@powerhousedao/reactor 6.2.2-dev.37 → 6.2.2-dev.39

package/dist/{drive-container-types-ZSLCC3lC.js → drive-container-types-BJCKXJwH.js}

@@ -1,5 +1,5 @@
 import { n as ReactorEventTypes, t as EventBusAggregateError } from "./types-DMKLa0Ok.js";
-import { DowngradeNotSupportedError, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, baseReducerVersion, createPresignedHeader, decide, defaultBaseState, deriveOperationId, garbageCollect, hashDocumentStateForScope, isDenied, isUndoRedo, sortOperations } from "@powerhousedao/shared/document-model";
+import { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, DOCUMENT_DELETED_REASON, DowngradeNotSupportedError, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, baseReducerVersion, createPresignedHeader, decide, defaultBaseState, deriveOperationId, evaluate, garbageCollect, hashDocumentStateForScope, isDenied, isUndoRedo, sortOperations } from "@powerhousedao/shared/document-model";
 import { v4 } from "uuid";
 import { Migrator, sql } from "kysely";
 //#region \0rolldown/runtime.js
@@ -93,6 +93,81 @@ var AuthorizationDeniedError = class AuthorizationDeniedError extends Error {
 	}
 };
 /**
+* An auth operation did not strictly exceed the newest timestamp in its stream.
+*
+* Terminal and asymmetric by design: no ordering rule can reconcile two replicas
+* that each accepted an auth operation offline, because either order hands one
+* authority the other never granted, so the replica ahead holds the arrival.
+*/
+var AuthTimestampNotMonotonicError = class AuthTimestampNotMonotonicError extends Error {
+	documentId;
+	branch;
+	timestampUtcMs;
+	newestTimestampUtcMs;
+	constructor(documentId, branch, timestampUtcMs, newestTimestampUtcMs) {
+		super(`Auth timestamp not monotonic: ${timestampUtcMs} does not exceed ${newestTimestampUtcMs} in the auth stream of document ${documentId} on branch ${branch}`);
+		this.name = "AuthTimestampNotMonotonicError";
+		this.documentId = documentId;
+		this.branch = branch;
+		this.timestampUtcMs = timestampUtcMs;
+		this.newestTimestampUtcMs = newestTimestampUtcMs;
+		Error.captureStackTrace(this, AuthTimestampNotMonotonicError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "AuthTimestampNotMonotonicError";
+	}
+};
+/**
+* An operation or action carried a timestamp that is not an ISO-8601 UTC
+* instant.
+*
+* Terminal rather than retryable: the value does not change between attempts,
+* so a retry re-runs the whole job to fail identically. Quarantining, unlike a
+* held auth operation — this is malformed data rather than two replicas
+* disagreeing, and nothing further from that source should be trusted until it
+* is looked at.
+*/
+var InvalidOperationTimestampError = class InvalidOperationTimestampError extends Error {
+	documentId;
+	scope;
+	timestampUtcMs;
+	constructor(documentId, scope, timestampUtcMs, context) {
+		super(`Invalid timestamp "${timestampUtcMs}" on ${context} in scope "${scope}" of document ${documentId}`);
+		this.name = "InvalidOperationTimestampError";
+		this.documentId = documentId;
+		this.scope = scope;
+		this.timestampUtcMs = timestampUtcMs;
+		Error.captureStackTrace(this, InvalidOperationTimestampError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "InvalidOperationTimestampError";
+	}
+};
+/**
+* A load would move more operations than the bound allows, indicating a real
+* divergence between local and incoming history. Counts only first-time moves,
+* so a re-evaluation pass's re-appends do not make busy documents
+* revocation-proof. Terminal: the condition is deterministic.
+*/
+var ExcessiveReshuffleError = class ExcessiveReshuffleError extends Error {
+	documentId;
+	scope;
+	count;
+	threshold;
+	constructor(documentId, scope, count, threshold) {
+		super(`Excessive reshuffle detected: ${count} operations in scope "${scope}" of document ${documentId} exceeds the threshold of ${threshold}. This indicates a significant divergence between local and incoming operations.`);
+		this.name = "ExcessiveReshuffleError";
+		this.documentId = documentId;
+		this.scope = scope;
+		this.count = count;
+		this.threshold = threshold;
+		Error.captureStackTrace(this, ExcessiveReshuffleError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "ExcessiveReshuffleError";
+	}
+};
+/**
 * Error thrown when an operation has an invalid signature.
 */
 var InvalidSignatureError = class InvalidSignatureError extends Error {
@@ -288,6 +363,34 @@ var CollectionMembershipCache = class CollectionMembershipCache {
 };
 //#endregion
 //#region src/executor/util.ts
+/** Actions the reactor reduces itself, onto the document scope. */
+const DOCUMENT_SCOPE_ACTIONS = new Set([
+	"CREATE_DOCUMENT",
+	"DELETE_DOCUMENT",
+	"UPGRADE_DOCUMENT",
+	"ADD_RELATIONSHIP",
+	"REMOVE_RELATIONSHIP",
+	"UPDATE_RELATIONSHIP"
+]);
+/**
+* `CREATE_DOCUMENT` is exempt by necessity: it runs before the document exists,
+* so building a decision model would throw and defer the job forever.
+*/
+const GATED_DOCUMENT_ACTIONS = new Set([...DOCUMENT_SCOPE_ACTIONS].filter((type) => type !== "CREATE_DOCUMENT"));
+/**
+* The document a document-scope action writes to, which is not always the job's
+* own document: delete and upgrade name it in `input.documentId`, and the
+* relationship actions in `input.sourceId`. `execute` only checks that a batch
+* shares one scope, so a caller can submit an action whose target is a document
+* other than the one the job is keyed by. The policy gate has to follow the
+* action rather than the job, or it decides against a policy the caller may
+* control instead of the one guarding the write.
+*/
+function targetDocumentId(action, fallback) {
+	const input = action.input;
+	if (action.type === "ADD_RELATIONSHIP" || action.type === "REMOVE_RELATIONSHIP" || action.type === "UPDATE_RELATIONSHIP") return typeof input?.sourceId === "string" && input.sourceId.length > 0 ? input.sourceId : fallback;
+	return typeof input?.documentId === "string" && input.documentId.length > 0 ? input.documentId : fallback;
+}
 /**
 * Creates a PHDocument from a CREATE_DOCUMENT action input.
 * Reconstructs the document header and initializes the base state.
@@ -426,6 +529,14 @@ function buildErrorResult(job, error, startTime) {
 	};
 }
 /**
+* The error a refusal surfaces as. Both classes are already terminal in the job
+* result handler, so a refusal never burns a retry.
+*/
+function refusalError(reason, documentId, deletedAtUtcIso, action) {
+	if (reason === DOCUMENT_DELETED_REASON) return new DocumentDeletedError(documentId, deletedAtUtcIso);
+	return new AuthorizationDeniedError(documentId, action.scope, action.type, action.context?.signer?.user.address);
+}
+/**
 * Whether this operation is part of the document's creation. The create and the
 * upgrade from version zero hold the first two indexes for the life of the
 * document, so a reshuffle has to leave them where they are.
@@ -984,20 +1095,6 @@ function keyframeRevision(keyframe, documentId, scope) {
 	if (typeof nextIndex !== "number") throw new Error(`Corrupt keyframe for document ${documentId} at revision ${keyframe.revision}: header carries no ${scope} revision`);
 	return nextIndex - 1;
 }
-/**
-* Records a denied operation in the history without applying it. This is used
-* for auth-rejected operations, as these need to be recorded without being
-* applied.
