@githolon/runtime 0.115.0 → 0.116.4

package/dist/nomos-runner.js

@@ -7879,8 +7879,10 @@
   var SignOfferPreparationRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 37);
   var SigningIdentityRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 39);
   var KernelRefusalSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 55);
+  var QueryResponseSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 56);
   var ApplicationResultDeltaSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 58);
   var InterfaceCompatibilityQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 60);
+  var ReadIndexPendingSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 64);
   var MaintenanceQuantumQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 65);
   var CarriedWorkspaceOfferSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 80);
   var PrepareOutboundOfferSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 84);
@@ -8158,32 +8160,44 @@
   // ../../platform-shells/browser/runtime_fetch.ts
   init_define_NOMOS_KERNEL_RELEASE();
   init_shims();
-  function browserRuntimeFetch(base, fetchImpl, caches, repositoryUrl) {
+
+  // ../../platform-shells/shared/retained_boot_fetch.ts
+  init_define_NOMOS_KERNEL_RELEASE();
+  init_shims();
+  function retainedBootFetch(base, fetchImpl, store, repositoryUrl) {
     const root = base.replace(/\/+$/, "");
     return async (input, init) => {
       const url = String(input);
       const bootArtifact = url === (repositoryUrl ?? `${root}/v1/runtime/repository.xml`) || url === `${root}/v1/runtime/nomos.law.usdz`;
       if (!bootArtifact) return fetchImpl(input, init);
-      const networkInit = {
-        ...init,
-        cache: "no-store",
-        signal: init?.signal ?? AbortSignal.timeout(15e3)
-      };
-      if (!caches) return fetchImpl(input, networkInit);
-      const cache = await caches.open("nomos-browser-boot-v1");
+      const networkInit = { ...init, cache: "no-store", signal: init?.signal ?? AbortSignal.timeout(15e3) };
+      if (!store) return fetchImpl(input, networkInit);
       let response;
+      let failure;
       try {
         response = await fetchImpl(input, networkInit);
       } catch (error) {
-        const retained = await cache.match(url);
-        if (retained) return retained;
-        throw error;
+        failure = error;
       }
-      if (response.ok) await cache.put(url, response.clone());
-      return response;
+      if (response !== void 0 && response.status < 500) {
+        if (response.ok) await store.put(url, response.clone());
+        return response;
+      }
+      const retained = await store.match(url);
+      if (retained) return retained;
+      if (response !== void 0) return response;
+      throw failure;
     };
   }
 
+  // ../../platform-shells/browser/runtime_fetch.ts
+  function browserRuntimeFetch(base, fetchImpl, caches, repositoryUrl) {
+    return retainedBootFetch(base, fetchImpl, caches === void 0 ? void 0 : {
+      match: async (url) => (await caches.open("nomos-browser-boot-v1")).match(url),
+      put: async (url, response) => (await caches.open("nomos-browser-boot-v1")).put(url, response)
+    }, repositoryUrl);
+  }
+
   // ../../adapter/proto/nomos/runtime/v2/runtime_pb.js
   init_define_NOMOS_KERNEL_RELEASE();
   init_shims();
@@ -8324,7 +8338,7 @@
   var CustodyBreakPolicy = /* @__PURE__ */ tsEnum(CustodyBreakPolicySchema);
 
   // ../../adapter/proto/nomos/runtime/v2/observability_desk_pb.js
-  var file_nomos_runtime_v2_observability_desk = /* @__PURE__ */ fileDesc("Cilub21vcy9ydW50aW1lL3YyL29ic2VydmFiaWxpdHlfZGVzay5wcm90bxIQbm9tb3MucnVudGltZS52MiJCCgxUcmFjZUNvbnRleHQSEAoIdHJhY2VfaWQYASABKAwSDwoHc3Bhbl9pZBgCIAEoDBIPCgdzYW1wbGVkGAMgASgIIp0CCg5SdW50aW1lRmFpbHVyZRIMCgRjb2RlGAEgASgJEg8KB21lc3NhZ2UYAiABKAkSEQoJY29tcG9uZW50GAMgASgJEhYKCXdvcmtzcGFjZRgEIAEoCUgAiAEBEhMKBmRvbWFpbhgFIAEoCUgBiAEBEhYKCWRpcmVjdGl2ZRgGIAEoCUgCiAEBEjkKCmF0dHJpYnV0ZXMYByADKAsyJS5ub21vcy5ydW50aW1lLnYyLkRpYWdub3N0aWNBdHRyaWJ1dGUSMgoEa2luZBgIIAEoDjIkLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZUZhaWx1cmVLaW5kQgwKCl93b3Jrc3BhY2VCCQoHX2RvbWFpbkIMCgpfZGlyZWN0aXZlIr4BChJSdW50aW1lVW5hdmFpbGFibGUSOgoGcmVhc29uGAEgASgOMioubm9tb3MucnVudGltZS52Mi5SdW50aW1lVW5hdmFpbGFibGVSZWFzb24SEQoJd29ya3NwYWNlGAIgASgJEhEKCXJldHJ5YWJsZRgDIAEoCBIfChJyZXRyeV9hZnRlcl9taWxsaXMYBCABKA1IAIgBARIOCgZkZXRhaWwYBSABKAlCFQoTX3JldHJ5X2FmdGVyX21pbGxpcyJ+Cg5SdW50aW1lUmVmdXNhbBI2CgZyZWFzb24YASABKA4yJi5ub21vcy5ydW50aW1lLnYyLlJ1bnRpbWVSZWZ1c2FsUmVhc29uEhEKCXdvcmtzcGFjZRgCIAEoCRIRCglyZXRyeWFibGUYAyABKAgSDgoGZGV0YWlsGAQgASgJIqUBChNEaWFnbm9zdGljQXR0cmlidXRlEgwKBG5hbWUYASABKAkSFgoMc3RyaW5nX3ZhbHVlGAIgASgJSAASFwoNaW50ZWdlcl92YWx1ZRgDIAEoEkgAEhYKDGRvdWJsZV92YWx1ZRgEIAEoAUgAEhcKDWJvb2xlYW5fdmFsdWUYBSABKAhIABIVCgtieXRlc192YWx1ZRgGIAEoDEgAQgcKBXZhbHVlIvALCgxSdW50aW1lRXZlbnQSEAoIc2VxdWVuY2UYASABKAQSFAoHc2Vzc2lvbhgCIAEoCUgBiAEBEi8KBXJlYWR5GAogASgLMh4ubm9tb3MucnVudGltZS52Mi5SdW50aW1lUmVhZHlIABI3Cg13YXRjaF9jaGFuZ2VkGAsgASgLMh4ubm9tb3MucnVudGltZS52Mi5XYXRjaENoYW5nZWRIABI5Cg5zeW5jX2NvbXBsZXRlZBgMIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU3luY0NvbXBsZXRlZEgAEjUKDGxpbmtfY2hhbmdlZBgNIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuTGlua0NoYW5nZWRIABI5Cg5zaWduYWxfY2hhbmdlZBgOIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU2lnbmFsQ2hhbmdlZEgAEjsKD2N1c3RvZHlfY2hhbmdlZBgPIAEoCzIgLm5vbW9zLnJ1bnRpbWUudjIuQ3VzdG9keUNoYW5nZWRIABJCChNsb2NhbF93b3JrX3JlamVjdGVkGBAgASgLMiMubm9tb3MucnVudGltZS52Mi5Mb2NhbFdvcmtSZWplY3RlZEgAEjMKC2xhd19jaGFuZ2VkGBEgASgLMhwubm9tb3MucnVudGltZS52Mi5MYXdDaGFuZ2VkSAASQwoPa2VybmVsX3Byb2dyZXNzGBIgASgLMigubm9tb3MucnVudGltZS52Mi5LZXJuZWxQcm9ncmVzc09ic2VydmVkSAASLQoEc3BhbhgTIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZVNwYW5IABI/ChF0cmFuc2Zlcl9wcm9ncmVzcxgUIAEoCzIiLm5vbW9zLnJ1bnRpbWUudjIuVHJhbnNmZXJQcm9ncmVzc0gAEkkKFG1haW50ZW5hbmNlX3Byb2dyZXNzGBUgASgLMikubm9tb3MucnVudGltZS52Mi5SZWFkTWFpbnRlbmFuY2VQcm9ncmVzc0gAEjsKDXNvY2tldF9lZmZlY3QYFiABKAsyIi5ub21vcy5ydW50aW1lLnYyLlBlZXJTb2NrZXRFZmZlY3RIABJUChxjcmVkZW50aWFsX3JlZnJlc2hfcmVxdWVzdGVkGBcgASgLMiwubm9tb3MucnVudGltZS52Mi5DcmVkZW50aWFsUmVmcmVzaFJlcXVlc3RlZEgAElIKG3JlY2VpdmluZ19ncm91cF9jb252ZXJnZW5jZRgYIAEoCzIrLm5vbW9zLnJ1bnRpbWUudjIuUmVjZWl2aW5nR3JvdXBDb252ZXJnZW5jZUgAEkoKF21vZGVsX2Fkb3B0aW9uX3Byb2dyZXNzGBkgASgLMicubm9tb3MucnVudGltZS52Mi5Nb2RlbEFkb3B0aW9uUHJvZ3Jlc3NIABI7Cg9mb2xsb3dzX3N1bW1hcnkYGiABKAsyIC5ub21vcy5ydW50aW1lLnYyLkZvbGxvd3NTdW1tYXJ5SAASRAoUbG9jYWxfY29weV9wcmVzZXJ2ZWQYGyABKAsyJC5ub21vcy5ydW50aW1lLnYyLlByZXNlcnZlZExvY2FsQ29weUgAEk4KGWZvcmVpZ25fcGxhY2VtZW50X2lnbm9yZWQYHCABKAsyKS5ub21vcy5ydW50aW1lLnYyLkZvcmVpZ25QbGFjZW1lbnRJZ25vcmVkSAASQwoTYmluZGluZ19xdWFyYW50aW5lZBgdIAEoCzIkLm5vbW9zLnJ1bnRpbWUudjIuUXVhcmFudGluZWRCaW5kaW5nSAASPwoRd3JpdGVfcHJlcGFyYXRpb24YHiABKAsyIi5ub21vcy5ydW50aW1lLnYyLldyaXRlUHJlcGFyYXRpb25IABJKChdyZWFkX2FjY2Vzc19wcmVwYXJhdGlvbhgfIAEoCzInLm5vbW9zLnJ1bnRpbWUudjIuUmVhZEFjY2Vzc1ByZXBhcmF0aW9uSABCBwoFZXZlbnRCCgoIX3Nlc3Npb24ivAEKDkZvbGxvd3NTdW1tYXJ5EhAKCGZvbGxvd2VkGAEgASgNEg8KB3NldHRsZWQYAiABKA0SDAoEbGl2ZRgDIAEoDRI3Cgp3b3Jrc3BhY2VzGAQgAygLMiMubm9tb3MucnVudGltZS52Mi5Gb2xsb3dPYnNlcnZhdGlvbhIkChdvYnNlcnZlZF9hdF91bml4X21pbGxpcxgFIAEoBEgAiAEBQhoKGF9vYnNlcnZlZF9hdF91bml4X21pbGxpcyL7AwoRRm9sbG93T2JzZXJ2YXRpb24SEQoJd29ya3NwYWNlGAEgASgJEjcKBXBoYXNlGAIgASgOMigubm9tb3MucnVudGltZS52Mi5Gb2xsb3dPYnNlcnZhdGlvblBoYXNlEgwKBGxpdmUYAyABKAgSEwoGZGV0YWlsGAQgASgJSACIAQESIQoUcmV0cnlfYXRfdW5peF9taWxsaXMYBSABKARIAYgBARIfChJkdWVfYXRfdW5peF9taWxsaXMYBiABKARIAogBARIUCgdhdHRlbXB0GAcgASgNSAOIAQESGgoNYWN0aXZlX2VmZmVjdBgIIAEoCUgEiAEBEhMKBnVuc2VudBgJIAEoDUgFiAEBEhsKDnVuYWNrbm93bGVkZ2VkGAogASgNSAaIAQESQgoRY3VzdG9kaWFuX3dhcm1pbmcYCyABKAsyIi5ub21vcy5ydW50aW1lLnYyLkN1c3RvZGlhbldhcm1pbmdIB4gBAUIJCgdfZGV0YWlsQhcKFV9yZXRyeV9hdF91bml4X21pbGxpc0IVChNfZHVlX2F0X3VuaXhfbWlsbGlzQgoKCF9hdHRlbXB0QhAKDl9hY3RpdmVfZWZmZWN0QgkKB191bnNlbnRCEQoPX3VuYWNrbm93bGVkZ2VkQhQKEl9jdXN0b2RpYW5fd2FybWluZyKFAQoQQ3VzdG9kaWFuV2FybWluZxIZChFzaW5jZV91bml4X21pbGxpcxgBIAEoBBIiChpleHBlY3RlZF9yZWFkeV91bml4X21pbGxpcxgCIAEoBBIhChlzdGFsbGVkX2FmdGVyX3VuaXhfbWlsbGlzGAMgASgEEg8KB3N0YWxsZWQYBCABKAgiVgoaQ3JlZGVudGlhbFJlZnJlc2hSZXF1ZXN0ZWQSOAoHcGVuZGluZxgBIAEoCzInLm5vbW9zLnJ1bnRpbWUudjIuQ29ycmVzcG9uZGVuY2VQZW5kaW5nIj4KDFJ1bnRpbWVSZWFkeRIXCg9ydW50aW1lX3ZlcnNpb24YASABKAkSFQoNa2VybmVsX3NoYTI1NhgCIAEoDCKNAwoMV2F0Y2hDaGFuZ2VkEhcKD3N1YnNjcmlwdGlvbl9pZBgBIAEoCRITCgtyZXN1bHRfdXNkYRgCIAEoDBI2CgdmYWlsdXJlGAMgASgLMiAubm9tb3MucnVudGltZS52Mi5SdW50aW1lRmFpbHVyZUgAiAEBEjUKEmFwcGxpY2F0aW9uX3Jlc3VsdBgEIAEoCzIULmdvb2dsZS5wcm90b2J1Zi5BbnlIAYgBARIaCg1pbnRlZ2VyX3ZhbHVlGAUgASgDSAKIAQESRwoRYXBwbGljYXRpb25fZGVsdGEYBiABKAsyJy5ub21vcy5rZXJuZWwudjEuQXBwbGljYXRpb25SZXN1bHREZWx0YUgDiAEBEhwKD3Jlc3VsdF9mcm9udGllchgHIAEoCUgEiAEBQgoKCF9mYWlsdXJlQhUKE19hcHBsaWNhdGlvbl9yZXN1bHRCEAoOX2ludGVnZXJfdmFsdWVCFAoSX2FwcGxpY2F0aW9uX2RlbHRhQhIKEF9yZXN1bHRfZnJvbnRpZXIinAEKDVN5bmNDb21wbGV0ZWQSDgoGcmVhc29uGAEgASgJEjcKBnJlc3VsdBgCIAEoCzInLm5vbW9zLnJ1bnRpbWUudjIuU3luY1dvcmtzcGFjZVJlc3BvbnNlEjYKB2ZhaWx1cmUYAyABKAsyIC5ub21vcy5ydW50aW1lLnYyLlJ1bnRpbWVGYWlsdXJlSACIAQFCCgoIX2ZhaWx1cmUigAEKC0xpbmtDaGFuZ2VkEiwKBnN0YXR1cxgBIAEoDjIcLm5vbW9zLnJ1bnRpbWUudjIuTGlua1N0YXR1cxI3CgdjbG9zdXJlGAIgASgLMiEubm9tb3MucnVudGltZS52Mi5MaXZlTGlua0Nsb3N1cmVIAIgBAUIKCghfY2xvc3VyZSI4Cg1TaWduYWxDaGFuZ2VkEg4KBmRvbWFpbhgBIAEoCRIXCg9wcm9qZWN0aW9uX3VzZGEYAiABKAwiUAoKTGF3Q2hhbmdlZBIOCgZkb21haW4YASABKAkSFgoOcGFja2FnZV9zaGEyNTYYAiABKAkSGgoSY29tcGF0aWJpbGl0eV91c2RhGAMgASgMIt0BCgtSdW50aW1lU3BhbhIQCgh0cmFjZV9pZBgBIAEoDBIPCgdzcGFuX2lkGAIgASgMEhsKDnBhcmVudF9zcGFuX2lkGAMgASgMSACIAQESDAoEbmFtZRgEIAEoCRIaChJzdGFydGVkX3VuaXhfbmFub3MYBSABKAQSFgoOZHVyYXRpb25fbmFub3MYBiABKAQSOQoKYXR0cmlidXRlcxgHIAMoCzIlLm5vbW9zLnJ1bnRpbWUudjIuRGlhZ25vc3RpY0F0dHJpYnV0ZUIRCg9fcGFyZW50X3NwYW5faWQi6gEKFktlcm5lbFByb2dyZXNzT2JzZXJ2ZWQSOQoIc25hcHNob3QYASABKAsyJy5ub21vcy5rZXJuZWwudjEuS2VybmVsUHJvZ3Jlc3NTbmFwc2hvdBIkChxob3N0X29ic2VydmVkX2VsYXBzZWRfbWljcm9zGAIgASgEEioKImhvc3Rfb2JzZXJ2ZWRfcGhhc2VfZWxhcHNlZF9taWNyb3MYAyABKAQSHgoWcHJvY2Vzc19yZXNpZGVudF9ieXRlcxgEIAEoBBIjChtwcm9jZXNzX3BlYWtfcmVzaWRlbnRfYnl0ZXMYBSABKAQiggEKEFRyYW5zZmVyUHJvZ3Jlc3MSFgoOcmVjZWl2ZWRfYnl0ZXMYASABKAQSGAoLdG90YWxfYnl0ZXMYAiABKARIAIgBARIsCgRraW5kGAMgASgOMh4ubm9tb3MucnVudGltZS52Mi5UcmFuc2ZlcktpbmRCDgoMX3RvdGFsX2J5dGVzIjkKEFdyaXRlUHJlcGFyYXRpb24SEgoKcmVxdWVzdF9pZBgBIAEoCRIRCgl3b3Jrc3BhY2UYAiABKAkiPgoVUmVhZEFjY2Vzc1ByZXBhcmF0aW9uEhIKCnJlcXVlc3RfaWQYASABKAkSEQoJd29ya3NwYWNlGAIgASgJKsoBChJSdW50aW1lRmFpbHVyZUtpbmQSJAogUlVOVElNRV9GQUlMVVJFX0tJTkRfVU5TUEVDSUZJRUQQABIhCh1SVU5USU1FX0ZBSUxVUkVfS0lORF9JTlRFUk5BTBABEiEKHVJVTlRJTUVfRkFJTFVSRV9LSU5EX1BST1RPQ09MEAISIgoeUlVOVElNRV9GQUlMVVJFX0tJTkRfSU5URUdSSVRZEAMSJAogUlVOVElNRV9GQUlMVVJFX0tJTkRfVU5TVVBQT1JURUQQBCqnAwoYUnVudGltZVVuYXZhaWxhYmxlUmVhc29uEioKJlJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1VOU1BFQ0lGSUVEEAASMgouUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fUkVNT1RFX09OTFlfT0ZGTElORRABEjEKLVJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1JFTU9URV9VTlJFQUNIQUJMRRACEi0KKVJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1JFTU9URV9USU1FT1VUEAMSNgoyUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fTE9DQUxfUkVQTElDQV9OT1RfUkVBRFkQBBI1CjFSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9DUkVERU5USUFMX1VOQVZBSUxBQkxFEAUSMAosUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fV09SS1NQQUNFX09QRU5JTkcQBhIoCiRSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9QRUVSX0JVU1kQByrwAQoUUnVudGltZVJlZnVzYWxSZWFzb24SJgoiUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9VTlNQRUNJRklFRBAAEi0KKVJVTlRJTUVfUkVGVVNBTF9SRUFTT05fSU5WQUxJRF9DUkVERU5USUFMEAESKAokUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9BQ0NFU1NfREVOSUVEEAISKwonUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9QTEFDRU1FTlRfUE9MSUNZEAMSKgomUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9TRVNTSU9OX1VOQk9VTkQQBCqVBAoWRm9sbG93T2JzZXJ2YXRpb25QaGFzZRIoCiRGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfVU5TUEVDSUZJRUQQABIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfREVTSVJFRBABEiAKHEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9EVUUQAhIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfUlVOTklORxADEiQKIEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9TRVRUTEVEEAQSMAosRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0FXQUlUSU5HX0RFUEVOREVOQ1kQBRIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfT0ZGTElORRAGEi8KK0ZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9JTlZBTElEX0NSRURFTlRJQUwQBxIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfQkFDS09GRhAIEiwKKEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9SRUJPUk5fUkVNT1RFTFkQCRIsCihGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfUkVQTEFDSU5HX0xPQ0FMEAoSMgouRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0xPQ0FMX0NPUFlfVU5SRUFEQUJMRRALKlcKCkxpbmtTdGF0dXMSGwoXTElOS19TVEFUVVNfVU5TUEVDSUZJRUQQABIUChBMSU5LX1NUQVRVU19PUEVOEAESFgoSTElOS19TVEFUVVNfQ0xPU0VEEAIqdgoMVHJhbnNmZXJLaW5kEh0KGVRSQU5TRkVSX0tJTkRfVU5TUEVDSUZJRUQQABIXChNUUkFOU0ZFUl9LSU5EX0RFTFRBEAESFgoSVFJBTlNGRVJfS0lORF9GVUxMEAISFgoSVFJBTlNGRVJfS0lORF9QVVNIEANiBnByb3RvMw", [file_google_protobuf_any, file_nomos_kernel_v1_kernel, file_nomos_kernel_v1_progress, file_nomos_runtime_v2_correspondence_desk, file_nomos_runtime_v2_custody_desk, file_nomos_runtime_v2_placement_desk, file_nomos_runtime_v2_maintenance_desk, file_nomos_runtime_v2_model_adoption_desk, file_nomos_runtime_v2_receiving_group_desk, file_nomos_runtime_v2_recovery_desk]);
+  var file_nomos_runtime_v2_observability_desk = /* @__PURE__ */ fileDesc("Cilub21vcy9ydW50aW1lL3YyL29ic2VydmFiaWxpdHlfZGVzay5wcm90bxIQbm9tb3MucnVudGltZS52MiJCCgxUcmFjZUNvbnRleHQSEAoIdHJhY2VfaWQYASABKAwSDwoHc3Bhbl9pZBgCIAEoDBIPCgdzYW1wbGVkGAMgASgIIp0CCg5SdW50aW1lRmFpbHVyZRIMCgRjb2RlGAEgASgJEg8KB21lc3NhZ2UYAiABKAkSEQoJY29tcG9uZW50GAMgASgJEhYKCXdvcmtzcGFjZRgEIAEoCUgAiAEBEhMKBmRvbWFpbhgFIAEoCUgBiAEBEhYKCWRpcmVjdGl2ZRgGIAEoCUgCiAEBEjkKCmF0dHJpYnV0ZXMYByADKAsyJS5ub21vcy5ydW50aW1lLnYyLkRpYWdub3N0aWNBdHRyaWJ1dGUSMgoEa2luZBgIIAEoDjIkLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZUZhaWx1cmVLaW5kQgwKCl93b3Jrc3BhY2VCCQoHX2RvbWFpbkIMCgpfZGlyZWN0aXZlIr4BChJSdW50aW1lVW5hdmFpbGFibGUSOgoGcmVhc29uGAEgASgOMioubm9tb3MucnVudGltZS52Mi5SdW50aW1lVW5hdmFpbGFibGVSZWFzb24SEQoJd29ya3NwYWNlGAIgASgJEhEKCXJldHJ5YWJsZRgDIAEoCBIfChJyZXRyeV9hZnRlcl9taWxsaXMYBCABKA1IAIgBARIOCgZkZXRhaWwYBSABKAlCFQoTX3JldHJ5X2FmdGVyX21pbGxpcyJ+Cg5SdW50aW1lUmVmdXNhbBI2CgZyZWFzb24YASABKA4yJi5ub21vcy5ydW50aW1lLnYyLlJ1bnRpbWVSZWZ1c2FsUmVhc29uEhEKCXdvcmtzcGFjZRgCIAEoCRIRCglyZXRyeWFibGUYAyABKAgSDgoGZGV0YWlsGAQgASgJIqUBChNEaWFnbm9zdGljQXR0cmlidXRlEgwKBG5hbWUYASABKAkSFgoMc3RyaW5nX3ZhbHVlGAIgASgJSAASFwoNaW50ZWdlcl92YWx1ZRgDIAEoEkgAEhYKDGRvdWJsZV92YWx1ZRgEIAEoAUgAEhcKDWJvb2xlYW5fdmFsdWUYBSABKAhIABIVCgtieXRlc192YWx1ZRgGIAEoDEgAQgcKBXZhbHVlIvALCgxSdW50aW1lRXZlbnQSEAoIc2VxdWVuY2UYASABKAQSFAoHc2Vzc2lvbhgCIAEoCUgBiAEBEi8KBXJlYWR5GAogASgLMh4ubm9tb3MucnVudGltZS52Mi5SdW50aW1lUmVhZHlIABI3Cg13YXRjaF9jaGFuZ2VkGAsgASgLMh4ubm9tb3MucnVudGltZS52Mi5XYXRjaENoYW5nZWRIABI5Cg5zeW5jX2NvbXBsZXRlZBgMIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU3luY0NvbXBsZXRlZEgAEjUKDGxpbmtfY2hhbmdlZBgNIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuTGlua0NoYW5nZWRIABI5Cg5zaWduYWxfY2hhbmdlZBgOIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU2lnbmFsQ2hhbmdlZEgAEjsKD2N1c3RvZHlfY2hhbmdlZBgPIAEoCzIgLm5vbW9zLnJ1bnRpbWUudjIuQ3VzdG9keUNoYW5nZWRIABJCChNsb2NhbF93b3JrX3JlamVjdGVkGBAgASgLMiMubm9tb3MucnVudGltZS52Mi5Mb2NhbFdvcmtSZWplY3RlZEgAEjMKC2xhd19jaGFuZ2VkGBEgASgLMhwubm9tb3MucnVudGltZS52Mi5MYXdDaGFuZ2VkSAASQwoPa2VybmVsX3Byb2dyZXNzGBIgASgLMigubm9tb3MucnVudGltZS52Mi5LZXJuZWxQcm9ncmVzc09ic2VydmVkSAASLQoEc3BhbhgTIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZVNwYW5IABI/ChF0cmFuc2Zlcl9wcm9ncmVzcxgUIAEoCzIiLm5vbW9zLnJ1bnRpbWUudjIuVHJhbnNmZXJQcm9ncmVzc0gAEkkKFG1haW50ZW5hbmNlX3Byb2dyZXNzGBUgASgLMikubm9tb3MucnVudGltZS52Mi5SZWFkTWFpbnRlbmFuY2VQcm9ncmVzc0gAEjsKDXNvY2tldF9lZmZlY3QYFiABKAsyIi5ub21vcy5ydW50aW1lLnYyLlBlZXJTb2NrZXRFZmZlY3RIABJUChxjcmVkZW50aWFsX3JlZnJlc2hfcmVxdWVzdGVkGBcgASgLMiwubm9tb3MucnVudGltZS52Mi5DcmVkZW50aWFsUmVmcmVzaFJlcXVlc3RlZEgAElIKG3JlY2VpdmluZ19ncm91cF9jb252ZXJnZW5jZRgYIAEoCzIrLm5vbW9zLnJ1bnRpbWUudjIuUmVjZWl2aW5nR3JvdXBDb252ZXJnZW5jZUgAEkoKF21vZGVsX2Fkb3B0aW9uX3Byb2dyZXNzGBkgASgLMicubm9tb3MucnVudGltZS52Mi5Nb2RlbEFkb3B0aW9uUHJvZ3Jlc3NIABI7Cg9mb2xsb3dzX3N1bW1hcnkYGiABKAsyIC5ub21vcy5ydW50aW1lLnYyLkZvbGxvd3NTdW1tYXJ5SAASRAoUbG9jYWxfY29weV9wcmVzZXJ2ZWQYGyABKAsyJC5ub21vcy5ydW50aW1lLnYyLlByZXNlcnZlZExvY2FsQ29weUgAEk4KGWZvcmVpZ25fcGxhY2VtZW50X2lnbm9yZWQYHCABKAsyKS5ub21vcy5ydW50aW1lLnYyLkZvcmVpZ25QbGFjZW1lbnRJZ25vcmVkSAASQwoTYmluZGluZ19xdWFyYW50aW5lZBgdIAEoCzIkLm5vbW9zLnJ1bnRpbWUudjIuUXVhcmFudGluZWRCaW5kaW5nSAASPwoRd3JpdGVfcHJlcGFyYXRpb24YHiABKAsyIi5ub21vcy5ydW50aW1lLnYyLldyaXRlUHJlcGFyYXRpb25IABJKChdyZWFkX2FjY2Vzc19wcmVwYXJhdGlvbhgfIAEoCzInLm5vbW9zLnJ1bnRpbWUudjIuUmVhZEFjY2Vzc1ByZXBhcmF0aW9uSABCBwoFZXZlbnRCCgoIX3Nlc3Npb24ivAEKDkZvbGxvd3NTdW1tYXJ5EhAKCGZvbGxvd2VkGAEgASgNEg8KB3NldHRsZWQYAiABKA0SDAoEbGl2ZRgDIAEoDRI3Cgp3b3Jrc3BhY2VzGAQgAygLMiMubm9tb3MucnVudGltZS52Mi5Gb2xsb3dPYnNlcnZhdGlvbhIkChdvYnNlcnZlZF9hdF91bml4X21pbGxpcxgFIAEoBEgAiAEBQhoKGF9vYnNlcnZlZF9hdF91bml4X21pbGxpcyL7AwoRRm9sbG93T2JzZXJ2YXRpb24SEQoJd29ya3NwYWNlGAEgASgJEjcKBXBoYXNlGAIgASgOMigubm9tb3MucnVudGltZS52Mi5Gb2xsb3dPYnNlcnZhdGlvblBoYXNlEgwKBGxpdmUYAyABKAgSEwoGZGV0YWlsGAQgASgJSACIAQESIQoUcmV0cnlfYXRfdW5peF9taWxsaXMYBSABKARIAYgBARIfChJkdWVfYXRfdW5peF9taWxsaXMYBiABKARIAogBARIUCgdhdHRlbXB0GAcgASgNSAOIAQESGgoNYWN0aXZlX2VmZmVjdBgIIAEoCUgEiAEBEhMKBnVuc2VudBgJIAEoDUgFiAEBEhsKDnVuYWNrbm93bGVkZ2VkGAogASgNSAaIAQESQgoRY3VzdG9kaWFuX3dhcm1pbmcYCyABKAsyIi5ub21vcy5ydW50aW1lLnYyLkN1c3RvZGlhbldhcm1pbmdIB4gBAUIJCgdfZGV0YWlsQhcKFV9yZXRyeV9hdF91bml4X21pbGxpc0IVChNfZHVlX2F0X3VuaXhfbWlsbGlzQgoKCF9hdHRlbXB0QhAKDl9hY3RpdmVfZWZmZWN0QgkKB191bnNlbnRCEQoPX3VuYWNrbm93bGVkZ2VkQhQKEl9jdXN0b2RpYW5fd2FybWluZyKFAQoQQ3VzdG9kaWFuV2FybWluZxIZChFzaW5jZV91bml4X21pbGxpcxgBIAEoBBIiChpleHBlY3RlZF9yZWFkeV91bml4X21pbGxpcxgCIAEoBBIhChlzdGFsbGVkX2FmdGVyX3VuaXhfbWlsbGlzGAMgASgEEg8KB3N0YWxsZWQYBCABKAgiVgoaQ3JlZGVudGlhbFJlZnJlc2hSZXF1ZXN0ZWQSOAoHcGVuZGluZxgBIAEoCzInLm5vbW9zLnJ1bnRpbWUudjIuQ29ycmVzcG9uZGVuY2VQZW5kaW5nIj4KDFJ1bnRpbWVSZWFkeRIXCg9ydW50aW1lX3ZlcnNpb24YASABKAkSFQoNa2VybmVsX3NoYTI1NhgCIAEoDCKNAwoMV2F0Y2hDaGFuZ2VkEhcKD3N1YnNjcmlwdGlvbl9pZBgBIAEoCRITCgtyZXN1bHRfdXNkYRgCIAEoDBI2CgdmYWlsdXJlGAMgASgLMiAubm9tb3MucnVudGltZS52Mi5SdW50aW1lRmFpbHVyZUgAiAEBEjUKEmFwcGxpY2F0aW9uX3Jlc3VsdBgEIAEoCzIULmdvb2dsZS5wcm90b2J1Zi5BbnlIAYgBARIaCg1pbnRlZ2VyX3ZhbHVlGAUgASgDSAKIAQESRwoRYXBwbGljYXRpb25fZGVsdGEYBiABKAsyJy5ub21vcy5rZXJuZWwudjEuQXBwbGljYXRpb25SZXN1bHREZWx0YUgDiAEBEhwKD3Jlc3VsdF9mcm9udGllchgHIAEoCUgEiAEBQgoKCF9mYWlsdXJlQhUKE19hcHBsaWNhdGlvbl9yZXN1bHRCEAoOX2ludGVnZXJfdmFsdWVCFAoSX2FwcGxpY2F0aW9uX2RlbHRhQhIKEF9yZXN1bHRfZnJvbnRpZXIinAEKDVN5bmNDb21wbGV0ZWQSDgoGcmVhc29uGAEgASgJEjcKBnJlc3VsdBgCIAEoCzInLm5vbW9zLnJ1bnRpbWUudjIuU3luY1dvcmtzcGFjZVJlc3BvbnNlEjYKB2ZhaWx1cmUYAyABKAsyIC5ub21vcy5ydW50aW1lLnYyLlJ1bnRpbWVGYWlsdXJlSACIAQFCCgoIX2ZhaWx1cmUigAEKC0xpbmtDaGFuZ2VkEiwKBnN0YXR1cxgBIAEoDjIcLm5vbW9zLnJ1bnRpbWUudjIuTGlua1N0YXR1cxI3CgdjbG9zdXJlGAIgASgLMiEubm9tb3MucnVudGltZS52Mi5MaXZlTGlua0Nsb3N1cmVIAIgBAUIKCghfY2xvc3VyZSI4Cg1TaWduYWxDaGFuZ2VkEg4KBmRvbWFpbhgBIAEoCRIXCg9wcm9qZWN0aW9uX3VzZGEYAiABKAwiUAoKTGF3Q2hhbmdlZBIOCgZkb21haW4YASABKAkSFgoOcGFja2FnZV9zaGEyNTYYAiABKAkSGgoSY29tcGF0aWJpbGl0eV91c2RhGAMgASgMIt0BCgtSdW50aW1lU3BhbhIQCgh0cmFjZV9pZBgBIAEoDBIPCgdzcGFuX2lkGAIgASgMEhsKDnBhcmVudF9zcGFuX2lkGAMgASgMSACIAQESDAoEbmFtZRgEIAEoCRIaChJzdGFydGVkX3VuaXhfbmFub3MYBSABKAQSFgoOZHVyYXRpb25fbmFub3MYBiABKAQSOQoKYXR0cmlidXRlcxgHIAMoCzIlLm5vbW9zLnJ1bnRpbWUudjIuRGlhZ25vc3RpY0F0dHJpYnV0ZUIRCg9fcGFyZW50X3NwYW5faWQi6gEKFktlcm5lbFByb2dyZXNzT2JzZXJ2ZWQSOQoIc25hcHNob3QYASABKAsyJy5ub21vcy5rZXJuZWwudjEuS2VybmVsUHJvZ3Jlc3NTbmFwc2hvdBIkChxob3N0X29ic2VydmVkX2VsYXBzZWRfbWljcm9zGAIgASgEEioKImhvc3Rfb2JzZXJ2ZWRfcGhhc2VfZWxhcHNlZF9taWNyb3MYAyABKAQSHgoWcHJvY2Vzc19yZXNpZGVudF9ieXRlcxgEIAEoBBIjChtwcm9jZXNzX3BlYWtfcmVzaWRlbnRfYnl0ZXMYBSABKAQiggEKEFRyYW5zZmVyUHJvZ3Jlc3MSFgoOcmVjZWl2ZWRfYnl0ZXMYASABKAQSGAoLdG90YWxfYnl0ZXMYAiABKARIAIgBARIsCgRraW5kGAMgASgOMh4ubm9tb3MucnVudGltZS52Mi5UcmFuc2ZlcktpbmRCDgoMX3RvdGFsX2J5dGVzIjkKEFdyaXRlUHJlcGFyYXRpb24SEgoKcmVxdWVzdF9pZBgBIAEoCRIRCgl3b3Jrc3BhY2UYAiABKAkiPgoVUmVhZEFjY2Vzc1ByZXBhcmF0aW9uEhIKCnJlcXVlc3RfaWQYASABKAkSEQoJd29ya3NwYWNlGAIgASgJKsoBChJSdW50aW1lRmFpbHVyZUtpbmQSJAogUlVOVElNRV9GQUlMVVJFX0tJTkRfVU5TUEVDSUZJRUQQABIhCh1SVU5USU1FX0ZBSUxVUkVfS0lORF9JTlRFUk5BTBABEiEKHVJVTlRJTUVfRkFJTFVSRV9LSU5EX1BST1RPQ09MEAISIgoeUlVOVElNRV9GQUlMVVJFX0tJTkRfSU5URUdSSVRZEAMSJAogUlVOVElNRV9GQUlMVVJFX0tJTkRfVU5TVVBQT1JURUQQBCqnAwoYUnVudGltZVVuYXZhaWxhYmxlUmVhc29uEioKJlJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1VOU1BFQ0lGSUVEEAASMgouUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fUkVNT1RFX09OTFlfT0ZGTElORRABEjEKLVJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1JFTU9URV9VTlJFQUNIQUJMRRACEi0KKVJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1JFTU9URV9USU1FT1VUEAMSNgoyUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fTE9DQUxfUkVQTElDQV9OT1RfUkVBRFkQBBI1CjFSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9DUkVERU5USUFMX1VOQVZBSUxBQkxFEAUSMAosUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fV09SS1NQQUNFX09QRU5JTkcQBhIoCiRSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9QRUVSX0JVU1kQByrwAQoUUnVudGltZVJlZnVzYWxSZWFzb24SJgoiUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9VTlNQRUNJRklFRBAAEi0KKVJVTlRJTUVfUkVGVVNBTF9SRUFTT05fSU5WQUxJRF9DUkVERU5USUFMEAESKAokUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9BQ0NFU1NfREVOSUVEEAISKwonUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9QTEFDRU1FTlRfUE9MSUNZEAMSKgomUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9TRVNTSU9OX1VOQk9VTkQQBCrCBAoWRm9sbG93T2JzZXJ2YXRpb25QaGFzZRIoCiRGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfVU5TUEVDSUZJRUQQABIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfREVTSVJFRBABEiAKHEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9EVUUQAhIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfUlVOTklORxADEiQKIEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9TRVRUTEVEEAQSMAosRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0FXQUlUSU5HX0RFUEVOREVOQ1kQBRIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfT0ZGTElORRAGEi8KK0ZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9JTlZBTElEX0NSRURFTlRJQUwQBxIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfQkFDS09GRhAIEiwKKEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9SRUJPUk5fUkVNT1RFTFkQCRIsCihGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfUkVQTEFDSU5HX0xPQ0FMEAoSMgouRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0xPQ0FMX0NPUFlfVU5SRUFEQUJMRRALEisKJ0ZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9LRVJORUxfUkVGVVNFRBAMKlcKCkxpbmtTdGF0dXMSGwoXTElOS19TVEFUVVNfVU5TUEVDSUZJRUQQABIUChBMSU5LX1NUQVRVU19PUEVOEAESFgoSTElOS19TVEFUVVNfQ0xPU0VEEAIqdgoMVHJhbnNmZXJLaW5kEh0KGVRSQU5TRkVSX0tJTkRfVU5TUEVDSUZJRUQQABIXChNUUkFOU0ZFUl9LSU5EX0RFTFRBEAESFgoSVFJBTlNGRVJfS0lORF9GVUxMEAISFgoSVFJBTlNGRVJfS0lORF9QVVNIEANiBnByb3RvMw", [file_google_protobuf_any, file_nomos_kernel_v1_kernel, file_nomos_kernel_v1_progress, file_nomos_runtime_v2_correspondence_desk, file_nomos_runtime_v2_custody_desk, file_nomos_runtime_v2_placement_desk, file_nomos_runtime_v2_maintenance_desk, file_nomos_runtime_v2_model_adoption_desk, file_nomos_runtime_v2_receiving_group_desk, file_nomos_runtime_v2_recovery_desk]);
   var RuntimeFailureSchema = /* @__PURE__ */ messageDesc(file_nomos_runtime_v2_observability_desk, 1);
   var RuntimeUnavailableSchema = /* @__PURE__ */ messageDesc(file_nomos_runtime_v2_observability_desk, 2);
   var RuntimeRefusalSchema = /* @__PURE__ */ messageDesc(file_nomos_runtime_v2_observability_desk, 3);
@@ -11896,6 +11910,11 @@
     if (!READINESS_DEBT.test(message)) return void 0;
     return new KernelReadinessPending(/source workspace '([^']+)'/.exec(message)?.[1]?.trim(), message);
   };
+  var READ_INDEX_BUILDING = /the read index of (.+?) is (?:being built \(\d+ of \d+ documents\)|built \(\d+ documents\) and is being bound); read maintenance (?:continues|finishes) it/;
+  var kernelReadIndexBuilding = (message) => {
+    const workspace = READ_INDEX_BUILDING.exec(message)?.[1]?.trim();
+    return workspace === void 0 ? void 0 : { workspace };
+  };
   var requiredForeignWorkspace = (message) => {
     const patterns = [
       /workspace '([^']+)' must be resident in the kernel/,
@@ -11919,9 +11938,31 @@
       throw new KernelWorkspaceResidencyRequired(workspace, failure.message);
     }
   }
+  var KernelRefusal = class extends Error {
+    constructor(failure) {
+      super(`${failure.code}: ${failure.message}`);
+      __publicField(this, "code");
+      __publicField(this, "failure");
+      this.name = "KernelRefusal";
+      this.code = failure.code;
+      this.failure = failure;
+    }
+  };
   function throwKernelFailure(failure) {
     throwIfKernelControlRequired(failure);
-    throw new Error(`${failure.code}: ${failure.message}`);
+    throw new KernelRefusal(failure);
+  }
+  var KERNEL_FAILURE_TEXT = /^(NMS-[A-Z0-9]+(?:-[A-Z0-9]+)*): ([\s\S]*)$/;
+  var ENVIRONMENTAL = /NMS-KERNEL-TRAP|\btrap\b|unreachable|out of bounds|out of memory|memory allocation|\block\b|File exists|No such file|os error|I\/O|Permission denied|No space|\bE(?:EXIST|NOENT|ACCES|NOSPC|IO|AGAIN|BUSY)\b/i;
+  function deterministicKernelRefusal(error) {
+    if (error instanceof KernelWorkspaceResidencyRequired || error instanceof KernelHistoryRequired || error instanceof KernelReadinessPending) return void 0;
+    if (error instanceof KernelRefusal && (error.failure.historyRequired !== void 0 || error.failure.identityProviderWitnessRequired !== void 0)) return void 0;
+    const text = error instanceof Error ? error.message : typeof error === "string" ? error : "";
+    const match = KERNEL_FAILURE_TEXT.exec(text);
+    if (!match) return void 0;
+    const [, code, message] = match;
+    if (ENVIRONMENTAL.test(text) || READINESS_DEBT.test(message) || requiredForeignWorkspace(message) !== void 0) return void 0;
+    return { code, message };
   }
   function rethrowTypedKernelFailure(error) {
     if (error instanceof KernelWorkspaceResidencyRequired || error instanceof KernelHistoryRequired) throw error;
@@ -15284,8 +15325,9 @@
 
   // ../src/runtime/live_inbound_stream.ts
   var LEVEL_BATCH = "level:";
+  var HISTORY_REQUIRED = "nomos.stream.history_required";
+  var CONTAINMENT_ASK_SUFFIX = ":contain";
   var STREAM_WINDOW_CHUNKS = 8;
-  var ASK_AGAIN_NANOS = 15000000000n;
   var historySlot = (workspace) => `${workspace}#history`;
   var _ports, _staging, _by, _LiveInboundStream_instances, of_fn, refusalReceipt_fn, offered_fn, completed_fn, askHistory_fn, sliceOffered_fn, sliceChunk_fn, askCheckpoint_fn, askLevel_fn;
   var LiveInboundStream = class {
@@ -15297,7 +15339,10 @@
       __privateSet(this, _ports, ports);
       __privateSet(this, _staging, ports.staging ?? memoryCheckpointStaging());
     }
-    /** When this workspace's stream last delivered anything (a waiting procedure is progressing). */
+    /** When this workspace's stream last delivered data to an ask (a waiting procedure is progressing).
+     * A refusal, a frontier, unrelated traffic on the socket and this copy's own re-asking are not
+     * progress: a procedure whose stream only ever says "ask again" gives up and its round fails over
+     * (CAP-838). */
     lastHeard(workspace) {
       return __privateGet(this, _by).get(workspace)?.lastHeard;
     }
@@ -15320,7 +15365,8 @@
           inbound.wants.level = {
             effectId: effect.effectId,
             maxOffers: Math.max(1, request.value.maxOffers),
-            remountAfterOffers: request.value.remountAfterOffers
+            remountAfterOffers: request.value.remountAfterOffers,
+            contain: effect.effectId.endsWith(CONTAINMENT_ASK_SUFFIX)
           };
           __privateMethod(this, _LiveInboundStream_instances, askLevel_fn).call(this, effect.workspace, inbound);
         }
@@ -15380,7 +15426,7 @@
         const batch = inbound.levelBatch;
         if (batch) {
           inbound.levelBatch = void 0;
-          if (batch.base === __privateGet(this, _ports).head(effect.workspace)) {
+          if (batch.base === __privateGet(this, _ports).head(effect.workspace) || batch.base === request.value.head) {
             inbound.wants.level = void 0;
             return create(PeerStreamReceiptSchema, {
               outcome: { case: "pack", value: batch },
@@ -15391,14 +15437,14 @@
           __privateMethod(this, _LiveInboundStream_instances, askLevel_fn).call(this, effect.workspace, inbound);
         }
         const head = __privateGet(this, _ports).head(effect.workspace);
-        if (head && inbound.announced && head === inbound.announced) {
+        if (inbound.announced && (head === inbound.announced || inbound.askedFrom === inbound.announced)) {
           inbound.wants.level = void 0;
           return create(PeerStreamReceiptSchema, {
-            outcome: { case: "level", value: head },
+            outcome: { case: "level", value: inbound.announced },
             ...inbound.sealed ? { sealed: inbound.sealed } : {}
           });
         }
-        return __privateMethod(this, _LiveInboundStream_instances, refusalReceipt_fn).call(this, inbound);
+        return __privateMethod(this, _LiveInboundStream_instances, refusalReceipt_fn).call(this, inbound, inbound.wants.level?.effectId === effect.effectId && inbound.wants.level.contain);
       }
       if (request.case === "history" || request.case === "ref") {
         const want = inbound.wants.packs.get(request.value.requestId);
@@ -15440,7 +15486,9 @@
     /** One frame from the peer. True when it was the stream's (the live desk handles the rest). */
     frame(workspace, message) {
       const inbound = __privateMethod(this, _LiveInboundStream_instances, of_fn).call(this, workspace);
-      inbound.lastHeard = __privateGet(this, _ports).monotonicNanoseconds();
+      if (message.case === "checkpointOffer" || message.case === "checkpointChunk" || message.case === "pack") {
+        inbound.lastHeard = __privateGet(this, _ports).monotonicNanoseconds();
+      }
       switch (message.case) {
         case "frontier":
           if (message.value.response && message.value.head) {
@@ -15495,18 +15543,26 @@
           return false;
       }
     }
-    /** Re-ask what is due: a refusal's retry time passed, or an ask heard nothing for too long. */
+    /**
+     * Ask again when a refusal said when to (the peer was opening, or acquiring history). Nothing else
+     * here runs on a timer (CAP-838): the socket is ordered and reliable, every ask is answered on it,
+     * and an ask is re-sent only when its socket re-opens (`opened`) or its refusal's time comes. The
+     * stream used to re-ask whatever had heard nothing for 15 s, and that resend - itself counted as
+     * hearing - hid an ask answered "come back" for ever.
+     */
     drive(workspace) {
       const inbound = __privateGet(this, _by).get(workspace);
-      if (!inbound || !this.wanted(workspace)) return void 0;
+      if (!inbound || inbound.askAgainAt === void 0) return void 0;
+      if (!this.wanted(workspace)) {
+        inbound.askAgainAt = void 0;
+        return void 0;
+      }
       const now2 = __privateGet(this, _ports).monotonicNanoseconds();
-      const due2 = inbound.askAgainAt ?? inbound.lastHeard + ASK_AGAIN_NANOS;
-      if (now2 < due2) return due2 - now2;
+      if (now2 < inbound.askAgainAt) return inbound.askAgainAt - now2;
       inbound.askAgainAt = void 0;
       inbound.refused = void 0;
-      inbound.lastHeard = now2;
       this.opened(workspace);
-      return ASK_AGAIN_NANOS;
+      return void 0;
     }
   };
   _ports = new WeakMap();
@@ -15522,10 +15578,16 @@
     return inbound;
   };
   /** A terminal refusal (not one that only says when to ask again) ends the procedure's wait. */
-  refusalReceipt_fn = function(inbound) {
+  refusalReceipt_fn = function(inbound, contain = false) {
     const refused = inbound.refused;
-    if (!refused || refused.retryAfterMillis !== void 0) return void 0;
+    if (!refused) return void 0;
+    const answersContainment = contain && refused.code === HISTORY_REQUIRED;
+    if (refused.retryAfterMillis !== void 0 && !answersContainment) return void 0;
     inbound.refused = void 0;
+    if (answersContainment) {
+      inbound.askAgainAt = void 0;
+      inbound.wants.level = void 0;
+    }
     return create(PeerStreamReceiptSchema, { outcome: { case: "refusal", value: refused } });
   };
   offered_fn = function(workspace, inbound, offer) {
@@ -15569,6 +15631,7 @@
     const held = !taken ? -1 : "pack" in taken ? taken.pack.byteLength : taken.bytes;
     if (held !== transfer.bytes || transfer.received !== transfer.bytes) {
       if (taken && "stagedPackFile" in taken) __privateGet(this, _staging).clear(workspace);
+      if (inbound.wants.checkpoint) __privateMethod(this, _LiveInboundStream_instances, askCheckpoint_fn).call(this, workspace, inbound);
       return;
     }
     inbound.complete = {
@@ -15686,8 +15749,12 @@
       __privateMethod(this, _LiveInboundStream_instances, askCheckpoint_fn).call(this, workspace, inbound);
       return;
     }
+    inbound.announced = void 0;
+    inbound.sealed = void 0;
+    const head = __privateGet(this, _ports).head(workspace) ?? "";
+    inbound.askedFrom = head;
     __privateGet(this, _ports).send(workspace, { case: "frontier", value: create(LiveFrontierSchema, {
-      head: __privateGet(this, _ports).head(workspace) ?? "",
+      head,
       response: false,
       maxOffers: level.maxOffers,
       remountAfterOffers: level.remountAfterOffers,
@@ -16222,6 +16289,24 @@
     return void 0;
   }
   var PLACEMENT_REFERENCE = "refs/nomos/placement";
+  function readIndexPendingAnswer(request, message) {
+    if (request.operation.case !== "query" || request.operation.value.query.case === "maintenanceQuantum") return void 0;
+    const building = kernelReadIndexBuilding(message);
+    if (building === void 0) return void 0;
+    const target3 = request.operation.value.target;
+    return create(CallResponseSchema, {
+      protocolVersion: request.protocolVersion,
+      requestId: request.requestId,
+      outcome: { case: "query", value: create(QueryResponseSchema, {
+        result: { case: "readIndexPending", value: create(ReadIndexPendingSchema, {
+          workspace: target3?.workspace || building.workspace,
+          branch: target3?.branch ?? "",
+          // The sliced build names no frontier: it restarts at whatever head main holds when it continues.
