@powerhousedao/reactor 6.2.2-dev.6 → 6.2.2-dev.60

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { Action, CreateDocumentActionInput, DocumentModelModule, ISigner, Operation, OperationContext, OperationWithContext, OperationWithContext as OperationWithContext$1, PHDocument, PHDocumentState, SignatureVerificationHandler, UpgradeDocumentActionInput, UpgradeManifest, UpgradeReducer, UpgradeTransition, actions as documentActions } from "@powerhousedao/shared/document-model";
+import { Action, AuthRequest, AuthSubject, CreateDocumentActionInput, DocumentModelModule, ISigner, Operation, OperationContext, OperationWithContext, OperationWithContext as OperationWithContext$1, PHAuthState, PHDocument, PHDocumentState, SignatureVerificationHandler, UpgradeDocumentActionInput, UpgradeManifest, UpgradeReducer, UpgradeTransition, actions as documentActions } from "@powerhousedao/shared/document-model";
 import { DocumentDriveDocument, DriveInput, FolderNode, Node } from "@powerhousedao/shared/document-drive";
 import { ILogger } from "document-model";
 import * as kysely from "kysely";
@@ -57,7 +57,14 @@ declare function updateRelationshipAction(sourceId: string, targetId: string, re
 declare function removeRelationshipAction(sourceId: string, targetId: string, relationshipType?: string): Action;
 //#endregion
 //#region src/queue/types.d.ts
-type JobKind = "mutation" | "load";
+/**
+ * What a job carries: a mutation applies actions, a load imports synced
+ * operations, and a reevaluation re-judges a document's stored operations
+ * because a read-set stream elsewhere (a group document) changed. A
+ * reevaluation job carries no actions or operations; its work is derived
+ * from what is already stored.
+ */
+type JobKind = "mutation" | "load" | "reevaluation";
 /**
  * State of a job in the queue
  */
@@ -69,6 +76,17 @@ declare enum JobQueueState {
   RUNNING = 3,
   RESOLVED = 4
 }
+/**
+ * How a retry is accounted against the job's retry limit.
+ * - `CountAgainstLimit` (default): a fault; the job eventually exhausts its
+ *   retries and fails terminally.
+ * - `ExemptFromLimit`: not a fault, so the attempt is not charged to the job.
+ *   Used for concurrency conflicts, where the retry does new work.
+ */
+declare enum RetryAccounting {
+  CountAgainstLimit = "count-against-limit",
+  ExemptFromLimit = "exempt-from-limit"
+}
 /**
  * Interface for a job execution handle
  */
@@ -127,9 +145,14 @@ type JobAvailableEvent = {
 //#endregion
 //#region src/shared/types.d.ts
 /**
- * Information about an error including message and stack trace.
+ * Information about an error including its name, message and stack trace.
+ *
+ * The name is what survives the crossing out of the executor: a consumer that
+ * has to tell a terminal failure from a retryable one, or classify a dead
+ * letter, only ever sees this record rather than the thrown error.
  */
 type ErrorInfo$1 = {
+  name: string;
   message: string;
   stack: string;
 };
@@ -230,6 +253,11 @@ type ViewFilter = {
   branch?: string;
   scopes?: string[];
   revision?: number;
+  /**
+   * Read subject for the IReactorClient read gate; defaults to the client's
+   * signer. Set per request when serving many principals. Ignored by IReactor.
+   */
+  subject?: AuthSubject;
 };
 /**
  * Describes filter options for searching documents.
@@ -328,6 +356,16 @@ interface IReadModelCoordinator {
    */
   getChainDepth(): number;
 }
+type ReadModelRegistrationStage = "pre_ready" | "post_ready";
+/**
+ * Optional capability exposed by coordinators that support adding read models
+ * after construction. Custom and remote coordinators are not required to
+ * implement it.
+ */
+interface ILiveReadModelCoordinator extends IReadModelCoordinator {
+  addReadModel(readModel: IReadModel, stage: ReadModelRegistrationStage): void;
+}
+declare function supportsLiveReadModelRegistration(coordinator: IReadModelCoordinator): coordinator is ILiveReadModelCoordinator;
 //#endregion
 //#region src/sync/types.d.ts
 declare enum ChannelScheme {
@@ -361,6 +399,16 @@ type RemoteOptions = {
    * Polling cadence for this remote. Defaults to `PollBehavior.Auto` when omitted.
    */
   pollBehavior?: PollBehavior;
+  /**
+   * The address this channel belongs to, once one has claimed it.
+   *
+   * Undefined is unbound and adoptable: a channel created anonymously, or one
+   * that predates binding. The first authenticated subject to poll or touch it
+   * takes it, and from then on it answers to that address alone. There is no
+   * sentinel for "anonymous" -- an anonymous holder is exactly one that has not
+   * claimed the channel.
+   */
+  boundAddress?: string;
 };
 type RemoteFilter = {
   documentId: string[];
@@ -398,7 +446,13 @@ declare enum ChannelErrorSource {
   Inbox = "inbox",
   Outbox = "outbox"
 }
-type SyncOperationErrorType = "SIGNATURE_INVALID" | "HASH_MISMATCH" | "LIBRARY_ERROR" | "MISSING_OPERATIONS" | "EXCESSIVE_SHUFFLE" | "GRACEFUL_ABORT";
+type SyncOperationErrorType = "SIGNATURE_INVALID" | "HASH_MISMATCH" | "LIBRARY_ERROR" | "MISSING_OPERATIONS" | "EXCESSIVE_SHUFFLE" | "GRACEFUL_ABORT"
+/**
+ * An arriving auth operation did not exceed the local auth head. Exempt from
+ * quarantine, because reconciling the two policies needs the traffic a
+ * quarantine would stop.
+ */
+| "AUTH_TIMESTAMP_NOT_MONOTONIC" /** An arriving operation carried a timestamp that is not an ISO-8601 instant. */ | "INVALID_TIMESTAMP" /** No classification applies, including rows written before the field. */ | "UNCLASSIFIED";
 type ChannelHealth = {
   state: "idle" | "running" | "error";
   lastSuccessUtcMs?: number;
@@ -491,6 +545,7 @@ type DeadLetterAddedEvent = {
   remoteName: string;
   documentId: string;
   errorSource: ChannelErrorSource;
+  errorType: SyncOperationErrorType;
 };
 /**
  * Status of a sync operation result.
@@ -537,6 +592,36 @@ declare class OptimisticLockError extends Error {
 declare class RevisionMismatchError extends Error {
   constructor(expected: number, actual: number);
 }
+/**
+ * One read-set stream and the highest operation index observed on it, or -1
+ * if it was observed empty.
+ */
+type AppendConditionStream = {
+  documentId: string;
+  scope: string;
+  branch: string;
+  revision: number;
+};
+/**
+ * A read-set enforced by {@link IOperationStore.apply}: the append fails if
+ * any stream has operations past its recorded revision.
+ */
+type AppendCondition = {
+  streams: AppendConditionStream[];
+};
+/** Error history keeps messages, not classes, so failures match by prefix. */
+declare const APPEND_CONDITION_FAILED_PREFIX = "Append condition failed: ";
+/**
+ * A read-set stream grew before the append committed. A concurrency
+ * conflict, not a fault: the caller retries against the new stream heads.
+ */
+declare class AppendConditionFailedError extends Error {
+  readonly condition: AppendCondition;
+  constructor(condition: AppendCondition);
+  static isError(error: unknown): error is AppendConditionFailedError;
+  /** True when a recorded error message is an append-condition failure. */
+  static isFailureMessage(message: string): boolean;
+}
 /**
  * A write transaction passed to {@link IOperationStore.apply}. Accumulates
  * operations that are committed atomically when the callback returns.
@@ -550,7 +635,7 @@ interface AtomicTxn {
  * revision field and lastModified timestamp.
  */
 type DocumentRevisions = {
-  /** Map of scope to operation index for that scope */revision: Record<string, number>; /** Latest timestamp across revisions */
+  /** Map of scope to operation index for that scope */revision: Record<string, number>; /** The largest operation timestamp in the document, across every scope. */
   latestTimestamp: string;
 };
 /**
@@ -571,6 +656,12 @@ interface IOperationStore {
    * returned instead of throwing. If no matching stored row is found, the
    * original error is propagated unchanged.
    *
+   * With an {@link AppendCondition}, the append additionally fails with
+   * {@link AppendConditionFailedError} — writing nothing — if any read-set
+   * stream has operations past its recorded revision. The written and
+   * read-set streams are advisory-locked in sorted key order, so concurrent
+   * conditional appends on overlapping streams serialize.
+   *
    * @param documentId - The document id
    * @param documentType - The document type identifier
    * @param scope - The operation scope (e.g. "global", "local")
@@ -578,9 +669,10 @@ interface IOperationStore {
    * @param revision - Expected current revision (optimistic lock)
    * @param fn - Callback that stages operations via {@link AtomicTxn}
    * @param signal - Optional abort signal to cancel the request
+   * @param condition - Optional read-set to enforce at write time
    * @returns The stored operations; empty array when no operations were staged
    */
-  apply(documentId: string, documentType: string, scope: string, branch: string, revision: number, fn: (txn: AtomicTxn) => void | Promise<void>, signal?: AbortSignal): Promise<Operation[]>;
+  apply(documentId: string, documentType: string, scope: string, branch: string, revision: number, fn: (txn: AtomicTxn) => void | Promise<void>, signal?: AbortSignal, condition?: AppendCondition): Promise<Operation[]>;
   /**
    * Returns operations for a document/scope/branch whose index is greater
    * than the given revision.
@@ -627,6 +719,16 @@ interface IOperationStore {
    * @returns Object containing revision map and latest timestamp
    */
   getRevisions(documentId: string, branch: string, signal?: AbortSignal): Promise<DocumentRevisions>;
+  /**
+   * The largest operation timestamp in one stream, or undefined when it is empty.
+   * Distinct from {@link DocumentRevisions.latestTimestamp}, which maxes over
+   * every scope.
+   *
+   * Must be a real maximum, not the last-indexed operation's timestamp: a
+   * re-evaluation pass re-appends at a fresh index while keeping the original
+   * timestamp, so a later timestamp can sit behind the last row.
+   */
+  getStreamLatestTimestamp(documentId: string, scope: string, branch: string, signal?: AbortSignal): Promise<string | undefined>;
 }
 /**
  * Stores periodic document snapshots (keyframes) so that document state
@@ -1045,7 +1147,8 @@ type DeadLetterRecord = {
   branch: string;
   operations: OperationWithContext$1[];
   errorSource: ChannelErrorSource;
-  errorMessage: string;
+  errorMessage: string; /** Why it failed, in the closed set sync classifies failures into. */
+  errorType: SyncOperationErrorType;
 };
 /**
  * Persists dead-lettered sync operations so they survive reactor restarts.
@@ -1103,6 +1206,15 @@ interface IOperationIndexTxn {
   createCollection(collectionId: string): void;
   addToCollection(collectionId: string, documentId: string): void;
   removeFromCollection(collectionId: string, documentId: string): void;
+  /**
+   * Records the group documents an auth operation's input names, tied to the
+   * last written operation like addToCollection. At commit each reference is
+   * remembered permanently and the group joins every collection the
+   * referencing document belongs to, keeping the earliest join and reopening
+   * a closed membership, so sync serves the group's history to every remote
+   * that can observe the referencing grant.
+   */
+  recordGroupReferences(documentId: string, groupIds: string[]): void;
   write(operations: OperationIndexEntry[]): void;
 }
 /**
@@ -1124,6 +1236,13 @@ interface IOperationIndex {
    * Returns a map of documentId to array of collection IDs.
    */
   getCollectionsForDocuments(documentIds: string[]): Promise<Record<string, string[]>>;
+  /**
+   * The documents whose auth history has ever referenced the group, from the
+   * group-reference relation. This is the set a group-stream change owes a
+   * re-evaluation pass to; it is complete because a group's auth scope cannot
+   * reference other groups.
+   */
+  getGroupReferencers(groupId: string, signal?: AbortSignal): Promise<string[]>;
 }
 /**
  * Identifies the collection a remote synchronizes. Collections are drive-level
@@ -1152,6 +1271,51 @@ declare class DriveCollectionId {
   equals(other: DriveCollectionId): boolean;
 }
 //#endregion
+//#region src/cache/write-cache-types.d.ts
+/**
+ * Configuration options for the write cache
+ */
+type WriteCacheConfig = {
+  /** Maximum number of document streams to cache (LRU eviction). Default: 1000 */maxDocuments: number; /** Number of snapshots to keep in each document's ring buffer. Default: 10 */
+  ringBufferSize: number; /** Persist a keyframe snapshot every N revisions. Default: 10 */
+  keyframeInterval: number;
+};
+/**
+ * Unique identifier for a document stream
+ */
+type DocumentStreamKey = {
+  /** Document identifier */documentId: string; /** Operation scope */
+  scope: string; /** Branch name */
+  branch: string;
+};
+/**
+ * Where a snapshot sits in its stream.
+ *
+ * - `Head`: the newest revision of the stream when it was stored. Only these
+ *   can answer a read that asks for the head.
+ * - `Historical`: state at an earlier revision. Usable as a starting point to
+ *   replay forward from, and as an answer to a read for that same revision.
+ */
+declare enum SnapshotPosition {
+  Head = "head",
+  Historical = "historical"
+}
+/**
+ * A cached document snapshot at a specific revision
+ */
+type CachedSnapshot = {
+  /** The revision number of this snapshot */revision: number; /** The document state at this revision */
+  document: PHDocument; /** Where this snapshot sat in the stream when it was stored */
+  position: SnapshotPosition;
+};
+/**
+ * Serialized keyframe snapshot for K/V store persistence
+ */
+type KeyframeSnapshot = {
+  /** The revision number of this keyframe */revision: number; /** Serialized document state */
+  document: string;
+};
+//#endregion
 //#region src/cache/write/interfaces.d.ts
 /**
  * IWriteCache is a write-side projection that optimizes document state retrieval
@@ -1166,7 +1330,8 @@ interface IWriteCache {
    * @param documentId - The document identifier
    * @param scope - Operation scope
    * @param branch - Branch name
-   * @param targetRevision - The exact revision to retrieve (optional, defaults to latest)
+   * @param targetRevision - Index of the last operation to apply, defaulting
+   *   to latest. An operation index, never `header.revision[scope]`.
    * @param signal - Optional abort signal to cancel the operation
    * @returns The complete document at the specified revision
    *
@@ -1192,15 +1357,19 @@ interface IWriteCache {
    * @param documentId - The document identifier
    * @param scope - Operation scope
    * @param branch - Branch name
-   * @param revision - The revision this document represents
+   * @param revision - Index of the last operation this document reflects, so
+   *   `header.revision[scope]` is one greater. -1 for an empty scope.
    * @param document - The document to cache
+   * @param position - Whether `revision` is the stream's head. Nothing checks
+   *   it: claiming `Head` for an earlier revision makes a getState() with no
+   *   target return stale state.
    *
    * @example
    * ```typescript
-   * cache.putState(docId, 'global', 'main', 42, document);
+   * cache.putState(docId, 'global', 'main', 42, document, SnapshotPosition.Head);
    * ```
    */
-  putState(documentId: string, scope: string, branch: string, revision: number, document: PHDocument): void;
+  putState(documentId: string, scope: string, branch: string, revision: number, document: PHDocument, position: SnapshotPosition): void;
   /**
    * Invalidates (removes) cached entries for a document stream.
    *
@@ -1500,6 +1669,104 @@ interface IReactorSubscriptionManager {
   onRelationshipChanged(callback: (parentId: string, childId: string, changeType: RelationshipChangeType) => void, search?: SearchFilter): () => void;
 }
 //#endregion
+//#region src/decision/types.d.ts
+/** One operation stream. */
+type StreamQuery = {
+  documentId: string;
+  branch: string;
+  scope: string;
+};
+/**
+ * What building a decision model reads a stream's state through.
+ *
+ * `IWriteCache` satisfies this and is what the write paths pass. The read path
+ * cannot: the write cache is a write-side projection invalidated by the process
+ * that runs the executor, so a reactor whose executors live in worker processes
+ * holds state in its parent that no commit ever invalidates. A read there would
+ * decide against a policy arbitrarily far behind the one the write paths
+ * enforce. Reads therefore pass a reader backed by the read side.
+ */
+interface IStreamStateReader {
+  getState(documentId: string, scope: string, branch: string, targetRevision?: number, signal?: AbortSignal): Promise<PHDocument>;
+}
+/** The document and branch a decision model is built for. */
+type DecisionTarget = {
+  documentId: string;
+  branch: string;
+};
+/**
+ * What a decision's conditions may read beyond the projections: the executing
+ * scope's own state and the attempted action's input. Populated only while
+ * authConditions is on; otherwise both stay undefined and conditional grants
+ * never apply.
+ */
+type DecisionContext = {
+  scopeState: unknown;
+  actionInput?: unknown;
+};
+/** A statically-queried stream's operations, named after its projection. */
+type StreamHistory = {
+  name: string;
+  operations: Operation[];
+};
+/**
+ * A named stream whose value in the model is that scope's state from the
+ * document rebuild the reactor already performs. A derived query may read
+ * only statically-queried projections, so composition is one layer deep.
+ */
+type Projection<M> = {
+  query: StreamQuery | ((model: Partial<M>) => StreamQuery[]);
+  /**
+   * For a derived projection, the streams it may read anywhere in an
+   * evaluated range, derived from the statically-queried streams' operations
+   * (including the operations under evaluation). A positional walk cannot use
+   * `query`, because the folded state it depends on changes over the range;
+   * this over-approximates by design, since a stream referenced at any
+   * position stays readable when the earlier range is re-evaluated even if a
+   * later operation removes the reference. Ignored on static projections.
+   */
+  queryOverHistory?: (reads: StreamHistory[]) => StreamQuery[];
+  /**
+   * Action types in this stream that can change an evaluation. Reads of the stream
+   * are filtered to these, so anything left out is invisible to a decision.
+   */
+  decidingActions: string[]; /** Applies one of this stream's operations while deciding. */
+  apply: (document: PHDocument, operation: Operation) => PHDocument;
+};
+/**
+ * The outcome of evaluating one operation. A refusal carries the reason it is
+ * recorded with, because a model has more than one way to refuse.
+ */
+type Evaluation = {
+  decision: "allow";
+} | {
+  decision: "deny";
+  reason: string;
+};
+/** Projections plus a decision function over the built model. */
+type DecisionModel<M> = {
+  projections: { [K in keyof M]: Projection<M> };
+  /**
+   * Present when decide reads the executing scope's state through the
+   * decision context. A positional walk then folds the evaluated stream with
+   * this, from its base state through every effective operation, so
+   * conditions read the state as it stood at each operation's position
+   * rather than at the head.
+   */
+  foldEvaluatedScope?: (document: PHDocument, operation: Operation) => PHDocument;
+  /**
+   * Whether or not this model decides about operations in a given scope. That
+   * is, a scope it reads is not necessarily one it evaluates, and vise-versa.
+   */
+  evaluatesScope(scope: string): boolean;
+  decide(model: M, subject: AuthSubject, request: AuthRequest, ctx: DecisionContext): Evaluation;
+};
+/** A built model plus the read-set condition recording what the build read. */
+type BuiltDecisionModel<M> = {
+  model: M;
+  appendCondition: AppendCondition;
+};
+//#endregion
 //#region src/client/types.d.ts
 /**
  * Describes the types of document changes that can occur.
@@ -1531,6 +1798,17 @@ type CreateDocumentOptions = {
   /** Optional "id" or "slug" of parent document */parentIdentifier?: string; /** Optional version of the document model to use (defaults to latest) */
   documentModelVersion?: number;
 };
+/**
+ * Options for upgrading a document.
+ */
+type UpgradeDocumentOptions = {
+  /**
+   * How many times to retry with a fresh read when the executor rejects the
+   * upgrade because the document changed after it was read. Defaults to
+   * {@link DEFAULT_UPGRADE_CONFLICT_RETRIES}.
+   */
+  maxConflictRetries?: number;
+};
 /**
  * Drive-aware operations grouped under `client.drives`.
  *
@@ -1596,6 +1874,33 @@ interface IDriveClient {
    */
   listNodes(driveIdentifier: string, parentFolder?: string | null, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Node>>;
 }
+/**
+ * One operation an authorization preflight predicts a verdict for. The input is
+ * what a conditional grant reads, so a candidate standing for a filled-in form
+ * carries that form's input.
+ */
+type ActionCandidate = {
+  scope: string;
+  type: string;
+  input?: unknown;
+};
+/**
+ * The predicted verdicts for a set of candidates, in the order they were given,
+ * with the aggregates a UI branches on.
+ *
+ * The aggregates are redundant -- a verdict is binary, so `allDenied` is
+ * `!anyAllowed` and `anyDenied` is `!allAllowed` -- and all four are returned
+ * so that a caller reads the one its question is phrased in rather than
+ * negating another. Over no candidates every aggregate is false: nothing is
+ * allowed and nothing is denied.
+ */
+type ActionEvaluations = {
+  evaluations: Evaluation[];
+  allAllowed: boolean;
+  anyAllowed: boolean;
+  allDenied: boolean;
+  anyDenied: boolean;
+};
 /**
  * The ReactorClient interface that wraps lower-level APIs to provide
  * a simpler interface for document operations.
@@ -1646,7 +1951,7 @@ interface IReactorClient {
    * @param signal - Optional abort signal to cancel the request
    * @returns The canonical document id
    */
-  resolveIdOrSlug(identifier: string, signal?: AbortSignal): Promise<string>;
+  resolveIdOrSlug(identifier: string, view?: ViewFilter, signal?: AbortSignal): Promise<string>;
   /**
    * Retrieves operations for a document.
    *
@@ -1690,6 +1995,44 @@ interface IReactorClient {
    * @returns List of documents matching criteria and pagination cursor
    */
   find(search: SearchFilter, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
+  /**
+   * Predicts whether the subject would be admitted to execute each of a set of
+   * candidate operations, without submitting any of them. A UI asks this to
+   * disable a control rather than offer an action that fails on submit.
+   *
+   * The answer is a prediction, not a promise. Three caveats hold:
+   *
+   * - Real admission compiles an append condition over everything it read and
+   *   the store enforces it at write time. A preflight reads no future, so a
+   *   policy change landing between this answer and the submit changes the
+   *   verdict. The submit path stays the only authority.
+   * - The verdict is evaluated at the stream heads. It is therefore correct for
+   *   a candidate that will be stamped at or after every timestamp the
+   *   evaluation read, which is the normal case for a control the user is about
+   *   to click. A backdated submission is out of contract: the reactor decides
+   *   that one by position, against the policy as it stood there.
+   * - A candidate whose input decides the verdict needs that input supplied.
+   *   With `authConditions` on, a conditional grant reads `action.input`, so
+   *   omitting the input predicts the denial an empty input would earn rather
+   *   than the verdict the filled-in form will get.
+   *
+   * Document-scope candidates are decided against the policy of the document
+   * their input names, not the one passed here: delete and upgrade name it in
+   * `input.documentId`, and the relationship actions in `input.sourceId`. This
+   * follows the executor's own gate, which decides against the document
+   * guarding the write. `CREATE_DOCUMENT` follows the gate's exemption: it runs
+   * before its document exists, so the executor never decides it against a
+   * policy and the preflight predicts allow.
