@econ-v1/rpc 7.0.24 → 7.0.27

package/dist/describe-client-error.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Maps any thrown value to what the UI should do with it.
+ *
+ * The routing is the spec's D4 rule, computed once: transport and sync failures already have an
+ * owner (the connectivity pill, the sync indicator), so repeating them per-stage would say one
+ * fact N times. A domain failure has no ambient owner — the node ANSWERED, so the pill reads
+ * "Connected", truthfully — and only the surface that asked can explain it.
+ *
+ * @param {unknown} error
+ * @returns {DescribedClientError}
+ */
+export function describeClientError(error: unknown): DescribedClientError;
+export type DescribedClientError = {
+    readonly message: string;
+    readonly showRetry: boolean;
+    readonly surface: "ambient" | "inline";
+};
+//# sourceMappingURL=describe-client-error.d.ts.map

package/dist/describe-client-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe-client-error.d.ts","sourceRoot":"","sources":["../src/describe-client-error.js"],"names":[],"mappings":"AA0BA;;;;;;;;;;GAUG;AACH,2CAHW,OAAO,GACL,oBAAoB,CA+BhC;mCAhEa;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,QAAQ,CAAA;CAAE"}

package/dist/index.d.ts

@@ -1,7 +1,12 @@
 export { DEVICE_BOOT_STATE_QUERY } from "./device-boot-contract.js";
 export { CLIENT_DEVICE_PENDING_QUERY } from "./client-device-pending-contract.js";
 export { SYNC_CURSORS_QUERY } from "./sync-cursors-contract.js";
+export { describeClientError } from "./describe-client-error.js";
 export type KernelRpcClient = import("./client.js").KernelRpcClient;
+export type DescribedClientError = import("./describe-client-error.js").DescribedClientError;
+export type NodeHealthRow = import("./node-health-query.js").NodeHealthRow;
+export type ResponsivenessState = import("./node-responsiveness.js").ResponsivenessState;
+export type ResponsivenessTracker = import("./node-responsiveness.js").ResponsivenessTracker;
 export type PreparedStage = import("./client.js").PreparedStage;
 export type StageRpcSession = import("./client.js").StageRpcSession;
 export type Unsubscribe = import("./client.js").Unsubscribe;
@@ -158,7 +163,7 @@ export type RpcTransport = import("./transport.js").RpcTransport;
 export type RpcTransportState = import("./transport.js").RpcTransportState;
 export { DOMAIN_ERROR_CODES, DomainError, SYNC_ERROR_CODES, SyncError, TRANSPORT_ERROR_CODES, TransportError } from "@econ-v1/domain";
 export { deserializeClientError, isJsonValue, isSerializableClientError, serializeClientError } from "./errors.js";
-export { KernelRpcTimeoutError, MessagePortKernelRpcClient } from "./message-port-client.js";
+export { DEFAULT_REQUEST_TIMEOUT_MS, KernelRpcTimeoutError, MessagePortKernelRpcClient } from "./message-port-client.js";
 export { NODE_APP_LIFECYCLE_COMMAND, NODE_APP_MEMORY_CAPTURE_COMMAND, NODE_APP_MEMORY_DETAIL_QUERY, NODE_APP_MEMORY_DOWNLOAD_COMMAND, NODE_APP_MEMORY_LIST_QUERY, NODE_APP_MEMORY_OVERVIEW_QUERY, NODE_APP_MEMORY_STATUS_COMMAND } from "./node-app-memory-contract.js";
 export { APPS_LIFECYCLE_PIN_COMMAND, APPS_LIFECYCLE_QUERY } from "./apps-lifecycle-contract.js";
 export { L402_ENFORCEMENT_QUERY, L402_ENFORCEMENT_ROW_ID, L402_ENFORCEMENT_SET_COMMAND } from "./l402-enforcement-contract.js";
@@ -171,4 +176,6 @@ export { isOnboardingCommand, ONBOARDING_COMMAND, ONBOARDING_EVENTS, ONBOARDING_
 export { TRUST_INSTALL_RESTART_COMMAND, TRUST_SKIP_COMMAND, TRUST_STATUS_QUERY, TRUST_VERIFY_COMMAND, isTrustInstallRestartPayload, isTrustSkipPayload, isTrustVerifyPayload } from "./trust-contract.js";
 export { isOwnerClaimCompletePayload, OWNER_CLAIM_COMPLETE_COMMAND, OWNER_CLAIM_PREPARE_COMMAND } from "./onboarding/owner-claim-contract.js";
 export { deserializeRpcEvent, deserializeRpcRequest, deserializeRpcResponse, ipPoolHealthChangedEvent, serializeRpcEvent, serializeRpcRequest, serializeRpcResponse } from "./protocol.js";
+export { createNodeHealthQuery, NODE_HEALTH_QUERY } from "./node-health-query.js";
+export { createResponsivenessTracker, EMA_HOLD_MS } from "./node-responsiveness.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.js"],"names":[],"mappings":";;;8BAEc,OAAO,aAAa,EAAE,eAAe;4BACrC,OAAO,aAAa,EAAE,aAAa;8BACnC,OAAO,aAAa,EAAE,eAAe;0BACrC,OAAO,aAAa,EAAE,WAAW;0BACjC,OAAO,iBAAiB,EAAE,WAAW;0BACrC,OAAO,iBAAiB,EAAE,WAAW;8BACrC,OAAO,iBAAiB,EAAE,eAAe;8BACvB,CAAC,SAAlB,eAAgB,IAAa,OAAO,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC;+BAC1D,CAAC,SAAlB,eAAgB,IAAa,OAAO,iBAAiB,EAAE,kBAAkB,CAAC,CAAC,CAAC;8BAC7E,OAAO,iBAAiB,EAAE,eAAe;2BACzC,OAAO,iBAAiB,EAAE,YAAY;sBACtC,CAAC,IAAW,OAAO,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAC;wBAClD,OAAO,iBAAiB,EAAE,SAAS;sCACnC,OAAO,iBAAiB,EAAE,uBAAuB;4BACjD,OAAO,iBAAiB,EAAE,aAAa;6BACvC,OAAO,iBAAiB,EAAE,cAAc;qCACxC,OAAO,iBAAiB,EAAE,sBAAsB;iCAChD,OAAO,iBAAiB,EAAE,kBAAkB;+BAC5C,OAAO,yBAAyB,EAAE,gBAAgB;yCAClD,OAAO,gBAAgB,EAAE,0BAA0B;8BACnD,OAAO,gBAAgB,EAAE,eAAe;mCACxC,OAAO,gBAAgB,EAAE,oBAAoB;sCAC7C,OAAO,gBAAgB,EAAE,uBAAuB;+BAChD,OAAO,gBAAgB,EAAE,gBAAgB;uCACzC,OAAO,gBAAgB,EAAE,wBAAwB;gCACjD,OAAO,gBAAgB,EAAE,iBAAiB;8BAC1C,OAAO,gBAAgB,EAAE,eAAe;gCACxC,OAAO,gBAAgB,EAAE,iBAAiB;6BAC1C,OAAO,gBAAgB,EAAE,cAAc;qCACvC,OAAO,gBAAgB,EAAE,sBAAsB;4BAC/C,OAAO,gBAAgB,EAAE,aAAa;kDACtC,OAAO,gBAAgB,EAAE,mCAAmC;0CAC5D,OAAO,gBAAgB,EAAE,2BAA2B;uCACpD,OAAO,gBAAgB,EAAE,wBAAwB;0CACjD,OAAO,gBAAgB,EAAE,2BAA2B;oCACpD,OAAO,gBAAgB,EAAE,qBAAqB;wCAC9C,OAAO,gBAAgB,EAAE,yBAAyB;qCAClD,OAAO,gBAAgB,EAAE,sBAAsB;+BAC/C,OAAO,gBAAgB,EAAE,gBAAgB;mCACzC,OAAO,gBAAgB,EAAE,oBAAoB;mCAC7C,OAAO,gBAAgB,EAAE,oBAAoB;kCAC7C,OAAO,gBAAgB,EAAE,mBAAmB;iCAC5C,OAAO,gBAAgB,EAAE,kBAAkB;kCAC3C,OAAO,gBAAgB,EAAE,mBAAmB;8BAC5C,OAAO,gBAAgB,EAAE,eAAe;oCACxC,OAAO,gBAAgB,EAAE,qBAAqB;uCAC9C,OAAO,gBAAgB,EAAE,wBAAwB;sCACjD,OAAO,gBAAgB,EAAE,uBAAuB;gCAChD,OAAO,gBAAgB,EAAE,iBAAiB;+BAC1C,OAAO,gBAAgB,EAAE,gBAAgB;sCACzC,OAAO,gBAAgB,EAAE,uBAAuB;kCAChD,OAAO,gBAAgB,EAAE,mBAAmB;iCAC5C,OAAO,gBAAgB,EAAE,kBAAkB;iCAC3C,OAAO,gBAAgB,EAAE,kBAAkB;4BAC3C,OAAO,gBAAgB,EAAE,aAAa;wCACtC,OAAO,gBAAgB,EAAE,yBAAyB;kCAClD,OAAO,gBAAgB,EAAE,mBAAmB;iCAC5C,OAAO,gBAAgB,EAAE,kBAAkB;sCAC3C,OAAO,gBAAgB,EAAE,uBAAuB;kCAChD,OAAO,gBAAgB,EAAE,mBAAmB;+BAC5C,OAAO,gBAAgB,EAAE,gBAAgB;iCACzC,OAAO,gBAAgB,EAAE,kBAAkB;qCAC3C,OAAO,gBAAgB,EAAE,sBAAsB;qCAC/C,OAAO,gBAAgB,EAAE,sBAAsB;mCAC/C,OAAO,gBAAgB,EAAE,oBAAoB;gCAC7C,OAAO,gBAAgB,EAAE,iBAAiB;gCAC1C,OAAO,gBAAgB,EAAE,iBAAiB;qCAC1C,OAAO,gBAAgB,EAAE,sBAAsB;4CAC/C,OAAO,gBAAgB,EAAE,6BAA6B;wCACtD,OAAO,gBAAgB,EAAE,yBAAyB;kCAClD,OAAO,gBAAgB,EAAE,mBAAmB;kCAC5C,OAAO,gBAAgB,EAAE,mBAAmB;mCAC5C,OAAO,gBAAgB,EAAE,oBAAoB;mCAC7C,OAAO,gBAAgB,EAAE,oBAAoB;8BAC7C,OAAO,gBAAgB,EAAE,eAAe;gDACxC,OAAO,0BAA0B,EAAE,iCAAiC;uCACpE,OAAO,oCAAoC,EAAE,wBAAwB;qCACrE,OAAO,oCAAoC,EAAE,sBAAsB;iCACnE,OAAO,oCAAoC,EAAE,kBAAkB;kCAC/D,OAAO,oCAAoC,EAAE,mBAAmB;qCAChE,OAAO,oCAAoC,EAAE,sBAAsB;kCACnE,OAAO,oCAAoC,EAAE,mBAAmB;qCAChE,OAAO,oCAAoC,EAAE,sBAAsB;sCACnE,OAAO,oCAAoC,EAAE,uBAAuB;sCACpE,OAAO,qCAAqC,EAAE,uBAAuB;gCACrE,OAAO,qCAAqC,EAAE,iBAAiB;2CAC/D,OAAO,qCAAqC,EAAE,4BAA4B;8BAC1E,OAAO,qCAAqC,EAAE,eAAe;uCAC7D,OAAO,qCAAqC,EAAE,wBAAwB;wCACtE,OAAO,qCAAqC,EAAE,yBAAyB;8BACvE,OAAO,qCAAqC,EAAE,eAAe;iCAC7D,OAAO,qCAAqC,EAAE,kBAAkB;+BAChE,OAAO,qCAAqC,EAAE,gBAAgB;6BAC9D,OAAO,qCAAqC,EAAE,cAAc;6CAC5D,OAAO,+BAA+B,EAAE,8BAA8B;6CACtE,OAAO,8BAA8B,EAAE,8BAA8B;8BACrE,OAAO,gCAAgC,EAAE,eAAe;iCACxD,OAAO,gCAAgC,EAAE,kBAAkB;oCAC3D,OAAO,gCAAgC,EAAE,qBAAqB;wCAC9D,OAAO,gCAAgC,EAAE,yBAAyB;2BAClE,OAAO,sBAAsB,EAAE,YAAY;2BAC3C,OAAO,sBAAsB,EAAE,YAAY;2BAC3C,OAAO,sBAAsB,EAAE,YAAY;4BAC3C,OAAO,sBAAsB,EAAE,aAAa;qCAC5C,OAAO,qCAAqC,EAAE,sBAAsB;2CACpE,OAAO,8BAA8B,EAAE,4BAA4B;iCACnE,OAAO,2BAA2B,EAAE,kBAAkB;2BACtD,OAAO,8BAA8B,EAAE,YAAY;yCACnD,OAAO,8BAA8B,EAAE,0BAA0B;+BACjE,OAAO,8BAA8B,EAAE,gBAAgB;wCACvD,OAAO,8BAA8B,EAAE,yBAAyB;6BAChE,OAAO,4BAA4B,EAAE,cAAc;iCACnD,OAAO,qCAAqC,EAAE,kBAAkB;iCAChE,OAAO,qCAAqC,EAAE,kBAAkB;sCAChE,OAAO,qCAAqC,EAAE,uBAAuB;oCACrE,OAAO,qCAAqC,EAAE,qBAAqB;uCACnE,OAAO,qCAAqC,EAAE,wBAAwB;sCACtE,OAAO,qCAAqC,EAAE,uBAAuB;sCACrE,OAAO,qCAAqC,EAAE,uBAAuB;6CACrE,OAAO,qCAAqC,EAAE,8BAA8B;gCAC5E,OAAO,qCAAqC,EAAE,iBAAiB;mCAC/D,OAAO,qCAAqC,EAAE,oBAAoB;+BAClE,OAAO,qCAAqC,EAAE,gBAAgB;qCAC9D,OAAO,qCAAqC,EAAE,sBAAsB;wCACpE,OAAO,sCAAsC,EAAE,yBAAyB;wCACxE,OAAO,sCAAsC,EAAE,yBAAyB;uCACxE,OAAO,sCAAsC,EAAE,wBAAwB;sCACvE,OAAO,sCAAsC,EAAE,uBAAuB;8BACtE,OAAO,qBAAqB,EAAE,eAAe;6BAC7C,OAAO,oBAAoB,EAAE,cAAc;6BAC3C,OAAO,oBAAoB,EAAE,cAAc;2BAC3C,OAAO,6BAA6B,EAAE,YAAY;iCAClD,OAAO,6BAA6B,EAAE,kBAAkB;qCACxD,OAAO,6BAA6B,EAAE,sBAAsB;qCAC5D,OAAO,6BAA6B,EAAE,sBAAsB;+BAC5D,OAAO,6BAA6B,EAAE,gBAAgB;iCACtD,OAAO,6BAA6B,EAAE,kBAAkB;kCACxD,OAAO,6BAA6B,EAAE,mBAAmB;iCACzD,OAAO,6BAA6B,EAAE,kBAAkB;4CACxD,OAAO,6BAA6B,EAAE,6BAA6B;qCACnE,OAAO,6BAA6B,EAAE,sBAAsB;iCAC5D,OAAO,6BAA6B,EAAE,kBAAkB;gCACxD,OAAO,6BAA6B,EAAE,iBAAiB;mCACvD,OAAO,6BAA6B,EAAE,oBAAoB;gCAC1D,OAAO,6BAA6B,EAAE,iBAAiB;mCACvD,OAAO,6BAA6B,EAAE,oBAAoB;gCAC1D,OAAO,6BAA6B,EAAE,iBAAiB;uBACvD,OAAO,eAAe,EAAE,QAAQ;yBAChC,OAAO,eAAe,EAAE,UAAU;0BAClC,OAAO,eAAe,EAAE,WAAW;2BACnC,OAAO,oBAAoB,EAAE,YAAY;2BACzC,OAAO,oBAAoB,EAAE,YAAY;0BACzC,OAAO,oBAAoB,EAAE,WAAW;2BACxC,OAAO,gBAAgB,EAAE,YAAY;gCACrC,OAAO,gBAAgB,EAAE,iBAAiB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.js"],"names":[],"mappings":";;;;8BAEc,OAAO,aAAa,EAAE,eAAe;mCACrC,OAAO,4BAA4B,EAAE,oBAAoB;4BACzD,OAAO,wBAAwB,EAAE,aAAa;kCAC9C,OAAO,0BAA0B,EAAE,mBAAmB;oCACtD,OAAO,0BAA0B,EAAE,qBAAqB;4BACxD,OAAO,aAAa,EAAE,aAAa;8BACnC,OAAO,aAAa,EAAE,eAAe;0BACrC,OAAO,aAAa,EAAE,WAAW;0BACjC,OAAO,iBAAiB,EAAE,WAAW;0BACrC,OAAO,iBAAiB,EAAE,WAAW;8BACrC,OAAO,iBAAiB,EAAE,eAAe;8BACvB,CAAC,SAAlB,eAAgB,IAAa,OAAO,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC;+BAC1D,CAAC,SAAlB,eAAgB,IAAa,OAAO,iBAAiB,EAAE,kBAAkB,CAAC,CAAC,CAAC;8BAC7E,OAAO,iBAAiB,EAAE,eAAe;2BACzC,OAAO,iBAAiB,EAAE,YAAY;sBACtC,CAAC,IAAW,OAAO,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAC;wBAClD,OAAO,iBAAiB,EAAE,SAAS;sCACnC,OAAO,iBAAiB,EAAE,uBAAuB;4BACjD,OAAO,iBAAiB,EAAE,aAAa;6BACvC,OAAO,iBAAiB,EAAE,cAAc;qCACxC,OAAO,iBAAiB,EAAE,sBAAsB;iCAChD,OAAO,iBAAiB,EAAE,kBAAkB;+BAC5C,OAAO,yBAAyB,EAAE,gBAAgB;yCAClD,OAAO,gBAAgB,EAAE,0BAA0B;8BACnD,OAAO,gBAAgB,EAAE,eAAe;mCACxC,OAAO,gBAAgB,EAAE,oBAAoB;sCAC7C,OAAO,gBAAgB,EAAE,uBAAuB;+BAChD,OAAO,gBAAgB,EAAE,gBAAgB;uCACzC,OAAO,gBAAgB,EAAE,wBAAwB;gCACjD,OAAO,gBAAgB,EAAE,iBAAiB;8BAC1C,OAAO,gBAAgB,EAAE,eAAe;gCACxC,OAAO,gBAAgB,EAAE,iBAAiB;6BAC1C,OAAO,gBAAgB,EAAE,cAAc;qCACvC,OAAO,gBAAgB,EAAE,sBAAsB;4BAC/C,OAAO,gBAAgB,EAAE,aAAa;kDACtC,OAAO,gBAAgB,EAAE,mCAAmC;0CAC5D,OAAO,gBAAgB,EAAE,2BAA2B;uCACpD,OAAO,gBAAgB,EAAE,wBAAwB;0CACjD,OAAO,gBAAgB,EAAE,2BAA2B;oCACpD,OAAO,gBAAgB,EAAE,qBAAqB;wCAC9C,OAAO,gBAAgB,EAAE,yBAAyB;qCAClD,OAAO,gBAAgB,EAAE,sBAAsB;+BAC/C,OAAO,gBAAgB,EAAE,gBAAgB;mCACzC,OAAO,gBAAgB,EAAE,oBAAoB;mCAC7C,OAAO,gBAAgB,EAAE,oBAAoB;kCAC7C,OAAO,gBAAgB,EAAE,mBAAmB;iCAC5C,OAAO,gBAAgB,EAAE,kBAAkB;kCAC3C,OAAO,gBAAgB,EAAE,mBAAmB;8BAC5C,OAAO,gBAAgB,EAAE,eAAe;oCACxC,OAAO,gBAAgB,EAAE,qBAAqB;uCAC9C,OAAO,gBAAgB,EAAE,wBAAwB;sCACjD,OAAO,gBAAgB,EAAE,uBAAuB;gCAChD,OAAO,gBAAgB,EAAE,iBAAiB;+BAC1C,OAAO,gBAAgB,EAAE,gBAAgB;sCACzC,OAAO,gBAAgB,EAAE,uBAAuB;kCAChD,OAAO,gBAAgB,EAAE,mBAAmB;iCAC5C,OAAO,gBAAgB,EAAE,kBAAkB;iCAC3C,OAAO,gBAAgB,EAAE,kBAAkB;4BAC3C,OAAO,gBAAgB,EAAE,aAAa;wCACtC,OAAO,gBAAgB,EAAE,yBAAyB;kCAClD,OAAO,gBAAgB,EAAE,mBAAmB;iCAC5C,OAAO,gBAAgB,EAAE,kBAAkB;sCAC3C,OAAO,gBAAgB,EAAE,uBAAuB;kCAChD,OAAO,gBAAgB,EAAE,mBAAmB;+BAC5C,OAAO,gBAAgB,EAAE,gBAAgB;iCACzC,OAAO,gBAAgB,EAAE,kBAAkB;qCAC3C,OAAO,gBAAgB,EAAE,sBAAsB;qCAC/C,OAAO,gBAAgB,EAAE,sBAAsB;mCAC/C,OAAO,gBAAgB,EAAE,oBAAoB;gCAC7C,OAAO,gBAAgB,EAAE,iBAAiB;gCAC1C,OAAO,gBAAgB,EAAE,iBAAiB;qCAC1C,OAAO,gBAAgB,EAAE,sBAAsB;4CAC/C,OAAO,gBAAgB,EAAE,6BAA6B;wCACtD,OAAO,gBAAgB,EAAE,yBAAyB;kCAClD,OAAO,gBAAgB,EAAE,mBAAmB;kCAC5C,OAAO,gBAAgB,EAAE,mBAAmB;mCAC5C,OAAO,gBAAgB,EAAE,oBAAoB;mCAC7C,OAAO,gBAAgB,EAAE,oBAAoB;8BAC7C,OAAO,gBAAgB,EAAE,eAAe;gDACxC,OAAO,0BAA0B,EAAE,iCAAiC;uCACpE,OAAO,oCAAoC,EAAE,wBAAwB;qCACrE,OAAO,oCAAoC,EAAE,sBAAsB;iCACnE,OAAO,oCAAoC,EAAE,kBAAkB;kCAC/D,OAAO,oCAAoC,EAAE,mBAAmB;qCAChE,OAAO,oCAAoC,EAAE,sBAAsB;kCACnE,OAAO,oCAAoC,EAAE,mBAAmB;qCAChE,OAAO,oCAAoC,EAAE,sBAAsB;sCACnE,OAAO,oCAAoC,EAAE,uBAAuB;sCACpE,OAAO,qCAAqC,EAAE,uBAAuB;gCACrE,OAAO,qCAAqC,EAAE,iBAAiB;2CAC/D,OAAO,qCAAqC,EAAE,4BAA4B;8BAC1E,OAAO,qCAAqC,EAAE,eAAe;uCAC7D,OAAO,qCAAqC,EAAE,wBAAwB;wCACtE,OAAO,qCAAqC,EAAE,yBAAyB;8BACvE,OAAO,qCAAqC,EAAE,eAAe;iCAC7D,OAAO,qCAAqC,EAAE,kBAAkB;+BAChE,OAAO,qCAAqC,EAAE,gBAAgB;6BAC9D,OAAO,qCAAqC,EAAE,cAAc;6CAC5D,OAAO,+BAA+B,EAAE,8BAA8B;6CACtE,OAAO,8BAA8B,EAAE,8BAA8B;8BACrE,OAAO,gCAAgC,EAAE,eAAe;iCACxD,OAAO,gCAAgC,EAAE,kBAAkB;oCAC3D,OAAO,gCAAgC,EAAE,qBAAqB;wCAC9D,OAAO,gCAAgC,EAAE,yBAAyB;2BAClE,OAAO,sBAAsB,EAAE,YAAY;2BAC3C,OAAO,sBAAsB,EAAE,YAAY;2BAC3C,OAAO,sBAAsB,EAAE,YAAY;4BAC3C,OAAO,sBAAsB,EAAE,aAAa;qCAC5C,OAAO,qCAAqC,EAAE,sBAAsB;2CACpE,OAAO,8BAA8B,EAAE,4BAA4B;iCACnE,OAAO,2BAA2B,EAAE,kBAAkB;2BACtD,OAAO,8BAA8B,EAAE,YAAY;yCACnD,OAAO,8BAA8B,EAAE,0BAA0B;+BACjE,OAAO,8BAA8B,EAAE,gBAAgB;wCACvD,OAAO,8BAA8B,EAAE,yBAAyB;6BAChE,OAAO,4BAA4B,EAAE,cAAc;iCACnD,OAAO,qCAAqC,EAAE,kBAAkB;iCAChE,OAAO,qCAAqC,EAAE,kBAAkB;sCAChE,OAAO,qCAAqC,EAAE,uBAAuB;oCACrE,OAAO,qCAAqC,EAAE,qBAAqB;uCACnE,OAAO,qCAAqC,EAAE,wBAAwB;sCACtE,OAAO,qCAAqC,EAAE,uBAAuB;sCACrE,OAAO,qCAAqC,EAAE,uBAAuB;6CACrE,OAAO,qCAAqC,EAAE,8BAA8B;gCAC5E,OAAO,qCAAqC,EAAE,iBAAiB;mCAC/D,OAAO,qCAAqC,EAAE,oBAAoB;+BAClE,OAAO,qCAAqC,EAAE,gBAAgB;qCAC9D,OAAO,qCAAqC,EAAE,sBAAsB;wCACpE,OAAO,sCAAsC,EAAE,yBAAyB;wCACxE,OAAO,sCAAsC,EAAE,yBAAyB;uCACxE,OAAO,sCAAsC,EAAE,wBAAwB;sCACvE,OAAO,sCAAsC,EAAE,uBAAuB;8BACtE,OAAO,qBAAqB,EAAE,eAAe;6BAC7C,OAAO,oBAAoB,EAAE,cAAc;6BAC3C,OAAO,oBAAoB,EAAE,cAAc;2BAC3C,OAAO,6BAA6B,EAAE,YAAY;iCAClD,OAAO,6BAA6B,EAAE,kBAAkB;qCACxD,OAAO,6BAA6B,EAAE,sBAAsB;qCAC5D,OAAO,6BAA6B,EAAE,sBAAsB;+BAC5D,OAAO,6BAA6B,EAAE,gBAAgB;iCACtD,OAAO,6BAA6B,EAAE,kBAAkB;kCACxD,OAAO,6BAA6B,EAAE,mBAAmB;iCACzD,OAAO,6BAA6B,EAAE,kBAAkB;4CACxD,OAAO,6BAA6B,EAAE,6BAA6B;qCACnE,OAAO,6BAA6B,EAAE,sBAAsB;iCAC5D,OAAO,6BAA6B,EAAE,kBAAkB;gCACxD,OAAO,6BAA6B,EAAE,iBAAiB;mCACvD,OAAO,6BAA6B,EAAE,oBAAoB;gCAC1D,OAAO,6BAA6B,EAAE,iBAAiB;mCACvD,OAAO,6BAA6B,EAAE,oBAAoB;gCAC1D,OAAO,6BAA6B,EAAE,iBAAiB;uBACvD,OAAO,eAAe,EAAE,QAAQ;yBAChC,OAAO,eAAe,EAAE,UAAU;0BAClC,OAAO,eAAe,EAAE,WAAW;2BACnC,OAAO,oBAAoB,EAAE,YAAY;2BACzC,OAAO,oBAAoB,EAAE,YAAY;0BACzC,OAAO,oBAAoB,EAAE,WAAW;2BACxC,OAAO,gBAAgB,EAAE,YAAY;gCACrC,OAAO,gBAAgB,EAAE,iBAAiB"}

