@powerhousedao/reactor 6.2.2-dev.5 → 6.2.2-dev.50

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { Action, CreateDocumentActionInput, DocumentModelModule, ISigner, Operation, OperationContext, OperationWithContext, OperationWithContext as OperationWithContext$1, PHDocument, PHDocumentState, SignatureVerificationHandler, UpgradeDocumentActionInput, UpgradeManifest, UpgradeReducer, UpgradeTransition, actions as documentActions } from "@powerhousedao/shared/document-model";
+import { Action, AuthRequest, AuthSubject, CreateDocumentActionInput, DocumentModelModule, ISigner, Operation, OperationContext, OperationWithContext, OperationWithContext as OperationWithContext$1, PHAuthState, PHDocument, PHDocumentState, SignatureVerificationHandler, UpgradeDocumentActionInput, UpgradeManifest, UpgradeReducer, UpgradeTransition, actions as documentActions } from "@powerhousedao/shared/document-model";
 import { DocumentDriveDocument, DriveInput, FolderNode, Node } from "@powerhousedao/shared/document-drive";
 import { ILogger } from "document-model";
 import * as kysely from "kysely";
@@ -57,7 +57,14 @@ declare function updateRelationshipAction(sourceId: string, targetId: string, re
 declare function removeRelationshipAction(sourceId: string, targetId: string, relationshipType?: string): Action;
 //#endregion
 //#region src/queue/types.d.ts
-type JobKind = "mutation" | "load";
+/**
+ * What a job carries: a mutation applies actions, a load imports synced
+ * operations, and a reevaluation re-judges a document's stored operations
+ * because a read-set stream elsewhere (a group document) changed. A
+ * reevaluation job carries no actions or operations; its work is derived
+ * from what is already stored.
+ */
+type JobKind = "mutation" | "load" | "reevaluation";
 /**
  * State of a job in the queue
  */
@@ -69,6 +76,17 @@ declare enum JobQueueState {
   RUNNING = 3,
   RESOLVED = 4
 }
+/**
+ * How a retry is accounted against the job's retry limit.
+ * - `CountAgainstLimit` (default): a fault; the job eventually exhausts its
+ *   retries and fails terminally.
+ * - `ExemptFromLimit`: not a fault, so the attempt is not charged to the job.
+ *   Used for concurrency conflicts, where the retry does new work.
+ */
+declare enum RetryAccounting {
+  CountAgainstLimit = "count-against-limit",
+  ExemptFromLimit = "exempt-from-limit"
+}
 /**
  * Interface for a job execution handle
  */
@@ -127,9 +145,14 @@ type JobAvailableEvent = {
 //#endregion
 //#region src/shared/types.d.ts
 /**
- * Information about an error including message and stack trace.
+ * Information about an error including its name, message and stack trace.
+ *
+ * The name is what survives the crossing out of the executor: a consumer that
+ * has to tell a terminal failure from a retryable one, or classify a dead
+ * letter, only ever sees this record rather than the thrown error.
  */
 type ErrorInfo$1 = {
+  name: string;
   message: string;
   stack: string;
 };
@@ -230,6 +253,11 @@ type ViewFilter = {
   branch?: string;
   scopes?: string[];
   revision?: number;
+  /**
+   * Read subject for the IReactorClient read gate; defaults to the client's
+   * signer. Set per request when serving many principals. Ignored by IReactor.
+   */
+  subject?: AuthSubject;
 };
 /**
  * Describes filter options for searching documents.
@@ -328,6 +356,16 @@ interface IReadModelCoordinator {
    */
   getChainDepth(): number;
 }
+type ReadModelRegistrationStage = "pre_ready" | "post_ready";
+/**
+ * Optional capability exposed by coordinators that support adding read models
+ * after construction. Custom and remote coordinators are not required to
+ * implement it.
+ */
+interface ILiveReadModelCoordinator extends IReadModelCoordinator {
+  addReadModel(readModel: IReadModel, stage: ReadModelRegistrationStage): void;
+}
+declare function supportsLiveReadModelRegistration(coordinator: IReadModelCoordinator): coordinator is ILiveReadModelCoordinator;
 //#endregion
 //#region src/sync/types.d.ts
 declare enum ChannelScheme {
@@ -398,7 +436,13 @@ declare enum ChannelErrorSource {
   Inbox = "inbox",
   Outbox = "outbox"
 }
-type SyncOperationErrorType = "SIGNATURE_INVALID" | "HASH_MISMATCH" | "LIBRARY_ERROR" | "MISSING_OPERATIONS" | "EXCESSIVE_SHUFFLE" | "GRACEFUL_ABORT";
+type SyncOperationErrorType = "SIGNATURE_INVALID" | "HASH_MISMATCH" | "LIBRARY_ERROR" | "MISSING_OPERATIONS" | "EXCESSIVE_SHUFFLE" | "GRACEFUL_ABORT"
+/**
+ * An arriving auth operation did not exceed the local auth head. Exempt from
+ * quarantine, because reconciling the two policies needs the traffic a
+ * quarantine would stop.
+ */
+| "AUTH_TIMESTAMP_NOT_MONOTONIC" /** An arriving operation carried a timestamp that is not an ISO-8601 instant. */ | "INVALID_TIMESTAMP" /** No classification applies, including rows written before the field. */ | "UNCLASSIFIED";
 type ChannelHealth = {
   state: "idle" | "running" | "error";
   lastSuccessUtcMs?: number;
@@ -491,6 +535,7 @@ type DeadLetterAddedEvent = {
   remoteName: string;
   documentId: string;
   errorSource: ChannelErrorSource;
+  errorType: SyncOperationErrorType;
 };
 /**
  * Status of a sync operation result.
@@ -537,6 +582,36 @@ declare class OptimisticLockError extends Error {
 declare class RevisionMismatchError extends Error {
   constructor(expected: number, actual: number);
 }
+/**
+ * One read-set stream and the highest operation index observed on it, or -1
+ * if it was observed empty.
+ */
+type AppendConditionStream = {
+  documentId: string;
+  scope: string;
+  branch: string;
+  revision: number;
+};
+/**
+ * A read-set enforced by {@link IOperationStore.apply}: the append fails if
+ * any stream has operations past its recorded revision.
+ */
+type AppendCondition = {
+  streams: AppendConditionStream[];
+};
+/** Error history keeps messages, not classes, so failures match by prefix. */
+declare const APPEND_CONDITION_FAILED_PREFIX = "Append condition failed: ";
+/**
+ * A read-set stream grew before the append committed. A concurrency
+ * conflict, not a fault: the caller retries against the new stream heads.
+ */
+declare class AppendConditionFailedError extends Error {
+  readonly condition: AppendCondition;
+  constructor(condition: AppendCondition);
+  static isError(error: unknown): error is AppendConditionFailedError;
+  /** True when a recorded error message is an append-condition failure. */
+  static isFailureMessage(message: string): boolean;
+}
 /**
  * A write transaction passed to {@link IOperationStore.apply}. Accumulates
  * operations that are committed atomically when the callback returns.
@@ -550,7 +625,7 @@ interface AtomicTxn {
  * revision field and lastModified timestamp.
  */
 type DocumentRevisions = {
-  /** Map of scope to operation index for that scope */revision: Record<string, number>; /** Latest timestamp across revisions */
+  /** Map of scope to operation index for that scope */revision: Record<string, number>; /** The largest operation timestamp in the document, across every scope. */
   latestTimestamp: string;
 };
 /**
@@ -571,6 +646,12 @@ interface IOperationStore {
    * returned instead of throwing. If no matching stored row is found, the
    * original error is propagated unchanged.
    *
+   * With an {@link AppendCondition}, the append additionally fails with
+   * {@link AppendConditionFailedError} — writing nothing — if any read-set
+   * stream has operations past its recorded revision. The written and
+   * read-set streams are advisory-locked in sorted key order, so concurrent
+   * conditional appends on overlapping streams serialize.
+   *
    * @param documentId - The document id
    * @param documentType - The document type identifier
    * @param scope - The operation scope (e.g. "global", "local")
@@ -578,9 +659,10 @@ interface IOperationStore {
    * @param revision - Expected current revision (optimistic lock)
    * @param fn - Callback that stages operations via {@link AtomicTxn}
    * @param signal - Optional abort signal to cancel the request
+   * @param condition - Optional read-set to enforce at write time
    * @returns The stored operations; empty array when no operations were staged
    */
-  apply(documentId: string, documentType: string, scope: string, branch: string, revision: number, fn: (txn: AtomicTxn) => void | Promise<void>, signal?: AbortSignal): Promise<Operation[]>;
+  apply(documentId: string, documentType: string, scope: string, branch: string, revision: number, fn: (txn: AtomicTxn) => void | Promise<void>, signal?: AbortSignal, condition?: AppendCondition): Promise<Operation[]>;
   /**
    * Returns operations for a document/scope/branch whose index is greater
    * than the given revision.
@@ -627,6 +709,16 @@ interface IOperationStore {
    * @returns Object containing revision map and latest timestamp
    */
   getRevisions(documentId: string, branch: string, signal?: AbortSignal): Promise<DocumentRevisions>;
+  /**
+   * The largest operation timestamp in one stream, or undefined when it is empty.
+   * Distinct from {@link DocumentRevisions.latestTimestamp}, which maxes over
+   * every scope.
+   *
+   * Must be a real maximum, not the last-indexed operation's timestamp: a
+   * re-evaluation pass re-appends at a fresh index while keeping the original
+   * timestamp, so a later timestamp can sit behind the last row.
+   */
+  getStreamLatestTimestamp(documentId: string, scope: string, branch: string, signal?: AbortSignal): Promise<string | undefined>;
 }
 /**
  * Stores periodic document snapshots (keyframes) so that document state
@@ -1045,7 +1137,8 @@ type DeadLetterRecord = {
   branch: string;
   operations: OperationWithContext$1[];
   errorSource: ChannelErrorSource;
-  errorMessage: string;
+  errorMessage: string; /** Why it failed, in the closed set sync classifies failures into. */
+  errorType: SyncOperationErrorType;
 };
 /**
  * Persists dead-lettered sync operations so they survive reactor restarts.
@@ -1103,6 +1196,15 @@ interface IOperationIndexTxn {
   createCollection(collectionId: string): void;
   addToCollection(collectionId: string, documentId: string): void;
   removeFromCollection(collectionId: string, documentId: string): void;
+  /**
+   * Records the group documents an auth operation's input names, tied to the
+   * last written operation like addToCollection. At commit each reference is
+   * remembered permanently and the group joins every collection the
+   * referencing document belongs to, keeping the earliest join and reopening
+   * a closed membership, so sync serves the group's history to every remote
+   * that can observe the referencing grant.
+   */
+  recordGroupReferences(documentId: string, groupIds: string[]): void;
   write(operations: OperationIndexEntry[]): void;
 }
 /**
@@ -1124,6 +1226,13 @@ interface IOperationIndex {
    * Returns a map of documentId to array of collection IDs.
    */
   getCollectionsForDocuments(documentIds: string[]): Promise<Record<string, string[]>>;
+  /**
+   * The documents whose auth history has ever referenced the group, from the
+   * group-reference relation. This is the set a group-stream change owes a
+   * re-evaluation pass to; it is complete because a group's auth scope cannot
+   * reference other groups.
+   */
+  getGroupReferencers(groupId: string, signal?: AbortSignal): Promise<string[]>;
 }
 /**
  * Identifies the collection a remote synchronizes. Collections are drive-level
@@ -1152,6 +1261,51 @@ declare class DriveCollectionId {
   equals(other: DriveCollectionId): boolean;
 }
 //#endregion
+//#region src/cache/write-cache-types.d.ts
+/**
+ * Configuration options for the write cache
+ */
+type WriteCacheConfig = {
+  /** Maximum number of document streams to cache (LRU eviction). Default: 1000 */maxDocuments: number; /** Number of snapshots to keep in each document's ring buffer. Default: 10 */
+  ringBufferSize: number; /** Persist a keyframe snapshot every N revisions. Default: 10 */
+  keyframeInterval: number;
+};
+/**
+ * Unique identifier for a document stream
+ */
+type DocumentStreamKey = {
+  /** Document identifier */documentId: string; /** Operation scope */
+  scope: string; /** Branch name */
+  branch: string;
+};
+/**
+ * Where a snapshot sits in its stream.
+ *
+ * - `Head`: the newest revision of the stream when it was stored. Only these
+ *   can answer a read that asks for the head.
+ * - `Historical`: state at an earlier revision. Usable as a starting point to
+ *   replay forward from, and as an answer to a read for that same revision.
+ */
+declare enum SnapshotPosition {
+  Head = "head",
+  Historical = "historical"
+}
+/**
+ * A cached document snapshot at a specific revision
+ */
+type CachedSnapshot = {
+  /** The revision number of this snapshot */revision: number; /** The document state at this revision */
+  document: PHDocument; /** Where this snapshot sat in the stream when it was stored */
+  position: SnapshotPosition;
+};
+/**
+ * Serialized keyframe snapshot for K/V store persistence
+ */
+type KeyframeSnapshot = {
+  /** The revision number of this keyframe */revision: number; /** Serialized document state */
+  document: string;
+};
+//#endregion
 //#region src/cache/write/interfaces.d.ts
 /**
  * IWriteCache is a write-side projection that optimizes document state retrieval
@@ -1166,7 +1320,8 @@ interface IWriteCache {
    * @param documentId - The document identifier
    * @param scope - Operation scope
    * @param branch - Branch name
-   * @param targetRevision - The exact revision to retrieve (optional, defaults to latest)
+   * @param targetRevision - Index of the last operation to apply, defaulting
+   *   to latest. An operation index, never `header.revision[scope]`.
    * @param signal - Optional abort signal to cancel the operation
    * @returns The complete document at the specified revision
    *
@@ -1192,15 +1347,19 @@ interface IWriteCache {
    * @param documentId - The document identifier
    * @param scope - Operation scope
    * @param branch - Branch name
-   * @param revision - The revision this document represents
+   * @param revision - Index of the last operation this document reflects, so
+   *   `header.revision[scope]` is one greater. -1 for an empty scope.
    * @param document - The document to cache
+   * @param position - Whether `revision` is the stream's head. Nothing checks
+   *   it: claiming `Head` for an earlier revision makes a getState() with no
+   *   target return stale state.
    *
    * @example
    * ```typescript
-   * cache.putState(docId, 'global', 'main', 42, document);
+   * cache.putState(docId, 'global', 'main', 42, document, SnapshotPosition.Head);
    * ```
    */
-  putState(documentId: string, scope: string, branch: string, revision: number, document: PHDocument): void;
+  putState(documentId: string, scope: string, branch: string, revision: number, document: PHDocument, position: SnapshotPosition): void;
   /**
    * Invalidates (removes) cached entries for a document stream.
    *
@@ -1531,6 +1690,17 @@ type CreateDocumentOptions = {
   /** Optional "id" or "slug" of parent document */parentIdentifier?: string; /** Optional version of the document model to use (defaults to latest) */
   documentModelVersion?: number;
 };
+/**
+ * Options for upgrading a document.
+ */
+type UpgradeDocumentOptions = {
+  /**
+   * How many times to retry with a fresh read when the executor rejects the
+   * upgrade because the document changed after it was read. Defaults to
+   * {@link DEFAULT_UPGRADE_CONFLICT_RETRIES}.
+   */
+  maxConflictRetries?: number;
+};
 /**
  * Drive-aware operations grouped under `client.drives`.
  *
@@ -1646,7 +1816,7 @@ interface IReactorClient {
    * @param signal - Optional abort signal to cancel the request
    * @returns The canonical document id
    */
-  resolveIdOrSlug(identifier: string, signal?: AbortSignal): Promise<string>;
+  resolveIdOrSlug(identifier: string, view?: ViewFilter, signal?: AbortSignal): Promise<string>;
   /**
    * Retrieves operations for a document.
    *
@@ -1707,6 +1877,38 @@ interface IReactorClient {
    * @param signal - Optional abort signal to cancel the request
    */
   createEmpty<TDocument extends PHDocument>(documentModelType: string, options?: CreateDocumentOptions, signal?: AbortSignal): Promise<TDocument>;
+  /**
+   * Retrieves the document model module matching the version a document is
+   * stamped with. Use this instead of {@link getDocumentModelModule}
+   * whenever a specific document is in hand: the latest-wins lookup feeds
+   * not-yet-upgraded documents the wrong reducer, diverging from replay.
+   *
+   * @param document - The document whose stamped version selects the module
+   * @returns The document model module registered for that version
+   * @throws UnsupportedDocumentModelVersionError if no module is registered for the stamped version
+   */
+  getDocumentModelModuleForDocument(document: PHDocument): Promise<DocumentModelModule<any>>;
+  /**
+   * Upgrades a document to a newer document model version by dispatching an
+   * UPGRADE_DOCUMENT action. When toVersion is omitted, upgrades to the
+   * latest registered module version for the document's type. Returns the
+   * document unchanged when it is already at the target version.
+   *
+   * The action carries a snapshot of the document's version and per-scope
+   * revisions, which the executor validates before persisting. When an edit
+   * lands between the read and the upgrade executing, the upgrade is
+   * rejected and retried with a fresh read up to
+   * {@link UpgradeDocumentOptions.maxConflictRetries} times before the
+   * conflict is surfaced.
+   *
+   * @param documentIdentifier - Target document id or slug
+   * @param toVersion - Optional target document model version; defaults to latest
+   * @param options - Optional upgrade options (maxConflictRetries)
+   * @param signal - Optional abort signal to cancel the request
+   * @returns The upgraded document
+   * @throws DowngradeNotSupportedError if toVersion is less than the document's current version
+   */
+  upgradeDocument<TDocument extends PHDocument = PHDocument>(documentIdentifier: string, toVersion?: number, options?: UpgradeDocumentOptions, signal?: AbortSignal): Promise<TDocument>;
   /**
    * Creates an empty document in a drive as a single batched operation.
    * This is more efficient than createEmpty + addFile as it batches all
@@ -1863,222 +2065,255 @@ interface IReactorClient {
   subscribe(search: SearchFilter, callback: (event: DocumentChangeEvent) => void, view?: ViewFilter): () => void;
 }
 //#endregion
-//#region src/client/reactor-client.d.ts
+//#region src/cache/collection-membership-cache.d.ts
+interface ICollectionMembershipCache {
+  getCollectionsForDocuments(documentIds: string[]): Promise<Record<string, string[]>>;
+  invalidate(documentId: string): void;
+}
+//#endregion
+//#region src/cache/document-meta-cache-types.d.ts
 /**
- * ReactorClient implementation that wraps lower-level APIs to provide
- * a simpler interface for document operations.
+ * Cached document metadata from the "document" scope.
  *
- * Features:
- * - Wraps Jobs with Promises for easier async handling
- * - Manages signing of submitted Action objects
- * - Provides quality-of-life functions for common tasks
- * - Wraps subscription interface with ViewFilters
+ * This lightweight structure holds essential document information needed by
+ * the job executor without fetching full scope state. It provides an explicit
+ * cross-scope contract for accessing document scope metadata.
  */
-declare class ReactorClient implements IReactorClient {
-  private logger;
-  private reactor;
-  private signer;
-  private subscriptionManager;
-  private jobAwaiter;
-  private documentIndexer;
-  private documentView;
-  readonly drives: IDriveClient;
-  constructor(logger: ILogger, reactor: IReactor, signer: ISigner, subscriptionManager: IReactorSubscriptionManager, jobAwaiter: IJobAwaiter, documentIndexer: IDocumentIndexer, documentView: IDocumentView);
-  /**
-   * Retrieves a list of document model modules.
-   */
-  getDocumentModelModules(namespace?: string, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<DocumentModelModule>>;
-  /**
-   * Retrieves a specific document model module by document type.
-   *
-   * @param documentType - The document type identifier
-   * @returns The document model module
-   */
-  getDocumentModelModule(documentType: string): Promise<DocumentModelModule<any>>;
-  /**
-   * Retrieves a specific PHDocument
-   */
-  get<TDocument extends PHDocument>(identifier: string, view?: ViewFilter, signal?: AbortSignal): Promise<TDocument>;
-  /**
-   * Resolves an identifier (id or slug) to the canonical document id, using the
-   * same lookup as the data path. Resolves against the "main" branch. Throws if
-   * the identifier cannot be resolved or is ambiguous.
-   */
-  resolveIdOrSlug(identifier: string, signal?: AbortSignal): Promise<string>;
-  /**
-   * Retrieves operations for a document
-   */
-  getOperations(documentIdentifier: string, view?: ViewFilter, filter?: OperationFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Operation>>;
-  private getOperationsWithCompositeCursor;
-  /**
-   * Retrieves outgoing relationships of a given type from a source document.
-   */
-  getOutgoingRelationships(sourceIdentifier: string, relationshipType: string, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
-  /**
-   * Retrieves incoming relationships of a given type to a target document.
-   */
-  getIncomingRelationships(targetIdentifier: string, relationshipType: string, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
+type CachedDocumentMeta = {
   /**
-   * Filters documents by criteria and returns a list of them
+   * The full PHDocumentState from document.state.document.
