githolon 0.112.7 → 0.112.11

package/dist/dev-server.mjs

@@ -3,7 +3,7 @@ import http from "node:http";
 import { randomBytes as randomBytes3 } from "node:crypto";
 import { mkdirSync as mkdirSync5, readFileSync as readFileSync4, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "node:fs";
 import path4 from "node:path";
-import { create as create82, fromBinary as fromBinary33, toBinary as toBinary35 } from "@bufbuild/protobuf";
+import { create as create82, fromBinary as fromBinary34, toBinary as toBinary36 } from "@bufbuild/protobuf";
 
 // ../adapter/proto/nomos/kernel/v1/kernel_pb.js
 import { enumDesc, fileDesc, messageDesc, serviceDesc, tsEnum } from "@bufbuild/protobuf/codegenv2";
@@ -792,17 +792,17 @@ function attributes(capability) {
   }
   return result;
 }
-function capabilityByNamespace(capabilities, namespace) {
-  const matches = capabilities.filter((capability) => capability.namespace === namespace);
+function capabilityByNamespace(capabilities, namespace2) {
+  const matches = capabilities.filter((capability) => capability.namespace === namespace2);
   if (matches.length !== 1) {
-    throw new Error(`OSGi resource needs exactly one ${namespace} capability`);
+    throw new Error(`OSGi resource needs exactly one ${namespace2} capability`);
   }
   return matches[0];
 }
-function optionalCapabilityByNamespace(capabilities, namespace) {
-  const matches = capabilities.filter((capability) => capability.namespace === namespace);
+function optionalCapabilityByNamespace(capabilities, namespace2) {
+  const matches = capabilities.filter((capability) => capability.namespace === namespace2);
   if (matches.length > 1) {
-    throw new Error(`OSGi resource needs at most one ${namespace} capability`);
+    throw new Error(`OSGi resource needs at most one ${namespace2} capability`);
   }
   return matches[0];
 }
@@ -2515,10 +2515,10 @@ function nodeCustodyFilesystem(directory3) {
 // ../platform-shells/node/kernel_wasi_stdio.ts
 import { TextDecoder as TextDecoder2 } from "node:util";
 function kernelWasiStdio(memory, stderr, writeFile2, stderrPartial) {
-  const decoder4 = new TextDecoder2();
+  const decoder5 = new TextDecoder2();
   let pending = "";
   const accept = (bytes) => {
-    pending += decoder4.decode(bytes, { stream: true });
+    pending += decoder5.decode(bytes, { stream: true });
     for (; ; ) {
       const newline = pending.indexOf("\n");
       if (newline >= 0 && newline < 16384) {
@@ -3997,10 +3997,10 @@ var PeerPlatformShell = class {
 };
 
 // ../platform-shells/shared/peer_office_host.ts
-import { create as create79, fromBinary as fromBinary32, toBinary as toBinary34 } from "@bufbuild/protobuf";
+import { create as create79, fromBinary as fromBinary33, toBinary as toBinary35 } from "@bufbuild/protobuf";
 
 // ../peer-office/src/peer_office.ts
-import { create as create75, toBinary as toBinary30 } from "@bufbuild/protobuf";
+import { create as create75, toBinary as toBinary31 } from "@bufbuild/protobuf";
 
 // ../peer-office/src/runtime/kernel_port.ts
 import { create as create12, fromBinary as fromBinary8, toBinary as toBinary9 } from "@bufbuild/protobuf";
@@ -4509,7 +4509,8 @@ var KernelPort = class {
       }
     }));
     if (response.outcome.case === "failure") {
-      throw new Error(`${response.outcome.value.code}: ${response.outcome.value.message}`);
+      throwUnnamedHistoryRequirement(response.outcome.value, mount.workspace);
+      throwKernelFailure(response.outcome.value);
     }
     if (response.outcome.case !== "outbox") {
       throw new Error(`kernel returned '${response.outcome.case || "empty"}' while reading correspondence`);
@@ -4538,7 +4539,8 @@ var KernelPort = class {
       }
     }));
     if (response.outcome.case === "failure") {
-      throw new Error(`${response.outcome.value.code}: ${response.outcome.value.message}`);
+      throwUnnamedHistoryRequirement(response.outcome.value, mount.workspace);
+      throwKernelFailure(response.outcome.value);
     }
     if (response.outcome.case !== "outbox") {
       throw new Error(
@@ -7569,19 +7571,19 @@ function base64(bytes) {
 // ../peer-office/src/runtime/workspace_naming.ts
 import { create as create24 } from "@bufbuild/protobuf";
 var WORKSPACE_NAME_SEP = "";
-var keyedBirthNameOf = (namespace, key) => `${namespace}-${sha256Hex(new TextEncoder().encode(namespace + WORKSPACE_NAME_SEP + key)).slice(0, 40)}`;
+var keyedBirthNameOf = (namespace2, key) => `${namespace2}-${sha256Hex(new TextEncoder().encode(namespace2 + WORKSPACE_NAME_SEP + key)).slice(0, 40)}`;
 var RECEIVING_GROUP_NAME_PREFIX = "nomos-rg-";
 var receivingGroupNameOf = (principal) => `${RECEIVING_GROUP_NAME_PREFIX}${sha256Hex(new TextEncoder().encode(principal)).slice(0, 40)}`;
-var isKeyedBirthOf = (namespace, workspace) => workspace.startsWith(`${namespace}-`);
+var isKeyedBirthOf = (namespace2, workspace) => workspace.startsWith(`${namespace2}-`);
 var WORKSPACE_NAME_REQUEST_INVALID = "nomos.runtime.workspace_name_request_invalid";
 function resolveWorkspaceName(command) {
   switch (command.birth.case) {
     case "keyed": {
-      const { namespace, key } = command.birth.value;
-      if (namespace.length === 0 || key.length === 0) {
+      const { namespace: namespace2, key } = command.birth.value;
+      if (namespace2.length === 0 || key.length === 0) {
         throw new Error(`${WORKSPACE_NAME_REQUEST_INVALID}: a keyed birth name needs both its namespace and its key`);
       }
-      return create24(ResolvedWorkspaceNameSchema, { workspace: keyedBirthNameOf(namespace, key) });
+      return create24(ResolvedWorkspaceNameSchema, { workspace: keyedBirthNameOf(namespace2, key) });
     }
     case "receivingGroup": {
       const { principal } = command.birth.value;
@@ -9632,14 +9634,143 @@ var ModelAdoptionDesk = class {
   }
 };
 
