@playola-radio/slipstream 0.1.0

package/dist/attribution-engine.js

@@ -0,0 +1,164 @@
+/**
+ * The attribution producer's scheduling + evaluation core. It decides *when* to
+ * evaluate a change and folds evidence into a published result; the honesty of
+ * the result itself is the pure reducer's ({@link ./attribution.ts}).
+ *
+ * Design (locked, Codex-vetted):
+ * - **Grace.** Every interval-bearing change arms a deadline at `end_ms +
+ *   grace_ms`; the first evaluation waits for it so a burst of evidence lands
+ *   before we commit to a status. An unavailable/legacy interval has no window to
+ *   wait for and resolves immediately to `observation-interval-unavailable`.
+ * - **Revision without new grace.** A resolved change stays revisable: later
+ *   evidence triggers a fresh evaluation right away (no second grace), and a new
+ *   result is appended only when it *differs semantically* — the original event
+ *   is never mutated (append-only revision).
+ * - **Original-policy retention.** A change keeps the policy it bound to at
+ *   commit time; every revision scores under that policy, never a newer one.
+ * - **Serialized evaluate+publish.** All evaluations run one at a time so a stale
+ *   result can never win a race against a newer one, and the semantic-dedup read
+ *   stays consistent with the append that follows it.
+ *
+ * Clock and timers are injected so tests drive them deterministically. A single
+ * timer is armed for the nearest pending deadline.
+ */
+import { foldEvidence } from "./attribution.js";
+import { evaluateChange, attributionResultsEqual } from "./attribution-scoring.js";
+export function createAttributionEngine(opts) {
+    const { now, setTimer, clearTimer, readEvents, appendAttribution } = opts;
+    const changes = new Map();
+    const published = new Map();
+    let timer;
+    let stopped = false;
+    // Serialized evaluate+publish queue. Per-change dedup collapses redundant
+    // requests; the pump processes one evaluation at a time.
+    const queue = [];
+    const queued = new Set();
+    let pumpPromise = Promise.resolve();
+    let pumping = false;
+    const requestEval = (changeSeq) => {
+        if (stopped || queued.has(changeSeq))
+            return;
+        queued.add(changeSeq);
+        queue.push(changeSeq);
+        if (!pumping)
+            pumpPromise = pump();
+    };
+    const pump = async () => {
+        pumping = true;
+        try {
+            for (;;) {
+                const changeSeq = queue.shift();
+                if (changeSeq === undefined)
+                    break;
+                queued.delete(changeSeq);
+                await evaluate(changeSeq);
+            }
+        }
+        finally {
+            pumping = false;
+        }
+    };
+    const evaluate = async (changeSeq) => {
+        if (stopped)
+            return;
+        const c = changes.get(changeSeq);
+        if (!c)
+            return;
+        const invocations = foldEvidence(readEvents()).values();
+        const result = evaluateChange({
+            path: c.path,
+            interval: c.interval,
+            policy: c.policy,
+            invocations,
+        });
+        const data = {
+            change_seq: changeSeq.toString(),
+            policy_seq: c.policySeq.toString(),
+            status: result.status,
+            reason: result.reason,
+            evidence_seqs: result.evidenceSeqs.map((s) => s.toString()),
+            ...(result.excludedConflicts.length > 0
+                ? { excluded_conflicts: result.excludedConflicts }
+                : {}),
+        };
+        const prev = published.get(changeSeq);
+        if (prev && attributionResultsEqual(prev, data))
+            return;
+        try {
+            await appendAttribution(data);
+        }
+        catch {
+            return; // transient storage fault: leave unpublished so a later eval retries
+        }
+        if (stopped)
+            return; // fenced after the append: a fresh generation owns state now
+        published.set(changeSeq, data);
+    };
+    const rescheduleTimer = () => {
+        if (timer !== undefined) {
+            clearTimer(timer);
+            timer = undefined;
+        }
+        let nearest = Infinity;
+        for (const c of changes.values()) {
+            if (!c.graced && c.deadlineMs !== undefined)
+                nearest = Math.min(nearest, c.deadlineMs);
+        }
+        if (nearest === Infinity)
+            return;
+        timer = setTimer(Math.max(0, nearest - now()), onTimer);
+    };
+    const onTimer = () => {
+        timer = undefined;
+        if (stopped)
+            return;
+        const t = now();
+        for (const c of changes.values()) {
+            if (!c.graced && c.deadlineMs !== undefined && c.deadlineMs <= t) {
+                c.graced = true;
+                requestEval(c.changeSeq);
+            }
+        }
+        rescheduleTimer();
+    };
+    const seedPublished = (changeSeq, data) => {
+        published.set(changeSeq, data);
+    };
+    const onChangeCommitted = (change) => {
+        if (stopped || changes.has(change.changeSeq))
+            return; // idempotent
+        const { interval } = change;
+        const deadlineMs = interval !== undefined && !('unavailable' in interval)
+            ? interval.end_ms + change.policy.grace_ms
+            : undefined;
+        const tracked = { ...change, deadlineMs, graced: deadlineMs === undefined };
+        changes.set(change.changeSeq, tracked);
+        if (deadlineMs === undefined) {
+            // No observation window to wait for: resolve immediately (unknown).
+            requestEval(change.changeSeq);
+        }
+        else {
+            rescheduleTimer();
+        }
+    };
+    const onEvidenceChanged = () => {
+        if (stopped)
+            return;
+        for (const c of changes.values()) {
+            if (c.graced)
+                requestEval(c.changeSeq);
+        }
+    };
+    const drain = async () => {
+        await pumpPromise;
+    };
+    const stop = async () => {
+        stopped = true;
+        if (timer !== undefined) {
+            clearTimer(timer);
+            timer = undefined;
+        }
+        await pumpPromise;
+    };
+    return { onChangeCommitted, onEvidenceChanged, seedPublished, drain, stop };
+}