package/dist/message-port-client.d.ts

@@ -16,6 +16,7 @@ export class KernelRpcTimeoutError extends Error {
     /** @readonly @type {number} */
     readonly timeoutMs: number;
 }
+export const DEFAULT_REQUEST_TIMEOUT_MS: 30000;
 /** @implements {KernelRpcClient} */
 export class MessagePortKernelRpcClient implements KernelRpcClient {
     /**
@@ -132,7 +133,10 @@ export type PendingRequest = {
     readonly reject: (error: unknown) => void;
     readonly resolve: (value: JsonValue) => void;
     readonly sessionId: string | undefined;
+    readonly slowBarId: ReturnType<typeof globalThis.setTimeout>;
+    readonly startedAtMs: number;
     readonly timeoutId: ReturnType<typeof globalThis.setTimeout>;
+    readonly timeoutMs: number;
 };
 export type EventGroup = {
     readonly eventType: KernelEventType;
@@ -147,8 +151,14 @@ export type LiveQueryGroup = {
     readonly sessionId: string | undefined;
     readonly subscriptionId: string;
 };
+export type RpcResponsivenessObserver = {
+    markSlow(id: string): void;
+    settle(id: string, elapsedMs: number, answered: boolean, timeoutMs: number): void;
+};
 export type MessagePortKernelRpcClientOptions = {
+    readonly monotonicNow?: () => number;
     readonly now?: () => string;
+    readonly observer?: RpcResponsivenessObserver;
     readonly requestTimeoutMs?: number;
 };
 //# sourceMappingURL=message-port-client.d.ts.map

