@githolon/dsl 0.115.0 → 0.116.4

package/dart/lib/src/sync_status_projection.dart

@@ -126,6 +126,14 @@ enum WorkspaceFollowPhase {
   rebornRemotely,
   replacingLocal,
   localCopyUnreadable,
+
+  /// This peer's kernel deterministically refused the last round at the same
+  /// local head and remote frontier: sync is blocked, not retrying. No timer
+  /// re-runs it; it runs again on new local work, an upstream head change, a
+  /// socket reopen or a changed kernel/runtime. [WorkspaceFollowStatus.retryAt]
+  /// is set only once such an event made it due, and
+  /// [WorkspaceFollowStatus.detail] carries the kernel's refusal.
+  kernelRefused,
   unknown,
 }
 
@@ -182,6 +190,9 @@ final class WorkspaceFollowStatus {
           nomos_protocol.FollowObservationPhase
                 .FOLLOW_OBSERVATION_PHASE_LOCAL_COPY_UNREADABLE =>
             WorkspaceFollowPhase.localCopyUnreadable,
+          nomos_protocol.FollowObservationPhase
+                .FOLLOW_OBSERVATION_PHASE_KERNEL_REFUSED =>
+            WorkspaceFollowPhase.kernelRefused,
           _ => WorkspaceFollowPhase.unknown,
         },
         live: report.live,

package/dart/pubspec.lock

@@ -222,7 +222,7 @@ packages:
       path: "../dart_types"
       relative: true
     source: path
-    version: "0.14.0"
+    version: "0.15.0"
   package_config:
     dependency: "direct main"
     description:

package/dart/pubspec.yaml

@@ -7,7 +7,7 @@ repository: https://github.com/Captain-App/nomos2
 description: >-
   Nomos 2 Dart client — generated domain values, intent payloads and application
   lifecycle types over the typed Nomos kernel protocol and USDA custody model.
-version: 0.69.0
+version: 0.70.2
 
 environment:
   sdk: ^3.5.0
@@ -18,7 +18,7 @@ dependencies:
   # The pure-data core (wire types, offer codec, NomosReads, schema validation, error
   # info). nomos_client depends on and re-exports it, so existing imports are unchanged.
   # For local monorepo dev, pubspec_overrides.yaml points this at ../dart_types.
-  nomos_types: ^0.14.0
+  nomos_types: ^0.15.0
   fixnum: ^1.1.1
   json_schema: ^5.2.2
   crypto: ^3.0.0

package/dart/test/kernel_refused_follow_test.dart

@@ -0,0 +1,36 @@
+import 'package:fixnum/fixnum.dart' as fixnum;
+import 'package:nomos_client/src/sync_status_projection.dart';
+import 'package:nomos_types/nomos_kernel_protocol.dart' as protocol;
+import 'package:test/test.dart';
+
+void main() {
+  test('a follow the kernel refused is blocked, not retrying', () {
+    final blocked =
+        WorkspaceFollowStatus.fromRuntime(protocol.FollowObservation(
+      workspace: 'estate',
+      phase: protocol
+          .FollowObservationPhase.FOLLOW_OBSERVATION_PHASE_KERNEL_REFUSED,
+      detail: 'NMS-KERNEL-CALL: refused',
+      attempt: 2,
+    ));
+    expect(blocked.phase, WorkspaceFollowPhase.kernelRefused);
+    expect(blocked.retryAt, isNull,
+        reason: 'no timer re-runs a blocked refusal');
+  });
+
+  test('an event made a refused follow due again at its re-run time', () {
+    final retryAt = DateTime.utc(2026, 10, 8, 9, 0, 10);
+    final status = WorkspaceFollowStatus.fromRuntime(protocol.FollowObservation(
+      workspace: 'estate',
+      phase: protocol
+          .FollowObservationPhase.FOLLOW_OBSERVATION_PHASE_KERNEL_REFUSED,
+      detail:
+          'NMS-KERNEL-CALL: invalid or repeated command frontier commit marker',
+      retryAtUnixMillis: fixnum.Int64(retryAt.millisecondsSinceEpoch),
+      attempt: 2,
+    ));
+    expect(status.phase, WorkspaceFollowPhase.kernelRefused);
+    expect(status.detail, startsWith('NMS-KERNEL-CALL:'));
+    expect(status.retryAt, retryAt.toLocal());
+  });
+}

