@cloudbitmaps/core 0.19.0 → 0.20.0

package/dist/index.js

@@ -3,6 +3,7 @@ import {
   CapabilityError,
   CloudRoaringError,
   DEFAULT_NAMESPACE,
+  FOOTER_BYTES,
   IntegrityError,
   KeyUnavailableError,
   LEASE_SKEW_MS,
@@ -14,9 +15,12 @@ import {
   MAX_METADATA_BYTES,
   MAX_NAME_LENGTH,
   NotFoundError,
+  PREAMBLE_BYTES,
   RESERVED_NAMESPACE_PREFIX,
   StaleOperandError,
   TransientError,
+  UNANSWERED_BASE_MS,
+  UNANSWERED_RESENDS,
   UnsupportedError,
   ValidationError,
   WriteConflictError,
@@ -24,6 +28,7 @@ import {
   assertRegistryCanWrite,
   brandAsBackend,
   canonicalMetadataJson,
+  compactFingerprint,
   copiedMetadata,
   decodeNameFromPath,
   drawIncarnation,
@@ -32,7 +37,10 @@ import {
   encodeNameForPath,
   encodedNameLength,
   entropyIsAvailable,
+  fingerprintFor,
+  fingerprintParts,
   heldGenerations,
+  incarnationField,
   incarnationOf,
   isBudgetExceededError,
   isCapabilityError,
@@ -60,10 +68,13 @@ import {
   nextRegistryToken,
   onlyLeasesDiffer,
   parseRegistryEnvelope,
+  pointerIdOf,
   recordFromNew,
   releaseLease,
+  renewPointer,
   sameIncarnation,
   serializeRegistryEnvelope,
+  sizePart,
   takeLease,
   usableKeptGens,
   validateChunkKeyOrder,
@@ -74,7 +85,7 @@ import {
   validateUserNamespace,
   validateUserRef,
   webCryptoEntropy
-} from "./chunk-TNWTIAON.js";
+} from "./chunk-YSC7NJWV.js";
 
 // src/core/bit-route.ts
 var U32_MAX = 4294967295;
@@ -252,9 +263,7 @@ var ChunkWindow = class {
 var MAGIC = Uint8Array.of(67, 82, 66, 77);
 var VERSION_MAJOR = 1;
 var VERSION_MINOR = 0;
-var PREAMBLE_BYTES = 8;
 var PAYLOAD_START = PREAMBLE_BYTES;
-var FOOTER_BYTES = 104;
 var FOOTER = {
   indexOffset: 0,
   // u64
@@ -329,11 +338,42 @@ function segmentKey(ref) {
 function segmentPrefix(ref) {
   return `${segmentKey(ref)}${FIELD}`;
 }
-function chunkRefKey(ref) {
-  return `${segmentPrefix(ref)}${ref.chunkKey}`;
-}
-function chunkGenKey(ref, version) {
-  return `${chunkRefKey(ref)}${FIELD}${version}`;
+var KEPT_SEGMENT_KEYS = 1024;
+var KeptSegmentKeys = class {
+  constructor(encode, max = KEPT_SEGMENT_KEYS) {
+    this.encode = encode;
+    this.max = max;
+  }
+  encode;
+  max;
+  byNamespace = /* @__PURE__ */ new Map();
+  kept = 0;
+  /** The segment's encoded key. */
+  of(ref) {
+    let names = this.byNamespace.get(ref.namespace);
+    const found = names?.get(ref.segment);
+    if (found !== void 0) return found;
+    const encoded = this.encode(ref);
+    if (this.kept >= this.max) {
+      this.byNamespace.clear();
+      this.kept = 0;
+      names = void 0;
+    }
+    if (names === void 0) {
+      names = /* @__PURE__ */ new Map();
+      this.byNamespace.set(ref.namespace, names);
+    }
+    names.set(ref.segment, encoded);
+    this.kept += 1;
+    return encoded;
+  }
+  /** How many encoded keys are kept. */
+  get size() {
+    return this.kept;
+  }
+};
+function chunkKeyUnder(prefix, chunkKey, version) {
+  return version === void 0 ? `${prefix}${chunkKey}` : `${prefix}${chunkKey}${FIELD}${version}`;
 }
 function shardOf(key, totalShards) {
   let h = 2166136261;
@@ -381,7 +421,9 @@ var RecordingAuditSink = class {
   }
   /** An independent copy of the recorded events, in emission order. */
   snapshot() {
-    return this.recorded.map((e) => ({ ...e }));
+    return this.recorded.map(
+      (e) => e.kind === "segment.collect" ? { ...e, collected: [...e.collected] } : { ...e }
+    );
   }
   reset() {
     this.recorded.length = 0;
@@ -619,6 +661,11 @@ var SegmentEngine = class {
   openStreams = /* @__PURE__ */ new Set();
   /** How many times {@link invalidate} has been called: a read compares it with the count it began under. */
   invalidations = 0;
+  /**
+   * The cache-key prefixes ({@link segmentPrefix}) of the segments this engine reads, kept rather than encoded for each
+   * chunk. A kept prefix is the one {@link invalidate} finds the segment's chunks by.
+   */
+  prefixes = new KeptSegmentKeys(segmentPrefix);
   constructor(deps) {
     this.storage = deps.storage;
     this.cache = deps.cache;
@@ -668,27 +715,30 @@ var SegmentEngine = class {
     return total;
   }
   /**
-   * What the segment's current generation is: its number, its id count and its metadata, from one resolution, so the
-   * three cannot straddle a publish. A source with no summary answers from `count()` and the generation it resolves.
+   * What the segment's current generation is: its number, its id count, its metadata and the size of its object in
+   * bytes. A source with a `stat` (the `.crbm` source) answers all four from one resolution, so they cannot straddle
+   * a publish: from the registry row's summary when it can use it, else from the opened generation's footer and
+   * index, with no payload read. A source without one answers from its other methods, each its own resolution: its
+   * summary when it has one, else `count()` and the generation it resolves, and its `sizeOf`, or `sizeBytes: null`
+   * when it has none. A segment with no generation answers `{ generation: null, cardinality: 0, sizeBytes: null }`.
    */
   async stat(seg) {
+    if (this.storage.stat) {
+      const found = await this.storage.stat(seg);
+      if (found === null) return { generation: null, cardinality: 0, sizeBytes: null };
+      return found;
+    }
     if (this.storage.summary) {
-      return await this.storage.summary(seg) ?? { generation: null, cardinality: 0 };
+      const summary = await this.storage.summary(seg);
+      if (summary === null) return { generation: null, cardinality: 0, sizeBytes: null };
+      return { ...summary, sizeBytes: await this.sizeOf(seg) };
     }
     const generation = this.storage.currentGeneration ? await this.storage.currentGeneration(seg) : null;
-    return { generation, cardinality: await this.count(seg) };
-  }
-  /** Whether the Storage source can measure segment size (for grounded cost); false ⇒ storage isn't grounded. */
-  get supportsStorageSize() {
-    return typeof this.storage.sizeOf === "function";
+    return { generation, cardinality: await this.count(seg), sizeBytes: await this.sizeOf(seg) };
   }
-  /** How often the Storage source re-reads a pointer while reading (cost reporting); undefined if it does not say. */
-  get pointerRefreshMs() {
-    return this.storage.pointerRefreshMs;
-  }
-  /** Grounded Storage size of a segment's current generation (cost reporting), or null if it has no generation. */
-  segmentSize(seg) {
-    return this.storage.sizeOf ? this.storage.sizeOf(seg) : Promise.resolve(null);
+  /** The size of the segment's current generation from the source's `sizeOf`, or `null` when it cannot say. */
+  async sizeOf(seg) {
+    return this.storage.sizeOf ? (await this.storage.sizeOf(seg))?.sizeBytes ?? null : null;
   }
   /** The chunks of `seg` at `chunkKeys`, read through a window of {@link DEFAULT_INTERSECT_CONCURRENCY}. */
   chunkWindow(seg, chunkKeys, gen, ramp) {
@@ -920,11 +970,13 @@ var SegmentEngine = class {
    * the result — every chunk read is a whole, checksum-verified, immutable generation. The edge a *long* call can
    * hit is invariant 3's: if it straddles a mid-call `cache.genTtlMs` boundary and a load has published, an
    * operand's not-yet-requested chunks may re-resolve forward to the newer generation (a generation hop within one long
-   * call) — the call never crashes or returns a torn object, but may mix generations. Three things hop it without
-   * waiting for the TTL, so a shorter call can meet them too: **the reader cache evicting an operand mid-call**
-   * (`maxOpenSegments`), whose re-read re-resolves fresh; a sweep deleting the generation it was reading, which
-   * heals the read forward; and an invalidation, which this store's own `load`, `rollback` and `eraseSubject` make
-   * and `invalidate()` makes on request. Still whole/immutable per read, never torn. An operand's stream resolves its
+   * call) — the call never crashes or returns a torn object, but may mix generations. Some things hop it without
+   * waiting for the TTL, so a shorter call can meet them too: **the reader cache evicting an operand mid-call** on a
+   * store with no timed refresh (`maxOpenSegments`), whose re-read re-resolves fresh, and on a store with one the
+   * resolution cache letting the operand's resolution go; a sweep deleting the generation it was reading, or another
+   * object under its number, met by this read or another, which heals the read forward, as another read's failed open
+   * of the operand does; and an invalidation, which this store's own `load`, `rollback` and `eraseSubject` make and
+   * `invalidate()` makes on request. Still whole/immutable per read, never torn. An operand's stream resolves its
    * segment again before it serves each chunk, so each of those moves a running read as it would a read of one chunk, and
    * the ranges it had requested of the earlier generation are dropped, not served.
    */
@@ -1306,7 +1358,7 @@ var SegmentEngine = class {
   }
   /** The cache key of a chunk: by the version it was read under, or by segment and key alone for a source with none. */
   chunkCacheKey(ref, version) {
-    return version === void 0 ? chunkRefKey(ref) : chunkGenKey(ref, version);
+    return chunkKeyUnder(this.prefixes.of(ref), ref.chunkKey, version);
   }
   /** The segment's chunk keys, ascending, checked as untrusted tier data. */
   async chunkKeys(seg) {
@@ -1620,599 +1672,6 @@ var BoundedLru = class {
   }
 };
 
-// src/core/generation-gc.ts
-async function nextGeneration(ref, deps) {
-  return aboveEverything(ref, deps, await deps.registry.get(ref));
-}
-async function aboveEverything(ref, deps, record) {
-  let highest = record?.currentGen ?? -1;
-  for await (const key of deps.storage.list(ref)) {
-    if (key.generation > highest) highest = key.generation;
-  }
-  return numberAbove(highest);
-}
-function numberAbove(highest) {
-  if (highest >= Number.MAX_SAFE_INTEGER) {
-    throw new IntegrityError("the segment has no generation number left above its highest");
-  }
-  return highest + 1;
-}
-async function nextLoadGeneration(ref, deps, row) {
-  const generation = numberAbove(row?.currentGen ?? -1);
-  try {
-    await deps.storage.getTail({ namespace: ref.namespace, segment: ref.segment, generation }, 0);
-  } catch (err) {
-    if (isNotFoundError(err)) return { generation, checked: true };
-  }
-  return { generation: await aboveEverything(ref, deps, row), checked: false };
-}
-var LIST_COLLECTION_CADENCE = 16;
-async function gcOrphanGenerations(ref, deps, options = {}) {
-  return (await listingPass(ref, deps, { keep: options.keep })).deleted;
-}
-async function listingPass(ref, deps, options) {
-  const keep = options.keep ?? 1;
-  const quiet = options.quiet === true;
-  if (!Number.isInteger(keep) || keep < 0) {
-    throw new ValidationError(`keep must be a non-negative integer; got ${String(keep)}`);
-  }
-  const record = await deps.registry.get(ref);
-  if (record === null) return { deleted: [], kept: [], complete: true };
-  const current = record.currentGen;
-  const seen = /* @__PURE__ */ new Set();
-  for await (const key of deps.storage.list(ref)) seen.add(key.generation);
-  const gens = [...seen];
-  const after = await deps.registry.get(ref);
-  if (after === null) {
-    if (quiet) return { deleted: [], kept: [], complete: false };
-    throw new WriteConflictError(`registry row for segment ${ref.segment} was purged mid-pass`);
-  }
-  if (record.status === "destroyed" && after.token !== record.token) {
-    if (quiet) return { deleted: [], kept: [], complete: false };
-    throw new WriteConflictError(
-      `segment ${ref.segment} changed incarnation while its generations were being listed`
-    );
-  }
-  const cutoff = current === null || after.currentGen === null ? null : Math.min(current, after.currentGen);
-  const named = record.status === "destroyed" ? void 0 : usableKeptGens(after);
-  const protect = options.protect === void 0 || named === void 0 ? void 0 : /* @__PURE__ */ new Set([...options.protect, ...named]);
-  const stillCollectable = async (generation) => {
-    const still = await deps.registry.get(ref);
-    if (still === null) {
-      if (quiet) return "stop";
-      throw new WriteConflictError(`registry row for segment ${ref.segment} was purged mid-pass`);
-    }
-    const ok = record.status === "destroyed" ? still.token === after.token : cutoff === null || still.currentGen !== null && still.currentGen >= cutoff;
-    const now = protect === void 0 ? void 0 : usableKeptGens(still);
-    const unnamed = protect === void 0 || record.status === "destroyed" || now !== void 0 && !now.includes(generation);
-    if (!ok || !unnamed) {
-      if (quiet) return "stop";
-      throw new WriteConflictError(
-        `segment ${ref.segment} changed incarnation while its generations were being collected`
-      );
-    }
-    if (guard !== void 0 && heldGenerations(still, guard.now()).has(generation)) return "skip";
-    return "delete";
-  };
-  const guard = record.status === "destroyed" ? void 0 : options.leases;
-  const held = guard === void 0 ? void 0 : heldGenerations(after, guard.now());
-  const below = record.status === "destroyed" || cutoff === null ? [] : gens.filter((g) => g < cutoff).sort((a, b) => b - a);
-  const candidates = record.status === "destroyed" ? gens.sort((a, b) => a - b) : cutoff === null ? (
-    // No Storage pointer yet, so "below current" selects nothing and there is nothing safe to infer: an object
-    // here is either a load about to publish or an orphan we cannot tell apart from it. Deleting would race
-    // that publish into a dangling pointer. It is collected once a pointer exists.
-    []
-  ) : protect !== void 0 ? (
-    // The row's list is the window: everything below the pointer it does not name is garbage.
-    below.filter((g) => !protect.has(g))
-  ) : (
-    // Delete generations below the cutoff, except the newest `keep` of them (the grace window).
-    below.slice(keep)
-  );
-  const leasedSpared = new Set(candidates.filter((g) => held?.has(g) === true));
-  const toDelete = candidates.filter((g) => !leasedSpared.has(g));
-  const done = [];
-  for (const generation of toDelete) {
-    const verdict = await stillCollectable(generation);
-    if (verdict === "stop") return { deleted: done, kept: [], complete: false };
-    if (verdict === "skip") {
-      leasedSpared.add(generation);
-      continue;
-    }
-    await deps.storage.delete({ namespace: ref.namespace, segment: ref.segment, generation });
-    done.push(generation);
-  }
-  const deleted = new Set(done);
-  return {
-    deleted: done,
-    kept: below.filter((g) => !deleted.has(g) && !leasedSpared.has(g)).reverse(),
-    complete: true
-  };
-}
-async function collectAfterLoad(ref, deps, options) {
-  const { generation, keep, byName, currentGone, kept, proveCurrent, leases } = options;
-  if (keep >= generation) return [];
-  const list = kept?.list;
-  if (list === void 0 || currentGone === true)
-    return reconcile(ref, deps, { keep, kept, leases });
-  const periodic = generation % LIST_COLLECTION_CADENCE === 0;
-  if (byName && !periodic) {
-    if (keep >= 1 && proveCurrent !== void 0 && !await objectIsThere(deps.storage, proveCurrent)) {
-      return reconcile(ref, deps, { keep, kept, leases });
-    }
-    return deleteEvicted(ref, deps, { generation, evict: kept.evict, leases });
-  }
-  return (await listingPass(ref, deps, { keep, protect: list, quiet: true, leases })).deleted;
-}
-async function reconcile(ref, deps, options) {
-  const { keep, kept, leases } = options;
-  const {
-    deleted,
-    kept: present,
-    complete
-  } = await listingPass(ref, deps, { keep, quiet: true, leases });
-  const token = kept?.token;
-  if (complete && token !== void 0 && keep <= MAX_KEPT_GENERATIONS && !sameList(kept?.list, present)) {
-    try {
-      await deps.registry.compareAndSwap(ref, token, { keptGens: present });
-    } catch (err) {
-      if (!isWriteConflictError(err)) throw err;
-    }
-  }
-  return deleted;
-}
-function sameList(a, b) {
-  return a !== void 0 && a.length === b.length && a.every((g, i) => g === b[i]);
-}
-async function objectIsThere(storage, key) {
-  try {
-    await storage.getTail(key, 0);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function deleteEvicted(ref, deps, options) {
-  const deleted = [];
-  for (const generation of options.evict) {
-    const still = await deps.registry.get(ref);
-    if (still === null || still.currentGen === null || still.currentGen < options.generation) break;
-    const named = usableKeptGens(still);
-    if (named === void 0 || generation >= still.currentGen || named.includes(generation)) break;
-    if (options.leases !== void 0 && heldGenerations(still, options.leases.now()).has(generation)) {
-      continue;
-    }
-    await deps.storage.delete({ namespace: ref.namespace, segment: ref.segment, generation });
-    deleted.push(generation);
-  }
-  return deleted;
-}
-
-// src/core/reader-defaults.ts
-var DEFAULT_CURRENT_GEN_TTL_MS = 2e3;
-var REFRESH_RETRY_MS = 500;
-var DEFAULT_MAX_OPEN_SEGMENTS = 1024;
-var DEFAULT_MAX_OPEN_INDEX_BYTES = 64 * 1024 * 1024;
-
-// src/core/cost.ts
-function deepFreeze(value) {
-  if (value !== null && typeof value === "object" && !Object.isFrozen(value)) {
-    Object.freeze(value);
-    for (const inner of Object.values(value)) deepFreeze(inner);
-  }
-  return value;
-}
-var ELASTICACHE_REDIS_US_EAST_1_ONDEMAND = deepFreeze({
-  source: "ElastiCache for Redis OSS, us-east-1 on-demand, AWS price list 20260914063714",
-  replicasPerShard: 2,
-  reservedMemoryFraction: 0.25,
-  nodeTypes: [
-    { name: "cache.t4g.micro", memoryGiB: 0.5, hourlyUSD: 0.016, maxShards: 1 },
-    { name: "cache.t4g.small", memoryGiB: 1.37, hourlyUSD: 0.032, maxShards: 1 },
-    { name: "cache.t4g.medium", memoryGiB: 3.09, hourlyUSD: 0.065, maxShards: 1 },
-    { name: "cache.m6g.large", memoryGiB: 6.38, hourlyUSD: 0.149 },
-    { name: "cache.r6g.large", memoryGiB: 13.07, hourlyUSD: 0.206 },
-    { name: "cache.r6g.xlarge", memoryGiB: 26.32, hourlyUSD: 0.411 },
-    { name: "cache.r6g.2xlarge", memoryGiB: 52.82, hourlyUSD: 0.821 },
-    { name: "cache.r6g.4xlarge", memoryGiB: 105.81, hourlyUSD: 1.642 },
-    { name: "cache.r6g.8xlarge", memoryGiB: 209.55, hourlyUSD: 3.284 },
