githolon 0.112.8 → 0.112.11

package/dist/full-cli.mjs

@@ -3534,7 +3534,7 @@ function birth(recipeOrAggregate, spec) {
       .../* @__PURE__ */ new Set([AUTH_PROVIDER_AUTHORITY, ...spec.parentWorkspace?.roles ?? []])
     ].sort();
     const aggregateNoun = aggregate2.id.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
-    const namespace = (spec.namespace ?? aggregateNoun).replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+    const namespace2 = (spec.namespace ?? aggregateNoun).replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
     const rootId = `${aggregateNoun}:self`;
     const declaration = {
       __isBusinessBirth: true,
@@ -3542,7 +3542,7 @@ function birth(recipeOrAggregate, spec) {
       payloadSchema,
       key: (payload) => String(payload[spec.key]),
       reference: (payload) => ({
-        workspace: workspaceNameForKey(namespace, String(payload[spec.key])),
+        workspace: workspaceNameForKey(namespace2, String(payload[spec.key])),
         type: aggregate2.id,
         id: rootId
       }),
@@ -3569,8 +3569,8 @@ function birth(recipeOrAggregate, spec) {
   }
   footprint2.push(recipeOrAggregate);
 }
-function workspaceNameForKey(namespace, key2) {
-  return namespace + "-" + nomos.sha256(String(namespace) + WORKSPACE_NAME_SEP + String(key2)).slice(0, 40);
+function workspaceNameForKey(namespace2, key2) {
+  return namespace2 + "-" + nomos.sha256(String(namespace2) + WORKSPACE_NAME_SEP + String(key2)).slice(0, 40);
 }
 function resolveChain(child, c) {
   return typeof c === "function" ? c(child) : c;
@@ -3585,10 +3585,10 @@ var init_births = __esm({
     WORKSPACE_NAME_SEP = "";
     birthKeyed = ({
       key: key2,
-      namespace,
+      namespace: namespace2,
       genesisChain
     }) => {
-      const child = workspaceNameForKey(namespace, String(key2));
+      const child = workspaceNameForKey(namespace2, String(key2));
       footprint2.push({ workspace: child, genesisChain: resolveChain(child, genesisChain) });
       return child;
     };
@@ -3603,11 +3603,11 @@ var init_births = __esm({
     };
     birthSingleton = ({
       keyedBy,
-      namespace,
+      namespace: namespace2,
       genesisChain
     }) => {
       const key2 = (Array.isArray(keyedBy) ? keyedBy : [keyedBy]).map(String).join(WORKSPACE_NAME_SEP);
-      return birthKeyed({ key: key2, namespace, genesisChain });
+      return birthKeyed({ key: key2, namespace: namespace2, genesisChain });
     };
     ((birth2) => {
       birth2.keyed = birthKeyed;
@@ -7130,7 +7130,7 @@ function lowerOne(decl, domain, initialBirthPolicyDomains = [domain]) {
   }
   const stem = decl.aggregate.id.replace(/[^A-Za-z0-9]/g, "");
   const aggregateNoun = decl.aggregate.id.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
-  const namespace = (decl.namespace ?? aggregateNoun).replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+  const namespace2 = (decl.namespace ?? aggregateNoun).replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
   const rootId = `${aggregateNoun}:self`;
   const seedId = `nomosSeed${stem}`;
   const birthId = `nomosBirth${stem}`;
@@ -7194,7 +7194,7 @@ function lowerOne(decl, domain, initialBirthPolicyDomains = [domain]) {
   };
   const birthBase = directive(birthId).creates(decl.aggregate).payload(parentSchema).plan((p, ctx) => {
     const founder = p.principal;
-    const child = workspaceNameForKey(namespace, String(decl.key(p)));
+    const child = workspaceNameForKey(namespace2, String(decl.key(p)));
     const foundingKeyHash = foundedBirthKeyHash(founder);
     const founded = foundingKeyHash !== void 0;
     if (founded) {
@@ -7273,7 +7273,7 @@ function lowerOne(decl, domain, initialBirthPolicyDomains = [domain]) {
         ),
         // The roles the parent delegates into every child of this namespace its founder's scope
         // founds (formerly a per-intent delegation certificate), as state tuples for the founder.
-        ...delegatedRolesSteps(founder, founder, namespace, Date.parse(String(p.bornAt)))
+        ...delegatedRolesSteps(founder, founder, namespace2, Date.parse(String(p.bornAt)))
       ] : [],
       {
         domain,
@@ -7321,7 +7321,7 @@ function lowerOne(decl, domain, initialBirthPolicyDomains = [domain]) {
     owned: decl.aggregate.audience?.kind === "owned",
     publicPayloadSchema: publicSchema,
     rootId,
-    namespace,
+    namespace: namespace2,
     keyField: decl.keyField,
     seedDirectiveId: seedId,
     genesisDirectiveIds: [
@@ -9808,10 +9808,10 @@ var init_node_custody_filesystem = __esm({
 // ../platform-shells/node/kernel_wasi_stdio.ts
 import { TextDecoder as TextDecoder2 } from "node:util";
 function kernelWasiStdio(memory, stderr, writeFile2, stderrPartial) {
-  const decoder4 = new TextDecoder2();
+  const decoder5 = new TextDecoder2();
   let pending = "";
   const accept = (bytes) => {
-    pending += decoder4.decode(bytes, { stream: true });
+    pending += decoder5.decode(bytes, { stream: true });
     for (; ; ) {
       const newline = pending.indexOf("\n");
       if (newline >= 0 && newline < 16384) {
@@ -11504,17 +11504,17 @@ function attributes(capability) {
   }
   return result;
 }
-function capabilityByNamespace(capabilities, namespace) {
-  const matches = capabilities.filter((capability) => capability.namespace === namespace);
+function capabilityByNamespace(capabilities, namespace2) {
+  const matches = capabilities.filter((capability) => capability.namespace === namespace2);
   if (matches.length !== 1) {
-    throw new Error(`OSGi resource needs exactly one ${namespace} capability`);
+    throw new Error(`OSGi resource needs exactly one ${namespace2} capability`);
   }
   return matches[0];
 }
-function optionalCapabilityByNamespace(capabilities, namespace) {
-  const matches = capabilities.filter((capability) => capability.namespace === namespace);
+function optionalCapabilityByNamespace(capabilities, namespace2) {
+  const matches = capabilities.filter((capability) => capability.namespace === namespace2);
   if (matches.length > 1) {
-    throw new Error(`OSGi resource needs at most one ${namespace} capability`);
+    throw new Error(`OSGi resource needs at most one ${namespace2} capability`);
   }
   return matches[0];
 }
@@ -12553,7 +12553,8 @@ var init_kernel_port = __esm({
           }
         }));
         if (response.outcome.case === "failure") {
-          throw new Error(`${response.outcome.value.code}: ${response.outcome.value.message}`);
+          throwUnnamedHistoryRequirement(response.outcome.value, mount.workspace);
+          throwKernelFailure(response.outcome.value);
         }
         if (response.outcome.case !== "outbox") {
           throw new Error(`kernel returned '${response.outcome.case || "empty"}' while reading correspondence`);
@@ -12582,7 +12583,8 @@ var init_kernel_port = __esm({
           }
         }));
         if (response.outcome.case === "failure") {
-          throw new Error(`${response.outcome.value.code}: ${response.outcome.value.message}`);
+          throwUnnamedHistoryRequirement(response.outcome.value, mount.workspace);
+          throwKernelFailure(response.outcome.value);
         }
         if (response.outcome.case !== "outbox") {
           throw new Error(
@@ -15779,11 +15781,11 @@ import { create as create20 } from "@bufbuild/protobuf";
 function resolveWorkspaceName(command) {
   switch (command.birth.case) {
     case "keyed": {
-      const { namespace, key: key2 } = command.birth.value;
-      if (namespace.length === 0 || key2.length === 0) {
+      const { namespace: namespace2, key: key2 } = command.birth.value;
+      if (namespace2.length === 0 || key2.length === 0) {
         throw new Error(`${WORKSPACE_NAME_REQUEST_INVALID}: a keyed birth name needs both its namespace and its key`);
       }
-      return create20(ResolvedWorkspaceNameSchema, { workspace: keyedBirthNameOf(namespace, key2) });
+      return create20(ResolvedWorkspaceNameSchema, { workspace: keyedBirthNameOf(namespace2, key2) });
     }
     case "receivingGroup": {
       const { principal } = command.birth.value;
@@ -15807,10 +15809,10 @@ var init_workspace_naming = __esm({
     init_records_desk_pb();
     init_sha256();
     WORKSPACE_NAME_SEP2 = "";
-    keyedBirthNameOf = (namespace, key2) => `${namespace}-${sha256Hex6(new TextEncoder().encode(namespace + WORKSPACE_NAME_SEP2 + key2)).slice(0, 40)}`;
+    keyedBirthNameOf = (namespace2, key2) => `${namespace2}-${sha256Hex6(new TextEncoder().encode(namespace2 + WORKSPACE_NAME_SEP2 + key2)).slice(0, 40)}`;
     RECEIVING_GROUP_NAME_PREFIX2 = "nomos-rg-";
     receivingGroupNameOf2 = (principal) => `${RECEIVING_GROUP_NAME_PREFIX2}${sha256Hex6(new TextEncoder().encode(principal)).slice(0, 40)}`;
-    isKeyedBirthOf = (namespace, workspace) => workspace.startsWith(`${namespace}-`);
+    isKeyedBirthOf = (namespace2, workspace) => workspace.startsWith(`${namespace2}-`);
     WORKSPACE_NAME_REQUEST_INVALID = "nomos.runtime.workspace_name_request_invalid";
   }
 });
@@ -17910,8 +17912,150 @@ var init_model_adoption_desk = __esm({
   }
 });
 
