@githolon/runtime 0.112.8 → 0.112.12

package/dist/nomos-native-runtime.js

@@ -6587,7 +6587,8 @@ var NomosRuntimeComponent = (() => {
         }
       }));
       if (response.outcome.case === "failure") {
-        throw new Error(`${response.outcome.value.code}: ${response.outcome.value.message}`);
+        throwUnnamedHistoryRequirement(response.outcome.value, mount.workspace);
+        throwKernelFailure(response.outcome.value);
       }
       if (response.outcome.case !== "outbox") {
         throw new Error(`kernel returned '${response.outcome.case || "empty"}' while reading correspondence`);
@@ -6616,7 +6617,8 @@ var NomosRuntimeComponent = (() => {
         }
       }));
       if (response.outcome.case === "failure") {
-        throw new Error(`${response.outcome.value.code}: ${response.outcome.value.message}`);
+        throwUnnamedHistoryRequirement(response.outcome.value, mount.workspace);
+        throwKernelFailure(response.outcome.value);
       }
       if (response.outcome.case !== "outbox") {
         throw new Error(
@@ -9574,19 +9576,19 @@ var NomosRuntimeComponent = (() => {
 
   // ../src/runtime/workspace_naming.ts
   var WORKSPACE_NAME_SEP = "";
-  var keyedBirthNameOf = (namespace, key) => `${namespace}-${sha256Hex(new TextEncoder().encode(namespace + WORKSPACE_NAME_SEP + key)).slice(0, 40)}`;
+  var keyedBirthNameOf = (namespace2, key) => `${namespace2}-${sha256Hex(new TextEncoder().encode(namespace2 + WORKSPACE_NAME_SEP + key)).slice(0, 40)}`;
   var RECEIVING_GROUP_NAME_PREFIX = "nomos-rg-";
   var receivingGroupNameOf = (principal) => `${RECEIVING_GROUP_NAME_PREFIX}${sha256Hex(new TextEncoder().encode(principal)).slice(0, 40)}`;
-  var isKeyedBirthOf = (namespace, workspace) => workspace.startsWith(`${namespace}-`);
+  var isKeyedBirthOf = (namespace2, workspace) => workspace.startsWith(`${namespace2}-`);
   var WORKSPACE_NAME_REQUEST_INVALID = "nomos.runtime.workspace_name_request_invalid";
   function resolveWorkspaceName(command) {
     switch (command.birth.case) {
       case "keyed": {
-        const { namespace, key } = command.birth.value;
-        if (namespace.length === 0 || key.length === 0) {
+        const { namespace: namespace2, key } = command.birth.value;
+        if (namespace2.length === 0 || key.length === 0) {
           throw new Error(`${WORKSPACE_NAME_REQUEST_INVALID}: a keyed birth name needs both its namespace and its key`);
         }
-        return create(ResolvedWorkspaceNameSchema, { workspace: keyedBirthNameOf(namespace, key) });
+        return create(ResolvedWorkspaceNameSchema, { workspace: keyedBirthNameOf(namespace2, key) });
       }
       case "receivingGroup": {
         const { principal } = command.birth.value;
@@ -11629,6 +11631,132 @@ var NomosRuntimeComponent = (() => {
     }
   };
 
+  // ../src/runtime/peer_desk_store.ts
+  var recordId = (namespace2, key) => `${namespace2.length}:${namespace2}${key}`;
+  var copy2 = (record) => ({
+    ...record,
+    value: record.value.slice()
+  });
+  var MemoryPeerDeskStore = class {
+    #records = /* @__PURE__ */ new Map();
+    list(namespace2) {
+      return [...this.#records.values()].filter((record) => record.namespace === namespace2).sort((left, right) => left.key.localeCompare(right.key)).map(copy2);
+    }
+    compareExchange(namespace2, key, expectedRevision, value) {
+      const id = recordId(namespace2, key);
+      const current = this.#records.get(id);
+      if (current?.revision !== expectedRevision) {
+        throw new Error(
+          `peer desk record '${namespace2}/${key}' changed at revision ${current?.revision ?? "absent"}`
+        );
+      }
+      if (value === void 0) {
+        this.#records.delete(id);
+        return void 0;
+      }
+      const next = Object.freeze({
+        namespace: namespace2,
+        key,
+        revision: (current?.revision ?? 0n) + 1n,
+        value: value.slice()
+      });
+      this.#records.set(id, next);
+      return copy2(next);
+    }
+  };
+
+  // ../src/runtime/custody_receipts.ts
+  var namespace = "nomos.peer-desk.custody-receipts/v1";
+  var encoder = new TextEncoder();
+  var decoder = new TextDecoder();
+  var MAX_BASES = 256;
+  var MAX_RECEIPTS = 4096;
+  var CustodyReceipts = class {
+    #store;
+    #records = /* @__PURE__ */ new Map();
+    #journals = /* @__PURE__ */ new Map();
+    #receipts = /* @__PURE__ */ new Map();
+    constructor(store = new MemoryPeerDeskStore()) {
+      this.#store = store;
+      for (const record of store.list(namespace)) {
+        this.#records.set(record.key, record);
+        try {
+          if (record.key.startsWith("receipt:")) {
+            const newline = record.value.indexOf(10);
+            if (newline < 0) continue;
+            const receipt = fromBinary(CustodyIntentAdmissionSchema, record.value.subarray(newline + 1));
+            const header2 = JSON.parse(decoder.decode(record.value.subarray(0, newline)));
+            if (receipt.outcome.case === "admitted" && typeof header2.generation === "string" && typeof header2.head === "string") this.#receipts.set(record.key, { ...header2, receipt });
+            continue;
+          }
+          if (!record.key.startsWith("head:")) continue;
+          const value = JSON.parse(decoder.decode(record.value));
