@cloudbitmaps/core 0.21.0 → 0.22.0

package/dist/index.js

@@ -1,6 +1,7 @@
 import {
   BudgetExceededError,
   CHUNK_COUNT,
+  CONTENTION_NEXT_STEP,
   CapabilityError,
   CloudRoaringError,
   DEFAULT_NAMESPACE,
@@ -47,6 +48,7 @@ import {
   encodeNameForPath,
   encodedNameLength,
   entropyIsAvailable,
+  errorKind,
   fallbackBound,
   fingerprintFor,
   fingerprintParts,
@@ -54,21 +56,15 @@ import {
   heldGenerations,
   incarnationField,
   incarnationOf,
-  isBudgetExceededError,
-  isCapabilityError,
-  isCloudRoaringError,
+  isBadIdError,
   isFullLedger,
   isIntegrityError,
   isKeyUnavailableError,
-  isLeaseExpiredError,
-  isLeaseLimitError,
   isLive,
   isNotFoundError,
   isReservedNamespace,
-  isStaleOperandError,
   isStorageBackend,
   isTransientError,
-  isUnsupportedError,
   isValidationError,
   isWriteConflictError,
   jitteredWait,
@@ -121,7 +117,7 @@ import {
   webCryptoEntropy,
   windowOf,
   withRetry
-} from "./chunk-IGLIZBR7.js";
+} from "./chunk-OSU7W2Y3.js";
 
 // src/core/budget.ts
 var DEFAULT_BUDGET = { maxRequests: 1e6 };
@@ -152,7 +148,8 @@ function resolvePerOpBudget(opt, storeBudget) {
 function checkBudget(budget, projectedRequests, op) {
   if (budget !== null && projectedRequests > budget.maxRequests) {
     throw new BudgetExceededError(
-      `${op} would fan out to ${projectedRequests} units, over the per-op budget of ${budget.maxRequests} \u2014 raise \`budget.maxRequests\`, override it per-op, or set \`budget: false\``
+      `${op} would fan out to ${projectedRequests} units, over the per-op budget of ${budget.maxRequests} \u2014 raise \`budget.maxRequests\`, override it per-op, or set \`budget: false\``,
+      { option: "budget.maxRequests", limit: budget.maxRequests, spent: projectedRequests }
     );
   }
 }
@@ -162,7 +159,9 @@ async function collectWithinBudget(source, budget, op) {
     out.push(item);
     if (budget !== null && out.length > budget.maxRequests) {
       throw new BudgetExceededError(
-        `${op} would fan out to more than ${budget.maxRequests} units, over the per-op budget \u2014 the scan was abandoned at that point rather than completed, so no exact total is available. Raise \`budget.maxRequests\`, override it per-op, or set \`budget: false\``
+        `${op} would fan out to more than ${budget.maxRequests} units, over the per-op budget \u2014 the scan was abandoned at that point rather than completed, so no exact total is available. Raise \`budget.maxRequests\`, override it per-op, or set \`budget: false\``,
+        // The scan stops at the first item past the bound, so `spent` is a lower bound on the true total.
+        { option: "budget.maxRequests", limit: budget.maxRequests, spent: out.length }
       );
     }
   }
@@ -172,8 +171,8 @@ async function collectWithinBudget(source, budget, op) {
 // src/core/absent-operands.ts
 async function refuseAbsent(op, candidates, limit, exists, nameOf) {
   if (candidates.length === 0) return;
-  const found = await boundedAll(candidates, limit, exists);
-  const absent = candidates.filter((_, i) => !found[i]);
+  const found2 = await boundedAll(candidates, limit, exists);
+  const absent = candidates.filter((_, i) => !found2[i]);
   if (absent.length === 0) return;
   const named = absent.map((c) => `"${nameOf(c)}"`).join(", ");
   throw new ValidationError(
@@ -549,8 +548,8 @@ var KeptSegmentKeys = class {
   /** The segment's encoded key. */
   of(ref) {
     let names = this.byNamespace.get(ref.namespace);
-    const found = names?.get(ref.segment);
-    if (found !== void 0) return found;
+    const found2 = names?.get(ref.segment);
+    if (found2 !== void 0) return found2;
     const encoded = this.encode(ref);
     if (this.kept >= this.max) {
       this.byNamespace.clear();
@@ -919,9 +918,9 @@ var SegmentEngine = class _SegmentEngine {
    */
   async stat(seg) {
     if (this.storage.stat) {
-      const found = await this.storage.stat(seg);
-      if (found === null) return { generation: null, cardinality: 0, sizeBytes: null };
-      return found;
+      const found2 = await this.storage.stat(seg);
+      if (found2 === null) return { generation: null, cardinality: 0, sizeBytes: null };
+      return found2;
     }
     if (this.storage.summary) {
       const summary = await this.storage.summary(seg);
@@ -2312,13 +2311,12 @@ function dueBucketsAt(now, lookbackBuckets) {
 // src/core/registry-scan.ts
 var DEFAULT_MAX_SCAN_SEGMENTS = 25e4;
 function validateMaxScanSegments(value, op) {
-  requirePositiveInteger(value, `${op}: maxScanSegments`);
+  requirePositiveInteger(value, `${op}: \`maxScanSegments\``);
 }
 async function drainRegistry(registry, options) {
   const { maxScanSegments, op } = options;
   validateMaxScanSegments(maxScanSegments, op);
-  const raise = options.raise ?? "raise `maxScanSegments`";
-  const advice = options.narrowable === false ? `${raise[0].toUpperCase()}${raise.slice(1)} if the namespace really is that large and the memory is ` : `Narrow it with \`namespace\`, or ${raise} if the fleet really is that large and the memory is `;
+  const advice = options.narrowable === false ? "Raise `maxScanSegments` if the namespace really is that large and the memory is " : "Narrow it with `namespace`, or raise `maxScanSegments` if the fleet really is that large and the memory is ";
   const rows = [];
   for await (const rec of registry.list(options.namespace)) {
     if (options.namespace === void 0 && isReservedRow(rec)) {
@@ -2327,7 +2325,9 @@ async function drainRegistry(registry, options) {
     }
     if (rows.length >= maxScanSegments) {
       throw new BudgetExceededError(
-        `${op} would enumerate more than ${maxScanSegments} segments \u2014 the scan was abandoned there rather than completed. ${advice}available (a record is a few hundred bytes resident).`
+        `${op} would enumerate more than ${maxScanSegments} segments \u2014 the scan was abandoned there rather than completed. ${advice}available (a record is a few hundred bytes resident).`,
+        // The scan stops at the first row past the bound, so `spent` is a lower bound on the true total.
+        { option: "maxScanSegments", limit: maxScanSegments, spent: rows.length + 1 }
       );
     }
     rows.push(rec);
@@ -3415,6 +3415,9 @@ var DEFAULT_MAX_OPEN_INDEX_BYTES = 64 * 1024 * 1024;
 var RESOLUTIONS_PER_OPEN_SEGMENT = 8;
 var RESOLUTION_BYTES_DIVISOR = 16;
 
+// src/core/crbm/integrity.ts
+var crbmIntegrity = (message) => new IntegrityError(`${message}; re-load from source or roll back`);
+
 // src/core/crbm/crc32c.ts
 var TABLES = (() => {
   const POLY = 2197175160;
@@ -3470,7 +3473,7 @@ function* planChunkReads(extents, region) {
   for (const extent of extents) {
     const extentEnd = extent.offset + extent.length;
     if (!(Number.isSafeInteger(extent.offset) && Number.isSafeInteger(extent.length) && extent.length >= 1 && extent.offset >= previousEnd && extentEnd <= region.end)) {
-      throw new IntegrityError(`chunk ${extent.key} is not inside the chunk region, in order`);
+      throw crbmIntegrity(`chunk ${extent.key} is not inside the chunk region, in order`);
     }
     previousEnd = extentEnd;
     if (chunks.length > 0 && extent.offset - end <= MAX_COALESCE_GAP_BYTES && extentEnd - start <= MAX_COALESCED_READ_BYTES) {
@@ -3509,12 +3512,12 @@ function readVarint(bytes, offset) {
   let pos = offset;
   for (let i = 0; i < 5; i++) {
     if (pos >= bytes.length) {
-      throw new IntegrityError("varint truncated past end of buffer");
+      throw crbmIntegrity("varint truncated past end of buffer");
     }
     const byte = bytes[pos];
     pos += 1;
     if (i === 4 && byte > 15) {
-      throw new IntegrityError("varint exceeds u32 range");
+      throw crbmIntegrity("varint exceeds u32 range");
     }
     result = (result | (byte & 127) << shift) >>> 0;
     if ((byte & 128) === 0) {
@@ -3522,7 +3525,7 @@ function readVarint(bytes, offset) {
     }
     shift += 7;
   }
-  throw new IntegrityError("varint exceeds u32 range");
+  throw crbmIntegrity("varint exceeds u32 range");
 }
 
 // src/core/crbm/reader.ts
@@ -3537,22 +3540,22 @@ function magicMatches(bytes, offset) {
 }
 function checkSize(tail, size) {
   if (!Number.isSafeInteger(size) || size < tail.length) {
-    throw new IntegrityError(`.crbm size is not a byte count its tail fits in: ${size}`);
+    throw crbmIntegrity(`.crbm size is not a byte count its tail fits in: ${size}`);
   }
 }
 function checkedFooter(tail, size) {
   checkSize(tail, size);
   if (size < PREAMBLE_BYTES + FOOTER_BYTES || tail.length < FOOTER_BYTES) {
-    throw new IntegrityError(`.crbm too small: ${size}B`);
+    throw crbmIntegrity(`.crbm too small: ${size}B`);
   }
   const footer = tail.subarray(tail.length - FOOTER_BYTES);
   if (!magicMatches(footer, FOOTER.endMagic)) {
-    throw new IntegrityError(".crbm end magic mismatch");
+    throw crbmIntegrity(".crbm end magic mismatch");
   }
   const fview = new DataView(footer.buffer, footer.byteOffset, footer.byteLength);
   const storedFooterCrc = fview.getUint32(FOOTER.footerCrc32c, true);
   if (crc32c(footer.subarray(0, FOOTER_CRC_COVERAGE)) !== storedFooterCrc) {
-    throw new IntegrityError(".crbm footer CRC mismatch");
+    throw crbmIntegrity(".crbm footer CRC mismatch");
   }
   return { footer, fview, storedFooterCrc };
 }
@@ -3570,7 +3573,7 @@ async function footerSaysEncrypted(blob) {
 function readU64(view, offset, field) {
   const big = view.getBigUint64(offset, true);
   if (big > BigInt(Number.MAX_SAFE_INTEGER)) {
-    throw new IntegrityError(`.crbm ${field} ${big} exceeds safe-integer range`);
+    throw crbmIntegrity(`.crbm ${field} ${big} exceeds safe-integer range`);
   }
   return Number(big);
 }
@@ -3678,7 +3681,10 @@ var CrbmReader = class _CrbmReader {
     const { footer, fview, storedFooterCrc } = checkedFooter(tail, size);
     const versionMajor = footer[FOOTER.versionMajor];
     if (versionMajor !== VERSION_MAJOR) {
-      throw new UnsupportedError(`.crbm major version ${versionMajor} not supported`);
+      const next = versionMajor > VERSION_MAJOR ? "upgrade @cloudbitmaps/core" : "no release writes that version, so this library did not write the object";
+      throw new UnsupportedError(
