githolon 0.45.0 → 0.47.0

package/dist/cli.mjs

@@ -351,8 +351,10 @@ var init_governance = __esm({
 // src/lifecycle.ts
 var lifecycle_exports = {};
 __export(lifecycle_exports, {
+  DOMAIN_LIFECYCLE_DX: () => DOMAIN_LIFECYCLE_DX,
   describeDeployPlan: () => describeDeployPlan,
   domainKeysOf: () => domainKeysOf,
+  domainLifecycleState: () => domainLifecycleState,
   domainsRetire: () => domainsRetire,
   domainsStatus: () => domainsStatus,
   fetchInstalledLaw: () => fetchInstalledLaw,
@@ -440,7 +442,7 @@ function describeDeployPlan(plan, targetHash) {
       case "keep-beside":
         return `  ${d.key}: ${t} kept beside ${short(d.currentHash)}`;
       case "idempotent":
-        return `  ${d.key}: unchanged \u2014 ${t} is already the current served law`;
+        return `  ${d.key}: unchanged \u2014 ${t} is already active`;
     }
   });
 }
@@ -450,7 +452,7 @@ function resolveInstallHash(arg, currentLaw) {
   if (hash !== void 0) return { hash };
   const keys = Object.keys(currentLaw);
   return {
-    error: `'${arg}' is neither a 64-hex install hash nor a served domain key` + (keys.length > 0 ? ` (served keys: ${keys.join(", ")})` : " (this workspace serves no law)")
+    error: `'${arg}' is neither a 64-hex install hash nor an active domain key` + (keys.length > 0 ? ` (active keys: ${keys.join(", ")})` : " (this workspace has no active law)")
   };
 }
 function keysServedBy(hash, currentLaw) {
@@ -550,14 +552,37 @@ async function domainsRetire(ws, target, opts) {
   const afterLaw = after.currentLaw ?? {};
   for (const k of retiredKeys) {
     const now = afterLaw[k];
-    out2(`  key '${k}' now serves: ${now !== void 0 ? short(now) : "NO served law"}`);
+    out2(`  key '${k}' now serves: ${now !== void 0 ? short(now) : "NO active law"}`);
   }
   if (stranded.length > 0 && retiredKeys.some((k) => afterLaw[k] === void 0)) {
-    err2(`\u26A0 retiring left these keys with NO served law: ${stranded.join(", ")} \u2014 nothing dispatches/reads them now`);
+    err2(`\u26A0 retiring left these keys with NO active law: ${stranded.join(", ")} \u2014 nothing dispatches/reads them now`);
     err2(`  (deploy law covering them, or this is intentional \u2014 the kernel allows an unserved key)`);
   }
   return 0;
 }
+function domainLifecycleState(row, currentHashes) {
+  if (row.lifecycle === "active" || row.lifecycle === "superseded" || row.lifecycle === "retired") return row.lifecycle;
+  if (row.lifecycle === "current") return "active";
+  const hash = row.domainHash;
+  switch (row.phase) {
+    case "Active":
+      return row.current === true || hash !== void 0 && currentHashes.has(hash) ? "active" : "superseded";
+    case "Superseded":
+      return "superseded";
+    case "Retired":
+      return "retired";
+    case "Pending":
+      return "pending";
+    case "Retiring":
+      return "retiring";
+    case "Disabled":
+      return "disabled";
+    case "Failed":
+      return "failed";
+    default:
+      return "unknown";
+  }
+}
 async function domainsStatus(ws, opts) {
   const cloud = cloudBase(opts.cloud);
   const law = await fetchInstalledLaw(cloud, ws);
@@ -567,43 +592,49 @@ async function domainsStatus(ws, opts) {
   }
   const currentLaw = law.currentLaw ?? {};
   const rows = law.domains ?? [];
-  const phaseOf = (hash) => rows.find((r) => r.domainHash === hash)?.phase ?? "(unknown)";
+  const servedHashes = new Set(Object.values(currentLaw));
+  const lifecycleOf = (row) => domainLifecycleState(row, servedHashes);
+  const lifecycleOfHash = (hash) => {
+    const row = rows.find((r) => r.domainHash === hash);
+    return row !== void 0 ? lifecycleOf(row) : "unknown";
+  };
   const keys = Object.keys(currentLaw).sort();
   out2(`installed law on ${ws} (${cloud})`);
   if (keys.length === 0) {
-    out2(`  (no domain key resolves a served law \u2014 nothing is dispatched/read here)`);
+    out2(`  (no domain key has active law \u2014 nothing is dispatched/read here)`);
   } else {
-    out2(`current interface \u2014 the served law per domain key (the frontier):`);
+    out2(`active law per domain key:`);
     for (const key of keys) {
       const hash = currentLaw[key];
-      out2(`  ${key}  \u2192  ${short(hash)}  [${phaseOf(hash)}]`);
+      out2(`  ${key}  \u2192  ${short(hash)}  [${lifecycleOfHash(hash)}]`);
     }
   }
-  const servedHashes = new Set(Object.values(currentLaw));
   const behind = rows.filter((r) => typeof r.domainHash === "string" && !servedHashes.has(r.domainHash));
   if (behind.length > 0) {
-    out2(`superseded / retired lineage (replayable, NEVER served):`);
+    out2(`superseded/retired lineage (replayable, not served):`);
     for (const r of behind) {
-      out2(`  ${short(r.domainHash)}  [${r.phase ?? "(unknown)"}]${r.generation !== void 0 ? `  gen ${r.generation}` : ""}`);
+      out2(`  ${short(r.domainHash)}  [${lifecycleOf(r)}]${r.generation !== void 0 ? `  gen ${r.generation}` : ""}`);
     }
   } else if (rows.length > 0) {
-    out2(`no superseded/retired installs behind the frontier \u2014 every install is current`);
+    out2(`no superseded or retired installs \u2014 every install is active`);
   }
   if (opts.explain === true) {
     out2(``);
-    out2(`why this is the current interface (the frontier resolution):`);
-    out2(`  the holon resolves, per domain key, the NEWEST '${SERVED_PHASE}' install that is not superseded/`);
