@powerhousedao/reactor 6.2.2-dev.31 → 6.2.2-dev.33

package/dist/{drive-container-types-BNwEHEXP.js → drive-container-types-ZSLCC3lC.js}

@@ -425,6 +425,16 @@ function buildErrorResult(job, error, startTime) {
 		duration: Date.now() - startTime
 	};
 }
+/**
+* Whether this operation is part of the document's creation. The create and the
+* upgrade from version zero hold the first two indexes for the life of the
+* document, so a reshuffle has to leave them where they are.
+*/
+function isGenesisOperation(operation) {
+	if (operation.action.type === "CREATE_DOCUMENT") return true;
+	if (operation.action.type !== "UPGRADE_DOCUMENT") return false;
+	return operation.action.input.fromVersion === 0;
+}
 //#endregion
 //#region src/cache/lru/lru-tracker.ts
 var LRUNode = class {
@@ -1743,7 +1753,7 @@ function documentDecisionModel(target) {
 				scope: "document"
 			}
 		} },
-		judgesScope() {
+		evaluatesScope() {
 			return true;
 		},
 		decide(model) {
@@ -1767,19 +1777,15 @@ function comparePositions(a, b) {
 	const aTime = Date.parse(a.operation.timestampUtcMs);
 	const bTime = Date.parse(b.operation.timestampUtcMs);
 	if (aTime !== bTime) return aTime - bTime;
+	if (a.streamKey === b.streamKey) return a.operation.index - b.operation.index;
 	const actionIds = (a.operation.action.id ?? "").localeCompare(b.operation.action.id ?? "");
 	if (actionIds !== 0) return actionIds;
 	return (a.operation.id ?? "").localeCompare(b.operation.id ?? "");
 }
 /**
-* Merges the read-set streams into one sequence by position. Each stream keeps
-* its stored order; only how far to go is decided by the timestamp, so a stream
-* whose stored order disagrees with its timestamp order still applies in the
-* order it is stored.
-*
-* An operation's position in the result is the bound a decision at that
-* operation reads to: every operation before it has been applied, and it has
-* not.
+* Merges the read-set streams into one sequence by position. An operation's
+* place in the result is the bound a decision at that operation reads to: every
+* operation before it has been applied, and it has not.
 */
 function mergeByPosition(streams) {
 	const merged = [];
@@ -1790,8 +1796,9 @@ function mergeByPosition(streams) {
 	return merged.sort(comparePositions);
 }
 /**
-* For auth-related reshuffles, we may need to retract previous operations.
-* This function calculates the needed skip value.
+* The skip that retracts everything from `firstRetractedIndex` up to where the
+* re-appended operation lands. It spans the indexes rather than counting the
+* operations, because a stream with a gap in it makes those differ.
 */
 function retractionSkip(nextIndex, firstRetractedIndex) {
 	return nextIndex - firstRetractedIndex;
@@ -1799,6 +1806,23 @@ function retractionSkip(nextIndex, firstRetractedIndex) {
 //#endregion
 //#region src/decision/walk.ts
 /**
+* A single forward pass is only correct while a stream's effective operations
+* are ordered.
+*/
+function assertPositionOrder(streamKey, operations) {
+	for (let i = 1; i < operations.length; i++) {
+		const previous = operations[i - 1];
+		const current = operations[i];
+		if (comparePositions({
+			streamKey,
+			operation: previous
+		}, {
+			streamKey,
+			operation: current
+		}) > 0) throw new Error(`Stream ${streamKey} is out of position order: index ${previous.index} at ${previous.timestampUtcMs} precedes index ${current.index} at ${current.timestampUtcMs}`);
+	}
+}
+/**
 * Visits every operation in the read-set once, in the order their positions
 * fall, and hands back the state each stream held just before it. That state is
 * what a decision at that operation reads: everything ahead of it has been
@@ -1810,10 +1834,15 @@ function retractionSkip(nextIndex, firstRetractedIndex) {
 * A denied operation is visited but not applied.
 */
 function* walkByPosition(streams) {
-	const merged = mergeByPosition(streams.map((stream) => ({
-		streamKey: stream.streamKey,
-		operations: garbageCollect(sortOperations([...stream.operations]))
-	})));
+	const merged = mergeByPosition(streams.map((stream) => {
+		const operations = garbageCollect(sortOperations([...stream.operations]));
+		assertPositionOrder(stream.streamKey, operations);
+		return {
+			streamKey: stream.streamKey,
+			operations
+		};
+	}));
+	const byKey = new Map(streams.map((stream) => [stream.streamKey, stream]));
 	const states = new Map(streams.map((stream) => [stream.streamKey, stream.document]));
 	for (const { streamKey, operation } of merged) {
 		yield {
@@ -1822,16 +1851,16 @@ function* walkByPosition(streams) {
 			states: new Map(states)
 		};
 		if (isDenied(operation)) continue;
-		const stream = streams.find((candidate) => candidate.streamKey === streamKey);
+		const stream = byKey.get(streamKey);
 		const before = states.get(streamKey);
 		if (before === void 0 || stream === void 0) throw new Error(`No state for stream ${streamKey}`);
 		states.set(streamKey, stream.apply(before, operation));
 	}
 }
 //#endregion
-//#region src/decision/deletion-verdicts.ts
+//#region src/decision/deletion-evaluation.ts
 const WRITTEN = "written";
-/** Whether a read stream counts this action as one that changes a verdict. */
+/** Whether a read stream counts this action as one that changes an evaluation. */
 function canRefuseOthers(operation, readSet) {
 	return readSet.some((stream) => stream.decidingActions.includes(operation.action.type));
 }
@@ -1849,19 +1878,20 @@ function firstDeleted(candidates) {
 * and leaves the earlier ones alone. A deletion among the ones passed in does
 * the same to those after it.