+        `.crbm major version ${versionMajor} not supported; this build reads major version ${VERSION_MAJOR}: ${next}`
+      );
     }
     const flags = fview.getUint32(FOOTER.flags, true);
     const encrypted = (flags & FLAG_ENCRYPTED) !== 0;
@@ -3716,24 +3722,22 @@ var CrbmReader = class _CrbmReader {
     const totalCardinality = readU64(fview, FOOTER.totalCardinality, "total_cardinality");
     const generation = readU64(fview, FOOTER.generation, "generation");
     if (!encrypted && options.crypto !== void 0) {
-      throw new IntegrityError(
+      throw crbmIntegrity(
         `.crbm generation ${generation} is not encrypted, but it was opened with a key: a cleartext object where an encrypted one belongs is forged, corrupt, or a write that never published (a crash, before the segment's key was made); a load's collection, dropSegment or deleting the object removes it`
       );
     }
     const versionMinor = footer[FOOTER.versionMinor];
     const hasExtension = (flags & FLAG_EXTENSION) !== 0;
     if (indexOffset < PAYLOAD_START || indexOffset + indexLength > size - FOOTER_BYTES) {
-      throw new IntegrityError(
-        `.crbm index region [${indexOffset}, +${indexLength}) out of bounds`
-      );
+      throw crbmIntegrity(`.crbm index region [${indexOffset}, +${indexLength}) out of bounds`);
     }
     if (indexLength > maxIndexBytes) {
-      throw new IntegrityError(`.crbm index ${indexLength}B exceeds cap ${maxIndexBytes}B`);
+      throw crbmIntegrity(`.crbm index ${indexLength}B exceeds cap ${maxIndexBytes}B`);
     }
     const tailCoversFrom = size - tail.length;
     if (tailCoversFrom === 0) {
       if (!magicMatches(tail, 0) || tail[4] !== versionMajor || tail[5] !== versionMinor) {
-        throw new IntegrityError(".crbm preamble magic/version mismatch with footer");
+        throw crbmIntegrity(".crbm preamble magic/version mismatch with footer");
       }
     }
     const lowest = hasExtension ? Math.max(PAYLOAD_START, indexOffset - EXT_TRAILER_BYTES - MAX_EXT_BYTES) : indexOffset;
@@ -3754,7 +3758,7 @@ var CrbmReader = class _CrbmReader {
       indexOffset - regionStart + indexLength
     );
     if (crc32c(indexBytes) !== indexCrc) {
-      throw new IntegrityError(".crbm index CRC mismatch");
+      throw crbmIntegrity(".crbm index CRC mismatch");
     }
     const indexForParse = encrypted ? options.crypto.aead.open(
       {
@@ -3770,7 +3774,7 @@ var CrbmReader = class _CrbmReader {
     if (hasExtension) {
       const trailerStart = indexOffset - EXT_TRAILER_BYTES;
       if (trailerStart < PAYLOAD_START) {
-        throw new IntegrityError(".crbm flags an extension block, but has no room for one");
+        throw crbmIntegrity(".crbm flags an extension block, but has no room for one");
       }
       let window = { bytes: region, start: regionStart };
       if (trailerStart < regionStart) {
@@ -3780,17 +3784,17 @@ var CrbmReader = class _CrbmReader {
       const trailer = within(window.bytes, window.start, trailerStart, indexOffset);
       const tview = new DataView(trailer.buffer, trailer.byteOffset, trailer.byteLength);
       if (!EXT_MAGIC.every((b, i) => trailer[8 + i] === b)) {
-        throw new IntegrityError(".crbm extension block trailer magic mismatch");
+        throw crbmIntegrity(".crbm extension block trailer magic mismatch");
       }
       const sectionsLength = tview.getUint32(0, true);
       if (sectionsLength > MAX_EXT_BYTES) {
-        throw new IntegrityError(
+        throw crbmIntegrity(
           `.crbm extension block ${sectionsLength}B exceeds cap ${MAX_EXT_BYTES}B`
         );
       }
       const extStart = trailerStart - sectionsLength;
       if (extStart < PAYLOAD_START) {
-        throw new IntegrityError(`.crbm extension block of ${sectionsLength}B out of bounds`);
+        throw crbmIntegrity(`.crbm extension block of ${sectionsLength}B out of bounds`);
       }
       let covered;
       if (extStart >= window.start) {
@@ -3799,11 +3803,11 @@ var CrbmReader = class _CrbmReader {
         covered = await blob.getRange(extStart, sectionsLength + 4);
         servedFromTail = false;
         if (covered.length !== sectionsLength + 4) {
-          throw new IntegrityError(".crbm extension block read short");
+          throw crbmIntegrity(".crbm extension block read short");
         }
       }
       if (crc32c(covered) !== tview.getUint32(4, true)) {
-        throw new IntegrityError(".crbm extension block CRC mismatch");
+        throw crbmIntegrity(".crbm extension block CRC mismatch");
       }
       ({ metadata, metadataLength } = extensionContents(
         covered.subarray(0, sectionsLength),
@@ -3819,18 +3823,16 @@ var CrbmReader = class _CrbmReader {
     );
     if (encrypted) {
       if (chunkCount !== 0 || totalCardinality !== 0) {
-        throw new IntegrityError(
-          ".crbm encrypted footer must zero chunk_count + total_cardinality"
-        );
+        throw crbmIntegrity(".crbm encrypted footer must zero chunk_count + total_cardinality");
       }
     } else {
       if (index.keys.length !== chunkCount) {
-        throw new IntegrityError(
+        throw crbmIntegrity(
           `.crbm chunk_count ${chunkCount} != ${index.keys.length} index entries`
         );
       }
       if (index.cardinalitySum !== totalCardinality) {
-        throw new IntegrityError(
+        throw crbmIntegrity(
           `.crbm total_cardinality ${totalCardinality} != \u03A3 index cardinality ${index.cardinalitySum}`
         );
       }
@@ -3932,7 +3934,7 @@ var CrbmReader = class _CrbmReader {
     const offset = this.index.offsets[slot];
     const length = this.index.lengths[slot];
     if (offset < PAYLOAD_START || offset + length > this.objectSize - FOOTER_BYTES) {
-      throw new IntegrityError(`chunk ${chunkKey} payload out of bounds`);
+      throw crbmIntegrity(`chunk ${chunkKey} payload out of bounds`);
     }
     const held = this.keptRange(offset, length);
     return this.openChunk(slot, chunkKey, held ?? await this.blob.getRange(offset, length));
@@ -3959,11 +3961,11 @@ var CrbmReader = class _CrbmReader {
    */
   openChunk(slot, chunkKey, bytes) {
     if (crc32c(bytes) !== this.index.crcs[slot]) {
-      throw new IntegrityError(`chunk ${chunkKey} payload CRC mismatch`);
+      throw crbmIntegrity(`chunk ${chunkKey} payload CRC mismatch`);
     }
     if (this.crypto === void 0) return bytes;
     if (bytes.length < AEAD_NONCE_BYTES + AEAD_TAG_BYTES) {
-      throw new IntegrityError(`chunk ${chunkKey} encrypted payload too short`);
+      throw crbmIntegrity(`chunk ${chunkKey} encrypted payload too short`);
     }
     return this.crypto.aead.open(
       {
@@ -4067,7 +4069,7 @@ var CrbmReader = class _CrbmReader {
           });
           moved = bytes.length;
           if (bytes.length !== read.length) {
-            throw new IntegrityError(
+            throw crbmIntegrity(
               `.crbm range [${read.offset}, +${read.length}) answered ${bytes.length} bytes, not the ${read.length} asked for`
             );
           }
@@ -4120,12 +4122,12 @@ var StreamClosed = class extends Error {
 };
 function within(bytes, start, from, to) {
   if (from < start || to > start + bytes.length) {
-    throw new IntegrityError(".crbm extension block read short");
+    throw crbmIntegrity(".crbm extension block read short");
   }
   return bytes.subarray(from - start, to - start);
 }
 function extensionCorrupt(message) {
-  throw new IntegrityError(`.crbm extension block: ${message}`);
+  throw crbmIntegrity(`.crbm extension block: ${message}`);
 }
 function extensionContents(sections, crypto) {
   const view = new DataView(sections.buffer, sections.byteOffset, sections.byteLength);
@@ -4202,26 +4204,26 @@ function parseIndex(indexBytes, payloadEnd, maxPayloadBytes, minPayloadBytes = 1
     const card = cardRead.value;
     pos = cardRead.next;
     if (pos + CRC32C_BYTES > indexBytes.length) {
-      throw new IntegrityError(".crbm index truncated (missing payload CRC)");
+      throw crbmIntegrity(".crbm index truncated (missing payload CRC)");
     }
     const crc = (indexBytes[pos] | indexBytes[pos + 1] << 8 | indexBytes[pos + 2] << 16 | indexBytes[pos + 3] << 24) >>> 0;
     pos += CRC32C_BYTES;
     const chunkKey = prevKey + keyDelta;
     const offset = prevEnd + offDelta;
     if (i > 0 && keyDelta === 0) {
-      throw new IntegrityError(`.crbm index has a duplicate chunkKey ${chunkKey}`);
+      throw crbmIntegrity(`.crbm index has a duplicate chunkKey ${chunkKey}`);
     }
-    if (chunkKey > 65535) throw new IntegrityError(`.crbm chunkKey ${chunkKey} out of range`);
+    if (chunkKey > 65535) throw crbmIntegrity(`.crbm chunkKey ${chunkKey} out of range`);
     if (len < minPayloadBytes || len > maxPayloadBytes) {
-      throw new IntegrityError(
+      throw crbmIntegrity(
         `.crbm chunk ${chunkKey} length ${len} invalid (most is ${maxPayloadBytes})`
       );
     }
     if (card < 1 || card > MAX_CHUNK_CARDINALITY) {
-      throw new IntegrityError(`.crbm chunk ${chunkKey} cardinality ${card} invalid`);
+      throw crbmIntegrity(`.crbm chunk ${chunkKey} cardinality ${card} invalid`);
     }
     if (offset + len > payloadEnd) {
-      throw new IntegrityError(`.crbm chunk ${chunkKey} payload out of bounds`);
+      throw crbmIntegrity(`.crbm chunk ${chunkKey} payload out of bounds`);
     }
     keys[count] = chunkKey;
     cardinalityMinusOne[count] = card - 1;
@@ -6211,6 +6213,7 @@ var CrbmWriter = class {
     this.metadata = metadataBytes(options.metadata, (message) => {
       throw new ValidationError(message);
     });
+    this.writeIdentity = options.crypto === void 0 ? drawWriteIdentity(options.entropy) : void 0;
   }
   sink;
   options;
@@ -6227,6 +6230,8 @@ var CrbmWriter = class {
   /** Where the chunk payloads end: the extension block's start when there is metadata, else the index's. */
   payloadEnd = 0;
   footerCrc32c;
+  /** A cleartext generation's write identity, drawn at construction; `undefined` for an encrypted one. */
+  writeIdentity;
   /**
    * Append one chunk's payload (the roaring-serialized bytes) with its cardinality. `chunkKey` must be
    * strictly greater than the previous one (ascending, no duplicates); `cardinality` is `[1, 65536]`.
