@githolon/runtime 0.111.1 → 0.112.1

package/dist/nomos-runner.js

@@ -2883,6 +2883,10 @@
   init_define_NOMOS_KERNEL_RELEASE();
   init_shims();
 
+  // ../../platform-shells/browser/history_custody.ts
+  init_define_NOMOS_KERNEL_RELEASE();
+  init_shims();
+
   // ../../node_modules/@bufbuild/protobuf/dist/esm/index.js
   init_define_NOMOS_KERNEL_RELEASE();
   init_shims();
@@ -7818,6 +7822,94 @@
   var DeviceRecoveryAdmissionStageSchema = /* @__PURE__ */ enumDesc(file_nomos_runtime_v2_correspondence_desk, 3);
   var DeviceRecoveryAdmissionStage = /* @__PURE__ */ tsEnum(DeviceRecoveryAdmissionStageSchema);
 
+  // ../../platform-shells/browser/history_custody.ts
+  function browserHistoryCustody(desk, discovery, providers, fetch2) {
+    const origins = new Set(providers.map((provider) => new URL(provider).origin));
+    return async (workspace, authToken) => {
+      const placement = await discovery.discoverWorkspacePlacement(workspace);
+      const leaseUrl = placement.custodyLeaseUrl;
+      if (!leaseUrl || !origins.has(new URL(leaseUrl).origin)) throw new Error("History custody lease is not from a configured provider");
+      const mediaType = "application/vnd.nomos.git-read-lease+protobuf";
+      const response = await fetch2(leaseUrl, {
+        headers: { Accept: mediaType, ...authToken ? { "x-nomos-auth": authToken } : {} },
+        signal: AbortSignal.timeout(3e4)
+      });
+      if (!response.ok || response.headers.get("content-type")?.split(";")[0] !== mediaType) throw new Error(`History custody lease returned HTTP ${response.status} or an untyped response`);
+      const lease = fromBinary(GitReadLeaseSchema, new Uint8Array(await response.arrayBuffer()));
+      if (lease.formatVersion !== 1 || lease.workspace !== workspace || !lease.token || !/^https?:\/\//.test(lease.remote)) throw new Error("History custody lease does not identify this workspace and transport");
+      return desk.deepenMain(workspace, { remote: lease.remote, headers: {
+        Authorization: `Bearer ${lease.token}`,
+        "x-nomos-artifacts-read-token": lease.token
+      } });
+    };
+  }
+
+  // ../../platform-shells/browser/kernel_custody.ts
+  init_define_NOMOS_KERNEL_RELEASE();
+  init_shims();
+  function browserKernelCustody(kernel, checkpoint, isCheckpointCurrent) {
+    return {
+      canRetainChanges: () => true,
+      hasLocalCustody: (workspace) => kernel.branchHead(workspace, "main") !== void 0,
+      openLocalCustody: async () => ({}),
+      ledgerFor: () => {
+        throw new Error("Browser Git custody is opened in place; there is no second local ledger");
+      },
+      async retainFrontier(effect) {
+        await checkpoint();
+        const retained = !!effect.head && kernel.branchHead(effect.workspace, effect.branch) === effect.head && effect.refs.every((ref) => kernel.branchHead(effect.workspace, ref.reference) === ref.oid) && isCheckpointCurrent();
+        return create(FrontierRetainedSchema, {
+          workspace: effect.workspace,
+          branch: effect.branch,
+          head: effect.head,
+          retained,
+          detail: retained ? "browser custody transaction committed" : "requested frontier differs from local custody",
+          refs: retained ? effect.refs : []
+        });
+      },
+      async persistBornCustody(effect) {
+        await checkpoint();
+        return create(PersistBornCustodyReceiptSchema, {
+          children: effect.children.map((born) => {
+            const workspace = born.child?.workspace ?? "";
+            const head = born.child?.head ?? "";
+            const persisted = !!workspace && !!head && kernel.branchHead(workspace, "main") === head && born.publication.every((item) => item.ref && kernel.branchHead(workspace, item.ref.reference) === item.ref.oid) && isCheckpointCurrent();
+            return create(PersistedBornCustodySchema, {
+              workspace,
+              head,
+              persisted,
+              refs: persisted ? born.publication.map((item) => item.ref) : [],
+              detail: persisted ? "born custody transaction committed" : "local custody does not contain the born frontier"
+            });
+          })
+        });
+      }
+    };
+  }
+
+  // ../../platform-shells/browser/runtime_fetch.ts
+  init_define_NOMOS_KERNEL_RELEASE();
+  init_shims();
+  function browserRuntimeFetch(base, fetchImpl, caches) {
+    const root = base.replace(/\/+$/, "");
+    return async (input, init) => {
+      const url = String(input);
+      const bootArtifact = url === `${root}/v1/runtime/repository.xml` || url === `${root}/v1/runtime/nomos.law.usdz`;
+      if (!bootArtifact || !caches) return fetchImpl(input, init);
+      const cache = await caches.open("nomos-browser-boot-v1");
+      let response;
+      try {
+        response = await fetchImpl(input, { ...init, signal: init?.signal ?? AbortSignal.timeout(15e3) });
+      } catch (error) {
+        const retained = await cache.match(url);
+        if (retained) return retained;
+        throw error;
+      }
+      if (response.ok) await cache.put(url, response.clone());
+      return response;
+    };
+  }
+
   // ../../adapter/proto/nomos/runtime/v2/runtime_pb.js
   init_define_NOMOS_KERNEL_RELEASE();
   init_shims();
@@ -9630,6 +9722,15 @@
     };
     return {
       preopen,
+      snapshot() {
+        const entries = [];
+        const visit = (path, node) => {
+          if (path !== "/work") entries.push({ path, ...node.data ? { bytes: node.data.slice() } : {} });
+          for (const [name, child] of node.contents ?? []) visit(`${path}/${name}`, child);
+        };
+        visit("/work", preopen.dir);
+        return entries;
+      },
       files,
       fs: makeGitFs(
         preopen,
@@ -9815,8 +9916,7 @@
     if (response.outcome.case !== "custody" || response.outcome.value.operation.case !== "lawClosureInfo" || !response.outcome.value.operation.value.identity)
       throw new Error(`kernel refused USDA closure ${closureFile}`);
   };
-  async function createKernelMachine(source) {
