@cloudbitmaps/core 0.18.3 → 0.19.0

package/dist/core/load.d.ts

@@ -59,8 +59,9 @@ export interface LoadDeps {
 /**
  * What a plausible result looks like, so an implausible one is refused instead of published.
  *
- * Both bounds are compared against the **current** generation's cardinality, read from the `.crbm` index rather
- * than its payload — one object-header read, and only when a bound is actually set.
+ * `minCardinality` judges the new generation alone. `minRetained` and `maxGrowth` judge it against the **current**
+ * generation's cardinality, which the load takes from the registry row's summary of it when the row has a usable one,
+ * and otherwise from the `.crbm` index (one object-header read, never the payload), and only when a bound needs it.
  */
 export interface LoadGuard {
     /** Refuse a generation with fewer than this many ids. Use for "this segment is never legitimately tiny". */
@@ -76,7 +77,25 @@ export interface LoadGuard {
      * permissive, which is where an inversion would eventually be written and not noticed.
      */
     readonly minRetained?: number;
+    /**
+     * Refuse a generation larger than this multiple of the current one — `1.5` means "at most half as large again".
+     * The ceiling to `minRetained`'s floor: a source that lands duplicated or joined wrong grows a segment as quietly as
+     * a partial one shrinks it. A shrinking load is never refused by this bound, and neither is the first load of a
+     * segment nor one onto an empty segment, which have no size to multiply. `1` means "never grow".
+     *
+     * `0` means no bound, as on the two fields above. Setting it makes the load read the current size and fence its
+     * publish on it, as `minRetained` does, `allowEmpty: true` or not. The comparison is in floating point, so do not
+     * rely on the exact boundary: `100 × 1.15` is `114.99999999999999`.
+     */
+    readonly maxGrowth?: number;
 }
+/**
+ * Check a guard's bounds before any round trip, and copy them: the one check `load` and each output of
+ * `materializeMany` share. The copy is what the load judges, so a guard object the caller reuses or changes while the
+ * call runs cannot change the bound it is judged by. `where` prefixes each field's name in the message (`''`, or
+ * `'outputs[3].'`).
+ */
+export declare function checkedGuard(guard: LoadGuard | undefined, where: string): LoadGuard | undefined;
 export interface LoadOptions {
     /**
      * Publish an empty generation over a non-empty one. Off by default: an empty result is far more often an
@@ -119,8 +138,34 @@ export interface LoadOptions {
     readonly metadata?: GenerationMetadata;
     readonly audit?: IAuditSink;
 }
+/** The bounds a guard can refuse a generation for: every {@link LoadRefusal} but a lost race. */
+export type GuardRefusal = Exclude<LoadRefusal, 'superseded'>;
+/**
+ * The bound a generation of `cardinality` ids breaks over a current one of `before` (`null`: none, or not read), in the
+ * order a load checks them, or `undefined`. Pure: the one judgement a load and a dry run share.
+ */
+export declare function guardRefusal(cardinality: number, before: number | null, guard: LoadGuard | undefined, allowEmpty: boolean | undefined): GuardRefusal | undefined;
+/** What a dry run learns about one write: the size it would replace, and the bound that would refuse it. */
+export interface LoadJudgement {
+    /**
+     * The current generation's size: `null` when there is none or its object is gone, and, where no bound needs the size,
+     * when its object could not be read, as the load would not read it. Always asked for.
+     */
+    readonly cardinalityBefore: number | null;
+    /** The bound a load of this size would be refused for now, absent when it would publish. */
+    readonly wouldRefuse?: GuardRefusal;
+    /** The requests the judgement made: the row, and the object's index when the row had no usable summary. */
+    readonly reads: number;
+}
+/**
+ * Judge a write of `cardinality` ids into `ref` as a load would, and write nothing: read the row and the current size
+ * as the load reads them, and apply the same bounds. A `destroyed` segment throws the `ValidationError` a load's write
+ * would, and an encrypted one with no keystore the `KeyUnavailableError`. What it says holds for now only: a load
+ * made later is judged against the segment as it is then.
+ */
+export declare function judgeLoad(ref: SegmentRef, cardinality: number, deps: LoadDeps, options?: Pick<LoadOptions, 'allowEmpty' | 'guard'>): Promise<LoadJudgement>;
 /** Why a load did not become current. */
-export type LoadRefusal = 'empty' | 'min-cardinality' | 'min-retained'
+export type LoadRefusal = 'empty' | 'min-cardinality' | 'min-retained' | 'max-growth'
 /**
  * Another writer got there first. Either another load wrote the same generation number first, so the write-once
  * put refused this one and it wrote nothing (`size: 0`); or the segment's registry row changed while the load was