package/dart/test/result_usda_test.dart

@@ -1,4 +1,5 @@
 import 'dart:convert';
+import 'dart:io';
 import 'dart:typed_data';
 
 import 'package:nomos_client/src/nms_generated_runtime.dart';
@@ -46,4 +47,70 @@ def NomosReadResult "Result"
       'Ship',
     );
   });
+
+  // CAP-862: the shared conformance vectors. Every canonical literal, and every legacy `\uXXXX`
+  // spelling an older kernel wrote, reads back as the value it names.
+  test('decodes the canonical and legacy USDA string vectors', () {
+    final vectors = jsonDecode(
+            File('../conformance/usda_string.v1.json').readAsStringSync())
+        as Map<String, dynamic>;
+    final cases = [
+      ...(vectors['encode'] as List).cast<Map<String, dynamic>>(),
+      ...(vectors['legacyDecode'] as List).cast<Map<String, dynamic>>(),
+    ];
+    expect(cases.length, greaterThan(60));
+    for (final vector in cases) {
+      final result = NmsUsdaResult.parse(
+        Uint8List.fromList(
+          utf8.encode('''#usda 1.0
+(
+    defaultPrim = "Result"
+)
+
+def NomosReadResult "Result"
+{
+    custom uniform bool nomos:done = true
+
+    def NomosListValue "Rows"
+    {
+        def NomosRecordValue "i_00000000"
+        {
+            custom uniform string nomos:id = "note:1"
+            custom rel nomos:type = </Nomos/Domains/d_1/Aggregates/a_note>
+
+            def NomosStringValue "f_title"
+            {
+                custom rel nomos:field = </Nomos/Domains/d_1/Aggregates/a_note/Fields/f_title>
+                custom uniform string nomos:value = ${vector['usda']}
+            }
+        }
+    }
+}
+'''),
+        ),
+      );
+      expect(
+        result.rows.single
+            .requiredField('/Nomos/Domains/d_1/Aggregates/a_note/Fields/f_title')
+            .stringValue(),
+        vector['value'],
+        reason: vector['name'] as String,
+      );
+    }
+  });
+
+  test('framework-call quoting writes every vector canonically', () {
+    final vectors = jsonDecode(
+            File('../conformance/usda_string.v1.json').readAsStringSync())
+        as Map<String, dynamic>;
+    for (final vector
+        in (vectors['encode'] as List).cast<Map<String, dynamic>>()) {
+      expect(NmsUsdaLayer.quote(vector['value'] as String), vector['usda'],
+          reason: vector['name'] as String);
+    }
+    for (final point in (vectors['refusedCodePoints'] as List).cast<int>()) {
+      expect(() => NmsUsdaLayer.quote('a${String.fromCharCode(point)}b'),
+          throwsArgumentError);
+    }
+  });
 }

package/dart_types/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 0.15.0
+
+- `FollowObservationPhase.FOLLOW_OBSERVATION_PHASE_KERNEL_REFUSED`: this peer's kernel deterministically refused a replica follow's round, so the follow's sync is blocked and is not retrying.
+
+- Generated value objects compare by the law's canonical value encoding, `nomos.vo-canonical.v1` (RFC 8785 over the value's `toJson()`): `NmsInternalValueIdentity.equals` / `hash` / `canonical` (CAP-853). Member order never matters, `2` and `2.0` are one number, `-0` is `0`, and an omitted optional member differs from `null`.
+
 ## 0.14.0
 
 - Live stream frames for peer catch-up (CAP-826): `LiveOfferFrame` gains checkpoint, history, ref, pack and

package/dart_types/lib/src/proto/nomos/runtime/v2/observability_desk.pbenum.dart

@@ -196,6 +196,15 @@ class FollowObservationPhase extends $pb.ProtobufEnum {
               ? ''
               : 'FOLLOW_OBSERVATION_PHASE_LOCAL_COPY_UNREADABLE');
 