-    const filesystem = memoryCustodyFilesystem();
+  async function createKernelMachine(source, filesystem = memoryCustodyFilesystem(), onFilesystemMutation) {
     const machine = await createKernelMachineWithHost(source, (pushStderr) => {
       const wasi = new WASI(
         ["wasm_git_holon", "reactor"],
@@ -9830,6 +9930,30 @@
         ],
         { debug: false }
       );
+      if (onFilesystemMutation) {
+        const imports = wasi.wasiImport;
+        for (const name of [
+          "fd_write",
+          "fd_pwrite",
+          "fd_allocate",
+          "fd_filestat_set_size",
+          "path_open",
+          "path_create_directory",
+          "path_unlink_file",
+          "path_remove_directory",
+          "path_rename",
+          "path_link",
+          "path_symlink"
+        ]) {
+          const original = imports[name];
+          if (!original) continue;
+          imports[name] = (...args) => {
+            const result = original(...args);
+            if (result === 0 && !(name === "fd_write" && Number(args[0]) < 3) && !(name === "path_open" && (Number(args[4]) & 9) === 0)) onFilesystemMutation();
+            return result;
+          };
+        }
+      }
       return {
         filesystem,
         imports: unsignedWasiPointers(
@@ -10069,7 +10193,7 @@
               case: "resolveRef",
               value: create(ResolveRefRequestSchema, {
                 repo: workspaceRepositoryPath(workspace),
-                reference: `refs/heads/${branch}`
+                reference: branch.startsWith("refs/") ? branch : `refs/heads/${branch}`
               })
             }
           })
@@ -11056,7 +11180,6 @@
         return acquired;
       },
       deepenMain(workspace, ledger) {
-        if (ledger.operatorCustody !== true) return Promise.resolve({ changed: false, complete: true });
         return acquiring(workspace, ledger, "deepen-main", async () => {
           if (resolveRef(workspace, branchRef("main")) === void 0) {
             const acquired = await acquireMain(workspace, ledger);
@@ -11250,45 +11373,189 @@
     return desk;
   }
 
-  // ../src/runtime/peer_desk_store.ts
+  // ../../platform-shells/browser/custody_store.ts
   init_define_NOMOS_KERNEL_RELEASE();
   init_shims();
-  var recordId = (namespace, key) => `${namespace.length}:${namespace}${key}`;
-  var copy = (record) => ({
-    ...record,
-    value: record.value.slice()
-  });
-  var _records;
-  var MemoryPeerDeskStore = class {
-    constructor() {
+  var copyRecord = (record) => ({ ...record, value: record.value.slice() });
+  var keyOf = (namespace, key) => JSON.stringify([namespace, key]);
+  var _backend, _records, _revision, _committed, _queued, _failure, _closed;
+  var _BrowserCustodyStore = class _BrowserCustodyStore {
+    constructor(backend, snapshot) {
+      __publicField(this, "filesystem", memoryCustodyFilesystem());
+      __publicField(this, "replica");
+      __publicField(this, "identity");
+      __privateAdd(this, _backend);
       __privateAdd(this, _records, /* @__PURE__ */ new Map());
+      __privateAdd(this, _revision, 0);
+      __privateAdd(this, _committed, -1);
+      __privateAdd(this, _queued);
+      __privateAdd(this, _failure);
+      __privateAdd(this, _closed, false);
+      __publicField(this, "changed", () => {
+        this.assertUsable();
+        __privateWrapper(this, _revision)._++;
+        void this.checkpoint().catch(() => {
+        });
+      });
+      __privateSet(this, _backend, backend);
+      if (snapshot && snapshot.format !== 1) throw new Error("Unsupported browser custody format; keep this site's data and update the application.");
+      this.replica = snapshot?.replica ?? globalThis.crypto.getRandomValues(new BigUint64Array(1))[0] & (1n << 63n) - 1n;
+      this.identity = snapshot?.identity ?? `browser-${globalThis.crypto.randomUUID()}`;
+      for (const entry of snapshot?.files ?? []) {
+        if (entry.bytes === void 0) this.filesystem.files.mkdir(entry.path);
+        else this.filesystem.files.writeFile(entry.path, entry.bytes);
+      }
+      for (const record of snapshot?.records ?? []) __privateGet(this, _records).set(keyOf(record.namespace, record.key), copyRecord(record));
+      for (const name of ["mkdir", "writeFile", "unlink"]) {
+        const original = this.filesystem.files[name].bind(this.filesystem.files);
+        this.filesystem.files[name] = (...args) => {
+          this.assertUsable();
+          const result = original(...args);
+          this.changed();
+          return result;
+        };
+      }
+      const promises = this.filesystem.fs.promises;
+      const mkdir = promises.mkdir.bind(promises);
+      const writeFile = promises.writeFile.bind(promises);
+      promises.mkdir = async (path) => {
+        this.assertUsable();
+        const result = await mkdir(path);
+        this.changed();
+        return result;
+      };
+      promises.writeFile = async (path, bytes) => {
+        this.assertUsable();
+        const result = await writeFile(path, bytes);
+        this.changed();
+        return result;
+      };
+    }
+    static async open(backend) {
+      try {
+        return new _BrowserCustodyStore(backend, await backend.load());
+      } catch (error) {
+        backend.close();
+        throw error;
+      }
+    }
+    assertUsable() {
+      if (__privateGet(this, _failure)) throw new Error("Browser custody could not be saved. Keep this tab open, free storage space, and reload only after recovery.", { cause: __privateGet(this, _failure) });
+      if (__privateGet(this, _closed)) throw new Error("Browser custody is closed");
     }
     list(namespace) {
-      return [...__privateGet(this, _records).values()].filter((record) => record.namespace === namespace).sort((left, right) => left.key.localeCompare(right.key)).map(copy);
+      this.assertUsable();
+      return [...__privateGet(this, _records).values()].filter((record) => record.namespace === namespace).sort((a, b) => a.key.localeCompare(b.key)).map(copyRecord);
     }
-    compareExchange(namespace, key, expectedRevision, value) {