-    out2(`  retired (refresh_key_map / rpc_current_law). Every live surface \u2014 the interface identity, reads,`);
-    out2(`  and dispatch \u2014 reads from THIS map, so a superseded/retired install can never pollute it.`);
+    out2(`domain install lifecycle:`);
+    for (const line of DOMAIN_LIFECYCLE_DX) out2(`  - ${line}`);
+    out2(``);
+    out2(`why this is the active interface:`);
+    out2(`  the holon resolves active law per domain key and every live surface \u2014 interface identity, reads,`);
+    out2(`  and dispatch \u2014 reads from that map, so superseded/retired installs cannot pollute it.`);
     for (const key of keys) {
       const hash = currentLaw[key];
-      out2(`  \u2022 '${key}' serves ${short(hash)} \u2014 it is the newest ${SERVED_PHASE} install for this key.`);
+      out2(`  \u2022 '${key}' serves ${short(hash)} \u2014 state: active.`);
     }
     if (behind.length > 0) {
-      const excluded = behind.filter((r) => EXCLUDED_PHASES.has(r.phase ?? "") || !servedHashes.has(r.domainHash)).map((r) => `${short(r.domainHash)} [${r.phase ?? "?"}]`);
+      const excluded = behind.filter((r) => EXCLUDED_PHASES.has(r.phase ?? "") || !servedHashes.has(r.domainHash)).map((r) => `${short(r.domainHash)} [${lifecycleOf(r)}]`);
       out2(`  \u2022 excluded from the interface (replayable, not served): ${excluded.join(", ")}`);
     }
-    out2(`  interface identity per key = the current served hash above; older installs are lineage, not surface.`);
+    out2(`  interface identity per key = the active hash above; older installs are lineage, not surface.`);
   }
   return 0;
 }
@@ -611,7 +642,7 @@ function signingAvailable(opts) {
   const principal = opts.principal ?? activePrincipal();
   return opts.principal !== void 0 || principal !== void 0 && getDeviceKey(principal) !== void 0;
 }
-var out2, err2, short, SERVED_PHASE, EXCLUDED_PHASES;
+var out2, err2, short, EXCLUDED_PHASES, DOMAIN_LIFECYCLE_DX;
 var init_lifecycle = __esm({
   "src/lifecycle.ts"() {
     "use strict";
@@ -619,8 +650,12 @@ var init_lifecycle = __esm({
     out2 = (s) => void process.stdout.write(s + "\n");
     err2 = (s) => void process.stderr.write("error: " + s + "\n");
     short = (h) => h.length > 16 ? h.slice(0, 16) + "\u2026" : h;
-    SERVED_PHASE = "Active";
     EXCLUDED_PHASES = /* @__PURE__ */ new Set(["Superseded", "Retired", "Disabled", "Failed", "Pending", "Retiring"]);
+    DOMAIN_LIFECYCLE_DX = [
+      "active: served now.",
+      "superseded: replaced by a newer install for the same domain key; replayable, not served.",
+      "retired: explicitly withdrawn; replayable, not served."
+    ];
   }
 });
 
@@ -1088,7 +1123,7 @@ async function deploy(ws, opts) {
       return 1;
     }
     const phase = d.installation?.[0]?.data?.["status.phase"];
-    phaseSuffix = typeof phase === "string" ? ` (${phase})` : "";
+    phaseSuffix = phase === "Active" ? " (active)" : typeof phase === "string" ? ` (${phase.toLowerCase()})` : "";
     deployedHash = typeof d.domainHash === "string" ? d.domainHash : void 0;
   }
   const after = await fetch(`${cloud}/v2/workspaces/${ws}/domains`).then((ar) => ar.json()).then((ad) => ad.ok === true ? ad : {}).catch(() => ({}));
@@ -1099,31 +1134,31 @@ async function deploy(ws, opts) {
     if (plan === void 0 || targetHash === void 0 || plan.decisions.length === 0) return;
     for (const line of describeDeployPlan2(plan, targetHash)) out3(line);
     if (plan.replaceCandidates.length > 1) {
-      out3(`  \u26A0 the package's keys were served by ${plan.replaceCandidates.length} different installs \u2014 installDomain supersedes one (${plan.replaces.slice(0, 16)}\u2026); the newest-Active frontier still serves this deploy for every key.`);
+      out3(`  \u26A0 the package's keys were active on ${plan.replaceCandidates.length} different installs \u2014 installDomain supersedes one (${plan.replaces.slice(0, 16)}\u2026); this deploy is active for every key.`);
     }
     if (!signed && plan.replaces !== void 0 && !opts.keepBeside) {
-      out3(`  note: the OPEN (unsigned) lane installs BESIDE \u2014 the new law is current (newest Active) but the prior install is not marked Superseded. Sign with --as <uid> to record the supersession.`);
+      out3(`  note: the OPEN (unsigned) lane installs beside \u2014 the new law is active, and the prior install is effectively superseded but not marked Superseded. Sign with --as <uid> to record the supersession.`);
     }
   };
   if (deployedHash !== void 0 && isCurrent) {
     out3(`\u2713 deployed ${fileName} \u2192 ${ws}${phaseSuffix}`);
     out3(`  law ${describeLawMove(before, deployedHash)}`);
     emitPlan();
-    out3(`  \u2713 current \u2014 dispatch + reads now resolve ${deployedHash.slice(0, 16)}\u2026`);
+    out3(`  \u2713 active \u2014 dispatch + reads now resolve ${deployedHash.slice(0, 16)}\u2026`);
     return 0;
   }
   if (deployedHash === void 0 || !hasCurrencyData) {
     out3(`\u2713 deployed ${fileName} \u2192 ${ws}${phaseSuffix}`);
     if (deployedHash !== void 0) out3(`  law ${describeLawMove(before, deployedHash)}`);
     emitPlan();
-    out3(`  \u26A0 couldn't confirm it is the current serving law (this workspace did not report current-law resolution).`);