+   * Contains version, hash, isDeleted, deletedAtUtcIso, etc.
    */
-  find(search: SearchFilter, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
+  state: PHDocumentState;
   /**
-   * Creates a document and waits for completion
+   * The document type (from header), cached for convenience.
    */
-  create<TDocument extends PHDocument = PHDocument>(document: PHDocument, parentIdentifier?: string, signal?: AbortSignal): Promise<TDocument>;
+  documentType: string;
   /**
-   * Creates an empty document and waits for completion
+   * The revision of the document scope when this metadata was captured.
+   * Used for cache invalidation and consistency checks.
    */
-  createEmpty<TDocument extends PHDocument>(documentModelType: string, options?: CreateDocumentOptions, signal?: AbortSignal): Promise<TDocument>;
+  documentScopeRevision: number;
+};
+/**
+ * Interface for the document metadata cache.
+ *
+ * This cache provides an explicit cross-scope contract for accessing document
+ * scope metadata. It solves the problem where job execution in one scope (e.g.,
+ * "global") needs access to document scope state (version, isDeleted, etc.)
+ * which may be stale in scope-specific caches or keyframes.
+ *
+ * The cache supports:
+ * - Latest metadata retrieval with LRU caching
+ * - Historical metadata reconstruction for reshuffling scenarios
+ * - Eager updates after document scope operations
+ */
+interface IDocumentMetaCache {
   /**
-   * Creates an empty document in a drive as a single batched operation.
-   * Delegates to {@link IDriveClient.addFile}.
+   * Retrieves the LATEST document metadata from cache or rebuilds from operations.
    *
-   * @deprecated Use `client.drives.addFile` instead. This method will be
-   * removed in a future release.
-   */
-  createDocumentInDrive<TDocument extends PHDocument>(driveId: string, document: PHDocument, parentFolder?: string, signal?: AbortSignal): Promise<TDocument>;
-  /**
-   * Applies a list of actions to a document and waits for completion
-   */
-  execute<TDocument extends PHDocument>(documentIdentifier: string, branch: string, actions: Action[], signal?: AbortSignal): Promise<TDocument>;
-  /**
-   * Submits a list of actions to a document
+   * On cache miss, fetches all document scope operations and reconstructs the
+   * current PHDocumentState by applying UPGRADE_DOCUMENT and DELETE_DOCUMENT
+   * operations.
+   *
+   * @param documentId - The document identifier
+   * @param branch - Branch name
+   * @param signal - Optional abort signal to cancel the operation
+   * @returns The cached or rebuilt document metadata
+   * @throws {Error} "Operation aborted" if signal is aborted
+   * @throws {Error} If document not found (no CREATE_DOCUMENT operation)
    */
-  executeAsync(documentIdentifier: string, branch: string, actions: Action[], signal?: AbortSignal): Promise<JobInfo>;
-  executeBatch(request: BatchExecutionRequest, signal?: AbortSignal): Promise<BatchExecutionResult>;
+  getDocumentMeta(documentId: string, branch: string, signal?: AbortSignal): Promise<CachedDocumentMeta>;
   /**
-   * Renames a document and waits for completion
+   * Rebuilds document metadata at a SPECIFIC revision (always rebuilds, no caching).
+   *
+   * Used during reshuffling when operations need to be inserted at a previous
+   * revision and we need the document scope state as of that point in time.
+   *
+   * @param documentId - The document identifier
+   * @param branch - Branch name
+   * @param targetRevision - The document scope revision to reconstruct up to
+   * @param signal - Optional abort signal to cancel the operation
+   * @returns Document metadata as of the target revision
+   * @throws {Error} "Operation aborted" if signal is aborted
+   * @throws {Error} If document not found
    */
-  rename(documentIdentifier: string, name: string, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
+  rebuildAtRevision(documentId: string, branch: string, targetRevision: number, signal?: AbortSignal): Promise<CachedDocumentMeta>;
   /**
-   * Updates the preferred editor recorded in the document header meta.
-   * Pass `null` to clear it.
+   * Eagerly updates cached metadata after document scope operations.
+   *
+   * Called by the job executor after CREATE_DOCUMENT, UPGRADE_DOCUMENT, or
+   * DELETE_DOCUMENT operations to keep the cache current.
+   *
+   * @param documentId - The document identifier
+   * @param branch - Branch name
+   * @param meta - The new metadata to cache
    */
-  setPreferredEditor(documentIdentifier: string, preferredEditor: string | null, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
+  putDocumentMeta(documentId: string, branch: string, meta: CachedDocumentMeta): void;
   /**
-   * Adds multiple documents as children to another and waits for completion
+   * Invalidates cached document metadata.
+   *
+   * Call before reshuffling operations that modify the document scope, or
+   * when document state may have changed externally.
+   *
+   * @param documentId - The document identifier
+   * @param branch - Optional branch to narrow invalidation (if omitted, all branches)
+   * @returns Number of entries invalidated
    */
-  addRelationship(sourceIdentifier: string, targetIdentifier: string, relationshipType: string, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
+  invalidate(documentId: string, branch?: string): number;
   /**
-   * Removes a relationship between two documents and waits for completion.
+   * Clears all cached document metadata.
    */
-  removeRelationship(sourceIdentifier: string, targetIdentifier: string, relationshipType: string, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
+  clear(): void;
   /**
-   * Moves a relationship from one source document to another and waits for completion.
+   * Performs startup initialization.
    */
-  moveRelationship(sourceParentIdentifier: string, targetParentIdentifier: string, targetIdentifier: string, relationshipType: string, branch?: string, signal?: AbortSignal): Promise<{
-    source: PHDocument;
-    target: PHDocument;
-  }>;
-  loadBatch(request: BatchLoadRequest, signal?: AbortSignal): Promise<BatchLoadResult>;
+  startup(): Promise<void>;
   /**
-   * Deletes a document and waits for completion
+   * Performs graceful shutdown.
    */
-  deleteDocument(identifier: string, propagate?: PropagationMode, signal?: AbortSignal): Promise<void>;
-  /**
-   * Deletes documents and waits for completion
-   */
-  deleteDocuments(identifiers: string[], propagate?: PropagationMode, signal?: AbortSignal): Promise<void>;
-  /**
-   * Retrieves the status of a job
-   */
-  getJobStatus(jobId: string, signal?: AbortSignal): Promise<JobInfo>;
-  /**
-   * Waits for a job to complete
-   */
-  waitForJob(jobId: string | JobInfo, signal?: AbortSignal): Promise<JobInfo>;
-  /**
-   * Subscribes to changes for documents matching specified filters
-   */
-  subscribe(search: SearchFilter, callback: (event: DocumentChangeEvent) => void, view?: ViewFilter): () => void;
-  private removeAllIncomingRelationships;
+  shutdown(): Promise<void>;
 }
 //#endregion
-//#region src/executor/types.d.ts
-/**
- * Represents the result of a job execution
- */
-type JobResult = {
-  /** The job that was executed */job: Job; /** Whether the job executed successfully */
-  success: boolean; /** Error if the job failed */
-  error?: Error; /** The operations generated from the actions (if successful) */
-  operations?: Operation[];
-  /**
-   * Operations with context (includes ephemeral resultingState).
-   * Used for emitting to IDocumentView via event bus.
-   */
-  operationsWithContext?: OperationWithContext$1[]; /** Timestamp when the job execution completed */
-  completedAt?: string; /** Duration of job execution in milliseconds */
-  duration?: number; /** Any additional metadata from the execution */
-  metadata?: Record<string, any>;
-};
-/**
- * Configuration options for the job executor
- */
-type JobExecutorConfig = {
-  /** Maximum number of conflicting operations to skip when reshuffling. */maxSkipThreshold?: number; /** Maximum number of concurrent jobs to execute */
-  maxConcurrency?: number; /** Maximum time in milliseconds a job can run before being considered timed out */
-  jobTimeoutMs?: number; /** Base delay in milliseconds for exponential backoff retries */
-  retryBaseDelayMs?: number; /** Maximum delay in milliseconds for exponential backoff retries */
-  retryMaxDelayMs?: number;
-  /** Maximum elapsed milliseconds before yielding to the main thread between actions.
-   *  Keeps the UI responsive when processing large batches. */
-  yieldDeadlineMs?: number;
-};
-/**
- * Event types for the job executor
- */
-declare const JobExecutorEventTypes: {
-  readonly JOB_STARTED: 20000;
-  readonly JOB_COMPLETED: 20001;
-  readonly JOB_FAILED: 20002;
-  readonly EXECUTOR_STARTED: 20003;
-  readonly EXECUTOR_STOPPED: 20004;
-};
+//#region src/storage/kysely/types.d.ts
+interface OperationTable {
+  id: Generated<number>;
+  jobId: string;
+  opId: string;
+  prevOpId: string;
+  writeTimestampUtcMs: Generated<Date>;
+  documentId: string;
+  documentType: string;
+  scope: string;
+  branch: string;
+  timestampUtcMs: Date;
+  index: number;
+  action: unknown;
+  skip: number;
+  error?: string | null;
+  deniedReason?: string | null;
+  hash: string;
+}
+interface KeyframeTable {
+  id: Generated<number>;
+  documentId: string;
+  documentType: string;
+  scope: string;
+  branch: string;
+  revision: number;
+  document: unknown;
+  createdAt: Generated<Date>;
+}
+interface DocumentCollectionTable {
+  documentId: string;
+  collectionId: string;
+  joinedOrdinal: bigint;
+  leftOrdinal: bigint | null;
+}
+interface OperationIndexOperationTable {
+  ordinal: Generated<number>;
+  opId: string;
+  documentId: string;
+  documentType: string;
+  scope: string;
+  branch: string;
+  timestampUtcMs: string;
+  writeTimestampUtcMs: Generated<Date>;
+  index: number;
+  skip: number;
+  hash: string;
+  action: unknown;
+  deniedReason?: string | null;
+  sourceRemote: Generated<string>;
+}
+interface SyncRemoteTable {
+  name: string;
+  collection_id: string;
+  channel_type: string;
+  channel_id: string;
+  remote_name: string;
+  channel_parameters: unknown;
+  filter_document_ids: unknown;
+  filter_scopes: unknown;
+  filter_branch: string;
+  push_state: string;
+  push_last_success_utc_ms: string | null;
+  push_last_failure_utc_ms: string | null;
+  push_failure_count: number;
+  pull_state: string;
+  pull_last_success_utc_ms: string | null;
+  pull_last_failure_utc_ms: string | null;
+  pull_failure_count: number;
+  created_at: Generated<Date>;
+  updated_at: Generated<Date>;
+}
+interface SyncCursorTable {
+  remote_name: string;
+  cursor_type: string;
+  cursor_ordinal: bigint;
+  last_synced_at_utc_ms: string | null;
+  updated_at: Generated<Date>;
+}
 /**
- * Event data for job execution events
+ * Kysely table definition for the `sync_dead_letters` table.
  */
-type JobStartedEvent = {
-  job: Job;
-  startedAt: string;
-  /**
-   * Identifier of the executor that took the job. For the worker pool this is
-   * the thread-worker id (e.g. "reactor-worker-3"); for the in-process simple
-   * manager it is "in-process-<index>". Optional for backwards compatibility
-   * with consumers built before the field was added.
-   */
-  workerId?: string;
-};
-type JobCompletedEvent = {
-  job: Job;
-  result: JobResult; /** See {@link JobStartedEvent.workerId}. */
-  workerId?: string;
-};
-type JobFailedEvent = {
-  job: Job;
-  error: string;
-  willRetry: boolean;
-  retryCount: number; /** See {@link JobStartedEvent.workerId}. */
-  workerId?: string;
-};
-type ExecutorStartedEvent = {
-  config: JobExecutorConfig;
-  startedAt: string;
-};
-type ExecutorStoppedEvent = {
-  stoppedAt: string;
-  graceful: boolean;
-};
+interface SyncDeadLetterTable {
+  ordinal: Generated<number>;
+  id: string;
+  job_id: string;
+  job_dependencies: unknown;
+  remote_name: string;
+  document_id: string;
+  scopes: unknown;
+  branch: string;
+  operations: unknown;
+  error_source: string;
+  error_message: string;
+  error_type: Generated<string>;
+  created_at: Generated<Date>;
+}
 /**
- * Status information for the job executor manager
+ * One (document, group) reference ever discovered from an auth operation's
+ * input. Rows are never updated or deleted (see migration 017).
  */
-type ExecutorManagerStatus = {
-  /** Whether the manager is currently running */isRunning: boolean; /** Number of executor instances managed */
-  numExecutors: number; /** Number of jobs currently being processed */
-  activeJobs: number; /** Total number of jobs processed since start */
-  totalJobsProcessed: number;
-};
+interface GroupReferenceTable {
+  documentId: string;
+  groupId: string;
+}
+interface Database$1 {
+  Operation: OperationTable;
+  Keyframe: KeyframeTable;
+  document_collections: DocumentCollectionTable;
+  operation_index_operations: OperationIndexOperationTable;
+  group_references: GroupReferenceTable;
+  sync_remotes: SyncRemoteTable;
+  sync_cursors: SyncCursorTable;
+  sync_dead_letters: SyncDeadLetterTable;
+}
+interface DocumentTable {
+  id: string;
+  createdAt: Generated<Date>;
+  updatedAt: Generated<Date>;
+}
+interface DocumentRelationshipTable {
+  id: Generated<string>;
+  sourceId: string;
+  targetId: string;
+  relationshipType: string;
+  metadata: unknown;
+  createdAt: Generated<Date>;
+  updatedAt: Generated<Date>;
+}
+interface IndexerStateTable {
+  id: Generated<number>;
+  lastOperationId: number;
+  lastOperationTimestamp: Generated<Date>;
+}
+interface DocumentIndexerDatabase {
+  Document: DocumentTable;
+  DocumentRelationship: DocumentRelationshipTable;
+  IndexerState: IndexerStateTable;
+}
 //#endregion
 //#region src/executor/worker/protocol.d.ts
 /**
@@ -2244,7 +2479,8 @@ type InitMessage = {
   poolConfig: WorkerPoolConfig;
   db: DbConfig; /** Omitted = the worker performs no executor-side signature verification. */
   signatureVerifier?: SignatureVerifierSpec;
-  models: ModelManifestEntry[];
+  models: ModelManifestEntry[]; /** Omitted = the worker builds its executor with the built-in defaults. */
+  executorConfig?: JobExecutorConfig;
 };
 /**
  * Dispatches a job to the worker for execution.
@@ -2425,209 +2661,1213 @@ type PoolAcquireSamplesMessage = {
  */
 type WorkerMessage = ReadyMessage | ResultMessage | ModelLoadedMessage | ModelLoadFailedMessage | LogMessage | HeartbeatMessage | MetricsMessage | PoolAcquireSamplesMessage;
 //#endregion
-//#region src/executor/interfaces.d.ts
+//#region src/core/model-sources.d.ts
+/** An importable file holding one or more document-model exports. */
+type FileModelSource = {
+  filePath: string;
+  exportName?: string;
+};
+/** An importable package specifier holding one or more document-model exports. */
+type PackageModelSource = {
+  packageName: string;
+  subpath?: string;
+  exportName?: string;
+};
 /**
- * Snapshot of the single in-flight slot maintained by an {@link IExecutorWorker}.
+ * A source of document models: a live module, an importable file, or an
+ * importable package. File and package sources can cross a worker-thread
+ * boundary (workers re-import them); a live module cannot.
  */
-type WorkerInFlightSnapshot = {
-  correlationId: string;
-  jobId: string;
+type DocumentModelSource = DocumentModelModule<any> | FileModelSource | PackageModelSource;
+//#endregion
+//#region src/registry/interfaces.d.ts
+type RegistrationResult<T> = {
+  status: "success";
+  item: T;
+} | {
+  status: "error";
+  item: T;
+  error: Error;
 };
 /**
- * Outcome of a worker-side job execution.
- *
- * `result` mirrors the in-process `JobResult` exactly. `writeReady` carries
- * the operations + jobMeta the parent needs to emit `JOB_WRITE_READY`, and is
- * present only when the worker produced operations. It is absent on failure
- * and on success-with-no-operations.
- */
-type WorkerExecutionOutcome = {
-  result: JobResult;
-  writeReady?: JobWriteReadyPayload;
-};
-/**
- * Parent-side handle for a single executor worker.
+ * Loader that asynchronously resolves a document type to a
+ * {@link DocumentModelSource}. Used by the queue to gate CREATE_DOCUMENT
+ * jobs until the required model is available in the registry.
  *
- * Implementations wrap an IPC transport (worker_threads, child_process, or a
- * test fake) and expose a transport-agnostic surface that the worker-pool
- * manager uses to dispatch jobs. The handle owns one worker's lifecycle
- * (`start` -> `execute`* -> `shutdown`) and bounds its in-flight map to a
- * single entry; `SimpleJobExecutor` is single-threaded inside the worker, so
- * concurrent dispatches would race its caches.
+ * Return an importable source ({ filePath } or { packageName }) whenever
+ * possible: the resolver registers the resolved models on the host registry
+ * and broadcasts importable sources to executor workers. A live
+ * DocumentModelModule is also valid but host-only — it cannot cross a
+ * worker-thread boundary, so worker pools will not receive it.
  */
-interface IExecutorWorker {
-  /** Stable identifier of the worker (mirrors `InitMessage.workerId`). */
-  readonly workerId: string;
-  /** Zero-based index within the pool, used for sticky routing. */
-  readonly index: number;
-  /**
-   * Spawn the worker (if not already started), send the `init` payload and
-   * resolve when the worker replies with `ready`.
-   */
-  start(): Promise<void>;
-  /**
-   * Dispatch a job to the worker and resolve with its outcome — the
-   * `JobResult` and, on success-with-operations, a `writeReady` payload
-   * the parent will enrich and re-emit. Rejects with a transport-level
-   * error if the worker exits, aborts, or times out before producing a
-   * result.
-   */
-  execute(job: Job, signal?: AbortSignal): Promise<WorkerExecutionOutcome>;
-  /**
-   * Request cancellation of the in-flight job (if any). The handle posts an
-   * `abort` message; if the worker fails to reply within its grace window it
-   * is force-terminated.
-   */
-  abort(correlationId: string, reason?: string): void;
-  /**
-   * Stop the worker. When `graceful` is true the handle waits for the
-   * in-flight job to settle (up to `graceMs`) before terminating; otherwise
-   * the worker is terminated immediately.
-   */
-  shutdown(graceful: boolean, graceMs?: number): Promise<void>;
-  /**
-   * Register an additional document model on the running worker. Resolves
-   * when the worker replies with `model-loaded`; rejects when it replies
-   * with `model-load-failed` or the worker exits before answering.
-   */
-  loadModel(entry: ModelManifestEntry, signal?: AbortSignal): Promise<void>;
-  /** True when no job is currently in flight. */
-  isIdle(): boolean;
-  /** Snapshot of the in-flight slot, or null when idle. */
-  getInFlight(): WorkerInFlightSnapshot | null;
+interface IDocumentModelLoader {
+  load(documentType: string): Promise<DocumentModelSource>;
 }
 /**
- * Simple interface for executing a job.
- * A JobExecutor simply takes a job and executes it - nothing more.
+ * Registry for managing document model modules.
+ * Provides centralized access to document models' reducers, utils, and specifications.
+ * Supports version-aware module storage and upgrade manifest management.
  */
-interface IJobExecutor {
+interface IDocumentModelRegistry {
   /**
-   * Execute a single job.
-   * @param job - The job to execute
-   * @returns Promise that resolves to the job result
+   * Register multiple modules at once.
+   * Modules without a version field default to version 1.
+   * Invalid or duplicate modules are skipped without breaking registration of the remaining modules.
+   *
+   * @param modules Document model modules to register
+   * @returns Array of results, one per module, indicating success or failure
    */
-  executeJob(job: Job, signal?: AbortSignal): Promise<JobResult>;
-}
-/**
- * Interface for managing multiple job executors.
- * Listens for 'jobAvailable' events from the event bus, pulls jobs from the queue,
- * and coordinates the distribution of jobs across multiple executor instances.
- */
-interface IJobExecutorManager {
+  registerModules(...modules: DocumentModelModule<any>[]): RegistrationResult<DocumentModelModule<any>>[];
   /**
-   * Start the executor manager.
-   * Begins listening for 'jobAvailable' events and dispatching to executors.
+   * Unregister all versions of the specified document types.
    *
-   * @param numExecutors - Number of executor instances to create
-   * @returns Promise that resolves when the manager is started
+   * @param documentTypes The document types to unregister
+   * @returns true if all modules were unregistered, false if any were not found
    */
-  start(numExecutors: number): Promise<void>;
+  unregisterModules(...documentTypes: string[]): boolean;
   /**
-   * Stop the executor manager.
+   * Get a specific document model module by document type and optional version.
+   * If version is not specified, returns the latest version.
    *
-   * @param graceful - Whether to wait for current jobs to complete
-   * @returns Promise that resolves when the manager is stopped
+   * @param documentType The document type identifier
+   * @param version Optional version number to retrieve
+   * @returns The document model module
+   * @throws ModuleNotFoundError if the document type or version is not registered
    */
-  stop(graceful?: boolean): Promise<void>;
+  getModule(documentType: string, version?: number): DocumentModelModule<any>;
   /**
-   * Get all managed executor instances.
