@powerhousedao/reactor 6.2.3-dev.32 → 6.2.3-dev.33

package/dist/index.js

@@ -1,7 +1,7 @@
-import { $ as DocumentNotFoundError, A as ModuleNotFoundError, B as authDecisionModel, C as DocumentMetaCache, D as DuplicateManifestError, E as JobExecutorEventTypes, F as summarizeSubmittedActions, G as DocumentExistence, H as APPEND_CONDITION_FAILED_PREFIX, I as targetDocumentId, J as RevisionMismatchError, K as DuplicateOperationError, L as decideAtHead, M as createConsistencyToken, N as createEmptyConsistencyToken, O as DuplicateModuleError, P as submittedActionIds, Q as DocumentDeletedError, R as selectDecisionModel, S as KyselyOperationIndex, T as DEFAULT_DEFERRED_JOB_TTL_MS, U as AppendConditionFailedError, V as buildDecisionModel, W as DocumentAlreadyExistsError, X as AuthTimestampNotMonotonicError, Y as AuthEnforcementDisabledError, Z as AuthorizationDeniedError, _ as DriveCollectionId, a as DEFAULT_DRIVE_CONTAINER_TYPES, at as EventBusAggregateError, b as EventBus, c as runMigrations, ct as parsePagingOptions, d as KyselyOperationStore, dt as __exportAll, et as ExcessiveReshuffleError, f as KyselyKeyframeStore, g as PassthroughSigner, h as verifyActionSignature, it as UpgradePreconditionFailedError, j as GATED_DOCUMENT_ACTIONS, k as InvalidModuleError, l as createForwardingPoolInstrumentation, lt as throwIfAborted, m as SimpleJobExecutor, n as errorToInfo, nt as InvalidSignatureError, o as REACTOR_SCHEMA, ot as ReactorEventTypes, p as DocumentModelRegistry, q as OptimisticLockError, r as sanitizeArg, rt as RelationshipNotFoundError, s as getMigrationStatus, st as matchesScope, t as createForwardingLogger, tt as InvalidOperationTimestampError, u as instrumentPgPool, v as KyselyExecutionScope, w as CollectionMembershipCache, x as KyselyWriteCache, y as resolveFeatureFlags, z as documentDecisionModel } from "./forwarding-logger-CnuVDVze.js";
+import { $ as OptimisticLockError, A as DEFAULT_DEFERRED_JOB_TTL_MS, B as summarizeSubmittedActions, C as SettledWatermark, D as snapshotFunctionsFor, E as parseSnapshot, F as ModuleNotFoundError, G as authDecisionModel, H as decideAtHead, I as GATED_DOCUMENT_ACTIONS, J as APPEND_CONDITION_FAILED_PREFIX, K as buildDecisionModel, L as createConsistencyToken, M as DuplicateManifestError, N as DuplicateModuleError, O as DocumentMetaCache, P as InvalidModuleError, Q as DuplicateOperationError, R as createEmptyConsistencyToken, S as ProbeSettler, T as describeWaitingSessions, U as selectDecisionModel, V as targetDocumentId, W as documentDecisionModel, X as DocumentAlreadyExistsError, Y as AppendConditionFailedError, Z as DocumentExistence, _ as KyselyExecutionScope, _t as throwIfAborted, a as DEFAULT_DRIVE_CONTAINER_TYPES, at as DocumentNotFoundError, b as KyselyWriteCache, c as runMigrations, ct as InvalidSignatureError, d as KyselyOperationStore, dt as UnsupportedStoredProtocolError, et as RevisionMismatchError, f as KyselyKeyframeStore, ft as UpgradePreconditionFailedError, g as PassthroughSigner, gt as parsePagingOptions, h as verifyActionSignature, ht as matchesScope, it as DocumentDeletedError, j as JobExecutorEventTypes, k as CollectionMembershipCache, l as createForwardingPoolInstrumentation, lt as RelationshipNotFoundError, m as SimpleJobExecutor, mt as ReactorEventTypes, n as errorToInfo, nt as AuthTimestampNotMonotonicError, o as REACTOR_SCHEMA, ot as ExcessiveReshuffleError, p as DocumentModelRegistry, pt as EventBusAggregateError, q as DriveCollectionId, r as sanitizeArg, rt as AuthorizationDeniedError, s as getMigrationStatus, st as InvalidOperationTimestampError, t as createForwardingLogger, tt as AuthEnforcementDisabledError, u as instrumentPgPool, ut as UnsupportedProtocolVersionError, v as resolveFeatureFlags, w as createKyselyWatermarkProbe, x as KyselyOperationIndex, y as EventBus, yt as __exportAll, z as submittedActionIds } from "./forwarding-logger-BkwlvD9W.js";
 import { i as WorkerInitFailedError, r as WorkerExitedError, t as WorkerAbortTimeoutError } from "./errors-BM_ULVWd.js";
-import { a as KyselyDocumentView, c as ReadModelCoordinator, d as DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, f as defaultReadModelIndexingConfig, i as DeletedDocumentRead, l as BaseReadModel, n as ConsistencyTracker, o as DOCUMENT_INDEXER_READ_MODEL, p as unchunkedReadModelIndexingConfig, r as makeConsistencyKey, s as DOCUMENT_VIEW_READ_MODEL, t as KyselyDocumentIndexer, u as DEFAULT_COMMIT_CHUNK_SIZE } from "./document-indexer-BVTGbEB0.js";
-import { DEFAULT_SIGNATURE_POLICY, DowngradeNotSupportedError, MAX_AUTH_GRANTS, UnsupportedDocumentModelVersionError, actionSignerIdentity, actionSigningTarget, actions, actions as documentActions, createCopyHeader, decide, deserializeSignature, garbageCollect, generateId, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, normalizeDocumentModelVersion, requestedSignaturePolicy, sortOperations, toTransportAction, withSignaturePolicy } from "@powerhousedao/shared/document-model";
+import { _ as ContiguousCursor, a as KyselyDocumentView, b as isCatchUpConsumer, c as ReadModelCoordinator, d as reserveBatch, f as BaseReadModel, g as unchunkedReadModelIndexingConfig, h as defaultReadModelIndexingConfig, i as DeletedDocumentRead, l as indexReserved, m as DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, n as ConsistencyTracker, o as DOCUMENT_INDEXER_READ_MODEL, p as DEFAULT_COMMIT_CHUNK_SIZE, r as makeConsistencyKey, s as DOCUMENT_VIEW_READ_MODEL, t as KyselyDocumentIndexer, u as releaseBatch, v as defaultCatchUpConfig, y as CatchUpScheduler } from "./document-indexer-I6i_YzsR.js";
+import { DEFAULT_SIGNATURE_POLICY, DowngradeNotSupportedError, MAX_AUTH_GRANTS, PEER_CAPABILITIES, UnsupportedDocumentModelVersionError, actionSignerIdentity, actionSigningTarget, actions, actions as documentActions, canonicalJson, coversLocal, createCopyHeader, decide, deserializeSignature, garbageCollect, generateId, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, holdReason, isOlderManifest, legacySupports, localPeerManifest, localSupports, mergePeerCapabilities, normalizeDocumentModelVersion, peerSupports, readPeerManifest, requestedSignaturePolicy, selectProtocolVersions, sortOperations, toTransportAction, withSignaturePolicy } from "@powerhousedao/shared/document-model";
 import { addFile, addFolder, copyNode, deleteNode, driveCreateDocument, generateNodesCopy, getDescendants, handleTargetNameCollisions, isFileNode, isFolderNode, moveNode, updateNode } from "@powerhousedao/shared/document-drive";
 import { v4 } from "uuid";
 import { ConsoleLogger, childLogger } from "document-model";
@@ -311,6 +311,16 @@ let JobStatus = /* @__PURE__ */ function(JobStatus) {
 * for batch execution. The back-reference is captured but never invoked
 * during construction, so the partial-`this` hazard does not apply.
