@powerhousedao/reactor 6.2.3-dev.31 → 6.2.3-dev.33

package/dist/{forwarding-logger-CnuVDVze.js → forwarding-logger-BkwlvD9W.js}

@@ -1,6 +1,6 @@
-import { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, DOCUMENT_DELETED_REASON, DOCUMENT_SCOPE_ACTION_TYPES, DowngradeNotSupportedError as DowngradeNotSupportedError$1, actionSignerIdentity, actionSigningTarget, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, base58Decode, baseReducerVersion, buildOperationSignatureMessage, buildOperationSignatureParams, canonicalJson, createPresignedHeader, decide, defaultBaseState, deriveDocumentId, deriveOperationId, evaluate, garbageCollect, groupDocumentType, groupMembershipActionTypes, hashActionV2, hashBrowser, hashDocumentStateForScope, isDenied, isDerivedDocumentId, isUndoRedo, isV2ActionHash, mentionedGroupIds, normalizeDocumentModelVersion, operationOutcome, referencedGroupIds, signaturePolicyOf, sortOperations, targetDocumentId, v2TupleProblem, withProtocolVersions } from "@powerhousedao/shared/document-model";
+import { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, DOCUMENT_DELETED_REASON, DOCUMENT_SCOPE_ACTION_TYPES, DowngradeNotSupportedError as DowngradeNotSupportedError$1, PEER_CAPABILITIES, actionSignerIdentity, actionSigningTarget, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, base58Decode, baseReducerVersion, buildOperationSignatureMessage, buildOperationSignatureParams, canonicalJson, createPresignedHeader, decide, defaultBaseState, deriveDocumentId, deriveOperationId, evaluate, garbageCollect, groupDocumentType, groupMembershipActionTypes, hashActionV2, hashBrowser, hashDocumentStateForScope, isDenied, isDerivedDocumentId, isUndoRedo, isV2ActionHash, localSupports, mentionedGroupIds, normalizeDocumentModelVersion, operationOutcome, referencedGroupIds, signaturePolicyOf, sortOperations, targetDocumentId, v2TupleProblem, withProtocolVersions } from "@powerhousedao/shared/document-model";
 import { v4 } from "uuid";
-import { Migrator, sql } from "kysely";
+import { Migrator, TableNode, sql } from "kysely";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
 var __exportAll = (all, no_symbols) => {
@@ -79,7 +79,8 @@ const ReactorEventTypes = {
 	READMODEL_BATCH_COMPLETED: 10006,
 	READMODEL_INDEXED: 10007,
 	MODEL_LOADED: 10008,
-	SIGNATURE_REFUSED: 10009
+	SIGNATURE_REFUSED: 10009,
+	CATCHUP_SWEPT: 10010
 };
 //#endregion
 //#region src/shared/errors.ts
@@ -173,6 +174,23 @@ var InvalidOperationTimestampError = class InvalidOperationTimestampError extend
 		return Error.isError(error) && error.name === "InvalidOperationTimestampError";
 	}
 };
+/** A document requires a protocol version this reactor does not run. Terminal. */
+var UnsupportedProtocolVersionError = class UnsupportedProtocolVersionError extends Error {
+	documentId;
+	protocol;
+	version;
+	constructor(documentId, protocol, version) {
+		super(`Document ${documentId} requires ${protocol} ${version}, which this reactor does not support`);
+		this.name = "UnsupportedProtocolVersionError";
+		this.documentId = documentId;
+		this.protocol = protocol;
+		this.version = version;
+		Error.captureStackTrace(this, UnsupportedProtocolVersionError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "UnsupportedProtocolVersionError";
+	}
+};
 /**
 * A load would move more operations than the bound allows, indicating a real
 * divergence between local and incoming history. Counts only first-time moves,
@@ -307,6 +325,22 @@ var RelationshipNotFoundError = class RelationshipNotFoundError extends Error {
 		return Error.isError(error) && error.name === "RelationshipNotFoundError";
 	}
 };
+/** The store holds documents at protocol versions this reactor does not run. */
+var UnsupportedStoredProtocolError = class UnsupportedStoredProtocolError extends Error {
+	versions;
+	documents;
+	constructor(versions, documents) {
+		const named = versions.map(({ protocol, version }) => `${protocol} ${version}`).join(", ");
+		super(`${documents} stored document(s) require ${named}, which this reactor does not run. Start a build that runs them, or accept them read-only with withUnsupportedStoredDocuments("read-only")`);
+		this.name = "UnsupportedStoredProtocolError";
+		this.versions = versions;
+		this.documents = documents;
+		Error.captureStackTrace(this, UnsupportedStoredProtocolError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "UnsupportedStoredProtocolError";
+	}
+};
 //#endregion
 //#region src/storage/interfaces.ts
 /**
@@ -393,6 +427,52 @@ let DocumentExistence = /* @__PURE__ */ function(DocumentExistence) {
 	return DocumentExistence;
 }({});
 //#endregion
+//#region src/cache/operation-index-types.ts
+const DRIVE_COLLECTION_PREFIX = "drive.";
+/**
+* Identifies the collection a remote synchronizes. Collections are drive-level
+* abstractions (document-drive and reactor-drive), so a collection id is the
+* drive document id plus the branch it scopes to rather than an opaque string.
+*
+* The canonical string form (`drive.${branch}.${driveId}`) is produced only by
+* `key` and parsed only by `fromKey`; that string is the wire and storage
+* representation and is byte-for-byte identical to the legacy
+* `driveCollectionId(branch, driveId)` output, so existing `document_collections`
+* rows and persisted remotes remain valid without migration.
+*/
+var DriveCollectionId = class DriveCollectionId {
+	driveId;
+	branch;
+	constructor(driveId, branch) {
+		this.driveId = driveId;
+		this.branch = branch;
+	}
+	static forDrive(driveId, branch = "main") {
+		return new DriveCollectionId(driveId, branch);
+	}
+	/**
+	* The single deserializer for the wire/storage form. `branch` may contain
+	* dots, while `driveId` is a dot-free document id, so the drive id is the
+	* final dot-delimited segment.
