githolon 0.115.0 → 0.116.4

package/dist/compile_mountability_entry.js

@@ -774,11 +774,106 @@ var init_contract = __esm({
   }
 });
 
+// ../dsl/src/value_identity.ts
+function canonicalString(value, at) {
+  if (PLAIN_STRING.test(value)) return `"${value}"`;
+  let out4 = '"';
+  for (let i = 0; i < value.length; i++) {
+    const c = value.charCodeAt(i);
+    if (c >= 55296 && c <= 56319) {
+      const next = i + 1 < value.length ? value.charCodeAt(i + 1) : -1;
+      if (next < 56320 || next > 57343) throw new VoCanonicalError(at, "is not well-formed UTF-16 (a lone high surrogate)");
+      out4 += value[i] + value[i + 1];
+      i++;
+      continue;
+    }
+    if (c >= 56320 && c <= 57343) throw new VoCanonicalError(at, "is not well-formed UTF-16 (a lone low surrogate)");
+    switch (c) {
+      case 34:
+        out4 += '\\"';
+        break;
+      case 92:
+        out4 += "\\\\";
+        break;
+      case 8:
+        out4 += "\\b";
+        break;
+      case 12:
+        out4 += "\\f";
+        break;
+      case 10:
+        out4 += "\\n";
+        break;
+      case 13:
+        out4 += "\\r";
+        break;
+      case 9:
+        out4 += "\\t";
+        break;
+      default:
+        out4 += c < 32 ? `\\u00${c < 16 ? "0" : ""}${c.toString(16)}` : value[i];
+    }
+  }
+  return `${out4}"`;
+}
+function canonicalNumber(value, at) {
+  if (!Number.isFinite(value)) throw new VoCanonicalError(at, "is not a finite number (NaN and Infinity have no canonical form)");
+  return String(value);
+}
+function isPlainObject(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function members(entries) {
+  const sorted = [...entries].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  return `{${sorted.map(([k, v]) => `${canonicalString(k, "member name")}:${v}`).join(",")}}`;
+}
+function canonicalJsonValue(value, at = "value") {
+  if (value === null) return "null";
+  switch (typeof value) {
+    case "string":
+      return canonicalString(value, at);
+    case "number":
+      return canonicalNumber(value, at);
+    case "boolean":
+      return value ? "true" : "false";
+    case "object": {
+      if (Array.isArray(value)) {
+        const out4 = [];
+        for (let i = 0; i < value.length; i++) {
+          if (value[i] === void 0) throw new VoCanonicalError(`${at}[${i}]`, "is undefined (a list has no absent elements)");
+          out4.push(canonicalJsonValue(value[i], `${at}[${i}]`));
+        }
+        return `[${out4.join(",")}]`;
+      }
+      if (!isPlainObject(value)) throw new VoCanonicalError(at, "is not a plain json object");
+      return members(Object.keys(value).filter((k) => value[k] !== void 0).map((k) => [k, canonicalJsonValue(value[k], `${at}.${k}`)]));
+    }
+    default:
+      throw new VoCanonicalError(at, `is a ${typeof value}, which json cannot carry`);
+  }
+}
+var VO_CANONICAL_ENCODING, VoCanonicalError, PLAIN_STRING;
+var init_value_identity = __esm({
+  "../dsl/src/value_identity.ts"() {
+    "use strict";
+    VO_CANONICAL_ENCODING = "nomos.vo-canonical.v1";
+    VoCanonicalError = class extends TypeError {
+      constructor(at, problem) {
+        super(`${VO_CANONICAL_ENCODING}: ${at} ${problem}`);
+        this.name = "VoCanonicalError";
+      }
+    };
+    PLAIN_STRING = /^[^"\\\u0000-\u001f\ud800-\udfff]*$/;
+  }
+});
+
 // ../dsl/src/aggregate.ts
 function sameKeyValue(a, b) {
   if (a === b) return true;
   if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) return false;
-  return JSON.stringify(a) === JSON.stringify(b);
+  return canonicalJsonValue(a) === canonicalJsonValue(b);
 }
 function judgeBirthKeyWriteOnce(aggregateId, fields, snapshot, previous) {
   if (previous === void 0 || previous === null) return { accept: true };
@@ -1116,6 +1211,7 @@ var init_aggregate = __esm({
     init_fields();
     init_contract();
     init_drivers();
+    init_value_identity();
     BIRTH_KEY_WRITE_ONCE_CODE = "birth-key-write-once";
     BIRTH_KEY_FIELDS = Symbol.for("nomos.birthKeyWriteOnceFields");
     READ_CAP_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$/;
@@ -1728,7 +1824,7 @@ function evaluatePointGuard(predicate, row, payload) {
       const left = valueAt(row, predicate.left.path);
       const right = predicate.right.source === "literal" ? predicate.right.value : valueAt(predicate.right.source === "row" ? row : payload, predicate.right.path);
       if (left === void 0 || right === void 0) return predicate.operator === "ne";
-      const equal = JSON.stringify(left) === JSON.stringify(right);
+      const equal = canonicalJsonValue(left) === canonicalJsonValue(right);
       return predicate.operator === "eq" ? equal : !equal;
     }
   }
@@ -1736,6 +1832,7 @@ function evaluatePointGuard(predicate, row, payload) {
 var init_point_guard = __esm({
   "../dsl/src/point_guard.ts"() {
     "use strict";
+    init_value_identity();
   }
 });
 
@@ -2907,7 +3004,7 @@ var init_law_status = __esm({
 // ../adapter/proto/nomos/kernel/v1/kernel_pb.js
 import { enumDesc, fileDesc, messageDesc, serviceDesc, tsEnum } from "@bufbuild/protobuf/codegenv2";
 import { file_google_protobuf_any } from "@bufbuild/protobuf/wkt";
-var file_nomos_kernel_v1_kernel, CallRequestSchema, CallResponseSchema, OfferResponseSchema, WorkspaceEffectStatusRequestSchema, WorkspaceEffectStatusResponseSchema, RecordWorkspaceEffectOutcomeRequestSchema, BirthOutcomeSchema, SignPreparedOfferRequestSchema, PrepareRemoteOfferRequestSchema, PrepareRemoteOfferResponseSchema, SignOfferPreparationRequestSchema, SigningIdentityRequestSchema, GenerateSigningKeyPairSchema, KernelRefusalSchema, ApplicationResultDeltaSchema, InterfaceCompatibilityQuerySchema, MaintenanceQuantumQuerySchema, CarriedWorkspaceOfferSchema, PrepareOutboundOfferSchema, SyncResponseSchema, CustodyDisagreementSchema, WorkspaceTargetSchema, DirectiveCallSchema, AuthoringOptionsSchema, CapturedClockSchema, BirthCertificateSchema, SignBirthCertificateRequestSchema, ModelLifecycleIntentSchema, IdentityProviderWitnessAdoptionSchema, OfferRequestSchema, QueryRequestSchema, IdentityProviderWitnessQuerySchema, ChildWorkspaceQuerySchema, InstalledLawDeclarationsQuerySchema, DirectiveAuthoringRequirementsQuerySchema, AuthenticationPostureQuerySchema, QueryAuthoritySchema, NomosRefSchema, ReferenceVersionsQuerySchema, NamedQuerySchema, FrontierTransitionRequestSchema, AuthorizationCheckRequestSchema, OutboxRequestSchema, SyncRequestSchema, KernelConfigurationRequestSchema, CustodyRequestSchema, AggregateCensusRequestSchema, ResidentFootprintRequestSchema, PackDeltaRequestSchema, ApplyPackRequestSchema, RepoStatsRequestSchema, IntentsAboveRequestSchema, HistorySummaryRequestSchema, InspectChangeRequestSchema, InspectRefusalVerdictRequestSchema, ReadBlobRequestSchema, ResolveRefRequestSchema, PhysicalRefFileSchema, ListRefsRequestSchema, WriteRefRequestSchema, DeleteRefRequestSchema, LawClosureInfoRequestSchema, RestoreMainRequestSchema, LawProductsSchema, ExportLawProductsRequestSchema, ExportLawProductsResponseSchema, ImportLawProductsRequestSchema, AttachLocalFrontierRequestSchema, CustodyRemoteSchema, CustodyPlacementPolicySchema, CustodyPlacementExpectationSchema, ReadCustodyPlacementRequestSchema, InspectCustodyPlacementRequestSchema, PlacementOfferSchema, ResolveStatePositionRequestSchema, ReleaseWorkspaceStateRequestSchema, NomosValueSchema, NullSchema, NomosListSchema, NomosStructSchema, BirthOutcomeStatusSchema, BirthOutcomeStatus, KernelRefusalCodeSchema, KernelRefusalCode, InterfaceCompatibilityStatusSchema, InterfaceCompatibilityStatus, EffectExecutionPlacementSchema, EffectExecutionPlacement, EffectExecutionCardinalitySchema, EffectExecutionCardinality, ModelLifecycleOperationSchema, ModelLifecycleOperation, ChildWorkspaceLifecycleStatusSchema, ChildWorkspaceLifecycleStatus, ProviderTokenVerificationStatusSchema, ProviderTokenVerificationStatus, DeviceSignerStatusSchema, DeviceSignerStatus, BirthEvidenceStatusSchema, BirthEvidenceStatus, QueryResultFormatSchema, QueryResultFormat, QueryOperationSchema, QueryOperation, KernelLawCapabilitySchema, KernelLawCapability, KernelResidencyIntentSchema, KernelResidencyIntent, CustodyRetentionIntentSchema, CustodyRetentionIntent, IntentTransportRequirementSchema, IntentTransportRequirement;
+var file_nomos_kernel_v1_kernel, CallRequestSchema, CallResponseSchema, OfferResponseSchema, WorkspaceEffectStatusRequestSchema, WorkspaceEffectStatusResponseSchema, RecordWorkspaceEffectOutcomeRequestSchema, BirthOutcomeSchema, SignPreparedOfferRequestSchema, PrepareRemoteOfferRequestSchema, PrepareRemoteOfferResponseSchema, SignOfferPreparationRequestSchema, SigningIdentityRequestSchema, GenerateSigningKeyPairSchema, KernelRefusalSchema, QueryResponseSchema, ApplicationResultDeltaSchema, InterfaceCompatibilityQuerySchema, ReadIndexPendingSchema, MaintenanceQuantumQuerySchema, CarriedWorkspaceOfferSchema, PrepareOutboundOfferSchema, SyncResponseSchema, CustodyDisagreementSchema, WorkspaceTargetSchema, DirectiveCallSchema, AuthoringOptionsSchema, CapturedClockSchema, BirthCertificateSchema, SignBirthCertificateRequestSchema, ModelLifecycleIntentSchema, IdentityProviderWitnessAdoptionSchema, OfferRequestSchema, QueryRequestSchema, IdentityProviderWitnessQuerySchema, ChildWorkspaceQuerySchema, InstalledLawDeclarationsQuerySchema, DirectiveAuthoringRequirementsQuerySchema, AuthenticationPostureQuerySchema, QueryAuthoritySchema, NomosRefSchema, ReferenceVersionsQuerySchema, NamedQuerySchema, FrontierTransitionRequestSchema, AuthorizationCheckRequestSchema, OutboxRequestSchema, SyncRequestSchema, KernelConfigurationRequestSchema, CustodyRequestSchema, AggregateCensusRequestSchema, ResidentFootprintRequestSchema, PackDeltaRequestSchema, ApplyPackRequestSchema, RepoStatsRequestSchema, IntentsAboveRequestSchema, HistorySummaryRequestSchema, InspectChangeRequestSchema, InspectRefusalVerdictRequestSchema, ReadBlobRequestSchema, ResolveRefRequestSchema, PhysicalRefFileSchema, ListRefsRequestSchema, WriteRefRequestSchema, DeleteRefRequestSchema, LawClosureInfoRequestSchema, RestoreMainRequestSchema, LawProductsSchema, ExportLawProductsRequestSchema, ExportLawProductsResponseSchema, ImportLawProductsRequestSchema, AttachLocalFrontierRequestSchema, CustodyRemoteSchema, CustodyPlacementPolicySchema, CustodyPlacementExpectationSchema, ReadCustodyPlacementRequestSchema, InspectCustodyPlacementRequestSchema, PlacementOfferSchema, ResolveStatePositionRequestSchema, ReleaseWorkspaceStateRequestSchema, NomosValueSchema, NullSchema, NomosListSchema, NomosStructSchema, BirthOutcomeStatusSchema, BirthOutcomeStatus, KernelRefusalCodeSchema, KernelRefusalCode, InterfaceCompatibilityStatusSchema, InterfaceCompatibilityStatus, EffectExecutionPlacementSchema, EffectExecutionPlacement, EffectExecutionCardinalitySchema, EffectExecutionCardinality, ModelLifecycleOperationSchema, ModelLifecycleOperation, ChildWorkspaceLifecycleStatusSchema, ChildWorkspaceLifecycleStatus, ProviderTokenVerificationStatusSchema, ProviderTokenVerificationStatus, DeviceSignerStatusSchema, DeviceSignerStatus, BirthEvidenceStatusSchema, BirthEvidenceStatus, QueryResultFormatSchema, QueryResultFormat, QueryOperationSchema, QueryOperation, KernelLawCapabilitySchema, KernelLawCapability, KernelResidencyIntentSchema, KernelResidencyIntent, CustodyRetentionIntentSchema, CustodyRetentionIntent, IntentTransportRequirementSchema, IntentTransportRequirement;
 var init_kernel_pb = __esm({
   "../adapter/proto/nomos/kernel/v1/kernel_pb.js"() {
     "use strict";
@@ -2926,8 +3023,10 @@ var init_kernel_pb = __esm({
     SigningIdentityRequestSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 39);
     GenerateSigningKeyPairSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 40);
     KernelRefusalSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 55);
+    QueryResponseSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 56);
     ApplicationResultDeltaSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 58);
     InterfaceCompatibilityQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 60);
+    ReadIndexPendingSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 64);
     MaintenanceQuantumQuerySchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 65);
     CarriedWorkspaceOfferSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 80);
     PrepareOutboundOfferSchema = /* @__PURE__ */ messageDesc(file_nomos_kernel_v1_kernel, 84);
@@ -3457,7 +3556,7 @@ var init_observability_desk_pb = __esm({
     init_model_adoption_desk_pb();
     init_receiving_group_desk_pb();
     init_recovery_desk_pb();
