@githolon/dsl 0.115.0 → 0.116.4

package/dart/lib/src/runner/node-entry.mjs

@@ -1056,7 +1056,7 @@ var require_uri_all = __commonJS({
 
 // ../../platform-shells/node/stdio/entry.ts
 init_define_NOMOS_KERNEL_RELEASE();
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
 import { existsSync as existsSync5, mkdirSync as mkdirSync5, mkdtempSync as mkdtempSync4, readFileSync as readFileSync3, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join5 } from "node:path";
@@ -5747,8 +5747,10 @@ var PrepareRemoteOfferResponseSchema = /* @__PURE__ */ messageDesc(file_nomos_ke
 var SignOfferPreparationRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 37);
 var SigningIdentityRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 39);
 var KernelRefusalSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 55);
+var QueryResponseSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 56);
 var ApplicationResultDeltaSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 58);
 var InterfaceCompatibilityQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 60);
+var ReadIndexPendingSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 64);
 var MaintenanceQuantumQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 65);
 var CarriedWorkspaceOfferSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 80);
 var PrepareOutboundOfferSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 84);
@@ -6017,7 +6019,7 @@ var CustodyBreakPolicySchema = /* @__PURE__ */ enumDesc(file_nomos_runtime_v2_re
 var CustodyBreakPolicy = /* @__PURE__ */ tsEnum(CustodyBreakPolicySchema);
 
 // ../../adapter/proto/nomos/runtime/v2/observability_desk_pb.js
-var file_nomos_runtime_v2_observability_desk = /* @__PURE__ */ fileDesc("Cilub21vcy9ydW50aW1lL3YyL29ic2VydmFiaWxpdHlfZGVzay5wcm90bxIQbm9tb3MucnVudGltZS52MiJCCgxUcmFjZUNvbnRleHQSEAoIdHJhY2VfaWQYASABKAwSDwoHc3Bhbl9pZBgCIAEoDBIPCgdzYW1wbGVkGAMgASgIIp0CCg5SdW50aW1lRmFpbHVyZRIMCgRjb2RlGAEgASgJEg8KB21lc3NhZ2UYAiABKAkSEQoJY29tcG9uZW50GAMgASgJEhYKCXdvcmtzcGFjZRgEIAEoCUgAiAEBEhMKBmRvbWFpbhgFIAEoCUgBiAEBEhYKCWRpcmVjdGl2ZRgGIAEoCUgCiAEBEjkKCmF0dHJpYnV0ZXMYByADKAsyJS5ub21vcy5ydW50aW1lLnYyLkRpYWdub3N0aWNBdHRyaWJ1dGUSMgoEa2luZBgIIAEoDjIkLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZUZhaWx1cmVLaW5kQgwKCl93b3Jrc3BhY2VCCQoHX2RvbWFpbkIMCgpfZGlyZWN0aXZlIr4BChJSdW50aW1lVW5hdmFpbGFibGUSOgoGcmVhc29uGAEgASgOMioubm9tb3MucnVudGltZS52Mi5SdW50aW1lVW5hdmFpbGFibGVSZWFzb24SEQoJd29ya3NwYWNlGAIgASgJEhEKCXJldHJ5YWJsZRgDIAEoCBIfChJyZXRyeV9hZnRlcl9taWxsaXMYBCABKA1IAIgBARIOCgZkZXRhaWwYBSABKAlCFQoTX3JldHJ5X2FmdGVyX21pbGxpcyJ+Cg5SdW50aW1lUmVmdXNhbBI2CgZyZWFzb24YASABKA4yJi5ub21vcy5ydW50aW1lLnYyLlJ1bnRpbWVSZWZ1c2FsUmVhc29uEhEKCXdvcmtzcGFjZRgCIAEoCRIRCglyZXRyeWFibGUYAyABKAgSDgoGZGV0YWlsGAQgASgJIqUBChNEaWFnbm9zdGljQXR0cmlidXRlEgwKBG5hbWUYASABKAkSFgoMc3RyaW5nX3ZhbHVlGAIgASgJSAASFwoNaW50ZWdlcl92YWx1ZRgDIAEoEkgAEhYKDGRvdWJsZV92YWx1ZRgEIAEoAUgAEhcKDWJvb2xlYW5fdmFsdWUYBSABKAhIABIVCgtieXRlc192YWx1ZRgGIAEoDEgAQgcKBXZhbHVlIvALCgxSdW50aW1lRXZlbnQSEAoIc2VxdWVuY2UYASABKAQSFAoHc2Vzc2lvbhgCIAEoCUgBiAEBEi8KBXJlYWR5GAogASgLMh4ubm9tb3MucnVudGltZS52Mi5SdW50aW1lUmVhZHlIABI3Cg13YXRjaF9jaGFuZ2VkGAsgASgLMh4ubm9tb3MucnVudGltZS52Mi5XYXRjaENoYW5nZWRIABI5Cg5zeW5jX2NvbXBsZXRlZBgMIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU3luY0NvbXBsZXRlZEgAEjUKDGxpbmtfY2hhbmdlZBgNIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuTGlua0NoYW5nZWRIABI5Cg5zaWduYWxfY2hhbmdlZBgOIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU2lnbmFsQ2hhbmdlZEgAEjsKD2N1c3RvZHlfY2hhbmdlZBgPIAEoCzIgLm5vbW9zLnJ1bnRpbWUudjIuQ3VzdG9keUNoYW5nZWRIABJCChNsb2NhbF93b3JrX3JlamVjdGVkGBAgASgLMiMubm9tb3MucnVudGltZS52Mi5Mb2NhbFdvcmtSZWplY3RlZEgAEjMKC2xhd19jaGFuZ2VkGBEgASgLMhwubm9tb3MucnVudGltZS52Mi5MYXdDaGFuZ2VkSAASQwoPa2VybmVsX3Byb2dyZXNzGBIgASgLMigubm9tb3MucnVudGltZS52Mi5LZXJuZWxQcm9ncmVzc09ic2VydmVkSAASLQoEc3BhbhgTIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZVNwYW5IABI/ChF0cmFuc2Zlcl9wcm9ncmVzcxgUIAEoCzIiLm5vbW9zLnJ1bnRpbWUudjIuVHJhbnNmZXJQcm9ncmVzc0gAEkkKFG1haW50ZW5hbmNlX3Byb2dyZXNzGBUgASgLMikubm9tb3MucnVudGltZS52Mi5SZWFkTWFpbnRlbmFuY2VQcm9ncmVzc0gAEjsKDXNvY2tldF9lZmZlY3QYFiABKAsyIi5ub21vcy5ydW50aW1lLnYyLlBlZXJTb2NrZXRFZmZlY3RIABJUChxjcmVkZW50aWFsX3JlZnJlc2hfcmVxdWVzdGVkGBcgASgLMiwubm9tb3MucnVudGltZS52Mi5DcmVkZW50aWFsUmVmcmVzaFJlcXVlc3RlZEgAElIKG3JlY2VpdmluZ19ncm91cF9jb252ZXJnZW5jZRgYIAEoCzIrLm5vbW9zLnJ1bnRpbWUudjIuUmVjZWl2aW5nR3JvdXBDb252ZXJnZW5jZUgAEkoKF21vZGVsX2Fkb3B0aW9uX3Byb2dyZXNzGBkgASgLMicubm9tb3MucnVudGltZS52Mi5Nb2RlbEFkb3B0aW9uUHJvZ3Jlc3NIABI7Cg9mb2xsb3dzX3N1bW1hcnkYGiABKAsyIC5ub21vcy5ydW50aW1lLnYyLkZvbGxvd3NTdW1tYXJ5SAASRAoUbG9jYWxfY29weV9wcmVzZXJ2ZWQYGyABKAsyJC5ub21vcy5ydW50aW1lLnYyLlByZXNlcnZlZExvY2FsQ29weUgAEk4KGWZvcmVpZ25fcGxhY2VtZW50X2lnbm9yZWQYHCABKAsyKS5ub21vcy5ydW50aW1lLnYyLkZvcmVpZ25QbGFjZW1lbnRJZ25vcmVkSAASQwoTYmluZGluZ19xdWFyYW50aW5lZBgdIAEoCzIkLm5vbW9zLnJ1bnRpbWUudjIuUXVhcmFudGluZWRCaW5kaW5nSAASPwoRd3JpdGVfcHJlcGFyYXRpb24YHiABKAsyIi5ub21vcy5ydW50aW1lLnYyLldyaXRlUHJlcGFyYXRpb25IABJKChdyZWFkX2FjY2Vzc19wcmVwYXJhdGlvbhgfIAEoCzInLm5vbW9zLnJ1bnRpbWUudjIuUmVhZEFjY2Vzc1ByZXBhcmF0aW9uSABCBwoFZXZlbnRCCgoIX3Nlc3Npb24ivAEKDkZvbGxvd3NTdW1tYXJ5EhAKCGZvbGxvd2VkGAEgASgNEg8KB3NldHRsZWQYAiABKA0SDAoEbGl2ZRgDIAEoDRI3Cgp3b3Jrc3BhY2VzGAQgAygLMiMubm9tb3MucnVudGltZS52Mi5Gb2xsb3dPYnNlcnZhdGlvbhIkChdvYnNlcnZlZF9hdF91bml4X21pbGxpcxgFIAEoBEgAiAEBQhoKGF9vYnNlcnZlZF9hdF91bml4X21pbGxpcyL7AwoRRm9sbG93T2JzZXJ2YXRpb24SEQoJd29ya3NwYWNlGAEgASgJEjcKBXBoYXNlGAIgASgOMigubm9tb3MucnVudGltZS52Mi5Gb2xsb3dPYnNlcnZhdGlvblBoYXNlEgwKBGxpdmUYAyABKAgSEwoGZGV0YWlsGAQgASgJSACIAQESIQoUcmV0cnlfYXRfdW5peF9taWxsaXMYBSABKARIAYgBARIfChJkdWVfYXRfdW5peF9taWxsaXMYBiABKARIAogBARIUCgdhdHRlbXB0GAcgASgNSAOIAQESGgoNYWN0aXZlX2VmZmVjdBgIIAEoCUgEiAEBEhMKBnVuc2VudBgJIAEoDUgFiAEBEhsKDnVuYWNrbm93bGVkZ2VkGAogASgNSAaIAQESQgoRY3VzdG9kaWFuX3dhcm1pbmcYCyABKAsyIi5ub21vcy5ydW50aW1lLnYyLkN1c3RvZGlhbldhcm1pbmdIB4gBAUIJCgdfZGV0YWlsQhcKFV9yZXRyeV9hdF91bml4X21pbGxpc0IVChNfZHVlX2F0X3VuaXhfbWlsbGlzQgoKCF9hdHRlbXB0QhAKDl9hY3RpdmVfZWZmZWN0QgkKB191bnNlbnRCEQoPX3VuYWNrbm93bGVkZ2VkQhQKEl9jdXN0b2RpYW5fd2FybWluZyKFAQoQQ3VzdG9kaWFuV2FybWluZxIZChFzaW5jZV91bml4X21pbGxpcxgBIAEoBBIiChpleHBlY3RlZF9yZWFkeV91bml4X21pbGxpcxgCIAEoBBIhChlzdGFsbGVkX2FmdGVyX3VuaXhfbWlsbGlzGAMgASgEEg8KB3N0YWxsZWQYBCABKAgiVgoaQ3JlZGVudGlhbFJlZnJlc2hSZXF1ZXN0ZWQSOAoHcGVuZGluZxgBIAEoCzInLm5vbW9zLnJ1bnRpbWUudjIuQ29ycmVzcG9uZGVuY2VQZW5kaW5nIj4KDFJ1bnRpbWVSZWFkeRIXCg9ydW50aW1lX3ZlcnNpb24YASABKAkSFQoNa2VybmVsX3NoYTI1NhgCIAEoDCKNAwoMV2F0Y2hDaGFuZ2VkEhcKD3N1YnNjcmlwdGlvbl9pZBgBIAEoCRITCgtyZXN1bHRfdXNkYRgCIAEoDBI2CgdmYWlsdXJlGAMgASgLMiAubm9tb3MucnVudGltZS52Mi5SdW50aW1lRmFpbHVyZUgAiAEBEjUKEmFwcGxpY2F0aW9uX3Jlc3VsdBgEIAEoCzIULmdvb2dsZS5wcm90b2J1Zi5BbnlIAYgBARIaCg1pbnRlZ2VyX3ZhbHVlGAUgASgDSAKIAQESRwoRYXBwbGljYXRpb25fZGVsdGEYBiABKAsyJy5ub21vcy5rZXJuZWwudjEuQXBwbGljYXRpb25SZXN1bHREZWx0YUgDiAEBEhwKD3Jlc3VsdF9mcm9udGllchgHIAEoCUgEiAEBQgoKCF9mYWlsdXJlQhUKE19hcHBsaWNhdGlvbl9yZXN1bHRCEAoOX2ludGVnZXJfdmFsdWVCFAoSX2FwcGxpY2F0aW9uX2RlbHRhQhIKEF9yZXN1bHRfZnJvbnRpZXIinAEKDVN5bmNDb21wbGV0ZWQSDgoGcmVhc29uGAEgASgJEjcKBnJlc3VsdBgCIAEoCzInLm5vbW9zLnJ1bnRpbWUudjIuU3luY1dvcmtzcGFjZVJlc3BvbnNlEjYKB2ZhaWx1cmUYAyABKAsyIC5ub21vcy5ydW50aW1lLnYyLlJ1bnRpbWVGYWlsdXJlSACIAQFCCgoIX2ZhaWx1cmUigAEKC0xpbmtDaGFuZ2VkEiwKBnN0YXR1cxgBIAEoDjIcLm5vbW9zLnJ1bnRpbWUudjIuTGlua1N0YXR1cxI3CgdjbG9zdXJlGAIgASgLMiEubm9tb3MucnVudGltZS52Mi5MaXZlTGlua0Nsb3N1cmVIAIgBAUIKCghfY2xvc3VyZSI4Cg1TaWduYWxDaGFuZ2VkEg4KBmRvbWFpbhgBIAEoCRIXCg9wcm9qZWN0aW9uX3VzZGEYAiABKAwiUAoKTGF3Q2hhbmdlZBIOCgZkb21haW4YASABKAkSFgoOcGFja2FnZV9zaGEyNTYYAiABKAkSGgoSY29tcGF0aWJpbGl0eV91c2RhGAMgASgMIt0BCgtSdW50aW1lU3BhbhIQCgh0cmFjZV9pZBgBIAEoDBIPCgdzcGFuX2lkGAIgASgMEhsKDnBhcmVudF9zcGFuX2lkGAMgASgMSACIAQESDAoEbmFtZRgEIAEoCRIaChJzdGFydGVkX3VuaXhfbmFub3MYBSABKAQSFgoOZHVyYXRpb25fbmFub3MYBiABKAQSOQoKYXR0cmlidXRlcxgHIAMoCzIlLm5vbW9zLnJ1bnRpbWUudjIuRGlhZ25vc3RpY0F0dHJpYnV0ZUIRCg9fcGFyZW50X3NwYW5faWQi6gEKFktlcm5lbFByb2dyZXNzT2JzZXJ2ZWQSOQoIc25hcHNob3QYASABKAsyJy5ub21vcy5rZXJuZWwudjEuS2VybmVsUHJvZ3Jlc3NTbmFwc2hvdBIkChxob3N0X29ic2VydmVkX2VsYXBzZWRfbWljcm9zGAIgASgEEioKImhvc3Rfb2JzZXJ2ZWRfcGhhc2VfZWxhcHNlZF9taWNyb3MYAyABKAQSHgoWcHJvY2Vzc19yZXNpZGVudF9ieXRlcxgEIAEoBBIjChtwcm9jZXNzX3BlYWtfcmVzaWRlbnRfYnl0ZXMYBSABKAQiggEKEFRyYW5zZmVyUHJvZ3Jlc3MSFgoOcmVjZWl2ZWRfYnl0ZXMYASABKAQSGAoLdG90YWxfYnl0ZXMYAiABKARIAIgBARIsCgRraW5kGAMgASgOMh4ubm9tb3MucnVudGltZS52Mi5UcmFuc2ZlcktpbmRCDgoMX3RvdGFsX2J5dGVzIjkKEFdyaXRlUHJlcGFyYXRpb24SEgoKcmVxdWVzdF9pZBgBIAEoCRIRCgl3b3Jrc3BhY2UYAiABKAkiPgoVUmVhZEFjY2Vzc1ByZXBhcmF0aW9uEhIKCnJlcXVlc3RfaWQYASABKAkSEQoJd29ya3NwYWNlGAIgASgJKsoBChJSdW50aW1lRmFpbHVyZUtpbmQSJAogUlVOVElNRV9GQUlMVVJFX0tJTkRfVU5TUEVDSUZJRUQQABIhCh1SVU5USU1FX0ZBSUxVUkVfS0lORF9JTlRFUk5BTBABEiEKHVJVTlRJTUVfRkFJTFVSRV9LSU5EX1BST1RPQ09MEAISIgoeUlVOVElNRV9GQUlMVVJFX0tJTkRfSU5URUdSSVRZEAMSJAogUlVOVElNRV9GQUlMVVJFX0tJTkRfVU5TVVBQT1JURUQQBCqnAwoYUnVudGltZVVuYXZhaWxhYmxlUmVhc29uEioKJlJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1VOU1BFQ0lGSUVEEAASMgouUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fUkVNT1RFX09OTFlfT0ZGTElORRABEjEKLVJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1JFTU9URV9VTlJFQUNIQUJMRRACEi0KKVJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1JFTU9URV9USU1FT1VUEAMSNgoyUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fTE9DQUxfUkVQTElDQV9OT1RfUkVBRFkQBBI1CjFSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9DUkVERU5USUFMX1VOQVZBSUxBQkxFEAUSMAosUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fV09SS1NQQUNFX09QRU5JTkcQBhIoCiRSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9QRUVSX0JVU1kQByrwAQoUUnVudGltZVJlZnVzYWxSZWFzb24SJgoiUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9VTlNQRUNJRklFRBAAEi0KKVJVTlRJTUVfUkVGVVNBTF9SRUFTT05fSU5WQUxJRF9DUkVERU5USUFMEAESKAokUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9BQ0NFU1NfREVOSUVEEAISKwonUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9QTEFDRU1FTlRfUE9MSUNZEAMSKgomUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9TRVNTSU9OX1VOQk9VTkQQBCqVBAoWRm9sbG93T2JzZXJ2YXRpb25QaGFzZRIoCiRGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfVU5TUEVDSUZJRUQQABIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfREVTSVJFRBABEiAKHEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9EVUUQAhIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfUlVOTklORxADEiQKIEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9TRVRUTEVEEAQSMAosRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0FXQUlUSU5HX0RFUEVOREVOQ1kQBRIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfT0ZGTElORRAGEi8KK0ZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9JTlZBTElEX0NSRURFTlRJQUwQBxIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfQkFDS09GRhAIEiwKKEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9SRUJPUk5fUkVNT1RFTFkQCRIsCihGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfUkVQTEFDSU5HX0xPQ0FMEAoSMgouRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0xPQ0FMX0NPUFlfVU5SRUFEQUJMRRALKlcKCkxpbmtTdGF0dXMSGwoXTElOS19TVEFUVVNfVU5TUEVDSUZJRUQQABIUChBMSU5LX1NUQVRVU19PUEVOEAESFgoSTElOS19TVEFUVVNfQ0xPU0VEEAIqdgoMVHJhbnNmZXJLaW5kEh0KGVRSQU5TRkVSX0tJTkRfVU5TUEVDSUZJRUQQABIXChNUUkFOU0ZFUl9LSU5EX0RFTFRBEAESFgoSVFJBTlNGRVJfS0lORF9GVUxMEAISFgoSVFJBTlNGRVJfS0lORF9QVVNIEANiBnByb3RvMw", [file_google_protobuf_any, file_nomos_kernel_v1_kernel, file_nomos_kernel_v1_progress, file_nomos_runtime_v2_correspondence_desk, file_nomos_runtime_v2_custody_desk, file_nomos_runtime_v2_placement_desk, file_nomos_runtime_v2_maintenance_desk, file_nomos_runtime_v2_model_adoption_desk, file_nomos_runtime_v2_receiving_group_desk, file_nomos_runtime_v2_recovery_desk]);