@@ -6289,6 +6294,8 @@ var CrbmWriter = class {
       indexRegion = sealed.ciphertext;
       indexNonce = sealed.nonce;
       indexTag = sealed.tag;
+    } else {
+      indexNonce = this.writeIdentity;
     }
     const indexOffset = this.offset;
     await this.sink.write(indexRegion);
@@ -6402,8 +6409,35 @@ function framed(sealed) {
   out.set(sealed.tag, sealed.nonce.length + sealed.ciphertext.length);
   return out;
 }
+function drawWriteIdentity(entropy) {
+  if (typeof entropy !== "function") {
+    throw new ValidationError(
+      "a cleartext CrbmWriter needs an entropy source (`entropy`) for its write's identity"
+    );
+  }
+  const drawn = entropy(AEAD_NONCE_BYTES);
+  if (!(drawn instanceof Uint8Array)) {
+    throw new ValidationError(
+      `the entropy source must return a Uint8Array of ${AEAD_NONCE_BYTES} bytes for a write's identity; got ${Array.isArray(drawn) ? "an array" : typeof drawn}`
+    );
+  }
+  if (drawn.length !== AEAD_NONCE_BYTES) {
+    throw new ValidationError(
+      `the entropy source must return ${AEAD_NONCE_BYTES} bytes for a write's identity; got ${drawn.length}`
+    );
+  }
+  return Uint8Array.from(drawn);
+}
 
 // src/core/crbm-write.ts
+function requireEntropy(entropy, verb) {
+  if (typeof entropy !== "function") {
+    throw new ValidationError(
+      `${verb} needs an entropy source (\`entropy\`): the footer of every generation it writes carries 12 random bytes of the write's identity`
+    );
+  }
+  return entropy;
+}
 function* encodeEach(chunks) {
   for (const { chunkKey, bitmap } of chunks) {
     if (bitmap.isEmpty) continue;
@@ -6420,7 +6454,8 @@ async function writeEncodedChunks(driver, key, chunks, options) {
     const writer = new CrbmWriter(sink, {
       generation: key.generation,
       crypto: options.crypto,
-      metadata: options.metadata
+      metadata: options.metadata,
+      entropy: options.entropy
     });
     for (const chunk of chunks) {
       await writer.addChunk(chunk.chunkKey, chunk.payload, chunk.cardinality);
@@ -6446,7 +6481,7 @@ async function writeEncodedChunks(driver, key, chunks, options) {
     tailBytes: identity.tailBytes
   };
 }
-async function writeCrbmGenerationStream(driver, key, chunks, options = {}) {
+async function writeCrbmGenerationStream(driver, key, chunks, options) {
   const chunkKeys = [];
   let cardinality = 0;
   const tick = yieldEvery(options.clock);
@@ -6455,7 +6490,8 @@ async function writeCrbmGenerationStream(driver, key, chunks, options = {}) {
     const writer = new CrbmWriter(sink, {
       generation: key.generation,
       crypto: options.crypto,
-      metadata: options.metadata
+      metadata: options.metadata,
+      entropy: options.entropy
     });
     for await (const { chunkKey, bitmap } of chunks) {
       if (bitmap.isEmpty) continue;
@@ -6701,7 +6737,7 @@ async function publishGenerationKept(registry, key, options) {
   }
   if (unanswered !== void 0) throw unanswered;
   throw new WriteConflictError(
-    `publishGeneration: contention setting currentGen for ${key.segment}`
+    `publishGeneration: contention setting currentGen for ${key.segment}${CONTENTION_NEXT_STEP}`
   );
 }
 var REFUSED = { published: false };
@@ -6749,6 +6785,7 @@ async function bucketIds(ids, codec, clock) {
   const byChunk = /* @__PURE__ */ new Map();
   const pendingByChunk = /* @__PURE__ */ new Map();
   let pending = 0;
+  let flushed = 0;
   const tickChunk = yieldEvery(clock);
   const tickId = yieldEvery(clock, YIELD_EVERY_IDS);
   const flushPending = async () => {
@@ -6761,6 +6798,7 @@ async function bucketIds(ids, codec, clock) {
       const pause = tickChunk();
       if (pause !== null) await pause;
     }
+    flushed += pending;
     pending = 0;
   };
   const ingest = (id) => {
@@ -6773,18 +6811,27 @@ async function bucketIds(ids, codec, clock) {
     bucket.push(remainder);
     return ++pending >= BULK_FLUSH_IDS;
   };
-  if (Symbol.asyncIterator in ids) {
-    for await (const id of ids) {
-      if (ingest(id)) await flushPending();
-      const pause = tickId();
-      if (pause !== null) await pause;
+  try {
+    if (Symbol.asyncIterator in ids) {
+      for await (const id of ids) {
+        if (ingest(id)) await flushPending();
+        const pause = tickId();
+        if (pause !== null) await pause;
+      }
+    } else {
+      for (const id of ids) {
+        if (ingest(id)) await flushPending();
+        const pause = tickId();
+        if (pause !== null) await pause;
+      }
     }
-  } else {
-    for (const id of ids) {
-      if (ingest(id)) await flushPending();
-      const pause = tickId();
-      if (pause !== null) await pause;
+  } catch (err) {
+    if (isBadIdError(err)) {
+      const positioned = new ValidationError(`ids[${flushed + pending}]: ${err.message}`);
+      positioned.cause = err;
+      throw positioned;
     }
+    throw err;
   }
   await flushPending();
   return [...byChunk].map(([chunkKey, bitmap]) => ({ chunkKey, bitmap })).sort((a, b) => a.chunkKey - b.chunkKey);
@@ -6794,20 +6841,28 @@ function cleartextUnderRequiredEncryption(ref, currentGen) {
     `requireEncryption: segment "${ref.segment}" already has generation ${currentGen} in cleartext, so this load cannot be encrypted \u2014 encryption is chosen when a segment is first loaded. Load into a new segment with the keystore wired, then drop this one.`
   );
 }
-async function bulkLoadAhead(driver, ref, ahead, ids, options = {}) {
+function requireKeystoreWhenEncryptionRequired(options) {
   if (options.keystore === void 0 && options.requireEncryption === true) {
     throw new ValidationError("requireEncryption: a load needs a keystore to write encrypted");
   }
+}
+function refuseCleartextWhenEncryptionRequired(options, ref, currentGen) {
+  if (options.requireEncryption === true) {
+    throw cleartextUnderRequiredEncryption(ref, currentGen);
+  }
+}
+async function bulkLoadAhead(driver, ref, ahead, ids, options = {}) {
+  requireKeystoreWhenEncryptionRequired(options);
   const codec = requireCodec(options.codec, "bulkLoadCrbmGeneration");
+  const entropy = requireEntropy(options.entropy, "a load");
   let chunks;
   if (ids instanceof ChunkLoadInput) {
     chunks = encodeEach(rangeCheckedAtWrite(await collectChunks(ids, codec, options.clock)));
   } else {
     chunks = await encodedChunksOfInput(ids, codec, options.clock);
   }
-  if (options.keystore !== void 0 && options.registry === void 0) {
+  if (options.keystore !== void 0 && options.registry === void 0)
     throw new ValidationError("an encrypted load requires a registry to store the wrapped DEK");
-  }
   const passed = options.row;
   const existing = passed !== void 0 && passed !== null && (passed.wrappedDeks === void 0 || passed.wrappedDeks.length === 0) ? passed : options.registry !== void 0 ? await options.registry.get(ref) : null;
   if (existing?.status === "destroyed") {
@@ -6830,8 +6885,7 @@ async function bulkLoadAhead(driver, ref, ahead, ids, options = {}) {
       const aead = early !== void 0 && sameKeys(early.wrapped, existing.wrappedDeks) ? await early.aead : await options.keystore.openDek(existing.wrappedDeks);
       crypto = { aead, aadFor: (scope) => aadFor(key, key.generation, scope) };
     } else if (existing !== null && existing.currentGen !== null) {
-      if (options.requireEncryption === true)
-        throw cleartextUnderRequiredEncryption(ref, existing.currentGen);
+      refuseCleartextWhenEncryptionRequired(options, ref, existing.currentGen);
     } else {
       const minted = await options.keystore.createDek();
       newWrapped = minted.wrapped;
@@ -6841,7 +6895,8 @@ async function bulkLoadAhead(driver, ref, ahead, ids, options = {}) {
   const { size, sha256, chunkCount, cardinality, fingerprint, tailBytes } = await writeEncodedChunks(driver, key, chunks, {
     crypto,
     clock: options.clock,
-    metadata: options.metadata
+    metadata: options.metadata,
+    entropy
   });
   const summary = ownSummary(
     key,
@@ -7380,6 +7435,10 @@ async function currentCardinality(ref, deps, record, unwrapped) {
 function loadSegment(ref, input, deps, options = {}) {
   return runLoad(ref, (codec) => prepareLoadInput(input, codec), deps, options);
 }
+function startUnwrap(row, keystore) {
+  const wrappedKeys = row?.wrappedDeks;
+  return row !== null && row.status !== "destroyed" && wrappedKeys !== void 0 && wrappedKeys.length > 0 && keystore !== void 0 ? { wrapped: wrappedKeys, aead: settled((async () => keystore.openDek(wrappedKeys))()) } : void 0;
+}
 function loadSegmentChunks(ref, chunks, deps, options = {}) {
   return runLoad(
     ref,
@@ -7399,6 +7458,7 @@ async function runLoad(ref, prepare, deps, options) {
   validateUserRef(ref);
   checkedAuditSink(options.audit, "load");
   const codec = requireCodec(deps.codec, "loadSegment");
+  const entropy = requireEntropy(deps.entropy, "a load");
   const keep = options.keep ?? 1;
   requireInteger(keep, { min: 0, what: "keep" });
   const guard = checkedGuard(options.guard, "");
@@ -7411,9 +7471,7 @@ async function runLoad(ref, prepare, deps, options) {
   const row = await deps.registry.get(ref);
   const fromToken = row?.token;
   const fromGeneration = row?.currentGen ?? void 0;
-  const wrappedKeys = row?.wrappedDeks;
-  const keystore = deps.keystore;
-  const unwrapped = row !== null && row.status !== "destroyed" && wrappedKeys !== void 0 && wrappedKeys.length > 0 && keystore !== void 0 ? { wrapped: wrappedKeys, aead: settled((async () => keystore.openDek(wrappedKeys))()) } : void 0;
+  const unwrapped = startUnwrap(row, deps.keystore);
   const needsBefore = sizeNeeded(guard, options.allowEmpty);
   const current = needsBefore ? await currentCardinality(ref, deps, row, unwrapped?.aead) : { cardinality: null, fromSummary: false };
   const before = current.cardinality;
@@ -7432,6 +7490,7 @@ async function runLoad(ref, prepare, deps, options) {
         requireEncryption: deps.requireEncryption,
         codec: deps.codec,
         clock: deps.clock,
+        entropy,
         metadata,
         row
       }
@@ -7770,16 +7829,16 @@ function collectFetch(node, demanded, operands, planned, fetch) {
   }
   for (const kid of node.kids) collectFetch(kid, here, operands, planned, fetch);
 }
-function canHold(node, holds) {
+function canHold(node, holds2) {
   switch (node.kind) {
     case "leaf":
-      return holds(node.operand);
+      return holds2(node.operand);
     case "and":
-      return node.kids.every((kid) => canHold(kid, holds));
+      return node.kids.every((kid) => canHold(kid, holds2));
     case "or":
-      return node.kids.some((kid) => canHold(kid, holds));
+      return node.kids.some((kid) => canHold(kid, holds2));
     case "andNot":
-      return canHold(node.kids[0], holds);
+      return canHold(node.kids[0], holds2);
   }
 }
 var KeyBits = class {
@@ -7857,11 +7916,12 @@ var ResidentLedger = class {
     return true;
   }
   /**
-   * Charge `bytes`, asking `makeRoom` to free some while they do not fit. `makeRoom` releases what it frees (through
-   * {@link release}) and answers whether it freed anything; the charge is refused when it cannot.
+   * Charge `bytes`, asking `makeRoom` to free some while they do not fit. `makeRoom` is told how many bytes are wanted,
+   * releases what it frees (through {@link release}) and answers whether it freed anything; the charge is refused when
+   * it cannot.
    */
   reserve(bytes, makeRoom) {
-    while (!this.tryCharge(bytes)) if (!makeRoom()) return false;
+    while (!this.tryCharge(bytes)) if (!makeRoom(bytes)) return false;
     return true;
   }
   release(bytes) {
@@ -8523,8 +8583,9 @@ var GroupCost = class {
   }
 };
 var planWorkOf = (o) => o.rootKeys.byteLength * (1 + 2 * o.compiled.operands.length);
-var budgetError = (limit, what) => new BudgetExceededError(
-  `materializeMany: ${what} would hold more than maxBufferedBytes (${limit}) resident \u2014 raise maxBufferedBytes, or split the outputs across calls`
+var budgetError = (limit, spent, what) => new BudgetExceededError(
+  `materializeMany: ${what} would hold more than maxBufferedBytes (${limit}) resident \u2014 raise maxBufferedBytes, or split the outputs across calls`,
+  { option: "maxBufferedBytes", limit, spent }
 );
 async function runCombineMany(compiled, deps) {
   const run = new Run(compiled, deps);
@@ -8648,8 +8709,8 @@ var Run = class {
       codec: this.codec,
       base: this.fedBase,
       charge: (bytes) => {
-        if (!this.ledger.reserve(bytes, () => this.reclaim())) {
-          throw budgetError(this.req.maxBufferedBytes, "the feed");
+        if (!this.ledger.reserve(bytes, (needed) => this.reclaim(needed))) {
+          throw this.refuse(bytes, "the feed");
         }
       },
       release: (bytes) => this.ledger.release(bytes),
@@ -8682,20 +8743,24 @@ var Run = class {
       this.fail(o, error instanceof FeedStale ? this.staleError(o) : error);
     }
   }
+  /** The refusal for `needed` more resident bytes than the ledger has room for: what it held plus what it was asked for. */
+  refuse(needed, what) {
+    return budgetError(this.req.maxBufferedBytes, this.ledger.used + needed, what);
+  }
   /**
    * Make room in the ledger. The plans kept for later groups give way first: they are rebuilt when their group starts,
    * and the outputs were judged without them. A fed output cannot be run again (the feed is read once), so a fed call
    * gives up its fed outputs and the feed next, as soon as the ledger passes the budget; only then is a stored-only
    * buffer evicted, to run again alone.