 */
-async function deletionVerdictsByPosition(documentId, scope, branch, operations, writeCache, operationStore, signal) {
-	const definition = documentDecisionModel({
-		documentId,
-		branch
-	});
+async function evaluateDeletionsByPosition(target, subject, stores, signal) {
+	const { scope, operations } = subject;
+	const { writeCache, operationStore } = stores;
+	const definition = documentDecisionModel(target);
 	const readSet = staticReadSet(definition);
-	if (!definition.judgesScope(scope)) return operations.map(() => void 0);
+	if (!definition.evaluatesScope(scope)) return operations.map(() => void 0);
+	const evaluating = new Set(operations.map((operation) => operation.id));
 	const readStreams = await Promise.all(readSet.map(async (stream) => ({
 		stream,
-		operations: (await operationStore.getSince(stream.query.documentId, stream.query.scope, stream.query.branch, 0, { actionTypes: stream.decidingActions }, void 0, signal)).results
+		operations: (await operationStore.getSince(stream.query.documentId, stream.query.scope, stream.query.branch, 0, { actionTypes: stream.decidingActions }, void 0, signal)).results.filter((operation) => !evaluating.has(operation.id))
 	})));
 	const decidingWritten = operations.filter((operation) => canRefuseOthers(operation, readSet));
 	if (readStreams.every((read) => read.operations.length === 0) && decidingWritten.length === 0) return operations.map(() => void 0);
+	if (readStreams.length === 0) throw new Error(`Decision model for ${target.documentId} reads no stream whose query is known before it is built`);
 	const walked = [];
 	for (const read of readStreams) {
 		const before = await writeCache.getState(read.stream.query.documentId, read.stream.query.scope, read.stream.query.branch, 0, signal);
@@ -1942,23 +1972,81 @@ var DriveCollectionId = class DriveCollectionId {
 //#endregion
 //#region src/executor/document-action-handler.ts
 var DocumentActionHandler = class {
-	constructor(registry, logger, driveContainerTypes) {
+	constructor(registry, logger, driveContainerTypes, featureFlags) {
 		this.registry = registry;
 		this.logger = logger;
 		this.driveContainerTypes = driveContainerTypes;
+		this.featureFlags = featureFlags;
 	}
-	async execute(job, action, startTime, indexTxn, stores, skip = 0, sourceRemote = "", signal, verdictAlreadyDecided = false) {
+	/** Whether the write arrives with its evaluation already decided. */
+	alreadyEvaluated(executing) {
+		return this.featureFlags.documentDecisions && executing.replayingAcceptedHistory;
+	}
+	async execute(write, executing) {
+		const { action } = write;
+		if (write.deniedReason !== void 0) return this.writeDenied(write, executing);
 		switch (action.type) {
-			case "CREATE_DOCUMENT": return this.executeCreate(job, action, startTime, indexTxn, stores, skip, sourceRemote, signal);
-			case "DELETE_DOCUMENT": return this.executeDelete(job, action, startTime, indexTxn, stores, sourceRemote, signal, verdictAlreadyDecided);
-			case "UPGRADE_DOCUMENT": return this.executeUpgrade(job, action, startTime, indexTxn, stores, skip, sourceRemote, signal, verdictAlreadyDecided);
-			case "ADD_RELATIONSHIP": return this.executeAddRelationship(job, action, startTime, indexTxn, stores, sourceRemote, signal);
-			case "REMOVE_RELATIONSHIP": return this.executeRemoveRelationship(job, action, startTime, indexTxn, stores, sourceRemote, signal);
-			case "UPDATE_RELATIONSHIP": return this.executeUpdateRelationship(job, action, startTime, indexTxn, stores, sourceRemote, signal);
-			default: return buildErrorResult(job, /* @__PURE__ */ new Error(`Unknown document action type: ${action.type}`), startTime);
+			case "CREATE_DOCUMENT": return this.executeCreate(write, executing);
+			case "DELETE_DOCUMENT": return this.executeDelete(write, executing);
+			case "UPGRADE_DOCUMENT": return this.executeUpgrade(write, executing);
+			case "ADD_RELATIONSHIP": return this.executeAddRelationship(write, executing);
+			case "REMOVE_RELATIONSHIP": return this.executeRemoveRelationship(write, executing);
+			case "UPDATE_RELATIONSHIP": return this.executeUpdateRelationship(write, executing);
+			default: return buildErrorResult(executing.job, /* @__PURE__ */ new Error(`Unknown document action type: ${action.type}`), executing.startTime);
+		}
+	}
+	/** A refused operation holds a position in the stream but changes nothing. */
+	async writeDenied(write, executing) {
+		const { action, skip, sourceRemote, deniedReason } = write;
+		const { job, startTime, indexTxn, stores, signal } = executing;
+		let document;
+		try {
+			document = await stores.writeCache.getState(job.documentId, job.scope, job.branch, void 0, signal);
+		} catch (error) {
+			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
 		}
+		let operation = createOperation(action, getNextIndexForScope(document, job.scope), skip, {
+			documentId: job.documentId,
+			scope: job.scope,
+			branch: job.branch
+		});
+		operation.deniedReason = deniedReason;
+		operation.hash = hashDocumentStateForScope(document, job.scope);
+		const writeResult = await this.writeOperationToStore({
+			documentId: job.documentId,
+			documentType: document.header.documentType,
+			scope: job.scope,
+			branch: job.branch
+		}, operation, executing);
+		if (!Array.isArray(writeResult)) return writeResult;
+		operation = writeResult[0];
+		updateDocumentRevision(document, job.scope, operation.index);
