@mmstack/primitives 21.7.0 → 21.8.1

package/fesm2022/mmstack-primitives.mjs

@@ -4052,7 +4052,7 @@ function isOpaque(value) {
 function isWritableSignal(value) {
     return isWritableSignal$2(value);
 }
-function isRecord(value) {
+function isRecord$1(value) {
     if (value === null || typeof value !== 'object' || isOpaque(value))
         return false;
     const proto = Object.getPrototypeOf(value);
@@ -4068,7 +4068,7 @@ function isLeafValue(value, vivifyEnabled) {
         return !vivifyEnabled;
     if (isOpaque(value))
         return true; // opaque always wins — even arrays
-    return !Array.isArray(value) && !isRecord(value);
+    return !Array.isArray(value) && !isRecord$1(value);
 }
 /**
  * @internal
@@ -4081,7 +4081,7 @@ function resolveVivify(sample, option) {
         return false;
     if (Array.isArray(sample))
         return 'array';
-    if (isRecord(sample))
+    if (isRecord$1(sample))
         return 'object';
     return 'auto';
 }
@@ -4106,7 +4106,7 @@ function createFallbackOnChange(target, prop, vivifyFn, isMutableSource) {
             ? container
             : Array.isArray(container)
                 ? container.slice()
-                : isRecord(container)
+                : isRecord$1(container)
                     ? { ...container }
                     : container; // non-plain leaf (Date/class instance): legacy in-place attempt
         try {
@@ -4243,7 +4243,7 @@ const isPlainArray$1 = (v) => Array.isArray(v) && !isOpaque(v);
 function diffNode(prev, next, path, ops) {
     if (Object.is(prev, next))
         return;
-    if (isRecord(prev) && isRecord(next)) {
+    if (isRecord$1(prev) && isRecord$1(next)) {
         for (const key of Object.keys(prev)) {
             if (!Object.hasOwn(next, key))
                 ops.push({ kind: 'delete', path: [...path, key], prev: prev[key] });
@@ -4276,9 +4276,11 @@ function diffNode(prev, next, path, ops) {
 /** Immutably applies one op along its path, vivifying missing containers `'auto'`-style. */
 function applyAt(container, path, idx, op) {
     const seg = path[idx];
+    if (seg === '__proto__')
+        return container;
     const base = isPlainArray$1(container)
         ? container.slice()
-        : isRecord(container)
+        : isRecord$1(container)
             ? { ...container }
             : typeof seg === 'number'
                 ? []
@@ -4307,6 +4309,8 @@ function applyOps(root, ops) {
     const list = Array.isArray(ops) ? ops : ops.ops;
     let next = root;
     for (const op of list) {
+        if (op.kind === 'clear')
+            continue; // register retirement, never a value change
         if (op.path.length === 0) {
             if (op.kind === 'set')
                 next = op.next;
@@ -4320,7 +4324,8 @@ function applyOps(root, ops) {
  * Pure reference-pruned structural diff of two roots into minimal ops (the emission core of
  * {@link opLog}, exported so code outside a log can produce a batch — e.g. diffing a scratch
  * draft against a replica's current value to route a write to its owner). Trusts the
- * copy-on-write contract: an untouched subtree that kept its reference is skipped.
+ * copy-on-write contract: an untouched subtree that kept its reference is skipped. Emits only
+ * `set` and `delete`; `clear` is an emission-layer intent, never a diff product.
  */
 function diffOps(prev, next) {
     const ops = [];
@@ -4331,20 +4336,21 @@ function diffOps(prev, next) {
  * Inverts a batch for undo: reversed order, `set`↔its own inverse (an add — a `set` with no
  * `prev` — inverts to a `delete`; a `delete` inverts to a `set` restoring `prev`). Feed the
  * result to {@link OpLog.apply}. Requires the ops' `prev`s, which in-memory batches always
- * carry — a wire-serialized batch that stripped them is not invertible.
+ * carry (a wire-serialized batch that stripped them is not invertible). A `clear` is skipped:
+ * it never changed a value, so it has no independent inverse (the accompanying subtree `set`'s
+ * `prev` subsumes restoration).
  */
 function invertBatch(batch) {
     const ops = Array.isArray(batch) ? batch : batch.ops;
     const inverted = [];
     for (let i = ops.length - 1; i >= 0; i--) {
         const op = ops[i];
+        if (op.kind === 'clear')
+            continue;
         if (op.kind === 'delete') {
-            inverted.push({
-                kind: 'set',
-                path: op.path,
-                next: op.prev,
-                prev: undefined,
-            });
+            // no `prev`: the key is ABSENT once the delete applied, so this inverse is an add —
+            // inverting it again yields the delete back (redo removes the key, not sets undefined)
+            inverted.push({ kind: 'set', path: op.path, next: op.prev });
             continue;
         }
         if (!Object.hasOwn(op, 'prev')) {
@@ -4497,7 +4503,7 @@ function buildChildNode(target, prop, isMutableSource, options) {
     const value = untracked(target);
     const nodeVivify = resolveVivify(value, options.vivify);
     const vivifyFn = createVivify(nodeVivify);
-    const equalFn = isMutableSource && (isRecord(value) || Array.isArray(value))
+    const equalFn = isMutableSource && (isRecord$1(value) || Array.isArray(value))
         ? mutableChildEqual
         : undefined;
     const computation = derived(target, {
@@ -4546,7 +4552,7 @@ function toStore(source, { injector, vivify = false, noUnionLeaves = false, ...r
         const v = source();
         if (Array.isArray(v) && !isOpaque(v))
             return 'array';
-        if (isRecord(v))
+        if (isRecord$1(v))
             return 'record';
         return 'primitive';
     }, ...(ngDevMode ? [{ debugName: "kind" }] : /* istanbul ignore next */ []));
@@ -4594,7 +4600,7 @@ function toStore(source, { injector, vivify = false, noUnionLeaves = false, ...r
                 arr[len] = 'length';
                 return arr;
             }
-            if (!isRecord(v))
+            if (!isRecord$1(v))
                 return [];
             return Reflect.ownKeys(v);
         },
@@ -4612,7 +4618,7 @@ function toStore(source, { injector, vivify = false, noUnionLeaves = false, ...r
                     return { enumerable: true, configurable: true };
                 return;
             }
-            if (!isRecord(v) || !(prop in v))
+            if (!isRecord$1(v) || !(prop in v))
                 return;
             return { enumerable: true, configurable: true };
         },
@@ -4951,23 +4957,110 @@ function createHlcClock(now = Date.now) {
     };
 }
 
-const OP_PROTO_VERSION = 1;
+/**
+ * Wire protocol version. Version 2 ops carry `cites` + `epoch` (the dot-citation register);
+ * envelopes from other versions are dropped loudly: an op without citations cannot be merged
+ * soundly (it would supersede nothing and its siblings would accumulate forever), so versions
+ * are never silently mixed.
+ */
+const OP_PROTO_VERSION = 2;
 const CONFLICT_BRAND = '~mmstackConflict';
 function isConflicted(value) {
     return typeof value === 'object' && value !== null && CONFLICT_BRAND in value;
 }
+const hasControlChar = (s) => {
+    for (let i = 0; i < s.length; i++)
+        if (s.charCodeAt(i) < 0x20)
+            return true;
+    return false;
+};
+const isCleanId = (v) => typeof v === 'string' && v.length > 0 && !hasControlChar(v);
+const isFiniteHlc = (h) => !!h &&
+    typeof h === 'object' &&
+    Number.isFinite(h.p) &&
+    Number.isFinite(h.l);
+/**
+ * Deterministic, total well-formedness check for a received envelope. Returns a short reason
+ * string when the envelope must be rejected WHOLE, or `null` when it is well-formed. It reads only
+ * the envelope (no clock, no local state), so every replica accepts or rejects a given envelope
+ * identically. This validates SHAPE, not authority: it closes malformed input (control characters
+ * in an id or path segment that could forge a path-key separator, a non-integer version, an unknown
+ * op kind, a negative epoch, forged cites, a root delete, two ops racing on one path). Authority and
+ * access control stay at the relay; direct peer-to-peer rooms are trust-full for authority, so this
+ * shape check is a peer's only line against a malformed neighbor.
