@cloudbitmaps/core 0.22.0 → 0.23.0

package/dist/index.js

@@ -1,10 +1,21 @@
+import {
+  boundedAll,
+  mapWithConcurrency
+} from "./chunk-CGILDXGP.js";
+import {
+  BufferReader,
+  KeptSegmentKeys,
+  chunkKeyUnder,
+  segmentKey,
+  segmentPrefix,
+  shardOf
+} from "./chunk-GKHERVVQ.js";
 import {
   BudgetExceededError,
   CHUNK_COUNT,
   CONTENTION_NEXT_STEP,
   CapabilityError,
   CloudRoaringError,
-  DEFAULT_NAMESPACE,
   DEFAULT_RETRY_POLICY,
   FOOTER_BYTES,
   IntegrityError,
@@ -20,6 +31,7 @@ import {
   MAX_REMAINDER,
   MAX_STORED_KNOWN_GENERATIONS,
   NotFoundError,
+  PORT_KEYS,
   PREAMBLE_BYTES,
   RESERVED_NAMESPACE_PREFIX,
   StaleOperandError,
@@ -31,23 +43,14 @@ import {
   ValidationError,
   WriteConflictError,
   aadFor,
-  applyRegistryPatch,
   ascending,
   assertRegistryCanWrite,
-  boundedAll,
-  brandAsBackend,
-  checkNow,
+  checkRequireEncryption,
   checkedRetryPolicy,
   compactFingerprint,
   copiedMetadata,
-  decodeNameFromPath,
   describingKnown,
-  drawIncarnation,
-  drawWrite,
-  encodeNameForKey,
-  encodeNameForPath,
   encodedNameLength,
-  entropyIsAvailable,
   errorKind,
   fallbackBound,
   fingerprintFor,
@@ -65,6 +68,7 @@ import {
   isReservedNamespace,
   isStorageBackend,
   isTransientError,
+  isUnsettledConflict,
   isValidationError,
   isWriteConflictError,
   jitteredWait,
@@ -72,24 +76,22 @@ import {
   keptWindow,
   knownGensShapeFault,
   leaseChurn,
-  mapWithConcurrency,
   metadataBytes,
   metadataFromBytes,
   metadataToCarry,
-  namespacePathPart,
-  newIncarnationToken,
   nextKnown,
-  nextRegistryToken,
   onlyLeasesDiffer,
   ownSummary,
-  parseRegistryEnvelope,
   pointerIdOf,
+  pointerSetBy,
   pruneKnown,
-  recordFromNew,
+  refusalOfId,
   refuseUnknownOptions,
+  refuseUnknownRefKeys,
   releaseLease,
   renewPointer,
   renewsPointer,
+  requireBool,
   requireFiniteNumber,
   requireInteger,
   requirePositiveInteger,
@@ -97,7 +99,6 @@ import {
   rollbackKnown,
   sameIncarnation,
   sameKeys,
-  serializeRegistryEnvelope,
   sizeOfFingerprint,
   sizePart,
   splitId,
@@ -109,23 +110,20 @@ import {
   validateChunkKey,
   validateChunkKeyOrder,
   validateChunkRef,
-  validateNewRegistryRecord,
-  validateRegistryPatch,
   validateSegmentRef,
   validateUserNamespace,
   validateUserRef,
-  webCryptoEntropy,
   windowOf,
   withRetry
-} from "./chunk-OSU7W2Y3.js";
+} from "./chunk-MVUD4R72.js";
 
 // src/core/budget.ts
 var DEFAULT_BUDGET = { maxRequests: 1e6 };
 function resolveBudget(opt, fallback) {
   if (opt === false) return null;
-  if (opt !== void 0 && opt !== null) {
-    if (typeof opt !== "object" || Array.isArray(opt)) {
-      const got = Array.isArray(opt) ? "an array" : `a ${typeof opt}`;
+  if (opt !== void 0) {
+    if (opt === null || typeof opt !== "object" || Array.isArray(opt)) {
+      const got = opt === null ? "null" : Array.isArray(opt) ? "an array" : `a ${typeof opt}`;
       throw new ValidationError(`budget must be { maxRequests } or false; got ${got}`);
     }
     const unknown = Object.keys(opt).filter(
@@ -137,12 +135,12 @@ function resolveBudget(opt, fallback) {
       );
     }
   }
-  const maxRequests = opt?.maxRequests ?? fallback.maxRequests;
+  const maxRequests = opt?.maxRequests === void 0 ? fallback.maxRequests : opt.maxRequests;
   requirePositiveInteger(maxRequests, "budget.maxRequests");
   return { maxRequests };
 }
 function resolvePerOpBudget(opt, storeBudget) {
-  if (opt === void 0 || opt === null) return storeBudget;
+  if (opt === void 0) return storeBudget;
   return resolveBudget(opt, storeBudget ?? DEFAULT_BUDGET);
 }
 function checkBudget(budget, projectedRequests, op) {
@@ -175,8 +173,9 @@ async function refuseAbsent(op, candidates, limit, exists, nameOf) {
   const absent = candidates.filter((_, i) => !found2[i]);
   if (absent.length === 0) return;
   const named = absent.map((c) => `"${nameOf(c)}"`).join(", ");
+  const [operand, names, does, was, it] = absent.length > 1 ? ["operands", "name segments", "do", "were", "they"] : ["operand", "names a segment", "does", "was", "it"];
   throw new ValidationError(
-    `${op}: operand ${named} names a segment that does not exist or was dropped, so it would contribute nothing \u2014 an exclude would suppress no ids and an include would contribute none. Check the name and the namespace (a segment addressed without its \`namespace\` is a DIFFERENT segment). Pass \`allowAbsentOperands: true\` if you meant it.`
+    `${op}: ${operand} ${named} ${names} that ${does} not exist or ${was} dropped, so ${it} would contribute nothing \u2014 an exclude would suppress no ids and an include would contribute none. Check the name and the namespace (a segment addressed without its \`namespace\` is a DIFFERENT segment). Pass \`allowAbsentOperands: true\` if you meant it.`
   );
 }
 
@@ -389,17 +388,17 @@ var AEAD_TAG_BYTES = 16;
 var DEFAULT_MAX_PAYLOAD_BYTES = DEFAULT_MAX_BITMAP_BYTES + AEAD_NONCE_BYTES + AEAD_TAG_BYTES;
 
 // src/core/id-window.ts
-function assertIdBound(name, bound) {
+function assertIdBound(name, bound, op) {
   if (bound !== void 0 && (!Number.isInteger(bound) || bound < 0 || bound > U32_MAX)) {
-    throw new ValidationError(`${name} must be an integer from 0 to ${U32_MAX}`);
+    throw new ValidationError(`${op}: ${name} must be an integer from 0 to ${U32_MAX}`);
   }
 }
-function windowOf2(range) {
+function windowOf2(range, op) {
   const after = range?.after;
   const through = range?.through;
   if (after === void 0 && through === void 0) return null;
-  assertIdBound("after", after);
-  assertIdBound("through", through);
+  assertIdBound("after", after, op);
+  assertIdBound("through", through, op);
   const lo = after === void 0 ? 0 : after + 1;
   const hi = through ?? U32_MAX;
   if (lo > hi) return "empty";
@@ -525,62 +524,6 @@ var InvalidationScope = class extends InvalidationRecord {
   }
 };
 
-// src/core/keys.ts
-var FIELD = " ";
-var NO_NAMESPACE = "/";
-function segmentKey(ref) {
-  const ns = ref.namespace === void 0 ? NO_NAMESPACE : encodeNameForKey(ref.namespace);
-  return `${ns}${FIELD}${encodeNameForKey(ref.segment)}`;
-}
-function segmentPrefix(ref) {
-  return `${segmentKey(ref)}${FIELD}`;
-}
-var KEPT_SEGMENT_KEYS = 1024;
-var KeptSegmentKeys = class {
-  constructor(encode, max = KEPT_SEGMENT_KEYS) {
-    this.encode = encode;
-    this.max = max;
-  }
-  encode;
-  max;
-  byNamespace = /* @__PURE__ */ new Map();
-  kept = 0;
-  /** The segment's encoded key. */
-  of(ref) {
-    let names = this.byNamespace.get(ref.namespace);
-    const found2 = names?.get(ref.segment);
-    if (found2 !== void 0) return found2;
-    const encoded = this.encode(ref);
-    if (this.kept >= this.max) {
-      this.byNamespace.clear();
-      this.kept = 0;
-      names = void 0;
-    }
-    if (names === void 0) {
-      names = /* @__PURE__ */ new Map();
-      this.byNamespace.set(ref.namespace, names);
-    }
-    names.set(ref.segment, encoded);
-    this.kept += 1;
-    return encoded;
-  }
-  /** How many encoded keys are kept. */
-  get size() {
-    return this.kept;
-  }
-};
-function chunkKeyUnder(prefix, chunkKey, version) {
-  return version === void 0 ? `${prefix}${chunkKey}` : `${prefix}${chunkKey}${FIELD}${version}`;
-}
-function shardOf(key, totalShards) {
-  let h = 2166136261;
-  for (let i = 0; i < key.length; i++) {
-    h ^= key.charCodeAt(i);
-    h = Math.imul(h, 16777619);
-  }
-  return (h >>> 0) % totalShards;
-}
-
 // src/core/audit.ts
 var NOOP_AUDIT = {
   onEvent() {
@@ -613,6 +556,7 @@ function ignoreRejection(returned) {
 }
 var RecordingAuditSink = class {
   recorded = [];
+  /** Records the event, in emission order. */
   onEvent(event) {
     this.recorded.push(event);
   }
@@ -622,6 +566,7 @@ var RecordingAuditSink = class {
       (e) => e.kind === "segment.collect" ? { ...e, collected: [...e.collected] } : { ...e }
     );
   }
+  /** Forgets every recorded event. */
   reset() {
     this.recorded.length = 0;
   }
@@ -667,6 +612,7 @@ var CountingMetricsSink = class _CountingMetricsSink {
     for (const name of OP_NAMES) ops[name] = { count: 0, totalMs: 0 };
     return ops;
   }
+  /** Adds the event to the totals. An `advisory` event is a note, not a quantity, and adds nothing. */
   onEvent(event) {
     switch (event.kind) {
       case "storage.get":
@@ -701,6 +647,7 @@ var CountingMetricsSink = class _CountingMetricsSink {
       }
     }
   }
+  /** A copy of the totals so far, which later events do not change. */
   snapshot() {
     const ops = /* @__PURE__ */ Object.create(null);
     for (const name of OP_NAMES) ops[name] = { ...this.ops[name] };
@@ -712,6 +659,7 @@ var CountingMetricsSink = class _CountingMetricsSink {
       ops
     };
   }
+  /** Sets every total back to zero. */
   reset() {
     this.storage = { gets: 0, bytes: 0, totalMs: 0 };
     this.cache = { hits: 0, misses: 0 };
@@ -1003,7 +951,7 @@ var SegmentEngine = class _SegmentEngine {
     }
   }
   async *iterateRange(seg, range) {
-    const w = windowOf2(range) ?? WHOLE_ID_SPACE;
+    const w = windowOf2(range, "iterate") ?? WHOLE_ID_SPACE;
     if (w === "empty") return;
     const run = await this.planIterate(seg, w);
     try {
@@ -1027,7 +975,7 @@ var SegmentEngine = class _SegmentEngine {
    * 65,536 ids (256 KiB) and is the caller's to keep.
    */
   async *iterateBatches(seg, range) {
-    const w = windowOf2(range);
+    const w = windowOf2(range, "iterate");
     if (w === "empty") return;
     const run = await this.planIterate(seg, w);
     try {
@@ -1167,9 +1115,9 @@ var SegmentEngine = class _SegmentEngine {
    * `after` turn out to be fewer than `n`, and one that cuts its last chunk may read it and yield nothing.
    */
   async *everyNth(seg, n, range) {
-    requirePositiveInteger(n, "n");
+    requirePositiveInteger(n, "everyNth: n");
     const epoch = this.scope.epoch;
-    const w = windowOf2(range);
+    const w = windowOf2(range, "everyNth");
     if (w === "empty") return;
     const span = w ?? WHOLE_ID_SPACE;
     const { loKey, loRem, hiKey, hiRem } = span;
@@ -1207,10 +1155,10 @@ var SegmentEngine = class _SegmentEngine {
     const hits = [];
     let before = 0;
     for (const key of keys) {
-      const skipped = key === loKey && cutsFirst ? below : 0;
-      const size = counts.get(key) - skipped;
+      const skipped2 = key === loKey && cutsFirst ? below : 0;
+      const size = counts.get(key) - skipped2;
       const next = (Math.floor(before / n) + 1) * n;
-      if (next <= before + size) hits.push({ key, index: skipped + next - before - 1 });
+      if (next <= before + size) hits.push({ key, index: skipped2 + next - before - 1 });
       before += size;
     }
     if (hits.length === 0) return;
@@ -1324,33 +1272,30 @@ var SegmentEngine = class _SegmentEngine {
    * for the range's edge, never a chunk the cache holds or another operand's. The reads, the budget, the metric and the
    * errors are the id reads' own.
    */
-  intersectChunks(segs, options) {
-    return this.combineChunks(segs, options?.exclude ?? [], "all", "intersect", options);
+  intersectChunks(segs, options, label) {
+    return this.combineChunks(segs, options?.exclude ?? [], "all", "intersect", options, label);
   }
   /** {@link union}, as chunks: see {@link intersectChunks}. */
-  unionChunks(segs, options) {
-    return this.combineChunks(segs, options?.exclude ?? [], "any", "union", options);
+  unionChunks(segs, options, label) {
+    return this.combineChunks(segs, options?.exclude ?? [], "any", "union", options, label);
   }
   /** {@link andNot}, as chunks: see {@link intersectChunks}. */
-  andNotChunks(seg, excludes, options) {
-    return this.combineChunks([seg], excludes, "all", "andNot", options);
+  andNotChunks(seg, excludes, options, label) {
+    return this.combineChunks([seg], excludes, "all", "andNot", options, label);
   }
   /**
    * Everything a combine decides before it reads a chunk: validation, each operand's keys and generation, the
    * absent-operand refusal, key alignment, the budget and the metric. `null` when the range is empty. The per-id
    * read and the batch read share it, so the two cannot disagree about what is read or charged.
    */
-  async combinePlan(segs, excludeSegs, mode, op, options) {
+  async combinePlan(segs, excludeSegs, mode, op, options, label = op) {
     if (segs.length === 0) {
       throw new ValidationError(`${op} requires at least one segment`);
     }
-    if (op === "andNot" && excludeSegs.length === 0) {
-      throw new ValidationError("andNot requires at least one segment to subtract");
-    }
-    const limit = options?.concurrency ?? DEFAULT_INTERSECT_CONCURRENCY;
-    requirePositiveInteger(limit, "concurrency");
+    const limit = options?.concurrency === void 0 ? DEFAULT_INTERSECT_CONCURRENCY : options.concurrency;
+    requirePositiveInteger(limit, `${label}: concurrency`);
     const budget = resolvePerOpBudget(options?.budget, this.budget);
-    const w = windowOf2(options);
+    const w = windowOf2(options, label);
     if (w === "empty") return null;
     const epoch = this.scope.epoch;
     const [operands, excludes] = await this.combineOperands(segs, excludeSegs, w, -1);
@@ -1412,7 +1357,7 @@ var SegmentEngine = class _SegmentEngine {
     const streams = [];
     const batches = [];
     const streamExcludes = mode === "any" || operands.length === 1;
-    const open4 = (o, wanted) => {
+    const open = (o, wanted) => {
       o.streamed = this.openStreamed(
         o.seg,
         wanted === void 0 ? keys : keys.filter(wanted),
@@ -1424,8 +1369,8 @@ var SegmentEngine = class _SegmentEngine {
       );
       if (o.streamed) streams.push(o.streamed);
     };
-    for (const o of operands) open4(o, mode === "all" ? void 0 : (k) => o.keys.has(k));
-    if (streamExcludes) for (const e of excludes) open4(e, (k) => e.keys.has(k));
+    for (const o of operands) open(o, mode === "all" ? void 0 : (k) => o.keys.has(k));
+    if (streamExcludes) for (const e of excludes) open(e, (k) => e.keys.has(k));
     else {
       const shared = /* @__PURE__ */ new Map();
       for (const e of excludes) this.openBatch(e, moves, limit, batches, shared);
@@ -1541,8 +1486,8 @@ var SegmentEngine = class _SegmentEngine {
     }
   }
   /** The chunk read: the plan every combine shares, then each key's result, cut to the range at its edges. */
-  async *combineChunks(segs, excludeSegs, mode, op, options) {
-    const run = await this.combinePlan(segs, excludeSegs, mode, op, options);
+  async *combineChunks(segs, excludeSegs, mode, op, options, label) {
+    const run = await this.combinePlan(segs, excludeSegs, mode, op, options, label);
     if (run === null) return;
     const { w } = run;
     try {
@@ -1651,8 +1596,8 @@ var SegmentEngine = class _SegmentEngine {
   askBatch(batch, key) {
     if (batch.closed)
       return Promise.reject(new Error("the combine this read belongs to has stopped"));
-    return new Promise((resolve3, reject) => {
-      batch.pending.push({ key, resolve: resolve3, reject });
+    return new Promise((resolve, reject) => {
+      batch.pending.push({ key, resolve, reject });
       batch.held.add(key);
       batch.oldest = Math.min(batch.oldest, batch.window?.slotOf(key) ?? 0);
       if (batch.held.size >= batch.half) this.flushBatch(batch);
@@ -1725,8 +1670,8 @@ var SegmentEngine = class _SegmentEngine {
     const streams = /* @__PURE__ */ new Set();
     const streamKeys = [];
     for (const ask of asks) {
-      const open4 = this.scope.hasOpenRead(this.chunkCacheKey({ ...seg, chunkKey: ask.key }, gen));
-      if (!open4 && streamKeys[streamKeys.length - 1] !== ask.key) {
+      const open = this.scope.hasOpenRead(this.chunkCacheKey({ ...seg, chunkKey: ask.key }, gen));
+      if (!open && streamKeys[streamKeys.length - 1] !== ask.key) {
         streams.add(ask);
         streamKeys.push(ask.key);
       }
@@ -2000,7 +1945,7 @@ var SegmentEngine = class _SegmentEngine {
    * the read listed the segment's keys: the read then lists them again, and caches as a read begun after the call.
    *
    * The decoded-chunk cache is keyed by generation, which handles a *publish* (the new generation misses) but
-   * not a *destruction*: a segment that was erased from, dropped, shredded or retired has no newer generation
+   * not a *destruction*: a segment that was erased from, dropped, destroyed or retired has no newer generation
    * whose key would miss, so its decoded chunks stay resident and keep answering. That is why the erasing
    * process itself could report `erased: true` and then still answer `true` for the same id, out of RAM, with
    * no storage read to intercept.
@@ -2065,8 +2010,8 @@ var SegmentEngine = class _SegmentEngine {
       }
       if (report && this.metricsOn) this.metrics.onEvent({ kind: "cache", hit: false });
     }
-    const open4 = this.scope.openRead(cacheKey);
-    if (open4) return open4;
+    const open = this.scope.openRead(cacheKey);
+    if (open) return open;
     const token = {};
     const entry = { token, read: this.fetchChunk(ref, gen, cacheKey, token) };
     this.scope.beginRead(cacheKey, entry);
@@ -2374,8 +2319,8 @@ async function runExport(reader, registry, sink, options = {}) {
   const ext = format === "roaring" ? ".roaring" : ".ndjson";
   const batchCap = options.ndjsonBatchBytes ?? DEFAULT_NDJSON_BATCH_BYTES;
   const segments = [];
-  const failed = [];
-  const skipped = [];
+  const failed2 = [];
+  const skipped2 = [];
   let totalIds = 0;
   if (typeof reader?.segment !== "function") {
     throw new ValidationError(
@@ -2393,7 +2338,7 @@ async function runExport(reader, registry, sink, options = {}) {
       await writer.abort?.();
     } catch {
     }
-    skipped.push({ segment: ref.segment, namespace: ref.namespace, reason: "destroyed" });
+    skipped2.push({ segment: ref.segment, namespace: ref.namespace, reason: "destroyed" });
   };
   const exportRef = async (ref) => {
     let writer;
@@ -2451,13 +2396,13 @@ async function runExport(reader, registry, sink, options = {}) {
         } catch {
         }
       }
-      failed.push({ segment: ref.segment, namespace: ref.namespace, error: errMessage(err) });
+      failed2.push({ segment: ref.segment, namespace: ref.namespace, error: errMessage(err) });
       return;
     }
     try {
       await writer.close();
     } catch (err) {
-      failed.push({ segment: ref.segment, namespace: ref.namespace, error: errMessage(err) });
+      failed2.push({ segment: ref.segment, namespace: ref.namespace, error: errMessage(err) });
       return;
     }
     segments.push({ segment: ref.segment, namespace: ref.namespace, count, bytes });
@@ -2466,7 +2411,7 @@ async function runExport(reader, registry, sink, options = {}) {
   for await (const rec of registry.list(options.namespace)) {
     if (options.namespace === void 0 && isReservedRow(rec)) continue;
     if (rec.status === "destroyed") {
-      skipped.push({ segment: rec.segment, namespace: rec.namespace, reason: "destroyed" });
+      skipped2.push({ segment: rec.segment, namespace: rec.namespace, reason: "destroyed" });
       continue;
     }
     await exportRef({ segment: rec.segment, namespace: rec.namespace });
@@ -2477,14 +2422,14 @@ async function runExport(reader, registry, sink, options = {}) {
     totalSegments: segments.length,
     totalIds,
     segments,
-    failed,
-    skipped
+    failed: failed2,
+    skipped: skipped2
   };
 }
 
 // src/core/discover.ts
 async function segmentExists(ref, registry) {
-  validateUserRef(ref);
+  validateUserRef(ref, "exists");
   const record = await registry.get(ref);
   return record !== null && record.status !== "destroyed" && record.currentGen !== null;
 }
@@ -2502,1105 +2447,210 @@ async function* listSegments(registry, options = {}) {
   }
 }
 
-// src/drivers/backends.ts
-import { join as join5 } from "node:path";
+// src/core/reader-defaults.ts
+var DEFAULT_CURRENT_GEN_TTL_MS = 2e3;
+var REFRESH_RETRY_MS = 500;
+var DEFAULT_MAX_OPEN_SEGMENTS = 1024;
+var DEFAULT_MAX_OPEN_INDEX_BYTES = 64 * 1024 * 1024;
+var RESOLUTIONS_PER_OPEN_SEGMENT = 8;
+var RESOLUTION_BYTES_DIVISOR = 16;
 
-// src/drivers/memory.ts
-import { createHash } from "node:crypto";
+// src/core/crbm/integrity.ts
+var crbmIntegrity = (message) => new IntegrityError(`${message}; re-load from source or roll back`);
 
