githolon 0.112.8 → 0.112.12

package/dist/compile_mountability_entry.js

@@ -3878,10 +3878,10 @@ var init_node_custody_filesystem = __esm({
 // ../platform-shells/node/kernel_wasi_stdio.ts
 import { TextDecoder as TextDecoder2 } from "node:util";
 function kernelWasiStdio(memory, stderr, writeFile2, stderrPartial) {
-  const decoder4 = new TextDecoder2();
+  const decoder5 = new TextDecoder2();
   let pending = "";
   const accept = (bytes) => {
-    pending += decoder4.decode(bytes, { stream: true });
+    pending += decoder5.decode(bytes, { stream: true });
     for (; ; ) {
       const newline = pending.indexOf("\n");
       if (newline >= 0 && newline < 16384) {
@@ -5574,17 +5574,17 @@ function attributes(capability) {
   }
   return result;
 }
-function capabilityByNamespace(capabilities, namespace) {
-  const matches = capabilities.filter((capability) => capability.namespace === namespace);
+function capabilityByNamespace(capabilities, namespace2) {
+  const matches = capabilities.filter((capability) => capability.namespace === namespace2);
   if (matches.length !== 1) {
-    throw new Error(`OSGi resource needs exactly one ${namespace} capability`);
+    throw new Error(`OSGi resource needs exactly one ${namespace2} capability`);
   }
   return matches[0];
 }
-function optionalCapabilityByNamespace(capabilities, namespace) {
-  const matches = capabilities.filter((capability) => capability.namespace === namespace);
+function optionalCapabilityByNamespace(capabilities, namespace2) {
+  const matches = capabilities.filter((capability) => capability.namespace === namespace2);
   if (matches.length > 1) {
-    throw new Error(`OSGi resource needs at most one ${namespace} capability`);
+    throw new Error(`OSGi resource needs at most one ${namespace2} capability`);
   }
   return matches[0];
 }
@@ -6618,7 +6618,8 @@ var init_kernel_port = __esm({
           }
         }));
         if (response.outcome.case === "failure") {
-          throw new Error(`${response.outcome.value.code}: ${response.outcome.value.message}`);
+          throwUnnamedHistoryRequirement(response.outcome.value, mount.workspace);
+          throwKernelFailure(response.outcome.value);
         }
         if (response.outcome.case !== "outbox") {
           throw new Error(`kernel returned '${response.outcome.case || "empty"}' while reading correspondence`);
@@ -6647,7 +6648,8 @@ var init_kernel_port = __esm({
           }
         }));
         if (response.outcome.case === "failure") {
-          throw new Error(`${response.outcome.value.code}: ${response.outcome.value.message}`);
+          throwUnnamedHistoryRequirement(response.outcome.value, mount.workspace);
+          throwKernelFailure(response.outcome.value);
         }
         if (response.outcome.case !== "outbox") {
           throw new Error(
@@ -9844,11 +9846,11 @@ import { create as create19 } from "@bufbuild/protobuf";
 function resolveWorkspaceName(command) {
   switch (command.birth.case) {
     case "keyed": {
-      const { namespace, key: key2 } = command.birth.value;
-      if (namespace.length === 0 || key2.length === 0) {
+      const { namespace: namespace2, key: key2 } = command.birth.value;
+      if (namespace2.length === 0 || key2.length === 0) {
         throw new Error(`${WORKSPACE_NAME_REQUEST_INVALID}: a keyed birth name needs both its namespace and its key`);
       }
-      return create19(ResolvedWorkspaceNameSchema, { workspace: keyedBirthNameOf(namespace, key2) });
+      return create19(ResolvedWorkspaceNameSchema, { workspace: keyedBirthNameOf(namespace2, key2) });
     }
     case "receivingGroup": {
       const { principal } = command.birth.value;
@@ -9872,10 +9874,10 @@ var init_workspace_naming = __esm({
     init_records_desk_pb();
     init_sha256();
     WORKSPACE_NAME_SEP = "";
-    keyedBirthNameOf = (namespace, key2) => `${namespace}-${sha256Hex(new TextEncoder().encode(namespace + WORKSPACE_NAME_SEP + key2)).slice(0, 40)}`;
+    keyedBirthNameOf = (namespace2, key2) => `${namespace2}-${sha256Hex(new TextEncoder().encode(namespace2 + WORKSPACE_NAME_SEP + key2)).slice(0, 40)}`;
     RECEIVING_GROUP_NAME_PREFIX = "nomos-rg-";
     receivingGroupNameOf = (principal) => `${RECEIVING_GROUP_NAME_PREFIX}${sha256Hex(new TextEncoder().encode(principal)).slice(0, 40)}`;
-    isKeyedBirthOf = (namespace, workspace) => workspace.startsWith(`${namespace}-`);
+    isKeyedBirthOf = (namespace2, workspace) => workspace.startsWith(`${namespace2}-`);
     WORKSPACE_NAME_REQUEST_INVALID = "nomos.runtime.workspace_name_request_invalid";
   }
 });
@@ -11975,8 +11977,150 @@ var init_model_adoption_desk = __esm({
   }
 });
 
+// ../peer-office/src/runtime/peer_desk_store.ts
+var recordId, copy2, MemoryPeerDeskStore;
+var init_peer_desk_store = __esm({
+  "../peer-office/src/runtime/peer_desk_store.ts"() {
+    "use strict";
+    recordId = (namespace2, key2) => `${namespace2.length}:${namespace2}${key2}`;
+    copy2 = (record) => ({
+      ...record,
+      value: record.value.slice()
+    });
+    MemoryPeerDeskStore = class {
+      #records = /* @__PURE__ */ new Map();
+      list(namespace2) {
+        return [...this.#records.values()].filter((record) => record.namespace === namespace2).sort((left, right) => left.key.localeCompare(right.key)).map(copy2);
+      }
+      compareExchange(namespace2, key2, expectedRevision, value) {
+        const id = recordId(namespace2, key2);
+        const current = this.#records.get(id);
+        if (current?.revision !== expectedRevision) {
+          throw new Error(
+            `peer desk record '${namespace2}/${key2}' changed at revision ${current?.revision ?? "absent"}`
+          );
+        }
+        if (value === void 0) {
+          this.#records.delete(id);
+          return void 0;
+        }
+        const next = Object.freeze({
+          namespace: namespace2,
+          key: key2,
+          revision: (current?.revision ?? 0n) + 1n,
+          value: value.slice()
+        });
+        this.#records.set(id, next);
+        return copy2(next);
+      }
+    };
+  }
+});
+
+// ../peer-office/src/runtime/custody_receipts.ts
+import { fromBinary as fromBinary15, toBinary as toBinary12 } from "@bufbuild/protobuf";
+var namespace, encoder, decoder, MAX_BASES, MAX_RECEIPTS, CustodyReceipts;
+var init_custody_receipts = __esm({
+  "../peer-office/src/runtime/custody_receipts.ts"() {
+    "use strict";
+    init_correspondence_desk_pb();
+    init_peer_desk_store();
+    init_sha256();
+    namespace = "nomos.peer-desk.custody-receipts/v1";
+    encoder = new TextEncoder();
+    decoder = new TextDecoder();
+    MAX_BASES = 256;
+    MAX_RECEIPTS = 4096;
+    CustodyReceipts = class {
+      #store;
+      #records = /* @__PURE__ */ new Map();
+      #journals = /* @__PURE__ */ new Map();
+      #receipts = /* @__PURE__ */ new Map();
+      constructor(store = new MemoryPeerDeskStore()) {
+        this.#store = store;
+        for (const record of store.list(namespace)) {
+          this.#records.set(record.key, record);
+          try {
+            if (record.key.startsWith("receipt:")) {
+              const newline = record.value.indexOf(10);
+              if (newline < 0) continue;
+              const receipt = fromBinary15(CustodyIntentAdmissionSchema, record.value.subarray(newline + 1));
+              const header2 = JSON.parse(decoder.decode(record.value.subarray(0, newline)));
+              if (receipt.outcome.case === "admitted" && typeof header2.generation === "string" && typeof header2.head === "string") this.#receipts.set(record.key, { ...header2, receipt });
+              continue;
+            }
+            if (!record.key.startsWith("head:")) continue;
+            const value = JSON.parse(decoder.decode(record.value));
+            if (typeof value.head !== "string" || typeof value.generation !== "string" || !Array.isArray(value.bases) || !Array.isArray(value.keys) || value.bases.length > MAX_BASES || value.keys.length > MAX_RECEIPTS) continue;
+            if (!value.bases.every((base) => typeof base === "string") || !value.keys.every((key2) => typeof key2 === "string")) continue;
+            this.#journals.set(record.key.slice(5), value);
+          } catch {
+          }
+        }
+      }
+      covers(workspace, current, base) {
+        const value = this.#journals.get(workspace);
+        return value?.head === current && value.bases.includes(base);
+      }
+      receipt(workspace, current, change) {
+        const value = this.#journals.get(workspace);
+        if (value?.head !== current) return void 0;
+        const stored = this.#receipts.get(`receipt:${workspace}:${sha256Hex(change)}`);
+        if (stored?.generation !== value.generation) return void 0;
+        if (stored.head !== value.head && !value.bases.includes(stored.head)) return void 0;
+        return fromBinary15(CustodyIntentAdmissionSchema, toBinary12(CustodyIntentAdmissionSchema, stored.receipt));
+      }
+      record(workspace, before, after, receipts) {
+        const old = this.#journals.get(workspace);
+        const journalKey = `head:${workspace}`;
+        const value = old?.head === before ? { ...old, head: after, bases: [...old.bases], keys: [...old.keys] } : { head: after, bases: [], keys: [], generation: String((this.#records.get(journalKey)?.revision ?? 0n) + 1n) };
+        if (before && before !== after) value.bases.push(before);
+        value.bases = [...new Set(value.bases)].slice(-MAX_BASES);
+        const keys = new Set(value.keys);
+        const discarded = new Set(old?.generation !== value.generation ? old?.keys : []);
+        for (const { change, receipt } of receipts) {
+          if (receipt.outcome.case !== "admitted") continue;
+          const key2 = `receipt:${workspace}:${sha256Hex(change)}`;
+          keys.delete(key2);
+          keys.add(key2);
+          discarded.delete(key2);
+          const header2 = encoder.encode(`${JSON.stringify({ generation: value.generation, head: after })}
+`);
+          const body = toBinary12(CustodyIntentAdmissionSchema, receipt);
+          const bytes = new Uint8Array(header2.length + body.length);
+          bytes.set(header2);
+          bytes.set(body, header2.length);
+          const record2 = this.#store.compareExchange(namespace, key2, this.#records.get(key2)?.revision, bytes);
+          if (record2) this.#records.set(key2, record2);
+          this.#receipts.set(key2, {
+            generation: value.generation,
+            head: after,
+            receipt: fromBinary15(CustodyIntentAdmissionSchema, body)
+          });
+        }
+        const ordered = [...keys];
+        for (const key2 of ordered.slice(0, -MAX_RECEIPTS)) discarded.add(key2);
+        value.keys = ordered.slice(-MAX_RECEIPTS);
+        for (const key2 of discarded) {
+          this.#store.compareExchange(namespace, key2, this.#records.get(key2)?.revision, void 0);
+          this.#records.delete(key2);
+          this.#receipts.delete(key2);
+        }
+        const record = this.#store.compareExchange(
+          namespace,
+          journalKey,
+          this.#records.get(journalKey)?.revision,
+          encoder.encode(JSON.stringify(value))
+        );
+        if (record) this.#records.set(journalKey, record);
+        this.#journals.set(workspace, value);
+      }
+    };
+  }
+});
+
 // ../peer-office/src/runtime/custodian_placement.ts
-import { create as create25, fromBinary as fromBinary15, toBinary as toBinary12 } from "@bufbuild/protobuf";
+import { create as create25, fromBinary as fromBinary16, toBinary as toBinary13 } from "@bufbuild/protobuf";
 var CustodianPlacement;
 var init_custodian_placement = __esm({
   "../peer-office/src/runtime/custodian_placement.ts"() {
@@ -11990,7 +12134,7 @@ var init_custodian_placement = __esm({
       #clock;
       #template;
       constructor(kernel, clock, templateProtobuf) {
-        const template = fromBinary15(CustodyPlacementPolicySchema, templateProtobuf);
+        const template = fromBinary16(CustodyPlacementPolicySchema, templateProtobuf);
         if (!template.declaration || !template.adoptedBy || template.rules.length === 0 || template.remotes.length === 0) {
           throw new Error("custodian placement template requires a declaration, adoptedBy, rules and remotes");
         }
@@ -12022,7 +12166,7 @@ var init_custodian_placement = __esm({
         });
         return create25(CustodyPlacementPolicySchema, {
           ...content,
-          packageSha256: sha256Hex(toBinary12(CustodyPlacementPolicySchema, content))
+          packageSha256: sha256Hex(toBinary13(CustodyPlacementPolicySchema, content))
         });
       }
       /** Adopt this custodian's placement for an opened, born workspace that has none. True when it adopted. */
@@ -12087,6 +12231,7 @@ var init_custody_admission_desk = __esm({
     init_correspondence_desk_pb();
     init_session_directory();
     init_custody_return_delta();
+    init_custody_receipts();
     CandidateCustodyRequiredError = class extends Error {
       workspace;
       reference;
@@ -12100,14 +12245,16 @@ var init_custody_admission_desk = __esm({
     CustodyAdmissionDesk = class {
       #kernel;
       #custody;
-      constructor(kernel, custody) {
+      #receipts;
+      constructor(kernel, custody, receipts = new CustodyReceipts()) {
         this.#kernel = kernel;
         this.#custody = custody;
+        this.#receipts = receipts;
       }
       admit(request, command) {
-        const session = request.target?.session;
-        if (!session) throw new Error("custody admission requires an addressed runtime session");
-        const mount = this.#custody.mountForSession(session);
+        const workspace = request.target?.workspace;
+        if (!workspace) throw new Error("custody admission requires an addressed workspace");
+        const mount = this.#custody.mountForWorkspace(workspace);
         if (command.evidencePack.byteLength > 0) {
           this.#kernel.applyPack(mount, request.requestId, command.evidencePack);
         }
@@ -12118,21 +12265,42 @@ var init_custody_admission_desk = __esm({
         const births = [];
         const admittedBase = this.#kernel.head(mount, request.requestId) ?? "";
         if (command.fastForwardOnly && offers.length > 0 && (command.baseHead ?? "") !== admittedBase) {
+          for (const offer of offers) {
+            const receipt = this.#receipts.receipt(mount.workspace, admittedBase, offer.changeUsda);
+            if (!receipt) continue;
+            receipt.commitOid = offer.commitOid;
+            const records = sessions.get(offer.session) ?? [];
+            records.push(receipt);
+            sessions.set(offer.session, records);
+          }
+          let delta = custodyReturnDelta(
+            this.#kernel,
+            mount,
+            request.requestId,
+            command.baseHead,
+            admittedBase,
+            admittedBase,
+            command.observedHead
+          );
+          if (command.baseHead && command.observedHead !== admittedBase && this.#receipts.covers(mount.workspace, admittedBase, command.baseHead)) {
+            try {
+              delta = {
+                resultBase: command.baseHead,
+                resultPack: this.#kernel.packDelta(mount, request.requestId, admittedBase, command.baseHead),
+                recoveryRequired: false
+              };
+            } catch {
+            }
+          }
           return create26(CustodyAdmissionSchema, {
             main: admittedBase,
-            ...custodyReturnDelta(
-              this.#kernel,
-              mount,
-              request.requestId,
-              command.baseHead,
-              admittedBase,
-              admittedBase,
-              command.observedHead
-            )
+            sessions: [...sessions].map(([session, intents]) => create26(CustodySessionAdmissionSchema, { session, intents })),
+            ...delta
           });
         }
         let main = admittedBase;
         const heldSessions = /* @__PURE__ */ new Map();
+        const receipts = [];
         for (const offer of offers) {
           const heldBehind = heldSessions.get(offer.session);
           const verdict = heldBehind === void 0 ? this.#offer(request, mount, offer) : create26(OfferResponseSchema, { outcome: { case: "blockedOnDependency", value: {
@@ -12142,7 +12310,9 @@ var init_custody_admission_desk = __esm({
             heldSessions.set(offer.session, verdict.outcome.value.offerId || offer.commitOid);
           }
           const records = sessions.get(offer.session) ?? [];
-          records.push(this.#record(offer, verdict));
+          const receipt = this.#record(offer, verdict);
+          records.push(receipt);
+          receipts.push({ change: offer.changeUsda, receipt });
           sessions.set(offer.session, records);
           if (verdict.outcome.case === "admitted") {
             main = verdict.outcome.value.head;
@@ -12158,6 +12328,9 @@ var init_custody_admission_desk = __esm({
             }
           }
         }
+        if (receipts.some((entry) => entry.receipt.outcome.case === "admitted")) {
+          this.#receipts.record(mount.workspace, admittedBase, main, receipts);
+        }
         return create26(CustodyAdmissionSchema, {
           main,
           sessions: [...sessions].map(
@@ -13176,7 +13349,7 @@ var init_application_readiness_desk = __esm({
 });
 