+var file_nomos_runtime_v2_observability_desk = /* @__PURE__ */ fileDesc("Cilub21vcy9ydW50aW1lL3YyL29ic2VydmFiaWxpdHlfZGVzay5wcm90bxIQbm9tb3MucnVudGltZS52MiJCCgxUcmFjZUNvbnRleHQSEAoIdHJhY2VfaWQYASABKAwSDwoHc3Bhbl9pZBgCIAEoDBIPCgdzYW1wbGVkGAMgASgIIp0CCg5SdW50aW1lRmFpbHVyZRIMCgRjb2RlGAEgASgJEg8KB21lc3NhZ2UYAiABKAkSEQoJY29tcG9uZW50GAMgASgJEhYKCXdvcmtzcGFjZRgEIAEoCUgAiAEBEhMKBmRvbWFpbhgFIAEoCUgBiAEBEhYKCWRpcmVjdGl2ZRgGIAEoCUgCiAEBEjkKCmF0dHJpYnV0ZXMYByADKAsyJS5ub21vcy5ydW50aW1lLnYyLkRpYWdub3N0aWNBdHRyaWJ1dGUSMgoEa2luZBgIIAEoDjIkLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZUZhaWx1cmVLaW5kQgwKCl93b3Jrc3BhY2VCCQoHX2RvbWFpbkIMCgpfZGlyZWN0aXZlIr4BChJSdW50aW1lVW5hdmFpbGFibGUSOgoGcmVhc29uGAEgASgOMioubm9tb3MucnVudGltZS52Mi5SdW50aW1lVW5hdmFpbGFibGVSZWFzb24SEQoJd29ya3NwYWNlGAIgASgJEhEKCXJldHJ5YWJsZRgDIAEoCBIfChJyZXRyeV9hZnRlcl9taWxsaXMYBCABKA1IAIgBARIOCgZkZXRhaWwYBSABKAlCFQoTX3JldHJ5X2FmdGVyX21pbGxpcyJ+Cg5SdW50aW1lUmVmdXNhbBI2CgZyZWFzb24YASABKA4yJi5ub21vcy5ydW50aW1lLnYyLlJ1bnRpbWVSZWZ1c2FsUmVhc29uEhEKCXdvcmtzcGFjZRgCIAEoCRIRCglyZXRyeWFibGUYAyABKAgSDgoGZGV0YWlsGAQgASgJIqUBChNEaWFnbm9zdGljQXR0cmlidXRlEgwKBG5hbWUYASABKAkSFgoMc3RyaW5nX3ZhbHVlGAIgASgJSAASFwoNaW50ZWdlcl92YWx1ZRgDIAEoEkgAEhYKDGRvdWJsZV92YWx1ZRgEIAEoAUgAEhcKDWJvb2xlYW5fdmFsdWUYBSABKAhIABIVCgtieXRlc192YWx1ZRgGIAEoDEgAQgcKBXZhbHVlIvALCgxSdW50aW1lRXZlbnQSEAoIc2VxdWVuY2UYASABKAQSFAoHc2Vzc2lvbhgCIAEoCUgBiAEBEi8KBXJlYWR5GAogASgLMh4ubm9tb3MucnVudGltZS52Mi5SdW50aW1lUmVhZHlIABI3Cg13YXRjaF9jaGFuZ2VkGAsgASgLMh4ubm9tb3MucnVudGltZS52Mi5XYXRjaENoYW5nZWRIABI5Cg5zeW5jX2NvbXBsZXRlZBgMIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU3luY0NvbXBsZXRlZEgAEjUKDGxpbmtfY2hhbmdlZBgNIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuTGlua0NoYW5nZWRIABI5Cg5zaWduYWxfY2hhbmdlZBgOIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU2lnbmFsQ2hhbmdlZEgAEjsKD2N1c3RvZHlfY2hhbmdlZBgPIAEoCzIgLm5vbW9zLnJ1bnRpbWUudjIuQ3VzdG9keUNoYW5nZWRIABJCChNsb2NhbF93b3JrX3JlamVjdGVkGBAgASgLMiMubm9tb3MucnVudGltZS52Mi5Mb2NhbFdvcmtSZWplY3RlZEgAEjMKC2xhd19jaGFuZ2VkGBEgASgLMhwubm9tb3MucnVudGltZS52Mi5MYXdDaGFuZ2VkSAASQwoPa2VybmVsX3Byb2dyZXNzGBIgASgLMigubm9tb3MucnVudGltZS52Mi5LZXJuZWxQcm9ncmVzc09ic2VydmVkSAASLQoEc3BhbhgTIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZVNwYW5IABI/ChF0cmFuc2Zlcl9wcm9ncmVzcxgUIAEoCzIiLm5vbW9zLnJ1bnRpbWUudjIuVHJhbnNmZXJQcm9ncmVzc0gAEkkKFG1haW50ZW5hbmNlX3Byb2dyZXNzGBUgASgLMikubm9tb3MucnVudGltZS52Mi5SZWFkTWFpbnRlbmFuY2VQcm9ncmVzc0gAEjsKDXNvY2tldF9lZmZlY3QYFiABKAsyIi5ub21vcy5ydW50aW1lLnYyLlBlZXJTb2NrZXRFZmZlY3RIABJUChxjcmVkZW50aWFsX3JlZnJlc2hfcmVxdWVzdGVkGBcgASgLMiwubm9tb3MucnVudGltZS52Mi5DcmVkZW50aWFsUmVmcmVzaFJlcXVlc3RlZEgAElIKG3JlY2VpdmluZ19ncm91cF9jb252ZXJnZW5jZRgYIAEoCzIrLm5vbW9zLnJ1bnRpbWUudjIuUmVjZWl2aW5nR3JvdXBDb252ZXJnZW5jZUgAEkoKF21vZGVsX2Fkb3B0aW9uX3Byb2dyZXNzGBkgASgLMicubm9tb3MucnVudGltZS52Mi5Nb2RlbEFkb3B0aW9uUHJvZ3Jlc3NIABI7Cg9mb2xsb3dzX3N1bW1hcnkYGiABKAsyIC5ub21vcy5ydW50aW1lLnYyLkZvbGxvd3NTdW1tYXJ5SAASRAoUbG9jYWxfY29weV9wcmVzZXJ2ZWQYGyABKAsyJC5ub21vcy5ydW50aW1lLnYyLlByZXNlcnZlZExvY2FsQ29weUgAEk4KGWZvcmVpZ25fcGxhY2VtZW50X2lnbm9yZWQYHCABKAsyKS5ub21vcy5ydW50aW1lLnYyLkZvcmVpZ25QbGFjZW1lbnRJZ25vcmVkSAASQwoTYmluZGluZ19xdWFyYW50aW5lZBgdIAEoCzIkLm5vbW9zLnJ1bnRpbWUudjIuUXVhcmFudGluZWRCaW5kaW5nSAASPwoRd3JpdGVfcHJlcGFyYXRpb24YHiABKAsyIi5ub21vcy5ydW50aW1lLnYyLldyaXRlUHJlcGFyYXRpb25IABJKChdyZWFkX2FjY2Vzc19wcmVwYXJhdGlvbhgfIAEoCzInLm5vbW9zLnJ1bnRpbWUudjIuUmVhZEFjY2Vzc1ByZXBhcmF0aW9uSABCBwoFZXZlbnRCCgoIX3Nlc3Npb24ivAEKDkZvbGxvd3NTdW1tYXJ5EhAKCGZvbGxvd2VkGAEgASgNEg8KB3NldHRsZWQYAiABKA0SDAoEbGl2ZRgDIAEoDRI3Cgp3b3Jrc3BhY2VzGAQgAygLMiMubm9tb3MucnVudGltZS52Mi5Gb2xsb3dPYnNlcnZhdGlvbhIkChdvYnNlcnZlZF9hdF91bml4X21pbGxpcxgFIAEoBEgAiAEBQhoKGF9vYnNlcnZlZF9hdF91bml4X21pbGxpcyL7AwoRRm9sbG93T2JzZXJ2YXRpb24SEQoJd29ya3NwYWNlGAEgASgJEjcKBXBoYXNlGAIgASgOMigubm9tb3MucnVudGltZS52Mi5Gb2xsb3dPYnNlcnZhdGlvblBoYXNlEgwKBGxpdmUYAyABKAgSEwoGZGV0YWlsGAQgASgJSACIAQESIQoUcmV0cnlfYXRfdW5peF9taWxsaXMYBSABKARIAYgBARIfChJkdWVfYXRfdW5peF9taWxsaXMYBiABKARIAogBARIUCgdhdHRlbXB0GAcgASgNSAOIAQESGgoNYWN0aXZlX2VmZmVjdBgIIAEoCUgEiAEBEhMKBnVuc2VudBgJIAEoDUgFiAEBEhsKDnVuYWNrbm93bGVkZ2VkGAogASgNSAaIAQESQgoRY3VzdG9kaWFuX3dhcm1pbmcYCyABKAsyIi5ub21vcy5ydW50aW1lLnYyLkN1c3RvZGlhbldhcm1pbmdIB4gBAUIJCgdfZGV0YWlsQhcKFV9yZXRyeV9hdF91bml4X21pbGxpc0IVChNfZHVlX2F0X3VuaXhfbWlsbGlzQgoKCF9hdHRlbXB0QhAKDl9hY3RpdmVfZWZmZWN0QgkKB191bnNlbnRCEQoPX3VuYWNrbm93bGVkZ2VkQhQKEl9jdXN0b2RpYW5fd2FybWluZyKFAQoQQ3VzdG9kaWFuV2FybWluZxIZChFzaW5jZV91bml4X21pbGxpcxgBIAEoBBIiChpleHBlY3RlZF9yZWFkeV91bml4X21pbGxpcxgCIAEoBBIhChlzdGFsbGVkX2FmdGVyX3VuaXhfbWlsbGlzGAMgASgEEg8KB3N0YWxsZWQYBCABKAgiVgoaQ3JlZGVudGlhbFJlZnJlc2hSZXF1ZXN0ZWQSOAoHcGVuZGluZxgBIAEoCzInLm5vbW9zLnJ1bnRpbWUudjIuQ29ycmVzcG9uZGVuY2VQZW5kaW5nIj4KDFJ1bnRpbWVSZWFkeRIXCg9ydW50aW1lX3ZlcnNpb24YASABKAkSFQoNa2VybmVsX3NoYTI1NhgCIAEoDCKNAwoMV2F0Y2hDaGFuZ2VkEhcKD3N1YnNjcmlwdGlvbl9pZBgBIAEoCRITCgtyZXN1bHRfdXNkYRgCIAEoDBI2CgdmYWlsdXJlGAMgASgLMiAubm9tb3MucnVudGltZS52Mi5SdW50aW1lRmFpbHVyZUgAiAEBEjUKEmFwcGxpY2F0aW9uX3Jlc3VsdBgEIAEoCzIULmdvb2dsZS5wcm90b2J1Zi5BbnlIAYgBARIaCg1pbnRlZ2VyX3ZhbHVlGAUgASgDSAKIAQESRwoRYXBwbGljYXRpb25fZGVsdGEYBiABKAsyJy5ub21vcy5rZXJuZWwudjEuQXBwbGljYXRpb25SZXN1bHREZWx0YUgDiAEBEhwKD3Jlc3VsdF9mcm9udGllchgHIAEoCUgEiAEBQgoKCF9mYWlsdXJlQhUKE19hcHBsaWNhdGlvbl9yZXN1bHRCEAoOX2ludGVnZXJfdmFsdWVCFAoSX2FwcGxpY2F0aW9uX2RlbHRhQhIKEF9yZXN1bHRfZnJvbnRpZXIinAEKDVN5bmNDb21wbGV0ZWQSDgoGcmVhc29uGAEgASgJEjcKBnJlc3VsdBgCIAEoCzInLm5vbW9zLnJ1bnRpbWUudjIuU3luY1dvcmtzcGFjZVJlc3BvbnNlEjYKB2ZhaWx1cmUYAyABKAsyIC5ub21vcy5ydW50aW1lLnYyLlJ1bnRpbWVGYWlsdXJlSACIAQFCCgoIX2ZhaWx1cmUigAEKC0xpbmtDaGFuZ2VkEiwKBnN0YXR1cxgBIAEoDjIcLm5vbW9zLnJ1bnRpbWUudjIuTGlua1N0YXR1cxI3CgdjbG9zdXJlGAIgASgLMiEubm9tb3MucnVudGltZS52Mi5MaXZlTGlua0Nsb3N1cmVIAIgBAUIKCghfY2xvc3VyZSI4Cg1TaWduYWxDaGFuZ2VkEg4KBmRvbWFpbhgBIAEoCRIXCg9wcm9qZWN0aW9uX3VzZGEYAiABKAwiUAoKTGF3Q2hhbmdlZBIOCgZkb21haW4YASABKAkSFgoOcGFja2FnZV9zaGEyNTYYAiABKAkSGgoSY29tcGF0aWJpbGl0eV91c2RhGAMgASgMIt0BCgtSdW50aW1lU3BhbhIQCgh0cmFjZV9pZBgBIAEoDBIPCgdzcGFuX2lkGAIgASgMEhsKDnBhcmVudF9zcGFuX2lkGAMgASgMSACIAQESDAoEbmFtZRgEIAEoCRIaChJzdGFydGVkX3VuaXhfbmFub3MYBSABKAQSFgoOZHVyYXRpb25fbmFub3MYBiABKAQSOQoKYXR0cmlidXRlcxgHIAMoCzIlLm5vbW9zLnJ1bnRpbWUudjIuRGlhZ25vc3RpY0F0dHJpYnV0ZUIRCg9fcGFyZW50X3NwYW5faWQi6gEKFktlcm5lbFByb2dyZXNzT2JzZXJ2ZWQSOQoIc25hcHNob3QYASABKAsyJy5ub21vcy5rZXJuZWwudjEuS2VybmVsUHJvZ3Jlc3NTbmFwc2hvdBIkChxob3N0X29ic2VydmVkX2VsYXBzZWRfbWljcm9zGAIgASgEEioKImhvc3Rfb2JzZXJ2ZWRfcGhhc2VfZWxhcHNlZF9taWNyb3MYAyABKAQSHgoWcHJvY2Vzc19yZXNpZGVudF9ieXRlcxgEIAEoBBIjChtwcm9jZXNzX3BlYWtfcmVzaWRlbnRfYnl0ZXMYBSABKAQiggEKEFRyYW5zZmVyUHJvZ3Jlc3MSFgoOcmVjZWl2ZWRfYnl0ZXMYASABKAQSGAoLdG90YWxfYnl0ZXMYAiABKARIAIgBARIsCgRraW5kGAMgASgOMh4ubm9tb3MucnVudGltZS52Mi5UcmFuc2ZlcktpbmRCDgoMX3RvdGFsX2J5dGVzIjkKEFdyaXRlUHJlcGFyYXRpb24SEgoKcmVxdWVzdF9pZBgBIAEoCRIRCgl3b3Jrc3BhY2UYAiABKAkiPgoVUmVhZEFjY2Vzc1ByZXBhcmF0aW9uEhIKCnJlcXVlc3RfaWQYASABKAkSEQoJd29ya3NwYWNlGAIgASgJKsoBChJSdW50aW1lRmFpbHVyZUtpbmQSJAogUlVOVElNRV9GQUlMVVJFX0tJTkRfVU5TUEVDSUZJRUQQABIhCh1SVU5USU1FX0ZBSUxVUkVfS0lORF9JTlRFUk5BTBABEiEKHVJVTlRJTUVfRkFJTFVSRV9LSU5EX1BST1RPQ09MEAISIgoeUlVOVElNRV9GQUlMVVJFX0tJTkRfSU5URUdSSVRZEAMSJAogUlVOVElNRV9GQUlMVVJFX0tJTkRfVU5TVVBQT1JURUQQBCqnAwoYUnVudGltZVVuYXZhaWxhYmxlUmVhc29uEioKJlJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1VOU1BFQ0lGSUVEEAASMgouUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fUkVNT1RFX09OTFlfT0ZGTElORRABEjEKLVJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1JFTU9URV9VTlJFQUNIQUJMRRACEi0KKVJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1JFTU9URV9USU1FT1VUEAMSNgoyUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fTE9DQUxfUkVQTElDQV9OT1RfUkVBRFkQBBI1CjFSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9DUkVERU5USUFMX1VOQVZBSUxBQkxFEAUSMAosUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fV09SS1NQQUNFX09QRU5JTkcQBhIoCiRSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9QRUVSX0JVU1kQByrwAQoUUnVudGltZVJlZnVzYWxSZWFzb24SJgoiUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9VTlNQRUNJRklFRBAAEi0KKVJVTlRJTUVfUkVGVVNBTF9SRUFTT05fSU5WQUxJRF9DUkVERU5USUFMEAESKAokUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9BQ0NFU1NfREVOSUVEEAISKwonUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9QTEFDRU1FTlRfUE9MSUNZEAMSKgomUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9TRVNTSU9OX1VOQk9VTkQQBCrCBAoWRm9sbG93T2JzZXJ2YXRpb25QaGFzZRIoCiRGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfVU5TUEVDSUZJRUQQABIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfREVTSVJFRBABEiAKHEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9EVUUQAhIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfUlVOTklORxADEiQKIEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9TRVRUTEVEEAQSMAosRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0FXQUlUSU5HX0RFUEVOREVOQ1kQBRIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfT0ZGTElORRAGEi8KK0ZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9JTlZBTElEX0NSRURFTlRJQUwQBxIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfQkFDS09GRhAIEiwKKEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9SRUJPUk5fUkVNT1RFTFkQCRIsCihGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfUkVQTEFDSU5HX0xPQ0FMEAoSMgouRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0xPQ0FMX0NPUFlfVU5SRUFEQUJMRRALEisKJ0ZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9LRVJORUxfUkVGVVNFRBAMKlcKCkxpbmtTdGF0dXMSGwoXTElOS19TVEFUVVNfVU5TUEVDSUZJRUQQABIUChBMSU5LX1NUQVRVU19PUEVOEAESFgoSTElOS19TVEFUVVNfQ0xPU0VEEAIqdgoMVHJhbnNmZXJLaW5kEh0KGVRSQU5TRkVSX0tJTkRfVU5TUEVDSUZJRUQQABIXChNUUkFOU0ZFUl9LSU5EX0RFTFRBEAESFgoSVFJBTlNGRVJfS0lORF9GVUxMEAISFgoSVFJBTlNGRVJfS0lORF9QVVNIEANiBnByb3RvMw", [file_google_protobuf_any, file_nomos_kernel_v1_kernel, file_nomos_kernel_v1_progress, file_nomos_runtime_v2_correspondence_desk, file_nomos_runtime_v2_custody_desk, file_nomos_runtime_v2_placement_desk, file_nomos_runtime_v2_maintenance_desk, file_nomos_runtime_v2_model_adoption_desk, file_nomos_runtime_v2_receiving_group_desk, file_nomos_runtime_v2_recovery_desk]);
 var RuntimeFailureSchema = /* @__PURE__ */ messageDesc(file_nomos_runtime_v2_observability_desk, 1);
 var RuntimeUnavailableSchema = /* @__PURE__ */ messageDesc(file_nomos_runtime_v2_observability_desk, 2);
 var RuntimeRefusalSchema = /* @__PURE__ */ messageDesc(file_nomos_runtime_v2_observability_desk, 3);
@@ -8032,6 +8034,11 @@ var kernelReadinessPending = (message) => {
   if (!READINESS_DEBT.test(message)) return void 0;
   return new KernelReadinessPending(/source workspace '([^']+)'/.exec(message)?.[1]?.trim(), message);
 };
+var READ_INDEX_BUILDING = /the read index of (.+?) is (?:being built \(\d+ of \d+ documents\)|built \(\d+ documents\) and is being bound); read maintenance (?:continues|finishes) it/;
+var kernelReadIndexBuilding = (message) => {
+  const workspace = READ_INDEX_BUILDING.exec(message)?.[1]?.trim();
+  return workspace === void 0 ? void 0 : { workspace };
+};
 var requiredForeignWorkspace = (message) => {
   const patterns = [
     /workspace '([^']+)' must be resident in the kernel/,
@@ -8055,9 +8062,31 @@ function throwIfKernelControlRequired(failure) {
     throw new KernelWorkspaceResidencyRequired(workspace, failure.message);
   }
 }
+var KernelRefusal = class extends Error {
+  code;
+  failure;
+  constructor(failure) {
+    super(`${failure.code}: ${failure.message}`);
+    this.name = "KernelRefusal";
+    this.code = failure.code;
+    this.failure = failure;
+  }
+};
 function throwKernelFailure(failure) {
   throwIfKernelControlRequired(failure);
-  throw new Error(`${failure.code}: ${failure.message}`);
+  throw new KernelRefusal(failure);
+}
+var KERNEL_FAILURE_TEXT = /^(NMS-[A-Z0-9]+(?:-[A-Z0-9]+)*): ([\s\S]*)$/;
