githolon 0.46.0 → 0.48.0

package/dist/cli.mjs

@@ -351,8 +351,10 @@ var init_governance = __esm({
 // src/lifecycle.ts
 var lifecycle_exports = {};
 __export(lifecycle_exports, {
+  DOMAIN_LIFECYCLE_DX: () => DOMAIN_LIFECYCLE_DX,
   describeDeployPlan: () => describeDeployPlan,
   domainKeysOf: () => domainKeysOf,
+  domainLifecycleState: () => domainLifecycleState,
   domainsRetire: () => domainsRetire,
   domainsStatus: () => domainsStatus,
   fetchInstalledLaw: () => fetchInstalledLaw,
@@ -440,7 +442,7 @@ function describeDeployPlan(plan, targetHash) {
       case "keep-beside":
         return `  ${d.key}: ${t} kept beside ${short(d.currentHash)}`;
       case "idempotent":
-        return `  ${d.key}: unchanged \u2014 ${t} is already the current served law`;
+        return `  ${d.key}: unchanged \u2014 ${t} is already active`;
     }
   });
 }
@@ -450,7 +452,7 @@ function resolveInstallHash(arg, currentLaw) {
   if (hash !== void 0) return { hash };
   const keys = Object.keys(currentLaw);
   return {
-    error: `'${arg}' is neither a 64-hex install hash nor a served domain key` + (keys.length > 0 ? ` (served keys: ${keys.join(", ")})` : " (this workspace serves no law)")
+    error: `'${arg}' is neither a 64-hex install hash nor an active domain key` + (keys.length > 0 ? ` (active keys: ${keys.join(", ")})` : " (this workspace has no active law)")
   };
 }
 function keysServedBy(hash, currentLaw) {
@@ -550,14 +552,37 @@ async function domainsRetire(ws, target, opts) {
   const afterLaw = after.currentLaw ?? {};
   for (const k of retiredKeys) {
     const now = afterLaw[k];
-    out2(`  key '${k}' now serves: ${now !== void 0 ? short(now) : "NO served law"}`);
+    out2(`  key '${k}' now serves: ${now !== void 0 ? short(now) : "NO active law"}`);
   }
   if (stranded.length > 0 && retiredKeys.some((k) => afterLaw[k] === void 0)) {
-    err2(`\u26A0 retiring left these keys with NO served law: ${stranded.join(", ")} \u2014 nothing dispatches/reads them now`);
+    err2(`\u26A0 retiring left these keys with NO active law: ${stranded.join(", ")} \u2014 nothing dispatches/reads them now`);
     err2(`  (deploy law covering them, or this is intentional \u2014 the kernel allows an unserved key)`);
   }
   return 0;
 }
+function domainLifecycleState(row, currentHashes) {
+  if (row.lifecycle === "active" || row.lifecycle === "superseded" || row.lifecycle === "retired") return row.lifecycle;
+  if (row.lifecycle === "current") return "active";
+  const hash = row.domainHash;
+  switch (row.phase) {
+    case "Active":
+      return row.current === true || hash !== void 0 && currentHashes.has(hash) ? "active" : "superseded";
+    case "Superseded":
+      return "superseded";
+    case "Retired":
+      return "retired";
+    case "Pending":
+      return "pending";
+    case "Retiring":
+      return "retiring";
+    case "Disabled":
+      return "disabled";
+    case "Failed":
+      return "failed";
+    default:
+      return "unknown";
+  }
+}
 async function domainsStatus(ws, opts) {
   const cloud = cloudBase(opts.cloud);
   const law = await fetchInstalledLaw(cloud, ws);
@@ -567,43 +592,49 @@ async function domainsStatus(ws, opts) {
   }
   const currentLaw = law.currentLaw ?? {};
   const rows = law.domains ?? [];
-  const phaseOf = (hash) => rows.find((r) => r.domainHash === hash)?.phase ?? "(unknown)";
+  const servedHashes = new Set(Object.values(currentLaw));
+  const lifecycleOf = (row) => domainLifecycleState(row, servedHashes);
+  const lifecycleOfHash = (hash) => {
+    const row = rows.find((r) => r.domainHash === hash);
+    return row !== void 0 ? lifecycleOf(row) : "unknown";
+  };
   const keys = Object.keys(currentLaw).sort();
   out2(`installed law on ${ws} (${cloud})`);
   if (keys.length === 0) {
-    out2(`  (no domain key resolves a served law \u2014 nothing is dispatched/read here)`);
+    out2(`  (no domain key has active law \u2014 nothing is dispatched/read here)`);
   } else {
