@helipod/client 0.1.0

package/dist/chunk-I7ZJFW4E.js

@@ -0,0 +1,2232 @@
+import {
+  DEFAULT_OUTBOX_MAX_QUEUE_SIZE,
+  OUTBOX_VERSION,
+  OfflineClientResetError,
+  OutboxOverflowError,
+  defaultMintClientId,
+  mintIdentity
+} from "./chunk-DW55SNHW.js";
+
+// src/api.ts
+function getFunctionPath(ref) {
+  return typeof ref === "string" ? ref : ref.__path;
+}
+function makeProxy(segments) {
+  return new Proxy(
+    {},
+    {
+      get(_target, prop) {
+        if (typeof prop !== "string") return void 0;
+        if (prop === "__path") {
+          if (segments.length < 2) return segments.join(":");
+          return `${segments.slice(0, -1).join("/")}:${segments[segments.length - 1]}`;
+        }
+        return makeProxy([...segments, prop]);
+      }
+    }
+  );
+}
+var anyApi = makeProxy([]);
+
+// src/delivery-policy.ts
+var MutationUndeliveredError = class extends Error {
+  constructor(message = "mutation outcome unknown: the connection closed before a response arrived") {
+    super(message);
+    this.name = "MutationUndeliveredError";
+  }
+};
+function closeDisposition(entries, opts = {}) {
+  const armed = opts.armed ?? false;
+  const reject = [];
+  const drop = [];
+  const retain = [];
+  const park = [];
+  for (const e of entries) {
+    switch (e.status.type) {
+      case "unsent":
+        retain.push(e.requestId);
+        break;
+      case "parked":
+        retain.push(e.requestId);
+        break;
+      case "inflight":
+        if (armed && e.durable) {
+          park.push(e.requestId);
+          drop.push(e.requestId);
+        } else {
+          reject.push(e.requestId);
+          drop.push(e.requestId);
+        }
+        break;
+      case "completed":
+        drop.push(e.requestId);
+        break;
+    }
+  }
+  return { reject, drop, retain, park };
+}
+
+// src/optimistic-store.ts
+function isDevMode() {
+  const env = globalThis.process?.env;
+  return env?.NODE_ENV !== "production";
+}
+function freezeDev(value) {
+  if (isDevMode() && value !== null && typeof value === "object") Object.freeze(value);
+  return value;
+}
+function createOptimisticLocalStore(view, seed) {
+  const ordinals = /* @__PURE__ */ new Map();
+  return {
+    getQuery: (ref, args) => freezeDev(view.getQuery(ref, args)),
+    setQuery: (ref, args, value) => view.setQuery(ref, args, value),
+    getAllQueries: (ref) => view.getAllQueries(ref).map(({ args, value }) => ({
+      args,
+      value: freezeDev(value)
+    })),
+    placeholderId: (table) => {
+      const n = ordinals.get(table) ?? 0;
+      ordinals.set(table, n + 1);
+      return `${seed.entropy}:${table}:${n}`;
+    },
+    now: () => seed.now
+  };
+}
+
+// src/outbox-drain.ts
+import { jsonToConvex } from "@helipod/values";
+var DRAIN_INITIAL_BACKOFF_MS = 250;
+var DRAIN_BACKOFF_BASE = 2;
+var DRAIN_MAX_BACKOFF_MS = 3e4;
+function computeDrainBackoff(attempts, rng = Math.random) {
+  const raw = DRAIN_INITIAL_BACKOFF_MS * DRAIN_BACKOFF_BASE ** (attempts + 1);
+  const jittered = Math.round(raw * (0.5 + 0.5 * rng()));
+  return Math.min(jittered, DRAIN_MAX_BACKOFF_MS);
+}
+var DEFAULT_DRAIN_CHUNK_SIZE = 50;
+var DEFAULT_DRAIN_INTERVAL_MS = 5e3;
+function probeLockManager() {
+  const nav = globalThis.navigator;
+  const locks = nav?.locks;
+  if (locks && typeof locks.request === "function") {
+    return {
+      request: (name, options, callback) => locks.request(name, options, callback)
+    };
+  }
+  return void 0;
+}
+var OFFLINE_IDENTITY_CHANGED = "OFFLINE_IDENTITY_CHANGED";
+var AUTH_REFRESH_UDF_PATH = "auth:refresh";
+var NON_REPLAYABLE_MUTATION_DROPPED = "NON_REPLAYABLE_MUTATION_DROPPED";
+function dropIfNonReplayable(outbox, entry) {
+  if (entry.udfPath !== AUTH_REFRESH_UDF_PATH) return false;
+  console.error(
+    `[helipod] outbox: dropping a queued "${entry.udfPath}" entry at hydrate \u2014 replaying an auth refresh is never safe (a stale rotation would trip reuse-detection and force-sign-out an honest user); this entry predates the client's transient-mutation fix`
+  );
+  void outbox.updateStatus(entry.clientId, entry.seq, "failed", {
+    message: `mutation "${entry.udfPath}" dropped at hydrate: durable auth-refresh replay is never safe`,
+    code: NON_REPLAYABLE_MUTATION_DROPPED
+  }).catch(() => {
+  });
+  return true;
+}
+var OutboxDrain = class {
+  host;
+  lockName;
+  locksOption;
+  poisonPolicy;
+  chunkSize;
+  intervalMs;
+  backoffMs;
+  onPause;
+  started = false;
+  leader = false;
+  stopped = false;
+  paused = false;
+  hydrated = false;
+  /** The in-flight chunk: requestId → in-log entry. Non-null iff one unacked chunk is outstanding. */
+  active = null;
+  /** Re-entrancy guard around `maybeDrainNext`'s `await whenBaselineAdopted()` (one flush at a time). */
+  flushScheduling = false;
+  /** Consecutive transient-stop count — the backoff attempt number (reset on any forward progress). */
+  transientAttempts = 0;
+  abort = new AbortController();
+  releaseLeadership;
+  intervalTimer;
+  backoffTimer;
+  constructor(host, opts) {
+    this.host = host;
+    this.lockName = opts.lockName;
+    this.locksOption = opts.locks;
+    this.poisonPolicy = opts.poisonPolicy ?? "skip";
+    this.chunkSize = opts.chunkSize ?? DEFAULT_DRAIN_CHUNK_SIZE;
+    this.intervalMs = opts.intervalMs ?? DEFAULT_DRAIN_INTERVAL_MS;
+    this.backoffMs = opts.backoffMs ?? ((attempts) => computeDrainBackoff(attempts));
+    this.onPause = opts.onPause;
+  }
+  /** Acquire leadership (Web Locks, or single-tab fallback) and, once leader, hydrate + drain. Safe
+   *  to call once; a no-op afterward. */
+  start() {
+    if (this.started) return;
+    this.started = true;
+    const locks = this.locksOption === void 0 ? probeLockManager() : this.locksOption ?? void 0;
+    if (!locks) {
+      queueMicrotask(() => void this.becomeLeader());
+      return;
+    }
+    void locks.request(this.lockName, { signal: this.abort.signal }, async () => {
+      if (this.stopped) return;
+      await this.becomeLeader();
+    }).catch(() => {
+    });
+  }
+  /** Stop cleanly (client close, or mid-drain lock loss). Releases leadership, cancels a pending
+   *  lock request, and clears every timer — the durable records make a successor leader safe. */
+  stop() {
+    if (this.stopped) return;
+    this.stopped = true;
+    this.leader = false;
+    this.active = null;
+    if (this.intervalTimer !== void 0) clearInterval(this.intervalTimer);
+    if (this.backoffTimer !== void 0) clearTimeout(this.backoffTimer);
+    this.intervalTimer = void 0;
+    this.backoffTimer = void 0;
+    this.abort.abort();
+    this.releaseLeadership?.();
+  }
+  /** Wake the drain (enqueue / reconnect-after-baseline / an explicit nudge). Deferred to a
+   *  microtask so a synchronous settling frame (e.g. a `ConnectAck` emitted right after reopen)
+   *  always settles its entries BEFORE the drain re-reads the queue. */
+  nudge() {
+    if (this.stopped || !this.leader) return;
+    queueMicrotask(() => void this.maybeDrainNext());
+  }
+  /** True iff `requestId` belongs to the drain's in-flight chunk — `client.ts` routes that unit's
+   *  `MutationResponse` here instead of down the direct-send path. */
+  handles(requestId) {
+    return this.active?.has(requestId) ?? false;
+  }
+  /** The transport dropped (a reconnect-class close, NOT the client's `close()` — leadership and
+   *  the interval survive). The in-flight chunk's unresponded units will never get a response on
+   *  the new server session, so revert them to re-sendable and clear the chunk NOW — otherwise
+   *  `canDrain()`'s one-unacked invariant (`active === null`) would wedge the drain for the rest of
+   *  this tab session (no chunk would ever flush again, and every new mutation would queue behind
+   *  the stuck backlog until overflow). Called by `client.ts#onTransportClosed` BEFORE the
+   *  reconciler's S4 close rules run, so the reverted (`unsent`) units are simply retained by the
+   *  close disposition, promises pending, ready for the reconnect handshake + re-drain. A pending
+   *  transient-backoff timer is also cleared — the reconnect handshake re-drives the drain, and
+   *  `canDrain()` would no-op a stale timer against a closed transport anyway. */
+  onTransportClosed() {
+    this.revertActive();
+    this.transientAttempts = 0;
+    if (this.backoffTimer !== void 0) {
+      clearTimeout(this.backoffTimer);
+      this.backoffTimer = void 0;
+    }
+  }
+  /** True while an unacked chunk is in flight — `client.ts#hasOutboxBacklog` counts it so a new
+   *  `mutation()` enqueues BEHIND the chunk instead of direct-sending ahead of it (the FIFO rule:
+   *  "while the queue is non-empty, new mutations enqueue behind it"). A chunk's units are
+   *  `inflight`, which the unsent/parked backlog scan alone would miss when the chunk consumed the
+   *  entire backlog. */
+  get hasActiveChunk() {
+    return this.active !== null;
+  }
+  /** @internal test/debug — the drain halted on a coded failure under `poisonPolicy: "pause"`. */
+  get isPaused() {
+    return this.paused;
+  }
+  /** @internal test/debug — the drain currently holds leadership. */
+  get isLeader() {
+    return this.leader;
+  }
+  /** Resume a `pause`d drain (T5 owns the app-facing retry surface; this is the mechanism). */
+  resume() {
+    if (!this.paused) return;
+    this.paused = false;
+    this.transientAttempts = 0;
+    this.nudge();
+  }
+  async becomeLeader() {
+    if (this.stopped) return;
+    this.leader = true;
+    await this.hydrateOnce();
+    if (this.stopped) return;
+    if (this.host.transportOpen() && this.host.drainable().length > 0) this.host.ensureInitialHandshake();
+    this.startInterval();
+    void this.maybeDrainNext();
+    await new Promise((resolve) => {
+      this.releaseLeadership = resolve;
+    });
+  }
+  startInterval() {
+    if (this.intervalTimer !== void 0 || this.intervalMs <= 0) return;
+    this.intervalTimer = setInterval(() => void this.maybeDrainNext(), this.intervalMs);
+    this.intervalTimer.unref?.();
+  }
+  /** Load the durable queue into the log (once), under recorded ids, then prune dead meta rows.
+   *  Only STILL-ACTIVE entries (`unsent`/`inflight`/`parked`) are hydrated into the log — a `failed`
+   *  entry left behind by a prior session is a terminal, accessor-only record (surfaced via
+   *  `pendingMutations()`/the constructor's `refireDurableFailures` R9 scan) and must never be
+   *  resurrected here as a fresh `unsent` log entry: `host.addHydrated` unconditionally stamps
+   *  `status: "unsent"` regardless of the persisted status, so hydrating a `failed` row verbatim
+   *  would render a phantom optimistic row for an already-dead mutation AND make it drainable again
+   *  (a resend of something the server/R9 already settled), on top of double-firing R9 alongside the
+   *  constructor's unconditional resume scan. Mirrors the same filter `mirrorFromStore`'s cross-tab
+   *  backstop applies (`client.ts`). */
+  async hydrateOnce() {
+    if (this.hydrated) return;
+    this.hydrated = true;
+    const { entries } = await this.host.outbox.loadAll();
+    for (const e of entries) {
+      if (e.status !== "unsent" && e.status !== "inflight" && e.status !== "parked") continue;
+      if (dropIfNonReplayable(this.host.outbox, e)) continue;
+      this.host.addHydrated(e);
+    }
+    await this.pruneDeadMeta();
+  }
+  /** Delete meta rows for clientIds with no live entries and that aren't the current session's — the
+   *  T1-flagged unbounded-tiny-rows gap (one dead row accrues per prior tab-session + every reset).
