@powerhousedao/reactor 6.2.2-dev.9 → 6.2.2-staging.0

package/dist/index.js

@@ -1,10 +1,10 @@
-import { A as parsePagingOptions, C as DuplicateManifestError, D as DocumentDeletedError, E as ModuleNotFoundError, O as DocumentNotFoundError, S as CollectionMembershipCache, T as InvalidModuleError, _ as KyselyWriteCache, a as createForwardingPoolInstrumentation, b as createConsistencyToken, c as DuplicateOperationError, d as KyselyKeyframeStore, f as DocumentModelRegistry, g as EventBus, h as KyselyExecutionScope, i as runMigrations, j as throwIfAborted, k as matchesScope, l as OptimisticLockError, m as DriveCollectionId, n as REACTOR_SCHEMA, o as instrumentPgPool, p as SimpleJobExecutor, r as getMigrationStatus, s as KyselyOperationStore, t as DEFAULT_DRIVE_CONTAINER_TYPES, u as RevisionMismatchError, v as KyselyOperationIndex, w as DuplicateModuleError, x as createEmptyConsistencyToken, y as DocumentMetaCache } from "./drive-container-types-DpJp2AmE.js";
+import { A as selectDecisionModel, B as RevisionMismatchError, C as InvalidModuleError, D as createEmptyConsistencyToken, E as createConsistencyToken, F as AppendConditionFailedError, G as DocumentNotFoundError, H as AuthTimestampNotMonotonicError, I as DocumentAlreadyExistsError, J as UpgradePreconditionFailedError, K as ExcessiveReshuffleError, L as DocumentExistence, M as authDecisionModel, N as buildDecisionModel, O as targetDocumentId, P as APPEND_CONDITION_FAILED_PREFIX, R as DuplicateOperationError, S as DuplicateModuleError, T as GATED_DOCUMENT_ACTIONS, U as AuthorizationDeniedError, V as AuthEnforcementDisabledError, W as DocumentDeletedError, X as parsePagingOptions, Y as matchesScope, Z as throwIfAborted, _ as DocumentMetaCache, a as createForwardingPoolInstrumentation, b as JobExecutorEventTypes, c as KyselyKeyframeStore, d as DriveCollectionId, f as KyselyExecutionScope, g as KyselyOperationIndex, h as KyselyWriteCache, i as runMigrations, j as documentDecisionModel, k as decideAtHead, l as DocumentModelRegistry, m as EventBus, n as REACTOR_SCHEMA, o as instrumentPgPool, p as resolveFeatureFlags, q as InvalidOperationTimestampError, r as getMigrationStatus, s as KyselyOperationStore, t as DEFAULT_DRIVE_CONTAINER_TYPES, u as SimpleJobExecutor, v as CollectionMembershipCache, w as ModuleNotFoundError, x as DuplicateManifestError, y as DEFAULT_DEFERRED_JOB_TTL_MS, z as OptimisticLockError } from "./drive-container-types-yZrksiJR.js";
 import { n as ReactorEventTypes, t as EventBusAggregateError } from "./types-DMKLa0Ok.js";
 import { i as WorkerInitFailedError, r as WorkerExitedError, t as WorkerAbortTimeoutError } from "./errors-D3S6Eysd.js";
-import { a as ReadModelCoordinator, i as KyselyDocumentView, n as ConsistencyTracker, o as BaseReadModel, r as makeConsistencyKey, t as KyselyDocumentIndexer } from "./document-indexer-FGJmRAdX.js";
+import { a as DOCUMENT_INDEXER_READ_MODEL, c as BaseReadModel, i as KyselyDocumentView, n as ConsistencyTracker, o as DOCUMENT_VIEW_READ_MODEL, r as makeConsistencyKey, s as ReadModelCoordinator, t as KyselyDocumentIndexer } from "./document-indexer-C5Gsa1B3.js";
 import { n as errorToInfo, r as sanitizeArg, t as createForwardingLogger } from "./forwarding-logger-BBkMSxuJ.js";
-import { t as workerEntryPath } from "./worker-DBJOv8Gp.js";
-import { actions, actions as documentActions, createPresignedHeader, generateId, hashDocumentStateForScope, replayDocument } from "@powerhousedao/shared/document-model";
+import { t as workerEntryPath } from "./worker-HPysBfhx.js";
+import { DowngradeNotSupportedError, MAX_AUTH_GRANTS, UnsupportedDocumentModelVersionError, actions, actions as documentActions, createPresignedHeader, decide, deserializeSignature, garbageCollect, generateId, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, normalizeDocumentModelVersion, sortOperations, toTransportAction } from "@powerhousedao/shared/document-model";
 import { addFile, addFolder, copyNode, deleteNode, driveCreateDocument, generateNodesCopy, getDescendants, handleTargetNameCollisions, isFileNode, isFolderNode, moveNode, updateNode } from "@powerhousedao/shared/document-drive";
 import { v4 } from "uuid";
 import { ConsoleLogger, childLogger } from "document-model";
@@ -190,10 +190,12 @@ function topologicalSort(jobs) {
 */
 function toErrorInfo$1(error) {
 	if (error instanceof Error) return {
+		name: error.name,
 		message: error.message,
 		stack: error.stack || (/* @__PURE__ */ new Error()).stack || ""
 	};
 	return {
+		name: "Error",
 		message: error,
 		stack: (/* @__PURE__ */ new Error()).stack || ""
 	};
@@ -363,7 +365,7 @@ var DriveClient = class {
 				documentId: document.header.id,
 				model: document.header.documentType,
 				fromVersion: 0,
-				toVersion: 1,
+				toVersion: normalizeDocumentModelVersion(document.state.document?.version),
 				initialState: document.state
 			}),
 			addRelationshipAction(driveIdentifier, documentId, "child")
@@ -374,24 +376,23 @@ var DriveClient = class {
 			documentType: document.header.documentType,
 			parentFolder
 		})], this.signer, signal);
-		const batchResult = await this.reactor.executeBatch({ jobs: [{
+		await this.runJobs([{
 			key: "document",
 			documentId,
 			scope: getSharedActionScope(documentActions),
 			branch: "main",
 			actions: documentActions,
 			dependsOn: []
-		}, {
+		}], signal);
+		await this.runJobs([{
 			key: "drive",
 			documentId: driveIdentifier,
 			scope: getSharedActionScope(driveActions),
 			branch: "main",
 			actions: driveActions,
-			dependsOn: ["document"]
-		}] }, signal);
-		const completedJobs = await Promise.all(Object.values(batchResult.jobs).map((job) => this.client.waitForJob(job, signal)));
-		for (const job of completedJobs) if (job.status === JobStatus.FAILED) throw new Error(job.error?.message);
-		return this.reactor.get(documentId);
+			dependsOn: []
+		}], signal);
+		return this.client.get(documentId, void 0, signal);
 	}
 	async addFolder(driveIdentifier, name, parentFolder, signal) {
 		this.logger.verbose("drives.addFolder(@driveIdentifier, @name, @parentFolder)", driveIdentifier, name, parentFolder);
@@ -400,7 +401,7 @@ var DriveClient = class {
 			id: folderId,
 			name,
 			parentFolder
-		})], signal)).state.global.nodes.find((n) => n.id === folderId);
+		})], signal)).state.global?.nodes.find((n) => n.id === folderId);
 		if (!node || !isFolderNode(node)) throw new Error("Folder creation failed");
 		return node;
 	}
@@ -427,7 +428,7 @@ var DriveClient = class {
 		const node = (await this.client.execute(driveIdentifier, "main", [updateNode({
 			id: nodeId,
 			name
-		})], signal)).state.global.nodes.find((n) => n.id === nodeId);
+		})], signal)).state.global?.nodes.find((n) => n.id === nodeId);
 		if (!node) throw new Error("Node missing from drive after rename");
 		return node;
 	}
@@ -468,8 +469,12 @@ var DriveClient = class {
 			const node = drive.state.global.nodes.find((n) => n.id === entry.srcId);
 			if (!node || !isFileNode(node)) continue;
 			const srcDoc = await this.client.get(entry.srcId, void 0, signal);
-			const module = await this.client.getDocumentModelModule(srcDoc.header.documentType);
-			const duplicated = replayDocument(srcDoc.initialState, srcDoc.operations, module.reducer, createPresignedHeader(entry.targetId, srcDoc.header.documentType));
+			const duplicated = {
+				...srcDoc,
+				header: createPresignedHeader(entry.targetId, srcDoc.header.documentType),
+				initialState: srcDoc.state,
+				operations: {}
+			};
 			const resolvedName = resolvedNamesByTargetId.get(entry.targetId);
 			if (resolvedName) duplicated.header.name = resolvedName;
 			await this.addFile(driveIdentifier, duplicated, entry.targetParentFolder ?? void 0, signal);
@@ -499,6 +504,22 @@ var DriveClient = class {
 			totalCount: filtered.length
 		};
 	}
+	/**
+	* Runs one batch to completion, throwing the first failure. The thrown error
+	* carries the job error's name, which is what callers classify on: an id
+	* collision has to be told apart from a transient failure.
+	*/
+	async runJobs(jobs, signal) {
+		const batchResult = await this.reactor.executeBatch({ jobs }, signal);
+		const completedJobs = await Promise.all(Object.values(batchResult.jobs).map((job) => this.client.waitForJob(job, signal)));
+		for (const job of completedJobs) if (job.status === JobStatus.FAILED) throw this.toError(job);
+		return completedJobs;
+	}
+	toError(job) {
+		const error = new Error(job.error?.message ?? "Job failed");
+		if (job.error?.name) error.name = job.error.name;
+		return error;
+	}
 	async documentExists(documentId, signal) {
 		try {
 			await this.client.get(documentId, void 0, signal);
@@ -680,8 +701,335 @@ let DocumentChangeType = /* @__PURE__ */ function(DocumentChangeType) {
 	return DocumentChangeType;
 }({});
 //#endregion
+//#region src/decision/read-gate.ts
+/**
+* Scopes every holder of a document may read, whatever the grants say. Denying
+* the policy itself would let a replica sync a document without it, read the
+* auth scope as uninitialized, and allow every operation it holds, so replicas
+* would diverge permanently. The document scope carries the metadata the same
+* argument covers. Grants gate domain-scope reads only.
+*/
+const ALWAYS_READABLE_SCOPES = new Set(["auth", "document"]);
+/** What a gate does with an uninitialized policy when told nothing. */
+const OPEN_BY_DEFAULT = { withholdUninitialized: false };
+/**
+* The branch a group is read on. A group's member list lives on its main
+* branch whatever branch the document naming it is on, and the reference
+* relation records no branch of its own.
+*/
+const GROUP_BRANCH = "main";
+/**
+* The scope of a group document that holds its member list. It is the only
+* scope group serving reaches, because it is the only one the audience must
+* fold in order to evaluate auth with the group.
+*/
+const GROUP_MEMBERSHIP_SCOPE = "global";
+/**
+* How many of a group's referencing documents are examined before a read of
+* that group gives up and withholds. Each one costs a model build, and the
+* relation is append-only, so an old and briefly-held reference still counts.
+* Truncating denies, which is the direction that withholds. It is the cap a
+* version-1 policy carries on its own grant list, taken from there rather than
+* restated: raising that cap raises the read fan-out here.
+*/
+const MAX_EXAMINED_REFERENCERS = MAX_AUTH_GRANTS;
+/**
+* How many referencers are probed at once. The reactor's Postgres pool size is
+* optional and defaults to ten, and a listing resolves one gate per result, so
+* per-gate fan-out multiplies: a handful keeps one group read from claiming the
+* whole pool while still cutting the walk several times over. On PGlite the
+* queries serialize regardless, so a larger number buys nothing in a browser.
+*/
+const REFERENCER_PROBE_CONCURRENCY = 4;
+/**
+* The policy carried on a document, if it carries one. A document handed to the
+* gate with no state at all is not policied, so it is not gated.
+*/
+function authOf(document) {
+	return document.state?.auth;
+}
+/**
+* The model reads enforce. Below `authEnforcement` there is no model to
+* enforce: the document-only model ignores the auth scope entirely, so reading
+* through it would serve every domain scope of a policied document to anyone.
+* Undefined therefore means "evaluate the policy alone", which is what the read
+* surface did before the model existed.
+*/
+function readDecisionModel(flags, registry) {
+	return flags.authEnforcement ? selectDecisionModel(flags, registry) : void 0;
+}
+/**
+* Evaluates the policy on its own, with no groups map and no condition context.
+* A `{ group }` or conditional grant therefore never applies: an allow that
+* does not apply withholds access, so this cannot widen a policy, but a policy
+* relying on a conditional deny is weaker here than it is written.
+*/
+var BareReadGate = class {
+	scopePredicate(document, subject) {
+		const auth = authOf(document);
+		return Promise.resolve((scope) => ALWAYS_READABLE_SCOPES.has(scope) || decide(auth, subject, {
+			verb: "read",
+			scope
+		}) === "allow");
+	}
+};
+/**
+* Answers a stream read from the document already fetched, and anything else
+* through the read side.
+*
+* The seed is why routing reads through a decision model costs no extra I/O for
+* the document being read: its `document` and `auth` scopes are the two static
+* projections, and the caller has both in hand. Only a group stream the grant
+* list names is fetched.
+*/
+var SeededStateReader = class {
+	constructor(documentView, seed, branch) {
+		this.documentView = documentView;
+		this.seed = seed;
+		this.branch = branch;
+	}
+	/**
+	* A stream this replica does not hold has to reach buildDecisionModel as the
+	* absence it recognises, or the whole read fails instead of leaving the group
+	* out of the model, where its principal does not match and the policy fails
+	* closed. The read side reports absence as a plain Error, so the absence is
+	* confirmed rather than inferred from the message: a transient failure must
+	* surface, not silently deny.
+	*/
+	async getState(documentId, scope, branch, targetRevision, signal) {
+		if (targetRevision === void 0 && documentId === this.seed.header.id && branch === this.branch && scope in this.seed.state) return this.seed;
+		try {
+			return await this.documentView.get(documentId, {
+				branch,
+				scopes: [scope]
+			}, void 0, signal);
+		} catch (error) {
+			await this.assertAbsent(documentId, error, signal);
+			throw new DocumentNotFoundError(documentId);
+		}
+	}
+	async assertAbsent(documentId, error, signal) {
+		if (DocumentNotFoundError.isError(error)) return;
+		let exists;
+		try {
+			exists = await this.documentView.exists([documentId], DocumentExistence.LiveOnly, void 0, signal);
+		} catch {
+			throw error;
+		}
+		if (exists[0]) throw error;
+	}
+};
+/**
+* Evaluates a read against the registered decision model, built at the stream
+* heads. This is what makes `{ group }` principals and conditional grants apply
+* to a read: the model supplies the groups map and the scope's own state, the
+* same two things admission supplies.
+*
+* A read has no action, so a condition on `action.input.*` never holds for one.
+*
+* State is read through the read side rather than the write cache. The write
+* cache is invalidated by whichever process runs the executor, so a reactor
+* running its executors in worker processes would answer reads in the parent
+* from state no commit ever invalidates.
+*/
+var ModelReadGate = class {
+	constructor(model, documentView, servesGroups, operationIndex, logger, options = OPEN_BY_DEFAULT) {
+		this.model = model;
+		this.documentView = documentView;
+		this.servesGroups = servesGroups;
+		this.operationIndex = operationIndex;
+		this.logger = logger;
+		this.options = options;
+	}
+	/**
+	* A served group yields its member list and nothing else. What the audience
+	* is owed is the state it must fold to evaluate auth with the group; a
+	* group's other scopes are its own business and stay behind its own grants.
+	*/
+	async scopePredicate(document, subject, branch, signal) {
+		const own = await this.ownPolicyPredicate(document, subject, branch, signal);
+		if (!this.servesGroup(document) || own(GROUP_MEMBERSHIP_SCOPE)) return own;
+		const audience = await this.servesGroupTo(document.header.id, subject, signal);
+		return (scope) => own(scope) || audience && scope === GROUP_MEMBERSHIP_SCOPE;
+	}
+	/**
+	* Whether the subject is served this group because a policy names it.
+	*
+	* A replica must fold a group's membership to evaluate auth with it, so a
+	* group a grant names is served to the audience of the document that names
+	* it, whatever the group's own read grants say. Naming a group in a policy
+	* publishes its roster to that policy's audience; a group whose membership
+	* must stay confidential does not belong in a grant.
+	*
+	* The referencing document's own domain scopes are the test. Its `auth` and
+	* `document` scopes are readable by every holder, so testing those would
+	* serve every referenced group to everybody.
+	*
+	* One level only. A referencer that is itself a group is skipped, and a
+	* referencer's own readability is decided from its policy alone, so a
+	* reference cycle terminates. Cycles are reachable: the reference relation
+	* is recorded from an operation's input, including one later stored denied,
+	* so a refused grant naming a group from inside another group leaves a row
+	* behind that validation never saw.
+	*
+	* The referencers are probed a few at a time and the walk stops at the first
+	* that serves, because a subject outside the audience is the case that runs to
+	* the bound, and it is the common one. A probe that failed decides only when
+	* nothing served: serving rests on a real allow, so this cannot widen, and it
+	* stops one unreachable referencer from turning an allow already in hand into
+	* a denial. A read records no operation, so replicas differing over a
+	* transient failure has no consensus consequence.
+	*
+	* The probes are awaited together rather than raced, so none is ever left
+	* running with nobody awaiting it, which is where unhandled rejections come
+	* from.