+var ENVIRONMENTAL = /NMS-KERNEL-TRAP|\btrap\b|unreachable|out of bounds|out of memory|memory allocation|\block\b|File exists|No such file|os error|I\/O|Permission denied|No space|\bE(?:EXIST|NOENT|ACCES|NOSPC|IO|AGAIN|BUSY)\b/i;
+function deterministicKernelRefusal(error) {
+  if (error instanceof KernelWorkspaceResidencyRequired || error instanceof KernelHistoryRequired || error instanceof KernelReadinessPending) return void 0;
+  if (error instanceof KernelRefusal && (error.failure.historyRequired !== void 0 || error.failure.identityProviderWitnessRequired !== void 0)) return void 0;
+  const text = error instanceof Error ? error.message : typeof error === "string" ? error : "";
+  const match = KERNEL_FAILURE_TEXT.exec(text);
+  if (!match) return void 0;
+  const [, code, message] = match;
+  if (ENVIRONMENTAL.test(text) || READINESS_DEBT.test(message) || requiredForeignWorkspace(message) !== void 0) return void 0;
+  return { code, message };
 }
 function rethrowTypedKernelFailure(error) {
   if (error instanceof KernelWorkspaceResidencyRequired || error instanceof KernelHistoryRequired) throw error;
@@ -14096,8 +14125,9 @@ function memoryCheckpointStaging() {
 
 // ../src/runtime/live_inbound_stream.ts
 var LEVEL_BATCH = "level:";
+var HISTORY_REQUIRED = "nomos.stream.history_required";
+var CONTAINMENT_ASK_SUFFIX = ":contain";
 var STREAM_WINDOW_CHUNKS = 8;
-var ASK_AGAIN_NANOS = 15000000000n;
 var historySlot = (workspace) => `${workspace}#history`;
 var LiveInboundStream = class {
   #ports;
@@ -14115,7 +14145,10 @@ var LiveInboundStream = class {
     }
     return inbound;
   }
-  /** When this workspace's stream last delivered anything (a waiting procedure is progressing). */
+  /** When this workspace's stream last delivered data to an ask (a waiting procedure is progressing).
+   * A refusal, a frontier, unrelated traffic on the socket and this copy's own re-asking are not
+   * progress: a procedure whose stream only ever says "ask again" gives up and its round fails over
+   * (CAP-838). */
   lastHeard(workspace) {
     return this.#by.get(workspace)?.lastHeard;
   }
@@ -14138,7 +14171,8 @@ var LiveInboundStream = class {
         inbound.wants.level = {
           effectId: effect.effectId,
           maxOffers: Math.max(1, request.value.maxOffers),
-          remountAfterOffers: request.value.remountAfterOffers
+          remountAfterOffers: request.value.remountAfterOffers,
+          contain: effect.effectId.endsWith(CONTAINMENT_ASK_SUFFIX)
         };
         this.#askLevel(effect.workspace, inbound);
       }
@@ -14198,7 +14232,7 @@ var LiveInboundStream = class {
       const batch = inbound.levelBatch;
       if (batch) {
         inbound.levelBatch = void 0;
-        if (batch.base === this.#ports.head(effect.workspace)) {
+        if (batch.base === this.#ports.head(effect.workspace) || batch.base === request.value.head) {
           inbound.wants.level = void 0;
           return create(PeerStreamReceiptSchema, {
             outcome: { case: "pack", value: batch },
@@ -14209,14 +14243,14 @@ var LiveInboundStream = class {
         this.#askLevel(effect.workspace, inbound);
       }
       const head = this.#ports.head(effect.workspace);
-      if (head && inbound.announced && head === inbound.announced) {
+      if (inbound.announced && (head === inbound.announced || inbound.askedFrom === inbound.announced)) {
         inbound.wants.level = void 0;
         return create(PeerStreamReceiptSchema, {
-          outcome: { case: "level", value: head },
+          outcome: { case: "level", value: inbound.announced },
           ...inbound.sealed ? { sealed: inbound.sealed } : {}
         });
       }
-      return this.#refusalReceipt(inbound);
+      return this.#refusalReceipt(inbound, inbound.wants.level?.effectId === effect.effectId && inbound.wants.level.contain);
     }
     if (request.case === "history" || request.case === "ref") {
       const want = inbound.wants.packs.get(request.value.requestId);
@@ -14231,10 +14265,16 @@ var LiveInboundStream = class {
     return void 0;
   }
   /** A terminal refusal (not one that only says when to ask again) ends the procedure's wait. */
-  #refusalReceipt(inbound) {
+  #refusalReceipt(inbound, contain = false) {
     const refused = inbound.refused;
-    if (!refused || refused.retryAfterMillis !== void 0) return void 0;
+    if (!refused) return void 0;
+    const answersContainment = contain && refused.code === HISTORY_REQUIRED;
+    if (refused.retryAfterMillis !== void 0 && !answersContainment) return void 0;
     inbound.refused = void 0;
+    if (answersContainment) {
+      inbound.askAgainAt = void 0;
+      inbound.wants.level = void 0;
+    }
     return create(PeerStreamReceiptSchema, { outcome: { case: "refusal", value: refused } });
   }
   /** The procedure gave up (it timed out, or its work ended). */
@@ -14265,7 +14305,9 @@ var LiveInboundStream = class {
   /** One frame from the peer. True when it was the stream's (the live desk handles the rest). */
   frame(workspace, message) {
     const inbound = this.#of(workspace);
-    inbound.lastHeard = this.#ports.monotonicNanoseconds();
+    if (message.case === "checkpointOffer" || message.case === "checkpointChunk" || message.case === "pack") {
+      inbound.lastHeard = this.#ports.monotonicNanoseconds();
+    }
     switch (message.case) {
       case "frontier":
         if (message.value.response && message.value.head) {
@@ -14320,18 +14362,26 @@ var LiveInboundStream = class {
         return false;
     }
   }
-  /** Re-ask what is due: a refusal's retry time passed, or an ask heard nothing for too long. */
+  /**
+   * Ask again when a refusal said when to (the peer was opening, or acquiring history). Nothing else
+   * here runs on a timer (CAP-838): the socket is ordered and reliable, every ask is answered on it,
+   * and an ask is re-sent only when its socket re-opens (`opened`) or its refusal's time comes. The
+   * stream used to re-ask whatever had heard nothing for 15 s, and that resend - itself counted as
+   * hearing - hid an ask answered "come back" for ever.
+   */
   drive(workspace) {
     const inbound = this.#by.get(workspace);
-    if (!inbound || !this.wanted(workspace)) return void 0;
+    if (!inbound || inbound.askAgainAt === void 0) return void 0;
+    if (!this.wanted(workspace)) {
+      inbound.askAgainAt = void 0;
+      return void 0;
+    }
     const now2 = this.#ports.monotonicNanoseconds();
-    const due2 = inbound.askAgainAt ?? inbound.lastHeard + ASK_AGAIN_NANOS;
-    if (now2 < due2) return due2 - now2;
+    if (now2 < inbound.askAgainAt) return inbound.askAgainAt - now2;
     inbound.askAgainAt = void 0;
     inbound.refused = void 0;
-    inbound.lastHeard = now2;
     this.opened(workspace);
-    return ASK_AGAIN_NANOS;
+    return void 0;
   }
   #offered(workspace, inbound, offer) {
     inbound.refused = void 0;
@@ -14374,6 +14424,7 @@ var LiveInboundStream = class {
     const held = !taken ? -1 : "pack" in taken ? taken.pack.byteLength : taken.bytes;
     if (held !== transfer.bytes || transfer.received !== transfer.bytes) {
       if (taken && "stagedPackFile" in taken) this.#staging.clear(workspace);
+      if (inbound.wants.checkpoint) this.#askCheckpoint(workspace, inbound);
       return;
     }
     inbound.complete = {
@@ -14491,8 +14542,12 @@ var LiveInboundStream = class {
       this.#askCheckpoint(workspace, inbound);
       return;
     }
+    inbound.announced = void 0;
+    inbound.sealed = void 0;
+    const head = this.#ports.head(workspace) ?? "";
+    inbound.askedFrom = head;
     this.#ports.send(workspace, { case: "frontier", value: create(LiveFrontierSchema, {
-      head: this.#ports.head(workspace) ?? "",
+      head,
       response: false,
       maxOffers: level.maxOffers,
       remountAfterOffers: level.remountAfterOffers,
@@ -15011,6 +15066,24 @@ function placementMovedBy(request, response) {
   return void 0;
 }
 var PLACEMENT_REFERENCE = "refs/nomos/placement";
+function readIndexPendingAnswer(request, message) {
+  if (request.operation.case !== "query" || request.operation.value.query.case === "maintenanceQuantum") return void 0;
+  const building = kernelReadIndexBuilding(message);
+  if (building === void 0) return void 0;
+  const target3 = request.operation.value.target;
+  return create(CallResponseSchema, {
+    protocolVersion: request.protocolVersion,
+    requestId: request.requestId,
+    outcome: { case: "query", value: create(QueryResponseSchema, {
+      result: { case: "readIndexPending", value: create(ReadIndexPendingSchema, {
+        workspace: target3?.workspace || building.workspace,
+        branch: target3?.branch ?? "",
+        // The sliced build names no frontier: it restarts at whatever head main holds when it continues.
+        requestedFrontier: ""
+      }) }
+    }) }
+  });
+}
 var KernelPort = class {
   #kernel;
   #activeOperation;
@@ -16035,6 +16108,8 @@ var KernelPort = class {
         const nested = request.operation.case === "custody" ? request.operation.value.operation.case ?? "empty" : request.operation.case === "query" ? request.operation.value.query.case === "named" ? `named:${request.operation.value.query.value.operation}` : request.operation.value.query.case ?? "empty" : "";
         error.message = `kernel-operation=${top}/${nested}: ${error.message}`;
       }
+      const pending = readIndexPendingAnswer(request, error instanceof Error ? error.message : String(error));
+      if (pending !== void 0) return pending;
       rethrowTypedKernelFailure(error);
     }
     if (response.requestId !== request.requestId) {
@@ -16045,6 +16120,9 @@ var KernelPort = class {
     this.#residency.after(request, response);
     const placementMoved = placementMovedBy(request, response);
     if (placementMoved !== void 0) this.#onPlacementMoved(placementMoved);
+    if (response.outcome.case === "failure") {
+      return readIndexPendingAnswer(request, response.outcome.value.message) ?? response;
+    }
     return response;
   }
   /** [#call] with the opt-in timeline trace: encode, kernel and decode timed separately. */
@@ -22674,6 +22752,7 @@ var ReadMaintenanceDesk = class {
       for (const [key, value] of entries.filter(([key2]) => key2 !== workspace)) this.#pending.set(key, value);
     }
     this.#revision += 1;
+    if (read && (!existing?.read || isReadDemand)) this.#observer.readinessMayChange?.(workspace);
     if (!existing || existing.read?.cause !== read?.cause || existing.background?.cause !== background?.cause) {
       this.#trace.emit(session ?? existing?.session, {
         case: "maintenanceProgress",
@@ -22690,32 +22769,65 @@ var ReadMaintenanceDesk = class {
    * (a waiting read's own turn advances read readiness only).
    */
   tick(request, sessionlessNotBeforeNanoseconds = 0n, backgroundNotBeforeNanoseconds = 0n, durability = true) {
+    const turn = this.#turn(
+      request,
+      sessionlessNotBeforeNanoseconds,
+      { case: "until", atNanoseconds: backgroundNotBeforeNanoseconds },
+      durability
+    );
+    return turn.case === "ran" ? turn.ticked : create(MaintenanceTickedSchema, {
+      pending: turn.pending,
+      nextTickAfterMillis: turn.nextDelayMillis ?? 0
+    });
+  }
+  /**
+   * A waiting read's turn: advance read readiness only. It never runs a background command, closure
+   * warm, pack import or durability flush on the foreground's turn, and never reports a wake for
+   * that background work: with only background work owed its wake is `none`.