+   *  Capability-gated: a minimal `OutboxStorage` (a bare test double) may omit the two optional
+   *  methods, in which case pruning is simply skipped. */
+  async pruneDeadMeta() {
+    const list = this.host.outbox.listMetaClientIds;
+    const del = this.host.outbox.deleteMeta;
+    if (!list || !del) return;
+    let ids;
+    try {
+      ids = await list.call(this.host.outbox);
+    } catch {
+      return;
+    }
+    const current = this.host.currentClientId();
+    const live = /* @__PURE__ */ new Set();
+    for (const e of this.host.drainable()) if (e.clientId !== void 0) live.add(e.clientId);
+    for (const id of ids) {
+      if (id === current || live.has(id)) continue;
+      try {
+        await del.call(this.host.outbox, id);
+      } catch {
+      }
+    }
+  }
+  canDrain() {
+    return this.leader && !this.stopped && !this.paused && this.active === null && this.host.transportOpen() && this.host.isArmed() && this.host.drainable().length > 0;
+  }
+  /** Flush the next chunk when eligible. The `flushScheduling` guard + the synchronous `this.active`
+   *  set (in `flushChunk`) keep exactly one chunk in flight across the `await` yield. */
+  async maybeDrainNext() {
+    if (this.flushScheduling || !this.canDrain()) return;
+    this.flushScheduling = true;
+    try {
+      await this.host.whenBaselineAdopted();
+      if (!this.canDrain()) return;
+      this.flushChunk();
+    } finally {
+      this.flushScheduling = false;
+    }
+  }
+  flushChunk() {
+    const all = this.host.drainable();
+    const currentFingerprint = this.host.currentFingerprint();
+    const chunk = [];
+    const map = /* @__PURE__ */ new Map();
+    let settledIdentityFailure = false;
+    for (const entry of all) {
+      if (chunk.length >= this.chunkSize) break;
+      if (entry.identityFingerprint !== void 0 && entry.identityFingerprint !== currentFingerprint) {
+        console.error(
+          `[helipod] outbox: dropping mutation "${entry.udfPath}" \u2014 it was queued under a different identity than the current session (${OFFLINE_IDENTITY_CHANGED})`
+        );
+        this.host.settleTerminal(
+          entry.requestId,
+          OFFLINE_IDENTITY_CHANGED,
+          `mutation "${entry.udfPath}" dropped: the session identity changed since it was queued`
+        );
+        settledIdentityFailure = true;
+        continue;
+      }
+      this.host.setStatus(entry, "inflight");
+      map.set(entry.requestId, entry);
+      chunk.push(this.host.batchEntry(entry));
+    }
+    if (chunk.length === 0) {
+      if (settledIdentityFailure) this.nudge();
+      return;
+    }
+    this.active = map;
+    this.host.sendBatch(chunk);
+  }
+  /** Route one unit's `MutationResponse` (only ever called for a requestId in the active chunk). */
+  onResponse(msg) {
+    const active = this.active;
+    const entry = active?.get(msg.requestId);
+    if (!active || !entry) return;
+    if (msg.success) {
+      active.delete(msg.requestId);
+      const value = this.resolveResponseValue(msg);
+      this.host.settleApplied(msg.requestId, value, msg.replayed === true, msg.ts);
+      this.onForwardProgress();
+      return;
+    }
+    if (msg.code !== void 0) {
+      if (this.poisonPolicy === "pause") {
+        this.paused = true;
+        console.error(
+          `[helipod] outbox drain PAUSED on a coded failure of "${entry.udfPath}" (${msg.code}); poisonPolicy="pause" \u2014 the queue is halted until resumed`
+        );
+        this.onPause?.({ requestId: msg.requestId, udfPath: entry.udfPath, code: msg.code });
+        this.revertActive();
+        return;
+      }
+      active.delete(msg.requestId);
+      this.host.settleTerminal(msg.requestId, msg.code, `mutation "${entry.udfPath}" failed`);
+      this.onForwardProgress();
+      return;
+    }
+    this.transientAttempts++;
+    this.revertActive();
+    const delay = this.backoffMs(this.transientAttempts);
+    this.backoffTimer = setTimeout(() => {
+      this.backoffTimer = void 0;
+      void this.maybeDrainNext();
+    }, delay);
+    this.backoffTimer.unref?.();
+  }
+  resolveResponseValue(msg) {
+    if (msg.valueMissing) return null;
+    return msg.value !== void 0 ? jsonToConvex(msg.value) : null;
+  }
+  /** A unit settled (applied or coded-terminal): if the chunk is now empty, advance to the next. */
+  onForwardProgress() {
+    this.transientAttempts = 0;
+    if (this.active && this.active.size === 0) {
+      this.active = null;
+      this.nudge();
+    }
+  }
+  /** Revert every still-in-flight entry of the active chunk to `unsent` (re-sendable) and clear the
+   *  chunk — used by the transient-stop and pause paths. The units that got no response are exactly
+   *  those still in `active`. */
+  revertActive() {
+    if (!this.active) return;
+    for (const entry of this.active.values()) this.host.setStatus(entry, "unsent");
+    this.active = null;
+  }
+};
+
+// src/connect-handshake.ts
+var HELD_STATUSES = /* @__PURE__ */ new Set(["unsent", "inflight", "parked"]);
+function outboxHeldFromLog(entries) {
+  const refs = [];
+  for (const e of entries) {
+    if (e.clientId !== void 0 && e.seq !== void 0 && HELD_STATUSES.has(e.status.type)) {
+      refs.push({ clientId: e.clientId, seq: e.seq });
+    }
+  }
+  return refs;
+}
+function outboxHeldFromStore(entries) {
+  const refs = [];
+  for (const e of entries) {
+    if (HELD_STATUSES.has(e.status)) refs.push({ clientId: e.clientId, seq: e.seq });
+  }
+  return refs;
+}
+function outboxAckedThrough(held) {
+  const lowestHeld = /* @__PURE__ */ new Map();
+  for (const ref of held) {
+    const cur = lowestHeld.get(ref.clientId);
+    if (cur === void 0 || ref.seq < cur) lowestHeld.set(ref.clientId, ref.seq);
+  }
+  const acked = [];
+  for (const [clientId, minSeq] of lowestHeld) {
+    if (minSeq > 0) acked.push({ clientId, seq: minSeq - 1 });
+  }
+  return acked;
+}
+function buildConnectMessage(sessionId, clientId, held) {
+  return {
+    type: "Connect",
+    sessionId,
+    ...clientId !== void 0 ? { clientId } : {},
+    held,
+    ackedThrough: outboxAckedThrough(held),
+    // DLR Stage 2a: advertise by-id diff support. The server records this on any `Connect` (even a
+    // resume-handshake one) and sends `QueryDiff` only to a session that advertised it.
+    supportsQueryDiff: true
+  };
+}
+
+// src/identity-fingerprint.ts
+async function sha256Hex(input) {
+  const bytes = new TextEncoder().encode(input);
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
+  return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function sessionFingerprintKey(sessionId) {
+  return `session:${sessionId}`;
+}
+
+// src/client.ts
+import {
+  versionsEqual,
+  INITIAL_VERSION
+} from "@helipod/sync";
+import { convexToJson as convexToJson2, jsonToConvex as jsonToConvex4 } from "@helipod/values";
+
+// src/layered-store.ts
+import { convexToJson, jsonToConvex as jsonToConvex2 } from "@helipod/values";
+import { applyChanges, driftChecksum } from "@helipod/sync";
+import { base64ToBytes, compareKeyBytes } from "@helipod/index-key-codec";
+function queryHash(path, argsJson) {
+  return `${path}:${JSON.stringify(argsJson)}`;
+}
+function renderByIdValue(rows) {
+  for (const rv of rows.values()) return jsonToConvex2(rv.row);
+  return void 0;
+}
+function renderRangeValue(rows, orderDir) {
+  const entries = [...rows.values()].sort(
+    (a, b) => compareKeyBytes(base64ToBytes(a.orderKey ?? ""), base64ToBytes(b.orderKey ?? ""))
+  );
+  if (orderDir === "desc") entries.reverse();
+  return entries.map((e) => jsonToConvex2(e.row));
+}
+function renderPageValue(rows, orderDir, meta) {
+  return {
+    page: renderRangeValue(rows, orderDir),
+    nextCursor: meta.nextCursor,
+    hasMore: meta.hasMore,
+    scanCapped: meta.scanCapped
+  };
+}
+var LayeredQueryStore = class {
+  byHash = /* @__PURE__ */ new Map();
+  byId = /* @__PURE__ */ new Map();
+  create(queryId, path, args, hash) {
+    const sub = {
+      queryId,
+      path,
+      args,
+      hash,
+      serverValue: void 0,
+      composedValue: void 0,
+      answered: false,
+      lastHash: void 0,
+      listeners: /* @__PURE__ */ new Set()
+    };
+    this.byHash.set(hash, sub);
+    this.byId.set(queryId, sub);
+    return sub;
+  }
+  remove(hash) {
+    const sub = this.byHash.get(hash);
+    if (!sub) return;
+    this.byHash.delete(hash);
+    this.byId.delete(sub.queryId);
+  }
+  /** Set a subscription's authoritative base (from a `QueryUpdated` modification). Does NOT fire —
+   *  `recompose` owns all listener firing so the base+drop+rebuild happen as one atomic frame.
+   *  `hash` is the server-minted result fingerprint carried on the same modification — stored
+   *  verbatim (undefined clears `lastHash`, e.g. an old server that never sends `hash`).
+   *
+   *  DLR Stage 2b (Finding 2): a `QueryUpdated` is the ONLY way a DIFFABLE (range/by-id) sub ever
+   *  reaches this method — the server sends a full RERUN answer instead of a `QueryDiff` only on a
+   *  RERUN-fallback (a `SetAuth` identity switch drops the server-side row-map; a fleet-forwarded
+   *  RERUN does the same), never in steady state (steady state for a diffable sub is `QueryDiff`).
+   *  So revert the sub to a plain RERUN-rendered sub here: drop the PRIOR identity's `diffRows` and
+   *  `renderMode`. Otherwise a subsequent incremental `QueryDiff` would merge onto the stale previous-
+   *  identity row-map and `renderRangeValue` the prior user's rows for ~1 RTT until drift-resync heals
+   *  — a transient cross-identity leak on an auth-scoped range query. Cleared → a later incremental
+   *  diff instead hits `reconcile.ts`'s uninitialized-render-mode guard (→ resync), and a later
+   *  `QueryDiff` reset re-establishes `renderMode`/`diffRows` cleanly. The immediate frame renders
+   *  `value` directly (recompose reads `serverValue`, never `diffRows`), so no stale row is shown. */
+  setServerValue(sub, value, hash) {
+    sub.serverValue = value;
+    sub.lastHash = hash;
+    sub.answered = true;
+    sub.diffRows = void 0;
+    sub.renderMode = void 0;
+    sub.orderDir = void 0;
+    sub.pageMeta = void 0;
+  }
+  /** Mark a subscription as having received its first reply WITHOUT a base value (from a
+   *  `QueryFailed` modification — there is no server row to render, only an error). See the
+   *  `answered` field doc for why this is distinct from `setServerValue`. */
+  markAnswered(sub) {
+    sub.answered = true;
+  }
+  /** Ingest a `QueryUnchanged` modification (subscription resume, design 2025-11-28): the fresh
+   *  server-side re-run's hash matched what this session echoed, so there is no new value on the
+   *  wire — `serverValue`/`lastHash`/`composedValue` all stay exactly as they were. It still counts
+   *  as a delivered reply (`answered = true`, same as `setServerValue`/`markAnswered`) — see the
+   *  `answered` field doc. The caller (`reconcile.ts`) is responsible for passing this sub's `hash`
+   *  into `recompose`'s `forceNotify` set — see that method's doc for why a `QueryUnchanged` must
+   *  still fire listeners to introduce no new observable difference for app code. */
+  markUnchanged(sub) {
+    sub.answered = true;
+  }
+  /**
+   * DLR Stage 2a/2b — apply a `QueryDiff`'s changes to a DIFFABLE query's keyed row-map, re-derive
+   * the rendered `serverValue` as a FRESH reference (so `recompose`'s reference-inequality check
+   * fires listeners), and report whether the client-recomputed drift checksum diverged from the
+   * server's. The caller (the reconciler) triggers a scoped resync on `drift === true`.
+   *
+   * `reset` (2b — widened from a bare `true`) governs where the diff applies FROM and how the
+   * result renders:
+   *   - `undefined` (an incremental diff): merges `changes` onto the RUNNING `sub.diffRows` map —
+   *     `sub.renderMode`/`orderDir` are left exactly as they were from the last reset.
+   *   - `true` (a by-id reset): the classic 2a reset — `sub.renderMode = "byid"`.
+   *   - `{ mode, orderDir }` (a range reset, or a future non-byid mode): `sub.renderMode = mode`,
+   *     `sub.orderDir = orderDir`.
+   * Both reset forms rebuild from an EMPTY map, never merge onto `sub.diffRows` — a reset is a full
+   * re-baseline (the initial subscribe answer, or a range resync after a drift/table-invalidation),
+   * so a row that's no longer in the result set must disappear, not linger from the prior baseline.
+   * `applyChanges` is copy-on-write, so `diffRows` becomes a new Map each apply — the client never
+   * mutates a map a listener may still hold.
+   *
+   * `lastHash` OWNERSHIP (DLR 2b Task 10): this method does NOT touch `sub.lastHash` — the caller
+   * (`reconcile.ts#ingestTransition`'s `QueryDiff` arm) owns it, since only the caller knows whether
+   * this call was a RESET (carries the server's resume fingerprint, `mod.hash`, to store) or an
+   * INCREMENTAL diff (no fingerprint — the caller clears it instead). Leaving it here would mean
+   * either always clearing it (breaking resume for every diffable sub, the Task 10 regression this
+   * fixes) or reaching into wire-message fields (`mod.hash`) this store-level method doesn't receive.
+   *
+   * NOTE ON AN UNINITIALIZED `renderMode` (DLR 2b Task 10 residual): this method does NOT itself
+   * guard against an INCREMENTAL diff (`reset === undefined`) arriving while `renderMode` has never
+   * been established — it can't distinguish that from the ordinary "first-ever call, reset omitted"
+   * shorthand several of this file's own unit tests use to mean "build from an empty baseline" (a
+   * pattern that predates `reset`'s widening and has no way here to tell "legitimately fresh" apart
+   * from "already answered by something else, never diff-initialized"). The caller
+   * (`reconcile.ts#ingestTransition`) owns that distinction instead — it has `sub.answered`'s
+   * PRE-CALL value on hand, which this method's own post-call mutation of `sub.answered` would
+   * otherwise erase, and doing it there also means the store-level surface tested here stays exactly
+   * as it always was.
+   */
+  applyDiff(sub, changes, checksum, reset) {
+    if (reset === true) {
+      sub.renderMode = "byid";
+    } else if (reset) {
+      sub.renderMode = reset.mode;
+      sub.orderDir = reset.orderDir;
+      if (reset.mode === "page") {
+        sub.pageMeta = { nextCursor: reset.nextCursor, hasMore: reset.hasMore, scanCapped: reset.scanCapped };
+      }
+    }
+    const base = reset !== void 0 ? /* @__PURE__ */ new Map() : sub.diffRows ?? /* @__PURE__ */ new Map();
+    const next = applyChanges(base, changes);
+    sub.diffRows = next;
+    sub.serverValue = sub.renderMode === "page" ? renderPageValue(next, sub.orderDir ?? "asc", sub.pageMeta) : sub.renderMode === "range" ? renderRangeValue(next, sub.orderDir ?? "asc") : renderByIdValue(next);
+    sub.answered = true;
+    return { drift: driftChecksum(next) !== checksum };
+  }
+  serverValueOf(hash) {
+    return this.byHash.get(hash)?.serverValue;
+  }
+  /**
+   * Rebuild every subscription's `composedValue` = replay the surviving updates (in `requestId`
+   * order) over the current `serverValue`s, then fire listeners wherever the composed value's
+   * reference changed. Transactional per-updater: a throwing updater is buffered-and-discarded and
+   * returned as a `ReplayDrop` (the caller removes it from the log); the rebuild always completes.
