@mmstack/primitives 20.11.1 → 20.13.0

package/fesm2022/mmstack-primitives.mjs

@@ -4121,7 +4121,7 @@ function isOpaque(value) {
         value[OPAQUE] === true);
 }
 
-function isRecord(value) {
+function isRecord$1(value) {
     if (value === null || typeof value !== 'object' || isOpaque(value))
         return false;
     const proto = Object.getPrototypeOf(value);
@@ -4137,7 +4137,7 @@ function isLeafValue(value, vivifyEnabled) {
         return !vivifyEnabled;
     if (isOpaque(value))
         return true; // opaque always wins — even arrays
-    return !Array.isArray(value) && !isRecord(value);
+    return !Array.isArray(value) && !isRecord$1(value);
 }
 /**
  * @internal
@@ -4150,7 +4150,7 @@ function resolveVivify(sample, option) {
         return false;
     if (Array.isArray(sample))
         return 'array';
-    if (isRecord(sample))
+    if (isRecord$1(sample))
         return 'object';
     return 'auto';
 }
@@ -4175,7 +4175,7 @@ function createFallbackOnChange(target, prop, vivifyFn, isMutableSource) {
             ? container
             : Array.isArray(container)
                 ? container.slice()
-                : isRecord(container)
+                : isRecord$1(container)
                     ? { ...container }
                     : container; // non-plain leaf (Date/class instance): legacy in-place attempt
         try {
@@ -4206,7 +4206,7 @@ const isPlainArray$1 = (v) => Array.isArray(v) && !isOpaque(v);
 function diffNode(prev, next, path, ops) {
     if (Object.is(prev, next))
         return;
-    if (isRecord(prev) && isRecord(next)) {
+    if (isRecord$1(prev) && isRecord$1(next)) {
         for (const key of Object.keys(prev)) {
             if (!Object.hasOwn(next, key))
                 ops.push({ kind: 'delete', path: [...path, key], prev: prev[key] });
@@ -4239,9 +4239,11 @@ function diffNode(prev, next, path, ops) {
 /** Immutably applies one op along its path, vivifying missing containers `'auto'`-style. */
 function applyAt(container, path, idx, op) {
     const seg = path[idx];
+    if (seg === '__proto__')
+        return container;
     const base = isPlainArray$1(container)
         ? container.slice()
-        : isRecord(container)
+        : isRecord$1(container)
             ? { ...container }
             : typeof seg === 'number'
                 ? []
@@ -4270,6 +4272,8 @@ function applyOps(root, ops) {
     const list = Array.isArray(ops) ? ops : ops.ops;
     let next = root;
     for (const op of list) {
+        if (op.kind === 'clear')
+            continue; // register retirement, never a value change
         if (op.path.length === 0) {
             if (op.kind === 'set')
                 next = op.next;
@@ -4283,7 +4287,8 @@ function applyOps(root, ops) {
  * Pure reference-pruned structural diff of two roots into minimal ops (the emission core of
  * {@link opLog}, exported so code outside a log can produce a batch — e.g. diffing a scratch
  * draft against a replica's current value to route a write to its owner). Trusts the
- * copy-on-write contract: an untouched subtree that kept its reference is skipped.
+ * copy-on-write contract: an untouched subtree that kept its reference is skipped. Emits only
+ * `set` and `delete`; `clear` is an emission-layer intent, never a diff product.
  */
 function diffOps(prev, next) {
     const ops = [];
@@ -4294,13 +4299,17 @@ function diffOps(prev, next) {
  * Inverts a batch for undo: reversed order, `set`↔its own inverse (an add — a `set` with no
  * `prev` — inverts to a `delete`; a `delete` inverts to a `set` restoring `prev`). Feed the
  * result to {@link OpLog.apply}. Requires the ops' `prev`s, which in-memory batches always
- * carry — a wire-serialized batch that stripped them is not invertible.
+ * carry (a wire-serialized batch that stripped them is not invertible). A `clear` is skipped:
+ * it never changed a value, so it has no independent inverse (the accompanying subtree `set`'s
+ * `prev` subsumes restoration).
  */
 function invertBatch(batch) {
     const ops = Array.isArray(batch) ? batch : batch.ops;
     const inverted = [];
     for (let i = ops.length - 1; i >= 0; i--) {
         const op = ops[i];
+        if (op.kind === 'clear')
+            continue;
         if (op.kind === 'delete') {
             inverted.push({
                 kind: 'set',
@@ -4524,7 +4533,7 @@ function buildChildNode(target, prop, isMutableSource, options) {
     const value = untracked(target);
     const nodeVivify = resolveVivify(value, options.vivify);
     const vivifyFn = createVivify(nodeVivify);
-    const equalFn = isMutableSource && (isRecord(value) || Array.isArray(value))
+    const equalFn = isMutableSource && (isRecord$1(value) || Array.isArray(value))
         ? mutableChildEqual
         : undefined;
     const computation = derived(target, {
@@ -4573,7 +4582,7 @@ function toStore(source, { injector, vivify = false, noUnionLeaves = false, ...r
         const v = source();
         if (Array.isArray(v) && !isOpaque(v))
             return 'array';
-        if (isRecord(v))
+        if (isRecord$1(v))
             return 'record';
         return 'primitive';
     }, ...(ngDevMode ? [{ debugName: "kind" }] : []));
@@ -4621,7 +4630,7 @@ function toStore(source, { injector, vivify = false, noUnionLeaves = false, ...r
                 arr[len] = 'length';
                 return arr;
             }
-            if (!isRecord(v))
+            if (!isRecord$1(v))
                 return [];
             return Reflect.ownKeys(v);
         },
@@ -4639,7 +4648,7 @@ function toStore(source, { injector, vivify = false, noUnionLeaves = false, ...r
                     return { enumerable: true, configurable: true };
                 return;
             }
-            if (!isRecord(v) || !(prop in v))
+            if (!isRecord$1(v) || !(prop in v))
                 return;
             return { enumerable: true, configurable: true };
         },
@@ -4981,23 +4990,274 @@ function createHlcClock(now = Date.now) {
     };
 }
 
-const OP_PROTO_VERSION = 1;
+/**
+ * Reserved key holding an element's fractional position inside a keyed container. It lives INSIDE
+ * the element (at `[container, elementKey, '~pos']`), so a reorder is a one-field write that never
+ * collides with a concurrent edit to the element's data. It stays visible on the materialized
+ * element value; do not read, write, or strip it by hand, use the helpers in this file.
+ */
+const POS_SEGMENT = '~pos';
+// Order-preserving fractional-index digits. The alphabet is ASCII-ascending, so a plain string
+// comparison of two positions matches their fractional order with no decoding.
+const DIGITS = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
+const BASE = DIGITS.length;
+const digitOf = (c) => DIGITS.indexOf(c);
+// Repeated inserts into the SAME gap grow a position one digit at a time. Healthy positions stay a
+// few characters; a long one signals a hot insertion point that should be rebalanced.
+const POS_WARN_LENGTH = 48;
+let posWarned = false;
+const warnIfLong = (pos) => {
+    if (isDevMode() && !posWarned && pos.length >= POS_WARN_LENGTH) {
+        posWarned = true;
+        console.warn(`[@mmstack/primitives] a keyed-container position grew to ${pos.length} characters from ` +
+            `repeated inserts into one gap. Call rebalanceContainer(...) to reclaim precision.`);
+    }
+    return pos;
+};
+/**
+ * A compact position string strictly between `before` and `after`, ordered by plain string
+ * comparison. Pass `undefined` for an open end: `posBetween()` seeds the first element,
+ * `posBetween(last)` appends, `posBetween(undefined, first)` prepends. Repeated inserts into the
+ * same gap grow the string one digit at a time rather than colliding, and the result is never equal
+ * to either neighbor. `before` must sort before `after`.
+ */
+function posBetween(before, after) {
+    // Neighbors can tie (concurrent inserts into the same gap leave two equal positions, ordered only
+    // by key). There is no position strictly between equal bounds, so open the upper end: the new
+    // position sorts just after them and stays deterministic instead of looping.
+    const upper = before != null && after != null && before >= after ? undefined : after;
+    let i = 0;
+    let out = '';
+    // The upper bound only opens to BASE once we pass `after`'s last constraining digit: an adjacent
+    // pair (gap of 1) leaves no room here, so we commit the lower digit and everything deeper is free.