 */
+/** A copy keeps its source's versions; selection fills only the keys it lacks. */
+function withSelectedVersions(header, selected) {
+	return {
+		documentType: header.documentType,
+		protocolVersions: header.protocolVersions ? {
+			...selected,
+			...header.protocolVersions
+		} : void 0
+	};
+}
 var DriveClient = class {
 	client;
 	logger;
@@ -328,7 +338,10 @@ var DriveClient = class {
 			name: input.global.name || "",
 			icon: input.global.icon ?? null,
 			nodes: []
-		} }), requestedSignaturePolicy(input, await this.client.getCreateSignaturePolicy()), { protocolVersions: input.protocolVersions });
+		} }), requestedSignaturePolicy(input, await this.client.getCreateSignaturePolicy()), { protocolVersions: {
+			...await this.client.getCreateProtocolVersions(void 0, signal),
+			...input.protocolVersions
+		} });
 		if (input.preferredEditor) driveDoc.header.meta = {
 			...driveDoc.header.meta,
 			preferredEditor: input.preferredEditor
@@ -468,13 +481,14 @@ var DriveClient = class {
 			resolvedNamesByTargetId.set(entry.targetId, resolved);
 		}
 		const policy = await this.client.getCreateSignaturePolicy();
+		const base = await this.client.getCreateProtocolVersions(drive.header.id, signal);
 		for (const entry of copyPlan) {
 			const node = drive.state.global.nodes.find((n) => n.id === entry.srcId);
 			if (!node || !isFileNode(node)) continue;
 			const srcDoc = await this.client.get(entry.srcId, void 0, signal);
 			const duplicated = {
 				...srcDoc,
-				header: createCopyHeader(srcDoc.header, entry.targetId, policy),
+				header: createCopyHeader(withSelectedVersions(srcDoc.header, base), entry.targetId, policy),
 				initialState: srcDoc.state,
 				operations: {}
 			};
@@ -1242,8 +1256,14 @@ var ReactorClient = class {
 	eventReads;
 	actionEvaluation;
 	createSignaturePolicy;
+	protocolSelection;
 	drives;
-	constructor(logger, reactor, signer, subscriptionManager, jobAwaiter, documentIndexer, documentView, readGate = new BareReadGate(), actionEvaluation, createSignaturePolicy = DEFAULT_SIGNATURE_POLICY) {
+	constructor(logger, reactor, signer, subscriptionManager, jobAwaiter, documentIndexer, documentView, readGate = new BareReadGate(), actionEvaluation, createSignaturePolicy = DEFAULT_SIGNATURE_POLICY, protocolSelection = {
+		capabilities: PEER_CAPABILITIES,
+		flags: {},
+		collectionsOf: () => Promise.resolve({})
+	}) {
+		this.protocolSelection = protocolSelection;
 		this.logger = logger;
 		this.reactor = reactor;
 		this.signer = signer;
@@ -1477,6 +1497,27 @@ var ReactorClient = class {
 	getCreateSignaturePolicy() {
 		return Promise.resolve(this.createSignaturePolicy);
 	}
+	async getCreateProtocolVersions(parentIdentifier, signal) {
+		const { capabilities, flags, agreement, collectionsOf } = this.protocolSelection;
+		let members = [];
+		if (parentIdentifier !== void 0 && agreement) {
+			let parentId;
+			try {
+				parentId = await this.resolveIdOrSlug(parentIdentifier, void 0, signal);
+			} catch {
+				parentId = void 0;
+			}
+			if (parentId !== void 0) {
+				const collectionIds = [...(await collectionsOf([parentId]))[parentId] ?? [], DriveCollectionId.forDrive(parentId).key];
+				members = [...agreement().members(collectionIds).values()];
+			}
+		}
+		return selectProtocolVersions({
+			capabilities,
+			flags,
+			members
+		});
+	}
 	/**
 	* Creates a document and waits for completion
 	*/
@@ -1557,7 +1598,11 @@ var ReactorClient = class {
 			}, void 0);
 			if (!module) throw new Error(`Document model not found for type: ${documentModelType}`);
 		}
-		const document = withSignaturePolicy(module.utils.createDocument(), requestedSignaturePolicy(options, this.createSignaturePolicy), { protocolVersions: options?.protocolVersions });
+		const base = await this.getCreateProtocolVersions(options?.parentIdentifier, signal);
+		const document = withSignaturePolicy(module.utils.createDocument(), requestedSignaturePolicy(options, this.createSignaturePolicy), { protocolVersions: {
+			...base,
+			...options?.protocolVersions
+		} });
 		document.state.document.version = normalizeDocumentModelVersion(module.version);
 		return this.create(document, options?.parentIdentifier, signal);
 	}
@@ -2189,7 +2234,7 @@ var JobResultHandler = class {
 			callbacks.deferJob(result.error.documentId, handle.job);
 			return;
 		}
-		if (result.error && (DocumentDeletedError.isError(result.error) || DocumentAlreadyExistsError.isError(result.error) || DocumentNotFoundError.isError(result.error) || AuthorizationDeniedError.isError(result.error) || AuthTimestampNotMonotonicError.isError(result.error) || InvalidOperationTimestampError.isError(result.error) || ExcessiveReshuffleError.isError(result.error) || InvalidSignatureError.isError(result.error) || UpgradePreconditionFailedError.isError(result.error))) {
+		if (result.error && (DocumentDeletedError.isError(result.error) || DocumentAlreadyExistsError.isError(result.error) || DocumentNotFoundError.isError(result.error) || AuthorizationDeniedError.isError(result.error) || AuthTimestampNotMonotonicError.isError(result.error) || InvalidOperationTimestampError.isError(result.error) || ExcessiveReshuffleError.isError(result.error) || InvalidSignatureError.isError(result.error) || UpgradePreconditionFailedError.isError(result.error) || UnsupportedProtocolVersionError.isError(result.error))) {
 			const errorInfo = toErrorInfo(result.error);
 			this.jobTracker.markFailed(handle.job.id, errorInfo, handle.job);
 			this.eventBus.emit(ReactorEventTypes.JOB_FAILED, {
@@ -2710,6 +2755,65 @@ function fillMissingMemberships(documentIds, found) {
 	return result;
 }
 //#endregion
+//#region src/storage/kysely/stored-protocol-versions.ts
+const created = sql.raw(`scope = 'document' and "index" = 0 and (action->'input'->'protocolVersions') is not null`);
+const key = sql.raw(`md5((action->'input'->'protocolVersions')::text)`);
+/** Distinct creation protocolVersions, one index probe per value. */
+async function storedProtocolVersions(db, schema) {
+	const operation = sql.id(schema, "Operation");
+	return (await sql`
+    with recursive hashes(hash) as (
+      select (select ${key} from ${operation} where ${created} order by 1 limit 1)
+      union all
+      select (
+        select ${key} from ${operation}
+        where ${created} and ${key} > hashes.hash
+        order by 1 limit 1
+      )
+      from hashes where hashes.hash is not null
+    )
+    select hash, (
+      select action->'input'->'protocolVersions' from ${operation}
+      where ${created} and ${key} = hashes.hash limit 1
+    ) as versions
+    from hashes where hash is not null
+  `.execute(db)).rows;
+}
+/** Documents created with any of the protocolVersions `hashes` name. */
+async function countDocumentsCreatedWith(db, schema, hashes) {
+	if (hashes.length === 0) return 0;
+	const operation = sql.id(schema, "Operation");
+	const result = await sql`
+    select count(distinct "documentId") as documents from ${operation}
+    where ${created} and ${key} in (${sql.join(hashes)})
+  `.execute(db);
+	return Number(result.rows[0]?.documents ?? 0);
+}
+//#endregion
+//#region src/core/stored-protocol-check.ts
+/** Refuses to run below a version the store holds, unless told read-only. */
+async function checkStoredProtocols(db, schema, support, mode, logger) {
+	const unsupported = /* @__PURE__ */ new Map();
+	const hashes = [];
+	for (const { hash, versions } of await storedProtocolVersions(db, schema)) {
+		let refused = false;
+		for (const [protocol, version] of Object.entries(versions)) {
+			const supported = support[protocol];
+			if (supported === void 0 || supported.includes(version)) continue;
+			unsupported.set(`${protocol}:${version}`, {
+				protocol,
+				version
+			});
+			refused = true;
+		}
+		if (refused) hashes.push(hash);
+	}
+	if (hashes.length === 0) return;
+	const error = new UnsupportedStoredProtocolError([...unsupported.values()], await countDocumentsCreatedWith(db, schema, hashes));
+	if (mode === "refuse") throw error;
+	logger.warn("Starting with documents read-only: @message", error.message);
+}
+//#endregion
 //#region src/executor/simple-job-executor-manager.ts
 /**
 * Manages multiple job executors and coordinates job distribution.
@@ -3293,9 +3397,9 @@ var ProcessorQueue = class {
 	}
 	async raiseCursor(through) {
 		const { cursor } = this.options;
-		if (cursor.status !== "active") return;
-		if (through <= cursor.lastOrdinal) return;
-		cursor.lastOrdinal = through;
+		const capped = Math.min(through, this.options.confirmedThrough());
+		if (cursor.status !== "active" || capped <= cursor.lastOrdinal) return;
+		cursor.lastOrdinal = capped;
 		await this.persist();
 	}
 	async parkBelow(missed) {
@@ -3327,6 +3431,8 @@ var ProcessorManager = class extends BaseReadModel {
 	knownDrives = /* @__PURE__ */ new Map();
 	highestRoutedOrdinal = 0;
 	cursorCache = /* @__PURE__ */ new Map();
+	persistedOrdinals = /* @__PURE__ */ new Map();
+	advancing = Promise.resolve();
 	cursorWrites = /* @__PURE__ */ new Map();
 	draining = /* @__PURE__ */ new Map();
 	logger;
@@ -3566,6 +3672,7 @@ var ProcessorManager = class extends BaseReadModel {
 			floor,
 			readSince: (ordinal) => this.operationIndex.getSinceOrdinal(ordinal),
 			routedThrough: () => this.highWater(),
+			confirmedThrough: () => this.lastOrdinal,
 			persist: (state) => this.writeCursor(tracked, state),
 			logger: this.logger
 		});
@@ -3574,6 +3681,16 @@ var ProcessorManager = class extends BaseReadModel {
 			queue
 		};
 	}
+	/** Resolves once every queue has taken the latest cursor advance. */
+	whenCursorsAdvanced() {
+		return this.advancing;
+	}
+	/** Every bound processor may now move up to the manager's cursor. */
+	onCursorAdvanced(appliedThrough) {
+		const advances = [];
+		for (const { queue } of this.allBound()) advances.push(queue.advance(appliedThrough));
+		this.advancing = Promise.all(advances).then(() => void 0);
+	}
 	async discard(slot, disconnect) {
 		try {
 			await disconnect();
@@ -3599,7 +3716,10 @@ var ProcessorManager = class extends BaseReadModel {
 	}
 	async loadAllCursors() {
 		const rows = await this.db.selectFrom("ProcessorCursor").selectAll().execute();
-		for (const row of rows) this.cursorCache.set(row.processorId, row);
+		for (const row of rows) {
+			this.cursorCache.set(row.processorId, row);
+			this.persistedOrdinals.set(row.processorId, row.lastOrdinal);
+		}
 	}
 	lane(processorId, write) {
 		const next = (this.cursorWrites.get(processorId) ?? Promise.resolve()).then(write).then(() => void 0, (error) => {
@@ -3626,7 +3746,28 @@ var ProcessorManager = class extends BaseReadModel {
 			updatedAt: now
 		};
 		this.cursorCache.set(row.processorId, row);
-		return this.lane(row.processorId, () => this.db.insertInto("ProcessorCursor").values({
+		return this.lane(row.processorId, async () => {
+			const expected = this.persistedOrdinals.get(row.processorId);
+			if (expected === void 0) {
+				await this.insertCursor(row, now);
+				return;
+			}
+			const result = await this.db.updateTable("ProcessorCursor").set({
+				lastOrdinal: row.lastOrdinal,
+				status: row.status,
+				lastError: row.lastError,
+				lastErrorTimestamp: row.lastErrorTimestamp,
+				updatedAt: now
+			}).where("processorId", "=", row.processorId).where("lastOrdinal", "=", expected).executeTakeFirst();
+			if (Number(result.numUpdatedRows) > 0) {
+				this.persistedOrdinals.set(row.processorId, row.lastOrdinal);
+				return;
+			}
+			await this.reconcileCursor(tracked, row, now);
+		});
+	}
+	async insertCursor(row, now) {
+		await this.db.insertInto("ProcessorCursor").values({
 			processorId: row.processorId,
 			factoryId: row.factoryId,
 			driveId: row.driveId,
@@ -3642,13 +3783,29 @@ var ProcessorManager = class extends BaseReadModel {
 			lastError: row.lastError,
 			lastErrorTimestamp: row.lastErrorTimestamp,
 			updatedAt: now
-		})).execute());
+		})).execute();
+		this.persistedOrdinals.set(row.processorId, row.lastOrdinal);
+	}
+	/** A failed compare-and-set: a lowered row resets the cursor and backfills. */
+	async reconcileCursor(tracked, row, now) {
+		const stored = await this.db.selectFrom("ProcessorCursor").select("lastOrdinal").where("processorId", "=", row.processorId).executeTakeFirst();
+		if (stored === void 0) {
+			await this.insertCursor(row, now);
+			return;
+		}
+		this.persistedOrdinals.set(row.processorId, stored.lastOrdinal);
+		if (stored.lastOrdinal >= row.lastOrdinal) return;
+		this.logger.info("Processor '@ProcessorId' cursor lowered externally from @Old to @New; replaying", row.processorId, row.lastOrdinal, stored.lastOrdinal);
+		tracked.lastOrdinal = stored.lastOrdinal;
+		row.lastOrdinal = stored.lastOrdinal;
+		for (const bound of this.allBound()) if (bound.tracked.processorId === row.processorId) bound.queue.backfill();
 	}
 	deleteCursors(matches) {
 		const deletes = [];
 		for (const [processorId, row] of this.cursorCache) {
 			if (!matches(row)) continue;
 			this.cursorCache.delete(processorId);
+			this.persistedOrdinals.delete(processorId);
 			deletes.push(this.lane(processorId, () => this.db.deleteFrom("ProcessorCursor").where("processorId", "=", processorId).execute()));
 		}
 		return deletes;
@@ -4567,6 +4724,10 @@ var SubscriptionNotificationReadModel = class {
 };
 //#endregion
 //#region src/core/group-reevaluation-trigger.ts
+const GROUP_REEVALUATION_TRIGGER = "group-reevaluation-trigger";
+function isMembershipChange({ operation, context }) {
+	return context.documentType === groupDocumentType && context.scope === "global" && groupMembershipActionTypes.includes(operation.action.type);
+}
 /**
 * Watches committed writes for group membership changes and enqueues a
 * re-evaluation job for every document whose auth history references the
@@ -4578,33 +4739,49 @@ var SubscriptionNotificationReadModel = class {
 * skips the pass when everything the document holds sorts before it, which
 * keeps the common case (a membership write later than all history) free.
