padLeft(4, '0')}');`,
+  `        if (point < 0x20 || point == 0x7f) {`,
+  `          out.write('\\\\x\${point.toRadixString(16).padLeft(2, '0')}');`,
+  `        } else if (point >= 0xd800 && point <= 0xdfff) {`,
+  `          throw ArgumentError.value(value, 'value', 'Nomos USDA strings cannot carry a lone surrogate');`,
   `        } else {`,
   `          out.write(String.fromCharCode(point));`,
   `        }`,

package/src/codegen_dart.ts

@@ -2133,54 +2133,16 @@ function voToJsonExpr(f: ValueObjectFieldDescriptor, expr: string, depth = 0): s
   }
 }
 
-/** Deep json equality/hash helpers shared by every generated VO class — emitted ONCE
- * per file when the file emits ≥1 VO class (`toJson()`-based value equality). */
-function emitVoHelpers(includeCopyWithSentinel: boolean): string {
+/** File-level helpers for generated VO classes — the copyWith absent-vs-null sentinel, emitted ONCE
+ * per file when a VO class needs it. Value equality is NOT emitted here: every VO's `==` / `hashCode`
+ * call `NmsInternalValueIdentity` (nomos_types), the Dart implementation of the law's
+ * `nomos.vo-canonical.v1` encoding (CAP-853) — one definition across runtimes. */
+function emitVoHelpers(): string {
   return [
-    ...(includeCopyWithSentinel
-      ? [
-          `/// The copyWith ABSENT-vs-null sentinel: an omitted optional param keeps the current`,
-          `/// value; an explicit \`null\` clears it. (Dart cannot distinguish the two otherwise.)`,
-          `const Object _voUnset = Object();`,
-          ``,
-        ]
-      : []),
-    `/// Deep json equality for generated value-object classes (toJson-based).`,
-    `bool _voJsonEq(Object? a, Object? b) {`,
-    `  if (a is Map && b is Map) {`,
-    `    if (a.length != b.length) {`,
-    `      return false;`,
-    `    }`,
-    `    for (final k in a.keys) {`,
-    `      if (!b.containsKey(k) || !_voJsonEq(a[k], b[k])) {`,
-    `        return false;`,
-    `      }`,
-    `    }`,
-    `    return true;`,
-    `  }`,
-    `  if (a is List && b is List) {`,
-    `    if (a.length != b.length) {`,
-    `      return false;`,
-    `    }`,
-    `    for (var i = 0; i < a.length; i++) {`,
-    `      if (!_voJsonEq(a[i], b[i])) {`,
-    `        return false;`,
-    `      }`,
-    `    }`,
-    `    return true;`,
-    `  }`,
-    `  return a == b;`,
-    `}`,
+    `/// The copyWith ABSENT-vs-null sentinel: an omitted optional param keeps the current`,
+    `/// value; an explicit \`null\` clears it. (Dart cannot distinguish the two otherwise.)`,
+    `const Object _voUnset = Object();`,
     ``,
-    `/// Deep json hash for generated value-object classes (toJson-based).`,
-    `int _voJsonHash(Object? v) {`,
-    `  if (v is Map) {`,
-    `    return Object.hashAllUnordered(`,
-    `        v.entries.map((e) => Object.hash(e.key, _voJsonHash(e.value))));`,
-    `  }`,
-    `  if (v is List) return Object.hashAll(v.map(_voJsonHash));`,
-    `  return v.hashCode;`,
-    `}`,
   ].join("\n");
 }
 