-    { name: "cache.r6g.12xlarge", memoryGiB: 317.77, hourlyUSD: 4.925 },
-    { name: "cache.r6g.16xlarge", memoryGiB: 419.09, hourlyUSD: 6.567 },
-    { name: "cache.r6gd.xlarge", memoryGiB: 26.32, ssdGiB: 99.33, hourlyUSD: 0.781 },
-    { name: "cache.r6gd.2xlarge", memoryGiB: 52.82, ssdGiB: 199.07, hourlyUSD: 1.56 },
-    { name: "cache.r6gd.4xlarge", memoryGiB: 105.81, ssdGiB: 398.14, hourlyUSD: 3.12 },
-    { name: "cache.r6gd.8xlarge", memoryGiB: 209.55, ssdGiB: 796.28, hourlyUSD: 6.24 },
-    { name: "cache.r6gd.12xlarge", memoryGiB: 317.77, ssdGiB: 1194.42, hourlyUSD: 9.358 },
-    { name: "cache.r6gd.16xlarge", memoryGiB: 419.09, ssdGiB: 1592.56, hourlyUSD: 12.477 }
-  ]
-});
-var ONE_REDIS_HA_CLUSTER = deepFreeze({ monthlyUSD: 346 });
-var AWS_US_EAST_1_ONDEMAND = deepFreeze({
-  name: "aws-us-east-1-ondemand",
-  storage: { getPerMillion: 0.4, putPerMillion: 5, storagePerGiBMonth: 0.023 },
-  redis: { sizedToData: ELASTICACHE_REDIS_US_EAST_1_ONDEMAND }
-});
-var HOURS_PER_MONTH = 730;
-var SECONDS_PER_MONTH = HOURS_PER_MONTH * 3600;
-var GIB = 1024 ** 3;
-var STORE_LOAD_PUT_CLASS = 1 + 1 / LIST_COLLECTION_CADENCE;
-var STORE_LOAD_POINTER_READS = 2 + 2 / LIST_COLLECTION_CADENCE;
-var STORE_LOAD_EXISTENCE_CHECKS = 2 - 1 / LIST_COLLECTION_CADENCE;
-var RETENTION_SWEEP_REQUESTS = deepFreeze({
-  conditionalDelete: {
-    retirement: { reads: 7, writes: 2, deletes: 1 },
-    purge: { reads: 4, writes: 0, deletes: 2 }
-  },
-  tombstoning: {
-    retirement: { reads: 6, writes: 2, deletes: 0 },
-    purge: { reads: 3, writes: 1, deletes: 0 }
-  }
-});
-var shown = (n) => String(Number(n.toFixed(2)));
-function requireFiniteNonNeg(n, field) {
-  if (n === void 0 || !Number.isFinite(n) || n < 0) {
-    throw new ValidationError(`${field} must be a finite number >= 0; got ${n}`);
-  }
-  return n;
-}
-function clamp01(n) {
-  return n < 0 ? 0 : n > 1 ? 1 : n;
-}
-var TIE_USD = 1e-6;
-function usableGiB(sizing, nodeType) {
-  return nodeType.memoryGiB * (1 - sizing.reservedMemoryFraction) + (nodeType.ssdGiB ?? 0);
-}
-function validateSizing(sizing) {
-  const at = "pricing.redis.sizedToData";
-  if (sizing === null || typeof sizing !== "object") {
-    throw new ValidationError(`${at} must be a RedisSizing`);
-  }
-  if (typeof sizing.source !== "string" || sizing.source === "") {
-    throw new ValidationError(`${at}.source must say where the prices come from`);
-  }
-  if (!Array.isArray(sizing.nodeTypes) || sizing.nodeTypes.length === 0) {
-    throw new ValidationError(`${at}.nodeTypes must list at least one node type`);
-  }
-  if (!Number.isInteger(sizing.replicasPerShard) || sizing.replicasPerShard < 0) {
-    throw new ValidationError(
-      `${at}.replicasPerShard must be an integer >= 0; got ${sizing.replicasPerShard}`
-    );
-  }
-  const reserved = requireFiniteNonNeg(
-    sizing.reservedMemoryFraction,
-    `${at}.reservedMemoryFraction`
-  );
-  if (reserved >= 1) {
-    throw new ValidationError(`${at}.reservedMemoryFraction must be below 1; got ${reserved}`);
-  }
-  const names = /* @__PURE__ */ new Set();
-  for (const n of sizing.nodeTypes) {
-    if (n === null || typeof n !== "object" || typeof n.name !== "string" || n.name === "") {
-      throw new ValidationError(`${at}.nodeTypes: every node type needs a name`);
-    }
-    const row = `${at}.nodeTypes[${JSON.stringify(n.name)}]`;
-    if (names.has(n.name)) throw new ValidationError(`${row} is listed twice`);
-    names.add(n.name);
-    if (!(requireFiniteNonNeg(n.memoryGiB, `${row}.memoryGiB`) > 0)) {
-      throw new ValidationError(`${row}.memoryGiB must be above 0`);
-    }
-    requireFiniteNonNeg(n.ssdGiB ?? 0, `${row}.ssdGiB`);
-    requireFiniteNonNeg(n.hourlyUSD, `${row}.hourlyUSD`);
-    if (n.maxShards !== void 0 && (!Number.isInteger(n.maxShards) || n.maxShards < 1)) {
-      throw new ValidationError(`${row}.maxShards must be an integer >= 1; got ${n.maxShards}`);
-    }
-    if (!(usableGiB(sizing, n) > 0)) {
-      throw new ValidationError(
-        `${row} leaves no memory for data once ${reserved} of it is reserved`
-      );
-    }
-  }
-}
-function cheapestCluster(sizing, dataGiB) {
-  const fits = [];
-  for (const nodeType of sizing.nodeTypes) {
-    const usable = usableGiB(sizing, nodeType);
-    let shards = Math.max(1, Math.ceil(dataGiB / usable));
-    if (shards > 1 && (shards - 1) * usable >= dataGiB) shards -= 1;
-    if (nodeType.maxShards !== void 0 && shards > nodeType.maxShards) continue;
-    const nodes = shards * (1 + sizing.replicasPerShard);
-    fits.push({
-      nodeType,
-      shards,
-      nodes,
-      monthlyUSD: nodes * nodeType.hourlyUSD * HOURS_PER_MONTH
-    });
-  }
-  const size = bytesWords(dataGiB * GIB);
-  if (fits.length === 0) {
-    throw new ValidationError(
-      `no node type in pricing.redis.sizedToData.nodeTypes holds ${size} within its maxShards`
-    );
-  }
-  const cheapest = fits.reduce((m, c) => Math.min(m, c.monthlyUSD), Infinity);
-  const [best] = fits.filter((c) => c.monthlyUSD <= cheapest + TIE_USD).sort(
-    (a, b) => a.nodes - b.nodes || a.monthlyUSD - b.monthlyUSD || (a.nodeType.name < b.nodeType.name ? -1 : a.nodeType.name > b.nodeType.name ? 1 : 0)
-  );
-  if (best === void 0 || !Number.isFinite(best.monthlyUSD)) {
-    throw new ValidationError(
-      `pricing.redis.sizedToData prices ${size} at no finite cost; check its node types`
-    );
-  }
-  return best;
-}
-function snapshotSizing(sizing) {
-  if (sizing === null || typeof sizing !== "object") return sizing;
-  const { source, nodeTypes, replicasPerShard, reservedMemoryFraction } = sizing;
-  const row = (n) => {
-    if (n === null || typeof n !== "object") return n;
-    const { name, memoryGiB, ssdGiB, hourlyUSD, maxShards } = n;
-    return {
-      name,
-      memoryGiB,
-      hourlyUSD,
-      ...ssdGiB === void 0 ? {} : { ssdGiB },
-      ...maxShards === void 0 ? {} : { maxShards }
-    };
-  };
-  return {
-    source,
-    replicasPerShard,
-    reservedMemoryFraction,
-    nodeTypes: Array.isArray(nodeTypes) ? Array.from(nodeTypes, row) : nodeTypes
-  };
-}
-function resolveBaseline(redis, storedGiB) {
-  if (redis === null || typeof redis !== "object") {
-    throw new ValidationError("pricing.redis must be { monthlyUSD } or { sizedToData }");
-  }
-  const { monthlyUSD, sizedToData } = redis;
-  const fixed = monthlyUSD !== void 0;
-  const sized = sizedToData !== void 0;
-  if (fixed === sized) {
-    throw new ValidationError(
-      "pricing.redis must be exactly one of { monthlyUSD } and { sizedToData }" + (fixed ? ", not both: spreading AWS_US_EAST_1_ONDEMAND.redis keeps its sizedToData, so pass redis: { monthlyUSD } alone" : "")
-    );
-  }
-  if (sized) {
-    const sizing = snapshotSizing(sizedToData);
-    validateSizing(sizing);
-    const cluster = cheapestCluster(sizing, storedGiB);
-    return { monthlyUSD: cluster.monthlyUSD, sized: { sizing, cluster } };
-  }
-  return { monthlyUSD: requireFiniteNonNeg(monthlyUSD, "pricing.redis.monthlyUSD") };
-}
-function bytesWords(bytes) {
-  const units = ["bytes", "KiB", "MiB", "GiB", "TiB", "PiB"];
-  let value = bytes;
-  let unit = 0;
-  const shown2 = (v, u) => u === 0 ? Math.round(v) : Number(v.toFixed(2));
-  while (unit < units.length - 1 && shown2(value, unit) >= 1024) {
-    value /= 1024;
-    unit += 1;
-  }
-  if (unit > 0) return `${value.toFixed(2)} ${units[unit]}`;
-  const n = Math.round(value);
-  return `${n} byte${n === 1 ? "" : "s"}`;
-}
-function clusterWords(c) {
-  const count = (n) => n.toLocaleString("en-US");
-  const nodes = `${count(c.nodes)} ${c.nodeType.name} node${c.nodes === 1 ? "" : "s"}`;
-  return c.shards === 1 ? `1 shard of ${nodes}` : `${count(c.shards)} shards, ${nodes}`;
-}
-function sizingBytes(spec) {
-  if (spec.sizeBytes !== void 0) return requireFiniteNonNeg(spec.sizeBytes, "segment.sizeBytes");
-  if (spec.cardinality !== void 0) {
-    return requireFiniteNonNeg(spec.cardinality, "segment.cardinality") * 2;
-  }
-  return 0;
-}
-function buildReport(input) {
-  const { pricing, grounded } = input;
-  const { storage, redis } = pricing;
-  const S = SECONDS_PER_MONTH;
-  requireFiniteNonNeg(storage.getPerMillion, "pricing.storage.getPerMillion");
-  requireFiniteNonNeg(storage.putPerMillion, "pricing.storage.putPerMillion");
-  requireFiniteNonNeg(storage.storagePerGiBMonth, "pricing.storage.storagePerGiBMonth");
-  const pointerRead = requireFiniteNonNeg(
-    storage.requestsPerPointerRead ?? 1,
-    "pricing.storage.requestsPerPointerRead"
-  );
-  const sizedRead = requireFiniteNonNeg(
-    storage.requestsPerSizedRead ?? 1,
-    "pricing.storage.requestsPerSizedRead"
-  );
-  const storageBytes = requireFiniteNonNeg(input.storageBytes, "storageBytes");
-  const storedGiB = storageBytes / GIB;
-  const baseline = resolveBaseline(redis, storedGiB);
-  const baselineUSD = baseline.monthlyUSD;
-  if ((input.workload.cacheHitRate ?? 0) > 1) {
-    throw new ValidationError(
-      `cacheHitRate must be a fraction from 0 to 1; got ${String(input.workload.cacheHitRate)}`
-    );
-  }
-  const cacheHitRate = clamp01(
-    requireFiniteNonNeg(input.workload.cacheHitRate ?? 0, "cacheHitRate")
-  );
-  const readsPerSec = requireFiniteNonNeg(input.workload.readsPerSec ?? 0, "readsPerSec");
-  const intersectsPerSec = requireFiniteNonNeg(
-    input.workload.intersectsPerSec ?? 0,
-    "intersectsPerSec"
-  );
-  const chunksPerIntersect = requireFiniteNonNeg(
-    input.workload.chunksPerIntersect ?? 1,
-    "chunksPerIntersect"
-  );
-  const loadsPerMonth = requireFiniteNonNeg(input.workload.loadsPerMonth ?? 0, "loadsPerMonth");
-  const requestsPerLoad = requireFiniteNonNeg(
-    input.workload.requestsPerLoad ?? 1,
-    "requestsPerLoad"
-  );
-  const operandsPerIntersect = requireFiniteNonNeg(
-    input.workload.operandsPerIntersect ?? 2,
-    "operandsPerIntersect"
-  );
-  if (operandsPerIntersect < 1) {
-    throw new ValidationError(
-      `operandsPerIntersect must be at least 1, since an intersection reads its operands; got ${operandsPerIntersect}`
-    );
-  }
-  const hotSegments = requireFiniteNonNeg(input.workload.hotSegments ?? 0, "hotSegments");
-  const readerProcesses = requireFiniteNonNeg(
-    input.workload.readerProcesses ?? 1,
-    "readerProcesses"
-  );
-  if (readerProcesses < 1) {
-    throw new ValidationError(`readerProcesses must be at least 1; got ${readerProcesses}`);
-  }
-  const genTtlMs = requireFiniteNonNeg(
-    input.workload.genTtlMs ?? DEFAULT_CURRENT_GEN_TTL_MS,
-    "genTtlMs"
-  );
-  const retirementsPerMonth = requireFiniteNonNeg(
-    input.workload.retirementsPerMonth ?? 0,
-    "retirementsPerMonth"
-  );
-  const purgesPerMonth = requireFiniteNonNeg(input.workload.purgesPerMonth ?? 0, "purgesPerMonth");
-  const conditionalDelete = input.workload.conditionalDelete ?? true;
-  if (typeof conditionalDelete !== "boolean") {
-    throw new ValidationError(`conditionalDelete must be a boolean; got ${conditionalDelete}`);
-  }
-  const storageGetUSD = storage.getPerMillion / 1e6;
-  const putUSD = storage.putPerMillion / 1e6;
-  const missFraction = 1 - cacheHitRate;
-  const readMisses = readsPerSec * S * missFraction;
-  const intersects = intersectsPerSec * S;
-  const refreshes = genTtlMs > 0 ? Math.min(readerProcesses * hotSegments * S * 1e3 / genTtlMs, readsPerSec * S) : 0;
-  const storageUSD = storedGiB * storage.storagePerGiBMonth;
-  const readsUSD = readMisses * storageGetUSD;
-  const getsPerColdOperand = pointerRead + sizedRead;
-  const intersectGets = chunksPerIntersect + getsPerColdOperand * operandsPerIntersect;
-  const intersectsUSD = intersects * intersectGets * storageGetUSD;
-  const loadGets = STORE_LOAD_POINTER_READS * pointerRead + STORE_LOAD_EXISTENCE_CHECKS;
-  const loadsUSD = loadsPerMonth * ((requestsPerLoad + STORE_LOAD_PUT_CLASS) * putUSD + loadGets * storageGetUSD);
-  const refreshUSD = refreshes * pointerRead * storageGetUSD;
-  const sweep = RETENTION_SWEEP_REQUESTS[conditionalDelete ? "conditionalDelete" : "tombstoning"];
-  const retentionUSD = retirementsPerMonth * (sweep.retirement.reads * storageGetUSD + sweep.retirement.writes * putUSD) + purgesPerMonth * (sweep.purge.reads * storageGetUSD + sweep.purge.writes * putUSD);
-  const total = readsUSD + intersectsUSD + storageUSD + loadsUSD + refreshUSD + retentionUSD;
-  const headroom = Math.max(0, baselineUSD - storageUSD - refreshUSD);
-  const readsCross = storageGetUSD > 0 && missFraction > 0 ? headroom / (S * storageGetUSD * missFraction) : Infinity;
-  const verdict = total <= baselineUSD * 0.1 ? "win-big" : total < baselineUSD ? "win" : "lose-zone";
-  const dominant = Math.max(
-    readsUSD,
-    intersectsUSD,
-    storageUSD,
-    loadsUSD,
-    refreshUSD,
-    retentionUSD
-  );
-  let driver = "storage";
-  if (dominant === readsUSD && readsUSD > 0) driver = "point reads (object GETs)";
-  else if (dominant === intersectsUSD && intersectsUSD > 0) {
-    driver = "intersections (pointer, index and chunk GETs)";
-  } else if (dominant === loadsUSD && loadsUSD > 0)
-    driver = "loads (object, listing and pointer requests)";
-  else if (dominant === refreshUSD && refreshUSD > 0) driver = "the pointer refresh (object GETs)";
-  else if (dominant === retentionUSD && retentionUSD > 0)
-    driver = "the retention sweep (registry reads and writes)";
-  const sized = baseline.sized;
-  const noBytes = Math.round(storageBytes) === 0;
-  const redisWords = sized === void 0 ? void 0 : noBytes ? `$${baselineUSD.toFixed(2)}/mo cheapest Redis cluster in the catalogue, as no bytes are counted (${clusterWords(sized.cluster)})` : `$${baselineUSD.toFixed(2)}/mo Redis that would hold ${bytesWords(storageBytes)} (${clusterWords(sized.cluster)})`;
-  const rationale = verdict === "lose-zone" ? `pay-per-use total $${total.toFixed(2)}/mo exceeds the ${redisWords ?? `$${baselineUSD}/mo flat baseline`}; dominated by ${driver}` : verdict === "win-big" ? `$${total.toFixed(2)}/mo \u2014 \u226410% of the ${redisWords ?? `$${baselineUSD}/mo baseline`}; dominated by ${driver}` : `$${total.toFixed(2)}/mo, under the ${redisWords ?? `$${baselineUSD}/mo baseline`}; dominated by ${driver}`;
-  const dataTiering = sized !== void 0 && (sized.cluster.nodeType.ssdGiB ?? 0) > 0;
-  const redisNote = sized === void 0 ? `Redis priced at the fixed $${baselineUSD}/mo given, whatever the data size.` : (noBytes ? "Redis priced at the cheapest cluster in the catalogue, as no bytes are counted, because nothing is stored or nothing was measured" : `Redis priced at the cheapest cluster in the catalogue that holds the ${bytesWords(storageBytes)} stored`) + `: ${clusterWords(sized.cluster)}, each shard a primary and ${sized.sizing.replicasPerShard} replica(s), ${Number((sized.sizing.reservedMemoryFraction * 100).toFixed(1))}% of memory reserved (${sized.sizing.source}).` + (noBytes ? " Pass pricing.redis: { monthlyUSD } to compare against a Redis of your own." : " Compressed bytes are a floor on the memory Redis needs: a native Redis bitmap is sized by its highest id, so sparse ids need more.") + " Redis bought another way \u2014 fewer replicas, another engine, reserved nodes \u2014 can cost less than the catalogue prices it." + (dataTiering ? ` ${sized.cluster.nodeType.name} is a data-tiering node, which keeps the values read least recently on its SSD. It is priced as if the data read often fits in its memory: AWS recommends data tiering for workloads that regularly read up to 20% of their data.` : "") + (input.sizesFromCardinality ? " Some segment sizes came from cardinality, at 2 bytes an id, which is more than a dense bitmap needs, so this Redis may be larger than the data calls for: pass sizeBytes to size it to the compressed bytes." : "");
-  const notes = [
-    "Same-region egress treated as free; internet egress is not modeled.",
-    "Request cost is from the supplied workload rates (live-metrics-derived request cost is a later phase).",
-    loadsPerMonth > 0 ? `Loads modeled: ${loadsPerMonth}/mo, each ${requestsPerLoad} PUT-class request(s) for the object plus ${shown(STORE_LOAD_PUT_CLASS)} PUT-class and ${shown(loadGets)} GETs that store.load() adds (the pointer, a check that the next generation number is free, a check that the current generation is there, and a listing every ${LIST_COLLECTION_CADENCE}th load).` : "Loads are NOT modeled \u2014 set workload.loadsPerMonth (+ requestsPerLoad for multipart) to include them.",
-    ...intersects > 0 ? [
-      `Intersections priced cold: ${intersectGets} GETs each, ${getsPerColdOperand} for each of ${operandsPerIntersect} operand(s) plus ${chunksPerIntersect} chunk range request(s); cacheHitRate does not apply.`
-    ] : [],
-    hotSegments > 0 ? genTtlMs > 0 ? `Pointer refresh modeled: ${hotSegments} hot segment(s) in each of ${readerProcesses} reader process(es), each re-reading its pointer at most every ${genTtlMs} ms, and at most once a point read.` : "Pointer refresh: none \u2014 genTtlMs 0 turns the timed refresh off. A reader still re-reads a pointer on an eviction, a swept generation or an invalidation, which this does not price." : readsPerSec > 0 ? "The pointer refresh is NOT modeled \u2014 set workload.hotSegments to the segments each long-lived reader keeps reading, and workload.readerProcesses to how many readers there are." : null,
-    hotSegments > DEFAULT_MAX_OPEN_SEGMENTS ? `More hot segments in a reader than a store keeps open by default (${DEFAULT_MAX_OPEN_SEGMENTS}): a read of a segment the reader evicted opens it again, a pointer and a tail read, which this does not price. Raise cache.readerMax, and cache.readerMaxBytes, to keep them open.` : null,
-    ...retirementsPerMonth > 0 || purgesPerMonth > 0 ? [
-      `Retention sweep modeled: ${retirementsPerMonth}/mo retirements at ${sweep.retirement.reads} reads, ${sweep.retirement.writes} writes and ${sweep.retirement.deletes} delete(s) each, ${purgesPerMonth}/mo purges at ${sweep.purge.reads} reads, ${sweep.purge.writes} writes and ${sweep.purge.deletes} delete(s) each; reads are priced at the GET rate and writes at the PUT rate, deletes at nothing, as S3 bills none` + (conditionalDelete ? "." : "; a registry that only tombstones is read again, two reads per purged segment, by every later full sweep, which is not priced.")
-    ] : [],
-    ...input.extraNotes ?? [],
-    // Last, so the notes a report already carried keep their places.
