@githolon/runtime 0.119.31 → 0.119.33

package/dist/RUNTIME-SOURCES.sha256

@@ -71,10 +71,10 @@
 33c06d52cd2978f920c683b281370b4622d8037bc4a2149c06d49ca40223e522  peer-office/src/runtime/records_desk.ts
 33e7d6bdd22396057d3f8db92384079f7ec2fda4b3582709de2d43fccacc4a9c  node_modules/@bufbuild/protobuf/dist/esm/codegenv2/extension.js
 34700c9b62d55b63b0cac5659fc10d2869d77809e0137c74216b58d6d9736515  adapter/kernel_failure.ts
-34a51508782f443beb3bca1c913363899979696b94ff480330363390570e7514  peer-office/src/runtime/live_correspondence_desk.ts
 34f8712de2bd30a2cb8366d8cfdcde466d979f1a28ac0d78f7547341b01f6c57  adapter/proto/nomos/kernel/v1/progress_pb.js
 37645d541d10a4f7782107f8d75449dd0b656b1a852e9e743919e216a1d314b0  peer-office/src/runtime/replica_follow_state.ts
 37f83564e2b43d3b488740b42eb4951aa21b60128b8be7271ab379ec81d47db6  platform-shells/browser/worker_page_entry.ts
+37ffd4b0a9438be03db9aa2d5cbb1f94489025fee3b46876707f726b6cf82456  peer-office/src/runtime/live_correspondence_desk.ts
 3b0e179a5fd3cde234903eedbadf591d103fafeffdf169d47d7a771130884fba  adapter/proto/nomos/runtime/v2/records_desk_pb.js
 3c092b8d4185badd23ecf4552434d05aa541b0cd0d534781d687db55260d5da8  adapter/proto/nomos/runtime/v2/sealing_desk_pb.js
 3c923a87cfaf9815b2801fe9ebe5720889a3eba04e2588dbf7f761aa0eb66a24  peer-office/src/runtime/custody_receipts.ts
@@ -114,7 +114,6 @@
 511c208c41516891173332c5348ee1d846c886919ace3e9deedeafc1225d6e95  peer-office/src/runtime/kernel_call_scope.ts
 513a0ca639e4d5cbb6ecce90f9668ab63f5e8ce4df2468b1ad439112b903ef0a  platform-shells/node/local-development/kernel_work_recovery.ts
 519afa7759c5cce91b66cd6b1444014ead77df1f691d0eee356b14206d32d59e  peer-office/src/runtime/workspace_call_binding.ts
-534d11140e7e6aa5ca4b8882f56ab3ac72add80ea410a8e521be0273dd8e64a5  peer-office/package/package.json
 56879b505b84ec7830fce9423473b1f61922cb35ab950d39b10cdf5b9113aa0a  adapter/proto/nomos/kernel/v1/kernel_pb.js
 56879b505b84ec7830fce9423473b1f61922cb35ab950d39b10cdf5b9113aa0a  peer-office/package/src/protocol/nomos/kernel/v1/kernel_pb.js
 56e2ac380c2d9be43647d88928727c17df70a3e734834a5be62c8bcb18616738  adapter/proto/nomos/runtime/v2/custody_desk_pb.js
@@ -208,7 +207,6 @@
 9c4c967ea6c149011acb8aabfbadb73651f84d572335c48391d627e5283c0cd0  node_modules/@bufbuild/protobuf/dist/esm/fields.js
 9e1bf39540fd14df32aa2307c44dd4d93a40a6024199f334ccf3db001f44a7f6  peer-office/src/runtime/local_copy_readability.ts
 9e82e1fc1bfd3e3573f64349dc42b4b624ed61d24e5c553f2bb4d041444f166c  node_modules/@bjorn3/browser_wasi_shim/dist/fd.js
-9f55335f6f7332d15988db9a0d1f314fdc4a82da96f08d07e846bb68792ae055  peer-office/src/runtime/workspace_sync.ts
 a0fcc6110f1154fd197a8ce056e2008dbc7d1750f8dd3ba77c3910af928ed3a1  node_modules/uri-js/dist/es5/uri.all.js
 a2869f50cbb840c1b0fa9e628b27426f9008ad1e0218685a7d129bcae15b7db9  peer-office/package/runner/build.ts
 a33120feed1faf765328722cee117f63e2147cb87052120fdacc9bd1086e67ab  peer-office/src/runtime/receiving_group_framework_wire.generated.ts
@@ -271,6 +269,7 @@ cdb1f7869edc7171b689fd532fcaa4fa039680e1af44b32cce227cf61ca3fe05  node_modules/@
 ce9ba4862b010b1d01f2ea9846ac397188526c750e7bb9d437b9ee9dd563b37d  peer-office/src/runtime/custodian_placement.ts
 cfc517180b5ade4339146bacf2ccd624770e071e00b601bd193422c2edbcabe6  node_modules/@bufbuild/protobuf/dist/esm/registry.js
 d06f53be0045dda3189ec55be539f37536166898b4e7dfd8aa4b6ee8406c4884  peer-office/src/runtime/offer_readiness_desk.ts
+d11c21a188c62572689c1e2ea15f7b61919342ed4609f1a8288627da15c9f9eb  peer-office/package/package.json
 d12b4694d7472ac029b2844cea2d850126085000fdbe5739482773d70e81dcbb  peer-office/src/runtime/live_stream_server.ts
 d13d77a3ef4461782e678f9c4f9227be039f00233de69b1742e1922a84becadc  peer-office/src/reception/typescript_application_desk.ts
 d1f73b0742c76b91aef4e20312062c2367a816de294d60f821bef2de58599413  peer-office/src/runtime/workspace_address.ts
@@ -330,6 +329,7 @@ f924465afc8098350f6ab77065360dce0b01876d1fb3061101e94ce745e25985  peer-office/sr
 fa2838d141fba0e8ee5bd2197956c3f6b1d23668be2c8841a585614ea7051f99  node_modules/@nodable/entities/src/entityTries.js
 facc9ec7ab1b104848a8fdc2c517a564c45c8b0e6794a84e48e91fca4cc916ee  peer-office/src/runtime/timeline_trace.ts
 fbc88bbf3cea189f0494b0949049ffeac334b8c5015ebfc988217f2fcdb3262b  node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/duration_pb.js
+fbf55ce167117f1c12bcf0d1a74e3a788e5888bc33dfaf6fc92db7744dbed63b  peer-office/src/runtime/workspace_sync.ts
 fd19ecbd12f0555c762fe07d53452721e7f52e26b3b59c45c6e5579a9ae381f6  peer-office/src/runtime/current_law.ts
 fe1678ab1c98db7387bea6892ec10a90a06a8e2ed01efb1ee577c3d155e4a395  node_modules/is-unsafe/src/contexts/log.js
 fe3e2b20c1ebb57c3b390c8f685ad1e04e6f493517fa7e432f4351bb77a1a4d0  node_modules/ieee754/index.js

package/dist/nomos-native-runtime.js

@@ -17959,7 +17959,7 @@ var NomosRuntimeComponent = (() => {
   }
 
   // ../src/runtime/runtime_identity.ts
-  var PEER_RUNTIME_IDENTITY = "0.119.31" ? `@githolon/runtime@${"0.119.31"}` : "@githolon/runtime@unbundled";
+  var PEER_RUNTIME_IDENTITY = "0.119.33" ? `@githolon/runtime@${"0.119.33"}` : "@githolon/runtime@unbundled";
 