+          requestedFrontier: ""
+        }) }
+      }) }
+    });
+  }
   var _kernel, _activeOperation, _signingSequence, _releaseSequence, _onWorkspaceUse, _onPlacementMoved, _attached, _residency, _KernelPort_instances, mount_fn, custodyCall_fn, call_fn, timedCall_fn, exclusive_fn;
   var KernelPort = class {
     /** `onPlacementMoved` hears of every placement frontier this port sees move: an admitted
@@ -17243,6 +17328,8 @@
         const nested = request.operation.case === "custody" ? request.operation.value.operation.case ?? "empty" : request.operation.case === "query" ? request.operation.value.query.case === "named" ? `named:${request.operation.value.query.value.operation}` : request.operation.value.query.case ?? "empty" : "";
         error.message = `kernel-operation=${top}/${nested}: ${error.message}`;
       }
+      const pending = readIndexPendingAnswer(request, error instanceof Error ? error.message : String(error));
+      if (pending !== void 0) return pending;
       rethrowTypedKernelFailure(error);
     }
     if (response.requestId !== request.requestId) {
@@ -17253,6 +17340,9 @@
     __privateGet(this, _residency).after(request, response);
     const placementMoved = placementMovedBy(request, response);
     if (placementMoved !== void 0) __privateGet(this, _onPlacementMoved).call(this, placementMoved);
+    if (response.outcome.case === "failure") {
+      return readIndexPendingAnswer(request, response.outcome.value.message) ?? response;
+    }
     return response;
   };
   /** [#call] with the opt-in timeline trace: encode, kernel and decode timed separately. */
@@ -23830,7 +23920,7 @@
   var DURABILITY_FLUSH_MAX_DELAY_NANOSECONDS = LOCAL_WRITE_STALENESS_CAP_NANOSECONDS;
   var CUSTODY_PACKING_PAUSE_NANOSECONDS = 1500000000n;
   var CUSTODY_BURST_SLICE_INTERVAL_NANOSECONDS = 250000000n;
-  var _queries3, _sessions5, _trace6, _observer, _clock7, _pending, _pins, _deferredDurability, _burst, _ownsBurst, _loosePressure, _lastBurstSliceNanoseconds, _flush, _sequence8, _revision3, _ReadMaintenanceDesk_instances, schedule_fn, oweFlush_fn, notePressure_fn, flushDueAt_fn, custodyBurstSlice_fn, tickFlush_fn, tickPin_fn, nextDelay_fn;
+  var _queries3, _sessions5, _trace6, _observer, _clock7, _pending, _pins, _deferredDurability, _burst, _ownsBurst, _loosePressure, _lastBurstSliceNanoseconds, _flush, _sequence8, _revision3, _ReadMaintenanceDesk_instances, schedule_fn, turn_fn, oweFlush_fn, notePressure_fn, flushDueAt_fn, custodyBurstSlice_fn, tickFlush_fn, tickPin_fn, nextDelay_fn;
   var ReadMaintenanceDesk = class {
     constructor(queries, sessions, trace, clock2, observer = {}, deferredDurability = false, writeBurst) {
       __privateAdd(this, _ReadMaintenanceDesk_instances);
@@ -23925,188 +24015,26 @@
      * (a waiting read's own turn advances read readiness only).
      */
     tick(request, sessionlessNotBeforeNanoseconds = 0n, backgroundNotBeforeNanoseconds = 0n, durability = true) {
-      const now2 = __privateGet(this, _clock7).monotonicNanoseconds();
-      const custodySlice = (workspace2) => __privateMethod(this, _ReadMaintenanceDesk_instances, custodyBurstSlice_fn).call(this, now2, workspace2);
-      const due2 = (demand2) => {
-        const held = demand2.session || demand2.awaited || demand2.retryNotBeforeNanoseconds > sessionlessNotBeforeNanoseconds ? demand2.retryNotBeforeNanoseconds : sessionlessNotBeforeNanoseconds;
-        const ordinary = demand2.read || demand2.awaited || held > backgroundNotBeforeNanoseconds ? held : backgroundNotBeforeNanoseconds;
-        const hold = demand2.read || demand2.awaited || !demand2.background?.maintainGitCustody ? void 0 : custodySlice(demand2.workspace);
-        if (!hold) return ordinary;
-        if (hold.slice && durability) return held > hold.at ? held : hold.at;
-        return ordinary > hold.at ? ordinary : hold.at;
-      };
-      const entry = [...__privateGet(this, _pending).entries()].find(([, demand2]) => due2(demand2) <= now2);
-      const flush = __privateGet(this, _flush);
-      if (durability && flush && __privateMethod(this, _ReadMaintenanceDesk_instances, flushDueAt_fn).call(this, flush) <= now2 && !entry?.[1].read && (flush.local || !entry || flush.owedSinceNanoseconds + DURABILITY_FLUSH_MAX_DELAY_NANOSECONDS <= now2)) {
-        return __privateMethod(this, _ReadMaintenanceDesk_instances, tickFlush_fn).call(this, flush, request);
-      }
-      const pinDue = (pin) => {
-        const held = pin.session ? 0n : sessionlessNotBeforeNanoseconds;
-        return [pin.notBeforeNanoseconds, held, backgroundNotBeforeNanoseconds].reduce((latest, at) => at > latest ? at : latest, 0n);
-      };
-      if (!entry) {
-        const pin = [...__privateGet(this, _pins).entries()].find(([, idle]) => pinDue(idle) <= now2);
-        if (pin) return __privateMethod(this, _ReadMaintenanceDesk_instances, tickPin_fn).call(this, pin[0], pin[1], request);
-        return create(MaintenanceTickedSchema, {
-          pending: this.hasPending(),
-          nextTickAfterMillis: __privateMethod(this, _ReadMaintenanceDesk_instances, nextDelay_fn).call(this, now2, due2, pinDue)
-        });
-      }
-      const [workspace, demand] = entry;
-      const mount = demand.session ? __privateGet(this, _sessions5).mountForSession(demand.session) : __privateGet(this, _sessions5).mountForWorkspace(workspace);
-      const read = demand.read;
-      const activeCause = read?.cause ?? demand.background?.cause;
-      if (activeCause === void 0) {
-        throw new Error(`maintenance demand for '${workspace}' has no work`);
-      }
-      const command = read ? void 0 : demand.background?.command;
-      const burstSlice = read === void 0 && demand.background?.maintainGitCustody === true && durability && custodySlice(workspace)?.slice === true;
-      const synthetic = request ?? create(RuntimeRequestSchema, {
-        protocolVersion: 2,
-        requestId: ++__privateWrapper(this, _sequence8)._
+      const turn = __privateMethod(this, _ReadMaintenanceDesk_instances, turn_fn).call(this, request, sessionlessNotBeforeNanoseconds, { case: "until", atNanoseconds: backgroundNotBeforeNanoseconds }, durability);
+      return turn.case === "ran" ? turn.ticked : create(MaintenanceTickedSchema, {
+        pending: turn.pending,
+        nextTickAfterMillis: turn.nextDelayMillis ?? 0
       });
-      try {
-        const progress = __privateGet(this, _trace6).measure(
-          "peer.read-maintenance.quantum",
-          { request: synthetic, ...demand.session ? { session: demand.session } : {}, workspace },
-          {
-            "maintenance.cause": ReadMaintenanceCause[activeCause],
-            ...command ? {
-              "maintenance.domain": command.domain,
-              "maintenance.package": command.packageHash,
-              ...command.directive ? { "maintenance.directive": command.directive } : {}
-            } : {}
-          },
-          () => __privateGet(this, _queries3).maintenanceQuantum(demand.session ?? "", mount, synthetic.requestId, {
-            ...command?.domain === void 0 ? {} : { requestedDomain: command.domain },
-            ...command?.packageHash === void 0 ? {} : { requestedPackage: command.packageHash },
-            ...command?.directive === void 0 ? {} : { requestedDirective: command.directive },
-            maintainGitCustody: read === void 0 && demand.background?.maintainGitCustody === true,
-            // Only reached inside a burst under the growth guard: one small packing slice.
-            ...burstSlice ? { localWriteBurst: true } : {},
-            // Readiness is one kernel-reported fact per workspace frontier. Every
-            // read demand repays all of it; no cause selects a weaker variant that
-            // would leave the workspace unusable as a foreign-read source.
-            readIndexOnly: read !== void 0
-          })
-        );
-        const elapsedNanoseconds = __privateGet(this, _clock7).monotonicNanoseconds() - now2;
-        if (slowQuantumObserver && elapsedNanoseconds >= 300000000n) {
-          slowQuantumObserver(`[nomos-kernel-perf] ${JSON.stringify({
-            op: "peer_maintenance_quantum",
-            totalMs: Number(elapsedNanoseconds / 1000000n),
-            cause: ReadMaintenanceCause[activeCause],
-            read: read !== void 0,
-            awaited: demand.awaited === true,
-            session: demand.session !== void 0,
-            backgroundHoldMs: Number((backgroundNotBeforeNanoseconds - now2) / 1000000n),
-            sessionlessHoldMs: Number((sessionlessNotBeforeNanoseconds - now2) / 1000000n),
-            caller: (new Error().stack ?? "").split("\n").slice(2, 6).map((frame2) => frame2.trim()).join(" < ")
-          })}`);
-        }
-        __privateMethod(this, _ReadMaintenanceDesk_instances, notePressure_fn).call(this, workspace, progress.looseCustodyPressure);
-        if (burstSlice) __privateSet(this, _lastBurstSliceNanoseconds, now2);
-        const observed = create(ReadMaintenanceProgressSchema, {
-          workspace,
-          cause: activeCause,
-          kernel: progress
-        });
-        __privateGet(this, _trace6).emit(demand.session, {
-          case: "maintenanceProgress",
-          value: observed
-        });
-        if (__privateGet(this, _deferredDurability)) __privateMethod(this, _ReadMaintenanceDesk_instances, oweFlush_fn).call(this, workspace, demand.session, false);
-        __privateGet(this, _pending).delete(workspace);
-        if (progress.maintenancePending) {
-          if (read) {
-            const rest = [...__privateGet(this, _pending).entries()];
-            __privateGet(this, _pending).clear();
-            __privateGet(this, _pending).set(workspace, { ...demand, failures: 0 });
-            for (const [key, value] of rest) __privateGet(this, _pending).set(key, value);
-          } else {
-            __privateGet(this, _pending).set(workspace, { ...demand, failures: 0 });
-          }
-        } else if (read && demand.background) {
-          const { read: _settled4, awaited: _served, ...backgroundDemand } = demand;
-          __privateGet(this, _pending).set(workspace, {
-            ...backgroundDemand,
-            background: read.owedByAdvance ? { ...demand.background, announced: true } : demand.background,
-            failures: 0
-          });
-          __privateGet(this, _trace6).emit(demand.session, {
-            case: "maintenanceProgress",
-            value: create(ReadMaintenanceProgressSchema, {
-              workspace,
-              cause: demand.background.cause
-            })
-          });
-        }
-        if (!progress.maintenancePending) {
-          if (read?.owedByAdvance) __privateGet(this, _observer).frontierAdvanced?.(workspace);
-          else if (read) __privateGet(this, _observer).readReady?.(workspace);
-          else if (demand.background?.maintainGitCustody && !demand.background.announced) {
-            __privateGet(this, _observer).frontierAdvanced?.(workspace);
-          }
-        }
-        return create(MaintenanceTickedSchema, {
-          pending: __privateGet(this, _pending).size > 0,
-          progress: observed,
-          // With no debt left, an armed idle pin names when the host should wake next.
-          nextTickAfterMillis: progress.maintenancePending ? 20 : __privateGet(this, _pending).size === 0 && this.hasIdleWork() ? __privateMethod(this, _ReadMaintenanceDesk_instances, nextDelay_fn).call(this, __privateGet(this, _clock7).monotonicNanoseconds()) : 0
-        });
-      } catch (error) {
-        const format = localCopyFormatRefusal(error);
-        if (format !== void 0) {
-          __privateGet(this, _pending).delete(workspace);
-          __privateGet(this, _pins).delete(workspace);
-          __privateSet(this, _revision3, __privateGet(this, _revision3) + 1);
-          __privateGet(this, _observer).localCopyUnreadable?.(workspace, format);
-          __privateGet(this, _trace6).emit(demand.session, {
-            case: "maintenanceProgress",
-            value: create(ReadMaintenanceProgressSchema, {
-              workspace,
-              cause: activeCause,
-              stopped: true
-            })
-          });
-          return create(MaintenanceTickedSchema, {
-            pending: __privateGet(this, _pending).size > 0,
-            nextTickAfterMillis: __privateMethod(this, _ReadMaintenanceDesk_instances, nextDelay_fn).call(this, __privateGet(this, _clock7).monotonicNanoseconds())
-          });
-        }
-        const failures = demand.failures + 1;
-        __privateGet(this, _pending).delete(workspace);
-        const retryMillis = Math.min(30 * 60 * 1e3, 1e3 * 2 ** Math.min(failures - 1, 10));
-        slowQuantumObserver?.(`[nomos-kernel-perf] ${JSON.stringify({
-          op: "peer_maintenance_failure",
-          failed: true,
-          workspace,
-          cause: ReadMaintenanceCause[activeCause],
-          failures,
-          retryAfterMillis: retryMillis,
-          totalMs: Number((__privateGet(this, _clock7).monotonicNanoseconds() - now2) / 1000000n),
-          error: (error instanceof Error ? error.message : String(error)).slice(0, 600)
-        })}`);
-        __privateGet(this, _pending).set(workspace, {
-          ...demand,
-          failures,
-          retryNotBeforeNanoseconds: __privateGet(this, _clock7).monotonicNanoseconds() + BigInt(retryMillis) * 1000000n
-        });
-        __privateGet(this, _trace6).emit(demand.session, {
-          case: "maintenanceProgress",
-          value: create(ReadMaintenanceProgressSchema, {
-            workspace,
-            cause: activeCause,
-            retryAfterMillis: retryMillis
-          })
-        });
-        return create(MaintenanceTickedSchema, {
-          pending: true,
-          // Backoff belongs to the failed workspace. Another workspace's ready
-          // index or changed watches must not wait for this retry deadline.
-          nextTickAfterMillis: __privateMethod(this, _ReadMaintenanceDesk_instances, nextDelay_fn).call(this, __privateGet(this, _clock7).monotonicNanoseconds())
-        });
+    }
+    /**
+     * A waiting read's turn: advance read readiness only. It never runs a background command, closure
+     * warm, pack import or durability flush on the foreground's turn, and never reports a wake for
+     * that background work: with only background work owed its wake is `none`.
+     */
+    tickReadReadiness() {
+      const turn = __privateMethod(this, _ReadMaintenanceDesk_instances, turn_fn).call(this, void 0, 0n, { case: "readReadinessOnly" }, false);
+      if (turn.case === "ran") {
+        return { ticked: turn.ticked, wake: { case: "after", millis: turn.ticked.nextTickAfterMillis } };
       }
+      return {
+        ticked: create(MaintenanceTickedSchema, { pending: turn.pending, nextTickAfterMillis: turn.nextDelayMillis ?? 0 }),
+        wake: turn.nextDelayMillis === void 0 ? { case: "none" } : { case: "after", millis: turn.nextDelayMillis }
+      };
     }
     /** Drop any demand for a workspace no maintenance can serve (an unreadable copy). */
     forget(workspace) {
@@ -24199,6 +24127,7 @@
       for (const [key, value] of entries.filter(([key2]) => key2 !== workspace)) __privateGet(this, _pending).set(key, value);
     }
     __privateSet(this, _revision3, __privateGet(this, _revision3) + 1);
+    if (read && (!existing?.read || isReadDemand)) __privateGet(this, _observer).readinessMayChange?.(workspace);
     if (!existing || existing.read?.cause !== read?.cause || existing.background?.cause !== background?.cause) {
       __privateGet(this, _trace6).emit(session ?? existing?.session, {
         case: "maintenanceProgress",
@@ -24206,6 +24135,197 @@
       });
     }
   };
+  turn_fn = function(request, sessionlessNotBeforeNanoseconds, backgroundHold, durability) {
+    const now2 = __privateGet(this, _clock7).monotonicNanoseconds();
+    const backgroundNotBeforeNanoseconds = backgroundHold.case === "until" ? backgroundHold.atNanoseconds : void 0;
+    const custodySlice = (workspace2) => __privateMethod(this, _ReadMaintenanceDesk_instances, custodyBurstSlice_fn).call(this, now2, workspace2);
+    const due2 = (demand2) => {
+      const held = demand2.session || demand2.awaited || demand2.retryNotBeforeNanoseconds > sessionlessNotBeforeNanoseconds ? demand2.retryNotBeforeNanoseconds : sessionlessNotBeforeNanoseconds;
+      if (!demand2.read && !demand2.awaited && backgroundNotBeforeNanoseconds === void 0) return void 0;
+      const ordinary = demand2.read || demand2.awaited || backgroundNotBeforeNanoseconds === void 0 || held > backgroundNotBeforeNanoseconds ? held : backgroundNotBeforeNanoseconds;
+      const hold = demand2.read || demand2.awaited || !demand2.background?.maintainGitCustody ? void 0 : custodySlice(demand2.workspace);
+      if (!hold) return ordinary;
+      if (hold.slice && durability) return held > hold.at ? held : hold.at;
+      return ordinary > hold.at ? ordinary : hold.at;
+    };
+    const entry = [...__privateGet(this, _pending).entries()].find(([, demand2]) => {
+      const at = due2(demand2);
+      return at !== void 0 && at <= now2;
+    });
+    const flush = __privateGet(this, _flush);
+    if (durability && flush && __privateMethod(this, _ReadMaintenanceDesk_instances, flushDueAt_fn).call(this, flush) <= now2 && !entry?.[1].read && (flush.local || !entry || flush.owedSinceNanoseconds + DURABILITY_FLUSH_MAX_DELAY_NANOSECONDS <= now2)) {
+      return { case: "ran", ticked: __privateMethod(this, _ReadMaintenanceDesk_instances, tickFlush_fn).call(this, flush, request) };
+    }
+    const pinDue = (pin) => {
+      if (backgroundNotBeforeNanoseconds === void 0) return void 0;
+      const held = pin.session ? 0n : sessionlessNotBeforeNanoseconds;
+      return [pin.notBeforeNanoseconds, held, backgroundNotBeforeNanoseconds].reduce((latest, at) => at > latest ? at : latest, 0n);
+    };
+    if (!entry) {
+      const pin = [...__privateGet(this, _pins).entries()].find(([, idle]) => {
+        const at = pinDue(idle);
+        return at !== void 0 && at <= now2;
+      });
+      if (pin) return { case: "ran", ticked: __privateMethod(this, _ReadMaintenanceDesk_instances, tickPin_fn).call(this, pin[0], pin[1], request) };
+      return { case: "idle", pending: this.hasPending(), nextDelayMillis: __privateMethod(this, _ReadMaintenanceDesk_instances, nextDelay_fn).call(this, now2, due2, pinDue, durability) };
+    }
+    const [workspace, demand] = entry;
+    const mount = demand.session ? __privateGet(this, _sessions5).mountForSession(demand.session) : __privateGet(this, _sessions5).mountForWorkspace(workspace);
+    const read = demand.read;
+    const activeCause = read?.cause ?? demand.background?.cause;
+    if (activeCause === void 0) {
+      throw new Error(`maintenance demand for '${workspace}' has no work`);
+    }
+    const command = read ? void 0 : demand.background?.command;
+    const burstSlice = read === void 0 && demand.background?.maintainGitCustody === true && durability && custodySlice(workspace)?.slice === true;
+    const synthetic = request ?? create(RuntimeRequestSchema, {
+      protocolVersion: 2,
+      requestId: ++__privateWrapper(this, _sequence8)._
+    });
+    try {
+      const progress = __privateGet(this, _trace6).measure(
+        "peer.read-maintenance.quantum",
+        { request: synthetic, ...demand.session ? { session: demand.session } : {}, workspace },
+        {
+          "maintenance.cause": ReadMaintenanceCause[activeCause],
+          ...command ? {
+            "maintenance.domain": command.domain,
+            "maintenance.package": command.packageHash,
+            ...command.directive ? { "maintenance.directive": command.directive } : {}
+          } : {}
+        },
+        () => __privateGet(this, _queries3).maintenanceQuantum(demand.session ?? "", mount, synthetic.requestId, {
+          ...command?.domain === void 0 ? {} : { requestedDomain: command.domain },
+          ...command?.packageHash === void 0 ? {} : { requestedPackage: command.packageHash },
+          ...command?.directive === void 0 ? {} : { requestedDirective: command.directive },
+          maintainGitCustody: read === void 0 && demand.background?.maintainGitCustody === true,
+          // Only reached inside a burst under the growth guard: one small packing slice.
+          ...burstSlice ? { localWriteBurst: true } : {},
+          // Readiness is one kernel-reported fact per workspace frontier. Every
+          // read demand repays all of it; no cause selects a weaker variant that
+          // would leave the workspace unusable as a foreign-read source.
+          readIndexOnly: read !== void 0
+        })
+      );
+      const elapsedNanoseconds = __privateGet(this, _clock7).monotonicNanoseconds() - now2;
+      if (slowQuantumObserver && elapsedNanoseconds >= 300000000n) {
+        slowQuantumObserver(`[nomos-kernel-perf] ${JSON.stringify({
+          op: "peer_maintenance_quantum",
+          totalMs: Number(elapsedNanoseconds / 1000000n),
+          cause: ReadMaintenanceCause[activeCause],
+          read: read !== void 0,
+          awaited: demand.awaited === true,
+          session: demand.session !== void 0,
+          backgroundHoldMs: backgroundNotBeforeNanoseconds === void 0 ? "read-readiness-only" : Number((backgroundNotBeforeNanoseconds - now2) / 1000000n),
+          sessionlessHoldMs: Number((sessionlessNotBeforeNanoseconds - now2) / 1000000n),
+          caller: (new Error().stack ?? "").split("\n").slice(2, 6).map((frame2) => frame2.trim()).join(" < ")
+        })}`);
+      }
+      __privateMethod(this, _ReadMaintenanceDesk_instances, notePressure_fn).call(this, workspace, progress.looseCustodyPressure);
+      if (burstSlice) __privateSet(this, _lastBurstSliceNanoseconds, now2);
+      const observed = create(ReadMaintenanceProgressSchema, {
+        workspace,
+        cause: activeCause,
+        kernel: progress
+      });
+      __privateGet(this, _trace6).emit(demand.session, {
+        case: "maintenanceProgress",
+        value: observed
+      });
+      if (__privateGet(this, _deferredDurability)) __privateMethod(this, _ReadMaintenanceDesk_instances, oweFlush_fn).call(this, workspace, demand.session, false);
+      __privateGet(this, _pending).delete(workspace);
+      if (progress.maintenancePending) {
+        if (read) {
+          const rest = [...__privateGet(this, _pending).entries()];
+          __privateGet(this, _pending).clear();
+          __privateGet(this, _pending).set(workspace, { ...demand, failures: 0 });
+          for (const [key, value] of rest) __privateGet(this, _pending).set(key, value);
+        } else {
+          __privateGet(this, _pending).set(workspace, { ...demand, failures: 0 });
+        }
+      } else if (read && demand.background) {
+        const { read: _settled4, awaited: _served, ...backgroundDemand } = demand;
+        __privateGet(this, _pending).set(workspace, {
+          ...backgroundDemand,
+          background: read.owedByAdvance ? { ...demand.background, announced: true } : demand.background,
+          failures: 0
+        });
+        __privateGet(this, _trace6).emit(demand.session, {
+          case: "maintenanceProgress",
+          value: create(ReadMaintenanceProgressSchema, {
+            workspace,
+            cause: demand.background.cause
+          })
+        });
+      }
+      if (!progress.maintenancePending) {
+        if (read?.owedByAdvance) __privateGet(this, _observer).frontierAdvanced?.(workspace);
+        else if (read) __privateGet(this, _observer).readReady?.(workspace);
+        else if (demand.background?.maintainGitCustody && !demand.background.announced) {
+          __privateGet(this, _observer).frontierAdvanced?.(workspace);
+        }
+      }
+      __privateGet(this, _observer).readinessMayChange?.(workspace);
+      return { case: "ran", ticked: create(MaintenanceTickedSchema, {
+        pending: __privateGet(this, _pending).size > 0,
+        progress: observed,
+        // With no debt left, an armed idle pin names when the host should wake next.
+        nextTickAfterMillis: progress.maintenancePending ? 20 : __privateGet(this, _pending).size === 0 && this.hasIdleWork() ? __privateMethod(this, _ReadMaintenanceDesk_instances, nextDelay_fn).call(this, __privateGet(this, _clock7).monotonicNanoseconds()) ?? 0 : 0
+      }) };
+    } catch (error) {
+      const format = localCopyFormatRefusal(error);
+      if (format !== void 0) {
+        __privateGet(this, _pending).delete(workspace);
+        __privateGet(this, _pins).delete(workspace);
+        __privateSet(this, _revision3, __privateGet(this, _revision3) + 1);
+        __privateGet(this, _observer).localCopyUnreadable?.(workspace, format);
+        __privateGet(this, _trace6).emit(demand.session, {
+          case: "maintenanceProgress",
+          value: create(ReadMaintenanceProgressSchema, {
+            workspace,
+            cause: activeCause,
+            stopped: true
+          })
+        });
+        return { case: "ran", ticked: create(MaintenanceTickedSchema, {
+          pending: __privateGet(this, _pending).size > 0,
+          nextTickAfterMillis: __privateMethod(this, _ReadMaintenanceDesk_instances, nextDelay_fn).call(this, __privateGet(this, _clock7).monotonicNanoseconds()) ?? 0
+        }) };
+      }
+      const failures = demand.failures + 1;
+      __privateGet(this, _pending).delete(workspace);
+      const retryMillis = Math.min(30 * 60 * 1e3, 1e3 * 2 ** Math.min(failures - 1, 10));
+      slowQuantumObserver?.(`[nomos-kernel-perf] ${JSON.stringify({
+        op: "peer_maintenance_failure",
+        failed: true,
+        workspace,
+        cause: ReadMaintenanceCause[activeCause],
+        failures,
+        retryAfterMillis: retryMillis,
+        totalMs: Number((__privateGet(this, _clock7).monotonicNanoseconds() - now2) / 1000000n),
+        error: (error instanceof Error ? error.message : String(error)).slice(0, 600)
+      })}`);
+      __privateGet(this, _pending).set(workspace, {
+        ...demand,
+        failures,
+        retryNotBeforeNanoseconds: __privateGet(this, _clock7).monotonicNanoseconds() + BigInt(retryMillis) * 1000000n
+      });
+      __privateGet(this, _trace6).emit(demand.session, {
+        case: "maintenanceProgress",
+        value: create(ReadMaintenanceProgressSchema, {
+          workspace,
+          cause: activeCause,
+          retryAfterMillis: retryMillis
+        })
+      });
+      return { case: "ran", ticked: create(MaintenanceTickedSchema, {
+        pending: true,
+        // Backoff belongs to the failed workspace. Another workspace's ready
+        // index or changed watches must not wait for this retry deadline.