-    out2(`current interface \u2014 the served law per domain key (the frontier):`);
+    out2(`active law per domain key:`);
     for (const key of keys) {
       const hash = currentLaw[key];
-      out2(`  ${key}  \u2192  ${short(hash)}  [${phaseOf(hash)}]`);
+      out2(`  ${key}  \u2192  ${short(hash)}  [${lifecycleOfHash(hash)}]`);
     }
   }
-  const servedHashes = new Set(Object.values(currentLaw));
   const behind = rows.filter((r) => typeof r.domainHash === "string" && !servedHashes.has(r.domainHash));
   if (behind.length > 0) {
-    out2(`superseded / retired lineage (replayable, NEVER served):`);
+    out2(`superseded/retired lineage (replayable, not served):`);
     for (const r of behind) {
-      out2(`  ${short(r.domainHash)}  [${r.phase ?? "(unknown)"}]${r.generation !== void 0 ? `  gen ${r.generation}` : ""}`);
+      out2(`  ${short(r.domainHash)}  [${lifecycleOf(r)}]${r.generation !== void 0 ? `  gen ${r.generation}` : ""}`);
     }
   } else if (rows.length > 0) {
-    out2(`no superseded/retired installs behind the frontier \u2014 every install is current`);
+    out2(`no superseded or retired installs \u2014 every install is active`);
   }
   if (opts.explain === true) {
     out2(``);
-    out2(`why this is the current interface (the frontier resolution):`);
-    out2(`  the holon resolves, per domain key, the NEWEST '${SERVED_PHASE}' install that is not superseded/`);
-    out2(`  retired (refresh_key_map / rpc_current_law). Every live surface \u2014 the interface identity, reads,`);
-    out2(`  and dispatch \u2014 reads from THIS map, so a superseded/retired install can never pollute it.`);
+    out2(`domain install lifecycle:`);
+    for (const line of DOMAIN_LIFECYCLE_DX) out2(`  - ${line}`);
+    out2(``);
+    out2(`why this is the active interface:`);
+    out2(`  the holon resolves active law per domain key and every live surface \u2014 interface identity, reads,`);
+    out2(`  and dispatch \u2014 reads from that map, so superseded/retired installs cannot pollute it.`);
     for (const key of keys) {
       const hash = currentLaw[key];
-      out2(`  \u2022 '${key}' serves ${short(hash)} \u2014 it is the newest ${SERVED_PHASE} install for this key.`);
+      out2(`  \u2022 '${key}' serves ${short(hash)} \u2014 state: active.`);
     }
     if (behind.length > 0) {
-      const excluded = behind.filter((r) => EXCLUDED_PHASES.has(r.phase ?? "") || !servedHashes.has(r.domainHash)).map((r) => `${short(r.domainHash)} [${r.phase ?? "?"}]`);
+      const excluded = behind.filter((r) => EXCLUDED_PHASES.has(r.phase ?? "") || !servedHashes.has(r.domainHash)).map((r) => `${short(r.domainHash)} [${lifecycleOf(r)}]`);
       out2(`  \u2022 excluded from the interface (replayable, not served): ${excluded.join(", ")}`);
     }
-    out2(`  interface identity per key = the current served hash above; older installs are lineage, not surface.`);
+    out2(`  interface identity per key = the active hash above; older installs are lineage, not surface.`);
   }
   return 0;
 }
@@ -611,7 +642,7 @@ function signingAvailable(opts) {
   const principal = opts.principal ?? activePrincipal();
   return opts.principal !== void 0 || principal !== void 0 && getDeviceKey(principal) !== void 0;
 }
-var out2, err2, short, SERVED_PHASE, EXCLUDED_PHASES;
+var out2, err2, short, EXCLUDED_PHASES, DOMAIN_LIFECYCLE_DX;
 var init_lifecycle = __esm({
   "src/lifecycle.ts"() {
     "use strict";
@@ -619,8 +650,12 @@ var init_lifecycle = __esm({
     out2 = (s) => void process.stdout.write(s + "\n");
     err2 = (s) => void process.stderr.write("error: " + s + "\n");
     short = (h) => h.length > 16 ? h.slice(0, 16) + "\u2026" : h;
-    SERVED_PHASE = "Active";
     EXCLUDED_PHASES = /* @__PURE__ */ new Set(["Superseded", "Retired", "Disabled", "Failed", "Pending", "Retiring"]);
+    DOMAIN_LIFECYCLE_DX = [
+      "active: served now.",
+      "superseded: replaced by a newer install for the same domain key; replayable, not served.",
+      "retired: explicitly withdrawn; replayable, not served."