    */
-  reclaim() {
+  reclaim(needed) {
     if (this.dropKeptPlans()) return true;
     if (this.feed !== void 0) {
       let fed = this.feed.heldBytes;
       for (const o of this.running)
         if (o.compiled.fed.length > 0 && o.status === "live") fed += o.charged;
       if (fed > 0) {
-        this.failFed(budgetError(this.req.maxBufferedBytes, "the feed and the fed outputs"));
+        this.failFed(this.refuse(needed, "the feed and the fed outputs"));
         return true;
       }
     }
@@ -8783,7 +8848,12 @@ var Run = class {
       return;
     }
     throw new BudgetExceededError(
-      `materializeMany: the plan alone (${what}) passes maxBufferedBytes (${this.req.maxBufferedBytes}) with ${this.planCharge} bytes already held for it, before any chunk is read \u2014 raise maxBufferedBytes, or split the outputs across calls`
+      `materializeMany: the plan alone (${what}) passes maxBufferedBytes (${this.req.maxBufferedBytes}) with ${this.planCharge} bytes already held for it, before any chunk is read \u2014 raise maxBufferedBytes, or split the outputs across calls`,
+      {
+        option: "maxBufferedBytes",
+        limit: this.req.maxBufferedBytes,
+        spent: this.ledger.used + bytes
+      }
     );
   }
   planOutputs() {
@@ -8861,7 +8931,8 @@ var Run = class {
         this.fail(
           o,
           new BudgetExceededError(
-            `materializeMany: output ${o.index} needs about ${alone} bytes resident with its operands, and the plan holds ${base}, over maxBufferedBytes (${this.req.maxBufferedBytes}) \u2014 raise maxBufferedBytes to at least ${alone + base}`
+            `materializeMany: output ${o.index} needs about ${alone} bytes resident with its operands, and the plan holds ${base}, over maxBufferedBytes (${this.req.maxBufferedBytes}) \u2014 raise maxBufferedBytes to at least ${alone + base}`,
+            { option: "maxBufferedBytes", limit: this.req.maxBufferedBytes, spent: alone + base }
           )
         );
         continue;
@@ -8957,7 +9028,8 @@ var Run = class {
       this.limit = given.maxRequests;
       if (this.planned > this.limit) {
         throw new BudgetExceededError(
-          `materializeMany would read ${this.planned} chunks over ${groups.length} group(s), over the budget of ${this.limit} \u2014 raise \`budget.maxRequests\`, raise maxBufferedBytes so fewer groups re-read the operands, or set \`budget: false\``
+          `materializeMany would read ${this.planned} chunks over ${groups.length} group(s), over the budget of ${this.limit} \u2014 raise \`budget.maxRequests\`, raise maxBufferedBytes so fewer groups re-read the operands, or set \`budget: false\``,
+          { option: "budget.maxRequests", limit: this.limit, spent: this.planned }
         );
       }
     }
@@ -8990,7 +9062,8 @@ var Run = class {
     const budget = this.limit;
     if (budget !== null && this.chunkReads + plan.reads > budget) {
       const error = new BudgetExceededError(
-        `materializeMany: re-running outputs would read ${plan.reads} more chunks, past the budget of ${budget} (${this.chunkReads} read)`
+        `materializeMany: re-running outputs would read ${plan.reads} more chunks, past the budget of ${budget} (${this.chunkReads} read)`,
+        { option: "budget.maxRequests", limit: budget, spent: this.chunkReads + plan.reads }
       );
       for (const o of members) this.fail(o, error);
       return;
@@ -9006,7 +9079,7 @@ var Run = class {
     }
     const fixed = plan.fixedBytes + plan.planBytes;
     if (!this.ledger.tryCharge(fixed) && !(this.dropKeptPlans() && this.ledger.tryCharge(fixed))) {
-      const error = budgetError(this.req.maxBufferedBytes, "the operand streams");
+      const error = this.refuse(fixed, "the operand streams");
       for (const o of members) this.fail(o, error);
       return;
     }
@@ -9084,7 +9157,7 @@ var Run = class {
       for (const o of victims) if (o.status === "live") this.fail(o, error);
     };
     const w = this.window === "empty" ? null : this.window;
-    const makeRoom = () => this.reclaim();
+    const makeRoom = (needed) => this.reclaim(needed);
     const feed = this.feed !== void 0 && this.feed.active ? this.feed : void 0;
     const fedBase = this.fedBase;
     let at = 0;
@@ -9115,8 +9188,8 @@ var Run = class {
             if (!(error instanceof FeedClosed)) this.failFed(error);
           }
         }
-        const holds = (operand) => operand >= fedBase ? fedHere?.has(operand) === true : hasKey(this.operands[operand].bounds.keys, key);
-        const needs = (o) => o.compiled.fed.length === 0 || canHold(o.compiled.node, holds);
+        const holds2 = (operand) => operand >= fedBase ? fedHere?.has(operand) === true : hasKey(this.operands[operand].bounds.keys, key);
+        const needs = (o) => o.compiled.fed.length === 0 || canHold(o.compiled.node, holds2);
         try {
           const exact = feed !== void 0 || members.some((o) => o.status !== "live");
           const cursorsAt = [];
@@ -9181,10 +9254,7 @@ var Run = class {
               try {
                 const resident = residentBytes(bytes.length);
                 if (!this.ledger.reserve(resident, makeRoom)) {
-                  throw budgetError(
-                    this.req.maxBufferedBytes,
-                    `operand "${c.op.spec.name}" at chunk ${key}`
-                  );
+                  throw this.refuse(resident, `operand "${c.op.spec.name}" at chunk ${key}`);
                 }
                 held += resident;
                 decoded.set(
@@ -9277,7 +9347,7 @@ var Run = class {
     const resident = residentBound(size);
     kc.drop(held);
     if (!this.ledger.reserve(resident, makeRoom)) {
-      throw budgetError(this.req.maxBufferedBytes, `output ${o.index}`);
+      throw this.refuse(resident, `output ${o.index}`);
     }
     if (o.status !== "live") {
       this.ledger.release(resident);
@@ -9357,7 +9427,7 @@ var Run = class {
         }
         if (!admitted) {
           if (o.solo || o.compiled.fed.length > 0) {
-            this.fail(o, budgetError(this.req.maxBufferedBytes, `publishing output ${o.index}`));
+            this.fail(o, this.refuse(transient, `publishing output ${o.index}`));
           } else {
             this.dropBuffer(o);
             o.status = "deferred";
@@ -9532,7 +9602,7 @@ var KeyContext = class {
   /** Charge `bytes` for a bitmap this evaluation made. */
   take(bytes) {
     if (!this.ledger.reserve(bytes, this.makeRoom)) {
-      throw budgetError(this.ledger.limit, "a chunk being evaluated");
+      throw budgetError(this.ledger.limit, this.ledger.used + bytes, "a chunk being evaluated");
     }
     this.temp += bytes;
   }
@@ -9757,7 +9827,13 @@ async function rollbackSegment(ref, toGeneration, deps, options = {}) {
       const seen = await deps.registry.get(ref);
       const settled2 = await churn.settle(record, seen, () => deps.registry.get(ref));
       const now = settled2?.row ?? null;
-      if (settled2 === void 0 || now === null || !onlyLeasesDiffer(record, now)) throw err;
+      if (settled2 === void 0 || now === null || !onlyLeasesDiffer(record, now)) {
+        const lost = new WriteConflictError(
+          "rollback: the segment's row changed while the rollback ran and the pointer was not moved; check store.generations(ref) and run it again"
+        );
+        lost.cause = err;
+        throw lost;
+      }
       against = now.token;
     }
   }
@@ -9934,6 +10010,7 @@ async function eraseOnce(ref, id, deps, options, seen) {
   checkedAuditSink(options.audit, "eraseIdFromSegment");
   const { chunkKey, remainder } = splitId(id);
   const codec = requireCodec(deps.codec, "eraseIdFromSegment");
+  requireEntropy(deps.entropy, "eraseIdFromSegment");
   const maxBytes = deps.maxBitmapBytes ?? DEFAULT_MAX_BITMAP_BYTES;
   const base = { segment: ref.segment, namespace: ref.namespace };
   const audit = safeAudit(options.audit ?? NOOP_AUDIT);
@@ -9945,510 +10022,560 @@ async function eraseOnce(ref, id, deps, options, seen) {
   const pointerless = !tombstoned && record.currentGen === null;
   const from = record.currentGen ?? -1;
   const fromToken = record.token;
-  let premise = record;
-  let premiseToken = fromToken;
-  let aead;
-  if (tombstoned) {
-  } else if (record.wrappedDeks !== void 0 && record.wrappedDeks.length > 0) {
-    if (deps.keystore === void 0) {
-      throw new KeyUnavailableError(
-        `segment "${ref.segment}" is encrypted but eraseIdFromSegment has no keystore`
-      );
-    }
-    aead = await deps.keystore.openDek(record.wrappedDeks);
-  } else if (!pointerless && deps.requireEncryption === true) {
-    throw new ValidationError(`requireEncryption: segment "${ref.segment}" is cleartext`);
-  }
-  const cryptoAt = (generation2) => aead === void 0 ? void 0 : { aead, aadFor: (scope) => aadFor(ref, generation2, scope) };
+  const aead = await resolveDek(ref, deps, record, { tombstoned, pointerless });
   const fromKey = { ...base, generation: from };
-  const refused = (reason, generation2) => ({
-    ...base,
-    erased: false,
-    reason,
-    fromGeneration: from,
-    generation: generation2,
-    collected: []
-  });
-  const rowVerdict = (row, alsoIgnore = []) => {
-    if (row === null) return "absent";
-    if (row.status === "destroyed") return "destroyed";
-    const same = row.token === premiseToken || onlyLeasesDiffer(premise, row, alsoIgnore);
-    if (pointerless) return row.currentGen === null && same ? null : "superseded";
-    if (row.currentGen === null) return "no-generation";
-    return row.currentGen === from && same ? null : "superseded";
+  const c = {
+    ref,
+    deps,
+    seen,
+    audit,
+    chunkKey,
+    remainder,
+    codec,
+    maxBytes,
+    base,
+    record,
+    tombstoned,
+    pointerless,
+    from,
+    fromToken,
+    aead,
+    fromKey,
+    read,
+    sealed: /* @__PURE__ */ new Set(),
+    versions: /* @__PURE__ */ new Map(),
+    premise: record,
+    premiseToken: fromToken,
+    fenceLost: 0,
+    rewrote: void 0
   };
-  const sealed = /* @__PURE__ */ new Set();
-  const versions = /* @__PURE__ */ new Map();
-  const holds = async (generation2) => {
-    const key2 = { ...base, generation: generation2 };
-    const crypto = cryptoAt(generation2);
+  if (tombstoned) return await underTombstone(c);
+  if (pointerless) return await unpublished(c);
+  const staged = await stage(c);
+  if ("erased" in staged) {
+    if (!staged.erased && staged.generation !== void 0 && c.rewrote !== void 0) {
+      await discardRefused(c, c.rewrote);
+    }
+    return staged;
+  }
+  return await finishRewrite(c, staged);
+}
+function rowVerdict(c, row, alsoIgnore = []) {
+  const { pointerless, from } = c;
+  if (row === null) return "absent";
+  if (row.status === "destroyed") return "destroyed";
+  const same = row.token === c.premiseToken || onlyLeasesDiffer(c.premise, row, alsoIgnore);
+  if (pointerless) return row.currentGen === null && same ? null : "superseded";
+  if (row.currentGen === null) return "superseded";
+  return row.currentGen === from && same ? null : "superseded";
+}
+function refusedResult(c, reason, generation) {
+  const { base, from } = c;
+  return { ...base, erased: false, reason, fromGeneration: from, generation, collected: [] };
+}
+function cryptoAt(c, generation) {
+  const { ref, aead } = c;
+  return aead === void 0 ? void 0 : { aead, aadFor: (scope) => aadFor(ref, generation, scope) };
+}
+function found(c, generation, held) {
+  return held === true && !c.sealed.has(generation);
+}
+async function holds(c, generation) {
+  const { deps, chunkKey, remainder, codec, maxBytes, base, tombstoned, read, sealed, versions } = c;
+  const key = { ...base, generation };
+  const crypto = cryptoAt(c, generation);
+  try {
+    let reader;
+    const index = { refused: false };
+    let opened;
     try {
-      let reader;
-      const index = { refused: false };
-      let opened;
-      try {
-        reader = await read(
-          () => openGenerationReaderNoting(
-            deps.storage,
-            key2,
