@powerhousedao/reactor 6.2.2-dev.4 → 6.2.2-dev.41

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { Action, CreateDocumentActionInput, DocumentModelModule, ISigner, Operation, OperationContext, OperationWithContext, OperationWithContext as OperationWithContext$1, PHDocument, PHDocumentState, SignatureVerificationHandler, UpgradeDocumentActionInput, UpgradeManifest, UpgradeReducer, UpgradeTransition, actions as documentActions } from "@powerhousedao/shared/document-model";
+import { Action, AuthRequest, AuthSubject, CreateDocumentActionInput, DocumentModelModule, ISigner, Operation, OperationContext, OperationWithContext, OperationWithContext as OperationWithContext$1, PHAuthState, PHDocument, PHDocumentState, SignatureVerificationHandler, UpgradeDocumentActionInput, UpgradeManifest, UpgradeReducer, UpgradeTransition, actions as documentActions } from "@powerhousedao/shared/document-model";
 import { DocumentDriveDocument, DriveInput, FolderNode, Node } from "@powerhousedao/shared/document-drive";
 import { ILogger } from "document-model";
 import * as kysely from "kysely";
@@ -69,6 +69,17 @@ declare enum JobQueueState {
   RUNNING = 3,
   RESOLVED = 4
 }
+/**
+ * How a retry is accounted against the job's retry limit.
+ * - `CountAgainstLimit` (default): a fault; the job eventually exhausts its
+ *   retries and fails terminally.
+ * - `ExemptFromLimit`: not a fault, so the attempt is not charged to the job.
+ *   Used for concurrency conflicts, where the retry does new work.
+ */
+declare enum RetryAccounting {
+  CountAgainstLimit = "count-against-limit",
+  ExemptFromLimit = "exempt-from-limit"
+}
 /**
  * Interface for a job execution handle
  */
@@ -127,9 +138,14 @@ type JobAvailableEvent = {
 //#endregion
 //#region src/shared/types.d.ts
 /**
- * Information about an error including message and stack trace.
+ * Information about an error including its name, message and stack trace.
+ *
+ * The name is what survives the crossing out of the executor: a consumer that
+ * has to tell a terminal failure from a retryable one, or classify a dead
+ * letter, only ever sees this record rather than the thrown error.
  */
 type ErrorInfo$1 = {
+  name: string;
   message: string;
   stack: string;
 };
@@ -230,6 +246,11 @@ type ViewFilter = {
   branch?: string;
   scopes?: string[];
   revision?: number;
+  /**
+   * Read subject for the IReactorClient read gate; defaults to the client's
+   * signer. Set per request when serving many principals. Ignored by IReactor.
+   */
+  subject?: AuthSubject;
 };
 /**
  * Describes filter options for searching documents.
@@ -328,6 +349,16 @@ interface IReadModelCoordinator {
    */
   getChainDepth(): number;
 }
+type ReadModelRegistrationStage = "pre_ready" | "post_ready";
+/**
+ * Optional capability exposed by coordinators that support adding read models
+ * after construction. Custom and remote coordinators are not required to
+ * implement it.
+ */
+interface ILiveReadModelCoordinator extends IReadModelCoordinator {
+  addReadModel(readModel: IReadModel, stage: ReadModelRegistrationStage): void;
+}
+declare function supportsLiveReadModelRegistration(coordinator: IReadModelCoordinator): coordinator is ILiveReadModelCoordinator;
 //#endregion
 //#region src/sync/types.d.ts
 declare enum ChannelScheme {
@@ -398,7 +429,13 @@ declare enum ChannelErrorSource {
   Inbox = "inbox",
   Outbox = "outbox"
 }
-type SyncOperationErrorType = "SIGNATURE_INVALID" | "HASH_MISMATCH" | "LIBRARY_ERROR" | "MISSING_OPERATIONS" | "EXCESSIVE_SHUFFLE" | "GRACEFUL_ABORT";
+type SyncOperationErrorType = "SIGNATURE_INVALID" | "HASH_MISMATCH" | "LIBRARY_ERROR" | "MISSING_OPERATIONS" | "EXCESSIVE_SHUFFLE" | "GRACEFUL_ABORT"
+/**
+ * An arriving auth operation did not exceed the local auth head. Exempt from
+ * quarantine, because reconciling the two policies needs the traffic a
+ * quarantine would stop.
+ */
+| "AUTH_TIMESTAMP_NOT_MONOTONIC" /** An arriving operation carried a timestamp that is not an ISO-8601 instant. */ | "INVALID_TIMESTAMP" /** No classification applies, including rows written before the field. */ | "UNCLASSIFIED";
 type ChannelHealth = {
   state: "idle" | "running" | "error";
   lastSuccessUtcMs?: number;
@@ -491,6 +528,7 @@ type DeadLetterAddedEvent = {
   remoteName: string;
   documentId: string;
   errorSource: ChannelErrorSource;
+  errorType: SyncOperationErrorType;
 };
 /**
  * Status of a sync operation result.
@@ -537,6 +575,36 @@ declare class OptimisticLockError extends Error {
 declare class RevisionMismatchError extends Error {
   constructor(expected: number, actual: number);
 }
+/**
+ * One read-set stream and the highest operation index observed on it, or -1
+ * if it was observed empty.
+ */
+type AppendConditionStream = {
+  documentId: string;
+  scope: string;
+  branch: string;
+  revision: number;
+};
+/**
+ * A read-set enforced by {@link IOperationStore.apply}: the append fails if
+ * any stream has operations past its recorded revision.
+ */
+type AppendCondition = {
+  streams: AppendConditionStream[];
+};
+/** Error history keeps messages, not classes, so failures match by prefix. */
+declare const APPEND_CONDITION_FAILED_PREFIX = "Append condition failed: ";
+/**
+ * A read-set stream grew before the append committed. A concurrency
+ * conflict, not a fault: the caller retries against the new stream heads.
+ */
+declare class AppendConditionFailedError extends Error {
+  readonly condition: AppendCondition;
+  constructor(condition: AppendCondition);
+  static isError(error: unknown): error is AppendConditionFailedError;
+  /** True when a recorded error message is an append-condition failure. */
+  static isFailureMessage(message: string): boolean;
+}
 /**
  * A write transaction passed to {@link IOperationStore.apply}. Accumulates
  * operations that are committed atomically when the callback returns.
@@ -550,7 +618,7 @@ interface AtomicTxn {
  * revision field and lastModified timestamp.
  */
 type DocumentRevisions = {
-  /** Map of scope to operation index for that scope */revision: Record<string, number>; /** Latest timestamp across revisions */
+  /** Map of scope to operation index for that scope */revision: Record<string, number>; /** The largest operation timestamp in the document, across every scope. */
   latestTimestamp: string;
 };
 /**
@@ -571,6 +639,12 @@ interface IOperationStore {
    * returned instead of throwing. If no matching stored row is found, the
    * original error is propagated unchanged.
    *
+   * With an {@link AppendCondition}, the append additionally fails with
+   * {@link AppendConditionFailedError} — writing nothing — if any read-set
+   * stream has operations past its recorded revision. The written and
+   * read-set streams are advisory-locked in sorted key order, so concurrent
+   * conditional appends on overlapping streams serialize.
+   *
    * @param documentId - The document id
    * @param documentType - The document type identifier
    * @param scope - The operation scope (e.g. "global", "local")
@@ -578,9 +652,10 @@ interface IOperationStore {
    * @param revision - Expected current revision (optimistic lock)
    * @param fn - Callback that stages operations via {@link AtomicTxn}
    * @param signal - Optional abort signal to cancel the request
+   * @param condition - Optional read-set to enforce at write time
    * @returns The stored operations; empty array when no operations were staged
    */
-  apply(documentId: string, documentType: string, scope: string, branch: string, revision: number, fn: (txn: AtomicTxn) => void | Promise<void>, signal?: AbortSignal): Promise<Operation[]>;
+  apply(documentId: string, documentType: string, scope: string, branch: string, revision: number, fn: (txn: AtomicTxn) => void | Promise<void>, signal?: AbortSignal, condition?: AppendCondition): Promise<Operation[]>;
   /**
    * Returns operations for a document/scope/branch whose index is greater
    * than the given revision.
@@ -627,6 +702,16 @@ interface IOperationStore {
    * @returns Object containing revision map and latest timestamp
    */
   getRevisions(documentId: string, branch: string, signal?: AbortSignal): Promise<DocumentRevisions>;
+  /**
+   * The largest operation timestamp in one stream, or undefined when it is empty.
+   * Distinct from {@link DocumentRevisions.latestTimestamp}, which maxes over
+   * every scope.
+   *
+   * Must be a real maximum, not the last-indexed operation's timestamp: a
+   * re-evaluation pass re-appends at a fresh index while keeping the original
+   * timestamp, so a later timestamp can sit behind the last row.
+   */
+  getStreamLatestTimestamp(documentId: string, scope: string, branch: string, signal?: AbortSignal): Promise<string | undefined>;
 }
 /**
  * Stores periodic document snapshots (keyframes) so that document state
@@ -1045,7 +1130,8 @@ type DeadLetterRecord = {
   branch: string;
   operations: OperationWithContext$1[];
   errorSource: ChannelErrorSource;
-  errorMessage: string;
+  errorMessage: string; /** Why it failed, in the closed set sync classifies failures into. */
+  errorType: SyncOperationErrorType;
 };
 /**
  * Persists dead-lettered sync operations so they survive reactor restarts.
@@ -1152,6 +1238,51 @@ declare class DriveCollectionId {
   equals(other: DriveCollectionId): boolean;
 }
 //#endregion
+//#region src/cache/write-cache-types.d.ts
+/**
+ * Configuration options for the write cache
+ */
+type WriteCacheConfig = {
+  /** Maximum number of document streams to cache (LRU eviction). Default: 1000 */maxDocuments: number; /** Number of snapshots to keep in each document's ring buffer. Default: 10 */
+  ringBufferSize: number; /** Persist a keyframe snapshot every N revisions. Default: 10 */
+  keyframeInterval: number;
+};
+/**
+ * Unique identifier for a document stream
+ */
+type DocumentStreamKey = {
+  /** Document identifier */documentId: string; /** Operation scope */
+  scope: string; /** Branch name */
+  branch: string;
+};
+/**
+ * Where a snapshot sits in its stream.
+ *
+ * - `Head`: the newest revision of the stream when it was stored. Only these
+ *   can answer a read that asks for the head.
+ * - `Historical`: state at an earlier revision. Usable as a starting point to
+ *   replay forward from, and as an answer to a read for that same revision.
+ */
+declare enum SnapshotPosition {
+  Head = "head",
+  Historical = "historical"
+}
+/**
+ * A cached document snapshot at a specific revision
+ */
+type CachedSnapshot = {
+  /** The revision number of this snapshot */revision: number; /** The document state at this revision */
+  document: PHDocument; /** Where this snapshot sat in the stream when it was stored */
+  position: SnapshotPosition;
+};
+/**
+ * Serialized keyframe snapshot for K/V store persistence
+ */
+type KeyframeSnapshot = {
+  /** The revision number of this keyframe */revision: number; /** Serialized document state */
+  document: string;
+};
+//#endregion
 //#region src/cache/write/interfaces.d.ts
 /**
  * IWriteCache is a write-side projection that optimizes document state retrieval
@@ -1166,7 +1297,8 @@ interface IWriteCache {
    * @param documentId - The document identifier
    * @param scope - Operation scope
    * @param branch - Branch name
-   * @param targetRevision - The exact revision to retrieve (optional, defaults to latest)
+   * @param targetRevision - Index of the last operation to apply, defaulting
+   *   to latest. An operation index, never `header.revision[scope]`.
    * @param signal - Optional abort signal to cancel the operation
    * @returns The complete document at the specified revision
    *
@@ -1192,15 +1324,19 @@ interface IWriteCache {
    * @param documentId - The document identifier
    * @param scope - Operation scope
    * @param branch - Branch name
-   * @param revision - The revision this document represents
+   * @param revision - Index of the last operation this document reflects, so
+   *   `header.revision[scope]` is one greater. -1 for an empty scope.
    * @param document - The document to cache
+   * @param position - Whether `revision` is the stream's head. Nothing checks
+   *   it: claiming `Head` for an earlier revision makes a getState() with no
+   *   target return stale state.
    *
    * @example
    * ```typescript
-   * cache.putState(docId, 'global', 'main', 42, document);
+   * cache.putState(docId, 'global', 'main', 42, document, SnapshotPosition.Head);
    * ```
    */
-  putState(documentId: string, scope: string, branch: string, revision: number, document: PHDocument): void;
+  putState(documentId: string, scope: string, branch: string, revision: number, document: PHDocument, position: SnapshotPosition): void;
   /**
    * Invalidates (removes) cached entries for a document stream.
    *
@@ -1646,7 +1782,7 @@ interface IReactorClient {
    * @param signal - Optional abort signal to cancel the request
    * @returns The canonical document id
    */
-  resolveIdOrSlug(identifier: string, signal?: AbortSignal): Promise<string>;
+  resolveIdOrSlug(identifier: string, view?: ViewFilter, signal?: AbortSignal): Promise<string>;
   /**
    * Retrieves operations for a document.
    *
@@ -1884,6 +2020,7 @@ declare class ReactorClient implements IReactorClient {
   private documentView;
   readonly drives: IDriveClient;
   constructor(logger: ILogger, reactor: IReactor, signer: ISigner, subscriptionManager: IReactorSubscriptionManager, jobAwaiter: IJobAwaiter, documentIndexer: IDocumentIndexer, documentView: IDocumentView);
+  private readSubject;
   /**
    * Retrieves a list of document model modules.
    */
@@ -1904,7 +2041,7 @@ declare class ReactorClient implements IReactorClient {
    * same lookup as the data path. Resolves against the "main" branch. Throws if
    * the identifier cannot be resolved or is ambiguous.
    */
-  resolveIdOrSlug(identifier: string, signal?: AbortSignal): Promise<string>;
+  resolveIdOrSlug(identifier: string, view?: ViewFilter, signal?: AbortSignal): Promise<string>;
   /**
    * Retrieves operations for a document
    */
@@ -1995,244 +2132,400 @@ declare class ReactorClient implements IReactorClient {
   private removeAllIncomingRelationships;
 }
 //#endregion
-//#region src/executor/types.d.ts
+//#region src/cache/collection-membership-cache.d.ts
+interface ICollectionMembershipCache {
+  getCollectionsForDocuments(documentIds: string[]): Promise<Record<string, string[]>>;
+  invalidate(documentId: string): void;
+}
+//#endregion
+//#region src/cache/document-meta-cache-types.d.ts
 /**
- * Represents the result of a job execution
+ * Cached document metadata from the "document" scope.
+ *
+ * This lightweight structure holds essential document information needed by
+ * the job executor without fetching full scope state. It provides an explicit
+ * cross-scope contract for accessing document scope metadata.
  */
-type JobResult = {
-  /** The job that was executed */job: Job; /** Whether the job executed successfully */
-  success: boolean; /** Error if the job failed */
-  error?: Error; /** The operations generated from the actions (if successful) */
-  operations?: Operation[];
+type CachedDocumentMeta = {
   /**
-   * Operations with context (includes ephemeral resultingState).
-   * Used for emitting to IDocumentView via event bus.
+   * The full PHDocumentState from document.state.document.
+   * Contains version, hash, isDeleted, deletedAtUtcIso, etc.
    */
-  operationsWithContext?: OperationWithContext$1[]; /** Timestamp when the job execution completed */
-  completedAt?: string; /** Duration of job execution in milliseconds */
-  duration?: number; /** Any additional metadata from the execution */
-  metadata?: Record<string, any>;
-};
-/**
- * Configuration options for the job executor
- */
-type JobExecutorConfig = {
-  /** Maximum number of conflicting operations to skip when reshuffling. */maxSkipThreshold?: number; /** Maximum number of concurrent jobs to execute */
-  maxConcurrency?: number; /** Maximum time in milliseconds a job can run before being considered timed out */
-  jobTimeoutMs?: number; /** Base delay in milliseconds for exponential backoff retries */
-  retryBaseDelayMs?: number; /** Maximum delay in milliseconds for exponential backoff retries */
-  retryMaxDelayMs?: number;
-  /** Maximum elapsed milliseconds before yielding to the main thread between actions.
-   *  Keeps the UI responsive when processing large batches. */
-  yieldDeadlineMs?: number;
-};
-/**
- * Event types for the job executor
- */
-declare const JobExecutorEventTypes: {
-  readonly JOB_STARTED: 20000;
-  readonly JOB_COMPLETED: 20001;
-  readonly JOB_FAILED: 20002;
-  readonly EXECUTOR_STARTED: 20003;
-  readonly EXECUTOR_STOPPED: 20004;
-};
-/**
- * Event data for job execution events
- */
-type JobStartedEvent = {
-  job: Job;
-  startedAt: string;
+  state: PHDocumentState;
   /**
-   * Identifier of the executor that took the job. For the worker pool this is
-   * the thread-worker id (e.g. "reactor-worker-3"); for the in-process simple
-   * manager it is "in-process-<index>". Optional for backwards compatibility
-   * with consumers built before the field was added.
+   * The document type (from header), cached for convenience.
    */
-  workerId?: string;
-};
-type JobCompletedEvent = {
-  job: Job;
-  result: JobResult; /** See {@link JobStartedEvent.workerId}. */
-  workerId?: string;
-};
-type JobFailedEvent = {
-  job: Job;
-  error: string;
-  willRetry: boolean;
-  retryCount: number; /** See {@link JobStartedEvent.workerId}. */
-  workerId?: string;
-};
-type ExecutorStartedEvent = {
-  config: JobExecutorConfig;
-  startedAt: string;
-};
-type ExecutorStoppedEvent = {
-  stoppedAt: string;
-  graceful: boolean;
-};
-/**
- * Status information for the job executor manager
- */
-type ExecutorManagerStatus = {
-  /** Whether the manager is currently running */isRunning: boolean; /** Number of executor instances managed */
-  numExecutors: number; /** Number of jobs currently being processed */
-  activeJobs: number; /** Total number of jobs processed since start */
-  totalJobsProcessed: number;
-};
-//#endregion
-//#region src/executor/worker/protocol.d.ts
-/**
- * A JSON-clonable value safe to send across the worker IPC boundary.
- *
- * The shape mirrors the structured-clone subset used by the parent's
- * sanitizer: primitives, arrays, plain objects, plus the explicit
- * {@link ErrorInfo} shape for marshalled Errors.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
- */
-type SanitizedArg = null | boolean | number | string | ErrorInfo | SanitizedArg[] | {
-  [key: string]: SanitizedArg;
-};
-/**
- * Structured representation of an Error for IPC transport.
- *
- * Class instances cannot be structured-cloned across worker boundaries,
- * so Errors are flattened into this shape on the worker side and
- * reconstructed on the parent side.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
- */
-type ErrorInfo = {
-  name: string;
-  message: string;
-  stack?: string;
-  cause?: ErrorInfo;
-};
-/**
- * Reference to a module that the worker should `import()` at runtime,
- * along with the named export to pluck out as the factory.
- *
- * Exactly one of `packageName` or `filePath` is provided.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
- */
-type ModuleRef = {
-  /** Bare-specifier package name (resolved by the worker's module loader). */packageName: string; /** Named export within the module to invoke as the factory. */
-  exportName: string;
-} | {
-  /** Absolute or worker-resolvable file path to import. */filePath: string; /** Named export within the module to invoke as the factory. */
-  exportName: string;
-};
-/**
- * Factory specification shared by the signature verifier and document
- * model spec channels. The worker imports `module.exportName` and invokes
- * it with `initArgs` to obtain the actual instance.
- *
- * `initArgs` must be JSON-clonable.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
- */
-type FactorySpec = {
-  module: ModuleRef;
-  initArgs?: SanitizedArg;
+  documentType: string;
+  /**
+   * The revision of the document scope when this metadata was captured.
+   * Used for cache invalidation and consistency checks.
+   */
+  documentScopeRevision: number;
 };
 /**
- * Factory spec for the signature verifier the worker should instantiate.
- *
- * Structurally identical to {@link FactorySpec}; the alias exists so call
- * sites read intent-fully.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
- */
-type SignatureVerifierSpec = FactorySpec;
-/**
- * Factory spec for a document model module the worker should instantiate.
- *
- * Structurally identical to {@link FactorySpec}; the alias exists so call
- * sites read intent-fully.
+ * Interface for the document metadata cache.
  *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
- */
-type DocumentModelSpec = FactorySpec;
-/**
- * One entry in the document model manifest the worker materializes on
- * startup (or extends lazily via `load-model`).
+ * This cache provides an explicit cross-scope contract for accessing document
+ * scope metadata. It solves the problem where job execution in one scope (e.g.,
+ * "global") needs access to document scope state (version, isDeleted, etc.)
+ * which may be stale in scope-specific caches or keyframes.
  *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * The cache supports:
+ * - Latest metadata retrieval with LRU caching
+ * - Historical metadata reconstruction for reshuffling scenarios
+ * - Eager updates after document scope operations
  */
-type ModelManifestEntry = {
-  /** Document type identifier (e.g. "ph/account"). */documentType: string; /** Document model version this entry registers. */
-  version: string; /** Factory spec the worker imports and invokes to obtain the model. */
-  spec: DocumentModelSpec;
-};
-/**
- * JSON-clonable Postgres connection info passed to the worker so it can
- * open its own pool. Storage-specific wiring may extend this shape in
- * later phases.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
- */
-type DbConfig = {
-  host: string;
-  port: number;
-  database: string;
-  user: string;
-  password: string;
-  ssl?: boolean;
-  applicationName?: string;
-  poolSize?: number;
+interface IDocumentMetaCache {
   /**
-   * Maximum time (ms) a caller will wait to acquire a connection from the
-   * pool before pg.Pool throws. When omitted, pg defaults to 0 (unlimited
-   * wait), which hides acquire-starvation as silent latency.
+   * Retrieves the LATEST document metadata from cache or rebuilds from operations.
+   *
+   * On cache miss, fetches all document scope operations and reconstructs the
+   * current PHDocumentState by applying UPGRADE_DOCUMENT and DELETE_DOCUMENT
+   * operations.
+   *
+   * @param documentId - The document identifier
+   * @param branch - Branch name
+   * @param signal - Optional abort signal to cancel the operation
+   * @returns The cached or rebuilt document metadata
+   * @throws {Error} "Operation aborted" if signal is aborted
+   * @throws {Error} If document not found (no CREATE_DOCUMENT operation)
    */
-  connectionTimeoutMillis?: number;
+  getDocumentMeta(documentId: string, branch: string, signal?: AbortSignal): Promise<CachedDocumentMeta>;
   /**
-   * How long (ms) an idle connection stays open before pg closes it. When
-   * omitted, pg defaults to 10000.
+   * Rebuilds document metadata at a SPECIFIC revision (always rebuilds, no caching).
+   *
+   * Used during reshuffling when operations need to be inserted at a previous
+   * revision and we need the document scope state as of that point in time.
