@githolon/runtime 0.112.5 → 0.112.6

package/dist/RUNTIME-SOURCES.sha256

@@ -69,6 +69,7 @@
 33e7d6bdd22396057d3f8db92384079f7ec2fda4b3582709de2d43fccacc4a9c  node_modules/@bufbuild/protobuf/dist/esm/codegenv2/extension.js
 34f8712de2bd30a2cb8366d8cfdcde466d979f1a28ac0d78f7547341b01f6c57  adapter/proto/nomos/kernel/v1/progress_pb.js
 3a90933569db7e42ec2ed3b77509c29d1ab75f6eb078f53fe5d1ac6d239d231e  peer-office/src/runtime/peer_background_scheduler.ts
+3b29007c75a5f51ad2eb490a828c3943ece28a0b3aaecfc7e416b1b35076e236  peer-office/package/package.json
 3c092b8d4185badd23ecf4552434d05aa541b0cd0d534781d687db55260d5da8  adapter/proto/nomos/runtime/v2/sealing_desk_pb.js
 3c98fa838c05abcfd8dfda1128f2d1fca9b196a371fe9751abbd8f4c3b9d04ec  node_modules/@bufbuild/protobuf/dist/esm/wkt/timestamp.js
 3d05089a8c1008f20e06da9907eec7f8824f871edfc95e907c15dc8e2bdf43e7  node_modules/@bufbuild/protobuf/dist/esm/extensions.js
@@ -105,7 +106,6 @@
 589afd70975c49b5d8856a85ffb597b1412f04b35b6234c324564d8640fcae15  node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/type_pb.js
 59ceb09d3fd2402e81ed7e5992245f2b398c7ceeb80141138f4eab5da0244586  node_modules/is-unsafe/src/contexts/redos.js
 59dd7fdcd3eac52054ff1edd4667fbadb66c851a66f60ec528f9db6421a0eed9  node_modules/@bufbuild/protobuf/dist/esm/codegenv2/restore-json-names.js
-5ac35f182ca8cdf2e187276f9c961a20799d7a2d64f3de3f5217d12ed3420890  peer-office/package/package.json
 5c47d871d691707bfa347b2c9199b433e277332ba4c523a4eb802d8c5cded105  peer-office/src/runtime/office_seat.ts
 5ce7673a392e7c11100428b040d6c9a08242021e33f859b2ad670edef31d80de  node_modules/@bufbuild/protobuf/dist/esm/from-binary.js
 5cf55a0f51490590bf56e1ff2d6dd11002f8a8b43b0bc661d2cc15a6c6e0e981  adapter/git-fs.ts
@@ -127,6 +127,7 @@
 71de64c0b205eed7bcbbe11bd937a363c83cb5ab8e9977c4bb4b73b3c5353cf3  peer-office/src/runtime/placement_discovery_desk.ts
 71edee071faa5f0ebbeda63fa23e009983da9e413db2340feb6287d95f497dcd  node_modules/@bufbuild/protobuf/dist/esm/wire/varint.js
 720eb959038ea5a41d7ce358d5fb1f575199db3f4f90267bdaf0314440290546  platform-shells/node/sqlite_peer_desk_store.ts
+722cbe0b307c0e525ea25709dd7d6b307ec3413ab6887b2cc3a573995fd003e1  platform-shells/browser/kernel_work.ts
 7287f23bb63a7f10dbacc04c773050dcc279299948a70cec5a9a3a040be2a933  platform-shells/node/kernel_wasi_stdio.ts
 72f4dbde9d104ea96276198f8fab8b32e1a296d7ae57b74f8f175472627c2546  peer-office/src/runtime/custody_return_delta.ts
 73e489001027c703bc0224ae73f78ecefe028e88284bd06952e8603c3d81472c  node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/api_pb.js
@@ -178,13 +179,13 @@
 98f70a85fe9d2578c977bbf26927910479cef472100b5ed7bebd4c390e79213c  peer-office/src/runtime/workspace_access_desk.ts
 99ce0b71dc7acc73e48634ff609eeb3620cf24b524e89835e804d37fb6b51b2c  adapter/offer_transport_contract.ts
 9a3d4c2296b0139778c8f61319349eac6dc0cdb723688f41ebf3c135dca85702  peer-office/src/runtime/history_acquisition_state.ts
+9b07729add8df9f24781f3135c821781e943780ef3374b16a884850949a6890a  platform-shells/browser/peer.ts
 9b1e46d587a9ad5d1531a5755ba4feccd2878de77749edce8a0086db3eb2217d  peer-office/src/runtime/admission_durability_desk.ts
 9c4c967ea6c149011acb8aabfbadb73651f84d572335c48391d627e5283c0cd0  node_modules/@bufbuild/protobuf/dist/esm/fields.js
 9e1bf39540fd14df32aa2307c44dd4d93a40a6024199f334ccf3db001f44a7f6  peer-office/src/runtime/local_copy_readability.ts
 9e82e1fc1bfd3e3573f64349dc42b4b624ed61d24e5c553f2bb4d041444f166c  node_modules/@bjorn3/browser_wasi_shim/dist/fd.js
 9efa0e5824cc0370ea3596b30cd57ea860df0bae95a0caccbbfe97d845a7a09b  peer-office/src/runtime/custody_offer.ts
 9f7a3b2bb0e2a2da849fd9101228bd9c9682b39d667e20900dd172d954b1a548  peer-office/src/runtime/observability_desk.ts
-9fa129d6ec52dea4f992be9bc3786fca75fdf733903f489ca8b954eadbd90078  platform-shells/browser/entry.ts
