@powerhousedao/reactor 6.2.3-dev.3 → 6.2.3-dev.31

package/dist/index.js

@@ -1,10 +1,7 @@
-import { A as selectDecisionModel, B as RevisionMismatchError, C as InvalidModuleError, D as createEmptyConsistencyToken, E as createConsistencyToken, F as AppendConditionFailedError, G as DocumentNotFoundError, H as AuthTimestampNotMonotonicError, I as DocumentAlreadyExistsError, J as UpgradePreconditionFailedError, K as ExcessiveReshuffleError, L as DocumentExistence, M as authDecisionModel, N as buildDecisionModel, O as targetDocumentId, P as APPEND_CONDITION_FAILED_PREFIX, R as DuplicateOperationError, S as DuplicateModuleError, T as GATED_DOCUMENT_ACTIONS, U as AuthorizationDeniedError, V as AuthEnforcementDisabledError, W as DocumentDeletedError, X as parsePagingOptions, Y as matchesScope, Z as throwIfAborted, _ as DocumentMetaCache, a as createForwardingPoolInstrumentation, b as JobExecutorEventTypes, c as KyselyKeyframeStore, d as DriveCollectionId, f as KyselyExecutionScope, g as KyselyOperationIndex, h as KyselyWriteCache, i as runMigrations, j as documentDecisionModel, k as decideAtHead, l as DocumentModelRegistry, m as EventBus, n as REACTOR_SCHEMA, o as instrumentPgPool, p as resolveFeatureFlags, q as InvalidOperationTimestampError, r as getMigrationStatus, s as KyselyOperationStore, t as DEFAULT_DRIVE_CONTAINER_TYPES, u as SimpleJobExecutor, v as CollectionMembershipCache, w as ModuleNotFoundError, x as DuplicateManifestError, y as DEFAULT_DEFERRED_JOB_TTL_MS, z as OptimisticLockError } from "./drive-container-types-yZrksiJR.js";
-import { n as ReactorEventTypes, t as EventBusAggregateError } from "./types-DMKLa0Ok.js";
-import { i as WorkerInitFailedError, r as WorkerExitedError, t as WorkerAbortTimeoutError } from "./errors-D3S6Eysd.js";
-import { a as DOCUMENT_INDEXER_READ_MODEL, c as BaseReadModel, i as KyselyDocumentView, n as ConsistencyTracker, o as DOCUMENT_VIEW_READ_MODEL, r as makeConsistencyKey, s as ReadModelCoordinator, t as KyselyDocumentIndexer } from "./document-indexer-C5Gsa1B3.js";
-import { n as errorToInfo, r as sanitizeArg, t as createForwardingLogger } from "./forwarding-logger-BBkMSxuJ.js";
-import { t as workerEntryPath } from "./worker-HPysBfhx.js";
-import { DowngradeNotSupportedError, MAX_AUTH_GRANTS, UnsupportedDocumentModelVersionError, actions, actions as documentActions, createPresignedHeader, decide, deserializeSignature, garbageCollect, generateId, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, normalizeDocumentModelVersion, sortOperations, toTransportAction } from "@powerhousedao/shared/document-model";
+import { $ as DocumentNotFoundError, A as ModuleNotFoundError, B as authDecisionModel, C as DocumentMetaCache, D as DuplicateManifestError, E as JobExecutorEventTypes, F as summarizeSubmittedActions, G as DocumentExistence, H as APPEND_CONDITION_FAILED_PREFIX, I as targetDocumentId, J as RevisionMismatchError, K as DuplicateOperationError, L as decideAtHead, M as createConsistencyToken, N as createEmptyConsistencyToken, O as DuplicateModuleError, P as submittedActionIds, Q as DocumentDeletedError, R as selectDecisionModel, S as KyselyOperationIndex, T as DEFAULT_DEFERRED_JOB_TTL_MS, U as AppendConditionFailedError, V as buildDecisionModel, W as DocumentAlreadyExistsError, X as AuthTimestampNotMonotonicError, Y as AuthEnforcementDisabledError, Z as AuthorizationDeniedError, _ as DriveCollectionId, a as DEFAULT_DRIVE_CONTAINER_TYPES, at as EventBusAggregateError, b as EventBus, c as runMigrations, ct as parsePagingOptions, d as KyselyOperationStore, dt as __exportAll, et as ExcessiveReshuffleError, f as KyselyKeyframeStore, g as PassthroughSigner, h as verifyActionSignature, it as UpgradePreconditionFailedError, j as GATED_DOCUMENT_ACTIONS, k as InvalidModuleError, l as createForwardingPoolInstrumentation, lt as throwIfAborted, m as SimpleJobExecutor, n as errorToInfo, nt as InvalidSignatureError, o as REACTOR_SCHEMA, ot as ReactorEventTypes, p as DocumentModelRegistry, q as OptimisticLockError, r as sanitizeArg, rt as RelationshipNotFoundError, s as getMigrationStatus, st as matchesScope, t as createForwardingLogger, tt as InvalidOperationTimestampError, u as instrumentPgPool, v as KyselyExecutionScope, w as CollectionMembershipCache, x as KyselyWriteCache, y as resolveFeatureFlags, z as documentDecisionModel } from "./forwarding-logger-CnuVDVze.js";
+import { i as WorkerInitFailedError, r as WorkerExitedError, t as WorkerAbortTimeoutError } from "./errors-BM_ULVWd.js";
+import { a as KyselyDocumentView, c as ReadModelCoordinator, d as DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, f as defaultReadModelIndexingConfig, i as DeletedDocumentRead, l as BaseReadModel, n as ConsistencyTracker, o as DOCUMENT_INDEXER_READ_MODEL, p as unchunkedReadModelIndexingConfig, r as makeConsistencyKey, s as DOCUMENT_VIEW_READ_MODEL, t as KyselyDocumentIndexer, u as DEFAULT_COMMIT_CHUNK_SIZE } from "./document-indexer-BVTGbEB0.js";
+import { DEFAULT_SIGNATURE_POLICY, DowngradeNotSupportedError, MAX_AUTH_GRANTS, UnsupportedDocumentModelVersionError, actionSignerIdentity, actionSigningTarget, actions, actions as documentActions, createCopyHeader, decide, deserializeSignature, garbageCollect, generateId, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, normalizeDocumentModelVersion, requestedSignaturePolicy, sortOperations, toTransportAction, withSignaturePolicy } from "@powerhousedao/shared/document-model";
 import { addFile, addFolder, copyNode, deleteNode, driveCreateDocument, generateNodesCopy, getDescendants, handleTargetNameCollisions, isFileNode, isFolderNode, moveNode, updateNode } from "@powerhousedao/shared/document-drive";
 import { v4 } from "uuid";
 import { ConsoleLogger, childLogger } from "document-model";
@@ -237,37 +234,31 @@ function getSharedActionScope(actions) {
 	return baseScope;
 }
 /**
-* Signs an action with the provided signer.
-* If the action already has valid signatures, it is returned unchanged.
+* Signs an action for `target`, the log it is written to. An action already
+* signed under a key is returned unchanged; one whose signer or last tuple has
+* no key is unsigned, and is signed like any other.
 */
-const signAction = async (action, signer, signal) => {
-	const existingSignatures = action.context?.signer?.signatures;
-	if (existingSignatures && existingSignatures.length > 0) return action;
-	const signature = await signer.signAction(action, signal);
+const signAction = async (action, signer, target, signal) => {
+	const existing = action.context?.signer;
+	if (existing?.app?.key && existing.signatures.at(-1)?.[1]) return action;
+	const signature = await signer.signAction(action, target, signal);
 	return {
 		...action,
 		context: {
 			...action.context,
 			signer: {
-				user: {
-					address: signer.user?.address || "",
-					networkId: signer.user?.networkId || "",
-					chainId: signer.user?.chainId || 0
-				},
-				app: {
-					name: signer.app?.name || "",
-					key: signer.app?.key || ""
-				},
+				...actionSignerIdentity(signer),
 				signatures: [signature]
 			}
 		}
 	};
 };
 /**
-* Signs multiple actions with the provided signer
+* Signs the actions of a job on `job.documentId`, each for the log it is
+* written to: a relationship action lands in its source document.
 */
-const signActions = async (actions, signer, signal) => {
-	return Promise.all(actions.map((action) => signAction(action, signer, signal)));
+const signActions = async (actions, signer, job, signal) => {
+	return Promise.all(actions.map((action) => signAction(action, signer, actionSigningTarget(action, job.documentId, job.branch), signal)));
 };
 function buildSingleJobMeta(jobId, callerMeta) {
 	return {
@@ -321,6 +312,10 @@ let JobStatus = /* @__PURE__ */ function(JobStatus) {
 * during construction, so the partial-`this` hazard does not apply.
 */
 var DriveClient = class {
+	client;
+	logger;
+	reactor;
+	signer;
 	constructor(client, logger, reactor, signer) {
 		this.client = client;
 		this.logger = logger;
@@ -329,11 +324,11 @@ var DriveClient = class {
 	}
 	async create(input, signal) {
 		this.logger.verbose("drives.create(@input)", input);
-		const driveDoc = driveCreateDocument({ global: {
+		const driveDoc = withSignaturePolicy(driveCreateDocument({ global: {
 			name: input.global.name || "",
 			icon: input.global.icon ?? null,
 			nodes: []
-		} });
+		} }), requestedSignaturePolicy(input, await this.client.getCreateSignaturePolicy()), { protocolVersions: input.protocolVersions });
 		if (input.preferredEditor) driveDoc.header.meta = {
 			...driveDoc.header.meta,
 			preferredEditor: input.preferredEditor
@@ -343,24 +338,25 @@ var DriveClient = class {
 	async addFile(driveIdentifier, document, parentFolder, signal) {
 		this.logger.verbose("drives.addFile(@driveIdentifier, @document, @parentFolder)", driveIdentifier, document.header.id, parentFolder);
 		const documentId = document.header.id;
+		const createInput = {
+			model: document.header.documentType,
+			version: 0,
+			documentId: document.header.id,
+			signing: {
+				signature: document.header.id,
+				publicKey: document.header.sig.publicKey,
+				nonce: document.header.sig.nonce,
+				createdAtUtcIso: document.header.createdAtUtcIso,
+				documentType: document.header.documentType
+			},
+			slug: document.header.slug,
+			name: document.header.name,
+			branch: document.header.branch,
+			meta: document.header.meta,
+			protocolVersions: document.header.protocolVersions ?? { "base-reducer": 2 }
+		};
 		const documentActions = await signActions([
-			createDocumentAction({
-				model: document.header.documentType,
-				version: 0,
-				documentId: document.header.id,
-				signing: {
-					signature: document.header.id,
-					publicKey: document.header.sig.publicKey,
-					nonce: document.header.sig.nonce,
-					createdAtUtcIso: document.header.createdAtUtcIso,
-					documentType: document.header.documentType
-				},
-				slug: document.header.slug,
-				name: document.header.name,
-				branch: document.header.branch,
-				meta: document.header.meta,
-				protocolVersions: document.header.protocolVersions ?? { "base-reducer": 2 }
-			}),
+			createDocumentAction(createInput),
 			upgradeDocumentAction({
 				documentId: document.header.id,
 				model: document.header.documentType,
@@ -369,13 +365,19 @@ var DriveClient = class {
 				initialState: document.state
 			}),
 			addRelationshipAction(driveIdentifier, documentId, "child")
-		], this.signer, signal);
+		], this.signer, {
+			documentId,
+			branch: "main"
+		}, signal);
 		const driveActions = await signActions([addFile({
 			id: documentId,
 			name: document.header.name || documentId,
 			documentType: document.header.documentType,
 			parentFolder
-		})], this.signer, signal);
+		})], this.signer, {
+			documentId: driveIdentifier,
+			branch: "main"
+		}, signal);
 		await this.runJobs([{
 			key: "document",
 			documentId,
@@ -465,18 +467,20 @@ var DriveClient = class {
 			});
 			resolvedNamesByTargetId.set(entry.targetId, resolved);
 		}
+		const policy = await this.client.getCreateSignaturePolicy();
 		for (const entry of copyPlan) {
 			const node = drive.state.global.nodes.find((n) => n.id === entry.srcId);
 			if (!node || !isFileNode(node)) continue;
 			const srcDoc = await this.client.get(entry.srcId, void 0, signal);
 			const duplicated = {
 				...srcDoc,
-				header: createPresignedHeader(entry.targetId, srcDoc.header.documentType),
+				header: createCopyHeader(srcDoc.header, entry.targetId, policy),
 				initialState: srcDoc.state,
 				operations: {}
 			};
 			const resolvedName = resolvedNamesByTargetId.get(entry.targetId);
 			if (resolvedName) duplicated.header.name = resolvedName;
+			entry.targetId = duplicated.header.id;
 			await this.addFile(driveIdentifier, duplicated, entry.targetParentFolder ?? void 0, signal);
 		}
 		return this.client.execute(driveIdentifier, "main", copyPlan.map((entry) => copyNode(entry)), signal);
@@ -500,8 +504,7 @@ var DriveClient = class {
 		return {
 			results: filtered.slice(startIndex, endIndex),
 			options: effective,
-			...endIndex < filtered.length ? { nextCursor: String(endIndex) } : {},
-			totalCount: filtered.length
+			...endIndex < filtered.length ? { nextCursor: String(endIndex) } : {}
 		};
 	}
 	/**
@@ -512,7 +515,7 @@ var DriveClient = class {
 	async runJobs(jobs, signal) {
 		const batchResult = await this.reactor.executeBatch({ jobs }, signal);
 		const completedJobs = await Promise.all(Object.values(batchResult.jobs).map((job) => this.client.waitForJob(job, signal)));
-		for (const job of completedJobs) if (job.status === JobStatus.FAILED) throw this.toError(job);
+		for (const job of completedJobs) if (job.status === "FAILED") throw this.toError(job);
 		return completedJobs;
 	}
 	toError(job) {
@@ -529,8 +532,14 @@ var DriveClient = class {
 		}
 	}
 	async removeFileNode(driveId, fileId, signal) {
-		const relationshipActions = await signActions([removeRelationshipAction(driveId, fileId, "child")], this.signer, signal);
-		const driveActions = await signActions([deleteNode({ id: fileId })], this.signer, signal);
+		const relationshipActions = await signActions([removeRelationshipAction(driveId, fileId, "child")], this.signer, {
+			documentId: driveId,
+			branch: "main"
+		}, signal);
+		const driveActions = await signActions([deleteNode({ id: fileId })], this.signer, {
+			documentId: driveId,
+			branch: "main"
+		}, signal);
 		const batchResult = await this.reactor.executeBatch({ jobs: [{
 			key: "relationship",
 			documentId: driveId,
@@ -547,10 +556,10 @@ var DriveClient = class {
 			dependsOn: ["relationship"]
 		}] }, signal);
 		const completedJobs = await Promise.all(Object.values(batchResult.jobs).map((job) => this.client.waitForJob(job, signal)));
-		for (const job of completedJobs) if (job.status === JobStatus.FAILED) throw new Error(job.error?.message);
+		for (const job of completedJobs) if (job.status === "FAILED") throw new Error(job.error?.message);
 		const deleteJob = await this.reactor.deleteDocument(fileId, this.signer, signal);
 		const deleteCompleted = await this.client.waitForJob(deleteJob, signal);
-		if (deleteCompleted.status === JobStatus.FAILED) throw new Error(deleteCompleted.error?.message);
+		if (deleteCompleted.status === "FAILED") throw new Error(deleteCompleted.error?.message);
 	}
 };
 //#endregion
@@ -561,13 +570,15 @@ var DriveClient = class {
 * Only READ_READY and FAILED are truly terminal.
 */
 function isTerminalStatus(status) {
-	return status === JobStatus.READ_READY || status === JobStatus.FAILED;
+	return status === "READ_READY" || status === "FAILED";
 }
 /**
 * Event-driven implementation of IJobAwaiter.
 * Subscribes to operation events to detect job completion without polling.
 */
 var JobAwaiter = class {
+	eventBus;
+	getJobStatus;
 	pendingJobs = /* @__PURE__ */ new Map();
 	unsubscribers = [];
 	constructor(eventBus, getJobStatus) {
@@ -709,7 +720,54 @@ let DocumentChangeType = /* @__PURE__ */ function(DocumentChangeType) {
 * would diverge permanently. The document scope carries the metadata the same
 * argument covers. Grants gate domain-scope reads only.
 */
-const ALWAYS_READABLE_SCOPES = new Set(["auth", "document"]);
+const ALWAYS_READABLE_SCOPES = /* @__PURE__ */ new Set(["auth", "document"]);
+const DECLARED_DOMAIN_SCOPES = ["global", "local"];
+/**
+* The scopes grants gate: the declared ones, and any other the document holds.
+* A document fetched for a narrowed view holds only that view's scopes.
+*/
+function domainScopesOf(document) {
+	const state = document.state;
+	const held = Object.keys(state ?? {}).filter((scope) => !ALWAYS_READABLE_SCOPES.has(scope));
+	return [.../* @__PURE__ */ new Set([...DECLARED_DOMAIN_SCOPES, ...held])];
+}
+function allowsSomeDomainScope(document, readable) {
+	return domainScopesOf(document).some(readable);
+}
+/** A document with no state at all is not policied, so nothing withholds it. */
+function refusesEveryDomainScope(document, readable) {
+	return document.state !== void 0 && !allowsSomeDomainScope(document, readable);
+}
+/**
+* The domain scopes the document does not hold whose read decision reads their
+* own state. A condition's `doc.<scope>` path resolves only for that scope, so
+* every other scope is decided on its name and the policy alone.
+*/
+function unheldScopesReadOnState(document) {
+	const grants = authOf(document)?.grants ?? [];
+	const onState = /* @__PURE__ */ new Set();
+	for (const grant of grants) {
+		collectStateScopes(grant.where, onState);
+		collectStateScopes(grant.principal, onState);
+	}
+	if (onState.size === 0) return [];
+	const held = document.state ?? {};
+	return domainScopesOf(document).filter((scope) => onState.has(scope) && !(scope in held));
+}
+function collectStateScopes(node, into) {
+	if (Array.isArray(node)) {
+		for (const child of node) collectStateScopes(child, into);
+		return;
+	}
+	if (typeof node !== "object" || node === null) return;
+	const { attr } = node;
+	if (typeof attr === "string") {
+		const [root, scope] = attr.split(".");
+		if (root === "doc" && scope) into.add(scope);
+		return;
+	}
+	for (const child of Object.values(node)) collectStateScopes(child, into);
+}
 /** What a gate does with an uninitialized policy when told nothing. */
 const OPEN_BY_DEFAULT = { withholdUninitialized: false };
 /**
@@ -772,8 +830,26 @@ var BareReadGate = class {
 			scope
 		}) === "allow");
 	}
+	prepare(document) {
+		return Promise.resolve((subject) => this.scopePredicate(document, subject));
+	}
 };
 /**
+* Rethrows a failed read unless the document is confirmed not live. The read
+* side reports absence as a plain Error, so absence is checked rather than
+* inferred from the message, and a failed check surfaces the read's own error.
+*/
+async function assertAbsent(documentView, documentId, error, signal) {
+	if (DocumentNotFoundError.isError(error)) return;
+	let exists;
+	try {
+		exists = await documentView.exists([documentId], "LiveOnly", void 0, signal);
+	} catch {
+		throw error;
+	}
+	if (exists[0]) throw error;
+}
+/**
 * Answers a stream read from the document already fetched, and anything else
 * through the read side.
 *
@@ -783,6 +859,9 @@ var BareReadGate = class {
 * list names is fetched.
 */
 var SeededStateReader = class {
+	documentView;
+	seed;
+	branch;
 	constructor(documentView, seed, branch) {
 		this.documentView = documentView;
 		this.seed = seed;
@@ -804,20 +883,10 @@ var SeededStateReader = class {
 				scopes: [scope]
 			}, void 0, signal);
 		} catch (error) {
-			await this.assertAbsent(documentId, error, signal);
+			await assertAbsent(this.documentView, documentId, error, signal);
 			throw new DocumentNotFoundError(documentId);
 		}
 	}
-	async assertAbsent(documentId, error, signal) {
-		if (DocumentNotFoundError.isError(error)) return;
-		let exists;
-		try {
-			exists = await this.documentView.exists([documentId], DocumentExistence.LiveOnly, void 0, signal);
-		} catch {
-			throw error;
-		}
-		if (exists[0]) throw error;
-	}
 };
 /**
 * Evaluates a read against the registered decision model, built at the stream
@@ -833,6 +902,12 @@ var SeededStateReader = class {
 * from state no commit ever invalidates.
 */
 var ModelReadGate = class {
+	model;
+	documentView;
+	servesGroups;
+	operationIndex;
+	logger;
+	options;
 	constructor(model, documentView, servesGroups, operationIndex, logger, options = OPEN_BY_DEFAULT) {
 		this.model = model;
 		this.documentView = documentView;
@@ -847,10 +922,18 @@ var ModelReadGate = class {
 	* group's other scopes are its own business and stay behind its own grants.
 	*/
 	async scopePredicate(document, subject, branch, signal) {
-		const own = await this.ownPolicyPredicate(document, subject, branch, signal);
-		if (!this.servesGroup(document) || own(GROUP_MEMBERSHIP_SCOPE)) return own;
-		const audience = await this.servesGroupTo(document.header.id, subject, signal);
-		return (scope) => own(scope) || audience && scope === GROUP_MEMBERSHIP_SCOPE;
+		return (await this.prepare(document, branch, signal))(subject);
+	}
+	async prepare(document, branch, signal) {
+		const policy = await this.ownPolicy(document, branch, signal);
+		if (!this.servesGroup(document)) return (subject) => Promise.resolve(policy(subject));
+		const referencers = this.referencerReads(document.header.id, signal);
+		return async (subject) => {
+			const own = policy(subject);
+			if (own(GROUP_MEMBERSHIP_SCOPE)) return own;
+			const audience = await this.servesGroupTo(subject, referencers);
+			return (scope) => own(scope) || audience && scope === GROUP_MEMBERSHIP_SCOPE;
+		};
 	}
 	/**
 	* Whether the subject is served this group because a policy names it.
@@ -884,11 +967,8 @@ var ModelReadGate = class {
 	* running with nobody awaiting it, which is where unhandled rejections come
 	* from.