+    ];
   }
 });
 
@@ -1088,7 +1123,7 @@ async function deploy(ws, opts) {
       return 1;
     }
     const phase = d.installation?.[0]?.data?.["status.phase"];
-    phaseSuffix = typeof phase === "string" ? ` (${phase})` : "";
+    phaseSuffix = phase === "Active" ? " (active)" : typeof phase === "string" ? ` (${phase.toLowerCase()})` : "";
     deployedHash = typeof d.domainHash === "string" ? d.domainHash : void 0;
   }
   const after = await fetch(`${cloud}/v2/workspaces/${ws}/domains`).then((ar) => ar.json()).then((ad) => ad.ok === true ? ad : {}).catch(() => ({}));
@@ -1099,31 +1134,31 @@ async function deploy(ws, opts) {
     if (plan === void 0 || targetHash === void 0 || plan.decisions.length === 0) return;
     for (const line of describeDeployPlan2(plan, targetHash)) out3(line);
     if (plan.replaceCandidates.length > 1) {
-      out3(`  \u26A0 the package's keys were served by ${plan.replaceCandidates.length} different installs \u2014 installDomain supersedes one (${plan.replaces.slice(0, 16)}\u2026); the newest-Active frontier still serves this deploy for every key.`);
+      out3(`  \u26A0 the package's keys were active on ${plan.replaceCandidates.length} different installs \u2014 installDomain supersedes one (${plan.replaces.slice(0, 16)}\u2026); this deploy is active for every key.`);
     }
     if (!signed && plan.replaces !== void 0 && !opts.keepBeside) {
-      out3(`  note: the OPEN (unsigned) lane installs BESIDE \u2014 the new law is current (newest Active) but the prior install is not marked Superseded. Sign with --as <uid> to record the supersession.`);
+      out3(`  note: the OPEN (unsigned) lane installs beside \u2014 the new law is active, and the prior install is effectively superseded but not marked Superseded. Sign with --as <uid> to record the supersession.`);
     }
   };
   if (deployedHash !== void 0 && isCurrent) {
     out3(`\u2713 deployed ${fileName} \u2192 ${ws}${phaseSuffix}`);
     out3(`  law ${describeLawMove(before, deployedHash)}`);
     emitPlan();
-    out3(`  \u2713 current \u2014 dispatch + reads now resolve ${deployedHash.slice(0, 16)}\u2026`);
+    out3(`  \u2713 active \u2014 dispatch + reads now resolve ${deployedHash.slice(0, 16)}\u2026`);
     return 0;
   }
   if (deployedHash === void 0 || !hasCurrencyData) {
     out3(`\u2713 deployed ${fileName} \u2192 ${ws}${phaseSuffix}`);
     if (deployedHash !== void 0) out3(`  law ${describeLawMove(before, deployedHash)}`);
     emitPlan();
-    out3(`  \u26A0 couldn't confirm it is the current serving law (this workspace did not report current-law resolution).`);
+    out3(`  \u26A0 couldn't confirm it is active (this workspace did not report active-law resolution).`);
     return 0;
   }
-  err3(`deployed ${fileName} \u2192 ${ws}${phaseSuffix}, but it is NOT the current serving law \u2014 the upgrade did not take effect`);
-  out3(`  law ${describeLawMove(before, deployedHash)} (committed as an install, but the holon does not resolve it as current)`);
+  err3(`deployed ${fileName} \u2192 ${ws}${phaseSuffix}, but it is NOT active \u2014 the upgrade did not take effect`);
+  out3(`  law ${describeLawMove(before, deployedHash)} (committed as an install, but the holon does not resolve it as active)`);
   const leads = (after.domains ?? []).filter((x) => x.current === true && typeof x.domainHash === "string").map((x) => x.domainHash);
-  if (leads.length > 0) err3(`  current serving: ${leads.map((h) => h.slice(0, 16) + "\u2026").join(", ")}`);
-  else err3(`  the workspace resolves NO current law for this domain (materialisation wedged \u2014 the evolve gate did not advance it)`);
+  if (leads.length > 0) err3(`  active: ${leads.map((h) => h.slice(0, 16) + "\u2026").join(", ")}`);
+  else err3(`  the workspace resolves NO active law for this domain (materialisation wedged \u2014 the evolve gate did not advance it)`);
   err3(`  re-run \`githolon deploy ${ws}\`; if it persists, the deploy committed but the workspace kept the old law (report it).`);
   return 2;
 }
@@ -1478,8 +1513,12 @@ async function createEngine({ wasmModule, bootstrapPkg, nomosPkg, replica, insta
   root.set("ws", new Directory(/* @__PURE__ */ new Map()));
   const preopen = new PreopenDirectory("/work", root);