+   *
+   * @param documentIdentifier - Document "id" or "slug" the candidates target
+   * @param branch - Branch to evaluate against
+   * @param candidates - Operations to predict a verdict for, each with the scope it would execute in
+   * @param subject - Optional subject to decide for, defaulting to the client's own signer. A plain subject rather than a ViewFilter: the evaluation reads no view, so a filter's branch or scopes would be silently ignored here
+   * @param signal - Optional abort signal to cancel the request
+   * @returns One evaluation per candidate, in the order given, with the aggregates over them
+   * @throws AuthEnforcementDisabledError if the reactor's authEnforcement flag is off, in which case it holds no decision model and the legacy host-table permission system cannot answer for one
+   */
+  evaluateActions(documentIdentifier: string, branch: string, candidates: ActionCandidate[], subject?: AuthSubject, signal?: AbortSignal): Promise<ActionEvaluations>;
   /**
    * Creates a document and waits for completion
    *
@@ -1707,6 +2050,38 @@ interface IReactorClient {
    * @param signal - Optional abort signal to cancel the request
    */
   createEmpty<TDocument extends PHDocument>(documentModelType: string, options?: CreateDocumentOptions, signal?: AbortSignal): Promise<TDocument>;
+  /**
+   * Retrieves the document model module matching the version a document is
+   * stamped with. Use this instead of {@link getDocumentModelModule}
+   * whenever a specific document is in hand: the latest-wins lookup feeds
+   * not-yet-upgraded documents the wrong reducer, diverging from replay.
+   *
+   * @param document - The document whose stamped version selects the module
+   * @returns The document model module registered for that version
+   * @throws UnsupportedDocumentModelVersionError if no module is registered for the stamped version
+   */
+  getDocumentModelModuleForDocument(document: PHDocument): Promise<DocumentModelModule<any>>;
+  /**
+   * Upgrades a document to a newer document model version by dispatching an
+   * UPGRADE_DOCUMENT action. When toVersion is omitted, upgrades to the
+   * latest registered module version for the document's type. Returns the
+   * document unchanged when it is already at the target version.
+   *
+   * The action carries a snapshot of the document's version and per-scope
+   * revisions, which the executor validates before persisting. When an edit
+   * lands between the read and the upgrade executing, the upgrade is
+   * rejected and retried with a fresh read up to
+   * {@link UpgradeDocumentOptions.maxConflictRetries} times before the
+   * conflict is surfaced.
+   *
+   * @param documentIdentifier - Target document id or slug
+   * @param toVersion - Optional target document model version; defaults to latest
+   * @param options - Optional upgrade options (maxConflictRetries)
+   * @param signal - Optional abort signal to cancel the request
+   * @returns The upgraded document
+   * @throws DowngradeNotSupportedError if toVersion is less than the document's current version
+   */
+  upgradeDocument<TDocument extends PHDocument = PHDocument>(documentIdentifier: string, toVersion?: number, options?: UpgradeDocumentOptions, signal?: AbortSignal): Promise<TDocument>;
   /**
    * Creates an empty document in a drive as a single batched operation.
    * This is more efficient than createEmpty + addFile as it batches all
@@ -1863,136 +2238,1043 @@ interface IReactorClient {
   subscribe(search: SearchFilter, callback: (event: DocumentChangeEvent) => void, view?: ViewFilter): () => void;
 }
 //#endregion
-//#region src/client/reactor-client.d.ts
+//#region src/cache/collection-membership-cache.d.ts
+interface ICollectionMembershipCache {
+  getCollectionsForDocuments(documentIds: string[]): Promise<Record<string, string[]>>;
+  invalidate(documentId: string): void;
+}
+//#endregion
+//#region src/cache/document-meta-cache-types.d.ts
 /**
- * ReactorClient implementation that wraps lower-level APIs to provide
- * a simpler interface for document operations.
+ * Cached document metadata from the "document" scope.
  *
- * Features:
- * - Wraps Jobs with Promises for easier async handling
- * - Manages signing of submitted Action objects
- * - Provides quality-of-life functions for common tasks
- * - Wraps subscription interface with ViewFilters
+ * This lightweight structure holds essential document information needed by
+ * the job executor without fetching full scope state. It provides an explicit
+ * cross-scope contract for accessing document scope metadata.
  */
-declare class ReactorClient implements IReactorClient {
-  private logger;
-  private reactor;
-  private signer;
-  private subscriptionManager;
-  private jobAwaiter;
-  private documentIndexer;
-  private documentView;
-  readonly drives: IDriveClient;
-  constructor(logger: ILogger, reactor: IReactor, signer: ISigner, subscriptionManager: IReactorSubscriptionManager, jobAwaiter: IJobAwaiter, documentIndexer: IDocumentIndexer, documentView: IDocumentView);
+type CachedDocumentMeta = {
   /**
-   * Retrieves a list of document model modules.
+   * The full PHDocumentState from document.state.document.
+   * Contains version, hash, isDeleted, deletedAtUtcIso, etc.
    */
-  getDocumentModelModules(namespace?: string, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<DocumentModelModule>>;
+  state: PHDocumentState;
   /**
-   * Retrieves a specific document model module by document type.
-   *
-   * @param documentType - The document type identifier
-   * @returns The document model module
+   * The document type (from header), cached for convenience.
    */
-  getDocumentModelModule(documentType: string): Promise<DocumentModelModule<any>>;
+  documentType: string;
   /**
-   * Retrieves a specific PHDocument
+   * The revision of the document scope when this metadata was captured.
+   * Used for cache invalidation and consistency checks.
    */
-  get<TDocument extends PHDocument>(identifier: string, view?: ViewFilter, signal?: AbortSignal): Promise<TDocument>;
+  documentScopeRevision: number;
+};
+/**
+ * Interface for the document metadata cache.
+ *
+ * This cache provides an explicit cross-scope contract for accessing document
+ * scope metadata. It solves the problem where job execution in one scope (e.g.,
+ * "global") needs access to document scope state (version, isDeleted, etc.)
+ * which may be stale in scope-specific caches or keyframes.
+ *
+ * The cache supports:
+ * - Latest metadata retrieval with LRU caching
+ * - Historical metadata reconstruction for reshuffling scenarios
+ * - Eager updates after document scope operations
+ */
+interface IDocumentMetaCache {
   /**
-   * Resolves an identifier (id or slug) to the canonical document id, using the
-   * same lookup as the data path. Resolves against the "main" branch. Throws if
-   * the identifier cannot be resolved or is ambiguous.
+   * Retrieves the LATEST document metadata from cache or rebuilds from operations.
+   *
+   * On cache miss, fetches all document scope operations and reconstructs the
+   * current PHDocumentState by applying UPGRADE_DOCUMENT and DELETE_DOCUMENT
+   * operations.
+   *
+   * @param documentId - The document identifier
+   * @param branch - Branch name
+   * @param signal - Optional abort signal to cancel the operation
+   * @returns The cached or rebuilt document metadata
+   * @throws {Error} "Operation aborted" if signal is aborted
+   * @throws {Error} If document not found (no CREATE_DOCUMENT operation)
    */
-  resolveIdOrSlug(identifier: string, signal?: AbortSignal): Promise<string>;
+  getDocumentMeta(documentId: string, branch: string, signal?: AbortSignal): Promise<CachedDocumentMeta>;
   /**
-   * Retrieves operations for a document
+   * Rebuilds document metadata at a SPECIFIC revision (always rebuilds, no caching).
+   *
+   * Used during reshuffling when operations need to be inserted at a previous
+   * revision and we need the document scope state as of that point in time.
+   *
+   * @param documentId - The document identifier
+   * @param branch - Branch name
+   * @param targetRevision - The document scope revision to reconstruct up to
+   * @param signal - Optional abort signal to cancel the operation
+   * @returns Document metadata as of the target revision
+   * @throws {Error} "Operation aborted" if signal is aborted
+   * @throws {Error} If document not found
    */
-  getOperations(documentIdentifier: string, view?: ViewFilter, filter?: OperationFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Operation>>;
-  private getOperationsWithCompositeCursor;
+  rebuildAtRevision(documentId: string, branch: string, targetRevision: number, signal?: AbortSignal): Promise<CachedDocumentMeta>;
   /**
-   * Retrieves outgoing relationships of a given type from a source document.
+   * Eagerly updates cached metadata after document scope operations.
+   *
+   * Called by the job executor after CREATE_DOCUMENT, UPGRADE_DOCUMENT, or
+   * DELETE_DOCUMENT operations to keep the cache current.
+   *
+   * @param documentId - The document identifier
+   * @param branch - Branch name
+   * @param meta - The new metadata to cache
    */
-  getOutgoingRelationships(sourceIdentifier: string, relationshipType: string, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
+  putDocumentMeta(documentId: string, branch: string, meta: CachedDocumentMeta): void;
   /**
-   * Retrieves incoming relationships of a given type to a target document.
+   * Invalidates cached document metadata.
+   *
+   * Call before reshuffling operations that modify the document scope, or
+   * when document state may have changed externally.
+   *
+   * @param documentId - The document identifier
+   * @param branch - Optional branch to narrow invalidation (if omitted, all branches)
+   * @returns Number of entries invalidated
    */
-  getIncomingRelationships(targetIdentifier: string, relationshipType: string, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
+  invalidate(documentId: string, branch?: string): number;
   /**
-   * Filters documents by criteria and returns a list of them
+   * Clears all cached document metadata.
    */
-  find(search: SearchFilter, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
+  clear(): void;
   /**
-   * Creates a document and waits for completion
+   * Performs startup initialization.
    */
-  create<TDocument extends PHDocument = PHDocument>(document: PHDocument, parentIdentifier?: string, signal?: AbortSignal): Promise<TDocument>;
+  startup(): Promise<void>;
+  /**
+   * Performs graceful shutdown.
+   */
+  shutdown(): Promise<void>;
+}
+//#endregion
+//#region src/storage/kysely/types.d.ts
+interface OperationTable {
+  id: Generated<number>;
+  jobId: string;
+  opId: string;
+  prevOpId: string;
+  writeTimestampUtcMs: Generated<Date>;
+  documentId: string;
+  documentType: string;
+  scope: string;
+  branch: string;
+  timestampUtcMs: Date;
+  index: number;
+  action: unknown;
+  skip: number;
+  error?: string | null;
+  deniedReason?: string | null;
+  hash: string;
+}
+interface KeyframeTable {
+  id: Generated<number>;
+  documentId: string;
+  documentType: string;
+  scope: string;
+  branch: string;
+  revision: number;
+  document: unknown;
+  createdAt: Generated<Date>;
+}
+interface DocumentCollectionTable {
+  documentId: string;
+  collectionId: string;
+  joinedOrdinal: bigint;
+  leftOrdinal: bigint | null;
+}
+interface OperationIndexOperationTable {
+  ordinal: Generated<number>;
+  opId: string;
+  documentId: string;
+  documentType: string;
+  scope: string;
+  branch: string;
+  timestampUtcMs: string;
+  writeTimestampUtcMs: Generated<Date>;
+  index: number;
+  skip: number;
+  hash: string;
+  action: unknown;
+  deniedReason?: string | null;
+  sourceRemote: Generated<string>;
+}
+interface SyncRemoteTable {
+  name: string;
+  collection_id: string;
+  channel_type: string;
+  channel_id: string;
+  remote_name: string;
+  channel_parameters: unknown;
+  filter_document_ids: unknown;
+  filter_scopes: unknown;
+  filter_branch: string;
+  push_state: string;
+  push_last_success_utc_ms: string | null;
+  push_last_failure_utc_ms: string | null;
+  push_failure_count: number;
+  pull_state: string;
+  pull_last_success_utc_ms: string | null;
+  pull_last_failure_utc_ms: string | null;
+  pull_failure_count: number;
+  bound_address: string | null;
+  created_at: Generated<Date>;
+  updated_at: Generated<Date>;
+}
+interface SyncCursorTable {
+  remote_name: string;
+  cursor_type: string;
+  cursor_ordinal: bigint;
+  last_synced_at_utc_ms: string | null;
+  updated_at: Generated<Date>;
+}
+/**
+ * Kysely table definition for the `sync_dead_letters` table.
+ */
+interface SyncDeadLetterTable {
+  ordinal: Generated<number>;
+  id: string;
+  job_id: string;
+  job_dependencies: unknown;
+  remote_name: string;
+  document_id: string;
+  scopes: unknown;
+  branch: string;
+  operations: unknown;
+  error_source: string;
+  error_message: string;
+  error_type: Generated<string>;
+  created_at: Generated<Date>;
+}
+/**
+ * One (document, group) reference ever discovered from an auth operation's
+ * input. Rows are never updated or deleted (see migration 017).
+ */
+interface GroupReferenceTable {
+  documentId: string;
+  groupId: string;
+}
+interface Database$1 {
+  Operation: OperationTable;
+  Keyframe: KeyframeTable;
+  document_collections: DocumentCollectionTable;
+  operation_index_operations: OperationIndexOperationTable;
+  group_references: GroupReferenceTable;
+  sync_remotes: SyncRemoteTable;
+  sync_cursors: SyncCursorTable;
+  sync_dead_letters: SyncDeadLetterTable;
+}
+interface DocumentTable {
+  id: string;
+  createdAt: Generated<Date>;
+  updatedAt: Generated<Date>;
+}
+interface DocumentRelationshipTable {
+  id: Generated<string>;
+  sourceId: string;
+  targetId: string;
+  relationshipType: string;
+  metadata: unknown;
+  createdAt: Generated<Date>;
+  updatedAt: Generated<Date>;
+}
+interface IndexerStateTable {
+  id: Generated<number>;
+  lastOperationId: number;
+  lastOperationTimestamp: Generated<Date>;
+}
+interface DocumentIndexerDatabase {
+  Document: DocumentTable;
+  DocumentRelationship: DocumentRelationshipTable;
+  IndexerState: IndexerStateTable;
+}
+//#endregion
+//#region src/executor/worker/protocol.d.ts
+/**
+ * A JSON-clonable value safe to send across the worker IPC boundary.
+ *
+ * The shape mirrors the structured-clone subset used by the parent's
+ * sanitizer: primitives, arrays, plain objects, plus the explicit
+ * {@link ErrorInfo} shape for marshalled Errors.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type SanitizedArg = null | boolean | number | string | ErrorInfo | SanitizedArg[] | {
+  [key: string]: SanitizedArg;
+};
+/**
+ * Structured representation of an Error for IPC transport.
+ *
+ * Class instances cannot be structured-cloned across worker boundaries,
+ * so Errors are flattened into this shape on the worker side and
+ * reconstructed on the parent side.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type ErrorInfo = {
+  name: string;
+  message: string;
+  stack?: string;
+  cause?: ErrorInfo;
+};
+/**
+ * Reference to a module that the worker should `import()` at runtime,
+ * along with the named export to pluck out as the factory.
+ *
+ * Exactly one of `packageName` or `filePath` is provided.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type ModuleRef = {
+  /** Bare-specifier package name (resolved by the worker's module loader). */packageName: string; /** Named export within the module to invoke as the factory. */
+  exportName: string;
+} | {
+  /** Absolute or worker-resolvable file path to import. */filePath: string; /** Named export within the module to invoke as the factory. */
+  exportName: string;
+};
+/**
+ * Factory specification shared by the signature verifier and document
+ * model spec channels. The worker imports `module.exportName` and invokes
+ * it with `initArgs` to obtain the actual instance.
+ *
+ * `initArgs` must be JSON-clonable.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type FactorySpec = {
+  module: ModuleRef;
+  initArgs?: SanitizedArg;
+};
+/**
+ * Factory spec for the signature verifier the worker should instantiate.
+ *
+ * Structurally identical to {@link FactorySpec}; the alias exists so call
+ * sites read intent-fully.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type SignatureVerifierSpec = FactorySpec;
+/**
+ * Factory spec for a document model module the worker should instantiate.
+ *
+ * Structurally identical to {@link FactorySpec}; the alias exists so call
+ * sites read intent-fully.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type DocumentModelSpec = FactorySpec;
+/**
+ * One entry in the document model manifest the worker materializes on
+ * startup (or extends lazily via `load-model`).
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type ModelManifestEntry = {
+  /** Document type identifier (e.g. "ph/account"). */documentType: string; /** Document model version this entry registers. */
+  version: string; /** Factory spec the worker imports and invokes to obtain the model. */
+  spec: DocumentModelSpec;
+};
+/**
+ * JSON-clonable Postgres connection info passed to the worker so it can
+ * open its own pool. Storage-specific wiring may extend this shape in
+ * later phases.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type DbConfig = {
+  host: string;
+  port: number;
+  database: string;
+  user: string;
+  password: string;
+  ssl?: boolean;
+  applicationName?: string;
+  poolSize?: number;
+  /**
+   * Maximum time (ms) a caller will wait to acquire a connection from the
+   * pool before pg.Pool throws. When omitted, pg defaults to 0 (unlimited
+   * wait), which hides acquire-starvation as silent latency.
+   */
+  connectionTimeoutMillis?: number;
+  /**
+   * How long (ms) an idle connection stays open before pg closes it. When
+   * omitted, pg defaults to 10000.
+   */
+  idleTimeoutMillis?: number;
+};
+/**
+ * Configuration for the executor worker pool.
+ *
+ * Mirrors the `workerPool` sub-config on {@link JobExecutorConfig};
+ * a later card wires this into the executor config.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type WorkerPoolConfig = {
+  /** Whether the worker pool is active; when false the executor runs in-process. */enabled: boolean; /** Number of worker instances to spawn. */
+  numWorkers: number; /** Worker isolation mode. */
+  workerType: "thread" | "process"; /** Optional heartbeat interval in milliseconds. */
+  heartbeatMs?: number; /** Optional per-worker Postgres pool size override. */
+  workerPgPoolSize?: number;
+};
+/**
+ * Payload the worker reports back when a job's write phase is complete.
+ *
+ * Parent fills `collectionMemberships` at emission time, so it is
+ * intentionally absent from the worker -> parent message.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type JobWriteReadyPayload = {
+  operations: OperationWithContext$1[];
+  jobMeta: JobMeta;
+};
+/**
+ * Initializes a freshly spawned worker with the configuration and
+ * factories it needs to start executing jobs.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type InitMessage = {
+  type: "init";
+  correlationId: string;
+  workerId: string;
+  poolConfig: WorkerPoolConfig;
+  db: DbConfig; /** Omitted = the worker performs no executor-side signature verification. */
+  signatureVerifier?: SignatureVerifierSpec;
+  models: ModelManifestEntry[]; /** Omitted = the worker builds its executor with the built-in defaults. */
+  executorConfig?: JobExecutorConfig;
+};
+/**
+ * Dispatches a job to the worker for execution.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type ExecuteMessage = {
+  type: "execute";
+  correlationId: string;
+  job: Job;
+};
+/**
+ * Requests cancellation of an in-flight job.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type AbortMessage = {
+  type: "abort";
+  correlationId: string; /** correlationId of the `execute` message being aborted. */
+  targetCorrelationId: string;
+  reason?: string;
+};
+/**
+ * Asks the worker to drain in-flight work and exit.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type ShutdownMessage = {
+  type: "shutdown";
+  correlationId: string; /** Optional grace period before the parent force-terminates the worker. */
+  graceMs?: number;
+};
+/**
+ * Lazily registers an additional document model on a running worker.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type LoadModelMessage = {
+  type: "load-model";
+  correlationId: string;
+  model: ModelManifestEntry;
+};
+/**
+ * Union of all messages the parent may send to a worker.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type ParentMessage = InitMessage | ExecuteMessage | AbortMessage | ShutdownMessage | LoadModelMessage;
+/**
+ * Announces that the worker has finished `init` and is ready to accept
+ * `execute` messages.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type ReadyMessage = {
+  type: "ready"; /** correlationId of the originating `init` message. */
+  correlationId: string;
+  workerId: string;
+};
+/**
+ * Final result for an `execute` job.
+ *
+ * On success, `writeReady` carries the operations and job meta the
+ * parent needs to emit `JOB_WRITE_READY`. On failure, `error` is set
+ * and `result.success` is false.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type ResultMessage = {
+  type: "result"; /** correlationId of the originating `execute` message. */
+  correlationId: string;
+  result: JobResult;
+  writeReady?: JobWriteReadyPayload;
+  error?: ErrorInfo;
+};
+/**
+ * Acknowledges that a `load-model` request succeeded.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type ModelLoadedMessage = {
+  type: "model-loaded"; /** correlationId of the originating `load-model` message. */
+  correlationId: string;
+  documentType: string;
+  version: string;
+};
+/**
+ * Reports that a `load-model` request failed.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type ModelLoadFailedMessage = {
+  type: "model-load-failed"; /** correlationId of the originating `load-model` message. */
+  correlationId: string;
+  documentType: string;
+  version: string;
+  error: ErrorInfo;
+};
+/**
+ * Forwarded log line from the worker. `args` is constrained to
+ * {@link SanitizedArg} so callers cannot accidentally ship non-clonable
+ * values across the boundary.
+ *
+ * The sanitizer in `./sanitize.ts` enforces the {@link SanitizedArg}
+ * invariant on the producer side before each message is posted.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type LogMessage = {
+  type: "log";
+  level: "debug" | "info" | "warn" | "error";
+  message: string;
+  args: SanitizedArg[]; /** Epoch milliseconds at which the worker generated the log line. */
+  timestamp: number;
+};
+/**
+ * Periodic liveness signal. Included now to unblock Phase-3 scaffolding;
+ * the wiki marks heartbeats as a Phase-5 future extension.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type HeartbeatMessage = {
+  type: "heartbeat";
+  workerId: string; /** Epoch milliseconds the worker generated the heartbeat. */
+  timestamp: number; /** Optional snapshot of in-flight job correlation ids. */
+  inFlightCorrelationIds?: string[];
+};
+/**
+ * Periodic counters / gauges the worker reports for observability.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type MetricsMessage = {
+  type: "metrics";
+  workerId: string; /** Epoch milliseconds the worker generated the metrics snapshot. */
+  timestamp: number;
+  counters: {
+    [name: string]: number;
+  };
+  gauges: {
+    [name: string]: number;
+  };
+};
+/**
+ * Snapshot of one worker pool's acquire-wait samples and pool-stat counters,
+ * forwarded periodically so the host can re-record into the shared
+ * pg.Pool histogram and observable gauges. The worker owns the real
+ * pg.Pool; the host's {@link PoolInstrumentation} is a forwarder driven
+ * by these messages.
+ */
+type PoolAcquireSamplesMessage = {
+  type: "pool-acquire-samples";
+  workerId: string; /** Stable identifier matching the host-side instrumentation name (e.g. "worker-0"). */
+  poolName: string; /** Epoch milliseconds the worker generated the batch. */
+  timestamp: number; /** Acquire-wait durations (ms) accumulated since the previous batch. */
+  durations: number[]; /** Most recent pg.Pool counter snapshot at batch send time. */
+  size: number;
+  idle: number;
+  waiting: number;
+};
+/**
+ * Union of all messages a worker may send to the parent.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type WorkerMessage = ReadyMessage | ResultMessage | ModelLoadedMessage | ModelLoadFailedMessage | LogMessage | HeartbeatMessage | MetricsMessage | PoolAcquireSamplesMessage;
+//#endregion
+//#region src/core/model-sources.d.ts
+/** An importable file holding one or more document-model exports. */
+type FileModelSource = {
+  filePath: string;
+  exportName?: string;
+};
+/** An importable package specifier holding one or more document-model exports. */
+type PackageModelSource = {
+  packageName: string;
+  subpath?: string;
+  exportName?: string;
+};
+/**
+ * A source of document models: a live module, an importable file, or an
+ * importable package. File and package sources can cross a worker-thread
+ * boundary (workers re-import them); a live module cannot.