+   *
+   * @param documentId - The document identifier
+   * @param branch - Branch name
+   * @param targetRevision - The document scope revision to reconstruct up to
+   * @param signal - Optional abort signal to cancel the operation
+   * @returns Document metadata as of the target revision
+   * @throws {Error} "Operation aborted" if signal is aborted
+   * @throws {Error} If document not found
    */
-  idleTimeoutMillis?: number;
-};
+  rebuildAtRevision(documentId: string, branch: string, targetRevision: number, signal?: AbortSignal): Promise<CachedDocumentMeta>;
+  /**
+   * Eagerly updates cached metadata after document scope operations.
+   *
+   * Called by the job executor after CREATE_DOCUMENT, UPGRADE_DOCUMENT, or
+   * DELETE_DOCUMENT operations to keep the cache current.
+   *
+   * @param documentId - The document identifier
+   * @param branch - Branch name
+   * @param meta - The new metadata to cache
+   */
+  putDocumentMeta(documentId: string, branch: string, meta: CachedDocumentMeta): void;
+  /**
+   * Invalidates cached document metadata.
+   *
+   * Call before reshuffling operations that modify the document scope, or
+   * when document state may have changed externally.
+   *
+   * @param documentId - The document identifier
+   * @param branch - Optional branch to narrow invalidation (if omitted, all branches)
+   * @returns Number of entries invalidated
+   */
+  invalidate(documentId: string, branch?: string): number;
+  /**
+   * Clears all cached document metadata.
+   */
+  clear(): void;
+  /**
+   * Performs startup initialization.
+   */
+  startup(): Promise<void>;
+  /**
+   * Performs graceful shutdown.
+   */
+  shutdown(): Promise<void>;
+}
+//#endregion
+//#region src/storage/kysely/types.d.ts
+interface OperationTable {
+  id: Generated<number>;
+  jobId: string;
+  opId: string;
+  prevOpId: string;
+  writeTimestampUtcMs: Generated<Date>;
+  documentId: string;
+  documentType: string;
+  scope: string;
+  branch: string;
+  timestampUtcMs: Date;
+  index: number;
+  action: unknown;
+  skip: number;
+  error?: string | null;
+  deniedReason?: string | null;
+  hash: string;
+}
+interface KeyframeTable {
+  id: Generated<number>;
+  documentId: string;
+  documentType: string;
+  scope: string;
+  branch: string;
+  revision: number;
+  document: unknown;
+  createdAt: Generated<Date>;
+}
+interface DocumentCollectionTable {
+  documentId: string;
+  collectionId: string;
+  joinedOrdinal: bigint;
+  leftOrdinal: bigint | null;
+}
+interface OperationIndexOperationTable {
+  ordinal: Generated<number>;
+  opId: string;
+  documentId: string;
+  documentType: string;
+  scope: string;
+  branch: string;
+  timestampUtcMs: string;
+  writeTimestampUtcMs: Generated<Date>;
+  index: number;
+  skip: number;
+  hash: string;
+  action: unknown;
+  deniedReason?: string | null;
+  sourceRemote: Generated<string>;
+}
+interface SyncRemoteTable {
+  name: string;
+  collection_id: string;
+  channel_type: string;
+  channel_id: string;
+  remote_name: string;
+  channel_parameters: unknown;
+  filter_document_ids: unknown;
+  filter_scopes: unknown;
+  filter_branch: string;
+  push_state: string;
+  push_last_success_utc_ms: string | null;
+  push_last_failure_utc_ms: string | null;
+  push_failure_count: number;
+  pull_state: string;
+  pull_last_success_utc_ms: string | null;
+  pull_last_failure_utc_ms: string | null;
+  pull_failure_count: number;
+  created_at: Generated<Date>;
+  updated_at: Generated<Date>;
+}
+interface SyncCursorTable {
+  remote_name: string;
+  cursor_type: string;
+  cursor_ordinal: bigint;
+  last_synced_at_utc_ms: string | null;
+  updated_at: Generated<Date>;
+}
 /**
- * Configuration for the executor worker pool.
+ * Kysely table definition for the `sync_dead_letters` table.
+ */
+interface SyncDeadLetterTable {
+  ordinal: Generated<number>;
+  id: string;
+  job_id: string;
+  job_dependencies: unknown;
+  remote_name: string;
+  document_id: string;
+  scopes: unknown;
+  branch: string;
+  operations: unknown;
+  error_source: string;
+  error_message: string;
+  error_type: Generated<string>;
+  created_at: Generated<Date>;
+}
+interface Database$1 {
+  Operation: OperationTable;
+  Keyframe: KeyframeTable;
+  document_collections: DocumentCollectionTable;
+  operation_index_operations: OperationIndexOperationTable;
+  sync_remotes: SyncRemoteTable;
+  sync_cursors: SyncCursorTable;
+  sync_dead_letters: SyncDeadLetterTable;
+}
+interface DocumentTable {
+  id: string;
+  createdAt: Generated<Date>;
+  updatedAt: Generated<Date>;
+}
+interface DocumentRelationshipTable {
+  id: Generated<string>;
+  sourceId: string;
+  targetId: string;
+  relationshipType: string;
+  metadata: unknown;
+  createdAt: Generated<Date>;
+  updatedAt: Generated<Date>;
+}
+interface IndexerStateTable {
+  id: Generated<number>;
+  lastOperationId: number;
+  lastOperationTimestamp: Generated<Date>;
+}
+interface DocumentIndexerDatabase {
+  Document: DocumentTable;
+  DocumentRelationship: DocumentRelationshipTable;
+  IndexerState: IndexerStateTable;
+}
+//#endregion
+//#region src/executor/worker/protocol.d.ts
+/**
+ * A JSON-clonable value safe to send across the worker IPC boundary.
  *
- * Mirrors the `workerPool` sub-config on {@link JobExecutorConfig};
- * a later card wires this into the executor config.
+ * The shape mirrors the structured-clone subset used by the parent's
+ * sanitizer: primitives, arrays, plain objects, plus the explicit
+ * {@link ErrorInfo} shape for marshalled Errors.
  *
  * @see Wire Protocol Reference wiki page
  *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
  */
-type WorkerPoolConfig = {
-  /** Whether the worker pool is active; when false the executor runs in-process. */enabled: boolean; /** Number of worker instances to spawn. */
-  numWorkers: number; /** Worker isolation mode. */
-  workerType: "thread" | "process"; /** Optional heartbeat interval in milliseconds. */
-  heartbeatMs?: number; /** Optional per-worker Postgres pool size override. */
-  workerPgPoolSize?: number;
+type SanitizedArg = null | boolean | number | string | ErrorInfo | SanitizedArg[] | {
+  [key: string]: SanitizedArg;
 };
 /**
- * Payload the worker reports back when a job's write phase is complete.
+ * Structured representation of an Error for IPC transport.
  *
- * Parent fills `collectionMemberships` at emission time, so it is
- * intentionally absent from the worker -> parent message.
+ * Class instances cannot be structured-cloned across worker boundaries,
+ * so Errors are flattened into this shape on the worker side and
+ * reconstructed on the parent side.
  *
  * @see Wire Protocol Reference wiki page
  *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
  */
-type JobWriteReadyPayload = {
-  operations: OperationWithContext$1[];
-  jobMeta: JobMeta;
+type ErrorInfo = {
+  name: string;
+  message: string;
+  stack?: string;
+  cause?: ErrorInfo;
 };
 /**
- * Initializes a freshly spawned worker with the configuration and
- * factories it needs to start executing jobs.
+ * Reference to a module that the worker should `import()` at runtime,
+ * along with the named export to pluck out as the factory.
+ *
+ * Exactly one of `packageName` or `filePath` is provided.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type ModuleRef = {
+  /** Bare-specifier package name (resolved by the worker's module loader). */packageName: string; /** Named export within the module to invoke as the factory. */
+  exportName: string;
+} | {
+  /** Absolute or worker-resolvable file path to import. */filePath: string; /** Named export within the module to invoke as the factory. */
+  exportName: string;
+};
+/**
+ * Factory specification shared by the signature verifier and document
+ * model spec channels. The worker imports `module.exportName` and invokes
+ * it with `initArgs` to obtain the actual instance.
+ *
+ * `initArgs` must be JSON-clonable.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type FactorySpec = {
+  module: ModuleRef;
+  initArgs?: SanitizedArg;
+};
+/**
+ * Factory spec for the signature verifier the worker should instantiate.
+ *
+ * Structurally identical to {@link FactorySpec}; the alias exists so call
+ * sites read intent-fully.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type SignatureVerifierSpec = FactorySpec;
+/**
+ * Factory spec for a document model module the worker should instantiate.
+ *
+ * Structurally identical to {@link FactorySpec}; the alias exists so call
+ * sites read intent-fully.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type DocumentModelSpec = FactorySpec;
+/**
+ * One entry in the document model manifest the worker materializes on
+ * startup (or extends lazily via `load-model`).
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type ModelManifestEntry = {
+  /** Document type identifier (e.g. "ph/account"). */documentType: string; /** Document model version this entry registers. */
+  version: string; /** Factory spec the worker imports and invokes to obtain the model. */
+  spec: DocumentModelSpec;
+};
+/**
+ * JSON-clonable Postgres connection info passed to the worker so it can
+ * open its own pool. Storage-specific wiring may extend this shape in
+ * later phases.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type DbConfig = {
+  host: string;
+  port: number;
+  database: string;
+  user: string;
+  password: string;
+  ssl?: boolean;
+  applicationName?: string;
+  poolSize?: number;
+  /**
+   * Maximum time (ms) a caller will wait to acquire a connection from the
+   * pool before pg.Pool throws. When omitted, pg defaults to 0 (unlimited
+   * wait), which hides acquire-starvation as silent latency.
+   */
+  connectionTimeoutMillis?: number;
+  /**
+   * How long (ms) an idle connection stays open before pg closes it. When
+   * omitted, pg defaults to 10000.
+   */
+  idleTimeoutMillis?: number;
+};
+/**
+ * Configuration for the executor worker pool.
+ *
+ * Mirrors the `workerPool` sub-config on {@link JobExecutorConfig};
+ * a later card wires this into the executor config.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type WorkerPoolConfig = {
+  /** Whether the worker pool is active; when false the executor runs in-process. */enabled: boolean; /** Number of worker instances to spawn. */
+  numWorkers: number; /** Worker isolation mode. */
+  workerType: "thread" | "process"; /** Optional heartbeat interval in milliseconds. */
+  heartbeatMs?: number; /** Optional per-worker Postgres pool size override. */
+  workerPgPoolSize?: number;
+};
+/**
+ * Payload the worker reports back when a job's write phase is complete.
+ *
+ * Parent fills `collectionMemberships` at emission time, so it is
+ * intentionally absent from the worker -> parent message.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type JobWriteReadyPayload = {
+  operations: OperationWithContext$1[];
+  jobMeta: JobMeta;
+};
+/**
+ * Initializes a freshly spawned worker with the configuration and
+ * factories it needs to start executing jobs.
  *
  * @see Wire Protocol Reference wiki page
  *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
@@ -2244,7 +2537,8 @@ type InitMessage = {
   poolConfig: WorkerPoolConfig;
   db: DbConfig; /** Omitted = the worker performs no executor-side signature verification. */
   signatureVerifier?: SignatureVerifierSpec;
-  models: ModelManifestEntry[];
+  models: ModelManifestEntry[]; /** Omitted = the worker builds its executor with the built-in defaults. */
+  executorConfig?: JobExecutorConfig;
 };
 /**
  * Dispatches a job to the worker for execution.
@@ -2425,504 +2719,873 @@ type PoolAcquireSamplesMessage = {
  */
 type WorkerMessage = ReadyMessage | ResultMessage | ModelLoadedMessage | ModelLoadFailedMessage | LogMessage | HeartbeatMessage | MetricsMessage | PoolAcquireSamplesMessage;
 //#endregion
-//#region src/executor/interfaces.d.ts
+//#region src/core/model-sources.d.ts
+/** An importable file holding one or more document-model exports. */
+type FileModelSource = {
+  filePath: string;
+  exportName?: string;
+};
+/** An importable package specifier holding one or more document-model exports. */
+type PackageModelSource = {
+  packageName: string;
+  subpath?: string;
+  exportName?: string;
+};
 /**
- * Snapshot of the single in-flight slot maintained by an {@link IExecutorWorker}.
+ * A source of document models: a live module, an importable file, or an
+ * importable package. File and package sources can cross a worker-thread
+ * boundary (workers re-import them); a live module cannot.
  */
-type WorkerInFlightSnapshot = {
-  correlationId: string;
-  jobId: string;
+type DocumentModelSource = DocumentModelModule<any> | FileModelSource | PackageModelSource;
+//#endregion
+//#region src/registry/interfaces.d.ts
+type RegistrationResult<T> = {
+  status: "success";
+  item: T;
+} | {
+  status: "error";
+  item: T;
+  error: Error;
 };
 /**
- * Outcome of a worker-side job execution.
+ * Loader that asynchronously resolves a document type to a
+ * {@link DocumentModelSource}. Used by the queue to gate CREATE_DOCUMENT
+ * jobs until the required model is available in the registry.
  *
- * `result` mirrors the in-process `JobResult` exactly. `writeReady` carries
- * the operations + jobMeta the parent needs to emit `JOB_WRITE_READY`, and is
- * present only when the worker produced operations. It is absent on failure
- * and on success-with-no-operations.
+ * Return an importable source ({ filePath } or { packageName }) whenever
+ * possible: the resolver registers the resolved models on the host registry
+ * and broadcasts importable sources to executor workers. A live
+ * DocumentModelModule is also valid but host-only — it cannot cross a
+ * worker-thread boundary, so worker pools will not receive it.
  */
-type WorkerExecutionOutcome = {
-  result: JobResult;
-  writeReady?: JobWriteReadyPayload;
-};
+interface IDocumentModelLoader {
+  load(documentType: string): Promise<DocumentModelSource>;
+}
 /**
- * Parent-side handle for a single executor worker.
- *
- * Implementations wrap an IPC transport (worker_threads, child_process, or a
- * test fake) and expose a transport-agnostic surface that the worker-pool
- * manager uses to dispatch jobs. The handle owns one worker's lifecycle
- * (`start` -> `execute`* -> `shutdown`) and bounds its in-flight map to a
- * single entry; `SimpleJobExecutor` is single-threaded inside the worker, so
- * concurrent dispatches would race its caches.
+ * Registry for managing document model modules.
+ * Provides centralized access to document models' reducers, utils, and specifications.
+ * Supports version-aware module storage and upgrade manifest management.
  */
-interface IExecutorWorker {
-  /** Stable identifier of the worker (mirrors `InitMessage.workerId`). */
-  readonly workerId: string;
-  /** Zero-based index within the pool, used for sticky routing. */
-  readonly index: number;
+interface IDocumentModelRegistry {
   /**
-   * Spawn the worker (if not already started), send the `init` payload and
-   * resolve when the worker replies with `ready`.
+   * Register multiple modules at once.
+   * Modules without a version field default to version 1.
+   * Invalid or duplicate modules are skipped without breaking registration of the remaining modules.
+   *
+   * @param modules Document model modules to register
+   * @returns Array of results, one per module, indicating success or failure
    */
-  start(): Promise<void>;
+  registerModules(...modules: DocumentModelModule<any>[]): RegistrationResult<DocumentModelModule<any>>[];
   /**
-   * Dispatch a job to the worker and resolve with its outcome — the
-   * `JobResult` and, on success-with-operations, a `writeReady` payload
-   * the parent will enrich and re-emit. Rejects with a transport-level
-   * error if the worker exits, aborts, or times out before producing a
-   * result.
+   * Unregister all versions of the specified document types.
+   *
+   * @param documentTypes The document types to unregister
+   * @returns true if all modules were unregistered, false if any were not found
    */
-  execute(job: Job, signal?: AbortSignal): Promise<WorkerExecutionOutcome>;
+  unregisterModules(...documentTypes: string[]): boolean;
   /**
-   * Request cancellation of the in-flight job (if any). The handle posts an
-   * `abort` message; if the worker fails to reply within its grace window it
-   * is force-terminated.
+   * Get a specific document model module by document type and optional version.
+   * If version is not specified, returns the latest version.
+   *
+   * @param documentType The document type identifier
+   * @param version Optional version number to retrieve
+   * @returns The document model module
+   * @throws ModuleNotFoundError if the document type or version is not registered
    */
-  abort(correlationId: string, reason?: string): void;
+  getModule(documentType: string, version?: number): DocumentModelModule<any>;
   /**
-   * Stop the worker. When `graceful` is true the handle waits for the
-   * in-flight job to settle (up to `graceMs`) before terminating; otherwise
-   * the worker is terminated immediately.
+   * Get all registered document model modules.
+   *
+   * @returns Array of all registered modules
    */
-  shutdown(graceful: boolean, graceMs?: number): Promise<void>;
+  getAllModules(): DocumentModelModule<any>[];
   /**
-   * Register an additional document model on the running worker. Resolves
-   * when the worker replies with `model-loaded`; rejects when it replies
-   * with `model-load-failed` or the worker exits before answering.
+   * Clear all registered modules and upgrade manifests.
    */
-  loadModel(entry: ModelManifestEntry, signal?: AbortSignal): Promise<void>;
-  /** True when no job is currently in flight. */
-  isIdle(): boolean;
-  /** Snapshot of the in-flight slot, or null when idle. */
-  getInFlight(): WorkerInFlightSnapshot | null;
-}
-/**
- * Simple interface for executing a job.
- * A JobExecutor simply takes a job and executes it - nothing more.
- */
-interface IJobExecutor {
+  clear(): void;
   /**
-   * Execute a single job.
-   * @param job - The job to execute
-   * @returns Promise that resolves to the job result
+   * Get all supported versions for a document type, sorted in ascending order.
+   *
+   * @param documentType The document type identifier
+   * @returns Array of version numbers sorted ascending
+   * @throws ModuleNotFoundError if no modules are registered for the document type
    */
-  executeJob(job: Job, signal?: AbortSignal): Promise<JobResult>;
-}
-/**
- * Interface for managing multiple job executors.
- * Listens for 'jobAvailable' events from the event bus, pulls jobs from the queue,
- * and coordinates the distribution of jobs across multiple executor instances.
- */
-interface IJobExecutorManager {
+  getSupportedVersions(documentType: string): number[];
   /**
-   * Start the executor manager.
-   * Begins listening for 'jobAvailable' events and dispatching to executors.
+   * Get the latest (highest) version number for a document type.
    *
-   * @param numExecutors - Number of executor instances to create
-   * @returns Promise that resolves when the manager is started
+   * @param documentType The document type identifier
+   * @returns The highest version number registered for this document type
+   * @throws ModuleNotFoundError if no modules are registered for the document type
    */
-  start(numExecutors: number): Promise<void>;
+  getLatestVersion(documentType: string): number;
   /**
-   * Stop the executor manager.
+   * Register upgrade manifests that define upgrade paths between versions.
+   * Invalid or duplicate manifests are skipped without breaking registration of the remaining manifests.
    *
-   * @param graceful - Whether to wait for current jobs to complete
-   * @returns Promise that resolves when the manager is stopped
+   * @param manifests Upgrade manifests to register
+   * @returns Array of results, one per manifest, indicating success or failure
    */
-  stop(graceful?: boolean): Promise<void>;
+  registerUpgradeManifests(...manifests: UpgradeManifest<readonly number[]>[]): RegistrationResult<UpgradeManifest<readonly number[]>>[];
   /**
-   * Get all managed executor instances.
+   * Unregister upgrade manifests for the specified document types.
+   * @param documentTypes The document types whose upgrade manifests should be unregistered
+   * @returns true if all modules were unregistered, false if any were not found
+   **/
+  unregisterUpgradeManifests(...documentTypes: string[]): boolean;
+  /**
+   * Get the upgrade manifest for a document type.
    *
-   * @returns Array of executor instances
+   * @param documentType The document type identifier
+   * @returns The upgrade manifest
+   * @throws ManifestNotFoundError if no manifest is registered for the document type
    */
-  getExecutors(): IJobExecutor[];
+  getUpgradeManifest(documentType: string): UpgradeManifest<readonly number[]>;
   /**
-   * Get the current status of the manager.
+   * Compute the upgrade path from one version to another.
+   * Returns the sequence of upgrade transitions needed.
    *
-   * @returns The current manager status
+   * @param documentType The document type identifier
+   * @param fromVersion The starting version
+   * @param toVersion The target version
+   * @returns Array of upgrade transitions in order
+   * @throws DowngradeNotSupportedError if toVersion is less than fromVersion
+   * @throws ManifestNotFoundError if no upgrade manifest is registered
+   * @throws MissingUpgradeTransitionError if any transition in the path is missing
    */
-  getStatus(): ExecutorManagerStatus;
+  computeUpgradePath(documentType: string, fromVersion: number, toVersion: number): UpgradeTransition[];
+  /**
+   * Get the upgrade reducer for a single-step version transition.
+   *
+   * @param documentType The document type identifier
+   * @param fromVersion The starting version
+   * @param toVersion The target version (must be fromVersion + 1)
+   * @returns The upgrade reducer function
+   * @throws InvalidUpgradeStepError if toVersion is not fromVersion + 1
+   * @throws ManifestNotFoundError if no upgrade manifest is registered
+   * @throws MissingUpgradeTransitionError if the transition is not found
+   */
+  getUpgradeReducer(documentType: string, fromVersion: number, toVersion: number): UpgradeReducer<any, any>;
 }
 //#endregion
-//#region src/job-tracker/interfaces.d.ts
+//#region src/cache/buffer/ring-buffer.d.ts
 /**
- * Interface for tracking job lifecycle status.
- * Maintains job state throughout execution: PENDING → RUNNING → COMPLETED/FAILED.
+ * RingBuffer is a generic circular buffer implementation that stores a fixed number
+ * of items. When the buffer is full, new items overwrite the oldest items.
+ *
+ * This implementation maintains O(1) time complexity for push operations and provides
+ * items in chronological order (oldest to newest) via getAll().
+ *
+ * @template T - The type of items stored in the buffer
  */
-interface IJobTracker {
-  /**
-   * Register a new job with PENDING status.
-   *
-   * @param jobInfo - The job information to register
-   */
-  registerJob(jobInfo: JobInfo): void;
+declare class RingBuffer<T> {
+  private buffer;
+  private head;
+  private size;
+  private capacity;
+  constructor(capacity: number);
   /**
-   * Update a job's status to RUNNING.
+   * Adds an item to the buffer. If the buffer is full, overwrites the oldest item.
    *
-   * @param jobId - The job ID to mark as running
+   * @param item - The item to add
    */
-  markRunning(jobId: string): void;
+  push(item: T): void;
   /**
-   * Mark a job as failed.
+   * Returns all items in the buffer in chronological order (oldest to newest).
    *
-   * @param jobId - The job ID to mark as failed
-   * @param error - Error information including message and stack trace
-   * @param job - Optional full job object for debugging purposes
+   * @returns Array of items in insertion order
    */
-  markFailed(jobId: string, error: ErrorInfo$1, job?: Job): void;
+  getAll(): T[];
   /**
-   * Retrieve the current status of a job.
-   *
-   * @param jobId - The job ID to query
-   * @returns The job information, or null if the job is not found
+   * Clears all items from the buffer.
