@githolon/runtime 0.112.7 → 0.112.11

package/runner/node-entry.mjs

@@ -6873,10 +6873,10 @@ function nodeCustodyFilesystem(directory2) {
 init_define_NOMOS_KERNEL_RELEASE();
 import { TextDecoder as TextDecoder2 } from "node:util";
 function kernelWasiStdio(memory, stderr, writeFile2, stderrPartial) {
-  const decoder4 = new TextDecoder2();
+  const decoder5 = new TextDecoder2();
   let pending = "";
   const accept = (bytes) => {
-    pending += decoder4.decode(bytes, { stream: true });
+    pending += decoder5.decode(bytes, { stream: true });
     for (; ; ) {
       const newline = pending.indexOf("\n");
       if (newline >= 0 && newline < 16384) {
@@ -10307,13 +10307,13 @@ var Expression = class {
         }
       }
     }
-    let namespace = void 0;
+    let namespace2 = void 0;
     let tagAndPosition = withoutBrackets;
     if (withoutBrackets.includes("::")) {
       const nsIndex = withoutBrackets.indexOf("::");
-      namespace = withoutBrackets.substring(0, nsIndex).trim();
+      namespace2 = withoutBrackets.substring(0, nsIndex).trim();
       tagAndPosition = withoutBrackets.substring(nsIndex + 2).trim();
-      if (!namespace) {
+      if (!namespace2) {
         throw new Error(`Invalid namespace in pattern: ${part}`);
       }
     }
@@ -10337,8 +10337,8 @@ var Expression = class {
       throw new Error(`Invalid segment pattern: ${part}`);
     }
     segment.tag = tag;
-    if (namespace) {
-      segment.namespace = namespace;
+    if (namespace2) {
+      segment.namespace = namespace2;
     }
     if (bracketContent) {
       if (bracketContent.includes("=")) {
@@ -10728,7 +10728,7 @@ var Matcher = class {
    * @param {Object|null} [options=null]
    * @param {string[]} [options.keep] - Names of attributes (from attrValues)
    */
-  push(tagName, attrValues = null, namespace = null, options = null) {
+  push(tagName, attrValues = null, namespace2 = null, options = null) {
     this._pathStringCache = null;
     if (this.path.length > 0) {
       this.path[this.path.length - 1].values = void 0;
@@ -10739,7 +10739,7 @@ var Matcher = class {
       level = { counts: /* @__PURE__ */ new Map(), total: 0 };
       this.siblingStacks[currentLevel] = level;
     }
-    const siblingKey = namespace ? `${namespace}:${tagName}` : tagName;
+    const siblingKey = namespace2 ? `${namespace2}:${tagName}` : tagName;
     const counter = level.counts.get(siblingKey) || 0;
     const position = level.total;
     level.counts.set(siblingKey, counter + 1);
@@ -10749,8 +10749,8 @@ var Matcher = class {
       position,
       counter
     };
-    if (namespace !== null && namespace !== void 0) {
-      node.namespace = namespace;
+    if (namespace2 !== null && namespace2 !== void 0) {
+      node.namespace = namespace2;
     }
     if (attrValues !== null && attrValues !== void 0) {
       node.values = attrValues;
@@ -12133,10 +12133,10 @@ var parseXml = function(xmlData) {
         }
         let prefixedAttrs = null;
         let rawAttrs = {};
-        let namespace = void 0;
-        namespace = extractNamespace(rawTagName);
+        let namespace2 = void 0;
+        namespace2 = extractNamespace(rawTagName);
         if (tagName !== xmlObj.tagname) {
-          this.matcher.push(tagName, {}, namespace);
+          this.matcher.push(tagName, {}, namespace2);
         }
         if (tagName !== tagExp && attrExpPresent) {
           prefixedAttrs = this.buildAttributesMap(tagExp, this.matcher, tagName);
@@ -13361,17 +13361,17 @@ function attributes(capability) {
   }
   return result;
 }
-function capabilityByNamespace(capabilities, namespace) {
-  const matches = capabilities.filter((capability) => capability.namespace === namespace);
+function capabilityByNamespace(capabilities, namespace2) {
+  const matches = capabilities.filter((capability) => capability.namespace === namespace2);
   if (matches.length !== 1) {
-    throw new Error(`OSGi resource needs exactly one ${namespace} capability`);
+    throw new Error(`OSGi resource needs exactly one ${namespace2} capability`);
   }
   return matches[0];
 }
-function optionalCapabilityByNamespace(capabilities, namespace) {
-  const matches = capabilities.filter((capability) => capability.namespace === namespace);
+function optionalCapabilityByNamespace(capabilities, namespace2) {
+  const matches = capabilities.filter((capability) => capability.namespace === namespace2);
   if (matches.length > 1) {
-    throw new Error(`OSGi resource needs at most one ${namespace} capability`);
+    throw new Error(`OSGi resource needs at most one ${namespace2} capability`);
   }
   return matches[0];
 }
@@ -14154,7 +14154,8 @@ var KernelPort = class {
       }
     }));
     if (response.outcome.case === "failure") {
-      throw new Error(`${response.outcome.value.code}: ${response.outcome.value.message}`);
+      throwUnnamedHistoryRequirement(response.outcome.value, mount.workspace);
+      throwKernelFailure(response.outcome.value);
     }
     if (response.outcome.case !== "outbox") {
       throw new Error(`kernel returned '${response.outcome.case || "empty"}' while reading correspondence`);
@@ -14183,7 +14184,8 @@ var KernelPort = class {
       }
     }));
     if (response.outcome.case === "failure") {
-      throw new Error(`${response.outcome.value.code}: ${response.outcome.value.message}`);
+      throwUnnamedHistoryRequirement(response.outcome.value, mount.workspace);
+      throwKernelFailure(response.outcome.value);
     }
     if (response.outcome.case !== "outbox") {
       throw new Error(
@@ -17222,19 +17224,19 @@ function base64(bytes) {
 // ../src/runtime/workspace_naming.ts
 init_define_NOMOS_KERNEL_RELEASE();
 var WORKSPACE_NAME_SEP = "";
-var keyedBirthNameOf = (namespace, key) => `${namespace}-${sha256Hex(new TextEncoder().encode(namespace + WORKSPACE_NAME_SEP + key)).slice(0, 40)}`;
+var keyedBirthNameOf = (namespace2, key) => `${namespace2}-${sha256Hex(new TextEncoder().encode(namespace2 + WORKSPACE_NAME_SEP + key)).slice(0, 40)}`;
 var RECEIVING_GROUP_NAME_PREFIX = "nomos-rg-";
 var receivingGroupNameOf = (principal) => `${RECEIVING_GROUP_NAME_PREFIX}${sha256Hex(new TextEncoder().encode(principal)).slice(0, 40)}`;
-var isKeyedBirthOf = (namespace, workspace) => workspace.startsWith(`${namespace}-`);
+var isKeyedBirthOf = (namespace2, workspace) => workspace.startsWith(`${namespace2}-`);