-      const id = recordId(namespace, key);
+    compareExchange(namespace, key, expected, value) {
+      this.assertUsable();
+      const id = keyOf(namespace, key);
       const current = __privateGet(this, _records).get(id);
-      if (current?.revision !== expectedRevision) {
-        throw new Error(
-          `peer desk record '${namespace}/${key}' changed at revision ${current?.revision ?? "absent"}`
-        );
-      }
-      if (value === void 0) {
-        __privateGet(this, _records).delete(id);
-        return void 0;
+      if (current?.revision !== expected) throw new Error(`peer desk record '${namespace}/${key}' changed at revision ${current?.revision ?? "absent"}`);
+      const next = value === void 0 ? void 0 : { namespace, key, revision: (current?.revision ?? 0n) + 1n, value: value.slice() };
+      if (next) __privateGet(this, _records).set(id, next);
+      else __privateGet(this, _records).delete(id);
+      this.changed();
+      return next && copyRecord(next);
+    }
+    checkpoint() {
+      this.assertUsable();
+      if (!__privateGet(this, _queued)) {
+        __privateSet(this, _queued, Promise.resolve().then(async () => {
+          while (__privateGet(this, _committed) !== __privateGet(this, _revision)) {
+            const revision = __privateGet(this, _revision);
+            const snapshot = {
+              format: 1,
+              replica: this.replica,
+              identity: this.identity,
+              files: this.filesystem.snapshot(),
+              records: [...__privateGet(this, _records).values()].map(copyRecord)
+            };
+            await __privateGet(this, _backend).commit(snapshot);
+            __privateSet(this, _committed, revision);
+          }
+        }).catch((error) => {
+          __privateSet(this, _failure, error);
+          throw error;
+        }).finally(() => {
+          __privateSet(this, _queued, void 0);
+        }));
       }
-      const next = Object.freeze({
-        namespace,
-        key,
-        revision: (current?.revision ?? 0n) + 1n,
-        value: value.slice()
+      return __privateGet(this, _queued).then(() => {
+        if (__privateGet(this, _committed) !== __privateGet(this, _revision)) return this.checkpoint();
       });
-      __privateGet(this, _records).set(id, next);
-      return copy(next);
+    }
+    isCheckpointCurrent() {
+      return !__privateGet(this, _failure) && !__privateGet(this, _closed) && __privateGet(this, _committed) === __privateGet(this, _revision);
+    }
+    async close() {
+      await this.checkpoint();
+      __privateSet(this, _closed, true);
+      __privateGet(this, _backend).close();
     }
   };
+  _backend = new WeakMap();
   _records = new WeakMap();
+  _revision = new WeakMap();
+  _committed = new WeakMap();
+  _queued = new WeakMap();
+  _failure = new WeakMap();
+  _closed = new WeakMap();
+  var BrowserCustodyStore = _BrowserCustodyStore;
+  async function openBrowserCustody(base) {
+    if (!globalThis.indexedDB || !globalThis.navigator?.locks) throw new Error("Durable browser custody needs IndexedDB and Web Locks. Use a supported browser on HTTPS and allow site storage.");
+    const name = `nomos-custody-v1:${base.replace(/\/+$/, "")}`;
+    let release;
+    let acquired;
+    let refuse;
+    const ready = new Promise((resolve, reject) => {
+      acquired = resolve;
+      refuse = reject;
+    });
+    const held = new Promise((resolve) => {
+      release = resolve;
+    });
+    void navigator.locks.request(name, { ifAvailable: true }, async (lock) => {
+      if (!lock) {
+        refuse(new Error("This application's workspace is open in another tab. Close that tab and retry; your saved data is preserved."));
+        return;
+      }
+      acquired();
+      await held;
+    }).catch(refuse);
+    await ready;
+    let db;
+    try {
+      db = await new Promise((resolve, reject) => {
+        const request = indexedDB.open(name, 1);
+        request.onupgradeneeded = () => request.result.createObjectStore("custody");
+        request.onsuccess = () => resolve(request.result);
+        request.onerror = () => reject(request.error);
+        request.onblocked = () => reject(new Error("Browser custody upgrade is blocked by another tab. Close it and retry."));
+      });
+    } catch (error) {
+      release();
+      throw error;
+    }
+    return BrowserCustodyStore.open({
+      load: () => new Promise((resolve, reject) => {
+        const tx = db.transaction("custody", "readonly");
+        const read = tx.objectStore("custody").get("current");
+        tx.oncomplete = () => resolve(read.result);
+        tx.onabort = () => reject(tx.error ?? new Error("Browser custody read aborted"));
+      }),
+      commit: (snapshot) => new Promise((resolve, reject) => {
+        const tx = db.transaction("custody", "readwrite", { durability: "strict" });
+        tx.objectStore("custody").put(snapshot, "current");
+        tx.oncomplete = () => resolve();
+        tx.onabort = () => reject(tx.error ?? new Error("Browser custody transaction aborted"));
+      }),
+      close: () => {
+        db.close();
+        release();
+      }
+    });
+  }
 
   // ../../platform-shells/shared/peer_office_host.ts
   init_define_NOMOS_KERNEL_RELEASE();
@@ -13883,7 +14150,7 @@
   _material = new WeakMap();
 
   // ../src/runtime/credential_sessions.ts
-  var copy2 = (bytes) => bytes.slice();
+  var copy = (bytes) => bytes.slice();
   var _bindings, _vault, _clock3, _contexts, _CredentialSessions_instances, refreshCapability_fn, applyProof_fn, authorSecret_fn;
   var CredentialSessions = class {
     constructor(bindings, vault, clock) {
@@ -13963,7 +14230,7 @@
       if (secret.byteLength !== 32) {
         throw new Error(`session '${session}' has a malformed enrolled-device signing capability`);
       }
-      return copy2(secret);
+      return copy(secret);
     }
     /** Whether this office's shell declared it a custodian by supplying its admission workload key. */
     holdsOfficeAdmissionKey() {
@@ -13977,7 +14244,7 @@