+   * Get all registered document model modules.
    *
-   * @returns Array of executor instances
+   * @returns Array of all registered modules
    */
-  getExecutors(): IJobExecutor[];
+  getAllModules(): DocumentModelModule<any>[];
   /**
-   * Get the current status of the manager.
+   * Clear all registered modules and upgrade manifests.
+   */
+  clear(): void;
+  /**
+   * Get all supported versions for a document type, sorted in ascending order.
    *
-   * @returns The current manager status
+   * @param documentType The document type identifier
+   * @returns Array of version numbers sorted ascending
+   * @throws ModuleNotFoundError if no modules are registered for the document type
    */
-  getStatus(): ExecutorManagerStatus;
-}
-//#endregion
-//#region src/job-tracker/interfaces.d.ts
-/**
- * Interface for tracking job lifecycle status.
- * Maintains job state throughout execution: PENDING → RUNNING → COMPLETED/FAILED.
- */
-interface IJobTracker {
+  getSupportedVersions(documentType: string): number[];
   /**
-   * Register a new job with PENDING status.
+   * Get the latest (highest) version number for a document type.
    *
-   * @param jobInfo - The job information to register
+   * @param documentType The document type identifier
+   * @returns The highest version number registered for this document type
+   * @throws ModuleNotFoundError if no modules are registered for the document type
    */
-  registerJob(jobInfo: JobInfo): void;
+  getLatestVersion(documentType: string): number;
   /**
-   * Update a job's status to RUNNING.
+   * Register upgrade manifests that define upgrade paths between versions.
+   * Invalid or duplicate manifests are skipped without breaking registration of the remaining manifests.
    *
-   * @param jobId - The job ID to mark as running
+   * @param manifests Upgrade manifests to register
+   * @returns Array of results, one per manifest, indicating success or failure
    */
-  markRunning(jobId: string): void;
+  registerUpgradeManifests(...manifests: UpgradeManifest<readonly number[]>[]): RegistrationResult<UpgradeManifest<readonly number[]>>[];
   /**
-   * Mark a job as failed.
+   * Unregister upgrade manifests for the specified document types.
+   * @param documentTypes The document types whose upgrade manifests should be unregistered
+   * @returns true if all modules were unregistered, false if any were not found
+   **/
+  unregisterUpgradeManifests(...documentTypes: string[]): boolean;
+  /**
+   * Get the upgrade manifest for a document type.
    *
-   * @param jobId - The job ID to mark as failed
-   * @param error - Error information including message and stack trace
-   * @param job - Optional full job object for debugging purposes
+   * @param documentType The document type identifier
+   * @returns The upgrade manifest
+   * @throws ManifestNotFoundError if no manifest is registered for the document type
    */
-  markFailed(jobId: string, error: ErrorInfo$1, job?: Job): void;
+  getUpgradeManifest(documentType: string): UpgradeManifest<readonly number[]>;
   /**
-   * Retrieve the current status of a job.
+   * Compute the upgrade path from one version to another.
+   * Returns the sequence of upgrade transitions needed.
    *
-   * @param jobId - The job ID to query
-   * @returns The job information, or null if the job is not found
+   * @param documentType The document type identifier
+   * @param fromVersion The starting version
+   * @param toVersion The target version
+   * @returns Array of upgrade transitions in order
+   * @throws DowngradeNotSupportedError if toVersion is less than fromVersion
+   * @throws ManifestNotFoundError if no upgrade manifest is registered
+   * @throws MissingUpgradeTransitionError if any transition in the path is missing
    */
-  getJobStatus(jobId: string): JobInfo | null;
+  computeUpgradePath(documentType: string, fromVersion: number, toVersion: number): UpgradeTransition[];
   /**
-   * Shutdown the job tracker and clean up resources.
-   * Unsubscribes from all event bus subscriptions.
+   * Get the upgrade reducer for a single-step version transition.
+   *
+   * @param documentType The document type identifier
+   * @param fromVersion The starting version
+   * @param toVersion The target version (must be fromVersion + 1)
+   * @returns The upgrade reducer function
+   * @throws InvalidUpgradeStepError if toVersion is not fromVersion + 1
+   * @throws ManifestNotFoundError if no upgrade manifest is registered
+   * @throws MissingUpgradeTransitionError if the transition is not found
    */
-  shutdown(): void;
+  getUpgradeReducer(documentType: string, fromVersion: number, toVersion: number): UpgradeReducer<any, any>;
 }
 //#endregion
-//#region src/queue/interfaces.d.ts
+//#region src/cache/buffer/ring-buffer.d.ts
 /**
- * Interface for a job queue that manages write operations.
- * Internally organizes jobs by documentId, scope, and branch to ensure proper ordering.
- * Emits events to the event bus when new jobs are available for consumption.
+ * RingBuffer is a generic circular buffer implementation that stores a fixed number
+ * of items. When the buffer is full, new items overwrite the oldest items.
+ *
+ * This implementation maintains O(1) time complexity for push operations and provides
+ * items in chronological order (oldest to newest) via getAll().
+ *
+ * @template T - The type of items stored in the buffer
  */
-interface IQueue {
+declare class RingBuffer<T> {
+  private buffer;
+  private head;
+  private size;
+  private capacity;
+  constructor(capacity: number);
   /**
-   * Add a new job to the queue.
-   * Jobs are automatically organized by documentId, scope, and branch internally.
-   * Emits a 'jobAvailable' event to the event bus when the job is queued.
-   * @param job - The job to add to the queue
-   * @returns Promise that resolves when the job is queued
+   * Adds an item to the buffer. If the buffer is full, overwrites the oldest item.
+   *
+   * @param item - The item to add
    */
-  enqueue(job: Job): Promise<void>;
+  push(item: T): void;
   /**
-   * Get the next job to execute for a specific document/scope/branch combination.
-   * @param documentId - The document ID to get jobs for
-   * @param scope - The scope to get jobs for
-   * @param branch - The branch to get jobs for
-   * @param signal - Optional abort signal to cancel the request
-   * @returns Promise that resolves to the next job execution handle or null if no jobs available
+   * Returns all items in the buffer in chronological order (oldest to newest).
+   *
+   * @returns Array of items in insertion order
    */
-  dequeue(documentId: string, scope: string, branch: string, signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
+  getAll(): T[];
   /**
-   * Get the next available job from any queue.
-   * @param signal - Optional abort signal to cancel the request
-   * @returns Promise that resolves to the next job execution handle or null if no jobs available
+   * Clears all items from the buffer.
    */
-  dequeueNext(signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
+  clear(): void;
   /**
-   * Get the next available job whose routing metadata satisfies the predicate.
-   * Walks ready sub-queue heads in queue insertion order, skips heads whose document
-   * is currently executing (same isDocumentExecuting gate as dequeueNext), and returns
-   * the first head for which predicate returns true.
-   * Returns null when paused, when nothing matches, or when the queue is empty.
-   * Rejects if signal is already aborted.
-   * @param predicate - Filter applied to JobRoutingMeta of each candidate head
-   * @param signal - Optional abort signal to cancel the request
-   * @returns Promise that resolves to the first matching job execution handle or null
+   * Gets the current number of items in the buffer.
    */
-  dequeueNextMatching(predicate: (meta: JobRoutingMeta) => boolean, signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
-  /**
-   * Get the current size of the queue for a specific document/scope/branch.
-   * @param documentId - The document ID
+  get length(): number;
+}
+//#endregion
+//#region src/cache/kysely-write-cache.d.ts
+type DocumentStream = {
+  key: string;
+  ringBuffer: RingBuffer<CachedSnapshot>;
+};
+/**
+ * In-memory write cache with keyframe persistence for PHDocuments.
+ *
+ * Caches document snapshots in ring buffers with LRU eviction. On cache miss,
+ * rebuilds documents from nearest keyframe or full operation history.
+ *
+ * **Performance Characteristics:**
+ * - Cache hit: O(1) lookup in ring buffer
+ * - Cold miss: O(n) where n is total operation count, or O(k) where k is operations since keyframe
+ * - Warm miss: O(m) where m is operations since cached revision
+ * - Eviction: O(1) for LRU tracking and removal
+ *
+ * **Thread Safety:**
+ * Not thread-safe. Designed for single-threaded job executor environment.
+ * External synchronization required for concurrent access across multiple executors.
+ *
+ * **Example:**
+ * ```typescript
+ * const cache = new KyselyWriteCache(
+ *   keyframeStore,
+ *   operationStore,
+ *   registry,
+ *   { maxDocuments: 1000, ringBufferSize: 10, keyframeInterval: 10 }
+ * );
+ *
+ * await cache.startup();
+ *
+ * // Retrieve or rebuild document
+ * const doc = await cache.getState(docId, docType, scope, branch, revision);
+ *
+ * // Cache result after job execution
+ * cache.putState(docId, docType, scope, branch, newRevision, updatedDoc);
+ *
+ * await cache.shutdown();
+ * ```
+ */
+declare class KyselyWriteCache implements IWriteCache {
+  private streams;
+  private lruTracker;
+  private keyframeStore;
+  private operationStore;
+  private registry;
+  private config;
+  constructor(keyframeStore: IKeyframeStore, operationStore: IOperationStore, registry: IDocumentModelRegistry, config: WriteCacheConfig);
+  withScopedStores(operationStore: IOperationStore, keyframeStore: IKeyframeStore): KyselyWriteCache;
+  /**
+   * Initializes the write cache.
+   * Currently a no-op as keyframe store lifecycle is managed externally.
+   */
+  startup(): Promise<void>;
+  /**
+   * Shuts down the write cache.
+   * Currently a no-op as keyframe store lifecycle is managed externally.
+   */
+  shutdown(): Promise<void>;
+  /**
+   * Retrieves document state at a specific revision from cache or rebuilds it.
+   *
+   * Note: this returns a _shallow_ copy of the document.
+   *
+   * Cache hit path: Returns cached snapshot if available (O(1))
+   * Warm miss path: Rebuilds from cached base revision + incremental ops
+   * Cold miss path: Rebuilds from keyframe or from scratch using all operations
+   *
+   * @param documentId - The document identifier
+   * @param scope - The operation scope
+   * @param branch - The operation branch
+   * @param targetRevision - The target revision, or undefined for newest
+   * @param signal - Optional abort signal to cancel the operation
+   * @returns The document at the target revision
+   * @throws {Error} "Operation aborted" if signal is aborted
+   * @throws {ModuleNotFoundError} If document type not registered in registry
+   * @throws {Error} "Failed to rebuild document" if operation store fails
+   * @throws {Error} If reducer throws during operation application
+   * @throws {Error} If document serialization fails
+   */
+  getState(documentId: string, scope: string, branch: string, targetRevision?: number, signal?: AbortSignal): Promise<PHDocument>;
+  /**
+   * Stores a document snapshot in the cache at a specific revision.
+   *
+   * The cached document is a shallow copy of the input with its operation history
+   * truncated to the last operation per scope and its clipboard cleared. This keeps
+   * memory use and copy costs constant regardless of operation count. Consumers of
+   * getState() must not rely on the full operation history being present; the only
+   * guaranteed invariant is that operations[scope].at(-1) reflects the latest
+   * operation index for each scope.
+   *
+   * Updates LRU tracker and may evict least recently used stream if at capacity.
+   * Asynchronously persists keyframes at configured intervals (fire-and-forget).
+   *
+   * @param documentId - The document identifier
+   * @param scope - The operation scope
+   * @param branch - The operation branch
+   * @param revision - The revision number
+   * @param document - The document to cache
+   * @throws {Error} If document serialization fails
+   */
+  putState(documentId: string, scope: string, branch: string, revision: number, document: PHDocument, position: SnapshotPosition): void;
+  private store;
+  /**
+   * Invalidates cached document streams.
+   *
+   * Supports three invalidation scopes:
+   * - Document-level: invalidate(documentId) - removes all streams for document
+   * - Scope-level: invalidate(documentId, scope) - removes all branches for scope
+   * - Stream-level: invalidate(documentId, scope, branch) - removes specific stream
+   *
+   * @param documentId - The document identifier
+   * @param scope - Optional scope to narrow invalidation
+   * @param branch - Optional branch to narrow invalidation (requires scope)
+   * @returns The number of streams evicted
+   */
+  invalidate(documentId: string, scope?: string, branch?: string): number;
+  /**
+   * Clears the entire cache, removing all cached document streams.
+   * Resets LRU tracking state. This operation always succeeds.
+   */
+  clear(): void;
+  /**
+   * Retrieves a specific stream for a document. Exposed on the implementation
+   * for testing, but not on the interface.
+   *
+   * @internal
+   */
+  getStream(documentId: string, scope: string, branch: string): DocumentStream | undefined;
+  private findNearestKeyframe;
+  /**
+   * Rebuilds a scope from a keyframe or from the whole operation history.
+   *
+   * The document scope is always rebuilt first, because it carries the type,
+   * the upgrades and the deletion marker. Its version-changing upgrades are not
+   * applied there though: an upgrade reducer must see the state the requested
+   * scope has reached at that upgrade's boundary, so each one is held back and
+   * applied when the replay below crosses the boundary that
+   * resolveModuleVersionForOp derives from it. Upgrades whose boundary lies past
+   * the last replayed operation are applied at the end. Creation-time 0->N seed
+   * upgrades carry the initial state, so they still apply immediately.
+   */
+  private coldMissRebuild;
+  /**
+   * Applies and removes every held-back upgrade whose target version is at or
+   * below `throughVersion`, in the order the document scope recorded them.
+   */
+  private applyPendingUpgrades;
+  /**
+   * Applies the remaining held-back upgrades after the requested scope's
+   * replay has finished. A head read applies them all. A positional read
+   * applies only those whose boundary for this scope lies at or before the
+   * target position: applying a later one would label migrated state with a
+   * pre-upgrade revision, and a keyframe stored from that poisons every
+   * rebuild that resumes from it. Boundaries come from the upgrade's revision
+   * snapshot; an upgrade without one records no position for this scope, and
+   * the replay loop not having crossed it already places it past the target.
+   */
+  private applyTailPendingUpgrades;
+  /**
+   * Applies one held-back upgrade, then re-applies the deletes the document
+   * scope recorded after it so the hold-back cannot invert their order.
+   */
+  private applyPendingUpgrade;
+  /**
+   * Copies the current document revisions onto the document. Overwrites the
+   * requested scope revision with the target revision, if provided.
+   */
+  private stampRevisions;
+  /** The stored operation at `index`, or undefined if it is no longer there. */
+  private operationAt;
+  /**
+   * Resolves which module version to use for a given operation in phase 2.
+   *
+   * Uses the validated-upgrade boundary rules from D7:
+   * - If `input.revision` is present: op.index < revision[scope] → before the upgrade boundary
+   * - Otherwise: timestamp fallback
+   * - Falls back to final module version when neither is decidable
+   */
+  private resolveModuleVersionForOp;
+  private warmMissRebuild;
+  private findNearestOlderSnapshot;
+  private makeStreamKey;
+  private getOrCreateStream;
+  private isKeyframeRevision;
+}
+//#endregion
+//#region src/storage/kysely/store.d.ts
+declare class KyselyOperationStore implements IOperationStore {
+  private db;
+  private trx?;
+  constructor(db: Kysely<Database$1>);
+  private get queryExecutor();
+  withTransaction(trx: Transaction<Database$1>): KyselyOperationStore;
+  apply(documentId: string, documentType: string, scope: string, branch: string, revision: number, fn: (txn: AtomicTxn) => void | Promise<void>, signal?: AbortSignal, condition?: AppendCondition): Promise<Operation[]>;
+  private resolveUniqueConstraint;
+  private executeApply;
+  /**
+   * Locks the written stream and every read-set stream, in sorted key order
+   * so that overlapping concurrent appends serialize rather than deadlock.
+   * The locks are still taken one row at a time, so the query preserves that
+   * order. It must stay separate from the guarded insert, which would
+   * otherwise read a snapshot taken before the locks were held.
+   */
+  private acquireStreamLocks;
+  /**
+   * Inserts the staged operations with the condition compiled in as a WHERE
+   * NOT EXISTS guard, making the check and the append one statement. Returns
+   * the rows inserted; zero means the guard failed and nothing was written.
+   */
+  private insertGuarded;
+  private findIdempotentReplay;
+  getSince(documentId: string, scope: string, branch: string, revision: number, filter?: OperationFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Operation>>;
+  getSinceId(id: number, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<OperationWithContext$1>>;
+  getConflicting(documentId: string, scope: string, branch: string, minTimestamp: string, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Operation>>;
+  getRevisions(documentId: string, branch: string, signal?: AbortSignal): Promise<DocumentRevisions>;
+  getStreamLatestTimestamp(documentId: string, scope: string, branch: string, signal?: AbortSignal): Promise<string | undefined>;
+  private rowToOperation;
+  private rowToOperationWithContext;
+}
+//#endregion
+//#region src/storage/kysely/keyframe-store.d.ts
+declare class KyselyKeyframeStore implements IKeyframeStore {
+  private db;
+  private trx?;
+  constructor(db: Kysely<Database$1>);
+  private get queryExecutor();
+  withTransaction(trx: Transaction<Database$1>): KyselyKeyframeStore;
+  putKeyframe(documentId: string, scope: string, branch: string, revision: number, document: PHDocument, signal?: AbortSignal): Promise<void>;
+  findNearestKeyframe(documentId: string, scope: string, branch: string, targetRevision: number, signal?: AbortSignal): Promise<{
+    revision: number;
+    document: PHDocument;
+  } | undefined>;
+  listKeyframes(documentId: string, scope?: string, branch?: string, signal?: AbortSignal): Promise<Array<{
+    scope: string;
+    branch: string;
+    revision: number;
+    document: PHDocument;
+  }>>;
+  deleteKeyframes(documentId: string, scope?: string, branch?: string, signal?: AbortSignal): Promise<number>;
+}
+//#endregion
+//#region src/executor/execution-scope.d.ts
+interface ExecutionStores {
+  operationStore: IOperationStore;
+  operationIndex: IOperationIndex;
+  writeCache: IWriteCache;
+  documentMetaCache: IDocumentMetaCache;
+  collectionMembershipCache: ICollectionMembershipCache;
+}
+interface IExecutionScope {
+  run<T>(fn: (stores: ExecutionStores) => Promise<T>, signal?: AbortSignal): Promise<T>;
+}
+//#endregion
+//#region src/executor/types.d.ts
+/**
+ * Represents the result of a job execution
+ */
+type JobResult = {
+  /** The job that was executed */job: Job; /** Whether the job executed successfully */
+  success: boolean; /** Error if the job failed */
+  error?: Error; /** The operations generated from the actions (if successful) */
+  operations?: Operation[];
+  /**
+   * Operations with context (includes ephemeral resultingState).
+   * Used for emitting to IDocumentView via event bus.
+   */
+  operationsWithContext?: OperationWithContext$1[]; /** Timestamp when the job execution completed */
+  completedAt?: string; /** Duration of job execution in milliseconds */
+  duration?: number; /** Any additional metadata from the execution */
+  metadata?: Record<string, any>;
+};
+/**
+ * Enforcement the reactor performs, each off by default.
+ *
+ * An evaluation made while replaying is part of the document's history, so two
+ * reactors that share documents and disagree on these diverge. A flag is turned
+ * on for a set of reactors that sync with each other, not for one node.
+ */
+type ReactorFeatureFlags = {
+  /**
+   * Decide whether an operation may be admitted by building a decision model
+   * over the document stream, rather than reading the deleted flag from the
+   * document meta cache. Deletion then takes effect from the deleting
+   * operation's position rather than for the whole document.
+   */
+  documentDecisions: boolean;
+  /**
+   * Evaluate the auth policy by reading the auth scope as a second projection.
+   * Requires documentDecisions.
+   */
+  authEnforcement: boolean;
+  /**
+   * Match { group } principals by folding the referenced PHGroup documents as
+   * derived projections. Requires authEnforcement.
+   */
+  authGroups: boolean;
+  /**
+   * Evaluate `where` clauses and { match } principals against the executing
+   * scope's state, the subject, and the action input. Requires authGroups.
+   */
+  authConditions: boolean;
+};
+/**
+ * Configuration options for the job executor
+ */
+type JobExecutorConfig = {
+  /** Feature flags; anything unset is off. */featureFlags?: Partial<ReactorFeatureFlags>; /** Maximum number of conflicting operations to skip when reshuffling. */
+  maxSkipThreshold?: number; /** Maximum number of concurrent jobs to execute */
+  maxConcurrency?: number; /** Maximum time in milliseconds a job can run before being considered timed out */
+  jobTimeoutMs?: number; /** Base delay in milliseconds for exponential backoff retries */
+  retryBaseDelayMs?: number; /** Maximum delay in milliseconds for exponential backoff retries */
+  retryMaxDelayMs?: number;
+  /** Maximum elapsed milliseconds before yielding to the main thread between actions.