 */
-var GroupReevaluationTrigger = class {
+var GroupReevaluationTrigger = class extends BaseReadModel {
 	logger;
 	eventBus;
 	queue;
-	operationIndex;
 	unsubscribe;
-	constructor(logger, eventBus, queue, operationIndex) {
+	constructor(logger, eventBus, queue, operationIndex, db) {
+		super(db, operationIndex, {}, new ConsistencyTracker(), {
+			readModelId: GROUP_REEVALUATION_TRIGGER,
+			rebuildStateOnInit: false,
+			indexing: unchunkedReadModelIndexingConfig,
+			startFrom: "head",
+			replayStreamSuffix: false
+		});
 		this.logger = logger;
 		this.eventBus = eventBus;
 		this.queue = queue;
-		this.operationIndex = operationIndex;
 	}
-	startup() {
+	/** A first start begins at the watermark: it has no history to trust. */
+	async startup() {
+		await this.init();
 		this.unsubscribe = this.eventBus.subscribe(ReactorEventTypes.JOB_WRITE_READY, async (_type, event) => this.onWriteReady(event));
 	}
 	shutdown() {
 		this.unsubscribe?.();
 		this.unsubscribe = void 0;
 	}
-	async onWriteReady(event) {
+	/** Sweeps membership changes only; other operations never hold the cursor. */
+	async sweep(settledThrough, _present, signal) {
+		signal?.throwIfAborted();
+		const rows = await this.db.selectFrom("operation_index_operations").select("ordinal").where("ordinal", ">", this.appliedThrough).where("ordinal", "<=", settledThrough).where("documentType", "=", groupDocumentType).where("scope", "=", "global").where(sql`action->>'type'`, "in", [...groupMembershipActionTypes]).orderBy("ordinal", "asc").execute();
+		return super.sweep(settledThrough, rows.map((row) => Number(row.ordinal)), signal);
+	}
+	/** Throws when any lookup or enqueue failed, so the batch is retried. */
+	async commitOperations(items) {
 		const changed = /* @__PURE__ */ new Map();
-		for (const { operation, context } of event.operations) {
-			if (context.documentType !== groupDocumentType || context.scope !== "global" || !groupMembershipActionTypes.includes(operation.action.type)) continue;
+		for (const item of items) {
+			if (!isMembershipChange(item)) continue;
+			const { operation, context } = item;
 			const existing = changed.get(context.documentId);
 			if (existing === void 0 || Date.parse(operation.timestampUtcMs) < Date.parse(existing)) changed.set(context.documentId, operation.timestampUtcMs);
 		}
 		if (changed.size === 0) return;
+		const failures = [];
 		const affected = /* @__PURE__ */ new Map();
 		for (const [groupId, timestamp] of changed) {
 			let referencers;
@@ -4612,6 +4789,7 @@ var GroupReevaluationTrigger = class {
 				referencers = await this.operationIndex.getGroupReferencers(groupId);
 			} catch (error) {
 				this.logger.error("Failed to resolve referencers of group @groupId: @error", groupId, error);
+				failures.push(error);
 				continue;
 			}
 			for (const documentId of referencers) {
@@ -4642,8 +4820,17 @@ var GroupReevaluationTrigger = class {
 				await this.queue.enqueue(job);
 			} catch (error) {
 				this.logger.error("Failed to enqueue re-evaluation of @documentId: @error", documentId, error);
+				failures.push(error);
 			}
 		}
+		if (failures.length > 0) throw new AggregateError(failures, "group re-evaluation was not enqueued for every affected document");
+	}
+	async onWriteReady(event) {
+		const changes = event.operations.filter(isMembershipChange);
+		if (changes.length === 0) return;
+		try {
+			await this.indexOperations(changes);
+		} catch {}
 	}
 };
 //#endregion
@@ -4689,7 +4876,9 @@ const SyncEventTypes = {
 	SYNC_SUCCEEDED: 20002,
 	SYNC_FAILED: 20003,
 	DEAD_LETTER_ADDED: 20004,
-	CONNECTION_STATE_CHANGED: 20005
+	CONNECTION_STATE_CHANGED: 20005,
+	SYNC_HELD: 20006,
+	SYNC_RELEASED: 20007
 };
 //#endregion
 //#region src/sync/mailbox.ts
@@ -5431,6 +5620,7 @@ function classifyJobFailure(errorName) {
 		case "ExcessiveReshuffleError": return "EXCESSIVE_SHUFFLE";
 		case "InvalidSignatureError": return "SIGNATURE_INVALID";
 		case "HashMismatchError": return "HASH_MISMATCH";
+		case "UnsupportedProtocolVersionError": return "UNSUPPORTED_PROTOCOL";
 		default: return "UNCLASSIFIED";
 	}
 }
@@ -5439,10 +5629,15 @@ function syncOperationErrorType(error) {
 	return error?.errorType ?? classifyJobFailure(error?.error?.name ?? "Error");
 }
 /** Dead-letter types that must not stop the document syncing. */
-const NON_QUARANTINING_ERROR_TYPES = /* @__PURE__ */ new Set(["AUTH_TIMESTAMP_NOT_MONOTONIC"]);
+const NON_QUARANTINING_ERROR_TYPES = /* @__PURE__ */ new Set([
+	"AUTH_TIMESTAMP_NOT_MONOTONIC",
+	"UNSUPPORTED_PROTOCOL",
+	"PEER_PROTOCOL_UNSUPPORTED"
+]);
 /**
 * A held auth operation must not quarantine: reconciling the two policies needs
-* the traffic a quarantine would stop.
+* the traffic a quarantine would stop. A protocol refusal concerns one peer,
+* and quarantine is global to the document.
 */
 function quarantinesDocument(errorType) {
 	return !NON_QUARANTINING_ERROR_TYPES.has(errorType);
@@ -5676,6 +5871,27 @@ const getLatestAppliedOrdinal = (syncOps) => {
 * the remote is known to serve them.
 */
 const DECISION_FIELDS = ["deniedReason", "errorType"];
+/** Fields peer agreement added; a remote without them is a silent peer. */
+const AGREEMENT_FIELDS = [
+	"manifest",
+	"manifestRevision",
+	"peerManifestRevision",
+	"refusals",
+	"SyncRefusalInput"
+];
+/** How often a channel whose remote went silent asks again whether it serves agreement. */
+const AGREEMENT_PROBE_INTERVAL_MS = 3e5;
+function pushMutation(withGatedUnder) {
+	return withGatedUnder ? `
+      mutation PushSyncEnvelopes($envelopes: [SyncEnvelopeInput!]!, $peerManifestRevision: String) {
+        pushSyncEnvelopes(envelopes: $envelopes, peerManifestRevision: $peerManifestRevision)
+      }
+    ` : `
+      mutation PushSyncEnvelopes($envelopes: [SyncEnvelopeInput!]!) {
+        pushSyncEnvelopes(envelopes: $envelopes)
+      }
+    `;
+}
 /**
 * GraphQL-based synchronization channel for network communication between reactors.
