@cloudbitmaps/roaring 0.22.0 → 0.24.0

package/dist/index.js

@@ -11,17 +11,20 @@ import {
   RetryingStorageChunkSource as RetryingStorageChunkSource2,
   SegmentEngine,
   LEASE_SKEW_MS,
+  BudgetExceededError,
   LeaseExpiredError,
   MAX_LEASE_MS,
   NotFoundError,
   UnsupportedError as UnsupportedError2,
-  ValidationError as ValidationError4,
+  ValidationError as ValidationError6,
+  errorKind,
   WriteConflictError,
   checkBudget,
   collectWithinBudget,
   excludingReservedRows,
   dropSegment,
   eraseIdFromSegment,
+  findIdUnderTombstone,
   judgeLoad,
   loadSegment,
   loadSegmentChunks,
@@ -42,7 +45,12 @@ import {
   splitId,
   takeLease
 } from "@cloudbitmaps/core";
-import { pointerIdOf, requirePositiveInt, validateSegmentRef } from "@cloudbitmaps/core/driver-kit";
+import {
+  pointerIdOf,
+  requireBool,
+  requirePositiveInt,
+  validateSegmentRef
+} from "@cloudbitmaps/core/driver-kit";
 
 // src/open-charging-storage.ts
 var OpenChargingStorage = class {
@@ -58,6 +66,7 @@ var OpenChargingStorage = class {
   }
   inner;
   charge;
+  /** Generations an open of costs nothing more: the scan's current one, this call's writes, and each one charged. */
   free = /* @__PURE__ */ new Set();
   capabilities() {
     return this.inner.capabilities();
@@ -70,9 +79,15 @@ var OpenChargingStorage = class {
   getRange(key, offset, length) {
     return this.inner.getRange(key, offset, length);
   }
-  /** One `getTail` is one open: a reader takes the footer and the index from it, and reads chunks with `getRange`. */
+  /**
+   * One `getTail` is one open: a reader takes the footer and the index from it, and reads chunks with `getRange`. A
+   * generation is charged at its first open only.
+   */
   async getTail(key, maxBytes) {
-    if (!this.free.has(key.generation)) this.charge();
+    if (!this.free.has(key.generation)) {
+      this.charge();
+      this.free.add(key.generation);
+    }
     return this.inner.getTail(key, maxBytes);
   }
   /** Handed through whole: the erasure's delete of a holder is conditioned on the object it searched. */
@@ -86,7 +101,12 @@ var OpenChargingStorage = class {
 
 // src/index.ts
 import { listGenerations, rollbackSegment } from "@cloudbitmaps/core";
-import { listSegments, segmentExists } from "@cloudbitmaps/core";
+import {
+  destroySegment as coreDestroySegment,
+  eraseNamespace as coreEraseNamespace
+} from "@cloudbitmaps/core";
+import { listSegments, refuseUnknownRefKeys, segmentExists } from "@cloudbitmaps/core";
+import { runPreflight } from "@cloudbitmaps/core";
 
 // src/reserved-namespace.ts
 import { ValidationError } from "@cloudbitmaps/core";
@@ -100,8 +120,10 @@ function refuseReservedNamespace(namespace) {
 }
 
 // src/roaring-codec.ts
-import roaring from "roaring";
-import { IntegrityError as IntegrityError2, decodeSerialized } from "@cloudbitmaps/core";
+import { ValidationError as ValidationError3, decodeSerialized } from "@cloudbitmaps/core";
+
+// src/ts-roaring/bitmap.ts
+import { IntegrityError as IntegrityError3, ValidationError as ValidationError2 } from "@cloudbitmaps/core";
 
 // src/portable/layout.ts
 import { IntegrityError } from "@cloudbitmaps/core";
@@ -119,45 +141,10 @@ function overrun(bytes, offset, length, what) {
     `portable roaring: ${what} needs bytes [${offset}, ${offset + length}) of a ${bytes.byteLength}-byte buffer`
   );
 }
-function checkPortableLayout(bytes) {
-  return walk(bytes, null);
-}
-var SINGLE_HEADER_BYTES = 16;
-var SINGLE_RUN_HEADER_BYTES = 9;
-function* containerPayloads(bytes) {
-  if (bytes.byteLength === 0) return;
-  const { view, count, runFlagsAt, descriptiveAt, bodiesAt } = header(bytes);
-  let pos = bodiesAt;
-  let previousKey = -1;
-  for (let i = 0; i < count; i++) {
-    const key = view.getUint16(descriptiveAt + i * 4, true);
-    if (key <= previousKey) {
-      throw new IntegrityError(
-        `portable roaring: container keys are not strictly ascending (${previousKey} then ${key} at index ${i})`
-      );
-    }
-    previousKey = key;
-    const cardinality = view.getUint16(descriptiveAt + i * 4 + 2, true) + 1;
-    const isRun = runFlagsAt >= 0 && (bytes[runFlagsAt + (i >>> 3)] & 1 << (i & 7)) !== 0;
-    const kind = isRun ? RUN : cardinality > ARRAY_MAX_CARDINALITY ? BITMAP : ARRAY;
-    const size = checkContainer(bytes, view, pos, kind, cardinality, i);
-    const headerBytes = isRun ? SINGLE_RUN_HEADER_BYTES : SINGLE_HEADER_BYTES;
-    const payload = new Uint8Array(headerBytes + size);
-    const out = new DataView(payload.buffer);
-    if (isRun) {
-      out.setUint32(0, SERIAL_COOKIE, true);
-      payload[4] = 1;
-      out.setUint16(7, cardinality - 1, true);
-    } else {
-      out.setUint32(0, SERIAL_COOKIE_NO_RUNCONTAINER, true);
-      out.setUint32(4, 1, true);
-      out.setUint16(10, cardinality - 1, true);
-      out.setUint32(12, SINGLE_HEADER_BYTES, true);
-    }
-    payload.set(bytes.subarray(pos, pos + size), headerBytes);
-    pos += size;
-    yield { chunkKey: key, payload, cardinality };
-  }
+function parsePortableLayout(bytes) {
+  const containers = [];
+  walk(bytes, containers);
+  return containers;
 }
 function header(bytes) {
   const length = bytes.byteLength;
@@ -308,165 +295,1606 @@ function popcount(view, at) {
   return bits;
 }
 
-// src/roaring-codec.ts
-var { RoaringBitmap32, SerializationFormat, DeserializationFormat } = roaring;
-var SafeBitmap = class _SafeBitmap {
-  bitmap;
-  constructor(bitmap) {
-    this.bitmap = bitmap;
+// src/ts-roaring/containers.ts
+var ARRAY2 = 0;
+var BITSET = 1;
+var RUN2 = 2;
+var WORDS = 2048;
+var BITSET_BYTES = 8192;
+var GALLOP_SKEW = 16;
+var LITTLE_ENDIAN = new Uint8Array(Uint16Array.of(1).buffer)[0] === 1;
+var Container = class {
+  constructor(kind, data, off, len, card, shared) {
+    this.kind = kind;
+    this.data = data;
+    this.off = off;
+    this.len = len;
+    this.card = card;
+    this.shared = shared;
+  }
+  kind;
+  data;
+  off;
+  len;
+  card;
+  shared;
+};
+function lows16(c) {
+  return c.data;
+}
+function words32(c) {
+  return c.data;
+}
+function arrayContainer(values, card) {
+  return new Container(ARRAY2, values, 0, card, card, false);
+}
+function bitsetContainer(words, card) {
+  return new Container(BITSET, words, 0, 0, card, false);
+}
+function runContainer(pairs, runs, card) {
+  return new Container(RUN2, pairs, 0, runs, card, false);
+}
+var valueScratch = new Uint16Array(8192);
+var pairScratch = new Uint16Array(8192);
+var SCRATCH_KEEP = 65536;
+function values16(n) {
+  if (valueScratch.length >= n) return valueScratch;
+  if (n > SCRATCH_KEEP) return new Uint16Array(n);
+  valueScratch = new Uint16Array(Math.max(n, Math.min(2 * valueScratch.length, SCRATCH_KEEP)));
+  return valueScratch;
+}
+function pairs16(n) {
+  if (pairScratch.length >= n) return pairScratch;
+  if (n > SCRATCH_KEEP) return new Uint16Array(n);
+  pairScratch = new Uint16Array(Math.max(n, Math.min(2 * pairScratch.length, SCRATCH_KEEP)));
+  return pairScratch;
+}
+function arrayOfScratch(scratch, n) {
+  return n === 0 ? null : arrayContainer(scratch.slice(0, n), n);
+}
+function popcount32(word) {
+  let w = word - (word >>> 1 & 1431655765);
+  w = (w & 858993459) + (w >>> 2 & 858993459);
+  return Math.imul(w + (w >>> 4) & 252645135, 16843009) >>> 24;
+}
+function popcountWords(d) {
+  let total = 0;
+  let ones = 0;
+  let twos = 0;
+  let fours = 0;
+  let eights = 0;
+  for (let i = 0; i < WORDS; i += 16) {
+    let u;
+    let twosA;
+    let twosB;
+    let foursA;
+    let foursB;
+    let x = d[i];
+    let y = d[i + 1];
+    u = ones ^ x;
+    twosA = ones & x | u & y;
+    ones = u ^ y;
+    x = d[i + 2];
+    y = d[i + 3];
+    u = ones ^ x;
+    twosB = ones & x | u & y;
+    ones = u ^ y;
+    u = twos ^ twosA;
+    foursA = twos & twosA | u & twosB;
+    twos = u ^ twosB;
+    x = d[i + 4];
+    y = d[i + 5];
+    u = ones ^ x;
+    twosA = ones & x | u & y;
+    ones = u ^ y;
+    x = d[i + 6];
+    y = d[i + 7];
+    u = ones ^ x;
+    twosB = ones & x | u & y;
+    ones = u ^ y;
+    u = twos ^ twosA;
+    foursB = twos & twosA | u & twosB;
+    twos = u ^ twosB;
+    u = fours ^ foursA;
+    const eightsA = fours & foursA | u & foursB;
+    fours = u ^ foursB;
+    x = d[i + 8];
+    y = d[i + 9];
+    u = ones ^ x;
+    twosA = ones & x | u & y;
+    ones = u ^ y;
+    x = d[i + 10];
+    y = d[i + 11];
+    u = ones ^ x;
+    twosB = ones & x | u & y;
+    ones = u ^ y;
+    u = twos ^ twosA;
+    foursA = twos & twosA | u & twosB;
+    twos = u ^ twosB;
+    x = d[i + 12];
+    y = d[i + 13];
+    u = ones ^ x;
+    twosA = ones & x | u & y;
+    ones = u ^ y;
+    x = d[i + 14];
+    y = d[i + 15];
+    u = ones ^ x;
+    twosB = ones & x | u & y;
+    ones = u ^ y;
+    u = twos ^ twosA;
+    foursB = twos & twosA | u & twosB;
+    twos = u ^ twosB;
+    u = fours ^ foursA;
+    const eightsB = fours & foursA | u & foursB;
+    fours = u ^ foursB;
+    u = eights ^ eightsA;
+    const sixteens = eights & eightsA | u & eightsB;
+    eights = u ^ eightsB;
+    total += popcount32(sixteens);
+  }
+  return 16 * total + 8 * popcount32(eights) + 4 * popcount32(fours) + 2 * popcount32(twos) + popcount32(ones);
+}
+function setRange(words, start, end) {
+  const first = start >>> 5;
+  const last = end >>> 5;
+  const head = 4294967295 << (start & 31) >>> 0;
+  const tail = 4294967295 >>> 31 - (end & 31);
+  if (first === last) {
+    words[first] = words[first] | head & tail;
+    return;
+  }
+  words[first] = words[first] | head;
+  for (let i = first + 1; i < last; i++) words[i] = 4294967295;
+  words[last] = words[last] | tail;
+}
+function clearRange(words, start, end) {
+  const first = start >>> 5;
+  const last = end >>> 5;
+  const head = 4294967295 << (start & 31) >>> 0;
+  const tail = 4294967295 >>> 31 - (end & 31);
+  if (first === last) {
+    words[first] = words[first] & ~(head & tail);
+    return;
+  }
+  words[first] = words[first] & ~head;
+  for (let i = first + 1; i < last; i++) words[i] = 0;
+  words[last] = words[last] & ~tail;
+}
+function fromSortedIds(ids, from, to) {
+  const n = to - from;
+  if (n <= ARRAY_MAX_CARDINALITY) {
+    const lows = new Uint16Array(n);
+    let count = 0;
+    let previous = -1;
+    for (let i = from; i < to; i++) {
+      const low = ids[i] & 65535;
+      if (low !== previous) lows[count++] = low;
+      previous = low;
+    }
+    return arrayContainer(count === n ? lows : lows.slice(0, count), count);
+  }
+  const words = new Uint32Array(WORDS);
+  for (let i = from; i < to; i++) {
+    const v = ids[i] & 65535;
+    words[v >>> 5] = words[v >>> 5] | 1 << (v & 31);
+  }
+  return fromWordsCard(words, popcountWords(words));
+}
+function fromWordsCard(words, card) {
+  if (card === 0) return null;
+  if (card > ARRAY_MAX_CARDINALITY) return bitsetContainer(words, card);
+  const out = new Uint16Array(card);
+  wordsToLows(words, out);
+  return arrayContainer(out, card);
+}
+function wordsToLows(words, out) {
+  let k = 0;
+  for (let i = 0; i < WORDS; i++) {
+    let w = words[i];
+    const base = i * 32 + 31;
+    while (w !== 0) {
+      const lowest = w & -w;
+      out[k++] = base - Math.clz32(lowest);
+      w ^= lowest;
+    }
+  }
+  return k;
+}
+function writeLows(c, out) {
+  if (c.kind === ARRAY2) {
+    out.set(lows16(c).subarray(c.off, c.off + c.len));
+  } else if (c.kind === BITSET) {
+    wordsToLows(words32(c), out);
+  } else {
+    const u16 = lows16(c);
+    let k = 0;
+    for (let r = 0; r < c.len; r++) {
+      const start = u16[c.off + 2 * r];
+      const end = start + u16[c.off + 2 * r + 1];
+      for (let v = start; v <= end; v++) out[k++] = v;
+    }
+  }
+}
+function appendIds(c, out, at, base) {
+  if (c.kind === ARRAY2) {
+    const u162 = lows16(c);
+    const end = c.off + c.len;
+    if (base === 0) {
+      out.set(u162.subarray(c.off, end), at);
+      return at + c.len;
+    }
+    for (let i = c.off; i < end; i++) out[at++] = base + u162[i];
+    return at;
+  }
+  if (c.kind === BITSET) {
+    const words = words32(c);
+    for (let i = 0; i < WORDS; i++) {
+      let w = words[i];
+      const top = base + i * 32 + 31;
+      while (w !== 0) {
+        const lowest = w & -w;
+        out[at++] = top - Math.clz32(lowest);
+        w ^= lowest;
+      }
+    }
+    return at;
+  }
+  const u16 = lows16(c);
+  for (let r = 0; r < c.len; r++) {
+    const start = u16[c.off + 2 * r];
+    const last = start + u16[c.off + 2 * r + 1];
+    if (last - start < LONG_RUN) {
+      for (let v = base + start; v <= base + last; v++) out[at++] = v;
+      continue;
+    }
+    const from = at;
+    out.set(iota().subarray(start, last + 1), at);
+    at += last - start + 1;
+    if (base !== 0) for (let i = from; i < at; i++) out[i] = out[i] + base;
+  }
+  return at;
+}
+var LONG_RUN = 48;
+var iotaTable;
+function iota() {
+  if (iotaTable === void 0) {
+    iotaTable = new Uint16Array(65536);
+    for (let i = 0; i < 65536; i++) iotaTable[i] = i;
+  }
+  return iotaTable;
+}
+function toWords(c) {
+  if (c.kind === BITSET) return words32(c);
+  const words = new Uint32Array(WORDS);
+  const u16 = lows16(c);
+  if (c.kind === ARRAY2) {
+    for (let i = c.off; i < c.off + c.len; i++) {
+      const v = u16[i];
+      words[v >>> 5] = words[v >>> 5] | 1 << (v & 31);
+    }
+  } else {
+    for (let r = 0; r < c.len; r++) {
+      const start = u16[c.off + 2 * r];
+      setRange(words, start, start + u16[c.off + 2 * r + 1]);
+    }
+  }
+  return words;
+}
+function demote(c) {
+  if (c.kind !== RUN2) return c;
+  if (c.card > ARRAY_MAX_CARDINALITY) return bitsetContainer(toWords(c), c.card);
+  const out = new Uint16Array(c.card);
+  writeLows(c, out);
+  return arrayContainer(out, c.card);
+}
+function cloneContainer(c) {
+  if (c.kind === BITSET) return bitsetContainer(words32(c).slice(), c.card);
+  const copy = lows16(c).slice(c.off, c.off + (c.kind === ARRAY2 ? c.len : 2 * c.len));
+  return new Container(c.kind, copy, 0, c.len, c.card, false);
+}
+function writableWords(c) {
+  return c.shared ? words32(c).slice() : words32(c);
+}
+function lowerBound(data, off, len, low, stride) {
+  let lo = 0;
+  let hi = len;
+  while (lo < hi) {
+    const mid = lo + hi >>> 1;
+    if (data[off + mid * stride] < low) lo = mid + 1;
+    else hi = mid;
+  }
+  return lo;
+}
+function gallop(data, off, from, end, target) {
+  let step = 1;
+  let lo = from;
+  let hi = from;
+  while (hi < end && data[off + hi] < target) {
+    lo = hi + 1;
+    hi += step;
+    step *= 2;
+  }
+  if (hi > end) hi = end;
+  while (lo < hi) {
+    const mid = lo + hi >>> 1;
+    if (data[off + mid] < target) lo = mid + 1;
+    else hi = mid;
+  }
+  return lo;
+}
+function containerHas(c, low) {
+  if (c.kind === BITSET)
+    return (c.data[low >>> 5] >>> (low & 31) & 1) === 1;
+  const u16 = c.data;
+  if (c.kind === ARRAY2) {
+    const at = lowerBound(u16, c.off, c.len, low, 1);
+    return at < c.len && u16[c.off + at] === low;
+  }
+  const after = lowerBound(u16, c.off, c.len, low + 1, 2);
+  if (after === 0) return false;
+  const r = c.off + 2 * (after - 1);
+  return low <= u16[r] + u16[r + 1];
+}
+function containerAdd(c, low) {
+  if (containerHas(c, low)) return c;
+  const plain = demote(c);
+  if (plain.kind === BITSET) {
+    const words = writableWords(plain);
+    words[low >>> 5] = words[low >>> 5] | 1 << (low & 31);
+    return bitsetContainer(words, plain.card + 1);
+  }
+  if (plain.card === ARRAY_MAX_CARDINALITY) {
+    const words = toWords(plain);
+    words[low >>> 5] = words[low >>> 5] | 1 << (low & 31);
+    return bitsetContainer(words, plain.card + 1);
+  }
+  const old = lows16(plain);
