@githolon/runtime 0.112.7 → 0.112.11

package/dist/nomos-runner.js

@@ -7894,16 +7894,22 @@
   // ../../platform-shells/browser/runtime_fetch.ts
   init_define_NOMOS_KERNEL_RELEASE();
   init_shims();
-  function browserRuntimeFetch(base, fetchImpl, caches) {
+  function browserRuntimeFetch(base, fetchImpl, caches, repositoryUrl) {
     const root = base.replace(/\/+$/, "");
     return async (input, init) => {
       const url = String(input);
-      const bootArtifact = url === `${root}/v1/runtime/repository.xml` || url === `${root}/v1/runtime/nomos.law.usdz`;
-      if (!bootArtifact || !caches) return fetchImpl(input, init);
+      const bootArtifact = url === (repositoryUrl ?? `${root}/v1/runtime/repository.xml`) || url === `${root}/v1/runtime/nomos.law.usdz`;
+      if (!bootArtifact) return fetchImpl(input, init);
+      const networkInit = {
+        ...init,
+        cache: "no-store",
+        signal: init?.signal ?? AbortSignal.timeout(15e3)
+      };
+      if (!caches) return fetchImpl(input, networkInit);
       const cache = await caches.open("nomos-browser-boot-v1");
       let response;
       try {
-        response = await fetchImpl(input, { ...init, signal: init?.signal ?? AbortSignal.timeout(15e3) });
+        response = await fetchImpl(input, networkInit);
       } catch (error) {
         const retained = await cache.match(url);
         if (retained) return retained;
@@ -12060,10 +12066,11 @@
   var copyRecord = (record) => ({ ...record, value: record.value.slice() });
   var currentCacheFile = (path) => path.endsWith("/nomos.git/nomos-cache/raw-frontier-v2/current.sqlite");
   var durableFile = (path) => !path.includes("/nomos.git/nomos-cache/raw-frontier-v2/addressed/") && !path.endsWith("/nomos.git/nomos-cache/raw-frontier-v2/addressed") && !currentCacheFile(path);
-  var keyOf = (namespace, key) => JSON.stringify([namespace, key]);
-  var _backend, _records, _knownNodes, _mutatedNodes, _changedRecords, _cachePaths, _cacheDirty, _cacheDisabled, _cacheTimer, _cachePending, _revision, _committed, _queued, _failure, _closed;
+  var keyOf = (namespace2, key) => JSON.stringify([namespace2, key]);
+  var _backend, _records, _knownNodes, _mutatedNodes, _changedRecords, _cachePaths, _cacheDirty, _cacheDisabled, _cacheTimer, _cachePending, _revision, _committed, _queued, _checkpoints, _failure, _closed;
   var _BrowserCustodyStore = class _BrowserCustodyStore {
     constructor(backend, snapshot) {
+      __publicField(this, "onCheckpoint");
       __publicField(this, "filesystem", memoryCustodyFilesystem());
       __publicField(this, "replica");
       __publicField(this, "identity");
@@ -12080,6 +12087,7 @@
       __privateAdd(this, _revision, 0);
       __privateAdd(this, _committed, -1);
       __privateAdd(this, _queued);
+      __privateAdd(this, _checkpoints, /* @__PURE__ */ new Set());
       __privateAdd(this, _failure);
       __privateAdd(this, _closed, false);
       __publicField(this, "changed", (inode) => {
@@ -12095,7 +12103,7 @@
           }, 3e4));
           __privateGet(this, _cacheTimer).unref?.();
         }
-        void this.checkpoint().catch(() => {
+        void this.flushDurable().catch(() => {
         });
       });
       __privateSet(this, _backend, backend);
@@ -12141,16 +12149,16 @@
       if (__privateGet(this, _failure)) throw new Error("Browser custody could not be saved. Keep this tab open, free storage space, and reload only after recovery.", { cause: __privateGet(this, _failure) });
       if (__privateGet(this, _closed)) throw new Error("Browser custody is closed");
     }
-    list(namespace) {
+    list(namespace2) {
       this.assertUsable();
-      return [...__privateGet(this, _records).values()].filter((record) => record.namespace === namespace).sort((a, b) => a.key.localeCompare(b.key)).map(copyRecord);
+      return [...__privateGet(this, _records).values()].filter((record) => record.namespace === namespace2).sort((a, b) => a.key.localeCompare(b.key)).map(copyRecord);
     }
-    compareExchange(namespace, key, expected, value) {
+    compareExchange(namespace2, key, expected, value) {
       this.assertUsable();
-      const id = keyOf(namespace, key);
+      const id = keyOf(namespace2, key);
       const current = __privateGet(this, _records).get(id);
-      if (current?.revision !== expected) throw new Error(`peer desk record '${namespace}/${key}' changed at revision ${current?.revision ?? "absent"}`);
-      const next = value === void 0 ? void 0 : { namespace, key, revision: (current?.revision ?? 0n) + 1n, value: value.slice() };
+      if (current?.revision !== expected) throw new Error(`peer desk record '${namespace2}/${key}' changed at revision ${current?.revision ?? "absent"}`);
+      const next = value === void 0 ? void 0 : { namespace: namespace2, key, revision: (current?.revision ?? 0n) + 1n, value: value.slice() };
       if (next) __privateGet(this, _records).set(id, next);
       else __privateGet(this, _records).delete(id);
       __privateGet(this, _changedRecords).set(id, next && copyRecord(next));
@@ -12158,16 +12166,30 @@
       return next && copyRecord(next);
     }
     checkpoint() {
+      this.assertUsable();
+      const revision = __privateGet(this, _revision);
+      if (__privateGet(this, _committed) >= revision) return Promise.resolve();
+      const completed = new Promise((resolve, reject) => {
+        __privateGet(this, _checkpoints).add({ revision, resolve, reject });
+      });
+      void this.flushDurable().catch(() => {
+      });
+      return completed;
+    }
+    flushDurable() {
       this.assertUsable();
       if (!__privateGet(this, _queued)) {
         __privateSet(this, _queued, Promise.resolve().then(async () => {
           while (__privateGet(this, _committed) !== __privateGet(this, _revision)) {
+            const snapshotStarted = performance.now();
             const revision = __privateGet(this, _revision);
             const delta = this.filesystem.delta(__privateGet(this, _knownNodes), __privateGet(this, _mutatedNodes), durableFile);
             __privateGet(this, _mutatedNodes).clear();
             const records = [...__privateGet(this, _changedRecords).values()].filter((record) => record !== void 0).map(copyRecord);
             const removedRecords = [...__privateGet(this, _changedRecords).entries()].filter(([, record]) => record === void 0).map(([id]) => id);
             __privateGet(this, _changedRecords).clear();
+            const snapshotMs = performance.now() - snapshotStarted;
+            const commitStarted = performance.now();
             await __privateGet(this, _backend).commit({
               control: { format: 2, replica: this.replica, identity: this.identity },
               files: delta.changed,
@@ -12175,19 +12197,39 @@
               records,
               removedRecords
             });
+            try {
+              this.onCheckpoint?.({
+                snapshotMs,
+                commitMs: performance.now() - commitStarted,
+                files: delta.changed.length,
+                bytes: delta.changed.reduce((total, file) => total + (file.bytes?.byteLength ?? 0), 0),
+                records: records.length,
+                removedFiles: delta.removed.length
+              });
+            } catch {
+            }
             __privateSet(this, _knownNodes, new Map(delta.nodes));
             __privateSet(this, _committed, revision);
+            for (const checkpoint of __privateGet(this, _checkpoints)) {
+              if (checkpoint.revision > revision) continue;
+              __privateGet(this, _checkpoints).delete(checkpoint);
+              checkpoint.resolve();
+            }
           }
         }).catch((error) => {
           __privateSet(this, _failure, error);
+          for (const checkpoint of __privateGet(this, _checkpoints)) checkpoint.reject(error);
+          __privateGet(this, _checkpoints).clear();
           throw error;
         }).finally(() => {
           __privateSet(this, _queued, void 0);
+          if (!__privateGet(this, _failure) && __privateGet(this, _committed) !== __privateGet(this, _revision)) {
+            void this.flushDurable().catch(() => {
+            });
+          }
         }));
       }
-      return __privateGet(this, _queued).then(() => {
-        if (__privateGet(this, _committed) !== __privateGet(this, _revision)) return this.checkpoint();
-      });
+      return __privateGet(this, _queued);
     }
     isCheckpointCurrent() {
       return !__privateGet(this, _failure) && !__privateGet(this, _closed) && __privateGet(this, _committed) === __privateGet(this, _revision);
@@ -12209,7 +12251,7 @@
       await __privateGet(this, _cachePending);
     }
     async close() {
-      await this.checkpoint();
+      await this.flushDurable();
       if (__privateGet(this, _cacheTimer)) clearTimeout(__privateGet(this, _cacheTimer));
       __privateSet(this, _cacheTimer, void 0);
       await this.flushCache();
@@ -12230,6 +12272,7 @@
   _revision = new WeakMap();
   _committed = new WeakMap();
   _queued = new WeakMap();
+  _checkpoints = new WeakMap();
   _failure = new WeakMap();
   _closed = new WeakMap();
   var BrowserCustodyStore = _BrowserCustodyStore;
@@ -12954,7 +12997,8 @@
         }
       }));
       if (response.outcome.case === "failure") {
-        throw new Error(`${response.outcome.value.code}: ${response.outcome.value.message}`);
+        throwUnnamedHistoryRequirement(response.outcome.value, mount.workspace);
+        throwKernelFailure(response.outcome.value);
       }
       if (response.outcome.case !== "outbox") {
         throw new Error(`kernel returned '${response.outcome.case || "empty"}' while reading correspondence`);
@@ -12983,7 +13027,8 @@
         }
       }));
       if (response.outcome.case === "failure") {
-        throw new Error(`${response.outcome.value.code}: ${response.outcome.value.message}`);
+        throwUnnamedHistoryRequirement(response.outcome.value, mount.workspace);
+        throwKernelFailure(response.outcome.value);
       }
       if (response.outcome.case !== "outbox") {
         throw new Error(
@@ -16092,19 +16137,19 @@
   init_define_NOMOS_KERNEL_RELEASE();
   init_shims();
   var WORKSPACE_NAME_SEP = "";
-  var keyedBirthNameOf = (namespace, key) => `${namespace}-${sha256Hex(new TextEncoder().encode(namespace + WORKSPACE_NAME_SEP + key)).slice(0, 40)}`;
+  var keyedBirthNameOf = (namespace2, key) => `${namespace2}-${sha256Hex(new TextEncoder().encode(namespace2 + WORKSPACE_NAME_SEP + key)).slice(0, 40)}`;
   var RECEIVING_GROUP_NAME_PREFIX = "nomos-rg-";
   var receivingGroupNameOf = (principal) => `${RECEIVING_GROUP_NAME_PREFIX}${sha256Hex(new TextEncoder().encode(principal)).slice(0, 40)}`;
-  var isKeyedBirthOf = (namespace, workspace) => workspace.startsWith(`${namespace}-`);
+  var isKeyedBirthOf = (namespace2, workspace) => workspace.startsWith(`${namespace2}-`);
   var WORKSPACE_NAME_REQUEST_INVALID = "nomos.runtime.workspace_name_request_invalid";
   function resolveWorkspaceName(command) {
     switch (command.birth.case) {
       case "keyed": {
-        const { namespace, key } = command.birth.value;
-        if (namespace.length === 0 || key.length === 0) {
+        const { namespace: namespace2, key } = command.birth.value;
+        if (namespace2.length === 0 || key.length === 0) {
           throw new Error(`${WORKSPACE_NAME_REQUEST_INVALID}: a keyed birth name needs both its namespace and its key`);
         }
-        return create(ResolvedWorkspaceNameSchema, { workspace: keyedBirthNameOf(namespace, key) });
+        return create(ResolvedWorkspaceNameSchema, { workspace: keyedBirthNameOf(namespace2, key) });
       }
       case "receivingGroup": {
         const { principal } = command.birth.value;
@@ -18091,6 +18136,147 @@
     return result;
   };
 
+  // ../src/runtime/custody_receipts.ts
+  init_define_NOMOS_KERNEL_RELEASE();
+  init_shims();
+
+  // ../src/runtime/peer_desk_store.ts