@@ -2261,9 +2223,9 @@ function emitUnionClasses(d: ValueObjectDescriptor): string {
         `  /// A copy with [value] replaced.`,
         `  ${cls} copyWith({${arm.ref}? value}) => ${cls}(value ?? this.value);`,
         `  @override`,
-        `  bool operator ==(Object other) => other is ${cls} && _voJsonEq(other.toJson(), toJson());`,
+        `  bool operator ==(Object other) => other is ${cls} && NmsInternalValueIdentity.equals(other.toJson(), toJson());`,
         `  @override`,
-        `  int get hashCode => _voJsonHash(toJson());`,
+        `  int get hashCode => NmsInternalValueIdentity.hash(toJson());`,
         `}`,
       ].join("\n");
     }
@@ -2313,9 +2275,9 @@ function emitUnionClasses(d: ValueObjectDescriptor): string {
       ``,
       ...emitCopyWith(cls, fields.map((x) => ({ member: x.member, dartType: dartTypeOfVoField(x.f, cls, x.wireName), optional: x.optional || x.f.nullable === true }))),
       `  @override`,
-      `  bool operator ==(Object other) => other is ${cls} && _voJsonEq(other.toJson(), toJson());`,
+      `  bool operator ==(Object other) => other is ${cls} && NmsInternalValueIdentity.equals(other.toJson(), toJson());`,
       `  @override`,
-      `  int get hashCode => _voJsonHash(toJson());`,
+      `  int get hashCode => NmsInternalValueIdentity.hash(toJson());`,
       `}`,
     ].join("\n");
   });
@@ -2332,9 +2294,9 @@ function emitUnionClasses(d: ValueObjectDescriptor): string {
     `  @override`,
     `  Map<String, Object?> toJson() => raw;`,
     `  @override`,
-    `  bool operator ==(Object other) => other is ${d.name}Unknown && _voJsonEq(other.raw, raw);`,
+    `  bool operator ==(Object other) => other is ${d.name}Unknown && NmsInternalValueIdentity.equals(other.raw, raw);`,
     `  @override`,
-    `  int get hashCode => _voJsonHash(raw);`,
+    `  int get hashCode => NmsInternalValueIdentity.hash(raw);`,
     `}`,
   ].join("\n");
 
@@ -2432,10 +2394,10 @@ function emitValueObjectClass(d: ValueObjectDescriptor): string {
       ``,
       `  @override`,
       `  bool operator ==(Object other) =>`,
-      `      other is ${d.name} && _voJsonEq(other.toJson(), toJson());`,
+      `      other is ${d.name} && NmsInternalValueIdentity.equals(other.toJson(), toJson());`,
       ``,
       `  @override`,
-      `  int get hashCode => _voJsonHash(toJson());`,
+      `  int get hashCode => NmsInternalValueIdentity.hash(toJson());`,
       `}`,
     ].join("\n");
   }
@@ -2498,10 +2460,10 @@ function emitValueObjectClass(d: ValueObjectDescriptor): string {
     ``,
     `  @override`,
     `  bool operator ==(Object other) =>`,
-    `      other is ${d.name} && _voJsonEq(other.toJson(), toJson());`,
+    `      other is ${d.name} && NmsInternalValueIdentity.equals(other.toJson(), toJson());`,
     ``,
     `  @override`,
-    `  int get hashCode => _voJsonHash(toJson());`,
+    `  int get hashCode => NmsInternalValueIdentity.hash(toJson());`,
     `}`,
   ].join("\n");
 }
@@ -5242,7 +5204,7 @@ export function generateDartDomain(mod: DomainModule, opts: GenerateDartDomainOp
     ...(brandBlock !== "" ? [brandBlock] : []),
     ...(localValueObjects.length > 0
       ? [
-          emitVoHelpers(needsVoCopyWithSentinel),
+          ...(needsVoCopyWithSentinel ? [emitVoHelpers()] : []),
           ...localValueObjects.flatMap((d) => [
             ...voEnumFields(d)
               .filter((e) => e.declaredName === undefined)

