@githolon/dsl 0.16.3 → 0.18.0

package/src/framework/workspaces.ts

@@ -67,6 +67,7 @@ export const GOVERNANCE_REVISION = "2026-06-12-capability-bindings"; // hash-bea
 import { z } from "zod";
 import { aggregate, instance } from "../aggregate.js";
 import { create, ensure } from "../authoring.js";
+import { birth } from "../births.js";
 import { directive } from "../directive.js";
 import { Lww } from "../drivers.js";
 import { t } from "../fields.js";
@@ -96,18 +97,24 @@ export const WORKSPACE_ROLES = ["cloud-root", "platform", "tenant"] as const;
 const WORKSPACE_SELF_ID = "workspaceself-self";
 const SELF_ADMIN_OBJECT = "workspace:self";
 export const WorkspaceSelf = aggregate("WorkspaceSelf", {
+  // VESTIGIAL node-class label (the same smell as `kind`): NOTHING decides on its value — the kernel, host,
+  // and gate read it nowhere; the write-once invariants below key on `name`'s PRESENCE (the "born" marker),
+  // never role. No longer set on new records (birthCloud/ensureWorkspaceSelf stopped writing it). Kept only
+  // for era-safety (old records carry it); slated for removal with `kind` in one #58 disposition pass.
   role: t.enum(WORKSPACE_ROLES).merge(Lww),
   name: t.string().merge(Lww),
 });
 // The one-off SELF-IDENTITY backfill for an already-born workspace (root predates WorkspaceSelf). UNGATED
 // by the admin gate — it must run BEFORE the admin tuple/gate are live — but WRITE-ONCE (the invariant
-// below refuses a re-set once the role exists), so a race or a malicious re-set cannot flip the role and
-// freeze governance. The HOST authors this in the serialized genesis re-entry, winning any race.
+// below refuses a re-set once the self-record exists), so a race or a malicious re-set cannot freeze
+// governance. The HOST authors this in the serialized genesis re-entry, winning any race.
 export const ensureWorkspaceSelf = directive("ensureWorkspaceSelf")
   .ensures(WorkspaceSelf)
-  .payload(z.object({ role: z.enum(WORKSPACE_ROLES), name: z.string().min(1) }))
+  // `role` accepted-but-ignored (vestigial — see WorkspaceSelf): callers may still pass it; the plan no
+  // longer sets it. `name` is the self-record's only meaningful field + the born marker.
+  .payload(z.object({ role: z.enum(WORKSPACE_ROLES).optional(), name: z.string().min(1) }))
   .plan((p) => {
-    ensure(WorkspaceSelf, WORKSPACE_SELF_ID).set("role", p.role).set("name", p.name);
+    ensure(WorkspaceSelf, WORKSPACE_SELF_ID).set("name", p.name);
     return [];
   });
 export const workspaceSelfWriteOnce = workspaceInvariant("WorkspaceSelfWriteOnce")
@@ -118,8 +125,11 @@ export const workspaceSelfWriteOnce = workspaceInvariant("WorkspaceSelfWriteOnce
   // 2026-06-15). Bare matches — exactly the convention the sharding invariants already fire under.
   .on("ensureWorkspaceSelf")
   .reads(() => [refAs("self", "WorkspaceSelf", "pre:" + WORKSPACE_SELF_ID)])
+  // WRITE-ONCE on the self-record's PRESENCE via `name` (not the vestigial `role`). At genesis name + role
+  // were always co-written, so an existing born workspace has `name` ⇒ behaviour preserved; a fresh one has
+  // neither ⇒ first set admitted.
   .assert(({ self }) =>
-    (self as { role?: string })?.role ? { reject: "workspace-self-already-set" } : { accept: true },
+    (self as { name?: string })?.name ? { reject: "workspace-self-already-set" } : { accept: true },
   );
 
 // ── THE GOVERNANCE RELATION SCHEMA (full-native Zanzibar — the ONE authz model) ──────────────────────
@@ -136,8 +146,10 @@ export const workspaceSelfWriteOnce = workspaceInvariant("WorkspaceSelfWriteOnce
 // side) DISCARDED at evaluation. Each relation is a flat `self()` (directly-stored tuples) — NO rewrite
 // algebra (no computed/from/union): control-plane authority is direct membership only.
 //   * admin           — grantAdmin/revokeAdmin + every admin-mutating governance directive.
-//   * creator         — createWorkspace (under invite/closed posture; see the host's _creationLawOk).
-//   * platformCreator — birthPlatform (always invite-only).
+//   * creator         — THE birth authority: createWorkspace + birthChild (leaf OR platform). The tier
+//                       collapsed onto this one relation (2026-06-24); a subject is user: or key:.
+//   * platformCreator — VESTIGIAL: its directives (birthPlatform/grant·revokePlatformCreation) are removed;
+//                       no .requires references it. Kept until the #58 disposition pass (with kind/role).
 // SELF-RELATIVE: custody guarantees a workspace only ever folds its OWN relations table, so
 // `workspace:root#admin` collapses to `workspace:self#admin` — the SAME law governs root and every
 // born platform with no name plumbing. (A pure tenant runs no governance ⇒ no schema ⇒ the gate is
@@ -224,9 +236,12 @@ export const CloudWorkspace = aggregate("CloudWorkspace", {
    */
   byteCap: t.int().merge(Lww).optional(),
   /**
-   * What this node IS: absent/`"workspace"` = a leaf; `"platform"` = a PLATFORM —
-   * a workspace that hosts the SAME governance law and parents its own subtree
-   * (the cloud, one level down; born via {@link birthPlatform}).
+   * DERIVED LABEL (the `kind`-collapse, architecture/provisioning_as_obligations.md): set to `"platform"`
+   * iff the birth order carried a genesis (a `foundingAdminHash`), else absent/`"workspace"`. It is NOT a
+   * node-class and NOTHING decides on it — the birth provider keys off `foundingAdminHash`, the genuine
+   * signal that a child is born running the governance law. Kept only so old readers/queries that filter by
+   * label still resolve; slated for removal (a #58 disposition) once no reader depends on it. "All
+   * workspaces are equal until a domain is installed" — a platform is one with the governance domain.
    */
   kind: t.enum(["workspace", "platform"]).merge(Lww).optional(),
   /**
@@ -237,6 +252,29 @@ export const CloudWorkspace = aggregate("CloudWorkspace", {
    * request at the cloud level).
    */
   pool: t.int().merge(Lww).optional(),
+  /**
+   * THE LAW-AUTHORED GENESIS CHAIN (P1, architecture/provisioning_as_obligations.md "law and law alone").
+   * For a genesis birth, `birthChild` authors the child's genesis RECIPE here as data — a JSON array of
+   * `{domain, directiveId, payload, actor}` steps (`seedGenesis → grantAdmin → birthCloud`). The birth
+   * capability provider REPLAYS this opaque list on the child (it names nothing — the directive ids come
+   * from the law, not host source); that is the difference between the host *reconstructing* the genesis
+   * (today) and the host *delivering* a law-authored one. Absent for plain births + pre-P1 records (the
+   * provider falls back to its inline recipe — flag-gated until live byte-equivalence is proven). Naming
+   * the genesis directives HERE is law naming law (legitimate); the prohibition binds only the host.
+   */
+  genesisChain: t.json().merge(Lww).optional(),
+  /**
+   * THE LINEAGE-AUTHORIZATION BINDING (proof-friendly — architecture/sovereign_adapter.md "birth is a kernel
+   * offer-effect"). The child's genesis SELF-ATTESTS who authorized it: a JSON commitment
+   * `{parent, principal, authorizedAt}` — the law-available lineage anchor — that the child's OWN chain
+   * carries, so a verifier of the child alone sees its claimed parentage, cross-checkable against the
+   * parent's chain (which holds the child's CloudWorkspace + the gated `birthChild` that minted it). It is
+   * the clean public-input shape a future recursive-proof circuit (Nova / zkWASM) would expose; the
+   * kernel-structural commitments (the parent chain head + the `birthChild` intent hash + the law hash) join
+   * it when the KERNEL produces the genesis (B's later slice — until then those ride as `""`). `t.string`
+   * (JSON), never `t.json`: it rides verbatim as a scalar (the kernel `Value` has no JSON variant — the same
+   * reasoning as the auth keys). Absent on root (the base of the world tree, born under nothing). */
+  bornUnder: t.string().merge(Lww).optional(),
 });
 