+// ../peer-office/src/runtime/peer_desk_store.ts
+var recordId, copy2, MemoryPeerDeskStore;
+var init_peer_desk_store = __esm({
+  "../peer-office/src/runtime/peer_desk_store.ts"() {
+    "use strict";
+    recordId = (namespace2, key2) => `${namespace2.length}:${namespace2}${key2}`;
+    copy2 = (record) => ({
+      ...record,
+      value: record.value.slice()
+    });
+    MemoryPeerDeskStore = class {
+      #records = /* @__PURE__ */ new Map();
+      list(namespace2) {
+        return [...this.#records.values()].filter((record) => record.namespace === namespace2).sort((left, right) => left.key.localeCompare(right.key)).map(copy2);
+      }
+      compareExchange(namespace2, key2, expectedRevision, value) {
+        const id = recordId(namespace2, key2);
+        const current = this.#records.get(id);
+        if (current?.revision !== expectedRevision) {
+          throw new Error(
+            `peer desk record '${namespace2}/${key2}' changed at revision ${current?.revision ?? "absent"}`
+          );
+        }
+        if (value === void 0) {
+          this.#records.delete(id);
+          return void 0;
+        }
+        const next = Object.freeze({
+          namespace: namespace2,
+          key: key2,
+          revision: (current?.revision ?? 0n) + 1n,
+          value: value.slice()
+        });
+        this.#records.set(id, next);
+        return copy2(next);
+      }
+    };
+  }
+});
+
+// ../peer-office/src/runtime/custody_receipts.ts
+import { fromBinary as fromBinary15, toBinary as toBinary12 } from "@bufbuild/protobuf";
+var namespace, encoder, decoder, MAX_BASES, MAX_RECEIPTS, CustodyReceipts;
+var init_custody_receipts = __esm({
+  "../peer-office/src/runtime/custody_receipts.ts"() {
+    "use strict";
+    init_correspondence_desk_pb();
+    init_peer_desk_store();
+    init_sha256();
+    namespace = "nomos.peer-desk.custody-receipts/v1";
+    encoder = new TextEncoder();
+    decoder = new TextDecoder();
+    MAX_BASES = 256;
+    MAX_RECEIPTS = 4096;
+    CustodyReceipts = class {
+      #store;
+      #records = /* @__PURE__ */ new Map();
+      #journals = /* @__PURE__ */ new Map();
+      #receipts = /* @__PURE__ */ new Map();
+      constructor(store = new MemoryPeerDeskStore()) {
+        this.#store = store;
+        for (const record of store.list(namespace)) {
+          this.#records.set(record.key, record);
+          try {
+            if (record.key.startsWith("receipt:")) {
+              const newline = record.value.indexOf(10);
+              if (newline < 0) continue;
+              const receipt = fromBinary15(CustodyIntentAdmissionSchema, record.value.subarray(newline + 1));
+              const header2 = JSON.parse(decoder.decode(record.value.subarray(0, newline)));
+              if (receipt.outcome.case === "admitted" && typeof header2.generation === "string" && typeof header2.head === "string") this.#receipts.set(record.key, { ...header2, receipt });
+              continue;
+            }
+            if (!record.key.startsWith("head:")) continue;
+            const value = JSON.parse(decoder.decode(record.value));
+            if (typeof value.head !== "string" || typeof value.generation !== "string" || !Array.isArray(value.bases) || !Array.isArray(value.keys) || value.bases.length > MAX_BASES || value.keys.length > MAX_RECEIPTS) continue;
+            if (!value.bases.every((base) => typeof base === "string") || !value.keys.every((key2) => typeof key2 === "string")) continue;
+            this.#journals.set(record.key.slice(5), value);
+          } catch {
+          }
+        }
+      }
+      covers(workspace, current, base) {
+        const value = this.#journals.get(workspace);
+        return value?.head === current && value.bases.includes(base);
+      }
+      receipt(workspace, current, change) {
+        const value = this.#journals.get(workspace);
+        if (value?.head !== current) return void 0;
+        const stored = this.#receipts.get(`receipt:${workspace}:${sha256Hex6(change)}`);
+        if (stored?.generation !== value.generation) return void 0;
+        if (stored.head !== value.head && !value.bases.includes(stored.head)) return void 0;
+        return fromBinary15(CustodyIntentAdmissionSchema, toBinary12(CustodyIntentAdmissionSchema, stored.receipt));
+      }
+      record(workspace, before, after, receipts) {
+        const old = this.#journals.get(workspace);
+        const journalKey = `head:${workspace}`;
+        const value = old?.head === before ? { ...old, head: after, bases: [...old.bases], keys: [...old.keys] } : { head: after, bases: [], keys: [], generation: String((this.#records.get(journalKey)?.revision ?? 0n) + 1n) };
+        if (before && before !== after) value.bases.push(before);
+        value.bases = [...new Set(value.bases)].slice(-MAX_BASES);
+        const keys = new Set(value.keys);
+        const discarded = new Set(old?.generation !== value.generation ? old?.keys : []);
+        for (const { change, receipt } of receipts) {
+          if (receipt.outcome.case !== "admitted") continue;
+          const key2 = `receipt:${workspace}:${sha256Hex6(change)}`;
+          keys.delete(key2);
+          keys.add(key2);
+          discarded.delete(key2);
+          const header2 = encoder.encode(`${JSON.stringify({ generation: value.generation, head: after })}
+`);
+          const body = toBinary12(CustodyIntentAdmissionSchema, receipt);
+          const bytes = new Uint8Array(header2.length + body.length);
+          bytes.set(header2);
+          bytes.set(body, header2.length);
+          const record2 = this.#store.compareExchange(namespace, key2, this.#records.get(key2)?.revision, bytes);
+          if (record2) this.#records.set(key2, record2);
+          this.#receipts.set(key2, {
+            generation: value.generation,
+            head: after,
+            receipt: fromBinary15(CustodyIntentAdmissionSchema, body)
+          });
+        }
+        const ordered = [...keys];
+        for (const key2 of ordered.slice(0, -MAX_RECEIPTS)) discarded.add(key2);
+        value.keys = ordered.slice(-MAX_RECEIPTS);
+        for (const key2 of discarded) {
+          this.#store.compareExchange(namespace, key2, this.#records.get(key2)?.revision, void 0);
+          this.#records.delete(key2);
+          this.#receipts.delete(key2);
+        }
+        const record = this.#store.compareExchange(
+          namespace,
+          journalKey,
+          this.#records.get(journalKey)?.revision,
+          encoder.encode(JSON.stringify(value))
+        );
+        if (record) this.#records.set(journalKey, record);
+        this.#journals.set(workspace, value);
+      }
+    };
+  }
+});
+
 // ../peer-office/src/runtime/custodian_placement.ts
-import { create as create26, fromBinary as fromBinary15, toBinary as toBinary12 } from "@bufbuild/protobuf";
+import { create as create26, fromBinary as fromBinary16, toBinary as toBinary13 } from "@bufbuild/protobuf";
 var CustodianPlacement;
 var init_custodian_placement = __esm({
   "../peer-office/src/runtime/custodian_placement.ts"() {
@@ -17925,7 +18069,7 @@ var init_custodian_placement = __esm({
       #clock;
       #template;
       constructor(kernel, clock, templateProtobuf) {
-        const template = fromBinary15(CustodyPlacementPolicySchema, templateProtobuf);
+        const template = fromBinary16(CustodyPlacementPolicySchema, templateProtobuf);
         if (!template.declaration || !template.adoptedBy || template.rules.length === 0 || template.remotes.length === 0) {
           throw new Error("custodian placement template requires a declaration, adoptedBy, rules and remotes");
         }
@@ -17957,7 +18101,7 @@ var init_custodian_placement = __esm({
         });
         return create26(CustodyPlacementPolicySchema, {
           ...content,
-          packageSha256: sha256Hex6(toBinary12(CustodyPlacementPolicySchema, content))
+          packageSha256: sha256Hex6(toBinary13(CustodyPlacementPolicySchema, content))
         });
       }
       /** Adopt this custodian's placement for an opened, born workspace that has none. True when it adopted. */
@@ -18022,6 +18166,7 @@ var init_custody_admission_desk = __esm({
     init_correspondence_desk_pb();
     init_session_directory();
     init_custody_return_delta();
+    init_custody_receipts();
     CandidateCustodyRequiredError = class extends Error {
       workspace;
       reference;
@@ -18035,14 +18180,16 @@ var init_custody_admission_desk = __esm({
     CustodyAdmissionDesk = class {
       #kernel;
       #custody;
-      constructor(kernel, custody) {
+      #receipts;
+      constructor(kernel, custody, receipts = new CustodyReceipts()) {
         this.#kernel = kernel;
         this.#custody = custody;
+        this.#receipts = receipts;
       }
       admit(request, command) {
-        const session = request.target?.session;
-        if (!session) throw new Error("custody admission requires an addressed runtime session");
-        const mount = this.#custody.mountForSession(session);
+        const workspace = request.target?.workspace;
+        if (!workspace) throw new Error("custody admission requires an addressed workspace");
+        const mount = this.#custody.mountForWorkspace(workspace);
         if (command.evidencePack.byteLength > 0) {
           this.#kernel.applyPack(mount, request.requestId, command.evidencePack);
         }
@@ -18053,21 +18200,42 @@ var init_custody_admission_desk = __esm({
         const births = [];
         const admittedBase = this.#kernel.head(mount, request.requestId) ?? "";
         if (command.fastForwardOnly && offers.length > 0 && (command.baseHead ?? "") !== admittedBase) {
+          for (const offer of offers) {
+            const receipt = this.#receipts.receipt(mount.workspace, admittedBase, offer.changeUsda);
+            if (!receipt) continue;
+            receipt.commitOid = offer.commitOid;
+            const records = sessions.get(offer.session) ?? [];
+            records.push(receipt);
+            sessions.set(offer.session, records);
+          }
+          let delta = custodyReturnDelta(
+            this.#kernel,
+            mount,
+            request.requestId,
+            command.baseHead,
+            admittedBase,
+            admittedBase,
+            command.observedHead
+          );
+          if (command.baseHead && command.observedHead !== admittedBase && this.#receipts.covers(mount.workspace, admittedBase, command.baseHead)) {
+            try {
+              delta = {
+                resultBase: command.baseHead,
+                resultPack: this.#kernel.packDelta(mount, request.requestId, admittedBase, command.baseHead),
+                recoveryRequired: false
+              };
+            } catch {
+            }
+          }
           return create27(CustodyAdmissionSchema, {
             main: admittedBase,
-            ...custodyReturnDelta(
-              this.#kernel,
-              mount,
-              request.requestId,
-              command.baseHead,
-              admittedBase,
-              admittedBase,
-              command.observedHead
-            )
+            sessions: [...sessions].map(([session, intents]) => create27(CustodySessionAdmissionSchema, { session, intents })),
+            ...delta
           });
         }
         let main2 = admittedBase;
         const heldSessions = /* @__PURE__ */ new Map();
+        const receipts = [];
         for (const offer of offers) {
           const heldBehind = heldSessions.get(offer.session);
           const verdict = heldBehind === void 0 ? this.#offer(request, mount, offer) : create27(OfferResponseSchema, { outcome: { case: "blockedOnDependency", value: {
@@ -18077,7 +18245,9 @@ var init_custody_admission_desk = __esm({
             heldSessions.set(offer.session, verdict.outcome.value.offerId || offer.commitOid);
           }
           const records = sessions.get(offer.session) ?? [];
-          records.push(this.#record(offer, verdict));
+          const receipt = this.#record(offer, verdict);
+          records.push(receipt);
+          receipts.push({ change: offer.changeUsda, receipt });
           sessions.set(offer.session, records);
           if (verdict.outcome.case === "admitted") {
             main2 = verdict.outcome.value.head;
@@ -18093,6 +18263,9 @@ var init_custody_admission_desk = __esm({
             }
           }
         }
+        if (receipts.some((entry) => entry.receipt.outcome.case === "admitted")) {
+          this.#receipts.record(mount.workspace, admittedBase, main2, receipts);
+        }
         return create27(CustodyAdmissionSchema, {
           main: main2,
           sessions: [...sessions].map(
@@ -19111,7 +19284,7 @@ var init_application_readiness_desk = __esm({
 });
 
 // ../peer-office/src/runtime/authentication_readiness_desk.ts
-import { create as create35, fromBinary as fromBinary16, toBinary as toBinary13 } from "@bufbuild/protobuf";
+import { create as create35, fromBinary as fromBinary17, toBinary as toBinary14 } from "@bufbuild/protobuf";
 var AuthenticationReadinessDesk;
 var init_authentication_readiness_desk = __esm({
   "../peer-office/src/runtime/authentication_readiness_desk.ts"() {
@@ -19134,7 +19307,7 @@ var init_authentication_readiness_desk = __esm({
       begin(request, input) {
         if (![AuthenticationReadinessCriterion.ENROLLED_DEVICE, AuthenticationReadinessCriterion.PROVIDER_TOKEN, AuthenticationReadinessCriterion.BIRTH_EVIDENCE].includes(input.criterion)) throw new Error("authentication readiness requires a criterion");
         if (!input.session) throw new Error("authentication readiness requires a session");
-        const command = fromBinary16(AwaitAuthenticationRequestSchema, toBinary13(AwaitAuthenticationRequestSchema, input));
+        const command = fromBinary17(AwaitAuthenticationRequestSchema, toBinary14(AwaitAuthenticationRequestSchema, input));
         const now = this.#now();
         for (const [id2, work2] of this.#waiting) if (work2.expiresAt <= now) this.#waiting.delete(id2);
         const work = {
@@ -19924,7 +20097,7 @@ var init_residency_pins = __esm({
 });
 
 // ../peer-office/src/runtime/subscription_manager.ts
-import { clone, create as create40, toBinary as toBinary14 } from "@bufbuild/protobuf";
+import { clone, create as create40, toBinary as toBinary15 } from "@bufbuild/protobuf";
 function createSyntheticRequest(requestId) {
   return create40(RuntimeRequestSchema, {
     protocolVersion: 2,
@@ -20068,7 +20241,7 @@ var init_subscription_manager = __esm({
         const groups = [];
         for (const subscription of this.#subscriptions.values()) {
           if (!matches(subscription) || !subscription.request.query) continue;
-          const declaration = toBinary14(QueryRequestSchema, subscription.request.query);
+          const declaration = toBinary15(QueryRequestSchema, subscription.request.query);
           const session = subscription.request.session;
           const group = groups.find((group2) => group2.session === session && sameBytes(group2.declaration, declaration));
           if (group) group.watches.push(subscription);
@@ -21218,14 +21391,14 @@ var init_local_copy_drop = __esm({
 