+   *  Keeps the UI responsive when processing large batches. */
+  yieldDeadlineMs?: number;
+};
+/**
+ * Event types for the job executor
+ */
+declare const JobExecutorEventTypes: {
+  readonly JOB_STARTED: 20000;
+  readonly JOB_COMPLETED: 20001;
+  readonly JOB_FAILED: 20002;
+  readonly EXECUTOR_STARTED: 20003;
+  readonly EXECUTOR_STOPPED: 20004;
+};
+/**
+ * Event data for job execution events
+ */
+type JobStartedEvent = {
+  job: Job;
+  startedAt: string;
+  /**
+   * Identifier of the executor that took the job. For the worker pool this is
+   * the thread-worker id (e.g. "reactor-worker-3"); for the in-process simple
+   * manager it is "in-process-<index>". Optional for backwards compatibility
+   * with consumers built before the field was added.
+   */
+  workerId?: string;
+};
+type JobCompletedEvent = {
+  job: Job;
+  result: JobResult; /** See {@link JobStartedEvent.workerId}. */
+  workerId?: string;
+};
+type JobFailedEvent = {
+  job: Job;
+  error: string;
+  willRetry: boolean;
+  retryCount: number; /** See {@link JobStartedEvent.workerId}. */
+  workerId?: string;
+};
+type ExecutorStartedEvent = {
+  config: JobExecutorConfig;
+  startedAt: string;
+};
+type ExecutorStoppedEvent = {
+  stoppedAt: string;
+  graceful: boolean;
+};
+/**
+ * Status information for the job executor manager
+ */
+type ExecutorManagerStatus = {
+  /** Whether the manager is currently running */isRunning: boolean; /** Number of executor instances managed */
+  numExecutors: number; /** Number of jobs currently being processed */
+  activeJobs: number; /** Total number of jobs processed since start */
+  totalJobsProcessed: number;
+};
+//#endregion
+//#region src/decision/types.d.ts
+/** One operation stream. */
+type StreamQuery = {
+  documentId: string;
+  branch: string;
+  scope: string;
+};
+/**
+ * What building a decision model reads a stream's state through.
+ *
+ * `IWriteCache` satisfies this and is what the write paths pass. The read path
+ * cannot: the write cache is a write-side projection invalidated by the process
+ * that runs the executor, so a reactor whose executors live in worker processes
+ * holds state in its parent that no commit ever invalidates. A read there would
+ * decide against a policy arbitrarily far behind the one the write paths
+ * enforce. Reads therefore pass a reader backed by the read side.
+ */
+interface IStreamStateReader {
+  getState(documentId: string, scope: string, branch: string, targetRevision?: number, signal?: AbortSignal): Promise<PHDocument>;
+}
+/** The document and branch a decision model is built for. */
+type DecisionTarget = {
+  documentId: string;
+  branch: string;
+};
+/**
+ * What a decision's conditions may read beyond the projections: the executing
+ * scope's own state and the attempted action's input. Populated only while
+ * authConditions is on; otherwise both stay undefined and conditional grants
+ * never apply.
+ */
+type DecisionContext = {
+  scopeState: unknown;
+  actionInput?: unknown;
+};
+/** A statically-queried stream's operations, named after its projection. */
+type StreamHistory = {
+  name: string;
+  operations: Operation[];
+};
+/**
+ * A named stream whose value in the model is that scope's state from the
+ * document rebuild the reactor already performs. A derived query may read
+ * only statically-queried projections, so composition is one layer deep.
+ */
+type Projection<M> = {
+  query: StreamQuery | ((model: Partial<M>) => StreamQuery[]);
+  /**
+   * For a derived projection, the streams it may read anywhere in an
+   * evaluated range, derived from the statically-queried streams' operations
+   * (including the operations under evaluation). A positional walk cannot use
+   * `query`, because the folded state it depends on changes over the range;
+   * this over-approximates by design, since a stream referenced at any
+   * position stays readable when the earlier range is re-evaluated even if a
+   * later operation removes the reference. Ignored on static projections.
+   */
+  queryOverHistory?: (reads: StreamHistory[]) => StreamQuery[];
+  /**
+   * Action types in this stream that can change an evaluation. Reads of the stream
+   * are filtered to these, so anything left out is invisible to a decision.
+   */
+  decidingActions: string[]; /** Applies one of this stream's operations while deciding. */
+  apply: (document: PHDocument, operation: Operation) => PHDocument;
+};
+/**
+ * The outcome of evaluating one operation. A refusal carries the reason it is
+ * recorded with, because a model has more than one way to refuse.
+ */
+type Evaluation = {
+  decision: "allow";
+} | {
+  decision: "deny";
+  reason: string;
+};
+/** Projections plus a decision function over the built model. */
+type DecisionModel<M> = {
+  projections: { [K in keyof M]: Projection<M> };
+  /**
+   * Present when decide reads the executing scope's state through the
+   * decision context. A positional walk then folds the evaluated stream with
+   * this, from its base state through every effective operation, so
+   * conditions read the state as it stood at each operation's position
+   * rather than at the head.
+   */
+  foldEvaluatedScope?: (document: PHDocument, operation: Operation) => PHDocument;
+  /**
+   * Whether or not this model decides about operations in a given scope. That
+   * is, a scope it reads is not necessarily one it evaluates, and vise-versa.
+   */
+  evaluatesScope(scope: string): boolean;
+  decide(model: M, subject: AuthSubject, request: AuthRequest, ctx: DecisionContext): Evaluation;
+};
+/** A built model plus the read-set condition recording what the build read. */
+type BuiltDecisionModel<M> = {
+  model: M;
+  appendCondition: AppendCondition;
+};
+//#endregion
+//#region src/decision/document-decision-model.d.ts
+/** What the document decision model reads: the target's document scope. */
+type DocumentDecisionModel = {
+  document: PHDocumentState;
+};
+/**
+ * The simplest decision model: one projection over the document scope, which
+ * rejects on a deleted document.
+ */
+declare function documentDecisionModel(target: DecisionTarget): DecisionModel<DocumentDecisionModel>;
+//#endregion
+//#region src/decision/registered-model.d.ts
+/**
+ * A model this reactor can register. Every one carries the document projection,
+ * because admission reads the version and the deletion timestamp off it; a model
+ * with more projections than that is still assignable here.
+ */
+type RegisteredDecisionModel = (target: DecisionTarget) => DecisionModel<DocumentDecisionModel>;
+/** What admission needs out of a model built at the stream heads. */
+type AdmissionDecision = {
+  evaluation: Evaluation;
+  appendCondition: AppendCondition;
+  documentVersion: number;
+  deletedAtUtcIso: string | null;
+};
+/**
+ * What decideAtHead resolves a condition context from: the action's input,
+ * with the executing scope's state read at the head. Supplied only while
+ * authConditions is on.
+ */
+type AdmissionConditions = {
+  actionInput?: unknown;
+};
+/**
+ * Builds the model at the stream heads and decides one request against it. The
+ * append condition it returns is the read-set the store enforces at write time.
+ *
+ * With `conditions` supplied, the executing scope's state is read at the head
+ * for `doc.<scope>.*` paths. That read carries no append-condition entry of
+ * its own: the written stream's expected-revision check already refuses a
+ * write whose scope grew between the read and the append.
+ */
+declare function decideAtHead(model: RegisteredDecisionModel, cache: IWriteCache, target: DecisionTarget, subject: AuthSubject, request: AuthRequest, signal?: AbortSignal, conditions?: AdmissionConditions): Promise<AdmissionDecision>;
+/**
+ * The model this reactor enforces. With `authEnforcement` off the auth scope is
+ * absent from every append condition and no load walks it; with `authGroups`
+ * on, the group documents the grant list names join the read-set and the
+ * registry supplies the reducer that folds them.
+ */
+declare function selectDecisionModel(flags: ReactorFeatureFlags, registry: IDocumentModelRegistry): RegisteredDecisionModel;
+//#endregion
+//#region src/decision/read-gate.d.ts
+/**
+ * Scopes every holder of a document may read, whatever the grants say. Denying
+ * the policy itself would let a replica sync a document without it, read the
+ * auth scope as uninitialized, and allow every operation it holds, so replicas
+ * would diverge permanently. The document scope carries the metadata the same
+ * argument covers. Grants gate domain-scope reads only.
+ */
+declare const ALWAYS_READABLE_SCOPES: ReadonlySet<string>;
+/** Whether a subject may read each scope of one document. */
+interface IReadGate {
+  /**
+   * Resolves, for one document, which of its scopes the subject may read.
+   *
+   * The predicate is resolved up front rather than asked per scope so that the
+   * filtering itself stays synchronous, and so that a model backing the answer
+   * is built once per document instead of once per scope.
+   */
+  scopePredicate(document: PHDocument, subject: AuthSubject, branch: string, signal?: AbortSignal): Promise<(scope: string) => boolean>;
+}
+/**
+ * The model reads enforce. Below `authEnforcement` there is no model to
+ * enforce: the document-only model ignores the auth scope entirely, so reading
+ * through it would serve every domain scope of a policied document to anyone.
+ * Undefined therefore means "evaluate the policy alone", which is what the read
+ * surface did before the model existed.
+ */
+declare function readDecisionModel(flags: ReactorFeatureFlags, registry: IDocumentModelRegistry): RegisteredDecisionModel | undefined;
+/**
+ * Evaluates the policy on its own, with no groups map and no condition context.
+ * A `{ group }` or conditional grant therefore never applies: an allow that
+ * does not apply withholds access, so this cannot widen a policy, but a policy
+ * relying on a conditional deny is weaker here than it is written.
+ */
+declare class BareReadGate implements IReadGate {
+  scopePredicate(document: PHDocument, subject: AuthSubject): Promise<(scope: string) => boolean>;
+}
+/**
+ * Evaluates a read against the registered decision model, built at the stream
+ * heads. This is what makes `{ group }` principals and conditional grants apply
+ * to a read: the model supplies the groups map and the scope's own state, the
+ * same two things admission supplies.
+ *
+ * A read has no action, so a condition on `action.input.*` never holds for one.
+ *
+ * State is read through the read side rather than the write cache. The write
+ * cache is invalidated by whichever process runs the executor, so a reactor
+ * running its executors in worker processes would answer reads in the parent
+ * from state no commit ever invalidates.
+ */
+declare class ModelReadGate implements IReadGate {
+  private readonly model;
+  private readonly documentView;
+  /**
+   * Whether a group a policy names is served to that policy's audience. Only
+   * meaningful with `authGroups`, which is what makes a `{ group }` grant
+   * match at all; below it the grant fails closed, so serving the roster
+   * would publish a member list no read grant can use.
+   */
+  private readonly servesGroups;
+  private readonly operationIndex?;
+  private readonly logger?;
+  constructor(model: RegisteredDecisionModel, documentView: IDocumentView,
+  /**
+   * Whether a group a policy names is served to that policy's audience. Only
+   * meaningful with `authGroups`, which is what makes a `{ group }` grant
+   * match at all; below it the grant fails closed, so serving the roster
+   * would publish a member list no read grant can use.
+   */
+
+  servesGroups: boolean, operationIndex?: IOperationIndex | undefined, logger?: ILogger | undefined);
+  /**
+   * A served group yields its member list and nothing else. What the audience
+   * is owed is the state it must fold to evaluate auth with the group; a
+   * group's other scopes are its own business and stay behind its own grants.
+   */
+  scopePredicate(document: PHDocument, subject: AuthSubject, branch: string, signal?: AbortSignal): Promise<(scope: string) => boolean>;
+  /**
+   * Whether the subject is served this group because a policy names it.
+   *
+   * A replica must fold a group's membership to evaluate auth with it, so a
+   * group a grant names is served to the audience of the document that names
+   * it, whatever the group's own read grants say. Naming a group in a policy
+   * publishes its roster to that policy's audience; a group whose membership
+   * must stay confidential does not belong in a grant.
+   *
+   * The referencing document's own domain scopes are the test. Its `auth` and
+   * `document` scopes are readable by every holder, so testing those would
+   * serve every referenced group to everybody.
+   *
+   * One level only. A referencer that is itself a group is skipped, and a
+   * referencer's own readability is decided from its policy alone, so a
+   * reference cycle terminates. Cycles are reachable: the reference relation
+   * is recorded from an operation's input, including one later stored denied,
+   * so a refused grant naming a group from inside another group leaves a row
+   * behind that validation never saw.
+   *
+   * The referencers are probed a few at a time and the walk stops at the first
+   * that serves, because a subject outside the audience is the case that runs to
+   * the bound, and it is the common one. A probe that failed decides only when
+   * nothing served: serving rests on a real allow, so this cannot widen, and it
+   * stops one unreachable referencer from turning an allow already in hand into
+   * a denial. A read records no operation, so replicas differing over a
+   * transient failure has no consensus consequence.
+   *
+   * The probes are awaited together rather than raced, so none is ever left
+   * running with nobody awaiting it, which is where unhandled rejections come
+   * from.
+   */
+  private servesGroupTo;
+  /**
+   * Whether one referencing document serves the subject any domain scope. A
+   * referencer this replica does not hold serves nothing, which fails closed
+   * the same way a group it does not hold does.
+   */
+  private servesThrough;
+  private servesGroup;
+  /**
+   * What this document's own policy says, with no group serving applied.
+   *
+   * An unpoliced document is readable in full, which is the common case and the
+   * one worth answering without building anything. The test is the one
+   * `evaluate` makes: a legacy `{}` auth scope and version 0 both mean
+   * uninitialized, and "no grants" does not, because a policy with a version and
+   * an empty grant list denies everything.
+   */
+  private ownPolicyPredicate;
+}
+//#endregion
+//#region src/client/reactor-client.d.ts
+/**
+ * ReactorClient implementation that wraps lower-level APIs to provide
+ * a simpler interface for document operations.
+ *
+ * Features:
+ * - Wraps Jobs with Promises for easier async handling
+ * - Manages signing of submitted Action objects
+ * - Provides quality-of-life functions for common tasks
+ * - Wraps subscription interface with ViewFilters
+ */
+declare class ReactorClient implements IReactorClient {
+  private logger;
+  private reactor;
+  private signer;
+  private subscriptionManager;
+  private jobAwaiter;
+  private documentIndexer;
+  private documentView;
+  private readGate;
+  readonly drives: IDriveClient;
+  constructor(logger: ILogger, reactor: IReactor, signer: ISigner, subscriptionManager: IReactorSubscriptionManager, jobAwaiter: IJobAwaiter, documentIndexer: IDocumentIndexer, documentView: IDocumentView, readGate?: IReadGate);
+  private readSubject;
+  /**
+   * Which scopes of one document the subject may read. Resolved once per
+   * document, so the gate builds its model once however many scopes are then
+   * tested, and the filtering itself stays synchronous.
+   */
+  private readableScopes;
+  /**
+   * One document, filtered to the scopes the subject may read. Every method
+   * that hands a document back goes through here, including the ones that
+   * follow a write: a document returned from a mutation is a read like any
+   * other, and returning it whole served scopes the same subject would be
+   * refused by `get`. Its author still sees what it wrote, because an allow on
+   * execute confers read of that scope.
+   */
+  private gateDocument;
+  /**
+   * Retrieves a list of document model modules.
+   */
+  getDocumentModelModules(namespace?: string, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<DocumentModelModule>>;
+  /**
+   * Retrieves a specific document model module by document type.
+   *
+   * @param documentType - The document type identifier
+   * @returns The document model module
+   */
+  getDocumentModelModule(documentType: string): Promise<DocumentModelModule<any>>;
+  /**
+   * Retrieves the document model module matching the version the document is
+   * stamped with, so not-yet-upgraded documents get the reducer their
+   * history was written with rather than the latest.
+   */
+  getDocumentModelModuleForDocument(document: PHDocument): Promise<DocumentModelModule<any>>;
+  /**
+   * Retrieves a specific PHDocument
+   */
+  get<TDocument extends PHDocument>(identifier: string, view?: ViewFilter, signal?: AbortSignal): Promise<TDocument>;
+  /**
+   * Resolves an identifier (id or slug) to the canonical document id, using the
+   * same lookup as the data path. Resolves against the "main" branch. Throws if
+   * the identifier cannot be resolved or is ambiguous.
+   */
+  resolveIdOrSlug(identifier: string, view?: ViewFilter, signal?: AbortSignal): Promise<string>;
+  /**
+   * Retrieves operations for a document
+   */
+  getOperations(documentIdentifier: string, view?: ViewFilter, filter?: OperationFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Operation>>;
+  private getOperationsWithCompositeCursor;
+  /**
+   * Retrieves outgoing relationships of a given type from a source document.
+   */
+  getOutgoingRelationships(sourceIdentifier: string, relationshipType: string, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
+  /**
+   * Retrieves incoming relationships of a given type to a target document.
+   */
+  getIncomingRelationships(targetIdentifier: string, relationshipType: string, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
+  /**
+   * Filters documents by criteria and returns a list of them
+   */
+  find(search: SearchFilter, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
+  /**
+   * Creates a document and waits for completion
+   */
+  create<TDocument extends PHDocument = PHDocument>(document: PHDocument, parentIdentifier?: string, signal?: AbortSignal): Promise<TDocument>;
+  /**
+   * Creates an empty document and waits for completion
+   */
+  createEmpty<TDocument extends PHDocument>(documentModelType: string, options?: CreateDocumentOptions, signal?: AbortSignal): Promise<TDocument>;
+  /**
+   * Upgrades a document to a newer document model version by dispatching an
+   * UPGRADE_DOCUMENT action. When toVersion is omitted, upgrades to the
+   * latest registered module version for the document's type. Returns the
+   * document unchanged when it is already at the target version.
+   *
+   * The executor validates the action's version and revision snapshot against
+   * the state the migration actually runs on. When a concurrent edit
+   * invalidates the snapshot, the upgrade is rebuilt from a fresh read and
+   * retried up to maxConflictRetries times before the conflict is surfaced.
+   */
+  upgradeDocument<TDocument extends PHDocument = PHDocument>(documentIdentifier: string, toVersion?: number, options?: UpgradeDocumentOptions, signal?: AbortSignal): Promise<TDocument>;
+  /**
+   * Creates an empty document in a drive as a single batched operation.
+   * Delegates to {@link IDriveClient.addFile}.
+   *
+   * @deprecated Use `client.drives.addFile` instead. This method will be
+   * removed in a future release.
+   */
+  createDocumentInDrive<TDocument extends PHDocument>(driveId: string, document: PHDocument, parentFolder?: string, signal?: AbortSignal): Promise<TDocument>;
+  /**
+   * Applies a list of actions to a document and waits for completion
+   */
+  execute<TDocument extends PHDocument>(documentIdentifier: string, branch: string, actions: Action[], signal?: AbortSignal): Promise<TDocument>;
+  /**
+   * Submits a list of actions to a document
+   */
+  executeAsync(documentIdentifier: string, branch: string, actions: Action[], signal?: AbortSignal): Promise<JobInfo>;
+  executeBatch(request: BatchExecutionRequest, signal?: AbortSignal): Promise<BatchExecutionResult>;
+  /**
+   * Renames a document and waits for completion
+   */
+  rename(documentIdentifier: string, name: string, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
+  /**
+   * Updates the preferred editor recorded in the document header meta.
+   * Pass `null` to clear it.
+   */
+  setPreferredEditor(documentIdentifier: string, preferredEditor: string | null, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
+  /**
+   * Adds multiple documents as children to another and waits for completion
+   */
+  addRelationship(sourceIdentifier: string, targetIdentifier: string, relationshipType: string, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
+  /**
+   * Removes a relationship between two documents and waits for completion.
+   */
+  removeRelationship(sourceIdentifier: string, targetIdentifier: string, relationshipType: string, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
+  /**
+   * Moves a relationship from one source document to another and waits for completion.
+   */
+  moveRelationship(sourceParentIdentifier: string, targetParentIdentifier: string, targetIdentifier: string, relationshipType: string, branch?: string, signal?: AbortSignal): Promise<{
+    source: PHDocument;
+    target: PHDocument;
+  }>;
+  loadBatch(request: BatchLoadRequest, signal?: AbortSignal): Promise<BatchLoadResult>;
+  /**
+   * Deletes a document and waits for completion
+   */
+  deleteDocument(identifier: string, propagate?: PropagationMode, signal?: AbortSignal): Promise<void>;
+  /**
+   * Deletes documents and waits for completion
+   */
+  deleteDocuments(identifiers: string[], propagate?: PropagationMode, signal?: AbortSignal): Promise<void>;
+  /**
+   * Retrieves the status of a job
+   */
+  getJobStatus(jobId: string, signal?: AbortSignal): Promise<JobInfo>;
+  /**
+   * Waits for a job to complete
+   */
+  waitForJob(jobId: string | JobInfo, signal?: AbortSignal): Promise<JobInfo>;
+  /**
+   * Subscribes to changes for documents matching specified filters
+   */
+  subscribe(search: SearchFilter, callback: (event: DocumentChangeEvent) => void, view?: ViewFilter): () => void;
+  private removeAllIncomingRelationships;
+}
+//#endregion
+//#region src/executor/interfaces.d.ts
+/**
+ * Snapshot of the single in-flight slot maintained by an {@link IExecutorWorker}.