+          if (typeof value.head !== "string" || typeof value.generation !== "string" || !Array.isArray(value.bases) || !Array.isArray(value.keys) || value.bases.length > MAX_BASES || value.keys.length > MAX_RECEIPTS) continue;
+          if (!value.bases.every((base) => typeof base === "string") || !value.keys.every((key) => typeof key === "string")) continue;
+          this.#journals.set(record.key.slice(5), value);
+        } catch {
+        }
+      }
+    }
+    covers(workspace, current, base) {
+      const value = this.#journals.get(workspace);
+      return value?.head === current && value.bases.includes(base);
+    }
+    receipt(workspace, current, change) {
+      const value = this.#journals.get(workspace);
+      if (value?.head !== current) return void 0;
+      const stored = this.#receipts.get(`receipt:${workspace}:${sha256Hex(change)}`);
+      if (stored?.generation !== value.generation) return void 0;
+      if (stored.head !== value.head && !value.bases.includes(stored.head)) return void 0;
+      return fromBinary(CustodyIntentAdmissionSchema, toBinary(CustodyIntentAdmissionSchema, stored.receipt));
+    }
+    record(workspace, before, after, receipts) {
+      const old = this.#journals.get(workspace);
+      const journalKey = `head:${workspace}`;
+      const value = old?.head === before ? { ...old, head: after, bases: [...old.bases], keys: [...old.keys] } : { head: after, bases: [], keys: [], generation: String((this.#records.get(journalKey)?.revision ?? 0n) + 1n) };
+      if (before && before !== after) value.bases.push(before);
+      value.bases = [...new Set(value.bases)].slice(-MAX_BASES);
+      const keys = new Set(value.keys);
+      const discarded = new Set(old?.generation !== value.generation ? old?.keys : []);
+      for (const { change, receipt } of receipts) {
+        if (receipt.outcome.case !== "admitted") continue;
+        const key = `receipt:${workspace}:${sha256Hex(change)}`;
+        keys.delete(key);
+        keys.add(key);
+        discarded.delete(key);
+        const header2 = encoder.encode(`${JSON.stringify({ generation: value.generation, head: after })}
+`);
+        const body = toBinary(CustodyIntentAdmissionSchema, receipt);
+        const bytes = new Uint8Array(header2.length + body.length);
+        bytes.set(header2);
+        bytes.set(body, header2.length);
+        const record2 = this.#store.compareExchange(namespace, key, this.#records.get(key)?.revision, bytes);
+        if (record2) this.#records.set(key, record2);
+        this.#receipts.set(key, {
+          generation: value.generation,
+          head: after,
+          receipt: fromBinary(CustodyIntentAdmissionSchema, body)
+        });
+      }
+      const ordered = [...keys];
+      for (const key of ordered.slice(0, -MAX_RECEIPTS)) discarded.add(key);
+      value.keys = ordered.slice(-MAX_RECEIPTS);
+      for (const key of discarded) {
+        this.#store.compareExchange(namespace, key, this.#records.get(key)?.revision, void 0);
+        this.#records.delete(key);
+        this.#receipts.delete(key);
+      }
+      const record = this.#store.compareExchange(
+        namespace,
+        journalKey,
+        this.#records.get(journalKey)?.revision,
+        encoder.encode(JSON.stringify(value))
+      );
+      if (record) this.#records.set(journalKey, record);
+      this.#journals.set(workspace, value);
+    }
+  };
+
   // ../src/runtime/custodian_placement.ts
   var CustodianPlacement = class {
     #kernel;
@@ -11729,14 +11857,16 @@ var NomosRuntimeComponent = (() => {
   var CustodyAdmissionDesk = class {
     #kernel;
     #custody;
-    constructor(kernel, custody) {
+    #receipts;
+    constructor(kernel, custody, receipts = new CustodyReceipts()) {
       this.#kernel = kernel;
       this.#custody = custody;
+      this.#receipts = receipts;
     }
     admit(request, command) {
-      const session = request.target?.session;
-      if (!session) throw new Error("custody admission requires an addressed runtime session");
-      const mount = this.#custody.mountForSession(session);
+      const workspace = request.target?.workspace;
+      if (!workspace) throw new Error("custody admission requires an addressed workspace");
+      const mount = this.#custody.mountForWorkspace(workspace);
       if (command.evidencePack.byteLength > 0) {
         this.#kernel.applyPack(mount, request.requestId, command.evidencePack);
       }
@@ -11747,21 +11877,42 @@ var NomosRuntimeComponent = (() => {
       const births = [];
       const admittedBase = this.#kernel.head(mount, request.requestId) ?? "";
       if (command.fastForwardOnly && offers.length > 0 && (command.baseHead ?? "") !== admittedBase) {
+        for (const offer of offers) {
+          const receipt = this.#receipts.receipt(mount.workspace, admittedBase, offer.changeUsda);
+          if (!receipt) continue;
+          receipt.commitOid = offer.commitOid;
+          const records = sessions.get(offer.session) ?? [];
+          records.push(receipt);
+          sessions.set(offer.session, records);
+        }
+        let delta = custodyReturnDelta(
+          this.#kernel,
+          mount,
+          request.requestId,
+          command.baseHead,
+          admittedBase,
+          admittedBase,
+          command.observedHead
+        );