+  init_define_NOMOS_KERNEL_RELEASE();
+  init_shims();
+  var recordId = (namespace2, key) => `${namespace2.length}:${namespace2}${key}`;
+  var copy2 = (record) => ({
+    ...record,
+    value: record.value.slice()
+  });
+  var _records2;
+  var MemoryPeerDeskStore = class {
+    constructor() {
+      __privateAdd(this, _records2, /* @__PURE__ */ new Map());
+    }
+    list(namespace2) {
+      return [...__privateGet(this, _records2).values()].filter((record) => record.namespace === namespace2).sort((left, right) => left.key.localeCompare(right.key)).map(copy2);
+    }
+    compareExchange(namespace2, key, expectedRevision, value) {
+      const id = recordId(namespace2, key);
+      const current = __privateGet(this, _records2).get(id);
+      if (current?.revision !== expectedRevision) {
+        throw new Error(
+          `peer desk record '${namespace2}/${key}' changed at revision ${current?.revision ?? "absent"}`
+        );
+      }
+      if (value === void 0) {
+        __privateGet(this, _records2).delete(id);
+        return void 0;
+      }
+      const next = Object.freeze({
+        namespace: namespace2,
+        key,
+        revision: (current?.revision ?? 0n) + 1n,
+        value: value.slice()
+      });
+      __privateGet(this, _records2).set(id, next);
+      return copy2(next);
+    }
+  };
+  _records2 = new WeakMap();
+
+  // ../src/runtime/custody_receipts.ts
+  var namespace = "nomos.peer-desk.custody-receipts/v1";
+  var encoder = new TextEncoder();
+  var decoder = new TextDecoder();
+  var MAX_BASES = 256;
+  var MAX_RECEIPTS = 4096;
+  var _store, _records3, _journals, _receipts;
+  var CustodyReceipts = class {
+    constructor(store = new MemoryPeerDeskStore()) {
+      __privateAdd(this, _store);
+      __privateAdd(this, _records3, /* @__PURE__ */ new Map());
+      __privateAdd(this, _journals, /* @__PURE__ */ new Map());
+      __privateAdd(this, _receipts, /* @__PURE__ */ new Map());
+      __privateSet(this, _store, store);
+      for (const record of store.list(namespace)) {
+        __privateGet(this, _records3).set(record.key, record);
+        try {
+          if (record.key.startsWith("receipt:")) {
+            const newline = record.value.indexOf(10);
+            if (newline < 0) continue;
+            const receipt = fromBinary(CustodyIntentAdmissionSchema, record.value.subarray(newline + 1));
+            const header2 = JSON.parse(decoder.decode(record.value.subarray(0, newline)));
+            if (receipt.outcome.case === "admitted" && typeof header2.generation === "string" && typeof header2.head === "string") __privateGet(this, _receipts).set(record.key, { ...header2, receipt });
+            continue;
+          }
+          if (!record.key.startsWith("head:")) continue;
+          const value = JSON.parse(decoder.decode(record.value));
+          if (typeof value.head !== "string" || typeof value.generation !== "string" || !Array.isArray(value.bases) || !Array.isArray(value.keys) || value.bases.length > MAX_BASES || value.keys.length > MAX_RECEIPTS) continue;
+          if (!value.bases.every((base) => typeof base === "string") || !value.keys.every((key) => typeof key === "string")) continue;
+          __privateGet(this, _journals).set(record.key.slice(5), value);
+        } catch {
+        }
+      }
+    }
+    covers(workspace, current, base) {
+      const value = __privateGet(this, _journals).get(workspace);
+      return value?.head === current && value.bases.includes(base);
+    }
+    receipt(workspace, current, change) {
+      const value = __privateGet(this, _journals).get(workspace);
+      if (value?.head !== current) return void 0;
+      const stored = __privateGet(this, _receipts).get(`receipt:${workspace}:${sha256Hex(change)}`);
+      if (stored?.generation !== value.generation) return void 0;
+      if (stored.head !== value.head && !value.bases.includes(stored.head)) return void 0;
+      return fromBinary(CustodyIntentAdmissionSchema, toBinary(CustodyIntentAdmissionSchema, stored.receipt));
+    }
+    record(workspace, before, after, receipts) {
+      const old = __privateGet(this, _journals).get(workspace);
+      const journalKey = `head:${workspace}`;
+      const value = old?.head === before ? { ...old, head: after, bases: [...old.bases], keys: [...old.keys] } : { head: after, bases: [], keys: [], generation: String((__privateGet(this, _records3).get(journalKey)?.revision ?? 0n) + 1n) };
+      if (before && before !== after) value.bases.push(before);
+      value.bases = [...new Set(value.bases)].slice(-MAX_BASES);
+      const keys = new Set(value.keys);
+      const discarded = new Set(old?.generation !== value.generation ? old?.keys : []);
+      for (const { change, receipt } of receipts) {
+        if (receipt.outcome.case !== "admitted") continue;
+        const key = `receipt:${workspace}:${sha256Hex(change)}`;
+        keys.delete(key);
+        keys.add(key);
+        discarded.delete(key);
+        const header2 = encoder.encode(`${JSON.stringify({ generation: value.generation, head: after })}
+`);
+        const body = toBinary(CustodyIntentAdmissionSchema, receipt);
+        const bytes = new Uint8Array(header2.length + body.length);
+        bytes.set(header2);
+        bytes.set(body, header2.length);
+        const record2 = __privateGet(this, _store).compareExchange(namespace, key, __privateGet(this, _records3).get(key)?.revision, bytes);
+        if (record2) __privateGet(this, _records3).set(key, record2);
+        __privateGet(this, _receipts).set(key, {
+          generation: value.generation,
+          head: after,
+          receipt: fromBinary(CustodyIntentAdmissionSchema, body)
+        });
+      }
+      const ordered = [...keys];
+      for (const key of ordered.slice(0, -MAX_RECEIPTS)) discarded.add(key);
+      value.keys = ordered.slice(-MAX_RECEIPTS);
+      for (const key of discarded) {
+        __privateGet(this, _store).compareExchange(namespace, key, __privateGet(this, _records3).get(key)?.revision, void 0);
+        __privateGet(this, _records3).delete(key);
+        __privateGet(this, _receipts).delete(key);
+      }
+      const record = __privateGet(this, _store).compareExchange(
+        namespace,
+        journalKey,
+        __privateGet(this, _records3).get(journalKey)?.revision,
+        encoder.encode(JSON.stringify(value))
+      );
+      if (record) __privateGet(this, _records3).set(journalKey, record);
+      __privateGet(this, _journals).set(workspace, value);
+    }
+  };
+  _store = new WeakMap();
+  _records3 = new WeakMap();
+  _journals = new WeakMap();
+  _receipts = new WeakMap();
+
   // ../src/runtime/custodian_placement.ts
   init_define_NOMOS_KERNEL_RELEASE();
   init_shims();
@@ -18200,19 +18386,21 @@
       this.reference = reference;
     }
   };
-  var _kernel6, _custody, _CustodyAdmissionDesk_instances, candidateOffers_fn, offer_fn, record_fn2;
+  var _kernel6, _custody, _receipts2, _CustodyAdmissionDesk_instances, candidateOffers_fn, offer_fn, record_fn2;
   var CustodyAdmissionDesk = class {
-    constructor(kernel, custody) {
+    constructor(kernel, custody, receipts = new CustodyReceipts()) {
       __privateAdd(this, _CustodyAdmissionDesk_instances);
       __privateAdd(this, _kernel6);
       __privateAdd(this, _custody);
+      __privateAdd(this, _receipts2);
       __privateSet(this, _kernel6, kernel);
       __privateSet(this, _custody, custody);
+      __privateSet(this, _receipts2, receipts);
     }
     admit(request, command) {
-      const session = request.target?.session;
-      if (!session) throw new Error("custody admission requires an addressed runtime session");
-      const mount = __privateGet(this, _custody).mountForSession(session);
+      const workspace = request.target?.workspace;
+      if (!workspace) throw new Error("custody admission requires an addressed workspace");
+      const mount = __privateGet(this, _custody).mountForWorkspace(workspace);
       if (command.evidencePack.byteLength > 0) {
         __privateGet(this, _kernel6).applyPack(mount, request.requestId, command.evidencePack);
       }
@@ -18223,21 +18411,42 @@
       const births = [];
       const admittedBase = __privateGet(this, _kernel6).head(mount, request.requestId) ?? "";
       if (command.fastForwardOnly && offers.length > 0 && (command.baseHead ?? "") !== admittedBase) {
+        for (const offer of offers) {
+          const receipt = __privateGet(this, _receipts2).receipt(mount.workspace, admittedBase, offer.changeUsda);
+          if (!receipt) continue;
+          receipt.commitOid = offer.commitOid;
+          const records = sessions.get(offer.session) ?? [];
+          records.push(receipt);
+          sessions.set(offer.session, records);
+        }
+        let delta = custodyReturnDelta(
+          __privateGet(this, _kernel6),
+          mount,
+          request.requestId,
+          command.baseHead,
+          admittedBase,
+          admittedBase,
+          command.observedHead
+        );
+        if (command.baseHead && command.observedHead !== admittedBase && __privateGet(this, _receipts2).covers(mount.workspace, admittedBase, command.baseHead)) {
+          try {
+            delta = {
+              resultBase: command.baseHead,
+              resultPack: __privateGet(this, _kernel6).packDelta(mount, request.requestId, admittedBase, command.baseHead),
+              recoveryRequired: false
+            };
+          } catch {
+          }
+        }
         return create(CustodyAdmissionSchema, {
           main: admittedBase,
-          ...custodyReturnDelta(
-            __privateGet(this, _kernel6),
-            mount,
-            request.requestId,
-            command.baseHead,
-            admittedBase,
-            admittedBase,
-            command.observedHead
-          )
+          sessions: [...sessions].map(([session, intents]) => create(CustodySessionAdmissionSchema, { session, intents })),
+          ...delta
         });
       }
       let main = admittedBase;
       const heldSessions = /* @__PURE__ */ new Map();
+      const receipts = [];
       for (const offer of offers) {
         const heldBehind = heldSessions.get(offer.session);
         const verdict = heldBehind === void 0 ? __privateMethod(this, _CustodyAdmissionDesk_instances, offer_fn).call(this, request, mount, offer) : create(OfferResponseSchema, { outcome: { case: "blockedOnDependency", value: {
@@ -18247,7 +18456,9 @@
           heldSessions.set(offer.session, verdict.outcome.value.offerId || offer.commitOid);
         }
         const records = sessions.get(offer.session) ?? [];
-        records.push(__privateMethod(this, _CustodyAdmissionDesk_instances, record_fn2).call(this, offer, verdict));
+        const receipt = __privateMethod(this, _CustodyAdmissionDesk_instances, record_fn2).call(this, offer, verdict);
+        records.push(receipt);
+        receipts.push({ change: offer.changeUsda, receipt });
         sessions.set(offer.session, records);
         if (verdict.outcome.case === "admitted") {
           main = verdict.outcome.value.head;
@@ -18263,6 +18474,9 @@
           }
         }
       }
+      if (receipts.some((entry) => entry.receipt.outcome.case === "admitted")) {
+        __privateGet(this, _receipts2).record(mount.workspace, admittedBase, main, receipts);
+      }
       return create(CustodyAdmissionSchema, {
         main,
         sessions: [...sessions].map(
@@ -18275,6 +18489,7 @@
   };
   _kernel6 = new WeakMap();
   _custody = new WeakMap();
+  _receipts2 = new WeakMap();
   _CustodyAdmissionDesk_instances = new WeakSet();
   candidateOffers_fn = function(request, mount, reference, requestedBase) {
     if (!/^refs\/heads\/session\/[A-Za-z0-9._/-]+$/.test(reference)) {
@@ -21137,18 +21352,18 @@
     }
     throw corrupt(record, `invalid '${state.case}' state`);
   }
-  var _store, _inventory, _loaded, _ReplicaFollowDesk_instances, sorted_fn, commit_fn;