package/dist/core/metrics.d.ts

@@ -14,8 +14,15 @@
  * per-series metric labels unless they're known low-cardinality and PII-free. See the observability
  * guide.
  */
-/** The segment operations that emit an `op` latency event (timed with the injected clock, at the facade). */
-export type MetricOpName = 'has' | 'count' | 'intersectInto' | 'unionInto' | 'andNotInto';
+/**
+ * The operations that emit an `op` latency event (timed with the injected clock, at the facade). `materializeMany` is
+ * timed from its first request, the pins, to its last publish: a call its input checks refuse emits none.
+ *
+ * A name added here stops two kinds of code compiling: a sink that switches on `name` with an exhaustive `never` check
+ * (add a case, or use a `default` branch, which needs no change), and a `Record<MetricOpName, …>` built by hand, a
+ * `MetricsSnapshot` literal among them (add the key).
+ */
+export type MetricOpName = 'has' | 'count' | 'intersectInto' | 'unionInto' | 'andNotInto' | 'materializeMany';
 /**
  * One observability event. A discriminated union on `kind` — new variants can be added over time without
  * breaking consumers (they switch on the kinds they care about). `namespace` is the segment's namespace
@@ -27,10 +34,11 @@ export type MetricEvent = {
     readonly namespace?: string;
     readonly segment: string;
     /**
-     * One event per request for chunks: a range request of a combine or `iterate`, which carries every chunk the read
-     * needs from a stretch of the object, or the one chunk of a read made on its own, however many callers were waiting
-     * on it. Bytes returned: the range's, the gaps between its chunks included (0 if a single chunk was absent — a GET
-     * still happened).
+     * One event per request for chunks: a range request of a combine, `iterate` or `materializeMany`, which carries
+     * every chunk the read needs from a stretch of the object, or the one chunk of a read made on its own, however
+     * many callers were waiting on it. A `materializeMany` range serves every output of its group, so its events
+     * count the requests the call sent, not requests per output. Bytes returned: the range's, the gaps between its
+     * chunks included (0 if a single chunk was absent — a GET still happened).
      */
     readonly bytes: number;
     /**
@@ -45,7 +53,7 @@ export type MetricEvent = {
      * no cached chunk. A combine or `iterate` looks up every chunk it needs when it opens its streams. A caller that
      * missed while another caller's read of the same chunk was open waits on that read and adds no `storage.get`, and a
      * range carries several chunks, so the misses can outnumber the `storage.get` events; the `storage.get` count is
-     * the number of requests for chunks.
+     * the number of requests for chunks. `materializeMany` never looks up the cache, so it emits none.
      */
     readonly kind: 'cache';
     readonly hit: boolean;
@@ -57,6 +65,10 @@ export type MetricEvent = {
     readonly attempt: number;
     readonly delayMs: number;
 } | {
+    /**
+     * One per chunk-aligned combine of one operator. `materializeMany` emits none: an output is an expression over
+     * several operators, and the call's `stats.chunks.pruned` counts the index keys it did not read.
+     */
     readonly kind: 'intersect';
     /**
      * Which chunk-aligned combine this was. **Optional** — absent means `'intersect'`.

