@githolon/dsl 0.14.0 → 0.16.0

package/src/wire.ts

@@ -127,6 +127,14 @@ export interface WireIntent {
   strikes: string[];
   events: WireEvent[];
   reads?: WireRead[];
+  /**
+   * THE OBSERVED ENDORSE FOOTPRINT (security_model.md — the integrity dual, Slice B): every
+   * PrincipalEvidence flow this plan run actually produced `{sink, facet, reason}`. A TRANSIENT
+   * verify-input — it rides the plan output the gate checks against the law's `nomosFlowGate.endorse`
+   * (author + replay), NEVER the committed intent's events, so it is not OID-hashed. OMITTED when
+   * empty so a principal-free intent is byte-identical.
+   */
+  endorse?: { sink: string; facet: string; reason: string | null }[];
 }
 
 /**

package/src/wire_encode.ts

@@ -26,7 +26,8 @@ import type { AggregateHandle } from "./aggregate.js";
 import type { Field, EvidenceRefValue } from "./fields.js";
 import type { Directive, ReferentialMarker } from "./directive.js";
 import type { PlannedOp, FieldOp } from "./ops.js";
-import type { Ports } from "./ctx.js";
+import { deterministicPorts, type Ports } from "./ctx.js";
+import type { PrincipalFacet } from "./principal_evidence.js";
 import type {
   WireEvent,
   WireHlc,
@@ -290,5 +291,77 @@ export function executeDirectiveToIntent<P>(
     return { aggregate, marker: eventMarker, ops };
   });
   // Attach the captured read footprint — OMITTED when empty so a read-free intent is byte-identical.
-  return { id: intentIdFromHlc(hlc), hlc, strikes, events, ...(reads.length ? { reads } : {}) };
+  // Attach the OBSERVED ENDORSE footprint (Slice B) — the principal flows this run produced; the gate
+  // checks them against the law's nomosFlowGate.endorse. Transient verify-input (not OID-hashed),
+  // OMITTED when empty so a principal-free intent is byte-identical.
+  const endorse = flowsFromOps(ops);
+  return {
+    id: intentIdFromHlc(hlc),
+    hlc,
+    strikes,
+    events,
+    ...(reads.length ? { reads } : {}),
+    ...(endorse.length ? { endorse } : {}),
+  };
+}
+
+/** One declared principal flow harvested from a plan — `sink` is `<AggregateType>.<field>`. */
+export interface PrincipalFlow {
+  readonly sink: string;
+  readonly facet: PrincipalFacet;
+  readonly reason: string | null;
+}
+
+/** Extract the principal flows carried by a plan's field ops (those with an `endorsement`). The ONE
+ *  op→flow mapping shared by the discovery harvest (compile) and the runtime footprint (Slice B). */
+function flowsFromOps(ops: readonly FieldOp[]): PrincipalFlow[] {
+  const flows: PrincipalFlow[] = [];
+  for (const op of ops) {
+    if (op.endorsement) {
+      flows.push({ sink: `${op.aggregateType ?? op.aggregateId}.${op.field}`, facet: op.endorsement.facet, reason: op.endorsement.reason });
+    }
+  }
+  return flows.sort((a, b) =>
+    a.sink !== b.sink ? (a.sink < b.sink ? -1 : 1) : a.facet < b.facet ? -1 : a.facet > b.facet ? 1 : 0,
+  );
+}
+
+/**
+ * THE DISCOVERY HARVEST (security_model.md — discovery IS law): run a directive's PURE plan with a
+ * probe payload + a probe principal, and harvest every PrincipalEvidence conversion's declared flow
+ * (`{sink, facet, reason}`). Executes the plan (not its AST) — the same technique as the rule-4 reads
+ * probe. Best-effort + fail-open on HARVEST (a probe that can't drive a branch just omits that flow);
+ * the omission is SAFE because the runtime/replay witness (Slice B) refuses any observed flow absent
+ * from the manifest. The reasons are static law, so they are intent-independent. SORTED for determinism.
+ */
+export function harvestPrincipalFlows(directive: Directive<unknown>): PrincipalFlow[] {
+  const ctx: Ports = deterministicPorts({ principal: "principal:probe" });
+  // A probe payload: any field access yields a benign string. Plans that need a typed shape (an
+  // array .map, etc.) may throw — caught below; that directive's flows are then witnessed at runtime.
+  const probe = new Proxy({}, { get: () => "probe" });
+  // A plan that MINTS (`create(Agg)` — the common `.creates` shape) calls `globalThis.nomos.mint`; the
+  // harvest runs at compile, where the engine's real shim is absent. Install a deterministic stub so the
+  // probe plan runs to completion and its flows ARE harvested (an un-harvested authority flow would be
+  // refused at runtime by the Slice B witness — fail-closed, but a false jam). The minted VALUE is
+  // irrelevant — a flow's sink is the field path, not the id. Restore any pre-existing shim after.
+  const g = globalThis as unknown as { nomos?: { mint?: (t: string) => string; read?: unknown } };
+  const hadNomos = "nomos" in g;
+  const prior: { mint?: (t: string) => string; read?: unknown } | undefined = g.nomos;
+  if (!hadNomos || typeof prior?.mint !== "function") {
+    g.nomos = { ...(prior ?? {}), mint: (typeTag: string) => `${typeTag}_0192f00d-0000-7000-8000-000000000000` };
+  }
+  let ops: FieldOp[];
+  __resetAuthoring();
+  __resetReads();
+  try {
+    const returned = directive.plan(probe as never, ctx);
+    ops = [...__drainAuthoring(), ...(Array.isArray(returned) ? returned : [])].filter((op): op is FieldOp => op.kind !== "strike");
+  } catch {
+    try { __drainAuthoring(); __drainReads(); } catch { /* sink already drained */ }
+    return [];
+  } finally {
+    if (hadNomos && prior !== undefined) g.nomos = prior; else delete g.nomos;
+  }
+  __drainReads();
+  return flowsFromOps(ops);
 }