 	*/
-	async servesGroupTo(groupId, subject, signal) {
-		if (!this.operationIndex) return false;
-		const referencers = await this.operationIndex.getGroupReferencers(groupId, signal);
-		const examined = referencers.slice(0, MAX_EXAMINED_REFERENCERS);
-		if (examined.length < referencers.length) this.logger?.warn(`Group ${groupId} is referenced by ${referencers.length} documents; only the first ${MAX_EXAMINED_REFERENCERS} decide whether it is served`);
+	async servesGroupTo(subject, referencers) {
+		const examined = await referencers.examined();
 		const walk = {
 			next: 0,
 			served: false,
@@ -899,7 +979,7 @@ var ModelReadGate = class {
 				const referencerId = examined[walk.next++];
 				let serves = false;
 				try {
-					serves = await this.servesThrough(referencerId, subject, signal);
+					serves = (await referencers.serves(referencerId))(subject);
 				} catch (error) {
 					walk.failure ??= Error.isError(error) ? error : /* @__PURE__ */ new Error(`Probing referencer ${referencerId} failed`);
 				}
@@ -910,21 +990,44 @@ var ModelReadGate = class {
 		if (!walk.served && walk.failure) throw walk.failure;
 		return walk.served;
 	}
+	/** Each read made once, however many subjects the walk runs for. */
+	referencerReads(groupId, signal) {
+		let examined;
+		const serves = /* @__PURE__ */ new Map();
+		return {
+			examined: () => examined ??= this.examinedReferencers(groupId, signal),
+			serves: (referencerId) => {
+				let read = serves.get(referencerId);
+				if (!read) {
+					read = this.servesThrough(referencerId, signal);
+					serves.set(referencerId, read);
+				}
+				return read;
+			}
+		};
+	}
+	async examinedReferencers(groupId, signal) {
+		if (!this.operationIndex) return [];
+		const referencers = await this.operationIndex.getGroupReferencers(groupId, signal);
+		const examined = referencers.slice(0, MAX_EXAMINED_REFERENCERS);
+		if (examined.length < referencers.length) this.logger?.warn(`Group ${groupId} is referenced by ${referencers.length} documents; only the first ${MAX_EXAMINED_REFERENCERS} decide whether it is served`);
+		return examined;
+	}
 	/**
-	* Whether one referencing document serves the subject any domain scope. A
+	* Whether one referencing document serves a subject any domain scope. A
 	* referencer this replica does not hold serves nothing, which fails closed
 	* the same way a group it does not hold does.
 	*/
-	async servesThrough(referencerId, subject, signal) {
+	async servesThrough(referencerId, signal) {
 		let referencer;
 		try {
 			referencer = await this.documentView.get(referencerId, { branch: GROUP_BRANCH }, void 0, signal);
 		} catch {
-			return false;
+			return () => false;
 		}
-		if (this.servesGroup(referencer)) return false;
-		const readable = await this.ownPolicyPredicate(referencer, subject, GROUP_BRANCH, signal);
-		return Object.keys(referencer.state ?? {}).filter((scope) => !ALWAYS_READABLE_SCOPES.has(scope)).some((scope) => readable(scope));
+		if (this.servesGroup(referencer)) return () => false;
+		const policy = await this.ownPolicy(referencer, GROUP_BRANCH, signal);
+		return (subject) => allowsSomeDomainScope(referencer, policy(subject));
 	}
 	servesGroup(document) {
 		return this.servesGroups && this.operationIndex !== void 0 && document.header.documentType === groupDocumentType;
@@ -942,9 +1045,12 @@ var ModelReadGate = class {
 	* publish an unpoliced group it names: the referencer walk asks this question
 	* of the referencing document, whose real policy answers it.
 	*/
-	async ownPolicyPredicate(document, subject, branch, signal) {
+	async ownPolicy(document, branch, signal) {
 		const auth = authOf(document);
-		if (!auth || !auth.version) return this.options.withholdUninitialized ? (scope) => ALWAYS_READABLE_SCOPES.has(scope) : () => true;
+		if (!auth || !auth.version) {
+			const readable = this.options.withholdUninitialized ? (scope) => ALWAYS_READABLE_SCOPES.has(scope) : () => true;
+			return () => readable;
+		}
 		const target = {
 			documentId: document.header.id,
 			branch
@@ -952,7 +1058,7 @@ var ModelReadGate = class {
 		const built = await buildDecisionModel(new SeededStateReader(this.documentView, document, branch), this.model, target, signal);
 		const definition = this.model(target);
 		const scopeStates = document.state ?? {};
-		return (scope) => ALWAYS_READABLE_SCOPES.has(scope) || definition.decide(built.model, subject, {
+		return (subject) => (scope) => ALWAYS_READABLE_SCOPES.has(scope) || definition.decide(built.model, subject, {
 			verb: "read",
 			scope
 		}, {
@@ -962,6 +1068,78 @@ var ModelReadGate = class {
 	}
 };
 //#endregion
+//#region src/client/event-reads.ts
+/** One change event's reads, shared by every subscription it reaches. */
+var EventReads = class {
+	reactor;
+	documentView;
+	readGate;
+	documents = /* @__PURE__ */ new Map();
+	existence = /* @__PURE__ */ new Map();
+	prepared = /* @__PURE__ */ new WeakMap();
+	constructor(reactor, documentView, readGate) {
+		this.reactor = reactor;
+		this.documentView = documentView;
+		this.readGate = readGate;
+	}
+	get(id, view) {
+		const key = JSON.stringify([
+			id,
+			view?.branch,
+			view?.scopes
+		]);
+		let read = this.documents.get(key);
+		if (!read) {
+			read = this.reactor.get(id, view);
+			this.documents.set(key, read);
+		}
+		return read;
+	}
+	exists(ids, existence) {
+		const key = JSON.stringify([ids, existence]);
+		let read = this.existence.get(key);
+		if (!read) {
+			read = this.documentView.exists(ids, existence);
+			this.existence.set(key, read);
+		}
+		return read;
+	}
+	async scopePredicate(document, subject, branch) {
+		if (!this.readGate.prepare) return this.readGate.scopePredicate(document, subject, branch);
+		let byBranch = this.prepared.get(document);
+		if (!byBranch) {
+			byBranch = /* @__PURE__ */ new Map();
+			this.prepared.set(document, byBranch);
+		}
+		let prepared = byBranch.get(branch);
+		if (!prepared) {
+			prepared = this.readGate.prepare(document, branch);
+			byBranch.set(branch, prepared);
+		}
+		return (await prepared)(subject);
+	}
+};
+var EventReadsSource = class {
+	reactor;
+	documentView;
+	readGate;
+	current;
+	constructor(reactor, documentView, readGate) {
+		this.reactor = reactor;
+		this.documentView = documentView;
+		this.readGate = readGate;
+	}
+	forEvent() {
+		if (!this.current) {
+			this.current = new EventReads(this.reactor, this.documentView, this.readGate);
+			queueMicrotask(() => {
+				this.current = void 0;
+			});
+		}
+		return this.current;
+	}
+};
+//#endregion
 //#region src/client/util.ts
 function authSubjectFromSigner(signer) {
 	return {
@@ -972,10 +1150,23 @@ function authSubjectFromSigner(signer) {
 function withAuthScope(view) {
 	if (view?.scopes && view.scopes.length > 0) return {
 		...view,
-		scopes: [...new Set([...view.scopes, "auth"])]
+		scopes: [.../* @__PURE__ */ new Set([...view.scopes, "auth"])]
 	};
 	return view;
 }
+function withAllScopes(view) {
+	if (!view?.scopes) return view;
+	const { scopes: _narrowed, ...whole } = view;
+	return whole;
+}
+function narrowedScopes(view) {
+	if (!view?.scopes || view.scopes.length === 0) return;
+	return /* @__PURE__ */ new Set([
+		"document",
+		"auth",
+		...view.scopes
+	]);
+}
 /**
 * Drops the scopes the predicate refuses. The predicate is resolved by the read
 * gate, which decides against the whole policy once per document; this only
@@ -1048,9 +1239,11 @@ var ReactorClient = class {
 	documentIndexer;
 	documentView;
 	readGate;
+	eventReads;
 	actionEvaluation;
+	createSignaturePolicy;
 	drives;
-	constructor(logger, reactor, signer, subscriptionManager, jobAwaiter, documentIndexer, documentView, readGate = new BareReadGate(), actionEvaluation) {
+	constructor(logger, reactor, signer, subscriptionManager, jobAwaiter, documentIndexer, documentView, readGate = new BareReadGate(), actionEvaluation, createSignaturePolicy = DEFAULT_SIGNATURE_POLICY) {
 		this.logger = logger;
 		this.reactor = reactor;
 		this.signer = signer;
@@ -1059,32 +1252,12 @@ var ReactorClient = class {
 		this.documentIndexer = documentIndexer;
 		this.documentView = documentView;
 		this.readGate = readGate;
+		this.eventReads = new EventReadsSource(reactor, documentView, readGate);
 		this.actionEvaluation = actionEvaluation;
+		this.createSignaturePolicy = createSignaturePolicy;
 		this.drives = new DriveClient(this, logger, reactor, signer);
 		this.logger.verbose("ReactorClient initialized");
 	}
-	readSubject(subject) {
-		return subject ?? authSubjectFromSigner(this.signer);
-	}
-	/**
-	* Which scopes of one document the subject may read. Resolved once per
-	* document, so the gate builds its model once however many scopes are then
-	* tested, and the filtering itself stays synchronous.
-	*/
-	readableScopes(document, view, signal) {
-		return this.readGate.scopePredicate(document, this.readSubject(view?.subject), view?.branch ?? "main", signal);
-	}
-	/**
-	* One document, filtered to the scopes the subject may read. Every method
-	* that hands a document back goes through here, including the ones that
-	* follow a write: a document returned from a mutation is a read like any
-	* other, and returning it whole served scopes the same subject would be
-	* refused by `get`. Its author still sees what it wrote, because an allow on
-	* execute confers read of that scope.
-	*/
-	async gateDocument(document, view, signal) {
-		return filterReadableScopes(document, await this.readableScopes(document, view, signal));
-	}
 	/**
 	* Retrieves a list of document model modules.
 	*/
@@ -1150,7 +1323,7 @@ var ReactorClient = class {
 	/** True when the id is taken; a soft-deleted document's id is still taken. */
 	async isDocumentIdTaken(documentId, signal) {
 		this.logger.verbose("isDocumentIdTaken(@documentId)", documentId);
-		return (await this.documentView.exists([documentId], DocumentExistence.IncludingDeleted, void 0, signal))[0];
+		return (await this.documentView.exists([documentId], "IncludingDeleted", void 0, signal))[0];
 	}
 	/**
 	* Retrieves operations for a document
@@ -1190,31 +1363,6 @@ var ReactorClient = class {
 			nextCursor: Object.keys(activeCursors).length > 0 ? encodeCompositeCursor(activeCursors) : void 0
 		};
 	}
-	async getOperationsWithCompositeCursor(documentId, view, filter, paging, signal, canRead) {
-		const scopeCursors = decodeCompositeCursor(paging.cursor);
-		const allOperations = [];
-		const activeCursors = {};
-		for (const [scopeName, cursor] of Object.entries(scopeCursors)) {
-			if (!canRead(scopeName)) continue;
-			const scopeView = {
-				...view,
-				scopes: [scopeName]
-			};
-			const scopePaging = {
-				cursor,
-				limit: paging.limit
-			};
-			const scopeResult = (await this.reactor.getOperations(documentId, scopeView, filter, scopePaging, void 0, signal))[scopeName];
-			allOperations.push(...scopeResult.results);
-			if (scopeResult.nextCursor) activeCursors[scopeName] = scopeResult.nextCursor;
-		}
-		allOperations.sort((a, b) => a.index - b.index);
-		return {
-			results: allOperations,
-			options: paging,
-			nextCursor: Object.keys(activeCursors).length > 0 ? encodeCompositeCursor(activeCursors) : void 0
-		};
-	}
 	/**
 	* Retrieves outgoing relationships of a given type from a source document.
 	*/
@@ -1248,15 +1396,44 @@ var ReactorClient = class {
 		return this.find({ ids: sourceIds }, view, paging, signal);
 	}
 	/**
+	* Retrieves the outgoing relationship edges of a source document, carrying the
+	* metadata and timestamps the far-end documents do not.
+	*/
+	async getOutgoingRelationshipEdges(sourceIdentifier, relationshipType, view, paging, signal) {
+		this.logger.verbose("getOutgoingRelationshipEdges(@sourceIdentifier, @relationshipType, @view, @paging)", sourceIdentifier, relationshipType, view, paging);
+		const sourceId = await this.documentView.resolveIdOrSlug(sourceIdentifier, view, void 0, signal);
+		const edges = await this.reactor.getOutgoingRelationshipEdges(sourceId, relationshipType, paging, void 0, signal);
+		return this.gateEdges(edges, "targetId", view, signal);
+	}
+	/**
+	* Retrieves the incoming relationship edges of a target document, carrying the
+	* metadata and timestamps the far-end documents do not.
+	*/
+	async getIncomingRelationshipEdges(targetIdentifier, relationshipType, view, paging, signal) {
+		this.logger.verbose("getIncomingRelationshipEdges(@targetIdentifier, @relationshipType, @view, @paging)", targetIdentifier, relationshipType, view, paging);
+		const targetId = await this.documentView.resolveIdOrSlug(targetIdentifier, view, void 0, signal);
+		const edges = await this.reactor.getIncomingRelationshipEdges(targetId, relationshipType, paging, void 0, signal);
+		return this.gateEdges(edges, "sourceId", view, signal);
+	}
+	/**
 	* Filters documents by criteria and returns a list of them
 	*/
 	async find(search, view, paging, signal) {
 		this.logger.verbose("find(@search, @view, @paging)", search, view, paging);
 		const results = await this.reactor.find(search, withAuthScope(view), paging, void 0, signal);
-		return {
-			...results,
-			results: await Promise.all(results.results.map(async (doc) => filterReadableScopes(doc, await this.readableScopes(doc, view, signal))))
-		};
+		return this.gateListing(results, view, signal);
+	}
+	/** Whether `find` would serve the document; false when it is absent. */
+	async isServed(identifier, view, signal) {
+		this.logger.verbose("isServed(@identifier, @view)", identifier, view);
+		let document;
+		try {
+			document = await this.reactor.getByIdOrSlug(identifier, withAuthScope(view), void 0, signal);
+		} catch (error) {
+			await assertAbsent(this.documentView, identifier, error, signal);
+			return false;
+		}
+		return await this.gateListed(document, view, signal) !== void 0;
 	}
 	/**
 	* Predicts the admission verdict for each candidate. See
@@ -1297,38 +1474,8 @@ var ReactorClient = class {
 			anyDenied: allowed < candidates.length
 		};
 	}
-	/**
-	* The decision model for one target document, built at its stream heads.
-	*
-	* The document is fetched unfiltered, because the policy is what decides:
-	* reading it through the read gate would withhold the very scopes the
-	* decision is about. A deleted document is served at its deletion boundary,
-	* which is what lets the model refuse an execute against it -- authEnforcement
-	* requires documentDecisions, so that read is available whenever this runs.
-	*
-	* Reading past the gate discloses nothing a submit does not. The `auth` and
-	* `document` scopes are readable by every holder, so a verdict resting on the
-	* policy alone is one the caller could compute unaided; and a verdict resting
-	* on a conditional grant reads the executing scope's state exactly as
-	* admission reads it, so the answer here is what submitting and being refused
-	* would have revealed anyway.
-	*
-	* The append condition the build records is dropped. It guards a write, and
-	* this makes none; reproducing it is also what the preflight cannot do, which
-	* is why the answer is a prediction.
-	*/
-	async buildEvaluationTarget(config, documentId, branch, signal) {
-		const document = await this.documentView.get(documentId, { branch }, void 0, signal);
-		const target = {
-			documentId,
-			branch
-		};
-		const built = await buildDecisionModel(new SeededStateReader(this.documentView, document, branch), config.model, target, signal);
-		return {
-			definition: config.model(target),
-			model: built.model,
-			scopeStates: document.state ?? {}
-		};
+	getCreateSignaturePolicy() {
+		return Promise.resolve(this.createSignaturePolicy);
 	}
 	/**
 	* Creates a document and waits for completion
@@ -1336,7 +1483,8 @@ var ReactorClient = class {
 	async create(document, parentIdentifier, signal) {
 		this.logger.verbose("create(@id, @parentIdentifier)", document.header.id, parentIdentifier);
 		const documentId = document.header.id;
-		const createActions = await signActions([createDocumentAction({
+		const branch = document.header.branch || "main";
+		const createInput = {
 			model: document.header.documentType,
 			version: 0,
 			documentId,
@@ -1352,23 +1500,30 @@ var ReactorClient = class {
 			branch: document.header.branch,
 			meta: document.header.meta,
 			protocolVersions: document.header.protocolVersions ?? { "base-reducer": 2 }
-		}), upgradeDocumentAction({
+		};
+		const createActions = await signActions([createDocumentAction(createInput), upgradeDocumentAction({
 			documentId,
 			model: document.header.documentType,
 			fromVersion: 0,
 			toVersion: normalizeDocumentModelVersion(document.state.document?.version),
 			initialState: document.state
-		})], this.signer, signal);
+		})], this.signer, {
+			documentId,
+			branch
+		}, signal);
 		const jobs = [{
 			key: "create",
 			documentId,
 			scope: getSharedActionScope(createActions),
-			branch: "main",
+			branch,
 			actions: createActions,
 			dependsOn: []
 		}];
 		if (parentIdentifier) {
-			const parentActions = await signActions([addRelationshipAction(parentIdentifier, documentId, "child")], this.signer, signal);
+			const parentActions = await signActions([addRelationshipAction(parentIdentifier, documentId, "child")], this.signer, {
+				documentId: parentIdentifier,
+				branch: "main"
+			}, signal);
 			jobs.push({
 				key: "parent",
 				documentId: parentIdentifier,
@@ -1380,7 +1535,7 @@ var ReactorClient = class {
 		}
 		const batchResult = await this.reactor.executeBatch({ jobs }, signal);
 		const completedJobs = await Promise.all(Object.values(batchResult.jobs).map((job) => this.waitForJob(job, signal)));
-		for (const job of completedJobs) if (job.status === JobStatus.FAILED) throw new Error(job.error?.message);
+		for (const job of completedJobs) if (job.status === "FAILED") throw new Error(job.error?.message);
 		const created = await this.reactor.get(documentId);
 		return this.gateDocument(created, void 0, signal);
 	}
@@ -1402,7 +1557,7 @@ var ReactorClient = class {
 			}, void 0);
 			if (!module) throw new Error(`Document model not found for type: ${documentModelType}`);
 		}
-		const document = module.utils.createDocument();
+		const document = withSignaturePolicy(module.utils.createDocument(), requestedSignaturePolicy(options, this.createSignaturePolicy), { protocolVersions: options?.protocolVersions });
 		document.state.document.version = normalizeDocumentModelVersion(module.version);
 		return this.create(document, options?.parentIdentifier, signal);
 	}
@@ -1428,19 +1583,26 @@ var ReactorClient = class {
 			const branch = document.header.branch || "main";
 			const fromVersion = normalizeDocumentModelVersion(document.state.document?.version);
 			let targetVersion = toVersion;
-			if (targetVersion === void 0) targetVersion = normalizeDocumentModelVersion((await this.getDocumentModelModule(documentType)).version);
+			if (targetVersion === void 0) {
+				const module = await this.getDocumentModelModule(documentType);
+				targetVersion = normalizeDocumentModelVersion(module.version);
+			}
 			if (targetVersion === fromVersion) return this.gateDocument(document, { branch }, signal);
 			if (targetVersion < fromVersion) throw new DowngradeNotSupportedError(documentType, fromVersion, targetVersion);
-			const signedActions = await signActions([upgradeDocumentAction({
+			const action = upgradeDocumentAction({
 				documentId,
 				model: documentType,
 				fromVersion,
 				toVersion: targetVersion,
 				revision: { ...document.header.revision }
-			})], this.signer, signal);
+			});
+			const signedActions = await signActions([action], this.signer, {
+				documentId,
+				branch
+			}, signal);
 			const jobInfo = await this.reactor.execute(documentId, branch, signedActions, signal);
 			const completedJob = await this.waitForJob(jobInfo, signal);
-			if (completedJob.status !== JobStatus.FAILED) {
+			if (completedJob.status !== "FAILED") {
 				const upgraded = await this.reactor.getByIdOrSlug(documentId, { branch }, completedJob.consistencyToken, signal);
 				return this.gateDocument(upgraded, { branch }, signal);
 			}
@@ -1467,10 +1629,14 @@ var ReactorClient = class {
 	*/
 	async execute(documentIdentifier, branch, actions, signal, subject) {
 		this.logger.verbose("execute(@documentIdentifier, @branch, @count actions)", documentIdentifier, branch, actions.length);
-		const signedActions = await signActions(actions, this.signer, signal);
-		const jobInfo = await this.reactor.execute(documentIdentifier, branch, signedActions, signal);
+		const documentId = await this.resolveWriteTarget(documentIdentifier, branch, actions, signal);
+		const signedActions = await signActions(actions, this.signer, {
+			documentId,
+			branch
+		}, signal);
+		const jobInfo = await this.reactor.execute(documentId, branch, signedActions, signal);
 		const completedJob = await this.waitForJob(jobInfo, signal);
-		if (completedJob.status === JobStatus.FAILED) throw new Error(completedJob.error?.message);
+		if (completedJob.status === "FAILED") throw new Error(completedJob.error?.message);
 		const view = {
 			branch,
 			subject
@@ -1483,18 +1649,29 @@ var ReactorClient = class {
 	*/
 	async executeAsync(documentIdentifier, branch, actions, signal) {
 		this.logger.verbose("executeAsync(@documentIdentifier, @branch, @count actions)", documentIdentifier, branch, actions.length);
-		const signedActions = await signActions(actions, this.signer, signal);
-		return this.reactor.execute(documentIdentifier, branch, signedActions, signal);
+		const documentId = await this.resolveWriteTarget(documentIdentifier, branch, actions, signal);
+		const signedActions = await signActions(actions, this.signer, {
+			documentId,
+			branch
+		}, signal);
+		return this.reactor.execute(documentId, branch, signedActions, signal);
 	}
 	async executeBatch(request, signal) {
 		this.logger.verbose("executeBatch(@count jobs)", request.jobs.length);
-		const signedJobs = await Promise.all(request.jobs.map(async (job) => ({
-			...job,
-			actions: await signActions(job.actions, this.signer, signal)
-		})));
+		const signedJobs = await Promise.all(request.jobs.map(async (job) => {
+			const documentId = await this.resolveWriteTarget(job.documentId, job.branch, job.actions, signal);
+			return {
+				...job,
+				documentId,
+				actions: await signActions(job.actions, this.signer, {
+					documentId,
+					branch: job.branch
+				}, signal)
+			};
+		}));
 		const batchResult = await this.reactor.executeBatch({ jobs: signedJobs }, signal);
 		const completedJobs = await Promise.all(Object.values(batchResult.jobs).map((job) => this.waitForJob(job, signal)));
-		for (const job of completedJobs) if (job.status === JobStatus.FAILED) throw new Error(job.error?.message);
+		for (const job of completedJobs) if (job.status === "FAILED") throw new Error(job.error?.message);
 		return batchResult;
 	}
 	/**
@@ -1515,11 +1692,23 @@ var ReactorClient = class {
 	/**
 	* Adds multiple documents as children to another and waits for completion
 	*/
-	async addRelationship(sourceIdentifier, targetIdentifier, relationshipType, branch = "main", signal) {
-		this.logger.verbose("addRelationship(@sourceIdentifier, @targetIdentifier, @relationshipType, @branch)", sourceIdentifier, targetIdentifier, relationshipType, branch);
-		const jobInfo = await this.reactor.addRelationship(sourceIdentifier, targetIdentifier, relationshipType, branch, this.signer, signal);
+	async addRelationship(sourceIdentifier, targetIdentifier, relationshipType, metadata, branch = "main", signal) {
+		this.logger.verbose("addRelationship(@sourceIdentifier, @targetIdentifier, @relationshipType, @metadata, @branch)", sourceIdentifier, targetIdentifier, relationshipType, metadata, branch);
+		const jobInfo = await this.reactor.addRelationship(sourceIdentifier, targetIdentifier, relationshipType, metadata, branch, this.signer, signal);
 		const completedJob = await this.waitForJob(jobInfo, signal);
-		if (completedJob.status === JobStatus.FAILED) throw new Error(completedJob.error?.message);
+		if (completedJob.status === "FAILED") throw new Error(completedJob.error?.message);
+		const result = await this.reactor.getByIdOrSlug(sourceIdentifier, { branch }, completedJob.consistencyToken, signal);
+		return this.gateDocument(result, { branch }, signal);
+	}
+	/**
+	* Replaces the metadata of an existing relationship and waits for completion.
