@powerhousedao/reactor 6.2.2-dev.6 → 6.2.2-dev.60

package/dist/{drive-container-types-DpJp2AmE.js → drive-container-types-bVQ_8YwX.js}

@@ -1,5 +1,5 @@
 import { n as ReactorEventTypes, t as EventBusAggregateError } from "./types-DMKLa0Ok.js";
-import { DowngradeNotSupportedError, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, createPresignedHeader, defaultBaseState, deriveOperationId, isUndoRedo } from "@powerhousedao/shared/document-model";
+import { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, DOCUMENT_DELETED_REASON, DowngradeNotSupportedError as DowngradeNotSupportedError$1, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, baseReducerVersion, createPresignedHeader, decide, defaultBaseState, deriveOperationId, evaluate, garbageCollect, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, isDenied, isUndoRedo, mentionedGroupIds, normalizeDocumentModelVersion, referencedGroupIds, sortOperations } from "@powerhousedao/shared/document-model";
 import { v4 } from "uuid";
 import { Migrator, sql } from "kysely";
 //#region \0rolldown/runtime.js
@@ -72,6 +72,102 @@ var DocumentDeletedError = class DocumentDeletedError extends Error {
 	}
 };
 /**
+* Error thrown when the auth policy denies an action at the executor gate.
+*/
+var AuthorizationDeniedError = class AuthorizationDeniedError extends Error {
+	documentId;
+	scope;
+	operation;
+	subject;
+	constructor(documentId, scope, operation, subject) {
+		super(`Authorization denied: ${subject ?? "anonymous"} may not execute ${operation} in scope "${scope}" of document ${documentId}`);
+		this.name = "AuthorizationDeniedError";
+		this.documentId = documentId;
+		this.scope = scope;
+		this.operation = operation;
+		this.subject = subject;
+		Error.captureStackTrace(this, AuthorizationDeniedError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "AuthorizationDeniedError";
+	}
+};
+/**
+* An auth operation did not strictly exceed the newest timestamp in its stream.
+*
+* Terminal and asymmetric by design: no ordering rule can reconcile two replicas
+* that each accepted an auth operation offline, because either order hands one
+* authority the other never granted, so the replica ahead holds the arrival.
+*/
+var AuthTimestampNotMonotonicError = class AuthTimestampNotMonotonicError extends Error {
+	documentId;
+	branch;
+	timestampUtcMs;
+	newestTimestampUtcMs;
+	constructor(documentId, branch, timestampUtcMs, newestTimestampUtcMs) {
+		super(`Auth timestamp not monotonic: ${timestampUtcMs} does not exceed ${newestTimestampUtcMs} in the auth stream of document ${documentId} on branch ${branch}`);
+		this.name = "AuthTimestampNotMonotonicError";
+		this.documentId = documentId;
+		this.branch = branch;
+		this.timestampUtcMs = timestampUtcMs;
+		this.newestTimestampUtcMs = newestTimestampUtcMs;
+		Error.captureStackTrace(this, AuthTimestampNotMonotonicError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "AuthTimestampNotMonotonicError";
+	}
+};
+/**
+* An operation or action carried a timestamp that is not an ISO-8601 UTC
+* instant.
+*
+* Terminal rather than retryable: the value does not change between attempts,
+* so a retry re-runs the whole job to fail identically. Quarantining, unlike a
+* held auth operation — this is malformed data rather than two replicas
+* disagreeing, and nothing further from that source should be trusted until it
+* is looked at.
+*/
+var InvalidOperationTimestampError = class InvalidOperationTimestampError extends Error {
+	documentId;
+	scope;
+	timestampUtcMs;
+	constructor(documentId, scope, timestampUtcMs, context) {
+		super(`Invalid timestamp "${timestampUtcMs}" on ${context} in scope "${scope}" of document ${documentId}`);
+		this.name = "InvalidOperationTimestampError";
+		this.documentId = documentId;
+		this.scope = scope;
+		this.timestampUtcMs = timestampUtcMs;
+		Error.captureStackTrace(this, InvalidOperationTimestampError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "InvalidOperationTimestampError";
+	}
+};
+/**
+* A load would move more operations than the bound allows, indicating a real
+* divergence between local and incoming history. Counts only first-time moves,
+* so a re-evaluation pass's re-appends do not make busy documents
+* revocation-proof. Terminal: the condition is deterministic.
+*/
+var ExcessiveReshuffleError = class ExcessiveReshuffleError extends Error {
+	documentId;
+	scope;
+	count;
+	threshold;
+	constructor(documentId, scope, count, threshold) {
+		super(`Excessive reshuffle detected: ${count} operations in scope "${scope}" of document ${documentId} exceeds the threshold of ${threshold}. This indicates a significant divergence between local and incoming operations.`);
+		this.name = "ExcessiveReshuffleError";
+		this.documentId = documentId;
+		this.scope = scope;
+		this.count = count;
+		this.threshold = threshold;
+		Error.captureStackTrace(this, ExcessiveReshuffleError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "ExcessiveReshuffleError";
+	}
+};
+/**
 * Error thrown when an operation has an invalid signature.
 */
 var InvalidSignatureError = class InvalidSignatureError extends Error {
@@ -86,12 +182,40 @@ var InvalidSignatureError = class InvalidSignatureError extends Error {
 	}
 };
 /**
+* An UPGRADE_DOCUMENT action's preconditions (fromVersion and the per-scope
+* revision snapshot) did not match the document state the executor loaded.
+*
+* Terminal rather than retryable: the action carries the client's snapshot,
+* which stays stale no matter how often the job re-runs. The client is
+* expected to re-read the document and submit a fresh action instead.
+*/
+var UpgradePreconditionFailedError = class UpgradePreconditionFailedError extends Error {
+	documentId;
+	detail;
+	constructor(documentId, detail) {
+		super(`Upgrade precondition failed for document ${documentId}: ${detail}`);
+		this.name = "UpgradePreconditionFailedError";
+		this.documentId = documentId;
+		this.detail = detail;
+		Error.captureStackTrace(this, UpgradePreconditionFailedError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "UpgradePreconditionFailedError";
+	}
+};
+/**
 * Error thrown when a document is not found (no operations exist for the document ID).
 */
 var DocumentNotFoundError = class DocumentNotFoundError extends Error {
 	documentId;
-	constructor(documentId) {
-		super(`Document ${documentId} not found`);
+	/**
+	* @param message Overrides the default text. A handler that knows which of
+	* several documents an action reads - a relationship's source, say - says so
+	* here rather than rewrapping in a bare Error, which would strip the name the
+	* executor classifies by.
+	*/
+	constructor(documentId, message) {
+		super(message ?? `Document ${documentId} not found`);
 		this.name = "DocumentNotFoundError";
 		this.documentId = documentId;
 		Error.captureStackTrace(this, DocumentNotFoundError);
@@ -100,122 +224,413 @@ var DocumentNotFoundError = class DocumentNotFoundError extends Error {
 		return Error.isError(error) && error.name === "DocumentNotFoundError";
 	}
 };
-//#endregion
-//#region src/registry/errors.ts
 /**
-* Error thrown when a document model module is not found in the registry.
+* An authorization preflight was asked for while the reactor's decision model
+* is off, so there is no model to answer from.
+*
+* Thrown rather than answered from the legacy host-side permission tables. The
+* two systems do not compose: the tables record which addresses a host lets
+* near a drive, the policy records what a document's own grants permit, and an
+* answer stitched from both would report an admission verdict neither system
+* would reach. A caller that cannot get a prediction disables nothing, which
+* leaves the submit path -- and its real gate -- as the only authority.
+*
+* Detection is by `name`, not `instanceof`: the SharedWorker RPC boundary
+* rebuilds a thrown error from `{ name, message, stack, cause }` alone
+* (`reactor-browser/src/rpc/error-info.ts`), so the class identity and any
+* custom field are lost in transit. This error therefore carries no fields.
 */
-var ModuleNotFoundError = class extends Error {
-	documentType;
-	requestedVersion;
-	constructor(documentType, version) {
-		const versionSuffix = version !== void 0 ? ` version ${version}` : "";
-		super(`Document model module not found for type: ${documentType}${versionSuffix}`);
-		this.name = "ModuleNotFoundError";
-		this.documentType = documentType;
-		this.requestedVersion = version;
+var AuthEnforcementDisabledError = class AuthEnforcementDisabledError extends Error {
+	constructor() {
+		super("Authorization evaluation requires the authEnforcement feature flag; this reactor holds no decision model, and the legacy host-table permission system cannot answer for one");
+		this.name = "AuthEnforcementDisabledError";
+		Error.captureStackTrace(this, AuthEnforcementDisabledError);
 	}
 	static isError(error) {
-		return Error.isError(error) && error.name === "ModuleNotFoundError";
+		return Error.isError(error) && error.name === "AuthEnforcementDisabledError";
 	}
 };
+//#endregion
+//#region src/decision/build-decision-model.ts
 /**
-* Error thrown when attempting to register a module that already exists.
+* Reads each projection's stream through the supplied reader, recording the
+* revision observed. Static projections resolve first; derived projections
+* see only those and contribute a map from document id to state. Each
+* distinct stream is read once and yields one append condition entry.
 */
-var DuplicateModuleError = class extends Error {
-	constructor(documentType, version) {
-		const versionSuffix = version !== void 0 ? ` (version ${version})` : "";
-		super(`Document model module already registered for type: ${documentType}${versionSuffix}`);
-		this.name = "DuplicateModuleError";
-	}
-	static isError(error) {
-		return Error.isError(error) && error.name === "DuplicateModuleError";
+async function buildDecisionModel(reader, definition, target, signal) {
+	const decisionModel = definition(target);
+	const projections = Object.entries(decisionModel.projections);
+	const reads = /* @__PURE__ */ new Map();
+	const model = {};
+	for (const [key, projection] of projections) {
+		if (typeof projection.query === "function") continue;
+		model[key] = (await readStream(reader, projection.query, reads, signal)).state;
+	}
+	const staticModel = { ...model };
+	for (const [key, projection] of projections) {
+		if (typeof projection.query !== "function") continue;
+		const queries = projection.query(staticModel);
+		const value = {};
+		for (const query of queries) {
+			let read;
+			try {
+				read = await readStream(reader, query, reads, signal);
+			} catch (error) {
+				if (error instanceof DocumentNotFoundError) {
+					recordEmptyStream(query, reads);
+					continue;
+				}
+				throw error;
+			}
+			value[query.documentId] = read.state;
+		}
+		model[key] = value;
 	}
-};
+	return {
+		model,
+		appendCondition: { streams: [...reads.values()].map((read) => read.stream) }
+	};
+}
+/** Guards a stream that holds nothing yet: any operation appearing is growth. */
+function recordEmptyStream(query, reads) {
+	const key = `${query.documentId}:${query.scope}:${query.branch}`;
+	if (reads.has(key)) return;
+	reads.set(key, {
+		state: void 0,
+		stream: {
+			documentId: query.documentId,
+			scope: query.scope,
+			branch: query.branch,
+			revision: -1
+		}
+	});
+}
+async function readStream(reader, query, reads, signal) {
+	const key = `${query.documentId}:${query.scope}:${query.branch}`;
+	const existing = reads.get(key);
+	if (existing) return existing;
+	const document = await reader.getState(query.documentId, query.scope, query.branch, void 0, signal);
+	const read = {
+		state: document.state[query.scope],
+		stream: {
+			documentId: query.documentId,
+			scope: query.scope,
+			branch: query.branch,
+			revision: observedRevision(document, query.scope)
+		}
+	};
+	reads.set(key, read);
+	return read;
+}
 /**
-* Error thrown when a module is invalid or malformed.
+* The highest operation index the document reflects for the scope, or -1 if
+* empty. `header.revision` is authoritative, not the rebuilt operation list.
 */
-var InvalidModuleError = class extends Error {
-	constructor(message) {
-		super(`Invalid document model module: ${message}`);
-		this.name = "InvalidModuleError";
+function observedRevision(document, scope) {
+	if (scope in document.header.revision) return document.header.revision[scope] - 1;
+	if (scope in document.operations) {
+		const operations = document.operations[scope];
+		if (operations.length > 0) return operations[operations.length - 1].index;
+	}
+	if (!(scope in document.header.revision)) return -1;
+	return document.header.revision[scope] - 1;
+}
+/**
+* The projections whose queries depend on folded state. A positional walk
+* resolves their streams through `queryOverHistory`; a projection without one
+* contributes no streams to a walk.
+*/
+function derivedReadSet(definition) {
+	const projections = [];
+	for (const [name, projection] of Object.entries(definition.projections)) {
+		if (typeof projection.query !== "function") continue;
+		projections.push({
+			name,
+			decidingActions: projection.decidingActions,
+			apply: projection.apply,
+			queryOverHistory: projection.queryOverHistory
+		});
 	}
-};
+	return projections;
+}
 /**
-* Error thrown when attempting to register an upgrade manifest that already exists.
+* The streams a model reads whose queries are known before it is built. A
+* derived query needs the statically-queried projections first, so it is not
+* included here.
 */
-var DuplicateManifestError = class extends Error {
-	constructor(documentType) {
-		super(`Upgrade manifest already registered for type: ${documentType}`);
-		this.name = "DuplicateManifestError";
+function staticReadSet(definition) {
+	const streams = [];
+	for (const [name, projection] of Object.entries(definition.projections)) {
+		if (typeof projection.query === "function") continue;
+		streams.push({
+			name,
+			query: projection.query,
+			decidingActions: projection.decidingActions,
+			apply: projection.apply
+		});
 	}
-	static isError(error) {
-		return Error.isError(error) && error.name === "DuplicateManifestError";
+	return streams;
+}
+//#endregion
+//#region src/decision/auth-decision-model.ts
+function refusalReason(refusal) {
+	switch (refusal) {
+		case "version-unsupported": return AUTH_VERSION_UNSUPPORTED_REASON;
+		case "denied-by-grant": return AUTH_DENIED_BY_GRANT_REASON;
+		case "no-applicable-grant": return AUTH_NO_GRANT_REASON;
 	}
-};
+}
+function decideAuthModel(model, subject, request, groups, conditions) {
+	if (request.verb === "execute" && model.document.isDeleted) return {
+		decision: "deny",
+		reason: DOCUMENT_DELETED_REASON
+	};
+	const evaluation = evaluate(model.auth, subject, request, groups, conditions);
+	if (evaluation.decision === "allow") return { decision: "allow" };
+	return {
+		decision: "deny",
+		reason: refusalReason(evaluation.refusal)
+	};
+}
+function documentProjection(target) {
+	return {
+		decidingActions: ["DELETE_DOCUMENT"],
+		apply: (document, operation) => operation.action.type === "DELETE_DOCUMENT" ? applyDeleteDocumentAction({
+			...document,
+			state: { ...document.state }
+		}, operation.action) : document,
+		query: {
+			documentId: target.documentId,
+			branch: target.branch,
+			scope: "document"
+		}
+	};
+}
+function authProjection(target) {
+	return {
+		decidingActions: [...AUTH_ACTION_TYPES],
+		apply: (document, operation) => applyAuthAction(document, operation.action),
+		query: {
+			documentId: target.documentId,
+			branch: target.branch,
+			scope: "auth"
+		}
+	};
+}
+/** This decision model uses both the document and the auth streams. */
+function authDecisionModel(target) {
+	return {
+		projections: {
+			document: documentProjection(target),
+			auth: authProjection(target)
+		},
+		evaluatesScope() {
+			return true;
+		},
+		decide(model, subject, request) {
+			return decideAuthModel(model, subject, request);
+		}
+	};
+}
 /**
-* Error thrown when an upgrade manifest is not found.
+* Folds one group-stream operation with the registered group model's reducer.
+* A reactor without the module registered folds nothing, so the member list
+* stays as read and a missing reducer never widens access.
 */
-var ManifestNotFoundError = class extends Error {
-	constructor(documentType) {
-		super(`Upgrade manifest not found for type: ${documentType}`);
-		this.name = "ManifestNotFoundError";
+function applyGroupOperation(registry, document, operation) {
+	let reducer;
+	try {
+		reducer = registry.getModule(groupDocumentType).reducer;
+	} catch {
+		return document;
 	}
-};
+	return reducer(document, operation.action);
+}
 /**
-* Error thrown when a required upgrade transition is missing from the manifest.
+* Folds one evaluated-scope operation with the reducer registered for the
+* document's own type, at the document's stamped version. A reactor without
+* that module folds nothing, so conditions read the base state and an
+* unresolvable reducer never widens access.
 */
-var MissingUpgradeTransitionError = class extends Error {
-	constructor(documentType, fromVersion, toVersion) {
-		super(`Missing upgrade transition for ${documentType}: v${fromVersion} to v${toVersion}`);
-		this.name = "MissingUpgradeTransitionError";
+function applyModelOperation(registry, document, operation) {
+	let reducer;
+	try {
+		const version = normalizeDocumentModelVersion(document.state.document?.version);
+		reducer = registry.getModule(document.header.documentType, version).reducer;
+	} catch {
+		return document;
 	}
-};
+	return reducer(document, operation.action);
+}
 /**
-* Error thrown when getUpgradeReducer is called with a non-single-step version increment.
+* The auth model extended with a derived groups projection: the streams it
+* reads are the group documents the folded grant list names, so adding a
+* grant that names a new group pulls that group's stream into the read-set.
+* Group queries pin the main branch, because a group's member list lives on
+* its main branch no matter which branch the referencing document is on.
 */
-var InvalidUpgradeStepError = class extends Error {
-	constructor(documentType, fromVersion, toVersion) {
-		super(`Invalid upgrade step for ${documentType}: must be single version increment, got v${fromVersion} to v${toVersion}`);
-		this.name = "InvalidUpgradeStepError";
-	}
-};
-//#endregion
-//#region src/cache/collection-membership-cache.ts
-var CollectionMembershipCache = class CollectionMembershipCache {
-	cache = /* @__PURE__ */ new Map();
-	constructor(operationIndex) {
-		this.operationIndex = operationIndex;
-	}
-	withScopedIndex(operationIndex) {
-		const scoped = new CollectionMembershipCache(operationIndex);
-		scoped.cache = this.cache;
-		return scoped;
-	}
-	async getCollectionsForDocuments(documentIds) {
-		const result = {};
-		const missing = [];
-		for (const docId of documentIds) {
-			const cached = this.cache.get(docId);
-			if (cached !== void 0) result[docId] = cached;
-			else missing.push(docId);
+function groupsProjection(registry) {
+	return {
+		decidingActions: [...groupMembershipActionTypes],
+		apply: (document, operation) => applyGroupOperation(registry, document, operation),
+		query: (model) => referencedGroupIds(model.auth?.grants ?? []).map((id) => ({
+			documentId: id,
+			branch: "main",
+			scope: "global"
+		})),
+		queryOverHistory: (reads) => {
+			const ids = [];
+			for (const read of reads) {
+				if (read.name !== "auth") continue;
+				for (const operation of read.operations) for (const id of mentionedGroupIds(operation.action)) if (!ids.includes(id)) ids.push(id);
+			}
+			return ids.map((id) => ({
+				documentId: id,
+				branch: "main",
+				scope: "global"
+			}));
 		}
-		if (missing.length > 0) {
-			const fromDb = await this.operationIndex.getCollectionsForDocuments(missing);
-			for (const docId of missing) {
-				const collections = fromDb[docId] ?? [];
-				result[docId] = collections;
-				this.cache.set(docId, collections);
+	};
+}
+function authGroupsDecisionModel(registry) {
+	return (target) => ({
+		projections: {
+			document: documentProjection(target),
+			auth: authProjection(target),
+			groups: groupsProjection(registry)
+		},
+		evaluatesScope() {
+			return true;
+		},
+		decide(model, subject, request) {
+			return decideAuthModel(model, subject, request, model.groups);
+		}
+	});
+}
+/**
+* The groups model with conditions live: decide hands the executing scope's
+* state and the action input through to the evaluator, so `where` clauses
+* and { match } principals apply. The model folds the evaluated scope during
+* a positional walk, so a condition reads the state as it stood at each
+* operation's position.