+   *
+   * @param entries    surviving pending mutations, in replay order
+   * @param invokeUpdate runs one entry's updater against the view (kept in the reconciler so the
+   *                     entry `seed` can feed `placeholderId()`/`now()` when T5 wires them)
+   * @param forceNotify  subscription `hash`es (subscription resume) to fire listeners for even when
+   *                     the composed reference didn't change — a `QueryUnchanged` ingest has no new
+   *                     value to swap in (`serverValue` is retained as-is), yet this store has NEVER
+   *                     done content-based dedup for a plain `QueryUpdated` either: `setServerValue`
+   *                     unconditionally overwrites `serverValue`, and — because `jsonToConvex` mints
+   *                     a fresh object on every decode — the reference-inequality check below ALWAYS
+   *                     fires for a content-identical `QueryUpdated` today (verified in
+   *                     `test/resume-client.test.ts`'s Step-1 comment). `forceNotify` reproduces
+   *                     that same always-fires behavior for `QueryUnchanged`, so it introduces no new
+   *                     observable difference for app code. One nuance worth flagging: a
+   *                     `QueryUnchanged` notify hands listeners the RETAINED `serverValue` reference
+   *                     (nothing new was decoded), whereas a value-equal `QueryUpdated` today mints a
+   *                     fresh object every time — so a reference-equality consumer (e.g. React's
+   *                     `useState`, which bails out of a re-render when the new state === the old
+   *                     state) may legitimately skip one redundant re-render on this path that it
+   *                     wouldn't skip on an equivalent full send. Content identity is hash-proven
+   *                     either way; only the object identity differs.
+   */
+  recompose(entries, invokeUpdate, forceNotify) {
+    const overlay = /* @__PURE__ */ new Map();
+    const dropped = [];
+    for (const entry of entries) {
+      if (!entry.update) continue;
+      const local = /* @__PURE__ */ new Map();
+      const touched = /* @__PURE__ */ new Set();
+      const read = (hash) => local.has(hash) ? local.get(hash) : overlay.has(hash) ? overlay.get(hash) : this.serverValueOf(hash);
+      const view = {
+        getQuery: (ref, args = {}) => read(queryHash(getFunctionPath(ref), convexToJson(args))),
+        setQuery: (ref, args, value) => {
+          const h = queryHash(getFunctionPath(ref), convexToJson(args));
+          local.set(h, value);
+          touched.add(h);
+        },
+        getAllQueries: (ref) => {
+          const path = getFunctionPath(ref);
+          const out = [];
+          for (const s of this.byHash.values()) {
+            if (s.path === path) out.push({ args: jsonToConvex2(s.args), value: read(s.hash) });
+          }
+          return out;
+        }
+      };
+      try {
+        invokeUpdate(entry, view);
+      } catch (error) {
+        dropped.push({ requestId: entry.requestId, error });
+        continue;
+      }
+      for (const h of touched) overlay.set(h, local.get(h));
+      entry.touched = touched;
+    }
+    for (const sub of this.byHash.values()) {
+      const next = overlay.has(sub.hash) ? overlay.get(sub.hash) : sub.serverValue;
+      if (next !== sub.composedValue || forceNotify?.has(sub.hash)) {
+        sub.composedValue = next;
+        if (next !== void 0) {
+          for (const l of sub.listeners) l.onUpdate(next);
+        }
+      }
+    }
+    return dropped;
+  }
+};
+
+// src/reconcile.ts
+import { jsonToConvex as jsonToConvex3 } from "@helipod/values";
+
+// src/mutation-log.ts
+var MutationLog = class {
+  entries = /* @__PURE__ */ new Map();
+  add(entry) {
+    this.entries.set(entry.requestId, entry);
+  }
+  get(requestId) {
+    return this.entries.get(requestId);
+  }
+  delete(requestId) {
+    return this.entries.delete(requestId);
+  }
+  /** All entries in requestId (insertion) order — the replay order. */
+  entriesInOrder() {
+    return [...this.entries.values()];
+  }
+  get size() {
+    return this.entries.size;
+  }
+};
+
+// src/reconcile.ts
+function versionCoversCommit(maxObservedTs, commitTs) {
+  return commitTs <= maxObservedTs && commitTs > 0;
+}
+var DEFAULT_GATE_TIMEOUT_MS = 1e4;
+var Reconciler = class {
+  constructor(store, opts = {}) {
+    this.store = store;
+    this.gateTimeoutMs = opts.gateTimeoutMs ?? DEFAULT_GATE_TIMEOUT_MS;
+    this.onDrift = opts.onDrift;
+  }
+  store;
+  log = new MutationLog();
+  observedTs = 0;
+  gateTimeoutMs;
+  timers = /* @__PURE__ */ new Map();
+  /** DLR Stage 2a — invoked when a `QueryDiff`'s client-recomputed drift checksum diverges from the
+   *  server's. The client wires this to a scoped resync (`client.ts` passes `() => this.resync()`).
+   *  For by-id the diff is trivially correct so this should never fire in normal operation; it is the
+   *  safety net that 2b's harder differ inherits already proven. */
+  onDrift;
+  /** Max `endVersion.ts` observed this session (reset on close). Exposed for tests. */
+  get maxObservedTs() {
+    return this.observedTs;
+  }
+  entries() {
+    return this.log.entriesInOrder();
+  }
+  /** T6: `unsent` entries in FIFO (requestId/insertion) order — flushed on transport reopen. */
+  unsentInOrder() {
+    return this.log.entriesInOrder().filter((e) => e.status.type === "unsent");
+  }
+  /** T3: the log entry for `requestId` (or `undefined`). Lets `client.ts` read an outbox entry's
+   *  recorded `(clientId, seq)` for dequeue-on-success BEFORE a settling event removes it from the
+   *  log. Read-only — all mutation still flows through the events below. */
+  getEntry(requestId) {
+    return this.log.get(requestId);
+  }
+  /**
+   * The drop-on-verdict-after-baseline rule (T3, verdict §(d) "Reload and rendering — the fork,
+   * decided"). A CROSS-SESSION entry whose recorded verdict is `applied` (learned via the `Connect`
+   * handshake's `ConnectAck` or a drain replay-ack) drops its optimistic layer once the reconnect
+   * baseline Transition has been ADOPTED. Sound because the entry's commit necessarily predates
+   * this session's `Connect`, hence predates the baseline's read snapshot — so the baseline already
+   * renders the effect; removing the (registry-rebuilt, T5) layer in the SAME one-pass `rebuild()`
+   * is flicker-free (the authoritative rows are already in the base, so the composed view never
+   * blinks the row away). The rule is deliberately **layer-agnostic**: the entry may hold no layer
+   * at all — a parked entry (its `update` was cleared at close), a plain non-optimistic mutation,
+   * or (until T5 ships the registry) any hydrated entry — in which case this is a clean removal.
+   *
+   * The CALLER (`client.ts`) is responsible for gating the call on baseline adoption; this method
+   * assumes that gate has already passed. `versionCoversCommit` (the same-session gate predicate)
+   * is intentionally untouched — same-session entries still drop on observed inclusion, never here.
+   */
+  onVerdictAfterBaseline(requestId) {
+    if (!this.log.get(requestId)) return;
+    this.log.delete(requestId);
+    this.clearTimer(requestId);
+    this.rebuild();
+  }
+  /**
+   * T5: add a HYDRATED (cross-reload) durable entry to the log — `client.ts#addHydratedEntry`'s
+   * counterpart to `initiate()` for a live call-site mutation. `entry.update` may already be set
+   * (a registry hit — `client.ts` looks it up BEFORE calling this). Unlike `initiate()`, where the
+   * OWN entry's throw is rethrown synchronously to the `mutation()` caller, a REGISTERED updater
+   * that throws here is ordinary replay-drop collateral — warned and dropped via the normal
+   * `rebuild()` path, never rethrown (there is no synchronous caller on the hydrate path to
+   * propagate to; the entry still drains fine, only its rendering is lost). An entry with no
+   * `update` (no registry hit, or the registry simply wasn't configured) is added without a
+   * recompose pass at all — a plain layerless entry, exactly T4's pre-registry behavior.
+   */
+  addHydrated(entry) {
+    this.log.add(entry);
+    if (entry.update) this.rebuild();
+  }
+  invokeUpdate = (entry, view) => {
+    const store = createOptimisticLocalStore(view, entry.seed);
+    entry.update(store, jsonToConvex3(entry.args));
+  };
+  /** Rebuild composed values; drop + warn any entry whose updater threw during replay.
+   *  `forceNotify` (subscription resume) forwards straight to `store.recompose` — see its doc. */
+  rebuild(forceNotify) {
+    const dropped = this.store.recompose(this.log.entriesInOrder(), this.invokeUpdate, forceNotify);
+    for (const d of dropped) {
+      const path = this.log.get(d.requestId)?.udfPath ?? d.requestId;
+      this.log.delete(d.requestId);
+      this.clearTimer(d.requestId);
+      console.warn(`[helipod] optimistic update for "${path}" threw during replay; dropping its pending layer`, d.error);
+    }
+  }
+  /**
+   * Event 1 — mutation initiation. Add the entry, replay all surviving updates over the current
+   * base. If THIS entry's updater throws, it is removed and the error rethrown **synchronously** so
+   * the caller sends nothing (a prior entry throwing is contained + warned, not rethrown).
+   */
+  initiate(entry) {
+    this.log.add(entry);
+    if (!entry.update) return;
+    const dropped = this.store.recompose(this.log.entriesInOrder(), this.invokeUpdate);
+    let ownError;
+    for (const d of dropped) {
+      this.log.delete(d.requestId);
+      this.clearTimer(d.requestId);
+      if (d.requestId === entry.requestId) {
+        ownError = { error: d.error };
+      } else {
+        const path = this.log.get(d.requestId)?.udfPath ?? d.requestId;
+        console.warn(`[helipod] optimistic update for "${path}" threw during replay; dropping its pending layer`, d.error);
+      }
+    }
+    if (ownError) throw ownError.error;
+  }
+  /**
+   * Event 2 — a contiguous (or resync-adopted) Transition, applied as ONE synchronous pass:
+   * advance the frontier, apply modifications to the base, drop every gated `completed` layer, then
+   * rebuild composed. The frame where a layer disappears is the same frame its authoritative rows
+   * appear — the no-flicker guarantee. An empty (`modifications: []`) ts-advancing Transition (T2)
+   * flows through here with zero special-casing: the loop simply does no base writes.
+   */
+  ingestTransition(modifications, endTs) {
+    this.observedTs = Math.max(this.observedTs, endTs);
+    let unchanged;
+    for (const mod of modifications) {
+      if (mod.type === "QueryUpdated") {
+        const sub = this.store.byId.get(mod.queryId);
+        if (sub) this.store.setServerValue(sub, jsonToConvex3(mod.value), mod.hash);
+      } else if (mod.type === "QueryFailed") {
+        const sub = this.store.byId.get(mod.queryId);
+        if (sub) {
+          this.store.markAnswered(sub);
+          console.error(`[helipod] query "${sub.path}" failed: ${mod.error}`);
+          for (const l of sub.listeners) l.onError?.(mod.error);
+        }
+      } else if (mod.type === "QueryUnchanged") {
+        const sub = this.store.byId.get(mod.queryId);
+        if (sub) {
+          this.store.markUnchanged(sub);
+          (unchanged ??= /* @__PURE__ */ new Set()).add(sub.hash);
+        }
+      } else if (mod.type === "QueryDiff") {
+        const sub = this.store.byId.get(mod.queryId);
+        if (sub) {
+          if (mod.reset === void 0 && sub.renderMode === void 0 && sub.answered) {
+            console.error(`[helipod] query "${sub.path}" incremental diff arrived with no established render mode; resyncing`);
+            sub.lastHash = void 0;
+            this.onDrift?.(mod.queryId);
+          } else {
+            const { drift } = this.store.applyDiff(sub, mod.changes, mod.checksum, mod.reset);
+            sub.lastHash = mod.reset !== void 0 ? mod.hash : void 0;
+            if (drift) {
+              console.error(`[helipod] query "${sub.path}" diff checksum mismatch; resyncing`);
+              this.onDrift?.(mod.queryId);
+            }
+          }
+        }
+      }
+    }
+    for (const entry of this.log.entriesInOrder()) {
+      if (entry.status.type === "completed" && versionCoversCommit(this.observedTs, entry.status.commitTs)) {
+        this.log.delete(entry.requestId);
+        this.clearTimer(entry.requestId);
+      }
+    }
+    this.rebuild(unchanged);
+  }
+  /**
+   * Event 3 — `MutationResponse` success carrying `ts` (W1). The client already resolved the
+   * promise (D3). Here: drop now if there is nothing to protect (no updater / nothing touched), or
+   * the gate is already covered, or `ts` is missing/≤0 (accept one-frame flicker over a wedge —
+   * the server-side `commitTs > 0` assertion makes this unreachable); otherwise hold the layer as
+   * `completed` and arm the gate timer.
+   */
+  onMutationSuccess(requestId, ts) {
+    const entry = this.log.get(requestId);
+    if (!entry) return;
+    if (!entry.update || entry.touched.size === 0) {
+      this.log.delete(requestId);
+      return;
+    }
+    if (ts === void 0 || ts <= 0) {
+      console.warn(`[helipod] mutation "${entry.udfPath}" acked with no usable commitTs (ts=${ts}); dropping its layer now`);
+      this.log.delete(requestId);
+      this.rebuild();
+      return;
+    }
+    if (versionCoversCommit(this.observedTs, ts)) {
+      this.log.delete(requestId);
+      this.rebuild();
+      return;
+    }
+    entry.status = { type: "completed", commitTs: ts, completedAt: Date.now() };
+    this.armGateTimer(requestId);
+  }
+  /** Event 4 — `MutationResponse` failure. The client rejected the promise; drop the layer + rebuild. */
+  onMutationFailure(requestId) {
+    if (!this.log.get(requestId)) return;
+    this.log.delete(requestId);
+    this.clearTimer(requestId);
+    this.rebuild();
+  }
+  /**
+   * Event 6 — transport close (S4). `unsent` retained; `inflight`/`completed` layers drop; the
+   * frontier resets; composed rebuilds over the retained set. Returns the `inflight` ids the client
+   * must reject with `MutationUndeliveredError`. NO layer crosses a session.
+   *
+   * Task 2 extends this with the S4 park swap: when `armed` (a `ConnectAck` has proven server-side
+   * dedup — T3 sets it via `client.ts#setOutboxArmed`) AND an `inflight` entry's durable append has
+   * already committed (`entry.durable`), it PARKS instead of rejecting — its `status` flips to
+   * `"parked"` and its `update` closure is cleared (the layer still drops, via the normal
+   * `rebuild()` below: `recompose` skips any entry with no `update`, the same mechanism a plain
+   * non-optimistic mutation already relies on) but the entry itself STAYS in the log, ready for a
+   * future drain (T4) to resend under its recorded `(clientId, seq)`. Every other `drop`ped id
+   * (rejected-inflight, completed) is still fully removed from the log, exactly as before.