   const STDERR = [];
+  const pushStderr = (l) => {
+    if (STDERR.length >= 500) STDERR.splice(0, STDERR.length - 499);
+    STDERR.push(l);
+  };
   const fds = [new OpenFile(new File([])), ConsoleStdout.lineBuffered(() => {
-  }), ConsoleStdout.lineBuffered((l) => STDERR.push(l)), preopen];
+  }), ConsoleStdout.lineBuffered(pushStderr), preopen];
   const wasi = new WASI(["wasm_git_holon", "reactor"], [], fds, { debug: false });
   const inst = await WebAssembly.instantiate(wasmModule, { wasi_snapshot_preview1: wasi.wasiImport });
   const code = wasi.start(inst);
@@ -1579,7 +1618,7 @@ function author(eng, ws, domain, directiveId, payload, controllerHash, opts = {}
     writeWork(eng, `envelope-${seq}.json`, enc3.encode(stringifyBig(envelope)));
     v = offerOnce();
   }
-  const res = v.outcome === "admitted" ? { ok: true, head: v.head, intentOut: v.intentOut, ...v.born ? { born: v.born } : {} } : v.outcome === "refused" ? { ok: false, error: v.verdict?.reason ?? v.error } : v;
+  const res = v.outcome === "admitted" ? { ok: true, head: v.head, intentOut: v.intentOut, ...v.born ? { born: v.born } : {}, ...v.birthOutcomes ? { birthOutcomes: v.birthOutcomes } : {} } : v.outcome === "refused" ? { ok: false, error: v.verdict?.reason ?? v.error } : v;
   if (defer && res.ok) (eng.pendingProjection ??= /* @__PURE__ */ new Set()).add(ws);
   return res;
 }
@@ -1950,6 +1989,13 @@ function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
   const t0 = performance.now();
   const lines = [];
   const done = (ok, error) => ({ ok, ms: performance.now() - t0, legs: lines, ...error !== void 0 ? { error } : {} });
+  if (cb.recipeIssues !== void 0 && cb.recipeIssues.length > 0) {
+    return done(
+      false,
+      `child birth ${cb.parentDomain}/${cb.birthDirectiveId} \u2014 the genesis recipe has ${cb.recipeIssues.length} compile-diagnosed issue(s); fix these and recompile:
+    - ${cb.recipeIssues.join("\n    - ")}`
+    );
+  }
   const fw = frameworkHash ?? eng.hashes?.nomos;
   const payload = { ...cb.birthPayload };
   if (cb.frameworkHashField !== void 0) payload[cb.frameworkHashField] = fw;
@@ -1998,7 +2044,29 @@ function runChildBirthLeg(eng, ws, lawHash, cb, frameworkHash) {
   }
   const childWs = (res.born ?? []).map((b) => b?.workspace).find((w) => typeof w === "string" && w.length > 0);
   if (childWs === void 0) {
-    return done(false, `child birth ${cb.parentDomain}/${cb.birthDirectiveId} admitted but the offer-effect spawned no child (born=${JSON.stringify(res.born ?? [])}) \u2014 the run_birth_effect did not fold a child (is the vendored kernel current? does the recipe carry a genesis chain?)`);
+    const planReturnHint = "\n    fix: the named step's plan must RETURN AN ARRAY of ops \u2014 fluent builders (ensure()/create().set(...)) record themselves, so end the plan with `return [];`, or wrap standalone ops in `[ ... ]`. Then recompile and rerun.";
+    const recipeHint = "\n    fix: the named genesis step is what the child's own gate refused \u2014 correct that directive/payload in the recipe and recompile. A working template: bench/scale/fixtures/estate-birth.";
+    const failing = (res.birthOutcomes ?? []).find((o) => o?.status === "failed" || o?.status === "deferred");
+    if (failing !== void 0) {
+      const reason = String(failing.reason ?? "unknown");
+      const what = failing.status === "deferred" ? `the birth of '${failing.workspace}' was DEFERRED to the edge (no local child custody):
+    ${reason}
+    (expected on a host-less/native peer \u2014 the edge materializes the child on next sync; not a law bug)` : `the child genesis of '${failing.workspace}' FAILED inside the kernel's birth offer-effect:
+    ${reason}${/not iterable/.test(reason) ? planReturnHint : recipeHint}`;
+      return done(false, `child birth ${cb.parentDomain}/${cb.birthDirectiveId} admitted, but ${what}`);
+    }
+    const kernelSays = eng.STDERR?.filter((l) => l.includes("birth-effect-failed")).at(-1);
+    if (kernelSays !== void 0) {
+      const hint = /not iterable/.test(kernelSays) ? planReturnHint : recipeHint;
+      return done(false, `child birth ${cb.parentDomain}/${cb.birthDirectiveId} admitted, but the child genesis FAILED inside the kernel's birth offer-effect:
