@githolon/dsl 0.33.0 → 0.34.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.33.0",
+  "version": "0.34.1",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/aggregate.ts

@@ -166,6 +166,16 @@ export interface AggregateHandle<
    * `readModelAggregates`). Identified by OBJECT IDENTITY (the branded singleton), so a tenant
    * aggregate that merely SHARES a name is never misclassified. OMITTED on tenant aggregates. */
   readonly framework?: true;
+  /**
+   * READ-PROJECTION NAMESPACING opt-out (`read_projection_namespace.ts`). TRUE ⇒ this
+   * aggregate's type name stays GLOBAL (bare, un-namespaced) on every surface — for
+   * KERNEL-COUPLED framework aggregates whose bare name/instance-id convention the
+   * kernel hardcodes. Statically-named framework aggregates ride the explicit
+   * allowlist instead; this flag is the DYNAMICALLY-NAMED factory lane (e.g.
+   * `platformAdmin()`'s founder aggregate, impure-capability envelopes). NOT hashed
+   * itself — its EFFECT (the bare vs qualified name) is what the law carries.
+   */
+  readonly global?: boolean;
   /** Presence-only flag (hashed); OMITTED ENTIRELY when no invariant is declared. */
   readonly hasInvariant?: true;
   /** The executable body — ships in the engine bundle, NOT the manifest. */
@@ -230,7 +240,7 @@ export interface AudienceMethods<Id extends string, F extends Record<string, Fie
 export function aggregate<const Id extends string, F extends Record<string, Field>>(
   id: Id,
   fields: F,
-  opts?: { invariant?: AggregateInvariantFn; invariantDeclassify?: string; cap?: number; visibility?: ReadVisibility },
+  opts?: { invariant?: AggregateInvariantFn; invariantDeclassify?: string; cap?: number; visibility?: ReadVisibility; global?: boolean },
 ): AggregateHandle<Id, F> & AudienceMethods<Id, F> {
   const { stored, hasMany } = partitionFields(fields);
   if (opts?.cap !== undefined && (!Number.isInteger(opts.cap) || opts.cap < 1)) {
@@ -279,6 +289,7 @@ export function aggregate<const Id extends string, F extends Record<string, Fiel
       : {}),
     ...(opts?.invariantDeclassify !== undefined ? { invariantDeclassify: opts.invariantDeclassify } : {}),
     ...(opts?.cap !== undefined ? { cap: opts.cap } : {}),
+    ...(opts?.global === true ? { global: true } : {}),
     ...(encryptedFields.length > 0 ? { encryptedFields } : {}),
     ...(metaFields.length > 0 ? { metaFields } : {}),
   };

package/src/authoring.ts

@@ -27,6 +27,7 @@ import type { AggregateHandle } from "./aggregate.js";
 import type { Field } from "./fields.js";
 import type { FieldOp, PlannedOp, PlannedEventMarker } from "./ops.js";
 import { endorsementOf } from "./principal_evidence.js";
+import { __qualifyAggregateType } from "./framework/relations.js";
 
 // ── the per-dispatch authoring sink — library state the engine never sees (NOT a side channel out of
 //    the sandbox; it is internal to the directive runtime, drained synchronously by `executeDirectiveToIntent`). ──
@@ -121,7 +122,9 @@ class Ref implements AggregateRef {
 
 /** Ask Nomos to CREATE a new aggregate of the handle's type → a fluent reference (id minted, no choice). */
 export function create(agg: AggregateHandle): AggregateRef {
-  return new Ref(agg, mint(agg.id), "creates");
+  // READ-PROJECTION NAMESPACING: mint under the QUALIFIED type tag — the kernel's id-mint gate
+  // verifies a Create's id was minted for EXACTLY the declared (qualified) `__type`.
+  return new Ref(agg, mint(__qualifyAggregateType(agg.id)), "creates");
 }
 
 /** A reference to an EXISTING aggregate the dev already holds an id for (e.g. from the payload / a read). */