+ */
+function validateEnvelope(env) {
+    if (!env || typeof env !== 'object')
+        return 'envelope';
+    if (!isCleanId(env.origin))
+        return 'origin';
+    if (!isCleanId(env.writer))
+        return 'writer';
+    if (!isFiniteHlc(env.hlc))
+        return 'hlc';
+    if (!Number.isInteger(env.version) || env.version <= 0)
+        return 'version';
+    if (!Array.isArray(env.ops))
+        return 'ops';
+    const seenPaths = new Set();
+    for (const op of env.ops) {
+        if (!op || typeof op !== 'object')
+            return 'op';
+        if (op.kind !== 'set' && op.kind !== 'delete' && op.kind !== 'clear')
+            return 'kind';
+        if (!Array.isArray(op.path))
+            return 'path';
+        for (const seg of op.path) {
+            if (typeof seg === 'string' && hasControlChar(seg))
+                return 'path-control';
+            if (seg === '__proto__')
+                return 'path-proto';
+        }
+        if (op.path.length === 0 && op.kind !== 'set')
+            return 'root-op';
+        const epoch = op.epoch;
+        if (typeof epoch !== 'number' || !Number.isFinite(epoch) || epoch < 0)
+            return 'epoch';
+        const cites = op.cites;
+        if (!Array.isArray(cites))
+            return 'cites';
+        for (const c of cites) {
+            if (!c ||
+                typeof c !== 'object' ||
+                !isCleanId(c.origin) ||
+                !isFiniteHlc(c.hlc)) {
+                return 'cites';
+            }
+        }
+        // one op per path per envelope: a dot is (origin, hlc), so two ops on one path in one envelope
+        // would share a dot and break the register's per-origin bookkeeping. Segments with control
+        // characters are already rejected above, so this join is unambiguous.
+        const key = op.path.map(String).join(String.fromCharCode(0x1f));
+        if (seenPaths.has(key))
+            return 'dup-path';
+        seenPaths.add(key);
+    }
+    return null;
+}
 const lww = (_ancestor, mine) => mine;
 const mergeThree = (ancestor, mine, theirs) => merge3(ancestor, mine, theirs);
-const preserve = (ancestor, mine, theirs) => ({ [CONFLICT_BRAND]: true, mine, theirs, ancestor });
+const preserve = (ancestor, mine, theirs) => ({
+    [CONFLICT_BRAND]: true,
+    siblings: [mine, theirs],
+    mine,
+    theirs,
+    ancestor,
+});
 /**
  * Identity-aware array merge: reconciles two concurrent versions of
  * an array item-wise by a user-provided identity, instead of last-writer-wins on the whole
  * array. Items are matched by key; per-item fields merge via `merge3` against the ancestor
  * item; items added on either side survive; an item removed on either side and unedited on
  * the other stays removed. Item ORDER follows `mine` (the total-order winner), with `theirs`-
- * only additions appended — positional merging is out of scope (fractional indexing is the
- * known upgrade if dogfooding demands it). Arrays still TRAVEL as whole-value sets; identity
- * only shapes conflict resolution, so the wire format is untouched.
+ * only additions appended, and arrays still TRAVEL as whole-value sets. For a list whose elements
+ * move and edit concurrently, model it as a keyed container (a record of elements ordered by
+ * `posBetween`) instead: `insertElement`/`moveElement`/`removeElement` write per element, so a
+ * reorder and a concurrent edit both survive and elements travel one at a time.
  */
 function keyedArray(identity, opt) {
     const mergeItem = opt?.item ?? mergeThree;
@@ -5015,19 +5108,23 @@ function compilePolicies(entries) {
         merge: e.merge,
     }));
 }
+function matchSegments(segments, path) {
+    if (segments.length !== path.length)
+        return false;
+    for (let i = 0; i < path.length; i++) {
+        if (segments[i] !== '*' && segments[i] !== String(path[i]))
+            return false;
+    }
+    return true;
+}
 function policyFor(policies, path) {
-    outer: for (const p of policies) {
-        if (p.segments.length !== path.length)
-            continue;
-        for (let i = 0; i < path.length; i++) {
-            if (p.segments[i] !== '*' && p.segments[i] !== String(path[i]))
-                continue outer;
-        }
-        return p.merge;
+    for (const p of policies) {
+        if (matchSegments(p.segments, path))
+            return p.merge;
     }
     return lww;
 }
-const SEP = '';
+const SEP = ''; // unit separator: keeps joined path keys prefix-unambiguous
 const keyOf$1 = (path) => path.map(String).join(SEP);
 function structuralEq(a, b) {
     if (Object.is(a, b))
@@ -5052,108 +5149,539 @@ function structuralEq(a, b) {
     }
     return true;
 }
-// total order (hlc, writer, origin): two origins can share a writer AND a stamp
-// (independent clocks, same ms), so only origin makes the order strict
-const compareStamp = (a, b) => {
+const kindClass = (k) => (k === 'clear' ? 0 : 1);
+/**
+ * The register's total order: max by `(epoch, kind-class, hlc, writer, origin)`, where `set`
+ * and `delete` outrank `clear` at equal epoch. Epoch first makes an authority bump decisive
+ * regardless of clocks (and closes stale-value resurrection); the kind-class tier makes a
+ * concurrent edit's survival of a subtree replace categorical rather than a clock race; origin
+ * last keeps the order strict when two replicas share a writer and a stamp.
+ */
+function compareSiblings(a, b) {
+    if (a.epoch !== b.epoch)
+        return a.epoch - b.epoch;
+    const kc = kindClass(a.kind) - kindClass(b.kind);
+    if (kc !== 0)
+        return kc;
     const byTotal = compareTotal(a.hlc, a.writer, b.hlc, b.writer);
     if (byTotal !== 0)
         return byTotal;
     return a.origin < b.origin ? -1 : a.origin > b.origin ? 1 : 0;
+}
+const maxSibling = (siblings) => siblings.reduce((a, b) => (compareSiblings(a, b) >= 0 ? a : b));
+/** Last-writer-wins over the live sibling set: the {@link compareSiblings} maximum, as-is. */
+const defaultFold = (siblings) => {
+    const winner = maxSibling(siblings);
+    return winner.kind === 'set'
+        ? { kind: 'set', value: winner.value }
+        : { kind: winner.kind };
 };
-const beats = (a, b) => compareStamp(a, b) > 0;
+// preserve on the register seam: every top-precedence live sibling survives as data. A delete
+// competes as a value (it may surface inside the conflict as `undefined`); lower-epoch siblings
+// never surface (the epoch gate stays outermost).
+const preserveFold = (siblings) => {
+    const winner = maxSibling(siblings);
+    if (winner.kind === 'clear')
+        return { kind: 'clear' };
+    const top = siblings.filter((s) => s.epoch === winner.epoch && s.kind !== 'clear');
+    if (top.length === 1) {
+        return top[0].kind === 'set'
+            ? { kind: 'set', value: top[0].value }
+            : { kind: 'delete' };
+    }
+    const ordered = [...top].sort((a, b) => compareSiblings(b, a));
+    const values = ordered.map((s) => (s.kind === 'set' ? s.value : undefined));
+    const conflicted = {
+        [CONFLICT_BRAND]: true,
+        siblings: values,
+        mine: values[0],
+        theirs: values[1],
+        ancestor: ordered[1].prev,
+    };
+    return { kind: 'set', value: conflicted };
+};
+// A two-sided MergeFn generalized to N siblings: reduce over the canonically-ordered
+// top-precedence set, winner first, each step merging the next sibling against its own `prev`
+// as the ancestor. The iteration order is a pure function of the set, so the result converges
+// even for merges that are not associative (the reason pairwise-at-arrival diverged).
+const mergeFold = (merge) => {
+    return (siblings, ctx) => {
+        const ordered = [...siblings].sort((a, b) => compareSiblings(b, a));
+        const winner = ordered[0];
+        if (winner.kind !== 'set')
+            return { kind: winner.kind };
+        let acc = winner.value;
+        for (let i = 1; i < ordered.length; i++) {
+            const s = ordered[i];
+            if (s.kind !== 'set' || s.epoch !== winner.epoch)
+                continue;
+            acc = merge(s.prev, acc, s.value, ctx);
+        }
+        return { kind: 'set', value: acc };
+    };
+};
+const isContainer = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
 /**
- * The unsequenced-topology convergence core: a per-path last-writer-wins
- * register map over the total order (hlc, writer), with subtree dominance. Order-independent:
- * any arrival order of the same envelope set yields the same state.