-    file_nomos_runtime_v2_observability_desk = /* @__PURE__ */ fileDesc22("Cilub21vcy9ydW50aW1lL3YyL29ic2VydmFiaWxpdHlfZGVzay5wcm90bxIQbm9tb3MucnVudGltZS52MiJCCgxUcmFjZUNvbnRleHQSEAoIdHJhY2VfaWQYASABKAwSDwoHc3Bhbl9pZBgCIAEoDBIPCgdzYW1wbGVkGAMgASgIIp0CCg5SdW50aW1lRmFpbHVyZRIMCgRjb2RlGAEgASgJEg8KB21lc3NhZ2UYAiABKAkSEQoJY29tcG9uZW50GAMgASgJEhYKCXdvcmtzcGFjZRgEIAEoCUgAiAEBEhMKBmRvbWFpbhgFIAEoCUgBiAEBEhYKCWRpcmVjdGl2ZRgGIAEoCUgCiAEBEjkKCmF0dHJpYnV0ZXMYByADKAsyJS5ub21vcy5ydW50aW1lLnYyLkRpYWdub3N0aWNBdHRyaWJ1dGUSMgoEa2luZBgIIAEoDjIkLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZUZhaWx1cmVLaW5kQgwKCl93b3Jrc3BhY2VCCQoHX2RvbWFpbkIMCgpfZGlyZWN0aXZlIr4BChJSdW50aW1lVW5hdmFpbGFibGUSOgoGcmVhc29uGAEgASgOMioubm9tb3MucnVudGltZS52Mi5SdW50aW1lVW5hdmFpbGFibGVSZWFzb24SEQoJd29ya3NwYWNlGAIgASgJEhEKCXJldHJ5YWJsZRgDIAEoCBIfChJyZXRyeV9hZnRlcl9taWxsaXMYBCABKA1IAIgBARIOCgZkZXRhaWwYBSABKAlCFQoTX3JldHJ5X2FmdGVyX21pbGxpcyJ+Cg5SdW50aW1lUmVmdXNhbBI2CgZyZWFzb24YASABKA4yJi5ub21vcy5ydW50aW1lLnYyLlJ1bnRpbWVSZWZ1c2FsUmVhc29uEhEKCXdvcmtzcGFjZRgCIAEoCRIRCglyZXRyeWFibGUYAyABKAgSDgoGZGV0YWlsGAQgASgJIqUBChNEaWFnbm9zdGljQXR0cmlidXRlEgwKBG5hbWUYASABKAkSFgoMc3RyaW5nX3ZhbHVlGAIgASgJSAASFwoNaW50ZWdlcl92YWx1ZRgDIAEoEkgAEhYKDGRvdWJsZV92YWx1ZRgEIAEoAUgAEhcKDWJvb2xlYW5fdmFsdWUYBSABKAhIABIVCgtieXRlc192YWx1ZRgGIAEoDEgAQgcKBXZhbHVlIvALCgxSdW50aW1lRXZlbnQSEAoIc2VxdWVuY2UYASABKAQSFAoHc2Vzc2lvbhgCIAEoCUgBiAEBEi8KBXJlYWR5GAogASgLMh4ubm9tb3MucnVudGltZS52Mi5SdW50aW1lUmVhZHlIABI3Cg13YXRjaF9jaGFuZ2VkGAsgASgLMh4ubm9tb3MucnVudGltZS52Mi5XYXRjaENoYW5nZWRIABI5Cg5zeW5jX2NvbXBsZXRlZBgMIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU3luY0NvbXBsZXRlZEgAEjUKDGxpbmtfY2hhbmdlZBgNIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuTGlua0NoYW5nZWRIABI5Cg5zaWduYWxfY2hhbmdlZBgOIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU2lnbmFsQ2hhbmdlZEgAEjsKD2N1c3RvZHlfY2hhbmdlZBgPIAEoCzIgLm5vbW9zLnJ1bnRpbWUudjIuQ3VzdG9keUNoYW5nZWRIABJCChNsb2NhbF93b3JrX3JlamVjdGVkGBAgASgLMiMubm9tb3MucnVudGltZS52Mi5Mb2NhbFdvcmtSZWplY3RlZEgAEjMKC2xhd19jaGFuZ2VkGBEgASgLMhwubm9tb3MucnVudGltZS52Mi5MYXdDaGFuZ2VkSAASQwoPa2VybmVsX3Byb2dyZXNzGBIgASgLMigubm9tb3MucnVudGltZS52Mi5LZXJuZWxQcm9ncmVzc09ic2VydmVkSAASLQoEc3BhbhgTIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZVNwYW5IABI/ChF0cmFuc2Zlcl9wcm9ncmVzcxgUIAEoCzIiLm5vbW9zLnJ1bnRpbWUudjIuVHJhbnNmZXJQcm9ncmVzc0gAEkkKFG1haW50ZW5hbmNlX3Byb2dyZXNzGBUgASgLMikubm9tb3MucnVudGltZS52Mi5SZWFkTWFpbnRlbmFuY2VQcm9ncmVzc0gAEjsKDXNvY2tldF9lZmZlY3QYFiABKAsyIi5ub21vcy5ydW50aW1lLnYyLlBlZXJTb2NrZXRFZmZlY3RIABJUChxjcmVkZW50aWFsX3JlZnJlc2hfcmVxdWVzdGVkGBcgASgLMiwubm9tb3MucnVudGltZS52Mi5DcmVkZW50aWFsUmVmcmVzaFJlcXVlc3RlZEgAElIKG3JlY2VpdmluZ19ncm91cF9jb252ZXJnZW5jZRgYIAEoCzIrLm5vbW9zLnJ1bnRpbWUudjIuUmVjZWl2aW5nR3JvdXBDb252ZXJnZW5jZUgAEkoKF21vZGVsX2Fkb3B0aW9uX3Byb2dyZXNzGBkgASgLMicubm9tb3MucnVudGltZS52Mi5Nb2RlbEFkb3B0aW9uUHJvZ3Jlc3NIABI7Cg9mb2xsb3dzX3N1bW1hcnkYGiABKAsyIC5ub21vcy5ydW50aW1lLnYyLkZvbGxvd3NTdW1tYXJ5SAASRAoUbG9jYWxfY29weV9wcmVzZXJ2ZWQYGyABKAsyJC5ub21vcy5ydW50aW1lLnYyLlByZXNlcnZlZExvY2FsQ29weUgAEk4KGWZvcmVpZ25fcGxhY2VtZW50X2lnbm9yZWQYHCABKAsyKS5ub21vcy5ydW50aW1lLnYyLkZvcmVpZ25QbGFjZW1lbnRJZ25vcmVkSAASQwoTYmluZGluZ19xdWFyYW50aW5lZBgdIAEoCzIkLm5vbW9zLnJ1bnRpbWUudjIuUXVhcmFudGluZWRCaW5kaW5nSAASPwoRd3JpdGVfcHJlcGFyYXRpb24YHiABKAsyIi5ub21vcy5ydW50aW1lLnYyLldyaXRlUHJlcGFyYXRpb25IABJKChdyZWFkX2FjY2Vzc19wcmVwYXJhdGlvbhgfIAEoCzInLm5vbW9zLnJ1bnRpbWUudjIuUmVhZEFjY2Vzc1ByZXBhcmF0aW9uSABCBwoFZXZlbnRCCgoIX3Nlc3Npb24ivAEKDkZvbGxvd3NTdW1tYXJ5EhAKCGZvbGxvd2VkGAEgASgNEg8KB3NldHRsZWQYAiABKA0SDAoEbGl2ZRgDIAEoDRI3Cgp3b3Jrc3BhY2VzGAQgAygLMiMubm9tb3MucnVudGltZS52Mi5Gb2xsb3dPYnNlcnZhdGlvbhIkChdvYnNlcnZlZF9hdF91bml4X21pbGxpcxgFIAEoBEgAiAEBQhoKGF9vYnNlcnZlZF9hdF91bml4X21pbGxpcyL7AwoRRm9sbG93T2JzZXJ2YXRpb24SEQoJd29ya3NwYWNlGAEgASgJEjcKBXBoYXNlGAIgASgOMigubm9tb3MucnVudGltZS52Mi5Gb2xsb3dPYnNlcnZhdGlvblBoYXNlEgwKBGxpdmUYAyABKAgSEwoGZGV0YWlsGAQgASgJSACIAQESIQoUcmV0cnlfYXRfdW5peF9taWxsaXMYBSABKARIAYgBARIfChJkdWVfYXRfdW5peF9taWxsaXMYBiABKARIAogBARIUCgdhdHRlbXB0GAcgASgNSAOIAQESGgoNYWN0aXZlX2VmZmVjdBgIIAEoCUgEiAEBEhMKBnVuc2VudBgJIAEoDUgFiAEBEhsKDnVuYWNrbm93bGVkZ2VkGAogASgNSAaIAQESQgoRY3VzdG9kaWFuX3dhcm1pbmcYCyABKAsyIi5ub21vcy5ydW50aW1lLnYyLkN1c3RvZGlhbldhcm1pbmdIB4gBAUIJCgdfZGV0YWlsQhcKFV9yZXRyeV9hdF91bml4X21pbGxpc0IVChNfZHVlX2F0X3VuaXhfbWlsbGlzQgoKCF9hdHRlbXB0QhAKDl9hY3RpdmVfZWZmZWN0QgkKB191bnNlbnRCEQoPX3VuYWNrbm93bGVkZ2VkQhQKEl9jdXN0b2RpYW5fd2FybWluZyKFAQoQQ3VzdG9kaWFuV2FybWluZxIZChFzaW5jZV91bml4X21pbGxpcxgBIAEoBBIiChpleHBlY3RlZF9yZWFkeV91bml4X21pbGxpcxgCIAEoBBIhChlzdGFsbGVkX2FmdGVyX3VuaXhfbWlsbGlzGAMgASgEEg8KB3N0YWxsZWQYBCABKAgiVgoaQ3JlZGVudGlhbFJlZnJlc2hSZXF1ZXN0ZWQSOAoHcGVuZGluZxgBIAEoCzInLm5vbW9zLnJ1bnRpbWUudjIuQ29ycmVzcG9uZGVuY2VQZW5kaW5nIj4KDFJ1bnRpbWVSZWFkeRIXCg9ydW50aW1lX3ZlcnNpb24YASABKAkSFQoNa2VybmVsX3NoYTI1NhgCIAEoDCKNAwoMV2F0Y2hDaGFuZ2VkEhcKD3N1YnNjcmlwdGlvbl9pZBgBIAEoCRITCgtyZXN1bHRfdXNkYRgCIAEoDBI2CgdmYWlsdXJlGAMgASgLMiAubm9tb3MucnVudGltZS52Mi5SdW50aW1lRmFpbHVyZUgAiAEBEjUKEmFwcGxpY2F0aW9uX3Jlc3VsdBgEIAEoCzIULmdvb2dsZS5wcm90b2J1Zi5BbnlIAYgBARIaCg1pbnRlZ2VyX3ZhbHVlGAUgASgDSAKIAQESRwoRYXBwbGljYXRpb25fZGVsdGEYBiABKAsyJy5ub21vcy5rZXJuZWwudjEuQXBwbGljYXRpb25SZXN1bHREZWx0YUgDiAEBEhwKD3Jlc3VsdF9mcm9udGllchgHIAEoCUgEiAEBQgoKCF9mYWlsdXJlQhUKE19hcHBsaWNhdGlvbl9yZXN1bHRCEAoOX2ludGVnZXJfdmFsdWVCFAoSX2FwcGxpY2F0aW9uX2RlbHRhQhIKEF9yZXN1bHRfZnJvbnRpZXIinAEKDVN5bmNDb21wbGV0ZWQSDgoGcmVhc29uGAEgASgJEjcKBnJlc3VsdBgCIAEoCzInLm5vbW9zLnJ1bnRpbWUudjIuU3luY1dvcmtzcGFjZVJlc3BvbnNlEjYKB2ZhaWx1cmUYAyABKAsyIC5ub21vcy5ydW50aW1lLnYyLlJ1bnRpbWVGYWlsdXJlSACIAQFCCgoIX2ZhaWx1cmUigAEKC0xpbmtDaGFuZ2VkEiwKBnN0YXR1cxgBIAEoDjIcLm5vbW9zLnJ1bnRpbWUudjIuTGlua1N0YXR1cxI3CgdjbG9zdXJlGAIgASgLMiEubm9tb3MucnVudGltZS52Mi5MaXZlTGlua0Nsb3N1cmVIAIgBAUIKCghfY2xvc3VyZSI4Cg1TaWduYWxDaGFuZ2VkEg4KBmRvbWFpbhgBIAEoCRIXCg9wcm9qZWN0aW9uX3VzZGEYAiABKAwiUAoKTGF3Q2hhbmdlZBIOCgZkb21haW4YASABKAkSFgoOcGFja2FnZV9zaGEyNTYYAiABKAkSGgoSY29tcGF0aWJpbGl0eV91c2RhGAMgASgMIt0BCgtSdW50aW1lU3BhbhIQCgh0cmFjZV9pZBgBIAEoDBIPCgdzcGFuX2lkGAIgASgMEhsKDnBhcmVudF9zcGFuX2lkGAMgASgMSACIAQESDAoEbmFtZRgEIAEoCRIaChJzdGFydGVkX3VuaXhfbmFub3MYBSABKAQSFgoOZHVyYXRpb25fbmFub3MYBiABKAQSOQoKYXR0cmlidXRlcxgHIAMoCzIlLm5vbW9zLnJ1bnRpbWUudjIuRGlhZ25vc3RpY0F0dHJpYnV0ZUIRCg9fcGFyZW50X3NwYW5faWQi6gEKFktlcm5lbFByb2dyZXNzT2JzZXJ2ZWQSOQoIc25hcHNob3QYASABKAsyJy5ub21vcy5rZXJuZWwudjEuS2VybmVsUHJvZ3Jlc3NTbmFwc2hvdBIkChxob3N0X29ic2VydmVkX2VsYXBzZWRfbWljcm9zGAIgASgEEioKImhvc3Rfb2JzZXJ2ZWRfcGhhc2VfZWxhcHNlZF9taWNyb3MYAyABKAQSHgoWcHJvY2Vzc19yZXNpZGVudF9ieXRlcxgEIAEoBBIjChtwcm9jZXNzX3BlYWtfcmVzaWRlbnRfYnl0ZXMYBSABKAQiggEKEFRyYW5zZmVyUHJvZ3Jlc3MSFgoOcmVjZWl2ZWRfYnl0ZXMYASABKAQSGAoLdG90YWxfYnl0ZXMYAiABKARIAIgBARIsCgRraW5kGAMgASgOMh4ubm9tb3MucnVudGltZS52Mi5UcmFuc2ZlcktpbmRCDgoMX3RvdGFsX2J5dGVzIjkKEFdyaXRlUHJlcGFyYXRpb24SEgoKcmVxdWVzdF9pZBgBIAEoCRIRCgl3b3Jrc3BhY2UYAiABKAkiPgoVUmVhZEFjY2Vzc1ByZXBhcmF0aW9uEhIKCnJlcXVlc3RfaWQYASABKAkSEQoJd29ya3NwYWNlGAIgASgJKsoBChJSdW50aW1lRmFpbHVyZUtpbmQSJAogUlVOVElNRV9GQUlMVVJFX0tJTkRfVU5TUEVDSUZJRUQQABIhCh1SVU5USU1FX0ZBSUxVUkVfS0lORF9JTlRFUk5BTBABEiEKHVJVTlRJTUVfRkFJTFVSRV9LSU5EX1BST1RPQ09MEAISIgoeUlVOVElNRV9GQUlMVVJFX0tJTkRfSU5URUdSSVRZEAMSJAogUlVOVElNRV9GQUlMVVJFX0tJTkRfVU5TVVBQT1JURUQQBCqnAwoYUnVudGltZVVuYXZhaWxhYmxlUmVhc29uEioKJlJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1VOU1BFQ0lGSUVEEAASMgouUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fUkVNT1RFX09OTFlfT0ZGTElORRABEjEKLVJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1JFTU9URV9VTlJFQUNIQUJMRRACEi0KKVJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1JFTU9URV9USU1FT1VUEAMSNgoyUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fTE9DQUxfUkVQTElDQV9OT1RfUkVBRFkQBBI1CjFSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9DUkVERU5USUFMX1VOQVZBSUxBQkxFEAUSMAosUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fV09SS1NQQUNFX09QRU5JTkcQBhIoCiRSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9QRUVSX0JVU1kQByrwAQoUUnVudGltZVJlZnVzYWxSZWFzb24SJgoiUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9VTlNQRUNJRklFRBAAEi0KKVJVTlRJTUVfUkVGVVNBTF9SRUFTT05fSU5WQUxJRF9DUkVERU5USUFMEAESKAokUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9BQ0NFU1NfREVOSUVEEAISKwonUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9QTEFDRU1FTlRfUE9MSUNZEAMSKgomUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9TRVNTSU9OX1VOQk9VTkQQBCqVBAoWRm9sbG93T2JzZXJ2YXRpb25QaGFzZRIoCiRGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfVU5TUEVDSUZJRUQQABIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfREVTSVJFRBABEiAKHEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9EVUUQAhIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfUlVOTklORxADEiQKIEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9TRVRUTEVEEAQSMAosRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0FXQUlUSU5HX0RFUEVOREVOQ1kQBRIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfT0ZGTElORRAGEi8KK0ZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9JTlZBTElEX0NSRURFTlRJQUwQBxIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfQkFDS09GRhAIEiwKKEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9SRUJPUk5fUkVNT1RFTFkQCRIsCihGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfUkVQTEFDSU5HX0xPQ0FMEAoSMgouRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0xPQ0FMX0NPUFlfVU5SRUFEQUJMRRALKlcKCkxpbmtTdGF0dXMSGwoXTElOS19TVEFUVVNfVU5TUEVDSUZJRUQQABIUChBMSU5LX1NUQVRVU19PUEVOEAESFgoSTElOS19TVEFUVVNfQ0xPU0VEEAIqdgoMVHJhbnNmZXJLaW5kEh0KGVRSQU5TRkVSX0tJTkRfVU5TUEVDSUZJRUQQABIXChNUUkFOU0ZFUl9LSU5EX0RFTFRBEAESFgoSVFJBTlNGRVJfS0lORF9GVUxMEAISFgoSVFJBTlNGRVJfS0lORF9QVVNIEANiBnByb3RvMw", [file_google_protobuf_any2, file_nomos_kernel_v1_kernel, file_nomos_kernel_v1_progress, file_nomos_runtime_v2_correspondence_desk, file_nomos_runtime_v2_custody_desk, file_nomos_runtime_v2_placement_desk, file_nomos_runtime_v2_maintenance_desk, file_nomos_runtime_v2_model_adoption_desk, file_nomos_runtime_v2_receiving_group_desk, file_nomos_runtime_v2_recovery_desk]);
+    file_nomos_runtime_v2_observability_desk = /* @__PURE__ */ fileDesc22("Cilub21vcy9ydW50aW1lL3YyL29ic2VydmFiaWxpdHlfZGVzay5wcm90bxIQbm9tb3MucnVudGltZS52MiJCCgxUcmFjZUNvbnRleHQSEAoIdHJhY2VfaWQYASABKAwSDwoHc3Bhbl9pZBgCIAEoDBIPCgdzYW1wbGVkGAMgASgIIp0CCg5SdW50aW1lRmFpbHVyZRIMCgRjb2RlGAEgASgJEg8KB21lc3NhZ2UYAiABKAkSEQoJY29tcG9uZW50GAMgASgJEhYKCXdvcmtzcGFjZRgEIAEoCUgAiAEBEhMKBmRvbWFpbhgFIAEoCUgBiAEBEhYKCWRpcmVjdGl2ZRgGIAEoCUgCiAEBEjkKCmF0dHJpYnV0ZXMYByADKAsyJS5ub21vcy5ydW50aW1lLnYyLkRpYWdub3N0aWNBdHRyaWJ1dGUSMgoEa2luZBgIIAEoDjIkLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZUZhaWx1cmVLaW5kQgwKCl93b3Jrc3BhY2VCCQoHX2RvbWFpbkIMCgpfZGlyZWN0aXZlIr4BChJSdW50aW1lVW5hdmFpbGFibGUSOgoGcmVhc29uGAEgASgOMioubm9tb3MucnVudGltZS52Mi5SdW50aW1lVW5hdmFpbGFibGVSZWFzb24SEQoJd29ya3NwYWNlGAIgASgJEhEKCXJldHJ5YWJsZRgDIAEoCBIfChJyZXRyeV9hZnRlcl9taWxsaXMYBCABKA1IAIgBARIOCgZkZXRhaWwYBSABKAlCFQoTX3JldHJ5X2FmdGVyX21pbGxpcyJ+Cg5SdW50aW1lUmVmdXNhbBI2CgZyZWFzb24YASABKA4yJi5ub21vcy5ydW50aW1lLnYyLlJ1bnRpbWVSZWZ1c2FsUmVhc29uEhEKCXdvcmtzcGFjZRgCIAEoCRIRCglyZXRyeWFibGUYAyABKAgSDgoGZGV0YWlsGAQgASgJIqUBChNEaWFnbm9zdGljQXR0cmlidXRlEgwKBG5hbWUYASABKAkSFgoMc3RyaW5nX3ZhbHVlGAIgASgJSAASFwoNaW50ZWdlcl92YWx1ZRgDIAEoEkgAEhYKDGRvdWJsZV92YWx1ZRgEIAEoAUgAEhcKDWJvb2xlYW5fdmFsdWUYBSABKAhIABIVCgtieXRlc192YWx1ZRgGIAEoDEgAQgcKBXZhbHVlIvALCgxSdW50aW1lRXZlbnQSEAoIc2VxdWVuY2UYASABKAQSFAoHc2Vzc2lvbhgCIAEoCUgBiAEBEi8KBXJlYWR5GAogASgLMh4ubm9tb3MucnVudGltZS52Mi5SdW50aW1lUmVhZHlIABI3Cg13YXRjaF9jaGFuZ2VkGAsgASgLMh4ubm9tb3MucnVudGltZS52Mi5XYXRjaENoYW5nZWRIABI5Cg5zeW5jX2NvbXBsZXRlZBgMIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU3luY0NvbXBsZXRlZEgAEjUKDGxpbmtfY2hhbmdlZBgNIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuTGlua0NoYW5nZWRIABI5Cg5zaWduYWxfY2hhbmdlZBgOIAEoCzIfLm5vbW9zLnJ1bnRpbWUudjIuU2lnbmFsQ2hhbmdlZEgAEjsKD2N1c3RvZHlfY2hhbmdlZBgPIAEoCzIgLm5vbW9zLnJ1bnRpbWUudjIuQ3VzdG9keUNoYW5nZWRIABJCChNsb2NhbF93b3JrX3JlamVjdGVkGBAgASgLMiMubm9tb3MucnVudGltZS52Mi5Mb2NhbFdvcmtSZWplY3RlZEgAEjMKC2xhd19jaGFuZ2VkGBEgASgLMhwubm9tb3MucnVudGltZS52Mi5MYXdDaGFuZ2VkSAASQwoPa2VybmVsX3Byb2dyZXNzGBIgASgLMigubm9tb3MucnVudGltZS52Mi5LZXJuZWxQcm9ncmVzc09ic2VydmVkSAASLQoEc3BhbhgTIAEoCzIdLm5vbW9zLnJ1bnRpbWUudjIuUnVudGltZVNwYW5IABI/ChF0cmFuc2Zlcl9wcm9ncmVzcxgUIAEoCzIiLm5vbW9zLnJ1bnRpbWUudjIuVHJhbnNmZXJQcm9ncmVzc0gAEkkKFG1haW50ZW5hbmNlX3Byb2dyZXNzGBUgASgLMikubm9tb3MucnVudGltZS52Mi5SZWFkTWFpbnRlbmFuY2VQcm9ncmVzc0gAEjsKDXNvY2tldF9lZmZlY3QYFiABKAsyIi5ub21vcy5ydW50aW1lLnYyLlBlZXJTb2NrZXRFZmZlY3RIABJUChxjcmVkZW50aWFsX3JlZnJlc2hfcmVxdWVzdGVkGBcgASgLMiwubm9tb3MucnVudGltZS52Mi5DcmVkZW50aWFsUmVmcmVzaFJlcXVlc3RlZEgAElIKG3JlY2VpdmluZ19ncm91cF9jb252ZXJnZW5jZRgYIAEoCzIrLm5vbW9zLnJ1bnRpbWUudjIuUmVjZWl2aW5nR3JvdXBDb252ZXJnZW5jZUgAEkoKF21vZGVsX2Fkb3B0aW9uX3Byb2dyZXNzGBkgASgLMicubm9tb3MucnVudGltZS52Mi5Nb2RlbEFkb3B0aW9uUHJvZ3Jlc3NIABI7Cg9mb2xsb3dzX3N1bW1hcnkYGiABKAsyIC5ub21vcy5ydW50aW1lLnYyLkZvbGxvd3NTdW1tYXJ5SAASRAoUbG9jYWxfY29weV9wcmVzZXJ2ZWQYGyABKAsyJC5ub21vcy5ydW50aW1lLnYyLlByZXNlcnZlZExvY2FsQ29weUgAEk4KGWZvcmVpZ25fcGxhY2VtZW50X2lnbm9yZWQYHCABKAsyKS5ub21vcy5ydW50aW1lLnYyLkZvcmVpZ25QbGFjZW1lbnRJZ25vcmVkSAASQwoTYmluZGluZ19xdWFyYW50aW5lZBgdIAEoCzIkLm5vbW9zLnJ1bnRpbWUudjIuUXVhcmFudGluZWRCaW5kaW5nSAASPwoRd3JpdGVfcHJlcGFyYXRpb24YHiABKAsyIi5ub21vcy5ydW50aW1lLnYyLldyaXRlUHJlcGFyYXRpb25IABJKChdyZWFkX2FjY2Vzc19wcmVwYXJhdGlvbhgfIAEoCzInLm5vbW9zLnJ1bnRpbWUudjIuUmVhZEFjY2Vzc1ByZXBhcmF0aW9uSABCBwoFZXZlbnRCCgoIX3Nlc3Npb24ivAEKDkZvbGxvd3NTdW1tYXJ5EhAKCGZvbGxvd2VkGAEgASgNEg8KB3NldHRsZWQYAiABKA0SDAoEbGl2ZRgDIAEoDRI3Cgp3b3Jrc3BhY2VzGAQgAygLMiMubm9tb3MucnVudGltZS52Mi5Gb2xsb3dPYnNlcnZhdGlvbhIkChdvYnNlcnZlZF9hdF91bml4X21pbGxpcxgFIAEoBEgAiAEBQhoKGF9vYnNlcnZlZF9hdF91bml4X21pbGxpcyL7AwoRRm9sbG93T2JzZXJ2YXRpb24SEQoJd29ya3NwYWNlGAEgASgJEjcKBXBoYXNlGAIgASgOMigubm9tb3MucnVudGltZS52Mi5Gb2xsb3dPYnNlcnZhdGlvblBoYXNlEgwKBGxpdmUYAyABKAgSEwoGZGV0YWlsGAQgASgJSACIAQESIQoUcmV0cnlfYXRfdW5peF9taWxsaXMYBSABKARIAYgBARIfChJkdWVfYXRfdW5peF9taWxsaXMYBiABKARIAogBARIUCgdhdHRlbXB0GAcgASgNSAOIAQESGgoNYWN0aXZlX2VmZmVjdBgIIAEoCUgEiAEBEhMKBnVuc2VudBgJIAEoDUgFiAEBEhsKDnVuYWNrbm93bGVkZ2VkGAogASgNSAaIAQESQgoRY3VzdG9kaWFuX3dhcm1pbmcYCyABKAsyIi5ub21vcy5ydW50aW1lLnYyLkN1c3RvZGlhbldhcm1pbmdIB4gBAUIJCgdfZGV0YWlsQhcKFV9yZXRyeV9hdF91bml4X21pbGxpc0IVChNfZHVlX2F0X3VuaXhfbWlsbGlzQgoKCF9hdHRlbXB0QhAKDl9hY3RpdmVfZWZmZWN0QgkKB191bnNlbnRCEQoPX3VuYWNrbm93bGVkZ2VkQhQKEl9jdXN0b2RpYW5fd2FybWluZyKFAQoQQ3VzdG9kaWFuV2FybWluZxIZChFzaW5jZV91bml4X21pbGxpcxgBIAEoBBIiChpleHBlY3RlZF9yZWFkeV91bml4X21pbGxpcxgCIAEoBBIhChlzdGFsbGVkX2FmdGVyX3VuaXhfbWlsbGlzGAMgASgEEg8KB3N0YWxsZWQYBCABKAgiVgoaQ3JlZGVudGlhbFJlZnJlc2hSZXF1ZXN0ZWQSOAoHcGVuZGluZxgBIAEoCzInLm5vbW9zLnJ1bnRpbWUudjIuQ29ycmVzcG9uZGVuY2VQZW5kaW5nIj4KDFJ1bnRpbWVSZWFkeRIXCg9ydW50aW1lX3ZlcnNpb24YASABKAkSFQoNa2VybmVsX3NoYTI1NhgCIAEoDCKNAwoMV2F0Y2hDaGFuZ2VkEhcKD3N1YnNjcmlwdGlvbl9pZBgBIAEoCRITCgtyZXN1bHRfdXNkYRgCIAEoDBI2CgdmYWlsdXJlGAMgASgLMiAubm9tb3MucnVudGltZS52Mi5SdW50aW1lRmFpbHVyZUgAiAEBEjUKEmFwcGxpY2F0aW9uX3Jlc3VsdBgEIAEoCzIULmdvb2dsZS5wcm90b2J1Zi5BbnlIAYgBARIaCg1pbnRlZ2VyX3ZhbHVlGAUgASgDSAKIAQESRwoRYXBwbGljYXRpb25fZGVsdGEYBiABKAsyJy5ub21vcy5rZXJuZWwudjEuQXBwbGljYXRpb25SZXN1bHREZWx0YUgDiAEBEhwKD3Jlc3VsdF9mcm9udGllchgHIAEoCUgEiAEBQgoKCF9mYWlsdXJlQhUKE19hcHBsaWNhdGlvbl9yZXN1bHRCEAoOX2ludGVnZXJfdmFsdWVCFAoSX2FwcGxpY2F0aW9uX2RlbHRhQhIKEF9yZXN1bHRfZnJvbnRpZXIinAEKDVN5bmNDb21wbGV0ZWQSDgoGcmVhc29uGAEgASgJEjcKBnJlc3VsdBgCIAEoCzInLm5vbW9zLnJ1bnRpbWUudjIuU3luY1dvcmtzcGFjZVJlc3BvbnNlEjYKB2ZhaWx1cmUYAyABKAsyIC5ub21vcy5ydW50aW1lLnYyLlJ1bnRpbWVGYWlsdXJlSACIAQFCCgoIX2ZhaWx1cmUigAEKC0xpbmtDaGFuZ2VkEiwKBnN0YXR1cxgBIAEoDjIcLm5vbW9zLnJ1bnRpbWUudjIuTGlua1N0YXR1cxI3CgdjbG9zdXJlGAIgASgLMiEubm9tb3MucnVudGltZS52Mi5MaXZlTGlua0Nsb3N1cmVIAIgBAUIKCghfY2xvc3VyZSI4Cg1TaWduYWxDaGFuZ2VkEg4KBmRvbWFpbhgBIAEoCRIXCg9wcm9qZWN0aW9uX3VzZGEYAiABKAwiUAoKTGF3Q2hhbmdlZBIOCgZkb21haW4YASABKAkSFgoOcGFja2FnZV9zaGEyNTYYAiABKAkSGgoSY29tcGF0aWJpbGl0eV91c2RhGAMgASgMIt0BCgtSdW50aW1lU3BhbhIQCgh0cmFjZV9pZBgBIAEoDBIPCgdzcGFuX2lkGAIgASgMEhsKDnBhcmVudF9zcGFuX2lkGAMgASgMSACIAQESDAoEbmFtZRgEIAEoCRIaChJzdGFydGVkX3VuaXhfbmFub3MYBSABKAQSFgoOZHVyYXRpb25fbmFub3MYBiABKAQSOQoKYXR0cmlidXRlcxgHIAMoCzIlLm5vbW9zLnJ1bnRpbWUudjIuRGlhZ25vc3RpY0F0dHJpYnV0ZUIRCg9fcGFyZW50X3NwYW5faWQi6gEKFktlcm5lbFByb2dyZXNzT2JzZXJ2ZWQSOQoIc25hcHNob3QYASABKAsyJy5ub21vcy5rZXJuZWwudjEuS2VybmVsUHJvZ3Jlc3NTbmFwc2hvdBIkChxob3N0X29ic2VydmVkX2VsYXBzZWRfbWljcm9zGAIgASgEEioKImhvc3Rfb2JzZXJ2ZWRfcGhhc2VfZWxhcHNlZF9taWNyb3MYAyABKAQSHgoWcHJvY2Vzc19yZXNpZGVudF9ieXRlcxgEIAEoBBIjChtwcm9jZXNzX3BlYWtfcmVzaWRlbnRfYnl0ZXMYBSABKAQiggEKEFRyYW5zZmVyUHJvZ3Jlc3MSFgoOcmVjZWl2ZWRfYnl0ZXMYASABKAQSGAoLdG90YWxfYnl0ZXMYAiABKARIAIgBARIsCgRraW5kGAMgASgOMh4ubm9tb3MucnVudGltZS52Mi5UcmFuc2ZlcktpbmRCDgoMX3RvdGFsX2J5dGVzIjkKEFdyaXRlUHJlcGFyYXRpb24SEgoKcmVxdWVzdF9pZBgBIAEoCRIRCgl3b3Jrc3BhY2UYAiABKAkiPgoVUmVhZEFjY2Vzc1ByZXBhcmF0aW9uEhIKCnJlcXVlc3RfaWQYASABKAkSEQoJd29ya3NwYWNlGAIgASgJKsoBChJSdW50aW1lRmFpbHVyZUtpbmQSJAogUlVOVElNRV9GQUlMVVJFX0tJTkRfVU5TUEVDSUZJRUQQABIhCh1SVU5USU1FX0ZBSUxVUkVfS0lORF9JTlRFUk5BTBABEiEKHVJVTlRJTUVfRkFJTFVSRV9LSU5EX1BST1RPQ09MEAISIgoeUlVOVElNRV9GQUlMVVJFX0tJTkRfSU5URUdSSVRZEAMSJAogUlVOVElNRV9GQUlMVVJFX0tJTkRfVU5TVVBQT1JURUQQBCqnAwoYUnVudGltZVVuYXZhaWxhYmxlUmVhc29uEioKJlJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1VOU1BFQ0lGSUVEEAASMgouUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fUkVNT1RFX09OTFlfT0ZGTElORRABEjEKLVJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1JFTU9URV9VTlJFQUNIQUJMRRACEi0KKVJVTlRJTUVfVU5BVkFJTEFCTEVfUkVBU09OX1JFTU9URV9USU1FT1VUEAMSNgoyUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fTE9DQUxfUkVQTElDQV9OT1RfUkVBRFkQBBI1CjFSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9DUkVERU5USUFMX1VOQVZBSUxBQkxFEAUSMAosUlVOVElNRV9VTkFWQUlMQUJMRV9SRUFTT05fV09SS1NQQUNFX09QRU5JTkcQBhIoCiRSVU5USU1FX1VOQVZBSUxBQkxFX1JFQVNPTl9QRUVSX0JVU1kQByrwAQoUUnVudGltZVJlZnVzYWxSZWFzb24SJgoiUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9VTlNQRUNJRklFRBAAEi0KKVJVTlRJTUVfUkVGVVNBTF9SRUFTT05fSU5WQUxJRF9DUkVERU5USUFMEAESKAokUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9BQ0NFU1NfREVOSUVEEAISKwonUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9QTEFDRU1FTlRfUE9MSUNZEAMSKgomUlVOVElNRV9SRUZVU0FMX1JFQVNPTl9TRVNTSU9OX1VOQk9VTkQQBCrCBAoWRm9sbG93T2JzZXJ2YXRpb25QaGFzZRIoCiRGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfVU5TUEVDSUZJRUQQABIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfREVTSVJFRBABEiAKHEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9EVUUQAhIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfUlVOTklORxADEiQKIEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9TRVRUTEVEEAQSMAosRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0FXQUlUSU5HX0RFUEVOREVOQ1kQBRIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfT0ZGTElORRAGEi8KK0ZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9JTlZBTElEX0NSRURFTlRJQUwQBxIkCiBGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfQkFDS09GRhAIEiwKKEZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9SRUJPUk5fUkVNT1RFTFkQCRIsCihGT0xMT1dfT0JTRVJWQVRJT05fUEhBU0VfUkVQTEFDSU5HX0xPQ0FMEAoSMgouRk9MTE9XX09CU0VSVkFUSU9OX1BIQVNFX0xPQ0FMX0NPUFlfVU5SRUFEQUJMRRALEisKJ0ZPTExPV19PQlNFUlZBVElPTl9QSEFTRV9LRVJORUxfUkVGVVNFRBAMKlcKCkxpbmtTdGF0dXMSGwoXTElOS19TVEFUVVNfVU5TUEVDSUZJRUQQABIUChBMSU5LX1NUQVRVU19PUEVOEAESFgoSTElOS19TVEFUVVNfQ0xPU0VEEAIqdgoMVHJhbnNmZXJLaW5kEh0KGVRSQU5TRkVSX0tJTkRfVU5TUEVDSUZJRUQQABIXChNUUkFOU0ZFUl9LSU5EX0RFTFRBEAESFgoSVFJBTlNGRVJfS0lORF9GVUxMEAISFgoSVFJBTlNGRVJfS0lORF9QVVNIEANiBnByb3RvMw", [file_google_protobuf_any2, file_nomos_kernel_v1_kernel, file_nomos_kernel_v1_progress, file_nomos_runtime_v2_correspondence_desk, file_nomos_runtime_v2_custody_desk, file_nomos_runtime_v2_placement_desk, file_nomos_runtime_v2_maintenance_desk, file_nomos_runtime_v2_model_adoption_desk, file_nomos_runtime_v2_receiving_group_desk, file_nomos_runtime_v2_recovery_desk]);
     RuntimeFailureSchema = /* @__PURE__ */ messageDesc22(file_nomos_runtime_v2_observability_desk, 1);
     RuntimeUnavailableSchema = /* @__PURE__ */ messageDesc22(file_nomos_runtime_v2_observability_desk, 2);
     RuntimeRefusalSchema = /* @__PURE__ */ messageDesc22(file_nomos_runtime_v2_observability_desk, 3);
@@ -5145,7 +5244,17 @@ function throwIfKernelControlRequired(failure) {
 }
 function throwKernelFailure(failure) {
   throwIfKernelControlRequired(failure);
-  throw new Error(`${failure.code}: ${failure.message}`);
+  throw new KernelRefusal(failure);
+}
+function deterministicKernelRefusal(error) {
+  if (error instanceof KernelWorkspaceResidencyRequired || error instanceof KernelHistoryRequired || error instanceof KernelReadinessPending) return void 0;
+  if (error instanceof KernelRefusal && (error.failure.historyRequired !== void 0 || error.failure.identityProviderWitnessRequired !== void 0)) return void 0;
+  const text = error instanceof Error ? error.message : typeof error === "string" ? error : "";
+  const match = KERNEL_FAILURE_TEXT.exec(text);
+  if (!match) return void 0;
+  const [, code, message] = match;
+  if (ENVIRONMENTAL.test(text) || READINESS_DEBT.test(message) || requiredForeignWorkspace(message) !== void 0) return void 0;
+  return { code, message };
 }
 function rethrowTypedKernelFailure(error) {
   if (error instanceof KernelWorkspaceResidencyRequired || error instanceof KernelHistoryRequired) throw error;
@@ -5154,7 +5263,7 @@ function rethrowTypedKernelFailure(error) {
   if (workspace !== void 0) throw new KernelWorkspaceResidencyRequired(workspace, message);
   throw error;
 }
-var KernelWorkspaceResidencyRequired, KernelHistoryRequired, KernelReadinessPending, READINESS_DEBT, kernelReadinessPending, requiredForeignWorkspace;
+var KernelWorkspaceResidencyRequired, KernelHistoryRequired, KernelReadinessPending, READINESS_DEBT, kernelReadinessPending, READ_INDEX_BUILDING, kernelReadIndexBuilding, requiredForeignWorkspace, KernelRefusal, KERNEL_FAILURE_TEXT, ENVIRONMENTAL;
 var init_kernel_failure = __esm({
   "../adapter/kernel_failure.ts"() {
     "use strict";
@@ -5193,6 +5302,11 @@ var init_kernel_failure = __esm({
       if (!READINESS_DEBT.test(message)) return void 0;
       return new KernelReadinessPending(/source workspace '([^']+)'/.exec(message)?.[1]?.trim(), message);
     };
+    READ_INDEX_BUILDING = /the read index of (.+?) is (?:being built \(\d+ of \d+ documents\)|built \(\d+ documents\) and is being bound); read maintenance (?:continues|finishes) it/;
+    kernelReadIndexBuilding = (message) => {
+      const workspace = READ_INDEX_BUILDING.exec(message)?.[1]?.trim();
+      return workspace === void 0 ? void 0 : { workspace };
+    };
     requiredForeignWorkspace = (message) => {
       const patterns = [
         /workspace '([^']+)' must be resident in the kernel/,
@@ -5207,6 +5321,18 @@ var init_kernel_failure = __esm({
       }
       return void 0;
     };
+    KernelRefusal = class extends Error {
+      code;
+      failure;
+      constructor(failure) {
+        super(`${failure.code}: ${failure.message}`);
+        this.name = "KernelRefusal";
+        this.code = failure.code;
+        this.failure = failure;
+      }
+    };
+    KERNEL_FAILURE_TEXT = /^(NMS-[A-Z0-9]+(?:-[A-Z0-9]+)*): ([\s\S]*)$/;
+    ENVIRONMENTAL = /NMS-KERNEL-TRAP|\btrap\b|unreachable|out of bounds|out of memory|memory allocation|\block\b|File exists|No such file|os error|I\/O|Permission denied|No space|\bE(?:EXIST|NOENT|ACCES|NOSPC|IO|AGAIN|BUSY)\b/i;
   }
 });
 
@@ -6638,15 +6764,16 @@ function streamRefused(code, message) {
     value: create6(LiveStreamRefusalSchema, { code, message })
   } });
 }
-var LEVEL_BATCH, STREAM_WINDOW_CHUNKS, ASK_AGAIN_NANOS, historySlot, LiveInboundStream;
+var LEVEL_BATCH, HISTORY_REQUIRED, CONTAINMENT_ASK_SUFFIX, STREAM_WINDOW_CHUNKS, historySlot, LiveInboundStream;
 var init_live_inbound_stream = __esm({
   "../peer-office/src/runtime/live_inbound_stream.ts"() {
     "use strict";
     init_correspondence_desk_pb();
     init_checkpoint_staging();
     LEVEL_BATCH = "level:";
+    HISTORY_REQUIRED = "nomos.stream.history_required";
+    CONTAINMENT_ASK_SUFFIX = ":contain";
     STREAM_WINDOW_CHUNKS = 8;
-    ASK_AGAIN_NANOS = 15000000000n;
     historySlot = (workspace) => `${workspace}#history`;
     LiveInboundStream = class {
       #ports;
@@ -6664,7 +6791,10 @@ var init_live_inbound_stream = __esm({
         }
         return inbound;
       }
-      /** When this workspace's stream last delivered anything (a waiting procedure is progressing). */
+      /** When this workspace's stream last delivered data to an ask (a waiting procedure is progressing).
+       * A refusal, a frontier, unrelated traffic on the socket and this copy's own re-asking are not
+       * progress: a procedure whose stream only ever says "ask again" gives up and its round fails over
+       * (CAP-838). */
       lastHeard(workspace) {
         return this.#by.get(workspace)?.lastHeard;
       }
@@ -6687,7 +6817,8 @@ var init_live_inbound_stream = __esm({
             inbound.wants.level = {
               effectId: effect.effectId,
               maxOffers: Math.max(1, request.value.maxOffers),
-              remountAfterOffers: request.value.remountAfterOffers
+              remountAfterOffers: request.value.remountAfterOffers,
+              contain: effect.effectId.endsWith(CONTAINMENT_ASK_SUFFIX)
             };
             this.#askLevel(effect.workspace, inbound);
           }
@@ -6747,7 +6878,7 @@ var init_live_inbound_stream = __esm({
           const batch = inbound.levelBatch;
           if (batch) {
             inbound.levelBatch = void 0;
-            if (batch.base === this.#ports.head(effect.workspace)) {
+            if (batch.base === this.#ports.head(effect.workspace) || batch.base === request.value.head) {
               inbound.wants.level = void 0;
               return create6(PeerStreamReceiptSchema, {
                 outcome: { case: "pack", value: batch },
@@ -6758,14 +6889,14 @@ var init_live_inbound_stream = __esm({
             this.#askLevel(effect.workspace, inbound);
           }
           const head = this.#ports.head(effect.workspace);
-          if (head && inbound.announced && head === inbound.announced) {
+          if (inbound.announced && (head === inbound.announced || inbound.askedFrom === inbound.announced)) {
             inbound.wants.level = void 0;
             return create6(PeerStreamReceiptSchema, {
-              outcome: { case: "level", value: head },
+              outcome: { case: "level", value: inbound.announced },
               ...inbound.sealed ? { sealed: inbound.sealed } : {}
             });
           }
-          return this.#refusalReceipt(inbound);
+          return this.#refusalReceipt(inbound, inbound.wants.level?.effectId === effect.effectId && inbound.wants.level.contain);
         }
         if (request.case === "history" || request.case === "ref") {
           const want = inbound.wants.packs.get(request.value.requestId);
@@ -6780,10 +6911,16 @@ var init_live_inbound_stream = __esm({
         return void 0;
       }
       /** A terminal refusal (not one that only says when to ask again) ends the procedure's wait. */
-      #refusalReceipt(inbound) {
+      #refusalReceipt(inbound, contain = false) {
         const refused = inbound.refused;
-        if (!refused || refused.retryAfterMillis !== void 0) return void 0;
+        if (!refused) return void 0;
+        const answersContainment = contain && refused.code === HISTORY_REQUIRED;
+        if (refused.retryAfterMillis !== void 0 && !answersContainment) return void 0;
         inbound.refused = void 0;
+        if (answersContainment) {
+          inbound.askAgainAt = void 0;
+          inbound.wants.level = void 0;
+        }
         return create6(PeerStreamReceiptSchema, { outcome: { case: "refusal", value: refused } });
       }
       /** The procedure gave up (it timed out, or its work ended). */
@@ -6814,7 +6951,9 @@ var init_live_inbound_stream = __esm({
       /** One frame from the peer. True when it was the stream's (the live desk handles the rest). */
       frame(workspace, message) {
         const inbound = this.#of(workspace);
-        inbound.lastHeard = this.#ports.monotonicNanoseconds();
+        if (message.case === "checkpointOffer" || message.case === "checkpointChunk" || message.case === "pack") {
+          inbound.lastHeard = this.#ports.monotonicNanoseconds();
+        }
         switch (message.case) {
           case "frontier":
             if (message.value.response && message.value.head) {
@@ -6869,18 +7008,26 @@ var init_live_inbound_stream = __esm({
             return false;
         }
       }
-      /** Re-ask what is due: a refusal's retry time passed, or an ask heard nothing for too long. */
+      /**
+       * Ask again when a refusal said when to (the peer was opening, or acquiring history). Nothing else
+       * here runs on a timer (CAP-838): the socket is ordered and reliable, every ask is answered on it,
+       * and an ask is re-sent only when its socket re-opens (`opened`) or its refusal's time comes. The
+       * stream used to re-ask whatever had heard nothing for 15 s, and that resend - itself counted as
+       * hearing - hid an ask answered "come back" for ever.