+// ../peer-office/src/runtime/custody_receipts.ts
+import { fromBinary as fromBinary19, toBinary as toBinary17 } from "@bufbuild/protobuf";
+
+// ../peer-office/src/runtime/peer_desk_store.ts
+var recordId = (namespace2, key) => `${namespace2.length}:${namespace2}${key}`;
+var copy2 = (record) => ({
+  ...record,
+  value: record.value.slice()
+});
+var MemoryPeerDeskStore = class {
+  #records = /* @__PURE__ */ new Map();
+  list(namespace2) {
+    return [...this.#records.values()].filter((record) => record.namespace === namespace2).sort((left, right) => left.key.localeCompare(right.key)).map(copy2);
+  }
+  compareExchange(namespace2, key, expectedRevision, value) {
+    const id = recordId(namespace2, key);
+    const current = this.#records.get(id);
+    if (current?.revision !== expectedRevision) {
+      throw new Error(
+        `peer desk record '${namespace2}/${key}' changed at revision ${current?.revision ?? "absent"}`
+      );
+    }
+    if (value === void 0) {
+      this.#records.delete(id);
+      return void 0;
+    }
+    const next = Object.freeze({
+      namespace: namespace2,
+      key,
+      revision: (current?.revision ?? 0n) + 1n,
+      value: value.slice()
+    });
+    this.#records.set(id, next);
+    return copy2(next);
+  }
+};
+
+// ../peer-office/src/runtime/custody_receipts.ts
+var namespace = "nomos.peer-desk.custody-receipts/v1";
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+var MAX_BASES = 256;
+var MAX_RECEIPTS = 4096;
+var CustodyReceipts = class {
+  #store;
+  #records = /* @__PURE__ */ new Map();
+  #journals = /* @__PURE__ */ new Map();
+  #receipts = /* @__PURE__ */ new Map();
+  constructor(store = new MemoryPeerDeskStore()) {
+    this.#store = store;
+    for (const record of store.list(namespace)) {
+      this.#records.set(record.key, record);
+      try {
+        if (record.key.startsWith("receipt:")) {
+          const newline = record.value.indexOf(10);
+          if (newline < 0) continue;
+          const receipt = fromBinary19(CustodyIntentAdmissionSchema, record.value.subarray(newline + 1));
+          const header3 = JSON.parse(decoder.decode(record.value.subarray(0, newline)));
+          if (receipt.outcome.case === "admitted" && typeof header3.generation === "string" && typeof header3.head === "string") this.#receipts.set(record.key, { ...header3, receipt });
+          continue;
+        }
+        if (!record.key.startsWith("head:")) continue;
+        const value = JSON.parse(decoder.decode(record.value));
+        if (typeof value.head !== "string" || typeof value.generation !== "string" || !Array.isArray(value.bases) || !Array.isArray(value.keys) || value.bases.length > MAX_BASES || value.keys.length > MAX_RECEIPTS) continue;
+        if (!value.bases.every((base) => typeof base === "string") || !value.keys.every((key) => typeof key === "string")) continue;
+        this.#journals.set(record.key.slice(5), value);
+      } catch {
+      }
+    }
+  }
+  covers(workspace, current, base) {
+    const value = this.#journals.get(workspace);
+    return value?.head === current && value.bases.includes(base);
+  }
+  receipt(workspace, current, change) {
+    const value = this.#journals.get(workspace);
+    if (value?.head !== current) return void 0;
+    const stored = this.#receipts.get(`receipt:${workspace}:${sha256Hex(change)}`);
+    if (stored?.generation !== value.generation) return void 0;
+    if (stored.head !== value.head && !value.bases.includes(stored.head)) return void 0;
+    return fromBinary19(CustodyIntentAdmissionSchema, toBinary17(CustodyIntentAdmissionSchema, stored.receipt));
+  }
+  record(workspace, before, after, receipts) {
+    const old = this.#journals.get(workspace);
+    const journalKey = `head:${workspace}`;
+    const value = old?.head === before ? { ...old, head: after, bases: [...old.bases], keys: [...old.keys] } : { head: after, bases: [], keys: [], generation: String((this.#records.get(journalKey)?.revision ?? 0n) + 1n) };
+    if (before && before !== after) value.bases.push(before);
+    value.bases = [...new Set(value.bases)].slice(-MAX_BASES);
+    const keys = new Set(value.keys);
+    const discarded = new Set(old?.generation !== value.generation ? old?.keys : []);
+    for (const { change, receipt } of receipts) {
+      if (receipt.outcome.case !== "admitted") continue;
+      const key = `receipt:${workspace}:${sha256Hex(change)}`;
+      keys.delete(key);
+      keys.add(key);
+      discarded.delete(key);
+      const header3 = encoder.encode(`${JSON.stringify({ generation: value.generation, head: after })}
+`);
+      const body = toBinary17(CustodyIntentAdmissionSchema, receipt);
+      const bytes = new Uint8Array(header3.length + body.length);
+      bytes.set(header3);
+      bytes.set(body, header3.length);
+      const record2 = this.#store.compareExchange(namespace, key, this.#records.get(key)?.revision, bytes);
+      if (record2) this.#records.set(key, record2);
+      this.#receipts.set(key, {
+        generation: value.generation,
+        head: after,
+        receipt: fromBinary19(CustodyIntentAdmissionSchema, body)
+      });
+    }
+    const ordered = [...keys];
+    for (const key of ordered.slice(0, -MAX_RECEIPTS)) discarded.add(key);
+    value.keys = ordered.slice(-MAX_RECEIPTS);
+    for (const key of discarded) {
+      this.#store.compareExchange(namespace, key, this.#records.get(key)?.revision, void 0);
+      this.#records.delete(key);
+      this.#receipts.delete(key);
+    }
+    const record = this.#store.compareExchange(
+      namespace,
+      journalKey,
+      this.#records.get(journalKey)?.revision,
+      encoder.encode(JSON.stringify(value))
+    );
+    if (record) this.#records.set(journalKey, record);
+    this.#journals.set(workspace, value);
+  }
+};
+
 // ../peer-office/src/runtime/custodian_placement.ts
-import { create as create30, fromBinary as fromBinary19, toBinary as toBinary17 } from "@bufbuild/protobuf";
+import { create as create30, fromBinary as fromBinary20, toBinary as toBinary18 } from "@bufbuild/protobuf";
 var CustodianPlacement = class {
   #kernel;
   #clock;
   #template;
   constructor(kernel, clock, templateProtobuf) {
-    const template = fromBinary19(CustodyPlacementPolicySchema, templateProtobuf);
+    const template = fromBinary20(CustodyPlacementPolicySchema, templateProtobuf);
     if (!template.declaration || !template.adoptedBy || template.rules.length === 0 || template.remotes.length === 0) {
       throw new Error("custodian placement template requires a declaration, adoptedBy, rules and remotes");
     }
@@ -9671,7 +9802,7 @@ var CustodianPlacement = class {
     });
     return create30(CustodyPlacementPolicySchema, {
       ...content,
-      packageSha256: sha256Hex(toBinary17(CustodyPlacementPolicySchema, content))
+      packageSha256: sha256Hex(toBinary18(CustodyPlacementPolicySchema, content))
     });
   }
   /** Adopt this custodian's placement for an opened, born workspace that has none. True when it adopted. */
@@ -9736,14 +9867,16 @@ var CandidateCustodyRequiredError = class extends Error {
 var CustodyAdmissionDesk = class {
   #kernel;
   #custody;
-  constructor(kernel, custody) {
+  #receipts;
+  constructor(kernel, custody, receipts = new CustodyReceipts()) {
     this.#kernel = kernel;
     this.#custody = custody;
+    this.#receipts = receipts;
   }
   admit(request, command) {
-    const session = request.target?.session;
-    if (!session) throw new Error("custody admission requires an addressed runtime session");
-    const mount = this.#custody.mountForSession(session);
+    const workspace = request.target?.workspace;
+    if (!workspace) throw new Error("custody admission requires an addressed workspace");
+    const mount = this.#custody.mountForWorkspace(workspace);
     if (command.evidencePack.byteLength > 0) {
       this.#kernel.applyPack(mount, request.requestId, command.evidencePack);
     }
@@ -9754,21 +9887,42 @@ var CustodyAdmissionDesk = class {
     const births = [];
     const admittedBase = this.#kernel.head(mount, request.requestId) ?? "";
     if (command.fastForwardOnly && offers.length > 0 && (command.baseHead ?? "") !== admittedBase) {
+      for (const offer of offers) {
+        const receipt = this.#receipts.receipt(mount.workspace, admittedBase, offer.changeUsda);
+        if (!receipt) continue;
+        receipt.commitOid = offer.commitOid;
+        const records = sessions.get(offer.session) ?? [];
+        records.push(receipt);
+        sessions.set(offer.session, records);
+      }
+      let delta = custodyReturnDelta(
+        this.#kernel,
+        mount,
+        request.requestId,
+        command.baseHead,
+        admittedBase,
+        admittedBase,
+        command.observedHead
+      );
+      if (command.baseHead && command.observedHead !== admittedBase && this.#receipts.covers(mount.workspace, admittedBase, command.baseHead)) {
+        try {
+          delta = {
+            resultBase: command.baseHead,
+            resultPack: this.#kernel.packDelta(mount, request.requestId, admittedBase, command.baseHead),
+            recoveryRequired: false
+          };
+        } catch {
+        }
+      }
       return create31(CustodyAdmissionSchema, {
         main: admittedBase,
-        ...custodyReturnDelta(
-          this.#kernel,
-          mount,
-          request.requestId,
-          command.baseHead,
-          admittedBase,
-          admittedBase,
-          command.observedHead
-        )
+        sessions: [...sessions].map(([session, intents]) => create31(CustodySessionAdmissionSchema, { session, intents })),
+        ...delta
       });
     }
     let main = admittedBase;
     const heldSessions = /* @__PURE__ */ new Map();
+    const receipts = [];
     for (const offer of offers) {
       const heldBehind = heldSessions.get(offer.session);
       const verdict = heldBehind === void 0 ? this.#offer(request, mount, offer) : create31(OfferResponseSchema, { outcome: { case: "blockedOnDependency", value: {
@@ -9778,7 +9932,9 @@ var CustodyAdmissionDesk = class {
         heldSessions.set(offer.session, verdict.outcome.value.offerId || offer.commitOid);
       }
       const records = sessions.get(offer.session) ?? [];
-      records.push(this.#record(offer, verdict));
+      const receipt = this.#record(offer, verdict);
+      records.push(receipt);
+      receipts.push({ change: offer.changeUsda, receipt });
       sessions.set(offer.session, records);
       if (verdict.outcome.case === "admitted") {
         main = verdict.outcome.value.head;
@@ -9794,6 +9950,9 @@ var CustodyAdmissionDesk = class {
         }
       }
     }
+    if (receipts.some((entry) => entry.receipt.outcome.case === "admitted")) {
+      this.#receipts.record(mount.workspace, admittedBase, main, receipts);
+    }
     return create31(CustodyAdmissionSchema, {
       main,
       sessions: [...sessions].map(
@@ -10739,7 +10898,7 @@ var ApplicationReadinessDesk = class {
 };
 
 // ../peer-office/src/runtime/authentication_readiness_desk.ts
-import { create as create39, fromBinary as fromBinary20, toBinary as toBinary18 } from "@bufbuild/protobuf";
+import { create as create39, fromBinary as fromBinary21, toBinary as toBinary19 } from "@bufbuild/protobuf";
 var AuthenticationReadinessDesk = class {
   #waiting = /* @__PURE__ */ new Map();
   #sequence = 0;
@@ -10755,7 +10914,7 @@ var AuthenticationReadinessDesk = class {
   begin(request, input) {
     if (![AuthenticationReadinessCriterion.ENROLLED_DEVICE, AuthenticationReadinessCriterion.PROVIDER_TOKEN, AuthenticationReadinessCriterion.BIRTH_EVIDENCE].includes(input.criterion)) throw new Error("authentication readiness requires a criterion");
     if (!input.session) throw new Error("authentication readiness requires a session");
-    const command = fromBinary20(AwaitAuthenticationRequestSchema, toBinary18(AwaitAuthenticationRequestSchema, input));
+    const command = fromBinary21(AwaitAuthenticationRequestSchema, toBinary19(AwaitAuthenticationRequestSchema, input));
     const now = this.#now();
     for (const [id2, work2] of this.#waiting) if (work2.expiresAt <= now) this.#waiting.delete(id2);
     const work = {
@@ -11504,7 +11663,7 @@ var ResidencyPins = class {
 };
 
 // ../peer-office/src/runtime/subscription_manager.ts
-import { clone, create as create44, toBinary as toBinary19 } from "@bufbuild/protobuf";
+import { clone, create as create44, toBinary as toBinary20 } from "@bufbuild/protobuf";
 var sameBytes = (left, right) => {
   if (!left || left.byteLength !== right.byteLength) return false;
   for (let index = 0; index < right.byteLength; index += 1) {
@@ -11632,7 +11791,7 @@ var SubscriptionManager = class {
     const groups = [];
     for (const subscription of this.#subscriptions.values()) {
       if (!matches(subscription) || !subscription.request.query) continue;
-      const declaration = toBinary19(QueryRequestSchema, subscription.request.query);
+      const declaration = toBinary20(QueryRequestSchema, subscription.request.query);
       const session = subscription.request.session;
       const group = groups.find((group2) => group2.session === session && sameBytes(group2.declaration, declaration));
       if (group) group.watches.push(subscription);
@@ -12757,8 +12916,8 @@ var short = (oid) => oid.slice(0, 12);
 // ../peer-office/src/runtime/preserved_copies_desk.ts
 import { create as create46, fromJsonString, toJsonString } from "@bufbuild/protobuf";
 var PRESERVED_COPIES_NAMESPACE = "nomos.peer-desk.preserved-local-copies/v1";
-var encoder = new TextEncoder();
-var decoder = new TextDecoder();
+var encoder2 = new TextEncoder();
+var decoder2 = new TextDecoder();
 var PreservedCopiesDesk = class {
   #store;
   constructor(store) {
@@ -12767,7 +12926,7 @@ var PreservedCopiesDesk = class {
   list(workspace) {
     const record = this.#store.list(PRESERVED_COPIES_NAMESPACE).find((entry) => entry.key === workspace);
     if (!record) return [];
-    const values = JSON.parse(decoder.decode(record.value));
+    const values = JSON.parse(decoder2.decode(record.value));
     if (!Array.isArray(values)) {
       throw new Error(`corrupt preserved-copy record for '${workspace}' at revision ${record.revision}`);
     }
@@ -12781,14 +12940,14 @@ var PreservedCopiesDesk = class {
       PRESERVED_COPIES_NAMESPACE,
       copy3.workspace,
       current?.revision,
-      encoder.encode(`[${next.map((entry) => toJsonString(PreservedLocalCopySchema, entry)).join(",")}]`)
+      encoder2.encode(`[${next.map((entry) => toJsonString(PreservedLocalCopySchema, entry)).join(",")}]`)
     );
     if (!stored) throw new Error(`preserved copy of '${copy3.workspace}' was not recorded`);
   }
 };
 