 var WORKSPACE_NAME_REQUEST_INVALID = "nomos.runtime.workspace_name_request_invalid";
 function resolveWorkspaceName(command) {
   switch (command.birth.case) {
     case "keyed": {
-      const { namespace, key } = command.birth.value;
-      if (namespace.length === 0 || key.length === 0) {
+      const { namespace: namespace2, key } = command.birth.value;
+      if (namespace2.length === 0 || key.length === 0) {
         throw new Error(`${WORKSPACE_NAME_REQUEST_INVALID}: a keyed birth name needs both its namespace and its key`);
       }
-      return create(ResolvedWorkspaceNameSchema, { workspace: keyedBirthNameOf(namespace, key) });
+      return create(ResolvedWorkspaceNameSchema, { workspace: keyedBirthNameOf(namespace2, key) });
     }
     case "receivingGroup": {
       const { principal } = command.birth.value;
@@ -19285,6 +19287,136 @@ var ModelAdoptionDesk = class {
   }
 };
 
+// ../src/runtime/custody_receipts.ts
+init_define_NOMOS_KERNEL_RELEASE();
+
+// ../src/runtime/peer_desk_store.ts
+init_define_NOMOS_KERNEL_RELEASE();
+var recordId = (namespace2, key) => `${namespace2.length}:${namespace2}${key}`;
+var copy2 = (record) => ({
+  ...record,
+  value: record.value.slice()
+});
+var MemoryPeerDeskStore = class {
+  #records = /* @__PURE__ */ new Map();
+  list(namespace2) {
+    return [...this.#records.values()].filter((record) => record.namespace === namespace2).sort((left, right) => left.key.localeCompare(right.key)).map(copy2);
+  }
+  compareExchange(namespace2, key, expectedRevision, value) {
+    const id = recordId(namespace2, key);
+    const current = this.#records.get(id);
+    if (current?.revision !== expectedRevision) {
+      throw new Error(
+        `peer desk record '${namespace2}/${key}' changed at revision ${current?.revision ?? "absent"}`
+      );
+    }
+    if (value === void 0) {
+      this.#records.delete(id);
+      return void 0;
+    }
+    const next = Object.freeze({
+      namespace: namespace2,
+      key,
+      revision: (current?.revision ?? 0n) + 1n,
+      value: value.slice()
+    });
+    this.#records.set(id, next);
+    return copy2(next);
+  }
+};
+
+// ../src/runtime/custody_receipts.ts
+var namespace = "nomos.peer-desk.custody-receipts/v1";
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+var MAX_BASES = 256;
+var MAX_RECEIPTS = 4096;
+var CustodyReceipts = class {
+  #store;
+  #records = /* @__PURE__ */ new Map();
+  #journals = /* @__PURE__ */ new Map();
+  #receipts = /* @__PURE__ */ new Map();
+  constructor(store = new MemoryPeerDeskStore()) {
+    this.#store = store;
+    for (const record of store.list(namespace)) {
+      this.#records.set(record.key, record);
+      try {
+        if (record.key.startsWith("receipt:")) {
+          const newline = record.value.indexOf(10);
+          if (newline < 0) continue;
+          const receipt = fromBinary(CustodyIntentAdmissionSchema, record.value.subarray(newline + 1));
+          const header2 = JSON.parse(decoder.decode(record.value.subarray(0, newline)));
+          if (receipt.outcome.case === "admitted" && typeof header2.generation === "string" && typeof header2.head === "string") this.#receipts.set(record.key, { ...header2, receipt });
+          continue;
+        }
+        if (!record.key.startsWith("head:")) continue;
+        const value = JSON.parse(decoder.decode(record.value));
+        if (typeof value.head !== "string" || typeof value.generation !== "string" || !Array.isArray(value.bases) || !Array.isArray(value.keys) || value.bases.length > MAX_BASES || value.keys.length > MAX_RECEIPTS) continue;
+        if (!value.bases.every((base) => typeof base === "string") || !value.keys.every((key) => typeof key === "string")) continue;
+        this.#journals.set(record.key.slice(5), value);
+      } catch {
+      }
+    }
+  }
+  covers(workspace, current, base) {
+    const value = this.#journals.get(workspace);
+    return value?.head === current && value.bases.includes(base);
+  }
+  receipt(workspace, current, change) {
+    const value = this.#journals.get(workspace);
+    if (value?.head !== current) return void 0;
+    const stored = this.#receipts.get(`receipt:${workspace}:${sha256Hex(change)}`);
+    if (stored?.generation !== value.generation) return void 0;
+    if (stored.head !== value.head && !value.bases.includes(stored.head)) return void 0;
+    return fromBinary(CustodyIntentAdmissionSchema, toBinary(CustodyIntentAdmissionSchema, stored.receipt));
+  }
+  record(workspace, before, after, receipts) {
+    const old = this.#journals.get(workspace);
+    const journalKey = `head:${workspace}`;
+    const value = old?.head === before ? { ...old, head: after, bases: [...old.bases], keys: [...old.keys] } : { head: after, bases: [], keys: [], generation: String((this.#records.get(journalKey)?.revision ?? 0n) + 1n) };
+    if (before && before !== after) value.bases.push(before);
+    value.bases = [...new Set(value.bases)].slice(-MAX_BASES);
+    const keys = new Set(value.keys);
+    const discarded = new Set(old?.generation !== value.generation ? old?.keys : []);
+    for (const { change, receipt } of receipts) {
+      if (receipt.outcome.case !== "admitted") continue;
+      const key = `receipt:${workspace}:${sha256Hex(change)}`;
+      keys.delete(key);
+      keys.add(key);
+      discarded.delete(key);
+      const header2 = encoder.encode(`${JSON.stringify({ generation: value.generation, head: after })}
+`);
+      const body = toBinary(CustodyIntentAdmissionSchema, receipt);
+      const bytes = new Uint8Array(header2.length + body.length);
+      bytes.set(header2);
+      bytes.set(body, header2.length);
+      const record2 = this.#store.compareExchange(namespace, key, this.#records.get(key)?.revision, bytes);
+      if (record2) this.#records.set(key, record2);
+      this.#receipts.set(key, {
+        generation: value.generation,
+        head: after,
+        receipt: fromBinary(CustodyIntentAdmissionSchema, body)
+      });
+    }
+    const ordered = [...keys];
+    for (const key of ordered.slice(0, -MAX_RECEIPTS)) discarded.add(key);
+    value.keys = ordered.slice(-MAX_RECEIPTS);
+    for (const key of discarded) {
+      this.#store.compareExchange(namespace, key, this.#records.get(key)?.revision, void 0);
+      this.#records.delete(key);
+      this.#receipts.delete(key);
+    }
+    const record = this.#store.compareExchange(