+*/
+function authConditionsDecisionModel(registry) {
+	return (target) => ({
+		projections: {
+			document: documentProjection(target),
+			auth: authProjection(target),
+			groups: groupsProjection(registry)
+		},
+		foldEvaluatedScope: (document, operation) => applyModelOperation(registry, document, operation),
+		evaluatesScope() {
+			return true;
+		},
+		decide(model, subject, request, ctx) {
+			return decideAuthModel(model, subject, request, model.groups, {
+				scopeState: ctx.scopeState,
+				actionInput: ctx.actionInput
+			});
+		}
+	});
+}
+//#endregion
+//#region src/decision/document-decision-model.ts
+/**
+* The simplest decision model: one projection over the document scope, which
+* rejects on a deleted document.
+*/
+function documentDecisionModel(target) {
+	return {
+		projections: { document: {
+			decidingActions: ["DELETE_DOCUMENT"],
+			apply: (document, operation) => operation.action.type === "DELETE_DOCUMENT" ? applyDeleteDocumentAction({
+				...document,
+				state: { ...document.state }
+			}, operation.action) : document,
+			query: {
+				documentId: target.documentId,
+				branch: target.branch,
+				scope: "document"
 			}
+		} },
+		evaluatesScope() {
+			return true;
+		},
+		decide(model, subject, request) {
+			return request.verb === "execute" && model.document.isDeleted ? {
+				decision: "deny",
+				reason: DOCUMENT_DELETED_REASON
+			} : { decision: "allow" };
 		}
-		return result;
-	}
-	invalidate(documentId) {
-		this.cache.delete(documentId);
-	}
-};
+	};
+}
+//#endregion
+//#region src/decision/registered-model.ts
+/**
+* Builds the model at the stream heads and decides one request against it. The
+* append condition it returns is the read-set the store enforces at write time.
+*
+* With `conditions` supplied, the executing scope's state is read at the head
+* for `doc.<scope>.*` paths. That read carries no append-condition entry of
+* its own: the written stream's expected-revision check already refuses a
+* write whose scope grew between the read and the append.
+*/
+async function decideAtHead(model, cache, target, subject, request, signal, conditions) {
+	const built = await buildDecisionModel(cache, model, target, signal);
+	let scopeState;
+	if (conditions !== void 0) scopeState = (await cache.getState(target.documentId, request.scope, target.branch, void 0, signal)).state[request.scope];
+	return {
+		evaluation: model(target).decide(built.model, subject, request, {
+			scopeState,
+			actionInput: conditions?.actionInput
+		}),
+		appendCondition: built.appendCondition,
+		documentVersion: built.model.document.version,
+		deletedAtUtcIso: built.model.document.deletedAtUtcIso ?? null
+	};
+}
+/**
+* The model this reactor enforces. With `authEnforcement` off the auth scope is
+* absent from every append condition and no load walks it; with `authGroups`
+* on, the group documents the grant list names join the read-set and the
+* registry supplies the reducer that folds them.
+*/
+function selectDecisionModel(flags, registry) {
+	if (flags.authConditions) return authConditionsDecisionModel(registry);
+	if (flags.authGroups) return authGroupsDecisionModel(registry);
+	return flags.authEnforcement ? authDecisionModel : documentDecisionModel;
+}
 //#endregion
 //#region src/executor/util.ts
+/** Actions the reactor reduces itself, onto the document scope. */
+const DOCUMENT_SCOPE_ACTIONS = new Set([
+	"CREATE_DOCUMENT",
+	"DELETE_DOCUMENT",
+	"UPGRADE_DOCUMENT",
+	"ADD_RELATIONSHIP",
+	"REMOVE_RELATIONSHIP",
+	"UPDATE_RELATIONSHIP"
+]);
+/**
+* `CREATE_DOCUMENT` is exempt by necessity: it runs before the document exists,
+* so building a decision model would throw and defer the job forever.
+*/
+const GATED_DOCUMENT_ACTIONS = new Set([...DOCUMENT_SCOPE_ACTIONS].filter((type) => type !== "CREATE_DOCUMENT"));
+/**
+* The document a document-scope action writes to, which is not always the job's
+* own document: delete and upgrade name it in `input.documentId`, and the
+* relationship actions in `input.sourceId`. `execute` only checks that a batch
+* shares one scope, so a caller can submit an action whose target is a document
+* other than the one the job is keyed by. The policy gate has to follow the
+* action rather than the job, or it decides against a policy the caller may
+* control instead of the one guarding the write.
+*/
+function targetDocumentId(action, fallback) {
+	const input = action.input;
+	if (action.type === "ADD_RELATIONSHIP" || action.type === "REMOVE_RELATIONSHIP" || action.type === "UPDATE_RELATIONSHIP") return typeof input?.sourceId === "string" && input.sourceId.length > 0 ? input.sourceId : fallback;
+	return typeof input?.documentId === "string" && input.documentId.length > 0 ? input.documentId : fallback;
+}
 /**
 * Creates a PHDocument from a CREATE_DOCUMENT action input.
 * Reconstructs the document header and initializes the base state.
@@ -353,6 +768,203 @@ function buildErrorResult(job, error, startTime) {
 		duration: Date.now() - startTime
 	};
 }
+/**
+* The error a refusal surfaces as. Both classes are already terminal in the job
+* result handler, so a refusal never burns a retry.
+*/
+function refusalError(reason, documentId, deletedAtUtcIso, action) {
+	if (reason === DOCUMENT_DELETED_REASON) return new DocumentDeletedError(documentId, deletedAtUtcIso);
+	return new AuthorizationDeniedError(documentId, action.scope, action.type, action.context?.signer?.user.address);
+}
+/**
+* Whether this operation is part of the document's creation. The create and the
+* upgrade from version zero hold the first two indexes for the life of the
+* document, so a reshuffle has to leave them where they are.
+*/
+function isGenesisOperation(operation) {
+	if (operation.action.type === "CREATE_DOCUMENT") return true;
+	if (operation.action.type !== "UPGRADE_DOCUMENT") return false;
+	return operation.action.input.fromVersion === 0;
+}
+//#endregion
+//#region src/registry/errors.ts
+/**
+* Error thrown when a document model module is not found in the registry.
+*/
+var ModuleNotFoundError = class extends Error {
+	documentType;
+	requestedVersion;
+	constructor(documentType, version) {
+		const versionSuffix = version !== void 0 ? ` version ${version}` : "";
+		super(`Document model module not found for type: ${documentType}${versionSuffix}`);
+		this.name = "ModuleNotFoundError";
+		this.documentType = documentType;
+		this.requestedVersion = version;
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "ModuleNotFoundError";
+	}
+};
+/**
+* Error thrown when attempting to register a module that already exists.
+*/
+var DuplicateModuleError = class extends Error {
+	constructor(documentType, version) {
+		const versionSuffix = version !== void 0 ? ` (version ${version})` : "";
+		super(`Document model module already registered for type: ${documentType}${versionSuffix}`);
+		this.name = "DuplicateModuleError";
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "DuplicateModuleError";
+	}
+};
+/**
+* Error thrown when a module is invalid or malformed.
+*/
+var InvalidModuleError = class extends Error {
+	constructor(message) {
+		super(`Invalid document model module: ${message}`);
+		this.name = "InvalidModuleError";
+	}
+};
+/**
+* Error thrown when attempting to register an upgrade manifest that already exists.
+*/
+var DuplicateManifestError = class extends Error {
+	constructor(documentType) {
+		super(`Upgrade manifest already registered for type: ${documentType}`);
+		this.name = "DuplicateManifestError";
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "DuplicateManifestError";
+	}
+};
+/**
+* Error thrown when an upgrade manifest is not found.
+*/
+var ManifestNotFoundError = class extends Error {
+	constructor(documentType) {
+		super(`Upgrade manifest not found for type: ${documentType}`);
+		this.name = "ManifestNotFoundError";
+	}
+};
+/**
+* Error thrown when a required upgrade transition is missing from the manifest.
+*/
+var MissingUpgradeTransitionError = class extends Error {
+	constructor(documentType, fromVersion, toVersion) {
+		super(`Missing upgrade transition for ${documentType}: v${fromVersion} to v${toVersion}`);
+		this.name = "MissingUpgradeTransitionError";
+	}
+};
+/**
+* Error thrown when getUpgradeReducer is called with a non-single-step version increment.
+*/
+var InvalidUpgradeStepError = class extends Error {
+	constructor(documentType, fromVersion, toVersion) {
+		super(`Invalid upgrade step for ${documentType}: must be single version increment, got v${fromVersion} to v${toVersion}`);
+		this.name = "InvalidUpgradeStepError";
+	}
+};
+//#endregion
+//#region src/storage/interfaces.ts
+/**
+* Thrown when an operation with the same identity already exists in the store.
+*/
+var DuplicateOperationError = class extends Error {
+	constructor(description) {
+		super(`Duplicate operation: ${description}`);
+		this.name = "DuplicateOperationError";
+	}
+};
+/**
+* Thrown when a concurrent write conflict is detected during an atomic apply.
+*/
+var OptimisticLockError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "OptimisticLockError";
+	}
+};
+/**
+* Thrown when the caller-provided revision does not match the current
+* stored revision, indicating a stale read.
+*/
+var RevisionMismatchError = class extends Error {
+	constructor(expected, actual) {
+		super(`Revision mismatch: expected ${expected}, got ${actual}`);
+		this.name = "RevisionMismatchError";
+	}
+};
+/** Error history keeps messages, not classes, so failures match by prefix. */
+const APPEND_CONDITION_FAILED_PREFIX = "Append condition failed: ";
+/**
+* A read-set stream grew before the append committed. A concurrency
+* conflict, not a fault: the caller retries against the new stream heads.
+*/
+var AppendConditionFailedError = class extends Error {
+	constructor(condition) {
+		const streams = condition.streams.map((s) => `${s.documentId}:${s.scope}:${s.branch}@${s.revision}`).join(", ");
+		super(`${APPEND_CONDITION_FAILED_PREFIX}a read-set stream advanced [${streams}]`);
+		this.condition = condition;
+		this.name = "AppendConditionFailedError";
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "AppendConditionFailedError";
+	}
+	/** True when a recorded error message is an append-condition failure. */
+	static isFailureMessage(message) {
+		return message.startsWith(APPEND_CONDITION_FAILED_PREFIX);
+	}
+};
+//#endregion
+//#region src/executor/types.ts
+/** How long a deferred job waits for its document before it fails. */
+const DEFAULT_DEFERRED_JOB_TTL_MS = 3e4;
+/**
+* Event types for the job executor
+*/
+const JobExecutorEventTypes = {
+	JOB_STARTED: 2e4,
+	JOB_COMPLETED: 20001,
+	JOB_FAILED: 20002,
+	EXECUTOR_STARTED: 20003,
+	EXECUTOR_STOPPED: 20004
+};
+//#endregion
+//#region src/cache/collection-membership-cache.ts
+var CollectionMembershipCache = class CollectionMembershipCache {
+	cache = /* @__PURE__ */ new Map();
+	constructor(operationIndex) {
+		this.operationIndex = operationIndex;
+	}
+	withScopedIndex(operationIndex) {
+		const scoped = new CollectionMembershipCache(operationIndex);
+		scoped.cache = this.cache;
+		return scoped;
+	}
+	async getCollectionsForDocuments(documentIds) {
+		const result = {};
+		const missing = [];
+		for (const docId of documentIds) {
+			const cached = this.cache.get(docId);
+			if (cached !== void 0) result[docId] = cached;
+			else missing.push(docId);
+		}
+		if (missing.length > 0) {
+			const fromDb = await this.operationIndex.getCollectionsForDocuments(missing);
+			for (const docId of missing) {
+				const collections = fromDb[docId] ?? [];
+				result[docId] = collections;
+				this.cache.set(docId, collections);
+			}
+		}
+		return result;
+	}
+	invalidate(documentId) {
+		this.cache.delete(documentId);
+	}
+};
 //#endregion
 //#region src/cache/lru/lru-tracker.ts
 var LRUNode = class {
@@ -543,6 +1155,7 @@ var KyselyOperationIndexTxn = class {
 	collections = [];
 	collectionMemberships = [];
 	collectionRemovals = [];
+	groupReferences = [];
 	operations = [];
 	createCollection(collectionId) {
 		this.collections.push(collectionId);
@@ -565,12 +1178,25 @@ var KyselyOperationIndexTxn = class {
 			operationIndex: lastOpIndex
 		});
 	}
+	recordGroupReferences(documentId, groupIds) {
+		const lastOpIndex = this.operations.length - 1;
+		if (lastOpIndex < 0) throw new Error("recordGroupReferences must be called after write() - no operations in transaction");
+		if (groupIds.length === 0) return;
+		this.groupReferences.push({
+			documentId,
+			groupIds,
+			operationIndex: lastOpIndex
+		});
+	}
 	write(operations) {
 		this.operations.push(...operations);
 	}
 	getCollections() {
 		return this.collections;
 	}
+	getGroupReferenceRecords() {
+		return this.groupReferences;
+	}
 	getCollectionMembershipRecords() {
 		return this.collectionMemberships;
 	}
@@ -607,10 +1233,27 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 		});
 		return resultOrdinals;
 	}
+	/**
+	* A policy-driven join: keeps the earliest join so a rediscovered reference
+	* never shrinks a backfill window remotes already rely on, and reopens a
+	* closed membership because a policy reference is not a removable one.
+	*/
+	async joinKeepingEarliest(trx, documentId, collectionId, ordinal) {
+		await trx.insertInto("document_collections").values({
+			documentId,
+			collectionId,
+			joinedOrdinal: ordinal,
+			leftOrdinal: null
+		}).onConflict((oc) => oc.columns(["documentId", "collectionId"]).doUpdateSet({
+			joinedOrdinal: sql`LEAST("document_collections"."joinedOrdinal", EXCLUDED."joinedOrdinal")`,
+			leftOrdinal: null
+		})).execute();
+	}
 	async executeCommit(trx, kyselyTxn) {
 		const collections = kyselyTxn.getCollections();
 		const memberships = kyselyTxn.getCollectionMembershipRecords();
 		const removals = kyselyTxn.getCollectionRemovals();
+		const groupReferences = kyselyTxn.getGroupReferenceRecords();
 		const operations = kyselyTxn.getOperations();
 		if (collections.length > 0) {
 			const collectionRows = collections.map((collectionId) => ({
@@ -634,6 +1277,7 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 				skip: op.skip,
 				hash: op.hash,
 				action: op.action,
+				deniedReason: op.deniedReason ?? null,
 				sourceRemote: op.sourceRemote
 			}));
 			operationOrdinals = (await trx.insertInto("operation_index_operations").values(operationRows).returning("ordinal").execute()).map((row) => row.ordinal);
@@ -649,13 +1293,28 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 				joinedOrdinal: BigInt(ordinal),
 				leftOrdinal: null
 			})).execute();
+			const references = await trx.selectFrom("group_references").select("groupId").where("documentId", "=", m.documentId).execute();
+			for (const { groupId } of references) await this.joinKeepingEarliest(trx, groupId, m.collectionId, BigInt(ordinal));
 		}
 		if (removals.length > 0) for (const r of removals) {
 			const ordinal = operationOrdinals[r.operationIndex];
 			await trx.updateTable("document_collections").set({ leftOrdinal: BigInt(ordinal) }).where("collectionId", "=", r.collectionId).where("documentId", "=", r.documentId).where("leftOrdinal", "is", null).execute();
 		}
+		if (groupReferences.length > 0) for (const record of groupReferences) {
+			const ordinal = operationOrdinals[record.operationIndex];
+			await trx.insertInto("group_references").values(record.groupIds.map((groupId) => ({
+				documentId: record.documentId,
+				groupId
+			}))).onConflict((oc) => oc.doNothing()).execute();
+			const rows = await trx.selectFrom("document_collections").select("collectionId").where("documentId", "=", record.documentId).execute();
+			for (const groupId of record.groupIds) for (const { collectionId } of rows) await this.joinKeepingEarliest(trx, groupId, collectionId, BigInt(ordinal));
+		}
 		return operationOrdinals;
 	}
+	async getGroupReferencers(groupId, signal) {
+		if (signal?.aborted) throw new Error("Operation aborted");
+		return (await this.queryExecutor.selectFrom("group_references").select("documentId").where("groupId", "=", groupId).orderBy("documentId").execute()).map((row) => row.documentId);
+	}
 	async find(collectionId, cursor, view, paging, signal) {
 		if (signal?.aborted) throw new Error("Operation aborted");
 		const outerCursor = cursor ?? -1;
@@ -765,6 +1424,7 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 				hash: row.hash,
 				skip: row.skip,
 				action: row.action,
+				deniedReason: row.deniedReason ?? void 0,
 				id: row.opId
 			},
 			context: {
@@ -788,6 +1448,7 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 			hash: row.hash,
 			skip: row.skip,
 			action: row.action,
+			deniedReason: row.deniedReason ?? void 0,
 			id: row.opId,
 			sourceRemote: row.sourceRemote
 		};
@@ -873,10 +1534,54 @@ var RingBuffer = class {
 	}
 };
 //#endregion
+//#region src/cache/write-cache-types.ts
+/**
+* Where a snapshot sits in its stream.
+*
+* - `Head`: the newest revision of the stream when it was stored. Only these
+*   can answer a read that asks for the head.
+* - `Historical`: state at an earlier revision. Usable as a starting point to
+*   replay forward from, and as an answer to a read for that same revision.
+*/
+let SnapshotPosition = /* @__PURE__ */ function(SnapshotPosition) {
+	SnapshotPosition["Head"] = "head";
+	SnapshotPosition["Historical"] = "historical";
+	return SnapshotPosition;
+}({});
+//#endregion
 //#region src/cache/kysely-write-cache.ts
+/**
+* The last operation index a keyframe's document reflects for the scope. A
+* keyframe only exists for a scope that has operations, so a missing entry
+* means the stored row is corrupt.
+*/
+function keyframeRevision(keyframe, documentId, scope) {
+	const nextIndex = keyframe.document.header.revision[scope];
+	if (typeof nextIndex !== "number") throw new Error(`Corrupt keyframe for document ${documentId} at revision ${keyframe.revision}: header carries no ${scope} revision`);
+	return nextIndex - 1;
+}
 function extractModuleVersion(doc) {
 	const v = doc.state.document.version;
-	return v === 0 ? void 0 : v;
+	return normalizeDocumentModelVersion(v);
+}
+/** The highest revision held, latest push winning a tie. */
+function highestRevision(snapshots) {
+	let newest = void 0;
+	for (const snapshot of snapshots) if (!newest || snapshot.revision >= newest.revision) newest = snapshot;
+	return newest;
+}
+/**
+* Copies a document far enough that the caller cannot write through it. Inside
+* this class, callers only ever replace whole fields on these four, so one
+* level each is enough.
+*/
+function copyDocument(document) {
+	return {
+		...document,
+		header: { ...document.header },
+		state: { ...document.state },
+		operations: { ...document.operations }
+	};
 }
 /**
 * In-memory write cache with keyframe persistence for PHDocuments.
@@ -956,6 +1661,8 @@ var KyselyWriteCache = class KyselyWriteCache {
 	/**
 	* Retrieves document state at a specific revision from cache or rebuilds it.
 	*
+	* Note: this returns a _shallow_ copy of the document.