+  var _store2, _inventory, _loaded, _ReplicaFollowDesk_instances, sorted_fn, commit_fn;
   var ReplicaFollowDesk = class {
     constructor(store) {
       __privateAdd(this, _ReplicaFollowDesk_instances);
-      __privateAdd(this, _store);
+      __privateAdd(this, _store2);
       __privateAdd(this, _inventory, /* @__PURE__ */ new Map());
       __privateAdd(this, _loaded, false);
-      __privateSet(this, _store, store);
+      __privateSet(this, _store2, store);
     }
     load() {
       if (!__privateGet(this, _loaded)) {
-        for (const record of __privateGet(this, _store).list(REPLICA_FOLLOW_NAMESPACE)) {
+        for (const record of __privateGet(this, _store2).list(REPLICA_FOLLOW_NAMESPACE)) {
           const follow = decode(record);
           __privateGet(this, _inventory).set(follow.spec.workspace, follow);
         }
@@ -21180,7 +21395,7 @@
       this.load();
       const current = __privateGet(this, _inventory).get(workspace);
       if (!current) return false;
-      __privateGet(this, _store).compareExchange(REPLICA_FOLLOW_NAMESPACE, workspace, current.revision, void 0);
+      __privateGet(this, _store2).compareExchange(REPLICA_FOLLOW_NAMESPACE, workspace, current.revision, void 0);
       __privateGet(this, _inventory).delete(workspace);
       return true;
     }
@@ -21261,7 +21476,7 @@
       return wakes;
     }
   };
-  _store = new WeakMap();
+  _store2 = new WeakMap();
   _inventory = new WeakMap();
   _loaded = new WeakMap();
   _ReplicaFollowDesk_instances = new WeakSet();
@@ -21269,7 +21484,7 @@
     return [...__privateGet(this, _inventory).values()].sort((left, right) => left.spec.workspace.localeCompare(right.spec.workspace));
   };
   commit_fn = function(next, expectedRevision) {
-    const stored = __privateGet(this, _store).compareExchange(
+    const stored = __privateGet(this, _store2).compareExchange(
       REPLICA_FOLLOW_NAMESPACE,
       next.spec.workspace,
       expectedRevision,
@@ -21359,37 +21574,37 @@
   init_define_NOMOS_KERNEL_RELEASE();
   init_shims();
   var PRESERVED_COPIES_NAMESPACE = "nomos.peer-desk.preserved-local-copies/v1";
-  var encoder = new TextEncoder();
-  var decoder = new TextDecoder();
-  var _store2;
+  var encoder2 = new TextEncoder();
+  var decoder2 = new TextDecoder();
+  var _store3;
   var PreservedCopiesDesk = class {
     constructor(store) {
-      __privateAdd(this, _store2);
-      __privateSet(this, _store2, store);
+      __privateAdd(this, _store3);
+      __privateSet(this, _store3, store);
     }
     list(workspace) {
-      const record = __privateGet(this, _store2).list(PRESERVED_COPIES_NAMESPACE).find((entry) => entry.key === workspace);
+      const record = __privateGet(this, _store3).list(PRESERVED_COPIES_NAMESPACE).find((entry) => entry.key === workspace);
       if (!record) return [];
-      const values = JSON.parse(decoder.decode(record.value));
+      const values = JSON.parse(decoder2.decode(record.value));
       if (!Array.isArray(values)) {
         throw new Error(`corrupt preserved-copy record for '${workspace}' at revision ${record.revision}`);
       }
       return values.map((value) => fromJsonString(PreservedLocalCopySchema, JSON.stringify(value)));
     }
     record(copy3) {
-      const current = __privateGet(this, _store2).list(PRESERVED_COPIES_NAMESPACE).find((entry) => entry.key === copy3.workspace);
+      const current = __privateGet(this, _store3).list(PRESERVED_COPIES_NAMESPACE).find((entry) => entry.key === copy3.workspace);
       const existing = this.list(copy3.workspace).filter((entry) => entry.preservedHead !== copy3.preservedHead);
       const next = [...existing, create(PreservedLocalCopySchema, copy3)];
-      const stored = __privateGet(this, _store2).compareExchange(
+      const stored = __privateGet(this, _store3).compareExchange(
         PRESERVED_COPIES_NAMESPACE,
         copy3.workspace,
         current?.revision,
-        encoder.encode(`[${next.map((entry) => toJsonString(PreservedLocalCopySchema, entry)).join(",")}]`)
+        encoder2.encode(`[${next.map((entry) => toJsonString(PreservedLocalCopySchema, entry)).join(",")}]`)
       );
       if (!stored) throw new Error(`preserved copy of '${copy3.workspace}' was not recorded`);
     }
   };
-  _store2 = new WeakMap();
+  _store3 = new WeakMap();
 
   // ../src/runtime/office_seat.ts
   init_define_NOMOS_KERNEL_RELEASE();
@@ -21430,9 +21645,9 @@
   ]);
   var SEAT_PREFIX = "nomos-office-seat/v1:";
   var SEAT_DIGEST_HEX = 64;
-  var encoder2 = new TextEncoder();
-  var decoder2 = new TextDecoder();
-  var header = (digest) => encoder2.encode(`${SEAT_PREFIX}${digest}
+  var encoder3 = new TextEncoder();
+  var decoder3 = new TextDecoder();
+  var header = (digest) => encoder3.encode(`${SEAT_PREFIX}${digest}
 `);
   var QuarantineReason = Object.freeze({
     /** Another office's seat: a copied state directory, or a store lifted from another peer. */
@@ -21443,7 +21658,7 @@
   function readSeal(value) {
     const headerLength = SEAT_PREFIX.length + SEAT_DIGEST_HEX + 1;
     if (value.byteLength < headerLength) return void 0;
-    const text = decoder2.decode(value.subarray(0, headerLength));
+    const text = decoder3.decode(value.subarray(0, headerLength));
     if (!text.startsWith(SEAT_PREFIX) || !text.endsWith("\n")) return void 0;
     const seat = text.slice(SEAT_PREFIX.length, headerLength - 1);
     if (!/^[0-9a-f]{64}$/.test(seat)) return void 0;
@@ -21469,32 +21684,32 @@
       __privateSet(this, _seat, seat);
       __privateSet(this, _report, report);
     }
-    list(namespace) {
-      if (LOCAL_ONLY_NAMESPACES.has(namespace)) return __privateGet(this, _inner).list(namespace);
+    list(namespace2) {
+      if (LOCAL_ONLY_NAMESPACES.has(namespace2)) return __privateGet(this, _inner).list(namespace2);
       const kept = [];
-      for (const record of __privateGet(this, _inner).list(namespace)) {
+      for (const record of __privateGet(this, _inner).list(namespace2)) {
         const sealed = readSeal(record.value);
         if (sealed?.seat === __privateGet(this, _seat).digest) {
           kept.push({ ...record, value: sealed.value.slice() });
           continue;
         }
-        __privateMethod(this, _SeatedPeerDeskStore_instances, quarantine_fn).call(this, namespace, record, sealed?.seat);
+        __privateMethod(this, _SeatedPeerDeskStore_instances, quarantine_fn).call(this, namespace2, record, sealed?.seat);
       }
       return kept;
     }
-    compareExchange(namespace, key, expectedRevision, value) {
-      if (LOCAL_ONLY_NAMESPACES.has(namespace)) {
-        return __privateGet(this, _inner).compareExchange(namespace, key, expectedRevision, value);
+    compareExchange(namespace2, key, expectedRevision, value) {
+      if (LOCAL_ONLY_NAMESPACES.has(namespace2)) {
+        return __privateGet(this, _inner).compareExchange(namespace2, key, expectedRevision, value);
       }
       const stored = __privateGet(this, _inner).compareExchange(
-        namespace,
+        namespace2,
         key,
         expectedRevision,
         value === void 0 ? void 0 : seal(__privateGet(this, _seat).digest, value)
       );
       if (stored === void 0) return void 0;
       const sealed = readSeal(stored.value);
-      if (!sealed) throw new Error(`peer desk record '${namespace}/${key}' lost its office seat`);
+      if (!sealed) throw new Error(`peer desk record '${namespace2}/${key}' lost its office seat`);
       return { ...stored, value: sealed.value.slice() };
     }
   };
@@ -21503,15 +21718,15 @@
   _report = new WeakMap();
   _SeatedPeerDeskStore_instances = new WeakSet();
   /** Preserve the foreign record under the quarantine namespace, then free the slot. */
-  quarantine_fn = function(namespace, record, recordedSeat) {
-    const key = `${namespace}\0${record.key}\0${record.revision}`;
+  quarantine_fn = function(namespace2, record, recordedSeat) {
+    const key = `${namespace2}\0${record.key}\0${record.revision}`;
     try {
       __privateGet(this, _inner).compareExchange(QUARANTINED_BINDINGS_NAMESPACE, key, void 0, record.value);
     } catch {
     }
-    __privateGet(this, _inner).compareExchange(namespace, record.key, record.revision, void 0);
+    __privateGet(this, _inner).compareExchange(namespace2, record.key, record.revision, void 0);
     __privateGet(this, _report).call(this, create(QuarantinedBindingSchema, {
-      namespace,
+      namespace: namespace2,
       key: record.key,
       reason: recordedSeat === void 0 ? QuarantineReason.Unseated : QuarantineReason.ForeignSeat,
       recordedSeat: recordedSeat ?? "",
@@ -21563,6 +21778,7 @@
       const undiscovered = /* @__PURE__ */ new Set();
       for (const restored of __privateGet(this, _follows).recover()) {
         following.set(restored.workspace, restored.delayMillis);
+        followed.add(restored.workspace);
       }
       if (!__privateGet(this, _bootstrapped)) {
         __privateSet(this, _bootstrapped, true);
@@ -21600,6 +21816,7 @@
             stopped.delete(workspace);
           } else if (reconciliation.changed) {
             following.delete(workspace);
+            followed.delete(workspace);
             stopped.add(workspace);
           }
         } catch (error) {
@@ -21968,13 +22185,16 @@
         wasResident: this.kernel.isResident(binding.workspace) !== false
       };
       __privateGet(this, _links).set(binding.workspace, link);
-      if (link.wasResident) __privateMethod(this, _LiveCorrespondenceDesk_instances, open_fn2).call(this, link);
+      if (!link.publisher || link.wasResident) __privateMethod(this, _LiveCorrespondenceDesk_instances, open_fn2).call(this, link);
     }
     changed(workspace) {
       const link = __privateGet(this, _links).get(workspace);
       if (link) link.dirty = true;
     }
     export(binding, base, requestId) {
+      if (this.kernel.isResident(binding.workspace) === false) {
+        return create(CustodyOfferBatchRequestSchema, { protocolVersion: 2 });
+      }
       const mount = workspaceMount(binding.workspace);
       const head = this.kernel.head(mount, requestId);
       if (!base || !head || base === head) return create(CustodyOfferBatchRequestSchema, { protocolVersion: 2 });
@@ -22035,6 +22255,7 @@
       }
       if (frame.message.case === "frontier") {
         __privateMethod(this, _LiveCorrespondenceDesk_instances, announced_fn).call(this, link, frame.message.value.head);
+        if (this.kernel.isResident(link.binding.workspace) === false) return;
         if (!frame.message.value.response) {
           __privateMethod(this, _LiveCorrespondenceDesk_instances, send_fn).call(this, link, { case: "frontier", value: {
             head: this.kernel.head(workspaceMount(link.binding.workspace), ++__privateWrapper(this, _requestId2)._) ?? "",
@@ -22051,6 +22272,10 @@
       if (frame.message.case !== "offers") return;
       const batch = frame.message.value;
       if (batch.protocolVersion !== 2 || !batch.requestId || batch.source.case !== "inline" || !batch.source.value.offers.length) return;
+      if (this.kernel.isResident(link.binding.workspace) === false) {
+        this.remoteAdvanced?.(link.binding.workspace);
+        return;
+      }
       if ([...__privateGet(this, _pending3).values()].some((pending) => pending.link === link && pending.bytes.length === bytes.length && pending.bytes.every((byte, index) => byte === bytes[index]))) return;
       if (__privateGet(this, _pending3).size >= 32) return;
       __privateGet(this, _pending3).set(request.requestId, { link, bytes });
@@ -22058,7 +22283,16 @@
         protocolVersion: 2,
         requestId: request.requestId,
         target: { workspace: link.binding.workspace, session: link.binding.replicaId },
-        command: { case: "admitCustodyOffers", value: create(CustodyOfferBatchRequestSchema, { ...batch, baseHead: void 0 }) }
+        // HTTP sender reconciliation controls are not part of a live proposal.