    */
-  getJobStatus(jobId: string): JobInfo | null;
+  clear(): void;
   /**
-   * Shutdown the job tracker and clean up resources.
-   * Unsubscribes from all event bus subscriptions.
+   * Gets the current number of items in the buffer.
    */
-  shutdown(): void;
+  get length(): number;
 }
 //#endregion
-//#region src/queue/interfaces.d.ts
+//#region src/cache/kysely-write-cache.d.ts
+type DocumentStream = {
+  key: string;
+  ringBuffer: RingBuffer<CachedSnapshot>;
+};
 /**
- * Interface for a job queue that manages write operations.
- * Internally organizes jobs by documentId, scope, and branch to ensure proper ordering.
- * Emits events to the event bus when new jobs are available for consumption.
+ * In-memory write cache with keyframe persistence for PHDocuments.
+ *
+ * Caches document snapshots in ring buffers with LRU eviction. On cache miss,
+ * rebuilds documents from nearest keyframe or full operation history.
+ *
+ * **Performance Characteristics:**
+ * - Cache hit: O(1) lookup in ring buffer
+ * - Cold miss: O(n) where n is total operation count, or O(k) where k is operations since keyframe
+ * - Warm miss: O(m) where m is operations since cached revision
+ * - Eviction: O(1) for LRU tracking and removal
+ *
+ * **Thread Safety:**
+ * Not thread-safe. Designed for single-threaded job executor environment.
+ * External synchronization required for concurrent access across multiple executors.
+ *
+ * **Example:**
+ * ```typescript
+ * const cache = new KyselyWriteCache(
+ *   keyframeStore,
+ *   operationStore,
+ *   registry,
+ *   { maxDocuments: 1000, ringBufferSize: 10, keyframeInterval: 10 }
+ * );
+ *
+ * await cache.startup();
+ *
+ * // Retrieve or rebuild document
+ * const doc = await cache.getState(docId, docType, scope, branch, revision);
+ *
+ * // Cache result after job execution
+ * cache.putState(docId, docType, scope, branch, newRevision, updatedDoc);
+ *
+ * await cache.shutdown();
+ * ```
  */
-interface IQueue {
+declare class KyselyWriteCache implements IWriteCache {
+  private streams;
+  private lruTracker;
+  private keyframeStore;
+  private operationStore;
+  private registry;
+  private config;
+  constructor(keyframeStore: IKeyframeStore, operationStore: IOperationStore, registry: IDocumentModelRegistry, config: WriteCacheConfig);
+  withScopedStores(operationStore: IOperationStore, keyframeStore: IKeyframeStore): KyselyWriteCache;
   /**
-   * Add a new job to the queue.
-   * Jobs are automatically organized by documentId, scope, and branch internally.
-   * Emits a 'jobAvailable' event to the event bus when the job is queued.
-   * @param job - The job to add to the queue
-   * @returns Promise that resolves when the job is queued
+   * Initializes the write cache.
+   * Currently a no-op as keyframe store lifecycle is managed externally.
    */
-  enqueue(job: Job): Promise<void>;
+  startup(): Promise<void>;
   /**
-   * Get the next job to execute for a specific document/scope/branch combination.
-   * @param documentId - The document ID to get jobs for
-   * @param scope - The scope to get jobs for
-   * @param branch - The branch to get jobs for
-   * @param signal - Optional abort signal to cancel the request
-   * @returns Promise that resolves to the next job execution handle or null if no jobs available
+   * Shuts down the write cache.
+   * Currently a no-op as keyframe store lifecycle is managed externally.
    */
-  dequeue(documentId: string, scope: string, branch: string, signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
+  shutdown(): Promise<void>;
   /**
-   * Get the next available job from any queue.
-   * @param signal - Optional abort signal to cancel the request
-   * @returns Promise that resolves to the next job execution handle or null if no jobs available
+   * Retrieves document state at a specific revision from cache or rebuilds it.
+   *
+   * Note: this returns a _shallow_ copy of the document.
+   *
+   * Cache hit path: Returns cached snapshot if available (O(1))
+   * Warm miss path: Rebuilds from cached base revision + incremental ops
+   * Cold miss path: Rebuilds from keyframe or from scratch using all operations
+   *
+   * @param documentId - The document identifier
+   * @param scope - The operation scope
+   * @param branch - The operation branch
+   * @param targetRevision - The target revision, or undefined for newest
+   * @param signal - Optional abort signal to cancel the operation
+   * @returns The document at the target revision
+   * @throws {Error} "Operation aborted" if signal is aborted
+   * @throws {ModuleNotFoundError} If document type not registered in registry
+   * @throws {Error} "Failed to rebuild document" if operation store fails
+   * @throws {Error} If reducer throws during operation application
+   * @throws {Error} If document serialization fails
    */
-  dequeueNext(signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
+  getState(documentId: string, scope: string, branch: string, targetRevision?: number, signal?: AbortSignal): Promise<PHDocument>;
   /**
-   * Get the next available job whose routing metadata satisfies the predicate.
-   * Walks ready sub-queue heads in queue insertion order, skips heads whose document
-   * is currently executing (same isDocumentExecuting gate as dequeueNext), and returns
-   * the first head for which predicate returns true.
-   * Returns null when paused, when nothing matches, or when the queue is empty.
-   * Rejects if signal is already aborted.
-   * @param predicate - Filter applied to JobRoutingMeta of each candidate head
-   * @param signal - Optional abort signal to cancel the request
-   * @returns Promise that resolves to the first matching job execution handle or null
+   * Stores a document snapshot in the cache at a specific revision.
+   *
+   * The cached document is a shallow copy of the input with its operation history
+   * truncated to the last operation per scope and its clipboard cleared. This keeps
+   * memory use and copy costs constant regardless of operation count. Consumers of
+   * getState() must not rely on the full operation history being present; the only
+   * guaranteed invariant is that operations[scope].at(-1) reflects the latest
+   * operation index for each scope.
+   *
+   * Updates LRU tracker and may evict least recently used stream if at capacity.
+   * Asynchronously persists keyframes at configured intervals (fire-and-forget).
+   *
+   * @param documentId - The document identifier
+   * @param scope - The operation scope
+   * @param branch - The operation branch
+   * @param revision - The revision number
+   * @param document - The document to cache
+   * @throws {Error} If document serialization fails
    */
-  dequeueNextMatching(predicate: (meta: JobRoutingMeta) => boolean, signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
+  putState(documentId: string, scope: string, branch: string, revision: number, document: PHDocument, position: SnapshotPosition): void;
+  private store;
   /**
-   * Get the current size of the queue for a specific document/scope/branch.
-   * @param documentId - The document ID
-   * @param scope - The scope
-   * @param branch - The branch
-   * @returns Promise that resolves to the number of jobs in the queue
+   * Invalidates cached document streams.
+   *
+   * Supports three invalidation scopes:
+   * - Document-level: invalidate(documentId) - removes all streams for document
+   * - Scope-level: invalidate(documentId, scope) - removes all branches for scope
+   * - Stream-level: invalidate(documentId, scope, branch) - removes specific stream
+   *
+   * @param documentId - The document identifier
+   * @param scope - Optional scope to narrow invalidation
+   * @param branch - Optional branch to narrow invalidation (requires scope)
+   * @returns The number of streams evicted
    */
-  size(documentId: string, scope: string, branch: string): Promise<number>;
+  invalidate(documentId: string, scope?: string, branch?: string): number;
   /**
-   * Get the total size of all queues.
-   * @returns Promise that resolves to the total number of jobs across all queues
-   */
-  totalSize(): Promise<number>;
-  /**
-   * Remove a specific job from the queue.
-   * @param jobId - The ID of the job to remove
-   * @returns Promise that resolves to true if job was removed, false if not found
-   */
-  remove(jobId: string): Promise<boolean>;
-  /**
-   * Clear all jobs for a specific document/scope/branch combination.
-   * @param documentId - The document ID
-   * @param scope - The scope
-   * @param branch - The branch
-   * @returns Promise that resolves when the queue is cleared
-   */
-  clear(documentId: string, scope: string, branch: string): Promise<void>;
-  /**
-   * Clear all jobs from all queues.
-   * @returns Promise that resolves when all queues are cleared
-   */
-  clearAll(): Promise<void>;
-  /**
-   * Check if there are any jobs in the queue.
-   * @returns Promise that resolves to true if there are jobs, false otherwise
-   */
-  hasJobs(): Promise<boolean>;
-  /**
-   * Mark a job as completed.
-   * @param jobId - The ID of the job to mark as completed
-   * @returns Promise that resolves when the job is marked as completed
+   * Clears the entire cache, removing all cached document streams.
+   * Resets LRU tracking state. This operation always succeeds.
    */
-  completeJob(jobId: string): Promise<void>;
+  clear(): void;
   /**
-   * Mark a job as failed.
-   * @param jobId - The ID of the job to mark as failed
-   * @param error - Optional error information
-   * @returns Promise that resolves when the job is marked as failed
+   * Retrieves a specific stream for a document. Exposed on the implementation
+   * for testing, but not on the interface.
+   *
+   * @internal
    */
-  failJob(jobId: string, error?: ErrorInfo$1): Promise<void>;
+  getStream(documentId: string, scope: string, branch: string): DocumentStream | undefined;
+  private findNearestKeyframe;
+  private coldMissRebuild;
   /**
-   * Retry a failed job.
-   * @param jobId - The ID of the job to retry
-   * @param error - Optional error information from the failure
-   * @returns Promise that resolves when the job is requeued for retry
+   * Copies the current document revisions onto the document. Overwrites the
+   * requested scope revision with the target revision, if provided.
    */
-  retryJob(jobId: string, error?: ErrorInfo$1): Promise<void>;
+  private stampRevisions;
+  /** The stored operation at `index`, or undefined if it is no longer there. */
+  private operationAt;
   /**
-   * Returns true if and only if all jobs have been resolved.
+   * Resolves which module version to use for a given operation in phase 2.
+   *
+   * Uses the validated-upgrade boundary rules from D7:
+   * - If `input.revision` is present: op.index < revision[scope] → before the upgrade boundary
+   * - Otherwise: timestamp fallback
+   * - Falls back to final module version when neither is decidable
    */
-  get isDrained(): boolean;
+  private resolveModuleVersionForOp;
+  private warmMissRebuild;
+  private findNearestOlderSnapshot;
+  private makeStreamKey;
+  private getOrCreateStream;
+  private isKeyframeRevision;
+}
+//#endregion
+//#region src/storage/kysely/store.d.ts
+declare class KyselyOperationStore implements IOperationStore {
+  private db;
+  private trx?;
+  constructor(db: Kysely<Database$1>);
+  private get queryExecutor();
+  withTransaction(trx: Transaction<Database$1>): KyselyOperationStore;
+  apply(documentId: string, documentType: string, scope: string, branch: string, revision: number, fn: (txn: AtomicTxn) => void | Promise<void>, signal?: AbortSignal, condition?: AppendCondition): Promise<Operation[]>;
+  private resolveUniqueConstraint;
+  private executeApply;
   /**
-   * Blocks the queue from accepting new jobs.
-   * @param onDrained - Optional callback to call when the queue is drained
+   * Locks the written stream and every read-set stream, in sorted key order
+   * so that overlapping concurrent appends serialize rather than deadlock.
+   * The locks are still taken one row at a time, so the query preserves that
+   * order. It must stay separate from the guarded insert, which would
+   * otherwise read a snapshot taken before the locks were held.
    */
-  block(onDrained?: () => void): void;
+  private acquireStreamLocks;
   /**
-   * Unblocks the queue from accepting new jobs.
+   * Inserts the staged operations with the condition compiled in as a WHERE
+   * NOT EXISTS guard, making the check and the append one statement. Returns
+   * the rows inserted; zero means the guard failed and nothing was written.
    */
-  unblock(): void;
+  private insertGuarded;
+  private findIdempotentReplay;
+  getSince(documentId: string, scope: string, branch: string, revision: number, filter?: OperationFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Operation>>;
+  getSinceId(id: number, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<OperationWithContext$1>>;
+  getConflicting(documentId: string, scope: string, branch: string, minTimestamp: string, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Operation>>;
+  getRevisions(documentId: string, branch: string, signal?: AbortSignal): Promise<DocumentRevisions>;
+  getStreamLatestTimestamp(documentId: string, scope: string, branch: string, signal?: AbortSignal): Promise<string | undefined>;
+  private rowToOperation;
+  private rowToOperationWithContext;
 }
 //#endregion
-//#region src/read-models/types.d.ts
-interface ViewStateTable {
-  readModelId: string;
-  lastOrdinal: number;
-  lastOperationTimestamp: Generated<Date>;
-}
-interface DocumentSnapshotTable {
-  id: Generated<string>;
-  documentId: string;
-  slug: string | null;
-  name: string | null;
-  scope: string;
-  branch: string;
-  content: unknown;
-  documentType: string;
-  lastOperationIndex: number;
-  lastOperationHash: string;
-  lastUpdatedAt: Generated<Date>;
-  snapshotVersion: Generated<number>;
-  identifiers: unknown;
-  metadata: unknown;
-  isDeleted: Generated<boolean>;
-  deletedAt: Date | null;
-}
-interface SlugMappingTable {
-  slug: string;
-  documentId: string;
-  scope: string;
-  branch: string;
-  createdAt: Generated<Date>;
-  updatedAt: Generated<Date>;
+//#region src/storage/kysely/keyframe-store.d.ts
+declare class KyselyKeyframeStore implements IKeyframeStore {
+  private db;
+  private trx?;
+  constructor(db: Kysely<Database$1>);
+  private get queryExecutor();
+  withTransaction(trx: Transaction<Database$1>): KyselyKeyframeStore;
+  putKeyframe(documentId: string, scope: string, branch: string, revision: number, document: PHDocument, signal?: AbortSignal): Promise<void>;
+  findNearestKeyframe(documentId: string, scope: string, branch: string, targetRevision: number, signal?: AbortSignal): Promise<{
+    revision: number;
+    document: PHDocument;
+  } | undefined>;
+  listKeyframes(documentId: string, scope?: string, branch?: string, signal?: AbortSignal): Promise<Array<{
+    scope: string;
+    branch: string;
+    revision: number;
+    document: PHDocument;
+  }>>;
+  deleteKeyframes(documentId: string, scope?: string, branch?: string, signal?: AbortSignal): Promise<number>;
 }
-interface ProcessorCursorTable {
-  processorId: string;
-  factoryId: string;
-  driveId: string;
-  processorIndex: number;
-  lastOrdinal: Generated<number>;
-  status: Generated<string>;
-  lastError: string | null;
-  lastErrorTimestamp: Date | null;
-  createdAt: Generated<Date>;
-  updatedAt: Generated<Date>;
+//#endregion
+//#region src/executor/execution-scope.d.ts
+interface ExecutionStores {
+  operationStore: IOperationStore;
+  operationIndex: IOperationIndex;
+  writeCache: IWriteCache;
+  documentMetaCache: IDocumentMetaCache;
+  collectionMembershipCache: ICollectionMembershipCache;
 }
-interface DocumentViewDatabase {
-  ViewState: ViewStateTable;
-  DocumentSnapshot: DocumentSnapshotTable;
-  SlugMapping: SlugMappingTable;
-  ProcessorCursor: ProcessorCursorTable;
+interface IExecutionScope {
+  run<T>(fn: (stores: ExecutionStores) => Promise<T>, signal?: AbortSignal): Promise<T>;
 }
-type InsertableDocumentSnapshot = Insertable<DocumentSnapshotTable>;
 //#endregion
-//#region src/core/model-sources.d.ts
-/** An importable file holding one or more document-model exports. */
-type FileModelSource = {
-  filePath: string;
-  exportName?: string;
-};
-/** An importable package specifier holding one or more document-model exports. */
-type PackageModelSource = {
-  packageName: string;
-  subpath?: string;
-  exportName?: string;
-};
+//#region src/executor/types.d.ts
 /**
- * A source of document models: a live module, an importable file, or an
- * importable package. File and package sources can cross a worker-thread
- * boundary (workers re-import them); a live module cannot.
+ * Represents the result of a job execution
  */
-type DocumentModelSource = DocumentModelModule<any> | FileModelSource | PackageModelSource;
-//#endregion
-//#region src/registry/interfaces.d.ts
-type RegistrationResult<T> = {
-  status: "success";
-  item: T;
-} | {
-  status: "error";
-  item: T;
-  error: Error;
+type JobResult = {
+  /** The job that was executed */job: Job; /** Whether the job executed successfully */
+  success: boolean; /** Error if the job failed */
+  error?: Error; /** The operations generated from the actions (if successful) */
+  operations?: Operation[];
+  /**
+   * Operations with context (includes ephemeral resultingState).
+   * Used for emitting to IDocumentView via event bus.
+   */
+  operationsWithContext?: OperationWithContext$1[]; /** Timestamp when the job execution completed */
+  completedAt?: string; /** Duration of job execution in milliseconds */
+  duration?: number; /** Any additional metadata from the execution */
+  metadata?: Record<string, any>;
 };
 /**
- * Loader that asynchronously resolves a document type to a
- * {@link DocumentModelSource}. Used by the queue to gate CREATE_DOCUMENT
- * jobs until the required model is available in the registry.
+ * Enforcement the reactor performs, each off by default.
  *
- * Return an importable source ({ filePath } or { packageName }) whenever
- * possible: the resolver registers the resolved models on the host registry
- * and broadcasts importable sources to executor workers. A live
- * DocumentModelModule is also valid but host-only — it cannot cross a
- * worker-thread boundary, so worker pools will not receive it.
- */
-interface IDocumentModelLoader {
-  load(documentType: string): Promise<DocumentModelSource>;
-}
-/**
- * Registry for managing document model modules.
- * Provides centralized access to document models' reducers, utils, and specifications.
- * Supports version-aware module storage and upgrade manifest management.
+ * An evaluation made while replaying is part of the document's history, so two
+ * reactors that share documents and disagree on these diverge. A flag is turned
+ * on for a set of reactors that sync with each other, not for one node.
  */
-interface IDocumentModelRegistry {
-  /**
-   * Register multiple modules at once.
-   * Modules without a version field default to version 1.
-   * Invalid or duplicate modules are skipped without breaking registration of the remaining modules.
-   *
-   * @param modules Document model modules to register
-   * @returns Array of results, one per module, indicating success or failure
-   */
-  registerModules(...modules: DocumentModelModule<any>[]): RegistrationResult<DocumentModelModule<any>>[];
-  /**
-   * Unregister all versions of the specified document types.
-   *
-   * @param documentTypes The document types to unregister
-   * @returns true if all modules were unregistered, false if any were not found
-   */
-  unregisterModules(...documentTypes: string[]): boolean;
-  /**
-   * Get a specific document model module by document type and optional version.
-   * If version is not specified, returns the latest version.
-   *
-   * @param documentType The document type identifier
-   * @param version Optional version number to retrieve
-   * @returns The document model module
-   * @throws ModuleNotFoundError if the document type or version is not registered
-   */
-  getModule(documentType: string, version?: number): DocumentModelModule<any>;
+type ReactorFeatureFlags = {
   /**
-   * Get all registered document model modules.
-   *
-   * @returns Array of all registered modules
+   * Decide whether an operation may be admitted by building a decision model
+   * over the document stream, rather than reading the deleted flag from the
+   * document meta cache. Deletion then takes effect from the deleting
+   * operation's position rather than for the whole document.
    */
-  getAllModules(): DocumentModelModule<any>[];
+  documentDecisions: boolean;
   /**
-   * Clear all registered modules and upgrade manifests.
+   * Evaluate the auth policy by reading the auth scope as a second projection.
+   * Requires documentDecisions.
    */
-  clear(): void;
-  /**
-   * Get all supported versions for a document type, sorted in ascending order.
-   *
-   * @param documentType The document type identifier
-   * @returns Array of version numbers sorted ascending
-   * @throws ModuleNotFoundError if no modules are registered for the document type
+  authEnforcement: boolean;
+};
+/**
+ * Configuration options for the job executor
+ */
+type JobExecutorConfig = {
+  /** Feature flags; anything unset is off. */featureFlags?: Partial<ReactorFeatureFlags>; /** Maximum number of conflicting operations to skip when reshuffling. */
+  maxSkipThreshold?: number; /** Maximum number of concurrent jobs to execute */
+  maxConcurrency?: number; /** Maximum time in milliseconds a job can run before being considered timed out */
+  jobTimeoutMs?: number; /** Base delay in milliseconds for exponential backoff retries */
+  retryBaseDelayMs?: number; /** Maximum delay in milliseconds for exponential backoff retries */
+  retryMaxDelayMs?: number;
+  /** Maximum elapsed milliseconds before yielding to the main thread between actions.
+   *  Keeps the UI responsive when processing large batches. */
+  yieldDeadlineMs?: number;
+};
+/**
+ * Event types for the job executor
+ */
+declare const JobExecutorEventTypes: {
+  readonly JOB_STARTED: 20000;
+  readonly JOB_COMPLETED: 20001;
+  readonly JOB_FAILED: 20002;
+  readonly EXECUTOR_STARTED: 20003;
+  readonly EXECUTOR_STOPPED: 20004;
+};
+/**
+ * Event data for job execution events
+ */
+type JobStartedEvent = {
+  job: Job;
+  startedAt: string;
+  /**
+   * Identifier of the executor that took the job. For the worker pool this is
+   * the thread-worker id (e.g. "reactor-worker-3"); for the in-process simple
+   * manager it is "in-process-<index>". Optional for backwards compatibility
+   * with consumers built before the field was added.
    */
-  getSupportedVersions(documentType: string): number[];
+  workerId?: string;
+};
+type JobCompletedEvent = {
+  job: Job;
+  result: JobResult; /** See {@link JobStartedEvent.workerId}. */
+  workerId?: string;
+};
+type JobFailedEvent = {
+  job: Job;
+  error: string;
+  willRetry: boolean;
+  retryCount: number; /** See {@link JobStartedEvent.workerId}. */
+  workerId?: string;
+};
+type ExecutorStartedEvent = {
+  config: JobExecutorConfig;
+  startedAt: string;
+};
+type ExecutorStoppedEvent = {
+  stoppedAt: string;
+  graceful: boolean;
+};
+/**
+ * Status information for the job executor manager
+ */
+type ExecutorManagerStatus = {
+  /** Whether the manager is currently running */isRunning: boolean; /** Number of executor instances managed */
+  numExecutors: number; /** Number of jobs currently being processed */
+  activeJobs: number; /** Total number of jobs processed since start */
+  totalJobsProcessed: number;
+};
+//#endregion
+//#region src/executor/interfaces.d.ts
+/**
+ * Snapshot of the single in-flight slot maintained by an {@link IExecutorWorker}.
+ */
+type WorkerInFlightSnapshot = {
+  correlationId: string;
+  jobId: string;
+};
+/**
+ * Outcome of a worker-side job execution.
+ *
+ * `result` mirrors the in-process `JobResult` exactly. `writeReady` carries
+ * the operations + jobMeta the parent needs to emit `JOB_WRITE_READY`, and is
+ * present only when the worker produced operations. It is absent on failure
+ * and on success-with-no-operations.
+ */
+type WorkerExecutionOutcome = {
+  result: JobResult;
+  writeReady?: JobWriteReadyPayload;
+};
+/**
+ * Parent-side handle for a single executor worker.