+ */
+type WorkerInFlightSnapshot = {
+  correlationId: string;
+  jobId: string;
+};
+/**
+ * Outcome of a worker-side job execution.
+ *
+ * `result` mirrors the in-process `JobResult` exactly. `writeReady` carries
+ * the operations + jobMeta the parent needs to emit `JOB_WRITE_READY`, and is
+ * present only when the worker produced operations. It is absent on failure
+ * and on success-with-no-operations.
+ */
+type WorkerExecutionOutcome = {
+  result: JobResult;
+  writeReady?: JobWriteReadyPayload;
+};
+/**
+ * Parent-side handle for a single executor worker.
+ *
+ * Implementations wrap an IPC transport (worker_threads, child_process, or a
+ * test fake) and expose a transport-agnostic surface that the worker-pool
+ * manager uses to dispatch jobs. The handle owns one worker's lifecycle
+ * (`start` -> `execute`* -> `shutdown`) and bounds its in-flight map to a
+ * single entry; `SimpleJobExecutor` is single-threaded inside the worker, so
+ * concurrent dispatches would race its caches.
+ */
+interface IExecutorWorker {
+  /** Stable identifier of the worker (mirrors `InitMessage.workerId`). */
+  readonly workerId: string;
+  /** Zero-based index within the pool, used for sticky routing. */
+  readonly index: number;
+  /**
+   * Spawn the worker (if not already started), send the `init` payload and
+   * resolve when the worker replies with `ready`.
+   */
+  start(): Promise<void>;
+  /**
+   * Dispatch a job to the worker and resolve with its outcome — the
+   * `JobResult` and, on success-with-operations, a `writeReady` payload
+   * the parent will enrich and re-emit. Rejects with a transport-level
+   * error if the worker exits, aborts, or times out before producing a
+   * result.
+   */
+  execute(job: Job, signal?: AbortSignal): Promise<WorkerExecutionOutcome>;
+  /**
+   * Request cancellation of the in-flight job (if any). The handle posts an
+   * `abort` message; if the worker fails to reply within its grace window it
+   * is force-terminated.
+   */
+  abort(correlationId: string, reason?: string): void;
+  /**
+   * Stop the worker. When `graceful` is true the handle waits for the
+   * in-flight job to settle (up to `graceMs`) before terminating; otherwise
+   * the worker is terminated immediately.
+   */
+  shutdown(graceful: boolean, graceMs?: number): Promise<void>;
+  /**
+   * Register an additional document model on the running worker. Resolves
+   * when the worker replies with `model-loaded`; rejects when it replies
+   * with `model-load-failed` or the worker exits before answering.
+   */
+  loadModel(entry: ModelManifestEntry, signal?: AbortSignal): Promise<void>;
+  /** True when no job is currently in flight. */
+  isIdle(): boolean;
+  /** Snapshot of the in-flight slot, or null when idle. */
+  getInFlight(): WorkerInFlightSnapshot | null;
+}
+/**
+ * Simple interface for executing a job.
+ * A JobExecutor simply takes a job and executes it - nothing more.
+ */
+interface IJobExecutor {
+  /**
+   * Execute a single job.
+   * @param job - The job to execute
+   * @returns Promise that resolves to the job result
+   */
+  executeJob(job: Job, signal?: AbortSignal): Promise<JobResult>;
+}
+/**
+ * Interface for managing multiple job executors.
+ * Listens for 'jobAvailable' events from the event bus, pulls jobs from the queue,
+ * and coordinates the distribution of jobs across multiple executor instances.
+ */
+interface IJobExecutorManager {
+  /**
+   * Start the executor manager.
+   * Begins listening for 'jobAvailable' events and dispatching to executors.
+   *
+   * @param numExecutors - Number of executor instances to create
+   * @returns Promise that resolves when the manager is started
+   */
+  start(numExecutors: number): Promise<void>;
+  /**
+   * Stop the executor manager.
+   *
+   * @param graceful - Whether to wait for current jobs to complete
+   * @returns Promise that resolves when the manager is stopped
+   */
+  stop(graceful?: boolean): Promise<void>;
+  /**
+   * Get all managed executor instances.
+   *
+   * @returns Array of executor instances
+   */
+  getExecutors(): IJobExecutor[];
+  /**
+   * Get the current status of the manager.
+   *
+   * @returns The current manager status
+   */
+  getStatus(): ExecutorManagerStatus;
+}
+//#endregion
+//#region src/job-tracker/interfaces.d.ts
+/**
+ * Interface for tracking job lifecycle status.
+ * Maintains job state throughout execution: PENDING → RUNNING → COMPLETED/FAILED.
+ */
+interface IJobTracker {
+  /**
+   * Register a new job with PENDING status.
+   *
+   * @param jobInfo - The job information to register
+   */
+  registerJob(jobInfo: JobInfo): void;
+  /**
+   * Update a job's status to RUNNING.
+   *
+   * @param jobId - The job ID to mark as running
+   */
+  markRunning(jobId: string): void;
+  /**
+   * Mark a job as failed.
+   *
+   * @param jobId - The job ID to mark as failed
+   * @param error - Error information including message and stack trace
+   * @param job - Optional full job object for debugging purposes
+   */
+  markFailed(jobId: string, error: ErrorInfo$1, job?: Job): void;
+  /**
+   * Retrieve the current status of a job.
+   *
+   * @param jobId - The job ID to query
+   * @returns The job information, or null if the job is not found
+   */
+  getJobStatus(jobId: string): JobInfo | null;
+  /**
+   * Shutdown the job tracker and clean up resources.
+   * Unsubscribes from all event bus subscriptions.
+   */
+  shutdown(): void;
+}
+//#endregion
+//#region src/queue/interfaces.d.ts
+/**
+ * Interface for a job queue that manages write operations.
+ * Internally organizes jobs by documentId, scope, and branch to ensure proper ordering.
+ * Emits events to the event bus when new jobs are available for consumption.
+ */
+interface IQueue {
+  /**
+   * Add a new job to the queue.
+   * Jobs are automatically organized by documentId, scope, and branch internally.
+   * Emits a 'jobAvailable' event to the event bus when the job is queued.
+   * @param job - The job to add to the queue
+   * @returns Promise that resolves when the job is queued
+   */
+  enqueue(job: Job): Promise<void>;
+  /**
+   * Get the next job to execute for a specific document/scope/branch combination.
+   * @param documentId - The document ID to get jobs for
+   * @param scope - The scope to get jobs for
+   * @param branch - The branch to get jobs for
+   * @param signal - Optional abort signal to cancel the request
+   * @returns Promise that resolves to the next job execution handle or null if no jobs available
+   */
+  dequeue(documentId: string, scope: string, branch: string, signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
+  /**
+   * Get the next available job from any queue.
+   * @param signal - Optional abort signal to cancel the request
+   * @returns Promise that resolves to the next job execution handle or null if no jobs available
+   */
+  dequeueNext(signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
+  /**
+   * Get the next available job whose routing metadata satisfies the predicate.
+   * Walks ready sub-queue heads in queue insertion order, skips heads whose document
+   * is currently executing (same isDocumentExecuting gate as dequeueNext), and returns
+   * the first head for which predicate returns true.
+   * Returns null when paused, when nothing matches, or when the queue is empty.
+   * Rejects if signal is already aborted.
+   * @param predicate - Filter applied to JobRoutingMeta of each candidate head
+   * @param signal - Optional abort signal to cancel the request
+   * @returns Promise that resolves to the first matching job execution handle or null
+   */
+  dequeueNextMatching(predicate: (meta: JobRoutingMeta) => boolean, signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
+  /**
+   * Get the current size of the queue for a specific document/scope/branch.
+   * @param documentId - The document ID
    * @param scope - The scope
    * @param branch - The branch
    * @returns Promise that resolves to the number of jobs in the queue
@@ -2679,9 +3919,11 @@ interface IQueue {
    * Retry a failed job.
    * @param jobId - The ID of the job to retry
    * @param error - Optional error information from the failure
+   * @param accounting - Whether the attempt counts against the job's retry
+   * limit; defaults to {@link RetryAccounting.CountAgainstLimit}
    * @returns Promise that resolves when the job is requeued for retry
    */
-  retryJob(jobId: string, error?: ErrorInfo$1): Promise<void>;
+  retryJob(jobId: string, error?: ErrorInfo$1, accounting?: RetryAccounting): Promise<void>;
   /**
    * Returns true if and only if all jobs have been resolved.
    */
@@ -2690,213 +3932,88 @@ interface IQueue {
    * Blocks the queue from accepting new jobs.
    * @param onDrained - Optional callback to call when the queue is drained
    */
-  block(onDrained?: () => void): void;
-  /**
-   * Unblocks the queue from accepting new jobs.
-   */
-  unblock(): void;
-}
-//#endregion
-//#region src/read-models/types.d.ts
-interface ViewStateTable {
-  readModelId: string;
-  lastOrdinal: number;
-  lastOperationTimestamp: Generated<Date>;
-}
-interface DocumentSnapshotTable {
-  id: Generated<string>;
-  documentId: string;
-  slug: string | null;
-  name: string | null;
-  scope: string;
-  branch: string;
-  content: unknown;
-  documentType: string;
-  lastOperationIndex: number;
-  lastOperationHash: string;
-  lastUpdatedAt: Generated<Date>;
-  snapshotVersion: Generated<number>;
-  identifiers: unknown;
-  metadata: unknown;
-  isDeleted: Generated<boolean>;
-  deletedAt: Date | null;
-}
-interface SlugMappingTable {
-  slug: string;
-  documentId: string;
-  scope: string;
-  branch: string;
-  createdAt: Generated<Date>;
-  updatedAt: Generated<Date>;
-}
-interface ProcessorCursorTable {
-  processorId: string;
-  factoryId: string;
-  driveId: string;
-  processorIndex: number;
-  lastOrdinal: Generated<number>;
-  status: Generated<string>;
-  lastError: string | null;
-  lastErrorTimestamp: Date | null;
-  createdAt: Generated<Date>;
-  updatedAt: Generated<Date>;
-}
-interface DocumentViewDatabase {
-  ViewState: ViewStateTable;
-  DocumentSnapshot: DocumentSnapshotTable;
-  SlugMapping: SlugMappingTable;
-  ProcessorCursor: ProcessorCursorTable;
-}
-type InsertableDocumentSnapshot = Insertable<DocumentSnapshotTable>;
-//#endregion
-//#region src/core/model-sources.d.ts
-/** An importable file holding one or more document-model exports. */
-type FileModelSource = {
-  filePath: string;
-  exportName?: string;
-};
-/** An importable package specifier holding one or more document-model exports. */
-type PackageModelSource = {
-  packageName: string;
-  subpath?: string;
-  exportName?: string;
-};
-/**
- * A source of document models: a live module, an importable file, or an
- * importable package. File and package sources can cross a worker-thread
- * boundary (workers re-import them); a live module cannot.
- */
-type DocumentModelSource = DocumentModelModule<any> | FileModelSource | PackageModelSource;
-//#endregion
-//#region src/registry/interfaces.d.ts
-type RegistrationResult<T> = {
-  status: "success";
-  item: T;
-} | {
-  status: "error";
-  item: T;
-  error: Error;
-};
-/**
- * Loader that asynchronously resolves a document type to a
- * {@link DocumentModelSource}. Used by the queue to gate CREATE_DOCUMENT
- * jobs until the required model is available in the registry.
- *
- * Return an importable source ({ filePath } or { packageName }) whenever
- * possible: the resolver registers the resolved models on the host registry
- * and broadcasts importable sources to executor workers. A live
- * DocumentModelModule is also valid but host-only — it cannot cross a
- * worker-thread boundary, so worker pools will not receive it.
- */
-interface IDocumentModelLoader {
-  load(documentType: string): Promise<DocumentModelSource>;
-}
-/**
- * Registry for managing document model modules.
- * Provides centralized access to document models' reducers, utils, and specifications.
- * Supports version-aware module storage and upgrade manifest management.
- */
-interface IDocumentModelRegistry {
-  /**
-   * Register multiple modules at once.
-   * Modules without a version field default to version 1.
-   * Invalid or duplicate modules are skipped without breaking registration of the remaining modules.
-   *
-   * @param modules Document model modules to register
-   * @returns Array of results, one per module, indicating success or failure
-   */
-  registerModules(...modules: DocumentModelModule<any>[]): RegistrationResult<DocumentModelModule<any>>[];
-  /**
-   * Unregister all versions of the specified document types.
-   *
-   * @param documentTypes The document types to unregister
-   * @returns true if all modules were unregistered, false if any were not found
-   */
-  unregisterModules(...documentTypes: string[]): boolean;
-  /**
-   * Get a specific document model module by document type and optional version.
-   * If version is not specified, returns the latest version.
-   *
-   * @param documentType The document type identifier
-   * @param version Optional version number to retrieve
-   * @returns The document model module
-   * @throws ModuleNotFoundError if the document type or version is not registered
-   */
-  getModule(documentType: string, version?: number): DocumentModelModule<any>;
-  /**
-   * Get all registered document model modules.
-   *
-   * @returns Array of all registered modules
-   */
-  getAllModules(): DocumentModelModule<any>[];
-  /**
-   * Clear all registered modules and upgrade manifests.
-   */
-  clear(): void;
-  /**
-   * Get all supported versions for a document type, sorted in ascending order.
-   *
-   * @param documentType The document type identifier
-   * @returns Array of version numbers sorted ascending
-   * @throws ModuleNotFoundError if no modules are registered for the document type
-   */
-  getSupportedVersions(documentType: string): number[];
-  /**
-   * Get the latest (highest) version number for a document type.
-   *
-   * @param documentType The document type identifier
-   * @returns The highest version number registered for this document type
-   * @throws ModuleNotFoundError if no modules are registered for the document type
-   */
-  getLatestVersion(documentType: string): number;
-  /**
-   * Register upgrade manifests that define upgrade paths between versions.
-   * Invalid or duplicate manifests are skipped without breaking registration of the remaining manifests.
-   *
-   * @param manifests Upgrade manifests to register
-   * @returns Array of results, one per manifest, indicating success or failure
-   */
-  registerUpgradeManifests(...manifests: UpgradeManifest<readonly number[]>[]): RegistrationResult<UpgradeManifest<readonly number[]>>[];
-  /**
-   * Unregister upgrade manifests for the specified document types.
-   * @param documentTypes The document types whose upgrade manifests should be unregistered
-   * @returns true if all modules were unregistered, false if any were not found
-   **/
-  unregisterUpgradeManifests(...documentTypes: string[]): boolean;
-  /**
-   * Get the upgrade manifest for a document type.
-   *
-   * @param documentType The document type identifier
-   * @returns The upgrade manifest
-   * @throws ManifestNotFoundError if no manifest is registered for the document type
-   */
-  getUpgradeManifest(documentType: string): UpgradeManifest<readonly number[]>;
-  /**
-   * Compute the upgrade path from one version to another.
-   * Returns the sequence of upgrade transitions needed.
-   *
-   * @param documentType The document type identifier
-   * @param fromVersion The starting version
-   * @param toVersion The target version
-   * @returns Array of upgrade transitions in order
-   * @throws DowngradeNotSupportedError if toVersion is less than fromVersion
-   * @throws ManifestNotFoundError if no upgrade manifest is registered
-   * @throws MissingUpgradeTransitionError if any transition in the path is missing
-   */
-  computeUpgradePath(documentType: string, fromVersion: number, toVersion: number): UpgradeTransition[];
+  block(onDrained?: () => void): void;
   /**
-   * Get the upgrade reducer for a single-step version transition.
-   *
-   * @param documentType The document type identifier
-   * @param fromVersion The starting version
-   * @param toVersion The target version (must be fromVersion + 1)
-   * @returns The upgrade reducer function
-   * @throws InvalidUpgradeStepError if toVersion is not fromVersion + 1
-   * @throws ManifestNotFoundError if no upgrade manifest is registered
-   * @throws MissingUpgradeTransitionError if the transition is not found
+   * Unblocks the queue from accepting new jobs.
    */
-  getUpgradeReducer(documentType: string, fromVersion: number, toVersion: number): UpgradeReducer<any, any>;
+  unblock(): void;
+}
+//#endregion
+//#region src/core/group-reevaluation-trigger.d.ts
+/**
+ * Watches committed writes for group membership changes and enqueues a
+ * re-evaluation job for every document whose auth history references the
+ * changed group, found through the reverse direction of the group-reference
+ * relation. Each affected document is re-judged in its own job, so the work
+ * runs under that document's execution slot rather than the group's.
+ *
+ * The job carries the earliest changed membership timestamp; the executor
+ * skips the pass when everything the document holds sorts before it, which
+ * keeps the common case (a membership write later than all history) free.
+ */
+declare class GroupReevaluationTrigger {
+  private logger;
+  private eventBus;
+  private queue;
+  private operationIndex;
+  private unsubscribe?;
+  constructor(logger: ILogger, eventBus: IEventBus, queue: IQueue, operationIndex: IOperationIndex);
+  startup(): void;
+  shutdown(): void;
+  private onWriteReady;
+}
+//#endregion
+//#region src/read-models/types.d.ts
+interface ViewStateTable {
+  readModelId: string;
+  lastOrdinal: number;
+  lastOperationTimestamp: Generated<Date>;
+}
+interface DocumentSnapshotTable {
+  id: Generated<string>;
+  documentId: string;
+  slug: string | null;
+  name: string | null;
+  scope: string;
+  branch: string;
+  content: unknown;
+  documentType: string;
+  lastOperationIndex: number;
+  lastOperationHash: string;
+  lastUpdatedAt: Generated<Date>;
+  snapshotVersion: Generated<number>;
+  identifiers: unknown;
+  metadata: unknown;
+  isDeleted: Generated<boolean>;
+  deletedAt: Date | null;
+}
+interface SlugMappingTable {
+  slug: string;
+  documentId: string;
+  scope: string;
+  branch: string;
+  createdAt: Generated<Date>;
+  updatedAt: Generated<Date>;
+}
+interface ProcessorCursorTable {
+  processorId: string;
+  factoryId: string;
+  driveId: string;
+  processorIndex: number;
+  lastOrdinal: Generated<number>;
+  status: Generated<string>;
+  lastError: string | null;
+  lastErrorTimestamp: Date | null;
+  createdAt: Generated<Date>;
+  updatedAt: Generated<Date>;
+}
+interface DocumentViewDatabase {
+  ViewState: ViewStateTable;
+  DocumentSnapshot: DocumentSnapshotTable;
+  SlugMapping: SlugMappingTable;
+  ProcessorCursor: ProcessorCursorTable;
 }
+type InsertableDocumentSnapshot = Insertable<DocumentSnapshotTable>;
 //#endregion
 //#region src/shared/consistency-tracker.d.ts
 interface IConsistencyTracker {
@@ -2946,134 +4063,6 @@ declare class ConsistencyTracker implements IConsistencyTracker {
   private removeWaiter;
 }
 //#endregion
-//#region src/storage/kysely/types.d.ts
-interface OperationTable {
-  id: Generated<number>;
-  jobId: string;
-  opId: string;
-  prevOpId: string;
-  writeTimestampUtcMs: Generated<Date>;
-  documentId: string;
-  documentType: string;
-  scope: string;
-  branch: string;
-  timestampUtcMs: Date;
-  index: number;
-  action: unknown;
-  skip: number;
-  error?: string | null;
-  hash: string;
-}
-interface KeyframeTable {
-  id: Generated<number>;
-  documentId: string;
-  documentType: string;
-  scope: string;
-  branch: string;
-  revision: number;
-  document: unknown;
-  createdAt: Generated<Date>;
-}
-interface DocumentCollectionTable {
-  documentId: string;
-  collectionId: string;
-  joinedOrdinal: bigint;
-  leftOrdinal: bigint | null;
-}
-interface OperationIndexOperationTable {
-  ordinal: Generated<number>;
-  opId: string;
-  documentId: string;
-  documentType: string;
-  scope: string;
-  branch: string;
-  timestampUtcMs: string;
-  writeTimestampUtcMs: Generated<Date>;
-  index: number;
-  skip: number;
-  hash: string;
-  action: unknown;
-  sourceRemote: Generated<string>;
-}
-interface SyncRemoteTable {
-  name: string;
-  collection_id: string;
-  channel_type: string;
-  channel_id: string;
-  remote_name: string;
-  channel_parameters: unknown;
-  filter_document_ids: unknown;
-  filter_scopes: unknown;
-  filter_branch: string;
-  push_state: string;
-  push_last_success_utc_ms: string | null;
-  push_last_failure_utc_ms: string | null;
-  push_failure_count: number;
-  pull_state: string;
-  pull_last_success_utc_ms: string | null;
-  pull_last_failure_utc_ms: string | null;
-  pull_failure_count: number;
-  created_at: Generated<Date>;
-  updated_at: Generated<Date>;
-}
-interface SyncCursorTable {
-  remote_name: string;
-  cursor_type: string;
-  cursor_ordinal: bigint;
-  last_synced_at_utc_ms: string | null;
-  updated_at: Generated<Date>;
-}
-/**
- * Kysely table definition for the `sync_dead_letters` table.