package/src/workspace_sharding.ts

@@ -10,7 +10,7 @@
  * invariants, slice 3 delta lane + least-loaded placement).
  *
  * `nomos-compile` APPENDS this module to a TAXONOMY-BEARING domain's module list —
- * both in the canonical manifests (the placement law is hash-bearing law) and in the
+ * both in the compiled package metadata (the placement law is hash-bearing law) and in the
  * generated engine entry (the plans ship in the lump). A taxonomy-FREE package never
  * imports it (subpath `@githolon/dsl/workspace-sharding`, never the runtime barrel —
  * the slice-1 hash-stability law: its bytes must not enter other tenants' lumps).
@@ -73,7 +73,10 @@ import { t } from "./fields.js";
 import { Lww } from "./drivers.js";
 import { directive } from "./directive.js";
 import { set, strike, withMarker, type PlannedOp } from "./ops.js";
+import { create } from "./authoring.js";
+import { impureCapabilityAggregate } from "./framework/impure_capability.js";
 import { query } from "./query.js";
+import { read } from "./read.js";
 import { sum } from "./sum.js";
 import { min, max } from "./extremum.js";
 import { refAs, workspaceInvariant } from "./framework/workspace_invariant.js";
@@ -110,7 +113,7 @@ export interface ShardingRouteSpec {
 export interface ShardingLawSpec {
   readonly axes: readonly ShardingAxisSpec[];
   /**
-   * THE DERIVED ROUTES (slice 2's canonical-manifest `routes`, fed back into the law):
+   * THE DERIVED ROUTES (slice 2's package route facts, fed back into the law):
    * per routed directive, the homing invariant `nomosWrongHome:<directive>` is derived
    * so THE CHAIN GATE ITSELF refuses a wrong-home write (#41 — slice 3a; the edge
    * bailiff stays as defense-in-depth). OMITTED routes ⇒ no invariants (slice-2 shape).
@@ -156,6 +159,15 @@ export const checkpointSealRowId = (seq: number | string): string => `nomos-chec
 /** The LATEST seal (the head pointer — same aggregate, well-known id; O(1) to find). */
 export const NOMOS_CHECKPOINT_HEAD_ID = "nomos-checkpoint-seal:head";
 