 // ../peer-office/src/runtime/office_seat.ts
-import { fromBinary as fromBinary21 } from "@bufbuild/protobuf";
+import { fromBinary as fromBinary22 } from "@bufbuild/protobuf";
 function officeSeat(profile) {
   const origins = /* @__PURE__ */ new Set();
   const add = (url) => {
@@ -12798,7 +12957,7 @@ function officeSeat(profile) {
   add(profile.liveRelayOrigin);
   if (profile.custodianPlacement !== void 0 && profile.custodianPlacement.byteLength > 0) {
     try {
-      for (const remote of fromBinary21(CustodyPlacementPolicySchema, profile.custodianPlacement).remotes) {
+      for (const remote of fromBinary22(CustodyPlacementPolicySchema, profile.custodianPlacement).remotes) {
         add(remote.url);
       }
     } catch {
@@ -12824,9 +12983,9 @@ var LOCAL_ONLY_NAMESPACES = /* @__PURE__ */ new Set([
 ]);
 var SEAT_PREFIX = "nomos-office-seat/v1:";
 var SEAT_DIGEST_HEX = 64;
-var encoder2 = new TextEncoder();
-var decoder2 = new TextDecoder();
-var header2 = (digest) => encoder2.encode(`${SEAT_PREFIX}${digest}
+var encoder3 = new TextEncoder();
+var decoder3 = new TextDecoder();
+var header2 = (digest) => encoder3.encode(`${SEAT_PREFIX}${digest}
 `);
 var QuarantineReason = Object.freeze({
   /** Another office's seat: a copied state directory, or a store lifted from another peer. */
@@ -12837,7 +12996,7 @@ var QuarantineReason = Object.freeze({
 function readSeal(value) {
   const headerLength = SEAT_PREFIX.length + SEAT_DIGEST_HEX + 1;
   if (value.byteLength < headerLength) return void 0;
-  const text2 = decoder2.decode(value.subarray(0, headerLength));
+  const text2 = decoder3.decode(value.subarray(0, headerLength));
   if (!text2.startsWith(SEAT_PREFIX) || !text2.endsWith("\n")) return void 0;
   const seat = text2.slice(SEAT_PREFIX.length, headerLength - 1);
   if (!/^[0-9a-f]{64}$/.test(seat)) return void 0;
@@ -12861,44 +13020,44 @@ var SeatedPeerDeskStore = class {
     this.#seat = seat;
     this.#report = report;
   }
-  list(namespace) {
-    if (LOCAL_ONLY_NAMESPACES.has(namespace)) return this.#inner.list(namespace);
+  list(namespace2) {
+    if (LOCAL_ONLY_NAMESPACES.has(namespace2)) return this.#inner.list(namespace2);
     const kept = [];
-    for (const record of this.#inner.list(namespace)) {
+    for (const record of this.#inner.list(namespace2)) {
       const sealed = readSeal(record.value);
       if (sealed?.seat === this.#seat.digest) {
         kept.push({ ...record, value: sealed.value.slice() });
         continue;
       }
-      this.#quarantine(namespace, record, sealed?.seat);
+      this.#quarantine(namespace2, record, sealed?.seat);
     }
     return kept;
   }
-  compareExchange(namespace, key, expectedRevision, value) {
-    if (LOCAL_ONLY_NAMESPACES.has(namespace)) {
-      return this.#inner.compareExchange(namespace, key, expectedRevision, value);
+  compareExchange(namespace2, key, expectedRevision, value) {
+    if (LOCAL_ONLY_NAMESPACES.has(namespace2)) {
+      return this.#inner.compareExchange(namespace2, key, expectedRevision, value);
     }
     const stored = this.#inner.compareExchange(
-      namespace,
+      namespace2,
       key,
       expectedRevision,
       value === void 0 ? void 0 : seal(this.#seat.digest, value)
     );
     if (stored === void 0) return void 0;
     const sealed = readSeal(stored.value);
-    if (!sealed) throw new Error(`peer desk record '${namespace}/${key}' lost its office seat`);
+    if (!sealed) throw new Error(`peer desk record '${namespace2}/${key}' lost its office seat`);
     return { ...stored, value: sealed.value.slice() };
   }
   /** Preserve the foreign record under the quarantine namespace, then free the slot. */
-  #quarantine(namespace, record, recordedSeat) {
-    const key = `${namespace}\0${record.key}\0${record.revision}`;
+  #quarantine(namespace2, record, recordedSeat) {
+    const key = `${namespace2}\0${record.key}\0${record.revision}`;
     try {
       this.#inner.compareExchange(QUARANTINED_BINDINGS_NAMESPACE, key, void 0, record.value);
     } catch {
     }
-    this.#inner.compareExchange(namespace, record.key, record.revision, void 0);
+    this.#inner.compareExchange(namespace2, record.key, record.revision, void 0);
     this.#report(create47(QuarantinedBindingSchema, {
-      namespace,
+      namespace: namespace2,
       key: record.key,
       reason: recordedSeat === void 0 ? QuarantineReason.Unseated : QuarantineReason.ForeignSeat,
       recordedSeat: recordedSeat ?? "",
@@ -12948,6 +13107,7 @@ var ReplicaInventoryDesk = class _ReplicaInventoryDesk {
     const undiscovered = /* @__PURE__ */ new Set();
     for (const restored of this.#follows.recover()) {
       following.set(restored.workspace, restored.delayMillis);
+      followed.add(restored.workspace);
     }
     if (!this.#bootstrapped) {
       this.#bootstrapped = true;
@@ -12985,6 +13145,7 @@ var ReplicaInventoryDesk = class _ReplicaInventoryDesk {
           stopped.delete(workspace);
         } else if (reconciliation.changed) {
           following.delete(workspace);
+          followed.delete(workspace);
           stopped.add(workspace);
         }
       } catch (error) {
@@ -13032,7 +13193,7 @@ var ReplicaInventoryDesk = class _ReplicaInventoryDesk {
 };
 
 // ../peer-office/src/runtime/placement_discovery_desk.ts
-import { create as create48, toBinary as toBinary20 } from "@bufbuild/protobuf";
+import { create as create48, toBinary as toBinary21 } from "@bufbuild/protobuf";
 
 // ../peer-office/src/runtime/correspondence_work_registry.ts
 var CorrespondenceWorkRegistry = class {
@@ -13177,7 +13338,7 @@ var PlacementDiscoveryDesk = class {
     return {
       workspace: next.workspace,
       nextAfterMillis: 0,
-      frame: toBinary20(RuntimeRequestSchema, create48(RuntimeRequestSchema, {
+      frame: toBinary21(RuntimeRequestSchema, create48(RuntimeRequestSchema, {
         protocolVersion: 2,
         requestId,
         command: { case: "workspacePlacement", value: {
@@ -13262,7 +13423,7 @@ var PlacementDiscoveryDesk = class {
 };
 
 // ../peer-office/src/runtime/live_correspondence_desk.ts
-import { create as create49, fromBinary as fromBinary22, toBinary as toBinary21 } from "@bufbuild/protobuf";
+import { create as create49, fromBinary as fromBinary23, toBinary as toBinary22 } from "@bufbuild/protobuf";
 var MAX_LIVE_FRAME_BYTES = 25 * 1024 * 1024;
 var PLACEMENT_REF3 = "refs/nomos/placement";
 var PRESENCE_PEER_TOKEN_HEX = 32;
@@ -13317,7 +13478,7 @@ var LiveCorrespondenceDesk = class {
       wasResident: this.kernel.isResident(binding.workspace) !== false
     };
     this.#links.set(binding.workspace, link);
-    if (link.wasResident) this.#open(link);
+    if (!link.publisher || link.wasResident) this.#open(link);
   }
   changed(workspace) {
     const link = this.#links.get(workspace);
@@ -13339,11 +13500,14 @@ var LiveCorrespondenceDesk = class {
     this.#effect(link, { case: "openUrl", value: `${endpoint}/v2/workspaces/${encodeURIComponent(link.binding.workspace)}/subscribe?${subscribeQuery(link)}` });
   }
   #send(link, message) {
-    const bytes = toBinary21(LiveOfferFrameSchema, create49(LiveOfferFrameSchema, { message }));
+    const bytes = toBinary22(LiveOfferFrameSchema, create49(LiveOfferFrameSchema, { message }));
     if (bytes.byteLength > MAX_LIVE_FRAME_BYTES) return;
     this.#effect(link, { case: "send", value: bytes });
   }
   export(binding, base, requestId) {
+    if (this.kernel.isResident(binding.workspace) === false) {
+      return create49(CustodyOfferBatchRequestSchema, { protocolVersion: 2 });
+    }
     const mount = workspaceMount(binding.workspace);
     const head = this.kernel.head(mount, requestId);
     if (!base || !head || base === head) return create49(CustodyOfferBatchRequestSchema, { protocolVersion: 2 });
@@ -13389,7 +13553,7 @@ var LiveCorrespondenceDesk = class {
     if (!bytes.byteLength || bytes.byteLength > MAX_LIVE_FRAME_BYTES) return;
     let frame;
     try {
-      frame = fromBinary22(LiveOfferFrameSchema, bytes);
+      frame = fromBinary23(LiveOfferFrameSchema, bytes);
     } catch {
       let ring;
       try {
@@ -13404,6 +13568,7 @@ var LiveCorrespondenceDesk = class {
     }
     if (frame.message.case === "frontier") {
       this.#announced(link, frame.message.value.head);
+      if (this.kernel.isResident(link.binding.workspace) === false) return;
       if (!frame.message.value.response) {
         this.#send(link, { case: "frontier", value: {
           head: this.kernel.head(workspaceMount(link.binding.workspace), ++this.#requestId) ?? "",
@@ -13420,6 +13585,10 @@ var LiveCorrespondenceDesk = class {
     if (frame.message.case !== "offers") return;
     const batch = frame.message.value;
     if (batch.protocolVersion !== 2 || !batch.requestId || batch.source.case !== "inline" || !batch.source.value.offers.length) return;
+    if (this.kernel.isResident(link.binding.workspace) === false) {
+      this.remoteAdvanced?.(link.binding.workspace);
+      return;
+    }
     if ([...this.#pending.values()].some((pending) => pending.link === link && pending.bytes.length === bytes.length && pending.bytes.every((byte, index) => byte === bytes[index]))) return;
     if (this.#pending.size >= 32) return;
     this.#pending.set(request.requestId, { link, bytes });
@@ -13427,7 +13596,16 @@ var LiveCorrespondenceDesk = class {
       protocolVersion: 2,
       requestId: request.requestId,
       target: { workspace: link.binding.workspace, session: link.binding.replicaId },
-      command: { case: "admitCustodyOffers", value: create49(CustodyOfferBatchRequestSchema, { ...batch, baseHead: void 0 }) }
+      // HTTP sender reconciliation controls are not part of a live proposal.
+      // Keeping fastForwardOnly while removing baseHead silently skips every
+      // offer against a nonempty local head. The Kernel judges sealed causality;
+      // live receivers neither ask for a return archive nor confirm the sender.
+      command: { case: "admitCustodyOffers", value: create49(CustodyOfferBatchRequestSchema, {
+        ...batch,
+        baseHead: void 0,
+        observedHead: void 0,
+        fastForwardOnly: false
+      }) }
     });
   }
   /** Upstream news is a frontier this replica has NEVER seen: neither its own head nor the
@@ -13436,6 +13614,10 @@ var LiveCorrespondenceDesk = class {
   #announced(link, head) {
     if (!head || link.lastAnnounced === head) return;
     link.lastAnnounced = head;
+    if (this.kernel.isResident(link.binding.workspace) === false) {
+      this.remoteAdvanced?.(link.binding.workspace);
+      return;
+    }
     const mount = workspaceMount(link.binding.workspace);
     if (head === this.kernel.head(mount, ++this.#requestId) || head === this.kernel.resolveRef(mount, ++this.#requestId, "refs/remotes/nomos/main")) return;
     this.remoteAdvanced?.(link.binding.workspace);
@@ -13445,6 +13627,10 @@ var LiveCorrespondenceDesk = class {
   #placementAnnounced(link, frontier) {
     if (!frontier || link.lastPlacementAnnounced === frontier) return;
     link.lastPlacementAnnounced = frontier;
+    if (this.kernel.isResident(link.binding.workspace) === false) {
+      this.placementAdvanced?.(link.binding.workspace);
+      return;
+    }
     const mount = workspaceMount(link.binding.workspace);
     if (frontier === this.kernel.resolveRef(mount, ++this.#requestId, PLACEMENT_REF3)) return;
     this.placementAdvanced?.(link.binding.workspace);
@@ -13461,11 +13647,13 @@ var LiveCorrespondenceDesk = class {
   disconnect(workspace) {
     const link = this.#links.get(workspace);
     if (!link) return;
+    if (link.state === "open") this.linkClosed?.(workspace);
     this.#effect(link, { case: "close", value: true });
     this.#links.delete(workspace);
     for (const [id, pending] of this.#pending) if (pending.link === link) this.#pending.delete(id);
   }
   #hello(link) {
+    if (this.kernel.isResident(link.binding.workspace) === false) return;
     const head = this.kernel.head(workspaceMount(link.binding.workspace), ++this.#requestId);
     this.#send(link, { case: "frontier", value: { head: head ?? "" } });
   }
@@ -13473,19 +13661,20 @@ var LiveCorrespondenceDesk = class {
     const now = this.clock.monotonicNanoseconds();
     let wake;
     for (const link of this.#links.values()) {
-      if (this.kernel.isResident(link.binding.workspace) === false) {
+      const resident = this.kernel.isResident(link.binding.workspace) !== false;
+      if (link.publisher && !resident) {
         if (link.wasResident) this.disconnect(link.binding.workspace);
         else wake = wake === void 0 || wake > 250n ? 250n : wake;
         continue;
       }
-      link.wasResident = true;
+      if (resident) link.wasResident = true;
       if (link.state === "opening" && now >= link.due) {
         this.#effect(link, { case: "close", value: true });
         link.state = "closed";
       }
       if (link.state === "closed" && now >= link.due) this.#open(link);
       if (link.state === "open") {
-        if (link.dirty) {
+        if (link.dirty && resident) {
           link.dirty = false;
           try {
             link.published ??= link.publisher ? this.kernel.head(workspaceMount(link.binding.workspace), ++this.#requestId) : this.kernel.resolveRef(workspaceMount(link.binding.workspace), ++this.#requestId, "refs/remotes/nomos/main");
@@ -13504,8 +13693,7 @@ var LiveCorrespondenceDesk = class {
     return wake;
   }
   close() {
-    for (const link of this.#links.values()) this.#effect(link, { case: "close", value: true });
-    this.#links.clear();
+    for (const workspace of [...this.#links.keys()]) this.disconnect(workspace);
     this.#pending.clear();
   }
 };
@@ -13636,9 +13824,9 @@ var RecordsDesk = class {
       command.namespace === void 0 ? {} : { "custody.children_namespace": command.namespace },
       () => this.#kernel.childWorkspaces(mount, request.requestId)
     );
-    const namespace = command.namespace;
-    const selected = namespace === void 0 ? result.children : result.children.filter(
-      (child) => child.status === ChildWorkspaceLifecycleStatus.ACTIVE && isKeyedBirthOf(namespace, child.workspace)
+    const namespace2 = command.namespace;
+    const selected = namespace2 === void 0 ? result.children : result.children.filter(
+      (child) => child.status === ChildWorkspaceLifecycleStatus.ACTIVE && isKeyedBirthOf(namespace2, child.workspace)
     );
     return create51(ChildWorkspaceListSchema, {
       children: selected.map((child) => create51(ChildWorkspaceSchema, {
@@ -14004,41 +14192,7 @@ var RecoveryDesk = class {
 };
 