-// src/core/blob.ts
-function checkTailLength(maxBytes) {
-  if (!Number.isSafeInteger(maxBytes)) {
-    throw new ValidationError(`invalid tail length ${String(maxBytes)}`);
-  }
-}
-var BufferSink = class {
-  chunks = [];
-  length = 0;
-  write(bytes) {
-    this.chunks.push(new Uint8Array(bytes));
-    this.length += bytes.length;
-    return Promise.resolve();
-  }
-  bytes() {
-    const out = new Uint8Array(this.length);
-    let offset = 0;
-    for (const chunk of this.chunks) {
-      out.set(chunk, offset);
-      offset += chunk.length;
-    }
-    return out;
-  }
-};
-var BufferReader = class {
-  constructor(buffer) {
-    this.buffer = buffer;
-  }
-  buffer;
-  getRange(offset, length) {
-    if (!Number.isInteger(offset) || !Number.isInteger(length) || offset < 0 || length < 0 || offset + length > this.buffer.length) {
-      throw new ValidationError(
-        `range [${offset}, ${offset + length}) out of bounds for ${this.buffer.length}-byte blob`
-      );
-    }
-    return Promise.resolve(this.buffer.subarray(offset, offset + length));
+// src/core/crbm/crc32c.ts
+var TABLES = (() => {
+  const POLY = 2197175160;
+  const t0 = new Uint32Array(256);
+  for (let n = 0; n < 256; n++) {
+    let c = n;
+    for (let k = 0; k < 8; k++) c = c & 1 ? POLY ^ c >>> 1 : c >>> 1;
+    t0[n] = c >>> 0;
   }
-  getTail(maxBytes) {
-    try {
-      checkTailLength(maxBytes);
-    } catch (err) {
-      return Promise.reject(err);
+  const tables = [t0];
+  for (let k = 1; k < 8; k++) {
+    const prev = tables[k - 1];
+    const next = new Uint32Array(256);
+    for (let n = 0; n < 256; n++) {
+      const v = prev[n];
+      next[n] = (v >>> 8 ^ t0[v & 255]) >>> 0;
     }
-    const size = this.buffer.length;
-    const take = Math.min(Math.max(maxBytes, 0), size);
-    return Promise.resolve({ bytes: this.buffer.subarray(size - take), size });
-  }
-};
-
-// src/drivers/memory.ts
-var MemoryRegistryDriver = class {
-  rows = /* @__PURE__ */ new Map();
-  now;
-  entropy;
-  seq = 0;
-  constructor(options = {}) {
-    this.now = options.now ?? (() => Date.now());
-    this.entropy = options.entropy ?? webCryptoEntropy;
-  }
-  nextToken(incarnation) {
-    this.seq += 1;
-    return `${incarnation}.${this.seq}.${drawWrite(this.entropy)}`;
-  }
-  /** `conditionalDelete`: a delete checks the token and removes the row in one step, with no await between. */
-  capabilities() {
-    return entropyIsAvailable(this.entropy) ? { strongRead: true, conditionalDelete: true } : { strongRead: true, canWrite: false, conditionalDelete: true };
-  }
-  /** Every write reports its token to `onToken` before it is applied. */
-  get reportsWriteTokens() {
-    return true;
-  }
-  async get(ref) {
-    validateSegmentRef(ref);
-    const row = this.rows.get(segmentKey(ref));
-    return row ? structuredClone(row) : null;
+    tables.push(next);
   }
-  async create(ref, record, options) {
-    validateSegmentRef(ref);
-    const checked = validateNewRegistryRecord(record);
-    const key = segmentKey(ref);
-    if (this.rows.has(key)) {
-      throw new WriteConflictError(`registry row already exists for segment ${ref.segment}`);
-    }
-    const token = this.nextToken(drawIncarnation(this.entropy));
-    options?.onToken?.(token);
-    this.rows.set(key, structuredClone(recordFromNew(ref, checked, this.now(), token)));
-    return { token };
+  return tables;
+})();
+var T0 = TABLES[0];
+var T1 = TABLES[1];
+var T2 = TABLES[2];
+var T3 = TABLES[3];
+var T4 = TABLES[4];
+var T5 = TABLES[5];
+var T6 = TABLES[6];
+var T7 = TABLES[7];
+function crc32c(bytes, seed = 0) {
+  let crc = (seed ^ 4294967295) >>> 0;
+  let i = 0;
+  const n8 = bytes.length - bytes.length % 8;
+  for (; i < n8; i += 8) {
+    crc ^= bytes[i] | bytes[i + 1] << 8 | bytes[i + 2] << 16 | bytes[i + 3] << 24;
+    crc = (T7[crc & 255] ^ T6[crc >>> 8 & 255] ^ T5[crc >>> 16 & 255] ^ T4[crc >>> 24 & 255] ^ T3[bytes[i + 4]] ^ T2[bytes[i + 5]] ^ T1[bytes[i + 6]] ^ T0[bytes[i + 7]]) >>> 0;
   }
-  /**
-   * A caller's `held` row (see `RegistryWriteOptions`) has no read to spare here: the token is compared with the stored row in the same step
-   * as the write, in memory, so a stale one fails exactly as a lost race does.
-   */
-  async compareAndSwap(ref, expected, patch, options) {
-    validateSegmentRef(ref);
-    const checked = validateRegistryPatch(patch);
-    const key = segmentKey(ref);
-    const existing = this.rows.get(key);
-    if (!existing || existing.token !== expected) {
-      throw new WriteConflictError(`OCC token mismatch for registry row ${ref.segment}`);
-    }
-    const token = this.nextToken(incarnationOf(existing.token));
-    options?.onToken?.(token);
-    this.rows.set(key, structuredClone(applyRegistryPatch(existing, checked, this.now(), token)));
-    return { token };
+  for (; i < bytes.length; i++) {
+    crc = (T0[(crc ^ bytes[i]) & 255] ^ crc >>> 8) >>> 0;
   }
-  async *list(namespace) {
-    if (namespace !== void 0) validateSegmentRef({ segment: "x", namespace });
-    for (const row of this.rows.values()) {
-      if (namespace === void 0 || row.namespace === namespace) yield structuredClone(row);
+  return (crc ^ 4294967295) >>> 0;
+}
+
+// src/core/crbm/plan-reads.ts
+var MAX_COALESCE_GAP_BYTES = 256 * 1024;
+var MAX_COALESCED_READ_BYTES = DEFAULT_MAX_BITMAP_BYTES;
+var MAX_RANGES_IN_FLIGHT = 32;
+function* planChunkReads(extents, region) {
+  let chunks = [];
+  let start = 0;
+  let end = 0;
+  let previousEnd = region.start;
+  for (const extent of extents) {
+    const extentEnd = extent.offset + extent.length;
+    if (!(Number.isSafeInteger(extent.offset) && Number.isSafeInteger(extent.length) && extent.length >= 1 && extent.offset >= previousEnd && extentEnd <= region.end)) {
+      throw crbmIntegrity(`chunk ${extent.key} is not inside the chunk region, in order`);
     }
-  }
-  async delete(ref, expected) {
-    validateSegmentRef(ref);
-    const key = segmentKey(ref);
-    if (expected !== void 0 && this.rows.get(key)?.token !== expected) {
-      throw new WriteConflictError(`OCC token mismatch for registry row ${ref.segment}`);
+    previousEnd = extentEnd;
+    if (chunks.length > 0 && extent.offset - end <= MAX_COALESCE_GAP_BYTES && extentEnd - start <= MAX_COALESCED_READ_BYTES) {
+      chunks.push(extent);
+      end = extentEnd;
+      continue;
     }
-    this.rows.delete(key);
-  }
-};
-var MemoryStorageDriver = class {
-  objects = /* @__PURE__ */ new Map();
-  stored = 0;
-  capabilities() {
-    return {
-      rangeRead: true,
-      maxObjectBytes: Number.MAX_SAFE_INTEGER,
-      conditionalPut: true,
-      conditionalDelete: true
-    };
-  }
-  async putImmutable(key, write) {
-    const k = genObjectKey(key);
-    const sink = new BufferSink();
-    await write(sink);
-    const body = sink.bytes();
-    if (this.objects.has(k)) {
-      throw new WriteConflictError(
-        `generation already exists (write-once): ${key.segment}.${key.generation}`
-      );
+    if (chunks.length > 0) {
+      const done = chunks;
+      chunks = [];
+      yield { offset: start, length: end - start, chunks: done };
     }
-    this.stored += 1;
-    this.objects.set(k, { body, version: String(this.stored) });
-    return { size: body.length, sha256: createHash("sha256").update(body).digest("hex") };
+    chunks.push(extent);
+    start = extent.offset;
+    end = extentEnd;
   }
-  async getRange(key, offset, length) {
-    requireInteger(offset, { min: 0, what: "range offset" });
-    requireInteger(length, { min: 0, what: "range length" });
-    const { body } = this.require(key);
-    if (offset + length > body.length) {
-      throw new ValidationError(
-        `range [${offset}, ${offset + length}) out of bounds for ${body.length}B`
-      );
-    }
-    return body.slice(offset, offset + length);
+  if (chunks.length > 0) yield { offset: start, length: end - start, chunks };
+}
+
+// src/core/crbm/varint.ts
+var U32_CEIL = U32_MAX + 1;
+function varintLength(value) {
+  if (!Number.isInteger(value) || value < 0 || value >= U32_CEIL) {
+    throw new RangeError(`varint value must be a u32; got ${value}`);
   }
-  async getTail(key, maxBytes) {
-    checkTailLength(maxBytes);
-    const { body, version } = this.require(key);
-    const take = Math.min(Math.max(maxBytes, 0), body.length);
-    return { bytes: body.slice(body.length - take), size: body.length, version };
+  if (value < 128) return 1;
+  if (value < 16384) return 2;
+  if (value < 2097152) return 3;
+  if (value < 268435456) return 4;
+  return 5;
+}
+function writeVarintAt(out, pos, value) {
+  varintLength(value);
+  let v = value;
+  let at = pos;
+  while (v > 127) {
+    out[at++] = v & 127 | 128;
+    v >>>= 7;
   }
-  async delete(key, options) {
-    const k = genObjectKey(key);
-    const ifVersion = options?.ifVersion;
-    const stored = this.objects.get(k);
-    if (ifVersion !== void 0 && stored !== void 0 && stored.version !== ifVersion) {
-      throw new WriteConflictError(
-        `generation ${key.segment}.${key.generation} is another object than the version given; not deleted`
-      );
+  out[at++] = v;
+  return at;
+}
+function readVarint(bytes, offset) {
+  let result = 0;
+  let shift = 0;
+  let pos = offset;
+  for (let i = 0; i < 5; i++) {
+    if (pos >= bytes.length) {
+      throw crbmIntegrity("varint truncated past end of buffer");
     }
-    this.objects.delete(k);
-  }
-  async *list(ref) {
-    validateSegmentRef(ref);
-    const prefix = `${segmentKey(ref)} `;
-    for (const k of this.objects.keys()) {
-      if (k.startsWith(prefix)) {
-        yield {
-          namespace: ref.namespace,
-          segment: ref.segment,
-          generation: Number(k.slice(prefix.length))
-        };
-      }
+    const byte = bytes[pos];
+    pos += 1;
+    if (i === 4 && byte > 15) {
+      throw crbmIntegrity("varint exceeds u32 range");
     }
-  }
-  require(key) {
-    const stored = this.objects.get(genObjectKey(key));
-    if (stored === void 0) {
-      throw new NotFoundError(`no such generation: ${key.segment}.${key.generation}`);
+    result = (result | (byte & 127) << shift) >>> 0;
+    if ((byte & 128) === 0) {
+      return { value: result, next: pos };
     }
-    return stored;
+    shift += 7;
   }
-};
-function genObjectKey(key) {
-  validateSegmentRef(key);
-  requireInteger(key.generation, { min: 0, what: "generation" });
-  return `${segmentKey(key)} ${key.generation}`;
+  throw crbmIntegrity("varint exceeds u32 range");
 }
 