-    redisNote
-  ].filter((n) => n !== null);
-  return {
-    monthlyUSD: {
-      byOp: {
-        reads: readsUSD,
-        intersects: intersectsUSD,
-        storage: storageUSD,
-        loads: loadsUSD,
-        pointerRefresh: refreshUSD,
-        retention: retentionUSD
-      },
-      total
-    },
-    redisBaseline: sized === void 0 ? { basis: "fixed", monthlyUSD: baselineUSD } : {
-      basis: "sized-to-data",
-      monthlyUSD: baselineUSD,
-      cluster: {
-        nodeType: sized.cluster.nodeType.name,
-        shards: sized.cluster.shards,
-        nodes: sized.cluster.nodes,
-        dataTiering
-      }
-    },
-    redisCrossover: { readsPerSec: readsCross },
-    verdict,
-    rationale,
-    assumptions: { cacheHitRate, pricingName: pricing.name, grounded, notes }
-  };
-}
-function checkModelInputs(op, pricing, workload) {
-  const storage = pricing !== null && typeof pricing === "object" ? pricing.storage : void 0;
-  if (pricing !== void 0 && (storage === null || typeof storage !== "object")) {
-    throw new ValidationError(`${op}: pricing must be a profile with a storage price list`);
-  }
-  if (workload !== void 0 && workload !== null && (typeof workload !== "object" || Array.isArray(workload))) {
-    throw new ValidationError(`${op}: workload must be an object`);
-  }
-}
-function estimateCost(input) {
-  if (input === null || typeof input !== "object") {
-    throw new ValidationError("estimateCost: input must be an object such as { segments }");
-  }
-  if (!Array.isArray(input.segments)) {
-    throw new ValidationError(
-      "estimateCost: segments must be an array of { sizeBytes } or { cardinality }"
-    );
-  }
-  for (let i = 0; i < input.segments.length; i++) {
-    const spec = input.segments[i];
-    if (spec === null || typeof spec !== "object") {
-      throw new ValidationError(`estimateCost: segments[${i}] must be an object`);
-    }
-  }
-  checkModelInputs("estimateCost", input.pricing, input.workload);
-  const pricing = input.pricing ?? AWS_US_EAST_1_ONDEMAND;
-  const workload = input.workload ?? {};
-  let storageBytes = 0;
-  let sizesFromCardinality = false;
-  for (const spec of input.segments) {
-    const count = Math.floor(requireFiniteNonNeg(spec.count ?? 1, "segment.count"));
-    storageBytes += sizingBytes(spec) * count;
-    if (spec.sizeBytes === void 0 && spec.cardinality !== void 0 && sizingBytes(spec) * count > 0) {
-      sizesFromCardinality = true;
-    }
-  }
-  return buildReport({ storageBytes, workload, pricing, grounded: false, sizesFromCardinality });
-}
-function groundedReport(input) {
-  checkModelInputs("costReport", input.pricing, input.workload);
-  return buildReport({
-    storageBytes: input.storageBytes,
-    workload: input.workload ?? {},
-    pricing: input.pricing ?? AWS_US_EAST_1_ONDEMAND,
-    grounded: input.grounded ?? true,
-    extraNotes: input.extraNotes
-  });
-}
-
 // src/core/due-index.ts
 var DUE_BUCKET_MS = 864e5;
 function dueBucket(expiresAt) {
@@ -2335,6 +1794,7 @@ async function runExport(reader, registry, sink, options = {}) {
   const batchCap = options.ndjsonBatchBytes ?? DEFAULT_NDJSON_BATCH_BYTES;
   const segments = [];
   const failed = [];
+  const skipped = [];
   let totalIds = 0;
   if (typeof reader?.segment !== "function") {
     throw new ValidationError(
@@ -2411,10 +1871,21 @@ async function runExport(reader, registry, sink, options = {}) {
   };
   for await (const rec of registry.list(options.namespace)) {
     if (options.namespace === void 0 && isReservedRow(rec)) continue;
-    if (rec.status === "destroyed") continue;
-    await exportRef({ segment: rec.segment, namespace: rec.namespace });
+    if (rec.status === "destroyed") {
+      skipped.push({ segment: rec.segment, namespace: rec.namespace, reason: "destroyed" });
+      continue;
+    }
+    await exportRef({ segment: rec.segment, namespace: rec.namespace });
   }
-  return { version: 1, format, totalSegments: segments.length, totalIds, segments, failed };
+  return {
+    version: 1,
+    format,
+    totalSegments: segments.length,
+    totalIds,
+    segments,
+    failed,
+    skipped
+  };
 }
 
 // src/core/discover.ts
@@ -2528,7 +1999,7 @@ var MemoryRegistryDriver = class {
     if (!existing || existing.token !== expected) {
       throw new WriteConflictError(`OCC token mismatch for registry row ${ref.segment}`);
     }
-    const token = this.nextToken(incarnationOf(existing.token) ?? drawIncarnation(this.entropy));
+    const token = this.nextToken(incarnationOf(existing.token));
     this.rows.set(key, structuredClone(applyRegistryPatch(existing, checked, this.now(), token)));
     return { token };
   }
@@ -2549,8 +2020,14 @@ var MemoryRegistryDriver = class {
 };
 var MemoryStorageDriver = class {
   objects = /* @__PURE__ */ new Map();
+  stored = 0;
   capabilities() {
-    return { rangeRead: true, maxObjectBytes: Number.MAX_SAFE_INTEGER, conditionalPut: true };
+    return {
+      rangeRead: true,
+      maxObjectBytes: Number.MAX_SAFE_INTEGER,
+      conditionalPut: true,
+      conditionalDelete: true
+    };
   }
   async putImmutable(key, write) {
     const k = genObjectKey(key);
@@ -2562,14 +2039,15 @@ var MemoryStorageDriver = class {
         `generation already exists (write-once): ${key.segment}.${key.generation}`
       );
     }
-    this.objects.set(k, body);
+    this.stored += 1;
+    this.objects.set(k, { body, version: String(this.stored) });
     return { size: body.length, sha256: createHash("sha256").update(body).digest("hex") };
   }
   async getRange(key, offset, length) {
     if (!Number.isInteger(offset) || !Number.isInteger(length) || offset < 0 || length < 0) {
       throw new ValidationError(`invalid range offset=${offset} length=${length}`);
     }
-    const body = this.require(key);
+    const { body } = this.require(key);
     if (offset + length > body.length) {
       throw new ValidationError(
         `range [${offset}, ${offset + length}) out of bounds for ${body.length}B`
@@ -2578,12 +2056,20 @@ var MemoryStorageDriver = class {
     return body.slice(offset, offset + length);
   }
   async getTail(key, maxBytes) {
-    const body = this.require(key);
+    const { body, version } = this.require(key);
     const take = Math.min(Math.max(maxBytes, 0), body.length);
-    return { bytes: body.slice(body.length - take), size: body.length };
+    return { bytes: body.slice(body.length - take), size: body.length, version };
   }
-  async delete(key) {
-    this.objects.delete(genObjectKey(key));
+  async delete(key, options) {
+    const k = genObjectKey(key);
+    const ifVersion = options?.ifVersion;
+    const stored = this.objects.get(k);
+    if (ifVersion !== void 0 && stored !== void 0 && stored.version !== ifVersion) {
+      throw new WriteConflictError(
+        `generation ${key.segment}.${key.generation} is another object than the version given; not deleted`
+      );
+    }
+    this.objects.delete(k);
   }
   async *list(ref) {
     validateSegmentRef(ref);
@@ -2599,11 +2085,11 @@ var MemoryStorageDriver = class {
     }
   }
   require(key) {
-    const body = this.objects.get(genObjectKey(key));
-    if (body === void 0) {
+    const stored = this.objects.get(genObjectKey(key));
+    if (stored === void 0) {
       throw new NotFoundError(`no such generation: ${key.segment}.${key.generation}`);
     }
-    return body;
+    return stored;
   }
 };
 function genObjectKey(key) {
@@ -2862,7 +2348,12 @@ var LocalFsStorageDriver = class {
   root;
   exactCase;
   capabilities() {
-    return { rangeRead: true, maxObjectBytes: Number.MAX_SAFE_INTEGER, conditionalPut: false };
+    return {
+      rangeRead: true,
+      maxObjectBytes: Number.MAX_SAFE_INTEGER,
+      conditionalPut: false,
+      conditionalDelete: false
+    };
   }
   async putImmutable(key, write) {
     const finalPath = storageObjectPath(this.root, key);
@@ -2939,7 +2430,12 @@ var LocalFsStorageDriver = class {
       await handle.close();
     }
   }
-  async delete(key) {
+  /**
+   * Idempotent. Ignores `options.ifVersion`, as `conditionalDelete: false` says: see the note on the class for why it
+   * cannot apply one. The parameter is declared so that a wrapper of this driver can hand the port's options on.
+   */
+  async delete(key, options) {
+    void options;
     const path = storageObjectPath(this.root, key);
     if (await this.exactCase.differs(path)) return;
     await unlink(path).catch((err) => {
@@ -3038,7 +2534,7 @@ var LocalFsRegistryDriver = class {
         throw new WriteConflictError(`registry row already exists for segment ${ref.segment}`);
       }
       const token = newIncarnationToken(this.entropy, current?.record);
-      await this.writeRow(path, false, recordFromNew(ref, checked, this.now(), token));
+      await this.writeRow(path, recordFromNew(ref, checked, this.now(), token));
       return { token };
     });
   }
@@ -3056,11 +2552,7 @@ var LocalFsRegistryDriver = class {
         throw new WriteConflictError(`OCC token mismatch for registry row ${ref.segment}`);
       }
       const token = nextRegistryToken(current.record, this.entropy);
-      await this.writeRow(
-        path,
-        false,
-        applyRegistryPatch(current.record, checked, this.now(), token)
-      );
+      await this.writeRow(path, applyRegistryPatch(current.record, checked, this.now(), token));
       return { token };
     });
   }
@@ -3095,12 +2587,7 @@ var LocalFsRegistryDriver = class {
       } else if (current === null || current.deleted) {
         return;
       }
-      if (incarnationOf(current.record.token) !== void 0) {
-        await this.unlinkRow(path);
-        return;
-      }
-      const token = nextRegistryToken(current.record, this.entropy);
-      await this.writeRow(path, true, { ...current.record, token, updatedAt: this.now() });
+      await this.unlinkRow(path);
     });
   }
   /** Remove a row's file and make the removal durable (fsync the directory). */
@@ -3150,10 +2637,10 @@ var LocalFsRegistryDriver = class {
       await handle.close();
     }
   }
-  async writeRow(path, deleted, record) {
+  async writeRow(path, record) {
     await this.exactCase.refuseVariant(path);
     await mkdir2(dirname3(path), { recursive: true });
-    const out = Buffer.from(serializeRegistryEnvelope({ deleted, record }), "utf8");
+    const out = Buffer.from(serializeRegistryEnvelope({ deleted: false, record }), "utf8");
     if (out.length > DEFAULT_MAX_ROW_BYTES) {
       throw new ValidationError(
         `registry row ${out.length}B exceeds cap ${DEFAULT_MAX_ROW_BYTES}B`
@@ -3227,6 +2714,14 @@ var LocalFsStorage = class {
   registry;
 };
 
+// src/core/reader-defaults.ts
+var DEFAULT_CURRENT_GEN_TTL_MS = 2e3;
+var REFRESH_RETRY_MS = 500;
+var DEFAULT_MAX_OPEN_SEGMENTS = 1024;
+var DEFAULT_MAX_OPEN_INDEX_BYTES = 64 * 1024 * 1024;
+var RESOLUTIONS_PER_OPEN_SEGMENT = 8;
+var RESOLUTION_BYTES_DIVISOR = 16;
+
 // src/core/cooperative.ts
 var YIELD_EVERY = 1024;
 function yieldEvery(clock, everyN = YIELD_EVERY) {
@@ -3395,8 +2890,6 @@ function indexCapacity(indexLength) {
 function magicMatches(bytes, offset) {
   return bytes[offset] === MAGIC[0] && bytes[offset + 1] === MAGIC[1] && bytes[offset + 2] === MAGIC[2] && bytes[offset + 3] === MAGIC[3];
 }
-var sizePart = (size) => `${size}:`;
-var fingerprintFor = (size, footerCrc) => `${sizePart(size)}${footerCrc}`;
 function checkSize(tail, size) {
   if (!Number.isSafeInteger(size) || size < tail.length) {
     throw new IntegrityError(`.crbm size is not a byte count its tail fits in: ${size}`);
@@ -3473,7 +2966,7 @@ var CrbmReader = class _CrbmReader {
   get fingerprint() {
     return fingerprintFor(this.objectSize, this.footerCrc);
   }
-  /** Total object bytes (from the one-GET tail read) — for grounded storage cost. */
+  /** Total object bytes (from the one-GET tail read): the `sizeBytes` a segment's `stat()` reports. */
   get sizeBytes() {
     return this.objectSize;
   }
@@ -4382,7 +3875,16 @@ function decodeSerialized(bytes, codec, what = "the buffer") {
 var NONCE_BYTES = 12;
 var TAG_BYTES = 16;
 var COUNT_BYTES = 8;
+var SIZE_BYTES = 8;
+var CRC_BYTES = 4;
+var FIXED_BYTES = COUNT_BYTES + SIZE_BYTES + CRC_BYTES;
 var MAX_CARDINALITY = 2 ** 32;
+function sizeOfFingerprint(fingerprint) {
+  const parts = fingerprintParts(fingerprint);
+  if (parts === void 0)
+    throw new IntegrityError("registry record summary: a malformed fingerprint");
+  return parts.size;
+}
 var BASE64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 function toBase64(bytes) {
   let out = "";
@@ -4409,16 +3911,21 @@ function fromBase64(text) {
   }
   return out;
 }
-function clearSummary(generation, cardinality, metadata) {
-  return metadata === void 0 || Object.keys(metadata).length === 0 ? { generation, cardinality } : { generation, cardinality, metadata };
+function clearSummary(generation, cardinality, fingerprint, metadata) {
+  return metadata === void 0 || Object.keys(metadata).length === 0 ? { generation, cardinality, fingerprint } : { generation, cardinality, fingerprint, metadata };
 }
-function sealSummary(aead, ref, generation, cardinality, metadata) {
+function sealSummary(aead, ref, generation, cardinality, fingerprint, metadata) {
   const meta = metadataBytes(metadata, (message) => {
     throw new IntegrityError(`summary metadata: ${message}`);
   });
-  const plain = new Uint8Array(COUNT_BYTES + (meta?.length ?? 0));
-  new DataView(plain.buffer).setBigUint64(0, BigInt(cardinality), true);
-  if (meta !== void 0) plain.set(meta, COUNT_BYTES);
+  const parts = fingerprintParts(fingerprint);
+  if (parts === void 0) throw new IntegrityError("summary: a malformed fingerprint");
+  const plain = new Uint8Array(FIXED_BYTES + (meta?.length ?? 0));
+  const view = new DataView(plain.buffer);
+  view.setBigUint64(0, BigInt(cardinality), true);
+  view.setBigUint64(COUNT_BYTES, BigInt(parts.size), true);
+  view.setUint32(COUNT_BYTES + SIZE_BYTES, parts.footerCrc, true);
+  if (meta !== void 0) plain.set(meta, FIXED_BYTES);
   const { nonce, ciphertext, tag } = aead.seal(plain, aadFor(ref, generation, "summary"));
   const framed2 = new Uint8Array(nonce.length + ciphertext.length + tag.length);
   framed2.set(nonce, 0);
@@ -4432,8 +3939,10 @@ function openSummary(aead, ref, summary) {
   };
   const framed2 = fromBase64(summary.sealed);
   const framing = NONCE_BYTES + TAG_BYTES;
-  if (framed2 === void 0 || framed2.length < framing + COUNT_BYTES || framed2.length > framing + COUNT_BYTES + MAX_METADATA_BYTES) {
-    fail("the sealed summary is not a nonce, a count, up to 1 KiB of metadata and a tag");
+  if (framed2 === void 0 || framed2.length < framing + FIXED_BYTES || framed2.length > framing + FIXED_BYTES + MAX_METADATA_BYTES) {
+    fail(
+      "the sealed summary is not a nonce, a count, a fingerprint, up to 1 KiB of metadata and a tag"
+    );
   }
   const bytes = framed2;
   let plain;
@@ -4452,14 +3961,18 @@ function openSummary(aead, ref, summary) {
       "the sealed summary does not open: tampered bytes, or a summary moved from another generation"
     );
   }
-  if (plain.length < COUNT_BYTES) fail("the sealed summary is shorter than its count");
-  const count = new DataView(plain.buffer, plain.byteOffset, plain.byteLength).getBigUint64(
-    0,
-    true
-  );
+  if (plain.length < FIXED_BYTES)
+    fail("the sealed summary is shorter than its count and fingerprint");
+  const view = new DataView(plain.buffer, plain.byteOffset, plain.byteLength);
+  const count = view.getBigUint64(0, true);
   if (count > BigInt(MAX_CARDINALITY)) fail(`cardinality ${count} is outside 0 to 2^32`);
-  const metadata = plain.length === COUNT_BYTES ? void 0 : metadataFromBytes(plain.subarray(COUNT_BYTES), fail);
-  return { cardinality: Number(count), metadata };
+  const size = view.getBigUint64(COUNT_BYTES, true);
+  const fingerprint = fingerprintFor(Number(size), view.getUint32(COUNT_BYTES + SIZE_BYTES, true));
+  if (size > BigInt(Number.MAX_SAFE_INTEGER) || fingerprintParts(fingerprint) === void 0) {
+    fail(`the object size ${size} is not one a .crbm object can have`);
+  }
+  const metadata = plain.length === FIXED_BYTES ? void 0 : metadataFromBytes(plain.subarray(FIXED_BYTES), fail);
+  return { cardinality: Number(count), metadata, fingerprint };
 }
 function usableSummary(ref, row, aead) {
   const summary = row.summary;
@@ -4477,7 +3990,12 @@ function usableSummary(ref, row, aead) {
     }
   }
   if (keyed) return void 0;
-  return { cardinality: summary.cardinality, metadata: summary.metadata };
+  if (fingerprintParts(summary.fingerprint) === void 0) return void 0;
+  return {
+    cardinality: summary.cardinality,
+    metadata: summary.metadata,
+    fingerprint: summary.fingerprint
+  };
 }
 function canonicalOrNone(metadata) {
   if (metadata === void 0) return void 0;
@@ -4494,32 +4012,66 @@ function metadataToCarry(object, authenticated) {
   return empty(object) && authenticated !== void 0 && !empty(authenticated.metadata) ? authenticated.metadata : object;
 }
 function summaryOf(ref, generation, description, aead) {
-  return aead === void 0 ? clearSummary(generation, description.cardinality, description.metadata) : sealSummary(aead, ref, generation, description.cardinality, description.metadata);
+  const { cardinality, fingerprint, metadata } = description;
+  return aead === void 0 ? clearSummary(generation, cardinality, fingerprint, metadata) : sealSummary(aead, ref, generation, cardinality, fingerprint, metadata);
 }
 
 // src/core/crbm-storage-source.ts
-function storageBlobReader(driver, key) {
+function storageBlobReader(driver, key, noteTail) {
   return {
     getRange(offset, length) {
       return driver.getRange(key, offset, length);
     },
-    getTail(maxBytes) {
-      return driver.getTail(key, maxBytes);
+    getTail: noteTail === void 0 ? (maxBytes) => driver.getTail(key, maxBytes) : async (maxBytes) => {
+      const tail = await driver.getTail(key, maxBytes);
+      noteTail(tail);
+      return tail;
     }
   };
 }
+function resolvedOf(record) {
+  if (record === null || record.status === "destroyed" || record.currentGen === null) return null;
+  return {
+    generation: record.currentGen,
+    lineage: pointerIdOf(record),
+    wrappedDeks: record.wrappedDeks,
+    summary: record.summary
+  };
+}
+function weightOf(resolved) {
+  return SNAPSHOT_BASE_BYTES + (resolved.summary === void 0 ? 0 : JSON.stringify(resolved.summary).length) + (resolved.wrappedDeks === void 0 ? 0 : JSON.stringify(resolved.wrappedDeks).length);
+}
 var notThePinned = (ref, generation) => new NotFoundError(
   `segment "${ref.segment}" generation ${generation} is no longer the object this handle pinned`
 );
 function versionOf(generation, lineage) {
   return lineage === void 0 ? String(generation) : `${generation}:${String(lineage)}`;
 }
+var readerVersions = /* @__PURE__ */ new WeakMap();
+function versionOfReader(reader) {
+  let version = readerVersions.get(reader);
+  if (version === void 0) {
+    version = `${versionOf(reader.generation, reader.lineage)}#${compactFingerprint(reader.fingerprint)}`;
+    readerVersions.set(reader, version);
+  }
+  return version;
+}
+var OBJECT_SUFFIX = /#[0-9a-z]+\.[0-9a-z]+$/;
+function rowVersionOf(version) {
+  return version.replace(OBJECT_SUFFIX, "");
+}
 var PinMoved = class extends Error {
 };
 function summaryOfGeneration(generation, description) {
   const { cardinality, metadata } = description;
   return metadata === void 0 || Object.keys(metadata).length === 0 ? { generation, cardinality } : { generation, cardinality, metadata: Object.freeze({ ...metadata }) };
 }
+function sizedSummary(reader) {
+  return {
+    ...summaryOfGeneration(reader.generation, describe(reader)),
+    sizeBytes: reader.sizeBytes
+  };
+}
 var sameKeys = (a, b) => a !== void 0 && JSON.stringify(a) === JSON.stringify(b);
 function once(fn) {
   let pending;
@@ -4535,62 +4087,95 @@ function once(fn) {
   };
 }
 var readerIsOf = (reader, live) => reader.generation === live.target.generation && reader.lineage === live.target.lineage;
-async function versionNamed(snap) {
-  if (snap.target === void 0) {
-    const reader = await snap.reader;
-    return reader === null ? null : versionOf(reader.generation, reader.lineage);
+async function readsObjectOf(snap, reader) {
+  const settled2 = snap.settled;
+  if (settled2 !== void 0) {
+    const other = settled2.reader;
+    return other !== null && (other === reader || versionOfReader(other) === versionOfReader(reader));
   }
   const live = await snap.target;
-  return live === null ? null : versionOf(live.target.generation, live.target.lineage);
+  return live !== null && versionOf(live.target.generation, live.target.lineage) === versionOf(reader.generation, reader.lineage);
 }
 function describe(reader) {
   return { cardinality: reader.count(), metadata: reader.metadata };
 }
 var Snapshot = class _Snapshot {
-  constructor(target, open4, prior) {
+  constructor(resolution, target, open4, prior) {
+    this.resolution = resolution;
     this.target = target;
     this.open = open4;
     this.prior = prior;
   }
+  resolution;
   target;
   open;
   prior;
-  /** When the snapshot's refresh clock started. A refresh that failed transiently moves it back, so it lapses sooner. */
-  installedAtMs = 0;
   /** Set by the cache, to hear of a reader as it is opened. */
   onReader;
   opened;
-  static live(target, open4, prior) {
-    return new _Snapshot(target, open4, prior);
+  outcome;
+  static live(resolution, target, open4, prior) {
+    return new _Snapshot(resolution, target, open4, prior);
   }
   static eager(reader) {
-    const snap = new _Snapshot(void 0, void 0, void 0);
-    snap.opened = reader;
+    const snap = new _Snapshot(void 0, void 0, void 0, void 0);
+    snap.hold(reader);
     return snap;
   }
   /** The reader, opened by the first call. */
   get reader() {
     if (this.opened === void 0) {
       const target = this.target;
-      this.opened = target.then(async (live) => {
-        if (live === null) return null;
-        const kept = await this.reuse(live);
-        this.prior = void 0;
-        return kept ?? this.open(live);
-      });
-      this.onReader?.(this.opened);
+      const opened = this.hold(
+        target.then(async (live) => {
+          if (live === null) return null;
+          const kept = await this.reuse(live);
+          this.prior = void 0;
+          return kept ?? this.open(live);
+        })
+      );
+      this.onReader?.(opened);
+      return opened;
     }
     return this.opened;
   }
+  /**
+   * Take `reader` as this snapshot's, and note the reader once it has opened. A failed open is not noted: the reader
+   * cache forgets the snapshot as the failure lands, and whoever awaits the reader meets the error.