 */
@@ -5706,6 +5922,16 @@ var GqlRequestChannel = class {
 	receivingPages = false;
 	/** Cleared for good the first time the remote rejects {@link DECISION_FIELDS}. */
 	peerServesDecisionFields = true;
+	/** Cleared when the remote rejects {@link AGREEMENT_FIELDS}; set again by a touch that carries them. */
+	peerServesAgreement = true;
+	agreementStoppedUtcMs = 0;
+	localManifestProvider;
+	/** Undefined until the first handshake; null for a silent peer. */
+	peerManifest = void 0;
+	peerManifestCallbacks = /* @__PURE__ */ new Set();
+	manifestRefresh;
+	/** Polled rows this reactor could not run, reported on the next poll. */
+	pendingRefusals = /* @__PURE__ */ new Map();
 	isRecovering = false;
 	connectionState = "connecting";
 	/** Latest unrecoverable error was an auth rejection; cleared on connect. */
@@ -5734,7 +5960,13 @@ var GqlRequestChannel = class {
 		this.outbox = this.bufferedOutbox;
 		this.deadLetter = new Mailbox();
 		this.deadLetter.onAdded((syncOps) => {
-			for (const syncOp of syncOps) this.logger.warn("Dead letter added for document @DocumentId on channel @ChannelId", syncOp.documentId, this.channelId);
+			for (const syncOp of syncOps) {
+				this.logger.warn("Dead letter added for document @DocumentId on channel @ChannelId", syncOp.documentId, this.channelId);
+				if (syncOp.error?.source === "inbox" && syncOperationErrorType(syncOp.error) === "UNSUPPORTED_PROTOCOL") this.pendingRefusals.set(`${syncOp.documentId}:${syncOp.branch}`, {
+					documentId: syncOp.documentId,
+					branch: syncOp.branch
+				});
+			}
 		});
 		this.outbox.onAdded((syncOps) => {
 			if (this.isShutdown) return;
@@ -5750,13 +5982,13 @@ var GqlRequestChannel = class {
 			this.attemptPush(syncOps);
 		});
 		this.outbox.onRemoved((syncOps) => {
-			const maxOrdinal = getLatestAppliedOrdinal(syncOps);
-			if (maxOrdinal > this.lastPersistedOutboxOrdinal) {
-				this.lastPersistedOutboxOrdinal = maxOrdinal;
+			const ordinal = Math.min(getLatestAppliedOrdinal(syncOps), this.unappliedFloor() - 1);
+			if (ordinal > this.lastPersistedOutboxOrdinal) {
+				this.lastPersistedOutboxOrdinal = ordinal;
 				this.cursorStorage.upsert({
 					remoteName: this.remoteName,
 					cursorType: "outbox",
-					cursorOrdinal: maxOrdinal,
+					cursorOrdinal: ordinal,
 					lastSyncedAtUtcMs: Date.now()
 				}).catch((error) => {
 					this.logger.error("Failed to update outbox cursor for @ChannelId! This means that future application runs may resend duplicate operations. This is recoverable (with deduplication protection), but not-optimal: @Error", this.channelId, error);
@@ -5819,6 +6051,58 @@ var GqlRequestChannel = class {
 	notePoll() {}
 	/** No holder, so nothing this channel reports may strand one. */
 	lastHolderPollUtcMs() {}
+	setLocalManifest(provider) {
+		this.localManifestProvider = provider;
+	}
+	onPeerManifest(callback) {
+		this.peerManifestCallbacks.add(callback);
+		return () => {
+			this.peerManifestCallbacks.delete(callback);
+		};
+	}
+	async hearPeer(manifest, undelivered) {
+		if (this.peerManifest !== void 0 && (this.peerManifest?.revision ?? null) === (manifest?.revision ?? null) || isOlderManifest(manifest, this.peerManifest)) return;
+		this.peerManifest = manifest;
+		await Promise.all([...this.peerManifestCallbacks].map(async (callback) => {
+			try {
+				await callback(manifest, undelivered);
+			} catch (error) {
+				this.logger.error("Peer manifest callback error: @Error", error);
+			}
+		}));
+	}
+	/**
+	* Re-touches once when either side's manifest moved; touching is idempotent.
+	* False when the refresh failed, so polled rows must not be judged yet.
+	*/
+	async refreshManifestsIfStale(manifestRevision, peerManifestRevision) {
+		if (!this.peerServesAgreement || typeof manifestRevision !== "string") return true;
+		const local = this.localManifestProvider?.().revision ?? null;
+		if (manifestRevision === (this.peerManifest?.revision ?? null) && (peerManifestRevision ?? null) === local) return true;
+		if (this.isShutdown) return false;
+		this.manifestRefresh ??= this.touchRemoteChannel().then(({ ackOrdinal }) => {
+			if (ackOrdinal > 0) trimMailboxFromAckOrdinal(this.outbox, ackOrdinal);
+		}).finally(() => {
+			this.manifestRefresh = void 0;
+		});
+		try {
+			await this.manifestRefresh;
+			return true;
+		} catch (error) {
+			this.logger.error("GqlChannel @ChannelId manifest refresh failed: @Error", this.channelId, error);
+			return false;
+		}
+	}
+	/** Re-touches a silent remote in case it was upgraded. */
+	async probeAgreement() {
+		this.agreementStoppedUtcMs = Date.now();
+		try {
+			const { ackOrdinal } = await this.touchRemoteChannel();
+			if (ackOrdinal > 0) trimMailboxFromAckOrdinal(this.outbox, ackOrdinal);
+		} catch (error) {
+			this.logger.error("GqlChannel @ChannelId agreement probe failed: @Error", this.channelId, error);
+		}
+	}
 	/**
 	* Initializes the channel by registering it on the remote server and starting polling.
 	*/
@@ -5852,6 +6136,7 @@ var GqlRequestChannel = class {
 	*/
 	async poll() {
 		if (this.isShutdown) return;
+		if (!this.peerServesAgreement && Date.now() - this.agreementStoppedUtcMs >= AGREEMENT_PROBE_INTERVAL_MS) await this.probeAgreement();
 		let response;
 		try {
 			response = await this.pollSyncEnvelopes(this.inbox.ackOrdinal, this.inbox.latestOrdinal);
@@ -5859,8 +6144,9 @@ var GqlRequestChannel = class {
 			if (!this.handlePollError(error)) throw error;
 			return;
 		}
-		const { envelopes, ackOrdinal, deadLetters, hasMore } = response;
+		const { envelopes, ackOrdinal, deadLetters, hasMore, manifestRevision, peerManifestRevision } = response;
 		if (ackOrdinal > 0) trimMailboxFromAckOrdinal(this.outbox, ackOrdinal);
+		if (!await this.refreshManifestsIfStale(manifestRevision, peerManifestRevision)) return;
 		const allSyncOps = [];
 		for (const envelope of envelopes) if (envelope.type.toLowerCase() === "operations" && envelope.operations) {
 			const syncOps = envelopesToSyncOperations(envelope, this.remoteName);
@@ -5986,21 +6272,51 @@ var GqlRequestChannel = class {
 			outboxLatest: latestOrdinal
 		};
 		let response;
-		try {
-			response = await this.executeGraphQL(this.pollQuery(this.peerServesDecisionFields), variables);
-		} catch (error) {
-			if (!this.rejectsDecisionFields(error)) throw error;
-			this.logger.warn("Remote @channelId does not serve deniedReason/errorType; polling without them. The remote is on an older schema, so it has neither to report.", this.channelId);
-			this.peerServesDecisionFields = false;
-			response = await this.executeGraphQL(this.pollQuery(false), variables);
+		let refusals = [];
+		for (;;) {
+			const revision = this.peerServesAgreement ? this.localManifestProvider?.().revision : void 0;
+			refusals = this.peerServesAgreement ? [...this.pendingRefusals.values()] : [];
+			try {
+				response = await this.executeGraphQL(this.pollQuery(this.peerServesDecisionFields, this.peerServesAgreement), this.peerServesAgreement ? {
+					...variables,
+					manifestRevision: revision,
+					refusals
+				} : variables);
+				break;
+			} catch (error) {
+				if (this.rejectsAgreementFields(error)) {
+					await this.stopAgreement();
+					continue;
+				}
+				if (!this.rejectsDecisionFields(error)) throw error;
+				this.logger.warn("Remote @channelId does not serve deniedReason/errorType; polling without them. The remote is on an older schema, so it has neither to report.", this.channelId);
+				this.peerServesDecisionFields = false;
+			}
 		}
+		for (const refusal of refusals) this.pendingRefusals.delete(`${refusal.documentId}:${refusal.branch}`);
 		return {
 			envelopes: response.pollSyncEnvelopes.envelopes,
 			ackOrdinal: response.pollSyncEnvelopes.ackOrdinal,
 			deadLetters: response.pollSyncEnvelopes.deadLetters ?? [],
-			hasMore: response.pollSyncEnvelopes.hasMore
+			hasMore: response.pollSyncEnvelopes.hasMore,
+			manifestRevision: response.pollSyncEnvelopes.manifestRevision,
+			peerManifestRevision: response.pollSyncEnvelopes.peerManifestRevision
 		};
 	}
+	rejectsAgreementFields(error) {
+		return this.peerServesAgreement && this.isAgreementRejection(error);
+	}
+	isAgreementRejection(error) {
+		if (!(error instanceof GraphQLRequestError) || error.category !== "graphql") return false;
+		return AGREEMENT_FIELDS.some((field) => error.message.includes(field));
+	}
+	/** Resolves once what the silent peer cannot run is held. */
+	async stopAgreement(undelivered) {
+		this.logger.warn("Remote @channelId does not serve peer manifests; treating it as a silent peer.", this.channelId);
+		this.peerServesAgreement = false;
+		this.agreementStoppedUtcMs = Date.now();
+		await this.hearPeer(null, undelivered);
+	}
 	/**
 	* True when the remote rejected the query for naming a field it does not
 	* have. Selecting an unknown field fails validation for the whole query, so
@@ -6016,10 +6332,10 @@ var GqlRequestChannel = class {
 	* The poll query. `withDecisionFields` selects the two fields added with the
 	* auth projection; a remote on the previous schema is polled without them.
 	*/
-	pollQuery(withDecisionFields) {
+	pollQuery(withDecisionFields, withAgreementFields) {
 		return `
-      query PollSyncEnvelopes($channelId: String!, $outboxAck: Int!, $outboxLatest: Int!) {
-        pollSyncEnvelopes(channelId: $channelId, outboxAck: $outboxAck, outboxLatest: $outboxLatest) {
+      query PollSyncEnvelopes($channelId: String!, $outboxAck: Int!, $outboxLatest: Int!${withAgreementFields ? ", $manifestRevision: String, $refusals: [SyncRefusalInput!]" : ""}) {
+        pollSyncEnvelopes(channelId: $channelId, outboxAck: $outboxAck, outboxLatest: $outboxLatest${withAgreementFields ? ", manifestRevision: $manifestRevision, refusals: $refusals" : ""}) {
           envelopes {
             type
             channelMeta {
@@ -6083,6 +6399,7 @@ var GqlRequestChannel = class {
             operationCount
           }
           hasMore
+          ${withAgreementFields ? "manifestRevision\n          peerManifestRevision" : ""}
         }
       }
     `;
@@ -6097,27 +6414,40 @@ var GqlRequestChannel = class {
 			const result = await this.operationIndex.getLatestTimestampForCollection(this.config.collectionId.key);
 			if (result) sinceTimestampUtcMs = result;
 		} catch {}
-		const mutation = `
+		const touch = (withAgreement) => {
+			const manifest = withAgreement ? this.localManifestProvider?.() : void 0;
+			return this.executeGraphQL(`
       mutation TouchChannel($input: TouchChannelInput!) {
         touchChannel(input: $input) {
           success
           ackOrdinal
+          ${withAgreement ? "manifest" : ""}
         }
       }
-    `;
-		const variables = { input: {
-			id: this.channelId,
-			name: this.channelId,
-			collectionId: this.config.collectionId.key,
-			filter: {
-				documentId: this.config.filter.documentId,
-				scope: this.config.filter.scope,
-				branch: this.config.filter.branch
-			},
-			sinceTimestampUtcMs
-		} };
-		const data = await this.executeGraphQL(mutation, variables);
+    `, { input: {
+				id: this.channelId,
+				name: this.channelId,
+				collectionId: this.config.collectionId.key,
+				filter: {
+					documentId: this.config.filter.documentId,
+					scope: this.config.filter.scope,
+					branch: this.config.filter.branch
+				},
+				sinceTimestampUtcMs,
+				...manifest ? { manifest } : {}
+			} });
+		};
+		let data;
+		try {
+			data = await touch(true);
+			this.peerServesAgreement = true;
+		} catch (error) {
+			if (!this.isAgreementRejection(error)) throw error;
+			await this.stopAgreement();
+			data = await touch(false);
+		}
 		if (!data.touchChannel.success) throw new GraphQLRequestError("touchChannel returned success=false", "graphql");
+		await this.hearPeer(this.peerServesAgreement ? readPeerManifest(data.touchChannel.manifest) : null);
 		return { ackOrdinal: data.touchChannel.ackOrdinal };
 	}
 	/**
@@ -6214,6 +6544,24 @@ var GqlRequestChannel = class {
 	*/
 	async pushSyncOperations(syncOps) {
 		for (const syncOp of syncOps) syncOp.started();
+		const gatedUnder = this.peerServesAgreement ? this.peerManifest?.revision : void 0;
+		try {
+			await this.executeGraphQL(pushMutation(gatedUnder !== void 0), {
+				envelopes: this.envelopesFor(syncOps),
+				...gatedUnder !== void 0 ? { peerManifestRevision: gatedUnder } : {}
+			});
+			return;
+		} catch (error) {
+			if (gatedUnder === void 0 || !this.rejectsAgreementFields(error)) throw error;
+		}
+		await this.stopAgreement(syncOps);
+		const unsent = new Set(this.outbox.items);
+		const remaining = syncOps.filter((syncOp) => unsent.has(syncOp));
+		if (remaining.length === 0) return;
+		await this.executeGraphQL(pushMutation(false), { envelopes: this.envelopesFor(remaining) });
+	}
+	/** One envelope per SyncOperation, with key/dependsOn for batch ordering. */
+	envelopesFor(syncOps) {
 		const jobIdToKeys = /* @__PURE__ */ new Map();
 		const envelopes = [];
 		for (let i = 0; i < syncOps.length; i++) {
@@ -6237,13 +6585,7 @@ var GqlRequestChannel = class {
 				dependsOn
 			});
 		}
-		const mutation = `
-      mutation PushSyncEnvelopes($envelopes: [SyncEnvelopeInput!]!) {
-        pushSyncEnvelopes(envelopes: $envelopes)
-      }
-    `;
-		const variables = { envelopes: envelopes.map((e) => serializeEnvelope(e)) };
-		await this.executeGraphQL(mutation, variables);
+		return envelopes.map((e) => serializeEnvelope(e));
 	}
 	/**
 	* Gets the authorization header value using jwtHandler.