+ */
+type DocumentModelSource = DocumentModelModule<any> | FileModelSource | PackageModelSource;
+//#endregion
+//#region src/registry/interfaces.d.ts
+type RegistrationResult<T> = {
+  status: "success";
+  item: T;
+} | {
+  status: "error";
+  item: T;
+  error: Error;
+};
+/**
+ * Loader that asynchronously resolves a document type to a
+ * {@link DocumentModelSource}. Used by the queue to gate CREATE_DOCUMENT
+ * jobs until the required model is available in the registry.
+ *
+ * Return an importable source ({ filePath } or { packageName }) whenever
+ * possible: the resolver registers the resolved models on the host registry
+ * and broadcasts importable sources to executor workers. A live
+ * DocumentModelModule is also valid but host-only — it cannot cross a
+ * worker-thread boundary, so worker pools will not receive it.
+ */
+interface IDocumentModelLoader {
+  load(documentType: string): Promise<DocumentModelSource>;
+}
+/**
+ * Registry for managing document model modules.
+ * Provides centralized access to document models' reducers, utils, and specifications.
+ * Supports version-aware module storage and upgrade manifest management.
+ */
+interface IDocumentModelRegistry {
+  /**
+   * Register multiple modules at once.
+   * Modules without a version field default to version 1.
+   * Invalid or duplicate modules are skipped without breaking registration of the remaining modules.
+   *
+   * @param modules Document model modules to register
+   * @returns Array of results, one per module, indicating success or failure
+   */
+  registerModules(...modules: DocumentModelModule<any>[]): RegistrationResult<DocumentModelModule<any>>[];
+  /**
+   * Unregister all versions of the specified document types.
+   *
+   * @param documentTypes The document types to unregister
+   * @returns true if all modules were unregistered, false if any were not found
+   */
+  unregisterModules(...documentTypes: string[]): boolean;
+  /**
+   * Get a specific document model module by document type and optional version.
+   * If version is not specified, returns the latest version.
+   *
+   * @param documentType The document type identifier
+   * @param version Optional version number to retrieve
+   * @returns The document model module
+   * @throws ModuleNotFoundError if the document type or version is not registered
+   */
+  getModule(documentType: string, version?: number): DocumentModelModule<any>;
+  /**
+   * Get all registered document model modules.
+   *
+   * @returns Array of all registered modules
+   */
+  getAllModules(): DocumentModelModule<any>[];
+  /**
+   * Clear all registered modules and upgrade manifests.
+   */
+  clear(): void;
+  /**
+   * Get all supported versions for a document type, sorted in ascending order.
+   *
+   * @param documentType The document type identifier
+   * @returns Array of version numbers sorted ascending
+   * @throws ModuleNotFoundError if no modules are registered for the document type
+   */
+  getSupportedVersions(documentType: string): number[];
+  /**
+   * Get the latest (highest) version number for a document type.
+   *
+   * @param documentType The document type identifier
+   * @returns The highest version number registered for this document type
+   * @throws ModuleNotFoundError if no modules are registered for the document type
+   */
+  getLatestVersion(documentType: string): number;
   /**
-   * Creates an empty document and waits for completion
+   * Register upgrade manifests that define upgrade paths between versions.
+   * Invalid or duplicate manifests are skipped without breaking registration of the remaining manifests.
+   *
+   * @param manifests Upgrade manifests to register
+   * @returns Array of results, one per manifest, indicating success or failure
    */
-  createEmpty<TDocument extends PHDocument>(documentModelType: string, options?: CreateDocumentOptions, signal?: AbortSignal): Promise<TDocument>;
+  registerUpgradeManifests(...manifests: UpgradeManifest<readonly number[]>[]): RegistrationResult<UpgradeManifest<readonly number[]>>[];
   /**
-   * Creates an empty document in a drive as a single batched operation.
-   * Delegates to {@link IDriveClient.addFile}.
+   * Unregister upgrade manifests for the specified document types.
+   * @param documentTypes The document types whose upgrade manifests should be unregistered
+   * @returns true if all modules were unregistered, false if any were not found
+   **/
+  unregisterUpgradeManifests(...documentTypes: string[]): boolean;
+  /**
+   * Get the upgrade manifest for a document type.
    *
-   * @deprecated Use `client.drives.addFile` instead. This method will be
-   * removed in a future release.
+   * @param documentType The document type identifier
+   * @returns The upgrade manifest
+   * @throws ManifestNotFoundError if no manifest is registered for the document type
    */
-  createDocumentInDrive<TDocument extends PHDocument>(driveId: string, document: PHDocument, parentFolder?: string, signal?: AbortSignal): Promise<TDocument>;
+  getUpgradeManifest(documentType: string): UpgradeManifest<readonly number[]>;
   /**
-   * Applies a list of actions to a document and waits for completion
+   * Compute the upgrade path from one version to another.
+   * Returns the sequence of upgrade transitions needed.
+   *
+   * @param documentType The document type identifier
+   * @param fromVersion The starting version
+   * @param toVersion The target version
+   * @returns Array of upgrade transitions in order
+   * @throws DowngradeNotSupportedError if toVersion is less than fromVersion
+   * @throws ManifestNotFoundError if no upgrade manifest is registered
+   * @throws MissingUpgradeTransitionError if any transition in the path is missing
    */
-  execute<TDocument extends PHDocument>(documentIdentifier: string, branch: string, actions: Action[], signal?: AbortSignal): Promise<TDocument>;
+  computeUpgradePath(documentType: string, fromVersion: number, toVersion: number): UpgradeTransition[];
   /**
-   * Submits a list of actions to a document
+   * Get the upgrade reducer for a single-step version transition.
+   *
+   * @param documentType The document type identifier
+   * @param fromVersion The starting version
+   * @param toVersion The target version (must be fromVersion + 1)
+   * @returns The upgrade reducer function
+   * @throws InvalidUpgradeStepError if toVersion is not fromVersion + 1
+   * @throws ManifestNotFoundError if no upgrade manifest is registered
+   * @throws MissingUpgradeTransitionError if the transition is not found
    */
-  executeAsync(documentIdentifier: string, branch: string, actions: Action[], signal?: AbortSignal): Promise<JobInfo>;
-  executeBatch(request: BatchExecutionRequest, signal?: AbortSignal): Promise<BatchExecutionResult>;
+  getUpgradeReducer(documentType: string, fromVersion: number, toVersion: number): UpgradeReducer<any, any>;
+}
+//#endregion
+//#region src/cache/buffer/ring-buffer.d.ts
+/**
+ * RingBuffer is a generic circular buffer implementation that stores a fixed number
+ * of items. When the buffer is full, new items overwrite the oldest items.
+ *
+ * This implementation maintains O(1) time complexity for push operations and provides
+ * items in chronological order (oldest to newest) via getAll().
+ *
+ * @template T - The type of items stored in the buffer
+ */
+declare class RingBuffer<T> {
+  private buffer;
+  private head;
+  private size;
+  private capacity;
+  constructor(capacity: number);
   /**
-   * Renames a document and waits for completion
+   * Adds an item to the buffer. If the buffer is full, overwrites the oldest item.
+   *
+   * @param item - The item to add
    */
-  rename(documentIdentifier: string, name: string, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
+  push(item: T): void;
   /**
-   * Updates the preferred editor recorded in the document header meta.
-   * Pass `null` to clear it.
+   * Returns all items in the buffer in chronological order (oldest to newest).
+   *
+   * @returns Array of items in insertion order
    */
-  setPreferredEditor(documentIdentifier: string, preferredEditor: string | null, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
+  getAll(): T[];
   /**
-   * Adds multiple documents as children to another and waits for completion
+   * Clears all items from the buffer.
    */
-  addRelationship(sourceIdentifier: string, targetIdentifier: string, relationshipType: string, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
+  clear(): void;
   /**
-   * Removes a relationship between two documents and waits for completion.
+   * Gets the current number of items in the buffer.
    */
-  removeRelationship(sourceIdentifier: string, targetIdentifier: string, relationshipType: string, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
+  get length(): number;
+}
+//#endregion
+//#region src/cache/kysely-write-cache.d.ts
+type DocumentStream = {
+  key: string;
+  ringBuffer: RingBuffer<CachedSnapshot>;
+};
+/**
+ * In-memory write cache with keyframe persistence for PHDocuments.
+ *
+ * Caches document snapshots in ring buffers with LRU eviction. On cache miss,
+ * rebuilds documents from nearest keyframe or full operation history.
+ *
+ * **Performance Characteristics:**
+ * - Cache hit: O(1) lookup in ring buffer
+ * - Cold miss: O(n) where n is total operation count, or O(k) where k is operations since keyframe
+ * - Warm miss: O(m) where m is operations since cached revision
+ * - Eviction: O(1) for LRU tracking and removal
+ *
+ * **Thread Safety:**
+ * Not thread-safe. Designed for single-threaded job executor environment.
+ * External synchronization required for concurrent access across multiple executors.
+ *
+ * **Example:**
+ * ```typescript
+ * const cache = new KyselyWriteCache(
+ *   keyframeStore,
+ *   operationStore,
+ *   registry,
+ *   { maxDocuments: 1000, ringBufferSize: 10, keyframeInterval: 10 }
+ * );
+ *
+ * await cache.startup();
+ *
+ * // Retrieve or rebuild document
+ * const doc = await cache.getState(docId, docType, scope, branch, revision);
+ *
+ * // Cache result after job execution
+ * cache.putState(docId, docType, scope, branch, newRevision, updatedDoc);
+ *
+ * await cache.shutdown();
+ * ```
+ */
+declare class KyselyWriteCache implements IWriteCache {
+  private streams;
+  private lruTracker;
+  private keyframeStore;
+  private operationStore;
+  private registry;
+  private config;
+  constructor(keyframeStore: IKeyframeStore, operationStore: IOperationStore, registry: IDocumentModelRegistry, config: WriteCacheConfig);
+  withScopedStores(operationStore: IOperationStore, keyframeStore: IKeyframeStore): KyselyWriteCache;
   /**
-   * Moves a relationship from one source document to another and waits for completion.
+   * Initializes the write cache.
+   * Currently a no-op as keyframe store lifecycle is managed externally.
    */
-  moveRelationship(sourceParentIdentifier: string, targetParentIdentifier: string, targetIdentifier: string, relationshipType: string, branch?: string, signal?: AbortSignal): Promise<{
-    source: PHDocument;
-    target: PHDocument;
-  }>;
-  loadBatch(request: BatchLoadRequest, signal?: AbortSignal): Promise<BatchLoadResult>;
+  startup(): Promise<void>;
   /**
-   * Deletes a document and waits for completion
+   * Shuts down the write cache.
+   * Currently a no-op as keyframe store lifecycle is managed externally.
    */
-  deleteDocument(identifier: string, propagate?: PropagationMode, signal?: AbortSignal): Promise<void>;
+  shutdown(): Promise<void>;
   /**
-   * Deletes documents and waits for completion
+   * Retrieves document state at a specific revision from cache or rebuilds it.
+   *
+   * Note: this returns a _shallow_ copy of the document.
+   *
+   * Cache hit path: Returns cached snapshot if available (O(1))
+   * Warm miss path: Rebuilds from cached base revision + incremental ops
+   * Cold miss path: Rebuilds from keyframe or from scratch using all operations
+   *
+   * @param documentId - The document identifier
+   * @param scope - The operation scope
+   * @param branch - The operation branch
+   * @param targetRevision - The target revision, or undefined for newest
+   * @param signal - Optional abort signal to cancel the operation
+   * @returns The document at the target revision
+   * @throws {Error} "Operation aborted" if signal is aborted
+   * @throws {ModuleNotFoundError} If document type not registered in registry
+   * @throws {Error} "Failed to rebuild document" if operation store fails
+   * @throws {Error} If reducer throws during operation application
+   * @throws {Error} If document serialization fails
    */
-  deleteDocuments(identifiers: string[], propagate?: PropagationMode, signal?: AbortSignal): Promise<void>;
+  getState(documentId: string, scope: string, branch: string, targetRevision?: number, signal?: AbortSignal): Promise<PHDocument>;
   /**
-   * Retrieves the status of a job
+   * Stores a document snapshot in the cache at a specific revision.
+   *
+   * The cached document is a shallow copy of the input with its operation history
+   * truncated to the last operation per scope and its clipboard cleared. This keeps
+   * memory use and copy costs constant regardless of operation count. Consumers of
+   * getState() must not rely on the full operation history being present; the only
+   * guaranteed invariant is that operations[scope].at(-1) reflects the latest
+   * operation index for each scope.
+   *
+   * Updates LRU tracker and may evict least recently used stream if at capacity.
+   * Asynchronously persists keyframes at configured intervals (fire-and-forget).
+   *
+   * @param documentId - The document identifier
+   * @param scope - The operation scope
+   * @param branch - The operation branch
+   * @param revision - The revision number
+   * @param document - The document to cache
+   * @throws {Error} If document serialization fails
    */
-  getJobStatus(jobId: string, signal?: AbortSignal): Promise<JobInfo>;
+  putState(documentId: string, scope: string, branch: string, revision: number, document: PHDocument, position: SnapshotPosition): void;
+  private store;
+  /**
+   * Invalidates cached document streams.
+   *
+   * Supports three invalidation scopes:
+   * - Document-level: invalidate(documentId) - removes all streams for document
+   * - Scope-level: invalidate(documentId, scope) - removes all branches for scope
+   * - Stream-level: invalidate(documentId, scope, branch) - removes specific stream
+   *
+   * @param documentId - The document identifier
+   * @param scope - Optional scope to narrow invalidation
+   * @param branch - Optional branch to narrow invalidation (requires scope)
+   * @returns The number of streams evicted
+   */
+  invalidate(documentId: string, scope?: string, branch?: string): number;
+  /**
+   * Clears the entire cache, removing all cached document streams.
+   * Resets LRU tracking state. This operation always succeeds.
+   */
+  clear(): void;
+  /**
+   * Retrieves a specific stream for a document. Exposed on the implementation
+   * for testing, but not on the interface.
+   *
+   * @internal
+   */
+  getStream(documentId: string, scope: string, branch: string): DocumentStream | undefined;
+  private findNearestKeyframe;
+  /**
+   * Rebuilds a scope from a keyframe or from the whole operation history.
+   *
+   * The document scope is always rebuilt first, because it carries the type,
+   * the upgrades and the deletion marker. Its version-changing upgrades are not
+   * applied there though: an upgrade reducer must see the state the requested
+   * scope has reached at that upgrade's boundary, so each one is held back and
+   * applied when the replay below crosses the boundary that
+   * resolveModuleVersionForOp derives from it. Upgrades whose boundary lies past
+   * the last replayed operation are applied at the end. Creation-time 0->N seed
+   * upgrades carry the initial state, so they still apply immediately.
+   */
+  private coldMissRebuild;
+  /**
+   * Applies and removes every held-back upgrade whose target version is at or
+   * below `throughVersion`, in the order the document scope recorded them.
+   */
+  private applyPendingUpgrades;
+  /**
+   * Applies the remaining held-back upgrades after the requested scope's
+   * replay has finished. A head read applies them all. A positional read
+   * applies only those whose boundary for this scope lies at or before the
+   * target position: applying a later one would label migrated state with a
+   * pre-upgrade revision, and a keyframe stored from that poisons every
+   * rebuild that resumes from it. Boundaries come from the upgrade's revision
+   * snapshot; an upgrade without one records no position for this scope, and
+   * the replay loop not having crossed it already places it past the target.
+   */
+  private applyTailPendingUpgrades;
+  /**
+   * Applies one held-back upgrade, then re-applies the deletes the document
+   * scope recorded after it so the hold-back cannot invert their order.
+   */
+  private applyPendingUpgrade;
+  /**
+   * Copies the current document revisions onto the document. Overwrites the
+   * requested scope revision with the target revision, if provided.
+   */
+  private stampRevisions;
+  /** The stored operation at `index`, or undefined if it is no longer there. */
+  private operationAt;
+  /**
+   * Resolves which module version to use for a given operation in phase 2.
+   *
+   * Uses the validated-upgrade boundary rules from D7:
+   * - If `input.revision` is present: op.index < revision[scope] → before the upgrade boundary
+   * - Otherwise: timestamp fallback
+   * - Falls back to final module version when neither is decidable
+   */
+  private resolveModuleVersionForOp;
+  private warmMissRebuild;
+  private findNearestOlderSnapshot;
+  private makeStreamKey;
+  private getOrCreateStream;
+  private isKeyframeRevision;
+}
+//#endregion
+//#region src/storage/kysely/store.d.ts
+declare class KyselyOperationStore implements IOperationStore {
+  private db;
+  private trx?;
+  constructor(db: Kysely<Database$1>);
+  private get queryExecutor();
+  withTransaction(trx: Transaction<Database$1>): KyselyOperationStore;
+  apply(documentId: string, documentType: string, scope: string, branch: string, revision: number, fn: (txn: AtomicTxn) => void | Promise<void>, signal?: AbortSignal, condition?: AppendCondition): Promise<Operation[]>;
+  private resolveUniqueConstraint;
+  private executeApply;
   /**
-   * Waits for a job to complete
+   * Locks the written stream and every read-set stream, in sorted key order
+   * so that overlapping concurrent appends serialize rather than deadlock.
+   * The locks are still taken one row at a time, so the query preserves that
+   * order. It must stay separate from the guarded insert, which would
+   * otherwise read a snapshot taken before the locks were held.
    */
-  waitForJob(jobId: string | JobInfo, signal?: AbortSignal): Promise<JobInfo>;
+  private acquireStreamLocks;
   /**
-   * Subscribes to changes for documents matching specified filters
+   * Inserts the staged operations with the condition compiled in as a WHERE
+   * NOT EXISTS guard, making the check and the append one statement. Returns
+   * the rows inserted; zero means the guard failed and nothing was written.
    */
-  subscribe(search: SearchFilter, callback: (event: DocumentChangeEvent) => void, view?: ViewFilter): () => void;
-  private removeAllIncomingRelationships;
+  private insertGuarded;
+  private findIdempotentReplay;
+  getSince(documentId: string, scope: string, branch: string, revision: number, filter?: OperationFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Operation>>;
+  getSinceId(id: number, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<OperationWithContext$1>>;
+  getConflicting(documentId: string, scope: string, branch: string, minTimestamp: string, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Operation>>;
+  getRevisions(documentId: string, branch: string, signal?: AbortSignal): Promise<DocumentRevisions>;
+  getStreamLatestTimestamp(documentId: string, scope: string, branch: string, signal?: AbortSignal): Promise<string | undefined>;
+  private rowToOperation;
+  private rowToOperationWithContext;
+}
+//#endregion
+//#region src/storage/kysely/keyframe-store.d.ts
+declare class KyselyKeyframeStore implements IKeyframeStore {
+  private db;
+  private trx?;
+  constructor(db: Kysely<Database$1>);
+  private get queryExecutor();
+  withTransaction(trx: Transaction<Database$1>): KyselyKeyframeStore;
+  putKeyframe(documentId: string, scope: string, branch: string, revision: number, document: PHDocument, signal?: AbortSignal): Promise<void>;
+  findNearestKeyframe(documentId: string, scope: string, branch: string, targetRevision: number, signal?: AbortSignal): Promise<{
+    revision: number;
+    document: PHDocument;
+  } | undefined>;
+  listKeyframes(documentId: string, scope?: string, branch?: string, signal?: AbortSignal): Promise<Array<{
+    scope: string;
+    branch: string;
+    revision: number;
+    document: PHDocument;
+  }>>;
+  deleteKeyframes(documentId: string, scope?: string, branch?: string, signal?: AbortSignal): Promise<number>;
+}
+//#endregion
+//#region src/executor/execution-scope.d.ts
+interface ExecutionStores {
+  operationStore: IOperationStore;
+  operationIndex: IOperationIndex;
+  writeCache: IWriteCache;
+  documentMetaCache: IDocumentMetaCache;
+  collectionMembershipCache: ICollectionMembershipCache;
+}
+interface IExecutionScope {
+  run<T>(fn: (stores: ExecutionStores) => Promise<T>, signal?: AbortSignal): Promise<T>;
 }
 //#endregion
 //#region src/executor/types.d.ts
@@ -2013,13 +3295,48 @@ type JobResult = {
   duration?: number; /** Any additional metadata from the execution */
   metadata?: Record<string, any>;
 };
+/**
+ * Enforcement the reactor performs, each off by default.
+ *
+ * An evaluation made while replaying is part of the document's history, so two
+ * reactors that share documents and disagree on these diverge. A flag is turned
+ * on for a set of reactors that sync with each other, not for one node.
+ */
+type ReactorFeatureFlags = {
+  /**
+   * Decide whether an operation may be admitted by building a decision model
+   * over the document stream, rather than reading the deleted flag from the
+   * document meta cache. Deletion then takes effect from the deleting
+   * operation's position rather than for the whole document.
+   */
+  documentDecisions: boolean;
+  /**
+   * Evaluate the auth policy by reading the auth scope as a second projection.
+   * Requires documentDecisions.
+   */
+  authEnforcement: boolean;
+  /**
+   * Match { group } principals by folding the referenced PHGroup documents as
+   * derived projections. Requires authEnforcement.
+   */
+  authGroups: boolean;
+  /**
+   * Evaluate `where` clauses and { match } principals against the executing
+   * scope's state, the subject, and the action input. Requires authGroups.
+   */
+  authConditions: boolean;
+};
 /**
  * Configuration options for the job executor
  */
 type JobExecutorConfig = {
-  /** Maximum number of conflicting operations to skip when reshuffling. */maxSkipThreshold?: number; /** Maximum number of concurrent jobs to execute */
+  /** Feature flags; anything unset is off. */featureFlags?: Partial<ReactorFeatureFlags>; /** Maximum number of conflicting operations to skip when reshuffling. */
+  maxSkipThreshold?: number; /** Maximum number of concurrent jobs to execute */
   maxConcurrency?: number; /** Maximum time in milliseconds a job can run before being considered timed out */
-  jobTimeoutMs?: number; /** Base delay in milliseconds for exponential backoff retries */
+  jobTimeoutMs?: number;
+  /** How long a job whose document is missing waits for it before failing.
+   *  Unbounded deferral never resolves the caller awaiting the job. */
+  deferredJobTtlMs?: number; /** Base delay in milliseconds for exponential backoff retries */
   retryBaseDelayMs?: number; /** Maximum delay in milliseconds for exponential backoff retries */
   retryMaxDelayMs?: number;
   /** Maximum elapsed milliseconds before yielding to the main thread between actions.