   // ../src/runtime/replica_follow_desk.ts
   var REPLICA_FOLLOW_NAMESPACE = "nomos.peer-desk.replica-follow/v2";
@@ -19426,6 +19426,10 @@ var NomosRuntimeComponent = (() => {
     return new TextDecoder().decode(bytes.subarray(0, CLOSE_REASON_BYTES)).replace(/\uFFFD+$/, "");
   }
   var LIVE_CARRIED_COMMITS_BYTES = 4 * 1024 * 1024;
+  function offerFrameBytes(batch) {
+    const offers = batch.source.case === "inline" ? batch.source.value.offers : [];
+    return batch.evidencePack.byteLength + offers.reduce((total, offer) => total + offer.changeUsda.byteLength + offer.commitOid.length + offer.session.length + 16, 0) + 1024;
+  }
   var LIVE_ANSWER_WINDOW = 15000000000n;
   var LIVE_STREAM_WINDOW = 16;
   var LIVE_BATCH_COMMITS = 64;
@@ -19540,8 +19544,7 @@ var NomosRuntimeComponent = (() => {
         send: (workspace, message) => {
           const link = this.#links.get(workspace);
           if (!link || link.state !== "open" || link.publisher) return false;
-          this.#send(link, message);
-          return true;
+          return this.#send(link, message);
         },
         // This copy's main as its kernel holds it (residency is not asked: a stream ask only ever
         // comes from a procedure that has the copy open).
@@ -19831,10 +19834,17 @@ var NomosRuntimeComponent = (() => {
       this.#effect(link, { case: "openUrl", value: `${endpoint}/v2/workspaces/${encodeURIComponent(link.binding.workspace)}/subscribe?${subscribeQuery(link)}` });
       return true;
     }
+    /** Sends one frame, or refuses one too large for the live socket (large recovery uses Git) and
+     * answers false: the caller must not account a refused frame as sent. An offers frame is refused
+     * on its byte-length estimate, before it is encoded; the encoded size is the backstop. */
     #send(link, message) {
+      if (message.case === "offers" && offerFrameBytes(create(CustodyOfferBatchRequestSchema, message.value)) > MAX_LIVE_FRAME_BYTES) {
+        return false;
+      }
       const bytes = toBinary(LiveOfferFrameSchema, create(LiveOfferFrameSchema, { message }));
-      if (bytes.byteLength > MAX_LIVE_FRAME_BYTES) return;
+      if (bytes.byteLength > MAX_LIVE_FRAME_BYTES) return false;
       this.#effect(link, { case: "send", value: bytes });
+      return true;
     }
     export(binding, base, requestId, options = {}) {
       if (this.kernel.isResident(binding.workspace) === false) {
@@ -19858,11 +19868,7 @@ var NomosRuntimeComponent = (() => {
         }
       }
       const batchRequestId = `${binding.replicaId}:${batchHead}`;
-      if (intents.length) {
-        this.#own.commits(binding.workspace, intents.map((intent) => intent.oid));
-        this.#own.request(binding.workspace, batchRequestId, batchHead);
-      }
-      return create(CustodyOfferBatchRequestSchema, {
+      const batch = create(CustodyOfferBatchRequestSchema, {
         protocolVersion: 2,
         requestId: batchRequestId,
         source: { case: "inline", value: { offers: intents.map((intent) => ({
@@ -19877,6 +19883,15 @@ var NomosRuntimeComponent = (() => {
         // travel the same way.
         evidencePack: options.carryCommits || intents.some((intent) => intent.transportRequirement === IntentTransportRequirement.COMMIT_TREE) ? this.kernel.packDelta(mount, requestId, batchHead, base) : new Uint8Array()
       });
+      if (!options.registerWhenSent) this.#ownBatch(binding.workspace, batch);
+      return batch;
+    }
+    /** Records a batch this replica offered, so the custodian's answer to it is recognised as its own. */
+    #ownBatch(workspace, batch) {
+      const offers = batch.source.case === "inline" ? batch.source.value.offers : [];
+      if (!offers.length) return;
+      this.#own.commits(workspace, offers.map((offer) => offer.commitOid));
+      this.#own.request(workspace, batch.requestId, offers.at(-1).commitOid);
     }
     receive(receipt) {
       const link = [...this.#links.values()].find((item) => item.id === receipt.connectionId);
@@ -20064,6 +20079,10 @@ var NomosRuntimeComponent = (() => {
         link.convergeDue = void 0;
         link.heldRing = void 0;
       }
+      this.#followNow(workspace);
+    }
+    /** Asks for the ordinary (HTTP) round for this workspace now. */
+    #followNow(workspace) {
       if (this.declined) this.declined(workspace);
       else this.remoteAdvanced?.(workspace);
     }
@@ -20225,19 +20244,31 @@ var NomosRuntimeComponent = (() => {
                 link.binding,
                 continuesAfter ?? answered2,
                 ++this.#requestId,
-                { baseInHistory: continuesAfter !== void 0, carryCommits: false }
+                { baseInHistory: continuesAfter !== void 0, carryCommits: false, registerWhenSent: true }
               ) : this.#fittingBatch(link, continuesAfter ?? answered2, continuesAfter !== void 0);
               if (batch.evidencePack.byteLength > LIVE_CARRIED_COMMITS_BYTES && !link.publisher) {
                 batch = create(CustodyOfferBatchRequestSchema, { ...batch, evidencePack: new Uint8Array() });
               }
+              let refused = false;
               if (batch.source.case === "inline" && batch.source.value.offers.length) {
-                this.#send(link, { case: "offers", value: link.publisher ? batch : create(CustodyOfferBatchRequestSchema, {
+                refused = !this.#send(link, { case: "offers", value: link.publisher ? batch : create(CustodyOfferBatchRequestSchema, {
                   ...batch,
                   baseHead: fence,
                   fastForwardOnly: true,
                   ...continuesAfter ? { continuesAfter } : {}
                 }) });
-                if (!link.publisher && head) {
+                if (!refused) this.#ownBatch(link.binding.workspace, batch);
+                else if (!link.publisher) {
+                  this.#followNow(link.binding.workspace);
+                } else {
+                  this.#send(link, { case: "offers", value: create(CustodyOfferBatchRequestSchema, {
+                    protocolVersion: 2,
+                    requestId: batch.requestId,
+                    source: { case: "inline", value: { offers: [] } },
+                    ...head ? { observedHead: head } : {}
+                  }) });
+                }
+                if (!refused && !link.publisher && head) {
                   const batchHead = batch.source.value.offers.at(-1).commitOid;
                   link.stream ??= { sent: batchHead, unanswered: [] };
                   link.stream.sent = batchHead;
@@ -20289,8 +20320,9 @@ var NomosRuntimeComponent = (() => {
     /**
      * A follower's next batch above `base`: up to the link's commit bound, cut down until its carried
      * commits fit LIVE_CARRIED_COMMITS_BYTES and its frame fits MAX_LIVE_FRAME_BYTES. A single commit
-     * too large to carry still goes out (the custodian admits it on its own commits). Each attempt is
-     * the same bounded export, so every batch still continues its base with no hole below it.
+     * too large to carry still goes out (the custodian admits it on its own commits); a single commit
+     * whose frame cannot fit is refused by #send before it is encoded. Each attempt is the same bounded
+     * export, so every batch still continues its base with no hole below it.
      */
     #fittingBatch(link, base, baseInHistory) {
       let bound = link.batchCommits ?? LIVE_BATCH_COMMITS;
@@ -20299,12 +20331,13 @@ var NomosRuntimeComponent = (() => {
           link.binding,
           base,
           ++this.#requestId,
-          { baseInHistory, carryCommits: true, maxCommits: bound }
+          { baseInHistory, carryCommits: true, maxCommits: bound, registerWhenSent: true }
         );
         const offers = batch.source.case === "inline" ? batch.source.value.offers : [];
-        const frameBytes = batch.evidencePack.byteLength + offers.reduce((total, offer) => total + offer.changeUsda.byteLength + offer.commitOid.length + offer.session.length + 16, 0) + 1024;
+        const frameBytes = offerFrameBytes(batch);
         if (offers.length > 1 && (batch.evidencePack.byteLength > LIVE_CARRIED_COMMITS_BYTES || frameBytes > MAX_LIVE_FRAME_BYTES)) {
-          bound = Math.max(1, Math.floor(offers.length / 2));
+          const first = offers[0];
+          bound = first.changeUsda.byteLength + first.commitOid.length + first.session.length + 16 + 1024 > MAX_LIVE_FRAME_BYTES ? 1 : Math.max(1, Math.floor(offers.length / 2));
           link.batchCommits = bound;
           continue;
         }
@@ -21376,6 +21409,7 @@ var NomosRuntimeComponent = (() => {
   var MAX_NOT_CONTAINED = 1024;
   var NOT_CONTAINED_REFUSALS = /* @__PURE__ */ new Set(["nomos.stream.off_main", "nomos.stream.history_required"]);
   var MAX_REBASES_PER_ROUND = 2;
+  var OFF_CHAIN_BASE = /intents_above: base \S* is not on the first-parent chain/;
   var elapsedMillis = (clock2, started) => {
     const finished = clock2.monotonicNanoseconds();
     return finished >= started ? Number(finished - started) / 1e6 : 0;
@@ -22667,7 +22701,7 @@ var NomosRuntimeComponent = (() => {
       const head = this.#kernel.head(this.#mount, this.#requestId);
       if (tracked !== candidateHead || !head || head === tracked) return void 0;
       if (candidateHead === this.#rebaseFrom) return void 0;
-      if (this.#kernel.transportIntentsAbove(this.#mount, this.#requestId, 0n, tracked, this.#offerHead).intents.length === 0) return void 0;
+      if (!this.#holdsWorkAbove(tracked)) return void 0;
       this.#rebases += 1;
       this.#offerAfterConverge = false;
       this.#previousHead = tracked;
@@ -22678,6 +22712,23 @@ var NomosRuntimeComponent = (() => {
       this.#candidateDurable = true;
       return this.#offerOrReconcile();
     }
+    /**
+     * Whether the head this round offers holds at least one commit above `base`. Asks for the ONE
+     * commit immediately above base (the bounded `fromBase` walk the live export uses): a walk of
+     * commit objects to base plus one decoded change, never the whole suffix. Asking for the whole
+     * suffix only to test it for emptiness decoded every unsent change (5,001 commits: 3.6 s and
+     * 70.6 MB). A base off that head's first-parent chain (a dependency's captured prefix the
+     * rebase rewrote, or history that ends before base) is no fast-forward from base: there is
+     * nothing to offer onto it in this round, and the next round plans from the rebased head.
+     */
+    #holdsWorkAbove(base) {
+      try {
+        return this.#kernel.transportIntentsAbove(this.#mount, this.#requestId, 1n, base, this.#offerHead, true).intents.length > 0;
+      } catch (error) {
+        if (error instanceof Error && OFF_CHAIN_BASE.test(error.message)) return false;
+        throw error;
+      }
+    }
     /**
      * The admitted local changes a copy with a missing history commit holds above the provider's last
      * admitted head (its bookmark), oldest first. Without a reachable bookmark the walk ends at the

