@cloudbitmaps/core 0.19.0 → 0.19.1

package/dist/core/combine-many.d.ts

@@ -310,3 +310,9 @@ export declare class GroupCost {
  * budget, both before any chunk is read.
  */
 export declare function runCombineMany<R>(compiled: CompiledCombineMany<R>, deps: CombineManyDeps): Promise<CombineManyRun<R>>;
+/**
+ * The token of a row's version (`<generation>:<token>`, as a pin holds it), or `undefined` where the version names no
+ * row. A live version from the `.crbm` source ends with the opened object's fingerprint: read it through
+ * `rowVersionOf` first.
+ */
+export declare function tokenOfVersion(version: string | null | undefined): string | undefined;

package/dist/core/crbm/reader.d.ts

@@ -51,6 +51,11 @@ export interface CrbmReaderOptions {
 }
 /** An object's fingerprint, from its size and its footer's CRC (see {@link CrbmReader.fingerprint}). */
 export declare const fingerprintFor: (size: number, footerCrc: number) => string;
+/**
+ * A fingerprint spelled short, for a key a read builds on every chunk: its size and its footer's CRC in base 36,
+ * `<size>.<crc>`. Two compact spellings are equal exactly when the fingerprints are.
+ */
+export declare function compactFingerprint(fingerprint: string): string;
 /**
  * Whether the object behind `blob` says it is encrypted, from one tail read of a footer's worth, with no key and no
  * index; a footer that fails its own checks throws, as an open would. For a caller that must not open an object with