+      namespace,
+      journalKey,
+      this.#records.get(journalKey)?.revision,
+      encoder.encode(JSON.stringify(value))
+    );
+    if (record) this.#records.set(journalKey, record);
+    this.#journals.set(workspace, value);
+  }
+};
+
 // ../src/runtime/custodian_placement.ts
 init_define_NOMOS_KERNEL_RELEASE();
 var CustodianPlacement = class {
@@ -19390,14 +19522,16 @@ var CandidateCustodyRequiredError = class extends Error {
 var CustodyAdmissionDesk = class {
   #kernel;
   #custody;
-  constructor(kernel, custody) {
+  #receipts;
+  constructor(kernel, custody, receipts = new CustodyReceipts()) {
     this.#kernel = kernel;
     this.#custody = custody;
+    this.#receipts = receipts;
   }
   admit(request, command) {
-    const session = request.target?.session;
-    if (!session) throw new Error("custody admission requires an addressed runtime session");
-    const mount = this.#custody.mountForSession(session);
+    const workspace = request.target?.workspace;
+    if (!workspace) throw new Error("custody admission requires an addressed workspace");
+    const mount = this.#custody.mountForWorkspace(workspace);
     if (command.evidencePack.byteLength > 0) {
       this.#kernel.applyPack(mount, request.requestId, command.evidencePack);
     }
@@ -19408,21 +19542,42 @@ var CustodyAdmissionDesk = class {
     const births = [];
     const admittedBase = this.#kernel.head(mount, request.requestId) ?? "";
     if (command.fastForwardOnly && offers.length > 0 && (command.baseHead ?? "") !== admittedBase) {
+      for (const offer of offers) {
+        const receipt = this.#receipts.receipt(mount.workspace, admittedBase, offer.changeUsda);
+        if (!receipt) continue;
+        receipt.commitOid = offer.commitOid;
+        const records = sessions.get(offer.session) ?? [];
+        records.push(receipt);
+        sessions.set(offer.session, records);
+      }
+      let delta = custodyReturnDelta(
+        this.#kernel,
+        mount,
+        request.requestId,
+        command.baseHead,
+        admittedBase,
+        admittedBase,
+        command.observedHead
+      );
+      if (command.baseHead && command.observedHead !== admittedBase && this.#receipts.covers(mount.workspace, admittedBase, command.baseHead)) {
+        try {
+          delta = {
+            resultBase: command.baseHead,
+            resultPack: this.#kernel.packDelta(mount, request.requestId, admittedBase, command.baseHead),
+            recoveryRequired: false
+          };
+        } catch {
+        }
+      }
       return create(CustodyAdmissionSchema, {
         main: admittedBase,
-        ...custodyReturnDelta(
-          this.#kernel,
-          mount,
-          request.requestId,
-          command.baseHead,
-          admittedBase,
-          admittedBase,
-          command.observedHead
-        )
+        sessions: [...sessions].map(([session, intents]) => create(CustodySessionAdmissionSchema, { session, intents })),
+        ...delta
       });
     }
     let main = admittedBase;
     const heldSessions = /* @__PURE__ */ new Map();
+    const receipts = [];
     for (const offer of offers) {
       const heldBehind = heldSessions.get(offer.session);
       const verdict = heldBehind === void 0 ? this.#offer(request, mount, offer) : create(OfferResponseSchema, { outcome: { case: "blockedOnDependency", value: {
@@ -19432,7 +19587,9 @@ var CustodyAdmissionDesk = class {
         heldSessions.set(offer.session, verdict.outcome.value.offerId || offer.commitOid);
       }
       const records = sessions.get(offer.session) ?? [];
-      records.push(this.#record(offer, verdict));
+      const receipt = this.#record(offer, verdict);
+      records.push(receipt);
+      receipts.push({ change: offer.changeUsda, receipt });
       sessions.set(offer.session, records);
       if (verdict.outcome.case === "admitted") {
         main = verdict.outcome.value.head;
@@ -19448,6 +19605,9 @@ var CustodyAdmissionDesk = class {
         }
       }
     }
+    if (receipts.some((entry) => entry.receipt.outcome.case === "admitted")) {
+      this.#receipts.record(mount.workspace, admittedBase, main, receipts);
+    }
     return create(CustodyAdmissionSchema, {
       main,
       sessions: [...sessions].map(
@@ -22419,8 +22579,8 @@ var short = (oid) => oid.slice(0, 12);
 // ../src/runtime/preserved_copies_desk.ts
 init_define_NOMOS_KERNEL_RELEASE();
 var PRESERVED_COPIES_NAMESPACE = "nomos.peer-desk.preserved-local-copies/v1";
-var encoder = new TextEncoder();
-var decoder = new TextDecoder();
+var encoder2 = new TextEncoder();
+var decoder2 = new TextDecoder();
 var PreservedCopiesDesk = class {
   #store;
   constructor(store) {
@@ -22429,7 +22589,7 @@ var PreservedCopiesDesk = class {
   list(workspace) {
     const record = this.#store.list(PRESERVED_COPIES_NAMESPACE).find((entry) => entry.key === workspace);
     if (!record) return [];
-    const values = JSON.parse(decoder.decode(record.value));
+    const values = JSON.parse(decoder2.decode(record.value));
     if (!Array.isArray(values)) {
       throw new Error(`corrupt preserved-copy record for '${workspace}' at revision ${record.revision}`);
     }
@@ -22443,7 +22603,7 @@ var PreservedCopiesDesk = class {
       PRESERVED_COPIES_NAMESPACE,
       copy3.workspace,
       current?.revision,
-      encoder.encode(`[${next.map((entry) => toJsonString(PreservedLocalCopySchema, entry)).join(",")}]`)
+      encoder2.encode(`[${next.map((entry) => toJsonString(PreservedLocalCopySchema, entry)).join(",")}]`)
     );
     if (!stored) throw new Error(`preserved copy of '${copy3.workspace}' was not recorded`);
   }
@@ -22486,9 +22646,9 @@ var LOCAL_ONLY_NAMESPACES = /* @__PURE__ */ new Set([
 ]);
 var SEAT_PREFIX = "nomos-office-seat/v1:";
 var SEAT_DIGEST_HEX = 64;
-var encoder2 = new TextEncoder();
-var decoder2 = new TextDecoder();
-var header = (digest) => encoder2.encode(`${SEAT_PREFIX}${digest}
+var encoder3 = new TextEncoder();
+var decoder3 = new TextDecoder();
+var header = (digest) => encoder3.encode(`${SEAT_PREFIX}${digest}
 `);
 var QuarantineReason = Object.freeze({
   /** Another office's seat: a copied state directory, or a store lifted from another peer. */
@@ -22499,7 +22659,7 @@ var QuarantineReason = Object.freeze({
 function readSeal(value) {
   const headerLength = SEAT_PREFIX.length + SEAT_DIGEST_HEX + 1;