package/dist/attribution-producer.js

@@ -0,0 +1,153 @@
+/**
+ * The attribution producer: the session-side composition that turns a durable
+ * event log into revisable attribution. It owns three cooperating pieces —
+ *
+ * - the {@link createEvidenceIngestor} write side (durable, deduped evidence),
+ * - the {@link createAttributionEngine} scheduler (grace + revision), and
+ * - an in-memory projection of the log the engine folds (evidence + policy).
+ *
+ * and wires them to the session's single append path. It is honest about
+ * restarts: `start(events)` rebuilds every projection from the durable log and
+ * only then arms a fresh generation of evaluations (the replay barrier), and
+ * `stop()` discards outstanding work and fences the previous generation so a
+ * stale evaluation can never append after a recovery reopens the log.
+ *
+ * Enrichment never blocks capture (CLAUDE.md): all scheduling is asynchronous,
+ * append-only, and a failed attribution append is retried later rather than
+ * propagated. The producer never emits a `file.changed` — it only refines.
+ */
+import { foldAttributions } from "./attribution.js";
+import { createAttributionEngine, } from "./attribution-engine.js";
+import { createEvidenceIngestor, } from "./evidence-ingest.js";
+/** A1 ships no real transcript adapters, so both real sources are `unconfigured`;
+ * an `unknown` under this coverage honestly means "nothing was watched". */
+export const DEFAULT_ENRICHMENT_POLICY = {
+    window_ms: 2000,
+    grace_ms: 5000,
+    sources: { 'claude-code': 'unconfigured', codex: 'unconfigured' },
+};
+const EVIDENCE = 'slipstream.harness.evidence.v1';
+const FILE_CHANGED = 'slipstream.file.changed.v1';
+const POLICY = 'slipstream.enrichment.configured.v1';
+/** Canonical form for comparing two policies by value (source key order is incidental). */
+function policyKey(p) {
+    const sources = Object.keys(p.sources)
+        .sort()
+        .map((k) => `${k}=${p.sources[k]}`)
+        .join(',');
+    return `${p.window_ms}|${p.grace_ms}|${sources}`;
+}
+export function createAttributionProducer(opts) {
+    const { appendEvent, now, setTimer, clearTimer } = opts;
+    let running = false;
+    let engine;
+    let ingestor;
+    let evidenceList = [];
+    let currentPolicy;
+    const inflightIngests = new Set();
+    const makeEngine = () => createAttributionEngine({
+        now,
+        setTimer,
+        clearTimer,
+        readEvents: () => evidenceList,
+        appendAttribution: (data) => appendEvent({ type: 'slipstream.change.attribution.v1', occurred_at_ms: now(), data }),
+    });
+    const makeIngestor = () => createEvidenceIngestor({ append: appendEvent, now });
+    const registerChange = (event, policy) => {
+        // A change committed before any policy is a legacy record with no bound
+        // policy; it carries the documented legacy disposition and is not scheduled.
+        if (!policy || !engine)
+            return;
+        engine.onChangeCommitted({
+            changeSeq: BigInt(event.seq),
+            path: event.data.path,
+            interval: event.data.observed_interval_ms,
+            policy: policy.policy,
+            policySeq: policy.seq,
+        });
+    };
+    const noteCommitted = (event) => {
+        if (!running || !engine)
+            return;
