@origintrail-official/dkg-agent 10.0.19 → 10.0.21

package/dist/sync/responder/graph-plan.js

@@ -1,18 +1,23 @@
 import { DKG_ONTOLOGY, GRAPH_KA_CONTENT_SCOPE_VERSION, MemoryLayer, assertSafeIri, sparqlString, validateSubGraphName, contextGraphCatalogUri, createGraphKnowledgeAssetScope, knowledgeAssetLayerGraphUri, } from '@origintrail-official/dkg-core';
 import { asGraphWriteRevisionSource, loadSortedGraphCatalog, StoreResponseTooLargeError, } from '@origintrail-official/dkg-storage';
 import { isSharedMemoryBucketDescendantDataGraph } from '../shared-memory-graphs.js';
-import { SYNC_RESPONDER_SNAPSHOT_BUILD_MAX_BYTES_ESTIMATE, SYNC_RESPONDER_SNAPSHOT_BUILD_MAX_ROWS, SYNC_RESPONDER_SNAPSHOT_BUILD_PAGE_ROWS, isSyncRowSnapshotPagingRequiredError, } from './snapshot-cache.js';
+import { SYNC_RESPONDER_SNAPSHOT_BUILD_MAX_BYTES_ESTIMATE, SYNC_RESPONDER_SNAPSHOT_BUILD_MAX_ROWS, SYNC_RESPONDER_SNAPSHOT_BUILD_PAGE_ROWS, } from './snapshot-cache.js';
 import { bytesToHex } from '@noble/hashes/utils.js';
 import { sha256 } from '@noble/hashes/sha2.js';
-import { SyncRowSnapshotBudgetError, } from './snapshot-budget.js';
 import { estimateStringRowHeapBytes } from '../memory-telemetry.js';
-import { SYNC_BYTE_BUDGET_RESPONSE_BYTES } from '../../dkg-agent-constants.js';
+import { SYNC_BYTE_BUDGET_RESPONSE_BYTES, } from '../../dkg-agent-constants.js';
 import { durableMetaDelegationSubjectAdmissionExpression } from './durable-meta-admission.js';
-import { exactAssetFilterKey } from '../exact-assets.js';
 import { isIriTerm } from '../iri-term.js';
 import { compareCodePoint } from '@origintrail-official/dkg-core';
 import { isLegacySyncGraphCandidateV1 } from '../legacy-sync-graph-candidate.js';
 import { createGraphMembershipSnapshotFromSortedCatalog, } from '../graph-membership-snapshot.js';
+import { readExactDataSessionPage, durableDataRowListCacheKey, createStoreOnlyDataSession, } from './exact-data-session.js';
+import { createSessionPlanMemo, createPageOnlySessionPlanMemo } from './session-plan-memo.js';
+import { buildExactGraphPagePlan, readRowsPageFromExactGraphPlan, readExactGraphPlanSnapshot, readGraphScopedVmManifest, snapshotResponseByteLimit, storeResponseActualBytes, snapshotBudgetError, } from './exact-graph-reader.js';
+import { createSessionPlanGetter, readResponderRowsPage, raceAgainstAbort, throwIfAborted, } from './responder-row-page.js';
+export { createResponderExactDataSessionMemo, createResponderPageOnlyExactDataSessionMemo } from './exact-data-session.js';
+import { compareRows, metaSubjectKey, serializeResponderRows, serializedResponderRowByteLength, } from './row-serialization.js';
+export { compareRows, serializeResponderRows, serializeResponderRowsWithinByteBudget } from './row-serialization.js';
 export { createResponderSyncRowListMemo, SyncRowSnapshotLimitError, } from './snapshot-cache.js';
 export { compareCodePoint } from '../code-point-order.js';
 const DKG = 'http://dkg.io/ontology/';
@@ -27,12 +32,8 @@ const DKG_SHARE_OPERATION_ID = `${DKG}shareOperationId`;
 const DKG_ASSERTION_GRAPH = `${DKG}assertionGraph`;
 const DKG_ASSERTION_NAME = `${DKG}assertionName`;
 const DKG_MEMORY_LAYER = `${DKG}memoryLayer`;
-const DKG_CONTEXT_GRAPH = `${DKG}contextGraph`;
 const DKG_CONTEXT_GRAPH_ID = `${DKG}contextGraphId`;
-const DKG_PUBLIC_TRIPLE_COUNT = `${DKG}publicTripleCount`;
-const DKG_PRIVATE_TRIPLE_COUNT = `${DKG}privateTripleCount`;
 const DKG_STATUS = `${DKG}status`;
-const DKG_SUB_GRAPH_NAME = `${DKG}subGraphName`;
 const DETERMINISTIC_KA_UAL_SHAPE = /^did:dkg:[^/]+\/0x[0-9A-Fa-f]{40}\/[0-9]+$/;
 const DKG_PART_OF = `${DKG}partOf`;
 const DKG_BATCH_ID = `${DKG}batchId`;
@@ -40,7 +41,6 @@ const SCHEMA_NAME = 'http://schema.org/name';
 const PROV_GENERATED = 'http://www.w3.org/ns/prov#generated';
 const PROV_USED = 'http://www.w3.org/ns/prov#used';
 const DKG_JOIN_REQUEST_SUBJECT_PREFIX = 'did:dkg:join-request:';
-const COMPLETED_SYNC_RESPONDER_SESSION_GRACE_MS = 30_000;
 function syncResponderStoreOptions(signal, source) {
     return { signal, priority: 'background', source };
 }
@@ -199,82 +199,6 @@ export function createResponderFreshSwmMetaPlanMemo(ttlMs = 10 * 60_000, maxEntr
         bytesEstimate: (plan) => plan.bytesEstimate,
     });
 }
-function createSessionPlanMemo(ttlMs, maxEntries, accounting) {
-    const cached = new Map();
-    const inflight = new Map();
-    const deleteEntry = (key, reason) => {
-        const entry = cached.get(key);
-        if (!entry)
-            return;
-        cached.delete(key);
-        if (entry.budgetEntryId)
-            accounting?.budget.remove(entry.budgetEntryId, reason);
-    };
-    const prune = (now = Date.now()) => {
-        for (const [key, entry] of cached) {
-            if (now - entry.cachedAt >= ttlMs)
-                deleteEntry(key, 'expired');
-        }
-    };
-    return {
-        async get(key, load, options) {
-            throwIfAborted(options?.signal);
-            const now = Date.now();
-            prune(now);
-            const pending = inflight.get(key);
-            if (pending)
-                return raceAgainstAbort(pending, options?.signal);
-            const existing = cached.get(key);
-            if (!options?.refresh && existing) {
-                cached.delete(key);
-                cached.set(key, { ...existing, cachedAt: now });
-                if (existing.budgetEntryId) {
-                    // Refresh the global-budget LRU position, then stay evictable: an
-                    // entry pinned forever would let idle plans exempt themselves from
-                    // memory-pressure eviction.
-                    accounting?.budget.touch(existing.budgetEntryId);
-                    accounting?.budget.release(existing.budgetEntryId);
-                }
-                return existing.value;
-            }
-            if (options?.requireExisting)
-                return null;
-            if (!existing && cached.size >= maxEntries) {
-                deleteEntry(cached.keys().next().value, 'released');
-            }
-            const pendingLoad = load()
-                .then((value) => {
-                const replaced = cached.get(key);
-                let budgetEntryId;
-                if (accounting) {
-                    budgetEntryId = Symbol(key);
-                    // Throws the typed global budget error when the process-wide
-                    // responder budget cannot admit the plan; the failed refresh leaves
-                    // any previously-admitted plan in place (memo entry untouched).