+   */
+  closeSession(armed = false) {
+    const disp = closeDisposition(this.log.entriesInOrder(), { armed });
+    const parkedIds = new Set(disp.park);
+    for (const rid of disp.park) {
+      const entry = this.log.get(rid);
+      if (entry) {
+        entry.status = { type: "parked" };
+        entry.update = void 0;
+      }
+    }
+    for (const rid of disp.drop) {
+      if (parkedIds.has(rid)) continue;
+      this.log.delete(rid);
+      this.clearTimer(rid);
+    }
+    this.observedTs = 0;
+    this.rebuild();
+    return { rejectedInflight: disp.reject, parked: disp.park };
+  }
+  armGateTimer(requestId) {
+    this.clearTimer(requestId);
+    const timer = setTimeout(() => {
+      this.timers.delete(requestId);
+      const entry = this.log.get(requestId);
+      if (!entry || entry.status.type !== "completed") return;
+      console.warn(`[helipod] mutation "${entry.udfPath}" layer not confirmed within ${this.gateTimeoutMs}ms; dropping it`);
+      this.log.delete(requestId);
+      this.rebuild();
+    }, this.gateTimeoutMs);
+    timer.unref?.();
+    this.timers.set(requestId, timer);
+  }
+  clearTimer(requestId) {
+    const timer = this.timers.get(requestId);
+    if (timer !== void 0) {
+      clearTimeout(timer);
+      this.timers.delete(requestId);
+    }
+  }
+};
+
+// src/client.ts
+function isOutboxBroadcastMessage(data) {
+  if (typeof data !== "object" || data === null || !("kind" in data)) return false;
+  const kind = data.kind;
+  return kind === "enqueued" || kind === "settled" || kind === "failed";
+}
+function probeBroadcastChannel(name) {
+  if (typeof BroadcastChannel === "undefined") return void 0;
+  const channel = new BroadcastChannel(name);
+  let closed = false;
+  const wrapper = {
+    // A `postMessage` racing an in-flight write-behind `.then()` against `close()` (e.g. a client
+    // torn down mid-test, or an app unmounting while an append is still resolving) must NEVER throw
+    // out from under `notifyOutboxChange()` — `closed` makes this a harmless no-op instead of the
+    // DOM's `InvalidStateError`.
+    postMessage: (message) => {
+      if (!closed) channel.postMessage(message);
+    },
+    onmessage: null,
+    close: () => {
+      closed = true;
+      channel.close();
+    }
+  };
+  channel.onmessage = (ev) => wrapper.onmessage?.({ data: ev.data });
+  return wrapper;
+}
+var entropyCounter = 0;
+function makeEntropy() {
+  return `${Date.now().toString(36)}-${(entropyCounter++).toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+}
+var HelipodClient = class {
+  transport;
+  version = { ...INITIAL_VERSION };
+  resyncing = false;
+  closed = false;
+  // DLR Stage 3: the observed-ts frontier as of the moment BEFORE the current close. `closeSession`
+  // resets `reconciler.maxObservedTs` to 0 on every transport close (reconcile.ts ~line 320, "the
+  // ts-gate is only sound over one monotone feed") — so on a genuine reconnect, `maxObservedTs` is
+  // already 0 by the time `resync()` runs and echoing it alone would defeat the resume watermark.
+  // Captured in `onTransportClosed()` BEFORE `closeSession()` runs; `resync()` echoes
+  // `Math.max(resumeSinceTs, reconciler.maxObservedTs)` so a real reconnect (observedTs reset to 0)
+  // uses this snapshot, while a same-session drift resync (observedTs intact, no close in between)
+  // uses the live value instead.
+  resumeSinceTs = 0;
+  store = new LayeredQueryStore();
+  reconciler;
+  /** Mutation promise callbacks, keyed by requestId — resolved/rejected here; layers live in the log. */
+  pendingMutationCallbacks = /* @__PURE__ */ new Map();
+  pendingActions = /* @__PURE__ */ new Map();
+  broadcastListeners = /* @__PURE__ */ new Set();
+  disposeTransport;
+  disposeClose;
+  disposeReopen;
+  nextQueryId = 1;
+  nextRequestId = 1;
+  /** The last token passed to `setAuth` (T6: replayed on reconnect). Unset until `setAuth` is
+   *  first called — a transport that never had auth set never sends a spurious `SetAuth` on reopen. */
+  hasSetAuth = false;
+  lastAuthToken = null;
+  /** Absent unless `opts.outbox` is configured — a client constructed without it behaves exactly
+   *  as before this seam existed (`outbox-storage.ts`'s file doc: "never touches this file's
+   *  runtime branches that matter"). */
+  outbox;
+  /** Resolves once this tab-session's clientId is durably persisted (`mintIdentity`,
+   *  `outbox-storage.ts`) — ALWAYS a fresh clientId, never one reused from a prior session. Public
+   *  contract for tests/direct inspection; `mutation()` itself never awaits this (see
+   *  `outboxClientId`/`outboxNextSeq` below — the synchronous counterparts it actually reads). */
+  outboxIdentity;
+  /** This tab-session's clientId, minted SYNCHRONOUSLY at construction (Task 2) — `mutation()` must
+   *  stay fully synchronous (T1's open concern), so it cannot await `outboxIdentity`'s async
+   *  `getMeta`/`setMeta` round-trip. Fed into `mintIdentity` via `opts.mintClientId` below so the
+   *  durable meta row names this SAME id. Set once, iff `opts.outbox` is configured; never reused
+   *  across a reload (a fresh `HelipodClient` always mints again). */
+  outboxClientId;
+  /** In-memory serial `seq` counter for `outboxClientId` (verdict §(d): "seqs minted serially
+   *  in-memory per tab"). Starts at 0 synchronously; `outboxIdentity`'s resolution only ever
+   *  reconciles it UPWARD (never re-hands-out a seq already allocated locally) for the
+   *  astronomically-unlikely colliding-clientId case `mintIdentity` itself guards against. */
+  outboxNextSeq = 0;
+  /** Monotonic per-tab counter for `OutboxEntry.order` — the drain's (T4) FIFO key across the
+   *  WHOLE shared queue (every clientId/tab). Seeded from wall-clock time so multiple tabs sharing
+   *  one outbox interleave in roughly chronological order; strictly increasing per call within
+   *  this tab regardless of clock resolution. Cross-tab total ordering is a best-effort aid to the
+   *  drain's efficiency, NOT a correctness requirement — "locks are efficiency; correctness is the
+   *  records" (verdict §(d) "Drain"). */
+  outboxOrderCounter = 0;
+  /** Cache of `identityFingerprint` (SHA-256 hex of the last `SetAuth` token, or `"anon"` for
+   *  none/empty) — see `setAuth()` below and spec §(k)7. Stamped synchronously onto every entry;
+   *  computed asynchronously (SubtleCrypto) whenever `setAuth` is called with a real token. */
+  outboxFingerprint = "anon";
+  /** When true, a managed `createAuthClient` owns the outbox fingerprint (derived from the stable
+   *  `sessionId`, not the rotating token) — `setAuth`'s token-hash recompute is suppressed so
+   *  rotation never orphans queued offline mutations mid-drain (spec decision 9). The raw
+   *  `setAuth(token)` path (no `createAuthClient`) leaves this false and keeps token-hash
+   *  fingerprinting byte-for-byte unchanged. */
+  sessionFingerprintActive = false;
+  /** The `session:<sessionId>` key whose SHA-256 is the active managed fingerprint — guards a stale
+   *  async digest from overwriting a newer session's fingerprint. */
+  sessionFingerprintKey = null;
+  /** The S4 swap's capability flag (verdict §(d) "S4 swap, feature-detected") — flipped by
+   *  `setOutboxArmed()`, which T3's Connect handshake calls once a `ConnectAck` proves server-side
+   *  receipt dedup exists for this session. Defaults `false`: today's fail-fast, byte-for-byte,
+   *  whether or not an outbox is configured. */
+  outboxArmed = false;
+  outboxMaxQueueSize;
+  /** The last `ConnectAck.deploymentId` seen — the same-timeline proof stamp (verdict §(g) hazard
+   *  15's client half). Surfaced via `getOutboxDeploymentId()`; also written into the durable meta
+   *  row so a future reload can compare timelines. Undefined until the first `ConnectAck`. */
+  outboxDeploymentId;
+  /** App callback fired once whenever a `ConnectAck{known: false}` resets this client's identity
+   *  (verdict §(d) Retention). Optional constructor config. */
+  onClientResetCallback;
+  /** True while the Connect handshake is waiting for the first post-`Connect` baseline Transition
+   *  to be ADOPTED through S3 (verdict §(d) / spec decision 5 — "a NEW await"). While true, the
+   *  drop rule for `applied` cross-session entries is DEFERRED (queued in `outboxPendingDrops`) and
+   *  `whenBaselineAdopted()` (T4's drain gate) stays pending. */
+  outboxAwaitingBaseline = false;
+  /** requestIds whose `applied`-verdict layer drop is deferred until the baseline is adopted (so the
+   *  drop is flicker-free — the baseline already renders the effect). Drained by `markBaselineAdopted`. */
+  outboxPendingDrops = [];
+  /** Resolvers for in-flight `whenBaselineAdopted()` promises — settled together when the baseline
+   *  Transition adopts (or immediately, when a reopen had no live subscriptions to re-baseline). */
+  outboxBaselineResolvers = [];
+  /** Whether a `Connect` handshake has already gone out on the CURRENT connection (reset at close).
+   *  Guards against a double-handshake when both the reopen path and the drain's first-connect path
+   *  could fire — the drain's `ensureInitialHandshake()` is a no-op once a reopen already sent one. */
+  outboxConnectSent = false;
+  /** DLR Stage 2a — whether this connection has advertised `supportsQueryDiff` (reset at close). A
+   *  non-outbox client has no resume `Connect` to piggyback the capability on (an outbox client's
+   *  `buildConnectMessage` carries it), so it sends a minimal capability-only `Connect` before its
+   *  first subscribe. Without this the server never records the capability and every by-id sub falls
+   *  back to RERUN — correct, but the diff path never engages. */
+  diffCapabilitySent = false;
+  /** The drain (Task 4) — the Web Locks leader that turns the durable queue into exactly-once server
+   *  effects. Present iff `opts.outbox` is configured; started at construction. */
+  outboxDrain;
+  /* -------------------------------------------------------------------------------------------
+   * T5 — the `optimisticUpdates` registry, R9 observability.
+   * ------------------------------------------------------------------------------------------- */
+  /** T5: the registry `mutation()` NEVER consults — only `addHydratedEntry` does, at hydrate time
+   *  (verdict §(d): "call-site closure wins for the live call; the registry is consulted only at
+   *  hydrate"). Plain string-keyed: a generated `UdfPathOf<Api>` union (`@helipod/codegen`) narrows
+   *  the caller's OWN object-literal keys; this package never imports that generated type. */
+  optimisticUpdates;
+  /** udfPaths already warned for a registry miss at hydrate — "one warn per udfPath" (spec §(k)6),
+   *  not once per missed ENTRY (a stale backlog of the same unregistered udfPath warns exactly once). */
+  optimisticUpdateMissWarned = /* @__PURE__ */ new Set();
+  /** T5 (R9): fired for a terminal durable failure with no live promise awaiter THIS session (a
+   *  hydrated/retried entry, or one discovered already-failed at construction — "resume"). Never
+   *  fired for a failure a live `mutation()` caller's own rejected promise already delivered
+   *  (Lunora's `hadAwaiter` — no double notification for one failure). */
+  onMutationFailedCallback;
+  /** T5 (R9): same-instance listeners for "the durable outbox changed" — `usePendingMutations()`'s
+   *  re-read trigger. Fired locally on every outbox-mutating op AND on an incoming cross-tab
+   *  `outboxBroadcast` message (unified into one path — a listener never needs to know which). */
+  outboxChangeListeners = /* @__PURE__ */ new Set();
+  /** T5 (R9): the cross-tab nudge — `undefined` when no outbox is configured or the probe/injected
+   *  option resolved to nothing (single-tab observability still works via `outboxChangeListeners`). */
+  outboxBroadcast;
+  /** T-crosstab: serializes `mirrorFromStore()` — a second call arriving while one is already
+   *  in-flight (a rapid burst of `enqueued` broadcasts) sets this bit instead of racing a second
+   *  `loadAll()`; the in-flight run loops once more on completion so the caller's freshest read is
+   *  never dropped. */
+  mirrorInFlight = false;
+  mirrorRerun = false;
+  constructor(transport, opts = {}) {
+    this.transport = transport;
+    this.reconciler = new Reconciler(this.store, { gateTimeoutMs: opts.gateTimeoutMs, onDrift: () => this.resync() });
+    this.outbox = opts.outbox;
+    this.onClientResetCallback = opts.onClientReset;
+    this.outboxMaxQueueSize = opts.outboxMaxQueueSize ?? DEFAULT_OUTBOX_MAX_QUEUE_SIZE;
+    this.optimisticUpdates = opts.optimisticUpdates ?? {};
+    this.onMutationFailedCallback = opts.onMutationFailed;
+    if (opts.outbox) {
+      this.outboxClientId = defaultMintClientId();
+      this.outboxIdentity = mintIdentity(opts.outbox, { mintClientId: () => this.outboxClientId }).then((id) => {
+        this.outboxNextSeq = Math.max(this.outboxNextSeq, id.nextSeq);
+        return id;
+      });
+      this.outboxIdentity.catch((err) => this.handleOutboxWriteError("mintIdentity", this.outboxClientId, void 0, void 0, err));
+      this.outboxDrain = new OutboxDrain(this.makeDrainHost(), {
+        lockName: `helipod:outbox:${this.originTag()}:${opts.outboxDeployment ?? "default"}`,
+        locks: opts.outboxLocks,
+        poisonPolicy: opts.poisonPolicy,
+        chunkSize: opts.outboxChunkSize,
+        intervalMs: opts.outboxDrainIntervalMs,
+        backoffMs: opts.outboxBackoffMs,
+        onPause: opts.onOutboxPause
+      });
+      this.outboxBroadcast = opts.outboxBroadcast === null ? void 0 : opts.outboxBroadcast ?? probeBroadcastChannel(`helipod:outbox:${this.originTag()}:${opts.outboxDeployment ?? "default"}:pending`);
+      if (this.outboxBroadcast) {
+        this.outboxBroadcast.onmessage = (event) => {
+          for (const l of this.outboxChangeListeners) l();
+          try {
+            this.handleOutboxBroadcastMessage(event.data);
+          } catch (err) {
+            if (isDevMode()) console.error("[helipod] outbox: error handling a cross-tab broadcast message", err);
+          }
+        };
+      }
+      void this.refireDurableFailures();
+      void this.mirrorFromStore().catch((err) => this.handleOutboxWriteError("mirrorFromStore", void 0, void 0, void 0, err));
+    }
+    this.disposeTransport = transport.onMessage((msg) => this.onServerMessage(msg));
+    this.disposeClose = transport.onClose(() => this.onTransportClosed());