package/src/codegen_result_usda.ts

@@ -45,9 +45,13 @@ export const TS_RESULT_USDA_PRELUDE = [
   `    const c = source[i]!; if (c !== "\\\\") { out += c; continue; }`,
   `    const e = source[++i]; if (e === undefined) throw new Error("truncated USDA escape");`,
   `    if (e === "n") out += "\\n"; else if (e === "r") out += "\\r"; else if (e === "t") out += "\\t";`,
-  `    else if (e === "b") out += "\\b"; else if (e === "f") out += "\\f"; else if (e === '"' || e === "\\\\") out += e;`,
-  `    else if (e === "u") { const hex = source.slice(i + 1, i + 5); if (!/^[0-9a-fA-F]{4}$/.test(hex)) throw new Error("invalid USDA unicode escape"); out += String.fromCharCode(Number.parseInt(hex, 16)); i += 4; }`,
-  `    else throw new Error("unsupported USDA escape: " + e);`,
+  // OpenUSD's escapes (TfEscapeString): named controls, \x with up to two hex digits, \NNN octal,
+  // any other escaped character is itself; plus the LEGACY \uXXXX that pre-CAP-862 kernels wrote.
+  `    else if (e === "b") out += "\\b"; else if (e === "f") out += "\\f"; else if (e === "a") out += "\\x07"; else if (e === "v") out += "\\v";`,
+  `    else if (e === "x") { const hex = /^[0-9a-fA-F]{0,2}/.exec(source.slice(i + 1, source.length - 1))![0]; out += String.fromCharCode(hex ? Number.parseInt(hex, 16) : 0); i += hex.length; }`,
+  `    else if (e >= "0" && e <= "7") { const oct = /^[0-7]{1,3}/.exec(source.slice(i, source.length - 1))![0]; out += String.fromCharCode(Number.parseInt(oct, 8)); i += oct.length - 1; }`,
+  `    else if (e === "u" && /^[0-9a-fA-F]{4}$/.test(source.slice(i + 1, i + 5)) && !/^d[89a-f]/i.test(source.slice(i + 1, i + 5))) { out += String.fromCharCode(Number.parseInt(source.slice(i + 1, i + 5), 16)); i += 4; }`,
+  `    else out += e;`,
   `  } return out;`,
   `};`,
   `const _nmsUsdaAtom = (raw: string): string | number | boolean | readonly string[] => {`,
@@ -71,7 +75,7 @@ export const TS_RESULT_USDA_PRELUDE = [
   `    if (declaration) { pending = { typeName: declaration[1]!, name: _nmsUsdaUnquote(declaration[2]!), properties: [], children: [] }; continue; }`,
   `    if (line === "{") { if (!pending) throw new Error("USDA scope has no declaration"); const parent = stack.at(-1); if (parent) parent.children.push(pending); else roots.push(pending); stack.push(pending); pending = undefined; continue; }`,
   `    if (line === "}") { if (!stack.pop()) throw new Error("unbalanced USDA scope"); continue; }`,
-  `    const property = /^custom(?:\\s+uniform)?\\s+(?:rel|[A-Za-z0-9_\\[\\]]+)\\s+([A-Za-z0-9_:]+)\\s*=\\s*(.+)$/.exec(line);`,
+  `    const property = /^custom(?:\\s+uniform)?\\s+(?:rel|[A-Za-z0-9_\\[\\]]+)\\s+([A-Za-z0-9_:]+)\\s*=\\s*(.+)$/s.exec(line);`,
   `    if (property) { const owner = stack.at(-1); if (!owner) throw new Error("USDA property outside prim"); owner.properties.push({ name: property[1]!, value: _nmsUsdaAtom(property[2]!) }); continue; }`,
   `    throw new Error("unsupported canonical USDA line: " + line);`,
   `  }`,

package/src/compile_package_main.ts

@@ -1,5 +1,6 @@
 import { collectPackageSources, findBirthKeyWrites, formatBirthKeyWriteWarnings } from "./birth_key_rule.js";
 import type { Directive } from "./directive.js";
+import { usdaString } from "./usda_text.js";
 // NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
 // remotes are replaceable custody/transport, not truth.  ⇒ ONE Nomos GitHolon
 // wasm32-wasip1 artifact {kernel · projection · embedded
@@ -817,7 +818,7 @@ function emitLawClosure(
         return [
           `        def NomosLawAsset "${primName}"`,
           "        {",
-          `            custom string nomos:logicalPath = ${JSON.stringify(
+          `            custom string nomos:logicalPath = ${usdaString(
             asset.logicalPath
           )}`,
           `            custom string nomos:sha256 = "${asset.sha256}"`,
@@ -2555,6 +2556,11 @@ const dartTypesImportFor = (generatedSource: string): string => {
           `import 'package:nomos_types/src/foreign_ref.dart' show NmsInternalForeignRefs;`,
         ]
       : []),
+    ...(generatedSource.includes("NmsInternalValueIdentity.")
+      ? [
+          `import 'package:nomos_types/src/vo_canonical.dart' show NmsInternalValueIdentity;`,
+        ]
+      : []),
   ];
   const invitationHelpers = [
     ...(generatedSource.includes("NmsInternalInvitations.")
@@ -2578,12 +2584,12 @@ const dartTypesImportFor = (generatedSource: string): string => {
  *  just the floor generated code needs — a lagging pin forces tenants into dependency_overrides. */
 // 0.3.0: SurfacedValue<T>/SurfacedObservation/PendingConflictRow — generated Surfaced-field typing +
 //        the pendingConflicts read rows.
-const NOMOS_TYPES_DEP = "^0.14.0";
+const NOMOS_TYPES_DEP = "^0.15.0";
 // 0.48.x: session-bound clients (XClient.bind/NomosClientInterface/DomainClientSessionMismatch/
 //         DomainNotInstalledForSession, engine.follow, pendingConflicts lanes) — the generated client
 //         REQUIRES this surface. 0.48.1 fixes NomosSession.watchPendingConflicts delegation.
-const NOMOS_CLIENT_DEP = "^0.69.0";
-const NOMOS_FLUTTER_DEP = "^0.68.0";
+const NOMOS_CLIENT_DEP = "^0.70.1";
+const NOMOS_FLUTTER_DEP = "^0.68.2";
 // DRIFT TRIPWIRE: pubspec_pins.test.ts asserts these equal the CURRENT versions in the Dart and Flutter
 // package pubspecs — a release without this bump fails the suite, so tenants never
 // land back in dependency_overrides (the exact co2 report this closes, third occurrence).
@@ -3406,6 +3412,7 @@ function emitDartPackages(
         m[1] !== "package:nomos_types/src/versioned_nomos_ref.dart" &&
         m[1] !== "package:nomos_types/src/foreign_ref.dart" &&
         m[1] !== "package:nomos_types/src/invitation.dart" &&
+        m[1] !== "package:nomos_types/src/vo_canonical.dart" &&
         m[1] !== `${FRAMEWORK_FILE}.dart` &&
         !siblingTypeFiles.has(m[1]!)
       ) {