package/dist/core/crbm-storage-source.d.ts

@@ -80,6 +80,15 @@ export interface PinnedObject {
     readonly version: string;
     readonly fingerprint?: string;
 }
+/**
+ * What a live version's resolution named, without the object's fingerprint: `<generation>:<row token>`, or
+ * `<generation>` with no registry. For a caller that compares a live version, from
+ * {@link CrbmStorageChunkSource.currentVersion} or a chunk of its `getChunks`, with a row it read, which names no
+ * object. A live version always ends with the suffix, which holds no `#`, so the match starts at its last `#` and a row
+ * token holding `#` of its own is kept whole. Known limit: a string with no suffix, such as a pin's version or one
+ * from another source, loses its end when its row token itself ends in `#<base 36>.<base 36>`; no caller passes one.
+ */
+export declare function rowVersionOf(version: string): string;
 /** What a pin that leases its generation does between reading the row and opening the object. */
 export interface PinLease {
     /** Write the lease against the row the pin read: its token, or `'moved'` when the pointer is no longer at the generation. */
@@ -94,7 +103,8 @@ export declare class CrbmStorageChunkSource implements StorageChunkSource {
      * needs a clock). Within the TTL a segment's Storage bytes are treated as an immutable snapshot; when the TTL
      * elapses the next read cheaply re-resolves `currentGen` and, only if it advanced (a load published),
      * opens the new generation — so a long-lived source observes new generations within the TTL. The engine pairs
-     * this with a **generation-keyed** cache so a bump never serves a stale decoded chunk. Without a clock or a
+     * this with a cache keyed by {@link currentVersion}, which names the object a reader opened, so a bump never serves
+     * a stale decoded chunk, and neither does a number taken again by another object. Without a clock or a
      * registry there is no timed refresh, and a segment's reader is replaced only when it is evicted, when a read
      * has to fetch from a generation a sweep deleted, or when {@link invalidate} drops it. A segment with no generation yet is not memoized, so
      * it's re-checked until one exists. **Bounded** by a {@link BoundedLru} ({@link CrbmStorageChunkSourceOptions.maxOpenSegments}, default
@@ -147,11 +157,11 @@ export declare class CrbmStorageChunkSource implements StorageChunkSource {
     private readonly timedRefresh;
     constructor(driver: IStorageDriver, options?: CrbmStorageChunkSourceOptions);
     /**
-     * The last few segments' keys, newest first. A stream asks for its segment's snapshot before every cached chunk it
-     * serves, and a combine alternates between a few operands, so comparing two names beats encoding them again, which
-     * cost about a microsecond a chunk.
+     * The keys of the segments this source reads, kept rather than encoded again: a read asks for its segment's snapshot
+     * once per operand, and a stream before every cached chunk it serves, and encoding the names cost about a
+     * microsecond each time.
      */
-    private readonly recentKeys;
+    private readonly keys;
     private keyOf;
     /**
      * The segment's live snapshot, refreshing on the TTL. Cheap within the TTL window. The snapshot holds the resolved
@@ -221,13 +231,16 @@ export declare class CrbmStorageChunkSource implements StorageChunkSource {
      */
     invalidate(ref: SegmentRef): void;
     /**
-     * `<generation>` for a registry-less source, or `<generation>:<row token>` with one. The token moves on every row
-     * write, so an unrelated write (a `setRetention`) costs the segment's decoded chunks once — bounded, and on an
-     * admin path. Exactness in the direction that matters: with a registry, two incarnations can never share a version
-     * string. Without one they can: a name purged and loaded again out of band restarts at the same bare number, and
-     * a live read that reopens it after an eviction reads the new object's chunks beside the old one's cached ones. A
-     * store with no registry cannot write, so that takes a change made from outside it; a pin is kept apart from it by
-     * the fingerprint it records.
+     * `<generation>#<object>` for a registry-less source, or `<generation>:<row token>#<object>` with one: the generation
+     * the segment's snapshot resolved, and the object its reader opened, by that object's size and footer checksum in
+     * base 36, which the open read anyway. The token moves on every row write, so an unrelated write (a `setRetention`)
+     * costs the segment's decoded chunks once — bounded, and on an admin path. Two objects do not share a version
+     * string, as far as their sizes and footer checksums tell them apart, whichever way a number came to name a second
+     * one: a name purged and loaded again (a new row, or with no registry the same bare number), a number taken again
+     * within one row once its object was deleted, or an object put back under its key from outside the library. That
+     * holds however long after its row read a reader opens: a snapshot that a `count()` resolved from the row opens its
+     * reader only when a later read needs it, and the object under the key may have changed in between. The version is
+     * opaque: compare two for equality.
      *
      * This is the call the engine makes **once per operand of every read**, before any chunk fetch, to key its
      * chunk cache, so it heals a swept generation exactly as {@link currentGeneration} does: unhealed, a cold read
@@ -583,17 +596,17 @@ export declare function publishGenerationKept(registry: IRegistryDriver, key: Ge
     /**
      * Publish only while the segment still has **no registry row**.
      *
-     * The fence for a caller whose decision rests on the row being ABSENT. `expectFrom` and `expectToken`
-     * cannot express it: both compare against a value read from a row, so when there was no row there is
-     * nothing to compare and both are simply omitted — leaving the publish a bare forward-only advance that
-     * happily lands over whatever appeared in the meantime.
+     * The fence for a caller whose decision rests on the row being ABSENT: every load that found no row sets it,
+     * guarded or not. `expectFrom` and `expectToken` cannot express it: both compare against a value read from a
+     * row, so when there was no row there is nothing to compare and both are simply omitted — leaving the publish a
+     * bare forward-only advance that happily lands over whatever appeared in the meantime.
      *
-     * That gap was a silent wipe, not a theoretical one. A guarded load into a segment that did not exist yet
-     * read "no row", so its empty/`minRetained` bounds had nothing to judge and passed vacuously; a
-     * concurrent writer then created the row and published a thousand ids; and the guarded load published an
-     * EMPTY generation over them, reporting `published: true` with no reason. Reproduced through both
-     * `loadSegment` and the `*Into` verbs, which hit it far more often because materialising into a
-     * destination that does not exist yet is the ordinary first run of a pipeline.
+     * Without it, a guarded load into a segment that did not exist yet would judge "no row", pass its empty and
+     * `minRetained` bounds vacuously, and land an EMPTY generation over the ids a concurrent writer had just loaded,
+     * reporting `published: true`. An unguarded load would move the pointer over another first load's generation or
+     * onto a row `setRetention` made, and, where an erasure had deleted its object above that row's pointer, onto an
+     * object that is gone. Materialising into a destination that does not exist yet is the ordinary first run of a
+     * pipeline, so the `*Into` verbs reach this as often as `loadSegment` does.
      */
     expectAbsent?: boolean;
     /**