+	*/
+	async updateRelationship(sourceIdentifier, targetIdentifier, relationshipType, metadata, branch = "main", signal) {
+		this.logger.verbose("updateRelationship(@sourceIdentifier, @targetIdentifier, @relationshipType, @metadata, @branch)", sourceIdentifier, targetIdentifier, relationshipType, metadata, branch);
+		if (!await this.readRelationshipEdge(sourceIdentifier, targetIdentifier, relationshipType, { branch }, signal)) throw new RelationshipNotFoundError(sourceIdentifier, targetIdentifier, relationshipType);
+		const jobInfo = await this.reactor.updateRelationship(sourceIdentifier, targetIdentifier, relationshipType, metadata, branch, this.signer, signal);
+		const completedJob = await this.waitForJob(jobInfo, signal);
+		if (completedJob.status === "FAILED") throw new Error(completedJob.error?.message);
 		const result = await this.reactor.getByIdOrSlug(sourceIdentifier, { branch }, completedJob.consistencyToken, signal);
 		return this.gateDocument(result, { branch }, signal);
 	}
@@ -1530,7 +1719,7 @@ var ReactorClient = class {
 		this.logger.verbose("removeRelationship(@sourceIdentifier, @targetIdentifier, @relationshipType, @branch)", sourceIdentifier, targetIdentifier, relationshipType, branch);
 		const jobInfo = await this.reactor.removeRelationship(sourceIdentifier, targetIdentifier, relationshipType, branch, this.signer, signal);
 		const completedJob = await this.waitForJob(jobInfo, signal);
-		if (completedJob.status === JobStatus.FAILED) throw new Error(completedJob.error?.message);
+		if (completedJob.status === "FAILED") throw new Error(completedJob.error?.message);
 		const result = await this.reactor.getByIdOrSlug(sourceIdentifier, { branch }, completedJob.consistencyToken, signal);
 		return this.gateDocument(result, { branch }, signal);
 	}
@@ -1539,12 +1728,13 @@ var ReactorClient = class {
 	*/
 	async moveRelationship(sourceParentIdentifier, targetParentIdentifier, targetIdentifier, relationshipType, branch = "main", signal) {
 		this.logger.verbose("moveRelationship(@sourceParentIdentifier, @targetParentIdentifier, @targetIdentifier, @relationshipType, @branch)", sourceParentIdentifier, targetParentIdentifier, targetIdentifier, relationshipType, branch);
+		const metadata = (await this.readRelationshipEdge(sourceParentIdentifier, targetIdentifier, relationshipType, { branch }, signal))?.metadata;
 		const removeJobInfo = await this.reactor.removeRelationship(sourceParentIdentifier, targetIdentifier, relationshipType, branch, this.signer, signal);
 		const removeCompletedJob = await this.waitForJob(removeJobInfo, signal);
-		if (removeCompletedJob.status === JobStatus.FAILED) throw new Error(removeCompletedJob.error?.message);
-		const addJobInfo = await this.reactor.addRelationship(targetParentIdentifier, targetIdentifier, relationshipType, branch, this.signer, signal);
+		if (removeCompletedJob.status === "FAILED") throw new Error(removeCompletedJob.error?.message);
+		const addJobInfo = await this.reactor.addRelationship(targetParentIdentifier, targetIdentifier, relationshipType, metadata, branch, this.signer, signal);
 		const addCompletedJob = await this.waitForJob(addJobInfo, signal);
-		if (addCompletedJob.status === JobStatus.FAILED) throw new Error(addCompletedJob.error?.message);
+		if (addCompletedJob.status === "FAILED") throw new Error(addCompletedJob.error?.message);
 		const sourceResult = await this.reactor.getByIdOrSlug(sourceParentIdentifier, { branch }, removeCompletedJob.consistencyToken, signal);
 		const targetResult = await this.reactor.getByIdOrSlug(targetParentIdentifier, { branch }, addCompletedJob.consistencyToken, signal);
 		return {
@@ -1558,7 +1748,7 @@ var ReactorClient = class {
 		const completedJobs = await Promise.all(Object.entries(result.jobs).map(async ([key, jobInfo]) => {
 			return [key, await this.waitForJob(jobInfo, signal)];
 		}));
-		for (const [, completedJob] of completedJobs) if (completedJob.status === JobStatus.FAILED) throw new Error(completedJob.error?.message);
+		for (const [, completedJob] of completedJobs) if (completedJob.status === "FAILED") throw new Error(completedJob.error?.message);
 		return { jobs: Object.fromEntries(completedJobs) };
 	}
 	/**
@@ -1567,8 +1757,8 @@ var ReactorClient = class {
 	async deleteDocument(identifier, propagate, signal) {
 		this.logger.verbose("deleteDocument(@identifier, @propagate)", identifier, propagate);
 		const jobs = [];
-		if (propagate === PropagationMode.Cascade) {
-			const toDelete = new Set([identifier]);
+		if (propagate === "cascade") {
+			const toDelete = /* @__PURE__ */ new Set([identifier]);
 			let changed = true;
 			while (changed) {
 				if (signal?.aborted) throw new Error("Operation aborted");
@@ -1592,7 +1782,7 @@ var ReactorClient = class {
 		const jobInfo = await this.reactor.deleteDocument(identifier, this.signer, signal);
 		jobs.push(jobInfo);
 		const completedJobs = await Promise.all(jobs.map((job) => this.waitForJob(job, signal)));
-		for (const completedJob of completedJobs) if (completedJob.status === JobStatus.FAILED) throw new Error(completedJob.error?.message);
+		for (const completedJob of completedJobs) if (completedJob.status === "FAILED") throw new Error(completedJob.error?.message);
 	}
 	/**
 	* Deletes documents and waits for completion
@@ -1622,7 +1812,13 @@ var ReactorClient = class {
 	*/
 	subscribe(search, callback, view) {
 		this.logger.verbose("subscribe(@search, @view)", search, view);
-		const readable = async (document) => filterReadableScopes(document, await this.readableScopes(document, view));
+		const served = async (type, documents, reads) => {
+			const documentsServed = await this.gateServedAll(documents, view, void 0, reads);
+			return documentsServed.length > 0 ? {
+				type,
+				documents: documentsServed
+			} : void 0;
+		};
 		let disposed = false;
 		let delivering = Promise.resolve();
 		/**
@@ -1636,49 +1832,46 @@ var ReactorClient = class {
 		* gated is withheld, because serving it unfiltered would leak the scopes
 		* the gate did not clear -- but it is logged rather than swallowed, since
 		* the gate rethrows a transient failure precisely so it is not read as a
-		* denial.
+		* denial. An event that resolves to undefined was withheld.
 		*/
 		const deliver = (event) => {
 			Promise.resolve(event).catch(() => void 0);
 			delivering = delivering.then(async () => {
 				const built = await event;
-				if (disposed) return;
+				if (disposed || !built) return;
 				callback(built);
 			}).catch((error) => {
 				this.logger.error("Subscription delivery failed for @search: @Error", { search }, error);
 			});
 		};
 		const unsubscribeCreated = this.subscriptionManager.onDocumentCreated((result) => {
+			const reads = this.eventReads.forEvent();
 			deliver((async () => {
-				const documents = await Promise.all(result.results.map((id) => this.reactor.get(id, withAuthScope(view), void 0, void 0)));
-				return {
-					type: DocumentChangeType.Created,
-					documents: await Promise.all(documents.map(readable))
-				};
+				const documents = await Promise.all(result.results.map((id) => reads.get(id, withAllScopes(view))));
+				return served("created", documents, reads);
 			})());
 		}, search);
 		const unsubscribeDeleted = this.subscriptionManager.onDocumentDeleted((documentIds) => {
-			deliver({
-				type: DocumentChangeType.Deleted,
+			const reads = this.eventReads.forEvent();
+			for (const childId of documentIds) deliver((async () => await this.servesEvery([childId], view, reads) ? {
+				type: "deleted",
 				documents: [],
-				context: { childId: documentIds[0] }
-			});
+				context: { childId }
+			} : void 0)());
 		}, search);
 		const unsubscribeUpdated = this.subscriptionManager.onDocumentStateUpdated((result) => {
-			deliver((async () => ({
-				type: DocumentChangeType.Updated,
-				documents: await Promise.all(result.results.map(readable))
-			}))());
+			deliver(served("updated", result.results, this.eventReads.forEvent()));
 		}, search, view);
 		const unsubscribeRelationship = this.subscriptionManager.onRelationshipChanged((parentId, childId, changeType) => {
-			deliver({
-				type: changeType === RelationshipChangeType.Added ? DocumentChangeType.ChildAdded : DocumentChangeType.ChildRemoved,
+			const reads = this.eventReads.forEvent();
+			deliver((async () => await this.servesEvery([parentId, childId], view, reads) ? {
+				type: changeType === "added" ? "child_added" : "child_removed",
 				documents: [],
 				context: {
 					parentId,
 					childId
 				}
-			});
+			} : void 0)());
 		}, search);
 		return () => {
 			disposed = true;
@@ -1688,6 +1881,225 @@ var ReactorClient = class {
 			unsubscribeRelationship();
 		};
 	}
+	readSubject(subject) {
+		return subject ?? authSubjectFromSigner(this.signer);
+	}
+	/**
+	* Which scopes of one document the subject may read. Resolved once per
+	* document, so the gate builds its model once however many scopes are then
+	* tested, and the filtering itself stays synchronous.
+	*/
+	readableScopes(document, view, signal, reads) {
+		const subject = this.readSubject(view?.subject);
+		const branch = view?.branch ?? "main";
+		return reads ? reads.scopePredicate(document, subject, branch) : this.readGate.scopePredicate(document, subject, branch, signal);
+	}
+	/**
+	* One document, filtered to the scopes the subject may read. Every method
+	* that hands a document back goes through here, including the ones that
+	* follow a write: a document returned from a mutation is a read like any
+	* other, and returning it whole served scopes the same subject would be
+	* refused by `get`. Its author still sees what it wrote, because an allow on
+	* execute confers read of that scope.
+	*/
+	async gateDocument(document, view, signal) {
+		return filterReadableScopes(document, await this.readableScopes(document, view, signal));
+	}
+	/**
+	* One document as a listing or a feed serves it, or undefined when withheld.
+	* The document must hold every scope, or withholding is decided on a subset;
+	* a narrowing view is applied here instead.
+	*/
+	async gateServed(document, view, signal, reads) {
+		const readable = await this.readableScopes(document, view, signal, reads);
+		if (refusesEveryDomainScope(document, readable)) return;
+		const narrowed = narrowedScopes(view);
+		return filterReadableScopes(document, narrowed ? (scope) => readable(scope) && narrowed.has(scope) : readable);
+	}
+	async gateServedAll(documents, view, signal, reads) {
+		return (await Promise.all(documents.map((document) => this.gateServed(document, view, signal, reads)))).filter((document) => document !== void 0);
+	}
+	/**
+	* Gates a page and every page after it. `nextCursor` is left as the stream
+	* reported it.
+	*/
+	async gateListing(page, view, signal) {
+		const results = (await Promise.all(page.results.map((document) => this.gateListed(document, view, signal)))).filter((document) => document !== void 0);
+		const next = page.next;
+		return {
+			...page,
+			results,
+			next: next ? async () => this.gateListing(await next(), view, signal) : void 0
+		};
+	}
+	/**
+	* One document as a listing serves it, or undefined when withheld. It holds
+	* only the view's scopes; a domain scope it lacks is decided on its name, or
+	* on its state read now when a condition needs that.
+	*/
+	async gateListed(document, view, signal) {
+		const readable = await this.readableScopes(document, view, signal);
+		const unheld = unheldScopesReadOnState(document);
+		if (refusesEveryDomainScope(document, unheld.length === 0 ? readable : (scope) => !unheld.includes(scope) && readable(scope)) && !await this.servesUnheld(document, unheld, view, signal)) return;
+		return filterReadableScopes(document, readable);
+	}
+	async servesUnheld(document, scopes, view, signal) {
+		if (scopes.length === 0) return false;
+		const id = document.header.id;
+		let held;
+		try {
+			held = await this.reactor.get(id, withAuthScope({
+				...view,
+				scopes
+			}), void 0, signal);
+		} catch (error) {
+			await assertAbsent(this.documentView, id, error, signal);
+			return false;
+		}
+		const readable = await this.readableScopes(held, view, signal);
+		return scopes.some(readable);
+	}
+	/**
+	* Whether an event naming only these ids may reach the subject. An id with no
+	* live document behind it has no content left to protect, so it does not
+	* withhold; a deleted document is read at its deletion boundary when
+	* deletion is positional, and gated like any other.
+	*/
+	async servesEvery(ids, view, reads) {
+		return (await Promise.all(ids.map((id) => this.servesId(id, view, reads)))).every(Boolean);
+	}
+	async servesId(id, view, reads) {
+		let document;
+		try {
+			document = await reads.get(id, withAllScopes(view));
+		} catch (error) {
+			await assertAbsent(reads, id, error);
+			return true;
+		}
+		return !refusesEveryDomainScope(document, await this.readableScopes(document, view, void 0, reads));
+	}
+	async getOperationsWithCompositeCursor(documentId, view, filter, paging, signal, canRead) {
+		const scopeCursors = decodeCompositeCursor(paging.cursor);
+		const allOperations = [];
+		const activeCursors = {};
+		for (const [scopeName, cursor] of Object.entries(scopeCursors)) {
+			if (!canRead(scopeName)) continue;
+			const scopeView = {
+				...view,
+				scopes: [scopeName]
+			};
+			const scopePaging = {
+				cursor,
+				limit: paging.limit
+			};
+			const scopeResult = (await this.reactor.getOperations(documentId, scopeView, filter, scopePaging, void 0, signal))[scopeName];
+			allOperations.push(...scopeResult.results);
+			if (scopeResult.nextCursor) activeCursors[scopeName] = scopeResult.nextCursor;
+		}
+		allOperations.sort((a, b) => a.index - b.index);
+		return {
+			results: allOperations,
+			options: paging,
+			nextCursor: Object.keys(activeCursors).length > 0 ? encodeCompositeCursor(activeCursors) : void 0
+		};
+	}
+	/**
+	* Drops the edges whose far-end document the subject may read no domain scope
+	* of. An edge is withheld whole rather than stripped of its metadata: the
+	* document-shaped relationship reads already answer with the far end stripped
+	* to the scopes the gate allows, so the far end's existence is disclosed
+	* either way, but an edge's metadata is content about the pair that the far
+	* end's own reads would refuse. An edge to a far end stripped to nothing
+	* therefore carries content past a refusal, and there is no useful shell to
+	* hand back in its place.
+	*
+	* `nextCursor` and `options` are left as the underlying stream reported them,
+	* because a caller must feed them back to resume from the right position. A
+	* gated page can therefore be shorter than the limit it asked for.
+	*/
+	async gateEdges(page, farEnd, view, signal) {
+		const ids = [...new Set(page.results.map((edge) => edge[farEnd]))];
+		if (ids.length === 0) return page;
+		const farEndView = {
+			subject: view?.subject,
+			branch: view?.branch
+		};
+		const documents = await this.reactor.find({ ids }, farEndView, {
+			cursor: "0",
+			limit: ids.length
+		}, void 0, signal);
+		const readable = new Map(await Promise.all(documents.results.map(async (doc) => {
+			const allows = await this.readableScopes(doc, view, signal);
+			return [doc.header.id, !refusesEveryDomainScope(doc, allows)];
+		})));
+		const results = page.results.filter((edge) => readable.get(edge[farEnd]) !== false);
+		if (results.length === page.results.length) return page;
+		const nextPage = page.next;
+		return {
+			...page,
+			results,
+			next: nextPage ? async () => this.gateEdges(await nextPage(), farEnd, view, signal) : void 0
+		};
+	}
+	/**
+	* One relationship edge, or undefined when it does not exist. A point lookup:
+	* the pair is filtered in SQL rather than scanned out of the source's edge
+	* list, which on a drive with thousands of children is the difference between
+	* one query and dozens.
+	*/
+	async readRelationshipEdge(sourceIdentifier, targetIdentifier, relationshipType, view, signal) {
+		const sourceId = await this.documentView.resolveIdOrSlug(sourceIdentifier, view, void 0, signal);
+		const targetId = await this.documentView.resolveIdOrSlug(targetIdentifier, view, void 0, signal);
+		return (await this.documentIndexer.getDirectedRelationships(sourceId, targetId, [relationshipType], {
+			cursor: "0",
+			limit: 1
+		}, void 0, signal)).results[0];
+	}
+	/**
+	* The id a write on `identifier` is stored under, which its signatures bind.
+	* A create names its own id, and an id no slug maps to is taken as given, so
+	* a document still in flight resolves to itself.
+	*/
+	async resolveWriteTarget(identifier, branch, actions, signal) {
+		if (actions.some((action) => action.type === "CREATE_DOCUMENT")) return identifier;
+		const view = { branch };
+		const bySlug = await this.documentView.resolveSlug(identifier, view, void 0, signal);
+		if (bySlug === void 0 || bySlug === identifier) return identifier;
+		return this.documentView.resolveIdOrSlug(identifier, view, void 0, signal);
+	}
+	/**
+	* The decision model for one target document, built at its stream heads.
+	*
+	* The document is fetched unfiltered, because the policy is what decides:
+	* reading it through the read gate would withhold the very scopes the
+	* decision is about. A deleted document is served at its deletion boundary,
+	* which is what lets the model refuse an execute against it -- authEnforcement
+	* requires documentDecisions, so that read is available whenever this runs.
+	*
+	* Reading past the gate discloses nothing a submit does not. The `auth` and
+	* `document` scopes are readable by every holder, so a verdict resting on the
+	* policy alone is one the caller could compute unaided; and a verdict resting
+	* on a conditional grant reads the executing scope's state exactly as
+	* admission reads it, so the answer here is what submitting and being refused
+	* would have revealed anyway.
+	*
+	* The append condition the build records is dropped. It guards a write, and
+	* this makes none; reproducing it is also what the preflight cannot do, which
+	* is why the answer is a prediction.
+	*/
+	async buildEvaluationTarget(config, documentId, branch, signal) {
+		const document = await this.documentView.get(documentId, { branch }, void 0, signal);
+		const target = {
+			documentId,
+			branch
+		};
+		const built = await buildDecisionModel(new SeededStateReader(this.documentView, document, branch), config.model, target, signal);
+		return {
+			definition: config.model(target),
+			model: built.model,
+			scopeStates: document.state ?? {}
+		};
+	}
 	async removeAllIncomingRelationships(documentId, signal) {
 		const incoming = await this.documentIndexer.getIncoming(documentId, void 0, void 0, void 0, signal);
 		const jobs = [];
@@ -1701,18 +2113,6 @@ var ReactorClient = class {
 //#endregion
 //#region src/queue/types.ts
 /**
-* State of a job in the queue
-*/
-let JobQueueState = /* @__PURE__ */ function(JobQueueState) {
-	JobQueueState[JobQueueState["UNKNOWN"] = -1] = "UNKNOWN";
-	JobQueueState[JobQueueState["PREPROCESSING"] = 0] = "PREPROCESSING";
-	JobQueueState[JobQueueState["PENDING"] = 1] = "PENDING";
-	JobQueueState[JobQueueState["READY"] = 2] = "READY";
-	JobQueueState[JobQueueState["RUNNING"] = 3] = "RUNNING";
-	JobQueueState[JobQueueState["RESOLVED"] = 4] = "RESOLVED";
-	return JobQueueState;
-}({});
-/**
 * How a retry is accounted against the job's retry limit.
 * - `CountAgainstLimit` (default): a fault; the job eventually exhausts its
 *   retries and fails terminally.
@@ -1745,6 +2145,11 @@ function toErrorInfo(error) {
 	};
 }
 var JobResultHandler = class {
+	queue;
+	jobTracker;
+	eventBus;
+	resolver;
+	logger;
 	constructor(queue, jobTracker, eventBus, resolver, logger) {
 		this.queue = queue;
 		this.jobTracker = jobTracker;
@@ -1775,7 +2180,7 @@ var JobResultHandler = class {
 		if (result.error && AppendConditionFailedError.isError(result.error) && this.countConflicts(handle.job) < MAX_EXEMPT_CONFLICT_RETRIES) {
 			const errorInfo = toErrorInfo(result.error);
 			try {
-				await this.queue.retryJob(handle.job.id, errorInfo, RetryAccounting.ExemptFromLimit);
+				await this.queue.retryJob(handle.job.id, errorInfo, "exempt-from-limit");
 				return;
 			} catch {}
 		}
@@ -1784,7 +2189,7 @@ var JobResultHandler = class {
 			callbacks.deferJob(result.error.documentId, handle.job);
 			return;
 		}
-		if (result.error && (DocumentDeletedError.isError(result.error) || DocumentAlreadyExistsError.isError(result.error) || DocumentNotFoundError.isError(result.error) || AuthorizationDeniedError.isError(result.error) || AuthTimestampNotMonotonicError.isError(result.error) || InvalidOperationTimestampError.isError(result.error) || ExcessiveReshuffleError.isError(result.error) || UpgradePreconditionFailedError.isError(result.error))) {
+		if (result.error && (DocumentDeletedError.isError(result.error) || DocumentAlreadyExistsError.isError(result.error) || DocumentNotFoundError.isError(result.error) || AuthorizationDeniedError.isError(result.error) || AuthTimestampNotMonotonicError.isError(result.error) || InvalidOperationTimestampError.isError(result.error) || ExcessiveReshuffleError.isError(result.error) || InvalidSignatureError.isError(result.error) || UpgradePreconditionFailedError.isError(result.error))) {
 			const errorInfo = toErrorInfo(result.error);
 			this.jobTracker.markFailed(handle.job.id, errorInfo, handle.job);
 			this.eventBus.emit(ReactorEventTypes.JOB_FAILED, {
@@ -1873,6 +2278,12 @@ var JobResultHandler = class {
 * is stranded at PENDING for as long as the deferral lasts.