- */
-interface SyncDeadLetterTable {
-  ordinal: Generated<number>;
-  id: string;
-  job_id: string;
-  job_dependencies: unknown;
-  remote_name: string;
-  document_id: string;
-  scopes: unknown;
-  branch: string;
-  operations: unknown;
-  error_source: string;
-  error_message: string;
-  created_at: Generated<Date>;
-}
-interface Database$1 {
-  Operation: OperationTable;
-  Keyframe: KeyframeTable;
-  document_collections: DocumentCollectionTable;
-  operation_index_operations: OperationIndexOperationTable;
-  sync_remotes: SyncRemoteTable;
-  sync_cursors: SyncCursorTable;
-  sync_dead_letters: SyncDeadLetterTable;
-}
-interface DocumentTable {
-  id: string;
-  createdAt: Generated<Date>;
-  updatedAt: Generated<Date>;
-}
-interface DocumentRelationshipTable {
-  id: Generated<string>;
-  sourceId: string;
-  targetId: string;
-  relationshipType: string;
-  metadata: unknown;
-  createdAt: Generated<Date>;
-  updatedAt: Generated<Date>;
-}
-interface IndexerStateTable {
-  id: Generated<number>;
-  lastOperationId: number;
-  lastOperationTimestamp: Generated<Date>;
-}
-interface DocumentIndexerDatabase {
-  Document: DocumentTable;
-  DocumentRelationship: DocumentRelationshipTable;
-  IndexerState: IndexerStateTable;
-}
-//#endregion
 //#region src/storage/pool-instrumentation.d.ts
 /**
  * Snapshot of a pg.Pool's internal counters at a point in time.
@@ -3137,7 +4126,13 @@ declare class PollingChannelError extends Error {
 declare class ChannelError extends Error {
   source: ChannelErrorSource;
   error: Error;
-  constructor(source: ChannelErrorSource, error: Error);
+  /**
+   * The classification when something other than the error carries it. Absent
+   * means derive it from `error.name`; a dead letter mirrored from a peer sets it,
+   * because only the message crosses the wire.
+   */
+  readonly errorType?: SyncOperationErrorType;
+  constructor(source: ChannelErrorSource, error: Error, errorType?: SyncOperationErrorType);
 }
 //#endregion
 //#region src/sync/sync-operation.d.ts
@@ -3736,6 +4731,12 @@ interface ReactorModule {
  * integration scenarios.
  */
 interface InProcessReactorModule extends ReactorModule {
+  /**
+   * The enforcement flags this reactor resolved, as plain booleans. Held on the
+   * module because they select what a read enforces as well as what a write
+   * does, and the read surface is composed outside the reactor.
+   */
+  featureFlags: ReactorFeatureFlags;
   queue: IQueue;
   jobTracker: IJobTracker;
   executorManager: IJobExecutorManager;
@@ -3754,6 +4755,12 @@ interface InProcessReactorModule extends ReactorModule {
   processorManagerConsistencyTracker: IConsistencyTracker;
   reactor: IReactor;
   syncModule: InProcessSyncModule | undefined;
+  /**
+   * Present when authGroups is on: enqueues re-evaluation jobs for the
+   * documents a group membership change affects. Started by the builder;
+   * hosts shut it down alongside the sync manager.
+   */
+  groupReevaluationTrigger: GroupReevaluationTrigger | undefined;
   /**
    * Instrumented pg.Pool handles registered with the builder, either by
    * createPostgresDatabase or by withInstrumentedPool. Empty when no pg
@@ -3815,12 +4822,6 @@ declare class DriveClient implements IDriveClient {
   private removeFileNode;
 }
 //#endregion
-//#region src/cache/collection-membership-cache.d.ts
-interface ICollectionMembershipCache {
-  getCollectionsForDocuments(documentIds: string[]): Promise<Record<string, string[]>>;
-  invalidate(documentId: string): void;
-}
-//#endregion
 //#region src/registry/document-model-resolver.d.ts
 interface IDocumentModelResolver {
   ensureModelLoaded(documentType: string): Promise<void>;
@@ -3857,60 +4858,28 @@ declare class DocumentModelResolver implements IDocumentModelResolver {
    * peers (tabs) can load the same type via the event bus.
    */
   setModelLoadedHook(hook: (documentType: string) => Promise<void>): void;
-  ensureModelLoaded(documentType: string): Promise<void>;
-  private loadRegisterAndBroadcast;
-  private notifyPeersModelLoaded;
-}
-/**
- * No-op resolver used when no document model loader is configured.
- * Checks the registry for the model and returns if found; throws if not.
- * Since there is no loader, missing models cannot be recovered.
- */
-declare class NullDocumentModelResolver implements IDocumentModelResolver {
-  private registry?;
-  constructor(registry?: IDocumentModelRegistry | undefined);
-  ensureModelLoaded(documentType: string): Promise<void>;
-}
-//#endregion
-//#region src/executor/worker-pool-job-executor-manager.d.ts
-/**
- * Factory invoked once per worker at `start()` time. The index is the
- * worker's position in the pool and the same value the manager will use
- * for sticky routing (`bucketFor(documentId) === index`).
- */
-type WorkerFactory = (index: number) => IExecutorWorker;
-//#endregion
-//#region src/cache/write-cache-types.d.ts
-/**
- * Configuration options for the write cache
- */
-type WriteCacheConfig = {
-  /** Maximum number of document streams to cache (LRU eviction). Default: 1000 */maxDocuments: number; /** Number of snapshots to keep in each document's ring buffer. Default: 10 */
-  ringBufferSize: number; /** Persist a keyframe snapshot every N revisions. Default: 10 */
-  keyframeInterval: number;
-};
-/**
- * Unique identifier for a document stream
- */
-type DocumentStreamKey = {
-  /** Document identifier */documentId: string; /** Operation scope */
-  scope: string; /** Branch name */
-  branch: string;
-};
+  ensureModelLoaded(documentType: string): Promise<void>;
+  private loadRegisterAndBroadcast;
+  private notifyPeersModelLoaded;
+}
 /**
- * A cached document snapshot at a specific revision
+ * No-op resolver used when no document model loader is configured.
+ * Checks the registry for the model and returns if found; throws if not.
+ * Since there is no loader, missing models cannot be recovered.
  */
-type CachedSnapshot = {
-  /** The revision number of this snapshot */revision: number; /** The document state at this revision */
-  document: PHDocument;
-};
+declare class NullDocumentModelResolver implements IDocumentModelResolver {
+  private registry?;
+  constructor(registry?: IDocumentModelRegistry | undefined);
+  ensureModelLoaded(documentType: string): Promise<void>;
+}
+//#endregion
+//#region src/executor/worker-pool-job-executor-manager.d.ts
 /**
- * Serialized keyframe snapshot for K/V store persistence
+ * Factory invoked once per worker at `start()` time. The index is the
+ * worker's position in the pool and the same value the manager will use
+ * for sticky routing (`bucketFor(documentId) === index`).
  */
-type KeyframeSnapshot = {
-  /** The revision number of this keyframe */revision: number; /** Serialized document state */
-  document: string;
-};
+type WorkerFactory = (index: number) => IExecutorWorker;
 //#endregion
 //#region src/projection/protocol.d.ts
 /**
@@ -4162,6 +5131,7 @@ declare class SyncBuilder {
  * them (`BaseReadModel` subclasses, in particular).
  */
 interface ReadModelFactoryDeps {
+  documentModelRegistry: IDocumentModelRegistry;
   operationIndex: IOperationIndex;
   writeCache: IWriteCache;
   processorManagerConsistencyTracker: IConsistencyTracker;
@@ -4383,6 +5353,7 @@ declare class ReactorClientBuilder {
   private subscriptionManager?;
   private jobAwaiter?;
   private documentModelLoader?;
+  private readGate?;
   /**
    * Sets the logger for the ReactorClient.
    * @param logger - The logger to use.
@@ -4406,6 +5377,22 @@ declare class ReactorClientBuilder {
   withSubscriptionManager(subscriptionManager: IReactorSubscriptionManager): this;
   withJobAwaiter(jobAwaiter: IJobAwaiter): this;
   withDocumentModelLoader(loader: IDocumentModelLoader): this;
+  /**
+   * Overrides how reads are gated. A client built from a ReactorBuilder derives
+   * this from that reactor's flags; one built from `withReactor` cannot, because
+   * it is handed no flags and no registry, so it gates on the policy alone
+   * unless a gate is supplied here.
+   */
+  withReadGate(readGate: IReadGate): this;
+  /**
+   * The gate this reactor's flags call for. Below authEnforcement there is no
+   * model to enforce -- the registered one ignores the auth scope -- so the
+   * policy is evaluated on its own, which is what reads did before the model
+   * existed. Group serving turns on with authGroups, because below it a
+   * `{ group }` grant does not match, so a served roster is one no grant can
+   * use.
+   */
+  private resolveReadGate;
   build(): Promise<ReactorClient>;
   buildModule(): Promise<InProcessReactorClientModule>;
 }
@@ -4500,568 +5487,229 @@ type ParsedPaging = {
  */
 declare function parsePagingOptions(paging: PagingOptions | undefined, defaultLimit: number): ParsedPaging;
 //#endregion
-//#region src/subs/default-error-handler.d.ts
-/**
- * Default error handler that re-throws subscription errors.
- * This ensures that errors are not silently swallowed.
- */
-declare class DefaultSubscriptionErrorHandler implements ISubscriptionErrorHandler {
-  handleError(error: unknown, context: SubscriptionErrorContext): void;
-}
-//#endregion
-//#region src/subs/react-subscription-manager.d.ts
-type DocumentCreatedCallback = (result: PagedResults<string>) => void;
-type DocumentDeletedCallback = (documentIds: string[]) => void;
-type DocumentStateUpdatedCallback = (result: PagedResults<PHDocument>) => void;
-type RelationshipChangedCallback = (parentId: string, childId: string, changeType: RelationshipChangeType) => void;
-declare class ReactorSubscriptionManager implements IReactorSubscriptionManager {
-  private createdSubscriptions;
-  private deletedSubscriptions;
-  private updatedSubscriptions;
-  private relationshipSubscriptions;
-  private subscriptionCounter;
-  private errorHandler;
-  constructor(errorHandler: ISubscriptionErrorHandler);
-  onDocumentCreated(callback: DocumentCreatedCallback, search?: SearchFilter): () => void;
-  onDocumentDeleted(callback: DocumentDeletedCallback, search?: SearchFilter): () => void;
-  onDocumentStateUpdated(callback: DocumentStateUpdatedCallback, search?: SearchFilter, view?: ViewFilter): () => void;
-  onRelationshipChanged(callback: RelationshipChangedCallback, search?: SearchFilter): () => void;
-  /**
-   * Notify subscribers about created documents
-   */
-  notifyDocumentsCreated(documentIds: string[], documentTypes?: Map<string, string>, parentIds?: Map<string, string | null>): void;
-  /**
-   * Notify subscribers about deleted documents
-   */
-  notifyDocumentsDeleted(documentIds: string[], documentTypes?: Map<string, string>, parentIds?: Map<string, string | null>): void;
-  /**
-   * Notify subscribers about updated documents
-   */
-  notifyDocumentsUpdated(documents: PHDocument[]): void;
-  /**
-   * Notify subscribers about relationship changes
-   */
-  notifyRelationshipChanged(parentId: string, childId: string, changeType: RelationshipChangeType, childType?: string): void;
-  /**
-   * Clear all subscriptions
-   */
-  clearAll(): void;
-  private filterDocumentIds;
-  private filterDocuments;
-  private matchesRelationshipFilter;
-}
-//#endregion
-//#region src/events/event-bus.d.ts
-declare class EventBus implements IEventBus {
-  readonly eventTypeToSubscribers: Map<number, Subscriber[]>;
-  subscribe<K>(type: number, subscriber: (type: number, event: K) => void | Promise<void>): Unsubscribe;
-  emit(type: number, data: any): Promise<void>;
-}
-//#endregion
-//#region src/queue/queue.d.ts
-/**
- * In-memory implementation of the IQueue interface.
- * Organizes jobs by documentId, scope, and branch to ensure proper ordering.
- * Ensures serial execution per document by tracking executing jobs.
- * Implements dependency management through queue hints.
- */
-declare class InMemoryQueue implements IQueue {
-  private eventBus;
-  private resolver;
-  private queues;
-  private jobIdToQueueKey;
-  private docIdToJobId;
-  private jobIdToDocId;
-  private completedJobs;
-  private jobIndex;
-  private isBlocked;
-  private onDrainedCallback?;
-  private isPausedFlag;
-  constructor(eventBus: IEventBus, resolver: IDocumentModelResolver);
-  private toErrorInfo;
-  /**
-   * Creates a unique key for a document/scope/branch combination
-   */
-  private createQueueKey;
-  /**
-   * Gets or creates a queue for the given key
-   */
-  private getQueue;
-  /**
-   * Check if a document has any jobs currently executing
-   */
-  private isDocumentExecuting;
-  /**
-   * Mark a job as executing for its document
-   */
-  private markJobExecuting;
-  /**
-   * Mark a job as no longer executing for its document
-   */
-  private markJobComplete;
-  /**
-   * Check if all dependencies for a job have been completed
-   */
-  private areDependenciesMet;
-  /**
-   * Returns the head of the sub-queue if its dependencies are met, or null.
-   *
-   * The dispatcher only ever considers the head — a dep-blocked head holds
-   * the rest of its sub-queue. This preserves per-(documentId, scope, branch)
-   * FIFO regardless of how dependencies are authored, and makes the queue's
-   * documented "serialized per document" invariant hold even when callers
-   * omit queueHint dependencies on jobs that share a sub-queue.
-   */
-  private getNextJobWithMetDependencies;
-  private getCreateDocumentType;
-  enqueue(job: Job): Promise<void>;
-  dequeue(documentId: string, scope: string, branch: string, signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
-  dequeueNext(signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
-  dequeueNextMatching(predicate: (meta: JobRoutingMeta) => boolean, signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
-  size(documentId: string, scope: string, branch: string): Promise<number>;
-  totalSize(): Promise<number>;
-  remove(jobId: string): Promise<boolean>;
-  clear(documentId: string, scope: string, branch: string): Promise<void>;
-  clearAll(): Promise<void>;
-  hasJobs(): Promise<boolean>;
-  completeJob(jobId: string): Promise<void>;
-  failJob(jobId: string, error?: ErrorInfo$1): Promise<void>;
-  deferJob(jobId: string): void;
-  retryJob(jobId: string, error?: ErrorInfo$1): Promise<void>;
-  /**
-   * Check if the queue is drained and call the callback if it is
-   */
-  private checkDrained;
-  /**
-   * Returns true if and only if all jobs have been resolved.
-   */
-  get isDrained(): boolean;
-  /**
-   * Blocks the queue from accepting new jobs.
-   * @param onDrained - Optional callback to call when the queue is drained
-   */
-  block(onDrained?: () => void): void;
-  /**
-   * Unblocks the queue from accepting new jobs.
-   */
-  unblock(): void;
-  /**
-   * Pauses job dequeuing. Jobs can still be enqueued but dequeueNext() will return null.
-   */
-  pause(): void;
-  /**
-   * Resumes job dequeuing and emits JOB_AVAILABLE events for pending jobs to wake up executors.
-   */
-  resume(): Promise<void>;
-  /**
-   * Returns whether job dequeuing is paused.
-   */
-  get paused(): boolean;
-  /**
-   * Returns all pending jobs across all queues.
-   */
-  getPendingJobs(): Job[];
-  /**
-   * Returns a map of document IDs to sets of executing job IDs.
-   */
-  getExecutingJobIds(): Map<string, Set<string>>;
-  /**
-   * Returns a job by ID from the job index.
-   */
-  getJob(jobId: string): Job | undefined;
-}
-//#endregion
-//#region src/job-tracker/in-memory-job-tracker.d.ts
-/**
- * In-memory implementation of IJobTracker.
- * Maintains job status in a Map for synchronous access.
- * Subscribes to operation events to update job states.
- */
-declare class InMemoryJobTracker implements IJobTracker {
-  private eventBus;
-  private jobs;
-  private unsubscribers;
-  constructor(eventBus: IEventBus);
-  private subscribeToEvents;
-  private handleWriteReady;
-  private handleReadReady;
-  private handleJobFailed;
-  shutdown(): void;
-  registerJob(jobInfo: JobInfo): void;
-  markRunning(jobId: string): void;
-  markFailed(jobId: string, error: ErrorInfo$1, job?: Job): void;
-  getJobStatus(jobId: string): JobInfo | null;
-}
-//#endregion
-//#region src/executor/simple-job-executor-manager.d.ts
-type JobExecutorFactory = () => IJobExecutor;
-/**
- * Manages multiple job executors and coordinates job distribution.
- * Listens for job available events and dispatches jobs to executors.
- */
-declare class SimpleJobExecutorManager implements IJobExecutorManager {
-  private executorFactory;
-  private eventBus;
-  private queue;
-  private jobTracker;
-  private logger;
-  private resolver;
-  private executors;
-  private isRunning;
-  private activeJobs;
-  private totalJobsProcessed;
-  private unsubscribe?;
-  private deferredJobs;
-  private resultHandler;
-  private jobTimeoutMs;
-  constructor(executorFactory: JobExecutorFactory, eventBus: IEventBus, queue: IQueue, jobTracker: IJobTracker, logger: ILogger, resolver: IDocumentModelResolver, jobTimeoutMs?: number);
-  start(numExecutors: number): Promise<void>;
-  stop(graceful?: boolean): Promise<void>;
-  getExecutors(): IJobExecutor[];
-  getStatus(): ExecutorManagerStatus;
-  private processNextJob;
-  private checkForMoreJobs;
-  private processExistingJobs;
-  private flushDeferredJobs;
-}
-//#endregion
-//#region src/cache/document-meta-cache-types.d.ts
+//#region src/subs/default-error-handler.d.ts
 /**
- * Cached document metadata from the "document" scope.
- *
- * This lightweight structure holds essential document information needed by
- * the job executor without fetching full scope state. It provides an explicit
- * cross-scope contract for accessing document scope metadata.
+ * Default error handler that re-throws subscription errors.
+ * This ensures that errors are not silently swallowed.
  */
-type CachedDocumentMeta = {
+declare class DefaultSubscriptionErrorHandler implements ISubscriptionErrorHandler {
+  handleError(error: unknown, context: SubscriptionErrorContext): void;
+}
+//#endregion
+//#region src/subs/react-subscription-manager.d.ts
+type DocumentCreatedCallback = (result: PagedResults<string>) => void;
+type DocumentDeletedCallback = (documentIds: string[]) => void;
+type DocumentStateUpdatedCallback = (result: PagedResults<PHDocument>) => void;
+type RelationshipChangedCallback = (parentId: string, childId: string, changeType: RelationshipChangeType) => void;
+declare class ReactorSubscriptionManager implements IReactorSubscriptionManager {
+  private createdSubscriptions;
+  private deletedSubscriptions;
+  private updatedSubscriptions;
+  private relationshipSubscriptions;
+  private subscriptionCounter;
+  private errorHandler;
+  constructor(errorHandler: ISubscriptionErrorHandler);
+  onDocumentCreated(callback: DocumentCreatedCallback, search?: SearchFilter): () => void;
+  onDocumentDeleted(callback: DocumentDeletedCallback, search?: SearchFilter): () => void;
+  onDocumentStateUpdated(callback: DocumentStateUpdatedCallback, search?: SearchFilter, view?: ViewFilter): () => void;
+  onRelationshipChanged(callback: RelationshipChangedCallback, search?: SearchFilter): () => void;
   /**
-   * The full PHDocumentState from document.state.document.
-   * Contains version, hash, isDeleted, deletedAtUtcIso, etc.
+   * Notify subscribers about created documents
    */
-  state: PHDocumentState;
+  notifyDocumentsCreated(documentIds: string[], documentTypes?: Map<string, string>, parentIds?: Map<string, string | null>): void;
   /**
-   * The document type (from header), cached for convenience.
+   * Notify subscribers about deleted documents
    */
-  documentType: string;
+  notifyDocumentsDeleted(documentIds: string[], documentTypes?: Map<string, string>, parentIds?: Map<string, string | null>): void;
   /**
-   * The revision of the document scope when this metadata was captured.
-   * Used for cache invalidation and consistency checks.
+   * Notify subscribers about updated documents
    */
-  documentScopeRevision: number;
-};
-/**
- * Interface for the document metadata cache.
- *
- * This cache provides an explicit cross-scope contract for accessing document
- * scope metadata. It solves the problem where job execution in one scope (e.g.,
- * "global") needs access to document scope state (version, isDeleted, etc.)
- * which may be stale in scope-specific caches or keyframes.
- *
- * The cache supports:
- * - Latest metadata retrieval with LRU caching
- * - Historical metadata reconstruction for reshuffling scenarios
- * - Eager updates after document scope operations
- */
-interface IDocumentMetaCache {
+  notifyDocumentsUpdated(documents: PHDocument[]): void;
   /**
-   * Retrieves the LATEST document metadata from cache or rebuilds from operations.