package/dist/core/engine.d.ts

@@ -106,6 +106,11 @@ export declare class SegmentEngine {
     private readonly openStreams;
     /** How many times {@link invalidate} has been called: a read compares it with the count it began under. */
     private invalidations;
+    /**
+     * The cache-key prefixes ({@link segmentPrefix}) of the segments this engine reads, kept rather than encoded for each
+     * chunk. A kept prefix is the one {@link invalidate} finds the segment's chunks by.
+     */
+    private readonly prefixes;
     constructor(deps: EngineDeps);
     /** Membership: one chunk lookup — the cache, else one Storage fetch of that chunk. */
     has(seg: SegmentRef, id: number): Promise<boolean>;

package/dist/core/erase-id.d.ts

@@ -70,8 +70,9 @@
  * carries whatever its source held, and the library cannot know that source was meant to exclude the id.
  * A load already in flight writes its object above the pointer before it publishes. An erasure that finds the id in that
  * object writes the row before deleting it, so the load's publish, fenced on the row it read, is refused
- * (`published: false`) and the pointer never names a missing object (see `fenceInFlight`). A first load onto a row with
- * no pointer has nothing to be fenced on, so an erasure that finds the id in its object refuses instead.
+ * (`published: false`) and the pointer never names a missing object (see `fenceInFlight`). On a row with no pointer
+ * the erasure writes nothing to the row, so a first load's object there may still be published; an erasure that finds
+ * the id in it refuses instead of deleting it.
  */
 import { type IAuditSink } from './audit.js';
 import type { CodecInterface } from './codec.js';

package/dist/core/generation-gc.d.ts

@@ -45,8 +45,8 @@ export interface LoadNumber {
  * `superseded`. The orphan above stays unpublished; the load whose check meets it numbers past it by the listing,
  * and collection takes it once a generation above it is current. Like a listing's, the number can be one whose
  * object was deleted (an erasure removes the generations above a rolled-back pointer that held the id), which is
- * why nothing identifies a generation by its number alone: the reader cache, the chunk cache and a pin all key on
- * the number and the row's token, and the token has moved on.
+ * why nothing identifies a generation by its number alone: the reader cache and the chunk cache key on the number and
+ * the row's token, checked against the object a reader opens, and a pin on its object's fingerprint.
  */
 export declare function nextLoadGeneration(ref: SegmentRef, deps: GenerationDeps, row: RegistryRecord | null): Promise<LoadNumber>;
 /**

package/dist/core/keys.d.ts

@@ -1,7 +1,35 @@
 import type { ChunkRef, SegmentRef } from './ports.js';
 export declare function segmentKey(ref: SegmentRef): string;
 export declare function segmentPrefix(ref: SegmentRef): string;
+/**
+ * How many segments' encoded keys a {@link KeptSegmentKeys} holds before it empties: the reader cache's default
+ * segment count, a working set a long-lived reader keeps open. With 30-character names that is about 150 KB.
+ */
+export declare const KEPT_SEGMENT_KEYS = 1024;
+/**
+ * Segments' encoded keys ({@link segmentKey}, or {@link segmentPrefix}: whichever `encode` gives), kept so a read that
+ * looks up chunk after chunk compares names rather than encoding them again, which costs about a third of a warm
+ * `has()`. Held by namespace and then by segment, so segments of one name in several namespaces sit side by side, and
+ * no number of segments read in turn makes every lookup encode again. Bounded: at `max` entries it empties and fills
+ * again. An encoding is the names' and nothing else, so a kept one is the one an encoding would give now.
+ */
+export declare class KeptSegmentKeys {
+    private readonly encode;
+    private readonly max;
+    private readonly byNamespace;
+    private kept;
+    constructor(encode: (ref: SegmentRef) => string, max?: number);
+    /** The segment's encoded key. */
+    of(ref: SegmentRef): string;
+    /** How many encoded keys are kept. */
+    get size(): number;
+}
 export declare function chunkRefKey(ref: ChunkRef): string;
+/**
+ * {@link chunkRefKey}, or {@link chunkGenKey} with a `version`, from the segment's {@link segmentPrefix} already
+ * encoded: for a caller that looks up many chunks of a few segments and keeps their prefixes.
+ */
+export declare function chunkKeyUnder(prefix: string, chunkKey: number, version?: string | number): string;
 /**
  * Cache key for a chunk scoped to a specific **version** of the segment — {@link chunkRefKey} plus that
  * version (space-delimited, injection-proof exactly as above — the name parts are already encoded). A publish bumps the version, so it naturally