+  const at = lowerBound(old, plain.off, plain.len, low, 1);
+  let u16 = old;
+  if (!plain.shared && plain.off === 0 && old.length > plain.len) {
+    u16.copyWithin(at + 1, at, plain.len);
+  } else {
+    u16 = new Uint16Array(Math.min(ARRAY_MAX_CARDINALITY, Math.max(8, plain.len * 2)));
+    u16.set(old.subarray(plain.off, plain.off + at));
+    u16.set(old.subarray(plain.off + at, plain.off + plain.len), at + 1);
+  }
+  u16[at] = low;
+  return arrayContainer(u16, plain.card + 1);
+}
+function containerRemove(c, low) {
+  if (!containerHas(c, low)) return c;
+  if (c.card === 1) return null;
+  const plain = demote(c);
+  if (plain.kind === BITSET) {
+    const words = writableWords(plain);
+    words[low >>> 5] = words[low >>> 5] & ~(1 << (low & 31));
+    return fromWordsCard(words, plain.card - 1);
+  }
+  const old = lows16(plain);
+  const at = lowerBound(old, plain.off, plain.len, low, 1);
+  if (!plain.shared && plain.off === 0) {
+    old.copyWithin(at, at + 1, plain.len);
+    return arrayContainer(old, plain.card - 1);
+  }
+  const u16 = new Uint16Array(plain.len - 1);
+  u16.set(old.subarray(plain.off, plain.off + at));
+  u16.set(old.subarray(plain.off + at + 1, plain.off + plain.len), at);
+  return arrayContainer(u16, plain.card - 1);
+}
+function containerMax(c) {
+  if (c.kind === ARRAY2) return c.data[c.off + c.len - 1];
+  if (c.kind === RUN2) {
+    const u16 = c.data;
+    return u16[c.off + 2 * c.len - 2] + u16[c.off + 2 * c.len - 1];
+  }
+  const words = words32(c);
+  for (let i = WORDS - 1; i >= 0; i--) {
+    const w = words[i];
+    if (w !== 0) return i * 32 + 31 - Math.clz32(w);
+  }
+  throw new RangeError("a bitset container holds no bits");
+}
+function runCount(c, stop) {
+  if (c.kind === RUN2) return c.len;
+  let runs = 0;
+  if (c.kind === ARRAY2) {
+    const u16 = lows16(c);
+    let previous = -2;
+    for (let i = c.off; i < c.off + c.len; i++) {
+      const v = u16[i];
+      if (v !== previous + 1 && ++runs >= stop) return runs;
+      previous = v;
+    }
+    return runs;
+  }
+  const words = words32(c);
+  let carry = 0;
+  for (let i = 0; i < WORDS; i++) {
+    const w = words[i];
+    const starts = w & ~(w << 1 | carry);
+    if (starts !== 0) {
+      runs += popcount32(starts >>> 0);
+      if (runs >= stop) return runs;
+    }
+    carry = w >>> 31;
+  }
+  return runs;
+}
+function toRun(c, runs) {
+  const pairs = new Uint16Array(2 * runs);
+  let r = 0;
+  if (c.kind === ARRAY2) {
+    const u16 = lows16(c);
+    const end = c.off + c.len;
+    let i = c.off;
+    while (i < end) {
+      let j = i;
+      while (j + 1 < end && u16[j + 1] === u16[j] + 1) j++;
+      pairs[2 * r] = u16[i];
+      pairs[2 * r + 1] = j - i;
+      r++;
+      i = j + 1;
+    }
+    return runContainer(pairs, runs, c.card);
+  }
+  const words = words32(c);
+  let start = 0;
+  let carry = 0;
+  for (let i = 0; i < WORDS; i++) {
+    const w = words[i];
+    const next = i + 1 < WORDS ? words[i + 1] : 0;
+    let starts = (w & ~(w << 1 | carry)) >>> 0;
+    let ends = (w & ~(w >>> 1 | next << 31)) >>> 0;
+    carry = w >>> 31;
+    let both = starts | ends;
+    while (both !== 0) {
+      const bit = both & -both;
+      both ^= bit;
+      const at = i * 32 + 31 - Math.clz32(bit);
+      if ((starts & bit) !== 0) {
+        starts ^= bit;
+        start = at;
+      }
+      if ((ends & bit) !== 0) {
+        ends ^= bit;
+        pairs[2 * r] = start;
+        pairs[2 * r + 1] = at - start;
+        r++;
+      }
+    }
+  }
+  return runContainer(pairs, runs, c.card);
+}
+function optimize(c) {
+  const plain = c.card <= ARRAY_MAX_CARDINALITY ? 2 * c.card : BITSET_BYTES;
+  const runs = runCount(c, (plain - 2) / 4);
+  if (2 + 4 * runs < plain) return c.kind === RUN2 ? c : toRun(c, runs);
+  return demote(c);
+}
+function skewed(shorter, longer) {
+  return longer >= GALLOP_SKEW * shorter;
+}
+var PROBE_MIN = 32;
+var probeWords = new Uint32Array(WORDS);
+function andArrays(a, b) {
+  const small = a.len <= b.len ? a : b;
+  const big = small === a ? b : a;
+  const s = lows16(small);
+  const l = lows16(big);
+  const out = values16(small.len);
+  let n = 0;
+  if (small.len >= PROBE_MIN && !skewed(small.len, big.len)) {
+    const se = small.off + small.len;
+    const first = s[small.off];
+    const last = s[se - 1];
+    const le = big.off + big.len;
+    if (last < l[big.off] || first > l[le - 1]) return null;
+    const from = gallop(l, 0, big.off, le, first);
+    const to = gallop(l, 0, from, le, last + 1);
+    const words = probeWords;
+    for (let i2 = small.off; i2 < se; i2++) {
+      const v = s[i2];
+      words[v >>> 5] = words[v >>> 5] | 1 << (v & 31);
+    }
+    for (let j2 = from; j2 < to; j2++) {
+      const v = l[j2];
+      out[n] = v;
+      n += words[v >>> 5] >>> (v & 31) & 1;
+    }
+    for (let i2 = small.off; i2 < se; i2++) words[s[i2] >>> 5] = 0;
+    return arrayOfScratch(out, n);
+  }
+  if (skewed(small.len, big.len)) {
+    let at = 0;
+    const end = big.off + big.len;
+    for (let i2 = small.off; i2 < small.off + small.len; i2++) {
+      const v = s[i2];
+      at = gallop(l, 0, Math.max(at, big.off), end, v);
+      if (at === end) break;
+      if (l[at] === v) out[n++] = v;
+    }
+    return arrayOfScratch(out, n);
+  }
+  let i = small.off;
+  let j = big.off;
+  const ie = small.off + small.len;
+  const je = big.off + big.len;
+  while (i < ie && j < je) {
+    const x = s[i];
+    const y = l[j];
+    out[n] = x;
+    n += x === y ? 1 : 0;
+    i += x <= y ? 1 : 0;
+    j += x >= y ? 1 : 0;
+  }
+  return arrayOfScratch(out, n);
+}
+function filterByBits(a, b, keep) {
+  const u16 = lows16(a);
+  const words = words32(b);
+  const out = values16(a.len);
+  const flip = keep ? 0 : 1;
+  let n = 0;
+  for (let i = a.off; i < a.off + a.len; i++) {
+    const v = u16[i];
+    out[n] = v;
+    n += words[v >>> 5] >>> (v & 31) & 1 ^ flip;
+  }
+  return arrayOfScratch(out, n);
+}
+function filterByRuns(a, b, keep) {
+  const u16 = lows16(a);
+  const pairs = lows16(b);
+  const out = values16(a.len);
+  let n = 0;
+  if (keep && a.len >= b.len) {
+    const ae = a.off + a.len;
+    let i = a.off;
+    for (let r2 = 0; r2 < b.len && i < ae; r2++) {
+      const start = pairs[b.off + 2 * r2];
+      const end = start + pairs[b.off + 2 * r2 + 1];
+      while (i < ae && u16[i] < start) i++;
+      while (i < ae && u16[i] <= end) out[n++] = u16[i++];
+    }
+    return arrayOfScratch(out, n);
+  }
+  let r = 0;
+  for (let i = a.off; i < a.off + a.len; i++) {
+    const v = u16[i];
+    while (r < b.len && pairs[b.off + 2 * r] + pairs[b.off + 2 * r + 1] < v) {
+      r++;
+    }
+    const inside = r < b.len && pairs[b.off + 2 * r] <= v;
+    if (inside === keep) out[n++] = v;
+  }
+  return arrayOfScratch(out, n);
+}
+function andNotArrays(a, b) {
+  const x = lows16(a);
+  const y = lows16(b);
+  const out = values16(a.len);
+  let n = 0;
+  const je = b.off + b.len;
+  if (skewed(a.len, b.len)) {
+    let at = b.off;
+    for (let i2 = a.off; i2 < a.off + a.len; i2++) {
+      const v = x[i2];
+      at = gallop(y, 0, at, je, v);
+      if (at === je || y[at] !== v) out[n++] = v;
+    }
+    return arrayOfScratch(out, n);
+  }
+  if (b.len >= PROBE_MIN) {
+    const ae = a.off + a.len;
+    const first = x[a.off];
+    const last = x[ae - 1];
+    const from = gallop(y, 0, b.off, je, first);
+    const to = gallop(y, 0, from, je, last + 1);
+    const words = probeWords;
+    for (let j2 = from; j2 < to; j2++) {
+      const v = y[j2];
+      words[v >>> 5] = words[v >>> 5] | 1 << (v & 31);
+    }
+    for (let i2 = a.off; i2 < ae; i2++) {
+      const v = x[i2];
+      out[n] = v;
+      n += words[v >>> 5] >>> (v & 31) & 1 ^ 1;
+    }
+    for (let j2 = from; j2 < to; j2++) words[y[j2] >>> 5] = 0;
+    return arrayOfScratch(out, n);
+  }
+  let i = a.off;
+  let j = b.off;
+  const ie = a.off + a.len;
+  while (i < ie && j < je) {
+    const p = x[i];
+    const q = y[j];
+    out[n] = p;
+    n += p < q ? 1 : 0;
+    i += p <= q ? 1 : 0;
+    j += p >= q ? 1 : 0;
+  }
+  while (i < ie) out[n++] = x[i++];
+  return arrayOfScratch(out, n);
+}
+function orArrays(a, b) {
+  const x = lows16(a);
+  const y = lows16(b);
+  const ie = a.off + a.len;
+  const je = b.off + b.len;
+  if (a.len + b.len > ARRAY_MAX_CARDINALITY) {
+    const words = new Uint32Array(WORDS);
+    for (let i2 = a.off; i2 < ie; i2++) {
+      const v = x[i2];
+      words[v >>> 5] = words[v >>> 5] | 1 << (v & 31);
+    }
+    for (let j2 = b.off; j2 < je; j2++) {
+      const v = y[j2];
+      words[v >>> 5] = words[v >>> 5] | 1 << (v & 31);
+    }
+    return fromWordsCard(words, popcountWords(words));
+  }
+  const out = values16(a.len + b.len);
+  let n = 0;
+  let i = a.off;
+  let j = b.off;
+  while (i < ie && j < je) {
+    const p = x[i];
+    const q = y[j];
+    out[n++] = p < q ? p : q;
+    i += p <= q ? 1 : 0;
+    j += p >= q ? 1 : 0;
+  }
+  while (i < ie) out[n++] = x[i++];
+  while (j < je) out[n++] = y[j++];
+  return arrayOfScratch(out, n);
+}
+function orIntoBitset(dest, other, inPlace) {
+  const words = inPlace ? words32(dest) : words32(dest).slice();
+  if (other.kind === ARRAY2) {
+    const u16 = lows16(other);
+    let card = dest.card;
+    for (let i = other.off; i < other.off + other.len; i++) {
+      const v = u16[i];
+      const w = words[v >>> 5];
+      const bit = 1 << (v & 31);
+      if ((w & bit) === 0) {
+        words[v >>> 5] = w | bit;
+        card++;
+      }
+    }
+    return bitsetContainer(words, card);
+  }
+  if (other.kind === BITSET) {
+    const o = words32(other);
+    for (let i = 0; i < WORDS; i++) words[i] = words[i] | o[i];
+  } else {
+    const pairs = lows16(other);
+    for (let r = 0; r < other.len; r++) {
+      const start = pairs[other.off + 2 * r];
+      setRange(words, start, start + pairs[other.off + 2 * r + 1]);
+    }
+  }
+  return bitsetContainer(words, popcountWords(words));
+}
+function fromRunPairs(pairs, runs, card) {
+  if (card === 0) return null;
+  if (card <= ARRAY_MAX_CARDINALITY) {
+    const out = new Uint16Array(card);
+    let k = 0;
+    for (let r = 0; r < runs; r++) {
+      const start = pairs[2 * r];
+      const end = start + pairs[2 * r + 1];
+      for (let v = start; v <= end; v++) out[k++] = v;
+    }
+    return arrayContainer(out, card);
+  }
+  const words = new Uint32Array(WORDS);
+  for (let r = 0; r < runs; r++) {
+    const start = pairs[2 * r];
+    setRange(words, start, start + pairs[2 * r + 1]);
+  }
+  return bitsetContainer(words, card);
+}
+function andRuns(a, b) {
+  const x = lows16(a);
+  const y = lows16(b);
+  const out = pairs16(2 * (a.len + b.len));
+  let runs = 0;
+  let card = 0;
+  let i = 0;
+  let j = 0;
+  while (i < a.len && j < b.len) {
+    const as = x[a.off + 2 * i];
+    const ae = as + x[a.off + 2 * i + 1];
+    const bs = y[b.off + 2 * j];
+    const be = bs + y[b.off + 2 * j + 1];
+    const lo = as > bs ? as : bs;
+    const hi = ae < be ? ae : be;
+    if (lo <= hi) {
+      out[2 * runs] = lo;
+      out[2 * runs + 1] = hi - lo;
+      runs++;
+      card += hi - lo + 1;
+    }
+    if (ae < be) i++;
+    else j++;
+  }
+  return fromRunPairs(out, runs, card);
+}
+function orRuns(a, b) {
+  const x = lows16(a);
+  const y = lows16(b);
+  const out = pairs16(2 * (a.len + b.len));
+  let runs = 0;
+  let card = 0;
+  let i = 0;
+  let j = 0;
+  let start = -1;
+  let end = -1;
+  const flush = () => {
+    if (start < 0) return;
+    out[2 * runs] = start;
+    out[2 * runs + 1] = end - start;
+    runs++;
+    card += end - start + 1;
+  };
+  while (i < a.len || j < b.len) {
+    let s;
+    let e;
+    if (j >= b.len || i < a.len && x[a.off + 2 * i] <= y[b.off + 2 * j]) {
+      s = x[a.off + 2 * i];
+      e = s + x[a.off + 2 * i + 1];
+      i++;
+    } else {
+      s = y[b.off + 2 * j];
+      e = s + y[b.off + 2 * j + 1];
+      j++;
+    }
+    if (start >= 0 && s <= end + 1) {
+      if (e > end) end = e;
+    } else {
+      flush();
+      start = s;
+      end = e;
+    }
+  }
+  flush();
+  return fromRunPairs(out, runs, card);
+}
+function andNotRuns(a, b) {
+  const x = lows16(a);
+  const y = lows16(b);
+  const out = pairs16(2 * (a.len + b.len + 1));
+  let runs = 0;
+  let card = 0;
+  let j = 0;
+  for (let i = 0; i < a.len; i++) {
+    let s = x[a.off + 2 * i];
+    const e = s + x[a.off + 2 * i + 1];
+    while (j < b.len && y[b.off + 2 * j] + y[b.off + 2 * j + 1] < s) j++;
+    let k = j;
+    while (s <= e) {
+      if (k >= b.len || y[b.off + 2 * k] > e) {
+        out[2 * runs] = s;
+        out[2 * runs + 1] = e - s;
+        runs++;
+        card += e - s + 1;
+        break;
+      }
+      const bs = y[b.off + 2 * k];
+      const be = bs + y[b.off + 2 * k + 1];
+      if (bs > s) {
+        out[2 * runs] = s;
+        out[2 * runs + 1] = bs - 1 - s;
+        runs++;
+        card += bs - s;
+      }
+      s = be + 1;
+      k++;
+    }
+  }
+  return fromRunPairs(out, runs, card);
+}
+function bitsetInRuns(a, b) {
+  const words = words32(a);
+  const pairs = lows16(b);
+  if (b.card <= ARRAY_MAX_CARDINALITY) {
+    const out2 = values16(b.card);
+    let n = 0;
+    for (let r = 0; r < b.len; r++) {
+      const start = pairs[b.off + 2 * r];
+      const end = start + pairs[b.off + 2 * r + 1];
+      const first = start >>> 5;
+      const last = end >>> 5;
+      const head = 4294967295 << (start & 31) >>> 0;
+      const tail = 4294967295 >>> 31 - (end & 31);
+      for (let i = first; i <= last; i++) {
+        let w = words[i];
+        if (i === first) w &= head;
+        if (i === last) w &= tail;
+        const top = i * 32 + 31;
+        while (w !== 0) {
+          const lowest = w & -w;
+          out2[n++] = top - Math.clz32(lowest);
+          w ^= lowest;
+        }
+      }
+    }
+    return arrayOfScratch(out2, n);
+  }
+  const out = new Uint32Array(WORDS);
+  for (let r = 0; r < b.len; r++) {
+    const start = pairs[b.off + 2 * r];
+    const end = start + pairs[b.off + 2 * r + 1];
+    const first = start >>> 5;
+    const last = end >>> 5;
+    const head = 4294967295 << (start & 31) >>> 0;
+    const tail = 4294967295 >>> 31 - (end & 31);
+    if (first === last) {
+      out[first] = out[first] | words[first] & head & tail;
+    } else {
+      out[first] = out[first] | words[first] & head;
+      for (let i = first + 1; i < last; i++) out[i] = words[i];
+      out[last] = out[last] | words[last] & tail;
+    }
+  }
+  return fromWordsCard(out, popcountWords(out));
+}
+function containerAnd(a, b, inPlace = false) {
+  if (a.kind === BITSET && b.kind === BITSET) {
+    const x = words32(a);
+    const y = words32(b);
+    const out = inPlace ? x : new Uint32Array(WORDS);
+    for (let i = 0; i < WORDS; i++) out[i] = x[i] & y[i];
+    return fromWordsCard(out, popcountWords(out));
+  }
+  if (a.kind > b.kind) return containerAnd(b, a);
+  if (a.kind === ARRAY2) {
+    if (b.kind === ARRAY2) return andArrays(a, b);
+    return b.kind === BITSET ? filterByBits(a, b, true) : filterByRuns(a, b, true);
+  }
+  return b.kind === RUN2 && a.kind === RUN2 ? andRuns(a, b) : bitsetInRuns(a, b);
+}
+function containerOr(a, b, inPlace = false) {
+  if (a.kind === BITSET) return orIntoBitset(a, b, inPlace);
+  if (b.kind === BITSET) return orIntoBitset(b, a, false);
+  if (a.kind === ARRAY2 && b.kind === ARRAY2) return orArrays(a, b);
+  if (a.kind === RUN2 && b.kind === RUN2) return orRuns(a, b);
+  const words = toWords(a.kind === RUN2 ? a : b);
+  return orIntoBitsetWords(words, a.kind === RUN2 ? b : a);
+}
+function orIntoBitsetWords(words, array) {
+  const u16 = lows16(array);