@@ -2074,356 +3391,448 @@ type ExecutorStoppedEvent = {
  * Status information for the job executor manager
  */
 type ExecutorManagerStatus = {
-  /** Whether the manager is currently running */isRunning: boolean; /** Number of executor instances managed */
-  numExecutors: number; /** Number of jobs currently being processed */
-  activeJobs: number; /** Total number of jobs processed since start */
-  totalJobsProcessed: number;
-};
-//#endregion
-//#region src/executor/worker/protocol.d.ts
-/**
- * A JSON-clonable value safe to send across the worker IPC boundary.
- *
- * The shape mirrors the structured-clone subset used by the parent's
- * sanitizer: primitives, arrays, plain objects, plus the explicit
- * {@link ErrorInfo} shape for marshalled Errors.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
- */
-type SanitizedArg = null | boolean | number | string | ErrorInfo | SanitizedArg[] | {
-  [key: string]: SanitizedArg;
-};
-/**
- * Structured representation of an Error for IPC transport.
- *
- * Class instances cannot be structured-cloned across worker boundaries,
- * so Errors are flattened into this shape on the worker side and
- * reconstructed on the parent side.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
- */
-type ErrorInfo = {
-  name: string;
-  message: string;
-  stack?: string;
-  cause?: ErrorInfo;
-};
-/**
- * Reference to a module that the worker should `import()` at runtime,
- * along with the named export to pluck out as the factory.
- *
- * Exactly one of `packageName` or `filePath` is provided.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
- */
-type ModuleRef = {
-  /** Bare-specifier package name (resolved by the worker's module loader). */packageName: string; /** Named export within the module to invoke as the factory. */
-  exportName: string;
-} | {
-  /** Absolute or worker-resolvable file path to import. */filePath: string; /** Named export within the module to invoke as the factory. */
-  exportName: string;
-};
-/**
- * Factory specification shared by the signature verifier and document
- * model spec channels. The worker imports `module.exportName` and invokes
- * it with `initArgs` to obtain the actual instance.
- *
- * `initArgs` must be JSON-clonable.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
- */
-type FactorySpec = {
-  module: ModuleRef;
-  initArgs?: SanitizedArg;
-};
-/**
- * Factory spec for the signature verifier the worker should instantiate.
- *
- * Structurally identical to {@link FactorySpec}; the alias exists so call
- * sites read intent-fully.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
- */
-type SignatureVerifierSpec = FactorySpec;
-/**
- * Factory spec for a document model module the worker should instantiate.
- *
- * Structurally identical to {@link FactorySpec}; the alias exists so call
- * sites read intent-fully.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
- */
-type DocumentModelSpec = FactorySpec;
-/**
- * One entry in the document model manifest the worker materializes on
- * startup (or extends lazily via `load-model`).
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
- */
-type ModelManifestEntry = {
-  /** Document type identifier (e.g. "ph/account"). */documentType: string; /** Document model version this entry registers. */
-  version: string; /** Factory spec the worker imports and invokes to obtain the model. */
-  spec: DocumentModelSpec;
-};
-/**
- * JSON-clonable Postgres connection info passed to the worker so it can
- * open its own pool. Storage-specific wiring may extend this shape in
- * later phases.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
- */
-type DbConfig = {
-  host: string;
-  port: number;
-  database: string;
-  user: string;
-  password: string;
-  ssl?: boolean;
-  applicationName?: string;
-  poolSize?: number;
-  /**
-   * Maximum time (ms) a caller will wait to acquire a connection from the
-   * pool before pg.Pool throws. When omitted, pg defaults to 0 (unlimited
-   * wait), which hides acquire-starvation as silent latency.
-   */
-  connectionTimeoutMillis?: number;
-  /**
-   * How long (ms) an idle connection stays open before pg closes it. When
-   * omitted, pg defaults to 10000.
-   */
-  idleTimeoutMillis?: number;
-};
-/**
- * Configuration for the executor worker pool.
- *
- * Mirrors the `workerPool` sub-config on {@link JobExecutorConfig};
- * a later card wires this into the executor config.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
- */
-type WorkerPoolConfig = {
-  /** Whether the worker pool is active; when false the executor runs in-process. */enabled: boolean; /** Number of worker instances to spawn. */
-  numWorkers: number; /** Worker isolation mode. */
-  workerType: "thread" | "process"; /** Optional heartbeat interval in milliseconds. */
-  heartbeatMs?: number; /** Optional per-worker Postgres pool size override. */
-  workerPgPoolSize?: number;
-};
-/**
- * Payload the worker reports back when a job's write phase is complete.
- *
- * Parent fills `collectionMemberships` at emission time, so it is
- * intentionally absent from the worker -> parent message.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
- */
-type JobWriteReadyPayload = {
-  operations: OperationWithContext$1[];
-  jobMeta: JobMeta;
-};
-/**
- * Initializes a freshly spawned worker with the configuration and
- * factories it needs to start executing jobs.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
- */
-type InitMessage = {
-  type: "init";
-  correlationId: string;
-  workerId: string;
-  poolConfig: WorkerPoolConfig;
-  db: DbConfig; /** Omitted = the worker performs no executor-side signature verification. */
-  signatureVerifier?: SignatureVerifierSpec;
-  models: ModelManifestEntry[];
-};
-/**
- * Dispatches a job to the worker for execution.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
- */
-type ExecuteMessage = {
-  type: "execute";
-  correlationId: string;
-  job: Job;
-};
-/**
- * Requests cancellation of an in-flight job.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
- */
-type AbortMessage = {
-  type: "abort";
-  correlationId: string; /** correlationId of the `execute` message being aborted. */
-  targetCorrelationId: string;
-  reason?: string;
+  /** Whether the manager is currently running */isRunning: boolean; /** Number of executor instances managed */
+  numExecutors: number; /** Number of jobs currently being processed */
+  activeJobs: number; /** Total number of jobs processed since start */
+  totalJobsProcessed: number;
+};
+//#endregion
+//#region src/decision/document-decision-model.d.ts
+/** What the document decision model reads: the target's document scope. */
+type DocumentDecisionModel = {
+  document: PHDocumentState;
 };
 /**
- * Asks the worker to drain in-flight work and exit.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * The simplest decision model: one projection over the document scope, which
+ * rejects on a deleted document.
  */
-type ShutdownMessage = {
-  type: "shutdown";
-  correlationId: string; /** Optional grace period before the parent force-terminates the worker. */
-  graceMs?: number;
+declare function documentDecisionModel(target: DecisionTarget): DecisionModel<DocumentDecisionModel>;
+//#endregion
+//#region src/decision/registered-model.d.ts
+/**
+ * A model this reactor can register. Every one carries the document projection,
+ * because admission reads the version and the deletion timestamp off it; a model
+ * with more projections than that is still assignable here.
+ */
+type RegisteredDecisionModel = (target: DecisionTarget) => DecisionModel<DocumentDecisionModel>;
+/** What admission needs out of a model built at the stream heads. */
+type AdmissionDecision = {
+  evaluation: Evaluation;
+  appendCondition: AppendCondition;
+  documentVersion: number;
+  deletedAtUtcIso: string | null;
 };
 /**
- * Lazily registers an additional document model on a running worker.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * What decideAtHead resolves a condition context from: the action's input,
+ * with the executing scope's state read at the head. Supplied only while
+ * authConditions is on.
  */
-type LoadModelMessage = {
-  type: "load-model";
-  correlationId: string;
-  model: ModelManifestEntry;
+type AdmissionConditions = {
+  actionInput?: unknown;
 };
 /**
- * Union of all messages the parent may send to a worker.
+ * Builds the model at the stream heads and decides one request against it. The
+ * append condition it returns is the read-set the store enforces at write time.
  *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * With `conditions` supplied, the executing scope's state is read at the head
+ * for `doc.<scope>.*` paths. That read carries no append-condition entry of
+ * its own: the written stream's expected-revision check already refuses a
+ * write whose scope grew between the read and the append.
  */
-type ParentMessage = InitMessage | ExecuteMessage | AbortMessage | ShutdownMessage | LoadModelMessage;
+declare function decideAtHead(model: RegisteredDecisionModel, cache: IWriteCache, target: DecisionTarget, subject: AuthSubject, request: AuthRequest, signal?: AbortSignal, conditions?: AdmissionConditions): Promise<AdmissionDecision>;
 /**
- * Announces that the worker has finished `init` and is ready to accept
- * `execute` messages.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * The model this reactor enforces. With `authEnforcement` off the auth scope is
+ * absent from every append condition and no load walks it; with `authGroups`
+ * on, the group documents the grant list names join the read-set and the
+ * registry supplies the reducer that folds them.
  */
-type ReadyMessage = {
-  type: "ready"; /** correlationId of the originating `init` message. */
-  correlationId: string;
-  workerId: string;
-};
+declare function selectDecisionModel(flags: ReactorFeatureFlags, registry: IDocumentModelRegistry): RegisteredDecisionModel;
+//#endregion
+//#region src/decision/read-gate.d.ts
 /**
- * Final result for an `execute` job.
- *
- * On success, `writeReady` carries the operations and job meta the
- * parent needs to emit `JOB_WRITE_READY`. On failure, `error` is set
- * and `result.success` is false.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * Scopes every holder of a document may read, whatever the grants say. Denying
+ * the policy itself would let a replica sync a document without it, read the
+ * auth scope as uninitialized, and allow every operation it holds, so replicas
+ * would diverge permanently. The document scope carries the metadata the same
+ * argument covers. Grants gate domain-scope reads only.
  */
-type ResultMessage = {
-  type: "result"; /** correlationId of the originating `execute` message. */
-  correlationId: string;
-  result: JobResult;
-  writeReady?: JobWriteReadyPayload;
-  error?: ErrorInfo;
-};
+declare const ALWAYS_READABLE_SCOPES: ReadonlySet<string>;
 /**
- * Acknowledges that a `load-model` request succeeded.
+ * How a gate treats a document nobody has written a policy onto.
  *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * A host that closes by default owes an uninitialized document the same silence
+ * it owes a denied one, because "no policy yet" and "a policy that allows this"
+ * are indistinguishable to a replica that never receives the scope. The option
+ * exists because that answer belongs to the host serving the read, not to the
+ * document: replay must keep reading an uninitialized document in full, or a
+ * replica would refuse to rebuild state it already holds.
  */
-type ModelLoadedMessage = {
-  type: "model-loaded"; /** correlationId of the originating `load-model` message. */
-  correlationId: string;
-  documentType: string;
-  version: string;
+type ReadGateOptions = {
+  withholdUninitialized: boolean;
 };
+/** Whether a subject may read each scope of one document. */
+interface IReadGate {
+  /**
+   * Resolves, for one document, which of its scopes the subject may read.
+   *
+   * The predicate is resolved up front rather than asked per scope so that the
+   * filtering itself stays synchronous, and so that a model backing the answer
+   * is built once per document instead of once per scope.
+   */
+  scopePredicate(document: PHDocument, subject: AuthSubject, branch: string, signal?: AbortSignal): Promise<(scope: string) => boolean>;
+}
 /**
- * Reports that a `load-model` request failed.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * The model reads enforce. Below `authEnforcement` there is no model to
+ * enforce: the document-only model ignores the auth scope entirely, so reading
+ * through it would serve every domain scope of a policied document to anyone.
+ * Undefined therefore means "evaluate the policy alone", which is what the read
+ * surface did before the model existed.
  */
-type ModelLoadFailedMessage = {
-  type: "model-load-failed"; /** correlationId of the originating `load-model` message. */
-  correlationId: string;
-  documentType: string;
-  version: string;
-  error: ErrorInfo;
-};
+declare function readDecisionModel(flags: ReactorFeatureFlags, registry: IDocumentModelRegistry): RegisteredDecisionModel | undefined;
 /**
- * Forwarded log line from the worker. `args` is constrained to
- * {@link SanitizedArg} so callers cannot accidentally ship non-clonable
- * values across the boundary.
- *
- * The sanitizer in `./sanitize.ts` enforces the {@link SanitizedArg}
- * invariant on the producer side before each message is posted.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * Evaluates the policy on its own, with no groups map and no condition context.
+ * A `{ group }` or conditional grant therefore never applies: an allow that
+ * does not apply withholds access, so this cannot widen a policy, but a policy
+ * relying on a conditional deny is weaker here than it is written.
  */
-type LogMessage = {
-  type: "log";
-  level: "debug" | "info" | "warn" | "error";
-  message: string;
-  args: SanitizedArg[]; /** Epoch milliseconds at which the worker generated the log line. */
-  timestamp: number;
-};
+declare class BareReadGate implements IReadGate {
+  scopePredicate(document: PHDocument, subject: AuthSubject): Promise<(scope: string) => boolean>;
+}
 /**
- * Periodic liveness signal. Included now to unblock Phase-3 scaffolding;
- * the wiki marks heartbeats as a Phase-5 future extension.
+ * Answers a stream read from the document already fetched, and anything else
+ * through the read side.
  *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * The seed is why routing reads through a decision model costs no extra I/O for
+ * the document being read: its `document` and `auth` scopes are the two static
+ * projections, and the caller has both in hand. Only a group stream the grant
+ * list names is fetched.
  */
-type HeartbeatMessage = {
-  type: "heartbeat";
-  workerId: string; /** Epoch milliseconds the worker generated the heartbeat. */
-  timestamp: number; /** Optional snapshot of in-flight job correlation ids. */
-  inFlightCorrelationIds?: string[];
-};
+declare class SeededStateReader implements IStreamStateReader {
+  private readonly documentView;
+  private readonly seed;
+  private readonly branch;
+  constructor(documentView: IDocumentView, seed: PHDocument, branch: string);
+  /**
+   * A stream this replica does not hold has to reach buildDecisionModel as the
+   * absence it recognises, or the whole read fails instead of leaving the group
+   * out of the model, where its principal does not match and the policy fails
+   * closed. The read side reports absence as a plain Error, so the absence is
+   * confirmed rather than inferred from the message: a transient failure must
+   * surface, not silently deny.
+   */
+  getState(documentId: string, scope: string, branch: string, targetRevision?: number, signal?: AbortSignal): Promise<PHDocument>;
+  private assertAbsent;
+}
 /**
- * Periodic counters / gauges the worker reports for observability.
+ * Evaluates a read against the registered decision model, built at the stream
+ * heads. This is what makes `{ group }` principals and conditional grants apply
+ * to a read: the model supplies the groups map and the scope's own state, the
+ * same two things admission supplies.
  *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * A read has no action, so a condition on `action.input.*` never holds for one.
+ *
+ * State is read through the read side rather than the write cache. The write
+ * cache is invalidated by whichever process runs the executor, so a reactor
+ * running its executors in worker processes would answer reads in the parent
+ * from state no commit ever invalidates.
  */
-type MetricsMessage = {
-  type: "metrics";
-  workerId: string; /** Epoch milliseconds the worker generated the metrics snapshot. */
-  timestamp: number;
-  counters: {
-    [name: string]: number;
-  };
-  gauges: {
-    [name: string]: number;
-  };
-};
+declare class ModelReadGate implements IReadGate {
+  private readonly model;
+  private readonly documentView;
+  /**
+   * Whether a group a policy names is served to that policy's audience. Only
+   * meaningful with `authGroups`, which is what makes a `{ group }` grant
+   * match at all; below it the grant fails closed, so serving the roster
+   * would publish a member list no read grant can use.
+   */
+  private readonly servesGroups;
+  private readonly operationIndex?;
+  private readonly logger?;
+  private readonly options;
+  constructor(model: RegisteredDecisionModel, documentView: IDocumentView,
+  /**
+   * Whether a group a policy names is served to that policy's audience. Only
+   * meaningful with `authGroups`, which is what makes a `{ group }` grant
+   * match at all; below it the grant fails closed, so serving the roster
+   * would publish a member list no read grant can use.
+   */
+
+  servesGroups: boolean, operationIndex?: IOperationIndex | undefined, logger?: ILogger | undefined, options?: ReadGateOptions);
+  /**
+   * A served group yields its member list and nothing else. What the audience
+   * is owed is the state it must fold to evaluate auth with the group; a
+   * group's other scopes are its own business and stay behind its own grants.
+   */
+  scopePredicate(document: PHDocument, subject: AuthSubject, branch: string, signal?: AbortSignal): Promise<(scope: string) => boolean>;
+  /**
+   * Whether the subject is served this group because a policy names it.
+   *
+   * A replica must fold a group's membership to evaluate auth with it, so a
+   * group a grant names is served to the audience of the document that names
+   * it, whatever the group's own read grants say. Naming a group in a policy
+   * publishes its roster to that policy's audience; a group whose membership
+   * must stay confidential does not belong in a grant.
+   *
+   * The referencing document's own domain scopes are the test. Its `auth` and
+   * `document` scopes are readable by every holder, so testing those would
+   * serve every referenced group to everybody.
+   *
+   * One level only. A referencer that is itself a group is skipped, and a
+   * referencer's own readability is decided from its policy alone, so a
+   * reference cycle terminates. Cycles are reachable: the reference relation
+   * is recorded from an operation's input, including one later stored denied,
+   * so a refused grant naming a group from inside another group leaves a row
+   * behind that validation never saw.
+   *
+   * The referencers are probed a few at a time and the walk stops at the first
+   * that serves, because a subject outside the audience is the case that runs to
+   * the bound, and it is the common one. A probe that failed decides only when
+   * nothing served: serving rests on a real allow, so this cannot widen, and it
+   * stops one unreachable referencer from turning an allow already in hand into
+   * a denial. A read records no operation, so replicas differing over a
+   * transient failure has no consensus consequence.
+   *
+   * The probes are awaited together rather than raced, so none is ever left
+   * running with nobody awaiting it, which is where unhandled rejections come
+   * from.
+   */
+  private servesGroupTo;
+  /**
+   * Whether one referencing document serves the subject any domain scope. A
+   * referencer this replica does not hold serves nothing, which fails closed
+   * the same way a group it does not hold does.
+   */
+  private servesThrough;
+  private servesGroup;
+  /**
+   * What this document's own policy says, with no group serving applied.
+   *
+   * An unpoliced document is readable in full unless the host closes by default,
+   * and either way it is the common case and the one worth answering without
+   * building anything. The test is the one `evaluate` makes: a legacy `{}` auth
+   * scope and version 0 both mean uninitialized, and "no grants" does not,
+   * because a policy with a version and an empty grant list denies everything.
+   *
+   * Closing here rather than around the gate is what keeps a policy able to
+   * publish an unpoliced group it names: the referencer walk asks this question
+   * of the referencing document, whose real policy answers it.
+   */
+  private ownPolicyPredicate;
+}
+//#endregion
+//#region src/client/reactor-client.d.ts
 /**
- * Snapshot of one worker pool's acquire-wait samples and pool-stat counters,
- * forwarded periodically so the host can re-record into the shared
- * pg.Pool histogram and observable gauges. The worker owns the real
- * pg.Pool; the host's {@link PoolInstrumentation} is a forwarder driven
- * by these messages.
+ * What {@link IReactorClient.evaluateActions} decides against: the decision
+ * model this reactor enforces, and the flags that selected it.
+ *
+ * Both, because neither alone is enough. The flags say which of the model's
+ * inputs a decision may read, and the model itself cannot be derived from them
+ * here: selecting one needs the document model registry, which a client does not
+ * hold. Absent, this client answers no preflight at all -- which is the whole of
+ * the non-coexistence guarantee, since a client built without a reactor holding
+ * a decision model has nothing to answer from.
  */
-type PoolAcquireSamplesMessage = {
-  type: "pool-acquire-samples";
-  workerId: string; /** Stable identifier matching the host-side instrumentation name (e.g. "worker-0"). */
-  poolName: string; /** Epoch milliseconds the worker generated the batch. */
-  timestamp: number; /** Acquire-wait durations (ms) accumulated since the previous batch. */
-  durations: number[]; /** Most recent pg.Pool counter snapshot at batch send time. */
-  size: number;
-  idle: number;
-  waiting: number;
+type ActionEvaluationConfig = {
+  model: RegisteredDecisionModel;
+  flags: ReactorFeatureFlags;
 };
 /**
- * Union of all messages a worker may send to the parent.
+ * ReactorClient implementation that wraps lower-level APIs to provide
+ * a simpler interface for document operations.
  *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * Features:
+ * - Wraps Jobs with Promises for easier async handling
+ * - Manages signing of submitted Action objects
+ * - Provides quality-of-life functions for common tasks
+ * - Wraps subscription interface with ViewFilters
  */
-type WorkerMessage = ReadyMessage | ResultMessage | ModelLoadedMessage | ModelLoadFailedMessage | LogMessage | HeartbeatMessage | MetricsMessage | PoolAcquireSamplesMessage;
+declare class ReactorClient implements IReactorClient {
+  private logger;
+  private reactor;
+  private signer;
+  private subscriptionManager;
+  private jobAwaiter;
+  private documentIndexer;
+  private documentView;
+  private readGate;
+  private actionEvaluation;
+  readonly drives: IDriveClient;
+  constructor(logger: ILogger, reactor: IReactor, signer: ISigner, subscriptionManager: IReactorSubscriptionManager, jobAwaiter: IJobAwaiter, documentIndexer: IDocumentIndexer, documentView: IDocumentView, readGate?: IReadGate, actionEvaluation?: ActionEvaluationConfig);
+  private readSubject;
+  /**
+   * Which scopes of one document the subject may read. Resolved once per
+   * document, so the gate builds its model once however many scopes are then
+   * tested, and the filtering itself stays synchronous.
+   */
+  private readableScopes;
+  /**
+   * One document, filtered to the scopes the subject may read. Every method
+   * that hands a document back goes through here, including the ones that
+   * follow a write: a document returned from a mutation is a read like any
+   * other, and returning it whole served scopes the same subject would be
+   * refused by `get`. Its author still sees what it wrote, because an allow on
+   * execute confers read of that scope.
+   */
+  private gateDocument;
+  /**
+   * Retrieves a list of document model modules.
+   */
+  getDocumentModelModules(namespace?: string, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<DocumentModelModule>>;
+  /**
+   * Retrieves a specific document model module by document type.
+   *
+   * @param documentType - The document type identifier
+   * @returns The document model module
+   */
+  getDocumentModelModule(documentType: string): Promise<DocumentModelModule<any>>;
+  /**
+   * Retrieves the document model module matching the version the document is
+   * stamped with, so not-yet-upgraded documents get the reducer their
+   * history was written with rather than the latest.
+   */
+  getDocumentModelModuleForDocument(document: PHDocument): Promise<DocumentModelModule<any>>;
+  /**
+   * Retrieves a specific PHDocument
+   */
+  get<TDocument extends PHDocument>(identifier: string, view?: ViewFilter, signal?: AbortSignal): Promise<TDocument>;
+  /**
+   * Resolves an identifier (id or slug) to the canonical document id, using the
+   * same lookup as the data path. Resolves against the "main" branch. Throws if
+   * the identifier cannot be resolved or is ambiguous.
+   */
+  resolveIdOrSlug(identifier: string, view?: ViewFilter, signal?: AbortSignal): Promise<string>;
+  /**
+   * Retrieves operations for a document
+   */
+  getOperations(documentIdentifier: string, view?: ViewFilter, filter?: OperationFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Operation>>;
+  private getOperationsWithCompositeCursor;
+  /**
+   * Retrieves outgoing relationships of a given type from a source document.
+   */
+  getOutgoingRelationships(sourceIdentifier: string, relationshipType: string, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
+  /**
+   * Retrieves incoming relationships of a given type to a target document.