   if (value.byteLength < headerLength) return void 0;
-  const text = decoder2.decode(value.subarray(0, headerLength));
+  const text = decoder3.decode(value.subarray(0, headerLength));
   if (!text.startsWith(SEAT_PREFIX) || !text.endsWith("\n")) return void 0;
   const seat = text.slice(SEAT_PREFIX.length, headerLength - 1);
   if (!/^[0-9a-f]{64}$/.test(seat)) return void 0;
@@ -22523,44 +22683,44 @@ var SeatedPeerDeskStore = class {
     this.#seat = seat;
     this.#report = report;
   }
-  list(namespace) {
-    if (LOCAL_ONLY_NAMESPACES.has(namespace)) return this.#inner.list(namespace);
+  list(namespace2) {
+    if (LOCAL_ONLY_NAMESPACES.has(namespace2)) return this.#inner.list(namespace2);
     const kept = [];
-    for (const record of this.#inner.list(namespace)) {
+    for (const record of this.#inner.list(namespace2)) {
       const sealed = readSeal(record.value);
       if (sealed?.seat === this.#seat.digest) {
         kept.push({ ...record, value: sealed.value.slice() });
         continue;
       }
-      this.#quarantine(namespace, record, sealed?.seat);
+      this.#quarantine(namespace2, record, sealed?.seat);
     }
     return kept;
   }
-  compareExchange(namespace, key, expectedRevision, value) {
-    if (LOCAL_ONLY_NAMESPACES.has(namespace)) {
-      return this.#inner.compareExchange(namespace, key, expectedRevision, value);
+  compareExchange(namespace2, key, expectedRevision, value) {
+    if (LOCAL_ONLY_NAMESPACES.has(namespace2)) {
+      return this.#inner.compareExchange(namespace2, key, expectedRevision, value);
     }
     const stored = this.#inner.compareExchange(
-      namespace,
+      namespace2,
       key,
       expectedRevision,
       value === void 0 ? void 0 : seal(this.#seat.digest, value)
     );
     if (stored === void 0) return void 0;
     const sealed = readSeal(stored.value);
-    if (!sealed) throw new Error(`peer desk record '${namespace}/${key}' lost its office seat`);
+    if (!sealed) throw new Error(`peer desk record '${namespace2}/${key}' lost its office seat`);
     return { ...stored, value: sealed.value.slice() };
   }
   /** Preserve the foreign record under the quarantine namespace, then free the slot. */
-  #quarantine(namespace, record, recordedSeat) {
-    const key = `${namespace}\0${record.key}\0${record.revision}`;
+  #quarantine(namespace2, record, recordedSeat) {
+    const key = `${namespace2}\0${record.key}\0${record.revision}`;
     try {
       this.#inner.compareExchange(QUARANTINED_BINDINGS_NAMESPACE, key, void 0, record.value);
     } catch {
     }
-    this.#inner.compareExchange(namespace, record.key, record.revision, void 0);
+    this.#inner.compareExchange(namespace2, record.key, record.revision, void 0);
     this.#report(create(QuarantinedBindingSchema, {
-      namespace,
+      namespace: namespace2,
       key: record.key,
       reason: recordedSeat === void 0 ? QuarantineReason.Unseated : QuarantineReason.ForeignSeat,
       recordedSeat: recordedSeat ?? "",
@@ -22611,6 +22771,7 @@ var ReplicaInventoryDesk = class _ReplicaInventoryDesk {
     const undiscovered = /* @__PURE__ */ new Set();
     for (const restored of this.#follows.recover()) {
       following.set(restored.workspace, restored.delayMillis);
+      followed.add(restored.workspace);
     }
     if (!this.#bootstrapped) {
       this.#bootstrapped = true;
@@ -22648,6 +22809,7 @@ var ReplicaInventoryDesk = class _ReplicaInventoryDesk {
           stopped.delete(workspace);
         } else if (reconciliation.changed) {
           following.delete(workspace);
+          followed.delete(workspace);
           stopped.add(workspace);
         }
       } catch (error) {
@@ -22981,7 +23143,7 @@ var LiveCorrespondenceDesk = class {
       wasResident: this.kernel.isResident(binding.workspace) !== false
     };
     this.#links.set(binding.workspace, link);
-    if (link.wasResident) this.#open(link);
+    if (!link.publisher || link.wasResident) this.#open(link);
   }
   changed(workspace) {
     const link = this.#links.get(workspace);
@@ -23008,6 +23170,9 @@ var LiveCorrespondenceDesk = class {
     this.#effect(link, { case: "send", value: bytes });
   }
   export(binding, base, requestId) {
+    if (this.kernel.isResident(binding.workspace) === false) {
+      return create(CustodyOfferBatchRequestSchema, { protocolVersion: 2 });
+    }
     const mount = workspaceMount(binding.workspace);
     const head = this.kernel.head(mount, requestId);
     if (!base || !head || base === head) return create(CustodyOfferBatchRequestSchema, { protocolVersion: 2 });
@@ -23068,6 +23233,7 @@ var LiveCorrespondenceDesk = class {
     }
     if (frame.message.case === "frontier") {
       this.#announced(link, frame.message.value.head);
+      if (this.kernel.isResident(link.binding.workspace) === false) return;
       if (!frame.message.value.response) {
         this.#send(link, { case: "frontier", value: {
           head: this.kernel.head(workspaceMount(link.binding.workspace), ++this.#requestId) ?? "",
@@ -23084,6 +23250,10 @@ var LiveCorrespondenceDesk = class {
     if (frame.message.case !== "offers") return;
     const batch = frame.message.value;
     if (batch.protocolVersion !== 2 || !batch.requestId || batch.source.case !== "inline" || !batch.source.value.offers.length) return;
+    if (this.kernel.isResident(link.binding.workspace) === false) {
+      this.remoteAdvanced?.(link.binding.workspace);
+      return;
+    }
     if ([...this.#pending.values()].some((pending) => pending.link === link && pending.bytes.length === bytes.length && pending.bytes.every((byte, index) => byte === bytes[index]))) return;
     if (this.#pending.size >= 32) return;
     this.#pending.set(request.requestId, { link, bytes });
@@ -23091,7 +23261,16 @@ var LiveCorrespondenceDesk = class {
       protocolVersion: 2,
       requestId: request.requestId,
       target: { workspace: link.binding.workspace, session: link.binding.replicaId },
-      command: { case: "admitCustodyOffers", value: create(CustodyOfferBatchRequestSchema, { ...batch, baseHead: void 0 }) }
+      // HTTP sender reconciliation controls are not part of a live proposal.
+      // Keeping fastForwardOnly while removing baseHead silently skips every
+      // offer against a nonempty local head. The Kernel judges sealed causality;
+      // live receivers neither ask for a return archive nor confirm the sender.