-// src/drivers/localfs/storage.ts
-import { constants as FS2 } from "node:fs";
-import { createHash as createHash2 } from "node:crypto";
-import { link, open as open2, readdir as readdir2, unlink as unlink2 } from "node:fs/promises";
-import { dirname as dirname3 } from "node:path";
-
-// src/drivers/localfs/paths.ts
-import { join } from "node:path";
-var MAX_COMPONENT_BYTES = 255;
-var TEMP_SUFFIX_BYTES = 1 + 36 + 4;
-function assertFits(component, extraBytes) {
-  if (component.length + extraBytes > MAX_COMPONENT_BYTES) {
-    throw new ValidationError(
-      `a name is too long for a file name on this backend: the namespace, or the segment with its generation and the temp file's suffix, must fit in ${MAX_COMPONENT_BYTES} bytes once encoded`
-    );
-  }
+// src/core/crbm/reader.ts
+var RETAINED_BYTES_PER_METADATA_BYTE = 2;
+var RETAINED_BYTES_PER_METADATA_KEY = 160;
+var MIN_INDEX_RECORD_BYTES = 4 + CRC32C_BYTES;
+function indexCapacity(indexLength) {
+  return Math.min(65536, Math.floor(indexLength / MIN_INDEX_RECORD_BYTES));
 }
-function assertStorageNamesFit(key) {
-  validateSegmentRef(key);
-  assertFits(namespacePathPart(key.namespace), 0);
-  assertFits(storageObjectFilename(key.segment, key.generation), TEMP_SUFFIX_BYTES);
-}
-function assertRegistryNamesFit(ref) {
-  validateSegmentRef(ref);
-  assertFits(namespacePathPart(ref.namespace), 0);
-  assertFits(`${encodeNameForPath(ref.segment)}${REGISTRY_SUFFIX}`, TEMP_SUFFIX_BYTES);
-}
-function segmentsDir(root, ref) {
-  validateSegmentRef(ref);
-  return join(root, namespacePathPart(ref.namespace), "segments");
-}
-function storageObjectPath(root, key) {
-  validateSegmentRef(key);
-  requireInteger(key.generation, { min: 0, what: "generation" });
-  return join(segmentsDir(root, key), storageObjectFilename(key.segment, key.generation));
-}
-function storageObjectFilename(segment, generation) {
-  return `${encodeNameForPath(segment)}.${generation}.crbm`;
-}
-function parseGeneration(segment, filename) {
-  const prefix = `${encodeNameForPath(segment)}.`;
-  const suffix = ".crbm";
-  if (!filename.startsWith(prefix) || !filename.endsWith(suffix)) return null;
-  const middle = filename.slice(prefix.length, filename.length - suffix.length);
-  if (!/^(0|[1-9]\d*)$/.test(middle)) return null;
-  const gen = Number(middle);
-  return Number.isSafeInteger(gen) ? gen : null;
-}
-var REGISTRY_SUFFIX = ".reg";
-function registryDir(root, namespace) {
-  if (namespace !== void 0) validateSegmentRef({ segment: "x", namespace });
-  return join(root, namespacePathPart(namespace), "registry");
-}
-function registryRowPath(root, ref) {
-  validateSegmentRef(ref);
-  return join(
-    registryDir(root, ref.namespace),
-    `${encodeNameForPath(ref.segment)}${REGISTRY_SUFFIX}`
-  );
+function magicMatches(bytes, offset) {
+  return bytes[offset] === MAGIC[0] && bytes[offset + 1] === MAGIC[1] && bytes[offset + 2] === MAGIC[2] && bytes[offset + 3] === MAGIC[3];
 }
-function parseRegistryRow(filename) {
-  if (!filename.endsWith(REGISTRY_SUFFIX)) return null;
-  const stem = filename.slice(0, filename.length - REGISTRY_SUFFIX.length);
-  const segment = decodeNameFromPath(stem);
-  if (encodeNameForPath(segment) !== stem) return null;
-  try {
-    validateSegmentRef({ segment });
-  } catch {
-    return null;
+function checkSize(tail, size) {
+  if (!Number.isSafeInteger(size) || size < tail.length) {
+    throw crbmIntegrity(`.crbm size is not a byte count its tail fits in: ${size}`);
   }
-  return segment;
 }
-function parseNamespaceDir(entry) {
-  if (entry === DEFAULT_NAMESPACE) return { namespace: void 0 };
-  const namespace = decodeNameFromPath(entry);
-  if (encodeNameForPath(namespace) !== entry) return null;
-  try {
-    validateSegmentRef({ segment: "x", namespace });
-  } catch {
-    return null;
+function checkedFooter(tail, size) {
+  checkSize(tail, size);
+  if (size < PREAMBLE_BYTES + FOOTER_BYTES || tail.length < FOOTER_BYTES) {
+    throw crbmIntegrity(`.crbm too small: ${size}B`);
   }
-  return { namespace };
-}
-
-// src/drivers/localfs/exact-case.ts
-import { readdir, realpath, stat } from "node:fs/promises";
-import { dirname as dirname2, join as join3, parse, relative, resolve, sep } from "node:path";
-
-// src/drivers/localfs/fs-util.ts
-import { constants as FS } from "node:fs";
-import { randomUUID } from "node:crypto";
-import { lstat, mkdir, opendir, open, unlink } from "node:fs/promises";
-import { dirname, join as join2 } from "node:path";
-var isCode = (err, code) => err instanceof Error && err.code === code;
-var isAbsent = (err) => isCode(err, "ENOENT") || isCode(err, "ENOTDIR") || isCode(err, "ENAMETOOLONG");
-var TRANSIENT_FS_CODES = /* @__PURE__ */ new Set(["EBUSY", "EAGAIN", "EMFILE", "ENFILE", "ETIMEDOUT"]);
-var isFsTransient = (err) => err instanceof Error && TRANSIENT_FS_CODES.has(err.code ?? "");
-var mapFsError = (err) => isFsTransient(err) ? new TransientError(`transient filesystem fault: ${err.code}`, { cause: err }) : err;
-var O_NOFOLLOW = FS.O_NOFOLLOW ?? 0;
-var FILE_MODE = 384;
-var DIR_MODE = 448;
-async function fsyncDir(dir) {
-  try {
-    const handle = await open(dir, "r");
-    try {
-      await handle.sync();
-    } finally {
-      await handle.close();
-    }
-  } catch {
+  const footer = tail.subarray(tail.length - FOOTER_BYTES);
+  if (!magicMatches(footer, FOOTER.endMagic)) {
+    throw crbmIntegrity(".crbm end magic mismatch");
   }
-}
-async function writeAll(handle, bytes) {
-  let offset = 0;
-  while (offset < bytes.length) {
-    const { bytesWritten } = await handle.write(bytes, offset, bytes.length - offset);
-    if (bytesWritten <= 0) {
-      throw Object.assign(new Error("a write made no progress: the device is full"), {
-        code: "ENOSPC"
-      });
-    }
-    offset += bytesWritten;
+  const fview = new DataView(footer.buffer, footer.byteOffset, footer.byteLength);
+  const storedFooterCrc = fview.getUint32(FOOTER.footerCrc32c, true);
+  if (crc32c(footer.subarray(0, FOOTER_CRC_COVERAGE)) !== storedFooterCrc) {
+    throw crbmIntegrity(".crbm footer CRC mismatch");
   }
+  return { footer, fview, storedFooterCrc };
 }
-async function makeDirs(dir, top) {
-  if (!parentsMade.has(top)) {
-    await mkdir(dirname(top), { recursive: true });
-    parentsMade.add(top);
-  }
-  await mkdir(dir, { recursive: true, mode: DIR_MODE });
+async function readFooter(blob) {
+  const { bytes: tail, size } = await blob.getTail(FOOTER_BYTES);
+  const { fview, storedFooterCrc } = checkedFooter(tail, size);
+  return {
+    encrypted: (fview.getUint32(FOOTER.flags, true) & FLAG_ENCRYPTED) !== 0,
+    footerCrc: storedFooterCrc
+  };
 }
-var parentsMade = /* @__PURE__ */ new Set();
-var tempPathFor = (finalPath) => `${finalPath}.${randomUUID()}.tmp`;
-var TEMP_NAME = /\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.tmp$/;
-var ORPHAN_TEMP_AGE_MS = 24 * 60 * 60 * 1e3;
-var SWEEP_INTERVAL_MS = 60 * 60 * 1e3;
-var lastSwept = /* @__PURE__ */ new Map();
-async function sweepOrphanTemps(dir, now = Date.now()) {
-  const last = lastSwept.get(dir);
-  if (last !== void 0 && now - last < SWEEP_INTERVAL_MS) return;
-  lastSwept.set(dir, now);
-  try {
-    const entries = await opendir(dir);
-    for await (const entry of entries) {
-      if (!TEMP_NAME.test(entry.name)) continue;
-      const path = join2(dir, entry.name);
-      const info = await lstat(path).catch(() => void 0);
-      if (info?.isFile() === true && info.mtimeMs < now - ORPHAN_TEMP_AGE_MS) {
-        await unlink(path).catch(() => {
-        });
-      }
-    }
-  } catch {
+async function footerSaysEncrypted(blob) {
+  return (await readFooter(blob)).encrypted;
+}
+function readU64(view, offset, field) {
+  const big = view.getBigUint64(offset, true);
+  if (big > BigInt(Number.MAX_SAFE_INTEGER)) {
+    throw crbmIntegrity(`.crbm ${field} ${big} exceeds safe-integer range`);
   }
+  return Number(big);
 }
-
-// src/drivers/localfs/exact-case.ts
-function firstCaseDifference(expected, actual) {
-  const shared = Math.min(expected.length, actual.length);
-  for (let i = 0; i < shared; i++) {
-    const want = expected[i];
-    const have = actual[i];
-    if (want !== have) return want.toLowerCase() === have.toLowerCase() ? i : -1;
-  }
-  return -1;
-}
-var swapCase = (s) => [...s].map((c) => c === c.toLowerCase() ? c.toUpperCase() : c.toLowerCase()).join("");
-var components = (path) => path.split(sep).filter((c) => c !== "");
-function caseVariantError() {
-  return new ValidationError(
-    "names differ only by case on a case-insensitive filesystem: a name that differs only by case from one already stored is the same file here, so it is refused rather than written over"
-  );
+var keepLimits = /* @__PURE__ */ new WeakMap();
+function openCrbmReaderKeeping(blob, options, keepChunkBytesUpTo) {
+  const asked = { ...options };
+  if (keepChunkBytesUpTo !== void 0) keepLimits.set(asked, keepChunkBytesUpTo);
+  return CrbmReader.open(blob, asked);
+}
+function openTailBytes(options) {
+  return Math.max(options.tailBytes ?? DEFAULT_TAIL_BYTES, FOOTER_BYTES);
 }
-var ExactCase = class {
-  constructor(root) {
-    this.root = root;
-  }
-  root;
-  /** `undefined` until the root holds an entry to try; then fixed, as a filesystem does not change its mind. */
-  insensitive;
-  /**
-   * Whether the root's filesystem folds case, learned from an entry already in the root: the entry's name with its
-   * case swapped is the same file or it is not. An empty or absent root holds nothing to alias, so it is not
-   * insensitive yet, and is looked at again on the next call.
-   */
-  async foldsCase() {
-    if (this.insensitive !== void 0) return this.insensitive;
-    let names;
-    try {
-      names = await readdir(this.root);
-    } catch (err) {
-      if (isAbsent(err)) return this.foldsAtAncestor();
-      throw err;
-    }
-    for (const name of names) {
-      const swapped = swapCase(name);
-      if (swapped === name) continue;
-      const own = await stat(join3(this.root, name), { bigint: true }).catch(() => void 0);
-      if (own === void 0) continue;
-      const other = await stat(join3(this.root, swapped), { bigint: true }).catch(() => void 0);
-      this.insensitive = other !== void 0 && other.ino === own.ino && other.dev === own.dev;
-      return this.insensitive;
-    }
-    return this.foldsAtAncestor();
-  }
-  /**
-   * The same question asked of the root's own name, or the nearest existing directory above it, when the root holds
-   * nothing to try: a root with no entries has none to alias yet, but two names created at once still would. Not
-   * remembered, since it is the volume above the root that answers.
-   */
-  async foldsAtAncestor() {
-    let dir = resolve(this.root);
-    for (; ; ) {
-      const top = parse(dir).root;
-      const parts = components(relative(top, dir));
-      let at = parts.length - 1;
-      while (at >= 0 && swapCase(parts[at]) === parts[at]) at--;
-      if (at === -1) return false;
-      const swapped = [...parts];
-      swapped[at] = swapCase(parts[at]);
-      let own;
-      try {
-        own = await stat(dir, { bigint: true });
-      } catch (err) {
-        if (!isAbsent(err)) return false;
-        const parent = dirname2(dir);
-        if (parent === dir) return false;
-        dir = parent;
-        continue;
-      }
-      const other = await stat(join3(top, ...swapped), { bigint: true }).catch(() => void 0);
-      return other !== void 0 && other.ino === own.ino && other.dev === own.dev;
-    }
-  }
-  /** Whether the root's filesystem folds case: names that differ only by case are one file there. */
-  folds() {
-    return this.foldsCase();
-  }
-  /**
-   * `true` when `path` (inside the root) is, on disk, a path whose name differs only by case from the one given:
-   * the deepest part of it that exists is resolved to its real name and compared exactly. A path that does not exist
-   * yet, or that nothing differs from, is `false`.
-   */
-  async differs(path) {
-    if (!await this.foldsCase()) return false;
-    const rootAbs = resolve(this.root);
-    let probe = resolve(path);
-    let real;
-    for (; ; ) {
-      if (probe === rootAbs || !relative(rootAbs, probe) || relative(rootAbs, probe).startsWith("..")) {
-        return false;
-      }
-      try {
-        real = await realpath(probe);
-        break;
-      } catch (err) {
-        if (!isAbsent(err)) throw err;
-        probe = dirname2(probe);
-      }
-    }
-    const realRoot = await realpath(rootAbs).catch(() => void 0);
-    if (realRoot === void 0) return false;
-    const actual = relative(realRoot, real);
-    if (actual.startsWith("..")) return false;
-    return firstCaseDifference(components(relative(rootAbs, probe)), components(actual)) !== -1;
-  }
-  /** Refuse a write to `path` when its real name differs from it only by case. */
-  async refuseVariant(path) {
-    if (await this.differs(path)) throw caseVariantError();
-  }
-};
-
-// src/drivers/localfs/storage.ts
-async function readWhole(handle, key, length, offset) {
-  const buf = new Uint8Array(length);
-  let filled = 0;
-  while (filled < length) {
-    const { bytesRead } = await handle.read(buf, filled, length - filled, offset + filled);
-    if (bytesRead === 0) {
-      throw new IntegrityError(
-        `short read of ${key.segment}.${key.generation}: wanted ${length}B at ${offset}, got ${filled}B`
-      );
-    }
-    filled += bytesRead;
-  }
-  return buf;
-}
-var LocalFsStorageDriver = class {
-  /**
-   * `options.privateRoot` is the directory this one lives under, from which down directories are created private; it
-   * defaults to `root`.
-   */
-  constructor(root, options = {}) {
-    this.root = root;
-    this.options = options;
-    this.exactCase = new ExactCase(root);
-  }
-  root;
-  options;
-  exactCase;
-  capabilities() {
-    return {
-      rangeRead: true,
-      maxObjectBytes: Number.MAX_SAFE_INTEGER,
-      conditionalPut: false,
-      conditionalDelete: false
-    };
-  }
-  async putImmutable(key, write) {
-    const finalPath = storageObjectPath(this.root, key);
-    assertStorageNamesFit(key);
-    await this.exactCase.refuseVariant(finalPath);
-    await makeDirs(dirname3(finalPath), this.options.privateRoot ?? this.root);
-    void sweepOrphanTemps(dirname3(finalPath));
-    const tmpPath = tempPathFor(finalPath);
-    const handle = await open2(
-      tmpPath,
-      FS2.O_CREAT | FS2.O_EXCL | FS2.O_WRONLY | O_NOFOLLOW,
-      FILE_MODE
-    );
-    const hash = createHash2("sha256");
-    let size = 0;
-    const sink = {
-      async write(bytes) {
-        await writeAll(handle, bytes);
-        hash.update(bytes);
-        size += bytes.length;
-      }
-    };
-    try {
-      await write(sink);
-      await handle.sync();
-    } catch (err) {
-      await handle.close().catch(() => {
-      });
-      await unlink2(tmpPath).catch(() => {
-      });
-      throw mapFsError(err);
-    }
-    await handle.close();
-    try {
-      await link(tmpPath, finalPath);
-    } catch (err) {
-      await unlink2(tmpPath).catch(() => {
-      });
-      if (isCode(err, "ENOENT")) {
-        throw new TransientError(
-          `the temporary file of ${key.segment}.${key.generation} was removed mid-write`,
-          {
-            cause: err
-          }
-        );
-      }
-      if (isCode(err, "EEXIST")) {
-        throw new WriteConflictError(
-          `generation already exists (write-once): ${key.segment}.${key.generation}`
-        );
-      }
-      throw mapFsError(err);
-    }
-    await unlink2(tmpPath).catch(() => {
-    });
-    await fsyncDir(dirname3(finalPath));
-    return { size, sha256: hash.digest("hex") };
-  }
-  async getRange(key, offset, length) {
-    requireInteger(offset, { min: 0, what: "range offset" });
-    requireInteger(length, { min: 0, what: "range length" });
-    const handle = await this.openRead(key);
-    try {
-      const { size } = await handle.stat();
-      if (offset + length > size) {
-        throw new ValidationError(
-          `range [${offset}, ${offset + length}) out of bounds for ${size}B`
-        );
-      }
-      return await readWhole(handle, key, length, offset);
-    } finally {
-      await handle.close();
-    }
-  }
-  async getTail(key, maxBytes) {
-    checkTailLength(maxBytes);
-    const handle = await this.openRead(key);
-    try {
-      const { size } = await handle.stat();
-      const take = Math.min(Math.max(maxBytes, 0), size);
-      return { bytes: await readWhole(handle, key, take, size - take), size };
-    } finally {
-      await handle.close();
-    }
-  }
-  /**
-   * Idempotent. Ignores `options.ifVersion`, as `conditionalDelete: false` says: see the note on the class for why it
-   * cannot apply one. The parameter is declared so that a wrapper of this driver can hand the port's options on.
-   */
-  async delete(key, options) {
-    void options;
-    const path = storageObjectPath(this.root, key);
-    if (await this.exactCase.differs(path)) return;
-    await unlink2(path).catch((err) => {
-      if (!isAbsent(err)) throw mapFsError(err);
-    });
-  }
-  async *list(ref) {
-    const dir = segmentsDir(this.root, ref);
-    if (await this.exactCase.differs(dir)) return;
-    let names;
-    try {
-      names = await readdir2(dir);
-    } catch (err) {
-      if (isAbsent(err)) return;
-      throw mapFsError(err);
-    }
-    for (const name of names) {
-      const generation = parseGeneration(ref.segment, name);
-      if (generation !== null) {
-        yield { namespace: ref.namespace, segment: ref.segment, generation };
-      }
-    }
-  }
-  async openRead(key) {
-    const path = storageObjectPath(this.root, key);
-    if (await this.exactCase.differs(path)) {
-      throw new NotFoundError(`no such generation: ${key.segment}.${key.generation}`);
-    }
-    try {
-      return await open2(path, FS2.O_RDONLY | O_NOFOLLOW);
-    } catch (err) {
-      if (isAbsent(err)) {
-        throw new NotFoundError(`no such generation: ${key.segment}.${key.generation}`);
-      }
-      if (isCode(err, "ELOOP")) {
-        throw new NotFoundError(
-          `generation path is a symlink, refusing: ${key.segment}.${key.generation}`
-        );
-      }
-      throw mapFsError(err);
-    }
-  }
-};
-
-// src/drivers/localfs/registry.ts
-import { constants as FS3 } from "node:fs";
-import { open as open3, opendir as opendir2, readdir as readdir3, realpath as realpath2, rename, unlink as unlink3 } from "node:fs/promises";
-import { basename, dirname as dirname4, join as join4, relative as relative2, resolve as resolve2 } from "node:path";
-var DEFAULT_MAX_ROW_BYTES = 1 * 1024 * 1024;
-var rowChains = /* @__PURE__ */ new Map();
-async function rowLockKey(path) {
-  const abs = resolve2(path);
-  const tail = [basename(abs)];
-  let dir = dirname4(abs);
-  for (; ; ) {
-    try {
-      return join4(await realpath2(dir), ...tail);
-    } catch (err) {
-      const parent = dirname4(dir);
-      if (!isAbsent(err) || parent === dir) throw mapFsError(err);
-      tail.unshift(basename(dir));
-      dir = parent;
-    }
-  }
-}
-var LocalFsRegistryDriver = class {
-  constructor(root, options = {}) {
-    this.root = root;
-    this.options = options;
-    this.exactCase = new ExactCase(root);
-    this.now = options.now ?? (() => Date.now());
-    this.entropy = options.entropy ?? webCryptoEntropy;
-  }
-  root;
-  options;
-  now;
-  entropy;
-  exactCase;
-  /**
-   * `conditionalDelete`: a delete reads the row, checks it, and unlinks it under the row's lock, which every writer on
-   * the root in this process takes, so no write can land between the check and the unlink.
-   */
-  capabilities() {
-    return entropyIsAvailable(this.entropy) ? { strongRead: true, conditionalDelete: true } : { strongRead: true, canWrite: false, conditionalDelete: true };
-  }
-  /** Every write reports its token to `onToken` before the row's file is written. */
-  get reportsWriteTokens() {
-    return true;
-  }
-  async get(ref) {
-    const env = await this.readRow(registryRowPath(this.root, ref), ref);
-    return env && !env.deleted ? env.record : null;
-  }
-  async create(ref, record, options) {
-    const checked = validateNewRegistryRecord(record);
-    const path = registryRowPath(this.root, ref);
-    assertRegistryNamesFit(ref);
-    return this.withRowLock(path, async () => {
-      const current = await this.readRow(path, ref);
-      if (current !== null && !current.deleted) {
-        throw new WriteConflictError(`registry row already exists for segment ${ref.segment}`);
-      }
-      const token = newIncarnationToken(this.entropy, current?.record);
-      options?.onToken?.(token);
-      await this.writeRow(path, recordFromNew(ref, checked, this.now(), token));
-      return { token };
-    });
-  }
-  /**
-   * A caller's `held` row (see `RegistryWriteOptions`) has no read to spare here: the row's file is read under its lock and its token compared
-   * there, a local read and no request, so a stale one fails exactly as a lost race does.
-   */
-  async compareAndSwap(ref, expected, patch, options) {
-    const checked = validateRegistryPatch(patch);
-    const path = registryRowPath(this.root, ref);
-    assertRegistryNamesFit(ref);
-    return this.withRowLock(path, async () => {
-      const current = await this.readRow(path, ref);
-      if (current === null || current.deleted || current.record.token !== expected) {
-        throw new WriteConflictError(`OCC token mismatch for registry row ${ref.segment}`);
-      }
-      const token = nextRegistryToken(current.record, this.entropy);
-      options?.onToken?.(token);
-      await this.writeRow(path, applyRegistryPatch(current.record, checked, this.now(), token));
-      return { token };
-    });
-  }
-  async *list(namespace) {
-    for (const ns of await this.namespaceDirs(namespace)) {
-      const dir = registryDir(this.root, ns);
-      if (await this.exactCase.differs(dir)) continue;
-      let entries;
-      try {
-        entries = await opendir2(dir);
-      } catch (err) {
-        if (isAbsent(err)) continue;
-        throw mapFsError(err);
-      }
-      for await (const entry of entries) {
-        const segment = parseRegistryRow(entry.name);
-        if (segment === null) continue;
-        const ref = { namespace: ns, segment };
-        const env = await this.readRow(registryRowPath(this.root, ref), ref);
-        if (env && !env.deleted) yield env.record;
-      }
-    }
-  }
-  async delete(ref, expected) {
-    const path = registryRowPath(this.root, ref);
-    return this.withRowLock(path, async () => {
-      const current = await this.readRow(path, ref);
-      if (expected !== void 0) {
-        if (current === null || current.deleted || current.record.token !== expected) {
-          throw new WriteConflictError(`OCC token mismatch for registry row ${ref.segment}`);
-        }
-      } else if (current === null || current.deleted) {
-        return;
-      }
-      await this.unlinkRow(path);
-    });
-  }
-  /** Remove a row's file and make the removal durable (fsync the directory). */
-  async unlinkRow(path) {
-    try {
-      await unlink3(path);
-    } catch (err) {
-      if (!isCode(err, "ENOENT")) throw mapFsError(err);
-    }
-    await fsyncDir(dirname4(path));
-  }
-  /** Namespaces to scan: just the one requested, or every namespace dir under the root. */
-  async namespaceDirs(namespace) {
-    if (namespace !== void 0) return [namespace];
-    let entries;
-    try {
-      entries = await readdir3(this.root);
-    } catch (err) {
-      if (isCode(err, "ENOENT")) return [];
-      throw mapFsError(err);
-    }
-    const namespaces = [];
-    for (const entry of entries) {
-      const parsed = parseNamespaceDir(entry);
-      if (parsed !== null) namespaces.push(parsed.namespace);
-    }
-    return namespaces;
-  }
-  /** Read the row at `path`, which must be the row of `ref`: one that names another segment is refused. */
-  async readRow(path, ref) {
-    let handle;
-    try {
-      if (await this.exactCase.differs(path)) return null;
-      handle = await open3(path, FS3.O_RDONLY | O_NOFOLLOW);
-    } catch (err) {
-      if (isAbsent(err) || isCode(err, "ELOOP")) return null;
-      throw mapFsError(err);
-    }
-    try {
-      const { size } = await handle.stat();
-      if (size > DEFAULT_MAX_ROW_BYTES) {
-        throw new IntegrityError(`registry row ${size}B exceeds cap ${DEFAULT_MAX_ROW_BYTES}B`);
-      }
-      const text = (await handle.readFile()).toString("utf8");
-      return parseRegistryEnvelope(text, relative2(this.root, path), ref);
-    } finally {
-      await handle.close();
-    }
-  }
-  async writeRow(path, record) {
-    await this.exactCase.refuseVariant(path);
-    await makeDirs(dirname4(path), this.options.privateRoot ?? this.root);
-    void sweepOrphanTemps(dirname4(path));
-    const out = Buffer.from(serializeRegistryEnvelope({ deleted: false, record }), "utf8");
-    if (out.length > DEFAULT_MAX_ROW_BYTES) {
-      throw new ValidationError(
-        `registry row ${out.length}B exceeds cap ${DEFAULT_MAX_ROW_BYTES}B`
-      );
-    }
-    const tmp = tempPathFor(path);
-    let handle;
-    try {
-      handle = await open3(tmp, FS3.O_CREAT | FS3.O_EXCL | FS3.O_WRONLY | O_NOFOLLOW, FILE_MODE);
-    } catch (err) {
-      throw mapFsError(err);
-    }
-    try {
-      await writeAll(handle, out);
-      await handle.sync();
-    } catch (err) {
-      await handle.close().catch(() => {
-      });
-      await unlink3(tmp).catch(() => {
-      });
-      throw mapFsError(err);
-    }
-    await handle.close();
-    await rename(tmp, path).catch(async (err) => {
-      await unlink3(tmp).catch(() => {
-      });
-      if (isCode(err, "ENOENT")) {
-        throw new TransientError("the temporary file of a registry row was removed mid-write", {
-          cause: err
-        });
-      }
-      throw mapFsError(err);
-    });
-    await fsyncDir(dirname4(path));
-  }
-  /** Serialize callbacks for a row so read-modify-write is atomic across every instance in the process. */
-  async withRowLock(path, fn) {
-    const resolved = await rowLockKey(path);
-    const key = await this.exactCase.folds() ? resolved.toLowerCase() : resolved;
-    const prev = rowChains.get(key) ?? Promise.resolve();
-    const result = prev.then(fn, fn);
-    const tail = result.then(
-      () => void 0,
-      () => void 0
-    );
-    rowChains.set(key, tail);
-    void tail.then(() => {
-      if (rowChains.get(key) === tail) rowChains.delete(key);
-    });
-    return result;
-  }
-};
-
-// src/drivers/backends.ts
-var CLOCK_OPTION_KEYS = ["now"];
-var MemoryStorage = class {
-  storage;
-  registry;
-  constructor(options = {}) {
-    refuseUnknownOptions("MemoryStorage", options, CLOCK_OPTION_KEYS);
-    checkNow("MemoryStorage", options.now);
-    this.storage = new MemoryStorageDriver();
-    this.registry = new MemoryRegistryDriver(options.now === void 0 ? {} : { now: options.now });
-    brandAsBackend(this);
-  }
-};
-var LocalFsStorage = class {
-  constructor(root, options = {}) {
-    this.root = root;
-    if (typeof root !== "string" || root.length === 0) {
-      throw new ValidationError(
-        `LocalFsStorage needs a root directory: a non-empty string, got ${root === "" ? "an empty string" : typeof root}`
-      );
-    }
-    refuseUnknownOptions("LocalFsStorage", options, CLOCK_OPTION_KEYS);
-    checkNow("LocalFsStorage", options.now);
-    this.storage = new LocalFsStorageDriver(join5(root, "storage"), { privateRoot: root });
-    this.registry = new LocalFsRegistryDriver(
-      join5(root, "registry"),
-      options.now === void 0 ? { privateRoot: root } : { now: options.now, privateRoot: root }
-    );
-    brandAsBackend(this);
-  }
-  root;
-  storage;
-  registry;
-};
-
-// src/core/reader-defaults.ts
-var DEFAULT_CURRENT_GEN_TTL_MS = 2e3;
-var REFRESH_RETRY_MS = 500;
-var DEFAULT_MAX_OPEN_SEGMENTS = 1024;
-var DEFAULT_MAX_OPEN_INDEX_BYTES = 64 * 1024 * 1024;
-var RESOLUTIONS_PER_OPEN_SEGMENT = 8;
-var RESOLUTION_BYTES_DIVISOR = 16;
-
-// src/core/crbm/integrity.ts
-var crbmIntegrity = (message) => new IntegrityError(`${message}; re-load from source or roll back`);
-
-// src/core/crbm/crc32c.ts
-var TABLES = (() => {
-  const POLY = 2197175160;
-  const t0 = new Uint32Array(256);
-  for (let n = 0; n < 256; n++) {
-    let c = n;
-    for (let k = 0; k < 8; k++) c = c & 1 ? POLY ^ c >>> 1 : c >>> 1;
-    t0[n] = c >>> 0;
-  }
-  const tables = [t0];
-  for (let k = 1; k < 8; k++) {
-    const prev = tables[k - 1];
-    const next = new Uint32Array(256);
-    for (let n = 0; n < 256; n++) {
-      const v = prev[n];
-      next[n] = (v >>> 8 ^ t0[v & 255]) >>> 0;
-    }
-    tables.push(next);
-  }
-  return tables;
-})();
-var T0 = TABLES[0];
-var T1 = TABLES[1];
-var T2 = TABLES[2];
-var T3 = TABLES[3];
-var T4 = TABLES[4];
-var T5 = TABLES[5];
-var T6 = TABLES[6];
-var T7 = TABLES[7];
-function crc32c(bytes, seed = 0) {
-  let crc = (seed ^ 4294967295) >>> 0;
-  let i = 0;
-  const n8 = bytes.length - bytes.length % 8;
-  for (; i < n8; i += 8) {
-    crc ^= bytes[i] | bytes[i + 1] << 8 | bytes[i + 2] << 16 | bytes[i + 3] << 24;
-    crc = (T7[crc & 255] ^ T6[crc >>> 8 & 255] ^ T5[crc >>> 16 & 255] ^ T4[crc >>> 24 & 255] ^ T3[bytes[i + 4]] ^ T2[bytes[i + 5]] ^ T1[bytes[i + 6]] ^ T0[bytes[i + 7]]) >>> 0;
-  }
-  for (; i < bytes.length; i++) {
-    crc = (T0[(crc ^ bytes[i]) & 255] ^ crc >>> 8) >>> 0;
-  }
-  return (crc ^ 4294967295) >>> 0;
-}
-
-// src/core/crbm/plan-reads.ts
-var MAX_COALESCE_GAP_BYTES = 256 * 1024;
-var MAX_COALESCED_READ_BYTES = DEFAULT_MAX_BITMAP_BYTES;
-var MAX_RANGES_IN_FLIGHT = 32;
-function* planChunkReads(extents, region) {
-  let chunks = [];
-  let start = 0;
-  let end = 0;
-  let previousEnd = region.start;
-  for (const extent of extents) {
-    const extentEnd = extent.offset + extent.length;
-    if (!(Number.isSafeInteger(extent.offset) && Number.isSafeInteger(extent.length) && extent.length >= 1 && extent.offset >= previousEnd && extentEnd <= region.end)) {
-      throw crbmIntegrity(`chunk ${extent.key} is not inside the chunk region, in order`);
-    }
-    previousEnd = extentEnd;
-    if (chunks.length > 0 && extent.offset - end <= MAX_COALESCE_GAP_BYTES && extentEnd - start <= MAX_COALESCED_READ_BYTES) {
-      chunks.push(extent);
-      end = extentEnd;
-      continue;
-    }
-    if (chunks.length > 0) {
-      const done = chunks;
-      chunks = [];
-      yield { offset: start, length: end - start, chunks: done };
-    }
-    chunks.push(extent);
-    start = extent.offset;
-    end = extentEnd;
-  }
-  if (chunks.length > 0) yield { offset: start, length: end - start, chunks };
-}
-
-// src/core/crbm/varint.ts
-var U32_CEIL = U32_MAX + 1;
-function writeVarint(out, value) {
-  if (!Number.isInteger(value) || value < 0 || value >= U32_CEIL) {
-    throw new RangeError(`varint value must be a u32; got ${value}`);
-  }
-  let v = value;
-  while (v > 127) {
-    out.push(v & 127 | 128);
-    v >>>= 7;
-  }
-  out.push(v);
-}
-function readVarint(bytes, offset) {
-  let result = 0;
-  let shift = 0;
-  let pos = offset;
-  for (let i = 0; i < 5; i++) {
-    if (pos >= bytes.length) {
-      throw crbmIntegrity("varint truncated past end of buffer");
-    }
-    const byte = bytes[pos];
-    pos += 1;
-    if (i === 4 && byte > 15) {
-      throw crbmIntegrity("varint exceeds u32 range");
-    }
-    result = (result | (byte & 127) << shift) >>> 0;
-    if ((byte & 128) === 0) {
-      return { value: result, next: pos };
-    }
-    shift += 7;
-  }
-  throw crbmIntegrity("varint exceeds u32 range");
-}
-
-// src/core/crbm/reader.ts
-var RETAINED_BYTES_PER_METADATA_BYTE = 2;
-var RETAINED_BYTES_PER_METADATA_KEY = 160;
-var MIN_INDEX_RECORD_BYTES = 4 + CRC32C_BYTES;
-function indexCapacity(indexLength) {
-  return Math.min(65536, Math.floor(indexLength / MIN_INDEX_RECORD_BYTES));
-}
-function magicMatches(bytes, offset) {
-  return bytes[offset] === MAGIC[0] && bytes[offset + 1] === MAGIC[1] && bytes[offset + 2] === MAGIC[2] && bytes[offset + 3] === MAGIC[3];
-}
-function checkSize(tail, size) {
-  if (!Number.isSafeInteger(size) || size < tail.length) {
-    throw crbmIntegrity(`.crbm size is not a byte count its tail fits in: ${size}`);
-  }
-}
-function checkedFooter(tail, size) {
-  checkSize(tail, size);
-  if (size < PREAMBLE_BYTES + FOOTER_BYTES || tail.length < FOOTER_BYTES) {
-    throw crbmIntegrity(`.crbm too small: ${size}B`);
-  }
-  const footer = tail.subarray(tail.length - FOOTER_BYTES);
-  if (!magicMatches(footer, FOOTER.endMagic)) {
-    throw crbmIntegrity(".crbm end magic mismatch");
-  }
-  const fview = new DataView(footer.buffer, footer.byteOffset, footer.byteLength);
-  const storedFooterCrc = fview.getUint32(FOOTER.footerCrc32c, true);
-  if (crc32c(footer.subarray(0, FOOTER_CRC_COVERAGE)) !== storedFooterCrc) {
-    throw crbmIntegrity(".crbm footer CRC mismatch");
-  }
-  return { footer, fview, storedFooterCrc };
-}
-async function readFooter(blob) {
-  const { bytes: tail, size } = await blob.getTail(FOOTER_BYTES);
-  const { fview, storedFooterCrc } = checkedFooter(tail, size);
-  return {
-    encrypted: (fview.getUint32(FOOTER.flags, true) & FLAG_ENCRYPTED) !== 0,
-    footerCrc: storedFooterCrc
-  };
-}
-async function footerSaysEncrypted(blob) {
-  return (await readFooter(blob)).encrypted;
-}
-function readU64(view, offset, field) {
-  const big = view.getBigUint64(offset, true);
-  if (big > BigInt(Number.MAX_SAFE_INTEGER)) {
-    throw crbmIntegrity(`.crbm ${field} ${big} exceeds safe-integer range`);
-  }
-  return Number(big);
-}
-var keepLimits = /* @__PURE__ */ new WeakMap();
-function openCrbmReaderKeeping(blob, options, keepChunkBytesUpTo) {
-  const asked = { ...options };
-  if (keepChunkBytesUpTo !== void 0) keepLimits.set(asked, keepChunkBytesUpTo);
-  return CrbmReader.open(blob, asked);
-}
-function openTailBytes(options) {
-  return Math.max(options.tailBytes ?? DEFAULT_TAIL_BYTES, FOOTER_BYTES);
-}
-var CrbmReader = class _CrbmReader {
-  constructor(blob, objectSize, generation, lineage, totalCardinality, index, servedFromTail, crypto, footerCrc, metadata, metadataWeight, payloadEnd, kept) {
-    this.blob = blob;
-    this.objectSize = objectSize;
-    this.generation = generation;
-    this.lineage = lineage;
-    this.totalCardinality = totalCardinality;
-    this.index = index;
-    this.servedFromTail = servedFromTail;
-    this.crypto = crypto;
-    this.footerCrc = footerCrc;
-    this.metadata = metadata;
-    this.metadataWeight = metadataWeight;
-    this.payloadEnd = payloadEnd;
-    this.kept = kept;
+var CrbmReader = class _CrbmReader {
+  constructor(blob, objectSize, generation, lineage, totalCardinality, index, servedFromTail, crypto, footerCrc, metadata, metadataWeight, payloadEnd, kept) {
+    this.blob = blob;
+    this.objectSize = objectSize;
+    this.generation = generation;
+    this.lineage = lineage;
+    this.totalCardinality = totalCardinality;
+    this.index = index;
+    this.servedFromTail = servedFromTail;
+    this.crypto = crypto;
+    this.footerCrc = footerCrc;
+    this.metadata = metadata;
+    this.metadataWeight = metadataWeight;
+    this.payloadEnd = payloadEnd;
+    this.kept = kept;
   }
   blob;
   objectSize;
@@ -4028,13 +3078,13 @@ var CrbmReader = class _CrbmReader {
    * error.
    */
   readChunks(chunkKeys, options = {}) {
-    const open4 = { window: void 0 };
-    const stream = this.streamChunks(chunkKeys, options, open4);
+    const open = { window: void 0 };
+    const stream = this.streamChunks(chunkKeys, options, open);
     return Object.assign(stream, {
-      settled: () => open4.window?.settle() ?? Promise.resolve()
+      settled: () => open.window?.settle() ?? Promise.resolve()
     });
   }
-  async *streamChunks(chunkKeys, options, open4) {
+  async *streamChunks(chunkKeys, options, open) {
     const width = options.concurrency ?? MAX_RANGES_IN_FLIGHT;
     requirePositiveInteger(width, "concurrency");
     validateChunkKeyOrder(chunkKeys);
@@ -4082,7 +3132,7 @@ var CrbmReader = class _CrbmReader {
       ramp !== false,
       typeof ramp === "number" ? ramp : 1
     );
-    open4.window = window;
+    open.window = window;
     const cur = { range: void 0, at: 0 };
     let last;
     try {
@@ -4587,16 +3637,16 @@ function viaRetry(retry, request) {
   return retry === void 0 ? request() : retry(request);
 }
 function validateRead(ref, keys) {
-  validateUserRef(ref);
+  validateUserRef(ref, "read", PORT_KEYS);
   if (keys.length > 0) validateSegmentRef({ ...ref });
   for (const chunkKey of keys) validateChunkKey(chunkKey);
   validateChunkKeyOrder(keys);
 }
 var Snapshot = class _Snapshot {
-  constructor(resolution, target, open4, prior) {
+  constructor(resolution, target, open, prior) {
     this.resolution = resolution;
     this.target = target;
-    this.open = open4;
+    this.open = open;
     this.prior = prior;
   }
   resolution;
@@ -4607,8 +3657,8 @@ var Snapshot = class _Snapshot {
   onReader;
   opened;
   outcome;
-  static live(resolution, target, open4, prior) {
-    return new _Snapshot(resolution, target, open4, prior);
+  static live(resolution, target, open, prior) {
+    return new _Snapshot(resolution, target, open, prior);
   }
   static eager(reader) {
     const snap = new _Snapshot(void 0, void 0, void 0, void 0);
@@ -4698,6 +3748,11 @@ var CrbmStorageChunkSource = class {
       maxOpenIndexBytes,
       ...readerOptions
     } = options;
+    checkRequireEncryption(requireEncryption);
+    if (maxOpenSegments !== void 0) requirePositiveInteger(maxOpenSegments, "maxOpenSegments");
+    if (maxOpenIndexBytes !== void 0) {
+      requirePositiveInteger(maxOpenIndexBytes, "maxOpenIndexBytes");
+    }
     if (keystore !== void 0 && registry === void 0) {
       throw new CapabilityError(
         "a keystore needs a storage backend \u2014 that is where the wrapped DEKs live. A bare IStorageDriver has no registry to hold them"
@@ -4710,7 +3765,7 @@ var CrbmStorageChunkSource = class {
     this.keystore = keystore;
     this.requireEncryption = requireEncryption ?? false;
     this.readerOptions = readerOptions;
-    if (currentGenTtlMs !== void 0 && currentGenTtlMs !== null) {
+    if (currentGenTtlMs !== void 0) {
       requireFiniteNumber(currentGenTtlMs, {
         min: 0,
         what: "cache.genTtlMs",
@@ -5040,6 +4095,7 @@ var CrbmStorageChunkSource = class {
    * storage side can close the window; with no registry, no clock or `cache.genTtlMs: 0`, nothing bounds it at all.
    */
   invalidate(ref) {
+    validateUserRef(ref, "read", PORT_KEYS);
     const key = segmentKey(ref);
     this.invalidated.invalidate(key);
     this.snapshots.delete(key);
@@ -5109,7 +4165,7 @@ var CrbmStorageChunkSource = class {
    * once the swept one is gone is exactly what a pin taken now should hold. One retry, then propagate.
    */
   async pinGeneration(ref, lease) {
-    validateUserRef(ref);
+    validateUserRef(ref, "read", PORT_KEYS);
     for (let moved = 0; ; moved++) {
       try {
         try {
@@ -5141,7 +4197,7 @@ var CrbmStorageChunkSource = class {
    * of the row's summary against it, since that check is made where the row's own generation is read.
    */
   async pinGenerationAt(ref, at, lease) {
-    validateUserRef(ref);
+    validateUserRef(ref, "read", PORT_KEYS);
     if (typeof at?.fingerprint !== "string")
       throw new ValidationError(
         `a pin of segment "${ref.segment}" needs the fingerprint of the object it names`
@@ -5291,7 +4347,8 @@ var CrbmStorageChunkSource = class {
    * the one read path with no resilience.
    *
    * **`status` is re-checked here**, on every open rather than once at pin time. A pin taken before a
-   * crypto-shred must not keep unwrapping a DEK the shred destroyed; a destroyed segment resolves no generation
+   * crypto-shred must not keep unwrapping a DEK whose wrapping the shred removed; a destroyed segment resolves no
+   * generation
    * for anyone, and a pin's read of one fails. That holds from the pin's next open: a reader already open keeps
    * the key it unwrapped until it is evicted or invalidated.
    *
@@ -5358,7 +4415,7 @@ var CrbmStorageChunkSource = class {
    * object, and the read fails if the generation is now another object.
    */
   async getChunkAt(ref, generation, held) {
-    validateUserRef(ref);
+    validateUserRef(ref, "read", PORT_KEYS);
     const reader = await this.readerAt(ref, generation, held);
     if (reader === null) return null;
     if (held !== void 0 && this.replacedPins.get(this.heldKey(ref, held.version, held.fingerprint)) !== void 0)
@@ -5416,7 +4473,7 @@ var CrbmStorageChunkSource = class {
   }
   /** Chunk keys of a specific generation — the pinned shape read. `held` as for {@link getChunkAt}. */
   async listChunkKeysAt(ref, generation, held) {
-    validateUserRef(ref);
+    validateUserRef(ref, "read", PORT_KEYS);
     const reader = await this.readerAt(ref, generation, held);
     return reader === null ? [] : reader.chunkKeys();
   }
@@ -5425,27 +4482,28 @@ var CrbmStorageChunkSource = class {
    * for {@link getChunkAt}.
    */
   async cardinalitiesAt(ref, generation, held) {
-    validateUserRef(ref);
+    validateUserRef(ref, "read", PORT_KEYS);
     const reader = await this.readerAt(ref, generation, held);
     return reader === null ? null : reader.cardinalities();
   }
   /** Size of a specific generation. `held` as for {@link getChunkAt}. */
   async sizeOfAt(ref, generation, held) {
-    validateUserRef(ref);
+    validateUserRef(ref, "read", PORT_KEYS);
     const reader = await this.readerAt(ref, generation, held);
     return reader === null ? null : { sizeBytes: reader.sizeBytes };
   }
   /**
    * Whether the segment is a registered name at all. With a registry: a row that is not a `destroyed` tombstone,
    * including one with no generation yet (minted by `setRetention` before the first load), which somebody deliberately
-   * created. A tombstone holds nothing, so it answers `false`. Without a registry there is no registration to
+   * created. No generation resolves through a tombstone, so it answers `false`. Without a registry there is no
+   * registration to
    * consult, so the honest answer is whether the bucket holds any generation of it.
    *
    * Deliberately NOT served from the snapshot memo: the memo resolves to `null` for both states this exists to
    * tell apart.
    */
   async exists(ref) {
-    validateUserRef(ref);
+    validateUserRef(ref, "read", PORT_KEYS);
     if (this.registry !== void 0) {
       const row = await this.registry.get(ref);
       return row !== null && row.status !== "destroyed";
@@ -5739,10 +4797,10 @@ var CrbmStorageChunkSource = class {
   async *getChunksAt(ref, generation, keys, held, options) {
     validateRead(ref, keys);
     const retry = options?.retry;
-    const open4 = () => this.readerAt(ref, generation, held);
+    const open = () => this.readerAt(ref, generation, held);
     const segment = segmentKey(ref);
     let since = this.invalidated.epoch;
-    const reader = await viaRetry(retry, open4);
+    const reader = await viaRetry(retry, open);
     if (reader === null) {
       for (const key of keys) yield { key, bytes: null };
       return;
@@ -5755,7 +4813,7 @@ var CrbmStorageChunkSource = class {
         while (await pull.advance()) {
           if (this.invalidated.invalidatedSince(segment, since)) {
             since = this.invalidated.epoch;
-            if (await viaRetry(retry, open4) === null) throw goneUnder(ref, generation);
+            if (await viaRetry(retry, open) === null) throw goneUnder(ref, generation);
           }
           yield pull.take((chunk) => chunk);
         }
@@ -5771,11 +4829,11 @@ var CrbmStorageChunkSource = class {
     }
   }
   async listChunkKeys(ref) {
-    validateUserRef(ref);
+    validateUserRef(ref, "read", PORT_KEYS);
     return this.withFreshSnapshot(ref, (reader) => reader.chunkKeys(), []);
   }
   async sizeOf(ref) {
-    validateUserRef(ref);
+    validateUserRef(ref, "read", PORT_KEYS);
     return this.withFreshSnapshot(
       ref,
       (reader) => ({ sizeBytes: reader.sizeBytes }),
@@ -5783,7 +4841,7 @@ var CrbmStorageChunkSource = class {
     );
   }
   async cardinalities(ref) {
-    validateUserRef(ref);
+    validateUserRef(ref, "read", PORT_KEYS);
     return this.withFreshSnapshot(
       ref,
       (reader) => reader.cardinalities(),
@@ -5804,7 +4862,7 @@ var CrbmStorageChunkSource = class {
    * believed until the next time the object is opened, which holds it against the summary.
    */
   async summary(ref) {
-    validateUserRef(ref);
+    validateUserRef(ref, "read", PORT_KEYS);
     return this.described(
       ref,
       (generation, row) => summaryOfGeneration(generation, row),
@@ -5837,7 +4895,7 @@ var CrbmStorageChunkSource = class {
   }
   /** {@link summary} of a specific generation, from the object a pin holds. `held` as for {@link getChunkAt}. */
   async summaryAt(ref, generation, held) {
-    validateUserRef(ref);
+    validateUserRef(ref, "read", PORT_KEYS);
     const reader = await this.readerAt(ref, generation, held);
     return reader === null ? null : summaryOfGeneration(reader.generation, describe(reader));
   }
@@ -5851,7 +4909,7 @@ var CrbmStorageChunkSource = class {
    * are the generation's the row names, and `checkConsistency` is what finds such a row.
    */
   async stat(ref) {
-    validateUserRef(ref);
+    validateUserRef(ref, "read", PORT_KEYS);
     return this.described(
       ref,
       (generation, row) => ({
@@ -5863,7 +4921,7 @@ var CrbmStorageChunkSource = class {
   }
   /** {@link stat} of a specific generation, from the object a pin holds. `held` as for {@link getChunkAt}. */
   async statAt(ref, generation, held) {
-    validateUserRef(ref);
+    validateUserRef(ref, "read", PORT_KEYS);
     const reader = await this.readerAt(ref, generation, held);
     return reader === null ? null : sizedSummary(reader);
   }
@@ -5885,8 +4943,9 @@ var CrbmStorageChunkSource = class {
    *
    * A *second* NotFound is pathological (GC outrunning resolution) and propagates rather than fabricating an
    * absent answer — never return a wrong result. `ifGone` is returned when the segment has no committed
-   * generation to serve: storage is empty, or the row was dropped or crypto-shredded, in which case reading empty
-   * is the documented outcome rather than a failure.
+   * generation to serve: storage is empty, or the row is destroyed (crypto-shredded, destroyed in the clear or
+   * dropped), in which case
+   * reading empty is the documented outcome rather than a failure.
    *
    * **Bounded to exactly two resolve-and-open round trips.** That is a cost contract, not a detail: the retry
    * re-reads the *registry*, so an unbounded one would hammer the shared, throttle-prone resource in a
@@ -5984,9 +5043,10 @@ var PinnedStorageChunkSource = class {
     this.inner = inner;
     this.pins = pins;
     for (const [key, pin] of pins) {
-      if (pin.generation !== null && (typeof pin.version !== "string" || typeof pin.fingerprint !== "string"))
+      const held = pin;
+      if (held.generation !== null && (typeof held.version !== "string" || typeof held.fingerprint !== "string"))
         throw new ValidationError(
-          `pin for "${key}" names generation ${pin.generation} without its version and object fingerprint`
+          `pin for "${key}" names generation ${held.generation} without its version and object fingerprint`
         );
     }
   }
@@ -6093,6 +5153,7 @@ var PinnedStorageChunkSource = class {
 