package/dist/core/ports.d.ts

@@ -10,7 +10,10 @@
 import type { BlobSink } from './blob.js';
 import type { WrappedDek } from './crypto.js';
 import type { IMetricsSink } from './metrics.js';
-/** Opaque optimistic-concurrency token — unique per write, compared by equality only. */
+/**
+ * Opaque optimistic-concurrency token — unique per write with overwhelming probability, since it carries random parts
+ * (see {@link RegistryRecord.token}), and compared by equality only.
+ */
 export type Token = string;
 /**
  * The address of one segment: a `namespace` and a `segment` name, both any non-empty string of at most 256
@@ -214,8 +217,14 @@ export interface StorageCaps {
  * shipped driver to them:
  *
  * - **`putImmutable` is write-once and reports a collision as {@link WriteConflictError}.** It never overwrites a
- *   stored object. `load` reads that error as a lost race for the generation number (`superseded`), so a driver
- *   that threw anything else for an existing key would surface as a failed load.
+ *   stored object, two concurrent writes of one key included: exactly one lands. `load` reads that error as a lost
+ *   race for the generation number (`superseded`), so a driver that threw anything else for an existing key would
+ *   surface as a failed load. A write whose writer fails stores nothing, and the key can be written after.
+ * - **Keys keep every name apart.** One segment in two namespaces, two names an encoding could fold into one (`a/b`
+ *   and `a_b`), and a name that extends another (`s` and `s.1`) are separate objects, each listed and deleted alone;
+ *   generations are listed and deleted by number, never by a prefix of one.
+ * - **A bucket or container that does not exist is not a missing object**: it fails with an error that is neither
+ *   {@link NotFoundError}, which would read as an empty segment, nor a {@link TransientError}, which a retry cannot fix.
  * - **A missing object makes `getRange` and `getTail` throw {@link NotFoundError}** — never an empty or short
  *   result. Heal-forward (a read whose generation a sweep collected re-resolves), the erasure's holder probe and
  *   its verify of the rewrite, and a pin's replaced-object check all branch on that one error. (A zero-length
@@ -234,6 +243,8 @@ export interface StorageCaps {
  *   holding the id, `dropSegment`'s `generationsRemaining`, the retention sweep's check that a tombstone's storage
  *   is gone, and rollback's post-move check prove a deletion or a presence by listing, so a listing that lags
  *   reports an erasure as incomplete or a stale object as gone.
+ * - **`list` yields every generation, however many pages the service splits it into.** One that stops after its
+ *   first page drops generations from every collection and every check above.
  * - **Never replay a conditional write without telling the replay apart.** A `putImmutable` that lands and then
  *   loses its response, sent again, finds its own object and would report a collision. Either send each write
  *   once, with the backend client's retry off for that request, or recognise your own write when the
@@ -486,47 +497,6 @@ export interface RegCaps {
      */
     readonly conditionalDelete?: boolean;
 }
-/** What {@link IRegistryDriver.reapLegacyTombstones} is asked to do. */
-export interface ReapLegacyTombstonesOptions {
-    /** Only rows in this namespace; every namespace, the library's bookkeeping namespaces included, when absent. */
-    readonly namespace?: string;
-    /** Count what would be removed and remove nothing. */
-    readonly dryRun: boolean;
-    /** The most rows to remove (or, in a dry run, to count as removable) in this call. */
-    readonly limit: number;
-}
-/** What a reap of the tombstones a registry holds found. Every count is of rows, not requests. */
-export interface ReapLegacyTombstonesResult {
-    /** The call was a dry run: nothing was removed, and `wouldReap` says what a real run removes. */
-    readonly dryRun: boolean;
-    /** Rows read. Rows the `limit` stopped the run before reading are not counted. */
-    readonly examined: number;
-    /** Rows removed. Always 0 in a dry run. */
-    readonly reaped: number;
-    /** Rows a dry run found removable. Always 0 in a real run. */
-    readonly wouldReap: number;
-    /**
-     * The `limit` was spent and the listing had more keys: rows were left unread, and they may or may not be removable,
-     * so run again. A run is not resumable: each lists and reads from the start, so a dry run with a `limit` reports the
-     * same first rows every time, and `wouldReap` is a total only when this is `false`.