+   */
+  hold(reader) {
+    this.opened = reader;
+    reader.then(
+      (r) => {
+        this.outcome = { reader: r };
+      },
+      () => void 0
+    );
+    return reader;
+  }
   /** The reader if one has been asked for, without asking for one. */
   get openedReader() {
     return this.opened;
   }
-  /** The prior snapshot's reader, if it is of what this snapshot resolved. */
+  /**
+   * The reader once it has opened (`null` for no generation). Undefined while no reader has been asked for, while the
+   * open is under way, and after an open that failed.
+   */
+  get settled() {
+    return this.outcome;
+  }
+  /**
+   * The prior snapshot's reader, if it is of what this snapshot resolved: the same generation and `pointerId`, and the
+   * object the row's summary names, where it names one. A registry renews `pointerId` with every write that changes the
+   * summary, so the last holds whenever the first two do; it is checked anyway, since it costs no request, and a reader
+   * kept across a write that should have renewed it would serve another object's chunks.
+   */
   async reuse(live) {
     const prior = this.prior;
     const reader = prior === void 0 ? null : await prior.catch(() => null);
-    return reader !== null && readerIsOf(reader, live) ? reader : null;
+    if (reader === null || !readerIsOf(reader, live)) return null;
+    const named = await live.summary().catch(() => void 0);
+    return named === void 0 || named.fingerprint === reader.fingerprint ? reader : null;
   }
   /** Keep the prior snapshot's reader when the refresh found its generation, so a count does not drop it. */
   async adopt(live) {
@@ -4598,15 +4183,13 @@ var Snapshot = class _Snapshot {
     const reader = await this.reuse(live);
     this.prior = void 0;
     if (reader !== null && this.opened === void 0) {
-      this.opened = Promise.resolve(reader);
-      this.onReader?.(this.opened);
+      this.onReader?.(this.hold(Promise.resolve(reader)));
     }
   }
 };
 var SNAPSHOT_BASE_BYTES = 256;
 var BULK_FLUSH_IDS = 1 << 20;
 var YIELD_EVERY_IDS = 1 << 14;
-var RECENT_KEYS = 8;
 var CrbmStorageChunkSource = class {
   constructor(driver, options = {}) {
     this.driver = driver;
@@ -4651,6 +4234,11 @@ var CrbmStorageChunkSource = class {
       maxBytes: maxOpenIndexBytes ?? DEFAULT_MAX_OPEN_INDEX_BYTES,
       clock: clock ?? { now: () => 0 }
     });
+    this.resolutions = this.timedRefresh ? new BoundedLru({
+      maxEntries: RESOLUTIONS_PER_OPEN_SEGMENT * (maxOpenSegments ?? DEFAULT_MAX_OPEN_SEGMENTS),
+      maxBytes: (maxOpenIndexBytes ?? DEFAULT_MAX_OPEN_INDEX_BYTES) / RESOLUTION_BYTES_DIVISOR,
+      clock: { now: () => 0 }
+    }) : void 0;
     this.distrusted = new BoundedLru({
       maxEntries: maxOpenSegments ?? DEFAULT_MAX_OPEN_SEGMENTS,
       clock: { now: () => 0 }
@@ -4666,7 +4254,8 @@ var CrbmStorageChunkSource = class {
    * needs a clock). Within the TTL a segment's Storage bytes are treated as an immutable snapshot; when the TTL
    * elapses the next read cheaply re-resolves `currentGen` and, only if it advanced (a load published),
    * opens the new generation — so a long-lived source observes new generations within the TTL. The engine pairs
-   * this with a **generation-keyed** cache so a bump never serves a stale decoded chunk. Without a clock or a
+   * this with a cache keyed by {@link currentVersion}, which names the object a reader opened, so a bump never serves
+   * a stale decoded chunk, and neither does a number taken again by another object. Without a clock or a
    * registry there is no timed refresh, and a segment's reader is replaced only when it is evicted, when a read
    * has to fetch from a generation a sweep deleted, or when {@link invalidate} drops it. A segment with no generation yet is not memoized, so
    * it's re-checked until one exists. **Bounded** by a {@link BoundedLru} ({@link CrbmStorageChunkSourceOptions.maxOpenSegments}, default
@@ -4674,6 +4263,21 @@ var CrbmStorageChunkSource = class {
    * steady-state memory bound; re-opening an evicted segment is one cheap tail GET.
    */
   snapshots;
+  /**
+   * Each segment's resolution, kept apart from its reader, by segment: what a read of its row found, for the TTL from
+   * the instant that read was sent, whether or not the reader cache still holds the segment's reader. So letting a reader
+   * go moves nothing: the next read builds a snapshot on the resolution, reads no row, and opens the object when it needs
+   * the index or a chunk the chunk cache does not hold (a version, a count and a stat from the row's summary need
+   * neither). It holds the resolved fields only ({@link Resolved}): the wrapped keys, never an unwrapped one, so a
+   * snapshot built on it unwraps the key again through the keystore. It never holds a resolution that found no
+   * generation: the next read of such a segment reads the row.
+   *
+   * Only a source with a timed refresh has one: without it, letting a reader go is one of the few things that ever moves
+   * a read on, and keeping the resolution would keep it forever. **Bounded** by count and by bytes, both derived from
+   * the reader cache's: {@link RESOLUTIONS_PER_OPEN_SEGMENT} times its count bound, and its byte bound over
+   * {@link RESOLUTION_BYTES_DIVISOR}. An entry heavier than the byte bound is kept alone, as the reader cache keeps one.
+   */
+  resolutions;
   /**
    * Pins ({@link heldKey}) whose object has been found replaced: another object is under its generation's key. Kept,
    * and bounded as the readers are, so that a pin's later chunk reads and any reopen fail at once rather than pay for
@@ -4703,6 +4307,13 @@ var CrbmStorageChunkSource = class {
    * the disagreement again.
    */
   distrusted;
+  /**
+   * The readers held to the row's summary: by a live open ({@link openLive}), or by a live pin that shared one. A pin
+   * that finds one memoised under its version shares it as it is: the version names the row's `pointerId`, and every
+   * write of the summary renews it, so the summary it was held to is the one the row has now. Any other memoised reader
+   * (a `pinAt`'s, held to the fingerprint its caller named) is held to the row's summary before a live pin shares it.
+   */
+  rowChecked = /* @__PURE__ */ new WeakSet();
   registry;
   keystore;
   requireEncryption;
@@ -4713,97 +4324,149 @@ var CrbmStorageChunkSource = class {
   currentGenTtlMs;
   /**
    * Whether the segment's pointer is re-read on a timer: it needs a clock (the TTL), a registry (the cheap row read; with
-   * none, resolving is a listing of the bucket) and a TTL above 0. It decides the keeping of chunk bytes, the TTL lapse
-   * and the refresh interval the cost report prices, so it is decided once.
+   * none, resolving is a listing of the bucket) and a TTL above 0. It decides the keeping of chunk bytes and the TTL
+   * lapse, so it is decided once.
    */
   timedRefresh;
   /**
-   * The last few segments' keys, newest first. A stream asks for its segment's snapshot before every cached chunk it
-   * serves, and a combine alternates between a few operands, so comparing two names beats encoding them again, which
-   * cost about a microsecond a chunk.
+   * The keys of the segments this source reads, kept rather than encoded again: a read asks for its segment's snapshot
+   * once per operand, and a stream before every cached chunk it serves, and encoding the names cost about a
+   * microsecond each time.
    */
-  recentKeys = [];
+  keys = new KeptSegmentKeys(segmentKey);
   keyOf(ref) {
-    for (const k of this.recentKeys) {
-      if (k.segment === ref.segment && k.namespace === ref.namespace) return k.key;
-    }
-    const key = segmentKey(ref);
-    this.recentKeys.unshift({ namespace: ref.namespace, segment: ref.segment, key });
-    if (this.recentKeys.length > RECENT_KEYS) this.recentKeys.pop();
-    return key;
+    return this.keys.of(ref);
   }
   /**
-   * The segment's live snapshot, refreshing on the TTL. Cheap within the TTL window. The snapshot holds the resolved
-   * target, and its reader once a read has asked for one.
+   * The segment's live snapshot, refreshing on the TTL. Cheap within the TTL window: the snapshot the reader cache holds,
+   * while its resolution is inside the TTL. With a timed refresh, a segment whose reader the cache let go is served a
+   * snapshot built on its kept resolution, while that is inside the TTL: no row is read, and the reader opens only when a
+   * read needs one. Otherwise the pointer is read now. The snapshot holds the resolved target, and its reader once a read
+   * has asked for one.
    */
   liveSnapshot(ref) {
     const key = this.keyOf(ref);
     const existing = this.snapshots.get(key);
-    if (existing === void 0) {
-      return this.install(
-        key,
-        Snapshot.live(this.resolveLive(ref), (live) => this.openLive(ref, live))
-      );
+    if (existing !== void 0 && !this.expired(existing.resolution)) return existing;
+    const kept = this.resolutions?.get(key);
+    if (kept !== void 0 && kept !== existing?.resolution && !this.expired(kept)) {
+      return this.install(key, this.snapshotOn(ref, kept, existing));
     }
-    if (!this.expired(existing.installedAtMs)) return existing;
-    const snap = this.install(
-      key,
-      Snapshot.live(
-        this.refreshedTarget(ref, existing, () => this.retrySoon(snap)),
-        (live) => this.openLive(ref, live),
-        existing.openedReader
-      )
-    );
-    return snap;
+    const resolution = this.resolveNow(ref, existing?.resolution);
+    this.remember(key, resolution);
+    return this.install(key, this.snapshotOn(ref, resolution, existing));
   }
-  /** The current resolved reader for a segment, refreshing on the TTL. */
-  resolvedReader(ref) {
-    return this.liveSnapshot(ref).reader;
+  /**
+   * Read the segment's pointer now. The read is sent before this returns, and the TTL counts from this instant: a read
+   * that answers late does not lengthen the life of what it found. The row read is always fresh, so what a snapshot on
+   * it says of the generation (its summary included) is what the row says now, never `prior`'s.
+   *
+   * A read that fails with a transient fault answers what `prior` found, when it found a generation, and is asked again
+   * soon ({@link retrySoon}): `prior` is the resolution of the snapshot the reader cache still holds, so an outage of the
+   * registry keeps that snapshot's generation, and its reader and unwrapped key where it has them; one resolved without
+   * an open, for a count or a generation lookup, unwraps the key from `prior`'s wrapped keys when a read first needs
+   * it. The outage ends shortly after the registry answers.
+   * That answer is the snapshot's alone ({@link Resolution.rodeOut}): it is not kept as the segment's resolution, and a
+   * snapshot built on it after the reader cache let that one go fails with the fault. With no `prior` the fault
+   * fails the read, as a cold resolve's does. If `prior` found none or failed, the pointer is read once more rather than
+   * a dead resolution re-armed (else the segment reads empty for a whole TTL window). Anything else — an access denial, a corrupt row, a
+   * registry that answers NotFound — fails the read exactly as a cold resolve of the segment would, and the resolution
+   * and the snapshot on it are forgotten, so a reader and the key it unwrapped do not outlive a refresh that could not
+   * be trusted.
+   */
+  resolveNow(ref, prior) {
+    const sentAtMs = this.now();
+    const sent = this.resolve(ref);
+    if (prior === void 0) return { resolved: sent, sentAtMs };
+    const resolution = {
+      sentAtMs,
+      resolved: sent.catch(async (err) => {
+        if (!isTransientError(err)) throw err;
+        const before = await prior.resolved.catch(() => null);
+        if (before === null) return this.resolve(ref);
+        this.retrySoon(resolution);
+        const key = this.keyOf(ref);
+        if (this.resolutions?.peek(key) === resolution) this.resolutions.delete(key);
+        resolution.rodeOut = { from: prior, fault: err };
+        prior.rodeOut = void 0;
+        return before;
+      })
+    };
+    return resolution;
   }
   /**
-   * A refresh failed transiently and the prior reader keeps serving: make this snapshot lapse after
-   * {@link REFRESH_RETRY_MS} (never longer than the TTL) rather than after a whole TTL, so the next read after
-   * that asks the registry again. It costs no read of its own; it only changes when the next refresh happens.
+   * A refresh failed transiently and the prior resolution keeps serving: make it lapse after {@link REFRESH_RETRY_MS}
+   * (never longer than the TTL) rather than after a whole TTL, so the next read after that asks the registry again. It
+   * costs no read of its own; it only changes when the next refresh happens.
    */
-  retrySoon(snap) {
-    snap.installedAtMs = this.now() - (this.currentGenTtlMs - Math.min(this.currentGenTtlMs, REFRESH_RETRY_MS));
+  retrySoon(resolution) {
+    resolution.sentAtMs = this.now() - (this.currentGenTtlMs - Math.min(this.currentGenTtlMs, REFRESH_RETRY_MS));
   }
   /**
-   * TTL elapsed: cheaply re-resolve the pointer. The row read is always fresh, so what the new snapshot says of the
-   * generation (its summary included) is what the row says now, never the prior snapshot's. The reader is reopened
-   * only if the generation or the row changed, and only when a read asks for it.
+   * Keep `resolution` as the segment's, from the instant its read was sent, so the reads that come while it is in flight
+   * share it, and a read after the reader cache let the segment go builds on it. Its weight is reported once it lands,
+   * and one that finds no generation, or fails, is forgotten. Both are identity-guarded, as the reader cache's are, and
+   * nothing is installed when the read lands: an `invalidate` while it is in flight, or a newer resolution, is never
+   * undone by its answer.
    */
-  async refreshedTarget(ref, existing, onTransientFault) {
-    const prior = await existing.target.catch(() => null);
-    try {
-      return await this.resolveLive(ref, prior);
-    } catch (err) {
-      if (!isTransientError(err)) throw err;
-      const alive = prior !== null;
-      if (!alive) return this.resolveLive(ref);
-      onTransientFault();
-      return prior;
-    }
+  remember(key, resolution) {
+    const cache = this.resolutions;
+    if (cache === void 0) return;
+    cache.set(key, resolution);
+    const forgetIfStale = () => {
+      if (cache.peek(key) === resolution) cache.delete(key);
+    };
+    resolution.resolved.then((resolved) => {
+      if (resolved === null) forgetIfStale();
+      else if (cache.peek(key) === resolution) cache.setWeight(key, weightOf(resolved));
+    }, forgetIfStale);
   }
   /**
-   * Memoize a snapshot as the segment's at `now()`, forgetting it later if it resolves to null / throws
-   * (identity-guarded, so a stale cleanup never clobbers a fresher snapshot). Installing the (pending) snapshot
-   * **synchronously** is what lets concurrent callers coalesce onto one in-flight resolve.
+   * A live snapshot on `resolution`. `before` is the snapshot it replaces, while the reader cache still holds one: its
+   * reader is kept if the resolution finds the same generation, `pointerId` and object ({@link Snapshot.reuse}), and its
+   * unwrapped key if the same wrapped keys. A snapshot built after the reader cache let the segment go has neither, so
+   * its open asks the keystore again: a key is held only while a reader of the segment is.
+   */
+  snapshotOn(ref, resolution, before) {
+    return Snapshot.live(
+      resolution,
+      this.targetOn(ref, resolution, before),
+      (live) => this.openLive(ref, live),
+      before?.openedReader
+    );
+  }
+  /** What the snapshot on `resolution` that replaces `before` reads: see {@link snapshotOn}. */
+  targetOn(ref, resolution, before) {
+    const prior = before?.target;
+    const replaces = before?.resolution;
+    return resolution.resolved.then(async (resolved) => {
+      if (resolved === null) return null;
+      const rodeOut = resolution.rodeOut;
+      if (rodeOut !== void 0 && replaces !== rodeOut.from) throw rodeOut.fault;
+      return this.liveOf(ref, resolved, prior === void 0 ? null : await prior.catch(() => null));
+    });
+  }
+  /**
+   * Memoize a snapshot as the segment's, forgetting it later if it resolves to null / throws (identity-guarded, so a
+   * stale cleanup never clobbers a fresher snapshot). Installing the (pending) snapshot **synchronously** is what lets
+   * concurrent callers coalesce onto one in-flight resolve.
    */
   install(key, snap) {
-    snap.installedAtMs = this.now();
     this.snapshots.set(key, snap);
     const forgetIfStale = () => {
       if (this.snapshots.get(key) === snap) this.snapshots.delete(key);
     };
     snap.onReader = (reader) => {
-      reader.then((r) => {
-        if (r === null) {
-          forgetIfStale();
-          return;
-        }
-        if (this.snapshots.peek(key) === snap) this.snapshots.setWeight(key, r.retainedBytes);
-      }, forgetIfStale);
+      reader.then(
+        (r) => {
+          if (r === null) {
+            forgetIfStale();
+            return;
+          }
+          if (this.snapshots.peek(key) === snap) this.snapshots.setWeight(key, r.retainedBytes);
+        },
+        () => this.dropStale(key, snap)
+      );
     };
     if (snap.target !== void 0) {
       snap.target.then(async (live) => {
@@ -4823,53 +4486,46 @@ var CrbmStorageChunkSource = class {
   now() {
     return this.clock ? this.clock.now() : 0;
   }
-  /**
-   * How often this source re-reads a segment's pointer while the segment is being read, in ms: its TTL, or 0 when
-   * it has no timed refresh (no clock, no registry, or a TTL of 0). The grounded cost report prices the refresh at
-   * this.
-   */
-  get pointerRefreshMs() {
-    return this.timedRefresh ? this.currentGenTtlMs : 0;
-  }
   /**
    * Whether a stream reading from `snap` must resolve its segment again before its next chunk, as a read of one chunk
-   * would: the snapshot's TTL has lapsed, an invalidation has happened since `epoch`, or the snapshot is no longer the
-   * one the reader cache holds for the segment (it let it go, or another read installed a newer one). Else nothing can
-   * have moved it, and the check costs a compare and a lookup.
+   * would. In this order: an invalidation has happened since `epoch` (what the store that erased stops on, at once);
+   * the TTL of the snapshot's resolution has lapsed; or that resolution is no longer the segment's: another read
+   * installed a newer one (a refresh, or a heal), or the resolution cache let it go. With no resolution cache (no timed
+   * refresh) the last test is of the snapshot itself, so there the reader cache letting it go is a move, as it is one of
+   * the few things that ever moves such a store's read on. With one, it is not. Else nothing can have moved it, and the
+   * check costs a compare and a lookup in each cache.
    */
   mayHaveMoved(key, snap, epoch) {
-    return this.invalidations !== epoch || this.expired(snap.installedAtMs) || this.snapshots.get(key) !== snap;
+    const resolution = snap.resolution;
+    if (this.invalidations !== epoch || this.expired(resolution)) return true;
+    const held = this.snapshots.get(key);
+    return this.resolutions === void 0 ? held !== snap : this.resolutions.get(key) !== resolution;
   }
-  expired(installedAtMs) {
-    return this.timedRefresh && this.now() - installedAtMs >= this.currentGenTtlMs;
+  expired(resolution) {
+    return this.timedRefresh && this.now() - resolution.sentAtMs >= this.currentGenTtlMs;
   }
   /**
-   * The segment's current generation number — the engine keys its chunk cache by this so a generation bump
-   * is observed instead of serving a stale decoded chunk. Served from the (TTL-refreshed)
-   * snapshot, so no extra backend read within the TTL window. `null` if the segment has no committed generation.
+   * The segment's current generation number, as its snapshot's resolution found it: no backend read within the TTL
+   * window, and no open of the object, ever. `null` if the segment has no committed generation. A generation swept from
+   * under the resolution is met by the read that fetches from it, which heals ({@link withFreshSnapshot}). Since it
+   * opens nothing, the only error it meets is the resolution's own, and it fails with that error at once: there is
+   * nothing to heal. The reads that can open the object (`listChunkKeys`, `summary`, `currentVersion` and the rest)
+   * resolve once more on any `NotFoundError`, a registry's among them, since theirs can be a swept generation.
    *
-   * Heals a swept generation exactly like {@link withFreshSnapshot}: a caller that resolves the generation once
-   * per op, before any chunk fetch, would otherwise fail the whole operation rather than one chunk. The engine
-   * keys by {@link currentVersion} instead, which heals the same way, and falls back to this for a source that
-   * cannot report a version. It is spelled out rather than delegated because a lookup like this runs once per
-   * operand of every `has`/`count`/`iterate`/`intersect`, almost always served from the cached snapshot with
-   * no backend call at all. Routing it through the generic helper cost ~115 ns/op on that path (a second async
-   * frame, a per-call closure, and an `await` on a plain number) for a race that fires only during a
-   * concurrent sweep. One retry, then propagate — same contract, same eviction rule.