 // ../peer-office/src/runtime/preserved_copies_desk.ts
 import { create as create42, fromJsonString, toJsonString } from "@bufbuild/protobuf";
-var PRESERVED_COPIES_NAMESPACE, encoder, decoder, PreservedCopiesDesk;
+var PRESERVED_COPIES_NAMESPACE, encoder2, decoder2, PreservedCopiesDesk;
 var init_preserved_copies_desk = __esm({
   "../peer-office/src/runtime/preserved_copies_desk.ts"() {
     "use strict";
     init_custody_desk_pb();
     PRESERVED_COPIES_NAMESPACE = "nomos.peer-desk.preserved-local-copies/v1";
-    encoder = new TextEncoder();
-    decoder = new TextDecoder();
+    encoder2 = new TextEncoder();
+    decoder2 = new TextDecoder();
     PreservedCopiesDesk = class {
       #store;
       constructor(store) {
@@ -21234,7 +21407,7 @@ var init_preserved_copies_desk = __esm({
       list(workspace) {
         const record = this.#store.list(PRESERVED_COPIES_NAMESPACE).find((entry) => entry.key === workspace);
         if (!record) return [];
-        const values = JSON.parse(decoder.decode(record.value));
+        const values = JSON.parse(decoder2.decode(record.value));
         if (!Array.isArray(values)) {
           throw new Error(`corrupt preserved-copy record for '${workspace}' at revision ${record.revision}`);
         }
@@ -21248,7 +21421,7 @@ var init_preserved_copies_desk = __esm({
           PRESERVED_COPIES_NAMESPACE,
           copy3.workspace,
           current?.revision,
-          encoder.encode(`[${next.map((entry) => toJsonString(PreservedLocalCopySchema, entry)).join(",")}]`)
+          encoder2.encode(`[${next.map((entry) => toJsonString(PreservedLocalCopySchema, entry)).join(",")}]`)
         );
         if (!stored) throw new Error(`preserved copy of '${copy3.workspace}' was not recorded`);
       }
@@ -21257,7 +21430,7 @@ var init_preserved_copies_desk = __esm({
 });
 
 // ../peer-office/src/runtime/office_seat.ts
-import { fromBinary as fromBinary17 } from "@bufbuild/protobuf";
+import { fromBinary as fromBinary18 } from "@bufbuild/protobuf";
 function officeSeat(profile) {
   const origins = /* @__PURE__ */ new Set();
   const add = (url) => {
@@ -21267,7 +21440,7 @@ function officeSeat(profile) {
   add(profile.liveRelayOrigin);
   if (profile.custodianPlacement !== void 0 && profile.custodianPlacement.byteLength > 0) {
     try {
-      for (const remote of fromBinary17(CustodyPlacementPolicySchema, profile.custodianPlacement).remotes) {
+      for (const remote of fromBinary18(CustodyPlacementPolicySchema, profile.custodianPlacement).remotes) {
         add(remote.url);
       }
     } catch {
@@ -21297,7 +21470,7 @@ import { create as create43 } from "@bufbuild/protobuf";
 function readSeal(value) {
   const headerLength = SEAT_PREFIX.length + SEAT_DIGEST_HEX + 1;
   if (value.byteLength < headerLength) return void 0;
-  const text2 = decoder2.decode(value.subarray(0, headerLength));
+  const text2 = decoder3.decode(value.subarray(0, headerLength));
   if (!text2.startsWith(SEAT_PREFIX) || !text2.endsWith("\n")) return void 0;
   const seat = text2.slice(SEAT_PREFIX.length, headerLength - 1);
   if (!/^[0-9a-f]{64}$/.test(seat)) return void 0;
@@ -21310,7 +21483,7 @@ function seal(digest, value) {
   sealed.set(value, prefix.byteLength);
   return sealed;
 }
-var QUARANTINED_BINDINGS_NAMESPACE, LOCAL_ONLY_NAMESPACES, SEAT_PREFIX, SEAT_DIGEST_HEX, encoder2, decoder2, header, QuarantineReason, SeatedPeerDeskStore;
+var QUARANTINED_BINDINGS_NAMESPACE, LOCAL_ONLY_NAMESPACES, SEAT_PREFIX, SEAT_DIGEST_HEX, encoder3, decoder3, header, QuarantineReason, SeatedPeerDeskStore;
 var init_seated_peer_desk_store = __esm({
   "../peer-office/src/runtime/seated_peer_desk_store.ts"() {
     "use strict";
@@ -21323,9 +21496,9 @@ var init_seated_peer_desk_store = __esm({
     ]);
     SEAT_PREFIX = "nomos-office-seat/v1:";
     SEAT_DIGEST_HEX = 64;
-    encoder2 = new TextEncoder();
-    decoder2 = new TextDecoder();
-    header = (digest) => encoder2.encode(`${SEAT_PREFIX}${digest}
+    encoder3 = new TextEncoder();
+    decoder3 = new TextDecoder();
+    header = (digest) => encoder3.encode(`${SEAT_PREFIX}${digest}
 `);
     QuarantineReason = Object.freeze({
       /** Another office's seat: a copied state directory, or a store lifted from another peer. */
@@ -21344,44 +21517,44 @@ var init_seated_peer_desk_store = __esm({
         this.#seat = seat;
         this.#report = report;
       }
-      list(namespace) {
-        if (LOCAL_ONLY_NAMESPACES.has(namespace)) return this.#inner.list(namespace);
+      list(namespace2) {
+        if (LOCAL_ONLY_NAMESPACES.has(namespace2)) return this.#inner.list(namespace2);
         const kept = [];
-        for (const record of this.#inner.list(namespace)) {
+        for (const record of this.#inner.list(namespace2)) {
           const sealed = readSeal(record.value);
           if (sealed?.seat === this.#seat.digest) {
             kept.push({ ...record, value: sealed.value.slice() });
             continue;
           }
-          this.#quarantine(namespace, record, sealed?.seat);
+          this.#quarantine(namespace2, record, sealed?.seat);
         }
         return kept;
       }
-      compareExchange(namespace, key2, expectedRevision, value) {
-        if (LOCAL_ONLY_NAMESPACES.has(namespace)) {
-          return this.#inner.compareExchange(namespace, key2, expectedRevision, value);
+      compareExchange(namespace2, key2, expectedRevision, value) {
+        if (LOCAL_ONLY_NAMESPACES.has(namespace2)) {
+          return this.#inner.compareExchange(namespace2, key2, expectedRevision, value);
         }
         const stored = this.#inner.compareExchange(
-          namespace,
+          namespace2,
           key2,
           expectedRevision,
           value === void 0 ? void 0 : seal(this.#seat.digest, value)
         );
         if (stored === void 0) return void 0;
         const sealed = readSeal(stored.value);
-        if (!sealed) throw new Error(`peer desk record '${namespace}/${key2}' lost its office seat`);
+        if (!sealed) throw new Error(`peer desk record '${namespace2}/${key2}' lost its office seat`);
         return { ...stored, value: sealed.value.slice() };
       }
       /** Preserve the foreign record under the quarantine namespace, then free the slot. */
-      #quarantine(namespace, record, recordedSeat) {
-        const key2 = `${namespace}\0${record.key}\0${record.revision}`;
+      #quarantine(namespace2, record, recordedSeat) {
+        const key2 = `${namespace2}\0${record.key}\0${record.revision}`;
         try {
           this.#inner.compareExchange(QUARANTINED_BINDINGS_NAMESPACE, key2, void 0, record.value);
         } catch {
         }
-        this.#inner.compareExchange(namespace, record.key, record.revision, void 0);
+        this.#inner.compareExchange(namespace2, record.key, record.revision, void 0);
         this.#report(create43(QuarantinedBindingSchema, {
-          namespace,
+          namespace: namespace2,
           key: record.key,
           reason: recordedSeat === void 0 ? QuarantineReason.Unseated : QuarantineReason.ForeignSeat,
           recordedSeat: recordedSeat ?? "",
@@ -21440,6 +21613,7 @@ var init_replica_inventory_desk = __esm({
         const undiscovered = /* @__PURE__ */ new Set();
         for (const restored of this.#follows.recover()) {
           following.set(restored.workspace, restored.delayMillis);
+          followed.add(restored.workspace);
         }
         if (!this.#bootstrapped) {
           this.#bootstrapped = true;
@@ -21477,6 +21651,7 @@ var init_replica_inventory_desk = __esm({
               stopped.delete(workspace);
             } else if (reconciliation.changed) {
               following.delete(workspace);
+              followed.delete(workspace);
               stopped.add(workspace);
             }
           } catch (error) {
@@ -21620,7 +21795,7 @@ var init_correspondence_work_registry = __esm({
 });
 
 // ../peer-office/src/runtime/placement_discovery_desk.ts
-import { create as create44, toBinary as toBinary15 } from "@bufbuild/protobuf";
+import { create as create44, toBinary as toBinary16 } from "@bufbuild/protobuf";
 var DiscoveryPhase, PlacementDiscoveryDesk;
 var init_placement_discovery_desk = __esm({
   "../peer-office/src/runtime/placement_discovery_desk.ts"() {
@@ -21681,7 +21856,7 @@ var init_placement_discovery_desk = __esm({
         return {
           workspace: next.workspace,
           nextAfterMillis: 0,
-          frame: toBinary15(RuntimeRequestSchema, create44(RuntimeRequestSchema, {
+          frame: toBinary16(RuntimeRequestSchema, create44(RuntimeRequestSchema, {
             protocolVersion: 2,
             requestId,
             command: { case: "workspacePlacement", value: {
@@ -21768,7 +21943,7 @@ var init_placement_discovery_desk = __esm({
 });
 