+    let upperOpen = upper == null;
+    for (;;) {
+        const lo = before != null && i < before.length ? digitOf(before[i]) : 0;
+        const hi = upperOpen || upper == null ? BASE : i < upper.length ? digitOf(upper[i]) : 0;
+        if (hi - lo >= 2)
+            return warnIfLong(out + DIGITS[lo + ((hi - lo) >> 1)]);
+        if (hi === lo) {
+            // digits equal: no room yet, but `after` still constrains deeper digits, keep following it
+            out += DIGITS[lo];
+            i++;
+            continue;
+        }
+        // gap of 1: commit the lower digit and open the upper bound (deeper digits only exceed `before`)
+        out += DIGITS[lo];
+        i++;
+        upperOpen = true;
+    }
+}
+const isRecord = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+/**
+ * A keyed container's elements in reading order. Order is a pure function of the materialized
+ * value: elements sort by their `~pos` string, ties broken by key. An element whose `~pos` is
+ * missing or not a string is ordered as if its position were the empty string (it sorts first,
+ * key breaking the tie), so a peer that dropped the position field still lands somewhere
+ * deterministic on every replica.
+ */
+function orderedEntries(container) {
+    const entries = [];
+    for (const key of Object.keys(container)) {
+        const value = container[key];
+        const raw = isRecord(value) ? value[POS_SEGMENT] : undefined;
+        entries.push({ key, pos: typeof raw === 'string' ? raw : '', value });
+    }
+    entries.sort((a, b) => a.pos < b.pos ? -1 : a.pos > b.pos ? 1 : a.key < b.key ? -1 : a.key > b.key ? 1 : 0);
+    return entries;
+}
+const devError = (msg) => {
+    if (typeof ngDevMode !== 'undefined' && ngDevMode)
+        console.error(`[keyed-container] ${msg}`);
+};
+const neighborPositions = (entries, index) => {
+    const clamped = Math.max(0, Math.min(index, entries.length));
+    return [entries[clamped - 1]?.pos || undefined, entries[clamped]?.pos || undefined];
+};
+/**
+ * Insert `value` under `key` at `index` in reading order (default: append). The position is
+ * computed from the neighbors at that index, so the element lands where asked without renumbering
+ * any sibling. A keyed container is a RECORD, never an array, so this is a per-key write the sync
+ * layer diffs on its own. Returns the assigned position. Re-inserting an existing key overwrites it.
+ */
+function insertElement(container, key, value, index) {
+    if (POS_SEGMENT in value)
+        devError(`insertElement: '${POS_SEGMENT}' is managed, drop it from the value`);
+    const entries = orderedEntries(container()).filter((e) => e.key !== key);
+    const [before, after] = neighborPositions(entries, index ?? entries.length);
+    const pos = posBetween(before, after);
+    container.update((c) => ({ ...c, [key]: { ...value, [POS_SEGMENT]: pos } }));
+    return pos;
+}
+/**
+ * Move the element at `key` to `index` in reading order. This writes ONLY the element's `~pos`
+ * field, so it never conflicts with a concurrent edit to the same element's data (they land on
+ * different paths and both survive). Returns the new position, or `undefined` if `key` is absent.
+ */
+function moveElement(container, key, index) {
+    const current = container()[key];
+    if (current == null)
+        return undefined;
+    const entries = orderedEntries(container()).filter((e) => e.key !== key);
+    const [before, after] = neighborPositions(entries, index);
+    const pos = posBetween(before, after);
+    container.update((c) => ({ ...c, [key]: { ...c[key], [POS_SEGMENT]: pos } }));
+    return pos;
+}
+/** Remove the element at `key`. Deletes the whole element (a per-key delete the sync layer folds). */
+function removeElement(container, key) {
+    container.update((c) => {
+        if (!(key in c))
+            return c;
+        const next = { ...c };
+        delete next[key];
+        return next;
+    });
+}
+/**
+ * Reassign every element's position to a fresh, evenly spaced sequence, as an authority write:
+ * each `~pos` set is epoch-bumped so it wins the merge against any concurrent move, while leaving
+ * concurrent edits to element DATA untouched (only the `~pos` fields are written). Use this to
+ * reclaim precision after many same-gap inserts. Existing reading order is preserved.
+ */
+function rebalanceContainer(sync, container) {
+    const order = orderedEntries(container());
+    const positions = evenPositions(order.length);
+    sync.override(() => {
+        container.update((c) => {
+            const next = { ...c };
+            order.forEach(({ key }, i) => {
+                next[key] = { ...c[key], [POS_SEGMENT]: positions[i] };
+            });
+            return next;
+        });
+    });
+}
+// `n` evenly spaced, order-preserving positions in (0, 1): fraction (i+1)/(n+1) encoded to enough
+// base-62 digits that consecutive fractions never collide. Compact, so precision is reclaimed.
+function evenPositions(n) {
+    if (n === 0)
+        return [];
+    const digits = Math.floor(Math.log(n + 1) / Math.log(BASE)) + 2;
+    const out = [];
+    for (let i = 0; i < n; i++) {
+        let f = (i + 1) / (n + 1);
+        let s = '';
+        for (let k = 0; k < digits; k++) {
+            f *= BASE;
+            const d = Math.min(BASE - 1, Math.floor(f));
+            s += DIGITS[d];
+            f -= d;
+        }
+        out.push(s);
+    }
+    return out;
+}
+
+/**
+ * Wire protocol version. Version 2 ops carry `cites` + `epoch` (the dot-citation register);
+ * envelopes from other versions are dropped loudly: an op without citations cannot be merged
+ * soundly (it would supersede nothing and its siblings would accumulate forever), so versions
+ * are never silently mixed.
+ */
+const OP_PROTO_VERSION = 2;
 const CONFLICT_BRAND = '~mmstackConflict';
 function isConflicted(value) {
     return typeof value === 'object' && value !== null && CONFLICT_BRAND in value;
 }
+const hasControlChar = (s) => {
+    for (let i = 0; i < s.length; i++)
+        if (s.charCodeAt(i) < 0x20)
+            return true;
+    return false;
+};
+const isCleanId = (v) => typeof v === 'string' && v.length > 0 && !hasControlChar(v);
+const isFiniteHlc = (h) => !!h &&
+    typeof h === 'object' &&
+    Number.isFinite(h.p) &&
+    Number.isFinite(h.l);
+/**
+ * Deterministic, total well-formedness check for a received envelope. Returns a short reason
+ * string when the envelope must be rejected WHOLE, or `null` when it is well-formed. It reads only
+ * the envelope (no clock, no local state), so every replica accepts or rejects a given envelope
+ * identically. This validates SHAPE, not authority: it closes malformed input (control characters
+ * in an id or path segment that could forge a path-key separator, a non-integer version, an unknown
+ * op kind, a negative epoch, forged cites, a root delete, two ops racing on one path). Authority and
+ * access control stay at the relay; direct peer-to-peer rooms are trust-full for authority, so this
+ * shape check is a peer's only line against a malformed neighbor.
+ */
+function validateEnvelope(env) {
+    if (!env || typeof env !== 'object')
+        return 'envelope';
+    if (!isCleanId(env.origin))
+        return 'origin';
+    if (!isCleanId(env.writer))
+        return 'writer';
+    if (!isFiniteHlc(env.hlc))
+        return 'hlc';
+    if (!Number.isInteger(env.version) || env.version <= 0)
+        return 'version';
+    if (!Array.isArray(env.ops))
+        return 'ops';
+    const seenPaths = new Set();
+    for (const op of env.ops) {
+        if (!op || typeof op !== 'object')
+            return 'op';
+        if (op.kind !== 'set' && op.kind !== 'delete' && op.kind !== 'clear')
+            return 'kind';
+        if (!Array.isArray(op.path))
+            return 'path';
+        for (const seg of op.path) {
+            if (typeof seg === 'string' && hasControlChar(seg))
+                return 'path-control';
+            if (seg === '__proto__')
+                return 'path-proto';
+        }
+        if (op.path.length === 0 && op.kind !== 'set')
+            return 'root-op';
+        const epoch = op.epoch;
+        if (typeof epoch !== 'number' || !Number.isFinite(epoch) || epoch < 0)
+            return 'epoch';
+        const cites = op.cites;
+        if (!Array.isArray(cites))
+            return 'cites';
+        for (const c of cites) {
+            if (!c ||
+                typeof c !== 'object' ||
+                !isCleanId(c.origin) ||
+                !isFiniteHlc(c.hlc)) {
+                return 'cites';
+            }
+        }
+        // one op per path per envelope: a dot is (origin, hlc), so two ops on one path in one envelope
+        // would share a dot and break the register's per-origin bookkeeping. Segments with control
+        // characters are already rejected above, so this join is unambiguous.