+   */
+  getIncomingRelationships(targetIdentifier: string, relationshipType: string, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
+  /**
+   * Filters documents by criteria and returns a list of them
+   */
+  find(search: SearchFilter, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
+  /**
+   * Predicts the admission verdict for each candidate. See
+   * {@link IReactorClient.evaluateActions} for the contract and its caveats.
+   *
+   * Read-only throughout, and never through the write cache: that cache is
+   * invalidated by whichever process runs the executor, so a reactor running
+   * its executors in worker processes would answer here from state no commit
+   * ever invalidates.
+   */
+  evaluateActions(documentIdentifier: string, branch: string, candidates: ActionCandidate[], subject?: AuthSubject, signal?: AbortSignal): Promise<ActionEvaluations>;
+  /**
+   * The decision model for one target document, built at its stream heads.
+   *
+   * The document is fetched unfiltered, because the policy is what decides:
+   * reading it through the read gate would withhold the very scopes the
+   * decision is about. A deleted document is served at its deletion boundary,
+   * which is what lets the model refuse an execute against it -- authEnforcement
+   * requires documentDecisions, so that read is available whenever this runs.
+   *
+   * Reading past the gate discloses nothing a submit does not. The `auth` and
+   * `document` scopes are readable by every holder, so a verdict resting on the
+   * policy alone is one the caller could compute unaided; and a verdict resting
+   * on a conditional grant reads the executing scope's state exactly as
+   * admission reads it, so the answer here is what submitting and being refused
+   * would have revealed anyway.
+   *
+   * The append condition the build records is dropped. It guards a write, and
+   * this makes none; reproducing it is also what the preflight cannot do, which
+   * is why the answer is a prediction.
+   */
+  private buildEvaluationTarget;
+  /**
+   * Creates a document and waits for completion
+   */
+  create<TDocument extends PHDocument = PHDocument>(document: PHDocument, parentIdentifier?: string, signal?: AbortSignal): Promise<TDocument>;
+  /**
+   * Creates an empty document and waits for completion
+   */
+  createEmpty<TDocument extends PHDocument>(documentModelType: string, options?: CreateDocumentOptions, signal?: AbortSignal): Promise<TDocument>;
+  /**
+   * Upgrades a document to a newer document model version by dispatching an
+   * UPGRADE_DOCUMENT action. When toVersion is omitted, upgrades to the
+   * latest registered module version for the document's type. Returns the
+   * document unchanged when it is already at the target version.
+   *
+   * The executor validates the action's version and revision snapshot against
+   * the state the migration actually runs on. When a concurrent edit
+   * invalidates the snapshot, the upgrade is rebuilt from a fresh read and
+   * retried up to maxConflictRetries times before the conflict is surfaced.
+   */
+  upgradeDocument<TDocument extends PHDocument = PHDocument>(documentIdentifier: string, toVersion?: number, options?: UpgradeDocumentOptions, signal?: AbortSignal): Promise<TDocument>;
+  /**
+   * Creates an empty document in a drive as a single batched operation.
+   * Delegates to {@link IDriveClient.addFile}.
+   *
+   * @deprecated Use `client.drives.addFile` instead. This method will be
+   * removed in a future release.
+   */
+  createDocumentInDrive<TDocument extends PHDocument>(driveId: string, document: PHDocument, parentFolder?: string, signal?: AbortSignal): Promise<TDocument>;
+  /**
+   * Applies a list of actions to a document and waits for completion
+   */
+  execute<TDocument extends PHDocument>(documentIdentifier: string, branch: string, actions: Action[], signal?: AbortSignal): Promise<TDocument>;
+  /**
+   * Submits a list of actions to a document
+   */
+  executeAsync(documentIdentifier: string, branch: string, actions: Action[], signal?: AbortSignal): Promise<JobInfo>;
+  executeBatch(request: BatchExecutionRequest, signal?: AbortSignal): Promise<BatchExecutionResult>;
+  /**
+   * Renames a document and waits for completion
+   */
+  rename(documentIdentifier: string, name: string, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
+  /**
+   * Updates the preferred editor recorded in the document header meta.
+   * Pass `null` to clear it.
+   */
+  setPreferredEditor(documentIdentifier: string, preferredEditor: string | null, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
+  /**
+   * Adds multiple documents as children to another and waits for completion
+   */
+  addRelationship(sourceIdentifier: string, targetIdentifier: string, relationshipType: string, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
+  /**
+   * Removes a relationship between two documents and waits for completion.
+   */
+  removeRelationship(sourceIdentifier: string, targetIdentifier: string, relationshipType: string, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
+  /**
+   * Moves a relationship from one source document to another and waits for completion.
+   */
+  moveRelationship(sourceParentIdentifier: string, targetParentIdentifier: string, targetIdentifier: string, relationshipType: string, branch?: string, signal?: AbortSignal): Promise<{
+    source: PHDocument;
+    target: PHDocument;
+  }>;
+  loadBatch(request: BatchLoadRequest, signal?: AbortSignal): Promise<BatchLoadResult>;
+  /**
+   * Deletes a document and waits for completion
+   */
+  deleteDocument(identifier: string, propagate?: PropagationMode, signal?: AbortSignal): Promise<void>;
+  /**
+   * Deletes documents and waits for completion
+   */
+  deleteDocuments(identifiers: string[], propagate?: PropagationMode, signal?: AbortSignal): Promise<void>;
+  /**
+   * Retrieves the status of a job
+   */
+  getJobStatus(jobId: string, signal?: AbortSignal): Promise<JobInfo>;
+  /**
+   * Waits for a job to complete
+   */
+  waitForJob(jobId: string | JobInfo, signal?: AbortSignal): Promise<JobInfo>;
+  /**
+   * Subscribes to changes for documents matching specified filters
+   */
+  subscribe(search: SearchFilter, callback: (event: DocumentChangeEvent) => void, view?: ViewFilter): () => void;
+  private removeAllIncomingRelationships;
+}
 //#endregion
 //#region src/executor/interfaces.d.ts
 /**
@@ -2679,9 +4088,11 @@ interface IQueue {
    * Retry a failed job.
    * @param jobId - The ID of the job to retry
    * @param error - Optional error information from the failure
+   * @param accounting - Whether the attempt counts against the job's retry
+   * limit; defaults to {@link RetryAccounting.CountAgainstLimit}
    * @returns Promise that resolves when the job is requeued for retry
    */
-  retryJob(jobId: string, error?: ErrorInfo$1): Promise<void>;
+  retryJob(jobId: string, error?: ErrorInfo$1, accounting?: RetryAccounting): Promise<void>;
   /**
    * Returns true if and only if all jobs have been resolved.
    */
@@ -2692,211 +4103,86 @@ interface IQueue {
    */
   block(onDrained?: () => void): void;
   /**
-   * Unblocks the queue from accepting new jobs.
-   */
-  unblock(): void;
-}
-//#endregion
-//#region src/read-models/types.d.ts
-interface ViewStateTable {
-  readModelId: string;
-  lastOrdinal: number;
-  lastOperationTimestamp: Generated<Date>;
-}
-interface DocumentSnapshotTable {
-  id: Generated<string>;
-  documentId: string;
-  slug: string | null;
-  name: string | null;
-  scope: string;
-  branch: string;
-  content: unknown;
-  documentType: string;
-  lastOperationIndex: number;
-  lastOperationHash: string;
-  lastUpdatedAt: Generated<Date>;
-  snapshotVersion: Generated<number>;
-  identifiers: unknown;
-  metadata: unknown;
-  isDeleted: Generated<boolean>;
-  deletedAt: Date | null;
-}
-interface SlugMappingTable {
-  slug: string;
-  documentId: string;
-  scope: string;
-  branch: string;
-  createdAt: Generated<Date>;
-  updatedAt: Generated<Date>;
-}
-interface ProcessorCursorTable {
-  processorId: string;
-  factoryId: string;
-  driveId: string;
-  processorIndex: number;
-  lastOrdinal: Generated<number>;
-  status: Generated<string>;
-  lastError: string | null;
-  lastErrorTimestamp: Date | null;
-  createdAt: Generated<Date>;
-  updatedAt: Generated<Date>;
-}
-interface DocumentViewDatabase {
-  ViewState: ViewStateTable;
-  DocumentSnapshot: DocumentSnapshotTable;
-  SlugMapping: SlugMappingTable;
-  ProcessorCursor: ProcessorCursorTable;
-}
-type InsertableDocumentSnapshot = Insertable<DocumentSnapshotTable>;
-//#endregion
-//#region src/core/model-sources.d.ts
-/** An importable file holding one or more document-model exports. */
-type FileModelSource = {
-  filePath: string;
-  exportName?: string;
-};
-/** An importable package specifier holding one or more document-model exports. */
-type PackageModelSource = {
-  packageName: string;
-  subpath?: string;
-  exportName?: string;
-};
-/**
- * A source of document models: a live module, an importable file, or an
- * importable package. File and package sources can cross a worker-thread
- * boundary (workers re-import them); a live module cannot.
- */
-type DocumentModelSource = DocumentModelModule<any> | FileModelSource | PackageModelSource;
-//#endregion
-//#region src/registry/interfaces.d.ts
-type RegistrationResult<T> = {
-  status: "success";
-  item: T;
-} | {
-  status: "error";
-  item: T;
-  error: Error;
-};
-/**
- * Loader that asynchronously resolves a document type to a
- * {@link DocumentModelSource}. Used by the queue to gate CREATE_DOCUMENT
- * jobs until the required model is available in the registry.
- *
- * Return an importable source ({ filePath } or { packageName }) whenever
- * possible: the resolver registers the resolved models on the host registry
- * and broadcasts importable sources to executor workers. A live
- * DocumentModelModule is also valid but host-only — it cannot cross a
- * worker-thread boundary, so worker pools will not receive it.
- */
-interface IDocumentModelLoader {
-  load(documentType: string): Promise<DocumentModelSource>;
-}
-/**
- * Registry for managing document model modules.
- * Provides centralized access to document models' reducers, utils, and specifications.
- * Supports version-aware module storage and upgrade manifest management.
- */
-interface IDocumentModelRegistry {
-  /**
-   * Register multiple modules at once.
-   * Modules without a version field default to version 1.
-   * Invalid or duplicate modules are skipped without breaking registration of the remaining modules.
-   *
-   * @param modules Document model modules to register
-   * @returns Array of results, one per module, indicating success or failure
-   */
-  registerModules(...modules: DocumentModelModule<any>[]): RegistrationResult<DocumentModelModule<any>>[];
-  /**
-   * Unregister all versions of the specified document types.
-   *
-   * @param documentTypes The document types to unregister
-   * @returns true if all modules were unregistered, false if any were not found
-   */
-  unregisterModules(...documentTypes: string[]): boolean;
-  /**
-   * Get a specific document model module by document type and optional version.
-   * If version is not specified, returns the latest version.
-   *
-   * @param documentType The document type identifier
-   * @param version Optional version number to retrieve
-   * @returns The document model module
-   * @throws ModuleNotFoundError if the document type or version is not registered
-   */
-  getModule(documentType: string, version?: number): DocumentModelModule<any>;
-  /**
-   * Get all registered document model modules.
-   *
-   * @returns Array of all registered modules
-   */
-  getAllModules(): DocumentModelModule<any>[];
-  /**
-   * Clear all registered modules and upgrade manifests.
-   */
-  clear(): void;
-  /**
-   * Get all supported versions for a document type, sorted in ascending order.
-   *
-   * @param documentType The document type identifier
-   * @returns Array of version numbers sorted ascending
-   * @throws ModuleNotFoundError if no modules are registered for the document type
-   */
-  getSupportedVersions(documentType: string): number[];
-  /**
-   * Get the latest (highest) version number for a document type.
-   *
-   * @param documentType The document type identifier
-   * @returns The highest version number registered for this document type
-   * @throws ModuleNotFoundError if no modules are registered for the document type
-   */
-  getLatestVersion(documentType: string): number;
-  /**
-   * Register upgrade manifests that define upgrade paths between versions.
-   * Invalid or duplicate manifests are skipped without breaking registration of the remaining manifests.
-   *
-   * @param manifests Upgrade manifests to register
-   * @returns Array of results, one per manifest, indicating success or failure
-   */
-  registerUpgradeManifests(...manifests: UpgradeManifest<readonly number[]>[]): RegistrationResult<UpgradeManifest<readonly number[]>>[];
-  /**
-   * Unregister upgrade manifests for the specified document types.
-   * @param documentTypes The document types whose upgrade manifests should be unregistered
-   * @returns true if all modules were unregistered, false if any were not found
-   **/
-  unregisterUpgradeManifests(...documentTypes: string[]): boolean;
-  /**
-   * Get the upgrade manifest for a document type.
-   *
-   * @param documentType The document type identifier
-   * @returns The upgrade manifest
-   * @throws ManifestNotFoundError if no manifest is registered for the document type
-   */
-  getUpgradeManifest(documentType: string): UpgradeManifest<readonly number[]>;
-  /**
-   * Compute the upgrade path from one version to another.
-   * Returns the sequence of upgrade transitions needed.
-   *
-   * @param documentType The document type identifier
-   * @param fromVersion The starting version
-   * @param toVersion The target version
-   * @returns Array of upgrade transitions in order
-   * @throws DowngradeNotSupportedError if toVersion is less than fromVersion
-   * @throws ManifestNotFoundError if no upgrade manifest is registered
-   * @throws MissingUpgradeTransitionError if any transition in the path is missing
-   */
-  computeUpgradePath(documentType: string, fromVersion: number, toVersion: number): UpgradeTransition[];
-  /**
-   * Get the upgrade reducer for a single-step version transition.
-   *
-   * @param documentType The document type identifier
-   * @param fromVersion The starting version
-   * @param toVersion The target version (must be fromVersion + 1)
-   * @returns The upgrade reducer function
-   * @throws InvalidUpgradeStepError if toVersion is not fromVersion + 1
-   * @throws ManifestNotFoundError if no upgrade manifest is registered
-   * @throws MissingUpgradeTransitionError if the transition is not found
+   * Unblocks the queue from accepting new jobs.
    */
-  getUpgradeReducer(documentType: string, fromVersion: number, toVersion: number): UpgradeReducer<any, any>;
+  unblock(): void;
+}
+//#endregion
+//#region src/core/group-reevaluation-trigger.d.ts
+/**
+ * Watches committed writes for group membership changes and enqueues a
+ * re-evaluation job for every document whose auth history references the
+ * changed group, found through the reverse direction of the group-reference
+ * relation. Each affected document is re-judged in its own job, so the work
+ * runs under that document's execution slot rather than the group's.
+ *
+ * The job carries the earliest changed membership timestamp; the executor
+ * skips the pass when everything the document holds sorts before it, which
+ * keeps the common case (a membership write later than all history) free.
+ */
+declare class GroupReevaluationTrigger {
+  private logger;
+  private eventBus;
+  private queue;
+  private operationIndex;
+  private unsubscribe?;
+  constructor(logger: ILogger, eventBus: IEventBus, queue: IQueue, operationIndex: IOperationIndex);
+  startup(): void;
+  shutdown(): void;
+  private onWriteReady;
+}
+//#endregion
+//#region src/read-models/types.d.ts
+interface ViewStateTable {
+  readModelId: string;
+  lastOrdinal: number;
+  lastOperationTimestamp: Generated<Date>;
+}
+interface DocumentSnapshotTable {
+  id: Generated<string>;
+  documentId: string;
+  slug: string | null;
+  name: string | null;
+  scope: string;
+  branch: string;
+  content: unknown;
+  documentType: string;
+  lastOperationIndex: number;
+  lastOperationHash: string;
+  lastUpdatedAt: Generated<Date>;
+  snapshotVersion: Generated<number>;
+  identifiers: unknown;
+  metadata: unknown;
+  isDeleted: Generated<boolean>;
+  deletedAt: Date | null;
+}
+interface SlugMappingTable {
+  slug: string;
+  documentId: string;
+  scope: string;
+  branch: string;
+  createdAt: Generated<Date>;
+  updatedAt: Generated<Date>;
+}
+interface ProcessorCursorTable {
+  processorId: string;
+  factoryId: string;
+  driveId: string;
+  processorIndex: number;
+  lastOrdinal: Generated<number>;
+  status: Generated<string>;
+  lastError: string | null;
+  lastErrorTimestamp: Date | null;
+  createdAt: Generated<Date>;
+  updatedAt: Generated<Date>;
+}
+interface DocumentViewDatabase {
+  ViewState: ViewStateTable;
+  DocumentSnapshot: DocumentSnapshotTable;
+  SlugMapping: SlugMappingTable;
+  ProcessorCursor: ProcessorCursorTable;
 }
+type InsertableDocumentSnapshot = Insertable<DocumentSnapshotTable>;
 //#endregion
 //#region src/shared/consistency-tracker.d.ts
 interface IConsistencyTracker {
@@ -2946,134 +4232,6 @@ declare class ConsistencyTracker implements IConsistencyTracker {
   private removeWaiter;
 }
 //#endregion
-//#region src/storage/kysely/types.d.ts
-interface OperationTable {
-  id: Generated<number>;
-  jobId: string;
-  opId: string;
-  prevOpId: string;
-  writeTimestampUtcMs: Generated<Date>;
-  documentId: string;
-  documentType: string;
-  scope: string;
-  branch: string;
-  timestampUtcMs: Date;
-  index: number;
-  action: unknown;
-  skip: number;
-  error?: string | null;
-  hash: string;
-}
-interface KeyframeTable {
-  id: Generated<number>;
-  documentId: string;
-  documentType: string;
-  scope: string;
-  branch: string;
-  revision: number;
-  document: unknown;
-  createdAt: Generated<Date>;
-}
-interface DocumentCollectionTable {
-  documentId: string;
-  collectionId: string;
-  joinedOrdinal: bigint;
-  leftOrdinal: bigint | null;
-}
-interface OperationIndexOperationTable {
-  ordinal: Generated<number>;
-  opId: string;
-  documentId: string;
-  documentType: string;
-  scope: string;
-  branch: string;
-  timestampUtcMs: string;
-  writeTimestampUtcMs: Generated<Date>;
-  index: number;
-  skip: number;
-  hash: string;
-  action: unknown;
-  sourceRemote: Generated<string>;
-}
-interface SyncRemoteTable {
-  name: string;
-  collection_id: string;
-  channel_type: string;
-  channel_id: string;
-  remote_name: string;
-  channel_parameters: unknown;
-  filter_document_ids: unknown;
-  filter_scopes: unknown;
-  filter_branch: string;
-  push_state: string;
-  push_last_success_utc_ms: string | null;
-  push_last_failure_utc_ms: string | null;
-  push_failure_count: number;
-  pull_state: string;
-  pull_last_success_utc_ms: string | null;
-  pull_last_failure_utc_ms: string | null;
-  pull_failure_count: number;
-  created_at: Generated<Date>;
-  updated_at: Generated<Date>;
-}
-interface SyncCursorTable {
-  remote_name: string;
-  cursor_type: string;
-  cursor_ordinal: bigint;
-  last_synced_at_utc_ms: string | null;
-  updated_at: Generated<Date>;
-}
-/**
- * Kysely table definition for the `sync_dead_letters` table.
- */
-interface SyncDeadLetterTable {
-  ordinal: Generated<number>;
-  id: string;
-  job_id: string;
-  job_dependencies: unknown;
-  remote_name: string;
-  document_id: string;
-  scopes: unknown;
-  branch: string;
-  operations: unknown;
-  error_source: string;
-  error_message: string;
-  created_at: Generated<Date>;
-}
-interface Database$1 {
-  Operation: OperationTable;
-  Keyframe: KeyframeTable;
-  document_collections: DocumentCollectionTable;
-  operation_index_operations: OperationIndexOperationTable;
-  sync_remotes: SyncRemoteTable;
-  sync_cursors: SyncCursorTable;
-  sync_dead_letters: SyncDeadLetterTable;
-}
-interface DocumentTable {
-  id: string;
-  createdAt: Generated<Date>;
-  updatedAt: Generated<Date>;
-}
-interface DocumentRelationshipTable {
-  id: Generated<string>;
-  sourceId: string;
-  targetId: string;
-  relationshipType: string;
-  metadata: unknown;
-  createdAt: Generated<Date>;
-  updatedAt: Generated<Date>;
-}
-interface IndexerStateTable {
-  id: Generated<number>;
-  lastOperationId: number;
-  lastOperationTimestamp: Generated<Date>;
-}
-interface DocumentIndexerDatabase {
-  Document: DocumentTable;
-  DocumentRelationship: DocumentRelationshipTable;
-  IndexerState: IndexerStateTable;
-}
-//#endregion
 //#region src/storage/pool-instrumentation.d.ts
 /**
  * Snapshot of a pg.Pool's internal counters at a point in time.
@@ -3122,6 +4280,45 @@ type ForwardingPoolInstrumentation = PoolInstrumentation & {
 };
 //#endregion
 //#region src/sync/errors.d.ts
+type GraphQLRequestErrorCategory = "network" | "http" | "parse" | "graphql" | "missing-data";
+declare class GraphQLRequestError extends Error {
+  readonly statusCode: number | undefined;
+  readonly category: GraphQLRequestErrorCategory;
+  /**
+   * One entry per error the response carried, in order, holding its
+   * `extensions.code` - undefined where it declared none. Kept per error rather
+   * than as a set, because a response that mixes a classified error with an
+   * unclassified one must not be read as if only the classified one arrived.
+   */
+  readonly codes: readonly (string | undefined)[];
+  constructor(message: string, category: GraphQLRequestErrorCategory, statusCode?: number, codes?: readonly (string | undefined)[]);
+}
+/**
+ * Extension codes a remote uses to say a failure is worth polling through.
+ *
+ * Shared with reactor-api so the server throws what this check reads and the two
+ * cannot drift. A `graphql` category error is otherwise permanent: it stops the
+ * poll timer, and nothing restarts it, so a code that lands here is the
+ * difference between a channel that recovers and one that is dead for the
+ * process lifetime.
+ */
+declare const RECOVERABLE_GRAPHQL_ERROR_CODES: {
+  /**
+   * A stored operation cannot be represented in the schema - an action with no
+   * id, say. The document holding it needs repairing, but the channel serves
+   * every other document, and a peer that stopped polling would stop receiving
+   * those too.
+   */
+  readonly malformedStoredOperation: "MALFORMED_STORED_OPERATION";
+};
+/**
+ * True when every error the response carried named a recoverable code.
+ *
+ * Unanimity is the requirement: one unclassified error alongside a recoverable
+ * one means something else also went wrong, and polling through that would be
+ * guessing.
+ */
+declare function isRecoverableGraphQLError(error: GraphQLRequestError): boolean;
 /** Auth-rejection message fragments the switchboard emits. Shared with
  * reactor-api so server throws and this client check can't drift. */
 declare const DRIVE_AUTH_ERROR_MESSAGES: {
@@ -3137,7 +4334,13 @@ declare class PollingChannelError extends Error {
 declare class ChannelError extends Error {
   source: ChannelErrorSource;
   error: Error;
-  constructor(source: ChannelErrorSource, error: Error);
+  /**
+   * The classification when something other than the error carries it. Absent
+   * means derive it from `error.name`; a dead letter mirrored from a peer sets it,
+   * because only the message crosses the wire.