+      command: { case: "admitCustodyOffers", value: create(CustodyOfferBatchRequestSchema, {
+        ...batch,
+        baseHead: void 0,
+        observedHead: void 0,
+        fastForwardOnly: false
+      }) }
     });
   }
   /** Upstream news is a frontier this replica has NEVER seen: neither its own head nor the
@@ -23100,6 +23279,10 @@ var LiveCorrespondenceDesk = class {
   #announced(link, head) {
     if (!head || link.lastAnnounced === head) return;
     link.lastAnnounced = head;
+    if (this.kernel.isResident(link.binding.workspace) === false) {
+      this.remoteAdvanced?.(link.binding.workspace);
+      return;
+    }
     const mount = workspaceMount(link.binding.workspace);
     if (head === this.kernel.head(mount, ++this.#requestId) || head === this.kernel.resolveRef(mount, ++this.#requestId, "refs/remotes/nomos/main")) return;
     this.remoteAdvanced?.(link.binding.workspace);
@@ -23109,6 +23292,10 @@ var LiveCorrespondenceDesk = class {
   #placementAnnounced(link, frontier) {
     if (!frontier || link.lastPlacementAnnounced === frontier) return;
     link.lastPlacementAnnounced = frontier;
+    if (this.kernel.isResident(link.binding.workspace) === false) {
+      this.placementAdvanced?.(link.binding.workspace);
+      return;
+    }
     const mount = workspaceMount(link.binding.workspace);
     if (frontier === this.kernel.resolveRef(mount, ++this.#requestId, PLACEMENT_REF2)) return;
     this.placementAdvanced?.(link.binding.workspace);
@@ -23125,11 +23312,13 @@ var LiveCorrespondenceDesk = class {
   disconnect(workspace) {
     const link = this.#links.get(workspace);
     if (!link) return;
+    if (link.state === "open") this.linkClosed?.(workspace);
     this.#effect(link, { case: "close", value: true });
     this.#links.delete(workspace);
     for (const [id, pending] of this.#pending) if (pending.link === link) this.#pending.delete(id);
   }
   #hello(link) {
+    if (this.kernel.isResident(link.binding.workspace) === false) return;
     const head = this.kernel.head(workspaceMount(link.binding.workspace), ++this.#requestId);
     this.#send(link, { case: "frontier", value: { head: head ?? "" } });
   }
@@ -23137,19 +23326,20 @@ var LiveCorrespondenceDesk = class {
     const now = this.clock.monotonicNanoseconds();
     let wake;
     for (const link of this.#links.values()) {
-      if (this.kernel.isResident(link.binding.workspace) === false) {
+      const resident = this.kernel.isResident(link.binding.workspace) !== false;
+      if (link.publisher && !resident) {
         if (link.wasResident) this.disconnect(link.binding.workspace);
         else wake = wake === void 0 || wake > 250n ? 250n : wake;
         continue;
       }
-      link.wasResident = true;
+      if (resident) link.wasResident = true;
       if (link.state === "opening" && now >= link.due) {
         this.#effect(link, { case: "close", value: true });
         link.state = "closed";
       }
       if (link.state === "closed" && now >= link.due) this.#open(link);
       if (link.state === "open") {
-        if (link.dirty) {
+        if (link.dirty && resident) {
           link.dirty = false;
           try {
             link.published ??= link.publisher ? this.kernel.head(workspaceMount(link.binding.workspace), ++this.#requestId) : this.kernel.resolveRef(workspaceMount(link.binding.workspace), ++this.#requestId, "refs/remotes/nomos/main");
@@ -23168,8 +23358,7 @@ var LiveCorrespondenceDesk = class {
     return wake;
   }
   close() {
-    for (const link of this.#links.values()) this.#effect(link, { case: "close", value: true });
-    this.#links.clear();
+    for (const workspace of [...this.#links.keys()]) this.disconnect(workspace);
     this.#pending.clear();
   }
 };
@@ -23300,9 +23489,9 @@ var RecordsDesk = class {
       command.namespace === void 0 ? {} : { "custody.children_namespace": command.namespace },
       () => this.#kernel.childWorkspaces(mount, request.requestId)
     );
-    const namespace = command.namespace;
-    const selected = namespace === void 0 ? result.children : result.children.filter(
-      (child) => child.status === ChildWorkspaceLifecycleStatus.ACTIVE && isKeyedBirthOf(namespace, child.workspace)
+    const namespace2 = command.namespace;
+    const selected = namespace2 === void 0 ? result.children : result.children.filter(
+      (child) => child.status === ChildWorkspaceLifecycleStatus.ACTIVE && isKeyedBirthOf(namespace2, child.workspace)
     );
     return create(ChildWorkspaceListSchema, {
       children: selected.map((child) => create(ChildWorkspaceSchema, {
@@ -23670,41 +23859,6 @@ var RecoveryDesk = class {
 // ../src/runtime/correspondence_desk.ts
 init_define_NOMOS_KERNEL_RELEASE();
 
-// ../src/runtime/peer_desk_store.ts
-init_define_NOMOS_KERNEL_RELEASE();
-var recordId = (namespace, key) => `${namespace.length}:${namespace}${key}`;
-var copy2 = (record) => ({
-  ...record,
-  value: record.value.slice()
-});
-var MemoryPeerDeskStore = class {
-  #records = /* @__PURE__ */ new Map();
-  list(namespace) {
-    return [...this.#records.values()].filter((record) => record.namespace === namespace).sort((left, right) => left.key.localeCompare(right.key)).map(copy2);
-  }
-  compareExchange(namespace, key, expectedRevision, value) {
-    const id = recordId(namespace, key);
-    const current = this.#records.get(id);
-    if (current?.revision !== expectedRevision) {
-      throw new Error(
-        `peer desk record '${namespace}/${key}' changed at revision ${current?.revision ?? "absent"}`
-      );
-    }
-    if (value === void 0) {
-      this.#records.delete(id);
-      return void 0;
-    }
-    const next = Object.freeze({
-      namespace,
-      key,
-      revision: (current?.revision ?? 0n) + 1n,
-      value: value.slice()
-    });
-    this.#records.set(id, next);
-    return copy2(next);
-  }
-};
-
 // ../src/runtime/correspondence_recovery.ts
 init_define_NOMOS_KERNEL_RELEASE();
 var CorrespondenceRecoveryWork = class {
@@ -24090,6 +24244,7 @@ var WorkspaceSyncWork = class {
   #offerSequence = 0;
   #lastStep;
   #probeOnly;
+  #liveConnected;
   /** Set when this round adopted the upstream's own head as its base (see #establishBase). */
   #establishedBase;
   #receiveState;
@@ -24122,6 +24277,7 @@ var WorkspaceSyncWork = class {
     this.#directoryAnswered = args.directoryAnswered;
     this.#placementFetched = args.placementFetched;
     this.#probeOnly = args.probeOnly ?? false;
+    this.#liveConnected = args.liveConnected === true;
     this.#receiveState = args.receiveState;
     this.#completeHistory = args.completeHistory === true;
     this.#repairMissingCommit = args.repairMissingCommit === true;
@@ -24192,6 +24348,9 @@ var WorkspaceSyncWork = class {
   #openRound() {
     if (this.#receiveState || this.#replaceLocalHead !== void 0) return this.#leaseEffect();
     if (!this.#localHead) return this.#leaseEffect();
+    if (this.#liveConnected && !this.#probeOnly && this.#holdsLocalWork() && this.#previousHead) {
+      return this.#offerOrReconcile();
+    }
     const requestId = `${this.#binding.replicaId}:${this.#requestId}:${this.workId}:frontier`;
     return this.#beginOffer(encodeInlineCustodyOffer({
       session: this.#binding.replicaId,
@@ -24423,6 +24582,18 @@ var WorkspaceSyncWork = class {
       return this.#finishOfferOutcome(false);
     }
     const admission = outcome.value;
+    globalThis.__nomosSyncDiagnostic?.("sync.admission", {
+      workspace: this.#mount.workspace,
+      phase: state.phase,
+      local: this.#localHead,
+      tracked: this.#previousHead,
+      remote: admission.main,
+      sealed: admission.sealedMain,
+      resultBase: admission.resultBase,
+      resultBytes: admission.resultPack.byteLength,
+      recoveryRequired: admission.recoveryRequired,
+      summary: summarizeCustodyAdmission(admission)
+    });
     this.#desiredHead = admission.main || void 0;
     if (!this.#desiredHead) return this.#transportFailure("resident peer returned no admitted frontier", false);
     this.#candidateDurable = admission.sealedMain === this.#desiredHead;
@@ -25039,6 +25210,19 @@ var WorkspaceSyncWork = class {
     return step;
   }
   #finish(value) {
+    globalThis.__nomosSyncDiagnostic?.("sync.finished", {
+      workspace: value.workspace,
+      previous: value.previousHead,
+      current: value.currentHead,
+      stillAhead: value.stillAhead,
+      deferred: String(value.deferred),
+      admitted: String(value.admitted),
+      reconnect: value.reconnectRequired,
+      directOfferDeferred: value.directOfferDeferred,
+      pushFailed: value.pushFailed,
+      failure: value.pushError?.message,
+      wallMs: elapsedMillis(this.#clock, this.#started)
+    });
     this.#state = { phase: WorkspaceSyncPhase.Done };
     this.#current = void 0;
     return this.#remember({ case: "synced", value });
@@ -25095,6 +25279,10 @@ var WorkspaceDependencySyncWork = class {
       this.#plan = [this.#args.root];
       return this.#advance();
     }
+    if (this.#args.liveConnected && this.#args.kernel.resolveRef(this.#args.root.mount, this.#args.requestId, trackedMain2)) {
+      this.#plan = this.#planDependencies();
+      return this.#advance();
+    }
     this.#current = this.#work(this.#args.root, `${this.workId}:frontier`, true);
     return this.#accept(this.#current.start());
   }
@@ -26288,6 +26476,7 @@ var CorrespondenceDesk = class {
   #onSyncCompleted;
   #onPlacementFetched;
   #onShallowMount;
+  #onOutboxHistoryRequired;
   #remoteOffers = new CorrespondenceWorkRegistry();
   #recoveries = new CorrespondenceWorkRegistry();
   #deliveries = new CorrespondenceWorkRegistry();
@@ -26334,6 +26523,7 @@ var CorrespondenceDesk = class {
     this.#onSyncCompleted = args.onSyncCompleted;
     this.#onPlacementFetched = args.onPlacementFetched;
     this.#onShallowMount = args.onShallowMount;
+    this.#onOutboxHistoryRequired = args.onOutboxHistoryRequired;
     this.#clock = args.clock;
     this.#outboxClock = new OutboxObservationClock(args.clock, args.peerIdentity);
     this.#executesCustodianObligations = args.executesCustodianObligations ?? false;
@@ -26497,6 +26687,15 @@ var CorrespondenceDesk = class {
     this.#followLane.dependencyAdvanced(workspace);
     this.reportFollows();
   }
+  /** Received custody can release correspondence and foreign-read dependencies,
+   * but is not newly authored work to send back to its upstream. Recovery is
+   * driven separately by missing history, reconnects and provider announcements.