+ * The unsequenced-topology convergence core: a dot-citation multi-value register per path.
+ * An op supersedes exactly the sibling dots it cites; uncited concurrent writes stay live; a
+ * pluggable fold resolves the live set at read. Both the live set and any pure fold over it
+ * are functions of the delivered op SET, so any arrival order of the same envelopes (split,
+ * duplicated, cites-before-ops) yields the same state.
  */
 function createConvergingApply(opt) {
     const registers = new Map();
+    // per-path floor of this replica's own emitted epochs: monotone, survives reset() so a
+    // rehydrated replica can never re-emit below an epoch it already exposed
+    const floors = new Map();
+    // monotone ingest counter + the seq at which each live sibling arrived (keyed pathKey → origin).
+    // captureFrontier() reads the counter in O(1); a frontier-scoped stamp cites only siblings at or
+    // below the captured seq. Side-mapped so the public sibling/checkpoint shapes stay unchanged.
+    let ingestSeq = 0;
+    const seqs = new Map();
+    const setSeq = (key, origin, seq) => {
+        let sm = seqs.get(key);
+        if (!sm)
+            seqs.set(key, (sm = new Map()));
+        sm.set(origin, seq);
+    };
     const policies = compilePolicies(opt?.policies ?? []);
-    const resolveConcurrent = (winner, loser, path) => {
+    const customFolds = (opt?.folds ?? []).map((e) => ({
+        segments: typeof e.path === 'string' ? e.path.split('.') : e.path.map(String),
+        fold: e.fold,
+    }));
+    const foldFor = (path) => {
+        for (const f of customFolds) {
+            if (matchSegments(f.segments, path))
+                return f.fold;
+        }
         const merge = policyFor(policies, path);
-        if (merge === lww || winner.kind === 'delete' || loser.kind === 'delete') {
-            return winner;
+        if (merge === lww)
+            return defaultFold;
+        if (merge === preserve)
+            return preserveFold;
+        return mergeFold(merge);
+    };
+    const regAt = (path) => {
+        const key = keyOf$1(path);
+        let reg = registers.get(key);
+        if (!reg) {
+            reg = { path, siblings: new Map(), water: new Map(), sig: '' };
+            registers.set(key, reg);
+        }
+        return reg;
+    };
+    const liveOf = (reg) => {
+        const out = [];
+        for (const [o, s] of reg.siblings) {
+            const w = reg.water.get(o);
+            if (!w || compareHlc(s.hlc, w) > 0)
+                out.push(s);
         }
-        const resolved = merge(loser.prev, winner.next, loser.next, { path });
-        if (Object.is(resolved, winner.next))
-            return winner;
-        return { kind: 'set', path, next: resolved, prev: winner.next };
+        return out.sort((a, b) => a.origin < b.origin ? -1 : a.origin > b.origin ? 1 : 0);
+    };
+    // The live siblings a frontier had observed: those that arrived at or below its captured seq.
+    // Used by a fork commit so it supersedes only what it saw when it forked, not later writes.
+    const liveObserved = (reg, frontier) => {
+        const live = liveOf(reg);
+        if (!frontier)
+            return live;
+        const sm = seqs.get(keyOf$1(reg.path));
+        return live.filter((s) => (sm?.get(s.origin) ?? 0) <= frontier.seq);
     };
-    const concurrentWith = (incoming, registered) => {
-        if (incoming.kind === 'delete' || registered.kind === 'delete')
+    // JSON of a tuple array, not a separator-joined string: `origin` is a caller-supplied value on a
+    // P2P peer, so a naive `origin@p.l#epoch` join lets a crafted origin collide the signatures of two
+    // distinct live sets. A collision makes refresh() skip a fold update, and since that skip is
+    // arrival-order-sensitive it breaks convergence. JSON.stringify escapes the strings and the array
+    // structure is unambiguous, so the signature is injective in the live set.
+    const sigOf = (live) => JSON.stringify(live.map((s) => [s.origin, s.hlc.p, s.hlc.l, s.epoch, s.kind]));
+    /** Recompute the fold cache; true iff the materialized result meaningfully changed. */
+    const refresh = (reg) => {
+        const live = liveOf(reg);
+        const sig = sigOf(live);
+        if (sig === reg.sig)
             return false;
-        if (!Object.hasOwn(incoming, 'prev'))
-            return true;
-        return !structuralEq(incoming.prev, registered.next);
+        reg.sig = sig;
+        const next = live.length
+            ? foldFor(reg.path)(live, { path: reg.path })
+            : undefined;
+        const prev = reg.result;
+        const same = prev === next ||
+            (!!prev &&
+                !!next &&
+                prev.kind === next.kind &&
+                (prev.kind !== 'set' ||
+                    next.kind !== 'set' ||
+                    Object.is(prev.value, next.value) ||
+                    structuralEq(prev.value, next.value)));
+        if (same)
+            return false; // keep the previous result object: reference identity is the contract
+        reg.result = next;
+        return true;
+    };
+    const descendantsOf = (key) => {
+        const out = [];
+        for (const [k, r] of registers) {
+            if (k === key)
+                continue;
+            if (key === '' ? k !== '' : k.startsWith(key + SEP))
+                out.push(r);
+        }
+        return out.sort((a, b) => a.path.length - b.path.length ||
+            (keyOf$1(a.path) < keyOf$1(b.path) ? -1 : 1));
+    };
+    /** Does `value` still hold a key at `rel` (present, not merely undefined)? */
+    const holdsKey = (value, rel) => {
+        let cur = value;
+        for (const seg of rel) {
+            if (cur === null ||
+                typeof cur !== 'object' ||
+                !Object.hasOwn(cur, String(seg))) {
+                return false;
+            }
+            cur = cur[String(seg)];
+        }
+        return true;
+    };
+    // A lone tombstone is droppable only if nothing else still materializes its key: no live
+    // descendant register would resurface, and no live ancestor `set` value still holds it. Mirrors
+    // the relay's retention twin so a client that prunes converges with a joiner seeded from the relay.
+    const tombstoneDroppable = (key, reg) => {
+        for (const [k, other] of registers) {
+            if (k === key)
+                continue;
+            if (k.startsWith(key + SEP)) {
+                if (liveOf(other).length > 0)
+                    return false;
+            }
+            else if (key.startsWith(k === '' ? '' : k + SEP)) {
+                const rel = reg.path.slice(other.path.length);
+                for (const s of liveOf(other)) {
+                    if (s.kind === 'set' && holdsKey(s.value, rel))
+                        return false;
+                }
+            }
+        }
+        return true;
+    };
+    /** Nearest ancestor register that contributes a value or a deletion (clears abstain). */
+    const nearestContributing = (path) => {
+        for (let len = path.length - 1; len >= 0; len--) {
+            const reg = registers.get(keyOf$1(path.slice(0, len)));
+            if (reg?.result && reg.result.kind !== 'clear')
+                return reg;
+        }
+        return undefined;
+    };
+    // graft with the deterministic type-change rule: a graft whose parent location is not a plain
+    // record is DROPPED (the register stays intact and resurfaces if the container is restored)
+    const graft = (tree, rel, res) => {
+        if (!isContainer(tree))
+            return tree;
+        const head = String(rel[0]);
+        if (rel.length === 1) {
+            if (res.kind === 'delete') {
+                if (!Object.hasOwn(tree, head))
+                    return tree;
+                const copy = { ...tree };
+                delete copy[head];
+                return copy;
+            }
+            return { ...tree, [head]: res.value };
+        }
+        if (!Object.hasOwn(tree, head)) {
+            // vivify an absent middle container so a checkpoint-seeded materialization matches a peer that
+            // applied the ops incrementally (incremental apply creates missing parents). A numeric next
+            // segment vivifies an array, else an object, mirroring the incremental apply path.
+            const vivified = typeof rel[1] === 'number' ? [] : {};
+            return { ...tree, [head]: graft(vivified, rel.slice(1), res) };
+        }
+        const child = graft(tree[head], rel.slice(1), res);
+        return child === tree[head] ? tree : { ...tree, [head]: child };
+    };
+    /** Would a value at `rel` under `value` materialize, per the graft rules? */
+    const graftable = (value, rel) => {
+        let cur = value;
+        for (let i = 0; i < rel.length - 1; i++) {
+            if (!isContainer(cur) || !Object.hasOwn(cur, String(rel[i])))
+                return false;
+            cur = cur[String(rel[i])];
+        }
+        return isContainer(cur);
+    };
+    /**
+     * Whether a value at `path` materializes: every contributing ancestor register down the
+     * chain must be a `set` whose value composes containers to the next one. The drop rule is
+     * checked against the WHOLE chain, since a graft fine under its nearest ancestor can still drop
+     * at a scalar further up.