-            crypto === void 0 ? void 0 : noticingIndex(crypto, index),
-            (version) => opened = version
-          )
-        );
-      } catch (err) {
-        if (crypto === void 0) {
-          let footer;
-          const encrypted = !isTransientError(err) && await read(
-            () => objectIsEncrypted(deps.storage, key2, (version) => footer = version)
-          );
-          if (encrypted) {
-            if (tombstoned) return false;
-            sealed.add(generation2);
-            versions.set(generation2, footer);
-            return true;
-          }
-          throw err;
-        }
-        if (isIntegrityError(err) && index.refused) {
-          sealed.add(generation2);
-          versions.set(generation2, opened);
+      reader = await read(
+        () => openGenerationReaderNoting(
+          deps.storage,
+          key,
+          crypto === void 0 ? void 0 : noticingIndex(crypto, index),
+          (version) => opened = version
+        )
+      );
+    } catch (err) {
+      if (crypto === void 0) {
+        let footer;
+        const encrypted = !isTransientError(err) && await read(() => objectIsEncrypted(deps.storage, key, (version) => footer = version));
+        if (encrypted) {
+          if (tombstoned) return false;
+          sealed.add(generation);
+          versions.set(generation, footer);
           return true;
         }
-        if (!isIntegrityError(err) || await read(() => objectIsEncrypted(deps.storage, key2))) {
-          throw err;
-        }
-        reader = await read(() => openGenerationReader(deps.storage, key2, void 0));
+        throw err;
       }
-      versions.set(generation2, objectVersionOf(reader));
-      let bytes;
-      try {
-        bytes = await read(() => reader.getChunk(chunkKey));
-      } catch (err) {
-        if (!isTransientError(err) && !await read(() => sameObjectUnder(deps.storage, key2, reader.fingerprint))) {
-          return null;
-        }
+      if (isIntegrityError(err) && index.refused) {
+        sealed.add(generation);
+        versions.set(generation, opened);
+        return true;
+      }
+      if (!isIntegrityError(err) || await read(() => objectIsEncrypted(deps.storage, key))) {
         throw err;
       }
-      return bytes !== null && codec.safeDeserialize(bytes, maxBytes).has(remainder);
+      reader = await read(() => openGenerationReader(deps.storage, key, void 0));
+    }
+    versions.set(generation, objectVersionOf(reader));
+    let bytes;
+    try {
+      bytes = await read(() => reader.getChunk(chunkKey));
     } catch (err) {
-      if (isNotFoundError(err)) return null;
+      if (!isTransientError(err) && !await read(() => sameObjectUnder(deps.storage, key, reader.fingerprint))) {
+        return null;
+      }
       throw err;
     }
-  };
-  const found = (generation2, held) => held === true && !sealed.has(generation2);
-  const holdsEach = async (generations, { stopAtHolder }) => {
-    let firstHolder = Infinity;
-    const settled2 = await mapWithConcurrency(
-      generations,
-      HOLDS_CONCURRENCY,
-      async (generation2, index) => {
-        if (stopAtHolder && index > firstHolder) {
-          return { generation: generation2, held: null, fault: void 0 };
-        }
-        try {
-          const held = await holds(generation2);
-          if (found(generation2, held) && index < firstHolder) firstHolder = index;
-          return { generation: generation2, held, fault: void 0 };
-        } catch (fault) {
-          return { generation: generation2, held: null, fault: { error: fault } };
-        }
+    return bytes !== null && codec.safeDeserialize(bytes, maxBytes).has(remainder);
+  } catch (err) {
+    if (isNotFoundError(err)) return null;
+    throw err;
+  }
+}
+async function holdsEach(c, generations, { stopAtHolder }) {
+  let firstHolder = Infinity;
+  const settled2 = await mapWithConcurrency(
+    generations,
+    HOLDS_CONCURRENCY,
+    async (generation, index) => {
+      if (stopAtHolder && index > firstHolder) {
+        return { generation, held: null, fault: void 0 };
+      }
+      try {
+        const held = await holds(c, generation);
+        if (found(c, generation, held) && index < firstHolder) firstHolder = index;
+        return { generation, held, fault: void 0 };
+      } catch (fault) {
+        return { generation, held: null, fault: { error: fault } };
       }
-    );
-    const outcomes = [];
-    for (const { generation: generation2, held, fault } of settled2) {
-      if (fault !== void 0) throw fault.error;
-      outcomes.push({ generation: generation2, held });
-      if (stopAtHolder && found(generation2, held)) break;
     }
-    return outcomes;
-  };
-  const holderLeft = async (clean) => {
-    const toRead = (await generationsOf(deps.storage, ref)).reverse().filter((generation2) => !clean.has(generation2));
-    return (await holdsEach(toRead, { stopAtHolder: true })).find(
-      (outcome) => outcome.held === true
-    )?.generation;
-  };
-  const cannotRemove = (generation2) => new WriteConflictError(
-    `erasure of segment ${ref.segment} could not remove generation ${generation2}, which ${sealed.has(generation2) ? "cannot be searched, so may hold the id," : "still holds the id"} and is still in the bucket; re-run`
   );
-  let fenceLost = 0;
-  const fence = async (plan) => {
-    const renewal = rowRenewal(ref, deps);
-    const churn = leaseChurn({ clock: deps.clock, rng: renewal.rng });
-    const first = await deps.registry.get(ref);
-    let row = first;
-    const refuse = (moved) => ({
-      moved,
-      sweep: false,
-      byName: [],
-      ledger: true,
-      pruned: false
-    });
-    for (; ; ) {
-      if (row === null || row.status === "destroyed" || !pointerless && row.currentGen === null) {
-        if (row !== null && !sameIncarnation(record, row)) return refuse("superseded");
-        const reason = row === null ? "absent" : row.status === "destroyed" ? "destroyed" : "no-generation";
-        return {
-          moved: plan.byName.length > 0 ? reason : null,
-          sweep: plan.sweeps,
-          byName: [],
-          ledger: true,
-          pruned: false
-        };
-      }
-      if (!sameIncarnation(record, row)) return refuse("superseded");
-      const held = row.token === record.token || onlyLeasesDiffer(record, row, ["pointerId", "knownGens"]);
-      const pointer = row.currentGen;
-      let byName = plan.byName;
-      let moved = null;
-      let pastHolders = false;
-      if (plan.byName.length > 0 && !held) {
-        const below = plan.sweeps && !pointerless && pointer !== null && pointer > from && plan.byName.every((h) => h <= pointer);
-        if (!below) return refuse(pointerless || pointer !== null ? "superseded" : "no-generation");
-        byName = [];
-        moved = "superseded";
-        pastHolders = true;
-      }
-      const ledger = usableKnownGens(row);
-      const doomed = new Set(byName);
-      if (plan.sweeps && ledger !== void 0 && pointer !== null) {
-        const bound = Math.min(plan.below ?? from, pointer);
-        for (const e of ledger) if (e.generation < bound) doomed.add(e.generation);
-        if (byName.length === 0) {
-          for (const h of plan.byName) if (h < pointer) doomed.add(h);
-        }
-      }
-      if (pointer !== null) doomed.delete(pointer);
-      const named = ledger !== void 0 && ledger.some((e) => doomed.has(e.generation));
-      const renew = byName.length > 0;
-      const renewedAfter = held && row.pointerId !== first.pointerId;
-      if (!named && (!renew || renewedAfter)) {
-        premise = row;
-        premiseToken = row.token;
-        return {
-          moved,
-          sweep: plan.sweeps,
-          byName,
-          ledger: ledger !== void 0,
-          pruned: false,
-          past: pastHolders
-        };
-      }
-      const written = await renewal.write(row, {
-        ...renew ? renewPointer(row) : {},
-        ...named ? { knownGens: pruneKnown(row, doomed) } : {}
-      });
-      if ("row" in written) {
-        premise = written.row;
-        premiseToken = written.row.token;
-        return {
-          moved,
-          sweep: plan.sweeps,
-          byName,
-          ledger: ledger !== void 0,
-          pruned: named,
-          past: pastHolders
-        };
-      }
-      const now = written.lost;
-      const settled2 = await churn.settle(row, now, () => deps.registry.get(ref));
-      if (settled2 !== void 0) {
-        row = settled2.row;
-        continue;
-      }
-      fenceLost += 1;
-      if (fenceLost >= FENCE_ATTEMPTS) return refuse("superseded");
-      row = now;
+  const outcomes = [];
+  for (const { generation, held, fault } of settled2) {
+    if (fault !== void 0) throw fault.error;
+    outcomes.push({ generation, held });
+    if (stopAtHolder && found(c, generation, held)) break;
+  }
+  return outcomes;
+}
+async function holderLeft(c, clean) {
+  const { ref, deps } = c;
+  const toRead = (await generationsOf(deps.storage, ref)).reverse().filter((generation) => !clean.has(generation));
+  return (await holdsEach(c, toRead, { stopAtHolder: true })).find(
+    (outcome) => outcome.held === true
+  )?.generation;
+}
+function cannotRemove(c, generation) {
+  const { ref, sealed } = c;
+  return new WriteConflictError(
+    `erasure of segment ${ref.segment} could not remove generation ${generation}, which ${sealed.has(generation) ? "cannot be searched, so may hold the id," : "still holds the id"} and is still in the bucket; re-run`
+  );
+}
+function fenceRefused(moved) {
+  return { moved, sweep: false, byName: [], ledger: true, pruned: false };
+}
+function doomedGenerations(c, plan, byName, ledger, pointer) {
+  const { from } = c;
+  const doomed = new Set(byName);
+  if (plan.sweeps && ledger !== void 0 && pointer !== null) {
+    const bound = Math.min(plan.below ?? from, pointer);
+    for (const e of ledger) if (e.generation < bound) doomed.add(e.generation);
+    if (byName.length === 0) {
+      for (const h of plan.byName) if (h < pointer) doomed.add(h);
     }
-  };
-  const collectAgain = async (start, plan) => {
-    const deleted = [];
+  }
+  if (pointer !== null) doomed.delete(pointer);
+  return doomed;
+}
+async function fence(c, plan) {
+  const { ref, deps, record, pointerless, from } = c;
+  const renewal = rowRenewal(ref, deps);
+  const churn = leaseChurn({ clock: deps.clock, rng: renewal.rng });
+  const first = await deps.registry.get(ref);
+  let row = first;
+  for (; ; ) {
+    if (row === null || row.status === "destroyed" || !pointerless && row.currentGen === null) {
+      if (row !== null && !sameIncarnation(record, row)) return fenceRefused("superseded");
+      const reason = row === null ? "absent" : row.status === "destroyed" ? "destroyed" : "superseded";
+      return {
+        moved: plan.byName.length > 0 ? reason : null,
+        sweep: plan.sweeps,
+        byName: [],
+        ledger: true,
+        pruned: false
+      };
+    }
+    if (!sameIncarnation(record, row)) return fenceRefused("superseded");
+    const held = row.token === record.token || onlyLeasesDiffer(record, row, ["pointerId", "knownGens"]);
+    const pointer = row.currentGen;
+    let byName = plan.byName;
     let moved = null;
-    let missing2;
-    let spared = start.spared;
-    for (let passes = 0; passes < FENCE_ATTEMPTS && missing2 === void 0 && (!start.ledgered && passes === 0 || spared.length > 0); passes++) {
-      const again = await fence({ byName: plan.byName, sweeps: true, below: plan.below });
-      if (again.moved !== null && again.past !== true) {
-        moved = again.moved;
-        break;
-      }
-      if (!again.pruned) break;
-      const more = await collectBelowPointer(ref, deps, { keep: 0, skipKnown: true });
-      deleted.push(...more.deleted);
-      missing2 = more.missing;
-      spared = more.knownSpared ?? [];
+    let pastHolders = false;
+    if (plan.byName.length > 0 && !held) {
+      const below = plan.sweeps && !pointerless && pointer !== null && pointer > from && plan.byName.every((h) => h <= pointer);