-*/
-function appendWithoutApplying(document, scope, operation) {
-	return {
-		...document,
-		operations: {
-			...document.operations,
-			[scope]: [...document.operations[scope] ?? [], operation]
-		}
-	};
-}
 function extractModuleVersion(doc) {
 	const v = doc.state.document.version;
 	return v === 0 ? void 0 : v;
@@ -1395,7 +1492,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 				for (const operation of result.results) {
 					if (targetRevision !== void 0 && operation.index > targetRevision) break;
 					const moduleVersion = this.resolveModuleVersionForOp(operation.index, operation.timestampUtcMs, scope, validatedUpgrades, extractModuleVersion(document));
-					if (isDenied(operation)) document = appendWithoutApplying(document, scope, operation);
+					if (isDenied(operation)) document = appendWithoutApplying(document, operation, scope);
 					else {
 						const protocolVersion = baseReducerVersion(document.header);
 						document = getModuleCached(moduleVersion).reducer(document, operation.action, void 0, {
@@ -1467,7 +1564,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 			for (const operation of pagedResults.results) {
 				if (signal?.aborted) throw new Error("Operation aborted");
 				if (targetRevision !== void 0 && operation.index > targetRevision) break;
-				if (isDenied(operation)) document = appendWithoutApplying(document, scope, operation);
+				if (isDenied(operation)) document = appendWithoutApplying(document, operation, scope);
 				else {
 					const protocolVersion = baseReducerVersion(document.header);
 					document = module.reducer(document, operation.action, void 0, {
@@ -1555,6 +1652,32 @@ var EventBus = class {
 	}
 };
 //#endregion
+//#region src/core/feature-flags.ts
+/**
+* Every flag this reactor knows, with the flags it requires. A stage adds its
+* flag here when it ships, so asking an older reactor for a later stage's flag
+* is an unrecognized name rather than a flag that quietly does nothing.
+*/
+const FLAG_PREREQUISITES = {
+	documentDecisions: [],
+	authEnforcement: ["documentDecisions"]
+};
+/**
+* Throws when the flags ask for enforcement the reactor cannot deliver. Either
+* failure would otherwise read as enforcement being on while the reactor
+* applies less than the caller asked for.
+*/
+function validateFeatureFlags(flags, prerequisites) {
+	const known = Object.keys(prerequisites);
+	const unrecognized = Object.keys(flags).filter((name) => !known.includes(name));
+	if (unrecognized.length > 0) throw new Error(`Unrecognized reactor feature flag: ${unrecognized.join(", ")}. This reactor knows: ${known.join(", ")}.`);
+	for (const name of known) {
+		if (flags[name] !== true) continue;
+		const missing = prerequisites[name].filter((required) => flags[required] !== true);
+		if (missing.length > 0) throw new Error(`Reactor feature flag ${name} requires ${missing.join(", ")}.`);
+	}
+}
+//#endregion
 //#region src/executor/execution-scope.ts
 var DefaultExecutionScope = class {
 	constructor(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache) {
@@ -1652,6 +1775,58 @@ function reshuffleByTimestamp(startIndex, opsA, opsB) {
 	}));
 }
 //#endregion
+//#region src/decision/auth-decision-model.ts
+function refusalReason(refusal) {
+	switch (refusal) {
+		case "version-unsupported": return AUTH_VERSION_UNSUPPORTED_REASON;
+		case "denied-by-grant": return AUTH_DENIED_BY_GRANT_REASON;
+		case "no-applicable-grant": return AUTH_NO_GRANT_REASON;
+	}
+}
+/** This decision model uses both the document and the auth streams. */
+function authDecisionModel(target) {
+	return {
+		projections: {
+			document: {
+				decidingActions: ["DELETE_DOCUMENT"],
+				apply: (document, operation) => operation.action.type === "DELETE_DOCUMENT" ? applyDeleteDocumentAction({
+					...document,
+					state: { ...document.state }
+				}, operation.action) : document,
+				query: {
+					documentId: target.documentId,
+					branch: target.branch,
+					scope: "document"
+				}
+			},
+			auth: {
+				decidingActions: [...AUTH_ACTION_TYPES],
+				apply: (document, operation) => applyAuthAction(document, operation.action),
+				query: {
+					documentId: target.documentId,
+					branch: target.branch,
+					scope: "auth"
+				}
+			}
+		},
+		evaluatesScope() {
+			return true;
+		},
+		decide(model, subject, request) {
+			if (request.verb === "execute" && model.document.isDeleted) return {
+				decision: "deny",
+				reason: DOCUMENT_DELETED_REASON
+			};
+			const evaluation = evaluate(model.auth, subject, request);
+			if (evaluation.decision === "allow") return { decision: "allow" };
+			return {
+				decision: "deny",
+				reason: refusalReason(evaluation.refusal)
+			};
+		}
+	};
+}
+//#endregion
 //#region src/decision/build-decision-model.ts
 /**
 * Reads each projection's stream through the write cache, recording the
@@ -1721,9 +1896,10 @@ function observedRevision(document, scope) {
 */
 function staticReadSet(definition) {
 	const streams = [];
-	for (const projection of Object.values(definition.projections)) {
+	for (const [name, projection] of Object.entries(definition.projections)) {
 		if (typeof projection.query === "function") continue;
 		streams.push({
+			name,
 			query: projection.query,
 			decidingActions: projection.decidingActions,
 			apply: projection.apply
@@ -1733,8 +1909,6 @@ function staticReadSet(definition) {
 }
 //#endregion
 //#region src/decision/document-decision-model.ts
-/** Why the model refused an operation. */
-const DOCUMENT_DELETED_REASON = "document deleted";
 /**
 * The simplest decision model: one projection over the document scope, which
 * rejects on a deleted document.
@@ -1757,11 +1931,36 @@ function documentDecisionModel(target) {
 			return true;
 		},
 		decide(model) {
-			return model.document.isDeleted ? "deny" : "allow";
+			return model.document.isDeleted ? {
+				decision: "deny",
+				reason: DOCUMENT_DELETED_REASON
+			} : { decision: "allow" };
 		}
 	};
 }
 //#endregion
+//#region src/decision/registered-model.ts
+/**
+* Builds the model at the stream heads and decides one request against it. The
+* append condition it returns is the read-set the store enforces at write time.
+*/
+async function decideAtHead(model, cache, target, subject, request, signal) {
+	const built = await buildDecisionModel(cache, model, target, signal);
+	return {
+		evaluation: model(target).decide(built.model, subject, request, { scopeState: void 0 }),
+		appendCondition: built.appendCondition,
+		documentVersion: built.model.document.version,
+		deletedAtUtcIso: built.model.document.deletedAtUtcIso ?? null
+	};
+}
+/**
+* The model this reactor enforces. With `authEnforcement` off the auth scope is
+* absent from every append condition and no load walks it.
+*/
+function selectDecisionModel(flags) {
+	return flags.authEnforcement ? authDecisionModel : documentDecisionModel;
+}
+//#endregion
 //#region src/decision/merged-order.ts
 /** Identifies a stream within a walk. */
 function streamKey(query) {
@@ -1769,15 +1968,17 @@ function streamKey(query) {
 }
 /**
 * Orders two operations from different streams by position. Timestamp decides;
-* an equal timestamp falls to the action id and then the operation id, so that
-* two replicas holding the same operations agree on the order whatever order
-* they happen to store them in.
+* an equal timestamp puts an auth operation first, and otherwise falls to the
+* action id and then the operation id, so that two replicas holding the same
+* operations agree on the order whatever order they happen to store them in.
 */
 function comparePositions(a, b) {
 	const aTime = Date.parse(a.operation.timestampUtcMs);
 	const bTime = Date.parse(b.operation.timestampUtcMs);
 	if (aTime !== bTime) return aTime - bTime;
 	if (a.streamKey === b.streamKey) return a.operation.index - b.operation.index;
+	const aAuth = a.scope === "auth";
+	if (aAuth !== (b.scope === "auth")) return aAuth ? -1 : 1;
 	const actionIds = (a.operation.action.id ?? "").localeCompare(b.operation.action.id ?? "");
 	if (actionIds !== 0) return actionIds;
 	return (a.operation.id ?? "").localeCompare(b.operation.id ?? "");
@@ -1791,6 +1992,7 @@ function mergeByPosition(streams) {
 	const merged = [];
 	for (const stream of streams) for (const operation of stream.operations) merged.push({
 		streamKey: stream.streamKey,
+		scope: stream.scope,
 		operation
 	});
 	return merged.sort(comparePositions);
@@ -1809,15 +2011,17 @@ function retractionSkip(nextIndex, firstRetractedIndex) {
 * A single forward pass is only correct while a stream's effective operations
 * are ordered.