+        switch (event.type) {
+            case POLICY:
+                currentPolicy = { seq: BigInt(event.seq), policy: event.data.policy };
+                break;
+            case EVIDENCE:
+                evidenceList.push(event);
+                engine.onEvidenceChanged();
+                break;
+            case FILE_CHANGED:
+                registerChange(event, currentPolicy);
+                break;
+            default:
+                break;
+        }
+    };
+    const ingestEvidence = (evidence) => {
+        if (!running || !ingestor) {
+            return Promise.resolve({ status: 'rejected', reason: 'queue-full', retryable: true });
+        }
+        const p = ingestor.ingest(evidence);
+        // Track a settled (never-rejecting) view so drain/stop can await it without a
+        // second rejecting chain producing an unhandled rejection; return the original
+        // promise so the caller still observes ingestion failures.
+        const settled = p.then(() => { }, () => { });
+        inflightIngests.add(settled);
+        void settled.finally(() => inflightIngests.delete(settled));
+        return p;
+    };
+    const ensurePolicy = async (policy) => {
+        if (currentPolicy && policyKey(currentPolicy.policy) === policyKey(policy))
+            return;
+        await appendEvent({
+            type: 'slipstream.enrichment.configured.v1',
+            occurred_at_ms: now(),
+            data: { policy },
+        });
+        // `noteCommitted` (via the sequencer) advances `currentPolicy` from the commit.
+    };
+    const start = (events) => {
+        running = true;
+        evidenceList = [];
+        currentPolicy = undefined;
+        ingestor = makeIngestor();
+        engine = makeEngine();
+        // Replay in commit order: seed evidence + policy, and collect each change with
+        // the policy in force at its position (highest policy seq below the change).
+        const evidence = [];
+        const pendingChanges = [];
+        for (const event of events) {
+            if (event.type === POLICY) {
+                currentPolicy = { seq: BigInt(event.seq), policy: event.data.policy };
+            }
+            else if (event.type === EVIDENCE) {
+                evidence.push(event);
+            }
+            else if (event.type === FILE_CHANGED) {
+                pendingChanges.push({ event, policy: currentPolicy });
+            }
+        }
+        evidenceList = evidence;
+        ingestor.seed(evidence);
+        // Seed prior results BEFORE scheduling, so a replayed evaluation that
+        // reproduces the same result appends nothing (no double-attribution).
+        for (const { data } of foldAttributions(events).values()) {
+            engine.seedPublished(BigInt(data.change_seq), data);
+        }
+        for (const { event, policy } of pendingChanges)
+            registerChange(event, policy);
+    };
+    const drain = async () => {
+        await Promise.allSettled([...inflightIngests]);
+        await engine?.drain();
+    };
+    const stop = async () => {
+        running = false;
+        await Promise.allSettled([...inflightIngests]);
+        await engine?.stop();
+        engine = undefined;
+        ingestor = undefined;
+    };
+    return { noteCommitted, ingestEvidence, ensurePolicy, start, drain, stop };
+}