+        const key = op.path.map(String).join(String.fromCharCode(0x1f));
+        if (seenPaths.has(key))
+            return 'dup-path';
+        seenPaths.add(key);
+    }
+    return null;
+}
 const lww = (_ancestor, mine) => mine;
 const mergeThree = (ancestor, mine, theirs) => merge3(ancestor, mine, theirs);
-const preserve = (ancestor, mine, theirs) => ({ [CONFLICT_BRAND]: true, mine, theirs, ancestor });
+const preserve = (ancestor, mine, theirs) => ({
+    [CONFLICT_BRAND]: true,
+    siblings: [mine, theirs],
+    mine,
+    theirs,
+    ancestor,
+});
 /**
- * Identity-aware array merge (op-protocol RFC §12 v0): reconciles two concurrent versions of
+ * Identity-aware array merge: reconciles two concurrent versions of
  * an array item-wise by a user-provided identity, instead of last-writer-wins on the whole
  * array. Items are matched by key; per-item fields merge via `merge3` against the ancestor
  * item; items added on either side survive; an item removed on either side and unedited on
  * the other stays removed. Item ORDER follows `mine` (the total-order winner), with `theirs`-
- * only additions appended — positional merging is out of scope (fractional indexing is the
- * known upgrade if dogfooding demands it). Arrays still TRAVEL as whole-value sets; identity
- * only shapes conflict resolution, so the wire format is untouched.
+ * only additions appended, and arrays still TRAVEL as whole-value sets. For a list whose elements
+ * move and edit concurrently, model it as a keyed container (a record of elements ordered by
+ * `posBetween`) instead: `insertElement`/`moveElement`/`removeElement` write per element, so a
+ * reorder and a concurrent edit both survive and elements travel one at a time.
  */
 function keyedArray(identity, opt) {
     const mergeItem = opt?.item ?? mergeThree;
@@ -5021,9 +5281,7 @@ function keyedArray(identity, opt) {
             const other = theirsMap.get(key);
             const base = ancMap.get(key);
             if (theirsMap.has(key)) {
-                out.push(structuralEq(item, other)
-                    ? item
-                    : mergeItem(base, item, other, ctx));
+                out.push(structuralEq(item, other) ? item : mergeItem(base, item, other, ctx));
             }
             else if (!ancMap.has(key) || !structuralEq(item, base)) {
                 out.push(item); // added by mine, or edited by mine while theirs removed it → keep
@@ -5047,19 +5305,23 @@ function compilePolicies(entries) {
         merge: e.merge,
     }));
 }
+function matchSegments(segments, path) {
+    if (segments.length !== path.length)
+        return false;
+    for (let i = 0; i < path.length; i++) {
+        if (segments[i] !== '*' && segments[i] !== String(path[i]))
+            return false;
+    }
+    return true;
+}
 function policyFor(policies, path) {
-    outer: for (const p of policies) {
-        if (p.segments.length !== path.length)
-            continue;
-        for (let i = 0; i < path.length; i++) {
-            if (p.segments[i] !== '*' && p.segments[i] !== String(path[i]))
-                continue outer;
-        }
-        return p.merge;
+    for (const p of policies) {
+        if (matchSegments(p.segments, path))
+            return p.merge;
     }
     return lww;
 }
-const SEP = '';
+const SEP = ''; // unit separator: keeps joined path keys prefix-unambiguous
 const keyOf$1 = (path) => path.map(String).join(SEP);
 function structuralEq(a, b) {
     if (Object.is(a, b))
@@ -5084,102 +5346,539 @@ function structuralEq(a, b) {
     }
     return true;
 }
-// total order (hlc, writer, origin): two origins can share a writer AND a stamp
-// (independent clocks, same ms), so only origin makes the order strict
-const compareStamp = (a, b) => {
+const kindClass = (k) => (k === 'clear' ? 0 : 1);
+/**
+ * The register's total order: max by `(epoch, kind-class, hlc, writer, origin)`, where `set`
+ * and `delete` outrank `clear` at equal epoch. Epoch first makes an authority bump decisive
+ * regardless of clocks (and closes stale-value resurrection); the kind-class tier makes a
+ * concurrent edit's survival of a subtree replace categorical rather than a clock race; origin
+ * last keeps the order strict when two replicas share a writer and a stamp.
+ */
+function compareSiblings(a, b) {
+    if (a.epoch !== b.epoch)
+        return a.epoch - b.epoch;
+    const kc = kindClass(a.kind) - kindClass(b.kind);
+    if (kc !== 0)
+        return kc;
     const byTotal = compareTotal(a.hlc, a.writer, b.hlc, b.writer);
     if (byTotal !== 0)
         return byTotal;
     return a.origin < b.origin ? -1 : a.origin > b.origin ? 1 : 0;
+}
+const maxSibling = (siblings) => siblings.reduce((a, b) => (compareSiblings(a, b) >= 0 ? a : b));
+/** Last-writer-wins over the live sibling set: the {@link compareSiblings} maximum, as-is. */
+const defaultFold = (siblings) => {
+    const winner = maxSibling(siblings);
+    return winner.kind === 'set'
+        ? { kind: 'set', value: winner.value }
+        : { kind: winner.kind };
 };
-const beats = (a, b) => compareStamp(a, b) > 0;
+// preserve on the register seam: every top-precedence live sibling survives as data. A delete
+// competes as a value (it may surface inside the conflict as `undefined`); lower-epoch siblings
+// never surface (the epoch gate stays outermost).
+const preserveFold = (siblings) => {
+    const winner = maxSibling(siblings);
+    if (winner.kind === 'clear')
+        return { kind: 'clear' };
+    const top = siblings.filter((s) => s.epoch === winner.epoch && s.kind !== 'clear');
+    if (top.length === 1) {
+        return top[0].kind === 'set'
+            ? { kind: 'set', value: top[0].value }
+            : { kind: 'delete' };
+    }
+    const ordered = [...top].sort((a, b) => compareSiblings(b, a));
+    const values = ordered.map((s) => (s.kind === 'set' ? s.value : undefined));
+    const conflicted = {
+        [CONFLICT_BRAND]: true,
+        siblings: values,
+        mine: values[0],
+        theirs: values[1],
+        ancestor: ordered[1].prev,
+    };
+    return { kind: 'set', value: conflicted };
+};
+// A two-sided MergeFn generalized to N siblings: reduce over the canonically-ordered
+// top-precedence set, winner first, each step merging the next sibling against its own `prev`
+// as the ancestor. The iteration order is a pure function of the set, so the result converges
+// even for merges that are not associative (the reason pairwise-at-arrival diverged).
+const mergeFold = (merge) => {
+    return (siblings, ctx) => {
+        const ordered = [...siblings].sort((a, b) => compareSiblings(b, a));
+        const winner = ordered[0];
+        if (winner.kind !== 'set')
+            return { kind: winner.kind };
+        let acc = winner.value;
+        for (let i = 1; i < ordered.length; i++) {
+            const s = ordered[i];
+            if (s.kind !== 'set' || s.epoch !== winner.epoch)
+                continue;
+            acc = merge(s.prev, acc, s.value, ctx);
+        }
+        return { kind: 'set', value: acc };
+    };
+};
+const isContainer = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
 /**
- * The unsequenced-topology convergence core (op-protocol RFC §4): a per-path last-writer-wins
- * register map over the total order (hlc, writer), with subtree dominance. Order-independent:
- * any arrival order of the same envelope set yields the same state.
+ * The unsequenced-topology convergence core: a dot-citation multi-value register per path.
+ * An op supersedes exactly the sibling dots it cites; uncited concurrent writes stay live; a
+ * pluggable fold resolves the live set at read. Both the live set and any pure fold over it
+ * are functions of the delivered op SET, so any arrival order of the same envelopes (split,
+ * duplicated, cites-before-ops) yields the same state.