+      if (!below) return fenceRefused("superseded");
+      byName = [];
+      moved = "superseded";
+      pastHolders = true;
+    }
+    const ledger = usableKnownGens(row);
+    const doomed = doomedGenerations(c, plan, byName, ledger, pointer);
+    const named = ledger !== void 0 && ledger.some((e) => doomed.has(e.generation));
+    const renew = byName.length > 0;
+    const renewedAfter = held && row.pointerId !== first.pointerId;
+    if (!named && (!renew || renewedAfter)) {
+      c.premise = row;
+      c.premiseToken = row.token;
+      return {
+        moved,
+        sweep: plan.sweeps,
+        byName,
+        ledger: ledger !== void 0,
+        pruned: false,
+        past: pastHolders
+      };
     }
-    return missing2 === void 0 ? { deleted, moved } : { deleted, moved, missing: missing2 };
-  };
-  const deleteFenced = async (holders, fenced) => {
-    const deleted = [];
-    const watch = watchDeletes(deps, ref);
-    let moved = fenced;
-    for (const generation2 of holders) {
-      if (moved !== null) break;
-      const row = await deps.registry.get(ref);
-      const missing3 = await watch.check(premise, row);
-      if (missing3 !== void 0) return { deleted, moved: "superseded", missing: missing3 };
-      moved = rowVerdict(row, ["pointerId", "knownGens"]);
-      if (moved === null && usableKnownGens(row)?.some((e) => e.generation === generation2)) {
-        moved = "superseded";
-      }
-      if (moved !== null) break;
-      try {
-        await deps.storage.delete({ ...base, generation: generation2 }, { ifVersion: versions.get(generation2) });
-      } catch (err) {
-        if (!isWriteConflictError(err)) throw err;
-        moved = rowVerdict(await deps.registry.get(ref)) ?? "superseded";
-        break;
-      }
-      deleted.push(generation2);
-      watch.deleted(generation2);
+    const written = await renewal.write(row, {
+      ...renew ? renewPointer(row) : {},
+      ...named ? { knownGens: pruneKnown(row, doomed) } : {}
+    });
+    if ("row" in written) {
+      c.premise = written.row;
+      c.premiseToken = written.row.token;
+      return {
+        moved,
+        sweep: plan.sweeps,
+        byName,
+        ledger: ledger !== void 0,
+        pruned: named,
+        past: pastHolders
+      };
     }
-    const missing2 = await watch.settle(premise);
+    const now = written.lost;
+    const settled2 = await churn.settle(row, now, () => deps.registry.get(ref));
+    if (settled2 !== void 0) {
+      row = settled2.row;
+      continue;
+    }
+    c.fenceLost += 1;
+    if (c.fenceLost >= FENCE_ATTEMPTS) return fenceRefused("superseded");
+    row = now;
+  }
+}
+async function collectAgain(c, start, plan) {
+  const { ref, deps } = c;
+  const deleted = [];
+  let moved = null;
+  let missing;
+  let spared = start.spared;
+  for (let passes = 0; passes < FENCE_ATTEMPTS && missing === void 0 && (!start.ledgered && passes === 0 || spared.length > 0); passes++) {
+    const again = await fence(c, { byName: plan.byName, sweeps: true, below: plan.below });
+    if (again.moved !== null && again.past !== true) {
+      moved = again.moved;
+      break;
+    }
+    if (!again.pruned) break;
+    const more = await collectBelowPointer(ref, deps, { keep: 0, skipKnown: true });
+    deleted.push(...more.deleted);
+    missing = more.missing;
+    spared = more.knownSpared ?? [];
+  }
+  return missing === void 0 ? { deleted, moved } : { deleted, moved, missing };
+}
+async function deleteFenced(c, holders, fenced) {
+  const { ref, deps, base, versions } = c;
+  const deleted = [];
+  const watch = watchDeletes(deps, ref);
+  let moved = fenced;
+  for (const generation of holders) {
+    if (moved !== null) break;
+    const row = await deps.registry.get(ref);
+    const missing2 = await watch.check(c.premise, row);
     if (missing2 !== void 0) return { deleted, moved: "superseded", missing: missing2 };
-    return { deleted, moved };
-  };
-  const notePointerOnDeleted = (missing2) => {
-    seen.missing = pointerOnDeletedError(ref, { kind: "erasure" }, missing2);
+    moved = rowVerdict(c, row, ["pointerId", "knownGens"]);
+    if (moved === null && usableKnownGens(row)?.some((e) => e.generation === generation)) {
+      moved = "superseded";
+    }
+    if (moved !== null) break;
+    try {
+      await deps.storage.delete({ ...base, generation }, { ifVersion: versions.get(generation) });
+    } catch (err) {
+      if (!isWriteConflictError(err)) throw err;
+      moved = rowVerdict(c, await deps.registry.get(ref)) ?? "superseded";
+      break;
+    }
+    deleted.push(generation);
+    watch.deleted(generation);
+  }
+  const missing = await watch.settle(c.premise);
+  if (missing !== void 0) return { deleted, moved: "superseded", missing };
+  return { deleted, moved };
+}
+function notePointerOnDeleted(c, missing) {
+  const { ref, seen } = c;
+  seen.missing = pointerOnDeletedError(ref, { kind: "erasure" }, missing);
+}
+function collectedAll(c, fromGeneration, collected) {
+  const { seen, base, record } = c;
+  seen.collectedOn = record.token;
+  seen.found = true;
+  return {
+    ...base,
+    erased: true,
+    fromGeneration,
+    collected: [...collected].sort(ascending)
   };
-  const collectedAll = (fromGeneration, collected2) => {
-    seen.collectedOn = record.token;
-    seen.found = true;
+}
+function sealedOnly(c, answer, collected) {
+  const { seen, record } = c;
+  if (collected.length > 0) seen.collectedOn = record.token;
+  return { ...answer, collected: [...collected].sort(ascending) };
+}
+async function unpublished(c) {
+  const { ref, deps, base, sealed } = c;
+  const newestFirst = (await generationsOf(deps.storage, ref)).reverse();
+  const holders = [];
+  const clean = /* @__PURE__ */ new Set();
+  for (const { generation, held } of await holdsEach(c, newestFirst, { stopAtHolder: false })) {
+    if (held === true) holders.push(generation);
+    else if (held === false) clean.add(generation);
+  }
+  const none = { ...base, erased: false, reason: "no-generation", collected: [] };
+  if (holders.length === 0) return none;
+  const newest = holders.find((generation) => !sealed.has(generation));
+  const fenced = await fence(c, { byName: holders, sweeps: false });
+  const { deleted, moved, missing } = await deleteFenced(c, fenced.byName, fenced.moved);
+  const collected = [...deleted].sort(ascending);
+  const left = await holderLeft(c, clean);
+  if (missing !== void 0) notePointerOnDeleted(c, missing);
+  if (left === void 0) {
+    return newest === void 0 ? sealedOnly(c, none, collected) : collectedAll(c, newest, collected);
+  }
+  if (moved !== null) {
     return {
       ...base,
-      erased: true,
-      fromGeneration,
-      collected: [...collected2].sort(ascending)
+      erased: false,
+      reason: moved,
+      ...newest === void 0 ? {} : { fromGeneration: newest },
+      collected
     };
+  }
+  throw cannotRemove(c, left);
+}
+async function underTombstone(c) {
+  const { ref, deps, base } = c;
+  const newestFirst = (await generationsOf(deps.storage, ref)).reverse();
+  const holder = (await holdsEach(c, newestFirst, { stopAtHolder: true })).find(
+    (h) => h.held === true
+  );
+  if (holder === void 0) return { ...base, erased: false, reason: "destroyed", collected: [] };
+  const collected = await gcOrphanGenerations(ref, deps, { keep: 0 });
+  const left = await holderLeft(c, /* @__PURE__ */ new Set());
+  if (left !== void 0) throw cannotRemove(c, left);
+  return collectedAll(c, holder.generation, collected);
+}
+async function notInCurrent(c) {
+  const { ref, deps, base, from, sealed } = c;
+  const notMember = {
+    ...base,
+    erased: false,
+    reason: "not-member",
+    fromGeneration: from,
+    collected: []
   };
-  const sealedOnly = (answer, collected2) => {
-    if (collected2.length > 0) seen.collectedOn = record.token;
-    return { ...answer, collected: [...collected2].sort(ascending) };
-  };
-  const unpublished = async () => {
-    const newestFirst = (await generationsOf(deps.storage, ref)).reverse();
-    const holders = [];
-    const clean = /* @__PURE__ */ new Set();
-    for (const { generation: generation2, held } of await holdsEach(newestFirst, { stopAtHolder: false })) {
-      if (held === true) holders.push(generation2);
-      else if (held === false) clean.add(generation2);
-    }
-    const none = { ...base, erased: false, reason: "no-generation", collected: [] };
-    if (holders.length === 0) return none;
-    const newest = holders.find((generation2) => !sealed.has(generation2));
-    const fenced = await fence({ byName: holders, sweeps: false });
-    const { deleted, moved, missing: missing2 } = await deleteFenced(fenced.byName, fenced.moved);
-    const collected2 = [...deleted].sort(ascending);
-    const left2 = await holderLeft(clean);
-    if (missing2 !== void 0) notePointerOnDeleted(missing2);
-    if (left2 === void 0) {
-      return newest === void 0 ? sealedOnly(none, collected2) : collectedAll(newest, collected2);
-    }
-    if (moved !== null) {
-      return {
-        ...base,
-        erased: false,
-        reason: moved,
-        ...newest === void 0 ? {} : { fromGeneration: newest },
-        collected: collected2
-      };
-    }
-    throw cannotRemove(left2);
-  };
-  const underTombstone = async () => {
-    const newestFirst = (await generationsOf(deps.storage, ref)).reverse();
-    const holder = (await holdsEach(newestFirst, { stopAtHolder: true })).find(
-      (h) => h.held === true
+  const newestFirst = (await generationsOf(deps.storage, ref)).filter((g) => g !== from).reverse();
+  if (newestFirst.length === 0) return notMember;
+  const clean = /* @__PURE__ */ new Set([from]);
+  const holdersAbove = [];
+  for (const { generation, held } of await holdsEach(
+    c,
+    newestFirst.filter((g) => g > from),
+    { stopAtHolder: false }
+  )) {
+    if (held === true) holdersAbove.push(generation);
+    else if (held === false) clean.add(generation);
+  }
+  const foundAbove = holdersAbove.find((generation) => !sealed.has(generation));
+  let holderBelow;
+  const sealedBelow = [];
+  if (foundAbove === void 0) {
+    for (const { generation, held } of await holdsEach(
+      c,
+      newestFirst.filter((g) => g < from),
+      { stopAtHolder: true }
+    )) {
+      if (found(c, generation, held)) holderBelow = generation;
+      else if (held === true) sealedBelow.push(generation);
+      else if (held === false) clean.add(generation);
+    }
+  }
+  const newest = foundAbove ?? holderBelow;
+  const fenced = newest === void 0 ? [...holdersAbove, ...sealedBelow] : holdersAbove;
+  if (newest === void 0 && fenced.length === 0) return notMember;
+  const sweeping = newest !== void 0;
+  let moved = null;
+  let byName = fenced;
+  let sweep = sweeping;
+  let ledgered = true;
+  let past = false;
+  if (sweeping || fenced.length > 0) {
+    const made = await fence(c, { byName: fenced, sweeps: sweeping });
+    moved = made.moved;
+    byName = made.byName;
+    sweep = made.sweep;
+    ledgered = made.ledger;
+    past = made.past === true;
+  }
+  const swept = sweep ? await collectBelowPointer(ref, deps, { keep: 0, skipKnown: true }) : { deleted: [] };
+  const collected = [...swept.deleted];
+  let missing = swept.missing;
+  if (sweep && missing === void 0 && (moved === null || past)) {
+    const again = await collectAgain(
+      c,
+      { spared: swept.knownSpared ?? [], ledgered },
+      { byName: past ? fenced : [] }
     );
-    if (holder === void 0) return { ...base, erased: false, reason: "destroyed", collected: [] };
-    const collected2 = await gcOrphanGenerations(ref, deps, { keep: 0 });
-    const left2 = await holderLeft(/* @__PURE__ */ new Set());
-    if (left2 !== void 0) throw cannotRemove(left2);
-    return collectedAll(holder.generation, collected2);
-  };
-  const notInCurrent = async () => {
-    const notMember = {
+    collected.push(...again.deleted);
+    missing = again.missing;
+    if (again.moved !== null && again.moved !== "absent") {
+      moved = again.moved;