+    ${kernelSays.replace(/^nomos:\s*/, "")}${hint}`);
+    }
+    return done(false, `child birth ${cb.parentDomain}/${cb.birthDirectiveId} admitted but the offer-effect spawned no child (born=${JSON.stringify(res.born ?? [])}) and the kernel logged no birth-effect failure \u2014 check the recipe carries a genesis chain (birth({ workspace, genesisChain })), and that the runtime wasm is current (~/.holon/runtime)`);
+  }
+  const downgraded = (res.birthOutcomes ?? []).find((o) => o?.workspace === childWs && o?.status === "unwarranted-cert");
+  if (downgraded !== void 0) {
+    const checks = downgraded.certChecks !== void 0 ? ` certChecks=${JSON.stringify(downgraded.certChecks)}` : "";
+    lines.push(`\u26A0 child ${childWs} was born UNWARRANTED \u2014 ${String(downgraded.reason ?? "cert not seeded")}${checks}`);
   }
   lines.push(`\u2713 child birth ${cb.parentDomain}/${cb.birthDirectiveId} \u2014 ${childWs} born (the offer-effect folded the child genesis through the child's OWN gate)`);
   const installed = (hash) => {
@@ -4254,11 +4322,11 @@ var HELP = {
   },
   deploy: {
     usage: "githolon deploy [<ws>] [--as <uid>] [--keep-beside] [--retire-replaced] [--file <deploy.json>] [--cloud <url>] [--target <name>]",
-    what: "Deploy build/*.deploy.json \u2014 kernel-gated, no host secret. DEFAULT = REPLACE-CURRENT: for each domain\nkey in the package it resolves the workspace's CURRENT served install (the holon's `currentLaw` frontier\nmap) and passes it as installDomain's `replaces`, so the new law SUPERSEDES the old per key (the prior\ndrops out of the served frontier). Re-deploying the SAME hash stays idempotent (never self-superseded).\nTWO lanes, picked automatically:\n\u2022 SIGNED (a WARRANTED ws, or when --as / the active `githolon use` principal has a signing key on\n  file): signs a `nomos/installDomain` offer (carrying `replaces`) with that key and relays it; the\n  kernel re-verifies the signature + judges the installDomain relation. Required for warranted platforms.\n\u2022 OPEN (unwarranted ws / no key): the open POST /domains \u2014 installs BESIDE (the host-authored lane does\n  not thread `replaces`; the newest-Active frontier still serves the deploy). Sign with --as to supersede.\nAfter the POST it CONFIRMS the deployed hash is the CURRENT serving law (exit 2 if committed-but-not-\ncurrent) and prints what MOVED, per key. With no <ws>, the project's `workspace` binding resolves it.",
+    what: "Deploy build/*.deploy.json \u2014 kernel-gated, no host secret. DEFAULT = REPLACE-CURRENT: for each domain\nkey in the package it resolves the workspace's active install (the holon's existing `currentLaw` map)\nand passes it as installDomain's `replaces`, so the old install becomes superseded for that key.\nRe-deploying the SAME hash stays idempotent (never self-superseded).\nTWO lanes, picked automatically:\n\u2022 SIGNED (a WARRANTED ws, or when --as / the active `githolon use` principal has a signing key on\n  file): signs a `nomos/installDomain` offer (carrying `replaces`) with that key and relays it; the\n  kernel re-verifies the signature + judges the installDomain relation. Required for warranted platforms.\n\u2022 OPEN (unwarranted ws / no key): the open POST /domains installs beside. The new law becomes active,\n  but the prior install is only effectively superseded unless you sign with --as to record Superseded.\nAfter the POST it CONFIRMS the deployed hash is active (exit 2 if committed-but-not-active) and prints\nwhat moved, per key. With no <ws>, the project's `workspace` binding resolves it.\nLifecycle vocabulary: active = served now; superseded = replayable, not served; retired = explicitly withdrawn, replayable, not served.",
     flags: [
       ["--as <uid>", "deploy as this principal via the SIGNED lane (needs its key \u2014 githolon key import; else githolon use)"],
-      ["--keep-beside", "install BESIDE the prior law (the old multi-version default; no supersession)"],
-      ["--retire-replaced", "supersede via Retired (not just Superseded) \u2014 the prior install is explicitly retired"],
+      ["--keep-beside", "install beside the prior law (the old multi-version default; prior becomes effectively superseded by recency)"],