+ *
+ * Implementations wrap an IPC transport (worker_threads, child_process, or a
+ * test fake) and expose a transport-agnostic surface that the worker-pool
+ * manager uses to dispatch jobs. The handle owns one worker's lifecycle
+ * (`start` -> `execute`* -> `shutdown`) and bounds its in-flight map to a
+ * single entry; `SimpleJobExecutor` is single-threaded inside the worker, so
+ * concurrent dispatches would race its caches.
+ */
+interface IExecutorWorker {
+  /** Stable identifier of the worker (mirrors `InitMessage.workerId`). */
+  readonly workerId: string;
+  /** Zero-based index within the pool, used for sticky routing. */
+  readonly index: number;
   /**
-   * Get the latest (highest) version number for a document type.
-   *
-   * @param documentType The document type identifier
-   * @returns The highest version number registered for this document type
-   * @throws ModuleNotFoundError if no modules are registered for the document type
+   * Spawn the worker (if not already started), send the `init` payload and
+   * resolve when the worker replies with `ready`.
    */
-  getLatestVersion(documentType: string): number;
+  start(): Promise<void>;
   /**
-   * Register upgrade manifests that define upgrade paths between versions.
-   * Invalid or duplicate manifests are skipped without breaking registration of the remaining manifests.
-   *
-   * @param manifests Upgrade manifests to register
-   * @returns Array of results, one per manifest, indicating success or failure
+   * Dispatch a job to the worker and resolve with its outcome — the
+   * `JobResult` and, on success-with-operations, a `writeReady` payload
+   * the parent will enrich and re-emit. Rejects with a transport-level
+   * error if the worker exits, aborts, or times out before producing a
+   * result.
    */
-  registerUpgradeManifests(...manifests: UpgradeManifest<readonly number[]>[]): RegistrationResult<UpgradeManifest<readonly number[]>>[];
+  execute(job: Job, signal?: AbortSignal): Promise<WorkerExecutionOutcome>;
   /**
-   * Unregister upgrade manifests for the specified document types.
-   * @param documentTypes The document types whose upgrade manifests should be unregistered
-   * @returns true if all modules were unregistered, false if any were not found
-   **/
-  unregisterUpgradeManifests(...documentTypes: string[]): boolean;
+   * Request cancellation of the in-flight job (if any). The handle posts an
+   * `abort` message; if the worker fails to reply within its grace window it
+   * is force-terminated.
+   */
+  abort(correlationId: string, reason?: string): void;
   /**
-   * Get the upgrade manifest for a document type.
+   * Stop the worker. When `graceful` is true the handle waits for the
+   * in-flight job to settle (up to `graceMs`) before terminating; otherwise
+   * the worker is terminated immediately.
+   */
+  shutdown(graceful: boolean, graceMs?: number): Promise<void>;
+  /**
+   * Register an additional document model on the running worker. Resolves
+   * when the worker replies with `model-loaded`; rejects when it replies
+   * with `model-load-failed` or the worker exits before answering.
+   */
+  loadModel(entry: ModelManifestEntry, signal?: AbortSignal): Promise<void>;
+  /** True when no job is currently in flight. */
+  isIdle(): boolean;
+  /** Snapshot of the in-flight slot, or null when idle. */
+  getInFlight(): WorkerInFlightSnapshot | null;
+}
+/**
+ * Simple interface for executing a job.
+ * A JobExecutor simply takes a job and executes it - nothing more.
+ */
+interface IJobExecutor {
+  /**
+   * Execute a single job.
+   * @param job - The job to execute
+   * @returns Promise that resolves to the job result
+   */
+  executeJob(job: Job, signal?: AbortSignal): Promise<JobResult>;
+}
+/**
+ * Interface for managing multiple job executors.
+ * Listens for 'jobAvailable' events from the event bus, pulls jobs from the queue,
+ * and coordinates the distribution of jobs across multiple executor instances.
+ */
+interface IJobExecutorManager {
+  /**
+   * Start the executor manager.
+   * Begins listening for 'jobAvailable' events and dispatching to executors.
    *
-   * @param documentType The document type identifier
-   * @returns The upgrade manifest
-   * @throws ManifestNotFoundError if no manifest is registered for the document type
+   * @param numExecutors - Number of executor instances to create
+   * @returns Promise that resolves when the manager is started
    */
-  getUpgradeManifest(documentType: string): UpgradeManifest<readonly number[]>;
+  start(numExecutors: number): Promise<void>;
   /**
-   * Compute the upgrade path from one version to another.
-   * Returns the sequence of upgrade transitions needed.
+   * Stop the executor manager.
    *
-   * @param documentType The document type identifier
-   * @param fromVersion The starting version
-   * @param toVersion The target version
-   * @returns Array of upgrade transitions in order
-   * @throws DowngradeNotSupportedError if toVersion is less than fromVersion
-   * @throws ManifestNotFoundError if no upgrade manifest is registered
-   * @throws MissingUpgradeTransitionError if any transition in the path is missing
+   * @param graceful - Whether to wait for current jobs to complete
+   * @returns Promise that resolves when the manager is stopped
    */
-  computeUpgradePath(documentType: string, fromVersion: number, toVersion: number): UpgradeTransition[];
+  stop(graceful?: boolean): Promise<void>;
   /**
-   * Get the upgrade reducer for a single-step version transition.
+   * Get all managed executor instances.
    *
-   * @param documentType The document type identifier
-   * @param fromVersion The starting version
-   * @param toVersion The target version (must be fromVersion + 1)
-   * @returns The upgrade reducer function
-   * @throws InvalidUpgradeStepError if toVersion is not fromVersion + 1
-   * @throws ManifestNotFoundError if no upgrade manifest is registered
-   * @throws MissingUpgradeTransitionError if the transition is not found
+   * @returns Array of executor instances
    */
-  getUpgradeReducer(documentType: string, fromVersion: number, toVersion: number): UpgradeReducer<any, any>;
+  getExecutors(): IJobExecutor[];
+  /**
+   * Get the current status of the manager.
+   *
+   * @returns The current manager status
+   */
+  getStatus(): ExecutorManagerStatus;
 }
 //#endregion
-//#region src/shared/consistency-tracker.d.ts
-interface IConsistencyTracker {
+//#region src/job-tracker/interfaces.d.ts
+/**
+ * Interface for tracking job lifecycle status.
+ * Maintains job state throughout execution: PENDING → RUNNING → COMPLETED/FAILED.
+ */
+interface IJobTracker {
   /**
-   * Updates the tracker with new operation indexes.
-   * When multiple coordinates have the same key, keeps the highest operationIndex.
-   * Resolves any pending waiters whose coordinates are now satisfied.
+   * Register a new job with PENDING status.
+   *
+   * @param jobInfo - The job information to register
    */
-  update(coordinates: ConsistencyCoordinate[]): void;
+  registerJob(jobInfo: JobInfo): void;
   /**
-   * Returns the latest operation index for a given key, or undefined if not tracked.
+   * Update a job's status to RUNNING.
+   *
+   * @param jobId - The job ID to mark as running
    */
-  getLatest(key: ConsistencyKey): number | undefined;
+  markRunning(jobId: string): void;
   /**
-   * Returns a promise that resolves when all coordinates are satisfied.
-   * Rejects if the timeout is reached or the signal is aborted.
+   * Mark a job as failed.
+   *
+   * @param jobId - The job ID to mark as failed
+   * @param error - Error information including message and stack trace
+   * @param job - Optional full job object for debugging purposes
    */
-  waitFor(coordinates: ConsistencyCoordinate[], timeoutMs?: number, signal?: AbortSignal): Promise<void>;
+  markFailed(jobId: string, error: ErrorInfo$1, job?: Job): void;
   /**
-   * Returns a serializable snapshot of the current state.
+   * Retrieve the current status of a job.
+   *
+   * @param jobId - The job ID to query
+   * @returns The job information, or null if the job is not found
    */
-  serialize(): Array<[ConsistencyKey, number]>;
+  getJobStatus(jobId: string): JobInfo | null;
   /**
-   * Restores state from a serialized snapshot.
+   * Shutdown the job tracker and clean up resources.
+   * Unsubscribes from all event bus subscriptions.
    */
-  hydrate(entries: Array<[ConsistencyKey, number]>): void;
+  shutdown(): void;
+}
+//#endregion
+//#region src/queue/interfaces.d.ts
+/**
+ * Interface for a job queue that manages write operations.
+ * Internally organizes jobs by documentId, scope, and branch to ensure proper ordering.
+ * Emits events to the event bus when new jobs are available for consumption.
+ */
+interface IQueue {
+  /**
+   * Add a new job to the queue.
+   * Jobs are automatically organized by documentId, scope, and branch internally.
+   * Emits a 'jobAvailable' event to the event bus when the job is queued.
+   * @param job - The job to add to the queue
+   * @returns Promise that resolves when the job is queued
+   */
+  enqueue(job: Job): Promise<void>;
+  /**
+   * Get the next job to execute for a specific document/scope/branch combination.
+   * @param documentId - The document ID to get jobs for
+   * @param scope - The scope to get jobs for
+   * @param branch - The branch to get jobs for
+   * @param signal - Optional abort signal to cancel the request
+   * @returns Promise that resolves to the next job execution handle or null if no jobs available
+   */
+  dequeue(documentId: string, scope: string, branch: string, signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
+  /**
+   * Get the next available job from any queue.
+   * @param signal - Optional abort signal to cancel the request
+   * @returns Promise that resolves to the next job execution handle or null if no jobs available
+   */
+  dequeueNext(signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
+  /**
+   * Get the next available job whose routing metadata satisfies the predicate.
+   * Walks ready sub-queue heads in queue insertion order, skips heads whose document
+   * is currently executing (same isDocumentExecuting gate as dequeueNext), and returns
+   * the first head for which predicate returns true.
+   * Returns null when paused, when nothing matches, or when the queue is empty.
+   * Rejects if signal is already aborted.
+   * @param predicate - Filter applied to JobRoutingMeta of each candidate head
+   * @param signal - Optional abort signal to cancel the request
+   * @returns Promise that resolves to the first matching job execution handle or null
+   */
+  dequeueNextMatching(predicate: (meta: JobRoutingMeta) => boolean, signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
+  /**
+   * Get the current size of the queue for a specific document/scope/branch.
+   * @param documentId - The document ID
+   * @param scope - The scope
+   * @param branch - The branch
+   * @returns Promise that resolves to the number of jobs in the queue
+   */
+  size(documentId: string, scope: string, branch: string): Promise<number>;
+  /**
+   * Get the total size of all queues.
+   * @returns Promise that resolves to the total number of jobs across all queues
+   */
+  totalSize(): Promise<number>;
+  /**
+   * Remove a specific job from the queue.
+   * @param jobId - The ID of the job to remove
+   * @returns Promise that resolves to true if job was removed, false if not found
+   */
+  remove(jobId: string): Promise<boolean>;
+  /**
+   * Clear all jobs for a specific document/scope/branch combination.
+   * @param documentId - The document ID
+   * @param scope - The scope
+   * @param branch - The branch
+   * @returns Promise that resolves when the queue is cleared
+   */
+  clear(documentId: string, scope: string, branch: string): Promise<void>;
+  /**
+   * Clear all jobs from all queues.
+   * @returns Promise that resolves when all queues are cleared
+   */
+  clearAll(): Promise<void>;
+  /**
+   * Check if there are any jobs in the queue.
+   * @returns Promise that resolves to true if there are jobs, false otherwise
+   */
+  hasJobs(): Promise<boolean>;
+  /**
+   * Mark a job as completed.
+   * @param jobId - The ID of the job to mark as completed
+   * @returns Promise that resolves when the job is marked as completed
+   */
+  completeJob(jobId: string): Promise<void>;
+  /**
+   * Mark a job as failed.
+   * @param jobId - The ID of the job to mark as failed
+   * @param error - Optional error information
+   * @returns Promise that resolves when the job is marked as failed
+   */
+  failJob(jobId: string, error?: ErrorInfo$1): Promise<void>;
+  /**
+   * Retry a failed job.
+   * @param jobId - The ID of the job to retry
+   * @param error - Optional error information from the failure
+   * @param accounting - Whether the attempt counts against the job's retry
+   * limit; defaults to {@link RetryAccounting.CountAgainstLimit}
+   * @returns Promise that resolves when the job is requeued for retry
+   */
+  retryJob(jobId: string, error?: ErrorInfo$1, accounting?: RetryAccounting): Promise<void>;
+  /**
+   * Returns true if and only if all jobs have been resolved.
+   */
+  get isDrained(): boolean;
+  /**
+   * Blocks the queue from accepting new jobs.
+   * @param onDrained - Optional callback to call when the queue is drained
+   */
+  block(onDrained?: () => void): void;
+  /**
+   * Unblocks the queue from accepting new jobs.
+   */
+  unblock(): void;
+}
+//#endregion
+//#region src/read-models/types.d.ts
+interface ViewStateTable {
+  readModelId: string;
+  lastOrdinal: number;
+  lastOperationTimestamp: Generated<Date>;
+}
+interface DocumentSnapshotTable {
+  id: Generated<string>;
+  documentId: string;
+  slug: string | null;
+  name: string | null;
+  scope: string;
+  branch: string;
+  content: unknown;
+  documentType: string;
+  lastOperationIndex: number;
+  lastOperationHash: string;
+  lastUpdatedAt: Generated<Date>;
+  snapshotVersion: Generated<number>;
+  identifiers: unknown;
+  metadata: unknown;
+  isDeleted: Generated<boolean>;
+  deletedAt: Date | null;
+}
+interface SlugMappingTable {
+  slug: string;
+  documentId: string;
+  scope: string;
+  branch: string;
+  createdAt: Generated<Date>;
+  updatedAt: Generated<Date>;
+}
+interface ProcessorCursorTable {
+  processorId: string;
+  factoryId: string;
+  driveId: string;
+  processorIndex: number;
+  lastOrdinal: Generated<number>;
+  status: Generated<string>;
+  lastError: string | null;
+  lastErrorTimestamp: Date | null;
+  createdAt: Generated<Date>;
+  updatedAt: Generated<Date>;
+}
+interface DocumentViewDatabase {
+  ViewState: ViewStateTable;
+  DocumentSnapshot: DocumentSnapshotTable;
+  SlugMapping: SlugMappingTable;
+  ProcessorCursor: ProcessorCursorTable;
+}
+type InsertableDocumentSnapshot = Insertable<DocumentSnapshotTable>;
+//#endregion
+//#region src/shared/consistency-tracker.d.ts
+interface IConsistencyTracker {
+  /**
+   * Updates the tracker with new operation indexes.
+   * When multiple coordinates have the same key, keeps the highest operationIndex.
+   * Resolves any pending waiters whose coordinates are now satisfied.
+   */
+  update(coordinates: ConsistencyCoordinate[]): void;
+  /**
+   * Returns the latest operation index for a given key, or undefined if not tracked.
+   */
+  getLatest(key: ConsistencyKey): number | undefined;
+  /**
+   * Returns a promise that resolves when all coordinates are satisfied.
+   * Rejects if the timeout is reached or the signal is aborted.
+   */
+  waitFor(coordinates: ConsistencyCoordinate[], timeoutMs?: number, signal?: AbortSignal): Promise<void>;
+  /**
+   * Returns a serializable snapshot of the current state.
+   */
+  serialize(): Array<[ConsistencyKey, number]>;
+  /**
+   * Restores state from a serialized snapshot.
+   */
+  hydrate(entries: Array<[ConsistencyKey, number]>): void;
 }
 /**
  * Creates a consistency key from documentId, scope, and branch.
@@ -2946,134 +3609,6 @@ declare class ConsistencyTracker implements IConsistencyTracker {
   private removeWaiter;
 }
 //#endregion
-//#region src/storage/kysely/types.d.ts
-interface OperationTable {
-  id: Generated<number>;
-  jobId: string;
-  opId: string;
-  prevOpId: string;
-  writeTimestampUtcMs: Generated<Date>;
-  documentId: string;
-  documentType: string;
-  scope: string;
-  branch: string;
-  timestampUtcMs: Date;
-  index: number;
-  action: unknown;
-  skip: number;
-  error?: string | null;
-  hash: string;
-}
-interface KeyframeTable {
-  id: Generated<number>;
-  documentId: string;
-  documentType: string;
-  scope: string;
-  branch: string;
-  revision: number;
-  document: unknown;
-  createdAt: Generated<Date>;
-}
-interface DocumentCollectionTable {
-  documentId: string;
-  collectionId: string;
-  joinedOrdinal: bigint;
-  leftOrdinal: bigint | null;
-}
-interface OperationIndexOperationTable {
-  ordinal: Generated<number>;
-  opId: string;
-  documentId: string;
-  documentType: string;
-  scope: string;
-  branch: string;
-  timestampUtcMs: string;
-  writeTimestampUtcMs: Generated<Date>;
-  index: number;
-  skip: number;
-  hash: string;
-  action: unknown;
-  sourceRemote: Generated<string>;
-}
-interface SyncRemoteTable {
-  name: string;
-  collection_id: string;
-  channel_type: string;
-  channel_id: string;
-  remote_name: string;
-  channel_parameters: unknown;
-  filter_document_ids: unknown;
-  filter_scopes: unknown;
-  filter_branch: string;
-  push_state: string;
-  push_last_success_utc_ms: string | null;
-  push_last_failure_utc_ms: string | null;
-  push_failure_count: number;
-  pull_state: string;
-  pull_last_success_utc_ms: string | null;
-  pull_last_failure_utc_ms: string | null;
-  pull_failure_count: number;
-  created_at: Generated<Date>;
-  updated_at: Generated<Date>;
-}
-interface SyncCursorTable {
-  remote_name: string;
-  cursor_type: string;
-  cursor_ordinal: bigint;
-  last_synced_at_utc_ms: string | null;
-  updated_at: Generated<Date>;
-}
-/**
- * Kysely table definition for the `sync_dead_letters` table.
- */
-interface SyncDeadLetterTable {
-  ordinal: Generated<number>;
-  id: string;
-  job_id: string;
-  job_dependencies: unknown;
-  remote_name: string;
-  document_id: string;
-  scopes: unknown;
-  branch: string;
-  operations: unknown;
-  error_source: string;
-  error_message: string;
-  created_at: Generated<Date>;
-}
-interface Database$1 {
-  Operation: OperationTable;
-  Keyframe: KeyframeTable;
-  document_collections: DocumentCollectionTable;
-  operation_index_operations: OperationIndexOperationTable;
-  sync_remotes: SyncRemoteTable;
-  sync_cursors: SyncCursorTable;
-  sync_dead_letters: SyncDeadLetterTable;
-}
-interface DocumentTable {
-  id: string;
-  createdAt: Generated<Date>;
-  updatedAt: Generated<Date>;
-}
-interface DocumentRelationshipTable {
-  id: Generated<string>;
-  sourceId: string;
-  targetId: string;
-  relationshipType: string;
-  metadata: unknown;
-  createdAt: Generated<Date>;
-  updatedAt: Generated<Date>;
-}
-interface IndexerStateTable {
-  id: Generated<number>;
-  lastOperationId: number;
-  lastOperationTimestamp: Generated<Date>;
-}
-interface DocumentIndexerDatabase {
-  Document: DocumentTable;
-  DocumentRelationship: DocumentRelationshipTable;
-  IndexerState: IndexerStateTable;
-}
-//#endregion
 //#region src/storage/pool-instrumentation.d.ts
 /**
  * Snapshot of a pg.Pool's internal counters at a point in time.
@@ -3137,7 +3672,13 @@ declare class PollingChannelError extends Error {
 declare class ChannelError extends Error {
   source: ChannelErrorSource;
   error: Error;
-  constructor(source: ChannelErrorSource, error: Error);
+  /**
+   * The classification when something other than the error carries it. Absent
+   * means derive it from `error.name`; a dead letter mirrored from a peer sets it,
+   * because only the message crosses the wire.
+   */
+  readonly errorType?: SyncOperationErrorType;
+  constructor(source: ChannelErrorSource, error: Error, errorType?: SyncOperationErrorType);
 }
 //#endregion
 //#region src/sync/sync-operation.d.ts
@@ -3815,12 +4356,6 @@ declare class DriveClient implements IDriveClient {
   private removeFileNode;
 }
 //#endregion
-//#region src/cache/collection-membership-cache.d.ts
-interface ICollectionMembershipCache {
-  getCollectionsForDocuments(documentIds: string[]): Promise<Record<string, string[]>>;
-  invalidate(documentId: string): void;
-}
-//#endregion
 //#region src/registry/document-model-resolver.d.ts
 interface IDocumentModelResolver {
   ensureModelLoaded(documentType: string): Promise<void>;
@@ -3880,38 +4415,6 @@ declare class NullDocumentModelResolver implements IDocumentModelResolver {
  */
 type WorkerFactory = (index: number) => IExecutorWorker;
 //#endregion
-//#region src/cache/write-cache-types.d.ts
-/**
- * Configuration options for the write cache
- */
-type WriteCacheConfig = {
-  /** Maximum number of document streams to cache (LRU eviction). Default: 1000 */maxDocuments: number; /** Number of snapshots to keep in each document's ring buffer. Default: 10 */
-  ringBufferSize: number; /** Persist a keyframe snapshot every N revisions. Default: 10 */
-  keyframeInterval: number;
-};
-/**
- * Unique identifier for a document stream
- */
-type DocumentStreamKey = {
-  /** Document identifier */documentId: string; /** Operation scope */
-  scope: string; /** Branch name */
-  branch: string;
-};
-/**
- * A cached document snapshot at a specific revision
- */
-type CachedSnapshot = {
-  /** The revision number of this snapshot */revision: number; /** The document state at this revision */
-  document: PHDocument;
-};
-/**
- * Serialized keyframe snapshot for K/V store persistence
- */
-type KeyframeSnapshot = {
-  /** The revision number of this keyframe */revision: number; /** Serialized document state */
-  document: string;
-};
-//#endregion
 //#region src/projection/protocol.d.ts
 /**
  * Identifier for a built-in read model the projection worker materializes
@@ -4095,973 +4598,635 @@ type ProjectionShardManagerConfig = {
   shardCount: number;
   db: DbConfig;
   models: ModelManifestEntry[];
-  preReadyKinds: BuiltInReadModelKind[];
-  postReadyKinds: BuiltInReadModelKind[];
-  factory: ProjectionWorkerFactory;
-  logger: ILogger;
-  hostBus: IEventBus;
-  initTimeoutMs?: number;
-  shutdownGraceMs?: number;
-  drainTimeoutMs?: number;
-  chainDepthReportIntervalMs?: number;
-  /**
-   * Host-side forwarding instrumentations indexed by shard index. The
-   * manager routes each shard's `pool-acquire-samples` message to the
-   * matching forwarder so the host's OpenTelemetry instrumentation records
-   * acquire-wait latencies as if each shard's pg.Pool were local.
-   */
-  poolInstrumentations?: ForwardingPoolInstrumentation[];
-};
-//#endregion
-//#region src/signer/types.d.ts
-/**
- * Configuration for signing and verification.
- */
-type SignerConfig = {
-  /**
-   * The signer used to sign actions before submission.