+	*/
+	static fromKey(key) {
+		if (!key.startsWith(DRIVE_COLLECTION_PREFIX)) throw new Error(`Unsupported collection id: ${key}`);
+		const rest = key.slice(6);
+		const lastDot = rest.lastIndexOf(".");
+		if (lastDot === -1 || lastDot === rest.length - 1) throw new Error(`Malformed drive collection id: ${key}`);
+		return new DriveCollectionId(rest.slice(lastDot + 1), rest.slice(0, lastDot));
+	}
+	get key() {
+		return `${DRIVE_COLLECTION_PREFIX}${this.branch}.${this.driveId}`;
+	}
+	toString() {
+		return this.key;
+	}
+	equals(other) {
+		return this.driveId === other.driveId && this.branch === other.branch;
+	}
+};
+//#endregion
 //#region src/decision/build-decision-model.ts
 /**
 * Reads each projection's stream through the supplied reader, recording the
@@ -1283,6 +1363,212 @@ var DocumentMetaCache = class DocumentMetaCache {
 		};
 	}
 };
+//#endregion
+//#region src/catch-up/settled-watermark.ts
+const MAX_PENDING_PROBES = 64;
+/** pg_sequence_last_value needs 10; pg_current_* replaced txid_* in 13. */
+function snapshotFunctionsFor(serverVersionNum) {
+	if (serverVersionNum >= 13e4) return {
+		snapshot: "pg_current_snapshot",
+		currentXid: "pg_current_xact_id",
+		xidIfAssigned: "pg_current_xact_id_if_assigned"
+	};
+	if (serverVersionNum >= 1e5) return {
+		snapshot: "txid_current_snapshot",
+		currentXid: "txid_current",
+		xidIfAssigned: "txid_current_if_assigned"
+	};
+	throw new Error(`PostgreSQL server_version_num ${serverVersionNum} is not supported: read-side catch-up needs 10 or later`);
+}
+/** Parses the `xmin:xmax:xip,...` text form of a snapshot. */
+function parseSnapshot(text) {
+	const parts = text.split(":");
+	if (parts.length !== 3) throw new Error(`Malformed snapshot: ${text}`);
+	const [xmin, xmax, xip] = parts;
+	return {
+		xmin: BigInt(xmin),
+		xmax: BigInt(xmax),
+		xip: xip === "" ? [] : xip.split(",").map((xid) => BigInt(xid))
+	};
+}
+async function readSnapshotFunctions(db) {
+	const result = await sql`select current_setting('server_version_num') as version`.execute(db);
+	return snapshotFunctionsFor(Number(result.rows[0].version));
+}
+/** A probe settles once an xmin passes the xid it took after its head. */
+var ProbeSettler = class {
+	settled = 0;
+	lastHead = 0;
+	covered = 0;
+	lastXip = [];
+	pending = [];
+	get settledThrough() {
+		return this.settled;
+	}
+	get head() {
+		return this.lastHead;
+	}
+	/** The highest head a settled or pending probe covers. */
+	get probedHead() {
+		return this.covered;
+	}
+	observe(head, xid, snapshot, nowUtcMs) {
+		this.lastHead = Math.max(this.lastHead, head);
+		this.lastXip = snapshot.xip;
+		if (xid !== null && head > this.covered) {
+			this.covered = head;
+			this.pending.push({
+				head,
+				xid,
+				takenAtUtcMs: nowUtcMs
+			});
+			if (this.pending.length > MAX_PENDING_PROBES) this.pending.shift();
+		}
+		const stillPending = [];
+		for (const probe of this.pending) if (snapshot.xmin > probe.xid) this.settled = Math.max(this.settled, probe.head);
+		else stillPending.push(probe);
+		this.pending = stillPending.filter((probe) => probe.head > this.settled);
+		return this.settled;
+	}
+	/** Xids an unsettled probe still waits on. */
+	waitingOn() {
+		if (this.pending.length === 0) return [];
+		const xid = this.pending[0].xid;
+		return this.lastXip.filter((open) => open < xid).map((open) => open.toString());
+	}
+	stalledSinceUtcMs() {
+		return this.pending[0]?.takenAtUtcMs;
+	}
+};
+function operationIndexTableName(db) {
+	const from = db.selectFrom("operation_index_operations").selectAll().toOperationNode().from?.froms[0];
+	const schema = from !== void 0 && TableNode.is(from) ? from.table.schema?.name : void 0;
+	const quote = (identifier) => `"${identifier.replace(/"/g, "\"\"")}"`;
+	return schema === void 0 ? quote("operation_index_operations") : `${quote(schema)}.${quote("operation_index_operations")}`;
+}
+/** Reads the head, takes and commits an xid, then reads a snapshot, in order. */
+function createKyselyWatermarkProbe(db) {
+	let resolved = null;
+	const resolve = async () => {
+		const fns = await readSnapshotFunctions(db);
+		const table = operationIndexTableName(db);
+		const sequence = (await sql`select pg_get_serial_sequence(${table}, 'ordinal') as sequence`.execute(db)).rows[0]?.sequence;
+		if (!sequence) throw new Error(`No ordinal sequence found for ${table}`);
+		return {
+			fns,
+			sequence
+		};
+	};
+	return async (probedHead) => {
+		resolved ??= resolve().catch((error) => {
+			resolved = null;
+			throw error;
+		});
+		const { fns, sequence } = await resolved;
+		const headRow = (await sql`select coalesce(pg_sequence_last_value(${sequence}::regclass), 0) as head, ${sql.raw(fns.xidIfAssigned)}() is null as outside_write`.execute(db)).rows[0];
+		const head = Number(headRow.head);
+		let xid = null;
+		if (headRow.outside_write && head > probedHead) {
+			const xidResult = await sql`select ${sql.raw(fns.currentXid)}()::text as xid`.execute(db);
+			xid = BigInt(xidResult.rows[0].xid);
+		}
+		const row = (await sql`select ${sql.raw(fns.snapshot)}()::text as snapshot, ${sql.raw(fns.xidIfAssigned)}() is null as outside_write`.execute(db)).rows[0];
+		return {
+			head,
+			xid,
+			snapshot: parseSnapshot(row.snapshot),
+			outsideWrite: headRow.outside_write && row.outside_write
+		};
+	};
+}
+/** Knows when an ordinal gap is final by asking which transactions are open. */
+var SettledWatermark = class {
+	probe;
+	logger;
+	now;
+	settler = new ProbeSettler();
+	listeners = /* @__PURE__ */ new Set();
+	current;
+	next;
+	warnedInsideWrite = false;
+	constructor(probe, logger, now = Date.now) {
+		this.probe = probe;
+		this.logger = logger;
+		this.now = now;
+	}
+	get settledThrough() {
+		return this.settler.settledThrough;
+	}
+	refresh(signal) {
+		signal?.throwIfAborted();
+		if (this.next !== void 0) return this.next;
+		if (this.current === void 0) return this.start();
+		const next = this.current.catch(() => this.settledThrough).then(() => {
+			this.next = void 0;
+			return this.start();
+		});
+		this.next = next;
+		return next;