package/dist/core/load.d.ts

@@ -169,10 +169,12 @@ export type LoadRefusal = 'empty' | 'min-cardinality' | 'min-retained' | 'max-gr
 /**
  * Another writer got there first. Either another load wrote the same generation number first, so the write-once
  * put refused this one and it wrote nothing (`size: 0`); or the segment's registry row changed while the load was
- * writing: another load published, a retention change, a rollback or an erasure wrote the row, or the row was
- * deleted. Once another write has changed the row, the object stays in the bucket, because its generation number
- * may by then name another incarnation's live object; once the row is `destroyed` (dropped or crypto-shredded),
- * the object is deleted, and once the row is gone, so is an object its footer proves this load's own.
+ * writing: another load published, a retention change, a rollback or an erasure wrote the row, the row was
+ * deleted, or a row appeared where the load found none. Once another write has changed the row, the object stays in
+ * the bucket, still billed, until a later load's collection deletes it (at the latest the listing a load runs
+ * every sixteenth generation) or the segment is dropped, because its generation number may by then name another
+ * incarnation's live object; once the row is `destroyed` (dropped or crypto-shredded), the object is deleted, and
+ * once the row is gone, so is an object its footer proves this load's own.
  */
  | 'superseded';
 export interface LoadResult {

package/dist/core/ports.d.ts

@@ -194,6 +194,10 @@ export interface StorageChunkSource {
      * Note that putting the incarnation in the *object key* would not fix this: the new incarnation still starts
      * at generation 0, so the cache key collides either way. The identity has to reach the cache.
      *
+     * Within one incarnation a number can be taken again once its object is deleted, so two objects must never share
+     * a version either, however long after its pointer read a source opens the object: the `.crbm` source's version
+     * ends with the fingerprint of the object it opened.
+     *
      * Returns `null` when the segment resolves to no generation. A source that only ever serves one immutable
      * generation may omit this, and the engine falls back to the generation alone.
      */

package/dist/driver-kit.js

@@ -30,7 +30,7 @@ import {
   validateRegistryPatch,
   validateSegmentRef,
   webCryptoEntropy
-} from "./chunk-TNWTIAON.js";
+} from "./chunk-RSLVTRJY.js";
 
 // src/drivers/_shared/object-registry-keys.ts
 var REGISTRY_SUFFIX = ".reg";

package/dist/index.js

@@ -74,7 +74,7 @@ import {
   validateUserNamespace,
   validateUserRef,
   webCryptoEntropy
-} from "./chunk-TNWTIAON.js";
+} from "./chunk-RSLVTRJY.js";
 