package/dist/attribution-scoring.js

@@ -0,0 +1,86 @@
+import { evidenceKeyString } from "./attribution.js";
+/** Whether an invocation's ±window overlaps the observation interval, inclusive. */
+function windowOverlaps(inv, start, end, windowMs) {
+    const winStart = inv.minAtMs - windowMs;
+    const winEnd = inv.maxAtMs + windowMs;
+    return winStart <= end && winEnd >= start;
+}
+function touchesPath(inv, path) {
+    return inv.knownPaths.includes(path);
+}
+/**
+ * Match one change against the known invocations under its bound policy. An
+ * unavailable interval resolves to `unknown` with its own distinct reason — never
+ * conflated with "we looked and found nothing". Each eligible invocation
+ * contributes one candidate; conflicts are excluded and disclosed, never counted.
+ */
+export function evaluateChange(input) {
+    const { interval } = input;
+    // An absent, explicitly-unavailable, or inverted (end before start, e.g. the
+    // wall clock regressed mid-acquisition) interval bounds no real observation
+    // window. Treat all three as the honest unavailable disposition rather than
+    // matching evidence against a degenerate window and publishing a false result.
+    if (interval === undefined || 'unavailable' in interval || interval.end_ms < interval.start_ms) {
+        return {
+            status: 'unknown',
+            reason: 'observation-interval-unavailable',
+            evidenceSeqs: [],
+            excludedConflicts: [],
+        };
+    }
+    const eligible = [];
+    const conflicts = [];
+    for (const inv of input.invocations) {
+        const relevant = touchesPath(inv, input.path) &&
+            windowOverlaps(inv, interval.start_ms, interval.end_ms, input.policy.window_ms);
+        if (!relevant)
+            continue;
+        if (inv.conflicted)
+            conflicts.push(inv);
+        else
+            eligible.push(inv);
+    }
+    const evidenceSeqs = eligible
+        .flatMap((inv) => inv.evidenceSeqs)
+        .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+    const excludedConflicts = conflicts
+        .slice()
+        .sort((a, b) => (a.keyStr < b.keyStr ? -1 : a.keyStr > b.keyStr ? 1 : 0))
+        .map((inv) => inv.key);
+    let status;
+    let reason;
+    if (eligible.length >= 2) {
+        status = 'ambiguous';
+        reason = 'multiple-candidates';
+    }
+    else if (eligible.length === 1) {
+        status = 'heuristic';
+        reason = 'single-candidate';
+    }
+    else {
+        status = 'unknown';
+        reason = 'no-matching-evidence';
+    }
+    return { status, reason, evidenceSeqs, excludedConflicts };
+}
+function sameStringSet(a, b) {
+    if (a.length !== b.length)
+        return false;
+    const sa = [...a].sort();
+    const sb = [...b].sort();
+    return sa.every((v, i) => v === sb[i]);
+}
+/**
+ * Whether two attribution results are semantically identical, so a re-evaluation
+ * that reproduces the last result appends nothing. Compares the meaning, not the
+ * envelope: status, reason, bound policy, evidence set, and conflict disclosure.
+ */
+export function attributionResultsEqual(a, b) {
+    if (a.status !== b.status || a.reason !== b.reason || a.policy_seq !== b.policy_seq)
+        return false;
+    if (!sameStringSet(a.evidence_seqs, b.evidence_seqs))
+        return false;
+    const ca = (a.excluded_conflicts ?? []).map(evidenceKeyString);
+    const cb = (b.excluded_conflicts ?? []).map(evidenceKeyString);
+    return sameStringSet(ca, cb);
+}