package/dist/nomos-runner-web.js

@@ -284,7 +284,7 @@
   }
 
   // ../../platform-shells/browser/worker_page_entry.ts
-  var workerDigest = true ? "4f8c79d9c411cfaf065f0e73e92706fdd2c9da10e549b646c6e554e4e6ab987f" : "";
+  var workerDigest = true ? "d24a79a523b9fac2983f4cd1fb19e3b4e38e5bdec73489d23aa8b024c34df155" : "";
   var SLOW_OPERATION_MICROS = 1e6;
   var slowOperationsReported = 0;
   var bootStages = [];

package/dist/nomos-runner-worker.js

@@ -27421,7 +27421,7 @@
   // ../src/runtime/runtime_identity.ts
   init_define_NOMOS_KERNEL_RELEASE();
   init_shims();
-  var PEER_RUNTIME_IDENTITY = "0.119.31" ? `@githolon/runtime@${"0.119.31"}` : "@githolon/runtime@unbundled";
+  var PEER_RUNTIME_IDENTITY = "0.119.33" ? `@githolon/runtime@${"0.119.33"}` : "@githolon/runtime@unbundled";
 
   // ../src/runtime/replica_follow_desk.ts
   init_define_NOMOS_KERNEL_RELEASE();
@@ -28977,6 +28977,10 @@
     return new TextDecoder().decode(bytes.subarray(0, CLOSE_REASON_BYTES)).replace(/\uFFFD+$/, "");
   }
   var LIVE_CARRIED_COMMITS_BYTES = 4 * 1024 * 1024;
+  function offerFrameBytes(batch) {
+    const offers = batch.source.case === "inline" ? batch.source.value.offers : [];
+    return batch.evidencePack.byteLength + offers.reduce((total, offer) => total + offer.changeUsda.byteLength + offer.commitOid.length + offer.session.length + 16, 0) + 1024;
+  }
   var LIVE_ANSWER_WINDOW = 15000000000n;
   var LIVE_STREAM_WINDOW = 16;
   var LIVE_BATCH_COMMITS = 64;
@@ -29036,7 +29040,7 @@
   };
   _commits = new WeakMap();
   _requests = new WeakMap();
-  var _links, _own, _progress, _progressOwedSince, _recounting, _walks, _sequence12, _requestId3, _closures, _LiveCorrespondenceDesk_instances, recordClosure_fn, closeByRuntime_fn, count_fn, chain_fn, walksOf_fn, custodyDeepened_fn, holds_fn, heldPeerMain_fn, cursor_fn, currentCursor_fn, effect_fn, open_fn2, send_fn, admitted_fn, declined_fn, announced_fn, releaseHeldRing_fn, placementAnnounced_fn, outcomesDigest_fn, outcomesAnnounced_fn, outcomesArrived_fn, fittingBatch_fn;
+  var _links, _own, _progress, _progressOwedSince, _recounting, _walks, _sequence12, _requestId3, _closures, _LiveCorrespondenceDesk_instances, recordClosure_fn, closeByRuntime_fn, count_fn, chain_fn, walksOf_fn, custodyDeepened_fn, holds_fn, heldPeerMain_fn, cursor_fn, currentCursor_fn, effect_fn, open_fn2, send_fn, ownBatch_fn, admitted_fn, declined_fn, followNow_fn, announced_fn, releaseHeldRing_fn, placementAnnounced_fn, outcomesDigest_fn, outcomesAnnounced_fn, outcomesArrived_fn, fittingBatch_fn;
   var LiveCorrespondenceDesk = class {
     constructor(kernel, events, clock2, relayOrigin, staging, lawTrees) {
       __privateAdd(this, _LiveCorrespondenceDesk_instances);
@@ -29099,8 +29103,7 @@
         send: (workspace, message) => {
           const link = __privateGet(this, _links).get(workspace);
           if (!link || link.state !== "open" || link.publisher) return false;
-          __privateMethod(this, _LiveCorrespondenceDesk_instances, send_fn).call(this, link, message);
-          return true;
+          return __privateMethod(this, _LiveCorrespondenceDesk_instances, send_fn).call(this, link, message);
         },
         // This copy's main as its kernel holds it (residency is not asked: a stream ask only ever
         // comes from a procedure that has the copy open).
@@ -29251,11 +29254,7 @@
         }
       }
       const batchRequestId = `${binding.replicaId}:${batchHead}`;
-      if (intents.length) {
-        __privateGet(this, _own).commits(binding.workspace, intents.map((intent) => intent.oid));
-        __privateGet(this, _own).request(binding.workspace, batchRequestId, batchHead);
-      }
-      return create(CustodyOfferBatchRequestSchema, {
+      const batch = create(CustodyOfferBatchRequestSchema, {
         protocolVersion: 2,
         requestId: batchRequestId,
         source: { case: "inline", value: { offers: intents.map((intent) => ({
@@ -29270,6 +29269,8 @@
         // travel the same way.
         evidencePack: options.carryCommits || intents.some((intent) => intent.transportRequirement === IntentTransportRequirement.COMMIT_TREE) ? this.kernel.packDelta(mount, requestId, batchHead, base) : new Uint8Array()
       });
+      if (!options.registerWhenSent) __privateMethod(this, _LiveCorrespondenceDesk_instances, ownBatch_fn).call(this, binding.workspace, batch);
+      return batch;
     }
     receive(receipt) {
       const link = [...__privateGet(this, _links).values()].find((item) => item.id === receipt.connectionId);
@@ -29424,19 +29425,31 @@
                 link.binding,
                 continuesAfter ?? answered2,
                 ++__privateWrapper(this, _requestId3)._,
-                { baseInHistory: continuesAfter !== void 0, carryCommits: false }
+                { baseInHistory: continuesAfter !== void 0, carryCommits: false, registerWhenSent: true }
               ) : __privateMethod(this, _LiveCorrespondenceDesk_instances, fittingBatch_fn).call(this, link, continuesAfter ?? answered2, continuesAfter !== void 0);
               if (batch.evidencePack.byteLength > LIVE_CARRIED_COMMITS_BYTES && !link.publisher) {
                 batch = create(CustodyOfferBatchRequestSchema, { ...batch, evidencePack: new Uint8Array() });
               }
+              let refused = false;
               if (batch.source.case === "inline" && batch.source.value.offers.length) {
-                __privateMethod(this, _LiveCorrespondenceDesk_instances, send_fn).call(this, link, { case: "offers", value: link.publisher ? batch : create(CustodyOfferBatchRequestSchema, {
+                refused = !__privateMethod(this, _LiveCorrespondenceDesk_instances, send_fn).call(this, link, { case: "offers", value: link.publisher ? batch : create(CustodyOfferBatchRequestSchema, {
                   ...batch,
                   baseHead: fence,
                   fastForwardOnly: true,
                   ...continuesAfter ? { continuesAfter } : {}
                 }) });
-                if (!link.publisher && head) {
+                if (!refused) __privateMethod(this, _LiveCorrespondenceDesk_instances, ownBatch_fn).call(this, link.binding.workspace, batch);
+                else if (!link.publisher) {
+                  __privateMethod(this, _LiveCorrespondenceDesk_instances, followNow_fn).call(this, link.binding.workspace);
+                } else {
+                  __privateMethod(this, _LiveCorrespondenceDesk_instances, send_fn).call(this, link, { case: "offers", value: create(CustodyOfferBatchRequestSchema, {
+                    protocolVersion: 2,
+                    requestId: batch.requestId,
+                    source: { case: "inline", value: { offers: [] } },
+                    ...head ? { observedHead: head } : {}
+                  }) });
+                }
+                if (!refused && !link.publisher && head) {
                   const batchHead = batch.source.value.offers.at(-1).commitOid;
                   link.stream ?? (link.stream = { sent: batchHead, unanswered: [] });
                   link.stream.sent = batchHead;
@@ -29659,10 +29672,24 @@
     __privateMethod(this, _LiveCorrespondenceDesk_instances, effect_fn).call(this, link, { case: "openUrl", value: `${endpoint}/v2/workspaces/${encodeURIComponent(link.binding.workspace)}/subscribe?${subscribeQuery(link)}` });
     return true;
   };
+  /** Sends one frame, or refuses one too large for the live socket (large recovery uses Git) and
+   * answers false: the caller must not account a refused frame as sent. An offers frame is refused
+   * on its byte-length estimate, before it is encoded; the encoded size is the backstop. */
   send_fn = function(link, message) {
+    if (message.case === "offers" && offerFrameBytes(create(CustodyOfferBatchRequestSchema, message.value)) > MAX_LIVE_FRAME_BYTES) {
+      return false;
+    }
     const bytes = toBinary(LiveOfferFrameSchema, create(LiveOfferFrameSchema, { message }));
-    if (bytes.byteLength > MAX_LIVE_FRAME_BYTES) return;
+    if (bytes.byteLength > MAX_LIVE_FRAME_BYTES) return false;
     __privateMethod(this, _LiveCorrespondenceDesk_instances, effect_fn).call(this, link, { case: "send", value: bytes });
+    return true;
+  };
+  /** Records a batch this replica offered, so the custodian's answer to it is recognised as its own. */
+  ownBatch_fn = function(workspace, batch) {
+    const offers = batch.source.case === "inline" ? batch.source.value.offers : [];
+    if (!offers.length) return;
+    __privateGet(this, _own).commits(workspace, offers.map((offer) => offer.commitOid));
+    __privateGet(this, _own).request(workspace, batch.requestId, offers.at(-1).commitOid);
   };
   /**
    * The custodian judged a live batch. Admission acknowledges the batch at once; its admitted main
@@ -29768,6 +29795,10 @@
       link.convergeDue = void 0;
       link.heldRing = void 0;
     }
+    __privateMethod(this, _LiveCorrespondenceDesk_instances, followNow_fn).call(this, workspace);
+  };