+        if (command.baseHead && command.observedHead !== admittedBase && this.#receipts.covers(mount.workspace, admittedBase, command.baseHead)) {
+          try {
+            delta = {
+              resultBase: command.baseHead,
+              resultPack: this.#kernel.packDelta(mount, request.requestId, admittedBase, command.baseHead),
+              recoveryRequired: false
+            };
+          } catch {
+          }
+        }
         return create(CustodyAdmissionSchema, {
           main: admittedBase,
-          ...custodyReturnDelta(
-            this.#kernel,
-            mount,
-            request.requestId,
-            command.baseHead,
-            admittedBase,
-            admittedBase,
-            command.observedHead
-          )
+          sessions: [...sessions].map(([session, intents]) => create(CustodySessionAdmissionSchema, { session, intents })),
+          ...delta
         });
       }
       let main = admittedBase;
       const heldSessions = /* @__PURE__ */ new Map();
+      const receipts = [];
       for (const offer of offers) {
         const heldBehind = heldSessions.get(offer.session);
         const verdict = heldBehind === void 0 ? this.#offer(request, mount, offer) : create(OfferResponseSchema, { outcome: { case: "blockedOnDependency", value: {
@@ -11771,7 +11922,9 @@ var NomosRuntimeComponent = (() => {
           heldSessions.set(offer.session, verdict.outcome.value.offerId || offer.commitOid);
         }
         const records = sessions.get(offer.session) ?? [];
-        records.push(this.#record(offer, verdict));
+        const receipt = this.#record(offer, verdict);
+        records.push(receipt);
+        receipts.push({ change: offer.changeUsda, receipt });
         sessions.set(offer.session, records);
         if (verdict.outcome.case === "admitted") {
           main = verdict.outcome.value.head;
@@ -11787,6 +11940,9 @@ var NomosRuntimeComponent = (() => {
           }
         }
       }
+      if (receipts.some((entry) => entry.receipt.outcome.case === "admitted")) {
+        this.#receipts.record(mount.workspace, admittedBase, main, receipts);
+      }
       return create(CustodyAdmissionSchema, {
         main,
         sessions: [...sessions].map(
@@ -14745,8 +14901,8 @@ var NomosRuntimeComponent = (() => {
 
   // ../src/runtime/preserved_copies_desk.ts
   var PRESERVED_COPIES_NAMESPACE = "nomos.peer-desk.preserved-local-copies/v1";
-  var encoder = new TextEncoder();
-  var decoder = new TextDecoder();
+  var encoder2 = new TextEncoder();
+  var decoder2 = new TextDecoder();
   var PreservedCopiesDesk = class {
     #store;
     constructor(store) {
@@ -14755,7 +14911,7 @@ var NomosRuntimeComponent = (() => {
     list(workspace) {
       const record = this.#store.list(PRESERVED_COPIES_NAMESPACE).find((entry) => entry.key === workspace);
       if (!record) return [];
-      const values = JSON.parse(decoder.decode(record.value));
+      const values = JSON.parse(decoder2.decode(record.value));
       if (!Array.isArray(values)) {
         throw new Error(`corrupt preserved-copy record for '${workspace}' at revision ${record.revision}`);
       }
@@ -14769,7 +14925,7 @@ var NomosRuntimeComponent = (() => {
         PRESERVED_COPIES_NAMESPACE,
         copy3.workspace,
         current?.revision,
-        encoder.encode(`[${next.map((entry) => toJsonString(PreservedLocalCopySchema, entry)).join(",")}]`)
+        encoder2.encode(`[${next.map((entry) => toJsonString(PreservedLocalCopySchema, entry)).join(",")}]`)
       );
       if (!stored) throw new Error(`preserved copy of '${copy3.workspace}' was not recorded`);
     }
@@ -14810,9 +14966,9 @@ var NomosRuntimeComponent = (() => {
   ]);
   var SEAT_PREFIX = "nomos-office-seat/v1:";
   var SEAT_DIGEST_HEX = 64;
-  var encoder2 = new TextEncoder();
-  var decoder2 = new TextDecoder();
-  var header = (digest) => encoder2.encode(`${SEAT_PREFIX}${digest}
+  var encoder3 = new TextEncoder();
+  var decoder3 = new TextDecoder();
+  var header = (digest) => encoder3.encode(`${SEAT_PREFIX}${digest}
 `);
   var QuarantineReason = Object.freeze({
     /** Another office's seat: a copied state directory, or a store lifted from another peer. */
@@ -14823,7 +14979,7 @@ var NomosRuntimeComponent = (() => {
   function readSeal(value) {
     const headerLength = SEAT_PREFIX.length + SEAT_DIGEST_HEX + 1;
     if (value.byteLength < headerLength) return void 0;
-    const text = decoder2.decode(value.subarray(0, headerLength));
+    const text = decoder3.decode(value.subarray(0, headerLength));
     if (!text.startsWith(SEAT_PREFIX) || !text.endsWith("\n")) return void 0;
     const seat = text.slice(SEAT_PREFIX.length, headerLength - 1);
     if (!/^[0-9a-f]{64}$/.test(seat)) return void 0;
@@ -14847,44 +15003,44 @@ var NomosRuntimeComponent = (() => {
       this.#seat = seat;
       this.#report = report;
     }
-    list(namespace) {
-      if (LOCAL_ONLY_NAMESPACES.has(namespace)) return this.#inner.list(namespace);
+    list(namespace2) {
+      if (LOCAL_ONLY_NAMESPACES.has(namespace2)) return this.#inner.list(namespace2);
       const kept = [];
-      for (const record of this.#inner.list(namespace)) {
+      for (const record of this.#inner.list(namespace2)) {
         const sealed = readSeal(record.value);
         if (sealed?.seat === this.#seat.digest) {
           kept.push({ ...record, value: sealed.value.slice() });