  */
 function createConvergingApply(opt) {
     const registers = new Map();
+    // per-path floor of this replica's own emitted epochs: monotone, survives reset() so a
+    // rehydrated replica can never re-emit below an epoch it already exposed
+    const floors = new Map();
+    // monotone ingest counter + the seq at which each live sibling arrived (keyed pathKey → origin).
+    // captureFrontier() reads the counter in O(1); a frontier-scoped stamp cites only siblings at or
+    // below the captured seq. Side-mapped so the public sibling/checkpoint shapes stay unchanged.
+    let ingestSeq = 0;
+    const seqs = new Map();
+    const setSeq = (key, origin, seq) => {
+        let sm = seqs.get(key);
+        if (!sm)
+            seqs.set(key, (sm = new Map()));
+        sm.set(origin, seq);
+    };
     const policies = compilePolicies(opt?.policies ?? []);
-    const resolveConcurrent = (winner, loser, path) => {
+    const customFolds = (opt?.folds ?? []).map((e) => ({
+        segments: typeof e.path === 'string' ? e.path.split('.') : e.path.map(String),
+        fold: e.fold,
+    }));
+    const foldFor = (path) => {
+        for (const f of customFolds) {
+            if (matchSegments(f.segments, path))
+                return f.fold;
+        }
         const merge = policyFor(policies, path);
-        if (merge === lww || winner.kind === 'delete' || loser.kind === 'delete') {
-            return winner;
+        if (merge === lww)
+            return defaultFold;
+        if (merge === preserve)
+            return preserveFold;
+        return mergeFold(merge);
+    };
+    const regAt = (path) => {
+        const key = keyOf$1(path);
+        let reg = registers.get(key);
+        if (!reg) {
+            reg = { path, siblings: new Map(), water: new Map(), sig: '' };
+            registers.set(key, reg);
+        }
+        return reg;
+    };
+    const liveOf = (reg) => {
+        const out = [];
+        for (const [o, s] of reg.siblings) {
+            const w = reg.water.get(o);
+            if (!w || compareHlc(s.hlc, w) > 0)
+                out.push(s);
         }
-        const resolved = merge(loser.prev, winner.next, loser.next, { path });
-        if (Object.is(resolved, winner.next))
-            return winner;
-        return { kind: 'set', path, next: resolved, prev: winner.next };
+        return out.sort((a, b) => a.origin < b.origin ? -1 : a.origin > b.origin ? 1 : 0);
     };
-    // a sequential edit carries the value it overwrote; a mismatch means neither saw the other.
-    // Structural, not referential: identity never survives the wire, so a peer that built on
-    // the replicated copy of a value must still count as sequential.
-    const concurrentWith = (incoming, registered) => {
-        if (incoming.kind === 'delete' || registered.kind === 'delete')
+    // The live siblings a frontier had observed: those that arrived at or below its captured seq.
+    // Used by a fork commit so it supersedes only what it saw when it forked, not later writes.
+    const liveObserved = (reg, frontier) => {
+        const live = liveOf(reg);
+        if (!frontier)
+            return live;
+        const sm = seqs.get(keyOf$1(reg.path));
+        return live.filter((s) => (sm?.get(s.origin) ?? 0) <= frontier.seq);
+    };
+    // JSON of a tuple array, not a separator-joined string: `origin` is a caller-supplied value on a
+    // P2P peer, so a naive `origin@p.l#epoch` join lets a crafted origin collide the signatures of two
+    // distinct live sets. A collision makes refresh() skip a fold update, and since that skip is
+    // arrival-order-sensitive it breaks convergence. JSON.stringify escapes the strings and the array
+    // structure is unambiguous, so the signature is injective in the live set.
+    const sigOf = (live) => JSON.stringify(live.map((s) => [s.origin, s.hlc.p, s.hlc.l, s.epoch, s.kind]));
+    /** Recompute the fold cache; true iff the materialized result meaningfully changed. */
+    const refresh = (reg) => {
+        const live = liveOf(reg);
+        const sig = sigOf(live);
+        if (sig === reg.sig)
             return false;
-        if (!Object.hasOwn(incoming, 'prev'))
-            return true;
-        return !structuralEq(incoming.prev, registered.next);
+        reg.sig = sig;
+        const next = live.length
+            ? foldFor(reg.path)(live, { path: reg.path })
+            : undefined;
+        const prev = reg.result;
+        const same = prev === next ||
+            (!!prev &&
+                !!next &&
+                prev.kind === next.kind &&
+                (prev.kind !== 'set' ||
+                    next.kind !== 'set' ||
+                    Object.is(prev.value, next.value) ||
+                    structuralEq(prev.value, next.value)));
+        if (same)
+            return false; // keep the previous result object: reference identity is the contract
+        reg.result = next;
+        return true;
+    };
+    const descendantsOf = (key) => {
+        const out = [];
+        for (const [k, r] of registers) {
+            if (k === key)
+                continue;
+            if (key === '' ? k !== '' : k.startsWith(key + SEP))
+                out.push(r);
+        }
+        return out.sort((a, b) => a.path.length - b.path.length ||
+            (keyOf$1(a.path) < keyOf$1(b.path) ? -1 : 1));
+    };
+    /** Does `value` still hold a key at `rel` (present, not merely undefined)? */
+    const holdsKey = (value, rel) => {
+        let cur = value;
+        for (const seg of rel) {
+            if (cur === null ||
+                typeof cur !== 'object' ||
+                !Object.hasOwn(cur, String(seg))) {
+                return false;
+            }
+            cur = cur[String(seg)];
+        }
+        return true;
+    };
+    // A lone tombstone is droppable only if nothing else still materializes its key: no live
+    // descendant register would resurface, and no live ancestor `set` value still holds it. Mirrors
+    // the relay's retention twin so a client that prunes converges with a joiner seeded from the relay.
+    const tombstoneDroppable = (key, reg) => {
+        for (const [k, other] of registers) {
+            if (k === key)
+                continue;
+            if (k.startsWith(key + SEP)) {
+                if (liveOf(other).length > 0)
+                    return false;
+            }
+            else if (key.startsWith(k === '' ? '' : k + SEP)) {
+                const rel = reg.path.slice(other.path.length);
+                for (const s of liveOf(other)) {
+                    if (s.kind === 'set' && holdsKey(s.value, rel))
+                        return false;
+                }
+            }
+        }
+        return true;
+    };
+    /** Nearest ancestor register that contributes a value or a deletion (clears abstain). */
+    const nearestContributing = (path) => {
+        for (let len = path.length - 1; len >= 0; len--) {
+            const reg = registers.get(keyOf$1(path.slice(0, len)));
+            if (reg?.result && reg.result.kind !== 'clear')
+                return reg;
+        }
+        return undefined;
+    };
+    // graft with the deterministic type-change rule: a graft whose parent location is not a plain
+    // record is DROPPED (the register stays intact and resurfaces if the container is restored)
+    const graft = (tree, rel, res) => {
+        if (!isContainer(tree))
+            return tree;
+        const head = String(rel[0]);
+        if (rel.length === 1) {
+            if (res.kind === 'delete') {
+                if (!Object.hasOwn(tree, head))
+                    return tree;
+                const copy = { ...tree };
+                delete copy[head];
+                return copy;
+            }
+            return { ...tree, [head]: res.value };
+        }
+        if (!Object.hasOwn(tree, head)) {
+            // vivify an absent middle container so a checkpoint-seeded materialization matches a peer that
+            // applied the ops incrementally (incremental apply creates missing parents). A numeric next
+            // segment vivifies an array, else an object, mirroring the incremental apply path.
+            const vivified = typeof rel[1] === 'number' ? [] : {};
+            return { ...tree, [head]: graft(vivified, rel.slice(1), res) };
+        }
+        const child = graft(tree[head], rel.slice(1), res);
+        return child === tree[head] ? tree : { ...tree, [head]: child };
+    };
+    /** Would a value at `rel` under `value` materialize, per the graft rules? */
+    const graftable = (value, rel) => {
+        let cur = value;
+        for (let i = 0; i < rel.length - 1; i++) {
+            if (!isContainer(cur) || !Object.hasOwn(cur, String(rel[i])))
+                return false;
+            cur = cur[String(rel[i])];
+        }
+        return isContainer(cur);
+    };
+    /**
+     * Whether a value at `path` materializes: every contributing ancestor register down the
+     * chain must be a `set` whose value composes containers to the next one. The drop rule is
+     * checked against the WHOLE chain, since a graft fine under its nearest ancestor can still drop
+     * at a scalar further up.