+	*
 	* Cache hit path: Returns cached snapshot if available (O(1))
 	* Warm miss path: Rebuilds from cached base revision + incremental ops
 	* Cold miss path: Rebuilds from keyframe or from scratch using all operations
@@ -979,30 +1686,35 @@ var KyselyWriteCache = class KyselyWriteCache {
 		if (stream) {
 			const snapshots = stream.ringBuffer.getAll();
 			if (targetRevision === void 0) {
-				if (snapshots.length > 0) {
-					const newest = snapshots[snapshots.length - 1];
+				const newest = highestRevision(snapshots);
+				if (newest?.position === SnapshotPosition.Head) {
+					this.lruTracker.touch(streamKey);
+					return copyDocument(newest.document);
+				}
+				if (newest) {
+					const document = await this.warmMissRebuild(newest.document, newest.revision, documentId, scope, branch, void 0, signal);
+					this.store(documentId, scope, branch, (document.header.revision[scope] ?? 0) - 1, document, SnapshotPosition.Head);
 					this.lruTracker.touch(streamKey);
-					return newest.document;
+					return document;
 				}
 			} else {
-				const exactMatch = snapshots.find((s) => s.revision === targetRevision);
+				const exactMatch = snapshots.findLast((s) => s.revision === targetRevision);
 				if (exactMatch) {
 					this.lruTracker.touch(streamKey);
-					return exactMatch.document;
+					return copyDocument(exactMatch.document);
 				}
 				const newestOlder = this.findNearestOlderSnapshot(snapshots, targetRevision);
 				if (newestOlder) {
 					const document = await this.warmMissRebuild(newestOlder.document, newestOlder.revision, documentId, scope, branch, targetRevision, signal);
-					this.putState(documentId, scope, branch, targetRevision, document);
+					this.store(documentId, scope, branch, targetRevision, document, SnapshotPosition.Historical);
 					this.lruTracker.touch(streamKey);
 					return document;
 				}
 			}
 		}
 		const document = await this.coldMissRebuild(documentId, scope, branch, targetRevision, signal);
-		let revision = targetRevision;
-		if (revision === void 0) revision = document.header.revision[scope] || 0;
-		this.putState(documentId, scope, branch, revision, document);
+		const revision = targetRevision ?? (document.header.revision[scope] ?? 0) - 1;
+		this.store(documentId, scope, branch, revision, document, targetRevision === void 0 ? SnapshotPosition.Head : SnapshotPosition.Historical);
 		return document;
 	}
 	/**
@@ -1025,16 +1737,20 @@ var KyselyWriteCache = class KyselyWriteCache {
 	* @param document - The document to cache
 	* @throws {Error} If document serialization fails
 	*/
-	putState(documentId, scope, branch, revision, document) {
+	putState(documentId, scope, branch, revision, document, position) {
+		this.store(documentId, scope, branch, revision, document, position);
+	}
+	store(documentId, scope, branch, revision, document, position) {
 		const streamKey = this.makeStreamKey(documentId, scope, branch);
 		const stream = this.getOrCreateStream(streamKey);
 		const snapshot = {
 			revision,
 			document: {
-				...document,
+				...copyDocument(document),
 				operations: Object.fromEntries(Object.entries(document.operations).map(([k, ops]) => [k, ops.length ? [ops.at(-1)] : []])),
 				clipboard: []
-			}
+			},
+			position
 		};
 		stream.ringBuffer.push(snapshot);
 		if (this.isKeyframeRevision(revision)) this.keyframeStore.putKeyframe(documentId, scope, branch, revision, {
@@ -1102,64 +1818,102 @@ var KyselyWriteCache = class KyselyWriteCache {
 	}
 	async findNearestKeyframe(documentId, scope, branch, targetRevision, signal) {
 		if (targetRevision === Number.MAX_SAFE_INTEGER || targetRevision <= 0) return;
-		return this.keyframeStore.findNearestKeyframe(documentId, scope, branch, targetRevision, signal);
+		const keyframe = await this.keyframeStore.findNearestKeyframe(documentId, scope, branch, targetRevision, signal);
+		if (!keyframe) return;
+		return {
+			revision: Math.min(keyframeRevision(keyframe, documentId, scope), keyframe.revision),
+			document: keyframe.document
+		};
 	}
+	/**
+	* Rebuilds a scope from a keyframe or from the whole operation history.
+	*
+	* The document scope is always rebuilt first, because it carries the type,
+	* the upgrades and the deletion marker. Its version-changing upgrades are not
+	* applied there though: an upgrade reducer must see the state the requested
+	* scope has reached at that upgrade's boundary, so each one is held back and
+	* applied when the replay below crosses the boundary that
+	* resolveModuleVersionForOp derives from it. Upgrades whose boundary lies past
+	* the last replayed operation are applied at the end. Creation-time 0->N seed
+	* upgrades carry the initial state, so they still apply immediately.
+	*/
 	async coldMissRebuild(documentId, scope, branch, targetRevision, signal) {
 		const effectiveTargetRevision = targetRevision || Number.MAX_SAFE_INTEGER;
 		const keyframe = await this.findNearestKeyframe(documentId, scope, branch, effectiveTargetRevision, signal);
+		const documentScopeBound = scope === "document" ? targetRevision : void 0;
 		let document;
 		let startRevision;
 		let documentType;
 		const validatedUpgrades = [];
+		const pendingUpgrades = [];
+		let lastDocumentScopeOperation;
 		if (keyframe) {
 			document = keyframe.document;
 			startRevision = keyframe.revision;
 			documentType = keyframe.document.header.documentType;
-			const docScopeOpsAfterKeyframe = await this.operationStore.getSince(documentId, "document", branch, keyframe.revision, void 0, void 0, signal);
-			for (const operation of docScopeOpsAfterKeyframe.results) if (operation.action.type === "UPGRADE_DOCUMENT") {
-				const upgradeAction = operation.action;
-				const fromVersion = upgradeAction.input.fromVersion;
-				const toVersion = upgradeAction.input.toVersion;
-				if (fromVersion > 0 && fromVersion < toVersion) {
-					let upgradePath;
-					try {
-						upgradePath = this.registry.computeUpgradePath(documentType, fromVersion, toVersion);
-					} catch (err) {
-						if (upgradeAction.input.initialState !== void 0) upgradePath = void 0;
-						else throw new Error(`Failed to rebuild document ${documentId}: no upgrade manifest for ${documentType} v${fromVersion}→v${toVersion} and no initialState snapshot. ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+			const documentScopeResume = scope === "document" ? keyframe.revision : keyframeRevision(keyframe, documentId, "document");
+			const docScopeOpsAfterKeyframe = await this.operationStore.getSince(documentId, "document", branch, documentScopeResume, void 0, void 0, signal);
+			for (const operation of docScopeOpsAfterKeyframe.results) {
+				if (documentScopeBound !== void 0 && operation.index > documentScopeBound) break;
+				lastDocumentScopeOperation = operation;
+				if (operation.error || isDenied(operation)) continue;
+				if (operation.action.type === "UPGRADE_DOCUMENT") {
+					const upgradeAction = operation.action;
+					const fromVersion = upgradeAction.input.fromVersion;
+					const toVersion = upgradeAction.input.toVersion;
+					if (fromVersion > 0 && fromVersion < toVersion) {
+						let upgradePath;
+						try {
+							upgradePath = this.registry.computeUpgradePath(documentType, fromVersion, toVersion);
+						} catch (err) {
+							if (upgradeAction.input.initialState !== void 0) upgradePath = void 0;
+							else throw new Error(`Failed to rebuild document ${documentId}: no upgrade manifest for ${documentType} v${fromVersion}→v${toVersion} and no initialState snapshot. ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+						}
+						validatedUpgrades.push({
+							fromVersion,
+							toVersion,
+							revision: upgradeAction.input.revision,
+							timestampUtcMs: operation.timestampUtcMs
+						});
+						pendingUpgrades.push({
+							action: upgradeAction,
+							upgradePath,
+							index: operation.index,
+							subsequentDeletes: []
+						});
 					}
-					validatedUpgrades.push({
-						fromVersion,
-						toVersion,
-						revision: upgradeAction.input.revision,
-						timestampUtcMs: operation.timestampUtcMs
-					});
-					document = applyUpgradeDocumentAction(document, upgradeAction, upgradePath);
+				} else if (operation.action.type === "DELETE_DOCUMENT") {
+					applyDeleteDocumentAction(document, operation.action);
+					for (const pending of pendingUpgrades) pending.subsequentDeletes.push(operation.action);
 				}
-			} else if (operation.action.type === "DELETE_DOCUMENT") applyDeleteDocumentAction(document, operation.action);
+			}
 		} else {
 			startRevision = -1;
 			const createOpResult = await this.operationStore.getSince(documentId, "document", branch, -1, void 0, {
 				cursor: "0",
 				limit: 1
 			}, signal);
-			if (createOpResult.results.length === 0) throw new Error(`Failed to rebuild document ${documentId}: no CREATE_DOCUMENT operation found in document scope`);
+			if (createOpResult.results.length === 0) throw new DocumentNotFoundError(documentId);
 			const createOp = createOpResult.results[0];
 			if (createOp.action.type !== "CREATE_DOCUMENT") throw new Error(`Failed to rebuild document ${documentId}: first operation in document scope must be CREATE_DOCUMENT, found ${createOp.action.type}`);
 			const documentCreateAction = createOp.action;
 			documentType = documentCreateAction.input.model;
 			if (!documentType) throw new Error(`Failed to rebuild document ${documentId}: CREATE_DOCUMENT action missing model in input`);
 			document = createDocumentFromAction(documentCreateAction);
+			lastDocumentScopeOperation = createOp;
 			let docModule = this.registry.getModule(documentType, extractModuleVersion(document));
 			const docScopeOps = await this.operationStore.getSince(documentId, "document", branch, 0, void 0, void 0, signal);
 			for (const operation of docScopeOps.results) {
+				if (documentScopeBound !== void 0 && operation.index > documentScopeBound) break;
+				lastDocumentScopeOperation = operation;
 				if (operation.index === 0) continue;
+				if (operation.error || isDenied(operation)) continue;
 				if (operation.action.type === "UPGRADE_DOCUMENT") {
 					const upgradeAction = operation.action;
 					const fromVersion = upgradeAction.input.fromVersion;
 					const toVersion = upgradeAction.input.toVersion;
-					let upgradePath;
 					if (fromVersion > 0 && fromVersion < toVersion) {
+						let upgradePath;
 						try {
 							upgradePath = this.registry.computeUpgradePath(documentType, fromVersion, toVersion);
 						} catch (err) {
@@ -1172,12 +1926,19 @@ var KyselyWriteCache = class KyselyWriteCache {
 							revision: upgradeAction.input.revision,
 							timestampUtcMs: operation.timestampUtcMs
 						});
-					}
-					document = applyUpgradeDocumentAction(document, upgradeAction, upgradePath);
-					docModule = this.registry.getModule(documentType, extractModuleVersion(document));
-				} else if (operation.action.type === "DELETE_DOCUMENT") applyDeleteDocumentAction(document, operation.action);
-				else {
-					const protocolVersion = document.header.protocolVersions?.["base-reducer"] ?? 1;
+						pendingUpgrades.push({
+							action: upgradeAction,
+							upgradePath,
+							index: operation.index,
+							subsequentDeletes: []
+						});
+					} else document = applyUpgradeDocumentAction(document, upgradeAction, void 0);
+					docModule = this.registry.getModule(documentType, normalizeDocumentModelVersion(toVersion));
+				} else if (operation.action.type === "DELETE_DOCUMENT") {
+					applyDeleteDocumentAction(document, operation.action);
+					for (const pending of pendingUpgrades) pending.subsequentDeletes.push(operation.action);
+				} else {
+					const protocolVersion = baseReducerVersion(document.header);
 					document = docModule.reducer(document, operation.action, void 0, {
 						skip: operation.skip,
 						protocolVersion
@@ -1185,6 +1946,22 @@ var KyselyWriteCache = class KyselyWriteCache {
 				}
 			}
 		}
+		if (scope === "document") {
+			document = this.applyPendingUpgrades(document, pendingUpgrades, Number.MAX_SAFE_INTEGER);
+			const last = lastDocumentScopeOperation ?? await this.operationAt(documentId, "document", branch, startRevision, signal);
+			document.operations = {
+				...document.operations,
+				document: last ? [last] : []
+			};
+			return this.stampRevisions(document, documentId, scope, branch, targetRevision, signal);
+		}
+		if (keyframe) {
+			const resumeOperation = await this.operationAt(documentId, scope, branch, startRevision, signal);
+			if (resumeOperation) document.operations = {
+				...document.operations,
+				[scope]: [resumeOperation]
+			};
+		}
 		const moduleCache = /* @__PURE__ */ new Map();
 		const getModuleCached = (version) => {
 			const key = version ?? 0;
@@ -1195,6 +1972,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 			}
 			return mod;
 		};
+		const finalVersion = validatedUpgrades.at(-1)?.toVersion ?? extractModuleVersion(document);
 		let cursor = void 0;
 		const pageSize = 100;
 		let hasMorePages;
@@ -1208,12 +1986,16 @@ var KyselyWriteCache = class KyselyWriteCache {
 				const result = await this.operationStore.getSince(documentId, scope, branch, startRevision, void 0, paging, signal);
 				for (const operation of result.results) {
 					if (targetRevision !== void 0 && operation.index > targetRevision) break;
-					const moduleVersion = this.resolveModuleVersionForOp(operation.index, operation.timestampUtcMs, scope, validatedUpgrades, extractModuleVersion(document));
-					const protocolVersion = document.header.protocolVersions?.["base-reducer"] ?? 1;
-					document = getModuleCached(moduleVersion).reducer(document, operation.action, void 0, {
-						skip: operation.skip,
-						protocolVersion
-					});
+					const moduleVersion = this.resolveModuleVersionForOp(operation.index, operation.timestampUtcMs, scope, validatedUpgrades, finalVersion);
+					document = this.applyPendingUpgrades(document, pendingUpgrades, moduleVersion ?? Number.MAX_SAFE_INTEGER);
+					if (isDenied(operation)) document = appendWithoutApplying(document, operation, scope);
+					else {
+						const protocolVersion = baseReducerVersion(document.header);
+						document = getModuleCached(moduleVersion).reducer(document, operation.action, void 0, {
+							skip: operation.skip,
+							protocolVersion
+						});
+					}
 				}
 				const reachedTarget = targetRevision !== void 0 && result.results.some((op) => op.index >= targetRevision);
 				hasMorePages = Boolean(result.nextCursor) && !reachedTarget;
@@ -1222,11 +2004,86 @@ var KyselyWriteCache = class KyselyWriteCache {
 				throw new Error(`Failed to rebuild document ${documentId}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
 			}
 		} while (hasMorePages);
+		document = this.applyTailPendingUpgrades(document, pendingUpgrades, scope, targetRevision);
+		document = await this.stampRevisions(document, documentId, scope, branch, targetRevision, signal);
+		if (pendingUpgrades.length > 0) {
+			const firstHeldBack = pendingUpgrades[0];
+			const stamped = document.header.revision["document"] ?? 0;
+			document.header.revision = {
+				...document.header.revision,
+				document: Math.min(stamped, firstHeldBack.index)
+			};
+		}
+		return document;
+	}
+	/**
+	* Applies and removes every held-back upgrade whose target version is at or
+	* below `throughVersion`, in the order the document scope recorded them.
+	*/
+	applyPendingUpgrades(document, pendingUpgrades, throughVersion) {
+		while (pendingUpgrades.length > 0) {
+			const pending = pendingUpgrades[0];
+			if (throughVersion < pending.action.input.toVersion) break;
+			pendingUpgrades.shift();
+			document = this.applyPendingUpgrade(document, pending);
+		}
+		return document;
+	}
+	/**
+	* Applies the remaining held-back upgrades after the requested scope's
+	* replay has finished. A head read applies them all. A positional read
+	* applies only those whose boundary for this scope lies at or before the
+	* target position: applying a later one would label migrated state with a
+	* pre-upgrade revision, and a keyframe stored from that poisons every
+	* rebuild that resumes from it. Boundaries come from the upgrade's revision
+	* snapshot; an upgrade without one records no position for this scope, and
+	* the replay loop not having crossed it already places it past the target.
+	*/
+	applyTailPendingUpgrades(document, pendingUpgrades, scope, targetRevision) {
+		while (pendingUpgrades.length > 0) {
+			const pending = pendingUpgrades[0];
+			if (targetRevision !== void 0) {
+				const snapshot = pending.action.input.revision;
+				if (snapshot === void 0) break;
+				if ((snapshot[scope] ?? 0) > targetRevision) break;
+			}
+			pendingUpgrades.shift();
+			document = this.applyPendingUpgrade(document, pending);
+		}
+		return document;
+	}
+	/**
+	* Applies one held-back upgrade, then re-applies the deletes the document
+	* scope recorded after it so the hold-back cannot invert their order.
+	*/
+	applyPendingUpgrade(document, pending) {
+		document = applyUpgradeDocumentAction(document, pending.action, pending.upgradePath);
+		for (const deleteAction of pending.subsequentDeletes) document = applyDeleteDocumentAction(document, deleteAction);
+		return document;
+	}
+	/**
+	* Copies the current document revisions onto the document. Overwrites the
+	* requested scope revision with the target revision, if provided.
+	*/
+	async stampRevisions(document, documentId, scope, branch, targetRevision, signal) {
 		const revisions = await this.operationStore.getRevisions(documentId, branch, signal);
 		document.header.revision = revisions.revision;
+		if (targetRevision !== void 0) document.header.revision = {
+			...document.header.revision,
+			[scope]: targetRevision + 1
+		};
 		document.header.lastModifiedAtUtcIso = revisions.latestTimestamp;
 		return document;
 	}
+	/** The stored operation at `index`, or undefined if it is no longer there. */
+	async operationAt(documentId, scope, branch, index, signal) {
+		if (index < 0) return;
+		const operation = (await this.operationStore.getSince(documentId, scope, branch, index - 1, void 0, {
+			cursor: "0",
+			limit: 1
+		}, signal)).results[0];
+		return operation && operation.index === index ? operation : void 0;
+	}
 	/**
 	* Resolves which module version to use for a given operation in phase 2.
 	*
@@ -1250,19 +2107,22 @@ var KyselyWriteCache = class KyselyWriteCache {
 	async warmMissRebuild(baseDocument, baseRevision, documentId, scope, branch, targetRevision, signal) {
 		const documentType = baseDocument.header.documentType;
 		const docScopeNextIndex = baseDocument.header.revision["document"] ?? 0;
-		if ((await this.operationStore.getSince(documentId, "document", branch, docScopeNextIndex - 1, void 0, void 0, signal)).results.some((op) => op.action.type === "UPGRADE_DOCUMENT")) return this.coldMissRebuild(documentId, scope, branch, targetRevision, signal);
+		if ((await this.operationStore.getSince(documentId, "document", branch, docScopeNextIndex - 1, void 0, void 0, signal)).results.length > 0) return this.coldMissRebuild(documentId, scope, branch, targetRevision, signal);
 		const module = this.registry.getModule(documentType, extractModuleVersion(baseDocument));
-		let document = baseDocument;
+		let document = copyDocument(baseDocument);
 		try {
 			const pagedResults = await this.operationStore.getSince(documentId, scope, branch, baseRevision, void 0, void 0, signal);
 			for (const operation of pagedResults.results) {
 				if (signal?.aborted) throw new Error("Operation aborted");
 				if (targetRevision !== void 0 && operation.index > targetRevision) break;
-				const protocolVersion = document.header.protocolVersions?.["base-reducer"] ?? 1;
-				document = module.reducer(document, operation.action, void 0, {
-					skip: operation.skip,
-					protocolVersion
-				});
+				if (isDenied(operation)) document = appendWithoutApplying(document, operation, scope);
+				else {
+					const protocolVersion = baseReducerVersion(document.header);
+					document = module.reducer(document, operation.action, void 0, {
+						skip: operation.skip,
+						protocolVersion
+					});
+				}
 				if (targetRevision !== void 0 && operation.index === targetRevision) break;
 			}
 		} catch (err) {
@@ -1270,6 +2130,10 @@ var KyselyWriteCache = class KyselyWriteCache {
 		}
 		const revisions = await this.operationStore.getRevisions(documentId, branch, signal);
 		document.header.revision = revisions.revision;
+		if (targetRevision !== void 0) document.header.revision = {
+			...document.header.revision,
+			[scope]: targetRevision + 1
+		};
 		document.header.lastModifiedAtUtcIso = revisions.latestTimestamp;
 		return document;
 	}
@@ -1339,6 +2203,49 @@ var EventBus = class {
 	}
 };
 //#endregion
+//#region src/core/feature-flags.ts
+/**
+* Every flag this reactor knows, with the flags it requires. A stage adds its
+* flag here when it ships, so asking an older reactor for a later stage's flag
+* is an unrecognized name rather than a flag that quietly does nothing.