 */
 var DeferredJobs = class {
+	queue;
+	jobTracker;
+	eventBus;
+	logger;
+	ttlMs;
+	onReleased;
 	#byDocumentId = /* @__PURE__ */ new Map();
 	#timers = /* @__PURE__ */ new Map();
 	constructor(queue, jobTracker, eventBus, logger, ttlMs = DEFAULT_DEFERRED_JOB_TTL_MS, onReleased = () => Promise.resolve()) {
@@ -2034,6 +2445,13 @@ function bucketFor(documentId, numWorkers) {
 *   (Powerhouse board wiki id: d400d711-f07e-4389-a226-4e9fdd4fa8ba)
 */
 var WorkerPoolJobExecutorManager = class {
+	workerFactory;
+	eventBus;
+	queue;
+	jobTracker;
+	logger;
+	resolver;
+	operationIndex;
 	workers = [];
 	isRunning = false;
 	activeJobs = 0;
@@ -2172,6 +2590,7 @@ var WorkerPoolJobExecutorManager = class {
 			await this.tryDispatchFor(worker);
 			return;
 		}
+		for (const refusal of outcome.signatureRefusals ?? []) this.eventBus.emit(ReactorEventTypes.SIGNATURE_REFUSED, refusal).catch(() => {});
 		if (outcome.result.success) {
 			this.totalJobsProcessed++;
 			const completedEvent = {
@@ -2212,6 +2631,7 @@ var WorkerPoolJobExecutorManager = class {
 			jobId: job.id,
 			operations: payload.operations,
 			jobMeta: payload.jobMeta,
+			submittedActionIds: submittedActionIds(job),
 			collectionMemberships
 		};
 		try {
@@ -2296,6 +2716,12 @@ function fillMissingMemberships(documentIds, found) {
 * Listens for job available events and dispatches jobs to executors.
 */
 var SimpleJobExecutorManager = class {
+	executorFactory;
+	eventBus;
+	queue;
+	jobTracker;
+	logger;
+	resolver;
 	executors = [];
 	isRunning = false;
 	activeJobs = 0;
@@ -2470,6 +2896,7 @@ var SimpleJobExecutorManager = class {
 * Subscribes to operation events to update job states.
 */
 var InMemoryJobTracker = class {
+	eventBus;
 	jobs = /* @__PURE__ */ new Map();
 	unsubscribers = [];
 	constructor(eventBus) {
@@ -2490,21 +2917,22 @@ var InMemoryJobTracker = class {
 	handleWriteReady(event) {
 		const jobId = event.jobId;
 		const job = this.jobs.get(jobId);
-		if (job && job.status === JobStatus.RUNNING) {
+		if (job && job.status === "RUNNING") {
 			const consistencyToken = createConsistencyToken(event.operations);
 			this.jobs.set(jobId, {
 				...job,
-				status: JobStatus.WRITE_READY,
-				consistencyToken
+				status: "WRITE_READY",
+				consistencyToken,
+				result: summarizeSubmittedActions(event.operations, event.submittedActionIds)
 			});
 		}
 	}
 	handleReadReady(event) {
 		const jobId = event.jobId;
 		const job = this.jobs.get(jobId);
-		if (job && job.status === JobStatus.WRITE_READY) this.jobs.set(jobId, {
+		if (job && job.status === "WRITE_READY") this.jobs.set(jobId, {
 			...job,
-			status: JobStatus.READ_READY
+			status: "READ_READY"
 		});
 	}
 	handleJobFailed(event) {
@@ -2527,7 +2955,7 @@ var InMemoryJobTracker = class {
 			this.jobs.set(jobId, {
 				id: jobId,
 				documentId: "",
-				status: JobStatus.RUNNING,
+				status: "RUNNING",
 				createdAtUtcIso: (/* @__PURE__ */ new Date()).toISOString(),
 				consistencyToken: createEmptyConsistencyToken(),
 				meta: {
@@ -2539,7 +2967,7 @@ var InMemoryJobTracker = class {
 		}
 		this.jobs.set(jobId, {
 			...job,
-			status: JobStatus.RUNNING
+			status: "RUNNING"
 		});
 	}
 	markFailed(jobId, error, job) {
@@ -2548,7 +2976,7 @@ var InMemoryJobTracker = class {
 			this.jobs.set(jobId, {
 				id: jobId,
 				documentId: job?.documentId ?? "",
-				status: JobStatus.FAILED,
+				status: "FAILED",
 				createdAtUtcIso: (/* @__PURE__ */ new Date()).toISOString(),
 				completedAtUtcIso: (/* @__PURE__ */ new Date()).toISOString(),
 				error,
@@ -2563,7 +2991,7 @@ var InMemoryJobTracker = class {
 		}
 		this.jobs.set(jobId, {
 			...existing,
-			status: JobStatus.FAILED,
+			status: "FAILED",
 			completedAtUtcIso: (/* @__PURE__ */ new Date()).toISOString(),
 			error,
 			job,
@@ -2610,99 +3038,336 @@ function matchesFilter(op, filter) {
 	if (filter.scope && filter.scope.length > 0) {
 		if (!filter.scope.includes(op.context.scope)) return false;
 	}
-	if (filter.branch && filter.branch.length > 0) {
-		if (!filter.branch.includes(op.context.branch)) return false;
+	if (filter.branch && filter.branch.length > 0) {
+		if (!filter.branch.includes(op.context.branch)) return false;
+	}
+	if (filter.documentId && filter.documentId.length > 0) {
+		if (!filter.documentId.includes("*") && !filter.documentId.includes(op.context.documentId)) return false;
+	}
+	return true;
+}
+function nonEmpty(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function namespaceOf(processor) {
+	return nonEmpty(processor.namespace);
+}
+function classNameOf(processor) {
+	const name = processor.constructor.name;
+	return name && name !== "Object" ? name : void 0;
+}
+function resolveProcessorSlots(records, legacy) {
+	if (legacy) return records.map((_, i) => String(i));
+	const seen = /* @__PURE__ */ new Map();
+	return records.map((record, i) => {
+		const base = nonEmpty(record.id) ?? namespaceOf(record.processor) ?? classNameOf(record.processor) ?? String(i);
+		const count = seen.get(base) ?? 0;
+		seen.set(base, count + 1);
+		return count === 0 ? base : `${base}#${count}`;
+	});
+}
+//#endregion
+//#region src/processors/processor-queue.ts
+function isDelivery(task) {
+	return task?.kind === "live" || task?.kind === "advance";
+}
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function lowestOf(ops) {
+	let lowest = ops[0].context.ordinal;
+	for (const op of ops) lowest = Math.min(lowest, op.context.ordinal);
+	return lowest;
+}
+function highestOf(ops) {
+	let highest = 0;
+	for (const op of ops) highest = Math.max(highest, op.context.ordinal);
+	return highest;
+}
+var ProcessorQueue = class {
+	options;
+	tasks = [];
+	running = false;
+	closed = false;
+	replaysAhead = 0;
+	unrouted = /* @__PURE__ */ new Set();
+	constructor(options) {
+		this.options = options;
+	}
+	get isClosed() {
+		return this.closed;
+	}
+	/** Resolves at once behind a replay, so a pass never waits out a backfill. */
+	live(ops) {
+		const delivered = this.push((done) => ({
+			kind: "live",
+			ops,
+			done
+		}));
+		return this.replaysAhead > 0 ? Promise.resolve() : delivered;
+	}
+	/** Raises the cursor past a batch with nothing for this processor. */
+	advance(through) {
+		const last = this.tasks.at(-1);
+		if (last?.kind === "advance") {
+			last.through = Math.max(last.through, through);
+			return Promise.resolve();
+		}
+		return this.push((done) => ({
+			kind: "advance",
+			through,
+			done
+		}));
+	}
+	/** Replays from the cursor as it stands when the task runs. */
+	backfill() {
+		return this.replay("backfill", () => this.runBackfill());
+	}
+	/** Clears an error and replays from the cursor. No-op when active. */
+	retry() {
+		return this.replay("retry", async () => {
+			const { cursor } = this.options;
+			if (cursor.status !== "errored") return;
+			cursor.status = "active";
+			cursor.lastError = void 0;
+			cursor.lastErrorTimestamp = void 0;
+			await this.persist();
+			await this.runBackfill();
+		});
+	}
+	/** Stops cursor writes now; queued tasks still run before the disconnect. */
+	close() {
+		if (this.closed) return Promise.resolve();
+		const disconnect = this.enqueue("disconnect", async () => {
+			try {
+				await this.options.processor.onDisconnect();
+			} catch (error) {
+				this.options.logger.error("Error disconnecting processor '@ProcessorId': @Error", this.options.processorId, error);
+			}
+		});
+		this.closed = true;
+		return disconnect;
+	}
+	replay(kind, run) {
+		if (this.closed) return Promise.resolve();
+		this.replaysAhead++;
+		return this.enqueue(kind, async () => {
+			try {
+				await run();
+			} finally {
+				this.replaysAhead--;
+			}
+		});
+	}
+	enqueue(kind, run) {
+		return this.push((done) => ({
+			kind,
+			run,
+			done
+		}));
+	}
+	push(task) {
+		if (this.closed) return Promise.resolve();
+		return new Promise((resolve) => {
+			this.tasks.push(task(resolve));
+			if (this.running) return;
+			this.running = true;
+			queueMicrotask(() => void this.drain());
+		});
+	}
+	async drain() {
+		while (this.tasks.length > 0) {
+			const task = this.tasks.shift();
+			const batch = [];
+			if (isDelivery(task)) {
+				batch.push(task);
+				let size = task.kind === "live" ? task.ops.length : 0;
+				let next = this.tasks[0];
+				while (isDelivery(next) && size < 500) {
+					if (next.kind === "live") size += next.ops.length;
+					batch.push(next);
+					this.tasks.shift();
+					next = this.tasks[0];
+				}
+			}
+			try {
+				await (isDelivery(task) ? this.deliverLive(batch) : task.run());
+			} catch (error) {
+				this.options.logger.error("Processor '@ProcessorId' task '@Kind' failed: @Error", this.options.processorId, task.kind, error);
+			} finally {
+				task.done();
+				for (const merged of batch.slice(1)) merged.done();
+			}
+		}
+		this.running = false;
+	}
+	async deliverLive(batch) {
+		const { cursor, floor } = this.options;
+		const ops = [];
+		let through = 0;
+		for (const task of batch) if (task.kind === "live") ops.push(...task.ops);
+		else through = Math.max(through, task.through);
+		const fresh = ops.filter((op) => {
+			const ordinal = op.context.ordinal;
+			if (ordinal <= floor) return false;
+			return !this.unrouted.delete(ordinal);
+		});
+		if (fresh.length === 0) {
+			await this.raiseCursor(through);
+			return;
+		}
+		if (cursor.status !== "active") {
+			await this.parkBelow(fresh);
+			return;
+		}
+		if (!await this.deliver(fresh)) {
+			await this.parkBelow(fresh);
+			return;
+		}
+		await this.raiseCursor(Math.max(highestOf(fresh), through));
+	}
+	async runBackfill() {
+		const { cursor, filter, floor } = this.options;
+		if (cursor.status !== "active") return;
+		let page;
+		try {
+			page = await this.options.readSince(cursor.lastOrdinal);
+		} catch (error) {
+			await this.fail(error, "reading backfill");
+			return;
+		}
+		while (page.results.length > 0) {
+			if (this.closed) return;
+			const matching = page.results.filter((op) => op.context.ordinal > floor && matchesFilter(op, filter));
+			if (matching.length > 0) {
+				if (!await this.deliver(matching)) {
+					await this.persist();
+					return;
+				}
+				this.dedupeQueued(matching);
+			}
+			await this.raiseCursor(highestOf(page.results));
+			if (!page.next) break;
+			try {
+				page = await page.next();
+			} catch (error) {
+				await this.fail(error, "reading backfill");
+				return;
+			}
+		}
+	}
+	dedupeQueued(delivered) {
+		const routed = this.options.routedThrough();
+		const queued = /* @__PURE__ */ new Set();
+		for (const op of delivered) {
+			const ordinal = op.context.ordinal;
+			if (ordinal > routed) this.unrouted.add(ordinal);
+			else queued.add(ordinal);
+		}
+		if (queued.size === 0) return;
+		for (const task of this.tasks) {
+			if (task.kind !== "live") continue;
+			task.ops = task.ops.filter((op) => !queued.has(op.context.ordinal));
+		}
+	}
+	async deliver(ops) {
+		try {
+			await this.options.processor.onOperations(ops);
+			return true;
+		} catch (error) {
+			this.markErrored(error);
+			this.options.logger.error("Processor '@ProcessorId' failed at ordinal @Ordinal: @Error", this.options.processorId, lowestOf(ops), error);
+			return false;
+		}
 	}
-	if (filter.documentId && filter.documentId.length > 0) {
-		if (!filter.documentId.includes("*") && !filter.documentId.includes(op.context.documentId)) return false;
+	async fail(error, during) {
+		this.markErrored(error);
+		await this.persist();
+		this.options.logger.error("Processor '@ProcessorId' failed @During: @Error", this.options.processorId, during, error);
+	}
+	markErrored(error) {
+		const { cursor } = this.options;
+		cursor.status = "errored";
+		cursor.lastError = errorMessage(error);
+		cursor.lastErrorTimestamp = /* @__PURE__ */ new Date();
+	}
+	async raiseCursor(through) {
+		const { cursor } = this.options;
+		if (cursor.status !== "active") return;
+		if (through <= cursor.lastOrdinal) return;
+		cursor.lastOrdinal = through;
+		await this.persist();
+	}
+	async parkBelow(missed) {
+		const { cursor } = this.options;
+		cursor.lastOrdinal = Math.min(cursor.lastOrdinal, lowestOf(missed) - 1);
+		await this.persist();
+	}
+	async persist() {
+		if (this.closed) return;
+		const { cursor } = this.options;
+		try {
+			await this.options.persist({
+				lastOrdinal: cursor.lastOrdinal,
+				status: cursor.status,
+				lastError: cursor.lastError,
+				lastErrorTimestamp: cursor.lastErrorTimestamp
+			});
+		} catch (error) {
+			this.options.logger.error("Failed to persist cursor for '@ProcessorId': @Error", this.options.processorId, error);
+		}
 	}
-	return true;
-}
-function nonEmpty(value) {
-	return typeof value === "string" && value.length > 0 ? value : void 0;
-}
-function namespaceOf(processor) {
-	return nonEmpty(processor.namespace);
-}
-function classNameOf(processor) {
-	const name = processor.constructor.name;
-	return name && name !== "Object" ? name : void 0;
-}
-function resolveProcessorSlots(records, legacy) {
-	if (legacy) return records.map((_, i) => String(i));
-	const seen = /* @__PURE__ */ new Map();
-	return records.map((record, i) => {
-		const base = nonEmpty(record.id) ?? namespaceOf(record.processor) ?? classNameOf(record.processor) ?? String(i);
-		const count = seen.get(base) ?? 0;
-		seen.set(base, count + 1);
-		return count === 0 ? base : `${base}#${count}`;
-	});
-}
+};
 //#endregion
 //#region src/processors/processor-manager.ts
-/**
-* Manages processor lifecycle based on operations.
-* Extends BaseReadModel to receive operations from ReadModelCoordinator.
-*
-* Responsibilities:
-* 1. Detect drive creation from CREATE_DOCUMENT operations
-* 2. Create processors for each drive using registered factories
-* 3. Route operations to matching processors based on filters
-* 4. Clean up processors when drives are deleted or factories are unregistered
-* 5. Track per-processor cursors for failure recovery and backfill
-*/
 var ProcessorManager = class extends BaseReadModel {
 	factoryRegistry = /* @__PURE__ */ new Map();
 	processorsByDrive = /* @__PURE__ */ new Map();
-	factoryToProcessors = /* @__PURE__ */ new Map();
+	pendingSlots = /* @__PURE__ */ new Set();
 	knownDrives = /* @__PURE__ */ new Map();
+	highestRoutedOrdinal = 0;
 	cursorCache = /* @__PURE__ */ new Map();
+	cursorWrites = /* @__PURE__ */ new Map();
+	draining = /* @__PURE__ */ new Map();
 	logger;
 	driveContainerTypes;
 	legacyProcessorIds;
 	constructor(db, operationIndex, writeCache, consistencyTracker, logger, driveContainerTypes, options = {}) {
 		super(db, operationIndex, writeCache, consistencyTracker, {
 			readModelId: "processor-manager",
-			rebuildStateOnInit: true
+			rebuildStateOnInit: true,
+			indexing: unchunkedReadModelIndexingConfig
 		});
 		this.logger = logger;
 		this.driveContainerTypes = driveContainerTypes;
 		this.legacyProcessorIds = options.legacyProcessorIds ?? true;
 	}
 	async init() {
-		await super.init();
 		await this.loadAllCursors();
+		await super.init();
 		await this.discoverExistingDrives();
 	}
 	async commitOperations(items) {
-		await this.detectAndRegisterNewDrives(items);
-		await this.detectAndCleanupDeletedDrives(items);
-		await this.routeOperationsToProcessors(items);
+		const { runs, reserved } = this.detectNewDrives(items);
+		const disconnects = this.detectDeletedDrives(items);
+		const deliveries = this.enqueueRouted(items, reserved);
+		await Promise.all([
+			...runs.map((run) => run()),
+			...disconnects,
+			...deliveries
+		]);
 	}
 	async registerFactory(identifier, factory) {
-		if (this.factoryRegistry.has(identifier)) await this.unregisterFactory(identifier);
+		const removals = this.removeFactory(identifier);
 		this.factoryRegistry.set(identifier, factory);
-		this.factoryToProcessors.set(identifier, /* @__PURE__ */ new Map());
-		for (const [driveId, documentType] of this.knownDrives) {
-			const driveHeader = createMinimalDriveHeader(driveId, documentType);
-			await this.createProcessorsForDrive(driveId, identifier, factory, driveHeader);
-		}
+		const previous = this.draining.get(identifier);
+		const creationOrdinal = this.highWater() + 1;
+		const runs = [];
+		for (const [driveId, documentType] of this.knownDrives) runs.push(this.reserveSlot(identifier, factory, driveId, createMinimalDriveHeader(driveId, documentType), creationOrdinal, void 0, false, previous).run);
+		await Promise.all([...removals, ...runs.map((run) => run())]);
 	}
 	async unregisterFactory(identifier) {
-		const factoryProcessors = this.factoryToProcessors.get(identifier);
-		if (!factoryProcessors) return;
-		for (const [driveId, tracked] of factoryProcessors) {
-			for (const t of tracked) await this.safeDisconnect(t.record.processor);
-			const driveProcessors = this.processorsByDrive.get(driveId);
-			if (driveProcessors) {
-				const remaining = driveProcessors.filter((p) => !tracked.includes(p));
-				if (remaining.length > 0) this.processorsByDrive.set(driveId, remaining);
-				else this.processorsByDrive.delete(driveId);
-			}
-		}
-		await this.deleteProcessorCursors({ factoryId: identifier });
-		this.factoryToProcessors.delete(identifier);
-		this.factoryRegistry.delete(identifier);
+		await Promise.all(this.removeFactory(identifier));
 	}
 	get(processorId) {
 		for (const tracked of this.allTrackedProcessors()) if (tracked.processorId === processorId) return tracked;
@@ -2710,208 +3375,283 @@ var ProcessorManager = class extends BaseReadModel {
 	getAll() {
 		return Array.from(this.allTrackedProcessors());
 	}
-	*allTrackedProcessors() {
-		for (const tracked of this.processorsByDrive.values()) yield* tracked;
-	}
-	async detectAndRegisterNewDrives(operations) {
-		for (const op of operations) {
+	/** Synchronous: reserves a slot per registered factory for each new drive. */
+	detectNewDrives(items) {
+		const runs = [];
+		const reserved = /* @__PURE__ */ new Set();
+		for (const op of items) {
 			if (!this.isDriveCreation(op)) continue;
 			const driveId = op.context.documentId;
 			if (this.knownDrives.has(driveId)) continue;
 			this.knownDrives.set(driveId, op.context.documentType);
 			const driveHeader = extractDriveHeader(op);
 			if (!driveHeader) continue;
-			for (const [identifier, factory] of this.factoryRegistry) await this.createProcessorsForDrive(driveId, identifier, factory, driveHeader);
+			for (const [identifier, factory] of this.factoryRegistry) {
+				const { slot, run } = this.reserveSlot(identifier, factory, driveId, driveHeader, op.context.ordinal, items, true);
+				reserved.add(slot);
+				runs.push(run);
+			}
 		}
+		return {
+			runs,
+			reserved
+		};
 	}
-	isDriveCreation(op) {
-		return op.operation.action.type === "CREATE_DOCUMENT" && this.driveContainerTypes.has(op.context.documentType);
-	}
-	async detectAndCleanupDeletedDrives(operations) {
-		for (const op of operations) {
+	/** Synchronous: drops a deleted drive's processors from the tables. */
+	detectDeletedDrives(items) {
+		const pending = [];
+		for (const op of items) {
 			if (!isDriveDeletion(op)) continue;
 			const driveId = extractDeletedDocumentId(op);
 			if (!driveId || !this.knownDrives.has(driveId)) continue;
-			if (!this.isDeletedDocumentADrive(driveId)) continue;
-			await this.cleanupDriveProcessors(driveId);
 			this.knownDrives.delete(driveId);
+			for (const slot of this.pendingSlots) if (slot.driveId === driveId) this.pendingSlots.delete(slot);
+			for (const { queue } of this.processorsByDrive.get(driveId) ?? []) queue.close();
+			this.processorsByDrive.delete(driveId);
+			pending.push(...this.deleteCursors((row) => row.driveId === driveId));
+		}
+		return pending;
+	}
+	/** Synchronous: puts each processor's share of the batch on its queue. */
+	enqueueRouted(items, reserved) {
+		if (items.length === 0) return [];
+		let lowest = items[0].context.ordinal;
+		let highest = 0;
+		for (const item of items) {
+			lowest = Math.min(lowest, item.context.ordinal);
+			highest = Math.max(highest, item.context.ordinal);
+		}
+		this.highestRoutedOrdinal = Math.max(this.highestRoutedOrdinal, highest);
+		for (const slot of this.pendingSlots) {
+			if (reserved.has(slot)) continue;
+			slot.lowestRoutedOrdinal = Math.min(slot.lowestRoutedOrdinal ?? lowest, lowest);
+		}
+		const deliveries = [];
+		for (const { tracked, queue } of this.allBound()) {
+			const matching = items.filter((op) => matchesFilter(op, tracked.record.filter));
+			if (matching.length > 0) deliveries.push(queue.live(matching));
+			else queue.advance(highest);
+		}
+		return deliveries;
+	}
+	/** Synchronous: binds records, or discards them if the slot was cancelled. */
+	bind(slot, records, creationOrdinal, creationItems) {
+		const released = this.pendingSlots.delete(slot);
+		if (!records || records.length === 0) {
+			const settled = Promise.resolve();
+			return {
+				persisted: settled,
+				delivered: settled
+			};
+		}
+		if (!released) {
+			const discarded = records.map((record) => this.discard(slot, record.processor.onDisconnect.bind(record.processor)));
+			const settled = Promise.all(discarded).then(() => void 0);
+			return {
+				persisted: settled,
+				delivered: settled
+			};
 		}