-                    accounting.budget.admit({
-                        id: budgetEntryId,
-                        key,
-                        phase: accounting.phase,
-                        rows: 0,
-                        bytesEstimate: accounting.bytesEstimate(value),
-                        controlPlane: true,
-                        replaceId: replaced?.budgetEntryId,
-                        onEvict: () => {
-                            if (cached.get(key)?.budgetEntryId === budgetEntryId)
-                                cached.delete(key);
-                        },
-                    });
-                    accounting.budget.release(budgetEntryId);
-                }
-                cached.set(key, { value, cachedAt: Date.now(), budgetEntryId });
-                return value;
-            })
-                .finally(() => inflight.delete(key));
-            inflight.set(key, pendingLoad);
-            return raceAgainstAbort(pendingLoad, options?.signal);
-        },
-    };
-}
 /**
  * Session-scoped inventory for ordinary durable/SWM graph paging. The memo
  * stores only exact graph IRIs and their row counts. Payload rows remain in the
@@ -285,6 +209,14 @@ function createSessionPlanMemo(ttlMs, maxEntries, accounting) {
 export function createResponderExactGraphPagePlanMemo(ttlMs = 10 * 60_000, maxEntries = 32) {
     return createSessionPlanMemo(ttlMs, maxEntries);
 }
+/**
+ * Exact byte-budget sessions retain only bounded graph/count scalars and
+ * keyset cursors. Reserve the cursor ceiling up front so later pages cannot
+ * grow uncharged state outside the process-wide responder budget.
+ */
+export function createResponderPageOnlyExactGraphPlanMemo(ttlMs, maxEntries, budget) {
+    return createPageOnlySessionPlanMemo(ttlMs, maxEntries, budget, plan => plan);
+}
 function createSubGraphNameMemo(loadNames, ttlMs) {
     const cached = new Map();
     const inflight = new Map();
@@ -340,42 +272,6 @@ function createSubGraphNameMemo(loadNames, ttlMs) {
         },
     };
 }
-export function compareRows(a, b) {
-    return (compareCodePoint(a.g, b.g) ||
-        compareCodePoint(a.s, b.s) ||
-        compareCodePoint(a.p, b.p) ||
-        compareCodePoint(a.o, b.o));
-}
-/**
- * The `(g, s)` identity a durable `_meta` row belongs to. Durable meta is
- * ordered by `(g, s, p, o)`; a graph-scoped assertion seal is ONE `(g, s)`
- * subject whose rows — including the batch-local control field
- * `dkg:assertionVersion` — MUST cross the wire together in a single round, else
- * the receiver's per-round completeness check drops the control fields
- * permanently (#1788). Used to snap durable-meta page boundaries to subject
- * boundaries. The `\n` separator cannot occur inside an IRI, so distinct
- * subjects never collide.
- */
-function metaSubjectKey(row) {
-    return `${row.g}\n${row.s}`;
-}
-function serializeResponderRow(row) {
-    return `${formatTerm(row.s)} <${assertSafeIri(row.p)}> ${formatTerm(row.o)} <${assertSafeIri(row.g)}> .`;
-}
-export function serializeResponderRows(rows) {
-    return rows.map(serializeResponderRow).join('\n');
-}
-const RESPONDER_ROW_ENCODER = new TextEncoder();
-/**
- * Serialized (N-Quads, UTF-8) wire byte length of one responder row — the ONE
- * byte model for response-frame budgets, shared by the byte-budget serializer
- * and the subject-atomic extend so both reason about `maxResponseBytes` the same
- * way (#1916). This is distinct from `estimateStringRowHeapBytes`, which
- * estimates retained HEAP size for snapshot memory budgets only.
- */
-function serializedResponderRowByteLength(row) {
-    return RESPONDER_ROW_ENCODER.encode(serializeResponderRow(row)).byteLength;
-}
 /**
  * A non-negotiated (legacy) durable-meta request cannot be served frame-safe:
  * the subject-atomic, row-limit-bound page — a single admitted subject alone or
@@ -511,30 +407,6 @@ function subjectAtomicBudgetEnd(rows, start, maxBytes, rowLimit, trailingComplet
     }
     return lastBoundary;
 }
-/**
- * Serialize the largest prefix that fits the negotiated response target.
- * Pagination advances by the number of N-Quads actually parsed by the
- * requester, so returning a prefix is cursor-safe. Always emit one row when a
- * non-empty input contains an unexpectedly oversized row; that guarantees
- * forward progress and leaves the transport's existing hard frame limit as the
- * final safety boundary for that pathological single row.
- */
-export function serializeResponderRowsWithinByteBudget(rows, maxBytes) {
-    const safeMaxBytes = Math.max(1, Math.floor(maxBytes));
-    const page = [];
-    let bytes = 0;
-    for (const row of rows) {
-        const serialized = serializeResponderRow(row);
-        const rowBytes = serializedResponderRowByteLength(row) + (page.length > 0 ? 1 : 0);
-        if (page.length > 0 && bytes + rowBytes > safeMaxBytes)
-            break;
-        page.push(serialized);
-        bytes += rowBytes;
-        if (bytes >= safeMaxBytes)
-            break;
-    }
-    return page.join('\n');
-}
 export async function readSwmMetaPage(params) {
     const graphs = swmGraphsForRegisteredSubGraphs(params.contextGraphId, params.registeredSubGraphNames, true);
     const candidateGraphs = graphs.filter((graph) => params.graphMembership.has(graph));
@@ -544,6 +416,7 @@ export async function readSwmMetaPage(params) {
             key: params.rowListCacheKey,
             refresh: params.refreshRowList,
             refreshGeneration: params.refreshGeneration,
+            releaseOnShortPage: params.releaseCacheOnShortPage,
             expiredMessage: 'Shared-memory meta sync session snapshot expired before page completion',
         }
         : undefined;
@@ -596,6 +469,7 @@ export async function readSwmDataPage(params) {
             key: params.rowListCacheKey,
             refresh: params.refreshRowList,
             refreshGeneration: params.refreshGeneration,
+            releaseOnShortPage: params.releaseCacheOnShortPage,
             expiredMessage: 'Shared-memory data sync session snapshot expired before page completion',
         }
         : undefined;
@@ -625,7 +499,7 @@ export async function readDurableMetaPage(params) {
     if (params.assetUals !== undefined) {
         if (params.assetUals.length === 0)
             return [];
-        const manifest = await readGraphScopedVmManifest(params.store, params.contextGraphId, params.signal);
+        const manifest = await readGraphScopedVmManifest(params.store, params.contextGraphId, params.signal, params.assetUals);
         const requested = new Set(params.assetUals);
         const confirmedUals = manifest.confirmedEntries
             .map((entry) => entry.ual)
@@ -677,242 +551,6 @@ export async function readDurableMetaPage(params) {
  * transport read cap (the requester loops for more). A single graph larger than
  * this is still emitted alone rather than split across pages. */
 const DEFAULT_CHANGELOG_PAGE_BYTES = 4 * 1024 * 1024;
-/**
- * Read the constant-size V2 control rows that already form a per-KA manifest.
- *
- * The payload graph and its row count are authenticated again by the requester,
- * but deriving the responder plan from these rows removes three store-wide or
- * per-graph discovery operations from the normal rootless path: graph-family
- * enumeration as authority, child-prefix probing after the reserved VM segment,
- * and COUNT(*)/countQuads for every KA. The query is deliberately one exact
- * metadata graph, standard SPARQL 1.1, unordered, row/response bounded, and
- * backend-neutral.