+		document.operations = {
+			...document.operations,
+			[job.scope]: [...document.operations[job.scope] ?? [], operation]
+		};
+		stores.writeCache.putState(job.documentId, job.scope, job.branch, operation.index, document, SnapshotPosition.Head);
+		indexTxn.write([{
+			...operation,
+			documentId: job.documentId,
+			documentType: document.header.documentType,
+			branch: job.branch,
+			scope: job.scope,
+			sourceRemote
+		}]);
+		stores.documentMetaCache.putDocumentMeta(job.documentId, job.branch, {
+			state: document.state.document,
+			documentType: document.header.documentType,
+			documentScopeRevision: operation.index + 1
+		});
+		return buildSuccessResult(job, operation, job.documentId, document.header.documentType, JSON.stringify({
+			header: document.header,
+			document: document.state.document
+		}), startTime);
 	}
-	async executeCreate(job, action, startTime, indexTxn, stores, skip = 0, sourceRemote = "", signal) {
+	async executeCreate(write, executing) {
+		const { action, skip, sourceRemote } = write;
+		const { job, startTime, indexTxn, stores, signal } = executing;
 		if (job.scope !== "document") return {
 			job,
 			success: false,
@@ -1976,7 +2064,12 @@ var DocumentActionHandler = class {
 			...document.state
 		};
 		const resultingState = JSON.stringify(resultingStateObj);
-		const writeResult = await this.writeOperationToStore(document.header.id, document.header.documentType, job.scope, job.branch, operation, job, startTime, stores, signal);
+		const writeResult = await this.writeOperationToStore({
+			documentId: document.header.id,
+			documentType: document.header.documentType,
+			scope: job.scope,
+			branch: job.branch
+		}, operation, executing);
 		if (!Array.isArray(writeResult)) return writeResult;
 		operation = writeResult[0];
 		updateDocumentRevision(document, job.scope, operation.index);
@@ -2005,7 +2098,9 @@ var DocumentActionHandler = class {
 		});
 		return buildSuccessResult(job, operation, document.header.id, document.header.documentType, resultingState, startTime);
 	}
-	async executeDelete(job, action, startTime, indexTxn, stores, sourceRemote = "", signal, verdictAlreadyDecided = false) {
+	async executeDelete(write, executing) {
+		const { action, skip, sourceRemote } = write;
+		const { job, startTime, indexTxn, stores, signal } = executing;
 		const input = action.input;
 		if (!input.documentId) return buildErrorResult(job, /* @__PURE__ */ new Error("DELETE_DOCUMENT action requires a documentId in input"), startTime);
 		const documentId = input.documentId;
@@ -2016,8 +2111,8 @@ var DocumentActionHandler = class {
 			return buildErrorResult(job, /* @__PURE__ */ new Error(`Failed to fetch document before deletion: ${error instanceof Error ? error.message : String(error)}`), startTime);
 		}
 		const documentState = document.state.document;
-		if (documentState.isDeleted && !verdictAlreadyDecided) return buildErrorResult(job, new DocumentDeletedError(documentId, documentState.deletedAtUtcIso), startTime);
-		let operation = createOperation(action, getNextIndexForScope(document, job.scope), 0, {
+		if (documentState.isDeleted && !this.alreadyEvaluated(executing)) return buildErrorResult(job, new DocumentDeletedError(documentId, documentState.deletedAtUtcIso), startTime);
+		let operation = createOperation(action, getNextIndexForScope(document, job.scope), skip, {
 			documentId,
 			scope: job.scope,
 			branch: job.branch
@@ -2028,7 +2123,12 @@ var DocumentActionHandler = class {
 			document: document.state.document
 		};
 		const resultingState = JSON.stringify(resultingStateObj);
-		const writeResult = await this.writeOperationToStore(documentId, document.header.documentType, job.scope, job.branch, operation, job, startTime, stores, signal);
+		const writeResult = await this.writeOperationToStore({
+			documentId,
+			documentType: document.header.documentType,
+			scope: job.scope,
+			branch: job.branch
+		}, operation, executing);
 		if (!Array.isArray(writeResult)) return writeResult;
 		operation = writeResult[0];
 		updateDocumentRevision(document, job.scope, operation.index);
@@ -2052,7 +2152,9 @@ var DocumentActionHandler = class {
 		});
 		return buildSuccessResult(job, operation, documentId, document.header.documentType, resultingState, startTime);
 	}
-	async executeUpgrade(job, action, startTime, indexTxn, stores, skip = 0, sourceRemote = "", signal, verdictAlreadyDecided = false) {
+	async executeUpgrade(write, executing) {
+		const { action, skip, sourceRemote } = write;
+		const { job, startTime, indexTxn, stores, signal } = executing;
 		const input = action.input;
 		if (!input.documentId) return buildErrorResult(job, /* @__PURE__ */ new Error("UPGRADE_DOCUMENT action requires a documentId in input"), startTime);
 		const documentId = input.documentId;
@@ -2065,7 +2167,7 @@ var DocumentActionHandler = class {
 			return buildErrorResult(job, /* @__PURE__ */ new Error(`Failed to fetch document for upgrade: ${error instanceof Error ? error.message : String(error)}`), startTime);
 		}
 		const documentState = document.state.document;
-		if (documentState.isDeleted && !verdictAlreadyDecided) return buildErrorResult(job, new DocumentDeletedError(documentId, documentState.deletedAtUtcIso), startTime);
+		if (documentState.isDeleted && !this.alreadyEvaluated(executing)) return buildErrorResult(job, new DocumentDeletedError(documentId, documentState.deletedAtUtcIso), startTime);