package/src/engine_entry.ts

@@ -93,7 +93,8 @@ import {
   assertApplicationLanguageCoversAuthoredDirectives,
   executableDirectivesForLanguage,
   publicOfferRoute,
-  remapWorkspaceInvariantsForLanguage,
+  carryWorkspaceInvariantsToPerformingIntents,
+  isBusinessIntent,
 } from "./intent.js";
 
 /** One bundled domain module: a bag of named exports the entry scans by SHAPE. */
@@ -511,9 +512,16 @@ function buildDomainSlice(mod: DomainModuleExports, domain: string): DomainSlice
       declaredWorkspaceInvariants.push(w);
     }
   }
-  for (const w of applicationLanguage === undefined
-    ? declaredWorkspaceInvariants
-    : remapWorkspaceInvariantsForLanguage(declaredWorkspaceInvariants, applicationLanguage)) {
+  // CAP-863: the SAME carry rule package composition applies, with the same keep-the-original predicate —
+  // an effect's invariant is registered for every routable intent that performs it, every original is kept
+  // without a language, and a language keeps an original only while its target is still dispatchable. The
+  // registered set feeds the routing table, so it must equal the manifest's set: an extra body would emit a
+  // dead invariant route into language law, a missing one would fail closed at dispatch.
+  for (const w of carryWorkspaceInvariantsToPerformingIntents(
+    declaredWorkspaceInvariants,
+    [...dirs.values()].filter(isBusinessIntent),
+    (directiveId) => applicationLanguage === undefined || dirs.has(directiveId),
+  )) {
     wsInvariants.set(w.id, w);
   }
   // ── DESUGARED write-path preconditions (`.requiresExisting`/`.creates(Agg,idFn)`/`.where`) ──

package/src/identity_usda.ts

@@ -12,6 +12,7 @@
 // NO JSON, INCLUDING FOR OPAQUE DESCRIPTORS. A field's canonical value `shape` and merge `driver`
 // are compiler-derived structured values. They are written here through the generic typed-USDA value
 // codec below rather than stringified, so this file has no JSON in it at any depth.
+import { usdaString, usdaUnquote } from "./usda_text.js";
 import {
   emptyLawIdentityRegistry,
   lawEntityKeyParts,
@@ -28,58 +29,8 @@ export const NOMOS_IDENTITY_LAYER_FORMAT = "nomos.identity.v1";
 /** The committed identity layer's filename, beside the package config. */
 export const NOMOS_IDENTITY_FILENAME = "nomos.identity.usda";
 
-function quote(value: string): string {
-  return `"${value.replace(/[\\"\u0000-\u001f]/gu, (character) => {
-    switch (character) {
-      case "\\": return "\\\\";
-      case '"': return '\\"';
-      case "\n": return "\\n";
-      case "\r": return "\\r";
-      case "\t": return "\\t";
-      case "\b": return "\\b";
-      case "\f": return "\\f";
-      default: return `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`;
-    }
-  })}"`;
-}
-
-function parseQuoted(raw: string): string {
-  const value = raw.trim();
-  if (!value.startsWith('"') || !value.endsWith('"')) {
-    throw new Error(`expected a quoted USDA string, got ${value}`);
-  }
-  let out = "";
-  for (let index = 1; index < value.length - 1; index += 1) {
-    const character = value[index]!;
-    if (character !== "\\") {
-      out += character;
-      continue;
-    }
-    index += 1;
-    const escaped = value[index];
-    if (escaped === undefined || index >= value.length - 1) throw new Error("unterminated USDA escape");
-    if (escaped === "u") {
-      const digits = value.slice(index + 1, index + 5);
-      if (!/^[0-9a-fA-F]{4}$/u.test(digits)) throw new Error(`invalid USDA unicode escape \\u${digits}`);
-      out += String.fromCharCode(Number.parseInt(digits, 16));
-      index += 4;
-      continue;
-    }
-    const decoded: Record<string, string> = {
-      "\\": "\\",
-      '"': '"',
-      n: "\n",
-      r: "\r",
-      t: "\t",
-      b: "\b",
-      f: "\f",
-    };
-    const replacement = decoded[escaped];
-    if (replacement === undefined) throw new Error(`unsupported USDA escape \\${escaped}`);
-    out += replacement;
-  }
-  return out;
-}
+const quote = usdaString;
+const parseQuoted = usdaUnquote;
 