+	*/
+	async servesGroupTo(groupId, subject, signal) {
+		if (!this.operationIndex) return false;
+		const referencers = await this.operationIndex.getGroupReferencers(groupId, signal);
+		const examined = referencers.slice(0, MAX_EXAMINED_REFERENCERS);
+		if (examined.length < referencers.length) this.logger?.warn(`Group ${groupId} is referenced by ${referencers.length} documents; only the first ${MAX_EXAMINED_REFERENCERS} decide whether it is served`);
+		const walk = {
+			next: 0,
+			served: false,
+			failure: void 0
+		};
+		const probe = async () => {
+			while (!walk.served && walk.next < examined.length) {
+				const referencerId = examined[walk.next++];
+				let serves = false;
+				try {
+					serves = await this.servesThrough(referencerId, subject, signal);
+				} catch (error) {
+					walk.failure ??= Error.isError(error) ? error : /* @__PURE__ */ new Error(`Probing referencer ${referencerId} failed`);
+				}
+				if (serves) walk.served = true;
+			}
+		};
+		await Promise.all(Array.from({ length: Math.min(REFERENCER_PROBE_CONCURRENCY, examined.length) }, probe));
+		if (!walk.served && walk.failure) throw walk.failure;
+		return walk.served;
+	}
+	/**
+	* Whether one referencing document serves the subject any domain scope. A
+	* referencer this replica does not hold serves nothing, which fails closed
+	* the same way a group it does not hold does.
+	*/
+	async servesThrough(referencerId, subject, signal) {
+		let referencer;
+		try {
+			referencer = await this.documentView.get(referencerId, { branch: GROUP_BRANCH }, void 0, signal);
+		} catch {
+			return false;
+		}
+		if (this.servesGroup(referencer)) return false;
+		const readable = await this.ownPolicyPredicate(referencer, subject, GROUP_BRANCH, signal);
+		return Object.keys(referencer.state ?? {}).filter((scope) => !ALWAYS_READABLE_SCOPES.has(scope)).some((scope) => readable(scope));
+	}
+	servesGroup(document) {
+		return this.servesGroups && this.operationIndex !== void 0 && document.header.documentType === groupDocumentType;
+	}
+	/**
+	* What this document's own policy says, with no group serving applied.
+	*
+	* An unpoliced document is readable in full unless the host closes by default,
+	* and either way it is the common case and the one worth answering without
+	* building anything. The test is the one `evaluate` makes: a legacy `{}` auth
+	* scope and version 0 both mean uninitialized, and "no grants" does not,
+	* because a policy with a version and an empty grant list denies everything.
+	*
+	* Closing here rather than around the gate is what keeps a policy able to
+	* publish an unpoliced group it names: the referencer walk asks this question
+	* of the referencing document, whose real policy answers it.
+	*/
+	async ownPolicyPredicate(document, subject, branch, signal) {
+		const auth = authOf(document);
+		if (!auth || !auth.version) return this.options.withholdUninitialized ? (scope) => ALWAYS_READABLE_SCOPES.has(scope) : () => true;
+		const target = {
+			documentId: document.header.id,
+			branch
+		};
+		const built = await buildDecisionModel(new SeededStateReader(this.documentView, document, branch), this.model, target, signal);
+		const definition = this.model(target);
+		const scopeStates = document.state ?? {};
+		return (scope) => ALWAYS_READABLE_SCOPES.has(scope) || definition.decide(built.model, subject, {
+			verb: "read",
+			scope
+		}, {
+			scopeState: scopeStates[scope],
+			actionInput: void 0
+		}).decision === "allow";
+	}
+};
+//#endregion
+//#region src/client/util.ts
+function authSubjectFromSigner(signer) {
+	return {
+		address: signer.user?.address,
+		key: signer.app?.key
+	};
+}
+function withAuthScope(view) {
+	if (view?.scopes && view.scopes.length > 0) return {
+		...view,
+		scopes: [...new Set([...view.scopes, "auth"])]
+	};
+	return view;
+}
+/**
+* Drops the scopes the predicate refuses. The predicate is resolved by the read
+* gate, which decides against the whole policy once per document; this only
+* applies the answer, so it stays synchronous.
+*/
+function filterReadableScopes(document, readable) {
+	const state = document.state;
+	if (!state) return document;
+	return {
+		...document,
+		state: keepReadableScopes(state, readable),
+		initialState: keepReadableScopes(document.initialState, readable)
+	};
+}
+function keepReadableScopes(scopes, readable) {
+	if (!scopes) return scopes;
+	const kept = {};
+	for (const scope of Object.keys(scopes)) if (readable(scope)) kept[scope] = scopes[scope];
+	return kept;
+}
+//#endregion
 //#region src/client/reactor-client.ts
 /**
+* The document a candidate is decided against. Routed on the action type alone,
+* which is what the executor routes on: every action the reactor reduces onto
+* the document scope carries that scope already, and the gate follows the
+* action's own target rather than the document the request named.
+*/
+function evaluationTargetId(candidate, fallback) {
+	return GATED_DOCUMENT_ACTIONS.has(candidate.type) ? targetDocumentId({
+		type: candidate.type,
+		input: candidate.input
+	}, fallback) : fallback;
+}
+/**
+* One candidate's verdict, decided exactly as admission decides it: the same
+* request, and a condition context populated only while authConditions is on,
+* so a conditional grant applies here precisely when it would apply there.
+* Groups need nothing added, because the selected model carries them.
+*/
+function decideCandidate(config, target, subject, candidate) {
+	return target.definition.decide(target.model, subject, {
+		verb: "execute",
+		scope: candidate.scope,
+		operation: candidate.type
+	}, config.flags.authConditions ? {
+		scopeState: target.scopeStates[candidate.scope],
+		actionInput: candidate.input
+	} : {
+		scopeState: void 0,
+		actionInput: void 0
+	});
+}
+/**
 * ReactorClient implementation that wraps lower-level APIs to provide
 * a simpler interface for document operations.
 *
@@ -699,8 +1047,10 @@ var ReactorClient = class {
 	jobAwaiter;
 	documentIndexer;
 	documentView;
+	readGate;
+	actionEvaluation;
 	drives;
-	constructor(logger, reactor, signer, subscriptionManager, jobAwaiter, documentIndexer, documentView) {
+	constructor(logger, reactor, signer, subscriptionManager, jobAwaiter, documentIndexer, documentView, readGate = new BareReadGate(), actionEvaluation) {
 		this.logger = logger;
 		this.reactor = reactor;
 		this.signer = signer;
@@ -708,9 +1058,33 @@ var ReactorClient = class {
 		this.jobAwaiter = jobAwaiter;
 		this.documentIndexer = documentIndexer;
 		this.documentView = documentView;
+		this.readGate = readGate;
+		this.actionEvaluation = actionEvaluation;
 		this.drives = new DriveClient(this, logger, reactor, signer);
 		this.logger.verbose("ReactorClient initialized");
 	}
+	readSubject(subject) {
+		return subject ?? authSubjectFromSigner(this.signer);
+	}
+	/**
+	* Which scopes of one document the subject may read. Resolved once per
+	* document, so the gate builds its model once however many scopes are then
+	* tested, and the filtering itself stays synchronous.
+	*/
+	readableScopes(document, view, signal) {
+		return this.readGate.scopePredicate(document, this.readSubject(view?.subject), view?.branch ?? "main", signal);
+	}
+	/**
+	* One document, filtered to the scopes the subject may read. Every method
+	* that hands a document back goes through here, including the ones that
+	* follow a write: a document returned from a mutation is a read like any
+	* other, and returning it whole served scopes the same subject would be
+	* refused by `get`. Its author still sees what it wrote, because an allow on
+	* execute confers read of that scope.
+	*/
+	async gateDocument(document, view, signal) {
+		return filterReadableScopes(document, await this.readableScopes(document, view, signal));
+	}
 	/**
 	* Retrieves a list of document model modules.
 	*/
@@ -725,24 +1099,58 @@ var ReactorClient = class {
 	* @returns The document model module
 	*/
 	async getDocumentModelModule(documentType) {
-		const module = (await this.reactor.getDocumentModels()).results.find((m) => m.documentModel.global.id === documentType);
-		if (!module) throw new Error(`Document model module not found for type: ${documentType}`);
-		return module;
+		const modules = await this.reactor.getDocumentModels();
+		let latestModule;
+		let latestVersion = -1;
+		for (const module of modules.results) {
+			if (module.documentModel.global.id !== documentType) continue;
+			const version = module.version ?? 1;
+			if (version > latestVersion) {
+				latestVersion = version;
+				latestModule = module;
+			}
+		}
+		if (!latestModule) throw new Error(`Document model module not found for type: ${documentType}`);
+		return latestModule;
+	}
+	/**
+	* Retrieves the document model module matching the version the document is
+	* stamped with, so not-yet-upgraded documents get the reducer their
+	* history was written with rather than the latest.
+	*/
+	async getDocumentModelModuleForDocument(document) {
+		const documentType = document.header.documentType;
+		const version = normalizeDocumentModelVersion(document.state.document?.version);
+		const modules = await this.reactor.getDocumentModels();
+		const availableVersions = [];
+		for (const module of modules.results) {
+			if (module.documentModel.global.id !== documentType) continue;
+			const moduleVersion = normalizeDocumentModelVersion(module.version);
+			if (moduleVersion === version) return module;
+			availableVersions.push(moduleVersion);
+		}
+		throw new UnsupportedDocumentModelVersionError(documentType, version, availableVersions.sort((a, b) => a - b));
 	}
 	/**
 	* Retrieves a specific PHDocument
 	*/
 	async get(identifier, view, signal) {
 		this.logger.verbose("get(@identifier, @view)", identifier, view);
-		return await this.reactor.getByIdOrSlug(identifier, view, void 0, signal);
+		const document = await this.reactor.getByIdOrSlug(identifier, withAuthScope(view), void 0, signal);
+		return this.gateDocument(document, view, signal);
 	}
 	/**
 	* Resolves an identifier (id or slug) to the canonical document id, using the
 	* same lookup as the data path. Resolves against the "main" branch. Throws if
 	* the identifier cannot be resolved or is ambiguous.
 	*/
-	async resolveIdOrSlug(identifier, signal) {
-		return this.documentView.resolveIdOrSlug(identifier, void 0, void 0, signal);
+	async resolveIdOrSlug(identifier, view, signal) {
+		return this.documentView.resolveIdOrSlug(identifier, view, void 0, signal);
+	}
+	/** True when the id is taken; a soft-deleted document's id is still taken. */
+	async isDocumentIdTaken(documentId, signal) {
+		this.logger.verbose("isDocumentIdTaken(@documentId)", documentId);
+		return (await this.documentView.exists([documentId], DocumentExistence.IncludingDeleted, void 0, signal))[0];
 	}
 	/**
 	* Retrieves operations for a document
@@ -750,8 +1158,11 @@ var ReactorClient = class {
 	async getOperations(documentIdentifier, view, filter, paging, signal) {
 		this.logger.verbose("getOperations(@documentIdentifier, @view, @filter, @paging)", documentIdentifier, view, filter, paging);
 		const documentId = await this.documentView.resolveIdOrSlug(documentIdentifier, view, void 0, signal);
-		if (paging?.cursor && isCompositeCursor(paging.cursor)) return this.getOperationsWithCompositeCursor(documentId, view, filter, paging, signal);
+		const gated = await this.reactor.getByIdOrSlug(documentId, withAuthScope(view), void 0, signal);
+		const canRead = await this.readableScopes(gated, view, signal);
+		if (paging?.cursor && isCompositeCursor(paging.cursor)) return this.getOperationsWithCompositeCursor(documentId, view, filter, paging, signal, canRead);
 		const operationsByScope = await this.reactor.getOperations(documentId, view, filter, paging, void 0, signal);
+		for (const scope of Object.keys(operationsByScope)) if (!canRead(scope)) delete operationsByScope[scope];
 		const scopeEntries = Object.entries(operationsByScope);
 		const effectivePaging = paging || {
 			cursor: "0",
@@ -779,11 +1190,12 @@ var ReactorClient = class {
 			nextCursor: Object.keys(activeCursors).length > 0 ? encodeCompositeCursor(activeCursors) : void 0
 		};
 	}
-	async getOperationsWithCompositeCursor(documentId, view, filter, paging, signal) {
+	async getOperationsWithCompositeCursor(documentId, view, filter, paging, signal, canRead) {
 		const scopeCursors = decodeCompositeCursor(paging.cursor);
 		const allOperations = [];
 		const activeCursors = {};
 		for (const [scopeName, cursor] of Object.entries(scopeCursors)) {
+			if (!canRead(scopeName)) continue;
 			const scopeView = {
 				...view,
 				scopes: [scopeName]
@@ -817,7 +1229,7 @@ var ReactorClient = class {
 				limit: 0
 			}
 		};
-		return this.reactor.find({ ids: targetIds }, view, paging, void 0, signal);
+		return this.find({ ids: targetIds }, view, paging, signal);
 	}
 	/**
 	* Retrieves incoming relationships of a given type to a target document.
@@ -833,14 +1245,90 @@ var ReactorClient = class {
 				limit: 0
 			}
 		};
-		return this.reactor.find({ ids: sourceIds }, view, paging, void 0, signal);
+		return this.find({ ids: sourceIds }, view, paging, signal);
 	}
 	/**
 	* Filters documents by criteria and returns a list of them
 	*/
 	async find(search, view, paging, signal) {
 		this.logger.verbose("find(@search, @view, @paging)", search, view, paging);
-		return this.reactor.find(search, view, paging, void 0, signal);
+		const results = await this.reactor.find(search, withAuthScope(view), paging, void 0, signal);
+		return {
+			...results,
+			results: await Promise.all(results.results.map(async (doc) => filterReadableScopes(doc, await this.readableScopes(doc, view, signal))))
+		};
+	}
+	/**
+	* Predicts the admission verdict for each candidate. See
+	* {@link IReactorClient.evaluateActions} for the contract and its caveats.
+	*
+	* Read-only throughout, and never through the write cache: that cache is
+	* invalidated by whichever process runs the executor, so a reactor running
+	* its executors in worker processes would answer here from state no commit
+	* ever invalidates.
+	*/
+	async evaluateActions(documentIdentifier, branch, candidates, subject, signal) {
+		this.logger.verbose("evaluateActions(@documentIdentifier, @branch, @count candidates)", documentIdentifier, branch, candidates.length);
+		const config = this.actionEvaluation;
+		if (config === void 0) throw new AuthEnforcementDisabledError();
+		const decidedSubject = this.readSubject(subject);
+		const resolvedId = await this.documentView.resolveIdOrSlug(documentIdentifier, { branch }, void 0, signal);
+		const targets = /* @__PURE__ */ new Map();
+		const evaluations = [];
+		for (const candidate of candidates) {
+			if (candidate.type === "CREATE_DOCUMENT") {
+				evaluations.push({ decision: "allow" });
+				continue;
+			}
+			const targetId = evaluationTargetId(candidate, resolvedId);
+			let target = targets.get(targetId);
+			if (target === void 0) {
+				target = await this.buildEvaluationTarget(config, targetId, branch, signal);
+				targets.set(targetId, target);
+			}
+			evaluations.push(decideCandidate(config, target, decidedSubject, candidate));
+		}
+		const allowed = evaluations.filter((evaluation) => evaluation.decision === "allow").length;
+		return {
+			evaluations,
+			allAllowed: candidates.length > 0 && allowed === candidates.length,
+			anyAllowed: allowed > 0,
+			allDenied: candidates.length > 0 && allowed === 0,
+			anyDenied: allowed < candidates.length
+		};
+	}
+	/**
+	* The decision model for one target document, built at its stream heads.
+	*
+	* The document is fetched unfiltered, because the policy is what decides:
+	* reading it through the read gate would withhold the very scopes the
+	* decision is about. A deleted document is served at its deletion boundary,
+	* which is what lets the model refuse an execute against it -- authEnforcement
+	* requires documentDecisions, so that read is available whenever this runs.
+	*
+	* Reading past the gate discloses nothing a submit does not. The `auth` and
+	* `document` scopes are readable by every holder, so a verdict resting on the
+	* policy alone is one the caller could compute unaided; and a verdict resting
+	* on a conditional grant reads the executing scope's state exactly as
+	* admission reads it, so the answer here is what submitting and being refused
+	* would have revealed anyway.
+	*
+	* The append condition the build records is dropped. It guards a write, and
+	* this makes none; reproducing it is also what the preflight cannot do, which
+	* is why the answer is a prediction.