+  /** Asks for the ordinary (HTTP) round for this workspace now. */
+  followNow_fn = function(workspace) {
     if (this.declined) this.declined(workspace);
     else this.remoteAdvanced?.(workspace);
   };
@@ -29861,8 +29892,9 @@
   /**
    * A follower's next batch above `base`: up to the link's commit bound, cut down until its carried
    * commits fit LIVE_CARRIED_COMMITS_BYTES and its frame fits MAX_LIVE_FRAME_BYTES. A single commit
-   * too large to carry still goes out (the custodian admits it on its own commits). Each attempt is
-   * the same bounded export, so every batch still continues its base with no hole below it.
+   * too large to carry still goes out (the custodian admits it on its own commits); a single commit
+   * whose frame cannot fit is refused by #send before it is encoded. Each attempt is the same bounded
+   * export, so every batch still continues its base with no hole below it.
    */
   fittingBatch_fn = function(link, base, baseInHistory) {
     let bound = link.batchCommits ?? LIVE_BATCH_COMMITS;
@@ -29871,12 +29903,13 @@
         link.binding,
         base,
         ++__privateWrapper(this, _requestId3)._,
-        { baseInHistory, carryCommits: true, maxCommits: bound }
+        { baseInHistory, carryCommits: true, maxCommits: bound, registerWhenSent: true }
       );
       const offers = batch.source.case === "inline" ? batch.source.value.offers : [];
-      const frameBytes = batch.evidencePack.byteLength + offers.reduce((total, offer) => total + offer.changeUsda.byteLength + offer.commitOid.length + offer.session.length + 16, 0) + 1024;
+      const frameBytes = offerFrameBytes(batch);
       if (offers.length > 1 && (batch.evidencePack.byteLength > LIVE_CARRIED_COMMITS_BYTES || frameBytes > MAX_LIVE_FRAME_BYTES)) {
-        bound = Math.max(1, Math.floor(offers.length / 2));
+        const first = offers[0];
+        bound = first.changeUsda.byteLength + first.commitOid.length + first.session.length + 16 + 1024 > MAX_LIVE_FRAME_BYTES ? 1 : Math.max(1, Math.floor(offers.length / 2));
         link.batchCommits = bound;
         continue;
       }
@@ -31025,11 +31058,12 @@
   var MAX_NOT_CONTAINED = 1024;
   var NOT_CONTAINED_REFUSALS = /* @__PURE__ */ new Set(["nomos.stream.off_main", "nomos.stream.history_required"]);
   var MAX_REBASES_PER_ROUND = 2;
+  var OFF_CHAIN_BASE = /intents_above: base \S* is not on the first-parent chain/;
   var elapsedMillis = (clock2, started) => {
     const finished = clock2.monotonicNanoseconds();
     return finished >= started ? Number(finished - started) / 1e6 : 0;
   };
-  var _kernel19, _credentials4, _clock14, _mount2, _binding, _route2, _rediscover, _reroute, _discoveredFrontier, _observePlacement, _recheckPlacement, _directoryAnswered, _placementFetched, _acquired, _streamSequence, _historySlices, _levelling, _roundStartHead, _levelledBatches, _levelledBytes, _boundaries, _sealedObserved, _command2, _requestId6, _started, _state, _localHead, _offerHead, _previousHead, _pushMillis, _pushBytes, _desiredHead, _candidateDurable, _admissionSummary, _offerReceipt, _pushError, _current3, _lastReceiptEffectId2, _offerSequence, _lastStep2, _probeOnly, _liveConnected, _liveAdmitted, _establishedBase, _completeHistory, _lawProductsImported, _lawProductsInFlight, _shallowMounted, _fetchedLawProducts, _needsReconciliation, _offerAfterConverge, _rebaseFrom, _rebases, _remountsLost, _containment, _containmentProven, _containedBookmark, _parkedLocal, _replaceLocalHead, _repairMissingCommit, _receiveStep, _offered, _lawTrees, _wholeAsked, _receiveSteps, _importId, _importSource, _WorkspaceSyncWork_instances, openRound_fn, mayBeContained_fn, custodianMainOffLocalChain_fn, askContainment_fn, contained_fn, notContained_fn, offerOrReconcile_fn, establishBase_fn, missingTrackedBase_fn, holdsLocalWork_fn, holdsUnsyncedCommits_fn, pullBeforeOffer_fn, acquire_fn, lawProductsFetch_fn, streamEffect_fn, acceptStream_fn, importStep_fn, imported_fn, historyOrMount_fn, remount_fn, remountLost_fn, beginOffer_fn, acceptOffer_fn, placementFrontier_fn, placementOnly_fn, acceptDiscovery_fn, providerCustody_fn, mountFetched_fn, lawProductsRequest_fn, acceptLawProducts_fn, providerCustodyMounted_fn, importLawProducts_fn, converge_fn2, convergeStep_fn, unrelatedLineageRefusal_fn, replaceLocal_fn, converged_fn, offerAfterRebase_fn, preservedSuffix_fn, offerPreserved_fn, preservedCopy_fn, alreadyJudged_fn, rememberJudgment_fn, forgetJudgment_fn, present_fn, finishOfferOutcome_fn, finishWarming_fn, transportFailure_fn, remember_fn4, finish_fn2, cloudBase_fn, offerEndpoint_fn, workspaceEndpoint_fn, authToken_fn;
+  var _kernel19, _credentials4, _clock14, _mount2, _binding, _route2, _rediscover, _reroute, _discoveredFrontier, _observePlacement, _recheckPlacement, _directoryAnswered, _placementFetched, _acquired, _streamSequence, _historySlices, _levelling, _roundStartHead, _levelledBatches, _levelledBytes, _boundaries, _sealedObserved, _command2, _requestId6, _started, _state, _localHead, _offerHead, _previousHead, _pushMillis, _pushBytes, _desiredHead, _candidateDurable, _admissionSummary, _offerReceipt, _pushError, _current3, _lastReceiptEffectId2, _offerSequence, _lastStep2, _probeOnly, _liveConnected, _liveAdmitted, _establishedBase, _completeHistory, _lawProductsImported, _lawProductsInFlight, _shallowMounted, _fetchedLawProducts, _needsReconciliation, _offerAfterConverge, _rebaseFrom, _rebases, _remountsLost, _containment, _containmentProven, _containedBookmark, _parkedLocal, _replaceLocalHead, _repairMissingCommit, _receiveStep, _offered, _lawTrees, _wholeAsked, _receiveSteps, _importId, _importSource, _WorkspaceSyncWork_instances, openRound_fn, mayBeContained_fn, custodianMainOffLocalChain_fn, askContainment_fn, contained_fn, notContained_fn, offerOrReconcile_fn, establishBase_fn, missingTrackedBase_fn, holdsLocalWork_fn, holdsUnsyncedCommits_fn, pullBeforeOffer_fn, acquire_fn, lawProductsFetch_fn, streamEffect_fn, acceptStream_fn, importStep_fn, imported_fn, historyOrMount_fn, remount_fn, remountLost_fn, beginOffer_fn, acceptOffer_fn, placementFrontier_fn, placementOnly_fn, acceptDiscovery_fn, providerCustody_fn, mountFetched_fn, lawProductsRequest_fn, acceptLawProducts_fn, providerCustodyMounted_fn, importLawProducts_fn, converge_fn2, convergeStep_fn, unrelatedLineageRefusal_fn, replaceLocal_fn, converged_fn, offerAfterRebase_fn, holdsWorkAbove_fn, preservedSuffix_fn, offerPreserved_fn, preservedCopy_fn, alreadyJudged_fn, rememberJudgment_fn, forgetJudgment_fn, present_fn, finishOfferOutcome_fn, finishWarming_fn, transportFailure_fn, remember_fn4, finish_fn2, cloudBase_fn, offerEndpoint_fn, workspaceEndpoint_fn, authToken_fn;
   var WorkspaceSyncWork = class {
     constructor(args) {
       __privateAdd(this, _WorkspaceSyncWork_instances);
@@ -32346,7 +32380,7 @@
     const head = __privateGet(this, _kernel19).head(__privateGet(this, _mount2), __privateGet(this, _requestId6));
     if (tracked !== candidateHead || !head || head === tracked) return void 0;
     if (candidateHead === __privateGet(this, _rebaseFrom)) return void 0;
-    if (__privateGet(this, _kernel19).transportIntentsAbove(__privateGet(this, _mount2), __privateGet(this, _requestId6), 0n, tracked, __privateGet(this, _offerHead)).intents.length === 0) return void 0;
+    if (!__privateMethod(this, _WorkspaceSyncWork_instances, holdsWorkAbove_fn).call(this, tracked)) return void 0;
     __privateSet(this, _rebases, __privateGet(this, _rebases) + 1);
     __privateSet(this, _offerAfterConverge, false);
     __privateSet(this, _previousHead, tracked);
@@ -32357,6 +32391,23 @@
     __privateSet(this, _candidateDurable, true);
     return __privateMethod(this, _WorkspaceSyncWork_instances, offerOrReconcile_fn).call(this);
   };
+  /**
+   * Whether the head this round offers holds at least one commit above `base`. Asks for the ONE
+   * commit immediately above base (the bounded `fromBase` walk the live export uses): a walk of
+   * commit objects to base plus one decoded change, never the whole suffix. Asking for the whole
+   * suffix only to test it for emptiness decoded every unsent change (5,001 commits: 3.6 s and
+   * 70.6 MB). A base off that head's first-parent chain (a dependency's captured prefix the
+   * rebase rewrote, or history that ends before base) is no fast-forward from base: there is
+   * nothing to offer onto it in this round, and the next round plans from the rebased head.
+   */
+  holdsWorkAbove_fn = function(base) {
+    try {
+      return __privateGet(this, _kernel19).transportIntentsAbove(__privateGet(this, _mount2), __privateGet(this, _requestId6), 1n, base, __privateGet(this, _offerHead), true).intents.length > 0;
+    } catch (error) {
+      if (error instanceof Error && OFF_CHAIN_BASE.test(error.message)) return false;
+      throw error;
+    }
+  };
   /**
    * The admitted local changes a copy with a missing history commit holds above the provider's last
    * admitted head (its bookmark), oldest first. Without a reachable bookmark the walk ends at the