+     */
+    const shows = (path) => {
+        let holder;
+        for (let len = 0; len < path.length; len++) {
+            const reg = registers.get(keyOf$1(path.slice(0, len)));
+            if (!reg?.result || reg.result.kind === 'clear')
+                continue;
+            if (holder) {
+                const hres = holder.result;
+                if (!hres || hres.kind !== 'set')
+                    return false;
+                if (!graftable(hres.value, reg.path.slice(holder.path.length))) {
+                    return false;
+                }
+            }
+            holder = reg;
+        }
+        if (!holder)
+            return true; // nothing above constrains → vivify semantics
+        const hres = holder.result;
+        if (!hres || hres.kind !== 'set')
+            return false;
+        return graftable(hres.value, path.slice(holder.path.length));
+    };
+    /** Deepest-live-wins subtree value: the register's fold value with every live descendant fold grafted on. */
+    const materializeAt = (base) => {
+        const res = base.result;
+        let tree = res && res.kind === 'set' ? res.value : undefined;
+        for (const d of descendantsOf(keyOf$1(base.path))) {
+            const r = d.result;
+            if (!r || r.kind === 'clear')
+                continue;
+            if (!shows(d.path))
+                continue; // dropped under a deleted/scalar ancestor (matches applied deltas)
+            tree = graft(tree, d.path.slice(base.path.length), r);
+        }
+        return tree;
+    };
+    const deltas = (changed) => {
+        changed.sort((a, b) => a.reg.path.length - b.reg.path.length ||
+            (keyOf$1(a.reg.path) < keyOf$1(b.reg.path) ? -1 : 1));
+        const out = [];
+        const regions = [];
+        const covered = (key) => regions.some((r) => key === r || (r === '' ? true : key.startsWith(r + SEP)));
+        for (const { reg, before } of changed) {
+            const key = keyOf$1(reg.path);
+            if (covered(key))
+                continue;
+            const res = reg.result;
+            if (!res || res.kind === 'clear') {
+                // the register now abstains: re-materialize the nearest ancestor region it cleared out of
+                if (!reg.path.length)
+                    continue;
+                const anc = nearestContributing(reg.path);
+                const ares = anc?.result;
+                if (!anc || !ares || ares.kind !== 'set' || !shows(anc.path))
+                    continue;
+                out.push({ kind: 'set', path: anc.path, next: materializeAt(anc) });
+                regions.push(keyOf$1(anc.path));
+                continue;
+            }
+            if (!shows(reg.path))
+                continue; // dropped by the type-change rule or a deleted parent
+            if (res.kind === 'delete') {
+                if (!reg.path.length)
+                    continue; // a root delete is meaningless
+                out.push({
+                    kind: 'delete',
+                    path: reg.path,
+                    prev: before?.kind === 'set' ? before.value : undefined,
+                });
+            }
+            else {
+                out.push({ kind: 'set', path: reg.path, next: materializeAt(reg) });
+            }
+            regions.push(key);
+        }
+        return out;
     };
     return {
         ingest: (env, o) => {
-            const stamp = { hlc: env.hlc, writer: env.writer, origin: env.origin };
-            const out = [];
+            const touched = new Map();
+            const seq = ++ingestSeq;
             for (const op of env.ops) {
+                if (o?.frontier && compareHlc(env.hlc, o.frontier) <= 0)
+                    continue; // below the pruned horizon
+                // a delete or clear at the root has no parent register to abstain to; it can only blank the
+                // whole document, and materialize would then disagree with the delta path, so drop it
+                if (!op.path.length && op.kind !== 'set')
+                    continue;
+                const reg = regAt(op.path);
                 const key = keyOf$1(op.path);
-                let dominated = false;
-                let exact;
-                for (let len = 0; len <= op.path.length; len++) {
-                    const reg = registers.get(keyOf$1(op.path.slice(0, len)));
-                    if (!reg)
+                if (!touched.has(key))
+                    touched.set(key, { reg, before: reg.result });
+                const sop = op;
+                for (const c of sop.cites ?? []) {
+                    // a self-citation (the op citing its own dot) would born-dead the write; ignore it
+                    if (c.origin === env.origin && compareHlc(c.hlc, env.hlc) === 0)
                         continue;
-                    if (len === op.path.length)
-                        exact = reg;
-                    else if (beats(reg, stamp)) {
-                        dominated = true;
-                        break;
+                    const cur = reg.water.get(c.origin);
+                    if (!cur || compareHlc(c.hlc, cur) > 0)
+                        reg.water.set(c.origin, c.hlc);
+                }
+                const best = reg.siblings.get(env.origin);
+                if (!best || compareHlc(env.hlc, best.hlc) > 0) {
+                    const sib = {
+                        kind: op.kind,
+                        writer: env.writer,
+                        origin: env.origin,
+                        hlc: env.hlc,
+                        epoch: sop.epoch ?? 0,
+                    };
+                    if (op.kind === 'set')
+                        sib.value = op.next;
+                    if (op.kind !== 'clear' && Object.hasOwn(op, 'prev')) {
+                        sib.prev = op.prev;
                     }
+                    reg.siblings.set(env.origin, sib);
+                    setSeq(key, env.origin, seq);
                 }
-                if (dominated)
+                if (o?.local && (sop.epoch ?? 0) > 0) {
+                    floors.set(key, Math.max(floors.get(key) ?? 0, sop.epoch));
+                }
+            }
+            const changed = [];
+            for (const c of touched.values()) {
+                if (refresh(c.reg))
+                    changed.push(c);
+            }
+            if ((o?.local && !o?.reconcile) || !changed.length)
+                return [];
+            return deltas(changed);
+        },
+        stamp: (ops, o) => {
+            const out = [];
+            const bump = o?.bump ? 1 : 0;
+            const frontier = o?.frontier;
+            const epochFor = (key, live) => {
+                let e = floors.get(key) ?? 0;
+                for (const s of live)
+                    if (s.epoch > e)
+                        e = s.epoch;
+                return e + bump;
+            };
+            for (const op of ops) {
+                const key = keyOf$1(op.path);
+                const reg = registers.get(key);
+                const live = reg ? liveObserved(reg, frontier) : [];
+                out.push({
+                    ...op,
+                    cites: live.map((s) => ({ origin: s.origin, hlc: s.hlc })),
+                    epoch: epochFor(key, live),
+                });
+                if (op.kind === 'clear')
                     continue;
-                if (exact && beats(exact, stamp)) {
-                    if (concurrentWith(op, exact.op)) {
-                        const resolved = resolveConcurrent(exact.op, op, op.path);
-                        if (resolved !== exact.op) {
-                            exact.op = resolved;
-                            if (!o?.local)
-                                out.push(resolved);
-                        }
-                    }
+                for (const d of descendantsOf(key)) {
+                    if (d.result?.kind === 'clear')
+                        continue; // already abstaining
+                    const dlive = liveObserved(d, frontier);
+                    if (!dlive.length)
+                        continue;
+                    out.push({
+                        kind: 'clear',
+                        path: d.path,
+                        cites: dlive.map((s) => ({ origin: s.origin, hlc: s.hlc })),
+                        epoch: epochFor(keyOf$1(d.path), dlive),
+                    });
+                }
+            }
+            return out;
+        },
+        captureFrontier: () => ({ seq: ingestSeq }),
+        liveAt: (path) => {
+            const reg = registers.get(keyOf$1(path));
+            return reg ? liveOf(reg) : [];
+        },
+        materialize: () => {