+       */
       drive(workspace) {
         const inbound = this.#by.get(workspace);
-        if (!inbound || !this.wanted(workspace)) return void 0;
+        if (!inbound || inbound.askAgainAt === void 0) return void 0;
+        if (!this.wanted(workspace)) {
+          inbound.askAgainAt = void 0;
+          return void 0;
+        }
         const now2 = this.#ports.monotonicNanoseconds();
-        const due2 = inbound.askAgainAt ?? inbound.lastHeard + ASK_AGAIN_NANOS;
-        if (now2 < due2) return due2 - now2;
+        if (now2 < inbound.askAgainAt) return inbound.askAgainAt - now2;
         inbound.askAgainAt = void 0;
         inbound.refused = void 0;
-        inbound.lastHeard = now2;
         this.opened(workspace);
-        return ASK_AGAIN_NANOS;
+        return void 0;
       }
       #offered(workspace, inbound, offer) {
         inbound.refused = void 0;
@@ -6923,6 +7070,7 @@ var init_live_inbound_stream = __esm({
         const held = !taken ? -1 : "pack" in taken ? taken.pack.byteLength : taken.bytes;
         if (held !== transfer.bytes || transfer.received !== transfer.bytes) {
           if (taken && "stagedPackFile" in taken) this.#staging.clear(workspace);
+          if (inbound.wants.checkpoint) this.#askCheckpoint(workspace, inbound);
           return;
         }
         inbound.complete = {
@@ -7040,8 +7188,12 @@ var init_live_inbound_stream = __esm({
           this.#askCheckpoint(workspace, inbound);
           return;
         }
+        inbound.announced = void 0;
+        inbound.sealed = void 0;
+        const head = this.#ports.head(workspace) ?? "";
+        inbound.askedFrom = head;
         this.#ports.send(workspace, { case: "frontier", value: create6(LiveFrontierSchema, {
-          head: this.#ports.head(workspace) ?? "",
+          head,
           response: false,
           maxOffers: level.maxOffers,
           remountAfterOffers: level.remountAfterOffers,
@@ -7584,6 +7736,24 @@ function placementMovedBy(request, response) {
   }
   return void 0;
 }
+function readIndexPendingAnswer(request, message) {
+  if (request.operation.case !== "query" || request.operation.value.query.case === "maintenanceQuantum") return void 0;
+  const building = kernelReadIndexBuilding(message);
+  if (building === void 0) return void 0;
+  const target3 = request.operation.value.target;
+  return create10(CallResponseSchema, {
+    protocolVersion: request.protocolVersion,
+    requestId: request.requestId,
+    outcome: { case: "query", value: create10(QueryResponseSchema, {
+      result: { case: "readIndexPending", value: create10(ReadIndexPendingSchema, {
+        workspace: target3?.workspace || building.workspace,
+        branch: target3?.branch ?? "",
+        // The sliced build names no frontier: it restarts at whatever head main holds when it continues.
+        requestedFrontier: ""
+      }) }
+    }) }
+  });
+}
 var STAGED_PACK_BYTES, PLACEMENT_REFERENCE, KernelPort;
 var init_kernel_port = __esm({
   "../peer-office/src/runtime/kernel_port.ts"() {
@@ -8621,6 +8791,8 @@ var init_kernel_port = __esm({
             const nested = request.operation.case === "custody" ? request.operation.value.operation.case ?? "empty" : request.operation.case === "query" ? request.operation.value.query.case === "named" ? `named:${request.operation.value.query.value.operation}` : request.operation.value.query.case ?? "empty" : "";
             error.message = `kernel-operation=${top}/${nested}: ${error.message}`;
           }
+          const pending = readIndexPendingAnswer(request, error instanceof Error ? error.message : String(error));
+          if (pending !== void 0) return pending;
           rethrowTypedKernelFailure(error);
         }
         if (response.requestId !== request.requestId) {
@@ -8631,6 +8803,9 @@ var init_kernel_port = __esm({
         this.#residency.after(request, response);
         const placementMoved = placementMovedBy(request, response);
         if (placementMoved !== void 0) this.#onPlacementMoved(placementMoved);
+        if (response.outcome.case === "failure") {
+          return readIndexPendingAnswer(request, response.outcome.value.message) ?? response;
+        }
         return response;
       }
       /** [#call] with the opt-in timeline trace: encode, kernel and decode timed separately. */
@@ -15632,6 +15807,7 @@ var init_read_maintenance_desk = __esm({
           for (const [key2, value] of entries.filter(([key3]) => key3 !== workspace)) this.#pending.set(key2, value);
         }
         this.#revision += 1;
+        if (read && (!existing?.read || isReadDemand)) this.#observer.readinessMayChange?.(workspace);
         if (!existing || existing.read?.cause !== read?.cause || existing.background?.cause !== background?.cause) {
           this.#trace.emit(session ?? existing?.session, {
             case: "maintenanceProgress",
@@ -15648,32 +15824,65 @@ var init_read_maintenance_desk = __esm({
        * (a waiting read's own turn advances read readiness only).
        */
       tick(request, sessionlessNotBeforeNanoseconds = 0n, backgroundNotBeforeNanoseconds = 0n, durability = true) {
+        const turn = this.#turn(
+          request,
+          sessionlessNotBeforeNanoseconds,
+          { case: "until", atNanoseconds: backgroundNotBeforeNanoseconds },
+          durability
+        );
+        return turn.case === "ran" ? turn.ticked : create40(MaintenanceTickedSchema, {
+          pending: turn.pending,
+          nextTickAfterMillis: turn.nextDelayMillis ?? 0
+        });
+      }
+      /**
+       * A waiting read's turn: advance read readiness only. It never runs a background command, closure
+       * warm, pack import or durability flush on the foreground's turn, and never reports a wake for
+       * that background work: with only background work owed its wake is `none`.
+       */
+      tickReadReadiness() {
+        const turn = this.#turn(void 0, 0n, { case: "readReadinessOnly" }, false);
+        if (turn.case === "ran") {
+          return { ticked: turn.ticked, wake: { case: "after", millis: turn.ticked.nextTickAfterMillis } };
+        }
+        return {
+          ticked: create40(MaintenanceTickedSchema, { pending: turn.pending, nextTickAfterMillis: turn.nextDelayMillis ?? 0 }),
+          wake: turn.nextDelayMillis === void 0 ? { case: "none" } : { case: "after", millis: turn.nextDelayMillis }
+        };
+      }
+      #turn(request, sessionlessNotBeforeNanoseconds, backgroundHold, durability) {
         const now2 = this.#clock.monotonicNanoseconds();
+        const backgroundNotBeforeNanoseconds = backgroundHold.case === "until" ? backgroundHold.atNanoseconds : void 0;
         const custodySlice = (workspace2) => this.#custodyBurstSlice(now2, workspace2);
         const due2 = (demand2) => {
           const held = demand2.session || demand2.awaited || demand2.retryNotBeforeNanoseconds > sessionlessNotBeforeNanoseconds ? demand2.retryNotBeforeNanoseconds : sessionlessNotBeforeNanoseconds;
-          const ordinary = demand2.read || demand2.awaited || held > backgroundNotBeforeNanoseconds ? held : backgroundNotBeforeNanoseconds;
+          if (!demand2.read && !demand2.awaited && backgroundNotBeforeNanoseconds === void 0) return void 0;
+          const ordinary = demand2.read || demand2.awaited || backgroundNotBeforeNanoseconds === void 0 || held > backgroundNotBeforeNanoseconds ? held : backgroundNotBeforeNanoseconds;
           const hold = demand2.read || demand2.awaited || !demand2.background?.maintainGitCustody ? void 0 : custodySlice(demand2.workspace);
           if (!hold) return ordinary;
           if (hold.slice && durability) return held > hold.at ? held : hold.at;
           return ordinary > hold.at ? ordinary : hold.at;
         };
-        const entry = [...this.#pending.entries()].find(([, demand2]) => due2(demand2) <= now2);
+        const entry = [...this.#pending.entries()].find(([, demand2]) => {
+          const at = due2(demand2);
+          return at !== void 0 && at <= now2;
+        });
         const flush = this.#flush;
         if (durability && flush && this.#flushDueAt(flush) <= now2 && !entry?.[1].read && (flush.local || !entry || flush.owedSinceNanoseconds + DURABILITY_FLUSH_MAX_DELAY_NANOSECONDS <= now2)) {
-          return this.#tickFlush(flush, request);
+          return { case: "ran", ticked: this.#tickFlush(flush, request) };
         }
         const pinDue = (pin) => {
+          if (backgroundNotBeforeNanoseconds === void 0) return void 0;
           const held = pin.session ? 0n : sessionlessNotBeforeNanoseconds;
           return [pin.notBeforeNanoseconds, held, backgroundNotBeforeNanoseconds].reduce((latest, at) => at > latest ? at : latest, 0n);
         };
         if (!entry) {
-          const pin = [...this.#pins.entries()].find(([, idle]) => pinDue(idle) <= now2);
-          if (pin) return this.#tickPin(pin[0], pin[1], request);
-          return create40(MaintenanceTickedSchema, {
-            pending: this.hasPending(),
-            nextTickAfterMillis: this.#nextDelay(now2, due2, pinDue)
+          const pin = [...this.#pins.entries()].find(([, idle]) => {
+            const at = pinDue(idle);
+            return at !== void 0 && at <= now2;
           });
+          if (pin) return { case: "ran", ticked: this.#tickPin(pin[0], pin[1], request) };
+          return { case: "idle", pending: this.hasPending(), nextDelayMillis: this.#nextDelay(now2, due2, pinDue, durability) };
         }
         const [workspace, demand] = entry;
         const mount = demand.session ? this.#sessions.mountForSession(demand.session) : this.#sessions.mountForWorkspace(workspace);
@@ -15722,7 +15931,7 @@ var init_read_maintenance_desk = __esm({
               read: read !== void 0,
               awaited: demand.awaited === true,
               session: demand.session !== void 0,
-              backgroundHoldMs: Number((backgroundNotBeforeNanoseconds - now2) / 1000000n),
+              backgroundHoldMs: backgroundNotBeforeNanoseconds === void 0 ? "read-readiness-only" : Number((backgroundNotBeforeNanoseconds - now2) / 1000000n),
               sessionlessHoldMs: Number((sessionlessNotBeforeNanoseconds - now2) / 1000000n),
               caller: (new Error().stack ?? "").split("\n").slice(2, 6).map((frame2) => frame2.trim()).join(" < ")
             })}`);
@@ -15771,12 +15980,13 @@ var init_read_maintenance_desk = __esm({
               this.#observer.frontierAdvanced?.(workspace);
             }
           }
-          return create40(MaintenanceTickedSchema, {
+          this.#observer.readinessMayChange?.(workspace);
+          return { case: "ran", ticked: create40(MaintenanceTickedSchema, {
             pending: this.#pending.size > 0,
             progress: observed,
             // With no debt left, an armed idle pin names when the host should wake next.
-            nextTickAfterMillis: progress.maintenancePending ? 20 : this.#pending.size === 0 && this.hasIdleWork() ? this.#nextDelay(this.#clock.monotonicNanoseconds()) : 0
-          });
+            nextTickAfterMillis: progress.maintenancePending ? 20 : this.#pending.size === 0 && this.hasIdleWork() ? this.#nextDelay(this.#clock.monotonicNanoseconds()) ?? 0 : 0
+          }) };
         } catch (error) {
           const format = localCopyFormatRefusal(error);
           if (format !== void 0) {
@@ -15792,10 +16002,10 @@ var init_read_maintenance_desk = __esm({
                 stopped: true
               })
             });
-            return create40(MaintenanceTickedSchema, {
+            return { case: "ran", ticked: create40(MaintenanceTickedSchema, {
               pending: this.#pending.size > 0,
-              nextTickAfterMillis: this.#nextDelay(this.#clock.monotonicNanoseconds())
-            });
+              nextTickAfterMillis: this.#nextDelay(this.#clock.monotonicNanoseconds()) ?? 0
+            }) };
           }
           const failures = demand.failures + 1;
           this.#pending.delete(workspace);
@@ -15823,12 +16033,12 @@ var init_read_maintenance_desk = __esm({
               retryAfterMillis: retryMillis
             })
           });
-          return create40(MaintenanceTickedSchema, {
+          return { case: "ran", ticked: create40(MaintenanceTickedSchema, {
             pending: true,
             // Backoff belongs to the failed workspace. Another workspace's ready
             // index or changed watches must not wait for this retry deadline.
-            nextTickAfterMillis: this.#nextDelay(this.#clock.monotonicNanoseconds())
-          });
+            nextTickAfterMillis: this.#nextDelay(this.#clock.monotonicNanoseconds()) ?? 0
+          }) };
         }
       }
       /** Owe the kernel its ordered flush. The first write it covers fixes `owedSince`; the shared
@@ -15893,7 +16103,7 @@ var init_read_maintenance_desk = __esm({
           }
           return create40(MaintenanceTickedSchema, {
             pending: this.hasPending(),
-            nextTickAfterMillis: progress.maintenancePending ? 20 : this.#nextDelay(this.#clock.monotonicNanoseconds())
+            nextTickAfterMillis: progress.maintenancePending ? 20 : this.#nextDelay(this.#clock.monotonicNanoseconds()) ?? 0
           });
         } catch (error) {
           const failures = flush.failures + 1;
@@ -15917,7 +16127,7 @@ var init_read_maintenance_desk = __esm({
           };
           return create40(MaintenanceTickedSchema, {
             pending: this.hasPending(),
-            nextTickAfterMillis: this.#nextDelay(this.#clock.monotonicNanoseconds())
+            nextTickAfterMillis: this.#nextDelay(this.#clock.monotonicNanoseconds()) ?? 0
           });
         }
       }
@@ -15948,7 +16158,7 @@ var init_read_maintenance_desk = __esm({
           }
           return create40(MaintenanceTickedSchema, {
             pending: this.hasPending(),
-            nextTickAfterMillis: progress.maintenancePending ? 20 : this.#nextDelay(this.#clock.monotonicNanoseconds())
+            nextTickAfterMillis: progress.maintenancePending ? 20 : this.#nextDelay(this.#clock.monotonicNanoseconds()) ?? 0
           });
         } catch (error) {
           slowQuantumObserver?.(`[nomos-kernel-perf] ${JSON.stringify({
@@ -15960,28 +16170,31 @@ var init_read_maintenance_desk = __esm({
           })}`);
           return create40(MaintenanceTickedSchema, {
             pending: this.hasPending(),
-            nextTickAfterMillis: this.#nextDelay(this.#clock.monotonicNanoseconds())
+            nextTickAfterMillis: this.#nextDelay(this.#clock.monotonicNanoseconds()) ?? 0
           });
         }
       }
-      #nextDelay(now2, due2 = (demand) => demand.retryNotBeforeNanoseconds, pinDue = (pin) => pin.notBeforeNanoseconds) {
+      /** Milliseconds until the earliest owed work this turn serves; `undefined` when none is owed. */
+      #nextDelay(now2, due2 = (demand) => demand.retryNotBeforeNanoseconds, pinDue = (pin) => pin.notBeforeNanoseconds, flushes = true) {
         let earliest;
         for (const demand of this.#pending.values()) {
           const at = due2(demand);
+          if (at === void 0) continue;
           if (at <= now2) return 0;
           if (earliest === void 0 || at < earliest) earliest = at;
         }
         for (const pin of this.#pins.values()) {
           const at = pinDue(pin);
+          if (at === void 0) continue;
           if (at <= now2) return 0;
           if (earliest === void 0 || at < earliest) earliest = at;
         }
-        if (this.#flush) {
+        if (flushes && this.#flush) {
           const at = this.#flushDueAt(this.#flush);
           if (at <= now2) return 0;
           if (earliest === void 0 || at < earliest) earliest = at;
         }
-        return earliest === void 0 ? 0 : Number((earliest - now2 + 999999n) / 1000000n);
+        return earliest === void 0 ? void 0 : Number((earliest - now2 + 999999n) / 1000000n);
       }
       /** Drop any demand for a workspace no maintenance can serve (an unreadable copy). */
       forget(workspace) {
@@ -16024,20 +16237,24 @@ var init_read_maintenance_desk = __esm({
 
 // ../peer-office/src/runtime/read_response_desk.ts
 import { create as create41 } from "@bufbuild/protobuf";
-var ReadResponseDesk;
+var READ_RETENTION_MILLIS, READ_RESUME_MAX_MILLIS, ReadResponseDesk;
 var init_read_response_desk = __esm({
   "../peer-office/src/runtime/read_response_desk.ts"() {
     "use strict";
     init_maintenance_desk_pb();
+    READ_RETENTION_MILLIS = 12e4;
+    READ_RESUME_MAX_MILLIS = 1e3;
     ReadResponseDesk = class {
       #waiting = /* @__PURE__ */ new Map();
       #clock;
       #tick;
+      #owe;
       #read;
       #sequence = 0;
-      constructor(clock2, tick, read) {
+      constructor(clock2, tick, owe, read) {
         this.#clock = clock2;
         this.#tick = tick;
+        this.#owe = owe;
         this.#read = read;
       }
       #now() {
@@ -16050,18 +16267,27 @@ var init_read_response_desk = __esm({
         const now2 = this.#now();
         for (const [id, work] of this.#waiting) if (work.deadline <= now2) this.#waiting.delete(id);
         const workId2 = `local-read-${++this.#sequence}`;
-        this.#waiting.set(workId2, { request, dependency, deadline: now2 + 12e4, notBefore: now2 });
+        this.#waiting.set(workId2, {
+          request,
+          dependency,
+          deadline: now2 + READ_RETENTION_MILLIS,
+          notBefore: now2,
+          idle: false,
+          // The office owed this frontier's debt when the kernel first answered pending.
+          owedFor: dependency.requestedFrontier,
+          waiters: /* @__PURE__ */ new Set()
+        });
         return create41(LocalReadPendingSchema, { workId: workId2 });
       }
       resume(workId2, requestId) {
         const work = this.#waiting.get(workId2);
         if (!work || work.request.requestId !== requestId) throw new Error(`unknown local read continuation '${workId2}'`);
         const now2 = this.#now();
+        work.waiters.clear();
         if (now2 >= work.deadline) {
           this.#waiting.delete(workId2);
           throw new Error(`Local read index for '${work.dependency.workspace}' did not catch up to ${work.dependency.requestedFrontier} within its retained maintenance window`);
         }
-        if (now2 < work.notBefore) return this.#pending(workId2, work, now2);
         try {
           const response = this.#read(work.request);
           if (response.outcome.case !== "query" || response.outcome.value.result.case !== "readIndexPending") {
@@ -16069,24 +16295,65 @@ var init_read_response_desk = __esm({
             return { case: "ready", request: work.request, response };
           }
           work.dependency = response.outcome.value.result.value;
-          const tick = this.#tick();
+          if (now2 < work.notBefore) return this.#pending(workId2, work, now2);
+          let { ticked, wake } = this.#tick();
+          if (wake.case === "none" && ticked.progress === void 0 && work.owedFor !== work.dependency.requestedFrontier) {
+            work.owedFor = work.dependency.requestedFrontier;
+            this.#owe(work.request);
+            ({ ticked, wake } = this.#tick());
+          }
           const afterTick = this.#now();
-          work.notBefore = afterTick + tick.nextTickAfterMillis;
-          work.deadline = afterTick + Math.max(12e4, tick.nextTickAfterMillis + 6e4);
+          work.idle = wake.case === "none";
+          const backoff = wake.case === "after" ? wake.millis : 0;
+          work.notBefore = afterTick + backoff;
+          work.deadline = afterTick + Math.max(READ_RETENTION_MILLIS, backoff + 6e4);
           return this.#pending(workId2, work, afterTick);
         } catch (error) {
           this.#waiting.delete(workId2);
           throw error;
         }
       }
+      /**
+       * Wait in process for a held read to become worth continuing. `notify` is called once, when read
+       * readiness for its workspace changes (a slice or binding finished, a frontier advanced, readiness
+       * newly owed). `afterMillis` is the only timer the shell needs: the read's own scheduled quantum
+       * when it has one, otherwise its deadline. Undefined for an unknown or finished read.