           continue;
         }
-        this.#quarantine(namespace, record, sealed?.seat);
+        this.#quarantine(namespace2, record, sealed?.seat);
       }
       return kept;
     }
-    compareExchange(namespace, key, expectedRevision, value) {
-      if (LOCAL_ONLY_NAMESPACES.has(namespace)) {
-        return this.#inner.compareExchange(namespace, key, expectedRevision, value);
+    compareExchange(namespace2, key, expectedRevision, value) {
+      if (LOCAL_ONLY_NAMESPACES.has(namespace2)) {
+        return this.#inner.compareExchange(namespace2, key, expectedRevision, value);
       }
       const stored = this.#inner.compareExchange(
-        namespace,
+        namespace2,
         key,
         expectedRevision,
         value === void 0 ? void 0 : seal(this.#seat.digest, value)
       );
       if (stored === void 0) return void 0;
       const sealed = readSeal(stored.value);
-      if (!sealed) throw new Error(`peer desk record '${namespace}/${key}' lost its office seat`);
+      if (!sealed) throw new Error(`peer desk record '${namespace2}/${key}' lost its office seat`);
       return { ...stored, value: sealed.value.slice() };
     }
     /** Preserve the foreign record under the quarantine namespace, then free the slot. */
-    #quarantine(namespace, record, recordedSeat) {
-      const key = `${namespace}\0${record.key}\0${record.revision}`;
+    #quarantine(namespace2, record, recordedSeat) {
+      const key = `${namespace2}\0${record.key}\0${record.revision}`;
       try {
         this.#inner.compareExchange(QUARANTINED_BINDINGS_NAMESPACE, key, void 0, record.value);
       } catch {
       }
-      this.#inner.compareExchange(namespace, record.key, record.revision, void 0);
+      this.#inner.compareExchange(namespace2, record.key, record.revision, void 0);
       this.#report(create(QuarantinedBindingSchema, {
-        namespace,
+        namespace: namespace2,
         key: record.key,
         reason: recordedSeat === void 0 ? QuarantineReason.Unseated : QuarantineReason.ForeignSeat,
         recordedSeat: recordedSeat ?? "",
@@ -14934,6 +15090,7 @@ var NomosRuntimeComponent = (() => {
       const undiscovered = /* @__PURE__ */ new Set();
       for (const restored of this.#follows.recover()) {
         following.set(restored.workspace, restored.delayMillis);
+        followed.add(restored.workspace);
       }
       if (!this.#bootstrapped) {
         this.#bootstrapped = true;
@@ -14971,6 +15128,7 @@ var NomosRuntimeComponent = (() => {
             stopped.delete(workspace);
           } else if (reconciliation.changed) {
             following.delete(workspace);
+            followed.delete(workspace);
             stopped.add(workspace);
           }
         } catch (error) {
@@ -15299,7 +15457,7 @@ var NomosRuntimeComponent = (() => {
         wasResident: this.kernel.isResident(binding.workspace) !== false
       };
       this.#links.set(binding.workspace, link);
-      if (link.wasResident) this.#open(link);
+      if (!link.publisher || link.wasResident) this.#open(link);
     }
     changed(workspace) {
       const link = this.#links.get(workspace);
@@ -15326,6 +15484,9 @@ var NomosRuntimeComponent = (() => {
       this.#effect(link, { case: "send", value: bytes });
     }
     export(binding, base, requestId) {
+      if (this.kernel.isResident(binding.workspace) === false) {
+        return create(CustodyOfferBatchRequestSchema, { protocolVersion: 2 });
+      }
       const mount = workspaceMount(binding.workspace);
       const head = this.kernel.head(mount, requestId);
       if (!base || !head || base === head) return create(CustodyOfferBatchRequestSchema, { protocolVersion: 2 });
@@ -15386,6 +15547,7 @@ var NomosRuntimeComponent = (() => {
       }
       if (frame.message.case === "frontier") {
         this.#announced(link, frame.message.value.head);
+        if (this.kernel.isResident(link.binding.workspace) === false) return;
         if (!frame.message.value.response) {
           this.#send(link, { case: "frontier", value: {
             head: this.kernel.head(workspaceMount(link.binding.workspace), ++this.#requestId) ?? "",
@@ -15402,6 +15564,10 @@ var NomosRuntimeComponent = (() => {
       if (frame.message.case !== "offers") return;
       const batch = frame.message.value;
       if (batch.protocolVersion !== 2 || !batch.requestId || batch.source.case !== "inline" || !batch.source.value.offers.length) return;
+      if (this.kernel.isResident(link.binding.workspace) === false) {
+        this.remoteAdvanced?.(link.binding.workspace);
+        return;
+      }
       if ([...this.#pending.values()].some((pending) => pending.link === link && pending.bytes.length === bytes.length && pending.bytes.every((byte, index) => byte === bytes[index]))) return;
       if (this.#pending.size >= 32) return;
       this.#pending.set(request.requestId, { link, bytes });
@@ -15409,7 +15575,16 @@ var NomosRuntimeComponent = (() => {
         protocolVersion: 2,
         requestId: request.requestId,
         target: { workspace: link.binding.workspace, session: link.binding.replicaId },
-        command: { case: "admitCustodyOffers", value: create(CustodyOfferBatchRequestSchema, { ...batch, baseHead: void 0 }) }
+        // HTTP sender reconciliation controls are not part of a live proposal.