+    out3(`  \u26A0 couldn't confirm it is active (this workspace did not report active-law resolution).`);
     return 0;
   }
-  err3(`deployed ${fileName} \u2192 ${ws}${phaseSuffix}, but it is NOT the current serving law \u2014 the upgrade did not take effect`);
-  out3(`  law ${describeLawMove(before, deployedHash)} (committed as an install, but the holon does not resolve it as current)`);
+  err3(`deployed ${fileName} \u2192 ${ws}${phaseSuffix}, but it is NOT active \u2014 the upgrade did not take effect`);
+  out3(`  law ${describeLawMove(before, deployedHash)} (committed as an install, but the holon does not resolve it as active)`);
   const leads = (after.domains ?? []).filter((x) => x.current === true && typeof x.domainHash === "string").map((x) => x.domainHash);
-  if (leads.length > 0) err3(`  current serving: ${leads.map((h) => h.slice(0, 16) + "\u2026").join(", ")}`);
-  else err3(`  the workspace resolves NO current law for this domain (materialisation wedged \u2014 the evolve gate did not advance it)`);
+  if (leads.length > 0) err3(`  active: ${leads.map((h) => h.slice(0, 16) + "\u2026").join(", ")}`);
+  else err3(`  the workspace resolves NO active law for this domain (materialisation wedged \u2014 the evolve gate did not advance it)`);
   err3(`  re-run \`githolon deploy ${ws}\`; if it persists, the deploy committed but the workspace kept the old law (report it).`);
   return 2;
 }
@@ -1478,8 +1513,12 @@ async function createEngine({ wasmModule, bootstrapPkg, nomosPkg, replica, insta
   root.set("ws", new Directory(/* @__PURE__ */ new Map()));
   const preopen = new PreopenDirectory("/work", root);
   const STDERR = [];
+  const pushStderr = (l) => {
+    if (STDERR.length >= 500) STDERR.splice(0, STDERR.length - 499);
+    STDERR.push(l);
+  };
   const fds = [new OpenFile(new File([])), ConsoleStdout.lineBuffered(() => {
-  }), ConsoleStdout.lineBuffered((l) => STDERR.push(l)), preopen];
+  }), ConsoleStdout.lineBuffered(pushStderr), preopen];
   const wasi = new WASI(["wasm_git_holon", "reactor"], [], fds, { debug: false });
   const inst = await WebAssembly.instantiate(wasmModule, { wasi_snapshot_preview1: wasi.wasiImport });
   const code = wasi.start(inst);
@@ -1624,24 +1663,10 @@ function parseAttestedReadNeed(error) {
   }
   return null;
 }
-function offerIntent(eng, ws, bytes, opts) {
-  const name = `offer-in-${eng.seq++}.json`;
-  writeWork(eng, name, bytes);
-  const deferProjection = !!(opts && opts.defer);
-  const branch = opts && opts.branch || BRANCH;
-  return JSON.parse(call(eng.ex, "offer", { repoArg: repoArgOf(ws), workspace: ws, intentFile: `/work/${name}`, branch, deferProjection }, eng.STDERR));
-}
-function offerAdmit(eng, ws, bytes, opts) {
-  const v = offerIntent(eng, ws, bytes, opts);
-  return v.outcome === "admitted" ? { ok: true, head: v.head, ...v.born ? { born: v.born } : {} } : { ok: false, error: v.verdict?.reason ?? v.error ?? "the offer was refused" };
-}
-function applyIntentBytes(eng, ws, bytes, opts) {
-  return offerAdmit(eng, ws, bytes, opts);
-}
 function verifyChainLocal(eng, ws) {
   return JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "verifyChain" }), branch: BRANCH }, eng.STDERR));
 }
-var enc3, dec3, BRANCH, RESULT_PACK_INLINE_MAX, repoArgOf, gitdirOf, unpack, repoArgOfGitdir, bytesFromB64, kgit, installPayload, fullRef, applyPackInto, custodyLsRefs, qById, query, attestedRead, cryptoUnwrapKey, count, sum;
+var enc3, dec3, BRANCH, RESULT_PACK_INLINE_MAX, repoArgOf, gitdirOf, unpack, repoArgOfGitdir, bytesFromB64, kgit, installPayload, fullRef, applyPackInto, custodyLsRefs, qById, query, attestedRead, cryptoUnwrapKey, count, sum, spatialWithin;
 var init_engine = __esm({
   "vendor/engine/engine.mjs"() {
     "use strict";
@@ -1707,6 +1732,7 @@ var init_engine = __esm({
     cryptoUnwrapKey = (eng, { secret, hpkeEpk, ct }) => JSON.parse(call(eng.ex, "query", { queryBytes: b64Json({ op: "cryptoUnwrapKey", secret, hpkeEpk, ct }) }, eng.STDERR)).scopeKey;
     count = (eng, ws, countId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "count", countId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
     sum = (eng, ws, sumId, groupKey, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "sum", sumId, groupKey }), principal, branch: BRANCH }, eng.STDERR));
+    spatialWithin = (eng, ws, spatialId, bbox, principal = "") => JSON.parse(call(eng.ex, "query", { repoArg: repoArgOf(ws), workspace: ws, queryBytes: b64Json({ op: "spatial", spatialId, minLng: bbox.minLng, minLat: bbox.minLat, maxLng: bbox.maxLng, maxLat: bbox.maxLat }), principal, branch: BRANCH }, eng.STDERR));
   }
 });
 
@@ -1889,32 +1915,55 @@ async function runOfflineLegs(eng, ws, lawHash, legs, frameworkHash, deployUsda)
   });
   const lines = [];
   const kinds = legs.legs ?? (legs.directiveId !== void 0 ? ["standalone-provable"] : []);
+  const createLegs = [];
   if (legs.directiveId !== void 0) {
-    const payload = { ...legs.payload };
+    createLegs.push({
+      directiveId: legs.directiveId,
+      ...legs.aggregateId !== void 0 ? { aggregateId: legs.aggregateId } : {},
+      ...legs.payload !== void 0 ? { payload: legs.payload } : {},
+      ...legs.autoStamped !== void 0 ? { autoStamped: legs.autoStamped } : {},
+      ...legs.mintField !== void 0 ? { mintField: legs.mintField } : {},
+      ...legs.query !== void 0 ? { query: legs.query } : {},