@@ -6296,6 +6638,18 @@ var GqlRequestChannel = class {
 	get poller() {
 		return this.pollTimer;
 	}
+	/** The lowest ordinal of an outbox item the remote has not applied. */
+	unappliedFloor() {
+		let floor = Number.POSITIVE_INFINITY;
+		for (const syncOp of this.outbox.items) {
+			if (syncOp.status === 2) continue;
+			for (const op of syncOp.operations) {
+				const ordinal = op.context.ordinal;
+				if (ordinal > 0 && ordinal < floor) floor = ordinal;
+			}
+		}
+		return floor;
+	}
 };
 //#endregion
 //#region src/sync/channels/gql-request-channel-factory.ts
@@ -6469,6 +6823,11 @@ var GqlResponseChannel = class {
 	lastHolderPollUtcMs() {
 		return this.lastPollUtcMs;
 	}
+	/** The client announces through touchChannel, which the sync manager serves. */
+	setLocalManifest(_provider) {}
+	onPeerManifest(_callback) {
+		return () => {};
+	}
 	async init() {
 		const cursors = await this.cursorStorage.list(this.remoteName);
 		const inboxOrdinal = cursors.find((c) => c.cursorType === "inbox")?.cursorOrdinal ?? 0;
@@ -6722,9 +7081,67 @@ var KyselySyncDeadLetterStorage = class {
 	}
 };
 //#endregion
+//#region src/storage/kysely/sync-hold-storage.ts
+var KyselySyncHoldStorage = class {
+	db;
+	constructor(db) {
+		this.db = db;
+	}
+	async list(filter = {}) {
+		let query = this.db.selectFrom("sync_holds").selectAll();
+		if (filter.remoteName !== void 0) query = query.where("remote_name", "=", filter.remoteName);
+		if (filter.documentId !== void 0) query = query.where("document_id", "=", filter.documentId);
+		return (await query.orderBy("held_at_utc_ms").execute()).map((row) => ({
+			remoteName: row.remote_name,
+			documentId: row.document_id,
+			branch: row.branch,
+			protocol: row.protocol,
+			version: row.version,
+			heldAtUtcMs: Number(row.held_at_utc_ms)
+		}));
+	}
+	async upsert(hold) {
+		const row = {
+			remote_name: hold.remoteName,
+			document_id: hold.documentId,
+			branch: hold.branch,
+			protocol: hold.protocol,
+			version: hold.version,
+			held_at_utc_ms: hold.heldAtUtcMs
+		};
+		await this.db.insertInto("sync_holds").values(row).onConflict((oc) => oc.columns([
+			"remote_name",
+			"document_id",
+			"branch"
+		]).doUpdateSet({
+			protocol: row.protocol,
+			version: row.version
+		})).execute();
+	}
+	async remove(remoteName, documentId, branch) {
+		await this.db.deleteFrom("sync_holds").where("remote_name", "=", remoteName).where("document_id", "=", documentId).where("branch", "=", branch).execute();
+	}
+	async removeRemote(remoteName) {
+		await this.db.deleteFrom("sync_holds").where("remote_name", "=", remoteName).execute();
+	}
+};
+//#endregion
 //#region src/storage/kysely/sync-remote-storage.ts
+function rowToPeer(row) {
+	if (row.peer_manifest_at_utc_ms === null) return;
+	let manifest = null;
+	if (row.peer_manifest !== null) try {
+		manifest = readPeerManifest(JSON.parse(row.peer_manifest));
+	} catch {}
+	return {
+		manifest,
+		receivedAtUtcMs: Number(row.peer_manifest_at_utc_ms)
+	};
+}
 function rowToRemoteRecord(row) {
+	const peer = rowToPeer(row);
 	return {
+		...peer ? { peer } : {},
 		id: row.channel_id,
 		name: row.name,
 		collectionId: DriveCollectionId.fromKey(row.collection_id),
@@ -6781,7 +7198,9 @@ function remoteRecordToRow(remote) {
 		pull_last_success_utc_ms: remote.status.pull.lastSuccessUtcMs ? new Date(remote.status.pull.lastSuccessUtcMs).toISOString() : null,
 		pull_last_failure_utc_ms: remote.status.pull.lastFailureUtcMs ? new Date(remote.status.pull.lastFailureUtcMs).toISOString() : null,
 		pull_failure_count: remote.status.pull.failureCount,
-		bound_address: remote.options.boundAddress ?? null
+		bound_address: remote.options.boundAddress ?? null,
+		peer_manifest: remote.peer?.manifest ? canonicalJson(remote.peer.manifest, "peer manifest") : null,
+		peer_manifest_at_utc_ms: remote.peer?.receivedAtUtcMs ?? null
 	};
 }
 var KyselySyncRemoteStorage = class {
@@ -6823,22 +7242,31 @@ var KyselySyncRemoteStorage = class {
 };
 //#endregion
 //#region src/sync/batch-aggregator.ts
+/** Queued between write-ready events when the settled watermark advances. */
+const SETTLED = Symbol("settled");
 var BatchAggregator = class {
 	logger;
 	driveContainerTypes;
 	onBatchReady;
+	onSettled;
 	queue = [];
 	processing = false;
 	pendingBatches = /* @__PURE__ */ new Map();
-	constructor(logger, driveContainerTypes, onBatchReady) {
+	constructor(logger, driveContainerTypes, onBatchReady, onSettled) {
 		this.logger = logger;
 		this.driveContainerTypes = driveContainerTypes;
 		this.onBatchReady = onBatchReady;
+		this.onSettled = onSettled;
 	}
 	async enqueueWriteReady(event) {
 		this.queue.push(event);
 		await this.processQueue();
 	}
+	/** Runs onSettled on the serial queue; one queued run covers many. */
+	async enqueueSettled() {
+		if (!this.queue.includes(SETTLED)) this.queue.push(SETTLED);
+		await this.processQueue();
+	}
 	async handleJobFailed(event) {
 		const batchId = event.job?.meta.batchId;
 		if (!batchId) return;
@@ -6856,12 +7284,20 @@ var BatchAggregator = class {
 		this.processing = true;
 		try {
 			while (this.queue.length > 0) {
-				const event = this.queue.shift();
+				const item = this.queue.shift();
+				if (item === SETTLED) {
+					try {
+						await this.onSettled();
+					} catch (error) {
+						this.logger.error("Failed to derive settled outboxes (@error)", error instanceof Error ? error.message : String(error));
+					}
+					continue;
+				}
 				try {
-					await this.handleWriteReady(event);
+					await this.handleWriteReady(item);
 				} catch (error) {
 					const err = error instanceof Error ? error : new Error(String(error));
-					this.logger.error("Failed to process write-ready event (@jobId, @error)", event.jobId, err.message);
+					this.logger.error("Failed to process write-ready event (@jobId, @error)", item.jobId, err.message);
 				}
 			}
 		} finally {
@@ -6929,6 +7365,59 @@ var BatchAggregator = class {
 	}
 };
 //#endregion
+//#region src/sync/memory-hold-storage.ts
+const keyOf = (remoteName, documentId, branch) => `${remoteName}\u0000${documentId}\u0000${branch}`;
+/** For a sync manager built without a database. */
+var InMemorySyncHoldStorage = class {
+	holds = /* @__PURE__ */ new Map();
+	list(filter = {}) {
+		return Promise.resolve([...this.holds.values()].filter((hold) => (filter.remoteName === void 0 || hold.remoteName === filter.remoteName) && (filter.documentId === void 0 || hold.documentId === filter.documentId)));
+	}
+	upsert(hold) {
+		const key = keyOf(hold.remoteName, hold.documentId, hold.branch);
+		const known = this.holds.get(key);
+		this.holds.set(key, {
+			...hold,
+			heldAtUtcMs: known?.heldAtUtcMs ?? hold.heldAtUtcMs
+		});
+		return Promise.resolve();
+	}
+	remove(remoteName, documentId, branch) {
+		this.holds.delete(keyOf(remoteName, documentId, branch));
+		return Promise.resolve();
+	}
+	removeRemote(remoteName) {
+		for (const [key, hold] of this.holds) if (hold.remoteName === remoteName) this.holds.delete(key);
+		return Promise.resolve();
+	}
+};
+//#endregion
+//#region src/sync/peer-agreement.ts
+/** Pure over the remote records it is given, live or not. */
+function createPeerAgreement(basis, remotes) {
+	const supportsOf = (remote) => remote.peer?.manifest ?? basis.legacy;
+	const members = (collectionIds) => {
+		const wanted = new Set(collectionIds);
+		const found = /* @__PURE__ */ new Map();
+		for (const remote of remotes) if (wanted.has(remote.collectionId.key)) found.set(remote.name, supportsOf(remote));
+		return found;
+	};
+	return {
+		local: () => basis.local,
+		basis: () => basis,
+		peer: (remoteName) => {
+			const remote = remotes.find((candidate) => candidate.name === remoteName);
+			return remote ? supportsOf(remote) : basis.legacy;
+		},
+		members,
+		limitedBy: (collectionId, protocol) => {
+			const version = basis.wanted[protocol];
+			if (version === void 0) return [];
+			return [...members([collectionId])].filter(([, supports]) => !supports.protocols[protocol]?.includes(version)).map(([name]) => name);
+		}
+	};
+}
+//#endregion
 //#region src/sync/sync-awaiter.ts
 /**
 * Provides a promise-based interface for waiting on sync completion.