package/dist/nomos-runner.js

@@ -27684,7 +27684,7 @@
   // ../src/runtime/runtime_identity.ts
   init_define_NOMOS_KERNEL_RELEASE();
   init_shims();
-  var PEER_RUNTIME_IDENTITY = "0.119.31" ? `@githolon/runtime@${"0.119.31"}` : "@githolon/runtime@unbundled";
+  var PEER_RUNTIME_IDENTITY = "0.119.33" ? `@githolon/runtime@${"0.119.33"}` : "@githolon/runtime@unbundled";
 
   // ../src/runtime/replica_follow_desk.ts
   init_define_NOMOS_KERNEL_RELEASE();
@@ -29234,6 +29234,10 @@
     return new TextDecoder().decode(bytes.subarray(0, CLOSE_REASON_BYTES)).replace(/\uFFFD+$/, "");
   }
   var LIVE_CARRIED_COMMITS_BYTES = 4 * 1024 * 1024;
+  function offerFrameBytes(batch) {
+    const offers = batch.source.case === "inline" ? batch.source.value.offers : [];
+    return batch.evidencePack.byteLength + offers.reduce((total, offer) => total + offer.changeUsda.byteLength + offer.commitOid.length + offer.session.length + 16, 0) + 1024;
+  }
   var LIVE_ANSWER_WINDOW = 15000000000n;
   var LIVE_STREAM_WINDOW = 16;
   var LIVE_BATCH_COMMITS = 64;
@@ -29293,7 +29297,7 @@
   };
   _commits = new WeakMap();
   _requests = new WeakMap();
-  var _links, _own, _progress, _progressOwedSince, _recounting, _walks, _sequence12, _requestId3, _closures, _LiveCorrespondenceDesk_instances, recordClosure_fn, closeByRuntime_fn, count_fn, chain_fn, walksOf_fn, custodyDeepened_fn, holds_fn, heldPeerMain_fn, cursor_fn, currentCursor_fn, effect_fn, open_fn2, send_fn, admitted_fn, declined_fn, announced_fn, releaseHeldRing_fn, placementAnnounced_fn, outcomesDigest_fn, outcomesAnnounced_fn, outcomesArrived_fn, fittingBatch_fn;
+  var _links, _own, _progress, _progressOwedSince, _recounting, _walks, _sequence12, _requestId3, _closures, _LiveCorrespondenceDesk_instances, recordClosure_fn, closeByRuntime_fn, count_fn, chain_fn, walksOf_fn, custodyDeepened_fn, holds_fn, heldPeerMain_fn, cursor_fn, currentCursor_fn, effect_fn, open_fn2, send_fn, ownBatch_fn, admitted_fn, declined_fn, followNow_fn, announced_fn, releaseHeldRing_fn, placementAnnounced_fn, outcomesDigest_fn, outcomesAnnounced_fn, outcomesArrived_fn, fittingBatch_fn;
   var LiveCorrespondenceDesk = class {
     constructor(kernel, events, clock2, relayOrigin, staging, lawTrees) {
       __privateAdd(this, _LiveCorrespondenceDesk_instances);
@@ -29356,8 +29360,7 @@
         send: (workspace, message) => {
           const link = __privateGet(this, _links).get(workspace);
           if (!link || link.state !== "open" || link.publisher) return false;
-          __privateMethod(this, _LiveCorrespondenceDesk_instances, send_fn).call(this, link, message);
-          return true;
+          return __privateMethod(this, _LiveCorrespondenceDesk_instances, send_fn).call(this, link, message);
         },
         // This copy's main as its kernel holds it (residency is not asked: a stream ask only ever
         // comes from a procedure that has the copy open).
@@ -29508,11 +29511,7 @@
         }
       }
       const batchRequestId = `${binding.replicaId}:${batchHead}`;
-      if (intents.length) {
-        __privateGet(this, _own).commits(binding.workspace, intents.map((intent) => intent.oid));
-        __privateGet(this, _own).request(binding.workspace, batchRequestId, batchHead);
-      }
-      return create(CustodyOfferBatchRequestSchema, {
+      const batch = create(CustodyOfferBatchRequestSchema, {
         protocolVersion: 2,
         requestId: batchRequestId,
         source: { case: "inline", value: { offers: intents.map((intent) => ({
@@ -29527,6 +29526,8 @@
         // travel the same way.
         evidencePack: options.carryCommits || intents.some((intent) => intent.transportRequirement === IntentTransportRequirement.COMMIT_TREE) ? this.kernel.packDelta(mount, requestId, batchHead, base) : new Uint8Array()
       });
+      if (!options.registerWhenSent) __privateMethod(this, _LiveCorrespondenceDesk_instances, ownBatch_fn).call(this, binding.workspace, batch);
+      return batch;
     }
     receive(receipt) {
       const link = [...__privateGet(this, _links).values()].find((item) => item.id === receipt.connectionId);
@@ -29681,19 +29682,31 @@
                 link.binding,
                 continuesAfter ?? answered2,
                 ++__privateWrapper(this, _requestId3)._,
-                { baseInHistory: continuesAfter !== void 0, carryCommits: false }
+                { baseInHistory: continuesAfter !== void 0, carryCommits: false, registerWhenSent: true }
               ) : __privateMethod(this, _LiveCorrespondenceDesk_instances, fittingBatch_fn).call(this, link, continuesAfter ?? answered2, continuesAfter !== void 0);
               if (batch.evidencePack.byteLength > LIVE_CARRIED_COMMITS_BYTES && !link.publisher) {
                 batch = create(CustodyOfferBatchRequestSchema, { ...batch, evidencePack: new Uint8Array() });
               }
+              let refused = false;
               if (batch.source.case === "inline" && batch.source.value.offers.length) {
-                __privateMethod(this, _LiveCorrespondenceDesk_instances, send_fn).call(this, link, { case: "offers", value: link.publisher ? batch : create(CustodyOfferBatchRequestSchema, {
+                refused = !__privateMethod(this, _LiveCorrespondenceDesk_instances, send_fn).call(this, link, { case: "offers", value: link.publisher ? batch : create(CustodyOfferBatchRequestSchema, {
                   ...batch,
                   baseHead: fence,
                   fastForwardOnly: true,
                   ...continuesAfter ? { continuesAfter } : {}
                 }) });
-                if (!link.publisher && head) {
+                if (!refused) __privateMethod(this, _LiveCorrespondenceDesk_instances, ownBatch_fn).call(this, link.binding.workspace, batch);
+                else if (!link.publisher) {
+                  __privateMethod(this, _LiveCorrespondenceDesk_instances, followNow_fn).call(this, link.binding.workspace);
+                } else {
+                  __privateMethod(this, _LiveCorrespondenceDesk_instances, send_fn).call(this, link, { case: "offers", value: create(CustodyOfferBatchRequestSchema, {
+                    protocolVersion: 2,
+                    requestId: batch.requestId,
+                    source: { case: "inline", value: { offers: [] } },
+                    ...head ? { observedHead: head } : {}
+                  }) });
+                }
+                if (!refused && !link.publisher && head) {
                   const batchHead = batch.source.value.offers.at(-1).commitOid;
                   link.stream ?? (link.stream = { sent: batchHead, unanswered: [] });
                   link.stream.sent = batchHead;
@@ -29916,10 +29929,24 @@
     __privateMethod(this, _LiveCorrespondenceDesk_instances, effect_fn).call(this, link, { case: "openUrl", value: `${endpoint}/v2/workspaces/${encodeURIComponent(link.binding.workspace)}/subscribe?${subscribeQuery(link)}` });
     return true;
   };
+  /** Sends one frame, or refuses one too large for the live socket (large recovery uses Git) and
+   * answers false: the caller must not account a refused frame as sent. An offers frame is refused
+   * on its byte-length estimate, before it is encoded; the encoded size is the backstop. */
   send_fn = function(link, message) {
+    if (message.case === "offers" && offerFrameBytes(create(CustodyOfferBatchRequestSchema, message.value)) > MAX_LIVE_FRAME_BYTES) {
+      return false;
+    }
     const bytes = toBinary(LiveOfferFrameSchema, create(LiveOfferFrameSchema, { message }));
-    if (bytes.byteLength > MAX_LIVE_FRAME_BYTES) return;
+    if (bytes.byteLength > MAX_LIVE_FRAME_BYTES) return false;
     __privateMethod(this, _LiveCorrespondenceDesk_instances, effect_fn).call(this, link, { case: "send", value: bytes });
+    return true;
+  };
+  /** Records a batch this replica offered, so the custodian's answer to it is recognised as its own. */
+  ownBatch_fn = function(workspace, batch) {
+    const offers = batch.source.case === "inline" ? batch.source.value.offers : [];
+    if (!offers.length) return;
+    __privateGet(this, _own).commits(workspace, offers.map((offer) => offer.commitOid));
+    __privateGet(this, _own).request(workspace, batch.requestId, offers.at(-1).commitOid);
   };
   /**
    * The custodian judged a live batch. Admission acknowledges the batch at once; its admitted main
@@ -30025,6 +30052,10 @@
       link.convergeDue = void 0;
       link.heldRing = void 0;
     }
+    __privateMethod(this, _LiveCorrespondenceDesk_instances, followNow_fn).call(this, workspace);
+  };
+  /** Asks for the ordinary (HTTP) round for this workspace now. */
+  followNow_fn = function(workspace) {
     if (this.declined) this.declined(workspace);
     else this.remoteAdvanced?.(workspace);
   };
@@ -30118,8 +30149,9 @@
   /**
    * A follower's next batch above `base`: up to the link's commit bound, cut down until its carried