+*/
+const FLAG_PREREQUISITES = {
+	documentDecisions: [],
+	authEnforcement: ["documentDecisions"],
+	authGroups: ["authEnforcement"],
+	authConditions: ["authGroups"]
+};
+/**
+* The flags as plain booleans, with anything unset off, validated. Callers hold
+* a partial set, because that is what crosses to a pooled worker, and every
+* consumer needs the same resolution of it.
+*/
+function resolveFeatureFlags(flags = {}) {
+	const resolved = {
+		documentDecisions: flags.documentDecisions ?? false,
+		authEnforcement: flags.authEnforcement ?? false,
+		authGroups: flags.authGroups ?? false,
+		authConditions: flags.authConditions ?? false
+	};
+	validateFeatureFlags(flags, FLAG_PREREQUISITES);
+	return resolved;
+}
+/**
+* Throws when the flags ask for enforcement the reactor cannot deliver. Either
+* failure would otherwise read as enforcement being on while the reactor
+* applies less than the caller asked for.
+*/
+function validateFeatureFlags(flags, prerequisites) {
+	const known = Object.keys(prerequisites);
+	const unrecognized = Object.keys(flags).filter((name) => !known.includes(name));
+	if (unrecognized.length > 0) throw new Error(`Unrecognized reactor feature flag: ${unrecognized.join(", ")}. This reactor knows: ${known.join(", ")}.`);
+	for (const name of known) {
+		if (flags[name] !== true) continue;
+		const missing = prerequisites[name].filter((required) => flags[required] !== true);
+		if (missing.length > 0) throw new Error(`Reactor feature flag ${name} requires ${missing.join(", ")}.`);
+	}
+}
+//#endregion
 //#region src/executor/execution-scope.ts
 var DefaultExecutionScope = class {
 	constructor(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache) {
@@ -1436,6 +2343,273 @@ function reshuffleByTimestamp(startIndex, opsA, opsB) {
 	}));
 }
 //#endregion
+//#region src/decision/merged-order.ts
+/** Identifies a stream within a walk. */
+function streamKey(query) {
+	return `${query.documentId}:${query.scope}:${query.branch}`;
+}
+/**
+* Orders two operations from different streams by position. Timestamp decides;
+* an equal timestamp puts an auth operation first, and otherwise falls to the
+* action id and then the operation id, so that two replicas holding the same
+* operations agree on the order whatever order they happen to store them in.
+*/
+function comparePositions(a, b) {
+	const aTime = Date.parse(a.operation.timestampUtcMs);
+	const bTime = Date.parse(b.operation.timestampUtcMs);
+	if (aTime !== bTime) return aTime - bTime;
+	if (a.streamKey === b.streamKey) return a.operation.index - b.operation.index;
+	const aAuth = a.scope === "auth";
+	if (aAuth !== (b.scope === "auth")) return aAuth ? -1 : 1;
+	const actionIds = (a.operation.action.id ?? "").localeCompare(b.operation.action.id ?? "");
+	if (actionIds !== 0) return actionIds;
+	return (a.operation.id ?? "").localeCompare(b.operation.id ?? "");
+}
+/**
+* Merges the read-set streams into one sequence by position. An operation's
+* place in the result is the bound a decision at that operation reads to: every
+* operation before it has been applied, and it has not.
+*/
+function mergeByPosition(streams) {
+	const merged = [];
+	for (const stream of streams) for (const operation of stream.operations) merged.push({
+		streamKey: stream.streamKey,
+		scope: stream.scope,
+		operation
+	});
+	return merged.sort(comparePositions);
+}
+/**
+* The skip that retracts everything from `firstRetractedIndex` up to where the
+* re-appended operation lands. It spans the indexes rather than counting the
+* operations, because a stream with a gap in it makes those differ.
+*/
+function retractionSkip(nextIndex, firstRetractedIndex) {
+	return nextIndex - firstRetractedIndex;
+}
+//#endregion
+//#region src/decision/walk.ts
+/**
+* A single forward pass is only correct while a stream's effective operations
+* are ordered.
+*/
+function assertPositionOrder(streamKey, scope, operations) {
+	for (let i = 1; i < operations.length; i++) {
+		const previous = operations[i - 1];
+		const current = operations[i];
+		if (comparePositions({
+			streamKey,
+			scope,
+			operation: previous
+		}, {
+			streamKey,
+			scope,
+			operation: current
+		}) > 0) throw new Error(`Stream ${streamKey} is out of position order: index ${previous.index} at ${previous.timestampUtcMs} precedes index ${current.index} at ${current.timestampUtcMs}`);
+	}
+}
+/**
+* Visits every operation in the read-set once, in the order their positions
+* fall, and hands back the state each stream held just before it. That state is
+* what a decision at that operation reads.
+*
+* Skips are resolved first (i.e. this is performed on a garbage collected
+* stream), which means we can do a single forward pass.
+*
+* An operation that contributes no state, whether denied or holding a reducer
+* error, is visited but not applied (this matches the write cache's rebuild).
+*
+* The consumer sends back whether it refused the operation it was handed: a
+* refusal this pass produced must suppress it the same way a stored one does.
+*/
+function* walkByPosition(streams) {
+	const merged = mergeByPosition(streams.map((stream) => {
+		const operations = garbageCollect(sortOperations([...stream.operations]));
+		assertPositionOrder(stream.streamKey, stream.scope, operations);
+		return {
+			streamKey: stream.streamKey,
+			scope: stream.scope,
+			operations
+		};
+	}));
+	const byKey = new Map(streams.map((stream) => [stream.streamKey, stream]));
+	const states = new Map(streams.map((stream) => [stream.streamKey, stream.document]));
+	for (const { streamKey, operation } of merged) {
+		if ((yield {
+			streamKey,
+			operation,
+			states: new Map(states)
+		}) || operation.error !== void 0 || isDenied(operation)) continue;
+		const stream = byKey.get(streamKey);
+		const before = states.get(streamKey);
+		if (before === void 0 || stream === void 0) throw new Error(`No state for stream ${streamKey}`);
+		states.set(streamKey, stream.apply(before, operation));
+	}
+}
+//#endregion
+//#region src/decision/evaluation.ts
+/** The stream key for evaluated operations whose scope no projection reads. */
+const EVALUATED_ONLY = "evaluated";
+/**
+* Whether any stream the model reads declares this operation's action type as
+* one that can change an evaluation.
+*/
+function isDecidingAction(operation, readSet) {
+	return readSet.some((stream) => stream.decidingActions.includes(operation.action.type));
+}
+/**
+* Who an operation acts as. A replayed operation is evaluated as its own signer,
+* so an address-scoped policy does not deny its own author's history.
+*/
+function subjectOf(operation) {
+	const signer = operation.action.context?.signer;
+	return {
+		address: signer?.user.address,
+		key: signer?.app.key
+	};
+}
+/**
+* The model as the walk reached this operation: each static projection's value
+* is its own scope's state, and each derived projection's value maps document
+* id to that document's state, holding only the streams this replica walked. A
+* derived stream it does not hold stays out of the map, which fails closed.
+*/
+function modelAt(readSet, derivedNames, derived, states) {
+	const model = {};
+	for (const stream of readSet) {
+		const document = states.get(streamKey(stream.query));
+		if (document === void 0) throw new Error(`No state walked for projection ${stream.name}`);
+		model[stream.name] = document.state[stream.query.scope];
+	}
+	for (const name of derivedNames) model[name] = {};
+	for (const entry of derived) {
+		const map = model[entry.name];
+		const document = states.get(streamKey(entry.query));
+		if (document !== void 0) map[entry.query.documentId] = document.state[entry.query.scope];
+	}
+	return model;
+}
+/**
+* Evaluates each operation at its own position and returns the refusals in an
+* array parallel to the operations, where undefined means allowed.
+*
+* A position is a timestamp, so an operation refused by a delete is one that
+* sorts after it, and the operations before it are left alone. That holds
+* whether the delete is already stored or is among the operations passed in.
+*/
+async function evaluateByPosition(model, target, subject, stores, signal) {
+	const { scope, operations } = subject;
+	const { writeCache, operationStore } = stores;
+	const definition = model(target);
+	const readSet = staticReadSet(definition);
+	const derivedSet = derivedReadSet(definition);
+	if (!definition.evaluatesScope(scope)) return operations.map(() => void 0);
+	const evaluating = new Set(operations.map((operation) => operation.id));
+	const readStreams = await Promise.all(readSet.map(async (stream) => ({
+		stream,
+		operations: (await operationStore.getSince(stream.query.documentId, stream.query.scope, stream.query.branch, -1, { actionTypes: stream.decidingActions }, void 0, signal)).results.filter((operation) => !evaluating.has(operation.id))
+	})));
+	const decidingOperations = operations.filter((operation) => isDecidingAction(operation, readSet));
+	if (readStreams.every((read) => read.operations.length === 0) && decidingOperations.length === 0) return operations.map(() => void 0);
+	if (readStreams.length === 0) throw new Error(`Decision model for ${target.documentId} reads no stream whose query is known before it is built`);
+	const writtenProjection = readSet.find((stream) => stream.query.scope === scope);
+	const walked = [];
+	const histories = [];
+	for (const read of readStreams) {
+		const streamOperations = read.stream === writtenProjection ? [...read.operations, ...operations] : read.operations;
+		const before = await writeCache.getState(read.stream.query.documentId, read.stream.query.scope, read.stream.query.branch, -1, signal);
+		walked.push({
+			streamKey: streamKey(read.stream.query),
+			scope: read.stream.query.scope,
+			document: before,
+			operations: streamOperations,
+			apply: read.stream.apply
+		});
+		histories.push({
+			name: read.stream.name,
+			operations: streamOperations
+		});
+	}
+	let evaluatedStateKey;
+	if (writtenProjection !== void 0) evaluatedStateKey = streamKey(writtenProjection.query);
+	else if (definition.foldEvaluatedScope !== void 0) {
+		const query = {
+			documentId: target.documentId,
+			scope,
+			branch: target.branch
+		};
+		const storedOperations = (await operationStore.getSince(query.documentId, query.scope, query.branch, -1, void 0, void 0, signal)).results.filter((operation) => !evaluating.has(operation.id));
+		const before = await writeCache.getState(query.documentId, query.scope, query.branch, -1, signal);
+		evaluatedStateKey = streamKey(query);
+		walked.push({
+			streamKey: evaluatedStateKey,
+			scope,
+			document: before,
+			operations: [...storedOperations, ...operations],
+			apply: definition.foldEvaluatedScope
+		});
+	} else walked.push({
+		streamKey: EVALUATED_ONLY,
+		scope,
+		document: walked[0].document,
+		operations,
+		apply: (document) => document
+	});
+	const derivedEntries = [];
+	const walkedKeys = new Set(walked.map((stream) => stream.streamKey));
+	for (const projection of derivedSet) {
+		const queries = projection.queryOverHistory?.(histories) ?? [];
+		for (const query of queries) {
+			const key = streamKey(query);
+			if (walkedKeys.has(key)) continue;
+			let before;
+			try {
+				before = await writeCache.getState(query.documentId, query.scope, query.branch, -1, signal);
+			} catch (error) {
+				if (error instanceof DocumentNotFoundError) continue;
+				throw error;
+			}
+			const streamOperations = (await operationStore.getSince(query.documentId, query.scope, query.branch, -1, { actionTypes: projection.decidingActions }, void 0, signal)).results.filter((operation) => !evaluating.has(operation.id));
+			walkedKeys.add(key);
+			walked.push({
+				streamKey: key,
+				scope: query.scope,
+				document: before,
+				operations: streamOperations,
+				apply: projection.apply
+			});
+			derivedEntries.push({
+				name: projection.name,
+				query
+			});
+		}
+	}
+	const reasons = /* @__PURE__ */ new Map();
+	const walk = walkByPosition(walked);
+	let step = walk.next(false);
+	while (!step.done) {
+		const position = step.value;
+		if (!evaluating.has(position.operation.id)) {
+			step = walk.next(false);
+			continue;
+		}
+		const evaluatedDocument = evaluatedStateKey === void 0 ? void 0 : position.states.get(evaluatedStateKey);
+		const scopeState = evaluatedDocument === void 0 ? void 0 : evaluatedDocument.state[scope];
+		const evaluation = definition.decide(modelAt(readSet, derivedSet.map((projection) => projection.name), derivedEntries, position.states), subjectOf(position.operation), {
+			verb: "execute",
+			scope: position.operation.action.scope,
+			operation: position.operation.action.type
+		}, {
+			scopeState,
+			actionInput: position.operation.action.input
+		});
+		const denied = evaluation.decision === "deny";
+		reasons.set(position.operation.id, denied ? evaluation.reason : void 0);
+		step = walk.next(denied);
+	}
+	return operations.map((operation) => reasons.get(operation.id));
+}
+//#endregion
 //#region src/cache/operation-index-types.ts
 const DRIVE_COLLECTION_PREFIX = "drive.";
 /**
@@ -1482,23 +2656,119 @@ var DriveCollectionId = class DriveCollectionId {
 //#endregion
 //#region src/executor/document-action-handler.ts
 var DocumentActionHandler = class {
-	constructor(registry, logger, driveContainerTypes) {
+	constructor(registry, logger, driveContainerTypes, featureFlags, decisionModel) {
 		this.registry = registry;
 		this.logger = logger;
 		this.driveContainerTypes = driveContainerTypes;
-	}
-	async execute(job, action, startTime, indexTxn, stores, skip = 0, sourceRemote = "", signal) {
+		this.featureFlags = featureFlags;
+		this.decisionModel = decisionModel;
+	}
+	/** Whether the write arrives with its evaluation already decided. */
+	alreadyEvaluated(executing) {
+		return this.featureFlags.documentDecisions && (executing.replayingAcceptedHistory || executing.evaluatedByPosition);
+	}
+	async execute(write, executing) {
+		const { action } = write;
+		if (write.deniedReason !== void 0) return this.writeDenied(write, executing);
+		const refusal = await this.refuseIfPolicyDenies(write, executing);
+		if (refusal) return refusal;
 		switch (action.type) {
-			case "CREATE_DOCUMENT": return this.executeCreate(job, action, startTime, indexTxn, stores, skip, sourceRemote, signal);
-			case "DELETE_DOCUMENT": return this.executeDelete(job, action, startTime, indexTxn, stores, sourceRemote, signal);
-			case "UPGRADE_DOCUMENT": return this.executeUpgrade(job, action, startTime, indexTxn, stores, skip, sourceRemote, signal);
-			case "ADD_RELATIONSHIP": return this.executeAddRelationship(job, action, startTime, indexTxn, stores, sourceRemote, signal);
-			case "REMOVE_RELATIONSHIP": return this.executeRemoveRelationship(job, action, startTime, indexTxn, stores, sourceRemote, signal);
-			case "UPDATE_RELATIONSHIP": return this.executeUpdateRelationship(job, action, startTime, indexTxn, stores, sourceRemote, signal);
-			default: return buildErrorResult(job, /* @__PURE__ */ new Error(`Unknown document action type: ${action.type}`), startTime);
+			case "CREATE_DOCUMENT": return this.executeCreate(write, executing);
+			case "DELETE_DOCUMENT": return this.executeDelete(write, executing);
+			case "UPGRADE_DOCUMENT": return this.executeUpgrade(write, executing);
+			case "ADD_RELATIONSHIP": return this.executeAddRelationship(write, executing);
+			case "REMOVE_RELATIONSHIP": return this.executeRemoveRelationship(write, executing);
+			case "UPDATE_RELATIONSHIP": return this.executeUpdateRelationship(write, executing);
+			default: return buildErrorResult(executing.job, /* @__PURE__ */ new Error(`Unknown document action type: ${action.type}`), executing.startTime);
+		}
+	}
+	/**
+	* Refuses a document-scope write the policy denies, or undefined to proceed.
+	* Without this an `execute`-on-`document` grant is unenforceable.