+   */
+  readonly errorType?: SyncOperationErrorType;
+  constructor(source: ChannelErrorSource, error: Error, errorType?: SyncOperationErrorType);
 }
 //#endregion
 //#region src/sync/sync-operation.d.ts
@@ -3404,6 +4607,19 @@ interface ISyncManager {
    * @throws Error if a remote with this name already exists
    */
   add(name: string, collectionId: DriveCollectionId, channelConfig: ChannelConfig, filter?: RemoteFilter, options?: RemoteOptions, id?: string): Promise<Remote>;
+  /**
+   * Binds a remote to an address, so only that address may poll it.
+   *
+   * This is adoption, not configuration: a channel created anonymously is
+   * unbound and serves whatever an anonymous subject may read, and the first
+   * authenticated subject to poll it claims it. Binding an already-bound remote
+   * to a different address is refused rather than allowed to steal it.
+   *
+   * @param id - The id of the remote to bind
+   * @param boundAddress - The address that henceforth owns the channel
+   * @throws Error if the remote does not exist, or is bound to another address
+   */
+  bindRemote(id: string, boundAddress: string): Promise<void>;
   /**
    * Triggers a one-shot pull for the named remote. Useful for Manual poll-behavior
    * remotes, where the channel is registered but does not poll on a schedule.
@@ -3736,6 +4952,12 @@ interface ReactorModule {
  * integration scenarios.
  */
 interface InProcessReactorModule extends ReactorModule {
+  /**
+   * The enforcement flags this reactor resolved, as plain booleans. Held on the
+   * module because they select what a read enforces as well as what a write
+   * does, and the read surface is composed outside the reactor.
+   */
+  featureFlags: ReactorFeatureFlags;
   queue: IQueue;
   jobTracker: IJobTracker;
   executorManager: IJobExecutorManager;
@@ -3754,6 +4976,12 @@ interface InProcessReactorModule extends ReactorModule {
   processorManagerConsistencyTracker: IConsistencyTracker;
   reactor: IReactor;
   syncModule: InProcessSyncModule | undefined;
+  /**
+   * Present when authGroups is on: enqueues re-evaluation jobs for the
+   * documents a group membership change affects. Started by the builder;
+   * hosts shut it down alongside the sync manager.
+   */
+  groupReevaluationTrigger: GroupReevaluationTrigger | undefined;
   /**
    * Instrumented pg.Pool handles registered with the builder, either by
    * createPostgresDatabase or by withInstrumentedPool. Empty when no pg
@@ -3815,12 +5043,6 @@ declare class DriveClient implements IDriveClient {
   private removeFileNode;
 }
 //#endregion
-//#region src/cache/collection-membership-cache.d.ts
-interface ICollectionMembershipCache {
-  getCollectionsForDocuments(documentIds: string[]): Promise<Record<string, string[]>>;
-  invalidate(documentId: string): void;
-}
-//#endregion
 //#region src/registry/document-model-resolver.d.ts
 interface IDocumentModelResolver {
   ensureModelLoaded(documentType: string): Promise<void>;
@@ -3866,51 +5088,19 @@ declare class DocumentModelResolver implements IDocumentModelResolver {
  * Checks the registry for the model and returns if found; throws if not.
  * Since there is no loader, missing models cannot be recovered.
  */
-declare class NullDocumentModelResolver implements IDocumentModelResolver {
-  private registry?;
-  constructor(registry?: IDocumentModelRegistry | undefined);
-  ensureModelLoaded(documentType: string): Promise<void>;
-}
-//#endregion
-//#region src/executor/worker-pool-job-executor-manager.d.ts
-/**
- * Factory invoked once per worker at `start()` time. The index is the
- * worker's position in the pool and the same value the manager will use
- * for sticky routing (`bucketFor(documentId) === index`).
- */
-type WorkerFactory = (index: number) => IExecutorWorker;
-//#endregion
-//#region src/cache/write-cache-types.d.ts
-/**
- * Configuration options for the write cache
- */
-type WriteCacheConfig = {
-  /** Maximum number of document streams to cache (LRU eviction). Default: 1000 */maxDocuments: number; /** Number of snapshots to keep in each document's ring buffer. Default: 10 */
-  ringBufferSize: number; /** Persist a keyframe snapshot every N revisions. Default: 10 */
-  keyframeInterval: number;
-};
-/**
- * Unique identifier for a document stream
- */
-type DocumentStreamKey = {
-  /** Document identifier */documentId: string; /** Operation scope */
-  scope: string; /** Branch name */
-  branch: string;
-};
-/**
- * A cached document snapshot at a specific revision
- */
-type CachedSnapshot = {
-  /** The revision number of this snapshot */revision: number; /** The document state at this revision */
-  document: PHDocument;
-};
+declare class NullDocumentModelResolver implements IDocumentModelResolver {
+  private registry?;
+  constructor(registry?: IDocumentModelRegistry | undefined);
+  ensureModelLoaded(documentType: string): Promise<void>;
+}
+//#endregion
+//#region src/executor/worker-pool-job-executor-manager.d.ts
 /**
- * Serialized keyframe snapshot for K/V store persistence
+ * Factory invoked once per worker at `start()` time. The index is the
+ * worker's position in the pool and the same value the manager will use
+ * for sticky routing (`bucketFor(documentId) === index`).
  */
-type KeyframeSnapshot = {
-  /** The revision number of this keyframe */revision: number; /** Serialized document state */
-  document: string;
-};
+type WorkerFactory = (index: number) => IExecutorWorker;
 //#endregion
 //#region src/projection/protocol.d.ts
 /**
@@ -4150,6 +5340,7 @@ declare class SyncBuilder {
   withDeadLetterStorage(storage: ISyncDeadLetterStorage): this;
   withMaxDeadLettersPerRemote(limit: number): this;
   withMaxInboxBatchSize(limit: number): this;
+  withMaxHeldOperationsPerRemote(limit: number): this;
   build(reactor: IReactor, logger: ILogger, operationIndex: IOperationIndex, eventBus: IEventBus, db: Kysely<Database$1>, driveContainerTypes: ReadonlySet<string>): ISyncManager;
   buildModule(reactor: IReactor, logger: ILogger, operationIndex: IOperationIndex, eventBus: IEventBus, db: Kysely<Database$1>, driveContainerTypes: ReadonlySet<string>): InProcessSyncModule;
 }
@@ -4162,6 +5353,7 @@ declare class SyncBuilder {
  * them (`BaseReadModel` subclasses, in particular).
  */
 interface ReadModelFactoryDeps {
+  documentModelRegistry: IDocumentModelRegistry;
   operationIndex: IOperationIndex;
   writeCache: IWriteCache;
   processorManagerConsistencyTracker: IConsistencyTracker;
@@ -4383,6 +5575,7 @@ declare class ReactorClientBuilder {
   private subscriptionManager?;
   private jobAwaiter?;
   private documentModelLoader?;
+  private readGate?;
   /**
    * Sets the logger for the ReactorClient.
    * @param logger - The logger to use.
@@ -4406,6 +5599,36 @@ declare class ReactorClientBuilder {
   withSubscriptionManager(subscriptionManager: IReactorSubscriptionManager): this;
   withJobAwaiter(jobAwaiter: IJobAwaiter): this;
   withDocumentModelLoader(loader: IDocumentModelLoader): this;
+  /**
+   * Overrides how reads are gated. A client built from a ReactorBuilder derives
+   * this from that reactor's flags; one built from `withReactor` cannot, because
+   * it is handed no flags and no registry, so it gates on the policy alone
+   * unless a gate is supplied here.
+   */
+  withReadGate(readGate: IReadGate): this;
+  /**
+   * The gate the resolved model calls for. Below authEnforcement there is no
+   * model to enforce -- the registered one ignores the auth scope -- so the
+   * policy is evaluated on its own, which is what reads did before the model
+   * existed. Group serving turns on with authGroups, because below it a
+   * `{ group }` grant does not match, so a served roster is one no grant can
+   * use.
+   */
+  private resolveReadGate;
+  /**
+   * What the client answers an authorization preflight from, or undefined when
+   * it answers none.
+   *
+   * Resolved from the same model reads enforce, so a preflight and a read can
+   * never decide against different models. Undefined below authEnforcement, and
+   * undefined on the `withReactor` path, where there are no flags and no
+   * registry to select a model with -- a client with no model refuses the
+   * preflight rather than answering it from the legacy host-side permission
+   * tables. Deliberately not derived from the read gate: `withReadGate`
+   * overrides that, so sniffing the gate's type would report enforcement from a
+   * caller's substitution.
+   */
+  private resolveActionEvaluation;
   build(): Promise<ReactorClient>;
   buildModule(): Promise<InProcessReactorClientModule>;
 }
@@ -4478,6 +5701,28 @@ declare function parseDriveUrl(url: string): ParsedDriveUrl;
  */
 declare function driveIdFromUrl(url: string): string;
 //#endregion
+//#region src/shared/errors.d.ts
+/**
+ * An authorization preflight was asked for while the reactor's decision model
+ * is off, so there is no model to answer from.
+ *
+ * Thrown rather than answered from the legacy host-side permission tables. The
+ * two systems do not compose: the tables record which addresses a host lets
+ * near a drive, the policy records what a document's own grants permit, and an
+ * answer stitched from both would report an admission verdict neither system
+ * would reach. A caller that cannot get a prediction disables nothing, which
+ * leaves the submit path -- and its real gate -- as the only authority.
+ *
+ * Detection is by `name`, not `instanceof`: the SharedWorker RPC boundary
+ * rebuilds a thrown error from `{ name, message, stack, cause }` alone
+ * (`reactor-browser/src/rpc/error-info.ts`), so the class identity and any
+ * custom field are lost in transit. This error therefore carries no fields.
+ */
+declare class AuthEnforcementDisabledError extends Error {
+  constructor();
+  static isError(error: unknown): error is AuthEnforcementDisabledError;
+}
+//#endregion
 //#region src/shared/factories.d.ts
 /**
  * Factory method to create a ShutdownStatus that can be updated
@@ -4508,560 +5753,220 @@ declare function parsePagingOptions(paging: PagingOptions | undefined, defaultLi
 declare class DefaultSubscriptionErrorHandler implements ISubscriptionErrorHandler {
   handleError(error: unknown, context: SubscriptionErrorContext): void;
 }
-//#endregion
-//#region src/subs/react-subscription-manager.d.ts
-type DocumentCreatedCallback = (result: PagedResults<string>) => void;
-type DocumentDeletedCallback = (documentIds: string[]) => void;
-type DocumentStateUpdatedCallback = (result: PagedResults<PHDocument>) => void;
-type RelationshipChangedCallback = (parentId: string, childId: string, changeType: RelationshipChangeType) => void;
-declare class ReactorSubscriptionManager implements IReactorSubscriptionManager {
-  private createdSubscriptions;
-  private deletedSubscriptions;
-  private updatedSubscriptions;
-  private relationshipSubscriptions;
-  private subscriptionCounter;
-  private errorHandler;
-  constructor(errorHandler: ISubscriptionErrorHandler);
-  onDocumentCreated(callback: DocumentCreatedCallback, search?: SearchFilter): () => void;
-  onDocumentDeleted(callback: DocumentDeletedCallback, search?: SearchFilter): () => void;
-  onDocumentStateUpdated(callback: DocumentStateUpdatedCallback, search?: SearchFilter, view?: ViewFilter): () => void;
-  onRelationshipChanged(callback: RelationshipChangedCallback, search?: SearchFilter): () => void;
-  /**
-   * Notify subscribers about created documents
-   */
-  notifyDocumentsCreated(documentIds: string[], documentTypes?: Map<string, string>, parentIds?: Map<string, string | null>): void;
-  /**
-   * Notify subscribers about deleted documents
-   */
-  notifyDocumentsDeleted(documentIds: string[], documentTypes?: Map<string, string>, parentIds?: Map<string, string | null>): void;
-  /**
-   * Notify subscribers about updated documents
-   */
-  notifyDocumentsUpdated(documents: PHDocument[]): void;
-  /**
-   * Notify subscribers about relationship changes
-   */
-  notifyRelationshipChanged(parentId: string, childId: string, changeType: RelationshipChangeType, childType?: string): void;
-  /**
-   * Clear all subscriptions
-   */
-  clearAll(): void;
-  private filterDocumentIds;
-  private filterDocuments;
-  private matchesRelationshipFilter;
-}
-//#endregion
-//#region src/events/event-bus.d.ts
-declare class EventBus implements IEventBus {
-  readonly eventTypeToSubscribers: Map<number, Subscriber[]>;
-  subscribe<K>(type: number, subscriber: (type: number, event: K) => void | Promise<void>): Unsubscribe;
-  emit(type: number, data: any): Promise<void>;
-}
-//#endregion
-//#region src/queue/queue.d.ts
-/**
- * In-memory implementation of the IQueue interface.
- * Organizes jobs by documentId, scope, and branch to ensure proper ordering.
- * Ensures serial execution per document by tracking executing jobs.
- * Implements dependency management through queue hints.
- */
-declare class InMemoryQueue implements IQueue {
-  private eventBus;
-  private resolver;
-  private queues;
-  private jobIdToQueueKey;
-  private docIdToJobId;
-  private jobIdToDocId;
-  private completedJobs;
-  private jobIndex;
-  private isBlocked;
-  private onDrainedCallback?;
-  private isPausedFlag;
-  constructor(eventBus: IEventBus, resolver: IDocumentModelResolver);
-  private toErrorInfo;
-  /**
-   * Creates a unique key for a document/scope/branch combination
-   */
-  private createQueueKey;
-  /**
-   * Gets or creates a queue for the given key
-   */
-  private getQueue;
-  /**
-   * Check if a document has any jobs currently executing
-   */
-  private isDocumentExecuting;
-  /**
-   * Mark a job as executing for its document
-   */
-  private markJobExecuting;
-  /**
-   * Mark a job as no longer executing for its document
-   */
-  private markJobComplete;
-  /**
-   * Check if all dependencies for a job have been completed
-   */
-  private areDependenciesMet;
-  /**
-   * Returns the head of the sub-queue if its dependencies are met, or null.
-   *
-   * The dispatcher only ever considers the head — a dep-blocked head holds
-   * the rest of its sub-queue. This preserves per-(documentId, scope, branch)
-   * FIFO regardless of how dependencies are authored, and makes the queue's
-   * documented "serialized per document" invariant hold even when callers
-   * omit queueHint dependencies on jobs that share a sub-queue.
-   */
-  private getNextJobWithMetDependencies;
-  private getCreateDocumentType;
-  enqueue(job: Job): Promise<void>;
-  dequeue(documentId: string, scope: string, branch: string, signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
-  dequeueNext(signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
-  dequeueNextMatching(predicate: (meta: JobRoutingMeta) => boolean, signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
-  size(documentId: string, scope: string, branch: string): Promise<number>;
-  totalSize(): Promise<number>;
-  remove(jobId: string): Promise<boolean>;
-  clear(documentId: string, scope: string, branch: string): Promise<void>;
-  clearAll(): Promise<void>;
-  hasJobs(): Promise<boolean>;
-  completeJob(jobId: string): Promise<void>;
-  failJob(jobId: string, error?: ErrorInfo$1): Promise<void>;
-  deferJob(jobId: string): void;
-  retryJob(jobId: string, error?: ErrorInfo$1): Promise<void>;
-  /**
-   * Check if the queue is drained and call the callback if it is
-   */
-  private checkDrained;
-  /**
-   * Returns true if and only if all jobs have been resolved.
-   */
-  get isDrained(): boolean;
-  /**
-   * Blocks the queue from accepting new jobs.
-   * @param onDrained - Optional callback to call when the queue is drained
-   */
-  block(onDrained?: () => void): void;
-  /**
-   * Unblocks the queue from accepting new jobs.
-   */
-  unblock(): void;
-  /**
-   * Pauses job dequeuing. Jobs can still be enqueued but dequeueNext() will return null.
-   */
-  pause(): void;
-  /**
-   * Resumes job dequeuing and emits JOB_AVAILABLE events for pending jobs to wake up executors.
-   */
-  resume(): Promise<void>;
-  /**
-   * Returns whether job dequeuing is paused.
-   */
-  get paused(): boolean;
-  /**
-   * Returns all pending jobs across all queues.
-   */
-  getPendingJobs(): Job[];
-  /**
-   * Returns a map of document IDs to sets of executing job IDs.
-   */
-  getExecutingJobIds(): Map<string, Set<string>>;
-  /**
-   * Returns a job by ID from the job index.
-   */
-  getJob(jobId: string): Job | undefined;
-}
-//#endregion
-//#region src/job-tracker/in-memory-job-tracker.d.ts
-/**
- * In-memory implementation of IJobTracker.
- * Maintains job status in a Map for synchronous access.
- * Subscribes to operation events to update job states.
- */
-declare class InMemoryJobTracker implements IJobTracker {
-  private eventBus;
-  private jobs;
-  private unsubscribers;
-  constructor(eventBus: IEventBus);
-  private subscribeToEvents;
-  private handleWriteReady;
-  private handleReadReady;
-  private handleJobFailed;
-  shutdown(): void;
-  registerJob(jobInfo: JobInfo): void;
-  markRunning(jobId: string): void;
-  markFailed(jobId: string, error: ErrorInfo$1, job?: Job): void;
-  getJobStatus(jobId: string): JobInfo | null;
-}
-//#endregion
-//#region src/executor/simple-job-executor-manager.d.ts
-type JobExecutorFactory = () => IJobExecutor;
-/**
- * Manages multiple job executors and coordinates job distribution.
- * Listens for job available events and dispatches jobs to executors.
- */
-declare class SimpleJobExecutorManager implements IJobExecutorManager {
-  private executorFactory;
-  private eventBus;
-  private queue;
-  private jobTracker;
-  private logger;
-  private resolver;
-  private executors;
-  private isRunning;
-  private activeJobs;
-  private totalJobsProcessed;
-  private unsubscribe?;
-  private deferredJobs;
-  private resultHandler;
-  private jobTimeoutMs;
-  constructor(executorFactory: JobExecutorFactory, eventBus: IEventBus, queue: IQueue, jobTracker: IJobTracker, logger: ILogger, resolver: IDocumentModelResolver, jobTimeoutMs?: number);
-  start(numExecutors: number): Promise<void>;
-  stop(graceful?: boolean): Promise<void>;
-  getExecutors(): IJobExecutor[];
-  getStatus(): ExecutorManagerStatus;
-  private processNextJob;
-  private checkForMoreJobs;
-  private processExistingJobs;
-  private flushDeferredJobs;
-}
-//#endregion
-//#region src/cache/document-meta-cache-types.d.ts
-/**
- * Cached document metadata from the "document" scope.
- *
- * This lightweight structure holds essential document information needed by
- * the job executor without fetching full scope state. It provides an explicit
- * cross-scope contract for accessing document scope metadata.
- */
-type CachedDocumentMeta = {
+//#endregion
+//#region src/subs/react-subscription-manager.d.ts
+type DocumentCreatedCallback = (result: PagedResults<string>) => void;
+type DocumentDeletedCallback = (documentIds: string[]) => void;
+type DocumentStateUpdatedCallback = (result: PagedResults<PHDocument>) => void;
+type RelationshipChangedCallback = (parentId: string, childId: string, changeType: RelationshipChangeType) => void;
+declare class ReactorSubscriptionManager implements IReactorSubscriptionManager {
+  private createdSubscriptions;
+  private deletedSubscriptions;
+  private updatedSubscriptions;
+  private relationshipSubscriptions;
+  private subscriptionCounter;
+  private errorHandler;
+  constructor(errorHandler: ISubscriptionErrorHandler);
+  onDocumentCreated(callback: DocumentCreatedCallback, search?: SearchFilter): () => void;
+  onDocumentDeleted(callback: DocumentDeletedCallback, search?: SearchFilter): () => void;
+  onDocumentStateUpdated(callback: DocumentStateUpdatedCallback, search?: SearchFilter, view?: ViewFilter): () => void;
+  onRelationshipChanged(callback: RelationshipChangedCallback, search?: SearchFilter): () => void;
   /**
-   * The full PHDocumentState from document.state.document.
-   * Contains version, hash, isDeleted, deletedAtUtcIso, etc.
+   * Notify subscribers about created documents
    */
-  state: PHDocumentState;
+  notifyDocumentsCreated(documentIds: string[], documentTypes?: Map<string, string>, parentIds?: Map<string, string | null>): void;
   /**
-   * The document type (from header), cached for convenience.
+   * Notify subscribers about deleted documents
    */
-  documentType: string;
+  notifyDocumentsDeleted(documentIds: string[], documentTypes?: Map<string, string>, parentIds?: Map<string, string | null>): void;
   /**
-   * The revision of the document scope when this metadata was captured.
-   * Used for cache invalidation and consistency checks.
+   * Notify subscribers about updated documents
    */
-  documentScopeRevision: number;
-};
-/**
- * Interface for the document metadata cache.
- *
- * This cache provides an explicit cross-scope contract for accessing document
- * scope metadata. It solves the problem where job execution in one scope (e.g.,
- * "global") needs access to document scope state (version, isDeleted, etc.)
- * which may be stale in scope-specific caches or keyframes.
- *
- * The cache supports:
- * - Latest metadata retrieval with LRU caching
- * - Historical metadata reconstruction for reshuffling scenarios
- * - Eager updates after document scope operations
- */
-interface IDocumentMetaCache {
+  notifyDocumentsUpdated(documents: PHDocument[]): void;
   /**
-   * Retrieves the LATEST document metadata from cache or rebuilds from operations.
-   *
-   * On cache miss, fetches all document scope operations and reconstructs the
-   * current PHDocumentState by applying UPGRADE_DOCUMENT and DELETE_DOCUMENT
-   * operations.
-   *
-   * @param documentId - The document identifier
-   * @param branch - Branch name
-   * @param signal - Optional abort signal to cancel the operation
-   * @returns The cached or rebuilt document metadata
-   * @throws {Error} "Operation aborted" if signal is aborted
-   * @throws {Error} If document not found (no CREATE_DOCUMENT operation)
+   * Notify subscribers about relationship changes
    */
-  getDocumentMeta(documentId: string, branch: string, signal?: AbortSignal): Promise<CachedDocumentMeta>;
+  notifyRelationshipChanged(parentId: string, childId: string, changeType: RelationshipChangeType, childType?: string): void;
   /**
-   * Rebuilds document metadata at a SPECIFIC revision (always rebuilds, no caching).
-   *
-   * Used during reshuffling when operations need to be inserted at a previous
-   * revision and we need the document scope state as of that point in time.
-   *
-   * @param documentId - The document identifier
-   * @param branch - Branch name
-   * @param targetRevision - The document scope revision to reconstruct up to
-   * @param signal - Optional abort signal to cancel the operation
-   * @returns Document metadata as of the target revision
-   * @throws {Error} "Operation aborted" if signal is aborted
-   * @throws {Error} If document not found
+   * Clear all subscriptions
    */
-  rebuildAtRevision(documentId: string, branch: string, targetRevision: number, signal?: AbortSignal): Promise<CachedDocumentMeta>;
+  clearAll(): void;
+  private filterDocumentIds;
+  private filterDocuments;
+  private matchesRelationshipFilter;
+}
+//#endregion
+//#region src/events/event-bus.d.ts
+declare class EventBus implements IEventBus {
+  readonly eventTypeToSubscribers: Map<number, Subscriber[]>;
+  subscribe<K>(type: number, subscriber: (type: number, event: K) => void | Promise<void>): Unsubscribe;
+  emit(type: number, data: any): Promise<void>;
+}
+//#endregion
+//#region src/queue/queue.d.ts
+/**
+ * In-memory implementation of the IQueue interface.