 // ../peer-office/src/runtime/authentication_readiness_desk.ts
-import { create as create34, fromBinary as fromBinary16, toBinary as toBinary13 } from "@bufbuild/protobuf";
+import { create as create34, fromBinary as fromBinary17, toBinary as toBinary14 } from "@bufbuild/protobuf";
 var AuthenticationReadinessDesk;
 var init_authentication_readiness_desk = __esm({
   "../peer-office/src/runtime/authentication_readiness_desk.ts"() {
@@ -13199,7 +13372,7 @@ var init_authentication_readiness_desk = __esm({
       begin(request, input) {
         if (![AuthenticationReadinessCriterion.ENROLLED_DEVICE, AuthenticationReadinessCriterion.PROVIDER_TOKEN, AuthenticationReadinessCriterion.BIRTH_EVIDENCE].includes(input.criterion)) throw new Error("authentication readiness requires a criterion");
         if (!input.session) throw new Error("authentication readiness requires a session");
-        const command = fromBinary16(AwaitAuthenticationRequestSchema, toBinary13(AwaitAuthenticationRequestSchema, input));
+        const command = fromBinary17(AwaitAuthenticationRequestSchema, toBinary14(AwaitAuthenticationRequestSchema, input));
         const now = this.#now();
         for (const [id2, work2] of this.#waiting) if (work2.expiresAt <= now) this.#waiting.delete(id2);
         const work = {
@@ -13989,7 +14162,7 @@ var init_residency_pins = __esm({
 });
 
 // ../peer-office/src/runtime/subscription_manager.ts
-import { clone, create as create39, toBinary as toBinary14 } from "@bufbuild/protobuf";
+import { clone, create as create39, toBinary as toBinary15 } from "@bufbuild/protobuf";
 function createSyntheticRequest(requestId) {
   return create39(RuntimeRequestSchema, {
     protocolVersion: 2,
@@ -14133,7 +14306,7 @@ var init_subscription_manager = __esm({
         const groups = [];
         for (const subscription of this.#subscriptions.values()) {
           if (!matches(subscription) || !subscription.request.query) continue;
-          const declaration = toBinary14(QueryRequestSchema, subscription.request.query);
+          const declaration = toBinary15(QueryRequestSchema, subscription.request.query);
           const session = subscription.request.session;
           const group = groups.find((group2) => group2.session === session && sameBytes(group2.declaration, declaration));
           if (group) group.watches.push(subscription);
@@ -15283,14 +15456,14 @@ var init_local_copy_drop = __esm({
 
 // ../peer-office/src/runtime/preserved_copies_desk.ts
 import { create as create41, fromJsonString, toJsonString } from "@bufbuild/protobuf";
-var PRESERVED_COPIES_NAMESPACE, encoder, decoder, PreservedCopiesDesk;
+var PRESERVED_COPIES_NAMESPACE, encoder2, decoder2, PreservedCopiesDesk;
 var init_preserved_copies_desk = __esm({
   "../peer-office/src/runtime/preserved_copies_desk.ts"() {
     "use strict";
     init_custody_desk_pb();
     PRESERVED_COPIES_NAMESPACE = "nomos.peer-desk.preserved-local-copies/v1";
-    encoder = new TextEncoder();
-    decoder = new TextDecoder();
+    encoder2 = new TextEncoder();
+    decoder2 = new TextDecoder();
     PreservedCopiesDesk = class {
       #store;
       constructor(store) {
@@ -15299,7 +15472,7 @@ var init_preserved_copies_desk = __esm({
       list(workspace) {
         const record = this.#store.list(PRESERVED_COPIES_NAMESPACE).find((entry) => entry.key === workspace);
         if (!record) return [];
-        const values = JSON.parse(decoder.decode(record.value));
+        const values = JSON.parse(decoder2.decode(record.value));
         if (!Array.isArray(values)) {
           throw new Error(`corrupt preserved-copy record for '${workspace}' at revision ${record.revision}`);
         }
@@ -15313,7 +15486,7 @@ var init_preserved_copies_desk = __esm({
           PRESERVED_COPIES_NAMESPACE,
           copy3.workspace,
           current?.revision,
-          encoder.encode(`[${next.map((entry) => toJsonString(PreservedLocalCopySchema, entry)).join(",")}]`)
+          encoder2.encode(`[${next.map((entry) => toJsonString(PreservedLocalCopySchema, entry)).join(",")}]`)
         );
         if (!stored) throw new Error(`preserved copy of '${copy3.workspace}' was not recorded`);
       }
@@ -15322,7 +15495,7 @@ var init_preserved_copies_desk = __esm({
 });
 