 // src/core/cooperative.ts
 var YIELD_EVERY = 1024;
+var YIELD_EVERY_IDS = 1 << 14;
 function yieldEvery(clock, everyN = YIELD_EVERY) {
   if (clock === void 0) return () => null;
   const sleep = clock.sleep;
@@ -6120,6 +5181,51 @@ var ChunkLoadInput = class {
   }
   chunks;
 };
+var sourceErrors = /* @__PURE__ */ new WeakSet();
+function raisedBySource(err) {
+  if (typeof err === "object" && err !== null) sourceErrors.add(err);
+  return err;
+}
+function isSourceError(err) {
+  return typeof err === "object" && err !== null && sourceErrors.has(err);
+}
+var SortedLoadInput = class {
+  constructor(ids) {
+    this.ids = ids;
+  }
+  ids;
+  failure;
+  /** Keep `error` as what the ids raised, unless an earlier one is kept. */
+  fail(error) {
+    this.failure ??= { error };
+  }
+  /** What the load throws for a write that failed with `err`: the error the ids raised, when they raised one. */
+  thrown(err) {
+    return this.failure === void 0 ? err : raisedBySource(this.failure.error);
+  }
+};
+function kindOfOption(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "an array";
+  const kind = typeof value;
+  return kind === "object" || kind === "undefined" ? `an ${kind}` : `a ${kind}`;
+}
+function wantsSorted(sorted) {
+  if (sorted === void 0 || sorted === false) return false;
+  if (sorted !== true) {
+    throw new ValidationError(`sorted must be a boolean; got ${kindOfOption(sorted)}`);
+  }
+  return true;
+}
+function sortedLoadInput(prepared, sorted) {
+  if (!wantsSorted(sorted)) return prepared;
+  if (prepared instanceof DecodedLoadInput) {
+    throw new ValidationError(
+      "sorted: true applies to ids, and this load was given a bitmap ({ serialized }, { bitmap } or a bitmap itself), which is already held whole and is written from its own chunks: leave sorted off"
+    );
+  }
+  return new SortedLoadInput(prepared);
+}
 function tagOf(value) {
   return Object.prototype.toString.call(value).slice(8, -1);
 }
@@ -6204,6 +5310,98 @@ function decodeSerialized(bytes, codec, what = "the buffer") {
   }
 }
 
+// src/core/sorted-chunks.ts
+var NOT_ASCENDING = "lower than the id before it; { sorted: true } takes ids in ascending order (repeats are fine): sort at the source, or leave sorted off";
+var SourceFailed = class extends Error {
+  constructor() {
+    super("the ids of a sorted load raised an error");
+  }
+};
+function sortedChunks(input, codec, clock) {
+  return chunksOf(input, codec, clock);
+}
+function chunkCutter(codec) {
+  const remainders = new Uint32Array(1 << 16);
+  let position = 0;
+  let last = -1;
+  let chunk = -1;
+  let held = 0;
+  const cut = () => ({
+    chunkKey: chunk,
+    bitmap: codec.fromValues(remainders.subarray(0, held))
+  });
+  return {
+    accept(id) {
+      if (!Number.isInteger(id) || id < 0 || id > U32_MAX) {
+        const cause = refusalOfId(id);
+        const positioned = new ValidationError(`ids[${position}]: ${cause.message}`);
+        positioned.cause = cause;
+        throw positioned;
+      }
+      if (id <= last) {
+        if (id < last) throw new ValidationError(`ids[${position}]: ${NOT_ASCENDING}`);
+        position++;
+        return void 0;
+      }
+      last = id;
+      position++;
+      const key = id >>> 16;
+      let closed;
+      if (key !== chunk) {
+        if (held > 0) closed = cut();
+        chunk = key;
+        held = 0;
+      }
+      remainders[held++] = id & 65535;
+      return closed;
+    },
+    rest() {
+      return held > 0 ? cut() : void 0;
+    }
+  };
+}
+async function* chunksOf(input, codec, clock) {
+  const cutter = chunkCutter(codec);
+  const tick = yieldEvery(clock, YIELD_EVERY_IDS);
+  let handing = false;
+  const { ids } = input;
+  try {
+    if (Symbol.asyncIterator in ids) {
+      for await (const id of ids) {
+        const closed = cutter.accept(id);
+        if (closed !== void 0) {
+          handing = true;
+          yield closed;
+          handing = false;
+        }
+        const pause = tick();
+        if (pause !== null) await pause;
+      }
+    } else {
+      for (const id of ids) {
+        const closed = cutter.accept(id);
+        if (closed !== void 0) {
+          handing = true;
+          yield closed;
+          handing = false;
+        }
+        const pause = tick();
+        if (pause !== null) await pause;
+      }
+    }
+    const last = cutter.rest();
+    if (last !== void 0) {
+      handing = true;
+      yield last;
+      handing = false;
+    }
+  } catch (err) {
+    if (handing) throw err;
+    input.fail(err);
+    throw new SourceFailed();
+  }
+}
+
 // src/core/crbm/writer.ts
 var CrbmWriter = class {
   constructor(sink, options) {
@@ -6351,25 +5549,42 @@ var CrbmWriter = class {
     block.set(EXT_MAGIC, sectionsLength + 8);
     return block;
   }
+  /**
+   * The index region: per entry, four varints (key delta, offset gap, length, cardinality) and a fixed 4-byte
+   * little-endian crc32c. A first pass sizes the region exactly, so the bytes are written once into one buffer and no
+   * intermediate array is built.
+   */
   encodeIndex() {
-    const out = [];
+    let size = 0;
     let prevKey = 0;
     let prevEnd = PAYLOAD_START;
     for (const e of this.entries) {
-      writeVarint(out, e.chunkKey - prevKey);
-      writeVarint(out, e.offset - prevEnd);
-      writeVarint(out, e.length);
-      writeVarint(out, e.cardinality);
-      out.push(
-        e.crc32c & 255,
-        e.crc32c >>> 8 & 255,
-        e.crc32c >>> 16 & 255,
-        e.crc32c >>> 24 & 255
-      );
+      size += varintLength(e.chunkKey - prevKey) + varintLength(e.offset - prevEnd) + varintLength(e.length) + varintLength(e.cardinality) + 4;
       prevKey = e.chunkKey;
       prevEnd = e.offset + e.length;
     }
-    return Uint8Array.from(out);
+    const out = new Uint8Array(size);
+    let pos = 0;
+    prevKey = 0;
+    prevEnd = PAYLOAD_START;
+    for (const e of this.entries) {
+      pos = writeVarintAt(out, pos, e.chunkKey - prevKey);
+      pos = writeVarintAt(out, pos, e.offset - prevEnd);
+      pos = writeVarintAt(out, pos, e.length);
+      pos = writeVarintAt(out, pos, e.cardinality);
+      out[pos++] = e.crc32c & 255;
+      out[pos++] = e.crc32c >>> 8 & 255;
+      out[pos++] = e.crc32c >>> 16 & 255;
+      out[pos++] = e.crc32c >>> 24 & 255;
+      prevKey = e.chunkKey;
+      prevEnd = e.offset + e.length;
+    }
+    if (pos !== out.length) {
+      throw new IntegrityError(
+        `the chunk index was sized at ${out.length} bytes and encoded as ${pos}; the index was not written`
+      );
+    }
+    return out;
   }
   buildFooter(indexOffset, indexRegion, indexNonce, indexTag) {
     const encrypted = this.options.crypto !== void 0;
@@ -6451,13 +5666,15 @@ async function writeEncodedChunks(driver, key, chunks, options) {
   let cardinality = 0;
   let identity;
   const { size, sha256 } = await driver.putImmutable(key, async (sink) => {
+    chunkCount = 0;
+    cardinality = 0;
     const writer = new CrbmWriter(sink, {
       generation: key.generation,
       crypto: options.crypto,
       metadata: options.metadata,
       entropy: options.entropy
     });
-    for (const chunk of chunks) {
+    for (const chunk of chunks()) {
       await writer.addChunk(chunk.chunkKey, chunk.payload, chunk.cardinality);
       chunkCount++;
       cardinality += chunk.cardinality;
@@ -6486,24 +5703,42 @@ async function writeCrbmGenerationStream(driver, key, chunks, options) {
   let cardinality = 0;
   const tick = yieldEvery(options.clock);
   let identity;
-  const { size, sha256 } = await driver.putImmutable(key, async (sink) => {
-    const writer = new CrbmWriter(sink, {
-      generation: key.generation,
-      crypto: options.crypto,
-      metadata: options.metadata,
-      entropy: options.entropy
-    });
-    for await (const { chunkKey, bitmap } of chunks) {
-      if (bitmap.isEmpty) continue;
-      bitmap.optimize?.();
-      await writer.addChunk(chunkKey, bitmap.serialize(), bitmap.size);
-      chunkKeys.push(chunkKey);
-      cardinality += bitmap.size;
-      const pause = tick();
-      if (pause !== null) await pause;
+  let runs = 0;
+  let rerun;
+  let firstRun;
+  const put = driver.putImmutable(key, async (sink) => {
+    if (++runs > 1) {
+      rerun = new IntegrityError(
+        `the storage driver ran the write of ${key.segment}.${key.generation} again: its chunks are streamed and can be read once, so nothing was written`
+      );
+      if (firstRun !== void 0) rerun.cause = firstRun.error;
+      throw rerun;
     }
-    await writer.finish();
-    identity = writer.identity;
+    try {
+      const writer = new CrbmWriter(sink, {
+        generation: key.generation,
+        crypto: options.crypto,
+        metadata: options.metadata,
+        entropy: options.entropy
+      });
+      for await (const { chunkKey, bitmap } of chunks) {
+        if (bitmap.isEmpty) continue;
+        bitmap.optimize?.();
+        await writer.addChunk(chunkKey, bitmap.serialize(), bitmap.size);
+        chunkKeys.push(chunkKey);
+        cardinality += bitmap.size;
+        const pause = tick();
+        if (pause !== null) await pause;
+      }
+      await writer.finish();
+      identity = writer.identity;
+    } catch (err) {
+      firstRun = { error: err };
+      throw err;
+    }
+  });
+  const { size, sha256 } = await put.catch((err) => {
+    throw rerun ?? err;
   });
   if (identity === void 0) {
     throw new IntegrityError(
@@ -6567,17 +5802,18 @@ async function publishGenerationKept(registry, key, options) {
   let throughChurn = false;
   let waited;
   let sawUnanswered = false;
+  let readFault;
+  const readAgain = readOf(registry, key, (e) => readFault = e);
+  let tokenReported;
   let lastRecord;
   const sent = registry.reportsWriteTokens === true ? /* @__PURE__ */ new Set() : void 0;
-  const report = sent === void 0 ? void 0 : (token) => void sent.add(token);
+  const report = sent === void 0 ? void 0 : (token) => void (sent.add(token), tokenReported = true);
   for (let attempt = 0; attempt < 5; attempt++) {
     const reused = attempt === 0 && options.row !== void 0;
-    const holdsRow = fresh === void 0;
+    const holdsRow = fresh === void 0 || fresh === waited;
     const record = fresh !== void 0 ? fresh : reused ? options.row ?? null : await registry.get(key);
-    const write = holdsRow || report !== void 0 ? {
-      ...holdsRow ? { held: record } : {},
-      ...report !== void 0 ? { onToken: report } : {}
-    } : void 0;
+    const write = writeOptions(holdsRow ? { held: record } : {}, report);
+    tokenReported = false;
     fresh = void 0;
     unanswered = void 0;
     lastRecord = record;
@@ -6614,7 +5850,7 @@ async function publishGenerationKept(registry, key, options) {
         if (record !== null && held != null && record === waited && onlyLeasesDiffer(held, record, options.expectRowIgnores)) {
           throughChurn = true;
         } else {
-          const settled2 = record === waited ? void 0 : await churn.settle(held, record, () => registry.get(key), options.expectRowIgnores);
+          const settled2 = record === waited ? void 0 : await churn.settle(held, record, readAgain, options.expectRowIgnores);
           if (settled2 !== void 0) {
             waited = settled2.row;
             fresh = settled2.row;
@@ -6642,7 +5878,7 @@ async function publishGenerationKept(registry, key, options) {
         )).token;
       } else if (record.status === "destroyed") {
         throw new ValidationError(
-          `segment "${key.segment}" was destroyed (crypto-shredded) while generation ${key.generation} was being written \u2014 refusing to publish it; the written object is unreadable. Use a new segment.`
+          `segment "${key.segment}" was destroyed while generation ${key.generation} was being written \u2014 refusing to publish it: no generation resolves through a destroyed row. Use a new segment.`
         );
       } else if (record.currentGen === null) {
         refuseCleartextOntoKey(key, record, options.cleartext);
@@ -6690,13 +5926,14 @@ async function publishGenerationKept(registry, key, options) {
       };
     } catch (err) {
       if (isWriteConflictError(err)) {
+        if (isUnsettledConflict(err)) sawUnanswered = noteUnsettled(options);
         failedOn = record;
         if (throughChurn) attempt -= 1;
         continue;
       }
-      if (!isTransientError(err)) throw err;
-      options.onUnanswered?.();
-      sawUnanswered = true;
+      if (!isTransientError(err) || err === readFault) throw err;
+      if (sent !== void 0 && !tokenReported) throw err;
+      sawUnanswered = noteUnsettled(options);
       let now;
       try {
         now = await registry.get(key);
@@ -6740,6 +5977,23 @@ async function publishGenerationKept(registry, key, options) {
     `publishGeneration: contention setting currentGen for ${key.segment}${CONTENTION_NEXT_STEP}`
   );
 }
+function writeOptions(held, onToken) {
+  return held.held === void 0 && onToken === void 0 ? void 0 : { ...held, ...onToken === void 0 ? {} : { onToken } };
+}
+function readOf(registry, key, onFault) {
+  return async () => {
+    try {
+      return await registry.get(key);
+    } catch (err) {
+      onFault(err);
+      throw err;
+    }
+  };
+}
+function noteUnsettled(options) {
+  options.onUnanswered?.();
+  return true;
+}
 var REFUSED = { published: false };
 async function publishGeneration(registry, key, options) {
   return (await publishGenerationKept(registry, key, options)).published;
@@ -6747,7 +6001,7 @@ async function publishGeneration(registry, key, options) {
 async function landedHere(now, before, key, holdsOwnObject, sent) {
   if (now === null || now.status === "destroyed" || now.currentGen !== key.generation) return false;
   if (before !== null && !sameIncarnation(before, now)) return false;
-  if (sent !== void 0) return sent.has(now.pointerId);
+  if (sent !== void 0) return pointerSetBy(now, before, key.generation, sent);
   if (holdsOwnObject === void 0) {
     throw new TransientError(
       `publish of "${key.segment}" generation ${key.generation}: whether its registry write landed could not be settled, since the caller gave no way to tell its own object from another's. Its object is kept; re-run the write, which numbers past it.`
@@ -6768,18 +6022,21 @@ function outcomeUnknown(key, cause) {
 