 // src/core/bit-route.ts
 var U32_MAX = 4294967295;
@@ -329,11 +329,42 @@ function segmentKey(ref) {
 function segmentPrefix(ref) {
   return `${segmentKey(ref)}${FIELD}`;
 }
-function chunkRefKey(ref) {
-  return `${segmentPrefix(ref)}${ref.chunkKey}`;
-}
-function chunkGenKey(ref, version) {
-  return `${chunkRefKey(ref)}${FIELD}${version}`;
+var KEPT_SEGMENT_KEYS = 1024;
+var KeptSegmentKeys = class {
+  constructor(encode, max = KEPT_SEGMENT_KEYS) {
+    this.encode = encode;
+    this.max = max;
+  }
+  encode;
+  max;
+  byNamespace = /* @__PURE__ */ new Map();
+  kept = 0;
+  /** The segment's encoded key. */
+  of(ref) {
+    let names = this.byNamespace.get(ref.namespace);
+    const found = names?.get(ref.segment);
+    if (found !== void 0) return found;
+    const encoded = this.encode(ref);
+    if (this.kept >= this.max) {
+      this.byNamespace.clear();
+      this.kept = 0;
+      names = void 0;
+    }
+    if (names === void 0) {
+      names = /* @__PURE__ */ new Map();
+      this.byNamespace.set(ref.namespace, names);
+    }
+    names.set(ref.segment, encoded);
+    this.kept += 1;
+    return encoded;
+  }
+  /** How many encoded keys are kept. */
+  get size() {
+    return this.kept;
+  }
+};
+function chunkKeyUnder(prefix, chunkKey, version) {
+  return version === void 0 ? `${prefix}${chunkKey}` : `${prefix}${chunkKey}${FIELD}${version}`;
 }
 function shardOf(key, totalShards) {
   let h = 2166136261;
@@ -619,6 +650,11 @@ var SegmentEngine = class {
   openStreams = /* @__PURE__ */ new Set();
   /** How many times {@link invalidate} has been called: a read compares it with the count it began under. */
   invalidations = 0;
+  /**
+   * The cache-key prefixes ({@link segmentPrefix}) of the segments this engine reads, kept rather than encoded for each
+   * chunk. A kept prefix is the one {@link invalidate} finds the segment's chunks by.
+   */
+  prefixes = new KeptSegmentKeys(segmentPrefix);
   constructor(deps) {
     this.storage = deps.storage;
     this.cache = deps.cache;
@@ -1306,7 +1342,7 @@ var SegmentEngine = class {
   }
   /** The cache key of a chunk: by the version it was read under, or by segment and key alone for a source with none. */
   chunkCacheKey(ref, version) {
-    return version === void 0 ? chunkRefKey(ref) : chunkGenKey(ref, version);
+    return chunkKeyUnder(this.prefixes.of(ref), ref.chunkKey, version);
   }
   /** The segment's chunk keys, ascending, checked as untrusted tier data. */
   async chunkKeys(seg) {
@@ -3397,6 +3433,12 @@ function magicMatches(bytes, offset) {
 }
 var sizePart = (size) => `${size}:`;
 var fingerprintFor = (size, footerCrc) => `${sizePart(size)}${footerCrc}`;
+function compactFingerprint(fingerprint) {
+  const colon = fingerprint.indexOf(":");
+  const size = Number(fingerprint.slice(0, colon));
+  const crc = Number(fingerprint.slice(colon + 1));
+  return `${size.toString(36)}.${crc.toString(36)}`;
+}
 function checkSize(tail, size) {
   if (!Number.isSafeInteger(size) || size < tail.length) {
     throw new IntegrityError(`.crbm size is not a byte count its tail fits in: ${size}`);
@@ -4514,6 +4556,19 @@ var notThePinned = (ref, generation) => new NotFoundError(
 function versionOf(generation, lineage) {
   return lineage === void 0 ? String(generation) : `${generation}:${String(lineage)}`;
 }
+var readerVersions = /* @__PURE__ */ new WeakMap();
+function versionOfReader(reader) {
+  let version = readerVersions.get(reader);
+  if (version === void 0) {
+    version = `${versionOf(reader.generation, reader.lineage)}#${compactFingerprint(reader.fingerprint)}`;
+    readerVersions.set(reader, version);
+  }
+  return version;
+}
+var OBJECT_SUFFIX = /#[0-9a-z]+\.[0-9a-z]+$/;
+function rowVersionOf(version) {
+  return version.replace(OBJECT_SUFFIX, "");
+}
 var PinMoved = class extends Error {
 };
 function summaryOfGeneration(generation, description) {
@@ -4535,13 +4590,14 @@ function once(fn) {
   };
 }
 var readerIsOf = (reader, live) => reader.generation === live.target.generation && reader.lineage === live.target.lineage;
-async function versionNamed(snap) {
-  if (snap.target === void 0) {
-    const reader = await snap.reader;