+/** THE MOVE OBLIGATION id (P6 — sharding orchestration as outbound offers): one obligation per
+ *  (move, leg), keyed deterministically so re-entry is idempotent (the receipt-leg obligation re-folds
+ *  to the same row, never a duplicate). `<from>-<to>` names the move; the leg names the step. */
+export const moveObligationRowId = (fromShard: string, toShard: string, leg: string): string =>
+  `nomos-move-obligation:${fromShard}-${toShard}:${leg}`;
+/** The move-leg sequence the coordinator emits as outbound offers (architecture/sharding_as_outbound_offers.md). */
+export const MOVE_LEGS = ["receipt", "migrate", "seal", "open", "handoff"] as const;
+export type MoveLeg = (typeof MOVE_LEGS)[number];
+
 /** The estate-total bucket of a scoped read's group (`nomosEstateSummary` group key).
  *  `|` — printable (the kernel's canonical event decode refuses raw control bytes);
  *  unambiguous because a SCOPED read's id may not contain `|` (compile-refused);
@@ -201,6 +213,13 @@ export const NomosShardAssignment = aggregate("NomosShardAssignment", {
   placedAt: t.string().merge(Lww),
 });
 
+/** The home's CURRENT assignment row, keyed by home key. Top-level so the §6 move directives can
+ *  CAPTURED-READ it (P6 S3a — the map version is derived in law, not by the host). Also routed by
+ *  the law module under the same id. */
+export const nomosShardAssignmentByHomeKey = query("nomosShardAssignmentByHomeKey")
+  .key("homeKey")
+  .returns(NomosShardAssignment);
+
 /**
  * THE SHARD'S OWN IDENTITY — law-state in the shard's OWN chain (§3's "its assignment"
  * fact, the slice-3a slice of it): which shard label this workspace IS. An Ensure
@@ -313,11 +332,17 @@ export const NomosSummarySubtotal = aggregate("NomosSummarySubtotal", {
   empty: t.int().merge(Lww).optional(),
 });
 
+/** Per-(shard) committed subtotal rows, keyed by shard. Top-level so the derived placement directive can
+ *  CAPTURED-READ each open shard's load (the `nomosShardRows` subtotal) to pick LEAST-LOADED IN THE PLAN
+ *  (holon-native placement, P6 slice 3 — the host no longer picks). Also routed by the law module. */
+export const nomosSummarySubtotalByShard = query("nomosSummarySubtotalByShard")
+  .key("shard")
+  .returns(NomosSummarySubtotal);
+
 /** THE PER-SHARD DELTA FRONTIER watermark (§5.2 step 1 — contiguity law-state). */
 export const NomosSummaryFrontier = aggregate("NomosSummaryFrontier", {
   shard: t.string().merge(Lww),
   frontier: t.string().merge(Lww), // the shard main oid the subtotals are true at
-  readManifestHash: t.string().merge(Lww),
   updatedAt: t.string().merge(Lww),
 });
 
@@ -395,7 +420,36 @@ export const nomosReceiveAssignment = directive("nomosReceiveAssignment")
 //      `shard = target` and the map version BUMPED (wrong-home refusals carry it;
 //      clients refresh and retry — §4's self-healing lane).
 