 // src/core/bulk-load.ts
 var BULK_FLUSH_IDS = 1 << 20;
-var YIELD_EVERY_IDS = 1 << 14;
 async function encodedChunksOfInput(ids, codec, clock) {
-  if (ids instanceof DecodedLoadInput && ids.bitmap.encodeChunks !== void 0) {
+  const { bitmap } = ids instanceof DecodedLoadInput ? ids : { bitmap: void 0 };
+  if (bitmap?.encodeChunks !== void 0) {
     const pause = yieldEvery(clock, 1);
     await pause();
-    const chunks = ids.bitmap.encodeChunks();
+    let first = bitmap.encodeChunks();
     await pause();
-    return chunks;
+    return () => {
+      const chunks = first ?? bitmap.encodeChunks();
+      first = void 0;
+      return chunks;
+    };
   }
-  return encodeEach(
-    await bucketIds(ids instanceof DecodedLoadInput ? ids.bitmap : ids, codec, clock)
-  );
+  const bucketed = await bucketIds(bitmap ?? ids, codec, clock);
+  return () => encodeEach(bucketed);
 }
 async function bucketIds(ids, codec, clock) {
   const byChunk = /* @__PURE__ */ new Map();
@@ -6852,47 +6109,22 @@ function refuseCleartextWhenEncryptionRequired(options, ref, currentGen) {
   }
 }
 async function bulkLoadAhead(driver, ref, ahead, ids, options = {}) {
+  checkRequireEncryption(options.requireEncryption);
   requireKeystoreWhenEncryptionRequired(options);
   const codec = requireCodec(options.codec, "bulkLoadCrbmGeneration");
   const entropy = requireEntropy(options.entropy, "a load");
-  let chunks;
-  if (ids instanceof ChunkLoadInput) {
-    chunks = encodeEach(rangeCheckedAtWrite(await collectChunks(ids, codec, options.clock)));
+  let write;
+  if (ids instanceof SortedLoadInput) {
+    write = (key2, writeOptions2) => writeSorted(driver, key2, ids, codec, writeOptions2);
   } else {
-    chunks = await encodedChunksOfInput(ids, codec, options.clock);
-  }
-  if (options.keystore !== void 0 && options.registry === void 0)
-    throw new ValidationError("an encrypted load requires a registry to store the wrapped DEK");
-  const passed = options.row;
-  const existing = passed !== void 0 && passed !== null && (passed.wrappedDeks === void 0 || passed.wrappedDeks.length === 0) ? passed : options.registry !== void 0 ? await options.registry.get(ref) : null;
-  if (existing?.status === "destroyed") {
-    throw new ValidationError(
-      `segment "${ref.segment}" is destroyed (crypto-shredded) \u2014 refusing to write; use a new segment`
-    );
-  }
-  if (existing?.wrappedDeks !== void 0 && existing.wrappedDeks.length > 0 && options.keystore === void 0) {
-    throw new KeyUnavailableError(
-      `segment "${ref.segment}" is encrypted but this load has no keystore \u2014 refusing to write a cleartext generation onto an encrypted segment. Pass the keystore holding its DEK.`
-    );
+    const chunks = await encodedBeforeTheRow(ids, codec, options.clock);
+    write = (key2, writeOptions2) => writeEncodedChunks(driver, key2, chunks, writeOptions2);
   }
+  const existing = await rowForWrite(ref, options);
   const generation = await ahead.generation;
   const key = { namespace: ref.namespace, segment: ref.segment, generation };
-  let crypto;
-  let newWrapped;
-  if (options.keystore !== void 0) {
-    if (existing?.wrappedDeks !== void 0 && existing.wrappedDeks.length > 0) {
-      const early = ahead.unwrapped;
-      const aead = early !== void 0 && sameKeys(early.wrapped, existing.wrappedDeks) ? await early.aead : await options.keystore.openDek(existing.wrappedDeks);
-      crypto = { aead, aadFor: (scope) => aadFor(key, key.generation, scope) };
-    } else if (existing !== null && existing.currentGen !== null) {
-      refuseCleartextWhenEncryptionRequired(options, ref, existing.currentGen);
-    } else {
-      const minted = await options.keystore.createDek();
-      newWrapped = minted.wrapped;
-      crypto = { aead: minted.aead, aadFor: (scope) => aadFor(key, key.generation, scope) };
-    }
-  }
-  const { size, sha256, chunkCount, cardinality, fingerprint, tailBytes } = await writeEncodedChunks(driver, key, chunks, {
+  const { crypto, newWrapped } = await keyForWrite(existing, key, ahead, options);
+  const { size, sha256, chunkCount, cardinality, fingerprint, tailBytes } = await write(key, {
     crypto,
     clock: options.clock,
     metadata: options.metadata,
@@ -6904,48 +6136,95 @@ async function bulkLoadAhead(driver, ref, ahead, ids, options = {}) {
     { cardinality, metadata: options.metadata, fingerprint, tailBytes },
     crypto?.aead
   );
-  if (options.registry !== void 0 && options.publish !== false) {
-    const published = await publishGenerationKept(options.registry, key, {
-      wrappedDeks: newWrapped,
-      summary,
-      footerCrc: footerCrcOf(fingerprint),
-      cleartext: crypto === void 0,
-      holdsOwnObject: () => provesOwnObject(driver, key, fingerprint),
-      clock: options.clock
+  const result = {
+    size,
+    sha256,
+    chunkCount,
+    cardinality,
+    summary,
+    wrappedDeks: newWrapped,
+    encrypted: crypto !== void 0,
+    fingerprint
+  };
+  if (options.registry === void 0 || options.publish === false) return result;
+  const published = await publishGenerationKept(options.registry, key, {
+    wrappedDeks: newWrapped,
+    summary,
+    footerCrc: footerCrcOf(fingerprint),
+    cleartext: crypto === void 0,
+    holdsOwnObject: () => provesOwnObject(driver, key, fingerprint),
+    clock: options.clock
+  });
+  const becameCurrent = published.published;
+  if (becameCurrent) {
+    safeAudit(options.audit ?? NOOP_AUDIT).onEvent({
+      kind: "segment.publish",
+      namespace: key.namespace,
+      segment: key.segment,
+      ...incarnationField(published.token),
+      generation: key.generation
     });
-    const becameCurrent = published.published;
-    if (becameCurrent) {
-      safeAudit(options.audit ?? NOOP_AUDIT).onEvent({
-        kind: "segment.publish",
-        namespace: key.namespace,
-        segment: key.segment,
-        ...incarnationField(published.token),
-        generation: key.generation
-      });
+  }
+  return { ...result, becameCurrent };
+}
+async function encodedBeforeTheRow(ids, codec, clock) {
+  try {
+    if (ids instanceof ChunkLoadInput) {
+      const chunks = await collectChunks(ids, codec, clock);
+      return () => encodeEach(rangeCheckedAtWrite(chunks));
     }
-    return {
-      size,
-      sha256,
-      chunkCount,
-      cardinality,
-      summary,
-      becameCurrent,
-      wrappedDeks: newWrapped,
-      encrypted: crypto !== void 0,
-      fingerprint
-    };
+    return await encodedChunksOfInput(ids, codec, clock);
+  } catch (err) {
+    throw raisedBySource(err);
+  }
+}
+async function rowForWrite(ref, options) {
+  if (options.keystore !== void 0 && options.registry === void 0)
+    throw new ValidationError("an encrypted load requires a registry to store the wrapped DEK");
+  const passed = options.row;
+  const existing = passed !== void 0 && passed !== null && (passed.wrappedDeks === void 0 || passed.wrappedDeks.length === 0) ? passed : options.registry !== void 0 ? await options.registry.get(ref) : null;
+  if (existing?.status === "destroyed") {
+    throw new ValidationError(
+      `segment "${ref.segment}" is destroyed \u2014 refusing to write: no generation resolves through a destroyed row; use a new segment`
+    );
+  }
+  if (existing?.wrappedDeks !== void 0 && existing.wrappedDeks.length > 0 && options.keystore === void 0) {
+    throw new KeyUnavailableError(
+      `segment "${ref.segment}" is encrypted but this load has no keystore \u2014 refusing to write a cleartext generation onto an encrypted segment. Pass the keystore holding its DEK.`
+    );
+  }
+  return existing;
+}
+async function keyForWrite(existing, key, ahead, options) {
+  if (options.keystore === void 0) return {};
+  if (existing?.wrappedDeks !== void 0 && existing.wrappedDeks.length > 0) {
+    const early = ahead.unwrapped;
+    const aead = early !== void 0 && sameKeys(early.wrapped, existing.wrappedDeks) ? await early.aead : await options.keystore.openDek(existing.wrappedDeks);
+    return { crypto: { aead, aadFor: (scope) => aadFor(key, key.generation, scope) } };
+  }
+  if (existing !== null && existing.currentGen !== null) {
+    refuseCleartextWhenEncryptionRequired(options, key, existing.currentGen);
+    return {};
   }
+  const minted = await options.keystore.createDek();
   return {
-    size,
-    sha256,
-    chunkCount,
-    cardinality,
-    summary,
-    wrappedDeks: newWrapped,
-    encrypted: crypto !== void 0,
-    fingerprint
+    crypto: { aead: minted.aead, aadFor: (scope) => aadFor(key, key.generation, scope) },
+    newWrapped: minted.wrapped
   };
 }
+async function writeSorted(driver, key, input, codec, options) {
+  try {
+    const { chunkKeys, ...written } = await writeCrbmGenerationStream(
+      driver,
+      key,
+      sortedChunks(input, codec, options.clock),
+      options
+    );
+    return { ...written, chunkCount: chunkKeys.length };
+  } catch (err) {
+    throw input.thrown(err);
+  }
+}
 function* rangeCheckedAtWrite(chunks) {
   for (const chunk of chunks) {
     const max = chunk.bitmap.maximum?.();
@@ -7039,7 +6318,84 @@ async function readSeed(storage, ref, row, generation, keep, listed2, leased, re
   return read.filter((e) => e !== void 0);
 }
 
+// src/core/settle.ts
+function writeTokens(registry, onSent) {
+  const sent = registry.reportsWriteTokens === true ? /* @__PURE__ */ new Set() : void 0;
+  return {
+    sent,
+    options: sent === void 0 ? void 0 : {
+      onToken: (token) => {
+        sent.add(token);
+        onSent?.(token);
+      }
+    },
+    wrote: (row) => row !== null && sent !== void 0 && (sent.has(row.token) || sent.has(row.pointerId))
+  };
+}
+var READ_BACK_TRIES = 3;
+async function readBack(read, unanswered, waits = {}) {
+  let last;
+  for (let attempt = 0; attempt < READ_BACK_TRIES; attempt++) {
+    try {
+      return await read();
+    } catch (err) {
+      if (!isTransientError(err)) throw err;
+      last = err;
+    }
+    if (attempt < READ_BACK_TRIES - 1) {
+      await jitteredWait(waits.clock, waits.rng, UNANSWERED_BASE_MS * 2 ** attempt);
+    }
+  }
+  if (unanswered.cause === void 0) unanswered.cause = last;
+  throw unanswered;
+}
+async function deleteSettled(storage, key, options, read = (op) => op(), waits = {}) {
+  try {
+    await storage.delete(key, options);
+    return;
+  } catch (err) {
+    if (!isTransientError(err)) throw err;
+    const tail = await readBack(
+      () => read(() => storage.getTail(key, 0)).then(
+        (t) => t,
+        (readErr) => {
+          if (isNotFoundError(readErr)) return null;
+          throw readErr;
+        }
+      ),
+      err,
+      waits
+    );
+    if (tail === null) return;
+    const version = tail.version;
+    if (options?.ifVersion !== void 0 && version !== void 0 && version !== options.ifVersion) {
+      throw new WriteConflictError(
+        `generation s.${key.generation} is another object than the version given; not deleted`
+      );
+    }
+    throw err;
+  }
+}
+async function rowDeleteSettled(registry, ref, expected, waits = {}) {
+  try {
+    await registry.delete(ref, expected);
+    return;
+  } catch (err) {
+    if (!isTransientError(err) && !isWriteConflictError(err)) throw err;
+    const row = await readBack(() => registry.get(ref), err, waits);
+    if (row === null) return;
+    throw err;
+  }
+}
+
 // src/core/generation-gc.ts
+function deleteGeneration(deps, ref, generation) {
+  const key = { namespace: ref.namespace, segment: ref.segment, generation };
+  return deleteSettled(deps.storage, key, void 0, void 0, {
+    clock: deps.clock,
+    rng: deps.rng
+  });
+}
 var DELETE_SETTLE_WAITS_MS = Object.freeze([250, 500, 1e3]);
 function watchDeletes(deps, ref) {
   const gone = /* @__PURE__ */ new Set();
@@ -7127,19 +6483,44 @@ async function gcOrphanGenerations(ref, deps, options = {}) {
 async function collectBelowPointer(ref, deps, options = {}) {
   const { deleted, missing, knownSpared } = await listingPass(ref, deps, {
     keep: options.keep,
-    skipKnown: options.skipKnown
+    skipKnown: options.skipKnown,
+    incarnation: options.incarnation
   });
   return missing === void 0 ? { deleted, knownSpared } : { deleted, missing, knownSpared };
 }
+function isAskedRow(asked, row) {
+  return asked === void 0 || sameIncarnation(asked, row) && asked.status === "destroyed" === (row.status === "destroyed");
+}
+async function readHeldRow(deps, ref, asked) {
+  const row = await deps.registry.get(ref);
+  if (row === null || isAskedRow(asked, row)) return row;
+  throw refusedOtherRow(ref);
+}
+function quietOf(options) {
+  if (options.quiet === true && options.incarnation !== void 0) {
+    throw new ValidationError("a quiet collection pass cannot be held to a row incarnation");
+  }
+  return options.quiet === true;
+}
+function changedWhileCollecting(ref) {
+  return new WriteConflictError(
+    `segment ${ref.segment} changed incarnation while its generations were being collected`
+  );
+}
+function refusedOtherRow(ref) {
+  return new WriteConflictError(
+    `segment ${ref.segment} is not the row this collection works from: the row was purged and created again, or is no longer of the same kind (a tombstone or an active row), since it was read`
+  );
+}
 async function listingPass(ref, deps, options) {
   const keep = options.keep ?? 1;
-  const quiet = options.quiet === true;
+  const quiet = quietOf(options);
   requireInteger(keep, { min: 0, what: "keep" });
-  const record = await deps.registry.get(ref);
+  const record = await readHeldRow(deps, ref, options.incarnation);
   if (record === null) return { deleted: [] };
   const current = record.currentGen;
   const gens = await generationsOf(deps.storage, ref);
-  const after = await deps.registry.get(ref);
+  const after = await readHeldRow(deps, ref, options.incarnation);
   if (after === null) {
     if (quiet) return { deleted: [] };
     throw new WriteConflictError(`registry row for segment ${ref.segment} was purged mid-pass`);
@@ -7167,11 +6548,10 @@ async function listingPass(ref, deps, options) {
     const ok = record.status === "destroyed" ? still.token === after.token : cutoff === null || still.currentGen !== null && still.currentGen >= cutoff;
     const now = protect === void 0 ? void 0 : windowOf(still);
     const unnamed = protect === void 0 || record.status === "destroyed" || now !== void 0 && !now.includes(generation);
-    if (!ok || !unnamed) {
+    const asked = isAskedRow(options.incarnation, still);
+    if (!ok || !unnamed || !asked) {
       if (quiet) return "stop";
-      throw new WriteConflictError(
-        `segment ${ref.segment} changed incarnation while its generations were being collected`
-      );
+      throw asked ? changedWhileCollecting(ref) : refusedOtherRow(ref);
     }
     if (guard !== void 0 && heldGenerations(still, guard.now()).has(generation)) return "skip";
     if (options.skipKnown === true && record.status !== "destroyed" && usableKnownGens(still)?.some((e) => e.generation === generation) === true) {
@@ -7209,7 +6589,7 @@ async function listingPass(ref, deps, options) {
       leasedSpared.add(generation);
       continue;
     }
-    await deps.storage.delete({ namespace: ref.namespace, segment: ref.segment, generation });
+    await deleteGeneration(deps, ref, generation);
     done.push(generation);
     watch.deleted(generation);
   }
@@ -7292,7 +6672,7 @@ async function deleteEvicted(ref, deps, options) {
       continue;
     }
     held ??= still;
-    await deps.storage.delete({ namespace: ref.namespace, segment: ref.segment, generation });
+    await deleteGeneration(deps, ref, generation);
     deleted.push(generation);
     watch.deleted(generation);
   }
@@ -7351,17 +6731,18 @@ function guardRefusal(cardinality, before, guard, allowEmpty) {
   return void 0;
 }
 async function judgeLoad(ref, cardinality, deps, options = {}) {
-  validateUserRef(ref);
+  validateUserRef(ref, "judgeLoad");
   requireInteger(cardinality, { min: 0, what: "judgeLoad: cardinality" });
   const guard = checkedGuard(options.guard, "");
   assertRegistryCanWrite(deps.registry, "load");
+  checkRequireEncryption(deps.requireEncryption);
   if (deps.requireEncryption === true && deps.keystore === void 0) {
     throw new ValidationError("requireEncryption: a load needs a keystore to write encrypted");
   }
   const row = await deps.registry.get(ref);
   if (row?.status === "destroyed") {
     throw new ValidationError(
-      `segment "${ref.segment}" is destroyed (crypto-shredded) \u2014 refusing to write; use a new segment`
+      `segment "${ref.segment}" is destroyed \u2014 refusing to write: no generation resolves through a destroyed row; use a new segment`
     );
   }
   const cleartext = row?.wrappedDeks === void 0 || row.wrappedDeks.length === 0;
@@ -7396,6 +6777,9 @@ async function judgeLoad(ref, cardinality, deps, options = {}) {
 function sizeNeeded(guard, allowEmpty) {
   return guard?.minRetained !== void 0 || guard?.maxGrowth !== void 0 || allowEmpty !== true;
 }
+function lostNumberRace(err) {
+  return isWriteConflictError(err) && !isSourceError(err);
+}
 function settled(promise) {
   promise.catch(() => void 0);
   return promise;
@@ -7433,7 +6817,12 @@ async function currentCardinality(ref, deps, record, unwrapped) {
   return { cardinality: reader.count(), fromSummary: false };
 }
 function loadSegment(ref, input, deps, options = {}) {
-  return runLoad(ref, (codec) => prepareLoadInput(input, codec), deps, options);
+  return runLoad(
+    ref,
+    (codec) => sortedLoadInput(prepareLoadInput(input, codec), options.sorted),
+    deps,
+    options
+  );
 }
 function startUnwrap(row, keystore) {
   const wrappedKeys = row?.wrappedDeks;
@@ -7448,6 +6837,11 @@ function loadSegmentChunks(ref, chunks, deps, options = {}) {
           "loadSegmentChunks takes an async iterable of { chunkKey, bitmap }"
         );
       }
+      if (wantsSorted(options.sorted)) {
+        throw new ValidationError(
+          "loadSegmentChunks takes no sorted: true: its chunks ascend by key already, and are written as they are"
+        );
+      }
       return new ChunkLoadInput(chunks);
     },
     deps,
@@ -7455,11 +6849,11 @@ function loadSegmentChunks(ref, chunks, deps, options = {}) {
   );
 }
 async function runLoad(ref, prepare, deps, options) {
-  validateUserRef(ref);
+  validateUserRef(ref, "load");
   checkedAuditSink(options.audit, "load");
   const codec = requireCodec(deps.codec, "loadSegment");
   const entropy = requireEntropy(deps.entropy, "a load");
-  const keep = options.keep ?? 1;
+  const keep = options.keep === void 0 ? 1 : options.keep;
   requireInteger(keep, { min: 0, what: "keep" });
   const guard = checkedGuard(options.guard, "");
   const metadata = copiedMetadata(options.metadata, (message) => {
@@ -7496,7 +6890,7 @@ async function runLoad(ref, prepare, deps, options) {
       }
     );
   } catch (err) {
-    if (!isWriteConflictError(err)) throw err;
+    if (!lostNumberRace(err)) throw err;
     const { generation: generation2 } = await numbering;
     audit.onEvent({
       kind: "segment.load-refused",
@@ -8405,9 +7799,13 @@ function compileCombineMany(request) {
     max: MAX_BATCH_PARALLELISM,
     what: "publishConcurrency"
   });
-  requireInteger(request.concurrency, { min: 1, max: MAX_BATCH_PARALLELISM, what: "concurrency" });
-  assertIdBound("after", request.after);
-  assertIdBound("through", request.through);
+  requireInteger(request.concurrency, {
+    min: 1,
+    max: MAX_BATCH_PARALLELISM,
+    what: "materializeMany: concurrency"
+  });
+  assertIdBound("after", request.after, "materializeMany");
+  assertIdBound("through", request.through, "materializeMany");
   const index = /* @__PURE__ */ new Map();
   operands.forEach((op, i) => index.set(op.name, i));
   const feed = request.feed === void 0 ? void 0 : checkFeed(request.feed, new Set(index.keys()));
@@ -8494,7 +7892,7 @@ var Gate = class {
     return this.peak;
   }
   async run(task) {
-    if (this.active >= this.limit) await new Promise((resolve3) => this.waiting.push(resolve3));
+    if (this.active >= this.limit) await new Promise((resolve) => this.waiting.push(resolve));
     else this.active++;
     if (this.active > this.peak) this.peak = this.active;
     try {
@@ -8679,7 +8077,7 @@ var Run = class {
   running = [];
   bounds;
   async execute() {
-    this.window = windowOf2(this.req);
+    this.window = windowOf2(this.req, "materializeMany");
     if (this.checkedFeed !== void 0) this.feed = this.openFeed(this.checkedFeed);
     await this.readIndexes();
     await this.refuseAbsentOperands();
@@ -8867,9 +8265,9 @@ var Run = class {
     }
     const bounds = this.boundsList();
     for (const o of this.outputs) {
-      const failed = o.compiled.operands.map((i) => this.operands[i]).find((op) => op.error);
-      if (failed?.error !== void 0) {
-        this.fail(o, failed.error.error);
+      const failed2 = o.compiled.operands.map((i) => this.operands[i]).find((op) => op.error);
+      if (failed2?.error !== void 0) {
+        this.fail(o, failed2.error.error);
         continue;
       }
       if (this.window === "empty") {
@@ -9403,7 +8801,7 @@ var Run = class {
     const wake = () => {
       const now = waiters;
       waiters = [];
-      for (const resolve3 of now) resolve3();
+      for (const resolve of now) resolve();
     };
     const worker = async () => {
       for (; ; ) {
@@ -9422,7 +8820,7 @@ var Run = class {
         const transient = o.serialized;
         let admitted = this.ledger.tryCharge(transient);
         while (!admitted && inFlight > 0) {
-          await new Promise((resolve3) => waiters.push(resolve3));
+          await new Promise((resolve) => waiters.push(resolve));
           admitted = this.ledger.tryCharge(transient);
         }
         if (!admitted) {
@@ -9692,9 +9090,9 @@ function evaluate(node, kc) {
 