 // AdminGrant / CreationGrant aggregates: DELETED (full-native Zanzibar). Admin/creation authority is
@@ -356,11 +394,125 @@ export const CapabilityBinding = aggregate("CapabilityBinding", {
 
 // --- workspace directives ---------------------------------------------------------
 
+// ── THE ONE BIRTH RECORD (the `kind`-collapse — architecture/provisioning_as_obligations.md) ───────────
+// Every birth — a plain child OR a platform — mints the SAME `CloudWorkspace` order; the ONLY difference is
+// the GENESIS DATA the order carries. `genesis` present (a founding-admin hash + pool) ⇒ this child is born
+// running the governance law: the birth capability provider drains it (the order carries a foundingAdminHash)
+// and seeds the genesis. Absent ⇒ a plain lineage record, materialized by boot-on-touch (never drained).
+// `kind` is set PURELY as a derived label off genesis presence — a vestige for old readers; NOTHING decides
+// on it (the host now keys off foundingAdminHash, not the label). There is NO node-class: a platform is just
+// a workspace whose birth order carried a genesis. (`birthChild` is the one unified directive — the tier
+// was collapsed onto `#creator`; `birthPlatform`/`createWorkspace` remain only as deprecated compat aliases.)
+// Returns the record builder so a caller (birthChild) can author the law-authored genesis chain onto it.
+function planBirthRecord(
+  p: {
+    name: string;
+    parent: string;
+    principal: string;
+    tier: (typeof WORKSPACE_TIERS)[number];
+    requestedBy: string;
+    requestedAt: number;
+  },
+  genesis?: { foundingAdminHash: string; pool: number },
+) {
+  const rec = create(CloudWorkspace)
+    .set("name", p.name)
+    .set("parent", p.parent)
+    .set("principal", p.principal)
+    .set("tier", p.tier)
+    .set("status", "requested" as const)
+    .set("ownerGrantHash", "") // no owner credential until provisioned
+    .set("createdBy", p.requestedBy)
+    .set("createdAt", p.requestedAt);
+  if (genesis) {
+    rec
+      .set("kind", "platform" as const) // DERIVED LABEL ONLY — the order's foundingAdminHash is the real signal
+      .set("pool", genesis.pool)
+      .set("foundingAdminHash", genesis.foundingAdminHash); // the provider grants admin to this hash at materialize
+  }
+  return rec;
+}
+
+// ── THE LAW-AUTHORED GENESIS CHAIN (P1 — "law and law alone") ──────────────────────────────────────────
+// The parent's `birthChild` AUTHORS the child's genesis recipe as DATA — byte-faithful to what the host's
+// `/materialize` reconstructs today (seedGenesis → grantAdmin → birthCloud), but now owned by the LAW. The
+// host replays this opaque list on the child (naming nothing). Timestamps ride IN the payload (the doctrine):
+// `bornAt` (ISO) for the warrant, `requestedAt` (epoch-ms) for the ms-stamped grants — both caller-stamped,
+// so the chain is a pure function of the payload (deterministic on every replaying peer). Naming the genesis
+// directives here is law naming law; the prohibition binds only the host. The law package bytes are NOT in
+// here — the install-by-hash stays a custody concern of the provider (the bytes-in-pack refinement is later).
+export function buildGenesisChain(p: {
+  name: string;
+  principal: string;
+  parent: string;
+  tier: (typeof WORKSPACE_TIERS)[number];
+  foundingAdminHash: string;
+  bornAt: string;
+  requestedAt: number;
+  /** THE ORDER DECLARES THE LAW (G3 — no inheritance, no `_parentLawHash`): the content hashes of the
+   *  bootstrap framework controller + the governance law package the child installs IN-CHAIN as its first
+   *  intents. Frozen facts on the birth order (the parent captured them at `birthChild` time). When present,
+   *  the recipe PREPENDS `bootstrap/installDomain(framework)` + `nomos/installDomain(law)` — the two-layer
+   *  install the genesis bootstrap does — so the child installs ITS OWN law as intent 0 and self-validates
+   *  from there. Absent ⇒ the recipe resolves an already-installed law by shape (pre-G3 / test lanes). */
+  frameworkHash?: string;
+  lawHash?: string;
+  /**
+   * THE WARRANT-FLIP (VA-1, architecture/identity_keys.md). When TRUE — set iff the genesis recipe
+   * declares an AuthProvider (an IdP vouches for this subtree's principals) — `seedGenesis` records a
+   * REAL `workspaceId` (the workspace name as the unique self-id), so the chain is born WARRANTED:
+   * `verify_captured_principal` enforces signed authorship on all lanes (author / receive / verify_chain).
+   * FALSE (the default, the legacy lane) keeps `workspaceId: ""` so the workspace stays unwarranted
+   * (host-stamped authorship, like root) — pre-VA / non-AuthProvider births replay byte-identically.
+   * NO flag-day: the era is per-workspace, decided at genesis by whether the recipe carries an AuthProvider.
+   */
+  requiresWarrant?: boolean;
+}): string {
+  const founder = "user:" + p.principal;
+  // THE ORDER-DECLARED LAW INSTALL (G3): the child installs the EXACT law the order names — bytes are NOT in
+  // the recipe (the kernel resolves them by hash from its own custody when it folds the birth, never the
+  // host). `domainHash` names the law; `domainPackageB64` stays empty here (the kernel supplies bytes-by-hash
+  // for the in-chain install). Two layers, matching the genesis bootstrap: bootstrap controller, then law.
+  const installSteps =
+    p.frameworkHash && p.lawHash
+      ? [
+          { domain: "bootstrap", directiveId: "installDomain", actor: founder, payload: { domainHash: p.frameworkHash }, domainHash: p.frameworkHash, domainPackageB64: "" },
+          { domain: "nomos", directiveId: "installDomain", actor: founder, payload: { domainHash: p.lawHash }, domainHash: p.lawHash, domainPackageB64: "" },