 // ../peer-office/src/runtime/correspondence_desk.ts
-import { create as create64, toBinary as toBinary25 } from "@bufbuild/protobuf";
-
-// ../peer-office/src/runtime/peer_desk_store.ts
-var recordId = (namespace, key) => `${namespace.length}:${namespace}${key}`;
-var copy2 = (record) => ({
-  ...record,
-  value: record.value.slice()
-});
-var MemoryPeerDeskStore = class {
-  #records = /* @__PURE__ */ new Map();
-  list(namespace) {
-    return [...this.#records.values()].filter((record) => record.namespace === namespace).sort((left, right) => left.key.localeCompare(right.key)).map(copy2);
-  }
-  compareExchange(namespace, key, expectedRevision, value) {
-    const id = recordId(namespace, key);
-    const current = this.#records.get(id);
-    if (current?.revision !== expectedRevision) {
-      throw new Error(
-        `peer desk record '${namespace}/${key}' changed at revision ${current?.revision ?? "absent"}`
-      );
-    }
-    if (value === void 0) {
-      this.#records.delete(id);
-      return void 0;
-    }
-    const next = Object.freeze({
-      namespace,
-      key,
-      revision: (current?.revision ?? 0n) + 1n,
-      value: value.slice()
-    });
-    this.#records.set(id, next);
-    return copy2(next);
-  }
-};
+import { create as create64, toBinary as toBinary26 } from "@bufbuild/protobuf";
 
 // ../peer-office/src/runtime/correspondence_recovery.ts
 import { create as create55 } from "@bufbuild/protobuf";
@@ -14126,7 +14280,7 @@ var CorrespondenceRecoveryWork = class {
 };
 
 // ../peer-office/src/runtime/workspace_sync.ts
-import { create as create59, fromBinary as fromBinary24 } from "@bufbuild/protobuf";
+import { create as create59, fromBinary as fromBinary25 } from "@bufbuild/protobuf";
 
 // ../peer-office/src/runtime/placement_fetch.ts
 import { create as create56 } from "@bufbuild/protobuf";
@@ -14206,7 +14360,7 @@ function resolveCustodyDisagreement(kernel, mount, requestId, policy, verdict) {
 }
 
 // ../peer-office/src/runtime/custody_offer.ts
-import { create as create58, fromBinary as fromBinary23, toBinary as toBinary22 } from "@bufbuild/protobuf";
+import { create as create58, fromBinary as fromBinary24, toBinary as toBinary23 } from "@bufbuild/protobuf";
 var CUSTODY_OFFER_MEDIA_TYPE = "application/vnd.nomos.custody-offer-batch+protobuf";
 var CUSTODY_OFFER_RESULT_MEDIA_TYPE = "application/vnd.nomos.custody-offer-result+protobuf";
 function settleCustodyOfferExchange(awaiting, response) {
@@ -14238,7 +14392,7 @@ function settleCustodyOfferExchange(awaiting, response) {
   }
 }
 function encodeInlineCustodyOffer(args) {
-  return toBinary22(CustodyOfferBatchRequestSchema, create58(CustodyOfferBatchRequestSchema, {
+  return toBinary23(CustodyOfferBatchRequestSchema, create58(CustodyOfferBatchRequestSchema, {
     protocolVersion: 2,
     requestId: args.requestId,
     source: {
@@ -14258,7 +14412,7 @@ function encodeInlineCustodyOffer(args) {
   }));
 }
 function decodeCustodyOffer(bytes, requestId) {
-  const response = fromBinary23(CustodyOfferBatchResponseSchema, bytes);
+  const response = fromBinary24(CustodyOfferBatchResponseSchema, bytes);
   if (response.protocolVersion !== 2 || response.requestId !== requestId) {
     throw new Error("custody offer returned a mismatched generated response");
   }
@@ -14425,6 +14579,7 @@ var WorkspaceSyncWork = class {
   #offerSequence = 0;
   #lastStep;
   #probeOnly;
+  #liveConnected;
   /** Set when this round adopted the upstream's own head as its base (see #establishBase). */
   #establishedBase;
   #receiveState;
@@ -14457,6 +14612,7 @@ var WorkspaceSyncWork = class {
     this.#directoryAnswered = args.directoryAnswered;
     this.#placementFetched = args.placementFetched;
     this.#probeOnly = args.probeOnly ?? false;
+    this.#liveConnected = args.liveConnected === true;
     this.#receiveState = args.receiveState;
     this.#completeHistory = args.completeHistory === true;
     this.#repairMissingCommit = args.repairMissingCommit === true;
@@ -14527,6 +14683,9 @@ var WorkspaceSyncWork = class {
   #openRound() {
     if (this.#receiveState || this.#replaceLocalHead !== void 0) return this.#leaseEffect();
     if (!this.#localHead) return this.#leaseEffect();
+    if (this.#liveConnected && !this.#probeOnly && this.#holdsLocalWork() && this.#previousHead) {
+      return this.#offerOrReconcile();
+    }
     const requestId = `${this.#binding.replicaId}:${this.#requestId}:${this.workId}:frontier`;
     return this.#beginOffer(encodeInlineCustodyOffer({
       session: this.#binding.replicaId,
@@ -14758,6 +14917,18 @@ var WorkspaceSyncWork = class {
       return this.#finishOfferOutcome(false);
     }
     const admission = outcome.value;
+    globalThis.__nomosSyncDiagnostic?.("sync.admission", {
+      workspace: this.#mount.workspace,
+      phase: state.phase,
+      local: this.#localHead,
+      tracked: this.#previousHead,
+      remote: admission.main,
+      sealed: admission.sealedMain,
+      resultBase: admission.resultBase,
+      resultBytes: admission.resultPack.byteLength,
+      recoveryRequired: admission.recoveryRequired,
+      summary: summarizeCustodyAdmission(admission)
+    });
     this.#desiredHead = admission.main || void 0;
     if (!this.#desiredHead) return this.#transportFailure("resident peer returned no admitted frontier", false);
     this.#candidateDurable = admission.sealedMain === this.#desiredHead;
@@ -15032,7 +15203,7 @@ var WorkspaceSyncWork = class {
   #acceptLawProducts(response) {
     if (response.status !== 200 || response.contentType?.split(";")[0]?.trim() !== LAW_PRODUCTS_MEDIA_TYPE2) return;
     try {
-      const exported = fromBinary24(ExportLawProductsResponseSchema, response.body);
+      const exported = fromBinary25(ExportLawProductsResponseSchema, response.body);
       this.#fetchedLawProducts = { head: exported.head, products: exported.products };
     } catch {
     }
@@ -15374,6 +15545,19 @@ var WorkspaceSyncWork = class {
     return step;
   }
   #finish(value) {
+    globalThis.__nomosSyncDiagnostic?.("sync.finished", {
+      workspace: value.workspace,
+      previous: value.previousHead,
+      current: value.currentHead,
+      stillAhead: value.stillAhead,
+      deferred: String(value.deferred),
+      admitted: String(value.admitted),
+      reconnect: value.reconnectRequired,
+      directOfferDeferred: value.directOfferDeferred,
+      pushFailed: value.pushFailed,
+      failure: value.pushError?.message,
+      wallMs: elapsedMillis(this.#clock, this.#started)
+    });
     this.#state = { phase: WorkspaceSyncPhase.Done };
     this.#current = void 0;
     return this.#remember({ case: "synced", value });
@@ -15430,6 +15614,10 @@ var WorkspaceDependencySyncWork = class {
       this.#plan = [this.#args.root];
       return this.#advance();
     }
+    if (this.#args.liveConnected && this.#args.kernel.resolveRef(this.#args.root.mount, this.#args.requestId, trackedMain2)) {
+      this.#plan = this.#planDependencies();
+      return this.#advance();
+    }
     this.#current = this.#work(this.#args.root, `${this.workId}:frontier`, true);
     return this.#accept(this.#current.start());
   }
@@ -15702,7 +15890,7 @@ var CorrespondenceRetrySchedule = class {
 };
 
 // ../peer-office/src/runtime/workspace_effect_delivery.ts
-import { create as create61, fromBinary as fromBinary25, toBinary as toBinary23 } from "@bufbuild/protobuf";
+import { create as create61, fromBinary as fromBinary26, toBinary as toBinary24 } from "@bufbuild/protobuf";
 
 // ../adapter/workspace_effect_outcome.ts
 function workspaceEffectOutcome(response) {
@@ -16107,7 +16295,7 @@ var RemoteWorkspaceEffectDeliveryWork = class {
       }
       let status;
       try {
-        status = fromBinary25(WorkspaceEffectStatusResponseSchema, observation.body);
+        status = fromBinary26(WorkspaceEffectStatusResponseSchema, observation.body);
       } catch {
         return this.#transportFailed("mailbox returned an invalid effect observation");
       }
@@ -16122,7 +16310,7 @@ var RemoteWorkspaceEffectDeliveryWork = class {
       return this.#advance(this.#delivery.next(response2, this.#settlement));
     }
     if (receipt.outcome.value.status === 202 && (receipt.outcome.value.contentType ?? "").includes(WORKSPACE_EFFECT_DEFERRED)) {
-      const deferred = fromBinary25(WorkspaceEffectDeferredSchema, receipt.outcome.value.body);
+      const deferred = fromBinary26(WorkspaceEffectDeferredSchema, receipt.outcome.value.body);
       this.#deferredRetryAfterMillis = Math.max(
         this.#deferredRetryAfterMillis ?? 0,
         Number(deferred.retryAfterMillis)
@@ -16147,7 +16335,7 @@ var RemoteWorkspaceEffectDeliveryWork = class {
     }
     let applied;
     try {
-      applied = fromBinary25(OfferResponseSchema, receipt.outcome.value.body);
+      applied = fromBinary26(OfferResponseSchema, receipt.outcome.value.body);
     } catch {
       return this.#transportFailed("remote workspace returned an invalid offer response");
     }
@@ -16269,7 +16457,7 @@ var RemoteWorkspaceEffectDeliveryWork = class {
           url: this.#mailboxUrl,
           contentType: WORKSPACE_EFFECT_STATUS,
           accept: WORKSPACE_EFFECT_STATUS_RESPONSE,
-          body: toBinary23(WorkspaceEffectStatusRequestSchema, create61(WorkspaceEffectStatusRequestSchema, {
+          body: toBinary24(WorkspaceEffectStatusRequestSchema, create61(WorkspaceEffectStatusRequestSchema, {
             sourceWorkspaceGenesis: offer.sourceWorkspaceGenesis,
             effectDigest: offer.effectDigest
           }))
@@ -16296,7 +16484,7 @@ var RemoteWorkspaceEffectDeliveryWork = class {
       url: this.#mailboxUrl,
       contentType: CARRIED_OFFER,
       accept: CARRIED_OFFER_RESPONSE,
-      body: toBinary23(OfferRequestSchema, body)
+      body: toBinary24(OfferRequestSchema, body)
     });
     this.#pending = create61(CorrespondencePendingSchema, {
       workId: this.workId,
@@ -16307,7 +16495,7 @@ var RemoteWorkspaceEffectDeliveryWork = class {
 };
 