+        // Keeping fastForwardOnly while removing baseHead silently skips every
+        // offer against a nonempty local head. The Kernel judges sealed causality;
+        // live receivers neither ask for a return archive nor confirm the sender.
+        command: { case: "admitCustodyOffers", value: create(CustodyOfferBatchRequestSchema, {
+          ...batch,
+          baseHead: void 0,
+          observedHead: void 0,
+          fastForwardOnly: false
+        }) }
       });
     }
     /** Upstream news is a frontier this replica has NEVER seen: neither its own head nor the
@@ -15418,6 +15593,10 @@ var NomosRuntimeComponent = (() => {
     #announced(link, head) {
       if (!head || link.lastAnnounced === head) return;
       link.lastAnnounced = head;
+      if (this.kernel.isResident(link.binding.workspace) === false) {
+        this.remoteAdvanced?.(link.binding.workspace);
+        return;
+      }
       const mount = workspaceMount(link.binding.workspace);
       if (head === this.kernel.head(mount, ++this.#requestId) || head === this.kernel.resolveRef(mount, ++this.#requestId, "refs/remotes/nomos/main")) return;
       this.remoteAdvanced?.(link.binding.workspace);
@@ -15427,6 +15606,10 @@ var NomosRuntimeComponent = (() => {
     #placementAnnounced(link, frontier) {
       if (!frontier || link.lastPlacementAnnounced === frontier) return;
       link.lastPlacementAnnounced = frontier;
+      if (this.kernel.isResident(link.binding.workspace) === false) {
+        this.placementAdvanced?.(link.binding.workspace);
+        return;
+      }
       const mount = workspaceMount(link.binding.workspace);
       if (frontier === this.kernel.resolveRef(mount, ++this.#requestId, PLACEMENT_REF2)) return;
       this.placementAdvanced?.(link.binding.workspace);
@@ -15443,11 +15626,13 @@ var NomosRuntimeComponent = (() => {
     disconnect(workspace) {
       const link = this.#links.get(workspace);
       if (!link) return;
+      if (link.state === "open") this.linkClosed?.(workspace);
       this.#effect(link, { case: "close", value: true });
       this.#links.delete(workspace);
       for (const [id, pending] of this.#pending) if (pending.link === link) this.#pending.delete(id);
     }
     #hello(link) {
+      if (this.kernel.isResident(link.binding.workspace) === false) return;
       const head = this.kernel.head(workspaceMount(link.binding.workspace), ++this.#requestId);
       this.#send(link, { case: "frontier", value: { head: head ?? "" } });
     }
@@ -15455,19 +15640,20 @@ var NomosRuntimeComponent = (() => {
       const now = this.clock.monotonicNanoseconds();
       let wake;
       for (const link of this.#links.values()) {
-        if (this.kernel.isResident(link.binding.workspace) === false) {
+        const resident = this.kernel.isResident(link.binding.workspace) !== false;
+        if (link.publisher && !resident) {
           if (link.wasResident) this.disconnect(link.binding.workspace);
           else wake = wake === void 0 || wake > 250n ? 250n : wake;
           continue;
         }
-        link.wasResident = true;
+        if (resident) link.wasResident = true;
         if (link.state === "opening" && now >= link.due) {
           this.#effect(link, { case: "close", value: true });
           link.state = "closed";
         }
         if (link.state === "closed" && now >= link.due) this.#open(link);
         if (link.state === "open") {
-          if (link.dirty) {
+          if (link.dirty && resident) {
             link.dirty = false;
             try {
               link.published ??= link.publisher ? this.kernel.head(workspaceMount(link.binding.workspace), ++this.#requestId) : this.kernel.resolveRef(workspaceMount(link.binding.workspace), ++this.#requestId, "refs/remotes/nomos/main");
@@ -15486,8 +15672,7 @@ var NomosRuntimeComponent = (() => {
       return wake;
     }
     close() {
-      for (const link of this.#links.values()) this.#effect(link, { case: "close", value: true });
-      this.#links.clear();
+      for (const workspace of [...this.#links.keys()]) this.disconnect(workspace);
       this.#pending.clear();
     }
   };
@@ -15616,9 +15801,9 @@ var NomosRuntimeComponent = (() => {
         command.namespace === void 0 ? {} : { "custody.children_namespace": command.namespace },
         () => this.#kernel.childWorkspaces(mount, request.requestId)
       );
-      const namespace = command.namespace;
-      const selected = namespace === void 0 ? result.children : result.children.filter(
-        (child) => child.status === ChildWorkspaceLifecycleStatus.ACTIVE && isKeyedBirthOf(namespace, child.workspace)
+      const namespace2 = command.namespace;
+      const selected = namespace2 === void 0 ? result.children : result.children.filter(
+        (child) => child.status === ChildWorkspaceLifecycleStatus.ACTIVE && isKeyedBirthOf(namespace2, child.workspace)
       );
       return create(ChildWorkspaceListSchema, {