+       */
+      onResumable(workId2, notify) {
+        const work = this.#waiting.get(workId2);
+        if (!work) return void 0;
+        const now2 = this.#now();
+        const due2 = work.idle ? work.deadline : Math.min(work.notBefore, work.deadline);
+        work.waiters.add(notify);
+        return { afterMillis: Math.max(0, due2 - now2), cancel: () => {
+          work.waiters.delete(notify);
+        } };
+      }
+      /** Read readiness for `workspace` changed: every read waiting on it may continue now. */
+      readinessChanged(workspace) {
+        const now2 = this.#now();
+        for (const work of this.#waiting.values()) {
+          if (work.dependency.workspace !== workspace) continue;
+          work.idle = false;
+          if (work.notBefore > now2) work.notBefore = now2;
+          const waiters = [...work.waiters];
+          work.waiters.clear();
+          for (const notify of waiters) notify();
+        }
+      }
+      /** The protocol wake is a bounded re-poll inside the read's retention deadline, never the raw backoff. */
       #pending(workId2, work, now2) {
+        const due2 = work.idle ? READ_RESUME_MAX_MILLIS : work.notBefore - now2;
+        const resumeAfterMillis = Math.max(0, Math.min(due2, work.deadline - now2, READ_RESUME_MAX_MILLIS));
         return { case: "pending", value: create41(LocalReadPendingSchema, {
           workId: workId2,
-          resumeAfterMillis: Math.max(0, work.notBefore - now2)
+          resumeAfterMillis: Number.isFinite(resumeAfterMillis) ? Math.ceil(resumeAfterMillis) : READ_RESUME_MAX_MILLIS
         }) };
       }
       clear() {
+        const waiters = [...this.#waiting.values()].flatMap((work) => [...work.waiters]);
         this.#waiting.clear();
+        for (const notify of waiters) notify();
       }
     };
   }
@@ -17000,6 +17267,9 @@ function reduceReplicaFollow(state, event, policy) {
       if (state.case === ReplicaFollowPhase.Running) {
         return { state: { ...state, observed: true }, effects: [] };
       }
+      if (state.case === ReplicaFollowPhase.Backoff && state.refusal?.blocked) {
+        return refusedEvent(state, state.refusal, event.nowUnixMillis);
+      }
       if (state.case === ReplicaFollowPhase.RebornRemotely || state.case === ReplicaFollowPhase.LocalCopyUnreadable) return quiet(state);
       if (state.case === ReplicaFollowPhase.InvalidCredential) {
         return {
@@ -17009,6 +17279,9 @@ function reduceReplicaFollow(state, event, policy) {
       }
       return due(event.nowUnixMillis);
     case ReplicaFollowEventKind.Reconnected:
+      if (state.case === ReplicaFollowPhase.Backoff && state.refusal?.blocked) {
+        return refusedEvent(state, state.refusal, event.nowUnixMillis);
+      }
       switch (state.case) {
         case ReplicaFollowPhase.Running:
           return { state: { ...state, observed: true }, effects: [] };
@@ -17054,15 +17327,25 @@ function reduceReplicaFollow(state, event, policy) {
           }
           return run(state.attempt + 1, state.expectedLocalHead);
         case ReplicaFollowPhase.Offline:
-        case ReplicaFollowPhase.Backoff:
+        case ReplicaFollowPhase.Backoff: {
+          const blocked = blockedRefusal(state);
+          if (blocked) {
+            if (blocked.rerunAtUnixMillis === void 0) return quiet(state);
+            if (event.nowUnixMillis < blocked.rerunAtUnixMillis) {
+              return { state, effects: [{ case: ReplicaFollowEffectKind.ScheduleWake, atUnixMillis: blocked.rerunAtUnixMillis }] };
+            }
+            return run(state.attempt + 1, void 0, void 0, state.failure);
+          }
           if (event.nowUnixMillis < state.retryAtUnixMillis) {
             return { state, effects: [{ case: ReplicaFollowEffectKind.ScheduleWake, atUnixMillis: state.retryAtUnixMillis }] };
           }
           return run(
             state.attempt + 1,
             void 0,
-            state.case === ReplicaFollowPhase.Backoff ? state.warming?.sinceUnixMillis : void 0
+            state.case === ReplicaFollowPhase.Backoff ? state.warming?.sinceUnixMillis : void 0,
+            state.case === ReplicaFollowPhase.Backoff && state.refusal ? state.failure : void 0
           );
+        }
         case ReplicaFollowPhase.InvalidCredential:
           if (!state.refreshDue && event.nowUnixMillis < state.retryAtUnixMillis) {
             return { state, effects: [{ case: ReplicaFollowEffectKind.ScheduleWake, atUnixMillis: state.retryAtUnixMillis }] };
@@ -17139,6 +17422,31 @@ function reduceReplicaFollow(state, event, policy) {
       };
     }
     case ReplicaFollowEventKind.Failed: {
+      if (event.refusal && !(state.case === ReplicaFollowPhase.Running && state.replaceLocalHead !== void 0)) {
+        const attempt2 = Math.max(1, attempts(state));
+        const blocked = state.case === ReplicaFollowPhase.Running && state.refused === event.failure || state.case === ReplicaFollowPhase.Backoff && state.refusal !== void 0 && state.failure === event.failure;
+        const refusal2 = {
+          code: event.refusal.code,
+          blocked,
+          runtime: event.refusal.runtime,
+          atUnixMillis: event.nowUnixMillis
+        };
+        if (!blocked) {
+          const retryAtUnixMillis2 = event.nowUnixMillis + boundedRetry(policy, attempt2);
+          return {
+            state: { case: ReplicaFollowPhase.Backoff, attempt: attempt2, retryAtUnixMillis: retryAtUnixMillis2, failure: event.failure, refusal: refusal2 },
+            effects: [{ case: ReplicaFollowEffectKind.ScheduleWake, atUnixMillis: retryAtUnixMillis2 }]
+          };
+        }
+        const waiting = {
+          case: ReplicaFollowPhase.Backoff,
+          attempt: attempt2,
+          retryAtUnixMillis: event.nowUnixMillis,
+          failure: event.failure,
+          refusal: refusal2
+        };
+        return state.case === ReplicaFollowPhase.Running && state.observed ? refusedEvent(waiting, refusal2, event.nowUnixMillis) : quiet(waiting);
+      }
       if (state.case === ReplicaFollowPhase.Running && state.observed) {
         return due(event.nowUnixMillis);
       }
@@ -17176,6 +17484,11 @@ function reduceReplicaFollow(state, event, policy) {
       return quiet({ case: ReplicaFollowPhase.RebornRemotely, rebirth: event.rebirth });
     case ReplicaFollowEventKind.LocalCopyUnreadable:
       return quiet({ case: ReplicaFollowPhase.LocalCopyUnreadable, format: event.format });
+    case ReplicaFollowEventKind.RuntimeStarted:
+      if (state.case === ReplicaFollowPhase.Backoff && refusedByKernel(state) && state.refusal?.runtime !== event.runtime) {
+        return due(event.nowUnixMillis);
+      }
+      return quiet(state);
     case ReplicaFollowEventKind.LocalCopyDropAuthorized:
       if (state.case === ReplicaFollowPhase.Running) return invalid(state, event);
       return replacing(event.expectedLocalHead, 0, event.nowUnixMillis);
@@ -17188,10 +17501,11 @@ function reduceReplicaFollow(state, event, policy) {
 function invalid(state, event) {
   throw new Error(`replica follow cannot apply '${event.case}' while '${state.case}'`);
 }
-var ReplicaFollowPhase, ReplicaFollowEventKind, ReplicaFollowEffectKind, boundedRetry, attempts, due, run, replacing, quiet;
+var ReplicaFollowPhase, ReplicaFollowEventKind, ReplicaFollowEffectKind, KERNEL_REFUSAL_EVENT_FLOOR_MILLIS, boundedRetry, attempts, due, run, replacing, quiet, blockedRefusal, refusedEvent, refusedByKernel;
 var init_replica_follow_state = __esm({
   "../peer-office/src/runtime/replica_follow_state.ts"() {
     "use strict";
+    init_kernel_failure();
     ReplicaFollowPhase = Object.freeze({
       Desired: "desired",
       Due: "due",
@@ -17226,13 +17540,15 @@ var init_replica_follow_state = __esm({
       DependencyAdvanced: "dependency_advanced",
       RebornRemotely: "reborn_remotely",
       LocalCopyDropAuthorized: "local_copy_drop_authorized",
-      LocalCopyUnreadable: "local_copy_unreadable"
+      LocalCopyUnreadable: "local_copy_unreadable",
+      RuntimeStarted: "runtime_started"
     });
     ReplicaFollowEffectKind = Object.freeze({
       ScheduleWake: "schedule_wake",
       RunSync: "run_sync",
       RefreshCredential: "refresh_credential"
     });
+    KERNEL_REFUSAL_EVENT_FLOOR_MILLIS = 1e4;
     boundedRetry = (policy, attempt) => Math.min(policy.fallbackMillis, Math.max(250, policy.debounceMillis) * 2 ** Math.min(attempt - 1, 20));
     attempts = (state) => {
       switch (state.case) {
@@ -17259,13 +17575,14 @@ var init_replica_follow_state = __esm({
       state: { case: ReplicaFollowPhase.Due, dueAtUnixMillis: atUnixMillis },
       effects: [{ case: ReplicaFollowEffectKind.ScheduleWake, atUnixMillis }]
     });
-    run = (attempt, replaceLocalHead, warmingSinceUnixMillis) => ({
+    run = (attempt, replaceLocalHead, warmingSinceUnixMillis, refused) => ({
       state: {
         case: ReplicaFollowPhase.Running,
         attempt,
         observed: false,
         ...replaceLocalHead === void 0 ? {} : { replaceLocalHead },
-        ...warmingSinceUnixMillis === void 0 ? {} : { warmingSinceUnixMillis }
+        ...warmingSinceUnixMillis === void 0 ? {} : { warmingSinceUnixMillis },
+        ...refused === void 0 ? {} : { refused }
       },
       effects: [{ case: ReplicaFollowEffectKind.RunSync }]
     });
@@ -17274,6 +17591,16 @@ var init_replica_follow_state = __esm({
       effects: [{ case: ReplicaFollowEffectKind.ScheduleWake, atUnixMillis }]
     });
     quiet = (state) => ({ state, effects: [] });
+    blockedRefusal = (state) => state.case === ReplicaFollowPhase.Backoff && state.refusal?.blocked ? state.refusal : void 0;
+    refusedEvent = (state, refusal2, nowUnixMillis) => {
+      const earliest = Math.max(nowUnixMillis, refusal2.atUnixMillis + KERNEL_REFUSAL_EVENT_FLOOR_MILLIS);
+      const rerunAtUnixMillis = refusal2.rerunAtUnixMillis === void 0 ? earliest : Math.min(refusal2.rerunAtUnixMillis, earliest);
+      return {
+        state: { ...state, refusal: { ...refusal2, rerunAtUnixMillis } },
+        effects: [{ case: ReplicaFollowEffectKind.ScheduleWake, atUnixMillis: rerunAtUnixMillis }]
+      };
+    };
+    refusedByKernel = (state) => state.case === ReplicaFollowPhase.Backoff && (state.refusal !== void 0 || deterministicKernelRefusal(state.failure) !== void 0);
   }
 });
 
@@ -17293,9 +17620,12 @@ function dueAt(follow) {
     case ReplicaFollowPhase.RebornRemotely:
     case ReplicaFollowPhase.LocalCopyUnreadable:
       return void 0;
+    case ReplicaFollowPhase.Backoff: {
+      const blocked = blockedRefusal(follow.state);
+      return blocked ? blocked.rerunAtUnixMillis : follow.state.retryAtUnixMillis;
+    }
     case ReplicaFollowPhase.Offline:
     case ReplicaFollowPhase.InvalidCredential:
-    case ReplicaFollowPhase.Backoff:
       return follow.state.retryAtUnixMillis;
     default: {
       const exhaustive = follow.state;
@@ -17321,6 +17651,7 @@ var init_replica_follow_controller = __esm({
     init_custodian_warming();
     init_birth_refusal();
     init_peer_desk_store();
+    init_kernel_failure();
     ReplicaFollowReconciliationKind = Object.freeze({
       Following: "following",
       NotFollowing: "not_following"
@@ -17353,11 +17684,15 @@ var init_replica_follow_controller = __esm({
       #replicaId;
       /** Local children whose births custody refused (CAP-804): quarantined, never followed. */
       #birthRefusals;
-      constructor(desk, clock2, replicaId2, birthRefusals) {
+      /** The kernel/runtime identity this process runs: a refusal is recorded under it, and a refusal
+       * drawn under another identity is retried once when this process starts. */
+      #runtime;
+      constructor(desk, clock2, replicaId2, birthRefusals, runtime = "unidentified") {
         this.#desk = desk;
         this.#clock = clock2;
         this.#replicaId = replicaId2;
         this.#birthRefusals = birthRefusals ?? new BirthRefusalRegister(new MemoryPeerDeskStore());
+        this.#runtime = runtime;
       }
       /** The durable quarantine of a local child whose birth custody refused; undefined otherwise. */
       birthRefusal(workspace) {
@@ -17456,6 +17791,13 @@ var init_replica_follow_controller = __esm({
       recover() {
         const now2 = this.#now();
         if (!this.#recovered) {
+          for (const follow of this.#desk.all()) {
+            this.#desk.transition(follow.spec.workspace, {
+              case: ReplicaFollowEventKind.RuntimeStarted,
+              nowUnixMillis: now2,
+              runtime: this.#runtime
+            });
+          }
           for (const follow of this.#desk.all()) {
             if (follow.state.case === ReplicaFollowPhase.Settled || follow.state.case === ReplicaFollowPhase.AwaitingDependency) {
               this.#placementRecheck.add(follow.spec.workspace);
@@ -17544,11 +17886,12 @@ var init_replica_follow_controller = __esm({
       placementAnnounced(workspace) {
         if (!this.followForWorkspace(workspace)) return void 0;
         this.#placementRecheck.add(workspace);
-        return this.reconnected(workspace);
+        return this.reconnected(workspace, true);
       }
-      /** The upstream live link opened or reopened: reconcile once for missed pushes. */
-      reconnected(workspace) {
-        return this.#event(workspace, ReplicaFollowEventKind.Reconnected);
+      /** The upstream live link opened or reopened: reconcile once for missed pushes. With
+       * `remoteAdvanced`, the upstream announced a new frontier. Either re-runs a blocked refusal. */
+      reconnected(workspace, remoteAdvanced = false) {
+        return this.#event(workspace, ReplicaFollowEventKind.Reconnected, remoteAdvanced);
       }
       /** Another workspace advanced or settled; every held dependency gets one retry. */
       dependencyAdvanced(except) {
@@ -17561,11 +17904,11 @@ var init_replica_follow_controller = __esm({
         }
         return woken;
       }
-      #event(workspace, kind) {
+      #event(workspace, kind, remoteAdvanced = false) {
         const follow = this.#recovered ? this.#desk.get(workspace) : void 0;
         if (!follow) return void 0;
         const nowUnixMillis = this.#now();
-        this.#desk.transition(workspace, { case: kind, nowUnixMillis });
+        this.#desk.transition(workspace, kind === ReplicaFollowEventKind.Reconnected && remoteAdvanced ? { case: kind, nowUnixMillis, remoteAdvanced } : { case: kind, nowUnixMillis });
         const nextDueAt = dueAt(this.#desk.get(workspace));
         return nextDueAt === void 0 ? void 0 : Math.max(0, nextDueAt - nowUnixMillis);
       }
@@ -17712,7 +18055,9 @@ var init_replica_follow_controller = __esm({
        * still opening the workspace and named when to ask again. */
       failed(workspace, error, custodianRetryAfterMillis) {
         if (!this.#recovered) this.recover();
-        custodianRetryAfterMillis ??= warmingFromFailureMessage(error instanceof Error ? error.message : String(error));
+        const refusal2 = deterministicKernelRefusal(error);
+        if (refusal2 !== void 0) custodianRetryAfterMillis = void 0;
+        else custodianRetryAfterMillis ??= warmingFromFailureMessage(error instanceof Error ? error.message : String(error));
         if (!this.#desk.get(workspace)) return;
         const format = localCopyFormatRefusal(error);
         if (format !== void 0) {
@@ -17727,9 +18072,15 @@ var init_replica_follow_controller = __esm({
           case: ReplicaFollowEventKind.Failed,
           nowUnixMillis: this.#now(),
           failure: error instanceof Error ? error.message : String(error),
-          ...custodianRetryAfterMillis === void 0 ? {} : { custodianRetryAfterMillis }
+          ...custodianRetryAfterMillis === void 0 ? {} : { custodianRetryAfterMillis },
+          ...refusal2 === void 0 ? {} : { refusal: { code: refusal2.code, runtime: this.#runtime } }
         });
       }
+      /** The kernel refusal behind this follow's backoff (`blocked` once the kernel repeated it). */
+      refusal(workspace) {
+        const state = this.followForWorkspace(workspace)?.state;
+        return state?.case === ReplicaFollowPhase.Backoff ? state.refusal : void 0;
+      }
       /** Closing an interaction realm must not erase a peer-owned follow. */
       closeInteractionRealm() {
       }
@@ -17750,6 +18101,15 @@ var init_replica_follow_controller = __esm({
   }
 });
 
+// ../peer-office/src/runtime/runtime_identity.ts
+var PEER_RUNTIME_IDENTITY;
+var init_runtime_identity = __esm({
+  "../peer-office/src/runtime/runtime_identity.ts"() {
+    "use strict";
+    PEER_RUNTIME_IDENTITY = typeof __NOMOS_BUNDLE_VERSION__ === "string" && __NOMOS_BUNDLE_VERSION__ ? `@githolon/runtime@${__NOMOS_BUNDLE_VERSION__}` : "@githolon/runtime@unbundled";
+  }
+});
+
 // ../peer-office/src/runtime/replica_follow_desk.ts
 function assertSpec(record, spec) {
   if (!spec.workspace || !spec.credentialCapability || typeof spec.cloudBound !== "boolean" || !Number.isFinite(spec.policy?.debounceMillis) || !Number.isFinite(spec.policy?.fallbackMillis) || spec.policy.debounceMillis < 0 || spec.policy.fallbackMillis <= 0) {
@@ -17803,7 +18163,7 @@ function assertState(record, state) {
   }
   throw corrupt(record, `invalid '${state.case}' state`);
 }
-var REPLICA_FOLLOW_NAMESPACE, textEncoder, textDecoder, encode, decode, decodeWarming, decodeState, corrupt, samePolicy, sameSpec, ReplicaFollowDesk;
+var REPLICA_FOLLOW_NAMESPACE, textEncoder, textDecoder, encode, decode, decodeWarming, decodeRefusal, decodeState, corrupt, samePolicy, sameSpec, ReplicaFollowDesk;
 var init_replica_follow_desk = __esm({
   "../peer-office/src/runtime/replica_follow_desk.ts"() {
     "use strict";
@@ -17834,6 +18194,16 @@ var init_replica_follow_desk = __esm({
         ...Number.isFinite(warming.hintMillis) ? { hintMillis: warming.hintMillis } : {}
       } } : {};
     };
+    decodeRefusal = (value) => {
+      const refusal2 = value;
+      return refusal2 && typeof refusal2.code === "string" && typeof refusal2.runtime === "string" && Number.isFinite(refusal2.atUnixMillis) ? { refusal: {
+        code: refusal2.code,
+        blocked: refusal2.blocked === true,
+        runtime: refusal2.runtime,
+        atUnixMillis: refusal2.atUnixMillis,
+        ...Number.isFinite(refusal2.rerunAtUnixMillis) ? { rerunAtUnixMillis: refusal2.rerunAtUnixMillis } : {}
+      } } : {};
+    };
     decodeState = (record, value) => {
       if (!value || typeof value !== "object") throw corrupt(record, "state is not an object");
       const state = value;
@@ -17848,7 +18218,8 @@ var init_replica_follow_desk = __esm({
             attempt: state.attempt,
             observed: state.observed === true,
             ...state.replaceLocalHead === void 0 ? {} : { replaceLocalHead: state.replaceLocalHead },
-            ...Number.isFinite(state.warmingSinceUnixMillis) ? { warmingSinceUnixMillis: state.warmingSinceUnixMillis } : {}
+            ...Number.isFinite(state.warmingSinceUnixMillis) ? { warmingSinceUnixMillis: state.warmingSinceUnixMillis } : {},
+            ...typeof state.refused === "string" ? { refused: state.refused } : {}
           };
         case ReplicaFollowPhase.Settled:
           return {
@@ -17880,7 +18251,8 @@ var init_replica_follow_desk = __esm({
             attempt: state.attempt,
             retryAtUnixMillis: state.retryAtUnixMillis,
             failure: state.failure,
-            ...decodeWarming(state.warming)
+            ...decodeWarming(state.warming),
+            ...decodeRefusal(state.refusal)
           };
         case ReplicaFollowPhase.RebornRemotely: {
           const rebirth = state.rebirth ?? {};
@@ -18018,9 +18390,15 @@ var init_replica_follow_desk = __esm({
               break;
             }
             case ReplicaFollowPhase.Offline:
-            case ReplicaFollowPhase.Backoff:
-              wakes.push({ workspace: follow.spec.workspace, atUnixMillis: follow.state.retryAtUnixMillis });
+            case ReplicaFollowPhase.Backoff: {
+              const blocked = blockedRefusal(follow.state);
+              if (blocked && blocked.rerunAtUnixMillis === void 0) break;
+              wakes.push({
+                workspace: follow.spec.workspace,
+                atUnixMillis: blocked?.rerunAtUnixMillis ?? follow.state.retryAtUnixMillis
+              });
               break;
+            }
             case ReplicaFollowPhase.InvalidCredential:
               wakes.push({
                 workspace: follow.spec.workspace,
@@ -18690,7 +19068,7 @@ import { create as create48 } from "@bufbuild/protobuf";
 function outcomesDigest(oids) {
   return sha256Hex(new TextEncoder().encode([...new Set(oids)].sort().join("\n")));
 }
-var CHECKPOINT_CHUNK_BYTES, CHECKPOINT_WINDOW_CHUNKS, MAX_CHECKPOINT_WINDOW_CHUNKS, CHECKPOINT_STALE_OFFERS, MAX_STREAM_BATCH_OFFERS, MAX_HISTORY_SLICE, MAX_HELD_SLICES, CHECKPOINT_CACHE_BYTES, MAX_CHECKPOINT_OUTCOMES, PLACEMENT_REF2, LEVEL_BATCH2, hex, frame, refusal, LiveStreamServer;
+var CHECKPOINT_CHUNK_BYTES, CHECKPOINT_WINDOW_CHUNKS, MAX_CHECKPOINT_WINDOW_CHUNKS, CHECKPOINT_STALE_OFFERS, MAX_STREAM_BATCH_OFFERS, MAX_HISTORY_SLICE, MAX_HELD_SLICES, CHECKPOINT_CACHE_BYTES, MAX_CHECKPOINT_OUTCOMES, PLACEMENT_REF2, LEVEL_BATCH2, hex, frame, refusal, OFF_MAIN_AFTER_MILLIS, MAX_UNFOUND_HEADS, LiveStreamServer;
 var init_live_stream_server = __esm({
   "../peer-office/src/runtime/live_stream_server.ts"() {
     "use strict";
@@ -18717,6 +19095,8 @@ var init_live_stream_server = __esm({
       message,
       ...retryAfterMillis === void 0 ? {} : { retryAfterMillis }
     }) });
+    OFF_MAIN_AFTER_MILLIS = 6e4;
+    MAX_UNFOUND_HEADS = 1024;
     LiveStreamServer = class {
       #kernel;
       #now;
@@ -18730,6 +19110,10 @@ var init_live_stream_server = __esm({
       /** By workspace: the history slices copies are fetching (a few, newest last). */
       #slices = /* @__PURE__ */ new Map();
       #cachedBytes = 0;
+      /** By workspace and asked head: when this peer first answered "acquiring its own history" to a level
+       * ask from a head it could not find. A shallow custody can never prove the head is off its main (its
+       * walk is never `complete`), so after OFF_MAIN_AFTER_MILLIS of the same answer it says so anyway. */
+      #unfound = /* @__PURE__ */ new Map();
       constructor(kernel, now2 = Date.now, historyWanted = () => {
       }, sealed = () => void 0) {
         this.#kernel = kernel;
@@ -18777,9 +19161,12 @@ var init_live_stream_server = __esm({
         if (!head) return [...answer, ...this.#checkpoint(workspace, requestId, create48(LiveCheckpointRequestSchema))];
         if (head === main) return answer;
         let behind;
+        let offMain = false;
         try {
           const summary = this.#kernel.historySummary(mount, requestId, head, main);
           behind = summary.reachedBase ? summary.commitCount : void 0;
+          offMain = !summary.reachedBase && (summary.complete || !this.#shallow(mount, requestId));
+          if (summary.reachedBase) this.#unfound.delete(`${workspace}\0${head}`);
         } catch {
           behind = void 0;
         }
@@ -18788,6 +19175,22 @@ var init_live_stream_server = __esm({
           if (remountAfter > 0) {
             return [...answer, ...this.#checkpoint(workspace, requestId, create48(LiveCheckpointRequestSchema), behind ?? 0n)];
           }
+          const key2 = `${workspace}\0${head}`;
+          const firstUnfound = this.#unfound.get(key2);
+          if (!offMain && firstUnfound === void 0) {
+            if (this.#unfound.size >= MAX_UNFOUND_HEADS) this.#unfound.delete(this.#unfound.keys().next().value);
+            this.#unfound.set(key2, this.#now());
+          } else if (!offMain && this.#now() - firstUnfound >= OFF_MAIN_AFTER_MILLIS) {
+            offMain = true;
+          }
+          if (offMain) {
+            this.#unfound.delete(key2);
+            return [...answer, refusal(
+              "",
+              "nomos.stream.off_main",
+              "the copy's head is not on this peer's main; it must converge its own work, not level from it"
+            )];
+          }
           this.#historyWanted(workspace);
           return [...answer, refusal(
             "",
@@ -18799,6 +19202,17 @@ var init_live_stream_server = __esm({
         const maxOffers = Math.min(Math.max(1, frontier.maxOffers || MAX_STREAM_BATCH_OFFERS), MAX_STREAM_BATCH_OFFERS);
         return [...answer, this.#batch(workspace, requestId, head, main, maxOffers)];
       }
+      /** Whether this peer's custody of the workspace is shallow. Unknown counts as shallow: it keeps the
+       * existing wait for history rather than calling a head off main. */
+      #shallow(mount, requestId) {
+        const boundaries = this.#kernel.shallowBoundaries;
+        if (!boundaries) return true;
+        try {
+          return boundaries.call(this.#kernel, mount, requestId).length > 0;
+        } catch {
+          return true;
+        }
+      }
       /**
        * The `maxOffers` offers directly above `base`, as the commits this peer admitted them in: one
        * bounded walk and one bounded pack (O(batch)). The copy's kernel adopts exactly these commits on
@@ -19128,7 +19542,6 @@ var init_live_correspondence_desk = __esm({
     "use strict";
     init_kernel_pb();
     init_correspondence_desk_pb();
-    init_runtime_pb();
     init_kernel_failure();
     init_local_write_burst();
     init_session_directory();
@@ -19189,7 +19602,6 @@ var init_live_correspondence_desk = __esm({
     };
     LiveCorrespondenceDesk = class {
       #links = /* @__PURE__ */ new Map();
-      #pending = /* @__PURE__ */ new Map();
       /** What procedures asked of each workspace's stream, and what it delivered (peer_catchup.md). */
       inbound;
       #own = new OwnOffers();
@@ -19225,13 +19637,6 @@ var init_live_correspondence_desk = __esm({
        * never held. Absent (a custodian, a relay, a test), every write goes out on the next drive.