+	}
+	onAdvance(listener) {
+		this.listeners.add(listener);
+		return () => {
+			this.listeners.delete(listener);
+		};
+	}
+	status() {
+		const stalledSinceUtcMs = this.settler.head > this.settledThrough ? this.settler.stalledSinceUtcMs() : void 0;
+		return {
+			head: this.settler.head,
+			settledThrough: this.settledThrough,
+			waitingOn: this.settler.waitingOn(),
+			...stalledSinceUtcMs !== void 0 ? { stalledSinceUtcMs } : {}
+		};
+	}
+	start() {
+		const run = this.probeOnce().finally(() => {
+			if (this.current === run) this.current = void 0;
+		});
+		this.current = run;
+		return run;
+	}
+	async probeOnce() {
+		const reading = await this.probe(this.settler.probedHead);
+		if (!reading.outsideWrite) {
+			if (!this.warnedInsideWrite) {
+				this.warnedInsideWrite = true;
+				this.logger.warn("settled watermark probe ran inside another session's write transaction; discarded");
+			}
+			return this.settledThrough;
+		}
+		const before = this.settledThrough;
+		const after = this.settler.observe(reading.head, reading.xid, reading.snapshot, this.now());
+		if (after > before) for (const listener of this.listeners) try {
+			listener(after);
+		} catch (error) {
+			this.logger.error("settled watermark listener failed: @error", error);
+		}
+		return after;
+	}
+};
+/** Sessions holding these xids open; empty without pg_stat_activity. */
+async function describeWaitingSessions(db, xids) {
+	if (xids.length === 0) return [];
+	const epochless = xids.map((xid) => (BigInt(xid) % 2n ** 32n).toString());
+	try {
+		return (await sql`select pid, application_name, state, xact_start, backend_xid::text as xid
+       from pg_stat_activity
+       where backend_xid::text in (${sql.join(epochless)})`.execute(db)).rows.map((row) => ({
+			pid: Number(row.pid),
+			applicationName: row.application_name ?? "",
+			state: row.state ?? "",
+			xactStart: row.xact_start === null ? null : new Date(row.xact_start).toISOString(),
+			xid: row.xid
+		}));
+	} catch {
+		return [];
+	}
+}
 /** Bind slots per statement: 16-bit on the wire, read signed in-process. */
 const MAX_BIND_PARAMETERS = 32767;
 /** Splits rows into runs that each bind at most MAX_BIND_PARAMETERS. */
@@ -1295,6 +1581,8 @@ function chunkRows(rows) {
 	for (let i = 0; i < rows.length; i += perChunk) chunks.push(rows.slice(i, i + perChunk));
 	return chunks;
 }
+/** Per database: the function that assigns the transaction's xid. */
+const xidFunctions = /* @__PURE__ */ new WeakMap();
 var KyselyOperationIndexTxn = class {
 	collections = [];
 	collectionMemberships = [];
@@ -1421,6 +1709,7 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 		}
 		let operationOrdinals = [];
 		if (operations.length > 0) {
+			await this.assignXid(trx);
 			const operationRows = operations.map((op) => ({
 				opId: op.id || "",
 				documentId: op.documentId,
@@ -1471,6 +1760,27 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 		}
 		return operationOrdinals;
 	}
+	async getOrdinalsInRange(after, through, limit, signal) {
+		signal?.throwIfAborted();
+		if (through <= after || limit <= 0) return [];
+		return (await this.queryExecutor.selectFrom("operation_index_operations").select("ordinal").where("ordinal", ">", after).where("ordinal", "<=", through).orderBy("ordinal", "asc").limit(limit).execute()).map((row) => Number(row.ordinal));
+	}
+	async getByOrdinals(ordinals, signal) {
+		signal?.throwIfAborted();
+		if (ordinals.length === 0) return [];
+		const results = [];
+		for (let i = 0; i < ordinals.length; i += MAX_BIND_PARAMETERS) {
+			const chunk = ordinals.slice(i, i + MAX_BIND_PARAMETERS);
+			const rows = await this.queryExecutor.selectFrom("operation_index_operations").selectAll().where("ordinal", "in", chunk).orderBy("ordinal", "asc").execute();
+			for (const row of rows) results.push(this.rowToOperationWithContext(row));
+		}
+		results.sort((a, b) => a.context.ordinal - b.context.ordinal);
+		return results;
+	}
+	async getStreamAfter(stream, after, signal) {
+		signal?.throwIfAborted();
+		return (await this.queryExecutor.selectFrom("operation_index_operations").selectAll().where("documentId", "=", stream.documentId).where("branch", "=", stream.branch).where("scope", "=", stream.scope).where("ordinal", ">", after).orderBy("ordinal", "asc").execute()).map((row) => this.rowToOperationWithContext(row));
+	}
 	async getGroupReferencers(groupId, signal) {
 		if (signal?.aborted) throw new Error("Operation aborted");
 		return (await this.queryExecutor.selectFrom("group_references").select("documentId").where("groupId", "=", groupId).orderBy("documentId").execute()).map((row) => row.documentId);
@@ -1494,6 +1804,7 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 			if (view?.branch) qb = qb.where("oi.branch", "=", view.branch);
 			if (view?.scopes && view.scopes.length > 0) qb = qb.where("oi.scope", "in", view.scopes);
 			if (view?.excludeSourceRemote) qb = qb.where("oi.sourceRemote", "!=", view.excludeSourceRemote);
+			if (view?.throughOrdinal !== void 0) qb = qb.where("oi.ordinal", "<=", view.throughOrdinal).where("dc.joinedOrdinal", "<=", BigInt(view.throughOrdinal));
 			return qb;
 		};
 		const rows = await buildBranch("joiner").unionAll(buildBranch("newOps")).orderBy("ordinal", "asc").limit(limit + 1).execute();
@@ -1582,6 +1893,17 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 			}, signal) : void 0
 		};
 	}
+	/** Takes the xid before the first ordinal, as the settled watermark needs. */
+	async assignXid(trx) {
+		let fn = xidFunctions.get(this.db);
+		if (fn === void 0) {
+			fn = readSnapshotFunctions(trx).then((fns) => fns.currentXid);
+			xidFunctions.set(this.db, fn);
+			fn.catch(() => xidFunctions.delete(this.db));
+		}
+		const name = await fn;
+		await sql`select ${sql.raw(name)}()`.execute(trx);
+	}
 	rowToOperationWithContext(row) {
 		return {
 			operation: {
@@ -2004,9 +2326,9 @@ var KyselyWriteCache = class KyselyWriteCache {
 	* the last replayed operation are applied at the end. Creation-time 0->N seed
 	* upgrades carry the initial state, so they still apply immediately.