+  for (let i = array.off; i < array.off + array.len; i++) {
+    const v = u16[i];
+    words[v >>> 5] = words[v >>> 5] | 1 << (v & 31);
+  }
+  return fromWordsCard(words, popcountWords(words));
+}
+function containerAndNot(a, b, inPlace = false) {
+  if (a.kind === ARRAY2) {
+    if (b.kind === ARRAY2) return andNotArrays(a, b);
+    return b.kind === BITSET ? filterByBits(a, b, false) : filterByRuns(a, b, false);
+  }
+  if (a.kind === RUN2 && b.kind === RUN2) return andNotRuns(a, b);
+  const words = a.kind === BITSET ? inPlace ? words32(a) : words32(a).slice() : toWords(a);
+  if (b.kind === ARRAY2) {
+    const u16 = lows16(b);
+    for (let i = b.off; i < b.off + b.len; i++) {
+      const v = u16[i];
+      words[v >>> 5] = words[v >>> 5] & ~(1 << (v & 31));
+    }
+  } else if (b.kind === BITSET) {
+    const y = words32(b);
+    for (let i = 0; i < WORDS; i++) words[i] = words[i] & ~y[i];
+  } else {
+    const pairs = lows16(b);
+    for (let r = 0; r < b.len; r++) {
+      const start = pairs[b.off + 2 * r];
+      clearRange(words, start, start + pairs[b.off + 2 * r + 1]);
+    }
+  }
+  return fromWordsCard(words, popcountWords(words));
+}
+
+// src/ts-roaring/iterator.ts
+var DONE = { done: true, value: void 0 };
+var BitmapIterator = class {
+  #keys;
+  #conts;
+  /** The container being walked, as an index into `#conts`, and its kind, storage and offset. */
+  #at = -1;
+  #kind = ARRAY2;
+  #u16 = new Uint16Array(0);
+  #words = new Uint32Array(0);
+  #off = 0;
+  /** Added to every remainder: the container's key times 65,536. */
+  #base = 0;
+  /** An array: the next index and one past the last. A run container: the next run's index and the run count. A bitset: the word index. */
+  #pos = 0;
+  #end = 0;
+  /** A run container: the next value and the last of the current run. A bitset: what is left of the current word. */
+  #next = 0;
+  #last = -1;
+  constructor(keys, conts) {
+    this.#keys = keys;
+    this.#conts = conts;
+  }
+  [Symbol.iterator]() {
+    return this;
+  }
+  next() {
+    for (; ; ) {
+      if (this.#kind === ARRAY2) {
+        if (this.#pos < this.#end) {
+          return { done: false, value: this.#base + this.#u16[this.#pos++] };
+        }
+      } else if (this.#kind === BITSET) {
+        let w = this.#next;
+        while (w === 0 && ++this.#pos < WORDS) w = this.#words[this.#pos];
+        if (w !== 0) {
+          const lowest = w & -w;
+          this.#next = w ^ lowest;
+          return {
+            done: false,
+            value: this.#base + this.#pos * 32 + 31 - Math.clz32(lowest)
+          };
+        }
+      } else {
+        if (this.#next <= this.#last) return { done: false, value: this.#base + this.#next++ };
+        if (this.#pos < this.#end) {
+          const r = this.#off + 2 * this.#pos++;
+          this.#next = this.#u16[r];
+          this.#last = this.#next + this.#u16[r + 1];
+          continue;
+        }
+      }
+      if (!this.#advance()) return DONE;
+    }
+  }
+  /** Move to the next container; `false` when there is none. */
+  #advance() {
+    if (++this.#at >= this.#conts.length) {
+      this.#at = this.#conts.length;
+      this.#kind = ARRAY2;
+      this.#pos = 0;
+      this.#end = 0;
+      return false;
+    }
+    const c = this.#conts[this.#at];
+    this.#kind = c.kind;
+    this.#base = this.#keys[this.#at] * 65536;
+    this.#off = c.off;
+    if (c.kind === ARRAY2) {
+      this.#u16 = c.data;
+      this.#pos = c.off;
+      this.#end = c.off + c.len;
+    } else if (c.kind === BITSET) {
+      this.#words = c.data;
+      this.#pos = 0;
+      this.#next = this.#words[0];
+    } else {
+      this.#u16 = c.data;
+      this.#pos = 0;
+      this.#end = c.len;
+      this.#next = 0;
+      this.#last = -1;
+    }
+    return true;
+  }
+};
+
+// src/ts-roaring/wire.ts
+import { IntegrityError as IntegrityError2 } from "@cloudbitmaps/core";
+function bodySize(c) {
+  if (c.kind === ARRAY2) return 2 * c.len;
+  if (c.kind === BITSET) return BITSET_BYTES;
+  return 2 + 4 * c.len;
+}
+function putU16s(out, at, src, from, count) {
+  if (LITTLE_ENDIAN) {
+    out.set(new Uint8Array(src.buffer, src.byteOffset + 2 * from, 2 * count), at);
+    return;
+  }
+  const view = new DataView(out.buffer, out.byteOffset, out.byteLength);
+  for (let i = 0; i < count; i++) view.setUint16(at + 2 * i, src[from + i], true);
+}
+function writeBody(c, out, view, at) {
+  if (c.kind === ARRAY2) {
+    putU16s(out, at, c.data, c.off, c.len);
+  } else if (c.kind === BITSET) {
+    const words = c.data;
+    if (LITTLE_ENDIAN) out.set(new Uint8Array(words.buffer, words.byteOffset, BITSET_BYTES), at);
+    else for (let i = 0; i < WORDS; i++) view.setUint32(at + 4 * i, words[i], true);
+  } else {
+    view.setUint16(at, c.len, true);
+    putU16s(out, at + 2, c.data, c.off, 2 * c.len);
+  }
+}
+function serializeContainers(keys, conts) {
+  const n = conts.length;
+  let hasRun = false;
+  for (let i = 0; i < n; i++) if (conts[i].kind === RUN2) hasRun = true;
+  const offsets = !hasRun || n >= NO_OFFSET_THRESHOLD;
+  let at = hasRun ? 4 + (n + 7 >>> 3) : 8;
+  const describeAt = at;
+  at += 4 * n;
+  const offsetsAt = at;
+  if (offsets) at += 4 * n;
+  let total = at;
+  for (let i = 0; i < n; i++) total += bodySize(conts[i]);
+  const out = new Uint8Array(total);
+  const view = new DataView(out.buffer);
+  if (hasRun) {
+    view.setUint32(0, SERIAL_COOKIE | n - 1 << 16, true);
+    for (let i = 0; i < n; i++) {
+      if (conts[i].kind === RUN2) {
+        out[4 + (i >>> 3)] = out[4 + (i >>> 3)] | 1 << (i & 7);
+      }
+    }
+  } else {
+    view.setUint32(0, SERIAL_COOKIE_NO_RUNCONTAINER, true);
+    view.setUint32(4, n, true);
+  }
+  for (let i = 0; i < n; i++) {
+    const c = conts[i];
+    view.setUint16(describeAt + 4 * i, keys[i], true);
+    view.setUint16(describeAt + 4 * i + 2, c.card - 1, true);
+    if (offsets) view.setUint32(offsetsAt + 4 * i, at, true);
+    writeBody(c, out, view, at);
+    at += bodySize(c);
+  }
+  return out;
+}
+function decodeContainers(input) {
+  const bytes = Uint8Array.prototype.slice.call(input);
+  const layout = parsePortableLayout(bytes);
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const keys = new Array(layout.length);
+  const conts = new Array(layout.length);
+  let n = 0;
+  let end = bytes.byteLength === 0 ? 0 : 8;
+  let slabLength = 0;
+  let small = 0;
+  for (const { cardinality, kind, offset } of layout) {
+    if (kind === ARRAY) {
+      slabLength += cardinality;
+      small++;
+    } else if (kind !== BITMAP) {
+      slabLength += 2 * view.getUint16(offset, true);
+      small++;
+    }
+  }
+  const own = LITTLE_ENDIAN && bytes.byteOffset === 0 && bytes.buffer instanceof ArrayBuffer && bytes.buffer.byteLength === bytes.byteLength;
+  const alias = own && small === 1;
+  const slab = alias ? NO_U16 : new Uint16Array(slabLength);
+  let used = 0;
+  for (const { key, cardinality, kind, offset } of layout) {
+    keys[n] = key;
+    if (kind === ARRAY) {
+      if (alias && offset % 2 === 0) {
+        const values = new Uint16Array(bytes.buffer, offset, cardinality);
+        conts[n++] = new Container(ARRAY2, values, 0, cardinality, cardinality, false);
+      } else {
+        const into = alias ? new Uint16Array(cardinality) : slab;
+        getU16s(bytes, view, offset, into, alias ? 0 : used, cardinality);
+        conts[n++] = new Container(
+          ARRAY2,
+          into,
+          alias ? 0 : used,
+          cardinality,
+          cardinality,
+          small > 1
+        );
+        used += cardinality;
+      }
+      end = offset + 2 * cardinality;
+    } else if (kind === BITMAP) {
+      let words;
+      if (own && offset % 4 === 0) {
+        words = new Uint32Array(bytes.buffer, offset, WORDS);
+      } else {
+        words = new Uint32Array(WORDS);
+        if (LITTLE_ENDIAN) {
+          new Uint8Array(words.buffer).set(bytes.subarray(offset, offset + BITSET_BYTES));
+        } else {
+          for (let i = 0; i < WORDS; i++) words[i] = view.getUint32(offset + 4 * i, true);
+        }
+      }
+      conts[n++] = bitsetContainer(words, cardinality);
+      end = offset + BITSET_BYTES;
+    } else {
+      const runs = view.getUint16(offset, true);
+      if (alias && (offset + 2) % 2 === 0) {
+        const pairs = new Uint16Array(bytes.buffer, offset + 2, 2 * runs);
+        conts[n++] = new Container(RUN2, pairs, 0, runs, cardinality, false);
+      } else {
+        const into = alias ? new Uint16Array(2 * runs) : slab;
+        getU16s(bytes, view, offset + 2, into, alias ? 0 : used, 2 * runs);
+        conts[n++] = new Container(RUN2, into, alias ? 0 : used, runs, cardinality, small > 1);
+        used += 2 * runs;
+      }
+      end = offset + 2 + 4 * runs;
+    }
+  }
+  return { keys, conts, end };
+}
+var NO_U16 = new Uint16Array(0);
+function getU16s(bytes, view, at, slab, to, count) {
+  if (LITTLE_ENDIAN) {
+    new Uint8Array(slab.buffer, 2 * to, 2 * count).set(bytes.subarray(at, at + 2 * count));
+    return;
+  }
+  for (let i = 0; i < count; i++) slab[to + i] = view.getUint16(at + 2 * i, true);
+}
+function trailingBytes(length, end) {
+  return new IntegrityError2(
+    `portable roaring: ${length - end} bytes follow the bitmap's last container, which ends at byte ${end}. One buffer holds one bitmap: to load several as one segment, combine them first and serialize the result.`
+  );
+}
+
+// src/ts-roaring/bitmap.ts
+var MAX_ID = 4294967295;
+function isId(value) {
+  return Number.isInteger(value) && value >= 0 && value <= MAX_ID;
+}
+function badId(value) {
+  return new ValidationError2(`${String(value)} is not an integer from 0 to ${MAX_ID}`);
+}
+function checkedId(value) {
+  if (!isId(value)) throw badId(value);
+  return value;
+}
+function collect(values) {
+  if (values instanceof Uint32Array) return values;
+  if (Array.isArray(values)) {
+    const list = values;
+    const out2 = new Uint32Array(list.length);
+    for (let i = 0; i < list.length; i++) {
+      const v = list[i];
+      if (v >>> 0 !== v) throw badId(v);
+      out2[i] = v;
+    }
+    return out2;
+  }
+  let out = new Uint32Array(1024);
+  let n = 0;
+  for (const v of values) {
+    if (n === out.length) {
+      const grown = new Uint32Array(2 * n);
+      grown.set(out);
+      out = grown;
+    }
+    out[n++] = checkedId(v);
+  }
+  return out.subarray(0, n);
+}
+function collectLenient(values) {
+  const list = Array.isArray(values) ? values : Array.from(values);
+  const out = new Uint32Array(list.length);
+  let n = 0;
+  for (let i = 0; i < list.length; i++) {
+    const v = list[i];
+    if (v >>> 0 === v) out[n++] = v;
+  }
+  return out.subarray(0, n);
+}
+function sortedIds(ids, owned) {
+  for (let i = 1; i < ids.length; i++) {
+    if (ids[i - 1] > ids[i]) return (owned ? ids : ids.slice()).sort();
+  }
+  return ids;
+}
+function lowerBound2(keys, key, from = 0) {
+  let lo = from;
+  let hi = keys.length;
+  while (lo < hi) {
+    const mid = lo + hi >>> 1;
+    if (keys[mid] < key) lo = mid + 1;
+    else hi = mid;
+  }
+  return lo;
+}
+function gallopKeys(keys, key, from) {
+  let step = 1;
+  let lo = from;
+  let hi = from;
+  while (hi < keys.length && keys[hi] < key) {
+    lo = hi + 1;
+    hi += step;
+    step *= 2;
+  }
+  return lowerBoundIn(keys, key, lo, Math.min(hi, keys.length));
+}
+function lowerBoundIn(keys, key, from, to) {
+  let lo = from;
+  let hi = to;
+  while (lo < hi) {
+    const mid = lo + hi >>> 1;
+    if (keys[mid] < key) lo = mid + 1;
+    else hi = mid;
+  }
+  return lo;
+}
+var OR = 0;
+var AND = 1;
+var AND_NOT = 2;
+function combineContainers(op, a, b) {
+  if (op === OR) return containerOr(a, b, !a.shared);
+  if (op === AND) return containerAnd(a, b, !a.shared);
+  return containerAndNot(a, b, !a.shared);
+}
+var TsBitmap = class _TsBitmap {
+  #keys;
+  #conts;
+  #size;
+  constructor(keys, conts, size) {
+    this.#keys = keys;
+    this.#conts = conts;
+    this.#size = size;
   }
   static empty() {
-    return new _SafeBitmap(new RoaringBitmap32());
+    return new _TsBitmap([], [], 0);
   }
   static fromValues(values) {
-    return new _SafeBitmap(new RoaringBitmap32(values));
+    const bitmap = _TsBitmap.empty();
+    bitmap.addMany(values);
+    return bitmap;
   }
   /**
-   * Cap the size, check the structure, then deserialize with the **portable** format.
-   * Throws `IntegrityError` if the input exceeds `maxBytes`, is not a well-formed portable bitmap, or fails to
-   * decode — the native addon is never handed unbounded, malformed or unsafe-format input. With `whole`, bytes
-   * after the bitmap's last container are refused too; without it they are ignored, as the native decoder ignores
-   * them.
+   * Cap the size, check the structure, then build the containers. With `whole`, bytes after the last container are
+   * refused too; without it they are ignored.
    *
-   * The structural check is what makes the decoded bitmap's answers mean anything. The native deserializer
-   * bounds its reads and checks nothing else, so bytes of the right length and the wrong shape (containers or
-   * values out of order, overlapping runs, a cardinality that disagrees with the bits) decode into a bitmap
-   * whose `maximum()`, `has()` and `size` are wrong, and some of those shapes crash the process when used.
+   * @throws {IntegrityError} if the input exceeds `maxBytes`, is not a well-formed portable bitmap, or (with `whole`)
+   * has bytes after it.
    */
   static safeDeserialize(bytes, maxBytes, options = {}) {
     if (bytes.length > maxBytes) {
-      throw new IntegrityError2(`serialized bitmap is ${bytes.length}B, exceeds cap ${maxBytes}B`);
+      throw new IntegrityError3(`serialized bitmap is ${bytes.length}B, exceeds cap ${maxBytes}B`);
     }
-    const end = checkPortableLayout(bytes);
+    const { keys, conts, end } = decodeContainers(bytes);
     if (options.whole === true && end !== bytes.byteLength) {
-      throw new IntegrityError2(
-        `portable roaring: ${bytes.byteLength - end} bytes follow the bitmap's last container, which ends at byte ${end}. One buffer holds one bitmap: to load several as one segment, combine them first (RoaringBitmap32.orMany) and serialize the result.`
-      );
+      throw trailingBytes(bytes.byteLength, end);
     }
-    try {
-      return new _SafeBitmap(RoaringBitmap32.deserialize(bytes, DeserializationFormat.portable));
-    } catch (err) {
-      throw new IntegrityError2(`failed to deserialize bitmap: ${err.message}`);
-    }
-  }
-  /** The `roaring` bitmap this wraps, for a caller that was handed it once and keeps no wrapper. */
-  unwrap() {
-    return this.bitmap;
+    let size = 0;
+    for (let i = 0; i < conts.length; i++) size += conts[i].card;
+    return new _TsBitmap(keys, conts, size);
   }
   serialize() {
-    return this.bitmap.serialize(SerializationFormat.portable);
+    return serializeContainers(this.#keys, this.#conts);
   }
-  /**
-   * Convert containers to run-encoding where that is smaller. Representation only — membership is untouched, and
-   * the portable format still round-trips through {@link RoaringCodec.safeDeserialize}.
-   *
-   * Roaring's third container type is a RUN, and no implementation selects it on its own: it takes an explicit
-   * `runOptimize()` pass. Nothing here made that call, so run-shaped ids paid array or bitset prices — measured
-   * at **570×** for a contiguous 1M-id range (128.1 KiB → 0.2 KiB) and **63×** for a 2,000-run shape
-   * (536.5 KiB → 8.5 KiB). Sparse ids come out byte-identical, so this is never a losing trade; roaring keeps
-   * whichever encoding is smaller per container.