 		const nextIndex = getNextIndexForScope(document, job.scope);
 		let upgradePath;
 		if (fromVersion > 0 && fromVersion < toVersion) try {
@@ -2095,7 +2197,12 @@ var DocumentActionHandler = class {
 			...document.state
 		};
 		const resultingState = JSON.stringify(resultingStateObj);
-		const writeResult = await this.writeOperationToStore(documentId, document.header.documentType, job.scope, job.branch, operation, job, startTime, stores, signal);
+		const writeResult = await this.writeOperationToStore({
+			documentId,
+			documentType: document.header.documentType,
+			scope: job.scope,
+			branch: job.branch
+		}, operation, executing);
 		if (!Array.isArray(writeResult)) return writeResult;
 		operation = writeResult[0];
 		updateDocumentRevision(document, job.scope, operation.index);
@@ -2119,8 +2226,8 @@ var DocumentActionHandler = class {
 		});
 		return buildSuccessResult(job, operation, documentId, document.header.documentType, resultingState, startTime);
 	}
-	executeAddRelationship(job, action, startTime, indexTxn, stores, sourceRemote = "", signal) {
-		return this.withRelationshipAction("ADD_RELATIONSHIP", job, action, startTime, indexTxn, stores, sourceRemote, signal, (input) => input.sourceId === input.targetId ? /* @__PURE__ */ new Error("ADD_RELATIONSHIP: sourceId and targetId cannot be the same (self-relationships not allowed)") : null, ({ indexTxn: txn, stores: s, sourceDoc, input, job: j }) => {
+	executeAddRelationship(write, executing) {
+		return this.withRelationshipAction("ADD_RELATIONSHIP", write, executing, (input) => input.sourceId === input.targetId ? /* @__PURE__ */ new Error("ADD_RELATIONSHIP: sourceId and targetId cannot be the same (self-relationships not allowed)") : null, ({ indexTxn: txn, stores: s, sourceDoc, input, job: j }) => {
 			if (this.driveContainerTypes.has(sourceDoc.header.documentType)) {
 				const collectionId = DriveCollectionId.forDrive(input.sourceId, j.branch).key;
 				txn.addToCollection(collectionId, input.targetId);
@@ -2128,8 +2235,8 @@ var DocumentActionHandler = class {
 			}
 		});
 	}
-	executeRemoveRelationship(job, action, startTime, indexTxn, stores, sourceRemote = "", signal) {
-		return this.withRelationshipAction("REMOVE_RELATIONSHIP", job, action, startTime, indexTxn, stores, sourceRemote, signal, null, ({ indexTxn: txn, stores: s, sourceDoc, input, job: j }) => {
+	executeRemoveRelationship(write, executing) {
+		return this.withRelationshipAction("REMOVE_RELATIONSHIP", write, executing, null, ({ indexTxn: txn, stores: s, sourceDoc, input, job: j }) => {
 			if (this.driveContainerTypes.has(sourceDoc.header.documentType)) {
 				const collectionId = DriveCollectionId.forDrive(input.sourceId, j.branch).key;
 				txn.removeFromCollection(collectionId, input.targetId);
@@ -2137,10 +2244,12 @@ var DocumentActionHandler = class {
 			}
 		});
 	}
-	executeUpdateRelationship(job, action, startTime, indexTxn, stores, sourceRemote = "", signal) {
-		return this.withRelationshipAction("UPDATE_RELATIONSHIP", job, action, startTime, indexTxn, stores, sourceRemote, signal, null, null);
+	executeUpdateRelationship(write, executing) {
+		return this.withRelationshipAction("UPDATE_RELATIONSHIP", write, executing, null, null);
 	}
-	async withRelationshipAction(actionTypeName, job, action, startTime, indexTxn, stores, sourceRemote, signal, preValidate, postWrite) {
+	async withRelationshipAction(actionTypeName, write, executing, preValidate, postWrite) {
+		const { action, skip, sourceRemote } = write;
+		const { job, startTime, indexTxn, stores, signal } = executing;
 		if (job.scope !== "document") return buildErrorResult(job, /* @__PURE__ */ new Error(`${actionTypeName} must be in "document" scope, got "${job.scope}"`), startTime);
 		const input = action.input;
 		if (!input.sourceId || !input.targetId || !input.relationshipType) return buildErrorResult(job, /* @__PURE__ */ new Error(`${actionTypeName} action requires sourceId, targetId, and relationshipType in input`), startTime);
@@ -2154,12 +2263,17 @@ var DocumentActionHandler = class {
 		} catch (error) {
 			return buildErrorResult(job, /* @__PURE__ */ new Error(`${actionTypeName}: source document ${input.sourceId} not found: ${error instanceof Error ? error.message : String(error)}`), startTime);
 		}
-		let operation = createOperation(action, getNextIndexForScope(sourceDoc, job.scope), 0, {
+		let operation = createOperation(action, getNextIndexForScope(sourceDoc, job.scope), skip, {
 			documentId: input.sourceId,
 			scope: job.scope,
 			branch: job.branch
 		});
-		const writeResult = await this.writeOperationToStore(input.sourceId, sourceDoc.header.documentType, job.scope, job.branch, operation, job, startTime, stores, signal);
+		const writeResult = await this.writeOperationToStore({
+			documentId: input.sourceId,
+			documentType: sourceDoc.header.documentType,
+			scope: job.scope,
+			branch: job.branch
+		}, operation, executing);
 		if (!Array.isArray(writeResult)) return writeResult;
 		operation = writeResult[0];
 		sourceDoc.header.lastModifiedAtUtcIso = operation.timestampUtcMs || (/* @__PURE__ */ new Date()).toISOString();
@@ -2197,7 +2311,9 @@ var DocumentActionHandler = class {
 		});
 		return buildSuccessResult(job, operation, input.sourceId, sourceDoc.header.documentType, resultingState, startTime);
 	}