 */
-function assertPositionOrder(streamKey, operations) {
+function assertPositionOrder(streamKey, scope, operations) {
 	for (let i = 1; i < operations.length; i++) {
 		const previous = operations[i - 1];
 		const current = operations[i];
 		if (comparePositions({
 			streamKey,
+			scope,
 			operation: previous
 		}, {
 			streamKey,
+			scope,
 			operation: current
 		}) > 0) throw new Error(`Stream ${streamKey} is out of position order: index ${previous.index} at ${previous.timestampUtcMs} precedes index ${current.index} at ${current.timestampUtcMs}`);
 	}
@@ -1825,32 +2029,35 @@ function assertPositionOrder(streamKey, operations) {
 /**
 * Visits every operation in the read-set once, in the order their positions
 * fall, and hands back the state each stream held just before it. That state is
-* what a decision at that operation reads: everything ahead of it has been
-* applied and it has not.
+* what a decision at that operation reads.
 *
 * Skips are resolved first (i.e. this is performed on a garbage collected
 * stream), which means we can do a single forward pass.
 *
-* A denied operation is visited but not applied.
+* An operation that contributes no state, whether denied or holding a reducer
+* error, is visited but not applied (this matches the write cache's rebuild).
+*
+* The consumer sends back whether it refused the operation it was handed: a
+* refusal this pass produced must suppress it the same way a stored one does.
 */
 function* walkByPosition(streams) {
 	const merged = mergeByPosition(streams.map((stream) => {
 		const operations = garbageCollect(sortOperations([...stream.operations]));
-		assertPositionOrder(stream.streamKey, operations);
+		assertPositionOrder(stream.streamKey, stream.scope, operations);
 		return {
 			streamKey: stream.streamKey,
+			scope: stream.scope,
 			operations
 		};
 	}));
 	const byKey = new Map(streams.map((stream) => [stream.streamKey, stream]));
 	const states = new Map(streams.map((stream) => [stream.streamKey, stream.document]));
 	for (const { streamKey, operation } of merged) {
-		yield {
+		if ((yield {
 			streamKey,
 			operation,
 			states: new Map(states)
-		};
-		if (isDenied(operation)) continue;
+		}) || operation.error !== void 0 || isDenied(operation)) continue;
 		const stream = byKey.get(streamKey);
 		const before = states.get(streamKey);
 		if (before === void 0 || stream === void 0) throw new Error(`No state for stream ${streamKey}`);
@@ -1858,70 +2065,99 @@ function* walkByPosition(streams) {
 	}
 }
 //#endregion
-//#region src/decision/deletion-evaluation.ts
-const WRITTEN = "written";
-/** Whether a read stream counts this action as one that changes an evaluation. */
-function canRefuseOthers(operation, readSet) {
+//#region src/decision/evaluation.ts
+/** The stream key for evaluated operations whose scope no projection reads. */
+const EVALUATED_ONLY = "evaluated";
+/**
+* Whether any stream the model reads declares this operation's action type as
+* one that can change an evaluation.
+*/
+function isDecidingAction(operation, readSet) {
 	return readSet.some((stream) => stream.decidingActions.includes(operation.action.type));
 }
-/** The deleted one of these, or the first if none of them is deleted. */
-function firstDeleted(candidates) {
-	for (const candidate of candidates) if (candidate?.state.document.isDeleted) return candidate.state.document;
-	return candidates[0].state.document;
+/**
+* Who an operation acts as. A replayed operation is evaluated as its own signer,
+* so an address-scoped policy does not deny its own author's history.
+*/
+function subjectOf(operation) {
+	const signer = operation.action.context?.signer;
+	return {
+		address: signer?.user.address,
+		key: signer?.app.key
+	};
+}
+/**
+* The model as the walk reached this operation: each projection's value is its
+* own scope's state, taken from the stream that projection reads.
+*/
+function modelAt(readSet, states) {
+	const model = {};
+	for (const stream of readSet) {
+		const document = states.get(streamKey(stream.query));
+		if (document === void 0) throw new Error(`No state walked for projection ${stream.name}`);
+		model[stream.name] = document.state[stream.query.scope];
+	}
+	return model;
 }
 /**
-* This function determines which operations will be refused because of
-* deletes, returning reasons in a parallel array (undefined means the
-* operation is not refused).
+* Evaluates each operation at its own position and returns the refusals in an
+* array parallel to the operations, where undefined means allowed.
 *
-* A deletion already in the stream refuses the operations timestamped after it
-* and leaves the earlier ones alone. A deletion among the ones passed in does
-* the same to those after it.
+* A position is a timestamp, so an operation refused by a delete is one that
+* sorts after it, and the operations before it are left alone. That holds
+* whether the delete is already stored or is among the operations passed in.
 */
-async function evaluateDeletionsByPosition(target, subject, stores, signal) {
+async function evaluateByPosition(model, target, subject, stores, signal) {
 	const { scope, operations } = subject;
 	const { writeCache, operationStore } = stores;
-	const definition = documentDecisionModel(target);
+	const definition = model(target);
 	const readSet = staticReadSet(definition);
 	if (!definition.evaluatesScope(scope)) return operations.map(() => void 0);
 	const evaluating = new Set(operations.map((operation) => operation.id));
 	const readStreams = await Promise.all(readSet.map(async (stream) => ({
 		stream,
-		operations: (await operationStore.getSince(stream.query.documentId, stream.query.scope, stream.query.branch, 0, { actionTypes: stream.decidingActions }, void 0, signal)).results.filter((operation) => !evaluating.has(operation.id))
+		operations: (await operationStore.getSince(stream.query.documentId, stream.query.scope, stream.query.branch, -1, { actionTypes: stream.decidingActions }, void 0, signal)).results.filter((operation) => !evaluating.has(operation.id))
 	})));
-	const decidingWritten = operations.filter((operation) => canRefuseOthers(operation, readSet));
-	if (readStreams.every((read) => read.operations.length === 0) && decidingWritten.length === 0) return operations.map(() => void 0);
+	const decidingOperations = operations.filter((operation) => isDecidingAction(operation, readSet));
+	if (readStreams.every((read) => read.operations.length === 0) && decidingOperations.length === 0) return operations.map(() => void 0);
 	if (readStreams.length === 0) throw new Error(`Decision model for ${target.documentId} reads no stream whose query is known before it is built`);
+	const writtenProjection = readSet.find((stream) => stream.query.scope === scope);
 	const walked = [];
 	for (const read of readStreams) {
-		const before = await writeCache.getState(read.stream.query.documentId, read.stream.query.scope, read.stream.query.branch, 0, signal);
+		const isWritten = read.stream === writtenProjection;
+		const before = await writeCache.getState(read.stream.query.documentId, read.stream.query.scope, read.stream.query.branch, -1, signal);
 		walked.push({
 			streamKey: streamKey(read.stream.query),
+			scope: read.stream.query.scope,
 			document: before,
-			operations: read.operations,
+			operations: isWritten ? [...read.operations, ...operations] : read.operations,
 			apply: read.stream.apply
 		});
 	}
-	const writtenStreamIsRead = readSet.find((stream) => stream.query.scope === scope);
-	walked.push({
-		streamKey: WRITTEN,
+	if (writtenProjection === void 0) walked.push({
+		streamKey: EVALUATED_ONLY,
+		scope,
 		document: walked[0].document,
 		operations,
-		apply: writtenStreamIsRead?.apply ?? ((document) => document)
+		apply: (document) => document
 	});
 	const reasons = /* @__PURE__ */ new Map();
-	for (const step of walkByPosition(walked)) {
-		if (step.streamKey !== WRITTEN) continue;
-		const document = firstDeleted([...step.states.values()]);
-		const decision = definition.decide({ document }, {
-			address: void 0,
-			key: void 0
-		}, {
+	const walk = walkByPosition(walked);
+	let step = walk.next(false);
+	while (!step.done) {
+		const position = step.value;
+		if (!evaluating.has(position.operation.id)) {
+			step = walk.next(false);
+			continue;
+		}
+		const evaluation = definition.decide(modelAt(readSet, position.states), subjectOf(position.operation), {
 			verb: "execute",
-			scope,
-			operation: step.operation.action.type
+			scope: position.operation.action.scope,
+			operation: position.operation.action.type
 		}, { scopeState: void 0 });
-		reasons.set(step.operation.id, decision === "deny" ? DOCUMENT_DELETED_REASON : void 0);
+		const denied = evaluation.decision === "deny";
+		reasons.set(position.operation.id, denied ? evaluation.reason : void 0);
+		step = walk.next(denied);
 	}
 	return operations.map((operation) => reasons.get(operation.id));
 }
@@ -1972,19 +2208,22 @@ var DriveCollectionId = class DriveCollectionId {
 //#endregion
 //#region src/executor/document-action-handler.ts
 var DocumentActionHandler = class {
-	constructor(registry, logger, driveContainerTypes, featureFlags) {
+	constructor(registry, logger, driveContainerTypes, featureFlags, decisionModel) {
 		this.registry = registry;
 		this.logger = logger;
 		this.driveContainerTypes = driveContainerTypes;
 		this.featureFlags = featureFlags;
+		this.decisionModel = decisionModel;
 	}
 	/** Whether the write arrives with its evaluation already decided. */
 	alreadyEvaluated(executing) {
-		return this.featureFlags.documentDecisions && executing.replayingAcceptedHistory;
+		return this.featureFlags.documentDecisions && (executing.replayingAcceptedHistory || executing.evaluatedByPosition);
 	}
 	async execute(write, executing) {
 		const { action } = write;
 		if (write.deniedReason !== void 0) return this.writeDenied(write, executing);
+		const refusal = await this.refuseIfPolicyDenies(write, executing);
+		if (refusal) return refusal;
 		switch (action.type) {
 			case "CREATE_DOCUMENT": return this.executeCreate(write, executing);
 			case "DELETE_DOCUMENT": return this.executeDelete(write, executing);
@@ -1995,6 +2234,34 @@ var DocumentActionHandler = class {
 			default: return buildErrorResult(executing.job, /* @__PURE__ */ new Error(`Unknown document action type: ${action.type}`), executing.startTime);
 		}
 	}
+	/**
+	* Refuses a document-scope write the policy denies, or undefined to proceed.