- */
-async function readGraphScopedVmManifest(store, contextGraphId, signal) {
-    const metaGraph = contextGraphMetaGraphUri(contextGraphId);
-    const contextGraph = contextGraphDataGraphUri(contextGraphId);
-    const maxRows = SYNC_RESPONDER_SNAPSHOT_BUILD_MAX_ROWS;
-    const readBoundedBindings = async (sparql, operation) => {
-        let result;
-        try {
-            result = await store.query(sparql, {
-                ...syncResponderStoreOptions(signal, operation),
-                maxResponseBytes: snapshotResponseByteLimit(SYNC_RESPONDER_SNAPSHOT_BUILD_MAX_BYTES_ESTIMATE),
-            });
-        }
-        catch (error) {
-            if (!(error instanceof StoreResponseTooLargeError))
-                throw error;
-            throw snapshotBudgetError({
-                key: `durable-v2-manifest:${contextGraphId}`,
-                reason: 'snapshot_bytes',
-                rows: 0,
-                bytesEstimate: storeResponseActualBytes(error),
-                limit: SYNC_RESPONDER_SNAPSHOT_BUILD_MAX_BYTES_ESTIMATE,
-            });
-        }
-        if (result.type !== 'bindings')
-            return [];
-        if (result.bindings.length > maxRows) {
-            throw snapshotBudgetError({
-                key: `durable-v2-manifest:${contextGraphId}`,
-                reason: 'snapshot_rows',
-                rows: result.bindings.length,
-                bytesEstimate: 0,
-                limit: maxRows,
-            });
-        }
-        return result.bindings;
-    };
-    // Read every scope marker independently of the complete descriptor join.
-    // Without this pass, a partially written V2 descriptor would be absent from
-    // the join below and its payload graph could incorrectly fall through the
-    // legacy compatibility lane.
-    const markerBindings = await readBoundedBindings(`
-    SELECT ?ual ?scopeVersion WHERE {
-      GRAPH <${assertSafeIri(metaGraph)}> {
-        ?ual <${DKG_CONTENT_SCOPE_VERSION}> ?scopeVersion .
-      }
-    }
-    LIMIT ${maxRows + 1}
-  `, 'sync.responder.readGraphScopedVmManifestMarkers');
-    const scopeVersionsByUal = new Map();
-    for (const row of markerBindings) {
-        const ual = row['ual'];
-        const rawVersion = row['scopeVersion'];
-        if (!ual || !rawVersion)
-            continue;
-        const versions = scopeVersionsByUal.get(ual) ?? new Set();
-        versions.add(stripLiteral(rawVersion));
-        scopeVersionsByUal.set(ual, versions);
-    }
-    const currentV2Uals = new Set();
-    for (const [ual, versions] of scopeVersionsByUal) {
-        // Lifecycle, assertion-graph and SWM-operation rows deliberately repeat
-        // contentScopeVersion. Only deterministic UAL subjects are V2 descriptor
-        // candidates; a UAL-shaped partial descriptor still fails closed below.
-        if (!DETERMINISTIC_KA_UAL_SHAPE.test(ual))
-            continue;
-        if (versions.size !== 1) {
-            throw new Error(`Rootless sync manifest ${ual} has ambiguous scopeVersion`);
-        }
-        const decoded = [...versions][0];
-        if (!/^-?\d+$/.test(decoded)) {
-            throw new Error(`Rootless sync manifest ${ual} has invalid scopeVersion: ${decoded}`);
-        }
-        const version = BigInt(decoded);
-        if (version < 0n || version.toString() !== decoded) {
-            throw new Error(`Rootless sync manifest ${ual} has non-canonical scopeVersion: ${decoded}`);
-        }
-        if (version === 0n || version === 1n)
-            continue;
-        if (version !== BigInt(GRAPH_KA_CONTENT_SCOPE_VERSION)) {
-            throw new Error(`Rootless sync manifest ${ual} has unsupported contentScopeVersion ${decoded}`);
-        }
-        currentV2Uals.add(ual);
-    }
-    const bindings = await readBoundedBindings(`
-      SELECT ?ual ?scopeVersion ?kaUal ?assertionVersion ?assertionGraph
-             ?contextGraph ?publicTripleCount ?privateTripleCount ?status ?subGraphName
-      WHERE {
-        GRAPH <${assertSafeIri(metaGraph)}> {
-          ?ual <${DKG_CONTENT_SCOPE_VERSION}> ?scopeVersion ;
-               <${DKG_KA_UAL}> ?kaUal ;
-               <${DKG_ASSERTION_VERSION}> ?assertionVersion ;
-               <${DKG_ASSERTION_GRAPH}> ?assertionGraph ;
-               <${DKG_CONTEXT_GRAPH}> ?contextGraph ;
-               <${DKG_PUBLIC_TRIPLE_COUNT}> ?publicTripleCount ;
-               <${DKG_PRIVATE_TRIPLE_COUNT}> ?privateTripleCount ;
-               <${DKG_STATUS}> ?status .
-          OPTIONAL { ?ual <${DKG_SUB_GRAPH_NAME}> ?subGraphName }
-        }
-      }
-      LIMIT ${maxRows + 1}
-  `, 'sync.responder.readGraphScopedVmManifest');
-    const fields = [
-        'scopeVersion',
-        'kaUal',
-        'assertionVersion',
-        'assertionGraph',
-        'contextGraph',
-        'publicTripleCount',
-        'privateTripleCount',
-        'status',
-        'subGraphName',
-    ];
-    const byUal = new Map();
-    for (const row of bindings) {
-        const ual = row['ual'];
-        if (!ual)
-            continue;
-        const values = byUal.get(ual) ?? new Map();
-        for (const field of fields) {
-            const value = row[field];
-            if (!value)
-                continue;
-            const set = values.get(field) ?? new Set();
-            set.add(value);
-            values.set(field, set);
-        }
-        byUal.set(ual, values);
-    }
-    for (const ual of currentV2Uals) {
-        if (!byUal.has(ual)) {
-            throw new Error(`Rootless sync manifest ${ual} has an incomplete V2 descriptor`);
-        }
-    }
-    const confirmedEntries = [];
-    const knownGraphs = new Set();
-    const graphOwners = new Map();
-    for (const [ual, values] of byUal) {
-        if (!currentV2Uals.has(ual))
-            continue;
-        const requireSingle = (field) => {
-            const candidates = [...(values.get(field) ?? [])];
-            if (candidates.length !== 1) {
-                throw new Error(`Rootless sync manifest ${ual} has ${candidates.length === 0 ? 'missing' : 'ambiguous'} ${field}`);
-            }
-            return candidates[0];
-        };
-        const optionalSingle = (field) => {
-            const candidates = [...(values.get(field) ?? [])];
-            if (candidates.length > 1) {
-                throw new Error(`Rootless sync manifest ${ual} has ambiguous ${field}`);
-            }
-            return candidates[0];
-        };
-        const parseCanonicalInteger = (field, minimum) => {
-            const decoded = stripLiteral(requireSingle(field));
-            if (!/^-?\d+$/.test(decoded)) {
-                throw new Error(`Rootless sync manifest ${ual} has invalid ${field}: ${decoded}`);
-            }
-            const value = BigInt(decoded);
-            if (value < minimum || value.toString() !== decoded) {
-                throw new Error(`Rootless sync manifest ${ual} has non-canonical ${field}: ${decoded}`);
-            }
-            return value;
-        };
-        const scopeVersion = parseCanonicalInteger('scopeVersion', 0n);