+   * It is spelled out rather than delegated because a lookup like this runs once per operand of every
+   * `has`/`count`/`iterate`/`intersect`, almost always served from the cached snapshot with no backend call at all.
+   * Routing it through the generic helper cost ~115 ns/op on that path (a second async frame, a per-call closure, and
+   * an `await` on a plain number).
    */
   async currentGeneration(ref) {
     const snap = this.liveSnapshot(ref);
-    try {
-      return (await snap.reader)?.generation ?? null;
-    } catch (err) {
-      if (!isNotFoundError(err)) throw err;
-      this.dropStale(segmentKey(ref), snap);
-      return (await this.resolvedReader(ref))?.generation ?? null;
-    }
+    const settled2 = snap.settled;
+    if (settled2 !== void 0) return settled2.reader?.generation ?? null;
+    return (await snap.target)?.target.generation ?? null;
   }
   /**
-   * Forget everything derived from `ref`: the resolved snapshot and the open reader behind it (and with the
-   * reader, the DEK it unwrapped at open time), and what its pins' objects were found to be. The next read
+   * Forget everything derived from `ref`: its resolution, the resolved snapshot and the open reader behind it (and with
+   * the reader, the DEK it unwrapped at open time), and what its pins' objects were found to be. The next read
    * resolves the segment again.
    *
    * Needed because the TTL refresh only ever answers "has the pointer moved?", and every *destructive* verb —
@@ -4882,6 +4538,7 @@ var CrbmStorageChunkSource = class {
     this.invalidations += 1;
     const key = segmentKey(ref);
     this.snapshots.delete(key);
+    this.resolutions?.delete(key);
     const pinnedPrefix = `${key}@`;
     this.distrusted.deleteWhere((k) => k.startsWith(pinnedPrefix));
     this.snapshots.deleteWhere((k) => k.startsWith(pinnedPrefix));
@@ -4889,31 +4546,53 @@ var CrbmStorageChunkSource = class {
     for (const k of this.checking.keys()) if (k.startsWith(pinnedPrefix)) this.checking.delete(k);
   }
   /**
-   * `<generation>` for a registry-less source, or `<generation>:<row token>` with one. The token moves on every row
-   * write, so an unrelated write (a `setRetention`) costs the segment's decoded chunks once — bounded, and on an
-   * admin path. Exactness in the direction that matters: with a registry, two incarnations can never share a version
-   * string. Without one they can: a name purged and loaded again out of band restarts at the same bare number, and
-   * a live read that reopens it after an eviction reads the new object's chunks beside the old one's cached ones. A
-   * store with no registry cannot write, so that takes a change made from outside it; a pin is kept apart from it by
-   * the fingerprint it records.
+   * `<generation>#<object>` for a registry-less source, or `<generation>:<pointerId>#<object>` with one: the generation
+   * the segment's snapshot resolved, and the object a reader of it opens, by that object's size and footer checksum in
+   * base 36. The row's `pointerId` moves only with a write that names a field a read resolves through, at any value, so
+   * a lease or a policy write (a `setRetention`) leaves the version, the open reader and the decoded chunks as they were.
+   * Two objects do not share a version string, as far as their sizes and footer checksums tell them apart, whichever way
+   * a number came to name a second one: a name purged and loaded again (a new row, or with no registry the same bare
+   * number), a number taken again within one row once its object was deleted, or an object put back under its key from
+   * outside the library. The version is opaque: compare two for equality.
+   *
+   * Where the row's summary names the object, the version is answered from the resolution, with no open: every live
+   * open of the generation is held to that object ({@link openLive}), refused as a move otherwise, so the one object any
+   * reader of this resolution can name is the one the summary names, and a version named from it is the one that
+   * reader's would be. So a `has()` whose chunk is in the chunk cache opens nothing, after the reader cache let
+   * the segment go included (a read that needs the index opens the object for it, and on an encrypted segment the
+   * key is unwrapped to read the row's sealed summary); an object under the number that is not the row's is met by the read that fetches from it,
+   * which refuses it and heals. Where the row has no summary it can use, or there is no registry, nothing names the
+   * object but the object: the reader is opened, and the version names what it opened, however long after its row read
+   * that is.
    *
-   * This is the call the engine makes **once per operand of every read**, before any chunk fetch, to key its
-   * chunk cache, so it heals a swept generation exactly as {@link currentGeneration} does: unhealed, a cold read
-   * racing a publish and a `keep: 0` sweep failed the whole operation with `NotFoundError`, where the same race
-   * on a chunk fetch heals. Spelled out rather than delegated for the reason `currentGeneration` gives: it is
-   * almost always served from the cached snapshot with no backend call at all. One retry, then propagate.
+   * This is the call the engine makes **once per operand of every read**, before any chunk fetch, to key its chunk
+   * cache, so an open it makes heals a swept generation as a read does: unhealed, a cold read racing a publish and a
+   * `keep: 0` sweep failed the whole operation with `NotFoundError`, where the same race on a chunk fetch heals. Spelled
+   * out rather than delegated for the reason `currentGeneration` gives: it is almost always served from the cached
+   * snapshot with no backend call at all. One retry, then propagate.
    */
   async currentVersion(ref) {
     const snap = this.liveSnapshot(ref);
-    let reader;
+    const settled2 = snap.settled;
+    if (settled2 !== void 0) {
+      return settled2.reader === null ? null : versionOfReader(settled2.reader);
+    }
     try {
-      reader = await snap.reader;
+      return await this.versionOn(snap);
     } catch (err) {
       if (!isNotFoundError(err)) throw err;
       this.dropStale(segmentKey(ref), snap);
-      reader = await this.resolvedReader(ref);
+      return await this.versionOn(this.liveSnapshot(ref));
     }
-    return reader === null ? null : versionOf(reader.generation, reader.lineage);
+  }
+  /** {@link currentVersion} of one snapshot: named by the row's summary when it can be, else by the reader, opened. */
+  async versionOn(snap) {
+    const live = await snap.target;
+    if (live === null) return null;
+    const named = await live.version();
+    if (named !== void 0) return named;
+    const reader = await snap.reader;
+    return reader === null ? null : versionOfReader(reader);
   }
   /**
    * Resolve the segment **once** and report what a pin should hold: the generation, and the version that
@@ -4973,11 +4652,10 @@ var CrbmStorageChunkSource = class {
       if (record.currentGen === null || generation > record.currentGen) {
         throw gone("it is not a published generation of this segment");
       }
-      let lineage = record.token;
+      const lineage = pointerIdOf(record);
       if (lease !== void 0) {
         const taken = await lease.take(record);
         if (taken === "moved") throw gone("the segment moved while its lease was taken");
-        lineage = taken.token;
       }
       version = versionOf(generation, lineage);
       const key = this.pinnedKey(ref, version);
@@ -5015,12 +4693,11 @@ var CrbmStorageChunkSource = class {
     return { generation, version, fingerprint };
   }
   async pinOnce(ref, lease) {
-    let live = await this.resolveLive(ref);
+    const live = await this.resolveLive(ref);
     if (live === null) return null;
     if (lease !== void 0 && live.row !== void 0) {
       const taken = await lease.take(live.row);
       if (taken === "moved") throw new PinMoved();
-      live = { ...live, target: { ...live.target, lineage: taken.token } };
     }
     const target = live.target;
     const version = versionOf(target.generation, target.lineage);
@@ -5040,8 +4717,17 @@ var CrbmStorageChunkSource = class {
       entry ??= this.install(key, Snapshot.eager(this.openLive(ref, live)));
       reader = await entry.reader;
       if (reader === null) return null;
-      const replaced = (r) => this.replacedPins.get(this.heldKey(ref, version, r.fingerprint)) !== void 0;
-      const known = !opened && replaced(reader);
+      let named;
+      const replaced = async (r) => {
+        if (this.replacedPins.get(this.heldKey(ref, version, r.fingerprint)) !== void 0)
+          return true;
+        if (this.rowChecked.has(r)) return false;
+        const fingerprint = await (named ??= live.summary().then((d) => d?.fingerprint));
+        if (fingerprint !== void 0 && r.fingerprint !== fingerprint) return true;
+        this.rowChecked.add(r);
+        return false;
+      };
+      const known = !opened && await replaced(reader);
       if (!known && this.invalidations === epoch && this.snapshots.peek(key) === void 0) {
         this.install(key, Snapshot.eager(Promise.resolve(reader)));
       }
@@ -5050,7 +4736,7 @@ var CrbmStorageChunkSource = class {
         let fresh = current !== void 0 && current !== entry ? current : this.install(key, Snapshot.eager(this.openLive(ref, live)));
         reader = await fresh.reader;
         if (reader === null) return null;
-        if (fresh === current && replaced(reader)) {
+        if (fresh === current && await replaced(reader)) {
           fresh = this.install(key, Snapshot.eager(this.openLive(ref, live)));
           reader = await fresh.reader;
           if (reader === null) return null;
@@ -5067,7 +4753,7 @@ var CrbmStorageChunkSource = class {
   }
   /**
    * Where a pinned reader of one object is memoised. With a registry that is its version, which names the object:
-   * a name purged and loaded again gets a new row, and with it a new token. Without one the version is the bare
+   * a name purged and loaded again gets a new row, and with it a new `pointerId`. Without one the version is the bare
    * generation number, which two incarnations share, so the object's fingerprint is added to tell them apart.
    */
   pinnedKey(ref, version, fingerprint) {
@@ -5103,9 +4789,10 @@ var CrbmStorageChunkSource = class {
    * **And the object is checked**, when the caller says which one it pinned. A generation number is not an
    * identity (invariant 1): once a name is purged and loaded again, its new segment starts again at generation 0,
    * so a pin of the old one would open the new one's object as its own, and read it beside the chunks it had
-   * already cached from the old one. The row's token cannot tell them apart, since it moves on every write, a
-   * publish included; the object's fingerprint can, and a pin whose object has been replaced fails, as one whose
-   * generation has been swept does. The memo is keyed so that two pins of one generation number in two
+   * already cached from the old one. The row's `pointerId` cannot tell them apart, since it moves with every write
+   * that changes what the row resolves to, a publish included, while the pinned object stays what it was; the
+   * object's fingerprint can, and a pin whose object has been replaced fails, as one whose generation has been swept
+   * does. The memo is keyed so that two pins of one generation number in two
    * incarnations never share a reader, with a registry or without one ({@link pinnedKey}).
    */
   async readerAt(ref, generation, version, fingerprint) {
@@ -5147,7 +4834,7 @@ var CrbmStorageChunkSource = class {
     if (record === null || record.status === "destroyed") return null;
     return this.openForTarget(ref, {
       generation,
-      lineage: record.token,
+      lineage: pointerIdOf(record),
       wrappedDeks: record.wrappedDeks
     });
   }
@@ -5228,7 +4915,7 @@ var CrbmStorageChunkSource = class {
     const reader = await this.readerAt(ref, generation, held?.version, held?.fingerprint);
     return reader === null ? null : reader.cardinalities();
   }
-  /** Grounded size of a specific generation. `held` as for {@link getChunkAt}. */
+  /** Size of a specific generation. `held` as for {@link getChunkAt}. */
   async sizeOfAt(ref, generation, held) {
     validateUserRef(ref);
     const reader = await this.readerAt(ref, generation, held?.version, held?.fingerprint);
@@ -5256,19 +4943,29 @@ var CrbmStorageChunkSource = class {
     return false;
   }
   /**
-   * Evict a snapshot we just failed to read from — matched by the snapshot itself, so a concurrent call's
-   * fresher snapshot is never clobbered. The identity guard is the whole point: `install` replaces the entry
-   * wholesale, so comparing anything else would drop a good snapshot on the floor.
+   * Evict a snapshot we just failed to read from, and the resolution it was built on — each matched by identity, so a
+   * concurrent call's fresher snapshot or resolution is never clobbered. The identity guard is the whole point: `install`
+   * and `remember` replace an entry wholesale, so comparing anything else would drop a good one on the floor. The
+   * resolution goes too, or the read's retry would build its snapshot on it again and reopen the generation it just
+   * found gone; and so does a snapshot the reader cache holds on that same resolution, which another read built once the
+   * cache had let `snap` go, or the retry would open that one.
    */
   dropStale(key, snap) {
-    if (this.snapshots.get(key) === snap) this.snapshots.delete(key);
+    const resolution = snap.resolution;
+    const held = this.snapshots.peek(key);
+    if (held === snap || resolution !== void 0 && held?.resolution === resolution) {
+      this.snapshots.delete(key);
+    }
+    if (resolution !== void 0 && this.resolutions?.peek(key) === resolution) {
+      this.resolutions.delete(key);
+    }
   }
   /** Open a {@link CrbmReader} for an already-resolved generation target (decrypting if the segment is encrypted). */
   async openForTarget(ref, target) {
     const crypto = await this.cryptoForRead(ref, target.generation, target.wrappedDeks);
     return this.openGeneration(ref, target, crypto);
   }
-  openGeneration(ref, target, crypto) {
+  openGeneration(ref, target, crypto, named) {
     const genKey = {
       namespace: ref.namespace,
       segment: ref.segment,
@@ -5278,17 +4975,23 @@ var CrbmStorageChunkSource = class {
       this.driver,
       genKey,
       { ...this.readerOptions, crypto, lineage: target.lineage },
-      this.keepChunkBytesUpTo
+      this.keepChunkBytesUpTo,
+      named
     );
   }
   /**
-   * Open the generation a resolution found, and hold the row's summary against the object while it is open anyway:
-   * the same count and metadata, or the summary is not believed again in this process ({@link distrusted}). This
-   * costs no request; a mismatch is not an error, since the object is the truth and this read has it.
+   * Open the generation a resolution found, and hold the row's summary against the object: the object must be the one
+   * the summary names by its fingerprint, and is refused before its index is opened otherwise, as another object under
+   * the generation's number ({@link NotFoundError}, so the read resolves the row again, as for a swept generation); and
+   * it should hold the same count and metadata, or the summary is not believed again in this process
+   * ({@link distrusted}). Neither check costs a request. A row with no summary it can use names no object, and its
+   * generation's object is opened as it is.
    */
   async openLive(ref, live) {
-    const reader = await this.openGeneration(ref, live.target, await live.crypto());
+    const crypto = await live.crypto();
     const summary = await live.summary();
+    const reader = await this.openGeneration(ref, live.target, crypto, summary?.fingerprint);
+    this.rowChecked.add(reader);
     if (summary !== void 0 && !summaryAgrees(summary, describe(reader))) {
       this.distrusted.set(this.distrustKey(ref, live.target.generation, live.target.lineage), true);
     }
@@ -5305,43 +5008,70 @@ var CrbmStorageChunkSource = class {
     return live.summary();
   }
   /**
-   * The current generation + its DEK wrappings: the registry's authoritative record (one strong read), or a
-   * `list` scan for the max generation when there's no registry (a registry-less source can only read cleartext
-   * — there's nowhere a wrapped DEK could live). The row's summary rides along, to be used or not by whoever
-   * asks.
+   * What the segment resolves to now: the fields of the registry's authoritative record a read resolves through (one
+   * strong read), or the highest generation a `list` of the bucket finds when there is no registry (a registry-less
+   * source can only read cleartext: there is nowhere a wrapped DEK could live). `null` for no generation.
    */
-  async resolveLive(ref, prior) {
-    if (this.registry !== void 0) {
-      const record = await this.registry.get(ref);
-      if (record === null) return null;
-      if (record.status === "destroyed") return null;
-      if (record.currentGen === null) return null;
-      const generation = record.currentGen;
-      const keys = record.wrappedDeks;
-      const unwrap = keys === void 0 || keys.length === 0 || this.keystore === void 0 ? void 0 : prior?.unwrap !== void 0 && sameKeys(prior.target.wrappedDeks, keys) ? prior.unwrap : once(() => this.keystore.openDek(keys));
-      const crypto = once(() => this.cryptoForRead(ref, generation, keys, unwrap));
-      return {
-        row: record,
-        target: { generation, lineage: record.token, wrappedDeks: record.wrappedDeks },
-        crypto,
-        unwrap,
-        // The same checks as a read of the object makes (`requireEncryption`, a keystore for an encrypted row)
-        // come first, then the row's summary, used only if it names this generation in the shape the keys call for.
-        summary: once(async () => usableSummary(ref, record, (await crypto())?.aead)),
-        bytes: SNAPSHOT_BASE_BYTES + (record.summary === void 0 ? 0 : JSON.stringify(record.summary).length)
-      };
-    }
+  async resolve(ref) {
+    if (this.registry !== void 0) return resolvedOf(await this.registry.get(ref));
     let maxGen = -1;
     for await (const key of this.driver.list(ref)) {
       if (key.generation > maxGen) maxGen = key.generation;
     }
-    if (maxGen < 0) return null;
+    return maxGen < 0 ? null : { generation: maxGen };
+  }
+  /**
+   * The segment resolved afresh for a pin, with the row it read, which a lease is written against. Never a kept
+   * resolution, and kept nowhere: the generation current right now is the whole promise of a pin.
+   */
+  async resolveLive(ref) {
+    if (this.registry === void 0) {
+      const resolved2 = await this.resolve(ref);
+      return resolved2 === null ? null : this.liveOf(ref, resolved2, null);
+    }
+    const row = await this.registry.get(ref);
+    const resolved = resolvedOf(row);
+    return resolved === null || row === null ? null : this.liveOf(ref, resolved, null, row);
+  }
+  /**
+   * What a snapshot, or a pin, makes of a resolution: its decryption context and what the row's summary says of the
+   * generation, each made only when asked for. A snapshot that replaces `prior` with the same wrapped keys keeps the key
+   * `prior` unwrapped, so a count polling an encrypted segment asks the keystore once, not once each `genTtlMs`.
+   * Different keys (a shred, a re-created name) unwrap afresh, and so does a snapshot with no prior: the resolution
+   * holds the wrapped keys, never an unwrapped one.
+   */
+  liveOf(ref, resolved, prior, row) {
+    if (this.registry === void 0) {
+      return {
+        target: resolved,
+        crypto: () => Promise.resolve(void 0),
+        unwrap: void 0,
+        summary: () => Promise.resolve(void 0),
+        version: () => Promise.resolve(void 0),
+        bytes: weightOf(resolved)
+      };
+    }
+    const { generation, lineage, wrappedDeks: keys, summary } = resolved;
+    const unwrap = keys === void 0 || keys.length === 0 || this.keystore === void 0 ? void 0 : prior?.unwrap !== void 0 && sameKeys(prior.target.wrappedDeks, keys) ? prior.unwrap : once(() => this.keystore.openDek(keys));
+    const crypto = once(() => this.cryptoForRead(ref, generation, keys, unwrap));
+    const described = once(
+      async () => usableSummary(
+        ref,
+        { status: "active", currentGen: generation, summary, wrappedDeks: keys },
+        (await crypto())?.aead
+      )
+    );
     return {
-      target: { generation: maxGen },
-      crypto: () => Promise.resolve(void 0),
-      unwrap: void 0,
-      summary: () => Promise.resolve(void 0),
-      bytes: SNAPSHOT_BASE_BYTES
+      target: resolved,
+      ...row === void 0 ? {} : { row },
+      crypto,
+      unwrap,
+      summary: described,
+      version: once(async () => {
+        const named = (await described())?.fingerprint;
+        return named === void 0 ? void 0 : `${versionOf(generation, lineage)}#${compactFingerprint(named)}`;
+      }),
+      bytes: weightOf(resolved)
     };
   }
   /** Build the per-generation decryption context for an encrypted segment (undefined for cleartext). */
@@ -5405,7 +5135,8 @@ var CrbmStorageChunkSource = class {
           }
           return;
         }
-        const version = versionOf(reader.generation, reader.lineage);
+        const version = versionOfReader(reader);
+        let seen = snap.settled;
         chunks = reader.readChunks(keys.slice(yielded), {
           ...options?.concurrency === void 0 ? {} : { concurrency: options.concurrency },
           ...options?.ramp === void 0 ? {} : { ramp: options.ramp },
@@ -5417,22 +5148,24 @@ var CrbmStorageChunkSource = class {
         let movedOn = false;
         try {
           while (await pull.advance()) {
-            if (this.mayHaveMoved(key, snap, epoch)) {
+            if (this.mayHaveMoved(key, snap, epoch) || snap.settled !== seen) {
               const live = this.liveSnapshot(ref);
-              if (live !== snap) {
-                let now;
+              if (live !== snap || live.settled !== seen) {
+                const looked = live.settled;
+                let same;
                 try {
-                  now = await versionNamed(live);
+                  same = await readsObjectOf(live, reader);
                 } catch (err) {
                   if (!isTransientError(err)) throw err;
                   movedOn = true;
                   break;
                 }
-                if (now !== version) {
+                if (!same) {
                   movedOn = true;
                   break;
                 }
                 snap = live;
+                seen = looked;
               }
               epoch = this.invalidations;
             }
@@ -5526,24 +5259,37 @@ var CrbmStorageChunkSource = class {
    * it can: the row's summary of the generation it names, on an active row, in the shape the row's keys call for
    * (a sealed one is opened with the segment's key), and one this process has not found to disagree with its
    * object. That is one registry read when the snapshot is cold, none when it is warm, and no read of the object.
-   * With no summary it can use (an older row, one for another generation, one that does not open), it opens the
-   * generation and answers from the object. A row that names an object that is gone still answers, while a read
-   * of the object throws: the number is true of the generation the row names.
+   * With no summary it can use (a row written without one, one for another generation, one that does not open), it
+   * opens the generation and answers from the object. A row that names an object that is gone, or another object
+   * under the number, still answers, while a read of the object throws: the number is true of the generation the row
+   * names.
    *
    * What the row says is not confirmed here: a summary edited to agree with itself by whoever can write the row is
    * believed until the next time the object is opened, which holds it against the summary.