+	* Without this an `execute`-on-`document` grant is unenforceable.
+	*/
+	async refuseIfPolicyDenies(write, executing) {
+		const { action } = write;
+		const { job, startTime, stores, signal } = executing;
+		if (!this.featureFlags.documentDecisions || !this.featureFlags.authEnforcement || this.alreadyEvaluated(executing) || !GATED_DOCUMENT_ACTIONS.has(action.type)) return;
+		const documentId = targetDocumentId(action, job.documentId);
+		let admission;
+		try {
+			admission = await decideAtHead(this.decisionModel, stores.writeCache, {
+				documentId,
+				branch: job.branch
+			}, {
+				address: action.context?.signer?.user.address,
+				key: action.context?.signer?.app.key
+			}, {
+				verb: "execute",
+				scope: action.scope,
+				operation: action.type
+			}, signal);
+		} catch (error) {
+			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+		}
+		if (admission.evaluation.decision === "allow") return;
+		return buildErrorResult(job, refusalError(admission.evaluation.reason, documentId, admission.deletedAtUtcIso, action), startTime);
+	}
 	/** A refused operation holds a position in the stream but changes nothing. */
 	async writeDenied(write, executing) {
 		const { action, skip, sourceRemote, deniedReason } = write;
@@ -2005,13 +2272,20 @@ var DocumentActionHandler = class {
 		} catch (error) {
 			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
 		}
-		let operation = createOperation(action, getNextIndexForScope(document, job.scope), skip, {
+		const index = getNextIndexForScope(document, job.scope);
+		let standing = document;
+		if (skip > 0) try {
+			standing = await stores.writeCache.getState(job.documentId, job.scope, job.branch, index - skip - 1, signal);
+		} catch (error) {
+			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+		}
+		let operation = createOperation(action, index, skip, {
 			documentId: job.documentId,
 			scope: job.scope,
 			branch: job.branch
 		});
 		operation.deniedReason = deniedReason;
-		operation.hash = hashDocumentStateForScope(document, job.scope);
+		operation.hash = hashDocumentStateForScope(standing, job.scope);
 		const writeResult = await this.writeOperationToStore({
 			documentId: job.documentId,
 			documentType: document.header.documentType,
@@ -2020,12 +2294,12 @@ var DocumentActionHandler = class {
 		}, operation, executing);
 		if (!Array.isArray(writeResult)) return writeResult;
 		operation = writeResult[0];
-		updateDocumentRevision(document, job.scope, operation.index);
-		document.operations = {
-			...document.operations,
-			[job.scope]: [...document.operations[job.scope] ?? [], operation]
+		updateDocumentRevision(standing, job.scope, operation.index);
+		standing.operations = {
+			...standing.operations,
+			[job.scope]: [...standing.operations[job.scope] ?? [], operation]
 		};
-		stores.writeCache.putState(job.documentId, job.scope, job.branch, operation.index, document, SnapshotPosition.Head);
+		stores.writeCache.putState(job.documentId, job.scope, job.branch, operation.index, standing, SnapshotPosition.Head);
 		indexTxn.write([{
 			...operation,
 			documentId: job.documentId,
@@ -2035,13 +2309,13 @@ var DocumentActionHandler = class {
 			sourceRemote
 		}]);
 		stores.documentMetaCache.putDocumentMeta(job.documentId, job.branch, {
-			state: document.state.document,
-			documentType: document.header.documentType,
+			state: standing.state.document,
+			documentType: standing.header.documentType,
 			documentScopeRevision: operation.index + 1
 		});
-		return buildSuccessResult(job, operation, job.documentId, document.header.documentType, JSON.stringify({
-			header: document.header,
-			document: document.state.document
+		return buildSuccessResult(job, operation, job.documentId, standing.header.documentType, JSON.stringify({
+			header: standing.header,
+			document: standing.state.document
 		}), startTime);
 	}
 	async executeCreate(write, executing) {
@@ -2391,20 +2665,13 @@ function isValidISOTimestamp(value) {
 	if (!ISO_TIMESTAMP_REGEX.test(value)) return false;
 	return !isNaN(new Date(value).getTime());
 }
-const documentScopeActions = [
-	"CREATE_DOCUMENT",
-	"DELETE_DOCUMENT",
-	"UPGRADE_DOCUMENT",
-	"ADD_RELATIONSHIP",
-	"REMOVE_RELATIONSHIP",
-	"UPDATE_RELATIONSHIP"
-];
 /**
 * Simple job executor that processes a job by applying actions through document model reducers.