-        if (scopeVersion !== BigInt(GRAPH_KA_CONTENT_SCOPE_VERSION)) {
-            throw new Error(`Rootless sync manifest ${ual} changed scopeVersion during projection`);
-        }
-        const metadataUal = requireSingle('kaUal');
-        if (metadataUal !== ual) {
-            throw new Error(`Rootless sync manifest UAL mismatch: subject ${ual}, kaUal ${metadataUal}`);
-        }
-        const assertionVersion = parseCanonicalInteger('assertionVersion', 1n);
-        const scope = createGraphKnowledgeAssetScope(ual, assertionVersion);
-        if (scope.ual !== ual) {
-            throw new Error(`Rootless sync manifest contains non-canonical UAL ${ual}`);
-        }
-        if (requireSingle('contextGraph') !== contextGraph) {
-            throw new Error(`Rootless sync manifest ${ual} points outside context graph ${contextGraphId}`);
-        }
-        const rawSubGraphName = optionalSingle('subGraphName');
-        const subGraphName = rawSubGraphName === undefined
-            ? undefined
-            : stripLiteral(rawSubGraphName);
-        if (subGraphName !== undefined && !validateSubGraphName(subGraphName).valid) {
-            throw new Error(`Rootless sync manifest ${ual} has invalid subGraphName ${subGraphName}`);
-        }
-        const expectedGraph = knowledgeAssetLayerGraphUri(contextGraphId, MemoryLayer.VerifiableMemory, scope, subGraphName);
-        const assertionGraph = requireSingle('assertionGraph');
-        if (assertionGraph !== expectedGraph) {
-            throw new Error(`Rootless sync manifest ${ual} assertionGraph mismatch: expected ${expectedGraph}, found ${assertionGraph}`);
-        }
-        const publicCount = parseCanonicalInteger('publicTripleCount', 0n);
-        const privateCount = parseCanonicalInteger('privateTripleCount', 0n);
-        if (publicCount > BigInt(Number.MAX_SAFE_INTEGER) || privateCount > BigInt(Number.MAX_SAFE_INTEGER)) {
-            throw new Error(`Rootless sync manifest ${ual} has an unsafe triple count`);
-        }
-        if (publicCount === 0n && privateCount === 0n) {
-            throw new Error(`Rootless sync manifest ${ual} describes an empty asset`);
-        }
-        const owner = graphOwners.get(assertionGraph);
-        if (owner && owner !== ual) {
-            throw new Error(`Rootless sync graph ${assertionGraph} has multiple UAL owners`);
-        }
-        graphOwners.set(assertionGraph, ual);
-        knownGraphs.add(assertionGraph);
-        const statuses = new Set([...(values.get('status') ?? [])].map((status) => stripLiteral(status)));
-        if (statuses.size !== 1) {
-            throw new Error(`Rootless sync manifest ${ual} has ambiguous status metadata`);
-        }
-        if (!statuses.has('confirmed'))
-            continue;
-        confirmedEntries.push({
-            ual,
-            graph: assertionGraph,
-            rowCount: Number(publicCount),
-        });
-    }
-    confirmedEntries.sort((a, b) => compareCodePoint(a.graph, b.graph));
-    return {
-        confirmedEntries,
-        confirmedGraphs: new Set(confirmedEntries.map((entry) => entry.graph)),
-        knownGraphs,
-    };
-}
 /**
  * The per-CG admission boundary shared by the durable-data phase and the
  * changelog delta lane: the candidate-graph exclusions (wrong CG / top or
@@ -1045,6 +683,11 @@ export async function readChangelogDeltaPage(params) {
         : drained ? Math.max(lastRawSeq, head.seq) : lastRawSeq;
     return { kind: 'delta', era: headAfter.era, headSeq: headAfter.seq, nextSeq, records };
 }
+/** Compatibility dispatcher; selected exact DATA owns its reader and fences separately. */
+export async function readDurableDataPageWithLease(params) {
+    return params.assetUals !== undefined ? readExactDataSessionPage(params) : { rows: await readDurableDataPage(params) };
+}
+/** Ordinary row callers use the conservative reader without acquiring a response lease. */
 export async function readDurableDataPage(params) {
     const cache = params.rowListMemo
         ? {
@@ -1056,17 +699,20 @@ export async function readDurableDataPage(params) {
         }
         : undefined;
     if (params.assetUals !== undefined) {
-        if (params.assetUals.length === 0)
-            return [];
-        const requested = new Set(params.assetUals);
-        return readPagedRowsFromExactGraphPlanLoader(params.store, params.offset, params.limit, cache, params.signal, params.exactGraphPlanMemo, async (planSignal) => {
-            const manifest = await readGraphScopedVmManifest(params.store, params.contextGraphId, planSignal);
-            const entries = manifest.confirmedEntries.filter((entry) => requested.has(entry.ual));
-            return buildExactGraphPagePlan(params.store, entries.map((entry) => entry.graph), () => Promise.resolve(true), planSignal, new Map(entries.map((entry) => [entry.graph, entry.rowCount])), params.exactGraphReadMode);
-        });
-    }
+        return (await readExactDataSessionPage({ ...params, exactAssetExportCache: undefined })).rows;
+    }
+    const sessionMemo = params.exactDataSessionMemo;
+    const planMemo = sessionMemo
+        ? { async get(key, load, options) {
+                const session = await sessionMemo.get(key, async () => createStoreOnlyDataSession(params.store, await load(), cache?.memo.snapshotLoadLimits ?? {
+                    maxRows: SYNC_RESPONDER_SNAPSHOT_BUILD_MAX_ROWS,
+                    maxBytesEstimate: SYNC_RESPONDER_SNAPSHOT_BUILD_MAX_BYTES_ESTIMATE,
+                }), options);
+                return session?.graphPlan ?? null;
+            } }
+        : params.exactGraphPlanMemo;
     if (params.sinceBatchId == null) {
-        return readPagedRowsFromExactGraphPlanLoader(params.store, params.offset, params.limit, cache, params.signal, params.exactGraphPlanMemo, async (planSignal) => {
+        return readPagedRowsFromExactGraphPlanLoader(params.store, params.offset, params.limit, cache, params.signal, planMemo, async (planSignal) => {
             const manifest = await readGraphScopedVmManifest(params.store, params.contextGraphId, planSignal);
             const { cgPrefix, isCandidateGraph, isAdmitted } = createAdmissionContext(params.store, params.contextGraphId, { graphScopedVmManifest: manifest });
             // A just-committed exact graph may precede a stale external graph-list
@@ -1140,413 +786,11 @@ async function readPagedRowsFromExactGraphPlanLoader(store, offset, limit, cache
     const getPlan = createSessionPlanGetter(planMemo, cache?.key, cache?.refresh === true, (planSignal) => loadExactGraphPlan(planSignal), 'Sync session exact-graph plan expired before page completion');
     const loadPage = async (pageOffset, pageLimit, pageSignal) => {
         const plan = await getPlan(pageOffset, pageSignal);
-        return readRowsPageFromExactGraphPlan(store, plan, pageOffset, pageLimit, rowSnapshotLimits, pageSignal);
+        const rows = await readRowsPageFromExactGraphPlan(store, plan, pageOffset, pageLimit, rowSnapshotLimits, pageSignal);
+        throwIfAborted(pageSignal);
+        return rows;