+     */
+    const shows = (path) => {
+        let holder;
+        for (let len = 0; len < path.length; len++) {
+            const reg = registers.get(keyOf$1(path.slice(0, len)));
+            if (!reg?.result || reg.result.kind === 'clear')
+                continue;
+            if (holder) {
+                const hres = holder.result;
+                if (!hres || hres.kind !== 'set')
+                    return false;
+                if (!graftable(hres.value, reg.path.slice(holder.path.length))) {
+                    return false;
+                }
+            }
+            holder = reg;
+        }
+        if (!holder)
+            return true; // nothing above constrains → vivify semantics
+        const hres = holder.result;
+        if (!hres || hres.kind !== 'set')
+            return false;
+        return graftable(hres.value, path.slice(holder.path.length));
+    };
+    /** Deepest-live-wins subtree value: the register's fold value with every live descendant fold grafted on. */
+    const materializeAt = (base) => {
+        const res = base.result;
+        let tree = res && res.kind === 'set' ? res.value : undefined;
+        for (const d of descendantsOf(keyOf$1(base.path))) {
+            const r = d.result;
+            if (!r || r.kind === 'clear')
+                continue;
+            if (!shows(d.path))
+                continue; // dropped under a deleted/scalar ancestor (matches applied deltas)
+            tree = graft(tree, d.path.slice(base.path.length), r);
+        }
+        return tree;
+    };
+    const deltas = (changed) => {
+        changed.sort((a, b) => a.reg.path.length - b.reg.path.length ||
+            (keyOf$1(a.reg.path) < keyOf$1(b.reg.path) ? -1 : 1));
+        const out = [];
+        const regions = [];
+        const covered = (key) => regions.some((r) => key === r || (r === '' ? true : key.startsWith(r + SEP)));
+        for (const { reg, before } of changed) {
+            const key = keyOf$1(reg.path);
+            if (covered(key))
+                continue;
+            const res = reg.result;
+            if (!res || res.kind === 'clear') {
+                // the register now abstains: re-materialize the nearest ancestor region it cleared out of
+                if (!reg.path.length)
+                    continue;
+                const anc = nearestContributing(reg.path);
+                const ares = anc?.result;
+                if (!anc || !ares || ares.kind !== 'set' || !shows(anc.path))
+                    continue;
+                out.push({ kind: 'set', path: anc.path, next: materializeAt(anc) });
+                regions.push(keyOf$1(anc.path));
+                continue;
+            }
+            if (!shows(reg.path))
+                continue; // dropped by the type-change rule or a deleted parent
+            if (res.kind === 'delete') {
+                if (!reg.path.length)
+                    continue; // a root delete is meaningless
+                out.push({
+                    kind: 'delete',
+                    path: reg.path,
+                    prev: before?.kind === 'set' ? before.value : undefined,
+                });
+            }
+            else {
+                out.push({ kind: 'set', path: reg.path, next: materializeAt(reg) });
+            }
+            regions.push(key);
+        }
+        return out;
     };
     return {
         ingest: (env, o) => {
-            const stamp = {
-                hlc: env.hlc,
-                writer: env.writer,
-                origin: env.origin,
-            };
-            const out = [];
+            const touched = new Map();
+            const seq = ++ingestSeq;
             for (const op of env.ops) {
+                if (o?.frontier && compareHlc(env.hlc, o.frontier) <= 0)
+                    continue; // below the pruned horizon
+                // a delete or clear at the root has no parent register to abstain to; it can only blank the
+                // whole document, and materialize would then disagree with the delta path, so drop it
+                if (!op.path.length && op.kind !== 'set')
+                    continue;
+                const reg = regAt(op.path);
                 const key = keyOf$1(op.path);
-                let dominated = false;
-                let exact;
-                for (let len = 0; len <= op.path.length; len++) {
-                    const reg = registers.get(keyOf$1(op.path.slice(0, len)));
-                    if (!reg)
+                if (!touched.has(key))
+                    touched.set(key, { reg, before: reg.result });
+                const sop = op;
+                for (const c of sop.cites ?? []) {
+                    // a self-citation (the op citing its own dot) would born-dead the write; ignore it
+                    if (c.origin === env.origin && compareHlc(c.hlc, env.hlc) === 0)
                         continue;
-                    if (len === op.path.length)
-                        exact = reg;
-                    else if (beats(reg, stamp)) {
-                        dominated = true;
-                        break;
-                    }
+                    const cur = reg.water.get(c.origin);
+                    if (!cur || compareHlc(c.hlc, cur) > 0)
+                        reg.water.set(c.origin, c.hlc);
                 }
-                if (dominated)
-                    continue;
-                if (exact && beats(exact, stamp)) {
-                    if (concurrentWith(op, exact.op)) {
-                        const resolved = resolveConcurrent(exact.op, op, op.path);
-                        if (resolved !== exact.op) {
-                            exact.op = resolved;
-                            if (!o?.local)
-                                out.push(resolved);
-                        }
+                const best = reg.siblings.get(env.origin);
+                if (!best || compareHlc(env.hlc, best.hlc) > 0) {
+                    const sib = {
+                        kind: op.kind,
+                        writer: env.writer,
+                        origin: env.origin,
+                        hlc: env.hlc,
+                        epoch: sop.epoch ?? 0,
+                    };
+                    if (op.kind === 'set')
+                        sib.value = op.next;
+                    if (op.kind !== 'clear' && Object.hasOwn(op, 'prev')) {
+                        sib.prev = op.prev;
                     }
-                    continue;
+                    reg.siblings.set(env.origin, sib);
+                    setSeq(key, env.origin, seq);
                 }
-                let accepted = op;
-                if (exact && concurrentWith(op, exact.op)) {
-                    accepted = resolveConcurrent(op, exact.op, op.path);
+                if (o?.local && (sop.epoch ?? 0) > 0) {
+                    floors.set(key, Math.max(floors.get(key) ?? 0, sop.epoch));
                 }
-                const isDescendant = key === ''
-                    ? (k) => k !== ''
-                    : (k) => k.startsWith(key + SEP);
-                const replays = [];
-                for (const [k, reg] of registers) {
-                    if (!isDescendant(k))
+            }
+            const changed = [];
+            for (const c of touched.values()) {
+                if (refresh(c.reg))
+                    changed.push(c);
+            }
+            if ((o?.local && !o?.reconcile) || !changed.length)
+                return [];
+            return deltas(changed);
+        },
+        stamp: (ops, o) => {
+            const out = [];
+            const bump = o?.bump ? 1 : 0;
+            const frontier = o?.frontier;
+            const epochFor = (key, live) => {
+                let e = floors.get(key) ?? 0;
+                for (const s of live)
+                    if (s.epoch > e)
+                        e = s.epoch;
+                return e + bump;
+            };
+            for (const op of ops) {
+                const key = keyOf$1(op.path);
+                const reg = registers.get(key);
+                const live = reg ? liveObserved(reg, frontier) : [];
+                out.push({
+                    ...op,
+                    cites: live.map((s) => ({ origin: s.origin, hlc: s.hlc })),
+                    epoch: epochFor(key, live),
+                });
+                if (op.kind === 'clear')
+                    continue;
+                for (const d of descendantsOf(key)) {
+                    if (d.result?.kind === 'clear')
+                        continue; // already abstaining
+                    const dlive = liveObserved(d, frontier);
+                    if (!dlive.length)
                         continue;
-                    if (beats(stamp, reg))
-                        registers.delete(k);
-                    else
-                        replays.push(reg);
+                    out.push({
+                        kind: 'clear',
+                        path: d.path,
+                        cites: dlive.map((s) => ({ origin: s.origin, hlc: s.hlc })),
+                        epoch: epochFor(keyOf$1(d.path), dlive),
+                    });
                 }
-                replays.sort(compareStamp);
-                registers.set(key, {
-                    hlc: env.hlc,
-                    writer: env.writer,
-                    origin: env.origin,
-                    op: accepted,
+            }
+            return out;
+        },
+        captureFrontier: () => ({ seq: ingestSeq }),
+        liveAt: (path) => {
+            const reg = registers.get(keyOf$1(path));
+            return reg ? liveOf(reg) : [];
+        },
+        materialize: () => {