 // src/core/rollback.ts
 async function listGenerations(ref, deps) {
-  validateUserRef(ref);
+  validateUserRef(ref, "generations");
   const record = await deps.registry.get(ref);
-  const current = record?.currentGen ?? null;
+  const current = record?.status === "destroyed" ? null : record?.currentGen ?? null;
   const seen = await generationsOf(deps.storage, ref);
   const described = record === null ? void 0 : await currentDescription(ref, record, deps);
   const known = new Set((usableKnownGens(record) ?? []).map((e) => e.generation));
@@ -9718,7 +9116,7 @@ async function currentDescription(ref, record, deps) {
   return metadata === void 0 || Object.keys(metadata).length === 0 ? { cardinality: usable.cardinality } : { cardinality: usable.cardinality, metadata: Object.freeze({ ...metadata }) };
 }
 async function rollbackSegment(ref, toGeneration, deps, options = {}) {
-  validateUserRef(ref);
+  validateUserRef(ref, "rollback");
   checkedAuditSink(options.audit, "rollback");
   requireInteger(toGeneration, { min: 0, what: "rollback: generation" });
   const record = await deps.registry.get(ref);
@@ -9727,7 +9125,7 @@ async function rollbackSegment(ref, toGeneration, deps, options = {}) {
   }
   if (record.status === "destroyed") {
     throw new ValidationError(
-      `rollback: segment "${ref.segment}" is destroyed (crypto-shredded) \u2014 every generation of it is unreadable`
+      `rollback: segment "${ref.segment}" is destroyed \u2014 no generation resolves through a destroyed row`
     );
   }
   const known = usableKnownGens(record);
@@ -9800,43 +9198,13 @@ async function rollbackSegment(ref, toGeneration, deps, options = {}) {
     footerCrc: footer.footerCrc
   });
   const churn = leaseChurn(deps);
-  let against = record.token;
-  let swapped;
-  for (; ; ) {
-    try {
-      const { token } = await deps.registry.compareAndSwap(ref, against, {
-        currentGen: toGeneration,
-        summary,
-        ...knownAfter === void 0 ? {} : { knownGens: knownAfter }
-      });
-      swapped = { pointerId: token, token };
-      break;
-    } catch (err) {
-      if (isTransientError(err)) {
-        const landed = await swapLanded(
-          ref,
-          record,
-          { toGeneration, summary, known: knownAfter },
-          deps.registry,
-          err
-        );
-        swapped = { pointerId: landed.pointerId, token: landed.token };
-        break;
-      }
-      if (!isWriteConflictError(err)) throw err;
-      const seen = await deps.registry.get(ref);
-      const settled2 = await churn.settle(record, seen, () => deps.registry.get(ref));
-      const now = settled2?.row ?? null;
-      if (settled2 === void 0 || now === null || !onlyLeasesDiffer(record, now)) {
-        const lost = new WriteConflictError(
-          "rollback: the segment's row changed while the rollback ran and the pointer was not moved; check store.generations(ref) and run it again"
-        );
-        lost.cause = err;
-        throw lost;
-      }
-      against = now.token;
-    }
-  }
+  const swapped = await swapPointer(
+    ref,
+    record,
+    { toGeneration, summary, known: knownAfter },
+    deps,
+    churn
+  );
   const emitMove = () => {
     safeAudit(options.audit ?? NOOP_AUDIT).onEvent({
       kind: "segment.rollback",
@@ -9862,43 +9230,9 @@ async function rollbackSegment(ref, toGeneration, deps, options = {}) {
     }
   }
   if (!stillThere || replaced) {
-    let undone = false;
-    let undoAgainst = swapped.token;
-    for (; ; ) {
-      try {
-        const restored = describingKnown(record, toGeneration)?.filter(
-          (e) => e.generation !== toGeneration || e.generation === record.currentGen
-        );
-        await deps.registry.compareAndSwap(ref, undoAgainst, {
-          currentGen: record.currentGen,
-          summary: describingSummary(record),
-          ...restored === void 0 ? {} : { knownGens: restored }
-        });
-        undone = true;
-        break;
-      } catch (err) {
-        if (!isWriteConflictError(err)) break;
-        let now;
-        try {
-          const seen = await deps.registry.get(ref);
-          if (seen === null || seen.currentGen !== toGeneration) break;
-          const settled2 = await churn.settle(
-            record,
-            seen,
-            () => deps.registry.get(ref),
-            SWAP_MOVES
-          );
-          now = settled2?.row ?? null;
-        } catch {
-          break;
-        }
-        if (now === null || now.currentGen !== toGeneration || now.pointerId !== swapped.pointerId || !onlyLeasesDiffer(record, now, SWAP_MOVES))
-          break;
-        undoAgainst = now.token;
-      }
-    }
+    const undone = await moveBack(ref, record, toGeneration, swapped, deps.registry, churn, deps);
     throw new NotFoundError(
-      `rollback: generation ${toGeneration} of "${ref.segment}" was ${replaced ? "replaced" : "collected"} while the pointer was moving` + (undone ? " \u2014 the pointer was put back" : `, and the move back failed, so the pointer may still name ${toGeneration} (a write that landed and lost its response reads as a failure here). Check which generation is current, then re-run a rollback to a generation that exists, or restore the object.`)
+      `rollback: generation ${toGeneration} of "${ref.segment}" was ${replaced ? "replaced" : "collected"} while the pointer was moving` + (undone ? " \u2014 the pointer was put back" : `, and the move back failed, so the pointer may still name ${toGeneration} (the row could not show whether the move back landed). Check which generation is current, then re-run a rollback to a generation that exists, or restore the object.`)
     );
   }
   emitMove();
@@ -9951,13 +9285,113 @@ function keyNotHeld(err) {
 function keyServiceUnanswered(err) {
   return isTransientError(err) || err instanceof Error && err.name === "TimeoutError";
 }
-async function swapLanded(ref, record, swap, registry, unanswered) {
-  let now;
-  try {
-    now = await registry.get(ref);
-  } catch (readErr) {
-    if (isIntegrityError(readErr)) throw readErr;
-    throw unanswered;
+async function moveBack(ref, record, toGeneration, swapped, registry, churn, waits) {
+  let undone = false;
+  let undoAgainst = swapped.token;
+  const undo = writeTokens(registry);
+  const undoLanded = (row) => {
+    if (row === null || undo.sent === void 0) return false;
+    if (record.currentGen !== null) return pointerSetBy(row, record, record.currentGen, undo.sent);
+    return row.currentGen === null && row.status !== "destroyed" && sameIncarnation(record, row) && undo.sent.has(row.pointerId);
+  };
+  for (; ; ) {
+    try {
+      const restored = describingKnown(record, toGeneration)?.filter(
+        (e) => e.generation !== toGeneration || e.generation === record.currentGen
+      );
+      await registry.compareAndSwap(
+        ref,
+        undoAgainst,
+        {
+          currentGen: record.currentGen,
+          summary: describingSummary(record),
+          ...restored === void 0 ? {} : { knownGens: restored }
+        },
+        undo.options
+      );
+      undone = true;
+      break;
+    } catch (err) {
+      if (isTransientError(err)) {
+        try {
+          const row = await readBack(() => registry.get(ref), err, waits);
+          if (undoLanded(row)) undone = true;
+        } catch {
+        }
+        break;
+      }
+      if (!isWriteConflictError(err)) break;
+      let now;
+      try {
+        const seen = await readBack(() => registry.get(ref), err, waits);
+        if (undoLanded(seen)) {
+          undone = true;
+          break;
+        }
+        if (seen === null || seen.currentGen !== toGeneration) break;
+        const settled2 = await churn.settle(record, seen, () => registry.get(ref), SWAP_MOVES);
+        now = settled2?.row ?? null;
+      } catch {
+        break;
+      }
+      if (now === null || now.currentGen !== toGeneration || now.pointerId !== swapped.pointerId || !onlyLeasesDiffer(record, now, SWAP_MOVES))
+        break;
+      undoAgainst = now.token;
+    }
+  }
+  return undone;
+}
+function unconfirmedSwap(err, cause = err) {
+  const lost = new WriteConflictError(
+    "rollback: the segment's row changed while the rollback ran, and this rollback could not confirm that its swap is the one the row shows; check store.generations(ref) and run it again"
+  );
+  lost.cause = cause;
+  return lost;
+}
+async function swapPointer(ref, record, swap, deps, churn) {
+  const { registry } = deps;
+  let against = record.token;
+  const { sent, options: writeOptions2 } = writeTokens(registry);
+  for (; ; ) {
+    try {
+      const { token } = await registry.compareAndSwap(
+        ref,
+        against,
+        {
+          currentGen: swap.toGeneration,
+          summary: swap.summary,
+          ...swap.known === void 0 ? {} : { knownGens: swap.known }
+        },
+        writeOptions2
+      );
+      return { pointerId: token, token };
+    } catch (err) {
+      if (isTransientError(err)) return swapLanded(ref, record, swap, registry, err, sent, deps);
+      if (!isWriteConflictError(err)) throw err;
+      let seen;
+      try {
+        seen = await readBack(() => registry.get(ref), err, deps);
+      } catch (readErr) {
+        if (readErr === err) throw unconfirmedSwap(err, err.cause);
+        throw readErr;
+      }
+      if (seen !== null && sent !== void 0 && pointerSetBy(seen, record, swap.toGeneration, sent)) {
+        return seen;
+      }
+      const settled2 = await churn.settle(record, seen, () => registry.get(ref));
+      const now = settled2?.row ?? null;
+      if (settled2 === void 0 || now === null || !onlyLeasesDiffer(record, now)) {
+        throw unconfirmedSwap(err);
+      }
+      against = now.token;
+    }
+  }
+}
+async function swapLanded(ref, record, swap, registry, unanswered, sent, waits) {
+  const now = await readBack(() => registry.get(ref), unanswered, waits);
+  if (sent !== void 0) {
+    if (now === null || !pointerSetBy(now, record, swap.toGeneration, sent)) throw unanswered;
+    return now;
   }
   const left = {
     ...record,
@@ -10006,7 +9440,7 @@ function recordCollect(ref, result, pass, options) {
   return result;
 }
 async function eraseOnce(ref, id, deps, options, seen) {
-  validateUserRef(ref);
+  validateUserRef(ref, "eraseIdFromSegment");
   checkedAuditSink(options.audit, "eraseIdFromSegment");
   const { chunkKey, remainder } = splitId(id);
   const codec = requireCodec(deps.codec, "eraseIdFromSegment");
@@ -10044,6 +9478,7 @@ async function eraseOnce(ref, id, deps, options, seen) {
     read,
     sealed: /* @__PURE__ */ new Set(),
     versions: /* @__PURE__ */ new Map(),
+    fromFingerprint: void 0,
     premise: record,
     premiseToken: fromToken,
     fenceLost: 0,
@@ -10120,6 +9555,7 @@ async function holds(c, generation) {
       reader = await read(() => openGenerationReader(deps.storage, key, void 0));
     }
     versions.set(generation, objectVersionOf(reader));
+    sealed.delete(generation);
     let bytes;
     try {
       bytes = await read(() => reader.getChunk(chunkKey));
@@ -10163,11 +9599,32 @@ async function holdsEach(c, generations, { stopAtHolder }) {
 }
 async function holderLeft(c, clean) {
   const { ref, deps } = c;
-  const toRead = (await generationsOf(deps.storage, ref)).reverse().filter((generation) => !clean.has(generation));
+  const listed2 = (await generationsOf(deps.storage, ref)).reverse();
+  const own = (generation) => clean.has(generation) ? ownFingerprint(c, generation) : void 0;
+  const known = listed2.some((generation) => own(generation) !== void 0) ? await ledgerAfterListing(c) : void 0;
+  const vouched = (generation) => {
+    const fingerprint = own(generation);
+    if (fingerprint === void 0 || known === void 0) return false;
+    const footerCrc = footerCrcOf(fingerprint);
+    return known.some((e) => e.generation === generation && e.footerCrc === footerCrc);
+  };
+  const toRead = listed2.filter((generation) => !vouched(generation));
   return (await holdsEach(c, toRead, { stopAtHolder: true })).find(
     (outcome) => outcome.held === true
   )?.generation;
 }
+function ownFingerprint(c, generation) {
+  if (generation === c.from) return c.fromFingerprint;
+  if (generation === c.rewrote?.generation) return c.rewrote.fingerprint;
+  return void 0;
+}
+async function ledgerAfterListing(c) {
+  try {
+    return usableKnownGens(await c.deps.registry.get(c.ref));
+  } catch {
+    return void 0;
+  }
+}
 function cannotRemove(c, generation) {
   const { ref, sealed } = c;
   return new WriteConflictError(
@@ -10301,7 +9758,13 @@ async function deleteFenced(c, holders, fenced) {
     }
     if (moved !== null) break;
     try {
-      await deps.storage.delete({ ...base, generation }, { ifVersion: versions.get(generation) });
+      await deleteSettled(
+        deps.storage,
+        { ...base, generation },
+        { ifVersion: versions.get(generation) },
+        c.read,
+        { clock: deps.clock, rng: deps.rng }
+      );
     } catch (err) {
       if (!isWriteConflictError(err)) throw err;
       moved = rowVerdict(c, await deps.registry.get(ref)) ?? "superseded";
@@ -10365,14 +9828,35 @@ async function unpublished(c) {
   }
   throw cannotRemove(c, left);
 }
+async function holderUnderTombstone(c) {
+  const newestFirst = (await c.read(() => generationsOf(c.deps.storage, c.ref))).reverse();
+  return (await holdsEach(c, newestFirst, { stopAtHolder: true })).find((h) => h.held === true);
+}
+async function findIdUnderTombstone(ref, id, deps) {
+  validateUserRef(ref, "findIdUnderTombstone");
+  const { chunkKey, remainder } = splitId(id);
+  const codec = requireCodec(deps.codec, "findIdUnderTombstone");
+  const c = {
+    ref,
+    deps,
+    chunkKey,
+    remainder,
+    codec,
+    maxBytes: deps.maxBitmapBytes ?? DEFAULT_MAX_BITMAP_BYTES,
+    base: { segment: ref.segment, namespace: ref.namespace },
+    tombstoned: true,
+    aead: void 0,
+    read: (op) => retryRead(op, deps.readRetry),
+    sealed: /* @__PURE__ */ new Set(),
+    versions: /* @__PURE__ */ new Map()
+  };
+  return (await holderUnderTombstone(c))?.generation ?? null;
+}
 async function underTombstone(c) {
   const { ref, deps, base } = c;
-  const newestFirst = (await generationsOf(deps.storage, ref)).reverse();
-  const holder = (await holdsEach(c, newestFirst, { stopAtHolder: true })).find(
-    (h) => h.held === true
-  );
+  const holder = await holderUnderTombstone(c);
   if (holder === void 0) return { ...base, erased: false, reason: "destroyed", collected: [] };
-  const collected = await gcOrphanGenerations(ref, deps, { keep: 0 });
+  const collected = await gcOrphanGenerations(ref, deps, { keep: 0, incarnation: c.record });
   const left = await holderLeft(c, /* @__PURE__ */ new Set());
   if (left !== void 0) throw cannotRemove(c, left);
   return collectedAll(c, holder.generation, collected);
@@ -10488,6 +9972,7 @@ async function stage(c) {
     const reader = await read(
       () => openGenerationReader(deps.storage, fromKey, cryptoAt(c, from), {}, described?.fingerprint)
     );
+    c.fromFingerprint = reader.fingerprint;
     const bytes = await read(() => reader.getChunk(chunkKey));
     if (bytes === null) return await notInCurrent(c);
     const target = codec.safeDeserialize(bytes, maxBytes);
@@ -10498,17 +9983,29 @@ async function stage(c) {
     const generation = await nextGeneration(ref, deps);
     const key = { ...base, generation };
     const metadata = metadataToCarry(reader.metadata, aead === void 0 ? void 0 : described);
-    const tally = await writeCrbmGenerationStream(
-      deps.storage,
-      key,
-      rewrite(reader, chunkKey, target, codec, maxBytes, read),
-      {
-        crypto: cryptoAt(c, generation),
-        clock: deps.clock,
-        metadata,
-        entropy: deps.entropy
+    let tally;
+    try {
+      tally = await writeCrbmGenerationStream(
+        deps.storage,
+        key,
+        rewrite(reader, chunkKey, target, codec, maxBytes, read),
+        {
+          crypto: cryptoAt(c, generation),
+          clock: deps.clock,
+          metadata,
+          entropy: deps.entropy
+        }
+      );
+    } catch (err) {
+      if (!isWriteConflictError(err)) throw err;
+      let now;
+      try {
+        now = await deps.registry.get(ref);
+      } catch {
+        throw err;
       }
-    );
+      return refusedResult(c, rowVerdict(c, now) ?? "superseded");
+    }
     written = generation;
     c.rewrote = { generation, fingerprint: tally.fingerprint };
     const beforeVerify = await deps.registry.get(ref);
@@ -10550,7 +10047,10 @@ async function discardRefused(c, own) {
   let row = await deps.registry.get(ref);
   for (let attempts = 1; ; attempts++) {
     if (row !== null && row.status === "destroyed") {
-      await deps.storage.delete(key);
+      await deleteSettled(deps.storage, key, void 0, c.read, {
+        clock: deps.clock,
+        rng: deps.rng
+      });
       return row;
     }
     if (row === null || row.status !== "active" || row.currentGen === null) return row;
@@ -10560,7 +10060,10 @@ async function discardRefused(c, own) {
     const renewed = await renewal.renew(row);
     if ("row" in renewed) {
       try {
-        await deps.storage.delete(key, { ifVersion: proven.version });
+        await deleteSettled(deps.storage, key, { ifVersion: proven.version }, c.read, {
+          clock: deps.clock,
+          rng: deps.rng
+        });
       } catch (err) {
         if (!isWriteConflictError(err)) throw err;
       }
@@ -10640,17 +10143,20 @@ async function finishRewrite(c, staged) {
   return { ...base, erased: true, fromGeneration: from, generation, collected };
 }
 async function resolveDek(ref, deps, record, row) {
+  checkRequireEncryption(deps.requireEncryption);
   if (row.tombstoned) return void 0;
   if (record.wrappedDeks !== void 0 && record.wrappedDeks.length > 0) {
     if (deps.keystore === void 0) {
       throw new KeyUnavailableError(
-        `segment "${ref.segment}" is encrypted but eraseIdFromSegment has no keystore`
+        `segment "${ref.segment}" is encrypted, and the erasure has no keystore to open its key (encryption.keystore on the store)`
       );
     }
     return await deps.keystore.openDek(record.wrappedDeks);
   }
   if (!row.pointerless && deps.requireEncryption === true) {
-    throw new ValidationError(`requireEncryption: segment "${ref.segment}" is cleartext`);
+    throw new KeyUnavailableError(
+      `requireEncryption: segment "${ref.segment}" is cleartext but encryption is required`
+    );
   }
   return void 0;
 }
@@ -10749,116 +10255,6 @@ function assertRemaindersInRange(bitmap, chunkKey) {
   }
 }
 