+	*/
+	async buildEvaluationTarget(config, documentId, branch, signal) {
+		const document = await this.documentView.get(documentId, { branch }, void 0, signal);
+		const target = {
+			documentId,
+			branch
+		};
+		const built = await buildDecisionModel(new SeededStateReader(this.documentView, document, branch), config.model, target, signal);
+		return {
+			definition: config.model(target),
+			model: built.model,
+			scopeStates: document.state ?? {}
+		};
 	}
 	/**
 	* Creates a document and waits for completion
@@ -868,7 +1356,7 @@ var ReactorClient = class {
 			documentId,
 			model: document.header.documentType,
 			fromVersion: 0,
-			toVersion: document.state.document.version,
+			toVersion: normalizeDocumentModelVersion(document.state.document?.version),
 			initialState: document.state
 		})], this.signer, signal);
 		const jobs = [{
@@ -893,7 +1381,8 @@ var ReactorClient = class {
 		const batchResult = await this.reactor.executeBatch({ jobs }, signal);
 		const completedJobs = await Promise.all(Object.values(batchResult.jobs).map((job) => this.waitForJob(job, signal)));
 		for (const job of completedJobs) if (job.status === JobStatus.FAILED) throw new Error(job.error?.message);
-		return await this.reactor.get(documentId);
+		const created = await this.reactor.get(documentId);
+		return this.gateDocument(created, void 0, signal);
 	}
 	/**
 	* Creates an empty document and waits for completion
@@ -903,20 +1392,64 @@ var ReactorClient = class {
 		const matchingModules = (await this.reactor.getDocumentModels(void 0, void 0, signal)).results.filter((m) => m.documentModel.global.id === documentModelType);
 		let module;
 		if (options?.documentModelVersion !== void 0) {
-			module = matchingModules.find((m) => m.version === options.documentModelVersion);
+			const requestedVersion = normalizeDocumentModelVersion(options.documentModelVersion);
+			module = matchingModules.find((m) => normalizeDocumentModelVersion(m.version) === requestedVersion);
 			if (!module) throw new Error(`Document model not found for type: ${documentModelType} with version: ${options.documentModelVersion}`);
 		} else {
 			module = matchingModules.reduce((latest, current) => {
 				if (latest === void 0) return current;
-				return (current.version ?? 0) > (latest.version ?? 0) ? current : latest;
+				return normalizeDocumentModelVersion(current.version) > normalizeDocumentModelVersion(latest.version) ? current : latest;
 			}, void 0);
 			if (!module) throw new Error(`Document model not found for type: ${documentModelType}`);
 		}
 		const document = module.utils.createDocument();
-		document.state.document.version = module.version ?? 1;
+		document.state.document.version = normalizeDocumentModelVersion(module.version);
 		return this.create(document, options?.parentIdentifier, signal);
 	}
 	/**
+	* Upgrades a document to a newer document model version by dispatching an
+	* UPGRADE_DOCUMENT action. When toVersion is omitted, upgrades to the
+	* latest registered module version for the document's type. Returns the
+	* document unchanged when it is already at the target version.
+	*
+	* The executor validates the action's version and revision snapshot against
+	* the state the migration actually runs on. When a concurrent edit
+	* invalidates the snapshot, the upgrade is rebuilt from a fresh read and
+	* retried up to maxConflictRetries times before the conflict is surfaced.
+	*/
+	async upgradeDocument(documentIdentifier, toVersion, options, signal) {
+		this.logger.verbose("upgradeDocument(@documentIdentifier, @toVersion)", documentIdentifier, toVersion);
+		const maxConflictRetries = options?.maxConflictRetries ?? 3;
+		let lastConflictMessage = "";
+		for (let attempt = 0; attempt <= maxConflictRetries; attempt++) {
+			const document = await this.reactor.getByIdOrSlug(documentIdentifier, void 0, void 0, signal);
+			const documentId = document.header.id;
+			const documentType = document.header.documentType;
+			const branch = document.header.branch || "main";
+			const fromVersion = normalizeDocumentModelVersion(document.state.document?.version);
+			let targetVersion = toVersion;
+			if (targetVersion === void 0) targetVersion = normalizeDocumentModelVersion((await this.getDocumentModelModule(documentType)).version);
+			if (targetVersion === fromVersion) return this.gateDocument(document, { branch }, signal);
+			if (targetVersion < fromVersion) throw new DowngradeNotSupportedError(documentType, fromVersion, targetVersion);
+			const signedActions = await signActions([upgradeDocumentAction({
+				documentId,
+				model: documentType,
+				fromVersion,
+				toVersion: targetVersion,
+				revision: { ...document.header.revision }
+			})], this.signer, signal);
+			const jobInfo = await this.reactor.execute(documentId, branch, signedActions, signal);
+			const completedJob = await this.waitForJob(jobInfo, signal);
+			if (completedJob.status !== JobStatus.FAILED) {
+				const upgraded = await this.reactor.getByIdOrSlug(documentId, { branch }, completedJob.consistencyToken, signal);
+				return this.gateDocument(upgraded, { branch }, signal);
+			}
+			if (completedJob.error?.name !== "UpgradePreconditionFailedError") throw new Error(completedJob.error?.message);
+			lastConflictMessage = completedJob.error.message;
+		}
+		throw new Error(`Upgrade of document ${documentIdentifier} conflicted with concurrent edits after ${maxConflictRetries + 1} attempts: ${lastConflictMessage}`);
+	}
+	/**
 	* Creates an empty document in a drive as a single batched operation.
 	* Delegates to {@link IDriveClient.addFile}.
 	*
@@ -927,16 +1460,23 @@ var ReactorClient = class {
 		return this.drives.addFile(driveId, document, parentFolder, signal);
 	}
 	/**
-	* Applies a list of actions to a document and waits for completion
+	* Applies a list of actions to a document and waits for completion.
+	*
+	* `subject` names who the returned document is read as; see
+	* {@link IReactorClient.execute}.
 	*/
-	async execute(documentIdentifier, branch, actions, signal) {
+	async execute(documentIdentifier, branch, actions, signal, subject) {
 		this.logger.verbose("execute(@documentIdentifier, @branch, @count actions)", documentIdentifier, branch, actions.length);
 		const signedActions = await signActions(actions, this.signer, signal);
 		const jobInfo = await this.reactor.execute(documentIdentifier, branch, signedActions, signal);
 		const completedJob = await this.waitForJob(jobInfo, signal);
 		if (completedJob.status === JobStatus.FAILED) throw new Error(completedJob.error?.message);
-		const view = { branch };
-		return await this.reactor.getByIdOrSlug(documentIdentifier, view, completedJob.consistencyToken, signal);
+		const view = {
+			branch,
+			subject
+		};
+		const result = await this.reactor.getByIdOrSlug(documentIdentifier, view, completedJob.consistencyToken, signal);
+		return this.gateDocument(result, view, signal);
 	}
 	/**
 	* Submits a list of actions to a document
@@ -980,7 +1520,8 @@ var ReactorClient = class {
 		const jobInfo = await this.reactor.addRelationship(sourceIdentifier, targetIdentifier, relationshipType, branch, this.signer, signal);
 		const completedJob = await this.waitForJob(jobInfo, signal);
 		if (completedJob.status === JobStatus.FAILED) throw new Error(completedJob.error?.message);
-		return await this.reactor.getByIdOrSlug(sourceIdentifier, { branch }, completedJob.consistencyToken, signal);
+		const result = await this.reactor.getByIdOrSlug(sourceIdentifier, { branch }, completedJob.consistencyToken, signal);
+		return this.gateDocument(result, { branch }, signal);
 	}
 	/**
 	* Removes a relationship between two documents and waits for completion.
@@ -990,7 +1531,8 @@ var ReactorClient = class {
 		const jobInfo = await this.reactor.removeRelationship(sourceIdentifier, targetIdentifier, relationshipType, branch, this.signer, signal);
 		const completedJob = await this.waitForJob(jobInfo, signal);
 		if (completedJob.status === JobStatus.FAILED) throw new Error(completedJob.error?.message);
-		return await this.reactor.getByIdOrSlug(sourceIdentifier, { branch }, completedJob.consistencyToken, signal);
+		const result = await this.reactor.getByIdOrSlug(sourceIdentifier, { branch }, completedJob.consistencyToken, signal);
+		return this.gateDocument(result, { branch }, signal);
 	}
 	/**
 	* Moves a relationship from one source document to another and waits for completion.
@@ -1003,9 +1545,11 @@ var ReactorClient = class {
 		const addJobInfo = await this.reactor.addRelationship(targetParentIdentifier, targetIdentifier, relationshipType, branch, this.signer, signal);
 		const addCompletedJob = await this.waitForJob(addJobInfo, signal);
 		if (addCompletedJob.status === JobStatus.FAILED) throw new Error(addCompletedJob.error?.message);
+		const sourceResult = await this.reactor.getByIdOrSlug(sourceParentIdentifier, { branch }, removeCompletedJob.consistencyToken, signal);
+		const targetResult = await this.reactor.getByIdOrSlug(targetParentIdentifier, { branch }, addCompletedJob.consistencyToken, signal);
 		return {
-			source: await this.reactor.getByIdOrSlug(sourceParentIdentifier, { branch }, removeCompletedJob.consistencyToken, signal),
-			target: await this.reactor.getByIdOrSlug(targetParentIdentifier, { branch }, addCompletedJob.consistencyToken, signal)
+			source: await this.gateDocument(sourceResult, { branch }, signal),
+			target: await this.gateDocument(targetResult, { branch }, signal)
 		};
 	}
 	async loadBatch(request, signal) {
@@ -1078,32 +1622,56 @@ var ReactorClient = class {
 	*/
 	subscribe(search, callback, view) {
 		this.logger.verbose("subscribe(@search, @view)", search, view);
+		const readable = async (document) => filterReadableScopes(document, await this.readableScopes(document, view));
+		let disposed = false;
+		let delivering = Promise.resolve();
+		/**
+		* Queues one event behind those already queued. Gating an event resolves
+		* asynchronously, so an event needing a group fetch would otherwise be
+		* overtaken by the one behind it, and one still in flight would reach a
+		* subscriber that has already unsubscribed. Only delivery is ordered, not
+		* the gating: a single subscription can cover every document in the
+		* reactor, so serializing that work would make its delivery rate the sum
+		* of every gate build rather than the slowest. An event that cannot be
+		* gated is withheld, because serving it unfiltered would leak the scopes
+		* the gate did not clear -- but it is logged rather than swallowed, since
+		* the gate rethrows a transient failure precisely so it is not read as a
+		* denial.
+		*/
+		const deliver = (event) => {
+			Promise.resolve(event).catch(() => void 0);
+			delivering = delivering.then(async () => {
+				const built = await event;
+				if (disposed) return;
+				callback(built);
+			}).catch((error) => {
+				this.logger.error("Subscription delivery failed for @search: @Error", { search }, error);
+			});
+		};
 		const unsubscribeCreated = this.subscriptionManager.onDocumentCreated((result) => {
-			(async () => {
-				try {
-					const documents = await Promise.all(result.results.map((id) => this.reactor.get(id, view, void 0, void 0)));
-					callback({
-						type: DocumentChangeType.Created,
-						documents
-					});
-				} catch {}
-			})();
+			deliver((async () => {
+				const documents = await Promise.all(result.results.map((id) => this.reactor.get(id, withAuthScope(view), void 0, void 0)));
+				return {
+					type: DocumentChangeType.Created,
+					documents: await Promise.all(documents.map(readable))
+				};
+			})());
 		}, search);
 		const unsubscribeDeleted = this.subscriptionManager.onDocumentDeleted((documentIds) => {
-			callback({
+			deliver({
 				type: DocumentChangeType.Deleted,
 				documents: [],
 				context: { childId: documentIds[0] }
 			});
 		}, search);
 		const unsubscribeUpdated = this.subscriptionManager.onDocumentStateUpdated((result) => {
-			callback({
+			deliver((async () => ({
 				type: DocumentChangeType.Updated,
-				documents: result.results
-			});
+				documents: await Promise.all(result.results.map(readable))
+			}))());
 		}, search, view);
 		const unsubscribeRelationship = this.subscriptionManager.onRelationshipChanged((parentId, childId, changeType) => {
-			callback({
+			deliver({
 				type: changeType === RelationshipChangeType.Added ? DocumentChangeType.ChildAdded : DocumentChangeType.ChildRemoved,
 				documents: [],
 				context: {
@@ -1113,6 +1681,7 @@ var ReactorClient = class {
 			});
 		}, search);
 		return () => {
+			disposed = true;
 			unsubscribeCreated();
 			unsubscribeDeleted();
 			unsubscribeUpdated();
@@ -1144,17 +1713,33 @@ let JobQueueState = /* @__PURE__ */ function(JobQueueState) {
 	return JobQueueState;
 }({});
 /**
+* How a retry is accounted against the job's retry limit.
+* - `CountAgainstLimit` (default): a fault; the job eventually exhausts its
+*   retries and fails terminally.
+* - `ExemptFromLimit`: not a fault, so the attempt is not charged to the job.
+*   Used for concurrency conflicts, where the retry does new work.
+*/
+let RetryAccounting = /* @__PURE__ */ function(RetryAccounting) {
+	RetryAccounting["CountAgainstLimit"] = "count-against-limit";
+	RetryAccounting["ExemptFromLimit"] = "exempt-from-limit";
+	return RetryAccounting;
+}({});
+/**
 * Event types for the queue system
 */
 const QueueEventTypes = { JOB_AVAILABLE: 1e4 };
 //#endregion
 //#region src/executor/job-result-handler.ts
+/** Conflict retries a job may take without charging its retry limit. */
+const MAX_EXEMPT_CONFLICT_RETRIES = 20;
 function toErrorInfo(error) {
 	if (error instanceof Error) return {
+		name: error.name,
 		message: error.message,
 		stack: error.stack || (/* @__PURE__ */ new Error()).stack || ""
 	};
 	return {
+		name: "Error",
 		message: error,
 		stack: (/* @__PURE__ */ new Error()).stack || ""
 	};
@@ -1187,12 +1772,19 @@ var JobResultHandler = class {
 				} catch {}
 			}
 		}
-		if (result.error && DocumentNotFoundError.isError(result.error)) {
+		if (result.error && AppendConditionFailedError.isError(result.error) && this.countConflicts(handle.job) < MAX_EXEMPT_CONFLICT_RETRIES) {
+			const errorInfo = toErrorInfo(result.error);
+			try {
+				await this.queue.retryJob(handle.job.id, errorInfo, RetryAccounting.ExemptFromLimit);
+				return;
+			} catch {}
+		}
+		if (result.error && DocumentNotFoundError.isError(result.error) && handle.job.kind === "load") {
 			handle.defer();
-			callbacks.deferJob(handle.job.documentId, handle.job);
+			callbacks.deferJob(result.error.documentId, handle.job);
 			return;
 		}
-		if (result.error && DocumentDeletedError.isError(result.error)) {
+		if (result.error && (DocumentDeletedError.isError(result.error) || DocumentAlreadyExistsError.isError(result.error) || DocumentNotFoundError.isError(result.error) || AuthorizationDeniedError.isError(result.error) || AuthTimestampNotMonotonicError.isError(result.error) || InvalidOperationTimestampError.isError(result.error) || ExcessiveReshuffleError.isError(result.error) || UpgradePreconditionFailedError.isError(result.error))) {
 			const errorInfo = toErrorInfo(result.error);
 			this.jobTracker.markFailed(handle.job.id, errorInfo, handle.job);
 			this.eventBus.emit(ReactorEventTypes.JOB_FAILED, {
@@ -1230,6 +1822,12 @@ var JobResultHandler = class {
 			handle.fail(fullErrorInfo);
 		}
 	}
+	/** How many times this job has already lost an append-condition race. */
+	countConflicts(job) {
+		let conflicts = 0;
+		for (const error of job.errorHistory) if (AppendConditionFailedError.isFailureMessage(error.message)) conflicts++;
+		return conflicts;
+	}
 	hasCreateDocumentAction(job) {
 		for (const action of job.actions) if (action.type === "CREATE_DOCUMENT") return true;
 		for (const operation of job.operations) if (operation.action.type === "CREATE_DOCUMENT") return true;
@@ -1245,22 +1843,134 @@ var JobResultHandler = class {
 			stackLines.push(`[Attempt ${index + 1}] Stack trace:\n${error.stack}`);
 		});
 		return {
+			name: currentError.name,
 			message: messageLines.join("\n"),
 			stack: stackLines.join("\n\n")
 		};
 	}
 };
 //#endregion
-//#region src/executor/types.ts
+//#region src/executor/deferred-jobs.ts
 /**
-* Event types for the job executor
+* The jobs held back because the document they write to was not there yet.
+*
+* A job whose document is missing is deferred rather than failed, because the
+* operations that create that document may still be on their way - out of order
+* from a peer, or a sibling job in the same batch. Deferring emits no event and
+* moves no job status, which is what makes it cheap: a job that gets flushed
+* runs as if it had merely waited its turn.
+*
+* That silence is also why the wait has to be bounded. A deferred job is only
+* released when a job carrying CREATE_DOCUMENT for that exact document id
+* completes, so a job deferred against an id nothing will ever create is
+* released by nothing. Its status stays RUNNING, which is not terminal, so a
+* caller awaiting it waits forever - there is no timeout on that side. The TTL
+* converts that silence into the failure the caller can act on.
+*
+* Failing through the queue rather than only the tracker matters: the queue
+* records the job as resolved, which is what unblocks anything that declared a
+* dependency on it. Deferring alone does not, so a dependent of a deferred job
+* is stranded at PENDING for as long as the deferral lasts.
 */
-const JobExecutorEventTypes = {
-	JOB_STARTED: 2e4,
-	JOB_COMPLETED: 20001,
-	JOB_FAILED: 20002,
-	EXECUTOR_STARTED: 20003,
-	EXECUTOR_STOPPED: 20004
+var DeferredJobs = class {
+	#byDocumentId = /* @__PURE__ */ new Map();
+	#timers = /* @__PURE__ */ new Map();
+	constructor(queue, jobTracker, eventBus, logger, ttlMs = DEFAULT_DEFERRED_JOB_TTL_MS, onReleased = () => Promise.resolve()) {
+		this.queue = queue;
+		this.jobTracker = jobTracker;
+		this.eventBus = eventBus;
+		this.logger = logger;
+		this.ttlMs = ttlMs;
+		this.onReleased = onReleased;
+	}
+	/**
+	* Holds a job until its document arrives, or until the TTL elapses.
+	*
+	* A job deferred again after a flush replaces its own timer rather than
+	* accumulating one, so the wait is measured from the most recent attempt.