 function parseStringList(raw: string): string[] {
   const value = raw.trim();

package/src/index.ts

@@ -147,7 +147,17 @@ export {
   type GeoPolygonValue,
   type GeoMultiPointValue,
   type ValueObjectUsage,
+  valueIdentity,
 } from "./value_object.js";
+// VALUE IDENTITY (`value_identity.ts`, CAP-853): every value object's `canonical` / `equals` /
+// `digest` implement the versioned `nomos.vo-canonical.v1` encoding (RFC 8785 over the
+// descriptor-judged value); `valueIdentity(schema)` derives them for lists/maps of VOs.
+export {
+  VO_CANONICAL_ENCODING,
+  VoCanonicalError,
+  type ValueIdentity,
+  type VoCanonicalEncoding,
+} from "./value_identity.js";
 export {
   enumType,
   enumTypeNameOf,

package/src/intent.ts

@@ -1449,17 +1449,42 @@ export function assertApplicationLanguageCoversAuthoredDirectives(
 export function remapWorkspaceInvariantsForLanguage(
   invariants: readonly WorkspaceInvariantDecl[],
   language: ApplicationLanguage
+): WorkspaceInvariantDecl[] {
+  return carryWorkspaceInvariantsToPerformingIntents(
+    invariants,
+    language.intents,
+    () => false
+  );
+}
+
+/**
+ * THE ONE CARRY RULE for effect invariants (CAP-863). The kernel selects a workspace invariant by
+ * the DISPATCHED directive id (`invariant.on == directive_id`), and a business intent dispatches
+ * under its own id while planning its effects inline. An invariant declared `.on(effect)` therefore
+ * judges an intent only if it is carried onto that intent. Carry it onto EVERY routable business
+ * intent that performs the effect, whether or not the domain declares `language(...)`.
+ *
+ * The original declaration stays on the effect when nothing performs it, or when the caller says the
+ * effect id may still be dispatched (`dispatchable(effect.id)`): a public directive dispatched directly,
+ * or (without a language) a bare id another installed law may dispatch, must still be judged. A
+ * language-closed effect is private, so its original is dropped exactly as before. Package composition
+ * and the sealed engine both call this function with the same predicate, so the manifest and the
+ * executable invariant registry (and its routing table) name exactly the same invariants.
+ */
+export function carryWorkspaceInvariantsToPerformingIntents(
+  invariants: readonly WorkspaceInvariantDecl[],
+  intents: readonly BusinessIntent<any>[],
+  dispatchable: (directiveId: string) => boolean
 ): WorkspaceInvariantDecl[] {
   const out: WorkspaceInvariantDecl[] = [];
   for (const invariant of invariants) {
-    const uses = language.intents.flatMap((candidate) =>
+    const uses = intents.flatMap((candidate) =>
       candidate.steps
         .filter((step) => step.directive.id === invariant.on)
         .map((step) => ({ intent: candidate, step }))
     );
-    if (uses.length === 0) {
+    if (uses.length === 0 || dispatchable(invariant.on)) {
       out.push(invariant);
-      continue;
     }
     for (const use of uses) {
       const mapFacts = (

package/src/law_check.ts

@@ -1103,6 +1103,39 @@ function invariantFindings(mod: DomainModule, aggById: ReadonlyMap<string, Aggre
   return out;
 }
 