+    }
+  }
+  if (byName.length > 0 && missing === void 0) {
+    const deleted = await deleteFenced(c, byName, moved);
+    collected.push(...deleted.deleted);
+    moved = deleted.moved;
+    missing = deleted.missing;
+  }
+  const left = await holderLeft(c, clean);
+  if (missing !== void 0) notePointerOnDeleted(c, missing);
+  if (left === void 0) {
+    if (newest !== void 0) return collectedAll(c, newest, collected);
+    return sealedOnly(c, notMember, collected);
+  }
+  if (moved !== null || missing !== void 0) {
+    return {
       ...base,
       erased: false,
-      reason: "not-member",
-      fromGeneration: from,
-      collected: []
+      reason: moved ?? "superseded",
+      fromGeneration: newest ?? from,
+      collected
     };
-    const newestFirst = (await generationsOf(deps.storage, ref)).filter((g) => g !== from).reverse();
-    if (newestFirst.length === 0) return notMember;
-    const clean = /* @__PURE__ */ new Set([from]);
-    const holdersAbove = [];
-    for (const { generation: generation2, held } of await holdsEach(
-      newestFirst.filter((g) => g > from),
-      { stopAtHolder: false }
-    )) {
-      if (held === true) holdersAbove.push(generation2);
-      else if (held === false) clean.add(generation2);
-    }
-    const foundAbove = holdersAbove.find((generation2) => !sealed.has(generation2));
-    let holderBelow;
-    const sealedBelow = [];
-    if (foundAbove === void 0) {
-      for (const { generation: generation2, held } of await holdsEach(
-        newestFirst.filter((g) => g < from),
-        { stopAtHolder: true }
-      )) {
-        if (found(generation2, held)) holderBelow = generation2;
-        else if (held === true) sealedBelow.push(generation2);
-        else if (held === false) clean.add(generation2);
-      }
-    }
-    const newest = foundAbove ?? holderBelow;
-    const fenced = newest === void 0 ? [...holdersAbove, ...sealedBelow] : holdersAbove;
-    if (newest === void 0 && fenced.length === 0) return notMember;
-    const sweeping = newest !== void 0;
-    let moved = null;
-    let byName = fenced;
-    let sweep = sweeping;
-    let ledgered = true;
-    let past = false;
-    if (sweeping || fenced.length > 0) {
-      const made = await fence({ byName: fenced, sweeps: sweeping });
-      moved = made.moved;
-      byName = made.byName;
-      sweep = made.sweep;
-      ledgered = made.ledger;
-      past = made.past === true;
-    }
-    const swept2 = sweep ? await collectBelowPointer(ref, deps, { keep: 0, skipKnown: true }) : { deleted: [] };
-    const collected2 = [...swept2.deleted];
-    let missing2 = swept2.missing;
-    if (sweep && missing2 === void 0 && (moved === null || past)) {
-      const again = await collectAgain(
-        { spared: swept2.knownSpared ?? [], ledgered },
-        { byName: past ? fenced : [] }
-      );
-      collected2.push(...again.deleted);
-      missing2 = again.missing;
-      if (again.moved !== null && again.moved !== "absent" && again.moved !== "no-generation") {
-        moved = again.moved;
+  }
+  throw cannotRemove(c, left);
+}
+async function stage(c) {
+  const {
+    ref,
+    deps,
+    chunkKey,
+    remainder,
+    codec,
+    maxBytes,
+    base,
+    record,
+    from,
+    aead,
+    fromKey,
+    read
+  } = c;
+  let written;
+  const described = usableSummary(ref, record, aead);
+  try {
+    const reader = await read(
+      () => openGenerationReader(deps.storage, fromKey, cryptoAt(c, from), {}, described?.fingerprint)
+    );
+    const bytes = await read(() => reader.getChunk(chunkKey));
+    if (bytes === null) return await notInCurrent(c);
+    const target = codec.safeDeserialize(bytes, maxBytes);
+    assertRemaindersInRange(target, chunkKey);
+    if (!target.has(remainder)) return await notInCurrent(c);
+    target.remove(remainder);
+    assertRegistryCanWrite(deps.registry, "eraseIdFromSegment");
+    const generation = await nextGeneration(ref, deps);
+    const key = { ...base, generation };
+    const metadata = metadataToCarry(reader.metadata, aead === void 0 ? void 0 : described);
+    const tally = await writeCrbmGenerationStream(
+      deps.storage,
+      key,
+      rewrite(reader, chunkKey, target, codec, maxBytes, read),
+      {
+        crypto: cryptoAt(c, generation),
+        clock: deps.clock,
+        metadata,
+        entropy: deps.entropy
       }
-    }
-    if (byName.length > 0 && missing2 === void 0) {
-      const deleted = await deleteFenced(byName, moved);
-      collected2.push(...deleted.deleted);
-      moved = deleted.moved;
-      missing2 = deleted.missing;
-    }
-    const left2 = await holderLeft(clean);
-    if (missing2 !== void 0) notePointerOnDeleted(missing2);
-    if (left2 === void 0) {
-      if (newest !== void 0) return collectedAll(newest, collected2);
-      return sealedOnly(notMember, collected2);
-    }
-    if (moved !== null || missing2 !== void 0) {
-      return {
-        ...base,
-        erased: false,
-        reason: moved ?? "superseded",
-        fromGeneration: newest ?? from,
-        collected: collected2
-      };
-    }
-    throw cannotRemove(left2);
-  };
-  let rewrote;
-  const stage = async () => {
-    let written;
-    const described = usableSummary(ref, record, aead);
+    );
+    written = generation;
+    c.rewrote = { generation, fingerprint: tally.fingerprint };
+    const beforeVerify = await deps.registry.get(ref);
+    const early = rowVerdict(c, beforeVerify, ["knownGens"]);
+    if (early !== null) return refusedResult(c, early, written);
+    await read(
+      () => verifyGeneration(deps.storage, key, { ...tally, metadata }, cryptoAt(c, generation))
+    );
+    const summary = ownSummary(
+      ref,
+      generation,
+      {
+        cardinality: tally.cardinality,
+        metadata,
+        fingerprint: tally.fingerprint,
+        tailBytes: tally.tailBytes
+      },
+      aead
+    );
+    return { generation, key, fingerprint: tally.fingerprint, summary };
+  } catch (err) {
+    if (!isNotFoundError(err)) throw err;
+    let now;
     try {
-      const reader = await read(
-        () => openGenerationReader(deps.storage, fromKey, cryptoAt(from), {}, described?.fingerprint)
-      );
-      const bytes = await read(() => reader.getChunk(chunkKey));
-      if (bytes === null) return await notInCurrent();
-      const target = codec.safeDeserialize(bytes, maxBytes);
-      assertRemaindersInRange(target, chunkKey);
-      if (!target.has(remainder)) return await notInCurrent();
-      target.remove(remainder);
-      assertRegistryCanWrite(deps.registry, "eraseIdFromSegment");
-      const generation2 = await nextGeneration(ref, deps);
-      const key2 = { ...base, generation: generation2 };
-      const metadata = metadataToCarry(reader.metadata, aead === void 0 ? void 0 : described);
-      const tally = await writeCrbmGenerationStream(
-        deps.storage,
-        key2,
-        rewrite(reader, chunkKey, target, codec, maxBytes, read),
-        { crypto: cryptoAt(generation2), clock: deps.clock, metadata }
-      );
-      written = generation2;
-      rewrote = { generation: generation2, fingerprint: tally.fingerprint };
-      const beforeVerify = await deps.registry.get(ref);
-      const early = rowVerdict(beforeVerify, ["knownGens"]);
-      if (early !== null) return refused(early, written);
-      await read(
-        () => verifyGeneration(deps.storage, key2, { ...tally, metadata }, cryptoAt(generation2))
-      );
-      const summary2 = ownSummary(
-        ref,
-        generation2,
-        {
-          cardinality: tally.cardinality,
-          metadata,
-          fingerprint: tally.fingerprint,
-          tailBytes: tally.tailBytes
-        },
-        aead
-      );
-      return { generation: generation2, key: key2, fingerprint: tally.fingerprint, summary: summary2 };
-    } catch (err) {
-      if (!isNotFoundError(err)) throw err;
-      let now;
-      try {
-        now = await deps.registry.get(ref);
-      } catch {
-        throw err;
-      }
-      const verdict = rowVerdict(now);
-      if (verdict !== null) return refused(verdict, written);
+      now = await deps.registry.get(ref);
+    } catch {
       throw err;
     }
-  };
-  const discardRefused = async (own) => {
-    const key2 = { ...base, generation: own.generation };
-    const renewal = rowRenewal(ref, deps);
-    const churn = leaseChurn({ clock: deps.clock, rng: renewal.rng });
-    let row = await deps.registry.get(ref);
-    for (let attempts = 1; ; attempts++) {
-      if (row !== null && row.status === "destroyed") {
-        await deps.storage.delete(key2);
-        return row;
-      }
-      if (row === null || row.status !== "active" || row.currentGen === null) return row;
-      if (row.currentGen <= from || row.currentGen >= own.generation) return row;
-      const proven = await provenObject(deps.storage, key2, own.fingerprint);
-      if (proven === null) return row;
-      const renewed = await renewal.renew(row);
-      if ("row" in renewed) {
-        try {
-          await deps.storage.delete(key2, { ifVersion: proven.version });
-        } catch (err) {
-          if (!isWriteConflictError(err)) throw err;
-        }
-        return row;
+    const verdict = rowVerdict(c, now);
+    if (verdict !== null) return refusedResult(c, verdict, written);
+    throw err;
+  }
+}
+async function discardRefused(c, own) {
+  const { ref, deps, base, from } = c;
+  const key = { ...base, generation: own.generation };
+  const renewal = rowRenewal(ref, deps);
+  const churn = leaseChurn({ clock: deps.clock, rng: renewal.rng });
+  let row = await deps.registry.get(ref);
+  for (let attempts = 1; ; attempts++) {
+    if (row !== null && row.status === "destroyed") {
+      await deps.storage.delete(key);
+      return row;
+    }
+    if (row === null || row.status !== "active" || row.currentGen === null) return row;
+    if (row.currentGen <= from || row.currentGen >= own.generation) return row;
+    const proven = await provenObject(deps.storage, key, own.fingerprint);
+    if (proven === null) return row;
+    const renewed = await renewal.renew(row);
+    if ("row" in renewed) {
+      try {
+        await deps.storage.delete(key, { ifVersion: proven.version });
+      } catch (err) {
+        if (!isWriteConflictError(err)) throw err;
       }
-      const settled2 = await churn.settle(row, renewed.lost, () => deps.registry.get(ref), [
-        "pointerId"
-      ]);
-      if (settled2 === void 0 && attempts >= DISCARD_ATTEMPTS) return renewed.lost;
-      if (settled2 !== void 0) attempts -= 1;
-      row = settled2 === void 0 ? renewed.lost : settled2.row;
-    }
-  };
-  if (tombstoned) return await underTombstone();
-  if (pointerless) return await unpublished();
-  const staged = await stage();
-  if ("erased" in staged) {
-    if (!staged.erased && staged.generation !== void 0 && rewrote !== void 0) {
-      await discardRefused(rewrote);
+      return row;
     }
-    return staged;
+    const settled2 = await churn.settle(row, renewed.lost, () => deps.registry.get(ref), [
+      "pointerId"
+    ]);
+    if (settled2 === void 0 && attempts >= DISCARD_ATTEMPTS) return renewed.lost;
+    if (settled2 !== void 0) attempts -= 1;
+    row = settled2 === void 0 ? renewed.lost : settled2.row;
   }
+}
+async function finishRewrite(c, staged) {
+  const { ref, deps, audit, base, record, from, fromToken } = c;
   const { generation, key, fingerprint, summary } = staged;
   const published = await publishGeneration(deps.registry, key, {
     expectFrom: from,
@@ -10465,18 +10592,18 @@ async function eraseOnce(ref, id, deps, options, seen) {
     clearLeases: true,
     // A write that ends without an answer is settled by reading the row: a registry that reports its writes' tokens
     // settles it by the row's `pointerId`; any other takes a pointer at this number for this rewrite's only over an
-    // object whose footer matches what it wrote, so one of other bytes cannot pass for it, and one of the same bytes
-    // holds the rewrite's content.