+            const root = registers.get('');
+            const res = root?.result;
+            let tree = res && res.kind === 'set' ? res.value : undefined;
+            for (const d of descendantsOf('')) {
+                const r = d.result;
+                if (!r || r.kind === 'clear')
                     continue;
+                if (!shows(d.path))
+                    continue; // dropped under a deleted/scalar ancestor (matches applied deltas)
+                if (tree === undefined)
+                    tree = {}; // vivify: deeper registers materialize without a root write
+                tree = graft(tree, d.path, r);
+            }
+            return tree;
+        },
+        checkpoint: () => {
+            const out = [];
+            for (const reg of registers.values()) {
+                out.push({
+                    path: reg.path,
+                    siblings: [...reg.siblings.values()],
+                    water: Object.fromEntries(reg.water),
+                });
+            }
+            return out;
+        },
+        load: (regs) => {
+            const seq = ++ingestSeq;
+            for (const r of regs) {
+                const reg = regAt(r.path);
+                const key = keyOf$1(r.path);
+                for (const s of r.siblings) {
+                    const cur = reg.siblings.get(s.origin);
+                    if (!cur || compareHlc(s.hlc, cur.hlc) > 0) {
+                        reg.siblings.set(s.origin, s);
+                        setSeq(key, s.origin, seq);
+                    }
                 }
-                let accepted = op;
-                if (exact && concurrentWith(op, exact.op)) {
-                    accepted = resolveConcurrent(op, exact.op, op.path);
+                for (const [o, h] of Object.entries(r.water)) {
+                    const cur = reg.water.get(o);
+                    if (!cur || compareHlc(h, cur) > 0)
+                        reg.water.set(o, h);
                 }
-                const isDescendant = key === ''
-                    ? (k) => k !== ''
-                    : (k) => k.startsWith(key + SEP);
-                const replays = [];
-                for (const [k, reg] of registers) {
-                    if (!isDescendant(k))
-                        continue;
-                    if (beats(stamp, reg))
-                        registers.delete(k);
-                    else
-                        replays.push(reg);
+                if (opt?.origin) {
+                    const own = reg.siblings.get(opt.origin);
+                    if (own) {
+                        floors.set(key, Math.max(floors.get(key) ?? 0, own.epoch));
+                    }
+                }
+                refresh(reg);
+            }
+        },
+        prune: (frontier) => {
+            for (const [key, reg] of [...registers]) {
+                const sm = seqs.get(key);
+                for (const [o, s] of [...reg.siblings]) {
+                    const w = reg.water.get(o);
+                    if (compareHlc(s.hlc, frontier) <= 0 &&
+                        w &&
+                        compareHlc(s.hlc, w) <= 0) {
+                        reg.siblings.delete(o);
+                        sm?.delete(o);
+                    }
+                }
+                for (const [o, h] of [...reg.water]) {
+                    if (compareHlc(h, frontier) <= 0)
+                        reg.water.delete(o);
                 }
-                replays.sort(compareStamp);
-                registers.set(key, { hlc: env.hlc, writer: env.writer, origin: env.origin, op: accepted });
-                if (!o?.local) {
-                    out.push(accepted);
-                    for (const r of replays)
-                        out.push(r.op);
+                if (reg.siblings.size === 0 && reg.water.size === 0) {
+                    registers.delete(key);
+                    seqs.delete(key);
+                    floors.delete(key);
                 }
             }
-            return out;
+            const byDepth = [...registers.entries()].sort((a, b) => b[1].path.length - a[1].path.length);
+            for (const [key, reg] of byDepth) {
+                const live = liveOf(reg);
+                if (live.length === 1 &&
+                    live[0].kind === 'delete' &&
+                    reg.siblings.size === 1 &&
+                    compareHlc(live[0].hlc, frontier) <= 0 &&
+                    tombstoneDroppable(key, reg)) {
+                    registers.delete(key);
+                    seqs.delete(key);
+                    floors.delete(key);
+                }
+            }
+        },
+        reset: () => {
+            registers.clear();
+            seqs.clear();
         },
-        reset: () => registers.clear(),
     };
 }
 function getAtPath(root, path) {
@@ -5192,7 +5891,7 @@ function getAtPath(root, path) {
     return cur;
 }
 /**
- * The shared rebase routine (op-protocol RFC §5): invert pending, apply remote, re-apply
+ * The shared rebase routine: invert pending, apply remote, re-apply
  * pending through the merge policies. Pure — branching's `rebase()` and the sequenced relay
  * client both call this.
  */
@@ -5207,6 +5906,10 @@ function rebaseOps(root, pending, remote, policies) {
     for (const batch of pending) {
         const next = [];
         for (const op of batch) {
+            if (op.kind === 'clear') {
+                next.push(op); // a register intent, not a value change: passes through untouched
+                continue;
+            }
             const cur = getAtPath(base, op.path);
             if (op.kind === 'delete') {
                 next.push({ kind: 'delete', path: op.path, prev: cur });
@@ -5245,40 +5948,108 @@ function generateOrigin() {
 }
 /**
  * Wires a copy-on-write signal (a `store` root) to the op protocol: local writes emit
- * stamped envelopes, received envelopes fold in through the converging apply. The
- * unsequenced-topology client core that `tabSync(store)` and P2P transports build on.
+ * stamped envelopes (citing the sibling dots they observed), received envelopes fold in
+ * through the converging register. The unsequenced-topology client core that
+ * `tabSync(store)` and P2P transports build on.
  */
 const RECENT_LOCAL_CAP = 64;
 function opSync(source, opt) {
     const origin = opt.origin ?? generateOrigin();
     const clock = opt.clock ?? createHlcClock();
-    const conv = createConvergingApply({ policies: opt.policies });
+    const conv = createConvergingApply({
+        policies: opt.policies,
+        folds: opt.folds,
+        origin,
+    });
     const subscribers = new Set();
+    // per-origin high-watermark; `versions.get(origin)` IS the local emit counter, so a hydrate/restore
+    // that raises our own watermark also advances the next mint — no separate counter to drift out of
+    // sync and collide with a version acked before a reboot but dropped from a debounced outbox.
     const versions = new Map();
     const recentLocal = [];
-    let version = 0;
+    // highest stability frontier this peer has pruned to. A remote envelope at or below it is a settled
+    // straggler (its state is compacted away); re-admitting one could resurrect a value below the
+    // frontier, and per-origin version dedup cannot catch a FIRST-CONTACT straggler (no prior entry),
+    // so the frontier is the admission gate that closes that hole on the receive path.
+    let prunedFrontier;
+    const resolvedInjector = opt.driver
+        ? null
+        : (opt.injector ?? inject(Injector));
     const log = opLog(source, opt.driver
         ? { origin, driver: opt.driver }
-        : { origin, injector: opt.injector ?? inject(Injector) });
+        : { origin, injector: resolvedInjector });
+    // Local envelopes stamped + registered but not yet handed to the transport. A `receive` freezes
+    // this peer's pending writes here so it can ingest the remote WITHOUT emitting mid-receive — the
+    // synchronous re-entrant emission that used to scramble the relay's commit order. The outbox
+    // drains on a LATER tick, so emission always lands outside any receive callstack. Writes made
+    // while a drain is still owed queue here too, keeping wire order == version order (else a receiver
+    // would dedup the older, still-frozen envelope).
+    //
+    // Deferral rides an Angular effect, so it arms only on the injector path — the transport
+    // topologies (`tabSync`, `meshSync`) that actually re-enter through a relay. A custom `driver`
+    // (worker mirror, pure sim, multi-reader) owns its own scheduling and has no such re-entrancy, so
+    // it emits synchronously; the freeze-before-observe STAMPING fix below is identical either way.