+// ── VALUE IDENTITY (CAP-853) — `JSON.stringify` COMPARISON WARN ──────────────────────────
+// `JSON.stringify(a) === JSON.stringify(b)` compares TEXT, and json text depends on member insertion
+// order: a value object read back from storage arrives in storage order, so the comparison calls a
+// value unequal to itself (CO2's field-publication invariant refused every round-tripped snapshot).
+// Law compares typed values with `<Vo>.equals(a, b)` (`nomos.vo-canonical.v1`). This is a source-text
+// heuristic over the law bodies Nomos runs (plans, aggregate invariants, workspace invariants), so it
+// WARNS — it cannot prove the operands are structured values.
+const JSON_STRINGIFY_COMPARISON =
+  /JSON\.stringify\s*\((?:[^()]|\((?:[^()]|\([^()]*\))*\))*\)\s*[!=]==?|[!=]==?\s*JSON\.stringify\s*\(/;
+
+function jsonStringifyComparisonFindings(mod: DomainModule): Finding[] {
+  const domain = mod.domain ?? mod.name;
+  const out: Finding[] = [];
+  const judge = (body: unknown, subject: string, directiveId?: string): void => {
+    if (typeof body !== "function") return;
+    if (!JSON_STRINGIFY_COMPARISON.test(Function.prototype.toString.call(body))) return;
+    out.push({
+      domain,
+      ...(directiveId === undefined ? {} : { directiveId }),
+      level: "warn",
+      what: `${subject} compares JSON.stringify(...) text — member order is not part of a value, so a value read back from storage can compare unequal to itself`,
+      fix: "compare typed values with <ValueObject>.equals(a, b) (or valueIdentity(schema).equals for lists/maps of them); for plain json leaves compare the fields you mean",
+    });
+  };
+  for (const dir of mod.directives as Directive<unknown>[]) judge(dir.plan, `directive '${dir.id}' plan`, dir.id);
+  for (const agg of mod.aggregates) judge(agg.invariant, `aggregate '${agg.id}' invariant`);
+  for (const wi of mod.workspaceInvariants ?? []) {
+    judge(wi.assert, `workspace invariant '${wi.id}' assert`, wi.on);
+    judge(wi.reads, `workspace invariant '${wi.id}' reads`, wi.on);
+  }
+  return out;
+}
+
 // ── TWIN 2 (slice 2) — TOP-LEVEL PORT-READ pool-eligibility WARN ───────────────────
 // A tenant MODULE whose TOP LEVEL reads the captured ports (`Date.now()`/`new Date()`/`Math.random()`
 // at module scope, not inside a plan) makes the built engine lump PRISTINE-POOL-INELIGIBLE
@@ -1359,6 +1392,7 @@ export function checkDomainModules(
     findings.push(...nullBanFindings(mod, aggById));
     findings.push(...nullClearAuthorityFindings(mod, aggById));
     findings.push(...attestedReadFindings(mod));
+    findings.push(...jsonStringifyComparisonFindings(mod));
   }
 
   // The BIRTH-RECIPE twin (unify): fold the scattered `.births()` recipe diagnostics into the

package/src/law_graph_usda.ts

@@ -1,3 +1,4 @@
+import { usdaString } from "./usda_text.js";
 import type {
   LawAggregateNode,
   LawAnonymousValueFieldNode,
@@ -1946,9 +1947,7 @@ function requiredPath(id: string, paths: ReadonlyMap<string, string>): string {
   return path;
 }
 
-function quote(value: string): string {
-  return JSON.stringify(value);
-}
+const quote = usdaString;
 
 function fail(message: string): never {
   throw new Error(`NMS-USDA-001 ${message}`);

package/src/law_layer_prims.ts

@@ -10,6 +10,7 @@
 // subset and throws on anything else. Law layers carry relationships, dictionaries and typed
 // literals that layer never contains, so the baseline export needs a reader that keeps going past
 // opinions it does not understand instead of refusing a whole released layer over one of them.
+import { usdaUnquote } from "./usda_text.js";
 
 export interface UsdaPrim {
   /** The prim's name, unquoted. */
@@ -29,35 +30,9 @@ const PRIM_OPEN = /^\s*(?:def|over|class)\b(?:\s+([A-Za-z_][A-Za-z0-9_]*))?\s+"(
 const REL = /^\s*(?:custom\s+)?(?:uniform\s+)?rel\s+nomos:([A-Za-z0-9_]+)\s*=\s*(.+?)\s*$/;
 const ATTR = /^\s*(?:custom\s+)?(?:uniform\s+)?[A-Za-z0-9_]+(?:\[\])?\s+nomos:([A-Za-z0-9_]+)\s*=\s*(.+?)\s*$/;
 