         throw new Error("this office holds recipient custody but its shell supplied no admission workload key");
       }
       if (secret.byteLength !== 32) throw new Error("this office's admission workload key is malformed");
-      return copy2(secret);
+      return copy(secret);
     }
     authToken(session) {
       const capability = __privateGet(this, _bindings).credentialCapabilityFor(session);
@@ -13986,13 +14253,13 @@
     /** Background replica work names the durable capability directly; it does
      * not manufacture an interaction session merely to reach the same vault. */
     authTokenForCapability(capability) {
-      return copy2(__privateGet(this, _vault).authToken(capability) ?? new Uint8Array());
+      return copy(__privateGet(this, _vault).authToken(capability) ?? new Uint8Array());
     }
     /** Background replica recovery addresses the durable capability directly;
      * this is the same vault slot an interaction session would select. */
     authorSecretForCapabilityIfPresent(capability) {
       const secret = __privateGet(this, _vault).authorSecret(capability);
-      return secret === void 0 || secret.byteLength === 0 ? void 0 : copy2(secret);
+      return secret === void 0 || secret.byteLength === 0 ? void 0 : copy(secret);
     }
     /** The enrolled-device secret the session's capability holds, if any; a device challenge derives from it. */
     authorSecretIfPresent(session) {
@@ -18233,7 +18500,7 @@
   // ../src/runtime/read_maintenance_desk.ts
   init_define_NOMOS_KERNEL_RELEASE();
   init_shims();
-  var _queries3, _sessions5, _trace6, _observer, _clock6, _pending, _sequence8, _revision, _ReadMaintenanceDesk_instances, schedule_fn, nextDelay_fn;
+  var _queries3, _sessions5, _trace6, _observer, _clock6, _pending, _sequence8, _revision2, _ReadMaintenanceDesk_instances, schedule_fn, nextDelay_fn;
   var ReadMaintenanceDesk = class {
     constructor(queries, sessions, trace, clock, observer = {}) {
       __privateAdd(this, _ReadMaintenanceDesk_instances);
@@ -18244,7 +18511,7 @@
       __privateAdd(this, _clock6);
       __privateAdd(this, _pending, /* @__PURE__ */ new Map());
       __privateAdd(this, _sequence8, 0n);
-      __privateAdd(this, _revision, 0);
+      __privateAdd(this, _revision2, 0);
       __privateSet(this, _queries3, queries);
       __privateSet(this, _sessions5, sessions);
       __privateSet(this, _trace6, trace);
@@ -18295,7 +18562,7 @@
           })
         });
       }
-      __privateSet(this, _revision, __privateGet(this, _revision) + 1);
+      __privateSet(this, _revision2, __privateGet(this, _revision2) + 1);
       __privateGet(this, _observer).readReady?.(workspace);
     }
     /**
@@ -18396,7 +18663,7 @@
         const format = localCopyFormatRefusal(error);
         if (format !== void 0) {
           __privateGet(this, _pending).delete(workspace);
-          __privateSet(this, _revision, __privateGet(this, _revision) + 1);
+          __privateSet(this, _revision2, __privateGet(this, _revision2) + 1);
           __privateGet(this, _observer).localCopyUnreadable?.(workspace, format);
           __privateGet(this, _trace6).emit(demand.session, {
             case: "maintenanceProgress",
@@ -18437,20 +18704,20 @@
     }
     /** Drop any demand for a workspace no maintenance can serve (an unreadable copy). */
     forget(workspace) {
-      if (__privateGet(this, _pending).delete(workspace)) __privateSet(this, _revision, __privateGet(this, _revision) + 1);
+      if (__privateGet(this, _pending).delete(workspace)) __privateSet(this, _revision2, __privateGet(this, _revision2) + 1);
     }
     hasPending() {
       return __privateGet(this, _pending).size > 0;
     }
     get revision() {
-      return __privateGet(this, _revision);
+      return __privateGet(this, _revision2);
     }
     pendingWorkspaces() {
       return new Set(__privateGet(this, _pending).keys());
     }
     clear() {
       __privateGet(this, _pending).clear();
-      __privateSet(this, _revision, __privateGet(this, _revision) + 1);
+      __privateSet(this, _revision2, __privateGet(this, _revision2) + 1);
     }
   };
   _queries3 = new WeakMap();
@@ -18460,7 +18727,7 @@
   _clock6 = new WeakMap();
   _pending = new WeakMap();
   _sequence8 = new WeakMap();
-  _revision = new WeakMap();
+  _revision2 = new WeakMap();
   _ReadMaintenanceDesk_instances = new WeakSet();
   schedule_fn = function(workspace, cause, session, command, awaited = false) {
     if (__privateGet(this, _observer).isLocalCopyUnreadable?.(workspace)) return;
@@ -18488,7 +18755,7 @@
       for (const [key, value] of entries.filter(([key2]) => key2 === workspace)) __privateGet(this, _pending).set(key, value);
       for (const [key, value] of entries.filter(([key2]) => key2 !== workspace)) __privateGet(this, _pending).set(key, value);
     }
-    __privateSet(this, _revision, __privateGet(this, _revision) + 1);
+    __privateSet(this, _revision2, __privateGet(this, _revision2) + 1);
     if (!existing || existing.read?.cause !== read?.cause || existing.background?.cause !== background?.cause) {
       __privateGet(this, _trace6).emit(session ?? existing?.session, {
         case: "maintenanceProgress",
@@ -20817,10 +21084,11 @@
         failures: 0,
         origin,
         publisher: !binding.cloudBound,
-        published: !binding.cloudBound ? head : void 0
+        published: !binding.cloudBound ? head : void 0,
+        wasResident: this.kernel.isResident(binding.workspace) !== false
       };
       __privateGet(this, _links).set(binding.workspace, link);
-      __privateMethod(this, _LiveCorrespondenceDesk_instances, open_fn2).call(this, link);
+      if (link.wasResident) __privateMethod(this, _LiveCorrespondenceDesk_instances, open_fn2).call(this, link);
     }
     changed(workspace) {
       const link = __privateGet(this, _links).get(workspace);
@@ -20934,9 +21202,11 @@
       let wake;
       for (const link of __privateGet(this, _links).values()) {
         if (this.kernel.isResident(link.binding.workspace) === false) {