-    return reader === null ? null : versionOf(reader.generation, reader.lineage);
+async function readsObjectOf(snap, reader) {
+  const settled2 = snap.settled;
+  if (settled2 !== void 0) {
+    const other = settled2.reader;
+    return other !== null && (other === reader || versionOfReader(other) === versionOfReader(reader));
   }
   const live = await snap.target;
-  return live === null ? null : versionOf(live.target.generation, live.target.lineage);
+  return live !== null && versionOf(live.target.generation, live.target.lineage) === versionOf(reader.generation, reader.lineage);
 }
 function describe(reader) {
   return { cardinality: reader.count(), metadata: reader.metadata };
@@ -4560,32 +4616,57 @@ var Snapshot = class _Snapshot {
   /** Set by the cache, to hear of a reader as it is opened. */
   onReader;
   opened;
+  outcome;
   static live(target, open4, prior) {
     return new _Snapshot(target, open4, prior);
   }
   static eager(reader) {
     const snap = new _Snapshot(void 0, void 0, void 0);
-    snap.opened = reader;
+    snap.hold(reader);
     return snap;
   }
   /** The reader, opened by the first call. */
   get reader() {
     if (this.opened === void 0) {
       const target = this.target;
-      this.opened = target.then(async (live) => {
-        if (live === null) return null;
-        const kept = await this.reuse(live);
-        this.prior = void 0;
-        return kept ?? this.open(live);
-      });
-      this.onReader?.(this.opened);
+      const opened = this.hold(
+        target.then(async (live) => {
+          if (live === null) return null;
+          const kept = await this.reuse(live);
+          this.prior = void 0;
+          return kept ?? this.open(live);
+        })
+      );
+      this.onReader?.(opened);
+      return opened;
     }
     return this.opened;
   }
+  /**
+   * Take `reader` as this snapshot's, and note the reader once it has opened. A failed open is not noted: the reader
+   * cache forgets the snapshot as the failure lands, and whoever awaits the reader meets the error.
+   */
+  hold(reader) {
+    this.opened = reader;
+    reader.then(
+      (r) => {
+        this.outcome = { reader: r };
+      },
+      () => void 0
+    );
+    return reader;
+  }
   /** The reader if one has been asked for, without asking for one. */
   get openedReader() {
     return this.opened;
   }
+  /**
+   * The reader once it has opened (`null` for no generation). Undefined while no reader has been asked for, while the
+   * open is under way, and after an open that failed.
+   */
+  get settled() {
+    return this.outcome;
+  }
   /** The prior snapshot's reader, if it is of what this snapshot resolved. */
   async reuse(live) {
     const prior = this.prior;
@@ -4598,15 +4679,13 @@ var Snapshot = class _Snapshot {
     const reader = await this.reuse(live);
     this.prior = void 0;
     if (reader !== null && this.opened === void 0) {
-      this.opened = Promise.resolve(reader);
-      this.onReader?.(this.opened);
+      this.onReader?.(this.hold(Promise.resolve(reader)));
     }
   }
 };
 var SNAPSHOT_BASE_BYTES = 256;
 var BULK_FLUSH_IDS = 1 << 20;
 var YIELD_EVERY_IDS = 1 << 14;
-var RECENT_KEYS = 8;
 var CrbmStorageChunkSource = class {
   constructor(driver, options = {}) {
     this.driver = driver;
@@ -4666,7 +4745,8 @@ var CrbmStorageChunkSource = class {
    * needs a clock). Within the TTL a segment's Storage bytes are treated as an immutable snapshot; when the TTL
    * elapses the next read cheaply re-resolves `currentGen` and, only if it advanced (a load published),
    * opens the new generation — so a long-lived source observes new generations within the TTL. The engine pairs
-   * this with a **generation-keyed** cache so a bump never serves a stale decoded chunk. Without a clock or a
+   * this with a cache keyed by {@link currentVersion}, which names the object a reader opened, so a bump never serves
+   * a stale decoded chunk, and neither does a number taken again by another object. Without a clock or a
    * registry there is no timed refresh, and a segment's reader is replaced only when it is evicted, when a read
    * has to fetch from a generation a sweep deleted, or when {@link invalidate} drops it. A segment with no generation yet is not memoized, so