-   *
-   * Those two factors are THIS CALL's own before/after on the same ids. They are not the ones the site quotes
-   * (543× and 63×) — those compare the optimized encoding against the best *fixed* representation at its floor,
-   * a different baseline that happens to land near 63× on the run shape too. `pnpm bench:encoding` prints both
-   * columns; don't carry a figure between them without checking which denominator it had.
-   *
-   * Called only when writing an immutable objects generation — see {@link CodecBitmap.optimize} for why the read
-   * path deliberately does not.
-   *
-   * CANONICAL, which `runOptimize()` alone is not. Where a container's run and array encodings are the same size
-   * (cardinality = 2 × runs + 1: three values in one run, five in two), CRoaring keeps whichever kind the
-   * container already has. A chunk built from ids starts as an array and stays one; the same set reached through
-   * `addRange`, an earlier `runOptimize()` or an operation over run containers is a run, and serializes to other
-   * bytes. Undoing run compression first starts every container where one built from ids starts, so the bytes
-   * depend on membership alone. On a bitmap built from ids there is nothing to undo.
-   */
+  /** Re-encode each container canonically; membership is untouched. */
   optimize() {
-    this.bitmap.removeRunCompression();
-    this.bitmap.runOptimize();
+    const conts = this.#conts;
+    for (let i = 0; i < conts.length; i++) conts[i] = optimize(conts[i]);
   }
   /**
-   * This set as storage chunks, cut from its own containers: {@link optimize} and one `serialize` when called, then
-   * a lazy header walk that copies one container out per step (`containerPayloads`). Per container and per byte,
-   * never per id, and the payloads are the ones {@link SafeBitmap.fromValues} of each chunk's low 16 bits would
-   * serialize to. The walk trusts the bytes it cuts because the native serializer wrote them, from a bitmap that
-   * passed the structural check when it was decoded.
+   * The set as storage chunks: each payload is the portable bytes of a one-container bitmap holding that chunk's low 16
+   * bits, optimized the way {@link optimize} does. Nothing is built until a chunk is asked for, so a writer that yields
+   * between chunks runs this in slices. The call snapshots the containers and marks each shared, so a change to the
+   * bitmap while the chunks are read copies a container instead of altering what the chunks will say. The bitmap's own
+   * containers are not optimized by it.
    */
   encodeChunks() {
-    this.optimize();
-    return containerPayloads(this.serialize());
+    const keys = this.#keys.slice();
+    const conts = this.#conts.slice();
+    for (let i = 0; i < conts.length; i++) conts[i].shared = true;
+    return {
+      *[Symbol.iterator]() {
+        for (let i = 0; i < conts.length; i++) {
+          const c = optimize(conts[i]);
+          yield {
+            chunkKey: keys[i],
+            payload: serializeContainers([0], [c]),
+            cardinality: c.card
+          };
+        }
+      }
+    };
   }
-  /**
-   * Largest value, or `undefined` when empty. O(1) — roaring reads it off the last container, so the engine's
-   * per-chunk range assertion costs one call per chunk rather than a walk per id. The last container holds the
-   * largest value only because {@link SafeBitmap.safeDeserialize} refuses bytes whose containers or values are
-   * out of order.
-   */
   maximum() {
-    return this.bitmap.isEmpty ? void 0 : this.bitmap.maximum();
+    const last = this.#conts.length - 1;
+    if (last < 0) return void 0;
+    return this.#keys[last] * 65536 + containerMax(this.#conts[last]);
   }
   add(value) {
-    this.bitmap.add(value);
+    checkedId(value);
+    const key = value >>> 16;
+    const low = value & 65535;
+    const at = lowerBound2(this.#keys, key);
+    const found = this.#keys[at] === key;
+    if (!found) {
+      this.#insert(at, key, arrayContainer(Uint16Array.of(low), 1));
+      this.#size++;
+      return;
+    }
+    const before = this.#conts[at];
+    const after = containerAdd(before, low);
+    this.#conts[at] = after;
+    this.#size += after.card - before.card;
   }
+  /**
+   * Add the ids. They are grouped by key in ascending order, so each container is touched once, a key already held is
+   * merged where it is, and the new keys are put in with one pass over the key list however many there are.
+   */
   addMany(values) {
-    this.bitmap.addMany(values);
+    const ids = sortedIds(collect(values), !(values instanceof Uint32Array));
+    const fresh = [];
+    let at = 0;
+    for (let i = 0; i < ids.length; ) {
+      const key = ids[i] >>> 16;
+      let end = i + 1;
+      while (end < ids.length && ids[end] >>> 16 === key) end++;
+      const group = fromSortedIds(ids, i, end);
+      i = end;
+      at = gallopKeys(this.#keys, key, at);
+      if (this.#keys[at] === key) {
+        const before = this.#conts[at];
+        const after = containerOr(before, group, !before.shared);
+        this.#conts[at] = after;
+        this.#size += after.card - before.card;
+      } else {
+        fresh.push({ key, group });
+        this.#size += group.card;
+      }
+    }
+    if (fresh.length > 0) this.#insertAll(fresh);
   }
   remove(value) {
-    this.bitmap.remove(value);
+    if (!isId(value)) return;
+    const key = value >>> 16;
+    const at = lowerBound2(this.#keys, key);
+    if (this.#keys[at] !== key) return;
+    const before = this.#conts[at];
+    const after = containerRemove(before, value & 65535);
+    if (after === null) {
+      this.#keys.splice(at, 1);
+      this.#conts.splice(at, 1);
+      this.#size -= before.card;
+      return;
+    }
+    this.#conts[at] = after;
+    this.#size += after.card - before.card;
   }
+  /** Remove the ids (anything that is not an id is ignored), grouped by key; the keys left empty go in one pass. */
   removeMany(values) {
-    this.bitmap.removeMany(values);
+    const ids = sortedIds(collectLenient(values), true);
+    const keys = this.#keys;
+    const conts = this.#conts;
+    let at = 0;
+    let emptied = 0;
+    for (let i = 0; i < ids.length; ) {
+      const key = ids[i] >>> 16;
+      let end = i + 1;
+      while (end < ids.length && ids[end] >>> 16 === key) end++;
+      const from = i;
+      i = end;
+      at = gallopKeys(keys, key, at);
+      if (keys[at] !== key) continue;
+      const before = conts[at];
+      if (before.card === 0) continue;
+      const after = containerAndNot(before, fromSortedIds(ids, from, end), !before.shared);
+      this.#size -= before.card - (after === null ? 0 : after.card);
+      if (after === null) {
+        conts[at] = EMPTIED;
+        emptied++;
+      } else {
+        conts[at] = after;
+      }
+    }
+    if (emptied > 0) this.#dropEmptied();
   }
   has(value) {
-    return this.bitmap.has(value);
+    if (!isId(value)) return false;
+    const key = value >>> 16;
+    const at = lowerBound2(this.#keys, key);
+    return this.#keys[at] === key && containerHas(this.#conts[at], value & 65535);
   }
   get size() {
-    return this.bitmap.size;
+    return this.#size;
   }
   get isEmpty() {
-    return this.bitmap.isEmpty;
+    return this.#size === 0;
   }
   clone() {
-    return new _SafeBitmap(this.bitmap.clone());
+    const conts = new Array(this.#conts.length);
+    for (let i = 0; i < conts.length; i++) {
+      const c = this.#conts[i];
+      c.shared = true;
+      conts[i] = c;
+    }
+    return new _TsBitmap(this.#keys.slice(), conts, this.#size);
   }
-  // The binary set ops take the `CodecBitmap` interface type (per the seam), but a single store is
-  // single-codec (homogeneity contract), so `other` is always a `SafeBitmap` here — reach its private
-  // `bitmap` (accessible on same-class instances) for the native op.
-  /** In-place union: `this = this ∪ other`. */
   orInPlace(other) {
-    this.bitmap.orInPlace(other.bitmap);
-  }
-  /** In-place difference: `this = this \ other`. */
-  andNotInPlace(other) {
-    this.bitmap.andNotInPlace(other.bitmap);
+    this.#combine(_TsBitmap.#of(other), OR);
   }
-  /** In-place intersection: `this = this ∩ other`. */
   andInPlace(other) {
-    this.bitmap.andInPlace(other.bitmap);
+    this.#combine(_TsBitmap.#of(other), AND);
+  }
+  andNotInPlace(other) {
+    this.#combine(_TsBitmap.#of(other), AND_NOT);
   }
-  /** Ascending iterator over the set values. */
   [Symbol.iterator]() {
-    return this.bitmap[Symbol.iterator]();
+    return new BitmapIterator(this.#keys, this.#conts);
   }
   toArray() {
-    return this.bitmap.toArray();
+    return Array.from(this.toUint32Array());
   }
-  /** The values as one fresh ascending `Uint32Array`, exported natively. */
+  /** The ids as a new ascending `Uint32Array`. */
   toUint32Array() {
-    return this.bitmap.toUint32Array();
+    const out = new Uint32Array(this.#size);
+    let at = 0;
+    for (let i = 0; i < this.#conts.length; i++) {
+      at = appendIds(this.#conts[i], out, at, this.#keys[i] * 65536);
+    }
+    return out;
+  }
+  static #of(other) {
+    if (!(other instanceof _TsBitmap)) {
+      throw new ValidationError2("a TypeScript roaring bitmap combines only with another one");
+    }
+    return other;
+  }
+  #insert(at, key, container) {
+    if (at === this.#keys.length) {
+      this.#keys.push(key);
+      this.#conts.push(container);
+    } else {
+      this.#keys.splice(at, 0, key);
+      this.#conts.splice(at, 0, container);
+    }
+  }
+  /** Put the new keys, ascending and none held, in: after the last key by pushing, else in one merge pass. */
+  #insertAll(fresh) {
+    const keys = this.#keys;
+    const conts = this.#conts;
+    if (keys.length === 0 || keys[keys.length - 1] < fresh[0].key) {
+      for (const { key, group } of fresh) {
+        keys.push(key);
+        conts.push(group);
+      }
+      return;
+    }
+    const outKeys = [];
+    const outConts = [];
+    let i = 0;
+    let j = 0;
+    while (i < keys.length || j < fresh.length) {
+      if (j === fresh.length || i < keys.length && keys[i] < fresh[j].key) {
+        outKeys.push(keys[i]);
+        outConts.push(conts[i++]);
+      } else {
+        const next = fresh[j++];
+        outKeys.push(next.key);
+        outConts.push(next.group);
+      }
+    }
+    this.#keys = outKeys;
+    this.#conts = outConts;
+  }
+  /** Remove the keys whose container was emptied by {@link removeMany}, in one pass. */
+  #dropEmptied() {
+    let kept = 0;
+    for (let i = 0; i < this.#conts.length; i++) {
+      if (this.#conts[i] === EMPTIED) continue;
+      this.#keys[kept] = this.#keys[i];
+      this.#conts[kept++] = this.#conts[i];
+    }
+    this.#keys.length = kept;
+    this.#conts.length = kept;
+  }
+  /**
+   * Walk both key lists and rebuild this one: where both hold a key, the combine of the two containers; where only this
+   * does, its container, unless the operation is an intersection; where only `that` does, a copy of its container for a
+   * union and nothing otherwise. A combine that leaves no value drops the key. An intersection jumps over a stretch of
+   * keys the other side lacks by doubling steps, so a few keys against many cost the few.
+   */
+  #combine(that, op) {
+    const a = this.#keys;
+    const b = that.#keys;
+    const ca = this.#conts;
+    const cb = that.#conts;
+    const keys = [];
+    const conts = [];
+    let size = 0;
+    let i = 0;
+    let j = 0;
+    while (i < a.length && j < b.length) {
+      const ka = a[i];
+      const kb = b[j];
+      if (ka === kb) {
+        const c = combineContainers(op, ca[i++], cb[j++]);
+        if (c !== null) {
+          keys.push(ka);
+          conts.push(c);
+          size += c.card;
+        }
+      } else if (ka < kb) {
+        if (op === AND) {
+          i = gallopKeys(a, kb, i + 1);
+        } else {
+          keys.push(ka);
+          conts.push(ca[i]);
+          size += ca[i++].card;
+        }
+      } else if (op === AND) {
+        j = gallopKeys(b, ka, j + 1);
+      } else {
+        if (op === OR) {
+          keys.push(kb);
+          conts.push(cloneContainer(cb[j]));
+          size += cb[j].card;
+        }
+        j++;
+      }
+    }
+    if (op !== AND) {
+      for (; i < a.length; i++) {
+        keys.push(a[i]);
+        conts.push(ca[i]);
+        size += ca[i].card;
+      }
+    }
+    if (op === OR) {
+      for (; j < b.length; j++) {
+        keys.push(b[j]);
+        conts.push(cloneContainer(cb[j]));
+        size += cb[j].card;
+      }
+    }
+    this.#keys = keys;
+    this.#conts = conts;
+    this.#size = size;
   }
 };
+var EMPTIED = arrayContainer(new Uint16Array(0), 0);
+var tsRoaringCodec = {
+  empty: () => TsBitmap.empty(),
+  fromValues: (values) => TsBitmap.fromValues(values),
+  safeDeserialize: (bytes, maxBytes, options) => TsBitmap.safeDeserialize(bytes, maxBytes, options),
+  owns: (bitmap) => bitmap instanceof TsBitmap,
+  intersectSmallestFirst: true
+};
+
+// src/roaring-codec.ts
 function bitmapAsLoadInput(input) {
-  return input instanceof RoaringBitmap32 ? { bitmap: input } : input;
+  if (typeof input !== "object" || input === null) return input;
+  const tag = Object.prototype.toString.call(input).slice(8, -1);
+  if (tag === "Uint8Array" || tag === "Uint8ClampedArray") return input;
+  return Symbol.iterator in input && typeof input.serialize === "function" ? { bitmap: input } : input;
 }
-var roaringCodec = {
-  empty: () => SafeBitmap.empty(),
-  fromValues: (values) => SafeBitmap.fromValues(values),
-  safeDeserialize: (bytes, maxBytes, options) => SafeBitmap.safeDeserialize(bytes, maxBytes, options),
-  owns: (bitmap) => bitmap instanceof SafeBitmap
+var activeCodec = tsRoaringCodec;
+function flagshipCodec() {
+  return activeCodec;
+}
+var ReadonlyRoaringView = class {
+  #bitmap;
+  constructor(bitmap) {
+    this.#bitmap = bitmap;
+  }
+  get size() {
+    return this.#bitmap.size;
+  }
+  has(id) {
+    return this.#bitmap.has(id);
+  }
+  [Symbol.iterator]() {
+    return this.#bitmap[Symbol.iterator]();
+  }
+  /** The portable bytes, for exactly the argument `'portable'`; any other call is a `ValidationError`. */
+  serialize(...args) {
+    if (args.length !== 1 || args[0] !== "portable") {
+      const got = args.length === 0 ? "no argument" : args.map((a) => typeof a === "string" ? `'${a}'` : typeof a).join(", ");
+      throw new ValidationError3(
+        `a decoded bitmap serializes only as serialize('portable'); got ${got}`
+      );
+    }
+    return this.#bitmap.serialize();
+  }
 };
 function deserializePortable(bytes) {
-  return decodeSerialized(bytes, roaringCodec).unwrap();
+  return new ReadonlyRoaringView(decodeSerialized(bytes, flagshipCodec()));
 }
 
 // src/system-clock.ts
@@ -607,17 +2035,18 @@ import {
   DEFAULT_RETRY_POLICY,
   NOOP_METRICS,
   RetryingStorageChunkSource,
-  ValidationError as ValidationError2,
+  ValidationError as ValidationError4,
   isStorageBackend
 } from "@cloudbitmaps/core";
 function resolveRetryPolicy(partial) {
-  const baseDelayMs = partial.baseDelayMs ?? DEFAULT_RETRY_POLICY.baseDelayMs;
+  const orDefault = (field) => partial[field] === void 0 ? DEFAULT_RETRY_POLICY[field] : partial[field];
+  const baseDelayMs = orDefault("baseDelayMs");
   return {
-    maxAttempts: partial.maxAttempts ?? DEFAULT_RETRY_POLICY.maxAttempts,
+    maxAttempts: orDefault("maxAttempts"),
     baseDelayMs,
-    maxDelayMs: partial.maxDelayMs ?? (typeof baseDelayMs === "number" && baseDelayMs > DEFAULT_RETRY_POLICY.maxDelayMs ? baseDelayMs : DEFAULT_RETRY_POLICY.maxDelayMs),
-    backoffFactor: partial.backoffFactor ?? DEFAULT_RETRY_POLICY.backoffFactor,
-    jitter: partial.jitter ?? DEFAULT_RETRY_POLICY.jitter
+    maxDelayMs: partial.maxDelayMs === void 0 ? typeof baseDelayMs === "number" && baseDelayMs > DEFAULT_RETRY_POLICY.maxDelayMs ? baseDelayMs : DEFAULT_RETRY_POLICY.maxDelayMs : partial.maxDelayMs,
+    backoffFactor: orDefault("backoffFactor"),
+    jitter: orDefault("jitter")
   };
 }
 function wireStore(options, clock, rng, metrics) {
@@ -630,7 +2059,7 @@ function wireStore(options, clock, rng, metrics) {
   if (options.retry !== false) {
     const { onRetry: userOnRetry, ...ov } = options.retry ?? {};
     if (userOnRetry !== void 0 && typeof userOnRetry !== "function") {
-      throw new ValidationError2("retry.onRetry must be a function");
+      throw new ValidationError4("retry.onRetry must be a function");
     }
     retryOptions = {
       clock,
@@ -654,13 +2083,14 @@ function wireStore(options, clock, rng, metrics) {
     source: resolved.source,
     driver: resolved.driver,
     registry: resolved.registry,
+    backend: isStorageBackend(options.storage) ? options.storage : void 0,
     retryOptions
   };
 }
 function resolveStorageSource(options, clock) {
   const storage = options.storage;
   if (storage === null || typeof storage !== "object") {
-    throw new ValidationError2(
+    throw new ValidationError4(
       "`storage` must be a StorageBackend, an IStorageDriver, or a StorageChunkSource"
     );
   }
@@ -670,14 +2100,14 @@ function resolveStorageSource(options, clock) {
   const hasPutImmutable = typeof storage.putImmutable === "function";
   const isBackend = isStorageBackend(storage);
   if (isBackend && (hasGetChunk || hasPutImmutable)) {
-    throw new ValidationError2(
+    throw new ValidationError4(
       `\`storage\` is a StorageBackend that also exposes ${hasGetChunk ? "`getChunk`" : "`putImmutable`"} \u2014 ambiguous. A backend must not also be a driver or a source; pass whichever one you mean.`
     );
   }
   const hasStorageHalf = isObject(asBackend.storage);
   const hasRegistryHalf = isObject(asBackend.registry);
   if (!isBackend && hasPutImmutable && hasRegistryHalf) {
-    throw new ValidationError2(
+    throw new ValidationError4(
       "`storage` looks like a driver that also carries a `registry`. Passed as a bare driver it would have no pointer at all \u2014 generations would resolve by list-scan, so reads could serve a generation that was written but never published. If you meant a backend, use a backend class \u2014 S3Storage, GcsStorage, AzureBlobStorage, LocalFsStorage or MemoryStorage \u2014 or, to pair a driver of your own with a registry, brand the pair with `brandAsBackend` from `@cloudbitmaps/core/driver-kit`."