-     */
-    readonly limited: boolean;
-    /** Rows read and left, by why. */
-    readonly skipped: {
-        /** A live (`active`, not deleted) row. */
-        readonly live: number;
-        /** A `destroyed` row that is not `deleted`: a crypto-shred's or a drop's tombstone, kept as the attestation of an erasure. */
-        readonly destroyed: number;
-        /**
-         * A deleted row that carries an incarnation id, written by a 0.12 or later release. On a registry that removes rows,
-         * `delete` and the sweep remove such a row themselves; one left while the registry could not remove rows (GCS by
-         * default, S3 on a custom endpoint) stays, and this call, which refuses on such a registry, does not remove it.
-         */
-        readonly incarnated: number;
-        /** A row that changed, or was already gone (a 404), between its read and its delete, so the delete (fenced on the version read) refused. */
-        readonly raced: number;
-    };
-}
 /**
  * Refuse, with `UnsupportedError`, a write that would write an object before its row when the registry reports it
  * cannot write a row (see {@link RegCaps.canWrite}). Called before the write's first request.
@@ -623,8 +593,8 @@ export declare function brandAsBackend<T extends {
 export declare function isStorageBackend(value: unknown): value is StorageBackend;
 /**
  * Per-segment registry — the authoritative source of `currentGen`, the discovery index, and the wrapped-DEK
- * holder. One row per segment under OCC: a never-reused, equality-compared {@link Token} (ABA-safe across
- * delete→recreate).
+ * holder. One row per segment under OCC: an equality-compared {@link Token} that is never reused, with overwhelming
+ * probability (ABA-safe across delete→recreate).
  *
  * **What a driver must do** — callers rely on each of these, and the registry conformance suite holds every
  * shipped driver to them:
@@ -643,7 +613,11 @@ export declare function isStorageBackend(value: unknown): value is StorageBacken
  *   **With `expected` it is fenced**: it lands only while the row still carries that token, and otherwise throws
  *   {@link WriteConflictError} and leaves the row.
  * - **Reads are strongly consistent** (`RegCaps.strongRead`), and `list` yields every existing row,
- *   `destroyed` tombstones included, with every field (see {@link IRegistryDriver.list}).
+ *   `destroyed` tombstones included, with every field (see {@link IRegistryDriver.list}), however many pages the
+ *   service splits the listing into.
+ * - **A bucket or container that does not exist is not an absent row**: a read, a listing and a write fail with an
+ *   error that is neither {@link NotFoundError} nor a {@link TransientError}, and a read never answers `null`, which would
+ *   read as a segment with no generation.
  * - **Never replay a conditional write without telling the replay apart.** A `create` or `compareAndSwap`
  *   that lands and then loses its response, sent again, finds its own write and would report a conflict.
  *   Either send each write once, with the backend client's retry off for that request, or recognise your own
@@ -701,20 +675,5 @@ export interface IRegistryDriver {
      * created after the decision. A third-party driver that ignores `expected` keeps the unfenced behaviour.
      */
     delete(ref: SegmentRef, expected?: Token): Promise<void>;
-    /**
-     * Optional: remove the `deleted: true` rows with no incarnation id, which a release before 0.12 left, or a 0.12 or
-     * later release left by deleting a row born before 0.12, so that no later full `list` reads them. Only a registry that
-     * keeps such rows in its backend implements it; the object registries do.
-     *
-     * It removes a row only if it is `deleted: true` with no incarnation id (whatever its `status`), and only by a delete
-     * the backend applies under the version it read (see {@link RegCaps.conditionalDelete}), so a `create` that lands over
-     * the row first wins. A registry that cannot delete under that precondition throws `CapabilityError` before its first
-     * request. It never touches a live row, a `destroyed` row that is not `deleted`, or a deleted row with an incarnation
-     * id, so it does not remove every row a full `list` reads. If `conditionalDelete` was set on a backend that ignores the
-     * precondition, the delete is unfenced.
-     *
-     * Not resumable: every call lists and reads from the start (R reads for R rows, whatever the `limit`).
-     */
-    reapLegacyTombstones?(options: ReapLegacyTombstonesOptions): Promise<ReapLegacyTombstonesResult>;
 }
 export {};