+        ]
+      : [];
+  // THE LINEAGE-AUTHORIZATION BINDING (proof-friendly): the child's birthCloud records who authorized it, so
+  // the child's OWN chain self-attests its parentage — cross-checkable against the parent's chain. The
+  // law-available anchor now; the kernel-structural commitments (parent chain head + birthChild intent hash
+  // + law hash) join as `""` placeholders until the kernel produces the genesis (B's later slice). The
+  // ordering of keys is fixed so the commitment is a stable, content-addressed shape (proof public inputs).
+  const bornUnder = JSON.stringify({
+    parent: p.parent,
+    principal: p.principal,
+    authorizedAt: p.requestedAt,
+    lawHash: "",
+    authorizationHash: "",
+    parentHead: "",
+  });
+  return JSON.stringify([
+    ...installSteps,
+    // THE WARRANT-FLIP (VA-1): a REAL self-id iff the recipe declares an AuthProvider (born warranted ⇒
+    // signed authorship enforced on every lane); "" keeps the legacy host-stamped lane (byte-identical).
+    { domain: "workspaces", directiveId: "seedGenesis", actor: founder, payload: { principal: founder, workspaceId: p.requiresWarrant ? p.name : "", bornAt: p.bornAt } },
+    { domain: "workspaces", directiveId: "grantAdmin", actor: founder, payload: { keyHash: p.foundingAdminHash, label: `founding admin (born for ${p.principal})`, grantedBy: p.principal, grantedAt: p.requestedAt } },
+    // No `role` — it was a vestigial node-class label (collapsed with `kind`); birthCloud ignores it now.
+    { domain: "workspaces", directiveId: "birthCloud", actor: "", payload: { principal: p.principal, name: p.name, tier: p.tier, bornAt: p.requestedAt, bornUnder } },
+  ]);
+}
+
 /**
  * createWorkspace — record the lawful REQUEST for a workspace. Nomos MINTS the
  * `CloudWorkspace` id (the payload carries none); the record is born
  * `status:"requested"` with `ownerGrantHash:""` — no bearer exists until the
  * worker provisions and authors {@link provisionWorkspace}.
+ *
+ * @deprecated SUPERSEDED by {@link birthChild} (the `kind`-collapse) — a plain birth is `birthChild`
+ * with no genesis. Kept as a compat alias (same `#creator` gate) during migration; the host still
+ * authors it by name for namespaced-child + upload births. Retire once those callers move to birthChild.
  */
 export const createWorkspace = directive("createWorkspace")
   .creates(CloudWorkspace)
@@ -378,17 +530,8 @@ export const createWorkspace = directive("createWorkspace")
     }),
   )
   .plan((p) => {
-    create(CloudWorkspace)
-      .set("name", p.name)
-      .set("parent", p.parent)
-      .set("principal", p.principal)
-      .set("tier", p.tier)
-      .set("status", "requested" as const)
-      .set("ownerGrantHash", "") // no owner credential until provisioned
-      .set("createdBy", p.requestedBy)
-      .set("createdAt", p.requestedAt);
-    // A plain workspace record (no kind:platform) — boot materializes it directly; the birth capability
-    // provider only drains kind:platform records, so this is a lineage record, not a genesis order.
+    // No genesis ⇒ a plain lineage record (no foundingAdminHash) — never drained; materialized by boot-on-touch.
+    planBirthRecord(p);
     return [];
   })
   .requires("creator"); // posture-gated creation: only a #creator holder may request a workspace
@@ -409,15 +552,19 @@ export const birthCloud = directive("birthCloud")
       /** The genesis auth-provider principal uid upon which the world rests. */
       principal: z.string().min(1),
       name: z.string().min(1).default("root"),
-      /** The workspace's ROLE for the governance domain — the host stamps "cloud-root" at root genesis,
-       *  "platform" when birthing a platform's own chain. Drives the self-relative authz gate. */
-      role: z.enum(WORKSPACE_ROLES).default("cloud-root"),
+      /** VESTIGIAL (see WorkspaceSelf): accepted-but-ignored — the value drives nothing. The authz gate is
+       *  self-relative (`workspace:self#<relation>`), NOT role-keyed. Kept optional for caller compat. */
+      role: z.enum(WORKSPACE_ROLES).optional(),
       tier: z.enum(WORKSPACE_TIERS).default("edge"),
       bornAt: epochMs,
+      /** THE LINEAGE-AUTHORIZATION BINDING (proof-friendly): the JSON commitment to who authorized this
+       *  birth, recorded onto the child's self-record so its OWN chain self-attests its parentage. Absent on
+       *  root (born under nothing). Authored by {@link buildGenesisChain} for a child birth. */
+      bornUnder: z.string().optional(),
     }),
   )
   .plan((p) => {
-    create(CloudWorkspace)
+    const rec = create(CloudWorkspace)
       .set("name", p.name)
       .set("parent", "") // the root of the world tree
       .set("principal", p.principal)
@@ -427,9 +574,12 @@ export const birthCloud = directive("birthCloud")
       .set("createdBy", p.principal)
       .set("createdAt", p.bornAt)
       .set("provisionedAt", p.bornAt);
+    // The child's chain self-attests its lineage authorization (the proof-friendly binding); root omits it.
+    if (p.bornUnder) rec.set("bornUnder", p.bornUnder);
     // The self-identity singleton at the CONSTANT id (ungated — birthCloud is not admin-mutating), so the
-    // gate's self-record exists before any admin write. ensure() = deterministic-id sibling birth.
-    ensure(WorkspaceSelf, WORKSPACE_SELF_ID).set("role", p.role).set("name", p.name);
+    // gate's self-record exists before any admin write. ensure() = deterministic-id sibling birth. `name` is
+    // the born marker; `role` is no longer written (vestigial node-class — see WorkspaceSelf).
+    ensure(WorkspaceSelf, WORKSPACE_SELF_ID).set("name", p.name);
     return [];
   });
 