-// src/drivers/crypto.ts
-import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
-var UTF82 = new TextEncoder();
-var KEY_BYTES = 32;
-var NONCE_BYTES = 12;
-var TAG_BYTES = 16;
-var isBytes = (v) => Object.prototype.toString.call(v) === "[object Uint8Array]";
-function ownKey(key) {
-  const own = Buffer.alloc(key.length);
-  own.set(key);
-  return own;
-}
-var NodeAead = class {
-  key;
-  constructor(key) {
-    if (!isBytes(key))
-      throw new ValidationError("AEAD key must be a Uint8Array of key bytes, not text");
-    if (key.length !== KEY_BYTES)
-      throw new ValidationError(`AEAD key must be ${KEY_BYTES} bytes, got ${key.length}`);
-    this.key = ownKey(key);
-  }
-  seal(plaintext, aad) {
-    const nonce = randomBytes(NONCE_BYTES);
-    const cipher = createCipheriv("aes-256-gcm", this.key, nonce);
-    cipher.setAAD(aad);
-    const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
-    return { nonce, ciphertext, tag: cipher.getAuthTag() };
-  }
-  open(sealed, aad) {
-    if (sealed.nonce.length !== NONCE_BYTES || sealed.tag.length !== TAG_BYTES)
-      throw new IntegrityError("AEAD nonce/tag have the wrong length");
-    const decipher = createDecipheriv("aes-256-gcm", this.key, sealed.nonce);
-    decipher.setAAD(aad);
-    decipher.setAuthTag(Buffer.from(sealed.tag));
-    try {
-      return Buffer.concat([decipher.update(sealed.ciphertext), decipher.final()]);
-    } catch {
-      throw new IntegrityError(
-        "AEAD authentication failed (wrong key, tampered data, or wrong context)"
-      );
-    }
-  }
-};
-function wrapKey(dek, kek, keyId) {
-  const sealed = new NodeAead(kek).seal(dek, UTF82.encode(keyId));
-  return Buffer.concat([sealed.nonce, sealed.ciphertext, sealed.tag]).toString("base64");
-}
-function unwrapKey(wrapped, kek, keyId) {
-  const blob = Buffer.from(wrapped, "base64");
-  if (blob.length < NONCE_BYTES + TAG_BYTES)
-    throw new IntegrityError("wrapped DEK is too short to be valid");
-  const nonce = blob.subarray(0, NONCE_BYTES);
-  const tag = blob.subarray(blob.length - TAG_BYTES);
-  const ciphertext = blob.subarray(NONCE_BYTES, blob.length - TAG_BYTES);
-  return new NodeAead(kek).open({ nonce, ciphertext, tag }, UTF82.encode(keyId));
-}
-var InProcessKeystore = class {
-  keys;
-  activeKeyId;
-  recoveryKeyId;
-  constructor(options) {
-    const entries = Object.entries(options.keys);
-    if (entries.length === 0) throw new ValidationError("keystore needs at least one KEK");
-    for (const [id, k] of entries) {
-      if (!isBytes(k))
-        throw new ValidationError(`KEK "${id}" must be a Uint8Array of key bytes, not text`);
-      if (k.length !== KEY_BYTES)
-        throw new ValidationError(`KEK "${id}" must be ${KEY_BYTES} bytes, got ${k.length}`);
-    }
-    this.keys = new Map(entries.map(([id, k]) => [id, ownKey(k)]));
-    if (!this.keys.has(options.activeKeyId))
-      throw new ValidationError(`activeKeyId "${String(options.activeKeyId)}" is not in keys`);
-    if (options.recoveryKeyId !== void 0 && !this.keys.has(options.recoveryKeyId))
-      throw new ValidationError(`recoveryKeyId "${String(options.recoveryKeyId)}" is not in keys`);
-    this.activeKeyId = options.activeKeyId;
-    this.recoveryKeyId = options.recoveryKeyId === options.activeKeyId ? void 0 : options.recoveryKeyId;
-  }
-  // async to satisfy the IKeystore seam (a KMS adapter awaits a network call here); the in-process path is
-  // synchronous, but staying async keeps unwrap failures as rejections, matching a remote keystore.
-  async createDek() {
-    const dek = randomBytes(KEY_BYTES);
-    const ids = this.recoveryKeyId ? [this.activeKeyId, this.recoveryKeyId] : [this.activeKeyId];
-    const wrapped = ids.map((keyId) => ({
-      keyId,
-      wrapped: wrapKey(dek, this.keys.get(keyId), keyId)
-    }));
-    return { wrapped, aead: new NodeAead(dek) };
-  }
-  // async for the same reason as createDek — a synchronous unwrap failure surfaces as a promise rejection.
-  async openDek(wrapped) {
-    let anyKekHeld = false;
-    let lastUnwrapError;
-    for (const w of wrapped) {
-      const kek = this.keys.get(w.keyId);
-      if (kek === void 0) continue;
-      anyKekHeld = true;
-      try {
-        return new NodeAead(unwrapKey(w.wrapped, kek, w.keyId));
-      } catch (err) {
-        lastUnwrapError = err;
-      }
-    }
-    if (anyKekHeld) throw lastUnwrapError;
-    const need = wrapped.map((w) => w.keyId).join(", ") || "(none)";
-    throw new KeyUnavailableError(
-      `no held KEK can unwrap this DEK \u2014 the wrappings reference [${need}]. Restore the missing KEK (or its recovery KEK), or rebuild the segment from source.`
-    );
-  }
-};
-
 // src/core/cas-retry.ts
 async function casRetry(deps, ref, plan, step) {
   const churn = leaseChurn(deps);
@@ -10904,6 +10300,7 @@ function validateRetentionPolicy(policy) {
       `retention policy must be an object such as { expiresAt }; got ${policy === null ? "null" : Array.isArray(policy) ? "an array" : `a ${typeof policy}`}`
     );
   }
+  refuseUnknownOptions("setRetention policy", policy, ["expiresAt"]);
   const { expiresAt } = policy;
   if (typeof expiresAt !== "number" || !Number.isInteger(expiresAt)) {
     throw new ValidationError(
@@ -10931,7 +10328,7 @@ function readRetentionPolicy(meta) {
   return { expiresAt: raw };
 }
 async function getSegmentRetention(ref, deps) {
-  validateUserRef(ref);
+  validateUserRef(ref, "getRetention");
   const record = await deps.registry.get(ref);
   if (record === null || record.status === "destroyed") return null;
   return readRetentionPolicy(record.retention);
@@ -10940,20 +10337,25 @@ function readExpiresAt(record) {
   const parsed = record === null ? null : readRetentionPolicy(record.retention);
   return parsed === null || parsed === "invalid" ? void 0 : parsed.expiresAt;
 }
-async function reindex(ref, deps, expiresAt, previousExpiresAt) {
+async function reindex(ref, deps, expiresAt, previous) {
   if (!canIndex(ref)) return false;
   const nextBucket = expiresAt === void 0 ? void 0 : dueBucket(expiresAt);
-  const oldBucket = previousExpiresAt === void 0 ? void 0 : dueBucket(previousExpiresAt);
   let indexed = expiresAt === void 0;
   if (nextBucket !== void 0) {
+    const pointer = dueIndexRef(nextBucket, ref);
     try {
-      await deps.registry.create(dueIndexRef(nextBucket, ref), { currentGen: null });
+      await deps.registry.create(pointer, { currentGen: null });
       indexed = true;
     } catch (err) {
-      if (isWriteConflictError(err)) indexed = true;
+      if (isWriteConflictError(err)) {
+        indexed = true;
+      } else {
+        indexed = await deps.registry.get(pointer).catch(() => null) !== null;
+      }
     }
   }
-  if (oldBucket !== void 0 && oldBucket !== nextBucket) {
+  for (const oldBucket of new Set([...previous].map(dueBucket))) {
+    if (oldBucket === nextBucket) continue;
     try {
       await deps.registry.delete(dueIndexRef(oldBucket, ref));
     } catch {
@@ -10961,10 +10363,38 @@ async function reindex(ref, deps, expiresAt, previousExpiresAt) {
   }
   return indexed;
 }
+async function settledWrite(ref, deps, tokens, before, send) {
+  try {
+    await send();
+    return null;
+  } catch (err) {
+    if (!isTransientError(err) || tokens.sent === void 0) throw err;
+    const now = await readBack(() => deps.registry.get(ref), err, deps);
+    if (tokens.wrote(now)) return now;
+    if (now === null ? before === null : now.token === before?.token) throw err;
+    const moved = new WriteConflictError(
+      `the row of segment "${ref.segment}" changed while its retention write got no answer`
+    );
+    moved.cause = err;
+    throw moved;
+  }
+}
 async function setSegmentRetention(ref, deps, policy) {
-  validateUserRef(ref);
+  validateUserRef(ref, "setRetention");
   validateRetentionPolicy(policy);
   const base = { segment: ref.segment, namespace: ref.namespace };
+  const created = /* @__PURE__ */ new Set();
+  let creating = false;
+  const tokens = writeTokens(deps.registry, (token) => {
+    if (creating) created.add(token);
+  });
+  const previous = /* @__PURE__ */ new Set();
+  const done = async (createdRow, held = policy.expiresAt) => ({
+    ...base,
+    expiresAt: policy.expiresAt,
+    createdRow,
+    indexed: await reindex(ref, deps, held, previous)
+  });
   return casRetry(
     deps,
     ref,
@@ -10975,34 +10405,53 @@ async function setSegmentRetention(ref, deps, policy) {
       )
     },
     async (record) => {
-      const previousExpiresAt = readExpiresAt(record);
+      if (record !== null && tokens.wrote(record)) {
+        return done(created.has(record.pointerId), readExpiresAt(record));
+      }
       if (record === null) {
-        await deps.registry.create(ref, {
-          currentGen: null,
-          retention: { [EXPIRES_AT]: policy.expiresAt }
-        });
-        return {
-          ...base,
-          expiresAt: policy.expiresAt,
-          createdRow: true,
-          indexed: await reindex(ref, deps, policy.expiresAt, void 0)
-        };
+        creating = true;
+        let landed2;
+        try {
+          landed2 = await settledWrite(
+            ref,
+            deps,
+            tokens,
+            null,
+            () => deps.registry.create(
+              ref,
+              { currentGen: null, retention: { [EXPIRES_AT]: policy.expiresAt } },
+              tokens.options
+            )
+          );
+        } finally {
+          creating = false;
+        }
+        return done(true, landed2 === null ? policy.expiresAt : readExpiresAt(landed2));
       }
       assertNotDestroyed(record, ref);
-      await deps.registry.compareAndSwap(ref, record.token, {
-        retention: { ...record.retention, [EXPIRES_AT]: policy.expiresAt }
-      });
-      return {
-        ...base,
-        expiresAt: policy.expiresAt,
-        createdRow: false,
-        indexed: await reindex(ref, deps, policy.expiresAt, previousExpiresAt)
-      };
+      const was = readExpiresAt(record);
+      if (was !== void 0) previous.add(was);
+      const landed = await settledWrite(
+        ref,
+        deps,
+        tokens,
+        record,
+        () => deps.registry.compareAndSwap(
+          ref,
+          record.token,
+          { retention: { ...record.retention, [EXPIRES_AT]: policy.expiresAt } },
+          tokens.options
+        )
+      );
+      return done(false, landed === null ? policy.expiresAt : readExpiresAt(landed));
     }
   );
 }
 async function clearSegmentRetention(ref, deps) {
-  validateUserRef(ref);
+  validateUserRef(ref, "clearRetention");
+  const tokens = writeTokens(deps.registry);
+  const previous = /* @__PURE__ */ new Set();
+  let unanswered = false;
   return casRetry(
     deps,
     ref,
@@ -11013,15 +10462,40 @@ async function clearSegmentRetention(ref, deps) {
       )
     },
     async (record) => {
+      if (tokens.wrote(record)) {
+        await reindex(ref, deps, void 0, previous);
+        return true;
+      }
       if (record === null) return false;
       if (record.status === "destroyed") return false;
-      if (record.retention === void 0 || !(EXPIRES_AT in record.retention)) return false;
+      const expiresAt = readExpiresAt(record);
+      if (record.retention === void 0 || !(EXPIRES_AT in record.retention)) {
+        if (unanswered) await reindex(ref, deps, void 0, previous);
+        return false;
+      }
+      if (expiresAt !== void 0) previous.add(expiresAt);
       const rest = { ...record.retention };
       delete rest[EXPIRES_AT];
-      await deps.registry.compareAndSwap(ref, record.token, {
-        retention: Object.keys(rest).length === 0 ? void 0 : rest
-      });
-      await reindex(ref, deps, void 0, readExpiresAt(record));
+      try {
+        await settledWrite(
+          ref,
+          deps,
+          tokens,
+          record,
+          () => deps.registry.compareAndSwap(
+            ref,
+            record.token,
+            { retention: Object.keys(rest).length === 0 ? void 0 : rest },
+            tokens.options
+          )
+        );
+      } catch (err) {
+        if (isTransientError(err) || isUnsettledConflict(err) || isWriteConflictError(err) && isTransientError(err.cause)) {
+          unanswered = true;
+        }
+        throw err;
+      }
+      await reindex(ref, deps, void 0, previous);
       return true;
     }
   );
@@ -11029,7 +10503,7 @@ async function clearSegmentRetention(ref, deps) {
 function assertNotDestroyed(record, ref) {
   if (record.status === "destroyed") {
     throw new ValidationError(
-      `segment "${ref.segment}" is destroyed (crypto-shredded) \u2014 refusing to set a retention policy on a tombstone; there is nothing left to retire. Use a new segment.`
+      `segment "${ref.segment}" is destroyed \u2014 refusing to set a retention policy on a tombstone. Use a new segment; to delete objects a destroy left in the bucket, run dropSegment.`
     );
   }
 }
@@ -11038,8 +10512,31 @@ function assertNotDestroyed(record, ref) {
 var MAX_CAS_ATTEMPTS = 8;
 var ERASE_CONCURRENCY = 8;
 var MAX_STORAGE_SWEEPS = 3;
+function checkEraseDeps(name, deps) {
+  const registry = deps === null || typeof deps !== "object" ? void 0 : deps.registry;
+  if (registry === void 0 || registry === null || typeof registry.get !== "function") {
+    throw new ValidationError(
+      `${name}: \`deps.registry\` must be a registry driver, such as \`backend.registry\``
+    );
+  }
+}
+function checkDropOptions(options) {
+  refuseUnknownOptions("dropSegment", options, ["confirmSegment", "dryRun", "audit"]);
+  requireBool("dropSegment: `dryRun`", options.dryRun);
+  checkedAuditSink(options.audit, "dropSegment");
+}
+var DESTROY_SEGMENT_KEYS = ["confirmSegment", "allowCleartext", "audit"];
+var ERASE_NAMESPACE_KEYS = [
+  "confirmNamespace",
+  "allowCleartext",
+  "audit",
+  "maxScanSegments"
+];
 async function destroySegment(ref, deps, options) {
-  validateUserRef(ref);
+  validateUserRef(ref, "destroySegment");
+  checkEraseDeps("destroySegment", deps);
+  refuseUnknownOptions("destroySegment", options, DESTROY_SEGMENT_KEYS);
+  requireBool("destroySegment: `allowCleartext`", options.allowCleartext);
   checkedAuditSink(options.audit, "destroySegment");
   if (options.confirmSegment !== ref.segment) {
     throw new ValidationError(
@@ -11056,14 +10553,31 @@ async function destroySegment(ref, deps, options) {
       segment: ref.segment,
       ...incarnationField(token)
     });
+  } else if (isCleartextTombstone(result)) {
+    safeAudit(options.audit ?? NOOP_AUDIT).onEvent(tombstoneEvent(ref, token));
   }
   return result;
 }
+function isCleartextTombstone(result) {
+  return result.destroyed && !result.cryptoShredded && result.reason === void 0;
+}
+function tombstoneEvent(ref, token) {
+  return {
+    kind: "segment.tombstone",
+    namespace: ref.namespace,
+    segment: ref.segment,
+    ...incarnationField(token),
+    objectsReadable: true
+  };
+}
 async function eraseNamespace(namespace, deps, options) {
   if (typeof namespace !== "string" || namespace.length === 0) {
     throw new ValidationError("eraseNamespace: namespace must be a non-empty string");
   }
   validateUserNamespace(namespace);
+  checkEraseDeps("eraseNamespace", deps);
+  refuseUnknownOptions("eraseNamespace", options, ERASE_NAMESPACE_KEYS);
+  requireBool("eraseNamespace: `allowCleartext`", options.allowCleartext);
   checkedAuditSink(options.audit, "eraseNamespace");
   if (options.confirmNamespace !== namespace) {
     throw new ValidationError(
@@ -11108,6 +10622,8 @@ async function eraseNamespace(namespace, deps, options) {
         segment: ref.segment,
         ...incarnationField(token)
       });
+    } else if (isCleartextTombstone(result)) {
+      audit.onEvent(tombstoneEvent(ref, token));
     }
     return result;
   });
@@ -11118,8 +10634,8 @@ async function dropSegment(ref, deps, options) {
   return await dropSegmentFor(ref, deps, options, void 0);
 }
 async function dropSegmentFor(ref, deps, options, sweep) {
-  validateUserRef(ref);
-  checkedAuditSink(options.audit, "dropSegment");
+  validateUserRef(ref, "dropSegment");
+  checkDropOptions(options);
   if (options.confirmSegment !== ref.segment) {
     throw new ValidationError(
       `dropSegment: confirmSegment must equal the segment name "${ref.segment}" (guard against accidental deletion)`
@@ -11155,18 +10671,7 @@ async function dropSegmentFor(ref, deps, options, sweep) {
         reason: "absent"
       };
     }
-    try {
-      const tombstone = await deps.registry.create(ref, {
-        // The max listed generation, so the row is consistent with what is on disk if anything reads it before
-        // the sweep finishes. It is a tombstone, so no reader resolves through it either way.
-        currentGen: orphans[orphans.length - 1],
-        status: "destroyed"
-      });
-      shred = { ...shred, destroyed: true, reason: void 0, token: tombstone.token };
-    } catch (err) {
-      if (!isWriteConflictError(err)) throw err;
-      shred = await shredSegment(ref, deps, { allowCleartext: true, op: "dropSegment" });
-    }
+    shred = await claimIdentity(ref, deps, orphans[orphans.length - 1], shred);
   }
   if (shred.cryptoShredded) {
     safeAudit(options.audit ?? NOOP_AUDIT).onEvent({
@@ -11182,7 +10687,7 @@ async function dropSegmentFor(ref, deps, options, sweep) {
     if (present.length === 0) break;
     const outcomes = await mapWithConcurrency(present, ERASE_CONCURRENCY, async (generation) => {
       try {
-        await deps.storage.delete({ ...ref, generation });
+        await deleteSettled(deps.storage, { ...ref, generation }, void 0, void 0, deps);
         return generation;
       } catch {
         return null;
@@ -11210,16 +10715,49 @@ async function dropSegmentFor(ref, deps, options, sweep) {
   return {
     ...base,
     dropped: shred.destroyed,
-    generationsDeleted,
+    generationsDeleted: generationsDeleted.sort((a, b) => a - b),
     generationsRemaining,
     cryptoShredded: shred.cryptoShredded,
     reason: shred.reason
   };
 }
+async function claimIdentity(ref, deps, newestGeneration, shred) {
+  const createTokens = writeTokens(deps.registry);
+  try {
+    const tombstone = await deps.registry.create(
+      ref,
+      {
+        // The max listed generation, so the row is consistent with what is on disk if anything reads it before
+        // the sweep finishes. It is a tombstone, so no reader resolves through it either way.
+        currentGen: newestGeneration,
+        status: "destroyed"
+      },
+      createTokens.options
+    );
+    return { ...shred, destroyed: true, reason: void 0, token: tombstone.token };
+  } catch (err) {
+    if (!isWriteConflictError(err) && !isTransientError(err)) throw err;
+    if (createTokens.sent === void 0 && isTransientError(err)) throw err;
+    const now = isTransientError(err) ? await readBack(() => deps.registry.get(ref), err, deps) : await deps.registry.get(ref);
+    if (now?.status === "destroyed" && createTokens.wrote(now)) {
+      return { ...shred, destroyed: true, reason: void 0, token: now.token };
+    }
+    if (isTransientError(err) && now === null) throw err;
+    return shredSegment(ref, deps, { allowCleartext: true, op: "dropSegment" });
+  }
+}
 async function shredSegment(ref, deps, options) {
   const { allowCleartext, op = "destroySegment", sweep } = options;
   const base = { segment: ref.segment, namespace: ref.namespace };
-  return casRetry(
+  const encryptedBy = /* @__PURE__ */ new Map();
+  let sentEncrypted = false;
+  const tokens = writeTokens(deps.registry, (token) => void encryptedBy.set(token, sentEncrypted));
+  const ownShred = (row) => {
+    if (row === null || row.status !== "destroyed") return null;
+    const encrypted = encryptedBy.get(row.pointerId);
+    return encrypted === void 0 ? null : { ...base, destroyed: true, cryptoShredded: encrypted, token: row.token };
+  };
+  const shred = casRetry(
     deps,
     ref,
     {
@@ -11227,6 +10765,8 @@ async function shredSegment(ref, deps, options) {
       contention: () => new WriteConflictError(`${op}: contention shredding "${ref.segment}" \u2014 retry`)
     },
     async (record) => {
+      const own = ownShred(record);
+      if (own !== null) return own;
       if (sweep !== void 0 && (record === null || record.status === "destroyed" || !sweep.wanted(record))) {
         return null;
       }
@@ -11247,32 +10787,67 @@ async function shredSegment(ref, deps, options) {
         return { ...base, destroyed: false, cryptoShredded: false, reason: "cleartext" };
       }
       const unmarked = sweep === void 0 ? withoutSweepMark(record.retention) : null;
-      const tombstone = await deps.registry.compareAndSwap(ref, record.token, {
-        status: "destroyed",
-        wrappedDeks: void 0,
-        // ← the crypto-shred: the only copy of the DEK wrappings is gone
-        keyId: void 0,
-        // The current generation's cached count and metadata go with it: sealed, they cannot be opened without
-        // the wrappings; clear, they would outlive the segment on its tombstone.
-        summary: void 0,
-        // A tombstone holds nothing: a lease names a generation of a segment that now resolves none, and the ledger
-        // vouches for objects of a segment no read resolves, which the pointer staying put would otherwise keep.
-        knownGens: void 0,
-        leases: void 0,
-        // A sweep's mark, in this same write, so no other tombstone ever carries it: any other tombstone write removes
-        // one a restored or hand-edited row carried.
-        ...sweep !== void 0 ? { retention: sweep.stamp(record.retention) } : unmarked === null ? {} : { retention: unmarked }
-      });
+      sentEncrypted = encrypted;
+      let tombstone;
+      try {
+        tombstone = await deps.registry.compareAndSwap(
+          ref,
+          record.token,
+          tombstonePatch(record, sweep, unmarked),
+          tokens.options
+        );
+      } catch (err) {
+        if (!isTransientError(err) || tokens.sent === void 0) throw err;
+        const now = await readBack(() => deps.registry.get(ref), err, deps);
+        const landed = ownShred(now);
+        if (landed !== null) return landed;
+        if (now !== null && now.token === record.token) throw err;
+        const moved = new WriteConflictError(
+          `${op}: the row of "${ref.segment}" changed while its shred got no answer`
+        );
+        moved.cause = err;
+        throw moved;
+      }
       return { ...base, destroyed: true, cryptoShredded: encrypted, token: tombstone.token };
     }
   );
+  try {
+    return await shred;
+  } catch (err) {
+    if (isWriteConflictError(err)) {
+      const own = ownShred(await deps.registry.get(ref).catch(() => null));
+      if (own !== null) return own;
+    }
+    throw err;
+  }
+}
+function tombstonePatch(record, sweep, unmarked) {
+  return {
+    status: "destroyed",
+    // ← the crypto-shred: the current row's DEK wrappings are gone (earlier versions and backups of the row keep
+    // theirs)
+    wrappedDeks: void 0,
+    keyId: void 0,
+    // The current generation's cached count and metadata go with it: sealed, they cannot be opened without
+    // the wrappings; clear, they would outlive the segment on its tombstone.
+    summary: void 0,
+    // A tombstone holds nothing: a lease names a generation of a segment that now resolves none, and the ledger
+    // vouches for objects of a segment no read resolves, which the pointer staying put would otherwise keep.
+    knownGens: void 0,
+    leases: void 0,
+    // A sweep's mark, in this same write, so no other tombstone ever carries it: any other tombstone write removes
+    // one a restored or hand-edited row carried.
+    ...sweep !== void 0 ? { retention: sweep.stamp(record.retention) } : unmarked === null ? {} : { retention: unmarked }
+  };
 }
 