+   */
+  tickReadReadiness() {
+    const turn = this.#turn(void 0, 0n, { case: "readReadinessOnly" }, false);
+    if (turn.case === "ran") {
+      return { ticked: turn.ticked, wake: { case: "after", millis: turn.ticked.nextTickAfterMillis } };
+    }
+    return {
+      ticked: create(MaintenanceTickedSchema, { pending: turn.pending, nextTickAfterMillis: turn.nextDelayMillis ?? 0 }),
+      wake: turn.nextDelayMillis === void 0 ? { case: "none" } : { case: "after", millis: turn.nextDelayMillis }
+    };
+  }
+  #turn(request, sessionlessNotBeforeNanoseconds, backgroundHold, durability) {
     const now2 = this.#clock.monotonicNanoseconds();
+    const backgroundNotBeforeNanoseconds = backgroundHold.case === "until" ? backgroundHold.atNanoseconds : void 0;
     const custodySlice = (workspace2) => this.#custodyBurstSlice(now2, workspace2);
     const due2 = (demand2) => {
       const held = demand2.session || demand2.awaited || demand2.retryNotBeforeNanoseconds > sessionlessNotBeforeNanoseconds ? demand2.retryNotBeforeNanoseconds : sessionlessNotBeforeNanoseconds;
-      const ordinary = demand2.read || demand2.awaited || held > backgroundNotBeforeNanoseconds ? held : backgroundNotBeforeNanoseconds;
+      if (!demand2.read && !demand2.awaited && backgroundNotBeforeNanoseconds === void 0) return void 0;
+      const ordinary = demand2.read || demand2.awaited || backgroundNotBeforeNanoseconds === void 0 || held > backgroundNotBeforeNanoseconds ? held : backgroundNotBeforeNanoseconds;
       const hold = demand2.read || demand2.awaited || !demand2.background?.maintainGitCustody ? void 0 : custodySlice(demand2.workspace);
       if (!hold) return ordinary;
       if (hold.slice && durability) return held > hold.at ? held : hold.at;
       return ordinary > hold.at ? ordinary : hold.at;
     };
-    const entry = [...this.#pending.entries()].find(([, demand2]) => due2(demand2) <= now2);
+    const entry = [...this.#pending.entries()].find(([, demand2]) => {
+      const at = due2(demand2);
+      return at !== void 0 && at <= now2;
+    });
     const flush = this.#flush;
     if (durability && flush && this.#flushDueAt(flush) <= now2 && !entry?.[1].read && (flush.local || !entry || flush.owedSinceNanoseconds + DURABILITY_FLUSH_MAX_DELAY_NANOSECONDS <= now2)) {
-      return this.#tickFlush(flush, request);
+      return { case: "ran", ticked: this.#tickFlush(flush, request) };
     }
     const pinDue = (pin) => {
+      if (backgroundNotBeforeNanoseconds === void 0) return void 0;
       const held = pin.session ? 0n : sessionlessNotBeforeNanoseconds;
       return [pin.notBeforeNanoseconds, held, backgroundNotBeforeNanoseconds].reduce((latest, at) => at > latest ? at : latest, 0n);
     };
     if (!entry) {
-      const pin = [...this.#pins.entries()].find(([, idle]) => pinDue(idle) <= now2);
-      if (pin) return this.#tickPin(pin[0], pin[1], request);
-      return create(MaintenanceTickedSchema, {
-        pending: this.hasPending(),
-        nextTickAfterMillis: this.#nextDelay(now2, due2, pinDue)
+      const pin = [...this.#pins.entries()].find(([, idle]) => {
+        const at = pinDue(idle);
+        return at !== void 0 && at <= now2;
       });
+      if (pin) return { case: "ran", ticked: this.#tickPin(pin[0], pin[1], request) };
+      return { case: "idle", pending: this.hasPending(), nextDelayMillis: this.#nextDelay(now2, due2, pinDue, durability) };
     }
     const [workspace, demand] = entry;
     const mount = demand.session ? this.#sessions.mountForSession(demand.session) : this.#sessions.mountForWorkspace(workspace);
@@ -22764,7 +22876,7 @@ var ReadMaintenanceDesk = class {
           read: read !== void 0,
           awaited: demand.awaited === true,
           session: demand.session !== void 0,
-          backgroundHoldMs: Number((backgroundNotBeforeNanoseconds - now2) / 1000000n),
+          backgroundHoldMs: backgroundNotBeforeNanoseconds === void 0 ? "read-readiness-only" : Number((backgroundNotBeforeNanoseconds - now2) / 1000000n),
           sessionlessHoldMs: Number((sessionlessNotBeforeNanoseconds - now2) / 1000000n),
           caller: (new Error().stack ?? "").split("\n").slice(2, 6).map((frame2) => frame2.trim()).join(" < ")
         })}`);
@@ -22813,12 +22925,13 @@ var ReadMaintenanceDesk = class {
           this.#observer.frontierAdvanced?.(workspace);
         }
       }
-      return create(MaintenanceTickedSchema, {
+      this.#observer.readinessMayChange?.(workspace);
+      return { case: "ran", ticked: create(MaintenanceTickedSchema, {
         pending: this.#pending.size > 0,
         progress: observed,
         // With no debt left, an armed idle pin names when the host should wake next.
-        nextTickAfterMillis: progress.maintenancePending ? 20 : this.#pending.size === 0 && this.hasIdleWork() ? this.#nextDelay(this.#clock.monotonicNanoseconds()) : 0
-      });
+        nextTickAfterMillis: progress.maintenancePending ? 20 : this.#pending.size === 0 && this.hasIdleWork() ? this.#nextDelay(this.#clock.monotonicNanoseconds()) ?? 0 : 0
+      }) };
     } catch (error) {
       const format = localCopyFormatRefusal(error);
       if (format !== void 0) {
@@ -22834,10 +22947,10 @@ var ReadMaintenanceDesk = class {
             stopped: true
           })
         });
-        return create(MaintenanceTickedSchema, {
+        return { case: "ran", ticked: create(MaintenanceTickedSchema, {
           pending: this.#pending.size > 0,
-          nextTickAfterMillis: this.#nextDelay(this.#clock.monotonicNanoseconds())
-        });
+          nextTickAfterMillis: this.#nextDelay(this.#clock.monotonicNanoseconds()) ?? 0
+        }) };
       }
       const failures = demand.failures + 1;
       this.#pending.delete(workspace);
@@ -22865,12 +22978,12 @@ var ReadMaintenanceDesk = class {
           retryAfterMillis: retryMillis
         })
       });
-      return create(MaintenanceTickedSchema, {
+      return { case: "ran", ticked: create(MaintenanceTickedSchema, {
         pending: true,
         // Backoff belongs to the failed workspace. Another workspace's ready
         // index or changed watches must not wait for this retry deadline.
-        nextTickAfterMillis: this.#nextDelay(this.#clock.monotonicNanoseconds())
-      });
+        nextTickAfterMillis: this.#nextDelay(this.#clock.monotonicNanoseconds()) ?? 0
+      }) };
     }
   }
   /** Owe the kernel its ordered flush. The first write it covers fixes `owedSince`; the shared
@@ -22935,7 +23048,7 @@ var ReadMaintenanceDesk = class {
       }
       return create(MaintenanceTickedSchema, {
         pending: this.hasPending(),
-        nextTickAfterMillis: progress.maintenancePending ? 20 : this.#nextDelay(this.#clock.monotonicNanoseconds())
+        nextTickAfterMillis: progress.maintenancePending ? 20 : this.#nextDelay(this.#clock.monotonicNanoseconds()) ?? 0
       });
     } catch (error) {
       const failures = flush.failures + 1;
@@ -22959,7 +23072,7 @@ var ReadMaintenanceDesk = class {
       };
       return create(MaintenanceTickedSchema, {
         pending: this.hasPending(),
-        nextTickAfterMillis: this.#nextDelay(this.#clock.monotonicNanoseconds())
+        nextTickAfterMillis: this.#nextDelay(this.#clock.monotonicNanoseconds()) ?? 0
       });
     }
   }
@@ -22990,7 +23103,7 @@ var ReadMaintenanceDesk = class {
       }
       return create(MaintenanceTickedSchema, {
         pending: this.hasPending(),
-        nextTickAfterMillis: progress.maintenancePending ? 20 : this.#nextDelay(this.#clock.monotonicNanoseconds())
+        nextTickAfterMillis: progress.maintenancePending ? 20 : this.#nextDelay(this.#clock.monotonicNanoseconds()) ?? 0
       });
     } catch (error) {
       slowQuantumObserver?.(`[nomos-kernel-perf] ${JSON.stringify({
@@ -23002,28 +23115,31 @@ var ReadMaintenanceDesk = class {
       })}`);
       return create(MaintenanceTickedSchema, {
         pending: this.hasPending(),
-        nextTickAfterMillis: this.#nextDelay(this.#clock.monotonicNanoseconds())
+        nextTickAfterMillis: this.#nextDelay(this.#clock.monotonicNanoseconds()) ?? 0
       });
     }
   }
-  #nextDelay(now2, due2 = (demand) => demand.retryNotBeforeNanoseconds, pinDue = (pin) => pin.notBeforeNanoseconds) {
+  /** Milliseconds until the earliest owed work this turn serves; `undefined` when none is owed. */
+  #nextDelay(now2, due2 = (demand) => demand.retryNotBeforeNanoseconds, pinDue = (pin) => pin.notBeforeNanoseconds, flushes = true) {
     let earliest;
     for (const demand of this.#pending.values()) {
       const at = due2(demand);
+      if (at === void 0) continue;
       if (at <= now2) return 0;
       if (earliest === void 0 || at < earliest) earliest = at;
     }
     for (const pin of this.#pins.values()) {
       const at = pinDue(pin);
+      if (at === void 0) continue;
       if (at <= now2) return 0;
       if (earliest === void 0 || at < earliest) earliest = at;
     }
-    if (this.#flush) {
+    if (flushes && this.#flush) {
       const at = this.#flushDueAt(this.#flush);
       if (at <= now2) return 0;
       if (earliest === void 0 || at < earliest) earliest = at;
     }
-    return earliest === void 0 ? 0 : Number((earliest - now2 + 999999n) / 1000000n);
+    return earliest === void 0 ? void 0 : Number((earliest - now2 + 999999n) / 1000000n);
   }
   /** Drop any demand for a workspace no maintenance can serve (an unreadable copy). */
   forget(workspace) {
@@ -23064,15 +23180,19 @@ var ReadMaintenanceDesk = class {
 
 // ../src/runtime/read_response_desk.ts
 init_define_NOMOS_KERNEL_RELEASE();
+var READ_RETENTION_MILLIS = 12e4;
+var READ_RESUME_MAX_MILLIS = 1e3;
 var ReadResponseDesk = class {
   #waiting = /* @__PURE__ */ new Map();
   #clock;
   #tick;
+  #owe;
   #read;
   #sequence = 0;
-  constructor(clock2, tick, read) {
+  constructor(clock2, tick, owe, read) {
     this.#clock = clock2;
     this.#tick = tick;
+    this.#owe = owe;
     this.#read = read;
   }
   #now() {
@@ -23085,18 +23205,27 @@ var ReadResponseDesk = class {
     const now2 = this.#now();
     for (const [id, work] of this.#waiting) if (work.deadline <= now2) this.#waiting.delete(id);
     const workId2 = `local-read-${++this.#sequence}`;
-    this.#waiting.set(workId2, { request, dependency, deadline: now2 + 12e4, notBefore: now2 });
+    this.#waiting.set(workId2, {
+      request,
+      dependency,
+      deadline: now2 + READ_RETENTION_MILLIS,
+      notBefore: now2,
+      idle: false,
+      // The office owed this frontier's debt when the kernel first answered pending.
+      owedFor: dependency.requestedFrontier,
+      waiters: /* @__PURE__ */ new Set()
+    });
     return create(LocalReadPendingSchema, { workId: workId2 });
   }
   resume(workId2, requestId) {
     const work = this.#waiting.get(workId2);
     if (!work || work.request.requestId !== requestId) throw new Error(`unknown local read continuation '${workId2}'`);
     const now2 = this.#now();
+    work.waiters.clear();
     if (now2 >= work.deadline) {
       this.#waiting.delete(workId2);
       throw new Error(`Local read index for '${work.dependency.workspace}' did not catch up to ${work.dependency.requestedFrontier} within its retained maintenance window`);
     }
-    if (now2 < work.notBefore) return this.#pending(workId2, work, now2);
     try {
       const response = this.#read(work.request);
       if (response.outcome.case !== "query" || response.outcome.value.result.case !== "readIndexPending") {
@@ -23104,24 +23233,65 @@ var ReadResponseDesk = class {
         return { case: "ready", request: work.request, response };
       }
       work.dependency = response.outcome.value.result.value;
-      const tick = this.#tick();
+      if (now2 < work.notBefore) return this.#pending(workId2, work, now2);
+      let { ticked, wake } = this.#tick();
+      if (wake.case === "none" && ticked.progress === void 0 && work.owedFor !== work.dependency.requestedFrontier) {
+        work.owedFor = work.dependency.requestedFrontier;
+        this.#owe(work.request);
+        ({ ticked, wake } = this.#tick());
+      }
       const afterTick = this.#now();
-      work.notBefore = afterTick + tick.nextTickAfterMillis;
-      work.deadline = afterTick + Math.max(12e4, tick.nextTickAfterMillis + 6e4);
+      work.idle = wake.case === "none";
+      const backoff = wake.case === "after" ? wake.millis : 0;
+      work.notBefore = afterTick + backoff;
+      work.deadline = afterTick + Math.max(READ_RETENTION_MILLIS, backoff + 6e4);
       return this.#pending(workId2, work, afterTick);
     } catch (error) {
       this.#waiting.delete(workId2);
       throw error;
     }
   }
+  /**
+   * Wait in process for a held read to become worth continuing. `notify` is called once, when read
+   * readiness for its workspace changes (a slice or binding finished, a frontier advanced, readiness
+   * newly owed). `afterMillis` is the only timer the shell needs: the read's own scheduled quantum
+   * when it has one, otherwise its deadline. Undefined for an unknown or finished read.