-   *
-   * On cache miss, fetches all document scope operations and reconstructs the
-   * current PHDocumentState by applying UPGRADE_DOCUMENT and DELETE_DOCUMENT
-   * operations.
-   *
-   * @param documentId - The document identifier
-   * @param branch - Branch name
-   * @param signal - Optional abort signal to cancel the operation
-   * @returns The cached or rebuilt document metadata
-   * @throws {Error} "Operation aborted" if signal is aborted
-   * @throws {Error} If document not found (no CREATE_DOCUMENT operation)
+   * Notify subscribers about relationship changes
    */
-  getDocumentMeta(documentId: string, branch: string, signal?: AbortSignal): Promise<CachedDocumentMeta>;
+  notifyRelationshipChanged(parentId: string, childId: string, changeType: RelationshipChangeType, childType?: string): void;
   /**
-   * Rebuilds document metadata at a SPECIFIC revision (always rebuilds, no caching).
-   *
-   * Used during reshuffling when operations need to be inserted at a previous
-   * revision and we need the document scope state as of that point in time.
-   *
-   * @param documentId - The document identifier
-   * @param branch - Branch name
-   * @param targetRevision - The document scope revision to reconstruct up to
-   * @param signal - Optional abort signal to cancel the operation
-   * @returns Document metadata as of the target revision
-   * @throws {Error} "Operation aborted" if signal is aborted
-   * @throws {Error} If document not found
+   * Clear all subscriptions
    */
-  rebuildAtRevision(documentId: string, branch: string, targetRevision: number, signal?: AbortSignal): Promise<CachedDocumentMeta>;
+  clearAll(): void;
+  private filterDocumentIds;
+  private filterDocuments;
+  private matchesRelationshipFilter;
+}
+//#endregion
+//#region src/events/event-bus.d.ts
+declare class EventBus implements IEventBus {
+  readonly eventTypeToSubscribers: Map<number, Subscriber[]>;
+  subscribe<K>(type: number, subscriber: (type: number, event: K) => void | Promise<void>): Unsubscribe;
+  emit(type: number, data: any): Promise<void>;
+}
+//#endregion
+//#region src/queue/queue.d.ts
+/**
+ * In-memory implementation of the IQueue interface.
+ * Organizes jobs by documentId, scope, and branch to ensure proper ordering.
+ * Ensures serial execution per document by tracking executing jobs.
+ * Implements dependency management through queue hints.
+ */
+declare class InMemoryQueue implements IQueue {
+  private eventBus;
+  private resolver;
+  private queues;
+  private jobIdToQueueKey;
+  private docIdToJobId;
+  private jobIdToDocId;
+  private completedJobs;
+  private jobIndex;
+  private isBlocked;
+  private onDrainedCallback?;
+  private isPausedFlag;
+  constructor(eventBus: IEventBus, resolver: IDocumentModelResolver);
+  private toErrorInfo;
   /**
-   * Eagerly updates cached metadata after document scope operations.
-   *
-   * Called by the job executor after CREATE_DOCUMENT, UPGRADE_DOCUMENT, or
-   * DELETE_DOCUMENT operations to keep the cache current.
-   *
-   * @param documentId - The document identifier
-   * @param branch - Branch name
-   * @param meta - The new metadata to cache
+   * Creates a unique key for a document/scope/branch combination
    */
-  putDocumentMeta(documentId: string, branch: string, meta: CachedDocumentMeta): void;
+  private createQueueKey;
   /**
-   * Invalidates cached document metadata.
-   *
-   * Call before reshuffling operations that modify the document scope, or
-   * when document state may have changed externally.
-   *
-   * @param documentId - The document identifier
-   * @param branch - Optional branch to narrow invalidation (if omitted, all branches)
-   * @returns Number of entries invalidated
+   * Gets or creates a queue for the given key
    */
-  invalidate(documentId: string, branch?: string): number;
+  private getQueue;
   /**
-   * Clears all cached document metadata.
+   * Check if a document has any jobs currently executing
    */
-  clear(): void;
+  private isDocumentExecuting;
   /**
-   * Performs startup initialization.
+   * Mark a job as executing for its document
    */
-  startup(): Promise<void>;
+  private markJobExecuting;
   /**
-   * Performs graceful shutdown.
+   * Mark a job as no longer executing for its document
    */
-  shutdown(): Promise<void>;
-}
-//#endregion
-//#region src/cache/buffer/ring-buffer.d.ts
-/**
- * RingBuffer is a generic circular buffer implementation that stores a fixed number
- * of items. When the buffer is full, new items overwrite the oldest items.
- *
- * This implementation maintains O(1) time complexity for push operations and provides
- * items in chronological order (oldest to newest) via getAll().
- *
- * @template T - The type of items stored in the buffer
- */
-declare class RingBuffer<T> {
-  private buffer;
-  private head;
-  private size;
-  private capacity;
-  constructor(capacity: number);
+  private markJobComplete;
   /**
-   * Adds an item to the buffer. If the buffer is full, overwrites the oldest item.
-   *
-   * @param item - The item to add
+   * Check if all dependencies for a job have been completed
    */
-  push(item: T): void;
+  private areDependenciesMet;
   /**
-   * Returns all items in the buffer in chronological order (oldest to newest).
+   * Returns the head of the sub-queue if its dependencies are met, or null.
    *
-   * @returns Array of items in insertion order
-   */
-  getAll(): T[];
-  /**
-   * Clears all items from the buffer.
-   */
-  clear(): void;
-  /**
-   * Gets the current number of items in the buffer.
+   * The dispatcher only ever considers the head — a dep-blocked head holds
+   * the rest of its sub-queue. This preserves per-(documentId, scope, branch)
+   * FIFO regardless of how dependencies are authored, and makes the queue's
+   * documented "serialized per document" invariant hold even when callers
+   * omit queueHint dependencies on jobs that share a sub-queue.
    */
-  get length(): number;
-}
-//#endregion
-//#region src/cache/kysely-write-cache.d.ts
-type DocumentStream = {
-  key: string;
-  ringBuffer: RingBuffer<CachedSnapshot>;
-};
-/**
- * In-memory write cache with keyframe persistence for PHDocuments.
- *
- * Caches document snapshots in ring buffers with LRU eviction. On cache miss,
- * rebuilds documents from nearest keyframe or full operation history.
- *
- * **Performance Characteristics:**
- * - Cache hit: O(1) lookup in ring buffer
- * - Cold miss: O(n) where n is total operation count, or O(k) where k is operations since keyframe
- * - Warm miss: O(m) where m is operations since cached revision
- * - Eviction: O(1) for LRU tracking and removal
- *
- * **Thread Safety:**
- * Not thread-safe. Designed for single-threaded job executor environment.
- * External synchronization required for concurrent access across multiple executors.
- *
- * **Example:**
- * ```typescript
- * const cache = new KyselyWriteCache(
- *   keyframeStore,
- *   operationStore,
- *   registry,
- *   { maxDocuments: 1000, ringBufferSize: 10, keyframeInterval: 10 }
- * );
- *
- * await cache.startup();
- *
- * // Retrieve or rebuild document
- * const doc = await cache.getState(docId, docType, scope, branch, revision);
- *
- * // Cache result after job execution
- * cache.putState(docId, docType, scope, branch, newRevision, updatedDoc);
- *
- * await cache.shutdown();
- * ```
- */
-declare class KyselyWriteCache implements IWriteCache {
-  private streams;
-  private lruTracker;
-  private keyframeStore;
-  private operationStore;
-  private registry;
-  private config;
-  constructor(keyframeStore: IKeyframeStore, operationStore: IOperationStore, registry: IDocumentModelRegistry, config: WriteCacheConfig);
-  withScopedStores(operationStore: IOperationStore, keyframeStore: IKeyframeStore): KyselyWriteCache;
+  private getNextJobWithMetDependencies;
+  private getCreateDocumentType;
+  enqueue(job: Job): Promise<void>;
+  dequeue(documentId: string, scope: string, branch: string, signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
+  dequeueNext(signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
+  dequeueNextMatching(predicate: (meta: JobRoutingMeta) => boolean, signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
+  size(documentId: string, scope: string, branch: string): Promise<number>;
+  totalSize(): Promise<number>;
+  remove(jobId: string): Promise<boolean>;
+  clear(documentId: string, scope: string, branch: string): Promise<void>;
+  clearAll(): Promise<void>;
+  hasJobs(): Promise<boolean>;
+  completeJob(jobId: string): Promise<void>;
+  failJob(jobId: string, error?: ErrorInfo$1): Promise<void>;
+  deferJob(jobId: string): void;
+  retryJob(jobId: string, error?: ErrorInfo$1, accounting?: RetryAccounting): Promise<void>;
   /**
-   * Initializes the write cache.
-   * Currently a no-op as keyframe store lifecycle is managed externally.
+   * Check if the queue is drained and call the callback if it is
    */
-  startup(): Promise<void>;
+  private checkDrained;
   /**
-   * Shuts down the write cache.
-   * Currently a no-op as keyframe store lifecycle is managed externally.
+   * Returns true if and only if all jobs have been resolved.
    */
-  shutdown(): Promise<void>;
+  get isDrained(): boolean;
   /**
-   * Retrieves document state at a specific revision from cache or rebuilds it.
-   *
-   * Cache hit path: Returns cached snapshot if available (O(1))
-   * Warm miss path: Rebuilds from cached base revision + incremental ops
-   * Cold miss path: Rebuilds from keyframe or from scratch using all operations
-   *
-   * @param documentId - The document identifier
-   * @param scope - The operation scope
-   * @param branch - The operation branch
-   * @param targetRevision - The target revision, or undefined for newest
-   * @param signal - Optional abort signal to cancel the operation
-   * @returns The document at the target revision
-   * @throws {Error} "Operation aborted" if signal is aborted
-   * @throws {ModuleNotFoundError} If document type not registered in registry
-   * @throws {Error} "Failed to rebuild document" if operation store fails
-   * @throws {Error} If reducer throws during operation application
-   * @throws {Error} If document serialization fails
+   * Blocks the queue from accepting new jobs.
+   * @param onDrained - Optional callback to call when the queue is drained
    */
-  getState(documentId: string, scope: string, branch: string, targetRevision?: number, signal?: AbortSignal): Promise<PHDocument>;
+  block(onDrained?: () => void): void;
   /**
-   * Stores a document snapshot in the cache at a specific revision.
-   *
-   * The cached document is a shallow copy of the input with its operation history
-   * truncated to the last operation per scope and its clipboard cleared. This keeps
-   * memory use and copy costs constant regardless of operation count. Consumers of
-   * getState() must not rely on the full operation history being present; the only
-   * guaranteed invariant is that operations[scope].at(-1) reflects the latest
-   * operation index for each scope.
-   *
-   * Updates LRU tracker and may evict least recently used stream if at capacity.
-   * Asynchronously persists keyframes at configured intervals (fire-and-forget).
-   *
-   * @param documentId - The document identifier
-   * @param scope - The operation scope
-   * @param branch - The operation branch
-   * @param revision - The revision number
-   * @param document - The document to cache
-   * @throws {Error} If document serialization fails
+   * Unblocks the queue from accepting new jobs.
    */
-  putState(documentId: string, scope: string, branch: string, revision: number, document: PHDocument): void;
+  unblock(): void;
   /**
-   * Invalidates cached document streams.
-   *
-   * Supports three invalidation scopes:
-   * - Document-level: invalidate(documentId) - removes all streams for document
-   * - Scope-level: invalidate(documentId, scope) - removes all branches for scope
-   * - Stream-level: invalidate(documentId, scope, branch) - removes specific stream
-   *
-   * @param documentId - The document identifier
-   * @param scope - Optional scope to narrow invalidation
-   * @param branch - Optional branch to narrow invalidation (requires scope)
-   * @returns The number of streams evicted
+   * Pauses job dequeuing. Jobs can still be enqueued but dequeueNext() will return null.
    */
-  invalidate(documentId: string, scope?: string, branch?: string): number;
+  pause(): void;
   /**
-   * Clears the entire cache, removing all cached document streams.
-   * Resets LRU tracking state. This operation always succeeds.
+   * Resumes job dequeuing and emits JOB_AVAILABLE events for pending jobs to wake up executors.
    */
-  clear(): void;
+  resume(): Promise<void>;
   /**
-   * Retrieves a specific stream for a document. Exposed on the implementation
-   * for testing, but not on the interface.
-   *
-   * @internal
+   * Returns whether job dequeuing is paused.
    */
-  getStream(documentId: string, scope: string, branch: string): DocumentStream | undefined;
-  private findNearestKeyframe;
-  private coldMissRebuild;
+  get paused(): boolean;
   /**
-   * Resolves which module version to use for a given operation in phase 2.
-   *
-   * Uses the validated-upgrade boundary rules from D7:
-   * - If `input.revision` is present: op.index < revision[scope] → before the upgrade boundary
-   * - Otherwise: timestamp fallback
-   * - Falls back to final module version when neither is decidable
+   * Returns all pending jobs across all queues.
    */
-  private resolveModuleVersionForOp;
-  private warmMissRebuild;
-  private findNearestOlderSnapshot;
-  private makeStreamKey;
-  private getOrCreateStream;
-  private isKeyframeRevision;
-}
-//#endregion
-//#region src/storage/kysely/store.d.ts
-declare class KyselyOperationStore implements IOperationStore {
-  private db;
-  private trx?;
-  constructor(db: Kysely<Database$1>);
-  private get queryExecutor();
-  withTransaction(trx: Transaction<Database$1>): KyselyOperationStore;
-  apply(documentId: string, documentType: string, scope: string, branch: string, revision: number, fn: (txn: AtomicTxn) => void | Promise<void>, signal?: AbortSignal): Promise<Operation[]>;
-  private resolveUniqueConstraint;
-  private executeApply;
-  private findIdempotentReplay;
-  getSince(documentId: string, scope: string, branch: string, revision: number, filter?: OperationFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Operation>>;
-  getSinceId(id: number, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<OperationWithContext$1>>;
-  getConflicting(documentId: string, scope: string, branch: string, minTimestamp: string, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Operation>>;
-  getRevisions(documentId: string, branch: string, signal?: AbortSignal): Promise<DocumentRevisions>;
-  private rowToOperation;
-  private rowToOperationWithContext;
+  getPendingJobs(): Job[];
+  /**
+   * Returns a map of document IDs to sets of executing job IDs.
+   */
+  getExecutingJobIds(): Map<string, Set<string>>;
+  /**
+   * Returns a job by ID from the job index.
+   */
+  getJob(jobId: string): Job | undefined;
 }
 //#endregion
-//#region src/storage/kysely/keyframe-store.d.ts
-declare class KyselyKeyframeStore implements IKeyframeStore {
-  private db;
-  private trx?;
-  constructor(db: Kysely<Database$1>);
-  private get queryExecutor();
-  withTransaction(trx: Transaction<Database$1>): KyselyKeyframeStore;
-  putKeyframe(documentId: string, scope: string, branch: string, revision: number, document: PHDocument, signal?: AbortSignal): Promise<void>;
-  findNearestKeyframe(documentId: string, scope: string, branch: string, targetRevision: number, signal?: AbortSignal): Promise<{
-    revision: number;
-    document: PHDocument;
-  } | undefined>;
-  listKeyframes(documentId: string, scope?: string, branch?: string, signal?: AbortSignal): Promise<Array<{
-    scope: string;
-    branch: string;
-    revision: number;
-    document: PHDocument;
-  }>>;
-  deleteKeyframes(documentId: string, scope?: string, branch?: string, signal?: AbortSignal): Promise<number>;
+//#region src/job-tracker/in-memory-job-tracker.d.ts
+/**
+ * In-memory implementation of IJobTracker.
+ * Maintains job status in a Map for synchronous access.
+ * Subscribes to operation events to update job states.
+ */
+declare class InMemoryJobTracker implements IJobTracker {
+  private eventBus;
+  private jobs;
+  private unsubscribers;
+  constructor(eventBus: IEventBus);
+  private subscribeToEvents;
+  private handleWriteReady;
+  private handleReadReady;
+  private handleJobFailed;
+  shutdown(): void;
+  registerJob(jobInfo: JobInfo): void;
+  markRunning(jobId: string): void;
+  markFailed(jobId: string, error: ErrorInfo$1, job?: Job): void;
+  getJobStatus(jobId: string): JobInfo | null;
 }
 //#endregion
-//#region src/executor/execution-scope.d.ts
-interface ExecutionStores {
-  operationStore: IOperationStore;
-  operationIndex: IOperationIndex;
-  writeCache: IWriteCache;
-  documentMetaCache: IDocumentMetaCache;
-  collectionMembershipCache: ICollectionMembershipCache;
-}
-interface IExecutionScope {
-  run<T>(fn: (stores: ExecutionStores) => Promise<T>, signal?: AbortSignal): Promise<T>;
+//#region src/executor/simple-job-executor-manager.d.ts
+type JobExecutorFactory = () => IJobExecutor;
+/**
+ * Manages multiple job executors and coordinates job distribution.
+ * Listens for job available events and dispatches jobs to executors.
+ */
+declare class SimpleJobExecutorManager implements IJobExecutorManager {
+  private executorFactory;
+  private eventBus;
+  private queue;
+  private jobTracker;
+  private logger;
+  private resolver;
+  private executors;
+  private isRunning;
+  private activeJobs;
+  private totalJobsProcessed;
+  private unsubscribe?;
+  private deferredJobs;
+  private resultHandler;
+  private jobTimeoutMs;
+  constructor(executorFactory: JobExecutorFactory, eventBus: IEventBus, queue: IQueue, jobTracker: IJobTracker, logger: ILogger, resolver: IDocumentModelResolver, jobTimeoutMs?: number);
+  start(numExecutors: number): Promise<void>;
+  stop(graceful?: boolean): Promise<void>;
+  getExecutors(): IJobExecutor[];
+  getStatus(): ExecutorManagerStatus;
+  private processNextJob;
+  private checkForMoreJobs;
+  private processExistingJobs;
+  private flushDeferredJobs;
 }
 //#endregion
 //#region src/executor/simple-job-executor.d.ts
@@ -5079,6 +5727,8 @@ declare class SimpleJobExecutor implements IJobExecutor {
   private collectionMembershipCache;
   private driveContainerTypes;
   private config;
+  private featureFlags;
+  private decisionModel;
   private signatureVerifierModule;
   private documentActionHandler;
   private executionScope;
@@ -5091,6 +5741,69 @@ declare class SimpleJobExecutor implements IJobExecutor {
   private getCollectionMembershipsForOperations;
   private processActions;
   private executeRegularAction;
+  /**
+   * Orders a write by timestamp and decides it where it lands. The caller
+   * supplies the timestamp, so a write can belong before operations already
+   * stored; those are re-appended alongside it, the way a load reshuffles.
+   *
+   * Deciding a backdated write at the stream heads instead of at its position
+   * would overwrite the verdict every other replica computes for it.
+   */
+  private positionByTimestamp;
+  /**
+   * Decides each operation where it lands and carries the verdict on it. A
+   * refused submitted action is reported to the caller and nothing is stored; a
+   * refused operation the reshuffle merely moved keeps its verdict, because it
+   * already holds a position.
+   *
+   * The operations carry the indexes and skips they will be stored at, because
+   * the walk resolves skips before it orders them.
+   */
+  private evaluatePositioned;
+  /**
+   * The scopes a re-evaluation pass visits, in a fixed order.
+   *
+   * The revisions map comes from a query with no ORDER BY, and the order is
+   * load-bearing: each scope's pass re-reads the auth stream, and the walk skips
+   * an operation by its stored denial, so a denial this pass just wrote is
+   * visible to a later-visited scope and invisible to an earlier one. The model's
+   * own projection order leads, then the rest sorted, so the pass is reproducible
+   * across replicas and across runs.
+   */
+  private evaluationOrder;
+  /**
+   * The first timestamp in the batch that does not strictly exceed everything
+   * ahead of it, or undefined when the whole batch is monotonic.
+   *
+   * The bound is carried forward rather than compared against one stored maximum,
+   * because a single execute can carry several auth actions stamped in the same
+   * millisecond. Letting a tie through would store a stream the position walk
+   * then refuses to read, with no repair path.
+   */
+  private firstNonMonotonicTimestamp;
+  /** The operations a batch of submitted actions appends at the scope's tail. */
+  private appendedOperations;
+  /**
+   * Re-evaluates the document when a write meets both criteria: it was written
+   * to a stream the model reads, and it is timestamped before an operation
+   * already stored. The caller supplies the timestamp and the reactor does not replace
+   * it, so a mutation job can write such an operation just as a load job can,
+   * which is why both executeJob and executeLoadJob call this.
+   */
+  private reevaluateIfCriteriaMet;
+  /**
+   * Re-evaluates every scope the model evaluates. Where an operation's
+   * evaluation differs from what is stored, the tail from that operation is
+   * re-appended, carrying a skip that spans the indices it supersedes.