 // ../peer-office/src/runtime/office_seat.ts
-import { fromBinary as fromBinary17 } from "@bufbuild/protobuf";
+import { fromBinary as fromBinary18 } from "@bufbuild/protobuf";
 function officeSeat(profile) {
   const origins = /* @__PURE__ */ new Set();
   const add = (url) => {
@@ -15332,7 +15505,7 @@ function officeSeat(profile) {
   add(profile.liveRelayOrigin);
   if (profile.custodianPlacement !== void 0 && profile.custodianPlacement.byteLength > 0) {
     try {
-      for (const remote of fromBinary17(CustodyPlacementPolicySchema, profile.custodianPlacement).remotes) {
+      for (const remote of fromBinary18(CustodyPlacementPolicySchema, profile.custodianPlacement).remotes) {
         add(remote.url);
       }
     } catch {
@@ -15362,7 +15535,7 @@ import { create as create42 } from "@bufbuild/protobuf";
 function readSeal(value) {
   const headerLength = SEAT_PREFIX.length + SEAT_DIGEST_HEX + 1;
   if (value.byteLength < headerLength) return void 0;
-  const text = decoder2.decode(value.subarray(0, headerLength));
+  const text = decoder3.decode(value.subarray(0, headerLength));
   if (!text.startsWith(SEAT_PREFIX) || !text.endsWith("\n")) return void 0;
   const seat = text.slice(SEAT_PREFIX.length, headerLength - 1);
   if (!/^[0-9a-f]{64}$/.test(seat)) return void 0;
@@ -15375,7 +15548,7 @@ function seal(digest, value) {
   sealed.set(value, prefix.byteLength);
   return sealed;
 }
-var QUARANTINED_BINDINGS_NAMESPACE, LOCAL_ONLY_NAMESPACES, SEAT_PREFIX, SEAT_DIGEST_HEX, encoder2, decoder2, header, QuarantineReason, SeatedPeerDeskStore;
+var QUARANTINED_BINDINGS_NAMESPACE, LOCAL_ONLY_NAMESPACES, SEAT_PREFIX, SEAT_DIGEST_HEX, encoder3, decoder3, header, QuarantineReason, SeatedPeerDeskStore;
 var init_seated_peer_desk_store = __esm({
   "../peer-office/src/runtime/seated_peer_desk_store.ts"() {
     "use strict";
@@ -15388,9 +15561,9 @@ var init_seated_peer_desk_store = __esm({
     ]);
     SEAT_PREFIX = "nomos-office-seat/v1:";
     SEAT_DIGEST_HEX = 64;
-    encoder2 = new TextEncoder();
-    decoder2 = new TextDecoder();
-    header = (digest) => encoder2.encode(`${SEAT_PREFIX}${digest}
+    encoder3 = new TextEncoder();
+    decoder3 = new TextDecoder();
+    header = (digest) => encoder3.encode(`${SEAT_PREFIX}${digest}
 `);
     QuarantineReason = Object.freeze({
       /** Another office's seat: a copied state directory, or a store lifted from another peer. */
@@ -15409,44 +15582,44 @@ var init_seated_peer_desk_store = __esm({
         this.#seat = seat;
         this.#report = report;
       }
-      list(namespace) {
-        if (LOCAL_ONLY_NAMESPACES.has(namespace)) return this.#inner.list(namespace);
+      list(namespace2) {
+        if (LOCAL_ONLY_NAMESPACES.has(namespace2)) return this.#inner.list(namespace2);
         const kept = [];
-        for (const record of this.#inner.list(namespace)) {
+        for (const record of this.#inner.list(namespace2)) {
           const sealed = readSeal(record.value);
           if (sealed?.seat === this.#seat.digest) {
             kept.push({ ...record, value: sealed.value.slice() });
             continue;
           }
-          this.#quarantine(namespace, record, sealed?.seat);
+          this.#quarantine(namespace2, record, sealed?.seat);
         }
         return kept;
       }
-      compareExchange(namespace, key2, expectedRevision, value) {
-        if (LOCAL_ONLY_NAMESPACES.has(namespace)) {
-          return this.#inner.compareExchange(namespace, key2, expectedRevision, value);
+      compareExchange(namespace2, key2, expectedRevision, value) {
+        if (LOCAL_ONLY_NAMESPACES.has(namespace2)) {
+          return this.#inner.compareExchange(namespace2, key2, expectedRevision, value);
         }
         const stored = this.#inner.compareExchange(
-          namespace,
+          namespace2,
           key2,
           expectedRevision,
           value === void 0 ? void 0 : seal(this.#seat.digest, value)
         );
         if (stored === void 0) return void 0;
         const sealed = readSeal(stored.value);
-        if (!sealed) throw new Error(`peer desk record '${namespace}/${key2}' lost its office seat`);
+        if (!sealed) throw new Error(`peer desk record '${namespace2}/${key2}' lost its office seat`);
         return { ...stored, value: sealed.value.slice() };
       }
       /** Preserve the foreign record under the quarantine namespace, then free the slot. */
-      #quarantine(namespace, record, recordedSeat) {
-        const key2 = `${namespace}\0${record.key}\0${record.revision}`;
+      #quarantine(namespace2, record, recordedSeat) {
+        const key2 = `${namespace2}\0${record.key}\0${record.revision}`;
         try {
           this.#inner.compareExchange(QUARANTINED_BINDINGS_NAMESPACE, key2, void 0, record.value);
         } catch {
         }
-        this.#inner.compareExchange(namespace, record.key, record.revision, void 0);
+        this.#inner.compareExchange(namespace2, record.key, record.revision, void 0);
         this.#report(create42(QuarantinedBindingSchema, {
-          namespace,
+          namespace: namespace2,
           key: record.key,
           reason: recordedSeat === void 0 ? QuarantineReason.Unseated : QuarantineReason.ForeignSeat,
           recordedSeat: recordedSeat ?? "",
@@ -15505,6 +15678,7 @@ var init_replica_inventory_desk = __esm({
         const undiscovered = /* @__PURE__ */ new Set();
         for (const restored of this.#follows.recover()) {
           following.set(restored.workspace, restored.delayMillis);
+          followed.add(restored.workspace);
         }
         if (!this.#bootstrapped) {
           this.#bootstrapped = true;
@@ -15542,6 +15716,7 @@ var init_replica_inventory_desk = __esm({
               stopped.delete(workspace);
             } else if (reconciliation.changed) {
               following.delete(workspace);
+              followed.delete(workspace);
               stopped.add(workspace);
             }
           } catch (error) {
@@ -15685,7 +15860,7 @@ var init_correspondence_work_registry = __esm({
 });
 
 // ../peer-office/src/runtime/placement_discovery_desk.ts
-import { create as create43, toBinary as toBinary15 } from "@bufbuild/protobuf";
+import { create as create43, toBinary as toBinary16 } from "@bufbuild/protobuf";
 var DiscoveryPhase, PlacementDiscoveryDesk;
 var init_placement_discovery_desk = __esm({
   "../peer-office/src/runtime/placement_discovery_desk.ts"() {
@@ -15746,7 +15921,7 @@ var init_placement_discovery_desk = __esm({
         return {
           workspace: next.workspace,
           nextAfterMillis: 0,
-          frame: toBinary15(RuntimeRequestSchema, create43(RuntimeRequestSchema, {
+          frame: toBinary16(RuntimeRequestSchema, create43(RuntimeRequestSchema, {
             protocolVersion: 2,
             requestId,
             command: { case: "workspacePlacement", value: {
@@ -15833,7 +16008,7 @@ var init_placement_discovery_desk = __esm({
 });
 
 // ../peer-office/src/runtime/live_correspondence_desk.ts
-import { create as create44, fromBinary as fromBinary18, toBinary as toBinary16 } from "@bufbuild/protobuf";
+import { create as create44, fromBinary as fromBinary19, toBinary as toBinary17 } from "@bufbuild/protobuf";
 function presencePeerToken(replicaId2) {
   return sha256Hex(new TextEncoder().encode(`nomos-presence-peer:${replicaId2}`)).slice(0, PRESENCE_PEER_TOKEN_HEX);
 }
@@ -15897,7 +16072,7 @@ var init_live_correspondence_desk = __esm({
           wasResident: this.kernel.isResident(binding.workspace) !== false
         };
         this.#links.set(binding.workspace, link);
-        if (link.wasResident) this.#open(link);
+        if (!link.publisher || link.wasResident) this.#open(link);
       }
       changed(workspace) {
         const link = this.#links.get(workspace);
@@ -15919,11 +16094,14 @@ var init_live_correspondence_desk = __esm({
         this.#effect(link, { case: "openUrl", value: `${endpoint}/v2/workspaces/${encodeURIComponent(link.binding.workspace)}/subscribe?${subscribeQuery(link)}` });
       }
       #send(link, message) {
-        const bytes = toBinary16(LiveOfferFrameSchema, create44(LiveOfferFrameSchema, { message }));
+        const bytes = toBinary17(LiveOfferFrameSchema, create44(LiveOfferFrameSchema, { message }));
         if (bytes.byteLength > MAX_LIVE_FRAME_BYTES) return;
         this.#effect(link, { case: "send", value: bytes });
       }
       export(binding, base, requestId) {
+        if (this.kernel.isResident(binding.workspace) === false) {
+          return create44(CustodyOfferBatchRequestSchema, { protocolVersion: 2 });
+        }
         const mount = workspaceMount(binding.workspace);
         const head = this.kernel.head(mount, requestId);
         if (!base || !head || base === head) return create44(CustodyOfferBatchRequestSchema, { protocolVersion: 2 });
@@ -15969,7 +16147,7 @@ var init_live_correspondence_desk = __esm({
         if (!bytes.byteLength || bytes.byteLength > MAX_LIVE_FRAME_BYTES) return;
         let frame;
         try {
-          frame = fromBinary18(LiveOfferFrameSchema, bytes);
+          frame = fromBinary19(LiveOfferFrameSchema, bytes);
         } catch {
           let ring;
           try {
@@ -15984,6 +16162,7 @@ var init_live_correspondence_desk = __esm({
         }
         if (frame.message.case === "frontier") {
           this.#announced(link, frame.message.value.head);
+          if (this.kernel.isResident(link.binding.workspace) === false) return;
           if (!frame.message.value.response) {
             this.#send(link, { case: "frontier", value: {
               head: this.kernel.head(workspaceMount(link.binding.workspace), ++this.#requestId) ?? "",
@@ -16000,6 +16179,10 @@ var init_live_correspondence_desk = __esm({
         if (frame.message.case !== "offers") return;
         const batch = frame.message.value;
         if (batch.protocolVersion !== 2 || !batch.requestId || batch.source.case !== "inline" || !batch.source.value.offers.length) return;
+        if (this.kernel.isResident(link.binding.workspace) === false) {
+          this.remoteAdvanced?.(link.binding.workspace);
+          return;
+        }
         if ([...this.#pending.values()].some((pending) => pending.link === link && pending.bytes.length === bytes.length && pending.bytes.every((byte, index) => byte === bytes[index]))) return;
         if (this.#pending.size >= 32) return;
         this.#pending.set(request.requestId, { link, bytes });
@@ -16007,7 +16190,16 @@ var init_live_correspondence_desk = __esm({
           protocolVersion: 2,
           requestId: request.requestId,
           target: { workspace: link.binding.workspace, session: link.binding.replicaId },
-          command: { case: "admitCustodyOffers", value: create44(CustodyOfferBatchRequestSchema, { ...batch, baseHead: void 0 }) }
+          // HTTP sender reconciliation controls are not part of a live proposal.
+          // Keeping fastForwardOnly while removing baseHead silently skips every
+          // offer against a nonempty local head. The Kernel judges sealed causality;
+          // live receivers neither ask for a return archive nor confirm the sender.
+          command: { case: "admitCustodyOffers", value: create44(CustodyOfferBatchRequestSchema, {
+            ...batch,
+            baseHead: void 0,
+            observedHead: void 0,
+            fastForwardOnly: false
+          }) }
         });
       }
       /** Upstream news is a frontier this replica has NEVER seen: neither its own head nor the
@@ -16016,6 +16208,10 @@ var init_live_correspondence_desk = __esm({
       #announced(link, head) {
         if (!head || link.lastAnnounced === head) return;
         link.lastAnnounced = head;
+        if (this.kernel.isResident(link.binding.workspace) === false) {
+          this.remoteAdvanced?.(link.binding.workspace);
+          return;
+        }
         const mount = workspaceMount(link.binding.workspace);
         if (head === this.kernel.head(mount, ++this.#requestId) || head === this.kernel.resolveRef(mount, ++this.#requestId, "refs/remotes/nomos/main")) return;
         this.remoteAdvanced?.(link.binding.workspace);
@@ -16025,6 +16221,10 @@ var init_live_correspondence_desk = __esm({
       #placementAnnounced(link, frontier) {
         if (!frontier || link.lastPlacementAnnounced === frontier) return;
         link.lastPlacementAnnounced = frontier;
+        if (this.kernel.isResident(link.binding.workspace) === false) {
+          this.placementAdvanced?.(link.binding.workspace);
+          return;
+        }
         const mount = workspaceMount(link.binding.workspace);
         if (frontier === this.kernel.resolveRef(mount, ++this.#requestId, PLACEMENT_REF2)) return;
         this.placementAdvanced?.(link.binding.workspace);
@@ -16041,11 +16241,13 @@ var init_live_correspondence_desk = __esm({
       disconnect(workspace) {
         const link = this.#links.get(workspace);
         if (!link) return;
+        if (link.state === "open") this.linkClosed?.(workspace);
         this.#effect(link, { case: "close", value: true });
         this.#links.delete(workspace);
         for (const [id, pending] of this.#pending) if (pending.link === link) this.#pending.delete(id);
       }
       #hello(link) {
+        if (this.kernel.isResident(link.binding.workspace) === false) return;
         const head = this.kernel.head(workspaceMount(link.binding.workspace), ++this.#requestId);
         this.#send(link, { case: "frontier", value: { head: head ?? "" } });
       }
@@ -16053,19 +16255,20 @@ var init_live_correspondence_desk = __esm({
         const now = this.clock.monotonicNanoseconds();
         let wake;
         for (const link of this.#links.values()) {
-          if (this.kernel.isResident(link.binding.workspace) === false) {
+          const resident = this.kernel.isResident(link.binding.workspace) !== false;
+          if (link.publisher && !resident) {
             if (link.wasResident) this.disconnect(link.binding.workspace);
             else wake = wake === void 0 || wake > 250n ? 250n : wake;
             continue;
           }
-          link.wasResident = true;
+          if (resident) link.wasResident = true;
           if (link.state === "opening" && now >= link.due) {
             this.#effect(link, { case: "close", value: true });
             link.state = "closed";
           }
           if (link.state === "closed" && now >= link.due) this.#open(link);
           if (link.state === "open") {
-            if (link.dirty) {
+            if (link.dirty && resident) {
               link.dirty = false;
               try {
                 link.published ??= link.publisher ? this.kernel.head(workspaceMount(link.binding.workspace), ++this.#requestId) : this.kernel.resolveRef(workspaceMount(link.binding.workspace), ++this.#requestId, "refs/remotes/nomos/main");
@@ -16084,8 +16287,7 @@ var init_live_correspondence_desk = __esm({
         return wake;
       }
       close() {
-        for (const link of this.#links.values()) this.#effect(link, { case: "close", value: true });
-        this.#links.clear();
+        for (const workspace of [...this.#links.keys()]) this.disconnect(workspace);
         this.#pending.clear();
       }
     };
@@ -16257,9 +16459,9 @@ var init_records_desk = __esm({
           command.namespace === void 0 ? {} : { "custody.children_namespace": command.namespace },
           () => this.#kernel.childWorkspaces(mount, request.requestId)
         );
-        const namespace = command.namespace;
-        const selected = namespace === void 0 ? result.children : result.children.filter(
-          (child) => child.status === ChildWorkspaceLifecycleStatus.ACTIVE && isKeyedBirthOf(namespace, child.workspace)
+        const namespace2 = command.namespace;
+        const selected = namespace2 === void 0 ? result.children : result.children.filter(
+          (child) => child.status === ChildWorkspaceLifecycleStatus.ACTIVE && isKeyedBirthOf(namespace2, child.workspace)
         );
         return create46(ChildWorkspaceListSchema, {
           children: selected.map((child) => create46(ChildWorkspaceSchema, {
@@ -16629,46 +16831,6 @@ var init_recovery_desk = __esm({
   }
 });
 