-          this.disconnect(link.binding.workspace);
+          if (link.wasResident) this.disconnect(link.binding.workspace);
+          else wake = wake === void 0 || wake > 250n ? 250n : wake;
           continue;
         }
+        link.wasResident = true;
         if (link.state === "opening" && now >= link.due) {
           __privateMethod(this, _LiveCorrespondenceDesk_instances, effect_fn).call(this, link, { case: "close", value: true });
           link.state = "closed";
@@ -21019,11 +21289,11 @@
   // ../src/runtime/peer_lifecycle.ts
   init_define_NOMOS_KERNEL_RELEASE();
   init_shims();
-  var _events3, _closed;
+  var _events3, _closed2;
   var PeerLifecycle = class {
     constructor(events, runtimeVersion) {
       __privateAdd(this, _events3);
-      __privateAdd(this, _closed, false);
+      __privateAdd(this, _closed2, false);
       __privateSet(this, _events3, events);
       __privateGet(this, _events3).emit(void 0, {
         case: "ready",
@@ -21037,21 +21307,21 @@
       });
     }
     assertAccepting(request) {
-      if (__privateGet(this, _closed) && request.command.case !== "closeRealm") {
+      if (__privateGet(this, _closed2) && request.command.case !== "closeRealm") {
         throw new Error("Nomos peer runtime is closed");
       }
     }
     close() {
-      if (__privateGet(this, _closed)) return false;
-      __privateSet(this, _closed, true);
+      if (__privateGet(this, _closed2)) return false;
+      __privateSet(this, _closed2, true);
       return true;
     }
     get closed() {
-      return __privateGet(this, _closed);
+      return __privateGet(this, _closed2);
     }
   };
   _events3 = new WeakMap();
-  _closed = new WeakMap();
+  _closed2 = new WeakMap();
 
   // ../src/runtime/records_desk.ts
   init_define_NOMOS_KERNEL_RELEASE();
@@ -21541,6 +21811,46 @@
   init_define_NOMOS_KERNEL_RELEASE();
   init_shims();
 
+  // ../src/runtime/peer_desk_store.ts
+  init_define_NOMOS_KERNEL_RELEASE();
+  init_shims();
+  var recordId = (namespace, key) => `${namespace.length}:${namespace}${key}`;
+  var copy2 = (record) => ({
+    ...record,
+    value: record.value.slice()
+  });
+  var _records2;
+  var MemoryPeerDeskStore = class {
+    constructor() {
+      __privateAdd(this, _records2, /* @__PURE__ */ new Map());
+    }
+    list(namespace) {
+      return [...__privateGet(this, _records2).values()].filter((record) => record.namespace === namespace).sort((left, right) => left.key.localeCompare(right.key)).map(copy2);
+    }
+    compareExchange(namespace, key, expectedRevision, value) {
+      const id = recordId(namespace, key);
+      const current = __privateGet(this, _records2).get(id);
+      if (current?.revision !== expectedRevision) {
+        throw new Error(
+          `peer desk record '${namespace}/${key}' changed at revision ${current?.revision ?? "absent"}`
+        );
+      }
+      if (value === void 0) {
+        __privateGet(this, _records2).delete(id);
+        return void 0;
+      }
+      const next = Object.freeze({
+        namespace,
+        key,
+        revision: (current?.revision ?? 0n) + 1n,
+        value: value.slice()
+      });
+      __privateGet(this, _records2).set(id, next);
+      return copy2(next);
+    }
+  };
+  _records2 = new WeakMap();
+
   // ../src/runtime/correspondence_recovery.ts
   init_define_NOMOS_KERNEL_RELEASE();
   init_shims();
@@ -26967,7 +27277,7 @@
   }
   var INTERACTIVE_PEER_CLASSES = /* @__PURE__ */ new Set(["personal-device", "browser"]);
   var INTERACTION_FIRST_MILLIS = 15e3;
-  var _kernel25, _sessions14, _interactivePeer, _interaction, _trace13, _credentials7, _credentialRecovery, _deviceIdentity, _receivingGroup2, _modelAdoption, _deviceChallenges, _enrolledCapabilities, _custody4, _readability3, _origins5, _seat2, _custodyAdmission, _correspondence3, _birthCustody, _placement5, _access, _identity2, _custodianPlacement, _identityRecovery, _queries8, _application3, _compatibility2, _custodyVerification, _commandPreparation, _applicationReadiness, _authenticationReadiness, _lawPackages, _readMaintenance, _readResponses, _residency4, _residencyPins, _subscriptions5, _follows3, _replicaInventory, _placementDiscovery2, _live3, _records2, _historicQueries, _authoringPreflight, _recovery, _lifecycle, _maintenance2, _background2, _paperSlots, _retentionObserver, _admissionDurability, _historyAcquisition, _responses, _PeerOffice_instances, fenced_fn, handleRequest_fn, localCopyUnreadable_fn, probeLocalCopyFormat_fn, protectedResidents_fn, bindInteraction_fn, keepCustodianPlacement_fn, dispatchRequest_fn, historyCredentialCapability_fn, preferredCredentialCapability_fn, correspondenceResponse_fn, authenticationReadinessResponse_fn, completedKernelCall_fn, modelAdoptionResponse_fn, receivingGroupResponse_fn, deviceIdentityResponse_fn, deviceChallengeFor_fn, deviceChallengeForCapability_fn, credentialRecoveryResponse_fn, afterCredentialKernelCall_fn, acknowledgedWhenDurable_fn, admissionDurabilityResponse_fn, birthCustodyResponse_fn, identityResponse_fn, identityRecoveryResponse_fn, response_fn, failure_fn, custodyRequired_fn, kernelResidencyRequired_fn, candidateCustodyRequired_fn;
+  var _kernel25, _sessions14, _interactivePeer, _interaction, _trace13, _credentials7, _credentialRecovery, _deviceIdentity, _receivingGroup2, _modelAdoption, _deviceChallenges, _enrolledCapabilities, _custody4, _readability3, _origins5, _seat2, _custodyAdmission, _correspondence3, _birthCustody, _placement5, _access, _identity2, _custodianPlacement, _identityRecovery, _queries8, _application3, _compatibility2, _custodyVerification, _commandPreparation, _applicationReadiness, _authenticationReadiness, _lawPackages, _readMaintenance, _readResponses, _residency4, _residencyPins, _subscriptions5, _follows3, _replicaInventory, _placementDiscovery2, _live3, _records3, _historicQueries, _authoringPreflight, _recovery, _lifecycle, _maintenance2, _background2, _paperSlots, _retentionObserver, _admissionDurability, _historyAcquisition, _responses, _PeerOffice_instances, fenced_fn, handleRequest_fn, localCopyUnreadable_fn, probeLocalCopyFormat_fn, protectedResidents_fn, bindInteraction_fn, keepCustodianPlacement_fn, dispatchRequest_fn, historyCredentialCapability_fn, preferredCredentialCapability_fn, correspondenceResponse_fn, authenticationReadinessResponse_fn, completedKernelCall_fn, modelAdoptionResponse_fn, receivingGroupResponse_fn, deviceIdentityResponse_fn, deviceChallengeFor_fn, deviceChallengeForCapability_fn, credentialRecoveryResponse_fn, afterCredentialKernelCall_fn, acknowledgedWhenDurable_fn, admissionDurabilityResponse_fn, birthCustodyResponse_fn, identityResponse_fn, identityRecoveryResponse_fn, response_fn, failure_fn, custodyRequired_fn, kernelResidencyRequired_fn, candidateCustodyRequired_fn;