 */
 var SimpleJobExecutor = class {
 	config;
 	featureFlags;
+	decisionModel;
 	signatureVerifierModule;
 	documentActionHandler;
 	executionScope;
@@ -2427,9 +2694,14 @@ var SimpleJobExecutor = class {
 			retryMaxDelayMs: config.retryMaxDelayMs ?? 5e3,
 			yieldDeadlineMs: config.yieldDeadlineMs ?? 50
 		};
-		this.featureFlags = { documentDecisions: config.featureFlags?.documentDecisions ?? false };
+		this.featureFlags = {
+			documentDecisions: config.featureFlags?.documentDecisions ?? false,
+			authEnforcement: config.featureFlags?.authEnforcement ?? false
+		};
+		validateFeatureFlags(this.featureFlags, FLAG_PREREQUISITES);
+		this.decisionModel = selectDecisionModel(this.featureFlags);
 		this.signatureVerifierModule = new SignatureVerifier(signatureVerifier);
-		this.documentActionHandler = new DocumentActionHandler(registry, logger, driveContainerTypes, this.featureFlags);
+		this.documentActionHandler = new DocumentActionHandler(registry, logger, driveContainerTypes, this.featureFlags, this.decisionModel);
 		this.executionScope = executionScope ?? new DefaultExecutionScope(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache);
 	}
 	/**
@@ -2451,7 +2723,8 @@ var SimpleJobExecutor = class {
 						indexTxn,
 						stores,
 						signal,
-						replayingAcceptedHistory: true
+						replayingAcceptedHistory: true,
+						evaluatedByPosition: false
 					});
 					if (loadResult.success && loadResult.operationsWithContext) {
 						for (const owc of loadResult.operationsWithContext) touchedCacheEntries.push({
@@ -2471,20 +2744,18 @@ var SimpleJobExecutor = class {
 					}
 					return loadResult;
 				}
+				const positioned = await this.positionByTimestamp(job, stores, signal);
+				if (positioned.error) return buildErrorResult(job, positioned.error, startTime);
 				const executing = {
 					job,
 					startTime,
 					indexTxn,
 					stores,
 					signal,
-					replayingAcceptedHistory: false
+					replayingAcceptedHistory: false,
+					evaluatedByPosition: positioned.evaluatedByPosition
 				};
-				const positioned = await this.positionByTimestamp(job, stores, signal);
-				const actionResult = await this.processActions(positioned.actions.map((action, i) => ({
-					action,
-					skip: positioned.skipValues?.[i] ?? 0,
-					sourceRemote: ""
-				})), executing);
+				const actionResult = await this.processActions(positioned.writes, executing);
 				if (!actionResult.success) return {
 					job,
 					success: false,
@@ -2560,11 +2831,11 @@ var SimpleJobExecutor = class {
 			success: false,
 			generatedOperations,
 			operationsWithContext,
-			error: /* @__PURE__ */ new Error(`Invalid timestamp "${action.timestampUtcMs}" on action ${action.type} (id: ${action.id})`)
+			error: new InvalidOperationTimestampError(job.documentId, action.scope, action.timestampUtcMs, `action ${action.type} (id: ${action.id})`)
 		};
 		let lastYield = performance.now();
 		for (const write of writes) {
-			const result = documentScopeActions.includes(write.action.type) ? await this.documentActionHandler.execute(write, executing) : await this.executeRegularAction(write, executing);
+			const result = DOCUMENT_SCOPE_ACTIONS.has(write.action.type) ? await this.documentActionHandler.execute(write, executing) : await this.executeRegularAction(write, executing);
 			const error = this.accumulateResultOrReturnError(result, generatedOperations, operationsWithContext);
 			if (error !== null) return {
 				success: false,
@@ -2594,29 +2865,28 @@ var SimpleJobExecutor = class {
 		const { job, startTime, indexTxn, stores, signal } = executing;
 		let appendCondition;
 		let documentVersion;
-		const alreadyEvaluated = this.featureFlags.documentDecisions && executing.replayingAcceptedHistory;
+		const alreadyEvaluated = this.featureFlags.documentDecisions && (executing.replayingAcceptedHistory || executing.evaluatedByPosition);
 		if (this.featureFlags.documentDecisions && !alreadyEvaluated) {
 			const target = {
 				documentId: job.documentId,
 				branch: job.branch
 			};
-			const definition = documentDecisionModel(target);
-			let built;
+			let admission;
 			try {
-				built = await buildDecisionModel(stores.writeCache, () => definition, target, signal);
+				admission = await decideAtHead(this.decisionModel, stores.writeCache, target, {
+					address: action.context?.signer?.user.address,
+					key: action.context?.signer?.app.key
+				}, {
+					verb: "execute",
+					scope: action.scope,
+					operation: action.type
+				}, signal);
 			} catch (error) {
 				return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
 			}
-			if (definition.decide(built.model, {
-				address: action.context?.signer?.user.address,
-				key: action.context?.signer?.app.key
-			}, {
-				verb: "execute",
-				scope: action.scope,
-				operation: action.type
-			}, { scopeState: void 0 }) === "deny") return buildErrorResult(job, new DocumentDeletedError(job.documentId, built.model.document.deletedAtUtcIso), startTime);
-			appendCondition = built.appendCondition;
-			documentVersion = built.model.document.version;
+			if (admission.evaluation.decision === "deny") return buildErrorResult(job, refusalError(admission.evaluation.reason, job.documentId, admission.deletedAtUtcIso, action), startTime);
+			appendCondition = admission.appendCondition;
+			documentVersion = admission.documentVersion;
 		} else if (alreadyEvaluated) documentVersion = (await stores.writeCache.getState(job.documentId, "document", job.branch, void 0, signal)).state.document.version;
 		else {
 			let docMeta;
@@ -2635,7 +2905,7 @@ var SimpleJobExecutor = class {
 		} catch (error) {
 			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
 		}
-		if (!executing.replayingAcceptedHistory) {
+		if (!this.featureFlags.authEnforcement && !executing.replayingAcceptedHistory) {
 			const subject = {
 				address: write.action.context?.signer?.user.address,
 				key: write.action.context?.signer?.app.key
@@ -2753,19 +3023,51 @@ var SimpleJobExecutor = class {
 		};
 	}
 	/**
-	* Orders a write by timestamp. The caller supplies the timestamp, so a write
-	* can belong before operations already stored, and appending it at the tail
-	* would leave the scope out of order. The operations it belongs before are
-	* re-appended alongside it, the way a load reshuffles.
+	* Orders a write by timestamp and decides it where it lands. The caller
+	* supplies the timestamp, so a write can belong before operations already
+	* stored; those are re-appended alongside it, the way a load reshuffles.
+	*
+	* Deciding a backdated write at the stream heads instead of at its position
+	* would overwrite the verdict every other replica computes for it.
 	*/
 	async positionByTimestamp(job, stores, signal) {
-		if (!this.featureFlags.documentDecisions || job.actions.length === 0) return { actions: job.actions };
+		const plain = () => ({
+			writes: job.actions.map((action) => ({
+				action,
+				skip: 0,
+				sourceRemote: ""
+			})),
+			evaluatedByPosition: false
+		});
+		if (!this.featureFlags.documentDecisions || job.actions.length === 0) return plain();
 		let earliest = job.actions[0].timestampUtcMs;
-		for (const action of job.actions) if (action.timestampUtcMs < earliest) earliest = action.timestampUtcMs;
+		let earliestAt = Date.parse(earliest);
+		for (const action of job.actions) {
+			const at = Date.parse(action.timestampUtcMs);
+			if (at < earliestAt) {
+				earliest = action.timestampUtcMs;
+				earliestAt = at;
+			}
+		}
 		const revisions = await stores.operationStore.getRevisions(job.documentId, job.branch, signal);
-		if (earliest >= revisions.latestTimestamp) return { actions: job.actions };
+		const backdated = earliestAt < Date.parse(revisions.latestTimestamp);
+		if (this.featureFlags.authEnforcement && job.scope === "auth") {
+			const newest = await stores.operationStore.getStreamLatestTimestamp(job.documentId, "auth", job.branch, signal);
+			const violation = this.firstNonMonotonicTimestamp(job.actions, newest, job.documentId, job.branch);
+			if (violation) return {
+				writes: [],
+				evaluatedByPosition: false,
+				error: violation
+			};
+			if (!backdated) return plain();
+			return this.evaluatePositioned(job, stores, this.appendedOperations(job, revisions.revision[job.scope] ?? 0), signal);
+		}
+		if (!backdated) return plain();
 		const conflicting = (await stores.operationStore.getConflicting(job.documentId, job.scope, job.branch, earliest, void 0, signal)).results.filter((operation) => !isGenesisOperation(operation));
-		if (conflicting.length === 0) return { actions: job.actions };
+		if (conflicting.length === 0) {
+			if (!this.featureFlags.authEnforcement) return plain();
+			return this.evaluatePositioned(job, stores, this.appendedOperations(job, revisions.revision[job.scope] ?? 0), signal);
+		}
 		const nextIndex = revisions.revision[job.scope] ?? 0;
 		let firstConflicting = conflicting[0].index;
 		for (const operation of conflicting) if (operation.index < firstConflicting) firstConflicting = operation.index;
@@ -2782,12 +3084,105 @@ var SimpleJobExecutor = class {
 			skip: retractionSkip(nextIndex, firstConflicting)
 		}, conflicting, incoming);
 		stores.writeCache.invalidate(job.documentId, job.scope, job.branch);
+		if (!this.featureFlags.authEnforcement) return {
+			writes: merged.map((operation) => ({
+				action: operation.action,
+				skip: operation.skip,
+				sourceRemote: ""
+			})),
+			evaluatedByPosition: false
+		};
+		return this.evaluatePositioned(job, stores, merged, signal);
+	}
+	/**
+	* Decides each operation where it lands and carries the verdict on it. A
+	* refused submitted action is reported to the caller and nothing is stored; a
+	* refused operation the reshuffle merely moved keeps its verdict, because it
+	* already holds a position.
+	*
+	* The operations carry the indexes and skips they will be stored at, because
+	* the walk resolves skips before it orders them.