-   */
-  signer: ISigner;
-  /**
-   * Optional handler for verifying signatures on incoming operations.
-   * If not provided, signature verification will be skipped.
-   */
-  verifier?: SignatureVerificationHandler;
-};
-//#endregion
-//#region src/storage/migrations/types.d.ts
-type MigrationStrategy = "auto" | "manual" | "none";
-interface MigrationResult {
-  success: boolean;
-  migrationsExecuted: string[];
-  error?: Error;
-}
-//#endregion
-//#region src/sync/sync-builder.d.ts
-declare class SyncBuilder {
-  private channelFactory?;
-  private remoteStorage?;
-  private cursorStorage?;
-  private deadLetterStorage?;
-  private config;
-  withChannelFactory(factory: IChannelFactory): this;
-  withRemoteStorage(storage: ISyncRemoteStorage): this;
-  withCursorStorage(storage: ISyncCursorStorage): this;
-  withDeadLetterStorage(storage: ISyncDeadLetterStorage): this;
-  withMaxDeadLettersPerRemote(limit: number): this;
-  withMaxInboxBatchSize(limit: number): this;
-  build(reactor: IReactor, logger: ILogger, operationIndex: IOperationIndex, eventBus: IEventBus, db: Kysely<Database$1>, driveContainerTypes: ReadonlySet<string>): ISyncManager;
-  buildModule(reactor: IReactor, logger: ILogger, operationIndex: IOperationIndex, eventBus: IEventBus, db: Kysely<Database$1>, driveContainerTypes: ReadonlySet<string>): InProcessSyncModule;
-}
-//#endregion
-//#region src/core/reactor-builder.d.ts
-/**
- * Dependencies provided to read-model factories registered via
- * `withReadModelFactory`. These are constructed inside `buildModule()`, which
- * is why factory-based registration is needed for read models that depend on
- * them (`BaseReadModel` subclasses, in particular).
- */
-interface ReadModelFactoryDeps {
-  operationIndex: IOperationIndex;
-  writeCache: IWriteCache;
-  processorManagerConsistencyTracker: IConsistencyTracker;
-}
-/**
- * Factory that builds a pre-ready read model from internal reactor
- * dependencies once they are available. Awaited during `buildModule()`.
- */
-type ReadModelFactory = (deps: ReadModelFactoryDeps) => IReadModel | Promise<IReadModel>;
-type WorkerPoolBase = {
-  /** Number of worker threads to spawn; also the sticky-routing modulus. */numWorkers: number;
-  /**
-   * Factory spec the default transport's workers import to instantiate
-   * their signature verifier. Omitted = no executor-side verification,
-   * parity with the in-process executor's default.
-   */
-  verifier?: SignatureVerifierSpec;
-};
-/**
- * Executor worker-pool configuration. Either `db` (default thread
- * transport; each worker opens its own Postgres pool) or a custom
- * `factory` transport is required by construction — an enabled pool
- * without connection info is unrepresentable.
- */
-type WorkerPoolOptions = (WorkerPoolBase & {
-  db: DbConfig;
-  factory?: WorkerFactory;
-}) | (WorkerPoolBase & {
-  db?: DbConfig;
-  factory: WorkerFactory;
-});
-/**
- * Caller-facing config for {@link ReactorBuilder.withProjectionShards}.
- * When set, the builder replaces the in-process
- * {@link ReadModelCoordinator} with a {@link ProjectionShardManager} that
- * fans JOB_WRITE_READY events to N projection workers sharded by
- * documentId.
- *
- * @see Sharded projection workers sub-feature brief
- *   (Powerhouse board wiki id: eb26f01f-8f68-4918-a6f6-ac7a4679b533)
- */
-type ProjectionShardBuilderConfig = {
-  shardCount: number;
-  preReadyKinds: BuiltInReadModelKind[];
-  postReadyKinds: BuiltInReadModelKind[];
-  /**
-   * Connection info for the projection workers' own pools. Falls back to
-   * the executor worker pool's `db` when {@link ReactorBuilder.withWorkerPool}
-   * is configured with one.
-   */
-  db?: DbConfig;
-  poolSize?: number;
-  initTimeoutMs?: number;
-  shutdownGraceMs?: number;
-  drainTimeoutMs?: number;
-  chainDepthReportIntervalMs?: number;
-};
-declare class ReactorBuilder {
-  private logger?;
-  private documentModelSources;
-  private upgradeManifests;
-  private features;
-  private readModels;
-  private readModelFactories;
-  private executorManager;
-  private executorConfig;
-  private writeCacheConfig?;
-  private migrationStrategy;
-  private syncBuilder?;
-  private eventBus?;
-  private readModelCoordinator?;
-  private signatureVerifier?;
-  private kyselyInstance?;
-  private signalHandlersEnabled;
-  private queueInstance?;
-  private channelScheme?;
-  private jwtHandler?;
-  private documentModelLoader?;
-  private shutdownHooks;
-  private driveContainerTypes;
-  private workerPool?;
-  private resolvedModelManifest?;
-  private projectionShardConfig?;
-  private projectionWorkerFactory?;
-  private instrumentedPools;
-  withLogger(logger: ILogger): this;
-  /**
-   * Register document-model sources: live modules, importable files, or
-   * importable packages. Appends across calls. At `buildModule()` every
-   * source is resolved host-side and registered on the registry; file and
-   * package sources additionally form the worker manifest when the worker
-   * pool is enabled (live modules cannot cross a thread boundary).
-   */
-  withDocumentModelSources(sources: DocumentModelSource[]): this;
-  withUpgradeManifests(manifests: UpgradeManifest<readonly number[]>[]): this;
-  withFeatures(features: ReactorFeatures): this;
-  withReadModel(readModel: IReadModel): this;
-  /**
-   * Register a factory that builds a pre-ready read model after the reactor's
-   * internal `operationIndex`, `writeCache`, and processor-manager consistency
-   * tracker are constructed. Use this for read models (e.g. `BaseReadModel`
-   * subclasses) that need those dependencies and therefore cannot be built
-   * before calling `buildModule()`.
-   */
-  withReadModelFactory(factory: ReadModelFactory): this;
-  withReadModelCoordinator(readModelCoordinator: IReadModelCoordinator): this;
-  withExecutor(executor: IJobExecutorManager): this;
-  withExecutorConfig(config: Partial<JobExecutorConfig>): this;
-  withWriteCacheConfig(config: Partial<WriteCacheConfig>): this;
-  withDriveContainerTypes(types: string[]): this;
-  withMigrationStrategy(strategy: MigrationStrategy): this;
-  withSync(syncBuilder: SyncBuilder): this;
-  withEventBus(eventBus: IEventBus): this;
-  withSignatureVerifier(verifier: SignatureVerificationHandler): this;
-  withKysely(kysely: Kysely<Database>): this;
-  /**
-   * Register an externally-constructed pg.Pool's {@link PoolInstrumentation}
-   * so it surfaces through {@link ReactorModule.pools}. Use this when the
-   * caller built the pool itself (e.g. the in-process bench host wiring) so
-   * pool acquire-wait and pool-stat metrics still emit. The builder also
-   * registers any pool it constructs internally via {@link createPostgresDatabase}.
-   */
-  withInstrumentedPool(instrumentation: PoolInstrumentation): this;
-  withQueue(queue: IQueue): this;
-  withChannelScheme(scheme: ChannelScheme): this;
-  withJwtHandler(handler: JwtHandler): this;
-  withDocumentModelLoader(loader: IDocumentModelLoader): this;
-  withSignalHandlers(): this;
-  /**
-   * Register an async cleanup hook to run during graceful shutdown. Hooks fire
-   * after `reactor.kill()` resolves and before `database.destroy()`, so callers
-   * that depend on the reactor (e.g. an HTTP API layered on top) can drain
-   * cleanly before the underlying kysely instance is torn down. Hook errors are
-   * logged and otherwise ignored — one bad hook cannot strand the rest of the
-   * shutdown chain.
-   */
-  withShutdownHook(hook: () => Promise<void>): this;
-  /**
-   * Enable the executor worker pool: N `node:worker_threads` workers with
-   * sticky per-document routing, replacing the in-process executor. Calling
-   * this enables the pool — there is no `enabled` flag. Provide `db`
-   * (each worker opens its own Postgres pool; the parent database is built
-   * from it too unless {@link withKysely} is set) or a custom `factory`
-   * transport. `verifier` is imported by the default transport's workers;
-   * omitted = no executor-side signature verification.
-   */
-  withWorkerPool(options: WorkerPoolOptions): this;
-  /**
-   * Configure N sharded projection workers. When set, the builder replaces
-   * the default in-process {@link ReadModelCoordinator} with a
-   * {@link ProjectionShardManager}.
-   *
-   * Projection workers open their own Postgres pools from `config.db`,
-   * falling back to the executor worker pool's `db` when
-   * {@link withWorkerPool} is configured with one; only the `poolSize` is
-   * overridden by {@link ProjectionShardBuilderConfig.poolSize}. The same
-   * model manifest resolved from {@link withDocumentModelSources} is
-   * forwarded.
-   */
-  withProjectionShards(config: ProjectionShardBuilderConfig): this;
-  /**
-   * Inject a custom {@link ProjectionWorkerFactory}. When set, the builder
-   * skips default thread-transport wiring for the projection shards and
-   * hands the factory directly to {@link ProjectionShardManager}.
-   */
-  withProjectionWorkerFactory(factory: ProjectionWorkerFactory): this;
-  getResolvedModelManifest(): ModelManifestEntry[] | undefined;
-  build(): Promise<IReactor>;
-  buildModule(): Promise<InProcessReactorModule>;
-  /**
-   * The single Postgres config for the parent, executor workers, and
-   * projection shards. They must share one physical database (the parent
-   * writes operations; workers and shards read them), so divergent
-   * worker/shard targets throw. `withKysely` overrides the parent and is not
-   * validated against a worker/shard `db`.
-   */
-  private resolveReactorDbConfig;
-  /**
-   * Constructs a {@link ProjectionShardManager} bound to the host event
-   * bus. Builds the default thread-transport factory unless one was
-   * injected via {@link withProjectionWorkerFactory}. Calls
-   * `manager.startup()` so all N workers reach READY before the reactor
-   * is returned to the caller.
-   */
-  private createProjectionShardManager;
-  private createDefaultProjectionWorkerFactory;
-  /**
-   * Default {@link WorkerFactory} used when the pool options carry no
-   * custom `factory`. Each worker spawns a real `node:worker_threads`
-   * Worker pointing at the compiled `worker/entry.js`.
-   */
-  private createDefaultWorkerFactory;
-  /**
-   * Builds the parent Kysely instance against a real Postgres server using
-   * the same {@link DbConfig} the workers receive at init. Used in the
-   * worker-pool path so the parent reactor and each worker thread share
-   * storage; PGlite cannot be shared across threads. The constructed pool
-   * is wrapped with {@link instrumentPgPool} and the resulting
-   * {@link PoolInstrumentation} is pushed onto {@link instrumentedPools} so
-   * the reactor module exposes acquire-wait and pool-stat surfaces.
-   */
-  private createPostgresDatabase;
-  private attachSignalHandlers;
-}
-//#endregion
-//#region src/core/reactor-client-builder.d.ts
-/**
- * Builder class for constructing ReactorClient instances with proper configuration
- */
-declare class ReactorClientBuilder {
-  private logger?;
-  private reactorBuilder?;
-  private reactor?;
-  private eventBus?;
-  private documentIndexer?;
-  private documentView?;
-  private signer?;
-  private signatureVerifier?;
-  private subscriptionManager?;
-  private jobAwaiter?;
-  private documentModelLoader?;
-  /**
-   * Sets the logger for the ReactorClient.
-   * @param logger - The logger to use.
-   * @returns The ReactorClientBuilder instance.
-   */
-  withLogger(logger: ILogger): this;
-  /**
-   * Either this or withReactor must be set.
-   */
-  withReactorBuilder(reactorBuilder: ReactorBuilder): this;
-  /**
-   * Either this or withReactorBuilder must be set.
-   */
-  withReactor(reactor: IReactor, eventBus: IEventBus, documentIndexer: IDocumentIndexer, documentView: IDocumentView): this;
-  /**
-   * Sets the signer configuration for signing and verifying actions.
-   *
-   * @param config - Either an ISigner for signing only, or a SignerConfig for both signing and verification
-   */
-  withSigner(config: ISigner | SignerConfig): this;
-  withSubscriptionManager(subscriptionManager: IReactorSubscriptionManager): this;
-  withJobAwaiter(jobAwaiter: IJobAwaiter): this;
-  withDocumentModelLoader(loader: IDocumentModelLoader): this;
-  build(): Promise<ReactorClient>;
-  buildModule(): Promise<InProcessReactorClientModule>;
-}
-//#endregion
-//#region src/core/drive-container-types.d.ts
-declare const DEFAULT_DRIVE_CONTAINER_TYPES: ReadonlySet<string>;
-//#endregion
-//#region src/core/reactor.d.ts
-/**
- * This class implements the IReactor interface and serves as the main entry point
- * for the new Reactor architecture.
- */
-declare class Reactor implements IReactor {
-  private logger;
-  private documentModelRegistry;
-  private shutdownStatus;
-  private setShutdown;
-  private setCompleted;
-  private queue;
-  private jobTracker;
-  private readModelCoordinator;
-  private features;
-  private documentView;
-  private documentIndexer;
-  private operationStore;
-  private eventBus;
-  private executorManager;
-  constructor(logger: ILogger, documentModelRegistry: IDocumentModelRegistry, queue: IQueue, jobTracker: IJobTracker, readModelCoordinator: IReadModelCoordinator, features: ReactorFeatures, documentView: IDocumentView, documentIndexer: IDocumentIndexer, operationStore: IOperationStore, eventBus: IEventBus, executorManager: IJobExecutorManager);
-  kill(): ShutdownStatus;
-  getDocumentModels(namespace?: string, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<DocumentModelModule>>;
-  get<TDocument extends PHDocument>(id: string, view?: ViewFilter, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<TDocument>;
-  getBySlug<TDocument extends PHDocument>(slug: string, view?: ViewFilter, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<TDocument>;
-  getByIdOrSlug<TDocument extends PHDocument>(identifier: string, view?: ViewFilter, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<TDocument>;
-  getOutgoingRelationships(sourceId: string, relationshipType: string, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<string[]>;
-  getIncomingRelationships(targetId: string, relationshipType: string, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<string[]>;
-  getOperations(documentId: string, view?: ViewFilter, filter?: OperationFilter, paging?: PagingOptions, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<Record<string, PagedResults<Operation>>>;
-  find(search: SearchFilter, view?: ViewFilter, paging?: PagingOptions, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
-  create(document: PHDocument, signer?: ISigner, signal?: AbortSignal, meta?: Record<string, unknown>): Promise<JobInfo>;
-  deleteDocument(id: string, signer?: ISigner, signal?: AbortSignal, meta?: Record<string, unknown>): Promise<JobInfo>;
-  execute(docId: string, branch: string, actions: Action[], signal?: AbortSignal, meta?: Record<string, unknown>): Promise<JobInfo>;
-  load(docId: string, branch: string, operations: Operation[], signal?: AbortSignal, meta?: Record<string, unknown>): Promise<JobInfo>;
-  executeBatch(request: BatchExecutionRequest, signal?: AbortSignal, meta?: Record<string, unknown>): Promise<BatchExecutionResult>;
-  loadBatch(request: BatchLoadRequest, signal?: AbortSignal, meta?: Record<string, unknown>): Promise<BatchLoadResult>;
-  addRelationship(sourceId: string, targetId: string, relationshipType: string, branch?: string, signer?: ISigner, signal?: AbortSignal): Promise<JobInfo>;
-  removeRelationship(sourceId: string, targetId: string, relationshipType: string, branch?: string, signer?: ISigner, signal?: AbortSignal): Promise<JobInfo>;
-  getJobStatus(jobId: string, signal?: AbortSignal): Promise<JobInfo>;
-  private findByIds;
-  private findBySlugs;
-  private findByParentId;
-  private findByType;
-  private emitJobPending;
-}
-//#endregion
-//#region src/shared/drive-url.d.ts
-interface ParsedDriveUrl {
-  url: string;
-  driveId: string;
-  graphqlEndpoint: string;
-}
-/**
- * Parse a drive URL to extract drive ID and construct GraphQL endpoint.
- * Preserves any subpath prefix so the result is correct when the reactor is
- * served behind a proxy at a non-root path.
- * e.g., "http://localhost:4001/d/abc123" -> { driveId: "abc123", graphqlEndpoint: "http://localhost:4001/graphql/r" }
- * e.g., "https://example.com/api/reactor/d/abc123" -> { ..., graphqlEndpoint: "https://example.com/api/reactor/graphql/r" }
- */
-declare function parseDriveUrl(url: string): ParsedDriveUrl;
-/**
- * Extract drive ID from a drive URL.
- */
-declare function driveIdFromUrl(url: string): string;
-//#endregion
-//#region src/shared/factories.d.ts
-/**
- * Factory method to create a ShutdownStatus that can be updated
- *
- * @param initialState - Initial shutdown state (default: false)
- * @returns A tuple of [ShutdownStatus, setShutdown function, setCompleted function]
- */
-declare function createMutableShutdownStatus(initialState?: boolean): [ShutdownStatus, (value: boolean) => void, (completed: Promise<void>) => void];
-//#endregion
-//#region src/shared/utils.d.ts
-type ParsedPaging = {
-  offset: number;
-  limit: number;
-};
-/**
- * Validates PagingOptions and returns a normalized offset and limit.
- * Throws if the cursor is not empty and not a non-negative integer, or if
- * limit is less than 1. When `paging` is undefined, returns offset 0 and
- * the caller-supplied `defaultLimit`.
- */
-declare function parsePagingOptions(paging: PagingOptions | undefined, defaultLimit: number): ParsedPaging;
-//#endregion
-//#region src/subs/default-error-handler.d.ts
-/**
- * Default error handler that re-throws subscription errors.
- * This ensures that errors are not silently swallowed.
- */
-declare class DefaultSubscriptionErrorHandler implements ISubscriptionErrorHandler {
-  handleError(error: unknown, context: SubscriptionErrorContext): void;
-}
-//#endregion
-//#region src/subs/react-subscription-manager.d.ts
-type DocumentCreatedCallback = (result: PagedResults<string>) => void;
-type DocumentDeletedCallback = (documentIds: string[]) => void;
-type DocumentStateUpdatedCallback = (result: PagedResults<PHDocument>) => void;
-type RelationshipChangedCallback = (parentId: string, childId: string, changeType: RelationshipChangeType) => void;
-declare class ReactorSubscriptionManager implements IReactorSubscriptionManager {
-  private createdSubscriptions;
-  private deletedSubscriptions;
-  private updatedSubscriptions;
-  private relationshipSubscriptions;
-  private subscriptionCounter;
-  private errorHandler;
-  constructor(errorHandler: ISubscriptionErrorHandler);
-  onDocumentCreated(callback: DocumentCreatedCallback, search?: SearchFilter): () => void;
-  onDocumentDeleted(callback: DocumentDeletedCallback, search?: SearchFilter): () => void;
-  onDocumentStateUpdated(callback: DocumentStateUpdatedCallback, search?: SearchFilter, view?: ViewFilter): () => void;
-  onRelationshipChanged(callback: RelationshipChangedCallback, search?: SearchFilter): () => void;
-  /**
-   * Notify subscribers about created documents
-   */
-  notifyDocumentsCreated(documentIds: string[], documentTypes?: Map<string, string>, parentIds?: Map<string, string | null>): void;
-  /**
-   * Notify subscribers about deleted documents
-   */
-  notifyDocumentsDeleted(documentIds: string[], documentTypes?: Map<string, string>, parentIds?: Map<string, string | null>): void;
+  preReadyKinds: BuiltInReadModelKind[];
+  postReadyKinds: BuiltInReadModelKind[];
+  factory: ProjectionWorkerFactory;
+  logger: ILogger;
+  hostBus: IEventBus;
+  initTimeoutMs?: number;
+  shutdownGraceMs?: number;
+  drainTimeoutMs?: number;
+  chainDepthReportIntervalMs?: number;
   /**
-   * Notify subscribers about updated documents
+   * Host-side forwarding instrumentations indexed by shard index. The
+   * manager routes each shard's `pool-acquire-samples` message to the
+   * matching forwarder so the host's OpenTelemetry instrumentation records
+   * acquire-wait latencies as if each shard's pg.Pool were local.
    */
-  notifyDocumentsUpdated(documents: PHDocument[]): void;
+  poolInstrumentations?: ForwardingPoolInstrumentation[];
+};
+//#endregion
+//#region src/signer/types.d.ts
+/**
+ * Configuration for signing and verification.
+ */
+type SignerConfig = {
   /**
-   * Notify subscribers about relationship changes
+   * The signer used to sign actions before submission.
    */
-  notifyRelationshipChanged(parentId: string, childId: string, changeType: RelationshipChangeType, childType?: string): void;
+  signer: ISigner;
   /**
-   * Clear all subscriptions
+   * Optional handler for verifying signatures on incoming operations.
+   * If not provided, signature verification will be skipped.
    */
-  clearAll(): void;
-  private filterDocumentIds;
-  private filterDocuments;
-  private matchesRelationshipFilter;
+  verifier?: SignatureVerificationHandler;
+};
+//#endregion
+//#region src/storage/migrations/types.d.ts
+type MigrationStrategy = "auto" | "manual" | "none";
+interface MigrationResult {
+  success: boolean;
+  migrationsExecuted: string[];
+  error?: Error;
 }
 //#endregion
-//#region src/events/event-bus.d.ts
-declare class EventBus implements IEventBus {
-  readonly eventTypeToSubscribers: Map<number, Subscriber[]>;
-  subscribe<K>(type: number, subscriber: (type: number, event: K) => void | Promise<void>): Unsubscribe;
-  emit(type: number, data: any): Promise<void>;
+//#region src/sync/sync-builder.d.ts
+declare class SyncBuilder {
+  private channelFactory?;
+  private remoteStorage?;
+  private cursorStorage?;
+  private deadLetterStorage?;
+  private config;
+  withChannelFactory(factory: IChannelFactory): this;
+  withRemoteStorage(storage: ISyncRemoteStorage): this;
+  withCursorStorage(storage: ISyncCursorStorage): this;
+  withDeadLetterStorage(storage: ISyncDeadLetterStorage): this;
+  withMaxDeadLettersPerRemote(limit: number): this;
+  withMaxInboxBatchSize(limit: number): this;
+  build(reactor: IReactor, logger: ILogger, operationIndex: IOperationIndex, eventBus: IEventBus, db: Kysely<Database$1>, driveContainerTypes: ReadonlySet<string>): ISyncManager;
+  buildModule(reactor: IReactor, logger: ILogger, operationIndex: IOperationIndex, eventBus: IEventBus, db: Kysely<Database$1>, driveContainerTypes: ReadonlySet<string>): InProcessSyncModule;
 }
 //#endregion
-//#region src/queue/queue.d.ts
+//#region src/core/reactor-builder.d.ts
 /**
- * In-memory implementation of the IQueue interface.