+    this.disposeReopen = transport.onReopen?.(() => this.onTransportReopened());
+    this.outboxDrain?.start();
+  }
+  /** The origin component of the drain's Web Locks name — `location.origin` in a browser, a stable
+   *  fallback elsewhere (Node/SSR share one origin; correctness is the records, not the lock). */
+  originTag() {
+    const loc = globalThis.location;
+    return loc?.origin ?? "app";
+  }
+  /** @internal This tab-session's durable outbox identity, or `undefined` when no `outbox` was
+   *  configured. Exposed for direct testing of the identity-mint behavior; `mutation()` itself
+   *  reads the synchronous `outboxClientId`/`outboxNextSeq` counterparts, never this promise
+   *  (see the field doc above `outboxClientId`). */
+  getOutboxIdentity() {
+    return this.outboxIdentity;
+  }
+  /** @internal T3's Connect handshake calls this once a `ConnectAck` proves server-side receipt
+   *  dedup exists for this session — see verdict §(d) "S4 swap, feature-detected". Before that (no
+   *  outbox configured, a fresh/pre-handshake session, or an old server that never sends
+   *  `ConnectAck`), `close()` behaves exactly as it always has: today's fail-fast, byte-for-byte. */
+  setOutboxArmed(armed) {
+    this.outboxArmed = armed;
+  }
+  subscribe(ref, args = {}, onUpdate, onError) {
+    const path = getFunctionPath(ref);
+    const argsJson = convexToJson2(args);
+    const hash = queryHash(path, argsJson);
+    let sub = this.store.byHash.get(hash);
+    if (!sub) {
+      const queryId = this.nextQueryId++;
+      sub = this.store.create(queryId, path, argsJson, hash);
+      this.maybeSendDiffCapability();
+      this.transport.send({ type: "ModifyQuerySet", add: [{ queryId, udfPath: path, args: argsJson }], remove: [] });
+    }
+    const listener = { onUpdate, onError };
+    sub.listeners.add(listener);
+    if (sub.composedValue !== void 0) onUpdate(sub.composedValue);
+    return () => {
+      const s = this.store.byHash.get(hash);
+      if (!s) return;
+      s.listeners.delete(listener);
+      if (s.listeners.size === 0) {
+        this.transport.send({ type: "ModifyQuerySet", add: [], remove: [s.queryId] });
+        this.store.remove(hash);
+      }
+    };
+  }
+  query(ref, args = {}) {
+    return new Promise((resolve, reject) => {
+      const unsubscribe = this.subscribe(
+        ref,
+        args,
+        (value) => {
+          resolve(value);
+          queueMicrotask(() => unsubscribe());
+        },
+        (error) => {
+          reject(new Error(error));
+          queueMicrotask(() => unsubscribe());
+        }
+      );
+    });
+  }
+  mutation(ref, args = {}, opts = {}) {
+    const path = getFunctionPath(ref);
+    const argsJson = convexToJson2(args);
+    const useOutbox = this.outbox !== void 0 && opts.transient !== true;
+    if (useOutbox && this.outboxQueueDepth() >= this.outboxMaxQueueSize) {
+      return Promise.reject(new OutboxOverflowError());
+    }
+    const requestId = String(this.nextRequestId++);
+    const entry = {
+      requestId,
+      udfPath: path,
+      args: argsJson,
+      update: opts.optimisticUpdate,
+      seed: { entropy: makeEntropy(), now: Date.now() },
+      touched: /* @__PURE__ */ new Set(),
+      status: { type: "unsent" }
+    };
+    if (useOutbox) {
+      entry.clientId = this.outboxClientId;
+      entry.seq = this.outboxNextSeq++;
+      entry.order = this.nextOutboxOrder();
+      entry.identityFingerprint = this.outboxFingerprint;
+      entry.enqueuedAt = Date.now();
+    }
+    const queueBusy = useOutbox && this.hasOutboxBacklog();
+    this.reconciler.initiate(entry);
+    return new Promise((resolve, reject) => {
+      this.pendingMutationCallbacks.set(requestId, { resolve, reject });
+      if (this.closed || queueBusy) {
+        entry.status = { type: "unsent" };
+      } else {
+        entry.status = { type: "inflight" };
+        this.transport.send(this.mutationMessage(entry));
+      }
+      if (useOutbox) {
+        void this.outbox.append(this.toOutboxEntry(entry)).then(() => {
+          entry.durable = true;
+          this.outboxDrain?.nudge();
+          this.notifyOutboxChange();
+        }).catch((err) => this.handleOutboxWriteError("append", entry.clientId, entry.seq, entry.udfPath, err));
+      }
+    });
+  }
+  /** The wire `Mutation` message for `entry` — carries `(clientId, seq)` whenever an outbox is
+   *  configured (park-safety, verdict §(d)), and OMITS the fields entirely (not merely `undefined`)
+   *  when it isn't, so a client with no `outbox` sends exactly today's shape, byte-for-byte. */
+  mutationMessage(entry) {
+    return {
+      type: "Mutation",
+      requestId: entry.requestId,
+      udfPath: entry.udfPath,
+      args: entry.args,
+      ...entry.clientId !== void 0 ? { clientId: entry.clientId, seq: entry.seq } : {}
+    };
+  }
+  /** The persisted `OutboxStorage` twin of `entry` — only ever called when `this.outbox` (and thus
+   *  `entry.clientId`/`seq`/`order`/`enqueuedAt`) is set. */
+  toOutboxEntry(entry) {
+    return {
+      clientId: entry.clientId,
+      seq: entry.seq,
+      requestId: entry.requestId,
+      udfPath: entry.udfPath,
+      args: entry.args,
+      seed: entry.seed,
+      order: entry.order,
+      status: entry.status.type === "unsent" ? "unsent" : "inflight",
+      identityFingerprint: entry.identityFingerprint,
+      outboxVersion: OUTBOX_VERSION,
+      enqueuedAt: entry.enqueuedAt
+    };
+  }
+  /** True while any OTHER entry is `unsent` (queued for a flush) or `parked` (queued for a future
+   *  drain) — the FIFO-preserving gate a new mutation enqueues behind (verdict §(d) "Enqueue").
+   *  A drain chunk in flight also counts (its units are `inflight`, which the scan alone would miss
+   *  when the chunk consumed the whole backlog) — otherwise a mutation issued mid-chunk would
+   *  direct-send AHEAD of a still-unsettled older unit, breaking the FIFO promise if the chunk
+   *  transient-stops and re-sends. Plain live in-flight direct-sends deliberately do NOT count:
+   *  "when empty, live sends go direct and concurrent" (T2's scoping, unchanged). */
+  hasOutboxBacklog() {
+    if (this.outboxDrain?.hasActiveChunk) return true;
+    for (const e of this.reconciler.entries()) {
+      if (e.status.type === "unsent" || e.status.type === "parked") return true;
+    }
+    return false;
+  }
+  /** Count of outbox-tracked entries not yet fully settled (excludes `completed` — already acked,
+   *  held only for the ts-gate) — the overflow cap's occupancy (verdict §(d) "Enqueue": "bounded,
+   *  default 1000"). */
+  outboxQueueDepth() {
+    let n = 0;
+    for (const e of this.reconciler.entries()) {
+      if (e.clientId !== void 0 && e.status.type !== "completed") n++;
+    }
+    return n;
+  }
+  /** Monotonic `OutboxEntry.order` allocator — see the `outboxOrderCounter` field doc. */
+  nextOutboxOrder() {
+    const now = Date.now();
+    this.outboxOrderCounter = this.outboxOrderCounter >= now ? this.outboxOrderCounter + 1 : now;
+    return this.outboxOrderCounter;
+  }
+  action(ref, args = {}) {
+    const requestId = String(this.nextRequestId++);
+    return new Promise((resolve, reject) => {
+      this.pendingActions.set(requestId, { resolve, reject });
+      this.transport.send({ type: "Action", requestId, udfPath: getFunctionPath(ref), args: convexToJson2(args) });
+    });
+  }
+  /** Set (or clear) the session identity for this connection; the server re-runs subscriptions under it. */
+  setAuth(token) {
+    this.hasSetAuth = true;
+    this.lastAuthToken = token;
+    this.transport.send({ type: "SetAuth", token });
+    if (this.outbox && !this.sessionFingerprintActive) {
+      if (!token) {
+        this.outboxFingerprint = "anon";
+      } else {
+        const forToken = token;
+        void sha256Hex(forToken).then((hex) => {
+          if (this.lastAuthToken === forToken) this.outboxFingerprint = hex;
+        });
+      }
+    }
+  }
+  /** Managed-session fingerprinting (spec decision 9): a `createAuthClient` calls this so the durable
+   *  outbox's `identityFingerprint` derives from the STABLE `sessionId`, not the rotating access
+   *  token — otherwise a rotation mid-drain would orphan queued offline mutations under a new
+   *  fingerprint. Pass `null` to hand the fingerprint back to the raw `setAuth` token-hash path
+   *  (e.g. on sign-out). No-op when no outbox is configured. */
+  setSessionFingerprint(sessionId) {
+    this.sessionFingerprintActive = sessionId !== null;
+    if (sessionId === null) {
+      this.sessionFingerprintKey = null;
+      if (this.outbox) {
+        const token = this.lastAuthToken;
+        if (!token) this.outboxFingerprint = "anon";
+        else void sha256Hex(token).then((hex) => {
+          if (this.lastAuthToken === token && !this.sessionFingerprintActive) this.outboxFingerprint = hex;
+        });
+      }
+      return;
+    }
+    if (!this.outbox) return;
+    const key = sessionFingerprintKey(sessionId);
+    this.sessionFingerprintKey = key;
+    void sha256Hex(key).then((hex) => {
+      if (this.sessionFingerprintKey === key) this.outboxFingerprint = hex;
+    });
+  }
+  /** Publish an ephemeral event (presence/typing) — bypasses the engine. */
+  publishEphemeral(topic, event) {
+    this.transport.send({ type: "EphemeralPublish", topic, event: convexToJson2(event) });
+  }
+  /** Listen for ephemeral broadcasts (presence/typing) from other clients. */
+  onBroadcast(listener) {
+    this.broadcastListeners.add(listener);
+    return () => this.broadcastListeners.delete(listener);
+  }
+  close() {
+    this.outboxDrain?.stop();
+    this.outboxBroadcast?.close();
+    this.disposeTransport();
+    this.disposeClose();
+    this.disposeReopen?.();
+    this.transport.close();
+    this.onTransportClosed();
+  }
+  /** @internal test/debug only — the observed-inclusion frontier (resets to 0 at close). */
+  get __maxObservedTs() {
+    return this.reconciler.maxObservedTs;
+  }
+  /** @internal test/debug only — the live pending-mutation log, in requestId order. */
+  get __pending() {
+    return this.reconciler.entries();
+  }
+  /** @internal test/debug only — the current `identityFingerprint` cache (see `setAuth`); polling
+   *  this (rather than calling `mutation()` repeatedly, which consumes seqs) is how a test waits
+   *  out the async SHA-256 digest without depending on a fixed tick count. */
+  get __outboxFingerprint() {
+    return this.outboxFingerprint;
+  }
+  onServerMessage(msg) {
+    switch (msg.type) {
+      case "Transition": {
+        if (this.resyncing) {
+          this.reconciler.ingestTransition(msg.modifications, msg.endVersion.ts);
+          this.version = msg.endVersion;
+          this.resyncing = false;
+          if (this.outboxAwaitingBaseline) this.markBaselineAdopted();
+          return;
+        }
+        if (!versionsEqual(msg.startVersion, this.version)) {
+          this.resync();
+          return;
+        }
+        this.reconciler.ingestTransition(msg.modifications, msg.endVersion.ts);
+        this.version = msg.endVersion;
+        if (this.outboxAwaitingBaseline) this.markBaselineAdopted();
+        return;
+      }
+      case "MutationResponse": {
+        if (this.outboxDrain?.handles(msg.requestId)) {
+          this.outboxDrain.onResponse(msg);
+          return;
+        }
+        const entry = this.reconciler.getEntry(msg.requestId);
+        const pending = this.pendingMutationCallbacks.get(msg.requestId);
+        const hadAwaiter = pending !== void 0;
+        this.pendingMutationCallbacks.delete(msg.requestId);
+        if (msg.success) {
+          pending?.resolve(jsonToConvex4(msg.value ?? null));
+          this.reconciler.onMutationSuccess(msg.requestId, msg.ts);
+          this.dequeueOutboxEntry(entry);
+        } else {
+          pending?.reject(this.mutationError(msg.error, msg.code));
+          this.reconciler.onMutationFailure(msg.requestId);
+          if (entry?.clientId !== void 0 && entry.seq !== void 0) {
+            this.outboxMarkFailed(entry.clientId, entry.seq, msg.error, msg.code);
+          }
+          if (!hadAwaiter) this.notifyMutationFailed(entry?.clientId, entry?.seq, entry?.udfPath ?? "unknown", { message: msg.error, code: msg.code });
+        }
+        return;
+      }
+      case "ConnectAck":
+        this.handleConnectAck(msg);
+        return;
+      case "ActionResponse": {
+        const pending = this.pendingActions.get(msg.requestId);
+        if (pending) {
+          this.pendingActions.delete(msg.requestId);
+          if (msg.success) pending.resolve(jsonToConvex4(msg.value));
+          else pending.reject(new Error(msg.error));
+        }
+        return;
+      }
+      case "Broadcast": {
+        const event = jsonToConvex4(msg.event);
+        for (const listener of this.broadcastListeners) listener(msg.topic, event);
+        return;
+      }
+      default:
+        return;
+    }
+  }
+  /** A frame was missed: reset and re-subscribe all live queries; adopt the server's next state. */
+  resync() {
+    this.resyncing = true;
+    this.version = { ...INITIAL_VERSION };
+    const subs = [...this.store.byId.values()];
+    if (subs.length === 0) {
+      this.resyncing = false;
+      return;
+    }
+    this.transport.send({
+      type: "ModifyQuerySet",
+      // `resultHash` (subscription resume): echoed ONLY for a sub that was actually delivered a
+      // base value and still has its fingerprint on hand — a failed sub (`serverValue` never set),
+      // a never-answered sub, or one whose last `QueryUpdated` had no `hash` (old server) echoes
+      // nothing, falling through to today's full-send byte-for-byte. Note this condition doesn't
+      // check "currently failed" — a sub that failed AFTER a prior success still has a retained
+      // `serverValue`/`lastHash` from that success and still echoes it here. That's sound: the
+      // server only replies `QueryUnchanged` if the FRESH re-run (against live, current state)
+      // hashes equal to the echoed base — i.e. the query has recovered back to that exact value —
+      // in which case `QueryUnchanged` renders exactly what a full `QueryUpdated` send would have
+      // delivered. Any other outcome (still failing, or recovered to a different value) arrives as
+      // a normal `QueryFailed`/`QueryUpdated` modification, not `QueryUnchanged`.