+  /// This peer's kernel deterministically refused the follow's last round at this local head and
+  /// remote frontier. Sync is BLOCKED: no timer re-runs the same refused round. Only an event
+  /// (new local work, an upstream head change, a socket reopen, a changed kernel or runtime) runs
+  /// it again; `retry_at_unix_millis` is present only once an event made it due. `detail` carries
+  /// the kernel's refusal.
+  static const FollowObservationPhase FOLLOW_OBSERVATION_PHASE_KERNEL_REFUSED =
+      FollowObservationPhase._(
+          12, _omitEnumNames ? '' : 'FOLLOW_OBSERVATION_PHASE_KERNEL_REFUSED');
+
   static const $core.List<FollowObservationPhase> values =
       <FollowObservationPhase>[
     FOLLOW_OBSERVATION_PHASE_UNSPECIFIED,
@@ -210,10 +219,11 @@ class FollowObservationPhase extends $pb.ProtobufEnum {
     FOLLOW_OBSERVATION_PHASE_REBORN_REMOTELY,
     FOLLOW_OBSERVATION_PHASE_REPLACING_LOCAL,
     FOLLOW_OBSERVATION_PHASE_LOCAL_COPY_UNREADABLE,
+    FOLLOW_OBSERVATION_PHASE_KERNEL_REFUSED,
   ];
 
   static final $core.List<FollowObservationPhase?> _byValue =
-      $pb.ProtobufEnum.$_initByValueList(values, 11);
+      $pb.ProtobufEnum.$_initByValueList(values, 12);
   static FollowObservationPhase? valueOf($core.int value) =>
       value < 0 || value >= _byValue.length ? null : _byValue[value];
 