    */
   async summary(ref) {
     validateUserRef(ref);
+    return this.described(
+      ref,
+      (generation, row) => summaryOfGeneration(generation, row),
+      (reader) => summaryOfGeneration(reader.generation, describe(reader))
+    );
+  }
+  /**
+   * What one resolution of the segment says of its generation: from the row's summary when this process may use it,
+   * else from the generation's object, opened. `null` for no generation. One heal, as a read of the object has: a
+   * generation swept from under the snapshot, or replaced under its number, is resolved again once.
+   */
+  async described(ref, fromRow, fromObject) {
     for (let attempt = 0; attempt < 2; attempt++) {
       const snap = this.liveSnapshot(ref);
       try {
         const live = await snap.target;
         if (live === null) return null;
         const row = await this.trustedSummary(ref, live);
-        if (row !== void 0) return summaryOfGeneration(live.target.generation, row);
+        if (row !== void 0) return fromRow(live.target.generation, row);
         const reader = await snap.reader;
-        return reader === null ? null : summaryOfGeneration(reader.generation, describe(reader));
+        return reader === null ? null : fromObject(reader);
       } catch (err) {
         if (attempt === 1) throw err;
         const checks = isNotFoundError(err) || isIntegrityError(err) || isValidationError(err);
@@ -5561,6 +5307,32 @@ var CrbmStorageChunkSource = class {
     const reader = await this.readerAt(ref, generation, held?.version, held?.fingerprint);
     return reader === null ? null : summaryOfGeneration(reader.generation, describe(reader));
   }
+  /**
+   * The current generation's number, id count and metadata, with its object's size, all from one resolution. The answer
+   * comes from the row when it can, as {@link summary}'s does: the row's summary of the generation it names, whose
+   * fingerprint carries the object's size. That is one registry read when the snapshot is cold, none when it is warm,
+   * and no read of the object; on an encrypted segment the key is unwrapped to open the summary, as for a count. With no
+   * summary it can use, it opens the generation and answers from its footer and index, with no payload read: a tail read
+   * more when cold. A row that names an object that is gone, or another object, still answers from the row: the figures
+   * are the generation's the row names, and `checkConsistency` is what finds such a row.
+   */
+  async stat(ref) {
+    validateUserRef(ref);
+    return this.described(
+      ref,
+      (generation, row) => ({
+        ...summaryOfGeneration(generation, row),
+        sizeBytes: sizeOfFingerprint(row.fingerprint)
+      }),
+      (reader) => sizedSummary(reader)
+    );
+  }
+  /** {@link stat} of a specific generation, from the object a pin holds. `held` as for {@link getChunkAt}. */
+  async statAt(ref, generation, held) {
+    validateUserRef(ref);
+    const reader = await this.readerAt(ref, generation, held?.version, held?.fingerprint);
+    return reader === null ? null : sizedSummary(reader);
+  }
   /**
    * Run `read` against the pinned snapshot, healing the torn-read window generation GC can open: if the
    * generation we resolved was superseded *and* swept (the grace window elapsed), the Storage driver throws
@@ -5568,8 +5340,8 @@ var CrbmStorageChunkSource = class {
    * caller-visible error, so instead we drop the stale snapshot,
    * re-resolve `currentGen`, and retry once — the read then serves the newer (committed, immutable) generation,
    * a monotonic move forward — within one incarnation of the row. A name that was retired and re-created is a
-   * different segment and can resolve to a LOWER generation, which is why the snapshot carries the row's token
-   * as its lineage rather than trusting the generation number (invariant 1).
+   * different segment and can resolve to a LOWER generation, which is why the snapshot carries the row's
+   * `pointerId` as its lineage rather than trusting the generation number (invariants 1 and 2).
    *
    * **Resolution and open are inside the retry, not before it.** Resolving `currentGen` and opening that
    * generation's object are two backend round trips with a gap between them, so the object can be swept after
@@ -5699,15 +5471,30 @@ async function writeEncodedChunks(driver, key, chunks, options) {
     fingerprint: fingerprintFor(identity.size, identity.footerCrc)
   };
 }
-async function holdsObject(storage, key, fingerprint) {
+async function provenObject(storage, key, fingerprint) {
+  let version;
   try {
-    return await CrbmReader.sameObject(storageBlobReader(storage, key), fingerprint);
+    const blob = storageBlobReader(storage, key, (tail) => {
+      version ??= tail.version;
+    });
+    return await CrbmReader.sameObject(blob, fingerprint) ? { version } : null;
   } catch {
-    return false;
+    return null;
   }
 }
-function objectIsEncrypted(storage, key) {
-  return footerSaysEncrypted(storageBlobReader(storage, key));
+function sameObjectUnder(storage, key, fingerprint) {
+  return CrbmReader.sameObject(storageBlobReader(storage, key), fingerprint);
+}
+function objectIsEncrypted(storage, key, noteVersion) {
+  return footerSaysEncrypted(
+    storageBlobReader(
+      storage,
+      key,
+      noteVersion === void 0 ? void 0 : (tail) => {
+        if (tail.version !== void 0) noteVersion(tail.version);
+      }
+    )
+  );
 }
 function rememberingTail(blob) {
   let first;
@@ -5781,7 +5568,7 @@ function refuseCleartextOntoKey(key, record, cleartext) {
     `segment "${key.segment}" is encrypted, and generation ${key.generation} was written in cleartext: another writer created the segment with a key while this one was writing. Nothing was published. Re-run the write with the keystore that holds the segment's key.`
   );
 }
-var UNANSWERED_RESENDS = 3;
+var UNANSWERED_RESENDS2 = 3;
 var UNANSWERED_RESEND_BASE_MS = 500;
 function leasesPatch(record, options) {
   const held = record.leases;
@@ -5823,7 +5610,8 @@ async function publishGenerationKept(registry, key, options = {}) {
       if (landed)
         return {
           published: true,
-          kept: { ...nextKept(failedOn, key.generation, options.keep), token: void 0 }
+          kept: { ...nextKept(failedOn, key.generation, options.keep), token: void 0 },
+          token: record?.token
         };
       if (record !== null && record.status === "active" && record.currentGen === key.generation) {
         return REFUSED;
@@ -5891,7 +5679,7 @@ async function publishGenerationKept(registry, key, options = {}) {
         return REFUSED;
       } else if (record.currentGen === key.generation) {
         if (reused) continue;
-        return { published: true };
+        return { published: true, token: record.token };
       } else {
         if (options.wrappedDeks !== void 0 && options.wrappedDeks.length > 0) {
           throw new ValidationError(
@@ -5914,7 +5702,8 @@ async function publishGenerationKept(registry, key, options = {}) {
       }
       return {
         published: true,
-        kept: { ...next ?? { list: void 0, evict: [] }, token: wrote }
+        kept: { ...next ?? { list: void 0, evict: [] }, token: wrote },
+        token: wrote
       };
     } catch (err) {
       if (isWriteConflictError(err)) {
@@ -5934,7 +5723,7 @@ async function publishGenerationKept(registry, key, options = {}) {
       }
       if (sameRow(now, record)) {
         const sleep = options.clock?.sleep;
-        if (sleep === void 0 || resends >= UNANSWERED_RESENDS) throw outcomeUnknown(key, err);
+        if (sleep === void 0 || resends >= UNANSWERED_RESENDS2) throw outcomeUnknown(key, err);
         const bound = UNANSWERED_RESEND_BASE_MS * 2 ** resends;
         resends += 1;
         await sleep.call(options.clock, Math.floor((options.rng?.next() ?? 1) * bound));
@@ -5949,11 +5738,10 @@ async function publishGenerationKept(registry, key, options = {}) {
   const final = await registry.get(key);
   if (final !== null && final.currentGen !== null && final.currentGen >= key.generation) {
     if (final.currentGen !== key.generation) return REFUSED;
-    if (!sawUnanswered) return { published: true };
+    if (!sawUnanswered) return { published: true, token: final.token };
     try {
-      return {
-        published: await landedHere(final, lastRecord ?? null, key, options.holdsOwnObject)
-      };
+      const published = await landedHere(final, lastRecord ?? null, key, options.holdsOwnObject);
+      return published ? { published, token: final.token } : REFUSED;
     } catch (proofErr) {
       throw outcomeUnknown(key, proofErr);
     }
@@ -6053,22 +5841,24 @@ async function bulkLoadAhead(driver, ref, ahead, ids, options = {}) {
   const summary = summaryOf(
     key,
     key.generation,
-    { cardinality, metadata: options.metadata },
+    { cardinality, metadata: options.metadata, fingerprint },
     crypto?.aead
   );
   if (options.registry !== void 0 && options.publish !== false) {
-    const becameCurrent = await publishGeneration(options.registry, key, {
+    const published = await publishGenerationKept(options.registry, key, {
       wrappedDeks: newWrapped,
       summary,
       cleartext: crypto === void 0,
       holdsOwnObject: () => provesOwnObject(driver, key, fingerprint),
       clock: options.clock
     });
+    const becameCurrent = published.published;
     if (becameCurrent) {
       safeAudit(options.audit ?? NOOP_AUDIT).onEvent({
         kind: "segment.publish",
         namespace: key.namespace,
         segment: key.segment,
+        ...incarnationField(published.token),
         generation: key.generation
       });
     }
@@ -6181,15 +5971,72 @@ async function bucketIds(ids, codec, clock) {
   await flushPending();
   return [...byChunk].map(([chunkKey, bitmap]) => ({ chunkKey, bitmap })).sort((a, b) => a.chunkKey - b.chunkKey);
 }
-function openGenerationReader(storage, key, crypto, options = {}) {
-  return openChecked(storage, key, { ...options, crypto });
+var openedVersions = /* @__PURE__ */ new WeakMap();
+function openGenerationReader(storage, key, crypto, options = {}, named) {
+  return openNoting(storage, key, crypto, options, named);
+}
+function openGenerationReaderNoting(storage, key, crypto, noteVersion) {
+  return openNoting(storage, key, crypto, {}, void 0, noteVersion);
 }
-async function openChecked(storage, key, options, keepChunkBytesUpTo) {
-  const reader = await openCrbmReaderKeeping(
-    storageBlobReader(storage, key),
-    options,
-    keepChunkBytesUpTo
+async function openNoting(storage, key, crypto, options, named, noteVersion) {
+  let version;
+  const reader = await openChecked(
+    storage,
+    key,
+    { ...options, crypto },
+    void 0,
+    named,
+    (tail) => {
+      if (version !== void 0 || tail.version === void 0) return;
+      version = tail.version;
+      noteVersion?.(version);
+    }
   );
+  if (version !== void 0) openedVersions.set(reader, version);
+  return reader;
+}
+function objectVersionOf(reader) {
+  return openedVersions.get(reader);
+}
+async function openNamedGeneration(storage, key, crypto, fingerprint) {
+  return openHeldTo(storage, key, { crypto }, void 0, fingerprint);
+}
+async function openChecked(storage, key, options, keepChunkBytesUpTo, named, noteTail) {
+  const reader = await openHeldTo(storage, key, options, keepChunkBytesUpTo, named, noteTail);
+  if (reader === void 0) {
+    throw new NotFoundError(
+      `segment "${key.segment}" generation ${key.generation} is another object than its registry row names`
+    );
+  }
+  return reader;
+}
+async function openHeldTo(storage, key, options, keepChunkBytesUpTo, named, noteTail) {
+  const raw = storageBlobReader(storage, key, noteTail);
+  let reader;
+  if (named === void 0) {
+    reader = await openCrbmReaderKeeping(raw, options, keepChunkBytesUpTo);
+  } else {
+    let tail = await raw.getTail(
+      Math.max(options.tailBytes ?? DEFAULT_TAIL_BYTES, FOOTER_BYTES)
+    );
+    const blob = {
+      getRange: (offset, length) => raw.getRange(offset, length),
+      getTail: async (maxBytes) => {
+        const held = tail;
+        if (held !== void 0 && (maxBytes <= held.bytes.length || held.bytes.length === held.size)) {
+          const take = Math.min(maxBytes, held.bytes.length);
+          return { bytes: held.bytes.subarray(held.bytes.length - take), size: held.size };
+        }
+        return raw.getTail(maxBytes);
+      }
+    };
+    try {
+      if (!await CrbmReader.sameObject(blob, named)) return void 0;
+      reader = await openCrbmReaderKeeping(blob, options, keepChunkBytesUpTo);
+    } finally {
+      tail = void 0;
+    }
+  }
   if (reader.generation !== key.generation) {
     throw new IntegrityError(
       `segment "${key.segment}" generation ${key.generation}: its footer says generation ${reader.generation}`
@@ -6231,10 +6078,6 @@ var PinnedStorageChunkSource = class {
   }
   inner;
   pins;
-  /** The unpinned segments refresh as the store's own source does; a pinned one never does. */
-  get pointerRefreshMs() {
-    return this.inner.pointerRefreshMs;
-  }
   /**
    * The pin for this segment, or `undefined` if it is not pinned here.
    *
@@ -6259,76 +6102,250 @@ var PinnedStorageChunkSource = class {
     if (pin === void 0) return this.inner.getChunks(ref, keys, options);
     return this.pinnedChunks(ref, pin, keys, options);
   }
-  async *pinnedChunks(ref, pin, keys, options) {
-    if (pin.generation === null) {
-      for (const key of keys) yield { key, bytes: null, version: null };
-      return;
+  async *pinnedChunks(ref, pin, keys, options) {
+    if (pin.generation === null) {
+      for (const key of keys) yield { key, bytes: null, version: null };
+      return;
+    }
+    const version = await this.currentVersion(ref);
+    const pull = new ItemPull(
+      this.inner.getChunksAt(ref, pin.generation, keys, heldBy(pin), options)
+    );
+    try {
+      while (await pull.advance()) yield pull.take((chunk) => ({ ...chunk, version }));
+    } finally {
+      await pull.close();
+    }
+  }
+  listChunkKeys(ref) {
+    const pin = this.pinFor(ref);
+    if (pin === void 0) return this.inner.listChunkKeys(ref);
+    return pin.generation === null ? Promise.resolve([]) : this.inner.listChunkKeysAt(ref, pin.generation, heldBy(pin));
+  }
+  sizeOf(ref) {
+    const pin = this.pinFor(ref);
+    if (pin === void 0) return this.inner.sizeOf(ref);
+    return pin.generation === null ? Promise.resolve(null) : this.inner.sizeOfAt(ref, pin.generation, heldBy(pin));
+  }
+  cardinalities(ref) {
+    const pin = this.pinFor(ref);
+    if (pin === void 0) return this.inner.cardinalities(ref);
+    return pin.generation === null ? Promise.resolve(null) : this.inner.cardinalitiesAt(ref, pin.generation, heldBy(pin));
+  }
+  summary(ref) {
+    const pin = this.pinFor(ref);
+    if (pin === void 0) return this.inner.summary(ref);
+    return pin.generation === null ? Promise.resolve(null) : this.inner.summaryAt(ref, pin.generation, heldBy(pin));
+  }
+  stat(ref) {
+    const pin = this.pinFor(ref);
+    if (pin === void 0) return this.inner.stat(ref);
+    return pin.generation === null ? Promise.resolve(null) : this.inner.statAt(ref, pin.generation, heldBy(pin));
+  }
+  currentGeneration(ref) {
+    const pin = this.pinFor(ref);
+    return pin === void 0 ? this.inner.currentGeneration(ref) : Promise.resolve(pin.generation);
+  }
+  /**
+   * A pinned segment reports the version captured when it was pinned, marked as a pin's, so its decoded chunks
+   * are cached under keys that no live read writes. A live read keys its fetches by the version it resolved when
+   * it began, but is served whatever generation the live source holds when each fetch lands — after a publish
+   * and a lapsed `cache.genTtlMs`, a reader-cache eviction on a store with no timed refresh, the resolution
+   * cache letting the segment's resolution go on a store with one, a sweep that heals the read forward, or an
+   * invalidation, a different one — so an entry under a live version can hold another generation's chunk.
+   * Invariant 3 lets that live call see it, and later live reads resolve the current version and never look the
+   * entry up; a pin sharing the key would be handed it, and return a read that mixed two generations. A pinned
+   * read fetches exactly its own generation, so the entries it fills are always that generation's.
+   *
+   * The pin still shares the store's chunk cache, and its memory ceiling; what it gives up is a hit on a chunk a
+   * live read of the same version cached, which costs a pin one GET per such chunk. Live reads make no call for it,
+   * though a pin's entries share the cache's bound with theirs, so under a small `cache.maxChunks` each can evict
+   * the other. The version, not the bare generation, is still what the key carries: sharing on a generation-only
+   * key was how a pinned read could resurrect an id that `eraseIdFromSegment` had reported physically gone.
+   */
+  currentVersion(ref) {
+    const pin = this.pinFor(ref);
+    if (pin === void 0) return this.inner.currentVersion(ref);
+    if (pin.version === null) return Promise.resolve(null);
+    return Promise.resolve(
+      `pin ${pin.version}${pin.fingerprint == null ? "" : `#${pin.fingerprint}`}`
+    );
+  }
+  exists(ref) {
+    return this.inner.exists(ref);
+  }
+  invalidate(ref) {
+    this.inner.invalidate(ref);
+  }
+};
+
+// src/core/generation-gc.ts
+async function nextGeneration(ref, deps) {
+  return aboveEverything(ref, deps, await deps.registry.get(ref));
+}
+async function aboveEverything(ref, deps, record) {
+  let highest = record?.currentGen ?? -1;
+  for await (const key of deps.storage.list(ref)) {
+    if (key.generation > highest) highest = key.generation;
+  }
+  return numberAbove(highest);
+}
+function numberAbove(highest) {
+  if (highest >= Number.MAX_SAFE_INTEGER) {
+    throw new IntegrityError("the segment has no generation number left above its highest");
+  }
+  return highest + 1;
+}
+async function nextLoadGeneration(ref, deps, row) {
+  const generation = numberAbove(row?.currentGen ?? -1);
+  try {
+    await deps.storage.getTail({ namespace: ref.namespace, segment: ref.segment, generation }, 0);
+  } catch (err) {
+    if (isNotFoundError(err)) return { generation, checked: true };
+  }
+  return { generation: await aboveEverything(ref, deps, row), checked: false };
+}
+var LIST_COLLECTION_CADENCE = 16;
+async function gcOrphanGenerations(ref, deps, options = {}) {
+  return (await listingPass(ref, deps, { keep: options.keep })).deleted;
+}
+async function listingPass(ref, deps, options) {
+  const keep = options.keep ?? 1;
+  const quiet = options.quiet === true;
+  if (!Number.isInteger(keep) || keep < 0) {
+    throw new ValidationError(`keep must be a non-negative integer; got ${String(keep)}`);
+  }
+  const record = await deps.registry.get(ref);
+  if (record === null) return { deleted: [], kept: [], complete: true };
+  const current = record.currentGen;
+  const seen = /* @__PURE__ */ new Set();
+  for await (const key of deps.storage.list(ref)) seen.add(key.generation);
+  const gens = [...seen];
+  const after = await deps.registry.get(ref);
+  if (after === null) {
+    if (quiet) return { deleted: [], kept: [], complete: false };
+    throw new WriteConflictError(`registry row for segment ${ref.segment} was purged mid-pass`);
+  }
+  if (record.status === "destroyed" && after.token !== record.token) {
+    if (quiet) return { deleted: [], kept: [], complete: false };
+    throw new WriteConflictError(
+      `segment ${ref.segment} changed incarnation while its generations were being listed`
+    );
+  }
+  const cutoff = current === null || after.currentGen === null ? null : Math.min(current, after.currentGen);
+  const named = record.status === "destroyed" ? void 0 : usableKeptGens(after);
+  const protect = options.protect === void 0 || named === void 0 ? void 0 : /* @__PURE__ */ new Set([...options.protect, ...named]);
+  const stillCollectable = async (generation) => {
+    const still = await deps.registry.get(ref);
+    if (still === null) {
+      if (quiet) return "stop";
+      throw new WriteConflictError(`registry row for segment ${ref.segment} was purged mid-pass`);
+    }
+    const ok = record.status === "destroyed" ? still.token === after.token : cutoff === null || still.currentGen !== null && still.currentGen >= cutoff;
+    const now = protect === void 0 ? void 0 : usableKeptGens(still);
+    const unnamed = protect === void 0 || record.status === "destroyed" || now !== void 0 && !now.includes(generation);
+    if (!ok || !unnamed) {
+      if (quiet) return "stop";
+      throw new WriteConflictError(
+        `segment ${ref.segment} changed incarnation while its generations were being collected`
+      );
+    }
+    if (guard !== void 0 && heldGenerations(still, guard.now()).has(generation)) return "skip";
+    return "delete";
+  };
+  const guard = record.status === "destroyed" ? void 0 : options.leases;
+  const held = guard === void 0 ? void 0 : heldGenerations(after, guard.now());
+  const below = record.status === "destroyed" || cutoff === null ? [] : gens.filter((g) => g < cutoff).sort((a, b) => b - a);
+  const candidates = record.status === "destroyed" ? gens.sort((a, b) => a - b) : cutoff === null ? (
+    // No Storage pointer yet, so "below current" selects nothing and there is nothing safe to infer: an object
+    // here is either a load about to publish or an orphan we cannot tell apart from it. Deleting would race
+    // that publish into a dangling pointer. It is collected once a pointer exists.
+    []
+  ) : protect !== void 0 ? (
+    // The row's list is the window: everything below the pointer it does not name is garbage.
+    below.filter((g) => !protect.has(g))
+  ) : (
+    // Delete generations below the cutoff, except the newest `keep` of them (the grace window).