 	*/
-	async coldMissRebuild(documentId, scope, branch, targetRevision, signal) {
+	async coldMissRebuild(documentId, scope, branch, targetRevision, signal, fromKeyframe = true) {
 		const effectiveTargetRevision = targetRevision || Number.MAX_SAFE_INTEGER;
-		const keyframe = await this.findNearestKeyframe(documentId, scope, branch, effectiveTargetRevision, signal);
+		const keyframe = fromKeyframe ? await this.findNearestKeyframe(documentId, scope, branch, effectiveTargetRevision, signal) : void 0;
 		const documentScopeBound = scope === "document" ? targetRevision : void 0;
 		let document;
 		let startRevision;
@@ -2143,6 +2465,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 		let cursor = void 0;
 		const pageSize = 100;
 		let hasMorePages;
+		let needsFullReplay = false;
 		do {
 			if (signal?.aborted) throw new Error("Operation aborted");
 			const paging = {
@@ -2153,6 +2476,10 @@ var KyselyWriteCache = class KyselyWriteCache {
 				const result = await this.operationStore.getSince(documentId, scope, branch, startRevision, void 0, paging, signal);
 				for (const operation of result.results) {
 					if (targetRevision !== void 0 && operation.index > targetRevision) break;
+					if (keyframe && operation.skip > 0) {
+						needsFullReplay = true;
+						break;
+					}
 					const moduleVersion = this.resolveModuleVersionForOp(operation.index, operation.timestampUtcMs, scope, validatedUpgrades, finalVersion);
 					document = this.applyPendingUpgrades(document, pendingUpgrades, moduleVersion ?? Number.MAX_SAFE_INTEGER);
 					if (isDenied(operation)) document = appendWithoutApplying(document, operation, scope);
@@ -2167,12 +2494,13 @@ var KyselyWriteCache = class KyselyWriteCache {
 					}
 				}
 				const reachedTarget = targetRevision !== void 0 && result.results.some((op) => op.index >= targetRevision);
-				hasMorePages = Boolean(result.nextCursor) && !reachedTarget;
+				hasMorePages = Boolean(result.nextCursor) && !reachedTarget && !needsFullReplay;
 				if (hasMorePages) cursor = result.nextCursor;
 			} catch (err) {
 				throw new Error(`Failed to rebuild document ${documentId}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
 			}
 		} while (hasMorePages);
+		if (needsFullReplay) return this.coldMissRebuild(documentId, scope, branch, targetRevision, signal, false);
 		document = this.applyTailPendingUpgrades(document, pendingUpgrades, scope, targetRevision);
 		document = await this.stampRevisions(document, documentId, scope, branch, targetRevision, signal);
 		if (pendingUpgrades.length > 0) {
@@ -2279,11 +2607,16 @@ var KyselyWriteCache = class KyselyWriteCache {
 		if ((await this.operationStore.getSince(documentId, "document", branch, docScopeNextIndex - 1, void 0, void 0, signal)).results.length > 0) return this.coldMissRebuild(documentId, scope, branch, targetRevision, signal);
 		const module = this.registry.getModule(documentType, extractModuleVersion(baseDocument));
 		let document = copyDocument(baseDocument);
+		let needsFullReplay = false;
 		try {
 			const pagedResults = await this.operationStore.getSince(documentId, scope, branch, baseRevision, void 0, void 0, signal);
 			for (const operation of pagedResults.results) {
 				if (signal?.aborted) throw new Error("Operation aborted");
 				if (targetRevision !== void 0 && operation.index > targetRevision) break;
+				if (operation.skip > 0) {
+					needsFullReplay = true;
+					break;
+				}
 				if (isDenied(operation)) document = appendWithoutApplying(document, operation, scope);
 				else {
 					const protocolVersion = baseReducerVersion(document.header);
@@ -2299,6 +2632,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 		} catch (err) {
 			throw new Error(`Failed to rebuild document ${documentId}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
 		}
+		if (needsFullReplay) return this.coldMissRebuild(documentId, scope, branch, targetRevision, signal, false);
 		const revisions = await this.operationStore.getRevisions(documentId, branch, signal);
 		document.header.revision = revisions.revision;
 		if (targetRevision !== void 0) document.header.revision = {
@@ -2794,52 +3128,6 @@ async function evaluateByPosition(model, target, subject, stores, signal) {
 	return operations.map((operation) => reasons.get(operation.id));
 }
 //#endregion
-//#region src/cache/operation-index-types.ts
-const DRIVE_COLLECTION_PREFIX = "drive.";
-/**
-* Identifies the collection a remote synchronizes. Collections are drive-level
-* abstractions (document-drive and reactor-drive), so a collection id is the
-* drive document id plus the branch it scopes to rather than an opaque string.
-*
-* The canonical string form (`drive.${branch}.${driveId}`) is produced only by
-* `key` and parsed only by `fromKey`; that string is the wire and storage
-* representation and is byte-for-byte identical to the legacy
-* `driveCollectionId(branch, driveId)` output, so existing `document_collections`
-* rows and persisted remotes remain valid without migration.
-*/
-var DriveCollectionId = class DriveCollectionId {
-	driveId;
-	branch;
-	constructor(driveId, branch) {
-		this.driveId = driveId;
-		this.branch = branch;
-	}
-	static forDrive(driveId, branch = "main") {
-		return new DriveCollectionId(driveId, branch);
-	}
-	/**
-	* The single deserializer for the wire/storage form. `branch` may contain
-	* dots, while `driveId` is a dot-free document id, so the drive id is the
-	* final dot-delimited segment.
-	*/
-	static fromKey(key) {
-		if (!key.startsWith(DRIVE_COLLECTION_PREFIX)) throw new Error(`Unsupported collection id: ${key}`);
-		const rest = key.slice(6);
-		const lastDot = rest.lastIndexOf(".");
-		if (lastDot === -1 || lastDot === rest.length - 1) throw new Error(`Malformed drive collection id: ${key}`);
-		return new DriveCollectionId(rest.slice(lastDot + 1), rest.slice(0, lastDot));
-	}
-	get key() {
-		return `${DRIVE_COLLECTION_PREFIX}${this.branch}.${this.driveId}`;
-	}
-	toString() {
-		return this.key;
-	}
-	equals(other) {
-		return this.driveId === other.driveId && this.branch === other.branch;
-	}
-};
-//#endregion
 //#region src/executor/document-action-handler.ts
 var DocumentActionHandler = class {
 	registry;
@@ -2847,12 +3135,29 @@ var DocumentActionHandler = class {
 	driveContainerTypes;
 	featureFlags;
 	decisionModel;
-	constructor(registry, logger, driveContainerTypes, featureFlags, decisionModel) {
+	protocolSupport;
+	loggedUnregisteredProtocols = /* @__PURE__ */ new Set();
+	constructor(registry, logger, driveContainerTypes, featureFlags, decisionModel, protocolSupport) {
 		this.registry = registry;
 		this.logger = logger;
 		this.driveContainerTypes = driveContainerTypes;
 		this.featureFlags = featureFlags;
 		this.decisionModel = decisionModel;
+		this.protocolSupport = protocolSupport;
+	}
+	/** Keys this reactor does not register are admitted: it cannot judge them. */
+	unsupportedProtocol(documentId, protocolVersions) {
+		for (const [protocol, version] of Object.entries(protocolVersions ?? {})) {
+			const supported = this.protocolSupport[protocol];
+			if (supported === void 0) {
+				if (!this.loggedUnregisteredProtocols.has(protocol)) {
+					this.loggedUnregisteredProtocols.add(protocol);
+					this.logger.info("Admitting document @documentId with unregistered protocol @protocol @version", documentId, protocol, version);
+				}
+				continue;
+			}
+			if (!supported.includes(version)) return new UnsupportedProtocolVersionError(documentId, protocol, version);
+		}
 	}
 	/** Whether the write arrives with its evaluation already decided. */
 	alreadyEvaluated(executing) {
@@ -2968,6 +3273,9 @@ var DocumentActionHandler = class {