+      ...legs.count !== void 0 ? { count: legs.count } : {},
+      ...legs.spatial !== void 0 ? { spatial: legs.spatial } : {}
+    });
+    for (const e of legs.extraCreates ?? []) createLegs.push({ ...e });
+  }
+  for (const leg of createLegs) {
+    const payload = { ...leg.payload };
     const stamp = (/* @__PURE__ */ new Date()).toISOString();
-    for (const f of legs.autoStamped ?? []) payload[f] = stamp;
-    if (legs.mintField !== void 0 && legs.aggregateId !== void 0) {
-      payload[legs.mintField] = mintId(eng, legs.aggregateId);
+    for (const f of leg.autoStamped ?? []) payload[f] = stamp;
+    if (leg.mintField !== void 0 && leg.aggregateId !== void 0) {
+      payload[leg.mintField] = mintId(eng, leg.aggregateId);
     }
-    const res = author(eng, ws, legs.domain, legs.directiveId, payload, lawHash);
+    const res = author(eng, ws, legs.domain, leg.directiveId, payload, lawHash);
     if (res.ok === false) {
-      return done(false, lines, `dispatch ${legs.domain}/${legs.directiveId} refused: ${res.error ?? "unknown"} \u2014 the law itself rejected its own synthesized sample; check the directive's plan/payload schema`);
+      return done(false, lines, `dispatch ${legs.domain}/${leg.directiveId} refused: ${res.error ?? "unknown"} \u2014 the law itself rejected its own synthesized sample; check the directive's plan/payload schema`);
     }
     const createdId = (sealedIntentOf(eng, ws, res)?.events ?? []).find((e) => e.marker === "Create")?.aggregate;
-    lines.push(`\u2713 dispatch ${legs.domain}/${legs.directiveId} \u2014 offline write under the new law${createdId !== void 0 ? ` (${createdId.slice(0, 28)}\u2026)` : ""}`);
-    if (legs.query !== void 0) {
-      const rows = query(eng, ws, legs.query.id, JSON.stringify(legs.query.params));
+    lines.push(`\u2713 dispatch ${legs.domain}/${leg.directiveId} \u2014 offline write under the new law${createdId !== void 0 ? ` (${createdId.slice(0, 28)}\u2026)` : ""}`);
+    if (leg.query !== void 0) {
+      const rows = query(eng, ws, leg.query.id, JSON.stringify(leg.query.params));
       if (rows.length !== 1 || createdId !== void 0 && rows[0].id !== createdId) {
-        return done(false, lines, `declared query ${legs.query.id} expected the 1 created row, got ${JSON.stringify(rows.map((r) => r.id))} \u2014 check the query's key fields against the directive's payload`);
+        return done(false, lines, `declared query ${leg.query.id} expected the 1 created row, got ${JSON.stringify(rows.map((r) => r.id))} \u2014 check the query's key fields against the directive's payload`);
       }
-      lines.push(`\u2713 declared query ${legs.query.id} answers locally \u2014 1 row`);
+      lines.push(`\u2713 declared query ${leg.query.id} answers locally \u2014 1 row`);
     }
-    if (legs.count !== void 0) {
-      const c = count(eng, ws, legs.count.id, legs.count.group).count;
+    if (leg.count !== void 0) {
+      const c = count(eng, ws, leg.count.id, leg.count.group).count;
       if (c !== 1) {
-        return done(false, lines, `declared count ${legs.count.id}(${JSON.stringify(legs.count.group)}) expected 1, got ${c} \u2014 check the count's grouping against the created row`);
+        return done(false, lines, `declared count ${leg.count.id}(${JSON.stringify(leg.count.group)}) expected 1, got ${c} \u2014 check the count's grouping against the created row`);
+      }
+      lines.push(`\u2713 declared count ${leg.count.id}(${JSON.stringify(leg.count.group)}) = 1 locally`);
+    }
+    if (leg.spatial !== void 0) {
+      const world = { minLng: -180, minLat: -90, maxLng: 180, maxLat: 90 };
+      const sr = spatialWithin(eng, ws, leg.spatial.id, world);
+      const ids = (sr.rows ?? []).map((r) => r.id);
+      if (sr.ok === false || createdId === void 0 || !ids.includes(createdId)) {
+        return done(false, lines, `spatial ${leg.spatial.id} membership: expected the created row ${createdId ?? "?"} in the world-bbox probe, got ${JSON.stringify(ids)}${sr.error ? ` (${sr.error})` : ""} \u2014 check the indexed geometry path against the directive's payload`);
       }
-      lines.push(`\u2713 declared count ${legs.count.id}(${JSON.stringify(legs.count.group)}) = 1 locally`);
+      lines.push(`\u2713 spatial ${leg.spatial.id} \u2014 the created row answers the R*Tree probe (index membership proven)`);
     }
   }
   if (legs.childBirth !== void 0) {
@@ -1940,6 +1989,13 @@ function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
   const t0 = performance.now();
   const lines = [];
   const done = (ok, error) => ({ ok, ms: performance.now() - t0, legs: lines, ...error !== void 0 ? { error } : {} });
+  if (cb.recipeIssues !== void 0 && cb.recipeIssues.length > 0) {
+    return done(
+      false,
+      `child birth ${cb.parentDomain}/${cb.birthDirectiveId} \u2014 the genesis recipe has ${cb.recipeIssues.length} compile-diagnosed issue(s); fix these and recompile:
+    - ${cb.recipeIssues.join("\n    - ")}`
+    );
+  }
   const fw = frameworkHash ?? eng.hashes?.nomos;
   const payload = { ...cb.birthPayload };
   if (cb.frameworkHashField !== void 0) payload[cb.frameworkHashField] = fw;
@@ -1988,7 +2044,13 @@ function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
   }
   const childWs = (res.born ?? []).map((b) => b?.workspace).find((w) => typeof w === "string" && w.length > 0);