+        nextTickAfterMillis: __privateMethod(this, _ReadMaintenanceDesk_instances, nextDelay_fn).call(this, __privateGet(this, _clock7).monotonicNanoseconds()) ?? 0
+      }) };
+    }
+  };
   /** Owe the kernel its ordered flush. The first write it covers fixes `owedSince`; the shared
    * burst signal then releases it once the offers pause, or at the cap (CAP-750: one detector). */
   oweFlush_fn = function(workspace, session, local) {
@@ -24268,7 +24388,7 @@
       }
       return create(MaintenanceTickedSchema, {
         pending: this.hasPending(),
-        nextTickAfterMillis: progress.maintenancePending ? 20 : __privateMethod(this, _ReadMaintenanceDesk_instances, nextDelay_fn).call(this, __privateGet(this, _clock7).monotonicNanoseconds())
+        nextTickAfterMillis: progress.maintenancePending ? 20 : __privateMethod(this, _ReadMaintenanceDesk_instances, nextDelay_fn).call(this, __privateGet(this, _clock7).monotonicNanoseconds()) ?? 0
       });
     } catch (error) {
       const failures = flush.failures + 1;
@@ -24292,7 +24412,7 @@
       });
       return create(MaintenanceTickedSchema, {
         pending: this.hasPending(),
-        nextTickAfterMillis: __privateMethod(this, _ReadMaintenanceDesk_instances, nextDelay_fn).call(this, __privateGet(this, _clock7).monotonicNanoseconds())
+        nextTickAfterMillis: __privateMethod(this, _ReadMaintenanceDesk_instances, nextDelay_fn).call(this, __privateGet(this, _clock7).monotonicNanoseconds()) ?? 0
       });
     }
   };
@@ -24323,7 +24443,7 @@
       }
       return create(MaintenanceTickedSchema, {
         pending: this.hasPending(),
-        nextTickAfterMillis: progress.maintenancePending ? 20 : __privateMethod(this, _ReadMaintenanceDesk_instances, nextDelay_fn).call(this, __privateGet(this, _clock7).monotonicNanoseconds())
+        nextTickAfterMillis: progress.maintenancePending ? 20 : __privateMethod(this, _ReadMaintenanceDesk_instances, nextDelay_fn).call(this, __privateGet(this, _clock7).monotonicNanoseconds()) ?? 0
       });
     } catch (error) {
       slowQuantumObserver?.(`[nomos-kernel-perf] ${JSON.stringify({
@@ -24335,44 +24455,51 @@
       })}`);
       return create(MaintenanceTickedSchema, {
         pending: this.hasPending(),
-        nextTickAfterMillis: __privateMethod(this, _ReadMaintenanceDesk_instances, nextDelay_fn).call(this, __privateGet(this, _clock7).monotonicNanoseconds())
+        nextTickAfterMillis: __privateMethod(this, _ReadMaintenanceDesk_instances, nextDelay_fn).call(this, __privateGet(this, _clock7).monotonicNanoseconds()) ?? 0
       });
     }
   };
-  nextDelay_fn = function(now2, due2 = (demand) => demand.retryNotBeforeNanoseconds, pinDue = (pin) => pin.notBeforeNanoseconds) {
+  /** Milliseconds until the earliest owed work this turn serves; `undefined` when none is owed. */
+  nextDelay_fn = function(now2, due2 = (demand) => demand.retryNotBeforeNanoseconds, pinDue = (pin) => pin.notBeforeNanoseconds, flushes = true) {
     let earliest;
     for (const demand of __privateGet(this, _pending).values()) {
       const at = due2(demand);
+      if (at === void 0) continue;
       if (at <= now2) return 0;
       if (earliest === void 0 || at < earliest) earliest = at;
     }
     for (const pin of __privateGet(this, _pins).values()) {
       const at = pinDue(pin);
+      if (at === void 0) continue;
       if (at <= now2) return 0;
       if (earliest === void 0 || at < earliest) earliest = at;
     }
-    if (__privateGet(this, _flush)) {
+    if (flushes && __privateGet(this, _flush)) {
       const at = __privateMethod(this, _ReadMaintenanceDesk_instances, flushDueAt_fn).call(this, __privateGet(this, _flush));
       if (at <= now2) return 0;
       if (earliest === void 0 || at < earliest) earliest = at;
     }
-    return earliest === void 0 ? 0 : Number((earliest - now2 + 999999n) / 1000000n);
+    return earliest === void 0 ? void 0 : Number((earliest - now2 + 999999n) / 1000000n);
   };
 
   // ../src/runtime/read_response_desk.ts
   init_define_NOMOS_KERNEL_RELEASE();
   init_shims();
-  var _waiting5, _clock8, _tick, _read2, _sequence9, _ReadResponseDesk_instances, now_fn3, pending_fn;
+  var READ_RETENTION_MILLIS = 12e4;
+  var READ_RESUME_MAX_MILLIS = 1e3;
+  var _waiting5, _clock8, _tick, _owe, _read2, _sequence9, _ReadResponseDesk_instances, now_fn3, pending_fn;
   var ReadResponseDesk = class {
-    constructor(clock2, tick, read) {
+    constructor(clock2, tick, owe, read) {
       __privateAdd(this, _ReadResponseDesk_instances);
       __privateAdd(this, _waiting5, /* @__PURE__ */ new Map());
       __privateAdd(this, _clock8);
       __privateAdd(this, _tick);
+      __privateAdd(this, _owe);
       __privateAdd(this, _read2);
       __privateAdd(this, _sequence9, 0);
       __privateSet(this, _clock8, clock2);
       __privateSet(this, _tick, tick);
+      __privateSet(this, _owe, owe);
       __privateSet(this, _read2, read);
     }
     begin(request, dependency) {
@@ -24382,18 +24509,27 @@
       const now2 = __privateMethod(this, _ReadResponseDesk_instances, now_fn3).call(this);
       for (const [id, work] of __privateGet(this, _waiting5)) if (work.deadline <= now2) __privateGet(this, _waiting5).delete(id);
       const workId2 = `local-read-${++__privateWrapper(this, _sequence9)._}`;
-      __privateGet(this, _waiting5).set(workId2, { request, dependency, deadline: now2 + 12e4, notBefore: now2 });
+      __privateGet(this, _waiting5).set(workId2, {
+        request,
+        dependency,
+        deadline: now2 + READ_RETENTION_MILLIS,
+        notBefore: now2,
+        idle: false,
+        // The office owed this frontier's debt when the kernel first answered pending.
+        owedFor: dependency.requestedFrontier,
+        waiters: /* @__PURE__ */ new Set()
+      });
       return create(LocalReadPendingSchema, { workId: workId2 });
     }
     resume(workId2, requestId) {
       const work = __privateGet(this, _waiting5).get(workId2);
       if (!work || work.request.requestId !== requestId) throw new Error(`unknown local read continuation '${workId2}'`);
       const now2 = __privateMethod(this, _ReadResponseDesk_instances, now_fn3).call(this);
+      work.waiters.clear();
       if (now2 >= work.deadline) {
         __privateGet(this, _waiting5).delete(workId2);
         throw new Error(`Local read index for '${work.dependency.workspace}' did not catch up to ${work.dependency.requestedFrontier} within its retained maintenance window`);
       }
-      if (now2 < work.notBefore) return __privateMethod(this, _ReadResponseDesk_instances, pending_fn).call(this, workId2, work, now2);
       try {
         const response = __privateGet(this, _read2).call(this, work.request);
         if (response.outcome.case !== "query" || response.outcome.value.result.case !== "readIndexPending") {
@@ -24401,33 +24537,75 @@
           return { case: "ready", request: work.request, response };
         }
         work.dependency = response.outcome.value.result.value;
-        const tick = __privateGet(this, _tick).call(this);
+        if (now2 < work.notBefore) return __privateMethod(this, _ReadResponseDesk_instances, pending_fn).call(this, workId2, work, now2);
+        let { ticked, wake } = __privateGet(this, _tick).call(this);
+        if (wake.case === "none" && ticked.progress === void 0 && work.owedFor !== work.dependency.requestedFrontier) {
+          work.owedFor = work.dependency.requestedFrontier;
+          __privateGet(this, _owe).call(this, work.request);
+          ({ ticked, wake } = __privateGet(this, _tick).call(this));
+        }
         const afterTick = __privateMethod(this, _ReadResponseDesk_instances, now_fn3).call(this);
-        work.notBefore = afterTick + tick.nextTickAfterMillis;
-        work.deadline = afterTick + Math.max(12e4, tick.nextTickAfterMillis + 6e4);
+        work.idle = wake.case === "none";
+        const backoff = wake.case === "after" ? wake.millis : 0;
+        work.notBefore = afterTick + backoff;
+        work.deadline = afterTick + Math.max(READ_RETENTION_MILLIS, backoff + 6e4);
         return __privateMethod(this, _ReadResponseDesk_instances, pending_fn).call(this, workId2, work, afterTick);
       } catch (error) {
         __privateGet(this, _waiting5).delete(workId2);
         throw error;
       }
     }
+    /**
+     * Wait in process for a held read to become worth continuing. `notify` is called once, when read
+     * readiness for its workspace changes (a slice or binding finished, a frontier advanced, readiness
+     * newly owed). `afterMillis` is the only timer the shell needs: the read's own scheduled quantum
+     * when it has one, otherwise its deadline. Undefined for an unknown or finished read.
+     */
+    onResumable(workId2, notify) {
+      const work = __privateGet(this, _waiting5).get(workId2);
+      if (!work) return void 0;
+      const now2 = __privateMethod(this, _ReadResponseDesk_instances, now_fn3).call(this);
+      const due2 = work.idle ? work.deadline : Math.min(work.notBefore, work.deadline);
+      work.waiters.add(notify);
+      return { afterMillis: Math.max(0, due2 - now2), cancel: () => {
+        work.waiters.delete(notify);
+      } };
+    }
+    /** Read readiness for `workspace` changed: every read waiting on it may continue now. */
+    readinessChanged(workspace) {
+      const now2 = __privateMethod(this, _ReadResponseDesk_instances, now_fn3).call(this);
+      for (const work of __privateGet(this, _waiting5).values()) {
+        if (work.dependency.workspace !== workspace) continue;
+        work.idle = false;
+        if (work.notBefore > now2) work.notBefore = now2;
+        const waiters = [...work.waiters];
+        work.waiters.clear();
+        for (const notify of waiters) notify();
+      }
+    }
     clear() {
+      const waiters = [...__privateGet(this, _waiting5).values()].flatMap((work) => [...work.waiters]);
       __privateGet(this, _waiting5).clear();
+      for (const notify of waiters) notify();
     }
   };
   _waiting5 = new WeakMap();
   _clock8 = new WeakMap();
   _tick = new WeakMap();
+  _owe = new WeakMap();
   _read2 = new WeakMap();
   _sequence9 = new WeakMap();
   _ReadResponseDesk_instances = new WeakSet();
   now_fn3 = function() {
     return Number(__privateGet(this, _clock8).monotonicNanoseconds() / 1000000n);
   };
+  /** The protocol wake is a bounded re-poll inside the read's retention deadline, never the raw backoff. */
   pending_fn = function(workId2, work, now2) {
+    const due2 = work.idle ? READ_RESUME_MAX_MILLIS : work.notBefore - now2;
+    const resumeAfterMillis = Math.max(0, Math.min(due2, work.deadline - now2, READ_RESUME_MAX_MILLIS));
     return { case: "pending", value: create(LocalReadPendingSchema, {
       workId: workId2,
-      resumeAfterMillis: Math.max(0, work.notBefore - now2)
+      resumeAfterMillis: Number.isFinite(resumeAfterMillis) ? Math.ceil(resumeAfterMillis) : READ_RESUME_MAX_MILLIS
     }) };
   };
 
@@ -25373,13 +25551,15 @@
     DependencyAdvanced: "dependency_advanced",
     RebornRemotely: "reborn_remotely",
     LocalCopyDropAuthorized: "local_copy_drop_authorized",
-    LocalCopyUnreadable: "local_copy_unreadable"
+    LocalCopyUnreadable: "local_copy_unreadable",
+    RuntimeStarted: "runtime_started"
   });
   var ReplicaFollowEffectKind = Object.freeze({
     ScheduleWake: "schedule_wake",
     RunSync: "run_sync",
     RefreshCredential: "refresh_credential"
   });
+  var KERNEL_REFUSAL_EVENT_FLOOR_MILLIS = 1e4;
   var boundedRetry = (policy, attempt) => Math.min(policy.fallbackMillis, Math.max(250, policy.debounceMillis) * 2 ** Math.min(attempt - 1, 20));
   var attempts = (state) => {
     switch (state.case) {
@@ -25406,13 +25586,14 @@
     state: { case: ReplicaFollowPhase.Due, dueAtUnixMillis: atUnixMillis },
     effects: [{ case: ReplicaFollowEffectKind.ScheduleWake, atUnixMillis }]
   });
-  var run = (attempt, replaceLocalHead, warmingSinceUnixMillis) => ({
+  var run = (attempt, replaceLocalHead, warmingSinceUnixMillis, refused) => ({
     state: {
       case: ReplicaFollowPhase.Running,
       attempt,
       observed: false,
       ...replaceLocalHead === void 0 ? {} : { replaceLocalHead },
-      ...warmingSinceUnixMillis === void 0 ? {} : { warmingSinceUnixMillis }
+      ...warmingSinceUnixMillis === void 0 ? {} : { warmingSinceUnixMillis },
+      ...refused === void 0 ? {} : { refused }
     },
     effects: [{ case: ReplicaFollowEffectKind.RunSync }]
   });
@@ -25421,6 +25602,16 @@
     effects: [{ case: ReplicaFollowEffectKind.ScheduleWake, atUnixMillis }]
   });
   var quiet = (state) => ({ state, effects: [] });
+  var blockedRefusal = (state) => state.case === ReplicaFollowPhase.Backoff && state.refusal?.blocked ? state.refusal : void 0;
+  var refusedEvent = (state, refusal2, nowUnixMillis) => {
+    const earliest = Math.max(nowUnixMillis, refusal2.atUnixMillis + KERNEL_REFUSAL_EVENT_FLOOR_MILLIS);
+    const rerunAtUnixMillis = refusal2.rerunAtUnixMillis === void 0 ? earliest : Math.min(refusal2.rerunAtUnixMillis, earliest);
+    return {
+      state: { ...state, refusal: { ...refusal2, rerunAtUnixMillis } },
+      effects: [{ case: ReplicaFollowEffectKind.ScheduleWake, atUnixMillis: rerunAtUnixMillis }]
+    };
+  };
+  var refusedByKernel = (state) => state.case === ReplicaFollowPhase.Backoff && (state.refusal !== void 0 || deterministicKernelRefusal(state.failure) !== void 0);
   function reduceReplicaFollow(state, event, policy) {
     switch (event.case) {
       case ReplicaFollowEventKind.Activate:
@@ -25433,6 +25624,9 @@
         if (state.case === ReplicaFollowPhase.Running) {
           return { state: { ...state, observed: true }, effects: [] };
         }
+        if (state.case === ReplicaFollowPhase.Backoff && state.refusal?.blocked) {
+          return refusedEvent(state, state.refusal, event.nowUnixMillis);
+        }
         if (state.case === ReplicaFollowPhase.RebornRemotely || state.case === ReplicaFollowPhase.LocalCopyUnreadable) return quiet(state);
         if (state.case === ReplicaFollowPhase.InvalidCredential) {
           return {
@@ -25442,6 +25636,9 @@
         }
         return due(event.nowUnixMillis);
       case ReplicaFollowEventKind.Reconnected:
+        if (state.case === ReplicaFollowPhase.Backoff && state.refusal?.blocked) {
+          return refusedEvent(state, state.refusal, event.nowUnixMillis);
+        }
         switch (state.case) {
           case ReplicaFollowPhase.Running:
             return { state: { ...state, observed: true }, effects: [] };
@@ -25487,15 +25684,25 @@
             }
             return run(state.attempt + 1, state.expectedLocalHead);
           case ReplicaFollowPhase.Offline:
-          case ReplicaFollowPhase.Backoff:
+          case ReplicaFollowPhase.Backoff: {
+            const blocked = blockedRefusal(state);
+            if (blocked) {
+              if (blocked.rerunAtUnixMillis === void 0) return quiet(state);
+              if (event.nowUnixMillis < blocked.rerunAtUnixMillis) {
+                return { state, effects: [{ case: ReplicaFollowEffectKind.ScheduleWake, atUnixMillis: blocked.rerunAtUnixMillis }] };
+              }
+              return run(state.attempt + 1, void 0, void 0, state.failure);
+            }
             if (event.nowUnixMillis < state.retryAtUnixMillis) {
               return { state, effects: [{ case: ReplicaFollowEffectKind.ScheduleWake, atUnixMillis: state.retryAtUnixMillis }] };
             }
             return run(
               state.attempt + 1,
               void 0,
-              state.case === ReplicaFollowPhase.Backoff ? state.warming?.sinceUnixMillis : void 0
+              state.case === ReplicaFollowPhase.Backoff ? state.warming?.sinceUnixMillis : void 0,
+              state.case === ReplicaFollowPhase.Backoff && state.refusal ? state.failure : void 0
             );
+          }
           case ReplicaFollowPhase.InvalidCredential:
             if (!state.refreshDue && event.nowUnixMillis < state.retryAtUnixMillis) {
               return { state, effects: [{ case: ReplicaFollowEffectKind.ScheduleWake, atUnixMillis: state.retryAtUnixMillis }] };
@@ -25572,6 +25779,31 @@
         };
       }
       case ReplicaFollowEventKind.Failed: {
+        if (event.refusal && !(state.case === ReplicaFollowPhase.Running && state.replaceLocalHead !== void 0)) {
+          const attempt2 = Math.max(1, attempts(state));
+          const blocked = state.case === ReplicaFollowPhase.Running && state.refused === event.failure || state.case === ReplicaFollowPhase.Backoff && state.refusal !== void 0 && state.failure === event.failure;
+          const refusal2 = {
+            code: event.refusal.code,
+            blocked,
+            runtime: event.refusal.runtime,
+            atUnixMillis: event.nowUnixMillis
+          };
+          if (!blocked) {
+            const retryAtUnixMillis2 = event.nowUnixMillis + boundedRetry(policy, attempt2);
+            return {
+              state: { case: ReplicaFollowPhase.Backoff, attempt: attempt2, retryAtUnixMillis: retryAtUnixMillis2, failure: event.failure, refusal: refusal2 },
+              effects: [{ case: ReplicaFollowEffectKind.ScheduleWake, atUnixMillis: retryAtUnixMillis2 }]
+            };
+          }
+          const waiting = {
+            case: ReplicaFollowPhase.Backoff,
+            attempt: attempt2,
+            retryAtUnixMillis: event.nowUnixMillis,
+            failure: event.failure,
+            refusal: refusal2
+          };
+          return state.case === ReplicaFollowPhase.Running && state.observed ? refusedEvent(waiting, refusal2, event.nowUnixMillis) : quiet(waiting);
+        }
         if (state.case === ReplicaFollowPhase.Running && state.observed) {
           return due(event.nowUnixMillis);
         }
@@ -25609,6 +25841,11 @@
         return quiet({ case: ReplicaFollowPhase.RebornRemotely, rebirth: event.rebirth });
       case ReplicaFollowEventKind.LocalCopyUnreadable:
         return quiet({ case: ReplicaFollowPhase.LocalCopyUnreadable, format: event.format });
+      case ReplicaFollowEventKind.RuntimeStarted:
+        if (state.case === ReplicaFollowPhase.Backoff && refusedByKernel(state) && state.refusal?.runtime !== event.runtime) {
+          return due(event.nowUnixMillis);
+        }
+        return quiet(state);
       case ReplicaFollowEventKind.LocalCopyDropAuthorized:
         if (state.case === ReplicaFollowPhase.Running) return invalid2(state, event);
         return replacing(event.expectedLocalHead, 0, event.nowUnixMillis);
@@ -25635,9 +25872,9 @@
     debounceMillis: 1e3,
     fallbackMillis: 6e4
   });
-  var _desk, _clock11, _recovered, _placementRecheck, _replicaId, _birthRefusals, _ReplicaFollowController_instances, quarantineChild_fn, event_fn, binding_fn, now_fn5;
+  var _desk, _clock11, _recovered, _placementRecheck, _replicaId, _birthRefusals, _runtime, _ReplicaFollowController_instances, quarantineChild_fn, event_fn, binding_fn, now_fn5;
   var ReplicaFollowController = class {
-    constructor(desk, clock2, replicaId, birthRefusals) {
+    constructor(desk, clock2, replicaId, birthRefusals, runtime = "unidentified") {
       __privateAdd(this, _ReplicaFollowController_instances);
       __privateAdd(this, _desk);
       __privateAdd(this, _clock11);
@@ -25658,10 +25895,14 @@
       __privateAdd(this, _replicaId);
       /** Local children whose births custody refused (CAP-804): quarantined, never followed. */
       __privateAdd(this, _birthRefusals);
+      /** The kernel/runtime identity this process runs: a refusal is recorded under it, and a refusal
+       * drawn under another identity is retried once when this process starts. */
+      __privateAdd(this, _runtime);
       __privateSet(this, _desk, desk);
       __privateSet(this, _clock11, clock2);
       __privateSet(this, _replicaId, replicaId);
       __privateSet(this, _birthRefusals, birthRefusals ?? new BirthRefusalRegister(new MemoryPeerDeskStore()));
+      __privateSet(this, _runtime, runtime);
     }
     /** The durable quarantine of a local child whose birth custody refused; undefined otherwise. */
     birthRefusal(workspace) {
@@ -25750,6 +25991,13 @@
     recover() {
       const now2 = __privateMethod(this, _ReplicaFollowController_instances, now_fn5).call(this);
       if (!__privateGet(this, _recovered)) {
+        for (const follow of __privateGet(this, _desk).all()) {
+          __privateGet(this, _desk).transition(follow.spec.workspace, {
+            case: ReplicaFollowEventKind.RuntimeStarted,
+            nowUnixMillis: now2,
+            runtime: __privateGet(this, _runtime)
+          });
+        }
         for (const follow of __privateGet(this, _desk).all()) {
           if (follow.state.case === ReplicaFollowPhase.Settled || follow.state.case === ReplicaFollowPhase.AwaitingDependency) {
             __privateGet(this, _placementRecheck).add(follow.spec.workspace);
@@ -25838,11 +26086,12 @@
     placementAnnounced(workspace) {
       if (!this.followForWorkspace(workspace)) return void 0;
       __privateGet(this, _placementRecheck).add(workspace);
-      return this.reconnected(workspace);
+      return this.reconnected(workspace, true);
     }
-    /** The upstream live link opened or reopened: reconcile once for missed pushes. */
-    reconnected(workspace) {
-      return __privateMethod(this, _ReplicaFollowController_instances, event_fn).call(this, workspace, ReplicaFollowEventKind.Reconnected);
+    /** The upstream live link opened or reopened: reconcile once for missed pushes. With
+     * `remoteAdvanced`, the upstream announced a new frontier. Either re-runs a blocked refusal. */
+    reconnected(workspace, remoteAdvanced = false) {
+      return __privateMethod(this, _ReplicaFollowController_instances, event_fn).call(this, workspace, ReplicaFollowEventKind.Reconnected, remoteAdvanced);
     }
     /** Another workspace advanced or settled; every held dependency gets one retry. */
     dependencyAdvanced(except) {
@@ -25993,7 +26242,9 @@
      * still opening the workspace and named when to ask again. */
     failed(workspace, error, custodianRetryAfterMillis) {
       if (!__privateGet(this, _recovered)) this.recover();
-      custodianRetryAfterMillis ?? (custodianRetryAfterMillis = warmingFromFailureMessage(error instanceof Error ? error.message : String(error)));
+      const refusal2 = deterministicKernelRefusal(error);
+      if (refusal2 !== void 0) custodianRetryAfterMillis = void 0;
+      else custodianRetryAfterMillis ?? (custodianRetryAfterMillis = warmingFromFailureMessage(error instanceof Error ? error.message : String(error)));
       if (!__privateGet(this, _desk).get(workspace)) return;
       const format = localCopyFormatRefusal(error);
       if (format !== void 0) {
@@ -26008,9 +26259,15 @@
         case: ReplicaFollowEventKind.Failed,
         nowUnixMillis: __privateMethod(this, _ReplicaFollowController_instances, now_fn5).call(this),
         failure: error instanceof Error ? error.message : String(error),
-        ...custodianRetryAfterMillis === void 0 ? {} : { custodianRetryAfterMillis }
+        ...custodianRetryAfterMillis === void 0 ? {} : { custodianRetryAfterMillis },
+        ...refusal2 === void 0 ? {} : { refusal: { code: refusal2.code, runtime: __privateGet(this, _runtime) } }
       });
     }
+    /** The kernel refusal behind this follow's backoff (`blocked` once the kernel repeated it). */
+    refusal(workspace) {
+      const state = this.followForWorkspace(workspace)?.state;
+      return state?.case === ReplicaFollowPhase.Backoff ? state.refusal : void 0;
+    }
     /** Closing an interaction realm must not erase a peer-owned follow. */
     closeInteractionRealm() {
     }
@@ -26021,6 +26278,7 @@
   _placementRecheck = new WeakMap();
   _replicaId = new WeakMap();
   _birthRefusals = new WeakMap();
+  _runtime = new WeakMap();
   _ReplicaFollowController_instances = new WeakSet();
   /**
    * QUARANTINE a local child whose birth custody refused: record it durably and stop its follow, so
@@ -26032,11 +26290,11 @@
     __privateGet(this, _desk).stop(child);
     __privateGet(this, _placementRecheck).delete(child);
   };
-  event_fn = function(workspace, kind) {
+  event_fn = function(workspace, kind, remoteAdvanced = false) {
     const follow = __privateGet(this, _recovered) ? __privateGet(this, _desk).get(workspace) : void 0;