@@ -524,18 +674,18 @@ export const retireWorkspace = directive("retireWorkspace")
 /**
  * reclaimWorkspace — THE LAWFUL CUSTODY DISCARD. Where {@link retireWorkspace}
  * withdraws the law (a status, the bytes untouched), reclaim is the law AUTHORIZING
- * the host to drop the custody: the worker bailiff, on seeing THIS fact folded,
- * `ARTIFACTS.delete`s the workspace's git ledger and `deleteAll`s its DO storage.
+ * the bailiff to drop the custody: on seeing THIS fact folded, the bailiff drops the
+ * workspace's git ledger + DO storage (operator-gated soft-mark while pre-release).
  *
- * THE TWO-PHASE RULE (enforced worker-side, since a plan cannot read prior state):
- * only a `retired` workspace may be reclaimed — retire withdraws, reclaim discards.
+ * THE TWO-PHASE RULE is LAW (see {@link reclaimRequiresRetired}): only a `retired`
+ * workspace may be reclaimed — the invariant reads the pre-apply status at the one gate.
  *
- * THE FIXED POINT: this is authored for CHILDREN only. The worker refuses to reclaim
- * ROOT — the genesis workspace is the seat of the law that authorizes reclaim, so the
- * law can reap everything it governs EXCEPT itself. Dropping root is the one act Nomos
- * cannot perform in-law; the custodian does it through Cloudflare directly. The
- * custody-reclaimed fact (this status flip) is append-only and outlives the bytes:
- * Nomos never erases the FACT that a workspace existed and was reclaimed.
+ * THE FIXED POINT: this is authored for CHILDREN only. The law refuses to reclaim ROOT —
+ * the genesis workspace is the seat of the law that authorizes reclaim, so the law can
+ * reap everything it governs EXCEPT itself. Dropping root is the one act Nomos cannot
+ * perform in-law; the custodian does it through Cloudflare directly. The custody-reclaimed
+ * fact (this status flip) is append-only and outlives the bytes: Nomos never erases the
+ * FACT that a workspace existed and was reclaimed.
  */
 export const reclaimWorkspace = directive("reclaimWorkspace")
   .mutates(CloudWorkspace)
@@ -552,67 +702,96 @@ export const reclaimWorkspace = directive("reclaimWorkspace")
   })
   .requires("admin");
 