   if (childWs === void 0) {
-    return done(false, `child birth ${cb.parentDomain}/${cb.birthDirectiveId} admitted but the offer-effect spawned no child (born=${JSON.stringify(res.born ?? [])}) \u2014 the run_birth_effect did not fold a child (is the vendored kernel current? does the recipe carry a genesis chain?)`);
+    const kernelSays = eng.STDERR?.filter((l) => l.includes("birth-effect-failed")).at(-1);
+    if (kernelSays !== void 0) {
+      const hint = /not iterable/.test(kernelSays) ? "\n    fix: the named step's plan must RETURN AN ARRAY of ops \u2014 fluent builders (ensure()/create().set(...)) record themselves, so end the plan with `return [];`, or wrap standalone ops in `[ ... ]`. Then recompile and rerun." : "\n    fix: the named genesis step is what the child's own gate refused \u2014 correct that directive/payload in the recipe and recompile. A working template: bench/scale/fixtures/estate-birth.";
+      return done(false, `child birth ${cb.parentDomain}/${cb.birthDirectiveId} admitted, but the child genesis FAILED inside the kernel's birth offer-effect:
+    ${kernelSays.replace(/^nomos:\s*/, "")}${hint}`);
+    }
+    return done(false, `child birth ${cb.parentDomain}/${cb.birthDirectiveId} admitted but the offer-effect spawned no child (born=${JSON.stringify(res.born ?? [])}) and the kernel logged no birth-effect failure \u2014 check the recipe carries a genesis chain (birth({ workspace, genesisChain })), and that the runtime wasm is current (~/.holon/runtime)`);
   }
   lines.push(`\u2713 child birth ${cb.parentDomain}/${cb.birthDirectiveId} \u2014 ${childWs} born (the offer-effect folded the child genesis through the child's OWN gate)`);
   const installed = (hash) => {
@@ -4112,7 +4174,7 @@ var HELP = {
   },
   replay: {
     usage: "githolon replay <ws|dir> [--step N] [--json] [--cloud <url>]",
-    what: "The ledger as film: walk a chain (cloud workspace or local holon directory) and re-apply it\nintent by intent through the SAME wasm gate edge admission runs \u2014 per step: directive, payload,\nthe rows it changed, running per-type tallies. Finale: the chain's verify_chain verdict.\nOn a TTY it steps interactively (enter = next, a = run to end, q = quit).",
+    what: "The ledger as film: walk a chain (cloud workspace or local holon directory), require the\nkernel's from-genesis verify_chain verdict to be green, then render the verified intent stream \u2014\nper step: directive, payload, the rows it changed, running per-type tallies. On a TTY it steps\ninteractively (enter = next, a = run to end, q = quit).",
     flags: [
       ["<ws|dir>", "a workspace name on the cloud, or a local holon directory (githolon ledger init)"],
       ["--step N", "non-interactive; print the running tallies every N intents"],
@@ -4244,11 +4306,11 @@ var HELP = {
   },
   deploy: {
     usage: "githolon deploy [<ws>] [--as <uid>] [--keep-beside] [--retire-replaced] [--file <deploy.json>] [--cloud <url>] [--target <name>]",
-    what: "Deploy build/*.deploy.json \u2014 kernel-gated, no host secret. DEFAULT = REPLACE-CURRENT: for each domain\nkey in the package it resolves the workspace's CURRENT served install (the holon's `currentLaw` frontier\nmap) and passes it as installDomain's `replaces`, so the new law SUPERSEDES the old per key (the prior\ndrops out of the served frontier). Re-deploying the SAME hash stays idempotent (never self-superseded).\nTWO lanes, picked automatically:\n\u2022 SIGNED (a WARRANTED ws, or when --as / the active `githolon use` principal has a signing key on\n  file): signs a `nomos/installDomain` offer (carrying `replaces`) with that key and relays it; the\n  kernel re-verifies the signature + judges the installDomain relation. Required for warranted platforms.\n\u2022 OPEN (unwarranted ws / no key): the open POST /domains \u2014 installs BESIDE (the host-authored lane does\n  not thread `replaces`; the newest-Active frontier still serves the deploy). Sign with --as to supersede.\nAfter the POST it CONFIRMS the deployed hash is the CURRENT serving law (exit 2 if committed-but-not-\ncurrent) and prints what MOVED, per key. With no <ws>, the project's `workspace` binding resolves it.",
+    what: "Deploy build/*.deploy.json \u2014 kernel-gated, no host secret. DEFAULT = REPLACE-CURRENT: for each domain\nkey in the package it resolves the workspace's active install (the holon's existing `currentLaw` map)\nand passes it as installDomain's `replaces`, so the old install becomes superseded for that key.\nRe-deploying the SAME hash stays idempotent (never self-superseded).\nTWO lanes, picked automatically:\n\u2022 SIGNED (a WARRANTED ws, or when --as / the active `githolon use` principal has a signing key on\n  file): signs a `nomos/installDomain` offer (carrying `replaces`) with that key and relays it; the\n  kernel re-verifies the signature + judges the installDomain relation. Required for warranted platforms.\n\u2022 OPEN (unwarranted ws / no key): the open POST /domains installs beside. The new law becomes active,\n  but the prior install is only effectively superseded unless you sign with --as to record Superseded.\nAfter the POST it CONFIRMS the deployed hash is active (exit 2 if committed-but-not-active) and prints\nwhat moved, per key. With no <ws>, the project's `workspace` binding resolves it.\nLifecycle vocabulary: active = served now; superseded = replayable, not served; retired = explicitly withdrawn, replayable, not served.",