-/** Decode a USDA quoted string literal (the escapes the compiler writes). */
+/** Decode a USDA quoted string literal with OpenUSD's escape rules (and legacy `\uXXXX`). */
 export function unquoteUsda(raw: string): string {
-  const value = raw.trim();
-  if (!value.startsWith('"') || !value.endsWith('"') || value.length < 2) {
-    throw new Error(`expected a quoted USDA string, got ${value}`);
-  }
-  let out = "";
-  for (let index = 1; index < value.length - 1; index += 1) {
-    const character = value[index]!;
-    if (character !== "\\") {
-      out += character;
-      continue;
-    }
-    index += 1;
-    const escaped = value[index];
-    if (escaped === undefined) throw new Error("unterminated USDA escape");
-    if (escaped === "u") {
-      const digits = value.slice(index + 1, index + 5);
-      if (!/^[0-9a-fA-F]{4}$/u.test(digits)) throw new Error(`invalid USDA unicode escape \\u${digits}`);
-      out += String.fromCharCode(Number.parseInt(digits, 16));
-      index += 4;
-      continue;
-    }
-    const decoded: Record<string, string> = { "\\": "\\", '"': '"', n: "\n", r: "\r", t: "\t", b: "\b", f: "\f" };
-    const replacement = decoded[escaped];
-    if (replacement === undefined) throw new Error(`unsupported USDA escape \\${escaped}`);
-    out += replacement;
-  }
-  return out;
+  return usdaUnquote(raw);
 }
 
 /** Decode a one-line USDA string array literal `["a", "b"]`. */

package/src/law_units.ts

@@ -10,6 +10,7 @@
 // (kernel/src/law_units.rs) makes from the same package, so both hash identically. The format is
 // specified in architecture/law_units_format.md.
 
+import { usdaString, usdaUnquote } from "./usda_text.js";
 import { createHash } from "node:crypto";
 
 /** One authenticated file of a law closure, at its package logical path. */
@@ -136,7 +137,7 @@ export function scanDomainDeclarations(usda: string): DomainDeclarations {
     if (frames.includes(null)) continue;
     const at = frames as string[];
     if (at.length !== 5 || at[0] !== "Nomos" || at[1] !== "Domains") continue;
-    const value = JSON.parse(property[2]!) as string;
+    const value = usdaUnquote(property[2]!);
     if (at[3] === "Aggregates") {
       (property[1] === "wireType" ? aggregateWireTypes : aggregateLabels).add(value);
     } else if (at[3] === "Invariants" && property[1] === "label") {
@@ -213,7 +214,7 @@ export function packageRoutesLayerUsda(routes: readonly LawUnitRoute[]): string
       routeOpinions.push(
         `        def Scope "r${String(index).padStart(6, "0")}"`,
         "        {",
-        `            custom string nomos:selector = ${JSON.stringify(
+        `            custom string nomos:selector = ${usdaString(
           route.selector
         )}`,
         `            custom string nomos:plan = "${route.planSha256}"`,
@@ -268,11 +269,11 @@ export function unitManifestUsda(unit: Omit<LawUnit, "manifest">): string {
     "",
     'def NomosLawUnit "__NomosLawUnit_7e9c"',
     "{",
-    `    custom string nomos:unit = ${JSON.stringify(unit.key)}`,
+    `    custom string nomos:unit = ${usdaString(unit.key)}`,
     `    custom token nomos:unitKind = "${unit.kind}"`,
     ...(unit.domain === undefined
       ? []
-      : [`    custom string nomos:domain = ${JSON.stringify(unit.domain)}`]),
+      : [`    custom string nomos:domain = ${usdaString(unit.domain)}`]),
     `    custom string nomos:unitHash = "${unit.hash}"`,
     "",
     '    def Scope "Assets"',
@@ -280,7 +281,7 @@ export function unitManifestUsda(unit: Omit<LawUnit, "manifest">): string {
     ...unit.assets.flatMap((asset) => [
       `        def NomosLawAsset "a_${sha256Hex(asset.logicalPath)}"`,
       "        {",
-      `            custom string nomos:logicalPath = ${JSON.stringify(asset.logicalPath)}`,
+      `            custom string nomos:logicalPath = ${usdaString(asset.logicalPath)}`,
       `            custom string nomos:sha256 = "${asset.sha256}"`,
       "        }",
     ]),
@@ -291,7 +292,7 @@ export function unitManifestUsda(unit: Omit<LawUnit, "manifest">): string {
     ...unit.routes.flatMap((route) => [
       `        def NomosLawRoute "s_${sha256Hex(route.selector)}"`,
       "        {",
-      `            custom string nomos:selector = ${JSON.stringify(route.selector)}`,
+      `            custom string nomos:selector = ${usdaString(route.selector)}`,
       `            custom string nomos:plan = "${route.planSha256}"`,
       "        }",
     ]),

package/src/law_version.ts

@@ -15,6 +15,7 @@
 // Grammar: semver 2.0 MAJOR.MINOR.PATCH with an optional pre-release, no build metadata (build metadata does not
 // order versions, so it could only make two different laws claim the same place). Dependency-free so the compiler,
 // CLI, console and Peer Office share one comparison; the kernel's twin is `law_version` (kernel/src/law_version.rs).
+import { usdaUnquote } from "./usda_text.js";
 