-/**
- * birthPlatform — A PLATFORM IS BORN: the cloud, one level down. Records the
- * platform-kind workspace (parented to root, owned by the invited principal,
- * carrying its POOL). The worker then provisions it exactly like the cloud
- * provisioned itself: deploys the SAME governance law into it, seeds ITS founding
- * AdminGrant, and the platform claims itself with its own birth intent on its own
- * chain. Recursion, not new machinery.
- */
-export const birthPlatform = directive("birthPlatform")
+// ─────────────────────────── BIRTH AS A NOMOS PRIMITIVE ──────────────────────────────────────────────
+// (birthPlatform is GONE — the tier collapsed onto #creator; birthChild is the one birth directive.)
+// THE RECORD IS THE OBLIGATION (architecture/githolon_host_contract.md "Birth is a capability" +
+// provisioning_as_obligations.md). Birth is an IMPURE capability: the parent ORDERS (the law-gated
+// birthChild mints a CloudWorkspace at status:requested carrying foundingAdminHash + the LAW-AUTHORED
+// genesisChain — gated by .requires("creator")), the BIRTH CAPABILITY PROVIDER fulfils it (materialize:
+// install the parent's law + REPLAY the genesisChain opaquely — the child's OWN kernel admitting each), and
+// authors provisionWorkspace (the receipt) the parent TRUSTS. No separate obligation aggregate — the minted
+// CloudWorkspace IS the order. The provider owns only the impure boot + replay; the LAW owns the recipe (P1)
+// AND who/what (the gate); the parent trusts the DID-IT-HAPPEN. A child born this way runs THIS SAME law and
+// births its children identically — the recursion is the law.
+
+// ─────────────────────────── birthChild — THE ONE BIRTH DIRECTIVE (the `kind`-collapse) ───────────────
+// "There are only workspaces, all equal until a domain is installed." birthChild is the SINGLE directive
+// that births any child — a plain leaf OR a platform; the difference is the GENESIS DATA the payload carries,
+// never a node-class. THE TIER IS COLLAPSED (Jack, 2026-06-24): `#creator` is THE one birth authority — a
+// creator may spawn a leaf AND a platform (the prior `#platformCreator` second tier is retired; platform
+// birth under root is still invite-only because `creator` on root is admin-granted, just renamed/unified).
+//   • genesis ABSENT  → a plain lineage record (no foundingAdminHash); boot-on-touch, never drained.
+//   • genesis PRESENT → carries {foundingAdminHash, pool}: the birth capability provider drains it
+//                       (the order carries a foundingAdminHash) → materialize + seed genesis. A platform.
+// Self-relative: the gate is `workspace:self#creator`, so the SAME directive on root births a platform and
+// on a platform births a child — no per-level host code (the recursion is the law). Supersedes
+// createWorkspace + birthPlatform (kept as compat aliases during migration). See
+// architecture/provisioning_as_obligations.md "The `kind`-collapse".
+export const birthChild = directive("birthChild")
   .creates(CloudWorkspace)
   .payload(
-    z.object({
-      name: z.string().min(1),
-      /** The auth-provider uid of the platform OWNER (must hold a PlatformGrant). */
-      principal: z.string().min(1),
-      /** Parent CloudWorkspace aggregate id (root's record). */
-      parent: z.string().default(""),
-      /** The pool: how many live children the platform may parent. */
-      pool: z.number().int().positive().default(50),
-      tier: z.enum(WORKSPACE_TIERS).default("heavy"),
-      /** sha256 of the founding-admin key the requester PRESENTED (the provider grants admin to the hash;
-       *  the requester keeps the key — it is the platform's admin credential, used to govern + deploy). */
-      foundingAdminHash: sha256Hex,
-      requestedBy: z.string().min(1),
-      requestedAt: epochMs,
-    }),
+    z
+      .object({
+        name: z.string().min(1),
+        /** The auth-provider principal uid the request claimed; `""` = unclaimed (a plain leaf may be). */
+        principal: z.string().default(""),
+        /** Parent CloudWorkspace aggregate id; `""` (default) = root. */
+        parent: z.string().default(""),
+        /** Hosting tier; defaults to the edge DO (a genesis/platform birth typically passes `heavy`). */
+        tier: z.enum(WORKSPACE_TIERS).default("edge"),
+        requestedBy: z.string().min(1),
+        requestedAt: epochMs,
+        /** GENESIS (optional): present ⇒ this child is born running the governance law (a platform). The
+         *  sha256 of the founding-admin key the requester presented — the provider grants admin to the hash. */
+        foundingAdminHash: sha256Hex.optional(),
+        /** PLATFORM POOL: how many live children the born platform may parent. Only meaningful with genesis. */
+        pool: z.number().int().positive().default(50),
+        /** GENESIS birth time as an ISO string (caller-stamped — the timestamp doctrine). Arms the warrant
+         *  in the law-authored genesis chain; required for (and only used by) a genesis birth. */
+        bornAt: z.string().optional(),
+        /** THE ORDER DECLARES THE LAW (G3 — no inheritance): the content hashes of the bootstrap framework
+         *  controller + the governance law package the child installs IN-CHAIN as its genesis intent 0. Frozen
+         *  facts the requester presents (the parent's current law, captured at birth time). When present, the
+         *  genesis recipe prepends the two-layer installDomain; the kernel resolves the BYTES by hash from its
+         *  own custody (never the host). Absent ⇒ the recipe resolves an already-installed law by shape. */
+        frameworkHash: sha256Hex.optional(),
+        lawHash: sha256Hex.optional(),
+        /** THE WARRANT-FLIP (VA-1): TRUE iff the child's genesis recipe declares an AuthProvider — the child
+         *  is born WARRANTED (signed authorship enforced on every lane). Absent/false ⇒ the legacy
+         *  host-stamped lane (byte-identical to a pre-VA birth). Only meaningful with a genesis. */
+        requiresWarrant: z.boolean().optional(),
+      })
+      // A genesis birth (a platform) must carry a principal AND a bornAt — it owns a subtree, a lineage
+      // anchor, and a law-authored genesis chain whose warrant is stamped at bornAt.
+      .refine((d) => !d.foundingAdminHash || (d.principal.length > 0 && !!d.bornAt), {
+        message: "a genesis birth (foundingAdminHash present) requires a non-empty principal and bornAt (ISO)",
+        path: ["principal"],
+      }),
   )
   .plan((p) => {
-    create(CloudWorkspace)
-      .set("name", p.name)
-      .set("parent", p.parent)
-      .set("principal", p.principal)
-      .set("kind", "platform" as const)
-      .set("pool", p.pool)
-      .set("tier", p.tier)
-      .set("status", "requested" as const)
-      .set("ownerGrantHash", "")
-      .set("foundingAdminHash", p.foundingAdminHash) // the provider grants admin to this hash at materialize
-      .set("createdBy", p.requestedBy)
-      .set("createdAt", p.requestedAt);
-    // THE RECORD IS THE OBLIGATION: a kind:platform CloudWorkspace at status:requested with no ownerGrantHash
-    // is an order the birth capability provider drains (materialize + install the parent's law + seed genesis
-    // + grant the founding admin + birthCloud), closing it with provisionWorkspace (the receipt). No separate
-    // obligation aggregate — the minted CloudWorkspace IS it (sidesteps the id-mint gate; reuses the lifecycle).
+    const rec = planBirthRecord(p, p.foundingAdminHash ? { foundingAdminHash: p.foundingAdminHash, pool: p.pool } : undefined);
+    // LAW AUTHORS THE GENESIS RECIPE (P1): a genesis birth carries its child's [installDomain×2 →]
+    // seedGenesis→grantAdmin→birthCloud chain. (refine guarantees principal + bornAt here.)
+    if (p.foundingAdminHash) {
+      const genesisChain = buildGenesisChain({ name: p.name, principal: p.principal, parent: p.parent, tier: p.tier, foundingAdminHash: p.foundingAdminHash, bornAt: p.bornAt as string, requestedAt: p.requestedAt, ...(p.frameworkHash ? { frameworkHash: p.frameworkHash } : {}), ...(p.lawHash ? { lawHash: p.lawHash } : {}), ...(p.requiresWarrant ? { requiresWarrant: true } : {}) });
+      // THE GENESIS RECIPE IS ALSO A LINEAGE/AUDIT FACT on the parent's chain (the parent records what it
+      // ORDERED — law naming law, legitimate). The kernel does NOT read this field to detect the birth.
+      rec.set("genesisChain", genesisChain);
+      // THE DECLARED BIRTH EFFECT (G3 — the unix model): the recipe rides the committed intent as a declared
+      // output (`captured_ports.births`). The kernel — reading the `.births` DECLARATION off the law manifest
+      // (the `nomosBirthGate` era key, NEVER this CloudWorkspace aggregate) — takes the recipe off the intent
+      // after admit and spawns + self-validates the child through the child's OWN gate. So birth is an
+      // EXPLICIT, declared consequence of the offer, not a side-effect inferred by scanning domain state.
+      birth({ workspace: p.name, genesisChain: JSON.parse(genesisChain) });
+    }
     return [];
   })
-  .requires("platformCreator"); // invite-only: an active #platformCreator tuple admits the birth
+  .births() // BIRTH IS A DECLARED KERNEL PRIMITIVE (G3): emits the `nomosBirthGate` era key; the kernel folds the carried recipe
+  .requires("creator"); // THE ONE birth authority — a #creator may birth a leaf OR a platform (tier collapsed)
 