+	*/
+	async evaluatePositioned(job, stores, operations, signal) {
+		const reasons = await evaluateByPosition(this.decisionModel, {
+			documentId: job.documentId,
+			branch: job.branch
+		}, {
+			scope: job.scope,
+			operations
+		}, stores, signal);
+		const submitted = new Set(job.actions.map((action) => action.id));
+		for (let i = 0; i < operations.length; i++) {
+			const reason = reasons[i];
+			if (reason !== void 0 && submitted.has(operations[i].action.id)) return {
+				writes: [],
+				evaluatedByPosition: false,
+				error: refusalError(reason, job.documentId, null, operations[i].action)
+			};
+		}
 		return {
-			actions: merged.map((operation) => operation.action),
-			skipValues: merged.map((operation) => operation.skip)
+			writes: operations.map((operation, i) => ({
+				action: operation.action,
+				skip: operation.skip,
+				sourceRemote: "",
+				deniedReason: reasons[i]
+			})),
+			evaluatedByPosition: true
 		};
 	}
 	/**
+	* The scopes a re-evaluation pass visits, in a fixed order.
+	*
+	* The revisions map comes from a query with no ORDER BY, and the order is
+	* load-bearing: each scope's pass re-reads the auth stream, and the walk skips
+	* an operation by its stored denial, so a denial this pass just wrote is
+	* visible to a later-visited scope and invisible to an earlier one. The model's
+	* own projection order leads, then the rest sorted, so the pass is reproducible
+	* across replicas and across runs.
+	*/
+	evaluationOrder(target, revision) {
+		const definition = this.decisionModel(target);
+		const evaluated = Object.keys(revision).filter((scope) => definition.evaluatesScope(scope));
+		const leading = [];
+		for (const stream of staticReadSet(definition)) {
+			const scope = stream.query.scope;
+			if (evaluated.includes(scope) && !leading.includes(scope)) leading.push(scope);
+		}
+		const rest = evaluated.filter((scope) => !leading.includes(scope)).sort((a, b) => a.localeCompare(b));
+		return [...leading, ...rest];
+	}
+	/**
+	* The first timestamp in the batch that does not strictly exceed everything
+	* ahead of it, or undefined when the whole batch is monotonic.
+	*
+	* The bound is carried forward rather than compared against one stored maximum,
+	* because a single execute can carry several auth actions stamped in the same
+	* millisecond. Letting a tie through would store a stream the position walk
+	* then refuses to read, with no repair path.
+	*/
+	firstNonMonotonicTimestamp(entries, newest, documentId, branch) {
+		let boundIso = newest;
+		let bound = newest === void 0 ? Number.NEGATIVE_INFINITY : Date.parse(newest);
+		for (const entry of entries) {
+			if (!isValidISOTimestamp(entry.timestampUtcMs)) return new InvalidOperationTimestampError(documentId, "auth", entry.timestampUtcMs, "auth operation");
+			const at = Date.parse(entry.timestampUtcMs);
+			if (boundIso !== void 0 && at <= bound) return new AuthTimestampNotMonotonicError(documentId, branch, entry.timestampUtcMs, boundIso);
+			bound = at;
+			boundIso = entry.timestampUtcMs;
+		}
+	}
+	/** The operations a batch of submitted actions appends at the scope's tail. */
+	appendedOperations(job, nextIndex) {
+		return job.actions.map((action, i) => ({
+			id: action.id,
+			index: nextIndex + i,
+			skip: 0,
+			hash: "",
+			timestampUtcMs: action.timestampUtcMs,
+			action
+		}));
+	}
+	/**
 	* Re-evaluates the document when a write meets both criteria: it was written
 	* to a stream the model reads, and it is timestamped before an operation
 	* already stored. The caller supplies the timestamp and the reactor does not replace
@@ -2797,10 +3192,11 @@ var SimpleJobExecutor = class {
 	async reevaluateIfCriteriaMet(criteria, executing) {
 		if (!this.featureFlags.documentDecisions) return;
 		const { job, stores, signal } = executing;
-		if (!staticReadSet(documentDecisionModel({
+		const target = {
 			documentId: job.documentId,
 			branch: job.branch
-		})).some((stream) => stream.query.documentId === job.documentId && stream.query.scope === criteria.scope && stream.query.branch === job.branch)) return;
+		};
+		if (!staticReadSet(this.decisionModel(target)).some((stream) => stream.query.documentId === job.documentId && stream.query.scope === criteria.scope && stream.query.branch === job.branch)) return;
 		const revisions = await stores.operationStore.getRevisions(job.documentId, job.branch, signal);
 		const latest = Date.parse(revisions.latestTimestamp);
 		if (!criteria.operations.some((operation) => Date.parse(operation.timestampUtcMs) < latest)) return;
@@ -2813,20 +3209,16 @@ var SimpleJobExecutor = class {
 	*/
 	async reevaluateDocument(executing) {
 		const { job, stores, signal } = executing;
-		const definition = documentDecisionModel({
+		const target = {
 			documentId: job.documentId,
 			branch: job.branch
-		});
+		};
 		const revisions = await stores.operationStore.getRevisions(job.documentId, job.branch, signal);
-		for (const scope of Object.keys(revisions.revision)) {
-			if (!definition.evaluatesScope(scope)) continue;
+		for (const scope of this.evaluationOrder(target, revisions.revision)) {
 			const stored = (await stores.operationStore.getSince(job.documentId, scope, job.branch, -1, void 0, void 0, signal)).results;
 			const effective = garbageCollect(sortOperations([...stored]));
 			if (effective.length === 0) continue;
-			const reevaluated = await evaluateDeletionsByPosition({
-				documentId: job.documentId,
-				branch: job.branch
-			}, {
+			const reevaluated = await evaluateByPosition(this.decisionModel, target, {
 				scope,
 				operations: effective
 			}, stores, signal);
@@ -2846,7 +3238,8 @@ var SimpleJobExecutor = class {
 					...job,
 					scope
 				},
-				replayingAcceptedHistory: true
+				replayingAcceptedHistory: true,
+				evaluatedByPosition: true
 			});
 			if (!result.success) return result.error ?? /* @__PURE__ */ new Error(`Re-evaluation of ${job.documentId} ${scope} failed`);
 		}
@@ -2860,6 +3253,7 @@ var SimpleJobExecutor = class {
 		} catch {}
 		if (docMeta?.state.isDeleted && !this.featureFlags.documentDecisions) return buildErrorResult(job, new DocumentDeletedError(job.documentId, docMeta.state.deletedAtUtcIso), startTime);
 		const scope = job.scope;
+		const monotonicAuthStream = this.featureFlags.authEnforcement && scope === "auth";
 		let latestRevision;
 		try {
 			latestRevision = (await stores.operationStore.getRevisions(job.documentId, job.branch, signal)).revision[scope] ?? 0;
@@ -2869,7 +3263,7 @@ var SimpleJobExecutor = class {
 		for (const operation of job.operations) if (operation.timestampUtcMs && !isValidISOTimestamp(operation.timestampUtcMs)) return {
 			job,
 			success: false,
-			error: /* @__PURE__ */ new Error(`Invalid timestamp "${operation.timestampUtcMs}" on operation (index: ${operation.index})`),
+			error: new InvalidOperationTimestampError(job.documentId, scope, operation.timestampUtcMs, `operation (index: ${operation.index})`),
 			duration: Date.now() - startTime
 		};
 		let minIncomingIndex = Number.POSITIVE_INFINITY;
@@ -2877,7 +3271,7 @@ var SimpleJobExecutor = class {
 		for (const operation of job.operations) {
 			minIncomingIndex = Math.min(minIncomingIndex, operation.index);
 			const ts = operation.timestampUtcMs || "";
-			if (ts < minIncomingTimestamp) minIncomingTimestamp = ts;
+			if (Date.parse(ts) < Date.parse(minIncomingTimestamp)) minIncomingTimestamp = ts;
 		}
 		let conflictingOps;
 		try {
@@ -2902,11 +3296,14 @@ var SimpleJobExecutor = class {
 			}
 			return true;
 		});
-		const existingOpsToReshuffle = nonSupersededOps.filter((operation) => !isGenesisOperation(operation));
-		if (existingOpsToReshuffle.length > this.config.maxSkipThreshold) return {
+		const existingOpsToReshuffle = monotonicAuthStream ? [] : nonSupersededOps.filter((operation) => !isGenesisOperation(operation));
+		const actionIdCounts = /* @__PURE__ */ new Map();
+		for (const operation of allOpsFromMinConflictingIndex) actionIdCounts.set(operation.action.id, (actionIdCounts.get(operation.action.id) ?? 0) + 1);
+		const reshuffleCost = existingOpsToReshuffle.filter((operation) => (actionIdCounts.get(operation.action.id) ?? 0) < 2).length;
+		if (reshuffleCost > this.config.maxSkipThreshold) return {
 			job,
 			success: false,
-			error: /* @__PURE__ */ new Error(`Excessive reshuffle detected: existing op count of ${existingOpsToReshuffle.length} exceeds threshold of ${this.config.maxSkipThreshold}. This indicates a significant divergence between local and incoming operations.`),
+			error: new ExcessiveReshuffleError(job.documentId, scope, reshuffleCost, this.config.maxSkipThreshold),
 			duration: Date.now() - startTime
 		};
 		let skipCount = existingOpsToReshuffle.length;
@@ -2934,6 +3331,16 @@ var SimpleJobExecutor = class {