-/** Begin a move: flip each home's assignment to `moving:<toShard>` (gate-verified). */
+/**
+ * THE MOVE OBLIGATION (P6 — sharding orchestration as outbound offers, slice S1): one
+ * impure-capability-shaped row per (move, leg), driven through the obligation lifecycle the
+ * KERNEL already enforces (`scan_requested` emits it on the outbox; `OrphanReceipt`/terminal-once
+ * gate its receipt). The coordinator EMITS the move as data; the bailiff delivers each leg + relays
+ * the shard's gate verdict as a receipt; each receipt mints the next leg (S2). It carries the
+ * `requested`-status lifecycle envelope (`scheduledAt`/`deadlineAt` are required ints — the reactor
+ * skips a row missing them) PLUS the move-leg params. S1 is ADDITIVE: `nomosSplitShard` mints the
+ * receipt-leg obligation ALONGSIDE the unchanged assignment flip; the host orchestration still runs
+ * the move (the obligation is observable on the outbox, not yet consumed). `architecture/sharding_as_outbound_offers.md`.
+ */
+export const NomosMoveObligation = impureCapabilityAggregate("NomosMoveObligation", {
+  // the move-leg params (the non-envelope fields scan_requested returns as the order's `params`):
+  fromShard: t.string().merge(Lww),
+  toShard: t.string().merge(Lww),
+  homeKeys: t.json().merge(Lww), // the moving home keys (the leg's work list)
+  leg: t.string().merge(Lww), // one of MOVE_LEGS
+  mapVersion: t.int().merge(Lww), // the law-derived map version (S3a), ferried leg-to-leg
+  // S3b — the target shard's ADMITTED set, accumulated migrate→seal (the cross-leg state seal-home
+  // needs to compute `missing` against the source chain). The LAW unions it (the adapter only ferries
+  // arrays it read off the obligation + the shard response — it never accumulates), so the host holds no
+  // cross-leg move state and an adapter restart re-derives everything from the on-chain obligation.
+  migratedIds: t.json().merge(Lww), // JSON string array; "[]" until the migrate leg's receipt
+});
+
+/** S1 receipt-leg obligation window (ms) — the leg's soft deadline past its scheduledAt. */
+const MOVE_OBLIGATION_WINDOW_MS = 300_000;
+
+/** Begin a move: flip each home's assignment to `moving:<toShard>` (gate-verified) AND mint the
+ *  receipt-leg move obligation (P6 S1 — additive; observable on the outbox, not yet consumed). */
 export const nomosSplitShard = directive("nomosSplitShard")
   .mutates(NomosShardAssignment)
   .payload(
@@ -404,6 +458,9 @@ export const nomosSplitShard = directive("nomosSplitShard")
       toShard: z.string().regex(/^s\d+$/),
       homeKeys: z.array(z.string().min(1)).min(1).max(64),
       startedAt: z.string(),
+      // P6 S1: the caller-stamped epoch-ms the move begins (the obligation's scheduledAt). The
+      // timestamp rides IN the payload (the determinism doctrine — no clock in the plan).
+      scheduledAt: z.number().int().min(0),
     }),
   )
   .plan((p) => {
@@ -413,10 +470,107 @@ export const nomosSplitShard = directive("nomosSplitShard")
     if (new Set(p.homeKeys).size !== p.homeKeys.length) {
       throw new Error("split-duplicate: a home key appears twice in one split");
     }
-    return p.homeKeys.flatMap((homeKey) => {
+    const ops = p.homeKeys.flatMap((homeKey) => {
       const row = instance(NomosShardAssignment, shardAssignmentRowId(homeKey));
       return [set(row, "status", movingStatus(p.toShard))];
     });
+    // P6 S3a — THE MAP VERSION IS DERIVED IN LAW, not by the host. CAPTURED-READ each moving home's
+    // CURRENT assignment (the pre-apply committed state; the gate re-derives at verify, CAS-refusing on
+    // drift) and bump: newMapVersion = max(1, max held) + 1 — the SAME arithmetic `_runSplitMigration`
+    // used to do in JS, now on the chain. The floor of 1 guarantees ≥2 (the handoff gate's minimum). The
+    // obligation carries it forward (nomosAdvanceMove ferries it leg-to-leg) so the host NEVER computes it.
+    let maxHeld = 1;
+    for (const homeKey of p.homeKeys) {
+      const rows = read(nomosShardAssignmentByHomeKey, { homeKey }) as Array<{ data?: { mapVersion?: number } }>;
+      for (const r of rows) {
+        const v = r?.data?.mapVersion;
+        if (typeof v === "number" && v > maxHeld) maxHeld = v;
+      }
+    }
+    const newMapVersion = maxHeld + 1;
+    // P6 S1/S2 — mint the receipt-leg obligation (the standard obligation API: `create` mints the id; its
+    // ops are ambient-harvested + merged with these returned ops). status:'requested' + the lifecycle
+    // envelope ⇒ the outbox (`scan_requested`) surfaces it as an outbound offer; the move-leg params ride
+    // as the order's params. Re-entry is idempotent via the MOVE GATE (a double `nomosSplitShard` refuses