- * Organizes jobs by documentId, scope, and branch to ensure proper ordering.
- * Ensures serial execution per document by tracking executing jobs.
- * Implements dependency management through queue hints.
+ * Dependencies provided to read-model factories registered via
+ * `withReadModelFactory`. These are constructed inside `buildModule()`, which
+ * is why factory-based registration is needed for read models that depend on
+ * them (`BaseReadModel` subclasses, in particular).
  */
-declare class InMemoryQueue implements IQueue {
-  private eventBus;
-  private resolver;
-  private queues;
-  private jobIdToQueueKey;
-  private docIdToJobId;
-  private jobIdToDocId;
-  private completedJobs;
-  private jobIndex;
-  private isBlocked;
-  private onDrainedCallback?;
-  private isPausedFlag;
-  constructor(eventBus: IEventBus, resolver: IDocumentModelResolver);
-  private toErrorInfo;
+interface ReadModelFactoryDeps {
+  documentModelRegistry: IDocumentModelRegistry;
+  operationIndex: IOperationIndex;
+  writeCache: IWriteCache;
+  processorManagerConsistencyTracker: IConsistencyTracker;
+}
+/**
+ * Factory that builds a pre-ready read model from internal reactor
+ * dependencies once they are available. Awaited during `buildModule()`.
+ */
+type ReadModelFactory = (deps: ReadModelFactoryDeps) => IReadModel | Promise<IReadModel>;
+type WorkerPoolBase = {
+  /** Number of worker threads to spawn; also the sticky-routing modulus. */numWorkers: number;
   /**
-   * Creates a unique key for a document/scope/branch combination
+   * Factory spec the default transport's workers import to instantiate
+   * their signature verifier. Omitted = no executor-side verification,
+   * parity with the in-process executor's default.
    */
-  private createQueueKey;
+  verifier?: SignatureVerifierSpec;
+};
+/**
+ * Executor worker-pool configuration. Either `db` (default thread
+ * transport; each worker opens its own Postgres pool) or a custom
+ * `factory` transport is required by construction — an enabled pool
+ * without connection info is unrepresentable.
+ */
+type WorkerPoolOptions = (WorkerPoolBase & {
+  db: DbConfig;
+  factory?: WorkerFactory;
+}) | (WorkerPoolBase & {
+  db?: DbConfig;
+  factory: WorkerFactory;
+});
+/**
+ * Caller-facing config for {@link ReactorBuilder.withProjectionShards}.
+ * When set, the builder replaces the in-process
+ * {@link ReadModelCoordinator} with a {@link ProjectionShardManager} that
+ * fans JOB_WRITE_READY events to N projection workers sharded by
+ * documentId.
+ *
+ * @see Sharded projection workers sub-feature brief
+ *   (Powerhouse board wiki id: eb26f01f-8f68-4918-a6f6-ac7a4679b533)
+ */
+type ProjectionShardBuilderConfig = {
+  shardCount: number;
+  preReadyKinds: BuiltInReadModelKind[];
+  postReadyKinds: BuiltInReadModelKind[];
   /**
-   * Gets or creates a queue for the given key
+   * Connection info for the projection workers' own pools. Falls back to
+   * the executor worker pool's `db` when {@link ReactorBuilder.withWorkerPool}
+   * is configured with one.
    */
-  private getQueue;
+  db?: DbConfig;
+  poolSize?: number;
+  initTimeoutMs?: number;
+  shutdownGraceMs?: number;
+  drainTimeoutMs?: number;
+  chainDepthReportIntervalMs?: number;
+};
+declare class ReactorBuilder {
+  private logger?;
+  private documentModelSources;
+  private upgradeManifests;
+  private features;
+  private readModels;
+  private readModelFactories;
+  private executorManager;
+  private executorConfig;
+  private writeCacheConfig?;
+  private migrationStrategy;
+  private syncBuilder?;
+  private eventBus?;
+  private readModelCoordinator?;
+  private signatureVerifier?;
+  private kyselyInstance?;
+  private signalHandlersEnabled;
+  private queueInstance?;
+  private channelScheme?;
+  private jwtHandler?;
+  private documentModelLoader?;
+  private shutdownHooks;
+  private driveContainerTypes;
+  private workerPool?;
+  private resolvedModelManifest?;
+  private projectionShardConfig?;
+  private projectionWorkerFactory?;
+  private instrumentedPools;
+  withLogger(logger: ILogger): this;
   /**
-   * Check if a document has any jobs currently executing
+   * Register document-model sources: live modules, importable files, or
+   * importable packages. Appends across calls. At `buildModule()` every
+   * source is resolved host-side and registered on the registry; file and
+   * package sources additionally form the worker manifest when the worker
+   * pool is enabled (live modules cannot cross a thread boundary).
    */
-  private isDocumentExecuting;
+  withDocumentModelSources(sources: DocumentModelSource[]): this;
+  withUpgradeManifests(manifests: UpgradeManifest<readonly number[]>[]): this;
+  withFeatures(features: ReactorFeatures): this;
+  withReadModel(readModel: IReadModel): this;
   /**
-   * Mark a job as executing for its document
+   * Register a factory that builds a pre-ready read model after the reactor's
+   * internal `operationIndex`, `writeCache`, and processor-manager consistency
+   * tracker are constructed. Use this for read models (e.g. `BaseReadModel`
+   * subclasses) that need those dependencies and therefore cannot be built
+   * before calling `buildModule()`.
    */
-  private markJobExecuting;
+  withReadModelFactory(factory: ReadModelFactory): this;
+  withReadModelCoordinator(readModelCoordinator: IReadModelCoordinator): this;
+  withExecutor(executor: IJobExecutorManager): this;
+  withExecutorConfig(config: Partial<JobExecutorConfig>): this;
+  withWriteCacheConfig(config: Partial<WriteCacheConfig>): this;
+  withDriveContainerTypes(types: string[]): this;
+  withMigrationStrategy(strategy: MigrationStrategy): this;
+  withSync(syncBuilder: SyncBuilder): this;
+  withEventBus(eventBus: IEventBus): this;
+  withSignatureVerifier(verifier: SignatureVerificationHandler): this;
+  withKysely(kysely: Kysely<Database>): this;
   /**
-   * Mark a job as no longer executing for its document
+   * Register an externally-constructed pg.Pool's {@link PoolInstrumentation}
+   * so it surfaces through {@link ReactorModule.pools}. Use this when the
+   * caller built the pool itself (e.g. the in-process bench host wiring) so
+   * pool acquire-wait and pool-stat metrics still emit. The builder also
+   * registers any pool it constructs internally via {@link createPostgresDatabase}.
    */
-  private markJobComplete;
+  withInstrumentedPool(instrumentation: PoolInstrumentation): this;
+  withQueue(queue: IQueue): this;
+  withChannelScheme(scheme: ChannelScheme): this;
+  withJwtHandler(handler: JwtHandler): this;
+  withDocumentModelLoader(loader: IDocumentModelLoader): this;
+  withSignalHandlers(): this;
   /**
-   * Check if all dependencies for a job have been completed
+   * Register an async cleanup hook to run during graceful shutdown. Hooks fire
+   * after `reactor.kill()` resolves and before `database.destroy()`, so callers
+   * that depend on the reactor (e.g. an HTTP API layered on top) can drain
+   * cleanly before the underlying kysely instance is torn down. Hook errors are
+   * logged and otherwise ignored — one bad hook cannot strand the rest of the
+   * shutdown chain.
    */
-  private areDependenciesMet;
+  withShutdownHook(hook: () => Promise<void>): this;
   /**
-   * Returns the head of the sub-queue if its dependencies are met, or null.
-   *
-   * The dispatcher only ever considers the head — a dep-blocked head holds
-   * the rest of its sub-queue. This preserves per-(documentId, scope, branch)
-   * FIFO regardless of how dependencies are authored, and makes the queue's
-   * documented "serialized per document" invariant hold even when callers
-   * omit queueHint dependencies on jobs that share a sub-queue.
-   */
-  private getNextJobWithMetDependencies;
-  private getCreateDocumentType;
-  enqueue(job: Job): Promise<void>;
-  dequeue(documentId: string, scope: string, branch: string, signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
-  dequeueNext(signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
-  dequeueNextMatching(predicate: (meta: JobRoutingMeta) => boolean, signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
-  size(documentId: string, scope: string, branch: string): Promise<number>;
-  totalSize(): Promise<number>;
-  remove(jobId: string): Promise<boolean>;
-  clear(documentId: string, scope: string, branch: string): Promise<void>;
-  clearAll(): Promise<void>;
-  hasJobs(): Promise<boolean>;
-  completeJob(jobId: string): Promise<void>;
-  failJob(jobId: string, error?: ErrorInfo$1): Promise<void>;
-  deferJob(jobId: string): void;
-  retryJob(jobId: string, error?: ErrorInfo$1): Promise<void>;
+   * Enable the executor worker pool: N `node:worker_threads` workers with
+   * sticky per-document routing, replacing the in-process executor. Calling
+   * this enables the pool — there is no `enabled` flag. Provide `db`
+   * (each worker opens its own Postgres pool; the parent database is built
+   * from it too unless {@link withKysely} is set) or a custom `factory`
+   * transport. `verifier` is imported by the default transport's workers;
+   * omitted = no executor-side signature verification.
+   */
+  withWorkerPool(options: WorkerPoolOptions): this;
   /**
-   * Check if the queue is drained and call the callback if it is
+   * Configure N sharded projection workers. When set, the builder replaces
+   * the default in-process {@link ReadModelCoordinator} with a
+   * {@link ProjectionShardManager}.
+   *
+   * Projection workers open their own Postgres pools from `config.db`,
+   * falling back to the executor worker pool's `db` when
+   * {@link withWorkerPool} is configured with one; only the `poolSize` is
+   * overridden by {@link ProjectionShardBuilderConfig.poolSize}. The same
+   * model manifest resolved from {@link withDocumentModelSources} is
+   * forwarded.
    */
-  private checkDrained;
+  withProjectionShards(config: ProjectionShardBuilderConfig): this;
   /**
-   * Returns true if and only if all jobs have been resolved.
+   * Inject a custom {@link ProjectionWorkerFactory}. When set, the builder
+   * skips default thread-transport wiring for the projection shards and
+   * hands the factory directly to {@link ProjectionShardManager}.
    */
-  get isDrained(): boolean;
+  withProjectionWorkerFactory(factory: ProjectionWorkerFactory): this;
+  getResolvedModelManifest(): ModelManifestEntry[] | undefined;
+  build(): Promise<IReactor>;
+  buildModule(): Promise<InProcessReactorModule>;
   /**
-   * Blocks the queue from accepting new jobs.
-   * @param onDrained - Optional callback to call when the queue is drained
+   * The single Postgres config for the parent, executor workers, and
+   * projection shards. They must share one physical database (the parent
+   * writes operations; workers and shards read them), so divergent
+   * worker/shard targets throw. `withKysely` overrides the parent and is not
+   * validated against a worker/shard `db`.
    */
-  block(onDrained?: () => void): void;
+  private resolveReactorDbConfig;
   /**
-   * Unblocks the queue from accepting new jobs.
+   * Constructs a {@link ProjectionShardManager} bound to the host event
+   * bus. Builds the default thread-transport factory unless one was
+   * injected via {@link withProjectionWorkerFactory}. Calls
+   * `manager.startup()` so all N workers reach READY before the reactor
+   * is returned to the caller.
    */
-  unblock(): void;
+  private createProjectionShardManager;
+  private createDefaultProjectionWorkerFactory;
   /**
-   * Pauses job dequeuing. Jobs can still be enqueued but dequeueNext() will return null.
+   * Default {@link WorkerFactory} used when the pool options carry no
+   * custom `factory`. Each worker spawns a real `node:worker_threads`
+   * Worker pointing at the compiled `worker/entry.js`.
    */
-  pause(): void;
+  private createDefaultWorkerFactory;
   /**
-   * Resumes job dequeuing and emits JOB_AVAILABLE events for pending jobs to wake up executors.
+   * Builds the parent Kysely instance against a real Postgres server using
+   * the same {@link DbConfig} the workers receive at init. Used in the
+   * worker-pool path so the parent reactor and each worker thread share
+   * storage; PGlite cannot be shared across threads. The constructed pool
+   * is wrapped with {@link instrumentPgPool} and the resulting
+   * {@link PoolInstrumentation} is pushed onto {@link instrumentedPools} so
+   * the reactor module exposes acquire-wait and pool-stat surfaces.
    */
-  resume(): Promise<void>;
+  private createPostgresDatabase;
+  private attachSignalHandlers;
+}
+//#endregion
+//#region src/core/reactor-client-builder.d.ts
+/**
+ * Builder class for constructing ReactorClient instances with proper configuration
+ */
+declare class ReactorClientBuilder {
+  private logger?;
+  private reactorBuilder?;
+  private reactor?;
+  private eventBus?;
+  private documentIndexer?;
+  private documentView?;
+  private signer?;
+  private signatureVerifier?;
+  private subscriptionManager?;
+  private jobAwaiter?;
+  private documentModelLoader?;
   /**
-   * Returns whether job dequeuing is paused.
+   * Sets the logger for the ReactorClient.
+   * @param logger - The logger to use.
+   * @returns The ReactorClientBuilder instance.
    */
-  get paused(): boolean;
+  withLogger(logger: ILogger): this;
   /**
-   * Returns all pending jobs across all queues.
+   * Either this or withReactor must be set.
    */
-  getPendingJobs(): Job[];
+  withReactorBuilder(reactorBuilder: ReactorBuilder): this;
   /**
-   * Returns a map of document IDs to sets of executing job IDs.
+   * Either this or withReactorBuilder must be set.
    */
-  getExecutingJobIds(): Map<string, Set<string>>;
+  withReactor(reactor: IReactor, eventBus: IEventBus, documentIndexer: IDocumentIndexer, documentView: IDocumentView): this;
   /**
-   * Returns a job by ID from the job index.
+   * Sets the signer configuration for signing and verifying actions.
+   *
+   * @param config - Either an ISigner for signing only, or a SignerConfig for both signing and verification
    */
-  getJob(jobId: string): Job | undefined;
+  withSigner(config: ISigner | SignerConfig): this;
+  withSubscriptionManager(subscriptionManager: IReactorSubscriptionManager): this;
+  withJobAwaiter(jobAwaiter: IJobAwaiter): this;
+  withDocumentModelLoader(loader: IDocumentModelLoader): this;
+  build(): Promise<ReactorClient>;
+  buildModule(): Promise<InProcessReactorClientModule>;
 }
 //#endregion
-//#region src/job-tracker/in-memory-job-tracker.d.ts
+//#region src/core/drive-container-types.d.ts
+declare const DEFAULT_DRIVE_CONTAINER_TYPES: ReadonlySet<string>;
+//#endregion
+//#region src/core/reactor.d.ts
 /**
- * In-memory implementation of IJobTracker.
- * Maintains job status in a Map for synchronous access.
- * Subscribes to operation events to update job states.
+ * This class implements the IReactor interface and serves as the main entry point
+ * for the new Reactor architecture.
  */
-declare class InMemoryJobTracker implements IJobTracker {
+declare class Reactor implements IReactor {
+  private logger;
+  private documentModelRegistry;
+  private shutdownStatus;
+  private setShutdown;
+  private setCompleted;
+  private queue;
+  private jobTracker;
+  private readModelCoordinator;
+  private features;
+  private documentView;
+  private documentIndexer;
+  private operationStore;
   private eventBus;
-  private jobs;
-  private unsubscribers;
-  constructor(eventBus: IEventBus);
-  private subscribeToEvents;
-  private handleWriteReady;
-  private handleReadReady;
-  private handleJobFailed;
-  shutdown(): void;
-  registerJob(jobInfo: JobInfo): void;
-  markRunning(jobId: string): void;
-  markFailed(jobId: string, error: ErrorInfo$1, job?: Job): void;
-  getJobStatus(jobId: string): JobInfo | null;
+  private executorManager;
+  constructor(logger: ILogger, documentModelRegistry: IDocumentModelRegistry, queue: IQueue, jobTracker: IJobTracker, readModelCoordinator: IReadModelCoordinator, features: ReactorFeatures, documentView: IDocumentView, documentIndexer: IDocumentIndexer, operationStore: IOperationStore, eventBus: IEventBus, executorManager: IJobExecutorManager);
+  kill(): ShutdownStatus;
+  getDocumentModels(namespace?: string, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<DocumentModelModule>>;
+  get<TDocument extends PHDocument>(id: string, view?: ViewFilter, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<TDocument>;
+  getBySlug<TDocument extends PHDocument>(slug: string, view?: ViewFilter, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<TDocument>;
+  getByIdOrSlug<TDocument extends PHDocument>(identifier: string, view?: ViewFilter, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<TDocument>;
+  getOutgoingRelationships(sourceId: string, relationshipType: string, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<string[]>;
+  getIncomingRelationships(targetId: string, relationshipType: string, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<string[]>;
+  getOperations(documentId: string, view?: ViewFilter, filter?: OperationFilter, paging?: PagingOptions, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<Record<string, PagedResults<Operation>>>;
+  find(search: SearchFilter, view?: ViewFilter, paging?: PagingOptions, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
+  create(document: PHDocument, signer?: ISigner, signal?: AbortSignal, meta?: Record<string, unknown>): Promise<JobInfo>;
+  deleteDocument(id: string, signer?: ISigner, signal?: AbortSignal, meta?: Record<string, unknown>): Promise<JobInfo>;
+  execute(docId: string, branch: string, actions: Action[], signal?: AbortSignal, meta?: Record<string, unknown>): Promise<JobInfo>;
+  load(docId: string, branch: string, operations: Operation[], signal?: AbortSignal, meta?: Record<string, unknown>): Promise<JobInfo>;
+  executeBatch(request: BatchExecutionRequest, signal?: AbortSignal, meta?: Record<string, unknown>): Promise<BatchExecutionResult>;
+  loadBatch(request: BatchLoadRequest, signal?: AbortSignal, meta?: Record<string, unknown>): Promise<BatchLoadResult>;
+  addRelationship(sourceId: string, targetId: string, relationshipType: string, branch?: string, signer?: ISigner, signal?: AbortSignal): Promise<JobInfo>;
+  removeRelationship(sourceId: string, targetId: string, relationshipType: string, branch?: string, signer?: ISigner, signal?: AbortSignal): Promise<JobInfo>;
+  getJobStatus(jobId: string, signal?: AbortSignal): Promise<JobInfo>;
+  private findByIds;
+  private findBySlugs;
+  private findByParentId;
+  private findByType;
+  private emitJobPending;
 }
 //#endregion
-//#region src/executor/simple-job-executor-manager.d.ts
-type JobExecutorFactory = () => IJobExecutor;
+//#region src/shared/drive-url.d.ts
+interface ParsedDriveUrl {
+  url: string;
+  driveId: string;
+  graphqlEndpoint: string;
+}
 /**
- * Manages multiple job executors and coordinates job distribution.
- * Listens for job available events and dispatches jobs to executors.
+ * Parse a drive URL to extract drive ID and construct GraphQL endpoint.
+ * Preserves any subpath prefix so the result is correct when the reactor is
+ * served behind a proxy at a non-root path.
+ * e.g., "http://localhost:4001/d/abc123" -> { driveId: "abc123", graphqlEndpoint: "http://localhost:4001/graphql/r" }
+ * e.g., "https://example.com/api/reactor/d/abc123" -> { ..., graphqlEndpoint: "https://example.com/api/reactor/graphql/r" }
  */
-declare class SimpleJobExecutorManager implements IJobExecutorManager {
-  private executorFactory;
-  private eventBus;
-  private queue;
-  private jobTracker;
-  private logger;
-  private resolver;
-  private executors;
-  private isRunning;
-  private activeJobs;
-  private totalJobsProcessed;
-  private unsubscribe?;
-  private deferredJobs;
-  private resultHandler;
-  private jobTimeoutMs;
-  constructor(executorFactory: JobExecutorFactory, eventBus: IEventBus, queue: IQueue, jobTracker: IJobTracker, logger: ILogger, resolver: IDocumentModelResolver, jobTimeoutMs?: number);
-  start(numExecutors: number): Promise<void>;
-  stop(graceful?: boolean): Promise<void>;
-  getExecutors(): IJobExecutor[];
-  getStatus(): ExecutorManagerStatus;
-  private processNextJob;
-  private checkForMoreJobs;
-  private processExistingJobs;
-  private flushDeferredJobs;
-}
+declare function parseDriveUrl(url: string): ParsedDriveUrl;
+/**
+ * Extract drive ID from a drive URL.
+ */
+declare function driveIdFromUrl(url: string): string;
 //#endregion
-//#region src/cache/document-meta-cache-types.d.ts
+//#region src/shared/factories.d.ts
 /**
- * Cached document metadata from the "document" scope.
+ * Factory method to create a ShutdownStatus that can be updated
  *
- * This lightweight structure holds essential document information needed by
- * the job executor without fetching full scope state. It provides an explicit
- * cross-scope contract for accessing document scope metadata.
+ * @param initialState - Initial shutdown state (default: false)
+ * @returns A tuple of [ShutdownStatus, setShutdown function, setCompleted function]
  */
-type CachedDocumentMeta = {
-  /**
-   * The full PHDocumentState from document.state.document.
-   * Contains version, hash, isDeleted, deletedAtUtcIso, etc.
-   */
-  state: PHDocumentState;
-  /**
-   * The document type (from header), cached for convenience.
-   */
-  documentType: string;
-  /**
-   * The revision of the document scope when this metadata was captured.
-   * Used for cache invalidation and consistency checks.
-   */
-  documentScopeRevision: number;
+declare function createMutableShutdownStatus(initialState?: boolean): [ShutdownStatus, (value: boolean) => void, (completed: Promise<void>) => void];
+//#endregion
+//#region src/shared/utils.d.ts
+type ParsedPaging = {
+  offset: number;
+  limit: number;
 };
 /**
- * Interface for the document metadata cache.
- *
- * This cache provides an explicit cross-scope contract for accessing document
- * scope metadata. It solves the problem where job execution in one scope (e.g.,
- * "global") needs access to document scope state (version, isDeleted, etc.)
- * which may be stale in scope-specific caches or keyframes.
- *
- * The cache supports:
- * - Latest metadata retrieval with LRU caching
- * - Historical metadata reconstruction for reshuffling scenarios
- * - Eager updates after document scope operations
+ * Validates PagingOptions and returns a normalized offset and limit.
+ * Throws if the cursor is not empty and not a non-negative integer, or if
+ * limit is less than 1. When `paging` is undefined, returns offset 0 and
+ * the caller-supplied `defaultLimit`.
+ */
+declare function parsePagingOptions(paging: PagingOptions | undefined, defaultLimit: number): ParsedPaging;
+//#endregion
+//#region src/subs/default-error-handler.d.ts
+/**
+ * Default error handler that re-throws subscription errors.
+ * This ensures that errors are not silently swallowed.
  */
-interface IDocumentMetaCache {
-  /**
-   * Retrieves the LATEST document metadata from cache or rebuilds from operations.
-   *
-   * On cache miss, fetches all document scope operations and reconstructs the
-   * current PHDocumentState by applying UPGRADE_DOCUMENT and DELETE_DOCUMENT
-   * operations.