+	*/
+	add(documentId, job) {
+		const existing = this.#byDocumentId.get(documentId) ?? [];
+		existing.push(job);
+		this.#byDocumentId.set(documentId, existing);
+		this.#clearTimer(job.id);
+		const timer = setTimeout(() => {
+			this.#expire(documentId, job);
+		}, this.ttlMs);
+		if (typeof timer === "object" && "unref" in timer) timer.unref();
+		this.#timers.set(job.id, timer);
+	}
+	/** Re-enqueues everything waiting on a document that has now arrived. */
+	async flush(documentId) {
+		const jobs = this.#byDocumentId.get(documentId);
+		if (!jobs || jobs.length === 0) return;
+		this.#byDocumentId.delete(documentId);
+		for (const job of jobs) {
+			this.#clearTimer(job.id);
+			try {
+				await this.queue.enqueue(job);
+			} catch (error) {
+				this.logger.error("Error re-enqueuing deferred job: @Error", error);
+			}
+		}
+	}
+	/**
+	* Fails everything still deferred, for a reactor that is shutting down.
+	*
+	* The queue is deliberately not told: it is going away too, and nothing is
+	* left to unblock.
+	*/
+	failAll() {
+		for (const [, jobs] of this.#byDocumentId) for (const job of jobs) {
+			this.#clearTimer(job.id);
+			this.#markFailed(job);
+		}
+		this.#byDocumentId.clear();
+	}
+	/** The jobs still waiting on a document. Exposed for assertions. */
+	waitingOn(documentId) {
+		return this.#byDocumentId.get(documentId) ?? [];
+	}
+	async #expire(documentId, job) {
+		const jobs = this.#byDocumentId.get(documentId);
+		if (!jobs?.includes(job)) return;
+		const remaining = jobs.filter((held) => held !== job);
+		if (remaining.length === 0) this.#byDocumentId.delete(documentId);
+		else this.#byDocumentId.set(documentId, remaining);
+		this.#timers.delete(job.id);
+		this.logger.error("Deferred job @jobId gave up waiting for document @documentId after @ttlMs ms", job.id, documentId, this.ttlMs);
+		const errorInfo = this.#markFailed(job);
+		try {
+			await this.queue.failJob(job.id, errorInfo);
+		} catch (error) {
+			this.logger.error("Error failing an expired deferred job: @Error", error);
+			return;
+		}
+		this.jobTracker.markFailed(job.id, errorInfo, job);
+		try {
+			await this.onReleased();
+		} catch (error) {
+			this.logger.error("Error dispatching after a deferred job expired: @Error", error);
+		}
+	}
+	#markFailed(job) {
+		const error = new DocumentNotFoundError(job.documentId);
+		const errorInfo = toErrorInfo(error);
+		this.jobTracker.markFailed(job.id, errorInfo, job);
+		this.eventBus.emit(ReactorEventTypes.JOB_FAILED, {
+			jobId: job.id,
+			error,
+			job
+		}).catch(() => {});
+		return errorInfo;
+	}
+	#clearTimer(jobId) {
+		const timer = this.#timers.get(jobId);
+		if (timer !== void 0) {
+			clearTimeout(timer);
+			this.#timers.delete(jobId);
+		}
+	}
 };
 //#endregion
 //#region src/executor/worker-pool-router.ts
@@ -1297,18 +2007,6 @@ function bucketFor(documentId, numWorkers) {
 //#endregion
 //#region src/executor/worker-pool-job-executor-manager.ts
 /**
-* Action types whose application invalidates the parent's collection
-* membership cache. Mirrors the in-process invalidation pattern in
-* `document-action-handler.ts` (the worker pool relocates that work to
-* the parent because the cache lives there).
-*/
-const MEMBERSHIP_INVALIDATING_ACTIONS = new Set([
-	"ADD_RELATIONSHIP",
-	"REMOVE_RELATIONSHIP",
-	"UPDATE_RELATIONSHIP",
-	"DELETE_DOCUMENT"
-]);
-/**
 * Manages a pool of executor workers and dispatches jobs across them with
 * sticky-by-documentId routing. Replaces `SimpleJobExecutorManager` when
 * the worker pool is enabled.
@@ -1318,10 +2016,19 @@ const MEMBERSHIP_INVALIDATING_ACTIONS = new Set([
 *  - Emitting `JOB_RUNNING` and `JOB_WRITE_READY` events; the worker's
 *    local event bus is a no-op stub.
 *  - Maintaining the deferred-jobs map for `DocumentNotFoundError`.
-*  - Owning the authoritative `ICollectionMembershipCache` — workers do
-*    not query it. Each result enriches the outgoing `JOB_WRITE_READY`
-*    with `collectionMemberships` and invalidates targets named by
-*    relationship/delete operations before the lookup.
+*  - Enriching the outgoing `JOB_WRITE_READY` with
+*    `collectionMemberships`, read from the operation index after the
+*    worker has committed. It takes the whole index rather than a
+*    narrower read interface so that handing it a cache does not
+*    compile: which documents a commit moves between collections is not
+*    derivable from action shape, because joining a collection also
+*    joins every group the joining document has referenced and that set
+*    comes from selects run inside the commit. A parent-side cache
+*    cannot learn it went stale, and a stale entry silently drops the
+*    document's operations from the outbox of every remote subscribed to
+*    the omitted collection. Costs one primary-key-prefix lookup on
+*    `document_collections` per job that produced operations, on a
+*    fire-and-forget path.
 *
 * @see Executor Worker Pool Design wiki page
 *   (Powerhouse board wiki id: d400d711-f07e-4389-a226-4e9fdd4fa8ba)
@@ -1332,18 +2039,19 @@ var WorkerPoolJobExecutorManager = class {
 	activeJobs = 0;
 	totalJobsProcessed = 0;
 	unsubscribe;
-	deferredJobs = /* @__PURE__ */ new Map();
+	deferredJobs;
 	resultHandler;
 	jobTimeoutMs;
-	constructor(workerFactory, eventBus, queue, jobTracker, logger, resolver, collectionMembershipCache, jobTimeoutMs = 3e4) {
+	constructor(workerFactory, eventBus, queue, jobTracker, logger, resolver, operationIndex, jobTimeoutMs = 3e4, deferredJobTtlMs = DEFAULT_DEFERRED_JOB_TTL_MS) {
 		this.workerFactory = workerFactory;
 		this.eventBus = eventBus;
 		this.queue = queue;
 		this.jobTracker = jobTracker;
 		this.logger = logger;
 		this.resolver = resolver;
-		this.collectionMembershipCache = collectionMembershipCache;
+		this.operationIndex = operationIndex;
 		this.jobTimeoutMs = jobTimeoutMs;
+		this.deferredJobs = new DeferredJobs(queue, jobTracker, eventBus, logger, deferredJobTtlMs, () => this.tryDispatchAll());
 		this.resultHandler = new JobResultHandler(queue, jobTracker, eventBus, resolver, logger);
 	}
 	async start(numWorkers) {
@@ -1364,16 +2072,7 @@ var WorkerPoolJobExecutorManager = class {
 			this.unsubscribe = void 0;
 		}
 		if (graceful) while (this.activeJobs > 0) await new Promise((resolve) => setTimeout(resolve, 10));
-		for (const [, jobs] of this.deferredJobs) for (const job of jobs) {
-			const errorInfo = toErrorInfo(new DocumentNotFoundError(job.documentId));
-			this.jobTracker.markFailed(job.id, errorInfo, job);
-			this.eventBus.emit(ReactorEventTypes.JOB_FAILED, {
-				jobId: job.id,
-				error: new DocumentNotFoundError(job.documentId),
-				job
-			}).catch(() => {});
-		}
-		this.deferredJobs.clear();
+		this.deferredJobs.failAll();
 		await Promise.all(this.workers.map((w) => w.shutdown(graceful).catch((err) => {
 			this.logger.warn("worker shutdown failed: @Error", err);
 		})));
@@ -1495,22 +2194,17 @@ var WorkerPoolJobExecutorManager = class {
 			this.logger.error("emitWriteReady failed for job @jobId: @Error", { jobId: handle.job.id }, error);
 		});
 		await this.resultHandler.handleResult(handle, outcome.result, {
-			deferJob: (documentId, job) => {
-				const existing = this.deferredJobs.get(documentId) ?? [];
-				existing.push(job);
-				this.deferredJobs.set(documentId, existing);
-			},
-			flushDeferredFor: (documentId) => this.flushDeferredJobs(documentId)
+			deferJob: (documentId, job) => this.deferredJobs.add(documentId, job),
+			flushDeferredFor: (documentId) => this.deferredJobs.flush(documentId)
 		});
 		this.activeJobs--;
 		await this.tryDispatchFor(worker);
 	}
 	async emitWriteReady(job, payload) {
-		this.invalidateMembershipsFor(payload.operations);
 		const documentIds = [...new Set(payload.operations.map((op) => op.context.documentId))];
 		let collectionMemberships = {};
-		try {
-			collectionMemberships = await this.collectionMembershipCache.getCollectionsForDocuments(documentIds);
+		if (documentIds.length > 0) try {
+			collectionMemberships = fillMissingMemberships(documentIds, await this.operationIndex.getCollectionsForDocuments(documentIds));
 		} catch (error) {
 			this.logger.error("Failed to load collection memberships for JOB_WRITE_READY: @Error", error);
 		}
@@ -1526,14 +2220,6 @@ var WorkerPoolJobExecutorManager = class {
 			this.logger.error("Failed to emit JOB_WRITE_READY event: @Error", error);
 		}
 	}
-	invalidateMembershipsFor(operations) {
-		for (const op of operations) {
-			const actionType = op.operation.action.type;
-			if (!MEMBERSHIP_INVALIDATING_ACTIONS.has(actionType)) continue;
-			const target = extractMembershipTarget(op);
-			if (target) this.collectionMembershipCache.invalidate(target);
-		}
-	}
 	/**
 	* Handle a worker-transport failure (worker exited / init failed / abort
 	* timed out) detected while `worker.execute` was in flight. Re-enqueues
@@ -1582,16 +2268,6 @@ var WorkerPoolJobExecutorManager = class {
 		this.workers[deadIndex] = fresh;
 		await this.tryDispatchFor(fresh);
 	}
-	async flushDeferredJobs(documentId) {
-		const jobs = this.deferredJobs.get(documentId);
-		if (!jobs || jobs.length === 0) return;
-		this.deferredJobs.delete(documentId);
-		for (const job of jobs) try {
-			await this.queue.enqueue(job);
-		} catch (error) {
-			this.logger.error("Error re-enqueuing deferred job: @Error", error);
-		}
-	}
 };
 function isWorkerTransportError(error) {
 	return error instanceof WorkerExitedError || error instanceof WorkerInitFailedError || error instanceof WorkerAbortTimeoutError;
@@ -1602,11 +2278,16 @@ function isDuplicateModuleFailure(reason) {
 	const cause = reason.cause;
 	return cause instanceof Error && cause.name === "DuplicateModuleError";
 }
-function extractMembershipTarget(op) {
-	const actionType = op.operation.action.type;
-	const input = op.operation.action.input;
-	if (actionType === "ADD_RELATIONSHIP" || actionType === "REMOVE_RELATIONSHIP" || actionType === "UPDATE_RELATIONSHIP") return input?.targetId;
-	if (actionType === "DELETE_DOCUMENT") return input?.documentId ?? op.context.documentId;
+/**
+* Gives every requested document a key, empty when it belongs to no
+* collection. The operation index omits documents with no rows while the
+* membership cache defaulted them to `[]`, so this keeps the emitted
+* `JobWriteReadyEvent.collectionMemberships` shape unchanged.
+*/
+function fillMissingMemberships(documentIds, found) {
+	const result = {};
+	for (const documentId of documentIds) result[documentId] = found[documentId] ?? [];
+	return result;
 }
 //#endregion
 //#region src/executor/simple-job-executor-manager.ts
@@ -1620,10 +2301,10 @@ var SimpleJobExecutorManager = class {
 	activeJobs = 0;
 	totalJobsProcessed = 0;
 	unsubscribe;
-	deferredJobs = /* @__PURE__ */ new Map();
+	deferredJobs;
 	resultHandler;
 	jobTimeoutMs;
-	constructor(executorFactory, eventBus, queue, jobTracker, logger, resolver, jobTimeoutMs = 3e4) {
+	constructor(executorFactory, eventBus, queue, jobTracker, logger, resolver, jobTimeoutMs = 3e4, deferredJobTtlMs = DEFAULT_DEFERRED_JOB_TTL_MS) {
 		this.executorFactory = executorFactory;
 		this.eventBus = eventBus;
 		this.queue = queue;
@@ -1631,6 +2312,7 @@ var SimpleJobExecutorManager = class {
 		this.logger = logger;
 		this.resolver = resolver;
 		this.jobTimeoutMs = jobTimeoutMs;
+		this.deferredJobs = new DeferredJobs(queue, jobTracker, eventBus, logger, deferredJobTtlMs, () => this.checkForMoreJobs());
 		this.resultHandler = new JobResultHandler(queue, jobTracker, eventBus, resolver, logger);
 	}
 	async start(numExecutors) {
@@ -1651,16 +2333,7 @@ var SimpleJobExecutorManager = class {
 			this.unsubscribe = void 0;
 		}
 		if (graceful) while (this.activeJobs > 0) await new Promise((resolve) => setTimeout(resolve, 100));
-		for (const [, jobs] of this.deferredJobs) for (const job of jobs) {
-			const errorInfo = toErrorInfo(new DocumentNotFoundError(job.documentId));
-			this.jobTracker.markFailed(job.id, errorInfo, job);
-			this.eventBus.emit(ReactorEventTypes.JOB_FAILED, {
-				jobId: job.id,
-				error: new DocumentNotFoundError(job.documentId),
-				job
-			}).catch(() => {});
-		}
-		this.deferredJobs.clear();
+		this.deferredJobs.failAll();
 		this.executors = [];
 		this.isRunning = false;
 	}
@@ -1753,12 +2426,8 @@ var SimpleJobExecutorManager = class {
 			this.eventBus.emit(JobExecutorEventTypes.JOB_FAILED, failedEvent).catch(() => {});
 		}
 		await this.resultHandler.handleResult(handle, result, {
-			deferJob: (documentId, job) => {
-				const existing = this.deferredJobs.get(documentId) ?? [];
-				existing.push(job);
-				this.deferredJobs.set(documentId, existing);
-			},
-			flushDeferredFor: (documentId) => this.flushDeferredJobs(documentId)
+			deferJob: (documentId, job) => this.deferredJobs.add(documentId, job),
+			flushDeferredFor: (documentId) => this.deferredJobs.flush(documentId)
 		});
 		this.activeJobs--;
 		await this.checkForMoreJobs();
@@ -1792,16 +2461,6 @@ var SimpleJobExecutorManager = class {
 			}
 		}
 	}
-	async flushDeferredJobs(documentId) {
-		const jobs = this.deferredJobs.get(documentId);
-		if (!jobs || jobs.length === 0) return;
-		this.deferredJobs.delete(documentId);
-		for (const job of jobs) try {
-			await this.queue.enqueue(job);
-		} catch (error) {
-			this.logger.error("Error re-enqueuing deferred job: @Error", error);
-		}
-	}
 };
 //#endregion
 //#region src/job-tracker/in-memory-job-tracker.ts
@@ -1850,6 +2509,7 @@ var InMemoryJobTracker = class {
 	}
 	handleJobFailed(event) {
 		this.markFailed(event.jobId, {
+			name: event.error.name,
 			message: event.error.message,
 			stack: event.error.stack || ""
 		}, event.job);
@@ -1958,6 +2618,26 @@ function matchesFilter(op, filter) {
 	}
 	return true;
 }
+function nonEmpty(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function namespaceOf(processor) {
+	return nonEmpty(processor.namespace);
+}
+function classNameOf(processor) {
+	const name = processor.constructor.name;
+	return name && name !== "Object" ? name : void 0;
+}
+function resolveProcessorSlots(records, legacy) {
+	if (legacy) return records.map((_, i) => String(i));
+	const seen = /* @__PURE__ */ new Map();
+	return records.map((record, i) => {
+		const base = nonEmpty(record.id) ?? namespaceOf(record.processor) ?? classNameOf(record.processor) ?? String(i);
+		const count = seen.get(base) ?? 0;
+		seen.set(base, count + 1);
+		return count === 0 ? base : `${base}#${count}`;
+	});
+}
 //#endregion
 //#region src/processors/processor-manager.ts
 /**
@@ -1979,13 +2659,15 @@ var ProcessorManager = class extends BaseReadModel {
 	cursorCache = /* @__PURE__ */ new Map();
 	logger;
 	driveContainerTypes;
-	constructor(db, operationIndex, writeCache, consistencyTracker, logger, driveContainerTypes) {
+	legacyProcessorIds;
+	constructor(db, operationIndex, writeCache, consistencyTracker, logger, driveContainerTypes, options = {}) {
 		super(db, operationIndex, writeCache, consistencyTracker, {
 			readModelId: "processor-manager",
 			rebuildStateOnInit: true
 		});
 		this.logger = logger;
 		this.driveContainerTypes = driveContainerTypes;
+		this.legacyProcessorIds = options.legacyProcessorIds ?? true;
 	}
 	async init() {
 		await super.init();
@@ -2072,9 +2754,10 @@ var ProcessorManager = class extends BaseReadModel {
 		}
 		if (records.length === 0) return;
 		const trackedList = [];
+		const slots = resolveProcessorSlots(records, this.legacyProcessorIds);
 		for (let i = 0; i < records.length; i++) {
 			const record = records[i];
-			const processorId = `${identifier}:${driveId}:${i}`;
+			const processorId = `${identifier}:${driveId}:${slots[i]}`;
 			const cached = this.cursorCache.get(processorId);
 			let lastOrdinal;
 			let status;
@@ -2106,8 +2789,9 @@ var ProcessorManager = class extends BaseReadModel {
 			trackedList.push(tracked);
 			await this.saveProcessorCursor(tracked);
 		}
-		await this.db.deleteFrom("ProcessorCursor").where("factoryId", "=", identifier).where("driveId", "=", driveId).where("processorIndex", ">=", records.length).execute();
-		for (const [id, row] of this.cursorCache) if (row.factoryId === identifier && row.driveId === driveId && row.processorIndex >= records.length) this.cursorCache.delete(id);
+		const liveIds = new Set(trackedList.map((t) => t.processorId));
+		await this.db.deleteFrom("ProcessorCursor").where("factoryId", "=", identifier).where("driveId", "=", driveId).where("processorId", "not in", [...liveIds]).execute();
+		for (const [id, row] of this.cursorCache) if (row.factoryId === identifier && row.driveId === driveId && !liveIds.has(id)) this.cursorCache.delete(id);
 		const factoryProcessors = this.factoryToProcessors.get(identifier);
 		if (factoryProcessors) factoryProcessors.set(driveId, trackedList);
 		const existingDriveProcessors = this.processorsByDrive.get(driveId) ?? [];
@@ -2311,10 +2995,12 @@ var InMemoryQueue = class {
 	}
 	toErrorInfo(error) {
 		if (error instanceof Error) return {
+			name: error.name,
 			message: error.message,
 			stack: error.stack || (/* @__PURE__ */ new Error()).stack || ""
 		};
 		return {
+			name: "Error",
 			message: error,
 			stack: (/* @__PURE__ */ new Error()).stack || ""
 		};
@@ -2402,6 +3088,7 @@ var InMemoryQueue = class {
 			await this.resolver.ensureModelLoaded(documentType);
 		} catch {
 			await this.failJob(job.id, {
+				name: "Error",
 				message: `Failed to load document model for type: ${documentType}`,
 				stack: (/* @__PURE__ */ new Error()).stack || ""
 			});
@@ -2575,9 +3262,11 @@ var InMemoryQueue = class {
 		this.jobIndex.delete(jobId);
 		this.completedJobs.add(jobId);
 		await this.remove(jobId);
+		const emittedError = new Error(error?.message ?? "Job failed");
+		if (error?.name) emittedError.name = error.name;
 		this.eventBus.emit(ReactorEventTypes.JOB_FAILED, {
 			jobId,
-			error: new Error(error?.message ?? "Job failed"),
+			error: emittedError,
 			job
 		}).catch(() => {});
 		this.checkDrained();
@@ -2587,7 +3276,7 @@ var InMemoryQueue = class {
 		if (documentId) this.markJobComplete(jobId, documentId);
 		this.jobIndex.delete(jobId);
 	}
-	async retryJob(jobId, error) {
+	async retryJob(jobId, error, accounting = RetryAccounting.CountAgainstLimit) {
 		const job = this.jobIndex.get(jobId);
 		if (!job) return;
 		job.lastError = error;
@@ -2596,9 +3285,10 @@ var InMemoryQueue = class {
 		this.jobIndex.delete(jobId);
 		this.jobIdToQueueKey.delete(jobId);
 		if (error) job.errorHistory.push(error);
+		const retryCount = job.retryCount || 0;
 		const updatedJob = {
 			...job,
-			retryCount: (job.retryCount || 0) + 1,
+			retryCount: accounting === RetryAccounting.CountAgainstLimit ? retryCount + 1 : retryCount,
 			lastError: error
 		};
 		await this.enqueue(updatedJob);
@@ -2686,6 +3376,19 @@ var InMemoryQueue = class {
 	}
 };
 //#endregion
+//#region src/projection/read-model-kinds.ts
+/**
+* Every {@link BuiltInReadModelKind}, at runtime. Derived from a total
+* record so adding a kind to the union without adding it here is a compile
+* error: under projection sharding a kind missing from both `preReadyKinds`
+* and `postReadyKinds` is indexed by nobody — the host's own copies never
+* index an operation — so a gap here reads as silently stale data.