+ * Organizes jobs by documentId, scope, and branch to ensure proper ordering.
+ * Ensures serial execution per document by tracking executing jobs.
+ * Implements dependency management through queue hints.
+ */
+declare class InMemoryQueue implements IQueue {
+  private eventBus;
+  private resolver;
+  private queues;
+  private jobIdToQueueKey;
+  private docIdToJobId;
+  private jobIdToDocId;
+  private completedJobs;
+  private jobIndex;
+  private isBlocked;
+  private onDrainedCallback?;
+  private isPausedFlag;
+  constructor(eventBus: IEventBus, resolver: IDocumentModelResolver);
+  private toErrorInfo;
   /**
-   * Eagerly updates cached metadata after document scope operations.
-   *
-   * Called by the job executor after CREATE_DOCUMENT, UPGRADE_DOCUMENT, or
-   * DELETE_DOCUMENT operations to keep the cache current.
-   *
-   * @param documentId - The document identifier
-   * @param branch - Branch name
-   * @param meta - The new metadata to cache
+   * Creates a unique key for a document/scope/branch combination
    */
-  putDocumentMeta(documentId: string, branch: string, meta: CachedDocumentMeta): void;
+  private createQueueKey;
   /**
-   * Invalidates cached document metadata.
-   *
-   * Call before reshuffling operations that modify the document scope, or
-   * when document state may have changed externally.
-   *
-   * @param documentId - The document identifier
-   * @param branch - Optional branch to narrow invalidation (if omitted, all branches)
-   * @returns Number of entries invalidated
+   * Gets or creates a queue for the given key
    */
-  invalidate(documentId: string, branch?: string): number;
+  private getQueue;
   /**
-   * Clears all cached document metadata.
+   * Check if a document has any jobs currently executing
    */
-  clear(): void;
+  private isDocumentExecuting;
   /**
-   * Performs startup initialization.
+   * Mark a job as executing for its document
    */
-  startup(): Promise<void>;
+  private markJobExecuting;
   /**
-   * Performs graceful shutdown.
+   * Mark a job as no longer executing for its document
    */
-  shutdown(): Promise<void>;
-}
-//#endregion
-//#region src/cache/buffer/ring-buffer.d.ts
-/**
- * RingBuffer is a generic circular buffer implementation that stores a fixed number
- * of items. When the buffer is full, new items overwrite the oldest items.
- *
- * This implementation maintains O(1) time complexity for push operations and provides
- * items in chronological order (oldest to newest) via getAll().
- *
- * @template T - The type of items stored in the buffer
- */
-declare class RingBuffer<T> {
-  private buffer;
-  private head;
-  private size;
-  private capacity;
-  constructor(capacity: number);
+  private markJobComplete;
   /**
-   * Adds an item to the buffer. If the buffer is full, overwrites the oldest item.
-   *
-   * @param item - The item to add
+   * Check if all dependencies for a job have been completed
    */
-  push(item: T): void;
+  private areDependenciesMet;
   /**
-   * Returns all items in the buffer in chronological order (oldest to newest).
+   * Returns the head of the sub-queue if its dependencies are met, or null.
    *
-   * @returns Array of items in insertion order
+   * The dispatcher only ever considers the head — a dep-blocked head holds
+   * the rest of its sub-queue. This preserves per-(documentId, scope, branch)
+   * FIFO regardless of how dependencies are authored, and makes the queue's
+   * documented "serialized per document" invariant hold even when callers
+   * omit queueHint dependencies on jobs that share a sub-queue.
    */
-  getAll(): T[];
+  private getNextJobWithMetDependencies;
+  private getCreateDocumentType;
+  enqueue(job: Job): Promise<void>;
+  dequeue(documentId: string, scope: string, branch: string, signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
+  dequeueNext(signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
+  dequeueNextMatching(predicate: (meta: JobRoutingMeta) => boolean, signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
+  size(documentId: string, scope: string, branch: string): Promise<number>;
+  totalSize(): Promise<number>;
+  remove(jobId: string): Promise<boolean>;
+  clear(documentId: string, scope: string, branch: string): Promise<void>;
+  clearAll(): Promise<void>;
+  hasJobs(): Promise<boolean>;
+  completeJob(jobId: string): Promise<void>;
+  failJob(jobId: string, error?: ErrorInfo$1): Promise<void>;
+  deferJob(jobId: string): void;
+  retryJob(jobId: string, error?: ErrorInfo$1, accounting?: RetryAccounting): Promise<void>;
   /**
-   * Clears all items from the buffer.
+   * Check if the queue is drained and call the callback if it is
    */
-  clear(): void;
+  private checkDrained;
   /**
-   * Gets the current number of items in the buffer.
+   * Returns true if and only if all jobs have been resolved.
    */
-  get length(): number;
-}
-//#endregion
-//#region src/cache/kysely-write-cache.d.ts
-type DocumentStream = {
-  key: string;
-  ringBuffer: RingBuffer<CachedSnapshot>;
-};
-/**
- * In-memory write cache with keyframe persistence for PHDocuments.
- *
- * Caches document snapshots in ring buffers with LRU eviction. On cache miss,
- * rebuilds documents from nearest keyframe or full operation history.
- *
- * **Performance Characteristics:**
- * - Cache hit: O(1) lookup in ring buffer
- * - Cold miss: O(n) where n is total operation count, or O(k) where k is operations since keyframe
- * - Warm miss: O(m) where m is operations since cached revision
- * - Eviction: O(1) for LRU tracking and removal
- *
- * **Thread Safety:**
- * Not thread-safe. Designed for single-threaded job executor environment.
- * External synchronization required for concurrent access across multiple executors.
- *
- * **Example:**
- * ```typescript
- * const cache = new KyselyWriteCache(
- *   keyframeStore,
- *   operationStore,
- *   registry,
- *   { maxDocuments: 1000, ringBufferSize: 10, keyframeInterval: 10 }
- * );
- *
- * await cache.startup();
- *
- * // Retrieve or rebuild document
- * const doc = await cache.getState(docId, docType, scope, branch, revision);
- *
- * // Cache result after job execution
- * cache.putState(docId, docType, scope, branch, newRevision, updatedDoc);
- *
- * await cache.shutdown();
- * ```
- */
-declare class KyselyWriteCache implements IWriteCache {
-  private streams;
-  private lruTracker;
-  private keyframeStore;
-  private operationStore;
-  private registry;
-  private config;
-  constructor(keyframeStore: IKeyframeStore, operationStore: IOperationStore, registry: IDocumentModelRegistry, config: WriteCacheConfig);
-  withScopedStores(operationStore: IOperationStore, keyframeStore: IKeyframeStore): KyselyWriteCache;
+  get isDrained(): boolean;
   /**
-   * Initializes the write cache.
-   * Currently a no-op as keyframe store lifecycle is managed externally.
+   * Blocks the queue from accepting new jobs.
+   * @param onDrained - Optional callback to call when the queue is drained
    */
-  startup(): Promise<void>;
+  block(onDrained?: () => void): void;
   /**
-   * Shuts down the write cache.
-   * Currently a no-op as keyframe store lifecycle is managed externally.
+   * Unblocks the queue from accepting new jobs.
    */
-  shutdown(): Promise<void>;
+  unblock(): void;
   /**
-   * Retrieves document state at a specific revision from cache or rebuilds it.
-   *
-   * Cache hit path: Returns cached snapshot if available (O(1))
-   * Warm miss path: Rebuilds from cached base revision + incremental ops
-   * Cold miss path: Rebuilds from keyframe or from scratch using all operations
-   *
-   * @param documentId - The document identifier
-   * @param scope - The operation scope
-   * @param branch - The operation branch
-   * @param targetRevision - The target revision, or undefined for newest
-   * @param signal - Optional abort signal to cancel the operation
-   * @returns The document at the target revision
-   * @throws {Error} "Operation aborted" if signal is aborted
-   * @throws {ModuleNotFoundError} If document type not registered in registry
-   * @throws {Error} "Failed to rebuild document" if operation store fails
-   * @throws {Error} If reducer throws during operation application
-   * @throws {Error} If document serialization fails
+   * Pauses job dequeuing. Jobs can still be enqueued but dequeueNext() will return null.
    */
-  getState(documentId: string, scope: string, branch: string, targetRevision?: number, signal?: AbortSignal): Promise<PHDocument>;
+  pause(): void;
   /**
-   * Stores a document snapshot in the cache at a specific revision.
-   *
-   * The cached document is a shallow copy of the input with its operation history
-   * truncated to the last operation per scope and its clipboard cleared. This keeps
-   * memory use and copy costs constant regardless of operation count. Consumers of
-   * getState() must not rely on the full operation history being present; the only
-   * guaranteed invariant is that operations[scope].at(-1) reflects the latest
-   * operation index for each scope.
-   *
-   * Updates LRU tracker and may evict least recently used stream if at capacity.
-   * Asynchronously persists keyframes at configured intervals (fire-and-forget).
-   *
-   * @param documentId - The document identifier
-   * @param scope - The operation scope
-   * @param branch - The operation branch
-   * @param revision - The revision number
-   * @param document - The document to cache
-   * @throws {Error} If document serialization fails
+   * Resumes job dequeuing and emits JOB_AVAILABLE events for pending jobs to wake up executors.
    */
-  putState(documentId: string, scope: string, branch: string, revision: number, document: PHDocument): void;
+  resume(): Promise<void>;
   /**
-   * Invalidates cached document streams.
-   *
-   * Supports three invalidation scopes:
-   * - Document-level: invalidate(documentId) - removes all streams for document
-   * - Scope-level: invalidate(documentId, scope) - removes all branches for scope
-   * - Stream-level: invalidate(documentId, scope, branch) - removes specific stream
-   *
-   * @param documentId - The document identifier
-   * @param scope - Optional scope to narrow invalidation
-   * @param branch - Optional branch to narrow invalidation (requires scope)
-   * @returns The number of streams evicted
+   * Returns whether job dequeuing is paused.
    */
-  invalidate(documentId: string, scope?: string, branch?: string): number;
+  get paused(): boolean;
   /**
-   * Clears the entire cache, removing all cached document streams.
-   * Resets LRU tracking state. This operation always succeeds.
+   * Returns all pending jobs across all queues.
    */
-  clear(): void;
+  getPendingJobs(): Job[];
   /**
-   * Retrieves a specific stream for a document. Exposed on the implementation
-   * for testing, but not on the interface.
-   *
-   * @internal
+   * Returns a map of document IDs to sets of executing job IDs.
    */
-  getStream(documentId: string, scope: string, branch: string): DocumentStream | undefined;
-  private findNearestKeyframe;
-  private coldMissRebuild;
+  getExecutingJobIds(): Map<string, Set<string>>;
   /**
-   * Resolves which module version to use for a given operation in phase 2.
-   *
-   * Uses the validated-upgrade boundary rules from D7:
-   * - If `input.revision` is present: op.index < revision[scope] → before the upgrade boundary
-   * - Otherwise: timestamp fallback
-   * - Falls back to final module version when neither is decidable
+   * Returns a job by ID from the job index.
    */
-  private resolveModuleVersionForOp;
-  private warmMissRebuild;
-  private findNearestOlderSnapshot;
-  private makeStreamKey;
-  private getOrCreateStream;
-  private isKeyframeRevision;
-}
-//#endregion
-//#region src/storage/kysely/store.d.ts
-declare class KyselyOperationStore implements IOperationStore {
-  private db;
-  private trx?;
-  constructor(db: Kysely<Database$1>);
-  private get queryExecutor();
-  withTransaction(trx: Transaction<Database$1>): KyselyOperationStore;
-  apply(documentId: string, documentType: string, scope: string, branch: string, revision: number, fn: (txn: AtomicTxn) => void | Promise<void>, signal?: AbortSignal): Promise<Operation[]>;
-  private resolveUniqueConstraint;
-  private executeApply;
-  private findIdempotentReplay;
-  getSince(documentId: string, scope: string, branch: string, revision: number, filter?: OperationFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Operation>>;
-  getSinceId(id: number, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<OperationWithContext$1>>;
-  getConflicting(documentId: string, scope: string, branch: string, minTimestamp: string, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Operation>>;
-  getRevisions(documentId: string, branch: string, signal?: AbortSignal): Promise<DocumentRevisions>;
-  private rowToOperation;
-  private rowToOperationWithContext;
+  getJob(jobId: string): Job | undefined;
 }
 //#endregion
-//#region src/storage/kysely/keyframe-store.d.ts
-declare class KyselyKeyframeStore implements IKeyframeStore {
-  private db;
-  private trx?;
-  constructor(db: Kysely<Database$1>);
-  private get queryExecutor();
-  withTransaction(trx: Transaction<Database$1>): KyselyKeyframeStore;
-  putKeyframe(documentId: string, scope: string, branch: string, revision: number, document: PHDocument, signal?: AbortSignal): Promise<void>;
-  findNearestKeyframe(documentId: string, scope: string, branch: string, targetRevision: number, signal?: AbortSignal): Promise<{
-    revision: number;
-    document: PHDocument;
-  } | undefined>;
-  listKeyframes(documentId: string, scope?: string, branch?: string, signal?: AbortSignal): Promise<Array<{
-    scope: string;
-    branch: string;
-    revision: number;
-    document: PHDocument;
-  }>>;
-  deleteKeyframes(documentId: string, scope?: string, branch?: string, signal?: AbortSignal): Promise<number>;
+//#region src/job-tracker/in-memory-job-tracker.d.ts
+/**
+ * In-memory implementation of IJobTracker.
+ * Maintains job status in a Map for synchronous access.
+ * Subscribes to operation events to update job states.
+ */
+declare class InMemoryJobTracker implements IJobTracker {
+  private eventBus;
+  private jobs;
+  private unsubscribers;
+  constructor(eventBus: IEventBus);
+  private subscribeToEvents;
+  private handleWriteReady;
+  private handleReadReady;
+  private handleJobFailed;
+  shutdown(): void;
+  registerJob(jobInfo: JobInfo): void;
+  markRunning(jobId: string): void;
+  markFailed(jobId: string, error: ErrorInfo$1, job?: Job): void;
+  getJobStatus(jobId: string): JobInfo | null;
 }
 //#endregion
-//#region src/executor/execution-scope.d.ts
-interface ExecutionStores {
-  operationStore: IOperationStore;
-  operationIndex: IOperationIndex;
-  writeCache: IWriteCache;
-  documentMetaCache: IDocumentMetaCache;
-  collectionMembershipCache: ICollectionMembershipCache;
-}
-interface IExecutionScope {
-  run<T>(fn: (stores: ExecutionStores) => Promise<T>, signal?: AbortSignal): Promise<T>;
+//#region src/executor/simple-job-executor-manager.d.ts
+type JobExecutorFactory = () => IJobExecutor;
+/**
+ * Manages multiple job executors and coordinates job distribution.
+ * Listens for job available events and dispatches jobs to executors.
+ */
+declare class SimpleJobExecutorManager implements IJobExecutorManager {
+  private executorFactory;
+  private eventBus;
+  private queue;
+  private jobTracker;
+  private logger;
+  private resolver;
+  private executors;
+  private isRunning;
+  private activeJobs;
+  private totalJobsProcessed;
+  private unsubscribe?;
+  private deferredJobs;
+  private resultHandler;
+  private jobTimeoutMs;
+  constructor(executorFactory: JobExecutorFactory, eventBus: IEventBus, queue: IQueue, jobTracker: IJobTracker, logger: ILogger, resolver: IDocumentModelResolver, jobTimeoutMs?: number, deferredJobTtlMs?: number);
+  start(numExecutors: number): Promise<void>;
+  stop(graceful?: boolean): Promise<void>;
+  getExecutors(): IJobExecutor[];
+  getStatus(): ExecutorManagerStatus;
+  private processNextJob;
+  private checkForMoreJobs;
+  private processExistingJobs;
 }
 //#endregion
 //#region src/executor/simple-job-executor.d.ts
@@ -5079,6 +5984,8 @@ declare class SimpleJobExecutor implements IJobExecutor {
   private collectionMembershipCache;
   private driveContainerTypes;
   private config;
+  private featureFlags;
+  private decisionModel;
   private signatureVerifierModule;
   private documentActionHandler;
   private executionScope;
@@ -5091,6 +5998,69 @@ declare class SimpleJobExecutor implements IJobExecutor {
   private getCollectionMembershipsForOperations;
   private processActions;
   private executeRegularAction;
+  /**
+   * Orders a write by timestamp and decides it where it lands. The caller
+   * supplies the timestamp, so a write can belong before operations already
+   * stored; those are re-appended alongside it, the way a load reshuffles.
+   *
+   * Deciding a backdated write at the stream heads instead of at its position
+   * would overwrite the verdict every other replica computes for it.
+   */
+  private positionByTimestamp;
+  /**
+   * Decides each operation where it lands and carries the verdict on it. A
+   * refused submitted action is reported to the caller and nothing is stored; a
+   * refused operation the reshuffle merely moved keeps its verdict, because it
+   * already holds a position.
+   *
+   * The operations carry the indexes and skips they will be stored at, because
+   * the walk resolves skips before it orders them.
+   */
+  private evaluatePositioned;
+  /**
+   * The scopes a re-evaluation pass visits, in a fixed order.
+   *
+   * The revisions map comes from a query with no ORDER BY, and the order is
+   * load-bearing: each scope's pass re-reads the auth stream, and the walk skips
+   * an operation by its stored denial, so a denial this pass just wrote is
+   * visible to a later-visited scope and invisible to an earlier one. The model's
+   * own projection order leads, then the rest sorted, so the pass is reproducible
+   * across replicas and across runs.
+   */
+  private evaluationOrder;
+  /**
+   * The first timestamp in the batch that does not strictly exceed everything
+   * ahead of it, or undefined when the whole batch is monotonic.
+   *
+   * The bound is carried forward rather than compared against one stored maximum,
+   * because a single execute can carry several auth actions stamped in the same
+   * millisecond. Letting a tie through would store a stream the position walk
+   * then refuses to read, with no repair path.
+   */
+  private firstNonMonotonicTimestamp;
+  /** The operations a batch of submitted actions appends at the scope's tail. */
+  private appendedOperations;
+  /**
+   * Re-evaluates the document when a write meets both criteria: it was written
+   * to a stream the model reads, and it is timestamped before an operation
+   * already stored. The caller supplies the timestamp and the reactor does not replace
+   * it, so a mutation job can write such an operation just as a load job can,
+   * which is why both executeJob and executeLoadJob call this.
+   */
+  private reevaluateIfCriteriaMet;
+  /**
+   * Re-evaluates every scope the model evaluates. Where an operation's
+   * evaluation differs from what is stored, the tail from that operation is
+   * re-appended, carrying a skip that spans the indices it supersedes.
+   */
+  private reevaluateDocument;
+  /**
+   * Re-judges a document's stored operations because a read-set stream in
+   * another document (a group) gained an operation. The trigger timestamp
+   * bounds the work: an operation later than everything this document holds
+   * cannot change any evaluation, so the pass is skipped.
+   */
+  private executeReevaluationJob;
   private executeLoadJob;
   private accumulateResultOrReturnError;
 }
@@ -5159,6 +6129,78 @@ declare class DocumentModelRegistry implements IDocumentModelRegistry {
   getUpgradeReducer(documentType: string, fromVersion: number, toVersion: number): UpgradeReducer<any, any>;
 }
 //#endregion
+//#region src/decision/build-decision-model.d.ts
+/**
+ * Reads each projection's stream through the supplied reader, recording the
+ * revision observed. Static projections resolve first; derived projections
+ * see only those and contribute a map from document id to state. Each
+ * distinct stream is read once and yields one append condition entry.
+ */
+declare function buildDecisionModel<M>(reader: IStreamStateReader, definition: (target: DecisionTarget) => DecisionModel<M>, target: DecisionTarget, signal?: AbortSignal): Promise<BuiltDecisionModel<M>>;
+//#endregion
+//#region src/decision/auth-decision-model.d.ts
+type AuthDecisionModel = {
+  document: PHDocumentState;
+  auth: PHAuthState;
+};
+/** This decision model uses both the document and the auth streams. */
+declare function authDecisionModel(target: DecisionTarget): DecisionModel<AuthDecisionModel>;
+//#endregion
+//#region src/decision/sync-scope-gate.d.ts
+/**
+ * A read gate asked by document id rather than by document.
+ *
+ * Serving works from an id: an outbox entry names a document, a branch and a
+ * scope, and carries no state. Fetching the document is therefore the serving
+ * path's own job, and it is the only thing this adds to the gate it wraps.
+ */
+declare class SyncScopeGate {
+  private readonly gate;
+  private readonly documentView;
+  private readonly logger?;
+  constructor(gate: IReadGate, documentView: IDocumentView, logger?: ILogger | undefined);
+  /**
+   * Which scopes of one document the subject may be served.
+   *
+   * A document this replica cannot produce yields the metadata scopes and
+   * nothing else. That is the fail-closed direction, and it is safe to fail
+   * closed here precisely because serving withholds rather than consumes: the
+   * entry stays in the outbox and the next poll asks again, so a document that
+   * is merely not indexed yet is delayed rather than lost.
+   *
+   * Any other failure is rethrown. A read side that is down must not read as a
+   * silent, universal denial, because a denial that looks like a policy is one
+   * nobody investigates.
+   */
+  scopePredicateById(documentId: string, subject: AuthSubject, branch: string, signal?: AbortSignal): Promise<(scope: string) => boolean>;
+}
+//#endregion
+//#region src/decision/stream-order.d.ts
+/** Where a stream's stored order contradicts its timestamps. */
+type OutOfOrderPair = {
+  previous: Operation;
+  current: Operation;
+  /**
+   * `descending` cannot be walked at all. `tied` walks fine — the intra-stream
+   * rule breaks the tie by index — but violates the monotonic auth rule, so a
+   * stream holding one can never be replicated to a peer that lacks it.
+   */
+  kind: "descending" | "tied";
+};
+/**
+ * The first pair of effective operations whose stored order contradicts their
+ * timestamps, or undefined when the stream is in position order.
+ *
+ * Such a stream cannot be walked, and the auth stream is never reshuffled once
+ * the monotonic rule is on, so run this before enabling enforcement on a fleet.
+ *
+ * `requireStrict` additionally rejects a tie, which is what the auth stream's
+ * monotonic rule requires and what the walk alone does not care about.
+ */
+declare function firstOutOfOrderPair(operations: Operation[], options?: {
+  requireStrict?: boolean;
+}): OutOfOrderPair | undefined;
+//#endregion
 //#region src/read-models/base-read-model.d.ts
 type BaseReadModelConfig = {
   readModelId: string;
@@ -5243,7 +6285,7 @@ declare class KyselyDocumentIndexer extends BaseReadModel implements IDocumentIn
  * serialized so the executor can return to dispatch without holding ordering
  * implicitly.