+   * In particular an optimistic relay is not a durable upstream receipt. */
+  receivedFrontierChanged(workspace) {
+    this.wakeOutbox(workspace);
+    this.#followLane.dependencyAdvanced(workspace);
+    this.reportFollows();
+  }
   /**
    * Tell a workspace's sessions what its durable follow ALREADY knows.
    *
@@ -26733,8 +26932,16 @@ var CorrespondenceDesk = class {
         )
       );
     } catch (error) {
+      if (error instanceof KernelHistoryRequired && this.#onOutboxHistoryRequired) {
+        const retry = this.#onOutboxHistoryRequired(workspace, binding.credentialCapability);
+        this.#outboxDueAt.set(workspace, now + Math.max(250, retry));
+        return { nextAfterMillis: 0 };
+      }
       const format = localCopyFormatRefusal(error);
-      if (format === void 0) throw error;
+      if (format === void 0) {
+        this.#outboxDueAt.set(workspace, now + 3e4);
+        return { nextAfterMillis: 0 };
+      }
       this.#readability.mark(workspace, void 0, format);
       this.#outboxDueAt.delete(workspace);
       return { nextAfterMillis: 0 };
@@ -27014,6 +27221,7 @@ var CorrespondenceDesk = class {
         requestId: request.requestId,
         workId: id,
         probeOnly,
+        liveConnected: this.#openLinks.has(target3.mount.workspace),
         ...beforeConverge === void 0 ? {} : { beforeConverge },
         ...target3.receiveState === void 0 ? {} : { receiveState: target3.receiveState },
         ...target3.offerHead === void 0 ? {} : { offerHead: target3.offerHead },
@@ -27041,6 +27249,7 @@ var CorrespondenceDesk = class {
         root,
         work,
         outbound: command.admit,
+        liveConnected: this.#openLinks.has(mount.workspace),
         dependency: (workspace, source, acquire2 = false) => {
           if (this.#roundInFlight(workspace, workId2)) return void 0;
           const existing = this.#follows.bindingForWorkspace(workspace);
@@ -28580,15 +28789,15 @@ function reduceHistoryAcquisition(state, event) {
 var HISTORY_ACQUISITION_NAMESPACE = "nomos.peer-desk.history-acquisition/v1";
 var HISTORY_BACKGROUND_START_MILLIS = 1e4;
 var SLICE_ANSWER_MILLIS = 5 * 6e4;
-var encoder3 = new TextEncoder();
-var decoder3 = new TextDecoder();
+var encoder4 = new TextEncoder();
+var decoder4 = new TextDecoder();
 var workId = (workspace) => `history-acquisition:${workspace}`;
 var effectId = (workspace, attempt) => `history-acquisition:${workspace}:${HistoryAcquisitionPhase.Acquiring}:${attempt}`;
 var encode2 = (work) => {
   if (!work.credentialCapability) {
     throw new Error(`history acquisition for '${work.workspace}' has not restored its credential capability`);
   }
-  return encoder3.encode(JSON.stringify({
+  return encoder4.encode(JSON.stringify({
     version: 2,
     workspace: work.workspace,
     credentialCapability: work.credentialCapability,
@@ -28597,7 +28806,7 @@ var encode2 = (work) => {
 };
 var upgraded = (state) => state.case === "backoff" ? { case: HistoryAcquisitionPhase.Paced, attempt: state.attempt, delayMillis: state.delayMillis, failed: true } : state;
 var decode2 = (record) => {
-  const value = JSON.parse(decoder3.decode(record.value));
+  const value = JSON.parse(decoder4.decode(record.value));
   if (!value || typeof value !== "object") throw corrupt2(record, "not an object");
   const candidate = value;
   if (candidate.version !== 1 && candidate.version !== 2 || candidate.workspace !== record.key || !candidate.state) {
@@ -28660,6 +28869,21 @@ var HistoryAcquisitionDesk = class {
     this.#ensure(workspace, credentialCapability);
     this.#dueAt.set(workspace, this.#now() + HISTORY_BACKGROUND_START_MILLIS);
   }
+  /** A background kernel read needs an omitted ancestor now. Queue one bounded
+   * slice on the existing history lane; a failed slice keeps its retry pace. */
+  requestFromBackground(workspace, credentialCapability) {
+    if (!workspace) throw new Error("kernel history requirement names no workspace");
+    this.#ensure(workspace, credentialCapability);
+    const work = this.#get(workspace);
+    const now = this.#now();
+    if (work.state.case === HistoryAcquisitionPhase.Paced && work.state.failed) {
+      const due2 = this.#dueAt.get(workspace) ?? now + work.state.delayMillis;
+      this.#dueAt.set(workspace, due2);
+      if (due2 > now) return due2 - now;
+    }
+    this.#dueAt.set(workspace, now);
+    return 250;
+  }
   /** An operation needs history this custody lacks: its next slice now, joining one in flight. */
   begin(workspace, credentialCapability) {
     if (!workspace) throw new Error("kernel history requirement names no workspace");
@@ -28968,7 +29192,7 @@ var PeerOffice = class {
       this.#trace,
       this.#readability
     );
-    this.#custodyAdmission = new CustodyAdmissionDesk(this.#kernel, this.#custody);
+    this.#custodyAdmission = new CustodyAdmissionDesk(this.#kernel, this.#custody, new CustodyReceipts(seatedStore));
     this.#queries = new KernelQueries(this.#kernel, this.#credentials);
     this.#follows = new ReplicaFollowController(
       new ReplicaFollowDesk(seatedStore),
@@ -29130,6 +29354,7 @@ var PeerOffice = class {
       // Lazy history: a head-only mount materialises its history in the background, never on
       // the path of an operation (architecture/lazy_history.md).