@@ -7160,6 +7649,12 @@ function isCredentialOrNetworkError(error) {
 	if (isDriveAuthError(error)) return true;
 	return error instanceof GraphQLRequestError && error.category === "network";
 }
+const holdKey = (documentId, branch) => `${documentId}\u0000${branch}`;
+const VERSION_CACHE_CAP = 1e4;
+/** The versions a CREATE_DOCUMENT among `operations` fixes for the document. */
+function createdVersions(operations, documentId) {
+	for (const { operation, context } of operations) if (context.documentId === documentId && operation.action.type === "CREATE_DOCUMENT") return operation.action.input.protocolVersions ?? {};
+}
 /** Where a sync operation's run of ordinals begins. */
 function firstOrdinalOf(syncOp) {
 	return syncOp.operations.length > 0 ? syncOp.operations[0].context.ordinal : 0;
@@ -7194,8 +7689,39 @@ var SyncManager = class {
 	pruneDrainDeferred = false;
 	removing = /* @__PURE__ */ new Set();
 	lastEnqueuedJobIdByKey = /* @__PURE__ */ new Map();
+	watermark;
+	owed = /* @__PURE__ */ new Map();
+	settledUnsubscribe;
 	inboxChunkChain = Promise.resolve();
-	constructor(logger, remoteStorage, cursorStorage, deadLetterStorage, channelFactory, operationIndex, reactor, eventBus, driveContainerTypes, config = {}) {
+	capabilities;
+	manifest;
+	localSupport;
+	legacy;
+	wanted = {};
+	holds;
+	heldKeys = /* @__PURE__ */ new Map();
+	records = /* @__PURE__ */ new Map();
+	versionCache = /* @__PURE__ */ new Map();
+	protocolVersionsOf;
+	peerUpdates = /* @__PURE__ */ new Map();
+	peerUnsubscribes = /* @__PURE__ */ new Map();
+	constructor(logger, remoteStorage, cursorStorage, deadLetterStorage, channelFactory, operationIndex, reactor, eventBus, driveContainerTypes, watermark, config = {}, localPeer = {
+		capabilities: PEER_CAPABILITIES,
+		flags: {}
+	}, holds = new InMemorySyncHoldStorage()) {
+		this.watermark = watermark;
+		this.capabilities = localPeer.capabilities;
+		this.manifest = localPeerManifest(localPeer.capabilities, localPeer.flags, localPeer.appKey, localPeer.sequence ?? Date.now());
+		this.localSupport = localSupports(localPeer.capabilities, localPeer.flags);
+		this.legacy = legacySupports(localPeer.capabilities);
+		for (const capability of localPeer.capabilities) {
+			if (capability.kind !== "protocol") continue;
+			const supported = capability.supported(localPeer.flags);
+			const wanted = capability.preferred?.(localPeer.flags) ?? (supported.length > 0 ? Math.max(...supported) : void 0);
+			if (wanted !== void 0) this.wanted[capability.name] = wanted;
+		}
+		this.holds = holds;
+		this.protocolVersionsOf = localPeer.protocolVersionsOf ?? ((documentId, branch) => this.indexedVersions(documentId, branch));
 		this.logger = logger;
 		this.remoteStorage = remoteStorage;
 		this.cursorStorage = cursorStorage;
@@ -7212,7 +7738,7 @@ var SyncManager = class {
 		this.awaiter = new JobAwaiter(eventBus, (jobId, signal) => reactor.getJobStatus(jobId, signal));
 		this.syncAwaiter = new SyncAwaiter(eventBus);
 		this.isShutdown = false;
-		this.batchAggregator = new BatchAggregator(logger, driveContainerTypes, (batch) => this.processCompleteBatch(batch));
+		this.batchAggregator = new BatchAggregator(logger, driveContainerTypes, (batch) => this.processCompleteBatch(batch), () => this.deriveSettled());
 		this.syncStatusTracker = new SyncStatusTracker();
 	}
 	async startup() {
@@ -7223,7 +7749,13 @@ var SyncManager = class {
 		} catch (error) {
 			this.logger.error("Failed to load quarantined document IDs (@error)", error instanceof Error ? error.message : String(error));
 		}
+		try {
+			for (const hold of await this.holds.list()) this.heldFor(hold.remoteName).set(holdKey(hold.documentId, hold.branch), hold);
+		} catch (error) {
+			this.logger.error("Failed to load sync holds (@error)", error instanceof Error ? error.message : String(error));
+		}
 		const remoteRecords = await this.remoteStorage.list();
+		const head = await this.watermarkHead();
 		for (const record of remoteRecords) {
 			const channel = this.channelFactory.instance(record.id, record.name, record.channelConfig, this.cursorStorage, record.collectionId, record.filter, this.operationIndex, record.options);
 			const remote = {
@@ -7233,11 +7765,14 @@ var SyncManager = class {
 					collectionId: record.collectionId,
 					channelConfig: record.channelConfig,
 					filter: record.filter,
-					options: record.options
+					options: record.options,
+					peer: record.peer
 				},
 				channel
 			};
 			this.remotes.set(record.name, remote);
+			this.owe(record.name, head);
+			this.records.set(record.name, remote.meta);
 			await this.loadDeadLetters(remote);
 			this.wireChannelCallbacks(remote);
 			try {
@@ -7247,6 +7782,7 @@ var SyncManager = class {
 				await this.dropRemoteAfterFailedInit(remote, false);
 				continue;
 			}
+			await this.peerUpdates.get(record.name);
 			const outboxAckOrdinal = remote.channel.outbox.ackOrdinal;
 			if (outboxAckOrdinal > 0) {
 				const backfillController = new AbortController();
@@ -7260,6 +7796,7 @@ var SyncManager = class {
 				});
 			}
 		}
+		this.settledUnsubscribe = this.watermark.onAdvance(() => void this.batchAggregator.enqueueSettled());
 		this.eventUnsubscribe = this.eventBus.subscribe(ReactorEventTypes.JOB_WRITE_READY, async (_type, event) => this.batchAggregator.enqueueWriteReady(event));
 		this.failedEventUnsubscribe = this.eventBus.subscribe(ReactorEventTypes.JOB_FAILED, async (_type, event) => this.batchAggregator.handleJobFailed(event));
 	}
@@ -7273,6 +7810,9 @@ var SyncManager = class {
 		this.prunePending.clear();
 		this.pruneDrainDeferred = false;
 		this.batchAggregator.clear();
+		this.owed.clear();
+		this.settledUnsubscribe?.();
+		this.settledUnsubscribe = void 0;
 		if (this.eventUnsubscribe) {
 			this.eventUnsubscribe();
 			this.eventUnsubscribe = void 0;
@@ -7286,6 +7826,9 @@ var SyncManager = class {
 		this.syncStatusTracker.clear();
 		for (const unsub of this.connectionStateUnsubscribes.values()) unsub();
 		this.connectionStateUnsubscribes.clear();
+		for (const unsub of this.peerUnsubscribes.values()) unsub();
+		this.peerUnsubscribes.clear();
+		this.peerUpdates.clear();
 		const promises = [];
 		for (const remote of this.remotes.values()) promises.push(remote.channel.shutdown());
 		this.remotes.clear();
@@ -7312,54 +7855,316 @@ var SyncManager = class {
 			...remote.meta.options,
 			boundAddress
 		};
-		await this.remoteStorage.upsert({
-			id: remote.meta.id,
-			name: remote.meta.name,
-			collectionId: remote.meta.collectionId,
-			channelConfig: remote.meta.channelConfig,
-			filter: remote.meta.filter,
-			options: remote.meta.options,
+		await this.remoteStorage.upsert(this.recordOf(remote.meta));
+	}
+	localManifest() {
+		return this.manifest;
+	}
+	async setPeerManifest(id, manifest) {
+		await this.queuePeerManifest(this.getById(id), manifest);
+	}
+	/** Applied in arrival order per remote; the handshake awaits the tail. */
+	queuePeerManifest(remote, manifest, undelivered) {
+		const name = remote.meta.name;
+		const next = (this.peerUpdates.get(name) ?? Promise.resolve()).then(() => this.applyPeerManifest(remote, manifest, undelivered));
+		const settled = next.catch((error) => {
+			this.logger.error("Failed to record the peer manifest of @name: @error", name, error instanceof Error ? error.message : String(error));
+		});
+		this.peerUpdates.set(name, settled);
+		return next;
+	}
+	async applyPeerManifest(remote, manifest, undelivered) {
+		const name = remote.meta.name;
+		if (this.remotes.get(name) !== remote || this.removing.has(name)) return;
+		const known = remote.meta.peer;
+		if (isOlderManifest(manifest, known?.manifest)) return;
+		if (known !== void 0 && (known.manifest?.revision ?? null) === (manifest?.revision ?? null)) {
+			if (this.heldKeys.get(name)?.size) await this.releaseSupported(remote);
+			return;
+		}
+		remote.meta.peer = {
+			manifest,
+			receivedAtUtcMs: Date.now()
+		};
+		await this.remoteStorage.upsert(this.recordOf(remote.meta));
+		await this.holdUnsupported(remote, undelivered);
+		await this.releaseSupported(remote);
+	}
+	async listHolds(filter = {}) {
+		return (await this.holds.list(filter)).map((record) => ({
+			remoteName: record.remoteName,
+			documentId: record.documentId,
+			branch: record.branch,
+			reason: {
+				protocol: record.protocol,
+				version: record.version,
+				peerSupports: this.agreement().peer(record.remoteName).protocols[record.protocol] ?? []
+			},
+			heldAtUtcMs: record.heldAtUtcMs
+		}));
+	}
+	agreement() {
+		return createPeerAgreement({
+			local: this.manifest,
+			legacy: this.legacy,
+			wanted: this.wanted
+		}, [...this.records.values()]);
+	}
+	heldFor(remoteName) {
+		let held = this.heldKeys.get(remoteName);
+		if (!held) {
+			held = /* @__PURE__ */ new Map();
+			this.heldKeys.set(remoteName, held);
+		}
+		return held;
+	}
+	async forgetRemote(name) {
+		this.records.delete(name);
+		this.heldKeys.delete(name);
+		await this.holds.removeRemote(name);
+	}
+	peerSupportsOf(remote) {
+		return peerSupports(remote.meta.peer?.manifest ?? null, this.capabilities);
+	}
+	/** Cached once found: a document's versions never change. */
+	async versionsOf(documentId, branch) {
+		const key = holdKey(documentId, branch);