        */
       writeBurst;
-      /**
-       * An application peer's receive step (CAP-757; sized by time, CAP-762). A received batch of other
-       * senders' offers larger than one step is not admitted on the socket, in one kernel-thread hold:
-       * the follow receives it instead, in yielding steps of the policy's current size. Absent (a
-       * custodian, a relay, a test), every received batch is admitted as it arrives.
-       */
-      receiveStep;
       /** The last progress counted per workspace, served while a burst holds recounting back. */
       #progress = /* @__PURE__ */ new Map();
       /** When a held-back progress recount became owed; it reports at the burst's next due point. */
@@ -19321,10 +19726,12 @@ var init_live_correspondence_desk = __esm({
             sent: link.stream?.sent,
             unansweredAgesMs: (link.stream?.unanswered ?? []).map((entry) => Number((now2 - (entry.due - LIVE_ANSWER_WINDOW)) / 1000000n)),
             custodianLocal: link.custodian?.local,
-            convergeDue: link.convergeDue !== void 0
+            convergeDue: link.convergeDue !== void 0,
+            resident: false
           };
           try {
             if (this.kernel.isResident(link.binding.workspace) !== false) {
+              state.resident = true;
               const mount = workspaceMount(link.binding.workspace);
               state.head = this.kernel.head(mount, ++this.#requestId);
               state.tracked = this.kernel.resolveRef(mount, ++this.#requestId, TRACKED_MAIN2);
@@ -19393,7 +19800,7 @@ var init_live_correspondence_desk = __esm({
       }
       #count(link, mount) {
         const head = this.kernel.head(mount, ++this.#requestId);
-        const acknowledged = this.#cursor(link, mount)?.local ?? this.kernel.resolveRef(mount, ++this.#requestId, TRACKED_MAIN2);
+        const acknowledged = this.#cursor(link, mount)?.local ?? this.#heldPeerMain(link, mount, head) ?? this.kernel.resolveRef(mount, ++this.#requestId, TRACKED_MAIN2);
         if (!head || !acknowledged) return void 0;
         const count = (base, tip) => {
           if (base === tip) return 0;
@@ -19427,6 +19834,14 @@ var init_live_correspondence_desk = __esm({
       #holds(mount, base, tip) {
         return this.#chain(mount, base, tip)?.reachedBase === true;
       }
+      /** The custodian's main as last heard, when this copy holds it on its own head's chain above the
+       * sealed bookmark: the commits up to it came from the stream and are the custodian's (CAP-838). */
+      #heldPeerMain(link, mount, head, tracked = this.kernel.resolveRef(mount, ++this.#requestId, TRACKED_MAIN2)) {
+        const main = link.peerMain;
+        if (!main || !head || main === tracked) return void 0;
+        if (tracked && !this.#holds(mount, tracked, main)) return void 0;
+        return this.#holds(mount, main, head) ? main : void 0;
+      }
       /** This connection's admission cursor, while it still leads the saved bookmark. A cursor on local
        * history (admitted, not yet sealed) remembers the bookmark it was set above; once anything else
        * moves the bookmark (a follow round adopting the custodian's main) the bookmark rules again, so
@@ -19503,7 +19918,7 @@ var init_live_correspondence_desk = __esm({
           evidencePack: options.carryCommits || intents.some((intent) => intent.transportRequirement === IntentTransportRequirement.COMMIT_TREE) ? this.kernel.packDelta(mount, requestId, batchHead, base) : new Uint8Array()
         });
       }
-      receive(request, receipt) {
+      receive(receipt) {
         const link = [...this.#links.values()].find((item) => item.id === receipt.connectionId);
         if (!link) return;
         if (receipt.observation.case === "closed" || receipt.observation.case === "closure") {
@@ -19517,6 +19932,7 @@ var init_live_correspondence_desk = __esm({
           link.ownMains = [];
           delete link.lastAnnounced;
           delete link.lastPlacementAnnounced;
+          link.peerMain = void 0;
           link.dirty = true;
           link.due = this.clock.monotonicNanoseconds() + BigInt(Math.min(3e4, 250 * 2 ** Math.min(link.failures++, 7))) * 1000000n;
           return;
@@ -19526,7 +19942,6 @@ var init_live_correspondence_desk = __esm({
           link.openedAt = this.clock.monotonicNanoseconds();
           link.failures = 0;
           link.unheard = void 0;
-          if (!link.publisher) this.#hello(link);
           if (!link.publisher) this.inbound.opened(link.binding.workspace);
           this.linkOpened?.(link.binding.workspace);
           return;
@@ -19560,18 +19975,6 @@ var init_live_correspondence_desk = __esm({
         if (this.inbound.frame(link.binding.workspace, frame2.message)) return;
         if (frame2.message.case === "frontier") {
           this.#announced(link, frame2.message.value.head);
-          if (this.kernel.isResident(link.binding.workspace) === false) return;
-          if (!frame2.message.value.response) {
-            this.#send(link, { case: "frontier", value: {
-              head: this.kernel.head(workspaceMount(link.binding.workspace), ++this.#requestId) ?? "",
-              response: true
-            } });
-          }
-          try {
-            const batch2 = this.export(link.binding, frame2.message.value.head, ++this.#requestId);
-            if (batch2.source.case === "inline" && batch2.source.value.offers.length) this.#send(link, { case: "offers", value: batch2 });
-          } catch {
-          }
           return;
         }
         if (frame2.message.case === "admission") {
@@ -19579,48 +19982,18 @@ var init_live_correspondence_desk = __esm({
           this.progressChanged?.(link.binding.workspace);
           return;
         }
-        if (frame2.message.case !== "offers") return;
-        const batch = frame2.message.value;
-        if (batch.protocolVersion !== 2 || !batch.requestId || batch.source.case !== "inline" || !batch.source.value.offers.length) return;
-        const offers = batch.source.value.offers.filter((offer) => !this.#own.hasCommit(link.binding.workspace, offer.commitOid));
-        if (!offers.length) return;
-        if (this.kernel.isResident(link.binding.workspace) === false && !this.inbound.wanted(link.binding.workspace)) {
-          this.remoteAdvanced?.(link.binding.workspace);
-          return;
-        }
-        if (this.receiveStep !== void 0 && offers.length > this.receiveStep.offers) {
-          this.remoteAdvanced?.(link.binding.workspace);
-          return;
-        }
-        if ([...this.#pending.values()].some((pending) => pending.link === link && pending.bytes.length === bytes.length && pending.bytes.every((byte, index) => byte === bytes[index]))) return;
-        if (this.#pending.size >= 32) return;
-        this.#pending.set(request.requestId, { link, bytes });
-        return create50(RuntimeRequestSchema, {
-          protocolVersion: 2,
-          requestId: request.requestId,
-          target: { workspace: link.binding.workspace, session: link.binding.replicaId },
-          // HTTP sender reconciliation controls are not part of a live proposal.
-          // Keeping fastForwardOnly while removing baseHead silently skips every
-          // offer against a nonempty local head. The Kernel judges sealed causality;
-          // live receivers neither ask for a return archive nor confirm the sender.
-          command: { case: "admitCustodyOffers", value: create50(CustodyOfferBatchRequestSchema, {
-            ...batch,
-            baseHead: void 0,
-            observedHead: void 0,
-            fastForwardOnly: false,
-            ...offers.length === batch.source.value.offers.length ? {} : { source: { case: "inline", value: { ...batch.source.value, offers } } }
-          }) }
-        });
+      }
+      /** The newest local commit the custodian admitted unchanged over this workspace's open link: its
+       * main holds that commit, sealed or not, so it is no work to offer (CAP-838). */
+      admittedLocal(workspace) {
+        const link = this.#links.get(workspace);
+        const cursor = link?.state === "open" && !link.publisher ? link.custodian : void 0;
+        return cursor && cursor.main === cursor.local ? cursor.local : void 0;
       }
       /** Offers this replica sent another way (the HTTP lane): their echo on the live link is its own. */
       offered(workspace, commitOids) {
         this.#own.commits(workspace, commitOids);
       }
-      /** Whether this request is the admission of a batch relayed to this follower over its live link.
-       * Such an admission is never answered to a sender, so it keeps no custody receipts (CAP-759). */
-      relayed(requestId) {
-        return this.#pending.has(requestId);
-      }
       /**
        * The custodian judged a live batch. Admission acknowledges the batch at once; its admitted main
        * becomes this connection's cursor when it is already in local verified history. The saved
@@ -19640,9 +20013,10 @@ var init_live_correspondence_desk = __esm({
             ...admission.sealedMain ? { sealed: admission.sealedMain } : {}
           };
         }
-        if (!admission?.main || this.kernel.isResident(workspace) === false) return;
+        if (!admission?.main) return;
         const ownBatchHead = this.#own.batchHead(workspace, live.requestId);
         const ours = ownBatchHead !== void 0;
+        if (this.kernel.isResident(workspace) === false) return;
         let stale = false;
         if (ours) link.unheard = void 0;
         if (ours && link.stream) {
@@ -19730,6 +20104,7 @@ var init_live_correspondence_desk = __esm({
        * upstream head it already recorded. Re-announcing a known frontier - which is all an
        * upstream can do while this replica is ahead or held on a dependency - is not an event. */
       #announced(link, head) {
+        if (head) link.peerMain = head;
         if (!head || link.lastAnnounced === head) return;
         link.lastAnnounced = head;
         if (this.kernel.isResident(link.binding.workspace) === false) {
@@ -19754,15 +20129,6 @@ var init_live_correspondence_desk = __esm({
         if (frontier === this.kernel.resolveRef(mount, ++this.#requestId, PLACEMENT_REF3)) return;
         this.placementAdvanced?.(link.binding.workspace);
       }
-      settled(request, response) {
-        if (response.outcome.case === "correspondencePending" || response.outcome.case === "localReadPending") return;
-        this.#pending.delete(request.requestId);
-      }
-      failed(requestId) {
-        const pending = this.#pending.get(requestId);
-        this.#pending.delete(requestId);
-        if (pending) this.remoteAdvanced?.(pending.link.binding.workspace);
-      }
       disconnect(workspace) {
         const link = this.#links.get(workspace);
         if (!link) return;
@@ -19770,7 +20136,6 @@ var init_live_correspondence_desk = __esm({
         if (link.state === "open") this.linkClosed?.(workspace, closure);
         this.#links.delete(workspace);
         this.#progress.delete(workspace);
-        for (const [id, pending] of this.#pending) if (pending.link === link) this.#pending.delete(id);
       }
       /** The digest of the settled-letter outcomes this copy holds; empty when it cannot tell. */
       #outcomesDigest(workspace) {
@@ -19808,14 +20173,6 @@ var init_live_correspondence_desk = __esm({
         transfer.retain(create50(PeerGitRefsFetchedSchema, { refs: [...wanted.refs], pack }));
         this.progressChanged?.(link.binding.workspace);
       }
-      #hello(link) {
-        if (this.kernel.isResident(link.binding.workspace) === false) return;
-        const head = this.kernel.head(workspaceMount(link.binding.workspace), ++this.#requestId);
-        this.#send(link, { case: "frontier", value: {
-          head: head ?? "",
-          outcomesDigest: this.#outcomesDigest(link.binding.workspace)
-        } });
-      }
       drive() {
         const now2 = this.clock.monotonicNanoseconds();
         let wake;
@@ -19864,7 +20221,8 @@ var init_live_correspondence_desk = __esm({
                   link.custodian = void 0;
                 }
                 this.#cursor(link, mount);
-                const answered2 = link.publisher ? link.published ??= head ?? "" : link.custodian?.local ?? this.kernel.resolveRef(mount, ++this.#requestId, TRACKED_MAIN2) ?? "";
+                let answered2 = link.publisher ? link.published ??= head ?? "" : link.custodian?.local ?? this.kernel.resolveRef(mount, ++this.#requestId, TRACKED_MAIN2) ?? "";
+                if (!link.publisher && !link.custodian) answered2 = this.#heldPeerMain(link, mount, head, answered2) ?? answered2;
                 const fence = link.custodian?.main ?? answered2;
                 if (link.stream && !(head && this.#holds(mount, link.stream.sent, head))) {
                   link.stream = void 0;
@@ -19965,7 +20323,6 @@ var init_live_correspondence_desk = __esm({
       }
       close() {
         for (const workspace of [...this.#links.keys()]) this.disconnect(workspace);
-        this.#pending.clear();
       }
     };
   }
@@ -21007,12 +21364,14 @@ var init_custody_offer = __esm({
 import { create as create59 } from "@bufbuild/protobuf";
 function releaseSyncJudgment(workspace) {
   judgedThisLifetime.delete(workspace);
+  notContainedThisLifetime.delete(workspace);
 }
-var PLACEMENT_REF4, RECEIVED_PLACEMENT_REF, STREAM_BATCH_OFFERS, REMOUNT_AFTER_OFFERS, HISTORY_SLICES, WorkspaceSyncPhase, trackedMain, deferredRemote, deferredLocal, judgedThisLifetime, MAX_REBASES_PER_ROUND, elapsedMillis, WorkspaceSyncWork;
+var PLACEMENT_REF4, RECEIVED_PLACEMENT_REF, STREAM_BATCH_OFFERS, REMOUNT_AFTER_OFFERS, MAX_REMOUNTS_LOST, HISTORY_SLICES, WorkspaceSyncPhase, trackedMain, deferredRemote, deferredLocal, judgedThisLifetime, notContainedThisLifetime, MAX_NOT_CONTAINED, NOT_CONTAINED_REFUSALS, MAX_REBASES_PER_ROUND, elapsedMillis, WorkspaceSyncWork;
 var init_workspace_sync = __esm({
   "../peer-office/src/runtime/workspace_sync.ts"() {
     "use strict";
     init_placement_fetch();
+    init_kernel_failure();
     init_effect_outcome_refs();
     init_law_products_digest();
     init_law_products_digest();
@@ -21029,6 +21388,7 @@ var init_workspace_sync = __esm({
     RECEIVED_PLACEMENT_REF = "refs/remotes/nomos/placement";
     STREAM_BATCH_OFFERS = 64;
     REMOUNT_AFTER_OFFERS = 128;
+    MAX_REMOUNTS_LOST = 2;
     HISTORY_SLICES = [8, 64, 256, 256];
     WorkspaceSyncPhase = Object.freeze({
       Idle: "idle",
@@ -21047,6 +21407,9 @@ var init_workspace_sync = __esm({
     deferredRemote = "refs/remotes/nomos/deferred";
     deferredLocal = "refs/nomos/sync-deferred-local";
     judgedThisLifetime = /* @__PURE__ */ new Map();
+    notContainedThisLifetime = /* @__PURE__ */ new Map();
+    MAX_NOT_CONTAINED = 1024;
+    NOT_CONTAINED_REFUSALS = /* @__PURE__ */ new Set(["nomos.stream.off_main", "nomos.stream.history_required"]);
     MAX_REBASES_PER_ROUND = 2;
     elapsedMillis = (clock2, started) => {
       const finished = clock2.monotonicNanoseconds();
@@ -21102,6 +21465,7 @@ var init_workspace_sync = __esm({
       #lastStep;
       #probeOnly;
       #liveConnected;
+      #liveAdmitted;
       /** Set when this round adopted the upstream's own head as its base (see #establishBase). */
       #establishedBase;
       #receiveState;
@@ -21118,6 +21482,11 @@ var init_workspace_sync = __esm({
       /** The custodian head this round last offered or pulled from. */
       #rebaseFrom;
       #rebases = 0;
+      #remountsLost = 0;
+      /** This round's level ask is a containment question (CAP-870): on a refusal, take this path. */
+      #containment;
+      /** The stale bookmark a contained round replaces: its custodian's main holds the local head. */
+      #containedBookmark;
       /** Local intents this round's rebase refused and parked on the refused-offer desk. */
       #parkedLocal = 0;
       /** An application-authorized drop: replace local custody at exactly this head. */
@@ -21139,6 +21508,7 @@ var init_workspace_sync = __esm({
         this.#placementFetched = args.placementFetched;
         this.#probeOnly = args.probeOnly ?? false;
         this.#liveConnected = args.liveConnected === true;
+        this.#liveAdmitted = args.liveAdmitted;
         this.#receiveState = args.receiveState;
         this.#completeHistory = args.completeHistory === true;
         this.#repairMissingCommit = args.repairMissingCommit === true;
@@ -21213,9 +21583,15 @@ var init_workspace_sync = __esm({
         if (this.#receiveState) return this.#acquire("full");
         if (this.#replaceLocalHead !== void 0) return this.#acquire(this.#repairMissingCommit ? "full" : "mount");
         if (!this.#localHead) return this.#acquire(this.#completeHistory ? "full" : "mount");
-        if (this.#liveConnected && !this.#probeOnly && this.#holdsLocalWork() && this.#previousHead) {
-          return this.#offerOrReconcile();
+        const unadmitted = this.#holdsLocalWork() && this.#localHead !== this.#liveAdmitted;
+        if (this.#liveConnected && unadmitted && this.#previousHead) {
+          if (this.#mayBeContained()) return this.#askContainment("offer");
+          return this.#notContained();
         }
+        if (this.#liveConnected && this.#probeOnly && this.#previousHead && this.#holdsUnsyncedCommits() && this.#command.admit && this.#localHead === this.#liveAdmitted) {
+          return this.#acquire("level");
+        }
+        if (this.#liveConnected && !this.#probeOnly && !unadmitted) return this.#acquire("level");
         const requestId = `${this.#binding.replicaId}:${this.#requestId}:${this.workId}:frontier`;
         return this.#beginOffer(encodeInlineCustodyOffer({
           session: this.#binding.replicaId,
@@ -21224,6 +21600,60 @@ var init_workspace_sync = __esm({
           intents: []
         }), { case: "awaiting", requestId }, true);
       }
+      /** Whether the custodian's main may hold this copy's head: not already refused in this lifetime. */
+      #mayBeContained() {
+        return !!this.#localHead && this.#offerHead === void 0 && notContainedThisLifetime.get(this.#mount.workspace) !== this.#localHead;
+      }
+      /** The probe named a custodian main that is not on this copy's own chain, so the copy's head may be
+       * on the custodian's. A main below the local head (the custodian is behind) cannot contain it. A
+       * complete copy answers a main it does not hold after one existence check, and one it holds after
+       * a walk to where the two chains join. A kernel that cannot say keeps the existing path. */
+      #custodianMainOffLocalChain() {
+        if (!this.#kernel.historySummary || !this.#desiredHead || !this.#localHead) return false;
+        try {
+          return !this.#kernel.historySummary(this.#mount, this.#requestId, this.#desiredHead, this.#localHead).reachedBase;
+        } catch (error) {
+          return error instanceof KernelHistoryRequired;
+        }
+      }
+      /** Level from the local head (CAP-870). The stream answers with the custodian's commits above it
+       * (or "level") only when its main holds that head; then this round converges onto them, moves the
+       * bookmark, and offers nothing. One custodian lookup, O(commits behind); no local enumeration. */
+      #askContainment(otherwise) {
+        this.#containment = otherwise;
+        return this.#acquire("level");
+      }
+      /** The stream answered from the local head: it is on the custodian's main. The stale bookmark
+       * stays this round's to replace; the local head is the round's base from here. */
+      #contained() {
+        this.#containment = void 0;
+        this.#containedBookmark = this.#previousHead;
+        this.#previousHead = this.#localHead;
+      }
+      /** The custodian's main does not hold the local head (or the stream could not say): the copy holds
+       * work of its own. Go straight on to the pull/rebase/offer path. A dependency planner's probe hands
+       * the round back to it to plan the outbound suffix. */
+      #notContained(code) {
+        const otherwise = this.#containment ?? "offer";
+        this.#containment = void 0;
+        if (code !== void 0 && NOT_CONTAINED_REFUSALS.has(code) && this.#localHead) {
+          if (notContainedThisLifetime.size >= MAX_NOT_CONTAINED && !notContainedThisLifetime.has(this.#mount.workspace)) {
+            notContainedThisLifetime.delete(notContainedThisLifetime.keys().next().value);
+          }
+          notContainedThisLifetime.set(this.#mount.workspace, this.#localHead);
+        }
+        if (this.#probeOnly) {
+          this.#needsReconciliation = true;
+          return this.#finish(create59(SyncWorkspaceResponseSchema, {
+            workspace: this.#mount.workspace,
+            currentHead: this.#localHead,
+            previousHead: this.#previousHead,
+            stillAhead: true,
+            offerReceipt: this.#offerReceipt
+          }));
+        }
+        return otherwise === "pull" ? this.#pullBeforeOffer() : this.#offerOrReconcile();
+      }
       #offerOrReconcile() {
         if (this.#command.admit && this.#localHead && this.#localHead !== this.#previousHead) {
           const suffix = this.#kernel.transportIntentsAbove(
@@ -21302,7 +21732,14 @@ var init_workspace_sync = __esm({
         return this.#previousHead === void 0 && this.#localHead !== void 0 && this.#replaceLocalHead === void 0;
       }
       #holdsLocalWork() {
-        return this.#command.admit && !!this.#localHead && this.#localHead !== this.#previousHead;
+        return this.#command.admit && this.#holdsUnsyncedCommits();
+      }
+      /** Commits on local main the provider has not been seen to admit, whether or not this round may
+       * offer them. Remount replaces local main, so it asks this, never the admit-gated question: a copy
+       * holding unsynced work is offered and rebased, never remounted. A copy without a bookmark cannot
+       * prove it holds nothing of its own. */
+      #holdsUnsyncedCommits() {
+        return !!this.#localHead && this.#localHead !== this.#previousHead;
       }
       /** Ask only for the custodian's delta; the offer follows once this peer has rebased. */
       #pullBeforeOffer() {
@@ -21340,13 +21777,13 @@ var init_workspace_sync = __esm({
         }
         if (purpose === "level") {
           this.#state = { phase: WorkspaceSyncPhase.Stream, purpose, startedAt };
-          return this.#streamEffect("level", { case: "level", value: create59(LiveFrontierSchema, {
+          return this.#streamEffect(this.#containment ? "contain" : "level", { case: "level", value: create59(LiveFrontierSchema, {
             head: this.#localHead ?? "",
             response: false,
             maxOffers: this.#receiveStep?.offers ?? STREAM_BATCH_OFFERS,
             // Only a copy holding no work above its bookmark may be remounted instead of replaying, and
             // never one whose durable copy must hold the complete history (a head-only mount it cannot keep).