-// ../peer-office/src/runtime/peer_desk_store.ts
-var recordId, copy2, MemoryPeerDeskStore;
-var init_peer_desk_store = __esm({
-  "../peer-office/src/runtime/peer_desk_store.ts"() {
-    "use strict";
-    recordId = (namespace, key2) => `${namespace.length}:${namespace}${key2}`;
-    copy2 = (record) => ({
-      ...record,
-      value: record.value.slice()
-    });
-    MemoryPeerDeskStore = class {
-      #records = /* @__PURE__ */ new Map();
-      list(namespace) {
-        return [...this.#records.values()].filter((record) => record.namespace === namespace).sort((left, right) => left.key.localeCompare(right.key)).map(copy2);
-      }
-      compareExchange(namespace, key2, expectedRevision, value) {
-        const id = recordId(namespace, key2);
-        const current = this.#records.get(id);
-        if (current?.revision !== expectedRevision) {
-          throw new Error(
-            `peer desk record '${namespace}/${key2}' changed at revision ${current?.revision ?? "absent"}`
-          );
-        }
-        if (value === void 0) {
-          this.#records.delete(id);
-          return void 0;
-        }
-        const next = Object.freeze({
-          namespace,
-          key: key2,
-          revision: (current?.revision ?? 0n) + 1n,
-          value: value.slice()
-        });
-        this.#records.set(id, next);
-        return copy2(next);
-      }
-    };
-  }
-});
-
 // ../peer-office/src/runtime/correspondence_recovery.ts
 import { create as create50 } from "@bufbuild/protobuf";
 var CorrespondenceRecoveryWork;
@@ -16854,7 +17016,7 @@ var init_custody_replacement = __esm({
 });
 
 // ../peer-office/src/runtime/custody_offer.ts
-import { create as create53, fromBinary as fromBinary19, toBinary as toBinary17 } from "@bufbuild/protobuf";
+import { create as create53, fromBinary as fromBinary20, toBinary as toBinary18 } from "@bufbuild/protobuf";
 function settleCustodyOfferExchange(awaiting, response) {
   if (response.status === 202 && response.contentType?.includes("application/json")) {
     try {
@@ -16884,7 +17046,7 @@ function settleCustodyOfferExchange(awaiting, response) {
   }
 }
 function encodeInlineCustodyOffer(args) {
-  return toBinary17(CustodyOfferBatchRequestSchema, create53(CustodyOfferBatchRequestSchema, {
+  return toBinary18(CustodyOfferBatchRequestSchema, create53(CustodyOfferBatchRequestSchema, {
     protocolVersion: 2,
     requestId: args.requestId,
     source: {
@@ -16904,7 +17066,7 @@ function encodeInlineCustodyOffer(args) {
   }));
 }
 function decodeCustodyOffer(bytes, requestId) {
-  const response = fromBinary19(CustodyOfferBatchResponseSchema, bytes);
+  const response = fromBinary20(CustodyOfferBatchResponseSchema, bytes);
   if (response.protocolVersion !== 2 || response.requestId !== requestId) {
     throw new Error("custody offer returned a mismatched generated response");
   }
@@ -17016,7 +17178,7 @@ var init_custody_offer = __esm({
 });
 
 // ../peer-office/src/runtime/workspace_sync.ts
-import { create as create54, fromBinary as fromBinary20 } from "@bufbuild/protobuf";
+import { create as create54, fromBinary as fromBinary21 } from "@bufbuild/protobuf";
 function releaseSyncJudgment(workspace) {
   judgedThisLifetime.delete(workspace);
 }
@@ -17095,6 +17257,7 @@ var init_workspace_sync = __esm({
       #offerSequence = 0;
       #lastStep;
       #probeOnly;
+      #liveConnected;
       /** Set when this round adopted the upstream's own head as its base (see #establishBase). */
       #establishedBase;
       #receiveState;
@@ -17127,6 +17290,7 @@ var init_workspace_sync = __esm({
         this.#directoryAnswered = args.directoryAnswered;
         this.#placementFetched = args.placementFetched;
         this.#probeOnly = args.probeOnly ?? false;
+        this.#liveConnected = args.liveConnected === true;
         this.#receiveState = args.receiveState;
         this.#completeHistory = args.completeHistory === true;
         this.#repairMissingCommit = args.repairMissingCommit === true;
@@ -17197,6 +17361,9 @@ var init_workspace_sync = __esm({
       #openRound() {
         if (this.#receiveState || this.#replaceLocalHead !== void 0) return this.#leaseEffect();
         if (!this.#localHead) return this.#leaseEffect();
+        if (this.#liveConnected && !this.#probeOnly && this.#holdsLocalWork() && this.#previousHead) {
+          return this.#offerOrReconcile();
+        }
         const requestId = `${this.#binding.replicaId}:${this.#requestId}:${this.workId}:frontier`;
         return this.#beginOffer(encodeInlineCustodyOffer({
           session: this.#binding.replicaId,
@@ -17428,6 +17595,18 @@ var init_workspace_sync = __esm({
           return this.#finishOfferOutcome(false);
         }
         const admission = outcome.value;
+        globalThis.__nomosSyncDiagnostic?.("sync.admission", {
+          workspace: this.#mount.workspace,
+          phase: state.phase,
+          local: this.#localHead,
+          tracked: this.#previousHead,
+          remote: admission.main,
+          sealed: admission.sealedMain,
+          resultBase: admission.resultBase,
+          resultBytes: admission.resultPack.byteLength,
+          recoveryRequired: admission.recoveryRequired,
+          summary: summarizeCustodyAdmission(admission)
+        });
         this.#desiredHead = admission.main || void 0;
         if (!this.#desiredHead) return this.#transportFailure("resident peer returned no admitted frontier", false);
         this.#candidateDurable = admission.sealedMain === this.#desiredHead;
@@ -17702,7 +17881,7 @@ var init_workspace_sync = __esm({
       #acceptLawProducts(response) {
         if (response.status !== 200 || response.contentType?.split(";")[0]?.trim() !== LAW_PRODUCTS_MEDIA_TYPE) return;
         try {
-          const exported = fromBinary20(ExportLawProductsResponseSchema, response.body);
+          const exported = fromBinary21(ExportLawProductsResponseSchema, response.body);
           this.#fetchedLawProducts = { head: exported.head, products: exported.products };
         } catch {
         }
@@ -18044,6 +18223,19 @@ var init_workspace_sync = __esm({
         return step;
       }
       #finish(value) {
+        globalThis.__nomosSyncDiagnostic?.("sync.finished", {
+          workspace: value.workspace,
+          previous: value.previousHead,
+          current: value.currentHead,
+          stillAhead: value.stillAhead,
+          deferred: String(value.deferred),
+          admitted: String(value.admitted),
+          reconnect: value.reconnectRequired,
+          directOfferDeferred: value.directOfferDeferred,
+          pushFailed: value.pushFailed,
+          failure: value.pushError?.message,
+          wallMs: elapsedMillis(this.#clock, this.#started)
+        });
         this.#state = { phase: WorkspaceSyncPhase.Done };
         this.#current = void 0;
         return this.#remember({ case: "synced", value });
@@ -18108,6 +18300,10 @@ var init_workspace_sync_dependencies = __esm({
           this.#plan = [this.#args.root];
           return this.#advance();
         }
+        if (this.#args.liveConnected && this.#args.kernel.resolveRef(this.#args.root.mount, this.#args.requestId, trackedMain2)) {
+          this.#plan = this.#planDependencies();
+          return this.#advance();
+        }
         this.#current = this.#work(this.#args.root, `${this.workId}:frontier`, true);
         return this.#accept(this.#current.start());
       }
@@ -18427,7 +18623,7 @@ var init_offer_transport_contract = __esm({
 });
 
 // ../peer-office/src/runtime/workspace_effect_delivery.ts
-import { create as create56, fromBinary as fromBinary21, toBinary as toBinary18 } from "@bufbuild/protobuf";
+import { create as create56, fromBinary as fromBinary22, toBinary as toBinary19 } from "@bufbuild/protobuf";
 function answered(response) {
   const text = (response.contentType ?? "").startsWith("text/") || (response.contentType ?? "").includes("json") ? new TextDecoder().decode(response.body.subarray(0, RETRY_DETAIL_CHARACTERS)).trim() : "";
   return `HTTP ${response.status} ${response.contentType || "without a media type"}${text ? `: ${text}` : ""}`;
@@ -18818,7 +19014,7 @@ var init_workspace_effect_delivery = __esm({
           }
           let status;
           try {
-            status = fromBinary21(WorkspaceEffectStatusResponseSchema, observation.body);
+            status = fromBinary22(WorkspaceEffectStatusResponseSchema, observation.body);
           } catch {
             return this.#transportFailed("mailbox returned an invalid effect observation");
           }
@@ -18833,7 +19029,7 @@ var init_workspace_effect_delivery = __esm({
           return this.#advance(this.#delivery.next(response2, this.#settlement));
         }
         if (receipt.outcome.value.status === 202 && (receipt.outcome.value.contentType ?? "").includes(WORKSPACE_EFFECT_DEFERRED)) {
-          const deferred = fromBinary21(WorkspaceEffectDeferredSchema, receipt.outcome.value.body);
+          const deferred = fromBinary22(WorkspaceEffectDeferredSchema, receipt.outcome.value.body);
           this.#deferredRetryAfterMillis = Math.max(
             this.#deferredRetryAfterMillis ?? 0,
             Number(deferred.retryAfterMillis)
@@ -18858,7 +19054,7 @@ var init_workspace_effect_delivery = __esm({
         }
         let applied;
         try {
-          applied = fromBinary21(OfferResponseSchema, receipt.outcome.value.body);
+          applied = fromBinary22(OfferResponseSchema, receipt.outcome.value.body);
         } catch {
           return this.#transportFailed("remote workspace returned an invalid offer response");
         }
@@ -18980,7 +19176,7 @@ var init_workspace_effect_delivery = __esm({
               url: this.#mailboxUrl,
               contentType: WORKSPACE_EFFECT_STATUS,
               accept: WORKSPACE_EFFECT_STATUS_RESPONSE,
-              body: toBinary18(WorkspaceEffectStatusRequestSchema, create56(WorkspaceEffectStatusRequestSchema, {
+              body: toBinary19(WorkspaceEffectStatusRequestSchema, create56(WorkspaceEffectStatusRequestSchema, {
                 sourceWorkspaceGenesis: offer.sourceWorkspaceGenesis,
                 effectDigest: offer.effectDigest
               }))
@@ -19007,7 +19203,7 @@ var init_workspace_effect_delivery = __esm({
           url: this.#mailboxUrl,
           contentType: CARRIED_OFFER,
           accept: CARRIED_OFFER_RESPONSE,
-          body: toBinary18(OfferRequestSchema, body)
+          body: toBinary19(OfferRequestSchema, body)
         });
         this.#pending = create56(CorrespondencePendingSchema, {
           workId: this.workId,
@@ -19020,7 +19216,7 @@ var init_workspace_effect_delivery = __esm({
 });
 