-	async writeOperationToStore(documentId, documentType, scope, branch, operation, job, startTime, stores, signal) {
+	async writeOperationToStore(target, operation, executing) {
+		const { documentId, documentType, scope, branch } = target;
+		const { job, startTime, stores, signal } = executing;
 		let storedOperations;
 		try {
 			storedOperations = await stores.operationStore.apply(documentId, documentType, scope, branch, operation.index, (txn) => {
@@ -2313,7 +2429,7 @@ var SimpleJobExecutor = class {
 		};
 		this.featureFlags = { documentDecisions: config.featureFlags?.documentDecisions ?? false };
 		this.signatureVerifierModule = new SignatureVerifier(signatureVerifier);
-		this.documentActionHandler = new DocumentActionHandler(registry, logger, driveContainerTypes);
+		this.documentActionHandler = new DocumentActionHandler(registry, logger, driveContainerTypes, this.featureFlags);
 		this.executionScope = executionScope ?? new DefaultExecutionScope(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache);
 	}
 	/**
@@ -2329,7 +2445,14 @@ var SimpleJobExecutor = class {
 			result = await this.executionScope.run(async (stores) => {
 				const indexTxn = stores.operationIndex.start();
 				if (job.kind === "load") {
-					const loadResult = await this.executeLoadJob(job, startTime, indexTxn, stores, signal);
+					const loadResult = await this.executeLoadJob({
+						job,
+						startTime,
+						indexTxn,
+						stores,
+						signal,
+						replayingAcceptedHistory: true
+					});
 					if (loadResult.success && loadResult.operationsWithContext) {
 						for (const owc of loadResult.operationsWithContext) touchedCacheEntries.push({
 							documentId: owc.context.documentId,
@@ -2348,7 +2471,20 @@ var SimpleJobExecutor = class {
 					}
 					return loadResult;
 				}
-				const actionResult = await this.processActions(job, job.actions, startTime, indexTxn, stores, void 0, void 0, "", signal);
+				const executing = {
+					job,
+					startTime,
+					indexTxn,
+					stores,
+					signal,
+					replayingAcceptedHistory: false
+				};
+				const positioned = await this.positionByTimestamp(job, stores, signal);
+				const actionResult = await this.processActions(positioned.actions.map((action, i) => ({
+					action,
+					skip: positioned.skipValues?.[i] ?? 0,
+					sourceRemote: ""
+				})), executing);
 				if (!actionResult.success) return {
 					job,
 					success: false,
@@ -2360,6 +2496,16 @@ var SimpleJobExecutor = class {
 					scope: owc.context.scope,
 					branch: owc.context.branch
 				});
+				const reevaluationError = await this.reevaluateIfCriteriaMet({
+					scope: job.scope,
+					operations: actionResult.generatedOperations
+				}, executing);
+				if (reevaluationError) return {
+					job,
+					success: false,
+					error: reevaluationError,
+					duration: Date.now() - startTime
+				};
 				const ordinals = await stores.operationIndex.commit(indexTxn, signal);
 				if (actionResult.operationsWithContext.length > 0) {
 					for (let i = 0; i < actionResult.operationsWithContext.length; i++) actionResult.operationsWithContext[i].context.ordinal = ordinals[i];
@@ -2395,7 +2541,9 @@ var SimpleJobExecutor = class {
 		const documentIds = [...new Set(operations.map((op) => op.context.documentId))];
 		return stores.collectionMembershipCache.getCollectionsForDocuments(documentIds);
 	}
-	async processActions(job, actions, startTime, indexTxn, stores, skipValues, sourceOperations, sourceRemote = "", signal, deniedReasons) {
+	async processActions(writes, executing) {
+		const { job, signal } = executing;
+		const actions = writes.map((write) => write.action);
 		const generatedOperations = [];
 		const operationsWithContext = [];
 		try {
@@ -2415,12 +2563,8 @@ var SimpleJobExecutor = class {
 			error: /* @__PURE__ */ new Error(`Invalid timestamp "${action.timestampUtcMs}" on action ${action.type} (id: ${action.id})`)
 		};
 		let lastYield = performance.now();
-		for (let actionIndex = 0; actionIndex < actions.length; actionIndex++) {
-			const action = actions[actionIndex];
-			const skip = skipValues?.[actionIndex] ?? 0;
-			const sourceOperation = sourceOperations?.[actionIndex];
-			const deniedReason = deniedReasons?.[actionIndex];
-			const result = documentScopeActions.includes(action.type) ? await this.documentActionHandler.execute(job, action, startTime, indexTxn, stores, skip, sourceRemote, signal, this.featureFlags.documentDecisions && job.kind === "load") : await this.executeRegularAction(job, action, startTime, indexTxn, stores, skip, sourceOperation, sourceRemote, signal, deniedReason);
+		for (const write of writes) {
+			const result = documentScopeActions.includes(write.action.type) ? await this.documentActionHandler.execute(write, executing) : await this.executeRegularAction(write, executing);
 			const error = this.accumulateResultOrReturnError(result, generatedOperations, operationsWithContext);
 			if (error !== null) return {
 				success: false,
@@ -2445,11 +2589,13 @@ var SimpleJobExecutor = class {
 			operationsWithContext
 		};
 	}
-	async executeRegularAction(job, action, startTime, indexTxn, stores, skip = 0, sourceOperation, sourceRemote = "", signal, deniedReason) {
+	async executeRegularAction(write, executing) {
+		const { action, skip, sourceOperation, sourceRemote, deniedReason } = write;
+		const { job, startTime, indexTxn, stores, signal } = executing;
 		let appendCondition;