-            remountAfterOffers: this.#holdsLocalWork() || this.#completeHistory ? 0 : REMOUNT_AFTER_OFFERS
+            remountAfterOffers: this.#holdsUnsyncedCommits() || this.#completeHistory ? 0 : REMOUNT_AFTER_OFFERS
           }) });
         }
         const outcomes = new EffectOutcomeTransfer(this.#kernel, this.#mount, this.#requestId);
@@ -21423,6 +21860,7 @@ var init_workspace_sync = __esm({
         }
         if (answer.outcome.case === "refusal") {
           const refusal2 = answer.outcome.value;
+          if (state.purpose === "level" && this.#containment) return this.#notContained(refusal2.code);
           if (state.afterPlacement) return this.#finish(state.afterPlacement);
           return this.#transportFailure(`${refusal2.code}: ${refusal2.message}`, false);
         }
@@ -21459,6 +21897,11 @@ var init_workspace_sync = __esm({
             state.startedAt
           );
         }
+        if (state.purpose === "level" && this.#containment) {
+          const answeredFromHead = answer.outcome.case === "level" || answer.outcome.case === "pack" && answer.outcome.value.base === this.#localHead;
+          if (!answeredFromHead) return this.#notContained();
+          this.#contained();
+        }
         if (state.purpose === "level" && answer.outcome.case === "pack" && answer.outcome.value.base) {
           const batch = answer.outcome.value;
           if (batch.base !== this.#previousHead && batch.base !== this.#kernel.head(this.#mount, this.#requestId)) {
@@ -21597,13 +22040,19 @@ var init_workspace_sync = __esm({
       /**
        * A copy holding no work above its bookmark, too far behind to replay the backlog: mount the
        * peer's checkpoint in place of its exact local main (O(state), the same trust as a cold mount).
-       * The kernel keeps the replaced head at refs/heads/custody-preserved/<old>; that head was only a
-       * bookmark of the provider's own main, so the preservation is released at once.
+       * The kernel keeps the replaced head at refs/heads/custody-preserved/<old>. That ref is custody the
+       * kernel guards (custody may not delete an effectful branch), so it is left where it is: a remount
+       * that deleted it threw after main had already moved, leaving the bookmark behind main and the
+       * round failed for ever (2026-10-08, estate-5b493d6b).
+       *
+       * The copy may have moved while the checkpoint streamed (a live batch, a local write). Then it is
+       * no longer the copy the remount was asked for: take the round up again from its new head. Local
+       * work is offered first; a copy that is still only behind asks to level again.
        */
       #remount(candidateHead, receivedBytes, prefetchMillis) {
         const expected = this.#kernel.head(this.#mount, this.#requestId);
-        if (expected === void 0 || expected !== this.#localHead || this.#holdsLocalWork()) {
-          return this.#transportFailure("the copy changed while its remount was streaming", false);
+        if (expected === void 0 || expected !== this.#localHead || this.#holdsUnsyncedCommits()) {
+          return this.#remountLost(expected);
         }
         const started = this.#clock.monotonicNanoseconds();
         if (candidateHead !== expected) {
@@ -21611,7 +22060,6 @@ var init_workspace_sync = __esm({
           if (!restored.accepted || restored.head !== candidateHead) {
             throw new Error(`kernel refused to remount '${this.#mount.workspace}' at ${candidateHead}`);
           }
-          this.#kernel.deleteRef?.(this.#mount, this.#requestId, `refs/heads/custody-preserved/${expected}`);
           this.#providerCustodyMounted();
         }
         return this.#converged(create59(SyncResponseSchema, {
@@ -21621,6 +22069,25 @@ var init_workspace_sync = __esm({
           admittedRemoteHead: candidateHead
         }), candidateHead, receivedBytes, prefetchMillis, started);
       }
+      /** The remount's copy changed under it. Bounded: a copy that keeps moving under live traffic is
+       * levelled by its live link anyway, and the next round starts from wherever it got to. */
+      #remountLost(head) {
+        if (head === void 0 || ++this.#remountsLost > MAX_REMOUNTS_LOST) {
+          return this.#transportFailure("the copy changed while its remount was streaming", false);
+        }
+        this.#localHead = head;
+        this.#previousHead = this.#kernel.resolveRef(this.#mount, this.#requestId, trackedMain);
+        if (this.#desiredHead === this.#localHead) {
+          return this.#converged(create59(SyncResponseSchema, {
+            admitted: true,
+            head,
+            candidateHead: head,
+            admittedRemoteHead: head
+          }), head, 0, 0);
+        }
+        if (this.#holdsLocalWork() && this.#desiredHead !== this.#previousHead) return this.#pullBeforeOffer();
+        return this.#offerOrReconcile();
+      }
       resume(receipt) {
         if (receipt.effectId === this.#lastReceiptEffectId && this.#lastStep) {
           return this.#lastStep;
@@ -21785,6 +22252,10 @@ var init_workspace_sync = __esm({
               offerReceipt: this.#offerReceipt
             }));
           }
+          const custodianMoved = this.#holdsLocalWork() && this.#desiredHead !== this.#previousHead;
+          if (custodianMoved && this.#mayBeContained() && this.#custodianMainOffLocalChain()) {
+            return this.#askContainment("pull");
+          }
           if (this.#probeOnly) {
             this.#needsReconciliation = true;
             return this.#finish(create59(SyncWorkspaceResponseSchema, {
@@ -21795,9 +22266,7 @@ var init_workspace_sync = __esm({
               offerReceipt: this.#offerReceipt
             }));
           }
-          if (this.#holdsLocalWork() && this.#desiredHead !== this.#previousHead) {
-            return this.#pullBeforeOffer();
-          }
+          if (custodianMoved) return this.#pullBeforeOffer();
           return this.#offerOrReconcile();
         }
         this.#admissionSummary = summarizeCustodyAdmission(admission);
@@ -22131,7 +22600,8 @@ var init_workspace_sync = __esm({
         }));
       }
       #converged(verdict, candidateHead, receivedBytes, prefetchMillis, started = this.#clock.monotonicNanoseconds(), rebirth) {
-        if (verdict.admitted && this.#candidateDurable && candidateHead !== this.#previousHead && this.#kernel.resolveRef(this.#mount, this.#requestId, trackedMain) === this.#previousHead) {
+        const tracked = verdict.admitted && this.#candidateDurable ? this.#kernel.resolveRef(this.#mount, this.#requestId, trackedMain) : void 0;
+        if (verdict.admitted && this.#candidateDurable && tracked !== candidateHead && (tracked === this.#previousHead || this.#containedBookmark !== void 0 && tracked === this.#containedBookmark)) {
           this.#kernel.writeRef(
             this.#mount,
             this.#requestId,
@@ -22428,10 +22898,16 @@ var init_workspace_sync_dependencies = __esm({
           this.#plan = [this.#args.root];
           return this.#advance();
         }
-        if (this.#args.liveConnected && this.#args.kernel.resolveRef(this.#args.root.mount, this.#args.requestId, trackedMain2)) {
+        const { kernel, requestId, root } = this.#args;
+        const tracked = this.#args.liveConnected ? kernel.resolveRef(root.mount, requestId, trackedMain2) : void 0;
+        if (tracked && kernel.head(root.mount, requestId) === tracked) {
           this.#plan = this.#planDependencies();
           return this.#advance();
         }
+        if (tracked) {
+          this.#current = this.#work(root, `${this.workId}:contain`, true);
+          return this.#accept(this.#current.start());
+        }
         this.#current = this.#work(this.#args.root, `${this.workId}:frontier`, true);
         return this.#accept(this.#current.start());
       }
@@ -23804,6 +24280,11 @@ var init_replica_follow_lane = __esm({
         const delay = this.#controller.reconnected(workspace);
         if (delay !== void 0) this.#scheduleAt(workspace, this.#now() + delay);
       }
+      /** The upstream announced a new frontier: news even to a follow the kernel refused. */
+      remoteAdvanced(workspace) {
+        const delay = this.#controller.reconnected(workspace, true);
+        if (delay !== void 0) this.#scheduleAt(workspace, this.#now() + delay);
+      }
       /** The upstream rang for a new placement frontier (see ReplicaFollowController). */
       placementAnnounced(workspace) {
         const delay = this.#controller.placementAnnounced(workspace);
@@ -24158,6 +24639,7 @@ var init_correspondence_desk = __esm({
       #onPlacementFetched;
       #onShallowMount;
       #onOffered;
+      #liveAdmitted;
       #onOutboxHistoryRequired;
       #backgroundHistory;
       #receiveStep;
@@ -24214,6 +24696,7 @@ var init_correspondence_desk = __esm({
         this.#onPlacementFetched = args.onPlacementFetched;
         this.#onShallowMount = args.onShallowMount;
         this.#onOffered = args.onOffered;
+        this.#liveAdmitted = args.liveAdmitted;
         this.#onOutboxHistoryRequired = args.onOutboxHistoryRequired;
         this.#backgroundHistory = args.backgroundHistory !== false;
         this.#receiveStep = args.receiveStep;
@@ -24540,6 +25023,12 @@ var init_correspondence_desk = __esm({
         this.#followLane.reconnected(workspace);
         this.reportFollows();
       }
+      /** The upstream announced a new frontier for this workspace over its live link: an event which
+       * re-runs a round the kernel refused (its inputs changed). */
+      replicaRemoteAdvanced(workspace) {
+        this.#followLane.remoteAdvanced(workspace);
+        this.reportFollows();
+      }
       /** The upstream rang for a new placement frontier: the next round re-checks placement even
        * though main has not moved. */
       replicaPlacementAnnounced(workspace) {
@@ -24576,10 +25065,11 @@ var init_correspondence_desk = __esm({
           const state = this.#follows.followForWorkspace(workspace)?.state;
           if (!state) return [];
           const isSettled = state.case === ReplicaFollowPhase.Settled;
+          const refused = state.case === ReplicaFollowPhase.Backoff && state.refusal?.blocked === true;
           const isLive = this.#openLinks.has(workspace);
           if (isSettled) settled += 1;
           if (isLive) live += 1;
-          const phase = {
+          const phase = refused ? FollowObservationPhase.KERNEL_REFUSED : {
             [ReplicaFollowPhase.Desired]: FollowObservationPhase.DESIRED,
             [ReplicaFollowPhase.Due]: FollowObservationPhase.DUE,
             [ReplicaFollowPhase.Running]: FollowObservationPhase.RUNNING,
@@ -24593,7 +25083,7 @@ var init_correspondence_desk = __esm({
             [ReplicaFollowPhase.LocalCopyUnreadable]: FollowObservationPhase.LOCAL_COPY_UNREADABLE
           }[state.case];
           const detail = state.case === ReplicaFollowPhase.AwaitingDependency ? state.reason : state.case === ReplicaFollowPhase.InvalidCredential || state.case === ReplicaFollowPhase.Backoff ? state.failure : state.case === ReplicaFollowPhase.RebornRemotely ? state.rebirth.detail : state.case === ReplicaFollowPhase.LocalCopyUnreadable ? state.format : void 0;
-          const retryAt = state.case === ReplicaFollowPhase.Offline || state.case === ReplicaFollowPhase.InvalidCredential || state.case === ReplicaFollowPhase.Backoff ? state.retryAtUnixMillis : void 0;
+          const retryAt = refused ? state.case === ReplicaFollowPhase.Backoff ? state.refusal?.rerunAtUnixMillis : void 0 : state.case === ReplicaFollowPhase.Offline || state.case === ReplicaFollowPhase.InvalidCredential || state.case === ReplicaFollowPhase.Backoff ? state.retryAtUnixMillis : void 0;
           const dueAt2 = state.case === ReplicaFollowPhase.Due || state.case === ReplicaFollowPhase.ReplacingLocal ? state.dueAtUnixMillis : void 0;
           const attempt = state.case === ReplicaFollowPhase.Running || state.case === ReplicaFollowPhase.Offline || state.case === ReplicaFollowPhase.InvalidCredential || state.case === ReplicaFollowPhase.Backoff || state.case === ReplicaFollowPhase.ReplacingLocal ? state.attempt : void 0;
           const activeEffect = state.case === ReplicaFollowPhase.Running ? this.#activeSyncEffect(workspace) : void 0;
@@ -25091,6 +25581,7 @@ var init_correspondence_desk = __esm({
             workId: id,
             probeOnly,
             liveConnected: this.#openLinks.has(target3.mount.workspace),
+            ...this.#openLinks.has(target3.mount.workspace) && this.#liveAdmitted?.(target3.mount.workspace) ? { liveAdmitted: this.#liveAdmitted(target3.mount.workspace) } : {},
             ...beforeConverge === void 0 ? {} : { beforeConverge },
             ...target3.receiveState === void 0 ? {} : { receiveState: target3.receiveState },
             ...target3.offerHead === void 0 ? {} : { offerHead: target3.offerHead },
@@ -26824,10 +27315,10 @@ var init_offer_readiness_desk = __esm({
         while (true) {
           this.#ports.owe(owed.workspace);
           while (this.#ports.owes(owed.workspace)) {
-            const tick = this.#ports.tick();
+            const { ticked, wake: readiness } = this.#ports.tick();
             const delayMillis = Math.min(LONGEST_WAKE_MILLIS, Math.max(
               FIRST_WAKE_MILLIS,
-              tick.progress !== void 0 ? FIRST_WAKE_MILLIS : tick.nextTickAfterMillis
+              ticked.progress !== void 0 ? FIRST_WAKE_MILLIS : readiness.case === "after" ? readiness.millis : LONGEST_WAKE_MILLIS
             ));
             const receipt = yield { case: "wake", value: create75(PeerWakeEffectSchema, {
               effectId: `${workId2}:repay-${++wake}`,
@@ -26979,7 +27470,7 @@ function driveOfficeTurn(subscriptions, maintenance, followUp) {
   const wake = maintenance.drive();
   return subscriptions.owesRefresh ? 0n : wake;
 }
-var INTERACTIVE_PEER_CLASSES, INTERACTION_FIRST_MILLIS, READ_READINESS_ONLY, PLACEMENT_READ_RETRY_MILLIS, STREAM_WAKE_FIRST_MILLIS, HISTORY_STREAM_SLICES, STREAM_WAKE_MAX_MILLIS, CHECKPOINT_WAIT_LIMIT_NANOS, STREAM_WAIT_LIMIT_NANOS, BACKGROUND_YIELD_MILLIS, BACKGROUND_YIELD_LIMIT, BACKGROUND_YIELD_PREFIX, APPLICATION_WAITS, APPLICATION_WAIT_NANOS, READ_INDEX_BUILDING, PeerOffice, peerOffice;
+var INTERACTIVE_PEER_CLASSES, INTERACTION_FIRST_MILLIS, PLACEMENT_READ_RETRY_MILLIS, STREAM_WAKE_FIRST_MILLIS, HISTORY_STREAM_SLICES, STREAM_WAKE_MAX_MILLIS, CHECKPOINT_WAIT_LIMIT_NANOS, STREAM_WAIT_LIMIT_NANOS, BACKGROUND_YIELD_MILLIS, BACKGROUND_YIELD_LIMIT, BACKGROUND_YIELD_PREFIX, APPLICATION_WAITS, APPLICATION_WAIT_NANOS, PeerOffice, peerOffice;
 var init_peer_office = __esm({
   "../peer-office/src/peer_office.ts"() {
     "use strict";
@@ -27027,6 +27518,7 @@ var init_peer_office = __esm({
     init_shell_contract();
     init_birth_refusal();
     init_replica_follow_controller();
+    init_runtime_identity();
     init_replica_follow_desk();
     init_local_copy_drop();
     init_preserved_copies_desk();
@@ -27067,7 +27559,6 @@ var init_peer_office = __esm({
     init_pack_import_steps();
     INTERACTIVE_PEER_CLASSES = /* @__PURE__ */ new Set(["personal-device", "browser"]);
     INTERACTION_FIRST_MILLIS = 15e3;
-    READ_READINESS_ONLY = 1n << 62n;
     PLACEMENT_READ_RETRY_MILLIS = 60000n;
     STREAM_WAKE_FIRST_MILLIS = 20;
     HISTORY_STREAM_SLICES = [8, 64, 256];
@@ -27086,7 +27577,6 @@ var init_peer_office = __esm({
       "continueLocalRead"
     ]);
     APPLICATION_WAIT_NANOS = 5000000000n;
-    READ_INDEX_BUILDING = /the read index of .+ is being built|read maintenance continues it/;
     PeerOffice = class {
       #kernel;
       #sessions = new SessionDirectory();
@@ -27281,7 +27771,6 @@ var init_peer_office = __esm({
           }
         }, (workspace) => this.#residency.lastRetainedHead(workspace));
         if (this.#writeBurst) this.#live.writeBurst = this.#writeBurst;
-        if (this.#interactivePeer) this.#live.receiveStep = this.#receiveStepBudget;
         this.#credentials = new CredentialSessions(this.#sessions, credentials, observations);
         this.#readability = new LocalCopyReadability((workspace, format) => {
           this.#follows.markLocalCopyUnreadable(workspace, format);
@@ -27299,7 +27788,8 @@ var init_peer_office = __esm({
           new ReplicaFollowDesk(seatedStore),
           observations,
           this.#replicaId,
-          new BirthRefusalRegister(seatedStore)
+          new BirthRefusalRegister(seatedStore),
+          PEER_RUNTIME_IDENTITY
         );
         this.#compatibility = new CompatibilityDesk(
           this.#queries,
@@ -27318,13 +27808,20 @@ var init_peer_office = __esm({
           this.#trace,
           observations,
           {
-            readReady: (workspace) => this.#subscriptions.readIndexReady(workspace),
-            frontierAdvanced: (workspace) => this.#subscriptions.readIndexAdvanced(workspace),
-            localCopyUnreadable: (workspace, format) => this.#readability.mark(
-              workspace,
-              this.#kernel.head(workspaceMount(workspace), 0n),
-              format
-            ),
+            // A read waiting on this workspace is released by the readiness event itself, not a timer.