 // ../peer-office/src/runtime/replica_follow_lane.ts
-import { create as create57, toBinary as toBinary19 } from "@bufbuild/protobuf";
+import { create as create57, toBinary as toBinary20 } from "@bufbuild/protobuf";
 var ReplicaFollowLane;
 var init_replica_follow_lane = __esm({
   "../peer-office/src/runtime/replica_follow_lane.ts"() {
@@ -19102,7 +19298,7 @@ var init_replica_follow_lane = __esm({
         if (action === ReplicaFollowAction.RefreshCredential) {
           return {
             workspace,
-            frame: toBinary19(RuntimeRequestSchema, create57(RuntimeRequestSchema, {
+            frame: toBinary20(RuntimeRequestSchema, create57(RuntimeRequestSchema, {
               protocolVersion: 2,
               requestId,
               command: {
@@ -19117,7 +19313,7 @@ var init_replica_follow_lane = __esm({
         const replaceLocalHead = this.#controller.replacementHead(workspace);
         return {
           workspace,
-          frame: toBinary19(RuntimeRequestSchema, create57(RuntimeRequestSchema, {
+          frame: toBinary20(RuntimeRequestSchema, create57(RuntimeRequestSchema, {
             protocolVersion: 2,
             requestId,
             command: {
@@ -19314,7 +19510,7 @@ var init_http_obligation_delivery = __esm({
 });
 
 // ../peer-office/src/runtime/correspondence_desk.ts
-import { create as create59, toBinary as toBinary20 } from "@bufbuild/protobuf";
+import { create as create59, toBinary as toBinary21 } from "@bufbuild/protobuf";
 var REFETCH_AWAITS_PROVIDER, LOCAL_COPY_REFETCHING, CorrespondenceDesk;
 var init_correspondence_desk = __esm({
   "../peer-office/src/runtime/correspondence_desk.ts"() {
@@ -19372,6 +19568,7 @@ var init_correspondence_desk = __esm({
       #onSyncCompleted;
       #onPlacementFetched;
       #onShallowMount;
+      #onOutboxHistoryRequired;
       #remoteOffers = new CorrespondenceWorkRegistry();
       #recoveries = new CorrespondenceWorkRegistry();
       #deliveries = new CorrespondenceWorkRegistry();
@@ -19418,6 +19615,7 @@ var init_correspondence_desk = __esm({
         this.#onSyncCompleted = args.onSyncCompleted;
         this.#onPlacementFetched = args.onPlacementFetched;
         this.#onShallowMount = args.onShallowMount;
+        this.#onOutboxHistoryRequired = args.onOutboxHistoryRequired;
         this.#clock = args.clock;
         this.#outboxClock = new OutboxObservationClock(args.clock, args.peerIdentity);
         this.#executesCustodianObligations = args.executesCustodianObligations ?? false;
@@ -19581,6 +19779,15 @@ var init_correspondence_desk = __esm({
         this.#followLane.dependencyAdvanced(workspace);
         this.reportFollows();
       }
+      /** Received custody can release correspondence and foreign-read dependencies,
+       * but is not newly authored work to send back to its upstream. Recovery is
+       * driven separately by missing history, reconnects and provider announcements.
+       * In particular an optimistic relay is not a durable upstream receipt. */
+      receivedFrontierChanged(workspace) {
+        this.wakeOutbox(workspace);
+        this.#followLane.dependencyAdvanced(workspace);
+        this.reportFollows();
+      }
       /**
        * Tell a workspace's sessions what its durable follow ALREADY knows.
        *
@@ -19817,8 +20024,16 @@ var init_correspondence_desk = __esm({
             )
           );
         } catch (error) {
+          if (error instanceof KernelHistoryRequired && this.#onOutboxHistoryRequired) {
+            const retry = this.#onOutboxHistoryRequired(workspace, binding.credentialCapability);
+            this.#outboxDueAt.set(workspace, now + Math.max(250, retry));
+            return { nextAfterMillis: 0 };
+          }
           const format = localCopyFormatRefusal(error);
-          if (format === void 0) throw error;
+          if (format === void 0) {
+            this.#outboxDueAt.set(workspace, now + 3e4);
+            return { nextAfterMillis: 0 };
+          }
           this.#readability.mark(workspace, void 0, format);
           this.#outboxDueAt.delete(workspace);
           return { nextAfterMillis: 0 };
@@ -19899,7 +20114,7 @@ var init_correspondence_desk = __esm({
         };
         return {
           workspace,
-          frame: toBinary20(RuntimeRequestSchema, create59(RuntimeRequestSchema, {
+          frame: toBinary21(RuntimeRequestSchema, create59(RuntimeRequestSchema, {
             protocolVersion: 2,
             requestId,
             target: { workspace, session: binding.session },
@@ -20098,6 +20313,7 @@ var init_correspondence_desk = __esm({
             requestId: request.requestId,
             workId: id,
             probeOnly,
+            liveConnected: this.#openLinks.has(target3.mount.workspace),
             ...beforeConverge === void 0 ? {} : { beforeConverge },
             ...target3.receiveState === void 0 ? {} : { receiveState: target3.receiveState },
             ...target3.offerHead === void 0 ? {} : { offerHead: target3.offerHead },
@@ -20125,6 +20341,7 @@ var init_correspondence_desk = __esm({
             root,
             work,
             outbound: command.admit,
+            liveConnected: this.#openLinks.has(mount.workspace),
             dependency: (workspace, source, acquire2 = false) => {
               if (this.#roundInFlight(workspace, workId2)) return void 0;
               const existing = this.#follows.bindingForWorkspace(workspace);
@@ -20595,7 +20812,7 @@ var init_identity_witness_cache = __esm({
 });
 
 // ../peer-office/src/runtime/identity_witness_read.ts
-import { create as create62, fromBinary as fromBinary22, toBinary as toBinary21 } from "@bufbuild/protobuf";
+import { create as create62, fromBinary as fromBinary23, toBinary as toBinary22 } from "@bufbuild/protobuf";
 function prepareWitnessRead(args) {
   if (args.reception.workspace !== args.rootWorkspace) {
     throw new Error("identity-provider witness route addresses another workspace");
@@ -20633,7 +20850,7 @@ function prepareWitnessRead(args) {
           contentType: "application/vnd.nomos.runtime-request+protobuf",
           accept: "application/vnd.nomos.runtime-response+protobuf",
           bearerToken: args.bearerToken.slice(),
-          body: toBinary21(RuntimeRequestSchema, request),
+          body: toBinary22(RuntimeRequestSchema, request),
           // Opening provider custody from cold storage can exceed 30 seconds.
           timeoutMillis: 5 * 6e4
         })
@@ -20663,7 +20880,7 @@ function acceptWitnessResponse(pending, receipt) {
       `identity-provider witness receipt '${receipt.effectId}' does not answer '${pending.effectId}'`
     );
   }
-  const response = fromBinary22(RuntimeResponseSchema, responseBody2(receipt));
+  const response = fromBinary23(RuntimeResponseSchema, responseBody2(receipt));
   if (response.protocolVersion !== RUNTIME_V2_PROTOCOL_VERSION) {
     throw new Error("identity-provider root returned an incompatible runtime response");
   }
@@ -21029,7 +21246,7 @@ var init_admission_durability_desk = __esm({
 });
 
 // ../peer-office/src/runtime/identity_recovery_desk.ts
-import { create as create66, fromBinary as fromBinary23, toBinary as toBinary22 } from "@bufbuild/protobuf";
+import { create as create66, fromBinary as fromBinary24, toBinary as toBinary23 } from "@bufbuild/protobuf";
 var cloneCall, IdentityRecoveryDesk;
 var init_identity_recovery_desk = __esm({
   "../peer-office/src/runtime/identity_recovery_desk.ts"() {
@@ -21038,7 +21255,7 @@ var init_identity_recovery_desk = __esm({
     init_credentials_desk_pb();
     init_identity_desk_pb();
     init_application_desk_pb();
-    cloneCall = (call) => fromBinary23(CallRequestSchema, toBinary22(CallRequestSchema, call));
+    cloneCall = (call) => fromBinary24(CallRequestSchema, toBinary23(CallRequestSchema, call));
     IdentityRecoveryDesk = class {
       #identity;
       #application;
@@ -21056,7 +21273,7 @@ var init_identity_recovery_desk = __esm({
         if (!command.request || !["query", "offer"].includes(command.request.operation.case ?? "")) {
           throw new Error("identity-provider recovery demand did not originate from an application call");
         }
-        const originalCall = toBinary22(CallRequestSchema, command.request);
+        const originalCall = toBinary23(CallRequestSchema, command.request);
         const step = this.#identity.execute(
           runtimeRequest,
           create66(IdentityProviderWitnessRequestSchema, {
@@ -21136,7 +21353,7 @@ var init_identity_recovery_desk = __esm({
         }
       }
       #adoptAndRetry(runtimeRequest, command, originalCall, requirement, ready) {
-        const original = fromBinary23(CallRequestSchema, originalCall);
+        const original = fromBinary24(CallRequestSchema, originalCall);
         const query2 = original.operation.case === "query" ? original.operation.value : void 0;
         const offer = original.operation.case === "offer" ? original.operation.value : void 0;
         const target3 = query2?.target ?? offer?.target;
@@ -21184,7 +21401,7 @@ var init_identity_recovery_desk = __esm({
         const retryCommand = create66(KernelCallRequestSchema, {
           session: command.session,
           credentialUse: command.credentialUse,
-          request: cloneCall(fromBinary23(CallRequestSchema, originalCall))
+          request: cloneCall(fromBinary24(CallRequestSchema, originalCall))
         });
         const retried = this.#application.call(runtimeRequest, retryCommand);
         if (retried.outcome.case === "failure" && retried.outcome.value.identityProviderWitnessRequired) {
@@ -21258,7 +21475,7 @@ var init_peer_maintenance_scheduler = __esm({
 });
 
 // ../peer-office/src/runtime/peer_background_scheduler.ts
-import { create as create67, toBinary as toBinary23 } from "@bufbuild/protobuf";
+import { create as create67, toBinary as toBinary24 } from "@bufbuild/protobuf";
 function yielding(paper) {
   if (paper.frame !== void 0 || paper.nextAfterMillis === void 0 || paper.nextAfterMillis > 0) return paper;
   return { ...paper, nextAfterMillis: BACKGROUND_CONTINUATION_YIELD_MILLIS };
@@ -21298,7 +21515,7 @@ var init_peer_background_scheduler = __esm({
         const recovery = retentionOnly ? {} : this.#subscriptions.nextRecovery(id, excludedWorkspaces);
         if (recovery.request) {
           return {
-            frame: toBinary23(RuntimeRequestSchema, recovery.request),
+            frame: toBinary24(RuntimeRequestSchema, recovery.request),
             nextAfterMillis: 0,
             workspace: recovery.request.target.workspace
           };
@@ -21306,7 +21523,7 @@ var init_peer_background_scheduler = __esm({
         const retention = this.#residency.nextRetention();
         if (retention.request !== void 0) {
           return {
-            frame: toBinary23(RuntimeRequestSchema, create67(RuntimeRequestSchema, {
+            frame: toBinary24(RuntimeRequestSchema, create67(RuntimeRequestSchema, {
               protocolVersion: 2,
               requestId: id,
               command: {
@@ -21323,7 +21540,7 @@ var init_peer_background_scheduler = __esm({
         const convergence = this.#receivingGroup.nextBackgroundPaper(id, excludedWorkspaces);
         if (convergence.frame !== void 0) {
           return {
-            frame: toBinary23(RuntimeRequestSchema, convergence.frame),
+            frame: toBinary24(RuntimeRequestSchema, convergence.frame),
             nextAfterMillis: 0,
             ...convergence.workspace === void 0 ? {} : { workspace: convergence.workspace }
           };
@@ -21384,7 +21601,7 @@ var init_peer_background_scheduler = __esm({
         const recovery = this.#subscriptions.nextRecovery(id, excluded);
         if (recovery.request) {
           return {
-            frame: toBinary23(RuntimeRequestSchema, recovery.request),
+            frame: toBinary24(RuntimeRequestSchema, recovery.request),
             nextAfterMillis: 0,
             workspace: recovery.request.target.workspace
           };
@@ -21392,7 +21609,7 @@ var init_peer_background_scheduler = __esm({
         const convergence = this.#receivingGroup.nextBackgroundPaper(id, excluded);
         if (convergence.frame !== void 0) {
           return {
-            frame: toBinary23(RuntimeRequestSchema, convergence.frame),
+            frame: toBinary24(RuntimeRequestSchema, convergence.frame),
             nextAfterMillis: 0,
             ...convergence.workspace === void 0 ? {} : { workspace: convergence.workspace }
           };
@@ -21764,7 +21981,7 @@ var init_history_acquisition_state = __esm({
 });
 