     );
   }
@@ -686,11 +2116,11 @@ function resolveStorageSource(options, clock) {
     const registryOk = typeof asBackend.registry.compareAndSwap === "function";
     if (!storageOk || !registryOk) {
       const bad = !storageOk ? "`storage` half is not an IStorageDriver (no `putImmutable`)" : "`registry` half is not an IRegistryDriver (no `compareAndSwap`)";
-      throw new ValidationError2(
+      throw new ValidationError4(
         "`storage` looks like a backend but its " + bad + " \u2014 use a backend class, or brand a pair of drivers with `brandAsBackend` from `@cloudbitmaps/core/driver-kit`."
       );
     }
-    throw new ValidationError2(
+    throw new ValidationError4(
       "`storage` must be a backend \u2014 S3Storage, GcsStorage, AzureBlobStorage, LocalFsStorage or MemoryStorage. An object with `.storage` and `.registry` is not one: a backend builds both halves from a single bucket and prefix, so they cannot disagree, and hand-assembling them re-opens exactly that mismatch \u2014 a store whose pointer and generations live in different places reads as empty rather than failing. A driver author who genuinely wants halves of their own \u2014 an instrumented driver, a registry in a database you already run \u2014 brands the pair with `brandAsBackend` from `@cloudbitmaps/core/driver-kit`, which is taking on that they agree."
     );
   }
@@ -711,18 +2141,18 @@ function resolveStorageSource(options, clock) {
     };
   }
   if (hasGetChunk && hasPutImmutable) {
-    throw new ValidationError2(
+    throw new ValidationError4(
       "`storage` exposes both `getChunk` and `putImmutable` \u2014 ambiguous; pass a StorageBackend, an IStorageDriver, or a StorageChunkSource, not a hybrid"
     );
   }
   if (!hasGetChunk && !hasPutImmutable) {
-    throw new ValidationError2(
+    throw new ValidationError4(
       "`storage` must be a StorageBackend, an IStorageDriver, or a StorageChunkSource"
     );
   }
   if (hasGetChunk) {
     if (options.encryption?.keystore !== void 0 || options.encryption?.required === true) {
-      throw new ValidationError2(
+      throw new ValidationError4(
         "keystore/requireEncryption apply only when the store builds its own read path: a StorageChunkSource of your own reads an encrypted segment by itself, if it must; to have the store decrypt, pass a backend"
       );
     }
@@ -744,32 +2174,32 @@ function resolveStorageSource(options, clock) {
 }
 
 // src/options.ts
-import { ValidationError as ValidationError3 } from "@cloudbitmaps/core";
+import { ValidationError as ValidationError5 } from "@cloudbitmaps/core";
 var keysOf = () => (keys) => keys;
 var kindOf = (v) => v === null ? "null" : Array.isArray(v) ? "an array" : `a ${typeof v}`;
 function optionsError(options, op, known, booleans = [], misplaced = []) {
   if (options === void 0 || options === null) return void 0;
   if (typeof options !== "object" || Array.isArray(options)) {
-    return new ValidationError3(`${op}: options must be an object; got ${kindOf(options)}`);
+    return new ValidationError5(`${op}: options must be an object; got ${kindOf(options)}`);
   }
   const bag = options;
   const unknown = Object.keys(bag).filter((k) => !known.includes(k) && bag[k] !== void 0);
   for (const k of misplaced) if (!unknown.includes(k) && bag[k] !== void 0) unknown.push(k);
   if (unknown.length > 0) {
-    return new ValidationError3(
+    return new ValidationError5(
       `${op}: unknown option${unknown.length > 1 ? "s" : ""} ${unknown.map((k) => `"${k}"`).join(", ")}; it takes { ${known.join(", ")} }`
     );
   }
   const audit = bag.audit;
   if (audit !== void 0 && audit !== null && typeof audit.onEvent !== "function") {
-    return new ValidationError3(
+    return new ValidationError5(
       `${op}: audit must be a sink with an onEvent(event) method, such as a RecordingAuditSink`
     );
   }
   for (const name of booleans) {
     const v = bag[name];
     if (v !== void 0 && typeof v !== "boolean") {
-      return new ValidationError3(`${op}: \`${name}\` must be a boolean; got ${kindOf(v)}`);
+      return new ValidationError5(`${op}: \`${name}\` must be a boolean; got ${kindOf(v)}`);
     }
   }
   return void 0;
@@ -789,28 +2219,24 @@ function checkOptions(options, op, known, booleans, misplaced) {
 }
 
 // src/index.ts
+import { MemoryStorage, LocalFsStorage, InProcessKeystore } from "@cloudbitmaps/core/node";
 import {
-  MemoryStorage,
-  LocalFsStorage,
-  destroySegment,
-  eraseNamespace,
   excludingReservedRows as excludingReservedRows2,
   readRetentionPolicy,
-  InProcessKeystore,
   CloudRoaringError,
-  ValidationError as ValidationError5,
+  ValidationError as ValidationError7,
   WriteConflictError as WriteConflictError2,
-  IntegrityError as IntegrityError3,
+  IntegrityError as IntegrityError4,
   NotFoundError as NotFoundError2,
   UnsupportedError as UnsupportedError3,
   CapabilityError,
   TransientError,
   KeyUnavailableError,
-  BudgetExceededError,
+  BudgetExceededError as BudgetExceededError2,
   LeaseExpiredError as LeaseExpiredError2,
   LeaseLimitError,
   StaleOperandError,
-  errorKind,
+  errorKind as errorKind2,
   CountingMetricsSink,
   RecordingAuditSink
 } from "@cloudbitmaps/core";
@@ -820,13 +2246,25 @@ var SystemRng = class {
     return Math.random();
   }
 };
-function validateRef(ref) {
+function withWaits(deps) {
+  if (deps === null || typeof deps !== "object") return deps;
+  return { ...deps, clock: deps.clock ?? new SystemClock(), rng: deps.rng ?? new SystemRng() };
+}
+function destroySegment(ref, deps, options) {
+  return coreDestroySegment(ref, withWaits(deps), options);
+}
+function eraseNamespace(namespace, deps, options) {
+  return coreEraseNamespace(namespace, withWaits(deps), options);
+}
+function validateRef(ref, verb) {
   if (typeof ref !== "object" || ref === null) {
-    throw new ValidationError4(
+    throw new ValidationError6(
       "a segment ref is an object such as { segment: 'name' }; store.segment() takes the bare name"
     );
   }
+  refuseUnknownRefKeys(ref, verb);
   validateSegmentRef(ref);
+  return { segment: ref.segment, namespace: ref.namespace };
 }
 var DEFAULT_CACHE_MAX_CHUNKS = 1024;
 var DEFAULT_ADMIN_CONCURRENCY = 8;
@@ -841,15 +2279,20 @@ function validateConcurrency(concurrency) {
 function requireScope(options, op) {
   if (options.namespace !== void 0) {
     if (typeof options.namespace !== "string") {
-      throw new ValidationError4(
+      throw new ValidationError6(
         `${op}: namespace must be a string; got ${kindOf(options.namespace)}`
       );
     }
     validateSegmentRef({ segment: "x", namespace: options.namespace });
   }
   refuseReservedNamespace(options.namespace);
+  if (options.namespace !== void 0 && options.allNamespaces === true) {
+    throw new ValidationError6(
+      `${op}: pass a namespace or { allNamespaces: true }, not both: with both, it is unclear whether to scan one namespace or every one`
+    );
+  }
   if (options.namespace === void 0 && options.allNamespaces !== true) {
-    throw new ValidationError4(
+    throw new ValidationError6(
       `${op} scans the global id space across all namespaces \u2014 pass an explicit \`namespace\`, or \`{ allNamespaces: true }\` to intentionally sweep the whole fleet`
     );
   }
@@ -896,7 +2339,7 @@ var CALL_KEYS = {
     "metadata",
     "keep"
   ]),
-  load: keysOf()(["allowEmpty", "guard", "keep", "metadata", "audit"]),
+  load: keysOf()(["allowEmpty", "guard", "keep", "metadata", "audit", "sorted"]),
   segments: keysOf()(["namespace"]),
   subjectReport: keysOf()([
     "namespace",
@@ -957,16 +2400,16 @@ var originOf;
 function assertOneStore(verb, role, h, origin) {
   if (h instanceof Segment) {
     if (originOf(h) === origin) return;
-    throw new ValidationError4(
+    throw new ValidationError6(
       `${verb}: ${role} belongs to another store; combine segments of one store: open each with this store's segment()`
     );
   }
   if (typeof h === "object" && h !== null && h[SEGMENT_BRAND] === true) {
-    throw new ValidationError4(
+    throw new ValidationError6(
       `${verb}: ${role} comes from another installed copy of @cloudbitmaps/roaring, so it belongs to another store; install one copy and combine segments of one store`
     );
   }
-  throw new ValidationError4(`${verb}: ${role} must be a segment from this store's segment()`);
+  throw new ValidationError6(`${verb}: ${role} must be a segment from this store's segment()`);
 }
 var MATERIALIZE_MANY_KEYS = [
   "operands",
@@ -1035,6 +2478,8 @@ var CloudRoaring = class _CloudRoaring {
   // no underlying driver to write through).
   storageDriver;
   registry;
+  // The backend itself, for its optional `checkLifecycle`; `undefined` for a bare driver or a source.
+  backend;
   keystore;
   requireEncryption;
   /** Resolved store-level per-op budget (null = disabled); the admin scans use it, with a per-op override. */
@@ -1054,7 +2499,7 @@ var CloudRoaring = class _CloudRoaring {
    */
   static rejectUnknownOptions(options) {
     if (options === null || options === void 0 || typeof options !== "object") {
-      throw new ValidationError4(
+      throw new ValidationError6(
         "CloudRoaring needs an options object with a `storage` key \u2014 got " + (options === null ? "null" : typeof options)
       );
     }
@@ -1072,7 +2517,7 @@ var CloudRoaring = class _CloudRoaring {
       const tag = Object.prototype.toString.call(value).slice(8, -1);
       if (typeof value !== "object" || value === null || NOT_A_GROUP[tag] !== void 0) {
         const got = typeof value !== "object" ? typeof value : NOT_A_GROUP[tag];
-        throw new ValidationError4(
+        throw new ValidationError6(
           `CloudRoaring's \`${group}\` must be an object${offOk ? " or `false`" : ""} \u2014 got ${got}`
         );
       }
@@ -1082,7 +2527,7 @@ var CloudRoaring = class _CloudRoaring {
     if (unknown.length === 0) return;
     const takes = (keys) => keys.map((k) => `\`${k}\``).join(", ");
     const named = [...new Set(unknown.map((u) => u.group))];
-    throw new ValidationError4(
+    throw new ValidationError6(
       `CloudRoaring does not take ${takes(unknown.map((u) => u.group === null ? u.key : `${u.group}.${u.key}`))}. ` + named.map(
         (g) => g === null ? `The store takes ${takes(OPTION_KEYS.top)}.` : `\`${g}\` takes ${takes(OPTION_KEYS[g])}.`
       ).join(" ") + " https://github.com/cloudbitmaps/cloudbitmaps/blob/main/docs/guide/api-reference.md#build-a-store--new-cloudroaringoptions"
@@ -1100,23 +2545,51 @@ var CloudRoaring = class _CloudRoaring {
     ];
     const entropy = options.seams?.entropy;
     if (entropy !== void 0 && typeof entropy !== "function") {
-      throw new ValidationError4(
+      throw new ValidationError6(
         "CloudRoaring's `seams.entropy` must be a function `(length) => Uint8Array` returning that many random bytes"
       );
     }
     for (const [seam, name, needs] of seams) {
-      if (seam === void 0 || seam === null) continue;
-      const has = (m) => typeof seam[m] === "function";
-      if (typeof seam !== "object" || !needs.every(has)) {
-        throw new ValidationError4(
+      if (seam === void 0) continue;
+      const has = (m) => seam !== null && typeof seam[m] === "function";
+      if (seam === null || typeof seam !== "object" || !needs.every(has)) {
+        throw new ValidationError6(
           `CloudRoaring's \`${name}\` must be an object with ${needs.map((m) => `\`${m}()\``).join(" and ")}`
         );
       }
     }
   }
+  /**
+   * Refuse a `cache` or `encryption` value that can never be honoured, by the name the caller wrote. The sizes reach
+   * the caches under their own internal names, so left to them an error would name `maxEntries` or `maxBytes`; and
+   * `encryption.required` must be exactly a boolean, since the read path took a truthy string for `true` while every
+   * write path did not, which refused cleartext reads and still wrote cleartext.
+   */
+  static rejectBadValues(options) {
+    const cache = options.cache;
+    if (cache !== void 0) {
+      requirePositiveInt("cache.maxChunks", cache.maxChunks);
+      requirePositiveInt("cache.readerMax", cache.readerMax);
+      requirePositiveInt("cache.readerMaxBytes", cache.readerMaxBytes);
+      const ttl = cache.ttlMs;
+      if (ttl !== void 0 && (typeof ttl !== "number" || !Number.isFinite(ttl) || ttl <= 0)) {
+        throw new ValidationError6(
+          `cache.ttlMs must be a finite number above 0 (milliseconds); got ${typeof ttl === "string" ? JSON.stringify(ttl) : String(ttl)}`
+        );
+      }
+    }
+    requireBool("CloudRoaring's `encryption.required`", options.encryption?.required);
+  }
+  /**
+   * Builds a store. Only `storage` is required: pass a backend such as `S3Storage` or `MemoryStorage`. `cache`,
+   * `encryption`, `retry`, `metrics`, `budget` and `seams` tune it. An option it does not take, a `cache` size or `ttlMs`
+   * that is not a usable number, an `encryption.required` that is not a boolean, or a seam missing a method the store
+   * calls, throws `ValidationError`.
+   */
   constructor(options) {
     _CloudRoaring.rejectUnknownOptions(options);
     _CloudRoaring.rejectHollowSeams(options);
+    _CloudRoaring.rejectBadValues(options);
     const clock = options.seams?.clock ?? new SystemClock();
     const rng = options.seams?.rng ?? new SystemRng();
     const entropy = options.seams?.entropy ?? systemEntropy;
@@ -1132,7 +2605,7 @@ var CloudRoaring = class _CloudRoaring {
     const deps = {
       storage: wired.storage,
       cache,
-      codec: roaringCodec,
+      codec: flagshipCodec(),
       // the facade injects the flagship codec; core stays codec-agnostic
       clock,
       metrics,
@@ -1147,6 +2620,8 @@ var CloudRoaring = class _CloudRoaring {
     this.metrics = metrics;
     this.storageDriver = wired.driver;
     this.registry = wired.registry;
+    if (this.registry !== void 0) REGISTRY_OF.set(this.origin, this.registry);
+    this.backend = wired.backend;
     this.keystore = options.encryption?.keystore;
     this.requireEncryption = options.encryption?.required ?? false;
   }
@@ -1173,7 +2648,7 @@ var CloudRoaring = class _CloudRoaring {
       clock: this.clock,
       rng: this.rng,
       entropy: this.entropy,
-      codec: roaringCodec,
+      codec: flagshipCodec(),
       // facade injects the flagship codec
       keystore: this.keystore,
       requireEncryption: this.requireEncryption,
@@ -1190,17 +2665,17 @@ var CloudRoaring = class _CloudRoaring {
    */
   segment(name, options) {
     if (typeof name === "object" && name !== null) {
-      throw new ValidationError4(
+      throw new ValidationError6(
         Array.isArray(name) ? "segment: the name is a string, store.segment('name'), not an array" : "segment: the name is a string, not a ref: for a ref, call store.segment(ref.segment, { namespace: ref.namespace })"
       );
     }
     if (options !== void 0 && options !== null) {
       if (typeof options !== "object" || Array.isArray(options)) {
-        throw new ValidationError4("segment: options must be an object such as { namespace }");
+        throw new ValidationError6("segment: options must be an object such as { namespace }");
       }
       const proto = Object.getPrototypeOf(options);
       if (proto !== null && Object.getPrototypeOf(proto) !== null) {
-        throw new ValidationError4(
+        throw new ValidationError6(
           "segment: options must be a plain object such as { namespace }, not a class instance or an object built on another"
         );
       }
@@ -1208,7 +2683,7 @@ var CloudRoaring = class _CloudRoaring {
         (k) => k !== "namespace" && options[k] !== void 0
       );
       if (unknown.length > 0) {
-        throw new ValidationError4(
+        throw new ValidationError6(
           `segment: unknown option${unknown.length > 1 ? "s" : ""} ${unknown.map((k) => `"${k}"`).join(", ")}; a handle takes { namespace } only`
         );
       }
@@ -1290,7 +2765,7 @@ var CloudRoaring = class _CloudRoaring {
         // puts that call on the operator. Inheriting `load()`'s collection would silently delete the
         // generations an operator's recovery story depends on — `rollbackSegment` refuses a collected target —
         // as a side effect of adding a guard whose entire purpose is preventing data loss. Opt in with `keep`.