+*/
+const BUILT_IN_READ_MODEL_KINDS = Object.keys({
+	"document-view": true,
+	"document-indexer": true
+});
+//#endregion
 //#region src/core/model-sources.ts
 function modelSourceKey(module) {
 	return `${module.documentModel.global.id}@${module.version ?? 1}`;
@@ -3116,6 +3819,83 @@ var SubscriptionNotificationReadModel = class {
 	}
 };
 //#endregion
+//#region src/core/group-reevaluation-trigger.ts
+/**
+* Watches committed writes for group membership changes and enqueues a
+* re-evaluation job for every document whose auth history references the
+* changed group, found through the reverse direction of the group-reference
+* relation. Each affected document is re-judged in its own job, so the work
+* runs under that document's execution slot rather than the group's.
+*
+* The job carries the earliest changed membership timestamp; the executor
+* skips the pass when everything the document holds sorts before it, which
+* keeps the common case (a membership write later than all history) free.
+*/
+var GroupReevaluationTrigger = class {
+	unsubscribe;
+	constructor(logger, eventBus, queue, operationIndex) {
+		this.logger = logger;
+		this.eventBus = eventBus;
+		this.queue = queue;
+		this.operationIndex = operationIndex;
+	}
+	startup() {
+		this.unsubscribe = this.eventBus.subscribe(ReactorEventTypes.JOB_WRITE_READY, async (_type, event) => this.onWriteReady(event));
+	}
+	shutdown() {
+		this.unsubscribe?.();
+		this.unsubscribe = void 0;
+	}
+	async onWriteReady(event) {
+		const changed = /* @__PURE__ */ new Map();
+		for (const { operation, context } of event.operations) {
+			if (context.documentType !== groupDocumentType || context.scope !== "global" || !groupMembershipActionTypes.includes(operation.action.type)) continue;
+			const existing = changed.get(context.documentId);
+			if (existing === void 0 || Date.parse(operation.timestampUtcMs) < Date.parse(existing)) changed.set(context.documentId, operation.timestampUtcMs);
+		}
+		if (changed.size === 0) return;
+		const affected = /* @__PURE__ */ new Map();
+		for (const [groupId, timestamp] of changed) {
+			let referencers;
+			try {
+				referencers = await this.operationIndex.getGroupReferencers(groupId);
+			} catch (error) {
+				this.logger.error("Failed to resolve referencers of group @groupId: @error", groupId, error);
+				continue;
+			}
+			for (const documentId of referencers) {
+				const existing = affected.get(documentId);
+				if (existing === void 0 || Date.parse(timestamp) < Date.parse(existing)) affected.set(documentId, timestamp);
+			}
+		}
+		for (const [documentId, timestamp] of affected) {
+			const jobId = v4();
+			const job = {
+				id: jobId,
+				kind: "reevaluation",
+				documentId,
+				scope: "global",
+				branch: "main",
+				actions: [],
+				operations: [],
+				createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+				queueHint: [],
+				maxRetries: 3,
+				errorHistory: [],
+				meta: {
+					...buildSingleJobMeta(jobId),
+					triggerTimestampUtcMs: timestamp
+				}
+			};
+			try {
+				await this.queue.enqueue(job);
+			} catch (error) {
+				this.logger.error("Failed to enqueue re-evaluation of @documentId: @error", documentId, error);
+			}
+		}
+	}
+};
+//#endregion
 //#region src/sync/types.ts
 let ChannelScheme = /* @__PURE__ */ function(ChannelScheme) {
 	ChannelScheme["CONNECT"] = "connect";
@@ -3407,13 +4187,42 @@ var BufferedMailbox = class {
 var GraphQLRequestError = class extends Error {
 	statusCode;
 	category;
-	constructor(message, category, statusCode) {
+	/**
+	* One entry per error the response carried, in order, holding its
+	* `extensions.code` - undefined where it declared none. Kept per error rather
+	* than as a set, because a response that mixes a classified error with an
+	* unclassified one must not be read as if only the classified one arrived.
+	*/
+	codes;
+	constructor(message, category, statusCode, codes = []) {
 		super(message);
 		this.name = "GraphQLRequestError";
 		this.category = category;
 		this.statusCode = statusCode;
+		this.codes = codes;
 	}
 };
+/**
+* Extension codes a remote uses to say a failure is worth polling through.
+*
+* Shared with reactor-api so the server throws what this check reads and the two
+* cannot drift. A `graphql` category error is otherwise permanent: it stops the
+* poll timer, and nothing restarts it, so a code that lands here is the
+* difference between a channel that recovers and one that is dead for the
+* process lifetime.
+*/
+const RECOVERABLE_GRAPHQL_ERROR_CODES = { malformedStoredOperation: "MALFORMED_STORED_OPERATION" };
+const RECOVERABLE_CODES = new Set(Object.values(RECOVERABLE_GRAPHQL_ERROR_CODES));
+/**
+* True when every error the response carried named a recoverable code.
+*
+* Unanimity is the requirement: one unclassified error alongside a recoverable
+* one means something else also went wrong, and polling through that would be
+* guessing.
+*/
+function isRecoverableGraphQLError(error) {
+	return error.codes.length > 0 && error.codes.every((code) => code !== void 0 && RECOVERABLE_CODES.has(code));
+}
 /** Auth-rejection message fragments the switchboard emits. Shared with
 * reactor-api so server throws and this client check can't drift. */
 const DRIVE_AUTH_ERROR_MESSAGES = {
@@ -3437,11 +4246,18 @@ var PollingChannelError = class extends Error {
 var ChannelError = class extends Error {
 	source;
 	error;
-	constructor(source, error) {
+	/**
+	* The classification when something other than the error carries it. Absent
+	* means derive it from `error.name`; a dead letter mirrored from a peer sets it,
+	* because only the message crosses the wire.
+	*/
+	errorType;
+	constructor(source, error, errorType) {
 		super(`ChannelError[${source}]: ${error.message}`);
 		this.name = "ChannelError";
 		this.source = source;
 		this.error = error;
+		this.errorType = errorType;
 	}
 };
 //#endregion
@@ -3646,6 +4462,7 @@ function toOperationWithContext(entry) {
 			skip: entry.skip,
 			hash: entry.hash,
 			timestampUtcMs: entry.timestampUtcMs,
+			deniedReason: entry.deniedReason,
 			action: entry.action
 		},
 		context: {
@@ -3662,29 +4479,35 @@ function toOperationWithContext(entry) {
 * a single SyncOperation per group. Within each group, operations are sorted
 * by context.ordinal. The merged SyncOperation keeps the first group member's
 * jobId; all other jobIds are remapped so external dependencies still resolve.
+*
+* Only CONTIGUOUS runs merge. A document whose scopes interleave arrives as an
+* alternating chain (document -> auth -> document -> auth) where each entry
+* depends on the one before it. Merging every occurrence of a
+* (documentId, scope, branch) collapses that chain into two nodes that each
+* depend on the other, which validateBatchStructure rejects as a dependency
+* cycle. Merging only adjacent entries keeps the chain linear.
 */
 function consolidateSyncOperations(syncOps) {
 	if (syncOps.length <= 1) return syncOps;
-	const groups = /* @__PURE__ */ new Map();
+	const groups = [];
 	const jobIdRemap = /* @__PURE__ */ new Map();
-	const insertionOrder = [];
+	let prevKey = null;
 	for (const syncOp of syncOps) {
 		const key = `${syncOp.documentId}|${syncOp.scopes.slice().sort().join(",")}|${syncOp.branch}`;
-		const existing = groups.get(key);
-		if (existing) {
-			existing.ops.push(syncOp);
-			if (syncOp.jobId && syncOp.jobId !== existing.canonicalJobId) jobIdRemap.set(syncOp.jobId, existing.canonicalJobId);
+		const current = key === prevKey ? groups[groups.length - 1] : void 0;
+		if (current) {
+			current.ops.push(syncOp);
+			if (syncOp.jobId && syncOp.jobId !== current.canonicalJobId) jobIdRemap.set(syncOp.jobId, current.canonicalJobId);
 		} else {
-			groups.set(key, {
+			groups.push({
 				ops: [syncOp],
 				canonicalJobId: syncOp.jobId
 			});
-			insertionOrder.push(key);
+			prevKey = key;
 		}
 	}
 	const result = [];
-	for (const key of insertionOrder) {
-		const group = groups.get(key);
+	for (const group of groups) {
 		const allOperations = group.ops.flatMap((op) => op.operations).sort((a, b) => a.context.ordinal - b.context.ordinal);
 		const allDeps = /* @__PURE__ */ new Set();
 		for (const op of group.ops) for (const dep of op.jobDependencies) allDeps.add(dep);
@@ -3811,6 +4634,33 @@ function splitComponent(items, maxSize) {
 	for (let i = 0; i < sorted.length; i += maxSize) chunks.push(sorted.slice(i, i + maxSize));
 	return chunks;
 }
+/**
+* Classifies a failure by error name rather than `instanceof`, because a failure
+* that crossed the pooled-worker boundary arrives as plain data.
+*/
+function classifyJobFailure(errorName) {
+	switch (errorName) {
+		case "AuthTimestampNotMonotonicError": return "AUTH_TIMESTAMP_NOT_MONOTONIC";
+		case "InvalidOperationTimestampError": return "INVALID_TIMESTAMP";
+		case "ExcessiveReshuffleError": return "EXCESSIVE_SHUFFLE";
+		case "InvalidSignatureError": return "SIGNATURE_INVALID";
+		case "HashMismatchError": return "HASH_MISMATCH";
+		default: return "UNCLASSIFIED";
+	}
+}
+/** The explicit type when something else carried it, else derived by name. */
+function syncOperationErrorType(error) {
+	return error?.errorType ?? classifyJobFailure(error?.error?.name ?? "Error");
+}
+/** Dead-letter types that must not stop the document syncing. */
+const NON_QUARANTINING_ERROR_TYPES = new Set(["AUTH_TIMESTAMP_NOT_MONOTONIC"]);
+/**
+* A held auth operation must not quarantine: reconciling the two policies needs
+* the traffic a quarantine would stop.
+*/
+function quarantinesDocument(errorType) {
+	return !NON_QUARANTINING_ERROR_TYPES.has(errorType);
+}
 //#endregion
 //#region src/sync/channels/interval-poll-timer.ts
 const DEFAULT_CONFIG = {
@@ -3924,36 +4774,15 @@ var IntervalPollTimer = class {
 //#region src/sync/channels/utils.ts
 let syncOpCounter = 0;
 /**
-* Serializes an action for GraphQL transport, converting signature tuples to strings.
+* Serializes an action for GraphQL transport.
 *
-* Only the fields declared by the GraphQL `ActionInput` type are forwarded. This
-* guards against stale runtime-only fields (e.g. a legacy `attachments` array on
-* operations persisted before the attachment-system removal) leaking into the
-* mutation variables, where the tightened schema would reject them.
+* Projects onto exactly the fields `ActionInput` declares, which is what keeps a
+* stale runtime-only field - a legacy `attachments` array, say - from riding
+* along into the mutation variables, where the schema would reject the whole
+* request rather than the field.
 */
 function serializeAction(action) {
-	const base = {
-		id: action.id,
-		type: action.type,
-		timestampUtcMs: action.timestampUtcMs,
-		input: action.input,
-		scope: action.scope
-	};
-	const signer = action.context?.signer;
-	if (!signer?.signatures) return action.context ? {
-		...base,
-		context: action.context
-	} : base;
-	return {
-		...base,
-		context: {
-			...action.context,
-			signer: {
-				...signer,
-				signatures: signer.signatures.map((sig) => Array.isArray(sig) ? sig.join(", ") : sig)
-			}
-		}
-	};
+	return toTransportAction(action);
 }
 /**
 * Serializes a SyncEnvelope for GraphQL transport.
@@ -3973,6 +4802,7 @@ function serializeEnvelope(envelope) {
 				hash: opWithContext.operation.hash,
 				skip: opWithContext.operation.skip,
 				error: opWithContext.operation.error,
+				...opWithContext.operation.deniedReason !== void 0 ? { deniedReason: opWithContext.operation.deniedReason } : {},
 				id: opWithContext.operation.id,
 				action: serializeAction(opWithContext.operation.action)
 			},
@@ -3990,31 +4820,33 @@ function serializeEnvelope(envelope) {
 	};
 }
 /**
-* Deserializes a signature from a comma-separated string back to a tuple.
-*
-* GraphQL serializes Signature tuples as comma-separated strings for transport.
-* This function converts them back to the expected [string, string, string, string, string] format.
+* `isDenied` tests strictly against undefined, so a null left in place would mark
+* every synced operation denied. The key is removed rather than set to undefined,
+* so an operation that arrived without it stays identical to the one sent.
 */
-function deserializeSignature(sig) {
-	if (Array.isArray(sig)) return sig;
-	return sig.split(", ");
+function normalizeAbsentFields(operation) {
+	const wire = operation;
+	if (wire.error !== null && wire.deniedReason !== null) return operation;
+	const normalized = { ...operation };
+	if (wire.error === null) delete normalized.error;
+	if (wire.deniedReason === null) delete normalized.deniedReason;
+	return normalized;
 }
-/**
-* Deserializes signatures in an operation's signer context from strings back to tuples.
-*
-* When operations are transported via GraphQL, signatures are serialized as comma-separated
-* strings. This function restores them to the Signature tuple format required for verification.