+    // `not-active:moving:*` before this runs). The host orchestration is UNCHANGED — observable, not consumed.
+    create(NomosMoveObligation)
+      .set("requestedBy", "coordinator")
+      .set("requestedAt", p.scheduledAt)
+      .set("scheduledAt", p.scheduledAt)
+      .set("deadlineAt", p.scheduledAt + MOVE_OBLIGATION_WINDOW_MS)
+      .set("status", "requested")
+      .set("fromShard", p.fromShard)
+      .set("toShard", p.toShard)
+      .set("homeKeys", JSON.stringify(p.homeKeys)) // t.json() stores the stringified JSON
+      .set("leg", "receipt")
+      .set("mapVersion", newMapVersion)
+      .set("migratedIds", "[]"); // nothing migrated yet — the migrate leg's receipt accumulates it
+    return ops;
+  })
+  .reads(nomosShardAssignmentByHomeKey);
+
+/**
+ * P6 S2 — THE MOVE RECEIPT (the leg sequence becomes LAW): a leg's receipt COMPLETES its obligation
+ * (a terminal status ⇒ the kernel's receipt gate enforces terminal-once + no-orphan, since
+ * NomosMoveObligation carries the full impure-capability envelope) AND MINTS THE NEXT leg's obligation —
+ * so the order receipt→migrate→seal→open→handoff lives on the chain, not in the host's `_runSplitMigration`
+ * JS. The bailiff offers this after delivering a leg + taking the shard's gate verdict (that wiring is S3;
+ * S2 drives it directly to prove the chain). The SEAL leg, when `missing` writes raced in on the source,
+ * re-mints `migrate` (the bounded re-migrate) instead of advancing to `open`. The LAST leg (handoff) mints
+ * nothing — the move is done. (architecture/sharding_as_outbound_offers.md)
+ */
+export const nomosAdvanceMove = directive("nomosAdvanceMove")
+  .mutates(NomosMoveObligation)
+  .payload(
+    z.object({
+      requestId: z.string().min(1), // the leg obligation being completed (its runtime-minted id)
+      leg: z.enum(MOVE_LEGS),
+      fromShard: z.string().regex(/^s\d+$/),
+      toShard: z.string().regex(/^s\d+$/),
+      homeKeys: z.array(z.string().min(1)).min(1).max(64),
+      mapVersion: z.number().int().min(2), // the law-derived version (S3a), ferried leg-to-leg
+      scheduledAt: z.number().int().min(0),
+      completedAt: z.number().int().min(0),
+      missing: z.array(z.string()).optional(), // seal leg: writes that raced in, still on the source
+      // S3b — the migrated-id ferry (the adapter passes through arrays it READ; the LAW unions them).
+      // `priorMigratedIds`: the current obligation's accumulated set (off the obligation). `migratedIds`:
+      // THIS leg's shard delta (off the migrate-in response; [] for non-migrate legs). The plan unions
+      // them onto the next obligation, so the seal leg's obligation carries the full admitted set.
+      priorMigratedIds: z.array(z.string()).default([]),
+      migratedIds: z.array(z.string()).default([]),
+    }),
+  )
+  .plan((p) => {
+    // THE RECEIPT — drive the current leg obligation TERMINAL (the kernel's terminal-once anchors on this
+    // terminal-status set; a second receipt on the same obligation refuses ReceiptOnTerminalObligation).
+    const cur = instance(NomosMoveObligation, p.requestId);
+    const ops = [
+      set(cur, "status", "completed"),
+      set(cur, "completedAt", p.completedAt),
+      set(cur, "closesObligation", p.requestId), // the closure link (the O(1) closure read)
+    ];
+    // MINT THE NEXT LEG — the order is law. Seal + raced `missing` re-mints `migrate` (bounded re-migrate).
+    const idx = MOVE_LEGS.indexOf(p.leg);
+    let nextLeg: MoveLeg | undefined = MOVE_LEGS[idx + 1];
+    if (p.leg === "seal" && p.missing !== undefined && p.missing.length > 0) nextLeg = "migrate";
+    if (nextLeg !== undefined) {
+      // THE LAW UNIONS the migrated ids (the host never accumulates): the next obligation carries the
+      // accumulated admitted set forward, so the seal leg POSTs the full set + a re-migrate keeps growing it.
+      const accMigrated = [...new Set([...p.priorMigratedIds, ...p.migratedIds])].sort();
+      create(NomosMoveObligation)
+        .set("requestedBy", "coordinator")
+        .set("requestedAt", p.completedAt)
+        .set("scheduledAt", p.scheduledAt)
+        .set("deadlineAt", p.scheduledAt + MOVE_OBLIGATION_WINDOW_MS)
+        .set("status", "requested")
+        .set("fromShard", p.fromShard)
+        .set("toShard", p.toShard)
+        .set("homeKeys", JSON.stringify(p.homeKeys))
+        .set("leg", nextLeg)
+        .set("mapVersion", p.mapVersion) // carry the law-derived version forward (S3a)
+        .set("migratedIds", JSON.stringify(accMigrated)); // S3b — the accumulated admitted set
+    }
+    return ops;
   });
 