+	*/
+	async refuseIfPolicyDenies(write, executing) {
+		const { action } = write;
+		const { job, startTime, stores, signal } = executing;
+		if (!this.featureFlags.documentDecisions || !this.featureFlags.authEnforcement || this.alreadyEvaluated(executing) || !GATED_DOCUMENT_ACTIONS.has(action.type)) return;
+		const documentId = targetDocumentId(action, job.documentId);
+		let admission;
+		try {
+			admission = await decideAtHead(this.decisionModel, stores.writeCache, {
+				documentId,
+				branch: job.branch
+			}, {
+				address: action.context?.signer?.user.address,
+				key: action.context?.signer?.app.key
+			}, {
+				verb: "execute",
+				scope: action.scope,
+				operation: action.type
+			}, signal, this.featureFlags.authConditions ? { actionInput: action.input } : void 0);
+		} catch (error) {
+			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
 		}
+		if (admission.evaluation.decision === "allow") return;
+		return buildErrorResult(job, refusalError(admission.evaluation.reason, documentId, admission.deletedAtUtcIso, action), startTime);
 	}
-	async executeCreate(job, action, startTime, indexTxn, stores, skip = 0, sourceRemote = "", signal) {
+	/** A refused operation holds a position in the stream but changes nothing. */
+	async writeDenied(write, executing) {
+		const { action, skip, sourceRemote, deniedReason } = write;
+		const { job, startTime, indexTxn, stores, signal } = executing;
+		let document;
+		try {
+			document = await stores.writeCache.getState(job.documentId, job.scope, job.branch, void 0, signal);
+		} catch (error) {
+			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+		}
+		const index = getNextIndexForScope(document, job.scope);
+		let standing = document;
+		if (skip > 0) try {
+			standing = await stores.writeCache.getState(job.documentId, job.scope, job.branch, index - skip - 1, signal);
+		} catch (error) {
+			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+		}
+		let operation = createOperation(action, index, skip, {
+			documentId: job.documentId,
+			scope: job.scope,
+			branch: job.branch
+		});
+		operation.deniedReason = deniedReason;
+		operation.hash = hashDocumentStateForScope(standing, job.scope);
+		const writeResult = await this.writeOperationToStore({
+			documentId: job.documentId,
+			documentType: document.header.documentType,
+			scope: job.scope,
+			branch: job.branch
+		}, operation, executing);
+		if (!Array.isArray(writeResult)) return writeResult;
+		operation = writeResult[0];
+		updateDocumentRevision(standing, job.scope, operation.index);
+		standing.operations = {
+			...standing.operations,
+			[job.scope]: [...standing.operations[job.scope] ?? [], operation]
+		};
+		stores.writeCache.putState(job.documentId, job.scope, job.branch, operation.index, standing, SnapshotPosition.Head);
+		indexTxn.write([{
+			...operation,
+			documentId: job.documentId,
+			documentType: document.header.documentType,
+			branch: job.branch,
+			scope: job.scope,
+			sourceRemote
+		}]);
+		stores.documentMetaCache.putDocumentMeta(job.documentId, job.branch, {
+			state: standing.state.document,
+			documentType: standing.header.documentType,
+			documentScopeRevision: operation.index + 1
+		});
+		return buildSuccessResult(job, operation, job.documentId, standing.header.documentType, JSON.stringify({
+			header: standing.header,
+			document: standing.state.document
+		}), startTime);
+	}
+	async executeCreate(write, executing) {
+		const { action, skip, sourceRemote } = write;
+		const { job, startTime, indexTxn, stores, signal } = executing;
 		if (job.scope !== "document") return {
 			job,
 			success: false,
@@ -1516,7 +2786,12 @@ var DocumentActionHandler = class {
 			...document.state
 		};
 		const resultingState = JSON.stringify(resultingStateObj);
-		const writeResult = await this.writeOperationToStore(document.header.id, document.header.documentType, job.scope, job.branch, operation, job, startTime, stores, signal);
+		const writeResult = await this.writeOperationToStore({
+			documentId: document.header.id,
+			documentType: document.header.documentType,
+			scope: job.scope,
+			branch: job.branch
+		}, operation, executing);
 		if (!Array.isArray(writeResult)) return writeResult;
 		operation = writeResult[0];
 		updateDocumentRevision(document, job.scope, operation.index);
@@ -1524,7 +2799,7 @@ var DocumentActionHandler = class {
 			...document.operations,
 			[job.scope]: [...document.operations[job.scope] ?? [], operation]
 		};
-		stores.writeCache.putState(document.header.id, job.scope, job.branch, operation.index, document);
+		stores.writeCache.putState(document.header.id, job.scope, job.branch, operation.index, document, SnapshotPosition.Head);
 		indexTxn.write([{
 			...operation,
 			documentId: document.header.id,
@@ -1545,7 +2820,9 @@ var DocumentActionHandler = class {
 		});
 		return buildSuccessResult(job, operation, document.header.id, document.header.documentType, resultingState, startTime);
 	}
-	async executeDelete(job, action, startTime, indexTxn, stores, sourceRemote = "", signal) {
+	async executeDelete(write, executing) {
+		const { action, skip, sourceRemote } = write;
+		const { job, startTime, indexTxn, stores, signal } = executing;
 		const input = action.input;
 		if (!input.documentId) return buildErrorResult(job, /* @__PURE__ */ new Error("DELETE_DOCUMENT action requires a documentId in input"), startTime);
 		const documentId = input.documentId;
@@ -1556,8 +2833,8 @@ var DocumentActionHandler = class {
 			return buildErrorResult(job, /* @__PURE__ */ new Error(`Failed to fetch document before deletion: ${error instanceof Error ? error.message : String(error)}`), startTime);
 		}
 		const documentState = document.state.document;
-		if (documentState.isDeleted) return buildErrorResult(job, new DocumentDeletedError(documentId, documentState.deletedAtUtcIso), startTime);
-		let operation = createOperation(action, getNextIndexForScope(document, job.scope), 0, {
+		if (documentState.isDeleted && !this.alreadyEvaluated(executing)) return buildErrorResult(job, new DocumentDeletedError(documentId, documentState.deletedAtUtcIso), startTime);
+		let operation = createOperation(action, getNextIndexForScope(document, job.scope), skip, {
 			documentId,
 			scope: job.scope,
 			branch: job.branch
@@ -1568,7 +2845,12 @@ var DocumentActionHandler = class {
 			document: document.state.document
 		};
 		const resultingState = JSON.stringify(resultingStateObj);
-		const writeResult = await this.writeOperationToStore(documentId, document.header.documentType, job.scope, job.branch, operation, job, startTime, stores, signal);
+		const writeResult = await this.writeOperationToStore({
+			documentId,
+			documentType: document.header.documentType,
+			scope: job.scope,
+			branch: job.branch
+		}, operation, executing);
 		if (!Array.isArray(writeResult)) return writeResult;
 		operation = writeResult[0];
 		updateDocumentRevision(document, job.scope, operation.index);
@@ -1576,7 +2858,7 @@ var DocumentActionHandler = class {
 			...document.operations,
 			[job.scope]: [...document.operations[job.scope] ?? [], operation]
 		};
-		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document);
+		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, SnapshotPosition.Head);
 		indexTxn.write([{
 			...operation,
 			documentId,
@@ -1592,7 +2874,9 @@ var DocumentActionHandler = class {
 		});
 		return buildSuccessResult(job, operation, documentId, document.header.documentType, resultingState, startTime);
 	}
-	async executeUpgrade(job, action, startTime, indexTxn, stores, skip = 0, sourceRemote = "", signal) {
+	async executeUpgrade(write, executing) {
+		const { action, skip, sourceRemote } = write;
+		const { job, startTime, indexTxn, stores, signal } = executing;
 		const input = action.input;
 		if (!input.documentId) return buildErrorResult(job, /* @__PURE__ */ new Error("UPGRADE_DOCUMENT action requires a documentId in input"), startTime);
 		const documentId = input.documentId;
@@ -1605,14 +2889,7 @@ var DocumentActionHandler = class {
 			return buildErrorResult(job, /* @__PURE__ */ new Error(`Failed to fetch document for upgrade: ${error instanceof Error ? error.message : String(error)}`), startTime);
 		}
 		const documentState = document.state.document;
-		if (documentState.isDeleted) return buildErrorResult(job, new DocumentDeletedError(documentId, documentState.deletedAtUtcIso), startTime);
-		const nextIndex = getNextIndexForScope(document, job.scope);
-		let upgradePath;
-		if (fromVersion > 0 && fromVersion < toVersion) try {
-			upgradePath = this.registry.computeUpgradePath(document.header.documentType, fromVersion, toVersion);
-		} catch (error) {
-			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
-		}
+		if (documentState.isDeleted && !this.alreadyEvaluated(executing)) return buildErrorResult(job, new DocumentDeletedError(documentId, documentState.deletedAtUtcIso), startTime);
 		if (fromVersion === toVersion && fromVersion > 0) return {
 			job,
 			success: true,
@@ -1620,6 +2897,48 @@ var DocumentActionHandler = class {
 			operationsWithContext: [],
 			duration: Date.now() - startTime
 		};
+		const arrivesDecided = executing.replayingAcceptedHistory || executing.evaluatedByPosition;
+		if (fromVersion > 0 && !arrivesDecided) {
+			const stampedVersion = normalizeDocumentModelVersion(documentState.version);
+			if (fromVersion !== stampedVersion) return buildErrorResult(job, new UpgradePreconditionFailedError(documentId, `fromVersion ${fromVersion} does not match the document's version ${stampedVersion}`), startTime);
+			if (input.revision !== void 0) {
+				let actualRevisions;
+				try {
+					actualRevisions = (await stores.operationStore.getRevisions(documentId, job.branch, signal)).revision;
+				} catch (error) {
+					return buildErrorResult(job, /* @__PURE__ */ new Error(`Failed to fetch revisions for upgrade: ${error instanceof Error ? error.message : String(error)}`), startTime);
+				}
+				const revisionScopes = new Set([...Object.keys(input.revision), ...Object.keys(actualRevisions)]);
+				for (const revisionScope of revisionScopes) {
+					const snapshot = input.revision[revisionScope] ?? 0;
+					const actual = actualRevisions[revisionScope] ?? 0;
+					if (snapshot !== actual) return buildErrorResult(job, new UpgradePreconditionFailedError(documentId, `revision snapshot for scope "${revisionScope}" is ${snapshot} but the document is at ${actual}`), startTime);
+				}
+			}
+		}
+		let upgradePath;
+		if (fromVersion > 0 && fromVersion < toVersion) try {
+			upgradePath = this.registry.computeUpgradePath(document.header.documentType, fromVersion, toVersion);
+		} catch (error) {
+			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+		}
+		const otherScopes = Object.keys(document.state).filter((scope) => scope !== job.scope);
+		if (fromVersion > 0) for (const scope of otherScopes) {
+			let scopedDocument;
+			try {
+				scopedDocument = await stores.writeCache.getState(documentId, scope, job.branch, void 0, signal);
+			} catch (error) {
+				return buildErrorResult(job, /* @__PURE__ */ new Error(`Failed to fetch ${scope} scope for upgrade: ${error instanceof Error ? error.message : String(error)}`), startTime);
+			}
+			document = {
+				...document,
+				state: {
+					...document.state,
+					[scope]: scopedDocument.state[scope]
+				}
+			};
+		}
+		const nextIndex = getNextIndexForScope(document, job.scope);
 		try {
 			document = applyUpgradeDocumentAction$1(document, action, upgradePath);
 		} catch (error) {
@@ -1634,8 +2953,14 @@ var DocumentActionHandler = class {
 			header: document.header,
 			...document.state
 		};
+		if (fromVersion > 0) resultingStateObj.__migrated = true;
 		const resultingState = JSON.stringify(resultingStateObj);
-		const writeResult = await this.writeOperationToStore(documentId, document.header.documentType, job.scope, job.branch, operation, job, startTime, stores, signal);
+		const writeResult = await this.writeOperationToStore({
+			documentId,
+			documentType: document.header.documentType,
+			scope: job.scope,
+			branch: job.branch
+		}, operation, executing);
 		if (!Array.isArray(writeResult)) return writeResult;
 		operation = writeResult[0];
 		updateDocumentRevision(document, job.scope, operation.index);
@@ -1643,7 +2968,12 @@ var DocumentActionHandler = class {
 			...document.operations,
 			[job.scope]: [...document.operations[job.scope] ?? [], operation]
 		};
-		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document);
+		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, SnapshotPosition.Head);
+		for (const scope of otherScopes) executing.postCommitInvalidations.push({
+			documentId,
+			scope,
+			branch: job.branch
+		});
 		indexTxn.write([{
 			...operation,
 			documentId,
@@ -1659,8 +2989,8 @@ var DocumentActionHandler = class {
 		});
 		return buildSuccessResult(job, operation, documentId, document.header.documentType, resultingState, startTime);
 	}
-	executeAddRelationship(job, action, startTime, indexTxn, stores, sourceRemote = "", signal) {
-		return this.withRelationshipAction("ADD_RELATIONSHIP", job, action, startTime, indexTxn, stores, sourceRemote, signal, (input) => input.sourceId === input.targetId ? /* @__PURE__ */ new Error("ADD_RELATIONSHIP: sourceId and targetId cannot be the same (self-relationships not allowed)") : null, ({ indexTxn: txn, stores: s, sourceDoc, input, job: j }) => {
+	executeAddRelationship(write, executing) {
+		return this.withRelationshipAction("ADD_RELATIONSHIP", write, executing, (input) => input.sourceId === input.targetId ? /* @__PURE__ */ new Error("ADD_RELATIONSHIP: sourceId and targetId cannot be the same (self-relationships not allowed)") : null, ({ indexTxn: txn, stores: s, sourceDoc, input, job: j }) => {
 			if (this.driveContainerTypes.has(sourceDoc.header.documentType)) {
 				const collectionId = DriveCollectionId.forDrive(input.sourceId, j.branch).key;
 				txn.addToCollection(collectionId, input.targetId);
@@ -1668,8 +2998,8 @@ var DocumentActionHandler = class {
 			}
 		});
 	}
-	executeRemoveRelationship(job, action, startTime, indexTxn, stores, sourceRemote = "", signal) {
-		return this.withRelationshipAction("REMOVE_RELATIONSHIP", job, action, startTime, indexTxn, stores, sourceRemote, signal, null, ({ indexTxn: txn, stores: s, sourceDoc, input, job: j }) => {
+	executeRemoveRelationship(write, executing) {
+		return this.withRelationshipAction("REMOVE_RELATIONSHIP", write, executing, null, ({ indexTxn: txn, stores: s, sourceDoc, input, job: j }) => {
 			if (this.driveContainerTypes.has(sourceDoc.header.documentType)) {
 				const collectionId = DriveCollectionId.forDrive(input.sourceId, j.branch).key;
 				txn.removeFromCollection(collectionId, input.targetId);
@@ -1677,10 +3007,12 @@ var DocumentActionHandler = class {
 			}
 		});
 	}
-	executeUpdateRelationship(job, action, startTime, indexTxn, stores, sourceRemote = "", signal) {
-		return this.withRelationshipAction("UPDATE_RELATIONSHIP", job, action, startTime, indexTxn, stores, sourceRemote, signal, null, null);
+	executeUpdateRelationship(write, executing) {
+		return this.withRelationshipAction("UPDATE_RELATIONSHIP", write, executing, null, null);
 	}
-	async withRelationshipAction(actionTypeName, job, action, startTime, indexTxn, stores, sourceRemote, signal, preValidate, postWrite) {
+	async withRelationshipAction(actionTypeName, write, executing, preValidate, postWrite) {
+		const { action, skip, sourceRemote } = write;
+		const { job, startTime, indexTxn, stores, signal } = executing;
 		if (job.scope !== "document") return buildErrorResult(job, /* @__PURE__ */ new Error(`${actionTypeName} must be in "document" scope, got "${job.scope}"`), startTime);
 		const input = action.input;
 		if (!input.sourceId || !input.targetId || !input.relationshipType) return buildErrorResult(job, /* @__PURE__ */ new Error(`${actionTypeName} action requires sourceId, targetId, and relationshipType in input`), startTime);
@@ -1692,14 +3024,20 @@ var DocumentActionHandler = class {
 		try {
 			sourceDoc = await stores.writeCache.getState(input.sourceId, "document", job.branch, void 0, signal);
 		} catch (error) {
+			if (DocumentNotFoundError.isError(error)) return buildErrorResult(job, new DocumentNotFoundError(input.sourceId, `${actionTypeName}: source document ${input.sourceId} not found`), startTime);
 			return buildErrorResult(job, /* @__PURE__ */ new Error(`${actionTypeName}: source document ${input.sourceId} not found: ${error instanceof Error ? error.message : String(error)}`), startTime);
 		}
-		let operation = createOperation(action, getNextIndexForScope(sourceDoc, job.scope), 0, {
+		let operation = createOperation(action, getNextIndexForScope(sourceDoc, job.scope), skip, {
 			documentId: input.sourceId,
 			scope: job.scope,
 			branch: job.branch
 		});
-		const writeResult = await this.writeOperationToStore(input.sourceId, sourceDoc.header.documentType, job.scope, job.branch, operation, job, startTime, stores, signal);
+		const writeResult = await this.writeOperationToStore({
+			documentId: input.sourceId,
+			documentType: sourceDoc.header.documentType,
+			scope: job.scope,
+			branch: job.branch
+		}, operation, executing);
 		if (!Array.isArray(writeResult)) return writeResult;
 		operation = writeResult[0];
 		sourceDoc.header.lastModifiedAtUtcIso = operation.timestampUtcMs || (/* @__PURE__ */ new Date()).toISOString();
@@ -1714,7 +3052,7 @@ var DocumentActionHandler = class {
 			[job.scope]: scopeState === void 0 ? {} : structuredClone(scopeState)
 		};
 		const resultingState = JSON.stringify(resultingStateObj);
-		stores.writeCache.putState(input.sourceId, job.scope, job.branch, operation.index, sourceDoc);
+		stores.writeCache.putState(input.sourceId, job.scope, job.branch, operation.index, sourceDoc, SnapshotPosition.Head);
 		indexTxn.write([{
 			...operation,
 			documentId: input.sourceId,
@@ -1737,7 +3075,9 @@ var DocumentActionHandler = class {
 		});
 		return buildSuccessResult(job, operation, input.sourceId, sourceDoc.header.documentType, resultingState, startTime);
 	}
-	async writeOperationToStore(documentId, documentType, scope, branch, operation, job, startTime, stores, signal) {
+	async writeOperationToStore(target, operation, executing) {
+		const { documentId, documentType, scope, branch } = target;
+		const { job, startTime, stores, signal } = executing;
 		let storedOperations;
 		try {
 			storedOperations = await stores.operationStore.apply(documentId, documentType, scope, branch, operation.index, (txn) => {
@@ -1746,10 +3086,11 @@ var DocumentActionHandler = class {
 		} catch (error) {
 			this.logger.error("Error writing @Operation to IOperationStore: @Error", operation, error);
 			stores.writeCache.invalidate(documentId, scope, branch);
+			if (AppendConditionFailedError.isError(error)) for (const stream of error.condition.streams) stores.writeCache.invalidate(stream.documentId, stream.scope, stream.branch);
 			return {
 				job,
 				success: false,
-				error: /* @__PURE__ */ new Error(`Failed to write operation to IOperationStore: ${error instanceof Error ? error.message : String(error)}`),
+				error: AppendConditionFailedError.isError(error) ? error : /* @__PURE__ */ new Error(`Failed to write operation to IOperationStore: ${error instanceof Error ? error.message : String(error)}`),
 				duration: Date.now() - startTime
 			};
 		}
@@ -1814,19 +3155,13 @@ function isValidISOTimestamp(value) {
 	if (!ISO_TIMESTAMP_REGEX.test(value)) return false;
 	return !isNaN(new Date(value).getTime());
 }
-const documentScopeActions = [
-	"CREATE_DOCUMENT",
-	"DELETE_DOCUMENT",
-	"UPGRADE_DOCUMENT",
-	"ADD_RELATIONSHIP",
-	"REMOVE_RELATIONSHIP",
-	"UPDATE_RELATIONSHIP"
-];
 /**
 * Simple job executor that processes a job by applying actions through document model reducers.