 			error: /* @__PURE__ */ new Error(`CREATE_DOCUMENT must be in "document" scope, got "${job.scope}"`),
 			duration: Date.now() - startTime
 		};
+		const input = action.input;
+		const unsupported = this.unsupportedProtocol(input.documentId, input.protocolVersions);
+		if (unsupported) return buildErrorResult(job, unsupported, startTime);
 		const document = createDocumentFromAction(action);
 		let operation = createOperation(action, 0, skip, {
 			documentId: document.header.id,
@@ -4006,6 +4314,7 @@ var SimpleJobExecutor = class {
 		this.collectionMembershipCache = collectionMembershipCache;
 		this.driveContainerTypes = driveContainerTypes;
 		this.signer = signer ?? new PassthroughSigner();
+		this.featureFlags = resolveFeatureFlags(config.featureFlags);
 		this.config = {
 			featureFlags: config.featureFlags ?? {},
 			maxSkipThreshold: config.maxSkipThreshold ?? MAX_SKIP_THRESHOLD,
@@ -4016,9 +4325,9 @@ var SimpleJobExecutor = class {
 			retryMaxDelayMs: config.retryMaxDelayMs ?? 5e3,
 			yieldDeadlineMs: config.yieldDeadlineMs ?? 50,
 			batchApplies: config.batchApplies ?? true,
-			signatureVerification: config.signatureVerification ?? "enforce"
+			signatureVerification: config.signatureVerification ?? "enforce",
+			protocolSupport: config.protocolSupport ?? localSupports(PEER_CAPABILITIES, this.featureFlags).protocols
 		};
-		this.featureFlags = resolveFeatureFlags(config.featureFlags);
 		this.decisionModel = selectDecisionModel(this.featureFlags, registry);
 		this.signatureAdmission = new SignatureAdmission(this.config.signatureVerification, logger, eventBus, this.featureFlags.documentDecisions ? "write-cache" : "meta", {
 			signer: this.signer,
@@ -4026,7 +4335,7 @@ var SimpleJobExecutor = class {
 			policy: trustPolicy,
 			timeoutMs: Math.min(DEFAULT_TRUST_TIMEOUT_MS, this.config.jobTimeoutMs / 2)
 		});
-		this.documentActionHandler = new DocumentActionHandler(registry, logger, driveContainerTypes, this.featureFlags, this.decisionModel);
+		this.documentActionHandler = new DocumentActionHandler(registry, logger, driveContainerTypes, this.featureFlags, this.decisionModel, this.config.protocolSupport);
 		this.executionScope = executionScope ?? new DefaultExecutionScope(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache);
 	}
 	/**
@@ -4092,6 +4401,8 @@ var SimpleJobExecutor = class {
 	async executeInScope(params) {
 		const { job, startTime, stores, signal, touchedStreams, postCommitInvalidations, postCommitMembershipInvalidations } = params;
 		let pendingEvent;
+		const unsupported = await this.unsupportedStoredProtocol(job, stores, signal);
+		if (unsupported) return { result: buildErrorResult(job, unsupported, startTime) };
 		const indexTxn = stores.operationIndex.start();
 		if (job.kind === "load") {
 			const loadResult = await this.executeLoadJob({
@@ -4210,6 +4521,16 @@ var SimpleJobExecutor = class {
 		for (let i = 0; i < actionResult.operationsWithContext.length; i++) actionResult.operationsWithContext[i].context.ordinal = ordinals[i];
 		return this.committedOutcome(job, committed, actionResult.operationsWithContext, actionResult.generatedOperations, stores, startTime);
 	}
+	/** A stored document at a version this reactor does not run is read-only here. */
+	async unsupportedStoredProtocol(job, stores, signal) {
+		let versions;
+		try {
+			versions = this.featureFlags.documentDecisions && job.kind !== "load" ? (await stores.writeCache.getState(job.documentId, "document", job.branch, void 0, signal)).header.protocolVersions : (await stores.documentMetaCache.getDocumentMeta(job.documentId, job.branch, signal)).protocolVersions;
+		} catch {
+			return;
+		}
+		return this.documentActionHandler.unsupportedProtocol(job.documentId, versions);
+	}
 	/**
 	* A successful mutation's result and the write-ready event it owes, carrying
 	* what earlier attempts committed ahead of what this one wrote.
@@ -5841,8 +6162,8 @@ function createForwardingPoolInstrumentation(name) {
 }
 //#endregion
 //#region src/storage/migrations/001_create_operation_table.ts
-var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$19 });
-async function up$19(db) {
+var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$22 });
+async function up$22(db) {
 	await db.schema.createTable("Operation").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("jobId", "text", (col) => col.notNull()).addColumn("opId", "text", (col) => col.notNull()).addColumn("prevOpId", "text", (col) => col.notNull()).addColumn("writeTimestampUtcMs", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("timestampUtcMs", "timestamptz", (col) => col.notNull()).addColumn("index", "integer", (col) => col.notNull()).addColumn("action", "jsonb", (col) => col.notNull()).addColumn("skip", "integer", (col) => col.notNull()).addColumn("error", "text").addColumn("hash", "text", (col) => col.notNull()).addUniqueConstraint("unique_revision", [
 		"documentId",
 		"scope",
@@ -5867,8 +6188,8 @@ async function up$19(db) {
 }
 //#endregion
 //#region src/storage/migrations/002_create_keyframe_table.ts
-var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$18 });
-async function up$18(db) {
+var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$21 });
+async function up$21(db) {
 	await db.schema.createTable("Keyframe").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("revision", "integer", (col) => col.notNull()).addColumn("document", "jsonb", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_keyframe", [
 		"documentId",
 		"scope",
@@ -5884,14 +6205,14 @@ async function up$18(db) {
 }
 //#endregion
 //#region src/storage/migrations/003_create_document_table.ts
-var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$17 });
-async function up$17(db) {
+var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$20 });
+async function up$20(db) {
 	await db.schema.createTable("Document").addColumn("id", "text", (col) => col.primaryKey()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/004_create_document_relationship_table.ts
-var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$16 });
-async function up$16(db) {
+var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$19 });
+async function up$19(db) {
 	await db.schema.createTable("DocumentRelationship").addColumn("id", "text", (col) => col.primaryKey()).addColumn("sourceId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("targetId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("relationshipType", "text", (col) => col.notNull()).addColumn("metadata", "jsonb").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_source_target_type", [
 		"sourceId",
 		"targetId",
@@ -5903,14 +6224,14 @@ async function up$16(db) {
 }
 //#endregion
 //#region src/storage/migrations/005_create_indexer_state_table.ts
-var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$15 });
-async function up$15(db) {
+var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$18 });
+async function up$18(db) {
 	await db.schema.createTable("IndexerState").addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity()).addColumn("lastOperationId", "integer", (col) => col.notNull()).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/006_create_document_snapshot_table.ts
-var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$14 });
-async function up$14(db) {
+var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$17 });
+async function up$17(db) {