 a0eca2694871be026546039e99a71291822d01ba81943d44e69a14b2d766fd1a  peer-office/src/runtime/custody_desk.ts
 a0fcc6110f1154fd197a8ce056e2008dbc7d1750f8dd3ba77c3910af928ed3a1  node_modules/uri-js/dist/es5/uri.all.js
 a33120feed1faf765328722cee117f63e2147cb87052120fdacc9bd1086e67ab  peer-office/src/runtime/receiving_group_framework_wire.generated.ts
@@ -193,6 +194,7 @@ a51ad595569ec83af14644004083aad7f5086703dd46d609e8b006e36bac0f55  peer-office/sr
 a5540af900952b2ea7fde1fa967d624d427bcec5f3d1d89f3e78453a8624c650  peer-office/src/runtime/identity_witness_cache.ts
 a56cf2bf8174e0adf94970d70e003afcfc3923a53d0cf973f92d374cfe684544  node_modules/@nodable/entities/src/EntityDecoder.js
 a6250aa83ce7f238614fb7421f31e541c63c415a295e3764687693464918f3c4  node_modules/path-expression-matcher/src/ExpressionSet.js
+a7273df68b1a53d1efbc3919f0224119fcec335774a99f38e952dc8354ec375d  platform-shells/browser/entry.ts
 a79a133a4f4ae9559b127aca26b20b0b40af3b6a2cc17d75bedbd413d78276af  peer-office/src/runtime/receiving_group_desk.ts
 a91848ee180529e2a60c05dfb9584cad19cd4e1c6f391fdb76a938bcae4c0328  node_modules/@bjorn3/browser_wasi_shim/dist/debug.js
 a98127162afc0a5038171882b19d62f1c035cc8706f2463fda52fdf73c8c21bc  peer-office/src/runtime/live_correspondence_desk.ts
@@ -237,7 +239,6 @@ c41faf95c6c33b80349ff96f8127153672a6e6bf8bb9593f7aa67d2e2e642684  peer-office/sr
 c649d39c53ebe6817c71407de8105b6d8cbc2326867f90d59f49ab02d9271b44  node_modules/anynum/digitTable.js
 c6c85d892e445a8f84e9f628f2ac1ac6766103e90bb502ee9c101774831c4f0c  peer-office/src/runtime/command_preparation_desk.ts
 c87f55e284241bdf08e06a54b09567c329e8cc24519dbd08f064d0230a19f8fd  peer-office/src/runtime/correspondence_work_registry.ts
-c884aa80ac787299da2ec4ebd930c78372d82e227363980cc6a3baf08daf1889  platform-shells/browser/peer.ts
 caa925cb881f7586e9e01f09325f09ebdecf742debbfff21eb7c4c49ea09ef02  node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/java_features_pb.js
 cb095614d5f901cd00d46b930a23c64ebd909a77831aa666768fca47f3e7745f  node_modules/@bufbuild/protobuf/dist/esm/reflect/scalar.js
 cce0e8a8876bd1d3305a666e70cd556fd1ae57560fbca9f4ff0577d91178a0b1  node_modules/fast-xml-parser/src/xmlparser/node2json.js
@@ -262,6 +263,7 @@ db05a3f19bc575c1ed771fc6882af337a49cde7bd469181f3acc772d1a76df3e  node_modules/@
 db61a17ab4dbb3514b676cd93cc702fe62a6582d5ec292725f1ada20dfbc1f72  peer-office/src/runtime/custody_replacement.ts
 dd9f3f24fb154cfbfbde94e8f2647647c80c8ca050b98e981a407e760a4b9c1e  node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/go_features_pb.js
 deaa25227d669aa3fbe99174275588dcc175de648ae6623fddf11d6ae69d7f67  platform-shells/node/local-development/peer_process.ts
+dff6af323ca5f9c73dd06120879fcd5f561d22a8a7fd36d3317e564ae4e10e3b  platform-shells/shared/kernel_work_accounting.ts
 e20a132033f105a29db1cfdb3d85bbadbb7206b9a7e3336bcb030a63d66b4ab2  node_modules/is-unsafe/src/contexts/nosql.js
 e2133d7e0f0ce5491a3e9bd560e9e47db2243a6a9f762be89c82e027d99d278e  peer-office/src/runtime/credential_sessions.ts
 e34016b82b6f6e4c4a1cc2dd44ccd14a348e8156a1f6c5aeeb2c7fc36a15b8f9  adapter/proto/nomos/kernel/v1/kernel_pb.js

package/dist/nomos-runner.js

@@ -8108,6 +8108,10 @@
   var ResidencyPressureRelievedSchema = /* @__PURE__ */ messageDesc(file_nomos_runtime_v2_residency_desk, 2);
   var ResidentPlacementSchema = /* @__PURE__ */ messageDesc(file_nomos_runtime_v2_residency_desk, 6);
   var ResidentOutboxSchema = /* @__PURE__ */ messageDesc(file_nomos_runtime_v2_residency_desk, 7);
+  var KernelWorkCounterSchema = /* @__PURE__ */ messageDesc(file_nomos_runtime_v2_residency_desk, 8);
+  var KernelWorkCpuBucketSchema = /* @__PURE__ */ messageDesc(file_nomos_runtime_v2_residency_desk, 9);
+  var ActiveKernelWorkSchema = /* @__PURE__ */ messageDesc(file_nomos_runtime_v2_residency_desk, 10);