    * it's re-checked until one exists. **Bounded** by a {@link BoundedLru} ({@link CrbmStorageChunkSourceOptions.maxOpenSegments}, default
@@ -4718,19 +4798,13 @@ var CrbmStorageChunkSource = class {
    */
   timedRefresh;
   /**
-   * The last few segments' keys, newest first. A stream asks for its segment's snapshot before every cached chunk it
-   * serves, and a combine alternates between a few operands, so comparing two names beats encoding them again, which
-   * cost about a microsecond a chunk.
+   * The keys of the segments this source reads, kept rather than encoded again: a read asks for its segment's snapshot
+   * once per operand, and a stream before every cached chunk it serves, and encoding the names cost about a
+   * microsecond each time.
    */
-  recentKeys = [];
+  keys = new KeptSegmentKeys(segmentKey);
   keyOf(ref) {
-    for (const k of this.recentKeys) {
-      if (k.segment === ref.segment && k.namespace === ref.namespace) return k.key;
-    }
-    const key = segmentKey(ref);
-    this.recentKeys.unshift({ namespace: ref.namespace, segment: ref.segment, key });
-    if (this.recentKeys.length > RECENT_KEYS) this.recentKeys.pop();
-    return key;
+    return this.keys.of(ref);
   }
   /**
    * The segment's live snapshot, refreshing on the TTL. Cheap within the TTL window. The snapshot holds the resolved
@@ -4889,13 +4963,16 @@ var CrbmStorageChunkSource = class {
     for (const k of this.checking.keys()) if (k.startsWith(pinnedPrefix)) this.checking.delete(k);
   }
   /**
-   * `<generation>` for a registry-less source, or `<generation>:<row token>` with one. The token moves on every row
-   * write, so an unrelated write (a `setRetention`) costs the segment's decoded chunks once — bounded, and on an
-   * admin path. Exactness in the direction that matters: with a registry, two incarnations can never share a version
-   * string. Without one they can: a name purged and loaded again out of band restarts at the same bare number, and
-   * a live read that reopens it after an eviction reads the new object's chunks beside the old one's cached ones. A
-   * store with no registry cannot write, so that takes a change made from outside it; a pin is kept apart from it by
-   * the fingerprint it records.
+   * `<generation>#<object>` for a registry-less source, or `<generation>:<row token>#<object>` with one: the generation
+   * the segment's snapshot resolved, and the object its reader opened, by that object's size and footer checksum in
+   * base 36, which the open read anyway. The token moves on every row write, so an unrelated write (a `setRetention`)
+   * costs the segment's decoded chunks once — bounded, and on an admin path. Two objects do not share a version
+   * string, as far as their sizes and footer checksums tell them apart, whichever way a number came to name a second
+   * one: a name purged and loaded again (a new row, or with no registry the same bare number), a number taken again
+   * within one row once its object was deleted, or an object put back under its key from outside the library. That
+   * holds however long after its row read a reader opens: a snapshot that a `count()` resolved from the row opens its
+   * reader only when a later read needs it, and the object under the key may have changed in between. The version is
+   * opaque: compare two for equality.
    *
    * This is the call the engine makes **once per operand of every read**, before any chunk fetch, to key its
    * chunk cache, so it heals a swept generation exactly as {@link currentGeneration} does: unhealed, a cold read
@@ -4913,7 +4990,7 @@ var CrbmStorageChunkSource = class {
       this.dropStale(segmentKey(ref), snap);
       reader = await this.resolvedReader(ref);
     }
-    return reader === null ? null : versionOf(reader.generation, reader.lineage);
+    return reader === null ? null : versionOfReader(reader);
   }
   /**
    * Resolve the segment **once** and report what a pin should hold: the generation, and the version that
@@ -5405,7 +5482,8 @@ var CrbmStorageChunkSource = class {
           }
           return;
         }
-        const version = versionOf(reader.generation, reader.lineage);