+    below.slice(keep)
+  );
+  const leasedSpared = new Set(candidates.filter((g) => held?.has(g) === true));
+  const toDelete = candidates.filter((g) => !leasedSpared.has(g));
+  const done = [];
+  for (const generation of toDelete) {
+    const verdict = await stillCollectable(generation);
+    if (verdict === "stop") return { deleted: done, kept: [], complete: false };
+    if (verdict === "skip") {
+      leasedSpared.add(generation);
+      continue;
+    }
+    await deps.storage.delete({ namespace: ref.namespace, segment: ref.segment, generation });
+    done.push(generation);
+  }
+  const deleted = new Set(done);
+  return {
+    deleted: done,
+    kept: below.filter((g) => !deleted.has(g) && !leasedSpared.has(g)).reverse(),
+    complete: true
+  };
+}
+async function collectAfterLoad(ref, deps, options) {
+  const { generation, keep, byName, currentGone, kept, proveCurrent, leases } = options;
+  if (keep >= generation) return [];
+  const list = kept?.list;
+  if (list === void 0 || currentGone === true)
+    return reconcile(ref, deps, { keep, kept, leases });
+  const periodic = generation % LIST_COLLECTION_CADENCE === 0;
+  if (byName && !periodic) {
+    if (keep >= 1 && proveCurrent !== void 0 && !await objectIsThere(deps.storage, proveCurrent)) {
+      return reconcile(ref, deps, { keep, kept, leases });
     }
-    const version = await this.currentVersion(ref);
-    const pull = new ItemPull(
-      this.inner.getChunksAt(ref, pin.generation, keys, heldBy(pin), options)
-    );
+    return deleteEvicted(ref, deps, { generation, evict: kept.evict, leases });
+  }
+  return (await listingPass(ref, deps, { keep, protect: list, quiet: true, leases })).deleted;
+}
+async function reconcile(ref, deps, options) {
+  const { keep, kept, leases } = options;
+  const {
+    deleted,
+    kept: present,
+    complete
+  } = await listingPass(ref, deps, { keep, quiet: true, leases });
+  const token = kept?.token;
+  if (complete && token !== void 0 && keep <= MAX_KEPT_GENERATIONS && !sameList(kept?.list, present)) {
     try {
-      while (await pull.advance()) yield pull.take((chunk) => ({ ...chunk, version }));
-    } finally {
-      await pull.close();
+      await deps.registry.compareAndSwap(ref, token, { keptGens: present });
+    } catch (err) {
+      if (!isWriteConflictError(err)) throw err;
     }
   }
-  listChunkKeys(ref) {
-    const pin = this.pinFor(ref);
-    if (pin === void 0) return this.inner.listChunkKeys(ref);
-    return pin.generation === null ? Promise.resolve([]) : this.inner.listChunkKeysAt(ref, pin.generation, heldBy(pin));
-  }
-  sizeOf(ref) {
-    const pin = this.pinFor(ref);
-    if (pin === void 0) return this.inner.sizeOf(ref);
-    return pin.generation === null ? Promise.resolve(null) : this.inner.sizeOfAt(ref, pin.generation, heldBy(pin));
-  }
-  cardinalities(ref) {
-    const pin = this.pinFor(ref);
-    if (pin === void 0) return this.inner.cardinalities(ref);
-    return pin.generation === null ? Promise.resolve(null) : this.inner.cardinalitiesAt(ref, pin.generation, heldBy(pin));
-  }
-  summary(ref) {
-    const pin = this.pinFor(ref);
-    if (pin === void 0) return this.inner.summary(ref);
-    return pin.generation === null ? Promise.resolve(null) : this.inner.summaryAt(ref, pin.generation, heldBy(pin));
-  }
-  currentGeneration(ref) {
-    const pin = this.pinFor(ref);
-    return pin === void 0 ? this.inner.currentGeneration(ref) : Promise.resolve(pin.generation);
-  }
-  /**
-   * A pinned segment reports the version captured when it was pinned, marked as a pin's, so its decoded chunks
-   * are cached under keys that no live read writes. A live read keys its fetches by the version it resolved when
-   * it began, but is served whatever generation the live source holds when each fetch lands — after a publish
-   * and a lapsed `cache.genTtlMs`, a reader-cache eviction, a sweep that heals the read forward, or an
-   * invalidation, a different one — so an entry under a live version can hold another generation's chunk.
-   * Invariant 3 lets that live call see it, and later live reads resolve the current version and never look the
-   * entry up; a pin sharing the key would be handed it, and return a read that mixed two generations. A pinned
-   * read fetches exactly its own generation, so the entries it fills are always that generation's.
-   *
-   * The pin still shares the store's chunk cache, and its memory ceiling; what it gives up is a hit on a chunk a
-   * live read of the same version cached, which costs a pin one GET per such chunk. Live reads make no call for it,
-   * though a pin's entries share the cache's bound with theirs, so under a small `cache.maxChunks` each can evict
-   * the other. The version, not the bare generation, is still what the key carries: sharing on a generation-only
-   * key was how a pinned read could resurrect an id that `eraseIdFromSegment` had reported physically gone.
-   */
-  currentVersion(ref) {
-    const pin = this.pinFor(ref);
-    if (pin === void 0) return this.inner.currentVersion(ref);
-    if (pin.version === null) return Promise.resolve(null);
-    return Promise.resolve(
-      `pin ${pin.version}${pin.fingerprint == null ? "" : `#${pin.fingerprint}`}`
-    );
-  }
-  exists(ref) {
-    return this.inner.exists(ref);
+  return deleted;
+}
+function sameList(a, b) {
+  return a !== void 0 && a.length === b.length && a.every((g, i) => g === b[i]);
+}
+async function objectIsThere(storage, key) {
+  try {
+    await storage.getTail(key, 0);
+    return true;
+  } catch {
+    return false;
   }
-  invalidate(ref) {
-    this.inner.invalidate(ref);
+}
+async function deleteEvicted(ref, deps, options) {
+  const deleted = [];
+  for (const generation of options.evict) {
+    const still = await deps.registry.get(ref);
+    if (still === null || still.currentGen === null || still.currentGen < options.generation) break;
+    const named = usableKeptGens(still);
+    if (named === void 0 || generation >= still.currentGen || named.includes(generation)) break;
+    if (options.leases !== void 0 && heldGenerations(still, options.leases.now()).has(generation)) {
+      continue;
+    }
+    await deps.storage.delete({ namespace: ref.namespace, segment: ref.segment, generation });
+    deleted.push(generation);
   }
-};
+  return deleted;
+}
 
 // src/core/retry.ts
 var DEFAULT_RETRY_POLICY = {
@@ -6402,10 +6419,10 @@ async function withRetry(op, policy, deps) {
 // src/core/load.ts
 function checkedGuard(guard, where) {
   if (guard === void 0 || guard === null) return void 0;
-  const shown2 = (v) => typeof v === "number" ? String(v) : Array.isArray(v) ? "an array" : `a ${typeof v}`;
+  const shown = (v) => typeof v === "number" ? String(v) : Array.isArray(v) ? "an array" : `a ${typeof v}`;
   if (typeof guard !== "object" || Array.isArray(guard)) {
     throw new ValidationError(
-      `${where}guard must be an object of bounds, such as { minRetained: 0.5 }; got ${shown2(guard)}`
+      `${where}guard must be an object of bounds, such as { minRetained: 0.5 }; got ${shown(guard)}`
     );
   }
   const bounds = guard;
@@ -6420,17 +6437,17 @@ function checkedGuard(guard, where) {
   const { minCardinality, minRetained, maxGrowth } = guard;
   if (minCardinality !== void 0 && (!Number.isInteger(minCardinality) || minCardinality < 0)) {
     throw new ValidationError(
-      `${where}guard.minCardinality must be a non-negative integer; got ${shown2(minCardinality)}`
+      `${where}guard.minCardinality must be a non-negative integer; got ${shown(minCardinality)}`
     );
   }
   if (minRetained !== void 0 && (!Number.isFinite(minRetained) || minRetained < 0 || minRetained > 1)) {
     throw new ValidationError(
-      `${where}guard.minRetained must be a fraction in 0..1; got ${shown2(minRetained)}`
+      `${where}guard.minRetained must be a fraction in 0..1; got ${shown(minRetained)}`
     );
   }
   if (maxGrowth !== void 0 && (!Number.isFinite(maxGrowth) || maxGrowth !== 0 && maxGrowth < 1)) {
     throw new ValidationError(
-      `${where}guard.maxGrowth must be 0 (no bound) or a factor of at least 1; got ${shown2(maxGrowth)}`
+      `${where}guard.maxGrowth must be 0 (no bound) or a factor of at least 1; got ${shown(maxGrowth)}`
     );
   }
   return Object.freeze({
@@ -6606,6 +6623,7 @@ async function runLoad(ref, prepare, deps, options) {
       kind: "segment.load-refused",
       segment: ref.segment,
       namespace: ref.namespace,
+      ...incarnationField(fromToken),
       generation: generation2,
       reason: "superseded",
       cardinality: 0
@@ -6631,9 +6649,9 @@ async function runLoad(ref, prepare, deps, options) {
       return;
     }
     const keyed = now !== null && now.wrappedDeks !== void 0 && now.wrappedDeks.length > 0;
-    if ((now === null || keyed && !written.encrypted) && await holdsObject(deps.storage, key, written.fingerprint)) {
-      await deps.storage.delete(key);
-    }
+    if (now !== null && !(keyed && !written.encrypted)) return;
+    const own = await provenObject(deps.storage, key, written.fingerprint);
+    if (own !== null) await deps.storage.delete(key, { ifVersion: own.version });
   };
   let unanswered = false;
   const tidy = () => reclaim().catch(() => void 0);
@@ -6643,6 +6661,7 @@ async function runLoad(ref, prepare, deps, options) {
       kind: "segment.load-refused",
       segment: ref.segment,
       namespace: ref.namespace,
+      ...incarnationField(fromToken),
       generation,
       reason,
       cardinality: written.cardinality,
@@ -6674,14 +6693,14 @@ async function runLoad(ref, prepare, deps, options) {
       cleartext: !written.encrypted,
       ...fromToken === void 0 ? {} : { expectToken: fromToken, expectRow: row },
       ...needsBefore && fromGeneration !== void 0 ? { expectFrom: fromGeneration } : {},
-      // The third case, and the one the two fences above structurally cannot cover: the guard judged a segment
-      // that had NO ROW. Both `expectFrom` and `expectToken` compare against a value read from a row, so with no
-      // row both are omitted and the publish becomes a bare forward-only advance — which lands over anything
-      // that appeared in between. `before` was `null`, so the empty, `minRetained` and `maxGrowth` bounds had nothing
-      // to judge and passed vacuously. Verified: an empty generation published over a thousand ids that a
-      // concurrent writer had created meanwhile, reporting success. A guarded write therefore has to fence on
-      // the ABSENCE it relied on, exactly as it fences on the pointer it relied on.
-      ...needsBefore && row === null ? { expectAbsent: true } : {},
+      // A load that found NO ROW fences on that absence, guarded or not, so a row that appeared since refuses it.
+      // `expectFrom` and `expectToken` both compare against a value read from a row, so with no row both are omitted,
+      // and the publish would otherwise be a bare forward-only advance over whatever appeared in between. For a guarded
+      // load, `before` was `null` and its bounds passed vacuously, so an empty generation would land over the ids
+      // another writer had just loaded. For an unguarded one, the pointer would move over another first load's
+      // generation or onto a row `setRetention` made, and, where an erasure had already deleted this load's object
+      // above that row's pointer, onto an object that is gone, so that every read of the segment would fail.
+      ...row === null ? { expectAbsent: true } : {},
       // A registry write that fails without an answer is reconciled by reading the row: the pointer at this number
       // is this load's publish only over the object this load wrote, which one footer read proves.
       holdsOwnObject: () => provesOwnObject(deps.storage, key, written.fingerprint),
@@ -6701,6 +6720,7 @@ async function runLoad(ref, prepare, deps, options) {
     kind: "segment.publish",
     segment: ref.segment,
     namespace: ref.namespace,
+    ...incarnationField(published.token),
     generation
   });
   const currentObjectGone = needsBefore && before === null;
@@ -8669,7 +8689,7 @@ function pinnedStillCurrent(spec, now) {
 }
 function liveMoved(op) {
   if (op.endRow === void 0 || !op.read) return void 0;
-  const was = tokenOfVersion(op.startVersion);
+  const was = op.startVersion == null ? void 0 : tokenOfVersion(rowVersionOf(op.startVersion));
   if (was !== void 0 && op.endRow !== null && !sameRow2(was, op.endRow.token)) return true;
   return op.startGeneration === void 0 ? void 0 : op.endGeneration !== op.startGeneration;
 }
@@ -8870,7 +8890,11 @@ async function rollbackSegment(ref, toGeneration, deps, options = {}) {
   const summary = reader === void 0 ? void 0 : summaryOf(
     ref,
     toGeneration,
-    { cardinality: reader.count(), metadata: reader.metadata },
+    {
+      cardinality: reader.count(),
+      metadata: reader.metadata,
+      fingerprint: reader.fingerprint
+    },
     aead
   );
   const churn = leaseChurn(deps);
@@ -8925,7 +8949,7 @@ async function rollbackSegment(ref, toGeneration, deps, options = {}) {
         break;
       } catch (err) {
         if (!isWriteConflictError(err)) break;
-        const moved = ["currentGen", "summary", "keptGens"];
+        const moved = ["currentGen", "summary", "keptGens", "pointerId"];
         let now;
         try {
           const seen = await deps.registry.get(ref);
@@ -8935,7 +8959,7 @@ async function rollbackSegment(ref, toGeneration, deps, options = {}) {
         } catch {
           break;
         }
-        if (now === null || now.currentGen !== toGeneration || !onlyLeasesDiffer(record, now, moved))
+        if (now === null || now.currentGen !== toGeneration || now.pointerId !== token || !onlyLeasesDiffer(record, now, moved))
           break;
         undoAgainst = now.token;
       }
@@ -8948,6 +8972,7 @@ async function rollbackSegment(ref, toGeneration, deps, options = {}) {
     kind: "segment.rollback",
     segment: ref.segment,
     namespace: ref.namespace,
+    ...incarnationField(record.token),
     fromGeneration: record.currentGen,
     generation: toGeneration
   });
@@ -8966,12 +8991,27 @@ async function eraseIdFromSegment(ref, id, deps, options = {}) {
   const first = {};
   const result = await eraseOnce(ref, id, deps, options, first);
   if (result.reason === "destroyed" && first.tombstoned === false) {
-    const again = await eraseOnce(ref, id, deps, options, {});
+    const second = {};
+    const again = await eraseOnce(ref, id, deps, options, second);
     if (again.reason === "destroyed") return result;
     if (!again.erased) return again;
     const collected = [.../* @__PURE__ */ new Set([...result.collected, ...again.collected])].sort((a, b) => a - b);
     const newest = Math.max(result.fromGeneration ?? -1, again.fromGeneration ?? -1);
-    return { ...again, collected, ...newest >= 0 ? { fromGeneration: newest } : {} };
+    const merged = { ...again, collected, ...newest >= 0 ? { fromGeneration: newest } : {} };
+    return recordCollect(ref, merged, second, options);
+  }
+  return recordCollect(ref, result, first, options);
+}
+function recordCollect(ref, result, pass, options) {
+  if (pass.collectedOn !== void 0) {
+    safeAudit(options.audit ?? NOOP_AUDIT).onEvent({
+      kind: "segment.collect",
+      namespace: ref.namespace,
+      segment: ref.segment,
+      ...incarnationField(pass.collectedOn),
+      ...pass.found === true && result.fromGeneration !== void 0 ? { fromGeneration: result.fromGeneration } : {},
+      collected: [...result.collected]
+    });
   }
   return result;
 }
@@ -8982,6 +9022,7 @@ async function eraseOnce(ref, id, deps, options, seen) {
   const codec = requireCodec(deps.codec, "eraseIdFromSegment");
   const maxBytes = deps.maxBitmapBytes ?? DEFAULT_MAX_BITMAP_BYTES;
   const base = { segment: ref.segment, namespace: ref.namespace };
+  const audit = safeAudit(options.audit ?? NOOP_AUDIT);
   const read = (op) => retryRead(op, deps.readRetry);
   const record = await deps.registry.get(ref);
   if (record === null) return { ...base, erased: false, reason: "absent", collected: [] };
@@ -9017,30 +9058,62 @@ async function eraseOnce(ref, id, deps, options, seen) {
   const rowVerdict = (row) => {
     if (row === null) return "absent";
     if (row.status === "destroyed") return "destroyed";
+    const same = row.token === premiseToken || onlyLeasesDiffer(premise, row);
+    if (pointerless) return row.currentGen === null && same ? null : "superseded";
     if (row.currentGen === null) return "no-generation";
-    return row.currentGen === from && (row.token === premiseToken || onlyLeasesDiffer(premise, row)) ? null : "superseded";
+    return row.currentGen === from && same ? null : "superseded";
   };
-  const sealedUnpublished = /* @__PURE__ */ new Set();
+  const sealed = /* @__PURE__ */ new Set();
+  const versions = /* @__PURE__ */ new Map();
   const holds = async (generation2) => {
     const key2 = { ...base, generation: generation2 };
-    const chunkIn = (crypto) => read(async () => (await openGenerationReader(deps.storage, key2, crypto)).getChunk(chunkKey));
+    const crypto = cryptoAt(generation2);
     try {
-      let bytes;
+      let reader;
+      const index = { refused: false };
+      let opened;
       try {
-        bytes = await chunkIn(cryptoAt(generation2));
+        reader = await read(
+          () => openGenerationReaderNoting(
+            deps.storage,
+            key2,
+            crypto === void 0 ? void 0 : noticingIndex(crypto, index),
+            (version) => opened = version
+          )
+        );
       } catch (err) {
-        if (cryptoAt(generation2) === void 0) {
-          if ((tombstoned || pointerless) && await read(() => objectIsEncrypted(deps.storage, key2))) {
+        if (crypto === void 0) {
+          let footer;
+          const encrypted = !isTransientError(err) && await read(
+            () => objectIsEncrypted(deps.storage, key2, (version) => footer = version)
+          );
+          if (encrypted) {
             if (tombstoned) return false;
-            sealedUnpublished.add(generation2);
+            sealed.add(generation2);
+            versions.set(generation2, footer);
             return true;
           }
           throw err;
         }
+        if (isIntegrityError(err) && index.refused) {
+          sealed.add(generation2);
+          versions.set(generation2, opened);
+          return true;
+        }
         if (!isIntegrityError(err) || await read(() => objectIsEncrypted(deps.storage, key2))) {
           throw err;
         }
-        bytes = await chunkIn(void 0);
+        reader = await read(() => openGenerationReader(deps.storage, key2, void 0));
+      }
+      versions.set(generation2, objectVersionOf(reader));
+      let bytes;
+      try {
+        bytes = await read(() => reader.getChunk(chunkKey));
+      } catch (err) {
+        if (!isTransientError(err) && !await read(() => sameObjectUnder(deps.storage, key2, reader.fingerprint))) {
+          return null;
+        }
+        throw err;
       }
       return bytes !== null && codec.safeDeserialize(bytes, maxBytes).has(remainder);
     } catch (err) {
@@ -9048,6 +9121,7 @@ async function eraseOnce(ref, id, deps, options, seen) {
       throw err;
     }
   };
+  const found = (generation2, held) => held === true && !sealed.has(generation2);
   const holdsEach = async (generations, stopAtHolder) => {
     let firstHolder = Infinity;
     const settled2 = await mapWithConcurrency(
@@ -9059,7 +9133,7 @@ async function eraseOnce(ref, id, deps, options, seen) {
         }
         try {
           const held = await holds(generation2);
-          if (held === true && index < firstHolder) firstHolder = index;
+          if (found(generation2, held) && index < firstHolder) firstHolder = index;
           return { generation: generation2, held, fault: void 0 };
         } catch (fault) {
           return { generation: generation2, held: null, fault: { error: fault } };
@@ -9070,7 +9144,7 @@ async function eraseOnce(ref, id, deps, options, seen) {
     for (const { generation: generation2, held, fault } of settled2) {
       if (fault !== void 0) throw fault.error;
       outcomes.push({ generation: generation2, held });
-      if (stopAtHolder && held === true) break;
+      if (stopAtHolder && found(generation2, held)) break;
     }
     return outcomes;
   };
@@ -9081,41 +9155,119 @@ async function eraseOnce(ref, id, deps, options, seen) {
     return (await holdsEach(toRead, true)).find((outcome) => outcome.held === true)?.generation;
   };
   const cannotRemove = (generation2) => new WriteConflictError(
-    `erasure of segment ${ref.segment} could not remove generation ${generation2}, which still holds the id and is still in the bucket; re-run`
+    `erasure of segment ${ref.segment} could not remove generation ${generation2}, which ${sealed.has(generation2) ? "cannot be searched, so may hold the id," : "still holds the id"} and is still in the bucket; re-run`
   );
   const fenceInFlight = async () => {
-    const churn = leaseChurn({ clock: deps.clock, rng: deps.rng ?? deps.readRetry?.rng });
+    const rng = deps.rng ?? deps.readRetry?.rng;
+    const churn = leaseChurn({ clock: deps.clock, rng });
+    let resends = 0;
     let row = await deps.registry.get(ref);
     for (; ; ) {
       const verdict = rowVerdict(row);
       if (verdict !== null) return verdict;
       const current = row;
-      const keptGens = current.keptGens !== void 0 && current.keptGens.length === 0 ? void 0 : [];