 // ../peer-office/src/runtime/history_acquisition_desk.ts
-import { create as create69, toBinary as toBinary24 } from "@bufbuild/protobuf";
+import { create as create69, toBinary as toBinary25 } from "@bufbuild/protobuf";
 function assertState2(record, state) {
   switch (state.case) {
     case HistoryAcquisitionPhase.Desired:
@@ -21783,7 +22000,7 @@ function assertState2(record, state) {
   }
   throw corrupt2(record, `invalid '${state.case}' state`);
 }
-var HISTORY_ACQUISITION_NAMESPACE, HISTORY_BACKGROUND_START_MILLIS, SLICE_ANSWER_MILLIS, encoder3, decoder3, workId, effectId, encode2, upgraded, decode2, corrupt2, HistoryAcquisitionDesk;
+var HISTORY_ACQUISITION_NAMESPACE, HISTORY_BACKGROUND_START_MILLIS, SLICE_ANSWER_MILLIS, encoder4, decoder4, workId, effectId, encode2, upgraded, decode2, corrupt2, HistoryAcquisitionDesk;
 var init_history_acquisition_desk = __esm({
   "../peer-office/src/runtime/history_acquisition_desk.ts"() {
     "use strict";
@@ -21794,15 +22011,15 @@ var init_history_acquisition_desk = __esm({
     HISTORY_ACQUISITION_NAMESPACE = "nomos.peer-desk.history-acquisition/v1";
     HISTORY_BACKGROUND_START_MILLIS = 1e4;
     SLICE_ANSWER_MILLIS = 5 * 6e4;
-    encoder3 = new TextEncoder();
-    decoder3 = new TextDecoder();
+    encoder4 = new TextEncoder();
+    decoder4 = new TextDecoder();
     workId = (workspace) => `history-acquisition:${workspace}`;
     effectId = (workspace, attempt) => `history-acquisition:${workspace}:${HistoryAcquisitionPhase.Acquiring}:${attempt}`;
     encode2 = (work) => {
       if (!work.credentialCapability) {
         throw new Error(`history acquisition for '${work.workspace}' has not restored its credential capability`);
       }
-      return encoder3.encode(JSON.stringify({
+      return encoder4.encode(JSON.stringify({
         version: 2,
         workspace: work.workspace,
         credentialCapability: work.credentialCapability,
@@ -21811,7 +22028,7 @@ var init_history_acquisition_desk = __esm({
     };
     upgraded = (state) => state.case === "backoff" ? { case: HistoryAcquisitionPhase.Paced, attempt: state.attempt, delayMillis: state.delayMillis, failed: true } : state;
     decode2 = (record) => {
-      const value = JSON.parse(decoder3.decode(record.value));
+      const value = JSON.parse(decoder4.decode(record.value));
       if (!value || typeof value !== "object") throw corrupt2(record, "not an object");
       const candidate = value;
       if (candidate.version !== 1 && candidate.version !== 2 || candidate.workspace !== record.key || !candidate.state) {
@@ -21856,6 +22073,21 @@ var init_history_acquisition_desk = __esm({
         this.#ensure(workspace, credentialCapability);
         this.#dueAt.set(workspace, this.#now() + HISTORY_BACKGROUND_START_MILLIS);
       }
+      /** A background kernel read needs an omitted ancestor now. Queue one bounded
+       * slice on the existing history lane; a failed slice keeps its retry pace. */
+      requestFromBackground(workspace, credentialCapability) {
+        if (!workspace) throw new Error("kernel history requirement names no workspace");
+        this.#ensure(workspace, credentialCapability);
+        const work = this.#get(workspace);
+        const now = this.#now();
+        if (work.state.case === HistoryAcquisitionPhase.Paced && work.state.failed) {
+          const due2 = this.#dueAt.get(workspace) ?? now + work.state.delayMillis;
+          this.#dueAt.set(workspace, due2);
+          if (due2 > now) return due2 - now;
+        }
+        this.#dueAt.set(workspace, now);
+        return 250;
+      }
       /** An operation needs history this custody lacks: its next slice now, joining one in flight. */
       begin(workspace, credentialCapability) {
         if (!workspace) throw new Error("kernel history requirement names no workspace");
@@ -21952,7 +22184,7 @@ var init_history_acquisition_desk = __esm({
         return {
           workspace: next.workspace,
           nextAfterMillis: 0,
-          frame: toBinary24(RuntimeRequestSchema, create69(RuntimeRequestSchema, {
+          frame: toBinary25(RuntimeRequestSchema, create69(RuntimeRequestSchema, {
             protocolVersion: 2,
             requestId,
             target: { workspace: next.workspace, session: `history-materialisation:${next.workspace}` },
@@ -22053,7 +22285,7 @@ var init_history_acquisition_desk = __esm({
 });
 
 // ../peer-office/src/peer_office.ts
-import { create as create70, toBinary as toBinary25 } from "@bufbuild/protobuf";
+import { create as create70, toBinary as toBinary26 } from "@bufbuild/protobuf";
 function isAnsweredStateRead(command, response) {
   if (command.request?.operation.case !== "query" || response.outcome.case !== "query" || response.outcome.value.result.case === "readIndexPending") return false;
   switch (command.request.operation.value.query.case) {
@@ -22095,6 +22327,7 @@ var init_peer_office = __esm({
     init_credentials_desk_pb();
     init_framework_pb();
     init_sha256();
+    init_custody_receipts();
     init_custodian_placement();
     init_custody_admission_desk();
     init_kernel_queries();
@@ -22240,7 +22473,7 @@ var init_peer_office = __esm({
           this.#trace,
           this.#readability
         );
-        this.#custodyAdmission = new CustodyAdmissionDesk(this.#kernel, this.#custody);
+        this.#custodyAdmission = new CustodyAdmissionDesk(this.#kernel, this.#custody, new CustodyReceipts(seatedStore));
         this.#queries = new KernelQueries(this.#kernel, this.#credentials);
         this.#follows = new ReplicaFollowController(
           new ReplicaFollowDesk(seatedStore),
@@ -22402,6 +22635,7 @@ var init_peer_office = __esm({
           // Lazy history: a head-only mount materialises its history in the background, never on
           // the path of an operation (architecture/lazy_history.md).
           onShallowMount: (workspace, credentialCapability) => this.#historyAcquisition.materialise(workspace, credentialCapability),
+          onOutboxHistoryRequired: (workspace, credentialCapability) => this.#historyAcquisition.requestFromBackground(workspace, credentialCapability),
           onSyncCompleted: (session, event) => {
             if (event.result?.workspace) {
               this.#replicaInventory.placementMayHaveChanged(event.result.workspace);
@@ -22751,7 +22985,7 @@ var init_peer_office = __esm({
         this.#origins.observeReceipt(request);
         const response = this.#fenced(this.#handleRequest(request));
         this.#paperSlots.answered(request, response, (session) => this.#sessions.bindingIfPresent(session)?.workspace);
-        return { responseProtobuf: toBinary25(RuntimeResponseSchema, response) };
+        return { responseProtobuf: toBinary26(RuntimeResponseSchema, response) };
       }
       /** Every response leaving the office passes the origin fence (see fenceEffects). */
       #fenced(response) {
@@ -22868,8 +23102,8 @@ var init_peer_office = __esm({
           this.#replicaInventory.placementMayHaveChanged(workspace);
         }
       }
-      /** Execute a typed paper after the access desk; never skip lifecycle or
-       * session-binding checks merely because its caller is another local desk. */
+      /** Execute a typed paper after the access desk. Custody admission addresses a
+       * workspace by replica identity; application calls retain session binding. */
       #dispatchRequest(request) {
         validateRuntimeV2Request(request);
         try {
@@ -22883,18 +23117,20 @@ var init_peer_office = __esm({
             if (!request.target.workspace || !request.target.session) {
               throw new Error("addressed runtime request requires workspace and session");
             }
-            const binding = this.#sessions.bindingIfPresent(request.target.session);
-            if (binding !== void 0) {
-              if (binding.workspace !== request.target.workspace) {
-                throw new Error(
-                  `session '${request.target.session}' is bound to workspace '${binding.workspace}', not '${request.target.workspace}'`
-                );
+            if (request.command.case !== "admitCustodyOffers") {
+              const binding = this.#sessions.bindingIfPresent(request.target.session);
+              if (binding !== void 0) {
+                if (binding.workspace !== request.target.workspace) {
+                  throw new Error(
+                    `session '${request.target.session}' is bound to workspace '${binding.workspace}', not '${request.target.workspace}'`
+                  );
+                }
+              } else {
+                this.#bindInteraction(create70(BindSessionRequestSchema, {
+                  session: request.target.session,
+                  workspace: request.target.workspace
+                }));
               }
-            } else {
-              this.#bindInteraction(create70(BindSessionRequestSchema, {
-                session: request.target.session,
-                workspace: request.target.workspace
-              }));
             }
           }
           switch (request.command.case) {
@@ -23091,7 +23327,7 @@ var init_peer_office = __esm({
                     ReadMaintenanceCause.ADMITTED_OFFER
                   );
                   this.#subscriptions.refreshWorkspace(request.target.workspace);
-                  this.#correspondence.workspaceFrontierChanged(request.target.workspace);
+                  this.#correspondence.receivedFrontierChanged(request.target.workspace);
                 }
                 return this.#birthCustodyResponse(
                   request,
@@ -23670,6 +23906,15 @@ function createBackgroundLanes(options) {
   const correspondenceNotBefore = /* @__PURE__ */ new Map();
   let retention = 0;
   let closed = false;
+  let selectionFailures = 0;
+  const selectionFault = (error) => {
+    try {
+      options.onSelectionError?.(error);
+    } catch {
+    }
+    selectionFailures += 1;
+    wake(Math.min(3e4, 250 * 2 ** Math.min(selectionFailures - 1, 7)));
+  };
   const wake = (delayMillis = 0) => {
     if (closed) return;
     const delay = Math.max(0, Math.ceil(delayMillis));
@@ -23680,53 +23925,58 @@ function createBackgroundLanes(options) {
     }
     wakeAt = at;
     timer = setTimer(() => {
-      timer = void 0;
-      wakeAt = void 0;
-      if (closed) return;
-      const now = options.monotonicNanoseconds();
-      for (const [workspace2, at2] of correspondenceNotBefore) {
-        if (at2 <= now) correspondenceNotBefore.delete(workspace2);
-      }
-      const backoffMillis = correspondenceNotBefore.size ? Math.min(...[...correspondenceNotBefore.values()].map((at2) => Number((at2 - now + 999999n) / 1000000n))) : void 0;
-      const retentionOnly = correspondenceInFlight;
-      const next = options.nextPaper(retentionOnly, new Set(correspondenceNotBefore.keys()));
-      if (next.frame === void 0) {
-        const delays = [next.nextAfterMillis, backoffMillis].filter((delay2) => delay2 !== void 0);
-        if (delays.length) wake(Math.min(...delays));
-        return;
-      }
-      if (options.isRetention(next.frame)) {
-        retention += 1;
+      try {
+        timer = void 0;
+        wakeAt = void 0;
+        if (closed) return;
+        const now = options.monotonicNanoseconds();
+        for (const [workspace2, at2] of correspondenceNotBefore) {
+          if (at2 <= now) correspondenceNotBefore.delete(workspace2);
+        }
+        const backoffMillis = correspondenceNotBefore.size ? Math.min(...[...correspondenceNotBefore.values()].map((at2) => Number((at2 - now + 999999n) / 1000000n))) : void 0;
+        const retentionOnly = correspondenceInFlight;
+        const next = options.nextPaper(retentionOnly, new Set(correspondenceNotBefore.keys()));
+        selectionFailures = 0;
+        if (next.frame === void 0) {
+          const delays = [next.nextAfterMillis, backoffMillis].filter((delay2) => delay2 !== void 0);
+          if (delays.length) wake(Math.min(...delays));
+          return;
+        }
+        if (options.isRetention(next.frame)) {
+          retention += 1;
+          void options.drive(next.frame).then(
+            () => {
+              retention -= 1;
+              wake(0);
+            },
+            () => {
+              retention -= 1;
+              wake(0);
+            }
+          );
+          wake(next.nextAfterMillis ?? 0);
+          return;
+        }
+        if (retentionOnly) throw new Error("background desk reserved correspondence while its lane was unavailable");
+        const workspace = next.workspace;
+        if (!workspace) throw new Error("background correspondence has no source workspace");
+        if (correspondenceNotBefore.has(workspace)) throw new Error("background desk bypassed a workspace's physical backoff");
+        correspondenceInFlight = true;
         void options.drive(next.frame).then(
           () => {
-            retention -= 1;
-            wake(0);
+            correspondenceInFlight = false;
+            wake(next.nextAfterMillis ?? 0);
           },
           () => {
-            retention -= 1;
+            correspondenceInFlight = false;
+            correspondenceNotBefore.set(workspace, options.monotonicNanoseconds() + BigInt(failureBackoffMillis) * 1000000n);
             wake(0);
           }
         );
-        wake(next.nextAfterMillis ?? 0);
-        return;
+        wake(0);
+      } catch (error) {
+        selectionFault(error);
       }
-      if (retentionOnly) throw new Error("background desk reserved correspondence while its lane was unavailable");
-      const workspace = next.workspace;
-      if (!workspace) throw new Error("background correspondence has no source workspace");
-      if (correspondenceNotBefore.has(workspace)) throw new Error("background desk bypassed a workspace's physical backoff");
-      correspondenceInFlight = true;
-      void options.drive(next.frame).then(
-        () => {
-          correspondenceInFlight = false;
-          wake(next.nextAfterMillis ?? 0);
-        },
-        () => {
-          correspondenceInFlight = false;
-          correspondenceNotBefore.set(workspace, options.monotonicNanoseconds() + BigInt(failureBackoffMillis) * 1000000n);
-          wake(0);
-        }
-      );
-      wake(0);
     }, delay);
   };
   return {
@@ -23754,7 +24004,7 @@ var init_background_lanes = __esm({
 });
 