+        const version = versionOfReader(reader);
+        let seen = snap.settled;
         chunks = reader.readChunks(keys.slice(yielded), {
           ...options?.concurrency === void 0 ? {} : { concurrency: options.concurrency },
           ...options?.ramp === void 0 ? {} : { ramp: options.ramp },
@@ -5417,22 +5495,24 @@ var CrbmStorageChunkSource = class {
         let movedOn = false;
         try {
           while (await pull.advance()) {
-            if (this.mayHaveMoved(key, snap, epoch)) {
+            if (this.mayHaveMoved(key, snap, epoch) || snap.settled !== seen) {
               const live = this.liveSnapshot(ref);
-              if (live !== snap) {
-                let now;
+              if (live !== snap || live.settled !== seen) {
+                const looked = live.settled;
+                let same;
                 try {
-                  now = await versionNamed(live);
+                  same = await readsObjectOf(live, reader);
                 } catch (err) {
                   if (!isTransientError(err)) throw err;
                   movedOn = true;
                   break;
                 }
-                if (now !== version) {
+                if (!same) {
                   movedOn = true;
                   break;
                 }
                 snap = live;
+                seen = looked;
               }
               epoch = this.invalidations;
             }
@@ -6674,14 +6754,14 @@ async function runLoad(ref, prepare, deps, options) {
       cleartext: !written.encrypted,
       ...fromToken === void 0 ? {} : { expectToken: fromToken, expectRow: row },
       ...needsBefore && fromGeneration !== void 0 ? { expectFrom: fromGeneration } : {},
-      // The third case, and the one the two fences above structurally cannot cover: the guard judged a segment
-      // that had NO ROW. Both `expectFrom` and `expectToken` compare against a value read from a row, so with no
-      // row both are omitted and the publish becomes a bare forward-only advance — which lands over anything
-      // that appeared in between. `before` was `null`, so the empty, `minRetained` and `maxGrowth` bounds had nothing
-      // to judge and passed vacuously. Verified: an empty generation published over a thousand ids that a
-      // concurrent writer had created meanwhile, reporting success. A guarded write therefore has to fence on
-      // the ABSENCE it relied on, exactly as it fences on the pointer it relied on.
-      ...needsBefore && row === null ? { expectAbsent: true } : {},
+      // A load that found NO ROW fences on that absence, guarded or not, so a row that appeared since refuses it.
+      // `expectFrom` and `expectToken` both compare against a value read from a row, so with no row both are omitted,
+      // and the publish would otherwise be a bare forward-only advance over whatever appeared in between. For a guarded
+      // load, `before` was `null` and its bounds passed vacuously, so an empty generation would land over the ids
+      // another writer had just loaded. For an unguarded one, the pointer would move over another first load's
+      // generation or onto a row `setRetention` made, and, where an erasure had already deleted this load's object
+      // above that row's pointer, onto an object that is gone, so that every read of the segment would fail.
+      ...row === null ? { expectAbsent: true } : {},
       // A registry write that fails without an answer is reconciled by reading the row: the pointer at this number
       // is this load's publish only over the object this load wrote, which one footer read proves.
       holdsOwnObject: () => provesOwnObject(deps.storage, key, written.fingerprint),
@@ -8669,7 +8749,7 @@ function pinnedStillCurrent(spec, now) {
 }
 function liveMoved(op) {
   if (op.endRow === void 0 || !op.read) return void 0;
-  const was = tokenOfVersion(op.startVersion);
+  const was = op.startVersion == null ? void 0 : tokenOfVersion(rowVersionOf(op.startVersion));
   if (was !== void 0 && op.endRow !== null && !sameRow2(was, op.endRow.token)) return true;
   return op.startGeneration === void 0 ? void 0 : op.endGeneration !== op.startGeneration;
 }