 	await db.schema.createTable("DocumentSnapshot").addColumn("id", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("slug", "text").addColumn("name", "text").addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("content", "jsonb", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("lastOperationIndex", "integer", (col) => col.notNull()).addColumn("lastOperationHash", "text", (col) => col.notNull()).addColumn("lastUpdatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("snapshotVersion", "integer", (col) => col.notNull().defaultTo(1)).addColumn("identifiers", "jsonb").addColumn("metadata", "jsonb").addColumn("isDeleted", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("deletedAt", "timestamptz").addUniqueConstraint("unique_doc_scope_branch", [
 		"documentId",
 		"scope",
@@ -5931,8 +6252,8 @@ async function up$14(db) {
 }
 //#endregion
 //#region src/storage/migrations/007_create_slug_mapping_table.ts
-var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
-async function up$13(db) {
+var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$16 });
+async function up$16(db) {
 	await db.schema.createTable("SlugMapping").addColumn("slug", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_docid_scope_branch", [
 		"documentId",
 		"scope",
@@ -5942,14 +6263,14 @@ async function up$13(db) {
 }
 //#endregion
 //#region src/storage/migrations/008_create_view_state_table.ts
-var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$12 });
-async function up$12(db) {
+var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$15 });
+async function up$15(db) {
 	await db.schema.createTable("ViewState").addColumn("readModelId", "text", (col) => col.primaryKey()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(0)).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/009_create_operation_index_tables.ts
-var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$11 });
-async function up$11(db) {
+var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$14 });
+async function up$14(db) {
 	await db.schema.createTable("document_collections").addColumn("documentId", "text", (col) => col.notNull()).addColumn("collectionId", "text", (col) => col.notNull()).addColumn("joinedOrdinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("leftOrdinal", "bigint").addPrimaryKeyConstraint("document_collections_pkey", ["documentId", "collectionId"]).execute();
 	await db.schema.createIndex("idx_document_collections_collectionId").on("document_collections").column("collectionId").execute();
 	await db.schema.createIndex("idx_doc_collections_collection_range").on("document_collections").columns(["collectionId", "joinedOrdinal"]).execute();
@@ -5963,8 +6284,8 @@ async function up$11(db) {
 }
 //#endregion
 //#region src/storage/migrations/010_create_sync_tables.ts
-var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$10 });
-async function up$10(db) {
+var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
+async function up$13(db) {
 	await db.schema.createTable("sync_remotes").addColumn("name", "text", (col) => col.primaryKey()).addColumn("collection_id", "text", (col) => col.notNull()).addColumn("channel_type", "text", (col) => col.notNull()).addColumn("channel_id", "text", (col) => col.notNull().defaultTo("")).addColumn("remote_name", "text", (col) => col.notNull().defaultTo("")).addColumn("channel_parameters", "jsonb", (col) => col.notNull().defaultTo(sql`'{}'::jsonb`)).addColumn("filter_document_ids", "jsonb").addColumn("filter_scopes", "jsonb").addColumn("filter_branch", "text", (col) => col.notNull().defaultTo("main")).addColumn("push_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("push_last_success_utc_ms", "text").addColumn("push_last_failure_utc_ms", "text").addColumn("push_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("pull_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("pull_last_success_utc_ms", "text").addColumn("pull_last_failure_utc_ms", "text").addColumn("pull_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 	await db.schema.createIndex("idx_sync_remotes_collection").on("sync_remotes").column("collection_id").execute();
 	await db.schema.createTable("sync_cursors").addColumn("remote_name", "text", (col) => col.primaryKey().references("sync_remotes.name").onDelete("cascade")).addColumn("cursor_ordinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("last_synced_at_utc_ms", "text").addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
@@ -5972,8 +6293,8 @@ async function up$10(db) {
 }
 //#endregion
 //#region src/storage/migrations/011_add_cursor_type_column.ts
-var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$9 });
-async function up$9(db) {
+var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$12 });
+async function up$12(db) {
 	await db.deleteFrom("sync_cursors").where("remote_name", "like", "outbox::%").execute();
 	await db.deleteFrom("sync_remotes").where("name", "like", "outbox::%").execute();
 	await db.schema.dropTable("sync_cursors").execute();
@@ -5982,64 +6303,64 @@ async function up$9(db) {
 }
 //#endregion
 //#region src/storage/migrations/012_add_source_remote_column.ts
-var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$8 });
-async function up$8(db) {
+var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$11 });
+async function up$11(db) {
 	await db.schema.alterTable("operation_index_operations").addColumn("sourceRemote", "text", (col) => col.notNull().defaultTo("")).execute();
 }
 //#endregion
 //#region src/storage/migrations/013_create_sync_dead_letters_table.ts
-var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$7 });
-async function up$7(db) {
+var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$10 });
+async function up$10(db) {
 	await db.schema.createTable("sync_dead_letters").addColumn("ordinal", "serial", (col) => col.primaryKey()).addColumn("id", "text", (col) => col.unique().notNull()).addColumn("job_id", "text", (col) => col.notNull()).addColumn("job_dependencies", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("remote_name", "text", (col) => col.notNull().references("sync_remotes.name").onDelete("cascade")).addColumn("document_id", "text", (col) => col.notNull()).addColumn("scopes", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("branch", "text", (col) => col.notNull()).addColumn("operations", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("error_source", "text", (col) => col.notNull()).addColumn("error_message", "text", (col) => col.notNull()).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 	await db.schema.createIndex("idx_sync_dead_letters_remote").on("sync_dead_letters").column("remote_name").execute();
 }
 //#endregion
 //#region src/storage/migrations/014_create_processor_cursor_table.ts
-var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$6 });
-async function up$6(db) {
+var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$9 });
+async function up$9(db) {
 	await db.schema.createTable("ProcessorCursor").addColumn("processorId", "text", (col) => col.primaryKey()).addColumn("factoryId", "text", (col) => col.notNull()).addColumn("driveId", "text", (col) => col.notNull()).addColumn("processorIndex", "integer", (col) => col.notNull()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(sql`0`)).addColumn("status", "text", (col) => col.notNull().defaultTo(sql`'active'`)).addColumn("lastError", "text").addColumn("lastErrorTimestamp", "timestamptz").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/015_add_operation_denied_reason.ts
 var _015_add_operation_denied_reason_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$5,
-	up: () => up$5
+	down: () => down$8,
+	up: () => up$8
 });
 /**
 * Records why authorization refused an operation. Separate from `error` so a
 * denial is distinguishable from a reducer failure without matching on a
 * message. Null for every operation written before decisions were enforced.