package/src/birth_meter.ts

@@ -0,0 +1,300 @@
+// NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
+// remotes are replaceable custody/transport, not truth.  ⇒ ONE Nomos GitHolon
+// wasm32-wasip1 artifact {kernel · projection · embedded
+// QuickJS engine}.  If a file isn't this / hosting this / authoring for this / proving this — it's gone.
+
+/**
+ * THE BIRTH METER (metered birth, slice A — `architecture/metered_birth_and_attested_reads.md`).
+ *
+ * THE ONE-HOP VOUCHING PRINCIPLE: trust is established BY INDUCTION AT BIRTH and verified LOCALLY —
+ * a parent vouches for its child IN ITS OWN CHAIN; nobody walks to root. The parent's own ledger
+ * already witnesses every birth it performs (the admitted `.births()` intent is IN the parent's
+ * chain), so the count of a parent's children is a PARENT-LOCAL fact and the existing
+ * same-workspace #58 captured-read lane covers it. NO cross-workspace reads anywhere in this slice.
+ *
+ * Three structural pieces, all era-ruled by the bundle (a pre-feature bundle carries none of this
+ * and replays byte-identical; a bundle recompiled under this DSL carries all of it by construction):
+ *
+ *  A1 — THE BIRTH RECORD IS STRUCTURAL. Every `.births()` directive's intent ALSO writes a
+ *       {@link NomosBirthRecord} event (one deterministic-id record per child; a re-birth of the
+ *       same name UPDATES the record — Lww) in the SAME intent as the birth effect. The library
+ *       appends it in `executeDirectiveToIntent` (the ONE plan-output assembly BOTH lanes — client
+ *       authoring and the sealed engine — funnel through), so tenant law gets it by construction,
+ *       zero tenant code. The kernel arm (`verify_births_witness` + the `nomosBirthRecordGate` era
+ *       key) REFUSES a birth whose intent carries no record — ONLY for bundles declaring the key.
+ *
+ *  A2 — THE BIRTH QUOTA IS PARENT-LOCAL LAW. The `.births()` lane auto-captures
+ *       {@link birthRecordsByPrincipal} + the parent's allowance facts (the #58 captured-read lane,
+ *       CAS-re-derived on every lane), and a synthesized framework `workspaceInvariant` (the exact
+ *       WorkspaceQuota shape) refuses `birth-quota-exceeded` once the subject already holds its
+ *       allowance. Allowance resolution: the latest {@link BirthGrant} for the subject if any, else
+ *       the workspace's {@link BirthPolicy} singleton, else {@link DEFAULT_MAX_BIRTHS_PER_PRINCIPAL}.
+ *
+ *  A3 — THE POOL CHAINS TO ROOT. A parent births a child WITH the child's own descendant budget
+ *       (`buildGenesisChain`'s `descendantPool` threads a `seedBirthPolicy` genesis step), so every
+ *       child is BORN BOUNDED: root bounds platforms, platforms bound homes, homes bound estates —
+ *       the tree meters by induction. V1 BOUNDARY (deliberate): each node enforces ITS OWN
+ *       count-quota only; cross-level pool CONSERVATION arithmetic (a child may not grant more than
+ *       it holds) is v2 — stated in the design doc, not silently pretended here.
+ *
+ * THE METER SUBJECT: the payload-carried birth subject (`principal`, else `owner` — the SAME
+ * convention `birthChild`/`birthHome` already carry), a pure function of the committed payload so
+ * it is identical on author / edge admission / verify_chain. A `.births()` payload carrying NEITHER
+ * fails CLOSED (`birth-quota-missing-subject`) — un-meterable ⇒ un-born, the ratified doctrine.
+ */
+import { aggregate, instance, type AggregateHandle } from "./aggregate.js";
+import { t } from "./fields.js";
+import { Lww } from "./drivers.js";
+import { query, type QueryDecl } from "./query.js";
+import { __captureBirthMeterRead } from "./read.js";
+import { set, withMarker, type PlannedOp } from "./ops.js";
+import type { WorkspaceInvariantDecl, WorkspaceInvariantVerdict } from "./framework/workspace_invariant.js";
+import type { BirthRecipe } from "./births.js";
+
+// ── A1 — the structural birth record ───────────────────────────────────────────────────────────────
+
+/** The deterministic instance-id prefix — `nomos-birth-record:<child>` (one record per child name;