-// ─────────────────────────── BIRTH AS A NOMOS PRIMITIVE ──────────────────────────────────────────────
-// THE RECORD IS THE OBLIGATION (architecture/githolon_host_contract.md "Birth is a capability"). Birth is
-// an IMPURE capability: the parent ORDERS (the law-gated birthPlatform mints a CloudWorkspace at
-// status:requested, kind:platform, carrying foundingAdminHash — gated by .requires("platformCreator")),
-// the BIRTH CAPABILITY PROVIDER fulfils it (materialize: install the PARENT's law + seed genesis + grant
-// the founding admin + birthCloud — the child's OWN kernel admitting each), and authors provisionWorkspace
-// (the receipt) the parent TRUSTS. No separate obligation aggregate — the minted CloudWorkspace IS the
-// order (it sidesteps the id-mint gate and reuses the requested→provisioned lifecycle). The provider knows
-// HOW (the Capability Exception sanctions a declared effect); the law owns WHO/WHAT; the parent trusts the
-// DID-IT-HAPPEN. A child born this way runs THIS SAME law and births its children identically.
-
-/** workspacesByStatus — the birth provider drains `requested` CloudWorkspaces (kind:platform, no
- *  ownerGrantHash) → materialize → provisionWorkspace. The law's order queue; the host polls, never decides. */
+/** workspacesByStatus — the birth provider drains `requested` CloudWorkspaces that CARRY A foundingAdminHash
+ *  (a genesis order, no ownerGrantHash) → materialize → provisionWorkspace. Plain requested records (no
+ *  foundingAdminHash) are lineage only, boot-on-touch. The law's order queue; the host polls, never decides. */
 export const workspacesByStatus = query("workspacesByStatus").key("status").returns(CloudWorkspace);
 
 /** setPlatformPool — the pool edition of a granted quota request. */
@@ -632,39 +811,10 @@ export const setPlatformPool = directive("setPlatformPool")
   })
   .requires("admin");
 
-/**
- * grantPlatformCreation / revokePlatformCreation — open and close the
- * become-a-platform door for one principal (see {@link PlatformGrant}).
- */
-// grantPlatformCreation — become-a-platform authority IS the self-relative `#platformCreator` tuple
-// (one authz spine, all the way down). Writes `workspace:self#platformCreator@user:<principal>` (no
-// PlatformGrant aggregate) — the host's platform-birth invite check reads the SAME tuple via Check.
-export const grantPlatformCreation = directive("grantPlatformCreation")
-  .ensures(RelationTuple)
-  .payload(
-    z.object({
-      principal: z.string().min(1),
-      label: z.string().min(1),
-      grantedBy: z.string().min(1),
-      grantedAt: epochMs,
-    }),
-  )
-  .plan((p) => writeTuple({ object: SELF_ADMIN_OBJECT, relation: "platformCreator", subject: "user:" + p.principal, grantedBy: p.grantedBy, grantedAt: String(p.grantedAt) }))
-  .requires("admin"); // only an admin opens the become-a-platform door
-
-// revokePlatformCreation — flip the `#platformCreator@user:<principal>` leaf to revoked. BREAKING vs the
-// aggregate model: keyed by PRINCIPAL (the tuple subject), not a minted grantId.
-export const revokePlatformCreation = directive("revokePlatformCreation")
-  .ensures(RelationTuple)
-  .payload(
-    z.object({
-      principal: z.string().min(1),
-      revokedBy: z.string().min(1),
-      revokedAt: epochMs,
-    }),
-  )
-  .plan((p) => removeTuple({ object: SELF_ADMIN_OBJECT, relation: "platformCreator", subject: "user:" + p.principal, grantedBy: p.revokedBy, grantedAt: String(p.revokedAt), revokedBy: p.revokedBy, revokedAt: String(p.revokedAt) }))
-  .requires("admin");
+// grantPlatformCreation / revokePlatformCreation — REMOVED (the tier collapsed onto #creator, 2026-06-24).
+// Platform-birth authority is now just #creator (grantCreation, which takes a user OR key subject). The
+// `#platformCreator` relation + its (vestigial) PlatformGrant aggregate / platformGrantByPrincipal query
+// retire in the same #58 disposition pass as kind/role; any historical #platformCreator tuple is inert data.
 
 /**
  * AuthProvider — BYOAuth: WHO VOUCHES FOR THIS SUBTREE'S PRINCIPALS. A law-state
@@ -681,13 +831,31 @@ export const AuthProvider = aggregate("AuthProvider", {
   scope: t.string().merge(Lww),
   /** The token issuer (the `iss` claim tokens must carry). */
   issuer: t.string().merge(Lww),
-  /** The provider's public JWKS endpoint (asymmetric verification keys). */
+  /** The provider's public JWKS endpoint (asymmetric verification keys). The KERNEL never fetches — it's a
+   *  reference for the rotation capability that re-fetches + re-sets {@link keys}. */
   jwksUrl: t.string().merge(Lww),
+  /** THE VERIFYING KEYS — the JWKS JSON (`{keys:[{kid,kty,alg,crv,x,y,n,e,...}]}`) as an OPAQUE STRING the
+   *  KERNEL parses + verifies a presented token against (sovereign-auth arc — see
+   *  architecture/sovereign_adapter.md). `t.string` (NOT `t.json`): the kernel `Value` has no JSON variant,
+   *  so the raw JWKS text must ride verbatim as a scalar — the kernel does `serde_json` on it, no projection
+   *  parse, no double-encoding. LAW-STATE: set by {@link setAuthProvider} (gated), refreshed by the
+   *  JWKS-fetch rotation capability (the host FETCHES — impure — but the law OWNS the keys + the kernel does
+   *  the verification). Absent ⇒ no in-kernel verify for this workspace (shell-issuer fallback, transitional). */
+  keys: t.string().merge(Lww).optional(),
   /** OPTIONAL expected `aud` claim. When the platform sets it, a token's `aud` MUST carry this value
    *  (defense-in-depth beyond the issuer match — e.g. a Firebase project id, an Auth0 API audience).
    *  Absent ⇒ issuer match alone. This is LAW-STATE the PLATFORM owns; the host merely enforces it as a
    *  capability (it never chooses the audience). */
   audience: t.string().merge(Lww),
+  /** OPTIONAL — the JWT claim that carries the PRINCIPAL (default `"sub"` when absent). Azure AD's stable
+   *  user id is `oid` (its `sub` is pairwise-per-app, useless as identity); some setups key on a custom
+   *  claim. The KERNEL extracts THIS claim as the principal — never hardcoded to `sub`. */
+  principalClaim: t.string().merge(Lww).optional(),
+  /** OPTIONAL — the PINNED CA ROOT (base64 DER) for TRUSTLESS key rotation. When set, {@link rotateKeys}
+   *  accepts a new JWKS IFF each key's `x5c` chain validates to THIS root IN THE KERNEL (RFC 5280, the IdP's
+   *  CA vouches) and each key matches its leaf cert — no host trust, no admin. Pinned once via the
+   *  admin-gated {@link setAuthProvider}. Absent ⇒ no trustless rotation (rotate via setAuthProvider). */
+  rootCert: t.string().merge(Lww).optional(),
   /** Human label for audit ("acme supabase", ...). */
   label: t.string().merge(Lww),
   /** Who set it (attribution). */
@@ -709,6 +877,13 @@ export const setAuthProvider = directive("setAuthProvider")
       issuer: z.string().regex(/^https?:\/\/\S+$/, "expected an http(s) URL"),
       jwksUrl: z.string().regex(/^https?:\/\/\S+$/, "expected an http(s) URL"),
       audience: z.string().min(1).optional(),
+      /** The JWKS JSON (the public verifying keys) the KERNEL checks tokens against. Optional so the
+       *  rotation capability can re-set just the keys; absent keeps the prior keys (Lww). */
+      keys: z.string().min(1).optional(),
+      /** OPTIONAL — the claim carrying the principal (default "sub"; e.g. "oid" for Azure AD). */
+      principalClaim: z.string().min(1).optional(),
+      /** OPTIONAL — the pinned CA root (base64 DER) enabling trustless {@link rotateKeys}. */
+      rootCert: z.string().min(1).optional(),
       label: z.string().min(1),
       setBy: z.string().min(1),
       setAt: epochMs,
@@ -721,6 +896,9 @@ export const setAuthProvider = directive("setAuthProvider")
       set(ap, "issuer", p.issuer),
       set(ap, "jwksUrl", p.jwksUrl),
       ...(p.audience ? [set(ap, "audience", p.audience)] : []),
+      ...(p.keys ? [set(ap, "keys", p.keys)] : []),
+      ...(p.principalClaim ? [set(ap, "principalClaim", p.principalClaim)] : []),
+      ...(p.rootCert ? [set(ap, "rootCert", p.rootCert)] : []),
       set(ap, "label", p.label),
       set(ap, "setBy", p.setBy),
       set(ap, "setAt", p.setAt),
@@ -728,6 +906,30 @@ export const setAuthProvider = directive("setAuthProvider")
   })
   .requires("admin");
 