+  var KernelWorkSnapshotSchema = /* @__PURE__ */ messageDesc(file_nomos_runtime_v2_residency_desk, 11);
   var CorrespondenceHoldSchema = /* @__PURE__ */ messageDesc(file_nomos_runtime_v2_residency_desk, 18);
   var LocalHistoryPostureSchema = /* @__PURE__ */ enumDesc(file_nomos_runtime_v2_residency_desk, 1);
   var LocalHistoryPosture = /* @__PURE__ */ tsEnum(LocalHistoryPostureSchema);
@@ -10408,6 +10412,274 @@
   // ../../adapter/kernel_execution_desk.ts
   var kernelExecutionDesk = (machine) => runtimeKernelPort(machine);
 
+  // ../../platform-shells/shared/kernel_work_accounting.ts
+  init_define_NOMOS_KERNEL_RELEASE();
+  init_shims();
+  var KERNEL_WORK_CPU_BUCKET_MICROS = [
+    100,
+    250,
+    500,
+    1e3,
+    2500,
+    5e3,
+    1e4,
+    25e3,
+    5e4,
+    1e5,
+    25e4,
+    5e5,
+    1e6,
+    25e5,
+    5e6,
+    1e7,
+    3e7,
+    6e7
+  ];
+  var custodyValidation = /* @__PURE__ */ new Set([
+    "inspectChange",
+    "inspectRefusalVerdict",
+    "lawClosureInfo",
+    "resolveStatePosition",
+    "proveCompactionEquivalence"
+  ]);
+  var custodyOpenRestore = /* @__PURE__ */ new Set([
+    "checkpointExport",
+    "checkpointImport",
+    "restoreMain",
+    "openGitState",
+    "attachLocalFrontier",
+    "releaseWorkspaceState"
+  ]);
+  var custodyWrites = /* @__PURE__ */ new Set([
+    "writeRef",
+    "deleteRef",
+    "writeMetaCommit",
+    "recordWorkspaceEffectOutcome"
+  ]);
+  var custodyTransfers = /* @__PURE__ */ new Set([
+    "packDelta",
+    "applyPack",
+    "intentsAbove",
+    "historySummary",
+    "readBlob",
+    "resolveRef",
+    "listRefs"
+  ]);
+  var telemetryMeasurements = /* @__PURE__ */ new Set(["residentFootprint", "aggregateCensus"]);
+  var lawQueries = /* @__PURE__ */ new Set([
+    "authorizationCheck",
+    "authorizationExpand",
+    "frontierTransition",
+    "ownedDeviceRequest",
+    "ownedPrepareApproval",
+    "authenticationPosture",
+    "authoringRequirements",
+    "identityProviderWitness",
+    "interfaceCompatibility"
+  ]);
+  var authoringOperations = /* @__PURE__ */ new Set([
+    "signPreparedOffer",
+    "prepareRemoteOffer",
+    "signOfferPreparation"
+  ]);
+  var cryptographicOperations = /* @__PURE__ */ new Set([
+    "signBirthCertificate",
+    "signingIdentity",
+    "signAuthorityAttestation",
+    "mintTypedId",
+    "encryptionIdentity",
+    "wrapScopeKey",
+    "unwrapScopeKey"
+  ]);
+  function classifyKernelWork(frame) {
+    try {
+      const decoded = fromBinary(CallRequestSchema, frame);
+      const operation = decoded.operation;
+      if (!operation.case) return { family: "other", operation: "unspecified" };
+      if (operation.case === "query") {
+        const detail = operation.value.query.case || "unspecified";
+        const family = detail === "maintenanceQuantum" ? "read_index_maintenance" : detail === "fullHistoryAudit" ? "custody_validation" : lawQueries.has(detail) ? "law_evaluation" : "read_query";
+        return { family, operation: `query.${detail}`, workspace: operation.value.target?.workspace };
+      }
+      if (operation.case === "custody") {
+        const detail = operation.value.operation.case || "unspecified";
+        const value = operation.value.operation.value;
+        const target3 = value && "target" in value ? value.target : void 0;
+        const workspace = typeof target3 === "string" ? target3 : target3?.workspace;
+        const family = telemetryMeasurements.has(detail) ? "telemetry_measurement" : custodyValidation.has(detail) ? "custody_validation" : custodyOpenRestore.has(detail) ? "custody_open_restore" : custodyWrites.has(detail) ? "git_state_write" : custodyTransfers.has(detail) ? "sync_transfer" : "custody_inspection";
+        return { family, operation: `custody.${detail}`, workspace };