+    const canDefer = !opt.driver;
+    const outbox = [];
+    let receiving = false;
+    let bumping = false;
+    // set while a synced fork's commit is emitting: freezes emission cites to what the fork observed
+    let scopeFrontier;
+    // a signal the drain reaction tracks; bumping it schedules an outbox drain for the next tick
+    const drainTick = signal(0, ...(ngDevMode ? [{ debugName: "drainTick" }] : []));
+    const scheduleDrain = () => drainTick.update((v) => v + 1);
+    const notify = (env) => {
+        for (const cb of [...subscribers])
+            cb(env);
+    };
+    const drainOutbox = () => {
+        for (const env of outbox.splice(0))
+            notify(env);
+    };
     const emitLocal = (ops) => {
+        const frontier = scopeFrontier;
+        const stamped = conv.stamp(ops, { bump: bumping, frontier });
+        const nextVersion = (versions.get(origin) ?? 0) + 1;
         const env = {
             proto: OP_PROTO_VERSION,
             origin,
             writer: opt.writer,
-            version: ++version,
+            version: nextVersion,
             hlc: clock.next(),
             policyVersion: opt.policyVersion ?? 0,
-            ops,
+            ops: stamped,
         };
-        versions.set(origin, env.version);
-        conv.ingest(env, { local: true });
+        versions.set(origin, nextVersion);
+        if (frontier) {
+            // a fork commit: its ops are concurrent siblings (they cite only the fork-time frontier), so
+            // move the store to the fold winner rather than leaving the raw committed value in place
+            const reconciled = conv.ingest(env, { local: true, reconcile: true });
+            if (reconciled.length)
+                log.apply(reconciled);
+        }
+        else {
+            conv.ingest(env, { local: true });
+        }
         recentLocal.push(env);
         if (recentLocal.length > RECENT_LOCAL_CAP)
             recentLocal.shift();
-        for (const cb of [...subscribers])
-            cb(env);
+        // mid-receive, or a drain still owed → queue (frozen stamp verbatim) instead of emitting now
+        if (canDefer && (receiving || outbox.length)) {
+            outbox.push(env);
+            scheduleDrain();
+            return;
+        }
+        notify(env);
     };
     const unsub = log.subscribe((batch) => emitLocal(batch.ops));
+    // fires on the tick after `scheduleDrain`: emits frozen local envelopes outside any receive frame
+    const drainRun = () => {
+        drainTick();
+        untracked(drainOutbox);
+    };
+    const drainRef = canDefer
+        ? effect(drainRun, { injector: resolvedInjector })
+        : null;
     return {
         origin,
         subscribe: (cb) => {
@@ -5290,11 +6061,25 @@ function opSync(source, opt) {
                 return;
             if (env.proto !== OP_PROTO_VERSION) {
                 if (isDevMode()) {
-                    console.warn(`[@mmstack/primitives] dropped envelope with proto ${env.proto} (expected ${OP_PROTO_VERSION})`);
+                    console.warn(`[@mmstack/primitives] dropped envelope with proto ${env.proto} (expected ${OP_PROTO_VERSION}: ops must carry cites + epoch; emitters from another protocol version are rejected rather than silently mixed)`);
                 }
                 return;
             }
-            clock.observe(env.hlc);
+            const reason = validateEnvelope(env);
+            if (reason !== null) {
+                if (isDevMode()) {
+                    console.warn(`[@mmstack/primitives] dropped malformed envelope (${reason}) from origin ${String(env.origin)}`);
+                }
+                opt.onReject?.(env, reason);
+                return;
+            }
+            // a settled straggler at or below the pruned stability frontier: reject it (its state is
+            // compacted, re-admitting could resurrect a below-frontier value). All ops in an envelope share
+            // its stamp, so the envelope hlc is the dot for every op. The live relay path never delivers a
+            // below-frontier op (a lagging client gets a snapshot, not a delta), so this only fires on a
+            // stray re-broadcast, e.g. over a P2P/multi-path topology.
+            if (prunedFrontier && compareHlc(env.hlc, prunedFrontier) <= 0)
+                return;
             const known = versions.get(env.origin);
             if (known !== undefined && env.version <= known)
                 return; // duplicate/covered — idempotent
@@ -5302,43 +6087,140 @@ function opSync(source, opt) {
                 opt.onGap?.(env.origin, known + 1, env.version);
             }
             versions.set(env.origin, env.version);
+            receiving = true;
+            try {
+                log.flush();
+                clock.observe(env.hlc);
+                const ops = conv.ingest(env);
+                if (ops.length)
+                    log.apply(ops);
+            }
+            finally {
+                receiving = false;
+            }
+        },
+        flush: () => {
+            drainOutbox();
             log.flush();
-            const ops = conv.ingest(env);
-            if (ops.length)
-                log.apply(ops);
         },
-        flush: () => log.flush(),
+        override: (fn) => {
+            log.flush(); // earlier pending writes emit un-bumped
+            bumping = true;
+            try {
+                fn();
+                log.flush();
+            }
+            finally {
+                bumping = false;
+            }
+        },
+        captureFrontier: () => {
+            log.flush(); // fold pending base writes in first, so they count as observed
+            return conv.captureFrontier();
+        },
+        commitScope: (frontier, fn) => {
+            log.flush(); // earlier pending writes emit against the live frontier, not this one
+            scopeFrontier = frontier;
+            try {
+                fn();
+                log.flush(); // stamp + register the scoped writes now, while the frontier is frozen
+            }
+            finally {
+                scopeFrontier = undefined;
+            }
+        },
         watermark: () => Object.fromEntries(versions),
+        prune: (frontier) => {
+            if (!prunedFrontier || compareHlc(frontier, prunedFrontier) > 0) {
+                prunedFrontier = frontier;
+            }
+            conv.prune(frontier);
+        },
         snapshot: () => {
             log.flush();
-            return { root: untracked(source), wm: Object.fromEntries(versions) };
+            return {
+                root: untracked(source),
+                registers: conv.checkpoint(),
+                wm: Object.fromEntries(versions),
+            };
         },
         seed: () => {
             log.flush();
             emitLocal([{ kind: 'set', path: [], next: untracked(source) }]);
         },
-        hydrate: (root, wm) => {
+        hydrate: (state, pending) => {
             log.flush();
-            const covered = wm?.[origin] ?? 0;
-            const pending = recentLocal.filter((e) => e.version > covered);
+            // rebase this origin's uncovered local writes on top. A caller that keeps a durable outbox
+            // (meshSync, the worker replica) passes its full unacked set, so a long offline burst larger
+            // than the in-memory `recentLocal` cap is never dropped from the rebase; without it, fall back
+            // to the recent-local ring.
+            const source = pending ?? recentLocal;
+            const toReplay = source.filter((e) => e.version > (state.wm?.[e.origin] ?? 0));
             conv.reset();
-            let next = root;
-            for (const e of pending)
-                next = applyOps(next, e.ops);
-            log.apply([{ kind: 'set', path: [], next }]);
-            for (const [o, v] of Object.entries(wm ?? {})) {
+            conv.load(state.registers ?? []);
+            const deltas = [];
+            for (const e of toReplay) {
+                deltas.push(...conv.ingest(e, { local: true, reconcile: true }));
+            }
+            log.apply([
+                { kind: 'set', path: [], next: applyOps(state.root, deltas) },
+            ]);
+            for (const [o, v] of Object.entries(state.wm ?? {})) {
                 versions.set(o, Math.max(versions.get(o) ?? 0, v));
             }
-            for (const e of pending)
-                conv.ingest(e, { local: true });
+        },
+        restore: (envs, highWater) => {
+            let tailOrigin;
+            for (const env of envs) {
+                clock.observe(env.hlc); // keep the clock ≥ restored stamps before any future mint
+                log.apply(env.ops); // reflect the offline edit in the store, echo-free
+                conv.ingest(env, { local: true }); // register as a local winner (survives a reconnect merge)
+                recentLocal.push(env);
+                if (recentLocal.length > RECENT_LOCAL_CAP)
+                    recentLocal.shift();
+                versions.set(env.origin, Math.max(versions.get(env.origin) ?? 0, env.version));
+                tailOrigin = env.origin;
+                notify(env); // hand to the transport to resend the unacknowledged tail
+            }
+            if (highWater != null && tailOrigin != null) {
+                versions.set(tailOrigin, Math.max(versions.get(tailOrigin) ?? 0, highWater));
+            }
         },
         destroy: () => {
+            drainOutbox(); // don't silently drop frozen-but-unsent local writes
             unsub();
             subscribers.clear();
+            drainRef?.destroy();
             log.destroy();
         },
     };
 }
+/**
+ * Fork a synced store for isolated edits (an agent branch, a staged review), keeping the correct
+ * emission semantics on commit. The fork observes the base as it was when this call ran; committing
+ * emits its diff citing only those observed dots, so an edit that landed on the base mid-flight
+ * stays a concurrent sibling and the configured fold decides between them, rather than the commit
+ * overwriting a write it never saw. `rebase()` re-observes the base (a following commit then
+ * supersedes what is visible now, the reviewed-and-apply step). Pass the same `store` and `sync`
+ * that are wired together; the fork is a plain {@link Fork} otherwise, so `forkStore` itself stays
+ * sync-agnostic.