 // ../peer-office/src/runtime/frame_runner.ts
-import { fromBinary as fromBinary24 } from "@bufbuild/protobuf";
+import { fromBinary as fromBinary25 } from "@bufbuild/protobuf";
 function createPeerOfficeFrameRunner(kernel, credentials, profile, observations, custody, postEvent, maintenanceSettled, driveBackground, peerDeskStore, executeBackground) {
   if (!peerDeskStore) {
     throw new Error("Peer Office frame runner requires an explicit PeerDeskStore capability");
@@ -23775,7 +24025,7 @@ function createPeerOfficeFrameRunner(kernel, credentials, profile, observations,
       const event = peer2.nextEvent();
       if (event === void 0) return;
       if (maintenanceSettled !== void 0) {
-        const decoded = fromBinary24(RuntimeEventSchema, event);
+        const decoded = fromBinary25(RuntimeEventSchema, event);
         if (decoded.event.case === "maintenanceProgress" && decoded.event.value.kernel && !decoded.event.value.kernel.maintenancePending) {
           maintenanceSettled(decoded.event.value);
         }
@@ -23810,11 +24060,12 @@ function createPeerOfficeFrameRunner(kernel, credentials, profile, observations,
       return paper;
     },
     drive: (frame) => driveBackground(frame).catch((error) => {
-      peer2.backgroundPaperAbandoned(fromBinary24(RuntimeRequestSchema, frame).requestId);
+      peer2.backgroundPaperAbandoned(fromBinary25(RuntimeRequestSchema, frame).requestId);
       throw error;
     }),
-    isRetention: (frame) => fromBinary24(RuntimeRequestSchema, frame).command.case === "retainFrontier",
-    monotonicNanoseconds: () => observations.monotonicNanoseconds()
+    isRetention: (frame) => fromBinary25(RuntimeRequestSchema, frame).command.case === "retainFrontier",
+    monotonicNanoseconds: () => observations.monotonicNanoseconds(),
+    onSelectionError: (error) => console.error("Nomos background paper selection failed", error)
   });
   const scheduleCorrespondence = (delayMillis = 0) => {
     lanes?.wake(delayMillis);
@@ -23823,7 +24074,7 @@ function createPeerOfficeFrameRunner(kernel, credentials, profile, observations,
     handleFrame(frame) {
       const response = peer2.invoke(frame).responseProtobuf;
       drainEvents();
-      if (fromBinary24(RuntimeRequestSchema, frame).command.case !== "workspaceStatus") {
+      if (fromBinary25(RuntimeRequestSchema, frame).command.case !== "workspaceStatus") {
         scheduleMaintenance();
         scheduleCorrespondence();
       }
@@ -23885,21 +24136,21 @@ var init_frame_runner = __esm({
 });
 
 // ../peer-office/src/runtime/platform_effect_driver.ts
-import { create as create71, fromBinary as fromBinary25, toBinary as toBinary26 } from "@bufbuild/protobuf";
+import { create as create71, fromBinary as fromBinary26, toBinary as toBinary27 } from "@bufbuild/protobuf";
 async function drivePeerFrame(runner, initialFrame, fetchImpl = globalThis.fetch, custody, bornCustody, credentialRefresh, yieldWakeToCaller = false, deviceIdentity, lawPackage, yieldLocalReadToCaller = false, yieldHistoryToCaller = false, performExternalEffect) {
   const persistBornCustody = bornCustody ?? (custody?.persistBornCustody ? (effect) => custody.persistBornCustody(effect) : void 0);
   let responseFrame = runner.handleFrame(initialFrame);
   const satisfied = /* @__PURE__ */ new Set();
   const resendable = (() => {
     try {
-      return fromBinary25(RuntimeRequestSchema, initialFrame).command.case !== "continueCorrespondence";
+      return fromBinary26(RuntimeRequestSchema, initialFrame).command.case !== "continueCorrespondence";
     } catch {
       return false;
     }
   })();
   let historyRetries = 0;
   for (; ; ) {
-    const response = fromBinary25(RuntimeResponseSchema, responseFrame);
+    const response = fromBinary26(RuntimeResponseSchema, responseFrame);
     if (response.outcome.case === "historyAcquired" && resendable && historyRetries < 32) {
       historyRetries += 1;
       responseFrame = runner.handleFrame(initialFrame);
@@ -23909,7 +24160,7 @@ async function drivePeerFrame(runner, initialFrame, fetchImpl = globalThis.fetch
       if (yieldLocalReadToCaller) return responseFrame;
       const pending2 = response.outcome.value;
       await new Promise((resolve4) => setTimeout(resolve4, pending2.resumeAfterMillis));
-      responseFrame = runner.handleFrame(toBinary26(RuntimeRequestSchema, create71(RuntimeRequestSchema, {
+      responseFrame = runner.handleFrame(toBinary27(RuntimeRequestSchema, create71(RuntimeRequestSchema, {
         protocolVersion: response.protocolVersion,
         requestId: response.requestId,
         command: { case: "continueLocalRead", value: create71(ContinueLocalReadRequestSchema, { workId: pending2.workId }) }
@@ -24009,7 +24260,7 @@ async function drivePeerFrame(runner, initialFrame, fetchImpl = globalThis.fetch
           outcome: { case: "failure", value: { reason: PeerEffectFailureReason.TRANSPORT, message: error instanceof Error ? error.message : String(error) } }
         });
       }
-      responseFrame = runner.handleFrame(toBinary26(RuntimeRequestSchema, create71(RuntimeRequestSchema, {
+      responseFrame = runner.handleFrame(toBinary27(RuntimeRequestSchema, create71(RuntimeRequestSchema, {
         protocolVersion: response.protocolVersion,
         requestId: response.requestId,
         command: { case: "continueCorrespondence", value: { workId: pending.workId, receipt: receipt2 } }
@@ -24037,7 +24288,7 @@ async function drivePeerFrame(runner, initialFrame, fetchImpl = globalThis.fetch
     }) : pending.effect.case === "retainFrontier" ? await executeRetainFrontierEffect(pending.effect.value, custody) : pending.effect.case === "wake" ? await executeWakeEffect(pending.effect.value) : pending.effect.case === "refreshCredential" ? await executeCredentialRefreshEffect(pending.effect.value, credentialRefresh) : pending.effect.case === "deviceIdentity" ? await executeDeviceIdentityEffect(pending.effect.value, deviceIdentity) : pending.effect.case === "lawPackage" ? await executeLawPackageEffect(pending.effect.value, lawPackage) : pending.effect.case === "historyAcquisition" ? await executeHistoryAcquisitionEffect(pending.effect.value, custody) : (() => {
       throw new Error(`correspondence work '${pending.workId}' has no effect`);
     })();
-    responseFrame = runner.handleFrame(toBinary26(RuntimeRequestSchema, create71(RuntimeRequestSchema, {
+    responseFrame = runner.handleFrame(toBinary27(RuntimeRequestSchema, create71(RuntimeRequestSchema, {
       protocolVersion: response.protocolVersion,
       requestId: response.requestId,
       command: {
@@ -24109,11 +24360,11 @@ async function executeDeviceIdentityEffect(effect, store) {
       await store.save(effect.identity, effect.operation.value.secret.slice());
     } else if (effect.operation.case === "loadRecovery") {
       const bytes = await store.load(`nomos-device-recovery-v1|${effect.identity}`);
-      if (bytes !== void 0) recovery = fromBinary25(DeviceRecoveryRecordSchema, bytes);
+      if (bytes !== void 0) recovery = fromBinary26(DeviceRecoveryRecordSchema, bytes);
     } else if (effect.operation.case === "saveRecovery") {
       const record = effect.operation.value.record;
       if (!record) throw new Error("device recovery save contains no record");
-      await store.save(`nomos-device-recovery-v1|${effect.identity}`, toBinary26(DeviceRecoveryRecordSchema, record));
+      await store.save(`nomos-device-recovery-v1|${effect.identity}`, toBinary27(DeviceRecoveryRecordSchema, record));
     } else throw new Error("device identity effect has no operation");
     return create71(PeerEffectReceiptSchema, { effectId: effect.effectId, outcome: {
       case: "deviceIdentity",
@@ -24225,7 +24476,7 @@ var init_platform_effect_driver = __esm({
     correspondenceWakeups = /* @__PURE__ */ new WeakMap();
     deliveryIdentity = (requestFrame) => {
       try {
-        const request = fromBinary25(RuntimeRequestSchema, requestFrame);
+        const request = fromBinary26(RuntimeRequestSchema, requestFrame);
         if (request.command.case !== "deliverWorkspaceEffects") return void 0;
         const command = request.command.value;
         return `${command.sourceSession}\0${command.targetWorkspace}\0${command.sourceCommit ?? ""}`;
@@ -24236,7 +24487,7 @@ var init_platform_effect_driver = __esm({
     arrangeCorrespondenceWakeup = (runner, requestFrame, responseFrame, fetchImpl) => {
       const identity = deliveryIdentity(requestFrame);
       if (!identity) return;
-      const response = fromBinary25(RuntimeResponseSchema, responseFrame);
+      const response = fromBinary26(RuntimeResponseSchema, responseFrame);
       const retryAt = response.outcome.case === "workspaceEffectsDelivered" ? response.outcome.value.retryAtMillis : void 0;
       const wakeups = correspondenceWakeups.get(runner) ?? /* @__PURE__ */ new Map();
       correspondenceWakeups.set(runner, wakeups);
@@ -24361,13 +24612,19 @@ var init_platform_effect_driver = __esm({
     };
     executeGitFetchWithAlongside = async (effect, fetchImpl) => {
       if (!effect.alongside) return executeGitFetchEffect(effect, fetchImpl);
-      const [fetched, alongside] = await Promise.all([
-        executeGitFetchEffect(effect, fetchImpl),
-        executeHttpEffect(effect.alongside, fetchImpl)
-      ]);
-      if (fetched.outcome.case === "gitFetch" && alongside.outcome.case === "response") {
+      const cancelAlongside = new AbortController();
+      let alongside;
+      void executeHttpEffect(effect.alongside, (input, init) => fetchImpl(input, {
+        ...init,
+        signal: init?.signal ? AbortSignal.any([init.signal, cancelAlongside.signal]) : cancelAlongside.signal
+      })).then((receipt) => {
+        alongside = receipt;
+      });
+      const fetched = await executeGitFetchEffect(effect, fetchImpl);
+      if (fetched.outcome.case === "gitFetch" && alongside?.outcome.case === "response") {
         fetched.outcome.value.alongside = alongside.outcome.value;
       }
+      cancelAlongside.abort();
       return fetched;
     };
     executeGitPushEffect = async (effect, fetchImpl) => {
@@ -24427,25 +24684,26 @@ var init_platform_effect_driver = __esm({
 });
 