+      }
+      if (operation.case === "offer") {
+        const detail = operation.value.intent.case || "unspecified";
+        return {
+          family: "offer_adjudication",
+          operation: `offer.${detail}`,
+          workspace: operation.value.target?.workspace
+        };
+      }
+      if (operation.case === "open") {
+        return {
+          family: "custody_open_restore",
+          operation: "open",
+          workspace: operation.value.target?.workspace
+        };
+      }
+      if (operation.case === "outbox") {
+        return {
+          family: "correspondence_outbox",
+          operation: operation.value.prepare ? "outbox.prepare" : "outbox.inventory",
+          workspace: operation.value.target?.workspace
+        };
+      }
+      if (operation.case === "sync") {
+        return { family: "sync_transfer", operation: "sync", workspace: operation.value.target?.workspace };
+      }
+      if (operation.case === "configure") return { family: "configuration", operation: "configure" };
+      if (authoringOperations.has(operation.case)) {
+        return { family: "offer_authoring", operation: operation.case };
+      }
+      if (cryptographicOperations.has(operation.case)) {
+        return { family: "cryptography", operation: operation.case };
+      }
+      return { family: "other", operation: operation.case };
+    } catch {
+      return { family: "other", operation: "undecodable" };
+    }
+  }
+  function classifyCompletedKernelWork(work, result) {
+    if (work.family !== "offer_adjudication") return work;
+    try {
+      if (result) {
+        const response = fromBinary(CallResponseSchema, result);
+        if (response.outcome.case === "offer" && response.outcome.value.outcome.case === "admitted") {
+          const admitted = response.outcome.value.outcome.value;
+          if (!admitted.dryRun && !admitted.placement && !admitted.alreadyApplied) {
+            return { ...work, family: "offer_admitted" };
+          }
+        }
+      }
+    } catch {
+    }
+    return { ...work, family: "offer_not_admitted" };
+  }
+  var _counters, _activeChanged, _cpuAvailable, _startedUnixMillis, _active;
+  var KernelWorkAccounting = class {
+    constructor(activeChanged, cpuAvailable = true) {
+      __privateAdd(this, _counters, /* @__PURE__ */ new Map());
+      __privateAdd(this, _activeChanged);
+      __privateAdd(this, _cpuAvailable);
+      __privateAdd(this, _startedUnixMillis, Date.now());
+      __privateAdd(this, _active);
+      __privateSet(this, _activeChanged, activeChanged);
+      __privateSet(this, _cpuAvailable, cpuAvailable);
+    }
+    begin(work, startedUnixMillis) {
+      var _a;
+      __privateSet(this, _active, create(ActiveKernelWorkSchema, {
+        family: work.family,
+        operation: work.operation,
+        startedUnixMillis: BigInt(startedUnixMillis)
+      }));
+      try {
+        (_a = __privateGet(this, _activeChanged)) == null ? void 0 : _a.call(this, __privateGet(this, _active));
+      } catch {
+      }
+    }
+    complete(work, elapsedMillis2, cpuMicros, completed) {
+      var _a;
+      const key = `${work.family}\0${work.operation}`;
+      let counter = __privateGet(this, _counters).get(key);
+      if (!counter) {
+        counter = {
+          calls: 0n,
+          failures: 0n,
+          cpuMicros: __privateGet(this, _cpuAvailable) ? 0n : void 0,
+          wallMicros: 0n,
+          bucketCalls: __privateGet(this, _cpuAvailable) ? KERNEL_WORK_CPU_BUCKET_MICROS.map(() => 0n) : [],
+          lastCompletedUnixMillis: 0n
+        };
+        __privateGet(this, _counters).set(key, counter);
+      }
+      const boundedCpuMicros = cpuMicros === void 0 ? void 0 : Math.max(0, Math.round(cpuMicros));
+      counter.calls += 1n;