+ */
+function syncedFork(sync, store, opt) {
+    let frontier = sync.captureFrontier();
+    const f = forkStore(store, opt);
+    return {
+        store: f.store,
+        ops: f.ops,
+        commit: () => sync.commitScope(frontier, () => f.commit()),
+        discard: () => {
+            f.discard();
+            frontier = sync.captureFrontier();
+        },
+        rebase: () => {
+            frontier = sync.captureFrontier();
+        },
+    };
+}
 
 /**
  * Undo/redo for a copy-on-write store, built on the op-log: each tracked change is stored as
@@ -5609,7 +6491,7 @@ const isPlainArray = (v) => Array.isArray(v) && !isOpaque(v);
 function keyOf(item, key) {
     if (typeof key === 'function')
         return key(item);
-    return isRecord(item) ? item[key] : item;
+    return isRecord$1(item) ? item[key] : item;
 }
 /**
  * Produces a value equal to `next` but sharing as much of `prev`'s reference structure as possible:
@@ -5638,7 +6520,7 @@ function reconcileValue(prev, next, key) {
         });
         return changed ? out : prev;
     }
-    if (isRecord(prev) && isRecord(next)) {
+    if (isRecord$1(prev) && isRecord$1(next)) {
         const nextKeys = Object.keys(next);
         let changed = Object.keys(prev).length !== nextKeys.length;
         const out = {};
@@ -5898,7 +6780,7 @@ function stored(fallback, { key, store: providedStore, serialize = JSON.stringif
     return writable;
 }
 
-/** Op-mode sync for a writable store: hello exchange, then live envelopes (RFC §6 tab flavor). */
+/** Op-mode sync for a writable store: hello exchange, then live envelopes. */
 function storeTabSync(sig, opt, bus, injector) {
     const sync = opSync(sig, {
         writer: opt.writer ?? 'local',
@@ -5942,7 +6824,7 @@ function storeTabSync(sig, opt, bus, injector) {
                     const covered = Object.entries(snap.wm).every(([origin, v]) => (msg.wm[origin] ?? 0) >= v);
                     post(covered
                         ? { t: 'uptodate', to: msg.from }
-                        : { t: 'state', to: msg.from, root: snap.root, wm: snap.wm });
+                        : { t: 'state', to: msg.from, state: snap });
                 }, Math.random() * jitterMs);
                 responseTimers.set(msg.from, timer);
                 return;
@@ -5957,7 +6839,7 @@ function storeTabSync(sig, opt, bus, injector) {
                 if (msg.to !== sync.origin || phase !== 'joining')
                     return;
                 if (msg.t === 'state')
-                    sync.hydrate(msg.root, msg.wm);
+                    sync.hydrate(msg.state);
                 goLive();
                 return;
             }
@@ -5980,6 +6862,12 @@ function storeTabSync(sig, opt, bus, injector) {
 class MessageBus {
     channel = new BroadcastChannel('mmstack-tab-sync-bus');
     listeners = new Map();
+    constructor() {
+        inject(DestroyRef).onDestroy(() => {
+            this.channel.close();
+            this.listeners.clear();
+        });
+    }
     subscribe(id, listener) {
         const wrapped = (ev) => {
             try {
@@ -6010,10 +6898,6 @@ class MessageBus {
             post: (value) => this.channel.postMessage({ id, value }),
         };
     }
-    ngOnDestroy() {
-        this.channel.close();
-        this.listeners.clear();
-    }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: MessageBus, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
     static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: MessageBus, providedIn: 'root' });
 }
@@ -6022,7 +6906,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.17", ngImpo
             args: [{
                     providedIn: 'root',
                 }]
-        }] });
+        }], ctorParameters: () => [] });
 /**
  * @deprecated The generated id hashes the call-site stack line, which collides when a shared
  * helper calls {@link tabSync} for multiple signals and diverges across minified builds during
@@ -6087,7 +6971,7 @@ function tabSync(sig, opt) {
     if (isPlatformServer(injector.get(PLATFORM_ID)))
         return sig;
     const id = typeof opt === 'string' ? opt : (opt?.id ?? generateDeterministicID());
-    const bus = injector.get(MessageBus);
+    const bus = optObj?.bus ?? injector.get(MessageBus);
     const storeKind = sig[STORE_KIND];
     if (storeKind === 'writable') {
         storeTabSync(sig, { ...optObj, id }, bus, injector);
@@ -6329,5 +7213,5 @@ function withHistory(sourceOrValue, opt) {
  * Generated bundle index. Do not edit.
  */
 
-export { CONCURRENCY_INSTRUMENTATION, MmActivity, MmTransition, MmViewTransitionName, OP_PROTO_VERSION, PAUSABLE_OPTIONS, PERSISTED_STORE_OPTIONS, SuspenseBoundary, SuspenseBoundaryBase, UnscopedSuspenseBoundary, activeTransaction, applyOps, batteryStatus, bridgeScopeToPendingTasks, chunked, clipboard, combineWith, compareHlc, compareTotal, createAttributedPending, createConvergingApply, createForwardingScope, createHlcClock, createStoreContext, createTransaction, createTransitionScope, debounce, debounced, deferredValue, derived, diffOps, distinct, elementSize, elementVisibility, extendStore, filter, filterWith, focusWithin, forkStore, geolocation, getTransitionScope, holdUntilReady, idle, indexArray, injectPaused, injectRegisterResource, injectStartTransaction, injectStartTransition, injectTransitionScope, invertBatch, isConflicted, isDerivation, isLeaf, isMutable, isOpaque, isStore, keepPrevious, keyArray, keyedArray, latest, lww, map, mapArray, mapObject, mediaQuery, merge3, mergeThree, mousePosition, mutable, mutableStore, nestedEffect, networkStatus, opLog, opSync, opaque, orientation, pageVisibility, pairwise, pausableComputed, pausableEffect, pausableSignal, perfCustomTracks, persist, persistedStore, pipeable, piped, pointerDrag, policyStrategy, pooled, pooledArray, pooledMap, pooledSet, prefersDarkMode, prefersReducedMotion, preserve, projection, provideConcurrencyInstrumentation, provideForwardingTransitionScope, providePausableOptions, providePaused, providePersistedStoreOptions, provideTransitionScope, rebaseOps, reconcile, registerResource, resolvePause, scan, scrollPosition, select, sensor, sensors, signalFromEvent, startWith, store, storeHistory, stored, tabSync, tap, throttle, throttled, toFakeDerivation, toFakeSignalDerivation, toStore, toWritable, until, use, windowSize, withHistory };
+export { CONCURRENCY_INSTRUMENTATION, MmActivity, MmTransition, MmViewTransitionName, OP_PROTO_VERSION, PAUSABLE_OPTIONS, PERSISTED_STORE_OPTIONS, POS_SEGMENT, SuspenseBoundary, SuspenseBoundaryBase, UnscopedSuspenseBoundary, activeTransaction, applyOps, batteryStatus, bridgeScopeToPendingTasks, chunked, clipboard, combineWith, compareHlc, compareSiblings, compareTotal, createAttributedPending, createConvergingApply, createForwardingScope, createHlcClock, createStoreContext, createTransaction, createTransitionScope, debounce, debounced, defaultFold, deferredValue, derived, diffOps, distinct, elementSize, elementVisibility, extendStore, filter, filterWith, focusWithin, forkStore, geolocation, getTransitionScope, holdUntilReady, idle, indexArray, injectPaused, injectRegisterResource, injectStartTransaction, injectStartTransition, injectTransitionScope, insertElement, invertBatch, isConflicted, isDerivation, isLeaf, isMutable, isOpaque, isStore, keepPrevious, keyArray, keyedArray, latest, lww, map, mapArray, mapObject, mediaQuery, merge3, mergeThree, mousePosition, moveElement, mutable, mutableStore, nestedEffect, networkStatus, opLog, opSync, opaque, orderedEntries, orientation, pageVisibility, pairwise, pausableComputed, pausableEffect, pausableSignal, perfCustomTracks, persist, persistedStore, pipeable, piped, pointerDrag, policyStrategy, pooled, pooledArray, pooledMap, pooledSet, posBetween, prefersDarkMode, prefersReducedMotion, preserve, projection, provideConcurrencyInstrumentation, provideForwardingTransitionScope, providePausableOptions, providePaused, providePersistedStoreOptions, provideTransitionScope, rebalanceContainer, rebaseOps, reconcile, registerResource, removeElement, resolvePause, scan, scrollPosition, select, sensor, sensors, signalFromEvent, startWith, store, storeHistory, stored, syncedFork, tabSync, tap, throttle, throttled, toFakeDerivation, toFakeSignalDerivation, toStore, toWritable, until, use, validateEnvelope, windowSize, withHistory };
 //# sourceMappingURL=mmstack-primitives.mjs.map