         children: selected.map((child) => create(ChildWorkspaceSchema, {
@@ -15980,40 +16165,6 @@ var NomosRuntimeComponent = (() => {
     }
   };
 
-  // ../src/runtime/peer_desk_store.ts
-  var recordId = (namespace, key) => `${namespace.length}:${namespace}${key}`;
-  var copy2 = (record) => ({
-    ...record,
-    value: record.value.slice()
-  });
-  var MemoryPeerDeskStore = class {
-    #records = /* @__PURE__ */ new Map();
-    list(namespace) {
-      return [...this.#records.values()].filter((record) => record.namespace === namespace).sort((left, right) => left.key.localeCompare(right.key)).map(copy2);
-    }
-    compareExchange(namespace, key, expectedRevision, value) {
-      const id = recordId(namespace, key);
-      const current = this.#records.get(id);
-      if (current?.revision !== expectedRevision) {
-        throw new Error(
-          `peer desk record '${namespace}/${key}' changed at revision ${current?.revision ?? "absent"}`
-        );
-      }
-      if (value === void 0) {
-        this.#records.delete(id);
-        return void 0;
-      }
-      const next = Object.freeze({
-        namespace,
-        key,
-        revision: (current?.revision ?? 0n) + 1n,
-        value: value.slice()
-      });
-      this.#records.set(id, next);
-      return copy2(next);
-    }
-  };
-
   // ../src/runtime/correspondence_recovery.ts
   var CorrespondenceRecoveryWork = class {
     workId;
@@ -16392,6 +16543,7 @@ var NomosRuntimeComponent = (() => {
     #offerSequence = 0;
     #lastStep;
     #probeOnly;
+    #liveConnected;
     /** Set when this round adopted the upstream's own head as its base (see #establishBase). */
     #establishedBase;
     #receiveState;
@@ -16424,6 +16576,7 @@ var NomosRuntimeComponent = (() => {
       this.#directoryAnswered = args.directoryAnswered;
       this.#placementFetched = args.placementFetched;
       this.#probeOnly = args.probeOnly ?? false;
+      this.#liveConnected = args.liveConnected === true;
       this.#receiveState = args.receiveState;
       this.#completeHistory = args.completeHistory === true;
       this.#repairMissingCommit = args.repairMissingCommit === true;
@@ -16494,6 +16647,9 @@ var NomosRuntimeComponent = (() => {
     #openRound() {
       if (this.#receiveState || this.#replaceLocalHead !== void 0) return this.#leaseEffect();
       if (!this.#localHead) return this.#leaseEffect();
+      if (this.#liveConnected && !this.#probeOnly && this.#holdsLocalWork() && this.#previousHead) {
+        return this.#offerOrReconcile();
+      }
       const requestId = `${this.#binding.replicaId}:${this.#requestId}:${this.workId}:frontier`;
       return this.#beginOffer(encodeInlineCustodyOffer({
         session: this.#binding.replicaId,
@@ -16725,6 +16881,18 @@ var NomosRuntimeComponent = (() => {
         return this.#finishOfferOutcome(false);
       }
       const admission = outcome.value;
+      globalThis.__nomosSyncDiagnostic?.("sync.admission", {
+        workspace: this.#mount.workspace,
+        phase: state.phase,
+        local: this.#localHead,
+        tracked: this.#previousHead,
+        remote: admission.main,
+        sealed: admission.sealedMain,
+        resultBase: admission.resultBase,
+        resultBytes: admission.resultPack.byteLength,
+        recoveryRequired: admission.recoveryRequired,
+        summary: summarizeCustodyAdmission(admission)
+      });
       this.#desiredHead = admission.main || void 0;
       if (!this.#desiredHead) return this.#transportFailure("resident peer returned no admitted frontier", false);
       this.#candidateDurable = admission.sealedMain === this.#desiredHead;
@@ -17341,6 +17509,19 @@ var NomosRuntimeComponent = (() => {
       return step;
     }
     #finish(value) {
+      globalThis.__nomosSyncDiagnostic?.("sync.finished", {
+        workspace: value.workspace,
+        previous: value.previousHead,
+        current: value.currentHead,
+        stillAhead: value.stillAhead,
+        deferred: String(value.deferred),
+        admitted: String(value.admitted),
+        reconnect: value.reconnectRequired,
+        directOfferDeferred: value.directOfferDeferred,
+        pushFailed: value.pushFailed,
+        failure: value.pushError?.message,
+        wallMs: elapsedMillis(this.#clock, this.#started)
+      });
       this.#state = { phase: WorkspaceSyncPhase.Done };
       this.#current = void 0;
       return this.#remember({ case: "synced", value });
@@ -17396,6 +17577,10 @@ var NomosRuntimeComponent = (() => {
         this.#plan = [this.#args.root];
         return this.#advance();
       }
+      if (this.#args.liveConnected && this.#args.kernel.resolveRef(this.#args.root.mount, this.#args.requestId, trackedMain2)) {
+        this.#plan = this.#planDependencies();
+        return this.#advance();
+      }
       this.#current = this.#work(this.#args.root, `${this.workId}:frontier`, true);
       return this.#accept(this.#current.start());