+		const cached = this.versionCache.get(key);
+		if (cached) return cached;
+		let versions;
+		try {
+			versions = await this.protocolVersionsOf(documentId, branch);
+		} catch {
+			versions = void 0;
+		}
+		if (versions) {
+			if (this.versionCache.size >= VERSION_CACHE_CAP) {
+				const oldest = this.versionCache.keys().next().value;
+				if (oldest !== void 0) this.versionCache.delete(oldest);
+			}
+			this.versionCache.set(key, versions);
+		}
+		return versions;
+	}
+	/** The fallback without a meta cache: the document's indexed creation. */
+	async indexedVersions(documentId, branch) {
+		return createdVersions((await this.operationIndex.get(documentId, {
+			branch,
+			scopes: ["document"]
+		}, {
+			cursor: "0",
+			limit: 10
+		})).results.map((entry) => toOperationWithContext(entry)), documentId);
+	}
+	async hold(remote, documentId, branch, reason) {
+		const held = this.heldFor(remote.meta.name);
+		const key = holdKey(documentId, branch);
+		if (held.has(key)) return;
+		const record = {
+			remoteName: remote.meta.name,
+			documentId,
+			branch,
+			protocol: reason.protocol,
+			version: reason.version,
+			heldAtUtcMs: Date.now()
+		};
+		held.set(key, record);
+		try {
+			await this.holds.upsert(record);
+		} catch (error) {
+			this.logger.error("Failed to persist a sync hold (@remote, @documentId): @error", remote.meta.name, documentId, error instanceof Error ? error.message : String(error));
+		}
+		this.eventBus.emit(SyncEventTypes.SYNC_HELD, {
+			remoteName: remote.meta.name,
+			documentId,
+			branch,
+			reason
+		}).catch(() => {});
+	}
+	/** Narrowed: unsent outbox items for documents the peer cannot run. */
+	async holdUnsupported(remote, undelivered = []) {
+		const support = this.peerSupportsOf(remote);
+		if (coversLocal(support, this.localSupport, this.capabilities)) return;
+		const verdicts = /* @__PURE__ */ new Map();
+		const held = [];
+		const unsent = new Set(undelivered);
+		for (const item of remote.channel.outbox.items) {
+			if ((item.status !== -1 || item.emittedCount > 0) && !unsent.has(item)) continue;
+			const key = holdKey(item.documentId, item.branch);
+			let reason = verdicts.get(key);
+			if (reason === void 0) {
+				const versions = createdVersions(item.operations, item.documentId) ?? await this.versionsOf(item.documentId, item.branch);
+				reason = (versions && holdReason(support, versions, this.capabilities)) ?? null;
+				verdicts.set(key, reason);
+			}
+			if (reason) {
+				held.push(item);
+				await this.hold(remote, item.documentId, item.branch, reason);
+			}
+		}
+		if (held.length > 0) remote.channel.outbox.remove(...held);
+	}
+	/** Widened: held documents the peer can now run go out whole. */
+	async releaseSupported(remote) {
+		const held = this.heldKeys.get(remote.meta.name);
+		if (!held?.size) return;
+		const support = this.peerSupportsOf(remote);
+		for (const [key, record] of [...held]) {
+			const versions = await this.versionsOf(record.documentId, record.branch);
+			if (versions && holdReason(support, versions, this.capabilities)) continue;
+			held.delete(key);
+			await this.backfillDocument(remote, record.documentId, record.branch);
+			await this.holds.remove(record.remoteName, record.documentId, record.branch);
+			this.eventBus.emit(SyncEventTypes.SYNC_RELEASED, {
+				remoteName: record.remoteName,
+				documentId: record.documentId,
+				branch: record.branch
+			}).catch(() => {});
+		}
+	}
+	/**
+	* Queues a released document's whole history. The peer never received it
+	* from this remote, so sinceTimestampUtcMs does not apply; the receiver
+	* dedups by action id.
+	*/
+	async backfillDocument(remote, documentId, branch) {
+		const entries = [];
+		let page = await this.operationIndex.get(documentId, { branch }, void 0, this.abortController.signal);
+		for (;;) {
+			entries.push(...page.results);
+			if (!page.next) break;
+			page = await page.next();
+		}
+		let operations = entries.filter((entry) => entry.sourceRemote !== remote.meta.name).map((entry) => toOperationWithContext(entry));
+		operations = filterOperations(operations, remote.meta.filter);
+		if (operations.length === 0) return;
+		operations.sort((a, b) => {
+			if (a.context.scope !== b.context.scope) {
+				if (a.context.scope === "document") return -1;
+				if (b.context.scope === "document") return 1;
+				return a.context.scope < b.context.scope ? -1 : 1;
+			}
+			return a.context.ordinal - b.context.ordinal;
+		});
+		this.emitBatches(remote, operations, "backfill", { lastJobByDoc: /* @__PURE__ */ new Map() });
+	}
+	/** A peer that announced support refused the document: hold it from that peer. */
+	async holdRefused(remote, syncOp) {
+		const versions = await this.versionsOf(syncOp.documentId, syncOp.branch) ?? {};
+		const support = this.peerSupportsOf(remote);
+		const protocols = this.capabilities.filter((capability) => capability.kind === "protocol" && versions[capability.name] !== void 0);
+		const protocol = (protocols.find((candidate) => !candidate.baseline.includes(versions[candidate.name])) ?? protocols.at(0))?.name ?? "unknown";
+		await this.hold(remote, syncOp.documentId, syncOp.branch, {
+			protocol,
+			version: versions[protocol] ?? 0,
+			peerSupports: support.protocols[protocol] ?? []
+		});
+	}
+	/**
+	* Refuses, before load, what this reactor cannot run and what the sending
+	* peer does not announce. Neither quarantines the document.
+	*/
+	async refuseOnReceipt(remote, syncOps) {
+		await this.peerUpdates.get(remote.meta.name);
+		const peer = this.peerSupportsOf(remote);
+		const refused = /* @__PURE__ */ new Set();
+		for (const syncOp of syncOps) {
+			const versions = createdVersions(syncOp.operations, syncOp.documentId) ?? await this.versionsOf(syncOp.documentId, syncOp.branch);
+			if (versions && this.refuse(remote, syncOp, versions, peer)) refused.add(syncOp);
+		}
+		return refused;
+	}
+	/** Dead-letters a refused sync operation. */
+	refuse(remote, syncOp, versions, peer) {
+		let errorType;
+		let reason = holdReason(this.localSupport, versions, this.capabilities);
+		if (reason) errorType = "UNSUPPORTED_PROTOCOL";
+		else {
+			reason = holdReason(peer, versions, this.capabilities);
+			if (!reason) return false;
+			errorType = "PEER_PROTOCOL_UNSUPPORTED";
+		}
+		const message = errorType === "UNSUPPORTED_PROTOCOL" ? `Document ${syncOp.documentId} requires ${reason.protocol} ${reason.version}, which this reactor does not support` : `Remote ${remote.meta.name} wrote into document ${syncOp.documentId} at ${reason.protocol} ${reason.version}, which its peer does not announce`;
+		syncOp.failed(new ChannelError("inbox", new Error(message), errorType));
+		remote.channel.deadLetter.add(syncOp);
+		remote.channel.inbox.remove(syncOp);
+		return true;
+	}
+	/** Whether anything could be held from this remote; synchronous when not. */
+	gates(remote) {
+		return (this.heldKeys.get(remote.meta.name)?.size ?? 0) > 0 || !coversLocal(this.peerSupportsOf(remote), this.localSupport, this.capabilities);
+	}
+	/** Drops rows of documents the remote's peer cannot run, recording holds. */
+	async gateOutbound(remote, operations) {
+		if (operations.length === 0) return operations;
+		const held = this.heldKeys.get(remote.meta.name);
+		const support = this.peerSupportsOf(remote);
+		const verdicts = /* @__PURE__ */ new Map();
+		const kept = [];
+		for (const entry of operations) {
+			const { documentId, branch } = entry.context;
+			const key = holdKey(documentId, branch);
+			let isHeld = verdicts.get(key);
+			if (isHeld === void 0) {
+				isHeld = held?.has(key) ?? false;
+				if (!isHeld) {
+					const versions = createdVersions(operations, documentId) ?? await this.versionsOf(documentId, branch);
+					const reason = versions && holdReason(support, versions, this.capabilities);
+					if (reason) {
+						await this.hold(remote, documentId, branch, reason);
+						isHeld = true;
+					}
+				}
+				verdicts.set(key, isHeld);
+			}
+			if (!isHeld) kept.push(entry);
+		}
+		return kept;
+	}
+	recordOf(meta) {
+		return {
+			id: meta.id,
+			name: meta.name,
+			collectionId: meta.collectionId,
+			channelConfig: meta.channelConfig,
+			filter: meta.filter,
+			options: meta.options,
 			status: {
 				push: createIdleHealth(),
 				pull: createIdleHealth()
-			}
-		});
+			},
+			peer: meta.peer
+		};
 	}
 	async add(name, collectionId, channelConfig, filter = {
 		documentId: [],
 		scope: [],
 		branch: ""
-	}, options = { sinceTimestampUtcMs: "0" }, id) {
+	}, options = { sinceTimestampUtcMs: "0" }, id, peer) {
 		if (this.isShutdown) throw new Error("SyncManager is shutdown and cannot add remotes");
 		if (this.remotes.has(name)) throw new Error(`Remote with name '${name}' already exists`);
 		this.logger.debug("Adding remote (@name, @collectionId, @channelConfig, @filter, @options, @id)", name, collectionId.key, channelConfig, filter, options, id);
 		const remoteId = id ?? crypto.randomUUID();
-		const remoteRecord = {
+		const meta = {
 			id: remoteId,
 			name,
 			collectionId,
 			channelConfig,
 			filter,
 			options,
-			status: {
-				push: createIdleHealth(),
-				pull: createIdleHealth()
+			peer: peer === void 0 ? void 0 : {
+				manifest: peer,
+				receivedAtUtcMs: Date.now()
 			}