package/dist/core/retention-sweep.d.ts

@@ -177,7 +177,8 @@ export type RetireEntry = {
      * expiring is the silence that costs a retention commitment.
      * `'limit'` — eligible, but this cycle's `limit` was already spent. Re-run to continue.
      * `'tombstone-not-empty'` — a tombstone whose Storage generations are not gone even after a GC
-     * attempt, so its row is kept: the row is what keeps the segment reachable by the generation collection and
+     * attempt, so its row is kept, and, unless the collection lost a race to a write of the row, a refused purge
+     * (see {@link RetireExpiredResult.purgeFaults}): the row is what keeps the segment reachable by the generation collection and
      * refused by every writer. Several causes, all self-healing: the storage really could not be reclaimed,
      * the collection *declined* because the row changed underneath it (`WriteConflictError`, which this
      * sweep swallows deliberately), or this was a `dryRun`, which reports the reason without attempting the
@@ -193,7 +194,10 @@ export type RetireEntry = {
 export interface RetireExpiredResult {
     /** Registry rows enumerated. */
     readonly scanned: number;
-    /** Rows whose policy said "expired" — including any the `limit` deferred. */
+    /**
+     * Rows whose policy said "expired", counted until the `limit` stopped the scan: the first row it deferred is counted
+     * and the rows after it are not read, so with `limited: true` this is a lower bound.
+     */
     readonly eligible: number;
     /**
      * Segments **actually retired**. Zero under `dryRun` — see `wouldRetire`. Kept honest because this is the field
@@ -208,8 +212,9 @@ export interface RetireExpiredResult {
     /** True when `limit` cut the cycle short — **more segments are still eligible**. Re-run. */
     readonly limited: boolean;
     /**
-     * Deletes this sweep attempted that the registry **refused for a reason other than a lost race**: a tombstone's
-     * purge, or the removal of a due-index pointer. A policy that denies delete, an Azure blob with a snapshot, or any
+     * Deletes this sweep attempted that were **refused for a reason other than a lost race**: a tombstone's purge
+     * (including one whose objects were still there after a collection that raised nothing), or the removal of a
+     * due-index pointer. A policy that denies delete, an Azure blob with a snapshot, or any
      * raw provider error is one; a write that landed between the sweep's read and its fenced delete is not (that is
      * `failed: contended` in the ledger). Each leaves its row or pointer in place, so a purge that keeps failing never
      * frees the name.

package/dist/core/retention.d.ts

@@ -44,6 +44,14 @@ export interface SetRetentionResult {
      */
     readonly indexed: boolean;
 }
+/**
+ * The key of the retention sweep's mark on a tombstone it wrote, which is what lets a later sweep purge the row. Only the
+ * sweep's own tombstone write sets it, and every other tombstone write removes it ({@link withoutSweepMark}), so a
+ * restored or hand-edited row cannot hand the sweep a tombstone it did not write.
+ */
+export declare const SWEEP_MARK = "retiredBySweepAt";
+/** `meta` without the sweep's mark, or `undefined` when it carries none, so a write that changes nothing is not made. */
+export declare function withoutSweepMark(meta: GovernanceMeta | undefined): GovernanceMeta | undefined | null;
 /**
  * Read the policy off a registry row's `retention` metadata. Returns `null` when there is no policy, and
  * `'invalid'` when the key is present but unusable (wrong type, or below the epoch-seconds floor).
@@ -56,6 +64,15 @@ export interface SetRetentionResult {
 export declare function readRetentionPolicy(meta: GovernanceMeta | undefined): RetentionPolicy | null | 'invalid';
 /** The stored policy for one segment, or `null` if it has none (and `'invalid'` for a malformed one). */
 export declare function getSegmentRetention(ref: SegmentRef, deps: RetentionDeps): Promise<RetentionPolicy | null | 'invalid'>;
+/**
+ * Record when a segment becomes eligible for retirement, creating its registry row if it has none.
+ *
+ * Idempotent and safe to re-run: writing the same instant twice is a no-op in effect. Other keys already in the
+ * row's `retention` metadata are preserved — this owns one key, not the whole object.
+ *
+ * Refuses a `destroyed` segment: a tombstone has nothing left to retire, and putting a policy on one would make
+ * a sweep repeatedly "retire" bytes that are already gone.
+ */
 export declare function setSegmentRetention(ref: SegmentRef, deps: RetentionDeps, policy: RetentionPolicy): Promise<SetRetentionResult>;
 /**
  * Remove a segment's expiry so no sweep will retire it. Returns whether a policy was actually removed (`false`