 // src/core/retention-sweep.ts
 var DEFAULT_RETIRE_LIMIT = 100;
 var MAX_CONSECUTIVE_PURGE_FAULTS = 3;
 var DEFAULT_TOMBSTONE_GRACE_MS = 864e5;
+var MIN_TOMBSTONE_GRACE_MS = 36e5;
 var DEFAULT_LOOKBACK_BUCKETS = 7;
+var MAX_LOOKBACK_BUCKETS = 3660;
 async function rowsFromDueIndex(registry, options) {
   const rows = [];
   const pointers = /* @__PURE__ */ new Map();
@@ -11348,10 +10923,10 @@ async function rowsFromFleet(registry, options) {
   }
   return { rows, pointers, litter };
 }
-async function forgetDuePointer(registry, ref, expiresAt, onFault) {
+async function forgetDuePointer(deps, ref, expiresAt, onFault) {
   if (!canIndex(ref)) return;
   try {
-    await registry.delete(dueIndexRef(dueBucket(expiresAt), ref));
+    await rowDeleteSettled(deps.registry, dueIndexRef(dueBucket(expiresAt), ref), void 0, deps);
   } catch (err) {
     onFault(err);
   }
@@ -11363,22 +10938,22 @@ async function filePurgePointer(registry, ref, purgeAt) {
   } catch {
   }
 }
-async function forgetFoundPointers(registry, found2, onFault) {
+async function forgetFoundPointers(deps, found2, onFault) {
   for (const pointer of found2) {
     try {
-      await registry.delete(pointer.ref, pointer.token);
+      await rowDeleteSettled(deps.registry, pointer.ref, pointer.token, deps);
     } catch (err) {
       onFault(err);
     }
   }
 }
-async function forgetPurgePointers(registry, ref, purgeAt, found2, onFault) {
+async function forgetPurgePointers(deps, ref, purgeAt, found2, onFault) {
   if (!canIndex(ref)) return;
   const filed = dueIndexRef(dueBucket(purgeAt), ref);
   const all = found2.some((p) => p.ref.namespace === filed.namespace) ? found2 : [...found2, { ref: filed, target: ref }];
   for (const pointer of all) {
     try {
-      await registry.delete(pointer.ref, pointer.token);
+      await rowDeleteSettled(deps.registry, pointer.ref, pointer.token, deps);
     } catch (err) {
       onFault(err);
     }
@@ -11394,10 +10969,38 @@ function resolveRetireOptions(options) {
     if (!Array.isArray(options.shards)) {
       throw new ValidationError("retireExpired: shards must be an array of shard numbers");
     }
+    if (options.shards.length === 0) {
+      throw new ValidationError(
+        "retireExpired: shards is empty, so this sweep would own no segment; pass at least one shard number, or leave shards out to sweep every one"
+      );
+    }
+    const seen = /* @__PURE__ */ new Set();
     for (const shard of options.shards) {
-      requireInteger(shard, { min: 0, max: total - 1, what: "retireExpired: a shard" });
+      const n = requireInteger(shard, { min: 0, max: total - 1, what: "retireExpired: a shard" });
+      if (seen.has(n)) {
+        throw new ValidationError(
+          `retireExpired: shard ${n} is listed twice; shards is a set of shard numbers`
+        );
+      }
+      seen.add(n);
     }
   }
+  const scan = options.scan === void 0 ? "fleet" : options.scan;
+  if (scan !== "fleet" && scan !== "index") {
+    throw new ValidationError(
+      `retireExpired: \`scan\` must be 'fleet' or 'index'; got ${typeof scan === "string" ? JSON.stringify(scan) : scan === null ? "null" : typeof scan}`
+    );
+  }
+  const lookbackBuckets = options.lookbackBuckets === void 0 ? DEFAULT_LOOKBACK_BUCKETS : options.lookbackBuckets;
+  requireInteger(lookbackBuckets, {
+    min: 0,
+    max: MAX_LOOKBACK_BUCKETS,
+    what: "retireExpired: `lookbackBuckets`",
+    note: "days; older rows are the fleet scan's to find"
+  });
+  if (options.shards === void 0 && options.totalShards !== void 0) {
+    requirePositiveInteger(options.totalShards, "retireExpired: `totalShards`");
+  }
   if (options.namespace !== void 0) validateUserNamespace(options.namespace);
   const now = options.now;
   requireFiniteNumber(now, { what: "retireExpired: `now`", note: "epoch milliseconds" });
@@ -11406,11 +11009,15 @@ function resolveRetireOptions(options) {
       `retireExpired: \`now\` (${now}) is before ${MIN_EXPIRES_AT_MS} \u2014 that is almost certainly epoch SECONDS rather than milliseconds. A sweep with a wrong-units clock treats every policy as expired.`
     );
   }
-  const limit = options.limit ?? DEFAULT_RETIRE_LIMIT;
+  const limit = options.limit === void 0 ? DEFAULT_RETIRE_LIMIT : options.limit;
   requirePositiveInteger(limit, "retireExpired: `limit`");
   const purgeTombstones = options.purgeTombstones ?? true;
-  const grace = options.tombstoneGraceMs ?? DEFAULT_TOMBSTONE_GRACE_MS;
-  requireFiniteNumber(grace, { min: 0, what: "retireExpired: `tombstoneGraceMs`" });
+  const grace = options.tombstoneGraceMs === void 0 ? DEFAULT_TOMBSTONE_GRACE_MS : options.tombstoneGraceMs;
+  requireFiniteNumber(grace, {
+    min: MIN_TOMBSTONE_GRACE_MS,
+    what: "retireExpired: `tombstoneGraceMs`",
+    note: "one hour: the tombstone must outlast a create sent again after it got no answer"
+  });
   const maxScanSegments = options.maxScanSegments === void 0 ? DEFAULT_MAX_SCAN_SEGMENTS : options.maxScanSegments;
   requirePositiveInteger(maxScanSegments, "retireExpired: `maxScanSegments`");
   return {
@@ -11422,8 +11029,8 @@ function resolveRetireOptions(options) {
     grace,
     maxScanSegments,
     dryRun: options.dryRun === true,
-    scan: options.scan ?? "fleet",
-    lookbackBuckets: options.lookbackBuckets ?? DEFAULT_LOOKBACK_BUCKETS,
+    scan,
+    lookbackBuckets,
     shards: options.shards,
     totalShards: options.totalShards ?? 0
   };
@@ -11480,7 +11087,7 @@ async function purgeTombstone(rec, ctx) {
       try {
         const live = await deps.registry.get(ref);
         if (live?.status === "destroyed" && retirementStamp(live.retention) === null) {
-          await forgetFoundPointers(deps.registry, found2, tally.noteFault);
+          await forgetFoundPointers(deps, found2, tally.noteFault);
         }
       } catch (err) {
         tally.noteFault(err);
@@ -11500,7 +11107,7 @@ async function purgeTombstone(rec, ctx) {
     if (!await isFullyReclaimed(deps, ref)) {
       let collectFault;
       if (!dryRun) {
-        await gcOrphanGenerations(ref, deps).catch((error) => {
+        await gcOrphanGenerations(ref, deps, { incarnation: rec }).catch((error) => {
           collectFault = { error };
         });
       }
@@ -11518,12 +11125,12 @@ async function purgeTombstone(rec, ctx) {
       }
     }
     if (!dryRun) {
-      await deps.registry.delete(ref, rec.token);
+      await rowDeleteSettled(deps.registry, ref, rec.token, deps);
       tally.tombstonesPurged += 1;
       tally.purgeRun = 0;
       if (removesRows) {
         await forgetPurgePointers(
-          deps.registry,
+          deps,
           ref,
           retiredAt + grace,
           pointers.get(segmentKey(ref)) ?? [],
@@ -11554,8 +11161,9 @@ async function retireLive(rec, ctx) {
     tally.limited = true;
     return null;
   }
+  let live = null;
   try {
-    const live = await deps.registry.get(ref);
+    live = await deps.registry.get(ref);
     const livePolicy = live === null ? null : readRetentionPolicy(live.retention);
     if (live === null || live.status === "destroyed" || livePolicy === null || livePolicy === "invalid" || livePolicy.expiresAt > now) {
       return { ...base, action: "skipped", reason: "policy-changed" };
@@ -11586,11 +11194,11 @@ async function retireLive(rec, ctx) {
     }
     tally.retired += 1;
     tally.add({ ...base, action: "retired", expiresAt: livePolicy.expiresAt, result });
-    await forgetDuePointer(deps.registry, ref, livePolicy.expiresAt, tally.noteFault);
+    await forgetDuePointer(deps, ref, livePolicy.expiresAt, tally.noteFault);
     if (opts.purgeTombstones && result.generationsDeleted.length === 0 && result.generationsRemaining.length === 0) {
       const tombstone = await deps.registry.get(ref).catch(() => null);
       if (tombstone?.status === "destroyed") {
-        const deleted = await deps.registry.delete(ref, tombstone.token).then(
+        const deleted = await rowDeleteSettled(deps.registry, ref, tombstone.token, deps).then(
           () => true,
           (err) => {
             tally.noteFault(err);
@@ -11603,28 +11211,58 @@ async function retireLive(rec, ctx) {
     if (removesRows) await filePurgePointer(deps.registry, ref, now + grace);
     return null;
   } catch (err) {
-    const after = await deps.registry.get(ref).catch(() => null);
-    if (after?.status === "destroyed" && after.retention?.[SWEEP_MARK] === now) {
-      if (removesRows) await filePurgePointer(deps.registry, ref, now + grace);
-      tally.retired += 1;
+    const after = await rowAfterFault(deps, ref, err);
+    if (after?.status === "destroyed" && after.retention?.[SWEEP_MARK] === now && live !== null && sameIncarnation(live, after)) {
+      return retiredAfterFault(live, policy.expiresAt, err, ctx);
+    }
+    if (after === void 0) {
       return {
         ...base,
-        action: "retired",
-        expiresAt: policy.expiresAt,
-        result: {
-          ...base,
-          dropped: true,
-          generationsDeleted: [],
-          generationsRemaining: [],
-          cryptoShredded: false,
-          reason: void 0
-        },
-        fault: failureReason(err)
+        action: "skipped",
+        reason: `${failureReason(err)} (the row could not be read afterwards: the tombstone may have landed, and the segment may be shredded)`
       };
     }
     return { ...base, action: "skipped", reason: failureReason(err) };
   }
 }
+async function rowAfterFault(deps, ref, err) {
+  try {
+    return await readBack(
+      () => deps.registry.get(ref),
+      err instanceof Error ? err : new Error(String(err)),
+      deps
+    );
+  } catch {
+    return void 0;
+  }
+}
+async function retiredAfterFault(live, expiresAt, err, ctx) {
+  const { deps, opts, removesRows, tally } = ctx;
+  const ref = { namespace: live.namespace, segment: live.segment };
+  const base = { segment: live.segment, namespace: live.namespace };
+  if (removesRows) await filePurgePointer(deps.registry, ref, opts.now + opts.grace);
+  tally.retired += 1;
+  const remaining = await generationsOf(deps.storage, ref).catch(() => namedBy(live));
+  return {
+    ...base,
+    action: "retired",
+    expiresAt,
+    result: {
+      ...base,
+      dropped: true,
+      generationsDeleted: [],
+      generationsRemaining: remaining,
+      cryptoShredded: live.wrappedDeks !== void 0 && live.wrappedDeks.length > 0,
+      reason: void 0
+    },
+    fault: failureReason(err)
+  };
+}
+function namedBy(row) {
+  const names = new Set((row.knownGens ?? []).map((k) => k.generation));
+  if (row.currentGen !== null) names.add(row.currentGen);
+  return [...names].sort((a, b) => a - b);
+}
 async function retireExpired(deps, options) {
   const opts = resolveRetireOptions(options);
   const { now, limit, dryRun, shards, totalShards } = opts;
@@ -11656,7 +11294,7 @@ async function retireExpired(deps, options) {
       attemptedLitter += 1;
       try {
         if (await deps.registry.get(pointer.target) !== null) continue;
-        await deps.registry.delete(pointer.ref, pointer.token);
+        await rowDeleteSettled(deps.registry, pointer.ref, pointer.token, deps);
       } catch (err) {
         tally.noteFault(err);
       }
@@ -11694,6 +11332,411 @@ function failureReason(err) {
   return `failed: ${err instanceof Error ? err.message : String(err)}`;
 }
 
+// src/core/preflight.ts
+var PREFLIGHT_NAMESPACE = `${RESERVED_NAMESPACE_PREFIX}preflight`;
+var PREFLIGHT_SEGMENT = "probe";
+var LIFECYCLE_TIMEOUT_MS = 3e4;
+var LIFECYCLE_TICK_MS = 250;
+var MARKER_A = ascii("cloudbitmaps preflight probe A");
+var MARKER_B = ascii("cloudbitmaps preflight probe B");
+var TAIL_BYTES = 64;
+var MAX_MESSAGE_CHARS = 300;
+var MAX_LEFTOVERS_NAMED = 3;
+var MAX_LIFECYCLE_DETAIL_CHARS = 1e3;
+function ascii(text) {
+  const bytes = new Uint8Array(text.length);
+  for (let i = 0; i < text.length; i += 1) bytes[i] = text.charCodeAt(i);
+  return bytes;
+}
+function sameBytes2(a, b) {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i += 1) if (a[i] !== b[i]) return false;
+  return true;
+}
+function probeNumber(entropy) {
+  const bytes = entropy(6);
+  if (!(bytes instanceof Uint8Array) || bytes.length < 6) {
+    throw new TypeError("preflight needs an entropy source that returns the bytes it is asked for");
+  }
+  let n = 0;
+  for (let i = 0; i < 6; i += 1) n = n * 256 + (bytes[i] ?? 0);
+  return n;
+}
+function describeError(err) {
+  let name = "Error";
+  let message = "";
+  try {
+    if (typeof err === "object" && err !== null) {
+      const n = err.name;
+      const m = err.message;
+      if (typeof n === "string" && n !== "") name = n;
+      if (typeof m === "string") message = m;
+    } else {
+      message = String(err);
+    }
+  } catch {
+  }
+  const cut = message.length > MAX_MESSAGE_CHARS ? `${message.slice(0, MAX_MESSAGE_CHARS)}...` : message;
+  return cut === "" ? name : `${name}: ${cut}`;
+}
+function failed(doing, err) {
+  let transient = false;
+  try {
+    transient = isTransientError(err);
+  } catch {
+  }
+  return `${doing} failed with ${describeError(err)}.${transient ? " This is a transient fault: run preflight() again." : ""}`;
+}
+function isConflict(err) {
+  try {
+    return isWriteConflictError(err);
+  } catch {
+    return false;
+  }
+}
+var REFUSAL_NAMES = /* @__PURE__ */ new Set([
+  "AccessDenied",
+  "Forbidden",
+  "AuthorizationFailure",
+  "AuthorizationPermissionMismatch"
+]);
+function provesRefused(err) {
+  try {
+    for (let e = err, depth = 0; typeof e === "object" && e !== null && depth < 2; depth += 1) {
+      if (isValidationError(e)) return true;
+      const shape = e;
+      if (typeof shape.name === "string" && REFUSAL_NAMES.has(shape.name)) return true;
+      const status = shape.$metadata?.httpStatusCode ?? shape.statusCode ?? shape.status ?? shape.code;
+      if (status === 401 || status === 403) return true;
+      e = shape.cause;
+    }
+  } catch {
+  }
+  return false;
+}
+var ORDER = [
+  "registry",
+  "write",
+  "write-once",
+  "read",
+  "list",
+  "delete",
+  "lifecycle"
+];
+async function lifecycleStep(deps) {
+  const check = deps.checkLifecycle;
+  if (check === void 0) {
+    return {
+      status: "unchecked",
+      detail: "This backend does not offer the lifecycle check. Look at the bucket lifecycle rules by hand: none may delete or archive the store objects or the registry rows."
+    };
+  }
+  let settled2 = false;
+  const run = (async () => {
+    try {
+      return { kind: "answered", verdict: await check() };
+    } catch (error) {
+      return { kind: "threw", error };
+    } finally {
+      settled2 = true;
+    }
+  })();
+  const bound = (async () => {
+    try {
+      for (let waited = 0; waited < LIFECYCLE_TIMEOUT_MS && !settled2; waited += LIFECYCLE_TICK_MS) {
+        await deps.clock.sleep(LIFECYCLE_TICK_MS);
+      }
+    } catch (error) {
+      return { kind: "clock", error };
+    }
+    return { kind: "timeout" };
+  })();
+  let outcome = await Promise.race([run, bound]);
+  if (outcome.kind === "timeout" && settled2) outcome = await run;
+  if (outcome.kind === "timeout") {
+    return {
+      status: "unchecked",
+      detail: `The lifecycle check did not answer within ${LIFECYCLE_TIMEOUT_MS / 1e3} seconds. Run preflight() again, or look at the bucket lifecycle rules by hand.`
+    };
+  }
+  if (outcome.kind === "clock") {
+    return {
+      status: "unchecked",
+      detail: `The store's clock failed while the lifecycle check was timed: ${describeError(outcome.error)}. Run preflight() again, or look at the bucket lifecycle rules by hand.`
+    };
+  }
+  if (outcome.kind === "threw") {
+    return {
+      status: "unchecked",
+      detail: `${failed("The lifecycle check", outcome.error)} Look at the bucket lifecycle rules by hand.`
+    };
+  }
+  return readVerdict(outcome.verdict);
+}
+function readVerdict(answer) {
+  const unreadable = {
+    status: "unchecked",
+    detail: "The lifecycle check gave an answer preflight could not read. Look at the bucket lifecycle rules by hand."
+  };
+  try {
+    const verdict = answer;
+    const status = verdict?.status;
+    if (status !== "ok" && status !== "problem" && status !== "unchecked") return unreadable;
+    const text = verdict?.detail;
+    const detail = typeof text === "string" ? text : "";
+    return {
+      status,
+      detail: detail.length > MAX_LIFECYCLE_DETAIL_CHARS ? `${detail.slice(0, MAX_LIFECYCLE_DETAIL_CHARS)}...` : detail
+    };
+  } catch {
+    return unreadable;
+  }
+}
+async function registryStep(registry) {
+  const row = await registry.get({ namespace: PREFLIGHT_NAMESPACE, segment: PREFLIGHT_SEGMENT });
+  if (row !== null) {
+    return {
+      status: "problem",
+      detail: `A registry row exists at ${PREFLIGHT_NAMESPACE}/${PREFLIGHT_SEGMENT}, an address only the library uses and never writes a row at. The registry is not the one this store expects, or something else writes there.`
+    };
+  }
+  if (registry.capabilities().canWrite === false) {
+    return {
+      status: "problem",
+      detail: "The registry reads but cannot write in this runtime (no Web Crypto to draw its tokens from), so a load would be refused."
+    };
+  }
+  return { status: "ok", detail: "The registry answered a read, and can write." };
+}
+async function guarded(run, onThrow) {
+  try {
+    return await run();
+  } catch (err) {
+    return onThrow(err);
+  }
+}
+var skipped = (because) => ({
+  status: "unchecked",
+  detail: `Not run: ${because}.`
+});
+async function writeStep(probe) {
+  try {
+    await probe.storage.putImmutable(probe.key, async (sink) => sink.write(MARKER_A));
+    probe.found.set("write", { status: "ok", detail: "A new object was written." });
+    return { wrote: true, notOurs: false };
+  } catch (err) {
+    const notOurs = isConflict(err);
+    probe.refused = !notOurs && provesRefused(err);
+    probe.found.set("write", {
+      status: "problem",
+      detail: notOurs ? "The probe object already existed: another run drew the same number. Run preflight() again." : failed("Writing a new object", err)
+    });
+    return { wrote: false, notOurs };
+  }
+}
+async function writeOnceStep(probe) {
+  try {
+    await probe.storage.putImmutable(probe.key, async (sink) => sink.write(MARKER_B));
+    probe.accepted = MARKER_B;
+    probe.found.set("write-once", {
+      status: "problem",
+      detail: "A second write to the same key succeeded. The storage does not refuse an overwrite, so a generation could be replaced under a reader."
+    });
+  } catch (err) {
+    probe.found.set(
+      "write-once",
+      isConflict(err) ? { status: "ok", detail: "A second write to the same key was refused." } : {
+        status: "problem",
+        detail: `${failed("The second write to the same key", err)} Whether it was refused is not known.`
+      }
+    );
+  }
+}
+async function readStep(probe) {
+  try {
+    const tail = await probe.storage.getTail(probe.key, TAIL_BYTES);
+    probe.version = tail.version;
+    const same = sameBytes2(tail.bytes, probe.accepted) && tail.size === probe.accepted.length;
+    probe.found.set(
+      "read",
+      same ? { status: "ok", detail: "The object just written read back as written." } : {
+        status: "problem",
+        detail: `The object just written did not read back as written: the bytes or the size differ.${probe.found.get("write-once")?.status === "problem" ? " It was compared against the bytes the storage accepted last, so look at the write-once check first." : ""}`
+      }
+    );
+  } catch (err) {
+    probe.found.set("read", {
+      status: "problem",
+      detail: failed("Reading the object just written", err)
+    });
+  }
+}
+function leftoversSentence(others, named) {
+  if (others === 0) return "";
+  const more = others > named.length ? ", ..." : "";
+  const one = others === 1;
+  return ` ${others} other probe object${one ? "" : "s"} (generation ${named.join(", ")}${more}) ${one ? "was" : "were"} left alone: ${one ? "it may be" : "they may be"} a run in progress, or one that was cut off.`;
+}
+async function listStep(probe) {
+  try {
+    let seen = false;
+    let others = 0;
+    const named = [];
+    for await (const listed2 of probe.storage.list({
+      namespace: PREFLIGHT_NAMESPACE,
+      segment: PREFLIGHT_SEGMENT
+    })) {
+      if (listed2.generation === probe.key.generation) {
+        seen = true;
+      } else {
+        others += 1;
+        if (named.length < MAX_LEFTOVERS_NAMED) named.push(listed2.generation);
+      }
+    }
+    const leftovers = leftoversSentence(others, named);
+    probe.found.set(
+      "list",
+      seen ? { status: "ok", detail: `The listing named the object just written.${leftovers}` } : {
+        status: "problem",
+        detail: `The listing did not name the object just written, so a listing can lag a write.${leftovers}`
+      }
+    );
+  } catch (err) {
+    probe.found.set("list", {
+      status: "problem",
+      detail: failed("Listing the probe segment", err)
+    });
+  }
+}
+async function deleteStep(probe, wrote) {
+  try {
+    await probe.storage.delete(
+      probe.key,
+      probe.version === void 0 ? void 0 : { ifVersion: probe.version }
+    );
+    probe.found.set(
+      "delete",
+      wrote ? { status: "ok", detail: "The object was deleted." } : {
+        status: "unchecked",
+        detail: "The write failed, so this check was not made. The run deleted its key in case the write had landed; that delete succeeded, which it also does when no object was there."
+      }
+    );
+  } catch (err) {
+    if (wrote) {
+      probe.found.set("delete", {
+        status: "problem",
+        detail: `${failed("Deleting the object just written", err)} The object ${probe.object} was left behind: delete it by hand.`
+      });
+      return;
+    }
+    const write = probe.found.get("write");
+    if (probe.refused) {
+      probe.found.set("delete", {
+        status: "unchecked",
+        detail: `The write failed, so this check was not made. The run tried to delete its key in case the write had landed, and that failed with ${describeError(err)}. The write was most likely refused and stored nothing; a later run's \`list\` names any probe it finds.`
+      });
+      return;
+    }
+    probe.found.set("delete", {
+      status: "unchecked",
+      detail: `The write failed, so this check was not made. The run tried to delete its key in case the write had landed, and that failed with ${describeError(err)}.`
+    });
+    if (write !== void 0) {
+      probe.found.set("write", {
+        status: write.status,
+        detail: `${write.detail} The write may have landed, and the delete of ${probe.object} failed, so it may have been left behind.`
+      });
+    }
+  }
+}
+async function objectSteps(probe) {
+  const { wrote, notOurs } = await writeStep(probe);
+  try {
+    if (wrote) {
+      await writeOnceStep(probe);
+      await readStep(probe);
+      await listStep(probe);
+    } else {
+      const why = skipped("no object was written");
+      for (const name of ["write-once", "read", "list"]) probe.found.set(name, why);
+    }
+  } finally {
+    if (notOurs) {
+      probe.found.set(
+        "delete",
+        skipped("the object under the key was not this run's, so it was left alone")
+      );
+    } else {
+      await deleteStep(probe, wrote);
+    }
+  }
+}
+function drawKey(entropy) {
+  try {
+    return {
+      namespace: PREFLIGHT_NAMESPACE,
+      segment: PREFLIGHT_SEGMENT,
+      generation: probeNumber(entropy)
+    };
+  } catch (error) {
+    return { error };
+  }
+}
+function noNumber(error) {
+  const found2 = /* @__PURE__ */ new Map();
+  found2.set("write", {
+    status: "problem",
+    detail: `No number could be drawn for the probe's name, so nothing was written: ${describeError(error)}. Give the store an entropy source (the runtime's Web Crypto, or the \`entropy\` seam).`
+  });
+  const why = skipped("no object was written");
+  for (const name of ["write-once", "read", "list", "delete"]) found2.set(name, why);
+  return found2;
+}
+async function objectFindings(deps, key) {
+  const probe = {
+    storage: deps.storage,
+    key,
+    object: `${PREFLIGHT_NAMESPACE}/segments/${PREFLIGHT_SEGMENT}.${key.generation}.crbm (under the store's prefix)`,
+    found: /* @__PURE__ */ new Map(),
+    accepted: MARKER_A,
+    refused: false
+  };
+  try {
+    await objectSteps(probe);
+  } catch (err) {
+    for (const name of ["write", "write-once", "read", "list", "delete"]) {
+      if (!probe.found.has(name)) {
+        probe.found.set(name, { status: "problem", detail: failed("The check", err) });
+      }
+    }
+  }
+  return probe.found;
+}
+async function runPreflight(deps) {
+  const registry = await guarded(
+    () => registryStep(deps.registry),
+    (err) => ({ status: "problem", detail: failed("Reading the registry", err) })
+  );
+  const key = drawKey(deps.entropy);
+  const found2 = "error" in key ? noNumber(key.error) : await objectFindings(deps, key);
+  found2.set("registry", registry);
+  found2.set(
+    "lifecycle",
+    await guarded(
+      () => lifecycleStep(deps),
+      (err) => ({
+        status: "unchecked",
+        detail: `${failed("The lifecycle check", err)} Look at the bucket lifecycle rules by hand.`
+      })
+    )
+  );
+  const checks = ORDER.map((name) => ({
+    name,
+    ...found2.get(name) ?? skipped("the check did not run")
+  }));
+  return { ok: !checks.some((c) => c.status === "problem"), checks };
+}
+
 // src/core/consistency.ts
 var DEFAULT_CHECK_CONCURRENCY = 8;
 var NOTHING = { issues: [] };
@@ -11838,7 +11881,7 @@ async function runConsistencyCheck(deps, options = {}) {
   if (options.generations !== void 0 && typeof options.generations !== "boolean") {
     throw new ValidationError(`generations must be a boolean; got ${String(options.generations)}`);
   }
-  const concurrency = options.concurrency ?? DEFAULT_CHECK_CONCURRENCY;
+  const concurrency = options.concurrency === void 0 ? DEFAULT_CHECK_CONCURRENCY : options.concurrency;
   requirePositiveInteger(concurrency, "concurrency");
   const maxScanSegments = options.maxScanSegments === void 0 ? DEFAULT_MAX_SCAN_SEGMENTS : options.maxScanSegments;
   const recs = await drainRegistry(deps.registry, {
@@ -11997,19 +12040,15 @@ export {
   CrbmStorageChunkSource,
   DEFAULT_BUDGET,
   DEFAULT_RETRY_POLICY,
-  InProcessKeystore,
   IntegrityError,
   KeyUnavailableError,
   LEASE_SKEW_MS,
   LeaseExpiredError,
   LeaseLimitError,
-  LocalFsStorage,
   MAX_LEASES_PER_SEGMENT,
   MAX_LEASE_MS,
   MIN_EXPIRES_AT_MS,
-  MemoryStorage,
   NOOP_METRICS,
-  NodeAead,
   NotFoundError,
   PinnedStorageChunkSource,
   RecordingAuditSink,
@@ -12032,6 +12071,7 @@ export {
   eraseNamespace,
   errorKind,
   excludingReservedRows,
+  findIdUnderTombstone,
   getSegmentRetention,
   isStorageBackend,
   judgeLoad,
@@ -12042,6 +12082,7 @@ export {
   mapWithConcurrency,
   readRetentionPolicy,
   rebindCombineMany,
+  refuseUnknownRefKeys,
   releaseLease,
   resolveBudget,
   resolvePerOpBudget,
@@ -12050,6 +12091,7 @@ export {
   runCombineMany,
   runConsistencyCheck,
   runExport,
+  runPreflight,
   safeMetrics,
   segmentExists,
   segmentKey,