   var PeerOffice = class {
     constructor(kernel, credentials, profile, observations, custodyStorage, peerDeskStore) {
       __privateAdd(this, _PeerOffice_instances);
@@ -27019,7 +27329,7 @@
       __privateAdd(this, _replicaInventory);
       __privateAdd(this, _placementDiscovery2);
       __privateAdd(this, _live3);
-      __privateAdd(this, _records2);
+      __privateAdd(this, _records3);
       __privateAdd(this, _historicQueries);
       __privateAdd(this, _authoringPreflight);
       __privateAdd(this, _recovery);
@@ -27273,7 +27583,7 @@
           command.criterion === AuthenticationReadinessCriterion.BIRTH_EVIDENCE
         )
       ));
-      __privateSet(this, _records2, new RecordsDesk(
+      __privateSet(this, _records3, new RecordsDesk(
         __privateGet(this, _kernel25),
         __privateGet(this, _queries8),
         __privateGet(this, _sessions14),
@@ -27727,7 +28037,7 @@
   _replicaInventory = new WeakMap();
   _placementDiscovery2 = new WeakMap();
   _live3 = new WeakMap();
-  _records2 = new WeakMap();
+  _records3 = new WeakMap();
   _historicQueries = new WeakMap();
   _authoringPreflight = new WeakMap();
   _recovery = new WeakMap();
@@ -28100,29 +28410,29 @@
         case "listWorkspaceMoments":
           return __privateMethod(this, _PeerOffice_instances, response_fn).call(this, request, {
             case: "workspaceMoments",
-            value: __privateGet(this, _records2).moments(request, request.command.value)
+            value: __privateGet(this, _records3).moments(request, request.command.value)
           });
         case "estimateWorkspaceTransfer":
           return __privateMethod(this, _PeerOffice_instances, response_fn).call(this, request, {
             case: "workspaceTransferEstimate",
-            value: __privateGet(this, _records2).transferEstimate(request, request.command.value)
+            value: __privateGet(this, _records3).transferEstimate(request, request.command.value)
           });
         case "readWorkspaceGenesis":
           return __privateMethod(this, _PeerOffice_instances, response_fn).call(this, request, {
             case: "workspaceGenesis",
-            value: __privateGet(this, _records2).genesis(request, request.command.value)
+            value: __privateGet(this, _records3).genesis(request, request.command.value)
           });
         case "listChildWorkspaces":
           return __privateMethod(this, _PeerOffice_instances, response_fn).call(this, request, {
             case: "childWorkspaces",
-            value: __privateGet(this, _records2).children(request, request.command.value)
+            value: __privateGet(this, _records3).children(request, request.command.value)
           });
         // The kernel still answers this in its transitional value arm; the desk
         // decodes it once so no client infers a version status for itself.
         case "checkReferenceVersions":
           return __privateMethod(this, _PeerOffice_instances, response_fn).call(this, request, {
             case: "referenceVersions",
-            value: __privateGet(this, _records2).referenceVersions(request, request.command.value)
+            value: __privateGet(this, _records3).referenceVersions(request, request.command.value)
           });
         // A naming answer, not a custody read: it binds no session and mounts
         // nothing, so a client can ask which workspace a keyed birth addresses
@@ -28937,7 +29247,7 @@
       });
     }
   };
-  async function drivePeerFrame(runner, initialFrame, fetchImpl = globalThis.fetch, custody, bornCustody, credentialRefresh, yieldWakeToCaller = false, deviceIdentity, lawPackage, yieldLocalReadToCaller = false, yieldHistoryToCaller = false) {
+  async function drivePeerFrame(runner, initialFrame, fetchImpl = globalThis.fetch, custody, bornCustody, credentialRefresh, yieldWakeToCaller = false, deviceIdentity, lawPackage, yieldLocalReadToCaller = false, yieldHistoryToCaller = false, performExternalEffect) {
     const persistBornCustody = bornCustody ?? (custody?.persistBornCustody ? (effect) => custody.persistBornCustody(effect) : void 0);
     let responseFrame = runner.handleFrame(initialFrame);
     const satisfied = /* @__PURE__ */ new Set();
@@ -29073,12 +29383,10 @@
       if (pending.effect.case === "historyAcquisition" && (yieldHistoryToCaller || !custody?.advanceHistory)) {
         return responseFrame;
       }
-      if (pending.effect.case === "refreshCredential" && credentialRefresh === externalPeerEffect) return responseFrame;
-      if (pending.effect.case === "deviceIdentity" && deviceIdentity === externalPeerEffect) return responseFrame;
-      if (pending.effect.case === "lawPackage" && lawPackage === externalPeerEffect) return responseFrame;
       if (pending.effect.case === "wake" && yieldWakeToCaller) return responseFrame;
-      if (pending.effect.case === "consoleEnrolment") return responseFrame;
-      const receipt = pending.effect.case === "http" ? await executeHttpEffect(pending.effect.value, fetchImpl) : pending.effect.case === "gitFetch" ? await executeGitFetchWithAlongside(pending.effect.value, fetchImpl) : pending.effect.case === "gitPush" ? await executeGitPushEffect(pending.effect.value, fetchImpl) : pending.effect.case === "persistBornCustody" ? create(PeerEffectReceiptSchema, {