+		const { factoryId, driveId, lowestRoutedOrdinal } = slot;
+		const ids = resolveProcessorSlots(records, this.legacyProcessorIds);
+		const bound = records.map((record, i) => this.track(slot, record, i, `${factoryId}:${driveId}:${ids[i]}`, creationOrdinal, lowestRoutedOrdinal));
+		const drive = this.processorsByDrive.get(driveId) ?? [];
+		this.processorsByDrive.set(driveId, [...drive, ...bound]);
+		const liveIds = new Set(bound.map((b) => b.tracked.processorId));
+		const writes = this.deleteCursors((row) => row.factoryId === factoryId && row.driveId === driveId && !liveIds.has(row.processorId));
+		for (const { tracked } of bound) writes.push(this.writeCursor(tracked, tracked));
+		const deliveries = [];
+		for (const { tracked, queue } of bound) {
+			const missed = tracked.lastOrdinal < slot.reservedAt || lowestRoutedOrdinal !== void 0;
+			if (tracked.status === "active" && missed) deliveries.push(queue.backfill());
+			const matching = creationItems?.filter((op) => matchesFilter(op, tracked.record.filter));
+			if (matching && matching.length > 0) deliveries.push(queue.live(matching));
+		}
+		return {
+			persisted: Promise.all(writes).then(() => void 0),
+			delivered: Promise.all(deliveries).then(() => void 0)
+		};
 	}
-	async discoverExistingDrives() {
-		const drives = await this.db.selectFrom("DocumentSnapshot").select(["documentId", "documentType"]).where("documentType", "in", [...this.driveContainerTypes]).where("isDeleted", "=", false).execute();
-		for (const drive of drives) this.knownDrives.set(drive.documentId, drive.documentType);
+	/** Synchronous: removes a factory's slots, processors and cursor rows. */
+	removeFactory(identifier) {
+		if (!this.factoryRegistry.delete(identifier)) return [];
+		const closing = [];
+		for (const slot of this.pendingSlots) {
+			if (slot.factoryId !== identifier) continue;
+			this.pendingSlots.delete(slot);
+			if (slot.settled) closing.push(slot.settled);
+		}
+		for (const [driveId, drive] of this.processorsByDrive) {
+			const remaining = [];
+			for (const b of drive) if (b.tracked.factoryId === identifier) closing.push(b.queue.close());
+			else remaining.push(b);
+			if (remaining.length > 0) this.processorsByDrive.set(driveId, remaining);
+			else this.processorsByDrive.delete(driveId);
+		}
+		if (closing.length > 0) {
+			const drained = Promise.all([this.draining.get(identifier), ...closing]).then(() => void 0);
+			this.draining.set(identifier, drained);
+			drained.then(() => {
+				if (this.draining.get(identifier) === drained) this.draining.delete(identifier);
+			});
+		}
+		return this.deleteCursors((row) => row.factoryId === identifier);
 	}
-	isDeletedDocumentADrive(documentId) {
-		return this.knownDrives.has(documentId);
+	reserveSlot(factoryId, factory, driveId, driveHeader, creationOrdinal, creationItems, awaitDelivery, previous) {
+		const slot = {
+			factoryId,
+			driveId,
+			reservedAt: this.highWater(),
+			lowestRoutedOrdinal: void 0,
+			settled: void 0
+		};
+		this.pendingSlots.add(slot);
+		const run = async () => {
+			const bound = (async () => {
+				await previous;
+				const records = await this.runFactory(slot, factory, driveHeader);
+				return this.bind(slot, records, creationOrdinal, creationItems);
+			})();
+			slot.settled = bound.then(({ persisted }) => persisted);
+			const { persisted, delivered } = await bound;
+			await (awaitDelivery ? Promise.all([persisted, delivered]) : persisted);
+		};
+		return {
+			slot,
+			run
+		};
 	}
-	async createProcessorsForDrive(driveId, identifier, factory, driveHeader) {
-		let records;
+	async runFactory(slot, factory, driveHeader) {
 		try {
-			records = await factory(driveHeader);
+			return await factory(driveHeader);
 		} catch (error) {
-			this.logger.error("Factory '@FactoryId' failed for drive '@DriveId': @Error", identifier, driveId, error);
+			this.logger.error("Factory '@FactoryId' failed for drive '@DriveId': @Error", slot.factoryId, slot.driveId, error);
 			return;
 		}
-		if (records.length === 0) return;
-		const trackedList = [];
-		const slots = resolveProcessorSlots(records, this.legacyProcessorIds);
-		for (let i = 0; i < records.length; i++) {
-			const record = records[i];
-			const processorId = `${identifier}:${driveId}:${slots[i]}`;
-			const cached = this.cursorCache.get(processorId);
-			let lastOrdinal;
-			let status;
-			let lastError;
-			let lastErrorTimestamp;
-			if (cached) {
-				lastOrdinal = cached.lastOrdinal;
-				status = cached.status;
-				lastError = cached.lastError ?? void 0;
-				lastErrorTimestamp = cached.lastErrorTimestamp ?? void 0;
-			} else {
-				lastOrdinal = (record.startFrom ?? "beginning") === "current" ? this.lastOrdinal : 0;
-				status = "active";
-				lastError = void 0;
-				lastErrorTimestamp = void 0;
-			}
-			const tracked = {
-				processorId,
-				factoryId: identifier,
-				driveId,
-				processorIndex: i,
-				record,
-				lastOrdinal,
-				status,
-				lastError,
-				lastErrorTimestamp,
-				retry: () => this.retryProcessor(tracked)
+	}
+	track(slot, record, processorIndex, processorId, creationOrdinal, lowestRoutedOrdinal) {
+		const cached = this.cursorCache.get(processorId);
+		let floor = 0;
+		let cursor;
+		if (cached) cursor = {
+			lastOrdinal: cached.lastOrdinal,
+			status: cached.status,
+			lastError: cached.lastError ?? void 0,
+			lastErrorTimestamp: cached.lastErrorTimestamp ?? void 0
+		};
+		else {
+			if (record.startFrom === "current") floor = creationOrdinal - 1;
+			cursor = {
+				lastOrdinal: floor,
+				status: "active",
+				lastError: void 0,
+				lastErrorTimestamp: void 0
 			};
-			trackedList.push(tracked);
-			await this.saveProcessorCursor(tracked);
-		}
-		const liveIds = new Set(trackedList.map((t) => t.processorId));
-		await this.db.deleteFrom("ProcessorCursor").where("factoryId", "=", identifier).where("driveId", "=", driveId).where("processorId", "not in", [...liveIds]).execute();
-		for (const [id, row] of this.cursorCache) if (row.factoryId === identifier && row.driveId === driveId && !liveIds.has(id)) this.cursorCache.delete(id);
-		const factoryProcessors = this.factoryToProcessors.get(identifier);
-		if (factoryProcessors) factoryProcessors.set(driveId, trackedList);
-		const existingDriveProcessors = this.processorsByDrive.get(driveId) ?? [];
-		this.processorsByDrive.set(driveId, [...existingDriveProcessors, ...trackedList]);
-		for (const tracked of trackedList) if (tracked.status === "active" && tracked.lastOrdinal < this.lastOrdinal) await this.backfillProcessor(tracked);
-	}
-	async backfillProcessor(tracked) {
-		let page = await this.operationIndex.getSinceOrdinal(tracked.lastOrdinal);
-		while (page.results.length > 0) {
-			const matching = page.results.filter((op) => matchesFilter(op, tracked.record.filter));
-			if (matching.length > 0) try {
-				await tracked.record.processor.onOperations(matching);
-			} catch (error) {
-				tracked.status = "errored";
-				tracked.lastError = error instanceof Error ? error.message : String(error);
-				tracked.lastErrorTimestamp = /* @__PURE__ */ new Date();
-				await this.safeSaveProcessorCursor(tracked);
-				this.logger.error("Processor '@ProcessorId' failed during backfill at ordinal @Ordinal: @Error", tracked.processorId, tracked.lastOrdinal, error);
-				return;
-			}
-			tracked.lastOrdinal = page.results[page.results.length - 1].context.ordinal;
-			await this.safeSaveProcessorCursor(tracked);
-			if (!page.next) break;
-			page = await page.next();
-		}
-	}
-	async retryProcessor(tracked) {
-		if (tracked.status !== "errored") return;
-		tracked.status = "active";
-		tracked.lastError = void 0;
-		tracked.lastErrorTimestamp = void 0;
-		await this.saveProcessorCursor(tracked);
-		await this.backfillProcessor(tracked);
-	}
-	async cleanupDriveProcessors(driveId) {
-		const processors = this.processorsByDrive.get(driveId);
-		if (!processors) return;
-		for (const tracked of processors) await this.safeDisconnect(tracked.record.processor);
-		this.processorsByDrive.delete(driveId);
-		for (const factoryProcessors of this.factoryToProcessors.values()) factoryProcessors.delete(driveId);
-		await this.deleteProcessorCursors({ driveId });
-	}
-	async safeDisconnect(processor) {
+		}
+		if (lowestRoutedOrdinal !== void 0) cursor.lastOrdinal = Math.max(floor, Math.min(cursor.lastOrdinal, lowestRoutedOrdinal - 1));
+		const tracked = {
+			processorId,
+			factoryId: slot.factoryId,
+			driveId: slot.driveId,
+			processorIndex,
+			record,
+			...cursor,
+			retry: () => queue.retry()
+		};
+		const queue = new ProcessorQueue({
+			processorId,
+			processor: record.processor,
+			filter: record.filter,
+			cursor: tracked,
+			floor,
+			readSince: (ordinal) => this.operationIndex.getSinceOrdinal(ordinal),
+			routedThrough: () => this.highWater(),
+			persist: (state) => this.writeCursor(tracked, state),
+			logger: this.logger
+		});
+		return {
+			tracked,
+			queue
+		};
+	}
+	async discard(slot, disconnect) {
 		try {
-			await processor.onDisconnect();
+			await disconnect();
 		} catch (error) {
-			this.logger.error("Error disconnecting processor: @Error", error);
+			this.logger.error("Error disconnecting discarded processor for '@FactoryId' on '@DriveId': @Error", slot.factoryId, slot.driveId, error);
 		}
 	}
-	async routeOperationsToProcessors(operations) {
-		let maxOrdinal = 0;
-		for (const op of operations) maxOrdinal = Math.max(maxOrdinal, op.context.ordinal);
-		const allTracked = Array.from(this.allTrackedProcessors());
-		await Promise.all(allTracked.map(async (tracked) => {
-			if (tracked.status !== "active") return;
-			const matching = operations.filter((op) => op.context.ordinal > tracked.lastOrdinal).filter((op) => matchesFilter(op, tracked.record.filter));
-			if (matching.length > 0) try {
-				await tracked.record.processor.onOperations(matching);
-			} catch (error) {
-				tracked.status = "errored";
-				tracked.lastError = error instanceof Error ? error.message : String(error);
-				tracked.lastErrorTimestamp = /* @__PURE__ */ new Date();
-				await this.safeSaveProcessorCursor(tracked);
-				this.logger.error("Processor '@ProcessorId' failed at ordinal @Ordinal: @Error", tracked.processorId, tracked.lastOrdinal, error);
-				return;
-			}
-			tracked.lastOrdinal = maxOrdinal;
-			await this.safeSaveProcessorCursor(tracked);
-		}));
+	highWater() {
+		return Math.max(this.lastOrdinal, this.highestRoutedOrdinal);
+	}
+	*allBound() {
+		for (const drive of this.processorsByDrive.values()) yield* drive;
+	}
+	*allTrackedProcessors() {
+		for (const { tracked } of this.allBound()) yield tracked;
+	}
+	isDriveCreation(op) {
+		return op.operation.action.type === "CREATE_DOCUMENT" && this.driveContainerTypes.has(op.context.documentType);
+	}
+	async discoverExistingDrives() {
+		const drives = await this.db.selectFrom("DocumentSnapshot").select(["documentId", "documentType"]).where("documentType", "in", [...this.driveContainerTypes]).where("isDeleted", "=", false).execute();
+		for (const drive of drives) this.knownDrives.set(drive.documentId, drive.documentType);
 	}
 	async loadAllCursors() {
 		const rows = await this.db.selectFrom("ProcessorCursor").selectAll().execute();
 		for (const row of rows) this.cursorCache.set(row.processorId, row);
 	}
-	async safeSaveProcessorCursor(tracked) {
-		try {
-			await this.saveProcessorCursor(tracked);
-		} catch (error) {
-			this.logger.error("Failed to persist cursor for '@ProcessorId': @Error", tracked.processorId, error);
-		}
+	lane(processorId, write) {
+		const next = (this.cursorWrites.get(processorId) ?? Promise.resolve()).then(write).then(() => void 0, (error) => {
+			this.logger.error("Failed to write cursor for '@ProcessorId': @Error", processorId, error);
+		});
+		this.cursorWrites.set(processorId, next);
+		next.then(() => {
+			if (this.cursorWrites.get(processorId) === next) this.cursorWrites.delete(processorId);
+		});
+		return next;
 	}
-	async saveProcessorCursor(tracked) {
-		await this.db.insertInto("ProcessorCursor").values({
+	writeCursor(tracked, state) {
+		const now = /* @__PURE__ */ new Date();
+		const row = {
 			processorId: tracked.processorId,
 			factoryId: tracked.factoryId,
 			driveId: tracked.driveId,
 			processorIndex: tracked.processorIndex,
-			lastOrdinal: tracked.lastOrdinal,
-			status: tracked.status,
-			lastError: tracked.lastError ?? null,
-			lastErrorTimestamp: tracked.lastErrorTimestamp ?? null,
-			updatedAt: /* @__PURE__ */ new Date()
+			lastOrdinal: state.lastOrdinal,
+			status: state.status,
+			lastError: state.lastError ?? null,
+			lastErrorTimestamp: state.lastErrorTimestamp ?? null,
+			createdAt: now,
+			updatedAt: now
+		};
+		this.cursorCache.set(row.processorId, row);
+		return this.lane(row.processorId, () => this.db.insertInto("ProcessorCursor").values({
+			processorId: row.processorId,
+			factoryId: row.factoryId,
+			driveId: row.driveId,
+			processorIndex: row.processorIndex,
+			lastOrdinal: row.lastOrdinal,
+			status: row.status,
+			lastError: row.lastError,
+			lastErrorTimestamp: row.lastErrorTimestamp,
+			updatedAt: now
 		}).onConflict((oc) => oc.column("processorId").doUpdateSet({
-			lastOrdinal: tracked.lastOrdinal,
-			status: tracked.status,
-			lastError: tracked.lastError ?? null,
-			lastErrorTimestamp: tracked.lastErrorTimestamp ?? null,
-			updatedAt: /* @__PURE__ */ new Date()
-		})).execute();
-		this.cursorCache.set(tracked.processorId, {
-			processorId: tracked.processorId,
-			factoryId: tracked.factoryId,
-			driveId: tracked.driveId,
-			processorIndex: tracked.processorIndex,
-			lastOrdinal: tracked.lastOrdinal,
-			status: tracked.status,
-			lastError: tracked.lastError ?? null,
-			lastErrorTimestamp: tracked.lastErrorTimestamp ?? null,
-			createdAt: /* @__PURE__ */ new Date(),
-			updatedAt: /* @__PURE__ */ new Date()
-		});
-	}
-	async deleteProcessorCursors(filter) {
-		if ("factoryId" in filter) {
-			await this.db.deleteFrom("ProcessorCursor").where("factoryId", "=", filter.factoryId).execute();
-			for (const [id, row] of this.cursorCache) if (row.factoryId === filter.factoryId) this.cursorCache.delete(id);
-		} else {
-			await this.db.deleteFrom("ProcessorCursor").where("driveId", "=", filter.driveId).execute();
-			for (const [id, row] of this.cursorCache) if (row.driveId === filter.driveId) this.cursorCache.delete(id);
-		}
+			lastOrdinal: row.lastOrdinal,
+			status: row.status,
+			lastError: row.lastError,
+			lastErrorTimestamp: row.lastErrorTimestamp,
+			updatedAt: now
+		})).execute());
+	}
+	deleteCursors(matches) {
+		const deletes = [];
+		for (const [processorId, row] of this.cursorCache) {
+			if (!matches(row)) continue;
+			this.cursorCache.delete(processorId);
+			deletes.push(this.lane(processorId, () => this.db.deleteFrom("ProcessorCursor").where("processorId", "=", processorId).execute()));
+		}
+		return deletes;
 	}
 };
 //#endregion
@@ -2928,11 +3668,11 @@ var JobExecutionHandle = class {
 	onDefer;
 	getStateName(state) {
 		switch (state) {
-			case JobQueueState.PREPROCESSING: return "PREPROCESSING";
-			case JobQueueState.PENDING: return "PENDING";
-			case JobQueueState.READY: return "READY";
-			case JobQueueState.RUNNING: return "RUNNING";
-			case JobQueueState.RESOLVED: return "RESOLVED";
+			case 0: return "PREPROCESSING";
+			case 1: return "PENDING";
+			case 2: return "READY";
+			case 3: return "RUNNING";
+			case 4: return "RESOLVED";
 			default: return `UNKNOWN`;
 		}
 	}
@@ -2951,23 +3691,23 @@ var JobExecutionHandle = class {
 		return this._state;
 	}
 	start() {
-		if (this._state !== JobQueueState.READY) throw new Error(`Cannot start job in state ${this.getStateName(this._state)}`);
-		this._state = JobQueueState.RUNNING;
+		if (this._state !== 2) throw new Error(`Cannot start job in state ${this.getStateName(this._state)}`);
+		this._state = 3;
 		this.onStart?.();
 	}
 	complete() {
-		if (this._state !== JobQueueState.RUNNING) throw new Error(`Cannot complete job in state ${this.getStateName(this._state)}`);
-		this._state = JobQueueState.RESOLVED;
+		if (this._state !== 3) throw new Error(`Cannot complete job in state ${this.getStateName(this._state)}`);
+		this._state = 4;
 		this.onComplete?.();
 	}
 	fail(error) {
-		if (this._state !== JobQueueState.RUNNING) throw new Error(`Cannot fail job in state ${this.getStateName(this._state)}`);
-		this._state = JobQueueState.RESOLVED;
+		if (this._state !== 3) throw new Error(`Cannot fail job in state ${this.getStateName(this._state)}`);
+		this._state = 4;
 		this.onFail?.(error);
 	}
 	defer() {
-		if (this._state !== JobQueueState.RUNNING) throw new Error(`Cannot defer job in state ${this.getStateName(this._state)}`);
-		this._state = JobQueueState.RESOLVED;
+		if (this._state !== 3) throw new Error(`Cannot defer job in state ${this.getStateName(this._state)}`);
+		this._state = 4;
 		this.onDefer?.();
 	}
 };
@@ -2980,6 +3720,8 @@ var JobExecutionHandle = class {
 * Implements dependency management through queue hints.
 */
 var InMemoryQueue = class {
+	eventBus;
+	resolver;
 	queues = /* @__PURE__ */ new Map();
 	jobIdToQueueKey = /* @__PURE__ */ new Map();
 	docIdToJobId = /* @__PURE__ */ new Map();
@@ -3114,7 +3856,7 @@ var InMemoryQueue = class {
 		this.jobIdToQueueKey.delete(job.id);
 		this.markJobExecuting(job);
 		if (queue.length === 0) this.queues.delete(queueKey);
-		const handle = new JobExecutionHandle(job, JobQueueState.READY, {
+		const handle = new JobExecutionHandle(job, 2, {
 			onStart: () => {},
 			onComplete: () => {
 				this.completeJob(job.id);
@@ -3140,7 +3882,7 @@ var InMemoryQueue = class {
 				this.jobIdToQueueKey.delete(job.id);
 				this.markJobExecuting(job);
 				if (queue.length === 0) this.queues.delete(queueKey);
-				const handle = new JobExecutionHandle(job, JobQueueState.READY, {
+				const handle = new JobExecutionHandle(job, 2, {
 					onStart: () => {},
 					onComplete: () => {
 						this.completeJob(job.id);
@@ -3174,7 +3916,7 @@ var InMemoryQueue = class {
 			this.jobIdToQueueKey.delete(job.id);
 			this.markJobExecuting(job);
 			if (queue.length === 0) this.queues.delete(queueKey);
-			const handle = new JobExecutionHandle(job, JobQueueState.READY, {
+			const handle = new JobExecutionHandle(job, 2, {
 				onStart: () => {},
 				onComplete: () => {
 					this.completeJob(job.id);
@@ -3276,7 +4018,7 @@ var InMemoryQueue = class {
 		if (documentId) this.markJobComplete(jobId, documentId);
 		this.jobIndex.delete(jobId);
 	}
-	async retryJob(jobId, error, accounting = RetryAccounting.CountAgainstLimit) {
+	async retryJob(jobId, error, accounting = "count-against-limit") {
 		const job = this.jobIndex.get(jobId);
 		if (!job) return;
 		job.lastError = error;
@@ -3288,7 +4030,7 @@ var InMemoryQueue = class {
 		const retryCount = job.retryCount || 0;
 		const updatedJob = {
 			...job,
-			retryCount: accounting === RetryAccounting.CountAgainstLimit ? retryCount + 1 : retryCount,
+			retryCount: accounting === "count-against-limit" ? retryCount + 1 : retryCount,
 			lastError: error
 		};
 		await this.enqueue(updatedJob);
@@ -3489,6 +4231,8 @@ function describeSource(source) {
 * and failure-caching state.
 */
 var DocumentModelResolver = class {
+	registry;
+	loader;
 	loadingModels = /* @__PURE__ */ new Map();
 	failedModelTypes = /* @__PURE__ */ new Set();
 	broadcastHook = null;
@@ -3559,6 +4303,7 @@ var DocumentModelResolver = class {
 * Since there is no loader, missing models cannot be recovered.
 */
 var NullDocumentModelResolver = class {
+	registry;
 	constructor(registry) {
 		this.registry = registry;
 	}
@@ -3782,6 +4527,8 @@ var ReactorSubscriptionManager = class {
 * is emitted, so that reactor.get() returns fresh data when callbacks fire.
 */
 var SubscriptionNotificationReadModel = class {
+	subscriptionManager;
+	documentView;
 	name = "subscription-notification";
 	constructor(subscriptionManager, documentView) {
 		this.subscriptionManager = subscriptionManager;
@@ -3804,10 +4551,10 @@ var SubscriptionNotificationReadModel = class {
 				deleted.push(deletedId);
 			} else if (actionType === "ADD_RELATIONSHIP") {
 				const input = operation.action.input;
-				this.subscriptionManager.notifyRelationshipChanged(input.sourceId, input.targetId, RelationshipChangeType.Added, input.childType);
+				this.subscriptionManager.notifyRelationshipChanged(input.sourceId, input.targetId, "added", input.childType);
 			} else if (actionType === "REMOVE_RELATIONSHIP") {
 				const input = operation.action.input;
-				this.subscriptionManager.notifyRelationshipChanged(input.sourceId, input.targetId, RelationshipChangeType.Removed, input.childType);
+				this.subscriptionManager.notifyRelationshipChanged(input.sourceId, input.targetId, "removed", input.childType);
 			} else if (!created.includes(context.documentId)) updatedIds.add(context.documentId);
 		}
 		if (created.length > 0) this.subscriptionManager.notifyDocumentsCreated(created, documentTypes, parentIds);
@@ -3832,6 +4579,10 @@ var SubscriptionNotificationReadModel = class {
 * keeps the common case (a membership write later than all history) free.