     if (!follow) return void 0;
     const nowUnixMillis = __privateMethod(this, _ReplicaFollowController_instances, now_fn5).call(this);
-    __privateGet(this, _desk).transition(workspace, { case: kind, nowUnixMillis });
+    __privateGet(this, _desk).transition(workspace, kind === ReplicaFollowEventKind.Reconnected && remoteAdvanced ? { case: kind, nowUnixMillis, remoteAdvanced } : { case: kind, nowUnixMillis });
     const nextDueAt = dueAt(__privateGet(this, _desk).get(workspace));
     return nextDueAt === void 0 ? void 0 : Math.max(0, nextDueAt - nowUnixMillis);
   };
@@ -26068,9 +26326,12 @@
       case ReplicaFollowPhase.RebornRemotely:
       case ReplicaFollowPhase.LocalCopyUnreadable:
         return void 0;
+      case ReplicaFollowPhase.Backoff: {
+        const blocked = blockedRefusal(follow.state);
+        return blocked ? blocked.rerunAtUnixMillis : follow.state.retryAtUnixMillis;
+      }
       case ReplicaFollowPhase.Offline:
       case ReplicaFollowPhase.InvalidCredential:
-      case ReplicaFollowPhase.Backoff:
         return follow.state.retryAtUnixMillis;
       default: {
         const exhaustive = follow.state;
@@ -26086,6 +26347,11 @@
     return nextDueAt === void 0 ? void 0 : Math.max(0, nextDueAt - nowUnixMillis);
   }
 
+  // ../src/runtime/runtime_identity.ts
+  init_define_NOMOS_KERNEL_RELEASE();
+  init_shims();
+  var PEER_RUNTIME_IDENTITY = "0.116.4" ? `@githolon/runtime@${"0.116.4"}` : "@githolon/runtime@unbundled";
+
   // ../src/runtime/replica_follow_desk.ts
   init_define_NOMOS_KERNEL_RELEASE();
   init_shims();
@@ -26115,6 +26381,16 @@
       ...Number.isFinite(warming.hintMillis) ? { hintMillis: warming.hintMillis } : {}
     } } : {};
   };
+  var decodeRefusal = (value) => {
+    const refusal2 = value;
+    return refusal2 && typeof refusal2.code === "string" && typeof refusal2.runtime === "string" && Number.isFinite(refusal2.atUnixMillis) ? { refusal: {
+      code: refusal2.code,
+      blocked: refusal2.blocked === true,
+      runtime: refusal2.runtime,
+      atUnixMillis: refusal2.atUnixMillis,
+      ...Number.isFinite(refusal2.rerunAtUnixMillis) ? { rerunAtUnixMillis: refusal2.rerunAtUnixMillis } : {}
+    } } : {};
+  };
   var decodeState = (record, value) => {
     if (!value || typeof value !== "object") throw corrupt(record, "state is not an object");
     const state = value;
@@ -26129,7 +26405,8 @@
           attempt: state.attempt,
           observed: state.observed === true,
           ...state.replaceLocalHead === void 0 ? {} : { replaceLocalHead: state.replaceLocalHead },
-          ...Number.isFinite(state.warmingSinceUnixMillis) ? { warmingSinceUnixMillis: state.warmingSinceUnixMillis } : {}
+          ...Number.isFinite(state.warmingSinceUnixMillis) ? { warmingSinceUnixMillis: state.warmingSinceUnixMillis } : {},
+          ...typeof state.refused === "string" ? { refused: state.refused } : {}
         };
       case ReplicaFollowPhase.Settled:
         return {
@@ -26161,7 +26438,8 @@
           attempt: state.attempt,
           retryAtUnixMillis: state.retryAtUnixMillis,
           failure: state.failure,
-          ...decodeWarming(state.warming)
+          ...decodeWarming(state.warming),
+          ...decodeRefusal(state.refusal)
         };
       case ReplicaFollowPhase.RebornRemotely: {
         const rebirth = state.rebirth ?? {};
@@ -26350,9 +26628,15 @@
             break;
           }
           case ReplicaFollowPhase.Offline:
-          case ReplicaFollowPhase.Backoff:
-            wakes.push({ workspace: follow.spec.workspace, atUnixMillis: follow.state.retryAtUnixMillis });
+          case ReplicaFollowPhase.Backoff: {
+            const blocked = blockedRefusal(follow.state);
+            if (blocked && blocked.rerunAtUnixMillis === void 0) break;
+            wakes.push({
+              workspace: follow.spec.workspace,
+              atUnixMillis: blocked?.rerunAtUnixMillis ?? follow.state.retryAtUnixMillis
+            });
             break;
+          }
           case ReplicaFollowPhase.InvalidCredential:
             wakes.push({
               workspace: follow.spec.workspace,
@@ -27045,7 +27329,9 @@
     message,
     ...retryAfterMillis === void 0 ? {} : { retryAfterMillis }
   }) });
-  var _kernel12, _now, _historyWanted, _sealed, _checkpoints3, _slices, _cachedBytes, _LiveStreamServer_instances, frontier_fn, batch_fn, checkpoint_fn, current_fn, sealedOnMain_fn, outcomes_fn, build_fn, evict_fn, history_fn, buildSlice_fn, ref_fn;
+  var OFF_MAIN_AFTER_MILLIS = 6e4;
+  var MAX_UNFOUND_HEADS = 1024;
+  var _kernel12, _now, _historyWanted, _sealed, _checkpoints3, _slices, _cachedBytes, _unfound, _LiveStreamServer_instances, frontier_fn, shallow_fn, batch_fn, checkpoint_fn, current_fn, sealedOnMain_fn, outcomes_fn, build_fn, evict_fn, history_fn, buildSlice_fn, ref_fn;
   var LiveStreamServer = class {
     constructor(kernel, now2 = Date.now, historyWanted = () => {
     }, sealed = () => void 0) {
@@ -27062,6 +27348,10 @@
       /** By workspace: the history slices copies are fetching (a few, newest last). */
       __privateAdd(this, _slices, /* @__PURE__ */ new Map());
       __privateAdd(this, _cachedBytes, 0);
+      /** By workspace and asked head: when this peer first answered "acquiring its own history" to a level
+       * ask from a head it could not find. A shallow custody can never prove the head is off its main (its
+       * walk is never `complete`), so after OFF_MAIN_AFTER_MILLIS of the same answer it says so anyway. */
+      __privateAdd(this, _unfound, /* @__PURE__ */ new Map());
       __privateSet(this, _kernel12, kernel);
       __privateSet(this, _sealed, sealed);
       __privateSet(this, _historyWanted, historyWanted);
@@ -27098,6 +27388,7 @@
   _checkpoints3 = new WeakMap();
   _slices = new WeakMap();
   _cachedBytes = new WeakMap();
+  _unfound = new WeakMap();
   _LiveStreamServer_instances = new WeakSet();
   frontier_fn = function(workspace, requestId, frontier) {
     const mount = workspaceMount(workspace);
@@ -27116,9 +27407,12 @@
     if (!head) return [...answer, ...__privateMethod(this, _LiveStreamServer_instances, checkpoint_fn).call(this, workspace, requestId, create(LiveCheckpointRequestSchema))];
     if (head === main) return answer;
     let behind;
+    let offMain = false;
     try {
       const summary = __privateGet(this, _kernel12).historySummary(mount, requestId, head, main);
       behind = summary.reachedBase ? summary.commitCount : void 0;
+      offMain = !summary.reachedBase && (summary.complete || !__privateMethod(this, _LiveStreamServer_instances, shallow_fn).call(this, mount, requestId));
+      if (summary.reachedBase) __privateGet(this, _unfound).delete(`${workspace}\0${head}`);
     } catch {
       behind = void 0;
     }
@@ -27127,6 +27421,22 @@
       if (remountAfter > 0) {
         return [...answer, ...__privateMethod(this, _LiveStreamServer_instances, checkpoint_fn).call(this, workspace, requestId, create(LiveCheckpointRequestSchema), behind ?? 0n)];
       }
+      const key = `${workspace}\0${head}`;
+      const firstUnfound = __privateGet(this, _unfound).get(key);
+      if (!offMain && firstUnfound === void 0) {
+        if (__privateGet(this, _unfound).size >= MAX_UNFOUND_HEADS) __privateGet(this, _unfound).delete(__privateGet(this, _unfound).keys().next().value);
+        __privateGet(this, _unfound).set(key, __privateGet(this, _now).call(this));
+      } else if (!offMain && __privateGet(this, _now).call(this) - firstUnfound >= OFF_MAIN_AFTER_MILLIS) {
+        offMain = true;
+      }
+      if (offMain) {
+        __privateGet(this, _unfound).delete(key);
+        return [...answer, refusal(
+          "",
+          "nomos.stream.off_main",
+          "the copy's head is not on this peer's main; it must converge its own work, not level from it"
+        )];
+      }
       __privateGet(this, _historyWanted).call(this, workspace);
       return [...answer, refusal(
         "",
@@ -27138,6 +27448,17 @@
     const maxOffers = Math.min(Math.max(1, frontier.maxOffers || MAX_STREAM_BATCH_OFFERS), MAX_STREAM_BATCH_OFFERS);
     return [...answer, __privateMethod(this, _LiveStreamServer_instances, batch_fn).call(this, workspace, requestId, head, main, maxOffers)];
   };
+  /** Whether this peer's custody of the workspace is shallow. Unknown counts as shallow: it keeps the
+   * existing wait for history rather than calling a head off main. */
+  shallow_fn = function(mount, requestId) {
+    const boundaries = __privateGet(this, _kernel12).shallowBoundaries;
+    if (!boundaries) return true;
+    try {
+      return boundaries.call(__privateGet(this, _kernel12), mount, requestId).length > 0;
+    } catch {
+      return true;
+    }
+  };
   /**
    * The `maxOffers` offers directly above `base`, as the commits this peer admitted them in: one
    * bounded walk and one bounded pack (O(batch)). The copy's kernel adopts exactly these commits on
@@ -27515,12 +27836,11 @@
   };
   _commits = new WeakMap();
   _requests = new WeakMap();
-  var _links, _pending3, _own, _progress, _progressOwedSince, _recounting, _sequence12, _requestId3, _closures, _LiveCorrespondenceDesk_instances, recordClosure_fn, closeByRuntime_fn, count_fn, chain_fn, holds_fn, cursor_fn, effect_fn, open_fn2, send_fn, admitted_fn, declined_fn, announced_fn, placementAnnounced_fn, outcomesDigest_fn, outcomesAnnounced_fn, outcomesArrived_fn, hello_fn, fittingBatch_fn;
+  var _links, _own, _progress, _progressOwedSince, _recounting, _sequence12, _requestId3, _closures, _LiveCorrespondenceDesk_instances, recordClosure_fn, closeByRuntime_fn, count_fn, chain_fn, holds_fn, heldPeerMain_fn, cursor_fn, effect_fn, open_fn2, send_fn, admitted_fn, declined_fn, announced_fn, placementAnnounced_fn, outcomesDigest_fn, outcomesAnnounced_fn, outcomesArrived_fn, fittingBatch_fn;
   var LiveCorrespondenceDesk = class {
     constructor(kernel, events, clock2, relayOrigin, staging) {
       __privateAdd(this, _LiveCorrespondenceDesk_instances);
       __privateAdd(this, _links, /* @__PURE__ */ new Map());
-      __privateAdd(this, _pending3, /* @__PURE__ */ new Map());
       /** What procedures asked of each workspace's stream, and what it delivered (peer_catchup.md). */
       __publicField(this, "inbound");
       __privateAdd(this, _own, new OwnOffers());
@@ -27556,13 +27876,6 @@
        * never held. Absent (a custodian, a relay, a test), every write goes out on the next drive.
        */
       __publicField(this, "writeBurst");
-      /**
-       * An application peer's receive step (CAP-757; sized by time, CAP-762). A received batch of other
-       * senders' offers larger than one step is not admitted on the socket, in one kernel-thread hold:
-       * the follow receives it instead, in yielding steps of the policy's current size. Absent (a
-       * custodian, a relay, a test), every received batch is admitted as it arrives.
-       */
-      __publicField(this, "receiveStep");
       /** The last progress counted per workspace, served while a burst holds recounting back. */
       __privateAdd(this, _progress, /* @__PURE__ */ new Map());
       /** When a held-back progress recount became owed; it reports at the burst's next due point. */
@@ -27616,10 +27929,12 @@
           sent: link.stream?.sent,
           unansweredAgesMs: (link.stream?.unanswered ?? []).map((entry) => Number((now2 - (entry.due - LIVE_ANSWER_WINDOW)) / 1000000n)),
           custodianLocal: link.custodian?.local,
-          convergeDue: link.convergeDue !== void 0
+          convergeDue: link.convergeDue !== void 0,
+          resident: false
         };
         try {
           if (this.kernel.isResident(link.binding.workspace) !== false) {
+            state.resident = true;
             const mount = workspaceMount(link.binding.workspace);
             state.head = this.kernel.head(mount, ++__privateWrapper(this, _requestId3)._);
             state.tracked = this.kernel.resolveRef(mount, ++__privateWrapper(this, _requestId3)._, TRACKED_MAIN2);
@@ -27728,7 +28043,7 @@
         evidencePack: options.carryCommits || intents.some((intent) => intent.transportRequirement === IntentTransportRequirement.COMMIT_TREE) ? this.kernel.packDelta(mount, requestId, batchHead, base) : new Uint8Array()
       });
     }
-    receive(request, receipt) {
+    receive(receipt) {
       const link = [...__privateGet(this, _links).values()].find((item) => item.id === receipt.connectionId);
       if (!link) return;
       if (receipt.observation.case === "closed" || receipt.observation.case === "closure") {
@@ -27742,6 +28057,7 @@
         link.ownMains = [];
         delete link.lastAnnounced;
         delete link.lastPlacementAnnounced;
+        link.peerMain = void 0;
         link.dirty = true;
         link.due = this.clock.monotonicNanoseconds() + BigInt(Math.min(3e4, 250 * 2 ** Math.min(link.failures++, 7))) * 1000000n;
         return;
@@ -27751,7 +28067,6 @@
         link.openedAt = this.clock.monotonicNanoseconds();
         link.failures = 0;
         link.unheard = void 0;
-        if (!link.publisher) __privateMethod(this, _LiveCorrespondenceDesk_instances, hello_fn).call(this, link);
         if (!link.publisher) this.inbound.opened(link.binding.workspace);
         this.linkOpened?.(link.binding.workspace);
         return;
@@ -27785,18 +28100,6 @@
       if (this.inbound.frame(link.binding.workspace, frame2.message)) return;
       if (frame2.message.case === "frontier") {
         __privateMethod(this, _LiveCorrespondenceDesk_instances, announced_fn).call(this, link, frame2.message.value.head);
-        if (this.kernel.isResident(link.binding.workspace) === false) return;
-        if (!frame2.message.value.response) {
-          __privateMethod(this, _LiveCorrespondenceDesk_instances, send_fn).call(this, link, { case: "frontier", value: {
-            head: this.kernel.head(workspaceMount(link.binding.workspace), ++__privateWrapper(this, _requestId3)._) ?? "",
-            response: true
-          } });
-        }
-        try {
-          const batch2 = this.export(link.binding, frame2.message.value.head, ++__privateWrapper(this, _requestId3)._);
-          if (batch2.source.case === "inline" && batch2.source.value.offers.length) __privateMethod(this, _LiveCorrespondenceDesk_instances, send_fn).call(this, link, { case: "offers", value: batch2 });
-        } catch {
-        }
         return;
       }
       if (frame2.message.case === "admission") {
@@ -27804,57 +28107,18 @@
         this.progressChanged?.(link.binding.workspace);
         return;
       }
-      if (frame2.message.case !== "offers") return;
-      const batch = frame2.message.value;
-      if (batch.protocolVersion !== 2 || !batch.requestId || batch.source.case !== "inline" || !batch.source.value.offers.length) return;
-      const offers = batch.source.value.offers.filter((offer) => !__privateGet(this, _own).hasCommit(link.binding.workspace, offer.commitOid));
-      if (!offers.length) return;
-      if (this.kernel.isResident(link.binding.workspace) === false && !this.inbound.wanted(link.binding.workspace)) {
-        this.remoteAdvanced?.(link.binding.workspace);
-        return;
-      }
-      if (this.receiveStep !== void 0 && offers.length > this.receiveStep.offers) {
-        this.remoteAdvanced?.(link.binding.workspace);
-        return;
-      }
-      if ([...__privateGet(this, _pending3).values()].some((pending) => pending.link === link && pending.bytes.length === bytes.length && pending.bytes.every((byte, index) => byte === bytes[index]))) return;
-      if (__privateGet(this, _pending3).size >= 32) return;
-      __privateGet(this, _pending3).set(request.requestId, { link, bytes });
-      return create(RuntimeRequestSchema, {
-        protocolVersion: 2,
-        requestId: request.requestId,
-        target: { workspace: link.binding.workspace, session: link.binding.replicaId },
-        // HTTP sender reconciliation controls are not part of a live proposal.
-        // Keeping fastForwardOnly while removing baseHead silently skips every
-        // offer against a nonempty local head. The Kernel judges sealed causality;
-        // live receivers neither ask for a return archive nor confirm the sender.
-        command: { case: "admitCustodyOffers", value: create(CustodyOfferBatchRequestSchema, {
-          ...batch,
-          baseHead: void 0,
-          observedHead: void 0,
-          fastForwardOnly: false,
-          ...offers.length === batch.source.value.offers.length ? {} : { source: { case: "inline", value: { ...batch.source.value, offers } } }
-        }) }
-      });
+    }
+    /** The newest local commit the custodian admitted unchanged over this workspace's open link: its
+     * main holds that commit, sealed or not, so it is no work to offer (CAP-838). */
+    admittedLocal(workspace) {
+      const link = __privateGet(this, _links).get(workspace);
+      const cursor = link?.state === "open" && !link.publisher ? link.custodian : void 0;
+      return cursor && cursor.main === cursor.local ? cursor.local : void 0;
     }
     /** Offers this replica sent another way (the HTTP lane): their echo on the live link is its own. */
     offered(workspace, commitOids) {
       __privateGet(this, _own).commits(workspace, commitOids);
     }
-    /** Whether this request is the admission of a batch relayed to this follower over its live link.
-     * Such an admission is never answered to a sender, so it keeps no custody receipts (CAP-759). */
-    relayed(requestId) {
-      return __privateGet(this, _pending3).has(requestId);
-    }
-    settled(request, response) {
-      if (response.outcome.case === "correspondencePending" || response.outcome.case === "localReadPending") return;
-      __privateGet(this, _pending3).delete(request.requestId);
-    }
-    failed(requestId) {
-      const pending = __privateGet(this, _pending3).get(requestId);
-      __privateGet(this, _pending3).delete(requestId);
-      if (pending) this.remoteAdvanced?.(pending.link.binding.workspace);
-    }
     disconnect(workspace) {
       const link = __privateGet(this, _links).get(workspace);
       if (!link) return;
@@ -27862,7 +28126,6 @@
       if (link.state === "open") this.linkClosed?.(workspace, closure);
       __privateGet(this, _links).delete(workspace);
       __privateGet(this, _progress).delete(workspace);
-      for (const [id, pending] of __privateGet(this, _pending3)) if (pending.link === link) __privateGet(this, _pending3).delete(id);
     }
     drive() {
       const now2 = this.clock.monotonicNanoseconds();
@@ -27912,7 +28175,8 @@
                 link.custodian = void 0;
               }
               __privateMethod(this, _LiveCorrespondenceDesk_instances, cursor_fn).call(this, link, mount);
-              const answered2 = link.publisher ? link.published ?? (link.published = head ?? "") : link.custodian?.local ?? this.kernel.resolveRef(mount, ++__privateWrapper(this, _requestId3)._, TRACKED_MAIN2) ?? "";
+              let answered2 = link.publisher ? link.published ?? (link.published = head ?? "") : link.custodian?.local ?? this.kernel.resolveRef(mount, ++__privateWrapper(this, _requestId3)._, TRACKED_MAIN2) ?? "";
+              if (!link.publisher && !link.custodian) answered2 = __privateMethod(this, _LiveCorrespondenceDesk_instances, heldPeerMain_fn).call(this, link, mount, head, answered2) ?? answered2;
               const fence = link.custodian?.main ?? answered2;
               if (link.stream && !(head && __privateMethod(this, _LiveCorrespondenceDesk_instances, holds_fn).call(this, mount, link.stream.sent, head))) {
                 link.stream = void 0;
@@ -27985,11 +28249,9 @@
     }
     close() {
       for (const workspace of [...__privateGet(this, _links).keys()]) this.disconnect(workspace);
-      __privateGet(this, _pending3).clear();
     }
   };
   _links = new WeakMap();
-  _pending3 = new WeakMap();
   _own = new WeakMap();
   _progress = new WeakMap();
   _progressOwedSince = new WeakMap();
@@ -28035,7 +28297,7 @@
   };
   count_fn = function(link, mount) {
     const head = this.kernel.head(mount, ++__privateWrapper(this, _requestId3)._);
-    const acknowledged = __privateMethod(this, _LiveCorrespondenceDesk_instances, cursor_fn).call(this, link, mount)?.local ?? this.kernel.resolveRef(mount, ++__privateWrapper(this, _requestId3)._, TRACKED_MAIN2);
+    const acknowledged = __privateMethod(this, _LiveCorrespondenceDesk_instances, cursor_fn).call(this, link, mount)?.local ?? __privateMethod(this, _LiveCorrespondenceDesk_instances, heldPeerMain_fn).call(this, link, mount, head) ?? this.kernel.resolveRef(mount, ++__privateWrapper(this, _requestId3)._, TRACKED_MAIN2);
     if (!head || !acknowledged) return void 0;
     const count = (base, tip) => {
       if (base === tip) return 0;
@@ -28069,6 +28331,14 @@
   holds_fn = function(mount, base, tip) {
     return __privateMethod(this, _LiveCorrespondenceDesk_instances, chain_fn).call(this, mount, base, tip)?.reachedBase === true;
   };
+  /** The custodian's main as last heard, when this copy holds it on its own head's chain above the
+   * sealed bookmark: the commits up to it came from the stream and are the custodian's (CAP-838). */
+  heldPeerMain_fn = function(link, mount, head, tracked = this.kernel.resolveRef(mount, ++__privateWrapper(this, _requestId3)._, TRACKED_MAIN2)) {
+    const main = link.peerMain;
+    if (!main || !head || main === tracked) return void 0;
+    if (tracked && !__privateMethod(this, _LiveCorrespondenceDesk_instances, holds_fn).call(this, mount, tracked, main)) return void 0;
+    return __privateMethod(this, _LiveCorrespondenceDesk_instances, holds_fn).call(this, mount, main, head) ? main : void 0;
+  };
   /** This connection's admission cursor, while it still leads the saved bookmark. A cursor on local
    * history (admitted, not yet sealed) remembers the bookmark it was set above; once anything else
    * moves the bookmark (a follow round adopting the custodian's main) the bookmark rules again, so
@@ -28122,9 +28392,10 @@
         ...admission.sealedMain ? { sealed: admission.sealedMain } : {}
       };
     }
-    if (!admission?.main || this.kernel.isResident(workspace) === false) return;
+    if (!admission?.main) return;
     const ownBatchHead = __privateGet(this, _own).batchHead(workspace, live.requestId);
     const ours = ownBatchHead !== void 0;
+    if (this.kernel.isResident(workspace) === false) return;
     let stale = false;
     if (ours) link.unheard = void 0;
     if (ours && link.stream) {
@@ -28212,6 +28483,7 @@
    * upstream head it already recorded. Re-announcing a known frontier - which is all an
    * upstream can do while this replica is ahead or held on a dependency - is not an event. */
   announced_fn = function(link, head) {
+    if (head) link.peerMain = head;
     if (!head || link.lastAnnounced === head) return;
     link.lastAnnounced = head;
     if (this.kernel.isResident(link.binding.workspace) === false) {
@@ -28272,14 +28544,6 @@
     transfer.retain(create(PeerGitRefsFetchedSchema, { refs: [...wanted.refs], pack }));
     this.progressChanged?.(link.binding.workspace);
   };
-  hello_fn = function(link) {
-    if (this.kernel.isResident(link.binding.workspace) === false) return;
-    const head = this.kernel.head(workspaceMount(link.binding.workspace), ++__privateWrapper(this, _requestId3)._);
-    __privateMethod(this, _LiveCorrespondenceDesk_instances, send_fn).call(this, link, { case: "frontier", value: {
-      head: head ?? "",
-      outcomesDigest: __privateMethod(this, _LiveCorrespondenceDesk_instances, outcomesDigest_fn).call(this, link.binding.workspace)
-    } });
-  };
   /**
    * A follower's next batch above `base`: up to the link's commit bound, cut down until its carried
    * commits fit LIVE_CARRIED_COMMITS_BYTES and its frame fits MAX_LIVE_FRAME_BYTES. A single commit
@@ -29319,6 +29583,7 @@
   var RECEIVED_PLACEMENT_REF = "refs/remotes/nomos/placement";
   var STREAM_BATCH_OFFERS = 64;
   var REMOUNT_AFTER_OFFERS = 128;
+  var MAX_REMOUNTS_LOST = 2;
   var HISTORY_SLICES = [8, 64, 256, 256];
   var WorkspaceSyncPhase = Object.freeze({
     Idle: "idle",
@@ -29339,13 +29604,17 @@
   var judgedThisLifetime = /* @__PURE__ */ new Map();
   function releaseSyncJudgment(workspace) {