+      ["--retire-replaced", "supersede via Retired \u2014 the prior install is explicitly withdrawn"],
       ["--file <path>", "an explicit deploy body (default: the one build/*.deploy.json)"],
       ["--target <name>", "pick among named targets (workspace: { dev: \u2026, prod: \u2026 })"],
       ["--cloud <url>", "target cloud"]
@@ -4267,7 +4335,7 @@ var HELP = {
   },
   domains: {
     usage: "githolon domains <status <ws> [--explain-current-interface] | retire <ws> <hashOrKey> [--with <hashOrKey>]>",
-    what: "The INSTALL-LIFECYCLE lane over a workspace's law.\n\u2022 status: per domain KEY, the current SERVED hash + phase, then the superseded/retired lineage behind it\n  (replayable installs the frontier excludes). --explain-current-interface spells out WHY the current\n  interface is what it is \u2014 the frontier resolves the newest Active-not-superseded/-retired install per\n  key, so old installs never pollute the current interface.\n\u2022 retire: mark an install Retired (replayable, no longer served) via a signed installDomain offer. The\n  framework retires only as the consequence of installing a SUCCESSOR \u2014 by default the local compiled\n  package (build/*.deploy.json), or --with <hashOrKey> names an already-installed successor. A key the\n  successor does not cover is left with NO served law \u2014 WARNED loudly, never blocked. A key resolves to\n  its current served hash; a 64-hex arg is taken as the install hash.",
+    what: "The INSTALL-LIFECYCLE lane over a workspace's law.\n\u2022 status: per domain KEY, the active hash, then the superseded/retired lineage behind it.\n  Lifecycle vocabulary: active = served now; superseded = replaced by a newer install for the same domain\n  key, replayable, not served; retired = explicitly withdrawn, replayable, not served.\n  --explain-current-interface spells out why active reads/dispatch use only that active map.\n\u2022 retire: mark an install Retired via a signed installDomain offer. The framework retires only as the\n  consequence of installing a SUCCESSOR \u2014 by default the local compiled package (build/*.deploy.json),\n  or --with <hashOrKey> names an already-installed successor. A key the successor does not cover is left\n  with NO active law \u2014 WARNED loudly, never blocked. A key resolves to its active hash; a 64-hex arg is\n  taken as the install hash.",
     flags: [
       ["--explain-current-interface", "status: also explain the frontier resolution (why the interface is what it is)"],
       ["--with <hashOrKey>", "retire: the retiring successor package \u2014 an already-installed hash or served key"],
@@ -4639,6 +4707,7 @@ async function decrypt(ws, opts) {
 // src/status.ts
 init_engine();
 init_cloud();
+init_lifecycle();
 import { readFileSync as readFileSync10 } from "node:fs";
 var out10 = (s) => void process.stdout.write(s + "\n");
 var err10 = (s) => void process.stderr.write("error: " + s + "\n");
@@ -4650,39 +4719,39 @@ function lawDiffVerdict(localHash, installed, ws, hasCurrencyData) {
   const localIsCurrent = currents.some((d) => d.domainHash === localHash);
   const lines = [];
   if (localIsCurrent) {
-    lines.push(`\u2713 in sync \u2014 your local build IS the current serving law (${localHash.slice(0, 16)}\u2026)`);
-    if (priors.length > 0) lines.push(`  (${priors.length} prior deploy(s) remain Active under install-beside; yours is the one dispatch resolves)`);
+    lines.push(`\u2713 in sync \u2014 your local build is active (${localHash.slice(0, 16)}\u2026, served now)`);
+    if (priors.length > 0) lines.push(`  (${priors.length} superseded prior deploy(s) are replayable, not served)`);
     return { inSync: true, lines };
   }
   if (!hasCurrencyData && localActive !== void 0) {
-    lines.push(`~ your local build (${localHash.slice(0, 16)}\u2026) is an ACTIVE install on '${ws}'`);
-    lines.push(`  \u26A0 this workspace did not report current-law resolution \u2014 matched by active presence only; can't confirm it is serving`);
+    lines.push(`~ your local build (${localHash.slice(0, 16)}\u2026) is installed on '${ws}'`);
+    lines.push(`  \u26A0 this workspace did not report active-law resolution \u2014 matched by installed presence only; can't confirm it is served now`);