       onShallowMount: (workspace, credentialCapability) => this.#historyAcquisition.materialise(workspace, credentialCapability),
+      onOutboxHistoryRequired: (workspace, credentialCapability) => this.#historyAcquisition.requestFromBackground(workspace, credentialCapability),
       onSyncCompleted: (session, event) => {
         if (event.result?.workspace) {
           this.#replicaInventory.placementMayHaveChanged(event.result.workspace);
@@ -29596,8 +29821,8 @@ var PeerOffice = class {
       this.#replicaInventory.placementMayHaveChanged(workspace);
     }
   }
-  /** Execute a typed paper after the access desk; never skip lifecycle or
-   * session-binding checks merely because its caller is another local desk. */
+  /** Execute a typed paper after the access desk. Custody admission addresses a
+   * workspace by replica identity; application calls retain session binding. */
   #dispatchRequest(request) {
     validateRuntimeV2Request(request);
     try {
@@ -29611,18 +29836,20 @@ var PeerOffice = class {
         if (!request.target.workspace || !request.target.session) {
           throw new Error("addressed runtime request requires workspace and session");
         }
-        const binding = this.#sessions.bindingIfPresent(request.target.session);
-        if (binding !== void 0) {
-          if (binding.workspace !== request.target.workspace) {
-            throw new Error(
-              `session '${request.target.session}' is bound to workspace '${binding.workspace}', not '${request.target.workspace}'`
-            );
+        if (request.command.case !== "admitCustodyOffers") {
+          const binding = this.#sessions.bindingIfPresent(request.target.session);
+          if (binding !== void 0) {
+            if (binding.workspace !== request.target.workspace) {
+              throw new Error(
+                `session '${request.target.session}' is bound to workspace '${binding.workspace}', not '${request.target.workspace}'`
+              );
+            }
+          } else {
+            this.#bindInteraction(create(BindSessionRequestSchema, {
+              session: request.target.session,
+              workspace: request.target.workspace
+            }));
           }
-        } else {
-          this.#bindInteraction(create(BindSessionRequestSchema, {
-            session: request.target.session,
-            workspace: request.target.workspace
-          }));
         }
       }
       switch (request.command.case) {
@@ -29819,7 +30046,7 @@ var PeerOffice = class {
                 ReadMaintenanceCause.ADMITTED_OFFER
               );
               this.#subscriptions.refreshWorkspace(request.target.workspace);
-              this.#correspondence.workspaceFrontierChanged(request.target.workspace);
+              this.#correspondence.receivedFrontierChanged(request.target.workspace);
             }
             return this.#birthCustodyResponse(
               request,
@@ -30403,6 +30630,15 @@ function createBackgroundLanes(options) {
   const correspondenceNotBefore = /* @__PURE__ */ new Map();
   let retention = 0;
   let closed = false;
+  let selectionFailures = 0;
+  const selectionFault = (error) => {
+    try {
+      options.onSelectionError?.(error);
+    } catch {
+    }
+    selectionFailures += 1;
+    wake(Math.min(3e4, 250 * 2 ** Math.min(selectionFailures - 1, 7)));
+  };
   const wake = (delayMillis = 0) => {
     if (closed) return;
     const delay = Math.max(0, Math.ceil(delayMillis));
@@ -30413,53 +30649,58 @@ function createBackgroundLanes(options) {
     }
     wakeAt = at;
     timer = setTimer(() => {
-      timer = void 0;
-      wakeAt = void 0;
-      if (closed) return;
-      const now = options.monotonicNanoseconds();
-      for (const [workspace2, at2] of correspondenceNotBefore) {
-        if (at2 <= now) correspondenceNotBefore.delete(workspace2);
-      }
-      const backoffMillis = correspondenceNotBefore.size ? Math.min(...[...correspondenceNotBefore.values()].map((at2) => Number((at2 - now + 999999n) / 1000000n))) : void 0;
-      const retentionOnly = correspondenceInFlight;
-      const next = options.nextPaper(retentionOnly, new Set(correspondenceNotBefore.keys()));
-      if (next.frame === void 0) {
-        const delays = [next.nextAfterMillis, backoffMillis].filter((delay2) => delay2 !== void 0);
-        if (delays.length) wake(Math.min(...delays));
-        return;
-      }
-      if (options.isRetention(next.frame)) {
-        retention += 1;
+      try {
+        timer = void 0;
+        wakeAt = void 0;
+        if (closed) return;
+        const now = options.monotonicNanoseconds();
+        for (const [workspace2, at2] of correspondenceNotBefore) {
+          if (at2 <= now) correspondenceNotBefore.delete(workspace2);
+        }
+        const backoffMillis = correspondenceNotBefore.size ? Math.min(...[...correspondenceNotBefore.values()].map((at2) => Number((at2 - now + 999999n) / 1000000n))) : void 0;
+        const retentionOnly = correspondenceInFlight;
+        const next = options.nextPaper(retentionOnly, new Set(correspondenceNotBefore.keys()));
+        selectionFailures = 0;
+        if (next.frame === void 0) {
+          const delays = [next.nextAfterMillis, backoffMillis].filter((delay2) => delay2 !== void 0);
+          if (delays.length) wake(Math.min(...delays));
+          return;
+        }
+        if (options.isRetention(next.frame)) {
+          retention += 1;
+          void options.drive(next.frame).then(
+            () => {
+              retention -= 1;
+              wake(0);
+            },
+            () => {
+              retention -= 1;
+              wake(0);
+            }
+          );
+          wake(next.nextAfterMillis ?? 0);
+          return;
+        }
+        if (retentionOnly) throw new Error("background desk reserved correspondence while its lane was unavailable");
+        const workspace = next.workspace;
+        if (!workspace) throw new Error("background correspondence has no source workspace");
+        if (correspondenceNotBefore.has(workspace)) throw new Error("background desk bypassed a workspace's physical backoff");
+        correspondenceInFlight = true;
         void options.drive(next.frame).then(
           () => {
-            retention -= 1;
-            wake(0);
+            correspondenceInFlight = false;
+            wake(next.nextAfterMillis ?? 0);
           },
           () => {
-            retention -= 1;
+            correspondenceInFlight = false;
+            correspondenceNotBefore.set(workspace, options.monotonicNanoseconds() + BigInt(failureBackoffMillis) * 1000000n);
             wake(0);
           }
         );
-        wake(next.nextAfterMillis ?? 0);
-        return;
+        wake(0);
+      } catch (error) {
+        selectionFault(error);
       }
-      if (retentionOnly) throw new Error("background desk reserved correspondence while its lane was unavailable");
-      const workspace = next.workspace;
-      if (!workspace) throw new Error("background correspondence has no source workspace");