package/dist/attribution.js

@@ -0,0 +1,120 @@
+const EVIDENCE = 'slipstream.harness.evidence.v1';
+const FILE_CHANGED = 'slipstream.file.changed.v1';
+const ATTRIBUTION = 'slipstream.change.attribution.v1';
+/** A stable string identity for an evidence key, safe as a Map key. JSON-encoded
+ * so no component's bytes can bleed into another's: plain concatenation (even with
+ * a unit separator) collides, since the schema forbids no character in these ids. */
+export function evidenceKeyString(key) {
+    return JSON.stringify([key.harness, key.harness_session_id, key.record_id]);
+}
+/** Canonical signature of the semantic fact a record asserts, used for both dedup
+ * (identical signature = one variant) and conflict detection. Adapter version is
+ * deliberately excluded: a re-emit under a newer adapter is the same fact. Scope is
+ * a structured value, so `['a,b']` (one path) and `['a','b']` (two) never collide. */
+export function variantSignature(data) {
+    const scope = data.file_scope.kind === 'paths'
+        ? { kind: 'paths', paths: [...data.file_scope.paths].sort() }
+        : { kind: 'unknown', reason: data.file_scope.reason };
+    return JSON.stringify([data.tool_name, data.timestamp.basis, data.timestamp.at_ms, scope]);
+}
+/**
+ * Fold evidence records into one {@link Invocation} per key. Records sharing a
+ * key are joined; byte-identical variants dedup to a single seq; contradictory
+ * variants mark the invocation conflicted (never silently merged or overwritten).
+ */
+export function foldEvidence(events) {
+    const groups = new Map();
+    for (const e of events) {
+        if (e.type !== EVIDENCE)
+            continue;
+        const data = e.data;
+        const keyStr = evidenceKeyString(data.evidence_key);
+        const sig = variantSignature(data);
+        const seq = BigInt(e.seq);
+        let group = groups.get(keyStr);
+        if (!group) {
+            group = { key: data.evidence_key, variants: new Map() };
+            groups.set(keyStr, group);
+        }
+        const existing = group.variants.get(sig);
+        // Identical reread: keep the earliest seq that recorded the fact.
+        if (!existing || seq < existing.seq)
+            group.variants.set(sig, { seq, data });
+    }
+    const out = new Map();
+    for (const [keyStr, group] of groups) {
+        const variants = [...group.variants.values()];
+        const evidenceSeqs = variants.map((v) => v.seq).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+        const bases = new Set();
+        let sameBasisConflict = false;
+        for (const v of variants) {
+            const b = v.data.timestamp.basis;
+            if (bases.has(b))
+                sameBasisConflict = true;
+            bases.add(b);
+        }
+        const tools = new Set(variants.map((v) => v.data.tool_name));
+        const conflicted = sameBasisConflict || tools.size > 1;
+        let minAtMs = Infinity;
+        let maxAtMs = -Infinity;
+        // Union of known paths across every variant. An `unknown`-scope variant adds
+        // no path (we cannot say what it touched), but a sibling variant that names a
+        // path keeps the invocation relevant — so a conflict is still disclosed.
+        const paths = new Set();
+        for (const v of variants) {
+            minAtMs = Math.min(minAtMs, v.data.timestamp.at_ms);
+            maxAtMs = Math.max(maxAtMs, v.data.timestamp.at_ms);
+            if (v.data.file_scope.kind === 'paths')
+                for (const p of v.data.file_scope.paths)
+                    paths.add(p);
+        }
+        out.set(keyStr, {
+            key: group.key,
+            keyStr,
+            minAtMs,
+            maxAtMs,
+            knownPaths: [...paths].sort(),
+            conflicted,
+            evidenceSeqs,
+        });
+    }
+    return out;
+}
+/** The Fork-1 identity of a change/attribution target: `(source, change_seq)`.
+ * A change seq alone is NOT unique — two sessions each hold a change seq `2` — so
+ * a fold over a multi-session stream must key by both or silently drop one. */
+export function attributionTargetKey(source, changeSeq) {
+    return JSON.stringify([source, String(changeSeq)]);
+}
+/**
+ * The Fork-3 public fold: each change's current attribution, keyed by the
+ * `(source, change_seq)` identity. An attribution is counted only if its target
+ * reference is valid — an existing `file.changed.v1` in the same source with a
+ * strictly smaller seq (Fork 1). The highest-seq valid attribution wins, so a
+ * revision supersedes without mutating any prior record.
+ */
+export function foldAttributions(events) {
+    const changeTargets = new Set();
+    for (const e of events) {
+        if (e.type === FILE_CHANGED)
+            changeTargets.add(attributionTargetKey(e.source, e.seq));
+    }
+    const latest = new Map();
+    for (const e of events) {
+        if (e.type !== ATTRIBUTION)
+            continue;
+        if (!/^[1-9][0-9]*$/.test(e.data.change_seq))
+            continue;
+        const changeSeq = BigInt(e.data.change_seq);
+        const attrSeq = BigInt(e.seq);
+        if (changeSeq >= attrSeq)
+            continue; // must strictly precede its target
+        const targetKey = attributionTargetKey(e.source, e.data.change_seq);
+        if (!changeTargets.has(targetKey))
+            continue;
+        const cur = latest.get(targetKey);
+        if (!cur || attrSeq > cur.seq)
+            latest.set(targetKey, { seq: attrSeq, source: e.source, data: e.data });
+    }
+    return latest;
+}