+        // Keeping fastForwardOnly while removing baseHead silently skips every
+        // offer against a nonempty local head. The Kernel judges sealed causality;
+        // live receivers neither ask for a return archive nor confirm the sender.
+        command: { case: "admitCustodyOffers", value: create(CustodyOfferBatchRequestSchema, {
+          ...batch,
+          baseHead: void 0,
+          observedHead: void 0,
+          fastForwardOnly: false
+        }) }
       });
     }
     settled(request, response) {
@@ -22073,6 +22307,7 @@
     disconnect(workspace) {
       const link = __privateGet(this, _links).get(workspace);
       if (!link) return;
+      if (link.state === "open") this.linkClosed?.(workspace);
       __privateMethod(this, _LiveCorrespondenceDesk_instances, effect_fn).call(this, link, { case: "close", value: true });
       __privateGet(this, _links).delete(workspace);
       for (const [id, pending] of __privateGet(this, _pending3)) if (pending.link === link) __privateGet(this, _pending3).delete(id);
@@ -22081,19 +22316,20 @@
       const now = this.clock.monotonicNanoseconds();
       let wake;
       for (const link of __privateGet(this, _links).values()) {
-        if (this.kernel.isResident(link.binding.workspace) === false) {
+        const resident = this.kernel.isResident(link.binding.workspace) !== false;
+        if (link.publisher && !resident) {
           if (link.wasResident) this.disconnect(link.binding.workspace);
           else wake = wake === void 0 || wake > 250n ? 250n : wake;
           continue;
         }
-        link.wasResident = true;
+        if (resident) link.wasResident = true;
         if (link.state === "opening" && now >= link.due) {
           __privateMethod(this, _LiveCorrespondenceDesk_instances, effect_fn).call(this, link, { case: "close", value: true });
           link.state = "closed";
         }
         if (link.state === "closed" && now >= link.due) __privateMethod(this, _LiveCorrespondenceDesk_instances, open_fn2).call(this, link);
         if (link.state === "open") {
-          if (link.dirty) {
+          if (link.dirty && resident) {
             link.dirty = false;
             try {
               link.published ?? (link.published = link.publisher ? this.kernel.head(workspaceMount(link.binding.workspace), ++__privateWrapper(this, _requestId2)._) : this.kernel.resolveRef(workspaceMount(link.binding.workspace), ++__privateWrapper(this, _requestId2)._, "refs/remotes/nomos/main"));
@@ -22112,8 +22348,7 @@
       return wake;
     }
     close() {
-      for (const link of __privateGet(this, _links).values()) __privateMethod(this, _LiveCorrespondenceDesk_instances, effect_fn).call(this, link, { case: "close", value: true });
-      __privateGet(this, _links).clear();
+      for (const workspace of [...__privateGet(this, _links).keys()]) this.disconnect(workspace);
       __privateGet(this, _pending3).clear();
     }
   };
@@ -22148,6 +22383,10 @@
   announced_fn = function(link, head) {
     if (!head || link.lastAnnounced === head) return;
     link.lastAnnounced = head;
+    if (this.kernel.isResident(link.binding.workspace) === false) {
+      this.remoteAdvanced?.(link.binding.workspace);
+      return;
+    }
     const mount = workspaceMount(link.binding.workspace);
     if (head === this.kernel.head(mount, ++__privateWrapper(this, _requestId2)._) || head === this.kernel.resolveRef(mount, ++__privateWrapper(this, _requestId2)._, "refs/remotes/nomos/main")) return;
     this.remoteAdvanced?.(link.binding.workspace);
@@ -22157,11 +22396,16 @@
   placementAnnounced_fn = function(link, frontier) {
     if (!frontier || link.lastPlacementAnnounced === frontier) return;
     link.lastPlacementAnnounced = frontier;
+    if (this.kernel.isResident(link.binding.workspace) === false) {
+      this.placementAdvanced?.(link.binding.workspace);
+      return;
+    }
     const mount = workspaceMount(link.binding.workspace);
     if (frontier === this.kernel.resolveRef(mount, ++__privateWrapper(this, _requestId2)._, PLACEMENT_REF2)) return;
     this.placementAdvanced?.(link.binding.workspace);
   };
   hello_fn = function(link) {
+    if (this.kernel.isResident(link.binding.workspace) === false) return;
     const head = this.kernel.head(workspaceMount(link.binding.workspace), ++__privateWrapper(this, _requestId2)._);
     __privateMethod(this, _LiveCorrespondenceDesk_instances, send_fn).call(this, link, { case: "frontier", value: { head: head ?? "" } });
   };
@@ -22298,9 +22542,9 @@
         command.namespace === void 0 ? {} : { "custody.children_namespace": command.namespace },
         () => __privateGet(this, _kernel12).childWorkspaces(mount, request.requestId)
       );
-      const namespace = command.namespace;
-      const selected = namespace === void 0 ? result.children : result.children.filter(
-        (child) => child.status === ChildWorkspaceLifecycleStatus.ACTIVE && isKeyedBirthOf(namespace, child.workspace)
+      const namespace2 = command.namespace;
+      const selected = namespace2 === void 0 ? result.children : result.children.filter(
+        (child) => child.status === ChildWorkspaceLifecycleStatus.ACTIVE && isKeyedBirthOf(namespace2, child.workspace)
       );
       return create(ChildWorkspaceListSchema, {
         children: selected.map((child) => create(ChildWorkspaceSchema, {
@@ -22691,46 +22935,6 @@
   init_define_NOMOS_KERNEL_RELEASE();
   init_shims();
 
-  // ../src/runtime/peer_desk_store.ts
-  init_define_NOMOS_KERNEL_RELEASE();
-  init_shims();
-  var recordId = (namespace, key) => `${namespace.length}:${namespace}${key}`;
-  var copy2 = (record) => ({
-    ...record,
-    value: record.value.slice()
-  });
-  var _records2;
-  var MemoryPeerDeskStore = class {
-    constructor() {
-      __privateAdd(this, _records2, /* @__PURE__ */ new Map());
-    }
-    list(namespace) {
-      return [...__privateGet(this, _records2).values()].filter((record) => record.namespace === namespace).sort((left, right) => left.key.localeCompare(right.key)).map(copy2);
-    }
-    compareExchange(namespace, key, expectedRevision, value) {
-      const id = recordId(namespace, key);
-      const current = __privateGet(this, _records2).get(id);
-      if (current?.revision !== expectedRevision) {
-        throw new Error(
-          `peer desk record '${namespace}/${key}' changed at revision ${current?.revision ?? "absent"}`
-        );
-      }
-      if (value === void 0) {
-        __privateGet(this, _records2).delete(id);
-        return void 0;
-      }
-      const next = Object.freeze({
-        namespace,
-        key,
-        revision: (current?.revision ?? 0n) + 1n,
-        value: value.slice()
-      });
-      __privateGet(this, _records2).set(id, next);
-      return copy2(next);
-    }
-  };
-  _records2 = new WeakMap();
-
   // ../src/runtime/correspondence_recovery.ts
   init_define_NOMOS_KERNEL_RELEASE();
   init_shims();
@@ -23098,7 +23302,7 @@
     const finished = clock.monotonicNanoseconds();
     return finished >= started ? Number(finished - started) / 1e6 : 0;
   };
-  var _kernel16, _credentials4, _clock13, _mount, _binding, _route2, _rediscover, _reroute, _discoveredFrontier, _observePlacement, _recheckPlacement, _directoryAnswered, _placementFetched, _leased, _command2, _requestId4, _started, _state, _localHead, _offerHead, _previousHead, _pushMillis, _pushBytes, _desiredHead, _returnedPackHead, _candidateDurable, _admissionSummary, _offerReceipt, _pushError, _current3, _lastReceiptEffectId2, _offerSequence, _lastStep2, _probeOnly, _establishedBase, _receiveState, _completeHistory, _lawProductsImported, _shallowMounted, _fetchedLawProducts, _beforeConverge, _needsReconciliation, _offerAfterConverge, _rebaseFrom, _rebases, _parkedLocal, _replaceLocalHead, _repairMissingCommit, _WorkspaceSyncWork_instances, openRound_fn, offerOrReconcile_fn, establishBase_fn, missingTrackedBase_fn, holdsLocalWork_fn, pullBeforeOffer_fn, leaseEffect_fn, beginOffer_fn, acceptOffer_fn, acceptLease_fn, placementFrontier_fn, placementOnly_fn, acceptDiscovery_fn, providerCustody_fn, beginMainFetch_fn, acceptFetch_fn, mountFetched_fn, lawProductsAlongside_fn, acceptLawProducts_fn, providerCustodyMounted_fn, importLawProducts_fn, converge_fn2, unrelatedLineageRefusal_fn, replaceLocal_fn, converged_fn, offerAfterRebase_fn, preservedCopy_fn, alreadyJudged_fn, rememberJudgment_fn, forgetJudgment_fn, present_fn, finishOfferOutcome_fn, transportFailure_fn, remember_fn4, finish_fn2, cloudBase_fn, offerEndpoint_fn, workspaceEndpoint_fn, authToken_fn;
+  var _kernel16, _credentials4, _clock13, _mount, _binding, _route2, _rediscover, _reroute, _discoveredFrontier, _observePlacement, _recheckPlacement, _directoryAnswered, _placementFetched, _leased, _command2, _requestId4, _started, _state, _localHead, _offerHead, _previousHead, _pushMillis, _pushBytes, _desiredHead, _returnedPackHead, _candidateDurable, _admissionSummary, _offerReceipt, _pushError, _current3, _lastReceiptEffectId2, _offerSequence, _lastStep2, _probeOnly, _liveConnected, _establishedBase, _receiveState, _completeHistory, _lawProductsImported, _shallowMounted, _fetchedLawProducts, _beforeConverge, _needsReconciliation, _offerAfterConverge, _rebaseFrom, _rebases, _parkedLocal, _replaceLocalHead, _repairMissingCommit, _WorkspaceSyncWork_instances, openRound_fn, offerOrReconcile_fn, establishBase_fn, missingTrackedBase_fn, holdsLocalWork_fn, pullBeforeOffer_fn, leaseEffect_fn, beginOffer_fn, acceptOffer_fn, acceptLease_fn, placementFrontier_fn, placementOnly_fn, acceptDiscovery_fn, providerCustody_fn, beginMainFetch_fn, acceptFetch_fn, mountFetched_fn, lawProductsAlongside_fn, acceptLawProducts_fn, providerCustodyMounted_fn, importLawProducts_fn, converge_fn2, unrelatedLineageRefusal_fn, replaceLocal_fn, converged_fn, offerAfterRebase_fn, preservedCopy_fn, alreadyJudged_fn, rememberJudgment_fn, forgetJudgment_fn, present_fn, finishOfferOutcome_fn, transportFailure_fn, remember_fn4, finish_fn2, cloudBase_fn, offerEndpoint_fn, workspaceEndpoint_fn, authToken_fn;