+/**
+ * rotateKeys — TRUSTLESS key rotation. Replace {@link AuthProvider.keys} with a new JWKS whose every key
+ * carries an `x5c` cert chain. DELIBERATELY UNGATED at the relation level — the KERNEL is the authority: it
+ * admits this ONLY if each key's x5c chain validates (RFC 5280) to the law-pinned {@link AuthProvider.rootCert}
+ * and each key matches its CA-vouched leaf cert (the bind). So a bailiff (host on a cron, or anyone) may
+ * FETCH the IdP's rotated JWKS and offer it, but cannot forge keys — forged keys wouldn't chain to the root.
+ * No host trust, no admin: the IdP's CA vouches. Workspaces with no pinned root rotate via setAuthProvider.
+ */
+export const rotateKeys = directive("rotateKeys")
+  .ensures(AuthProvider)
+  .payload(
+    z.object({
+      /** The new JWKS JSON; EACH key MUST carry an `x5c` the kernel validates to {@link AuthProvider.rootCert}. */
+      keys: z.string().min(1),
+      rotatedAt: epochMs,
+    }),
+  )
+  .plan((p) => {
+    const ap = instance(AuthProvider, "auth-provider:platform");
+    // The kernel's x5c admission gate authorizes this (validate_rotate_keys); the plan just stores the
+    // CA-vouched JWKS. The `ensures` marker upserts onto the existing AuthProvider singleton.
+    return [withMarker(set(ap, "keys", p.keys), "ensures"), set(ap, "setAt", p.rotatedAt)];
+  });
+
 /**
  * HostnameClaim — a CUSTOM HOSTNAME bound to a platform: `api.acme.com` serving
  * acme's subtree. A root-custody fact (the hostname is the HOST's edge resource —
@@ -942,14 +1144,21 @@ export const setWorkspaceByteCap = directive("setWorkspaceByteCap")
 export const grantAdmin = directive("grantAdmin")
   .ensures(RelationTuple)
   .payload(
-    z.object({
-      keyHash: sha256Hex,
-      label: z.string().min(1),
-      grantedBy: z.string().min(1),
-      grantedAt: epochMs,
-    }),
+    z
+      .object({
+        // `principal` (a `user:<uid>` subject) is the PRINCIPAL-CENTRIC grant — authority lives on the
+        // identity, so it survives device-key ROTATION (the signer indirection's whole point) and matches
+        // the subject a SIGNED author resolves to. `keyHash` (a `key:<hash>` subject) is the legacy
+        // key-centric grant (the bearer-secret lane). Exactly one — mirrors grantCreation.
+        keyHash: sha256Hex.optional(),
+        principal: z.string().min(1).optional(),
+        label: z.string().min(1),
+        grantedBy: z.string().min(1),
+        grantedAt: epochMs,
+      })
+      .refine((d) => !!d.keyHash !== !!d.principal, { message: "grantAdmin needs exactly one of keyHash (a key: subject) or principal (a user: subject)", path: ["keyHash"] }),
   )
-  .plan((p) => writeTuple({ object: SELF_ADMIN_OBJECT, relation: "admin", subject: "key:" + p.keyHash, grantedBy: p.grantedBy, grantedAt: String(p.grantedAt) }))
+  .plan((p) => writeTuple({ object: SELF_ADMIN_OBJECT, relation: "admin", subject: p.principal ? "user:" + p.principal : "key:" + p.keyHash, grantedBy: p.grantedBy, grantedAt: String(p.grantedAt) }))
   .requires("admin"); // only an admin grants admin (pre-apply roster ⇒ no self-grant)
 
 /**
@@ -963,13 +1172,16 @@ export const grantAdmin = directive("grantAdmin")
 export const revokeAdmin = directive("revokeAdmin")
   .ensures(RelationTuple)
   .payload(
-    z.object({
-      keyHash: sha256Hex,
-      revokedBy: z.string().min(1),
-      revokedAt: epochMs,
-    }),
+    z
+      .object({
+        keyHash: sha256Hex.optional(),
+        principal: z.string().min(1).optional(),
+        revokedBy: z.string().min(1),
+        revokedAt: epochMs,
+      })
+      .refine((d) => !!d.keyHash !== !!d.principal, { message: "revokeAdmin needs exactly one of keyHash or principal", path: ["keyHash"] }),
   )
-  .plan((p) => removeTuple({ object: SELF_ADMIN_OBJECT, relation: "admin", subject: "key:" + p.keyHash, grantedBy: p.revokedBy, grantedAt: String(p.revokedAt), revokedBy: p.revokedBy, revokedAt: String(p.revokedAt) }))
+  .plan((p) => removeTuple({ object: SELF_ADMIN_OBJECT, relation: "admin", subject: p.principal ? "user:" + p.principal : "key:" + p.keyHash, grantedBy: p.revokedBy, grantedAt: String(p.revokedAt), revokedBy: p.revokedBy, revokedAt: String(p.revokedAt) }))
   .requires("admin");
 