+            const root = registers.get('');
+            const res = root?.result;
+            let tree = res && res.kind === 'set' ? res.value : undefined;
+            for (const d of descendantsOf('')) {
+                const r = d.result;
+                if (!r || r.kind === 'clear')
+                    continue;
+                if (!shows(d.path))
+                    continue; // dropped under a deleted/scalar ancestor (matches applied deltas)
+                if (tree === undefined)
+                    tree = {}; // vivify: deeper registers materialize without a root write
+                tree = graft(tree, d.path, r);
+            }
+            return tree;
+        },
+        checkpoint: () => {
+            const out = [];
+            for (const reg of registers.values()) {
+                out.push({
+                    path: reg.path,
+                    siblings: [...reg.siblings.values()],
+                    water: Object.fromEntries(reg.water),
                 });
-                if (!o?.local) {
-                    out.push(accepted);
-                    for (const r of replays)
-                        out.push(r.op);
-                }
             }
             return out;
         },
-        reset: () => registers.clear(),
+        load: (regs) => {
+            const seq = ++ingestSeq;
+            for (const r of regs) {
+                const reg = regAt(r.path);
+                const key = keyOf$1(r.path);
+                for (const s of r.siblings) {
+                    const cur = reg.siblings.get(s.origin);
+                    if (!cur || compareHlc(s.hlc, cur.hlc) > 0) {
+                        reg.siblings.set(s.origin, s);
+                        setSeq(key, s.origin, seq);
+                    }
+                }
+                for (const [o, h] of Object.entries(r.water)) {
+                    const cur = reg.water.get(o);
+                    if (!cur || compareHlc(h, cur) > 0)
+                        reg.water.set(o, h);
+                }
+                if (opt?.origin) {
+                    const own = reg.siblings.get(opt.origin);
+                    if (own) {
+                        floors.set(key, Math.max(floors.get(key) ?? 0, own.epoch));
+                    }
+                }
+                refresh(reg);
+            }
+        },
+        prune: (frontier) => {
+            for (const [key, reg] of [...registers]) {
+                const sm = seqs.get(key);
+                for (const [o, s] of [...reg.siblings]) {
+                    const w = reg.water.get(o);
+                    if (compareHlc(s.hlc, frontier) <= 0 &&
+                        w &&
+                        compareHlc(s.hlc, w) <= 0) {
+                        reg.siblings.delete(o);
+                        sm?.delete(o);
+                    }
+                }
+                for (const [o, h] of [...reg.water]) {
+                    if (compareHlc(h, frontier) <= 0)
+                        reg.water.delete(o);
+                }
+                if (reg.siblings.size === 0 && reg.water.size === 0) {
+                    registers.delete(key);
+                    seqs.delete(key);
+                    floors.delete(key);
+                }
+            }
+            const byDepth = [...registers.entries()].sort((a, b) => b[1].path.length - a[1].path.length);
+            for (const [key, reg] of byDepth) {
+                const live = liveOf(reg);
+                if (live.length === 1 &&
+                    live[0].kind === 'delete' &&
+                    reg.siblings.size === 1 &&
+                    compareHlc(live[0].hlc, frontier) <= 0 &&
+                    tombstoneDroppable(key, reg)) {
+                    registers.delete(key);
+                    seqs.delete(key);
+                    floors.delete(key);
+                }
+            }
+        },
+        reset: () => {
+            registers.clear();
+            seqs.clear();
+        },
     };
 }
 function getAtPath(root, path) {
@@ -5181,6 +5709,10 @@ function rebaseOps(root, pending, remote, policies) {
     for (const batch of pending) {
         const next = [];
         for (const op of batch) {
+            if (op.kind === 'clear') {
+                next.push(op); // a register intent, not a value change: passes through untouched
+                continue;
+            }
             const cur = getAtPath(base, op.path);
             if (op.kind === 'delete') {
                 next.push({ kind: 'delete', path: op.path, prev: cur });
@@ -5219,20 +5751,30 @@ function generateOrigin() {
 }
 /**
  * Wires a copy-on-write signal (a `store` root) to the op protocol: local writes emit
- * stamped envelopes, received envelopes fold in through the converging apply. The
- * unsequenced-topology client core that `tabSync(store)` and P2P transports build on.
+ * stamped envelopes (citing the sibling dots they observed), received envelopes fold in
+ * through the converging register. The unsequenced-topology client core that
+ * `tabSync(store)` and P2P transports build on.
  */
 const RECENT_LOCAL_CAP = 64;
 function opSync(source, opt) {
     const origin = opt.origin ?? generateOrigin();
     const clock = opt.clock ?? createHlcClock();
-    const conv = createConvergingApply({ policies: opt.policies });
+    const conv = createConvergingApply({
+        policies: opt.policies,
+        folds: opt.folds,
+        origin,
+    });
     const subscribers = new Set();
     // per-origin high-watermark; `versions.get(origin)` IS the local emit counter, so a hydrate/restore
     // that raises our own watermark also advances the next mint — no separate counter to drift out of
     // sync and collide with a version acked before a reboot but dropped from a debounced outbox.
     const versions = new Map();
     const recentLocal = [];
+    // highest stability frontier this peer has pruned to. A remote envelope at or below it is a settled
+    // straggler (its state is compacted away); re-admitting one could resurrect a value below the
+    // frontier, and per-origin version dedup cannot catch a FIRST-CONTACT straggler (no prior entry),
+    // so the frontier is the admission gate that closes that hole on the receive path.
+    let prunedFrontier;
     const resolvedInjector = opt.driver
         ? null
         : (opt.injector ?? inject(Injector));
@@ -5253,6 +5795,9 @@ function opSync(source, opt) {
     const canDefer = !opt.driver;
     const outbox = [];
     let receiving = false;
+    let bumping = false;
+    // set while a synced fork's commit is emitting: freezes emission cites to what the fork observed
+    let scopeFrontier;
     // a signal the drain reaction tracks; bumping it schedules an outbox drain for the next tick
     const drainTick = signal(0, ...(ngDevMode ? [{ debugName: "drainTick" }] : /* istanbul ignore next */ []));
     const scheduleDrain = () => drainTick.update((v) => v + 1);
@@ -5265,6 +5810,8 @@ function opSync(source, opt) {
             notify(env);
     };
     const emitLocal = (ops) => {
+        const frontier = scopeFrontier;
+        const stamped = conv.stamp(ops, { bump: bumping, frontier });
         const nextVersion = (versions.get(origin) ?? 0) + 1;
         const env = {
             proto: OP_PROTO_VERSION,
@@ -5273,10 +5820,19 @@ function opSync(source, opt) {
             version: nextVersion,
             hlc: clock.next(),
             policyVersion: opt.policyVersion ?? 0,
-            ops,
+            ops: stamped,
         };
         versions.set(origin, nextVersion);
-        conv.ingest(env, { local: true });
+        if (frontier) {
+            // a fork commit: its ops are concurrent siblings (they cite only the fork-time frontier), so
+            // move the store to the fold winner rather than leaving the raw committed value in place
+            const reconciled = conv.ingest(env, { local: true, reconcile: true });
+            if (reconciled.length)
+                log.apply(reconciled);
+        }
+        else {
+            conv.ingest(env, { local: true });
+        }
         recentLocal.push(env);
         if (recentLocal.length > RECENT_LOCAL_CAP)
             recentLocal.shift();
@@ -5308,10 +5864,25 @@ function opSync(source, opt) {
                 return;
             if (env.proto !== OP_PROTO_VERSION) {
                 if (isDevMode()) {
-                    console.warn(`[@mmstack/primitives] dropped envelope with proto ${env.proto} (expected ${OP_PROTO_VERSION})`);
+                    console.warn(`[@mmstack/primitives] dropped envelope with proto ${env.proto} (expected ${OP_PROTO_VERSION}: ops must carry cites + epoch; emitters from another protocol version are rejected rather than silently mixed)`);
+                }
+                return;
+            }
+            const reason = validateEnvelope(env);
+            if (reason !== null) {
+                if (isDevMode()) {
+                    console.warn(`[@mmstack/primitives] dropped malformed envelope (${reason}) from origin ${String(env.origin)}`);
                 }
+                opt.onReject?.(env, reason);
                 return;
             }
+            // a settled straggler at or below the pruned stability frontier: reject it (its state is
+            // compacted, re-admitting could resurrect a below-frontier value). All ops in an envelope share
+            // its stamp, so the envelope hlc is the dot for every op. The live relay path never delivers a
+            // below-frontier op (a lagging client gets a snapshot, not a delta), so this only fires on a
+            // stray re-broadcast, e.g. over a P2P/multi-path topology.