+   */
+  onResumable(workId2, notify) {
+    const work = this.#waiting.get(workId2);
+    if (!work) return void 0;
+    const now2 = this.#now();
+    const due2 = work.idle ? work.deadline : Math.min(work.notBefore, work.deadline);
+    work.waiters.add(notify);
+    return { afterMillis: Math.max(0, due2 - now2), cancel: () => {
+      work.waiters.delete(notify);
+    } };
+  }
+  /** Read readiness for `workspace` changed: every read waiting on it may continue now. */
+  readinessChanged(workspace) {
+    const now2 = this.#now();
+    for (const work of this.#waiting.values()) {
+      if (work.dependency.workspace !== workspace) continue;
+      work.idle = false;
+      if (work.notBefore > now2) work.notBefore = now2;
+      const waiters = [...work.waiters];
+      work.waiters.clear();
+      for (const notify of waiters) notify();
+    }
+  }
+  /** The protocol wake is a bounded re-poll inside the read's retention deadline, never the raw backoff. */
   #pending(workId2, work, now2) {
+    const due2 = work.idle ? READ_RESUME_MAX_MILLIS : work.notBefore - now2;
+    const resumeAfterMillis = Math.max(0, Math.min(due2, work.deadline - now2, READ_RESUME_MAX_MILLIS));
     return { case: "pending", value: create(LocalReadPendingSchema, {
       workId: workId2,
-      resumeAfterMillis: Math.max(0, work.notBefore - now2)
+      resumeAfterMillis: Number.isFinite(resumeAfterMillis) ? Math.ceil(resumeAfterMillis) : READ_RESUME_MAX_MILLIS
     }) };
   }
   clear() {
+    const waiters = [...this.#waiting.values()].flatMap((work) => [...work.waiters]);
     this.#waiting.clear();
+    for (const notify of waiters) notify();
   }
 };
 
@@ -24027,13 +24197,15 @@ var ReplicaFollowEventKind = Object.freeze({
   DependencyAdvanced: "dependency_advanced",
   RebornRemotely: "reborn_remotely",
   LocalCopyDropAuthorized: "local_copy_drop_authorized",
-  LocalCopyUnreadable: "local_copy_unreadable"
+  LocalCopyUnreadable: "local_copy_unreadable",
+  RuntimeStarted: "runtime_started"
 });
 var ReplicaFollowEffectKind = Object.freeze({
   ScheduleWake: "schedule_wake",
   RunSync: "run_sync",
   RefreshCredential: "refresh_credential"
 });
+var KERNEL_REFUSAL_EVENT_FLOOR_MILLIS = 1e4;
 var boundedRetry = (policy, attempt) => Math.min(policy.fallbackMillis, Math.max(250, policy.debounceMillis) * 2 ** Math.min(attempt - 1, 20));
 var attempts = (state) => {
   switch (state.case) {
@@ -24060,13 +24232,14 @@ var due = (atUnixMillis) => ({
   state: { case: ReplicaFollowPhase.Due, dueAtUnixMillis: atUnixMillis },
   effects: [{ case: ReplicaFollowEffectKind.ScheduleWake, atUnixMillis }]
 });
-var run = (attempt, replaceLocalHead, warmingSinceUnixMillis) => ({
+var run = (attempt, replaceLocalHead, warmingSinceUnixMillis, refused) => ({
   state: {
     case: ReplicaFollowPhase.Running,
     attempt,
     observed: false,
     ...replaceLocalHead === void 0 ? {} : { replaceLocalHead },
-    ...warmingSinceUnixMillis === void 0 ? {} : { warmingSinceUnixMillis }
+    ...warmingSinceUnixMillis === void 0 ? {} : { warmingSinceUnixMillis },
+    ...refused === void 0 ? {} : { refused }
   },
   effects: [{ case: ReplicaFollowEffectKind.RunSync }]
 });
@@ -24075,6 +24248,16 @@ var replacing = (expectedLocalHead, attempt, atUnixMillis) => ({
   effects: [{ case: ReplicaFollowEffectKind.ScheduleWake, atUnixMillis }]
 });
 var quiet = (state) => ({ state, effects: [] });
+var blockedRefusal = (state) => state.case === ReplicaFollowPhase.Backoff && state.refusal?.blocked ? state.refusal : void 0;
+var refusedEvent = (state, refusal2, nowUnixMillis) => {
+  const earliest = Math.max(nowUnixMillis, refusal2.atUnixMillis + KERNEL_REFUSAL_EVENT_FLOOR_MILLIS);
+  const rerunAtUnixMillis = refusal2.rerunAtUnixMillis === void 0 ? earliest : Math.min(refusal2.rerunAtUnixMillis, earliest);
+  return {
+    state: { ...state, refusal: { ...refusal2, rerunAtUnixMillis } },
+    effects: [{ case: ReplicaFollowEffectKind.ScheduleWake, atUnixMillis: rerunAtUnixMillis }]
+  };
+};
+var refusedByKernel = (state) => state.case === ReplicaFollowPhase.Backoff && (state.refusal !== void 0 || deterministicKernelRefusal(state.failure) !== void 0);
 function reduceReplicaFollow(state, event, policy) {
   switch (event.case) {
     case ReplicaFollowEventKind.Activate:
@@ -24087,6 +24270,9 @@ function reduceReplicaFollow(state, event, policy) {
       if (state.case === ReplicaFollowPhase.Running) {
         return { state: { ...state, observed: true }, effects: [] };
       }
+      if (state.case === ReplicaFollowPhase.Backoff && state.refusal?.blocked) {
+        return refusedEvent(state, state.refusal, event.nowUnixMillis);
+      }
       if (state.case === ReplicaFollowPhase.RebornRemotely || state.case === ReplicaFollowPhase.LocalCopyUnreadable) return quiet(state);
       if (state.case === ReplicaFollowPhase.InvalidCredential) {
         return {
@@ -24096,6 +24282,9 @@ function reduceReplicaFollow(state, event, policy) {
       }
       return due(event.nowUnixMillis);
     case ReplicaFollowEventKind.Reconnected:
+      if (state.case === ReplicaFollowPhase.Backoff && state.refusal?.blocked) {
+        return refusedEvent(state, state.refusal, event.nowUnixMillis);
+      }
       switch (state.case) {
         case ReplicaFollowPhase.Running:
           return { state: { ...state, observed: true }, effects: [] };
@@ -24141,15 +24330,25 @@ function reduceReplicaFollow(state, event, policy) {
           }
           return run(state.attempt + 1, state.expectedLocalHead);
         case ReplicaFollowPhase.Offline:
-        case ReplicaFollowPhase.Backoff:
+        case ReplicaFollowPhase.Backoff: {
+          const blocked = blockedRefusal(state);
+          if (blocked) {
+            if (blocked.rerunAtUnixMillis === void 0) return quiet(state);
+            if (event.nowUnixMillis < blocked.rerunAtUnixMillis) {
+              return { state, effects: [{ case: ReplicaFollowEffectKind.ScheduleWake, atUnixMillis: blocked.rerunAtUnixMillis }] };
+            }
+            return run(state.attempt + 1, void 0, void 0, state.failure);
+          }
           if (event.nowUnixMillis < state.retryAtUnixMillis) {
             return { state, effects: [{ case: ReplicaFollowEffectKind.ScheduleWake, atUnixMillis: state.retryAtUnixMillis }] };
           }
           return run(
             state.attempt + 1,
             void 0,
-            state.case === ReplicaFollowPhase.Backoff ? state.warming?.sinceUnixMillis : void 0
+            state.case === ReplicaFollowPhase.Backoff ? state.warming?.sinceUnixMillis : void 0,
+            state.case === ReplicaFollowPhase.Backoff && state.refusal ? state.failure : void 0
           );
+        }
         case ReplicaFollowPhase.InvalidCredential:
           if (!state.refreshDue && event.nowUnixMillis < state.retryAtUnixMillis) {
             return { state, effects: [{ case: ReplicaFollowEffectKind.ScheduleWake, atUnixMillis: state.retryAtUnixMillis }] };
@@ -24226,6 +24425,31 @@ function reduceReplicaFollow(state, event, policy) {
       };
     }
     case ReplicaFollowEventKind.Failed: {
+      if (event.refusal && !(state.case === ReplicaFollowPhase.Running && state.replaceLocalHead !== void 0)) {
+        const attempt2 = Math.max(1, attempts(state));
+        const blocked = state.case === ReplicaFollowPhase.Running && state.refused === event.failure || state.case === ReplicaFollowPhase.Backoff && state.refusal !== void 0 && state.failure === event.failure;
+        const refusal2 = {
+          code: event.refusal.code,
+          blocked,
+          runtime: event.refusal.runtime,
+          atUnixMillis: event.nowUnixMillis
+        };
+        if (!blocked) {
+          const retryAtUnixMillis2 = event.nowUnixMillis + boundedRetry(policy, attempt2);
+          return {
+            state: { case: ReplicaFollowPhase.Backoff, attempt: attempt2, retryAtUnixMillis: retryAtUnixMillis2, failure: event.failure, refusal: refusal2 },
+            effects: [{ case: ReplicaFollowEffectKind.ScheduleWake, atUnixMillis: retryAtUnixMillis2 }]
+          };
+        }
+        const waiting = {
+          case: ReplicaFollowPhase.Backoff,
+          attempt: attempt2,
+          retryAtUnixMillis: event.nowUnixMillis,
+          failure: event.failure,
+          refusal: refusal2
+        };
+        return state.case === ReplicaFollowPhase.Running && state.observed ? refusedEvent(waiting, refusal2, event.nowUnixMillis) : quiet(waiting);
+      }
       if (state.case === ReplicaFollowPhase.Running && state.observed) {
         return due(event.nowUnixMillis);
       }
@@ -24263,6 +24487,11 @@ function reduceReplicaFollow(state, event, policy) {
       return quiet({ case: ReplicaFollowPhase.RebornRemotely, rebirth: event.rebirth });
     case ReplicaFollowEventKind.LocalCopyUnreadable:
       return quiet({ case: ReplicaFollowPhase.LocalCopyUnreadable, format: event.format });
+    case ReplicaFollowEventKind.RuntimeStarted:
+      if (state.case === ReplicaFollowPhase.Backoff && refusedByKernel(state) && state.refusal?.runtime !== event.runtime) {
+        return due(event.nowUnixMillis);
+      }
+      return quiet(state);
     case ReplicaFollowEventKind.LocalCopyDropAuthorized:
       if (state.case === ReplicaFollowPhase.Running) return invalid(state, event);
       return replacing(event.expectedLocalHead, 0, event.nowUnixMillis);
@@ -24309,11 +24538,15 @@ var ReplicaFollowController = class {
   #replicaId;
   /** Local children whose births custody refused (CAP-804): quarantined, never followed. */
   #birthRefusals;
-  constructor(desk, clock2, replicaId2, birthRefusals) {
+  /** The kernel/runtime identity this process runs: a refusal is recorded under it, and a refusal
+   * drawn under another identity is retried once when this process starts. */
+  #runtime;
+  constructor(desk, clock2, replicaId2, birthRefusals, runtime = "unidentified") {
     this.#desk = desk;
     this.#clock = clock2;
     this.#replicaId = replicaId2;
     this.#birthRefusals = birthRefusals ?? new BirthRefusalRegister(new MemoryPeerDeskStore());
+    this.#runtime = runtime;
   }
   /** The durable quarantine of a local child whose birth custody refused; undefined otherwise. */
   birthRefusal(workspace) {
@@ -24412,6 +24645,13 @@ var ReplicaFollowController = class {
   recover() {
     const now2 = this.#now();
     if (!this.#recovered) {
+      for (const follow of this.#desk.all()) {
+        this.#desk.transition(follow.spec.workspace, {
+          case: ReplicaFollowEventKind.RuntimeStarted,
+          nowUnixMillis: now2,
+          runtime: this.#runtime
+        });
+      }
       for (const follow of this.#desk.all()) {
         if (follow.state.case === ReplicaFollowPhase.Settled || follow.state.case === ReplicaFollowPhase.AwaitingDependency) {
           this.#placementRecheck.add(follow.spec.workspace);
@@ -24500,11 +24740,12 @@ var ReplicaFollowController = class {
   placementAnnounced(workspace) {
     if (!this.followForWorkspace(workspace)) return void 0;
     this.#placementRecheck.add(workspace);
-    return this.reconnected(workspace);
+    return this.reconnected(workspace, true);
   }
-  /** The upstream live link opened or reopened: reconcile once for missed pushes. */
-  reconnected(workspace) {
-    return this.#event(workspace, ReplicaFollowEventKind.Reconnected);
+  /** The upstream live link opened or reopened: reconcile once for missed pushes. With
+   * `remoteAdvanced`, the upstream announced a new frontier. Either re-runs a blocked refusal. */
+  reconnected(workspace, remoteAdvanced = false) {
+    return this.#event(workspace, ReplicaFollowEventKind.Reconnected, remoteAdvanced);
   }
   /** Another workspace advanced or settled; every held dependency gets one retry. */
   dependencyAdvanced(except) {
@@ -24517,11 +24758,11 @@ var ReplicaFollowController = class {
     }
     return woken;
   }
-  #event(workspace, kind) {
+  #event(workspace, kind, remoteAdvanced = false) {
     const follow = this.#recovered ? this.#desk.get(workspace) : void 0;
     if (!follow) return void 0;
     const nowUnixMillis = this.#now();
-    this.#desk.transition(workspace, { case: kind, nowUnixMillis });
+    this.#desk.transition(workspace, kind === ReplicaFollowEventKind.Reconnected && remoteAdvanced ? { case: kind, nowUnixMillis, remoteAdvanced } : { case: kind, nowUnixMillis });
     const nextDueAt = dueAt(this.#desk.get(workspace));
     return nextDueAt === void 0 ? void 0 : Math.max(0, nextDueAt - nowUnixMillis);
   }
@@ -24668,7 +24909,9 @@ var ReplicaFollowController = class {
    * still opening the workspace and named when to ask again. */
   failed(workspace, error, custodianRetryAfterMillis) {
     if (!this.#recovered) this.recover();
-    custodianRetryAfterMillis ??= warmingFromFailureMessage(error instanceof Error ? error.message : String(error));
+    const refusal2 = deterministicKernelRefusal(error);
+    if (refusal2 !== void 0) custodianRetryAfterMillis = void 0;
+    else custodianRetryAfterMillis ??= warmingFromFailureMessage(error instanceof Error ? error.message : String(error));
     if (!this.#desk.get(workspace)) return;
     const format = localCopyFormatRefusal(error);
     if (format !== void 0) {
@@ -24683,9 +24926,15 @@ var ReplicaFollowController = class {
       case: ReplicaFollowEventKind.Failed,
       nowUnixMillis: this.#now(),
       failure: error instanceof Error ? error.message : String(error),
-      ...custodianRetryAfterMillis === void 0 ? {} : { custodianRetryAfterMillis }
+      ...custodianRetryAfterMillis === void 0 ? {} : { custodianRetryAfterMillis },
+      ...refusal2 === void 0 ? {} : { refusal: { code: refusal2.code, runtime: this.#runtime } }
     });
   }
+  /** The kernel refusal behind this follow's backoff (`blocked` once the kernel repeated it). */
+  refusal(workspace) {
+    const state = this.followForWorkspace(workspace)?.state;
+    return state?.case === ReplicaFollowPhase.Backoff ? state.refusal : void 0;
+  }
   /** Closing an interaction realm must not erase a peer-owned follow. */
   closeInteractionRealm() {
   }
@@ -24718,9 +24967,12 @@ function dueAt(follow) {
     case ReplicaFollowPhase.RebornRemotely:
     case ReplicaFollowPhase.LocalCopyUnreadable:
       return void 0;
+    case ReplicaFollowPhase.Backoff: {
+      const blocked = blockedRefusal(follow.state);
+      return blocked ? blocked.rerunAtUnixMillis : follow.state.retryAtUnixMillis;
+    }
     case ReplicaFollowPhase.Offline:
     case ReplicaFollowPhase.InvalidCredential:
-    case ReplicaFollowPhase.Backoff:
       return follow.state.retryAtUnixMillis;
     default: {
       const exhaustive = follow.state;
@@ -24736,6 +24988,10 @@ function delayUntilDue(follow, nowUnixMillis) {
   return nextDueAt === void 0 ? void 0 : Math.max(0, nextDueAt - nowUnixMillis);
 }
 
+// ../src/runtime/runtime_identity.ts
+init_define_NOMOS_KERNEL_RELEASE();
+var PEER_RUNTIME_IDENTITY = "0.116.4" ? `@githolon/runtime@${"0.116.4"}` : "@githolon/runtime@unbundled";
+
 // ../src/runtime/replica_follow_desk.ts
 init_define_NOMOS_KERNEL_RELEASE();
 var REPLICA_FOLLOW_NAMESPACE = "nomos.peer-desk.replica-follow/v2";
@@ -24764,6 +25020,16 @@ var decodeWarming = (value) => {
     ...Number.isFinite(warming.hintMillis) ? { hintMillis: warming.hintMillis } : {}
   } } : {};
 };
+var decodeRefusal = (value) => {
+  const refusal2 = value;
+  return refusal2 && typeof refusal2.code === "string" && typeof refusal2.runtime === "string" && Number.isFinite(refusal2.atUnixMillis) ? { refusal: {
+    code: refusal2.code,
+    blocked: refusal2.blocked === true,
+    runtime: refusal2.runtime,
+    atUnixMillis: refusal2.atUnixMillis,
+    ...Number.isFinite(refusal2.rerunAtUnixMillis) ? { rerunAtUnixMillis: refusal2.rerunAtUnixMillis } : {}
+  } } : {};
+};
 var decodeState = (record, value) => {
   if (!value || typeof value !== "object") throw corrupt(record, "state is not an object");
   const state = value;
@@ -24778,7 +25044,8 @@ var decodeState = (record, value) => {
         attempt: state.attempt,
         observed: state.observed === true,
         ...state.replaceLocalHead === void 0 ? {} : { replaceLocalHead: state.replaceLocalHead },
-        ...Number.isFinite(state.warmingSinceUnixMillis) ? { warmingSinceUnixMillis: state.warmingSinceUnixMillis } : {}
+        ...Number.isFinite(state.warmingSinceUnixMillis) ? { warmingSinceUnixMillis: state.warmingSinceUnixMillis } : {},
+        ...typeof state.refused === "string" ? { refused: state.refused } : {}
       };
     case ReplicaFollowPhase.Settled:
       return {
@@ -24810,7 +25077,8 @@ var decodeState = (record, value) => {
         attempt: state.attempt,
         retryAtUnixMillis: state.retryAtUnixMillis,
         failure: state.failure,
-        ...decodeWarming(state.warming)
+        ...decodeWarming(state.warming),
+        ...decodeRefusal(state.refusal)
       };
     case ReplicaFollowPhase.RebornRemotely: {
       const rebirth = state.rebirth ?? {};
@@ -25000,9 +25268,15 @@ var ReplicaFollowDesk = class {
           break;
         }
         case ReplicaFollowPhase.Offline:
-        case ReplicaFollowPhase.Backoff:
-          wakes.push({ workspace: follow.spec.workspace, atUnixMillis: follow.state.retryAtUnixMillis });
+        case ReplicaFollowPhase.Backoff: {
+          const blocked = blockedRefusal(follow.state);
+          if (blocked && blocked.rerunAtUnixMillis === void 0) break;
+          wakes.push({
+            workspace: follow.spec.workspace,
+            atUnixMillis: blocked?.rerunAtUnixMillis ?? follow.state.retryAtUnixMillis
+          });
           break;
+        }
         case ReplicaFollowPhase.InvalidCredential:
           wakes.push({
             workspace: follow.spec.workspace,
@@ -25640,6 +25914,8 @@ var refusal = (requestId, code, message, retryAfterMillis) => frame({ case: "ref
   message,
   ...retryAfterMillis === void 0 ? {} : { retryAfterMillis }
 }) });
+var OFF_MAIN_AFTER_MILLIS = 6e4;
+var MAX_UNFOUND_HEADS = 1024;
 var LiveStreamServer = class {
   #kernel;
   #now;
@@ -25653,6 +25929,10 @@ var LiveStreamServer = class {
   /** By workspace: the history slices copies are fetching (a few, newest last). */
   #slices = /* @__PURE__ */ new Map();
   #cachedBytes = 0;
+  /** By workspace and asked head: when this peer first answered "acquiring its own history" to a level
+   * ask from a head it could not find. A shallow custody can never prove the head is off its main (its
+   * walk is never `complete`), so after OFF_MAIN_AFTER_MILLIS of the same answer it says so anyway. */
+  #unfound = /* @__PURE__ */ new Map();
   constructor(kernel, now2 = Date.now, historyWanted = () => {
   }, sealed = () => void 0) {
     this.#kernel = kernel;
@@ -25700,9 +25980,12 @@ var LiveStreamServer = class {
     if (!head) return [...answer, ...this.#checkpoint(workspace, requestId, create(LiveCheckpointRequestSchema))];
     if (head === main) return answer;
     let behind;
+    let offMain = false;
     try {
       const summary = this.#kernel.historySummary(mount, requestId, head, main);
       behind = summary.reachedBase ? summary.commitCount : void 0;
+      offMain = !summary.reachedBase && (summary.complete || !this.#shallow(mount, requestId));
+      if (summary.reachedBase) this.#unfound.delete(`${workspace}\0${head}`);
     } catch {
       behind = void 0;
     }
@@ -25711,6 +25994,22 @@ var LiveStreamServer = class {
       if (remountAfter > 0) {
         return [...answer, ...this.#checkpoint(workspace, requestId, create(LiveCheckpointRequestSchema), behind ?? 0n)];
       }
+      const key = `${workspace}\0${head}`;
+      const firstUnfound = this.#unfound.get(key);
+      if (!offMain && firstUnfound === void 0) {
+        if (this.#unfound.size >= MAX_UNFOUND_HEADS) this.#unfound.delete(this.#unfound.keys().next().value);
+        this.#unfound.set(key, this.#now());
+      } else if (!offMain && this.#now() - firstUnfound >= OFF_MAIN_AFTER_MILLIS) {
+        offMain = true;
+      }
+      if (offMain) {
+        this.#unfound.delete(key);
+        return [...answer, refusal(
+          "",
+          "nomos.stream.off_main",
+          "the copy's head is not on this peer's main; it must converge its own work, not level from it"
+        )];
+      }
       this.#historyWanted(workspace);
       return [...answer, refusal(
         "",
@@ -25722,6 +26021,17 @@ var LiveStreamServer = class {
     const maxOffers = Math.min(Math.max(1, frontier.maxOffers || MAX_STREAM_BATCH_OFFERS), MAX_STREAM_BATCH_OFFERS);
     return [...answer, this.#batch(workspace, requestId, head, main, maxOffers)];
   }
+  /** Whether this peer's custody of the workspace is shallow. Unknown counts as shallow: it keeps the
+   * existing wait for history rather than calling a head off main. */
+  #shallow(mount, requestId) {
+    const boundaries = this.#kernel.shallowBoundaries;
+    if (!boundaries) return true;
+    try {
+      return boundaries.call(this.#kernel, mount, requestId).length > 0;
+    } catch {
+      return true;
+    }
+  }
   /**
    * The `maxOffers` offers directly above `base`, as the commits this peer admitted them in: one
    * bounded walk and one bounded pack (O(batch)). The copy's kernel adopts exactly these commits on
@@ -26089,7 +26399,6 @@ var OwnOffers = class {
 };
 var LiveCorrespondenceDesk = class {
   #links = /* @__PURE__ */ new Map();
-  #pending = /* @__PURE__ */ new Map();
   /** What procedures asked of each workspace's stream, and what it delivered (peer_catchup.md). */
   inbound;
   #own = new OwnOffers();
@@ -26125,13 +26434,6 @@ var LiveCorrespondenceDesk = class {
    * never held. Absent (a custodian, a relay, a test), every write goes out on the next drive.