+      if (!completed) counter.failures += 1n;
+      if (boundedCpuMicros !== void 0 && counter.cpuMicros !== void 0) {
+        counter.cpuMicros += BigInt(boundedCpuMicros);
+      }
+      counter.wallMicros += BigInt(Math.max(0, Math.round(elapsedMillis2 * 1e3)));
+      counter.lastCompletedUnixMillis = BigInt(Date.now());
+      for (let index = 0; boundedCpuMicros !== void 0 && index < counter.bucketCalls.length; index += 1) {
+        if (boundedCpuMicros <= KERNEL_WORK_CPU_BUCKET_MICROS[index]) counter.bucketCalls[index] += 1n;
+      }
+      __privateSet(this, _active, void 0);
+      try {
+        (_a = __privateGet(this, _activeChanged)) == null ? void 0 : _a.call(this, void 0);
+      } catch {
+      }
+    }
+    snapshot(observedUnixMillis = Date.now()) {
+      const counters = [...__privateGet(this, _counters).entries()].sort(([left], [right]) => left.localeCompare(right)).map(([key, value]) => {
+        const [family, operation] = key.split("\0");
+        return create(KernelWorkCounterSchema, {
+          family,
+          operation,
+          calls: value.calls,
+          failures: value.failures,
+          cpuMicros: value.cpuMicros,
+          wallMicros: value.wallMicros,
+          cpuBuckets: value.bucketCalls.map((calls, index) => create(KernelWorkCpuBucketSchema, { leMicros: BigInt(KERNEL_WORK_CPU_BUCKET_MICROS[index]), calls })),
+          lastCompletedUnixMillis: value.lastCompletedUnixMillis
+        });
+      });
+      return create(KernelWorkSnapshotSchema, {
+        startedUnixMillis: BigInt(__privateGet(this, _startedUnixMillis)),
+        observedUnixMillis: BigInt(observedUnixMillis),
+        counters,
+        active: __privateGet(this, _active)
+      });
+    }
+    reset() {
+      var _a;
+      __privateGet(this, _counters).clear();
+      __privateSet(this, _startedUnixMillis, Date.now());
+      __privateSet(this, _active, void 0);
+      try {
+        (_a = __privateGet(this, _activeChanged)) == null ? void 0 : _a.call(this, void 0);
+      } catch {
+      }
+    }
+  };
+  _counters = new WeakMap();
+  _activeChanged = new WeakMap();
+  _cpuAvailable = new WeakMap();
+  _startedUnixMillis = new WeakMap();
+  _active = new WeakMap();
+
+  // ../../platform-shells/browser/kernel_work.ts
+  init_define_NOMOS_KERNEL_RELEASE();
+  init_shims();
+  function observeBrowserKernelCalls(kernel, accounting, now = () => performance.now()) {
+    return {
+      ...kernel,
+      call(frame) {
+        const work = classifyKernelWork(frame);
+        accounting.begin(work, Date.now());
+        const started = now();
+        let completed = false;
+        let completedWork = work;
+        try {
+          const result = kernel.call(frame);
+          completedWork = classifyCompletedKernelWork(work, result);
+          completed = true;
+          return result;
+        } finally {
+          if (!completed) completedWork = classifyCompletedKernelWork(work);
+          accounting.complete(completedWork, now() - started, void 0, completed);
+        }
+      }
+    };
+  }
+
   // ../../adapter/git_custody_desk.ts
   init_define_NOMOS_KERNEL_RELEASE();
   init_shims();
@@ -14749,7 +15021,7 @@
   }
 
   // ../src/runtime/credential_recovery_desk.ts
-  var _ports, _waiting, _background, _renewing, _active, _replicaWaiters, _joining, _completed2, _sequence2, _CredentialRecoveryDesk_instances, now_fn, unixMillis_fn, tokenless_fn, prune_fn, begin_fn, wake_fn, callOnce_fn, remember_fn2, finishReplicaWaiters_fn;
+  var _ports, _waiting, _background, _renewing, _active2, _replicaWaiters, _joining, _completed2, _sequence2, _CredentialRecoveryDesk_instances, now_fn, unixMillis_fn, tokenless_fn, prune_fn, begin_fn, wake_fn, callOnce_fn, remember_fn2, finishReplicaWaiters_fn;
   var CredentialRecoveryDesk = class {