-   *
-   * @param documentId - The document identifier
-   * @param branch - Branch name
-   * @param signal - Optional abort signal to cancel the operation
-   * @returns The cached or rebuilt document metadata
-   * @throws {Error} "Operation aborted" if signal is aborted
-   * @throws {Error} If document not found (no CREATE_DOCUMENT operation)
-   */
-  getDocumentMeta(documentId: string, branch: string, signal?: AbortSignal): Promise<CachedDocumentMeta>;
-  /**
-   * Rebuilds document metadata at a SPECIFIC revision (always rebuilds, no caching).
-   *
-   * Used during reshuffling when operations need to be inserted at a previous
-   * revision and we need the document scope state as of that point in time.
-   *
-   * @param documentId - The document identifier
-   * @param branch - Branch name
-   * @param targetRevision - The document scope revision to reconstruct up to
-   * @param signal - Optional abort signal to cancel the operation
-   * @returns Document metadata as of the target revision
-   * @throws {Error} "Operation aborted" if signal is aborted
-   * @throws {Error} If document not found
-   */
-  rebuildAtRevision(documentId: string, branch: string, targetRevision: number, signal?: AbortSignal): Promise<CachedDocumentMeta>;
+declare class DefaultSubscriptionErrorHandler implements ISubscriptionErrorHandler {
+  handleError(error: unknown, context: SubscriptionErrorContext): void;
+}
+//#endregion
+//#region src/subs/react-subscription-manager.d.ts
+type DocumentCreatedCallback = (result: PagedResults<string>) => void;
+type DocumentDeletedCallback = (documentIds: string[]) => void;
+type DocumentStateUpdatedCallback = (result: PagedResults<PHDocument>) => void;
+type RelationshipChangedCallback = (parentId: string, childId: string, changeType: RelationshipChangeType) => void;
+declare class ReactorSubscriptionManager implements IReactorSubscriptionManager {
+  private createdSubscriptions;
+  private deletedSubscriptions;
+  private updatedSubscriptions;
+  private relationshipSubscriptions;
+  private subscriptionCounter;
+  private errorHandler;
+  constructor(errorHandler: ISubscriptionErrorHandler);
+  onDocumentCreated(callback: DocumentCreatedCallback, search?: SearchFilter): () => void;
+  onDocumentDeleted(callback: DocumentDeletedCallback, search?: SearchFilter): () => void;
+  onDocumentStateUpdated(callback: DocumentStateUpdatedCallback, search?: SearchFilter, view?: ViewFilter): () => void;
+  onRelationshipChanged(callback: RelationshipChangedCallback, search?: SearchFilter): () => void;
   /**
-   * Eagerly updates cached metadata after document scope operations.
-   *
-   * Called by the job executor after CREATE_DOCUMENT, UPGRADE_DOCUMENT, or
-   * DELETE_DOCUMENT operations to keep the cache current.
-   *
-   * @param documentId - The document identifier
-   * @param branch - Branch name
-   * @param meta - The new metadata to cache
+   * Notify subscribers about created documents
    */
-  putDocumentMeta(documentId: string, branch: string, meta: CachedDocumentMeta): void;
+  notifyDocumentsCreated(documentIds: string[], documentTypes?: Map<string, string>, parentIds?: Map<string, string | null>): void;
   /**
-   * Invalidates cached document metadata.
-   *
-   * Call before reshuffling operations that modify the document scope, or
-   * when document state may have changed externally.
-   *
-   * @param documentId - The document identifier
-   * @param branch - Optional branch to narrow invalidation (if omitted, all branches)
-   * @returns Number of entries invalidated
+   * Notify subscribers about deleted documents
    */
-  invalidate(documentId: string, branch?: string): number;
+  notifyDocumentsDeleted(documentIds: string[], documentTypes?: Map<string, string>, parentIds?: Map<string, string | null>): void;
   /**
-   * Clears all cached document metadata.
+   * Notify subscribers about updated documents
    */
-  clear(): void;
+  notifyDocumentsUpdated(documents: PHDocument[]): void;
   /**
-   * Performs startup initialization.
+   * Notify subscribers about relationship changes
    */
-  startup(): Promise<void>;
+  notifyRelationshipChanged(parentId: string, childId: string, changeType: RelationshipChangeType, childType?: string): void;
   /**
-   * Performs graceful shutdown.
+   * Clear all subscriptions
    */
-  shutdown(): Promise<void>;
+  clearAll(): void;
+  private filterDocumentIds;
+  private filterDocuments;
+  private matchesRelationshipFilter;
 }
 //#endregion
-//#region src/cache/buffer/ring-buffer.d.ts
+//#region src/events/event-bus.d.ts
+declare class EventBus implements IEventBus {
+  readonly eventTypeToSubscribers: Map<number, Subscriber[]>;
+  subscribe<K>(type: number, subscriber: (type: number, event: K) => void | Promise<void>): Unsubscribe;
+  emit(type: number, data: any): Promise<void>;
+}
+//#endregion
+//#region src/queue/queue.d.ts
 /**
- * RingBuffer is a generic circular buffer implementation that stores a fixed number
- * of items. When the buffer is full, new items overwrite the oldest items.
- *
- * This implementation maintains O(1) time complexity for push operations and provides
- * items in chronological order (oldest to newest) via getAll().
- *
- * @template T - The type of items stored in the buffer
+ * In-memory implementation of the IQueue interface.
+ * Organizes jobs by documentId, scope, and branch to ensure proper ordering.
+ * Ensures serial execution per document by tracking executing jobs.
+ * Implements dependency management through queue hints.
  */
-declare class RingBuffer<T> {
-  private buffer;
-  private head;
-  private size;
-  private capacity;
-  constructor(capacity: number);
+declare class InMemoryQueue implements IQueue {
+  private eventBus;
+  private resolver;
+  private queues;
+  private jobIdToQueueKey;
+  private docIdToJobId;
+  private jobIdToDocId;
+  private completedJobs;
+  private jobIndex;
+  private isBlocked;
+  private onDrainedCallback?;
+  private isPausedFlag;
+  constructor(eventBus: IEventBus, resolver: IDocumentModelResolver);
+  private toErrorInfo;
   /**
-   * Adds an item to the buffer. If the buffer is full, overwrites the oldest item.
-   *
-   * @param item - The item to add
+   * Creates a unique key for a document/scope/branch combination
    */
-  push(item: T): void;
+  private createQueueKey;
   /**
-   * Returns all items in the buffer in chronological order (oldest to newest).
-   *
-   * @returns Array of items in insertion order
+   * Gets or creates a queue for the given key
    */
-  getAll(): T[];
+  private getQueue;
   /**
-   * Clears all items from the buffer.
+   * Check if a document has any jobs currently executing
    */
-  clear(): void;
+  private isDocumentExecuting;
   /**
-   * Gets the current number of items in the buffer.
+   * Mark a job as executing for its document
    */
-  get length(): number;
-}
-//#endregion
-//#region src/cache/kysely-write-cache.d.ts
-type DocumentStream = {
-  key: string;
-  ringBuffer: RingBuffer<CachedSnapshot>;
-};
-/**
- * In-memory write cache with keyframe persistence for PHDocuments.
- *
- * Caches document snapshots in ring buffers with LRU eviction. On cache miss,
- * rebuilds documents from nearest keyframe or full operation history.
- *
- * **Performance Characteristics:**
- * - Cache hit: O(1) lookup in ring buffer
- * - Cold miss: O(n) where n is total operation count, or O(k) where k is operations since keyframe
- * - Warm miss: O(m) where m is operations since cached revision
- * - Eviction: O(1) for LRU tracking and removal
- *
- * **Thread Safety:**
- * Not thread-safe. Designed for single-threaded job executor environment.
- * External synchronization required for concurrent access across multiple executors.
- *
- * **Example:**
- * ```typescript
- * const cache = new KyselyWriteCache(
- *   keyframeStore,
- *   operationStore,
- *   registry,
- *   { maxDocuments: 1000, ringBufferSize: 10, keyframeInterval: 10 }
- * );
- *
- * await cache.startup();
- *
- * // Retrieve or rebuild document
- * const doc = await cache.getState(docId, docType, scope, branch, revision);
- *
- * // Cache result after job execution
- * cache.putState(docId, docType, scope, branch, newRevision, updatedDoc);
- *
- * await cache.shutdown();
- * ```
- */
-declare class KyselyWriteCache implements IWriteCache {
-  private streams;
-  private lruTracker;
-  private keyframeStore;
-  private operationStore;
-  private registry;
-  private config;
-  constructor(keyframeStore: IKeyframeStore, operationStore: IOperationStore, registry: IDocumentModelRegistry, config: WriteCacheConfig);
-  withScopedStores(operationStore: IOperationStore, keyframeStore: IKeyframeStore): KyselyWriteCache;
+  private markJobExecuting;
   /**
-   * Initializes the write cache.
-   * Currently a no-op as keyframe store lifecycle is managed externally.
+   * Mark a job as no longer executing for its document
    */
-  startup(): Promise<void>;
+  private markJobComplete;
   /**
-   * Shuts down the write cache.
-   * Currently a no-op as keyframe store lifecycle is managed externally.
+   * Check if all dependencies for a job have been completed
    */
-  shutdown(): Promise<void>;
+  private areDependenciesMet;
   /**
-   * Retrieves document state at a specific revision from cache or rebuilds it.
-   *
-   * Cache hit path: Returns cached snapshot if available (O(1))
-   * Warm miss path: Rebuilds from cached base revision + incremental ops
-   * Cold miss path: Rebuilds from keyframe or from scratch using all operations
+   * Returns the head of the sub-queue if its dependencies are met, or null.
    *
-   * @param documentId - The document identifier
-   * @param scope - The operation scope
-   * @param branch - The operation branch
-   * @param targetRevision - The target revision, or undefined for newest
-   * @param signal - Optional abort signal to cancel the operation
-   * @returns The document at the target revision
-   * @throws {Error} "Operation aborted" if signal is aborted
-   * @throws {ModuleNotFoundError} If document type not registered in registry
-   * @throws {Error} "Failed to rebuild document" if operation store fails
-   * @throws {Error} If reducer throws during operation application
-   * @throws {Error} If document serialization fails
+   * The dispatcher only ever considers the head — a dep-blocked head holds
+   * the rest of its sub-queue. This preserves per-(documentId, scope, branch)
+   * FIFO regardless of how dependencies are authored, and makes the queue's
+   * documented "serialized per document" invariant hold even when callers
+   * omit queueHint dependencies on jobs that share a sub-queue.
+   */
+  private getNextJobWithMetDependencies;
+  private getCreateDocumentType;
+  enqueue(job: Job): Promise<void>;
+  dequeue(documentId: string, scope: string, branch: string, signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
+  dequeueNext(signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
+  dequeueNextMatching(predicate: (meta: JobRoutingMeta) => boolean, signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
+  size(documentId: string, scope: string, branch: string): Promise<number>;
+  totalSize(): Promise<number>;
+  remove(jobId: string): Promise<boolean>;
+  clear(documentId: string, scope: string, branch: string): Promise<void>;
+  clearAll(): Promise<void>;
+  hasJobs(): Promise<boolean>;
+  completeJob(jobId: string): Promise<void>;
+  failJob(jobId: string, error?: ErrorInfo$1): Promise<void>;
+  deferJob(jobId: string): void;
+  retryJob(jobId: string, error?: ErrorInfo$1, accounting?: RetryAccounting): Promise<void>;
+  /**
+   * Check if the queue is drained and call the callback if it is
+   */
+  private checkDrained;
+  /**
+   * Returns true if and only if all jobs have been resolved.
    */
-  getState(documentId: string, scope: string, branch: string, targetRevision?: number, signal?: AbortSignal): Promise<PHDocument>;
+  get isDrained(): boolean;
   /**
-   * Stores a document snapshot in the cache at a specific revision.
-   *
-   * The cached document is a shallow copy of the input with its operation history
-   * truncated to the last operation per scope and its clipboard cleared. This keeps
-   * memory use and copy costs constant regardless of operation count. Consumers of
-   * getState() must not rely on the full operation history being present; the only
-   * guaranteed invariant is that operations[scope].at(-1) reflects the latest
-   * operation index for each scope.
-   *
-   * Updates LRU tracker and may evict least recently used stream if at capacity.
-   * Asynchronously persists keyframes at configured intervals (fire-and-forget).
-   *
-   * @param documentId - The document identifier
-   * @param scope - The operation scope
-   * @param branch - The operation branch
-   * @param revision - The revision number
-   * @param document - The document to cache
-   * @throws {Error} If document serialization fails
+   * Blocks the queue from accepting new jobs.
+   * @param onDrained - Optional callback to call when the queue is drained
    */
-  putState(documentId: string, scope: string, branch: string, revision: number, document: PHDocument): void;
+  block(onDrained?: () => void): void;
   /**
-   * Invalidates cached document streams.
-   *
-   * Supports three invalidation scopes:
-   * - Document-level: invalidate(documentId) - removes all streams for document
-   * - Scope-level: invalidate(documentId, scope) - removes all branches for scope
-   * - Stream-level: invalidate(documentId, scope, branch) - removes specific stream
-   *
-   * @param documentId - The document identifier
-   * @param scope - Optional scope to narrow invalidation
-   * @param branch - Optional branch to narrow invalidation (requires scope)
-   * @returns The number of streams evicted
+   * Unblocks the queue from accepting new jobs.
    */
-  invalidate(documentId: string, scope?: string, branch?: string): number;
+  unblock(): void;
   /**
-   * Clears the entire cache, removing all cached document streams.
-   * Resets LRU tracking state. This operation always succeeds.
+   * Pauses job dequeuing. Jobs can still be enqueued but dequeueNext() will return null.
    */
-  clear(): void;
+  pause(): void;
   /**
-   * Retrieves a specific stream for a document. Exposed on the implementation
-   * for testing, but not on the interface.
-   *
-   * @internal
+   * Resumes job dequeuing and emits JOB_AVAILABLE events for pending jobs to wake up executors.
    */
-  getStream(documentId: string, scope: string, branch: string): DocumentStream | undefined;
-  private findNearestKeyframe;
-  private coldMissRebuild;
+  resume(): Promise<void>;
   /**
-   * Resolves which module version to use for a given operation in phase 2.
-   *
-   * Uses the validated-upgrade boundary rules from D7:
-   * - If `input.revision` is present: op.index < revision[scope] → before the upgrade boundary
-   * - Otherwise: timestamp fallback
-   * - Falls back to final module version when neither is decidable
+   * Returns whether job dequeuing is paused.
    */
-  private resolveModuleVersionForOp;
-  private warmMissRebuild;
-  private findNearestOlderSnapshot;
-  private makeStreamKey;
-  private getOrCreateStream;
-  private isKeyframeRevision;
-}
-//#endregion
-//#region src/storage/kysely/store.d.ts
-declare class KyselyOperationStore implements IOperationStore {
-  private db;
-  private trx?;
-  constructor(db: Kysely<Database$1>);
-  private get queryExecutor();
-  withTransaction(trx: Transaction<Database$1>): KyselyOperationStore;
-  apply(documentId: string, documentType: string, scope: string, branch: string, revision: number, fn: (txn: AtomicTxn) => void | Promise<void>, signal?: AbortSignal): Promise<Operation[]>;
-  private resolveUniqueConstraint;
-  private executeApply;
-  private findIdempotentReplay;
-  getSince(documentId: string, scope: string, branch: string, revision: number, filter?: OperationFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Operation>>;
-  getSinceId(id: number, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<OperationWithContext$1>>;
-  getConflicting(documentId: string, scope: string, branch: string, minTimestamp: string, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Operation>>;
-  getRevisions(documentId: string, branch: string, signal?: AbortSignal): Promise<DocumentRevisions>;
-  private rowToOperation;
-  private rowToOperationWithContext;
+  get paused(): boolean;
+  /**
+   * Returns all pending jobs across all queues.
+   */
+  getPendingJobs(): Job[];
+  /**
+   * Returns a map of document IDs to sets of executing job IDs.
+   */
+  getExecutingJobIds(): Map<string, Set<string>>;
+  /**
+   * Returns a job by ID from the job index.
+   */
+  getJob(jobId: string): Job | undefined;
 }
 //#endregion
-//#region src/storage/kysely/keyframe-store.d.ts
-declare class KyselyKeyframeStore implements IKeyframeStore {
-  private db;
-  private trx?;
-  constructor(db: Kysely<Database$1>);
-  private get queryExecutor();
-  withTransaction(trx: Transaction<Database$1>): KyselyKeyframeStore;
-  putKeyframe(documentId: string, scope: string, branch: string, revision: number, document: PHDocument, signal?: AbortSignal): Promise<void>;
-  findNearestKeyframe(documentId: string, scope: string, branch: string, targetRevision: number, signal?: AbortSignal): Promise<{
-    revision: number;
-    document: PHDocument;
-  } | undefined>;
-  listKeyframes(documentId: string, scope?: string, branch?: string, signal?: AbortSignal): Promise<Array<{
-    scope: string;
-    branch: string;
-    revision: number;
-    document: PHDocument;
-  }>>;
-  deleteKeyframes(documentId: string, scope?: string, branch?: string, signal?: AbortSignal): Promise<number>;
+//#region src/job-tracker/in-memory-job-tracker.d.ts
+/**
+ * In-memory implementation of IJobTracker.
+ * Maintains job status in a Map for synchronous access.
+ * Subscribes to operation events to update job states.
+ */
+declare class InMemoryJobTracker implements IJobTracker {
+  private eventBus;
+  private jobs;
+  private unsubscribers;
+  constructor(eventBus: IEventBus);
+  private subscribeToEvents;
+  private handleWriteReady;
+  private handleReadReady;
+  private handleJobFailed;
+  shutdown(): void;
+  registerJob(jobInfo: JobInfo): void;
+  markRunning(jobId: string): void;
+  markFailed(jobId: string, error: ErrorInfo$1, job?: Job): void;
+  getJobStatus(jobId: string): JobInfo | null;
 }
 //#endregion
-//#region src/executor/execution-scope.d.ts
-interface ExecutionStores {
-  operationStore: IOperationStore;
-  operationIndex: IOperationIndex;
-  writeCache: IWriteCache;
-  documentMetaCache: IDocumentMetaCache;
-  collectionMembershipCache: ICollectionMembershipCache;
-}
-interface IExecutionScope {
-  run<T>(fn: (stores: ExecutionStores) => Promise<T>, signal?: AbortSignal): Promise<T>;
+//#region src/executor/simple-job-executor-manager.d.ts
+type JobExecutorFactory = () => IJobExecutor;
+/**
+ * Manages multiple job executors and coordinates job distribution.
+ * Listens for job available events and dispatches jobs to executors.
+ */
+declare class SimpleJobExecutorManager implements IJobExecutorManager {
+  private executorFactory;
+  private eventBus;
+  private queue;
+  private jobTracker;
+  private logger;
+  private resolver;
+  private executors;
+  private isRunning;
+  private activeJobs;
+  private totalJobsProcessed;
+  private unsubscribe?;
+  private deferredJobs;
+  private resultHandler;
+  private jobTimeoutMs;
+  constructor(executorFactory: JobExecutorFactory, eventBus: IEventBus, queue: IQueue, jobTracker: IJobTracker, logger: ILogger, resolver: IDocumentModelResolver, jobTimeoutMs?: number);
+  start(numExecutors: number): Promise<void>;
+  stop(graceful?: boolean): Promise<void>;
+  getExecutors(): IJobExecutor[];
+  getStatus(): ExecutorManagerStatus;
+  private processNextJob;
+  private checkForMoreJobs;
+  private processExistingJobs;
+  private flushDeferredJobs;
 }
 //#endregion
 //#region src/executor/simple-job-executor.d.ts
@@ -5079,6 +5244,8 @@ declare class SimpleJobExecutor implements IJobExecutor {
   private collectionMembershipCache;
   private driveContainerTypes;
   private config;
+  private featureFlags;
+  private decisionModel;
   private signatureVerifierModule;
   private documentActionHandler;
   private executionScope;
@@ -5091,6 +5258,62 @@ declare class SimpleJobExecutor implements IJobExecutor {
   private getCollectionMembershipsForOperations;
   private processActions;
   private executeRegularAction;
+  /**
+   * Orders a write by timestamp and decides it where it lands. The caller
+   * supplies the timestamp, so a write can belong before operations already
+   * stored; those are re-appended alongside it, the way a load reshuffles.
+   *
+   * Deciding a backdated write at the stream heads instead of at its position
+   * would overwrite the verdict every other replica computes for it.
+   */
+  private positionByTimestamp;
+  /**
+   * Decides each operation where it lands and carries the verdict on it. A
+   * refused submitted action is reported to the caller and nothing is stored; a
+   * refused operation the reshuffle merely moved keeps its verdict, because it
+   * already holds a position.
+   *
+   * The operations carry the indexes and skips they will be stored at, because
+   * the walk resolves skips before it orders them.
+   */
+  private evaluatePositioned;
+  /**
+   * The scopes a re-evaluation pass visits, in a fixed order.
+   *
+   * The revisions map comes from a query with no ORDER BY, and the order is
+   * load-bearing: each scope's pass re-reads the auth stream, and the walk skips
+   * an operation by its stored denial, so a denial this pass just wrote is
+   * visible to a later-visited scope and invisible to an earlier one. The model's
+   * own projection order leads, then the rest sorted, so the pass is reproducible
+   * across replicas and across runs.
+   */
+  private evaluationOrder;
+  /**
+   * The first timestamp in the batch that does not strictly exceed everything
+   * ahead of it, or undefined when the whole batch is monotonic.
+   *
+   * The bound is carried forward rather than compared against one stored maximum,
+   * because a single execute can carry several auth actions stamped in the same
+   * millisecond. Letting a tie through would store a stream the position walk
+   * then refuses to read, with no repair path.
+   */
+  private firstNonMonotonicTimestamp;
+  /** The operations a batch of submitted actions appends at the scope's tail. */
+  private appendedOperations;
+  /**
+   * Re-evaluates the document when a write meets both criteria: it was written
+   * to a stream the model reads, and it is timestamped before an operation
+   * already stored. The caller supplies the timestamp and the reactor does not replace
+   * it, so a mutation job can write such an operation just as a load job can,
+   * which is why both executeJob and executeLoadJob call this.
+   */
+  private reevaluateIfCriteriaMet;
+  /**
+   * Re-evaluates every scope the model evaluates. Where an operation's
+   * evaluation differs from what is stored, the tail from that operation is
+   * re-appended, carrying a skip that spans the indices it supersedes.
+   */
+  private reevaluateDocument;
   private executeLoadJob;
   private accumulateResultOrReturnError;
 }
@@ -5159,6 +5382,141 @@ declare class DocumentModelRegistry implements IDocumentModelRegistry {
   getUpgradeReducer(documentType: string, fromVersion: number, toVersion: number): UpgradeReducer<any, any>;
 }
 //#endregion
+//#region src/decision/types.d.ts
+/** One operation stream. */
+type StreamQuery = {
+  documentId: string;
+  branch: string;
+  scope: string;
+};
+/** The document and branch a decision model is built for. */
+type DecisionTarget = {
+  documentId: string;
+  branch: string;
+};
+/** The executing scope's own state, for conditions that read it. */
+type DecisionContext = {
+  scopeState: unknown;
+};
+/**
+ * A named stream whose value in the model is that scope's state from the
+ * document rebuild the reactor already performs. A derived query may read
+ * only statically-queried projections, so composition is one layer deep.