+      const external = pending.effect.case === "refreshCredential" && credentialRefresh === externalPeerEffect || pending.effect.case === "deviceIdentity" && deviceIdentity === externalPeerEffect || pending.effect.case === "lawPackage" && lawPackage === externalPeerEffect || pending.effect.case === "consoleEnrolment";
+      if (external && !performExternalEffect) return responseFrame;
+      const receipt = external ? await performExternalEffect(pending) : pending.effect.case === "http" ? await executeHttpEffect(pending.effect.value, fetchImpl) : pending.effect.case === "gitFetch" ? await executeGitFetchWithAlongside(pending.effect.value, fetchImpl) : pending.effect.case === "gitPush" ? await executeGitPushEffect(pending.effect.value, fetchImpl) : pending.effect.case === "persistBornCustody" ? create(PeerEffectReceiptSchema, {
         effectId: pending.effect.value.effectId,
         outcome: {
           case: "bornCustodyPersisted",
@@ -29106,7 +29414,7 @@
   async function executeHistoryAcquisitionEffect(effect, custody) {
     try {
       if (!custody.advanceHistory) throw new Error("platform shell has no history acquisition capability");
-      const progress = await custody.advanceHistory(effect.workspace);
+      const progress = await custody.advanceHistory(effect.workspace, effect.credentialCapability);
       return create(PeerEffectReceiptSchema, {
         effectId: effect.effectId,
         outcome: {
@@ -29339,7 +29647,7 @@
     };
   };
   function openPeerOfficeHost(kernel, shell, fetchImpl = globalThis.fetch, maintenanceSettled, postEvent2 = () => {
-  }, credentialRefresh, yieldWakeToCaller = false, deviceIdentity, lawPackage) {
+  }, credentialRefresh, yieldWakeToCaller = false, deviceIdentity, lawPackage, performExternalEffect) {
     let runner;
     const configuredOrigins = new Set((shell.providerOrigins?.() ?? []).map((provider) => originOf(provider)).filter((origin) => origin !== void 0));
     const permittedSocket = (url) => {
@@ -29348,10 +29656,10 @@
       return origin !== void 0 && configuredOrigins.has(origin);
     };
     const sockets = socketEffects(
-      (frame) => drivePeerFrame(runner, frame, fetchImpl, shell.custodyPort(), void 0, void 0, false, deviceIdentity, lawPackage),
+      (frame) => drivePeerFrame(runner, frame, fetchImpl, shell.custodyPort(), void 0, void 0, false, deviceIdentity, lawPackage, false, false, performExternalEffect),
       permittedSocket
     );
-    const credentials = credentialEffects((frame) => drivePeerFrame(runner, frame, fetchImpl, shell.custodyPort(), void 0, credentialRefresh, false, deviceIdentity, lawPackage), credentialRefresh);
+    const credentials = credentialEffects((frame) => drivePeerFrame(runner, frame, fetchImpl, shell.custodyPort(), void 0, credentialRefresh, false, deviceIdentity, lawPackage, false, false, performExternalEffect), credentialRefresh);
     runner = createPeerOfficeFrameRunner(
       kernel,
       shell.credentials(),
@@ -29376,7 +29684,10 @@
           credentialRefresh,
           false,
           deviceIdentity,
-          lawPackage
+          lawPackage,
+          false,
+          false,
+          performExternalEffect
         );
       },
       shell.peerDeskStore()
@@ -29428,7 +29739,10 @@
           credentialRefresh,
           yieldWakeToCaller,
           deviceIdentity,
-          lawPackage
+          lawPackage,
+          false,
+          false,
+          performExternalEffect
         );
       },
       settleRetention: (withinMillis) => runner.settleRetention(withinMillis),
@@ -29537,6 +29851,7 @@
         // one constitutional genesis offer. WorkspaceAccessDesk decides whether
         // that exact request may proceed against the unborn kernel mount.
         async openCustody(workspace) {
+          if (physical.openLocalCustody) return physical.openLocalCustody(workspace);
           await custody.acquireMain(workspace, await ledgerFor(workspace));
           return {};
         },
@@ -29552,7 +29867,12 @@
         },
         persistBornCustody: (effect) => physical.persistBornCustody(effect),
         retainFrontier: (effect) => physical.retainFrontier(effect),
-        ...physical.completeHistoryInLocalCustody ? {
+        ...physical.advanceHistory ? {
+          advanceHistory: (workspace, capability) => {
+            const credential = capability ? __privateGet(this, _credentials8).authToken(capability) : authToken;
+            return physical.advanceHistory(workspace, credential && new TextDecoder().decode(credential));
+          }
+        } : physical.completeHistoryInLocalCustody ? {
           // The kernel mounts a shallow working copy; the peer's own Git custody is deep.
           // One bounded slice per call; the Peer Office decides whether and when to take the next.
           async advanceHistory(workspace) {
@@ -34689,92 +35009,72 @@
   }
 
   // ../../platform-shells/browser/peer.ts
-  var randomReplica = () => {
-    const bytes = globalThis.crypto.getRandomValues(new Uint8Array(8));
-    let value = 0n;
-    for (const byte of bytes) value = value << 8n | BigInt(byte);
-    return value & (1n << 63n) - 1n;
-  };
   async function openBrowserPeer(options) {
-    const fetchImpl = options.fetchImpl ?? globalThis.fetch.bind(globalThis);
-    const selected = await selectReleaseKernel({
-      base: options.base,
-      release: options.release,
-      fetchImpl: (input, init) => fetchImpl(input, init),
-      cache: options.kernelCache
-    });
-    const machine = await createKernelMachine({
-      wasmModule: await WebAssembly.compile(selected.wasm),
-      bootstrapLawUsdz: selected.bootstrapLaw,
-      nomosLawUsdz: selected.controllerLaw,
-      replica: options.replica ?? randomReplica(),
-      trustRootPublicKey: options.trustRootPublicKey
-    });
-    const kernel = kernelExecutionDesk(machine);
-    const custodyDesk = gitCustodyDesk(kernel, fetchImpl);
-    const kernelStore = {
-      // The current browser store is writable but session-local. This capability
-      // must not be presented as proof of persistence across browser restarts.