 /**
@@ -980,30 +1192,41 @@ export const revokeAdmin = directive("revokeAdmin")
 // grantCreation — creation authority IS the self-relative `#creator` tuple the CreationGate reads.
 // Writes `workspace:self#creator@key:<keyHash>` (no CreationGrant aggregate). Under posture invite/closed
 // the gate admits only holders of an active #creator subject; under open/unset it admits anyone.
+// #creator is ONE relation over ONE principal graph; a subject is `key:<hash>` (proof by holding a secret —
+// a Bearer) OR `user:<uid>` (proof of identity — an auth-provider token). The relation allows BOTH
+// (allow:[user(),key()]); these are not two authorities, just two ways a principal authenticates. So
+// grantCreation takes EITHER — exactly one of keyHash / principal. This is what lets a USER birth platforms
+// via birthChild (no "creator key" dance) and dissolves the user/key migration wrinkle.
 export const grantCreation = directive("grantCreation")
   .ensures(RelationTuple)
   .payload(
-    z.object({
-      keyHash: sha256Hex,
-      label: z.string().min(1),
-      grantedBy: z.string().min(1),
-      grantedAt: epochMs,
-    }),
+    z
+      .object({
+        keyHash: sha256Hex.optional(),
+        principal: z.string().min(1).optional(),
+        label: z.string().min(1),
+        grantedBy: z.string().min(1),
+        grantedAt: epochMs,
+      })
+      .refine((d) => !!d.keyHash !== !!d.principal, { message: "grantCreation needs exactly one of keyHash (a key: subject) or principal (a user: subject)", path: ["keyHash"] }),
   )
-  .plan((p) => writeTuple({ object: SELF_ADMIN_OBJECT, relation: "creator", subject: "key:" + p.keyHash, grantedBy: p.grantedBy, grantedAt: String(p.grantedAt) }))
+  .plan((p) => writeTuple({ object: SELF_ADMIN_OBJECT, relation: "creator", subject: p.principal ? "user:" + p.principal : "key:" + p.keyHash, grantedBy: p.grantedBy, grantedAt: String(p.grantedAt) }))
   .requires("admin"); // only an admin grants creation authority
 
-/** revokeCreation — flip the `#creator@key:<keyHash>` leaf to revoked (see {@link revokeAdmin}). */
+/** revokeCreation — flip the `#creator@<subject>` leaf to revoked (key OR user, mirroring grantCreation). */
 export const revokeCreation = directive("revokeCreation")
   .ensures(RelationTuple)
   .payload(
-    z.object({
-      keyHash: sha256Hex,
-      revokedBy: z.string().min(1),
-      revokedAt: epochMs,
-    }),
+    z
+      .object({
+        keyHash: sha256Hex.optional(),
+        principal: z.string().min(1).optional(),
+        revokedBy: z.string().min(1),
+        revokedAt: epochMs,
+      })
+      .refine((d) => !!d.keyHash !== !!d.principal, { message: "revokeCreation needs exactly one of keyHash or principal", path: ["keyHash"] }),
   )
-  .plan((p) => removeTuple({ object: SELF_ADMIN_OBJECT, relation: "creator", subject: "key:" + p.keyHash, grantedBy: p.revokedBy, grantedAt: String(p.revokedAt), revokedBy: p.revokedBy, revokedAt: String(p.revokedAt) }))
+  .plan((p) => removeTuple({ object: SELF_ADMIN_OBJECT, relation: "creator", subject: p.principal ? "user:" + p.principal : "key:" + p.keyHash, grantedBy: p.revokedBy, grantedAt: String(p.revokedAt), revokedBy: p.revokedBy, revokedAt: String(p.revokedAt) }))
   .requires("admin");
 
 // --- declared read queries (the worker's ENTIRE enforcement surface) -----------------
@@ -1156,8 +1379,9 @@ export const founderSignerWriteOnce = workspaceInvariant("FounderSignerWriteOnce
 export const birthCloudOnce = workspaceInvariant("BirthCloudOnce")
   .on("birthCloud")
   .reads(() => [refAs("self", "WorkspaceSelf", "pre:" + WORKSPACE_SELF_ID)])
+  // WRITE-ONCE on the self-record's PRESENCE via `name` (not the vestigial `role`) — a workspace is born once.
   .assert(({ self }) =>
-    (self as { role?: string })?.role ? { reject: "cloud-already-born" } : { accept: true },
+    (self as { name?: string })?.name ? { reject: "cloud-already-born" } : { accept: true },
   );
 
 /** provisionWorkspace: the birth RECEIPT may only close a `requested` record (no hijacking a live
@@ -1177,3 +1401,18 @@ export const provisionReceiptGuard = workspaceInvariant("ProvisionReceiptGuard")
       return { reject: "provision-founding-hash-mismatch" };
     return { accept: true };
   });
+
+/** reclaimWorkspace: THE RETIRED→RECLAIMED TWO-PHASE INTERLOCK, AS LAW (#41/#58). Reclaim authorizes the
+ *  irreversible custody discard, so only a `retired` workspace may be reclaimed — retire WITHDRAWS (a status,
+ *  reversible), reclaim DISCARDS. The invariant reads the pre-apply status of the record being reclaimed (same
+ *  shape as ProvisionReceiptGuard) and refuses unless it is exactly `retired`. Fires at the ONE wasm gate on
+ *  every peer — author, edge admission, AND verify_chain — so the interlock is identical on cloud + client +
+ *  replay; the bailiff's drop merely executes the lawful `reclaimed` fact. (Root never reaches here: the law
+ *  refuses reclaiming itself; this guards children.) */
+export const reclaimRequiresRetired = workspaceInvariant("ReclaimRequiresRetired")
+  .on("reclaimWorkspace")
+  .reads((ctx) => [refAs("ws", "CloudWorkspace", "pre:" + String((ctx.intent ?? {}).workspaceId ?? ""))])
+  .assert(({ ws }) => {
+    const rec = ws as { status?: string } | undefined;
+    return rec?.status === "retired" ? { accept: true } : { reject: "reclaim-requires-retired" };
+  });