     flags: [
       ["--as <uid>", "deploy as this principal via the SIGNED lane (needs its key \u2014 githolon key import; else githolon use)"],
-      ["--keep-beside", "install BESIDE the prior law (the old multi-version default; no supersession)"],
-      ["--retire-replaced", "supersede via Retired (not just Superseded) \u2014 the prior install is explicitly retired"],
+      ["--keep-beside", "install beside the prior law (the old multi-version default; prior becomes effectively superseded by recency)"],
+      ["--retire-replaced", "supersede via Retired \u2014 the prior install is explicitly withdrawn"],
       ["--file <path>", "an explicit deploy body (default: the one build/*.deploy.json)"],
       ["--target <name>", "pick among named targets (workspace: { dev: \u2026, prod: \u2026 })"],
       ["--cloud <url>", "target cloud"]
@@ -4257,7 +4319,7 @@ var HELP = {
   },
   domains: {
     usage: "githolon domains <status <ws> [--explain-current-interface] | retire <ws> <hashOrKey> [--with <hashOrKey>]>",
-    what: "The INSTALL-LIFECYCLE lane over a workspace's law.\n\u2022 status: per domain KEY, the current SERVED hash + phase, then the superseded/retired lineage behind it\n  (replayable installs the frontier excludes). --explain-current-interface spells out WHY the current\n  interface is what it is \u2014 the frontier resolves the newest Active-not-superseded/-retired install per\n  key, so old installs never pollute the current interface.\n\u2022 retire: mark an install Retired (replayable, no longer served) via a signed installDomain offer. The\n  framework retires only as the consequence of installing a SUCCESSOR \u2014 by default the local compiled\n  package (build/*.deploy.json), or --with <hashOrKey> names an already-installed successor. A key the\n  successor does not cover is left with NO served law \u2014 WARNED loudly, never blocked. A key resolves to\n  its current served hash; a 64-hex arg is taken as the install hash.",
+    what: "The INSTALL-LIFECYCLE lane over a workspace's law.\n\u2022 status: per domain KEY, the active hash, then the superseded/retired lineage behind it.\n  Lifecycle vocabulary: active = served now; superseded = replaced by a newer install for the same domain\n  key, replayable, not served; retired = explicitly withdrawn, replayable, not served.\n  --explain-current-interface spells out why active reads/dispatch use only that active map.\n\u2022 retire: mark an install Retired via a signed installDomain offer. The framework retires only as the\n  consequence of installing a SUCCESSOR \u2014 by default the local compiled package (build/*.deploy.json),\n  or --with <hashOrKey> names an already-installed successor. A key the successor does not cover is left\n  with NO active law \u2014 WARNED loudly, never blocked. A key resolves to its active hash; a 64-hex arg is\n  taken as the install hash.",
     flags: [
       ["--explain-current-interface", "status: also explain the frontier resolution (why the interface is what it is)"],
       ["--with <hashOrKey>", "retire: the retiring successor package \u2014 an already-installed hash or served key"],
@@ -4372,7 +4434,6 @@ import git2 from "isomorphic-git";
 var out8 = (s) => void process.stdout.write(s + "\n");
 var err8 = (s) => void process.stderr.write("error: " + s + "\n");
 var SOURCE = "source";
-var REPLAY = "replay";
 function summarizePayload(payload, max = 100) {
   if (payload === void 0) return "\u2014";
   const parts = [];
@@ -4488,32 +4549,26 @@ async function replay(target, opts) {
     err8(`the chain on '${target}' carries no intents \u2014 nothing to replay`);
     return 1;
   }
-  await mountFresh(eng, REPLAY);
+  const verdict = verifyChainLocal(eng, SOURCE);
+  if (verdict["valid"] !== true) {
+    if (json) emit({ finale: true, verdict });
+    else printVerdict(verdict);
+    return 1;
+  }
   const interactive = !json && opts.step === void 0 && process.stdout.isTTY === true && process.stdin.isTTY === true;
   const stepEvery = opts.step ?? (json ? 0 : 0);
   const tallies = /* @__PURE__ */ new Map();
+  const seenRows = /* @__PURE__ */ new Set();
   let autoRun = !interactive;
   if (!json) {
-    out8(`replaying ${chain.length} intent(s) from ${isDir ? target : `${cloud} :: ${target}`} \u2014 every step re-admitted through the wasm gate`);
+    out8(`replaying ${chain.length} intent(s) from ${isDir ? target : `${cloud} :: ${target}`} \u2014 verify_chain green, rendering the sealed event film`);
     if (interactive) out8("  keys: enter = next intent \xB7 a = run to the end \xB7 q = quit\n");
   }
   for (let i = 0; i < chain.length; i++) {
-    const { oid, bytes, doc } = chain[i];
+    const { oid, doc } = chain[i];
     const domain = doc.payload?.domain ?? "?";
     const directive = doc.payload?.directiveId ?? "?";
-    const touched = (doc.events ?? []).map((e) => e.aggregate).filter((a) => typeof a === "string");
-    const before = new Map(touched.map((id) => [id, qById(eng, REPLAY, id)[0]?.data]));
-    const t0 = performance.now();
-    const res = applyIntentBytes(eng, REPLAY, bytes);
-    const ms = performance.now() - t0;
-    if (res.ok === false) {