+ */
+type Projection<M> = {
+  query: StreamQuery | ((model: Partial<M>) => StreamQuery[]);
+  /**
+   * Action types in this stream that can change an evaluation. Reads of the stream
+   * are filtered to these, so anything left out is invisible to a decision.
+   */
+  decidingActions: string[]; /** Applies one of this stream's operations while deciding. */
+  apply: (document: PHDocument, operation: Operation) => PHDocument;
+};
+/**
+ * The outcome of evaluating one operation. A refusal carries the reason it is
+ * recorded with, because a model has more than one way to refuse.
+ */
+type Evaluation = {
+  decision: "allow";
+} | {
+  decision: "deny";
+  reason: string;
+};
+/** Projections plus a decision function over the built model. */
+type DecisionModel<M> = {
+  projections: { [K in keyof M]: Projection<M> };
+  /**
+   * Whether or not this model decides about operations in a given scope. That
+   * is, a scope it reads is not necessarily one it evaluates, and vise-versa.
+   */
+  evaluatesScope(scope: string): boolean;
+  decide(model: M, subject: AuthSubject, request: AuthRequest, ctx: DecisionContext): Evaluation;
+};
+/** A built model plus the read-set condition recording what the build read. */
+type BuiltDecisionModel<M> = {
+  model: M;
+  appendCondition: AppendCondition;
+};
+//#endregion
+//#region src/decision/build-decision-model.d.ts
+/**
+ * Reads each projection's stream through the write cache, recording the
+ * revision observed. Static projections resolve first; derived projections
+ * see only those and contribute a map from document id to state. Each
+ * distinct stream is read once and yields one append condition entry.
+ */
+declare function buildDecisionModel<M>(cache: IWriteCache, definition: (target: DecisionTarget) => DecisionModel<M>, target: DecisionTarget, signal?: AbortSignal): Promise<BuiltDecisionModel<M>>;
+//#endregion
+//#region src/decision/auth-decision-model.d.ts
+type AuthDecisionModel = {
+  document: PHDocumentState;
+  auth: PHAuthState;
+};
+/** This decision model uses both the document and the auth streams. */
+declare function authDecisionModel(target: DecisionTarget): DecisionModel<AuthDecisionModel>;
+//#endregion
+//#region src/decision/document-decision-model.d.ts
+/** What the document decision model reads: the target's document scope. */
+type DocumentDecisionModel = {
+  document: PHDocumentState;
+};
+/**
+ * The simplest decision model: one projection over the document scope, which
+ * rejects on a deleted document.
+ */
+declare function documentDecisionModel(target: DecisionTarget): DecisionModel<DocumentDecisionModel>;
+//#endregion
+//#region src/decision/registered-model.d.ts
+/**
+ * A model this reactor can register. Every one carries the document projection,
+ * because admission reads the version and the deletion timestamp off it; a model
+ * with more projections than that is still assignable here.
+ */
+type RegisteredDecisionModel = (target: DecisionTarget) => DecisionModel<DocumentDecisionModel>;
+/** What admission needs out of a model built at the stream heads. */
+type AdmissionDecision = {
+  evaluation: Evaluation;
+  appendCondition: AppendCondition;
+  documentVersion: number;
+  deletedAtUtcIso: string | null;
+};
+/**
+ * Builds the model at the stream heads and decides one request against it. The
+ * append condition it returns is the read-set the store enforces at write time.
+ */
+declare function decideAtHead(model: RegisteredDecisionModel, cache: IWriteCache, target: DecisionTarget, subject: AuthSubject, request: AuthRequest, signal?: AbortSignal): Promise<AdmissionDecision>;
+/**
+ * The model this reactor enforces. With `authEnforcement` off the auth scope is
+ * absent from every append condition and no load walks it.
+ */
+declare function selectDecisionModel(flags: ReactorFeatureFlags): RegisteredDecisionModel;
+//#endregion
+//#region src/decision/stream-order.d.ts
+/** Where a stream's stored order contradicts its timestamps. */
+type OutOfOrderPair = {
+  previous: Operation;
+  current: Operation;
+  /**
+   * `descending` cannot be walked at all. `tied` walks fine — the intra-stream
+   * rule breaks the tie by index — but violates the monotonic auth rule, so a
+   * stream holding one can never be replicated to a peer that lacks it.
+   */
+  kind: "descending" | "tied";
+};
+/**
+ * The first pair of effective operations whose stored order contradicts their
+ * timestamps, or undefined when the stream is in position order.
+ *
+ * Such a stream cannot be walked, and the auth stream is never reshuffled once
+ * the monotonic rule is on, so run this before enabling enforcement on a fleet.
+ *
+ * `requireStrict` additionally rejects a tie, which is what the auth stream's
+ * monotonic rule requires and what the walk alone does not care about.
+ */
+declare function firstOutOfOrderPair(operations: Operation[], options?: {
+  requireStrict?: boolean;
+}): OutOfOrderPair | undefined;
+//#endregion
 //#region src/read-models/base-read-model.d.ts
 type BaseReadModelConfig = {
   readModelId: string;
@@ -5243,7 +5601,7 @@ declare class KyselyDocumentIndexer extends BaseReadModel implements IDocumentIn
  * serialized so the executor can return to dispatch without holding ordering
  * implicitly.
  */
-declare class ReadModelCoordinator implements IReadModelCoordinator {
+declare class ReadModelCoordinator implements ILiveReadModelCoordinator {
   private eventBus;
   readonly preReady: IReadModel[];
   readonly postReady: IReadModel[];
@@ -5262,6 +5620,7 @@ declare class ReadModelCoordinator implements IReadModelCoordinator {
    */
   drain(): Promise<void>;
   getChainDepth(): number;
+  addReadModel(readModel: IReadModel, stage: ReadModelRegistrationStage): void;
   private handleWriteReady;
   private emitEmptyReadReady;
   private runChain;
@@ -5275,8 +5634,21 @@ declare class ReadModelCoordinator implements IReadModelCoordinator {
 type Database$2 = Database$1 & DocumentViewDatabase;
 declare class KyselyDocumentView extends BaseReadModel implements IDocumentView {
   private operationStore;
+  /**
+   * Whether a single-document read serves a deleted document's state as of the
+   * deletion rather than hiding it. Only meaningful with `documentDecisions`,
+   * which is what makes deletion positional. Listings omit it either way.
+   */
+  private readonly servesDeletionBoundary;
   private _db;
-  constructor(db: Kysely<Database$2>, operationStore: IOperationStore, operationIndex: IOperationIndex, writeCache: IWriteCache, consistencyTracker: IConsistencyTracker);
+  constructor(db: Kysely<Database$2>, operationStore: IOperationStore, operationIndex: IOperationIndex, writeCache: IWriteCache, consistencyTracker: IConsistencyTracker,
+  /**
+   * Whether a single-document read serves a deleted document's state as of the
+   * deletion rather than hiding it. Only meaningful with `documentDecisions`,
+   * which is what makes deletion positional. Listings omit it either way.
+   */
+
+  servesDeletionBoundary: boolean);
   protected commitOperations(items: OperationWithContext$1[]): Promise<void>;
   exists(documentIds: string[], consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<boolean[]>;
   get<TDocument extends PHDocument>(documentId: string, view?: ViewFilter$1, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<TDocument>;
@@ -5408,6 +5780,8 @@ declare class GqlRequestChannel implements IChannel {
   private isPushing;
   private pendingDrain;
   private receivingPages;
+  /** Cleared for good the first time the remote rejects {@link DECISION_FIELDS}. */
+  private peerServesDecisionFields;
   private isRecovering;
   private connectionState;
   /** Latest unrecoverable error was an auth rejection; cleared on connect. */
@@ -5454,6 +5828,18 @@ declare class GqlRequestChannel implements IChannel {
    * Queries the remote GraphQL endpoint for sync envelopes.
    */
   private pollSyncEnvelopes;
+  /**
+   * True when the remote rejected the query for naming a field it does not
+   * have. Selecting an unknown field fails validation for the whole query, so
+   * an unhandled one takes the channel's polling down until the process
+   * restarts rather than degrading.
+   */
+  private rejectsDecisionFields;
+  /**
+   * The poll query. `withDecisionFields` selects the two fields added with the
+   * auth projection; a remote on the previous schema is polled without them.
+   */
+  private pollQuery;
   /**
    * Registers or updates this channel on the remote server via GraphQL mutation.
    * Returns the remote's ack ordinal so the client can trim its outbox.
@@ -5616,6 +6002,18 @@ declare function batchOperationsByDocument(operations: OperationWithContext$1[])
  * jobId; all other jobIds are remapped so external dependencies still resolve.
  */
 declare function consolidateSyncOperations(syncOps: SyncOperation[]): SyncOperation[];
+/**
+ * Classifies a failure by error name rather than `instanceof`, because a failure
+ * that crossed the pooled-worker boundary arrives as plain data.
+ */
+declare function classifyJobFailure(errorName: string): SyncOperationErrorType;
+/** The explicit type when something else carried it, else derived by name. */
+declare function syncOperationErrorType(error: ChannelError | undefined): SyncOperationErrorType;
+/**
+ * A held auth operation must not quarantine: reconciling the two policies needs
+ * the traffic a quarantine would stop.
+ */
+declare function quarantinesDocument(errorType: SyncOperationErrorType): boolean;
 //#endregion
 //#region src/admin/types.d.ts
 type KeyframeValidationIssue = {
@@ -5631,11 +6029,20 @@ type SnapshotValidationIssue = {
   snapshotHash: string;
   replayedHash: string;
 };
+/** Effective operations whose stored order contradicts their timestamps. */
+type StreamOrderIssue = {
+  scope: string;
+  branch: string;
+  previous: Operation;
+  current: Operation;
+  kind: OutOfOrderPair["kind"];
+};
 type ValidationResult = {
   documentId: string;
   isConsistent: boolean;
   keyframeIssues: KeyframeValidationIssue[];
   snapshotIssues: SnapshotValidationIssue[];
+  streamOrderIssues: StreamOrderIssue[];
 };
 type RebuildResult = {
   documentId: string;
@@ -5659,6 +6066,7 @@ declare class DocumentIntegrityService implements IDocumentIntegrityService {
   validateDocument(documentId: string, branch?: string, signal?: AbortSignal): Promise<ValidationResult>;
   rebuildKeyframes(documentId: string, branch?: string, signal?: AbortSignal): Promise<RebuildResult>;
   rebuildSnapshots(documentId: string, branch?: string, signal?: AbortSignal): Promise<RebuildResult>;
+  private findStreamOrderIssues;
   private discoverScopes;
 }
 //#endregion
@@ -5707,5 +6115,5 @@ declare class ProcessorManager extends BaseReadModel implements IProcessorManage
   private deleteProcessorCursors;
 }
 //#endregion
-export { type AbortMessage, type AtomicTxn, type AttachmentHash, type AttachmentRef, BaseReadModel, type BatchExecutionRequest, type BatchExecutionResult, type BatchLoadRequest, type BatchLoadResult, type BuiltInReadModelKind, type CachedSnapshot, type ChannelConfig, ChannelError, ChannelErrorSource, type ChannelHealth, type ChannelMeta, ChannelScheme, type ConnectionState, type ConnectionStateChangeCallback, type ConnectionStateChangedEvent, type ConnectionStateSnapshot, type ConsistencyCoordinate, type ConsistencyKey, type ConsistencyToken, ConsistencyTracker, DEFAULT_DRIVE_CONTAINER_TYPES, DRIVE_AUTH_ERROR_MESSAGES, type Database, type DbConfig, type DeadLetterAddedEvent, DefaultSubscriptionErrorHandler, type DocumentChangeEvent, DocumentChangeType, type DocumentGraphEdge, type DocumentIndexerDatabase, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, type DocumentModelSource, type DocumentModelSpec, type DocumentRelationship, type DocumentRevisions, type DocumentStreamKey, type DocumentViewDatabase, DriveClient, DriveCollectionId, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, type ExecuteMessage, type ExecutionJobPlan, type ExecutorStartedEvent, type ExecutorStoppedEvent, type FactorySpec, type FileModelSource, type GqlChannelConfig, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, type HeartbeatMessage, type IChannel, type IChannelFactory, type IConsistencyTracker, type IDocumentGraph, type IDocumentIndexer, type IDocumentIntegrityService, type IDocumentModelLoader, type IDocumentModelRegistry, type IDocumentModelResolver, type IDocumentView, type IDriveClient, type IEventBus, type IJobAwaiter, type IJobExecutor, type IJobExecutorManager, type IJobTracker, type IKeyframeStore, type IMailbox, type IOperationIndex, type IOperationStore, type IPollTimer, type IProcessor, type IProcessorHostModule, type IProcessorManager, type IProjectionTransport, type IQueue, type IReactor, type IReactorClient, type IReactorSubscriptionManager, type IReadModel, type IReadModelCoordinator, type IRelationalDb, type ISubscriptionErrorHandler, type ISyncCursorStorage, type ISyncManager, type ISyncRemoteStorage, type ISyncStatusTracker, type IWriteCache, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, type InProcessReactorClientModule, type InProcessReactorModule, type InProcessSyncModule, type InitMessage, type InsertableDocumentSnapshot, IntervalPollTimer, InvalidModuleError, type Job, type JobAvailableEvent, JobAwaiter, type JobCompletedEvent, type JobExecutorConfig, JobExecutorEventTypes, type JobExecutorFactory, type JobFailedEvent, type JobInfo, type JobPendingEvent, type JobReadReadyEvent, type JobResult, type JobRunningEvent, type JobStartedEvent, JobStatus, type JobWriteReadyEvent, type JobWriteReadyPayload, type JwtHandler, type KeyframeSnapshot, type KeyframeValidationIssue, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, type LoadJobPlan, type LoadModelMessage, type LogMessage, Mailbox, type MetricsMessage, type ModelLoadFailedMessage, type ModelLoadedEvent, type ModelLoadedMessage, type ModelManifestEntry, ModuleNotFoundError, type ModuleRef, NullDocumentModelResolver, type OperationBatch, type OperationContext, type OperationFilter, type OperationIndexEntry, type OperationTable, type OperationWithContext, OptimisticLockError, type PackageModelSource, type PagedResults, type PagingOptions, type ParentMessage, type ParsedDriveUrl, type ParsedPaging, PollBehavior, PollingChannelError, type PoolInstrumentation, type PoolStats, type ProcessorApp, type ProcessorFactory, type ProcessorFactoryBuilder, type ProcessorFilter, ProcessorManager, type ProcessorRecord, type ProcessorStatus, type ProjectionShardBuilderConfig, type ProjectionShardManagerConfig, type ProjectionWorkerFactory, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, type ReactorClientModule, ReactorEventTypes, type ReactorFeatures, type JobFailedEvent$1 as ReactorJobFailedEvent, type ReactorModule, ReactorSubscriptionManager, type ReadModelBatchCompletedEvent, ReadModelCoordinator, type ReadModelFactory, type ReadModelFactoryDeps, type ReadModelIndexedEvent, type ReadModelIndexingStage, type ReadModelStage, type ReadyMessage, type RebuildResult, RelationalDbProcessor, RelationshipChangeType, type Remote, type RemoteCursor, type RemoteFilter, type RemoteMeta, type RemoteOptions, type RemoteRecord, type RemoteStatus, type ResultMessage, RevisionMismatchError, type SanitizedArg, type SearchFilter, type ShutdownMessage, type ShutdownStatus, type SignatureVerificationHandler, type SignatureVerifierSpec, type SignerConfig, SimpleJobExecutorManager, type SnapshotValidationIssue, type Database$1 as StorageDatabase, type SubscriptionErrorContext, SyncBuilder, type SyncEnvelope, type SyncEnvelopeType, SyncEventTypes, type SyncFailedEvent, type SyncModule, SyncOperation, SyncOperationAggregateError, type SyncOperationErrorType, SyncOperationStatus, type SyncPendingEvent, SyncStatus, type SyncStatusChangeCallback, SyncStatusTracker, type SyncSucceededEvent, type TrackedProcessor, type Unsubscribe, type ValidationResult, type ViewFilter, type ErrorInfo as WorkerErrorInfo, type WorkerMessage, type WorkerPoolConfig, type WorkerPoolOptions, type WriteCacheConfig, addRelationshipAction, batchOperationsByDocument, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createMutableShutdownStatus, createRelationalDb, deleteDocumentAction, documentActions, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, getMigrationStatus, instrumentPgPool, isDriveAuthError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, removeRelationshipAction, runMigrations, sanitizeArg, trimMailboxFromAckOrdinal, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
+export { APPEND_CONDITION_FAILED_PREFIX, type AbortMessage, type AdmissionDecision, type AppendCondition, AppendConditionFailedError, type AppendConditionStream, type AtomicTxn, type AttachmentHash, type AttachmentRef, type AuthDecisionModel, BaseReadModel, type BatchExecutionRequest, type BatchExecutionResult, type BatchLoadRequest, type BatchLoadResult, type BuiltDecisionModel, type BuiltInReadModelKind, type CachedSnapshot, type ChannelConfig, ChannelError, ChannelErrorSource, type ChannelHealth, type ChannelMeta, ChannelScheme, type ConnectionState, type ConnectionStateChangeCallback, type ConnectionStateChangedEvent, type ConnectionStateSnapshot, type ConsistencyCoordinate, type ConsistencyKey, type ConsistencyToken, ConsistencyTracker, DEFAULT_DRIVE_CONTAINER_TYPES, DRIVE_AUTH_ERROR_MESSAGES, type Database, type DbConfig, type DeadLetterAddedEvent, type DecisionContext, type DecisionModel, type DecisionTarget, DefaultSubscriptionErrorHandler, type DocumentChangeEvent, DocumentChangeType, type DocumentDecisionModel, type DocumentGraphEdge, type DocumentIndexerDatabase, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, type DocumentModelSource, type DocumentModelSpec, type DocumentRelationship, type DocumentRevisions, type DocumentStreamKey, type DocumentViewDatabase, DriveClient, DriveCollectionId, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, type Evaluation, EventBus, EventBusAggregateError, type ExecuteMessage, type ExecutionJobPlan, type ExecutorStartedEvent, type ExecutorStoppedEvent, type FactorySpec, type FileModelSource, type GqlChannelConfig, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, type HeartbeatMessage, type IChannel, type IChannelFactory, type IConsistencyTracker, type IDocumentGraph, type IDocumentIndexer, type IDocumentIntegrityService, type IDocumentModelLoader, type IDocumentModelRegistry, type IDocumentModelResolver, type IDocumentView, type IDriveClient, type IEventBus, type IJobAwaiter, type IJobExecutor, type IJobExecutorManager, type IJobTracker, type IKeyframeStore, type ILiveReadModelCoordinator, type IMailbox, type IOperationIndex, type IOperationStore, type IPollTimer, type IProcessor, type IProcessorHostModule, type IProcessorManager, type IProjectionTransport, type IQueue, type IReactor, type IReactorClient, type IReactorSubscriptionManager, type IReadModel, type IReadModelCoordinator, type IRelationalDb, type ISubscriptionErrorHandler, type ISyncCursorStorage, type ISyncManager, type ISyncRemoteStorage, type ISyncStatusTracker, type IWriteCache, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, type InProcessReactorClientModule, type InProcessReactorModule, type InProcessSyncModule, type InitMessage, type InsertableDocumentSnapshot, IntervalPollTimer, InvalidModuleError, type Job, type JobAvailableEvent, JobAwaiter, type JobCompletedEvent, type JobExecutorConfig, JobExecutorEventTypes, type JobExecutorFactory, type JobFailedEvent, type JobInfo, type JobPendingEvent, type JobReadReadyEvent, type JobResult, type JobRunningEvent, type JobStartedEvent, JobStatus, type JobWriteReadyEvent, type JobWriteReadyPayload, type JwtHandler, type KeyframeSnapshot, type KeyframeValidationIssue, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, type LoadJobPlan, type LoadModelMessage, type LogMessage, Mailbox, type MetricsMessage, type ModelLoadFailedMessage, type ModelLoadedEvent, type ModelLoadedMessage, type ModelManifestEntry, ModuleNotFoundError, type ModuleRef, NullDocumentModelResolver, type OperationBatch, type OperationContext, type OperationFilter, type OperationIndexEntry, type OperationTable, type OperationWithContext, OptimisticLockError, type OutOfOrderPair, type PackageModelSource, type PagedResults, type PagingOptions, type ParentMessage, type ParsedDriveUrl, type ParsedPaging, PollBehavior, PollingChannelError, type PoolInstrumentation, type PoolStats, type ProcessorApp, type ProcessorFactory, type ProcessorFactoryBuilder, type ProcessorFilter, ProcessorManager, type ProcessorRecord, type ProcessorStatus, type Projection, type ProjectionShardBuilderConfig, type ProjectionShardManagerConfig, type ProjectionWorkerFactory, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, type ReactorClientModule, ReactorEventTypes, type ReactorFeatureFlags, type ReactorFeatures, type JobFailedEvent$1 as ReactorJobFailedEvent, type ReactorModule, ReactorSubscriptionManager, type ReadModelBatchCompletedEvent, ReadModelCoordinator, type ReadModelFactory, type ReadModelFactoryDeps, type ReadModelIndexedEvent, type ReadModelIndexingStage, type ReadModelRegistrationStage, type ReadModelStage, type ReadyMessage, type RebuildResult, type RegisteredDecisionModel, RelationalDbProcessor, RelationshipChangeType, type Remote, type RemoteCursor, type RemoteFilter, type RemoteMeta, type RemoteOptions, type RemoteRecord, type RemoteStatus, type ResultMessage, RetryAccounting, RevisionMismatchError, type SanitizedArg, type SearchFilter, type ShutdownMessage, type ShutdownStatus, type SignatureVerificationHandler, type SignatureVerifierSpec, type SignerConfig, SimpleJobExecutorManager, type SnapshotValidationIssue, type Database$1 as StorageDatabase, type StreamOrderIssue, type StreamQuery, type SubscriptionErrorContext, SyncBuilder, type SyncEnvelope, type SyncEnvelopeType, SyncEventTypes, type SyncFailedEvent, type SyncModule, SyncOperation, SyncOperationAggregateError, type SyncOperationErrorType, SyncOperationStatus, type SyncPendingEvent, SyncStatus, type SyncStatusChangeCallback, SyncStatusTracker, type SyncSucceededEvent, type TrackedProcessor, type Unsubscribe, type ValidationResult, type ViewFilter, type ErrorInfo as WorkerErrorInfo, type WorkerMessage, type WorkerPoolConfig, type WorkerPoolOptions, type WriteCacheConfig, addRelationshipAction, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createMutableShutdownStatus, createRelationalDb, decideAtHead, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isDriveAuthError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, quarantinesDocument, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, supportsLiveReadModelRegistration, syncOperationErrorType, trimMailboxFromAckOrdinal, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
 //# sourceMappingURL=index.d.ts.map