 // ../peer-office/src/runtime/live_correspondence_desk.ts
-import { create as create45, fromBinary as fromBinary18, toBinary as toBinary16 } from "@bufbuild/protobuf";
+import { create as create45, fromBinary as fromBinary19, toBinary as toBinary17 } from "@bufbuild/protobuf";
 function presencePeerToken(replicaId2) {
   return sha256Hex6(new TextEncoder().encode(`nomos-presence-peer:${replicaId2}`)).slice(0, PRESENCE_PEER_TOKEN_HEX);
 }
@@ -21832,7 +22007,7 @@ var init_live_correspondence_desk = __esm({
           wasResident: this.kernel.isResident(binding.workspace) !== false
         };
         this.#links.set(binding.workspace, link);
-        if (link.wasResident) this.#open(link);
+        if (!link.publisher || link.wasResident) this.#open(link);
       }
       changed(workspace) {
         const link = this.#links.get(workspace);
@@ -21854,11 +22029,14 @@ var init_live_correspondence_desk = __esm({
         this.#effect(link, { case: "openUrl", value: `${endpoint}/v2/workspaces/${encodeURIComponent(link.binding.workspace)}/subscribe?${subscribeQuery(link)}` });
       }
       #send(link, message) {
-        const bytes = toBinary16(LiveOfferFrameSchema, create45(LiveOfferFrameSchema, { message }));
+        const bytes = toBinary17(LiveOfferFrameSchema, create45(LiveOfferFrameSchema, { message }));
         if (bytes.byteLength > MAX_LIVE_FRAME_BYTES) return;
         this.#effect(link, { case: "send", value: bytes });
       }
       export(binding, base, requestId) {
+        if (this.kernel.isResident(binding.workspace) === false) {
+          return create45(CustodyOfferBatchRequestSchema, { protocolVersion: 2 });
+        }
         const mount = workspaceMount(binding.workspace);
         const head = this.kernel.head(mount, requestId);
         if (!base || !head || base === head) return create45(CustodyOfferBatchRequestSchema, { protocolVersion: 2 });
@@ -21904,7 +22082,7 @@ var init_live_correspondence_desk = __esm({
         if (!bytes.byteLength || bytes.byteLength > MAX_LIVE_FRAME_BYTES) return;
         let frame;
         try {
-          frame = fromBinary18(LiveOfferFrameSchema, bytes);
+          frame = fromBinary19(LiveOfferFrameSchema, bytes);
         } catch {
           let ring;
           try {
@@ -21919,6 +22097,7 @@ var init_live_correspondence_desk = __esm({
         }
         if (frame.message.case === "frontier") {
           this.#announced(link, frame.message.value.head);
+          if (this.kernel.isResident(link.binding.workspace) === false) return;
           if (!frame.message.value.response) {
             this.#send(link, { case: "frontier", value: {
               head: this.kernel.head(workspaceMount(link.binding.workspace), ++this.#requestId) ?? "",
@@ -21935,6 +22114,10 @@ var init_live_correspondence_desk = __esm({
         if (frame.message.case !== "offers") return;
         const batch = frame.message.value;
         if (batch.protocolVersion !== 2 || !batch.requestId || batch.source.case !== "inline" || !batch.source.value.offers.length) return;
+        if (this.kernel.isResident(link.binding.workspace) === false) {
+          this.remoteAdvanced?.(link.binding.workspace);
+          return;
+        }
         if ([...this.#pending.values()].some((pending) => pending.link === link && pending.bytes.length === bytes.length && pending.bytes.every((byte, index) => byte === bytes[index]))) return;
         if (this.#pending.size >= 32) return;
         this.#pending.set(request.requestId, { link, bytes });
@@ -21942,7 +22125,16 @@ var init_live_correspondence_desk = __esm({
           protocolVersion: 2,
           requestId: request.requestId,
           target: { workspace: link.binding.workspace, session: link.binding.replicaId },
-          command: { case: "admitCustodyOffers", value: create45(CustodyOfferBatchRequestSchema, { ...batch, baseHead: void 0 }) }
+          // HTTP sender reconciliation controls are not part of a live proposal.
+          // Keeping fastForwardOnly while removing baseHead silently skips every
+          // offer against a nonempty local head. The Kernel judges sealed causality;
+          // live receivers neither ask for a return archive nor confirm the sender.
+          command: { case: "admitCustodyOffers", value: create45(CustodyOfferBatchRequestSchema, {
+            ...batch,
+            baseHead: void 0,
+            observedHead: void 0,
+            fastForwardOnly: false
+          }) }
         });
       }
       /** Upstream news is a frontier this replica has NEVER seen: neither its own head nor the
@@ -21951,6 +22143,10 @@ var init_live_correspondence_desk = __esm({
       #announced(link, head) {
         if (!head || link.lastAnnounced === head) return;
         link.lastAnnounced = head;
+        if (this.kernel.isResident(link.binding.workspace) === false) {
+          this.remoteAdvanced?.(link.binding.workspace);
+          return;
+        }
         const mount = workspaceMount(link.binding.workspace);
         if (head === this.kernel.head(mount, ++this.#requestId) || head === this.kernel.resolveRef(mount, ++this.#requestId, "refs/remotes/nomos/main")) return;
         this.remoteAdvanced?.(link.binding.workspace);
@@ -21960,6 +22156,10 @@ var init_live_correspondence_desk = __esm({
       #placementAnnounced(link, frontier) {
         if (!frontier || link.lastPlacementAnnounced === frontier) return;
         link.lastPlacementAnnounced = frontier;
+        if (this.kernel.isResident(link.binding.workspace) === false) {
+          this.placementAdvanced?.(link.binding.workspace);
+          return;
+        }
         const mount = workspaceMount(link.binding.workspace);
         if (frontier === this.kernel.resolveRef(mount, ++this.#requestId, PLACEMENT_REF2)) return;
         this.placementAdvanced?.(link.binding.workspace);
@@ -21976,11 +22176,13 @@ var init_live_correspondence_desk = __esm({
       disconnect(workspace) {
         const link = this.#links.get(workspace);
         if (!link) return;
+        if (link.state === "open") this.linkClosed?.(workspace);
         this.#effect(link, { case: "close", value: true });
         this.#links.delete(workspace);
         for (const [id, pending] of this.#pending) if (pending.link === link) this.#pending.delete(id);
       }
       #hello(link) {
+        if (this.kernel.isResident(link.binding.workspace) === false) return;
         const head = this.kernel.head(workspaceMount(link.binding.workspace), ++this.#requestId);
         this.#send(link, { case: "frontier", value: { head: head ?? "" } });
       }
@@ -21988,19 +22190,20 @@ var init_live_correspondence_desk = __esm({
         const now = this.clock.monotonicNanoseconds();
         let wake;
         for (const link of this.#links.values()) {
-          if (this.kernel.isResident(link.binding.workspace) === false) {
+          const resident = this.kernel.isResident(link.binding.workspace) !== false;
+          if (link.publisher && !resident) {
             if (link.wasResident) this.disconnect(link.binding.workspace);
             else wake = wake === void 0 || wake > 250n ? 250n : wake;
             continue;
           }
-          link.wasResident = true;
+          if (resident) link.wasResident = true;
           if (link.state === "opening" && now >= link.due) {
             this.#effect(link, { case: "close", value: true });
             link.state = "closed";
           }
           if (link.state === "closed" && now >= link.due) this.#open(link);
           if (link.state === "open") {
-            if (link.dirty) {
+            if (link.dirty && resident) {
               link.dirty = false;
               try {
                 link.published ??= link.publisher ? this.kernel.head(workspaceMount(link.binding.workspace), ++this.#requestId) : this.kernel.resolveRef(workspaceMount(link.binding.workspace), ++this.#requestId, "refs/remotes/nomos/main");
@@ -22019,8 +22222,7 @@ var init_live_correspondence_desk = __esm({
         return wake;
       }
       close() {
-        for (const link of this.#links.values()) this.#effect(link, { case: "close", value: true });
-        this.#links.clear();
+        for (const workspace of [...this.#links.keys()]) this.disconnect(workspace);
         this.#pending.clear();
       }
     };
@@ -22192,9 +22394,9 @@ var init_records_desk = __esm({
           command.namespace === void 0 ? {} : { "custody.children_namespace": command.namespace },
           () => this.#kernel.childWorkspaces(mount, request.requestId)
         );
-        const namespace = command.namespace;
-        const selected = namespace === void 0 ? result.children : result.children.filter(
-          (child) => child.status === ChildWorkspaceLifecycleStatus.ACTIVE && isKeyedBirthOf(namespace, child.workspace)
+        const namespace2 = command.namespace;
+        const selected = namespace2 === void 0 ? result.children : result.children.filter(
+          (child) => child.status === ChildWorkspaceLifecycleStatus.ACTIVE && isKeyedBirthOf(namespace2, child.workspace)
         );
         return create47(ChildWorkspaceListSchema, {
           children: selected.map((child) => create47(ChildWorkspaceSchema, {
@@ -22564,46 +22766,6 @@ var init_recovery_desk = __esm({
   }
 });
 
-// ../peer-office/src/runtime/peer_desk_store.ts
-var recordId, copy2, MemoryPeerDeskStore;
-var init_peer_desk_store = __esm({
-  "../peer-office/src/runtime/peer_desk_store.ts"() {
-    "use strict";
-    recordId = (namespace, key2) => `${namespace.length}:${namespace}${key2}`;
-    copy2 = (record) => ({
-      ...record,
-      value: record.value.slice()
-    });
-    MemoryPeerDeskStore = class {
-      #records = /* @__PURE__ */ new Map();
-      list(namespace) {
-        return [...this.#records.values()].filter((record) => record.namespace === namespace).sort((left, right) => left.key.localeCompare(right.key)).map(copy2);
-      }
-      compareExchange(namespace, key2, expectedRevision, value) {
-        const id = recordId(namespace, key2);
-        const current = this.#records.get(id);
-        if (current?.revision !== expectedRevision) {
-          throw new Error(
-            `peer desk record '${namespace}/${key2}' changed at revision ${current?.revision ?? "absent"}`
-          );
-        }
-        if (value === void 0) {
-          this.#records.delete(id);
-          return void 0;
-        }
-        const next = Object.freeze({
-          namespace,
-          key: key2,
-          revision: (current?.revision ?? 0n) + 1n,
-          value: value.slice()
-        });
-        this.#records.set(id, next);
-        return copy2(next);
-      }
-    };
-  }
-});
-
 // ../peer-office/src/runtime/correspondence_recovery.ts
 import { create as create51 } from "@bufbuild/protobuf";
 var CorrespondenceRecoveryWork;
@@ -22789,7 +22951,7 @@ var init_custody_replacement = __esm({
 });
 
 // ../peer-office/src/runtime/custody_offer.ts
-import { create as create54, fromBinary as fromBinary19, toBinary as toBinary17 } from "@bufbuild/protobuf";
+import { create as create54, fromBinary as fromBinary20, toBinary as toBinary18 } from "@bufbuild/protobuf";
 function settleCustodyOfferExchange(awaiting, response) {
   if (response.status === 202 && response.contentType?.includes("application/json")) {
     try {
@@ -22819,7 +22981,7 @@ function settleCustodyOfferExchange(awaiting, response) {
   }
 }
 function encodeInlineCustodyOffer(args) {
-  return toBinary17(CustodyOfferBatchRequestSchema, create54(CustodyOfferBatchRequestSchema, {
+  return toBinary18(CustodyOfferBatchRequestSchema, create54(CustodyOfferBatchRequestSchema, {
     protocolVersion: 2,
     requestId: args.requestId,
     source: {
@@ -22839,7 +23001,7 @@ function encodeInlineCustodyOffer(args) {
   }));
 }
 function decodeCustodyOffer(bytes, requestId) {
-  const response = fromBinary19(CustodyOfferBatchResponseSchema, bytes);
+  const response = fromBinary20(CustodyOfferBatchResponseSchema, bytes);
   if (response.protocolVersion !== 2 || response.requestId !== requestId) {
     throw new Error("custody offer returned a mismatched generated response");
   }
@@ -22951,7 +23113,7 @@ var init_custody_offer = __esm({
 });
 
 // ../peer-office/src/runtime/workspace_sync.ts
-import { create as create55, fromBinary as fromBinary20 } from "@bufbuild/protobuf";
+import { create as create55, fromBinary as fromBinary21 } from "@bufbuild/protobuf";
 function releaseSyncJudgment(workspace) {
   judgedThisLifetime.delete(workspace);
 }
@@ -23030,6 +23192,7 @@ var init_workspace_sync = __esm({
       #offerSequence = 0;
       #lastStep;
       #probeOnly;
+      #liveConnected;
       /** Set when this round adopted the upstream's own head as its base (see #establishBase). */
       #establishedBase;
       #receiveState;
@@ -23062,6 +23225,7 @@ var init_workspace_sync = __esm({
         this.#directoryAnswered = args.directoryAnswered;
         this.#placementFetched = args.placementFetched;
         this.#probeOnly = args.probeOnly ?? false;
+        this.#liveConnected = args.liveConnected === true;
         this.#receiveState = args.receiveState;
         this.#completeHistory = args.completeHistory === true;
         this.#repairMissingCommit = args.repairMissingCommit === true;
@@ -23132,6 +23296,9 @@ var init_workspace_sync = __esm({
       #openRound() {
         if (this.#receiveState || this.#replaceLocalHead !== void 0) return this.#leaseEffect();
         if (!this.#localHead) return this.#leaseEffect();
+        if (this.#liveConnected && !this.#probeOnly && this.#holdsLocalWork() && this.#previousHead) {
+          return this.#offerOrReconcile();
+        }
         const requestId = `${this.#binding.replicaId}:${this.#requestId}:${this.workId}:frontier`;
         return this.#beginOffer(encodeInlineCustodyOffer({
           session: this.#binding.replicaId,
@@ -23363,6 +23530,18 @@ var init_workspace_sync = __esm({
           return this.#finishOfferOutcome(false);
         }
         const admission = outcome.value;
+        globalThis.__nomosSyncDiagnostic?.("sync.admission", {
+          workspace: this.#mount.workspace,
+          phase: state.phase,
+          local: this.#localHead,
+          tracked: this.#previousHead,
+          remote: admission.main,
+          sealed: admission.sealedMain,
+          resultBase: admission.resultBase,
+          resultBytes: admission.resultPack.byteLength,
+          recoveryRequired: admission.recoveryRequired,
+          summary: summarizeCustodyAdmission(admission)
+        });
         this.#desiredHead = admission.main || void 0;
         if (!this.#desiredHead) return this.#transportFailure("resident peer returned no admitted frontier", false);
         this.#candidateDurable = admission.sealedMain === this.#desiredHead;
@@ -23637,7 +23816,7 @@ var init_workspace_sync = __esm({
       #acceptLawProducts(response) {
         if (response.status !== 200 || response.contentType?.split(";")[0]?.trim() !== LAW_PRODUCTS_MEDIA_TYPE) return;
         try {
-          const exported = fromBinary20(ExportLawProductsResponseSchema, response.body);
+          const exported = fromBinary21(ExportLawProductsResponseSchema, response.body);
           this.#fetchedLawProducts = { head: exported.head, products: exported.products };
         } catch {
         }
@@ -23979,6 +24158,19 @@ var init_workspace_sync = __esm({
         return step;
       }
       #finish(value) {
+        globalThis.__nomosSyncDiagnostic?.("sync.finished", {
+          workspace: value.workspace,
+          previous: value.previousHead,
+          current: value.currentHead,
+          stillAhead: value.stillAhead,
+          deferred: String(value.deferred),
+          admitted: String(value.admitted),
+          reconnect: value.reconnectRequired,
+          directOfferDeferred: value.directOfferDeferred,
+          pushFailed: value.pushFailed,
+          failure: value.pushError?.message,
+          wallMs: elapsedMillis(this.#clock, this.#started)
+        });
         this.#state = { phase: WorkspaceSyncPhase.Done };
         this.#current = void 0;
         return this.#remember({ case: "synced", value });
@@ -24043,6 +24235,10 @@ var init_workspace_sync_dependencies = __esm({
           this.#plan = [this.#args.root];
           return this.#advance();
         }
+        if (this.#args.liveConnected && this.#args.kernel.resolveRef(this.#args.root.mount, this.#args.requestId, trackedMain2)) {
+          this.#plan = this.#planDependencies();
+          return this.#advance();
+        }
         this.#current = this.#work(this.#args.root, `${this.workId}:frontier`, true);
         return this.#accept(this.#current.start());
       }
@@ -24362,7 +24558,7 @@ var init_offer_transport_contract = __esm({
 });
 