     judgedThisLifetime.delete(workspace);
+    notContainedThisLifetime.delete(workspace);
   }
+  var notContainedThisLifetime = /* @__PURE__ */ new Map();
+  var MAX_NOT_CONTAINED = 1024;
+  var NOT_CONTAINED_REFUSALS = /* @__PURE__ */ new Set(["nomos.stream.off_main", "nomos.stream.history_required"]);
   var MAX_REBASES_PER_ROUND = 2;
   var elapsedMillis = (clock2, started) => {
     const finished = clock2.monotonicNanoseconds();
     return finished >= started ? Number(finished - started) / 1e6 : 0;
   };
-  var _kernel18, _credentials4, _clock14, _mount2, _binding, _route2, _rediscover, _reroute, _discoveredFrontier, _observePlacement, _recheckPlacement, _directoryAnswered, _placementFetched, _acquired, _streamSequence, _historySlices, _levelling, _boundaries, _sealedObserved, _command2, _requestId5, _started, _state, _localHead, _offerHead, _previousHead, _pushMillis, _pushBytes, _desiredHead, _candidateDurable, _admissionSummary, _offerReceipt, _pushError, _current3, _lastReceiptEffectId2, _offerSequence, _lastStep2, _probeOnly, _liveConnected, _establishedBase, _receiveState, _completeHistory, _lawProductsImported, _lawProductsInFlight, _shallowMounted, _fetchedLawProducts, _beforeConverge, _needsReconciliation, _offerAfterConverge, _rebaseFrom, _rebases, _parkedLocal, _replaceLocalHead, _repairMissingCommit, _receiveStep, _offered, _receiveSteps, _WorkspaceSyncWork_instances, openRound_fn, offerOrReconcile_fn, establishBase_fn, missingTrackedBase_fn, holdsLocalWork_fn, pullBeforeOffer_fn, acquire_fn, lawProductsFetch_fn, streamEffect_fn, acceptStream_fn, importStep_fn, imported_fn, historyOrMount_fn, remount_fn, beginOffer_fn, acceptOffer_fn, placementFrontier_fn, placementOnly_fn, acceptDiscovery_fn, providerCustody_fn, mountFetched_fn, lawProductsRequest_fn, acceptLawProducts_fn, providerCustodyMounted_fn, importLawProducts_fn, converge_fn2, convergeStep_fn, unrelatedLineageRefusal_fn, replaceLocal_fn, converged_fn, offerAfterRebase_fn, preservedCopy_fn, alreadyJudged_fn, rememberJudgment_fn, forgetJudgment_fn, present_fn, finishOfferOutcome_fn, finishWarming_fn, transportFailure_fn, remember_fn4, finish_fn2, cloudBase_fn, offerEndpoint_fn, workspaceEndpoint_fn, authToken_fn;
+  var _kernel18, _credentials4, _clock14, _mount2, _binding, _route2, _rediscover, _reroute, _discoveredFrontier, _observePlacement, _recheckPlacement, _directoryAnswered, _placementFetched, _acquired, _streamSequence, _historySlices, _levelling, _boundaries, _sealedObserved, _command2, _requestId5, _started, _state, _localHead, _offerHead, _previousHead, _pushMillis, _pushBytes, _desiredHead, _candidateDurable, _admissionSummary, _offerReceipt, _pushError, _current3, _lastReceiptEffectId2, _offerSequence, _lastStep2, _probeOnly, _liveConnected, _liveAdmitted, _establishedBase, _receiveState, _completeHistory, _lawProductsImported, _lawProductsInFlight, _shallowMounted, _fetchedLawProducts, _beforeConverge, _needsReconciliation, _offerAfterConverge, _rebaseFrom, _rebases, _remountsLost, _containment, _containedBookmark, _parkedLocal, _replaceLocalHead, _repairMissingCommit, _receiveStep, _offered, _receiveSteps, _WorkspaceSyncWork_instances, openRound_fn, mayBeContained_fn, custodianMainOffLocalChain_fn, askContainment_fn, contained_fn, notContained_fn, offerOrReconcile_fn, establishBase_fn, missingTrackedBase_fn, holdsLocalWork_fn, holdsUnsyncedCommits_fn, pullBeforeOffer_fn, acquire_fn, lawProductsFetch_fn, streamEffect_fn, acceptStream_fn, importStep_fn, imported_fn, historyOrMount_fn, remount_fn, remountLost_fn, beginOffer_fn, acceptOffer_fn, placementFrontier_fn, placementOnly_fn, acceptDiscovery_fn, providerCustody_fn, mountFetched_fn, lawProductsRequest_fn, acceptLawProducts_fn, providerCustodyMounted_fn, importLawProducts_fn, converge_fn2, convergeStep_fn, unrelatedLineageRefusal_fn, replaceLocal_fn, converged_fn, offerAfterRebase_fn, preservedCopy_fn, alreadyJudged_fn, rememberJudgment_fn, forgetJudgment_fn, present_fn, finishOfferOutcome_fn, finishWarming_fn, transportFailure_fn, remember_fn4, finish_fn2, cloudBase_fn, offerEndpoint_fn, workspaceEndpoint_fn, authToken_fn;
   var WorkspaceSyncWork = class {
     constructor(args) {
       __privateAdd(this, _WorkspaceSyncWork_instances);
@@ -29398,6 +29667,7 @@
       __privateAdd(this, _lastStep2);
       __privateAdd(this, _probeOnly);
       __privateAdd(this, _liveConnected);
+      __privateAdd(this, _liveAdmitted);
       /** Set when this round adopted the upstream's own head as its base (see #establishBase). */
       __privateAdd(this, _establishedBase);
       __privateAdd(this, _receiveState);
@@ -29414,6 +29684,11 @@
       /** The custodian head this round last offered or pulled from. */
       __privateAdd(this, _rebaseFrom);
       __privateAdd(this, _rebases, 0);
+      __privateAdd(this, _remountsLost, 0);
+      /** This round's level ask is a containment question (CAP-870): on a refusal, take this path. */
+      __privateAdd(this, _containment);
+      /** The stale bookmark a contained round replaces: its custodian's main holds the local head. */
+      __privateAdd(this, _containedBookmark);
       /** Local intents this round's rebase refused and parked on the refused-offer desk. */
       __privateAdd(this, _parkedLocal, 0);
       /** An application-authorized drop: replace local custody at exactly this head. */
@@ -29430,6 +29705,7 @@
       __privateSet(this, _placementFetched, args.placementFetched);
       __privateSet(this, _probeOnly, args.probeOnly ?? false);
       __privateSet(this, _liveConnected, args.liveConnected === true);
+      __privateSet(this, _liveAdmitted, args.liveAdmitted);
       __privateSet(this, _receiveState, args.receiveState);
       __privateSet(this, _completeHistory, args.completeHistory === true);
       __privateSet(this, _repairMissingCommit, args.repairMissingCommit === true);
@@ -29585,6 +29861,7 @@
   _lastStep2 = new WeakMap();
   _probeOnly = new WeakMap();
   _liveConnected = new WeakMap();
+  _liveAdmitted = new WeakMap();
   _establishedBase = new WeakMap();
   _receiveState = new WeakMap();
   _completeHistory = new WeakMap();
@@ -29597,6 +29874,9 @@
   _offerAfterConverge = new WeakMap();
   _rebaseFrom = new WeakMap();
   _rebases = new WeakMap();
+  _remountsLost = new WeakMap();
+  _containment = new WeakMap();
+  _containedBookmark = new WeakMap();
   _parkedLocal = new WeakMap();
   _replaceLocalHead = new WeakMap();
   _repairMissingCommit = new WeakMap();
@@ -29608,9 +29888,15 @@
     if (__privateGet(this, _receiveState)) return __privateMethod(this, _WorkspaceSyncWork_instances, acquire_fn).call(this, "full");
     if (__privateGet(this, _replaceLocalHead) !== void 0) return __privateMethod(this, _WorkspaceSyncWork_instances, acquire_fn).call(this, __privateGet(this, _repairMissingCommit) ? "full" : "mount");
     if (!__privateGet(this, _localHead)) return __privateMethod(this, _WorkspaceSyncWork_instances, acquire_fn).call(this, __privateGet(this, _completeHistory) ? "full" : "mount");
-    if (__privateGet(this, _liveConnected) && !__privateGet(this, _probeOnly) && __privateMethod(this, _WorkspaceSyncWork_instances, holdsLocalWork_fn).call(this) && __privateGet(this, _previousHead)) {
-      return __privateMethod(this, _WorkspaceSyncWork_instances, offerOrReconcile_fn).call(this);
+    const unadmitted = __privateMethod(this, _WorkspaceSyncWork_instances, holdsLocalWork_fn).call(this) && __privateGet(this, _localHead) !== __privateGet(this, _liveAdmitted);
+    if (__privateGet(this, _liveConnected) && unadmitted && __privateGet(this, _previousHead)) {
+      if (__privateMethod(this, _WorkspaceSyncWork_instances, mayBeContained_fn).call(this)) return __privateMethod(this, _WorkspaceSyncWork_instances, askContainment_fn).call(this, "offer");
+      return __privateMethod(this, _WorkspaceSyncWork_instances, notContained_fn).call(this);
     }
+    if (__privateGet(this, _liveConnected) && __privateGet(this, _probeOnly) && __privateGet(this, _previousHead) && __privateMethod(this, _WorkspaceSyncWork_instances, holdsUnsyncedCommits_fn).call(this) && __privateGet(this, _command2).admit && __privateGet(this, _localHead) === __privateGet(this, _liveAdmitted)) {
+      return __privateMethod(this, _WorkspaceSyncWork_instances, acquire_fn).call(this, "level");
+    }
+    if (__privateGet(this, _liveConnected) && !__privateGet(this, _probeOnly) && !unadmitted) return __privateMethod(this, _WorkspaceSyncWork_instances, acquire_fn).call(this, "level");
     const requestId = `${__privateGet(this, _binding).replicaId}:${__privateGet(this, _requestId5)}:${this.workId}:frontier`;
     return __privateMethod(this, _WorkspaceSyncWork_instances, beginOffer_fn).call(this, encodeInlineCustodyOffer({
       session: __privateGet(this, _binding).replicaId,
@@ -29619,6 +29905,60 @@
       intents: []
     }), { case: "awaiting", requestId }, true);
   };
+  /** Whether the custodian's main may hold this copy's head: not already refused in this lifetime. */
+  mayBeContained_fn = function() {
+    return !!__privateGet(this, _localHead) && __privateGet(this, _offerHead) === void 0 && notContainedThisLifetime.get(__privateGet(this, _mount2).workspace) !== __privateGet(this, _localHead);
+  };
+  /** The probe named a custodian main that is not on this copy's own chain, so the copy's head may be
+   * on the custodian's. A main below the local head (the custodian is behind) cannot contain it. A
+   * complete copy answers a main it does not hold after one existence check, and one it holds after
+   * a walk to where the two chains join. A kernel that cannot say keeps the existing path. */
+  custodianMainOffLocalChain_fn = function() {
+    if (!__privateGet(this, _kernel18).historySummary || !__privateGet(this, _desiredHead) || !__privateGet(this, _localHead)) return false;
+    try {
+      return !__privateGet(this, _kernel18).historySummary(__privateGet(this, _mount2), __privateGet(this, _requestId5), __privateGet(this, _desiredHead), __privateGet(this, _localHead)).reachedBase;
+    } catch (error) {
+      return error instanceof KernelHistoryRequired;
+    }
+  };
+  /** Level from the local head (CAP-870). The stream answers with the custodian's commits above it
+   * (or "level") only when its main holds that head; then this round converges onto them, moves the
+   * bookmark, and offers nothing. One custodian lookup, O(commits behind); no local enumeration. */
+  askContainment_fn = function(otherwise) {
+    __privateSet(this, _containment, otherwise);
+    return __privateMethod(this, _WorkspaceSyncWork_instances, acquire_fn).call(this, "level");
+  };
+  /** The stream answered from the local head: it is on the custodian's main. The stale bookmark
+   * stays this round's to replace; the local head is the round's base from here. */
+  contained_fn = function() {
+    __privateSet(this, _containment, void 0);
+    __privateSet(this, _containedBookmark, __privateGet(this, _previousHead));
+    __privateSet(this, _previousHead, __privateGet(this, _localHead));
+  };
+  /** The custodian's main does not hold the local head (or the stream could not say): the copy holds
+   * work of its own. Go straight on to the pull/rebase/offer path. A dependency planner's probe hands
+   * the round back to it to plan the outbound suffix. */
+  notContained_fn = function(code) {
+    const otherwise = __privateGet(this, _containment) ?? "offer";
+    __privateSet(this, _containment, void 0);
+    if (code !== void 0 && NOT_CONTAINED_REFUSALS.has(code) && __privateGet(this, _localHead)) {
+      if (notContainedThisLifetime.size >= MAX_NOT_CONTAINED && !notContainedThisLifetime.has(__privateGet(this, _mount2).workspace)) {
+        notContainedThisLifetime.delete(notContainedThisLifetime.keys().next().value);
+      }
+      notContainedThisLifetime.set(__privateGet(this, _mount2).workspace, __privateGet(this, _localHead));
+    }
+    if (__privateGet(this, _probeOnly)) {
+      __privateSet(this, _needsReconciliation, true);
+      return __privateMethod(this, _WorkspaceSyncWork_instances, finish_fn2).call(this, create(SyncWorkspaceResponseSchema, {
+        workspace: __privateGet(this, _mount2).workspace,
+        currentHead: __privateGet(this, _localHead),
+        previousHead: __privateGet(this, _previousHead),
+        stillAhead: true,
+        offerReceipt: __privateGet(this, _offerReceipt)
+      }));
+    }
+    return otherwise === "pull" ? __privateMethod(this, _WorkspaceSyncWork_instances, pullBeforeOffer_fn).call(this) : __privateMethod(this, _WorkspaceSyncWork_instances, offerOrReconcile_fn).call(this);
+  };
   offerOrReconcile_fn = function() {
     var _a;
     if (__privateGet(this, _command2).admit && __privateGet(this, _localHead) && __privateGet(this, _localHead) !== __privateGet(this, _previousHead)) {
@@ -29693,7 +30033,14 @@
     return __privateGet(this, _previousHead) === void 0 && __privateGet(this, _localHead) !== void 0 && __privateGet(this, _replaceLocalHead) === void 0;
   };
   holdsLocalWork_fn = function() {
-    return __privateGet(this, _command2).admit && !!__privateGet(this, _localHead) && __privateGet(this, _localHead) !== __privateGet(this, _previousHead);
+    return __privateGet(this, _command2).admit && __privateMethod(this, _WorkspaceSyncWork_instances, holdsUnsyncedCommits_fn).call(this);
+  };
+  /** Commits on local main the provider has not been seen to admit, whether or not this round may
+   * offer them. Remount replaces local main, so it asks this, never the admit-gated question: a copy
+   * holding unsynced work is offered and rebased, never remounted. A copy without a bookmark cannot
+   * prove it holds nothing of its own. */
+  holdsUnsyncedCommits_fn = function() {
+    return !!__privateGet(this, _localHead) && __privateGet(this, _localHead) !== __privateGet(this, _previousHead);
   };
   /** Ask only for the custodian's delta; the offer follows once this peer has rebased. */
   pullBeforeOffer_fn = function() {
@@ -29731,13 +30078,13 @@
     }
     if (purpose === "level") {
       __privateSet(this, _state, { phase: WorkspaceSyncPhase.Stream, purpose, startedAt });
-      return __privateMethod(this, _WorkspaceSyncWork_instances, streamEffect_fn).call(this, "level", { case: "level", value: create(LiveFrontierSchema, {
+      return __privateMethod(this, _WorkspaceSyncWork_instances, streamEffect_fn).call(this, __privateGet(this, _containment) ? "contain" : "level", { case: "level", value: create(LiveFrontierSchema, {
         head: __privateGet(this, _localHead) ?? "",
         response: false,
         maxOffers: __privateGet(this, _receiveStep)?.offers ?? STREAM_BATCH_OFFERS,
         // Only a copy holding no work above its bookmark may be remounted instead of replaying, and
         // never one whose durable copy must hold the complete history (a head-only mount it cannot keep).
-        remountAfterOffers: __privateMethod(this, _WorkspaceSyncWork_instances, holdsLocalWork_fn).call(this) || __privateGet(this, _completeHistory) ? 0 : REMOUNT_AFTER_OFFERS
+        remountAfterOffers: __privateMethod(this, _WorkspaceSyncWork_instances, holdsUnsyncedCommits_fn).call(this) || __privateGet(this, _completeHistory) ? 0 : REMOUNT_AFTER_OFFERS
       }) });
     }
     const outcomes = new EffectOutcomeTransfer(__privateGet(this, _kernel18), __privateGet(this, _mount2), __privateGet(this, _requestId5));
@@ -29811,6 +30158,7 @@
     }
     if (answer.outcome.case === "refusal") {
       const refusal2 = answer.outcome.value;
+      if (state.purpose === "level" && __privateGet(this, _containment)) return __privateMethod(this, _WorkspaceSyncWork_instances, notContained_fn).call(this, refusal2.code);
       if (state.afterPlacement) return __privateMethod(this, _WorkspaceSyncWork_instances, finish_fn2).call(this, state.afterPlacement);
       return __privateMethod(this, _WorkspaceSyncWork_instances, transportFailure_fn).call(this, `${refusal2.code}: ${refusal2.message}`, false);
     }
@@ -29843,6 +30191,11 @@
       for (const boundary of slice.shallow) __privateGet(this, _boundaries).add(boundary);
       return __privateMethod(this, _WorkspaceSyncWork_instances, historyOrMount_fn).call(this, state.candidateHead, state.receivedBytes + Number(answer.receivedBytes), state.startedAt);
     }
+    if (state.purpose === "level" && __privateGet(this, _containment)) {
+      const answeredFromHead = answer.outcome.case === "level" || answer.outcome.case === "pack" && answer.outcome.value.base === __privateGet(this, _localHead);
+      if (!answeredFromHead) return __privateMethod(this, _WorkspaceSyncWork_instances, notContained_fn).call(this);
+      __privateMethod(this, _WorkspaceSyncWork_instances, contained_fn).call(this);
+    }
     if (state.purpose === "level" && answer.outcome.case === "pack" && answer.outcome.value.base) {
       const batch = answer.outcome.value;
       if (batch.base !== __privateGet(this, _previousHead) && batch.base !== __privateGet(this, _kernel18).head(__privateGet(this, _mount2), __privateGet(this, _requestId5))) {
@@ -29981,13 +30334,19 @@
   /**
    * A copy holding no work above its bookmark, too far behind to replay the backlog: mount the
    * peer's checkpoint in place of its exact local main (O(state), the same trust as a cold mount).
-   * The kernel keeps the replaced head at refs/heads/custody-preserved/<old>; that head was only a
-   * bookmark of the provider's own main, so the preservation is released at once.
+   * The kernel keeps the replaced head at refs/heads/custody-preserved/<old>. That ref is custody the
+   * kernel guards (custody may not delete an effectful branch), so it is left where it is: a remount
+   * that deleted it threw after main had already moved, leaving the bookmark behind main and the
+   * round failed for ever (2026-10-08, estate-5b493d6b).
+   *
+   * The copy may have moved while the checkpoint streamed (a live batch, a local write). Then it is
+   * no longer the copy the remount was asked for: take the round up again from its new head. Local
+   * work is offered first; a copy that is still only behind asks to level again.
    */
   remount_fn = function(candidateHead, receivedBytes, prefetchMillis) {
     const expected = __privateGet(this, _kernel18).head(__privateGet(this, _mount2), __privateGet(this, _requestId5));
-    if (expected === void 0 || expected !== __privateGet(this, _localHead) || __privateMethod(this, _WorkspaceSyncWork_instances, holdsLocalWork_fn).call(this)) {
-      return __privateMethod(this, _WorkspaceSyncWork_instances, transportFailure_fn).call(this, "the copy changed while its remount was streaming", false);
+    if (expected === void 0 || expected !== __privateGet(this, _localHead) || __privateMethod(this, _WorkspaceSyncWork_instances, holdsUnsyncedCommits_fn).call(this)) {
+      return __privateMethod(this, _WorkspaceSyncWork_instances, remountLost_fn).call(this, expected);
     }
     const started = __privateGet(this, _clock14).monotonicNanoseconds();
     if (candidateHead !== expected) {
@@ -29995,7 +30354,6 @@
       if (!restored.accepted || restored.head !== candidateHead) {
         throw new Error(`kernel refused to remount '${__privateGet(this, _mount2).workspace}' at ${candidateHead}`);
       }
-      __privateGet(this, _kernel18).deleteRef?.(__privateGet(this, _mount2), __privateGet(this, _requestId5), `refs/heads/custody-preserved/${expected}`);
       __privateMethod(this, _WorkspaceSyncWork_instances, providerCustodyMounted_fn).call(this);
     }
     return __privateMethod(this, _WorkspaceSyncWork_instances, converged_fn).call(this, create(SyncResponseSchema, {
@@ -30005,6 +30363,25 @@
       admittedRemoteHead: candidateHead
     }), candidateHead, receivedBytes, prefetchMillis, started);
   };
+  /** The remount's copy changed under it. Bounded: a copy that keeps moving under live traffic is
+   * levelled by its live link anyway, and the next round starts from wherever it got to. */
+  remountLost_fn = function(head) {
+    if (head === void 0 || ++__privateWrapper(this, _remountsLost)._ > MAX_REMOUNTS_LOST) {
+      return __privateMethod(this, _WorkspaceSyncWork_instances, transportFailure_fn).call(this, "the copy changed while its remount was streaming", false);
+    }
+    __privateSet(this, _localHead, head);
+    __privateSet(this, _previousHead, __privateGet(this, _kernel18).resolveRef(__privateGet(this, _mount2), __privateGet(this, _requestId5), trackedMain));
+    if (__privateGet(this, _desiredHead) === __privateGet(this, _localHead)) {
+      return __privateMethod(this, _WorkspaceSyncWork_instances, converged_fn).call(this, create(SyncResponseSchema, {
+        admitted: true,
+        head,
+        candidateHead: head,
+        admittedRemoteHead: head
+      }), head, 0, 0);
+    }
+    if (__privateMethod(this, _WorkspaceSyncWork_instances, holdsLocalWork_fn).call(this) && __privateGet(this, _desiredHead) !== __privateGet(this, _previousHead)) return __privateMethod(this, _WorkspaceSyncWork_instances, pullBeforeOffer_fn).call(this);
+    return __privateMethod(this, _WorkspaceSyncWork_instances, offerOrReconcile_fn).call(this);
+  };
   beginOffer_fn = function(body, exchange, probe = false) {
     const phase = probe ? WorkspaceSyncPhase.Probe : WorkspaceSyncPhase.Offer;
     __privateSet(this, _state, { phase, exchange });
@@ -30125,6 +30502,10 @@
           offerReceipt: __privateGet(this, _offerReceipt)
         }));
       }
+      const custodianMoved = __privateMethod(this, _WorkspaceSyncWork_instances, holdsLocalWork_fn).call(this) && __privateGet(this, _desiredHead) !== __privateGet(this, _previousHead);
+      if (custodianMoved && __privateMethod(this, _WorkspaceSyncWork_instances, mayBeContained_fn).call(this) && __privateMethod(this, _WorkspaceSyncWork_instances, custodianMainOffLocalChain_fn).call(this)) {
+        return __privateMethod(this, _WorkspaceSyncWork_instances, askContainment_fn).call(this, "pull");
+      }
       if (__privateGet(this, _probeOnly)) {
         __privateSet(this, _needsReconciliation, true);
         return __privateMethod(this, _WorkspaceSyncWork_instances, finish_fn2).call(this, create(SyncWorkspaceResponseSchema, {
@@ -30135,9 +30516,7 @@
           offerReceipt: __privateGet(this, _offerReceipt)
         }));
       }
-      if (__privateMethod(this, _WorkspaceSyncWork_instances, holdsLocalWork_fn).call(this) && __privateGet(this, _desiredHead) !== __privateGet(this, _previousHead)) {
-        return __privateMethod(this, _WorkspaceSyncWork_instances, pullBeforeOffer_fn).call(this);
-      }
+      if (custodianMoved) return __privateMethod(this, _WorkspaceSyncWork_instances, pullBeforeOffer_fn).call(this);
       return __privateMethod(this, _WorkspaceSyncWork_instances, offerOrReconcile_fn).call(this);
     }
     __privateSet(this, _admissionSummary, summarizeCustodyAdmission(admission));
@@ -30452,7 +30831,8 @@
     }));
   };
   converged_fn = function(verdict, candidateHead, receivedBytes, prefetchMillis, started = __privateGet(this, _clock14).monotonicNanoseconds(), rebirth) {
-    if (verdict.admitted && __privateGet(this, _candidateDurable) && candidateHead !== __privateGet(this, _previousHead) && __privateGet(this, _kernel18).resolveRef(__privateGet(this, _mount2), __privateGet(this, _requestId5), trackedMain) === __privateGet(this, _previousHead)) {
+    const tracked = verdict.admitted && __privateGet(this, _candidateDurable) ? __privateGet(this, _kernel18).resolveRef(__privateGet(this, _mount2), __privateGet(this, _requestId5), trackedMain) : void 0;
+    if (verdict.admitted && __privateGet(this, _candidateDurable) && tracked !== candidateHead && (tracked === __privateGet(this, _previousHead) || __privateGet(this, _containedBookmark) !== void 0 && tracked === __privateGet(this, _containedBookmark))) {
       __privateGet(this, _kernel18).writeRef(
         __privateGet(this, _mount2),
         __privateGet(this, _requestId5),
@@ -30737,10 +31117,16 @@
         __privateSet(this, _plan2, [__privateGet(this, _args).root]);
         return __privateMethod(this, _WorkspaceDependencySyncWork_instances, advance_fn4).call(this);
       }
-      if (__privateGet(this, _args).liveConnected && __privateGet(this, _args).kernel.resolveRef(__privateGet(this, _args).root.mount, __privateGet(this, _args).requestId, trackedMain2)) {