    */
   writeBurst;
-  /**
-   * An application peer's receive step (CAP-757; sized by time, CAP-762). A received batch of other
-   * senders' offers larger than one step is not admitted on the socket, in one kernel-thread hold:
-   * the follow receives it instead, in yielding steps of the policy's current size. Absent (a
-   * custodian, a relay, a test), every received batch is admitted as it arrives.
-   */
-  receiveStep;
   /** The last progress counted per workspace, served while a burst holds recounting back. */
   #progress = /* @__PURE__ */ new Map();
   /** When a held-back progress recount became owed; it reports at the burst's next due point. */
@@ -26221,10 +26523,12 @@ var LiveCorrespondenceDesk = class {
         sent: link.stream?.sent,
         unansweredAgesMs: (link.stream?.unanswered ?? []).map((entry) => Number((now2 - (entry.due - LIVE_ANSWER_WINDOW)) / 1000000n)),
         custodianLocal: link.custodian?.local,
-        convergeDue: link.convergeDue !== void 0
+        convergeDue: link.convergeDue !== void 0,
+        resident: false
       };
       try {
         if (this.kernel.isResident(link.binding.workspace) !== false) {
+          state.resident = true;
           const mount = workspaceMount(link.binding.workspace);
           state.head = this.kernel.head(mount, ++this.#requestId);
           state.tracked = this.kernel.resolveRef(mount, ++this.#requestId, TRACKED_MAIN2);
@@ -26293,7 +26597,7 @@ var LiveCorrespondenceDesk = class {
   }
   #count(link, mount) {
     const head = this.kernel.head(mount, ++this.#requestId);
-    const acknowledged = this.#cursor(link, mount)?.local ?? this.kernel.resolveRef(mount, ++this.#requestId, TRACKED_MAIN2);
+    const acknowledged = this.#cursor(link, mount)?.local ?? this.#heldPeerMain(link, mount, head) ?? this.kernel.resolveRef(mount, ++this.#requestId, TRACKED_MAIN2);
     if (!head || !acknowledged) return void 0;
     const count = (base, tip) => {
       if (base === tip) return 0;
@@ -26327,6 +26631,14 @@ var LiveCorrespondenceDesk = class {
   #holds(mount, base, tip) {
     return this.#chain(mount, base, tip)?.reachedBase === true;
   }
+  /** The custodian's main as last heard, when this copy holds it on its own head's chain above the
+   * sealed bookmark: the commits up to it came from the stream and are the custodian's (CAP-838). */
+  #heldPeerMain(link, mount, head, tracked = this.kernel.resolveRef(mount, ++this.#requestId, TRACKED_MAIN2)) {
+    const main = link.peerMain;
+    if (!main || !head || main === tracked) return void 0;
+    if (tracked && !this.#holds(mount, tracked, main)) return void 0;
+    return this.#holds(mount, main, head) ? main : void 0;
+  }
   /** This connection's admission cursor, while it still leads the saved bookmark. A cursor on local
    * history (admitted, not yet sealed) remembers the bookmark it was set above; once anything else
    * moves the bookmark (a follow round adopting the custodian's main) the bookmark rules again, so
@@ -26403,7 +26715,7 @@ var LiveCorrespondenceDesk = class {
       evidencePack: options.carryCommits || intents.some((intent) => intent.transportRequirement === IntentTransportRequirement.COMMIT_TREE) ? this.kernel.packDelta(mount, requestId, batchHead, base) : new Uint8Array()
     });
   }
-  receive(request, receipt) {
+  receive(receipt) {
     const link = [...this.#links.values()].find((item) => item.id === receipt.connectionId);
     if (!link) return;
     if (receipt.observation.case === "closed" || receipt.observation.case === "closure") {
@@ -26417,6 +26729,7 @@ var LiveCorrespondenceDesk = class {
       link.ownMains = [];
       delete link.lastAnnounced;
       delete link.lastPlacementAnnounced;
+      link.peerMain = void 0;
       link.dirty = true;
       link.due = this.clock.monotonicNanoseconds() + BigInt(Math.min(3e4, 250 * 2 ** Math.min(link.failures++, 7))) * 1000000n;
       return;
@@ -26426,7 +26739,6 @@ var LiveCorrespondenceDesk = class {
       link.openedAt = this.clock.monotonicNanoseconds();
       link.failures = 0;
       link.unheard = void 0;
-      if (!link.publisher) this.#hello(link);
       if (!link.publisher) this.inbound.opened(link.binding.workspace);
       this.linkOpened?.(link.binding.workspace);
       return;
@@ -26460,18 +26772,6 @@ var LiveCorrespondenceDesk = class {
     if (this.inbound.frame(link.binding.workspace, frame2.message)) return;
     if (frame2.message.case === "frontier") {
       this.#announced(link, frame2.message.value.head);
-      if (this.kernel.isResident(link.binding.workspace) === false) return;
-      if (!frame2.message.value.response) {
-        this.#send(link, { case: "frontier", value: {
-          head: this.kernel.head(workspaceMount(link.binding.workspace), ++this.#requestId) ?? "",
-          response: true
-        } });
-      }
-      try {
-        const batch2 = this.export(link.binding, frame2.message.value.head, ++this.#requestId);
-        if (batch2.source.case === "inline" && batch2.source.value.offers.length) this.#send(link, { case: "offers", value: batch2 });
-      } catch {
-      }
       return;
     }
     if (frame2.message.case === "admission") {
@@ -26479,48 +26779,18 @@ var LiveCorrespondenceDesk = class {
       this.progressChanged?.(link.binding.workspace);
       return;
     }
-    if (frame2.message.case !== "offers") return;
-    const batch = frame2.message.value;
-    if (batch.protocolVersion !== 2 || !batch.requestId || batch.source.case !== "inline" || !batch.source.value.offers.length) return;
-    const offers = batch.source.value.offers.filter((offer) => !this.#own.hasCommit(link.binding.workspace, offer.commitOid));
-    if (!offers.length) return;
-    if (this.kernel.isResident(link.binding.workspace) === false && !this.inbound.wanted(link.binding.workspace)) {
-      this.remoteAdvanced?.(link.binding.workspace);
-      return;
-    }
-    if (this.receiveStep !== void 0 && offers.length > this.receiveStep.offers) {
-      this.remoteAdvanced?.(link.binding.workspace);
-      return;
-    }
-    if ([...this.#pending.values()].some((pending) => pending.link === link && pending.bytes.length === bytes.length && pending.bytes.every((byte, index) => byte === bytes[index]))) return;
-    if (this.#pending.size >= 32) return;
-    this.#pending.set(request.requestId, { link, bytes });
-    return create(RuntimeRequestSchema, {
-      protocolVersion: 2,
-      requestId: request.requestId,
-      target: { workspace: link.binding.workspace, session: link.binding.replicaId },
-      // HTTP sender reconciliation controls are not part of a live proposal.
-      // Keeping fastForwardOnly while removing baseHead silently skips every
-      // offer against a nonempty local head. The Kernel judges sealed causality;
-      // live receivers neither ask for a return archive nor confirm the sender.
-      command: { case: "admitCustodyOffers", value: create(CustodyOfferBatchRequestSchema, {
-        ...batch,
-        baseHead: void 0,
-        observedHead: void 0,
-        fastForwardOnly: false,
-        ...offers.length === batch.source.value.offers.length ? {} : { source: { case: "inline", value: { ...batch.source.value, offers } } }
-      }) }
-    });
+  }
+  /** The newest local commit the custodian admitted unchanged over this workspace's open link: its
+   * main holds that commit, sealed or not, so it is no work to offer (CAP-838). */
+  admittedLocal(workspace) {
+    const link = this.#links.get(workspace);
+    const cursor = link?.state === "open" && !link.publisher ? link.custodian : void 0;
+    return cursor && cursor.main === cursor.local ? cursor.local : void 0;
   }
   /** Offers this replica sent another way (the HTTP lane): their echo on the live link is its own. */
   offered(workspace, commitOids) {
     this.#own.commits(workspace, commitOids);
   }
-  /** Whether this request is the admission of a batch relayed to this follower over its live link.
-   * Such an admission is never answered to a sender, so it keeps no custody receipts (CAP-759). */
-  relayed(requestId) {
-    return this.#pending.has(requestId);
-  }
   /**
    * The custodian judged a live batch. Admission acknowledges the batch at once; its admitted main
    * becomes this connection's cursor when it is already in local verified history. The saved
@@ -26540,9 +26810,10 @@ var LiveCorrespondenceDesk = class {
         ...admission.sealedMain ? { sealed: admission.sealedMain } : {}
       };
     }
-    if (!admission?.main || this.kernel.isResident(workspace) === false) return;
+    if (!admission?.main) return;
     const ownBatchHead = this.#own.batchHead(workspace, live.requestId);
     const ours = ownBatchHead !== void 0;
+    if (this.kernel.isResident(workspace) === false) return;
     let stale = false;
     if (ours) link.unheard = void 0;
     if (ours && link.stream) {
@@ -26630,6 +26901,7 @@ var LiveCorrespondenceDesk = class {
    * upstream head it already recorded. Re-announcing a known frontier - which is all an
    * upstream can do while this replica is ahead or held on a dependency - is not an event. */
   #announced(link, head) {
+    if (head) link.peerMain = head;
     if (!head || link.lastAnnounced === head) return;
     link.lastAnnounced = head;
     if (this.kernel.isResident(link.binding.workspace) === false) {
@@ -26654,15 +26926,6 @@ var LiveCorrespondenceDesk = class {
     if (frontier === this.kernel.resolveRef(mount, ++this.#requestId, PLACEMENT_REF3)) return;
     this.placementAdvanced?.(link.binding.workspace);
   }
-  settled(request, response) {
-    if (response.outcome.case === "correspondencePending" || response.outcome.case === "localReadPending") return;
-    this.#pending.delete(request.requestId);
-  }
-  failed(requestId) {
-    const pending = this.#pending.get(requestId);
-    this.#pending.delete(requestId);
-    if (pending) this.remoteAdvanced?.(pending.link.binding.workspace);
-  }
   disconnect(workspace) {
     const link = this.#links.get(workspace);
     if (!link) return;
@@ -26670,7 +26933,6 @@ var LiveCorrespondenceDesk = class {
     if (link.state === "open") this.linkClosed?.(workspace, closure);
     this.#links.delete(workspace);
     this.#progress.delete(workspace);
-    for (const [id, pending] of this.#pending) if (pending.link === link) this.#pending.delete(id);
   }
   /** The digest of the settled-letter outcomes this copy holds; empty when it cannot tell. */
   #outcomesDigest(workspace) {
@@ -26708,14 +26970,6 @@ var LiveCorrespondenceDesk = class {
     transfer.retain(create(PeerGitRefsFetchedSchema, { refs: [...wanted.refs], pack }));
     this.progressChanged?.(link.binding.workspace);
   }
-  #hello(link) {
-    if (this.kernel.isResident(link.binding.workspace) === false) return;
-    const head = this.kernel.head(workspaceMount(link.binding.workspace), ++this.#requestId);
-    this.#send(link, { case: "frontier", value: {
-      head: head ?? "",
-      outcomesDigest: this.#outcomesDigest(link.binding.workspace)
-    } });
-  }
   drive() {
     const now2 = this.clock.monotonicNanoseconds();
     let wake;
@@ -26764,7 +27018,8 @@ var LiveCorrespondenceDesk = class {
               link.custodian = void 0;
             }
             this.#cursor(link, mount);
-            const answered2 = link.publisher ? link.published ??= head ?? "" : link.custodian?.local ?? this.kernel.resolveRef(mount, ++this.#requestId, TRACKED_MAIN2) ?? "";
+            let answered2 = link.publisher ? link.published ??= head ?? "" : link.custodian?.local ?? this.kernel.resolveRef(mount, ++this.#requestId, TRACKED_MAIN2) ?? "";
+            if (!link.publisher && !link.custodian) answered2 = this.#heldPeerMain(link, mount, head, answered2) ?? answered2;
             const fence = link.custodian?.main ?? answered2;
             if (link.stream && !(head && this.#holds(mount, link.stream.sent, head))) {
               link.stream = void 0;
@@ -26865,7 +27120,6 @@ var LiveCorrespondenceDesk = class {
   }
   close() {
     for (const workspace of [...this.#links.keys()]) this.disconnect(workspace);
-    this.#pending.clear();
   }
 };
 
@@ -27825,6 +28079,7 @@ var PLACEMENT_REF4 = "refs/nomos/placement";
 var RECEIVED_PLACEMENT_REF = "refs/remotes/nomos/placement";
 var STREAM_BATCH_OFFERS = 64;
 var REMOUNT_AFTER_OFFERS = 128;
+var MAX_REMOUNTS_LOST = 2;
 var HISTORY_SLICES = [8, 64, 256, 256];
 var WorkspaceSyncPhase = Object.freeze({
   Idle: "idle",
@@ -27845,7 +28100,11 @@ var deferredLocal = "refs/nomos/sync-deferred-local";
 var judgedThisLifetime = /* @__PURE__ */ new Map();
 function releaseSyncJudgment(workspace) {
   judgedThisLifetime.delete(workspace);
+  notContainedThisLifetime.delete(workspace);
 }
+var notContainedThisLifetime = /* @__PURE__ */ new Map();
+var MAX_NOT_CONTAINED = 1024;
+var NOT_CONTAINED_REFUSALS = /* @__PURE__ */ new Set(["nomos.stream.off_main", "nomos.stream.history_required"]);
 var MAX_REBASES_PER_ROUND = 2;
 var elapsedMillis = (clock2, started) => {
   const finished = clock2.monotonicNanoseconds();
@@ -27901,6 +28160,7 @@ var WorkspaceSyncWork = class {
   #lastStep;
   #probeOnly;
   #liveConnected;
+  #liveAdmitted;
   /** Set when this round adopted the upstream's own head as its base (see #establishBase). */
   #establishedBase;
   #receiveState;
@@ -27917,6 +28177,11 @@ var WorkspaceSyncWork = class {
   /** The custodian head this round last offered or pulled from. */
   #rebaseFrom;
   #rebases = 0;
+  #remountsLost = 0;
+  /** This round's level ask is a containment question (CAP-870): on a refusal, take this path. */
+  #containment;
+  /** The stale bookmark a contained round replaces: its custodian's main holds the local head. */
+  #containedBookmark;
   /** Local intents this round's rebase refused and parked on the refused-offer desk. */
   #parkedLocal = 0;
   /** An application-authorized drop: replace local custody at exactly this head. */
@@ -27938,6 +28203,7 @@ var WorkspaceSyncWork = class {
     this.#placementFetched = args.placementFetched;
     this.#probeOnly = args.probeOnly ?? false;
     this.#liveConnected = args.liveConnected === true;
+    this.#liveAdmitted = args.liveAdmitted;
     this.#receiveState = args.receiveState;
     this.#completeHistory = args.completeHistory === true;
     this.#repairMissingCommit = args.repairMissingCommit === true;
@@ -28012,9 +28278,15 @@ var WorkspaceSyncWork = class {
     if (this.#receiveState) return this.#acquire("full");
     if (this.#replaceLocalHead !== void 0) return this.#acquire(this.#repairMissingCommit ? "full" : "mount");
     if (!this.#localHead) return this.#acquire(this.#completeHistory ? "full" : "mount");
-    if (this.#liveConnected && !this.#probeOnly && this.#holdsLocalWork() && this.#previousHead) {
-      return this.#offerOrReconcile();
+    const unadmitted = this.#holdsLocalWork() && this.#localHead !== this.#liveAdmitted;
+    if (this.#liveConnected && unadmitted && this.#previousHead) {
+      if (this.#mayBeContained()) return this.#askContainment("offer");
+      return this.#notContained();
     }
+    if (this.#liveConnected && this.#probeOnly && this.#previousHead && this.#holdsUnsyncedCommits() && this.#command.admit && this.#localHead === this.#liveAdmitted) {
+      return this.#acquire("level");
+    }
+    if (this.#liveConnected && !this.#probeOnly && !unadmitted) return this.#acquire("level");
     const requestId = `${this.#binding.replicaId}:${this.#requestId}:${this.workId}:frontier`;
     return this.#beginOffer(encodeInlineCustodyOffer({
       session: this.#binding.replicaId,
@@ -28023,6 +28295,60 @@ var WorkspaceSyncWork = class {
       intents: []
     }), { case: "awaiting", requestId }, true);
   }
+  /** Whether the custodian's main may hold this copy's head: not already refused in this lifetime. */
+  #mayBeContained() {
+    return !!this.#localHead && this.#offerHead === void 0 && notContainedThisLifetime.get(this.#mount.workspace) !== this.#localHead;
+  }
+  /** The probe named a custodian main that is not on this copy's own chain, so the copy's head may be
+   * on the custodian's. A main below the local head (the custodian is behind) cannot contain it. A
+   * complete copy answers a main it does not hold after one existence check, and one it holds after
+   * a walk to where the two chains join. A kernel that cannot say keeps the existing path. */
+  #custodianMainOffLocalChain() {
+    if (!this.#kernel.historySummary || !this.#desiredHead || !this.#localHead) return false;
+    try {
+      return !this.#kernel.historySummary(this.#mount, this.#requestId, this.#desiredHead, this.#localHead).reachedBase;
+    } catch (error) {
+      return error instanceof KernelHistoryRequired;
+    }
+  }
+  /** Level from the local head (CAP-870). The stream answers with the custodian's commits above it
+   * (or "level") only when its main holds that head; then this round converges onto them, moves the
+   * bookmark, and offers nothing. One custodian lookup, O(commits behind); no local enumeration. */
+  #askContainment(otherwise) {
+    this.#containment = otherwise;
+    return this.#acquire("level");
+  }
+  /** The stream answered from the local head: it is on the custodian's main. The stale bookmark
+   * stays this round's to replace; the local head is the round's base from here. */
+  #contained() {
+    this.#containment = void 0;
+    this.#containedBookmark = this.#previousHead;
+    this.#previousHead = this.#localHead;
+  }
+  /** The custodian's main does not hold the local head (or the stream could not say): the copy holds
+   * work of its own. Go straight on to the pull/rebase/offer path. A dependency planner's probe hands
+   * the round back to it to plan the outbound suffix. */
+  #notContained(code) {
+    const otherwise = this.#containment ?? "offer";
+    this.#containment = void 0;
+    if (code !== void 0 && NOT_CONTAINED_REFUSALS.has(code) && this.#localHead) {
+      if (notContainedThisLifetime.size >= MAX_NOT_CONTAINED && !notContainedThisLifetime.has(this.#mount.workspace)) {
+        notContainedThisLifetime.delete(notContainedThisLifetime.keys().next().value);
+      }
+      notContainedThisLifetime.set(this.#mount.workspace, this.#localHead);
+    }
+    if (this.#probeOnly) {
+      this.#needsReconciliation = true;
+      return this.#finish(create(SyncWorkspaceResponseSchema, {
+        workspace: this.#mount.workspace,
+        currentHead: this.#localHead,
+        previousHead: this.#previousHead,
+        stillAhead: true,
+        offerReceipt: this.#offerReceipt
+      }));
+    }
+    return otherwise === "pull" ? this.#pullBeforeOffer() : this.#offerOrReconcile();
+  }
   #offerOrReconcile() {
     if (this.#command.admit && this.#localHead && this.#localHead !== this.#previousHead) {
       const suffix = this.#kernel.transportIntentsAbove(
@@ -28101,7 +28427,14 @@ var WorkspaceSyncWork = class {
     return this.#previousHead === void 0 && this.#localHead !== void 0 && this.#replaceLocalHead === void 0;
   }
   #holdsLocalWork() {
-    return this.#command.admit && !!this.#localHead && this.#localHead !== this.#previousHead;
+    return this.#command.admit && this.#holdsUnsyncedCommits();
+  }
+  /** Commits on local main the provider has not been seen to admit, whether or not this round may
+   * offer them. Remount replaces local main, so it asks this, never the admit-gated question: a copy
+   * holding unsynced work is offered and rebased, never remounted. A copy without a bookmark cannot
+   * prove it holds nothing of its own. */
+  #holdsUnsyncedCommits() {
+    return !!this.#localHead && this.#localHead !== this.#previousHead;
   }
   /** Ask only for the custodian's delta; the offer follows once this peer has rebased. */
   #pullBeforeOffer() {
@@ -28139,13 +28472,13 @@ var WorkspaceSyncWork = class {
     }
     if (purpose === "level") {
       this.#state = { phase: WorkspaceSyncPhase.Stream, purpose, startedAt };
-      return this.#streamEffect("level", { case: "level", value: create(LiveFrontierSchema, {
+      return this.#streamEffect(this.#containment ? "contain" : "level", { case: "level", value: create(LiveFrontierSchema, {
         head: this.#localHead ?? "",
         response: false,
         maxOffers: this.#receiveStep?.offers ?? STREAM_BATCH_OFFERS,
         // Only a copy holding no work above its bookmark may be remounted instead of replaying, and
         // never one whose durable copy must hold the complete history (a head-only mount it cannot keep).
