@githolon/dsl 0.43.0 → 0.44.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/dsl",
-  "version": "0.43.0",
+  "version": "0.44.0",
   "type": "module",
   "description": "Nomos 2 domain-authoring DSL: aggregates + directives in TS, executed and encoded to the Rust kernel's wire shapes.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/codegen_dart.ts

@@ -1475,6 +1475,8 @@ function emitUnionClasses(d: ValueObjectDescriptor): string {
     `/// Union \`${d.name}\` — a sum type stored as ONE json leaf (wholesale-replace; the`,
     `/// \`type\` discriminator names the arm). Adding an arm is ADDITIVE (older clients decode`,
     `/// it as [${d.name}Unknown]); removing/renaming an arm is a retype (#58 dispositions).`,
+    `/// \`.encrypted()\` on a field of this type seals the WHOLE leaf — discriminator included;`,
+    `/// per-arm sensitivity cannot be split (model differently-classified arms as separate fields).`,
     `sealed class ${d.name} {`,
     `  const ${d.name}();`,
     `  Map<String, Object?> toJson();`,

package/src/flow_gate.ts

@@ -173,8 +173,19 @@ export function assertFlowGate(m: CanonicalManifest, mod?: FlowModule): void {
       let refs: readonly { readonly aggregate: string }[];
       try {
         refs = wi.reads({ intent: new Proxy({}, { get: () => "" }) as Record<string, unknown>, principal: "" }) ?? [];
-      } catch {
-        continue; // the read-set can't be resolved on a probe intent — skip (no false refusal; conservative on availability)
+      } catch (e) {
+        // THE 4b PROBE HOLE, CLOSED (classified_first_class.md §2.1): a read-set that cannot be
+        // resolved on the probe used to be SKIPPED — "conservative on availability" was a hole on
+        // SAFETY (an invariant could escape rule 4 by accident of a throwing reads()). On a domain
+        // that HAS private types, an unresolvable read-set now REFUSES: make reads() total over a
+        // probe intent (every field reads as ""), or declare declassify if the read-set is
+        // genuinely intent-dependent and touches private state.
+        throw new FlowGateError(
+          `[nomosFlowGate rule 4b — unresolvable read-set] workspaceInvariant '${wi.id}' on '${wi.on}': its ` +
+            `.reads() threw on the compile probe (${String((e as Error)?.message ?? e).slice(0, 120)}) so the gate ` +
+            `cannot prove the refusal is secret-free while this domain declares private types. Make .reads() total ` +
+            `over a probe intent (every intent field reads as ""), or acknowledge with .declassify("<why>").`,
+        );
       }
       for (const r of refs) {
         const short = r.aggregate.includes(".") ? r.aggregate.slice(r.aggregate.lastIndexOf(".") + 1) : r.aggregate;