 // ../peer-office/src/runtime/workspace_effect_delivery.ts
-import { create as create57, fromBinary as fromBinary21, toBinary as toBinary18 } from "@bufbuild/protobuf";
+import { create as create57, fromBinary as fromBinary22, toBinary as toBinary19 } from "@bufbuild/protobuf";
 function answered(response) {
   const text2 = (response.contentType ?? "").startsWith("text/") || (response.contentType ?? "").includes("json") ? new TextDecoder().decode(response.body.subarray(0, RETRY_DETAIL_CHARACTERS)).trim() : "";
   return `HTTP ${response.status} ${response.contentType || "without a media type"}${text2 ? `: ${text2}` : ""}`;
@@ -24753,7 +24949,7 @@ var init_workspace_effect_delivery = __esm({
           }
           let status2;
           try {
-            status2 = fromBinary21(WorkspaceEffectStatusResponseSchema, observation.body);
+            status2 = fromBinary22(WorkspaceEffectStatusResponseSchema, observation.body);
           } catch {
             return this.#transportFailed("mailbox returned an invalid effect observation");
           }
@@ -24768,7 +24964,7 @@ var init_workspace_effect_delivery = __esm({
           return this.#advance(this.#delivery.next(response2, this.#settlement));
         }
         if (receipt.outcome.value.status === 202 && (receipt.outcome.value.contentType ?? "").includes(WORKSPACE_EFFECT_DEFERRED)) {
-          const deferred = fromBinary21(WorkspaceEffectDeferredSchema, receipt.outcome.value.body);
+          const deferred = fromBinary22(WorkspaceEffectDeferredSchema, receipt.outcome.value.body);
           this.#deferredRetryAfterMillis = Math.max(
             this.#deferredRetryAfterMillis ?? 0,
             Number(deferred.retryAfterMillis)
@@ -24793,7 +24989,7 @@ var init_workspace_effect_delivery = __esm({
         }
         let applied;
         try {
-          applied = fromBinary21(OfferResponseSchema, receipt.outcome.value.body);
+          applied = fromBinary22(OfferResponseSchema, receipt.outcome.value.body);
         } catch {
           return this.#transportFailed("remote workspace returned an invalid offer response");
         }
@@ -24915,7 +25111,7 @@ var init_workspace_effect_delivery = __esm({
               url: this.#mailboxUrl,
               contentType: WORKSPACE_EFFECT_STATUS,
               accept: WORKSPACE_EFFECT_STATUS_RESPONSE,
-              body: toBinary18(WorkspaceEffectStatusRequestSchema, create57(WorkspaceEffectStatusRequestSchema, {
+              body: toBinary19(WorkspaceEffectStatusRequestSchema, create57(WorkspaceEffectStatusRequestSchema, {
                 sourceWorkspaceGenesis: offer.sourceWorkspaceGenesis,
                 effectDigest: offer.effectDigest
               }))
@@ -24942,7 +25138,7 @@ var init_workspace_effect_delivery = __esm({
           url: this.#mailboxUrl,
           contentType: CARRIED_OFFER,
           accept: CARRIED_OFFER_RESPONSE,
-          body: toBinary18(OfferRequestSchema, body)
+          body: toBinary19(OfferRequestSchema, body)
         });
         this.#pending = create57(CorrespondencePendingSchema, {
           workId: this.workId,
@@ -24955,7 +25151,7 @@ var init_workspace_effect_delivery = __esm({
 });
 
 // ../peer-office/src/runtime/replica_follow_lane.ts
-import { create as create58, toBinary as toBinary19 } from "@bufbuild/protobuf";
+import { create as create58, toBinary as toBinary20 } from "@bufbuild/protobuf";
 var ReplicaFollowLane;
 var init_replica_follow_lane = __esm({
   "../peer-office/src/runtime/replica_follow_lane.ts"() {
@@ -25037,7 +25233,7 @@ var init_replica_follow_lane = __esm({
         if (action === ReplicaFollowAction.RefreshCredential) {
           return {
             workspace,
-            frame: toBinary19(RuntimeRequestSchema, create58(RuntimeRequestSchema, {
+            frame: toBinary20(RuntimeRequestSchema, create58(RuntimeRequestSchema, {
               protocolVersion: 2,
               requestId,
               command: {
@@ -25052,7 +25248,7 @@ var init_replica_follow_lane = __esm({
         const replaceLocalHead = this.#controller.replacementHead(workspace);
         return {
           workspace,
-          frame: toBinary19(RuntimeRequestSchema, create58(RuntimeRequestSchema, {
+          frame: toBinary20(RuntimeRequestSchema, create58(RuntimeRequestSchema, {
             protocolVersion: 2,
             requestId,
             command: {
@@ -25249,7 +25445,7 @@ var init_http_obligation_delivery = __esm({
 });
 
 // ../peer-office/src/runtime/correspondence_desk.ts
-import { create as create60, toBinary as toBinary20 } from "@bufbuild/protobuf";
+import { create as create60, toBinary as toBinary21 } from "@bufbuild/protobuf";
 var REFETCH_AWAITS_PROVIDER, LOCAL_COPY_REFETCHING, CorrespondenceDesk;
 var init_correspondence_desk = __esm({
   "../peer-office/src/runtime/correspondence_desk.ts"() {
@@ -25307,6 +25503,7 @@ var init_correspondence_desk = __esm({
       #onSyncCompleted;
       #onPlacementFetched;
       #onShallowMount;
+      #onOutboxHistoryRequired;
       #remoteOffers = new CorrespondenceWorkRegistry();
       #recoveries = new CorrespondenceWorkRegistry();
       #deliveries = new CorrespondenceWorkRegistry();
@@ -25353,6 +25550,7 @@ var init_correspondence_desk = __esm({
         this.#onSyncCompleted = args.onSyncCompleted;
         this.#onPlacementFetched = args.onPlacementFetched;
         this.#onShallowMount = args.onShallowMount;
+        this.#onOutboxHistoryRequired = args.onOutboxHistoryRequired;
         this.#clock = args.clock;
         this.#outboxClock = new OutboxObservationClock(args.clock, args.peerIdentity);
         this.#executesCustodianObligations = args.executesCustodianObligations ?? false;
@@ -25516,6 +25714,15 @@ var init_correspondence_desk = __esm({
         this.#followLane.dependencyAdvanced(workspace);
         this.reportFollows();
       }
+      /** Received custody can release correspondence and foreign-read dependencies,
+       * but is not newly authored work to send back to its upstream. Recovery is
+       * driven separately by missing history, reconnects and provider announcements.
+       * In particular an optimistic relay is not a durable upstream receipt. */
+      receivedFrontierChanged(workspace) {
+        this.wakeOutbox(workspace);
+        this.#followLane.dependencyAdvanced(workspace);
+        this.reportFollows();
+      }
       /**
        * Tell a workspace's sessions what its durable follow ALREADY knows.
        *
@@ -25752,8 +25959,16 @@ var init_correspondence_desk = __esm({
             )
           );
         } catch (error) {
+          if (error instanceof KernelHistoryRequired && this.#onOutboxHistoryRequired) {
+            const retry = this.#onOutboxHistoryRequired(workspace, binding.credentialCapability);
+            this.#outboxDueAt.set(workspace, now + Math.max(250, retry));
+            return { nextAfterMillis: 0 };
+          }
           const format = localCopyFormatRefusal(error);
-          if (format === void 0) throw error;
+          if (format === void 0) {
+            this.#outboxDueAt.set(workspace, now + 3e4);
+            return { nextAfterMillis: 0 };
+          }
           this.#readability.mark(workspace, void 0, format);
           this.#outboxDueAt.delete(workspace);
           return { nextAfterMillis: 0 };
@@ -25834,7 +26049,7 @@ var init_correspondence_desk = __esm({
         };
         return {
           workspace,
-          frame: toBinary20(RuntimeRequestSchema, create60(RuntimeRequestSchema, {
+          frame: toBinary21(RuntimeRequestSchema, create60(RuntimeRequestSchema, {
             protocolVersion: 2,
             requestId,
             target: { workspace, session: binding.session },
@@ -26033,6 +26248,7 @@ var init_correspondence_desk = __esm({
             requestId: request.requestId,
             workId: id,
             probeOnly,
+            liveConnected: this.#openLinks.has(target3.mount.workspace),
             ...beforeConverge === void 0 ? {} : { beforeConverge },
             ...target3.receiveState === void 0 ? {} : { receiveState: target3.receiveState },
             ...target3.offerHead === void 0 ? {} : { offerHead: target3.offerHead },
@@ -26060,6 +26276,7 @@ var init_correspondence_desk = __esm({
             root,
             work,
             outbound: command.admit,
+            liveConnected: this.#openLinks.has(mount.workspace),
             dependency: (workspace, source, acquire2 = false) => {
               if (this.#roundInFlight(workspace, workId2)) return void 0;
               const existing = this.#follows.bindingForWorkspace(workspace);
@@ -26530,7 +26747,7 @@ var init_identity_witness_cache = __esm({
 });
 
 // ../peer-office/src/runtime/identity_witness_read.ts
-import { create as create63, fromBinary as fromBinary22, toBinary as toBinary21 } from "@bufbuild/protobuf";
+import { create as create63, fromBinary as fromBinary23, toBinary as toBinary22 } from "@bufbuild/protobuf";
 function prepareWitnessRead(args) {
   if (args.reception.workspace !== args.rootWorkspace) {
     throw new Error("identity-provider witness route addresses another workspace");
@@ -26568,7 +26785,7 @@ function prepareWitnessRead(args) {
           contentType: "application/vnd.nomos.runtime-request+protobuf",
           accept: "application/vnd.nomos.runtime-response+protobuf",
           bearerToken: args.bearerToken.slice(),
-          body: toBinary21(RuntimeRequestSchema, request),
+          body: toBinary22(RuntimeRequestSchema, request),
           // Opening provider custody from cold storage can exceed 30 seconds.
           timeoutMillis: 5 * 6e4
         })
@@ -26598,7 +26815,7 @@ function acceptWitnessResponse(pending, receipt) {
       `identity-provider witness receipt '${receipt.effectId}' does not answer '${pending.effectId}'`
     );
   }
-  const response = fromBinary22(RuntimeResponseSchema, responseBody2(receipt));
+  const response = fromBinary23(RuntimeResponseSchema, responseBody2(receipt));
   if (response.protocolVersion !== RUNTIME_V2_PROTOCOL_VERSION) {
     throw new Error("identity-provider root returned an incompatible runtime response");
   }
@@ -26964,7 +27181,7 @@ var init_admission_durability_desk = __esm({
 });
 
 // ../peer-office/src/runtime/identity_recovery_desk.ts
-import { create as create67, fromBinary as fromBinary23, toBinary as toBinary22 } from "@bufbuild/protobuf";
+import { create as create67, fromBinary as fromBinary24, toBinary as toBinary23 } from "@bufbuild/protobuf";
 var cloneCall, IdentityRecoveryDesk;
 var init_identity_recovery_desk = __esm({
   "../peer-office/src/runtime/identity_recovery_desk.ts"() {
@@ -26973,7 +27190,7 @@ var init_identity_recovery_desk = __esm({
     init_credentials_desk_pb();
     init_identity_desk_pb();
     init_application_desk_pb();
-    cloneCall = (call) => fromBinary23(CallRequestSchema, toBinary22(CallRequestSchema, call));
+    cloneCall = (call) => fromBinary24(CallRequestSchema, toBinary23(CallRequestSchema, call));
     IdentityRecoveryDesk = class {
       #identity;
       #application;
@@ -26991,7 +27208,7 @@ var init_identity_recovery_desk = __esm({
         if (!command.request || !["query", "offer"].includes(command.request.operation.case ?? "")) {
           throw new Error("identity-provider recovery demand did not originate from an application call");
         }
-        const originalCall = toBinary22(CallRequestSchema, command.request);
+        const originalCall = toBinary23(CallRequestSchema, command.request);
         const step = this.#identity.execute(
           runtimeRequest,
           create67(IdentityProviderWitnessRequestSchema, {
@@ -27071,7 +27288,7 @@ var init_identity_recovery_desk = __esm({
         }
       }
       #adoptAndRetry(runtimeRequest, command, originalCall, requirement, ready) {
-        const original = fromBinary23(CallRequestSchema, originalCall);
+        const original = fromBinary24(CallRequestSchema, originalCall);
         const query2 = original.operation.case === "query" ? original.operation.value : void 0;
         const offer = original.operation.case === "offer" ? original.operation.value : void 0;
         const target3 = query2?.target ?? offer?.target;
@@ -27119,7 +27336,7 @@ var init_identity_recovery_desk = __esm({
         const retryCommand = create67(KernelCallRequestSchema, {
           session: command.session,
           credentialUse: command.credentialUse,
-          request: cloneCall(fromBinary23(CallRequestSchema, originalCall))
+          request: cloneCall(fromBinary24(CallRequestSchema, originalCall))
         });
         const retried = this.#application.call(runtimeRequest, retryCommand);
         if (retried.outcome.case === "failure" && retried.outcome.value.identityProviderWitnessRequired) {
@@ -27193,7 +27410,7 @@ var init_peer_maintenance_scheduler = __esm({
 });
 