 // ../peer-office/src/runtime/replica_follow_lane.ts
-import { create as create62, toBinary as toBinary24 } from "@bufbuild/protobuf";
+import { create as create62, toBinary as toBinary25 } from "@bufbuild/protobuf";
 var ReplicaFollowLane = class {
   #controller;
   #clock;
@@ -16381,7 +16569,7 @@ var ReplicaFollowLane = class {
     if (action === ReplicaFollowAction.RefreshCredential) {
       return {
         workspace,
-        frame: toBinary24(RuntimeRequestSchema, create62(RuntimeRequestSchema, {
+        frame: toBinary25(RuntimeRequestSchema, create62(RuntimeRequestSchema, {
           protocolVersion: 2,
           requestId,
           command: {
@@ -16396,7 +16584,7 @@ var ReplicaFollowLane = class {
     const replaceLocalHead = this.#controller.replacementHead(workspace);
     return {
       workspace,
-      frame: toBinary24(RuntimeRequestSchema, create62(RuntimeRequestSchema, {
+      frame: toBinary25(RuntimeRequestSchema, create62(RuntimeRequestSchema, {
         protocolVersion: 2,
         requestId,
         command: {
@@ -16613,6 +16801,7 @@ var CorrespondenceDesk = class {
   #onSyncCompleted;
   #onPlacementFetched;
   #onShallowMount;
+  #onOutboxHistoryRequired;
   #remoteOffers = new CorrespondenceWorkRegistry();
   #recoveries = new CorrespondenceWorkRegistry();
   #deliveries = new CorrespondenceWorkRegistry();
@@ -16659,6 +16848,7 @@ var CorrespondenceDesk = class {
     this.#onSyncCompleted = args.onSyncCompleted;
     this.#onPlacementFetched = args.onPlacementFetched;
     this.#onShallowMount = args.onShallowMount;
+    this.#onOutboxHistoryRequired = args.onOutboxHistoryRequired;
     this.#clock = args.clock;
     this.#outboxClock = new OutboxObservationClock(args.clock, args.peerIdentity);
     this.#executesCustodianObligations = args.executesCustodianObligations ?? false;
@@ -16822,6 +17012,15 @@ var CorrespondenceDesk = class {
     this.#followLane.dependencyAdvanced(workspace);
     this.reportFollows();
   }
+  /** Received custody can release correspondence and foreign-read dependencies,
+   * but is not newly authored work to send back to its upstream. Recovery is
+   * driven separately by missing history, reconnects and provider announcements.
+   * In particular an optimistic relay is not a durable upstream receipt. */
+  receivedFrontierChanged(workspace) {
+    this.wakeOutbox(workspace);
+    this.#followLane.dependencyAdvanced(workspace);
+    this.reportFollows();
+  }
   /**
    * Tell a workspace's sessions what its durable follow ALREADY knows.
    *
@@ -17058,8 +17257,16 @@ var CorrespondenceDesk = class {
         )
       );
     } catch (error) {
+      if (error instanceof KernelHistoryRequired && this.#onOutboxHistoryRequired) {
+        const retry = this.#onOutboxHistoryRequired(workspace, binding.credentialCapability);
+        this.#outboxDueAt.set(workspace, now + Math.max(250, retry));
+        return { nextAfterMillis: 0 };
+      }
       const format = localCopyFormatRefusal(error);
-      if (format === void 0) throw error;
+      if (format === void 0) {
+        this.#outboxDueAt.set(workspace, now + 3e4);
+        return { nextAfterMillis: 0 };
+      }
       this.#readability.mark(workspace, void 0, format);
       this.#outboxDueAt.delete(workspace);
       return { nextAfterMillis: 0 };
@@ -17140,7 +17347,7 @@ var CorrespondenceDesk = class {
     };
     return {
       workspace,
-      frame: toBinary25(RuntimeRequestSchema, create64(RuntimeRequestSchema, {
+      frame: toBinary26(RuntimeRequestSchema, create64(RuntimeRequestSchema, {
         protocolVersion: 2,
         requestId,
         target: { workspace, session: binding.session },
@@ -17339,6 +17546,7 @@ var CorrespondenceDesk = class {
         requestId: request.requestId,
         workId: id,
         probeOnly,
+        liveConnected: this.#openLinks.has(target3.mount.workspace),
         ...beforeConverge === void 0 ? {} : { beforeConverge },
         ...target3.receiveState === void 0 ? {} : { receiveState: target3.receiveState },
         ...target3.offerHead === void 0 ? {} : { offerHead: target3.offerHead },
@@ -17366,6 +17574,7 @@ var CorrespondenceDesk = class {
         root,
         work,
         outbound: command.admit,
+        liveConnected: this.#openLinks.has(mount.workspace),
         dependency: (workspace, source, acquire2 = false) => {
           if (this.#roundInFlight(workspace, workId2)) return void 0;
           const existing = this.#follows.bindingForWorkspace(workspace);
@@ -17820,7 +18029,7 @@ var IdentityWitnessCache = class {
 };
 
 // ../peer-office/src/runtime/identity_witness_read.ts
-import { create as create67, fromBinary as fromBinary26, toBinary as toBinary26 } from "@bufbuild/protobuf";
+import { create as create67, fromBinary as fromBinary27, toBinary as toBinary27 } from "@bufbuild/protobuf";
 function prepareWitnessRead(args) {
   if (args.reception.workspace !== args.rootWorkspace) {
     throw new Error("identity-provider witness route addresses another workspace");
@@ -17858,7 +18067,7 @@ function prepareWitnessRead(args) {
           contentType: "application/vnd.nomos.runtime-request+protobuf",
           accept: "application/vnd.nomos.runtime-response+protobuf",
           bearerToken: args.bearerToken.slice(),
-          body: toBinary26(RuntimeRequestSchema, request),
+          body: toBinary27(RuntimeRequestSchema, request),
           // Opening provider custody from cold storage can exceed 30 seconds.
           timeoutMillis: 5 * 6e4
         })
@@ -17888,7 +18097,7 @@ function acceptWitnessResponse(pending, receipt) {
       `identity-provider witness receipt '${receipt.effectId}' does not answer '${pending.effectId}'`
     );
   }
-  const response = fromBinary26(RuntimeResponseSchema, responseBody2(receipt));
+  const response = fromBinary27(RuntimeResponseSchema, responseBody2(receipt));
   if (response.protocolVersion !== RUNTIME_V2_PROTOCOL_VERSION) {
     throw new Error("identity-provider root returned an incompatible runtime response");
   }
@@ -18214,8 +18423,8 @@ var AdmissionDurabilityDesk = class {
 };
 
 // ../peer-office/src/runtime/identity_recovery_desk.ts
-import { create as create71, fromBinary as fromBinary27, toBinary as toBinary27 } from "@bufbuild/protobuf";
-var cloneCall = (call) => fromBinary27(CallRequestSchema, toBinary27(CallRequestSchema, call));
+import { create as create71, fromBinary as fromBinary28, toBinary as toBinary28 } from "@bufbuild/protobuf";
+var cloneCall = (call) => fromBinary28(CallRequestSchema, toBinary28(CallRequestSchema, call));
 var IdentityRecoveryDesk = class {
   #identity;
   #application;
@@ -18233,7 +18442,7 @@ var IdentityRecoveryDesk = class {
     if (!command.request || !["query", "offer"].includes(command.request.operation.case ?? "")) {
       throw new Error("identity-provider recovery demand did not originate from an application call");
     }
-    const originalCall = toBinary27(CallRequestSchema, command.request);
+    const originalCall = toBinary28(CallRequestSchema, command.request);
     const step = this.#identity.execute(
       runtimeRequest,
       create71(IdentityProviderWitnessRequestSchema, {
@@ -18313,7 +18522,7 @@ var IdentityRecoveryDesk = class {
     }
   }
   #adoptAndRetry(runtimeRequest, command, originalCall, requirement, ready) {
-    const original = fromBinary27(CallRequestSchema, originalCall);
+    const original = fromBinary28(CallRequestSchema, originalCall);
     const query = original.operation.case === "query" ? original.operation.value : void 0;
     const offer = original.operation.case === "offer" ? original.operation.value : void 0;
     const target3 = query?.target ?? offer?.target;
@@ -18361,7 +18570,7 @@ var IdentityRecoveryDesk = class {
     const retryCommand = create71(KernelCallRequestSchema, {
       session: command.session,
       credentialUse: command.credentialUse,
-      request: cloneCall(fromBinary27(CallRequestSchema, originalCall))
+      request: cloneCall(fromBinary28(CallRequestSchema, originalCall))
     });
     const retried = this.#application.call(runtimeRequest, retryCommand);
     if (retried.outcome.case === "failure" && retried.outcome.value.identityProviderWitnessRequired) {
@@ -18427,7 +18636,7 @@ var PeerMaintenanceScheduler = class {
 };
 
 // ../peer-office/src/runtime/peer_background_scheduler.ts
-import { create as create72, toBinary as toBinary28 } from "@bufbuild/protobuf";
+import { create as create72, toBinary as toBinary29 } from "@bufbuild/protobuf";
 var BACKGROUND_CONTINUATION_YIELD_MILLIS = 20;
 function yielding(paper) {
   if (paper.frame !== void 0 || paper.nextAfterMillis === void 0 || paper.nextAfterMillis > 0) return paper;
@@ -18461,7 +18670,7 @@ var PeerBackgroundScheduler = class {
     const recovery = retentionOnly ? {} : this.#subscriptions.nextRecovery(id, excludedWorkspaces);
     if (recovery.request) {
       return {
-        frame: toBinary28(RuntimeRequestSchema, recovery.request),
+        frame: toBinary29(RuntimeRequestSchema, recovery.request),
         nextAfterMillis: 0,
         workspace: recovery.request.target.workspace
       };
@@ -18469,7 +18678,7 @@ var PeerBackgroundScheduler = class {
     const retention = this.#residency.nextRetention();
     if (retention.request !== void 0) {
       return {
-        frame: toBinary28(RuntimeRequestSchema, create72(RuntimeRequestSchema, {
+        frame: toBinary29(RuntimeRequestSchema, create72(RuntimeRequestSchema, {
           protocolVersion: 2,
           requestId: id,
           command: {
@@ -18486,7 +18695,7 @@ var PeerBackgroundScheduler = class {
     const convergence = this.#receivingGroup.nextBackgroundPaper(id, excludedWorkspaces);
     if (convergence.frame !== void 0) {
       return {
-        frame: toBinary28(RuntimeRequestSchema, convergence.frame),
+        frame: toBinary29(RuntimeRequestSchema, convergence.frame),
         nextAfterMillis: 0,
         ...convergence.workspace === void 0 ? {} : { workspace: convergence.workspace }
       };
@@ -18547,7 +18756,7 @@ var PeerBackgroundScheduler = class {
     const recovery = this.#subscriptions.nextRecovery(id, excluded);
     if (recovery.request) {
       return {
-        frame: toBinary28(RuntimeRequestSchema, recovery.request),
+        frame: toBinary29(RuntimeRequestSchema, recovery.request),
         nextAfterMillis: 0,
         workspace: recovery.request.target.workspace
       };
@@ -18555,7 +18764,7 @@ var PeerBackgroundScheduler = class {
     const convergence = this.#receivingGroup.nextBackgroundPaper(id, excluded);
     if (convergence.frame !== void 0) {
       return {
-        frame: toBinary28(RuntimeRequestSchema, convergence.frame),
+        frame: toBinary29(RuntimeRequestSchema, convergence.frame),
         nextAfterMillis: 0,
         ...convergence.workspace === void 0 ? {} : { workspace: convergence.workspace }
       };
@@ -18840,7 +19049,7 @@ var RuntimeResponseFactory = class {
 };
 