 // ../platform-shells/shared/socket_effects.ts
-import { create as create72, fromBinary as fromBinary26, toBinary as toBinary27 } from "@bufbuild/protobuf";
+import { create as create72, fromBinary as fromBinary27, toBinary as toBinary28 } from "@bufbuild/protobuf";
 function socketEffects(invoke2, permits = () => true) {
   const sockets = /* @__PURE__ */ new Map();
   let sequence = 50000000000n;
   let closed = false;
   const receipt = (connectionId, observation) => {
     if (closed) return;
-    const frame = toBinary27(RuntimeRequestSchema, create72(RuntimeRequestSchema, {
+    const frame = toBinary28(RuntimeRequestSchema, create72(RuntimeRequestSchema, {
       protocolVersion: 2,
       requestId: ++sequence,
       command: { case: "socketReceipt", value: create72(PeerSocketReceiptSchema, { connectionId, observation }) }
     }));
-    void Promise.resolve().then(() => invoke2(frame)).catch(() => {
+    void Promise.resolve().then(() => invoke2(frame)).catch((error) => {
+      console.warn("[nomos-socket] receipt failed", { connectionId, error });
       sockets.get(connectionId)?.close();
     });
   };
   return {
     consume(frame) {
-      const event = fromBinary26(RuntimeEventSchema, frame);
+      const event = fromBinary27(RuntimeEventSchema, frame);
       if (event.event.case !== "socketEffect") return false;
       const effect = event.event.value;
       const id = effect.connectionId;
@@ -24461,6 +24719,7 @@ function socketEffects(invoke2, permits = () => true) {
           socket.onopen = () => receipt(id, { case: "opened", value: true });
           socket.onmessage = (message) => {
             if (message.data instanceof ArrayBuffer) receipt(id, { case: "received", value: new Uint8Array(message.data) });
+            else if (typeof message.data === "string") receipt(id, { case: "received", value: new TextEncoder().encode(message.data) });
           };
           socket.onclose = () => {
             if (sockets.get(id) === socket) sockets.delete(id);
@@ -24501,17 +24760,17 @@ var init_socket_effects = __esm({
 });
 
 // ../platform-shells/shared/credential_effects.ts
-import { create as create73, fromBinary as fromBinary27, toBinary as toBinary28 } from "@bufbuild/protobuf";
+import { create as create73, fromBinary as fromBinary28, toBinary as toBinary29 } from "@bufbuild/protobuf";
 function credentialEffects(invoke2, provider) {
   return { consume(frame) {
-    const event = fromBinary27(RuntimeEventSchema, frame);
+    const event = fromBinary28(RuntimeEventSchema, frame);
     if (event.event.case !== "credentialRefreshRequested" || provider === externalPeerEffect) return false;
     const pending = event.event.value.pending;
     if (pending?.effect.case !== "refreshCredential") throw new Error("credential refresh event omitted its physical effect");
     const effect = pending.effect.value;
     void Promise.resolve().then(async () => {
       const receipt = await executeCredentialRefreshEffect(effect, provider);
-      const response = fromBinary27(RuntimeResponseSchema, await invoke2(toBinary28(RuntimeRequestSchema, create73(RuntimeRequestSchema, {
+      const response = fromBinary28(RuntimeResponseSchema, await invoke2(toBinary29(RuntimeRequestSchema, create73(RuntimeRequestSchema, {
         protocolVersion: 2,
         requestId: event.sequence,
         command: { case: "continueCorrespondence", value: create73(ContinueCorrespondenceRequestSchema, { workId: pending.workId, receipt }) }
@@ -24534,7 +24793,7 @@ var init_credential_effects = __esm({
 });
 
 // ../platform-shells/shared/peer_office_host.ts
-import { create as create74, fromBinary as fromBinary28, toBinary as toBinary29 } from "@bufbuild/protobuf";
+import { create as create74, fromBinary as fromBinary29, toBinary as toBinary30 } from "@bufbuild/protobuf";
 function openPeerOfficeHost(kernel, shell, fetchImpl = globalThis.fetch, maintenanceSettled, postEvent = () => {
 }, credentialRefresh, yieldWakeToCaller = false, deviceIdentity, lawPackage, performExternalEffect) {
   let runner;
@@ -24583,7 +24842,7 @@ function openPeerOfficeHost(kernel, shell, fetchImpl = globalThis.fetch, mainten
   );
   const providerOrigins = [...configuredOrigins];
   if (providerOrigins.length > 0) {
-    const configured = fromBinary28(RuntimeResponseSchema, runner.handleFrame(toBinary29(
+    const configured = fromBinary29(RuntimeResponseSchema, runner.handleFrame(toBinary30(
       RuntimeRequestSchema,
       create74(RuntimeRequestSchema, {
         protocolVersion: 2,
@@ -24597,7 +24856,7 @@ function openPeerOfficeHost(kernel, shell, fetchImpl = globalThis.fetch, mainten
   }
   return {
     async invoke(args) {
-      const request = fromBinary28(RuntimeRequestSchema, args.requestBytes);
+      const request = fromBinary29(RuntimeRequestSchema, args.requestBytes);
       if (request.protocolVersion !== 2) {
         throw new Error(`unsupported Nomos runtime protocol ${request.protocolVersion}`);
       }
@@ -24653,7 +24912,7 @@ var init_peer_office_host = __esm({
     init_socket_effects();
     init_credential_effects();
     targetOf = (frame) => {
-      const target3 = fromBinary28(RuntimeRequestSchema, frame).target;
+      const target3 = fromBinary29(RuntimeRequestSchema, frame).target;
       return {
         ...target3?.session === void 0 ? {} : { session: target3.session },
         ...target3?.workspace === void 0 ? {} : { workspace: target3.workspace }
@@ -24707,21 +24966,21 @@ var init_sqlite_peer_desk_store = __esm({
         }
         return this.#opened = database;
       }
-      list(namespace) {
+      list(namespace2) {
         const rows = this.#database().prepare(`
       SELECT record_key AS key, revision, value
         FROM peer_desk_record
        WHERE namespace = ?
        ORDER BY record_key
-    `).all(namespace);
+    `).all(namespace2);
         return rows.map((row) => ({
-          namespace,
+          namespace: namespace2,
           key: row.key,
           revision: BigInt(row.revision),
           value: Uint8Array.from(row.value)
         }));
       }
-      compareExchange(namespace, key2, expectedRevision, value) {
+      compareExchange(namespace2, key2, expectedRevision, value) {
         const expected = expectedRevision === void 0 ? void 0 : Number(expectedRevision);
         if (expected !== void 0 && (!Number.isSafeInteger(expected) || expected <= 0)) {
           throw new Error(`peer desk revision ${expectedRevision} cannot be represented by SQLite`);
@@ -24734,8 +24993,8 @@ var init_sqlite_peer_desk_store = __esm({
             const removed = database.prepare(`
           DELETE FROM peer_desk_record
            WHERE namespace = ? AND record_key = ? AND revision = ?
-        `).run(namespace, key2, expected);
-            if (removed.changes !== 1) this.#conflict(namespace, key2);
+        `).run(namespace2, key2, expected);
+            if (removed.changes !== 1) this.#conflict(namespace2, key2);
             return this.#commit(void 0);
           }
           const bytes = Buffer.from(value.buffer, value.byteOffset, value.byteLength);
@@ -24747,14 +25006,14 @@ var init_sqlite_peer_desk_store = __esm({
             INSERT INTO peer_desk_record(namespace, record_key, revision, value)
             VALUES (?, ?, 1, ?)
             ON CONFLICT(namespace, record_key) DO NOTHING
-          `).run(namespace, key2, bytes) : database.prepare(`
+          `).run(namespace2, key2, bytes) : database.prepare(`
             UPDATE peer_desk_record
                SET revision = ?, value = ?
              WHERE namespace = ? AND record_key = ? AND revision = ?
-          `).run(nextRevision, bytes, namespace, key2, expected);
-          if (changed.changes !== 1) this.#conflict(namespace, key2);
+          `).run(nextRevision, bytes, namespace2, key2, expected);
+          if (changed.changes !== 1) this.#conflict(namespace2, key2);
           return this.#commit({
-            namespace,
+            namespace: namespace2,
             key: key2,
             revision: BigInt(nextRevision),
             value: value.slice()
@@ -24772,12 +25031,12 @@ var init_sqlite_peer_desk_store = __esm({
         this.#database().exec("COMMIT");
         return value;
       }
-      #conflict(namespace, key2) {
+      #conflict(namespace2, key2) {
         const current = this.#database().prepare(`
       SELECT revision FROM peer_desk_record WHERE namespace = ? AND record_key = ?
-    `).get(namespace, key2);
+    `).get(namespace2, key2);
         throw new Error(
-          `peer desk record '${namespace}/${key2}' changed at revision ${current?.revision ?? "absent"}`
+          `peer desk record '${namespace2}/${key2}' changed at revision ${current?.revision ?? "absent"}`
         );
       }
     };
@@ -25174,7 +25433,7 @@ __export(peer_office_exports, {
   signEraCertification: () => signEraCertification,
   verifyRemoteChain: () => verifyRemoteChain
 });
-import { create as create76, fromBinary as fromBinary29, toBinary as toBinary30 } from "@bufbuild/protobuf";
+import { create as create76, fromBinary as fromBinary30, toBinary as toBinary31 } from "@bufbuild/protobuf";
 import { createHash as createHash3, randomUUID as randomUUID2 } from "node:crypto";
 import {
   existsSync as existsSync5,
@@ -25255,13 +25514,13 @@ async function invokeLocalPeerOffice(cloud, command, target3) {
     command
   });
   const office = await peer(cloud);
-  const response = fromBinary29(RuntimeResponseSchema, await office.invoke({
+  const response = fromBinary30(RuntimeResponseSchema, await office.invoke({
     ...target3 === void 0 ? {} : {
       workspace: target3.workspace,
       authToken: target3.authToken,
       sourceDeviceKeySecret: target3.authorSecret
     },
-    requestBytes: toBinary30(RuntimeRequestSchema, request)
+    requestBytes: toBinary31(RuntimeRequestSchema, request)
   }));
   if (response.requestId !== requestId) {
     throw new Error(`Peer Office returned response ${response.requestId} for request ${requestId}`);