+   */
+  private reevaluateDocument;
+  /**
+   * Re-judges a document's stored operations because a read-set stream in
+   * another document (a group) gained an operation. The trigger timestamp
+   * bounds the work: an operation later than everything this document holds
+   * cannot change any evaluation, so the pass is skipped.
+   */
+  private executeReevaluationJob;
   private executeLoadJob;
   private accumulateResultOrReturnError;
 }
@@ -5159,6 +5872,49 @@ declare class DocumentModelRegistry implements IDocumentModelRegistry {
   getUpgradeReducer(documentType: string, fromVersion: number, toVersion: number): UpgradeReducer<any, any>;
 }
 //#endregion
+//#region src/decision/build-decision-model.d.ts
+/**
+ * Reads each projection's stream through the supplied reader, recording the
+ * revision observed. Static projections resolve first; derived projections
+ * see only those and contribute a map from document id to state. Each
+ * distinct stream is read once and yields one append condition entry.
+ */
+declare function buildDecisionModel<M>(reader: IStreamStateReader, definition: (target: DecisionTarget) => DecisionModel<M>, target: DecisionTarget, signal?: AbortSignal): Promise<BuiltDecisionModel<M>>;
+//#endregion
+//#region src/decision/auth-decision-model.d.ts
+type AuthDecisionModel = {
+  document: PHDocumentState;
+  auth: PHAuthState;
+};
+/** This decision model uses both the document and the auth streams. */
+declare function authDecisionModel(target: DecisionTarget): DecisionModel<AuthDecisionModel>;
+//#endregion
+//#region src/decision/stream-order.d.ts
+/** Where a stream's stored order contradicts its timestamps. */
+type OutOfOrderPair = {
+  previous: Operation;
+  current: Operation;
+  /**
+   * `descending` cannot be walked at all. `tied` walks fine — the intra-stream
+   * rule breaks the tie by index — but violates the monotonic auth rule, so a
+   * stream holding one can never be replicated to a peer that lacks it.
+   */
+  kind: "descending" | "tied";
+};
+/**
+ * The first pair of effective operations whose stored order contradicts their
+ * timestamps, or undefined when the stream is in position order.
+ *
+ * Such a stream cannot be walked, and the auth stream is never reshuffled once
+ * the monotonic rule is on, so run this before enabling enforcement on a fleet.
+ *
+ * `requireStrict` additionally rejects a tie, which is what the auth stream's
+ * monotonic rule requires and what the walk alone does not care about.
+ */
+declare function firstOutOfOrderPair(operations: Operation[], options?: {
+  requireStrict?: boolean;
+}): OutOfOrderPair | undefined;
+//#endregion
 //#region src/read-models/base-read-model.d.ts
 type BaseReadModelConfig = {
   readModelId: string;
@@ -5243,7 +5999,7 @@ declare class KyselyDocumentIndexer extends BaseReadModel implements IDocumentIn
  * serialized so the executor can return to dispatch without holding ordering
  * implicitly.
  */
-declare class ReadModelCoordinator implements IReadModelCoordinator {
+declare class ReadModelCoordinator implements ILiveReadModelCoordinator {
   private eventBus;
   readonly preReady: IReadModel[];
   readonly postReady: IReadModel[];
@@ -5262,6 +6018,7 @@ declare class ReadModelCoordinator implements IReadModelCoordinator {
    */
   drain(): Promise<void>;
   getChainDepth(): number;
+  addReadModel(readModel: IReadModel, stage: ReadModelRegistrationStage): void;
   private handleWriteReady;
   private emitEmptyReadReady;
   private runChain;
@@ -5275,8 +6032,31 @@ declare class ReadModelCoordinator implements IReadModelCoordinator {
 type Database$2 = Database$1 & DocumentViewDatabase;
 declare class KyselyDocumentView extends BaseReadModel implements IDocumentView {
   private operationStore;
+  /**
+   * Whether a single-document read serves a deleted document's state as of the
+   * deletion rather than hiding it. Only meaningful with `documentDecisions`,
+   * which is what makes deletion positional. Listings omit it either way.
+   */
+  private readonly servesDeletionBoundary;
   private _db;
-  constructor(db: Kysely<Database$2>, operationStore: IOperationStore, operationIndex: IOperationIndex, writeCache: IWriteCache, consistencyTracker: IConsistencyTracker);
+  constructor(db: Kysely<Database$2>, operationStore: IOperationStore, operationIndex: IOperationIndex, writeCache: IWriteCache, consistencyTracker: IConsistencyTracker,
+  /**
+   * Whether a single-document read serves a deleted document's state as of the
+   * deletion rather than hiding it. Only meaningful with `documentDecisions`,
+   * which is what makes deletion positional. Listings omit it either way.
+   */
+
+  servesDeletionBoundary: boolean);
+  /**
+   * Indexes committed operations into DocumentSnapshot rows. CREATE_DOCUMENT
+   * only seeds header/document/auth. UPGRADE_DOCUMENT reindexes every scope
+   * present in resultingState when the operation vouches for them — a seed
+   * carrying initialState or a migration stamped with the __migrated marker
+   * — since the upgrade reducer may have reshaped any of them; upgrades
+   * without either fall back to header/document/auth, because their sibling
+   * echoes may be stale. All other action types index only header and their
+   * own scope.
+   */
   protected commitOperations(items: OperationWithContext$1[]): Promise<void>;
   exists(documentIds: string[], consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<boolean[]>;
   get<TDocument extends PHDocument>(documentId: string, view?: ViewFilter$1, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<TDocument>;
@@ -5408,6 +6188,8 @@ declare class GqlRequestChannel implements IChannel {
   private isPushing;
   private pendingDrain;
   private receivingPages;
+  /** Cleared for good the first time the remote rejects {@link DECISION_FIELDS}. */
+  private peerServesDecisionFields;
   private isRecovering;
   private connectionState;
   /** Latest unrecoverable error was an auth rejection; cleared on connect. */
@@ -5454,6 +6236,18 @@ declare class GqlRequestChannel implements IChannel {
    * Queries the remote GraphQL endpoint for sync envelopes.
    */
   private pollSyncEnvelopes;
+  /**
+   * True when the remote rejected the query for naming a field it does not
+   * have. Selecting an unknown field fails validation for the whole query, so
+   * an unhandled one takes the channel's polling down until the process
+   * restarts rather than degrading.
+   */
+  private rejectsDecisionFields;
+  /**
+   * The poll query. `withDecisionFields` selects the two fields added with the
+   * auth projection; a remote on the previous schema is polled without them.
+   */
+  private pollQuery;
   /**
    * Registers or updates this channel on the remote server via GraphQL mutation.
    * Returns the remote's ack ordinal so the client can trim its outbox.
@@ -5616,6 +6410,18 @@ declare function batchOperationsByDocument(operations: OperationWithContext$1[])
  * jobId; all other jobIds are remapped so external dependencies still resolve.
  */
 declare function consolidateSyncOperations(syncOps: SyncOperation[]): SyncOperation[];
+/**
+ * Classifies a failure by error name rather than `instanceof`, because a failure
+ * that crossed the pooled-worker boundary arrives as plain data.
+ */
+declare function classifyJobFailure(errorName: string): SyncOperationErrorType;
+/** The explicit type when something else carried it, else derived by name. */
+declare function syncOperationErrorType(error: ChannelError | undefined): SyncOperationErrorType;
+/**
+ * A held auth operation must not quarantine: reconciling the two policies needs
+ * the traffic a quarantine would stop.
+ */
+declare function quarantinesDocument(errorType: SyncOperationErrorType): boolean;
 //#endregion
 //#region src/admin/types.d.ts
 type KeyframeValidationIssue = {
@@ -5631,11 +6437,20 @@ type SnapshotValidationIssue = {
   snapshotHash: string;
   replayedHash: string;
 };
+/** Effective operations whose stored order contradicts their timestamps. */
+type StreamOrderIssue = {
+  scope: string;
+  branch: string;
+  previous: Operation;
+  current: Operation;
+  kind: OutOfOrderPair["kind"];
+};
 type ValidationResult = {
   documentId: string;
   isConsistent: boolean;
   keyframeIssues: KeyframeValidationIssue[];
   snapshotIssues: SnapshotValidationIssue[];
+  streamOrderIssues: StreamOrderIssue[];
 };
 type RebuildResult = {
   documentId: string;
@@ -5659,6 +6474,7 @@ declare class DocumentIntegrityService implements IDocumentIntegrityService {
   validateDocument(documentId: string, branch?: string, signal?: AbortSignal): Promise<ValidationResult>;
   rebuildKeyframes(documentId: string, branch?: string, signal?: AbortSignal): Promise<RebuildResult>;
   rebuildSnapshots(documentId: string, branch?: string, signal?: AbortSignal): Promise<RebuildResult>;
+  private findStreamOrderIssues;
   private discoverScopes;
 }
 //#endregion
@@ -5707,5 +6523,5 @@ declare class ProcessorManager extends BaseReadModel implements IProcessorManage
   private deleteProcessorCursors;
 }
 //#endregion
-export { type AbortMessage, type AtomicTxn, type AttachmentHash, type AttachmentRef, BaseReadModel, type BatchExecutionRequest, type BatchExecutionResult, type BatchLoadRequest, type BatchLoadResult, type BuiltInReadModelKind, type CachedSnapshot, type ChannelConfig, ChannelError, ChannelErrorSource, type ChannelHealth, type ChannelMeta, ChannelScheme, type ConnectionState, type ConnectionStateChangeCallback, type ConnectionStateChangedEvent, type ConnectionStateSnapshot, type ConsistencyCoordinate, type ConsistencyKey, type ConsistencyToken, ConsistencyTracker, DEFAULT_DRIVE_CONTAINER_TYPES, DRIVE_AUTH_ERROR_MESSAGES, type Database, type DbConfig, type DeadLetterAddedEvent, DefaultSubscriptionErrorHandler, type DocumentChangeEvent, DocumentChangeType, type DocumentGraphEdge, type DocumentIndexerDatabase, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, type DocumentModelSource, type DocumentModelSpec, type DocumentRelationship, type DocumentRevisions, type DocumentStreamKey, type DocumentViewDatabase, DriveClient, DriveCollectionId, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, type ExecuteMessage, type ExecutionJobPlan, type ExecutorStartedEvent, type ExecutorStoppedEvent, type FactorySpec, type FileModelSource, type GqlChannelConfig, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, type HeartbeatMessage, type IChannel, type IChannelFactory, type IConsistencyTracker, type IDocumentGraph, type IDocumentIndexer, type IDocumentIntegrityService, type IDocumentModelLoader, type IDocumentModelRegistry, type IDocumentModelResolver, type IDocumentView, type IDriveClient, type IEventBus, type IJobAwaiter, type IJobExecutor, type IJobExecutorManager, type IJobTracker, type IKeyframeStore, type IMailbox, type IOperationIndex, type IOperationStore, type IPollTimer, type IProcessor, type IProcessorHostModule, type IProcessorManager, type IProjectionTransport, type IQueue, type IReactor, type IReactorClient, type IReactorSubscriptionManager, type IReadModel, type IReadModelCoordinator, type IRelationalDb, type ISubscriptionErrorHandler, type ISyncCursorStorage, type ISyncManager, type ISyncRemoteStorage, type ISyncStatusTracker, type IWriteCache, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, type InProcessReactorClientModule, type InProcessReactorModule, type InProcessSyncModule, type InitMessage, type InsertableDocumentSnapshot, IntervalPollTimer, InvalidModuleError, type Job, type JobAvailableEvent, JobAwaiter, type JobCompletedEvent, type JobExecutorConfig, JobExecutorEventTypes, type JobExecutorFactory, type JobFailedEvent, type JobInfo, type JobPendingEvent, type JobReadReadyEvent, type JobResult, type JobRunningEvent, type JobStartedEvent, JobStatus, type JobWriteReadyEvent, type JobWriteReadyPayload, type JwtHandler, type KeyframeSnapshot, type KeyframeValidationIssue, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, type LoadJobPlan, type LoadModelMessage, type LogMessage, Mailbox, type MetricsMessage, type ModelLoadFailedMessage, type ModelLoadedEvent, type ModelLoadedMessage, type ModelManifestEntry, ModuleNotFoundError, type ModuleRef, NullDocumentModelResolver, type OperationBatch, type OperationContext, type OperationFilter, type OperationIndexEntry, type OperationTable, type OperationWithContext, OptimisticLockError, type PackageModelSource, type PagedResults, type PagingOptions, type ParentMessage, type ParsedDriveUrl, type ParsedPaging, PollBehavior, PollingChannelError, type PoolInstrumentation, type PoolStats, type ProcessorApp, type ProcessorFactory, type ProcessorFactoryBuilder, type ProcessorFilter, ProcessorManager, type ProcessorRecord, type ProcessorStatus, type ProjectionShardBuilderConfig, type ProjectionShardManagerConfig, type ProjectionWorkerFactory, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, type ReactorClientModule, ReactorEventTypes, type ReactorFeatures, type JobFailedEvent$1 as ReactorJobFailedEvent, type ReactorModule, ReactorSubscriptionManager, type ReadModelBatchCompletedEvent, ReadModelCoordinator, type ReadModelFactory, type ReadModelFactoryDeps, type ReadModelIndexedEvent, type ReadModelIndexingStage, type ReadModelStage, type ReadyMessage, type RebuildResult, RelationalDbProcessor, RelationshipChangeType, type Remote, type RemoteCursor, type RemoteFilter, type RemoteMeta, type RemoteOptions, type RemoteRecord, type RemoteStatus, type ResultMessage, RevisionMismatchError, type SanitizedArg, type SearchFilter, type ShutdownMessage, type ShutdownStatus, type SignatureVerificationHandler, type SignatureVerifierSpec, type SignerConfig, SimpleJobExecutorManager, type SnapshotValidationIssue, type Database$1 as StorageDatabase, type SubscriptionErrorContext, SyncBuilder, type SyncEnvelope, type SyncEnvelopeType, SyncEventTypes, type SyncFailedEvent, type SyncModule, SyncOperation, SyncOperationAggregateError, type SyncOperationErrorType, SyncOperationStatus, type SyncPendingEvent, SyncStatus, type SyncStatusChangeCallback, SyncStatusTracker, type SyncSucceededEvent, type TrackedProcessor, type Unsubscribe, type ValidationResult, type ViewFilter, type ErrorInfo as WorkerErrorInfo, type WorkerMessage, type WorkerPoolConfig, type WorkerPoolOptions, type WriteCacheConfig, addRelationshipAction, batchOperationsByDocument, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createMutableShutdownStatus, createRelationalDb, deleteDocumentAction, documentActions, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, getMigrationStatus, instrumentPgPool, isDriveAuthError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, removeRelationshipAction, runMigrations, sanitizeArg, trimMailboxFromAckOrdinal, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
+export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, type AbortMessage, type AdmissionDecision, type AppendCondition, AppendConditionFailedError, type AppendConditionStream, type AtomicTxn, type AttachmentHash, type AttachmentRef, type AuthDecisionModel, BareReadGate, BaseReadModel, type BatchExecutionRequest, type BatchExecutionResult, type BatchLoadRequest, type BatchLoadResult, type BuiltDecisionModel, type BuiltInReadModelKind, type CachedSnapshot, type ChannelConfig, ChannelError, ChannelErrorSource, type ChannelHealth, type ChannelMeta, ChannelScheme, type ConnectionState, type ConnectionStateChangeCallback, type ConnectionStateChangedEvent, type ConnectionStateSnapshot, type ConsistencyCoordinate, type ConsistencyKey, type ConsistencyToken, ConsistencyTracker, DEFAULT_DRIVE_CONTAINER_TYPES, DRIVE_AUTH_ERROR_MESSAGES, type Database, type DbConfig, type DeadLetterAddedEvent, type DecisionContext, type DecisionModel, type DecisionTarget, DefaultSubscriptionErrorHandler, type DocumentChangeEvent, DocumentChangeType, type DocumentDecisionModel, type DocumentGraphEdge, type DocumentIndexerDatabase, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, type DocumentModelSource, type DocumentModelSpec, type DocumentRelationship, type DocumentRevisions, type DocumentStreamKey, type DocumentViewDatabase, DriveClient, DriveCollectionId, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, type Evaluation, EventBus, EventBusAggregateError, type ExecuteMessage, type ExecutionJobPlan, type ExecutorStartedEvent, type ExecutorStoppedEvent, type FactorySpec, type FileModelSource, type GqlChannelConfig, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, type HeartbeatMessage, type IChannel, type IChannelFactory, type IConsistencyTracker, type IDocumentGraph, type IDocumentIndexer, type IDocumentIntegrityService, type IDocumentModelLoader, type IDocumentModelRegistry, type IDocumentModelResolver, type IDocumentView, type IDriveClient, type IEventBus, type IJobAwaiter, type IJobExecutor, type IJobExecutorManager, type IJobTracker, type IKeyframeStore, type ILiveReadModelCoordinator, type IMailbox, type IOperationIndex, type IOperationStore, type IPollTimer, type IProcessor, type IProcessorHostModule, type IProcessorManager, type IProjectionTransport, type IQueue, type IReactor, type IReactorClient, type IReactorSubscriptionManager, type IReadGate, type IReadModel, type IReadModelCoordinator, type IRelationalDb, type IStreamStateReader, type ISubscriptionErrorHandler, type ISyncCursorStorage, type ISyncManager, type ISyncRemoteStorage, type ISyncStatusTracker, type IWriteCache, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, type InProcessReactorClientModule, type InProcessReactorModule, type InProcessSyncModule, type InitMessage, type InsertableDocumentSnapshot, IntervalPollTimer, InvalidModuleError, type Job, type JobAvailableEvent, JobAwaiter, type JobCompletedEvent, type JobExecutorConfig, JobExecutorEventTypes, type JobExecutorFactory, type JobFailedEvent, type JobInfo, type JobPendingEvent, type JobReadReadyEvent, type JobResult, type JobRunningEvent, type JobStartedEvent, JobStatus, type JobWriteReadyEvent, type JobWriteReadyPayload, type JwtHandler, type KeyframeSnapshot, type KeyframeValidationIssue, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, type LoadJobPlan, type LoadModelMessage, type LogMessage, Mailbox, type MetricsMessage, type ModelLoadFailedMessage, type ModelLoadedEvent, type ModelLoadedMessage, type ModelManifestEntry, ModelReadGate, ModuleNotFoundError, type ModuleRef, NullDocumentModelResolver, type OperationBatch, type OperationContext, type OperationFilter, type OperationIndexEntry, type OperationTable, type OperationWithContext, OptimisticLockError, type OutOfOrderPair, type PackageModelSource, type PagedResults, type PagingOptions, type ParentMessage, type ParsedDriveUrl, type ParsedPaging, PollBehavior, PollingChannelError, type PoolInstrumentation, type PoolStats, type ProcessorApp, type ProcessorFactory, type ProcessorFactoryBuilder, type ProcessorFilter, ProcessorManager, type ProcessorRecord, type ProcessorStatus, type Projection, type ProjectionShardBuilderConfig, type ProjectionShardManagerConfig, type ProjectionWorkerFactory, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, type ReactorClientModule, ReactorEventTypes, type ReactorFeatureFlags, type ReactorFeatures, type JobFailedEvent$1 as ReactorJobFailedEvent, type ReactorModule, ReactorSubscriptionManager, type ReadModelBatchCompletedEvent, ReadModelCoordinator, type ReadModelFactory, type ReadModelFactoryDeps, type ReadModelIndexedEvent, type ReadModelIndexingStage, type ReadModelRegistrationStage, type ReadModelStage, type ReadyMessage, type RebuildResult, type RegisteredDecisionModel, RelationalDbProcessor, RelationshipChangeType, type Remote, type RemoteCursor, type RemoteFilter, type RemoteMeta, type RemoteOptions, type RemoteRecord, type RemoteStatus, type ResultMessage, RetryAccounting, RevisionMismatchError, type SanitizedArg, type SearchFilter, type ShutdownMessage, type ShutdownStatus, type SignatureVerificationHandler, type SignatureVerifierSpec, type SignerConfig, SimpleJobExecutorManager, type SnapshotValidationIssue, type Database$1 as StorageDatabase, type StreamOrderIssue, type StreamQuery, type SubscriptionErrorContext, SyncBuilder, type SyncEnvelope, type SyncEnvelopeType, SyncEventTypes, type SyncFailedEvent, type SyncModule, SyncOperation, SyncOperationAggregateError, type SyncOperationErrorType, SyncOperationStatus, type SyncPendingEvent, SyncStatus, type SyncStatusChangeCallback, SyncStatusTracker, type SyncSucceededEvent, type TrackedProcessor, type Unsubscribe, type ValidationResult, type ViewFilter, type ErrorInfo as WorkerErrorInfo, type WorkerMessage, type WorkerPoolConfig, type WorkerPoolOptions, type WriteCacheConfig, addRelationshipAction, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createMutableShutdownStatus, createRelationalDb, decideAtHead, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isDriveAuthError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, quarantinesDocument, readDecisionModel, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, supportsLiveReadModelRegistration, syncOperationErrorType, trimMailboxFromAckOrdinal, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
 //# sourceMappingURL=index.d.ts.map