 // ../peer-office/src/runtime/history_acquisition_desk.ts
-import { create as create74, toBinary as toBinary29 } from "@bufbuild/protobuf";
+import { create as create74, toBinary as toBinary30 } from "@bufbuild/protobuf";
 
 // ../peer-office/src/runtime/history_acquisition_state.ts
 var HistoryAcquisitionPhase = Object.freeze({
@@ -18901,15 +19110,15 @@ function reduceHistoryAcquisition(state, event) {
 var HISTORY_ACQUISITION_NAMESPACE = "nomos.peer-desk.history-acquisition/v1";
 var HISTORY_BACKGROUND_START_MILLIS = 1e4;
 var SLICE_ANSWER_MILLIS = 5 * 6e4;
-var encoder3 = new TextEncoder();
-var decoder3 = new TextDecoder();
+var encoder4 = new TextEncoder();
+var decoder4 = new TextDecoder();
 var workId = (workspace) => `history-acquisition:${workspace}`;
 var effectId = (workspace, attempt) => `history-acquisition:${workspace}:${HistoryAcquisitionPhase.Acquiring}:${attempt}`;
 var encode2 = (work) => {
   if (!work.credentialCapability) {
     throw new Error(`history acquisition for '${work.workspace}' has not restored its credential capability`);
   }
-  return encoder3.encode(JSON.stringify({
+  return encoder4.encode(JSON.stringify({
     version: 2,
     workspace: work.workspace,
     credentialCapability: work.credentialCapability,
@@ -18918,7 +19127,7 @@ var encode2 = (work) => {
 };
 var upgraded = (state) => state.case === "backoff" ? { case: HistoryAcquisitionPhase.Paced, attempt: state.attempt, delayMillis: state.delayMillis, failed: true } : state;
 var decode2 = (record) => {
-  const value = JSON.parse(decoder3.decode(record.value));
+  const value = JSON.parse(decoder4.decode(record.value));
   if (!value || typeof value !== "object") throw corrupt2(record, "not an object");
   const candidate = value;
   if (candidate.version !== 1 && candidate.version !== 2 || candidate.workspace !== record.key || !candidate.state) {
@@ -18981,6 +19190,21 @@ var HistoryAcquisitionDesk = class {
     this.#ensure(workspace, credentialCapability);
     this.#dueAt.set(workspace, this.#now() + HISTORY_BACKGROUND_START_MILLIS);
   }
+  /** A background kernel read needs an omitted ancestor now. Queue one bounded
+   * slice on the existing history lane; a failed slice keeps its retry pace. */
+  requestFromBackground(workspace, credentialCapability) {
+    if (!workspace) throw new Error("kernel history requirement names no workspace");
+    this.#ensure(workspace, credentialCapability);
+    const work = this.#get(workspace);
+    const now = this.#now();
+    if (work.state.case === HistoryAcquisitionPhase.Paced && work.state.failed) {
+      const due2 = this.#dueAt.get(workspace) ?? now + work.state.delayMillis;
+      this.#dueAt.set(workspace, due2);
+      if (due2 > now) return due2 - now;
+    }
+    this.#dueAt.set(workspace, now);
+    return 250;
+  }
   /** An operation needs history this custody lacks: its next slice now, joining one in flight. */
   begin(workspace, credentialCapability) {
     if (!workspace) throw new Error("kernel history requirement names no workspace");
@@ -19077,7 +19301,7 @@ var HistoryAcquisitionDesk = class {
     return {
       workspace: next.workspace,
       nextAfterMillis: 0,
-      frame: toBinary29(RuntimeRequestSchema, create74(RuntimeRequestSchema, {
+      frame: toBinary30(RuntimeRequestSchema, create74(RuntimeRequestSchema, {
         protocolVersion: 2,
         requestId,
         target: { workspace: next.workspace, session: `history-materialisation:${next.workspace}` },
@@ -19289,7 +19513,7 @@ var PeerOffice = class {
       this.#trace,
       this.#readability
     );
-    this.#custodyAdmission = new CustodyAdmissionDesk(this.#kernel, this.#custody);
+    this.#custodyAdmission = new CustodyAdmissionDesk(this.#kernel, this.#custody, new CustodyReceipts(seatedStore));
     this.#queries = new KernelQueries(this.#kernel, this.#credentials);
     this.#follows = new ReplicaFollowController(
       new ReplicaFollowDesk(seatedStore),
@@ -19451,6 +19675,7 @@ var PeerOffice = class {
       // Lazy history: a head-only mount materialises its history in the background, never on
       // the path of an operation (architecture/lazy_history.md).
       onShallowMount: (workspace, credentialCapability) => this.#historyAcquisition.materialise(workspace, credentialCapability),
+      onOutboxHistoryRequired: (workspace, credentialCapability) => this.#historyAcquisition.requestFromBackground(workspace, credentialCapability),
       onSyncCompleted: (session, event) => {
         if (event.result?.workspace) {
           this.#replicaInventory.placementMayHaveChanged(event.result.workspace);
@@ -19800,7 +20025,7 @@ var PeerOffice = class {
     this.#origins.observeReceipt(request);
     const response = this.#fenced(this.#handleRequest(request));
     this.#paperSlots.answered(request, response, (session) => this.#sessions.bindingIfPresent(session)?.workspace);
-    return { responseProtobuf: toBinary30(RuntimeResponseSchema, response) };
+    return { responseProtobuf: toBinary31(RuntimeResponseSchema, response) };
   }
   /** Every response leaving the office passes the origin fence (see fenceEffects). */
   #fenced(response) {
@@ -19917,8 +20142,8 @@ var PeerOffice = class {
       this.#replicaInventory.placementMayHaveChanged(workspace);
     }
   }
-  /** Execute a typed paper after the access desk; never skip lifecycle or
-   * session-binding checks merely because its caller is another local desk. */
+  /** Execute a typed paper after the access desk. Custody admission addresses a
+   * workspace by replica identity; application calls retain session binding. */
   #dispatchRequest(request) {
     validateRuntimeV2Request(request);
     try {
@@ -19932,18 +20157,20 @@ var PeerOffice = class {
         if (!request.target.workspace || !request.target.session) {
           throw new Error("addressed runtime request requires workspace and session");
         }
-        const binding = this.#sessions.bindingIfPresent(request.target.session);
-        if (binding !== void 0) {
-          if (binding.workspace !== request.target.workspace) {
-            throw new Error(
-              `session '${request.target.session}' is bound to workspace '${binding.workspace}', not '${request.target.workspace}'`
-            );
+        if (request.command.case !== "admitCustodyOffers") {
+          const binding = this.#sessions.bindingIfPresent(request.target.session);
+          if (binding !== void 0) {
+            if (binding.workspace !== request.target.workspace) {
+              throw new Error(
+                `session '${request.target.session}' is bound to workspace '${binding.workspace}', not '${request.target.workspace}'`
+              );
+            }
+          } else {
+            this.#bindInteraction(create75(BindSessionRequestSchema, {
+              session: request.target.session,
+              workspace: request.target.workspace
+            }));
           }
-        } else {
-          this.#bindInteraction(create75(BindSessionRequestSchema, {
-            session: request.target.session,
-            workspace: request.target.workspace
-          }));
         }
       }
       switch (request.command.case) {
@@ -20140,7 +20367,7 @@ var PeerOffice = class {
                 ReadMaintenanceCause.ADMITTED_OFFER
               );
               this.#subscriptions.refreshWorkspace(request.target.workspace);
-              this.#correspondence.workspaceFrontierChanged(request.target.workspace);
+              this.#correspondence.receivedFrontierChanged(request.target.workspace);
             }
             return this.#birthCustodyResponse(
               request,
@@ -20707,7 +20934,7 @@ var peerOffice = {
 };
 
 // ../peer-office/src/runtime/frame_runner.ts
-import { fromBinary as fromBinary28 } from "@bufbuild/protobuf";
+import { fromBinary as fromBinary29 } from "@bufbuild/protobuf";
 