 			operationsWithContext: [],
 			duration: Date.now() - startTime
 		};
+		if (monotonicAuthStream) {
+			const newest = await stores.operationStore.getStreamLatestTimestamp(job.documentId, "auth", job.branch, signal);
+			const violation = this.firstNonMonotonicTimestamp([...incomingOpsToApply].sort((a, b) => a.index - b.index), newest, job.documentId, job.branch);
+			if (violation) return {
+				job,
+				success: false,
+				error: violation,
+				duration: Date.now() - startTime
+			};
+		}
 		const reshuffledOperations = existingOpsToReshuffle.length === 0 && skipCount === 0 ? incomingOpsToApply.slice().sort((a, b) => a.index - b.index).map((operation, i) => ({
 			...operation,
 			index: latestRevision + i
@@ -2947,7 +3354,7 @@ var SimpleJobExecutor = class {
 		for (const operation of reshuffledOperations) if (operation.action.type === "NOOP") operation.skip = 1;
 		let deniedReasons;
 		if (this.featureFlags.documentDecisions) try {
-			deniedReasons = await evaluateDeletionsByPosition({
+			deniedReasons = await evaluateByPosition(this.decisionModel, {
 				documentId: job.documentId,
 				branch: job.branch
 			}, {
@@ -3500,6 +3907,10 @@ var KyselyOperationStore = class KyselyOperationStore {
 			latestTimestamp: latest?.latestTimestamp ? new Date(latest.latestTimestamp).toISOString() : (/* @__PURE__ */ new Date(0)).toISOString()
 		};
 	}
+	async getStreamLatestTimestamp(documentId, scope, branch, signal) {
+		const latest = await this.queryExecutor.selectFrom("Operation").select((eb) => eb.fn.max("timestampUtcMs").as("latestTimestamp")).where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).executeTakeFirst();
+		return latest?.latestTimestamp ? new Date(latest.latestTimestamp).toISOString() : void 0;
+	}
 	rowToOperation(row) {
 		return {
 			index: row.index,
@@ -3593,8 +4004,8 @@ function createForwardingPoolInstrumentation(name) {
 }
 //#endregion
 //#region src/storage/migrations/001_create_operation_table.ts
-var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$14 });
-async function up$14(db) {
+var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$15 });
+async function up$15(db) {
 	await db.schema.createTable("Operation").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("jobId", "text", (col) => col.notNull()).addColumn("opId", "text", (col) => col.notNull()).addColumn("prevOpId", "text", (col) => col.notNull()).addColumn("writeTimestampUtcMs", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("timestampUtcMs", "timestamptz", (col) => col.notNull()).addColumn("index", "integer", (col) => col.notNull()).addColumn("action", "jsonb", (col) => col.notNull()).addColumn("skip", "integer", (col) => col.notNull()).addColumn("error", "text").addColumn("hash", "text", (col) => col.notNull()).addUniqueConstraint("unique_revision", [
 		"documentId",
 		"scope",
@@ -3619,8 +4030,8 @@ async function up$14(db) {
 }
 //#endregion
 //#region src/storage/migrations/002_create_keyframe_table.ts
-var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
-async function up$13(db) {
+var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$14 });
+async function up$14(db) {
 	await db.schema.createTable("Keyframe").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("revision", "integer", (col) => col.notNull()).addColumn("document", "jsonb", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_keyframe", [
 		"documentId",
 		"scope",
@@ -3636,14 +4047,14 @@ async function up$13(db) {
 }
 //#endregion
 //#region src/storage/migrations/003_create_document_table.ts
-var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$12 });
-async function up$12(db) {
+var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
+async function up$13(db) {
 	await db.schema.createTable("Document").addColumn("id", "text", (col) => col.primaryKey()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/004_create_document_relationship_table.ts
-var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$11 });
-async function up$11(db) {
+var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$12 });
+async function up$12(db) {
 	await db.schema.createTable("DocumentRelationship").addColumn("id", "text", (col) => col.primaryKey()).addColumn("sourceId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("targetId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("relationshipType", "text", (col) => col.notNull()).addColumn("metadata", "jsonb").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_source_target_type", [
 		"sourceId",
 		"targetId",
@@ -3655,14 +4066,14 @@ async function up$11(db) {
 }
 //#endregion
 //#region src/storage/migrations/005_create_indexer_state_table.ts
-var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$10 });
-async function up$10(db) {
+var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$11 });
+async function up$11(db) {
 	await db.schema.createTable("IndexerState").addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity()).addColumn("lastOperationId", "integer", (col) => col.notNull()).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/006_create_document_snapshot_table.ts
-var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$9 });
-async function up$9(db) {
+var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$10 });
+async function up$10(db) {
 	await db.schema.createTable("DocumentSnapshot").addColumn("id", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("slug", "text").addColumn("name", "text").addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("content", "jsonb", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("lastOperationIndex", "integer", (col) => col.notNull()).addColumn("lastOperationHash", "text", (col) => col.notNull()).addColumn("lastUpdatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("snapshotVersion", "integer", (col) => col.notNull().defaultTo(1)).addColumn("identifiers", "jsonb").addColumn("metadata", "jsonb").addColumn("isDeleted", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("deletedAt", "timestamptz").addUniqueConstraint("unique_doc_scope_branch", [
 		"documentId",
 		"scope",
@@ -3683,8 +4094,8 @@ async function up$9(db) {
 }
 //#endregion
 //#region src/storage/migrations/007_create_slug_mapping_table.ts
-var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$8 });
-async function up$8(db) {
+var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$9 });
+async function up$9(db) {
 	await db.schema.createTable("SlugMapping").addColumn("slug", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_docid_scope_branch", [
 		"documentId",
 		"scope",
@@ -3694,14 +4105,14 @@ async function up$8(db) {
 }
 //#endregion
 //#region src/storage/migrations/008_create_view_state_table.ts
-var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$7 });
-async function up$7(db) {
+var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$8 });
+async function up$8(db) {
 	await db.schema.createTable("ViewState").addColumn("readModelId", "text", (col) => col.primaryKey()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(0)).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/009_create_operation_index_tables.ts
-var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$6 });
-async function up$6(db) {
+var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$7 });
+async function up$7(db) {
 	await db.schema.createTable("document_collections").addColumn("documentId", "text", (col) => col.notNull()).addColumn("collectionId", "text", (col) => col.notNull()).addColumn("joinedOrdinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("leftOrdinal", "bigint").addPrimaryKeyConstraint("document_collections_pkey", ["documentId", "collectionId"]).execute();
 	await db.schema.createIndex("idx_document_collections_collectionId").on("document_collections").column("collectionId").execute();
 	await db.schema.createIndex("idx_doc_collections_collection_range").on("document_collections").columns(["collectionId", "joinedOrdinal"]).execute();
@@ -3715,8 +4126,8 @@ async function up$6(db) {
 }
 //#endregion
 //#region src/storage/migrations/010_create_sync_tables.ts
-var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$5 });
-async function up$5(db) {
+var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$6 });
+async function up$6(db) {