package/dist/message-port-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"message-port-client.d.ts","sourceRoot":"","sources":["../src/message-port-client.js"],"names":[],"mappings":"AA+CA;;;GAGG;AACH;IAQE;;;;OAIG;IACH,yBAJW,MAAM,iBACN,MAAM,aACN,MAAM,EAQhB;IAlBD,+BAA+B;IAC/B,sBADqB,MAAM,CACf;IACZ,+BAA+B;IAC/B,wBADqB,MAAM,CACb;IACd,+BAA+B;IAC/B,oBADqB,MAAM,CACjB;CAcX;AA2CD,oCAAoC;AACpC,mDADiB,eAAe;IA0B9B;;;OAGG;IACH,uBAHW,YAAY,YACZ,iCAAiC,EAQ3C;IAED,cAIC;IAED;;;;;OAKG;IACH,QALa,CAAC,QACH,MAAM,WACN,OAAO,GACL,OAAO,CAAC,CAAC,CAAC,CAItB;IAED;;;;;;OAMG;IACH,UANa,CAAC,QACH,SAAS,UACT,OAAO,YACP,CAAC,IAAI,EAAE,OAAO,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,GACpD,WAAW,CAIvB;IAED;;;;;OAKG;IACH,0BALW,MAAM,kBACN,MAAM,cACN,MAAM,GACJ,OAAO,CAAC,eAAe,CAAC,CAapC;IAED;;;OAGG;IACH,sBAHW,MAAM,GACJ,OAAO,CAAC,aAAa,CAAC,CA0BlC;IAED;;;;;OAKG;IACH,QAL+B,CAAC,SAAlB,eAAgB,QACnB,CAAC,WACD,OAAO,iBAAiB,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAC7C,OAAO,CAAC,IAAI,CAAC,CAKzB;IAED;;;;;OAKG;IACH,MALa,CAAC,QACH,SAAS,UACT,OAAO,GACL,OAAO,CAAC,CAAC,CAAC,CAItB;IAED;;;;;OAKG;IACH,UAL+B,CAAC,SAAlB,eAAgB,QACnB,CAAC,YACD,CAAC,KAAK,EAAE,OAAO,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC,KAAK,IAAI,GAC7D,WAAW,CAIvB;IAED,gCAAgC;IAChC,6BADY,MAAM,QAUjB;IAED;;;;;;OAMG;IACH,sBANa,CAAC,aACH,MAAM,cACN,MAAM,WACN,OAAO,GACL,OAAO,CAAC,CAAC,CAAC,CAStB;IAED;;;;;;;OAOG;IACH,eAPa,CAAC,aACH,MAAM,QACN,SAAS,UACT,OAAO,YACP,CAAC,IAAI,EAAE,OAAO,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,GACpD,WAAW,CAIvB;IAED;;;;;;OAMG;IACH,aAN+B,CAAC,SAAlB,eAAgB,aACnB,MAAM,QACN,CAAC,WACD,OAAO,iBAAiB,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAC7C,OAAO,CAAC,IAAI,CAAC,CAKzB;IAED;;;;;;OAMG;IACH,WANa,CAAC,aACH,MAAM,QACN,SAAS,UACT,OAAO,GACL,OAAO,CAAC,CAAC,CAAC,CAStB;IAED;;;;;;OAMG;IACH,eAN+B,CAAC,SAAlB,eAAgB,aACnB,MAAM,QACN,CAAC,YACD,CAAC,KAAK,EAAE,OAAO,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC,KAAK,IAAI,GAC7D,WAAW,CAIvB;;CAgPF;0BAnjBa,OAAO,iBAAiB,EAAE,WAAW;wBACrC,OAAO,iBAAiB,EAAE,SAAS;8BACnC,OAAO,iBAAiB,EAAE,eAAe;wBACzC,OAAO,iBAAiB,EAAE,SAAS;8BACnC,OAAO,aAAa,EAAE,eAAe;4BACrC,OAAO,aAAa,EAAE,aAAa;8BACnC,OAAO,aAAa,EAAE,eAAe;0BACrC,OAAO,aAAa,EAAE,WAAW;yBACjC,OAAO,eAAe,EAAE,UAAU;kCAClC,UAAU,SAAS,MAAM,QAAQ,GAAG,QAAQ,SAAS,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,KAAK,GAAG,KAAK;2BACtG,OAAO,gBAAgB,EAAE,YAAY;6BACrC;IAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,UAAU,CAAC,CAAA;CAAE;yBACjM;IAAE,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAAE;6BACvK;IAAE,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,OAAO,iBAAiB,EAAE,SAAS,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAAE;gDAC1N;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE"}
+{"version":3,"file":"message-port-client.d.ts","sourceRoot":"","sources":["../src/message-port-client.js"],"names":[],"mappings":"AAiDA;;;GAGG;AACH;IAQE;;;;OAIG;IACH,yBAJW,MAAM,iBACN,MAAM,aACN,MAAM,EAQhB;IAlBD,+BAA+B;IAC/B,sBADqB,MAAM,CACf;IACZ,+BAA+B;IAC/B,wBADqB,MAAM,CACb;IACd,+BAA+B;IAC/B,oBADqB,MAAM,CACjB;CAcX;AAqBD,+CAAmE;AAuCnE,oCAAoC;AACpC,mDADiB,eAAe;IA8B9B;;;OAGG;IACH,uBAHW,YAAY,YACZ,iCAAiC,EAU3C;IAED,cAIC;IAED;;;;;OAKG;IACH,QALa,CAAC,QACH,MAAM,WACN,OAAO,GACL,OAAO,CAAC,CAAC,CAAC,CAItB;IAED;;;;;;OAMG;IACH,UANa,CAAC,QACH,SAAS,UACT,OAAO,YACP,CAAC,IAAI,EAAE,OAAO,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,GACpD,WAAW,CAIvB;IAED;;;;;OAKG;IACH,0BALW,MAAM,kBACN,MAAM,cACN,MAAM,GACJ,OAAO,CAAC,eAAe,CAAC,CAapC;IAED;;;OAGG;IACH,sBAHW,MAAM,GACJ,OAAO,CAAC,aAAa,CAAC,CA0BlC;IAED;;;;;OAKG;IACH,QAL+B,CAAC,SAAlB,eAAgB,QACnB,CAAC,WACD,OAAO,iBAAiB,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAC7C,OAAO,CAAC,IAAI,CAAC,CAKzB;IAED;;;;;OAKG;IACH,MALa,CAAC,QACH,SAAS,UACT,OAAO,GACL,OAAO,CAAC,CAAC,CAAC,CAItB;IAED;;;;;OAKG;IACH,UAL+B,CAAC,SAAlB,eAAgB,QACnB,CAAC,YACD,CAAC,KAAK,EAAE,OAAO,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC,KAAK,IAAI,GAC7D,WAAW,CAIvB;IAED,gCAAgC;IAChC,6BADY,MAAM,QAUjB;IAED;;;;;;OAMG;IACH,sBANa,CAAC,aACH,MAAM,cACN,MAAM,WACN,OAAO,GACL,OAAO,CAAC,CAAC,CAAC,CAStB;IAED;;;;;;;OAOG;IACH,eAPa,CAAC,aACH,MAAM,QACN,SAAS,UACT,OAAO,YACP,CAAC,IAAI,EAAE,OAAO,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,GACpD,WAAW,CAIvB;IAED;;;;;;OAMG;IACH,aAN+B,CAAC,SAAlB,eAAgB,aACnB,MAAM,QACN,CAAC,WACD,OAAO,iBAAiB,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAC7C,OAAO,CAAC,IAAI,CAAC,CAKzB;IAED;;;;;;OAMG;IACH,WANa,CAAC,aACH,MAAM,QACN,SAAS,UACT,OAAO,GACL,OAAO,CAAC,CAAC,CAAC,CAStB;IAED;;;;;;OAMG;IACH,eAN+B,CAAC,SAAlB,eAAgB,aACnB,MAAM,QACN,CAAC,YACD,CAAC,KAAK,EAAE,OAAO,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC,KAAK,IAAI,GAC7D,WAAW,CAIvB;;CA4QF;0BAvmBa,OAAO,iBAAiB,EAAE,WAAW;wBACrC,OAAO,iBAAiB,EAAE,SAAS;8BACnC,OAAO,iBAAiB,EAAE,eAAe;wBACzC,OAAO,iBAAiB,EAAE,SAAS;8BACnC,OAAO,aAAa,EAAE,eAAe;4BACrC,OAAO,aAAa,EAAE,aAAa;8BACnC,OAAO,aAAa,EAAE,eAAe;0BACrC,OAAO,aAAa,EAAE,WAAW;yBACjC,OAAO,eAAe,EAAE,UAAU;kCAClC,UAAU,SAAS,MAAM,QAAQ,GAAG,QAAQ,SAAS,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,KAAK,GAAG,KAAK;2BACtG,OAAO,gBAAgB,EAAE,YAAY;6BACrC;IAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE;yBACzT;IAAE,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAAE;6BACvK;IAAE,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,OAAO,iBAAiB,EAAE,SAAS,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAAE;wCAC1N;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;gDACjH;IAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE"}

package/dist/node-health-query.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @param {ResponsivenessTracker} tracker
+ * @returns {{ subscribe(listener: (diff: QueryDiff<NodeHealthRow>) => void): () => void }}
+ */
+export function createNodeHealthQuery(tracker: ResponsivenessTracker): {
+    subscribe(listener: (diff: QueryDiff<NodeHealthRow>) => void): () => void;
+};
+/** @import { ResponsivenessState, ResponsivenessTracker } from "./node-responsiveness.js" */
+/** @import { QueryDiff } from "@econ-v1/domain" */
+/** @typedef {{ readonly emaMs: number | undefined, readonly id: "node-health", readonly since: number, readonly status: "normal" | "slow" }} NodeHealthRow */
+/**
+ * The one query name stages use to ask how the node is behaving.
+ *
+ * It is a live query in every respect a stage can observe, and it is answered WITHOUT crossing
+ * the kernel port. That is not an optimisation: if this were an ordinary query it would
+ * round-trip through the very port it is reporting on, so a wedged kernel would make
+ * "is the kernel wedged?" hang — arriving 30s late, or never, exactly when it is needed.
+ */
+export const NODE_HEALTH_QUERY: "node.health.v1";
+export type NodeHealthRow = {
+    readonly emaMs: number | undefined;
+    readonly id: "node-health";
+    readonly since: number;
+    readonly status: "normal" | "slow";
+};
+import type { ResponsivenessTracker } from "./node-responsiveness.js";
+import type { QueryDiff } from "@econ-v1/domain";
+//# sourceMappingURL=node-health-query.d.ts.map

package/dist/node-health-query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-health-query.d.ts","sourceRoot":"","sources":["../src/node-health-query.js"],"names":[],"mappings":"AA0BA;;;GAGG;AACH,+CAHW,qBAAqB,GACnB;IAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,UAAU,aAAa,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAA;CAAE,CAoBzF;AA/CD,6FAA6F;AAC7F,mDAAmD;AAEnD,8JAA8J;AAE9J;;;;;;;GAOG;AACH,gCAAiC,gBAAgB,CAAC;4BAVpC;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAA;CAAE;2CAH5E,0BAA0B;+BAC3D,iBAAiB"}