-      if (correspondenceNotBefore.has(workspace)) throw new Error("background desk bypassed a workspace's physical backoff");
-      correspondenceInFlight = true;
-      void options.drive(next.frame).then(
-        () => {
-          correspondenceInFlight = false;
-          wake(next.nextAfterMillis ?? 0);
-        },
-        () => {
-          correspondenceInFlight = false;
-          correspondenceNotBefore.set(workspace, options.monotonicNanoseconds() + BigInt(failureBackoffMillis) * 1000000n);
-          wake(0);
-        }
-      );
-      wake(0);
     }, delay);
   };
   return {
@@ -30534,7 +30775,8 @@ function createPeerOfficeFrameRunner(kernel, credentials, profile, observations,
       throw error;
     }),
     isRetention: (frame) => fromBinary(RuntimeRequestSchema, frame).command.case === "retainFrontier",
-    monotonicNanoseconds: () => observations.monotonicNanoseconds()
+    monotonicNanoseconds: () => observations.monotonicNanoseconds(),
+    onSelectionError: (error) => console.error("Nomos background paper selection failed", error)
   });
   const scheduleCorrespondence = (delayMillis = 0) => {
     lanes?.wake(delayMillis);
@@ -30765,13 +31007,19 @@ var candidateSessionReference = async (identity) => {
 };
 var executeGitFetchWithAlongside = async (effect, fetchImpl) => {
   if (!effect.alongside) return executeGitFetchEffect(effect, fetchImpl);
-  const [fetched, alongside] = await Promise.all([
-    executeGitFetchEffect(effect, fetchImpl),
-    executeHttpEffect(effect.alongside, fetchImpl)
-  ]);
-  if (fetched.outcome.case === "gitFetch" && alongside.outcome.case === "response") {
+  const cancelAlongside = new AbortController();
+  let alongside;
+  void executeHttpEffect(effect.alongside, (input, init) => fetchImpl(input, {
+    ...init,
+    signal: init?.signal ? AbortSignal.any([init.signal, cancelAlongside.signal]) : cancelAlongside.signal
+  })).then((receipt) => {
+    alongside = receipt;
+  });
+  const fetched = await executeGitFetchEffect(effect, fetchImpl);
+  if (fetched.outcome.case === "gitFetch" && alongside?.outcome.case === "response") {
     fetched.outcome.value.alongside = alongside.outcome.value;
   }
+  cancelAlongside.abort();
   return fetched;
 };
 var executeGitPushEffect = async (effect, fetchImpl) => {
@@ -31139,7 +31387,8 @@ function socketEffects(invoke2, permits = () => true) {
       requestId: ++sequence,
       command: { case: "socketReceipt", value: create(PeerSocketReceiptSchema, { connectionId, observation }) }
     }));
-    void Promise.resolve().then(() => invoke2(frame)).catch(() => {
+    void Promise.resolve().then(() => invoke2(frame)).catch((error) => {
+      console.warn("[nomos-socket] receipt failed", { connectionId, error });
       sockets.get(connectionId)?.close();
     });
   };
@@ -31161,6 +31410,7 @@ function socketEffects(invoke2, permits = () => true) {
           socket.onopen = () => receipt(id, { case: "opened", value: true });
           socket.onmessage = (message) => {
             if (message.data instanceof ArrayBuffer) receipt(id, { case: "received", value: new Uint8Array(message.data) });
+            else if (typeof message.data === "string") receipt(id, { case: "received", value: new TextEncoder().encode(message.data) });
           };
           socket.onclose = () => {
             if (sockets.get(id) === socket) sockets.delete(id);
@@ -31374,21 +31624,21 @@ var SqlitePeerDeskStore = class {
     }
     return this.#opened = database;
   }
-  list(namespace) {
+  list(namespace2) {
     const rows = this.#database().prepare(`
       SELECT record_key AS key, revision, value
         FROM peer_desk_record
        WHERE namespace = ?
        ORDER BY record_key
-    `).all(namespace);
+    `).all(namespace2);
     return rows.map((row) => ({
-      namespace,
+      namespace: namespace2,
       key: row.key,
       revision: BigInt(row.revision),
       value: Uint8Array.from(row.value)
     }));
   }
-  compareExchange(namespace, key, expectedRevision, value) {
+  compareExchange(namespace2, key, expectedRevision, value) {
     const expected = expectedRevision === void 0 ? void 0 : Number(expectedRevision);
     if (expected !== void 0 && (!Number.isSafeInteger(expected) || expected <= 0)) {
       throw new Error(`peer desk revision ${expectedRevision} cannot be represented by SQLite`);
@@ -31401,8 +31651,8 @@ var SqlitePeerDeskStore = class {
         const removed = database.prepare(`
           DELETE FROM peer_desk_record
            WHERE namespace = ? AND record_key = ? AND revision = ?
-        `).run(namespace, key, expected);
-        if (removed.changes !== 1) this.#conflict(namespace, key);
+        `).run(namespace2, key, expected);
+        if (removed.changes !== 1) this.#conflict(namespace2, key);
         return this.#commit(void 0);
       }
       const bytes = Buffer.from(value.buffer, value.byteOffset, value.byteLength);
@@ -31414,14 +31664,14 @@ var SqlitePeerDeskStore = class {
             INSERT INTO peer_desk_record(namespace, record_key, revision, value)
             VALUES (?, ?, 1, ?)
             ON CONFLICT(namespace, record_key) DO NOTHING
-          `).run(namespace, key, bytes) : database.prepare(`
+          `).run(namespace2, key, bytes) : database.prepare(`
             UPDATE peer_desk_record
                SET revision = ?, value = ?
              WHERE namespace = ? AND record_key = ? AND revision = ?
-          `).run(nextRevision, bytes, namespace, key, expected);
-      if (changed.changes !== 1) this.#conflict(namespace, key);
+          `).run(nextRevision, bytes, namespace2, key, expected);
+      if (changed.changes !== 1) this.#conflict(namespace2, key);
       return this.#commit({
-        namespace,
+        namespace: namespace2,
         key,
         revision: BigInt(nextRevision),
         value: value.slice()
@@ -31439,12 +31689,12 @@ var SqlitePeerDeskStore = class {
     this.#database().exec("COMMIT");
     return value;
   }
-  #conflict(namespace, key) {
+  #conflict(namespace2, key) {
     const current = this.#database().prepare(`
       SELECT revision FROM peer_desk_record WHERE namespace = ? AND record_key = ?
-    `).get(namespace, key);
+    `).get(namespace2, key);
     throw new Error(
-      `peer desk record '${namespace}/${key}' changed at revision ${current?.revision ?? "absent"}`
+      `peer desk record '${namespace2}/${key}' changed at revision ${current?.revision ?? "absent"}`
     );
   }
 };
@@ -31757,7 +32007,7 @@ var okBytes = async (fetchImpl, url) => {
 async function selectReleaseKernel(args) {
   const fetchImpl = args.fetchImpl ?? ((input, init) => globalThis.fetch(input, init));
   const base = args.base.replace(/\/+$/, "");
-  const repositoryUrl = `${base}/v1/runtime/repository.xml`;
+  const repositoryUrl = args.repositoryUrl ?? `${base}/v1/runtime/repository.xml`;
   const repositoryResponse = await fetchImpl(repositoryUrl);
   if (!repositoryResponse.ok) {
     throw new Error(`custodian kernel repository ${repositoryUrl}: HTTP ${repositoryResponse.status}`);