+            if (prunedFrontier && compareHlc(env.hlc, prunedFrontier) <= 0)
+                return;
             const known = versions.get(env.origin);
             if (known !== undefined && env.version <= known)
                 return; // duplicate/covered — idempotent
@@ -5321,14 +5892,9 @@ function opSync(source, opt) {
             versions.set(env.origin, env.version);
             receiving = true;
             try {
-                // Freeze pending local FIRST — stamped by a clock that has NOT yet observed this remote, so
-                // the local write keeps its causally-independent (original) stamp rather than being lifted
-                // above the remote and always winning. Emission is deferred to a tick via the outbox; this
-                // only registers + stamps.
                 log.flush();
                 clock.observe(env.hlc);
                 const ops = conv.ingest(env);
-                // apply the converged result — a local write that LOST its path rolls back visibly here
                 if (ops.length)
                     log.apply(ops);
             }
@@ -5340,45 +5906,88 @@ function opSync(source, opt) {
             drainOutbox();
             log.flush();
         },
+        override: (fn) => {
+            log.flush(); // earlier pending writes emit un-bumped
+            bumping = true;
+            try {
+                fn();
+                log.flush();
+            }
+            finally {
+                bumping = false;
+            }
+        },
+        captureFrontier: () => {
+            log.flush(); // fold pending base writes in first, so they count as observed
+            return conv.captureFrontier();
+        },
+        commitScope: (frontier, fn) => {
+            log.flush(); // earlier pending writes emit against the live frontier, not this one
+            scopeFrontier = frontier;
+            try {
+                fn();
+                log.flush(); // stamp + register the scoped writes now, while the frontier is frozen
+            }
+            finally {
+                scopeFrontier = undefined;
+            }
+        },
         watermark: () => Object.fromEntries(versions),
+        prune: (frontier) => {
+            if (!prunedFrontier || compareHlc(frontier, prunedFrontier) > 0) {
+                prunedFrontier = frontier;
+            }
+            conv.prune(frontier);
+        },
         snapshot: () => {
             log.flush();
-            return { root: untracked(source), wm: Object.fromEntries(versions) };
+            return {
+                root: untracked(source),
+                registers: conv.checkpoint(),
+                wm: Object.fromEntries(versions),
+            };
         },
         seed: () => {
             log.flush();
             emitLocal([{ kind: 'set', path: [], next: untracked(source) }]);
         },
-        hydrate: (root, wm) => {
+        hydrate: (state, pending) => {
             log.flush();
-            const covered = wm?.[origin] ?? 0;
-            const pending = recentLocal.filter((e) => e.version > covered);
+            // rebase this origin's uncovered local writes on top. A caller that keeps a durable outbox
+            // (meshSync, the worker replica) passes its full unacked set, so a long offline burst larger
+            // than the in-memory `recentLocal` cap is never dropped from the rebase; without it, fall back
+            // to the recent-local ring.
+            const source = pending ?? recentLocal;
+            const toReplay = source.filter((e) => e.version > (state.wm?.[e.origin] ?? 0));
             conv.reset();
-            let next = root;
-            for (const e of pending)
-                next = applyOps(next, e.ops);
-            log.apply([{ kind: 'set', path: [], next }]);
-            for (const [o, v] of Object.entries(wm ?? {})) {
+            conv.load(state.registers ?? []);
+            const deltas = [];
+            for (const e of toReplay) {
+                deltas.push(...conv.ingest(e, { local: true, reconcile: true }));
+            }
+            log.apply([
+                { kind: 'set', path: [], next: applyOps(state.root, deltas) },
+            ]);
+            for (const [o, v] of Object.entries(state.wm ?? {})) {
                 versions.set(o, Math.max(versions.get(o) ?? 0, v));
             }
-            for (const e of pending)
-                conv.ingest(e, { local: true });
         },
         restore: (envs, highWater) => {
-            let maxV = versions.get(origin) ?? 0;
+            let tailOrigin;
             for (const env of envs) {
-                if (env.origin !== origin)
-                    continue; // only this origin's own durable outbox
                 clock.observe(env.hlc); // keep the clock ≥ restored stamps before any future mint
                 log.apply(env.ops); // reflect the offline edit in the store, echo-free
                 conv.ingest(env, { local: true }); // register as a local winner (survives a reconnect merge)
                 recentLocal.push(env);
                 if (recentLocal.length > RECENT_LOCAL_CAP)
                     recentLocal.shift();
-                maxV = Math.max(maxV, env.version);
+                versions.set(env.origin, Math.max(versions.get(env.origin) ?? 0, env.version));
+                tailOrigin = env.origin;
                 notify(env); // hand to the transport to resend the unacknowledged tail
             }
-            versions.set(origin, Math.max(maxV, highWater ?? 0));
+            if (highWater != null && tailOrigin != null) {
+                versions.set(tailOrigin, Math.max(versions.get(tailOrigin) ?? 0, highWater));
+            }
         },
         destroy: () => {
             drainOutbox(); // don't silently drop frozen-but-unsent local writes
@@ -5389,7 +5998,199 @@ function opSync(source, opt) {
         },
     };
 }
+/**
+ * Fork a synced store for isolated edits (an agent branch, a staged review), keeping the correct
+ * emission semantics on commit. The fork observes the base as it was when this call ran; committing
+ * emits its diff citing only those observed dots, so an edit that landed on the base mid-flight
+ * stays a concurrent sibling and the configured fold decides between them, rather than the commit
+ * overwriting a write it never saw. `rebase()` re-observes the base (a following commit then
+ * supersedes what is visible now, the reviewed-and-apply step). Pass the same `store` and `sync`
+ * that are wired together; the fork is a plain {@link Fork} otherwise, so `forkStore` itself stays
+ * sync-agnostic.
+ */
+function syncedFork(sync, store, opt) {
+    let frontier = sync.captureFrontier();
+    const f = forkStore(store, opt);
+    return {
+        store: f.store,
+        ops: f.ops,
+        commit: () => sync.commitScope(frontier, () => f.commit()),
+        discard: () => {
+            f.discard();
+            frontier = sync.captureFrontier();
+        },
+        rebase: () => {
+            frontier = sync.captureFrontier();
+        },
+    };
+}
+
+/**
+ * Reserved key holding an element's fractional position inside a keyed container. It lives INSIDE
+ * the element (at `[container, elementKey, '~pos']`), so a reorder is a one-field write that never
+ * collides with a concurrent edit to the element's data. It stays visible on the materialized
+ * element value; do not read, write, or strip it by hand, use the helpers in this file.
+ */
+const POS_SEGMENT = '~pos';
+// Order-preserving fractional-index digits. The alphabet is ASCII-ascending, so a plain string
+// comparison of two positions matches their fractional order with no decoding.
+const DIGITS = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
+const BASE = DIGITS.length;
+const digitOf = (c) => DIGITS.indexOf(c);
+// Repeated inserts into the SAME gap grow a position one digit at a time. Healthy positions stay a
+// few characters; a long one signals a hot insertion point that should be rebalanced.
+const POS_WARN_LENGTH = 48;
+let posWarned = false;
+const warnIfLong = (pos) => {
+    if (isDevMode() && !posWarned && pos.length >= POS_WARN_LENGTH) {
+        posWarned = true;
+        console.warn(`[@mmstack/primitives] a keyed-container position grew to ${pos.length} characters from ` +
+            `repeated inserts into one gap. Call rebalanceContainer(...) to reclaim precision.`);
+    }
+    return pos;
+};
+/**
+ * A compact position string strictly between `before` and `after`, ordered by plain string
+ * comparison. Pass `undefined` for an open end: `posBetween()` seeds the first element,
+ * `posBetween(last)` appends, `posBetween(undefined, first)` prepends. Repeated inserts into the
+ * same gap grow the string one digit at a time rather than colliding, and the result is never equal
+ * to either neighbor. `before` must sort before `after`.