     };
-    return readResponderRowsPage(cache && {
-        ...cache,
-        expiredMessage: cache.expiredMessage ?? 'Durable data sync session snapshot expired before page completion',
-    }, loadPage, offset, limit, signal, cache
-        ? {
-            loadSnapshot: async () => readExactGraphPlanSnapshot(store, await getPlan(0, undefined), cache, rowSnapshotLimits),
-        }
-        : undefined);
-}
-async function buildExactGraphPagePlan(store, graphs, isAdmitted, signal, knownRowCounts, exactGraphReadMode = 'snapshot-or-page') {
-    const entries = [];
-    for (const graph of dedupeStrings(graphs).sort(compareCodePoint)) {
-        throwIfAborted(signal);
-        if (!(await isAdmitted(graph)))
-            continue;
-        const rowCount = knownRowCounts?.get(graph) ?? await store.countQuads(graph, syncResponderStoreOptions(signal, 'sync.responder.countExactGraphRows'));
-        if (rowCount > 0)
-            entries.push({ graph, rowCount });
-    }
-    return {
-        entries,
-        totalRows: entries.reduce((sum, entry) => sum + entry.rowCount, 0),
-        pagedGraphs: new Set(exactGraphReadMode === 'page-only'
-            ? entries.map((entry) => entry.graph)
-            : []),
-        cursors: new Map([[0, null]]),
-    };
-}
-const EXACT_GRAPH_CURSOR_CACHE_MAX_ENTRIES = 512;
-/** Datatypes whose SPARQL value comparison is numeric/date-like, not lexical. */
-const SPARQL_VALUE_ORDERED_DATATYPES = [
-    'http://www.w3.org/2001/XMLSchema#boolean',
-    'http://www.w3.org/2001/XMLSchema#date',
-    'http://www.w3.org/2001/XMLSchema#dateTime',
-    'http://www.w3.org/2001/XMLSchema#dateTimeStamp',
-    'http://www.w3.org/2001/XMLSchema#dayTimeDuration',
-    'http://www.w3.org/2001/XMLSchema#decimal',
-    'http://www.w3.org/2001/XMLSchema#double',
-    'http://www.w3.org/2001/XMLSchema#duration',
-    'http://www.w3.org/2001/XMLSchema#float',
-    'http://www.w3.org/2001/XMLSchema#gDay',
-    'http://www.w3.org/2001/XMLSchema#gMonth',
-    'http://www.w3.org/2001/XMLSchema#gMonthDay',
-    'http://www.w3.org/2001/XMLSchema#gYear',
-    'http://www.w3.org/2001/XMLSchema#gYearMonth',
-    'http://www.w3.org/2001/XMLSchema#integer',
-    'http://www.w3.org/2001/XMLSchema#nonNegativeInteger',
-    'http://www.w3.org/2001/XMLSchema#nonPositiveInteger',
-    'http://www.w3.org/2001/XMLSchema#negativeInteger',
-    'http://www.w3.org/2001/XMLSchema#positiveInteger',
-    'http://www.w3.org/2001/XMLSchema#long',
-    'http://www.w3.org/2001/XMLSchema#int',
-    'http://www.w3.org/2001/XMLSchema#short',
-    'http://www.w3.org/2001/XMLSchema#time',
-    'http://www.w3.org/2001/XMLSchema#byte',
-    'http://www.w3.org/2001/XMLSchema#unsignedLong',
-    'http://www.w3.org/2001/XMLSchema#unsignedInt',
-    'http://www.w3.org/2001/XMLSchema#unsignedShort',
-    'http://www.w3.org/2001/XMLSchema#unsignedByte',
-    'http://www.w3.org/2001/XMLSchema#yearMonthDuration',
-];
-const SPARQL_VALUE_ORDERED_DATATYPE_VALUES = SPARQL_VALUE_ORDERED_DATATYPES
-    .map((datatype) => `<${datatype}>`)
-    .join(', ');
-function hasValueOrderedDatatype(term) {
-    return SPARQL_VALUE_ORDERED_DATATYPES
-        .some((datatype) => term.endsWith(`^^<${datatype}>`));
-}
-function hasUnsupportedExactGraphCursorTerm(cursor) {
-    // SPARQL exposes no portable ordering relation for blank-node identifiers.
-    // Ordered XSD values also cannot be continued portably with `>`: float and
-    // double admit NaN, duration comparison can be partial, and distinct lexical
-    // forms can denote the same date/time or numeric value. ORDER BY can still
-    // place those terms after the cursor even when `>` is false. Falling back
-    // preserves the pre-existing deterministic path for each unsafe boundary.
-    return [cursor.s, cursor.p, cursor.o].some((term) => (term.startsWith('_:') || hasValueOrderedDatatype(term)));
-}
-/**
- * Build a SPARQL predicate for one term being strictly after a cursor term in
- * the backend's `ORDER BY` order. IRI rank is explicit, while
- * literal values use value comparison for ordered XSD datatypes and lexical
- * comparison otherwise.  The datatype/language tie-break mirrors Oxigraph's
- * RDF-term ordering and is covered by the mixed-term regression fixture.
- */
-function termAfterExactGraphCursor(variable, cursorTerm) {
-    const formatted = formatTerm(cursorTerm);
-    if (!cursorTerm.startsWith('"')) {
-        return `(isLiteral(${variable}) || (isIRI(${variable}) && STR(${variable}) > STR(${formatted})))`;
-    }
-    return `(
-    isLiteral(${variable}) && (
-      (
-        STR(${variable}) > STR(${formatted})
-        && !(
-          DATATYPE(${variable}) = DATATYPE(${formatted})
-          && DATATYPE(${variable}) IN (${SPARQL_VALUE_ORDERED_DATATYPE_VALUES})
-        )
-      )
-      || (
-        STR(${variable}) = STR(${formatted}) && (
-          STR(DATATYPE(${variable})) > STR(DATATYPE(${formatted}))
-          || (
-            DATATYPE(${variable}) = DATATYPE(${formatted})
-            && LANG(${variable}) > LANG(${formatted})
-          )
-        )
-      )
-      || (
-        DATATYPE(${variable}) = DATATYPE(${formatted})
-        && DATATYPE(${variable}) IN (${SPARQL_VALUE_ORDERED_DATATYPE_VALUES})
-        && ${variable} > ${formatted}
-      )
-    )
-  )`;
-}
-function exactGraphCursorFilter(cursor) {
-    const s = formatTerm(cursor.s);
-    const p = formatTerm(cursor.p);
-    return `(
-    ${termAfterExactGraphCursor('?s', cursor.s)}
-    || (?s = ${s} && ${termAfterExactGraphCursor('?p', cursor.p)})
-    || (
-      ?s = ${s}
-      && ?p = ${p}
-      && ${termAfterExactGraphCursor('?o', cursor.o)}
-    )
-  )`;
-}
-function rememberExactGraphPageCursor(plan, offset, cursor) {
-    const existing = plan.cursors.get(offset);
-    if (existing && (existing.graph !== cursor.graph
-        || existing.graphOffset !== cursor.graphOffset
-        || existing.s !== cursor.s
-        || existing.p !== cursor.p
-        || existing.o !== cursor.o)) {
-        // A boundary changing within one memoized session means the source no
-        // longer describes the committed plan. Do not silently choose one cursor.
-        throw new Error(`Sync exact-graph cursor changed at offset ${offset}`);
-    }
-    plan.cursors.delete(offset);
-    plan.cursors.set(offset, cursor);
-    while (plan.cursors.size > EXACT_GRAPH_CURSOR_CACHE_MAX_ENTRIES) {
-        let evict = plan.cursors.keys().next().value;
-        // Offset zero is the session origin and is never evicted.
-        if (evict === 0) {
-            const next = plan.cursors.keys();
-            next.next();
-            evict = next.next().value;
-        }
-        plan.cursors.delete(evict);
-    }
-}
-function snapshotResponseByteLimit(maxBytesEstimate) {
-    // SPARQL JSON adds field names and escaping around each RDF term. Bound the
-    // transport body independently while leaving enough headroom for that wire
-    // overhead. HTTP adapters enforce this before parsing; embedded adapters are
-    // still bounded by the row LIMIT below.