+      add: subs.map((s) => ({
+        queryId: s.queryId,
+        udfPath: s.path,
+        args: s.args,
+        ...s.answered && s.serverValue !== void 0 && s.lastHash !== void 0 ? { resultHash: s.lastHash } : {},
+        // DLR Stage 3: echo the client's observed-inclusion frontier so the server can skip the
+        // re-run entirely when nothing touched this query's read-set since. Fresh `subscribe()`
+        // never sets this — only a resume resubscribe has a meaningful watermark to echo. `Math.max`
+        // with `resumeSinceTs` (the pre-close snapshot) covers both resume paths: a real transport
+        // close resets `reconciler.maxObservedTs` to 0 (see `resumeSinceTs`'s own comment), so the
+        // snapshot wins there; a same-session drift resync never closed, so `maxObservedTs` is still
+        // live and wins instead.
+        sinceTs: Math.max(this.resumeSinceTs, this.reconciler.maxObservedTs)
+      })),
+      remove: []
+    });
+  }
+  onTransportClosed() {
+    this.closed = true;
+    this.outboxConnectSent = false;
+    this.diffCapabilitySent = false;
+    this.outboxDrain?.onTransportClosed();
+    this.resumeSinceTs = this.reconciler.maxObservedTs;
+    const { rejectedInflight, parked } = this.reconciler.closeSession(this.outboxArmed);
+    for (const rid of rejectedInflight) {
+      const pending = this.pendingMutationCallbacks.get(rid);
+      this.pendingMutationCallbacks.delete(rid);
+      pending?.reject(new MutationUndeliveredError());
+    }
+    for (const rid of parked) {
+      const entry = this.reconciler.getEntry(rid);
+      if (entry?.clientId !== void 0 && entry.seq !== void 0) this.outboxUpdateStatus(entry.clientId, entry.seq, "parked");
+    }
+    for (const [, pending] of this.pendingActions) pending.reject(new Error("connection closed"));
+    this.pendingActions.clear();
+  }
+  /**
+   * T6: the transport reconnected (a fresh session — the server has no state for it). Order is
+   * load-bearing (verdict §(c) event 6): `SetAuth` replay first (the server re-runs subscriptions
+   * under the right identity), THEN resubscribe every live query (the existing resync path — it
+   * adopts the reply as a fresh baseline regardless of its start version), THEN flush every
+   * `unsent` mutation FIFO — each transitions `unsent` -> `inflight` reusing its ORIGINAL
+   * `requestId` (never re-minted), so the promise created at `mutation()` call time stays the one
+   * that resolves when the new session's `MutationResponse` arrives.
+   */
+  onTransportReopened() {
+    this.closed = false;
+    if (this.hasSetAuth) this.transport.send({ type: "SetAuth", token: this.lastAuthToken });
+    this.maybeSendDiffCapability();
+    this.resync();
+    if (this.outbox) {
+      this.initiateHandshake(this.resyncing);
+      this.outboxDrain?.nudge();
+      return;
+    }
+    for (const entry of this.reconciler.unsentInOrder()) {
+      entry.status = { type: "inflight" };
+      this.transport.send(this.mutationMessage(entry));
+    }
+  }
+  /** Send the `Connect` resume handshake once per connection (idempotent via `outboxConnectSent`),
+   *  arming the baseline await. Shared by the reopen path and the drain's first-connect path (Task 4
+   *  / T3 handoff #1: a fresh-client-first-connect after reload has no reopen event, so the drain
+   *  triggers the same handshake on becoming leader with a durable backlog). */
+  initiateHandshake(expectTransition) {
+    if (this.outboxConnectSent || this.closed || !this.outbox) return;
+    this.outboxConnectSent = true;
+    this.beginBaselineAwait(expectTransition);
+    this.sendConnect();
+  }
+  /** True iff at least one live subscription has NOT yet received its first server reply
+   *  (`!sub.answered` — set by `ingestTransition` on EITHER outcome, `QueryUpdated` or `QueryFailed`).
+   *  The drain's first-connect `ensureInitialHandshake` gate (T4 bug fix, later widened to cover the
+   *  failed-query shape too — re-review FIX 2): a subscription created (and answered) BEFORE the
+   *  drain's async hydrate finishes has already consumed its one-shot Transition by the time the
+   *  handshake arms — waiting for ANOTHER one that will never come on a quiet deployment would starve
+   *  `whenBaselineAdopted()` (and so the drain) forever. Only a subscription still awaiting its first
+   *  reply guarantees a future Transition is actually coming — that's the one worth waiting for.
+   *  (Deliberately NOT `sub.serverValue === undefined`: a `QueryFailed` reply never sets `serverValue`
+   *  — there's no base to render — so that check misclassified an already-answered failed query as
+   *  still-undelivered and reproduced the same deadlock via the failed-query path.) */
+  hasUndeliveredSubscription() {
+    for (const sub of this.store.byId.values()) {
+      if (!sub.answered) return true;
+    }
+    return false;
+  }
+  /* ---------------------------------------------------------------------------------------------
+   * T3 — the Connect resume handshake, verdict settlement, the baseline-gated drop rule, and reset.
+   * ------------------------------------------------------------------------------------------- */
+  /** @internal T4's drain gate. Resolves once the first post-`Connect` baseline Transition has been
+   *  adopted through S3 (verdict §(d) / spec decision 5). Resolves immediately when no handshake is
+   *  in flight (nothing to await) or when a reopen had no live subscriptions to re-baseline. */
+  whenBaselineAdopted() {
+    if (!this.outboxAwaitingBaseline) return Promise.resolve();
+    return new Promise((resolve) => this.outboxBaselineResolvers.push(resolve));
+  }
+  /** @internal test/debug — the last `ConnectAck.deploymentId` (the same-timeline proof stamp), or
+   *  `undefined` before any handshake completed. */
+  getOutboxDeploymentId() {
+    return this.outboxDeploymentId;
+  }
+  /** @internal test/debug — whether the S4 park swap is armed (a `ConnectAck` has proven dedup). */
+  get __outboxArmed() {
+    return this.outboxArmed;
+  }
+  /** Begin awaiting the post-`Connect` baseline. `expectTransition` is true iff a baseline Transition
+   *  is actually coming — for a reopen, `this.resyncing` (set iff `resync()` re-subscribed live
+   *  queries); for a first connect, whether any live subscription is still awaiting its first
+   *  delivery (`hasUndeliveredSubscription()` — NOT merely whether one exists: a subscription
+   *  created and already answered before the handshake armed has nothing left to wait for). With
+   *  nothing pending, there is no baseline frame coming and adoption is immediate. */
+  beginBaselineAwait(expectTransition) {
+    this.outboxAwaitingBaseline = expectTransition;
+    if (!expectTransition) this.markBaselineAdopted();
+  }
+  /** The baseline Transition adopted (or there was none to await): fire every deferred `applied`
+   *  layer drop (each flicker-free now — the baseline renders the effect), release the drain gate,
+   *  and wake the drain (reconnect-after-baseline). */
+  markBaselineAdopted() {
+    this.outboxAwaitingBaseline = false;
+    for (const rid of this.outboxPendingDrops.splice(0)) this.reconciler.onVerdictAfterBaseline(rid);
+    const resolvers = this.outboxBaselineResolvers.splice(0);
+    for (const resolve of resolvers) resolve();
+    this.outboxDrain?.nudge();
+  }
+  /** Send the `Connect` resume handshake: this tab-session's clientId, the `held` durable entries
+   *  (every not-yet-settled `(clientId, seq)` in the log — the server classifies each into
+   *  `ConnectAck.results`), and `ackedThrough` (the contiguous settled-prefix per clientId, for
+   *  server-side retention pruning). Delegates the pure computation to `./connect-handshake` — the
+   *  SAME shared module the headless drain (`headless-drain.ts`) builds its own `Connect` from. */
+  sendConnect() {
+    const held = outboxHeldFromLog(this.reconciler.entries());
+    this.transport.send(buildConnectMessage(makeEntropy(), this.outboxClientId, held));
+  }
+  /** DLR Stage 2a — advertise by-id diff support once per connection for a NON-outbox client (an
+   *  outbox client's resume `Connect` already carries the flag). A capability-only `Connect` (no
+   *  `clientId`/`held`/`ackedThrough`) is the reserved server no-op path — it records the capability
+   *  and sends no `ConnectAck` — so it never interferes with the outbox handshake or backpressure.
+   *  Sent BEFORE the first `ModifyQuerySet` (fresh connect) and before `resync()` (reopen) so the
+   *  server has the capability recorded when it decides a by-id sub's initial answer; the ordered
+   *  transport guarantees delivery order. Even if it somehow arrived late the diff path self-heals
+   *  (a pre-capability RERUN answer, then diffs resume), but sending it first keeps the common path
+   *  on the diff answer from the very first subscribe. */
+  maybeSendDiffCapability() {
+    if (this.outbox || this.diffCapabilitySent || this.closed) return;
+    this.diffCapabilitySent = true;
+    this.transport.send({ type: "Connect", sessionId: makeEntropy(), supportsQueryDiff: true });
+  }
+  /** Process a `ConnectAck` (verdict §(e)): the capability proof arms the S4 park swap; the
+   *  deploymentId is surfaced + persisted; `known: false` triggers `onClientReset`; otherwise each
+   *  classified `held` seq is settled (`applied`/`failed`/`stale` terminal; `unknown` left for the
+   *  drain). */
+  handleConnectAck(msg) {
+    this.outboxArmed = true;
+    this.outboxDeploymentId = msg.deploymentId;
+    if (this.outbox && this.outboxClientId !== void 0) {
+      void this.outbox.setMeta(this.outboxClientId, { nextSeq: this.outboxNextSeq, deployment: msg.deploymentId }).catch((err) => this.handleOutboxWriteError("setMeta", this.outboxClientId, void 0, void 0, err));
+    }
+    if (!msg.known) {
+      void this.onClientReset().then(() => this.outboxDrain?.nudge());
+      return;
+    }
+    for (const v of msg.results) this.settleVerdict(v);
+    this.outboxDrain?.nudge();
+  }
+  /** Settle one classified `held` seq from a `ConnectAck` (or, later, a drain replay-ack). */
+  settleVerdict(v) {
+    const entry = this.findOutboxEntry(v.clientId, v.seq);
+    switch (v.verdict) {
+      case "applied": {
+        const value = v.valueMissing ? null : jsonToConvex4(v.value ?? null);
+        if (entry) this.resolvePending(entry.requestId, value);
+        this.outboxDequeue(v.clientId, v.seq);
+        if (entry) this.dropAfterBaseline(entry.requestId);
+        break;
+      }
+      case "failed": {
+        const hadAwaiter = entry ? this.pendingMutationCallbacks.has(entry.requestId) : false;
+        const message = `mutation "${entry?.udfPath ?? "unknown"}" failed`;
+        if (entry) this.rejectPending(entry.requestId, this.mutationError(message, v.code));
+        this.outboxMarkFailed(v.clientId, v.seq, message, v.code);
+        if (entry) this.reconciler.onMutationFailure(entry.requestId);
+        if (!hadAwaiter) this.notifyMutationFailed(v.clientId, v.seq, entry?.udfPath ?? "unknown", { message, code: v.code });
+        break;
+      }
+      case "stale": {
+        const hadAwaiter = entry ? this.pendingMutationCallbacks.has(entry.requestId) : false;
+        const message = "mutation disowned (STALE_CLIENT)";
+        const code = v.code ?? "STALE_CLIENT";
+        if (entry) this.rejectPending(entry.requestId, this.mutationError(message, code));
+        this.outboxMarkFailed(v.clientId, v.seq, message, code);
+        if (entry) this.reconciler.onMutationFailure(entry.requestId);
+        if (!hadAwaiter) this.notifyMutationFailed(v.clientId, v.seq, entry?.udfPath ?? "unknown", { message, code });
+        break;
+      }
+      case "unknown":
+        break;
+    }
+  }
+  /** `known: false` — the server disowned this client's history (verdict §(d) Retention). Re-mint a
+   *  fresh clientId + meta; re-enqueue every `unsent` entry under the new clientId + NEW seqs (never
+   *  applied, so safe); reject every `parked` entry LOUDLY (in-flight-at-disconnect, no server dedup
+   *  → a blind resend could double-apply); fire the `onClientReset` callback. */
+  async onClientReset() {
+    const oldClientId = this.outboxClientId;
+    const fresh = defaultMintClientId();
+    this.outboxClientId = fresh;
+    this.outboxNextSeq = 0;
+    let parkedRejected = 0;
+    let unsentReEnqueued = 0;
+    for (const entry of [...this.reconciler.entries()]) {
+      const recordedClientId = entry.clientId ?? oldClientId;
+      if (entry.status.type === "parked") {
+        const hadAwaiter = this.pendingMutationCallbacks.has(entry.requestId);
+        const resetMessage = "the server disowned this client's mutation history (swept/foreign timeline)";
+        if (recordedClientId !== void 0 && entry.seq !== void 0) {
+          this.outboxMarkFailed(recordedClientId, entry.seq, resetMessage, "OFFLINE_CLIENT_RESET");
+        }
+        this.rejectPending(entry.requestId, new OfflineClientResetError());
+        this.reconciler.onMutationFailure(entry.requestId);
+        if (!hadAwaiter) this.notifyMutationFailed(recordedClientId, entry.seq, entry.udfPath, { message: resetMessage, code: "OFFLINE_CLIENT_RESET" });
+        parkedRejected++;
+      } else if (entry.status.type === "unsent") {
+        if (recordedClientId !== void 0 && entry.seq !== void 0) this.outboxDequeue(recordedClientId, entry.seq);
+        entry.clientId = fresh;
+        entry.seq = this.outboxNextSeq++;
+        entry.order = this.nextOutboxOrder();
+        this.outboxAppend(entry);
+        unsentReEnqueued++;
+      }
+    }
+    if (this.outbox) {
+      await mintIdentity(this.outbox, { mintClientId: () => fresh, deployment: this.outboxDeploymentId });
+      await this.outbox.setMeta(fresh, { nextSeq: this.outboxNextSeq, deployment: this.outboxDeploymentId });
+    }
+    this.onClientResetCallback?.({ oldClientId, newClientId: fresh, unsentReEnqueued, parkedRejected });
+  }
+  /** The in-memory log entry with this recorded `(clientId, seq)`, or `undefined`. */
+  findOutboxEntry(clientId, seq) {
+    for (const e of this.reconciler.entries()) {
+      if (e.clientId === clientId && e.seq === seq) return e;
+    }
+    return void 0;
+  }
+  /** Resolve a pending mutation promise by requestId (no-op if it already settled / has no awaiter). */
+  resolvePending(requestId, value) {
+    const pending = this.pendingMutationCallbacks.get(requestId);
+    this.pendingMutationCallbacks.delete(requestId);
+    pending?.resolve(value);
+  }
+  /** Reject a pending mutation promise by requestId (no-op if it already settled / has no awaiter). */
+  rejectPending(requestId, error) {
+    const pending = this.pendingMutationCallbacks.get(requestId);
+    this.pendingMutationCallbacks.delete(requestId);
+    pending?.reject(error);
+  }
+  /** Drop an `applied` cross-session entry's layer — deferred until the baseline is adopted (so the
+   *  drop is flicker-free), or immediately if it already has. */
+  dropAfterBaseline(requestId) {
+    if (this.outboxAwaitingBaseline) this.outboxPendingDrops.push(requestId);
+    else this.reconciler.onVerdictAfterBaseline(requestId);
+  }
+  /** Dequeue a settled durable entry from the outbox store (no-op without an outbox / clientId). */
+  dequeueOutboxEntry(entry) {
+    if (entry?.clientId !== void 0 && entry.seq !== void 0) this.outboxDequeue(entry.clientId, entry.seq);
+  }
+  /** An `Error` carrying the server's terminal verdict `code` (STALE_CLIENT, an app error code) so
+   *  the drain's coded-vs-codeless retry policy (T4) and apps can key off it. */
+  mutationError(message, code) {
+    const err = new Error(message);
+    if (code !== void 0) err.code = code;
+    return err;
+  }
+  /* ---------------------------------------------------------------------------------------------
+   * Task 4 — the drain host. These bind the drain's `DrainHost` seam to the client's private state
+   * so the T3 settlement primitives (`resolvePending`/`rejectPending`, `dequeue`, the drop rule) are
+   * REUSED by the drain, not forked (verdict §(d) "Drain").