+ */
+function posBetween(before, after) {
+    // Neighbors can tie (concurrent inserts into the same gap leave two equal positions, ordered only
+    // by key). There is no position strictly between equal bounds, so open the upper end: the new
+    // position sorts just after them and stays deterministic instead of looping.
+    const upper = before != null && after != null && before >= after ? undefined : after;
+    let i = 0;
+    let out = '';
+    // The upper bound only opens to BASE once we pass `after`'s last constraining digit: an adjacent
+    // pair (gap of 1) leaves no room here, so we commit the lower digit and everything deeper is free.
+    let upperOpen = upper == null;
+    for (;;) {
+        const lo = before != null && i < before.length ? digitOf(before[i]) : 0;
+        const hi = upperOpen || upper == null ? BASE : i < upper.length ? digitOf(upper[i]) : 0;
+        if (hi - lo >= 2)
+            return warnIfLong(out + DIGITS[lo + ((hi - lo) >> 1)]);
+        if (hi === lo) {
+            // digits equal: no room yet, but `after` still constrains deeper digits, keep following it
+            out += DIGITS[lo];
+            i++;
+            continue;
+        }
+        // gap of 1: commit the lower digit and open the upper bound (deeper digits only exceed `before`)
+        out += DIGITS[lo];
+        i++;
+        upperOpen = true;
+    }
+}
+const isRecord = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+/**
+ * A keyed container's elements in reading order. Order is a pure function of the materialized
+ * value: elements sort by their `~pos` string, ties broken by key. An element whose `~pos` is
+ * missing or not a string is ordered as if its position were the empty string (it sorts first,
+ * key breaking the tie), so a peer that dropped the position field still lands somewhere
+ * deterministic on every replica.
+ */
+function orderedEntries(container) {
+    const entries = [];
+    for (const key of Object.keys(container)) {
+        const value = container[key];
+        const raw = isRecord(value) ? value[POS_SEGMENT] : undefined;
+        entries.push({ key, pos: typeof raw === 'string' ? raw : '', value });
+    }
+    entries.sort((a, b) => a.pos < b.pos ? -1 : a.pos > b.pos ? 1 : a.key < b.key ? -1 : a.key > b.key ? 1 : 0);
+    return entries;
+}
+const devError = (msg) => {
+    if (typeof ngDevMode !== 'undefined' && ngDevMode)
+        console.error(`[keyed-container] ${msg}`);
+};
+const neighborPositions = (entries, index) => {
+    const clamped = Math.max(0, Math.min(index, entries.length));
+    return [entries[clamped - 1]?.pos || undefined, entries[clamped]?.pos || undefined];
+};
+/**
+ * Insert `value` under `key` at `index` in reading order (default: append). The position is
+ * computed from the neighbors at that index, so the element lands where asked without renumbering
+ * any sibling. A keyed container is a RECORD, never an array, so this is a per-key write the sync
+ * layer diffs on its own. Returns the assigned position. Re-inserting an existing key overwrites it.
+ */
+function insertElement(container, key, value, index) {
+    if (POS_SEGMENT in value)
+        devError(`insertElement: '${POS_SEGMENT}' is managed, drop it from the value`);
+    const entries = orderedEntries(container()).filter((e) => e.key !== key);
+    const [before, after] = neighborPositions(entries, index ?? entries.length);
+    const pos = posBetween(before, after);
+    container.update((c) => ({ ...c, [key]: { ...value, [POS_SEGMENT]: pos } }));
+    return pos;
+}
+/**
+ * Move the element at `key` to `index` in reading order. This writes ONLY the element's `~pos`
+ * field, so it never conflicts with a concurrent edit to the same element's data (they land on
+ * different paths and both survive). Returns the new position, or `undefined` if `key` is absent.
+ */
+function moveElement(container, key, index) {
+    const current = container()[key];
+    if (current == null)
+        return undefined;
+    const entries = orderedEntries(container()).filter((e) => e.key !== key);
+    const [before, after] = neighborPositions(entries, index);
+    const pos = posBetween(before, after);
+    container.update((c) => ({ ...c, [key]: { ...c[key], [POS_SEGMENT]: pos } }));
+    return pos;
+}
+/** Remove the element at `key`. Deletes the whole element (a per-key delete the sync layer folds). */
+function removeElement(container, key) {
+    container.update((c) => {
+        if (!(key in c))
+            return c;
+        const next = { ...c };
+        delete next[key];
+        return next;
+    });
+}
+/**
+ * Reassign every element's position to a fresh, evenly spaced sequence, as an authority write:
+ * each `~pos` set is epoch-bumped so it wins the merge against any concurrent move, while leaving
+ * concurrent edits to element DATA untouched (only the `~pos` fields are written). Use this to
+ * reclaim precision after many same-gap inserts. Existing reading order is preserved.
+ */
+function rebalanceContainer(sync, container) {
+    const order = orderedEntries(container());
+    const positions = evenPositions(order.length);
+    sync.override(() => {
+        container.update((c) => {
+            const next = { ...c };
+            order.forEach(({ key }, i) => {
+                next[key] = { ...c[key], [POS_SEGMENT]: positions[i] };
+            });
+            return next;
+        });
+    });
+}
+// `n` evenly spaced, order-preserving positions in (0, 1): fraction (i+1)/(n+1) encoded to enough
+// base-62 digits that consecutive fractions never collide. Compact, so precision is reclaimed.
+function evenPositions(n) {
+    if (n === 0)
+        return [];
+    const digits = Math.floor(Math.log(n + 1) / Math.log(BASE)) + 2;
+    const out = [];
+    for (let i = 0; i < n; i++) {
+        let f = (i + 1) / (n + 1);
+        let s = '';
+        for (let k = 0; k < digits; k++) {
+            f *= BASE;
+            const d = Math.min(BASE - 1, Math.floor(f));
+            s += DIGITS[d];
+            f -= d;
+        }
+        out.push(s);
+    }
+    return out;
+}
 
+const PATH_SEP = '';
+const OP_SEP = '';
 /**
  * Undo/redo for a copy-on-write store, built on the op-log: each tracked change is stored as
  * its inverse batch, so `undo()` is one `apply` and history costs only the diffs, not full
@@ -5398,20 +6199,53 @@ function opSync(source, opt) {
  *
  * Composes with sync for collaborative undo: pass `track: syncClient` so only YOUR writes are
  * undoable, while `undo()` emits a normal op that propagates to peers (it writes through the
- * store, which the sync client picks up).
+ * store, which the sync client picks up). Coalescing groups only this stack's entries — what
+ * goes over the wire is untouched.