-    return Math.max(1, Math.min(Number.MAX_SAFE_INTEGER, Math.floor(maxBytesEstimate) * 2));
-}
-/** Clamp a store response-cap overshoot (possibly bigint) into a safe number. */
-function storeResponseActualBytes(error) {
-    return typeof error.actualBytes === 'bigint'
-        ? Number(error.actualBytes > BigInt(Number.MAX_SAFE_INTEGER)
-            ? BigInt(Number.MAX_SAFE_INTEGER)
-            : error.actualBytes)
-        : error.actualBytes;
-}
-function snapshotBudgetError(params) {
-    return new SyncRowSnapshotBudgetError(params);
-}
-async function loadExactGraphRowsSnapshot(store, plan, entry, limits, signal) {
-    if (entry.rowCount > limits.maxRows || plan.pagedGraphs.has(entry.graph))
-        return null;
-    if (plan.activeGraphRows?.graph === entry.graph)
-        return plan.activeGraphRows.rows;
-    if (plan.activeGraphRowsLoad?.graph === entry.graph) {
-        return raceAgainstAbort(plan.activeGraphRowsLoad.promise, signal);
-    }
-    const load = (async () => {
-        try {
-            const result = await store.query(`
-        SELECT ?s ?p ?o WHERE {
-          GRAPH <${assertSafeIri(entry.graph)}> { ?s ?p ?o }
-        }
-        LIMIT ${limits.maxRows + 1}
-      `, {
-                ...syncResponderStoreOptions(undefined, 'sync.responder.readExactGraphSnapshot'),
-                maxResponseBytes: snapshotResponseByteLimit(limits.maxBytesEstimate),
-            });
-            if (result.type !== 'bindings')
-                return [];
-            const rows = [];
-            let bytesEstimate = 0;
-            for (const row of result.bindings) {
-                const s = row['s'];
-                const p = row['p'];
-                const o = row['o'];
-                if (!s || !p || !o)
-                    continue;
-                const nextBytes = bytesEstimate + estimateStringRowHeapBytes(s, p, o, entry.graph);
-                if (rows.length + 1 > limits.maxRows || nextBytes > limits.maxBytesEstimate) {
-                    plan.pagedGraphs.add(entry.graph);
-                    return null;
-                }
-                rows.push({ s, p, o, g: entry.graph });
-                bytesEstimate = nextBytes;
-            }
-            // The plan count and payload must describe one immutable graph snapshot.
-            // A mismatch means the graph changed between COUNT and SELECT; fail the
-            // session rather than silently skipping or duplicating rows.
-            if (rows.length !== entry.rowCount) {
-                throw new Error(`Sync exact-graph plan changed while reading ${entry.graph}: ` +
-                    `expected ${entry.rowCount} rows, found ${rows.length}`);
-            }
-            rows.sort(compareRows);
-            plan.activeGraphRows = { graph: entry.graph, rows };
-            return rows;
-        }
-        catch (error) {
-            if (error instanceof StoreResponseTooLargeError) {
-                plan.pagedGraphs.add(entry.graph);
-                return null;
-            }
-            throw error;
-        }
-    })().finally(() => {
-        if (plan.activeGraphRowsLoad?.promise === load)
-            plan.activeGraphRowsLoad = undefined;
-    });
-    plan.activeGraphRowsLoad = { graph: entry.graph, promise: load };
-    return raceAgainstAbort(load, signal);
-}
-async function readExactGraphPlanSnapshot(store, plan, cache, limits) {
-    if (plan.totalRows > limits.maxRows) {
-        throw snapshotBudgetError({
-            key: cache.key,
-            reason: 'snapshot_rows',
-            rows: plan.totalRows,
-            bytesEstimate: 0,
-            limit: limits.maxRows,
-        });
-    }
-    const rows = [];
-    let bytesEstimate = 0;
-    for (const entry of plan.entries) {
-        const graphRows = await loadExactGraphRowsSnapshot(store, plan, entry, limits);
-        if (!graphRows) {
-            throw snapshotBudgetError({
-                key: cache.key,
-                reason: 'snapshot_bytes',
-                rows: rows.length,
-                bytesEstimate: limits.maxBytesEstimate + 1,
-                limit: limits.maxBytesEstimate,
-            });
-        }
-        for (const row of graphRows) {
-            const nextBytes = bytesEstimate + estimateStringRowHeapBytes(row.s, row.p, row.o, row.g);
-            if (nextBytes > limits.maxBytesEstimate) {
-                throw snapshotBudgetError({
-                    key: cache.key,
-                    reason: 'snapshot_bytes',
-                    rows: rows.length + 1,
-                    bytesEstimate: nextBytes,
-                    limit: limits.maxBytesEstimate,
-                });
-            }
-            rows.push(row);
-            bytesEstimate = nextBytes;
-        }
-    }
-    return rows.sort(compareRows);
-}
-async function readRowsPageFromExactGraphPlan(store, plan, offset, limit, snapshotLimits, signal) {
-    const safeOffset = Math.max(0, Math.floor(offset));
-    let skip = safeOffset;
-    let remaining = Math.max(0, Math.floor(limit));
-    if (remaining === 0 || skip >= plan.totalRows)
-        return [];
-    const rows = [];
-    const cursor = plan.cursors.get(safeOffset);
-    const useSeek = cursor !== undefined
-        && cursor !== null
-        && !hasUnsupportedExactGraphCursorTerm(cursor);
-    let cursorActive = useSeek;
-    let lastGraphOffset = 0;
-    let lastRow;
-    for (const entry of plan.entries) {
-        let entryOffset;
-        let seekFilter;
-        if (cursorActive && cursor) {
-            const graphOrder = compareCodePoint(entry.graph, cursor.graph);
-            if (graphOrder < 0)
-                continue;
-            if (graphOrder === 0) {
-                entryOffset = cursor.graphOffset;
-                if (entryOffset > entry.rowCount) {
-                    throw new Error(`Sync exact-graph cursor is past the committed row count for ${entry.graph}`);
-                }
-                seekFilter = exactGraphCursorFilter(cursor);
-            }
-            else {
-                // Once the cursor's graph is exhausted, every later graph starts at
-                // row zero and can be read with a plain LIMIT.  There is no OFFSET to
-                // make the store revisit the already-consumed prefix.
-                entryOffset = 0;
-            }
-        }
-        else {
-            if (skip >= entry.rowCount) {
-                skip -= entry.rowCount;
-                continue;
-            }
-            entryOffset = skip;
-        }
-        const expectedRows = Math.min(entry.rowCount - entryOffset, remaining);
-        if (expectedRows <= 0) {
-            cursorActive = false;
-            // The cursor already consumed this graph. Subsequent graphs start at
-            // their own zero offset rather than reusing the request's global offset.
-            skip = 0;
-            continue;
-        }
-        let added = 0;
-        const graphRows = await loadExactGraphRowsSnapshot(store, plan, entry, snapshotLimits, signal);
-        if (graphRows) {
-            const page = graphRows.slice(entryOffset, entryOffset + expectedRows);
-            rows.push(...page);
-            added = page.length;
-        }
-        else {
-            const isFinalGraphPage = entryOffset + expectedRows === entry.rowCount;
-            const seekEntry = cursorActive && cursor !== undefined && cursor !== null;
-            const offsetClause = seekFilter || seekEntry ? '' : `\n        OFFSET ${entryOffset}`;
-            // Keep the no-cursor query compact and compatible with adapters and
-            // instrumentation that recognize the established one-line graph
-            // pattern.  Cursor pages need the expanded form for their FILTER.