     constructor(ports) {
       __privateAdd(this, _CredentialRecoveryDesk_instances);
@@ -14759,7 +15031,7 @@
       /** Capabilities whose renewal-ahead-of-expiry is in flight: one refresh per capability, not one per offer. */
       __privateAdd(this, _renewing, /* @__PURE__ */ new Map());
       /** One physical acquisition per capability; other callers wait outside the serial kernel lane. */
-      __privateAdd(this, _active, /* @__PURE__ */ new Map());
+      __privateAdd(this, _active2, /* @__PURE__ */ new Map());
       /** Headless follows joining an interaction-owned refresh of the same
        * capability. They need no synthetic session or second provider request. */
       __privateAdd(this, _replicaWaiters, /* @__PURE__ */ new Map());
@@ -14797,7 +15069,7 @@
         request: fromBinary(RuntimeRequestSchema, toBinary(RuntimeRequestSchema, request))
       }, { allowCached: false, rejectCurrent: false });
       if (step.case !== "pending") throw new Error("credential renewal did not produce its physical paper");
-      __privateGet(this, _renewing).set(capability, __privateGet(this, _active).get(capability));
+      __privateGet(this, _renewing).set(capability, __privateGet(this, _active2).get(capability));
       return step;
     }
     beginOffer(request, command, response) {
@@ -14812,7 +15084,7 @@
     ensurePresent(session) {
       if (__privateGet(this, _ports).authToken(session).byteLength > 0 || __privateMethod(this, _CredentialRecoveryDesk_instances, tokenless_fn).call(this, session)) return true;
       __privateMethod(this, _CredentialRecoveryDesk_instances, prune_fn).call(this);
-      const active = __privateGet(this, _active).get(__privateGet(this, _ports).capabilityFor(session));
+      const active = __privateGet(this, _active2).get(__privateGet(this, _ports).capabilityFor(session));
       if (active !== void 0) {
         __privateGet(this, _waiting).get(active)?.affectedSessions.add(session);
         return false;
@@ -14826,7 +15098,7 @@
       if (!syncNeedsCredentialRefresh(event.result, event.failure) || __privateMethod(this, _CredentialRecoveryDesk_instances, tokenless_fn).call(this, session)) return;
       __privateMethod(this, _CredentialRecoveryDesk_instances, prune_fn).call(this);
       const capability = __privateGet(this, _ports).capabilityFor(session);
-      const existing = __privateGet(this, _active).get(capability);
+      const existing = __privateGet(this, _active2).get(capability);
       if (existing !== void 0) {
         __privateGet(this, _waiting).get(existing)?.affectedSessions.add(session);
         return;
@@ -14844,7 +15116,7 @@
         return { case: "refreshed", value: create(CredentialsRefreshedSchema, { session: capability }) };
       }
       __privateMethod(this, _CredentialRecoveryDesk_instances, prune_fn).call(this);
-      if (__privateGet(this, _active).has(capability)) {
+      if (__privateGet(this, _active2).has(capability)) {
         const waiting = __privateGet(this, _replicaWaiters).get(capability) ?? /* @__PURE__ */ new Set();
         waiting.add(workspace);
         __privateGet(this, _replicaWaiters).set(capability, waiting);
@@ -14893,7 +15165,7 @@
       __privateGet(this, _waiting).delete(command.workId);
       if (__privateGet(this, _background).get(work.capability) === command.workId) __privateGet(this, _background).delete(work.capability);
       if (__privateGet(this, _renewing).get(work.capability) === command.workId) __privateGet(this, _renewing).delete(work.capability);
-      if (__privateGet(this, _active).get(work.capability) === command.workId) __privateGet(this, _active).delete(work.capability);
+      if (__privateGet(this, _active2).get(work.capability) === command.workId) __privateGet(this, _active2).delete(work.capability);