 */
 var SimpleJobExecutor = class {
 	config;
+	featureFlags;
+	decisionModel;
 	signatureVerifierModule;
 	documentActionHandler;
 	executionScope;
@@ -1841,15 +3176,19 @@ var SimpleJobExecutor = class {
 		this.collectionMembershipCache = collectionMembershipCache;
 		this.driveContainerTypes = driveContainerTypes;
 		this.config = {
+			featureFlags: config.featureFlags ?? {},
 			maxSkipThreshold: config.maxSkipThreshold ?? MAX_SKIP_THRESHOLD,
 			maxConcurrency: config.maxConcurrency ?? 1,
 			jobTimeoutMs: config.jobTimeoutMs ?? 3e4,
+			deferredJobTtlMs: config.deferredJobTtlMs ?? 3e4,
 			retryBaseDelayMs: config.retryBaseDelayMs ?? 100,
 			retryMaxDelayMs: config.retryMaxDelayMs ?? 5e3,
 			yieldDeadlineMs: config.yieldDeadlineMs ?? 50
 		};
+		this.featureFlags = resolveFeatureFlags(config.featureFlags);
+		this.decisionModel = selectDecisionModel(this.featureFlags, registry);
 		this.signatureVerifierModule = new SignatureVerifier(signatureVerifier);
-		this.documentActionHandler = new DocumentActionHandler(registry, logger, driveContainerTypes);
+		this.documentActionHandler = new DocumentActionHandler(registry, logger, driveContainerTypes, this.featureFlags, this.decisionModel);
 		this.executionScope = executionScope ?? new DefaultExecutionScope(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache);
 	}
 	/**
@@ -1859,13 +3198,23 @@ var SimpleJobExecutor = class {
 	async executeJob(job, signal) {
 		const startTime = Date.now();
 		const touchedCacheEntries = [];
+		const postCommitInvalidations = [];
 		let pendingEvent;
 		let result;
 		try {
 			result = await this.executionScope.run(async (stores) => {
 				const indexTxn = stores.operationIndex.start();
 				if (job.kind === "load") {
-					const loadResult = await this.executeLoadJob(job, startTime, indexTxn, stores, signal);
+					const loadResult = await this.executeLoadJob({
+						job,
+						startTime,
+						indexTxn,
+						stores,
+						signal,
+						replayingAcceptedHistory: true,
+						evaluatedByPosition: false,
+						postCommitInvalidations
+					});
 					if (loadResult.success && loadResult.operationsWithContext) {
 						for (const owc of loadResult.operationsWithContext) touchedCacheEntries.push({
 							documentId: owc.context.documentId,
@@ -1884,7 +3233,50 @@ var SimpleJobExecutor = class {
 					}
 					return loadResult;
 				}
-				const actionResult = await this.processActions(job, job.actions, startTime, indexTxn, stores, void 0, void 0, "", signal);
+				if (job.kind === "reevaluation") {
+					const reevalResult = await this.executeReevaluationJob({
+						job,
+						startTime,
+						indexTxn,
+						stores,
+						signal,
+						replayingAcceptedHistory: false,
+						evaluatedByPosition: false,
+						postCommitInvalidations
+					});
+					if (reevalResult.success && reevalResult.operationsWithContext) {
+						for (const owc of reevalResult.operationsWithContext) touchedCacheEntries.push({
+							documentId: owc.context.documentId,
+							scope: owc.context.scope,
+							branch: owc.context.branch
+						});
+						const ordinals = await stores.operationIndex.commit(indexTxn, signal);
+						for (let i = 0; i < reevalResult.operationsWithContext.length; i++) reevalResult.operationsWithContext[i].context.ordinal = ordinals[i];
+						if (reevalResult.operationsWithContext.length > 0) {
+							const collectionMemberships = await this.getCollectionMembershipsForOperations(reevalResult.operationsWithContext, stores);
+							pendingEvent = {
+								jobId: job.id,
+								operations: reevalResult.operationsWithContext,
+								jobMeta: job.meta,
+								collectionMemberships
+							};
+						}
+					}
+					return reevalResult;
+				}
+				const positioned = await this.positionByTimestamp(job, stores, signal);
+				if (positioned.error) return buildErrorResult(job, positioned.error, startTime);
+				const executing = {
+					job,
+					startTime,
+					indexTxn,
+					stores,
+					signal,
+					replayingAcceptedHistory: false,
+					evaluatedByPosition: positioned.evaluatedByPosition,
+					postCommitInvalidations
+				};
+				const actionResult = await this.processActions(positioned.writes, executing);
 				if (!actionResult.success) return {
 					job,
 					success: false,
@@ -1896,6 +3288,16 @@ var SimpleJobExecutor = class {
 					scope: owc.context.scope,
 					branch: owc.context.branch
 				});
+				const reevaluationError = await this.reevaluateIfCriteriaMet({
+					scope: job.scope,
+					operations: actionResult.generatedOperations
+				}, executing);
+				if (reevaluationError) return {
+					job,
+					success: false,
+					error: reevaluationError,
+					duration: Date.now() - startTime
+				};
 				const ordinals = await stores.operationIndex.commit(indexTxn, signal);
 				if (actionResult.operationsWithContext.length > 0) {
 					for (let i = 0; i < actionResult.operationsWithContext.length; i++) actionResult.operationsWithContext[i].context.ordinal = ordinals[i];
@@ -1922,6 +3324,7 @@ var SimpleJobExecutor = class {
 			}
 			throw error;
 		}
+		if (result.success) for (const entry of postCommitInvalidations) this.writeCache.invalidate(entry.documentId, entry.scope, entry.branch);
 		if (pendingEvent) this.eventBus.emit(ReactorEventTypes.JOB_WRITE_READY, pendingEvent).catch((error) => {
 			this.logger.error("Failed to emit JOB_WRITE_READY event: @Event : @Error", pendingEvent, error);
 		});
@@ -1931,7 +3334,9 @@ var SimpleJobExecutor = class {
 		const documentIds = [...new Set(operations.map((op) => op.context.documentId))];
 		return stores.collectionMembershipCache.getCollectionsForDocuments(documentIds);
 	}
-	async processActions(job, actions, startTime, indexTxn, stores, skipValues, sourceOperations, sourceRemote = "", signal) {
+	async processActions(writes, executing) {
+		const { job, signal } = executing;
+		const actions = writes.map((write) => write.action);
 		const generatedOperations = [];
 		const operationsWithContext = [];
 		try {
@@ -1948,14 +3353,11 @@ var SimpleJobExecutor = class {
 			success: false,
 			generatedOperations,
 			operationsWithContext,
-			error: /* @__PURE__ */ new Error(`Invalid timestamp "${action.timestampUtcMs}" on action ${action.type} (id: ${action.id})`)
+			error: new InvalidOperationTimestampError(job.documentId, action.scope, action.timestampUtcMs, `action ${action.type} (id: ${action.id})`)
 		};
 		let lastYield = performance.now();
-		for (let actionIndex = 0; actionIndex < actions.length; actionIndex++) {
-			const action = actions[actionIndex];
-			const skip = skipValues?.[actionIndex] ?? 0;
-			const sourceOperation = sourceOperations?.[actionIndex];
-			const result = documentScopeActions.includes(action.type) ? await this.documentActionHandler.execute(job, action, startTime, indexTxn, stores, skip, sourceRemote, signal) : await this.executeRegularAction(job, action, startTime, indexTxn, stores, skip, sourceOperation, sourceRemote, signal);
+		for (const write of writes) {
+			const result = DOCUMENT_SCOPE_ACTIONS.has(write.action.type) ? await this.documentActionHandler.execute(write, executing) : await this.executeRegularAction(write, executing);
 			const error = this.accumulateResultOrReturnError(result, generatedOperations, operationsWithContext);
 			if (error !== null) return {
 				success: false,
@@ -1980,14 +3382,44 @@ var SimpleJobExecutor = class {
 			operationsWithContext
 		};
 	}
-	async executeRegularAction(job, action, startTime, indexTxn, stores, skip = 0, sourceOperation, sourceRemote = "", signal) {
-		let docMeta;
-		try {
-			docMeta = await stores.documentMetaCache.getDocumentMeta(job.documentId, job.branch, signal);
-		} catch (error) {
-			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+	async executeRegularAction(write, executing) {
+		const { action, skip, sourceOperation, sourceRemote, deniedReason } = write;
+		const { job, startTime, indexTxn, stores, signal } = executing;
+		let appendCondition;
+		let documentVersion;
+		const alreadyEvaluated = this.featureFlags.documentDecisions && (executing.replayingAcceptedHistory || executing.evaluatedByPosition);
+		if (this.featureFlags.documentDecisions && !alreadyEvaluated) {
+			const target = {
+				documentId: job.documentId,
+				branch: job.branch
+			};
+			let admission;
+			try {
+				admission = await decideAtHead(this.decisionModel, stores.writeCache, target, {
+					address: action.context?.signer?.user.address,
+					key: action.context?.signer?.app.key
+				}, {
+					verb: "execute",
+					scope: action.scope,
+					operation: action.type
+				}, signal, this.featureFlags.authConditions ? { actionInput: action.input } : void 0);
+			} catch (error) {
+				return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+			}
+			if (admission.evaluation.decision === "deny") return buildErrorResult(job, refusalError(admission.evaluation.reason, job.documentId, admission.deletedAtUtcIso, action), startTime);
+			appendCondition = admission.appendCondition;
+			documentVersion = admission.documentVersion;
+		} else if (alreadyEvaluated) documentVersion = (await stores.writeCache.getState(job.documentId, "document", job.branch, void 0, signal)).state.document.version;
+		else {
+			let docMeta;
+			try {
+				docMeta = await stores.documentMetaCache.getDocumentMeta(job.documentId, job.branch, signal);
+			} catch (error) {
+				return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+			}
+			if (docMeta.state.isDeleted) return buildErrorResult(job, new DocumentDeletedError(job.documentId, docMeta.state.deletedAtUtcIso), startTime);
+			documentVersion = docMeta.state.version;
 		}
-		if (docMeta.state.isDeleted) return buildErrorResult(job, new DocumentDeletedError(job.documentId, docMeta.state.deletedAtUtcIso), startTime);
 		if (isUndoRedo(action) || action.type === "PRUNE" || action.type === "NOOP" && skip > 0) stores.writeCache.invalidate(job.documentId, job.scope, job.branch);
 		let document;
 		try {
@@ -1995,16 +3427,48 @@ var SimpleJobExecutor = class {
 		} catch (error) {
 			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
 		}
+		if (!this.featureFlags.authEnforcement && !executing.replayingAcceptedHistory) {
+			const subject = {
+				address: write.action.context?.signer?.user.address,
+				key: write.action.context?.signer?.app.key
+			};
+			if (decide(document.state.auth, subject, {
+				verb: "execute",
+				scope: action.scope,
+				operation: action.type
+			}) === "deny") return buildErrorResult(job, new AuthorizationDeniedError(job.documentId, action.scope, action.type, subject.address), startTime);
+		}
 		let module;
 		try {
-			const moduleVersion = docMeta.state.version === 0 ? void 0 : docMeta.state.version;
-			module = this.registry.getModule(document.header.documentType, moduleVersion);
+			module = this.registry.getModule(document.header.documentType, normalizeDocumentModelVersion(documentVersion));
 		} catch (error) {
 			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
 		}
 		let updatedDocument;
-		try {
-			const protocolVersion = document.header.protocolVersions?.["base-reducer"] ?? 1;
+		if (deniedReason !== void 0) {
+			const index = getNextIndexForScope(document, job.scope);
+			const denied = createOperation(action, index, skip, {
+				documentId: job.documentId,
+				scope: job.scope,
+				branch: job.branch
+			});
+			denied.deniedReason = deniedReason;
+			let standing = document;
+			if (skip > 0) try {
+				standing = await stores.writeCache.getState(job.documentId, job.scope, job.branch, index - skip - 1, signal);
+			} catch (error) {
+				return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+			}
+			denied.hash = hashDocumentStateForScope(standing, job.scope);
+			updatedDocument = {
+				...standing,
+				operations: {
+					...standing.operations,
+					[job.scope]: [...standing.operations[job.scope] ?? [], denied]
+				}
+			};
+		} else try {
+			const protocolVersion = baseReducerVersion(document.header);
 			const reducerOptions = sourceOperation ? {
 				skip,
 				branch: job.branch,
@@ -2035,14 +3499,15 @@ var SimpleJobExecutor = class {
 		try {
 			storedOperations = await stores.operationStore.apply(job.documentId, document.header.documentType, scope, job.branch, newOperation.index, (txn) => {
 				txn.addOperations(newOperation);
-			}, signal);
+			}, signal, appendCondition);
 		} catch (error) {
 			this.logger.error("Error writing @Operation to IOperationStore: @Error", newOperation, error);
 			stores.writeCache.invalidate(job.documentId, scope, job.branch);
+			if (AppendConditionFailedError.isError(error)) for (const stream of error.condition.streams) stores.writeCache.invalidate(stream.documentId, stream.scope, stream.branch);
 			return {
 				job,
 				success: false,
-				error: /* @__PURE__ */ new Error(`Failed to write operation to IOperationStore: ${error instanceof Error ? error.message : String(error)}`),
+				error: AppendConditionFailedError.isError(error) ? error : /* @__PURE__ */ new Error(`Failed to write operation to IOperationStore: ${error instanceof Error ? error.message : String(error)}`),
 				duration: Date.now() - startTime
 			};
 		}
@@ -2051,7 +3516,7 @@ var SimpleJobExecutor = class {
 			...updatedDocument.header.revision,
 			[scope]: storedOperation.index + 1
 		};
-		stores.writeCache.putState(job.documentId, scope, job.branch, storedOperation.index, updatedDocument);
+		stores.writeCache.putState(job.documentId, scope, job.branch, storedOperation.index, updatedDocument, SnapshotPosition.Head);
 		indexTxn.write([{
 			...storedOperation,
 			documentId: job.documentId,
@@ -2060,6 +3525,7 @@ var SimpleJobExecutor = class {
 			scope,
 			sourceRemote
 		}]);
+		if (scope === "auth") indexTxn.recordGroupReferences(job.documentId, mentionedGroupIds(action));
 		return {
 			job,
 			success: true,
@@ -2078,14 +3544,291 @@ var SimpleJobExecutor = class {
 			duration: Date.now() - startTime
 		};
 	}
-	async executeLoadJob(job, startTime, indexTxn, stores, signal) {
+	/**
+	* Orders a write by timestamp and decides it where it lands. The caller
+	* supplies the timestamp, so a write can belong before operations already
+	* stored; those are re-appended alongside it, the way a load reshuffles.
+	*
+	* Deciding a backdated write at the stream heads instead of at its position
+	* would overwrite the verdict every other replica computes for it.
+	*/
+	async positionByTimestamp(job, stores, signal) {
+		const plain = () => ({
+			writes: job.actions.map((action) => ({
+				action,
+				skip: 0,
+				sourceRemote: ""
+			})),
+			evaluatedByPosition: false
+		});
+		if (!this.featureFlags.documentDecisions || job.actions.length === 0) return plain();
+		let earliest = job.actions[0].timestampUtcMs;
+		let earliestAt = Date.parse(earliest);
+		for (const action of job.actions) {
+			const at = Date.parse(action.timestampUtcMs);
+			if (at < earliestAt) {
+				earliest = action.timestampUtcMs;
+				earliestAt = at;
+			}
+		}
+		const revisions = await stores.operationStore.getRevisions(job.documentId, job.branch, signal);
+		const backdated = earliestAt < Date.parse(revisions.latestTimestamp);
+		if (this.featureFlags.authEnforcement && job.scope === "auth") {
+			const newest = await stores.operationStore.getStreamLatestTimestamp(job.documentId, "auth", job.branch, signal);
+			const violation = this.firstNonMonotonicTimestamp(job.actions, newest, job.documentId, job.branch);
+			if (violation) return {
+				writes: [],
+				evaluatedByPosition: false,
+				error: violation
+			};
+			if (!backdated) return plain();
+			return this.evaluatePositioned(job, stores, this.appendedOperations(job, revisions.revision[job.scope] ?? 0), signal);
+		}
+		if (!backdated) return plain();
+		const conflicting = (await stores.operationStore.getConflicting(job.documentId, job.scope, job.branch, earliest, void 0, signal)).results.filter((operation) => !isGenesisOperation(operation));
+		if (conflicting.length === 0) {
+			if (!this.featureFlags.authEnforcement) return plain();
+			return this.evaluatePositioned(job, stores, this.appendedOperations(job, revisions.revision[job.scope] ?? 0), signal);
+		}
+		const nextIndex = revisions.revision[job.scope] ?? 0;
+		let firstConflicting = conflicting[0].index;
+		for (const operation of conflicting) if (operation.index < firstConflicting) firstConflicting = operation.index;
+		const incoming = job.actions.map((action, i) => ({
+			id: action.id,
+			index: nextIndex + i,
+			skip: 0,
+			hash: "",
+			timestampUtcMs: action.timestampUtcMs,
+			action
+		}));
+		const merged = reshuffleByTimestamp({
+			index: nextIndex,
+			skip: retractionSkip(nextIndex, firstConflicting)
+		}, conflicting, incoming);
+		stores.writeCache.invalidate(job.documentId, job.scope, job.branch);
+		if (!this.featureFlags.authEnforcement) return {
+			writes: merged.map((operation) => ({
+				action: operation.action,
+				skip: operation.skip,
+				sourceRemote: ""
+			})),
+			evaluatedByPosition: false
+		};
+		return this.evaluatePositioned(job, stores, merged, signal);
+	}
+	/**
+	* Decides each operation where it lands and carries the verdict on it. A
+	* refused submitted action is reported to the caller and nothing is stored; a
+	* refused operation the reshuffle merely moved keeps its verdict, because it
+	* already holds a position.
+	*
+	* The operations carry the indexes and skips they will be stored at, because
+	* the walk resolves skips before it orders them.
+	*/
+	async evaluatePositioned(job, stores, operations, signal) {
+		const reasons = await evaluateByPosition(this.decisionModel, {
+			documentId: job.documentId,
+			branch: job.branch
+		}, {
+			scope: job.scope,
+			operations
+		}, stores, signal);
+		const submitted = new Set(job.actions.map((action) => action.id));
+		for (let i = 0; i < operations.length; i++) {
+			const reason = reasons[i];
+			if (reason !== void 0 && submitted.has(operations[i].action.id)) return {
+				writes: [],
+				evaluatedByPosition: false,
+				error: refusalError(reason, job.documentId, null, operations[i].action)
+			};
+		}
+		return {
+			writes: operations.map((operation, i) => ({
+				action: operation.action,
+				skip: operation.skip,
+				sourceRemote: "",
+				deniedReason: reasons[i]
+			})),
+			evaluatedByPosition: true
+		};
+	}
+	/**
+	* The scopes a re-evaluation pass visits, in a fixed order.
+	*
+	* The revisions map comes from a query with no ORDER BY, and the order is
+	* load-bearing: each scope's pass re-reads the auth stream, and the walk skips
+	* an operation by its stored denial, so a denial this pass just wrote is
+	* visible to a later-visited scope and invisible to an earlier one. The model's
+	* own projection order leads, then the rest sorted, so the pass is reproducible
+	* across replicas and across runs.
+	*/
+	evaluationOrder(target, revision) {
+		const definition = this.decisionModel(target);
+		const evaluated = Object.keys(revision).filter((scope) => definition.evaluatesScope(scope));
+		const leading = [];
+		for (const stream of staticReadSet(definition)) {
+			const scope = stream.query.scope;
+			if (evaluated.includes(scope) && !leading.includes(scope)) leading.push(scope);
+		}
+		const rest = evaluated.filter((scope) => !leading.includes(scope)).sort((a, b) => a.localeCompare(b));
+		return [...leading, ...rest];
+	}
+	/**
+	* The first timestamp in the batch that does not strictly exceed everything
+	* ahead of it, or undefined when the whole batch is monotonic.
+	*
+	* The bound is carried forward rather than compared against one stored maximum,
+	* because a single execute can carry several auth actions stamped in the same
+	* millisecond. Letting a tie through would store a stream the position walk
+	* then refuses to read, with no repair path.
+	*/
+	firstNonMonotonicTimestamp(entries, newest, documentId, branch) {
+		let boundIso = newest;
+		let bound = newest === void 0 ? Number.NEGATIVE_INFINITY : Date.parse(newest);
+		for (const entry of entries) {
+			if (!isValidISOTimestamp(entry.timestampUtcMs)) return new InvalidOperationTimestampError(documentId, "auth", entry.timestampUtcMs, "auth operation");
+			const at = Date.parse(entry.timestampUtcMs);
+			if (boundIso !== void 0 && at <= bound) return new AuthTimestampNotMonotonicError(documentId, branch, entry.timestampUtcMs, boundIso);
+			bound = at;
+			boundIso = entry.timestampUtcMs;
+		}
+	}
+	/** The operations a batch of submitted actions appends at the scope's tail. */
+	appendedOperations(job, nextIndex) {
+		return job.actions.map((action, i) => ({
+			id: action.id,
+			index: nextIndex + i,
+			skip: 0,
+			hash: "",
+			timestampUtcMs: action.timestampUtcMs,
+			action
+		}));
+	}
+	/**
+	* Re-evaluates the document when a write meets both criteria: it was written
+	* to a stream the model reads, and it is timestamped before an operation
+	* already stored. The caller supplies the timestamp and the reactor does not replace
+	* it, so a mutation job can write such an operation just as a load job can,
+	* which is why both executeJob and executeLoadJob call this.
+	*/
+	async reevaluateIfCriteriaMet(criteria, executing) {
+		if (!this.featureFlags.documentDecisions) return;
+		const { job, stores, signal } = executing;
+		const target = {
+			documentId: job.documentId,
+			branch: job.branch
+		};
+		if (!staticReadSet(this.decisionModel(target)).some((stream) => stream.query.documentId === job.documentId && stream.query.scope === criteria.scope && stream.query.branch === job.branch)) return;
+		const revisions = await stores.operationStore.getRevisions(job.documentId, job.branch, signal);
+		const latest = Date.parse(revisions.latestTimestamp);
+		if (!criteria.operations.some((operation) => Date.parse(operation.timestampUtcMs) < latest)) return;
+		return (await this.reevaluateDocument(executing)).error;
+	}
+	/**
+	* Re-evaluates every scope the model evaluates. Where an operation's
+	* evaluation differs from what is stored, the tail from that operation is
+	* re-appended, carrying a skip that spans the indices it supersedes.