 /**
@@ -530,7 +684,6 @@ export const nomosAmendSummaryFrontier = directive("nomosAmendSummaryFrontier")
     z.object({
       shard: z.string().regex(/^s\d+$/),
       frontier: z.string(),
-      readManifestHash: z.string(),
       updatedAt: z.string(),
     }),
   )
@@ -539,7 +692,6 @@ export const nomosAmendSummaryFrontier = directive("nomosAmendSummaryFrontier")
     return [
       withMarker(set(wm, "shard", p.shard), "ensures"),
       set(wm, "frontier", p.frontier),
-      set(wm, "readManifestHash", p.readManifestHash),
       set(wm, "updatedAt", p.updatedAt),
     ];
   });
@@ -656,7 +808,6 @@ export const nomosPropagateSummary = directive("nomosPropagateSummary")
       shard: z.string().regex(/^s\d+$/),
       fromOid: z.string(), // "" = the shard's first delta (a virgin coordinator record)
       toOid: z.string().min(1),
-      readManifestHash: z.string(),
       propagatedAt: z.string(),
       subtotals: z.array(summarySubtotalSchema).min(1).max(1024),
       events: z.array(summaryEventSchema).max(4096),
@@ -762,7 +913,6 @@ export const nomosPropagateSummary = directive("nomosPropagateSummary")
     ops.push(
       withMarker(set(wm, "shard", p.shard), "ensures"),
       set(wm, "frontier", p.toOid),
-      set(wm, "readManifestHash", p.readManifestHash),
       set(wm, "updatedAt", p.propagatedAt),
     );
     return ops;
@@ -947,6 +1097,7 @@ export function shardingLawModule(spec: ShardingLawSpec): Record<string, unknown
     NomosSummaryFrontier,
     NomosDeepVerify,
     NomosCheckpointSeal,
+    NomosMoveObligation, // P6 S1 — the move-leg obligation `nomosSplitShard` emits
     nomosDeclareShardIdentity,
     nomosReceiveAssignment,
     nomosOpenShard,
@@ -956,17 +1107,14 @@ export function shardingLawModule(spec: ShardingLawSpec): Record<string, unknown
     nomosRecordDeepVerify,
     nomosCheckpointSeal,
     nomosSplitShard,
+    nomosAdvanceMove, // P6 S2 — the move receipt: completes a leg + mints the next
     nomosSealHandoff,
     nomosSealHome,
-    nomosShardAssignmentByHomeKey: query("nomosShardAssignmentByHomeKey")
-      .key("homeKey")
-      .returns(NomosShardAssignment),
+    nomosShardAssignmentByHomeKey, // top-level (P6 S3a — captured-read by the move directives)
     nomosShardIdentityByScope: query("nomosShardIdentityByScope")
       .key("scope")
       .returns(NomosShardIdentity),
-    nomosSummarySubtotalByShard: query("nomosSummarySubtotalByShard")
-      .key("shard")
-      .returns(NomosSummarySubtotal),
+    nomosSummarySubtotalByShard, // top-level (P6 slice 3 — captured-read by the placement directive)
     nomosShardRegistryByStatus: query("nomosShardRegistryByStatus")
       .key("status")
       .returns(NomosShardRegistry),
@@ -1233,27 +1381,52 @@ export function shardingLawModule(spec: ShardingLawSpec): Record<string, unknown
     // by the dispatching client/worker over committed load subtotals — law-state,
     // never a live read a plan takes); the row id is the home key (ONE active
     // assignment per home, by construction); a conflicting re-offer refuses typed.
+    // HOLON-NATIVE PLACEMENT (P6 slice 3): the PLAN picks least-loaded — the host no longer chooses the
+    // shard. `shard` is GONE from the payload. The plan CAPTURED-READS the home's held assignment (idempotent
+    // reuse) and each open shard's committed `nomosShardRows` subtotal (least-loaded, ties → lowest ordinal),
+    // both #58 declared reads the gate re-derives at verify (CAS — a load that moved refuses typed). Pure over
+    // committed coordinator state ⇒ every peer places identically. (architecture/holon_native_routing.md)
+    const pool = axis.shardCount;
     mod[dirId] = directive(dirId)
       .ensures(NomosShardAssignment)
       .payload(
         z.object({
           [keyField]: z.string().min(1),
-          shard: z.string().regex(/^s\d+$/),
           placedAt: z.string(),
         }),
       )
       .plan((p: Record<string, string>) => {
         const homeKey = p[keyField]!;