+   * ------------------------------------------------------------------------------------------- */
+  /** @internal test/debug — the live drain (Task 4), or `undefined` without an outbox. */
+  get __outboxDrain() {
+    return this.outboxDrain;
+  }
+  makeDrainHost() {
+    return {
+      outbox: this.outbox,
+      currentClientId: () => this.outboxClientId,
+      currentFingerprint: () => this.outboxFingerprint,
+      transportOpen: () => !this.closed,
+      isArmed: () => this.outboxArmed,
+      drainable: () => this.drainableEntries(),
+      addHydrated: (entry) => this.addHydratedEntry(entry),
+      ensureInitialHandshake: () => this.initiateHandshake(this.hasUndeliveredSubscription()),
+      setStatus: (entry, status) => {
+        entry.status = { type: status };
+        if (entry.clientId !== void 0 && entry.seq !== void 0) this.outboxUpdateStatus(entry.clientId, entry.seq, status);
+      },
+      batchEntry: (entry) => this.drainBatchEntry(entry),
+      sendBatch: (entries) => this.transport.send({ type: "MutationBatch", entries }),
+      settleApplied: (requestId, value, replayed, ts) => this.drainSettleApplied(requestId, value, replayed, ts),
+      settleTerminal: (requestId, code, message) => this.drainSettleTerminal(requestId, code, message),
+      whenBaselineAdopted: () => this.whenBaselineAdopted()
+    };
+  }
+  /** Drain-eligible entries: durable, recorded `(clientId, seq)`, still `unsent`/`parked`, FIFO by
+   *  the persisted `order`. Excludes `inflight` (a live direct-send or an in-flight chunk unit) and
+   *  `completed`. */
+  drainableEntries() {
+    return this.reconciler.entries().filter(
+      (e) => e.clientId !== void 0 && e.seq !== void 0 && e.durable === true && (e.status.type === "unsent" || e.status.type === "parked")
+    ).sort((a, b) => (a.order ?? 0) - (b.order ?? 0));
+  }
+  /** Add a hydrated durable entry into the log under a FRESH requestId (the persisted requestId was
+   *  session-correlation only; a fresh one avoids colliding with this session's requestId counter).
+   *  Idempotent by `(clientId, seq)` — a direct-send this session already tracks is not re-added.
+   *  T5: `entry.update` is populated from the `optimisticUpdates` registry (hydrate-only lookup — a
+   *  live call-site closure is never in play here, there IS no live call site for a cross-reload
+   *  entry); a registry miss is layerless (no `update` at all), a clean drop under the baseline-gated
+   *  drop rule exactly as T4 shipped it. */
+  addHydratedEntry(e) {
+    if (dropIfNonReplayable(this.outbox, e)) return;
+    for (const existing of this.reconciler.entries()) {
+      if (existing.clientId === e.clientId && existing.seq === e.seq) return;
+    }
+    this.outboxOrderCounter = Math.max(this.outboxOrderCounter, e.order);
+    const entry = {
+      requestId: String(this.nextRequestId++),
+      udfPath: e.udfPath,
+      args: e.args,
+      seed: e.seed,
+      touched: /* @__PURE__ */ new Set(),
+      status: { type: "unsent" },
+      clientId: e.clientId,
+      seq: e.seq,
+      order: e.order,
+      identityFingerprint: e.identityFingerprint,
+      enqueuedAt: e.enqueuedAt,
+      durable: true,
+      update: this.lookupHydratedUpdate(e.udfPath)
+    };
+    this.reconciler.addHydrated(entry);
+  }
+  /** T5: the registry lookup `addHydratedEntry` makes — hydrate-time ONLY (verdict §(d): "the
+   *  registry is consulted at hydrate only"). A miss warns ONCE per udfPath (not per entry — a
+   *  backlog of many unregistered entries for the same udfPath warns once) and returns `undefined`:
+   *  the entry still drains fine, only its optimistic rendering is skipped (spec §(k)6). */
+  lookupHydratedUpdate(udfPath) {
+    const fn = this.optimisticUpdates[udfPath];
+    if (fn) return fn;
+    if (!this.optimisticUpdateMissWarned.has(udfPath)) {
+      this.optimisticUpdateMissWarned.add(udfPath);
+      console.warn(
+        `[helipod] outbox: no optimisticUpdates registered for "${udfPath}" \u2014 a hydrated cross-reload mutation for it will drain without an optimistic layer (rendering only; the mutation itself is unaffected)`
+      );
+    }
+    return void 0;
+  }
+  /* ---------------------------------------------------------------------------------------------
+   * T-crosstab (browser-ux spec Part A) — live cross-tab rendering. Extends the hydrate machinery
+   * above (`addHydratedEntry`/`lookupHydratedUpdate`) with live callers driven by the broadcast
+   * channel, instead of its one construction-time caller (`OutboxDrain#hydrateOnce`).
+   * ------------------------------------------------------------------------------------------- */
+  /** The one predicate distinguishing a MIRRORED entry (another tab-session's durable append, or
+   *  this tab's own past-session hydrate — either way, no live promise) from an entry THIS instance
+   *  itself initiated live (hazard (a), "own-tab discrimination"): durable AND no
+   *  `pendingMutationCallbacks` registered for its `requestId`. A live `mutation()` caller has a
+   *  callback registered only UNTIL its own wire response settles it — resolved/rejected callbacks
+   *  are deleted immediately (`resolvePending`/`rejectPending`), well before a `completed` layer's
+   *  gate gets a chance to drop it. So a live caller's entry looks exactly like a true mirror
+   *  (`isMirroredEntry` returns `true`) for the whole post-ack, still-gated window — this predicate
+   *  alone does NOT distinguish "own tab, post-ack" from "another tab's mirror"; it is the
+   *  `status.type === "completed"` skip in `mirrorFromStore`'s backstop pass that closes that gap
+   *  (a `completed` layer is owned by its gate, never force-settled by this predicate or the store).
+   *  Used both by the dispatch methods below and the doc comment on `mirrorFromStore`'s backstop pass
+   *  — a single documented helper, never inlined twice (brief hazard (a)). */
+  isMirroredEntry(entry) {
+    return entry.durable === true && !this.pendingMutationCallbacks.has(entry.requestId);
+  }
+  /** Handle an incoming (already-fan-out'd) broadcast payload — the typed half of `onmessage`. A
+   *  payload that doesn't match `OutboxBroadcastMessage` (the legacy bare `1`, or anything else) is
+   *  simply not recognized: the accessor nudge already fired in the caller, nothing else happens. */
+  handleOutboxBroadcastMessage(data) {
+    if (!this.outbox || !isOutboxBroadcastMessage(data)) return;
+    if (data.kind === "enqueued") {
+      void this.mirrorFromStore().catch((err) => this.handleOutboxWriteError("mirrorFromStore", void 0, void 0, void 0, err));
+    } else {
+      this.onCrossTabSettle(data);
+    }
+  }
+  /** Re-read the durable store and reconcile this tab's mirrored set against it — the `enqueued`
+   *  broadcast's handler, and the missed-message backstop (spec Part A "Rules"): a mirrored entry
+   *  absent from the fresh snapshot (settled/failed elsewhere, whose OWN targeted broadcast this tab
+   *  never received) drops via the same `dropAfterBaseline` one-pass rule the verdict-after-baseline
+   *  path uses. Serialized on `mirrorInFlight` — a second call arriving mid-read sets `mirrorRerun`
+   *  and is folded into one more pass after the current read finishes, rather than racing a second
+   *  `loadAll()` against it.
+   *
+   *  Only STILL-ACTIVE entries (`unsent`/`inflight`/`parked`) are (re-)hydrated — a `failed` (or a
+   *  stray `completed`) entry is a terminal, accessor-only record (`pendingMutations()` already
+   *  surfaces it) and must never be resurrected as a fresh `unsent` optimistic layer. Without this
+   *  guard, a tab that itself once owned a now-terminally-failed entry would keep reviving its OWN
+   *  dead record on every subsequent `enqueued` broadcast (this store never dequeues a `failed`
+   *  entry — R9 "persists until dismissed/retried") — and, being `durable` with no live callback,
+   *  that revived entry would then match `isMirroredEntry`, making the tab react to an UNRELATED
+   *  later `settled`/`failed` broadcast that merely happens to name the same `(clientId, seq)`.
+   *
+   *  Two review-fixed hazards in the reconcile loop below (both stem from the SAME root cause: the
+   *  store's presence/absence is not always the authority for a mirrored layer's fate):
+   *   - a `completed` mirrored layer (this tab already got a targeted `settled` broadcast and is
+   *     holding it gated until ITS OWN feed observes `commitTs`, per `onCrossTabSettle`) is SKIPPED
+   *     entirely here, never force-dropped merely because the store record is absent. The leader's
+   *     own `drainSettleApplied` dequeues the record right after posting `settled`, and THAT
+   *     dequeue's `{kind:"enqueued"}` follow-up broadcast is exactly what drives this backstop pass —
+   *     so a `completed` entry being store-absent is the ordinary, expected case, not a missed
+   *     message. Force-dropping it here would race ahead of this tab's own gate (a flicker the gate
+   *     exists to prevent) — CRITICAL. The same skip also protects THIS tab's own just-acked live
+   *     mutation: its `pendingMutationCallbacks` entry is deleted the moment its wire response
+   *     settles it (see `isMirroredEntry`'s doc — the callback does NOT survive the whole gated
+   *     window, only until the response arrives), so during that gated window it is
+   *     indistinguishable from a true mirror to `isMirroredEntry` and would otherwise be dropped by a
+   *     totally unrelated tab's `enqueued` broadcast.
+   *   - the "is this mirror still active" check now reads from ACTIVE-status (`unsent`/`inflight`/
+   *     `parked`) entries only, not "any entry present in the store" — a mirror whose backing record
+   *     flipped to `failed` (R9 never dequeues a failure) is present-in-store but no longer active;
+   *     treating presence alone as "still live" would leave a permanent phantom optimistic row behind
+   *     a missed `failed` broadcast. Such an entry is instead settled failed right here (same effect
+   *     as `onCrossTabSettle`'s `failed` branch — mark failed + fire R9), using the terminal verdict
+   *     already recorded on the store row itself. */
+  async mirrorFromStore() {
+    if (!this.outbox) return;
+    if (this.mirrorInFlight) {
+      this.mirrorRerun = true;
+      return;
+    }
+    this.mirrorInFlight = true;
+    try {
+      do {
+        this.mirrorRerun = false;
+        const { entries } = await this.outbox.loadAll();
+        const activeLive = /* @__PURE__ */ new Set();
+        const byKey = /* @__PURE__ */ new Map();
+        for (const e of entries) {
+          const key = `${e.clientId}:${e.seq}`;
+          byKey.set(key, e);
+          if (e.status === "unsent" || e.status === "inflight" || e.status === "parked") {
+            activeLive.add(key);
+            this.addHydratedEntry(e);
+          }
+        }
+        for (const entry of this.reconciler.entries()) {
+          if (!this.isMirroredEntry(entry)) continue;
+          if (entry.clientId === void 0 || entry.seq === void 0) continue;
+          if (entry.status.type === "completed") continue;
+          const key = `${entry.clientId}:${entry.seq}`;
+          if (activeLive.has(key)) continue;
+          const stored = byKey.get(key);
+          if (stored?.status === "failed") {
+            this.reconciler.onMutationFailure(entry.requestId);
+            this.notifyMutationFailed(entry.clientId, entry.seq, entry.udfPath, stored.error ?? { message: `mutation "${entry.udfPath}" failed` });
+          } else {
+            this.dropAfterBaseline(entry.requestId);
+          }
+        }
+      } while (this.mirrorRerun);
+    } finally {
+      this.mirrorInFlight = false;
+    }
+  }
+  /** Handle a targeted `settled`/`failed` broadcast — the leader's flicker-free fast path (Part A's
+   *  normal route; `mirrorFromStore`'s backstop above is the fallback for a missed message). Ignored
+   *  entirely for an entry this tab doesn't know about, or one it initiated live itself (hazard (a)).
+   *  Never touches the durable store — the leader (whichever tab settled it) already wrote that;
+   *  this only updates THIS tab's in-memory reconciler layer + R9 observability. */
+  onCrossTabSettle(msg) {
+    const entry = this.findOutboxEntry(msg.clientId, msg.seq);
+    if (!entry || !this.isMirroredEntry(entry)) return;
+    if (msg.kind === "settled") {
+      this.reconciler.onMutationSuccess(entry.requestId, msg.commitTs);
+    } else {
+      this.reconciler.onMutationFailure(entry.requestId);
+      this.notifyMutationFailed(entry.clientId, entry.seq, entry.udfPath, { message: msg.message, code: msg.code });
+    }
+  }
+  drainBatchEntry(entry) {
+    return { requestId: entry.requestId, udfPath: entry.udfPath, args: entry.args, clientId: entry.clientId, seq: entry.seq };
+  }
+  /** applied settlement for a drained unit — resolve the awaiting promise (if any) and dequeue the
+   *  durable record ALWAYS; then route the layer drop by `replayed` (T4 review fix — the ungated
+   *  fresh-apply drop):
+   *   - `replayed: true` — a resend whose commit predates this session's `Connect`, reusing the same
+   *     primitive `settleVerdict`'s `applied` case uses (T3's unconditional baseline-gated drop).