     return { inSync: true, lines };
   }
   if (active.length === 0) {
     lines.push(`\u2717 workspace '${ws}' has NO active tenant law \u2014 your local build is not deployed`);
   } else if (localActive !== void 0) {
     if (currents.length > 0) {
-      lines.push(`~ your build (${localHash.slice(0, 16)}\u2026) is an ACTIVE install on '${ws}', but SUPERSEDED \u2014 a newer deploy is current:`);
-      for (const c of currents) lines.push(`    current  ${c.domainHash.slice(0, 16)}\u2026  (${c.installedBy ?? "?"})  \u2190 resolution serves this`);
+      lines.push(`~ your build (${localHash.slice(0, 16)}\u2026) is superseded on '${ws}' \u2014 a newer deploy is active:`);
+      for (const c of currents) lines.push(`    active  ${c.domainHash.slice(0, 16)}\u2026  (${c.installedBy ?? "?"})  \u2190 served now`);
     } else {
-      lines.push(`\u2717 your build (${localHash.slice(0, 16)}\u2026) is ACTIVE on '${ws}' but is NOT the current serving law \u2014 the deploy did not take effect:`);
-      lines.push(`    the workspace resolves NO current law for this domain (materialisation wedged \u2014 the evolve gate did not advance it)`);
+      lines.push(`\u2717 your build (${localHash.slice(0, 16)}\u2026) is installed on '${ws}' but is NOT active \u2014 the deploy did not take effect:`);
+      lines.push(`    the workspace resolves NO active law for this domain (materialisation wedged \u2014 the evolve gate did not advance it)`);
     }
-    lines.push(`  redeploy to make your build current: githolon deploy ${ws}`);
+    lines.push(`  redeploy to make your build active: githolon deploy ${ws}`);
     return { inSync: false, lines };
   } else if (currents.length > 0) {
-    lines.push(`\u2717 local law differs from the current install${currents.length > 1 ? "s" : ""} on '${ws}':`);
-    for (const c of currents) lines.push(`    current  ${c.domainHash.slice(0, 16)}\u2026  (${c.installedBy ?? "?"})  \u2190 resolution serves this`);
-    if (priors.length > 0) lines.push(`    + ${priors.length} prior active install(s) (install-beside \u2014 historical, not served)`);
+    lines.push(`\u2717 local law differs from the active install${currents.length > 1 ? "s" : ""} on '${ws}':`);
+    for (const c of currents) lines.push(`    active  ${c.domainHash.slice(0, 16)}\u2026  (${c.installedBy ?? "?"})  \u2190 served now`);
+    if (priors.length > 0) lines.push(`    + ${priors.length} superseded prior install(s) (replayable, not served)`);
   } else {
-    lines.push(`\u2717 local law differs from every active installation on '${ws}' (${active.length}):`);
+    lines.push(`\u2717 local law differs from every installed tenant law on '${ws}' (${active.length}):`);
     for (const d of active) lines.push(`    deployed ${d.domainHash.slice(0, 16)}\u2026  (${d.installedBy ?? "?"})`);
   }
-  lines.push(`  remedy: githolon deploy ${ws}   (installs ${localHash.slice(0, 16)}\u2026 and makes it current)`);
+  lines.push(`  remedy: githolon deploy ${ws}   (installs ${localHash.slice(0, 16)}\u2026 and makes it active)`);
   return { inSync: false, lines };
 }
-var CONTROL_PLANE_KEYS = ["nomos", "bootstrap", "workspaces"];
+var FRAMEWORK_DOMAIN_KEYS = ["nomos", "bootstrap", "workspaces"];
 async function status(wsArg, opts) {
   const cloud = cloudBase(opts.cloud);
   let ws;
@@ -4712,17 +4781,21 @@ async function status(wsArg, opts) {
   }
   out10(`workspace  ${ws} on ${cloud}`);
   const allDomains = d.domains ?? [];
-  const controlPlaneHashes = new Set(CONTROL_PLANE_KEYS.map((k) => d.currentLaw?.[k]).filter(Boolean));
-  const domains = allDomains.filter((dm) => !controlPlaneHashes.has(dm.domainHash));
+  const frameworkHashes = new Set(FRAMEWORK_DOMAIN_KEYS.map((k) => d.currentLaw?.[k]).filter(Boolean));
+  const domains = allDomains.filter((dm) => !frameworkHashes.has(dm.domainHash));
   const controllerCount = allDomains.length - domains.length;
   if (allDomains.length === 0) out10(`installed  (none \u2014 not even the controller; the workspace may be unborn)`);
+  const currentHashes = new Set(Object.values(d.currentLaw ?? {}));
   for (const dom of domains) {