-            const graphPattern = seekFilter
-                ? `GRAPH <${assertSafeIri(entry.graph)}> {
-            ?s ?p ?o
-            FILTER(${seekFilter})
-          }`
-                : `GRAPH <${assertSafeIri(entry.graph)}> { ?s ?p ?o }`;
-            const result = await store.query(`
-        SELECT ?s ?p ?o WHERE {
-          ${graphPattern}
-        }
-        ORDER BY ?s ?p ?o
-        ${offsetClause}
-        LIMIT ${expectedRows + (isFinalGraphPage ? 1 : 0)}
-      `, {
-                ...syncResponderStoreOptions(signal, 'sync.responder.readExactGraphRowsPage'),
-                maxResponseBytes: snapshotResponseByteLimit(snapshotLimits.maxBytesEstimate),
-            });
-            if (result.type === 'bindings') {
-                for (const row of result.bindings) {
-                    const s = row['s'];
-                    const p = row['p'];
-                    const o = row['o'];
-                    if (s && p && o) {
-                        rows.push({ s, p, o, g: entry.graph });
-                        added += 1;
-                    }
-                }
-            }
-            if (isFinalGraphPage && added > expectedRows) {
-                throw new Error(`Sync exact-graph plan changed while paging ${entry.graph}: `
-                    + `expected ${entry.rowCount} total rows but found a surplus row`);
-            }
-        }
-        // Exact-asset metadata is a commitment to the number of rows in each
-        // assertion graph. Do not let a short graph borrow rows from the next
-        // graph in the plan: that produces a full-looking response whose graph
-        // boundaries no longer match the manifest and hides the damaged source.
-        if (added !== expectedRows) {
-            throw new Error(`Sync exact-graph plan changed while paging ${entry.graph}: ` +
-                `expected ${expectedRows} rows at offset ${entryOffset}, found ${added}`);
-        }
-        if (added > 0) {
-            lastRow = rows[rows.length - 1];
-            lastGraphOffset = entryOffset + added;
-        }
-        remaining -= added;
-        if (remaining <= 0)
-            break;
-        skip = 0;
-        // The cursor has served its graph.  Later entries are read from their
-        // beginning, still without OFFSET.
-        cursorActive = false;
-    }
-    const expectedTotal = Math.min(safeOffset + Math.max(0, Math.floor(limit)), plan.totalRows)
-        - safeOffset;
-    if (rows.length !== expectedTotal) {
-        throw new Error(`Sync exact-graph plan changed at offset ${safeOffset}: `
-            + `expected ${expectedTotal} rows, found ${rows.length}`);
-    }
-    if (lastRow) {
-        rememberExactGraphPageCursor(plan, safeOffset + rows.length, {
-            graph: lastRow.g,
-            graphOffset: lastGraphOffset,
-            s: lastRow.s,
-            p: lastRow.p,
-            o: lastRow.o,
-        });
-    }
-    return rows;
+    return readResponderRowsPage(cache && { ...cache, expiredMessage: cache.expiredMessage ?? 'Durable data sync session snapshot expired before page completion' }, loadPage, offset, limit, signal, cache ? { loadSnapshot: async () => readExactGraphPlanSnapshot(store, await getPlan(0, undefined), cache, rowSnapshotLimits) } : undefined);
 }
 async function readPagedDurableDeltaRowsAcrossGraphs(store, graphs, metaGraphs, sinceBatchId, offset, limit, cache, signal) {
     return readResponderRowsPage(cache && {
@@ -1554,181 +798,6 @@ async function readPagedDurableDeltaRowsAcrossGraphs(store, graphs, metaGraphs,
         expiredMessage: cache.expiredMessage ?? 'Durable data sync session snapshot expired before page completion',
     }, (pageOffset, pageLimit, pageSignal) => readDurableDeltaRowsPageAcrossGraphs(store, graphs, metaGraphs, sinceBatchId, pageOffset, pageLimit, pageSignal), offset, limit, signal);
 }
-/**
- * Session-plan getter shared by the plan-backed lanes (exact-graph and TTL SWM
- * meta), owning the one lifecycle both must agree on:
- *
- *  - the explicit session refresh is consumed exactly ONCE, so when a snapshot
- *    build crosses its budget, the immediate page-zero fallback reuses the
- *    just-built plan instead of rebuilding (and re-counting) it against a
- *    moving store;
- *  - offset>0 REQUIRES the existing plan — silently rebuilding against moved
- *    data would make the numeric offset skip or duplicate rows;
- *  - memo expiry becomes the lane's session-expired error.
- *
- * The SWM data lane intentionally does not use this helper: it has no snapshot
- * lane, so a single plan access per page means per-call refresh semantics are
- * equivalent and simpler there.
- */
-/**
- * Sessionless callers (no `syncSessionId` => no memo cache key) rebuild the
- * plan on EVERY page: per-page discovery + chunked GROUP BY cost (bounded, and
- * still far cheaper than the deleted global-sort query), no `requireExisting`
- * protection, and a fresh digest sidecar per plan object. Offset>0 pages
- * against a mutating store can therefore skip or duplicate rows for such
- * requesters — sessionless TTL paging is BEST-EFFORT, and the per-subject
- * digest guard does NOT cover it. This matches the exposure of the old OFFSET
- * lane (not a regression); requester-side verification still gates admission.
- */
-function createSessionPlanGetter(memo, cacheKey, initialRefreshPending, loadPlan, expiredMessage) {
-    let planRefreshPending = initialRefreshPending;
-    return async (pageOffset, pageSignal) => {
-        const refreshPlan = pageOffset === 0 && planRefreshPending;
-        if (refreshPlan)
-            planRefreshPending = false;
-        const plan = memo && cacheKey
-            ? await memo.get(cacheKey, () => loadPlan(pageSignal), {
-                refresh: refreshPlan,
-                requireExisting: pageOffset > 0,
-                signal: pageSignal,
-            })
-            : await loadPlan(pageSignal);
-        if (!plan)
-            throw new Error(expiredMessage);
-        return plan;
-    };
-}
-async function loadStorePagedSnapshot(cache, loadPage) {
-    const limits = cache.memo.snapshotLoadLimits ?? {
-        maxRows: SYNC_RESPONDER_SNAPSHOT_BUILD_MAX_ROWS,
-        maxBytesEstimate: SYNC_RESPONDER_SNAPSHOT_BUILD_MAX_BYTES_ESTIMATE,
-        pageRows: SYNC_RESPONDER_SNAPSHOT_BUILD_PAGE_ROWS,
-    };
-    const rows = [];
-    let bytesEstimate = 0;
-    let offset = 0;
-    // Read at most one row beyond the configured row cap. Tiny-budget tests and
-    // operators therefore never receive a 500-row temporary page merely to learn
-    // that a one-row snapshot is oversized.
-    const pageRows = Math.max(1, Math.min(Math.floor(limits.pageRows), Math.floor(limits.maxRows) + 1));
-    while (true) {
-        // The shared snapshot load is owner-independent: an individual request
-        // abort must not cancel a load used by coalesced waiters.