   var WorkspaceSyncWork = class {
     constructor(args) {
       __privateAdd(this, _WorkspaceSyncWork_instances);
@@ -23142,6 +23346,7 @@
       __privateAdd(this, _offerSequence, 0);
       __privateAdd(this, _lastStep2);
       __privateAdd(this, _probeOnly);
+      __privateAdd(this, _liveConnected);
       /** Set when this round adopted the upstream's own head as its base (see #establishBase). */
       __privateAdd(this, _establishedBase);
       __privateAdd(this, _receiveState);
@@ -23169,6 +23374,7 @@
       __privateSet(this, _directoryAnswered, args.directoryAnswered);
       __privateSet(this, _placementFetched, args.placementFetched);
       __privateSet(this, _probeOnly, args.probeOnly ?? false);
+      __privateSet(this, _liveConnected, args.liveConnected === true);
       __privateSet(this, _receiveState, args.receiveState);
       __privateSet(this, _completeHistory, args.completeHistory === true);
       __privateSet(this, _repairMissingCommit, args.repairMissingCommit === true);
@@ -23318,6 +23524,7 @@
   _offerSequence = new WeakMap();
   _lastStep2 = new WeakMap();
   _probeOnly = new WeakMap();
+  _liveConnected = new WeakMap();
   _establishedBase = new WeakMap();
   _receiveState = new WeakMap();
   _completeHistory = new WeakMap();
@@ -23336,6 +23543,9 @@
   openRound_fn = function() {
     if (__privateGet(this, _receiveState) || __privateGet(this, _replaceLocalHead) !== void 0) return __privateMethod(this, _WorkspaceSyncWork_instances, leaseEffect_fn).call(this);
     if (!__privateGet(this, _localHead)) return __privateMethod(this, _WorkspaceSyncWork_instances, leaseEffect_fn).call(this);
+    if (__privateGet(this, _liveConnected) && !__privateGet(this, _probeOnly) && __privateMethod(this, _WorkspaceSyncWork_instances, holdsLocalWork_fn).call(this) && __privateGet(this, _previousHead)) {
+      return __privateMethod(this, _WorkspaceSyncWork_instances, offerOrReconcile_fn).call(this);
+    }
     const requestId = `${__privateGet(this, _binding).replicaId}:${__privateGet(this, _requestId4)}:${this.workId}:frontier`;
     return __privateMethod(this, _WorkspaceSyncWork_instances, beginOffer_fn).call(this, encodeInlineCustodyOffer({
       session: __privateGet(this, _binding).replicaId,
@@ -23522,6 +23732,18 @@
       return __privateMethod(this, _WorkspaceSyncWork_instances, finishOfferOutcome_fn).call(this, false);
     }
     const admission = outcome.value;
+    globalThis.__nomosSyncDiagnostic?.("sync.admission", {
+      workspace: __privateGet(this, _mount).workspace,
+      phase: state.phase,
+      local: __privateGet(this, _localHead),
+      tracked: __privateGet(this, _previousHead),
+      remote: admission.main,
+      sealed: admission.sealedMain,
+      resultBase: admission.resultBase,
+      resultBytes: admission.resultPack.byteLength,
+      recoveryRequired: admission.recoveryRequired,
+      summary: summarizeCustodyAdmission(admission)
+    });
     __privateSet(this, _desiredHead, admission.main || void 0);
     if (!__privateGet(this, _desiredHead)) return __privateMethod(this, _WorkspaceSyncWork_instances, transportFailure_fn).call(this, "resident peer returned no admitted frontier", false);
     __privateSet(this, _candidateDurable, admission.sealedMain === __privateGet(this, _desiredHead));
@@ -24109,6 +24331,19 @@
     return step;
   };
   finish_fn2 = function(value) {
+    globalThis.__nomosSyncDiagnostic?.("sync.finished", {
+      workspace: value.workspace,
+      previous: value.previousHead,
+      current: value.currentHead,
+      stillAhead: value.stillAhead,
+      deferred: String(value.deferred),
+      admitted: String(value.admitted),
+      reconnect: value.reconnectRequired,
+      directOfferDeferred: value.directOfferDeferred,
+      pushFailed: value.pushFailed,
+      failure: value.pushError?.message,
+      wallMs: elapsedMillis(__privateGet(this, _clock13), __privateGet(this, _started))
+    });
     __privateSet(this, _state, { phase: WorkspaceSyncPhase.Done });
     __privateSet(this, _current3, void 0);
     return __privateMethod(this, _WorkspaceSyncWork_instances, remember_fn4).call(this, { case: "synced", value });
@@ -24167,6 +24402,10 @@
         __privateSet(this, _plan2, [__privateGet(this, _args).root]);
         return __privateMethod(this, _WorkspaceDependencySyncWork_instances, advance_fn4).call(this);
       }
+      if (__privateGet(this, _args).liveConnected && __privateGet(this, _args).kernel.resolveRef(__privateGet(this, _args).root.mount, __privateGet(this, _args).requestId, trackedMain2)) {
+        __privateSet(this, _plan2, __privateMethod(this, _WorkspaceDependencySyncWork_instances, planDependencies_fn).call(this));
+        return __privateMethod(this, _WorkspaceDependencySyncWork_instances, advance_fn4).call(this);
+      }
       __privateSet(this, _current4, __privateMethod(this, _WorkspaceDependencySyncWork_instances, work_fn).call(this, __privateGet(this, _args).root, `${this.workId}:frontier`, true));
       return __privateMethod(this, _WorkspaceDependencySyncWork_instances, accept_fn).call(this, __privateGet(this, _current4).start());
     }
@@ -25396,7 +25635,7 @@
   // ../src/runtime/correspondence_desk.ts
   var REFETCH_AWAITS_PROVIDER = "nomos.runtime.refetch_awaits_provider";
   var LOCAL_COPY_REFETCHING = "nomos.runtime.local_copy_refetching";
-  var _kernel20, _retention3, _custodyStorage, _custody3, _sessions11, _credentials5, _placement3, _clock18, _outboxClock, _follows2, _followLane, _readability2, _origins3, _preserved, _dropReasons, _lawProductsImported2, _replacing, _providerServesSameCopy, _events4, _onSyncFrontier, _onSyncCompleted, _onPlacementFetched, _onShallowMount, _remoteOffers, _recoveries, _deliveries, _httpDeliveries, _syncs, _syncWorkspaces, _retries, _remoteDeliveryKeys, _outboxDueAt, _settledFollowReported, _openLinks, _linkReported, _followsReported, _recoveredOutboxes, _outboxObservations, _outboxCursor, _httpDeliveryPaths, _executesCustodianObligations, _CorrespondenceDesk_instances, eligibleOutboxEntry_fn, settleDelivery_fn, activeSyncEffect_fn, dropReason_fn, roundInFlight_fn, observeSyncResult_fn, syncFailed_fn, scheduleFromResult_fn, syncCompleted_fn, recordPreserved_fn, scheduleOutbox_fn;
+  var _kernel20, _retention3, _custodyStorage, _custody3, _sessions11, _credentials5, _placement3, _clock18, _outboxClock, _follows2, _followLane, _readability2, _origins3, _preserved, _dropReasons, _lawProductsImported2, _replacing, _providerServesSameCopy, _events4, _onSyncFrontier, _onSyncCompleted, _onPlacementFetched, _onShallowMount, _onOutboxHistoryRequired, _remoteOffers, _recoveries, _deliveries, _httpDeliveries, _syncs, _syncWorkspaces, _retries, _remoteDeliveryKeys, _outboxDueAt, _settledFollowReported, _openLinks, _linkReported, _followsReported, _recoveredOutboxes, _outboxObservations, _outboxCursor, _httpDeliveryPaths, _executesCustodianObligations, _CorrespondenceDesk_instances, eligibleOutboxEntry_fn, settleDelivery_fn, activeSyncEffect_fn, dropReason_fn, roundInFlight_fn, observeSyncResult_fn, syncFailed_fn, scheduleFromResult_fn, syncCompleted_fn, recordPreserved_fn, scheduleOutbox_fn;
   var CorrespondenceDesk = class {
     constructor(args) {
       __privateAdd(this, _CorrespondenceDesk_instances);
@@ -25427,6 +25666,7 @@
       __privateAdd(this, _onSyncCompleted);
       __privateAdd(this, _onPlacementFetched);
       __privateAdd(this, _onShallowMount);
+      __privateAdd(this, _onOutboxHistoryRequired);
       __privateAdd(this, _remoteOffers, new CorrespondenceWorkRegistry());
       __privateAdd(this, _recoveries, new CorrespondenceWorkRegistry());
       __privateAdd(this, _deliveries, new CorrespondenceWorkRegistry());
@@ -25472,6 +25712,7 @@
       __privateSet(this, _onSyncCompleted, args.onSyncCompleted);
       __privateSet(this, _onPlacementFetched, args.onPlacementFetched);
       __privateSet(this, _onShallowMount, args.onShallowMount);
+      __privateSet(this, _onOutboxHistoryRequired, args.onOutboxHistoryRequired);
       __privateSet(this, _clock18, args.clock);
       __privateSet(this, _outboxClock, new OutboxObservationClock(args.clock, args.peerIdentity));
       __privateSet(this, _executesCustodianObligations, args.executesCustodianObligations ?? false);
@@ -25601,6 +25842,15 @@
       __privateGet(this, _followLane).dependencyAdvanced(workspace);
       this.reportFollows();
     }
+    /** Received custody can release correspondence and foreign-read dependencies,
+     * but is not newly authored work to send back to its upstream. Recovery is
+     * driven separately by missing history, reconnects and provider announcements.