+ *  a re-birth of the same name updates the SAME record, Lww). The kernel's `nomosBirthRecordGate`
+ *  era key carries this prefix so the wasm arm reads it from LAW, never hardcodes it. */
+export const NOMOS_BIRTH_RECORD_PREFIX = "nomos-birth-record:";
+
+/** The birth record's deterministic aggregate instance id for a child workspace name. */
+export function birthRecordId(child: string): string {
+  return NOMOS_BIRTH_RECORD_PREFIX + child;
+}
+
+/**
+ * NomosBirthRecord — THE STRUCTURAL BIRTH RECORD (A1). One row per child this workspace has
+ * birthed, written AUTOMATICALLY in the same intent as the birth effect (the `.births()` lane).
+ * The framework twin of `DomainInstallation`: a kernel-recognized, law-folded lifecycle fact.
+ */
+export const NomosBirthRecord = aggregate("NomosBirthRecord", {
+  /** The child workspace name the birth effect spawned. */
+  child: t.string().merge(Lww),
+  /** The birth SUBJECT — the payload-carried `principal`/`owner` the quota meters (see banner). */
+  principal: t.string().merge(Lww),
+  /** sha256 of the child's genesis chain JSON (the recipe the offer carried — content-addressed lineage). */
+  childGenesisHash: t.string().merge(Lww),
+  /** Caller-stamped birth time from the payload (`bornAt`, else `requestedAt`) — the timestamp doctrine. */
+  bornAt: t.string().merge(Lww),
+});
+
+/** BirthPolicy — the workspace's birth-allowance singleton (id `birth-policy:workspace`), the
+ *  `CloudPolicy` shape one level down: the default max live births per subject in THIS workspace. */
+export const BIRTH_POLICY_ID = "birth-policy:workspace";
+export const BirthPolicy = aggregate("BirthPolicy", {
+  /** The query key (constant `"workspace"`) — a declared field so `birthPolicy` can index it. */
+  scope: t.string().merge(Lww),
+  maxBirthsPerPrincipal: t.int().merge(Lww),
+  setBy: t.string().merge(Lww),
+  /** Caller-stamped (ISO or epoch-ms string) — the timestamp doctrine. */
+  setAt: t.string().merge(Lww),
+});
+
+/** BirthGrant — a per-subject allowance override (id `birth-grant:<principal>`), the `QuotaGrant`
+ *  shape: the LATEST grant (max grantedAt) for a subject is the allowance in force. */
+export function birthGrantId(principal: string): string {
+  return "birth-grant:" + principal;
+}
+export const BirthGrant = aggregate("BirthGrant", {
+  principal: t.string().merge(Lww),
+  maxBirths: t.int().merge(Lww),
+  grantedBy: t.string().merge(Lww),
+  /** epoch-ms — the recency tiebreak (latest grant wins), caller-stamped. */
+  grantedAt: t.int().merge(Lww),
+});
+
+// ── the meter's declared queries (the #58 captured-read recipes) ────────────────────────────────────
+
+/** A subject's birth records — the quota gate counts them (parent-LOCAL; no cross-ws read). */
+export const birthRecordsByPrincipal = query("birthRecordsByPrincipal")
+  .key("principal")
+  .returns(NomosBirthRecord);
+
+/** The workspace's birth-policy singleton (`scope: "workspace"`). */
+export const birthPolicy = query("birthPolicy").key("scope").returns(BirthPolicy);
+
+/** A subject's allowance grants — the LATEST one overrides the BirthPolicy default. */
+export const birthGrantByPrincipal = query("birthGrantByPrincipal")
+  .key("principal")
+  .returns(BirthGrant);
+
+/** The three meter reads every `.births()` directive auto-declares (`nomosReadGate`). */
+export const BIRTH_METER_QUERIES: readonly QueryDecl[] = [
+  birthRecordsByPrincipal,
+  birthPolicy,
+  birthGrantByPrincipal,
+];
+
+/**
+ * THE DEFAULT BIRTH ALLOWANCE when a workspace carries neither a BirthPolicy singleton nor a grant
+ * for the subject: a CONSERVATIVE floor for non-root workspaces (a home births a handful of estate
+ * children; a platform that needs more seeds a BirthPolicy at its own genesis — the A3 induction —
+ * or grants per-subject allowances). Root/platform governance already carries the 50-workspace
+ * `WorkspaceQuota`; THIS default only ever binds law that never set its own policy.
+ */
+export const DEFAULT_MAX_BIRTHS_PER_PRINCIPAL = 5;
+
+// ── the meter subject + the auto-record/auto-capture halves the `.births()` lane calls ─────────────