-      const msg = `replay REFUSED at intent ${i} (${domain}/${directive}, ${oid.slice(0, 10)}): ${res.error ?? "unknown"}`;
-      if (json) emit({ step: i, oid, domain, directive, refused: true, error: res.error ?? "unknown" });
-      else err8(msg);
-      err8("the chain's own gate rejects this entry on a fresh fold \u2014 the source it came from would refuse it too (verify below names the check)");
-      printVerdict(verifyChainLocal(eng, SOURCE));
-      return 1;
-    }
+    const seenBeforeStep = new Set(seenRows);
     for (const ev of doc.events ?? []) {
       if (ev.marker === "Create") tallies.set(typeOf(ev), (tallies.get(typeOf(ev)) ?? 0) + 1);
       if (ev.marker === "Delete") tallies.set(typeOf(ev), (tallies.get(typeOf(ev)) ?? 1) - 1);
@@ -4527,16 +4582,16 @@ async function replay(target, opts) {
         directive,
         payload: capJsonStrings(doc.payload?.payload ?? null),
         events: (doc.events ?? []).map((e) => ({ aggregate: e.aggregate, marker: e.marker, ops: summarizeOps(e) })),
-        applyMs: +ms.toFixed(1),
+        verified: true,
         tallies: Object.fromEntries(tallies)
       });
     } else {
-      out8(`[${String(i + 1).padStart(String(chain.length).length)}/${chain.length}] ${domain}/${directive}  (${oid.slice(0, 10)}, ${ms.toFixed(0)} ms)`);
+      out8(`[${String(i + 1).padStart(String(chain.length).length)}/${chain.length}] ${domain}/${directive}  (${oid.slice(0, 10)})`);
       out8(`      payload  ${summarizePayload(doc.payload?.payload)}`);
       for (const ev of doc.events ?? []) {
         const id = ev.aggregate ?? "?";
-        const was = before.get(id);
-        const verb = ev.marker === "Create" ? "+ created" : ev.marker === "Delete" ? "- deleted" : was === void 0 ? "~ touched" : "~ updated";
+        const hadRow = typeof ev.aggregate === "string" && seenBeforeStep.has(ev.aggregate);
+        const verb = ev.marker === "Create" ? "+ created" : ev.marker === "Delete" ? "- deleted" : hadRow ? "~ updated" : "~ touched";
         out8(`      ${verb}  ${id}`);
         const ops = summarizeOps(ev);
         if (ops.length > 0) out8(`                ${ops}`);
@@ -4545,6 +4600,12 @@ async function replay(target, opts) {
       const showTally = stepEvery > 0 ? (i + 1) % stepEvery === 0 || i === chain.length - 1 : true;
       if (showTally && tallyLine.length > 0) out8(`      rows     ${tallyLine}`);
     }
+    for (const ev of doc.events ?? []) {
+      if (typeof ev.aggregate === "string") {
+        if (ev.marker === "Delete") seenRows.delete(ev.aggregate);
+        else seenRows.add(ev.aggregate);
+      }
+    }
     if (interactive && !autoRun && i < chain.length - 1) {
       const key = await readKey();
       if (key === "quit") {
@@ -4556,7 +4617,6 @@ stopped at intent ${i + 1}/${chain.length} \u2014 the verify verdict below cover
     }
   }
   if (!json) out8("");
-  const verdict = verifyChainLocal(eng, SOURCE);
   if (json) {
     emit({ finale: true, verdict });
     return verdict["valid"] === true ? 0 : 1;
@@ -4631,6 +4691,7 @@ async function decrypt(ws, opts) {
 // src/status.ts
 init_engine();
 init_cloud();
+init_lifecycle();
 import { readFileSync as readFileSync10 } from "node:fs";
 var out10 = (s) => void process.stdout.write(s + "\n");
 var err10 = (s) => void process.stderr.write("error: " + s + "\n");
@@ -4642,39 +4703,39 @@ function lawDiffVerdict(localHash, installed, ws, hasCurrencyData) {
   const localIsCurrent = currents.some((d) => d.domainHash === localHash);
   const lines = [];
   if (localIsCurrent) {
-    lines.push(`\u2713 in sync \u2014 your local build IS the current serving law (${localHash.slice(0, 16)}\u2026)`);
-    if (priors.length > 0) lines.push(`  (${priors.length} prior deploy(s) remain Active under install-beside; yours is the one dispatch resolves)`);
+    lines.push(`\u2713 in sync \u2014 your local build is active (${localHash.slice(0, 16)}\u2026, served now)`);
+    if (priors.length > 0) lines.push(`  (${priors.length} superseded prior deploy(s) are replayable, not served)`);
     return { inSync: true, lines };
   }
   if (!hasCurrencyData && localActive !== void 0) {
-    lines.push(`~ your local build (${localHash.slice(0, 16)}\u2026) is an ACTIVE install on '${ws}'`);
-    lines.push(`  \u26A0 this workspace did not report current-law resolution \u2014 matched by active presence only; can't confirm it is serving`);
+    lines.push(`~ your local build (${localHash.slice(0, 16)}\u2026) is installed on '${ws}'`);
+    lines.push(`  \u26A0 this workspace did not report active-law resolution \u2014 matched by installed presence only; can't confirm it is served now`);
     return { inSync: true, lines };
   }
   if (active.length === 0) {
     lines.push(`\u2717 workspace '${ws}' has NO active tenant law \u2014 your local build is not deployed`);
   } else if (localActive !== void 0) {
     if (currents.length > 0) {
-      lines.push(`~ your build (${localHash.slice(0, 16)}\u2026) is an ACTIVE install on '${ws}', but SUPERSEDED \u2014 a newer deploy is current:`);
-      for (const c of currents) lines.push(`    current  ${c.domainHash.slice(0, 16)}\u2026  (${c.installedBy ?? "?"})  \u2190 resolution serves this`);
+      lines.push(`~ your build (${localHash.slice(0, 16)}\u2026) is superseded on '${ws}' \u2014 a newer deploy is active:`);