 // ../peer-office/src/runtime/background_lanes.ts
 var defaultSetTimer = (callback, delayMillis) => {
@@ -20726,6 +20953,15 @@ function createBackgroundLanes(options) {
   const correspondenceNotBefore = /* @__PURE__ */ new Map();
   let retention = 0;
   let closed = false;
+  let selectionFailures = 0;
+  const selectionFault = (error) => {
+    try {
+      options.onSelectionError?.(error);
+    } catch {
+    }
+    selectionFailures += 1;
+    wake(Math.min(3e4, 250 * 2 ** Math.min(selectionFailures - 1, 7)));
+  };
   const wake = (delayMillis = 0) => {
     if (closed) return;
     const delay = Math.max(0, Math.ceil(delayMillis));
@@ -20736,53 +20972,58 @@ function createBackgroundLanes(options) {
     }
     wakeAt = at;
     timer = setTimer(() => {
-      timer = void 0;
-      wakeAt = void 0;
-      if (closed) return;
-      const now = options.monotonicNanoseconds();
-      for (const [workspace2, at2] of correspondenceNotBefore) {
-        if (at2 <= now) correspondenceNotBefore.delete(workspace2);
-      }
-      const backoffMillis = correspondenceNotBefore.size ? Math.min(...[...correspondenceNotBefore.values()].map((at2) => Number((at2 - now + 999999n) / 1000000n))) : void 0;
-      const retentionOnly = correspondenceInFlight;
-      const next = options.nextPaper(retentionOnly, new Set(correspondenceNotBefore.keys()));
-      if (next.frame === void 0) {
-        const delays = [next.nextAfterMillis, backoffMillis].filter((delay2) => delay2 !== void 0);
-        if (delays.length) wake(Math.min(...delays));
-        return;
-      }
-      if (options.isRetention(next.frame)) {
-        retention += 1;
+      try {
+        timer = void 0;
+        wakeAt = void 0;
+        if (closed) return;
+        const now = options.monotonicNanoseconds();
+        for (const [workspace2, at2] of correspondenceNotBefore) {
+          if (at2 <= now) correspondenceNotBefore.delete(workspace2);
+        }
+        const backoffMillis = correspondenceNotBefore.size ? Math.min(...[...correspondenceNotBefore.values()].map((at2) => Number((at2 - now + 999999n) / 1000000n))) : void 0;
+        const retentionOnly = correspondenceInFlight;
+        const next = options.nextPaper(retentionOnly, new Set(correspondenceNotBefore.keys()));
+        selectionFailures = 0;
+        if (next.frame === void 0) {
+          const delays = [next.nextAfterMillis, backoffMillis].filter((delay2) => delay2 !== void 0);
+          if (delays.length) wake(Math.min(...delays));
+          return;
+        }
+        if (options.isRetention(next.frame)) {
+          retention += 1;
+          void options.drive(next.frame).then(
+            () => {
+              retention -= 1;
+              wake(0);
+            },
+            () => {
+              retention -= 1;
+              wake(0);
+            }
+          );
+          wake(next.nextAfterMillis ?? 0);
+          return;
+        }
+        if (retentionOnly) throw new Error("background desk reserved correspondence while its lane was unavailable");
+        const workspace = next.workspace;
+        if (!workspace) throw new Error("background correspondence has no source workspace");
+        if (correspondenceNotBefore.has(workspace)) throw new Error("background desk bypassed a workspace's physical backoff");
+        correspondenceInFlight = true;
         void options.drive(next.frame).then(
           () => {
-            retention -= 1;
-            wake(0);
+            correspondenceInFlight = false;
+            wake(next.nextAfterMillis ?? 0);
           },
           () => {
-            retention -= 1;
+            correspondenceInFlight = false;
+            correspondenceNotBefore.set(workspace, options.monotonicNanoseconds() + BigInt(failureBackoffMillis) * 1000000n);
             wake(0);
           }
         );
-        wake(next.nextAfterMillis ?? 0);
-        return;
+        wake(0);
+      } catch (error) {
+        selectionFault(error);
       }
-      if (retentionOnly) throw new Error("background desk reserved correspondence while its lane was unavailable");
-      const workspace = next.workspace;
-      if (!workspace) throw new Error("background correspondence has no source workspace");
-      if (correspondenceNotBefore.has(workspace)) throw new Error("background desk bypassed a workspace's physical backoff");
-      correspondenceInFlight = true;
-      void options.drive(next.frame).then(
-        () => {
-          correspondenceInFlight = false;
-          wake(next.nextAfterMillis ?? 0);
-        },
-        () => {
-          correspondenceInFlight = false;
-          correspondenceNotBefore.set(workspace, options.monotonicNanoseconds() + BigInt(failureBackoffMillis) * 1000000n);
-          wake(0);
-        }
-      );
-      wake(0);
     }, delay);
   };
   return {
@@ -20818,7 +21059,7 @@ function createPeerOfficeFrameRunner(kernel, credentials, profile, observations,
       const event = peer.nextEvent();
       if (event === void 0) return;
       if (maintenanceSettled !== void 0) {
-        const decoded = fromBinary28(RuntimeEventSchema, event);
+        const decoded = fromBinary29(RuntimeEventSchema, event);
         if (decoded.event.case === "maintenanceProgress" && decoded.event.value.kernel && !decoded.event.value.kernel.maintenancePending) {
           maintenanceSettled(decoded.event.value);
         }
@@ -20853,11 +21094,12 @@ function createPeerOfficeFrameRunner(kernel, credentials, profile, observations,
       return paper;
     },
     drive: (frame) => driveBackground(frame).catch((error) => {
-      peer.backgroundPaperAbandoned(fromBinary28(RuntimeRequestSchema, frame).requestId);
+      peer.backgroundPaperAbandoned(fromBinary29(RuntimeRequestSchema, frame).requestId);
       throw error;
     }),
-    isRetention: (frame) => fromBinary28(RuntimeRequestSchema, frame).command.case === "retainFrontier",
-    monotonicNanoseconds: () => observations.monotonicNanoseconds()
+    isRetention: (frame) => fromBinary29(RuntimeRequestSchema, frame).command.case === "retainFrontier",
+    monotonicNanoseconds: () => observations.monotonicNanoseconds(),
+    onSelectionError: (error) => console.error("Nomos background paper selection failed", error)
   });
   const scheduleCorrespondence = (delayMillis = 0) => {
     lanes?.wake(delayMillis);
@@ -20866,7 +21108,7 @@ function createPeerOfficeFrameRunner(kernel, credentials, profile, observations,
     handleFrame(frame) {
       const response = peer.invoke(frame).responseProtobuf;
       drainEvents();
-      if (fromBinary28(RuntimeRequestSchema, frame).command.case !== "workspaceStatus") {
+      if (fromBinary29(RuntimeRequestSchema, frame).command.case !== "workspaceStatus") {
         scheduleMaintenance();
         scheduleCorrespondence();
       }
@@ -20919,7 +21161,7 @@ function createPeerOfficeFrameRunner(kernel, credentials, profile, observations,
 }
 
 // ../peer-office/src/runtime/platform_effect_driver.ts
-import { create as create76, fromBinary as fromBinary29, toBinary as toBinary31 } from "@bufbuild/protobuf";
+import { create as create76, fromBinary as fromBinary30, toBinary as toBinary32 } from "@bufbuild/protobuf";
 var externalPeerEffect = Symbol("nomos.externalPeerEffect");
 var openKernelResidency = (runner, protocolVersion, requestId, workspace) => {
   runner.openLocalCustody(workspace, requestId);
@@ -20952,7 +21194,7 @@ var acquireKernelCustody = async (runner, custody, protocolVersion, requestId, w
 var correspondenceWakeups = /* @__PURE__ */ new WeakMap();
 var deliveryIdentity = (requestFrame) => {
   try {
-    const request = fromBinary29(RuntimeRequestSchema, requestFrame);
+    const request = fromBinary30(RuntimeRequestSchema, requestFrame);
     if (request.command.case !== "deliverWorkspaceEffects") return void 0;
     const command = request.command.value;
     return `${command.sourceSession}\0${command.targetWorkspace}\0${command.sourceCommit ?? ""}`;
@@ -20963,7 +21205,7 @@ var deliveryIdentity = (requestFrame) => {
 var arrangeCorrespondenceWakeup = (runner, requestFrame, responseFrame, fetchImpl) => {
   const identity = deliveryIdentity(requestFrame);
   if (!identity) return;
-  const response = fromBinary29(RuntimeResponseSchema, responseFrame);
+  const response = fromBinary30(RuntimeResponseSchema, responseFrame);
   const retryAt = response.outcome.case === "workspaceEffectsDelivered" ? response.outcome.value.retryAtMillis : void 0;
   const wakeups = correspondenceWakeups.get(runner) ?? /* @__PURE__ */ new Map();
   correspondenceWakeups.set(runner, wakeups);
@@ -21088,13 +21330,19 @@ var candidateSessionReference = async (identity) => {
 };
 var executeGitFetchWithAlongside = async (effect, fetchImpl) => {
   if (!effect.alongside) return executeGitFetchEffect(effect, fetchImpl);
-  const [fetched, alongside] = await Promise.all([
-    executeGitFetchEffect(effect, fetchImpl),
-    executeHttpEffect(effect.alongside, fetchImpl)
-  ]);
-  if (fetched.outcome.case === "gitFetch" && alongside.outcome.case === "response") {
+  const cancelAlongside = new AbortController();
+  let alongside;
+  void executeHttpEffect(effect.alongside, (input, init) => fetchImpl(input, {
+    ...init,
+    signal: init?.signal ? AbortSignal.any([init.signal, cancelAlongside.signal]) : cancelAlongside.signal
+  })).then((receipt) => {
+    alongside = receipt;
+  });
+  const fetched = await executeGitFetchEffect(effect, fetchImpl);
+  if (fetched.outcome.case === "gitFetch" && alongside?.outcome.case === "response") {
     fetched.outcome.value.alongside = alongside.outcome.value;
   }
+  cancelAlongside.abort();
   return fetched;
 };
 var executeGitPushEffect = async (effect, fetchImpl) => {
@@ -21156,14 +21404,14 @@ async function drivePeerFrame(runner, initialFrame, fetchImpl = globalThis.fetch
   const satisfied = /* @__PURE__ */ new Set();
   const resendable = (() => {
     try {
-      return fromBinary29(RuntimeRequestSchema, initialFrame).command.case !== "continueCorrespondence";
+      return fromBinary30(RuntimeRequestSchema, initialFrame).command.case !== "continueCorrespondence";
     } catch {
       return false;
     }
   })();
   let historyRetries = 0;
   for (; ; ) {
-    const response = fromBinary29(RuntimeResponseSchema, responseFrame);
+    const response = fromBinary30(RuntimeResponseSchema, responseFrame);
     if (response.outcome.case === "historyAcquired" && resendable && historyRetries < 32) {
       historyRetries += 1;
       responseFrame = runner.handleFrame(initialFrame);
@@ -21173,7 +21421,7 @@ async function drivePeerFrame(runner, initialFrame, fetchImpl = globalThis.fetch
       if (yieldLocalReadToCaller) return responseFrame;
       const pending2 = response.outcome.value;
       await new Promise((resolve4) => setTimeout(resolve4, pending2.resumeAfterMillis));
-      responseFrame = runner.handleFrame(toBinary31(RuntimeRequestSchema, create76(RuntimeRequestSchema, {
+      responseFrame = runner.handleFrame(toBinary32(RuntimeRequestSchema, create76(RuntimeRequestSchema, {
         protocolVersion: response.protocolVersion,
         requestId: response.requestId,
         command: { case: "continueLocalRead", value: create76(ContinueLocalReadRequestSchema, { workId: pending2.workId }) }
@@ -21273,7 +21521,7 @@ async function drivePeerFrame(runner, initialFrame, fetchImpl = globalThis.fetch
           outcome: { case: "failure", value: { reason: PeerEffectFailureReason.TRANSPORT, message: error instanceof Error ? error.message : String(error) } }
         });
       }
-      responseFrame = runner.handleFrame(toBinary31(RuntimeRequestSchema, create76(RuntimeRequestSchema, {
+      responseFrame = runner.handleFrame(toBinary32(RuntimeRequestSchema, create76(RuntimeRequestSchema, {
         protocolVersion: response.protocolVersion,
         requestId: response.requestId,
         command: { case: "continueCorrespondence", value: { workId: pending.workId, receipt: receipt2 } }
@@ -21301,7 +21549,7 @@ async function drivePeerFrame(runner, initialFrame, fetchImpl = globalThis.fetch
     }) : pending.effect.case === "retainFrontier" ? await executeRetainFrontierEffect(pending.effect.value, custody) : pending.effect.case === "wake" ? await executeWakeEffect(pending.effect.value) : pending.effect.case === "refreshCredential" ? await executeCredentialRefreshEffect(pending.effect.value, credentialRefresh) : pending.effect.case === "deviceIdentity" ? await executeDeviceIdentityEffect(pending.effect.value, deviceIdentity) : pending.effect.case === "lawPackage" ? await executeLawPackageEffect(pending.effect.value, lawPackage) : pending.effect.case === "historyAcquisition" ? await executeHistoryAcquisitionEffect(pending.effect.value, custody) : (() => {
       throw new Error(`correspondence work '${pending.workId}' has no effect`);
     })();
-    responseFrame = runner.handleFrame(toBinary31(RuntimeRequestSchema, create76(RuntimeRequestSchema, {
+    responseFrame = runner.handleFrame(toBinary32(RuntimeRequestSchema, create76(RuntimeRequestSchema, {
       protocolVersion: response.protocolVersion,
       requestId: response.requestId,
       command: {
@@ -21373,11 +21621,11 @@ async function executeDeviceIdentityEffect(effect, store) {
       await store.save(effect.identity, effect.operation.value.secret.slice());
     } else if (effect.operation.case === "loadRecovery") {
       const bytes = await store.load(`nomos-device-recovery-v1|${effect.identity}`);
-      if (bytes !== void 0) recovery = fromBinary29(DeviceRecoveryRecordSchema, bytes);
+      if (bytes !== void 0) recovery = fromBinary30(DeviceRecoveryRecordSchema, bytes);
     } else if (effect.operation.case === "saveRecovery") {
       const record = effect.operation.value.record;
       if (!record) throw new Error("device recovery save contains no record");
-      await store.save(`nomos-device-recovery-v1|${effect.identity}`, toBinary31(DeviceRecoveryRecordSchema, record));
+      await store.save(`nomos-device-recovery-v1|${effect.identity}`, toBinary32(DeviceRecoveryRecordSchema, record));
     } else throw new Error("device identity effect has no operation");
     return create76(PeerEffectReceiptSchema, { effectId: effect.effectId, outcome: {
       case: "deviceIdentity",
@@ -21450,25 +21698,26 @@ async function executeRetainFrontierEffect(effect, custody) {
 }
 