 */
 var GroupReevaluationTrigger = class {
+	logger;
+	eventBus;
+	queue;
+	operationIndex;
 	unsubscribe;
 	constructor(logger, eventBus, queue, operationIndex) {
 		this.logger = logger;
@@ -3983,7 +4734,7 @@ var Mailbox = class {
 			this.itemsMap.set(item.id, item);
 			for (const op of item.operations) this._latestOrdinal = Math.max(this._latestOrdinal, op.context.ordinal);
 			item.on((syncOp, _, next) => {
-				if (next === SyncOperationStatus.Applied) for (const op of syncOp.operations) this._ack = Math.max(this._ack, op.context.ordinal);
+				if (next === 2) for (const op of syncOp.operations) this._ack = Math.max(this._ack, op.context.ordinal);
 			});
 		}
 		if (this.paused) {
@@ -4097,7 +4848,7 @@ var BufferedMailbox = class {
 			this.itemsMap.set(item.id, item);
 			for (const op of item.operations) this._latestOrdinal = Math.max(this._latestOrdinal, op.context.ordinal);
 			item.on((syncOp, _, next) => {
-				if (next === SyncOperationStatus.Applied) for (const op of syncOp.operations) this._ack = Math.max(this._ack, op.context.ordinal);
+				if (next === 2) for (const op of syncOp.operations) this._ack = Math.max(this._ack, op.context.ordinal);
 			});
 		}
 		this.addedBuffer.push(...items);
@@ -4211,7 +4962,14 @@ var GraphQLRequestError = class extends Error {
 * difference between a channel that recovers and one that is dead for the
 * process lifetime.
 */
-const RECOVERABLE_GRAPHQL_ERROR_CODES = { malformedStoredOperation: "MALFORMED_STORED_OPERATION" };
+const RECOVERABLE_GRAPHQL_ERROR_CODES = { 
+/**
+* A stored operation cannot be represented in the schema - an action with no
+* id, say. The document holding it needs repairing, but the channel serves
+* every other document, and a peer that stopped polling would stop receiving
+* those too.
+*/
+malformedStoredOperation: "MALFORMED_STORED_OPERATION" };
 const RECOVERABLE_CODES = new Set(Object.values(RECOVERABLE_GRAPHQL_ERROR_CODES));
 /**
 * True when every error the response carried named a recoverable code.
@@ -4229,9 +4987,35 @@ const DRIVE_AUTH_ERROR_MESSAGES = {
 	forbidden: "Forbidden: insufficient permissions",
 	authenticationRequired: "Forbidden: authentication required"
 };
+/**
+* A non-GraphQL HTTP failure against a drive endpoint.
+*
+* Drive discovery (`GET <base>/d/:drive`) is REST, not GraphQL, so its
+* failures cannot be a `GraphQLRequestError` without the name lying about
+* what was called. It carries the status for the same reason that one does:
+* `isDriveAuthError` is what decides whether a failure prompts a login, and a
+* bare `Error` tells it nothing.
+*/
+var DriveRequestError = class extends Error {
+	statusCode;
+	constructor(message, statusCode) {
+		super(message);
+		this.name = "DriveRequestError";
+		this.statusCode = statusCode;
+	}
+};
 /** True when the remote rejected the caller as unauthenticated/unauthorized:
-* an HTTP 401/403, or a Forbidden/Unauthorized GraphQL error. */
+* an HTTP 401/403, or a Forbidden/Unauthorized GraphQL error.
+*
+* 403 and 401 only — NOT 404. The drive info endpoint answers a drive the
+* caller may not read with the same 404 it gives a drive that does not exist,
+* so that an unauthorized caller cannot enumerate drives by probing slugs.
+* That is deliberate, and it costs exactly this: a protected drive is
+* indistinguishable from a typo, and prompting for a login on every 404 would
+* fire on every mistyped URL. See the `WWW-Authenticate` note on the endpoint
+* for the signal that would let a client tell the two apart. */
 function isDriveAuthError(error) {
+	if (error instanceof DriveRequestError) return error.statusCode === 401 || error.statusCode === 403;
 	if (!(error instanceof GraphQLRequestError)) return false;
 	if (error.category === "http") return error.statusCode === 401 || error.statusCode === 403;
 	if (error.category === "graphql") return Object.values(DRIVE_AUTH_ERROR_MESSAGES).some((m) => error.message.includes(m));
@@ -4294,23 +5078,23 @@ var SyncOperation = class {
 		this.scopes = scopes;
 		this.branch = branch;
 		this.operations = operations;
-		this.status = SyncOperationStatus.Unknown;
+		this.status = -1;
 	}
 	on(callback) {
 		this.callbacks.push(callback);
 	}
 	started() {
-		this.transition(SyncOperationStatus.TransportPending);
+		this.transition(0);
 	}
 	transported() {
-		this.transition(SyncOperationStatus.ExecutionPending);
+		this.transition(1);
 	}
 	executed() {
-		this.transition(SyncOperationStatus.Applied);
+		this.transition(2);
 	}
 	failed(error) {
 		this.error = error;
-		this.transition(SyncOperationStatus.Error);
+		this.transition(3);
 	}
 	transition(next) {
 		const prev = this.status;
@@ -4520,9 +5304,11 @@ function consolidateSyncOperations(syncOps) {
 		}
 		const first = group.ops[0];
 		const merged = new SyncOperation(first.id, first.jobId, remappedDeps, first.remoteName, first.documentId, first.scopes, first.branch, allOperations);
-		if (first.status > SyncOperationStatus.TransportPending) if (first.status >= SyncOperationStatus.Error) merged.executed();
-		else if (first.status >= SyncOperationStatus.Applied) merged.transported();
-		else merged.started();
+		if (first.status > 0) {
+			if (first.status >= 3) merged.executed();
+			else if (first.status >= 2) merged.transported();
+			else merged.started();
+		}
 		result.push(merged);
 	}
 	return result;
@@ -4653,7 +5439,7 @@ function syncOperationErrorType(error) {
 	return error?.errorType ?? classifyJobFailure(error?.error?.name ?? "Error");
 }
 /** Dead-letter types that must not stop the document syncing. */
-const NON_QUARANTINING_ERROR_TYPES = new Set(["AUTH_TIMESTAMP_NOT_MONOTONIC"]);
+const NON_QUARANTINING_ERROR_TYPES = /* @__PURE__ */ new Set(["AUTH_TIMESTAMP_NOT_MONOTONIC"]);
 /**
 * A held auth operation must not quarantine: reconciling the two policies needs
 * the traffic a quarantine would stop.
@@ -4879,7 +5665,7 @@ function envelopesToSyncOperations(envelope, remoteName) {
 }
 const getLatestAppliedOrdinal = (syncOps) => {
 	let maxOrdinal = 0;
-	for (const syncOp of syncOps) if (syncOp.status === SyncOperationStatus.Applied) for (const op of syncOp.operations) maxOrdinal = Math.max(maxOrdinal, op.context.ordinal);
+	for (const syncOp of syncOps) if (syncOp.status === 2) for (const op of syncOp.operations) maxOrdinal = Math.max(maxOrdinal, op.context.ordinal);
 	return maxOrdinal;
 };
 //#endregion
@@ -4894,6 +5680,7 @@ const DECISION_FIELDS = ["deniedReason", "errorType"];
 * GraphQL-based synchronization channel for network communication between reactors.
 */
 var GqlRequestChannel = class {
+	logger;
 	inbox;
 	outbox;
 	deadLetter;
@@ -5028,6 +5815,10 @@ var GqlRequestChannel = class {
 		if (this.isShutdown) return;
 		this.pollTimer.triggerNow();
 	}
+	/** This channel polls a remote itself; it has no holder to hear from. */
+	notePoll() {}
+	/** No holder, so nothing this channel reports may strand one. */
+	lastHolderPollUtcMs() {}
 	/**
 	* Initializes the channel by registering it on the remote server and starting polling.
 	*/
@@ -5097,7 +5888,7 @@ var GqlRequestChannel = class {
 		const syncOps = [];
 		for (const dl of deadLetters) {
 			const syncOp = new SyncOperation(crypto.randomUUID(), dl.jobId, [], this.remoteName, dl.documentId, dl.scopes, dl.branch, []);
-			syncOp.failed(new ChannelError(ChannelErrorSource.Outbox, new Error(dl.error), dl.errorType ?? void 0));
+			syncOp.failed(new ChannelError("outbox", new Error(dl.error), dl.errorType ?? void 0));
 			syncOps.push(syncOp);
 		}
 		this.deadLetter.add(...syncOps);
@@ -5117,7 +5908,7 @@ var GqlRequestChannel = class {
 		const classification = this.classifyError(err);
 		this.failureCount++;
 		this.lastFailureUtcMs = Date.now();
-		const channelError = new ChannelError(ChannelErrorSource.Inbox, err);
+		const channelError = new ChannelError("inbox", err);
 		this.logger.error("GqlChannel poll error (@FailureCount, @Classification): @Error", this.failureCount, classification, channelError);
 		if (classification === "unrecoverable") {
 			this.pollTimer.stop();
@@ -5361,7 +6152,7 @@ var GqlRequestChannel = class {
 				this.transitionConnectionState("reconnecting");
 				this.schedulePushRetry();
 			} else {
-				const channelError = new ChannelError(ChannelErrorSource.Outbox, err);
+				const channelError = new ChannelError("outbox", err);
 				for (const syncOp of syncOps) syncOp.failed(channelError);
 				this.deadLetter.add(...syncOps);
 				this.outbox.remove(...syncOps);
@@ -5583,7 +6374,7 @@ var GqlRequestChannelFactory = class {
 			...retryMaxDelayMs !== void 0 && { retryMaxDelayMs },
 			...maxQueueDepth !== void 0 && { maxQueueDepth },
 			...backpressureCheckIntervalMs !== void 0 && { backpressureCheckIntervalMs },
-			startPaused: options?.pollBehavior === PollBehavior.Manual
+			startPaused: options?.pollBehavior === "manual"
 		});
 		return new GqlRequestChannel(this.logger, remoteId, remoteName, cursorStorage, gqlConfig, operationIndex, pollTimer);
 	}
@@ -5600,6 +6391,7 @@ function firstOrdinalOf$1(syncOp) {
 * In general, the resolvers are responsible for updating mailboxes.
 */
 var GqlResponseChannel = class {
+	logger;
 	inbox;
 	outbox;
 	deadLetter;
@@ -5611,6 +6403,7 @@ var GqlResponseChannel = class {
 	lastPersistedOutboxOrdinal = 0;
 	evictedOutboxFloor = Number.POSITIVE_INFINITY;
 	appliedOutboxOrdinal = 0;
+	lastPollUtcMs = Date.now();
 	connectionState = "connecting";
 	connectionStateCallbacks = /* @__PURE__ */ new Set();
 	constructor(logger, channelId, remoteName, cursorStorage) {
@@ -5653,7 +6446,7 @@ var GqlResponseChannel = class {
 		return {
 			state: this.connectionState,
 			failureCount: 0,
-			lastSuccessUtcMs: 0,
+			lastSuccessUtcMs: this.lastPollUtcMs,
 			lastFailureUtcMs: 0,
 			pushBlocked: false,
 			pushFailureCount: 0,
@@ -5669,6 +6462,13 @@ var GqlResponseChannel = class {
 	}
 	/** Response channels are push-driven; resolvers populate mailboxes directly. */
 	triggerPull() {}
+	notePoll() {
+		this.lastPollUtcMs = Date.now();
+	}
+	/** This channel is served: its holder's polls are the liveness it reports. */
+	lastHolderPollUtcMs() {
+		return this.lastPollUtcMs;
+	}
 	async init() {
 		const cursors = await this.cursorStorage.list(this.remoteName);
 		const inboxOrdinal = cursors.find((c) => c.cursorType === "inbox")?.cursorOrdinal ?? 0;
@@ -5702,7 +6502,7 @@ var GqlResponseChannel = class {
 	*/
 	rememberUnserved(syncOps) {
 		for (const syncOp of syncOps) {
-			if (syncOp.status === SyncOperationStatus.Applied) continue;
+			if (syncOp.status === 2) continue;
 			const first = firstOrdinalOf$1(syncOp);
 			if (first > 0 && first < this.evictedOutboxFloor) this.evictedOutboxFloor = first;
 		}
@@ -5747,7 +6547,7 @@ var GqlResponseChannel = class {
 	unservedFloor() {
 		let floor = this.evictedOutboxFloor;
 		for (const syncOp of this.outbox.items) {
-			if (syncOp.status === SyncOperationStatus.Applied) continue;
+			if (syncOp.status === 2) continue;
 			const first = firstOrdinalOf$1(syncOp);
 			if (first > 0 && first < floor) floor = first;
 		}
@@ -5787,6 +6587,7 @@ function remoteCursorToRow(cursor) {
 	};
 }
 var KyselySyncCursorStorage = class {
+	db;
 	constructor(db) {
 		this.db = db;
 	}
@@ -5862,6 +6663,7 @@ function deadLetterRecordToRow(record) {
 * PGlite/Kysely-backed implementation of {@link ISyncDeadLetterStorage}.
 */
 var KyselySyncDeadLetterStorage = class {
+	db;
 	constructor(db) {
 		this.db = db;
 	}
@@ -5983,6 +6785,7 @@ function remoteRecordToRow(remote) {
 	};
 }
 var KyselySyncRemoteStorage = class {
+	db;
 	constructor(db) {
 		this.db = db;
 	}
@@ -6133,6 +6936,7 @@ var BatchAggregator = class {
 * to provide a fast path for jobs that have already synced.
 */
 var SyncAwaiter = class {
+	eventBus;
 	completedResults = /* @__PURE__ */ new Map();
 	pendingWaiters = /* @__PURE__ */ new Map();
 	unsubscribers = [];
@@ -6332,25 +7136,30 @@ var SyncStatusTracker = class {
 	}
 };
 function deriveStatus(inboxCount, outboxCount, errorCount) {
-	if (errorCount > 0) return SyncStatus.Error;
-	if (inboxCount > 0 && outboxCount > 0) return SyncStatus.OutgoingAndIncoming;
-	if (inboxCount > 0) return SyncStatus.Incoming;
-	if (outboxCount > 0) return SyncStatus.Outgoing;
-	return SyncStatus.Synced;
+	if (errorCount > 0) return "ERROR";
+	if (inboxCount > 0 && outboxCount > 0) return "OUTGOING_AND_INCOMING";
+	if (inboxCount > 0) return "INCOMING";
+	if (outboxCount > 0) return "OUTGOING";
+	return "SYNCED";
 }
 //#endregion
 //#region src/sync/sync-manager.ts
-var OutboxMode = /* @__PURE__ */ function(OutboxMode) {
-	OutboxMode["Backfill"] = "backfill";
-	OutboxMode["BatchTriggered"] = "batch-triggered";
-	return OutboxMode;
-}(OutboxMode || {});
 const defaultSyncManagerConfig = {
 	maxDeadLettersPerRemote: 100,
 	maxInboxBatchSize: 32,
-	maxHeldOperationsPerRemote: 1e4
+	maxHeldOperationsPerRemote: 1e4,
+	staleRemotePollWindowMs: 3e5
 };
 const PLAN_KEY_TO_JOB_UUID_CAP = 1e4;
+/**
+* Whether a channel failure says the caller could not authenticate or could not
+* reach the remote, rather than that the remote itself is misconfigured. The
+* remote record stays on disk for these so a retry after sign-in can re-add it.
+*/
+function isCredentialOrNetworkError(error) {
+	if (isDriveAuthError(error)) return true;
+	return error instanceof GraphQLRequestError && error.category === "network";
+}
 /** Where a sync operation's run of ordinals begins. */
 function firstOrdinalOf(syncOp) {
 	return syncOp.operations.length > 0 ? syncOp.operations[0].context.ordinal : 0;
@@ -6379,6 +7188,11 @@ var SyncManager = class {
 	backfillAbortControllers = /* @__PURE__ */ new Map();
 	planKeyToJobUuid = /* @__PURE__ */ new Map();
 	evictedOutboxFloors = /* @__PURE__ */ new Map();
+	prunePending = /* @__PURE__ */ new Set();
+	pruneChain = Promise.resolve();
+	derivingOutboxes = 0;
+	pruneDrainDeferred = false;
+	removing = /* @__PURE__ */ new Set();
 	lastEnqueuedJobIdByKey = /* @__PURE__ */ new Map();
 	inboxChunkChain = Promise.resolve();
 	constructor(logger, remoteStorage, cursorStorage, deadLetterStorage, channelFactory, operationIndex, reactor, eventBus, driveContainerTypes, config = {}) {
@@ -6430,18 +7244,19 @@ var SyncManager = class {
 				await channel.init();
 			} catch (error) {
 				this.logger.error("Error initializing channel for remote (@name, @error)", record.name, error instanceof Error ? error.message : String(error));
-				this.remotes.delete(record.name);
+				await this.dropRemoteAfterFailedInit(remote, false);
 				continue;
 			}
 			const outboxAckOrdinal = remote.channel.outbox.ackOrdinal;
 			if (outboxAckOrdinal > 0) {
 				const backfillController = new AbortController();
 				this.backfillAbortControllers.set(record.name, backfillController);
-				this.updateOutbox(remote, outboxAckOrdinal, OutboxMode.Backfill, backfillController.signal).catch((error) => {
+				this.updateOutbox(remote, outboxAckOrdinal, "backfill", backfillController.signal).catch((error) => {
 					if (backfillController.signal.aborted) return;
 					this.logger.error("Backfill failed for remote @RemoteName: @Error", remote.meta.name, error instanceof Error ? error : new Error(String(error)));
 				}).finally(() => {
 					this.backfillAbortControllers.delete(record.name);
+					this.drainPrunes();
 				});
 			}
 		}
@@ -6455,6 +7270,8 @@ var SyncManager = class {
 		this.backfillAbortControllers.clear();
 		this.planKeyToJobUuid.clear();
 		this.lastEnqueuedJobIdByKey.clear();
+		this.prunePending.clear();
+		this.pruneDrainDeferred = false;
 		this.batchAggregator.clear();
 		if (this.eventUnsubscribe) {
 			this.eventUnsubscribe();
@@ -6548,17 +7365,17 @@ var SyncManager = class {
 		try {
 			await channel.init();
 		} catch (error) {
-			this.remotes.delete(name);
-			await this.remoteStorage.remove(name);
+			await this.dropRemoteAfterFailedInit(remote, !isCredentialOrNetworkError(error));
 			throw error;
 		}
 		const backfillController = new AbortController();
 		this.backfillAbortControllers.set(name, backfillController);
-		this.updateOutbox(remote, 0, OutboxMode.Backfill, backfillController.signal).catch((error) => {
+		this.updateOutbox(remote, 0, "backfill", backfillController.signal).catch((error) => {
 			if (backfillController.signal.aborted) return;
 			this.logger.error("Backfill failed for remote @RemoteName: @Error", remote.meta.name, error instanceof Error ? error : new Error(String(error)));
 		}).finally(() => {
 			this.backfillAbortControllers.delete(name);
+			this.drainPrunes();
 		});
 		return remote;
 	}
@@ -6570,21 +7387,62 @@ var SyncManager = class {
 	async remove(name) {
 		const remote = this.remotes.get(name);
 		if (!remote) throw new Error(`Remote with name '${name}' does not exist`);
+		this.removing.add(name);
+		try {
+			await this.teardownRemoteResources(remote);
+			await this.remoteStorage.remove(name);
+			await this.cursorStorage.remove(name);
+		} finally {
+			this.remotes.delete(name);
+			this.removing.delete(name);
+		}
+	}
+	/**
+	* Drops a remote whose channel.init() rejected, optionally removing its
+	* stored record. Ordered like remove(): the registry slot is released last,
+	* so a concurrent add of the same name cannot slip in and have its record
+	* deleted by the removal below. A failure to tear down must not replace the
+	* init error the caller has to classify.
+	*/
+	async dropRemoteAfterFailedInit(remote, removeStorageRecord) {
+		const name = remote.meta.name;
+		this.removing.add(name);
+		try {
+			await this.teardownRemoteResources(remote);
+			if (removeStorageRecord) await this.remoteStorage.remove(name);
+		} catch (error) {
+			this.logger.error("Error tearing down remote after failed init (@name, @error)", name, error instanceof Error ? error.message : String(error));
+		} finally {
+			this.remotes.delete(name);
+			this.removing.delete(name);
+		}
+	}
+	/**
+	* Releases everything wiring a remote up holds: the in-flight backfill, the
+	* channel, the status tracker entry and the connection-state subscription.
+	* The registry slot is deliberately NOT released here -- the caller holds it
+	* until any storage removal has finished, so a concurrent add of the same
+	* name is refused for the whole teardown.
+	*/
+	async teardownRemoteResources(remote) {
+		const name = remote.meta.name;
 		const backfillController = this.backfillAbortControllers.get(name);
 		if (backfillController) {
 			backfillController.abort();
 			this.backfillAbortControllers.delete(name);
 		}
-		await remote.channel.shutdown();
-		await this.remoteStorage.remove(name);
-		await this.cursorStorage.remove(name);
-		this.syncStatusTracker.untrackRemote(name);
-		const unsub = this.connectionStateUnsubscribes.get(name);
-		if (unsub) {
-			unsub();
-			this.connectionStateUnsubscribes.delete(name);
+		try {
+			await remote.channel.shutdown();
+		} finally {
+			this.syncStatusTracker.untrackRemote(name);
+			const unsub = this.connectionStateUnsubscribes.get(name);
+			if (unsub) {
+				unsub();
+				this.connectionStateUnsubscribes.delete(name);
+			}
+			this.evictedOutboxFloors.delete(name);
+			this.prunePending.delete(name);
 		}
-		this.remotes.delete(name);
 	}
 	list() {
 		return Array.from(this.remotes.values());
@@ -6632,7 +7490,7 @@ var SyncManager = class {
 					scopes: syncOp.scopes,
 					branch: syncOp.branch,
 					operations: syncOp.operations,
-					errorSource: syncOp.error?.source ?? ChannelErrorSource.None,
+					errorSource: syncOp.error?.source ?? "none",
 					errorMessage: syncOp.error?.error.message ?? "unknown",
 					errorType
 				};
@@ -6679,7 +7537,7 @@ var SyncManager = class {
 		this.logger.debug("Loaded @count persisted dead letters for remote @name", records.length, remote.meta.name);
 	}
 	getRemotesForCollection(collectionId) {
-		return Array.from(this.remotes.values()).filter((remote) => remote.meta.collectionId.key === collectionId);
+		return Array.from(this.remotes.values()).filter((remote) => remote.meta.collectionId.key === collectionId && !this.removing.has(remote.meta.name));
 	}
 	async processCompleteBatch(batch) {
 		if (this.isShutdown) return;
@@ -6690,7 +7548,11 @@ var SyncManager = class {
 			for (const remote of remotes) if (!affectedRemotes.includes(remote)) affectedRemotes.push(remote);
 		}
 		for (const remote of affectedRemotes) trimMailboxFromBatch(remote.channel.inbox, batch);
-		for (const remote of affectedRemotes) await this.updateOutbox(remote, remote.channel.outbox.latestOrdinal, OutboxMode.BatchTriggered);
+		for (const remote of affectedRemotes) {
+			if (!this.remotes.has(remote.meta.name) || this.removing.has(remote.meta.name)) continue;
+			await this.updateOutbox(remote, remote.channel.outbox.latestOrdinal, "batch-triggered");
+		}
+		await this.drainPrunes();
 	}
 	handleInboxAdded(remote, syncOps) {
 		if (this.isShutdown) return;
@@ -6730,7 +7592,7 @@ var SyncManager = class {
 			if (this.isShutdown) return;
 			const err = error instanceof Error ? error : new Error(String(error));
 			this.logger.error("Failed to load operations from inbox (@remote, @documentId, @error)", remote.meta.name, syncOp.documentId, err.message);
-			const channelError = new ChannelError(ChannelErrorSource.Inbox, err);
+			const channelError = new ChannelError("inbox", err);
 			syncOp.failed(channelError);
 			remote.channel.deadLetter.add(syncOp);
 			remote.channel.inbox.remove(syncOp);
@@ -6743,14 +7605,14 @@ var SyncManager = class {
 			if (this.isShutdown) return;
 			const err = error instanceof Error ? error : new Error(String(error));
 			this.logger.error("Failed to wait for job completion (@remote, @documentId, @jobId, @error)", remote.meta.name, syncOp.documentId, jobInfo.id, err.message);
-			const channelError = new ChannelError(ChannelErrorSource.Inbox, err);
+			const channelError = new ChannelError("inbox", err);
 			syncOp.failed(channelError);
 			remote.channel.deadLetter.add(syncOp);
 			remote.channel.inbox.remove(syncOp);
 			return;
 		}
 		if (this.isShutdown) return;
-		if (completedJobInfo.status === JobStatus.FAILED) {
+		if (completedJobInfo.status === "FAILED") {
 			const errorMessage = completedJobInfo.error?.message || "Unknown error";
 			this.logger.error("Failed to apply operations from inbox (@remote, @documentId, @jobId, @error)", remote.meta.name, syncOp.documentId, completedJobInfo.id, errorMessage);
 			syncOp.failed(this.inboxFailure(completedJobInfo.error));
@@ -6793,7 +7655,7 @@ var SyncManager = class {
 			if (this.isShutdown) return;
 			for (const { remote, syncOp } of items) {
 				const err = error instanceof Error ? error : new Error(String(error));
-				syncOp.failed(new ChannelError(ChannelErrorSource.Inbox, err));
+				syncOp.failed(new ChannelError("inbox", err));
 				remote.channel.deadLetter.add(syncOp);
 				remote.channel.inbox.remove(syncOp);
 			}
@@ -6810,7 +7672,7 @@ var SyncManager = class {
 		for (const { remote, syncOp } of items) {
 			if (!(syncOp.jobId in result.jobs)) {
 				this.logger.error("Job key missing from batch load result (@remote, @documentId, @jobId)", remote.meta.name, syncOp.documentId, syncOp.jobId);
-				const error = new ChannelError(ChannelErrorSource.Inbox, /* @__PURE__ */ new Error(`Job key '${syncOp.jobId}' missing from batch load result`));
+				const error = new ChannelError("inbox", /* @__PURE__ */ new Error(`Job key '${syncOp.jobId}' missing from batch load result`));
 				syncOp.failed(error);
 				remote.channel.deadLetter.add(syncOp);
 				remote.channel.inbox.remove(syncOp);
@@ -6823,13 +7685,13 @@ var SyncManager = class {
 			} catch (error) {
 				if (this.isShutdown) continue;
 				const err = error instanceof Error ? error : new Error(String(error));
-				syncOp.failed(new ChannelError(ChannelErrorSource.Inbox, err));
+				syncOp.failed(new ChannelError("inbox", err));
 				remote.channel.deadLetter.add(syncOp);
 				remote.channel.inbox.remove(syncOp);
 				continue;
 			}
 			if (this.isShutdown) return;
-			if (completedJobInfo.status === JobStatus.FAILED) {
+			if (completedJobInfo.status === "FAILED") {
 				syncOp.failed(this.inboxFailure(completedJobInfo.error));
 				remote.channel.deadLetter.add(syncOp);
 			} else syncOp.executed();
@@ -6848,7 +7710,7 @@ var SyncManager = class {
 	*/
 	inboxFailure(error) {
 		const message = error?.message || "Unknown error";
-		return new ChannelError(ChannelErrorSource.Inbox, /* @__PURE__ */ new Error(`Failed to apply operations: ${message}`), classifyJobFailure(error?.name ?? "Error"));
+		return new ChannelError("inbox", /* @__PURE__ */ new Error(`Failed to apply operations: ${message}`), classifyJobFailure(error?.name ?? "Error"));
 	}
 	/**
 	* Where the next outbox derivation starts: at the evicted floor when there is
@@ -6875,7 +7737,7 @@ var SyncManager = class {
 	*/
 	evictPastOutboxBound(remote) {
 		const cap = this.config.maxHeldOperationsPerRemote;
-		const queued = remote.channel.outbox.items.filter((syncOp) => syncOp.status === SyncOperationStatus.Unknown).sort((a, b) => firstOrdinalOf(a) - firstOrdinalOf(b));
+		const queued = remote.channel.outbox.items.filter((syncOp) => syncOp.status === -1).sort((a, b) => firstOrdinalOf(a) - firstOrdinalOf(b));
 		let kept = 0;
 		let cut = queued.length;
 		for (let i = 0; i < queued.length; i++) {
@@ -6891,15 +7753,95 @@ var SyncManager = class {
 		const floor = firstOrdinalOf(evicted[0]);
 		const known = this.evictedOutboxFloors.get(remote.meta.name);
 		this.evictedOutboxFloors.set(remote.meta.name, known === void 0 ? floor : Math.min(known, floor));
-		this.logger.warn("Outbox for @RemoteName is past its bound of @Cap operations; evicting @Count entries from ordinal @Floor, to be derived again once it drains", remote.meta.name, cap, evicted.length, floor);
+		const staleMs = this.stalePollAgeMs(remote);
+		if (staleMs !== void 0) {
+			let held = kept;
+			for (const syncOp of evicted) held += syncOp.operations.length;
+			if (!this.prunePending.has(remote.meta.name)) {
+				this.prunePending.add(remote.meta.name);
+				this.logger.warn("Outbox for @RemoteName (@Collection) is past its bound of @Cap operations holding @Held, and it has not been polled for @StaleMs ms; marking the channel for removal once this derivation ends", remote.meta.name, remote.meta.collectionId.key, cap, held, staleMs);
+			}
+		} else this.logger.warn("Outbox for @RemoteName is past its bound of @Cap operations; evicting @Count entries from ordinal @Floor, to be derived again once it drains", remote.meta.name, cap, evicted.length, floor);
 		remote.channel.outbox.remove(...evicted);
 	}
+	/**
+	* How long a served remote's holder has been silent, if past the window.
+	*
+	* The channel is asked, rather than its config inspected: SyncManager serves
+	* and subscribes with the same interface, both kinds report lastSuccessUtcMs,
+	* and the caller-supplied channelConfig.type is a free-form string the
+	* factories do not read -- so neither could tell a dead served channel from a
+	* client whose switchboard is merely unreachable. Only a channel that claims
+	* a holder by reporting when it last heard from one can be removed for that
+	* holder's silence; a channel that reports nothing (or 0) is never pruned.
+	*/
+	stalePollAgeMs(remote) {
+		const last = remote.channel.lastHolderPollUtcMs();
+		if (last === void 0 || last <= 0) return;
+		const age = Date.now() - last;
+		return age >= this.config.staleRemotePollWindowMs ? age : void 0;
+	}
+	/**
+	* Removes the remotes marked stale during eviction.
+	*
+	* Removing a remote that a derivation is still iterating would pull its
+	* mailboxes out from under it, so a drain that arrives during one is deferred
+	* rather than run; the last derivation to finish re-arms it.
+	*/
+	drainPrunes() {
+		if (this.derivingOutboxes > 0) {
+			this.pruneDrainDeferred = true;
+			return Promise.resolve();
+		}
+		const next = this.pruneChain.then(async () => {
+			if (this.isShutdown) return;
+			for (const name of [...this.prunePending]) {
+				if (this.derivingOutboxes > 0) {
+					this.pruneDrainDeferred = true;
+					return;
+				}
+				this.prunePending.delete(name);
+				const remote = this.remotes.get(name);
+				if (!remote) continue;
+				if (this.stalePollAgeMs(remote) === void 0) {
+					this.logger.info("Stale removal of @name revoked: its holder polled while the outbox was being derived", name);
+					continue;
+				}
+				try {
+					await this.remove(name);
+				} catch (error) {
+					this.logger.error("Failed to remove stale remote (@name, @error)", name, error instanceof Error ? error.message : String(error));
+				}
+			}
+		});
+		this.pruneChain = next.catch(() => {});
+		return next;
+	}
 	outboxOperationCount(remote) {
 		let count = 0;
 		for (const syncOp of remote.channel.outbox.items) count += syncOp.operations.length;
 		return count;
 	}
-	async updateOutbox(remote, ackOrdinal, mode = OutboxMode.Backfill, signal) {
+	/**
+	* Derives this remote's outbox, holding off prunes for the duration.
+	*
+	* A backfill elsewhere can finish at any await in here and drain the prunes
+	* it marked; the count is what keeps that drain from removing the remote this
+	* call is still adding to.
+	*/
+	async updateOutbox(remote, ackOrdinal, mode = "backfill", signal) {
+		this.derivingOutboxes++;
+		try {
+			await this.deriveOutbox(remote, ackOrdinal, mode, signal);
+		} finally {
+			this.derivingOutboxes--;
+			if (this.derivingOutboxes === 0 && this.pruneDrainDeferred) {
+				this.pruneDrainDeferred = false;
+				this.drainPrunes();
+			}
+		}
+	}
+	async deriveOutbox(remote, ackOrdinal, mode, signal) {
 		const composedSignal = signal ? AbortSignal.any([signal, this.abortController.signal]) : this.abortController.signal;
 		const startOrdinal = this.refillOrdinal(remote, ackOrdinal);
 		let maxOrdinal = startOrdinal;
@@ -6915,11 +7857,11 @@ var SyncManager = class {
 				const prevJobId = lastJobByDoc.get(batch.documentId);
 				const deps = [];
 				if (prevJobId) deps.push(prevJobId);
-				if (mode === OutboxMode.BatchTriggered && prevChainJobId && prevChainJobId !== prevJobId) deps.push(prevChainJobId);
+				if (mode === "batch-triggered" && prevChainJobId && prevChainJobId !== prevJobId) deps.push(prevChainJobId);
 				const syncOp = new SyncOperation(crypto.randomUUID(), jobId, deps, remote.meta.name, batch.documentId, [batch.scope], batch.branch, batch.operations);
 				syncOps.push(syncOp);
 				lastJobByDoc.set(batch.documentId, jobId);
-				if (mode === OutboxMode.BatchTriggered) prevChainJobId = jobId;
+				if (mode === "batch-triggered") prevChainJobId = jobId;
 			}
 			remote.channel.outbox.add(...syncOps);
 			this.evictPastOutboxBound(remote);
@@ -7001,6 +7943,10 @@ var SyncBuilder = class {
 		this.config.maxHeldOperationsPerRemote = limit;
 		return this;
 	}
+	withStaleRemotePollWindowMs(windowMs) {
+		this.config.staleRemotePollWindowMs = windowMs;
+		return this;
+	}
 	build(reactor, logger, operationIndex, eventBus, db, driveContainerTypes) {
 		return this.buildModule(reactor, logger, operationIndex, eventBus, db, driveContainerTypes).syncManager;
 	}
@@ -7166,6 +8112,16 @@ var Reactor = class {
 		throwIfAborted(signal, () => new AbortError());
 		return relationships.results.map((rel) => rel.sourceId);
 	}
+	async getOutgoingRelationshipEdges(sourceId, relationshipType, paging, consistencyToken, signal) {
+		const relationships = await this.documentIndexer.getOutgoing(sourceId, relationshipType ? [relationshipType] : void 0, paging, consistencyToken, signal);
+		throwIfAborted(signal, () => new AbortError());
+		return relationships;
+	}
+	async getIncomingRelationshipEdges(targetId, relationshipType, paging, consistencyToken, signal) {
+		const relationships = await this.documentIndexer.getIncoming(targetId, relationshipType ? [relationshipType] : void 0, paging, consistencyToken, signal);
+		throwIfAborted(signal, () => new AbortError());
+		return relationships;
+	}
 	async getOperations(documentId, view, filter, paging, consistencyToken, signal) {
 		this.logger.verbose("getOperations(@documentId, @view, @filter, @paging)", documentId, view, filter, paging);
 		const branch = view?.branch || "main";
@@ -7213,7 +8169,7 @@ var Reactor = class {
 		this.logger.verbose("create(@id, @type, @slug)", document.header.id, document.header.documentType, document.header.slug);
 		const createdAtUtcIso = (/* @__PURE__ */ new Date()).toISOString();
 		throwIfAborted(signal, () => new AbortError());
-		let actions = [createDocumentAction({
+		const createAction = createDocumentAction({
 			model: document.header.documentType,
 			version: 0,
 			documentId: document.header.id,
@@ -7229,14 +8185,20 @@ var Reactor = class {
 			branch: document.header.branch,
 			meta: document.header.meta,
 			protocolVersions: document.header.protocolVersions ?? { "base-reducer": 2 }
-		}), upgradeDocumentAction({
+		});
+		const upgradeAction = upgradeDocumentAction({
 			documentId: document.header.id,
 			model: document.header.documentType,
 			fromVersion: 0,
 			toVersion: normalizeDocumentModelVersion(document.state.document?.version),
 			initialState: document.state
-		})];
-		if (signer) actions = await signActions(actions, signer, signal);
+		});
+		const branch = document.header.branch || "main";
+		let actions = [createAction, upgradeAction];
+		if (signer) actions = await signActions(actions, signer, {
+			documentId: document.header.id,
+			branch
+		}, signal);
 		const jobId = v4();
 		const jobMeta = buildSingleJobMeta(jobId, meta);
 		const job = {
@@ -7244,7 +8206,7 @@ var Reactor = class {
 			kind: "mutation",
 			documentId: document.header.id,
 			scope: "document",
-			branch: "main",
+			branch,
 			actions,
 			operations: [],
 			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -7256,7 +8218,7 @@ var Reactor = class {
 		const jobInfo = {
 			id: jobId,
 			documentId: job.documentId,
-			status: JobStatus.PENDING,
+			status: "PENDING",
 			createdAtUtcIso,
 			consistencyToken: {
 				version: 1,
@@ -7275,7 +8237,10 @@ var Reactor = class {
 		const createdAtUtcIso = (/* @__PURE__ */ new Date()).toISOString();
 		throwIfAborted(signal, () => new AbortError());
 		let action = deleteDocumentAction(id);
-		if (signer) action = await signAction(action, signer, signal);
+		if (signer) action = await signAction(action, signer, {
+			documentId: id,
+			branch: "main"
+		}, signal);
 		const jobId = v4();
 		const jobMeta = buildSingleJobMeta(jobId, meta);
 		const job = {
@@ -7295,7 +8260,7 @@ var Reactor = class {
 		const jobInfo = {
 			id: jobId,
 			documentId: job.documentId,
-			status: JobStatus.PENDING,
+			status: "PENDING",
 			createdAtUtcIso,
 			consistencyToken: {
 				version: 1,
@@ -7333,7 +8298,7 @@ var Reactor = class {
 		const jobInfo = {
 			id: jobId,
 			documentId: job.documentId,
-			status: JobStatus.PENDING,
+			status: "PENDING",
 			createdAtUtcIso,
 			consistencyToken: {
 				version: 1,
@@ -7373,7 +8338,7 @@ var Reactor = class {
 		const jobInfo = {
 			id: jobId,
 			documentId: job.documentId,
-			status: JobStatus.PENDING,
+			status: "PENDING",
 			createdAtUtcIso,
 			consistencyToken: {
 				version: 1,
@@ -7408,7 +8373,7 @@ var Reactor = class {
 			const jobInfo = {
 				id: planKeyToJobId.get(jobPlan.key),
 				documentId: jobPlan.documentId,
-				status: JobStatus.PENDING,
+				status: "PENDING",
 				createdAtUtcIso,
 				consistencyToken: {
 					version: 1,
@@ -7478,7 +8443,7 @@ var Reactor = class {
 			const jobInfo = {
 				id: planKeyToJobId.get(jobPlan.key),
 				documentId: jobPlan.documentId,
-				status: JobStatus.PENDING,
+				status: "PENDING",
 				createdAtUtcIso,
 				consistencyToken: {
 					version: 1,
@@ -7528,18 +8493,34 @@ var Reactor = class {
 		}
 		return { jobs: Object.fromEntries(jobInfos) };
 	}
-	async addRelationship(sourceId, targetId, relationshipType, branch = "main", signer, signal) {
-		this.logger.verbose("addRelationship(@sourceId, @targetId, @relationshipType, @branch)", sourceId, targetId, relationshipType, branch);
+	async addRelationship(sourceId, targetId, relationshipType, metadata, branch = "main", signer, signal) {
+		this.logger.verbose("addRelationship(@sourceId, @targetId, @relationshipType, @metadata, @branch)", sourceId, targetId, relationshipType, metadata, branch);
+		throwIfAborted(signal, () => new AbortError());
+		let actions = [addRelationshipAction(sourceId, targetId, relationshipType, metadata)];
+		if (signer) actions = await signActions(actions, signer, {
+			documentId: sourceId,
+			branch
+		}, signal);
+		return await this.execute(sourceId, branch, actions, signal);
+	}
+	async updateRelationship(sourceId, targetId, relationshipType, metadata, branch = "main", signer, signal) {
+		this.logger.verbose("updateRelationship(@sourceId, @targetId, @relationshipType, @metadata, @branch)", sourceId, targetId, relationshipType, metadata, branch);
 		throwIfAborted(signal, () => new AbortError());
-		let actions = [addRelationshipAction(sourceId, targetId, relationshipType)];
-		if (signer) actions = await signActions(actions, signer, signal);
+		let actions = [updateRelationshipAction(sourceId, targetId, relationshipType, metadata)];
+		if (signer) actions = await signActions(actions, signer, {
+			documentId: sourceId,
+			branch
+		}, signal);
 		return await this.execute(sourceId, branch, actions, signal);
 	}
 	async removeRelationship(sourceId, targetId, relationshipType, branch = "main", signer, signal) {
 		this.logger.verbose("removeRelationship(@sourceId, @targetId, @relationshipType, @branch)", sourceId, targetId, relationshipType, branch);
 		throwIfAborted(signal, () => new AbortError());
 		let actions = [removeRelationshipAction(sourceId, targetId, relationshipType)];
-		if (signer) actions = await signActions(actions, signer, signal);
+		if (signer) actions = await signActions(actions, signer, {
+			documentId: sourceId,
+			branch
+		}, signal);
 		return await this.execute(sourceId, branch, actions, signal);
 	}
 	getJobStatus(jobId, signal) {
@@ -7551,7 +8532,7 @@ var Reactor = class {
 			return Promise.resolve({
 				id: jobId,
 				documentId: "",
-				status: JobStatus.FAILED,
+				status: "FAILED",
 				createdAtUtcIso: now,
 				completedAtUtcIso: now,
 				error: toErrorInfo$1("Job not found"),
@@ -7643,8 +8624,11 @@ var ReactorBuilder = class {
 	eventBus;
 	readModelCoordinator;
 	readModelCoordinatorFactory;
-	signatureVerifier;
 	kyselyInstance;
+	signer;
+	workerSigner;
+	trustPolicy;
+	workerTrustPolicy;
 	signalHandlersEnabled = false;
 	queueInstance;
 	channelScheme;
@@ -7743,10 +8727,34 @@ var ReactorBuilder = class {
 		this.eventBus = eventBus;
 		return this;
 	}
-	withSignatureVerifier(verifier) {
-		this.signatureVerifier = verifier;
+	/**
+	* Signs the operations the executor synthesizes: the NOOP an UNDO becomes and
+	* the action a REDO rebuilds. Without one they are stored unsigned. Pooled
+	* workers import `workerSigner` to build the same signer.
+	*/
+	withSigner(signer, workerSigner) {
+		this.signer = signer;
+		this.workerSigner = workerSigner;
+		return this;
+	}
+	/** Whether {@link withSigner} was called. */
+	hasSigner() {
+		return this.signer !== void 0;
+	}
+	/**
+	* Decides at admission whether a key may sign as the user it claims; see
+	* {@link SignatureTrustPolicy} for the contract and the default. Pooled
+	* workers import `workerTrustPolicy` to build the same policy.
+	*/
+	withTrustPolicy(trustPolicy, workerTrustPolicy) {
+		this.trustPolicy = trustPolicy;
+		this.workerTrustPolicy = workerTrustPolicy;
 		return this;
 	}
+	/** Whether {@link withTrustPolicy} was called. */
+	hasTrustPolicy() {
+		return this.trustPolicy !== void 0;
+	}
 	withKysely(kysely) {
 		this.kyselyInstance = kysely;
 		return this;
@@ -7800,8 +8808,7 @@ var ReactorBuilder = class {
 	* this enables the pool — there is no `enabled` flag. Provide `db`
 	* (each worker opens its own Postgres pool; the parent database is built
 	* from it too unless {@link withKysely} is set) or a custom `factory`
-	* transport. `verifier` is imported by the default transport's workers;
-	* omitted = no executor-side signature verification.
+	* transport.