+	*/
+	async reevaluateDocument(executing) {
+		const { job, stores, signal } = executing;
+		const target = {
+			documentId: job.documentId,
+			branch: job.branch
+		};
+		const reappended = [];
+		const revisions = await stores.operationStore.getRevisions(job.documentId, job.branch, signal);
+		for (const scope of this.evaluationOrder(target, revisions.revision)) {
+			const stored = (await stores.operationStore.getSince(job.documentId, scope, job.branch, -1, void 0, void 0, signal)).results;
+			const effective = garbageCollect(sortOperations([...stored]));
+			if (effective.length === 0) continue;
+			const reevaluated = await evaluateByPosition(this.decisionModel, target, {
+				scope,
+				operations: effective
+			}, stores, signal);
+			const firstChange = effective.findIndex((operation, i) => operation.deniedReason !== reevaluated[i]);
+			if (firstChange === -1) continue;
+			const tail = effective.slice(firstChange);
+			const nextIndex = revisions.revision[scope];
+			stores.writeCache.invalidate(job.documentId, scope, job.branch);
+			const result = await this.processActions(tail.map((operation, i) => ({
+				action: operation.action,
+				skip: i === 0 ? retractionSkip(nextIndex, tail[0].index) : 0,
+				sourceRemote: "",
+				deniedReason: reevaluated[firstChange + i]
+			})), {
+				...executing,
+				job: {
+					...job,
+					scope
+				},
+				replayingAcceptedHistory: true,
+				evaluatedByPosition: true
+			});
+			if (!result.success) return {
+				error: result.error ?? /* @__PURE__ */ new Error(`Re-evaluation of ${job.documentId} ${scope} failed`),
+				operationsWithContext: reappended
+			};
+			reappended.push(...result.operationsWithContext);
+		}
+		return { operationsWithContext: reappended };
+	}
+	/**
+	* Re-judges a document's stored operations because a read-set stream in
+	* another document (a group) gained an operation. The trigger timestamp
+	* bounds the work: an operation later than everything this document holds
+	* cannot change any evaluation, so the pass is skipped.
+	*/
+	async executeReevaluationJob(executing) {
+		const { job, startTime, stores, signal } = executing;
+		if (!this.featureFlags.documentDecisions) return {
+			job,
+			success: true,
+			operations: [],
+			operationsWithContext: [],
+			duration: Date.now() - startTime
+		};
+		const trigger = job.meta.triggerTimestampUtcMs;
+		if (typeof trigger === "string") {
+			let latestTimestamp;
+			try {
+				latestTimestamp = (await stores.operationStore.getRevisions(job.documentId, job.branch, signal)).latestTimestamp;
+			} catch {
+				return {
+					job,
+					success: true,
+					operations: [],
+					operationsWithContext: [],
+					duration: Date.now() - startTime
+				};
+			}
+			if (Date.parse(trigger) > Date.parse(latestTimestamp)) return {
+				job,
+				success: true,
+				operations: [],
+				operationsWithContext: [],
+				duration: Date.now() - startTime
+			};
+		}
+		const outcome = await this.reevaluateDocument(executing);
+		if (outcome.error) return buildErrorResult(job, outcome.error, startTime);
+		return {
+			job,
+			success: true,
+			operations: outcome.operationsWithContext.map((owc) => owc.operation),
+			operationsWithContext: outcome.operationsWithContext,
+			duration: Date.now() - startTime
+		};
+	}
+	async executeLoadJob(executing) {
+		const { job, startTime, indexTxn, stores, signal } = executing;
 		if (job.operations.length === 0) return buildErrorResult(job, /* @__PURE__ */ new Error("Load job must include at least one operation"), startTime);
 		let docMeta;
 		try {
 			docMeta = await stores.documentMetaCache.getDocumentMeta(job.documentId, job.branch, signal);
 		} catch {}
-		if (docMeta?.state.isDeleted) return buildErrorResult(job, new DocumentDeletedError(job.documentId, docMeta.state.deletedAtUtcIso), startTime);
+		if (docMeta?.state.isDeleted && !this.featureFlags.documentDecisions) return buildErrorResult(job, new DocumentDeletedError(job.documentId, docMeta.state.deletedAtUtcIso), startTime);
 		const scope = job.scope;
+		const monotonicAuthStream = this.featureFlags.authEnforcement && scope === "auth";
 		let latestRevision;
 		try {
 			latestRevision = (await stores.operationStore.getRevisions(job.documentId, job.branch, signal)).revision[scope] ?? 0;
@@ -2095,7 +3838,7 @@ var SimpleJobExecutor = class {
 		for (const operation of job.operations) if (operation.timestampUtcMs && !isValidISOTimestamp(operation.timestampUtcMs)) return {
 			job,
 			success: false,
-			error: /* @__PURE__ */ new Error(`Invalid timestamp "${operation.timestampUtcMs}" on operation (index: ${operation.index})`),
+			error: new InvalidOperationTimestampError(job.documentId, scope, operation.timestampUtcMs, `operation (index: ${operation.index})`),
 			duration: Date.now() - startTime
 		};
 		let minIncomingIndex = Number.POSITIVE_INFINITY;
@@ -2103,7 +3846,7 @@ var SimpleJobExecutor = class {
 		for (const operation of job.operations) {
 			minIncomingIndex = Math.min(minIncomingIndex, operation.index);
 			const ts = operation.timestampUtcMs || "";
-			if (ts < minIncomingTimestamp) minIncomingTimestamp = ts;
+			if (Date.parse(ts) < Date.parse(minIncomingTimestamp)) minIncomingTimestamp = ts;
 		}
 		let conflictingOps;
 		try {
@@ -2128,11 +3871,14 @@ var SimpleJobExecutor = class {
 			}
 			return true;
 		});
-		const existingOpsToReshuffle = nonSupersededOps;
-		if (existingOpsToReshuffle.length > this.config.maxSkipThreshold) return {
+		const existingOpsToReshuffle = monotonicAuthStream ? [] : nonSupersededOps.filter((operation) => !isGenesisOperation(operation));
+		const actionIdCounts = /* @__PURE__ */ new Map();
+		for (const operation of allOpsFromMinConflictingIndex) actionIdCounts.set(operation.action.id, (actionIdCounts.get(operation.action.id) ?? 0) + 1);
+		const reshuffleCost = existingOpsToReshuffle.filter((operation) => (actionIdCounts.get(operation.action.id) ?? 0) < 2).length;
+		if (reshuffleCost > this.config.maxSkipThreshold) return {
 			job,
 			success: false,
-			error: /* @__PURE__ */ new Error(`Excessive reshuffle detected: existing op count of ${existingOpsToReshuffle.length} exceeds threshold of ${this.config.maxSkipThreshold}. This indicates a significant divergence between local and incoming operations.`),
+			error: new ExcessiveReshuffleError(job.documentId, scope, reshuffleCost, this.config.maxSkipThreshold),
 			duration: Date.now() - startTime
 		};
 		let skipCount = existingOpsToReshuffle.length;
@@ -2160,6 +3906,16 @@ var SimpleJobExecutor = class {
 			operationsWithContext: [],
 			duration: Date.now() - startTime
 		};
+		if (monotonicAuthStream) {
+			const newest = await stores.operationStore.getStreamLatestTimestamp(job.documentId, "auth", job.branch, signal);
+			const violation = this.firstNonMonotonicTimestamp([...incomingOpsToApply].sort((a, b) => a.index - b.index), newest, job.documentId, job.branch);
+			if (violation) return {
+				job,
+				success: false,
+				error: violation,
+				duration: Date.now() - startTime
+			};
+		}
 		const reshuffledOperations = existingOpsToReshuffle.length === 0 && skipCount === 0 ? incomingOpsToApply.slice().sort((a, b) => a.index - b.index).map((operation, i) => ({
 			...operation,
 			index: latestRevision + i
@@ -2171,10 +3927,31 @@ var SimpleJobExecutor = class {
 			id: operation.id
 		})));
 		for (const operation of reshuffledOperations) if (operation.action.type === "NOOP") operation.skip = 1;
-		const actions = reshuffledOperations.map((operation) => operation.action);
-		const skipValues = reshuffledOperations.map((operation) => operation.skip);
+		let deniedReasons;
+		if (this.featureFlags.documentDecisions) try {
+			deniedReasons = await evaluateByPosition(this.decisionModel, {
+				documentId: job.documentId,
+				branch: job.branch
+			}, {
+				scope,
+				operations: reshuffledOperations
+			}, stores, signal);
+		} catch (error) {
+			return {
+				job,
+				success: false,
+				error: error instanceof Error ? error : new Error(String(error)),
+				duration: Date.now() - startTime
+			};
+		}
 		const effectiveSourceRemote = skipCount > 0 ? "" : job.meta.sourceRemote || "";
-		const result = await this.processActions(job, actions, startTime, indexTxn, stores, skipValues, reshuffledOperations, effectiveSourceRemote, signal);
+		const result = await this.processActions(reshuffledOperations.map((operation, i) => ({
+			action: operation.action,
+			skip: operation.skip,
+			sourceOperation: operation,
+			sourceRemote: effectiveSourceRemote,
+			deniedReason: deniedReasons?.[i]
+		})), executing);
 		if (!result.success) return {
 			job,
 			success: false,
@@ -2183,6 +3960,16 @@ var SimpleJobExecutor = class {
 		};
 		stores.writeCache.invalidate(job.documentId, scope, job.branch);
 		if (scope === "document") stores.documentMetaCache.invalidate(job.documentId, job.branch);
+		const reevaluationError = await this.reevaluateIfCriteriaMet({
+			scope,
+			operations: result.generatedOperations
+		}, executing);
+		if (reevaluationError) return {
+			job,
+			success: false,
+			error: reevaluationError,
+			duration: Date.now() - startTime
+		};
 		return {
 			job,
 			success: true,
@@ -2315,7 +4102,7 @@ var DocumentModelRegistry = class {
 	}
 	computeUpgradePath(documentType, fromVersion, toVersion) {
 		if (fromVersion === toVersion) return [];
-		if (toVersion < fromVersion) throw new DowngradeNotSupportedError(documentType, fromVersion, toVersion);
+		if (toVersion < fromVersion) throw new DowngradeNotSupportedError$1(documentType, fromVersion, toVersion);
 		const manifest = this.getUpgradeManifest(documentType);
 		const path = [];
 		for (let v = fromVersion + 1; v <= toVersion; v++) {
@@ -2419,36 +4206,6 @@ function paginateRows(rows, paging, cursorOf, toItem, refetch) {
 	};
 }
 //#endregion
-//#region src/storage/interfaces.ts
-/**
-* Thrown when an operation with the same identity already exists in the store.
-*/
-var DuplicateOperationError = class extends Error {
-	constructor(description) {
-		super(`Duplicate operation: ${description}`);
-		this.name = "DuplicateOperationError";
-	}
-};
-/**
-* Thrown when a concurrent write conflict is detected during an atomic apply.
-*/
-var OptimisticLockError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "OptimisticLockError";
-	}
-};
-/**
-* Thrown when the caller-provided revision does not match the current
-* stored revision, indicating a stale read.
-*/
-var RevisionMismatchError = class extends Error {
-	constructor(expected, actual) {
-		super(`Revision mismatch: expected ${expected}, got ${actual}`);
-		this.name = "RevisionMismatchError";
-	}
-};
-//#endregion
 //#region src/storage/txn.ts
 var AtomicTransaction = class {
 	operations = [];
@@ -2473,6 +4230,7 @@ var AtomicTransaction = class {
 			action: JSON.stringify(op.action),
 			skip: op.skip,
 			error: op.error || null,
+			deniedReason: op.deniedReason || null,
 			hash: op.hash
 		});
 	}
@@ -2506,12 +4264,12 @@ var KyselyOperationStore = class KyselyOperationStore {
 		instance.trx = trx;
 		return instance;
 	}
-	async apply(documentId, documentType, scope, branch, revision, fn, signal) {
+	async apply(documentId, documentType, scope, branch, revision, fn, signal, condition) {
 		if (this.trx) {
 			let executeResult = null;
 			let uniqueCtx = null;
 			try {
-				executeResult = await this.executeApply(this.trx, documentId, documentType, scope, branch, revision, fn, signal);
+				executeResult = await this.executeApply(this.trx, documentId, documentType, scope, branch, revision, fn, signal, condition);
 			} catch (error) {
 				if (error instanceof _UniqueConstraintContext) uniqueCtx = error;
 				else throw error;
@@ -2523,7 +4281,7 @@ var KyselyOperationStore = class KyselyOperationStore {
 			let uniqueCtx = null;
 			try {
 				transactionResult = await this.db.transaction().execute(async (trx) => {
-					return this.executeApply(trx, documentId, documentType, scope, branch, revision, fn, signal);
+					return this.executeApply(trx, documentId, documentType, scope, branch, revision, fn, signal, condition);
 				});
 			} catch (error) {
 				if (error instanceof _UniqueConstraintContext) uniqueCtx = error;
@@ -2542,12 +4300,13 @@ var KyselyOperationStore = class KyselyOperationStore {
 		const op = ctx.stagedOps[0];
 		throw new DuplicateOperationError(`${op.opId} at index ${op.index} with skip ${op.skip}`);
 	}
-	async executeApply(trx, documentId, documentType, scope, branch, revision, fn, signal) {
+	async executeApply(trx, documentId, documentType, scope, branch, revision, fn, signal, condition) {
 		throwIfAborted(signal);
 		const atomicTxn = new AtomicTransaction(documentId, documentType, scope, branch, revision);
 		await fn(atomicTxn);
 		const operations = atomicTxn.getOperations();
 		if (operations.length === 0) return [];
+		if (condition) await this.acquireStreamLocks(trx, documentId, scope, branch, condition);
 		const latestOp = await trx.selectFrom("Operation").selectAll().where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).orderBy("index", "desc").limit(1).executeTakeFirst();
 		const currentRevision = latestOp ? latestOp.index : -1;
 		if (currentRevision !== revision - 1) {
@@ -2563,22 +4322,91 @@ var KyselyOperationStore = class KyselyOperationStore {
 			op.prevOpId = prevOpId;
 			prevOpId = op.opId;
 		}
+		let insertedCount = operations.length;
 		try {
-			await trx.insertInto("Operation").values(operations).execute();
+			if (condition && condition.streams.length > 0) insertedCount = await this.insertGuarded(trx, operations, condition);
+			else await trx.insertInto("Operation").values(operations).execute();
 		} catch (error) {
 			if (error instanceof Error && error.message.includes("unique constraint")) throw new _UniqueConstraintContext(documentId, scope, branch, revision, operations);
 			throw error;
 		}
+		if (insertedCount !== operations.length) throw new AppendConditionFailedError(condition);
 		return operations.map((op) => ({
 			index: op.index,
 			timestampUtcMs: op.timestampUtcMs.toISOString(),
 			hash: op.hash,
 			skip: op.skip,
 			error: op.error || void 0,
+			deniedReason: op.deniedReason || void 0,
 			id: op.opId,
 			action: JSON.parse(op.action)
 		}));
 	}
+	/**
+	* Locks the written stream and every read-set stream, in sorted key order
+	* so that overlapping concurrent appends serialize rather than deadlock.
+	* The locks are still taken one row at a time, so the query preserves that
+	* order. It must stay separate from the guarded insert, which would
+	* otherwise read a snapshot taken before the locks were held.
+	*/
+	async acquireStreamLocks(trx, documentId, scope, branch, condition) {
+		const keys = new Set([`${documentId}:${scope}:${branch}`]);
+		for (const stream of condition.streams) keys.add(`${stream.documentId}:${stream.scope}:${stream.branch}`);
+		await sql`
+      with ordered as materialized (
+        select key
+        from unnest(array[${sql.join([...keys].sort())}]::text[]) with ordinality as t(key, ord)
+        order by ord
+      )
+      select pg_advisory_xact_lock(hashtext(key)) from ordered
+    `.execute(trx);
+	}
+	/**
+	* Inserts the staged operations with the condition compiled in as a WHERE
+	* NOT EXISTS guard, making the check and the append one statement. Returns
+	* the rows inserted; zero means the guard failed and nothing was written.