     }
@@ -18581,6 +18766,7 @@ var NomosRuntimeComponent = (() => {
     #onSyncCompleted;
     #onPlacementFetched;
     #onShallowMount;
+    #onOutboxHistoryRequired;
     #remoteOffers = new CorrespondenceWorkRegistry();
     #recoveries = new CorrespondenceWorkRegistry();
     #deliveries = new CorrespondenceWorkRegistry();
@@ -18627,6 +18813,7 @@ var NomosRuntimeComponent = (() => {
       this.#onSyncCompleted = args.onSyncCompleted;
       this.#onPlacementFetched = args.onPlacementFetched;
       this.#onShallowMount = args.onShallowMount;
+      this.#onOutboxHistoryRequired = args.onOutboxHistoryRequired;
       this.#clock = args.clock;
       this.#outboxClock = new OutboxObservationClock(args.clock, args.peerIdentity);
       this.#executesCustodianObligations = args.executesCustodianObligations ?? false;
@@ -18790,6 +18977,15 @@ var NomosRuntimeComponent = (() => {
       this.#followLane.dependencyAdvanced(workspace);
       this.reportFollows();
     }
+    /** Received custody can release correspondence and foreign-read dependencies,
+     * but is not newly authored work to send back to its upstream. Recovery is
+     * driven separately by missing history, reconnects and provider announcements.
+     * In particular an optimistic relay is not a durable upstream receipt. */
+    receivedFrontierChanged(workspace) {
+      this.wakeOutbox(workspace);
+      this.#followLane.dependencyAdvanced(workspace);
+      this.reportFollows();
+    }
     /**
      * Tell a workspace's sessions what its durable follow ALREADY knows.
      *
@@ -19026,8 +19222,16 @@ var NomosRuntimeComponent = (() => {
           )
         );
       } catch (error) {
+        if (error instanceof KernelHistoryRequired && this.#onOutboxHistoryRequired) {
+          const retry = this.#onOutboxHistoryRequired(workspace, binding.credentialCapability);
+          this.#outboxDueAt.set(workspace, now + Math.max(250, retry));
+          return { nextAfterMillis: 0 };
+        }
         const format = localCopyFormatRefusal(error);
-        if (format === void 0) throw error;
+        if (format === void 0) {
+          this.#outboxDueAt.set(workspace, now + 3e4);
+          return { nextAfterMillis: 0 };
+        }
         this.#readability.mark(workspace, void 0, format);
         this.#outboxDueAt.delete(workspace);
         return { nextAfterMillis: 0 };
@@ -19307,6 +19511,7 @@ var NomosRuntimeComponent = (() => {
           requestId: request.requestId,
           workId: id,
           probeOnly,
+          liveConnected: this.#openLinks.has(target3.mount.workspace),
           ...beforeConverge === void 0 ? {} : { beforeConverge },
           ...target3.receiveState === void 0 ? {} : { receiveState: target3.receiveState },
           ...target3.offerHead === void 0 ? {} : { offerHead: target3.offerHead },
@@ -19334,6 +19539,7 @@ var NomosRuntimeComponent = (() => {
           root,
           work,
           outbound: command.admit,
+          liveConnected: this.#openLinks.has(mount.workspace),
           dependency: (workspace, source, acquire2 = false) => {
             if (this.#roundInFlight(workspace, workId2)) return void 0;
             const existing = this.#follows.bindingForWorkspace(workspace);
@@ -20855,15 +21061,15 @@ var NomosRuntimeComponent = (() => {
   var HISTORY_ACQUISITION_NAMESPACE = "nomos.peer-desk.history-acquisition/v1";
   var HISTORY_BACKGROUND_START_MILLIS = 1e4;
   var SLICE_ANSWER_MILLIS = 5 * 6e4;
-  var encoder3 = new TextEncoder();
-  var decoder3 = new TextDecoder();
+  var encoder4 = new TextEncoder();
+  var decoder4 = new TextDecoder();
   var workId = (workspace) => `history-acquisition:${workspace}`;
   var effectId = (workspace, attempt) => `history-acquisition:${workspace}:${HistoryAcquisitionPhase.Acquiring}:${attempt}`;
   var encode2 = (work) => {
     if (!work.credentialCapability) {
       throw new Error(`history acquisition for '${work.workspace}' has not restored its credential capability`);
     }
-    return encoder3.encode(JSON.stringify({
+    return encoder4.encode(JSON.stringify({
       version: 2,
       workspace: work.workspace,
       credentialCapability: work.credentialCapability,
@@ -20872,7 +21078,7 @@ var NomosRuntimeComponent = (() => {
   };
   var upgraded = (state) => state.case === "backoff" ? { case: HistoryAcquisitionPhase.Paced, attempt: state.attempt, delayMillis: state.delayMillis, failed: true } : state;
   var decode2 = (record) => {
-    const value = JSON.parse(decoder3.decode(record.value));
+    const value = JSON.parse(decoder4.decode(record.value));
     if (!value || typeof value !== "object") throw corrupt2(record, "not an object");
     const candidate = value;
     if (candidate.version !== 1 && candidate.version !== 2 || candidate.workspace !== record.key || !candidate.state) {
@@ -20935,6 +21141,21 @@ var NomosRuntimeComponent = (() => {