+    // object whose footer matches what it wrote, which carries this rewrite's own write identity, so another write's
+    // object cannot pass for it.
     holdsOwnObject: () => provesOwnObject(deps.storage, key, fingerprint),
     clock: deps.clock,
     rng: deps.rng ?? deps.readRetry?.rng
   });
   if (!published) {
-    const now = await discardRefused({ generation, fingerprint });
+    const now = await discardRefused(c, { generation, fingerprint });
     return {
       ...base,
       erased: false,
-      reason: rowVerdict(now) ?? "superseded",
+      reason: rowVerdict(c, now) ?? "superseded",
       fromGeneration: from,
       generation,
       collected: []
@@ -10498,6 +10625,7 @@ async function eraseOnce(ref, id, deps, options, seen) {
   let missing;
   if (missing === void 0 && (swept.knownSpared?.length ?? 0) > 0) {
     const again = await collectAgain(
+      c,
       { spared: swept.knownSpared ?? [], ledgered: true },
       { byName: [], below: generation }
     );
@@ -10507,10 +10635,25 @@ async function eraseOnce(ref, id, deps, options, seen) {
   if (missing !== void 0) {
     throw pointerOnDeletedError(ref, { kind: "erasure" }, missing);
   }
-  const left = await holderLeft(/* @__PURE__ */ new Set([generation]));
-  if (left !== void 0) throw cannotRemove(left);
+  const left = await holderLeft(c, /* @__PURE__ */ new Set([generation]));
+  if (left !== void 0) throw cannotRemove(c, left);
   return { ...base, erased: true, fromGeneration: from, generation, collected };
 }
+async function resolveDek(ref, deps, record, row) {
+  if (row.tombstoned) return void 0;
+  if (record.wrappedDeks !== void 0 && record.wrappedDeks.length > 0) {
+    if (deps.keystore === void 0) {
+      throw new KeyUnavailableError(
+        `segment "${ref.segment}" is encrypted but eraseIdFromSegment has no keystore`
+      );
+    }
+    return await deps.keystore.openDek(record.wrappedDeks);
+  }
+  if (!row.pointerless && deps.requireEncryption === true) {
+    throw new ValidationError(`requireEncryption: segment "${ref.segment}" is cleartext`);
+  }
+  return void 0;
+}
 function noticingIndex(crypto, index) {
   const indexAad = crypto.aadFor("index");
   return {
@@ -10828,7 +10971,7 @@ async function setSegmentRetention(ref, deps, policy) {
     {
       attempts: RETENTION_CAS_ATTEMPTS,
       contention: () => new WriteConflictError(
-        `setRetention: contention writing the retention policy for segment "${ref.segment}"`
+        `setRetention: contention writing the retention policy for segment "${ref.segment}"${CONTENTION_NEXT_STEP}`
       )
     },
     async (record) => {
@@ -10866,7 +11009,7 @@ async function clearSegmentRetention(ref, deps) {
     {
       attempts: RETENTION_CAS_ATTEMPTS,
       contention: () => new WriteConflictError(
-        `clearRetention: contention clearing the retention policy for segment "${ref.segment}"`
+        `clearRetention: contention clearing the retention policy for segment "${ref.segment}"${CONTENTION_NEXT_STEP}`
       )
     },
     async (record) => {
@@ -10929,7 +11072,8 @@ async function eraseNamespace(namespace, deps, options) {
   }
   const rows = await drainRegistry(deps.registry, {
     namespace,
-    maxScanSegments: options.maxScanSegments ?? DEFAULT_MAX_SCAN_SEGMENTS,
+    // Only an absent value means the default: a `null` or a malformed one is refused, as a malformed `budget` is.
+    maxScanSegments: options.maxScanSegments === void 0 ? DEFAULT_MAX_SCAN_SEGMENTS : options.maxScanSegments,
     op: "eraseNamespace",
     narrowable: false
     // already one namespace: the only remedy is a higher ceiling
@@ -11140,7 +11284,7 @@ async function rowsFromDueIndex(registry, options) {
       if (ref === null) continue;
       if (isReservedNamespace(ref.namespace)) continue;
       if (options.namespace !== void 0 && ref.namespace !== options.namespace) continue;
-      const found = {
+      const found2 = {
         ref: { namespace: pointer.namespace, segment: pointer.segment },
         target: ref,
         token: pointer.token
@@ -11148,26 +11292,29 @@ async function rowsFromDueIndex(registry, options) {
       const key = segmentKey(ref);
       const known = pointers.get(key);
       if (known !== void 0) {
-        known.push(found);
+        known.push(found2);
         continue;
       }
       if (gone.has(key)) {
-        if (litter.length < options.maxScanSegments) litter.push(found);
+        if (litter.length < options.maxScanSegments) litter.push(found2);
         continue;
       }
       if (rows.length >= options.maxScanSegments) {
         throw new BudgetExceededError(
-          `retireExpired: the due index yielded more than ${options.maxScanSegments} segments \u2014 the scan was abandoned there rather than completed. Raise \`maxScanSegments\`, narrow with \`namespace\`, or reduce \`lookbackBuckets\`.`
+          `retireExpired: the due index yielded more than ${options.maxScanSegments} segments \u2014 the scan was abandoned there rather than completed. Raise \`maxScanSegments\`, narrow with \`namespace\`, or reduce \`lookbackBuckets\`.`,
+          // The scan refuses at the first pointer past the bound, before reading it, so `spent` is that pointer
+          // counted with the rows held. A stale pointer counts too, so it can pass the live rows by one.
+          { option: "maxScanSegments", limit: options.maxScanSegments, spent: rows.length + 1 }
         );
       }
       const live = await registry.get(ref);
       if (live === null) {
         if (gone.size < options.maxScanSegments) gone.add(key);
-        if (litter.length < options.maxScanSegments) litter.push(found);
+        if (litter.length < options.maxScanSegments) litter.push(found2);
         continue;
       }
       rows.push(live);
-      pointers.set(key, [found]);
+      pointers.set(key, [found2]);
     }
   }
   return { rows, pointers, litter };
@@ -11193,11 +11340,11 @@ async function rowsFromFleet(registry, options) {
   const litter = [];
   if (held.length === 0) return { rows, pointers, litter };
   const present = new Set(rows.map((rec) => segmentKey(rec)));
-  for (const found of held) {
-    const key = segmentKey(found.target);
-    if (!present.has(key)) litter.push(found);
-    else if (pointers.has(key)) pointers.get(key).push(found);
-    else pointers.set(key, [found]);
+  for (const found2 of held) {
+    const key = segmentKey(found2.target);
+    if (!present.has(key)) litter.push(found2);
+    else if (pointers.has(key)) pointers.get(key).push(found2);
+    else pointers.set(key, [found2]);
   }
   return { rows, pointers, litter };
 }
@@ -11216,8 +11363,8 @@ async function filePurgePointer(registry, ref, purgeAt) {
   } catch {
   }
 }
-async function forgetFoundPointers(registry, found, onFault) {
-  for (const pointer of found) {
+async function forgetFoundPointers(registry, found2, onFault) {
+  for (const pointer of found2) {
     try {
       await registry.delete(pointer.ref, pointer.token);
     } catch (err) {
@@ -11225,10 +11372,10 @@ async function forgetFoundPointers(registry, found, onFault) {
     }
   }
 }
-async function forgetPurgePointers(registry, ref, purgeAt, found, onFault) {
+async function forgetPurgePointers(registry, ref, purgeAt, found2, onFault) {
   if (!canIndex(ref)) return;
   const filed = dueIndexRef(dueBucket(purgeAt), ref);
-  const all = found.some((p) => p.ref.namespace === filed.namespace) ? found : [...found, { ref: filed, target: ref }];
+  const all = found2.some((p) => p.ref.namespace === filed.namespace) ? found2 : [...found2, { ref: filed, target: ref }];
   for (const pointer of all) {
     try {
       await registry.delete(pointer.ref, pointer.token);
@@ -11264,7 +11411,7 @@ function resolveRetireOptions(options) {
   const purgeTombstones = options.purgeTombstones ?? true;
   const grace = options.tombstoneGraceMs ?? DEFAULT_TOMBSTONE_GRACE_MS;
   requireFiniteNumber(grace, { min: 0, what: "retireExpired: `tombstoneGraceMs`" });
-  const maxScanSegments = options.maxScanSegments ?? DEFAULT_MAX_SCAN_SEGMENTS;
+  const maxScanSegments = options.maxScanSegments === void 0 ? DEFAULT_MAX_SCAN_SEGMENTS : options.maxScanSegments;
   requirePositiveInteger(maxScanSegments, "retireExpired: `maxScanSegments`");
   return {
     audit: options.audit,
@@ -11327,13 +11474,13 @@ async function purgeTombstone(rec, ctx) {
   const base = { segment: rec.segment, namespace: rec.namespace };
   const stamp = retirementStamp(rec.retention);
   if (stamp === null) {
-    const found = pointers.get(segmentKey(ref)) ?? [];
-    if (!dryRun && removesRows && found.length > 0 && tally.attemptedForeign < limit) {
+    const found2 = pointers.get(segmentKey(ref)) ?? [];
+    if (!dryRun && removesRows && found2.length > 0 && tally.attemptedForeign < limit) {
       tally.attemptedForeign += 1;
       try {
         const live = await deps.registry.get(ref);
         if (live?.status === "destroyed" && retirementStamp(live.retention) === null) {
-          await forgetFoundPointers(deps.registry, found, tally.noteFault);
+          await forgetFoundPointers(deps.registry, found2, tally.noteFault);
         }
       } catch (err) {
         tally.noteFault(err);
@@ -11555,7 +11702,7 @@ var errorEntry = (rec, error) => ({
   namespace: rec.namespace,
   error: error instanceof Error ? error.message : String(error)
 });
-async function checkSummary(ref, live, deps, found) {
+async function checkSummary(ref, live, deps, found2) {
   const generation = live.currentGen;
   const keyed = live.wrappedDeks !== void 0 && live.wrappedDeks.length > 0;
   let aead;
@@ -11589,7 +11736,7 @@ async function checkSummary(ref, live, deps, found) {
     { namespace: ref.namespace, segment: ref.segment, generation },
     aead === void 0 ? void 0 : { aead, aadFor: (scope) => aadFor(ref, generation, scope) },
     described,
-    found
+    found2
   );
   if (reader !== void 0 && summaryAgrees(described, {
     cardinality: reader.count(),
@@ -11671,11 +11818,11 @@ async function checkCurrentObject(ref, live, deps, summaries) {
   };
   const checksSummary = summaries && live.summary !== void 0;
   if (checksSummary && summaryOpensObject(ref, live)) {
-    let found = false;
+    let found2 = false;
     try {
-      return await checkSummary(ref, live, deps, () => found = true);
+      return await checkSummary(ref, live, deps, () => found2 = true);
     } catch (err) {
-      if (found) throw err;
+      if (found2) throw err;
       if (!await listed(deps.storage, key)) return missing;
       throw err;
     }
@@ -11693,14 +11840,11 @@ async function runConsistencyCheck(deps, options = {}) {
   }
   const concurrency = options.concurrency ?? DEFAULT_CHECK_CONCURRENCY;
   requirePositiveInteger(concurrency, "concurrency");
-  const maxScanSegments = options.maxScanSegments ?? DEFAULT_MAX_SCAN_SEGMENTS;
+  const maxScanSegments = options.maxScanSegments === void 0 ? DEFAULT_MAX_SCAN_SEGMENTS : options.maxScanSegments;
   const recs = await drainRegistry(deps.registry, {
     namespace: options.namespace,
     maxScanSegments,
-    op: "checkConsistency",
-    // Two callers reach this refusal, and only one of them can raise the ceiling: `store.checkConsistency` takes
-    // no `maxScanSegments`, so the advice names the call that does.
-    raise: "raise `maxScanSegments` on `runConsistencyCheck` (`store.checkConsistency` takes no ceiling, so run `runConsistencyCheck({ storage: backend.storage, registry: backend.registry }, { maxScanSegments })` over the same backend instead)"
+    op: "checkConsistency"
   });
   const summaries = options.summaries === true;
   const generations = options.generations === true;
@@ -11886,22 +12030,10 @@ export {
   dropSegment,
   eraseIdFromSegment,
   eraseNamespace,
+  errorKind,
   excludingReservedRows,
   getSegmentRetention,
-  isBudgetExceededError,
-  isCapabilityError,
-  isCloudRoaringError,
-  isIntegrityError,
-  isKeyUnavailableError,
-  isLeaseExpiredError,
-  isLeaseLimitError,
-  isNotFoundError,
-  isStaleOperandError,
   isStorageBackend,
-  isTransientError,
-  isUnsupportedError,
-  isValidationError,
-  isWriteConflictError,
   judgeLoad,
   listGenerations,
   listSegments,