+      let failure;
       try {
-        const { token } = await deps.registry.compareAndSwap(ref, current.token, { keptGens });
-        premise = { ...current, keptGens, token };
+        const { token } = await deps.registry.compareAndSwap(
+          ref,
+          current.token,
+          renewPointer(current)
+        );
+        premise = { ...current, token, pointerId: token };
         premiseToken = token;
         return null;
       } catch (err) {
-        if (!isWriteConflictError(err)) throw err;
+        if (!isWriteConflictError(err) && !isTransientError(err)) throw err;
+        failure = err;
+      }
+      const unanswered = isTransientError(failure);
+      let now;
+      try {
+        now = await deps.registry.get(ref);
+      } catch (readErr) {
+        if (!unanswered || isIntegrityError(readErr)) throw readErr;
+        throw failure;
+      }
+      if (now !== null && renewedSince(current, now)) {
+        premise = now;
+        premiseToken = now.token;
+        return null;
+      }
+      if (unanswered && now !== null && now.token === current.token) {
+        const sleep = deps.clock?.sleep;
+        if (sleep === void 0 || resends >= UNANSWERED_RESENDS) throw failure;
+        const bound = UNANSWERED_BASE_MS * 2 ** resends;
+        resends += 1;
+        await sleep.call(deps.clock, Math.floor((rng?.next() ?? 1) * bound));
+        row = now;
+        continue;
       }
-      const now = await deps.registry.get(ref);
       const settled2 = await churn.settle(current, now, () => deps.registry.get(ref));
       if (settled2 === void 0) return rowVerdict(now) ?? "superseded";
       row = settled2.row;
     }
   };
+  const deleteFenced = async (holders) => {
+    const deleted = [];
+    let moved = await fenceInFlight();
+    for (const generation2 of holders) {
+      if (moved !== null) break;
+      moved = rowVerdict(await deps.registry.get(ref));
+      if (moved !== null) break;
+      try {
+        await deps.storage.delete({ ...base, generation: generation2 }, { ifVersion: versions.get(generation2) });
+      } catch (err) {
+        if (!isWriteConflictError(err)) throw err;
+        moved = rowVerdict(await deps.registry.get(ref)) ?? "superseded";
+        break;
+      }
+      deleted.push(generation2);
+    }
+    return { deleted, moved };
+  };
+  const collectedAll = (fromGeneration, collected2) => {
+    seen.collectedOn = record.token;
+    seen.found = true;
+    return {
+      ...base,
+      erased: true,
+      fromGeneration,
+      collected: [...collected2].sort((a, b) => a - b)
+    };
+  };
+  const sealedOnly = (answer, collected2) => {
+    if (collected2.length > 0) seen.collectedOn = record.token;
+    return { ...answer, collected: [...collected2].sort((a, b) => a - b) };
+  };
   const unpublished = async () => {
     const generations = [];
     for await (const key2 of deps.storage.list(ref)) generations.push(key2.generation);
     const newestFirst = generations.sort((a, b) => b - a);
-    const holder = (await holdsEach(newestFirst, true)).find((h) => h.held === true);
-    if (holder === void 0)
-      return { ...base, erased: false, reason: "no-generation", collected: [] };
-    const what = sealedUnpublished.has(holder.generation) ? "is sealed under a key that load has not published, so it cannot be searched" : "holds the id";
-    throw new WriteConflictError(
-      `eraseIdFromSegment: segment "${ref.segment}" has no published generation, and an object a first load wrote and never published (generation ${holder.generation}) ${what}. It cannot be deleted while that load may still publish it: re-run once the segment is loaded, which makes the object collectable, or drop the segment`
-    );
+    const holders = [];
+    const clean = /* @__PURE__ */ new Set();
+    for (const { generation: generation2, held } of await holdsEach(newestFirst, false)) {
+      if (held === true) holders.push(generation2);
+      else if (held === false) clean.add(generation2);
+    }
+    const none = { ...base, erased: false, reason: "no-generation", collected: [] };
+    if (holders.length === 0) return none;
+    const newest = holders.find((generation2) => !sealed.has(generation2));
+    const { deleted, moved } = await deleteFenced(holders);
+    const collected2 = [...deleted].sort((a, b) => a - b);
+    const left2 = await holderLeft(clean);
+    if (left2 === void 0) {
+      return newest === void 0 ? sealedOnly(none, collected2) : collectedAll(newest, collected2);
+    }
+    if (moved !== null) {
+      return {
+        ...base,
+        erased: false,
+        reason: moved,
+        ...newest === void 0 ? {} : { fromGeneration: newest },
+        collected: collected2
+      };
+    }
+    throw cannotRemove(left2);
   };
   const underTombstone = async () => {
     const generations = [];
@@ -9126,7 +9278,7 @@ async function eraseOnce(ref, id, deps, options, seen) {
     const collected2 = await gcOrphanGenerations(ref, deps, { keep: 0 });
     const left2 = await holderLeft(/* @__PURE__ */ new Set());
     if (left2 !== void 0) throw cannotRemove(left2);
-    return { ...base, erased: true, fromGeneration: holder.generation, collected: collected2 };
+    return collectedAll(holder.generation, collected2);
   };
   const notInCurrent = async () => {
     const notMember = {
@@ -9151,38 +9303,47 @@ async function eraseOnce(ref, id, deps, options, seen) {
       if (held === true) holdersAbove.push(generation2);
       else if (held === false) clean.add(generation2);
     }
+    const foundAbove = holdersAbove.find((generation2) => !sealed.has(generation2));
     let holderBelow;
-    if (holdersAbove.length === 0) {
+    const sealedBelow = [];
+    if (foundAbove === void 0) {
       for (const { generation: generation2, held } of await holdsEach(
         newestFirst.filter((g) => g < from),
         true
       )) {
-        if (held === true) holderBelow = generation2;
+        if (found(generation2, held)) holderBelow = generation2;
+        else if (held === true) sealedBelow.push(generation2);
         else if (held === false) clean.add(generation2);
       }
     }
-    const newest = holdersAbove[0] ?? holderBelow;
-    if (newest === void 0) return notMember;
-    const collected2 = [...await gcOrphanGenerations(ref, deps, { keep: 0 })];
-    let moved = holdersAbove.length > 0 ? await fenceInFlight() : null;
-    for (const generation2 of holdersAbove) {
-      if (moved !== null) break;
-      moved = rowVerdict(await deps.registry.get(ref));
-      if (moved !== null) break;
-      await deps.storage.delete({ ...base, generation: generation2 });
-      collected2.push(generation2);
+    const newest = foundAbove ?? holderBelow;
+    const fenced = newest === void 0 ? [...holdersAbove, ...sealedBelow] : holdersAbove;
+    if (newest === void 0 && fenced.length === 0) return notMember;
+    const collected2 = newest === void 0 ? [] : [...await gcOrphanGenerations(ref, deps, { keep: 0 })];
+    let moved = null;
+    if (fenced.length > 0) {
+      const deleted = await deleteFenced(fenced);
+      collected2.push(...deleted.deleted);
+      moved = deleted.moved;
     }
     const left2 = await holderLeft(clean);
-    if (left2 === void 0) return { ...base, erased: true, fromGeneration: newest, collected: collected2 };
+    if (left2 === void 0) {
+      if (newest !== void 0) return collectedAll(newest, collected2);
+      return sealedOnly(notMember, collected2);
+    }
     if (moved !== null) {
-      return { ...base, erased: false, reason: moved, fromGeneration: newest, collected: collected2 };
+      return { ...base, erased: false, reason: moved, fromGeneration: newest ?? from, collected: collected2 };
     }
     throw cannotRemove(left2);
   };
+  let rewrote;
   const stage = async () => {
     let written;
+    const described = usableSummary(ref, record, aead);
     try {
-      const reader = await read(() => openGenerationReader(deps.storage, fromKey, cryptoAt(from)));
+      const reader = await read(
+        () => openGenerationReader(deps.storage, fromKey, cryptoAt(from), {}, described?.fingerprint)
+      );
       const bytes = await read(() => reader.getChunk(chunkKey));
       if (bytes === null) return await notInCurrent();
       const target = codec.safeDeserialize(bytes, maxBytes);
@@ -9192,10 +9353,7 @@ async function eraseOnce(ref, id, deps, options, seen) {
       assertRegistryCanWrite(deps.registry, "eraseIdFromSegment");
       const generation2 = await nextGeneration(ref, deps);
       const key2 = { ...base, generation: generation2 };
-      const metadata = metadataToCarry(
-        reader.metadata,
-        aead === void 0 ? void 0 : usableSummary(ref, record, aead)
-      );
+      const metadata = metadataToCarry(reader.metadata, aead === void 0 ? void 0 : described);
       const tally = await writeCrbmGenerationStream(
         deps.storage,
         key2,
@@ -9203,6 +9361,7 @@ async function eraseOnce(ref, id, deps, options, seen) {
         { crypto: cryptoAt(generation2), clock: deps.clock, metadata }
       );
       written = generation2;
+      rewrote = { generation: generation2, fingerprint: tally.fingerprint };
       const beforeVerify = await deps.registry.get(ref);
       const early = rowVerdict(beforeVerify);
       if (early !== null) return refused(early, written);
@@ -9212,7 +9371,7 @@ async function eraseOnce(ref, id, deps, options, seen) {
       const summary2 = summaryOf(
         ref,
         generation2,
-        { cardinality: tally.cardinality, metadata },
+        { cardinality: tally.cardinality, metadata, fingerprint: tally.fingerprint },
         aead
       );
       return { generation: generation2, key: key2, fingerprint: tally.fingerprint, summary: summary2 };
@@ -9229,22 +9388,31 @@ async function eraseOnce(ref, id, deps, options, seen) {
       throw err;
     }
   };
-  const discardRefused = async (written) => {
+  const discardRefused = async (own) => {
+    const key2 = { ...base, generation: own.generation };
     const row = await deps.registry.get(ref);
     if (row !== null && row.status === "destroyed") {
-      await deps.storage.delete({ ...base, generation: written });
+      await deps.storage.delete(key2);
       return row;
     }
     if (row === null || row.status !== "active" || row.currentGen === null) return row;
-    if (row.currentGen <= from || row.currentGen >= written) return row;
-    await deps.storage.delete({ ...base, generation: written });
+    if (row.currentGen <= from || row.currentGen >= own.generation) return row;
+    const proven = await provenObject(deps.storage, key2, own.fingerprint);
+    if (proven === null) return row;
+    try {
+      await deps.storage.delete(key2, { ifVersion: proven.version });
+    } catch (err) {
+      if (!isWriteConflictError(err)) throw err;
+    }
     return row;
   };
   if (tombstoned) return await underTombstone();
   if (pointerless) return await unpublished();
   const staged = await stage();
   if ("erased" in staged) {
-    if (!staged.erased && staged.generation !== void 0) await discardRefused(staged.generation);
+    if (!staged.erased && staged.generation !== void 0 && rewrote !== void 0) {
+      await discardRefused(rewrote);
+    }
     return staged;
   }
   const { generation, key, fingerprint, summary } = staged;
@@ -9265,7 +9433,7 @@ async function eraseOnce(ref, id, deps, options, seen) {
     rng: deps.rng ?? deps.readRetry?.rng
   });
   if (!published) {
-    const now = await discardRefused(generation);
+    const now = await discardRefused({ generation, fingerprint });
     return {
       ...base,
       erased: false,
@@ -9275,10 +9443,11 @@ async function eraseOnce(ref, id, deps, options, seen) {
       collected: []
     };
   }
-  safeAudit(options.audit ?? NOOP_AUDIT).onEvent({
+  audit.onEvent({
     kind: "segment.rewrite",
     namespace: ref.namespace,
     segment: ref.segment,
+    ...incarnationField(fromToken),
     fromGeneration: from,
     generation
   });
@@ -9287,6 +9456,29 @@ async function eraseOnce(ref, id, deps, options, seen) {
   if (left !== void 0) throw cannotRemove(left);
   return { ...base, erased: true, fromGeneration: from, generation, collected };
 }
+function noticingIndex(crypto, index) {
+  const indexAad = crypto.aadFor("index");
+  return {
+    aadFor: crypto.aadFor,
+    aead: {
+      seal: (plaintext, aad) => crypto.aead.seal(plaintext, aad),
+      open: (sealed, aad) => {
+        try {
+          return crypto.aead.open(sealed, aad);
+        } catch (err) {
+          if (sameBytes(aad, indexAad)) index.refused = true;
+          throw err;
+        }
+      }
+    }
+  };
+}
+function sameBytes(a, b) {
+  return a.length === b.length && a.every((byte, i) => byte === b[i]);
+}
+function renewedSince(held, now) {
+  return now.pointerId !== held.pointerId && onlyLeasesDiffer(held, now, ["pointerId"]);
+}
 var REWRITE_RANGES_AHEAD = 4;
 async function* rewrite(reader, chunkKey, replacement, codec, maxBytes, read) {
   const keys = [...reader.chunkKeys()].sort((a, b) => a - b);
@@ -9605,12 +9797,13 @@ async function destroySegment(ref, deps, options) {
       `destroySegment: confirmSegment must equal the segment name "${ref.segment}" (guard against accidental crypto-shred)`
     );
   }
-  const result = await shredSegment(ref, deps, options.allowCleartext ?? false);
+  const { token, ...result } = await shredSegment(ref, deps, options.allowCleartext ?? false);
   if (result.cryptoShredded) {
     safeAudit(options.audit ?? NOOP_AUDIT).onEvent({
       kind: "segment.erase",
       namespace: ref.namespace,
-      segment: ref.segment
+      segment: ref.segment,
+      ...incarnationField(token)
     });
   }
   return result;
@@ -9641,8 +9834,9 @@ async function eraseNamespace(namespace, deps, options) {
   let segmentsShredded = 0;
   const destroyed = await mapWithConcurrency(refs, ERASE_CONCURRENCY, async (ref) => {
     let result;
+    let token;
     try {
-      result = await shredSegment(ref, deps, options.allowCleartext ?? false);
+      ({ token, ...result } = await shredSegment(ref, deps, options.allowCleartext ?? false));
     } catch (err) {
       result = {
         segment: ref.segment,
@@ -9654,7 +9848,12 @@ async function eraseNamespace(namespace, deps, options) {
     }
     if (result.cryptoShredded) {
       segmentsShredded += 1;
-      audit.onEvent({ kind: "segment.erase", namespace: ref.namespace, segment: ref.segment });
+      audit.onEvent({
+        kind: "segment.erase",
+        namespace: ref.namespace,
+        segment: ref.segment,
+        ...incarnationField(token)
+      });
     }
     return result;
   });
@@ -9703,13 +9902,13 @@ async function dropSegmentFor(ref, deps, options, sweep) {
       };
     }
     try {
-      await deps.registry.create(ref, {
+      const tombstone = await deps.registry.create(ref, {
         // The max listed generation, so the row is consistent with what is on disk if anything reads it before
         // the sweep finishes. It is a tombstone, so no reader resolves through it either way.
         currentGen: orphans[orphans.length - 1],
         status: "destroyed"
       });
-      shred = { ...shred, destroyed: true, reason: void 0 };
+      shred = { ...shred, destroyed: true, reason: void 0, token: tombstone.token };
     } catch (err) {
       if (!isWriteConflictError(err)) throw err;
       shred = await shredSegment(ref, deps, true, "dropSegment");
@@ -9719,7 +9918,8 @@ async function dropSegmentFor(ref, deps, options, sweep) {
     safeAudit(options.audit ?? NOOP_AUDIT).onEvent({
       kind: "segment.erase",
       namespace: ref.namespace,
-      segment: ref.segment
+      segment: ref.segment,
+      ...incarnationField(shred.token)
     });
   }
   const generationsDeleted = [];
@@ -9749,6 +9949,7 @@ async function dropSegmentFor(ref, deps, options, sweep) {
       kind: "segment.dispose",
       namespace: ref.namespace,
       segment: ref.segment,
+      ...incarnationField(shred.token),
       generationsDeleted: generationsDeleted.length
     });
   }
@@ -9786,7 +9987,13 @@ async function shredSegment(ref, deps, allowCleartext, op = "destroySegment", sw
       return { ...base, destroyed: false, cryptoShredded: false, reason: "absent" };
     }
     if (record.status === "destroyed") {
-      return { ...base, destroyed: true, cryptoShredded: false, reason: "already" };
+      return {
+        ...base,
+        destroyed: true,
+        cryptoShredded: false,
+        reason: "already",
+        token: record.token
+      };
     }
     const encrypted = record.wrappedDeks !== void 0 && record.wrappedDeks.length > 0;
     if (!encrypted && !allowCleartext) {
@@ -9794,7 +10001,7 @@ async function shredSegment(ref, deps, allowCleartext, op = "destroySegment", sw
     }
     const unmarked = sweep === void 0 ? withoutSweepMark(record.retention) : null;
     try {
-      await deps.registry.compareAndSwap(ref, record.token, {
+      const tombstone = await deps.registry.compareAndSwap(ref, record.token, {
         status: "destroyed",
         wrappedDeks: void 0,
         // ← the crypto-shred: the only copy of the DEK wrappings is gone
@@ -9808,7 +10015,7 @@ async function shredSegment(ref, deps, allowCleartext, op = "destroySegment", sw
         // one a restored or hand-edited row carried.
         ...sweep !== void 0 ? { retention: sweep.stamp(record.retention) } : unmarked === null ? {} : { retention: unmarked }
       });
-      return { ...base, destroyed: true, cryptoShredded: encrypted };
+      return { ...base, destroyed: true, cryptoShredded: encrypted, token: tombstone.token };
     } catch (err) {
       if (!isWriteConflictError(err)) throw err;
       lost = record;
@@ -10223,17 +10430,7 @@ async function checkSummary(ref, live, deps) {
       throw err;
     }
   }
-  const described = usableSummary(ref, live, aead);
-  if (described === void 0) return { kind: "ok", unchecked: keyed };
-  const reader = await openGenerationReader(
-    deps.storage,
-    { namespace: ref.namespace, segment: ref.segment, generation },
-    aead === void 0 ? void 0 : { aead, aadFor: (scope) => aadFor(ref, generation, scope) }
-  );
-  let cardinality = 0;
-  for (const n of reader.cardinalities().values()) cardinality += n;
-  if (summaryAgrees(described, { cardinality, metadata: reader.metadata })) return { kind: "ok" };
-  return {
+  const mismatch = {
     kind: "issue",
     issue: {
       segment: ref.segment,
@@ -10242,6 +10439,24 @@ async function checkSummary(ref, live, deps) {
       issue: "summary-mismatch"
     }
   };
+  const described = usableSummary(ref, live, aead);
+  if (described === void 0) {
+    const summary = live.summary;
+    const unnamed = !keyed && live.status === "active" && summary !== void 0 && !("sealed" in summary) && summary.generation === generation && fingerprintParts(summary.fingerprint) === void 0;
+    return unnamed ? mismatch : { kind: "ok", unchecked: keyed };
+  }
+  const reader = await openNamedGeneration(
+    deps.storage,
+    { namespace: ref.namespace, segment: ref.segment, generation },
+    aead === void 0 ? void 0 : { aead, aadFor: (scope) => aadFor(ref, generation, scope) },
+    described.fingerprint
+  );
+  let cardinality = 0;
+  for (const n of reader?.cardinalities().values() ?? []) cardinality += n;
+  if (reader !== void 0 && summaryAgrees(described, { cardinality, metadata: reader.metadata })) {
+    return { kind: "ok" };
+  }
+  return mismatch;
 }
 async function runConsistencyCheck(deps, options = {}) {
   if (options.namespace !== void 0) validateUserNamespace(options.namespace);
@@ -10328,17 +10543,11 @@ var RetryingStorageChunkSource = class {
   getChunks;
   cardinalities;
   summary;
+  stat;
   currentGeneration;
   invalidate;
   exists;
   currentVersion;
-  /**
-   * Forwarded, not retried: a property, with no request behind it. Without it the grounded cost report priced a
-   * retrying store's refresh at the default TTL whatever the store was configured with.
-   */
-  get pointerRefreshMs() {
-    return this.inner.pointerRefreshMs;
-  }
   constructor(inner, opts) {
     this.inner = inner;
     const r = toRetry(opts);
@@ -10366,6 +10575,10 @@ var RetryingStorageChunkSource = class {
     if (innerSummary) {
       this.summary = (ref) => withRetry(() => innerSummary.call(inner, ref), this.policy, this.deps);
     }
+    const innerStat = inner.stat;
+    if (innerStat) {
+      this.stat = (ref) => withRetry(() => innerStat.call(inner, ref), this.policy, this.deps);
+    }
     const innerCurrentGeneration = inner.currentGeneration;
     if (innerCurrentGeneration) {
       this.currentGeneration = (ref) => withRetry(() => innerCurrentGeneration.call(inner, ref), this.policy, this.deps);
@@ -10393,7 +10606,6 @@ var RetryingStorageChunkSource = class {
   }
 };
 export {
-  AWS_US_EAST_1_ONDEMAND,
   BoundedLru,
   BudgetExceededError,
   BufferReader,
@@ -10404,7 +10616,6 @@ export {
   CrbmStorageChunkSource,
   DEFAULT_BUDGET,
   DEFAULT_RETRY_POLICY,
-  ELASTICACHE_REDIS_US_EAST_1_ONDEMAND,
   InProcessKeystore,
   IntegrityError,
   KeyUnavailableError,
@@ -10419,7 +10630,6 @@ export {
   NOOP_METRICS,
   NodeAead,
   NotFoundError,
-  ONE_REDIS_HA_CLUSTER,
   PinnedStorageChunkSource,
   RecordingAuditSink,
   RetryingStorageChunkSource,
@@ -10439,10 +10649,8 @@ export {
   dropSegment,
   eraseIdFromSegment,
   eraseNamespace,
-  estimateCost,
   excludingReservedRows,
   getSegmentRetention,
-  groundedReport,
   isBudgetExceededError,
   isCapabilityError,
   isCloudRoaringError,