 		let documentVersion;
-		const verdictAlreadyDecided = this.featureFlags.documentDecisions && job.kind === "load";
-		if (this.featureFlags.documentDecisions && !verdictAlreadyDecided) {
+		const alreadyEvaluated = this.featureFlags.documentDecisions && executing.replayingAcceptedHistory;
+		if (this.featureFlags.documentDecisions && !alreadyEvaluated) {
 			const target = {
 				documentId: job.documentId,
 				branch: job.branch
@@ -2471,7 +2617,7 @@ var SimpleJobExecutor = class {
 			}, { scopeState: void 0 }) === "deny") return buildErrorResult(job, new DocumentDeletedError(job.documentId, built.model.document.deletedAtUtcIso), startTime);
 			appendCondition = built.appendCondition;
 			documentVersion = built.model.document.version;
-		} else if (verdictAlreadyDecided) documentVersion = (await stores.writeCache.getState(job.documentId, "document", job.branch, void 0, signal)).state.document.version;
+		} else if (alreadyEvaluated) documentVersion = (await stores.writeCache.getState(job.documentId, "document", job.branch, void 0, signal)).state.document.version;
 		else {
 			let docMeta;
 			try {
@@ -2489,10 +2635,10 @@ var SimpleJobExecutor = class {
 		} catch (error) {
 			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
 		}
-		if (job.kind !== "load") {
+		if (!executing.replayingAcceptedHistory) {
 			const subject = {
-				address: action.context?.signer?.user.address,
-				key: action.context?.signer?.app.key
+				address: write.action.context?.signer?.user.address,
+				key: write.action.context?.signer?.app.key
 			};
 			if (decide(document.state.auth, subject, {
 				verb: "execute",
@@ -2509,18 +2655,25 @@ var SimpleJobExecutor = class {
 		}
 		let updatedDocument;
 		if (deniedReason !== void 0) {
-			const denied = createOperation(action, getNextIndexForScope(document, job.scope), skip, {
+			const index = getNextIndexForScope(document, job.scope);
+			const denied = createOperation(action, index, skip, {
 				documentId: job.documentId,
 				scope: job.scope,
 				branch: job.branch
 			});
 			denied.deniedReason = deniedReason;
-			denied.hash = hashDocumentStateForScope(document, job.scope);
+			let standing = document;
+			if (skip > 0) try {
+				standing = await stores.writeCache.getState(job.documentId, job.scope, job.branch, index - skip - 1, signal);
+			} catch (error) {
+				return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+			}
+			denied.hash = hashDocumentStateForScope(standing, job.scope);
 			updatedDocument = {
-				...document,
+				...standing,
 				operations: {
-					...document.operations,
-					[job.scope]: [...document.operations[job.scope] ?? [], denied]
+					...standing.operations,
+					[job.scope]: [...standing.operations[job.scope] ?? [], denied]
 				}
 			};
 		} else try {
@@ -2600,36 +2753,106 @@ var SimpleJobExecutor = class {
 		};
 	}
 	/**
-	* If an operation happened that could change a decision model verdict, we
-	* need to re-evaluate across the streams that could be affected. Previously
-	* approved operations may need to be denied, which will apply new denied
-	* operations with appropriate skip.
+	* Orders a write by timestamp. The caller supplies the timestamp, so a write
+	* can belong before operations already stored, and appending it at the tail
+	* would leave the scope out of order. The operations it belongs before are
+	* re-appended alongside it, the way a load reshuffles.
 	*/
-	async reevaluateReadingScopes(job, startTime, indexTxn, stores, signal) {
+	async positionByTimestamp(job, stores, signal) {
+		if (!this.featureFlags.documentDecisions || job.actions.length === 0) return { actions: job.actions };
+		let earliest = job.actions[0].timestampUtcMs;
+		for (const action of job.actions) if (action.timestampUtcMs < earliest) earliest = action.timestampUtcMs;
+		const revisions = await stores.operationStore.getRevisions(job.documentId, job.branch, signal);
+		if (earliest >= revisions.latestTimestamp) return { actions: job.actions };
+		const conflicting = (await stores.operationStore.getConflicting(job.documentId, job.scope, job.branch, earliest, void 0, signal)).results.filter((operation) => !isGenesisOperation(operation));
+		if (conflicting.length === 0) return { actions: job.actions };
+		const nextIndex = revisions.revision[job.scope] ?? 0;
+		let firstConflicting = conflicting[0].index;
+		for (const operation of conflicting) if (operation.index < firstConflicting) firstConflicting = operation.index;
+		const incoming = job.actions.map((action, i) => ({
+			id: action.id,
+			index: nextIndex + i,
+			skip: 0,
+			hash: "",
+			timestampUtcMs: action.timestampUtcMs,
+			action
+		}));
+		const merged = reshuffleByTimestamp({
+			index: nextIndex,
+			skip: retractionSkip(nextIndex, firstConflicting)
+		}, conflicting, incoming);
+		stores.writeCache.invalidate(job.documentId, job.scope, job.branch);
+		return {
+			actions: merged.map((operation) => operation.action),
+			skipValues: merged.map((operation) => operation.skip)
+		};
+	}
+	/**
+	* Re-evaluates the document when a write meets both criteria: it was written
+	* to a stream the model reads, and it is timestamped before an operation
+	* already stored. The caller supplies the timestamp and the reactor does not replace
+	* it, so a mutation job can write such an operation just as a load job can,
+	* which is why both executeJob and executeLoadJob call this.