 // ../peer-office/src/runtime/peer_background_scheduler.ts
-import { create as create68, toBinary as toBinary23 } from "@bufbuild/protobuf";
+import { create as create68, toBinary as toBinary24 } from "@bufbuild/protobuf";
 function yielding(paper) {
   if (paper.frame !== void 0 || paper.nextAfterMillis === void 0 || paper.nextAfterMillis > 0) return paper;
   return { ...paper, nextAfterMillis: BACKGROUND_CONTINUATION_YIELD_MILLIS };
@@ -27233,7 +27450,7 @@ var init_peer_background_scheduler = __esm({
         const recovery = retentionOnly ? {} : this.#subscriptions.nextRecovery(id, excludedWorkspaces);
         if (recovery.request) {
           return {
-            frame: toBinary23(RuntimeRequestSchema, recovery.request),
+            frame: toBinary24(RuntimeRequestSchema, recovery.request),
             nextAfterMillis: 0,
             workspace: recovery.request.target.workspace
           };
@@ -27241,7 +27458,7 @@ var init_peer_background_scheduler = __esm({
         const retention = this.#residency.nextRetention();
         if (retention.request !== void 0) {
           return {
-            frame: toBinary23(RuntimeRequestSchema, create68(RuntimeRequestSchema, {
+            frame: toBinary24(RuntimeRequestSchema, create68(RuntimeRequestSchema, {
               protocolVersion: 2,
               requestId: id,
               command: {
@@ -27258,7 +27475,7 @@ var init_peer_background_scheduler = __esm({
         const convergence = this.#receivingGroup.nextBackgroundPaper(id, excludedWorkspaces);
         if (convergence.frame !== void 0) {
           return {
-            frame: toBinary23(RuntimeRequestSchema, convergence.frame),
+            frame: toBinary24(RuntimeRequestSchema, convergence.frame),
             nextAfterMillis: 0,
             ...convergence.workspace === void 0 ? {} : { workspace: convergence.workspace }
           };
@@ -27319,7 +27536,7 @@ var init_peer_background_scheduler = __esm({
         const recovery = this.#subscriptions.nextRecovery(id, excluded);
         if (recovery.request) {
           return {
-            frame: toBinary23(RuntimeRequestSchema, recovery.request),
+            frame: toBinary24(RuntimeRequestSchema, recovery.request),
             nextAfterMillis: 0,
             workspace: recovery.request.target.workspace
           };
@@ -27327,7 +27544,7 @@ var init_peer_background_scheduler = __esm({
         const convergence = this.#receivingGroup.nextBackgroundPaper(id, excluded);
         if (convergence.frame !== void 0) {
           return {
-            frame: toBinary23(RuntimeRequestSchema, convergence.frame),
+            frame: toBinary24(RuntimeRequestSchema, convergence.frame),
             nextAfterMillis: 0,
             ...convergence.workspace === void 0 ? {} : { workspace: convergence.workspace }
           };
@@ -27699,7 +27916,7 @@ var init_history_acquisition_state = __esm({
 });
 
 // ../peer-office/src/runtime/history_acquisition_desk.ts
-import { create as create70, toBinary as toBinary24 } from "@bufbuild/protobuf";
+import { create as create70, toBinary as toBinary25 } from "@bufbuild/protobuf";
 function assertState2(record, state) {
   switch (state.case) {
     case HistoryAcquisitionPhase.Desired:
@@ -27718,7 +27935,7 @@ function assertState2(record, state) {
   }
   throw corrupt2(record, `invalid '${state.case}' state`);
 }
-var HISTORY_ACQUISITION_NAMESPACE, HISTORY_BACKGROUND_START_MILLIS, SLICE_ANSWER_MILLIS, encoder3, decoder3, workId, effectId, encode2, upgraded, decode2, corrupt2, HistoryAcquisitionDesk;
+var HISTORY_ACQUISITION_NAMESPACE, HISTORY_BACKGROUND_START_MILLIS, SLICE_ANSWER_MILLIS, encoder4, decoder4, workId, effectId, encode2, upgraded, decode2, corrupt2, HistoryAcquisitionDesk;
 var init_history_acquisition_desk = __esm({
   "../peer-office/src/runtime/history_acquisition_desk.ts"() {
     "use strict";
@@ -27729,15 +27946,15 @@ var init_history_acquisition_desk = __esm({
     HISTORY_ACQUISITION_NAMESPACE = "nomos.peer-desk.history-acquisition/v1";
     HISTORY_BACKGROUND_START_MILLIS = 1e4;
     SLICE_ANSWER_MILLIS = 5 * 6e4;
-    encoder3 = new TextEncoder();
-    decoder3 = new TextDecoder();
+    encoder4 = new TextEncoder();
+    decoder4 = new TextDecoder();
     workId = (workspace) => `history-acquisition:${workspace}`;
     effectId = (workspace, attempt) => `history-acquisition:${workspace}:${HistoryAcquisitionPhase.Acquiring}:${attempt}`;
     encode2 = (work) => {
       if (!work.credentialCapability) {
         throw new Error(`history acquisition for '${work.workspace}' has not restored its credential capability`);
       }
-      return encoder3.encode(JSON.stringify({
+      return encoder4.encode(JSON.stringify({
         version: 2,
         workspace: work.workspace,
         credentialCapability: work.credentialCapability,
@@ -27746,7 +27963,7 @@ var init_history_acquisition_desk = __esm({
     };
     upgraded = (state) => state.case === "backoff" ? { case: HistoryAcquisitionPhase.Paced, attempt: state.attempt, delayMillis: state.delayMillis, failed: true } : state;
     decode2 = (record) => {
-      const value = JSON.parse(decoder3.decode(record.value));
+      const value = JSON.parse(decoder4.decode(record.value));
       if (!value || typeof value !== "object") throw corrupt2(record, "not an object");
       const candidate = value;
       if (candidate.version !== 1 && candidate.version !== 2 || candidate.workspace !== record.key || !candidate.state) {
@@ -27791,6 +28008,21 @@ var init_history_acquisition_desk = __esm({
         this.#ensure(workspace, credentialCapability);
         this.#dueAt.set(workspace, this.#now() + HISTORY_BACKGROUND_START_MILLIS);
       }
+      /** A background kernel read needs an omitted ancestor now. Queue one bounded
+       * slice on the existing history lane; a failed slice keeps its retry pace. */
+      requestFromBackground(workspace, credentialCapability) {
+        if (!workspace) throw new Error("kernel history requirement names no workspace");
+        this.#ensure(workspace, credentialCapability);
+        const work = this.#get(workspace);
+        const now = this.#now();
+        if (work.state.case === HistoryAcquisitionPhase.Paced && work.state.failed) {
+          const due2 = this.#dueAt.get(workspace) ?? now + work.state.delayMillis;
+          this.#dueAt.set(workspace, due2);
+          if (due2 > now) return due2 - now;
+        }
+        this.#dueAt.set(workspace, now);
+        return 250;
+      }
       /** An operation needs history this custody lacks: its next slice now, joining one in flight. */
       begin(workspace, credentialCapability) {
         if (!workspace) throw new Error("kernel history requirement names no workspace");
@@ -27887,7 +28119,7 @@ var init_history_acquisition_desk = __esm({
         return {
           workspace: next.workspace,
           nextAfterMillis: 0,
-          frame: toBinary24(RuntimeRequestSchema, create70(RuntimeRequestSchema, {
+          frame: toBinary25(RuntimeRequestSchema, create70(RuntimeRequestSchema, {
             protocolVersion: 2,
             requestId,
             target: { workspace: next.workspace, session: `history-materialisation:${next.workspace}` },
@@ -27988,7 +28220,7 @@ var init_history_acquisition_desk = __esm({
 });
 
 // ../peer-office/src/peer_office.ts
-import { create as create71, toBinary as toBinary25 } from "@bufbuild/protobuf";
+import { create as create71, toBinary as toBinary26 } from "@bufbuild/protobuf";
 function isAnsweredStateRead(command, response) {
   if (command.request?.operation.case !== "query" || response.outcome.case !== "query" || response.outcome.value.result.case === "readIndexPending") return false;
   switch (command.request.operation.value.query.case) {
@@ -28030,6 +28262,7 @@ var init_peer_office = __esm({
     init_credentials_desk_pb();
     init_framework_pb();
     init_sha256();
+    init_custody_receipts();
     init_custodian_placement();
     init_custody_admission_desk();
     init_kernel_queries();
@@ -28175,7 +28408,7 @@ var init_peer_office = __esm({
           this.#trace,
           this.#readability
         );
-        this.#custodyAdmission = new CustodyAdmissionDesk(this.#kernel, this.#custody);
+        this.#custodyAdmission = new CustodyAdmissionDesk(this.#kernel, this.#custody, new CustodyReceipts(seatedStore));
         this.#queries = new KernelQueries(this.#kernel, this.#credentials);
         this.#follows = new ReplicaFollowController(
           new ReplicaFollowDesk(seatedStore),
@@ -28337,6 +28570,7 @@ var init_peer_office = __esm({
           // Lazy history: a head-only mount materialises its history in the background, never on
           // the path of an operation (architecture/lazy_history.md).
           onShallowMount: (workspace, credentialCapability) => this.#historyAcquisition.materialise(workspace, credentialCapability),
+          onOutboxHistoryRequired: (workspace, credentialCapability) => this.#historyAcquisition.requestFromBackground(workspace, credentialCapability),
           onSyncCompleted: (session, event) => {
             if (event.result?.workspace) {
               this.#replicaInventory.placementMayHaveChanged(event.result.workspace);
@@ -28686,7 +28920,7 @@ var init_peer_office = __esm({
         this.#origins.observeReceipt(request);
         const response = this.#fenced(this.#handleRequest(request));
         this.#paperSlots.answered(request, response, (session) => this.#sessions.bindingIfPresent(session)?.workspace);
-        return { responseProtobuf: toBinary25(RuntimeResponseSchema, response) };
+        return { responseProtobuf: toBinary26(RuntimeResponseSchema, response) };
       }
       /** Every response leaving the office passes the origin fence (see fenceEffects). */
       #fenced(response) {
@@ -28803,8 +29037,8 @@ var init_peer_office = __esm({
           this.#replicaInventory.placementMayHaveChanged(workspace);
         }
       }
-      /** Execute a typed paper after the access desk; never skip lifecycle or
-       * session-binding checks merely because its caller is another local desk. */
+      /** Execute a typed paper after the access desk. Custody admission addresses a
+       * workspace by replica identity; application calls retain session binding. */
       #dispatchRequest(request) {
         validateRuntimeV2Request(request);
         try {
@@ -28818,18 +29052,20 @@ var init_peer_office = __esm({
             if (!request.target.workspace || !request.target.session) {
               throw new Error("addressed runtime request requires workspace and session");
             }
-            const binding = this.#sessions.bindingIfPresent(request.target.session);
-            if (binding !== void 0) {
-              if (binding.workspace !== request.target.workspace) {
-                throw new Error(
-                  `session '${request.target.session}' is bound to workspace '${binding.workspace}', not '${request.target.workspace}'`
-                );
+            if (request.command.case !== "admitCustodyOffers") {
+              const binding = this.#sessions.bindingIfPresent(request.target.session);
+              if (binding !== void 0) {
+                if (binding.workspace !== request.target.workspace) {
+                  throw new Error(
+                    `session '${request.target.session}' is bound to workspace '${binding.workspace}', not '${request.target.workspace}'`
+                  );
+                }
+              } else {
+                this.#bindInteraction(create71(BindSessionRequestSchema, {
+                  session: request.target.session,
+                  workspace: request.target.workspace
+                }));
               }
-            } else {
-              this.#bindInteraction(create71(BindSessionRequestSchema, {
-                session: request.target.session,
-                workspace: request.target.workspace
-              }));
             }
           }
           switch (request.command.case) {
@@ -29026,7 +29262,7 @@ var init_peer_office = __esm({
                     ReadMaintenanceCause.ADMITTED_OFFER
                   );
                   this.#subscriptions.refreshWorkspace(request.target.workspace);
-                  this.#correspondence.workspaceFrontierChanged(request.target.workspace);
+                  this.#correspondence.receivedFrontierChanged(request.target.workspace);
                 }
                 return this.#birthCustodyResponse(
                   request,
@@ -29605,6 +29841,15 @@ function createBackgroundLanes(options) {
   const correspondenceNotBefore = /* @__PURE__ */ new Map();
   let retention = 0;
   let closed = false;
+  let selectionFailures = 0;
+  const selectionFault = (error) => {
+    try {
+      options.onSelectionError?.(error);
+    } catch {
+    }
+    selectionFailures += 1;
+    wake(Math.min(3e4, 250 * 2 ** Math.min(selectionFailures - 1, 7)));
+  };
   const wake = (delayMillis = 0) => {
     if (closed) return;
     const delay = Math.max(0, Math.ceil(delayMillis));
@@ -29615,53 +29860,58 @@ function createBackgroundLanes(options) {
     }
     wakeAt = at;
     timer = setTimer(() => {
-      timer = void 0;
-      wakeAt = void 0;
-      if (closed) return;
-      const now = options.monotonicNanoseconds();
-      for (const [workspace2, at2] of correspondenceNotBefore) {
-        if (at2 <= now) correspondenceNotBefore.delete(workspace2);
-      }
-      const backoffMillis = correspondenceNotBefore.size ? Math.min(...[...correspondenceNotBefore.values()].map((at2) => Number((at2 - now + 999999n) / 1000000n))) : void 0;
-      const retentionOnly = correspondenceInFlight;
-      const next = options.nextPaper(retentionOnly, new Set(correspondenceNotBefore.keys()));
-      if (next.frame === void 0) {
-        const delays = [next.nextAfterMillis, backoffMillis].filter((delay2) => delay2 !== void 0);
-        if (delays.length) wake(Math.min(...delays));
-        return;
-      }
-      if (options.isRetention(next.frame)) {
-        retention += 1;
+      try {
+        timer = void 0;
+        wakeAt = void 0;
+        if (closed) return;
+        const now = options.monotonicNanoseconds();
+        for (const [workspace2, at2] of correspondenceNotBefore) {
+          if (at2 <= now) correspondenceNotBefore.delete(workspace2);
+        }
+        const backoffMillis = correspondenceNotBefore.size ? Math.min(...[...correspondenceNotBefore.values()].map((at2) => Number((at2 - now + 999999n) / 1000000n))) : void 0;
+        const retentionOnly = correspondenceInFlight;
+        const next = options.nextPaper(retentionOnly, new Set(correspondenceNotBefore.keys()));
+        selectionFailures = 0;
+        if (next.frame === void 0) {
+          const delays = [next.nextAfterMillis, backoffMillis].filter((delay2) => delay2 !== void 0);
+          if (delays.length) wake(Math.min(...delays));
+          return;
+        }
+        if (options.isRetention(next.frame)) {
+          retention += 1;
+          void options.drive(next.frame).then(
+            () => {
+              retention -= 1;
+              wake(0);
+            },
+            () => {
+              retention -= 1;
+              wake(0);
+            }
+          );
+          wake(next.nextAfterMillis ?? 0);
+          return;
+        }
+        if (retentionOnly) throw new Error("background desk reserved correspondence while its lane was unavailable");
+        const workspace = next.workspace;
+        if (!workspace) throw new Error("background correspondence has no source workspace");
+        if (correspondenceNotBefore.has(workspace)) throw new Error("background desk bypassed a workspace's physical backoff");
+        correspondenceInFlight = true;
         void options.drive(next.frame).then(
           () => {
-            retention -= 1;
-            wake(0);
+            correspondenceInFlight = false;
+            wake(next.nextAfterMillis ?? 0);
           },
           () => {
-            retention -= 1;
+            correspondenceInFlight = false;
+            correspondenceNotBefore.set(workspace, options.monotonicNanoseconds() + BigInt(failureBackoffMillis) * 1000000n);
             wake(0);
           }
         );
-        wake(next.nextAfterMillis ?? 0);
-        return;
+        wake(0);
+      } catch (error) {
+        selectionFault(error);
       }
-      if (retentionOnly) throw new Error("background desk reserved correspondence while its lane was unavailable");
-      const workspace = next.workspace;
-      if (!workspace) throw new Error("background correspondence has no source workspace");
-      if (correspondenceNotBefore.has(workspace)) throw new Error("background desk bypassed a workspace's physical backoff");
-      correspondenceInFlight = true;
-      void options.drive(next.frame).then(
-        () => {
-          correspondenceInFlight = false;
-          wake(next.nextAfterMillis ?? 0);
-        },
-        () => {
-          correspondenceInFlight = false;
-          correspondenceNotBefore.set(workspace, options.monotonicNanoseconds() + BigInt(failureBackoffMillis) * 1000000n);
-          wake(0);
-        }
-      );
-      wake(0);
     }, delay);
   };
   return {
@@ -29689,7 +29939,7 @@ var init_background_lanes = __esm({
 });
 