 */
-async function up$5(db) {
+async function up$8(db) {
 	await db.schema.alterTable("Operation").addColumn("deniedReason", "text").execute();
 	await db.schema.alterTable("operation_index_operations").addColumn("deniedReason", "text").execute();
 }
-async function down$5(db) {
+async function down$8(db) {
 	await db.schema.alterTable("operation_index_operations").dropColumn("deniedReason").execute();
 	await db.schema.alterTable("Operation").dropColumn("deniedReason").execute();
 }
 //#endregion
 //#region src/storage/migrations/016_add_dead_letter_error_type.ts
 var _016_add_dead_letter_error_type_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$4,
-	up: () => up$4
+	down: () => down$7,
+	up: () => up$7
 });
 /**
 * The classification a dead letter falls into, stored because it decides whether
 * the document stays quarantined and the in-memory error is gone after a restart.
 * Defaulted rather than nullable, so a pre-existing row rehydrates.
 */
-async function up$4(db) {
+async function up$7(db) {
 	await db.schema.alterTable("sync_dead_letters").addColumn("error_type", "text", (col) => col.notNull().defaultTo("UNCLASSIFIED")).execute();
 }
-async function down$4(db) {
+async function down$7(db) {
 	await db.schema.alterTable("sync_dead_letters").dropColumn("error_type").execute();
 }
 //#endregion
 //#region src/storage/migrations/017_create_group_references.ts
 var _017_create_group_references_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$3,
-	up: () => up$3
+	down: () => down$6,
+	up: () => up$6
 });
 /**
 * One row per (document, group) reference ever discovered from an auth
@@ -6050,18 +6371,18 @@ var _017_create_group_references_exports = /* @__PURE__ */ __exportAll({
 * requires (sync), and by groupId for the documents a group change affects
 * (re-evaluation).
 */
-async function up$3(db) {
+async function up$6(db) {
 	await db.schema.createTable("group_references").addColumn("documentId", "text", (col) => col.notNull()).addColumn("groupId", "text", (col) => col.notNull()).addPrimaryKeyConstraint("group_references_pkey", ["documentId", "groupId"]).execute();
 	await db.schema.createIndex("idx_group_references_groupId").on("group_references").column("groupId").execute();
 }
-async function down$3(db) {
+async function down$6(db) {
 	await db.schema.dropTable("group_references").execute();
 }
 //#endregion
 //#region src/storage/migrations/018_add_sync_remote_bound_address.ts
 var _018_add_sync_remote_bound_address_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$2,
-	up: () => up$2
+	down: () => down$5,
+	up: () => up$5
 });
 /**
 * The address a sync channel is bound to, so a channel created by one subject
@@ -6072,17 +6393,17 @@ var _018_add_sync_remote_bound_address_exports = /* @__PURE__ */ __exportAll({
 * until its first authenticated poll adopts it. A default would claim them all
 * for one address.
 */
-async function up$2(db) {
+async function up$5(db) {
 	await db.schema.alterTable("sync_remotes").addColumn("bound_address", "text").execute();
 }
-async function down$2(db) {
+async function down$5(db) {
 	await db.schema.alterTable("sync_remotes").dropColumn("bound_address").execute();
 }
 //#endregion
 //#region src/storage/migrations/019_require_action_id.ts
 var _019_require_action_id_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$4,
+	up: () => up$4
 });
 /**
 * Makes an operation whose action carries no id physically unstorable.
@@ -6109,7 +6430,7 @@ var _019_require_action_id_exports = /* @__PURE__ */ __exportAll({
 * The empty string is rejected alongside null. It derives the same colliding
 * operation id as an absent id, so admitting it would leave the hole open.
 */
-async function up$1(db) {
+async function up$4(db) {
 	await db.updateTable("Operation").set({ action: sql`jsonb_set(action, '{id}', to_jsonb(gen_random_uuid()::text))` }).where(sql`jsonb_typeof(action) = 'object' and coalesce(action->>'id', '') = ''`).execute();
 	await db.updateTable("operation_index_operations as oio").from("Operation as op").set({ action: sql`jsonb_set(oio.action, '{id}', to_jsonb(op.action->>'id'))` }).whereRef("oio.opId", "=", "op.opId").whereRef("oio.index", "=", "op.index").whereRef("oio.skip", "=", "op.skip").where(sql`jsonb_typeof(oio.action) = 'object' and coalesce(oio.action->>'id', '') = ''`).where(sql`coalesce(op.action->>'id', '') <> ''`).execute();
 	await db.updateTable("operation_index_operations").set({ action: sql`jsonb_set(action, '{id}', to_jsonb(gen_random_uuid()::text))` }).where(sql`jsonb_typeof(action) = 'object' and coalesce(action->>'id', '') = ''`).execute();
@@ -6121,22 +6442,72 @@ async function up$1(db) {
 * their operations are now known by, and reverting them would reintroduce the
 * collision the migration removed.
 */
-async function down$1(db) {
+async function down$4(db) {
 	await db.schema.alterTable("operation_index_operations").dropConstraint("action_must_have_id").execute();
 	await db.schema.alterTable("Operation").dropConstraint("action_must_have_id").execute();
 }
 //#endregion
 //#region src/storage/migrations/020_add_snapshot_operation_ordinal.ts
 var _020_add_snapshot_operation_ordinal_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$3,
+	up: () => up$3
+});
+/** Orders header row writes across scopes; `lastOperationIndex` is per scope. */
+async function up$3(db) {
+	await db.schema.alterTable("DocumentSnapshot").addColumn("lastOperationOrdinal", "integer", (col) => col.notNull().defaultTo(0)).execute();
+}
+async function down$3(db) {
+	await db.schema.alterTable("DocumentSnapshot").dropColumn("lastOperationOrdinal").execute();
+}
+//#endregion
+//#region src/storage/migrations/021_add_sync_remote_peer.ts
+var _021_add_sync_remote_peer_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$2,
+	up: () => up$2
+});
+/**
+* The peer's manifest as canonical JSON, and when it was heard. Both null: not
+* yet heard. A time with no manifest: a silent peer, which gets the baselines.
+*/
+async function up$2(db) {
+	await db.schema.alterTable("sync_remotes").addColumn("peer_manifest", "text").addColumn("peer_manifest_at_utc_ms", "bigint").execute();
+}
+async function down$2(db) {
+	await db.schema.alterTable("sync_remotes").dropColumn("peer_manifest").dropColumn("peer_manifest_at_utc_ms").execute();
+}
+//#endregion
+//#region src/storage/migrations/022_create_sync_holds.ts
+var _022_create_sync_holds_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$1,
+	up: () => up$1
+});
+/** Documents held back from a remote whose peer cannot run their versions. */
+async function up$1(db) {
+	await db.schema.createTable("sync_holds").addColumn("remote_name", "text", (col) => col.notNull().references("sync_remotes.name").onDelete("cascade")).addColumn("document_id", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("protocol", "text", (col) => col.notNull()).addColumn("version", "integer", (col) => col.notNull()).addColumn("held_at_utc_ms", "bigint", (col) => col.notNull()).addPrimaryKeyConstraint("sync_holds_pkey", [
+		"remote_name",
+		"document_id",
+		"branch"
+	]).execute();
+}
+async function down$1(db) {
+	await db.schema.dropTable("sync_holds").execute();
+}
+//#endregion
+//#region src/storage/migrations/023_index_created_protocol_versions.ts
+var _023_index_created_protocol_versions_exports = /* @__PURE__ */ __exportAll({
 	down: () => down,
 	up: () => up
 });
-/** Orders header row writes across scopes; `lastOperationIndex` is per scope. */
+/**
+* One entry per document created with protocolVersions, keyed by a hash so an
+* oversized header cannot make its creation unstorable. Startup reads the
+* distinct values without visiting every document.