  */
-declare class ReadModelCoordinator implements IReadModelCoordinator {
+declare class ReadModelCoordinator implements ILiveReadModelCoordinator {
   private eventBus;
   readonly preReady: IReadModel[];
   readonly postReady: IReadModel[];
@@ -5262,6 +6304,7 @@ declare class ReadModelCoordinator implements IReadModelCoordinator {
    */
   drain(): Promise<void>;
   getChainDepth(): number;
+  addReadModel(readModel: IReadModel, stage: ReadModelRegistrationStage): void;
   private handleWriteReady;
   private emitEmptyReadReady;
   private runChain;
@@ -5275,8 +6318,31 @@ declare class ReadModelCoordinator implements IReadModelCoordinator {
 type Database$2 = Database$1 & DocumentViewDatabase;
 declare class KyselyDocumentView extends BaseReadModel implements IDocumentView {
   private operationStore;
+  /**
+   * Whether a single-document read serves a deleted document's state as of the
+   * deletion rather than hiding it. Only meaningful with `documentDecisions`,
+   * which is what makes deletion positional. Listings omit it either way.
+   */
+  private readonly servesDeletionBoundary;
   private _db;
-  constructor(db: Kysely<Database$2>, operationStore: IOperationStore, operationIndex: IOperationIndex, writeCache: IWriteCache, consistencyTracker: IConsistencyTracker);
+  constructor(db: Kysely<Database$2>, operationStore: IOperationStore, operationIndex: IOperationIndex, writeCache: IWriteCache, consistencyTracker: IConsistencyTracker,
+  /**
+   * Whether a single-document read serves a deleted document's state as of the
+   * deletion rather than hiding it. Only meaningful with `documentDecisions`,
+   * which is what makes deletion positional. Listings omit it either way.
+   */
+
+  servesDeletionBoundary: boolean);
+  /**
+   * Indexes committed operations into DocumentSnapshot rows. CREATE_DOCUMENT
+   * only seeds header/document/auth. UPGRADE_DOCUMENT reindexes every scope
+   * present in resultingState when the operation vouches for them — a seed
+   * carrying initialState or a migration stamped with the __migrated marker
+   * — since the upgrade reducer may have reshaped any of them; upgrades
+   * without either fall back to header/document/auth, because their sibling
+   * echoes may be stale. All other action types index only header and their
+   * own scope.
+   */
   protected commitOperations(items: OperationWithContext$1[]): Promise<void>;
   exists(documentIds: string[], consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<boolean[]>;
   get<TDocument extends PHDocument>(documentId: string, view?: ViewFilter$1, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<TDocument>;
@@ -5290,7 +6356,13 @@ declare class KyselyDocumentView extends BaseReadModel implements IDocumentView
 //#endregion
 //#region src/storage/migrations/migrator.d.ts
 declare const REACTOR_SCHEMA = "reactor";
-declare function runMigrations(db: Kysely<any>, schema?: string): Promise<MigrationResult>;
+/**
+ * Applies every pending migration, or every one up to and including `upTo`.
+ *
+ * The bound exists so a test can reach the schema a data migration is written
+ * against, populate it, and then migrate across the migration under test.
+ */
+declare function runMigrations(db: Kysely<any>, schema?: string, upTo?: string): Promise<MigrationResult>;
 declare function getMigrationStatus(db: Kysely<any>, schema?: string): Promise<readonly kysely.MigrationInfo[]>;
 //#endregion
 //#region src/storage/kysely/sync-cursor-storage.d.ts
@@ -5408,6 +6480,8 @@ declare class GqlRequestChannel implements IChannel {
   private isPushing;
   private pendingDrain;
   private receivingPages;
+  /** Cleared for good the first time the remote rejects {@link DECISION_FIELDS}. */
+  private peerServesDecisionFields;
   private isRecovering;
   private connectionState;
   /** Latest unrecoverable error was an auth rejection; cleared on connect. */
@@ -5454,6 +6528,18 @@ declare class GqlRequestChannel implements IChannel {
    * Queries the remote GraphQL endpoint for sync envelopes.
    */
   private pollSyncEnvelopes;
+  /**
+   * True when the remote rejected the query for naming a field it does not
+   * have. Selecting an unknown field fails validation for the whole query, so
+   * an unhandled one takes the channel's polling down until the process
+   * restarts rather than degrading.
+   */
+  private rejectsDecisionFields;
+  /**
+   * The poll query. `withDecisionFields` selects the two fields added with the
+   * auth projection; a remote on the previous schema is polled without them.
+   */
+  private pollQuery;
   /**
    * Registers or updates this channel on the remote server via GraphQL mutation.
    * Returns the remote's ack ordinal so the client can trim its outbox.
@@ -5514,6 +6600,8 @@ declare class GqlResponseChannel implements IChannel {
   private isShutdown;
   private lastPersistedInboxOrdinal;
   private lastPersistedOutboxOrdinal;
+  private evictedOutboxFloor;
+  private appliedOutboxOrdinal;
   private connectionState;
   private readonly connectionStateCallbacks;
   constructor(logger: ILogger, channelId: string, remoteName: string, cursorStorage: ISyncCursorStorage);
@@ -5522,8 +6610,35 @@ declare class GqlResponseChannel implements IChannel {
   onConnectionStateChange(callback: ConnectionStateChangeCallback): () => void;
   /** Response channels are push-driven; resolvers populate mailboxes directly. */
   triggerPull(): void;
-  private transitionConnectionState;
   init(): Promise<void>;
+  private transitionConnectionState;
+  /**
+   * Records the ordinals of entries that left the outbox without being served,
+   * so the cursor cannot advance past them.
+   *
+   * An entry can leave unserved because a bound evicted it, and an evicted entry
+   * is exactly one this channel intends to re-derive: it is still owed to the
+   * remote. Remembering the floor across the whole run rather than only while
+   * the entry is present is what makes that true after a later ack would
+   * otherwise have swept the cursor past it.
+   */
+  private rememberUnserved;
+  /**
+   * Persists the outbox cursor, never past an operation this remote has not
+   * been served.
+   *
+   * The cursor is where a restart resumes deriving the outbox from, so an
+   * ordinal persisted past an unserved entry loses that entry for good: the
+   * rebuild starts beyond it and nothing else remembers it was owed. Acks
+   * arrive out of order with respect to what is withheld -- a later entry can
+   * be acknowledged while an earlier one is still being withheld from this
+   * subject -- so the applied high-water mark alone is not a safe cursor.
+   */
+  private persistOutboxCursor;
+  /** Drops the evicted floor once the entries it stood for are queued again. */
+  private forgetEvictedBelow;
+  /** The lowest ordinal still owed to this remote, evicted or still queued. */
+  private unservedFloor;
 }
 //#endregion
 //#region src/sync/channels/interval-poll-timer.d.ts
@@ -5614,8 +6729,27 @@ declare function batchOperationsByDocument(operations: OperationWithContext$1[])
  * a single SyncOperation per group. Within each group, operations are sorted
  * by context.ordinal. The merged SyncOperation keeps the first group member's
  * jobId; all other jobIds are remapped so external dependencies still resolve.
+ *
+ * Only CONTIGUOUS runs merge. A document whose scopes interleave arrives as an
+ * alternating chain (document -> auth -> document -> auth) where each entry
+ * depends on the one before it. Merging every occurrence of a
+ * (documentId, scope, branch) collapses that chain into two nodes that each
+ * depend on the other, which validateBatchStructure rejects as a dependency
+ * cycle. Merging only adjacent entries keeps the chain linear.
  */
 declare function consolidateSyncOperations(syncOps: SyncOperation[]): SyncOperation[];
+/**
+ * Classifies a failure by error name rather than `instanceof`, because a failure
+ * that crossed the pooled-worker boundary arrives as plain data.
+ */
+declare function classifyJobFailure(errorName: string): SyncOperationErrorType;
+/** The explicit type when something else carried it, else derived by name. */
+declare function syncOperationErrorType(error: ChannelError | undefined): SyncOperationErrorType;
+/**
+ * A held auth operation must not quarantine: reconciling the two policies needs
+ * the traffic a quarantine would stop.
+ */
+declare function quarantinesDocument(errorType: SyncOperationErrorType): boolean;
 //#endregion
 //#region src/admin/types.d.ts
 type KeyframeValidationIssue = {
@@ -5631,11 +6765,20 @@ type SnapshotValidationIssue = {
   snapshotHash: string;
   replayedHash: string;
 };
+/** Effective operations whose stored order contradicts their timestamps. */
+type StreamOrderIssue = {
+  scope: string;
+  branch: string;
+  previous: Operation;
+  current: Operation;
+  kind: OutOfOrderPair["kind"];
+};
 type ValidationResult = {
   documentId: string;
   isConsistent: boolean;
   keyframeIssues: KeyframeValidationIssue[];
   snapshotIssues: SnapshotValidationIssue[];
+  streamOrderIssues: StreamOrderIssue[];
 };
 type RebuildResult = {
   documentId: string;
@@ -5659,10 +6802,14 @@ declare class DocumentIntegrityService implements IDocumentIntegrityService {
   validateDocument(documentId: string, branch?: string, signal?: AbortSignal): Promise<ValidationResult>;
   rebuildKeyframes(documentId: string, branch?: string, signal?: AbortSignal): Promise<RebuildResult>;
   rebuildSnapshots(documentId: string, branch?: string, signal?: AbortSignal): Promise<RebuildResult>;
+  private findStreamOrderIssues;
   private discoverScopes;
 }
 //#endregion
 //#region src/processors/processor-manager.d.ts
+type ProcessorManagerOptions = {
+  legacyProcessorIds?: boolean;
+};
 /**
  * Manages processor lifecycle based on operations.
  * Extends BaseReadModel to receive operations from ReadModelCoordinator.
@@ -5682,7 +6829,8 @@ declare class ProcessorManager extends BaseReadModel implements IProcessorManage
   private cursorCache;
   private logger;
   private driveContainerTypes;
-  constructor(db: Kysely<DocumentViewDatabase>, operationIndex: IOperationIndex, writeCache: IWriteCache, consistencyTracker: IConsistencyTracker, logger: ILogger, driveContainerTypes: ReadonlySet<string>);
+  private legacyProcessorIds;
+  constructor(db: Kysely<DocumentViewDatabase>, operationIndex: IOperationIndex, writeCache: IWriteCache, consistencyTracker: IConsistencyTracker, logger: ILogger, driveContainerTypes: ReadonlySet<string>, options?: ProcessorManagerOptions);
   init(): Promise<void>;
   protected commitOperations(items: OperationWithContext$1[]): Promise<void>;
   registerFactory(identifier: string, factory: ProcessorFactory$1): Promise<void>;
@@ -5707,5 +6855,5 @@ declare class ProcessorManager extends BaseReadModel implements IProcessorManage
   private deleteProcessorCursors;
 }
 //#endregion
-export { type AbortMessage, type AtomicTxn, type AttachmentHash, type AttachmentRef, BaseReadModel, type BatchExecutionRequest, type BatchExecutionResult, type BatchLoadRequest, type BatchLoadResult, type BuiltInReadModelKind, type CachedSnapshot, type ChannelConfig, ChannelError, ChannelErrorSource, type ChannelHealth, type ChannelMeta, ChannelScheme, type ConnectionState, type ConnectionStateChangeCallback, type ConnectionStateChangedEvent, type ConnectionStateSnapshot, type ConsistencyCoordinate, type ConsistencyKey, type ConsistencyToken, ConsistencyTracker, DEFAULT_DRIVE_CONTAINER_TYPES, DRIVE_AUTH_ERROR_MESSAGES, type Database, type DbConfig, type DeadLetterAddedEvent, DefaultSubscriptionErrorHandler, type DocumentChangeEvent, DocumentChangeType, type DocumentGraphEdge, type DocumentIndexerDatabase, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, type DocumentModelSource, type DocumentModelSpec, type DocumentRelationship, type DocumentRevisions, type DocumentStreamKey, type DocumentViewDatabase, DriveClient, DriveCollectionId, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, type ExecuteMessage, type ExecutionJobPlan, type ExecutorStartedEvent, type ExecutorStoppedEvent, type FactorySpec, type FileModelSource, type GqlChannelConfig, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, type HeartbeatMessage, type IChannel, type IChannelFactory, type IConsistencyTracker, type IDocumentGraph, type IDocumentIndexer, type IDocumentIntegrityService, type IDocumentModelLoader, type IDocumentModelRegistry, type IDocumentModelResolver, type IDocumentView, type IDriveClient, type IEventBus, type IJobAwaiter, type IJobExecutor, type IJobExecutorManager, type IJobTracker, type IKeyframeStore, type IMailbox, type IOperationIndex, type IOperationStore, type IPollTimer, type IProcessor, type IProcessorHostModule, type IProcessorManager, type IProjectionTransport, type IQueue, type IReactor, type IReactorClient, type IReactorSubscriptionManager, type IReadModel, type IReadModelCoordinator, type IRelationalDb, type ISubscriptionErrorHandler, type ISyncCursorStorage, type ISyncManager, type ISyncRemoteStorage, type ISyncStatusTracker, type IWriteCache, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, type InProcessReactorClientModule, type InProcessReactorModule, type InProcessSyncModule, type InitMessage, type InsertableDocumentSnapshot, IntervalPollTimer, InvalidModuleError, type Job, type JobAvailableEvent, JobAwaiter, type JobCompletedEvent, type JobExecutorConfig, JobExecutorEventTypes, type JobExecutorFactory, type JobFailedEvent, type JobInfo, type JobPendingEvent, type JobReadReadyEvent, type JobResult, type JobRunningEvent, type JobStartedEvent, JobStatus, type JobWriteReadyEvent, type JobWriteReadyPayload, type JwtHandler, type KeyframeSnapshot, type KeyframeValidationIssue, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, type LoadJobPlan, type LoadModelMessage, type LogMessage, Mailbox, type MetricsMessage, type ModelLoadFailedMessage, type ModelLoadedEvent, type ModelLoadedMessage, type ModelManifestEntry, ModuleNotFoundError, type ModuleRef, NullDocumentModelResolver, type OperationBatch, type OperationContext, type OperationFilter, type OperationIndexEntry, type OperationTable, type OperationWithContext, OptimisticLockError, type PackageModelSource, type PagedResults, type PagingOptions, type ParentMessage, type ParsedDriveUrl, type ParsedPaging, PollBehavior, PollingChannelError, type PoolInstrumentation, type PoolStats, type ProcessorApp, type ProcessorFactory, type ProcessorFactoryBuilder, type ProcessorFilter, ProcessorManager, type ProcessorRecord, type ProcessorStatus, type ProjectionShardBuilderConfig, type ProjectionShardManagerConfig, type ProjectionWorkerFactory, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, type ReactorClientModule, ReactorEventTypes, type ReactorFeatures, type JobFailedEvent$1 as ReactorJobFailedEvent, type ReactorModule, ReactorSubscriptionManager, type ReadModelBatchCompletedEvent, ReadModelCoordinator, type ReadModelFactory, type ReadModelFactoryDeps, type ReadModelIndexedEvent, type ReadModelIndexingStage, type ReadModelStage, type ReadyMessage, type RebuildResult, RelationalDbProcessor, RelationshipChangeType, type Remote, type RemoteCursor, type RemoteFilter, type RemoteMeta, type RemoteOptions, type RemoteRecord, type RemoteStatus, type ResultMessage, RevisionMismatchError, type SanitizedArg, type SearchFilter, type ShutdownMessage, type ShutdownStatus, type SignatureVerificationHandler, type SignatureVerifierSpec, type SignerConfig, SimpleJobExecutorManager, type SnapshotValidationIssue, type Database$1 as StorageDatabase, type SubscriptionErrorContext, SyncBuilder, type SyncEnvelope, type SyncEnvelopeType, SyncEventTypes, type SyncFailedEvent, type SyncModule, SyncOperation, SyncOperationAggregateError, type SyncOperationErrorType, SyncOperationStatus, type SyncPendingEvent, SyncStatus, type SyncStatusChangeCallback, SyncStatusTracker, type SyncSucceededEvent, type TrackedProcessor, type Unsubscribe, type ValidationResult, type ViewFilter, type ErrorInfo as WorkerErrorInfo, type WorkerMessage, type WorkerPoolConfig, type WorkerPoolOptions, type WriteCacheConfig, addRelationshipAction, batchOperationsByDocument, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createMutableShutdownStatus, createRelationalDb, deleteDocumentAction, documentActions, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, getMigrationStatus, instrumentPgPool, isDriveAuthError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, removeRelationshipAction, runMigrations, sanitizeArg, trimMailboxFromAckOrdinal, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
+export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, type AbortMessage, type ActionCandidate, type ActionEvaluationConfig, type ActionEvaluations, type AdmissionDecision, type AppendCondition, AppendConditionFailedError, type AppendConditionStream, type AtomicTxn, type AttachmentHash, type AttachmentRef, type AuthDecisionModel, AuthEnforcementDisabledError, BareReadGate, BaseReadModel, type BatchExecutionRequest, type BatchExecutionResult, type BatchLoadRequest, type BatchLoadResult, type BuiltDecisionModel, type BuiltInReadModelKind, type CachedSnapshot, type ChannelConfig, ChannelError, ChannelErrorSource, type ChannelHealth, type ChannelMeta, ChannelScheme, type ConnectionState, type ConnectionStateChangeCallback, type ConnectionStateChangedEvent, type ConnectionStateSnapshot, type ConsistencyCoordinate, type ConsistencyKey, type ConsistencyToken, ConsistencyTracker, DEFAULT_DRIVE_CONTAINER_TYPES, DRIVE_AUTH_ERROR_MESSAGES, type Database, type DbConfig, type DeadLetterAddedEvent, type DecisionContext, type DecisionModel, type DecisionTarget, DefaultSubscriptionErrorHandler, type DocumentChangeEvent, DocumentChangeType, type DocumentDecisionModel, type DocumentGraphEdge, type DocumentIndexerDatabase, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, type DocumentModelSource, type DocumentModelSpec, type DocumentRelationship, type DocumentRevisions, type DocumentStreamKey, type DocumentViewDatabase, DriveClient, DriveCollectionId, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, type Evaluation, EventBus, EventBusAggregateError, type ExecuteMessage, type ExecutionJobPlan, type ExecutorStartedEvent, type ExecutorStoppedEvent, type FactorySpec, type FileModelSource, type GqlChannelConfig, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, type HeartbeatMessage, type IChannel, type IChannelFactory, type IConsistencyTracker, type IDocumentGraph, type IDocumentIndexer, type IDocumentIntegrityService, type IDocumentModelLoader, type IDocumentModelRegistry, type IDocumentModelResolver, type IDocumentView, type IDriveClient, type IEventBus, type IJobAwaiter, type IJobExecutor, type IJobExecutorManager, type IJobTracker, type IKeyframeStore, type ILiveReadModelCoordinator, type IMailbox, type IOperationIndex, type IOperationStore, type IPollTimer, type IProcessor, type IProcessorHostModule, type IProcessorManager, type IProjectionTransport, type IQueue, type IReactor, type IReactorClient, type IReactorSubscriptionManager, type IReadGate, type IReadModel, type IReadModelCoordinator, type IRelationalDb, type IStreamStateReader, type ISubscriptionErrorHandler, type ISyncCursorStorage, type ISyncManager, type ISyncRemoteStorage, type ISyncStatusTracker, type IWriteCache, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, type InProcessReactorClientModule, type InProcessReactorModule, type InProcessSyncModule, type InitMessage, type InsertableDocumentSnapshot, IntervalPollTimer, InvalidModuleError, type Job, type JobAvailableEvent, JobAwaiter, type JobCompletedEvent, type JobExecutorConfig, JobExecutorEventTypes, type JobExecutorFactory, type JobFailedEvent, type JobInfo, type JobPendingEvent, type JobReadReadyEvent, type JobResult, type JobRunningEvent, type JobStartedEvent, JobStatus, type JobWriteReadyEvent, type JobWriteReadyPayload, type JwtHandler, type KeyframeSnapshot, type KeyframeValidationIssue, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, type LoadJobPlan, type LoadModelMessage, type LogMessage, Mailbox, type MetricsMessage, type ModelLoadFailedMessage, type ModelLoadedEvent, type ModelLoadedMessage, type ModelManifestEntry, ModelReadGate, ModuleNotFoundError, type ModuleRef, NullDocumentModelResolver, type OperationBatch, type OperationContext, type OperationFilter, type OperationIndexEntry, type OperationTable, type OperationWithContext, OptimisticLockError, type OutOfOrderPair, type PackageModelSource, type PagedResults, type PagingOptions, type ParentMessage, type ParsedDriveUrl, type ParsedPaging, PollBehavior, PollingChannelError, type PoolInstrumentation, type PoolStats, type ProcessorApp, type ProcessorFactory, type ProcessorFactoryBuilder, type ProcessorFilter, ProcessorManager, type ProcessorRecord, type ProcessorStatus, type Projection, type ProjectionShardBuilderConfig, type ProjectionShardManagerConfig, type ProjectionWorkerFactory, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, RECOVERABLE_GRAPHQL_ERROR_CODES, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, type ReactorClientModule, ReactorEventTypes, type ReactorFeatureFlags, type ReactorFeatures, type JobFailedEvent$1 as ReactorJobFailedEvent, type ReactorModule, ReactorSubscriptionManager, type ReadGateOptions, type ReadModelBatchCompletedEvent, ReadModelCoordinator, type ReadModelFactory, type ReadModelFactoryDeps, type ReadModelIndexedEvent, type ReadModelIndexingStage, type ReadModelRegistrationStage, type ReadModelStage, type ReadyMessage, type RebuildResult, type RegisteredDecisionModel, RelationalDbProcessor, RelationshipChangeType, type Remote, type RemoteCursor, type RemoteFilter, type RemoteMeta, type RemoteOptions, type RemoteRecord, type RemoteStatus, type ResultMessage, RetryAccounting, RevisionMismatchError, type SanitizedArg, type SearchFilter, SeededStateReader, type ShutdownMessage, type ShutdownStatus, type SignatureVerificationHandler, type SignatureVerifierSpec, type SignerConfig, SimpleJobExecutorManager, type SnapshotValidationIssue, type Database$1 as StorageDatabase, type StreamOrderIssue, type StreamQuery, type SubscriptionErrorContext, SyncBuilder, type SyncEnvelope, type SyncEnvelopeType, SyncEventTypes, type SyncFailedEvent, type SyncModule, SyncOperation, SyncOperationAggregateError, type SyncOperationErrorType, SyncOperationStatus, type SyncPendingEvent, SyncScopeGate, SyncStatus, type SyncStatusChangeCallback, SyncStatusTracker, type SyncSucceededEvent, type TrackedProcessor, type Unsubscribe, type ValidationResult, type ViewFilter, type ErrorInfo as WorkerErrorInfo, type WorkerMessage, type WorkerPoolConfig, type WorkerPoolOptions, type WriteCacheConfig, addRelationshipAction, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createMutableShutdownStatus, createRelationalDb, decideAtHead, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isDriveAuthError, isRecoverableGraphQLError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, quarantinesDocument, readDecisionModel, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, supportsLiveReadModelRegistration, syncOperationErrorType, trimMailboxFromAckOrdinal, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
 //# sourceMappingURL=index.d.ts.map