package/dart_types/lib/src/vo_canonical.dart

@@ -0,0 +1,185 @@
+// NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
+// remotes are replaceable custody/transport, not truth.
+
+/// Value identity for generated value objects — the Dart side of `nomos.vo-canonical.v1` (CAP-853).
+///
+/// The law's definition lives in `dsl/src/value_identity.ts`: RFC 8785 (JCS) over the value the
+/// value object's descriptor admits. A generated class's `toJson()` already IS that typed value
+/// (absent optionals omitted, nullable members `null`, the variant case in `type`), so the Dart side
+/// is the RFC 8785 encoder over it — members in UTF-16 code-unit order, ECMAScript number spelling,
+/// RFC 8785 string escapes — and generated `==` / `hashCode` compare that encoding. One definition
+/// across runtimes: the conformance vectors in `dsl/conformance/vo_canonical.v1.json` are replayed
+/// here (`test/vo_canonical_test.dart`), by the TypeScript suite and by the sealed engine.
+///
+/// Framework-internal: generated code calls [NmsInternalValueIdentity]; it is not exported from the
+/// `nomos_types` barrel. Digests are the law's to derive and store.
+library;
+
+const String nmsVoCanonicalEncoding = 'nomos.vo-canonical.v1';
+
+/// The value-identity operations generated value objects use for `==` and `hashCode`.
+abstract final class NmsInternalValueIdentity {
+  /// The `nomos.vo-canonical.v1` text of a value object's json (`toJson()`).
+  ///
+  /// Throws [ArgumentError] for what the law refuses: NaN or Infinity, an integer outside the
+  /// exact JavaScript range, a string that is not well-formed UTF-16, or a non-json value.
+  static String canonical(Object? json) {
+    final out = StringBuffer();
+    _write(out, json, strict: true, at: 'value');
+    return out.toString();
+  }
+
+  /// Value equality of two value objects' json over the canonical encoding.
+  ///
+  /// Total: a value the law would refuse (NaN, a lone surrogate) still compares, by a spelling
+  /// that never collides with an admissible value's canonical text.
+  static bool equals(Object? a, Object? b) => _lenient(a) == _lenient(b);
+
+  /// A hash consistent with [equals].
+  static int hash(Object? json) => _lenient(json).hashCode;
+}
+
+String _lenient(Object? json) {
+  final out = StringBuffer();
+  _write(out, json, strict: false, at: 'value');
+  return out.toString();
+}
+
+void _write(StringBuffer out, Object? v,
+    {required bool strict, required String at}) {
+  if (v == null) {
+    out.write('null');
+  } else if (v is bool) {
+    out.write(v ? 'true' : 'false');
+  } else if (v is num) {
+    out.write(_number(v, strict: strict, at: at));
+  } else if (v is String) {
+    _string(out, v, strict: strict, at: at);
+  } else if (v is List) {
+    out.write('[');
+    for (var i = 0; i < v.length; i++) {
+      if (i > 0) out.write(',');
+      _write(out, v[i], strict: strict, at: '$at[$i]');
+    }
+    out.write(']');
+  } else if (v is Map) {
+    final keys = v.keys.map((k) {
+      if (k is! String)
+        throw ArgumentError(
+            '$nmsVoCanonicalEncoding: $at has a non-string member name');
+      return k;
+    }).toList()
+      // String.compareTo orders by UTF-16 code units, as RFC 8785 §3.2.3 requires.
+      ..sort();
+    out.write('{');
+    var first = true;
+    for (final k in keys) {
+      if (!first) out.write(',');
+      first = false;
+      _string(out, k, strict: strict, at: '$at member name');
+      out.write(':');
+      _write(out, v[k], strict: strict, at: '$at.$k');
+    }
+    out.write('}');
+  } else {
+    throw ArgumentError(
+        '$nmsVoCanonicalEncoding: $at is a ${v.runtimeType}, which json cannot carry');
+  }
+}
+
+const int _maxSafeInteger = 9007199254740991;
+
+/// On the web every number is a JavaScript double, so an integral double also `is int`.
+const bool _numbersAreDoubles = identical(1, 1.0);
+
+/// ECMAScript Number::toString — the RFC 8785 number spelling — for a Dart [num].
+String _number(num v, {required bool strict, required String at}) {
+  if (v is int && !(_numbersAreDoubles && v.abs() > _maxSafeInteger)) {
+    if (v.abs() > _maxSafeInteger) {
+      if (strict) {
+        throw ArgumentError(
+            '$nmsVoCanonicalEncoding: $at is an integer outside the exact JavaScript range');
+      }
+      return 'int:$v';
+    }
+    return v.toString();
+  }
+  final d = v.toDouble();
+  if (d.isNaN || d.isInfinite) {
+    if (strict) {
+      throw ArgumentError(
+          '$nmsVoCanonicalEncoding: $at is not a finite number (NaN and Infinity have no canonical form)');
+    }
+    return 'nonfinite:$d';
+  }
+  if (d == 0) return '0'; // -0 too
+  if (d < 0) return '-${_number(-d, strict: strict, at: at)}';
+  // The shortest round-trip digits and the exponent, from Dart's own shortest representation.
+  final exponential = d.toStringAsExponential(); // e.g. "1.2345e+2", "5e-324"
+  final eIndex = exponential.indexOf('e');
+  final digits = exponential.substring(0, eIndex).replaceAll('.', '');
+  final k = digits.length;
+  final n = int.parse(exponential.substring(eIndex + 1)) +
+      1; // value = 0.digits × 10^n
+  if (k <= n && n <= 21) return digits + '0' * (n - k);
+  if (0 < n && n <= 21)
+    return '${digits.substring(0, n)}.${digits.substring(n)}';
+  if (-6 < n && n <= 0) return '0.${'0' * -n}$digits';
+  final e = n - 1;
+  final exponent = e < 0 ? '-${-e}' : '+$e';
+  return k == 1
+      ? '${digits}e$exponent'
+      : '${digits[0]}.${digits.substring(1)}e$exponent';
+}
+
+void _string(StringBuffer out, String s,
+    {required bool strict, required String at}) {
+  out.write('"');
+  for (var i = 0; i < s.length; i++) {
+    final c = s.codeUnitAt(i);
+    if (c >= 0xd800 && c <= 0xdbff) {
+      final next = i + 1 < s.length ? s.codeUnitAt(i + 1) : -1;
+      if (next >= 0xdc00 && next <= 0xdfff) {
+        out.writeCharCode(c);
+        out.writeCharCode(next);
+        i++;
+        continue;
+      }
+      if (strict)
+        throw ArgumentError(
+            '$nmsVoCanonicalEncoding: $at is not well-formed UTF-16 (a lone high surrogate)');
+      out.write('\\u${c.toRadixString(16)}');
+      continue;
+    }
+    if (c >= 0xdc00 && c <= 0xdfff) {
+      if (strict)
+        throw ArgumentError(
+            '$nmsVoCanonicalEncoding: $at is not well-formed UTF-16 (a lone low surrogate)');
+      out.write('\\u${c.toRadixString(16)}');
+      continue;
+    }
+    switch (c) {
+      case 0x22:
+        out.write(r'\"');
+      case 0x5c:
+        out.write(r'\\');
+      case 0x08:
+        out.write(r'\b');
+      case 0x0c:
+        out.write(r'\f');
+      case 0x0a:
+        out.write(r'\n');
+      case 0x0d:
+        out.write(r'\r');
+      case 0x09:
+        out.write(r'\t');
+      default:
+        if (c < 0x20) {
+          out.write('\\u00${c.toRadixString(16).padLeft(2, '0')}');
+        } else {
+          out.writeCharCode(c);
+        }
+    }
+  }
+  out.write('"');
+}