    * commits fit LIVE_CARRIED_COMMITS_BYTES and its frame fits MAX_LIVE_FRAME_BYTES. A single commit
-   * too large to carry still goes out (the custodian admits it on its own commits). Each attempt is
-   * the same bounded export, so every batch still continues its base with no hole below it.
+   * too large to carry still goes out (the custodian admits it on its own commits); a single commit
+   * whose frame cannot fit is refused by #send before it is encoded. Each attempt is the same bounded
+   * export, so every batch still continues its base with no hole below it.
    */
   fittingBatch_fn = function(link, base, baseInHistory) {
     let bound = link.batchCommits ?? LIVE_BATCH_COMMITS;
@@ -30128,12 +30160,13 @@
         link.binding,
         base,
         ++__privateWrapper(this, _requestId3)._,
-        { baseInHistory, carryCommits: true, maxCommits: bound }
+        { baseInHistory, carryCommits: true, maxCommits: bound, registerWhenSent: true }
       );
       const offers = batch.source.case === "inline" ? batch.source.value.offers : [];
-      const frameBytes = batch.evidencePack.byteLength + offers.reduce((total, offer) => total + offer.changeUsda.byteLength + offer.commitOid.length + offer.session.length + 16, 0) + 1024;
+      const frameBytes = offerFrameBytes(batch);
       if (offers.length > 1 && (batch.evidencePack.byteLength > LIVE_CARRIED_COMMITS_BYTES || frameBytes > MAX_LIVE_FRAME_BYTES)) {
-        bound = Math.max(1, Math.floor(offers.length / 2));
+        const first = offers[0];
+        bound = first.changeUsda.byteLength + first.commitOid.length + first.session.length + 16 + 1024 > MAX_LIVE_FRAME_BYTES ? 1 : Math.max(1, Math.floor(offers.length / 2));
         link.batchCommits = bound;
         continue;
       }
@@ -31282,11 +31315,12 @@
   var MAX_NOT_CONTAINED = 1024;
   var NOT_CONTAINED_REFUSALS = /* @__PURE__ */ new Set(["nomos.stream.off_main", "nomos.stream.history_required"]);
   var MAX_REBASES_PER_ROUND = 2;
+  var OFF_CHAIN_BASE = /intents_above: base \S* is not on the first-parent chain/;
   var elapsedMillis = (clock2, started) => {
     const finished = clock2.monotonicNanoseconds();
     return finished >= started ? Number(finished - started) / 1e6 : 0;
   };
-  var _kernel19, _credentials4, _clock14, _mount2, _binding, _route2, _rediscover, _reroute, _discoveredFrontier, _observePlacement, _recheckPlacement, _directoryAnswered, _placementFetched, _acquired, _streamSequence, _historySlices, _levelling, _roundStartHead, _levelledBatches, _levelledBytes, _boundaries, _sealedObserved, _command2, _requestId6, _started, _state, _localHead, _offerHead, _previousHead, _pushMillis, _pushBytes, _desiredHead, _candidateDurable, _admissionSummary, _offerReceipt, _pushError, _current3, _lastReceiptEffectId2, _offerSequence, _lastStep2, _probeOnly, _liveConnected, _liveAdmitted, _establishedBase, _completeHistory, _lawProductsImported, _lawProductsInFlight, _shallowMounted, _fetchedLawProducts, _needsReconciliation, _offerAfterConverge, _rebaseFrom, _rebases, _remountsLost, _containment, _containmentProven, _containedBookmark, _parkedLocal, _replaceLocalHead, _repairMissingCommit, _receiveStep, _offered, _lawTrees, _wholeAsked, _receiveSteps, _importId, _importSource, _WorkspaceSyncWork_instances, openRound_fn, mayBeContained_fn, custodianMainOffLocalChain_fn, askContainment_fn, contained_fn, notContained_fn, offerOrReconcile_fn, establishBase_fn, missingTrackedBase_fn, holdsLocalWork_fn, holdsUnsyncedCommits_fn, pullBeforeOffer_fn, acquire_fn, lawProductsFetch_fn, streamEffect_fn, acceptStream_fn, importStep_fn, imported_fn, historyOrMount_fn, remount_fn, remountLost_fn, beginOffer_fn, acceptOffer_fn, placementFrontier_fn, placementOnly_fn, acceptDiscovery_fn, providerCustody_fn, mountFetched_fn, lawProductsRequest_fn, acceptLawProducts_fn, providerCustodyMounted_fn, importLawProducts_fn, converge_fn2, convergeStep_fn, unrelatedLineageRefusal_fn, replaceLocal_fn, converged_fn, offerAfterRebase_fn, preservedSuffix_fn, offerPreserved_fn, preservedCopy_fn, alreadyJudged_fn, rememberJudgment_fn, forgetJudgment_fn, present_fn, finishOfferOutcome_fn, finishWarming_fn, transportFailure_fn, remember_fn4, finish_fn2, cloudBase_fn, offerEndpoint_fn, workspaceEndpoint_fn, authToken_fn;
+  var _kernel19, _credentials4, _clock14, _mount2, _binding, _route2, _rediscover, _reroute, _discoveredFrontier, _observePlacement, _recheckPlacement, _directoryAnswered, _placementFetched, _acquired, _streamSequence, _historySlices, _levelling, _roundStartHead, _levelledBatches, _levelledBytes, _boundaries, _sealedObserved, _command2, _requestId6, _started, _state, _localHead, _offerHead, _previousHead, _pushMillis, _pushBytes, _desiredHead, _candidateDurable, _admissionSummary, _offerReceipt, _pushError, _current3, _lastReceiptEffectId2, _offerSequence, _lastStep2, _probeOnly, _liveConnected, _liveAdmitted, _establishedBase, _completeHistory, _lawProductsImported, _lawProductsInFlight, _shallowMounted, _fetchedLawProducts, _needsReconciliation, _offerAfterConverge, _rebaseFrom, _rebases, _remountsLost, _containment, _containmentProven, _containedBookmark, _parkedLocal, _replaceLocalHead, _repairMissingCommit, _receiveStep, _offered, _lawTrees, _wholeAsked, _receiveSteps, _importId, _importSource, _WorkspaceSyncWork_instances, openRound_fn, mayBeContained_fn, custodianMainOffLocalChain_fn, askContainment_fn, contained_fn, notContained_fn, offerOrReconcile_fn, establishBase_fn, missingTrackedBase_fn, holdsLocalWork_fn, holdsUnsyncedCommits_fn, pullBeforeOffer_fn, acquire_fn, lawProductsFetch_fn, streamEffect_fn, acceptStream_fn, importStep_fn, imported_fn, historyOrMount_fn, remount_fn, remountLost_fn, beginOffer_fn, acceptOffer_fn, placementFrontier_fn, placementOnly_fn, acceptDiscovery_fn, providerCustody_fn, mountFetched_fn, lawProductsRequest_fn, acceptLawProducts_fn, providerCustodyMounted_fn, importLawProducts_fn, converge_fn2, convergeStep_fn, unrelatedLineageRefusal_fn, replaceLocal_fn, converged_fn, offerAfterRebase_fn, holdsWorkAbove_fn, preservedSuffix_fn, offerPreserved_fn, preservedCopy_fn, alreadyJudged_fn, rememberJudgment_fn, forgetJudgment_fn, present_fn, finishOfferOutcome_fn, finishWarming_fn, transportFailure_fn, remember_fn4, finish_fn2, cloudBase_fn, offerEndpoint_fn, workspaceEndpoint_fn, authToken_fn;
   var WorkspaceSyncWork = class {
     constructor(args) {
       __privateAdd(this, _WorkspaceSyncWork_instances);
@@ -32603,7 +32637,7 @@
     const head = __privateGet(this, _kernel19).head(__privateGet(this, _mount2), __privateGet(this, _requestId6));
     if (tracked !== candidateHead || !head || head === tracked) return void 0;
     if (candidateHead === __privateGet(this, _rebaseFrom)) return void 0;
-    if (__privateGet(this, _kernel19).transportIntentsAbove(__privateGet(this, _mount2), __privateGet(this, _requestId6), 0n, tracked, __privateGet(this, _offerHead)).intents.length === 0) return void 0;
+    if (!__privateMethod(this, _WorkspaceSyncWork_instances, holdsWorkAbove_fn).call(this, tracked)) return void 0;
     __privateSet(this, _rebases, __privateGet(this, _rebases) + 1);
     __privateSet(this, _offerAfterConverge, false);
     __privateSet(this, _previousHead, tracked);
@@ -32614,6 +32648,23 @@
     __privateSet(this, _candidateDurable, true);
     return __privateMethod(this, _WorkspaceSyncWork_instances, offerOrReconcile_fn).call(this);
   };
+  /**
+   * Whether the head this round offers holds at least one commit above `base`. Asks for the ONE
+   * commit immediately above base (the bounded `fromBase` walk the live export uses): a walk of
+   * commit objects to base plus one decoded change, never the whole suffix. Asking for the whole
+   * suffix only to test it for emptiness decoded every unsent change (5,001 commits: 3.6 s and
+   * 70.6 MB). A base off that head's first-parent chain (a dependency's captured prefix the
+   * rebase rewrote, or history that ends before base) is no fast-forward from base: there is
+   * nothing to offer onto it in this round, and the next round plans from the rebased head.
+   */
+  holdsWorkAbove_fn = function(base) {
+    try {
+      return __privateGet(this, _kernel19).transportIntentsAbove(__privateGet(this, _mount2), __privateGet(this, _requestId6), 1n, base, __privateGet(this, _offerHead), true).intents.length > 0;
+    } catch (error) {
+      if (error instanceof Error && OFF_CHAIN_BASE.test(error.message)) return false;
+      throw error;
+    }
+  };
   /**
    * The admitted local changes a copy with a missing history commit holds above the provider's last
    * admitted head (its bookmark), oldest first. Without a reachable bookmark the walk ends at the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/runtime",
-  "version": "0.119.31",
+  "version": "0.119.33",
   "type": "module",
   "description": "The portable Nomos application runtime, reception contracts, and Node/browser runners.",
   "license": "SEE LICENSE IN LICENSE.md",