-        const page = await loadPage(offset, pageRows, undefined);
-        for (const row of page) {
-            const nextRows = rows.length + 1;
-            const nextBytes = bytesEstimate + estimateStringRowHeapBytes(row.s, row.p, row.o, row.g);
-            if (nextRows > limits.maxRows) {
-                throw new SyncRowSnapshotBudgetError({
-                    key: cache.key,
-                    reason: 'snapshot_rows',
-                    rows: nextRows,
-                    bytesEstimate: nextBytes,
-                    limit: limits.maxRows,
-                });
-            }
-            if (nextBytes > limits.maxBytesEstimate) {
-                throw new SyncRowSnapshotBudgetError({
-                    key: cache.key,
-                    reason: 'snapshot_bytes',
-                    rows: nextRows,
-                    bytesEstimate: nextBytes,
-                    limit: limits.maxBytesEstimate,
-                });
-            }
-            rows.push(row);
-            bytesEstimate = nextBytes;
-        }
-        if (page.length < pageRows)
-            return rows;
-        offset += page.length;
-    }
-}
-async function readResponderRowsPage(cache, loadStoreBoundedPage, offset, limit, signal, options) {
-    const loadSnapshot = options?.loadSnapshot;
-    const subjectAtomic = options?.subjectAtomic ?? false;
-    const safeOffset = Math.max(0, Math.floor(offset));
-    const safeLimit = Math.max(0, Math.floor(limit));
-    if (safeLimit === 0)
-        return [];
-    // No session snapshot: the store-paged loader itself enforces subject
-    // atomicity where required (durable meta passes a subject-atomic loader), so
-    // this path needs no extra handling.
-    if (!cache)
-        return loadStoreBoundedPage(safeOffset, safeLimit, signal);
-    try {
-        return await readCachedRowsPage(cache, loadSnapshot ?? (() => loadStorePagedSnapshot(cache, loadStoreBoundedPage)), safeOffset, safeLimit, signal, subjectAtomic);
-    }
-    catch (error) {
-        if (!isSyncRowSnapshotPagingRequiredError(error))
-            throw error;
-        return loadStoreBoundedPage(safeOffset, safeLimit, signal);
-    }
-}
-async function readCachedRowsPage(cache, loadRows, offset, limit, signal, subjectAtomic = false) {
-    const safeOffset = Math.max(0, Math.floor(offset));
-    const safeLimit = Math.max(0, Math.floor(limit));
-    if (safeLimit === 0)
-        return [];
-    const rows = await cache.memo.get(cache.key, loadRows, {
-        refresh: cache.refresh,
-        refreshGeneration: cache.refreshGeneration,
-        // No prefix has been consumed at offset zero, so an entry evicted under
-        // responder memory pressure can be rebuilt without mixing snapshots.
-        refreshExpired: safeOffset === 0,
-        requireExisting: safeOffset > 0,
-        signal,
-    });
-    if (rows == null) {
-        throw new Error(cache.expiredMessage ?? 'Sync session snapshot expired before page completion');
-    }
-    // `rows` is an immutable snapshot. Slice it directly so serving a 500-row
-    // page allocates only that page's backing array, never a shallow copy of the
-    // complete snapshot first.
-    let pageEnd = Math.min(safeOffset + safeLimit, rows.length);
-    // Subject-atomic durable-meta lane (#1788): if the requested window ends
-    // mid-subject, EXTEND it forward until the subject changes (or the snapshot
-    // ends) so a graph-scoped seal is never split across a page — and therefore
-    // never across a sync round. Extending (never trimming) keeps a non-final
-    // page `>= safeLimit`, so it never trips the requester's empty-page EOF nor
-    // the release-on-short-page path below. Reads only in-page indices plus a
-    // bounded one-subject lookahead — never the whole snapshot. `_meta` subjects
-    // are small (a seal is 14 quads; KA descriptors ~10; membership/activity rows
-    // bounded), so the extension is O(one subject) and negligible against the
-    // #1868 64k-row meta snapshot ceiling; a pathologically large subject is
-    // still emitted whole rather than truncated, with the transport frame limit
-    // as the final guard.
-    if (subjectAtomic && pageEnd > safeOffset && pageEnd < rows.length) {
-        const trailingKey = metaSubjectKey(rows[pageEnd - 1]);
-        while (pageEnd < rows.length && metaSubjectKey(rows[pageEnd]) === trailingKey) {
-            pageEnd += 1;
-        }
-    }
-    const page = rows.slice(safeOffset, pageEnd);
-    if (page.length === 0 || (cache.releaseOnShortPage !== false && page.length < safeLimit)) {
-        cache.memo.release(cache.key, { graceMs: COMPLETED_SYNC_RESPONDER_SESSION_GRACE_MS });
-    }
-    return page;
-}
-function asAbortError(reason) {
-    return reason instanceof Error ? reason : new Error(String(reason ?? 'aborted'));
-}
-function throwIfAborted(signal) {
-    if (signal?.aborted)
-        throw asAbortError(signal.reason);
-}
-function raceAgainstAbort(work, signal) {
-    if (!signal)
-        return work;
-    throwIfAborted(signal);
-    return new Promise((resolve, reject) => {
-        const onAbort = () => reject(asAbortError(signal.reason));
-        signal.addEventListener('abort', onAbort, { once: true });
-        work.then(resolve, reject).finally(() => {
-            signal.removeEventListener('abort', onAbort);
-        });
-    });
-}
 async function readAdmittedSwmSubGraphNames(store, contextGraphId, signal) {
     const cgPrefix = contextGraphDataGraphUri(contextGraphId);
     const names = [];
@@ -2187,10 +1256,17 @@ async function countFreshSwmMetaSubjectRows(store, graph, subjects, budgetKey, s
     for (const chunk of chunkValues(subjects, FRESH_SWM_META_PLAN_SUBJECT_CHUNK)) {
         let res;
         try {
+            // Blazegraph drops the groups when aggregate subjects are introduced by
+            // VALUES. Constant-subject branches keep indexed, bounded lookups on
+            // both backends; a FILTER IN would scan the whole metadata graph.
             res = await store.query(`
         SELECT ?s (COUNT(*) AS ?count) WHERE {
-          VALUES ?s { ${subjectValues(chunk)} }
-          GRAPH <${assertSafeIri(graph)}> { ?s ?p ?o }
+          GRAPH <${assertSafeIri(graph)}> {
+            ${chunk.map((subject) => {
+                const iri = `<${assertSafeIri(subject)}>`;
+                return `{ ${iri} ?p ?o BIND(${iri} AS ?s) }`;
+            }).join(' UNION ')}
+          }
         }
         GROUP BY ?s
       `, {
@@ -3251,12 +2327,6 @@ function durableDeltaGroupClause(metaGraphs, sinceBatchId, includeGraph = false)
 function graphValues(graphs) {
     return dedupeStrings(graphs).map((graph) => `<${assertSafeIri(graph)}>`).join(' ');
 }
-function durableDataRowListCacheKey(scope, contextGraphId, sinceBatchId, assetUals) {
-    const selection = assetUals === undefined
-        ? (sinceBatchId == null ? 'full' : `since:${sinceBatchId.toString()}`)
-        : exactAssetFilterKey(assetUals);
-    return `durable-data:${scope}:${contextGraphId}:${selection}`;
-}
 function dedupeStrings(values) {
     const seen = new Set();
     const out = [];
@@ -3280,11 +2350,4 @@ function stripLiteral(value) {
     const match = value.match(/^"((?:[^"\\]|\\.)*)"(?:@[\w-]+|\^\^<[^>]+>)?$/);
     return match ? match[1].replace(/\\"/g, '"').replace(/\\\\/g, '\\') : value;
 }
-function formatTerm(term) {
-    if (term.startsWith('"') || term.startsWith('_:'))
-        return term;
-    if (term.startsWith('<') && term.endsWith('>'))
-        return term;
-    return `<${assertSafeIri(term)}>`;
-}
 //# sourceMappingURL=graph-plan.js.map