 // ../platform-shells/shared/socket_effects.ts
-import { create as create77, fromBinary as fromBinary30, toBinary as toBinary32 } from "@bufbuild/protobuf";
+import { create as create77, fromBinary as fromBinary31, toBinary as toBinary33 } from "@bufbuild/protobuf";
 function socketEffects(invoke2, permits = () => true) {
   const sockets = /* @__PURE__ */ new Map();
   let sequence = 50000000000n;
   let closed = false;
   const receipt = (connectionId, observation) => {
     if (closed) return;
-    const frame = toBinary32(RuntimeRequestSchema, create77(RuntimeRequestSchema, {
+    const frame = toBinary33(RuntimeRequestSchema, create77(RuntimeRequestSchema, {
       protocolVersion: 2,
       requestId: ++sequence,
       command: { case: "socketReceipt", value: create77(PeerSocketReceiptSchema, { connectionId, observation }) }
     }));
-    void Promise.resolve().then(() => invoke2(frame)).catch(() => {
+    void Promise.resolve().then(() => invoke2(frame)).catch((error) => {
+      console.warn("[nomos-socket] receipt failed", { connectionId, error });
       sockets.get(connectionId)?.close();
     });
   };
   return {
     consume(frame) {
-      const event = fromBinary30(RuntimeEventSchema, frame);
+      const event = fromBinary31(RuntimeEventSchema, frame);
       if (event.event.case !== "socketEffect") return false;
       const effect = event.event.value;
       const id = effect.connectionId;
@@ -21484,6 +21733,7 @@ function socketEffects(invoke2, permits = () => true) {
           socket.onopen = () => receipt(id, { case: "opened", value: true });
           socket.onmessage = (message) => {
             if (message.data instanceof ArrayBuffer) receipt(id, { case: "received", value: new Uint8Array(message.data) });
+            else if (typeof message.data === "string") receipt(id, { case: "received", value: new TextEncoder().encode(message.data) });
           };
           socket.onclose = () => {
             if (sockets.get(id) === socket) sockets.delete(id);
@@ -21516,17 +21766,17 @@ function socketEffects(invoke2, permits = () => true) {
 }
 
 // ../platform-shells/shared/credential_effects.ts
-import { create as create78, fromBinary as fromBinary31, toBinary as toBinary33 } from "@bufbuild/protobuf";
+import { create as create78, fromBinary as fromBinary32, toBinary as toBinary34 } from "@bufbuild/protobuf";
 function credentialEffects(invoke2, provider) {
   return { consume(frame) {
-    const event = fromBinary31(RuntimeEventSchema, frame);
+    const event = fromBinary32(RuntimeEventSchema, frame);
     if (event.event.case !== "credentialRefreshRequested" || provider === externalPeerEffect) return false;
     const pending = event.event.value.pending;
     if (pending?.effect.case !== "refreshCredential") throw new Error("credential refresh event omitted its physical effect");
     const effect = pending.effect.value;
     void Promise.resolve().then(async () => {
       const receipt = await executeCredentialRefreshEffect(effect, provider);
-      const response = fromBinary31(RuntimeResponseSchema, await invoke2(toBinary33(RuntimeRequestSchema, create78(RuntimeRequestSchema, {
+      const response = fromBinary32(RuntimeResponseSchema, await invoke2(toBinary34(RuntimeRequestSchema, create78(RuntimeRequestSchema, {
         protocolVersion: 2,
         requestId: event.sequence,
         command: { case: "continueCorrespondence", value: create78(ContinueCorrespondenceRequestSchema, { workId: pending.workId, receipt }) }
@@ -21541,7 +21791,7 @@ function credentialEffects(invoke2, provider) {
 
 // ../platform-shells/shared/peer_office_host.ts
 var targetOf = (frame) => {
-  const target3 = fromBinary32(RuntimeRequestSchema, frame).target;
+  const target3 = fromBinary33(RuntimeRequestSchema, frame).target;
   return {
     ...target3?.session === void 0 ? {} : { session: target3.session },
     ...target3?.workspace === void 0 ? {} : { workspace: target3.workspace }
@@ -21595,7 +21845,7 @@ function openPeerOfficeHost(kernel, shell, fetchImpl = globalThis.fetch, mainten
   );
   const providerOrigins = [...configuredOrigins];
   if (providerOrigins.length > 0) {
-    const configured = fromBinary32(RuntimeResponseSchema, runner.handleFrame(toBinary34(
+    const configured = fromBinary33(RuntimeResponseSchema, runner.handleFrame(toBinary35(
       RuntimeRequestSchema,
       create79(RuntimeRequestSchema, {
         protocolVersion: 2,
@@ -21609,7 +21859,7 @@ function openPeerOfficeHost(kernel, shell, fetchImpl = globalThis.fetch, mainten
   }
   return {
     async invoke(args) {
-      const request = fromBinary32(RuntimeRequestSchema, args.requestBytes);
+      const request = fromBinary33(RuntimeRequestSchema, args.requestBytes);
       if (request.protocolVersion !== 2) {
         throw new Error(`unsupported Nomos runtime protocol ${request.protocolVersion}`);
       }
@@ -21696,21 +21946,21 @@ var SqlitePeerDeskStore = class {
     }
     return this.#opened = database;
   }
-  list(namespace) {
+  list(namespace2) {
     const rows = this.#database().prepare(`
       SELECT record_key AS key, revision, value
         FROM peer_desk_record
        WHERE namespace = ?
        ORDER BY record_key
-    `).all(namespace);
+    `).all(namespace2);
     return rows.map((row) => ({
-      namespace,
+      namespace: namespace2,
       key: row.key,
       revision: BigInt(row.revision),
       value: Uint8Array.from(row.value)
     }));
   }
-  compareExchange(namespace, key, expectedRevision, value) {
+  compareExchange(namespace2, key, expectedRevision, value) {
     const expected = expectedRevision === void 0 ? void 0 : Number(expectedRevision);
     if (expected !== void 0 && (!Number.isSafeInteger(expected) || expected <= 0)) {
       throw new Error(`peer desk revision ${expectedRevision} cannot be represented by SQLite`);
@@ -21723,8 +21973,8 @@ var SqlitePeerDeskStore = class {
         const removed = database.prepare(`
           DELETE FROM peer_desk_record
            WHERE namespace = ? AND record_key = ? AND revision = ?
-        `).run(namespace, key, expected);
-        if (removed.changes !== 1) this.#conflict(namespace, key);
+        `).run(namespace2, key, expected);
+        if (removed.changes !== 1) this.#conflict(namespace2, key);
         return this.#commit(void 0);
       }
       const bytes = Buffer.from(value.buffer, value.byteOffset, value.byteLength);
@@ -21736,14 +21986,14 @@ var SqlitePeerDeskStore = class {
             INSERT INTO peer_desk_record(namespace, record_key, revision, value)
             VALUES (?, ?, 1, ?)
             ON CONFLICT(namespace, record_key) DO NOTHING
-          `).run(namespace, key, bytes) : database.prepare(`
+          `).run(namespace2, key, bytes) : database.prepare(`
             UPDATE peer_desk_record
                SET revision = ?, value = ?
              WHERE namespace = ? AND record_key = ? AND revision = ?
-          `).run(nextRevision, bytes, namespace, key, expected);
-      if (changed.changes !== 1) this.#conflict(namespace, key);
+          `).run(nextRevision, bytes, namespace2, key, expected);
+      if (changed.changes !== 1) this.#conflict(namespace2, key);
       return this.#commit({
-        namespace,
+        namespace: namespace2,
         key,
         revision: BigInt(nextRevision),
         value: value.slice()
@@ -21761,12 +22011,12 @@ var SqlitePeerDeskStore = class {
     this.#database().exec("COMMIT");
     return value;
   }
-  #conflict(namespace, key) {
+  #conflict(namespace2, key) {
     const current = this.#database().prepare(`
       SELECT revision FROM peer_desk_record WHERE namespace = ? AND record_key = ?
-    `).get(namespace, key);
+    `).get(namespace2, key);
     throw new Error(
-      `peer desk record '${namespace}/${key}' changed at revision ${current?.revision ?? "absent"}`
+      `peer desk record '${namespace2}/${key}' changed at revision ${current?.revision ?? "absent"}`
     );
   }
 };
@@ -22187,7 +22437,7 @@ async function startDevCloud(options = {}) {
       classes: ["cloud"],
       warmResidencyMillis: 600000n,
       servedOrigin: origin,
-      custodianPlacement: toBinary35(CustodyPlacementPolicySchema, create82(CustodyPlacementPolicySchema, {
+      custodianPlacement: toBinary36(CustodyPlacementPolicySchema, create82(CustodyPlacementPolicySchema, {
         declaration: "local-development-custodian-v1",
         adoptedBy: `peer:local-custodian:${origin}`,
         reason: "The development cloud retains born workspaces and publishes local-first placement for its clients",
@@ -22219,8 +22469,8 @@ async function startDevCloud(options = {}) {
     if (ringPlacement) {
       try {
         const advanced = placementAdvance(
-          fromBinary33(RuntimeRequestSchema, args.requestBytes),
-          fromBinary33(RuntimeResponseSchema, bytes)
+          fromBinary34(RuntimeRequestSchema, args.requestBytes),
+          fromBinary34(RuntimeResponseSchema, bytes)
         );
         if (advanced) ringPlacement(advanced.workspace, advanced.frontier);
       } catch (error) {
@@ -22243,7 +22493,7 @@ async function startDevCloud(options = {}) {
     const timer = setTimeout(() => {
       admissionTimers.delete(key);
       const requestId = ++requestSequence;
-      const frame = toBinary35(RuntimeRequestSchema, create82(RuntimeRequestSchema, {
+      const frame = toBinary36(RuntimeRequestSchema, create82(RuntimeRequestSchema, {
         protocolVersion: 2,
         requestId,
         target: { workspace, session: `custody-admission:${workspace}` },
@@ -22260,7 +22510,7 @@ async function startDevCloud(options = {}) {
         }
       }));
       void observedInvoke({ workspace, requestBytes: frame }).then((bytes) => {
-        const response = fromBinary33(RuntimeResponseSchema, bytes);
+        const response = fromBinary34(RuntimeResponseSchema, bytes);
         if (response.outcome.case !== "custodyOffersAdmitted") {
           console.error(`[local-peer] admission ${key}: ${response.outcome.case || "empty"}`);
         }
@@ -22406,7 +22656,7 @@ async function startDevCloud(options = {}) {
             "cache-control": "no-store",
             ...discovery.frontier ? { etag: `"${discovery.frontier}"` } : {}
           });
-          response.end(Buffer.from(toBinary35(DiscoveredWorkspacePlacementSchema, discovery)));
+          response.end(Buffer.from(toBinary36(DiscoveredWorkspacePlacementSchema, discovery)));
           return;
         }
         if (remainder.length === 1 && await carriage.respond(request, response, workspace, remainder[0])) return;
@@ -22425,7 +22675,7 @@ async function startDevCloud(options = {}) {
             return;
           }
           const answer = await answerLawProducts(
-            async (paper) => fromBinary33(RuntimeResponseSchema, await observedInvoke({ workspace, requestBytes: paper })),
+            async (paper) => fromBinary34(RuntimeResponseSchema, await observedInvoke({ workspace, requestBytes: paper })),
             workspace,
             knownLawIdentities(url)
           );
@@ -22463,7 +22713,7 @@ async function startDevCloud(options = {}) {
             "content-type": "application/vnd.nomos.git-read-lease+protobuf",
             "cache-control": "private, no-store"
           });
-          response.end(Buffer.from(toBinary35(GitReadLeaseSchema, lease)));
+          response.end(Buffer.from(toBinary36(GitReadLeaseSchema, lease)));
           return;
         }
         if (await carriage.respondReport(request, response, workspace, remainder)) return;