 // ../peer-office/src/runtime/frame_runner.ts
-import { fromBinary as fromBinary24 } from "@bufbuild/protobuf";
+import { fromBinary as fromBinary25 } from "@bufbuild/protobuf";
 function createPeerOfficeFrameRunner(kernel, credentials, profile, observations, custody, postEvent, maintenanceSettled, driveBackground, peerDeskStore, executeBackground) {
   if (!peerDeskStore) {
     throw new Error("Peer Office frame runner requires an explicit PeerDeskStore capability");
@@ -29710,7 +29960,7 @@ function createPeerOfficeFrameRunner(kernel, credentials, profile, observations,
       const event = peer2.nextEvent();
       if (event === void 0) return;
       if (maintenanceSettled !== void 0) {
-        const decoded = fromBinary24(RuntimeEventSchema, event);
+        const decoded = fromBinary25(RuntimeEventSchema, event);
         if (decoded.event.case === "maintenanceProgress" && decoded.event.value.kernel && !decoded.event.value.kernel.maintenancePending) {
           maintenanceSettled(decoded.event.value);
         }
@@ -29745,11 +29995,12 @@ function createPeerOfficeFrameRunner(kernel, credentials, profile, observations,
       return paper;
     },
     drive: (frame) => driveBackground(frame).catch((error) => {
-      peer2.backgroundPaperAbandoned(fromBinary24(RuntimeRequestSchema, frame).requestId);
+      peer2.backgroundPaperAbandoned(fromBinary25(RuntimeRequestSchema, frame).requestId);
       throw error;
     }),
-    isRetention: (frame) => fromBinary24(RuntimeRequestSchema, frame).command.case === "retainFrontier",
-    monotonicNanoseconds: () => observations.monotonicNanoseconds()
+    isRetention: (frame) => fromBinary25(RuntimeRequestSchema, frame).command.case === "retainFrontier",
+    monotonicNanoseconds: () => observations.monotonicNanoseconds(),
+    onSelectionError: (error) => console.error("Nomos background paper selection failed", error)
   });
   const scheduleCorrespondence = (delayMillis = 0) => {
     lanes?.wake(delayMillis);
@@ -29758,7 +30009,7 @@ function createPeerOfficeFrameRunner(kernel, credentials, profile, observations,
     handleFrame(frame) {
       const response = peer2.invoke(frame).responseProtobuf;
       drainEvents();
-      if (fromBinary24(RuntimeRequestSchema, frame).command.case !== "workspaceStatus") {
+      if (fromBinary25(RuntimeRequestSchema, frame).command.case !== "workspaceStatus") {
         scheduleMaintenance();
         scheduleCorrespondence();
       }
@@ -29820,21 +30071,21 @@ var init_frame_runner = __esm({
 });
 
 // ../peer-office/src/runtime/platform_effect_driver.ts
-import { create as create72, fromBinary as fromBinary25, toBinary as toBinary26 } from "@bufbuild/protobuf";
+import { create as create72, fromBinary as fromBinary26, toBinary as toBinary27 } from "@bufbuild/protobuf";
 async function drivePeerFrame(runner, initialFrame, fetchImpl = globalThis.fetch, custody, bornCustody, credentialRefresh, yieldWakeToCaller = false, deviceIdentity, lawPackage, yieldLocalReadToCaller = false, yieldHistoryToCaller = false, performExternalEffect) {
   const persistBornCustody = bornCustody ?? (custody?.persistBornCustody ? (effect) => custody.persistBornCustody(effect) : void 0);
   let responseFrame = runner.handleFrame(initialFrame);
   const satisfied = /* @__PURE__ */ new Set();
   const resendable = (() => {
     try {
-      return fromBinary25(RuntimeRequestSchema, initialFrame).command.case !== "continueCorrespondence";
+      return fromBinary26(RuntimeRequestSchema, initialFrame).command.case !== "continueCorrespondence";
     } catch {
       return false;
     }
   })();
   let historyRetries = 0;
   for (; ; ) {
-    const response = fromBinary25(RuntimeResponseSchema, responseFrame);
+    const response = fromBinary26(RuntimeResponseSchema, responseFrame);
     if (response.outcome.case === "historyAcquired" && resendable && historyRetries < 32) {
       historyRetries += 1;
       responseFrame = runner.handleFrame(initialFrame);
@@ -29844,7 +30095,7 @@ async function drivePeerFrame(runner, initialFrame, fetchImpl = globalThis.fetch
       if (yieldLocalReadToCaller) return responseFrame;
       const pending2 = response.outcome.value;
       await new Promise((resolve9) => setTimeout(resolve9, pending2.resumeAfterMillis));
-      responseFrame = runner.handleFrame(toBinary26(RuntimeRequestSchema, create72(RuntimeRequestSchema, {
+      responseFrame = runner.handleFrame(toBinary27(RuntimeRequestSchema, create72(RuntimeRequestSchema, {
         protocolVersion: response.protocolVersion,
         requestId: response.requestId,
         command: { case: "continueLocalRead", value: create72(ContinueLocalReadRequestSchema, { workId: pending2.workId }) }
@@ -29944,7 +30195,7 @@ async function drivePeerFrame(runner, initialFrame, fetchImpl = globalThis.fetch
           outcome: { case: "failure", value: { reason: PeerEffectFailureReason.TRANSPORT, message: error instanceof Error ? error.message : String(error) } }
         });
       }
-      responseFrame = runner.handleFrame(toBinary26(RuntimeRequestSchema, create72(RuntimeRequestSchema, {
+      responseFrame = runner.handleFrame(toBinary27(RuntimeRequestSchema, create72(RuntimeRequestSchema, {
         protocolVersion: response.protocolVersion,
         requestId: response.requestId,
         command: { case: "continueCorrespondence", value: { workId: pending.workId, receipt: receipt2 } }
@@ -29972,7 +30223,7 @@ async function drivePeerFrame(runner, initialFrame, fetchImpl = globalThis.fetch
     }) : pending.effect.case === "retainFrontier" ? await executeRetainFrontierEffect(pending.effect.value, custody) : pending.effect.case === "wake" ? await executeWakeEffect(pending.effect.value) : pending.effect.case === "refreshCredential" ? await executeCredentialRefreshEffect(pending.effect.value, credentialRefresh) : pending.effect.case === "deviceIdentity" ? await executeDeviceIdentityEffect(pending.effect.value, deviceIdentity) : pending.effect.case === "lawPackage" ? await executeLawPackageEffect(pending.effect.value, lawPackage) : pending.effect.case === "historyAcquisition" ? await executeHistoryAcquisitionEffect(pending.effect.value, custody) : (() => {
       throw new Error(`correspondence work '${pending.workId}' has no effect`);
     })();
-    responseFrame = runner.handleFrame(toBinary26(RuntimeRequestSchema, create72(RuntimeRequestSchema, {
+    responseFrame = runner.handleFrame(toBinary27(RuntimeRequestSchema, create72(RuntimeRequestSchema, {
       protocolVersion: response.protocolVersion,
       requestId: response.requestId,
       command: {
@@ -30044,11 +30295,11 @@ async function executeDeviceIdentityEffect(effect, store) {
       await store.save(effect.identity, effect.operation.value.secret.slice());
     } else if (effect.operation.case === "loadRecovery") {
       const bytes = await store.load(`nomos-device-recovery-v1|${effect.identity}`);
-      if (bytes !== void 0) recovery = fromBinary25(DeviceRecoveryRecordSchema, bytes);
+      if (bytes !== void 0) recovery = fromBinary26(DeviceRecoveryRecordSchema, bytes);
     } else if (effect.operation.case === "saveRecovery") {
       const record = effect.operation.value.record;
       if (!record) throw new Error("device recovery save contains no record");
-      await store.save(`nomos-device-recovery-v1|${effect.identity}`, toBinary26(DeviceRecoveryRecordSchema, record));
+      await store.save(`nomos-device-recovery-v1|${effect.identity}`, toBinary27(DeviceRecoveryRecordSchema, record));
     } else throw new Error("device identity effect has no operation");
     return create72(PeerEffectReceiptSchema, { effectId: effect.effectId, outcome: {
       case: "deviceIdentity",
@@ -30160,7 +30411,7 @@ var init_platform_effect_driver = __esm({
     correspondenceWakeups = /* @__PURE__ */ new WeakMap();
     deliveryIdentity = (requestFrame) => {
       try {
-        const request = fromBinary25(RuntimeRequestSchema, requestFrame);
+        const request = fromBinary26(RuntimeRequestSchema, requestFrame);
         if (request.command.case !== "deliverWorkspaceEffects") return void 0;
         const command = request.command.value;
         return `${command.sourceSession}\0${command.targetWorkspace}\0${command.sourceCommit ?? ""}`;
@@ -30171,7 +30422,7 @@ var init_platform_effect_driver = __esm({
     arrangeCorrespondenceWakeup = (runner, requestFrame, responseFrame, fetchImpl) => {
       const identity = deliveryIdentity(requestFrame);
       if (!identity) return;
-      const response = fromBinary25(RuntimeResponseSchema, responseFrame);
+      const response = fromBinary26(RuntimeResponseSchema, responseFrame);
       const retryAt = response.outcome.case === "workspaceEffectsDelivered" ? response.outcome.value.retryAtMillis : void 0;
       const wakeups = correspondenceWakeups.get(runner) ?? /* @__PURE__ */ new Map();
       correspondenceWakeups.set(runner, wakeups);
@@ -30296,13 +30547,19 @@ var init_platform_effect_driver = __esm({
     };
     executeGitFetchWithAlongside = async (effect, fetchImpl) => {
       if (!effect.alongside) return executeGitFetchEffect(effect, fetchImpl);
-      const [fetched, alongside] = await Promise.all([
-        executeGitFetchEffect(effect, fetchImpl),
-        executeHttpEffect(effect.alongside, fetchImpl)
-      ]);
-      if (fetched.outcome.case === "gitFetch" && alongside.outcome.case === "response") {
+      const cancelAlongside = new AbortController();
+      let alongside;
+      void executeHttpEffect(effect.alongside, (input, init) => fetchImpl(input, {
+        ...init,
+        signal: init?.signal ? AbortSignal.any([init.signal, cancelAlongside.signal]) : cancelAlongside.signal
+      })).then((receipt) => {
+        alongside = receipt;
+      });
+      const fetched = await executeGitFetchEffect(effect, fetchImpl);
+      if (fetched.outcome.case === "gitFetch" && alongside?.outcome.case === "response") {
         fetched.outcome.value.alongside = alongside.outcome.value;
       }
+      cancelAlongside.abort();
       return fetched;
     };
     executeGitPushEffect = async (effect, fetchImpl) => {
@@ -30362,25 +30619,26 @@ var init_platform_effect_driver = __esm({
 });
 