package/runner/node-entry.mjs

@@ -26258,7 +26258,7 @@ function delayUntilDue(follow, nowUnixMillis) {
 
 // ../src/runtime/runtime_identity.ts
 init_define_NOMOS_KERNEL_RELEASE();
-var PEER_RUNTIME_IDENTITY = "0.119.31" ? `@githolon/runtime@${"0.119.31"}` : "@githolon/runtime@unbundled";
+var PEER_RUNTIME_IDENTITY = "0.119.33" ? `@githolon/runtime@${"0.119.33"}` : "@githolon/runtime@unbundled";
 
 // ../src/runtime/replica_follow_desk.ts
 init_define_NOMOS_KERNEL_RELEASE();
@@ -27740,6 +27740,10 @@ function boundedReason(reason) {
   return new TextDecoder().decode(bytes.subarray(0, CLOSE_REASON_BYTES)).replace(/\uFFFD+$/, "");
 }
 var LIVE_CARRIED_COMMITS_BYTES = 4 * 1024 * 1024;
+function offerFrameBytes(batch) {
+  const offers = batch.source.case === "inline" ? batch.source.value.offers : [];
+  return batch.evidencePack.byteLength + offers.reduce((total, offer) => total + offer.changeUsda.byteLength + offer.commitOid.length + offer.session.length + 16, 0) + 1024;
+}
 var LIVE_ANSWER_WINDOW = 15000000000n;
 var LIVE_STREAM_WINDOW = 16;
 var LIVE_BATCH_COMMITS = 64;
@@ -27854,8 +27858,7 @@ var LiveCorrespondenceDesk = class {
       send: (workspace, message) => {
         const link = this.#links.get(workspace);
         if (!link || link.state !== "open" || link.publisher) return false;
-        this.#send(link, message);
-        return true;
+        return this.#send(link, message);
       },
       // This copy's main as its kernel holds it (residency is not asked: a stream ask only ever
       // comes from a procedure that has the copy open).
@@ -28145,10 +28148,17 @@ var LiveCorrespondenceDesk = class {
     this.#effect(link, { case: "openUrl", value: `${endpoint}/v2/workspaces/${encodeURIComponent(link.binding.workspace)}/subscribe?${subscribeQuery(link)}` });
     return true;
   }
+  /** Sends one frame, or refuses one too large for the live socket (large recovery uses Git) and
+   * answers false: the caller must not account a refused frame as sent. An offers frame is refused
+   * on its byte-length estimate, before it is encoded; the encoded size is the backstop. */
   #send(link, message) {
+    if (message.case === "offers" && offerFrameBytes(create(CustodyOfferBatchRequestSchema, message.value)) > MAX_LIVE_FRAME_BYTES) {
+      return false;
+    }
     const bytes = toBinary(LiveOfferFrameSchema, create(LiveOfferFrameSchema, { message }));
-    if (bytes.byteLength > MAX_LIVE_FRAME_BYTES) return;
+    if (bytes.byteLength > MAX_LIVE_FRAME_BYTES) return false;
     this.#effect(link, { case: "send", value: bytes });
+    return true;
   }
   export(binding, base, requestId, options = {}) {
     if (this.kernel.isResident(binding.workspace) === false) {
@@ -28172,11 +28182,7 @@ var LiveCorrespondenceDesk = class {
       }
     }
     const batchRequestId = `${binding.replicaId}:${batchHead}`;
-    if (intents.length) {
-      this.#own.commits(binding.workspace, intents.map((intent) => intent.oid));
-      this.#own.request(binding.workspace, batchRequestId, batchHead);
-    }
-    return create(CustodyOfferBatchRequestSchema, {
+    const batch = create(CustodyOfferBatchRequestSchema, {
       protocolVersion: 2,
       requestId: batchRequestId,
       source: { case: "inline", value: { offers: intents.map((intent) => ({
@@ -28191,6 +28197,15 @@ var LiveCorrespondenceDesk = class {
       // travel the same way.
       evidencePack: options.carryCommits || intents.some((intent) => intent.transportRequirement === IntentTransportRequirement.COMMIT_TREE) ? this.kernel.packDelta(mount, requestId, batchHead, base) : new Uint8Array()
     });
+    if (!options.registerWhenSent) this.#ownBatch(binding.workspace, batch);
+    return batch;
+  }
+  /** Records a batch this replica offered, so the custodian's answer to it is recognised as its own. */
+  #ownBatch(workspace, batch) {
+    const offers = batch.source.case === "inline" ? batch.source.value.offers : [];
+    if (!offers.length) return;
+    this.#own.commits(workspace, offers.map((offer) => offer.commitOid));
+    this.#own.request(workspace, batch.requestId, offers.at(-1).commitOid);
   }
   receive(receipt) {
     const link = [...this.#links.values()].find((item) => item.id === receipt.connectionId);
@@ -28378,6 +28393,10 @@ var LiveCorrespondenceDesk = class {
       link.convergeDue = void 0;
       link.heldRing = void 0;
     }
+    this.#followNow(workspace);
+  }
+  /** Asks for the ordinary (HTTP) round for this workspace now. */
+  #followNow(workspace) {
     if (this.declined) this.declined(workspace);
     else this.remoteAdvanced?.(workspace);
   }
@@ -28539,19 +28558,31 @@ var LiveCorrespondenceDesk = class {
               link.binding,
               continuesAfter ?? answered2,
               ++this.#requestId,
-              { baseInHistory: continuesAfter !== void 0, carryCommits: false }
+              { baseInHistory: continuesAfter !== void 0, carryCommits: false, registerWhenSent: true }
             ) : this.#fittingBatch(link, continuesAfter ?? answered2, continuesAfter !== void 0);
             if (batch.evidencePack.byteLength > LIVE_CARRIED_COMMITS_BYTES && !link.publisher) {
               batch = create(CustodyOfferBatchRequestSchema, { ...batch, evidencePack: new Uint8Array() });
             }
+            let refused = false;
             if (batch.source.case === "inline" && batch.source.value.offers.length) {
-              this.#send(link, { case: "offers", value: link.publisher ? batch : create(CustodyOfferBatchRequestSchema, {
+              refused = !this.#send(link, { case: "offers", value: link.publisher ? batch : create(CustodyOfferBatchRequestSchema, {
                 ...batch,
                 baseHead: fence,
                 fastForwardOnly: true,
                 ...continuesAfter ? { continuesAfter } : {}
               }) });
-              if (!link.publisher && head) {
+              if (!refused) this.#ownBatch(link.binding.workspace, batch);
+              else if (!link.publisher) {
+                this.#followNow(link.binding.workspace);
+              } else {
+                this.#send(link, { case: "offers", value: create(CustodyOfferBatchRequestSchema, {
+                  protocolVersion: 2,
+                  requestId: batch.requestId,
+                  source: { case: "inline", value: { offers: [] } },
+                  ...head ? { observedHead: head } : {}
+                }) });
+              }
+              if (!refused && !link.publisher && head) {
                 const batchHead = batch.source.value.offers.at(-1).commitOid;
                 link.stream ??= { sent: batchHead, unanswered: [] };
                 link.stream.sent = batchHead;
@@ -28603,8 +28634,9 @@ var LiveCorrespondenceDesk = class {
   /**
    * A follower's next batch above `base`: up to the link's commit bound, cut down until its carried
    * commits fit LIVE_CARRIED_COMMITS_BYTES and its frame fits MAX_LIVE_FRAME_BYTES. A single commit
-   * too large to carry still goes out (the custodian admits it on its own commits). Each attempt is
-   * the same bounded export, so every batch still continues its base with no hole below it.
+   * too large to carry still goes out (the custodian admits it on its own commits); a single commit
+   * whose frame cannot fit is refused by #send before it is encoded. Each attempt is the same bounded
+   * export, so every batch still continues its base with no hole below it.
    */
   #fittingBatch(link, base, baseInHistory) {
     let bound = link.batchCommits ?? LIVE_BATCH_COMMITS;
@@ -28613,12 +28645,13 @@ var LiveCorrespondenceDesk = class {
         link.binding,
         base,
         ++this.#requestId,
-        { baseInHistory, carryCommits: true, maxCommits: bound }
+        { baseInHistory, carryCommits: true, maxCommits: bound, registerWhenSent: true }
       );
       const offers = batch.source.case === "inline" ? batch.source.value.offers : [];
-      const frameBytes = batch.evidencePack.byteLength + offers.reduce((total, offer) => total + offer.changeUsda.byteLength + offer.commitOid.length + offer.session.length + 16, 0) + 1024;
+      const frameBytes = offerFrameBytes(batch);
       if (offers.length > 1 && (batch.evidencePack.byteLength > LIVE_CARRIED_COMMITS_BYTES || frameBytes > MAX_LIVE_FRAME_BYTES)) {
-        bound = Math.max(1, Math.floor(offers.length / 2));
+        const first = offers[0];
+        bound = first.changeUsda.byteLength + first.commitOid.length + first.session.length + 16 + 1024 > MAX_LIVE_FRAME_BYTES ? 1 : Math.max(1, Math.floor(offers.length / 2));
         link.batchCommits = bound;
         continue;
       }
@@ -29708,6 +29741,7 @@ var notContainedThisLifetime = /* @__PURE__ */ new Map();
 var MAX_NOT_CONTAINED = 1024;
 var NOT_CONTAINED_REFUSALS = /* @__PURE__ */ new Set(["nomos.stream.off_main", "nomos.stream.history_required"]);
 var MAX_REBASES_PER_ROUND = 2;
+var OFF_CHAIN_BASE = /intents_above: base \S* is not on the first-parent chain/;
 var elapsedMillis = (clock2, started) => {
   const finished = clock2.monotonicNanoseconds();
   return finished >= started ? Number(finished - started) / 1e6 : 0;
@@ -30999,7 +31033,7 @@ var WorkspaceSyncWork = class {
     const head = this.#kernel.head(this.#mount, this.#requestId);
     if (tracked !== candidateHead || !head || head === tracked) return void 0;
     if (candidateHead === this.#rebaseFrom) return void 0;
-    if (this.#kernel.transportIntentsAbove(this.#mount, this.#requestId, 0n, tracked, this.#offerHead).intents.length === 0) return void 0;
+    if (!this.#holdsWorkAbove(tracked)) return void 0;
     this.#rebases += 1;
     this.#offerAfterConverge = false;
     this.#previousHead = tracked;
@@ -31010,6 +31044,23 @@ var WorkspaceSyncWork = class {
     this.#candidateDurable = true;
     return this.#offerOrReconcile();
   }
+  /**
+   * Whether the head this round offers holds at least one commit above `base`. Asks for the ONE
+   * commit immediately above base (the bounded `fromBase` walk the live export uses): a walk of
+   * commit objects to base plus one decoded change, never the whole suffix. Asking for the whole
+   * suffix only to test it for emptiness decoded every unsent change (5,001 commits: 3.6 s and
+   * 70.6 MB). A base off that head's first-parent chain (a dependency's captured prefix the
+   * rebase rewrote, or history that ends before base) is no fast-forward from base: there is
+   * nothing to offer onto it in this round, and the next round plans from the rebased head.
+   */
+  #holdsWorkAbove(base) {
+    try {
+      return this.#kernel.transportIntentsAbove(this.#mount, this.#requestId, 1n, base, this.#offerHead, true).intents.length > 0;
+    } catch (error) {
+      if (error instanceof Error && OFF_CHAIN_BASE.test(error.message)) return false;
+      throw error;
+    }
+  }
   /**
    * The admitted local changes a copy with a missing history commit holds above the provider's last
    * admitted head (its bookmark), oldest first. Without a reachable bookmark the walk ends at the