+
+/** The payload-carried birth SUBJECT the meter counts under: `principal`, else `owner`, else `""`
+ *  (fail-closed at the invariant). A pure function of the committed payload — identical on every lane. */
+export function birthMeterSubject(payload: Record<string, unknown>): string {
+  // The payload-carried subject convention, in priority order: `principal` (birthChild/createWorkspace),
+  // `owner` (birthHome), `ownerSubject` (the estate-birth shape). A pure function of the committed
+  // payload — identical on every lane; empty ⇒ the quota invariant fails closed.
+  for (const key of ["principal", "owner", "ownerSubject"]) {
+    const v = payload[key];
+    if (typeof v === "string" && v.length > 0) return v;
+  }
+  return "";
+}
+
+/** The record's caller-stamped birth time off the payload (`bornAt`, else `requestedAt`, else `""`). */
+export function birthMeterBornAt(payload: Record<string, unknown>): string {
+  const b = payload["bornAt"];
+  if (typeof b === "string" && b.length > 0) return b;
+  const r = payload["requestedAt"];
+  if (typeof r === "number" || (typeof r === "string" && r.length > 0)) return String(r);
+  return "";
+}
+
+/** sha256 via the ONE deterministic host port (`nomos.sha256` — the same global `homeNameOf` uses,
+ *  provided by the sealed engine AND the client runtime, so both lanes hash identically). */
+function sha256(text: string): string {
+  const host = (globalThis as { nomos?: { sha256?: (s: string) => string } }).nomos;
+  if (host === undefined || typeof host.sha256 !== "function") {
+    throw new Error(
+      "birth-meter: the `nomos.sha256` host port is not available — a `.births()` dispatch needs the " +
+        "engine/client runtime (tests: stub `globalThis.nomos.sha256`).",
+    );
+  }
+  return host.sha256(text);
+}
+
+/**
+ * CAPTURE the three meter reads on the write path (A2 — the plan side of the birth-quota gate; the
+ * exact `countQuotaReads` shape). Called by `executeDirectiveToIntent` for every `.births()` dispatch
+ * that planned ≥1 birth — the values ride `captured_ports.reads`, CAS-re-derived + byte-compared at
+ * the pre-apply position on every lane; the verdict is the synthesized invariant's.
+ */
+export function captureBirthMeterReads(subject: string): void {
+  __captureBirthMeterRead(birthRecordsByPrincipal, { principal: subject });
+  __captureBirthMeterRead(birthGrantByPrincipal, { principal: subject });
+  __captureBirthMeterRead(birthPolicy, { scope: "workspace" });
+}
+
+/**
+ * THE AUTO-RECORD (A1): the `NomosBirthRecord` field ops for ONE planned birth, appended by
+ * `executeDirectiveToIntent` to the SAME intent that carries the birth effect. Deterministic-id
+ * upsert (Lww — a re-birth of the same child name updates the record), a fan-out sibling event
+ * exactly like `installDomain`'s `DomainInstallation` writes.
+ */
+export function planBirthRecordOps(
+  recipe: BirthRecipe,
+  subject: string,
+  bornAt: string,
+): PlannedOp[] {
+  const rec = instance(NomosBirthRecord, birthRecordId(recipe.workspace));
+  return [
+    // ENSURE, not a bare update: the record id is deterministic and the FIRST birth of a child writes a
+    // row that does not yet exist — the referential gate refuses a Mutate of a non-existent id, so the
+    // event must lower `Ensure` (create-or-update), exactly how `installDomain` lowers its
+    // DomainInstallation singleton (`withMarker(..., "ensures")`). One marked op sets the whole event's
+    // marker; both lanes share THIS function, so the op shape is byte-identical by construction.
+    withMarker(set(rec, "child", recipe.workspace), "ensures"),
+    set(rec, "principal", subject),
+    set(rec, "childGenesisHash", sha256(JSON.stringify(recipe.genesisChain))),
+    set(rec, "bornAt", bornAt),
+  ];
+}
+
+// ── A2 — the quota verdict + the synthesized per-directive invariant ────────────────────────────────
+
+/** A captured-read row as `derive_captured_read` shapes it: `{id, data:{field:value}}`. */
+type MeterRow = { id?: string; data?: Record<string, unknown> };
+
+/**