+      for (const c of currents) lines.push(`    active  ${c.domainHash.slice(0, 16)}\u2026  (${c.installedBy ?? "?"})  \u2190 served now`);
     } else {
-      lines.push(`\u2717 your build (${localHash.slice(0, 16)}\u2026) is ACTIVE on '${ws}' but is NOT the current serving law \u2014 the deploy did not take effect:`);
-      lines.push(`    the workspace resolves NO current law for this domain (materialisation wedged \u2014 the evolve gate did not advance it)`);
+      lines.push(`\u2717 your build (${localHash.slice(0, 16)}\u2026) is installed on '${ws}' but is NOT active \u2014 the deploy did not take effect:`);
+      lines.push(`    the workspace resolves NO active law for this domain (materialisation wedged \u2014 the evolve gate did not advance it)`);
     }
-    lines.push(`  redeploy to make your build current: githolon deploy ${ws}`);
+    lines.push(`  redeploy to make your build active: githolon deploy ${ws}`);
     return { inSync: false, lines };
   } else if (currents.length > 0) {
-    lines.push(`\u2717 local law differs from the current install${currents.length > 1 ? "s" : ""} on '${ws}':`);
-    for (const c of currents) lines.push(`    current  ${c.domainHash.slice(0, 16)}\u2026  (${c.installedBy ?? "?"})  \u2190 resolution serves this`);
-    if (priors.length > 0) lines.push(`    + ${priors.length} prior active install(s) (install-beside \u2014 historical, not served)`);
+    lines.push(`\u2717 local law differs from the active install${currents.length > 1 ? "s" : ""} on '${ws}':`);
+    for (const c of currents) lines.push(`    active  ${c.domainHash.slice(0, 16)}\u2026  (${c.installedBy ?? "?"})  \u2190 served now`);
+    if (priors.length > 0) lines.push(`    + ${priors.length} superseded prior install(s) (replayable, not served)`);
   } else {
-    lines.push(`\u2717 local law differs from every active installation on '${ws}' (${active.length}):`);
+    lines.push(`\u2717 local law differs from every installed tenant law on '${ws}' (${active.length}):`);
     for (const d of active) lines.push(`    deployed ${d.domainHash.slice(0, 16)}\u2026  (${d.installedBy ?? "?"})`);
   }
-  lines.push(`  remedy: githolon deploy ${ws}   (installs ${localHash.slice(0, 16)}\u2026 and makes it current)`);
+  lines.push(`  remedy: githolon deploy ${ws}   (installs ${localHash.slice(0, 16)}\u2026 and makes it active)`);
   return { inSync: false, lines };
 }
-var CONTROL_PLANE_KEYS = ["nomos", "bootstrap", "workspaces"];
+var FRAMEWORK_DOMAIN_KEYS = ["nomos", "bootstrap", "workspaces"];
 async function status(wsArg, opts) {
   const cloud = cloudBase(opts.cloud);
   let ws;
@@ -4704,17 +4765,21 @@ async function status(wsArg, opts) {
   }
   out10(`workspace  ${ws} on ${cloud}`);
   const allDomains = d.domains ?? [];
-  const controlPlaneHashes = new Set(CONTROL_PLANE_KEYS.map((k) => d.currentLaw?.[k]).filter(Boolean));
-  const domains = allDomains.filter((dm) => !controlPlaneHashes.has(dm.domainHash));
+  const frameworkHashes = new Set(FRAMEWORK_DOMAIN_KEYS.map((k) => d.currentLaw?.[k]).filter(Boolean));
+  const domains = allDomains.filter((dm) => !frameworkHashes.has(dm.domainHash));
   const controllerCount = allDomains.length - domains.length;
   if (allDomains.length === 0) out10(`installed  (none \u2014 not even the controller; the workspace may be unborn)`);
+  const currentHashes = new Set(Object.values(d.currentLaw ?? {}));
   for (const dom of domains) {
-    const mark = dom.current === true ? "  \u2190 current (the holon resolves dispatch here)" : "";
-    out10(`installed  ${(dom.domainHash ?? "?").slice(0, 16)}\u2026  ${dom.phase ?? "?"}  by ${dom.installedBy ?? "?"}${mark}`);
+    const state = domainLifecycleState(dom, currentHashes);
+    const mark = state === "active" ? "  \u2190 served now" : "";
+    out10(`law        ${(dom.domainHash ?? "?").slice(0, 16)}\u2026  ${state.padEnd(10)} by ${dom.installedBy ?? "?"}${mark}`);
   }
-  if (controllerCount > 0) out10(`           (+ ${controllerCount} control-plane install(s) \u2014 the nomos lifecycle controller; not tenant law)`);
+  if (controllerCount > 0) out10(`           (+ ${controllerCount} framework install(s) \u2014 nomos lifecycle/governance; not tenant law)`);
   const tenantActive = domains.filter((dm) => dm.phase === "Active").length;
-  if (tenantActive > 1) out10(`           (${tenantActive} active tenant installs \u2014 install-beside keeps every prior deploy Active; the holon serves the current one per domain)`);
+  const tenantServed = domains.filter((dm) => domainLifecycleState(dm, currentHashes) === "active").length;
+  const tenantSuperseded = domains.filter((dm) => domainLifecycleState(dm, currentHashes) === "superseded").length;
+  if (tenantActive > tenantServed || tenantSuperseded > 0) out10(`           (${tenantServed} active, ${tenantSuperseded} superseded tenant install(s); superseded installs are replayable, not served)`);
   if (localHash === void 0) {
     out10(`local      (no build/*.deploy.json here \u2014 run \`githolon compile\` to build the law this project authors)`);
     return 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.45.0",
+  "version": "0.47.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.45.0",
-    "@githolon/dsl": "^0.45.0",
+    "@githolon/client": "^0.47.0",
+    "@githolon/dsl": "^0.47.0",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {