@powerhousedao/reactor 6.2.3-dev.3 → 6.2.3-dev.30

package/dist/{drive-container-types-yZrksiJR.js → forwarding-logger-CnuVDVze.js}

@@ -1,5 +1,4 @@
-import { n as ReactorEventTypes, t as EventBusAggregateError } from "./types-DMKLa0Ok.js";
-import { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, DOCUMENT_DELETED_REASON, DowngradeNotSupportedError as DowngradeNotSupportedError$1, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, baseReducerVersion, createPresignedHeader, decide, defaultBaseState, deriveOperationId, evaluate, garbageCollect, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, isDenied, isUndoRedo, mentionedGroupIds, normalizeDocumentModelVersion, referencedGroupIds, sortOperations } from "@powerhousedao/shared/document-model";
+import { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, DOCUMENT_DELETED_REASON, DOCUMENT_SCOPE_ACTION_TYPES, DowngradeNotSupportedError as DowngradeNotSupportedError$1, actionSignerIdentity, actionSigningTarget, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, base58Decode, baseReducerVersion, buildOperationSignatureMessage, buildOperationSignatureParams, canonicalJson, createPresignedHeader, decide, defaultBaseState, deriveDocumentId, deriveOperationId, evaluate, garbageCollect, groupDocumentType, groupMembershipActionTypes, hashActionV2, hashBrowser, hashDocumentStateForScope, isDenied, isDerivedDocumentId, isUndoRedo, isV2ActionHash, mentionedGroupIds, normalizeDocumentModelVersion, operationOutcome, referencedGroupIds, signaturePolicyOf, sortOperations, targetDocumentId, v2TupleProblem, withProtocolVersions } from "@powerhousedao/shared/document-model";
 import { v4 } from "uuid";
 import { Migrator, sql } from "kysely";
 //#region \0rolldown/runtime.js
@@ -52,6 +51,37 @@ function parsePagingOptions(paging, defaultLimit) {
 	};
 }
 //#endregion
+//#region src/events/types.ts
+/**
+* Custom error class that aggregates multiple errors from event subscribers.
+*/
+var EventBusAggregateError = class extends Error {
+	errors;
+	constructor(errors) {
+		const message = `EventBus emit failed with ${errors.length} error(s): ${errors.map((e) => {
+			if (e && typeof e === "object" && "message" in e) return e.message;
+			return String(e);
+		}).join("; ")}`;
+		super(message);
+		this.name = "EventBusAggregateError";
+		this.errors = errors;
+	}
+};
+/**
+* Event types for reactor lifecycle events.
+*/
+const ReactorEventTypes = {
+	JOB_PENDING: 10001,
+	JOB_RUNNING: 10002,
+	JOB_WRITE_READY: 10003,
+	JOB_READ_READY: 10004,
+	JOB_FAILED: 10005,
+	READMODEL_BATCH_COMPLETED: 10006,
+	READMODEL_INDEXED: 10007,
+	MODEL_LOADED: 10008,
+	SIGNATURE_REFUSED: 10009
+};
+//#endregion
 //#region src/shared/errors.ts
 /**
 * Error thrown when attempting to access a deleted document.
@@ -167,19 +197,22 @@ var ExcessiveReshuffleError = class ExcessiveReshuffleError extends Error {
 		return Error.isError(error) && error.name === "ExcessiveReshuffleError";
 	}
 };
-/**
-* Error thrown when an operation has an invalid signature.
-*/
+/** The message carries the code: only name and message cross the queue. */
 var InvalidSignatureError = class InvalidSignatureError extends Error {
 	documentId;
+	code;
 	reason;
-	constructor(documentId, reason) {
-		super(`Invalid signature in document ${documentId}: ${reason}`);
+	constructor(documentId, code, reason) {
+		super(`Invalid signature in document ${documentId} [${code}]: ${reason}`);
 		this.name = "InvalidSignatureError";
 		this.documentId = documentId;
+		this.code = code;
 		this.reason = reason;
 		Error.captureStackTrace(this, InvalidSignatureError);
 	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "InvalidSignatureError";
+	}
 };
 /**
 * An UPGRADE_DOCUMENT action's preconditions (fromVersion and the per-scope
@@ -250,6 +283,30 @@ var AuthEnforcementDisabledError = class AuthEnforcementDisabledError extends Er
 		return Error.isError(error) && error.name === "AuthEnforcementDisabledError";
 	}
 };
+/**
+* Error thrown when a relationship edge an operation names does not exist.
+*
+* Detection is by `name`, not `instanceof`: the SharedWorker RPC boundary
+* rebuilds a thrown error from `{ name, message, stack, cause }` alone
+* (`reactor-browser/src/rpc/error-info.ts`), so the class identity is lost in
+* transit.
+*/
+var RelationshipNotFoundError = class RelationshipNotFoundError extends Error {
+	sourceId;
+	targetId;
+	relationshipType;
+	constructor(sourceId, targetId, relationshipType) {
+		super(`No ${relationshipType} relationship from ${sourceId} to ${targetId}`);
+		this.name = "RelationshipNotFoundError";
+		this.sourceId = sourceId;
+		this.targetId = targetId;
+		this.relationshipType = relationshipType;
+		Error.captureStackTrace(this, RelationshipNotFoundError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "RelationshipNotFoundError";
+	}
+};
 //#endregion
 //#region src/storage/interfaces.ts
 /**
@@ -302,6 +359,7 @@ const APPEND_CONDITION_FAILED_PREFIX = "Append condition failed: ";
 * conflict, not a fault: the caller retries against the new stream heads.
 */
 var AppendConditionFailedError = class extends Error {
+	condition;
 	constructor(condition) {
 		const streams = condition.streams.map((s) => `${s.documentId}:${s.scope}:${s.branch}@${s.revision}`).join(", ");
 		super(`${APPEND_CONDITION_FAILED_PREFIX}a read-set stream advanced [${streams}]`);
@@ -690,34 +748,13 @@ function selectDecisionModel(flags, registry) {
 //#endregion
 //#region src/executor/util.ts
 /** Actions the reactor reduces itself, onto the document scope. */
-const DOCUMENT_SCOPE_ACTIONS = new Set([
-	"CREATE_DOCUMENT",
-	"DELETE_DOCUMENT",
-	"UPGRADE_DOCUMENT",
-	"ADD_RELATIONSHIP",
-	"REMOVE_RELATIONSHIP",
-	"UPDATE_RELATIONSHIP"
-]);
+const DOCUMENT_SCOPE_ACTIONS = DOCUMENT_SCOPE_ACTION_TYPES;
 /**
 * `CREATE_DOCUMENT` is exempt by necessity: it runs before the document exists,
 * so building a decision model would throw and defer the job forever.
 */
 const GATED_DOCUMENT_ACTIONS = new Set([...DOCUMENT_SCOPE_ACTIONS].filter((type) => type !== "CREATE_DOCUMENT"));
 /**
-* The document a document-scope action writes to, which is not always the job's
-* own document: delete and upgrade name it in `input.documentId`, and the
-* relationship actions in `input.sourceId`. `execute` only checks that a batch
-* shares one scope, so a caller can submit an action whose target is a document
-* other than the one the job is keyed by. The policy gate has to follow the
-* action rather than the job, or it decides against a policy the caller may
-* control instead of the one guarding the write.
-*/
-function targetDocumentId(action, fallback) {
-	const input = action.input;
-	if (action.type === "ADD_RELATIONSHIP" || action.type === "REMOVE_RELATIONSHIP" || action.type === "UPDATE_RELATIONSHIP") return typeof input?.sourceId === "string" && input.sourceId.length > 0 ? input.sourceId : fallback;
-	return typeof input?.documentId === "string" && input.documentId.length > 0 ? input.documentId : fallback;
-}
-/**
 * Creates a PHDocument from a CREATE_DOCUMENT action input.
 * Reconstructs the document header and initializes the base state.
 *
@@ -896,6 +933,40 @@ var TouchedStreams = class {
 		return this.streams.values();
 	}
 };
+/**
+* The ids of the actions the caller handed to a job. Load and reevaluation
+* jobs write operations nobody submitted, so they report none.
+*/
+function submittedActionIds(job) {
+	return job.kind === "mutation" ? job.actions.map((action) => action.id) : [];
+}
+/**
+* Reports what became of each submitted action.
+*
+* A job's operations can include ones it only moved to a new index, so only
+* those carrying a submitted action are reported. Returns undefined when the
+* job submitted nothing, which keeps `JobInfo.result` null for the jobs that
+* have no caller to answer to.
+*/
+function summarizeSubmittedActions(operations, submitted) {
+	if (!submitted || submitted.length === 0) return;
+	const ids = new Set(submitted);
+	const actions = [];
+	for (const { operation, context } of operations) {
+		if (!ids.has(operation.action.id)) continue;
+		actions.push({
+			actionId: operation.action.id,
+			scope: context.scope,
+			index: operation.index,
+			...operationOutcome(operation)
+		});
+	}
+	if (actions.length === 0) return;
+	return {
+		actions,
+		allApplied: actions.every((action) => action.kind === "applied")
+	};
+}
 //#endregion
 //#region src/registry/errors.ts
 /**
@@ -993,6 +1064,7 @@ const JobExecutorEventTypes = {
 //#endregion
 //#region src/cache/collection-membership-cache.ts
 var CollectionMembershipCache = class CollectionMembershipCache {
+	operationIndex;
 	cache = /* @__PURE__ */ new Map();
 	constructor(operationIndex) {
 		this.operationIndex = operationIndex;
@@ -1206,10 +1278,23 @@ var DocumentMetaCache = class DocumentMetaCache {
 		return {
 			state: document.state.document,
 			documentType,
+			protocolVersions: createAction.input.protocolVersions,
 			documentScopeRevision: documentScopeRevision + 1
 		};
 	}
 };
+/** Bind slots per statement: 16-bit on the wire, read signed in-process. */
+const MAX_BIND_PARAMETERS = 32767;
+/** Splits rows into runs that each bind at most MAX_BIND_PARAMETERS. */
+function chunkRows(rows) {
+	if (rows.length === 0) return [];
+	const columnsPerRow = Math.max(1, Object.keys(rows[0]).length);
+	const perChunk = Math.max(1, Math.floor(MAX_BIND_PARAMETERS / columnsPerRow));
+	if (rows.length <= perChunk) return [rows];
+	const chunks = [];
+	for (let i = 0; i < rows.length; i += perChunk) chunks.push(rows.slice(i, i + perChunk));
+	return chunks;
+}
 var KyselyOperationIndexTxn = class {
 	collections = [];
 	collectionMemberships = [];
@@ -1275,6 +1360,7 @@ var KyselyOperationIndexTxn = class {
 	}
 };
 var KyselyOperationIndex = class KyselyOperationIndex {
+	db;
 	trx;
 	constructor(db) {
 		this.db = db;
@@ -1331,7 +1417,7 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 				leftOrdinal: null
 			}));
 			for (const collectionId of collections) kyselyTxn.recordMembershipInvalidation(collectionId);
-			await trx.insertInto("document_collections").values(collectionRows).onConflict((oc) => oc.doNothing()).execute();
+			for (const chunk of chunkRows(collectionRows)) await trx.insertInto("document_collections").values(chunk).onConflict((oc) => oc.doNothing()).execute();
 		}
 		let operationOrdinals = [];
 		if (operations.length > 0) {
@@ -1349,7 +1435,10 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 				deniedReason: op.deniedReason ?? null,
 				sourceRemote: op.sourceRemote
 			}));
-			operationOrdinals = (await trx.insertInto("operation_index_operations").values(operationRows).returning("ordinal").execute()).map((row) => row.ordinal);
+			for (const chunk of chunkRows(operationRows)) {
+				const insertedOps = await trx.insertInto("operation_index_operations").values(chunk).returning("ordinal").execute();
+				operationOrdinals = operationOrdinals.concat(insertedOps.map((row) => row.ordinal));
+			}
 		}
 		if (memberships.length > 0) for (const m of memberships) {
 			const ordinal = operationOrdinals[m.operationIndex];
@@ -1386,6 +1475,12 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 		if (signal?.aborted) throw new Error("Operation aborted");
 		return (await this.queryExecutor.selectFrom("group_references").select("documentId").where("groupId", "=", groupId).orderBy("documentId").execute()).map((row) => row.documentId);
 	}
+	async getOrdinalsByOpIds(documentId, scope, branch, opIds, signal) {
+		signal?.throwIfAborted();
+		if (opIds.length === 0) return /* @__PURE__ */ new Map();
+		const rows = await this.queryExecutor.selectFrom("operation_index_operations").select("opId").select((eb) => eb.fn.max("ordinal").as("ordinal")).where("documentId", "=", documentId).where("branch", "=", branch).where("scope", "=", scope).where("opId", "in", opIds).groupBy("opId").execute();
+		return new Map(rows.map((row) => [row.opId, Number(row.ordinal)]));
+	}
 	async find(collectionId, cursor, view, paging, signal) {
 		if (signal?.aborted) throw new Error("Operation aborted");
 		const outerCursor = cursor ?? -1;
@@ -1605,21 +1700,6 @@ var RingBuffer = class {
 	}
 };
 //#endregion
-//#region src/cache/write-cache-types.ts
-/**
-* Where a snapshot sits in its stream.
-*
-* - `Head`: the newest revision of the stream when it was stored. Only these
-*   can answer a read that asks for the head.
-* - `Historical`: state at an earlier revision. Usable as a starting point to
-*   replay forward from, and as an answer to a read for that same revision.
-*/
-let SnapshotPosition = /* @__PURE__ */ function(SnapshotPosition) {
-	SnapshotPosition["Head"] = "head";
-	SnapshotPosition["Historical"] = "historical";
-	return SnapshotPosition;
-}({});
-//#endregion
 //#region src/cache/kysely-write-cache.ts
 /**
 * The last operation index a keyframe's document reflects for the scope. A
@@ -1758,13 +1838,13 @@ var KyselyWriteCache = class KyselyWriteCache {
 			const snapshots = stream.ringBuffer.getAll();
 			if (targetRevision === void 0) {
 				const newest = highestRevision(snapshots);
-				if (newest?.position === SnapshotPosition.Head) {
+				if (newest?.position === "head") {
 					this.lruTracker.touch(streamKey);
 					return copyDocument(newest.document);
 				}
 				if (newest) {
 					const document = await this.warmMissRebuild(newest.document, newest.revision, documentId, scope, branch, void 0, signal);
-					this.store(documentId, scope, branch, (document.header.revision[scope] ?? 0) - 1, document, SnapshotPosition.Head);
+					this.store(documentId, scope, branch, (document.header.revision[scope] ?? 0) - 1, document, "head");
 					this.lruTracker.touch(streamKey);
 					return document;
 				}
@@ -1777,7 +1857,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 				const newestOlder = this.findNearestOlderSnapshot(snapshots, targetRevision);
 				if (newestOlder) {
 					const document = await this.warmMissRebuild(newestOlder.document, newestOlder.revision, documentId, scope, branch, targetRevision, signal);
-					this.store(documentId, scope, branch, targetRevision, document, SnapshotPosition.Historical);
+					this.store(documentId, scope, branch, targetRevision, document, "historical");
 					this.lruTracker.touch(streamKey);
 					return document;
 				}
@@ -1785,7 +1865,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 		}
 		const document = await this.coldMissRebuild(documentId, scope, branch, targetRevision, signal);
 		const revision = targetRevision ?? (document.header.revision[scope] ?? 0) - 1;
-		this.store(documentId, scope, branch, revision, document, targetRevision === void 0 ? SnapshotPosition.Head : SnapshotPosition.Historical);
+		this.store(documentId, scope, branch, revision, document, targetRevision === void 0 ? "head" : "historical");
 		return document;
 	}
 	/**
@@ -1820,7 +1900,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 		if (run.length === 0) return;
 		for (const entry of run.slice(0, -1)) this.persistKeyframe(documentId, scope, branch, entry.revision, entry.document);
 		const head = run[run.length - 1];
-		this.store(documentId, scope, branch, head.revision, head.document, SnapshotPosition.Head);
+		this.store(documentId, scope, branch, head.revision, head.document, "head");
 	}
 	store(documentId, scope, branch, revision, document, position) {
 		const streamKey = this.makeStreamKey(documentId, scope, branch);
@@ -2026,10 +2106,10 @@ var KyselyWriteCache = class KyselyWriteCache {
 					for (const pending of pendingUpgrades) pending.subsequentDeletes.push(operation.action);
 				} else {
 					const protocolVersion = baseReducerVersion(document.header);
-					document = docModule.reducer(document, operation.action, void 0, {
+					document = withProtocolVersions(docModule.reducer(document, operation.action, void 0, {
 						skip: operation.skip,
 						protocolVersion
-					});
+					}), document.header.protocolVersions);
 				}
 			}
 		}
@@ -2078,12 +2158,12 @@ var KyselyWriteCache = class KyselyWriteCache {
 					if (isDenied(operation)) document = appendWithoutApplying(document, operation, scope);
 					else {
 						const protocolVersion = baseReducerVersion(document.header);
-						document = getModuleCached(moduleVersion).reducer(document, operation.action, void 0, {
+						document = withProtocolVersions(getModuleCached(moduleVersion).reducer(document, operation.action, void 0, {
 							skip: operation.skip,
 							protocolVersion,
 							replayOptions: { operation },
 							skipIndexValidation: true
-						});
+						}), document.header.protocolVersions);
 					}
 				}
 				const reachedTarget = targetRevision !== void 0 && result.results.some((op) => op.index >= targetRevision);
@@ -2207,12 +2287,12 @@ var KyselyWriteCache = class KyselyWriteCache {
 				if (isDenied(operation)) document = appendWithoutApplying(document, operation, scope);
 				else {
 					const protocolVersion = baseReducerVersion(document.header);
-					document = module.reducer(document, operation.action, void 0, {
+					document = withProtocolVersions(module.reducer(document, operation.action, void 0, {
 						skip: operation.skip,
 						protocolVersion,
 						replayOptions: { operation },
 						skipIndexValidation: true
-					});
+					}), document.header.protocolVersions);
 				}
 				if (targetRevision !== void 0 && operation.index === targetRevision) break;
 			}
@@ -2339,6 +2419,11 @@ function validateFeatureFlags(flags, prerequisites) {
 //#endregion
 //#region src/executor/execution-scope.ts
 var DefaultExecutionScope = class {
+	operationStore;
+	operationIndex;
+	writeCache;
+	documentMetaCache;
+	collectionMembershipCache;
 	constructor(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache) {
 		this.operationStore = operationStore;
 		this.operationIndex = operationIndex;
@@ -2358,6 +2443,13 @@ var DefaultExecutionScope = class {
 	}
 };
 var KyselyExecutionScope = class {
+	db;
+	operationStore;
+	operationIndex;
+	keyframeStore;
+	writeCache;
+	documentMetaCache;
+	collectionMembershipCache;
 	constructor(db, operationStore, operationIndex, keyframeStore, writeCache, documentMetaCache, collectionMembershipCache) {
 		this.db = db;
 		this.operationStore = operationStore;
@@ -2385,7 +2477,7 @@ var KyselyExecutionScope = class {
 };
 //#endregion
 //#region src/utils/reshuffle.ts
-const STRICT_ORDER_ACTION_TYPES = new Set([
+const STRICT_ORDER_ACTION_TYPES = /* @__PURE__ */ new Set([
 	"CREATE_DOCUMENT",
 	"DELETE_DOCUMENT",
 	"UPGRADE_DOCUMENT",
@@ -2716,6 +2808,8 @@ const DRIVE_COLLECTION_PREFIX = "drive.";
 * rows and persisted remotes remain valid without migration.
 */
 var DriveCollectionId = class DriveCollectionId {
+	driveId;
+	branch;
 	constructor(driveId, branch) {
 		this.driveId = driveId;
 		this.branch = branch;
@@ -2748,6 +2842,11 @@ var DriveCollectionId = class DriveCollectionId {
 //#endregion
 //#region src/executor/document-action-handler.ts
 var DocumentActionHandler = class {
+	registry;
+	logger;
+	driveContainerTypes;
+	featureFlags;
+	decisionModel;
 	constructor(registry, logger, driveContainerTypes, featureFlags, decisionModel) {
 		this.registry = registry;
 		this.logger = logger;
@@ -2840,7 +2939,7 @@ var DocumentActionHandler = class {
 			[job.scope]: [...standing.operations[job.scope] ?? [], operation]
 		};
 		executing.touchedStreams.add(job.documentId, job.scope, job.branch);
-		stores.writeCache.putState(job.documentId, job.scope, job.branch, operation.index, standing, SnapshotPosition.Head);
+		stores.writeCache.putState(job.documentId, job.scope, job.branch, operation.index, standing, "head");
 		indexTxn.write([{
 			...operation,
 			documentId: job.documentId,
@@ -2852,6 +2951,7 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(job.documentId, job.branch, {
 			state: standing.state.document,
 			documentType: standing.header.documentType,
+			protocolVersions: standing.header.protocolVersions,
 			documentScopeRevision: operation.index + 1
 		});
 		return buildSuccessResult(job, operation, job.documentId, standing.header.documentType, JSON.stringify({
@@ -2875,8 +2975,8 @@ var DocumentActionHandler = class {
 			branch: job.branch
 		});
 		const resultingStateObj = {
-			header: document.header,
-			...document.state
+			...document.state,
+			header: document.header
 		};
 		const resultingState = JSON.stringify(resultingStateObj);
 		const writeResult = await this.writeOperationToStore({
@@ -2893,7 +2993,7 @@ var DocumentActionHandler = class {
 			[job.scope]: [...document.operations[job.scope] ?? [], operation]
 		};
 		executing.touchedStreams.add(document.header.id, job.scope, job.branch);
-		stores.writeCache.putState(document.header.id, job.scope, job.branch, operation.index, document, SnapshotPosition.Head);
+		stores.writeCache.putState(document.header.id, job.scope, job.branch, operation.index, document, "head");
 		indexTxn.write([{
 			...operation,
 			documentId: document.header.id,
@@ -2910,6 +3010,7 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(document.header.id, job.branch, {
 			state: document.state.document,
 			documentType: document.header.documentType,
+			protocolVersions: document.header.protocolVersions,
 			documentScopeRevision: 1
 		});
 		return buildSuccessResult(job, operation, document.header.id, document.header.documentType, resultingState, startTime);
@@ -2953,7 +3054,7 @@ var DocumentActionHandler = class {
 			[job.scope]: [...document.operations[job.scope] ?? [], operation]
 		};
 		executing.touchedStreams.add(documentId, job.scope, job.branch);
-		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, SnapshotPosition.Head);
+		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, "head");
 		indexTxn.write([{
 			...operation,
 			documentId,
@@ -2965,6 +3066,7 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(documentId, job.branch, {
 			state: document.state.document,
 			documentType: document.header.documentType,
+			protocolVersions: document.header.protocolVersions,
 			documentScopeRevision: operation.index + 1
 		});
 		return buildSuccessResult(job, operation, documentId, document.header.documentType, resultingState, startTime);
@@ -3003,7 +3105,7 @@ var DocumentActionHandler = class {
 				} catch (error) {
 					return buildErrorResult(job, /* @__PURE__ */ new Error(`Failed to fetch revisions for upgrade: ${error instanceof Error ? error.message : String(error)}`), startTime);
 				}
-				const revisionScopes = new Set([...Object.keys(input.revision), ...Object.keys(actualRevisions)]);
+				const revisionScopes = /* @__PURE__ */ new Set([...Object.keys(input.revision), ...Object.keys(actualRevisions)]);
 				for (const revisionScope of revisionScopes) {
 					const snapshot = input.revision[revisionScope] ?? 0;
 					const actual = actualRevisions[revisionScope] ?? 0;
@@ -3045,8 +3147,8 @@ var DocumentActionHandler = class {
 			branch: job.branch
 		});
 		const resultingStateObj = {
-			header: document.header,
-			...document.state
+			...document.state,
+			header: document.header
 		};
 		if (fromVersion > 0) resultingStateObj.__migrated = true;
 		const resultingState = JSON.stringify(resultingStateObj);
@@ -3064,7 +3166,7 @@ var DocumentActionHandler = class {
 			[job.scope]: [...document.operations[job.scope] ?? [], operation]
 		};
 		executing.touchedStreams.add(documentId, job.scope, job.branch);
-		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, SnapshotPosition.Head);
+		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, "head");
 		for (const scope of otherScopes) executing.postCommitInvalidations.push({
 			documentId,
 			scope,
@@ -3081,6 +3183,7 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(documentId, job.branch, {
 			state: document.state.document,
 			documentType: document.header.documentType,
+			protocolVersions: document.header.protocolVersions,
 			documentScopeRevision: operation.index + 1
 		});
 		return buildSuccessResult(job, operation, documentId, document.header.documentType, resultingState, startTime);
@@ -3150,7 +3253,7 @@ var DocumentActionHandler = class {
 		const resultingState = JSON.stringify(resultingStateObj);
 		executing.touchedStreams.add(input.sourceId, job.scope, job.branch);
 		executing.touchedStreams.add(input.targetId, job.scope, job.branch);
-		stores.writeCache.putState(input.sourceId, job.scope, job.branch, operation.index, sourceDoc, SnapshotPosition.Head);
+		stores.writeCache.putState(input.sourceId, job.scope, job.branch, operation.index, sourceDoc, "head");
 		indexTxn.write([{
 			...operation,
 			documentId: input.sourceId,
@@ -3169,6 +3272,7 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(input.sourceId, job.branch, {
 			state: sourceDoc.state.document,
 			documentType: sourceDoc.header.documentType,
+			protocolVersions: sourceDoc.header.protocolVersions,
 			documentScopeRevision: operation.index + 1
 		});
 		return buildSuccessResult(job, operation, input.sourceId, sourceDoc.header.documentType, resultingState, startTime);
@@ -3197,55 +3301,655 @@ var DocumentActionHandler = class {
 	}
 };
 //#endregion
-//#region src/executor/signature-verifier.ts
-var SignatureVerifier = class {
-	constructor(verifier) {
-		this.verifier = verifier;
-	}
-	async verifyActions(documentId, branch, actions) {
-		if (!this.verifier) return;
-		for (const action of actions) {
-			const signer = action.context?.signer;
-			if (!signer) continue;
-			if (signer.signatures.length === 0) throw new InvalidSignatureError(documentId, `Action ${action.id} has signer but no signatures`);
-			const publicKey = signer.app.key;
-			let isValid;
-			try {
-				const tempOperation = {
-					id: deriveOperationId(documentId, action.scope, branch, action.id),
-					index: 0,
-					timestampUtcMs: action.timestampUtcMs || (/* @__PURE__ */ new Date()).toISOString(),
-					hash: "",
-					skip: 0,
-					action
-				};
-				isValid = await this.verifier(tempOperation, publicKey);
-			} catch (error) {
-				const errorMessage = error instanceof Error ? error.message : String(error);
-				throw new InvalidSignatureError(documentId, `Action ${action.id} verification failed: ${errorMessage}`);
-			}
-			if (!isValid) throw new InvalidSignatureError(documentId, `Action ${action.id} signature verification returned false`);
+//#region src/signer/passthrough-signer.ts
+/**
+* A no-op signer that returns empty values for all methods.
+* Used when signing is not required.
+*/
+var PassthroughSigner = class {
+	publicKey = {};
+	sign() {
+		return Promise.resolve(/* @__PURE__ */ new Uint8Array(0));
+	}
+	verify() {
+		return Promise.resolve();
+	}
+	signAction() {
+		return Promise.resolve([
+			"",
+			"",
+			"",
+			"",
+			""
+		]);
+	}
+};
+//#endregion
+//#region src/signer/trust-policy.ts
+/**
+* The policy admission asks: the reactor's own key signing as its own user is
+* accepted, then the host's policy decides, else the default does. `own` is
+* read on every ask, since its user changes on login.
+*/
+function admissionTrustPolicy(own, authEnforcement, policy) {
+	return { authorizeSigner(signer, key, documentId) {
+		const identity = actionSignerIdentity(own);
+		if (identity.app.key !== "" && key === identity.app.key) {
+			if (sameUser(actionSignerIdentity(signer).user, identity.user)) return Promise.resolve(true);
 		}
+		if (policy) return policy.authorizeSigner(signer, key, documentId);
+		return Promise.resolve(!authEnforcement);
+	} };
+}
+function sameUser(a, b) {
+	return a.address.toLowerCase() === b.address.toLowerCase() && a.networkId === b.networkId && a.chainId === b.chainId;
+}
+//#endregion
+//#region src/signer/did-key.ts
+const DID_KEY_PREFIX = "did:key:z";
+const P256_MULTICODEC = [128, 36];
+const MAX_CACHED_KEYS = 1024;
+const P = BigInt("0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff");
+const A = BigInt("0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc");
+const B = BigInt("0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b");
+/** A did:key that is not a compressed P-256 public key. */
+var MalformedDidKeyError = class extends Error {
+	constructor(did, detail) {
+		super(`Malformed did:key ${did}: ${detail}`);
+		this.name = "MalformedDidKeyError";
 	}
-	async verifyOperations(documentId, operations) {
-		if (!this.verifier) return;
-		for (let i = 0; i < operations.length; i++) {
-			const operation = operations[i];
-			const signer = operation.action.context?.signer;
-			if (!signer) continue;
-			if (signer.signatures.length === 0) throw new InvalidSignatureError(documentId, `Operation ${operation.id} at index ${operation.index} has signer but no signatures`);
-			const publicKey = signer.app.key;
-			let isValid;
-			try {
-				isValid = await this.verifier(operation, publicKey);
-			} catch (error) {
-				const errorMessage = error instanceof Error ? error.message : String(error);
-				throw new InvalidSignatureError(documentId, `Operation ${operation.id} at index ${operation.index} verification failed: ${errorMessage}`);
+};
+const keyCache = /* @__PURE__ */ new Map();
+/** Cached per process: decompressing the point costs a BigInt modPow. */
+async function importDidKey(did) {
+	const cached = keyCache.get(did);
+	if (cached) {
+		keyCache.delete(did);
+		keyCache.set(did, cached);
+		return cached;
+	}
+	const raw = decompressP256(compressedPointFromDid(did), did);
+	const key = await crypto.subtle.importKey("raw", raw.buffer, {
+		name: "ECDSA",
+		namedCurve: "P-256"
+	}, false, ["verify"]);
+	keyCache.set(did, key);
+	if (keyCache.size > MAX_CACHED_KEYS) {
+		const oldest = keyCache.keys().next().value;
+		if (oldest !== void 0) keyCache.delete(oldest);
+	}
+	return key;
+}
+function compressedPointFromDid(did) {
+	if (!did.startsWith(DID_KEY_PREFIX)) throw new MalformedDidKeyError(did, "not a base58btc did:key");
+	const decoded = base58Decode(did.slice(9));
+	if (!decoded || decoded.length !== 35) throw new MalformedDidKeyError(did, "not a compressed P-256 key");
+	if (decoded[0] !== P256_MULTICODEC[0] || decoded[1] !== P256_MULTICODEC[1]) throw new MalformedDidKeyError(did, "not a P-256 multicodec");
+	return decoded.subarray(2);
+}
+function decompressP256(compressed, did) {
+	const prefix = compressed[0];
+	if (prefix !== 2 && prefix !== 3) throw new MalformedDidKeyError(did, `compression prefix ${prefix}`);
+	let x = BigInt(0);
+	for (let i = 1; i < compressed.length; i++) x = x << BigInt(8) | BigInt(compressed[i]);
+	if (x >= P) throw new MalformedDidKeyError(did, "x outside the field");
+	const ySquared = (modPow(x, BigInt(3), P) + A * x + B) % P;
+	let y = modPow(ySquared, (P + BigInt(1)) / BigInt(4), P);
+	if (y * y % P !== ySquared) throw new MalformedDidKeyError(did, "x is not on the curve");
+	if (y % BigInt(2) === BigInt(0) !== (prefix === 2)) y = P - y;
+	const uncompressed = /* @__PURE__ */ new Uint8Array(65);
+	uncompressed[0] = 4;
+	uncompressed.set(bigIntToBytes(x), 1);
+	uncompressed.set(bigIntToBytes(y), 33);
+	return uncompressed;
+}
+function modPow(base, exp, mod) {
+	let result = BigInt(1);
+	let b = base % mod;
+	let e = exp;
+	while (e > BigInt(0)) {
+		if (e & BigInt(1)) result = result * b % mod;
+		e >>= BigInt(1);
+		b = b * b % mod;
+	}
+	return result;
+}
+function bigIntToBytes(value) {
+	const bytes = /* @__PURE__ */ new Uint8Array(32);
+	let v = value;
+	for (let i = 31; i >= 0; i--) {
+		bytes[i] = Number(v & BigInt(255));
+		v >>= BigInt(8);
+	}
+	return bytes;
+}
+//#endregion
+//#region src/signer/verify-action-signature.ts
+const RENOWN_HASH_LENGTH = 44;
+const SHARED_HASH_LENGTH = 28;
+const HEX_SIGNATURE = /^(0x)?([0-9a-fA-F]{2})+$/;
+/**
+* Integrity only: identity binding and the live-id check sit with the caller.
+* `operation` is the incoming operation at load admission.
+*/
+async function verifyActionSignature(action, target, path, operation) {
+	const policy = target.policy ?? "legacy";
+	const refusal = policyRefusal(action, policy);
+	if (refusal) return refusal;
+	const shape = signerShape(action.context?.signer);
+	if (shape.kind === "unsigned") return policy === "v2-required" ? refuse("unsigned", "UNSIGNED_REQUIRED", `action ${action.id} is unsigned but ${target.documentId} requires v2 signatures`) : {
+		ok: true,
+		scheme: "unsigned"
+	};
+	if (shape.kind === "malformed") return refuse("legacy-unknown", "MALFORMED_TUPLE", `action ${action.id} ${shape.reason}`);
+	const { signer, tuple } = shape;
+	const scheme = schemeOf(tuple[2]);
+	if (tuple[1] !== signer.app.key) return refuse(scheme, "KEY_MISMATCH", `action ${action.id} tuple key does not match signer.app.key`);
+	if (scheme !== "v2" && policy === "v2-required") return refuse(scheme, "SCHEME_BELOW_POLICY", `action ${action.id} carries a legacy tuple but ${target.documentId} requires v2 signatures`);
+	if (scheme === "legacy-unknown" && path === "mutation") return refuse(scheme, "MALFORMED_TUPLE", `action ${action.id} carries a hash of unknown length ${tuple[2].length}`);
+	if (scheme === "v2") {
+		const refusal = await checkV2(action, tuple, target, operation);
+		if (refusal) return refusal;
+	} else if (path === "mutation") {
+		if (await legacyHash(scheme, action, target) !== tuple[2]) return refuse(scheme, "HASH_MISMATCH", `action ${action.id} does not match the hash its signature covers`);
+	}
+	return verifyEcdsa(tuple, scheme, action.id);
+}
+/** Refusals a document's policy makes before any tuple is read. */
+function policyRefusal(action, policy) {
+	if (action.type !== "CREATE_DOCUMENT") return;
+	const scheme = schemeOfAction(action);
+	const input = action.input;
+	const documentId = input?.documentId ?? "";
+	if (policy === "legacy") return isDerivedDocumentId(documentId) ? refuse(scheme, "ID_MISMATCH", `action ${action.id}: a legacy document cannot take the content-addressed id ${documentId}`) : void 0;
+	const expected = derivedCreateId(input);
+	if (expected === documentId) return;
+	return refuse(scheme, "ID_MISMATCH", expected === void 0 ? `action ${action.id} creates v2-required ${documentId} without the header params its id is derived from` : `action ${action.id} creates v2-required ${documentId}, but its header params derive ${expected}`);
+}
+function derivedCreateId(input) {
+	if (!input?.signing || !input.protocolVersions) return;
+	try {
+		return deriveDocumentId({
+			documentType: input.model,
+			createdAtUtcIso: input.signing.createdAtUtcIso,
+			nonce: input.signing.nonce,
+			protocolVersions: input.protocolVersions
+		});
+	} catch {
+		return;
+	}
+}
+function schemeOfAction(action) {
+	const shape = signerShape(action.context?.signer);
+	if (shape.kind === "unsigned") return "unsigned";
+	return shape.kind === "signed" ? schemeOf(shape.tuple[2]) : "legacy-unknown";
+}
+/** Peers send arbitrary JSON, so nothing past `context` is assumed. */
+function signerShape(value) {
+	if (value === void 0 || value === null) return { kind: "unsigned" };
+	if (!isRecord(value)) return {
+		kind: "malformed",
+		reason: "has a signer that is not an object"
+	};
+	const { app, user, signatures } = value;
+	if (app !== void 0 && app !== null && !isRecord(app)) return {
+		kind: "malformed",
+		reason: "has a signer.app that is not an object"
+	};
+	const key = isRecord(app) ? app.key : void 0;
+	if (key !== void 0 && key !== null && typeof key !== "string") return {
+		kind: "malformed",
+		reason: "has a signer.app.key that is not a string"
+	};
+	if (!key) return { kind: "unsigned" };
+	if (!isRecord(user) || typeof user.address !== "string") return {
+		kind: "malformed",
+		reason: "has a signer without a user address"
+	};
+	if (!Array.isArray(signatures)) return {
+		kind: "malformed",
+		reason: "has a signer whose signatures are not a list"
+	};
+	const tuple = signatures.at(-1);
+	if (!isTuple(tuple)) return {
+		kind: "malformed",
+		reason: signatures.length === 0 ? "has a signer but no signatures" : "carries a malformed signature tuple"
+	};
+	return {
+		kind: "signed",
+		signer: value,
+		tuple
+	};
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function checkV2(action, tuple, target, operation) {
+	const problem = v2TupleProblem(tuple);
+	if (problem) return refuse("v2", "MALFORMED_TUPLE", `action ${action.id}: ${problem}`);
+	if (operation && !sameInstant(operation.timestampUtcMs, action.timestampUtcMs)) return refuse("v2", "TIMESTAMP_MISMATCH", `action ${action.id} is stamped ${action.timestampUtcMs} but its operation ${operation.timestampUtcMs}`);
+	let expected;
+	try {
+		expected = await hashActionV2(action, target, action.context.signer);
+	} catch (error) {
+		return refuse("v2", "HASH_MISMATCH", `action ${action.id} has no v2 hash: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (expected !== tuple[2]) return refuse("v2", "HASH_MISMATCH", `action ${action.id} does not match the hash its signature covers`);
+}
+function sameInstant(a, b) {
+	const left = Date.parse(a);
+	return !Number.isNaN(left) && left === Date.parse(b);
+}
+function schemeOf(hash) {
+	if (isV2ActionHash(hash)) return "v2";
+	if (hash.length === RENOWN_HASH_LENGTH) return "legacy-renown";
+	if (hash.length === SHARED_HASH_LENGTH) return "legacy-shared";
+	return "legacy-unknown";
+}
+async function legacyHash(scheme, action, target) {
+	if (scheme === "legacy-renown") {
+		const payload = [
+			action.scope,
+			action.type,
+			JSON.stringify(action.input)
+		].join("");
+		const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(payload));
+		return bytesToBase64(new Uint8Array(digest));
+	}
+	const signer = action.context.signer;
+	return buildOperationSignatureParams({
+		documentId: target.documentId,
+		signer,
+		action,
+		previousStateHash: ""
+	})[2];
+}
+async function verifyEcdsa(tuple, scheme, actionId) {
+	const [timestamp, key, hash, prevStateHash, signatureHex] = tuple;
+	if (!HEX_SIGNATURE.test(signatureHex)) return refuse(scheme, "MALFORMED_TUPLE", `action ${actionId} signature is not hex`);
+	let cryptoKey;
+	try {
+		cryptoKey = await importDidKey(key);
+	} catch (error) {
+		return refuse(scheme, "MALFORMED_TUPLE", `action ${actionId}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	const message = buildOperationSignatureMessage([
+		timestamp,
+		key,
+		hash,
+		prevStateHash
+	]);
+	let valid;
+	try {
+		valid = await crypto.subtle.verify({
+			name: "ECDSA",
+			hash: "SHA-256"
+		}, cryptoKey, hexToBytes(signatureHex).buffer, message.buffer);
+	} catch {
+		valid = false;
+	}
+	if (!valid) return refuse(scheme, "BAD_SIGNATURE", `action ${actionId} signature does not verify under its key`);
+	return {
+		ok: true,
+		scheme
+	};
+}
+function isTuple(value) {
+	return Array.isArray(value) && value.length === 5 && value.every((element) => typeof element === "string");
+}
+function refuse(scheme, code, reason) {
+	return {
+		ok: false,
+		scheme,
+		code,
+		reason
+	};
+}
+function hexToBytes(hex) {
+	const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
+	const bytes = new Uint8Array(clean.length / 2);
+	for (let i = 0; i < bytes.length; i++) bytes[i] = parseInt(clean.substring(i * 2, i * 2 + 2), 16);
+	return bytes;
+}
+function bytesToBase64(bytes) {
+	let binary = "";
+	for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+	return btoa(binary);
+}
+//#endregion
+//#region src/executor/synthesized-signing.ts
+/** Submitted types whose stored action the reducer writes in their place. */
+const SYNTHESIZING_TYPES = /* @__PURE__ */ new Set(["UNDO", "REDO"]);
+/**
+* The id of the action synthesized from `submittedId`. Derived, so the stored
+* operation answers for the submitted id at the live-id check.
+*/
+function synthesizedActionId(submittedId) {
+	return hashBrowser(`synthesized:${submittedId}`, "sha1", "hex").slice(0, 32);
+}
+/**
+* Whether `operation` stores an action the reducer made from `submitted`
+* rather than `submitted` itself or an operation already in `history`.
+*/
+function isSynthesized(submitted, operation, history) {
+	if (!SYNTHESIZING_TYPES.has(submitted.type)) return false;
+	const id = operation.action.id;
+	if (!id) return true;
+	if (id === submitted.id) return false;
+	return !history.some((existing) => existing.action.id === id);
+}
+/**
+* Signs the synthesized action of `operation` in place as `signer`, under the
+* id {@link synthesizedActionId} derives from the submitted one. A REDO's
+* rebuilt action has no timestamp, so it takes the submitted one; the
+* operation timestamp is set to the action's, which a peer requires of a v2
+* tuple.
+*/
+async function signSynthesized(operation, submitted, target, signer, signal) {
+	const synthesized = operation.action;
+	const id = synthesizedActionId(submitted.id);
+	const timestampUtcMs = operation.timestampUtcMs || synthesized.timestampUtcMs || submitted.timestampUtcMs;
+	const action = {
+		id,
+		timestampUtcMs,
+		type: synthesized.type,
+		input: synthesized.input,
+		scope: synthesized.scope
+	};
+	const signature = await signer.signAction(action, {
+		documentId: target.documentId,
+		branch: target.branch
+	}, signal);
+	operation.action = {
+		...action,
+		context: { signer: {
+			...actionSignerIdentity(signer),
+			signatures: [signature]
+		} }
+	};
+	operation.id = deriveOperationId(target.documentId, target.scope, target.branch, id);
+	operation.timestampUtcMs = timestampUtcMs;
+}
+//#endregion
+//#region src/executor/signature-admission.ts
+const DEFAULT_TRUST_TIMEOUT_MS = 1e4;
+/** Runs once per write, when this reactor first stores it; never on re-appends. */
+var SignatureAdmission = class {
+	mode;
+	logger;
+	eventBus;
+	policySource;
+	trustPolicy;
+	trustTimeoutMs;
+	constructor(mode, logger, eventBus, policySource = "meta", trust = {
+		authEnforcement: false,
+		timeoutMs: DEFAULT_TRUST_TIMEOUT_MS
+	}) {
+		this.mode = mode;
+		this.logger = logger;
+		this.eventBus = eventBus;
+		this.policySource = policySource;
+		this.trustPolicy = admissionTrustPolicy(trust.signer ?? new PassthroughSigner(), trust.authEnforcement, trust.policy);
+		this.trustTimeoutMs = trust.timeoutMs;
+	}
+	/** The first refusal of a mutation's submitted actions, when enforcing. */
+	async admitMutation(job, stores, signal) {
+		const { operationStore } = stores;
+		const candidates = job.actions.map((action) => candidate(action, mutationStream(action, job)));
+		const live = await this.liveOperationIds(candidates, operationStore, signal);
+		const committed = await this.storedAsSubmitted(candidates, live, isRetry(job), operationStore, signal);
+		await resolvePolicies(candidates, job.actions, (documentId, branch) => storedPolicy(stores, this.policySource, documentId, branch, signal));
+		const submitted = /* @__PURE__ */ new Set();
+		for (const entry of candidates) {
+			if (committed.has(entry)) continue;
+			const verdict = await this.verdict(entry, live, submitted, "mutation", signal);
+			submitted.add(entry.opId);
+			if (verdict.ok) continue;
+			const refusal = this.record(job, entry, verdict, "mutation");
+			if (refusal) return {
+				kind: "refused",
+				error: refusal
+			};
+		}
+		return {
+			kind: "admitted",
+			committed: [...committed.values()]
+		};
+	}
+	/** The incoming operations a load drops, empty unless enforcing. */
+	async admitLoad(job, operations, stores, signal) {
+		const { operationStore } = stores;
+		const stream = {
+			documentId: job.documentId,
+			scope: job.scope,
+			branch: job.branch
+		};
+		const candidates = operations.map((operation) => ({
+			...candidate(operation.action, stream),
+			operation
+		}));
+		const live = await this.liveOperationIds(candidates, operationStore, signal);
+		const redelivered = await this.redelivered(candidates, live, operationStore, signal);
+		await resolvePolicies(candidates, job.operations.map((operation) => operation.action), (documentId, branch) => storedPolicy(stores, this.policySource, documentId, branch, signal));
+		const dropped = /* @__PURE__ */ new Set();
+		for (let i = 0; i < candidates.length; i++) {
+			const verdict = await this.verdict(candidates[i], live, void 0, "load", signal, redelivered.has(candidates[i]));
+			if (verdict.ok) continue;
+			if (this.record(job, candidates[i], verdict, "load")) dropped.add(operations[i]);
+		}
+		return dropped;
+	}
+	async verdict(entry, live, submitted, path, signal, known = false) {
+		const verdict = await verifyActionSignature(entry.action, {
+			documentId: entry.stream.documentId,
+			branch: entry.stream.branch,
+			policy: entry.policy
+		}, path, entry.operation);
+		if (!verdict.ok) return verdict;
+		if (!known && (isLive(entry, live) || submitted?.has(entry.opId))) return {
+			ok: false,
+			scheme: verdict.scheme,
+			code: "DUPLICATE_ACTION",
+			reason: `action ${entry.action.id} is already in the stream`
+		};
+		if (verdict.scheme === "unsigned") {
+			const address = entry.action.context?.signer?.user?.address;
+			return address ? {
+				ok: false,
+				scheme: "unsigned",
+				code: "UNSIGNED_IDENTITY",
+				reason: `action ${entry.action.id} is unsigned but claims to act as ${address}`
+			} : verdict;
+		}
+		if (known) return verdict;
+		const signer = entry.action.context.signer;
+		if (!await this.authorize(signer, entry.stream.documentId, signal)) return {
+			ok: false,
+			scheme: verdict.scheme,
+			code: "SIGNER_UNAUTHORIZED",
+			reason: `action ${entry.action.id}: key ${signer.app.key} may not sign as ${signer.user.address}`
+		};
+		return verdict;
+	}
+	/** Throws when the policy does, times out or the job is aborted. */
+	async authorize(signer, documentId, signal) {
+		signal?.throwIfAborted();
+		let timer;
+		let onAbort;
+		const stop = new Promise((_, reject) => {
+			timer = setTimeout(() => {
+				reject(/* @__PURE__ */ new Error(`signature trust policy did not answer for ${signer.app.key} within ${this.trustTimeoutMs}ms`));
+			}, this.trustTimeoutMs);
+			if (signal) {
+				onAbort = () => reject(signal.reason instanceof Error ? signal.reason : new Error(String(signal.reason)));
+				signal.addEventListener("abort", onAbort, { once: true });
 			}
-			if (!isValid) throw new InvalidSignatureError(documentId, `Operation ${operation.id} at index ${operation.index} signature verification returned false`);
+		});
+		try {
+			return await Promise.race([this.trustPolicy.authorizeSigner(signer, signer.app.key, documentId), stop]);
+		} finally {
+			clearTimeout(timer);
+			if (onAbort) signal?.removeEventListener("abort", onAbort);
+		}
+	}
+	/**
+	* The live candidates stored exactly as submitted and still standing: one
+	* an undo or a reshuffle has since superseded is refused, not re-emitted with
+	* the state it once produced. A synthesized operation
+	* holds another action, so it cannot be compared; only a retry, whose first
+	* attempt this job was, takes it as committed.
+	*/
+	async storedAsSubmitted(candidates, live, retry, operationStore, signal) {
+		const committed = /* @__PURE__ */ new Map();
+		const toCompare = [];
+		for (const entry of candidates) if (entry.synthesizedOpId && live.has(entry.synthesizedOpId)) {
+			if (retry) committed.set(entry, committedWrite(entry, entry.synthesizedOpId));
+		} else if (live.has(entry.opId)) toCompare.push(entry);
+		for (const [stream, entries] of byStream(toCompare)) {
+			const stored = await operationStore.getOperationsByIds(stream.documentId, stream.scope, stream.branch, entries.map((entry) => entry.opId), signal);
+			const byId = new Map(stored.map((operation) => [operation.id, operation]));
+			const matching = entries.filter((entry) => {
+				const operation = byId.get(entry.opId);
+				return operation && sameContent(operation.action, entry.action);
+			});
+			if (matching.length === 0) continue;
+			const later = await operationStore.getSince(stream.documentId, stream.scope, stream.branch, Math.min(...matching.map((entry) => byId.get(entry.opId).index)), void 0, void 0, signal);
+			for (const entry of matching) if (!isSuperseded(byId.get(entry.opId), later.results)) committed.set(entry, committedWrite(entry, entry.opId));
+		}
+		return committed;
+	}
+	/**
+	* The load candidates stored exactly as they arrive, timestamp included: a
+	* peer re-sending what this stream holds, not a replay of its action.
+	*/
+	async redelivered(candidates, live, operationStore, signal) {
+		const found = /* @__PURE__ */ new Set();
+		const toCompare = candidates.filter((entry) => live.has(entry.opId) && !(entry.synthesizedOpId && live.has(entry.synthesizedOpId)));
+		for (const [stream, entries] of byStream(toCompare)) {
+			const stored = await operationStore.getOperationsByIds(stream.documentId, stream.scope, stream.branch, entries.map((entry) => entry.opId), signal);
+			for (const entry of entries) if (stored.some((operation) => operation.id === entry.opId && Date.parse(operation.timestampUtcMs) === Date.parse(entry.operation?.timestampUtcMs ?? "") && sameContent(operation.action, entry.action))) found.add(entry);
+		}
+		return found;
+	}
+	async liveOperationIds(candidates, operationStore, signal) {
+		const live = /* @__PURE__ */ new Set();
+		for (const [stream, entries] of byStream(candidates)) {
+			const found = await operationStore.findOperationIds(stream.documentId, stream.scope, stream.branch, entries.flatMap((entry) => entry.synthesizedOpId ? [entry.opId, entry.synthesizedOpId] : [entry.opId]), signal);
+			for (const opId of found) live.add(opId);
 		}
+		return live;
+	}
+	/** Logs and counts a refusal; returns the error only when enforcing. */
+	record(job, entry, refusal, path) {
+		const enforced = this.mode === "enforce";
+		const event = {
+			jobId: job.id,
+			documentId: entry.stream.documentId,
+			scope: entry.stream.scope,
+			branch: entry.stream.branch,
+			actionId: entry.action.id,
+			code: refusal.code,
+			scheme: refusal.scheme,
+			path,
+			enforced,
+			reason: refusal.reason
+		};
+		this.logger.warn(enforced ? "Signature refused: @Refusal" : "Signature refusal logged, write admitted: @Refusal", event);
+		this.eventBus.emit(ReactorEventTypes.SIGNATURE_REFUSED, event).catch((error) => {
+			this.logger.error("Failed to emit SIGNATURE_REFUSED: @Error", error);
+		});
+		return enforced ? new InvalidSignatureError(entry.stream.documentId, refusal.code, refusal.reason) : void 0;
 	}
 };
+/**
+* A CREATE_DOCUMENT is verified under its own input. Anything else takes the
+* stored document's policy, or, for a document this job creates, that CREATE's.
+*/
+async function resolvePolicies(candidates, jobActions, stored) {
+	const resolved = /* @__PURE__ */ new Map();
+	for (const entry of candidates) {
+		if (entry.action.type === "CREATE_DOCUMENT") {
+			entry.policy = createPolicy(entry.action);
+			continue;
+		}
+		const { documentId, branch } = entry.stream;
+		const key = `${documentId}\u0000${branch}`;
+		let policy = resolved.get(key);
+		if (policy === void 0) {
+			policy = await stored(documentId, branch) ?? createdPolicy(jobActions, documentId) ?? "legacy";
+			resolved.set(key, policy);
+		}
+		entry.policy = policy;
+	}
+}
+async function storedPolicy(stores, source, documentId, branch, signal) {
+	try {
+		if (source === "write-cache") {
+			const document = await stores.writeCache.getState(documentId, "document", branch, void 0, signal);
+			return signaturePolicyOf(document.header);
+		}
+		const meta = await stores.documentMetaCache.getDocumentMeta(documentId, branch, signal);
+		return signaturePolicyOf(meta.protocolVersions);
+	} catch (error) {
+		if (DocumentNotFoundError.isError(error)) return;
+		throw error;
+	}
+}
+function createdPolicy(actions, documentId) {
+	const create = actions.find((action) => action.type === "CREATE_DOCUMENT" && action.input?.documentId === documentId);
+	return create ? createPolicy(create) : void 0;
+}
+function createPolicy(action) {
+	return signaturePolicyOf(action.input);
+}
+function candidate(action, stream) {
+	const opId = (actionId) => deriveOperationId(stream.documentId, stream.scope, stream.branch, actionId);
+	return {
+		action,
+		stream,
+		opId: opId(action.id),
+		synthesizedOpId: SYNTHESIZING_TYPES.has(action.type) ? opId(synthesizedActionId(action.id)) : void 0
+	};
+}
+function isLive(entry, live) {
+	return live.has(entry.opId) || entry.synthesizedOpId !== void 0 && live.has(entry.synthesizedOpId);
+}
+function mutationStream(action, job) {
+	return {
+		...actionSigningTarget(action, job.documentId, job.branch),
+		scope: job.scope
+	};
+}
+function byStream(candidates) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const entry of candidates) {
+		const key = `${entry.stream.documentId}\u0000${entry.stream.scope}\u0000${entry.stream.branch}`;
+		const group = groups.get(key) ?? [entry.stream, []];
+		group[1].push(entry);
+		groups.set(key, group);
+	}
+	return [...groups.values()];
+}
+function isRetry(job) {
+	return job.errorHistory.length > 0 || (job.retryCount ?? 0) > 0;
+}
+function committedWrite(entry, opId) {
+	return {
+		...entry.stream,
+		actionId: entry.action.id,
+		opId
+	};
+}
+function isSuperseded(operation, later) {
+	return later.some((next) => next.index > operation.index && next.skip > 0 && next.index - next.skip <= operation.index);
+}
+function sameContent(stored, submitted) {
+	try {
+		return canonicalJson(stored) === canonicalJson(submitted);
+	} catch {
+		return false;
+	}
+}
 //#endregion
 //#region src/executor/simple-job-executor.ts
 const MAX_SKIP_THRESHOLD = 1e3;
@@ -3263,6 +3967,7 @@ function isValidISOTimestamp(value) {
 * every test expect a failed job to look like.
 */
 var JobRollbackSignal = class extends Error {
+	result;
 	constructor(result) {
 		super("job rolled back");
 		this.result = result;
@@ -3270,13 +3975,27 @@ var JobRollbackSignal = class extends Error {
 	}
 };
 var SimpleJobExecutor = class {
+	logger;
+	registry;
+	operationStore;
+	eventBus;
+	writeCache;
+	operationIndex;
+	documentMetaCache;
+	collectionMembershipCache;
+	driveContainerTypes;
 	config;
 	featureFlags;
 	decisionModel;
-	signatureVerifierModule;
+	signatureAdmission;
 	documentActionHandler;
 	executionScope;
-	constructor(logger, registry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, driveContainerTypes, config, signatureVerifier, executionScope) {
+	signer;
+	/**
+	* `signer` signs the operations the reducer synthesizes; unsigned if omitted.
+	* `trustPolicy` decides which keys may sign as which users at admission.
+	*/
+	constructor(logger, registry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, driveContainerTypes, config, executionScope, signer, trustPolicy) {
 		this.logger = logger;
 		this.registry = registry;
 		this.operationStore = operationStore;
@@ -3286,6 +4005,7 @@ var SimpleJobExecutor = class {
 		this.documentMetaCache = documentMetaCache;
 		this.collectionMembershipCache = collectionMembershipCache;
 		this.driveContainerTypes = driveContainerTypes;
+		this.signer = signer ?? new PassthroughSigner();
 		this.config = {
 			featureFlags: config.featureFlags ?? {},
 			maxSkipThreshold: config.maxSkipThreshold ?? MAX_SKIP_THRESHOLD,
@@ -3295,11 +4015,17 @@ var SimpleJobExecutor = class {
 			retryBaseDelayMs: config.retryBaseDelayMs ?? 100,
 			retryMaxDelayMs: config.retryMaxDelayMs ?? 5e3,
 			yieldDeadlineMs: config.yieldDeadlineMs ?? 50,
-			batchApplies: config.batchApplies ?? true
+			batchApplies: config.batchApplies ?? true,
+			signatureVerification: config.signatureVerification ?? "enforce"
 		};
 		this.featureFlags = resolveFeatureFlags(config.featureFlags);
 		this.decisionModel = selectDecisionModel(this.featureFlags, registry);
-		this.signatureVerifierModule = new SignatureVerifier(signatureVerifier);
+		this.signatureAdmission = new SignatureAdmission(this.config.signatureVerification, logger, eventBus, this.featureFlags.documentDecisions ? "write-cache" : "meta", {
+			signer: this.signer,
+			authEnforcement: this.featureFlags.authEnforcement,
+			policy: trustPolicy,
+			timeoutMs: Math.min(DEFAULT_TRUST_TIMEOUT_MS, this.config.jobTimeoutMs / 2)
+		});
 		this.documentActionHandler = new DocumentActionHandler(registry, logger, driveContainerTypes, this.featureFlags, this.decisionModel);
 		this.executionScope = executionScope ?? new DefaultExecutionScope(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache);
 	}
@@ -3429,10 +4155,29 @@ var SimpleJobExecutor = class {
 				pendingEvent
 			};
 		}
-		const positioned = await this.positionByTimestamp(job, stores, signal);
+		let admission;
+		try {
+			admission = await this.signatureAdmission.admitMutation(job, stores, signal);
+		} catch (error) {
+			return { result: buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime) };
+		}
+		if (admission.kind === "refused") return { result: buildErrorResult(job, admission.error, startTime) };
+		let committed;
+		try {
+			committed = await this.reloadCommitted(admission.committed, stores, signal);
+		} catch (error) {
+			return { result: buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime) };
+		}
+		const committedIds = new Set(admission.committed.map((write) => write.actionId));
+		const fresh = committedIds.size === 0 ? job : {
+			...job,
+			actions: job.actions.filter((action) => !committedIds.has(action.id))
+		};
+		if (fresh.actions.length === 0) return this.committedOutcome(job, committed, [], [], stores, startTime);
+		const positioned = await this.positionByTimestamp(fresh, stores, signal);
 		if (positioned.error) return { result: buildErrorResult(job, positioned.error, startTime) };
 		const executing = {
-			job,
+			job: fresh,
 			startTime,
 			indexTxn,
 			stores,
@@ -3462,13 +4207,23 @@ var SimpleJobExecutor = class {
 		} };
 		const ordinals = await stores.operationIndex.commit(indexTxn, signal);
 		postCommitMembershipInvalidations.push(...indexTxn.getMembershipInvalidations());
-		if (actionResult.operationsWithContext.length > 0) {
-			for (let i = 0; i < actionResult.operationsWithContext.length; i++) actionResult.operationsWithContext[i].context.ordinal = ordinals[i];
-			const collectionMemberships = await this.getCollectionMembershipsForOperations(actionResult.operationsWithContext, stores);
+		for (let i = 0; i < actionResult.operationsWithContext.length; i++) actionResult.operationsWithContext[i].context.ordinal = ordinals[i];
+		return this.committedOutcome(job, committed, actionResult.operationsWithContext, actionResult.generatedOperations, stores, startTime);
+	}
+	/**
+	* A successful mutation's result and the write-ready event it owes, carrying
+	* what earlier attempts committed ahead of what this one wrote.
+	*/
+	async committedOutcome(job, reloaded, written, generated, stores, startTime) {
+		const operationsWithContext = [...reloaded, ...written];
+		let pendingEvent;
+		if (operationsWithContext.length > 0) {
+			const collectionMemberships = await this.getCollectionMembershipsForOperations(operationsWithContext, stores);
 			pendingEvent = {
 				jobId: job.id,
-				operations: actionResult.operationsWithContext,
+				operations: operationsWithContext,
 				jobMeta: job.meta,
+				submittedActionIds: submittedActionIds(job),
 				collectionMemberships
 			};
 		}
@@ -3476,14 +4231,62 @@ var SimpleJobExecutor = class {
 			result: {
 				job,
 				success: true,
-				operations: actionResult.generatedOperations,
-				operationsWithContext: actionResult.operationsWithContext,
+				operations: [...reloaded.map((entry) => entry.operation), ...generated],
+				operationsWithContext,
 				duration: Date.now() - startTime
 			},
 			pendingEvent
 		};
 	}
 	/**
+	* The stored operations of writes an earlier attempt committed, as a fresh
+	* write would report them. State is rebuilt from the write cache, and left
+	* out when it cannot be.
+	*/
+	async reloadCommitted(writes, stores, signal) {
+		const streams = /* @__PURE__ */ new Map();
+		for (const write of writes) {
+			const key = `${write.documentId}\u0000${write.scope}\u0000${write.branch}`;
+			streams.set(key, [...streams.get(key) ?? [], write]);
+		}
+		const reloaded = [];
+		for (const group of streams.values()) {
+			const { documentId, scope, branch } = group[0];
+			const opIds = [...new Set(group.map((write) => write.opId))];
+			const operations = await stores.operationStore.getOperationsByIds(documentId, scope, branch, opIds, signal);
+			const ordinals = await stores.operationIndex.getOrdinalsByOpIds(documentId, scope, branch, opIds, signal);
+			const { documentType } = await stores.documentMetaCache.getDocumentMeta(documentId, branch, signal);
+			for (const operation of operations.sort((a, b) => a.index - b.index)) reloaded.push({
+				operation,
+				context: {
+					documentId,
+					scope,
+					branch,
+					documentType,
+					resultingState: await this.rebuiltState(stores, {
+						documentId,
+						scope,
+						branch
+					}, operation, signal),
+					ordinal: ordinals.get(operation.id) ?? 0
+				}
+			});
+		}
+		return reloaded;
+	}
+	async rebuiltState(stores, stream, operation, signal) {
+		try {
+			const document = await stores.writeCache.getState(stream.documentId, stream.scope, stream.branch, operation.index, signal);
+			return JSON.stringify({
+				...document.state,
+				header: document.header
+			});
+		} catch (error) {
+			this.logger.warn("No state for committed operation @OperationId in @Stream: @Error", operation.id, stream, error);
+			return;
+		}
+	}
+	/**
 	* Drops the cached state of every stream a job wrote, after its transaction
 	* did not commit.
 	*
@@ -3512,16 +4315,6 @@ var SimpleJobExecutor = class {
 		const actions = writes.map((write) => write.action);
 		const generatedOperations = [];
 		const operationsWithContext = [];
-		try {
-			await this.signatureVerifierModule.verifyActions(job.documentId, job.branch, actions);
-		} catch (error) {
-			return {
-				success: false,
-				generatedOperations,
-				operationsWithContext,
-				error: error instanceof Error ? error : new Error(String(error))
-			};
-		}
 		for (const action of actions) if (action.timestampUtcMs && !isValidISOTimestamp(action.timestampUtcMs)) return {
 			success: false,
 			generatedOperations,
@@ -3619,7 +4412,7 @@ var SimpleJobExecutor = class {
 			if (docMeta.state.isDeleted) return buildErrorResult(job, new DocumentDeletedError(job.documentId, docMeta.state.deletedAtUtcIso), startTime);
 			documentVersion = docMeta.state.version;
 		}
-		if (isUndoRedo(action) || action.type === "PRUNE" || skip > 0) stores.writeCache.invalidate(job.documentId, job.scope, job.branch);
+		if (isUndoRedo(action) || skip > 0) stores.writeCache.invalidate(job.documentId, job.scope, job.branch);
 		let document;
 		if (baseDocument !== void 0) document = baseDocument;
 		else try {
@@ -3679,7 +4472,7 @@ var SimpleJobExecutor = class {
 				branch: job.branch,
 				protocolVersion
 			};
-			updatedDocument = module.reducer(document, action, void 0, reducerOptions);
+			updatedDocument = withProtocolVersions(module.reducer(document, action, void 0, reducerOptions), document.header.protocolVersions);
 		} catch (error) {
 			const contextMessage = `Failed to apply action to document:\n  Action type: ${action.type}\n  Document ID: ${job.documentId}\n  Document type: ${document.header.documentType}\n  Scope: ${job.scope}\n  Original error: ${error instanceof Error ? error.message : String(error)}`;
 			const enhancedError = new Error(contextMessage);
@@ -3691,6 +4484,15 @@ var SimpleJobExecutor = class {
 		if (operations.length === 0) return buildErrorResult(job, /* @__PURE__ */ new Error("No operation generated from action"), startTime);
 		const newOperation = operations[operations.length - 1];
 		if (!isUndoRedo(action)) newOperation.skip = skip;
+		if (deniedReason === void 0 && sourceOperation === void 0 && !executing.replayingAcceptedHistory && isSynthesized(action, newOperation, document.operations[scope] ?? [])) try {
+			await signSynthesized(newOperation, action, {
+				documentId: job.documentId,
+				scope,
+				branch: job.branch
+			}, this.signer, signal);
+		} catch (error) {
+			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+		}
 		const resultingState = JSON.stringify({
 			...updatedDocument.state,
 			header: updatedDocument.header
@@ -3791,7 +4593,7 @@ var SimpleJobExecutor = class {
 	*   apply and its own reasons for it.
 	* - A positional or replayed run carries skips and re-appended operations,
 	*   whose indices are not a simple ascending run from the head.
-	* - UNDO, REDO, PRUNE and NOOP-with-skip each invalidate the write cache to
+	* - UNDO, REDO and NOOP-with-skip each invalidate the write cache to
 	*   force a full-history rebuild, so they cannot be reduced against state
 	*   threaded from the write before them.
 	* - The auth scope decides later writes against the policy earlier ones
@@ -3809,7 +4611,7 @@ var SimpleJobExecutor = class {
 		if (scope === "auth" || scope === "document") return false;
 		return writes.every((write) => {
 			const type = write.action.type;
-			return write.skip === 0 && write.deniedReason === void 0 && write.sourceOperation === void 0 && !DOCUMENT_SCOPE_ACTIONS.has(type) && !isUndoRedo(write.action) && type !== "PRUNE" && type !== "NOOP";
+			return write.skip === 0 && write.deniedReason === void 0 && write.sourceOperation === void 0 && !DOCUMENT_SCOPE_ACTIONS.has(type) && !isUndoRedo(write.action) && type !== "NOOP";
 		});
 	}
 	/**
@@ -3932,13 +4734,22 @@ var SimpleJobExecutor = class {
 		}
 		if (!backdated) return plain();
 		const conflicting = (await stores.operationStore.getConflicting(job.documentId, job.scope, job.branch, earliest, void 0, signal)).results.filter((operation) => !isGenesisOperation(operation));
-		if (conflicting.length === 0) {
+		const nothingToMove = async () => {
 			if (!this.featureFlags.authEnforcement) return plain();
 			return this.evaluatePositioned(job, stores, this.appendedOperations(job, revisions.revision[job.scope] ?? 0), signal);
-		}
+		};
+		if (conflicting.length === 0) return nothingToMove();
 		const nextIndex = revisions.revision[job.scope] ?? 0;
 		let firstConflicting = conflicting[0].index;
 		for (const operation of conflicting) if (operation.index < firstConflicting) firstConflicting = operation.index;
+		const stored = (await stores.operationStore.getSince(job.documentId, job.scope, job.branch, firstConflicting - 1, void 0, void 0, signal)).results;
+		const conflictingIds = new Set(conflicting.map((operation) => operation.id));
+		const effective = garbageCollect(sortOperations(stored)).filter((operation) => !isGenesisOperation(operation));
+		const firstMoving = effective.findIndex((operation) => conflictingIds.has(operation.id));
+		const moving = firstMoving === -1 ? [] : effective.slice(firstMoving);
+		if (moving.length === 0) return nothingToMove();
+		let firstRetracted = moving[0].index;
+		for (const operation of moving) firstRetracted = Math.min(firstRetracted, operation.index - operation.skip);
 		const incoming = job.actions.map((action, i) => ({
 			id: action.id,
 			index: nextIndex + i,
@@ -3949,8 +4760,8 @@ var SimpleJobExecutor = class {
 		}));
 		const merged = reshuffleByTimestamp({
 			index: nextIndex,
-			skip: retractionSkip(nextIndex, firstConflicting)
-		}, conflicting, incoming);
+			skip: retractionSkip(nextIndex, firstRetracted)
+		}, moving, incoming);
 		stores.writeCache.invalidate(job.documentId, job.scope, job.branch);
 		if (!this.featureFlags.authEnforcement) return {
 			writes: merged.map((operation) => ({
@@ -4098,7 +4909,7 @@ var SimpleJobExecutor = class {
 			stores.writeCache.invalidate(job.documentId, scope, job.branch);
 			const result = await this.processActions(tail.map((operation, i) => ({
 				action: operation.action,
-				skip: i === 0 ? retractionSkip(nextIndex, tail[0].index) : 0,
+				skip: i === 0 ? retractionSkip(nextIndex, tail[0].index - tail[0].skip) : 0,
 				sourceRemote: "",
 				deniedReason: reevaluated[firstChange + i]
 			})), {
@@ -4187,36 +4998,32 @@ var SimpleJobExecutor = class {
 			error: new InvalidOperationTimestampError(job.documentId, scope, operation.timestampUtcMs, `operation (index: ${operation.index})`),
 			duration: Date.now() - startTime
 		};
-		let minIncomingIndex = Number.POSITIVE_INFINITY;
-		let minIncomingTimestamp = job.operations[0]?.timestampUtcMs || "";
-		for (const operation of job.operations) {
-			minIncomingIndex = Math.min(minIncomingIndex, operation.index);
-			const ts = operation.timestampUtcMs || "";
-			if (Date.parse(ts) < Date.parse(minIncomingTimestamp)) minIncomingTimestamp = ts;
-		}
-		let conflictingOps;
-		try {
-			conflictingOps = (await stores.operationStore.getConflicting(job.documentId, scope, job.branch, minIncomingTimestamp, void 0, signal)).results;
-		} catch {
-			conflictingOps = [];
-		}
-		let allOpsFromMinConflictingIndex = conflictingOps;
-		if (conflictingOps.length > 0) {
-			const minConflictingIndex = Math.min(...conflictingOps.map((op) => op.index));
+		const dropped = /* @__PURE__ */ new Set();
+		const admitted = /* @__PURE__ */ new Set();
+		let selection = await this.selectLoadWrites(job, job.operations, stores, signal);
+		for (;;) {
+			const unadmitted = selection.incomingOpsToApply.filter((operation) => !admitted.has(operation));
+			if (unadmitted.length === 0) break;
+			let refused;
 			try {
-				allOpsFromMinConflictingIndex = (await stores.operationStore.getSince(job.documentId, scope, job.branch, minConflictingIndex - 1, void 0, void 0, signal)).results;
-			} catch {
-				allOpsFromMinConflictingIndex = conflictingOps;
+				refused = await this.signatureAdmission.admitLoad(job, unadmitted, stores, signal);
+			} catch (error) {
+				return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
 			}
+			for (const operation of unadmitted) if (refused.has(operation)) dropped.add(operation);
+			else admitted.add(operation);
+			if (refused.size === 0) break;
+			const remaining = job.operations.filter((operation) => !dropped.has(operation));
+			if (remaining.length === 0) return {
+				job,
+				success: true,
+				operations: [],
+				operationsWithContext: [],
+				duration: Date.now() - startTime
+			};
+			selection = await this.selectLoadWrites(job, remaining, stores, signal);
 		}
-		const incomingActionIds = new Set(job.operations.map((op) => op.action.id));
-		const nonSupersededOps = conflictingOps.filter((op) => {
-			if (op.index < minIncomingIndex && !incomingActionIds.has(op.action.id)) return false;
-			for (const laterOp of allOpsFromMinConflictingIndex) if (laterOp.index > op.index && laterOp.skip > 0) {
-				if (laterOp.index - laterOp.skip <= op.index) return false;
-			}
-			return true;
-		});
+		const { nonSupersededOps, allOpsFromMinConflictingIndex, incomingOpsToApply } = selection;
 		const existingOpsToReshuffle = monotonicAuthStream ? [] : nonSupersededOps.filter((operation) => !isGenesisOperation(operation));
 		const actionIdCounts = /* @__PURE__ */ new Map();
 		for (const operation of allOpsFromMinConflictingIndex) actionIdCounts.set(operation.action.id, (actionIdCounts.get(operation.action.id) ?? 0) + 1);
@@ -4237,14 +5044,6 @@ var SimpleJobExecutor = class {
 			const logicalSkip = latestRevision - minLogicalIndex;
 			if (logicalSkip > skipCount) skipCount = logicalSkip;
 		}
-		const existingActionIds = new Set(nonSupersededOps.map((op) => op.action.id));
-		const seenIncomingActionIds = /* @__PURE__ */ new Set();
-		const incomingOpsToApply = job.operations.filter((op) => {
-			if (existingActionIds.has(op.action.id)) return false;
-			if (seenIncomingActionIds.has(op.action.id)) return false;
-			seenIncomingActionIds.add(op.action.id);
-			return true;
-		});
 		if (incomingOpsToApply.length === 0) return {
 			job,
 			success: true,
@@ -4272,7 +5071,8 @@ var SimpleJobExecutor = class {
 			...operation,
 			id: operation.id
 		})));
-		for (const operation of reshuffledOperations) if (operation.action.type === "NOOP" && operation.skip === 0) operation.skip = 1;
+		const incomingIds = new Set(incomingOpsToApply.map((operation) => operation.action.id));
+		for (const operation of reshuffledOperations) if (operation.action.type === "NOOP" && operation.skip === 0 && incomingIds.has(operation.action.id)) operation.skip = 1;
 		let deniedReasons;
 		if (this.featureFlags.documentDecisions) try {
 			deniedReasons = await evaluateByPosition(this.decisionModel, {
@@ -4324,6 +5124,71 @@ var SimpleJobExecutor = class {
 			duration: Date.now() - startTime
 		};
 	}
+	/** The conflicting window a load opens, and which of its operations are new. */
+	async selectLoadWrites(job, operations, stores, signal) {
+		const scope = job.scope;
+		let minIncomingIndex = Number.POSITIVE_INFINITY;
+		let minIncomingTimestamp = operations[0]?.timestampUtcMs || "";
+		for (const operation of operations) {
+			minIncomingIndex = Math.min(minIncomingIndex, operation.index);
+			const ts = operation.timestampUtcMs || "";
+			if (Date.parse(ts) < Date.parse(minIncomingTimestamp)) minIncomingTimestamp = ts;
+		}
+		let conflictingOps;
+		try {
+			conflictingOps = (await stores.operationStore.getConflicting(job.documentId, scope, job.branch, minIncomingTimestamp, void 0, signal)).results;
+		} catch {
+			conflictingOps = [];
+		}
+		let allOpsFromMinConflictingIndex = conflictingOps;
+		if (conflictingOps.length > 0) {
+			const minConflictingIndex = Math.min(...conflictingOps.map((op) => op.index));
+			try {
+				allOpsFromMinConflictingIndex = (await stores.operationStore.getSince(job.documentId, scope, job.branch, minConflictingIndex - 1, void 0, void 0, signal)).results;
+			} catch {
+				allOpsFromMinConflictingIndex = conflictingOps;
+			}
+		}
+		const incomingActionIds = new Set(operations.map((op) => op.action.id));
+		const supersededBy = (op) => {
+			let nearest;
+			for (const laterOp of allOpsFromMinConflictingIndex) if (laterOp.index > op.index && laterOp.skip > 0 && laterOp.index - laterOp.skip <= op.index && (nearest === void 0 || laterOp.index < nearest.index)) nearest = laterOp;
+			return nearest;
+		};
+		const undoneActionIds = /* @__PURE__ */ new Set();
+		let predecessorBound = minIncomingIndex;
+		const rowsByActionId = /* @__PURE__ */ new Map();
+		for (const op of conflictingOps) if (incomingActionIds.has(op.action.id)) rowsByActionId.set(op.action.id, [...rowsByActionId.get(op.action.id) ?? [], op]);
+		const liveOps = /* @__PURE__ */ new Set();
+		for (const op of conflictingOps) if (supersededBy(op) === void 0) liveOps.add(op);
+		for (const [actionId, rows] of rowsByActionId) {
+			if (rows.some((row) => liveOps.has(row))) continue;
+			if (rows.some((row) => supersededBy(row)?.action.type === "NOOP")) undoneActionIds.add(actionId);
+			else predecessorBound = Math.min(predecessorBound, Math.max(...rows.map((row) => row.index)));
+		}
+		const nonSupersededOps = conflictingOps.filter((op) => {
+			if (op.index < predecessorBound && !incomingActionIds.has(op.action.id)) return false;
+			return liveOps.has(op);
+		});
+		let rewoundFrom = Number.POSITIVE_INFINITY;
+		for (const op of nonSupersededOps) if (!isGenesisOperation(op)) rewoundFrom = Math.min(rewoundFrom, op.index - op.skip);
+		const reappended = new Set(nonSupersededOps.map((op) => op.index));
+		for (const op of allOpsFromMinConflictingIndex) if (op.index >= rewoundFrom && !reappended.has(op.index) && supersededBy(op) === void 0) nonSupersededOps.push(op);
+		const existingActionIds = new Set(nonSupersededOps.map((op) => op.action.id));
+		const seenIncomingActionIds = /* @__PURE__ */ new Set();
+		const incomingOpsToApply = operations.filter((op) => {
+			if (existingActionIds.has(op.action.id)) return false;
+			if (undoneActionIds.has(op.action.id)) return false;
+			if (seenIncomingActionIds.has(op.action.id)) return false;
+			seenIncomingActionIds.add(op.action.id);
+			return true;
+		});
+		return {
+			nonSupersededOps,
+			allOpsFromMinConflictingIndex,
+			incomingOpsToApply
+		};
+	}
 	accumulateResultOrReturnError(result, generatedOperations, operationsWithContext) {
 		if (!result.success) return result;
 		if (result.operations && result.operations.length > 0) generatedOperations.push(...result.operations);
@@ -4470,6 +5335,7 @@ var DocumentModelRegistry = class {
 //#endregion
 //#region src/storage/kysely/keyframe-store.ts
 var KyselyKeyframeStore = class KyselyKeyframeStore {
+	db;
 	trx;
 	constructor(db) {
 		this.db = db;
@@ -4554,6 +5420,11 @@ function paginateRows(rows, paging, cursorOf, toItem, refetch) {
 //#endregion
 //#region src/storage/txn.ts
 var AtomicTransaction = class {
+	documentId;
+	documentType;
+	scope;
+	branch;
+	baseRevision;
 	operations = [];
 	constructor(documentId, documentType, scope, branch, baseRevision) {
 		this.documentId = documentId;
@@ -4587,6 +5458,11 @@ var AtomicTransaction = class {
 //#endregion
 //#region src/storage/kysely/store.ts
 var _UniqueConstraintContext = class extends Error {
+	documentId;
+	scope;
+	branch;
+	revision;
+	stagedOps;
 	constructor(documentId, scope, branch, revision, stagedOps) {
 		super("unique constraint");
 		this.documentId = documentId;
@@ -4598,6 +5474,7 @@ var _UniqueConstraintContext = class extends Error {
 	}
 };
 var KyselyOperationStore = class KyselyOperationStore {
+	db;
 	trx;
 	constructor(db) {
 		this.db = db;
@@ -4697,12 +5574,13 @@ var KyselyOperationStore = class KyselyOperationStore {
 	* otherwise read a snapshot taken before the locks were held.
 	*/
 	async acquireStreamLocks(trx, documentId, scope, branch, condition) {
-		const keys = new Set([`${documentId}:${scope}:${branch}`]);
+		const keys = /* @__PURE__ */ new Set([`${documentId}:${scope}:${branch}`]);
 		for (const stream of condition.streams) keys.add(`${stream.documentId}:${stream.scope}:${stream.branch}`);
+		const sortedKeys = sql.join([...keys].sort());
 		await sql`
       with ordered as materialized (
         select key
-        from unnest(array[${sql.join([...keys].sort())}]::text[]) with ordinality as t(key, ord)
+        from unnest(array[${sortedKeys}]::text[]) with ordinality as t(key, ord)
         order by ord
       )
       select pg_advisory_xact_lock(hashtext(key)) from ordered
@@ -4779,6 +5657,14 @@ var KyselyOperationStore = class KyselyOperationStore {
 		}
 		return false;
 	}
+	/**
+	* The paging cursor here encodes the index to resume from (one past the
+	* last row returned), not the last row's own index. This keeps "0" an
+	* unambiguous start-of-stream sentinel even when a page ends at index 0
+	* (e.g. `limit: 1` on a fresh stream), which would otherwise make
+	* `nextCursor` equal the start cursor and loop a caller that walks pages
+	* forever.
+	*/
 	async getSince(documentId, scope, branch, revision, filter, paging, signal) {
 		throwIfAborted(signal);
 		let query = this.queryExecutor.selectFrom("Operation").selectAll().where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).where("index", ">", revision).orderBy("index", "asc");
@@ -4793,10 +5679,10 @@ var KyselyOperationStore = class KyselyOperationStore {
 		}
 		if (paging) {
 			const cursorValue = Number.parseInt(paging.cursor, 10);
-			if (cursorValue > 0) query = query.where("index", ">", cursorValue);
+			if (Number.isFinite(cursorValue) && cursorValue > 0) query = query.where("index", ">=", cursorValue);
 			if (paging.limit) query = query.limit(paging.limit + 1);
 		}
-		return paginateRows(await query.execute(), paging, (row) => row.index, (row) => this.rowToOperation(row), (cursor, limit) => this.getSince(documentId, scope, branch, revision, filter, {
+		return paginateRows(await query.execute(), paging, (row) => row.index + 1, (row) => this.rowToOperation(row), (cursor, limit) => this.getSince(documentId, scope, branch, revision, filter, {
 			cursor,
 			limit
 		}, signal));
@@ -4814,26 +5700,28 @@ var KyselyOperationStore = class KyselyOperationStore {
 			limit
 		}, signal));
 	}
+	/**
+	* The paging cursor here encodes the index to resume from (one past the
+	* last row returned), not the last row's own index, for the same reason as
+	* `getSince`: a page ending at index 0 must not produce a cursor that is
+	* indistinguishable from the start-of-stream sentinel.
+	*/
 	async getConflicting(documentId, scope, branch, minTimestamp, paging, signal) {
 		throwIfAborted(signal);
 		let query = this.queryExecutor.selectFrom("Operation").selectAll().where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).where("timestampUtcMs", ">=", new Date(minTimestamp)).orderBy("index", "asc");
 		if (paging) {
 			const cursorValue = Number.parseInt(paging.cursor, 10);
-			if (cursorValue > 0) query = query.where("index", ">", cursorValue);
+			if (Number.isFinite(cursorValue) && cursorValue > 0) query = query.where("index", ">=", cursorValue);
 			if (paging.limit) query = query.limit(paging.limit + 1);
 		}
-		return paginateRows(await query.execute(), paging, (row) => row.index, (row) => this.rowToOperation(row), (cursor, limit) => this.getConflicting(documentId, scope, branch, minTimestamp, {
+		return paginateRows(await query.execute(), paging, (row) => row.index + 1, (row) => this.rowToOperation(row), (cursor, limit) => this.getConflicting(documentId, scope, branch, minTimestamp, {
 			cursor,
 			limit
 		}, signal));
 	}
 	async getRevisions(documentId, branch, signal) {
 		throwIfAborted(signal);
-		const scopeRevisions = await this.queryExecutor.selectFrom("Operation as o1").select([
-			"o1.scope",
-			"o1.index",
-			"o1.timestampUtcMs"
-		]).where("o1.documentId", "=", documentId).where("o1.branch", "=", branch).where((eb) => eb("o1.index", "=", eb.selectFrom("Operation as o2").select((eb2) => eb2.fn.max("o2.index").as("maxIndex")).where("o2.documentId", "=", eb.ref("o1.documentId")).where("o2.branch", "=", eb.ref("o1.branch")).where("o2.scope", "=", eb.ref("o1.scope")))).execute();
+		const scopeRevisions = await this.queryExecutor.selectFrom("Operation").select("scope").select((eb) => eb.fn.max("index").as("index")).where("documentId", "=", documentId).where("branch", "=", branch).groupBy("scope").execute();
 		const latest = await this.queryExecutor.selectFrom("Operation").select((eb) => eb.fn.max("timestampUtcMs").as("latestTimestamp")).where("documentId", "=", documentId).where("branch", "=", branch).executeTakeFirst();
 		const revision = {};
 		for (const row of scopeRevisions) revision[row.scope] = row.index + 1;
@@ -4846,6 +5734,20 @@ var KyselyOperationStore = class KyselyOperationStore {
 		const latest = await this.queryExecutor.selectFrom("Operation").select((eb) => eb.fn.max("timestampUtcMs").as("latestTimestamp")).where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).executeTakeFirst();
 		return latest?.latestTimestamp ? new Date(latest.latestTimestamp).toISOString() : void 0;
 	}
+	async findOperationIds(documentId, scope, branch, opIds, signal) {
+		throwIfAborted(signal);
+		if (opIds.length === 0) return /* @__PURE__ */ new Set();
+		const rows = await this.queryExecutor.selectFrom("Operation").select("opId").distinct().where("opId", "in", opIds).where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).execute();
+		return new Set(rows.map((row) => row.opId));
+	}
+	async getOperationsByIds(documentId, scope, branch, opIds, signal) {
+		throwIfAborted(signal);
+		if (opIds.length === 0) return [];
+		const rows = await this.queryExecutor.selectFrom("Operation").selectAll().where("opId", "in", opIds).where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).orderBy("index", "asc").execute();
+		const latest = /* @__PURE__ */ new Map();
+		for (const row of rows) latest.set(row.opId, this.rowToOperation(row));
+		return [...latest.values()];
+	}
 	rowToOperation(row) {
 		return {
 			index: row.index,
@@ -4939,8 +5841,8 @@ function createForwardingPoolInstrumentation(name) {
 }
 //#endregion
 //#region src/storage/migrations/001_create_operation_table.ts
-var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$18 });
-async function up$18(db) {
+var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$19 });
+async function up$19(db) {
 	await db.schema.createTable("Operation").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("jobId", "text", (col) => col.notNull()).addColumn("opId", "text", (col) => col.notNull()).addColumn("prevOpId", "text", (col) => col.notNull()).addColumn("writeTimestampUtcMs", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("timestampUtcMs", "timestamptz", (col) => col.notNull()).addColumn("index", "integer", (col) => col.notNull()).addColumn("action", "jsonb", (col) => col.notNull()).addColumn("skip", "integer", (col) => col.notNull()).addColumn("error", "text").addColumn("hash", "text", (col) => col.notNull()).addUniqueConstraint("unique_revision", [
 		"documentId",
 		"scope",
@@ -4965,8 +5867,8 @@ async function up$18(db) {
 }
 //#endregion
 //#region src/storage/migrations/002_create_keyframe_table.ts
-var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$17 });
-async function up$17(db) {
+var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$18 });
+async function up$18(db) {
 	await db.schema.createTable("Keyframe").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("revision", "integer", (col) => col.notNull()).addColumn("document", "jsonb", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_keyframe", [
 		"documentId",
 		"scope",
@@ -4982,14 +5884,14 @@ async function up$17(db) {
 }
 //#endregion
 //#region src/storage/migrations/003_create_document_table.ts
-var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$16 });
-async function up$16(db) {
+var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$17 });
+async function up$17(db) {
 	await db.schema.createTable("Document").addColumn("id", "text", (col) => col.primaryKey()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/004_create_document_relationship_table.ts
-var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$15 });
-async function up$15(db) {
+var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$16 });
+async function up$16(db) {
 	await db.schema.createTable("DocumentRelationship").addColumn("id", "text", (col) => col.primaryKey()).addColumn("sourceId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("targetId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("relationshipType", "text", (col) => col.notNull()).addColumn("metadata", "jsonb").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_source_target_type", [
 		"sourceId",
 		"targetId",
@@ -5001,14 +5903,14 @@ async function up$15(db) {
 }
 //#endregion
 //#region src/storage/migrations/005_create_indexer_state_table.ts
-var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$14 });
-async function up$14(db) {
+var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$15 });
+async function up$15(db) {
 	await db.schema.createTable("IndexerState").addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity()).addColumn("lastOperationId", "integer", (col) => col.notNull()).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/006_create_document_snapshot_table.ts
-var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
-async function up$13(db) {
+var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$14 });
+async function up$14(db) {
 	await db.schema.createTable("DocumentSnapshot").addColumn("id", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("slug", "text").addColumn("name", "text").addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("content", "jsonb", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("lastOperationIndex", "integer", (col) => col.notNull()).addColumn("lastOperationHash", "text", (col) => col.notNull()).addColumn("lastUpdatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("snapshotVersion", "integer", (col) => col.notNull().defaultTo(1)).addColumn("identifiers", "jsonb").addColumn("metadata", "jsonb").addColumn("isDeleted", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("deletedAt", "timestamptz").addUniqueConstraint("unique_doc_scope_branch", [
 		"documentId",
 		"scope",
@@ -5029,8 +5931,8 @@ async function up$13(db) {
 }
 //#endregion
 //#region src/storage/migrations/007_create_slug_mapping_table.ts
-var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$12 });
-async function up$12(db) {
+var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
+async function up$13(db) {
 	await db.schema.createTable("SlugMapping").addColumn("slug", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_docid_scope_branch", [
 		"documentId",
 		"scope",
@@ -5040,14 +5942,14 @@ async function up$12(db) {
 }
 //#endregion
 //#region src/storage/migrations/008_create_view_state_table.ts
-var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$11 });
-async function up$11(db) {
+var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$12 });
+async function up$12(db) {
 	await db.schema.createTable("ViewState").addColumn("readModelId", "text", (col) => col.primaryKey()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(0)).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/009_create_operation_index_tables.ts
-var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$10 });
-async function up$10(db) {
+var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$11 });
+async function up$11(db) {
 	await db.schema.createTable("document_collections").addColumn("documentId", "text", (col) => col.notNull()).addColumn("collectionId", "text", (col) => col.notNull()).addColumn("joinedOrdinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("leftOrdinal", "bigint").addPrimaryKeyConstraint("document_collections_pkey", ["documentId", "collectionId"]).execute();
 	await db.schema.createIndex("idx_document_collections_collectionId").on("document_collections").column("collectionId").execute();
 	await db.schema.createIndex("idx_doc_collections_collection_range").on("document_collections").columns(["collectionId", "joinedOrdinal"]).execute();
@@ -5061,8 +5963,8 @@ async function up$10(db) {
 }
 //#endregion
 //#region src/storage/migrations/010_create_sync_tables.ts
-var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$9 });
-async function up$9(db) {
+var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$10 });
+async function up$10(db) {
 	await db.schema.createTable("sync_remotes").addColumn("name", "text", (col) => col.primaryKey()).addColumn("collection_id", "text", (col) => col.notNull()).addColumn("channel_type", "text", (col) => col.notNull()).addColumn("channel_id", "text", (col) => col.notNull().defaultTo("")).addColumn("remote_name", "text", (col) => col.notNull().defaultTo("")).addColumn("channel_parameters", "jsonb", (col) => col.notNull().defaultTo(sql`'{}'::jsonb`)).addColumn("filter_document_ids", "jsonb").addColumn("filter_scopes", "jsonb").addColumn("filter_branch", "text", (col) => col.notNull().defaultTo("main")).addColumn("push_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("push_last_success_utc_ms", "text").addColumn("push_last_failure_utc_ms", "text").addColumn("push_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("pull_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("pull_last_success_utc_ms", "text").addColumn("pull_last_failure_utc_ms", "text").addColumn("pull_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 	await db.schema.createIndex("idx_sync_remotes_collection").on("sync_remotes").column("collection_id").execute();
 	await db.schema.createTable("sync_cursors").addColumn("remote_name", "text", (col) => col.primaryKey().references("sync_remotes.name").onDelete("cascade")).addColumn("cursor_ordinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("last_synced_at_utc_ms", "text").addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
@@ -5070,8 +5972,8 @@ async function up$9(db) {
 }
 //#endregion
 //#region src/storage/migrations/011_add_cursor_type_column.ts
-var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$8 });
-async function up$8(db) {
+var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$9 });
+async function up$9(db) {
 	await db.deleteFrom("sync_cursors").where("remote_name", "like", "outbox::%").execute();
 	await db.deleteFrom("sync_remotes").where("name", "like", "outbox::%").execute();
 	await db.schema.dropTable("sync_cursors").execute();
@@ -5080,64 +5982,64 @@ async function up$8(db) {
 }
 //#endregion
 //#region src/storage/migrations/012_add_source_remote_column.ts
-var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$7 });
-async function up$7(db) {
+var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$8 });
+async function up$8(db) {
 	await db.schema.alterTable("operation_index_operations").addColumn("sourceRemote", "text", (col) => col.notNull().defaultTo("")).execute();
 }
 //#endregion
 //#region src/storage/migrations/013_create_sync_dead_letters_table.ts
-var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$6 });
-async function up$6(db) {
+var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$7 });
+async function up$7(db) {
 	await db.schema.createTable("sync_dead_letters").addColumn("ordinal", "serial", (col) => col.primaryKey()).addColumn("id", "text", (col) => col.unique().notNull()).addColumn("job_id", "text", (col) => col.notNull()).addColumn("job_dependencies", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("remote_name", "text", (col) => col.notNull().references("sync_remotes.name").onDelete("cascade")).addColumn("document_id", "text", (col) => col.notNull()).addColumn("scopes", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("branch", "text", (col) => col.notNull()).addColumn("operations", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("error_source", "text", (col) => col.notNull()).addColumn("error_message", "text", (col) => col.notNull()).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 	await db.schema.createIndex("idx_sync_dead_letters_remote").on("sync_dead_letters").column("remote_name").execute();
 }
 //#endregion
 //#region src/storage/migrations/014_create_processor_cursor_table.ts
-var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$5 });
-async function up$5(db) {
+var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$6 });
+async function up$6(db) {
 	await db.schema.createTable("ProcessorCursor").addColumn("processorId", "text", (col) => col.primaryKey()).addColumn("factoryId", "text", (col) => col.notNull()).addColumn("driveId", "text", (col) => col.notNull()).addColumn("processorIndex", "integer", (col) => col.notNull()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(sql`0`)).addColumn("status", "text", (col) => col.notNull().defaultTo(sql`'active'`)).addColumn("lastError", "text").addColumn("lastErrorTimestamp", "timestamptz").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/015_add_operation_denied_reason.ts
 var _015_add_operation_denied_reason_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$4,
-	up: () => up$4
+	down: () => down$5,
+	up: () => up$5
 });
 /**
 * Records why authorization refused an operation. Separate from `error` so a
 * denial is distinguishable from a reducer failure without matching on a
 * message. Null for every operation written before decisions were enforced.
 */
-async function up$4(db) {
+async function up$5(db) {
 	await db.schema.alterTable("Operation").addColumn("deniedReason", "text").execute();
 	await db.schema.alterTable("operation_index_operations").addColumn("deniedReason", "text").execute();
 }
-async function down$4(db) {
+async function down$5(db) {
 	await db.schema.alterTable("operation_index_operations").dropColumn("deniedReason").execute();
 	await db.schema.alterTable("Operation").dropColumn("deniedReason").execute();
 }
 //#endregion
 //#region src/storage/migrations/016_add_dead_letter_error_type.ts
 var _016_add_dead_letter_error_type_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$3,
-	up: () => up$3
+	down: () => down$4,
+	up: () => up$4
 });
 /**
 * The classification a dead letter falls into, stored because it decides whether
 * the document stays quarantined and the in-memory error is gone after a restart.
 * Defaulted rather than nullable, so a pre-existing row rehydrates.
 */
-async function up$3(db) {
+async function up$4(db) {
 	await db.schema.alterTable("sync_dead_letters").addColumn("error_type", "text", (col) => col.notNull().defaultTo("UNCLASSIFIED")).execute();
 }
-async function down$3(db) {
+async function down$4(db) {
 	await db.schema.alterTable("sync_dead_letters").dropColumn("error_type").execute();
 }
 //#endregion
 //#region src/storage/migrations/017_create_group_references.ts
 var _017_create_group_references_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$2,
-	up: () => up$2
+	down: () => down$3,
+	up: () => up$3
 });
 /**
 * One row per (document, group) reference ever discovered from an auth
@@ -5148,18 +6050,18 @@ var _017_create_group_references_exports = /* @__PURE__ */ __exportAll({
 * requires (sync), and by groupId for the documents a group change affects
 * (re-evaluation).
 */
-async function up$2(db) {
+async function up$3(db) {
 	await db.schema.createTable("group_references").addColumn("documentId", "text", (col) => col.notNull()).addColumn("groupId", "text", (col) => col.notNull()).addPrimaryKeyConstraint("group_references_pkey", ["documentId", "groupId"]).execute();
 	await db.schema.createIndex("idx_group_references_groupId").on("group_references").column("groupId").execute();
 }
-async function down$2(db) {
+async function down$3(db) {
 	await db.schema.dropTable("group_references").execute();
 }
 //#endregion
 //#region src/storage/migrations/018_add_sync_remote_bound_address.ts
 var _018_add_sync_remote_bound_address_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$2,
+	up: () => up$2
 });
 /**
 * The address a sync channel is bound to, so a channel created by one subject
@@ -5170,17 +6072,17 @@ var _018_add_sync_remote_bound_address_exports = /* @__PURE__ */ __exportAll({
 * until its first authenticated poll adopts it. A default would claim them all
 * for one address.
 */
-async function up$1(db) {
+async function up$2(db) {
 	await db.schema.alterTable("sync_remotes").addColumn("bound_address", "text").execute();
 }
-async function down$1(db) {
+async function down$2(db) {
 	await db.schema.alterTable("sync_remotes").dropColumn("bound_address").execute();
 }
 //#endregion
 //#region src/storage/migrations/019_require_action_id.ts
 var _019_require_action_id_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$1,
+	up: () => up$1
 });
 /**
 * Makes an operation whose action carries no id physically unstorable.
@@ -5207,7 +6109,7 @@ var _019_require_action_id_exports = /* @__PURE__ */ __exportAll({
 * The empty string is rejected alongside null. It derives the same colliding
 * operation id as an absent id, so admitting it would leave the hole open.
 */
-async function up(db) {
+async function up$1(db) {
 	await db.updateTable("Operation").set({ action: sql`jsonb_set(action, '{id}', to_jsonb(gen_random_uuid()::text))` }).where(sql`jsonb_typeof(action) = 'object' and coalesce(action->>'id', '') = ''`).execute();
 	await db.updateTable("operation_index_operations as oio").from("Operation as op").set({ action: sql`jsonb_set(oio.action, '{id}', to_jsonb(op.action->>'id'))` }).whereRef("oio.opId", "=", "op.opId").whereRef("oio.index", "=", "op.index").whereRef("oio.skip", "=", "op.skip").where(sql`jsonb_typeof(oio.action) = 'object' and coalesce(oio.action->>'id', '') = ''`).where(sql`coalesce(op.action->>'id', '') <> ''`).execute();
 	await db.updateTable("operation_index_operations").set({ action: sql`jsonb_set(action, '{id}', to_jsonb(gen_random_uuid()::text))` }).where(sql`jsonb_typeof(action) = 'object' and coalesce(action->>'id', '') = ''`).execute();
@@ -5219,11 +6121,24 @@ async function up(db) {
 * their operations are now known by, and reverting them would reintroduce the
 * collision the migration removed.
 */
-async function down(db) {
+async function down$1(db) {
 	await db.schema.alterTable("operation_index_operations").dropConstraint("action_must_have_id").execute();
 	await db.schema.alterTable("Operation").dropConstraint("action_must_have_id").execute();
 }
 //#endregion
+//#region src/storage/migrations/020_add_snapshot_operation_ordinal.ts
+var _020_add_snapshot_operation_ordinal_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/** Orders header row writes across scopes; `lastOperationIndex` is per scope. */
+async function up(db) {
+	await db.schema.alterTable("DocumentSnapshot").addColumn("lastOperationOrdinal", "integer", (col) => col.notNull().defaultTo(0)).execute();
+}
+async function down(db) {
+	await db.schema.alterTable("DocumentSnapshot").dropColumn("lastOperationOrdinal").execute();
+}
+//#endregion
 //#region src/storage/migrations/migrator.ts
 const REACTOR_SCHEMA = "reactor";
 const migrations = {
@@ -5245,7 +6160,8 @@ const migrations = {
 	"016_add_dead_letter_error_type": _016_add_dead_letter_error_type_exports,
 	"017_create_group_references": _017_create_group_references_exports,
 	"018_add_sync_remote_bound_address": _018_add_sync_remote_bound_address_exports,
-	"019_require_action_id": _019_require_action_id_exports
+	"019_require_action_id": _019_require_action_id_exports,
+	"020_add_snapshot_operation_ordinal": _020_add_snapshot_operation_ordinal_exports
 };
 var ProgrammaticMigrationProvider = class {
 	getMigrations() {
@@ -5303,8 +6219,148 @@ async function getMigrationStatus(db, schema = REACTOR_SCHEMA) {
 }
 //#endregion
 //#region src/core/drive-container-types.ts
-const DEFAULT_DRIVE_CONTAINER_TYPES = new Set(["powerhouse/document-drive", "powerhouse/reactor-drive"]);
+const DEFAULT_DRIVE_CONTAINER_TYPES = /* @__PURE__ */ new Set(["powerhouse/document-drive", "powerhouse/reactor-drive"]);
+//#endregion
+//#region src/executor/worker/error-info.ts
+const MAX_STACK_LENGTH = 8192;
+const MAX_CAUSE_DEPTH = 8;
+function toErrorInfo(err, depth = 0) {
+	if (depth > MAX_CAUSE_DEPTH) return {
+		name: "Error",
+		message: "cause chain truncated"
+	};
+	if (err instanceof Error) {
+		const info = {
+			name: err.name || "Error",
+			message: err.message
+		};
+		if (typeof err.stack === "string") info.stack = err.stack.length > MAX_STACK_LENGTH ? err.stack.slice(0, MAX_STACK_LENGTH) : err.stack;
+		if (err.cause !== void 0) info.cause = toErrorInfo(err.cause, depth + 1);
+		return info;
+	}
+	if (typeof err === "string") return {
+		name: "Error",
+		message: err
+	};
+	if (err && typeof err === "object") {
+		const record = err;
+		return {
+			name: typeof record.name === "string" ? record.name : "Error",
+			message: typeof record.message === "string" ? record.message : safeStringify(err)
+		};
+	}
+	return {
+		name: "Error",
+		message: safeStringify(err)
+	};
+}
+function safeStringify(value) {
+	if (value === null || value === void 0) return String(value);
+	if (typeof value === "string") return value;
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	try {
+		return JSON.stringify(value);
+	} catch {
+		return "[unserializable]";
+	}
+}
+function fromErrorInfo(info) {
+	const err = new Error(info.message);
+	Object.defineProperty(err, "name", {
+		value: info.name,
+		configurable: true,
+		writable: true
+	});
+	if (info.stack !== void 0) err.stack = info.stack;
+	if (info.cause !== void 0) Object.defineProperty(err, "cause", {
+		value: fromErrorInfo(info.cause),
+		configurable: true,
+		writable: true
+	});
+	return err;
+}
+//#endregion
+//#region src/executor/worker/sanitize.ts
+const MAX_DEPTH = 8;
+function errorToInfo(err) {
+	return toErrorInfo(err);
+}
+function sanitizeArg(value, depth = 0, seen = /* @__PURE__ */ new WeakSet()) {
+	if (depth > MAX_DEPTH) return "[Truncated]";
+	if (value === null || value === void 0) return null;
+	if (typeof value === "boolean") return value;
+	if (typeof value === "number") return value;
+	if (typeof value === "string") return value;
+	if (typeof value === "bigint") return value.toString();
+	if (typeof value === "function" || typeof value === "symbol") return null;
+	if (value instanceof Error) return toErrorInfo(value);
+	if (value instanceof Date) return value.toISOString();
+	if (value instanceof Map) {
+		const obj = {};
+		for (const [k, v] of value.entries()) obj[String(k)] = sanitizeArg(v, depth + 1, seen);
+		return obj;
+	}
+	if (value instanceof Set) {
+		const arr = [];
+		for (const v of value.values()) arr.push(sanitizeArg(v, depth + 1, seen));
+		return arr;
+	}
+	if (Array.isArray(value)) {
+		if (seen.has(value)) return "[Circular]";
+		seen.add(value);
+		const result = value.map((v) => sanitizeArg(v, depth + 1, seen));
+		seen.delete(value);
+		return result;
+	}
+	if (typeof value === "object") {
+		const proto = Object.getPrototypeOf(value);
+		if (proto !== Object.prototype && proto !== null) return { __nonClonable: value.constructor?.name || "Unknown" };
+		if (seen.has(value)) return "[Circular]";
+		seen.add(value);
+		const result = {};
+		for (const [k, v] of Object.entries(value)) result[k] = sanitizeArg(v, depth + 1, seen);
+		seen.delete(value);
+		return result;
+	}
+	return null;
+}
+//#endregion
+//#region src/executor/worker/forwarding-logger.ts
+function createForwardingLogger(post, level = "info", tags = []) {
+	function safePost(msg) {
+		try {
+			post(msg);
+		} catch {
+			try {
+				process.stderr.write(`[forwarding-logger] postMessage failed: ${msg.level} ${msg.message}\n`);
+			} catch {}
+		}
+	}
+	function emit(wireLevel, message, args) {
+		const sanitizedArgs = args.map((a) => sanitizeArg(a));
+		safePost({
+			type: "log",
+			level: wireLevel,
+			message,
+			args: tags.length > 0 ? [sanitizeArg({ tags }), ...sanitizedArgs] : sanitizedArgs,
+			timestamp: Date.now()
+		});
+	}
+	return {
+		level,
+		verbose: (message, ...args) => emit("debug", message, args),
+		debug: (message, ...args) => emit("debug", message, args),
+		info: (message, ...args) => emit("info", message, args),
+		warn: (message, ...args) => emit("warn", message, args),
+		error: (message, ...args) => emit("error", message, args),
+		errorHandler: ((...data) => {
+			const first = data[0];
+			emit("error", typeof first === "string" ? first : "", data.slice(1));
+		}),
+		child: (childTags) => createForwardingLogger(post, level, [...tags, ...childTags])
+	};
+}
 //#endregion
-export { selectDecisionModel as A, RevisionMismatchError as B, InvalidModuleError as C, createEmptyConsistencyToken as D, createConsistencyToken as E, AppendConditionFailedError as F, DocumentNotFoundError as G, AuthTimestampNotMonotonicError as H, DocumentAlreadyExistsError as I, UpgradePreconditionFailedError as J, ExcessiveReshuffleError as K, DocumentExistence as L, authDecisionModel as M, buildDecisionModel as N, targetDocumentId as O, APPEND_CONDITION_FAILED_PREFIX as P, __exportAll as Q, DuplicateOperationError as R, DuplicateModuleError as S, GATED_DOCUMENT_ACTIONS as T, AuthorizationDeniedError as U, AuthEnforcementDisabledError as V, DocumentDeletedError as W, parsePagingOptions as X, matchesScope as Y, throwIfAborted as Z, DocumentMetaCache as _, createForwardingPoolInstrumentation as a, JobExecutorEventTypes as b, KyselyKeyframeStore as c, DriveCollectionId as d, KyselyExecutionScope as f, KyselyOperationIndex as g, KyselyWriteCache as h, runMigrations as i, documentDecisionModel as j, decideAtHead as k, DocumentModelRegistry as l, EventBus as m, REACTOR_SCHEMA as n, instrumentPgPool as o, resolveFeatureFlags as p, InvalidOperationTimestampError as q, getMigrationStatus as r, KyselyOperationStore as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, SimpleJobExecutor as u, CollectionMembershipCache as v, ModuleNotFoundError as w, DuplicateManifestError as x, DEFAULT_DEFERRED_JOB_TTL_MS as y, OptimisticLockError as z };
+export { DocumentNotFoundError as $, ModuleNotFoundError as A, authDecisionModel as B, DocumentMetaCache as C, DuplicateManifestError as D, JobExecutorEventTypes as E, summarizeSubmittedActions as F, DocumentExistence as G, APPEND_CONDITION_FAILED_PREFIX as H, targetDocumentId as I, RevisionMismatchError as J, DuplicateOperationError as K, decideAtHead as L, createConsistencyToken as M, createEmptyConsistencyToken as N, DuplicateModuleError as O, submittedActionIds as P, DocumentDeletedError as Q, selectDecisionModel as R, KyselyOperationIndex as S, DEFAULT_DEFERRED_JOB_TTL_MS as T, AppendConditionFailedError as U, buildDecisionModel as V, DocumentAlreadyExistsError as W, AuthTimestampNotMonotonicError as X, AuthEnforcementDisabledError as Y, AuthorizationDeniedError as Z, DriveCollectionId as _, DEFAULT_DRIVE_CONTAINER_TYPES as a, EventBusAggregateError as at, EventBus as b, runMigrations as c, parsePagingOptions as ct, KyselyOperationStore as d, __exportAll as dt, ExcessiveReshuffleError as et, KyselyKeyframeStore as f, PassthroughSigner as g, verifyActionSignature as h, fromErrorInfo as i, UpgradePreconditionFailedError as it, GATED_DOCUMENT_ACTIONS as j, InvalidModuleError as k, createForwardingPoolInstrumentation as l, throwIfAborted as lt, SimpleJobExecutor as m, errorToInfo as n, InvalidSignatureError as nt, REACTOR_SCHEMA as o, ReactorEventTypes as ot, DocumentModelRegistry as p, OptimisticLockError as q, sanitizeArg as r, RelationshipNotFoundError as rt, getMigrationStatus as s, matchesScope as st, createForwardingLogger as t, InvalidOperationTimestampError as tt, instrumentPgPool as u, yieldToMain as ut, KyselyExecutionScope as v, CollectionMembershipCache as w, KyselyWriteCache as x, resolveFeatureFlags as y, documentDecisionModel as z };
 
-//# sourceMappingURL=drive-container-types-yZrksiJR.js.map
+//# sourceMappingURL=forwarding-logger-CnuVDVze.js.map