 	*/
 	withWorkerPool(options) {
 		this.workerPool = options;
@@ -7876,11 +8883,12 @@ var ReactorBuilder = class {
 		if (resolver instanceof DocumentModelResolver) resolver.setModelLoadedHook((documentType) => eventBus.emit(ReactorEventTypes.MODEL_LOADED, { documentType }));
 		const queue = this.queueInstance ?? new InMemoryQueue(eventBus, resolver);
 		const jobTracker = new InMemoryJobTracker(eventBus);
-		const writeCache = new KyselyWriteCache(keyframeStore, operationStore, documentModelRegistry, {
+		const cacheConfig = {
 			maxDocuments: this.writeCacheConfig?.maxDocuments ?? 100,
 			ringBufferSize: this.writeCacheConfig?.ringBufferSize ?? 10,
 			keyframeInterval: this.writeCacheConfig?.keyframeInterval ?? 10
-		});
+		};
+		const writeCache = new KyselyWriteCache(keyframeStore, operationStore, documentModelRegistry, cacheConfig);
 		await writeCache.startup();
 		const operationIndex = new KyselyOperationIndex(database);
 		const documentMetaCache = new DocumentMetaCache(operationStore, { maxDocuments: 1e3 });
@@ -7889,33 +8897,49 @@ var ReactorBuilder = class {
 		const executionScope = new KyselyExecutionScope(database, operationStore, operationIndex, keyframeStore, writeCache, documentMetaCache, collectionMembershipCache);
 		let executorManager = this.executorManager;
 		let executorStartCount = this.executorConfig.maxConcurrency ?? 1;
-		if (!executorManager) if (this.workerPool) {
-			const pool = this.workerPool;
-			let factory = pool.factory;
-			if (!factory) {
-				if (pool.db === void 0) throw new Error("unreachable: worker pool configured without db or factory");
-				factory = await this.createDefaultWorkerFactory(pool.numWorkers, pool.db, pool.verifier);
-			}
-			const poolManager = new WorkerPoolJobExecutorManager(factory, eventBus, queue, jobTracker, this.logger, resolver, operationIndex, this.executorConfig.jobTimeoutMs, this.executorConfig.deferredJobTtlMs);
-			executorManager = poolManager;
-			executorStartCount = pool.numWorkers;
-			if (resolver instanceof DocumentModelResolver) resolver.setBroadcastHook((entry) => poolManager.loadModel(entry));
-		} else executorManager = new SimpleJobExecutorManager(() => new SimpleJobExecutor(this.logger, documentModelRegistry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, this.driveContainerTypes, this.executorConfig, this.signatureVerifier, executionScope), eventBus, queue, jobTracker, this.logger, resolver, this.executorConfig.jobTimeoutMs, this.executorConfig.deferredJobTtlMs);
+		if (!executorManager) {
+			if (this.workerPool) {
+				const pool = this.workerPool;
+				let factory = pool.factory;
+				if (!factory) {
+					if (pool.db === void 0) throw new Error("unreachable: worker pool configured without db or factory");
+					if (this.signer && !this.workerSigner) this.logger.warn("Worker pool has no signer spec; pooled workers store synthesized operations unsigned");
+					if (this.trustPolicy && !this.workerTrustPolicy) this.logger.warn("Worker pool has no trust policy spec; pooled workers apply the default trust policy");
+					factory = await this.createDefaultWorkerFactory(pool.numWorkers, pool.db);
+				}
+				const poolManager = new WorkerPoolJobExecutorManager(factory, eventBus, queue, jobTracker, this.logger, resolver, operationIndex, this.executorConfig.jobTimeoutMs, this.executorConfig.deferredJobTtlMs);
+				executorManager = poolManager;
+				executorStartCount = pool.numWorkers;
+				if (resolver instanceof DocumentModelResolver) resolver.setBroadcastHook((entry) => poolManager.loadModel(entry));
+			} else executorManager = new SimpleJobExecutorManager(() => new SimpleJobExecutor(this.logger, documentModelRegistry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, this.driveContainerTypes, this.executorConfig, executionScope, this.signer, this.trustPolicy), eventBus, queue, jobTracker, this.logger, resolver, this.executorConfig.jobTimeoutMs, this.executorConfig.deferredJobTtlMs);
+		}
 		await executorManager.start(executorStartCount);
-		const callerReadModels = Array.from(new Set([...this.readModels]));
+		const callerReadModels = Array.from(/* @__PURE__ */ new Set([...this.readModels]));
+		const degradedComponents = [];
+		const startDegraded = (component, error) => {
+			degradedComponents.push({
+				component,
+				error: error instanceof Error ? error : new Error(String(error))
+			});
+			this.logger?.error("Reactor component started degraded: @component", component, error);
+		};
+		const readModelIndexing = {
+			commitChunkSize: 50,
+			yieldDeadlineMs: this.executorConfig.yieldDeadlineMs ?? 50
+		};
 		const documentViewConsistencyTracker = new ConsistencyTracker();
-		const documentView = new KyselyDocumentView(database, operationStore, operationIndex, writeCache, documentViewConsistencyTracker, featureFlags.documentDecisions);
+		const documentView = new KyselyDocumentView(database, operationStore, operationIndex, writeCache, documentViewConsistencyTracker, featureFlags.documentDecisions ? "StateAtDeletion" : "NotFound", readModelIndexing);
 		try {
 			await documentView.init();
 		} catch (error) {
-			console.error("Error initializing document view", error);
+			startDegraded("document view", error);
 		}
 		const documentIndexerConsistencyTracker = new ConsistencyTracker();
-		const documentIndexer = new KyselyDocumentIndexer(database, operationIndex, writeCache, documentIndexerConsistencyTracker);
+		const documentIndexer = new KyselyDocumentIndexer(database, operationIndex, writeCache, documentIndexerConsistencyTracker, readModelIndexing);
 		try {
 			await documentIndexer.init();
 		} catch (error) {
-			console.error("Error initializing document indexer", error);
+			startDegraded("document indexer", error);
 		}
 		const subscriptionManager = new ReactorSubscriptionManager(new DefaultSubscriptionErrorHandler());
 		const subscriptionNotificationReadModel = new SubscriptionNotificationReadModel(subscriptionManager, documentView);
@@ -7924,9 +8948,9 @@ var ReactorBuilder = class {
 		try {
 			await processorManager.init();
 		} catch (error) {
-			console.error("Error initializing processor manager", error);
+			startDegraded("processor manager", error);
 		}
-		for (const factory of this.readModelFactories) {
+		for (const [index, factory] of this.readModelFactories.entries()) try {
 			const readModel = await factory({
 				documentModelRegistry,
 				operationIndex,
@@ -7934,6 +8958,8 @@ var ReactorBuilder = class {
 				processorManagerConsistencyTracker
 			});
 			callerReadModels.push(readModel);
+		} catch (error) {
+			startDegraded(`read model ${index}${factory.name ? ` (${factory.name})` : ""}`, error);
 		}
 		const readModelInstances = [
 			...callerReadModels,
@@ -7952,13 +8978,13 @@ var ReactorBuilder = class {
 			processorManager,
 			documentView,
 			documentIndexer,
-			createProjectionShardManager: (config) => this.createProjectionShardManager(config, eventBus, hostTrackers, false),
+			createProjectionShardManager: (config) => this.createProjectionShardManager(config, eventBus, hostTrackers, readModelIndexing, false),
 			registerShutdownHook: (hook) => this.shutdownHooks.push(hook)
-		}) : this.projectionShardConfig ? await this.createProjectionShardManager(this.projectionShardConfig, eventBus, hostTrackers, true) : new ReadModelCoordinator(eventBus, readModelInstances, [subscriptionNotificationReadModel, processorManager]);
+		}) : this.projectionShardConfig ? await this.createProjectionShardManager(this.projectionShardConfig, eventBus, hostTrackers, readModelIndexing, true) : new ReadModelCoordinator(eventBus, readModelInstances, [subscriptionNotificationReadModel, processorManager]);
 		const reactor = new Reactor(this.logger, documentModelRegistry, queue, jobTracker, readModelCoordinator, this.features, documentView, documentIndexer, operationStore, eventBus, executorManager);
 		let syncModule = void 0;
 		if (this.channelScheme) {
-			const factory = this.channelScheme === ChannelScheme.CONNECT ? new GqlRequestChannelFactory(this.logger, this.jwtHandler, queue) : new GqlResponseChannelFactory(this.logger);
+			const factory = this.channelScheme === "connect" ? new GqlRequestChannelFactory(this.logger, this.jwtHandler, queue) : new GqlResponseChannelFactory(this.logger);
 			syncModule = new SyncBuilder().withChannelFactory(factory).buildModule(reactor, this.logger, operationIndex, eventBus, database, this.driveContainerTypes);
 			await syncModule.syncManager.startup();
 		} else if (this.syncBuilder) {
@@ -7993,8 +9019,10 @@ var ReactorBuilder = class {
 			syncModule,
 			reactor,
 			groupReevaluationTrigger,
-			pools: this.instrumentedPools
+			pools: this.instrumentedPools,
+			degradedComponents
 		};
+		if (degradedComponents.length > 0) this.logger.warn("Reactor started with @count degraded component(s): @components", degradedComponents.length, degradedComponents.map(({ component }) => component).join(", "));
 		if (this.signalHandlersEnabled) this.attachSignalHandlers(module);
 		return module;
 	}
@@ -8023,11 +9051,15 @@ var ReactorBuilder = class {
 	*   models never index an operation, so the manager advances these from the
 	*   shards' relayed indexing reports; without them every read carrying a
 	*   consistency token waits forever.
+	* @param indexing The chunking bounds the host's own read models index
+	*   under. The shards' read models are built inside the worker, so without
+	*   this they would fall back to the library default and a host that tuned
+	*   the cadence would silently get it on the in-process path only.
 	* @param registerShutdownHook Whether the builder owns `manager.shutdown()`
 	*   at signal time. False for the coordinator-factory path, whose factory
 	*   registers its own hook so host chains drain before the worker stops.
 	*/
-	async createProjectionShardManager(config, eventBus, consistencyTrackers, registerShutdownHook) {
+	async createProjectionShardManager(config, eventBus, consistencyTrackers, indexing, registerShutdownHook) {
 		const parentDb = this.resolveReactorDbConfig();
 		const baseDb = config.db ?? parentDb;
 		const caller = this.projectionShardConfig !== void 0 ? "withProjectionShards" : "withReadModelCoordinatorFactory";
@@ -8053,13 +9085,14 @@ var ReactorBuilder = class {
 			poolInstrumentations.push(forwarder);
 			this.instrumentedPools.push(forwarder);
 		}
-		const { ProjectionShardManager } = await import("./projection-shard-manager-CPQc5XHL.js");
+		const { ProjectionShardManager } = await import("./projection-shard-manager-BpcqDtnQ.js");
 		const manager = new ProjectionShardManager({
 			shardCount: config.shardCount,
 			db,
 			models,
 			preReadyKinds: config.preReadyKinds,
 			postReadyKinds: config.postReadyKinds,
+			indexing,
 			factory,
 			logger: this.logger,
 			hostBus: eventBus,
@@ -8086,7 +9119,7 @@ var ReactorBuilder = class {
 		return manager;
 	}
 	async createDefaultProjectionWorkerFactory() {
-		const [{ createProjectionThreadTransport }, { projectionWorkerEntryPath }] = await Promise.all([import("./transport-CuogVKN_.js"), import("./projection-worker-wI4PwcV2.js")]);
+		const [{ createProjectionThreadTransport }, { projectionWorkerEntryPath }] = await Promise.all([import("./transport-B3G50KVd.js"), import("./projection-worker-D8uNFdwX.js")]);
 		return () => createProjectionThreadTransport(projectionWorkerEntryPath);
 	}
 	/**
@@ -8094,11 +9127,11 @@ var ReactorBuilder = class {
 	* custom `factory`. Each worker spawns a real `node:worker_threads`
 	* Worker pointing at the compiled `worker/entry.js`.
 	*/
-	async createDefaultWorkerFactory(numWorkers, db, signatureVerifier) {
+	async createDefaultWorkerFactory(numWorkers, db) {
 		const [{ WorkerHandle }, { createThreadTransport }, { workerEntryPath }] = await Promise.all([
-			import("./worker-handle-CrERzl8s.js"),
-			import("./transport-ByGviWdZ.js"),
-			import("./worker-HPysBfhx.js").then((n) => n.n)
+			import("./worker-handle-C2rLUHwv.js"),
+			import("./transport-CZDHzfvy.js"),
+			Promise.resolve().then(() => worker_exports)
 		]);
 		const poolConfig = {
 			enabled: true,
@@ -8118,9 +9151,10 @@ var ReactorBuilder = class {
 				initPayload: {
 					poolConfig,
 					db,
-					signatureVerifier,
 					models,
-					executorConfig: this.executorConfig
+					executorConfig: this.executorConfig,
+					signer: this.workerSigner,
+					trustPolicy: this.workerTrustPolicy
 				},
 				logger,
 				poolInstrumentation
@@ -8194,7 +9228,7 @@ var ReactorBuilder = class {
 			}
 			this.logger.info("Shutdown complete");
 			nodeProcess.exit = realExit;
-			realExit(pendingExitCode ?? 0);
+			realExit(pendingExitCode || Number(nodeProcess.exitCode ?? 0));
 		};
 		nodeProcess.prependListener("SIGINT", () => void handler("SIGINT"));
 		nodeProcess.prependListener("SIGTERM", () => void handler("SIGTERM"));
@@ -8363,30 +9397,6 @@ function createHybridProjectionCoordinatorFactory(options = {}) {
 	};
 }
 //#endregion
-//#region src/signer/passthrough-signer.ts
-/**
-* A no-op signer that returns empty values for all methods.
-* Used when signing is not required.
-*/
-var PassthroughSigner = class {
-	publicKey = {};
-	sign() {
-		return Promise.resolve(new Uint8Array(0));
-	}
-	verify() {
-		return Promise.resolve();
-	}
-	signAction() {
-		return Promise.resolve([
-			"",
-			"",
-			"",
-			"",
-			""
-		]);
-	}
-};
-//#endregion
 //#region src/core/reactor-client-builder.ts
 /**
 * Builder class for constructing ReactorClient instances with proper configuration
@@ -8399,7 +9409,10 @@ var ReactorClientBuilder = class {
 	documentIndexer;
 	documentView;
 	signer;
-	signatureVerifier;
+	workerSigner;
+	trustPolicy;
+	workerTrustPolicy;
+	createSignaturePolicy = DEFAULT_SIGNATURE_POLICY;
 	subscriptionManager;
 	jobAwaiter;
 	documentModelLoader;
@@ -8433,17 +9446,28 @@ var ReactorClientBuilder = class {
 		return this;
 	}
 	/**
-	* Sets the signer configuration for signing and verifying actions.
-	*
-	* @param config - Either an ISigner for signing only, or a SignerConfig for both signing and verification
+	* Signs submitted actions, and the operations a reactor built from
+	* `withReactorBuilder` synthesizes unless that builder has its own signer.
+	* A `trustPolicy` reaches that builder unless it has its own.
 	*/
 	withSigner(config) {
 		if ("signer" in config) {
 			this.signer = config.signer;
-			this.signatureVerifier = config.verifier;
+			this.workerSigner = config.workerSigner;
+			this.trustPolicy = config.trustPolicy;
+			this.workerTrustPolicy = config.workerTrustPolicy;
 		} else this.signer = config;
 		return this;
 	}
+	/**
+	* What the client creates new documents as when a call does not say:
+	* `v2-required` (the default) or `legacy`, for a fleet with peers that
+	* predate v2-required documents. Existing documents keep their policy.
+	*/
+	withCreateSignaturePolicy(policy) {
+		this.createSignaturePolicy = policy;
+		return this;
+	}
 	withSubscriptionManager(subscriptionManager) {
 		this.subscriptionManager = subscriptionManager;
 		return this;
@@ -8508,8 +9532,9 @@ var ReactorClientBuilder = class {
 		let documentView;
 		let reactorModule;
 		if (this.reactorBuilder) {
-			if (this.signatureVerifier) this.reactorBuilder.withSignatureVerifier(this.signatureVerifier);
 			if (this.documentModelLoader) this.reactorBuilder.withDocumentModelLoader(this.documentModelLoader);
+			if (this.signer && !this.reactorBuilder.hasSigner()) this.reactorBuilder.withSigner(this.signer, this.workerSigner);
+			if (this.trustPolicy && !this.reactorBuilder.hasTrustPolicy()) this.reactorBuilder.withTrustPolicy(this.trustPolicy, this.workerTrustPolicy);
 			reactorModule = await this.reactorBuilder.buildModule();
 			reactor = reactorModule.reactor;
 			eventBus = reactorModule.eventBus;
@@ -8527,7 +9552,7 @@ var ReactorClientBuilder = class {
 		const jobAwaiter = this.jobAwaiter ?? new JobAwaiter(eventBus, (jobId, signal) => reactor.getJobStatus(jobId, signal));
 		const decisionModel = reactorModule ? readDecisionModel(reactorModule.featureFlags, reactorModule.documentModelRegistry) : void 0;
 		return {
-			client: new ReactorClient(this.logger, reactor, signer, subscriptionManager, jobAwaiter, documentIndexer, documentView, this.readGate ?? this.resolveReadGate(reactorModule, documentView, decisionModel), this.resolveActionEvaluation(reactorModule, decisionModel)),
+			client: new ReactorClient(this.logger, reactor, signer, subscriptionManager, jobAwaiter, documentIndexer, documentView, this.readGate ?? this.resolveReadGate(reactorModule, documentView, decisionModel), this.resolveActionEvaluation(reactorModule, decisionModel), this.createSignaturePolicy),
 			reactor,
 			eventBus,
 			documentIndexer,
@@ -8565,6 +9590,38 @@ function driveIdFromUrl(url) {
 	return url.split("/").pop() ?? "";
 }
 //#endregion
+//#region src/signer/types.ts
+const SIGNATURE_REFUSAL_CODES = [
+	"UNSIGNED_REQUIRED",
+	"UNSIGNED_IDENTITY",
+	"KEY_MISMATCH",
+	"MALFORMED_TUPLE",
+	"TIMESTAMP_MISMATCH",
+	"HASH_MISMATCH",
+	"BAD_SIGNATURE",
+	"SCHEME_BELOW_POLICY",
+	"ID_MISMATCH",
+	"DUPLICATE_ACTION",
+	"SIGNER_UNAUTHORIZED"
+];
+//#endregion
+//#region src/executor/worker/index.ts
+var worker_exports = /* @__PURE__ */ __exportAll({
+	createForwardingLogger: () => createForwardingLogger,
+	errorToInfo: () => errorToInfo,
+	sanitizeArg: () => sanitizeArg,
+	workerEntryPath: () => workerEntryPath
+});
+function resolveWorkerEntryPath() {
+	const url = new URL("./entry.js", import.meta.url);
+	if (url.protocol !== "file:") return url.href;
+	let pathname = decodeURIComponent(url.pathname);
+	if (/^\/[A-Za-z]:[/\\]/.test(pathname)) pathname = pathname.slice(1);
+	return pathname;
+}
+/** Absolute path to the worker entry script for use with `new Worker(workerEntryPath)`. */
+const workerEntryPath = resolveWorkerEntryPath();
+//#endregion
 //#region src/decision/sync-scope-gate.ts
 /** What a subject may read of a document that is not there to be read. */
 const META_ONLY = (scope) => ALWAYS_READABLE_SCOPES.has(scope);
@@ -8576,6 +9633,9 @@ const META_ONLY = (scope) => ALWAYS_READABLE_SCOPES.has(scope);
 * path's own job, and it is the only thing this adds to the gate it wraps.
 */
 var SyncScopeGate = class {
+	gate;
+	documentView;
+	logger;
 	constructor(gate, documentView, logger) {
 		this.gate = gate;
 		this.documentView = documentView;
@@ -8792,6 +9852,6 @@ var DocumentIntegrityService = class {
 	}
 };
 //#endregion
-export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, AppendConditionFailedError, AuthEnforcementDisabledError, BareReadGate, BaseReadModel, ChannelError, ChannelErrorSource, ChannelScheme, ConsistencyTracker, DEFAULT_DRIVE_CONTAINER_TYPES, DOCUMENT_INDEXER_READ_MODEL, DOCUMENT_VIEW_READ_MODEL, DRIVE_AUTH_ERROR_MESSAGES, DefaultSubscriptionErrorHandler, DocumentAlreadyExistsError, DocumentChangeType, DocumentExistence, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, DriveClient, DriveCollectionId, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, HybridProjectionCoordinator, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, IntervalPollTimer, InvalidModuleError, JobAwaiter, JobExecutorEventTypes, JobStatus, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, Mailbox, ModelReadGate, ModuleNotFoundError, NullDocumentModelResolver, OptimisticLockError, PollBehavior, PollingChannelError, ProcessorManager, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, RECOVERABLE_GRAPHQL_ERROR_CODES, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, ReactorEventTypes, ReactorSubscriptionManager, ReadModelCoordinator, RelationalDbProcessor, RelationshipChangeType, RetryAccounting, RevisionMismatchError, SeededStateReader, SimpleJobExecutorManager, SyncBuilder, SyncEventTypes, SyncOperation, SyncOperationAggregateError, SyncOperationStatus, SyncScopeGate, SyncStatus, SyncStatusTracker, addRelationshipAction, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createHybridProjectionCoordinatorFactory, createMutableShutdownStatus, createReactorHostModuleBase, createRelationalDb, decideAtHead, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isDriveAuthError, isRecoverableGraphQLError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, quarantinesDocument, readDecisionModel, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, supportsLiveReadModelRegistration, syncOperationErrorType, trimMailboxFromAckOrdinal, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
+export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, AppendConditionFailedError, AuthEnforcementDisabledError, BareReadGate, BaseReadModel, ChannelError, ChannelErrorSource, ChannelScheme, ConsistencyTracker, DEFAULT_COMMIT_CHUNK_SIZE, DEFAULT_DRIVE_CONTAINER_TYPES, DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, DOCUMENT_INDEXER_READ_MODEL, DOCUMENT_VIEW_READ_MODEL, DRIVE_AUTH_ERROR_MESSAGES, DefaultSubscriptionErrorHandler, DeletedDocumentRead, DocumentAlreadyExistsError, DocumentChangeType, DocumentExistence, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, DriveClient, DriveCollectionId, DriveRequestError, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, HybridProjectionCoordinator, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, IntervalPollTimer, InvalidModuleError, InvalidSignatureError, JobAwaiter, JobExecutorEventTypes, JobStatus, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, Mailbox, ModelReadGate, ModuleNotFoundError, NullDocumentModelResolver, OptimisticLockError, PollBehavior, PollingChannelError, ProcessorManager, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, RECOVERABLE_GRAPHQL_ERROR_CODES, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, ReactorEventTypes, ReactorSubscriptionManager, ReadModelCoordinator, RelationalDbProcessor, RelationshipChangeType, RelationshipNotFoundError, RetryAccounting, RevisionMismatchError, SIGNATURE_REFUSAL_CODES, SeededStateReader, SimpleJobExecutorManager, SyncBuilder, SyncEventTypes, SyncOperation, SyncOperationAggregateError, SyncOperationStatus, SyncScopeGate, SyncStatus, SyncStatusTracker, addRelationshipAction, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createHybridProjectionCoordinatorFactory, createMutableShutdownStatus, createReactorHostModuleBase, createRelationalDb, decideAtHead, defaultReadModelIndexingConfig, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isDriveAuthError, isRecoverableGraphQLError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, quarantinesDocument, readDecisionModel, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, supportsLiveReadModelRegistration, syncOperationErrorType, trimMailboxFromAckOrdinal, unchunkedReadModelIndexingConfig, updateRelationshipAction, upgradeDocumentAction, verifyActionSignature, workerEntryPath };
 
 //# sourceMappingURL=index.js.map