-      canRetainChanges: () => true,
-      hasLocalCustody: (workspace) => kernel.isResident(workspace),
-      retainFrontier: async (effect) => ({
-        $typeName: "nomos.runtime.v2.FrontierRetained",
-        workspace: effect.workspace,
-        branch: effect.branch,
-        head: effect.head,
-        retained: false,
-        detail: "browser peer has no durable local custody",
-        refs: []
-      }),
-      ledgerFor: (workspace) => {
-        throw new Error(`browser peer holds no ledger for '${workspace}' beside the custodian`);
-      },
-      // A born child already lives in the kernel's own Git store; persisting it means witnessing that.
-      persistBornCustody: async (effect) => create(PersistBornCustodyReceiptSchema, {
-        children: effect.children.map((born) => {
-          const workspace = born.child?.workspace ?? "";
-          const head = born.child?.head ?? "";
-          const persisted = workspace.length > 0 && head.length > 0 && kernel.branchHead(workspace, "main") === head && born.publication.every((item) => item.ref && kernel.branchHead(workspace, item.ref.reference) === item.ref.oid);
-          return create(PersistedBornCustodySchema, {
-            workspace,
-            head,
-            persisted,
-            refs: persisted ? born.publication.map((item) => item.ref) : [],
-            detail: persisted ? "born custody already persisted by the kernel's Git custody" : "the kernel's Git custody does not contain the born frontier"
-          });
-        })
-      })
-    };
-    const shell = new PeerPlatformShell(
-      custodyDesk,
-      withWorkspaceDiscovery(kernelStore, {
+    const storage = options.custodyStore ?? await openBrowserCustody(options.base);
+    try {
+      const fetchImpl = options.fetchImpl ?? globalThis.fetch.bind(globalThis);
+      const selected = await selectReleaseKernel({
+        base: options.base,
+        release: options.release,
+        fetchImpl: browserRuntimeFetch(options.base, fetchImpl, globalThis.caches),
+        cache: options.kernelCache
+      });
+      const machine = await createKernelMachine({
+        wasmModule: await WebAssembly.compile(selected.wasm),
+        bootstrapLawUsdz: selected.bootstrapLaw,
+        nomosLawUsdz: selected.controllerLaw,
+        replica: options.replica ?? storage.replica,
+        trustRootPublicKey: options.trustRootPublicKey
+      }, storage.filesystem, storage.changed);
+      const kernel = kernelExecutionDesk(machine);
+      const custodyDesk = gitCustodyDesk(kernel, fetchImpl);
+      const kernelStore = browserKernelCustody(kernel, () => storage.checkpoint(), () => storage.isCheckpointCurrent());
+      const physical = withWorkspaceDiscovery(kernelStore, {
         providers: options.discoveryProviders ?? [options.base],
         fetch: (input, init) => fetchImpl(input, init)
-      }),
-      options.profile,
-      void 0,
-      // Deliberately explicit until the browser shell grows a durable adapter.
-      // Production native hosts cannot fall through to this implementation.
-      new MemoryPeerDeskStore()
-    );
-    const office = openPeerOfficeHost(
-      kernel,
-      shell,
-      fetchImpl,
-      void 0,
-      options.postEvent,
-      options.credentialRefresh,
-      false,
-      options.deviceIdentity,
-      options.lawPackage
-    );
-    return {
-      invoke: (frame) => office.invoke({
-        workspace: fromBinary(RuntimeRequestSchema, frame).target?.workspace,
-        requestBytes: frame
-      }),
-      close: () => office.close()
-    };
+      });
+      physical.advanceHistory = browserHistoryCustody(custodyDesk, physical.discovery, options.discoveryProviders ?? [options.base], fetchImpl);
+      const shell = new PeerPlatformShell(
+        custodyDesk,
+        physical,
+        { ...options.profile, identity: storage.identity },
+        void 0,
+        { list: (namespace) => storage.list(namespace), compareExchange: (...args) => storage.compareExchange(...args) }
+      );
+      const office = openPeerOfficeHost(
+        kernel,
+        shell,
+        fetchImpl,
+        void 0,
+        options.postEvent,
+        options.credentialRefresh,
+        false,
+        options.deviceIdentity,
+        options.lawPackage,
+        options.performExternalEffect
+      );
+      return {
+        invoke: async (frame) => {
+          storage.assertUsable();
+          const result = await office.invoke({
+            workspace: fromBinary(RuntimeRequestSchema, frame).target?.workspace,
+            requestBytes: frame
+          });
+          await storage.checkpoint();
+          return result;
+        },
+        close: async () => {
+          await office.settleRetention();
+          office.close();
+          await storage.close();
+          machine.dispose();
+        }
+      };
+    } catch (error) {
+      await storage.close().catch(() => {
+      });
+      throw error;
+    }
   }
 
   // ../../platform-shells/browser/entry.ts
@@ -34848,6 +35148,12 @@
     }
     booting = (async () => {
       peer = await openBrowserPeer({
+        performExternalEffect: async (pending) => {
+          if (!window.__nomosPerformEffect) throw new Error("The browser host cannot perform background effects. Update the application and reload.");
+          return fromBinary(PeerEffectReceiptSchema, frameFromBase64(await window.__nomosPerformEffect(
+            frameToBase64(toBinary(CorrespondencePendingSchema, pending))
+          )));
+        },
         credentialRefresh: externalPeerEffect,
         // The embedding Dart/web application owns the device identity store
         // (IndexedDB through the Flutter key store); the page runner keeps none.