+	*/
+	async insertGuarded(trx, operations, condition) {
+		const branches = operations.map((op) => trx.selectNoFrom([
+			sql`${op.jobId}::text`.as("jobId"),
+			sql`${op.opId}::text`.as("opId"),
+			sql`${op.prevOpId}::text`.as("prevOpId"),
+			sql`${op.documentId}::text`.as("documentId"),
+			sql`${op.documentType}::text`.as("documentType"),
+			sql`${op.scope}::text`.as("scope"),
+			sql`${op.branch}::text`.as("branch"),
+			sql`${op.timestampUtcMs}::timestamptz`.as("timestampUtcMs"),
+			sql`${op.index}::integer`.as("index"),
+			sql`${op.action}::jsonb`.as("action"),
+			sql`${op.skip}::integer`.as("skip"),
+			sql`${op.error ?? null}::text`.as("error"),
+			sql`${op.deniedReason ?? null}::text`.as("deniedReason"),
+			sql`${op.hash}::text`.as("hash")
+		]).where((eb) => eb.not(eb.exists(eb.selectFrom("Operation").select("Operation.id").where((web) => web.or(condition.streams.map((s) => web.and([
+			web("Operation.documentId", "=", s.documentId),
+			web("Operation.scope", "=", s.scope),
+			web("Operation.branch", "=", s.branch),
+			web("Operation.index", ">", s.revision)
+		]))))))));
+		let expression = branches[0];
+		for (let i = 1; i < branches.length; i++) expression = expression.unionAll(branches[i]);
+		return (await trx.insertInto("Operation").columns([
+			"jobId",
+			"opId",
+			"prevOpId",
+			"documentId",
+			"documentType",
+			"scope",
+			"branch",
+			"timestampUtcMs",
+			"index",
+			"action",
+			"skip",
+			"error",
+			"deniedReason",
+			"hash"
+		]).expression(expression).returning("id").execute()).length;
+	}
 	async findIdempotentReplay(executor, documentId, scope, branch, revision, stagedOps) {
 		const minIndex = revision;
 		const maxIndex = revision + stagedOps.length - 1;
@@ -2646,18 +4474,18 @@ var KyselyOperationStore = class KyselyOperationStore {
 			"o1.index",
 			"o1.timestampUtcMs"
 		]).where("o1.documentId", "=", documentId).where("o1.branch", "=", branch).where((eb) => eb("o1.index", "=", eb.selectFrom("Operation as o2").select((eb2) => eb2.fn.max("o2.index").as("maxIndex")).where("o2.documentId", "=", eb.ref("o1.documentId")).where("o2.branch", "=", eb.ref("o1.branch")).where("o2.scope", "=", eb.ref("o1.scope")))).execute();
+		const latest = await this.queryExecutor.selectFrom("Operation").select((eb) => eb.fn.max("timestampUtcMs").as("latestTimestamp")).where("documentId", "=", documentId).where("branch", "=", branch).executeTakeFirst();
 		const revision = {};
-		let latestTimestamp = (/* @__PURE__ */ new Date(0)).toISOString();
-		for (const row of scopeRevisions) {
-			revision[row.scope] = row.index + 1;
-			const timestamp = row.timestampUtcMs.toISOString();
-			if (timestamp > latestTimestamp) latestTimestamp = timestamp;
-		}
+		for (const row of scopeRevisions) revision[row.scope] = row.index + 1;
 		return {
 			revision,
-			latestTimestamp
+			latestTimestamp: latest?.latestTimestamp ? new Date(latest.latestTimestamp).toISOString() : (/* @__PURE__ */ new Date(0)).toISOString()
 		};
 	}
+	async getStreamLatestTimestamp(documentId, scope, branch, signal) {
+		const latest = await this.queryExecutor.selectFrom("Operation").select((eb) => eb.fn.max("timestampUtcMs").as("latestTimestamp")).where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).executeTakeFirst();
+		return latest?.latestTimestamp ? new Date(latest.latestTimestamp).toISOString() : void 0;
+	}
 	rowToOperation(row) {
 		return {
 			index: row.index,
@@ -2665,6 +4493,7 @@ var KyselyOperationStore = class KyselyOperationStore {
 			hash: row.hash,
 			skip: row.skip,
 			error: row.error || void 0,
+			deniedReason: row.deniedReason || void 0,
 			id: row.opId,
 			action: row.action
 		};
@@ -2750,8 +4579,8 @@ function createForwardingPoolInstrumentation(name) {
 }
 //#endregion
 //#region src/storage/migrations/001_create_operation_table.ts
-var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
-async function up$13(db) {
+var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$18 });
+async function up$18(db) {
 	await db.schema.createTable("Operation").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("jobId", "text", (col) => col.notNull()).addColumn("opId", "text", (col) => col.notNull()).addColumn("prevOpId", "text", (col) => col.notNull()).addColumn("writeTimestampUtcMs", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("timestampUtcMs", "timestamptz", (col) => col.notNull()).addColumn("index", "integer", (col) => col.notNull()).addColumn("action", "jsonb", (col) => col.notNull()).addColumn("skip", "integer", (col) => col.notNull()).addColumn("error", "text").addColumn("hash", "text", (col) => col.notNull()).addUniqueConstraint("unique_revision", [
 		"documentId",
 		"scope",
@@ -2776,8 +4605,8 @@ async function up$13(db) {
 }
 //#endregion
 //#region src/storage/migrations/002_create_keyframe_table.ts
-var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$12 });
-async function up$12(db) {
+var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$17 });
+async function up$17(db) {
 	await db.schema.createTable("Keyframe").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("revision", "integer", (col) => col.notNull()).addColumn("document", "jsonb", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_keyframe", [
 		"documentId",
 		"scope",
@@ -2793,14 +4622,14 @@ async function up$12(db) {
 }
 //#endregion
 //#region src/storage/migrations/003_create_document_table.ts
-var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$11 });
-async function up$11(db) {
+var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$16 });
+async function up$16(db) {
 	await db.schema.createTable("Document").addColumn("id", "text", (col) => col.primaryKey()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/004_create_document_relationship_table.ts
-var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$10 });
-async function up$10(db) {
+var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$15 });
+async function up$15(db) {
 	await db.schema.createTable("DocumentRelationship").addColumn("id", "text", (col) => col.primaryKey()).addColumn("sourceId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("targetId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("relationshipType", "text", (col) => col.notNull()).addColumn("metadata", "jsonb").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_source_target_type", [
 		"sourceId",
 		"targetId",
@@ -2812,14 +4641,14 @@ async function up$10(db) {
 }
 //#endregion
 //#region src/storage/migrations/005_create_indexer_state_table.ts
-var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$9 });
-async function up$9(db) {
+var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$14 });
+async function up$14(db) {
 	await db.schema.createTable("IndexerState").addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity()).addColumn("lastOperationId", "integer", (col) => col.notNull()).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/006_create_document_snapshot_table.ts
-var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$8 });
-async function up$8(db) {
+var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
+async function up$13(db) {
 	await db.schema.createTable("DocumentSnapshot").addColumn("id", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("slug", "text").addColumn("name", "text").addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("content", "jsonb", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("lastOperationIndex", "integer", (col) => col.notNull()).addColumn("lastOperationHash", "text", (col) => col.notNull()).addColumn("lastUpdatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("snapshotVersion", "integer", (col) => col.notNull().defaultTo(1)).addColumn("identifiers", "jsonb").addColumn("metadata", "jsonb").addColumn("isDeleted", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("deletedAt", "timestamptz").addUniqueConstraint("unique_doc_scope_branch", [
 		"documentId",
 		"scope",
@@ -2840,8 +4669,8 @@ async function up$8(db) {
 }
 //#endregion
 //#region src/storage/migrations/007_create_slug_mapping_table.ts
-var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$7 });
-async function up$7(db) {
+var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$12 });
+async function up$12(db) {
 	await db.schema.createTable("SlugMapping").addColumn("slug", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_docid_scope_branch", [
 		"documentId",
 		"scope",
@@ -2851,14 +4680,14 @@ async function up$7(db) {
 }
 //#endregion
 //#region src/storage/migrations/008_create_view_state_table.ts
-var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$6 });
-async function up$6(db) {
+var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$11 });
+async function up$11(db) {
 	await db.schema.createTable("ViewState").addColumn("readModelId", "text", (col) => col.primaryKey()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(0)).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/009_create_operation_index_tables.ts
-var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$5 });
-async function up$5(db) {
+var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$10 });
+async function up$10(db) {
 	await db.schema.createTable("document_collections").addColumn("documentId", "text", (col) => col.notNull()).addColumn("collectionId", "text", (col) => col.notNull()).addColumn("joinedOrdinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("leftOrdinal", "bigint").addPrimaryKeyConstraint("document_collections_pkey", ["documentId", "collectionId"]).execute();
 	await db.schema.createIndex("idx_document_collections_collectionId").on("document_collections").column("collectionId").execute();
 	await db.schema.createIndex("idx_doc_collections_collection_range").on("document_collections").columns(["collectionId", "joinedOrdinal"]).execute();
@@ -2872,8 +4701,8 @@ async function up$5(db) {
 }
 //#endregion
 //#region src/storage/migrations/010_create_sync_tables.ts
-var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$4 });
-async function up$4(db) {
+var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$9 });
+async function up$9(db) {
 	await db.schema.createTable("sync_remotes").addColumn("name", "text", (col) => col.primaryKey()).addColumn("collection_id", "text", (col) => col.notNull()).addColumn("channel_type", "text", (col) => col.notNull()).addColumn("channel_id", "text", (col) => col.notNull().defaultTo("")).addColumn("remote_name", "text", (col) => col.notNull().defaultTo("")).addColumn("channel_parameters", "jsonb", (col) => col.notNull().defaultTo(sql`'{}'::jsonb`)).addColumn("filter_document_ids", "jsonb").addColumn("filter_scopes", "jsonb").addColumn("filter_branch", "text", (col) => col.notNull().defaultTo("main")).addColumn("push_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("push_last_success_utc_ms", "text").addColumn("push_last_failure_utc_ms", "text").addColumn("push_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("pull_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("pull_last_success_utc_ms", "text").addColumn("pull_last_failure_utc_ms", "text").addColumn("pull_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 	await db.schema.createIndex("idx_sync_remotes_collection").on("sync_remotes").column("collection_id").execute();
 	await db.schema.createTable("sync_cursors").addColumn("remote_name", "text", (col) => col.primaryKey().references("sync_remotes.name").onDelete("cascade")).addColumn("cursor_ordinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("last_synced_at_utc_ms", "text").addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
@@ -2881,8 +4710,8 @@ async function up$4(db) {
 }
 //#endregion
 //#region src/storage/migrations/011_add_cursor_type_column.ts
-var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$3 });
-async function up$3(db) {
+var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$8 });
+async function up$8(db) {
 	await db.deleteFrom("sync_cursors").where("remote_name", "like", "outbox::%").execute();
 	await db.deleteFrom("sync_remotes").where("name", "like", "outbox::%").execute();
 	await db.schema.dropTable("sync_cursors").execute();
@@ -2891,24 +4720,150 @@ async function up$3(db) {
 }
 //#endregion
 //#region src/storage/migrations/012_add_source_remote_column.ts
-var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$2 });
-async function up$2(db) {
+var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$7 });
+async function up$7(db) {
 	await db.schema.alterTable("operation_index_operations").addColumn("sourceRemote", "text", (col) => col.notNull().defaultTo("")).execute();
 }
 //#endregion
 //#region src/storage/migrations/013_create_sync_dead_letters_table.ts
-var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$1 });
-async function up$1(db) {
+var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$6 });
+async function up$6(db) {
 	await db.schema.createTable("sync_dead_letters").addColumn("ordinal", "serial", (col) => col.primaryKey()).addColumn("id", "text", (col) => col.unique().notNull()).addColumn("job_id", "text", (col) => col.notNull()).addColumn("job_dependencies", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("remote_name", "text", (col) => col.notNull().references("sync_remotes.name").onDelete("cascade")).addColumn("document_id", "text", (col) => col.notNull()).addColumn("scopes", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("branch", "text", (col) => col.notNull()).addColumn("operations", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("error_source", "text", (col) => col.notNull()).addColumn("error_message", "text", (col) => col.notNull()).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 	await db.schema.createIndex("idx_sync_dead_letters_remote").on("sync_dead_letters").column("remote_name").execute();
 }
 //#endregion
 //#region src/storage/migrations/014_create_processor_cursor_table.ts
-var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up });
-async function up(db) {
+var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$5 });
+async function up$5(db) {
 	await db.schema.createTable("ProcessorCursor").addColumn("processorId", "text", (col) => col.primaryKey()).addColumn("factoryId", "text", (col) => col.notNull()).addColumn("driveId", "text", (col) => col.notNull()).addColumn("processorIndex", "integer", (col) => col.notNull()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(sql`0`)).addColumn("status", "text", (col) => col.notNull().defaultTo(sql`'active'`)).addColumn("lastError", "text").addColumn("lastErrorTimestamp", "timestamptz").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
+//#region src/storage/migrations/015_add_operation_denied_reason.ts
+var _015_add_operation_denied_reason_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$4,
+	up: () => up$4
+});
+/**
+* Records why authorization refused an operation. Separate from `error` so a
+* denial is distinguishable from a reducer failure without matching on a
+* message. Null for every operation written before decisions were enforced.
+*/
+async function up$4(db) {
+	await db.schema.alterTable("Operation").addColumn("deniedReason", "text").execute();
+	await db.schema.alterTable("operation_index_operations").addColumn("deniedReason", "text").execute();
+}
+async function down$4(db) {
+	await db.schema.alterTable("operation_index_operations").dropColumn("deniedReason").execute();
+	await db.schema.alterTable("Operation").dropColumn("deniedReason").execute();
+}
+//#endregion
+//#region src/storage/migrations/016_add_dead_letter_error_type.ts
+var _016_add_dead_letter_error_type_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$3,
+	up: () => up$3
+});
+/**
+* The classification a dead letter falls into, stored because it decides whether
+* the document stays quarantined and the in-memory error is gone after a restart.
+* Defaulted rather than nullable, so a pre-existing row rehydrates.
+*/
+async function up$3(db) {
+	await db.schema.alterTable("sync_dead_letters").addColumn("error_type", "text", (col) => col.notNull().defaultTo("UNCLASSIFIED")).execute();
+}
+async function down$3(db) {
+	await db.schema.alterTable("sync_dead_letters").dropColumn("error_type").execute();
+}
+//#endregion
+//#region src/storage/migrations/017_create_group_references.ts
+var _017_create_group_references_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$2,
+	up: () => up$2
+});
+/**
+* One row per (document, group) reference ever discovered from an auth
+* operation's input. Rows are never updated or deleted: auth evaluation is
+* positional, so a grant that named a group at any position keeps that
+* group's stream in the document's read-set even after a later operation
+* removes the reference. Read by documentId for the groups a document
+* requires (sync), and by groupId for the documents a group change affects
+* (re-evaluation).
+*/
+async function up$2(db) {
+	await db.schema.createTable("group_references").addColumn("documentId", "text", (col) => col.notNull()).addColumn("groupId", "text", (col) => col.notNull()).addPrimaryKeyConstraint("group_references_pkey", ["documentId", "groupId"]).execute();
+	await db.schema.createIndex("idx_group_references_groupId").on("group_references").column("groupId").execute();
+}
+async function down$2(db) {
+	await db.schema.dropTable("group_references").execute();
+}
+//#endregion
+//#region src/storage/migrations/018_add_sync_remote_bound_address.ts
+var _018_add_sync_remote_bound_address_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$1,
+	up: () => up$1
+});
+/**
+* The address a sync channel is bound to, so a channel created by one subject
+* cannot be polled by another.
+*
+* Nullable rather than defaulted: null is a channel nobody has claimed, which is
+* what every pre-existing row is and what an anonymously created channel stays
+* until its first authenticated poll adopts it. A default would claim them all
+* for one address.
+*/
+async function up$1(db) {
+	await db.schema.alterTable("sync_remotes").addColumn("bound_address", "text").execute();
+}
+async function down$1(db) {
+	await db.schema.alterTable("sync_remotes").dropColumn("bound_address").execute();
+}
+//#endregion
+//#region src/storage/migrations/019_require_action_id.ts
+var _019_require_action_id_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* Makes an operation whose action carries no id physically unstorable.
+*
+* The id is not decoration: `deriveOperationId` hashes it into the operation id
+* and replay dedupes incoming operations by it, so an action without one
+* collapses every id-less operation on a document/scope/branch onto a single
+* derived operation id. The API rejects such an action now, and this is the
+* last line of defense behind it.
+*
+* Both tables are constrained because sync reads operations from the index
+* rather than the operation table, so poison reaching only the index would
+* still be served to a replica.
+*
+* Pre-existing rows are backfilled rather than left behind a NOT VALID
+* constraint: a row the index and the operation table disagree about is worse
+* than a missing id, because dedup keys off the value each side serves. The
+* backfill therefore mints one id per operation and writes that same id to both
+* tables, joined on the identity they share. Rewriting the action is safe: the
+* operation hash is taken over the resulting state, not over the action, and a
+* signature is verified from the params carried in the signature tuple, which
+* do not include the action id.
+*
+* The empty string is rejected alongside null. It derives the same colliding
+* operation id as an absent id, so admitting it would leave the hole open.
+*/
+async function up(db) {
+	await db.updateTable("Operation").set({ action: sql`jsonb_set(action, '{id}', to_jsonb(gen_random_uuid()::text))` }).where(sql`jsonb_typeof(action) = 'object' and coalesce(action->>'id', '') = ''`).execute();
+	await db.updateTable("operation_index_operations as oio").from("Operation as op").set({ action: sql`jsonb_set(oio.action, '{id}', to_jsonb(op.action->>'id'))` }).whereRef("oio.opId", "=", "op.opId").whereRef("oio.index", "=", "op.index").whereRef("oio.skip", "=", "op.skip").where(sql`jsonb_typeof(oio.action) = 'object' and coalesce(oio.action->>'id', '') = ''`).where(sql`coalesce(op.action->>'id', '') <> ''`).execute();
+	await db.updateTable("operation_index_operations").set({ action: sql`jsonb_set(action, '{id}', to_jsonb(gen_random_uuid()::text))` }).where(sql`jsonb_typeof(action) = 'object' and coalesce(action->>'id', '') = ''`).execute();
+	await db.schema.alterTable("Operation").addCheckConstraint("action_must_have_id", sql`action->>'id' is not null and action->>'id' <> ''`).execute();
+	await db.schema.alterTable("operation_index_operations").addCheckConstraint("action_must_have_id", sql`action->>'id' is not null and action->>'id' <> ''`).execute();
+}
+/**
+* Only the constraints are dropped. The backfilled ids stay: they are the ids
+* their operations are now known by, and reverting them would reintroduce the
+* collision the migration removed.
+*/
+async function down(db) {
+	await db.schema.alterTable("operation_index_operations").dropConstraint("action_must_have_id").execute();
+	await db.schema.alterTable("Operation").dropConstraint("action_must_have_id").execute();
+}
+//#endregion
 //#region src/storage/migrations/migrator.ts
 const REACTOR_SCHEMA = "reactor";
 const migrations = {
@@ -2925,14 +4880,25 @@ const migrations = {
 	"011_add_cursor_type_column": _011_add_cursor_type_column_exports,
 	"012_add_source_remote_column": _012_add_source_remote_column_exports,
 	"013_create_sync_dead_letters_table": _013_create_sync_dead_letters_table_exports,
-	"014_create_processor_cursor_table": _014_create_processor_cursor_table_exports
+	"014_create_processor_cursor_table": _014_create_processor_cursor_table_exports,
+	"015_add_operation_denied_reason": _015_add_operation_denied_reason_exports,
+	"016_add_dead_letter_error_type": _016_add_dead_letter_error_type_exports,
+	"017_create_group_references": _017_create_group_references_exports,
+	"018_add_sync_remote_bound_address": _018_add_sync_remote_bound_address_exports,
+	"019_require_action_id": _019_require_action_id_exports
 };
 var ProgrammaticMigrationProvider = class {
 	getMigrations() {
 		return Promise.resolve(migrations);
 	}
 };
-async function runMigrations(db, schema = REACTOR_SCHEMA) {
+/**
+* Applies every pending migration, or every one up to and including `upTo`.
+*
+* The bound exists so a test can reach the schema a data migration is written
+* against, populate it, and then migrate across the migration under test.
+*/
+async function runMigrations(db, schema = REACTOR_SCHEMA, upTo) {
 	try {
 		await sql`CREATE SCHEMA IF NOT EXISTS ${sql.id(schema)}`.execute(db);
 	} catch (error) {
@@ -2950,7 +4916,7 @@ async function runMigrations(db, schema = REACTOR_SCHEMA) {
 	let error;
 	let results;
 	try {
-		const result = await migrator.migrateToLatest();
+		const result = upTo ? await migrator.migrateTo(upTo) : await migrator.migrateToLatest();
 		error = result.error;
 		results = result.results;
 	} catch (e) {
@@ -2979,6 +4945,6 @@ async function getMigrationStatus(db, schema = REACTOR_SCHEMA) {
 //#region src/core/drive-container-types.ts
 const DEFAULT_DRIVE_CONTAINER_TYPES = new Set(["powerhouse/document-drive", "powerhouse/reactor-drive"]);
 //#endregion
-export { parsePagingOptions as A, DuplicateManifestError as C, DocumentDeletedError as D, ModuleNotFoundError as E, __exportAll as M, DocumentNotFoundError as O, CollectionMembershipCache as S, InvalidModuleError as T, KyselyWriteCache as _, createForwardingPoolInstrumentation as a, createConsistencyToken as b, DuplicateOperationError as c, KyselyKeyframeStore as d, DocumentModelRegistry as f, EventBus as g, KyselyExecutionScope as h, runMigrations as i, throwIfAborted as j, matchesScope as k, OptimisticLockError as l, DriveCollectionId as m, REACTOR_SCHEMA as n, instrumentPgPool as o, SimpleJobExecutor as p, getMigrationStatus as r, KyselyOperationStore as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, RevisionMismatchError as u, KyselyOperationIndex as v, DuplicateModuleError as w, createEmptyConsistencyToken as x, DocumentMetaCache as y };
+export { GATED_DOCUMENT_ACTIONS as A, AuthTimestampNotMonotonicError as B, DuplicateOperationError as C, DuplicateModuleError as D, DuplicateManifestError as E, selectDecisionModel as F, InvalidOperationTimestampError as G, DocumentDeletedError as H, documentDecisionModel as I, parsePagingOptions as J, UpgradePreconditionFailedError as K, authDecisionModel as L, createEmptyConsistencyToken as M, targetDocumentId as N, InvalidModuleError as O, decideAtHead as P, buildDecisionModel as R, AppendConditionFailedError as S, RevisionMismatchError as T, DocumentNotFoundError as U, AuthorizationDeniedError as V, ExcessiveReshuffleError as W, __exportAll as X, throwIfAborted as Y, DocumentMetaCache as _, createForwardingPoolInstrumentation as a, JobExecutorEventTypes as b, KyselyKeyframeStore as c, DriveCollectionId as d, KyselyExecutionScope as f, KyselyOperationIndex as g, KyselyWriteCache as h, runMigrations as i, createConsistencyToken as j, ModuleNotFoundError as k, DocumentModelRegistry as l, EventBus as m, REACTOR_SCHEMA as n, instrumentPgPool as o, resolveFeatureFlags as p, matchesScope as q, getMigrationStatus as r, KyselyOperationStore as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, SimpleJobExecutor as u, CollectionMembershipCache as v, OptimisticLockError as w, APPEND_CONDITION_FAILED_PREFIX as x, DEFAULT_DEFERRED_JOB_TTL_MS as y, AuthEnforcementDisabledError as z };
 
-//# sourceMappingURL=drive-container-types-DpJp2AmE.js.map
+//# sourceMappingURL=drive-container-types-bVQ_8YwX.js.map