package/dart_types/pubspec.lock

@@ -74,7 +74,7 @@ packages:
     source: hosted
     version: "1.15.1"
   crypto:
-    dependency: transitive
+    dependency: "direct dev"
     description:
       name: crypto
       sha256: c8ea0233063ba03258fbcf2ca4d6dadfefe14f02fab57702265467a19f27fadf

package/dart_types/pubspec.yaml

@@ -9,7 +9,7 @@ description: >-
   Pure kernel wire/data types for Nomos Dart frontends — no transport, no bridge,
   no runtime. Typed protobuf and USDA boundary values plus the offer codec,
   reactive read engine, schema validation, and data-only error/trace types.
-version: 0.14.0
+version: 0.15.0
 
 environment:
   sdk: ^3.5.0
@@ -20,4 +20,6 @@ dependencies:
   fixnum: ^1.1.1
 
 dev_dependencies:
+  # The value-identity conformance test checks vector digests (test/vo_canonical_test.dart).
+  crypto: ^3.0.0
   test: ^1.25.0

package/dart_types/test/vo_canonical_test.dart

@@ -0,0 +1,91 @@
+// `nomos.vo-canonical.v1` (CAP-853): the Dart encoder replays the law's conformance vectors —
+// dsl/conformance/vo_canonical.v1.json, shared with the TypeScript suite and the sealed engine.
+import 'dart:convert';
+import 'dart:io';
+import 'dart:typed_data';
+
+import 'package:crypto/crypto.dart' show sha256;
+import 'package:nomos_types/src/vo_canonical.dart';
+import 'package:test/test.dart';
+
+void main() {
+  final file =
+      jsonDecode(File('../conformance/vo_canonical.v1.json').readAsStringSync())
+          as Map<String, Object?>;
+
+  test('names the same encoding', () {
+    expect(file['encoding'], nmsVoCanonicalEncoding);
+  });
+
+  test('spells every RFC 8785 Appendix B number exactly', () {
+    for (final n in (file['numbers']! as List).cast<Map<String, Object?>>()) {
+      final bits = BigInt.parse(n['bits']! as String, radix: 16);
+      final bytes = ByteData(8)
+        ..setUint32(0, (bits >> 32).toInt())
+        ..setUint32(4, (bits & BigInt.from(0xffffffff)).toInt());
+      expect(NmsInternalValueIdentity.canonical(bytes.getFloat64(0)),
+          n['canonical'],
+          reason: n['bits'] as String);
+    }
+  });
+
+  test('encodes and digests every vector', () {
+    for (final v in (file['vectors']! as List).cast<Map<String, Object?>>()) {
+      expect(NmsInternalValueIdentity.canonical(v['value']), v['canonical'],
+          reason: v['name'] as String);
+      expect(
+          sha256
+              .convert(
+                  utf8.encode(NmsInternalValueIdentity.canonical(v['value'])))
+              .toString(),
+          v['sha256'],
+          reason: v['name'] as String);
+    }
+  });
+
+  test('judges equality like the law', () {
+    for (final e
+        in (file['equalities']! as List).cast<Map<String, Object?>>()) {
+      expect(NmsInternalValueIdentity.equals(e['a'], e['b']), e['equal'],
+          reason: e['name'] as String);
+      if (e['equal'] == true)
+        expect(NmsInternalValueIdentity.hash(e['a']),
+            NmsInternalValueIdentity.hash(e['b']),
+            reason: e['name'] as String);
+    }
+  });
+
+  test('refuses what the law refuses without a descriptor', () {
+    for (final r in (file['refusals']! as List)
+        .cast<Map<String, Object?>>()
+        .where((r) => r['generic'] == true)) {
+      expect(() => NmsInternalValueIdentity.canonical(r['value']),
+          throwsArgumentError,
+          reason: r['name'] as String);
+      // Equality stays total: a refused value still compares, and never equals an admissible one.
+      expect(NmsInternalValueIdentity.equals(r['value'], r['value']), isTrue);
+    }
+    for (final bad in [
+      double.nan,
+      double.infinity,
+      double.negativeInfinity,
+      9007199254740992
+    ]) {
+      expect(() => NmsInternalValueIdentity.canonical({'x': bad}),
+          throwsArgumentError,
+          reason: '$bad');
+    }
+    expect(
+        NmsInternalValueIdentity.equals({'x': double.nan}, {'x': double.nan}),
+        isTrue);
+  });
+
+  test('a double read back integral is the same value as the authored int', () {
+    expect(
+        NmsInternalValueIdentity.equals(
+            {'x': 2, 'y': -0.0}, {'y': 0, 'x': 2.0}),
+        isTrue);
+    expect(NmsInternalValueIdentity.hash({'x': 2, 'y': -0.0}),
+        NmsInternalValueIdentity.hash({'y': 0, 'x': 2.0}));
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.115.0",
+  "version": "0.116.4",
   "type": "module",
   "sideEffects": false,
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
@@ -77,7 +77,7 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@githolon/runtime": "^0.115.0",
+    "@githolon/runtime": "^0.116.4",
     "@bufbuild/protobuf": "^2.13.0",
     "@bufbuild/protoc-gen-es": "^2.13.0",
     "esbuild": "0.24.2",