+ * THE BIRTH-QUOTA VERDICT — the PURE predicate over the COMMITTED captured reads (the same
+ * `{queryId,args,result}` the plan recorded, CAS-re-derived on every lane). Counts the subject's
+ * birth records and compares against its allowance (the latest BirthGrant.maxBirths if any, else
+ * BirthPolicy.maxBirthsPerPrincipal, else {@link DEFAULT_MAX_BIRTHS_PER_PRINCIPAL}). The NEW birth's
+ * record is NOT yet in the pre-apply state, so `count < allowance` (strict) is the correct test. A
+ * subject-less birth fails CLOSED. Identical on author, edge admission, and verify_chain.
+ */
+export function birthQuotaVerdict(
+  reads: readonly { queryId: string; args: Record<string, string>; result: unknown }[],
+  subject: string,
+): WorkspaceInvariantVerdict {
+  if (!subject) return { reject: "birth-quota-missing-subject" };
+  const rowsOf = (queryId: string, argKey: string, argValue: string): MeterRow[] => {
+    const hit = reads.find((r) => r.queryId === queryId && r.args[argKey] === argValue);
+    return Array.isArray(hit?.result) ? (hit!.result as MeterRow[]) : [];
+  };
+  const count = rowsOf(birthRecordsByPrincipal.id, "principal", subject).length;
+  // ALLOWANCE: the LATEST BirthGrant (max grantedAt) wins; else the BirthPolicy singleton; else the floor.
+  let allowance: number | undefined;
+  let latestGrantedAt = -Infinity;
+  for (const g of rowsOf(birthGrantByPrincipal.id, "principal", subject)) {
+    const at = Number(g.data?.grantedAt ?? -Infinity);
+    const max = Number(g.data?.maxBirths ?? NaN);
+    if (Number.isFinite(at) && at > latestGrantedAt && Number.isFinite(max)) {
+      latestGrantedAt = at;
+      allowance = max;
+    }
+  }
+  if (allowance === undefined) {
+    const policyRows = rowsOf(birthPolicy.id, "scope", "workspace");
+    const max = Number(policyRows[0]?.data?.maxBirthsPerPrincipal ?? NaN);
+    if (Number.isFinite(max)) allowance = max;
+  }
+  if (allowance === undefined) allowance = DEFAULT_MAX_BIRTHS_PER_PRINCIPAL;
+  return count < allowance ? { accept: true } : { reject: "birth-quota-exceeded" };
+}
+
+/** The synthesized invariant's stable, deterministic id for a `.births()` directive. */
+export function birthQuotaInvariantId(directiveId: string): string {
+  return `${directiveId}__birthQuota`;
+}
+
+/**
+ * Synthesize THE BIRTH-QUOTA workspace invariant for ONE directive (A2). `[]` unless the directive
+ * declares `.births()` (the era rule — a birth-free directive synthesizes nothing, byte-identical).
+ * Applied at the SAME three sites the precondition desugaring rides (`composeDomainModule`, the
+ * engine slice build, the openapi decls) so the manifest's `nomosInvariantGate` entry and the sealed
+ * engine's executable body can never disagree. The verdict reads the row LIST off the captured reads
+ * (`ctx.reads` — the snapshot ref-set is empty; ref-resolution cannot enumerate), the exact
+ * WorkspaceQuota shape.
+ */
+export function synthesizeBirthQuotaInvariants(directive: {
+  id: string;
+  birthsChild?: boolean;
+}): WorkspaceInvariantDecl[] {
+  if (directive.birthsChild !== true) return [];
+  return [
+    {
+      id: birthQuotaInvariantId(directive.id),
+      on: directive.id,
+      reads: () => [],
+      assert: (_snapshots, ctx) => {
+        // A `.births()` plan that planned NO birth (e.g. birthChild without a genesis) captures no
+        // meter reads and consumes no allowance — accept without judging (nothing was born).
+        const reads = (ctx?.reads ?? []) as {
+          queryId: string;
+          args: Record<string, string>;
+          result: unknown;
+        }[];
+        if (!reads.some((r) => r.queryId === birthRecordsByPrincipal.id)) return { accept: true };
+        return birthQuotaVerdict(reads, birthMeterSubject(ctx?.intent ?? {}));
+      },
+      __isWorkspaceInvariant: true as const,
+    },
+  ];
+}
+
+/** The meter aggregates every `.births()`-declaring domain auto-ensures (the RelationTuple courtesy). */
+export const BIRTH_METER_AGGREGATES: readonly AggregateHandle[] = [
+  NomosBirthRecord,
+  BirthPolicy,
+  BirthGrant,
+] as unknown as readonly AggregateHandle[];