       const sameContext = __privateMethod(this, _CredentialRecoveryDesk_instances, now_fn).call(this) < work.expiresAt && (work.directCapability || __privateGet(this, _ports).capabilityFor(work.session) === work.capability) && (work.directCapability ? __privateGet(this, _ports).deviceChallengeForCapability(work.capability) : __privateGet(this, _ports).deviceChallenge(work.session)) === work.deviceChallenge;
       const material = sameContext && receipt.outcome.case === "credentialRefreshed" ? receipt.outcome.value : void 0;
       let refreshed = create(CredentialsRefreshedSchema, { session: work.session });
@@ -14930,7 +15202,7 @@
     clear() {
       __privateGet(this, _waiting).clear();
       __privateGet(this, _joining).clear();
-      __privateGet(this, _active).clear();
+      __privateGet(this, _active2).clear();
       __privateGet(this, _replicaWaiters).clear();
       __privateGet(this, _background).clear();
       __privateGet(this, _renewing).clear();
@@ -14941,7 +15213,7 @@
   _waiting = new WeakMap();
   _background = new WeakMap();
   _renewing = new WeakMap();
-  _active = new WeakMap();
+  _active2 = new WeakMap();
   _replicaWaiters = new WeakMap();
   _joining = new WeakMap();
   _completed2 = new WeakMap();
@@ -14962,7 +15234,7 @@
       __privateGet(this, _waiting).delete(id);
       if (__privateGet(this, _background).get(work.capability) === id) __privateGet(this, _background).delete(work.capability);
       if (__privateGet(this, _renewing).get(work.capability) === id) __privateGet(this, _renewing).delete(work.capability);
-      if (__privateGet(this, _active).get(work.capability) === id) __privateGet(this, _active).delete(work.capability);
+      if (__privateGet(this, _active2).get(work.capability) === id) __privateGet(this, _active2).delete(work.capability);
       __privateMethod(this, _CredentialRecoveryDesk_instances, finishReplicaWaiters_fn).call(this, work.capability, false);
     }
     for (const [id, work] of __privateGet(this, _joining)) if (work.expiresAt <= now) __privateGet(this, _joining).delete(id);
@@ -14972,7 +15244,7 @@
     const id = `credential-recovery-${++__privateWrapper(this, _sequence2)._}`;
     const effectId2 = `${id}:refresh`;
     const capability = direct ? session : __privateGet(this, _ports).capabilityFor(session);
-    const active = __privateGet(this, _active).get(capability);
+    const active = __privateGet(this, _active2).get(capability);
     if (active !== void 0 && original !== void 0) {
       __privateGet(this, _waiting).get(active)?.affectedSessions.add(session);
       const current2 = __privateMethod(this, _CredentialRecoveryDesk_instances, wake_fn).call(this, id, 0);
@@ -14999,7 +15271,7 @@
       ...direct === void 0 ? {} : { workspace: direct.workspace },
       ...original === void 0 ? {} : { original }
     });
-    __privateGet(this, _active).set(capability, id);
+    __privateGet(this, _active2).set(capability, id);
     return { case: "pending", value: create(CorrespondencePendingSchema, { workId: id, effect: {
       case: "refreshCredential",
       value: create(PeerCredentialRefreshEffectSchema, {
@@ -19372,27 +19644,27 @@
   // ../src/runtime/residency_pins.ts
   init_define_NOMOS_KERNEL_RELEASE();
   init_shims();
-  var _pending2, _resumed, _active2;
+  var _pending2, _resumed, _active3;
   var ResidencyPins = class {
     constructor() {
       __privateAdd(this, _pending2, /* @__PURE__ */ new Map());
       __privateAdd(this, _resumed, /* @__PURE__ */ new WeakMap());
-      __privateAdd(this, _active2, []);
+      __privateAdd(this, _active3, []);
     }
     begin(workId2, effectId2) {
       const pending = workId2 ? __privateGet(this, _pending2).get(workId2) : void 0;
       const correlated = pending && pending.effectId === effectId2;