-        keep: options?.keep ?? KEEP_EVERY_GENERATION,
+        keep: options?.keep === void 0 ? KEEP_EVERY_GENERATION : options.keep,
         ...options?.audit === void 0 ? {} : { audit: options.audit }
       };
       result = ids instanceof CombineChunks ? await loadSegmentChunks(dest, ids.chunks, deps, loadOptions) : await loadSegment(dest, ids, deps, loadOptions);
@@ -1318,20 +2793,20 @@ var CloudRoaring = class _CloudRoaring {
   /** The one body of the forms above. */
   async materializeMany(options) {
     if (typeof options !== "object" || options === null) {
-      throw new ValidationError4(
+      throw new ValidationError6(
         "materializeMany needs an options object with `operands`, `outputs` and `keep`"
       );
     }
     const epochAt = options.feed === void 0 ? 0 : this.epochNow();
     const unknown = unknownManyKeys(options);
     if (unknown.length > 0) {
-      throw new ValidationError4(
+      throw new ValidationError6(
         `materializeMany: unknown option${unknown.length > 1 ? "s" : ""} ${unknown.map((k) => `"${k}"`).join(", ")}`
       );
     }
     const dryRunIn = options.dryRun;
     if (dryRunIn !== void 0 && typeof dryRunIn !== "boolean") {
-      throw new ValidationError4("materializeMany: dryRun must be a boolean");
+      throw new ValidationError6("materializeMany: dryRun must be a boolean");
     }
     const dryRun = dryRunIn === true;
     const operandsIn = options.operands;
@@ -1343,7 +2818,7 @@ var CloudRoaring = class _CloudRoaring {
     const feedIn = options.feed;
     const mayBeEmptyIn = options.mayBeEmpty;
     if (feedIn !== void 0 && options.maxBufferedBytes === void 0) {
-      throw new ValidationError4(
+      throw new ValidationError6(
         "materializeMany: maxBufferedBytes is required with a feed: the feed is read once, so the call runs as one group and the budget is what bounds it"
       );
     }
@@ -1353,15 +2828,15 @@ var CloudRoaring = class _CloudRoaring {
     const budgetOption = options.budget;
     const allowAbsentOperands = options.allowAbsentOperands;
     if (typeof pinOption !== "boolean")
-      throw new ValidationError4("materializeMany: pin must be a boolean");
+      throw new ValidationError6("materializeMany: pin must be a boolean");
     if (allowAbsentOperands !== void 0 && typeof allowAbsentOperands !== "boolean") {
-      throw new ValidationError4("materializeMany: allowAbsentOperands must be a boolean");
+      throw new ValidationError6("materializeMany: allowAbsentOperands must be a boolean");
     }
     if (typeof operandsIn !== "object" || operandsIn === null || Array.isArray(operandsIn)) {
-      throw new ValidationError4("materializeMany: operands must be an object of name to segment");
+      throw new ValidationError6("materializeMany: operands must be an object of name to segment");
     }
     if (!Array.isArray(outputsIn) || outputsIn.length === 0) {
-      throw new ValidationError4("materializeMany: outputs must be a non-empty array");
+      throw new ValidationError6("materializeMany: outputs must be a non-empty array");
     }
     const names = Object.keys(operandsIn);
     const handles = /* @__PURE__ */ new Map();
@@ -1372,14 +2847,14 @@ var CloudRoaring = class _CloudRoaring {
     }
     if (mayBeEmptyIn !== void 0 && feedIn === void 0) {
       if (!Array.isArray(mayBeEmptyIn)) {
-        throw new ValidationError4(
+        throw new ValidationError6(
           "materializeMany: mayBeEmpty must be an array of fed operand names"
         );
       }
       if (mayBeEmptyIn.length > 0) {
         const first = mayBeEmptyIn[0];
         const what = typeof first !== "string" ? "something that is not a name" : handles.has(first) ? `"${first}", a stored operand` : `"${first}", which is not an operand of this call`;
-        throw new ValidationError4(
+        throw new ValidationError6(
           `materializeMany: mayBeEmpty names ${what}; it names fed operands, and this call has no feed`
         );
       }
@@ -1389,13 +2864,13 @@ var CloudRoaring = class _CloudRoaring {
     const destKeys = /* @__PURE__ */ new Set();
     outputsIn.forEach((raw, i) => {
       if (typeof raw !== "object" || raw === null) {
-        throw new ValidationError4(`outputs[${i}] must be an object`);
+        throw new ValidationError6(`outputs[${i}] must be an object`);
       }
       const bad = Object.keys(raw).filter(
         (k) => !MATERIALIZE_MANY_OUTPUT_KEYS.includes(k)
       );
       if (bad.length > 0) {
-        throw new ValidationError4(
+        throw new ValidationError6(
           `outputs[${i}]: unknown option${bad.length > 1 ? "s" : ""} ${bad.map((k) => `"${k}"`).join(", ")}`
         );
       }
@@ -1403,12 +2878,12 @@ var CloudRoaring = class _CloudRoaring {
       const dest = spec.dest;
       assertOneStore("materializeMany", `outputs[${i}].dest`, dest, this.origin);
       if (operandKeys.has(dest.key())) {
-        throw new ValidationError4(
+        throw new ValidationError6(
           `outputs[${i}].dest is also an operand of the call: one call is one pass over operands that do not change under it, so chain two calls`
         );
       }
       if (destKeys.has(dest.key())) {
-        throw new ValidationError4(
+        throw new ValidationError6(
           `outputs[${i}].dest names a segment another output of the call writes`
         );
       }
@@ -1481,13 +2956,13 @@ var CloudRoaring = class _CloudRoaring {
         held.set(key, { at, handle });
       } else if (prior.at !== void 0 && at !== void 0) {
         if (!samePin(prior.at, at)) {
-          throw new ValidationError4(
+          throw new ValidationError6(
             `materializeMany: operand "${name}" holds a segment another operand holds, ${twoPins(prior.at, at)}: one call reads a segment at one generation`
           );
         }
       } else if (prior.at !== void 0 || at !== void 0) {
         if (!pinOption) {
-          throw new ValidationError4(
+          throw new ValidationError6(
             `materializeMany: operand "${name}" holds a segment another operand holds, ${twoPins(prior.at, at)}: one call reads a segment at one generation`
           );
         }
@@ -1515,7 +2990,7 @@ var CloudRoaring = class _CloudRoaring {
       const final = rebindCombineMany(compiled, operandSpecs(pins));
       return runCombineMany(final, {
         source,
-        codec: roaringCodec,
+        codec: flagshipCodec(),
         clock: this.clock,
         ...metricsOn ? { metrics: this.metrics } : {}
       });
@@ -1575,7 +3050,7 @@ var CloudRoaring = class _CloudRoaring {
   /** A call's feed with the store's erasure counter: read once here, checked by the combine before any record is read. */
   feedOf(feed, mayBeEmpty, epochAt) {
     if (typeof feed !== "object" || feed === null || Array.isArray(feed)) {
-      throw new ValidationError4(
+      throw new ValidationError6(
         "materializeMany: feed must be an object with names, records and counts"
       );
     }
@@ -1625,13 +3100,32 @@ var CloudRoaring = class _CloudRoaring {
    * tax every load for a rare request; this admin scan is `O(registered segments)` and touches no hot path. Needs
    * a storage backend (throws {@link UnsupportedError} otherwise).
    *
+   * **Scope: one `namespace`, or `{ allNamespaces: true }`, never both** (both throws `ValidationError`, as does
+   * neither). A segment loaded with no `namespace` is in no namespace you can name: only `{ allNamespaces: true }`
+   * reaches it. `'_default'`, the label the export tool and the disaster-recovery samples print, and the bucket's
+   * object keys use, for such a segment, is an ordinary namespace name here, and passing it scans a namespace of that name, not those segments.
+   *
    * **Current as of the registry row, not as of the reader's cache.** Each segment's resolved generation is
    * compared with the row the scan listed, and a segment whose cached generation differs is re-resolved before the
    * read, so a load or an erasure from another process shows at once — whatever `cache.genTtlMs` is, `0` included.
    * The comparison is on the generation **and** the row's token, so a segment retired, purged and loaded again from
    * generation 0 while this store held its old generation 0 is told apart too.
+   *
+   * **A destroyed segment is searched as {@link CloudRoaring.eraseSubject} searches it.** No read resolves a
+   * tombstone, so the id is a member of none, but a cleartext `destroySegment` (`allowCleartext`), or a `dropSegment`
+   * whose sweep missed an object a load was still writing, leaves objects anyone with bucket access can read. Each
+   * object left under the tombstone is opened newest first until one holds the id, and the segment is then listed in
+   * `tombstones`, never in `segments`. A crypto-shredded segment's own objects are sealed under a key no row holds and are
+   * never a holder: it is listed only when an object left under it in the clear holds the id. The cost is one listing per destroyed segment in scope (1 request when nothing is left), and for each
+   * object opened a tail read and, where its index lists the id's chunk, a chunk read (two tail reads for an encrypted
+   * object, which never holds the id): 7 requests for a cleartext destroy with 3 objects, 21 for 10. The budget is
+   * charged one unit for each object opened past the one the row names, as `eraseSubject` charges. A report that runs
+   * out, or whose listing or read fails after the store's retry, rejects rather than under-reporting, so one leftover
+   * object that cannot be opened makes every report over its scope reject until it is removed (`generations(ref)` lists
+   * what is left, `dropSegment` deletes it). A report refused for budget while it searches a destroyed segment reports
+   * `spent` as `limit + 1`, a lower bound.
    */
-  async subjectReport(id, options = {}) {
+  async subjectReport(id, options) {
     checkOptions(options, "subjectReport", CALL_KEYS.subjectReport, ["allNamespaces"]);
     options ??= {};
     const registry = this.requireRegistry("subjectReport");
@@ -1646,26 +3140,53 @@ var CloudRoaring = class _CloudRoaring {
       budget,
       "subjectReport"
     );
+    let opens = 0;
+    const charge = () => {
+      opens += 1;
+      if (budget !== null && recs.length + opens > budget.maxRequests) {
+        throw new BudgetExceededError(
+          `subjectReport would fan out to more than ${budget.maxRequests} units, over the per-op budget: the search under a destroyed segment was abandoned at that point, so no exact total is available. Raise \`budget.maxRequests\`, override it per-op, or set \`budget: false\``,
+          {
+            option: "budget.maxRequests",
+            limit: budget.maxRequests,
+            spent: budget.maxRequests + 1
+          }
+        );
+      }
+    };
     const membership = await mapWithConcurrency(
       recs,
       options.concurrency ?? DEFAULT_ADMIN_CONCURRENCY,
       async (rec) => {
-        if (rec.status === "destroyed") return null;
         const ref = { segment: rec.segment, namespace: rec.namespace };
+        if (rec.status === "destroyed") {
+          const deps = this.lifecycleDeps("subjectReport");
+          const storage = budget === null ? deps.storage : new OpenChargingStorage(deps.storage, rec.currentGen, charge);
+          const held = await findIdUnderTombstone(ref, id, { ...deps, storage });
+          return held === null ? null : { tombstone: true, ref };
+        }
         if (this.crbmSource !== void 0) {
           const held = await this.crbmSource.currentVersion(ref);
-          const listed = rec.currentGen === null ? null : `${rec.currentGen}:${pointerIdOf(rec)}`;
-          if (rowVersionOfLive(held) !== listed) this.engine.invalidate(ref);
+          const listed2 = rec.currentGen === null ? null : `${rec.currentGen}:${pointerIdOf(rec)}`;
+          if (rowVersionOfLive(held) !== listed2) this.engine.invalidate(ref);
         }
-        return await this.engine.has(ref, id) ? { segment: rec.segment, namespace: rec.namespace } : null;
+        return await this.engine.has(ref, id) ? { tombstone: false, ref } : null;
       }
     );
-    const segments = membership.filter((m) => m !== null);
-    return { id, segments, scannedSegments: recs.length };
+    const listed = membership.filter((m) => m !== null);
+    const segments = listed.filter((m) => !m.tombstone).map((m) => m.ref);
+    const tombstones = listed.filter((m) => m.tombstone).map((m) => m.ref);
+    return { id, segments, tombstones, scannedSegments: recs.length };
   }
   /**
    * **Subject erasure (GDPR Art. 17): remove an id from every segment it's in, with the bit physically gone
-   * from the bucket on return.**
+   * from the bucket on return for each segment the ledger reports `erased: true`.** A noncurrent version, a replica
+   * or a backup keeps the old object until its own lifecycle removes it.
+   *
+   * **Scope: one `namespace`, or `{ allNamespaces: true }`, never both** (both throws `ValidationError`, as does
+   * neither). A segment loaded with no `namespace` is in no namespace you can name: only `{ allNamespaces: true }`
+   * reaches it. `'_default'`, the label the export tool and the disaster-recovery samples print, and the bucket's
+   * object keys use, for such a segment, is an ordinary namespace name here, and passing it scans a namespace of that name, not those segments.
    *
    * For each **registered** segment the id is a member of, `eraseIdFromSegment` rewrites the current generation
    * without the id — every chunk streamed through, one bit cleared — publishes the rewrite **fenced on the
@@ -1730,15 +3251,17 @@ var CloudRoaring = class _CloudRoaring {
    * `O(registered segments + superseded generations)`, no hot-path cost: a segment whose current generation lacks
    * the id is searched generation by generation, one open for each other generation in its bucket, and with the
    * keep-everything default of the `*Into` verbs that is one per generation the segment ever had. The per-op
-   * `budget` is charged one unit for each segment and one for each generation opened beyond the one its row names,
-   * so a fleet with long histories can exhaust it where the segment count alone would not. A segment that does is
+   * `budget` is charged one unit for each segment and one for each generation opened beyond the one its row names, so
+   * a fleet with long histories can exhaust it where the segment count alone would not. A generation is charged at its
+   * first open only: a later open of it in the call, a retry of a failed read included, costs no more units. A segment
+   * that exhausts the budget is
    * reported `erased: false` with an `error:` note, before it deletes anything (the one refusal that can come after a
    * rewrite is the last check for a generation a concurrent writer left behind), and the
    * rest of the scan continues: the call itself does not throw for it. Per-subject crypto-shred is infeasible (a subject's bit is
    * co-mingled in a shared container), so this is the single-subject erasure route; whole-segment/tenant erasure
    * is `dropSegment` / the `destroySegment`/`eraseNamespace` free functions.
    */
-  async eraseSubject(id, options = {}) {
+  async eraseSubject(id, options) {
     this.erasureEpoch++;
     checkOptions(options, "eraseSubject", CALL_KEYS.eraseSubject, ["allNamespaces"]);
     options ??= {};
@@ -1794,7 +3317,8 @@ var CloudRoaring = class _CloudRoaring {
             segment: rec.segment,
             namespace: rec.namespace,
             erased: false,
-            note: `error: ${err instanceof Error ? err.message : String(err)}`
+            note: `error: ${errorKind(err) ?? (err instanceof Error ? err.name : "Error")}: ${err instanceof Error ? err.message : String(err)}`
+            // the class lets a note be matched to the guide's table
           };
         } finally {
           try {
@@ -1815,11 +3339,12 @@ var CloudRoaring = class _CloudRoaring {
    * choose from, which is the reason to look at it. One registry read and one listing; it does not open the objects.
    * Each entry says whether the row knows the generation (`known`): a known generation needs no `allowUnknown`; an unknown
    * one does, except below a row's pointer when the row has no usable record or the target is older than a full one reaches.
+   * No entry is `current` on a destroyed segment: its row keeps the pointer it had, but no read resolves through it.
    *
    * Needs a backend.
    */
   async generations(ref) {
-    validateRef(ref);
+    ref = validateRef(ref, "generations");
     return listGenerations(ref, this.lifecycleDeps("generations"));
   }
   /**
@@ -1849,7 +3374,7 @@ var CloudRoaring = class _CloudRoaring {
    * ```
    */
   async exists(ref) {
-    validateRef(ref);
+    ref = validateRef(ref, "exists");
     return segmentExists(ref, this.requireRegistry("exists"));
   }
   /**
@@ -1906,8 +3431,9 @@ var CloudRoaring = class _CloudRoaring {
    * {@link ValidationError} before any request to storage, and a known one whose object carries another checksum than
    * the recorded one throws {@link IntegrityError}, with or without a keystore, since the footer is in the clear. A
    * generation not in the bucket (collected, or never written) throws `NotFoundError` naming what *is* available, a
-   * crypto-shredded segment throws {@link ValidationError} because every generation of it is unreadable, and a target
-   * that is cleartext under an encrypted segment, or encrypted under a cleartext one, throws {@link IntegrityError} from
+   * destroyed segment (crypto-shredded, destroyed in the clear or dropped) throws {@link ValidationError}, because no
+   * generation resolves through a destroyed row, and a target that is cleartext under an encrypted segment, or
+   * encrypted under a cleartext one, throws {@link IntegrityError} from
    * one tail read of it, because every read would refuse it. Rolling to the generation already current is a no-op that
    * reports itself, once one footer read finds its object in the bucket (and the one the row recorded); when the object is
    * gone it throws `NotFoundError` naming what is.
@@ -1918,8 +3444,10 @@ var CloudRoaring = class _CloudRoaring {
    * key (it holds none of the key's KEKs, one it holds does not unwrap it, or it throws `TransientError` or times out
    * as `AbortSignal.timeout()` and the AWS SDK report a timeout), a rollback onto a known generation still happens,
    * opening nothing, and the row carries no summary of the target. Any other failure of the keystore is
-   * thrown. A swap of the pointer that gets no answer is settled by reading the row: one that landed, the row being the
-   * one the swap leaves, is checked as any is, and otherwise its `TransientError` is thrown. After the swap the target's
+   * thrown. A swap of the pointer that gets no answer, or that meets a conflict, is settled by reading the row: one
+   * that landed, the row's pointer being at the target over a write this call sent (the write token, on a registry that
+   * reports them), is checked as any is, and otherwise its `TransientError` is thrown, or a `WriteConflictError` after
+   * a conflict, with no move recorded. After the swap the target's
    * footer is read once more, and the pointer put back if the object is gone or is another.
    *
    * It deletes nothing. The generations above the new pointer stay put — which is what makes this reversible —
@@ -1949,7 +3477,7 @@ var CloudRoaring = class _CloudRoaring {
    * Needs a backend.
    */
   async rollback(ref, toGeneration, options = {}) {
-    validateRef(ref);
+    ref = validateRef(ref, "rollback");
     checkOptions(options, "rollback", CALL_KEYS.rollback, ["allowUnknown"]);
     options ??= {};
     const deps = this.lifecycleDeps("rollback");
@@ -1965,9 +3493,16 @@ var CloudRoaring = class _CloudRoaring {
    * `input` is ids (any sync or async iterable of integers in `[0, 2^32)`), or a whole bitmap: `{ bitmap }`, anything
    * with `serialize('portable')` such as `roaring`'s `RoaringBitmap32`, or `{ serialized }`, portable Roaring bytes.
    * A bitmap is checked (size cap, structure, safe deserializer) before the first request, written from its own
-   * containers with no per-id work, and gives the generation chunk for chunk what its ids would. A bare
-   * `RoaringBitmap32` passed as ids loads as `{ bitmap }`. A `Uint8Array` or `Buffer` passed as ids is refused with
-   * `ValidationError`, since each byte would load as an id: pass bytes as `{ serialized }`.