+*/
 async function up(db) {
-	await db.schema.alterTable("DocumentSnapshot").addColumn("lastOperationOrdinal", "integer", (col) => col.notNull().defaultTo(0)).execute();
+	await db.schema.createIndex("idx_operation_created_protocol_versions").on("Operation").expression(sql`md5((action->'input'->'protocolVersions')::text)`).where(sql`scope = 'document' and "index" = 0 and (action->'input'->'protocolVersions') is not null`).execute();
 }
 async function down(db) {
-	await db.schema.alterTable("DocumentSnapshot").dropColumn("lastOperationOrdinal").execute();
+	await db.schema.dropIndex("idx_operation_created_protocol_versions").execute();
 }
 //#endregion
 //#region src/storage/migrations/migrator.ts
@@ -6161,7 +6532,10 @@ const migrations = {
 	"017_create_group_references": _017_create_group_references_exports,
 	"018_add_sync_remote_bound_address": _018_add_sync_remote_bound_address_exports,
 	"019_require_action_id": _019_require_action_id_exports,
-	"020_add_snapshot_operation_ordinal": _020_add_snapshot_operation_ordinal_exports
+	"020_add_snapshot_operation_ordinal": _020_add_snapshot_operation_ordinal_exports,
+	"021_add_sync_remote_peer": _021_add_sync_remote_peer_exports,
+	"022_create_sync_holds": _022_create_sync_holds_exports,
+	"023_index_created_protocol_versions": _023_index_created_protocol_versions_exports
 };
 var ProgrammaticMigrationProvider = class {
 	getMigrations() {
@@ -6361,6 +6735,6 @@ function createForwardingLogger(post, level = "info", tags = []) {
 	};
 }
 //#endregion
-export { DocumentNotFoundError as $, ModuleNotFoundError as A, authDecisionModel as B, DocumentMetaCache as C, DuplicateManifestError as D, JobExecutorEventTypes as E, summarizeSubmittedActions as F, DocumentExistence as G, APPEND_CONDITION_FAILED_PREFIX as H, targetDocumentId as I, RevisionMismatchError as J, DuplicateOperationError as K, decideAtHead as L, createConsistencyToken as M, createEmptyConsistencyToken as N, DuplicateModuleError as O, submittedActionIds as P, DocumentDeletedError as Q, selectDecisionModel as R, KyselyOperationIndex as S, DEFAULT_DEFERRED_JOB_TTL_MS as T, AppendConditionFailedError as U, buildDecisionModel as V, DocumentAlreadyExistsError as W, AuthTimestampNotMonotonicError as X, AuthEnforcementDisabledError as Y, AuthorizationDeniedError as Z, DriveCollectionId as _, DEFAULT_DRIVE_CONTAINER_TYPES as a, EventBusAggregateError as at, EventBus as b, runMigrations as c, parsePagingOptions as ct, KyselyOperationStore as d, __exportAll as dt, ExcessiveReshuffleError as et, KyselyKeyframeStore as f, PassthroughSigner as g, verifyActionSignature as h, fromErrorInfo as i, UpgradePreconditionFailedError as it, GATED_DOCUMENT_ACTIONS as j, InvalidModuleError as k, createForwardingPoolInstrumentation as l, throwIfAborted as lt, SimpleJobExecutor as m, errorToInfo as n, InvalidSignatureError as nt, REACTOR_SCHEMA as o, ReactorEventTypes as ot, DocumentModelRegistry as p, OptimisticLockError as q, sanitizeArg as r, RelationshipNotFoundError as rt, getMigrationStatus as s, matchesScope as st, createForwardingLogger as t, InvalidOperationTimestampError as tt, instrumentPgPool as u, yieldToMain as ut, KyselyExecutionScope as v, CollectionMembershipCache as w, KyselyWriteCache as x, resolveFeatureFlags as y, documentDecisionModel as z };
+export { OptimisticLockError as $, DEFAULT_DEFERRED_JOB_TTL_MS as A, summarizeSubmittedActions as B, SettledWatermark as C, snapshotFunctionsFor as D, parseSnapshot as E, ModuleNotFoundError as F, authDecisionModel as G, decideAtHead as H, GATED_DOCUMENT_ACTIONS as I, APPEND_CONDITION_FAILED_PREFIX as J, buildDecisionModel as K, createConsistencyToken as L, DuplicateManifestError as M, DuplicateModuleError as N, DocumentMetaCache as O, InvalidModuleError as P, DuplicateOperationError as Q, createEmptyConsistencyToken as R, ProbeSettler as S, describeWaitingSessions as T, selectDecisionModel as U, targetDocumentId as V, documentDecisionModel as W, DocumentAlreadyExistsError as X, AppendConditionFailedError as Y, DocumentExistence as Z, KyselyExecutionScope as _, throwIfAborted as _t, DEFAULT_DRIVE_CONTAINER_TYPES as a, DocumentNotFoundError as at, KyselyWriteCache as b, runMigrations as c, InvalidSignatureError as ct, KyselyOperationStore as d, UnsupportedStoredProtocolError as dt, RevisionMismatchError as et, KyselyKeyframeStore as f, UpgradePreconditionFailedError as ft, PassthroughSigner as g, parsePagingOptions as gt, verifyActionSignature as h, matchesScope as ht, fromErrorInfo as i, DocumentDeletedError as it, JobExecutorEventTypes as j, CollectionMembershipCache as k, createForwardingPoolInstrumentation as l, RelationshipNotFoundError as lt, SimpleJobExecutor as m, ReactorEventTypes as mt, errorToInfo as n, AuthTimestampNotMonotonicError as nt, REACTOR_SCHEMA as o, ExcessiveReshuffleError as ot, DocumentModelRegistry as p, EventBusAggregateError as pt, DriveCollectionId as q, sanitizeArg as r, AuthorizationDeniedError as rt, getMigrationStatus as s, InvalidOperationTimestampError as st, createForwardingLogger as t, AuthEnforcementDisabledError as tt, instrumentPgPool as u, UnsupportedProtocolVersionError as ut, resolveFeatureFlags as v, yieldToMain as vt, createKyselyWatermarkProbe as w, KyselyOperationIndex as x, EventBus as y, __exportAll as yt, submittedActionIds as z };
 
-//# sourceMappingURL=forwarding-logger-CnuVDVze.js.map
+//# sourceMappingURL=forwarding-logger-BkwlvD9W.js.map