-*/
-function deserializeOperationSignatures(opWithContext) {
-	const signer = opWithContext.operation.action.context?.signer;
-	if (!signer?.signatures || signer.signatures.length === 0) return opWithContext;
+/** Restores signature tuples and null-valued optional fields to undefined. */
+function deserializeOperation(opWithContext) {
+	const operation = normalizeAbsentFields(opWithContext.operation);
+	const signer = operation.action.context?.signer;
+	if (!signer?.signatures || signer.signatures.length === 0) return {
+		...opWithContext,
+		operation
+	};
 	const deserializedSignatures = signer.signatures.map(deserializeSignature);
 	const deserializedOperation = {
-		...opWithContext.operation,
+		...operation,
 		action: {
-			...opWithContext.operation.action,
+			...operation.action,
 			context: {
-				...opWithContext.operation.action.context,
+				...operation.action.context,
 				signer: {
 					...signer,
 					signatures: deserializedSignatures
@@ -4041,7 +4873,7 @@ function deserializeOperationSignatures(opWithContext) {
 */
 function envelopesToSyncOperations(envelope, remoteName) {
 	if (!envelope.operations || envelope.operations.length === 0) return [];
-	return batchOperationsByDocument(envelope.operations.map(deserializeOperationSignatures)).map((batch) => {
+	return batchOperationsByDocument(envelope.operations.map(deserializeOperation)).map((batch) => {
 		return new SyncOperation(`syncop-${envelope.channelMeta.id}-${Date.now()}-${syncOpCounter++}`, envelope.key ?? "", (envelope.dependsOn ?? []).filter(Boolean), remoteName, batch.documentId, [batch.scope], batch.branch, batch.operations);
 	});
 }
@@ -4053,6 +4885,12 @@ const getLatestAppliedOrdinal = (syncOps) => {
 //#endregion
 //#region src/sync/channels/gql-req-channel.ts
 /**
+* Fields the auth projection added to the sync schema. A remote that predates
+* them rejects the whole query for naming one, so they are selected only while
+* the remote is known to serve them.
+*/
+const DECISION_FIELDS = ["deniedReason", "errorType"];
+/**
 * GraphQL-based synchronization channel for network communication between reactors.
 */
 var GqlRequestChannel = class {
@@ -4079,6 +4917,8 @@ var GqlRequestChannel = class {
 	isPushing = false;
 	pendingDrain = false;
 	receivingPages = false;
+	/** Cleared for good the first time the remote rejects {@link DECISION_FIELDS}. */
+	peerServesDecisionFields = true;
 	isRecovering = false;
 	connectionState = "connecting";
 	/** Latest unrecoverable error was an auth rejection; cleared on connect. */
@@ -4257,7 +5097,7 @@ var GqlRequestChannel = class {
 		const syncOps = [];
 		for (const dl of deadLetters) {
 			const syncOp = new SyncOperation(crypto.randomUUID(), dl.jobId, [], this.remoteName, dl.documentId, dl.scopes, dl.branch, []);
-			syncOp.failed(new ChannelError(ChannelErrorSource.Outbox, new Error(dl.error)));
+			syncOp.failed(new ChannelError(ChannelErrorSource.Outbox, new Error(dl.error), dl.errorType ?? void 0));
 			syncOps.push(syncOp);
 		}
 		this.deadLetter.add(...syncOps);
@@ -4349,7 +5189,44 @@ var GqlRequestChannel = class {
 	* Queries the remote GraphQL endpoint for sync envelopes.
 	*/
 	async pollSyncEnvelopes(ackOrdinal, latestOrdinal) {
-		const query = `
+		const variables = {
+			channelId: this.channelId,
+			outboxAck: ackOrdinal,
+			outboxLatest: latestOrdinal
+		};
+		let response;
+		try {
+			response = await this.executeGraphQL(this.pollQuery(this.peerServesDecisionFields), variables);
+		} catch (error) {
+			if (!this.rejectsDecisionFields(error)) throw error;
+			this.logger.warn("Remote @channelId does not serve deniedReason/errorType; polling without them. The remote is on an older schema, so it has neither to report.", this.channelId);
+			this.peerServesDecisionFields = false;
+			response = await this.executeGraphQL(this.pollQuery(false), variables);
+		}
+		return {
+			envelopes: response.pollSyncEnvelopes.envelopes,
+			ackOrdinal: response.pollSyncEnvelopes.ackOrdinal,
+			deadLetters: response.pollSyncEnvelopes.deadLetters ?? [],
+			hasMore: response.pollSyncEnvelopes.hasMore
+		};
+	}
+	/**
+	* True when the remote rejected the query for naming a field it does not
+	* have. Selecting an unknown field fails validation for the whole query, so
+	* an unhandled one takes the channel's polling down until the process
+	* restarts rather than degrading.
+	*/
+	rejectsDecisionFields(error) {
+		if (!this.peerServesDecisionFields) return false;
+		if (!(error instanceof GraphQLRequestError) || error.category !== "graphql") return false;
+		return DECISION_FIELDS.some((field) => error.message.includes(field));
+	}
+	/**
+	* The poll query. `withDecisionFields` selects the two fields added with the
+	* auth projection; a remote on the previous schema is polled without them.
+	*/
+	pollQuery(withDecisionFields) {
+		return `
       query PollSyncEnvelopes($channelId: String!, $outboxAck: Int!, $outboxLatest: Int!) {
         pollSyncEnvelopes(channelId: $channelId, outboxAck: $outboxAck, outboxLatest: $outboxLatest) {
           envelopes {
@@ -4364,6 +5241,7 @@ var GqlRequestChannel = class {
                 hash
                 skip
                 error
+                ${withDecisionFields ? "deniedReason" : ""}
                 id
                 action {
                   id
@@ -4407,6 +5285,7 @@ var GqlRequestChannel = class {
           deadLetters {
             documentId
             error
+            ${withDecisionFields ? "errorType" : ""}
             jobId
             branch
             scopes
@@ -4416,18 +5295,6 @@ var GqlRequestChannel = class {
         }
       }
     `;
-		const variables = {
-			channelId: this.channelId,
-			outboxAck: ackOrdinal,
-			outboxLatest: latestOrdinal
-		};
-		const response = await this.executeGraphQL(query, variables);
-		return {
-			envelopes: response.pollSyncEnvelopes.envelopes,
-			ackOrdinal: response.pollSyncEnvelopes.ackOrdinal,
-			deadLetters: response.pollSyncEnvelopes.deadLetters ?? [],
-			hasMore: response.pollSyncEnvelopes.hasMore
-		};
 	}
 	/**
 	* Registers or updates this channel on the remote server via GraphQL mutation.
@@ -4546,7 +5413,7 @@ var GqlRequestChannel = class {
 				if (error.statusCode !== void 0 && error.statusCode >= 500) return "recoverable";
 				return "unrecoverable";
 			case "parse": return "recoverable";
-			case "graphql": return "unrecoverable";
+			case "graphql": return isRecoverableGraphQLError(error) ? "recoverable" : "unrecoverable";
 			case "missing-data": return "unrecoverable";
 		}
 	}
@@ -4631,7 +5498,7 @@ var GqlRequestChannel = class {
 			throw new GraphQLRequestError(`Failed to parse GraphQL response: ${error instanceof Error ? error.message : String(error)}`, "parse");
 		}
 		this.logger.verbose("GQL response @channelId @operation status=@status data=@data errors=@errors", this.channelId, operationName, response.status, JSON.stringify(result.data), result.errors ? JSON.stringify(result.errors) : "none");
-		if (result.errors) throw new GraphQLRequestError(`GraphQL errors: ${JSON.stringify(result.errors, null, 2)}`, "graphql");
+		if (result.errors) throw new GraphQLRequestError(`GraphQL errors: ${JSON.stringify(result.errors, null, 2)}`, "graphql", void 0, result.errors.map((error) => error.extensions?.code));
 		if (!result.data) throw new GraphQLRequestError("GraphQL response missing data field", "missing-data");
 		return result.data;
 	}
@@ -4723,6 +5590,10 @@ var GqlRequestChannelFactory = class {
 };
 //#endregion
 //#region src/sync/channels/gql-res-channel.ts
+/** Where a sync operation's run of ordinals begins. */
+function firstOrdinalOf$1(syncOp) {
+	return syncOp.operations.length > 0 ? syncOp.operations[0].context.ordinal : 0;
+}
 /**
 * This class is used server-side to accumulate inbox + outbox operations.
 *
@@ -4738,6 +5609,8 @@ var GqlResponseChannel = class {
 	isShutdown;
 	lastPersistedInboxOrdinal = 0;
 	lastPersistedOutboxOrdinal = 0;
+	evictedOutboxFloor = Number.POSITIVE_INFINITY;
+	appliedOutboxOrdinal = 0;
 	connectionState = "connecting";
 	connectionStateCallbacks = /* @__PURE__ */ new Set();
 	constructor(logger, channelId, remoteName, cursorStorage) {
@@ -4750,18 +5623,11 @@ var GqlResponseChannel = class {
 		this.outbox = new Mailbox();
 		this.deadLetter = new Mailbox();
 		this.outbox.onRemoved((syncOps) => {
-			const maxOrdinal = getLatestAppliedOrdinal(syncOps);
-			if (maxOrdinal > this.lastPersistedOutboxOrdinal) {
-				this.lastPersistedOutboxOrdinal = maxOrdinal;
-				this.cursorStorage.upsert({
-					remoteName: this.remoteName,
-					cursorType: "outbox",
-					cursorOrdinal: maxOrdinal,
-					lastSyncedAtUtcMs: Date.now()
-				}).catch((error) => {
-					this.logger.error("Failed to update outbox cursor for @ChannelId! This means that future application runs may resend duplicate operations. This is recoverable (with deduplication protection), but not-optimal: @Error", this.channelId, error);
-				});
-			}
+			this.rememberUnserved(syncOps);
+			this.persistOutboxCursor(getLatestAppliedOrdinal(syncOps));
+		});
+		this.outbox.onAdded((syncOps) => {
+			this.forgetEvictedBelow(syncOps);
 		});
 		this.inbox.onRemoved((syncOps) => {
 			const maxOrdinal = getLatestAppliedOrdinal(syncOps);
@@ -4803,6 +5669,17 @@ var GqlResponseChannel = class {
 	}
 	/** Response channels are push-driven; resolvers populate mailboxes directly. */
 	triggerPull() {}
+	async init() {
+		const cursors = await this.cursorStorage.list(this.remoteName);
+		const inboxOrdinal = cursors.find((c) => c.cursorType === "inbox")?.cursorOrdinal ?? 0;
+		const outboxOrdinal = cursors.find((c) => c.cursorType === "outbox")?.cursorOrdinal ?? 0;
+		this.inbox.init(inboxOrdinal);
+		this.outbox.init(outboxOrdinal);
+		this.lastPersistedInboxOrdinal = inboxOrdinal;
+		this.lastPersistedOutboxOrdinal = outboxOrdinal;
+		this.appliedOutboxOrdinal = outboxOrdinal;
+		this.transitionConnectionState("connected");
+	}
 	transitionConnectionState(next) {
 		if (this.connectionState === next) return;
 		this.connectionState = next;
@@ -4813,15 +5690,68 @@ var GqlResponseChannel = class {
 			this.logger.error("Connection state change callback error: @Error", error);
 		}
 	}
-	async init() {
-		const cursors = await this.cursorStorage.list(this.remoteName);
-		const inboxOrdinal = cursors.find((c) => c.cursorType === "inbox")?.cursorOrdinal ?? 0;
-		const outboxOrdinal = cursors.find((c) => c.cursorType === "outbox")?.cursorOrdinal ?? 0;
-		this.inbox.init(inboxOrdinal);
-		this.outbox.init(outboxOrdinal);
-		this.lastPersistedInboxOrdinal = inboxOrdinal;
-		this.lastPersistedOutboxOrdinal = outboxOrdinal;
-		this.transitionConnectionState("connected");
+	/**
+	* Records the ordinals of entries that left the outbox without being served,
+	* so the cursor cannot advance past them.
+	*
+	* An entry can leave unserved because a bound evicted it, and an evicted entry
+	* is exactly one this channel intends to re-derive: it is still owed to the
+	* remote. Remembering the floor across the whole run rather than only while
+	* the entry is present is what makes that true after a later ack would
+	* otherwise have swept the cursor past it.
+	*/
+	rememberUnserved(syncOps) {
+		for (const syncOp of syncOps) {
+			if (syncOp.status === SyncOperationStatus.Applied) continue;
+			const first = firstOrdinalOf$1(syncOp);
+			if (first > 0 && first < this.evictedOutboxFloor) this.evictedOutboxFloor = first;
+		}
+	}
+	/**
+	* Persists the outbox cursor, never past an operation this remote has not
+	* been served.
+	*
+	* The cursor is where a restart resumes deriving the outbox from, so an
+	* ordinal persisted past an unserved entry loses that entry for good: the
+	* rebuild starts beyond it and nothing else remembers it was owed. Acks
+	* arrive out of order with respect to what is withheld -- a later entry can
+	* be acknowledged while an earlier one is still being withheld from this
+	* subject -- so the applied high-water mark alone is not a safe cursor.