 /** A validated claim, as authored: typed, never a bare string. Only `lawVersionClaim` and the readers here mint one. */
 export type LawVersionClaim = string & { readonly __nomosLawVersionClaim: unique symbol };
@@ -103,5 +104,5 @@ export function compareLawVersions(left: LawVersionClaim, right: LawVersionClaim
 export function claimedVersionOfPackageContract(packageUsda: string): LawVersionClaim | undefined {
   const match = /^\s*custom uniform string nomos:version = ("(?:[^"\\]|\\.)*")\s*$/mu.exec(packageUsda);
   if (match === null) return undefined;
-  return lawVersionClaim(JSON.parse(match[1]!) as string);
+  return lawVersionClaim(usdaUnquote(match[1]!));
 }

package/src/point_guard.ts

@@ -2,6 +2,7 @@
 
 import type { AggregateHandle, FieldValue, StoredFields } from "./aggregate.js";
 import type { Field } from "./fields.js";
+import { canonicalJsonValue } from "./value_identity.js";
 
 export type PointGuardScalar = string | number | boolean;
 
@@ -185,7 +186,10 @@ export function evaluatePointGuard(
         ? predicate.right.value
         : valueAt(predicate.right.source === "row" ? row : payload, predicate.right.path);
       if (left === undefined || right === undefined) return predicate.operator === "ne";
-      const equal = JSON.stringify(left) === JSON.stringify(right);
+      // Value equality, not text equality: a stored row's members come back in storage order, so
+      // `JSON.stringify` would call a value unequal to itself (CAP-853). The kernel twin compares
+      // structurally too (`admission-peer` nominal_equals_json / serde_json Value equality).
+      const equal = canonicalJsonValue(left) === canonicalJsonValue(right);
       return predicate.operator === "eq" ? equal : !equal;
     }
   }

package/src/release_inspection.ts

@@ -1,4 +1,6 @@
 /** Read-only evidence, not an evolution/admission judge. No compile, mint or network calls. */
+import { usdaUnquote } from './usda_text.js';
+import { unquoteUsdaList } from './law_layer_prims.js';
 import { createHash } from 'node:crypto';
 import { lstatSync, readFileSync, readdirSync, realpathSync } from 'node:fs';
 import path from 'node:path';
@@ -12,7 +14,7 @@ const literal = '("(?:[^"\\\\]|\\\\.)*")';
 function attribute(source: string, name: string): string {
   const values = [...source.matchAll(new RegExp(`nomos:${name} = ${literal}`, 'g'))];
   if (values.length !== 1) throw new Error(`Expected one nomos:${name}`);
-  return JSON.parse(values[0]![1]!);
+  return usdaUnquote(values[0]![1]!);
 }
 function files(directory: string, root = directory): string[] {
   return readdirSync(directory).sort().flatMap(name => {
@@ -92,9 +94,9 @@ export function inspectReleaseBaseline(input: { identity: string; units: string;
       const label = /nomos:label = ("(?:[^"\\]|\\.)*")/.exec(attrs);
       const wire = /nomos:wireKey = ("(?:[^"\\]|\\.)*")/.exec(attrs);
       const aliases = /nomos:wireAliases = (\[[^\n]*\])/.exec(attrs);
-      const item = { ...(label ? { label: JSON.parse(label[1]!) as string } : {}),
-        ...(wire ? { wire: JSON.parse(wire[1]!) as string } : {}),
-        ...(aliases ? { aliases: JSON.parse(aliases[1]!) as string[] } : {}) };
+      const item = { ...(label ? { label: usdaUnquote(label[1]!) } : {}),
+        ...(wire ? { wire: usdaUnquote(wire[1]!) } : {}),
+        ...(aliases ? { aliases: unquoteUsdaList(aliases[1]!) } : {}) };
       for (const key of [match[1]!, ...(wire ? [`u_${match[2]!}`] : [])]) {
         declarations.set(key, [...(declarations.get(key) ?? []), item]);
       }