+   * containers with no per-id work, and gives the generation chunk for chunk what its ids would. An
+   * iterable with a `serialize` method (a `RoaringBitmap32`, another copy's bitmap, or a bitmap `deserializePortable`
+   * returned) passed as ids loads as `{ bitmap }` and is not iterated. A `Uint8Array` or `Buffer` passed as ids is
+   * refused with `ValidationError`, since each byte would load as an id, even when it has a `serialize` of its own:
+   * pass bytes as `{ serialized }`.
+   *
+   * Ids are held whole in memory before the object is written: the generation's bitmaps and a buffer of up to about 28
+   * MB. Ids that already ascend can be loaded with `sorted: true` instead, which writes them one chunk at a time while
+   * the object uploads, so the load holds one chunk and the writer's index (up to about 7 MiB, about 8 MiB for an
+   * encrypted segment, derived), whatever the segment's size, and writes the same object ({@link LoadOptions.sorted}).
    *
    * The whole write path in one call: take the next generation number, write the object, check the result is
    * plausible, move the pointer, collect what the move superseded. Composed by hand those are four functions and
@@ -2026,7 +3561,14 @@ var CloudRoaring = class _CloudRoaring {
    * does the first load of a row that records none, which then records it. {@link LoadResult.collected} then names
    * what the pass deleted by name, and one name may have been gone already.
    *
-   * What it **throws** for is a fault rather than an outcome: invalid options or ids, and a crypto-shredded
+   * `input` cannot be a stream of this library (`iterate`, `everyNth`, `intersect`, `union`, `andNot`, as returned) that
+   * read the segment being loaded, from this store or one built over the same registry driver: a load publishes over
+   * whatever the segment is by then, so it would replace another writer's newer load with a result built from an older
+   * one, and it throws {@link ValidationError}. Ids read from another store over another backend load as any ids do.
+   * Two separate store instances over one bucket cannot be told apart, so this does not cover them; this release has no
+   * fenced in-place update, so write the result into a new segment and point readers at it.
+   *
+   * What it **throws** for is a fault rather than an outcome: invalid options or ids, and a destroyed
    * segment (`ValidationError`); a key the keystore cannot provide (`KeyUnavailableError`); a current generation
    * that will not open when a guard has to read its size, which it does only when the row has no usable summary of it
    * (`IntegrityError`); a driver failure; and a fault in the collection's own reads, listing or deletes, or in the write
@@ -2049,8 +3591,18 @@ var CloudRoaring = class _CloudRoaring {
    * Needs a backend (throws {@link UnsupportedError} otherwise).
    */
   async load(ref, input, options = {}) {
-    validateRef(ref);
-    checkOptions(options, "load", CALL_KEYS.load, ["allowEmpty"]);
+    ref = validateRef(ref, "load");
+    checkOptions(options, "load", CALL_KEYS.load, ["allowEmpty", "sorted"]);
+    if (typeof input === "object" && input !== null) {
+      const reads = STREAM_SOURCES.get(input);
+      const sameBackend = reads !== void 0 && (reads.origin === this.origin || this.registry !== void 0 && REGISTRY_OF.get(reads.origin) === this.registry);
+      if (sameBackend && reads.keys.includes(segmentKey(ref))) {
+        const named = ref.namespace === void 0 ? ref.segment : `${ref.namespace}/${ref.segment}`;
+        throw new ValidationError6(
+          `load: the ids come from a read of the segment "${named}" that is being loaded, and a load publishes over whatever the segment is by then, so another process's newer load of it can be replaced by a result built from the one before, with no conflict reported. This release has no fenced in-place update: write the result into a new segment and point readers at it`
+        );
+      }
+    }
     options ??= {};
     const deps = this.lifecycleDeps("load");
     try {
@@ -2060,11 +3612,14 @@ var CloudRoaring = class _CloudRoaring {
     }
   }
   /**
-   * **Dispose of a segment — tombstone it, then delete its storage objects.** Irreversible.
+   * **Dispose of a segment — tombstone it, then delete its storage objects.** It cannot be undone through the
+   * library (a restore from the registry's and the bucket's versions or backups can).
    *
-   * The operation a rolling window needs: `destroySegment` crypto-shreds (bytes unreadable everywhere including
-   * backups, but still sitting in your bucket and still billed, and it requires encryption), while this one
-   * removes the storage and works on a cleartext segment. On an encrypted segment it does both.
+   * The operation a rolling window needs: `destroySegment` crypto-shreds (it removes the key from the segment's
+   * current registry row, so the bytes are unreadable everywhere, backups included, once no retained copy of the row
+   * holds the key or every KEK that wrapped it is destroyed; the objects still sit in your bucket and are still
+   * billed, and it requires encryption), while this one removes the storage and works on a cleartext segment. On an
+   * encrypted segment it does both.
    *
    * Pass `{ dryRun: true }` first — it reports the generations it *would* delete and changes nothing. That
    * matters more than the `confirmSegment` guard for anything automated, because in a loop the guard is the same
@@ -2105,9 +3660,9 @@ var CloudRoaring = class _CloudRoaring {
    * because it has to enumerate and delete generations — a pre-built `StorageChunkSource` only reads.
    */
   async dropSegment(ref, options) {
-    validateRef(ref);
+    ref = validateRef(ref, "dropSegment");
     if (options === void 0 || options === null) {
-      throw new ValidationError4("dropSegment: options { confirmSegment } are required");
+      throw new ValidationError6("dropSegment: options { confirmSegment } are required");
     }
     checkOptions(options, "dropSegment", CALL_KEYS.dropSegment, ["dryRun"]);
     const deps = this.lifecycleDeps("dropSegment");
@@ -2122,8 +3677,9 @@ var CloudRoaring = class _CloudRoaring {
     }
   }
   /**
-   * **Record when this segment becomes eligible for retirement.** One registry write; nothing is deleted here,
-   * and nothing starts running. `retireExpired` is what acts on the policy, and **you** decide when that runs —
+   * **Record when this segment becomes eligible for retirement.** One policy write, plus a best-effort write of its
+   * due-index pointer (and removal of the old pointer when the expiry day moves); no data is deleted here, and
+   * nothing starts running. `retireExpired` is what acts on the policy, and **you** decide when that runs —
    * an EventBridge rule, a CronJob, a queue consumer, whatever your deployment already has. This library starts
    * no background thread (it has to work identically in a Lambda, an edge isolate and a long-lived server).
    *
@@ -2145,10 +3701,10 @@ var CloudRoaring = class _CloudRoaring {
    * A value in the past is legal and means "eligible on the next sweep" — backfilling a policy onto existing
    * buckets is normal. A value below `1_000_000_000_000` (2001-09-09) is rejected: it is almost certainly epoch
    * **seconds**, which would read as long-expired and retire the segment on the next pass. Needs a storage
-   * backend (throws {@link UnsupportedError} otherwise), and refuses a crypto-shredded segment.
+   * backend (throws {@link UnsupportedError} otherwise), and refuses a destroyed segment.
    */
   async setRetention(ref, policy) {
-    validateRef(ref);
+    ref = validateRef(ref, "setRetention");
     return setSegmentRetention(
       ref,
       { registry: this.requireRegistry("setRetention"), clock: this.clock, rng: this.rng },
@@ -2162,16 +3718,18 @@ var CloudRoaring = class _CloudRoaring {
    * "never expires" on a segment someone believes is expiring.
    */
   async getRetention(ref) {
-    validateRef(ref);
+    ref = validateRef(ref, "getRetention");
     return getSegmentRetention(ref, { registry: this.requireRegistry("getRetention") });
   }
   /**
-   * **Cancel a segment's expiry** so no sweep retires it. Returns whether a policy was actually removed (`false`
-   * when there was none). A separate verb from `setRetention` on purpose: "never expire" as a magic value passed
+   * **Cancel a segment's expiry** so no sweep retires it. Returns whether this call removed a policy (`false`
+   * when there was none, and also when a write that got no answer cannot be shown to be this call's and the
+   * row holds no expiry: the expiry is gone either way, and its due-index pointer is removed. A later write that set an
+   * expiry is cleared too, and the answer is `true`). A separate verb from `setRetention` on purpose: "never expire" as a magic value passed
    * to the setter is how a typo becomes a deletion.
    */
   async clearRetention(ref) {
-    validateRef(ref);
+    ref = validateRef(ref, "clearRetention");
     return clearSegmentRetention(ref, {
       registry: this.requireRegistry("clearRetention"),
       clock: this.clock,
@@ -2196,20 +3754,22 @@ var CloudRoaring = class _CloudRoaring {
    *
    * const swept = await store.retireExpired({ namespace: 'active-daily' });
    * for (const e of swept.entries) {
-   *   if (e.action === 'skipped') console.warn(`${e.segment}: ${e.reason}`); // invalid-policy / limit / failed: …
+   *   // invalid-policy / policy-changed / tombstone-not-empty / failed: …
+   *   if (e.action === 'skipped') console.warn(`${e.segment}: ${e.reason}`);
    *   if (e.action === 'retired' && e.result.generationsRemaining.length > 0) {
    *     console.warn(`${e.segment}: storage not fully reclaimed — re-run`);
    *   }
    * }
-   * if (swept.limited) scheduleAnotherPassSoon(); // more are still eligible
+   * if (swept.limited) scheduleAnotherPassSoon(); // more work (retirements or purges) remains
    * ```
    *
    * **Read the ledger.** A per-segment *fault* is an entry, not an exception — a throw from the middle of a fleet
    * sweep would leave the caller unable to say which segments were retired, having already retired some. (A bad
    * argument does throw, and so does a fleet larger than `maxScanSegments`.) `limited: true` means the per-cycle
-   * `limit` (default 100) cut the pass short and more are eligible. That cap is charged on **attempts**, not
-   * successes, which is what makes it a real bound: `dropSegment` writes the tombstone before sweeping Storage, so a
-   * fault in the Storage phase is a segment that is already retired. Retirements are sequential, so `limit` is a
+   * `limit` (default 100) cut the pass short, and more work (retirements or purges) remains: `limit` caps the
+   * retirements and tombstone purges one call attempts, together, and a segment it deferred gets no entry. That cap
+   * is charged on **attempts**, not successes, which is what makes it a real bound: `dropSegment` writes the
+   * tombstone before sweeping Storage, so a fault in the Storage phase is a segment that is already retired. Retirements are sequential, so `limit` is a
    * wall-clock knob too, and `retired` counts deletions only — a dry run reports `wouldRetire` instead, so a
    * dashboard summing `retired` can never show a phantom deletion.
    *
@@ -2219,9 +3779,11 @@ var CloudRoaring = class _CloudRoaring {
    * charged to `limit`, so it never holds the retirements behind it, and purging stops for the rest of the call after
    * three refused purges in a row (a purge that succeeds starts the count again).
    *
-   * It also **deletes the tombstone rows its own past retirements left**, after `tombstoneGraceMs` (default 24 h)
+   * It also **deletes the tombstone rows its own past retirements left**, after `tombstoneGraceMs` (default 24 h; at least one hour, else `ValidationError`)
    * and only once that segment's Storage generations are provably gone — collecting a straggler generation itself
-   * first, since nothing else ever would for a tombstoned segment. Attribution is a **positive marker the sweep
+   * first, since nothing else runs that collection on its own for a tombstoned segment (an erasure collects there
+   * only
+   * when an object holds its id, and a re-run drop sweeps it). Attribution is a **positive marker the sweep
    * stamps on its own retirements**, not an inference from "destroyed + an expired policy": a crypto-shred leaves
    * `retention` untouched, so setting a policy and then honouring a right-to-erasure request mid-window produces
    * exactly that row, and deleting it would destroy the Art. 17 attestation and un-fence the name. By default a
@@ -2242,7 +3804,7 @@ var CloudRoaring = class _CloudRoaring {
     const deps = this.lifecycleDeps("retireExpired");
     const result = await retireExpired(
       { registry: deps.registry, storage: deps.storage, clock: this.clock, rng: this.rng },
-      { ...opts, now: opts.now ?? this.clock.now() }
+      { ...opts, now: opts.now === void 0 ? this.clock.now() : opts.now }
     );
     if (opts.dryRun !== true) {
       for (const entry of result.entries) {
@@ -2289,7 +3851,7 @@ var CloudRoaring = class _CloudRoaring {
    * ```
    */
   invalidate(ref) {
-    validateRef(ref);
+    ref = validateRef(ref, "invalidate");
     refuseReservedNamespace(ref.namespace);
     this.engine.invalidate(ref);
   }
@@ -2349,11 +3911,7 @@ var CloudRoaring = class _CloudRoaring {
       if (hold !== void 0) await hold.release().catch(() => void 0);
       throw err;
     }
-    const pinnedAt = {
-      generation: at?.generation ?? null,
-      version: at?.version ?? null,
-      fingerprint: at?.fingerprint ?? null
-    };
+    const pinnedAt = at === null ? { generation: null, version: null, fingerprint: null } : { generation: at.generation, version: at.version, fingerprint: at.fingerprint };
     const pins = /* @__PURE__ */ new Map([[segmentKey(ref), pinnedAt]]);
     return makeSegment({
       engine: this.engineWithPins(pins),
@@ -2393,7 +3951,7 @@ var CloudRoaring = class _CloudRoaring {
     return new SegmentEngine({
       storage: this.retryOptions === void 0 ? pinned : new RetryingStorageChunkSource2(pinned, this.retryOptions),
       cache: this.cache,
-      codec: roaringCodec,
+      codec: flagshipCodec(),
       clock: this.clock,
       metrics: this.metrics,
       budget: this.budget,
@@ -2423,8 +3981,8 @@ var CloudRoaring = class _CloudRoaring {
       if (held.has(key)) {
         const before = held.get(key);
         if (!samePin(before, at)) {
-          throw new ValidationError4(
-            `the same segment is in this combine twice, ${twoPins(before, at)}: one call reads a segment at one generation, so materialise one of them into a segment of its own first, with \`intersectInto(dest, [])\``
+          throw new ValidationError6(
+            `the same segment is in this combine twice, ${twoPins(before, at)}: one call reads a segment at one generation, so materialise one of them into a segment of its own first, with \`materializeMany({ operands: { src: seg }, outputs: [{ dest, expr: { or: ['src'] } }], keep })\``
           );
         }
       } else {
@@ -2455,8 +4013,9 @@ var CloudRoaring = class _CloudRoaring {
    * throw). Read-only, bounded fan-out; run it at startup after a restore. Returns `{ checked, inconsistent,
    * errored }` — `inconsistent` empty ⇒ coherent; otherwise it names the segments to recover (restore the object
    * store, or roll the registry back to a coherent point). Needs the store built with a **backend**
-   * (throws {@link UnsupportedError} otherwise). `destroyed` (crypto-shredded) segments are skipped. Pair it with
-   * the DR runbook (docs/guide/disaster-recovery.md).
+   * (throws {@link UnsupportedError} otherwise). `destroyed` segments (crypto-shredded, destroyed in the clear or
+   * dropped) are skipped. Pair
+   * it with the DR runbook (docs/guide/disaster-recovery.md).
    *
    * A segment whose pointer names a missing object is the torn restore this reports; a cold `count()` of it still
    * answers the number its row records, while a read of the object throws, so the count alone never shows it. With
@@ -2489,6 +4048,56 @@ var CloudRoaring = class _CloudRoaring {
       options
     );
   }
+  /**
+   * **First-run check of the store's storage and registry.** Call it once at deploy time, or on a first run, before
+   * the first load: it finds a missing permission, a storage that does not refuse a second write to a key, a listing
+   * that lags, or a lifecycle rule that would delete the store's objects, while nothing depends on them yet.
+   *
+   * It runs seven checks and always lists all seven, in this order: `registry` (one read of a row that must be
+   * absent, and the registry able to write), `write` (a new object), `write-once` (a second write to the same key must
+   * be refused), `read` (the object reads back as written), `list` (the listing names it), `delete` (this run's own
+   * object is removed, with the version the read gave where the driver applies one) and `lifecycle` (the backend's
+   * lifecycle check). The probe is one small object at `cbm.due.preflight/segments/probe.<number>.crbm` under the
+   * store's prefix; no registry row is written, and no segment of yours can share the name. A probe left by a run that
+   * was cut off is named in the `list` detail and never deleted, since it could be a run in progress.
+   *
+   * It **never throws over a finding**. A failed step, a transient fault included, is a `problem` whose `detail`
+   * says to run again when the fault was transient, and the checks that cannot run without it are `unchecked`. The
+   * exception is the `lifecycle` step, whose failures, its timeout included, are `unchecked`. `ok` is true when no
+   * check is a `problem`: read an `unchecked` check yourself, as `ok` does not vouch for it. The `lifecycle` check is
+   * `unchecked` for a backend whose check says so (Azure Blob always), for a backend that has no such method (a
+   * third-party backend, a `brandAsBackend` wrapper that does not forward it), when the identity lacks the optional
+   * permission to read the lifecycle rules (`s3:GetLifecycleConfiguration`, `storage.buckets.get`), and when the check
+   * takes longer than 30 seconds of the store's clock. The other steps are the store's ordinary calls and keep their
+   * timing.
+   *
+   * **Not checked:** read-after-delete, the registry's `If-Match` on compare-and-swap, multipart abort permission,
+   * versioning, backups, the keystore's backup and an S3 SDK from 3.641.0 to 3.699.0 (an older SDK shows as a
+   * `write-once` problem; these drop `If-Match`, which only a registry write refuses). It makes no kind of request that a
+   * load does not, though the lifecycle read needs its own optional permission. A run costs about seven requests (a
+   * first run on GCS makes eight, the eighth a second listing that checks the bucket exists, and Azure Blob always
+   * eight): two writes and a delete, the rest reads and one listing.
+   *
+   * Throws {@link UnsupportedError}, and only that, for a store with no backend, since there is nothing to check.
+   */
+  async preflight() {
+    const deps = this.lifecycleDeps("preflight");
+    const backend = this.backend;
+    let checkLifecycle;
+    try {
+      const method = backend?.checkLifecycle;
+      if (typeof method === "function")
+        checkLifecycle = method.bind(backend);
+    } catch {
+    }
+    return runPreflight({
+      storage: deps.storage,
+      registry: deps.registry,
+      clock: this.clock,
+      entropy: this.entropy,
+      checkLifecycle
+    });
+  }
   /**
    * **Export ("eject") every registered segment's current generation** through the injected `sink`, using only
    * public read APIs — so your data is readable **without CloudRoaring** (the exit path; see the README's "Your
@@ -2497,15 +4106,16 @@ var CloudRoaring = class _CloudRoaring {
    * Enumerates via the store's **own** registry (needs one — throws {@link UnsupportedError} otherwise) so the
    * enumeration and the read path provably share one registry. Encrypted segments are decrypted transparently
    * **iff** this store was wired with their keystore — the export is therefore **cleartext**; protect it.