+	*/
+	persistOutboxCursor(appliedOrdinal) {
+		this.appliedOutboxOrdinal = Math.max(this.appliedOutboxOrdinal, appliedOrdinal);
+		const ordinal = Math.min(this.appliedOutboxOrdinal, this.unservedFloor() - 1);
+		if (ordinal <= this.lastPersistedOutboxOrdinal) return;
+		this.lastPersistedOutboxOrdinal = ordinal;
+		this.cursorStorage.upsert({
+			remoteName: this.remoteName,
+			cursorType: "outbox",
+			cursorOrdinal: ordinal,
+			lastSyncedAtUtcMs: Date.now()
+		}).catch((error) => {
+			this.logger.error("Failed to update outbox cursor for @ChannelId! This means that future application runs may resend duplicate operations. This is recoverable (with deduplication protection), but not-optimal: @Error", this.channelId, error);
+		});
+	}
+	/** Drops the evicted floor once the entries it stood for are queued again. */
+	forgetEvictedBelow(syncOps) {
+		if (this.evictedOutboxFloor === Number.POSITIVE_INFINITY) return;
+		for (const syncOp of syncOps) {
+			const first = firstOrdinalOf$1(syncOp);
+			if (first > 0 && first <= this.evictedOutboxFloor) {
+				this.evictedOutboxFloor = Number.POSITIVE_INFINITY;
+				return;
+			}
+		}
+	}
+	/** The lowest ordinal still owed to this remote, evicted or still queued. */
+	unservedFloor() {
+		let floor = this.evictedOutboxFloor;
+		for (const syncOp of this.outbox.items) {
+			if (syncOp.status === SyncOperationStatus.Applied) continue;
+			const first = firstOrdinalOf$1(syncOp);
+			if (first > 0 && first < floor) floor = first;
+		}
+		return floor;
 	}
 };
 //#endregion
@@ -4909,7 +5839,8 @@ function rowToDeadLetterRecord(row) {
 		branch: row.branch,
 		operations: row.operations,
 		errorSource: row.error_source,
-		errorMessage: row.error_message
+		errorMessage: row.error_message,
+		errorType: row.error_type ?? "UNCLASSIFIED"
 	};
 }
 function deadLetterRecordToRow(record) {
@@ -4923,7 +5854,8 @@ function deadLetterRecordToRow(record) {
 		branch: record.branch,
 		operations: JSON.stringify(record.operations),
 		error_source: record.errorSource,
-		error_message: record.errorMessage
+		error_message: record.errorMessage,
+		error_type: record.errorType
 	};
 }
 /**
@@ -4980,9 +5912,11 @@ var KyselySyncDeadLetterStorage = class {
 	}
 	async listQuarantinedDocumentIds(signal) {
 		if (signal?.aborted) throw new Error("Operation aborted");
-		const rows = await this.db.selectFrom("sync_dead_letters").select("document_id").distinct().execute();
+		const rows = await this.db.selectFrom("sync_dead_letters").select(["document_id", "error_type"]).distinct().execute();
 		if (signal?.aborted) throw new Error("Operation aborted");
-		return rows.map((row) => row.document_id);
+		const quarantined = /* @__PURE__ */ new Set();
+		for (const row of rows) if (quarantinesDocument(row.error_type ?? "UNCLASSIFIED")) quarantined.add(row.document_id);
+		return [...quarantined];
 	}
 };
 //#endregion
@@ -5001,7 +5935,10 @@ function rowToRemoteRecord(row) {
 			scope: row.filter_scopes ?? [],
 			branch: row.filter_branch
 		},
-		options: { sinceTimestampUtcMs: "0" },
+		options: {
+			sinceTimestampUtcMs: "0",
+			boundAddress: row.bound_address ?? void 0
+		},
 		status: {
 			push: {
 				state: row.push_state,
@@ -5041,7 +5978,8 @@ function remoteRecordToRow(remote) {
 		pull_state: remote.status.pull.state,
 		pull_last_success_utc_ms: remote.status.pull.lastSuccessUtcMs ? new Date(remote.status.pull.lastSuccessUtcMs).toISOString() : null,
 		pull_last_failure_utc_ms: remote.status.pull.lastFailureUtcMs ? new Date(remote.status.pull.lastFailureUtcMs).toISOString() : null,
-		pull_failure_count: remote.status.pull.failureCount
+		pull_failure_count: remote.status.pull.failureCount,
+		bound_address: remote.options.boundAddress ?? null
 	};
 }
 var KyselySyncRemoteStorage = class {
@@ -5409,9 +6347,14 @@ var OutboxMode = /* @__PURE__ */ function(OutboxMode) {
 }(OutboxMode || {});
 const defaultSyncManagerConfig = {
 	maxDeadLettersPerRemote: 100,
-	maxInboxBatchSize: 32
+	maxInboxBatchSize: 32,
+	maxHeldOperationsPerRemote: 1e4
 };
 const PLAN_KEY_TO_JOB_UUID_CAP = 1e4;
+/** Where a sync operation's run of ordinals begins. */
+function firstOrdinalOf(syncOp) {
+	return syncOp.operations.length > 0 ? syncOp.operations[0].context.ordinal : 0;
+}
 var SyncManager = class {
 	logger;
 	remoteStorage;
@@ -5435,6 +6378,7 @@ var SyncManager = class {
 	quarantinedDocumentIds = /* @__PURE__ */ new Set();
 	backfillAbortControllers = /* @__PURE__ */ new Map();
 	planKeyToJobUuid = /* @__PURE__ */ new Map();
+	evictedOutboxFloors = /* @__PURE__ */ new Map();
 	lastEnqueuedJobIdByKey = /* @__PURE__ */ new Map();
 	inboxChunkChain = Promise.resolve();
 	constructor(logger, remoteStorage, cursorStorage, deadLetterStorage, channelFactory, operationIndex, reactor, eventBus, driveContainerTypes, config = {}) {
@@ -5542,6 +6486,28 @@ var SyncManager = class {
 		for (const remote of this.remotes.values()) if (remote.meta.id === id) return remote;
 		throw new Error(`Remote with id '${id}' does not exist`);
 	}
+	async bindRemote(id, boundAddress) {
+		const remote = this.getById(id);
+		const bound = remote.meta.options.boundAddress;
+		if (bound === boundAddress) return;
+		if (bound !== void 0) throw new Error(`Remote with id '${id}' is already bound to another address`);
+		remote.meta.options = {
+			...remote.meta.options,
+			boundAddress
+		};
+		await this.remoteStorage.upsert({
+			id: remote.meta.id,
+			name: remote.meta.name,
+			collectionId: remote.meta.collectionId,
+			channelConfig: remote.meta.channelConfig,
+			filter: remote.meta.filter,
+			options: remote.meta.options,
+			status: {
+				push: createIdleHealth(),
+				pull: createIdleHealth()
+			}
+		});
+	}
 	async add(name, collectionId, channelConfig, filter = {
 		documentId: [],
 		scope: [],
@@ -5655,7 +6621,8 @@ var SyncManager = class {
 		remote.channel.deadLetter.onAdded((syncOps) => {
 			for (const syncOp of syncOps) {
 				this.logger.error("Dead letter (@remote, @documentId, @jobId, @error, @dependencies)", remote.meta.name, syncOp.documentId, syncOp.jobId, syncOp.error?.message ?? "unknown", syncOp.jobDependencies);
-				this.quarantinedDocumentIds.add(syncOp.documentId);
+				const errorType = syncOperationErrorType(syncOp.error);
+				if (quarantinesDocument(errorType)) this.quarantinedDocumentIds.add(syncOp.documentId);
 				const record = {
 					id: syncOp.id,
 					jobId: syncOp.jobId,
@@ -5666,7 +6633,8 @@ var SyncManager = class {
 					branch: syncOp.branch,
 					operations: syncOp.operations,
 					errorSource: syncOp.error?.source ?? ChannelErrorSource.None,
-					errorMessage: syncOp.error?.error.message ?? "unknown"
+					errorMessage: syncOp.error?.error.message ?? "unknown",
+					errorType
 				};
 				this.deadLetterStorage.add(record).catch((err) => {
 					this.logger.error("Failed to persist dead letter (@id, @error)", record.id, err instanceof Error ? err.message : String(err));
@@ -5676,7 +6644,8 @@ var SyncManager = class {
 					jobId: record.jobId,
 					remoteName: record.remoteName,
 					documentId: record.documentId,
-					errorSource: record.errorSource
+					errorSource: record.errorSource,
+					errorType: record.errorType
 				}).catch(() => {});
 			}
 			const items = remote.channel.deadLetter.items;
@@ -5703,7 +6672,7 @@ var SyncManager = class {
 		const syncOps = [];
 		for (const record of records) {
 			const syncOp = new SyncOperation(record.id, record.jobId, record.jobDependencies, record.remoteName, record.documentId, record.scopes, record.branch, record.operations);
-			syncOp.failed(new ChannelError(record.errorSource, new Error(record.errorMessage)));
+			syncOp.failed(new ChannelError(record.errorSource, new Error(record.errorMessage), record.errorType));
 			syncOps.push(syncOp);
 		}
 		remote.channel.deadLetter.add(...syncOps);
@@ -5784,8 +6753,7 @@ var SyncManager = class {
 		if (completedJobInfo.status === JobStatus.FAILED) {
 			const errorMessage = completedJobInfo.error?.message || "Unknown error";
 			this.logger.error("Failed to apply operations from inbox (@remote, @documentId, @jobId, @error)", remote.meta.name, syncOp.documentId, completedJobInfo.id, errorMessage);
-			const error = new ChannelError(ChannelErrorSource.Inbox, /* @__PURE__ */ new Error(`Failed to apply operations: ${errorMessage}`));
-			syncOp.failed(error);
+			syncOp.failed(this.inboxFailure(completedJobInfo.error));
 			remote.channel.deadLetter.add(syncOp);
 		} else syncOp.executed();
 		remote.channel.inbox.remove(syncOp);
@@ -5862,17 +6830,79 @@ var SyncManager = class {
 			}
 			if (this.isShutdown) return;
 			if (completedJobInfo.status === JobStatus.FAILED) {
-				const errorMessage = completedJobInfo.error?.message || "Unknown error";
-				const channelError = new ChannelError(ChannelErrorSource.Inbox, /* @__PURE__ */ new Error(`Failed to apply operations: ${errorMessage}`));
-				syncOp.failed(channelError);
+				syncOp.failed(this.inboxFailure(completedJobInfo.error));
 				remote.channel.deadLetter.add(syncOp);
 			} else syncOp.executed();
 			remote.channel.inbox.remove(syncOp);
 		}
 	}
+	/**
+	* The dead letter for a load job the executor failed.
+	*
+	* The classification is passed explicitly because it cannot be recovered
+	* downstream: the wrapper carries the failure's message, not the failure, so
+	* deriving it from the wrapper's own name would classify every one of these
+	* as unclassified and quarantine the document. A held auth operation must
+	* keep syncing, because reconciling the two policies needs the traffic a
+	* quarantine would stop.
+	*/
+	inboxFailure(error) {
+		const message = error?.message || "Unknown error";
+		return new ChannelError(ChannelErrorSource.Inbox, /* @__PURE__ */ new Error(`Failed to apply operations: ${message}`), classifyJobFailure(error?.name ?? "Error"));
+	}
+	/**
+	* Where the next outbox derivation starts: at the evicted floor when there is
+	* room to take those entries back, and at the caller's cursor otherwise.
+	*
+	* The floor is forgotten as it is folded in. If the refill overflows again the
+	* eviction records a new one, and if it does not, the entries are queued and
+	* the outbox itself holds the cursor down.
+	*/
+	refillOrdinal(remote, ackOrdinal) {
+		const floor = this.evictedOutboxFloors.get(remote.meta.name);
+		if (floor === void 0) return ackOrdinal;
+		if (this.outboxOperationCount(remote) >= this.config.maxHeldOperationsPerRemote) return ackOrdinal;
+		this.evictedOutboxFloors.delete(remote.meta.name);
+		return Math.min(ackOrdinal, floor - 1);
+	}
+	/**
+	* Evicts the newest entries of an outbox that has grown past its bound.
+	*
+	* Only entries that have never been taken up for transport are eligible, which
+	* is what makes this a bound on withheld work rather than a way to drop
+	* something already in flight. One entry is always kept, so an outbox whose
+	* first entry is larger than the whole cap still makes progress.
+	*/
+	evictPastOutboxBound(remote) {
+		const cap = this.config.maxHeldOperationsPerRemote;
+		const queued = remote.channel.outbox.items.filter((syncOp) => syncOp.status === SyncOperationStatus.Unknown).sort((a, b) => firstOrdinalOf(a) - firstOrdinalOf(b));
+		let kept = 0;
+		let cut = queued.length;
+		for (let i = 0; i < queued.length; i++) {
+			const size = queued[i].operations.length;
+			if (i > 0 && kept + size > cap) {
+				cut = i;
+				break;
+			}
+			kept += size;
+		}
+		const evicted = queued.slice(cut);
+		if (evicted.length === 0) return;
+		const floor = firstOrdinalOf(evicted[0]);
+		const known = this.evictedOutboxFloors.get(remote.meta.name);
+		this.evictedOutboxFloors.set(remote.meta.name, known === void 0 ? floor : Math.min(known, floor));
+		this.logger.warn("Outbox for @RemoteName is past its bound of @Cap operations; evicting @Count entries from ordinal @Floor, to be derived again once it drains", remote.meta.name, cap, evicted.length, floor);
+		remote.channel.outbox.remove(...evicted);
+	}
+	outboxOperationCount(remote) {
+		let count = 0;
+		for (const syncOp of remote.channel.outbox.items) count += syncOp.operations.length;
+		return count;
+	}
 	async updateOutbox(remote, ackOrdinal, mode = OutboxMode.Backfill, signal) {
 		const composedSignal = signal ? AbortSignal.any([signal, this.abortController.signal]) : this.abortController.signal;
-		let maxOrdinal = ackOrdinal;
+		const startOrdinal = this.refillOrdinal(remote, ackOrdinal);
+		let maxOrdinal = startOrdinal;
 		const lastJobByDoc = /* @__PURE__ */ new Map();
 		let prevChainJobId;
 		const sinceTimestamp = remote.meta.options.sinceTimestampUtcMs;
@@ -5892,8 +6922,9 @@ var SyncManager = class {
 				if (mode === OutboxMode.BatchTriggered) prevChainJobId = jobId;
 			}
 			remote.channel.outbox.add(...syncOps);
+			this.evictPastOutboxBound(remote);
 		};
-		let page = await this.operationIndex.find(remote.meta.collectionId.key, ackOrdinal, { excludeSourceRemote: remote.meta.name }, void 0, composedSignal);
+		let page = await this.operationIndex.find(remote.meta.collectionId.key, startOrdinal, { excludeSourceRemote: remote.meta.name }, void 0, composedSignal);
 		let carry = [];
 		let hasMore;
 		do {
@@ -5909,9 +6940,17 @@ var SyncManager = class {
 			operations = operations.filter((op) => !this.quarantinedDocumentIds.has(op.context.documentId));
 			hasMore = !!page.next;
 			if (operations.length > 0) {
+				const created = /* @__PURE__ */ new Set();
+				for (const entry of operations) if (entry.operation.action.type === "CREATE_DOCUMENT") created.add(entry.context.documentId);
 				operations.sort((a, b) => {
 					if (a.context.documentId !== b.context.documentId) return a.context.documentId < b.context.documentId ? -1 : 1;
-					if (a.context.scope !== b.context.scope) return a.context.scope < b.context.scope ? -1 : 1;
+					if (a.context.scope !== b.context.scope) {
+						if (created.has(a.context.documentId)) {
+							if (a.context.scope === "document") return -1;
+							if (b.context.scope === "document") return 1;
+						}
+						return a.context.scope < b.context.scope ? -1 : 1;
+					}
 					return a.context.ordinal - b.context.ordinal;
 				});
 				if (hasMore) {
@@ -5958,6 +6997,10 @@ var SyncBuilder = class {
 		this.config.maxInboxBatchSize = limit;
 		return this;
 	}
+	withMaxHeldOperationsPerRemote(limit) {
+		this.config.maxHeldOperationsPerRemote = limit;
+		return this;
+	}
 	build(reactor, logger, operationIndex, eventBus, db, driveContainerTypes) {
 		return this.buildModule(reactor, logger, operationIndex, eventBus, db, driveContainerTypes).syncManager;
 	}
@@ -6190,7 +7233,7 @@ var Reactor = class {
 			documentId: document.header.id,
 			model: document.header.documentType,
 			fromVersion: 0,
-			toVersion: document.state.document.version,
+			toVersion: normalizeDocumentModelVersion(document.state.document?.version),
 			initialState: document.state
 		})];
 		if (signer) actions = await signActions(actions, signer, signal);
@@ -6572,7 +7615,10 @@ var ReactorBuilder = class {
 	logger;
 	documentModelSources = [];
 	upgradeManifests = [];
-	features = { legacyStorageEnabled: false };
+	features = {
+		legacyStorageEnabled: false,
+		legacyProcessorIds: true
+	};
 	readModels = [];
 	readModelFactories = [];
 	executorManager;
@@ -6769,6 +7815,18 @@ var ReactorBuilder = class {
 	}
 	async buildModule() {
 		if (!this.logger) this.logger = new ConsoleLogger(["reactor"]);
+		const featureFlags = resolveFeatureFlags(this.executorConfig.featureFlags);
+		if (this.projectionShardConfig !== void 0 && this.readModelFactories.length > 0) throw new Error("withProjectionShards does not support read models registered through withReadModelFactory; projection workers cannot receive host-only factory dependencies");
+		if (this.projectionShardConfig !== void 0 && this.readModels.length > 0) throw new Error("withProjectionShards does not support read models registered through withReadModel; projection workers build their own read models from the shard config and would silently omit these");
+		if (this.projectionShardConfig !== void 0) {
+			const named = [...this.projectionShardConfig.preReadyKinds, ...this.projectionShardConfig.postReadyKinds];
+			const missing = BUILT_IN_READ_MODEL_KINDS.filter((kind) => !named.includes(kind));
+			const duplicated = BUILT_IN_READ_MODEL_KINDS.filter((kind) => named.filter((entry) => entry === kind).length > 1);
+			if (missing.length > 0 || duplicated.length > 0) {
+				const problems = [missing.length > 0 ? `never named: ${missing.join(", ")} (would be indexed by no shard, leaving those reads permanently stale and their consistency-token waits unresolvable)` : void 0, duplicated.length > 0 ? `named more than once: ${duplicated.join(", ")} (would be indexed twice per operation)` : void 0].filter((problem) => problem !== void 0);
+				throw new Error(`withProjectionShards requires preReadyKinds and postReadyKinds to name each built-in read model (${BUILT_IN_READ_MODEL_KINDS.join(", ")}) exactly once between them; ${problems.join("; ")}`);
+			}
+		}
 		const resolvedSources = await resolveModelSources(this.documentModelSources);
 		if (this.workerPool) {
 			if (resolvedSources.manifest.length === 0) throw new Error("withWorkerPool requires at least one worker-importable document-model source ({ filePath } or { packageName }).");
@@ -6818,15 +7876,15 @@ var ReactorBuilder = class {
 				if (pool.db === void 0) throw new Error("unreachable: worker pool configured without db or factory");
 				factory = await this.createDefaultWorkerFactory(pool.numWorkers, pool.db, pool.verifier);
 			}
-			const poolManager = new WorkerPoolJobExecutorManager(factory, eventBus, queue, jobTracker, this.logger, resolver, collectionMembershipCache, this.executorConfig.jobTimeoutMs);
+			const poolManager = new WorkerPoolJobExecutorManager(factory, eventBus, queue, jobTracker, this.logger, resolver, operationIndex, this.executorConfig.jobTimeoutMs, this.executorConfig.deferredJobTtlMs);
 			executorManager = poolManager;
 			executorStartCount = pool.numWorkers;
 			if (resolver instanceof DocumentModelResolver) resolver.setBroadcastHook((entry) => poolManager.loadModel(entry));
-		} else executorManager = new SimpleJobExecutorManager(() => new SimpleJobExecutor(this.logger, documentModelRegistry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, this.driveContainerTypes, this.executorConfig, this.signatureVerifier, executionScope), eventBus, queue, jobTracker, this.logger, resolver, this.executorConfig.jobTimeoutMs);
+		} else executorManager = new SimpleJobExecutorManager(() => new SimpleJobExecutor(this.logger, documentModelRegistry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, this.driveContainerTypes, this.executorConfig, this.signatureVerifier, executionScope), eventBus, queue, jobTracker, this.logger, resolver, this.executorConfig.jobTimeoutMs, this.executorConfig.deferredJobTtlMs);
 		await executorManager.start(executorStartCount);
 		const readModelInstances = Array.from(new Set([...this.readModels]));
 		const documentViewConsistencyTracker = new ConsistencyTracker();
-		const documentView = new KyselyDocumentView(database, operationStore, operationIndex, writeCache, documentViewConsistencyTracker);
+		const documentView = new KyselyDocumentView(database, operationStore, operationIndex, writeCache, documentViewConsistencyTracker, featureFlags.documentDecisions);
 		try {
 			await documentView.init();
 		} catch (error) {
@@ -6844,7 +7902,7 @@ var ReactorBuilder = class {
 		const subscriptionManager = new ReactorSubscriptionManager(new DefaultSubscriptionErrorHandler());
 		const subscriptionNotificationReadModel = new SubscriptionNotificationReadModel(subscriptionManager, documentView);
 		const processorManagerConsistencyTracker = new ConsistencyTracker();
-		const processorManager = new ProcessorManager(database, operationIndex, writeCache, processorManagerConsistencyTracker, this.logger, this.driveContainerTypes);
+		const processorManager = new ProcessorManager(database, operationIndex, writeCache, processorManagerConsistencyTracker, this.logger, this.driveContainerTypes, { legacyProcessorIds: this.features.legacyProcessorIds !== false });
 		try {
 			await processorManager.init();
 		} catch (error) {
@@ -6852,13 +7910,17 @@ var ReactorBuilder = class {
 		}
 		for (const factory of this.readModelFactories) {
 			const readModel = await factory({
+				documentModelRegistry,
 				operationIndex,
 				writeCache,
 				processorManagerConsistencyTracker
 			});
 			readModelInstances.push(readModel);
 		}
-		const readModelCoordinator = this.readModelCoordinator ? this.readModelCoordinator : this.projectionShardConfig ? await this.createProjectionShardManager(this.projectionShardConfig, eventBus) : new ReadModelCoordinator(eventBus, readModelInstances, [subscriptionNotificationReadModel, processorManager]);
+		const readModelCoordinator = this.readModelCoordinator ? this.readModelCoordinator : this.projectionShardConfig ? await this.createProjectionShardManager(this.projectionShardConfig, eventBus, {
+			"document-view": documentViewConsistencyTracker,
+			"document-indexer": documentIndexerConsistencyTracker
+		}) : new ReadModelCoordinator(eventBus, readModelInstances, [subscriptionNotificationReadModel, processorManager]);
 		const reactor = new Reactor(this.logger, documentModelRegistry, queue, jobTracker, readModelCoordinator, this.features, documentView, documentIndexer, operationStore, eventBus, executorManager);
 		let syncModule = void 0;
 		if (this.channelScheme) {
@@ -6869,9 +7931,15 @@ var ReactorBuilder = class {
 			syncModule = this.syncBuilder.buildModule(reactor, this.logger, operationIndex, eventBus, database, this.driveContainerTypes);
 			await syncModule.syncManager.startup();
 		}
+		let groupReevaluationTrigger;
+		if (featureFlags.authGroups) {
+			groupReevaluationTrigger = new GroupReevaluationTrigger(this.logger, eventBus, queue, operationIndex);
+			groupReevaluationTrigger.startup();
+		}
 		const module = {
 			eventBus,
 			documentModelRegistry,
+			featureFlags,
 			queue,
 			jobTracker,
 			executorManager,
@@ -6890,6 +7958,7 @@ var ReactorBuilder = class {
 			processorManagerConsistencyTracker,
 			syncModule,
 			reactor,
+			groupReevaluationTrigger,
 			pools: this.instrumentedPools
 		};
 		if (this.signalHandlersEnabled) this.attachSignalHandlers(module);
@@ -6914,8 +7983,14 @@ var ReactorBuilder = class {
 	* injected via {@link withProjectionWorkerFactory}. Calls
 	* `manager.startup()` so all N workers reach READY before the reactor
 	* is returned to the caller.