package/dist/core/retry.d.ts

@@ -75,6 +75,12 @@ export type ReadRetry = RetryDeps & {
  * The write itself is never passed here.
  */
 export declare function retryRead<T>(op: () => Promise<T>, retry: ReadRetry | undefined): Promise<T>;
+/**
+ * `policy`, checked when it is wired rather than at the first retry: a delay or factor that is not a finite number, a
+ * negative delay, a factor below 1 or a jitter mode it does not know would make the backoff `NaN`, which a timer reads
+ * as 1 ms, so bounded backoff silently became a hot retry loop.
+ */
+export declare function checkedRetryPolicy(policy: RetryPolicy): RetryPolicy;
 /**
  * Run `op`, retrying transient failures per `policy`. Resolves with `op`'s result, or rejects with the last
  * error once attempts are exhausted (or immediately for a non-retryable error). The thrown error is always

package/dist/driver-kit.d.ts

@@ -1,7 +1,7 @@
 export type { GenKey, IRegistryDriver, IStorageDriver, SegmentRef, StorageBackend, StorageCaps, } from './core/ports.js';
 export { brandAsBackend, STORAGE_BACKEND } from './core/ports.js';
 export type { IMetricsSink, MetricEvent } from './core/metrics.js';
-export { IntegrityError, isNotFoundError, isValidationError, isWriteConflictError, NotFoundError, TransientError, ValidationError, WriteConflictError, } from './core/errors.js';
+export { IntegrityError, isIntegrityError, isNotFoundError, isTransientError, isValidationError, isWriteConflictError, NotFoundError, TransientError, ValidationError, WriteConflictError, } from './core/errors.js';
 export { validateSegmentRef } from './core/validate.js';
 export type { BlobSink } from './core/blob.js';
 export { MAX_ROW_BYTES, ObjectStoreRegistry, ObjectVersionRaced, } from './drivers/_shared/object-registry.js';

package/dist/driver-kit.js

@@ -1,5 +1,4 @@
 import {
-  CapabilityError,
   DEFAULT_NAMESPACE,
   IntegrityError,
   NotFoundError,
@@ -14,7 +13,9 @@ import {
   encodeNameForPath,
   entropyIsAvailable,
   incarnationOf,
+  isIntegrityError,
   isNotFoundError,
+  isTransientError,
   isValidationError,
   isWriteConflictError,
   mapWithConcurrency,
@@ -29,7 +30,7 @@ import {
   validateRegistryPatch,
   validateSegmentRef,
   webCryptoEntropy
-} from "./chunk-ML6AT53O.js";
+} from "./chunk-TNWTIAON.js";
 