-        remountAfterOffers: this.#holdsLocalWork() || this.#completeHistory ? 0 : REMOUNT_AFTER_OFFERS
+        remountAfterOffers: this.#holdsUnsyncedCommits() || this.#completeHistory ? 0 : REMOUNT_AFTER_OFFERS
       }) });
     }
     const outcomes = new EffectOutcomeTransfer(this.#kernel, this.#mount, this.#requestId);
@@ -28222,6 +28555,7 @@ var WorkspaceSyncWork = class {
     }
     if (answer.outcome.case === "refusal") {
       const refusal2 = answer.outcome.value;
+      if (state.purpose === "level" && this.#containment) return this.#notContained(refusal2.code);
       if (state.afterPlacement) return this.#finish(state.afterPlacement);
       return this.#transportFailure(`${refusal2.code}: ${refusal2.message}`, false);
     }
@@ -28258,6 +28592,11 @@ var WorkspaceSyncWork = class {
         state.startedAt
       );
     }
+    if (state.purpose === "level" && this.#containment) {
+      const answeredFromHead = answer.outcome.case === "level" || answer.outcome.case === "pack" && answer.outcome.value.base === this.#localHead;
+      if (!answeredFromHead) return this.#notContained();
+      this.#contained();
+    }
     if (state.purpose === "level" && answer.outcome.case === "pack" && answer.outcome.value.base) {
       const batch = answer.outcome.value;
       if (batch.base !== this.#previousHead && batch.base !== this.#kernel.head(this.#mount, this.#requestId)) {
@@ -28396,13 +28735,19 @@ var WorkspaceSyncWork = class {
   /**
    * A copy holding no work above its bookmark, too far behind to replay the backlog: mount the
    * peer's checkpoint in place of its exact local main (O(state), the same trust as a cold mount).
-   * The kernel keeps the replaced head at refs/heads/custody-preserved/<old>; that head was only a
-   * bookmark of the provider's own main, so the preservation is released at once.
+   * The kernel keeps the replaced head at refs/heads/custody-preserved/<old>. That ref is custody the
+   * kernel guards (custody may not delete an effectful branch), so it is left where it is: a remount
+   * that deleted it threw after main had already moved, leaving the bookmark behind main and the
+   * round failed for ever (2026-10-08, estate-5b493d6b).
+   *
+   * The copy may have moved while the checkpoint streamed (a live batch, a local write). Then it is
+   * no longer the copy the remount was asked for: take the round up again from its new head. Local
+   * work is offered first; a copy that is still only behind asks to level again.
    */
   #remount(candidateHead, receivedBytes, prefetchMillis) {
     const expected = this.#kernel.head(this.#mount, this.#requestId);
-    if (expected === void 0 || expected !== this.#localHead || this.#holdsLocalWork()) {
-      return this.#transportFailure("the copy changed while its remount was streaming", false);
+    if (expected === void 0 || expected !== this.#localHead || this.#holdsUnsyncedCommits()) {
+      return this.#remountLost(expected);
     }
     const started = this.#clock.monotonicNanoseconds();
     if (candidateHead !== expected) {
@@ -28410,7 +28755,6 @@ var WorkspaceSyncWork = class {
       if (!restored.accepted || restored.head !== candidateHead) {
         throw new Error(`kernel refused to remount '${this.#mount.workspace}' at ${candidateHead}`);
       }
-      this.#kernel.deleteRef?.(this.#mount, this.#requestId, `refs/heads/custody-preserved/${expected}`);
       this.#providerCustodyMounted();
     }
     return this.#converged(create(SyncResponseSchema, {
@@ -28420,6 +28764,25 @@ var WorkspaceSyncWork = class {
       admittedRemoteHead: candidateHead
     }), candidateHead, receivedBytes, prefetchMillis, started);
   }
+  /** The remount's copy changed under it. Bounded: a copy that keeps moving under live traffic is
+   * levelled by its live link anyway, and the next round starts from wherever it got to. */
+  #remountLost(head) {
+    if (head === void 0 || ++this.#remountsLost > MAX_REMOUNTS_LOST) {
+      return this.#transportFailure("the copy changed while its remount was streaming", false);
+    }
+    this.#localHead = head;
+    this.#previousHead = this.#kernel.resolveRef(this.#mount, this.#requestId, trackedMain);
+    if (this.#desiredHead === this.#localHead) {
+      return this.#converged(create(SyncResponseSchema, {
+        admitted: true,
+        head,
+        candidateHead: head,
+        admittedRemoteHead: head
+      }), head, 0, 0);
+    }
+    if (this.#holdsLocalWork() && this.#desiredHead !== this.#previousHead) return this.#pullBeforeOffer();
+    return this.#offerOrReconcile();
+  }
   resume(receipt) {
     if (receipt.effectId === this.#lastReceiptEffectId && this.#lastStep) {
       return this.#lastStep;
@@ -28584,6 +28947,10 @@ var WorkspaceSyncWork = class {
           offerReceipt: this.#offerReceipt
         }));
       }
+      const custodianMoved = this.#holdsLocalWork() && this.#desiredHead !== this.#previousHead;
+      if (custodianMoved && this.#mayBeContained() && this.#custodianMainOffLocalChain()) {
+        return this.#askContainment("pull");
+      }
       if (this.#probeOnly) {
         this.#needsReconciliation = true;
         return this.#finish(create(SyncWorkspaceResponseSchema, {
@@ -28594,9 +28961,7 @@ var WorkspaceSyncWork = class {
           offerReceipt: this.#offerReceipt
         }));
       }
-      if (this.#holdsLocalWork() && this.#desiredHead !== this.#previousHead) {
-        return this.#pullBeforeOffer();
-      }
+      if (custodianMoved) return this.#pullBeforeOffer();
       return this.#offerOrReconcile();
     }
     this.#admissionSummary = summarizeCustodyAdmission(admission);
@@ -28930,7 +29295,8 @@ var WorkspaceSyncWork = class {
     }));
   }
   #converged(verdict, candidateHead, receivedBytes, prefetchMillis, started = this.#clock.monotonicNanoseconds(), rebirth) {
-    if (verdict.admitted && this.#candidateDurable && candidateHead !== this.#previousHead && this.#kernel.resolveRef(this.#mount, this.#requestId, trackedMain) === this.#previousHead) {
+    const tracked = verdict.admitted && this.#candidateDurable ? this.#kernel.resolveRef(this.#mount, this.#requestId, trackedMain) : void 0;
+    if (verdict.admitted && this.#candidateDurable && tracked !== candidateHead && (tracked === this.#previousHead || this.#containedBookmark !== void 0 && tracked === this.#containedBookmark)) {
       this.#kernel.writeRef(
         this.#mount,
         this.#requestId,
@@ -29219,10 +29585,16 @@ var WorkspaceDependencySyncWork = class {
       this.#plan = [this.#args.root];
       return this.#advance();
     }
-    if (this.#args.liveConnected && this.#args.kernel.resolveRef(this.#args.root.mount, this.#args.requestId, trackedMain2)) {
+    const { kernel, requestId, root } = this.#args;
+    const tracked = this.#args.liveConnected ? kernel.resolveRef(root.mount, requestId, trackedMain2) : void 0;
+    if (tracked && kernel.head(root.mount, requestId) === tracked) {
       this.#plan = this.#planDependencies();
       return this.#advance();
     }
+    if (tracked) {
+      this.#current = this.#work(root, `${this.workId}:contain`, true);
+      return this.#accept(this.#current.start());
+    }
     this.#current = this.#work(this.#args.root, `${this.workId}:frontier`, true);
     return this.#accept(this.#current.start());
   }
@@ -30545,6 +30917,11 @@ var ReplicaFollowLane = class {
     const delay = this.#controller.reconnected(workspace);
     if (delay !== void 0) this.#scheduleAt(workspace, this.#now() + delay);
   }
+  /** The upstream announced a new frontier: news even to a follow the kernel refused. */
+  remoteAdvanced(workspace) {
+    const delay = this.#controller.reconnected(workspace, true);
+    if (delay !== void 0) this.#scheduleAt(workspace, this.#now() + delay);
+  }
   /** The upstream rang for a new placement frontier (see ReplicaFollowController). */
   placementAnnounced(workspace) {
     const delay = this.#controller.placementAnnounced(workspace);
@@ -30859,6 +31236,7 @@ var CorrespondenceDesk = class {
   #onPlacementFetched;
   #onShallowMount;
   #onOffered;
+  #liveAdmitted;
   #onOutboxHistoryRequired;
   #backgroundHistory;
   #receiveStep;
@@ -30915,6 +31293,7 @@ var CorrespondenceDesk = class {
     this.#onPlacementFetched = args.onPlacementFetched;
     this.#onShallowMount = args.onShallowMount;
     this.#onOffered = args.onOffered;
+    this.#liveAdmitted = args.liveAdmitted;
     this.#onOutboxHistoryRequired = args.onOutboxHistoryRequired;
     this.#backgroundHistory = args.backgroundHistory !== false;
     this.#receiveStep = args.receiveStep;
@@ -31241,6 +31620,12 @@ var CorrespondenceDesk = class {
     this.#followLane.reconnected(workspace);
     this.reportFollows();
   }
+  /** The upstream announced a new frontier for this workspace over its live link: an event which
+   * re-runs a round the kernel refused (its inputs changed). */
+  replicaRemoteAdvanced(workspace) {
+    this.#followLane.remoteAdvanced(workspace);
+    this.reportFollows();
+  }
   /** The upstream rang for a new placement frontier: the next round re-checks placement even
    * though main has not moved. */
   replicaPlacementAnnounced(workspace) {
@@ -31277,10 +31662,11 @@ var CorrespondenceDesk = class {
       const state = this.#follows.followForWorkspace(workspace)?.state;
       if (!state) return [];
       const isSettled = state.case === ReplicaFollowPhase.Settled;
+      const refused = state.case === ReplicaFollowPhase.Backoff && state.refusal?.blocked === true;
       const isLive = this.#openLinks.has(workspace);
       if (isSettled) settled += 1;
       if (isLive) live += 1;
-      const phase = {
+      const phase = refused ? FollowObservationPhase.KERNEL_REFUSED : {
         [ReplicaFollowPhase.Desired]: FollowObservationPhase.DESIRED,
         [ReplicaFollowPhase.Due]: FollowObservationPhase.DUE,
         [ReplicaFollowPhase.Running]: FollowObservationPhase.RUNNING,
@@ -31294,7 +31680,7 @@ var CorrespondenceDesk = class {
         [ReplicaFollowPhase.LocalCopyUnreadable]: FollowObservationPhase.LOCAL_COPY_UNREADABLE
       }[state.case];
       const detail = state.case === ReplicaFollowPhase.AwaitingDependency ? state.reason : state.case === ReplicaFollowPhase.InvalidCredential || state.case === ReplicaFollowPhase.Backoff ? state.failure : state.case === ReplicaFollowPhase.RebornRemotely ? state.rebirth.detail : state.case === ReplicaFollowPhase.LocalCopyUnreadable ? state.format : void 0;
-      const retryAt = state.case === ReplicaFollowPhase.Offline || state.case === ReplicaFollowPhase.InvalidCredential || state.case === ReplicaFollowPhase.Backoff ? state.retryAtUnixMillis : void 0;
+      const retryAt = refused ? state.case === ReplicaFollowPhase.Backoff ? state.refusal?.rerunAtUnixMillis : void 0 : state.case === ReplicaFollowPhase.Offline || state.case === ReplicaFollowPhase.InvalidCredential || state.case === ReplicaFollowPhase.Backoff ? state.retryAtUnixMillis : void 0;
       const dueAt2 = state.case === ReplicaFollowPhase.Due || state.case === ReplicaFollowPhase.ReplacingLocal ? state.dueAtUnixMillis : void 0;
       const attempt = state.case === ReplicaFollowPhase.Running || state.case === ReplicaFollowPhase.Offline || state.case === ReplicaFollowPhase.InvalidCredential || state.case === ReplicaFollowPhase.Backoff || state.case === ReplicaFollowPhase.ReplacingLocal ? state.attempt : void 0;
       const activeEffect = state.case === ReplicaFollowPhase.Running ? this.#activeSyncEffect(workspace) : void 0;
@@ -31792,6 +32178,7 @@ var CorrespondenceDesk = class {
         workId: id,
         probeOnly,
         liveConnected: this.#openLinks.has(target3.mount.workspace),
+        ...this.#openLinks.has(target3.mount.workspace) && this.#liveAdmitted?.(target3.mount.workspace) ? { liveAdmitted: this.#liveAdmitted(target3.mount.workspace) } : {},
         ...beforeConverge === void 0 ? {} : { beforeConverge },
         ...target3.receiveState === void 0 ? {} : { receiveState: target3.receiveState },
         ...target3.offerHead === void 0 ? {} : { offerHead: target3.offerHead },
@@ -33418,10 +33805,10 @@ var OfferReadinessDesk = class {
     while (true) {
       this.#ports.owe(owed.workspace);
       while (this.#ports.owes(owed.workspace)) {
-        const tick = this.#ports.tick();
+        const { ticked, wake: readiness } = this.#ports.tick();
         const delayMillis = Math.min(LONGEST_WAKE_MILLIS, Math.max(
           FIRST_WAKE_MILLIS,
-          tick.progress !== void 0 ? FIRST_WAKE_MILLIS : tick.nextTickAfterMillis
+          ticked.progress !== void 0 ? FIRST_WAKE_MILLIS : readiness.case === "after" ? readiness.millis : LONGEST_WAKE_MILLIS
         ));
         const receipt = yield { case: "wake", value: create(PeerWakeEffectSchema, {
           effectId: `${workId2}:repay-${++wake}`,
@@ -33553,7 +33940,6 @@ function isAnsweredStateRead(command, response) {
 }
 var INTERACTIVE_PEER_CLASSES = /* @__PURE__ */ new Set(["personal-device", "browser"]);
 var INTERACTION_FIRST_MILLIS = 15e3;
-var READ_READINESS_ONLY = 1n << 62n;
 var PLACEMENT_READ_RETRY_MILLIS = 60000n;
 var STREAM_WAKE_FIRST_MILLIS = 20;
 var HISTORY_STREAM_SLICES = [8, 64, 256];
@@ -33572,7 +33958,6 @@ var APPLICATION_WAITS = /* @__PURE__ */ new Set([
   "continueLocalRead"
 ]);
 var APPLICATION_WAIT_NANOS = 5000000000n;
-var READ_INDEX_BUILDING = /the read index of .+ is being built|read maintenance continues it/;
 var PeerOffice = class {
   #kernel;
   #sessions = new SessionDirectory();
@@ -33767,7 +34152,6 @@ var PeerOffice = class {
       }
     }, (workspace) => this.#residency.lastRetainedHead(workspace));
     if (this.#writeBurst) this.#live.writeBurst = this.#writeBurst;
-    if (this.#interactivePeer) this.#live.receiveStep = this.#receiveStepBudget;
     this.#credentials = new CredentialSessions(this.#sessions, credentials, observations);
     this.#readability = new LocalCopyReadability((workspace, format) => {
       this.#follows.markLocalCopyUnreadable(workspace, format);
@@ -33785,7 +34169,8 @@ var PeerOffice = class {
       new ReplicaFollowDesk(seatedStore),
       observations,
       this.#replicaId,
-      new BirthRefusalRegister(seatedStore)
+      new BirthRefusalRegister(seatedStore),
+      PEER_RUNTIME_IDENTITY
     );
     this.#compatibility = new CompatibilityDesk(
       this.#queries,
@@ -33804,13 +34189,20 @@ var PeerOffice = class {
       this.#trace,
       observations,
       {
-        readReady: (workspace) => this.#subscriptions.readIndexReady(workspace),
-        frontierAdvanced: (workspace) => this.#subscriptions.readIndexAdvanced(workspace),
-        localCopyUnreadable: (workspace, format) => this.#readability.mark(
-          workspace,
-          this.#kernel.head(workspaceMount(workspace), 0n),
-          format
-        ),
+        // A read waiting on this workspace is released by the readiness event itself, not a timer.