package/dist/node-responsiveness.d.ts

@@ -0,0 +1,174 @@
+/** @param {number} timeoutMs @returns {number} */
+export function slowBarMs(timeoutMs: number): number;
+/**
+ * One settle's contribution to the average, expressed in DEFAULT-REQUEST-EQUIVALENT ms.
+ *
+ * The slow bar is relative (a tenth of the request's OWN declared timeout); `EMA_HOLD_MS` is
+ * absolute. Scaling each sample by the ratio of the reference bar to the request's own bar is
+ * what reconciles the two: a request is worth `EMA_HOLD_MS` to the average exactly when it has
+ * reached its own bar, whatever deadline it declared. So 20s of a 300s-declared operation folds
+ * in as 2000 (under the hold, and correctly: its bar is 30s), while 20s of an ordinary request
+ * folds in as 20000 (well past its 3s bar). One rule, one frame, and the promise in
+ * `SLOW_BAR_DIVISOR` finally holds for the average as well as for the in-flight bar.
+ *
+ * The scale is CAPPED AT 1 — normalization may only ever discount a sample, never inflate one.
+ * A caller may construct the port with a shorter-than-default deadline (`requestTimeoutMs`), and
+ * inflating its ordinary settles would invent slowness on a node that is answering promptly.
+ * This function can therefore only ever remove `slow`, never add it, which is the side this
+ * whole indicator errs on.
+ *
+ * @param {number} elapsedMs
+ * @param {number | undefined} timeoutMs The deadline that request declared, or `undefined` for
+ *   a caller whose requests all use the default deadline.
+ * @returns {number}
+ */
+export function normalizeElapsedMs(elapsedMs: number, timeoutMs: number | undefined): number;
+/** @returns {ResponsivenessState} */
+export function initialResponsiveness(): ResponsivenessState;
+/**
+ * The whole state machine. Pressure (something past its bar, or a high recent average) pulls
+ * toward `slow`; its absence pulls toward `normal`. Neither takes effect until it has held for
+ * its dwell, and the dwells are deliberately asymmetric.
+ *
+ * @param {ResponsivenessState} state
+ * @param {ResponsivenessEvent} event
+ * @param {number} nowMs
+ * @returns {ResponsivenessState}
+ */
+export function nextResponsiveness(state: ResponsivenessState, event: ResponsivenessEvent, nowMs: number): ResponsivenessState;
+/**
+ * The stateful wrapper around `nextResponsiveness`.
+ *
+ * It exists for one reason the reducer cannot cover: a dwell has to be able to expire when
+ * NOTHING else happens. A node that stops answering entirely produces no further observations,
+ * and that is precisely the case that must raise `slow`. So every state carrying a pending
+ * transition arms a ONE-SHOT timer for the instant `dwellDueAtMs` names.
+ *
+ * NOT A LOOP, and the distinction is the whole reason CLIENT_NODE_CONVENTIONS C1 exempts a
+ * one-shot delay while forbidding a re-armed one. The timer fires once per pending transition
+ * and then stops: the `tick` it dispatches carries no new observation, so pressure — and with it
+ * the target — is unchanged, and by construction the dwell has elapsed, so `nextResponsiveness`
+ * takes the completing branch and clears `candidateSince`. With `candidateSince` cleared there
+ * is nothing left to arm. The only way a second timer follows is a host that fired the first one
+ * fractionally early, which re-arms for the remaining milliseconds and then converges; it cannot
+ * become recurring, because a state with no pending transition arms nothing at all.
+ *
+ * @param {{ readonly now?: () => number }} [options]
+ * @returns {ResponsivenessTracker}
+ */
+export function createResponsivenessTracker(options?: {
+    readonly now?: () => number;
+}): ResponsivenessTracker;
+/**
+ * `lastAnswerAtMs` is the instant the most recent request ACTUALLY CAME BACK — an answer, not
+ * an expiry — on this tracker's own clock, or `undefined` while nothing ever has. It is the
+ * only field here that can distinguish those two outcomes: `emaMs` folds both into one number
+ * and so cannot tell a fast expiry from a slow success apart. See `settle` below.
+ *
+ * @typedef {{
+ *   readonly changedAt: number,
+ *   readonly candidateSince: number | undefined,
+ *   readonly emaMs: number | undefined,
+ *   readonly lastAnswerAtMs: number | undefined,
+ *   readonly slowInFlight: number,
+ *   readonly status: "normal" | "slow",
+ * }} ResponsivenessState
+ */
+/**
+ * `timeoutMs` on a settle is the deadline THAT request declared, and it is what makes the
+ * average comparable across requests — see `normalizeElapsedMs`. It is optional because a
+ * caller that has not been taught the difference is one whose requests all use the default
+ * deadline, which is the frame the average is already expressed in.
+ *
+ * @typedef {{ type: "slow-bar-passed" }
+ *   | {
+ *       readonly answered: boolean,
+ *       readonly elapsedMs: number,
+ *       readonly timeoutMs?: number,
+ *       readonly type: "settled",
+ *       readonly wasSlow: boolean,
+ *     }
+ *   | { type: "tick" }} ResponsivenessEvent
+ */
+/** A request is "slow" at a tenth of its OWN declared timeout, not at a global constant.
+ * A default 30s request is slow at 3s; a host-declared 300s operation at 30s. One rule, and
+ * a legitimately long operation cannot mark the node slow merely by being long. */
+export const SLOW_BAR_DIVISOR: 10;
+/** Short: one straggler must not flash the badge. */
+export const RAISE_DWELL_MS: 1000;
+/** Longer than the raise dwell, deliberately: an intermittent node must not strobe.
+ *
+ * Raised from 5s to 15s after measuring it against a live node (Task 10). A node alternating
+ * 4s slow / 4s healthy flipped the pill TEN times in 42 seconds at 5s, because the clear is
+ * structurally favoured: pressure ends the instant the last slow request settles, but does not
+ * return until a NEW request has been outstanding for its full slow bar (3s on a default
+ * request). Any clear dwell shorter than (healthy window + slow bar) therefore drops the badge
+ * on a node that is still visibly misbehaving. 15s absorbs an oscillation of roughly a 10s
+ * period; the only cost is that the badge lingers up to 15s after a genuine recovery, which is
+ * the side this pair of dwells is meant to err on.
+ *
+ * The EMA below cannot cover this gap, and it is worth being explicit about why: it is
+ * weighted per SAMPLE, not per unit of time, so how long a high average survives depends
+ * entirely on request volume. On a busy shell dozens of fast settles land within a second and
+ * take the average under EMA_HOLD_MS almost immediately. The dwell is the only time-based
+ * brake here. */
+export const CLEAR_DWELL_MS: 15000;
+/** Recent-weighted. Three fast responses take an 8s average back under EMA_HOLD_MS
+ * (8000 -> 5660 -> 4022 -> 2875). A 9s seed needs four: it is still at ~3218 after three.
+ * Note this counts RESPONSES, not seconds — see CLEAR_DWELL_MS above. */
+export const EMA_ALPHA: 0.3;
+/** An average at or above this holds `slow` even with nothing currently in flight.
+ *
+ * ABSOLUTE, and therefore only meaningful against samples that share one frame — which is what
+ * `normalizeElapsedMs` below exists to guarantee. Mixing a 30s-deadline request and a
+ * 300s-deadline request into one absolutely-thresholded average is a unit error, and it had a
+ * user-visible consequence: a single legitimate 20s stage invoke seeded `emaMs = 20000` on an
+ * otherwise idle shell, and because the average decays per SAMPLE (see EMA_ALPHA) a quiet shell
+ * produced nothing to walk it back down. The status latched `slow` and the 90s notice fired on a
+ * perfectly healthy node — exactly what the slow bar's own rule ("a long operation cannot mark
+ * the node slow merely by being long") promises cannot happen. */
+export const EMA_HOLD_MS: 3000;
+/** The deadline a request gets when it declares none, and for that reason the frame the EMA is
+ * expressed in. `message-port-client.js` exports this same value as `DEFAULT_REQUEST_TIMEOUT_MS`
+ * — its home is here so the port's default and the average's frame are one number that cannot
+ * drift apart. */
+export const EMA_REFERENCE_TIMEOUT_MS: 30000;
+export type ResponsivenessTracker = {
+    dispose(): void;
+    markSlow(id: string): void;
+    settle(id: string, elapsedMs: number, answered?: boolean, timeoutMs?: number): void;
+    snapshot(): ResponsivenessState;
+    subscribe(listener: (state: ResponsivenessState) => void): () => void;
+};
+/**
+ * `lastAnswerAtMs` is the instant the most recent request ACTUALLY CAME BACK — an answer, not
+ * an expiry — on this tracker's own clock, or `undefined` while nothing ever has. It is the
+ * only field here that can distinguish those two outcomes: `emaMs` folds both into one number
+ * and so cannot tell a fast expiry from a slow success apart. See `settle` below.
+ */
+export type ResponsivenessState = {
+    readonly changedAt: number;
+    readonly candidateSince: number | undefined;
+    readonly emaMs: number | undefined;
+    readonly lastAnswerAtMs: number | undefined;
+    readonly slowInFlight: number;
+    readonly status: "normal" | "slow";
+};
+/**
+ * `timeoutMs` on a settle is the deadline THAT request declared, and it is what makes the
+ * average comparable across requests — see `normalizeElapsedMs`. It is optional because a
+ * caller that has not been taught the difference is one whose requests all use the default
+ * deadline, which is the frame the average is already expressed in.
+ */
+export type ResponsivenessEvent = {
+    type: "slow-bar-passed";
+} | {
+    readonly answered: boolean;
+    readonly elapsedMs: number;
+    readonly timeoutMs?: number;
+    readonly type: "settled";
+    readonly wasSlow: boolean;
+} | {
+    type: "tick";
+};
+//# sourceMappingURL=node-responsiveness.d.ts.map

package/dist/node-responsiveness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-responsiveness.d.ts","sourceRoot":"","sources":["../src/node-responsiveness.js"],"names":[],"mappings":"AA+EA,kDAAkD;AAClD,qCADY,MAAM,GAAsB,MAAM,CAG7C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,8CALW,MAAM,aACN,MAAM,GAAG,SAAS,GAEhB,MAAM,CAMlB;AAED,qCAAqC;AACrC,yCADc,mBAAmB,CAUhC;AAED;;;;;;;;;GASG;AACH,0CALW,mBAAmB,SACnB,mBAAmB,SACnB,MAAM,GACJ,mBAAmB,CAkE/B;AA8BD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,sDAHW;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE,GAC7B,qBAAqB,CA+FjC;AAnVD;;;;;;;;;;;;;;GAcG;AACH;;;;;;;;;;;;;;;GAeG;AAEH;;mFAEmF;AACnF,+BAAgC,EAAE,CAAC;AACnC,qDAAqD;AACrD,6BAA8B,IAAK,CAAC;AACpC;;;;;;;;;;;;;;;iBAeiB;AACjB,6BAA8B,KAAM,CAAC;AACrC;;yEAEyE;AACzE,wBAAyB,GAAG,CAAC;AAC7B;;;;;;;;;kEASkE;AAClE,0BAA2B,IAAK,CAAC;AAEjC;;;kBAGkB;AAClB,uCAAwC,KAAM,CAAC;oCA4HlC;IACR,OAAO,IAAI,IAAI,CAAC;IAChB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpF,QAAQ,IAAI,mBAAmB,CAAC;IAChC,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CACvE;;;;;;;kCAvMS;IACZ,QAAY,CAAC,SAAS,EAAE,MAAM,CAAC;IAC/B,QAAY,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAY,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAY,CAAC,YAAY,EAAE,MAAM,CAAC;IAClC,QAAY,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAC;CACpC;;;;;;;kCAQS;IAAE,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACjC;IACN,QAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC;IACnC,QAAgB,CAAC,SAAS,EAAE,MAAM,CAAC;IACnC,QAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IACpC,QAAgB,CAAC,IAAI,EAAE,SAAS,CAAC;IACjC,QAAgB,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B,GACD;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@econ-v1/rpc",
-  "version": "7.0.24",
+  "version": "7.0.27",
   "description": "Typed runtime and contracts for Node client stage-to-kernel RPC",
   "license": "MIT OR Apache-2.0",
   "author": "Node contributors",
@@ -56,7 +56,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@econ-v1/domain": "7.0.24",
-    "@econ-v1/ports": "7.0.24"
+    "@econ-v1/domain": "7.0.27",
+    "@econ-v1/ports": "7.0.27"
   }
 }