+   *     Drop-soundness (T3 watch item, scoped to replays ONLY): the drop is gated on baseline
+   *     adoption, not on the replay's carried commitTs — the entry's commit necessarily predates this
+   *     session's `Connect`, so it predates the baseline's read snapshot and the baseline already
+   *     renders the effect. Historical-ts-vs-current-base is therefore still covered; the drop is
+   *     flicker-free by the same one-pass rule as T3's handshake.
+   *   - a FRESH apply (`replayed` absent/false — this session's OWN first execution, a genuinely new
+   *     `ts`) — the argument above does NOT apply: nothing proves this commit predates the baseline,
+   *     so an unconditional drop here would remove a still-rendered layer before its authoritative row
+   *     ever appears (a flicker). Instead this routes through the normal same-session gate,
+   *     `onMutationSuccess` (the response `ts`) — the exact same shipped no-flicker discipline the
+   *     direct-send path uses at `MutationResponse` (see the `case "MutationResponse"` handler above):
+   *     hold the layer `completed` until this client's own reactive feed observes `ts`.
+   *
+   *  T-crosstab: AFTER the local settle above, the leader (this tab, if it holds the drain lock)
+   *  also posts a targeted `settled` broadcast so a tab MIRRORING this same `(clientId, seq)` gets
+   *  the flicker-free fast path instead of waiting for its own next `enqueued`-triggered backstop
+   *  read. Posted only when the entry carries a durable `(clientId, seq)` — a plain non-outbox
+   *  mutation has nothing for another tab to have mirrored in the first place.
+   */
+  drainSettleApplied(requestId, value, replayed, ts) {
+    const entry = this.reconciler.getEntry(requestId);
+    this.resolvePending(requestId, value);
+    if (entry?.clientId !== void 0 && entry.seq !== void 0) this.outboxDequeue(entry.clientId, entry.seq);
+    if (!entry) return;
+    if (replayed) this.dropAfterBaseline(requestId);
+    else this.reconciler.onMutationSuccess(requestId, ts);
+    if (entry.clientId !== void 0 && entry.seq !== void 0) {
+      this.outboxBroadcast?.postMessage({ kind: "settled", clientId: entry.clientId, seq: entry.seq, commitTs: ts ?? 0 });
+    }
+  }
+  /** Terminal settlement for a drained unit (a coded server verdict, or the identity gate) — reject
+   *  the awaiting promise (coded), MARK the durable record `"failed"` (R9: never dequeue a terminal
+   *  failure — it persists until dismissed/retried), drop the layer, and (T5) refire `onMutationFailed`
+   *  / the dev-loud default when nothing awaited this failure this session. T-crosstab: AFTER all of
+   *  the above, also posts a targeted `failed` broadcast (same durability gate as `drainSettleApplied`
+   *  above) — a mirroring tab's own `onCrossTabSettle` fires ITS OWN `onMutationFailed`/dev-loud
+   *  default; it never double-delivers THIS tab's own notification above. */
+  drainSettleTerminal(requestId, code, message) {
+    const entry = this.reconciler.getEntry(requestId);
+    const hadAwaiter = this.pendingMutationCallbacks.has(requestId);
+    this.rejectPending(requestId, this.mutationError(message, code));
+    if (entry?.clientId !== void 0 && entry.seq !== void 0) this.outboxMarkFailed(entry.clientId, entry.seq, message, code);
+    if (entry) this.reconciler.onMutationFailure(requestId);
+    if (!hadAwaiter) this.notifyMutationFailed(entry?.clientId, entry?.seq, entry?.udfPath ?? "unknown", { message, code });
+    if (entry?.clientId !== void 0 && entry.seq !== void 0) {
+      this.outboxBroadcast?.postMessage({ kind: "failed", clientId: entry.clientId, seq: entry.seq, code, message });
+    }
+  }
+  /* ---------------------------------------------------------------------------------------------
+   * T5 — R9 observability: `pendingMutations()`/`usePendingMutations()`, `pendingSummary()`,
+   * `onMutationFailed` refire, the dev-mode loud default, and the outbox-change notification bus
+   * every durable-mutating operation above funnels through.
+   * ------------------------------------------------------------------------------------------- */
+  /** A snapshot of the durable outbox — `usePendingMutations()`'s underlying read. `[]` without an
+   *  outbox configured (verdict §(d) R9). Each row's `retry()`/`dismiss()` close over the entry as
+   *  read HERE (no extra storage round-trip — `retry()` needs `args`/`seed`/`identityFingerprint`,
+   *  all captured already). */
+  async pendingMutations() {
+    if (!this.outbox) return [];
+    const { entries } = await this.outbox.loadAll();
+    return entries.map((e) => this.toPendingMutationEntry(e));
+  }
+  /** T5 (R9, hazard 2's client half): count + oldest-age advisory over the durable queue — cheap
+   *  enough to poll for a "your offline changes may be lost soon" banner ahead of a storage cliff
+   *  (Safari's 7-day eviction). `{count: 0, oldestEnqueuedAt: undefined, oldestAgeMs: undefined}`
+   *  without an outbox configured, or with an empty one. */
+  async pendingSummary() {
+    if (!this.outbox) return { count: 0, oldestEnqueuedAt: void 0, oldestAgeMs: void 0 };
+    const { entries } = await this.outbox.loadAll();
+    if (entries.length === 0) return { count: 0, oldestEnqueuedAt: void 0, oldestAgeMs: void 0 };
+    let oldest = entries[0].enqueuedAt;
+    for (const e of entries) if (e.enqueuedAt < oldest) oldest = e.enqueuedAt;
+    return { count: entries.length, oldestEnqueuedAt: oldest, oldestAgeMs: Date.now() - oldest };
+  }
+  toPendingMutationEntry(e) {
+    return {
+      clientId: e.clientId,
+      seq: e.seq,
+      udfPath: e.udfPath,
+      status: e.status,
+      enqueuedAt: e.enqueuedAt,
+      error: e.error,
+      retry: () => this.retryOutboxEntry(e),
+      dismiss: () => this.dismissOutboxEntry(e)
+    };
+  }
+  /** `entry.retry()` (R9): a FAILED entry only — everything else is a harmless no-op (verdict §(b):
+   *  "never reuse a seq for a new attempt"). Dequeues the OLD (failed-verdict) durable record and
+   *  builds a brand-new `PendingMutation` — fresh requestId/seq/order, the CURRENT session's identity
+   *  fingerprint (a fair shot even if identity rotated since the original failure), reconstructed
+   *  exactly like a hydrated entry (same udfPath/args/seed; the registry is consulted — there is no
+   *  live call-site closure for a retry either). No live promise is registered: like a hydrated
+   *  entry, its eventual outcome surfaces via `usePendingMutations()`/`onMutationFailed`, never a
+   *  returned `Promise<Value>` (the durable record outlives any promise). */
+  async retryOutboxEntry(e) {
+    if (!this.outbox || e.status !== "failed" || this.outboxClientId === void 0) return;
+    const requestId = String(this.nextRequestId++);
+    const entry = {
+      requestId,
+      udfPath: e.udfPath,
+      args: e.args,
+      seed: e.seed,
+      touched: /* @__PURE__ */ new Set(),
+      status: { type: "unsent" },
+      clientId: this.outboxClientId,
+      seq: this.outboxNextSeq++,
+      order: this.nextOutboxOrder(),
+      identityFingerprint: this.outboxFingerprint,
+      enqueuedAt: Date.now(),
+      durable: false,
+      update: this.lookupHydratedUpdate(e.udfPath)
+    };
+    this.reconciler.addHydrated(entry);
+    this.outboxAppend(entry);
+    this.outboxDequeue(e.clientId, e.seq);
+    this.outboxDrain?.nudge();
+  }
+  /** `entry.dismiss()` (R9): a FAILED entry only — permanently forget it without retrying. */
+  async dismissOutboxEntry(e) {
+    if (!this.outbox || e.status !== "failed") return;
+    this.outboxDequeue(e.clientId, e.seq);
+  }
+  /** T5 (R9): subscribe to "the durable outbox changed" — `usePendingMutations()`'s re-read trigger.
+   *  Fires on every local outbox-mutating op AND on an incoming cross-tab `outboxBroadcast` message. */
+  onOutboxChange(listener) {
+    this.outboxChangeListeners.add(listener);
+    return () => this.outboxChangeListeners.delete(listener);
+  }
+  notifyOutboxChange() {
+    for (const l of this.outboxChangeListeners) l();
+    this.outboxBroadcast?.postMessage({ kind: "enqueued" });
+  }
+  /** Every durable-mutating outbox call site funnels through these four wrappers (instead of a bare
+   *  `this.outbox?.xxx(...)`) so `notifyOutboxChange()` — and a rejection's route through
+   *  `handleOutboxWriteError` — is never missed at a new call site. */
+  outboxAppend(entry) {
+    if (!this.outbox) return;
+    void this.outbox.append(this.toOutboxEntry(entry)).then(() => {
+      entry.durable = true;
+      this.outboxDrain?.nudge();
+      this.notifyOutboxChange();
+    }).catch((err) => this.handleOutboxWriteError("append", entry.clientId, entry.seq, entry.udfPath, err));
+  }
+  outboxDequeue(clientId, seq) {
+    if (!this.outbox) return;
+    void this.outbox.dequeue(clientId, seq).then(() => this.notifyOutboxChange()).catch((err) => this.handleOutboxWriteError("dequeue", clientId, seq, void 0, err));
+  }
+  outboxUpdateStatus(clientId, seq, status) {
+    if (!this.outbox) return;
+    void this.outbox.updateStatus(clientId, seq, status).then(() => this.notifyOutboxChange()).catch((err) => this.handleOutboxWriteError("updateStatus", clientId, seq, void 0, err));
+  }
+  /** Record a terminal failure DURABLY (`status: "failed"` + the error) instead of dequeuing — R9:
+   *  "failed entries persist until dismissed/retried". */
+  outboxMarkFailed(clientId, seq, message, code) {
+    if (!this.outbox) return;
+    void this.outbox.updateStatus(clientId, seq, "failed", { message, code }).then(() => this.notifyOutboxChange()).catch((err) => this.handleOutboxWriteError("updateStatus", clientId, seq, void 0, err));
+  }
+  /** Routes a rejected fire-and-forget durable-outbox write (append/updateStatus/dequeue/setMeta —
+   *  never awaited by its caller, per the write-behind contract) to observability instead of letting
+   *  it become an unhandled promise rejection, which several Node/Electron hosts treat as fatal by
+   *  default (a `fsOutbox` that has fail-stopped after a disk error rejects EVERY subsequent op —
+   *  see `outbox-fs.ts`'s `OutboxClosedError`). When the write carries a `(clientId, seq)` — every
+   *  case except a meta-only write — it routes through the SAME R9 channel as any other terminal
+   *  mutation failure (`onMutationFailed`, or `notifyMutationFailed`'s own dev-mode loud
+   *  `console.error` default). With no such record to attach the failure to (a meta write), a
+   *  dev-loud `console.error` is the floor — NEVER swallowed silently either way. */
+  handleOutboxWriteError(op, clientId, seq, udfPath, err) {
+    const message = err instanceof Error ? err.message : String(err);
+    const code = typeof err === "object" && err !== null && "code" in err ? String(err.code) : void 0;
+    if (clientId !== void 0 && seq !== void 0) {
+      this.notifyMutationFailed(clientId, seq, udfPath ?? "unknown", { message: `durable outbox ${op} failed: ${message}`, code });
+    } else if (isDevMode()) {
+      console.error(`[helipod] durable outbox ${op} failed (clientId=${clientId ?? "unknown"}):`, err);
+    }
+  }
+  /** T5 (R9): fire `onMutationFailed` for a terminal durable failure with NO live promise awaiter
+   *  this session (`hadAwaiter` already checked by every call site) — or, absent a registered
+   *  handler, the dev-mode loud `console.error` default (spec-review: "the five-line courtesy" no
+   *  position shipped). A no-op for a non-outbox-tracked entry (`clientId`/`seq` undefined) — R9 is
+   *  entirely a durable-outbox concern. */
+  notifyMutationFailed(clientId, seq, udfPath, error) {
+    if (clientId === void 0 || seq === void 0) return;
+    if (this.onMutationFailedCallback) {
+      this.onMutationFailedCallback({ clientId, seq, udfPath, error });
+    } else if (isDevMode()) {
+      console.error(
+        `[helipod] outbox: mutation "${udfPath}" (clientId=${clientId}, seq=${seq}) failed terminally${error.code ? ` (${error.code})` : ""} with no onMutationFailed handler registered: ${error.message}`
+      );
+    }
+  }
+  /** R9 "resume" refire (constructor-only, verdict §(d) Observability: "`onMutationFailed` refires
+   *  from durable records on resume"): a fresh `HelipodClient` instance has made zero `mutation()`
+   *  calls yet, so EVERY already-`"failed"` durable record found here is trivially "no live awaiter" —
+   *  Lunora's `hadAwaiter` check is unconditionally false at this point, no gating needed. */
+  async refireDurableFailures() {
+    if (!this.outbox) return;
+    const { entries } = await this.outbox.loadAll();
+    for (const e of entries) {
+      if (e.status === "failed") {
+        this.notifyMutationFailed(e.clientId, e.seq, e.udfPath, e.error ?? { message: `mutation "${e.udfPath}" failed` });
+      }
+    }
+  }
+};
+
+export {
+  getFunctionPath,
+  anyApi,
+  MutationUndeliveredError,
+  createOptimisticLocalStore,
+  computeDrainBackoff,
+  DEFAULT_DRAIN_CHUNK_SIZE,
+  DEFAULT_DRAIN_INTERVAL_MS,
+  OFFLINE_IDENTITY_CHANGED,
+  AUTH_REFRESH_UDF_PATH,
+  NON_REPLAYABLE_MUTATION_DROPPED,
+  dropIfNonReplayable,
+  OutboxDrain,
+  outboxHeldFromLog,
+  outboxHeldFromStore,
+  outboxAckedThrough,
+  buildConnectMessage,
+  sha256Hex,
+  sessionFingerprintKey,
+  HelipodClient
+};
+//# sourceMappingURL=chunk-I7ZJFW4E.js.map