-    const mark = dom.current === true ? "  \u2190 current (the holon resolves dispatch here)" : "";
-    out10(`installed  ${(dom.domainHash ?? "?").slice(0, 16)}\u2026  ${dom.phase ?? "?"}  by ${dom.installedBy ?? "?"}${mark}`);
+    const state = domainLifecycleState(dom, currentHashes);
+    const mark = state === "active" ? "  \u2190 served now" : "";
+    out10(`law        ${(dom.domainHash ?? "?").slice(0, 16)}\u2026  ${state.padEnd(10)} by ${dom.installedBy ?? "?"}${mark}`);
   }
-  if (controllerCount > 0) out10(`           (+ ${controllerCount} control-plane install(s) \u2014 the nomos lifecycle controller; not tenant law)`);
+  if (controllerCount > 0) out10(`           (+ ${controllerCount} framework install(s) \u2014 nomos lifecycle/governance; not tenant law)`);
   const tenantActive = domains.filter((dm) => dm.phase === "Active").length;
-  if (tenantActive > 1) out10(`           (${tenantActive} active tenant installs \u2014 install-beside keeps every prior deploy Active; the holon serves the current one per domain)`);
+  const tenantServed = domains.filter((dm) => domainLifecycleState(dm, currentHashes) === "active").length;
+  const tenantSuperseded = domains.filter((dm) => domainLifecycleState(dm, currentHashes) === "superseded").length;
+  if (tenantActive > tenantServed || tenantSuperseded > 0) out10(`           (${tenantServed} active, ${tenantSuperseded} superseded tenant install(s); superseded installs are replayable, not served)`);
   if (localHash === void 0) {
     out10(`local      (no build/*.deploy.json here \u2014 run \`githolon compile\` to build the law this project authors)`);
     return 0;
@@ -4794,12 +4867,12 @@ deploy is OPEN + kernel-gated \u2014 births return no host secret, ownership is
   githolon ws reclaim <name> [--parent <ws>]              lawful custody discard via a SIGNED governance offer
                                                        (only a retired workspace; never root)
   githolon deploy [<ws>] [--file <deploy.json>]           deploy build/*.deploy.json \u2014 DEFAULT replace-current:
-            [--keep-beside] [--retire-replaced]           the new law SUPERSEDES the prior install per domain
-                                                       key (prints what moved). --keep-beside installs
-                                                       beside; --retire-replaced supersedes via Retired
-  githolon domains status <ws>                            per domain key: the current served law + phase +
-            [--explain-current-interface]                superseded/retired lineage (the served frontier)
-  githolon domains retire <ws> <hashOrKey>                retire an install (marks it Retired \u2014 replayable,
+            [--keep-beside] [--retire-replaced]           new law becomes active; prior install is superseded
+                                                       per domain key (prints what moved). --keep-beside
+                                                       installs beside; --retire-replaced marks retired
+  githolon domains status <ws>                            per domain key: active law plus superseded/retired
+            [--explain-current-interface]                lineage (active = served now)
+  githolon domains retire <ws> <hashOrKey>                retire an install (marks it retired \u2014 replayable,
             [--with <hashOrKey>]                          no longer served) via a signed installDomain offer
   githolon secret set <ws> <push-password>                store a git push password (push-to-create birth lane)
   githolon secret rotate <ws>                             RETIRED \u2014 host holds no ownership credential (410)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "githolon",
-  "version": "0.46.0",
+  "version": "0.48.0",
   "type": "module",
   "description": "githolon — the Nomos developer CLI: Rails-style generators for @githolon/dsl domains + the package compiler. Kernel-independent.",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@bjorn3/browser_wasi_shim": "0.4.2",
-    "@githolon/client": "^0.46.0",
-    "@githolon/dsl": "^0.46.0",
+    "@githolon/client": "^0.48.0",
+    "@githolon/dsl": "^0.48.0",
     "isomorphic-git": "^1.38.4"
   },
   "devDependencies": {