+        readReady: (workspace) => {
+          this.#subscriptions.readIndexReady(workspace);
+          this.#readResponses?.readinessChanged(workspace);
+        },
+        frontierAdvanced: (workspace) => {
+          this.#subscriptions.readIndexAdvanced(workspace);
+          this.#readResponses?.readinessChanged(workspace);
+        },
+        readinessMayChange: (workspace) => this.#readResponses?.readinessChanged(workspace),
+        localCopyUnreadable: (workspace, format) => {
+          this.#readability.mark(workspace, this.#kernel.head(workspaceMount(workspace), 0n), format);
+          this.#readResponses?.readinessChanged(workspace);
+        },
         isLocalCopyUnreadable: (workspace) => this.#readability.decide(workspace) !== void 0
       },
       // The kernel owes this peer's writes to an ordered background flush the desk schedules.
@@ -33872,7 +34264,7 @@ var PeerOffice = class {
             aggregateIds: new Set([...admitted.affected, ...admitted.created].map((ref) => ref.id)),
             // What the offer changed, typed as reads resolve it: watches it cannot change are not read.
             stateChange: admitted.stateChange
-          }, () => this.#readMaintenance.tick(void 0, 0n, READ_READINESS_ONLY, false).progress !== void 0));
+          }, () => this.#readMaintenance.tickReadReadiness().ticked.progress !== void 0));
           noteTimeline("ownOffer", `${delivery.delivered}/${delivery.watches}`);
           noteTimeline("ownOfferSkipped", delivery.skipped);
         });
@@ -33887,7 +34279,12 @@ var PeerOffice = class {
       observations,
       // A waiting read advances read readiness only: it must never run a background command or
       // closure warm on the foreground's turn.
-      () => this.#readMaintenance.tick(void 0, 0n, READ_READINESS_ONLY, false),
+      () => this.#readMaintenance.tickReadReadiness(),
+      // A read the kernel still finds behind, with nothing owing its index, owes it again (as a watch does).
+      (request) => {
+        if (request.command.case !== "kernelCall") throw new Error("local read continuation lost its query");
+        this.#readMaintenance.schedule(request.command.value.session, ReadMaintenanceCause.READ_DEBT);
+      },
       (request) => {
         if (request.command.case !== "kernelCall") throw new Error("local read continuation lost its query");
         return this.#application.call(request, request.command.value);
@@ -33988,6 +34385,7 @@ var PeerOffice = class {
       onShallowMount: (workspace, credentialCapability) => this.#historyAcquisition.materialise(workspace, credentialCapability),
       // The edge echoes an HTTP offer batch back over this replica's own live link (CAP-764).
       onOffered: (workspace, commitOids) => this.#live.offered(workspace, commitOids),
+      liveAdmitted: (workspace) => this.#live.admittedLocal(workspace),
       onOutboxHistoryRequired: (workspace, credentialCapability) => this.#historyAcquisition.requestFromBackground(workspace, credentialCapability),
       backgroundHistory: profile.backgroundHistory !== false,
       onSyncCompleted: (session, event) => {
@@ -34013,7 +34411,7 @@ var PeerOffice = class {
       this.#origins.ignored(workspace, origin2, "follow");
       return false;
     };
-    this.#live.remoteAdvanced = (workspace) => this.#correspondence.replicaLinkOpened(workspace);
+    this.#live.remoteAdvanced = (workspace) => this.#correspondence.replicaRemoteAdvanced(workspace);
     this.#live.declined = (workspace) => this.#correspondence.liveAdmissionDeclined(workspace);
     this.#live.acknowledged = (workspace, ack) => this.#correspondence.liveAdmissionAcknowledged(workspace, ack);
     this.#live.intentsAdmitted = (workspace, intentIds, local) => this.#correspondence.liveIntentsAdmitted(workspace, intentIds, local);
@@ -34225,7 +34623,7 @@ var PeerOffice = class {
       },
       owes: (workspace) => this.#readMaintenance.owesReadReadiness(workspace),
       // Read readiness only, as a waiting read takes: never a background command or pack import (CAP-806).
-      tick: () => this.#readMaintenance.tick(void 0, 0n, READ_READINESS_ONLY, false),
+      tick: () => this.#readMaintenance.tickReadReadiness(),
       emit: (session, event) => this.#trace.emit(session, event)
     });
     this.#modelAdoption = new ModelAdoptionDesk({
@@ -34623,9 +35021,8 @@ var PeerOffice = class {
     let pendingEffectId;
     try {
       if (request.command.case === "socketReceipt") {
-        const admission = this.#live.receive(request, request.command.value);
-        if (!admission) return this.#response(request, { case: "socketObserved", value: create(PeerSocketObservedSchema) });
-        request = admission;
+        this.#live.receive(request.command.value);
+        return this.#response(request, { case: "socketObserved", value: create(PeerSocketObservedSchema) });
       }
       const result = timelinePhase("access", () => this.#access.handle(request));
       if (result.outcome.case === "correspondencePending") {
@@ -34634,11 +35031,9 @@ var PeerOffice = class {
       }
       if (result.outcome.case === "watchStarted") this.#subscriptions.retainDependencies(result.outcome.value.subscriptionId, scope);
       this.#subscriptions.recoverySettled(result);
-      this.#live.settled(request, result);
       this.#correspondence.observeResponse(result);
       return result;
     } catch (error) {
-      this.#live.failed(request.requestId);
       const failure = this.#failure(request, "nomos.runtime.workspace_access", error instanceof Error ? error.message : String(error));
       this.#subscriptions.recoverySettled(failure);
       this.#correspondence.observeResponse(failure);
@@ -34905,11 +35300,7 @@ var PeerOffice = class {
           try {
             const mount = this.#sessions.mountForWorkspace(request.target.workspace);
             const previousHead = this.#kernel.head(mount, request.requestId);
-            const admission = this.#custodyAdmission.admit(
-              request,
-              request.command.value,
-              { journal: !this.#live.relayed(request.requestId) }
-            );
+            const admission = this.#custodyAdmission.admit(request, request.command.value);
             admission.sealedMain = this.#residency.retainedHead(request.target.workspace);
             if (custodyAdmissionNeedsReadMaintenance(admission)) {
               admission.localMaintenance = this.#readMaintenance.scheduleWorkspace(
@@ -35026,16 +35417,17 @@ var PeerOffice = class {
           });
         case "historicQuery": {
           const answered2 = this.#historicQueries.execute(request, request.command.value);
-          if (answered2.outcome.case === "failure" && READ_INDEX_BUILDING.test(answered2.outcome.value.message)) {
+          if (answered2.outcome.case === "query" && answered2.outcome.value.result.case === "readIndexPending") {
             this.#readMaintenance.schedule(request.command.value.session, ReadMaintenanceCause.READ_DEBT);
+            const workspace = answered2.outcome.value.result.value.workspace || (this.#sessions.bindingIfPresent(request.command.value.session)?.workspace ?? "");
             return this.#response(request, {
               case: "unavailable",
               value: create(RuntimeUnavailableSchema, {
                 reason: RuntimeUnavailableReason.LOCAL_REPLICA_NOT_READY,
-                workspace: this.#sessions.bindingIfPresent(request.command.value.session)?.workspace ?? "",
+                workspace,
                 retryable: true,
                 retryAfterMillis: 250,
-                detail: answered2.outcome.value.message
+                detail: `the read index of ${workspace} is being built on this device; read maintenance continues it`
               })
             });
           }
@@ -35455,6 +35847,10 @@ var PeerOffice = class {
   nextEvent() {
     return this.#trace.nextEvent();
   }
+  /** In-process shells wait on a held local read here instead of polling `resumeAfterMillis`. */
+  localReadResumable(workId2, notify) {
+    return this.#readResponses.onResumable(workId2, notify);
+  }
   close() {
     if (this.retentionOutstanding() > 0) {
       throw new Error("custody retention pending; retain the acknowledged frontiers before disposing the peer");
@@ -35804,6 +36200,23 @@ function createPeerOfficeFrameRunner(kernel, credentials, profile, observations,
     lanes?.wake(delayMillis);
   };
   const runner = {
+    localReadResumable(workId2) {
+      let resolve4;
+      const resumable = new Promise((done) => {
+        resolve4 = done;
+      });
+      let timer;
+      const wait = peer2.localReadResumable(workId2, () => {
+        if (timer !== void 0) clearTimeout(timer);
+        resolve4();
+      });
+      if (wait === void 0) return void 0;
+      timer = setTimeout(() => {
+        wait.cancel();
+        resolve4();
+      }, wait.afterMillis);
+      return resumable;
+    },
     handleFrame(frame2) {
       const response = peer2.invoke(frame2).responseProtobuf;
       drainEvents();
@@ -36032,7 +36445,7 @@ async function drivePeerFrame(runner, initialFrame, fetchImpl = globalThis.fetch
     if (response.outcome.case === "localReadPending") {
       if (yieldLocalReadToCaller) return responseFrame;
       const pending2 = response.outcome.value;
-      await new Promise((resolve4) => setTimeout(resolve4, pending2.resumeAfterMillis));
+      await (runner.localReadResumable?.(pending2.workId) ?? new Promise((resolve4) => setTimeout(resolve4, pending2.resumeAfterMillis)));
       responseFrame = await turn(() => runner.handleFrame(toBinary(RuntimeRequestSchema, create(RuntimeRequestSchema, {
         protocolVersion: response.protocolVersion,
         requestId: response.requestId,
@@ -37239,11 +37652,30 @@ var sha256Hex2 = async (bytes) => {
   const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes);
   return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 };
-var okBytes = async (fetchImpl, url) => {
+var okBytes = async (fetchImpl, url, progress, expectedBytes) => {
   const response = await fetchImpl(url);
   if (!response.ok) throw new Error(`runtime artifact ${url}: HTTP ${response.status}`);
-  return new Uint8Array(await response.arrayBuffer());
+  const reader = progress ? response.body?.getReader() : void 0;
+  if (!reader) return new Uint8Array(await response.arrayBuffer());
+  const total = expectedBytes ?? Number(response.headers.get("content-length") ?? 0);
+  const chunks = [];
+  let received = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    chunks.push(value);
+    received += value.byteLength;
+    progress(received, total);
+  }
+  const bytes = new Uint8Array(received);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return bytes;
 };
+var elapsedSince = (started) => globalThis.performance.now() - started;
 async function selectReleaseKernel(args) {
   const fetchImpl = args.fetchImpl ?? ((input, init) => globalThis.fetch(input, init));
   const base = args.base.replace(/\/+$/, "");
@@ -37271,11 +37703,27 @@ async function selectReleaseKernel(args) {
       }
     }
     const url = new URL(relativeUrl, repositoryUrl).toString();
-    const bytes = await okBytes(fetchImpl, url);
-    if (expected && (bytes.byteLength !== expected.size || await sha256Hex2(bytes) !== expected.sha256)) {
-      throw new Error(`runtime artifact ${url} does not match the OSGi resource it was selected by`);
+    const report = (progress) => {
+      try {
+        args.onProgress?.(progress);
+      } catch {
+      }
+    };
+    let started = globalThis.performance.now();
+    const bytes = await okBytes(fetchImpl, url, args.onProgress ? (receivedBytes, totalBytes) => report({ stage: "download", artifact: name, receivedBytes, totalBytes }) : void 0, expected?.size);
+    report({ stage: "fetched", artifact: name, millis: elapsedSince(started) });
+    if (expected) {
+      started = globalThis.performance.now();
+      if (bytes.byteLength !== expected.size || await sha256Hex2(bytes) !== expected.sha256) {
+        throw new Error(`runtime artifact ${url} does not match the OSGi resource it was selected by`);
+      }
+      report({ stage: "verified", artifact: name, millis: elapsedSince(started) });
+    }
+    if (expected && args.cache) {
+      started = globalThis.performance.now();
+      await args.cache.write(resource.contentSha256, name, bytes);
+      report({ stage: "stored", artifact: name, millis: elapsedSince(started) });
     }
-    if (expected && args.cache) await args.cache.write(resource.contentSha256, name, bytes);
     return bytes;
   };
   await verifySelectedKernel({
@@ -37339,6 +37787,34 @@ async function verifySelectedKernel(args) {
   }
 }
 
+// ../../platform-shells/shared/retained_boot_fetch.ts
+init_define_NOMOS_KERNEL_RELEASE();
+function retainedBootFetch(base, fetchImpl, store, repositoryUrl) {
+  const root = base.replace(/\/+$/, "");
+  return async (input, init) => {
+    const url = String(input);
+    const bootArtifact = url === (repositoryUrl ?? `${root}/v1/runtime/repository.xml`) || url === `${root}/v1/runtime/nomos.law.usdz`;
+    if (!bootArtifact) return fetchImpl(input, init);
+    const networkInit = { ...init, cache: "no-store", signal: init?.signal ?? AbortSignal.timeout(15e3) };
+    if (!store) return fetchImpl(input, networkInit);
+    let response;
+    let failure;
+    try {
+      response = await fetchImpl(input, networkInit);
+    } catch (error) {
+      failure = error;
+    }
+    if (response !== void 0 && response.status < 500) {
+      if (response.ok) await store.put(url, response.clone());
+      return response;
+    }
+    const retained = await store.match(url);
+    if (retained) return retained;
+    if (response !== void 0) return response;
+    throw failure;
+  };
+}
+
 // ../../runtime/kernel_local_dev_trust.ts
 init_define_NOMOS_KERNEL_RELEASE();
 var LOCAL_DEV_KERNEL_TRUST_ROOT_ENV = "NOMOS_LOCAL_DEV_KERNEL_TRUST_ROOT";
@@ -37408,10 +37884,28 @@ var physicalFetch = async (input, init) => {
   }, { signal: gitHttpBackendLifetime.signal });
   return new Response(result.body, { status: result.status, headers: result.headers });
 };
+var diskBootStore = (directory2) => {
+  const file = (url) => join5(directory2, createHash2("sha256").update(url).digest("hex"));
+  return {
+    async match(url) {
+      if (!existsSync5(`${file(url)}.body`) || !existsSync5(`${file(url)}.headers.json`)) return void 0;
+      return new Response(new Uint8Array(readFileSync3(`${file(url)}.body`)), {
+        headers: JSON.parse(readFileSync3(`${file(url)}.headers.json`, "utf8"))
+      });
+    },
+    async put(url, response) {
+      mkdirSync5(directory2, { recursive: true });
+      writeFileSync5(`${file(url)}.body`, new Uint8Array(await response.arrayBuffer()));
+      writeFileSync5(`${file(url)}.headers.json`, JSON.stringify(Object.fromEntries(response.headers)));
+    }
+  };
+};
 var fetchReleaseBundle = async (cloud) => {
   const cacheRoot = join5(data, "runtime");
   const selected = await selectReleaseKernel({
     base: cloud,
+    // Offline-first: an unreachable channel boots the last selection this peer verified, verified again now.
+    fetchImpl: retainedBootFetch(cloud, (input, init) => fetch(input, init), diskBootStore(join5(cacheRoot, "boot"))),
     release: define_NOMOS_KERNEL_RELEASE_default,
     // The pinned production roots; plus a developer's local-dev root only when named explicitly AND the custodian is
     // on this machine (CAP-813) — announced on stderr either way.