+            readReady: (workspace) => {
+              this.#subscriptions.readIndexReady(workspace);
+              this.#readResponses?.readinessChanged(workspace);
+            },
+            frontierAdvanced: (workspace) => {
+              this.#subscriptions.readIndexAdvanced(workspace);
+              this.#readResponses?.readinessChanged(workspace);
+            },
+            readinessMayChange: (workspace) => this.#readResponses?.readinessChanged(workspace),
+            localCopyUnreadable: (workspace, format) => {
+              this.#readability.mark(workspace, this.#kernel.head(workspaceMount(workspace), 0n), format);
+              this.#readResponses?.readinessChanged(workspace);
+            },
             isLocalCopyUnreadable: (workspace) => this.#readability.decide(workspace) !== void 0
           },
           // The kernel owes this peer's writes to an ordered background flush the desk schedules.
@@ -27386,7 +27883,7 @@ var init_peer_office = __esm({
                 aggregateIds: new Set([...admitted.affected, ...admitted.created].map((ref) => ref.id)),
                 // What the offer changed, typed as reads resolve it: watches it cannot change are not read.
                 stateChange: admitted.stateChange
-              }, () => this.#readMaintenance.tick(void 0, 0n, READ_READINESS_ONLY, false).progress !== void 0));
+              }, () => this.#readMaintenance.tickReadReadiness().ticked.progress !== void 0));
               noteTimeline("ownOffer", `${delivery.delivered}/${delivery.watches}`);
               noteTimeline("ownOfferSkipped", delivery.skipped);
             });
@@ -27401,7 +27898,12 @@ var init_peer_office = __esm({
           observations,
           // A waiting read advances read readiness only: it must never run a background command or
           // closure warm on the foreground's turn.
-          () => this.#readMaintenance.tick(void 0, 0n, READ_READINESS_ONLY, false),
+          () => this.#readMaintenance.tickReadReadiness(),
+          // A read the kernel still finds behind, with nothing owing its index, owes it again (as a watch does).
+          (request) => {
+            if (request.command.case !== "kernelCall") throw new Error("local read continuation lost its query");
+            this.#readMaintenance.schedule(request.command.value.session, ReadMaintenanceCause.READ_DEBT);
+          },
           (request) => {
             if (request.command.case !== "kernelCall") throw new Error("local read continuation lost its query");
             return this.#application.call(request, request.command.value);
@@ -27502,6 +28004,7 @@ var init_peer_office = __esm({
           onShallowMount: (workspace, credentialCapability) => this.#historyAcquisition.materialise(workspace, credentialCapability),
           // The edge echoes an HTTP offer batch back over this replica's own live link (CAP-764).
           onOffered: (workspace, commitOids) => this.#live.offered(workspace, commitOids),
+          liveAdmitted: (workspace) => this.#live.admittedLocal(workspace),
           onOutboxHistoryRequired: (workspace, credentialCapability) => this.#historyAcquisition.requestFromBackground(workspace, credentialCapability),
           backgroundHistory: profile.backgroundHistory !== false,
           onSyncCompleted: (session, event) => {
@@ -27527,7 +28030,7 @@ var init_peer_office = __esm({
           this.#origins.ignored(workspace, origin, "follow");
           return false;
         };
-        this.#live.remoteAdvanced = (workspace) => this.#correspondence.replicaLinkOpened(workspace);
+        this.#live.remoteAdvanced = (workspace) => this.#correspondence.replicaRemoteAdvanced(workspace);
         this.#live.declined = (workspace) => this.#correspondence.liveAdmissionDeclined(workspace);
         this.#live.acknowledged = (workspace, ack) => this.#correspondence.liveAdmissionAcknowledged(workspace, ack);
         this.#live.intentsAdmitted = (workspace, intentIds, local) => this.#correspondence.liveIntentsAdmitted(workspace, intentIds, local);
@@ -27739,7 +28242,7 @@ var init_peer_office = __esm({
           },
           owes: (workspace) => this.#readMaintenance.owesReadReadiness(workspace),
           // Read readiness only, as a waiting read takes: never a background command or pack import (CAP-806).
-          tick: () => this.#readMaintenance.tick(void 0, 0n, READ_READINESS_ONLY, false),
+          tick: () => this.#readMaintenance.tickReadReadiness(),
           emit: (session, event) => this.#trace.emit(session, event)
         });
         this.#modelAdoption = new ModelAdoptionDesk({
@@ -28137,9 +28640,8 @@ var init_peer_office = __esm({
         let pendingEffectId;
         try {
           if (request.command.case === "socketReceipt") {
-            const admission = this.#live.receive(request, request.command.value);
-            if (!admission) return this.#response(request, { case: "socketObserved", value: create76(PeerSocketObservedSchema) });
-            request = admission;
+            this.#live.receive(request.command.value);
+            return this.#response(request, { case: "socketObserved", value: create76(PeerSocketObservedSchema) });
           }
           const result = timelinePhase("access", () => this.#access.handle(request));
           if (result.outcome.case === "correspondencePending") {
@@ -28148,11 +28650,9 @@ var init_peer_office = __esm({
           }
           if (result.outcome.case === "watchStarted") this.#subscriptions.retainDependencies(result.outcome.value.subscriptionId, scope);
           this.#subscriptions.recoverySettled(result);
-          this.#live.settled(request, result);
           this.#correspondence.observeResponse(result);
           return result;
         } catch (error) {
-          this.#live.failed(request.requestId);
           const failure = this.#failure(request, "nomos.runtime.workspace_access", error instanceof Error ? error.message : String(error));
           this.#subscriptions.recoverySettled(failure);
           this.#correspondence.observeResponse(failure);
@@ -28419,11 +28919,7 @@ var init_peer_office = __esm({
               try {
                 const mount = this.#sessions.mountForWorkspace(request.target.workspace);
                 const previousHead = this.#kernel.head(mount, request.requestId);
-                const admission = this.#custodyAdmission.admit(
-                  request,
-                  request.command.value,
-                  { journal: !this.#live.relayed(request.requestId) }
-                );
+                const admission = this.#custodyAdmission.admit(request, request.command.value);
                 admission.sealedMain = this.#residency.retainedHead(request.target.workspace);
                 if (custodyAdmissionNeedsReadMaintenance(admission)) {
                   admission.localMaintenance = this.#readMaintenance.scheduleWorkspace(
@@ -28540,16 +29036,17 @@ var init_peer_office = __esm({
               });
             case "historicQuery": {
               const answered2 = this.#historicQueries.execute(request, request.command.value);
-              if (answered2.outcome.case === "failure" && READ_INDEX_BUILDING.test(answered2.outcome.value.message)) {
+              if (answered2.outcome.case === "query" && answered2.outcome.value.result.case === "readIndexPending") {
                 this.#readMaintenance.schedule(request.command.value.session, ReadMaintenanceCause.READ_DEBT);
+                const workspace = answered2.outcome.value.result.value.workspace || (this.#sessions.bindingIfPresent(request.command.value.session)?.workspace ?? "");
                 return this.#response(request, {
                   case: "unavailable",
                   value: create76(RuntimeUnavailableSchema, {
                     reason: RuntimeUnavailableReason.LOCAL_REPLICA_NOT_READY,
-                    workspace: this.#sessions.bindingIfPresent(request.command.value.session)?.workspace ?? "",
+                    workspace,
                     retryable: true,
                     retryAfterMillis: 250,
-                    detail: answered2.outcome.value.message
+                    detail: `the read index of ${workspace} is being built on this device; read maintenance continues it`
                   })
                 });
               }
@@ -28969,6 +29466,10 @@ var init_peer_office = __esm({
       nextEvent() {
         return this.#trace.nextEvent();
       }
+      /** In-process shells wait on a held local read here instead of polling `resumeAfterMillis`. */
+      localReadResumable(workId2, notify) {
+        return this.#readResponses.onResumable(workId2, notify);
+      }
       close() {
         if (this.retentionOutstanding() > 0) {
           throw new Error("custody retention pending; retain the acknowledged frontiers before disposing the peer");
@@ -29319,6 +29820,23 @@ function createPeerOfficeFrameRunner(kernel, credentials, profile, observations,
     lanes?.wake(delayMillis);
   };
   const runner = {
+    localReadResumable(workId2) {
+      let resolve4;
+      const resumable = new Promise((done) => {
+        resolve4 = done;
+      });
+      let timer;
+      const wait = peer2.localReadResumable(workId2, () => {
+        if (timer !== void 0) clearTimeout(timer);
+        resolve4();
+      });
+      if (wait === void 0) return void 0;
+      timer = setTimeout(() => {
+        wait.cancel();
+        resolve4();
+      }, wait.afterMillis);
+      return resumable;
+    },
     handleFrame(frame2) {
       const response = peer2.invoke(frame2).responseProtobuf;
       drainEvents();
@@ -29409,7 +29927,7 @@ async function drivePeerFrame(runner, initialFrame, fetchImpl = globalThis.fetch
     if (response.outcome.case === "localReadPending") {
       if (yieldLocalReadToCaller) return responseFrame;
       const pending2 = response.outcome.value;
-      await new Promise((resolve4) => setTimeout(resolve4, pending2.resumeAfterMillis));
+      await (runner.localReadResumable?.(pending2.workId) ?? new Promise((resolve4) => setTimeout(resolve4, pending2.resumeAfterMillis)));
       responseFrame = await turn(() => runner.handleFrame(toBinary28(RuntimeRequestSchema, create77(RuntimeRequestSchema, {
         protocolVersion: response.protocolVersion,
         requestId: response.requestId,
@@ -31459,12 +31977,10 @@ __export(governance_exports, {
   relaySealedOfferViaStage: () => relaySealedOfferViaStage,
   remoteOfferAuthority: () => remoteOfferAuthority,
   resolveGovernancePrincipal: () => resolveGovernancePrincipal,
-  signAndPostChildLifecycle: () => signAndPostChildLifecycle,
   signAndPostGovernance: () => signAndPostGovernance,
   signAndPostModelLifecycleOffer: () => signAndPostModelLifecycleOffer,
   signAndPostOffer: () => signAndPostOffer,
-  signAndPostWorkspaceBirth: () => signAndPostWorkspaceBirth,
-  signAndPostWorkspaceRetirement: () => signAndPostWorkspaceRetirement
+  signAndPostWorkspaceBirth: () => signAndPostWorkspaceBirth
 });
 import { createHash as createHash4, createPrivateKey, createPublicKey } from "node:crypto";
 import { create as create83 } from "@bufbuild/protobuf";
@@ -32370,38 +32886,6 @@ async function ensureApplicationWorkspace(application, opts = {}) {
     deployPrincipal: home.principal
   };
 }
-async function signAndPostWorkspaceRetirement(parent, workspaceId, creator, opts) {
-  return signAndPostPreparedOffer(
-    parent,
-    "workspaces",
-    (actor) => ({
-      directiveId: creator !== "" && sameIdentity(creator, actor) ? "retireOwnWorkspace" : "retireWorkspace",
-      payload: { workspaceId, retiredBy: lineageIdentity(actor), retiredAt: Date.now() }
-    }),
-    opts,
-    "self-if-unenrolled",
-    creator
-  );
-}
-async function signAndPostChildLifecycle(parent, child, creator, action, opts) {
-  return signAndPostPreparedOffer(
-    parent,
-    void 0,
-    (actor) => {
-      const creatorActing = creator !== "" && sameIdentity(creator, actor);
-      return action === "retire" ? {
-        directiveId: creatorActing ? "retireChild" : "retireChildAsAdmin",
-        payload: { child, principal: creator, retiredBy: lineageIdentity(actor), retiredAt: Date.now() }
-      } : {
-        directiveId: creatorActing ? "reclaimChild" : "reclaimChildAsAdmin",
-        payload: { child, reclaimedBy: lineageIdentity(actor), reclaimedAt: Date.now() }
-      };
-    },
-    opts,
-    "self-if-unenrolled",
-    creator
-  );
-}
 async function relaySealedOfferViaStage(cloud, ws, directiveId, intentBytesB64, fetchImpl) {
   const raw = Buffer.from(intentBytesB64, "base64");
   const sha2562 = createHash4("sha256").update(raw).digest("hex");
@@ -33086,8 +33570,6 @@ __export(cloud_exports, {
   waitForDurableMainAdvance: () => waitForDurableMainAdvance,
   whoami: () => whoami,
   wsCreate: () => wsCreate,
-  wsReclaim: () => wsReclaim,
-  wsRetire: () => wsRetire,
   wsStatus: () => wsStatus
 });
 import { chmodSync as chmodSync2, existsSync as existsSync6, mkdirSync as mkdirSync7, readdirSync as readdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync7 } from "node:fs";
@@ -33387,117 +33869,6 @@ async function wsStatus(name, opts) {
   out3(text);
   return 0;
 }
-async function childBirthRecord(cloud, parent, child) {
-  try {
-    const id = `nomos-birth-record:${child}`;
-    const r = await fetch(`${cloud}/v2/workspaces/${encodeURIComponent(parent)}/aggregates/${encodeURIComponent(id)}`);
-    const body = await r.json().catch(() => void 0);
-    return body?.ok === true ? body.rows?.find((row) => row.data?.child === child) : void 0;
-  } catch {
-    return void 0;
-  }
-}
-async function wsRetire(ws, opts) {
-  const cloud = cloudBase(opts.cloud);
-  const { signAndPostChildLifecycle: signAndPostChildLifecycle2, signAndPostWorkspaceRetirement: signAndPostWorkspaceRetirement2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
-  const parent = opts.parent ?? "root";
-  let record;
-  try {
-    const q = await fetch(`${cloud}/v2/workspaces/${parent}/workspaceByName?name=${encodeURIComponent(ws)}`);
-    const qd = await q.json().catch(() => void 0);
-    const rows = qd?.ok === true ? qd.rows ?? [] : [];
-    record = rows.find((r) => r.data?.status !== "retired" && r.data?.status !== "reclaimed") ?? rows[0];
-  } catch {
-  }
-  const recordId2 = record?.id;
-  if (recordId2 === void 0) {
-    const childRecord = await childBirthRecord(cloud, parent, ws);
-    if (childRecord === void 0) {
-      err3(
-        `retire '${ws}': no CloudWorkspace or NomosBirthRecord named '${ws}' in ${parent}'s registry \u2014 nothing lawful to retire.
-  An out-of-band custody repo has no parent lifecycle fact and needs a custodian investigation.`
-      );
-      return 1;
-    }
-    const creator = childRecord.data?.principal ?? "";
-    let childVerdict;
-    try {
-      childVerdict = await signAndPostChildLifecycle2(parent, ws, creator, "retire", opts);
-    } catch (e) {
-      err3(e.message);
-      return 1;
-    }
-    if (!childVerdict.ok) {
-      err3(`retire '${ws}' refused (${childVerdict.status}): ${typeof childVerdict.body === "string" ? childVerdict.body : JSON.stringify(childVerdict.body)}`);
-      return 1;
-    }
-    out3(`\u2713 child ${ws} retired via signed lifecycle offer to ${parent} on ${cloud}`);
-    out3("  custody is retained; reclaim is a separate, law-gated terminal step");
-    return 0;
-  }
-  let v;
-  try {
-    const creator = record?.data?.createdBy ?? record?.data?.principal ?? "";
-    v = await signAndPostWorkspaceRetirement2(parent, recordId2, creator, opts);
-  } catch (e) {
-    err3(e.message);
-    return 1;
-  }
-  if (!v.ok) {
-    err3(`retire '${ws}' refused (${v.status}): ${typeof v.body === "string" ? v.body : JSON.stringify(v.body)}`);
-    if (JSON.stringify(v.body ?? "").includes("retire-own-only")) {
-      err3(
-        `note: you appear to BE '${ws}'s creator \u2014 the parent's deployed governance law may predate the
-  0.34.1 retireOwnWorkspace creator-normalization fix (the 'user:' subject prefix vs the bare uid).
-  A governance re-deploy to ${parent} fixes the self-service lane; meanwhile an ADMIN can retire it:
-  githolon ws retire ${ws} --as <admin-uid>`
-      );
-    }
-    return 1;
-  }
-  out3(`\u2713 workspace ${ws} retired via signed governance offer to ${parent} on ${cloud}`);
-  out3("  nothing was deleted \u2014 the ledger and its data are retained per the Nomos Pre-Release License");
-  out3("  it no longer counts toward your workspace allowance; reads keep serving, deploys/pushes refuse");
-  return 0;
-}
-async function wsReclaim(ws, opts) {
-  const cloud = cloudBase(opts.cloud);
-  const { signAndPostChildLifecycle: signAndPostChildLifecycle2, signAndPostGovernance: signAndPostGovernance2, resolveGovernancePrincipal: resolveGovernancePrincipal2 } = await Promise.resolve().then(() => (init_governance(), governance_exports));
-  const parent = opts.parent ?? "root";
-  let v;
-  try {
-    const principal = resolveGovernancePrincipal2(opts);
-    const q = await fetch(`${cloud}/v2/workspaces/${parent}/workspaceByName?name=${encodeURIComponent(ws)}`);
-    const qd = await q.json().catch(() => void 0);
-    const rows = qd?.ok === true ? qd.rows ?? [] : [];
-    const workspace = rows.find((r) => r.data?.status === "retired") ?? rows[0];
-    if (workspace?.id !== void 0) {
-      v = await signAndPostGovernance2(
-        parent,
-        "reclaimWorkspace",
-        { workspaceId: workspace.id, reclaimedBy: principal, reclaimedAt: Date.now() },
-        opts
-      );
-    } else {
-      const child = await childBirthRecord(cloud, parent, ws);
-      if (child === void 0) {
-        err3(`reclaim '${ws}': no CloudWorkspace or NomosBirthRecord named '${ws}' in ${parent}'s registry`);
-        return 1;
-      }
-      v = await signAndPostChildLifecycle2(parent, ws, child.data?.principal ?? "", "reclaim", opts);
-    }
-  } catch (e) {
-    err3(e.message);
-    return 1;
-  }
-  if (!v.ok) {
-    err3(`reclaim '${ws}' refused (${v.status}): ${typeof v.body === "string" ? v.body : JSON.stringify(v.body)}`);
-    return 1;
-  }
-  out3(`\u2713 workspace ${ws} reclaimed via signed lifecycle offer to ${parent} on ${cloud}`);
-  out3("  the custodian drops the ledger bytes on seeing this fact folded; the reclaimed FACT is append-only");
-  return 0;
-}
 function advertisedMainHead(text) {
   return /([0-9a-f]{40}) refs\/heads\/main\b/.exec(text)?.[1];
 }