+	*/
+	async reevaluateIfCriteriaMet(criteria, executing) {
+		if (!this.featureFlags.documentDecisions) return;
+		const { job, stores, signal } = executing;
+		if (!staticReadSet(documentDecisionModel({
+			documentId: job.documentId,
+			branch: job.branch
+		})).some((stream) => stream.query.documentId === job.documentId && stream.query.scope === criteria.scope && stream.query.branch === job.branch)) return;
+		const revisions = await stores.operationStore.getRevisions(job.documentId, job.branch, signal);
+		const latest = Date.parse(revisions.latestTimestamp);
+		if (!criteria.operations.some((operation) => Date.parse(operation.timestampUtcMs) < latest)) return;
+		return this.reevaluateDocument(executing);
+	}
+	/**
+	* Re-evaluates every scope the model evaluates. Where an operation's
+	* evaluation differs from what is stored, the tail from that operation is
+	* re-appended, carrying a skip that spans the indices it supersedes.
+	*/
+	async reevaluateDocument(executing) {
+		const { job, stores, signal } = executing;
 		const definition = documentDecisionModel({
 			documentId: job.documentId,
 			branch: job.branch
 		});
 		const revisions = await stores.operationStore.getRevisions(job.documentId, job.branch, signal);
 		for (const scope of Object.keys(revisions.revision)) {
-			if (!definition.judgesScope(scope)) continue;
+			if (!definition.evaluatesScope(scope)) continue;
 			const stored = (await stores.operationStore.getSince(job.documentId, scope, job.branch, -1, void 0, void 0, signal)).results;
 			const effective = garbageCollect(sortOperations([...stored]));
 			if (effective.length === 0) continue;
-			const recomputed = await deletionVerdictsByPosition(job.documentId, scope, job.branch, effective, stores.writeCache, stores.operationStore, signal);
-			const firstChange = effective.findIndex((operation, i) => operation.deniedReason !== recomputed[i]);
+			const reevaluated = await evaluateDeletionsByPosition({
+				documentId: job.documentId,
+				branch: job.branch
+			}, {
+				scope,
+				operations: effective
+			}, stores, signal);
+			const firstChange = effective.findIndex((operation, i) => operation.deniedReason !== reevaluated[i]);
 			if (firstChange === -1) continue;
 			const tail = effective.slice(firstChange);
 			const nextIndex = revisions.revision[scope];
 			stores.writeCache.invalidate(job.documentId, scope, job.branch);
-			const result = await this.processActions({
-				...job,
-				scope
-			}, tail.map((operation) => operation.action), startTime, indexTxn, stores, tail.map((_, i) => i === 0 ? retractionSkip(nextIndex, tail[0].index) : 0), void 0, "", signal, recomputed.slice(firstChange));
+			const result = await this.processActions(tail.map((operation, i) => ({
+				action: operation.action,
+				skip: i === 0 ? retractionSkip(nextIndex, tail[0].index) : 0,
+				sourceRemote: "",
+				deniedReason: reevaluated[firstChange + i]
+			})), {
+				...executing,
+				job: {
+					...job,
+					scope
+				},
+				replayingAcceptedHistory: true
+			});
 			if (!result.success) return result.error ?? /* @__PURE__ */ new Error(`Re-evaluation of ${job.documentId} ${scope} failed`);
 		}
 	}
-	async executeLoadJob(job, startTime, indexTxn, stores, signal) {
+	async executeLoadJob(executing) {
+		const { job, startTime, indexTxn, stores, signal } = executing;
 		if (job.operations.length === 0) return buildErrorResult(job, /* @__PURE__ */ new Error("Load job must include at least one operation"), startTime);
 		let docMeta;
 		try {
@@ -2679,7 +2902,7 @@ var SimpleJobExecutor = class {
 			}
 			return true;
 		});
-		const existingOpsToReshuffle = nonSupersededOps;
+		const existingOpsToReshuffle = nonSupersededOps.filter((operation) => !isGenesisOperation(operation));
 		if (existingOpsToReshuffle.length > this.config.maxSkipThreshold) return {
 			job,
 			success: false,
@@ -2722,11 +2945,15 @@ var SimpleJobExecutor = class {
 			id: operation.id
 		})));
 		for (const operation of reshuffledOperations) if (operation.action.type === "NOOP") operation.skip = 1;
-		const actions = reshuffledOperations.map((operation) => operation.action);
-		const skipValues = reshuffledOperations.map((operation) => operation.skip);
 		let deniedReasons;
 		if (this.featureFlags.documentDecisions) try {
-			deniedReasons = await deletionVerdictsByPosition(job.documentId, scope, job.branch, reshuffledOperations, stores.writeCache, stores.operationStore, signal);
+			deniedReasons = await evaluateDeletionsByPosition({
+				documentId: job.documentId,
+				branch: job.branch
+			}, {
+				scope,