+      const { kernel, requestId, root } = __privateGet(this, _args);
+      const tracked = __privateGet(this, _args).liveConnected ? kernel.resolveRef(root.mount, requestId, trackedMain2) : void 0;
+      if (tracked && kernel.head(root.mount, requestId) === tracked) {
         __privateSet(this, _plan2, __privateMethod(this, _WorkspaceDependencySyncWork_instances, planDependencies_fn).call(this));
         return __privateMethod(this, _WorkspaceDependencySyncWork_instances, advance_fn4).call(this);
       }
+      if (tracked) {
+        __privateSet(this, _current4, __privateMethod(this, _WorkspaceDependencySyncWork_instances, work_fn).call(this, root, `${this.workId}:contain`, true));
+        return __privateMethod(this, _WorkspaceDependencySyncWork_instances, accept_fn).call(this, __privateGet(this, _current4).start());
+      }
       __privateSet(this, _current4, __privateMethod(this, _WorkspaceDependencySyncWork_instances, work_fn).call(this, __privateGet(this, _args).root, `${this.workId}:frontier`, true));
       return __privateMethod(this, _WorkspaceDependencySyncWork_instances, accept_fn).call(this, __privateGet(this, _current4).start());
     }
@@ -31784,7 +32170,7 @@
     Letter: 0,
     Correspondent: 1
   });
-  var _delivery, _kernel20, _mailboxUrl, _settlement, _retention2, _admitted, _awaitingObservation, _pending4, _targetCall, _deferredRetryAfterMillis, _retryScope, _retaining, _settled2, _acquireOmittedHistory, _RemoteWorkspaceEffectDeliveryWork_instances, transportFailed_fn, advance_fn5, observeTargetOffer_fn, postTargetOffer_fn;
+  var _delivery, _kernel20, _mailboxUrl, _settlement, _retention2, _admitted, _awaitingObservation, _pending3, _targetCall, _deferredRetryAfterMillis, _retryScope, _retaining, _settled2, _acquireOmittedHistory, _RemoteWorkspaceEffectDeliveryWork_instances, transportFailed_fn, advance_fn5, observeTargetOffer_fn, postTargetOffer_fn;
   var RemoteWorkspaceEffectDeliveryWork = class {
     constructor(args) {
       __privateAdd(this, _RemoteWorkspaceEffectDeliveryWork_instances);
@@ -31796,7 +32182,7 @@
       __privateAdd(this, _retention2);
       __privateAdd(this, _admitted);
       __privateAdd(this, _awaitingObservation, false);
-      __privateAdd(this, _pending4);
+      __privateAdd(this, _pending3);
       __privateAdd(this, _targetCall);
       __privateAdd(this, _deferredRetryAfterMillis);
       __privateAdd(this, _retryScope, CorrespondenceRetryScope.Letter);
@@ -31821,8 +32207,8 @@
       return __privateMethod(this, _RemoteWorkspaceEffectDeliveryWork_instances, advance_fn5).call(this, __privateGet(this, _delivery).next());
     }
     resume(receipt) {
-      if (__privateGet(this, _pending4)?.effect.case === "retainFrontier") {
-        const expected2 = __privateGet(this, _pending4).effect.value;
+      if (__privateGet(this, _pending3)?.effect.case === "retainFrontier") {
+        const expected2 = __privateGet(this, _pending3).effect.value;
         if (receipt.effectId !== expected2.effectId) throw new Error(`receipt '${receipt.effectId}' does not answer '${expected2.effectId}'`);
         const retained = receipt.outcome;
         if (retained.case !== "frontierRetained" || !retained.value.retained || retained.value.workspace !== expected2.workspace || retained.value.branch !== expected2.branch || retained.value.head !== expected2.head || !sameRetainedRefs(retained.value.refs, expected2.refs)) {
@@ -31837,7 +32223,7 @@
             settled.value.delivered = 0n;
             settled.value.refused = 0n;
             __privateSet(this, _settled2, void 0);
-            __privateSet(this, _pending4, void 0);
+            __privateSet(this, _pending3, void 0);
             __privateSet(this, _retaining, void 0);
             return settled;
           }
@@ -31845,7 +32231,7 @@
         }
         const retaining = __privateGet(this, _retaining);
         __privateSet(this, _retaining, void 0);
-        __privateSet(this, _pending4, void 0);
+        __privateSet(this, _pending3, void 0);
         if (retaining === WorkspaceEffectRetentionLeg.Source) return __privateMethod(this, _RemoteWorkspaceEffectDeliveryWork_instances, observeTargetOffer_fn).call(this);
         if (retaining === WorkspaceEffectRetentionLeg.Outcome) {
           const settled = __privateGet(this, _settled2);
@@ -31854,11 +32240,11 @@
         }
         const admitted = __privateGet(this, _admitted);
         __privateSet(this, _admitted, void 0);
-        __privateSet(this, _pending4, void 0);
+        __privateSet(this, _pending3, void 0);
         __privateSet(this, _targetCall, void 0);
         return __privateMethod(this, _RemoteWorkspaceEffectDeliveryWork_instances, advance_fn5).call(this, __privateGet(this, _delivery).next(admitted, __privateGet(this, _settlement)));
       }
-      const expected = __privateGet(this, _pending4)?.effect.case === "http" ? __privateGet(this, _pending4).effect.value.effectId : void 0;
+      const expected = __privateGet(this, _pending3)?.effect.case === "http" ? __privateGet(this, _pending3).effect.value.effectId : void 0;
       if (!expected || !__privateGet(this, _targetCall)) throw new Error(`correspondence work '${this.workId}' is not awaiting transport`);
       if (receipt.effectId !== expected) throw new Error(`receipt '${receipt.effectId}' does not answer '${expected}'`);
       if (receipt.outcome.case === "failure") {
@@ -31883,7 +32269,7 @@
           requestId: __privateGet(this, _targetCall).request.requestId,
           outcome: { case: "offer", value: status.judgment }
         });
-        __privateSet(this, _pending4, void 0);
+        __privateSet(this, _pending3, void 0);
         __privateSet(this, _targetCall, void 0);
         return __privateMethod(this, _RemoteWorkspaceEffectDeliveryWork_instances, advance_fn5).call(this, __privateGet(this, _delivery).next(response2, __privateGet(this, _settlement)));
       }
@@ -31904,7 +32290,7 @@
             }
           }
         });
-        __privateSet(this, _pending4, void 0);
+        __privateSet(this, _pending3, void 0);
         __privateSet(this, _targetCall, void 0);
         return __privateMethod(this, _RemoteWorkspaceEffectDeliveryWork_instances, advance_fn5).call(this, __privateGet(this, _delivery).next(held));
       }
@@ -31922,7 +32308,7 @@
         requestId: __privateGet(this, _targetCall).request.requestId,
         outcome: { case: "offer", value: applied }
       });
-      __privateSet(this, _pending4, void 0);
+      __privateSet(this, _pending3, void 0);
       __privateSet(this, _targetCall, void 0);
       __privateSet(this, _admitted, void 0);
       __privateSet(this, _awaitingObservation, false);
@@ -31937,7 +32323,7 @@
   _retention2 = new WeakMap();
   _admitted = new WeakMap();
   _awaitingObservation = new WeakMap();
-  _pending4 = new WeakMap();
+  _pending3 = new WeakMap();
   _targetCall = new WeakMap();
   _deferredRetryAfterMillis = new WeakMap();
   _retryScope = new WeakMap();
@@ -31948,7 +32334,7 @@
   transportFailed_fn = function(message) {
     const call = __privateGet(this, _targetCall);
     if (!call) throw new Error("failed transport has no target call");
-    __privateSet(this, _pending4, void 0);
+    __privateSet(this, _pending3, void 0);
     __privateSet(this, _targetCall, void 0);
     __privateSet(this, _admitted, void 0);
     __privateSet(this, _awaitingObservation, false);
@@ -31978,7 +32364,7 @@
         const head2 = __privateGet(this, _kernel20).head(source2, 0n);
         if (!head2) throw new Error("effect outcome source has no custody frontier");
         __privateSet(this, _retaining, WorkspaceEffectRetentionLeg.Outcome);
-        __privateSet(this, _pending4, create(CorrespondencePendingSchema, {
+        __privateSet(this, _pending3, create(CorrespondencePendingSchema, {
           workId: this.workId,
           effect: { case: "retainFrontier", value: create(RetainFrontierEffectSchema, {
             effectId: `${this.workId}:retain-outcome`,
@@ -31988,7 +32374,7 @@
             refs: __privateGet(this, _retention2).refs(source2.workspace)
           }) }
         }));
-        return { case: "pending", value: __privateGet(this, _pending4) };
+        return { case: "pending", value: __privateGet(this, _pending3) };
       }
       return settled;
     }
@@ -32014,7 +32400,7 @@
         if (!head2 || !/^[0-9a-f]{40}$/i.test(head2)) return __privateMethod(this, _RemoteWorkspaceEffectDeliveryWork_instances, transportFailed_fn).call(this, "admitted target has no current custody frontier");
         __privateSet(this, _admitted, response);
         __privateSet(this, _retaining, WorkspaceEffectRetentionLeg.Target);
-        __privateSet(this, _pending4, create(CorrespondencePendingSchema, {
+        __privateSet(this, _pending3, create(CorrespondencePendingSchema, {
           workId: this.workId,
           effect: { case: "retainFrontier", value: create(RetainFrontierEffectSchema, {
             effectId: `${this.workId}:retain:${offer.id}`,
@@ -32024,7 +32410,7 @@
             refs: __privateGet(this, _retention2).refs(step.value.mount.workspace)
           }) }
         }));
-        return { case: "pending", value: __privateGet(this, _pending4) };
+        return { case: "pending", value: __privateGet(this, _pending3) };
       }
       __privateSet(this, _targetCall, void 0);
       return __privateMethod(this, _RemoteWorkspaceEffectDeliveryWork_instances, advance_fn5).call(this, __privateGet(this, _delivery).next(response, __privateGet(this, _settlement)));
@@ -32033,7 +32419,7 @@
     const head = __privateGet(this, _kernel20).head(source, 0n);
     if (!head) return __privateMethod(this, _RemoteWorkspaceEffectDeliveryWork_instances, transportFailed_fn).call(this, "effect source has no admitted custody frontier");
     __privateSet(this, _retaining, WorkspaceEffectRetentionLeg.Source);
-    __privateSet(this, _pending4, create(CorrespondencePendingSchema, {
+    __privateSet(this, _pending3, create(CorrespondencePendingSchema, {
       workId: this.workId,
       effect: { case: "retainFrontier", value: create(RetainFrontierEffectSchema, {
         effectId: `${this.workId}:retain-source:${offer.id}`,
@@ -32043,14 +32429,14 @@
         refs: __privateGet(this, _retention2).refs(source.workspace)
       }) }
     }));
-    return { case: "pending", value: __privateGet(this, _pending4) };
+    return { case: "pending", value: __privateGet(this, _pending3) };
   };
   observeTargetOffer_fn = function() {
     const offer = __privateGet(this, _targetCall)?.offer;
     if (!offer || !__privateGet(this, _mailboxUrl)) throw new Error("mailbox observation has no active offer");
     if (offer.effectDigest && offer.sourceWorkspaceGenesis) {
       __privateSet(this, _awaitingObservation, true);
-      __privateSet(this, _pending4, create(CorrespondencePendingSchema, { workId: this.workId, effect: {
+      __privateSet(this, _pending3, create(CorrespondencePendingSchema, { workId: this.workId, effect: {
         case: "http",
         value: create(PeerHttpEffectSchema, {
           effectId: `${this.workId}:observe:${offer.id}`,
@@ -32064,7 +32450,7 @@
           }))
         })
       } }));
-      return { case: "pending", value: __privateGet(this, _pending4) };
+      return { case: "pending", value: __privateGet(this, _pending3) };
     }
     return __privateMethod(this, _RemoteWorkspaceEffectDeliveryWork_instances, postTargetOffer_fn).call(this);
   };
@@ -32087,11 +32473,11 @@
       accept: CARRIED_OFFER_RESPONSE,
       body: toBinary(OfferRequestSchema, body)
     });
-    __privateSet(this, _pending4, create(CorrespondencePendingSchema, {
+    __privateSet(this, _pending3, create(CorrespondencePendingSchema, {
       workId: this.workId,
       effect: { case: "http", value: effect }
     }));
-    return { case: "pending", value: __privateGet(this, _pending4) };
+    return { case: "pending", value: __privateGet(this, _pending3) };
   };
 
   // ../src/runtime/replica_follow_lane.ts
@@ -32127,6 +32513,11 @@
       const delay = __privateGet(this, _controller).reconnected(workspace);
       if (delay !== void 0) __privateMethod(this, _ReplicaFollowLane_instances, scheduleAt_fn).call(this, workspace, __privateMethod(this, _ReplicaFollowLane_instances, now_fn8).call(this) + delay);
     }
+    /** The upstream announced a new frontier: news even to a follow the kernel refused. */
+    remoteAdvanced(workspace) {
+      const delay = __privateGet(this, _controller).reconnected(workspace, true);
+      if (delay !== void 0) __privateMethod(this, _ReplicaFollowLane_instances, scheduleAt_fn).call(this, workspace, __privateMethod(this, _ReplicaFollowLane_instances, now_fn8).call(this) + delay);
+    }
     /** The upstream rang for a new placement frontier (see ReplicaFollowController). */
     placementAnnounced(workspace) {
       const delay = __privateGet(this, _controller).placementAnnounced(workspace);
@@ -32309,7 +32700,7 @@
   init_shims();
   var PREPARATION_QUANTA_PER_TURN = 64;
   var RETRY_AFTER_MILLIS = 30000n;
-  var _command4, _source4, _kernel21, _clock19, _requestId7, _offer, _pending5, _settled3, _HttpObligationDeliveryWork_instances, complete_fn;
+  var _command4, _source4, _kernel21, _clock19, _requestId7, _offer, _pending4, _settled3, _HttpObligationDeliveryWork_instances, complete_fn;
   var HttpObligationDeliveryWork = class {
     constructor(args) {
       __privateAdd(this, _HttpObligationDeliveryWork_instances);
@@ -32320,7 +32711,7 @@
       __privateAdd(this, _clock19);
       __privateAdd(this, _requestId7);
       __privateAdd(this, _offer);
-      __privateAdd(this, _pending5);
+      __privateAdd(this, _pending4);
       __privateAdd(this, _settled3);
       this.workId = args.workId;
       __privateSet(this, _command4, args.command);
@@ -32331,7 +32722,7 @@
     }
     start() {
       if (__privateGet(this, _settled3)) return __privateGet(this, _settled3);
-      if (__privateGet(this, _pending5)) return { case: "pending", value: __privateGet(this, _pending5) };
+      if (__privateGet(this, _pending4)) return { case: "pending", value: __privateGet(this, _pending4) };
       if (!__privateGet(this, _command4).sourceOfferPath) {
         throw new Error("HTTP obligation delivery requires an exact source offer path");
       }
@@ -32360,7 +32751,7 @@
           throw new Error("prepared HTTP obligation lacks its durable delivery identity");
         }
         __privateSet(this, _offer, offer);
-        __privateSet(this, _pending5, create(CorrespondencePendingSchema, {
+        __privateSet(this, _pending4, create(CorrespondencePendingSchema, {
           workId: this.workId,
           effect: {
             case: "http",
@@ -32376,13 +32767,13 @@
             })
           }
         }));
-        return { case: "pending", value: __privateGet(this, _pending5) };
+        return { case: "pending", value: __privateGet(this, _pending4) };
       }
       return __privateMethod(this, _HttpObligationDeliveryWork_instances, complete_fn).call(this, false, false, true);
     }
     resume(receipt) {
       if (__privateGet(this, _settled3)) return __privateGet(this, _settled3);
-      const pending = __privateGet(this, _pending5);
+      const pending = __privateGet(this, _pending4);
       const offer = __privateGet(this, _offer);
       if (!pending || pending.effect.case !== "http" || !offer) {
         throw new Error(`HTTP obligation work '${this.workId}' is not awaiting transport`);
@@ -32390,7 +32781,7 @@
       if (receipt.effectId !== pending.effect.value.effectId) {
         throw new Error(`receipt '${receipt.effectId}' does not answer '${pending.effect.value.effectId}'`);
       }
-      __privateSet(this, _pending5, void 0);
+      __privateSet(this, _pending4, void 0);
       __privateSet(this, _offer, void 0);
       if (receipt.outcome.case === "response" && receipt.outcome.value.status >= 200 && receipt.outcome.value.status < 300) {
         __privateGet(this, _kernel21).writeRef(
@@ -32410,7 +32801,7 @@
   _clock19 = new WeakMap();
   _requestId7 = new WeakMap();
   _offer = new WeakMap();
-  _pending5 = new WeakMap();
+  _pending4 = new WeakMap();
   _settled3 = new WeakMap();
   _HttpObligationDeliveryWork_instances = new WeakSet();
   complete_fn = function(attempted, delivered, preparationPending, retryAtMillis) {
@@ -32429,7 +32820,7 @@
   var REFETCH_AWAITS_PROVIDER = "nomos.runtime.refetch_awaits_provider";
   var LOCAL_COPY_REFETCHING = "nomos.runtime.local_copy_refetching";
   var LIVE_ADMISSION_GRACE_MILLIS = 1e4;
-  var _kernel22, _retention3, _custodyStorage, _custody3, _sessions11, _credentials5, _placement3, _clock20, _outboxClock, _follows2, _followLane, _readability2, _origins3, _preserved, _dropReasons, _lawProductsImported2, _lawProductsInFlight2, _replacing, _providerServesSameCopy, _events4, _onSyncFrontier, _onSyncCompleted, _onPlacementFetched, _onShallowMount, _onOffered, _onOutboxHistoryRequired, _backgroundHistory, _receiveStep2, _remoteOffers, _recoveries, _deliveries, _httpDeliveries, _syncs, _syncWorkspaces, _retries, _remoteDeliveryKeys, _outboxDueAt, _settledFollowReported, _openLinks, _liveAdmissionDue, _linkReported, _lastClosure, _followsReported, _warming, _recoveredOutboxes, _outboxObservations, _outboxCursor, _httpDeliveryPaths, _executesCustodianObligations, _CorrespondenceDesk_instances, dropRoundsOf_fn, observeWarming_fn, eligibleOutboxEntry_fn, settleDelivery_fn, nowMillis_fn2, liveAdmissionOverdue_fn, warmingPosture_fn, activeSyncEffect_fn, dropReason_fn, roundInFlight_fn, observeSyncResult_fn, syncFailed_fn, scheduleFromResult_fn, syncCompleted_fn, recordPreserved_fn, scheduleOutbox_fn;
+  var _kernel22, _retention3, _custodyStorage, _custody3, _sessions11, _credentials5, _placement3, _clock20, _outboxClock, _follows2, _followLane, _readability2, _origins3, _preserved, _dropReasons, _lawProductsImported2, _lawProductsInFlight2, _replacing, _providerServesSameCopy, _events4, _onSyncFrontier, _onSyncCompleted, _onPlacementFetched, _onShallowMount, _onOffered, _liveAdmitted2, _onOutboxHistoryRequired, _backgroundHistory, _receiveStep2, _remoteOffers, _recoveries, _deliveries, _httpDeliveries, _syncs, _syncWorkspaces, _retries, _remoteDeliveryKeys, _outboxDueAt, _settledFollowReported, _openLinks, _liveAdmissionDue, _linkReported, _lastClosure, _followsReported, _warming, _recoveredOutboxes, _outboxObservations, _outboxCursor, _httpDeliveryPaths, _executesCustodianObligations, _CorrespondenceDesk_instances, dropRoundsOf_fn, observeWarming_fn, eligibleOutboxEntry_fn, settleDelivery_fn, nowMillis_fn2, liveAdmissionOverdue_fn, warmingPosture_fn, activeSyncEffect_fn, dropReason_fn, roundInFlight_fn, observeSyncResult_fn, syncFailed_fn, scheduleFromResult_fn, syncCompleted_fn, recordPreserved_fn, scheduleOutbox_fn;
   var CorrespondenceDesk = class {
     constructor(args) {
       __privateAdd(this, _CorrespondenceDesk_instances);
@@ -32463,6 +32854,7 @@
       __privateAdd(this, _onPlacementFetched);
       __privateAdd(this, _onShallowMount);
       __privateAdd(this, _onOffered);
+      __privateAdd(this, _liveAdmitted2);
       __privateAdd(this, _onOutboxHistoryRequired);
       __privateAdd(this, _backgroundHistory);
       __privateAdd(this, _receiveStep2);
@@ -32520,6 +32912,7 @@
       __privateSet(this, _onPlacementFetched, args.onPlacementFetched);
       __privateSet(this, _onShallowMount, args.onShallowMount);
       __privateSet(this, _onOffered, args.onOffered);
+      __privateSet(this, _liveAdmitted2, args.liveAdmitted);
       __privateSet(this, _onOutboxHistoryRequired, args.onOutboxHistoryRequired);
       __privateSet(this, _backgroundHistory, args.backgroundHistory !== false);
       __privateSet(this, _receiveStep2, args.receiveStep);
@@ -32775,6 +33168,12 @@
       __privateGet(this, _followLane).reconnected(workspace);
       this.reportFollows();
     }
+    /** The upstream announced a new frontier for this workspace over its live link: an event which
+     * re-runs a round the kernel refused (its inputs changed). */
+    replicaRemoteAdvanced(workspace) {
+      __privateGet(this, _followLane).remoteAdvanced(workspace);
+      this.reportFollows();
+    }
     /** The upstream rang for a new placement frontier: the next round re-checks placement even
      * though main has not moved. */
     replicaPlacementAnnounced(workspace) {
@@ -32809,10 +33208,11 @@
         const state = __privateGet(this, _follows2).followForWorkspace(workspace)?.state;
         if (!state) return [];
         const isSettled = state.case === ReplicaFollowPhase.Settled;
+        const refused = state.case === ReplicaFollowPhase.Backoff && state.refusal?.blocked === true;
         const isLive = __privateGet(this, _openLinks).has(workspace);
         if (isSettled) settled += 1;
         if (isLive) live += 1;
-        const phase = {
+        const phase = refused ? FollowObservationPhase.KERNEL_REFUSED : {
           [ReplicaFollowPhase.Desired]: FollowObservationPhase.DESIRED,
           [ReplicaFollowPhase.Due]: FollowObservationPhase.DUE,
           [ReplicaFollowPhase.Running]: FollowObservationPhase.RUNNING,
@@ -32826,7 +33226,7 @@
           [ReplicaFollowPhase.LocalCopyUnreadable]: FollowObservationPhase.LOCAL_COPY_UNREADABLE
         }[state.case];
         const detail = state.case === ReplicaFollowPhase.AwaitingDependency ? state.reason : state.case === ReplicaFollowPhase.InvalidCredential || state.case === ReplicaFollowPhase.Backoff ? state.failure : state.case === ReplicaFollowPhase.RebornRemotely ? state.rebirth.detail : state.case === ReplicaFollowPhase.LocalCopyUnreadable ? state.format : void 0;
-        const retryAt = state.case === ReplicaFollowPhase.Offline || state.case === ReplicaFollowPhase.InvalidCredential || state.case === ReplicaFollowPhase.Backoff ? state.retryAtUnixMillis : void 0;
+        const retryAt = refused ? state.case === ReplicaFollowPhase.Backoff ? state.refusal?.rerunAtUnixMillis : void 0 : state.case === ReplicaFollowPhase.Offline || state.case === ReplicaFollowPhase.InvalidCredential || state.case === ReplicaFollowPhase.Backoff ? state.retryAtUnixMillis : void 0;
         const dueAt2 = state.case === ReplicaFollowPhase.Due || state.case === ReplicaFollowPhase.ReplacingLocal ? state.dueAtUnixMillis : void 0;
         const attempt = state.case === ReplicaFollowPhase.Running || state.case === ReplicaFollowPhase.Offline || state.case === ReplicaFollowPhase.InvalidCredential || state.case === ReplicaFollowPhase.Backoff || state.case === ReplicaFollowPhase.ReplacingLocal ? state.attempt : void 0;
         const activeEffect = state.case === ReplicaFollowPhase.Running ? __privateMethod(this, _CorrespondenceDesk_instances, activeSyncEffect_fn).call(this, workspace) : void 0;
@@ -33264,6 +33664,7 @@
       const active = /* @__PURE__ */ new Set([mount.workspace]);
       let roundPlacementFrontier;
       const work = (target3, id, probeOnly = false, beforeConverge) => {
+        var _a;
         active.add(target3.mount.workspace);
         const isRoot = target3.mount.workspace === mount.workspace;
         const targetRoute = isRoot ? route : __privateGet(this, _placement3).syncRoute(request, target3.mount);
@@ -33279,13 +33680,13 @@
           lawProductsImported: __privateGet(this, _lawProductsImported2),
           lawProductsInFlight: __privateGet(this, _lawProductsInFlight2),
           shallowMounted: (credentialCapability) => {
-            var _a;
-            return (_a = __privateGet(this, _onShallowMount)) == null ? void 0 : _a.call(this, target3.mount.workspace, credentialCapability);
+            var _a2;
+            return (_a2 = __privateGet(this, _onShallowMount)) == null ? void 0 : _a2.call(this, target3.mount.workspace, credentialCapability);
           },
           ...__privateGet(this, _receiveStep2) ? { receiveStep: __privateGet(this, _receiveStep2) } : {},
           ...__privateGet(this, _onOffered) ? { offered: (oids) => {
-            var _a;
-            return (_a = __privateGet(this, _onOffered)) == null ? void 0 : _a.call(this, target3.mount.workspace, oids);
+            var _a2;
+            return (_a2 = __privateGet(this, _onOffered)) == null ? void 0 : _a2.call(this, target3.mount.workspace, oids);
           } } : {},
           // A dropped copy's refetch authorization names the root workspace alone.