package/src/birth_meter_ensure.ts

@@ -0,0 +1,67 @@
+// NOMOS — Nomos Sovereign: participants act · verify · remember LOCALLY; hosted
+// remotes are replaceable custody/transport, not truth.  ⇒ ONE Nomos GitHolon
+// wasm32-wasip1 artifact {kernel · projection · embedded
+// QuickJS engine}.  If a file isn't this / hosting this / authoring for this / proving this — it's gone.
+
+/**
+ * THE BIRTH-RECORD SANCTIONING DECLARATION (metered birth, slice A1 — the id-mint-gate half).
+ *
+ * The auto-appended `NomosBirthRecord` event is an ENSURE at a deterministic id
+ * (`nomos-birth-record:<child>`). The kernel's id-mint gate admits an Ensure-INTRODUCED typed id
+ * ONLY through the sanctioned upsert-by-deterministic-key lane: the CERTIFIED manifest must declare
+ * the type as an `ensures` TARGET — i.e. the law must carry a directive whose marker is `Ensure`
+ * targeting `NomosBirthRecord` (exactly how `installDomain` sanctions `DomainInstallation`, or the
+ * governance `setBirthPolicy` sanctions `BirthPolicy`). A tenant `.births()` law writes the record
+ * by construction but authors NO such directive — so this module supplies it, injected at the ONE
+ * module-merge seam every plane shares (compose / engine slice / self-describe / compile openapi),
+ * keeping the compiled openapi and the lump's `describe()` byte-consistent.
+ *
+ * {@link nomosBirthRecordEnsure} is DELIBERATELY USELESS TO DISPATCH: its plan writes NOTHING (zero
+ * ops — it cannot forge a record), it exists purely so the law's manifest/USD carries the
+ * `Ensure → NomosBirthRecord` declaration the id-mint gate reads. Era-ruled like everything else in
+ * the meter: only a `.births()`-declaring domain gains it; every other law is byte-identical.
+ */
+import { z } from "zod";
+import { directive } from "./directive.js";
+import type { Directive } from "./directive.js";
+import {
+  NomosBirthRecord,
+  BirthPolicy,
+  BirthGrant,
+} from "./birth_meter.js";
+
+/**
+ * The sanctioning declaration — an `ensures(NomosBirthRecord)` directive whose plan emits ZERO ops.
+ * Its only load-bearing property is its manifest/USD presence (marker `Ensure`, target
+ * `NomosBirthRecord`), which opens the id-mint gate's declared-ensures lane for the auto-appended
+ * birth record. Dispatching it is a harmless no-op (no events, nothing folds).
+ */
+export const nomosBirthRecordEnsure = directive("nomosBirthRecordEnsure")
+  .ensures(NomosBirthRecord)
+  .payload(z.object({}).strict())
+  .plan(() => []);
+
+/**
+ * Inject the birth-meter's structural exports into a merged module-exports bag IFF it declares ≥1
+ * `.births()` directive (the RelationTuple "discoverable without re-exports" courtesy, at the one
+ * merge seam): the sanctioning {@link nomosBirthRecordEnsure} directive + the meter aggregates (so
+ * the engine registry / self-describe see the same surface the composed manifest carries). A
+ * birth-free bag is returned UNTOUCHED (the era rule — byte-identical). Existing keys are never
+ * overwritten (a law composing the framework governance surface keeps its own bindings).
+ */
+export function withBirthMeterExports<M extends Record<string, unknown>>(mod: M): M {
+  const declaresBirth = Object.values(mod).some(
+    (v) =>
+      v !== null &&
+      typeof v === "object" &&
+      (v as { birthsChild?: boolean }).birthsChild === true &&
+      typeof (v as Directive<unknown>).plan === "function",
+  );
+  if (!declaresBirth) return mod;
+  const out: Record<string, unknown> = { ...mod };
+  if (!("nomosBirthRecordEnsure" in out)) out["nomosBirthRecordEnsure"] = nomosBirthRecordEnsure;
+  if (!("NomosBirthRecord" in out)) out["NomosBirthRecord"] = NomosBirthRecord;
+  if (!("BirthPolicy" in out)) out["BirthPolicy"] = BirthPolicy;
+  if (!("BirthGrant" in out)) out["BirthGrant"] = BirthGrant;
+  return out as M;
+}

package/src/build_package.ts

@@ -54,6 +54,12 @@ import type { ImpureCapabilityDecl } from "./codegen_provider_dart.js";
 import type { WorkspaceTypeDecl } from "./workspace_type.js";
 import type { WorkspaceInvariantDecl } from "./framework/workspace_invariant.js";
 import { synthesizePreconditionInvariants } from "./precondition.js";
+import {
+  BIRTH_METER_AGGREGATES,
+  BIRTH_METER_QUERIES,
+  synthesizeBirthQuotaInvariants,
+} from "./birth_meter.js";
+import { withBirthMeterExports } from "./birth_meter_ensure.js";
 import type { RelationTypeDecl } from "./relation_schema.js";
 import { domainHash, emitManifestBytes } from "./manifest.js";
 import { collectValueObjectDescriptors } from "./value_object.js";
@@ -146,6 +152,11 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   // `capability()` bundles expand into discoverable entries (the package plane's
   // merge point) — the quartet validation below then passes without re-exports.
   merged = expandCapabilityExports(merged);
+  // METERED BIRTH: inject the sanctioning `nomosBirthRecordEnsure` directive + meter aggregates
+  // into a `.births()`-declaring domain at the SAME seam the engine merge applies it — the
+  // Ensure→NomosBirthRecord manifest declaration is what admits the auto-appended record through
+  // the id-mint gate's declared-ensures lane. Birth-free domains are byte-identical (era rule).
+  merged = withBirthMeterExports(merged);
 