package/src/aggregate.ts

@@ -18,6 +18,7 @@ import { admitsNull, attributionField, t } from "./fields.js";
 import { satisfiesContract, type ContractHandle } from "./contract.js";
 import type { FulfilmentDecl } from "./fulfilment.js";
 import { Lww } from "./drivers.js";
+import { canonicalJsonValue } from "./value_identity.js";
 
 /**
  * A pure, replay-stable predicate over one aggregate's PROJECTED snapshot —
@@ -99,7 +100,8 @@ export function birthKeyWriteOnceFields(aggregate: AggregateHandle): readonly st
 function sameKeyValue(a: unknown, b: unknown): boolean {
   if (a === b) return true;
   if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) return false;
-  return JSON.stringify(a) === JSON.stringify(b);
+  // Value equality (RFC 8785), not text equality: member order is not part of a key's value (CAP-853).
+  return canonicalJsonValue(a) === canonicalJsonValue(b);
 }
 
 /** @internal The write-once judgement over one transition (exported for direct tests). */

package/src/baseline_usda.ts

@@ -14,6 +14,7 @@
 // Typed USDA, like everything Nomos remembers: the identity scopes are the identity layer's own
 // encoding (identity_usda.ts `renderIdentityScopes`), hosted under `NomosBaseline` beside the
 // provenance and wire-allocation scopes this artifact adds.
+import { usdaString } from "./usda_text.js";
 import { createHash } from "node:crypto";
 import type { CompilerIdentityModel } from "./identity_model.js";
 import {
@@ -60,9 +61,7 @@ export interface ReleasedBaseline {
   readonly wireAllocations: readonly BaselineWireAllocation[];
 }
 