package/src/describe-client-error.js

@@ -0,0 +1,67 @@
+// @ts-check
+
+/** @typedef {{ readonly message: string, readonly showRetry: boolean, readonly surface: "ambient" | "inline" }} DescribedClientError */
+
+/**
+ * Copy for every domain code, plus whether retrying it could plausibly help.
+ *
+ * The codes themselves NEVER reach the user. A person reading "capability_unavailable" learns
+ * nothing they can act on; "This app isn't running on your node" tells them who to ask.
+ *
+ * @type {Readonly<Record<string, { readonly message: string, readonly showRetry: boolean }>>}
+ */
+const DOMAIN_COPY = {
+  "access-code-invalid": { message: "That access code wasn't accepted.", showRetry: false },
+  capability_not_declared: { message: "This app asked for something it isn't allowed to use.", showRetry: false },
+  capability_unavailable: { message: "This app isn't running on your node.", showRetry: true },
+  "code-already-bound": { message: "That access code has already been used.", showRetry: false },
+  conflict: { message: "Someone else changed this first.", showRetry: true },
+  invalid_request: { message: "Your node couldn't understand that request.", showRetry: false },
+  not_found: { message: "That isn't here any more.", showRetry: false },
+  stage_composition_not_enabled: { message: "This screen can't open other apps here.", showRetry: false },
+  unauthorized: { message: "This device isn't allowed to do that.", showRetry: false },
+  unsupported_query: { message: "Your node doesn't support this yet.", showRetry: false },
+  validation_failed: { message: "Some of those details weren't accepted.", showRetry: false },
+};
+
+/**
+ * Maps any thrown value to what the UI should do with it.
+ *
+ * The routing is the spec's D4 rule, computed once: transport and sync failures already have an
+ * owner (the connectivity pill, the sync indicator), so repeating them per-stage would say one
+ * fact N times. A domain failure has no ambient owner — the node ANSWERED, so the pill reads
+ * "Connected", truthfully — and only the surface that asked can explain it.
+ *
+ * @param {unknown} error
+ * @returns {DescribedClientError}
+ */
+export function describeClientError(error) {
+  const kind = /** @type {{ kind?: unknown }} */ (error)?.kind;
+  const code = /** @type {{ code?: unknown }} */ (error)?.code;
+
+  if (kind === "transport" || kind === "sync") {
+    // Ambient: the message is carried by the pill and the inspector panel, not here. The text
+    // is still returned for the one cold-surface case that renders it (spec D5).
+    return Object.freeze({
+      message: "Can't reach your node right now.",
+      showRetry: true,
+      surface: /** @type {const} */ ("ambient"),
+    });
+  }
+
+  if (kind === "domain" && typeof code === "string") {
+    const copy = DOMAIN_COPY[code];
+    if (copy !== undefined) {
+      return Object.freeze({ ...copy, surface: /** @type {const} */ ("inline") });
+    }
+  }
+
+  // Anything else — an unrecognised domain code, a plain Error, a rejected non-Error. Inline,
+  // because an unrecognised failure is at least as likely to be surface-specific as ambient,
+  // and generic, because an internal message is not written for a person to read.
+  return Object.freeze({
+    message: "Something went wrong.",
+    showRetry: true,
+    surface: /** @type {const} */ ("inline"),
+  });
+}

package/src/index.js

@@ -1,6 +1,10 @@
 // @ts-check
 
 /** @typedef {import("./client.js").KernelRpcClient} KernelRpcClient */
+/** @typedef {import("./describe-client-error.js").DescribedClientError} DescribedClientError */
+/** @typedef {import("./node-health-query.js").NodeHealthRow} NodeHealthRow */
+/** @typedef {import("./node-responsiveness.js").ResponsivenessState} ResponsivenessState */
+/** @typedef {import("./node-responsiveness.js").ResponsivenessTracker} ResponsivenessTracker */
 /** @typedef {import("./client.js").PreparedStage} PreparedStage */
 /** @typedef {import("./client.js").StageRpcSession} StageRpcSession */
 /** @typedef {import("./client.js").Unsubscribe} Unsubscribe */
@@ -170,7 +174,7 @@ export {
   isSerializableClientError,
   serializeClientError,
 } from "./errors.js";
-export { KernelRpcTimeoutError, MessagePortKernelRpcClient } from "./message-port-client.js";
+export { DEFAULT_REQUEST_TIMEOUT_MS, KernelRpcTimeoutError, MessagePortKernelRpcClient } from "./message-port-client.js";
 export { NODE_APP_LIFECYCLE_COMMAND, NODE_APP_MEMORY_CAPTURE_COMMAND, NODE_APP_MEMORY_DETAIL_QUERY, NODE_APP_MEMORY_DOWNLOAD_COMMAND, NODE_APP_MEMORY_LIST_QUERY, NODE_APP_MEMORY_OVERVIEW_QUERY, NODE_APP_MEMORY_STATUS_COMMAND } from "./node-app-memory-contract.js";
 export { APPS_LIFECYCLE_PIN_COMMAND, APPS_LIFECYCLE_QUERY } from "./apps-lifecycle-contract.js";
 export { L402_ENFORCEMENT_QUERY, L402_ENFORCEMENT_ROW_ID, L402_ENFORCEMENT_SET_COMMAND } from "./l402-enforcement-contract.js";
@@ -226,3 +230,6 @@ export {
   serializeRpcRequest,
   serializeRpcResponse,
 } from "./protocol.js";
+export { describeClientError } from "./describe-client-error.js";
+export { createNodeHealthQuery, NODE_HEALTH_QUERY } from "./node-health-query.js";
+export { createResponsivenessTracker, EMA_HOLD_MS } from "./node-responsiveness.js";

package/src/message-port-client.js

@@ -5,6 +5,7 @@ import {
 } from "@econ-v1/domain";
 
 import { isJsonValue } from "./errors.js";
+import { EMA_REFERENCE_TIMEOUT_MS, slowBarMs } from "./node-responsiveness.js";
 import {
   deserializeRpcEvent,
   deserializeRpcResponse,
@@ -22,10 +23,11 @@ import {
 /** @typedef {import("./protocol.js").RpcRequest} RpcRequest */
 /** @typedef {RpcRequest extends infer TRequest ? TRequest extends RpcRequest ? Omit<TRequest, "id"> : never : never} RpcRequestWithoutId */
 /** @typedef {import("./transport.js").RpcTransport} RpcTransport */
-/** @typedef {{ readonly reject: (error: unknown) => void, readonly resolve: (value: JsonValue) => void, readonly sessionId: string | undefined, readonly timeoutId: ReturnType<typeof globalThis.setTimeout> }} PendingRequest */
+/** @typedef {{ readonly reject: (error: unknown) => void, readonly resolve: (value: JsonValue) => void, readonly sessionId: string | undefined, readonly slowBarId: ReturnType<typeof globalThis.setTimeout>, readonly startedAtMs: number, readonly timeoutId: ReturnType<typeof globalThis.setTimeout>, readonly timeoutMs: number }} PendingRequest */
 /** @typedef {{ readonly eventType: KernelEventType, readonly listeners: Set<(event: DomainEvent) => void>, readonly sessionId: string | undefined, readonly subscriptionId: string }} EventGroup */
 /** @typedef {{ readonly listeners: Set<(diff: import("@econ-v1/domain").QueryDiff<JsonValue>) => void>, readonly name: QueryName, readonly params: JsonValue, readonly sessionId: string | undefined, readonly subscriptionId: string }} LiveQueryGroup */
-/** @typedef {{ readonly now?: () => string, readonly requestTimeoutMs?: number }} MessagePortKernelRpcClientOptions */
+/** @typedef {{ markSlow(id: string): void, settle(id: string, elapsedMs: number, answered: boolean, timeoutMs: number): void }} RpcResponsivenessObserver */
+/** @typedef {{ readonly monotonicNow?: () => number, readonly now?: () => string, readonly observer?: RpcResponsivenessObserver, readonly requestTimeoutMs?: number }} MessagePortKernelRpcClientOptions */
 
 /**
  * A subscribe request the kernel refused. The group is dropped either way,
@@ -73,7 +75,24 @@ export class KernelRpcTimeoutError extends Error {
 
 // Kernel RPC is local, but stage work can cross browser/worker scheduling boundaries.
 // Thirty seconds bounds dropped fire-and-forget messages without penalizing slow devices.
-const DEFAULT_REQUEST_TIMEOUT_MS = 30_000;
+//
+// It is the DEFAULT deadline, not a ceiling on observed round trips: `requestTimeoutMs()`
+// below lets a stage capability invoke declare its own, up to MAX_DECLARED_TIMEOUT_MS (300s),
+// so a request can legitimately answer at 290s and report that elapsed time. An earlier
+// revision of this comment claimed the opposite — that no answer could ever be observed above
+// this value, and that an average which reached it could only be made of expiries — and
+// `network-inspector-model.js` was built on that claim. It is false, and it silenced the
+// "still responding" surfaces on exactly the long-turn workloads the 300s ceiling exists for.
+//
+// `network-inspector-model.js` still reads this constant, but as a SILENCE bound rather than a
+// latency ceiling: if nothing has come back for a whole default deadline, every ordinary
+// request issued in that window has already expired, so "still responding" has stopped being
+// a true sentence. What came back and what merely expired is now carried explicitly — see the
+// `answered` argument threaded through `#takePending`.
+// The value itself lives in `node-responsiveness.js` as `EMA_REFERENCE_TIMEOUT_MS`: the
+// responsiveness average is expressed in the frame of this same default deadline, and two
+// declarations of one number are two chances to drift.
+export const DEFAULT_REQUEST_TIMEOUT_MS = EMA_REFERENCE_TIMEOUT_MS;
 
 // The ceiling for a deadline a STAGE declares on a capability invoke — the same
 // 300s the host validates (InvokeCapabilityRequest, 100..300000) and the kernel
@@ -122,8 +141,12 @@ export class MessagePortKernelRpcClient {
   #liveGroupsByKey = new Map();
   /** @type {Map<string, LiveQueryGroup>} */
   #liveGroupsBySubscription = new Map();
+  /** @type {() => number} */
+  #monotonicNow;
   /** @type {() => string} */
   #now;
+  /** @type {RpcResponsivenessObserver | undefined} */
+  #observer;
   /** @type {Map<string, PendingRequest>} */
   #pending = new Map();
   /** @type {number} */
@@ -145,6 +168,8 @@ export class MessagePortKernelRpcClient {
   constructor(transport, options = {}) {
     this.#transport = transport;
     this.#now = options.now ?? (() => new Date().toISOString());
+    this.#monotonicNow = options.monotonicNow ?? (() => Date.now());
+    this.#observer = options.observer;
     this.#requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
     this.#unsubscribeMessages = transport.subscribe((message) => this.#handleMessage(message));
     this.#unsubscribeClose = transport.subscribeClose(() => this.#handleClose());
@@ -262,7 +287,7 @@ export class MessagePortKernelRpcClient {
     const error = new TransportError({ code: "connection_lost", message: "Stage RPC session closed" });
     for (const [requestId, pending] of [...this.#pending]) {
       if (pending.sessionId === sessionId) {
-        this.#takePending(requestId)?.reject(error);
+        this.#takePending(requestId, false)?.reject(error);
       }
     }
     this.#removeSessionSubscriptions(sessionId);
@@ -342,7 +367,7 @@ export class MessagePortKernelRpcClient {
     this.#unsubscribeMessages();
     this.#unsubscribeClose();
     const error = new TransportError({ code: "connection_lost", message: "Kernel RPC port closed" });
-    for (const requestId of [...this.#pending.keys()]) this.#takePending(requestId)?.reject(error);
+    for (const requestId of [...this.#pending.keys()]) this.#takePending(requestId, false)?.reject(error);
     this.#eventGroupsByKey.clear();
     this.#eventGroupsBySubscription.clear();
     this.#liveGroupsByKey.clear();
@@ -363,14 +388,16 @@ export class MessagePortKernelRpcClient {
       const responseId = typeof envelope.id === "string" ? envelope.id : undefined;
       try {
         const response = deserializeRpcResponse(message);
-        const pending = this.#takePending(response.id);
+        const pending = this.#takePending(response.id, true);
         if (pending === undefined) return;
         if (response.ok) pending.resolve(response.value);
         else pending.reject(response.error);
         return;
       } catch {
         if (responseId !== undefined) {
-          const pending = this.#takePending(responseId);
+          // Malformed, but it CAME BACK: the kernel replied to this id, which is exactly the
+          // liveness the answer flag reports. The caller still gets an error.
+          const pending = this.#takePending(responseId, true);
           if (pending !== undefined) {
             pending.reject(new DomainError({ code: "invalid_request", message: "Malformed kernel RPC response" }));
           }
@@ -412,13 +439,27 @@ export class MessagePortKernelRpcClient {
 