         const row = instance(NomosShardAssignment, shardAssignmentRowId(homeKey));
+        // IDEMPOTENCY: a home already placed reuses ITS shard (re-offer is a no-op; the uniqueness
+        // invariant guards a mid-move / moved home). A fresh home picks least-loaded over the open pool.
+        const held = read(nomosShardAssignmentByHomeKey, { homeKey }) as Array<{ data?: { shard?: string } }>;
+        const heldShard = held[0]?.data?.shard;
+        let shard: string;
+        if (typeof heldShard === "string" && heldShard) {
+          shard = heldShard;
+        } else {
+          let best = "s0";
+          let bestLoad = Infinity;
+          for (let i = 0; i < pool; i++) {
+            const label = `s${i}`;
+            const subs = read(nomosSummarySubtotalByShard, { shard: label }) as Array<{ data?: { readId?: string; value?: number } }>;
+            const sub = subs.find((r) => r?.data?.readId === NOMOS_SHARD_ROWS_READ);
+            const load = typeof sub?.data?.value === "number" ? sub.data!.value! : 0;
+            if (load < bestLoad) { best = label; bestLoad = load; } // strict < ⇒ ties keep the lowest ordinal
+          }
+          shard = best;
+        }
         return [
           withMarker(set(row, "homeType", axisType), "ensures"),
           set(row, "homeKey", homeKey),
-          set(row, "shard", p.shard!),
+          set(row, "shard", shard),
           set(row, "mapVersion", 1),
           set(row, "status", "active"),
           set(row, "placedAt", p.placedAt!),
         ];
-      });
+      })
+      .reads(nomosShardAssignmentByHomeKey, nomosSummarySubtotalByShard);
     // PLACEMENT UNIQUENESS (task #42 item 5): an idempotent re-offer (same shard)
     // re-folds the same row; a CONFLICTING one refuses typed with the held shard.
     // THE MOVE-LANE GUARD (slice 5): a re-offer may only reproduce a FRESH placement
@@ -1267,17 +1440,17 @@ export function shardingLawModule(spec: ShardingLawSpec): Record<string, unknown
       .reads(({ intent }) => [
         refAs("held", "NomosShardAssignment", `pre:${shardAssignmentRowId(String(intent[keyField] ?? ""))}`),
       ])
-      .assert((snapshots, ctx) => {
+      .assert((snapshots) => {
         const held = snapshots["held"] ?? {};
         const heldShard = held["shard"];
-        if (typeof heldShard !== "string" || heldShard.length === 0) return { accept: true };
+        if (typeof heldShard !== "string" || heldShard.length === 0) return { accept: true }; // a virgin home — place it
         const target = movingTargetOf(held["status"]);
         if (target !== undefined) return { reject: `home-moving:${target}` };
         const heldVersion = typeof held["mapVersion"] === "number" ? (held["mapVersion"] as number) : 1;
-        const offered = ctx?.intent?.["shard"];
-        return offered === heldShard && heldVersion === 1
-          ? { accept: true } // the idempotent re-offer — same home, same shard, fresh era
-          : { reject: `placement-exists:${heldShard}` };
+        // The plan REUSES the held shard for an already-placed home (holon-native placement, slice 3), so a
+        // re-offer to a FRESH placement (v1) is byte-identical — admit. A MOVED home (v>1) would regress its
+        // version to 1, so it refuses typed (the routed client answers such re-offers from the held row).
+        return heldVersion === 1 ? { accept: true } : { reject: `placement-exists:${heldShard}` };
       });
   }
   return mod;

package/src/workspace_type.ts

@@ -367,6 +367,7 @@ export function deriveHoming(
     "NomosShardAssignment", "NomosShardIdentity", "NomosHomeReceipt", "NomosShardRegistry",
     "NomosShardPolicy", "NomosSummarySubtotal", "NomosSummaryFrontier", "NomosDeepVerify",
     "NomosCheckpointSeal",
+    "NomosMoveObligation", // P6 — the move-leg obligation is coordinator law-state (no homing t.ref)
   ]);
   const childIdsAll = new Set([...types.values()].flatMap((t) => [...t.childIds]));
   const coordinators = [...types.values()]