+     * In particular an optimistic relay is not a durable upstream receipt. */
+    receivedFrontierChanged(workspace) {
+      this.wakeOutbox(workspace);
+      __privateGet(this, _followLane).dependencyAdvanced(workspace);
+      this.reportFollows();
+    }
     /**
      * Tell a workspace's sessions what its durable follow ALREADY knows.
      *
@@ -25830,8 +26080,16 @@
           )
         );
       } catch (error) {
+        if (error instanceof KernelHistoryRequired && __privateGet(this, _onOutboxHistoryRequired)) {
+          const retry = __privateGet(this, _onOutboxHistoryRequired).call(this, workspace, binding.credentialCapability);
+          __privateGet(this, _outboxDueAt).set(workspace, now + Math.max(250, retry));
+          return { nextAfterMillis: 0 };
+        }
         const format = localCopyFormatRefusal(error);
-        if (format === void 0) throw error;
+        if (format === void 0) {
+          __privateGet(this, _outboxDueAt).set(workspace, now + 3e4);
+          return { nextAfterMillis: 0 };
+        }
         __privateGet(this, _readability2).mark(workspace, void 0, format);
         __privateGet(this, _outboxDueAt).delete(workspace);
         return { nextAfterMillis: 0 };
@@ -26108,6 +26366,7 @@
           requestId: request.requestId,
           workId: id,
           probeOnly,
+          liveConnected: __privateGet(this, _openLinks).has(target3.mount.workspace),
           ...beforeConverge === void 0 ? {} : { beforeConverge },
           ...target3.receiveState === void 0 ? {} : { receiveState: target3.receiveState },
           ...target3.offerHead === void 0 ? {} : { offerHead: target3.offerHead },
@@ -26138,6 +26397,7 @@
           root,
           work,
           outbound: command.admit,
+          liveConnected: __privateGet(this, _openLinks).has(mount.workspace),
           dependency: (workspace, source, acquire2 = false) => {
             if (__privateMethod(this, _CorrespondenceDesk_instances, roundInFlight_fn).call(this, workspace, workId2)) return void 0;
             const existing = __privateGet(this, _follows2).bindingForWorkspace(workspace);
@@ -26303,6 +26563,7 @@
   _onSyncCompleted = new WeakMap();
   _onPlacementFetched = new WeakMap();
   _onShallowMount = new WeakMap();
+  _onOutboxHistoryRequired = new WeakMap();
   _remoteOffers = new WeakMap();
   _recoveries = new WeakMap();
   _deliveries = new WeakMap();
@@ -27855,15 +28116,15 @@
   var HISTORY_ACQUISITION_NAMESPACE = "nomos.peer-desk.history-acquisition/v1";
   var HISTORY_BACKGROUND_START_MILLIS = 1e4;
   var SLICE_ANSWER_MILLIS = 5 * 6e4;
-  var encoder3 = new TextEncoder();
-  var decoder3 = new TextDecoder();
+  var encoder4 = new TextEncoder();
+  var decoder4 = new TextDecoder();
   var workId = (workspace) => `history-acquisition:${workspace}`;
   var effectId = (workspace, attempt) => `history-acquisition:${workspace}:${HistoryAcquisitionPhase.Acquiring}:${attempt}`;
   var encode2 = (work) => {
     if (!work.credentialCapability) {
       throw new Error(`history acquisition for '${work.workspace}' has not restored its credential capability`);
     }
-    return encoder3.encode(JSON.stringify({
+    return encoder4.encode(JSON.stringify({
       version: 2,
       workspace: work.workspace,
       credentialCapability: work.credentialCapability,
@@ -27872,7 +28133,7 @@
   };
   var upgraded = (state) => state.case === "backoff" ? { case: HistoryAcquisitionPhase.Paced, attempt: state.attempt, delayMillis: state.delayMillis, failed: true } : state;
   var decode2 = (record) => {
-    const value = JSON.parse(decoder3.decode(record.value));
+    const value = JSON.parse(decoder4.decode(record.value));
     if (!value || typeof value !== "object") throw corrupt2(record, "not an object");
     const candidate = value;
     if (candidate.version !== 1 && candidate.version !== 2 || candidate.workspace !== record.key || !candidate.state) {
@@ -27908,11 +28169,11 @@
     }
     throw corrupt2(record, `invalid '${state.case}' state`);
   }
-  var _store3, _clock20, _credentialCapabilityForWorkspace2, _inventory5, _dueAt2, _handedOutAt, _settled3, _loaded2, _HistoryAcquisitionDesk_instances, ensure_fn, activate_fn, load_fn, all_fn, get_fn, transition_fn, commit_fn2, pending_fn2, now_fn8;
+  var _store4, _clock20, _credentialCapabilityForWorkspace2, _inventory5, _dueAt2, _handedOutAt, _settled3, _loaded2, _HistoryAcquisitionDesk_instances, ensure_fn, activate_fn, load_fn, all_fn, get_fn, transition_fn, commit_fn2, pending_fn2, now_fn8;
   var HistoryAcquisitionDesk = class {
     constructor(store, clock, credentialCapabilityForWorkspace) {
       __privateAdd(this, _HistoryAcquisitionDesk_instances);
-      __privateAdd(this, _store3);
+      __privateAdd(this, _store4);
       __privateAdd(this, _clock20);
       __privateAdd(this, _credentialCapabilityForWorkspace2);
       __privateAdd(this, _inventory5, /* @__PURE__ */ new Map());
@@ -27925,7 +28186,7 @@
        * same answer, never "unknown work". */
       __privateAdd(this, _settled3, /* @__PURE__ */ new Set());
       __privateAdd(this, _loaded2, false);
-      __privateSet(this, _store3, store);
+      __privateSet(this, _store4, store);
       __privateSet(this, _clock20, clock);
       __privateSet(this, _credentialCapabilityForWorkspace2, credentialCapabilityForWorkspace);
     }
@@ -27937,6 +28198,21 @@
       __privateMethod(this, _HistoryAcquisitionDesk_instances, ensure_fn).call(this, workspace, credentialCapability);
       __privateGet(this, _dueAt2).set(workspace, __privateMethod(this, _HistoryAcquisitionDesk_instances, now_fn8).call(this) + HISTORY_BACKGROUND_START_MILLIS);
     }
+    /** A background kernel read needs an omitted ancestor now. Queue one bounded
+     * slice on the existing history lane; a failed slice keeps its retry pace. */
+    requestFromBackground(workspace, credentialCapability) {
+      if (!workspace) throw new Error("kernel history requirement names no workspace");
+      __privateMethod(this, _HistoryAcquisitionDesk_instances, ensure_fn).call(this, workspace, credentialCapability);
+      const work = __privateMethod(this, _HistoryAcquisitionDesk_instances, get_fn).call(this, workspace);
+      const now = __privateMethod(this, _HistoryAcquisitionDesk_instances, now_fn8).call(this);
+      if (work.state.case === HistoryAcquisitionPhase.Paced && work.state.failed) {
+        const due2 = __privateGet(this, _dueAt2).get(workspace) ?? now + work.state.delayMillis;
+        __privateGet(this, _dueAt2).set(workspace, due2);
+        if (due2 > now) return due2 - now;
+      }
+      __privateGet(this, _dueAt2).set(workspace, now);
+      return 250;
+    }
     /** An operation needs history this custody lacks: its next slice now, joining one in flight. */
     begin(workspace, credentialCapability) {
       if (!workspace) throw new Error("kernel history requirement names no workspace");
@@ -27993,7 +28269,7 @@
       __privateGet(this, _handedOutAt).delete(work.workspace);
       switch (next.state.case) {
         case HistoryAcquisitionPhase.Settled:
-          __privateGet(this, _store3).compareExchange(HISTORY_ACQUISITION_NAMESPACE, work.workspace, next.revision, void 0);
+          __privateGet(this, _store4).compareExchange(HISTORY_ACQUISITION_NAMESPACE, work.workspace, next.revision, void 0);
           __privateGet(this, _inventory5).delete(work.workspace);
           __privateGet(this, _dueAt2).delete(work.workspace);
           __privateGet(this, _settled3).add(workId(work.workspace));
@@ -28050,7 +28326,7 @@
       return [...__privateMethod(this, _HistoryAcquisitionDesk_instances, all_fn).call(this)].map((work) => work.workspace);
     }
   };
-  _store3 = new WeakMap();
+  _store4 = new WeakMap();
   _clock20 = new WeakMap();
   _credentialCapabilityForWorkspace2 = new WeakMap();
   _inventory5 = new WeakMap();
@@ -28087,7 +28363,7 @@
   };
   load_fn = function() {
     if (__privateGet(this, _loaded2)) return;
-    for (const record of __privateGet(this, _store3).list(HISTORY_ACQUISITION_NAMESPACE)) {
+    for (const record of __privateGet(this, _store4).list(HISTORY_ACQUISITION_NAMESPACE)) {
       const work = decode2(record);
       __privateGet(this, _inventory5).set(work.workspace, work);
     }
@@ -28109,7 +28385,7 @@
     }, work.revision);
   };
   commit_fn2 = function(next, expectedRevision) {
-    const stored = __privateGet(this, _store3).compareExchange(
+    const stored = __privateGet(this, _store4).compareExchange(
       HISTORY_ACQUISITION_NAMESPACE,
       next.workspace,
       expectedRevision,
@@ -28162,7 +28438,7 @@
   }
   var INTERACTIVE_PEER_CLASSES = /* @__PURE__ */ new Set(["personal-device", "browser"]);
   var INTERACTION_FIRST_MILLIS = 15e3;
-  var _kernel25, _sessions14, _interactivePeer, _interaction, _trace13, _credentials7, _credentialRecovery, _deviceIdentity, _receivingGroup2, _modelAdoption, _deviceChallenges, _enrolledCapabilities, _custody4, _readability3, _origins5, _seat2, _custodyAdmission, _correspondence3, _birthCustody, _placement5, _access, _identity2, _custodianPlacement, _identityRecovery, _queries8, _application3, _compatibility2, _custodyVerification, _commandPreparation, _applicationReadiness, _authenticationReadiness, _lawPackages, _readMaintenance, _readResponses, _residency4, _residencyPins, _subscriptions5, _follows3, _replicaInventory, _placementDiscovery2, _live3, _records3, _historicQueries, _authoringPreflight, _recovery, _lifecycle, _maintenance2, _background2, _paperSlots, _retentionObserver, _admissionDurability, _historyAcquisition, _responses, _PeerOffice_instances, fenced_fn, handleRequest_fn, localCopyUnreadable_fn, probeLocalCopyFormat_fn, protectedResidents_fn, bindInteraction_fn, keepCustodianPlacement_fn, dispatchRequest_fn, historyCredentialCapability_fn, preferredCredentialCapability_fn, correspondenceResponse_fn, authenticationReadinessResponse_fn, completedKernelCall_fn, modelAdoptionResponse_fn, receivingGroupResponse_fn, deviceIdentityResponse_fn, deviceChallengeFor_fn, deviceChallengeForCapability_fn, credentialRecoveryResponse_fn, afterCredentialKernelCall_fn, acknowledgedWhenDurable_fn, admissionDurabilityResponse_fn, birthCustodyResponse_fn, identityResponse_fn, identityRecoveryResponse_fn, response_fn, failure_fn, custodyRequired_fn, kernelResidencyRequired_fn, candidateCustodyRequired_fn;
+  var _kernel25, _sessions14, _interactivePeer, _interaction, _trace13, _credentials7, _credentialRecovery, _deviceIdentity, _receivingGroup2, _modelAdoption, _deviceChallenges, _enrolledCapabilities, _custody4, _readability3, _origins5, _seat2, _custodyAdmission, _correspondence3, _birthCustody, _placement5, _access, _identity2, _custodianPlacement, _identityRecovery, _queries8, _application3, _compatibility2, _custodyVerification, _commandPreparation, _applicationReadiness, _authenticationReadiness, _lawPackages, _readMaintenance, _readResponses, _residency4, _residencyPins, _subscriptions5, _follows3, _replicaInventory, _placementDiscovery2, _live3, _records4, _historicQueries, _authoringPreflight, _recovery, _lifecycle, _maintenance2, _background2, _paperSlots, _retentionObserver, _admissionDurability, _historyAcquisition, _responses, _PeerOffice_instances, fenced_fn, handleRequest_fn, localCopyUnreadable_fn, probeLocalCopyFormat_fn, protectedResidents_fn, bindInteraction_fn, keepCustodianPlacement_fn, dispatchRequest_fn, historyCredentialCapability_fn, preferredCredentialCapability_fn, correspondenceResponse_fn, authenticationReadinessResponse_fn, completedKernelCall_fn, modelAdoptionResponse_fn, receivingGroupResponse_fn, deviceIdentityResponse_fn, deviceChallengeFor_fn, deviceChallengeForCapability_fn, credentialRecoveryResponse_fn, afterCredentialKernelCall_fn, acknowledgedWhenDurable_fn, admissionDurabilityResponse_fn, birthCustodyResponse_fn, identityResponse_fn, identityRecoveryResponse_fn, response_fn, failure_fn, custodyRequired_fn, kernelResidencyRequired_fn, candidateCustodyRequired_fn;
   var PeerOffice = class {
     constructor(kernel, credentials, profile, observations, custodyStorage, peerDeskStore) {
       __privateAdd(this, _PeerOffice_instances);
@@ -28214,7 +28490,7 @@
       __privateAdd(this, _replicaInventory);
       __privateAdd(this, _placementDiscovery2);
       __privateAdd(this, _live3);
-      __privateAdd(this, _records3);
+      __privateAdd(this, _records4);
       __privateAdd(this, _historicQueries);
       __privateAdd(this, _authoringPreflight);
       __privateAdd(this, _recovery);
@@ -28258,7 +28534,7 @@
         __privateGet(this, _trace13),
         __privateGet(this, _readability3)
       ));
-      __privateSet(this, _custodyAdmission, new CustodyAdmissionDesk(__privateGet(this, _kernel25), __privateGet(this, _custody4)));
+      __privateSet(this, _custodyAdmission, new CustodyAdmissionDesk(__privateGet(this, _kernel25), __privateGet(this, _custody4), new CustodyReceipts(seatedStore)));
       __privateSet(this, _queries8, new KernelQueries(__privateGet(this, _kernel25), __privateGet(this, _credentials7)));
       __privateSet(this, _follows3, new ReplicaFollowController(
         new ReplicaFollowDesk(seatedStore),
@@ -28420,6 +28696,7 @@
         // Lazy history: a head-only mount materialises its history in the background, never on
         // the path of an operation (architecture/lazy_history.md).