package/dist/blob-source.js

@@ -0,0 +1,100 @@
+// BlobSource implementations: resolve a content blob (by sha256) to text, binary,
+// oversize, or an honest "missing" with a reason. The reader over HTTP and the
+// direct disk reader are the two ways to reach the content-addressed store; both
+// feed the same change renderer. Each bounds the bytes it will actually read to
+// `maxBytes`, so a snapshot that under-reports its size can't force a huge read.
+import { constants } from 'node:fs';
+import { open } from 'node:fs/promises';
+import { blobPath, isValidHex } from "./store-reader.js";
+function decode(buf) {
+    if (buf.includes(0))
+        return { kind: 'binary' };
+    // ignoreBOM keeps a leading U+FEFF as content, so a BOM-only file decodes to a
+    // one-char line, not a false "(empty file)".
+    try {
+        return { kind: 'text', text: new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(buf) };
+    }
+    catch {
+        return { kind: 'binary' };
+    }
+}
+export function diskBlobSource(storeDir) {
+    return async (sha256, maxBytes) => {
+        if (!isValidHex(sha256))
+            return { kind: 'missing', reason: 'invalid-hex' };
+        // O_NOFOLLOW: a symlink planted at a valid CAS path must serve nothing but
+        // the blob it names — never the link target's bytes.
+        let handle;
+        try {
+            handle = await open(blobPath(storeDir, sha256), constants.O_RDONLY | constants.O_NOFOLLOW);
+        }
+        catch (err) {
+            return { kind: 'missing', reason: err.code ?? 'open-failed' };
+        }
+        try {
+            const { size } = await handle.stat();
+            if (size > maxBytes)
+                return { kind: 'oversize', size };
+            return decode(await handle.readFile());
+        }
+        catch (err) {
+            return { kind: 'missing', reason: err.code ?? 'read-failed' };
+        }
+        finally {
+            await handle.close();
+        }
+    };
+}
+export function httpBlobSource(desc, timeoutMs = 5000) {
+    return async (sha256, maxBytes) => {
+        if (!isValidHex(sha256))
+            return { kind: 'missing', reason: 'invalid-hex' };
+        const url = new URL(`v1/blobs/sha256/${sha256}`, desc.url);
+        const ac = new AbortController();
+        // The timer stays armed through the body read, not just the header fetch: a
+        // server that stalls mid-body must still trip the timeout rather than hang.
+        // Aborting on every early return tears down the connection so a stalled body
+        // can't hold it open after we've stopped reading.
+        const timer = setTimeout(() => ac.abort(), timeoutMs);
+        try {
+            const res = await fetch(url, {
+                headers: { authorization: `Bearer ${desc.token}` }, redirect: 'error', signal: ac.signal,
+            });
+            // Only a plain 200 carries the full blob; 204/206 and the rest are not it.
+            if (res.status !== 200) {
+                ac.abort();
+                return { kind: 'missing', reason: `http-${res.status}` };
+            }
+            const declared = Number(res.headers.get('content-length'));
+            if (Number.isFinite(declared) && declared > maxBytes) {
+                ac.abort();
+                return { kind: 'oversize', size: declared };
+            }
+            if (!res.body)
+                return { kind: 'missing', reason: 'no-body' };
+            // Read incrementally so a chunked body with no Content-Length can't be fully
+            // buffered before the cap check: stop and abort the moment it exceeds it.
+            const reader = res.body.getReader();
+            const chunks = [];
+            let total = 0;
+            for (;;) {
+                const { value, done } = await reader.read();
+                if (done)
+                    break;
+                total += value.byteLength;
+                if (total > maxBytes) {
+                    ac.abort();
+                    return { kind: 'oversize', size: total };
+                }
+                chunks.push(value);
+            }
+            return decode(Buffer.concat(chunks));
+        }
+        catch {
+            return { kind: 'missing', reason: 'fetch-failed' };
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    };
+}

package/dist/boundary-registry.js

@@ -0,0 +1,47 @@
+import { staticBoundary } from "./reader-runtime.js";
+export function createBoundaryRegistry() {
+    const entries = new Map();
+    const ensure = (id, boundary) => {
+        let entry = entries.get(id);
+        if (!entry) {
+            entry = { boundary, followers: new Set() };
+            entries.set(id, entry);
+        }
+        return entry;
+    };
+    const transition = (id, boundary) => {
+        const entry = ensure(id, boundary);
+        entry.boundary = boundary;
+        // Disconnect followers pinned to the previous boundary; they reconnect and
+        // re-resolve. Clear the set so a later transition never re-aborts a stale ref.
+        const stale = [...entry.followers];
+        entry.followers.clear();
+        for (const ac of stale)
+            ac.abort();
+    };
+    return {
+        reserve(id) {
+            ensure(id, staticBoundary(0n));
+        },
+        activate(id, boundary) {
+            transition(id, boundary);
+        },
+        freeze(id, seq) {
+            transition(id, staticBoundary(seq));
+        },
+        get(id) {
+            return entries.get(id);
+        },
+        installIfAbsent(id, boundary) {
+            return ensure(id, boundary);
+        },
+        addFollower(id, ac) {
+            const entry = entries.get(id);
+            if (entry)
+                entry.followers.add(ac);
+        },
+        removeFollower(id, ac) {
+            entries.get(id)?.followers.delete(ac);
+        },
+    };
+}