-   * Crypto-shredded segments are skipped. A segment that can't be read is isolated into the manifest's `failed[]`
-   * (the run continues), so "a manifest exists" means the run finished — check `failed`. The `export-segments`
+   * Destroyed segments (crypto-shredded, destroyed in the clear or dropped) are skipped. A segment that can't be read
+   * is isolated into the manifest's `failed[]` (the run continues), so "a manifest exists" means the run finished —
+   * check `failed`. The `export-segments`
    * CLI wraps this with a filesystem sink. The `'roaring'` format's bitmaps are built by the store's own codec.
    */
   async exportSegments(sink, options = {}) {
     checkOptions(options, "exportSegments", CALL_KEYS.exportSegments, [], MISPLACED.exportSegments);
     const opts = picked(options, CALL_KEYS.exportSegments);
     const registry = this.requireRegistry("exportSegments");
-    return runExport(this, registry, sink, { ...opts, codec: roaringCodec });
+    return runExport(this, registry, sink, { ...opts, codec: flagshipCodec() });
   }
 };
 var withBatches = (gen, batches) => Object.assign(gen, { batches });
@@ -2533,12 +4143,23 @@ var readOptions = (options) => ({
 });
 var NO_SEGMENTS = [];
 function segmentList(list, what) {
-  if (!Array.isArray(list)) throw new ValidationError4(`${what} must be an array of segments`);
+  if (!Array.isArray(list)) throw new ValidationError6(`${what} must be an array of segments`);
   return list;
 }
+var STREAM_SOURCES = /* @__PURE__ */ new WeakMap();
+var REGISTRY_OF = /* @__PURE__ */ new WeakMap();
+function readsFrom(stream, origin, keys) {
+  STREAM_SOURCES.set(stream, { origin, keys });
+  return stream;
+}
 function operandsLabel(verb) {
   return verb === "andNot" ? "andNot: `excludes`" : `${verb}: \`others\``;
 }
+function refuseNoOperands(verb) {
+  throw new ValidationError6(
+    verb === "intersect" ? "intersect requires at least one segment to intersect with; to read every id of one segment, use iterate()" : "intersectInto requires at least one segment to intersect with; to copy this segment into dest, call materializeMany({ operands: { src: thisSegment }, outputs: [{ dest, expr: { or: ['src'] } }], keep })"
+  );
+}
 var AS_IDS = {
   failing,
   guard: guardIds,
@@ -2555,9 +4176,9 @@ var CombineChunks = class {
 var AS_CHUNKS = {
   guard: guardItems,
   failing: (err) => refusing(err)(),
-  intersect: (engine, refs, opts) => engine.intersectChunks(refs, opts),
-  union: (engine, refs, opts) => engine.unionChunks(refs, opts),
-  andNot: (engine, base, refs, opts) => engine.andNotChunks(base, refs, opts)
+  intersect: (engine, refs, opts) => engine.intersectChunks(refs, opts, "intersectInto"),
+  union: (engine, refs, opts) => engine.unionChunks(refs, opts, "unionInto"),
+  andNot: (engine, base, refs, opts) => engine.andNotChunks(base, refs, opts, "andNotInto")
 };
 var KEEP_EVERY_GENERATION = Number.MAX_SAFE_INTEGER;
 async function timeOp(metrics, clock, name, fn) {
@@ -2616,7 +4237,7 @@ var Segment = class _Segment {
    */
   constructor(parts) {
     if (!minting) {
-      throw new ValidationError4(
+      throw new ValidationError6(
         "a Segment is not constructed directly; call `store.segment(name)`"
       );
     }
@@ -2655,7 +4276,7 @@ var Segment = class _Segment {
    *
    * **One call reads a segment at one generation**, so a combine that holds this segment at two —
    * `snap0.andNot([snap1])`, or `live.intersect([snap])` — throws {@link ValidationError} when it is read, and an
-   * `*Into` of one throws before it reads anything. Materialise one side first, with `intersectInto(dest, [])`.
+   * `*Into` of one throws before it reads anything. Materialise one side first, with `materializeMany({ operands: { src: seg }, outputs: [{ dest, expr: { or: ['src'] } }], keep })`.
    *
    * **A pin knows its object, not only its number.** A name purged and loaded again starts again at generation
    * 0, so a pin of the old segment never reads the new one: what it has already read still answers, as the
@@ -2730,11 +4351,11 @@ var Segment = class _Segment {
   leaseUntilOf(op, options) {
     if (options === void 0 || options === null) return void 0;
     if (typeof options !== "object" || Array.isArray(options)) {
-      throw new ValidationError4(`${op}: options must be an object such as { leaseUntil }`);
+      throw new ValidationError6(`${op}: options must be an object such as { leaseUntil }`);
     }
     const unknown = Object.keys(options).filter((k) => k !== "leaseUntil");
     if (unknown.length > 0) {
-      throw new ValidationError4(
+      throw new ValidationError6(
         `${op}: unknown option${unknown.length > 1 ? "s" : ""} ${unknown.map((k) => `"${k}"`).join(", ")}; this version takes { leaseUntil } only`
       );
     }
@@ -2742,17 +4363,17 @@ var Segment = class _Segment {
     if (until === void 0) return void 0;
     const now = this.clock.now();
     if (typeof until !== "number" || !Number.isSafeInteger(until)) {
-      throw new ValidationError4(
+      throw new ValidationError6(
         `${op}: leaseUntil must be an integer epoch-MILLISECONDS; got ${String(until)}`
       );
     }
     if (until <= now) {
-      throw new ValidationError4(
+      throw new ValidationError6(
         `${op}: leaseUntil (${until}) is not after now (${now}); it is epoch MILLISECONDS, so a value in seconds reads as long past. Use \`Date.now() + hours * 3_600_000\``
       );
     }
     if (until > now + MAX_LEASE_MS) {
-      throw new ValidationError4(
+      throw new ValidationError6(
         `${op}: leaseUntil is more than 14 days away; the longest lease is ${MAX_LEASE_MS} ms. Take a new lease when a job outlasts it`
       );
     }
@@ -2830,10 +4451,10 @@ var Segment = class _Segment {
    * `at.generation` instead of the current one. Pass what the earlier pin recorded, `{ generation, fingerprint }`
    * from its {@link Segment.pinnedAt}. A generation number alone is not an identity, since a purged and re-created
    * name starts again at 0, so the fingerprint is required: a bare number, a malformed fingerprint or a key other
-   * than `generation` and `fingerprint` is a {@link ValidationError}. Identify a pin by its `generation` and
+   * than `generation`, `fingerprint` and `version` is a {@link ValidationError}. Identify a pin by its `generation` and
    * `fingerprint`: the handle's `pinnedAt.version` can differ from the earlier pin's.
    *
-   * Throws {@link NotFoundError} when the generation is gone (collected, purged, or on a crypto-shredded segment),
+   * Throws {@link NotFoundError} when the generation is gone (collected, purged, or on a destroyed segment),
    * is above the row's pointer, or is another object than the fingerprint names, and never reads empty. A rollback
    * deletes nothing, so once a later load moves the pointer past a generation it rolled back from, that one can be
    * reopened while its object is stored. Nothing keeps a generation alive unless you lease it: a later load's
@@ -2846,18 +4467,32 @@ var Segment = class _Segment {
    * then reads as one from `pin()` does, including its failure on a chunk it has not cached once the generation is
    * swept. Works for an encrypted segment. The first argument is an object so that fields can join it later; the lease
    * is in `options`, the second.
+   *
+   * It takes what {@link Segment.pinnedAt} holds: once `generation` is not `null`, the record passes as it is (its
+   * `version` is not read), and `{ generation, fingerprint }` does as well. A pin of a segment that had no generation
+   * has nothing to reopen and throws {@link ValidationError}.
    */
   async pinAt(at, options) {
     this.assertLease();
-    const { generation, fingerprint } = at ?? {};
-    const unknown = typeof at === "object" && at !== null ? Object.keys(at).filter((k) => k !== "generation" && k !== "fingerprint") : [];
+    const { generation, fingerprint, version } = at ?? {};
+    const unknown = typeof at === "object" && at !== null ? Object.keys(at).filter((k) => !["generation", "fingerprint", "version"].includes(k)) : [];
     if (unknown.length > 0) {
-      throw new ValidationError4(
-        `pinAt: unknown option${unknown.length > 1 ? "s" : ""} ${unknown.map((k) => `"${k}"`).join(", ")}; this version takes { generation, fingerprint } only`
+      throw new ValidationError6(
+        `pinAt: unknown option${unknown.length > 1 ? "s" : ""} ${unknown.map((k) => `"${k}"`).join(", ")}; pinAt takes { generation, fingerprint } and a pin's \`version\`, which it does not read`
+      );
+    }
+    if (generation === null) {
+      throw new ValidationError6(
+        "pinAt: the pin named no generation (the segment had none when it was pinned), so there is nothing to reopen"
+      );
+    }
+    if (version !== void 0 && typeof version !== "string") {
+      throw new ValidationError6(
+        "pinAt: `version`, when given, is the string a pin recorded in its pinnedAt; pinAt does not read it, so leave it out if you have none"
       );
     }
     if (typeof generation !== "number" || !Number.isSafeInteger(generation) || generation < 0 || typeof fingerprint !== "string" || !/^\d+:\d+$/.test(fingerprint)) {
-      throw new ValidationError4(
+      throw new ValidationError6(
         "pinAt: pass { generation, fingerprint } as recorded by an earlier pin (its pinnedAt); a generation number without the fingerprint of its object does not identify it"
       );
     }
@@ -2874,9 +4509,11 @@ var Segment = class _Segment {
     return segmentKey(this.ref);
   }
   /**
-   * Refuse an `*Into` whose handles cannot be used, before any request: anything that is not a segment or is a
-   * segment of another store ({@link ValidationError}), and a handle (this one, `dest`, an operand or an exclude) whose
-   * lease has ended or was released ({@link LeaseExpiredError}). Called by the three `*Into` verbs only.
+   * Refuse an `*Into` that cannot run, before any request, in this order: anything that is not a segment or is a
+   * segment of another store, an empty operand list for `intersectInto`, and a `dest` that is also a source (all
+   * {@link ValidationError}); then a handle (this one, `dest`, an operand or an exclude) whose lease has ended or was
+   * released ({@link LeaseExpiredError}). A call with both a lapsed lease and one of the first three refusals throws the
+   * first. Called by the three `*Into` verbs only.
    *
    * The verbs are `async` so this surfaces as a **rejected promise**, like every other validation in the facade —
    * a synchronous throw out of a promise-returning method escapes a caller who attached `.catch()` instead of
@@ -2886,8 +4523,28 @@ var Segment = class _Segment {
     this.assertSegments(verb, "the destination", [dest]);
     this.assertSegments(verb, verb === "andNotInto" ? "an exclude" : "an operand", operands);
     this.assertSegments(verb, "an exclude", excludes);
+    const base = verb.slice(0, -"Into".length);
+    if (base === "intersect" && operands.length === 0) refuseNoOperands("intersectInto");
+    this.refuseSourceDestination(verb, dest, operands, excludes);
     this.assertLeases([this, dest, ...operands, ...excludes]);
   }
+  /**
+   * Refuse an `*Into` whose destination is also one of its sources (this segment, an operand or an exclude, by the key
+   * a handle gives, so a pin of the source and a ref spelled with the default namespace count), before any request, as
+   * `materializeMany` refuses it. The combine would read the destination at the generation this store last resolved,
+   * up to `cache.genTtlMs` old, while the publish is fenced on the row as it stands: another process's newer load of
+   * the destination would be overwritten by a result built from the one before it, with no conflict to report.
+   */
+  refuseSourceDestination(verb, dest, operands, excludes) {
+    const key = dest.key();
+    const role = this.key() === key ? "this segment" : operands.some((o) => o.key() === key) ? verb === "andNotInto" ? "an exclude" : "an operand" : excludes.some((o) => o.key() === key) ? "an exclude" : void 0;
+    if (role === void 0) return;
+    const { namespace, segment } = dest.ref;
+    const named = namespace === void 0 ? segment : `${namespace}/${segment}`;
+    throw new ValidationError6(
+      `${verb}: the destination "${named}" is also ${role} of the call, and a call that reads a segment while it publishes to it can replace a newer load of it with a result built from an older one, with no conflict reported. This release has no fenced in-place update: combine into a new segment and point readers at it`
+    );
+  }
   /** `result` as is, or, when a handle of the call holds a lease, checking that lease each time it reads a chunk. */
   guarded(out, handles, result) {
     return handles.some((h) => h.leaseHold !== void 0) ? out.guard(result, () => this.assertLeases(handles)) : result;
@@ -2999,7 +4656,11 @@ var Segment = class _Segment {
       engine.iterate(ref, bounds),
       () => engine.iterateBatches(ref, bounds)
     );
-    return this.leaseHold === void 0 ? stream : guardIds(stream, () => this.assertLease());
+    return readsFrom(
+      this.leaseHold === void 0 ? stream : guardIds(stream, () => this.assertLease()),
+      this.origin,
+      [this.key()]
+    );
   }
   /**
    * **Pinned handles only.** The ids at 1-based ranks `n`, `2n`, `3n` …, counted over the ids in `(after, through]`
@@ -3048,7 +4709,11 @@ var Segment = class _Segment {
       n,
       options == null ? void 0 : rangeOf(options)
     );
-    return this.leaseHold === void 0 ? stream : guardIdIterable(stream, () => this.assertLease());
+    return readsFrom(
+      this.leaseHold === void 0 ? stream : guardIdIterable(stream, () => this.assertLease()),
+      this.origin,
+      [this.key()]
+    );
   }
   /**
    * The options a combine hands the engine, read once, when it is called ({@link readOptions}), with the `exclude`
@@ -3087,7 +4752,8 @@ var Segment = class _Segment {
    *
    * Of {@link CombineOptions} it takes the range, `concurrency`, `budget`, `allowAbsentOperands` and `exclude`; a write
    * option (`audit`, `allowEmpty`, `guard`, `metadata`, `keep`) fails the stream with {@link ValidationError} when it is
-   * first read, before any request.
+   * first read, before any request. So does an empty `others`: an intersection over nothing has no meaning, and
+   * to read every id of one segment, use {@link iterate}. (`union` and `andNot` read an empty list as `this`.)
    */
   intersect(others, options) {
     const bad = optionsError(
@@ -3119,6 +4785,15 @@ var Segment = class _Segment {
    * materialisation that silently did not take effect is the one thing a caller cannot detect on its own.
    *
    * A call involving a handle whose lease has ended, or anything that is not a segment, is refused before any of this.
+   * So is a `dest` that is also `this`, an operand or an exclude (the same segment by name and namespace, however the
+   * handle was made), and, for `intersectInto` alone, an empty `others` (`unionInto` and `andNotInto` publish `this` for an
+   * empty list): each throws {@link ValidationError} before any request. A destination that
+   * is also a source would publish a result built from the generation this store last resolved over a newer load by
+   * another process, with no conflict to report. This release has no fenced in-place update: write the result into a
+   * new segment and point readers at it; a single writer that knows nothing else writes the segment may load the result
+   * back, unfenced. To copy `src` into `dest`, call
+   * `materializeMany({ operands: { src }, outputs: [{ dest, expr: { or: ['src'] } }], keep })`, which reads each chunk
+   * once, at one instant.
    * It takes every field of {@link CombineOptions}, as `unionInto` does.
    */
   async intersectInto(dest, others, options) {
@@ -3133,7 +4808,8 @@ var Segment = class _Segment {
    * `intersect` prunes any key missing from any operand; union has nothing to prune. It is charged against the
    * same per-op budget, so a wide union is refused rather than quietly billed — pass `budget` to raise it
    * deliberately. If you find yourself unioning the same segments on every read, materializing the combined
-   * segment once (`unionInto`, or a load) is the cheaper shape. It takes the options {@link intersect} takes.
+   * segment once (`unionInto`, or a load) is the cheaper shape. It takes the options {@link intersect} takes, and an
+   * empty `others` reads `this` itself.
    */
   union(others, options) {
     const bad = optionsError(
@@ -3201,6 +4877,7 @@ var Segment = class _Segment {
     try {
       exclude = verb === "andNot" ? NO_SEGMENTS : this.excludesOf(options);
       const others = segmentList(operands, operandsLabel(verb));
+      if (verb === "intersect" && others.length === 0) refuseNoOperands("intersect");
       handles = [this, ...others, ...exclude];
       this.assertSegments(verb, verb === "andNot" ? "an exclude" : "an operand", others);
       this.assertSegments(verb, "an exclude", exclude);
@@ -3214,17 +4891,21 @@ var Segment = class _Segment {
     } catch (err) {
       return out.failing(err);
     }
+    const keys = handles.map((h) => h.key());
+    const known = (result) => out === AS_IDS ? readsFrom(result, this.origin, keys) : result;
     if (verb === "andNot") {
       const refs2 = operands.map((o) => o.ref);
       const opts2 = options == null ? void 0 : readOptions(options);
-      return this.guarded(out, handles, out.andNot(engine, this.ref, refs2, opts2));
+      return known(this.guarded(out, handles, out.andNot(engine, this.ref, refs2, opts2)));
     }
     const refs = [this.ref, ...operands.map((o) => o.ref)];
     const opts = this.refsIn(options, exclude);
-    return this.guarded(
-      out,
-      handles,
-      verb === "union" ? out.union(engine, refs, opts) : out.intersect(engine, refs, opts)
+    return known(
+      this.guarded(
+        out,
+        handles,
+        verb === "union" ? out.union(engine, refs, opts) : out.intersect(engine, refs, opts)
+      )
     );
   }
   /** The one body of the three `*Into` verbs, after each has checked its own options. */
@@ -3250,13 +4931,13 @@ var Segment = class _Segment {
   }
 };
 export {
-  BudgetExceededError,
+  BudgetExceededError2 as BudgetExceededError,
   CapabilityError,
   CloudRoaring,
   CloudRoaringError,
   CountingMetricsSink,
   InProcessKeystore,
-  IntegrityError3 as IntegrityError,
+  IntegrityError4 as IntegrityError,
   KeyUnavailableError,
   LeaseExpiredError2 as LeaseExpiredError,
   LeaseLimitError,
@@ -3268,12 +4949,12 @@ export {
   StaleOperandError,
   TransientError,
   UnsupportedError3 as UnsupportedError,
-  ValidationError5 as ValidationError,
+  ValidationError7 as ValidationError,
   WriteConflictError2 as WriteConflictError,
   deserializePortable,
   destroySegment,
   eraseNamespace,
-  errorKind,
+  errorKind2 as errorKind,
   excludingReservedRows2 as excludingReservedRows,
   readRetentionPolicy
 };