         onShallowMount: (workspace, credentialCapability) => __privateGet(this, _historyAcquisition).materialise(workspace, credentialCapability),
+        onOutboxHistoryRequired: (workspace, credentialCapability) => __privateGet(this, _historyAcquisition).requestFromBackground(workspace, credentialCapability),
         onSyncCompleted: (session, event) => {
           if (event.result?.workspace) {
             __privateGet(this, _replicaInventory).placementMayHaveChanged(event.result.workspace);
@@ -28468,7 +28745,7 @@
           command.criterion === AuthenticationReadinessCriterion.BIRTH_EVIDENCE
         )
       ));
-      __privateSet(this, _records3, new RecordsDesk(
+      __privateSet(this, _records4, new RecordsDesk(
         __privateGet(this, _kernel25),
         __privateGet(this, _queries8),
         __privateGet(this, _sessions14),
@@ -28922,7 +29199,7 @@
   _replicaInventory = new WeakMap();
   _placementDiscovery2 = new WeakMap();
   _live3 = new WeakMap();
-  _records3 = new WeakMap();
+  _records4 = new WeakMap();
   _historicQueries = new WeakMap();
   _authoringPreflight = new WeakMap();
   _recovery = new WeakMap();
@@ -29030,8 +29307,8 @@
       __privateGet(this, _replicaInventory).placementMayHaveChanged(workspace);
     }
   };
-  /** Execute a typed paper after the access desk; never skip lifecycle or
-   * session-binding checks merely because its caller is another local desk. */
+  /** Execute a typed paper after the access desk. Custody admission addresses a
+   * workspace by replica identity; application calls retain session binding. */
   dispatchRequest_fn = function(request) {
     validateRuntimeV2Request(request);
     try {
@@ -29045,18 +29322,20 @@
         if (!request.target.workspace || !request.target.session) {
           throw new Error("addressed runtime request requires workspace and session");
         }
-        const binding = __privateGet(this, _sessions14).bindingIfPresent(request.target.session);
-        if (binding !== void 0) {
-          if (binding.workspace !== request.target.workspace) {
-            throw new Error(
-              `session '${request.target.session}' is bound to workspace '${binding.workspace}', not '${request.target.workspace}'`
-            );
+        if (request.command.case !== "admitCustodyOffers") {
+          const binding = __privateGet(this, _sessions14).bindingIfPresent(request.target.session);
+          if (binding !== void 0) {
+            if (binding.workspace !== request.target.workspace) {
+              throw new Error(
+                `session '${request.target.session}' is bound to workspace '${binding.workspace}', not '${request.target.workspace}'`
+              );
+            }
+          } else {
+            __privateMethod(this, _PeerOffice_instances, bindInteraction_fn).call(this, create(BindSessionRequestSchema, {
+              session: request.target.session,
+              workspace: request.target.workspace
+            }));
           }
-        } else {
-          __privateMethod(this, _PeerOffice_instances, bindInteraction_fn).call(this, create(BindSessionRequestSchema, {
-            session: request.target.session,
-            workspace: request.target.workspace
-          }));
         }
       }
       switch (request.command.case) {
@@ -29241,7 +29520,7 @@
                 ReadMaintenanceCause.ADMITTED_OFFER
               );
               __privateGet(this, _subscriptions5).refreshWorkspace(request.target.workspace);
-              __privateGet(this, _correspondence3).workspaceFrontierChanged(request.target.workspace);
+              __privateGet(this, _correspondence3).receivedFrontierChanged(request.target.workspace);
             }
             return __privateMethod(this, _PeerOffice_instances, birthCustodyResponse_fn).call(this, request, __privateGet(this, _birthCustody).afterCustodyAdmission(request, admission));
           } catch (error) {
@@ -29295,29 +29574,29 @@
         case "listWorkspaceMoments":
           return __privateMethod(this, _PeerOffice_instances, response_fn).call(this, request, {
             case: "workspaceMoments",
-            value: __privateGet(this, _records3).moments(request, request.command.value)
+            value: __privateGet(this, _records4).moments(request, request.command.value)
           });
         case "estimateWorkspaceTransfer":
           return __privateMethod(this, _PeerOffice_instances, response_fn).call(this, request, {
             case: "workspaceTransferEstimate",
-            value: __privateGet(this, _records3).transferEstimate(request, request.command.value)
+            value: __privateGet(this, _records4).transferEstimate(request, request.command.value)
           });
         case "readWorkspaceGenesis":
           return __privateMethod(this, _PeerOffice_instances, response_fn).call(this, request, {
             case: "workspaceGenesis",
-            value: __privateGet(this, _records3).genesis(request, request.command.value)
+            value: __privateGet(this, _records4).genesis(request, request.command.value)
           });
         case "listChildWorkspaces":
           return __privateMethod(this, _PeerOffice_instances, response_fn).call(this, request, {
             case: "childWorkspaces",
-            value: __privateGet(this, _records3).children(request, request.command.value)
+            value: __privateGet(this, _records4).children(request, request.command.value)
           });
         // The kernel still answers this in its transitional value arm; the desk
         // decodes it once so no client infers a version status for itself.