 // ../platform-shells/shared/socket_effects.ts
-import { create as create73, fromBinary as fromBinary26, toBinary as toBinary27 } from "@bufbuild/protobuf";
+import { create as create73, fromBinary as fromBinary27, toBinary as toBinary28 } from "@bufbuild/protobuf";
 function socketEffects(invoke2, permits = () => true) {
   const sockets = /* @__PURE__ */ new Map();
   let sequence = 50000000000n;
   let closed = false;
   const receipt = (connectionId, observation) => {
     if (closed) return;
-    const frame = toBinary27(RuntimeRequestSchema, create73(RuntimeRequestSchema, {
+    const frame = toBinary28(RuntimeRequestSchema, create73(RuntimeRequestSchema, {
       protocolVersion: 2,
       requestId: ++sequence,
       command: { case: "socketReceipt", value: create73(PeerSocketReceiptSchema, { connectionId, observation }) }
     }));
-    void Promise.resolve().then(() => invoke2(frame)).catch(() => {
+    void Promise.resolve().then(() => invoke2(frame)).catch((error) => {
+      console.warn("[nomos-socket] receipt failed", { connectionId, error });
       sockets.get(connectionId)?.close();
     });
   };
   return {
     consume(frame) {
-      const event = fromBinary26(RuntimeEventSchema, frame);
+      const event = fromBinary27(RuntimeEventSchema, frame);
       if (event.event.case !== "socketEffect") return false;
       const effect = event.event.value;
       const id = effect.connectionId;
@@ -30396,6 +30654,7 @@ function socketEffects(invoke2, permits = () => true) {
           socket.onopen = () => receipt(id, { case: "opened", value: true });
           socket.onmessage = (message) => {
             if (message.data instanceof ArrayBuffer) receipt(id, { case: "received", value: new Uint8Array(message.data) });
+            else if (typeof message.data === "string") receipt(id, { case: "received", value: new TextEncoder().encode(message.data) });
           };
           socket.onclose = () => {
             if (sockets.get(id) === socket) sockets.delete(id);
@@ -30436,17 +30695,17 @@ var init_socket_effects = __esm({
 });
 
 // ../platform-shells/shared/credential_effects.ts
-import { create as create74, fromBinary as fromBinary27, toBinary as toBinary28 } from "@bufbuild/protobuf";
+import { create as create74, fromBinary as fromBinary28, toBinary as toBinary29 } from "@bufbuild/protobuf";
 function credentialEffects(invoke2, provider) {
   return { consume(frame) {
-    const event = fromBinary27(RuntimeEventSchema, frame);
+    const event = fromBinary28(RuntimeEventSchema, frame);
     if (event.event.case !== "credentialRefreshRequested" || provider === externalPeerEffect) return false;
     const pending = event.event.value.pending;
     if (pending?.effect.case !== "refreshCredential") throw new Error("credential refresh event omitted its physical effect");
     const effect = pending.effect.value;
     void Promise.resolve().then(async () => {
       const receipt = await executeCredentialRefreshEffect(effect, provider);
-      const response = fromBinary27(RuntimeResponseSchema, await invoke2(toBinary28(RuntimeRequestSchema, create74(RuntimeRequestSchema, {
+      const response = fromBinary28(RuntimeResponseSchema, await invoke2(toBinary29(RuntimeRequestSchema, create74(RuntimeRequestSchema, {
         protocolVersion: 2,
         requestId: event.sequence,
         command: { case: "continueCorrespondence", value: create74(ContinueCorrespondenceRequestSchema, { workId: pending.workId, receipt }) }
@@ -30469,7 +30728,7 @@ var init_credential_effects = __esm({
 });
 
 // ../platform-shells/shared/peer_office_host.ts
-import { create as create75, fromBinary as fromBinary28, toBinary as toBinary29 } from "@bufbuild/protobuf";
+import { create as create75, fromBinary as fromBinary29, toBinary as toBinary30 } from "@bufbuild/protobuf";
 function openPeerOfficeHost(kernel, shell, fetchImpl = globalThis.fetch, maintenanceSettled, postEvent = () => {
 }, credentialRefresh, yieldWakeToCaller = false, deviceIdentity, lawPackage, performExternalEffect) {
   let runner;
@@ -30518,7 +30777,7 @@ function openPeerOfficeHost(kernel, shell, fetchImpl = globalThis.fetch, mainten
   );
   const providerOrigins = [...configuredOrigins];
   if (providerOrigins.length > 0) {
-    const configured = fromBinary28(RuntimeResponseSchema, runner.handleFrame(toBinary29(
+    const configured = fromBinary29(RuntimeResponseSchema, runner.handleFrame(toBinary30(
       RuntimeRequestSchema,
       create75(RuntimeRequestSchema, {
         protocolVersion: 2,
@@ -30532,7 +30791,7 @@ function openPeerOfficeHost(kernel, shell, fetchImpl = globalThis.fetch, mainten
   }
   return {
     async invoke(args) {
-      const request = fromBinary28(RuntimeRequestSchema, args.requestBytes);
+      const request = fromBinary29(RuntimeRequestSchema, args.requestBytes);
       if (request.protocolVersion !== 2) {
         throw new Error(`unsupported Nomos runtime protocol ${request.protocolVersion}`);
       }
@@ -30588,7 +30847,7 @@ var init_peer_office_host = __esm({
     init_socket_effects();
     init_credential_effects();
     targetOf = (frame) => {
-      const target3 = fromBinary28(RuntimeRequestSchema, frame).target;
+      const target3 = fromBinary29(RuntimeRequestSchema, frame).target;
       return {
         ...target3?.session === void 0 ? {} : { session: target3.session },
         ...target3?.workspace === void 0 ? {} : { workspace: target3.workspace }
@@ -30642,21 +30901,21 @@ var init_sqlite_peer_desk_store = __esm({
         }
         return this.#opened = database;
       }
-      list(namespace) {
+      list(namespace2) {
         const rows = this.#database().prepare(`
       SELECT record_key AS key, revision, value
         FROM peer_desk_record
        WHERE namespace = ?
        ORDER BY record_key
-    `).all(namespace);
+    `).all(namespace2);
         return rows.map((row) => ({
-          namespace,
+          namespace: namespace2,
           key: row.key,
           revision: BigInt(row.revision),
           value: Uint8Array.from(row.value)
         }));
       }
-      compareExchange(namespace, key2, expectedRevision, value) {
+      compareExchange(namespace2, key2, expectedRevision, value) {
         const expected = expectedRevision === void 0 ? void 0 : Number(expectedRevision);
         if (expected !== void 0 && (!Number.isSafeInteger(expected) || expected <= 0)) {
           throw new Error(`peer desk revision ${expectedRevision} cannot be represented by SQLite`);
@@ -30669,8 +30928,8 @@ var init_sqlite_peer_desk_store = __esm({
             const removed = database.prepare(`
           DELETE FROM peer_desk_record
            WHERE namespace = ? AND record_key = ? AND revision = ?
-        `).run(namespace, key2, expected);
-            if (removed.changes !== 1) this.#conflict(namespace, key2);
+        `).run(namespace2, key2, expected);
+            if (removed.changes !== 1) this.#conflict(namespace2, key2);
             return this.#commit(void 0);
           }
           const bytes = Buffer.from(value.buffer, value.byteOffset, value.byteLength);
@@ -30682,14 +30941,14 @@ var init_sqlite_peer_desk_store = __esm({
             INSERT INTO peer_desk_record(namespace, record_key, revision, value)
             VALUES (?, ?, 1, ?)
             ON CONFLICT(namespace, record_key) DO NOTHING
-          `).run(namespace, key2, bytes) : database.prepare(`
+          `).run(namespace2, key2, bytes) : database.prepare(`
             UPDATE peer_desk_record
                SET revision = ?, value = ?
              WHERE namespace = ? AND record_key = ? AND revision = ?
-          `).run(nextRevision, bytes, namespace, key2, expected);
-          if (changed.changes !== 1) this.#conflict(namespace, key2);
+          `).run(nextRevision, bytes, namespace2, key2, expected);
+          if (changed.changes !== 1) this.#conflict(namespace2, key2);
           return this.#commit({
-            namespace,
+            namespace: namespace2,
             key: key2,
             revision: BigInt(nextRevision),
             value: value.slice()
@@ -30707,12 +30966,12 @@ var init_sqlite_peer_desk_store = __esm({
         this.#database().exec("COMMIT");
         return value;
       }
-      #conflict(namespace, key2) {
+      #conflict(namespace2, key2) {
         const current = this.#database().prepare(`
       SELECT revision FROM peer_desk_record WHERE namespace = ? AND record_key = ?
-    `).get(namespace, key2);
+    `).get(namespace2, key2);
         throw new Error(
-          `peer desk record '${namespace}/${key2}' changed at revision ${current?.revision ?? "absent"}`
+          `peer desk record '${namespace2}/${key2}' changed at revision ${current?.revision ?? "absent"}`
         );
       }
     };
@@ -31109,7 +31368,7 @@ __export(peer_office_exports, {
   signEraCertification: () => signEraCertification,
   verifyRemoteChain: () => verifyRemoteChain
 });
-import { create as create77, fromBinary as fromBinary29, toBinary as toBinary30 } from "@bufbuild/protobuf";
+import { create as create77, fromBinary as fromBinary30, toBinary as toBinary31 } from "@bufbuild/protobuf";
 import { createHash as createHash3, randomUUID as randomUUID2 } from "node:crypto";
 import {
   existsSync as existsSync6,
@@ -31190,13 +31449,13 @@ async function invokeLocalPeerOffice(cloud, command, target3) {
     command
   });
   const office = await peer(cloud);
-  const response = fromBinary29(RuntimeResponseSchema, await office.invoke({
+  const response = fromBinary30(RuntimeResponseSchema, await office.invoke({
     ...target3 === void 0 ? {} : {
       workspace: target3.workspace,
       authToken: target3.authToken,
       sourceDeviceKeySecret: target3.authorSecret
     },
-    requestBytes: toBinary30(RuntimeRequestSchema, request)
+    requestBytes: toBinary31(RuntimeRequestSchema, request)
   }));
   if (response.requestId !== requestId) {
     throw new Error(`Peer Office returned response ${response.requestId} for request ${requestId}`);