   const byId = new Map<string, AggregateHandle>();
   for (const a of [...aggregatesOf(merged), ...(spec.extraAggregates ?? [])]) byId.set(a.id, a);
@@ -158,6 +169,18 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   if (!byId.has(RelationTuple.id) && directives.some((d) => d.aggregateId === RelationTuple.id)) {
     byId.set(RelationTuple.id, RelationTuple);
   }
+  // BIRTH-METER AUTO-ENSURE (metered birth, slice A — the same "discoverable without re-exports"
+  // courtesy as RelationTuple): a domain declaring ≥1 `.births()` directive gets the meter aggregates
+  // (NomosBirthRecord/BirthPolicy/BirthGrant) injected so the auto-record folds + projects, and the
+  // meter queries injected so the captured reads route/re-derive. Era-safe: only a birth-declaring
+  // domain gains them, so no existing (birth-free) manifest hash drifts — and a birth-declaring domain
+  // recompiled under this DSL moves hash ANYWAY (the meter IS its new era).
+  const declaresBirth = directives.some((d) => (d as { birthsChild?: boolean }).birthsChild === true);
+  if (declaresBirth) {
+    for (const a of BIRTH_METER_AGGREGATES) {
+      if (!byId.has(a.id)) byId.set(a.id, a);
+    }
+  }
   const aggregates = [...byId.values()];
   const directiveIds = new Set(directives.map((d) => d.id));
   for (const task of spec.impureCapabilities ?? []) {
@@ -188,6 +211,17 @@ export function composeDomainModule(spec: DomainModuleSpec): DomainModule {
   // hand-authored `workspaceInvariant(...)` occupies — so downstream treats them identically. Era-safe:
   // a directive with no precondition synthesizes nothing (byte-identical manifest).
   for (const d of directives) workspaceInvariants.push(...synthesizePreconditionInvariants(d));
+  // METERED BIRTH (slice A2): synthesize THE BIRTH-QUOTA invariant for every `.births()` directive —
+  // the same desugaring lane as preconditions, so the manifest (`nomosInvariantGate`) and the sealed
+  // engine (which synthesizes from the SAME directives in `buildDomainSlice`) can never disagree.
+  for (const d of directives) workspaceInvariants.push(...synthesizeBirthQuotaInvariants(d));
+  // The meter's declared queries route like any exported query (read manifest + captured-read re-derive).
+  if (declaresBirth) {
+    const haveQuery = new Set(queries.map((q) => q.id));
+    for (const q of BIRTH_METER_QUERIES) {
+      if (!haveQuery.has(q.id)) queries.push(q);
+    }
+  }
   const relationTypes = [...(spec.relationTypes ?? [])];
   // FIRST-CLASS VALUE OBJECTS (value_object.ts): the deduped, sorted descriptors of every
   // named VO the domain's aggregates carry (transitive nested VOs included) — the input to

package/src/codegen_dart.ts

@@ -1835,6 +1835,13 @@ function emitDirective(
   const ctorParams = specs
     .map((s) => `    ${s.optional ? "" : "required "}this.${s.name},`)
     .join("\n");
+  // Zero-field payload (e.g. a `.births()` sanctioning directive with an empty
+  // object schema): `const X({});` / a dangling blank field block is INVALID Dart —
+  // emit a plain `const X();` and an empty map literal instead.
+  const hasFields = specs.length > 0;
+  const ctorLines = hasFields
+    ? [`  const ${className}({`, ctorParams, `  });`]
+    : [`  const ${className}();`];
 
   // toPayloadJson: serialise only typed fields to data. No Event, no Hlc; the
   // GitHolon executes the installed domain plan. Optional
@@ -1870,12 +1877,9 @@ function emitDirective(
     `  /// The referential marker (creates/mutates/ensures/archives).`,
     `  static const String marker = '${d.marker}';`,
     ``,
-    fieldDecls,
-    ``,
+    ...(hasFields ? [fieldDecls, ``] : []),
     `  /// ${docFirst}`,
-    `  const ${className}({`,
-    ctorParams,
-    `  });`,
+    ...ctorLines,
     ``,
     `  @override`,
     `  String get domain => domainName;`,

package/src/codegen_proof.ts

@@ -1766,9 +1766,10 @@ function v2IdentityAndCleanupPreamble(opts: TsProofOptions, hashConst: string, n
 }
 