   /**
    * @param {string} requestId
+   * @param {boolean} answered Whether the kernel actually replied to this request. `true` for
+   *   any received response, ok or error — an error result is still something coming back.
+   *   `false` for an expiry, a closed port, or a failed send. Required rather than defaulted
+   *   so a new call site cannot quietly report a non-answer as an answer.
    * @returns {PendingRequest | undefined}
    */
-  #takePending(requestId) {
+  #takePending(requestId, answered) {
     const pending = this.#pending.get(requestId);
     if (pending === undefined) return undefined;
     this.#pending.delete(requestId);
     globalThis.clearTimeout(pending.timeoutId);
+    globalThis.clearTimeout(pending.slowBarId);
+    try {
+      // The request's OWN deadline travels with its elapsed time. Without it the tracker
+      // cannot tell 20s of a 300s-declared operation (fast, for what it declared) from 20s of
+      // an ordinary one (six times past its bar), and folds both into one absolutely-thresholded
+      // average — which latched `slow` on healthy nodes. See `normalizeElapsedMs`.
+      this.#observer?.settle(requestId, this.#monotonicNow() - pending.startedAtMs, answered, pending.timeoutMs);
+    } catch {
+      // Same rule as the bar timer: report-only, never load-bearing.
+    }
     return pending;
   }
 
@@ -454,17 +495,29 @@ export class MessagePortKernelRpcClient {
         ? request.name
         : "capability" in request ? request.capability : request.type;
       const timeoutMs = requestTimeoutMs(request, this.#requestTimeoutMs);
+      const startedAtMs = this.#monotonicNow();
       const timeoutId = globalThis.setTimeout(() => {
-        this.#takePending(id)?.reject(new KernelRpcTimeoutError(commandName, id, timeoutMs));
+        this.#takePending(id, false)?.reject(new KernelRpcTimeoutError(commandName, id, timeoutMs));
       }, timeoutMs);
-      this.#pending.set(id, { reject, resolve, sessionId, timeoutId });
+      // The earlier of the two timers. It resolves nothing and rejects nothing — it only
+      // reports that this request has been outstanding long enough to be worth telling the
+      // user about, at a tenth of its OWN declared timeout.
+      const slowBarId = globalThis.setTimeout(() => {
+        try {
+          this.#observer?.markSlow(id);
+        } catch {
+          // A broken observer must never become a broken request. Instrumentation is
+          // report-only and may not degrade the call it is measuring.
+        }
+      }, slowBarMs(timeoutMs));
+      this.#pending.set(id, { reject, resolve, sessionId, slowBarId, startedAtMs, timeoutId, timeoutMs });
       try {
         this.#transport.send(serializeRpcRequest(/** @type {RpcRequest} */ ({ ...request, id })));
       } catch (error) {
         const sendError = error instanceof TransportError
           ? error
           : new TransportError({ code: "connection_lost", message: "Kernel RPC send failed" });
-        this.#takePending(id)?.reject(sendError);
+        this.#takePending(id, false)?.reject(sendError);
       }
     });
   }

package/src/node-health-query.js

@@ -0,0 +1,49 @@
+// @ts-check
+/** @import { ResponsivenessState, ResponsivenessTracker } from "./node-responsiveness.js" */
+/** @import { QueryDiff } from "@econ-v1/domain" */
+
+/** @typedef {{ readonly emaMs: number | undefined, readonly id: "node-health", readonly since: number, readonly status: "normal" | "slow" }} NodeHealthRow */
+
+/**
+ * The one query name stages use to ask how the node is behaving.
+ *
+ * It is a live query in every respect a stage can observe, and it is answered WITHOUT crossing
+ * the kernel port. That is not an optimisation: if this were an ordinary query it would
+ * round-trip through the very port it is reporting on, so a wedged kernel would make
+ * "is the kernel wedged?" hang — arriving 30s late, or never, exactly when it is needed.
+ */
+export const NODE_HEALTH_QUERY = "node.health.v1";
+
+/** @param {ResponsivenessState} state @returns {NodeHealthRow} */
+function rowOf(state) {
+  return Object.freeze({
+    emaMs: state.emaMs,
+    id: /** @type {const} */ ("node-health"),
+    since: state.changedAt,
+    status: state.status,
+  });
+}
+
+/**
+ * @param {ResponsivenessTracker} tracker
+ * @returns {{ subscribe(listener: (diff: QueryDiff<NodeHealthRow>) => void): () => void }}
+ */
+export function createNodeHealthQuery(tracker) {
+  return {
+    subscribe(listener) {
+      // The single row exists from the first moment, so the opening emission is an add and
+      // every later one is an update. A subscriber that folds diffs the ordinary way ends up
+      // with exactly one row throughout. `revision` is scoped to this one subscription — like
+      // the kernel's own live-query engine (`client/kernel/src/live-query/engine.js`), it
+      // increments BEFORE each emission, so the opening emission carries `revision: 1` and
+      // every later one increments from there.
+      let revision = 0;
+      revision += 1;
+      listener({ added: [rowOf(tracker.snapshot())], deleted: [], revision, updated: [] });
+      return tracker.subscribe((state) => {
+        revision += 1;
+        listener({ added: [], deleted: [], revision, updated: [rowOf(state)] });
+      });
+    },
+  };
+}