           command: target3.mount.workspace === mount.workspace || command.replaceLocalHead === void 0 ? command : create(SyncWorkspaceRequestSchema, { workspace: command.workspace, admit: command.admit }),
@@ -33293,6 +33694,7 @@
           workId: id,
           probeOnly,
           liveConnected: __privateGet(this, _openLinks).has(target3.mount.workspace),
+          ...__privateGet(this, _openLinks).has(target3.mount.workspace) && ((_a = __privateGet(this, _liveAdmitted2)) == null ? void 0 : _a.call(this, target3.mount.workspace)) ? { liveAdmitted: __privateGet(this, _liveAdmitted2).call(this, target3.mount.workspace) } : {},
           ...beforeConverge === void 0 ? {} : { beforeConverge },
           ...target3.receiveState === void 0 ? {} : { receiveState: target3.receiveState },
           ...target3.offerHead === void 0 ? {} : { offerHead: target3.offerHead },
@@ -33307,8 +33709,8 @@
           ...isRoot ? {
             directoryAnswered: () => __privateGet(this, _follows2).placementRechecked(mount.workspace),
             placementFetched: () => {
-              var _a;
-              return (_a = __privateGet(this, _onPlacementFetched)) == null ? void 0 : _a.call(this, mount.workspace);
+              var _a2;
+              return (_a2 = __privateGet(this, _onPlacementFetched)) == null ? void 0 : _a2.call(this, mount.workspace);
             }
           } : {}
         });
@@ -33492,6 +33894,7 @@
   _onPlacementFetched = new WeakMap();
   _onShallowMount = new WeakMap();
   _onOffered = new WeakMap();
+  _liveAdmitted2 = new WeakMap();
   _onOutboxHistoryRequired = new WeakMap();
   _backgroundHistory = new WeakMap();
   _receiveStep2 = new WeakMap();
@@ -33764,17 +34167,17 @@
   // ../src/runtime/birth_custody_desk.ts
   init_define_NOMOS_KERNEL_RELEASE();
   init_shims();
-  var _finalOutcome, _pending6, _completed7, _lastReceiptEffectId3;
+  var _finalOutcome, _pending5, _completed7, _lastReceiptEffectId3;
   var BirthCustodyWork = class {
     constructor(args) {
       __publicField(this, "workId");
       __privateAdd(this, _finalOutcome);
-      __privateAdd(this, _pending6);
+      __privateAdd(this, _pending5);
       __privateAdd(this, _completed7);
       __privateAdd(this, _lastReceiptEffectId3);
       this.workId = args.workId;
       __privateSet(this, _finalOutcome, args.finalOutcome);
-      __privateSet(this, _pending6, create(CorrespondencePendingSchema, {
+      __privateSet(this, _pending5, create(CorrespondencePendingSchema, {
         workId: this.workId,
         effect: {
           case: "persistBornCustody",
@@ -33786,13 +34189,13 @@
       }));
     }
     start() {
-      return __privateGet(this, _completed7) ?? { case: "pending", value: __privateGet(this, _pending6) };
+      return __privateGet(this, _completed7) ?? { case: "pending", value: __privateGet(this, _pending5) };
     }
     resume(receipt) {
       if (receipt.effectId === __privateGet(this, _lastReceiptEffectId3) && __privateGet(this, _completed7)) {
         return __privateGet(this, _completed7);
       }
-      const effect = __privateGet(this, _pending6).effect;
+      const effect = __privateGet(this, _pending5).effect;
       if (effect.case !== "persistBornCustody") {
         throw new Error(`birth custody work '${this.workId}' has no persistence effect`);
       }
@@ -33832,7 +34235,7 @@
     }
   };
   _finalOutcome = new WeakMap();
-  _pending6 = new WeakMap();
+  _pending5 = new WeakMap();
   _completed7 = new WeakMap();
   _lastReceiptEffectId3 = new WeakMap();
   var _kernel23, _work3, _publicationRefs, _origins4, _BirthCustodyDesk_instances, begin_fn3;
@@ -34395,13 +34798,13 @@
   init_define_NOMOS_KERNEL_RELEASE();
   init_shims();
   var cloneCall = (call) => fromBinary(CallRequestSchema, toBinary(CallRequestSchema, call));
-  var _identity, _application2, _pending7, _completed9, _completedOrder, _completedLimit2, _IdentityRecoveryDesk_instances, rememberCompleted_fn, adoptAndRetry_fn;
+  var _identity, _application2, _pending6, _completed9, _completedOrder, _completedLimit2, _IdentityRecoveryDesk_instances, rememberCompleted_fn, adoptAndRetry_fn;
   var IdentityRecoveryDesk = class {
     constructor(identity, application) {
       __privateAdd(this, _IdentityRecoveryDesk_instances);
       __privateAdd(this, _identity);
       __privateAdd(this, _application2);
-      __privateAdd(this, _pending7, /* @__PURE__ */ new Map());
+      __privateAdd(this, _pending6, /* @__PURE__ */ new Map());
       __privateAdd(this, _completed9, /* @__PURE__ */ new Map());
       __privateAdd(this, _completedOrder, []);
       __privateAdd(this, _completedLimit2, 128);
@@ -34432,25 +34835,25 @@
         return __privateMethod(this, _IdentityRecoveryDesk_instances, adoptAndRetry_fn).call(this, runtimeRequest, command, originalCall, requirement, step.value);
       }
       const requestKey = runtimeRequest.requestId.toString();
-      const waiters = __privateGet(this, _pending7).get(step.value.workId) ?? /* @__PURE__ */ new Map();
+      const waiters = __privateGet(this, _pending6).get(step.value.workId) ?? /* @__PURE__ */ new Map();
       waiters.set(requestKey, {
         runtimeRequest,
         command,
         originalCall,
         requirement
       });
-      __privateGet(this, _pending7).set(step.value.workId, waiters);
+      __privateGet(this, _pending6).set(step.value.workId, waiters);
       return step;
     }
     has(workId2, requestId) {
       const requestKey = requestId.toString();
-      return __privateGet(this, _pending7).get(workId2)?.has(requestKey) === true || __privateGet(this, _completed9).get(workId2)?.has(requestKey) === true;
+      return __privateGet(this, _pending6).get(workId2)?.has(requestKey) === true || __privateGet(this, _completed9).get(workId2)?.has(requestKey) === true;
     }
     continue(workId2, receipt, requestId) {
       const requestKey = requestId.toString();
       const completed = __privateGet(this, _completed9).get(workId2)?.get(requestKey);
       if (completed) return completed;
-      const waiters = __privateGet(this, _pending7).get(workId2);
+      const waiters = __privateGet(this, _pending6).get(workId2);
       const pending = waiters?.get(requestKey);
       if (!pending) {
         throw new Error(
@@ -34460,20 +34863,20 @@
       const step = __privateGet(this, _identity).continue(workId2, receipt);
       if (step.case === "pending") return step;
       waiters.delete(requestKey);
-      if (waiters.size === 0) __privateGet(this, _pending7).delete(workId2);
+      if (waiters.size === 0) __privateGet(this, _pending6).delete(workId2);
       const result = __privateMethod(this, _IdentityRecoveryDesk_instances, adoptAndRetry_fn).call(this, pending.runtimeRequest, pending.command, pending.originalCall, pending.requirement, step.value);
       __privateMethod(this, _IdentityRecoveryDesk_instances, rememberCompleted_fn).call(this, workId2, requestKey, result);
       return result;
     }
     clear() {
-      __privateGet(this, _pending7).clear();
+      __privateGet(this, _pending6).clear();
       __privateGet(this, _completed9).clear();
       __privateGet(this, _completedOrder).length = 0;
     }
   };
   _identity = new WeakMap();
   _application2 = new WeakMap();
-  _pending7 = new WeakMap();
+  _pending6 = new WeakMap();
   _completed9 = new WeakMap();
   _completedOrder = new WeakMap();
   _completedLimit2 = new WeakMap();
@@ -35179,10 +35582,10 @@
     while (true) {
       __privateGet(this, _ports6).owe(owed.workspace);
       while (__privateGet(this, _ports6).owes(owed.workspace)) {
-        const tick = __privateGet(this, _ports6).tick();
+        const { ticked, wake: readiness } = __privateGet(this, _ports6).tick();
         const delayMillis = Math.min(LONGEST_WAKE_MILLIS, Math.max(
           FIRST_WAKE_MILLIS,
-          tick.progress !== void 0 ? FIRST_WAKE_MILLIS : tick.nextTickAfterMillis
+          ticked.progress !== void 0 ? FIRST_WAKE_MILLIS : readiness.case === "after" ? readiness.millis : LONGEST_WAKE_MILLIS
         ));
         const receipt = yield { case: "wake", value: create(PeerWakeEffectSchema, {
           effectId: `${workId2}:repay-${++wake}`,
@@ -35324,7 +35727,6 @@
   }
   var INTERACTIVE_PEER_CLASSES = /* @__PURE__ */ new Set(["personal-device", "browser"]);
   var INTERACTION_FIRST_MILLIS = 15e3;
-  var READ_READINESS_ONLY = 1n << 62n;
   var PLACEMENT_READ_RETRY_MILLIS = 60000n;
   var STREAM_WAKE_FIRST_MILLIS = 20;
   var HISTORY_STREAM_SLICES = [8, 64, 256];
@@ -35343,7 +35745,6 @@
     "continueLocalRead"
   ]);
   var APPLICATION_WAIT_NANOS = 5000000000n;
-  var READ_INDEX_BUILDING = /the read index of .+ is being built|read maintenance continues it/;
   var _kernel27, _sessions14, _interactivePeer, _interaction, _trace13, _credentials7, _credentialRecovery, _deviceIdentity, _receivingGroup2, _offerReadiness, _modelAdoption, _deviceChallenges, _enrolledCapabilities, _custody4, _readability3, _origins5, _seat2, _replicaId3, _custodyAdmission, _correspondence3, _birthCustody, _placement5, _access, _identity2, _custodianPlacement, _identityRecovery, _queries8, _application3, _compatibility2, _custodyVerification, _commandPreparation, _applicationReadiness, _authenticationReadiness, _lawPackages, _readMaintenance, _readResponses, _residency5, _residencyPins, _subscriptions5, _follows3, _replicaInventory, _placementDiscovery2, _live3, _liveStream, _streamWaits, _records6, _historicQueries, _authoringPreflight, _foregroundWork, _backgroundPapers, _backgroundWork, _yielded, _released, _applicationWork, _followUp, _writeBurst, _receiveStepBudget, _importStepBudget, _recovery, _lifecycle, _maintenance3, _background3, _paperSlots, _retentionObserver, _admissionDurability, _historyAcquisition, _historySliceRequest, _PeerOffice_instances, sliceBoundaries_fn, _responses, _placementRead, _placementUnread, _entryDepth, _clock23, drive_fn, timedBackgroundPaper_fn, nextBackgroundPaper_fn, invoke_fn, yieldBackground_fn, applicationWaiting_fn, resumeYielded_fn, streamed_fn, streamWoken_fn, streamReceipt_fn, streamWake_fn, fenced_fn, handleRequest_fn, localCopyUnreadable_fn, probeLocalCopyFormat_fn, protectedResidents_fn, bindInteraction_fn, keepCustodianPlacement_fn, dispatchRequest_fn, continuesHistoryAcquisition_fn, historyCredentialCapability_fn, preferredCredentialCapability_fn, backgroundTurn_fn, settleResidentPlacement_fn, readResidentPlacement_fn, _internalPlacementRequests, internalRequestId_fn, correspondenceResponse_fn, authenticationReadinessResponse_fn, completedKernelCall_fn, modelAdoptionResponse_fn, receivingGroupResponse_fn, deviceIdentityResponse_fn, deviceChallengeFor_fn, deviceChallengeForCapability_fn, credentialRecoveryResponse_fn, afterCredentialKernelCall_fn, offerReadinessResponse_fn, acknowledgedWhenDurable_fn, admissionDurabilityResponse_fn, birthCustodyResponse_fn, identityResponse_fn, identityRecoveryResponse_fn, response_fn, failure_fn, custodyRequired_fn, kernelResidencyRequired_fn, candidateCustodyRequired_fn;
   var PeerOffice = class {
     constructor(kernel, credentials, profile, observations, custodyStorage, peerDeskStore) {
@@ -35527,7 +35928,6 @@
         }
       }, (workspace) => __privateGet(this, _residency5).lastRetainedHead(workspace)));
       if (__privateGet(this, _writeBurst)) __privateGet(this, _live3).writeBurst = __privateGet(this, _writeBurst);
-      if (__privateGet(this, _interactivePeer)) __privateGet(this, _live3).receiveStep = __privateGet(this, _receiveStepBudget);
       __privateSet(this, _credentials7, new CredentialSessions(__privateGet(this, _sessions14), credentials, observations));
       __privateSet(this, _readability3, new LocalCopyReadability((workspace, format) => {
         __privateGet(this, _follows3).markLocalCopyUnreadable(workspace, format);
@@ -35545,7 +35945,8 @@
         new ReplicaFollowDesk(seatedStore),
         observations,
         __privateGet(this, _replicaId3),
-        new BirthRefusalRegister(seatedStore)
+        new BirthRefusalRegister(seatedStore),
+        PEER_RUNTIME_IDENTITY
       ));
       __privateSet(this, _compatibility2, new CompatibilityDesk(
         __privateGet(this, _queries8),
@@ -35564,13 +35965,20 @@
         __privateGet(this, _trace13),
         observations,
         {
-          readReady: (workspace) => __privateGet(this, _subscriptions5).readIndexReady(workspace),
-          frontierAdvanced: (workspace) => __privateGet(this, _subscriptions5).readIndexAdvanced(workspace),
-          localCopyUnreadable: (workspace, format) => __privateGet(this, _readability3).mark(
-            workspace,
-            __privateGet(this, _kernel27).head(workspaceMount(workspace), 0n),
-            format
-          ),
+          // A read waiting on this workspace is released by the readiness event itself, not a timer.
+          readReady: (workspace) => {
+            __privateGet(this, _subscriptions5).readIndexReady(workspace);
+            __privateGet(this, _readResponses)?.readinessChanged(workspace);
+          },
+          frontierAdvanced: (workspace) => {
+            __privateGet(this, _subscriptions5).readIndexAdvanced(workspace);
+            __privateGet(this, _readResponses)?.readinessChanged(workspace);
+          },
+          readinessMayChange: (workspace) => __privateGet(this, _readResponses)?.readinessChanged(workspace),
+          localCopyUnreadable: (workspace, format) => {
+            __privateGet(this, _readability3).mark(workspace, __privateGet(this, _kernel27).head(workspaceMount(workspace), 0n), format);
+            __privateGet(this, _readResponses)?.readinessChanged(workspace);
+          },
           isLocalCopyUnreadable: (workspace) => __privateGet(this, _readability3).decide(workspace) !== void 0
         },
         // The kernel owes this peer's writes to an ordered background flush the desk schedules.
@@ -35632,7 +36040,7 @@
               aggregateIds: new Set([...admitted.affected, ...admitted.created].map((ref) => ref.id)),
               // What the offer changed, typed as reads resolve it: watches it cannot change are not read.
               stateChange: admitted.stateChange
-            }, () => __privateGet(this, _readMaintenance).tick(void 0, 0n, READ_READINESS_ONLY, false).progress !== void 0));
+            }, () => __privateGet(this, _readMaintenance).tickReadReadiness().ticked.progress !== void 0));
             noteTimeline("ownOffer", `${delivery.delivered}/${delivery.watches}`);
             noteTimeline("ownOfferSkipped", delivery.skipped);
           });
@@ -35647,7 +36055,12 @@
         observations,
         // A waiting read advances read readiness only: it must never run a background command or
         // closure warm on the foreground's turn.
-        () => __privateGet(this, _readMaintenance).tick(void 0, 0n, READ_READINESS_ONLY, false),
+        () => __privateGet(this, _readMaintenance).tickReadReadiness(),
+        // A read the kernel still finds behind, with nothing owing its index, owes it again (as a watch does).
+        (request) => {
+          if (request.command.case !== "kernelCall") throw new Error("local read continuation lost its query");
+          __privateGet(this, _readMaintenance).schedule(request.command.value.session, ReadMaintenanceCause.READ_DEBT);
+        },
         (request) => {
           if (request.command.case !== "kernelCall") throw new Error("local read continuation lost its query");
           return __privateGet(this, _application3).call(request, request.command.value);
@@ -35748,6 +36161,7 @@
         onShallowMount: (workspace, credentialCapability) => __privateGet(this, _historyAcquisition).materialise(workspace, credentialCapability),
         // The edge echoes an HTTP offer batch back over this replica's own live link (CAP-764).
         onOffered: (workspace, commitOids) => __privateGet(this, _live3).offered(workspace, commitOids),
+        liveAdmitted: (workspace) => __privateGet(this, _live3).admittedLocal(workspace),
         onOutboxHistoryRequired: (workspace, credentialCapability) => __privateGet(this, _historyAcquisition).requestFromBackground(workspace, credentialCapability),
         backgroundHistory: profile.backgroundHistory !== false,
         onSyncCompleted: (session, event) => {
@@ -35773,7 +36187,7 @@
         __privateGet(this, _origins5).ignored(workspace, origin, "follow");
         return false;
       };
-      __privateGet(this, _live3).remoteAdvanced = (workspace) => __privateGet(this, _correspondence3).replicaLinkOpened(workspace);
+      __privateGet(this, _live3).remoteAdvanced = (workspace) => __privateGet(this, _correspondence3).replicaRemoteAdvanced(workspace);
       __privateGet(this, _live3).declined = (workspace) => __privateGet(this, _correspondence3).liveAdmissionDeclined(workspace);
       __privateGet(this, _live3).acknowledged = (workspace, ack) => __privateGet(this, _correspondence3).liveAdmissionAcknowledged(workspace, ack);
       __privateGet(this, _live3).intentsAdmitted = (workspace, intentIds, local) => __privateGet(this, _correspondence3).liveIntentsAdmitted(workspace, intentIds, local);
@@ -35985,7 +36399,7 @@
         },
         owes: (workspace) => __privateGet(this, _readMaintenance).owesReadReadiness(workspace),
         // Read readiness only, as a waiting read takes: never a background command or pack import (CAP-806).
-        tick: () => __privateGet(this, _readMaintenance).tick(void 0, 0n, READ_READINESS_ONLY, false),
+        tick: () => __privateGet(this, _readMaintenance).tickReadReadiness(),
         emit: (session, event) => __privateGet(this, _trace13).emit(session, event)
       }));
       __privateSet(this, _modelAdoption, new ModelAdoptionDesk({
@@ -36202,6 +36616,10 @@
     nextEvent() {
       return __privateGet(this, _trace13).nextEvent();
     }
+    /** In-process shells wait on a held local read here instead of polling `resumeAfterMillis`. */
+    localReadResumable(workId2, notify) {
+      return __privateGet(this, _readResponses).onResumable(workId2, notify);
+    }
     close() {
       if (this.retentionOutstanding() > 0) {
         throw new Error("custody retention pending; retain the acknowledged frontiers before disposing the peer");
@@ -36568,9 +36986,8 @@
     let pendingEffectId;
     try {
       if (request.command.case === "socketReceipt") {
-        const admission = __privateGet(this, _live3).receive(request, request.command.value);
-        if (!admission) return __privateMethod(this, _PeerOffice_instances, response_fn).call(this, request, { case: "socketObserved", value: create(PeerSocketObservedSchema) });
-        request = admission;
+        __privateGet(this, _live3).receive(request.command.value);
+        return __privateMethod(this, _PeerOffice_instances, response_fn).call(this, request, { case: "socketObserved", value: create(PeerSocketObservedSchema) });
       }
       const result = timelinePhase("access", () => __privateGet(this, _access).handle(request));
       if (result.outcome.case === "correspondencePending") {
@@ -36579,11 +36996,9 @@
       }
       if (result.outcome.case === "watchStarted") __privateGet(this, _subscriptions5).retainDependencies(result.outcome.value.subscriptionId, scope);
       __privateGet(this, _subscriptions5).recoverySettled(result);
-      __privateGet(this, _live3).settled(request, result);
       __privateGet(this, _correspondence3).observeResponse(result);
       return result;
     } catch (error) {
-      __privateGet(this, _live3).failed(request.requestId);
       const failure = __privateMethod(this, _PeerOffice_instances, failure_fn).call(this, request, "nomos.runtime.workspace_access", error instanceof Error ? error.message : String(error));
       __privateGet(this, _subscriptions5).recoverySettled(failure);
       __privateGet(this, _correspondence3).observeResponse(failure);
@@ -36838,11 +37253,7 @@
           try {
             const mount = __privateGet(this, _sessions14).mountForWorkspace(request.target.workspace);
             const previousHead = __privateGet(this, _kernel27).head(mount, request.requestId);
-            const admission = __privateGet(this, _custodyAdmission).admit(
-              request,
-              request.command.value,
-              { journal: !__privateGet(this, _live3).relayed(request.requestId) }
-            );
+            const admission = __privateGet(this, _custodyAdmission).admit(request, request.command.value);
             admission.sealedMain = __privateGet(this, _residency5).retainedHead(request.target.workspace);
             if (custodyAdmissionNeedsReadMaintenance(admission)) {
               admission.localMaintenance = __privateGet(this, _readMaintenance).scheduleWorkspace(
@@ -36956,16 +37367,17 @@
           });
         case "historicQuery": {
           const answered2 = __privateGet(this, _historicQueries).execute(request, request.command.value);
-          if (answered2.outcome.case === "failure" && READ_INDEX_BUILDING.test(answered2.outcome.value.message)) {
+          if (answered2.outcome.case === "query" && answered2.outcome.value.result.case === "readIndexPending") {
             __privateGet(this, _readMaintenance).schedule(request.command.value.session, ReadMaintenanceCause.READ_DEBT);
+            const workspace = answered2.outcome.value.result.value.workspace || (__privateGet(this, _sessions14).bindingIfPresent(request.command.value.session)?.workspace ?? "");
             return __privateMethod(this, _PeerOffice_instances, response_fn).call(this, request, {
               case: "unavailable",
               value: create(RuntimeUnavailableSchema, {
                 reason: RuntimeUnavailableReason.LOCAL_REPLICA_NOT_READY,
-                workspace: __privateGet(this, _sessions14).bindingIfPresent(request.command.value.session)?.workspace ?? "",
+                workspace,
                 retryable: true,
                 retryAfterMillis: 250,
-                detail: answered2.outcome.value.message
+                detail: `the read index of ${workspace} is being built on this device; read maintenance continues it`
               })
             });
           }
@@ -37611,6 +38023,23 @@
       lanes?.wake(delayMillis);
     };
     const runner = {
+      localReadResumable(workId2) {
+        let resolve;
+        const resumable = new Promise((done) => {
+          resolve = done;
+        });
+        let timer;
+        const wait = peer2.localReadResumable(workId2, () => {
+          if (timer !== void 0) clearTimeout(timer);
+          resolve();
+        });
+        if (wait === void 0) return void 0;
+        timer = setTimeout(() => {
+          wait.cancel();
+          resolve();
+        }, wait.afterMillis);
+        return resumable;
+      },
       handleFrame(frame2) {
         const response = peer2.invoke(frame2).responseProtobuf;
         drainEvents();
@@ -37840,7 +38269,7 @@
       if (response.outcome.case === "localReadPending") {
         if (yieldLocalReadToCaller) return responseFrame;
         const pending2 = response.outcome.value;
-        await new Promise((resolve) => setTimeout(resolve, pending2.resumeAfterMillis));
+        await (runner.localReadResumable?.(pending2.workId) ?? new Promise((resolve) => setTimeout(resolve, pending2.resumeAfterMillis)));
         responseFrame = await turn(() => runner.handleFrame(toBinary(RuntimeRequestSchema, create(RuntimeRequestSchema, {
           protocolVersion: response.protocolVersion,
           requestId: response.requestId,
@@ -43579,11 +44008,30 @@
     const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes);
     return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
   };
-  var okBytes = async (fetchImpl, url) => {
+  var okBytes = async (fetchImpl, url, progress, expectedBytes) => {
     const response = await fetchImpl(url);
     if (!response.ok) throw new Error(`runtime artifact ${url}: HTTP ${response.status}`);
-    return new Uint8Array(await response.arrayBuffer());
+    const reader = progress ? response.body?.getReader() : void 0;
+    if (!reader) return new Uint8Array(await response.arrayBuffer());
+    const total = expectedBytes ?? Number(response.headers.get("content-length") ?? 0);
+    const chunks = [];
+    let received = 0;
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      chunks.push(value);
+      received += value.byteLength;
+      progress(received, total);
+    }
+    const bytes = new Uint8Array(received);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return bytes;
   };
+  var elapsedSince = (started) => globalThis.performance.now() - started;
   async function selectReleaseKernel(args) {
     const fetchImpl = args.fetchImpl ?? ((input, init) => globalThis.fetch(input, init));
     const base = args.base.replace(/\/+$/, "");
@@ -43611,11 +44059,27 @@
         }
       }
       const url = new URL(relativeUrl, repositoryUrl).toString();
-      const bytes = await okBytes(fetchImpl, url);
-      if (expected && (bytes.byteLength !== expected.size || await sha256Hex2(bytes) !== expected.sha256)) {
-        throw new Error(`runtime artifact ${url} does not match the OSGi resource it was selected by`);
+      const report = (progress) => {
+        try {
+          args.onProgress?.(progress);
+        } catch {
+        }
+      };
+      let started = globalThis.performance.now();
+      const bytes = await okBytes(fetchImpl, url, args.onProgress ? (receivedBytes, totalBytes) => report({ stage: "download", artifact: name, receivedBytes, totalBytes }) : void 0, expected?.size);
+      report({ stage: "fetched", artifact: name, millis: elapsedSince(started) });
+      if (expected) {
+        started = globalThis.performance.now();
+        if (bytes.byteLength !== expected.size || await sha256Hex2(bytes) !== expected.sha256) {
+          throw new Error(`runtime artifact ${url} does not match the OSGi resource it was selected by`);
+        }
+        report({ stage: "verified", artifact: name, millis: elapsedSince(started) });
+      }
+      if (expected && args.cache) {
+        started = globalThis.performance.now();
+        await args.cache.write(resource.contentSha256, name, bytes);
+        report({ stage: "stored", artifact: name, millis: elapsedSince(started) });
       }
-      if (expected && args.cache) await args.cache.write(resource.contentSha256, name, bytes);
       return bytes;
     };
     await verifySelectedKernel({
@@ -43701,6 +44165,8 @@
   var refusedGitTransport = (input) => Promise.reject(new Error(
     `refused: a tab moves no Git bytes itself (${String(input instanceof Request ? input.url : input).split("?")[0]}); custody comes from the workspace's stream`
   ));
+  var DOWNLOAD_PROGRESS_BYTES = 1048576;
+  var megabytes = (bytes) => (bytes / 1048576).toFixed(1);
   async function openBrowserPeer(options) {
     const bootStarted = performance.now();
     const progress = (stage) => {
@@ -43711,6 +44177,7 @@
       }
     };
     const fetchImpl = options.fetchImpl ?? globalThis.fetch.bind(globalThis);
+    const reportedBytes = /* @__PURE__ */ new Map();
     progress("opening browser custody and selecting Kernel artifacts");
     const selecting = selectReleaseKernel({
       base: options.base,
@@ -43718,7 +44185,19 @@
       release: options.release,
       fetchImpl: browserRuntimeFetch(options.base, fetchImpl, globalThis.caches, options.kernelRepositoryUrl),
       cache: options.kernelCache,
-      ...options.kernelTrustRoots === void 0 ? {} : { trustRoots: options.kernelTrustRoots }
+      ...options.kernelTrustRoots === void 0 ? {} : { trustRoots: options.kernelTrustRoots },
+      // A new kernel downloads (27 MB) and is verified and stored on the boot path: each step is
+      // progress, so the host keeps waiting, and a slow boot's report times each one (CAP-799).
+      onProgress: (step) => {
+        if (step.stage !== "download") {
+          progress(`${step.stage} ${step.artifact} in ${Math.round(step.millis)}ms`);
+          return;
+        }
+        const last = reportedBytes.get(step.artifact) ?? 0;
+        if (step.receivedBytes - last < DOWNLOAD_PROGRESS_BYTES && step.receivedBytes < step.totalBytes) return;
+        reportedBytes.set(step.artifact, step.receivedBytes);
+        progress(`downloading ${step.artifact} ${megabytes(step.receivedBytes)}/${megabytes(step.totalBytes)} MB`);
+      }
     }).then((selected) => {
       progress("selected Kernel artifacts");
       return selected;