 /**
- * THE V2 CATCH/FINALLY (G1, gap 4): retire the throwaway workspace on every exit via the OPEN lane (no
- * Bearer — there is no host secret to present; a retire is a SIGNED governance offer in the real lane, but
- * the open self-retire suffices to clean up a throwaway). PROOF_KEEP=1 keeps it.
+ * THE V2 CATCH/FINALLY (G1, gap 4 · 0.34.1): retirement is a SIGNED governance offer — the open self-retire
+ * lane is DEAD post-warrant-flip, so the proof itself never retires. Under `githolon proof --live`
+ * (NOMOS_PROOF_MANAGED=1) the CLI created the workspace REGISTERED and retires it lawfully after exit;
+ * standalone, the proof warns LOUDLY and names the manual command. PROOF_KEEP=1 keeps it.
  */
 function v2CatchFinally(): string[] {
   return [
@@ -1776,13 +1777,18 @@ function v2CatchFinally(): string[] {
     `  runError = e;`,
     `  console.error("✗ " + ((e as Error)?.message ?? e));`,
     `} finally {`,
-    `  // THE CLEANUP CONTRACT: never an orphaned cloud workspace. Retired on every exit path (open lane — no`,
-    `  // host secret exists post-G1); PROOF_KEEP=1 keeps it and prints the persist command.`,
+    `  // THE CLEANUP CONTRACT: never a SILENTLY orphaned cloud workspace. Retirement is a SIGNED`,
+    `  // governance offer (retireOwnWorkspace at the parent) — the old open-lane POST /retire is dead`,
+    `  // post-warrant-flip. \`githolon proof --live\` orchestrates it (NOMOS_PROOF_MANAGED=1: it created`,
+    `  // the workspace REGISTERED and retires it after this process exits). Run standalone, this proof`,
+    `  // cannot lawfully retire (no signing key) — so it says so LOUDLY and names the exact command.`,
     `  if (born_ws && process.env.PROOF_KEEP === "1") {`,
     `    console.log(\`workspace \${WS} KEPT — retire it when done: githolon ws retire \${WS}\`);`,
+    `  } else if (born_ws && process.env.NOMOS_PROOF_MANAGED === "1") {`,
+    `    console.log(\`  workspace \${WS} — retirement handled by githolon proof --live (signed retireOwnWorkspace)\`);`,
     `  } else if (born_ws) {`,
-    `    const rr = await fetch(\`\${CLOUD}/v2/workspaces/\${WS}/retire\`, { method: "POST", headers: { "x-nomos-principal": PRINCIPAL } }).then((x) => x.json()).catch(() => ({}));`,
-    `    console.log(\`  retired \${WS}: \${(rr as { ok?: boolean }).ok === true}\`);`,
+    `    console.error(\`⚠ THROWAWAY WORKSPACE NOT RETIRED: \${WS} (retirement is a signed governance offer this standalone proof cannot author)\`);`,
+    `    console.error(\`⚠ retire it manually: githolon ws retire \${WS}   (run the managed lane next time: githolon proof --live)\`);`,
     `  }`,
     `  process.exit(runError ? 1 : 0);`,
     `}`,

package/src/compile_engine.ts

@@ -41,6 +41,7 @@
  * re-baking is a later, gated step. SYNTHETIC framework units only.
  */
 import type { Directive } from "./directive.js";
+import { isNamespacedAggregate, READ_PROJECTION_DELIMITER } from "./read_projection_namespace.js";
 import type { AggregateHandle, AggregateInvariantFn } from "./aggregate.js";
 import type { ComposeOptions } from "./compose.js";
 import { flattenUsd, usdHash, type UsdDocument, type UsdPrim } from "./usd.js";
@@ -274,7 +275,17 @@ export function compileEngineModule(
           `id "${directiveId}".`,
       );
     }
-    if (binding.directive.aggregateId !== prim.target) {
+    // READ-PROJECTION NAMESPACING: the USD law's target is the QUALIFIED type name for a
+    // non-global aggregate (`<domain>__<handleId>`); the executable binding keeps the bare
+    // handle id (the source literal). Accept either the bare id (global / pre-namespacing law)
+    // or the domain-qualified form (the prim's own layer domain — the 2nd path segment).
+    const aggGlobal = (binding.agg as { global?: boolean }).global;
+    const targetMatches = (aggId: string): boolean =>
+      prim.target === aggId ||
+      (isNamespacedAggregate(aggGlobal === undefined ? { id: aggId } : { id: aggId, global: aggGlobal }) &&
+        prim.target.endsWith(`${READ_PROJECTION_DELIMITER}${aggId}`) &&
+        prim.target.length > READ_PROJECTION_DELIMITER.length + aggId.length);
+    if (!targetMatches(binding.directive.aggregateId)) {
       throw new EngineCompileError(
         "binding-mismatch",
         directiveId,
@@ -282,7 +293,7 @@ export function compileEngineModule(
           `USD law's target is "${prim.target}".`,
       );
     }
-    if (binding.agg.id !== prim.target) {
+    if (!targetMatches(binding.agg.id)) {
       throw new EngineCompileError(
         "binding-mismatch",
         directiveId,