package/src/node-responsiveness.js

@@ -0,0 +1,342 @@
+// @ts-check
+
+/**
+ * `lastAnswerAtMs` is the instant the most recent request ACTUALLY CAME BACK — an answer, not
+ * an expiry — on this tracker's own clock, or `undefined` while nothing ever has. It is the
+ * only field here that can distinguish those two outcomes: `emaMs` folds both into one number
+ * and so cannot tell a fast expiry from a slow success apart. See `settle` below.
+ *
+ * @typedef {{
+ *   readonly changedAt: number,
+ *   readonly candidateSince: number | undefined,
+ *   readonly emaMs: number | undefined,
+ *   readonly lastAnswerAtMs: number | undefined,
+ *   readonly slowInFlight: number,
+ *   readonly status: "normal" | "slow",
+ * }} ResponsivenessState
+ */
+/**
+ * `timeoutMs` on a settle is the deadline THAT request declared, and it is what makes the
+ * average comparable across requests — see `normalizeElapsedMs`. It is optional because a
+ * caller that has not been taught the difference is one whose requests all use the default
+ * deadline, which is the frame the average is already expressed in.
+ *
+ * @typedef {{ type: "slow-bar-passed" }
+ *   | {
+ *       readonly answered: boolean,
+ *       readonly elapsedMs: number,
+ *       readonly timeoutMs?: number,
+ *       readonly type: "settled",
+ *       readonly wasSlow: boolean,
+ *     }
+ *   | { type: "tick" }} ResponsivenessEvent
+ */
+
+/** A request is "slow" at a tenth of its OWN declared timeout, not at a global constant.
+ * A default 30s request is slow at 3s; a host-declared 300s operation at 30s. One rule, and
+ * a legitimately long operation cannot mark the node slow merely by being long. */
+export const SLOW_BAR_DIVISOR = 10;
+/** Short: one straggler must not flash the badge. */
+export const RAISE_DWELL_MS = 1_000;
+/** Longer than the raise dwell, deliberately: an intermittent node must not strobe.
+ *
+ * Raised from 5s to 15s after measuring it against a live node (Task 10). A node alternating
+ * 4s slow / 4s healthy flipped the pill TEN times in 42 seconds at 5s, because the clear is
+ * structurally favoured: pressure ends the instant the last slow request settles, but does not
+ * return until a NEW request has been outstanding for its full slow bar (3s on a default
+ * request). Any clear dwell shorter than (healthy window + slow bar) therefore drops the badge
+ * on a node that is still visibly misbehaving. 15s absorbs an oscillation of roughly a 10s
+ * period; the only cost is that the badge lingers up to 15s after a genuine recovery, which is
+ * the side this pair of dwells is meant to err on.
+ *
+ * The EMA below cannot cover this gap, and it is worth being explicit about why: it is
+ * weighted per SAMPLE, not per unit of time, so how long a high average survives depends
+ * entirely on request volume. On a busy shell dozens of fast settles land within a second and
+ * take the average under EMA_HOLD_MS almost immediately. The dwell is the only time-based
+ * brake here. */
+export const CLEAR_DWELL_MS = 15_000;
+/** Recent-weighted. Three fast responses take an 8s average back under EMA_HOLD_MS
+ * (8000 -> 5660 -> 4022 -> 2875). A 9s seed needs four: it is still at ~3218 after three.
+ * Note this counts RESPONSES, not seconds — see CLEAR_DWELL_MS above. */
+export const EMA_ALPHA = 0.3;
+/** An average at or above this holds `slow` even with nothing currently in flight.
+ *
+ * ABSOLUTE, and therefore only meaningful against samples that share one frame — which is what
+ * `normalizeElapsedMs` below exists to guarantee. Mixing a 30s-deadline request and a
+ * 300s-deadline request into one absolutely-thresholded average is a unit error, and it had a
+ * user-visible consequence: a single legitimate 20s stage invoke seeded `emaMs = 20000` on an
+ * otherwise idle shell, and because the average decays per SAMPLE (see EMA_ALPHA) a quiet shell
+ * produced nothing to walk it back down. The status latched `slow` and the 90s notice fired on a
+ * perfectly healthy node — exactly what the slow bar's own rule ("a long operation cannot mark
+ * the node slow merely by being long") promises cannot happen. */
+export const EMA_HOLD_MS = 3_000;
+
+/** The deadline a request gets when it declares none, and for that reason the frame the EMA is
+ * expressed in. `message-port-client.js` exports this same value as `DEFAULT_REQUEST_TIMEOUT_MS`
+ * — its home is here so the port's default and the average's frame are one number that cannot
+ * drift apart. */
+export const EMA_REFERENCE_TIMEOUT_MS = 30_000;
+
+/** @param {number} timeoutMs @returns {number} */
+export function slowBarMs(timeoutMs) {
+  return Math.max(1, Math.round(timeoutMs / SLOW_BAR_DIVISOR));
+}
+
+/**
+ * One settle's contribution to the average, expressed in DEFAULT-REQUEST-EQUIVALENT ms.
+ *
+ * The slow bar is relative (a tenth of the request's OWN declared timeout); `EMA_HOLD_MS` is
+ * absolute. Scaling each sample by the ratio of the reference bar to the request's own bar is
+ * what reconciles the two: a request is worth `EMA_HOLD_MS` to the average exactly when it has
+ * reached its own bar, whatever deadline it declared. So 20s of a 300s-declared operation folds
+ * in as 2000 (under the hold, and correctly: its bar is 30s), while 20s of an ordinary request
+ * folds in as 20000 (well past its 3s bar). One rule, one frame, and the promise in
+ * `SLOW_BAR_DIVISOR` finally holds for the average as well as for the in-flight bar.
+ *
+ * The scale is CAPPED AT 1 — normalization may only ever discount a sample, never inflate one.
+ * A caller may construct the port with a shorter-than-default deadline (`requestTimeoutMs`), and
+ * inflating its ordinary settles would invent slowness on a node that is answering promptly.
+ * This function can therefore only ever remove `slow`, never add it, which is the side this
+ * whole indicator errs on.
+ *
+ * @param {number} elapsedMs
+ * @param {number | undefined} timeoutMs The deadline that request declared, or `undefined` for
+ *   a caller whose requests all use the default deadline.
+ * @returns {number}
+ */
+export function normalizeElapsedMs(elapsedMs, timeoutMs) {
+  if (timeoutMs === undefined || !Number.isFinite(timeoutMs)) return elapsedMs;
+  const scale = slowBarMs(EMA_REFERENCE_TIMEOUT_MS) / slowBarMs(timeoutMs);
+  return scale >= 1 ? elapsedMs : elapsedMs * scale;
+}
+
+/** @returns {ResponsivenessState} */
+export function initialResponsiveness() {
+  return Object.freeze({
+    changedAt: 0,
+    candidateSince: undefined,
+    emaMs: undefined,
+    lastAnswerAtMs: undefined,
+    slowInFlight: 0,
+    status: /** @type {const} */ ("normal"),
+  });
+}
+
+/**
+ * The whole state machine. Pressure (something past its bar, or a high recent average) pulls
+ * toward `slow`; its absence pulls toward `normal`. Neither takes effect until it has held for
+ * its dwell, and the dwells are deliberately asymmetric.
+ *
+ * @param {ResponsivenessState} state
+ * @param {ResponsivenessEvent} event
+ * @param {number} nowMs
+ * @returns {ResponsivenessState}
+ */
+export function nextResponsiveness(state, event, nowMs) {
+  let slowInFlight = state.slowInFlight;
+  let emaMs = state.emaMs;
+  let lastAnswerAtMs = state.lastAnswerAtMs;
+
+  if (event.type === "slow-bar-passed") {
+    slowInFlight += 1;
+  } else if (event.type === "settled") {
+    // Guarded rather than trusted: a settle for a request that never passed its bar, or a
+    // duplicate settle, must not drive the count below zero and pin the node "normal".
+    if (event.wasSlow) {
+      slowInFlight = Math.max(0, slowInFlight - 1);
+    }
+    // Normalized, never raw: the average is thresholded absolutely, so every sample entering it
+    // has to be in one frame. See `normalizeElapsedMs`.
+    const sampleMs = normalizeElapsedMs(event.elapsedMs, event.timeoutMs);
+    emaMs = emaMs === undefined
+      ? sampleMs
+      : (EMA_ALPHA * sampleMs) + ((1 - EMA_ALPHA) * emaMs);
+    // Expiries deliberately still move the average — a request that ran its whole deadline out
+    // IS evidence of slowness — but only an ANSWER moves this clock. That asymmetry is the
+    // whole point of the field: `emaMs` answers "how long are round trips taking", while this
+    // answers "did anything come back", and no single average can answer both.
+    if (event.answered) {
+      lastAnswerAtMs = nowMs;
+    }
+  }
+
+  const pressure = slowInFlight > 0 || (emaMs !== undefined && emaMs >= EMA_HOLD_MS);
+  const target = pressure ? "slow" : "normal";
+
+  if (target === state.status) {
+    // Pressure agrees with where we already are: any pending transition is abandoned.
+    return Object.freeze({
+      changedAt: state.changedAt,
+      candidateSince: undefined,
+      emaMs,
+      lastAnswerAtMs,
+      slowInFlight,
+      status: state.status,
+    });
+  }
+
+  const candidateSince = state.candidateSince ?? nowMs;
+  const dwellMs = target === "slow" ? RAISE_DWELL_MS : CLEAR_DWELL_MS;
+  if (nowMs - candidateSince >= dwellMs) {
+    return Object.freeze({
+      changedAt: nowMs,
+      candidateSince: undefined,
+      emaMs,
+      lastAnswerAtMs,
+      slowInFlight,
+      status: target,
+    });
+  }
+
+  return Object.freeze({
+    changedAt: state.changedAt,
+    candidateSince,
+    emaMs,
+    lastAnswerAtMs,
+    slowInFlight,
+    status: state.status,
+  });
+}
+
+/**
+ * @typedef {{
+ *   dispose(): void,
+ *   markSlow(id: string): void,
+ *   settle(id: string, elapsedMs: number, answered?: boolean, timeoutMs?: number): void,
+ *   snapshot(): ResponsivenessState,
+ *   subscribe(listener: (state: ResponsivenessState) => void): () => void,
+ * }} ResponsivenessTracker
+ */
+
+/**
+ * The instant a pending transition becomes due, or `undefined` when none is pending.
+ *
+ * Derived purely from the state, which is what makes the tracker's timer a DEADLINE rather than
+ * a heartbeat: there is exactly one such instant per pending transition, it is known the moment
+ * the transition is proposed, and it does not move while the transition stays pending. The dwell
+ * to apply is chosen by the status being LEFT — `candidateSince` is set only when the target
+ * disagrees with `status`, so a pending transition out of `slow` is the clear (long) dwell and
+ * one out of `normal` is the raise (short) one.
+ *
+ * @param {ResponsivenessState} state
+ * @returns {number | undefined}
+ */
+function dwellDueAtMs(state) {
+  if (state.candidateSince === undefined) return undefined;
+  return state.candidateSince + (state.status === "slow" ? CLEAR_DWELL_MS : RAISE_DWELL_MS);
+}
+
+/**
+ * The stateful wrapper around `nextResponsiveness`.
+ *
+ * It exists for one reason the reducer cannot cover: a dwell has to be able to expire when
+ * NOTHING else happens. A node that stops answering entirely produces no further observations,
+ * and that is precisely the case that must raise `slow`. So every state carrying a pending
+ * transition arms a ONE-SHOT timer for the instant `dwellDueAtMs` names.
+ *
+ * NOT A LOOP, and the distinction is the whole reason CLIENT_NODE_CONVENTIONS C1 exempts a
+ * one-shot delay while forbidding a re-armed one. The timer fires once per pending transition
+ * and then stops: the `tick` it dispatches carries no new observation, so pressure — and with it
+ * the target — is unchanged, and by construction the dwell has elapsed, so `nextResponsiveness`
+ * takes the completing branch and clears `candidateSince`. With `candidateSince` cleared there
+ * is nothing left to arm. The only way a second timer follows is a host that fired the first one
+ * fractionally early, which re-arms for the remaining milliseconds and then converges; it cannot
+ * become recurring, because a state with no pending transition arms nothing at all.
+ *
+ * @param {{ readonly now?: () => number }} [options]
+ * @returns {ResponsivenessTracker}
+ */
+export function createResponsivenessTracker(options = {}) {
+  const now = options.now ?? (() => Date.now());
+  /** @type {Set<string>} */
+  const slowIds = new Set();
+  /** @type {Set<(state: ResponsivenessState) => void>} */
+  const listeners = new Set();
+  /** @type {ReturnType<typeof globalThis.setTimeout> | undefined} */
+  let dwellTimer;
+  let state = initialResponsiveness();
+  let disposed = false;
+
+  function clearDwellTimer() {
+    if (dwellTimer !== undefined) {
+      globalThis.clearTimeout(dwellTimer);
+      dwellTimer = undefined;
+    }
+  }
+
+  /** The timer's callback, and the ONLY thing it does: hand the reducer one `tick` so a dwell
+   * that came due with nothing else happening can complete. Named and hoisted out of the arming
+   * site deliberately — scheduling a deadline and reducing an event are two jobs, and keeping
+   * them apart is what makes it legible that no timer here schedules its own successor. */
+  function dwellDue() {
+    dwellTimer = undefined;
+    apply({ type: "tick" });
+  }
+
+  /** Arm the single one-shot deadline for the currently pending transition. Clamped at zero for
+   * a deadline already in the past (a clock that moved under us), which fires on the next turn
+   * of the loop rather than never.
+   * @param {number} dueAtMs */
+  function armDwellDeadline(dueAtMs) {
+    dwellTimer = globalThis.setTimeout(dwellDue, Math.max(0, dueAtMs - now()));
+  }
+
+  /** @param {ResponsivenessEvent} event */
+  function apply(event) {
+    if (disposed) return;
+    const previous = state;
+    state = nextResponsiveness(state, event, now());
+    clearDwellTimer();
+    const dueAtMs = dwellDueAtMs(state);
+    if (dueAtMs !== undefined) {
+      armDwellDeadline(dueAtMs);
+    }
+    // Publish on a status change only. Every settle moves the EMA a little, and republishing
+    // on each would rerender the pill continuously on a busy-but-healthy node.
+    if (state.status !== previous.status) {
+      for (const listener of listeners) listener(state);
+    }
+  }
+
+  return {
+    dispose() {
+      disposed = true;
+      clearDwellTimer();
+      listeners.clear();
+      slowIds.clear();
+    },
+    markSlow(id) {
+      if (disposed || slowIds.has(id)) return;
+      slowIds.add(id);
+      apply({ type: "slow-bar-passed" });
+    },
+    /**
+     * A request left the flight list. `answered` says HOW: `true` when the kernel actually
+     * replied (an ok result or an error result — either way something came back), `false` when
+     * the request expired, the port closed under it, or the send failed.
+     *
+     * It defaults to `true` because "settled" meant "came back" before the outcome was carried
+     * at all, and a caller that has not been taught the difference is one that only ever
+     * reports real replies. `MessagePortKernelRpcClient` passes it explicitly at every site.
+     *
+     * `timeoutMs` is the deadline THAT request declared, which is what makes `elapsedMs`
+     * comparable with every other sample (`normalizeElapsedMs`). Omitting it says "this request
+     * used the default deadline" — the frame the average is already in — so an untaught caller
+     * gets exactly the pre-existing behaviour.
+     */
+    settle(id, elapsedMs, answered = true, timeoutMs = undefined) {
+      if (disposed) return;
+      const wasSlow = slowIds.delete(id);
+      apply({ answered, elapsedMs, type: "settled", wasSlow, ...(timeoutMs === undefined ? {} : { timeoutMs }) });
+    },
+    snapshot() {
+      return state;
+    },
+    subscribe(listener) {
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+      };
+    },
+  };
+}