       const scope = new Set(correlated ? pending.scope : void 0);
       if (correlated) __privateGet(this, _resumed).set(scope, workId2);
-      __privateGet(this, _active2).push(scope);
+      __privateGet(this, _active3).push(scope);
       return scope;
     }
     touch(workspace) {
-      if (workspace) for (const scope of __privateGet(this, _active2)) scope.add(workspace);
+      if (workspace) for (const scope of __privateGet(this, _active3)) scope.add(workspace);
     }
     end(scope, previousWorkId, pendingWorkId, pendingEffectId) {
-      if (__privateGet(this, _active2).at(-1) !== scope) throw new Error("residency scopes must settle in stack order");
-      __privateGet(this, _active2).pop();
+      if (__privateGet(this, _active3).at(-1) !== scope) throw new Error("residency scopes must settle in stack order");
+      __privateGet(this, _active3).pop();
       if (previousWorkId && __privateGet(this, _resumed).get(scope) === previousWorkId) __privateGet(this, _pending2).delete(previousWorkId);
       if (pendingWorkId) __privateGet(this, _pending2).set(pendingWorkId, {
         scope,
@@ -19400,7 +19672,7 @@
       });
     }
     workspaces() {
-      return new Set([...__privateGet(this, _active2), ...[...__privateGet(this, _pending2).values()].map((pending) => pending.scope)].flatMap((scope) => [...scope]));
+      return new Set([...__privateGet(this, _active3), ...[...__privateGet(this, _pending2).values()].map((pending) => pending.scope)].flatMap((scope) => [...scope]));
     }
     clear() {
       __privateGet(this, _pending2).clear();
@@ -19408,7 +19680,7 @@
   };
   _pending2 = new WeakMap();
   _resumed = new WeakMap();
-  _active2 = new WeakMap();
+  _active3 = new WeakMap();
 
   // ../src/runtime/subscription_manager.ts
   init_define_NOMOS_KERNEL_RELEASE();
@@ -35250,7 +35522,8 @@
         replica: options.replica ?? storage.replica,
         trustRootPublicKey: options.trustRootPublicKey
       }, storage.filesystem, storage.changed);
-      const physicalKernel = kernelExecutionDesk(machine);
+      const kernelWork = new KernelWorkAccounting(options.onKernelWorkChanged, false);
+      const physicalKernel = observeBrowserKernelCalls(kernelExecutionDesk(machine), kernelWork);
       const kernel = options.observeKernel?.(physicalKernel) ?? physicalKernel;
       const custodyDesk = gitCustodyDesk(kernel, fetchImpl);
       const kernelStore = browserKernelCustody(kernel, () => storage.checkpoint(), () => storage.isCheckpointCurrent(), options.provisionedGenesisWorkspace);
@@ -35288,6 +35561,7 @@
           await storage.checkpoint();
           return result;
         },
+        kernelWorkSnapshot: () => kernelWork.snapshot(),
         close: async () => {
           await office.settleRetention();
           office.close();
@@ -35393,6 +35667,12 @@
           warmResidencyMillis: 86400000n
         },
         postEvent,
+        onKernelWorkChanged: (active) => {
+          try {
+            window.__nomosKernelWorkChanged?.(active ? toJsonString(ActiveKernelWorkSchema, active) : "");
+          } catch {
+          }
+        },
         kernelCache: kernelCache()
       });
       flushEvents();
@@ -35406,6 +35686,7 @@
     if (!peer) throw new Error("Nomos peer runtime is not booted");
     return frameToBase64(await peer.invoke(frameFromBase64(frameBase64)));
   };
+  window.__nomosKernelWorkSnapshot = () => peer ? toJsonString(KernelWorkSnapshotSchema, peer.kernelWorkSnapshot()) : void 0;
   window.NomosRunner = {
     version: 2,
     dispose: () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/runtime",
-  "version": "0.112.5",
+  "version": "0.112.6",
   "type": "module",
   "description": "The portable Nomos application runtime, reception contracts, and Node/browser runners.",
   "license": "SEE LICENSE IN LICENSE.md",