+	*
+	* @param consistencyTrackers The host's trackers for the built-in read
+	*   models, keyed by kind. Under sharding the host's own copies of those
+	*   models never index an operation, so the manager advances these from the
+	*   shards' relayed indexing reports; without them every read carrying a
+	*   consistency token waits forever.
 	*/
-	async createProjectionShardManager(config, eventBus) {
+	async createProjectionShardManager(config, eventBus, consistencyTrackers) {
 		const baseDb = this.resolveReactorDbConfig();
 		if (!baseDb) throw new Error("withProjectionShards requires a db (or an executor worker pool configured with one); projection workers need connection info to open their own pools.");
 		const models = this.resolvedModelManifest ?? [];
@@ -6931,7 +8006,7 @@ var ReactorBuilder = class {
 			poolInstrumentations.push(forwarder);
 			this.instrumentedPools.push(forwarder);
 		}
-		const { ProjectionShardManager } = await import("./projection-shard-manager-BnQKFqQd.js");
+		const { ProjectionShardManager } = await import("./projection-shard-manager-D6KYcEZi.js");
 		const manager = new ProjectionShardManager({
 			shardCount: config.shardCount,
 			db,
@@ -6945,7 +8020,8 @@ var ReactorBuilder = class {
 			shutdownGraceMs: config.shutdownGraceMs,
 			drainTimeoutMs: config.drainTimeoutMs,
 			chainDepthReportIntervalMs: config.chainDepthReportIntervalMs,
-			poolInstrumentations
+			poolInstrumentations,
+			consistencyTrackers
 		});
 		await manager.startup();
 		this.shutdownHooks.push(() => manager.shutdown());
@@ -6962,9 +8038,9 @@ var ReactorBuilder = class {
 	*/
 	async createDefaultWorkerFactory(numWorkers, db, signatureVerifier) {
 		const [{ WorkerHandle }, { createThreadTransport }, { workerEntryPath }] = await Promise.all([
-			import("./worker-handle-B1w03nRA.js"),
+			import("./worker-handle-CrERzl8s.js"),
 			import("./transport-ByGviWdZ.js"),
-			import("./worker-DBJOv8Gp.js").then((n) => n.n)
+			import("./worker-HPysBfhx.js").then((n) => n.n)
 		]);
 		const poolConfig = {
 			enabled: true,
@@ -6985,7 +8061,8 @@ var ReactorBuilder = class {
 					poolConfig,
 					db,
 					signatureVerifier,
-					models
+					models,
+					executorConfig: this.executorConfig
 				},
 				logger,
 				poolInstrumentation
@@ -7106,6 +8183,7 @@ var ReactorClientBuilder = class {
 	subscriptionManager;
 	jobAwaiter;
 	documentModelLoader;
+	readGate;
 	/**
 	* Sets the logger for the ReactorClient.
 	* @param logger - The logger to use.
@@ -7158,6 +8236,47 @@ var ReactorClientBuilder = class {
 		this.documentModelLoader = loader;
 		return this;
 	}
+	/**
+	* Overrides how reads are gated. A client built from a ReactorBuilder derives
+	* this from that reactor's flags; one built from `withReactor` cannot, because
+	* it is handed no flags and no registry, so it gates on the policy alone
+	* unless a gate is supplied here.
+	*/
+	withReadGate(readGate) {
+		this.readGate = readGate;
+		return this;
+	}
+	/**
+	* The gate the resolved model calls for. Below authEnforcement there is no
+	* model to enforce -- the registered one ignores the auth scope -- so the
+	* policy is evaluated on its own, which is what reads did before the model
+	* existed. Group serving turns on with authGroups, because below it a
+	* `{ group }` grant does not match, so a served roster is one no grant can
+	* use.
+	*/
+	resolveReadGate(reactorModule, documentView, model) {
+		if (!reactorModule || model === void 0) return new BareReadGate();
+		return new ModelReadGate(model, documentView, reactorModule.featureFlags.authGroups, reactorModule.operationIndex, this.logger);
+	}
+	/**
+	* What the client answers an authorization preflight from, or undefined when
+	* it answers none.
+	*
+	* Resolved from the same model reads enforce, so a preflight and a read can
+	* never decide against different models. Undefined below authEnforcement, and
+	* undefined on the `withReactor` path, where there are no flags and no
+	* registry to select a model with -- a client with no model refuses the
+	* preflight rather than answering it from the legacy host-side permission
+	* tables. Deliberately not derived from the read gate: `withReadGate`
+	* overrides that, so sniffing the gate's type would report enforcement from a
+	* caller's substitution.
+	*/
+	resolveActionEvaluation(reactorModule, model) {
+		return reactorModule && model ? {
+			model,
+			flags: reactorModule.featureFlags
+		} : void 0;
+	}
 	async build() {
 		return (await this.buildModule()).client;
 	}
@@ -7186,8 +8305,9 @@ var ReactorClientBuilder = class {
 		const signer = this.signer ?? new PassthroughSigner();
 		const subscriptionManager = this.subscriptionManager ?? reactorModule?.subscriptionManager ?? new ReactorSubscriptionManager(new DefaultSubscriptionErrorHandler());
 		const jobAwaiter = this.jobAwaiter ?? new JobAwaiter(eventBus, (jobId, signal) => reactor.getJobStatus(jobId, signal));
+		const decisionModel = reactorModule ? readDecisionModel(reactorModule.featureFlags, reactorModule.documentModelRegistry) : void 0;
 		return {
-			client: new ReactorClient(this.logger, reactor, signer, subscriptionManager, jobAwaiter, documentIndexer, documentView),
+			client: new ReactorClient(this.logger, reactor, signer, subscriptionManager, jobAwaiter, documentIndexer, documentView, this.readGate ?? this.resolveReadGate(reactorModule, documentView, decisionModel), this.resolveActionEvaluation(reactorModule, decisionModel)),
 			reactor,
 			eventBus,
 			documentIndexer,
@@ -7225,6 +8345,107 @@ function driveIdFromUrl(url) {
 	return url.split("/").pop() ?? "";
 }
 //#endregion
+//#region src/decision/sync-scope-gate.ts
+/** What a subject may read of a document that is not there to be read. */
+const META_ONLY = (scope) => ALWAYS_READABLE_SCOPES.has(scope);
+/**
+* A read gate asked by document id rather than by document.
+*
+* Serving works from an id: an outbox entry names a document, a branch and a
+* scope, and carries no state. Fetching the document is therefore the serving
+* path's own job, and it is the only thing this adds to the gate it wraps.
+*/
+var SyncScopeGate = class {
+	constructor(gate, documentView, logger) {
+		this.gate = gate;
+		this.documentView = documentView;
+		this.logger = logger;
+	}
+	/**
+	* Which scopes of one document the subject may be served.
+	*
+	* A document this replica cannot produce yields the metadata scopes and
+	* nothing else. That is the fail-closed direction, and it is safe to fail
+	* closed here precisely because serving withholds rather than consumes: the
+	* entry stays in the outbox and the next poll asks again, so a document that
+	* is merely not indexed yet is delayed rather than lost.
+	*
+	* Any other failure is rethrown. A read side that is down must not read as a
+	* silent, universal denial, because a denial that looks like a policy is one
+	* nobody investigates.
+	*/
+	async scopePredicateById(documentId, subject, branch, signal) {
+		let document;
+		try {
+			document = await this.documentView.get(documentId, { branch }, void 0, signal);
+		} catch (error) {
+			if (!DocumentNotFoundError.isError(error)) throw error;
+			this.logger?.verbose(`Withholding ${documentId} on branch ${branch}: the read side does not hold it`);
+			return META_ONLY;
+		}
+		return this.gate.scopePredicate(document, subject, branch, signal);
+	}
+};
+//#endregion
+//#region src/decision/stream-order.ts
+/**
+* The first pair of effective operations whose stored order contradicts their
+* timestamps, or undefined when the stream is in position order.
+*
+* Such a stream cannot be walked, and the auth stream is never reshuffled once
+* the monotonic rule is on, so run this before enabling enforcement on a fleet.
+*
+* `requireStrict` additionally rejects a tie, which is what the auth stream's
+* monotonic rule requires and what the walk alone does not care about.
+*/
+function firstOutOfOrderPair(operations, options) {
+	const requireStrict = options?.requireStrict ?? false;
+	const effective = garbageCollect(sortOperations([...operations]));
+	for (let i = 1; i < effective.length; i++) {
+		const previous = effective[i - 1];
+		const current = effective[i];
+		const previousAt = Date.parse(previous.timestampUtcMs);
+		const currentAt = Date.parse(current.timestampUtcMs);
+		if (currentAt < previousAt) return {
+			previous,
+			current,
+			kind: "descending"
+		};
+		if (requireStrict && currentAt === previousAt) return {
+			previous,
+			current,
+			kind: "tied"
+		};
+	}
+}
+//#endregion
+//#region src/read-models/interfaces.ts
+function supportsLiveReadModelRegistration(coordinator) {
+	return "addReadModel" in coordinator && typeof coordinator.addReadModel === "function";
+}
+//#endregion
+//#region src/processors/host-module.ts
+/** Builds the reactor-level host module; hosts spread it and add their own fields. */
+function createReactorHostModuleBase(options) {
+	const { client, readModels, ...core } = options;
+	return {
+		...core,
+		client,
+		dispatch: { async execute(docId, branch, actions, signal) {
+			const jobInfo = await client.executeAsync(docId, branch, actions, signal);
+			return {
+				id: jobInfo.id,
+				status: jobInfo.status
+			};
+		} },
+		getReadModel(name) {
+			const model = readModels.find((m) => m.name === name);
+			if (!model) throw new Error(`Read model "${name}" not found`);
+			return model;
+		}
+	};
+}
+//#endregion
 //#region src/admin/passthrough-keyframe-store.ts
 const passthroughKeyframeStore = {
 	putKeyframe: () => Promise.resolve(),
@@ -7250,6 +8471,7 @@ var DocumentIntegrityService = class {
 	async validateDocument(documentId, branch = "main", signal) {
 		const keyframeIssues = [];
 		const snapshotIssues = [];
+		const streamOrderIssues = await this.findStreamOrderIssues(documentId, branch, signal);
 		const replayCache = new KyselyWriteCache(passthroughKeyframeStore, this.operationStore, this.documentModelRegistry, {
 			maxDocuments: 1,
 			ringBufferSize: 1,
@@ -7276,9 +8498,10 @@ var DocumentIntegrityService = class {
 		} catch {
 			return {
 				documentId,
-				isConsistent: keyframeIssues.length === 0,
+				isConsistent: keyframeIssues.length === 0 && streamOrderIssues.length === 0,
 				keyframeIssues,
-				snapshotIssues
+				snapshotIssues,
+				streamOrderIssues
 			};
 		}
 		const revisions = await this.operationStore.getRevisions(documentId, branch, signal);
@@ -7304,9 +8527,10 @@ var DocumentIntegrityService = class {
 		}
 		return {
 			documentId,
-			isConsistent: keyframeIssues.length === 0 && snapshotIssues.length === 0,
+			isConsistent: keyframeIssues.length === 0 && snapshotIssues.length === 0 && streamOrderIssues.length === 0,
 			keyframeIssues,
-			snapshotIssues
+			snapshotIssues,
+			streamOrderIssues
 		};
 	}
 	async rebuildKeyframes(documentId, branch = "main", signal) {
@@ -7328,12 +8552,26 @@ var DocumentIntegrityService = class {
 			scopesInvalidated: scopes.length
 		};
 	}
+	async findStreamOrderIssues(documentId, branch, signal) {
+		const scopes = await this.discoverScopes(documentId, branch, signal);
+		const issues = [];
+		for (const scope of scopes) {
+			throwIfAborted(signal);
+			const pair = firstOutOfOrderPair((await this.operationStore.getSince(documentId, scope, branch, -1, void 0, void 0, signal)).results, { requireStrict: scope === "auth" });
+			if (pair !== void 0) issues.push({
+				scope,
+				branch,
+				...pair
+			});
+		}
+		return issues;
+	}
 	async discoverScopes(documentId, branch, signal) {
 		const revisions = await this.operationStore.getRevisions(documentId, branch, signal);
 		return Object.keys(revisions.revision);
 	}
 };
 //#endregion
-export { BaseReadModel, ChannelError, ChannelErrorSource, ChannelScheme, ConsistencyTracker, DEFAULT_DRIVE_CONTAINER_TYPES, DRIVE_AUTH_ERROR_MESSAGES, DefaultSubscriptionErrorHandler, DocumentChangeType, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, DriveClient, DriveCollectionId, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, IntervalPollTimer, InvalidModuleError, JobAwaiter, JobExecutorEventTypes, JobStatus, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, Mailbox, ModuleNotFoundError, NullDocumentModelResolver, OptimisticLockError, PollBehavior, PollingChannelError, ProcessorManager, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, ReactorEventTypes, ReactorSubscriptionManager, ReadModelCoordinator, RelationalDbProcessor, RelationshipChangeType, RevisionMismatchError, SimpleJobExecutorManager, SyncBuilder, SyncEventTypes, SyncOperation, SyncOperationAggregateError, SyncOperationStatus, SyncStatus, SyncStatusTracker, addRelationshipAction, batchOperationsByDocument, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createMutableShutdownStatus, createRelationalDb, deleteDocumentAction, documentActions, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, getMigrationStatus, instrumentPgPool, isDriveAuthError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, removeRelationshipAction, runMigrations, sanitizeArg, trimMailboxFromAckOrdinal, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
+export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, AppendConditionFailedError, AuthEnforcementDisabledError, BareReadGate, BaseReadModel, ChannelError, ChannelErrorSource, ChannelScheme, ConsistencyTracker, DEFAULT_DRIVE_CONTAINER_TYPES, DOCUMENT_INDEXER_READ_MODEL, DOCUMENT_VIEW_READ_MODEL, DRIVE_AUTH_ERROR_MESSAGES, DefaultSubscriptionErrorHandler, DocumentAlreadyExistsError, DocumentChangeType, DocumentExistence, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, DriveClient, DriveCollectionId, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, IntervalPollTimer, InvalidModuleError, JobAwaiter, JobExecutorEventTypes, JobStatus, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, Mailbox, ModelReadGate, ModuleNotFoundError, NullDocumentModelResolver, OptimisticLockError, PollBehavior, PollingChannelError, ProcessorManager, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, RECOVERABLE_GRAPHQL_ERROR_CODES, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, ReactorEventTypes, ReactorSubscriptionManager, ReadModelCoordinator, RelationalDbProcessor, RelationshipChangeType, RetryAccounting, RevisionMismatchError, SeededStateReader, SimpleJobExecutorManager, SyncBuilder, SyncEventTypes, SyncOperation, SyncOperationAggregateError, SyncOperationStatus, SyncScopeGate, SyncStatus, SyncStatusTracker, addRelationshipAction, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createMutableShutdownStatus, createReactorHostModuleBase, createRelationalDb, decideAtHead, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isDriveAuthError, isRecoverableGraphQLError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, quarantinesDocument, readDecisionModel, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, supportsLiveReadModelRegistration, syncOperationErrorType, trimMailboxFromAckOrdinal, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
 
 //# sourceMappingURL=index.js.map