       this.#ensure(workspace, credentialCapability);
       this.#dueAt.set(workspace, this.#now() + HISTORY_BACKGROUND_START_MILLIS);
     }
+    /** A background kernel read needs an omitted ancestor now. Queue one bounded
+     * slice on the existing history lane; a failed slice keeps its retry pace. */
+    requestFromBackground(workspace, credentialCapability) {
+      if (!workspace) throw new Error("kernel history requirement names no workspace");
+      this.#ensure(workspace, credentialCapability);
+      const work = this.#get(workspace);
+      const now = this.#now();
+      if (work.state.case === HistoryAcquisitionPhase.Paced && work.state.failed) {
+        const due2 = this.#dueAt.get(workspace) ?? now + work.state.delayMillis;
+        this.#dueAt.set(workspace, due2);
+        if (due2 > now) return due2 - now;
+      }
+      this.#dueAt.set(workspace, now);
+      return 250;
+    }
     /** An operation needs history this custody lacks: its next slice now, joining one in flight. */
     begin(workspace, credentialCapability) {
       if (!workspace) throw new Error("kernel history requirement names no workspace");
@@ -21243,7 +21464,7 @@ var NomosRuntimeComponent = (() => {
         this.#trace,
         this.#readability
       );
-      this.#custodyAdmission = new CustodyAdmissionDesk(this.#kernel, this.#custody);
+      this.#custodyAdmission = new CustodyAdmissionDesk(this.#kernel, this.#custody, new CustodyReceipts(seatedStore));
       this.#queries = new KernelQueries(this.#kernel, this.#credentials);
       this.#follows = new ReplicaFollowController(
         new ReplicaFollowDesk(seatedStore),
@@ -21405,6 +21626,7 @@ var NomosRuntimeComponent = (() => {
         // Lazy history: a head-only mount materialises its history in the background, never on
         // the path of an operation (architecture/lazy_history.md).
         onShallowMount: (workspace, credentialCapability) => this.#historyAcquisition.materialise(workspace, credentialCapability),
+        onOutboxHistoryRequired: (workspace, credentialCapability) => this.#historyAcquisition.requestFromBackground(workspace, credentialCapability),
         onSyncCompleted: (session, event) => {
           if (event.result?.workspace) {
             this.#replicaInventory.placementMayHaveChanged(event.result.workspace);
@@ -21871,8 +22093,8 @@ var NomosRuntimeComponent = (() => {
         this.#replicaInventory.placementMayHaveChanged(workspace);
       }
     }
-    /** Execute a typed paper after the access desk; never skip lifecycle or
-     * session-binding checks merely because its caller is another local desk. */
+    /** Execute a typed paper after the access desk. Custody admission addresses a
+     * workspace by replica identity; application calls retain session binding. */
     #dispatchRequest(request) {
       validateRuntimeV2Request(request);
       try {
@@ -21886,18 +22108,20 @@ var NomosRuntimeComponent = (() => {
           if (!request.target.workspace || !request.target.session) {
             throw new Error("addressed runtime request requires workspace and session");
           }
-          const binding = this.#sessions.bindingIfPresent(request.target.session);
-          if (binding !== void 0) {
-            if (binding.workspace !== request.target.workspace) {
-              throw new Error(
-                `session '${request.target.session}' is bound to workspace '${binding.workspace}', not '${request.target.workspace}'`
-              );
+          if (request.command.case !== "admitCustodyOffers") {
+            const binding = this.#sessions.bindingIfPresent(request.target.session);
+            if (binding !== void 0) {
+              if (binding.workspace !== request.target.workspace) {
+                throw new Error(
+                  `session '${request.target.session}' is bound to workspace '${binding.workspace}', not '${request.target.workspace}'`
+                );
+              }
+            } else {
+              this.#bindInteraction(create(BindSessionRequestSchema, {
+                session: request.target.session,
+                workspace: request.target.workspace
+              }));
             }
-          } else {
-            this.#bindInteraction(create(BindSessionRequestSchema, {
-              session: request.target.session,
-              workspace: request.target.workspace
-            }));
           }
         }
         switch (request.command.case) {
@@ -22094,7 +22318,7 @@ var NomosRuntimeComponent = (() => {
                   ReadMaintenanceCause.ADMITTED_OFFER
                 );
                 this.#subscriptions.refreshWorkspace(request.target.workspace);
-                this.#correspondence.workspaceFrontierChanged(request.target.workspace);
+                this.#correspondence.receivedFrontierChanged(request.target.workspace);
               }
               return this.#birthCustodyResponse(
                 request,