  */
 function storeHistory(source, opt) {
     const limit = opt?.limit ?? 100;
+    const coalesce = opt?.coalesce;
+    const now = opt?.now ?? Date.now;
     const logOpt = { origin: opt?.origin };
     if (opt?.driver)
         logOpt.driver = opt.driver;
     else
-        logOpt.injector = opt?.injector ?? inject(Injector);
+        logOpt.injector =
+            opt?.injector ?? inject(Injector);
     const log = opLog(source, logOpt);
     const undoStack = [];
     const redoStack = [];
     const version = signal(0, ...(ngDevMode ? [{ debugName: "version" }] : /* istanbul ignore next */ [])); // monotonic: bumps on every mutation so the computeds recompute
     let applying = false;
+    let runOpen = false;
+    let lastAt = 0;
+    let lastSig = '';
+    const sigOf = (ops) => ops.map((o) => `${o.kind}:${o.path.join(PATH_SEP)}`).join(OP_SEP);
+    const mergeInto = (entry, incoming) => {
+        const merged = [...entry];
+        const rest = [];
+        for (const inc of incoming) {
+            const key = inc.path.join(PATH_SEP);
+            const at = merged.findIndex((o) => o.path.join(PATH_SEP) === key);
+            const cur = at >= 0 ? merged[at] : undefined;
+            if (cur && cur.kind === 'set' && inc.kind === 'set') {
+                const composed = {
+                    kind: 'set',
+                    path: cur.path,
+                    next: cur.next,
+                };
+                // absent `prev` means the composed inverse is an add (inverts to a delete): the newest
+                // forward op removed the key, so redo must remove it again
+                if (Object.hasOwn(inc, 'prev'))
+                    composed.prev = inc.prev;
+                merged[at] = composed;
+            }
+            else {
+                rest.push(inc);
+            }
+        }
+        return rest.length ? [...rest, ...merged] : merged;
+    };
     const push = (stack, inverse) => {
         stack.push(inverse);
         if (stack.length > limit)
@@ -5422,20 +6256,39 @@ function storeHistory(source, opt) {
             return; // an undo/redo's own emission must not re-enter history
         if (!batch.ops.length)
             return;
-        push(undoStack, invertBatch(batch));
+        const inverse = invertBatch(batch);
+        const at = now();
+        const sig = coalesce ? sigOf(batch.ops) : '';
+        if (coalesce &&
+            runOpen &&
+            undoStack.length > 0 &&
+            at - lastAt <= coalesce.ms &&
+            (coalesce.samePath === false || sig === lastSig)) {
+            undoStack[undoStack.length - 1] = mergeInto(undoStack[undoStack.length - 1], inverse);
+        }
+        else {
+            push(undoStack, inverse);
+        }
+        runOpen = true;
+        lastAt = at;
+        lastSig = sig;
         redoStack.length = 0; // a fresh edit forks the timeline
         version.update((v) => v + 1);
     };
     // track the sync client's local stream when given, else self-diff every store change
     const unsub = (opt?.track ?? log).subscribe(record);
+    const flushTrack = () => opt?.track?.flush?.();
     const run = (from, to) => {
+        flushTrack();
+        log.flush();
         const inverse = from.pop();
         if (!inverse)
             return;
-        log.flush(); // settle pending local writes before applying
+        runOpen = false; // stepping through history is a boundary: the next edit starts fresh
         applying = true;
         try {
             log.apply(inverse);
+            flushTrack();
         }
         finally {
             applying = false;
@@ -5448,7 +6301,11 @@ function storeHistory(source, opt) {
         canRedo: computed(() => (version(), redoStack.length > 0)),
         undo: () => run(undoStack, redoStack),
         redo: () => run(redoStack, undoStack),
+        checkpoint: () => {
+            runOpen = false;
+        },
         clear: () => {
+            runOpen = false;
             undoStack.length = 0;
             redoStack.length = 0;
             version.update((v) => v + 1);
@@ -5659,7 +6516,7 @@ const isPlainArray = (v) => Array.isArray(v) && !isOpaque(v);
 function keyOf(item, key) {
     if (typeof key === 'function')
         return key(item);
-    return isRecord(item) ? item[key] : item;
+    return isRecord$1(item) ? item[key] : item;
 }
 /**
  * Produces a value equal to `next` but sharing as much of `prev`'s reference structure as possible:
@@ -5688,7 +6545,7 @@ function reconcileValue(prev, next, key) {
         });
         return changed ? out : prev;
     }
-    if (isRecord(prev) && isRecord(next)) {
+    if (isRecord$1(prev) && isRecord$1(next)) {
         const nextKeys = Object.keys(next);
         let changed = Object.keys(prev).length !== nextKeys.length;
         const out = {};
@@ -5974,7 +6831,7 @@ function storeTabSync(sig, opt, bus, injector) {
                     const covered = Object.entries(snap.wm).every(([origin, v]) => (msg.wm[origin] ?? 0) >= v);
                     post(covered
                         ? { t: 'uptodate', to: msg.from }
-                        : { t: 'state', to: msg.from, root: snap.root, wm: snap.wm });
+                        : { t: 'state', to: msg.from, state: snap });
                 }, Math.random() * jitterMs);
                 responseTimers.set(msg.from, timer);
                 return;
@@ -5989,7 +6846,7 @@ function storeTabSync(sig, opt, bus, injector) {
                 if (msg.to !== sync.origin || phase !== 'joining')
                     return;
                 if (msg.t === 'state')
-                    sync.hydrate(msg.root, msg.wm);
+                    sync.hydrate(msg.state);
                 goLive();
                 return;
             }
@@ -6363,5 +7220,5 @@ function withHistory(sourceOrValue, opt) {
  * Generated bundle index. Do not edit.
  */
 
-export { CONCURRENCY_INSTRUMENTATION, MmActivity, MmTransition, MmViewTransitionName, OP_PROTO_VERSION, PAUSABLE_OPTIONS, PERSISTED_STORE_OPTIONS, SuspenseBoundary, SuspenseBoundaryBase, UnscopedSuspenseBoundary, activeTransaction, applyOps, batteryStatus, bridgeScopeToPendingTasks, chunked, clipboard, combineWith, compareHlc, compareTotal, createAttributedPending, createConvergingApply, createForwardingScope, createHlcClock, createStoreContext, createTransaction, createTransitionScope, debounce, debounced, deferredValue, derived, diffOps, distinct, elementSize, elementVisibility, extendStore, filter, filterWith, focusWithin, forkStore, geolocation, getTransitionScope, holdUntilReady, idle, indexArray, injectPaused, injectRegisterResource, injectStartTransaction, injectStartTransition, injectTransitionScope, invertBatch, isConflicted, isDerivation, isLeaf, isMutable, isOpaque, isStore, keepPrevious, keyArray, keyedArray, latest, lww, map, mapArray, mapObject, mediaQuery, merge3, mergeThree, mousePosition, mutable, mutableStore, nestedEffect, networkStatus, opLog, opSync, opaque, orientation, pageVisibility, pairwise, pausableComputed, pausableEffect, pausableSignal, perfCustomTracks, persist, persistedStore, pipeable, piped, pointerDrag, policyStrategy, pooled, pooledArray, pooledMap, pooledSet, prefersDarkMode, prefersReducedMotion, preserve, projection, provideConcurrencyInstrumentation, provideForwardingTransitionScope, providePausableOptions, providePaused, providePersistedStoreOptions, provideTransitionScope, rebaseOps, reconcile, registerResource, resolvePause, scan, scrollPosition, select, sensor, sensors, signalFromEvent, startWith, store, storeHistory, stored, tabSync, tap, throttle, throttled, toFakeDerivation, toFakeSignalDerivation, toStore, toWritable, until, use, windowSize, withHistory };
+export { CONCURRENCY_INSTRUMENTATION, MmActivity, MmTransition, MmViewTransitionName, OP_PROTO_VERSION, PAUSABLE_OPTIONS, PERSISTED_STORE_OPTIONS, POS_SEGMENT, SuspenseBoundary, SuspenseBoundaryBase, UnscopedSuspenseBoundary, activeTransaction, applyOps, batteryStatus, bridgeScopeToPendingTasks, chunked, clipboard, combineWith, compareHlc, compareSiblings, compareTotal, createAttributedPending, createConvergingApply, createForwardingScope, createHlcClock, createStoreContext, createTransaction, createTransitionScope, debounce, debounced, defaultFold, deferredValue, derived, diffOps, distinct, elementSize, elementVisibility, extendStore, filter, filterWith, focusWithin, forkStore, geolocation, getTransitionScope, holdUntilReady, idle, indexArray, injectPaused, injectRegisterResource, injectStartTransaction, injectStartTransition, injectTransitionScope, insertElement, invertBatch, isConflicted, isDerivation, isLeaf, isMutable, isOpaque, isStore, keepPrevious, keyArray, keyedArray, latest, lww, map, mapArray, mapObject, mediaQuery, merge3, mergeThree, mousePosition, moveElement, mutable, mutableStore, nestedEffect, networkStatus, opLog, opSync, opaque, orderedEntries, orientation, pageVisibility, pairwise, pausableComputed, pausableEffect, pausableSignal, perfCustomTracks, persist, persistedStore, pipeable, piped, pointerDrag, policyStrategy, pooled, pooledArray, pooledMap, pooledSet, posBetween, prefersDarkMode, prefersReducedMotion, preserve, projection, provideConcurrencyInstrumentation, provideForwardingTransitionScope, providePausableOptions, providePaused, providePersistedStoreOptions, provideTransitionScope, rebalanceContainer, rebaseOps, reconcile, registerResource, removeElement, resolvePause, scan, scrollPosition, select, sensor, sensors, signalFromEvent, startWith, store, storeHistory, stored, syncedFork, tabSync, tap, throttle, throttled, toFakeDerivation, toFakeSignalDerivation, toStore, toWritable, until, use, validateEnvelope, windowSize, withHistory };
 //# sourceMappingURL=mmstack-primitives.mjs.map