         case "checkReferenceVersions":
           return __privateMethod(this, _PeerOffice_instances, response_fn).call(this, request, {
             case: "referenceVersions",
-            value: __privateGet(this, _records3).referenceVersions(request, request.command.value)
+            value: __privateGet(this, _records4).referenceVersions(request, request.command.value)
           });
         // A naming answer, not a custody read: it binds no session and mounts
         // nothing, so a client can ask which workspace a keyed birth addresses
@@ -29707,6 +29986,15 @@
     const correspondenceNotBefore = /* @__PURE__ */ new Map();
     let retention = 0;
     let closed = false;
+    let selectionFailures = 0;
+    const selectionFault = (error) => {
+      try {
+        options.onSelectionError?.(error);
+      } catch {
+      }
+      selectionFailures += 1;
+      wake(Math.min(3e4, 250 * 2 ** Math.min(selectionFailures - 1, 7)));
+    };
     const wake = (delayMillis = 0) => {
       if (closed) return;
       const delay = Math.max(0, Math.ceil(delayMillis));
@@ -29717,53 +30005,58 @@
       }
       wakeAt = at;
       timer = setTimer(() => {
-        timer = void 0;
-        wakeAt = void 0;
-        if (closed) return;
-        const now = options.monotonicNanoseconds();
-        for (const [workspace2, at2] of correspondenceNotBefore) {
-          if (at2 <= now) correspondenceNotBefore.delete(workspace2);
-        }
-        const backoffMillis = correspondenceNotBefore.size ? Math.min(...[...correspondenceNotBefore.values()].map((at2) => Number((at2 - now + 999999n) / 1000000n))) : void 0;
-        const retentionOnly = correspondenceInFlight;
-        const next = options.nextPaper(retentionOnly, new Set(correspondenceNotBefore.keys()));
-        if (next.frame === void 0) {
-          const delays = [next.nextAfterMillis, backoffMillis].filter((delay2) => delay2 !== void 0);
-          if (delays.length) wake(Math.min(...delays));
-          return;
-        }
-        if (options.isRetention(next.frame)) {
-          retention += 1;
+        try {
+          timer = void 0;
+          wakeAt = void 0;
+          if (closed) return;
+          const now = options.monotonicNanoseconds();
+          for (const [workspace2, at2] of correspondenceNotBefore) {
+            if (at2 <= now) correspondenceNotBefore.delete(workspace2);
+          }
+          const backoffMillis = correspondenceNotBefore.size ? Math.min(...[...correspondenceNotBefore.values()].map((at2) => Number((at2 - now + 999999n) / 1000000n))) : void 0;
+          const retentionOnly = correspondenceInFlight;
+          const next = options.nextPaper(retentionOnly, new Set(correspondenceNotBefore.keys()));
+          selectionFailures = 0;
+          if (next.frame === void 0) {
+            const delays = [next.nextAfterMillis, backoffMillis].filter((delay2) => delay2 !== void 0);
+            if (delays.length) wake(Math.min(...delays));
+            return;
+          }
+          if (options.isRetention(next.frame)) {
+            retention += 1;
+            void options.drive(next.frame).then(
+              () => {
+                retention -= 1;
+                wake(0);
+              },
+              () => {
+                retention -= 1;
+                wake(0);
+              }
+            );
+            wake(next.nextAfterMillis ?? 0);
+            return;
+          }
+          if (retentionOnly) throw new Error("background desk reserved correspondence while its lane was unavailable");
+          const workspace = next.workspace;
+          if (!workspace) throw new Error("background correspondence has no source workspace");
+          if (correspondenceNotBefore.has(workspace)) throw new Error("background desk bypassed a workspace's physical backoff");
+          correspondenceInFlight = true;
           void options.drive(next.frame).then(
             () => {
-              retention -= 1;
-              wake(0);
+              correspondenceInFlight = false;
+              wake(next.nextAfterMillis ?? 0);
             },
             () => {
-              retention -= 1;
+              correspondenceInFlight = false;
+              correspondenceNotBefore.set(workspace, options.monotonicNanoseconds() + BigInt(failureBackoffMillis) * 1000000n);
               wake(0);
             }
           );
-          wake(next.nextAfterMillis ?? 0);
-          return;
+          wake(0);
+        } catch (error) {
+          selectionFault(error);
         }
-        if (retentionOnly) throw new Error("background desk reserved correspondence while its lane was unavailable");
-        const workspace = next.workspace;
-        if (!workspace) throw new Error("background correspondence has no source workspace");
-        if (correspondenceNotBefore.has(workspace)) throw new Error("background desk bypassed a workspace's physical backoff");
-        correspondenceInFlight = true;
-        void options.drive(next.frame).then(
-          () => {
-            correspondenceInFlight = false;
-            wake(next.nextAfterMillis ?? 0);
-          },
-          () => {
-            correspondenceInFlight = false;
-            correspondenceNotBefore.set(workspace, options.monotonicNanoseconds() + BigInt(failureBackoffMillis) * 1000000n);
-            wake(0);
-          }
-        );
-        wake(0);
       }, delay);
     };
     return {
@@ -29838,7 +30131,8 @@
         throw error;
       }),
       isRetention: (frame) => fromBinary(RuntimeRequestSchema, frame).command.case === "retainFrontier",
-      monotonicNanoseconds: () => observations.monotonicNanoseconds()
+      monotonicNanoseconds: () => observations.monotonicNanoseconds(),
+      onSelectionError: (error) => console.error("Nomos background paper selection failed", error)
     });
     const scheduleCorrespondence = (delayMillis = 0) => {
       lanes?.wake(delayMillis);
@@ -30070,13 +30364,19 @@
   };
   var executeGitFetchWithAlongside = async (effect, fetchImpl) => {
     if (!effect.alongside) return executeGitFetchEffect(effect, fetchImpl);
-    const [fetched, alongside] = await Promise.all([
-      executeGitFetchEffect(effect, fetchImpl),
-      executeHttpEffect(effect.alongside, fetchImpl)
-    ]);
-    if (fetched.outcome.case === "gitFetch" && alongside.outcome.case === "response") {
+    const cancelAlongside = new AbortController();
+    let alongside;
+    void executeHttpEffect(effect.alongside, (input, init) => fetchImpl(input, {
+      ...init,
+      signal: init?.signal ? AbortSignal.any([init.signal, cancelAlongside.signal]) : cancelAlongside.signal
+    })).then((receipt) => {
+      alongside = receipt;
+    });
+    const fetched = await executeGitFetchEffect(effect, fetchImpl);
+    if (fetched.outcome.case === "gitFetch" && alongside?.outcome.case === "response") {
       fetched.outcome.value.alongside = alongside.outcome.value;
     }
+    cancelAlongside.abort();
     return fetched;
   };
   var executeGitPushEffect = async (effect, fetchImpl) => {
@@ -30445,7 +30745,8 @@
         requestId: ++sequence,
         command: { case: "socketReceipt", value: create(PeerSocketReceiptSchema, { connectionId, observation }) }
       }));
-      void Promise.resolve().then(() => invoke2(frame)).catch(() => {
+      void Promise.resolve().then(() => invoke2(frame)).catch((error) => {
+        console.warn("[nomos-socket] receipt failed", { connectionId, error });
         sockets.get(connectionId)?.close();
       });
     };
@@ -30467,6 +30768,7 @@
             socket.onopen = () => receipt(id, { case: "opened", value: true });
             socket.onmessage = (message) => {
               if (message.data instanceof ArrayBuffer) receipt(id, { case: "received", value: new Uint8Array(message.data) });
+              else if (typeof message.data === "string") receipt(id, { case: "received", value: new TextEncoder().encode(message.data) });
             };
             socket.onclose = () => {
               if (sockets.get(id) === socket) sockets.delete(id);
@@ -32660,13 +32962,13 @@
           }
         }
       }
-      let namespace = void 0;
+      let namespace2 = void 0;
       let tagAndPosition = withoutBrackets;
       if (withoutBrackets.includes("::")) {
         const nsIndex = withoutBrackets.indexOf("::");
-        namespace = withoutBrackets.substring(0, nsIndex).trim();
+        namespace2 = withoutBrackets.substring(0, nsIndex).trim();
         tagAndPosition = withoutBrackets.substring(nsIndex + 2).trim();
-        if (!namespace) {
+        if (!namespace2) {
           throw new Error(`Invalid namespace in pattern: ${part}`);
         }
       }
@@ -32690,8 +32992,8 @@
         throw new Error(`Invalid segment pattern: ${part}`);
       }
       segment.tag = tag;
-      if (namespace) {
-        segment.namespace = namespace;
+      if (namespace2) {
+        segment.namespace = namespace2;
       }
       if (bracketContent) {
         if (bracketContent.includes("=")) {
@@ -33083,7 +33385,7 @@
      * @param {Object|null} [options=null]
      * @param {string[]} [options.keep] - Names of attributes (from attrValues)
      */
-    push(tagName, attrValues = null, namespace = null, options = null) {
+    push(tagName, attrValues = null, namespace2 = null, options = null) {
       this._pathStringCache = null;
       if (this.path.length > 0) {
         this.path[this.path.length - 1].values = void 0;
@@ -33094,7 +33396,7 @@
         level = { counts: /* @__PURE__ */ new Map(), total: 0 };
         this.siblingStacks[currentLevel] = level;
       }
-      const siblingKey = namespace ? `${namespace}:${tagName}` : tagName;
+      const siblingKey = namespace2 ? `${namespace2}:${tagName}` : tagName;
       const counter = level.counts.get(siblingKey) || 0;
       const position = level.total;
       level.counts.set(siblingKey, counter + 1);
@@ -33104,8 +33406,8 @@
         position,
         counter
       };
-      if (namespace !== null && namespace !== void 0) {
-        node.namespace = namespace;
+      if (namespace2 !== null && namespace2 !== void 0) {
+        node.namespace = namespace2;
       }
       if (attrValues !== null && attrValues !== void 0) {
         node.values = attrValues;
@@ -34498,10 +34800,10 @@
           }
           let prefixedAttrs = null;
           let rawAttrs = {};
-          let namespace = void 0;
-          namespace = extractNamespace(rawTagName);
+          let namespace2 = void 0;
+          namespace2 = extractNamespace(rawTagName);
           if (tagName !== xmlObj.tagname) {
-            this.matcher.push(tagName, {}, namespace);
+            this.matcher.push(tagName, {}, namespace2);
           }
           if (tagName !== tagExp && attrExpPresent) {
             prefixedAttrs = this.buildAttributesMap(tagExp, this.matcher, tagName);
@@ -35732,17 +36034,17 @@
     }
     return result;
   }
-  function capabilityByNamespace(capabilities, namespace) {
-    const matches = capabilities.filter((capability) => capability.namespace === namespace);
+  function capabilityByNamespace(capabilities, namespace2) {
+    const matches = capabilities.filter((capability) => capability.namespace === namespace2);
     if (matches.length !== 1) {
-      throw new Error(`OSGi resource needs exactly one ${namespace} capability`);
+      throw new Error(`OSGi resource needs exactly one ${namespace2} capability`);
     }
     return matches[0];
   }
-  function optionalCapabilityByNamespace(capabilities, namespace) {
-    const matches = capabilities.filter((capability) => capability.namespace === namespace);
+  function optionalCapabilityByNamespace(capabilities, namespace2) {
+    const matches = capabilities.filter((capability) => capability.namespace === namespace2);
     if (matches.length > 1) {
-      throw new Error(`OSGi resource needs at most one ${namespace} capability`);
+      throw new Error(`OSGi resource needs at most one ${namespace2} capability`);
     }
     return matches[0];
   }
@@ -35850,7 +36152,7 @@
   async function selectReleaseKernel(args) {
     const fetchImpl = args.fetchImpl ?? ((input, init) => globalThis.fetch(input, init));
     const base = args.base.replace(/\/+$/, "");
-    const repositoryUrl = `${base}/v1/runtime/repository.xml`;
+    const repositoryUrl = args.repositoryUrl ?? `${base}/v1/runtime/repository.xml`;
     const repositoryResponse = await fetchImpl(repositoryUrl);
     if (!repositoryResponse.ok) {
       throw new Error(`custodian kernel repository ${repositoryUrl}: HTTP ${repositoryResponse.status}`);
@@ -35895,22 +36197,36 @@
 
   // ../../platform-shells/browser/peer.ts
   async function openBrowserPeer(options) {
+    const progress = (stage) => {
+      try {
+        options.onBootProgress?.(stage);
+      } catch {
+      }
+    };
+    progress("opening browser custody");
     const storage = options.custodyStore ?? await openBrowserCustody(options.base);
+    storage.onCheckpoint = options.onCustodyCheckpoint;
     try {
+      progress("selecting Kernel artifacts");
       const fetchImpl = options.fetchImpl ?? globalThis.fetch.bind(globalThis);
       const selected = await selectReleaseKernel({
         base: options.base,
+        repositoryUrl: options.kernelRepositoryUrl,
         release: options.release,
-        fetchImpl: browserRuntimeFetch(options.base, fetchImpl, globalThis.caches),
+        fetchImpl: browserRuntimeFetch(options.base, fetchImpl, globalThis.caches, options.kernelRepositoryUrl),
         cache: options.kernelCache
       });
+      progress(`compiling Kernel ${selected.resource.contentSha256}`);
+      const wasmModule = await WebAssembly.compile(selected.wasm);
+      progress("opening Kernel machine");
       const machine = await createKernelMachine({
-        wasmModule: await WebAssembly.compile(selected.wasm),
+        wasmModule,
         bootstrapLawUsdz: selected.bootstrapLaw,
         nomosLawUsdz: selected.controllerLaw,
         replica: options.replica ?? storage.replica,
         trustRootPublicKey: options.trustRootPublicKey
       }, storage.filesystem, storage.changed);
+      progress("opening Peer Office");
       const kernelWork = new KernelWorkAccounting(options.onKernelWorkChanged, false);
       const physicalKernel = observeBrowserKernelCalls(kernelExecutionDesk(machine), kernelWork);
       const kernel = options.observeKernel?.(physicalKernel) ?? physicalKernel;
@@ -35926,7 +36242,7 @@
         physical,
         { ...options.profile, identity: storage.identity },
         void 0,
-        { list: (namespace) => storage.list(namespace), compareExchange: (...args) => storage.compareExchange(...args) }
+        { list: (namespace2) => storage.list(namespace2), compareExchange: (...args) => storage.compareExchange(...args) }
       );
       const office = openPeerOfficeHost(
         kernel,
@@ -35940,6 +36256,7 @@
         options.lawPackage,
         options.performExternalEffect
       );
+      progress("peer ready");
       return {
         invoke: async (frame) => {
           storage.assertUsable();