-function quote(value: string): string {
-  return JSON.stringify(value);
-}
+const quote = usdaString;
 const stringList = (items: readonly string[]): string => `[${items.map(quote).join(", ")}]`;
 const byteOrder = (left: string, right: string): number => (left < right ? -1 : left > right ? 1 : 0);
 

package/src/build_package.ts

@@ -48,7 +48,8 @@ import {
   applicationLanguageOf,
   assertApplicationLanguageCoversAuthoredDirectives,
   executableDirectivesForLanguage,
-  remapWorkspaceInvariantsForLanguage,
+  carryWorkspaceInvariantsToPerformingIntents,
+  isBusinessIntent,
 } from "./intent.js";
 import { synthesizePreconditionInvariants } from "./precondition.js";
 import {
@@ -229,6 +230,39 @@ export interface DomainModuleSpec {
  * the read-models, and apply the HASH-LOAD-BEARING omit-when-empty key discipline
  * (an empty optional key must be ABSENT or every domain's canonical manifest hash drifts).
  */
+/**
+ * REFUSE A DANGLING INVARIANT (CAP-863). The kernel runs a workspace invariant only for a dispatch whose
+ * directive id equals its `.on(...)` target, and an effect's invariant reaches an intent only by being
+ * carried onto it. An invariant whose target this domain neither dispatches nor performs from a routable
+ * intent would compile, hash into the law and never run: a rule the author believes is enforced and is
+ * not. (The law graph later refuses a target outside the domain's intent closure as NMS-GRAPH-001; this
+ * check runs first, names every dangling invariant, and also covers a private effect no intent performs.)
+ */
+export function assertWorkspaceInvariantTargetsDispatchable(
+  invariants: readonly WorkspaceInvariantDecl[],
+  dispatchable: readonly Directive<any>[],
+  domain: string,
+): void {
+  const judged = new Set(dispatchable.map((directive) => directive.id));
+  // An effect a routable intent performs is judged through that intent's carried copy.
+  for (const directive of dispatchable) {
+    if (isBusinessIntent(directive)) {
+      for (const step of directive.steps) judged.add(step.directive.id);
+    }
+  }
+  const dangling = invariants
+    .filter((invariant) => !judged.has(invariant.on))
+    .map((invariant) => `'${invariant.id}' on '${invariant.on}'`)
+    .sort();
+  if (dangling.length > 0) {
+    throw new Error(
+      `domain '${domain}' declares workspace invariant ${dangling.join(", ")}, but nothing in the compiled ` +
+        `domain dispatches that target or performs it from an intent, so the invariant could never run. ` +
+        `Export the directive, or perform it from an intent the domain publishes.`,
+    );
+  }
+}
+
 export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   const domain = spec.domain ?? spec.name;
   const indexedVariants = indexedVariantsOf(spec.modules);
@@ -736,12 +770,17 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   for (const invariant of spec.workspaceInvariants ?? []) {
     workspaceInvariantById.set(invariant.id, invariant);
   }
-  const workspaceInvariants = applicationLanguage === undefined
-    ? [...workspaceInvariantById.values()]
-    : remapWorkspaceInvariantsForLanguage(
-        [...workspaceInvariantById.values()],
-        applicationLanguage,
-      );
+  // CAP-863: one carry rule with or without `language(...)` — an effect's invariant judges every
+  // routable intent that performs it. Without a language the original declaration is always kept, exactly
+  // as before: its bare id may also be dispatched directly or by another installed law, so carrying only
+  // ever ADDS judgements. A language closes its private effects, so (as before) only a still-dispatchable
+  // effect keeps its original.
+  const dispatchableDirectiveIds = new Set(directives.map((directive) => directive.id));
+  const workspaceInvariants = carryWorkspaceInvariantsToPerformingIntents(
+    [...workspaceInvariantById.values()],
+    directives.filter(isBusinessIntent),
+    (directiveId) => applicationLanguage === undefined || dispatchableDirectiveIds.has(directiveId),
+  );
   for (const policy of applicationLanguage?.workspaceSharing ?? []) {
     if (!workspaceInvariants.some((candidate) => candidate.id === policy.invitationLaw.gate.id)) {
       workspaceInvariants.push(policy.invitationLaw.gate);
@@ -769,6 +808,7 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   // the same desugaring lane as preconditions, so the manifest (`nomosInvariantGate`) and the sealed
   // engine (which synthesizes from the SAME directives in `buildDomainSlice`) can never disagree.
   for (const d of directives) workspaceInvariants.push(...synthesizeBirthQuotaInvariants(d));
+  assertWorkspaceInvariantTargetsDispatchable(workspaceInvariants, directives, domain);
   // The meter's declared queries route like any exported query (read manifest + captured-read re-derive).
   if (declaresBirth) {
     const haveQuery = new Set(queries.map((q) => q.id));