 	await db.schema.createTable("sync_remotes").addColumn("name", "text", (col) => col.primaryKey()).addColumn("collection_id", "text", (col) => col.notNull()).addColumn("channel_type", "text", (col) => col.notNull()).addColumn("channel_id", "text", (col) => col.notNull().defaultTo("")).addColumn("remote_name", "text", (col) => col.notNull().defaultTo("")).addColumn("channel_parameters", "jsonb", (col) => col.notNull().defaultTo(sql`'{}'::jsonb`)).addColumn("filter_document_ids", "jsonb").addColumn("filter_scopes", "jsonb").addColumn("filter_branch", "text", (col) => col.notNull().defaultTo("main")).addColumn("push_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("push_last_success_utc_ms", "text").addColumn("push_last_failure_utc_ms", "text").addColumn("push_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("pull_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("pull_last_success_utc_ms", "text").addColumn("pull_last_failure_utc_ms", "text").addColumn("pull_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 	await db.schema.createIndex("idx_sync_remotes_collection").on("sync_remotes").column("collection_id").execute();
 	await db.schema.createTable("sync_cursors").addColumn("remote_name", "text", (col) => col.primaryKey().references("sync_remotes.name").onDelete("cascade")).addColumn("cursor_ordinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("last_synced_at_utc_ms", "text").addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
@@ -3724,8 +4135,8 @@ async function up$5(db) {
 }
 //#endregion
 //#region src/storage/migrations/011_add_cursor_type_column.ts
-var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$4 });
-async function up$4(db) {
+var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$5 });
+async function up$5(db) {
 	await db.deleteFrom("sync_cursors").where("remote_name", "like", "outbox::%").execute();
 	await db.deleteFrom("sync_remotes").where("name", "like", "outbox::%").execute();
 	await db.schema.dropTable("sync_cursors").execute();
@@ -3734,43 +4145,60 @@ async function up$4(db) {
 }
 //#endregion
 //#region src/storage/migrations/012_add_source_remote_column.ts
-var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$3 });
-async function up$3(db) {
+var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$4 });
+async function up$4(db) {
 	await db.schema.alterTable("operation_index_operations").addColumn("sourceRemote", "text", (col) => col.notNull().defaultTo("")).execute();
 }
 //#endregion
 //#region src/storage/migrations/013_create_sync_dead_letters_table.ts
-var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$2 });
-async function up$2(db) {
+var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$3 });
+async function up$3(db) {
 	await db.schema.createTable("sync_dead_letters").addColumn("ordinal", "serial", (col) => col.primaryKey()).addColumn("id", "text", (col) => col.unique().notNull()).addColumn("job_id", "text", (col) => col.notNull()).addColumn("job_dependencies", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("remote_name", "text", (col) => col.notNull().references("sync_remotes.name").onDelete("cascade")).addColumn("document_id", "text", (col) => col.notNull()).addColumn("scopes", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("branch", "text", (col) => col.notNull()).addColumn("operations", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("error_source", "text", (col) => col.notNull()).addColumn("error_message", "text", (col) => col.notNull()).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 	await db.schema.createIndex("idx_sync_dead_letters_remote").on("sync_dead_letters").column("remote_name").execute();
 }
 //#endregion
 //#region src/storage/migrations/014_create_processor_cursor_table.ts
-var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$1 });
-async function up$1(db) {
+var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$2 });
+async function up$2(db) {
 	await db.schema.createTable("ProcessorCursor").addColumn("processorId", "text", (col) => col.primaryKey()).addColumn("factoryId", "text", (col) => col.notNull()).addColumn("driveId", "text", (col) => col.notNull()).addColumn("processorIndex", "integer", (col) => col.notNull()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(sql`0`)).addColumn("status", "text", (col) => col.notNull().defaultTo(sql`'active'`)).addColumn("lastError", "text").addColumn("lastErrorTimestamp", "timestamptz").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/015_add_operation_denied_reason.ts
 var _015_add_operation_denied_reason_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$1,
+	up: () => up$1
 });
 /**
 * Records why authorization refused an operation. Separate from `error` so a
 * denial is distinguishable from a reducer failure without matching on a
 * message. Null for every operation written before decisions were enforced.
 */
-async function up(db) {
+async function up$1(db) {
 	await db.schema.alterTable("Operation").addColumn("deniedReason", "text").execute();
 	await db.schema.alterTable("operation_index_operations").addColumn("deniedReason", "text").execute();
 }
-async function down(db) {
+async function down$1(db) {
 	await db.schema.alterTable("operation_index_operations").dropColumn("deniedReason").execute();
 	await db.schema.alterTable("Operation").dropColumn("deniedReason").execute();
 }
 //#endregion
+//#region src/storage/migrations/016_add_dead_letter_error_type.ts
+var _016_add_dead_letter_error_type_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* The classification a dead letter falls into, stored because it decides whether
+* the document stays quarantined and the in-memory error is gone after a restart.
+* Defaulted rather than nullable, so a pre-existing row rehydrates.
+*/
+async function up(db) {
+	await db.schema.alterTable("sync_dead_letters").addColumn("error_type", "text", (col) => col.notNull().defaultTo("UNCLASSIFIED")).execute();
+}
+async function down(db) {
+	await db.schema.alterTable("sync_dead_letters").dropColumn("error_type").execute();
+}
+//#endregion
 //#region src/storage/migrations/migrator.ts
 const REACTOR_SCHEMA = "reactor";
 const migrations = {
@@ -3788,7 +4216,8 @@ const migrations = {
 	"012_add_source_remote_column": _012_add_source_remote_column_exports,
 	"013_create_sync_dead_letters_table": _013_create_sync_dead_letters_table_exports,
 	"014_create_processor_cursor_table": _014_create_processor_cursor_table_exports,
-	"015_add_operation_denied_reason": _015_add_operation_denied_reason_exports
+	"015_add_operation_denied_reason": _015_add_operation_denied_reason_exports,
+	"016_add_dead_letter_error_type": _016_add_dead_letter_error_type_exports
 };
 var ProgrammaticMigrationProvider = class {
 	getMigrations() {
@@ -3842,6 +4271,6 @@ async function getMigrationStatus(db, schema = REACTOR_SCHEMA) {
 //#region src/core/drive-container-types.ts
 const DEFAULT_DRIVE_CONTAINER_TYPES = new Set(["powerhouse/document-drive", "powerhouse/reactor-drive"]);
 //#endregion
-export { AuthorizationDeniedError as A, DuplicateOperationError as C, DuplicateModuleError as D, DuplicateManifestError as E, throwIfAborted as F, __exportAll as I, DocumentNotFoundError as M, matchesScope as N, InvalidModuleError as O, parsePagingOptions as P, AppendConditionFailedError as S, RevisionMismatchError as T, DocumentMetaCache as _, createForwardingPoolInstrumentation as a, CollectionMembershipCache as b, KyselyKeyframeStore as c, DriveCollectionId as d, buildDecisionModel as f, KyselyOperationIndex as g, KyselyWriteCache as h, runMigrations as i, DocumentDeletedError as j, ModuleNotFoundError as k, DocumentModelRegistry as l, EventBus as m, REACTOR_SCHEMA as n, instrumentPgPool as o, KyselyExecutionScope as p, getMigrationStatus as r, KyselyOperationStore as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, SimpleJobExecutor as u, createConsistencyToken as v, OptimisticLockError as w, APPEND_CONDITION_FAILED_PREFIX as x, createEmptyConsistencyToken as y };
+export { OptimisticLockError as A, ExcessiveReshuffleError as B, DocumentMetaCache as C, APPEND_CONDITION_FAILED_PREFIX as D, CollectionMembershipCache as E, ModuleNotFoundError as F, __exportAll as G, matchesScope as H, AuthTimestampNotMonotonicError as I, AuthorizationDeniedError as L, DuplicateManifestError as M, DuplicateModuleError as N, AppendConditionFailedError as O, InvalidModuleError as P, DocumentDeletedError as R, KyselyOperationIndex as S, createEmptyConsistencyToken as T, parsePagingOptions as U, InvalidOperationTimestampError as V, throwIfAborted as W, KyselyExecutionScope as _, createForwardingPoolInstrumentation as a, EventBus as b, KyselyKeyframeStore as c, DriveCollectionId as d, decideAtHead as f, authDecisionModel as g, buildDecisionModel as h, runMigrations as i, RevisionMismatchError as j, DuplicateOperationError as k, DocumentModelRegistry as l, documentDecisionModel as m, REACTOR_SCHEMA as n, instrumentPgPool as o, selectDecisionModel as p, getMigrationStatus as r, KyselyOperationStore as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, SimpleJobExecutor as u, FLAG_PREREQUISITES as v, createConsistencyToken as w, KyselyWriteCache as x, validateFeatureFlags as y, DocumentNotFoundError as z };
 
-//# sourceMappingURL=drive-container-types-ZSLCC3lC.js.map
+//# sourceMappingURL=drive-container-types-BJCKXJwH.js.map