 // src/drivers/_shared/object-registry-keys.ts
 var REGISTRY_SUFFIX = ".reg";
@@ -205,6 +206,7 @@ var ObjectStoreRegistry = class {
     return this.decodeRow(key, seen);
   }
   async *list(namespace) {
+    if (namespace !== void 0) validateSegmentRef({ segment: "x", namespace });
     const prefix = registryListPrefix(this.prefix, namespace);
     let page = [];
     const flush = async function* (keys) {
@@ -258,104 +260,6 @@ var ObjectStoreRegistry = class {
     }
     throw new WriteConflictError(`registry delete: contention deleting "${ref.segment}" \u2014 retry`);
   }
-  /**
-   * Remove the `deleted: true` rows with no incarnation id (the envelopes a release before 0.12 left), or count them.
-   * One listing, a read per key and a conditional delete per envelope, so a row that a create wrote over since it was
-   * read keeps its new version and the delete is refused. Refuses with {@link CapabilityError}, before any request,
-   * where the store's delete is not known to apply its precondition.
-   *
-   * An object that cannot be read or parsed stops the run with the error that names its key, and removes nothing
-   * more: it may be a newer release's row. Rows removed before the stop stay removed, and a re-run is safe.
-   *
-   * Not resumable: it lists and reads from the start on every call. A delete refused as a conflict, including one for a
-   * row already gone, is counted as `raced`.
-   */
-  async reapLegacyTombstones(options) {
-    await this.store.resolveCapabilities?.();
-    const remove = this.removesRows() ? this.store.delete : void 0;
-    if (remove === void 0) {
-      throw new CapabilityError(
-        `reapRegistryTombstones: this registry's delete is not conditional (capabilities().conditionalDelete is false), so a removal could take a row a create has just written over the envelope. Nothing was requested`
-      );
-    }
-    const { dryRun, limit } = options;
-    const counts = {
-      examined: 0,
-      reaped: 0,
-      wouldReap: 0,
-      live: 0,
-      destroyed: 0,
-      incarnated: 0,
-      raced: 0
-    };
-    let limited = false;
-    const removable = () => counts.reaped + counts.wouldReap;
-    const handle = async (keys) => {
-      const rows = await mapWithConcurrency(
-        keys,
-        LIST_READ_CONCURRENCY,
-        (key) => this.readRow(key).then((row) => ({ key, row }))
-      );
-      const found = [];
-      for (const { key, row } of rows) {
-        if (row === null) continue;
-        counts.examined += 1;
-        const { deleted, record } = row.env;
-        if (!deleted) {
-          if (record.status === "destroyed") counts.destroyed += 1;
-          else counts.live += 1;
-        } else if (incarnationOf(record.token) !== void 0) {
-          counts.incarnated += 1;
-        } else if (removable() + found.length >= limit) {
-          limited = true;
-        } else {
-          found.push({ key, version: row.version });
-        }
-      }
-      if (dryRun) {
-        counts.wouldReap += found.length;
-        return;
-      }
-      await mapWithConcurrency(found, LIST_READ_CONCURRENCY, async ({ key, version }) => {
-        try {
-          await remove.call(this.store, key, { version });
-          counts.reaped += 1;
-        } catch (err) {
-          if (!isWriteConflictError(err)) throw err;
-          counts.raced += 1;
-        }
-      });
-    };
-    let page = [];
-    for await (const key of this.store.listKeys(
-      registryListPrefix(this.prefix, options.namespace)
-    )) {
-      if (parseRegistryKey(this.prefix, key) === null) continue;
-      if (removable() >= limit) {
-        limited = true;
-        break;
-      }
-      page.push(key);
-      if (page.length >= LIST_READ_CONCURRENCY) {
-        await handle(page);
-        page = [];
-      }
-    }
-    if (page.length > 0) await handle(page);
-    return {
-      dryRun,
-      examined: counts.examined,
-      reaped: counts.reaped,
-      wouldReap: counts.wouldReap,
-      limited,
-      skipped: {
-        live: counts.live,
-        destroyed: counts.destroyed,
-        incarnated: counts.incarnated,
-        raced: counts.raced
-      }
-    };
-  }
   /**
    * Read + parse a registry object, returning its envelope and version fence, or null if absent.
    *
@@ -380,7 +284,8 @@ var ObjectStoreRegistry = class {
         `registry object has no version fence (needed for compare-and-swap): ${objectKey}`
       );
     }
-    const env = parseRegistryEnvelope(new TextDecoder().decode(row.bytes), objectKey);
+    const stored = parseRegistryKey(this.prefix, objectKey) ?? void 0;
+    const env = parseRegistryEnvelope(new TextDecoder().decode(row.bytes), objectKey, stored);
     return { env, bytes: row.bytes, version: row.version };
   }
   /** {@link ObjectRegistryStore.read}, retrying the bounded number of times a mid-read overwrite allows. */
@@ -418,7 +323,9 @@ export {
   brandAsBackend,
   encodeNameForKey,
   encodeNameForPath,
+  isIntegrityError,
   isNotFoundError,
+  isTransientError,
   isValidationError,
   isWriteConflictError,
   namespaceKeyPart,