+				operations: reshuffledOperations
+			}, stores, signal);
 		} catch (error) {
 			return {
 				job,
@@ -2736,7 +2963,13 @@ var SimpleJobExecutor = class {
 			};
 		}
 		const effectiveSourceRemote = skipCount > 0 ? "" : job.meta.sourceRemote || "";
-		const result = await this.processActions(job, actions, startTime, indexTxn, stores, skipValues, reshuffledOperations, effectiveSourceRemote, signal, deniedReasons);
+		const result = await this.processActions(reshuffledOperations.map((operation, i) => ({
+			action: operation.action,
+			skip: operation.skip,
+			sourceOperation: operation,
+			sourceRemote: effectiveSourceRemote,
+			deniedReason: deniedReasons?.[i]
+		})), executing);
 		if (!result.success) return {
 			job,
 			success: false,
@@ -2745,23 +2978,16 @@ var SimpleJobExecutor = class {
 		};
 		stores.writeCache.invalidate(job.documentId, scope, job.branch);
 		if (scope === "document") stores.documentMetaCache.invalidate(job.documentId, job.branch);
-		const readsThisStream = staticReadSet(documentDecisionModel({
-			documentId: job.documentId,
-			branch: job.branch
-		})).some((stream) => stream.query.documentId === job.documentId && stream.query.scope === scope && stream.query.branch === job.branch);
-		if (this.featureFlags.documentDecisions && readsThisStream) {
-			const revisions = await stores.operationStore.getRevisions(job.documentId, job.branch, signal);
-			const latest = Date.parse(revisions.latestTimestamp);
-			if (result.generatedOperations.some((operation) => Date.parse(operation.timestampUtcMs) < latest)) {
-				const error = await this.reevaluateReadingScopes(job, startTime, indexTxn, stores, signal);
-				if (error) return {
-					job,
-					success: false,
-					error,
-					duration: Date.now() - startTime
-				};
-			}
-		}
+		const reevaluationError = await this.reevaluateIfCriteriaMet({
+			scope,
+			operations: result.generatedOperations
+		}, executing);
+		if (reevaluationError) return {
+			job,
+			success: false,
+			error: reevaluationError,
+			duration: Date.now() - startTime
+		};
 		return {
 			job,
 			success: true,
@@ -3266,16 +3492,12 @@ var KyselyOperationStore = class KyselyOperationStore {
 			"o1.index",
 			"o1.timestampUtcMs"
 		]).where("o1.documentId", "=", documentId).where("o1.branch", "=", branch).where((eb) => eb("o1.index", "=", eb.selectFrom("Operation as o2").select((eb2) => eb2.fn.max("o2.index").as("maxIndex")).where("o2.documentId", "=", eb.ref("o1.documentId")).where("o2.branch", "=", eb.ref("o1.branch")).where("o2.scope", "=", eb.ref("o1.scope")))).execute();
+		const latest = await this.queryExecutor.selectFrom("Operation").select((eb) => eb.fn.max("timestampUtcMs").as("latestTimestamp")).where("documentId", "=", documentId).where("branch", "=", branch).executeTakeFirst();
 		const revision = {};
-		let latestTimestamp = (/* @__PURE__ */ new Date(0)).toISOString();
-		for (const row of scopeRevisions) {
-			revision[row.scope] = row.index + 1;
-			const timestamp = row.timestampUtcMs.toISOString();
-			if (timestamp > latestTimestamp) latestTimestamp = timestamp;
-		}
+		for (const row of scopeRevisions) revision[row.scope] = row.index + 1;
 		return {
 			revision,
-			latestTimestamp
+			latestTimestamp: latest?.latestTimestamp ? new Date(latest.latestTimestamp).toISOString() : (/* @__PURE__ */ new Date(0)).toISOString()
 		};
 	}
 	rowToOperation(row) {
@@ -3622,4 +3844,4 @@ const DEFAULT_DRIVE_CONTAINER_TYPES = new Set(["powerhouse/document-drive", "pow
 //#endregion
 export { AuthorizationDeniedError as A, DuplicateOperationError as C, DuplicateModuleError as D, DuplicateManifestError as E, throwIfAborted as F, __exportAll as I, DocumentNotFoundError as M, matchesScope as N, InvalidModuleError as O, parsePagingOptions as P, AppendConditionFailedError as S, RevisionMismatchError as T, DocumentMetaCache as _, createForwardingPoolInstrumentation as a, CollectionMembershipCache as b, KyselyKeyframeStore as c, DriveCollectionId as d, buildDecisionModel as f, KyselyOperationIndex as g, KyselyWriteCache as h, runMigrations as i, DocumentDeletedError as j, ModuleNotFoundError as k, DocumentModelRegistry as l, EventBus as m, REACTOR_SCHEMA as n, instrumentPgPool as o, KyselyExecutionScope as p, getMigrationStatus as r, KyselyOperationStore as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, SimpleJobExecutor as u, createConsistencyToken as v, OptimisticLockError as w, APPEND_CONDITION_FAILED_PREFIX as x, createEmptyConsistencyToken as y };
 
-//# sourceMappingURL=drive-container-types-BNwEHEXP.js.map
+//# sourceMappingURL=drive-container-types-ZSLCC3lC.js.map