 		};
-		await this.remoteStorage.upsert(remoteRecord);
+		await this.remoteStorage.upsert(this.recordOf(meta));
 		const channel = this.channelFactory.instance(remoteId, name, channelConfig, this.cursorStorage, collectionId, filter, this.operationIndex, options);
 		const remote = {
-			meta: {
-				id: remoteId,
-				name,
-				collectionId,
-				channelConfig,
-				filter,
-				options
-			},
+			meta,
 			channel
 		};
 		this.remotes.set(name, remote);
+		this.records.set(name, meta);
 		await this.loadDeadLetters(remote);
 		this.wireChannelCallbacks(remote);
 		try {
@@ -7368,6 +8173,8 @@ var SyncManager = class {
 			await this.dropRemoteAfterFailedInit(remote, !isCredentialOrNetworkError(error));
 			throw error;
 		}
+		await this.peerUpdates.get(name);
+		this.owe(name, await this.watermarkHead());
 		const backfillController = new AbortController();
 		this.backfillAbortControllers.set(name, backfillController);
 		this.updateOutbox(remote, 0, "backfill", backfillController.signal).catch((error) => {
@@ -7388,10 +8195,12 @@ var SyncManager = class {
 		const remote = this.remotes.get(name);
 		if (!remote) throw new Error(`Remote with name '${name}' does not exist`);
 		this.removing.add(name);
+		this.owed.delete(name);
 		try {
 			await this.teardownRemoteResources(remote);
 			await this.remoteStorage.remove(name);
 			await this.cursorStorage.remove(name);
+			await this.forgetRemote(name);
 		} finally {
 			this.remotes.delete(name);
 			this.removing.delete(name);
@@ -7409,7 +8218,10 @@ var SyncManager = class {
 		this.removing.add(name);
 		try {
 			await this.teardownRemoteResources(remote);
-			if (removeStorageRecord) await this.remoteStorage.remove(name);
+			if (removeStorageRecord) {
+				await this.remoteStorage.remove(name);
+				await this.forgetRemote(name);
+			}
 		} catch (error) {
 			this.logger.error("Error tearing down remote after failed init (@name, @error)", name, error instanceof Error ? error.message : String(error));
 		} finally {
@@ -7442,6 +8254,9 @@ var SyncManager = class {
 			}
 			this.evictedOutboxFloors.delete(name);
 			this.prunePending.delete(name);
+			this.peerUnsubscribes.get(name)?.();
+			this.peerUnsubscribes.delete(name);
+			this.peerUpdates.delete(name);
 		}
 	}
 	list() {
@@ -7465,6 +8280,9 @@ var SyncManager = class {
 	}
 	wireChannelCallbacks(remote) {
 		remote.channel.inbox.onAdded((syncOps) => this.handleInboxAdded(remote, syncOps));
+		remote.channel.setLocalManifest?.(() => this.manifest);
+		const unsubscribePeer = remote.channel.onPeerManifest?.((manifest, undelivered) => this.queuePeerManifest(remote, manifest, undelivered).catch(() => {}));
+		if (unsubscribePeer) this.peerUnsubscribes.set(remote.meta.name, unsubscribePeer);
 		this.syncStatusTracker.trackRemote(remote.meta.name, remote.channel);
 		const unsubscribe = remote.channel.onConnectionStateChange((snapshot) => {
 			this.eventBus.emit(SyncEventTypes.CONNECTION_STATE_CHANGED, {
@@ -7476,7 +8294,13 @@ var SyncManager = class {
 			}).catch(() => {});
 		});
 		this.connectionStateUnsubscribes.set(remote.meta.name, unsubscribe);
-		remote.channel.deadLetter.onAdded((syncOps) => {
+		remote.channel.deadLetter.onAdded((added) => {
+			const refusals = added.filter((syncOp) => syncOp.error?.source === "outbox" && syncOperationErrorType(syncOp.error) === "UNSUPPORTED_PROTOCOL");
+			if (refusals.length > 0) {
+				remote.channel.deadLetter.remove(...refusals);
+				for (const syncOp of refusals) this.holdRefused(remote, syncOp).catch(() => {});
+			}
+			const syncOps = added.filter((syncOp) => !refusals.includes(syncOp));
 			for (const syncOp of syncOps) {
 				this.logger.error("Dead letter (@remote, @documentId, @jobId, @error, @dependencies)", remote.meta.name, syncOp.documentId, syncOp.jobId, syncOp.error?.message ?? "unknown", syncOp.jobDependencies);
 				const errorType = syncOperationErrorType(syncOp.error);
@@ -7548,12 +8372,43 @@ var SyncManager = class {
 			for (const remote of remotes) if (!affectedRemotes.includes(remote)) affectedRemotes.push(remote);
 		}
 		for (const remote of affectedRemotes) trimMailboxFromBatch(remote.channel.inbox, batch);
+		const through = await this.watermark.refresh();
+		let batchMax = 0;
+		for (const { event } of batch.entries) for (const op of event.operations) batchMax = Math.max(batchMax, op.context.ordinal);
 		for (const remote of affectedRemotes) {
 			if (!this.remotes.has(remote.meta.name) || this.removing.has(remote.meta.name)) continue;
 			await this.updateOutbox(remote, remote.channel.outbox.latestOrdinal, "batch-triggered");
+			if (batchMax > through) this.owe(remote.meta.name, batchMax);
 		}
 		await this.drainPrunes();
 	}
+	/** Derives every owed remote up to the watermark. */
+	async deriveSettled() {
+		if (this.isShutdown) return;
+		const through = this.watermark.settledThrough;
+		for (const [name, upTo] of [...this.owed]) {
+			const remote = this.remotes.get(name);
+			if (!remote || this.removing.has(name)) {
+				this.owed.delete(name);
+				continue;
+			}
+			await this.updateOutbox(remote, remote.channel.outbox.latestOrdinal, "batch-triggered");
+			if (through >= upTo) this.owed.delete(name);
+		}
+		await this.drainPrunes();
+	}
+	owe(name, upTo) {
+		this.owed.set(name, Math.max(this.owed.get(name) ?? 0, upTo));
+	}
+	/** The sequence head after a fresh probe; a remote is owed through it. */
+	async watermarkHead() {
+		try {
+			await this.watermark.refresh();
+		} catch (error) {
+			this.logger.warn("Settled watermark probe failed; owed remotes wait for the next one: @error", error);
+		}
+		return this.watermark.status().head;
+	}
 	handleInboxAdded(remote, syncOps) {
 		if (this.isShutdown) return;
 		const eligible = syncOps.filter((op) => !this.quarantinedDocumentIds.has(op.documentId));
@@ -7584,6 +8439,7 @@ var SyncManager = class {
 		return next;
 	}
 	async applyInboxJob(remote, syncOp) {
+		if ((await this.refuseOnReceipt(remote, [syncOp])).size > 0) return;
 		const operations = syncOp.operations.map((op) => op.operation);
 		let jobInfo;
 		try {
@@ -7620,7 +8476,14 @@ var SyncManager = class {
 		} else syncOp.executed();
 		remote.channel.inbox.remove(syncOp);
 	}
-	async applyInboxBatch(items) {
+	async applyInboxBatch(received) {
+		const refused = /* @__PURE__ */ new Set();
+		for (const { remote, syncOp } of received) {
+			const refusals = await this.refuseOnReceipt(remote, [syncOp]);
+			for (const refusal of refusals) refused.add(refusal);
+		}
+		const items = received.filter(({ syncOp }) => !refused.has(syncOp));
+		if (items.length === 0) return;
 		const sourceRemote = items[0].remote.meta.name;
 		const chunkKeys = new Set(items.map(({ syncOp }) => syncOp.jobId));
 		const jobs = items.map(({ syncOp }) => {
@@ -7841,32 +8704,35 @@ var SyncManager = class {
 			}
 		}
 	}
+	emitBatches(remote, operations, mode, chain) {
+		if (operations.length === 0) return;
+		const batches = batchOperationsByDocument(operations);
+		const syncOps = [];
+		for (const batch of batches) {
+			const jobId = crypto.randomUUID();
+			const prevJobId = chain.lastJobByDoc.get(batch.documentId);
+			const deps = [];
+			if (prevJobId) deps.push(prevJobId);
+			if (mode === "batch-triggered" && chain.prevChainJobId && chain.prevChainJobId !== prevJobId) deps.push(chain.prevChainJobId);
+			const syncOp = new SyncOperation(crypto.randomUUID(), jobId, deps, remote.meta.name, batch.documentId, [batch.scope], batch.branch, batch.operations);
+			syncOps.push(syncOp);
+			chain.lastJobByDoc.set(batch.documentId, jobId);
+			if (mode === "batch-triggered") chain.prevChainJobId = jobId;
+		}
+		remote.channel.outbox.add(...syncOps);
+		this.evictPastOutboxBound(remote);
+	}
 	async deriveOutbox(remote, ackOrdinal, mode, signal) {
 		const composedSignal = signal ? AbortSignal.any([signal, this.abortController.signal]) : this.abortController.signal;
 		const startOrdinal = this.refillOrdinal(remote, ackOrdinal);
 		let maxOrdinal = startOrdinal;
-		const lastJobByDoc = /* @__PURE__ */ new Map();
-		let prevChainJobId;
+		const chain = { lastJobByDoc: /* @__PURE__ */ new Map() };
 		const sinceTimestamp = remote.meta.options.sinceTimestampUtcMs;
-		const emitBatches = (operations) => {
-			if (operations.length === 0) return;
-			const batches = batchOperationsByDocument(operations);
-			const syncOps = [];
-			for (const batch of batches) {
-				const jobId = crypto.randomUUID();
-				const prevJobId = lastJobByDoc.get(batch.documentId);
-				const deps = [];
-				if (prevJobId) deps.push(prevJobId);
-				if (mode === "batch-triggered" && prevChainJobId && prevChainJobId !== prevJobId) deps.push(prevChainJobId);
-				const syncOp = new SyncOperation(crypto.randomUUID(), jobId, deps, remote.meta.name, batch.documentId, [batch.scope], batch.branch, batch.operations);
-				syncOps.push(syncOp);
-				lastJobByDoc.set(batch.documentId, jobId);
-				if (mode === "batch-triggered") prevChainJobId = jobId;
-			}
-			remote.channel.outbox.add(...syncOps);
-			this.evictPastOutboxBound(remote);
-		};
-		let page = await this.operationIndex.find(remote.meta.collectionId.key, startOrdinal, { excludeSourceRemote: remote.meta.name }, void 0, composedSignal);
+		const emitBatches = (operations) => this.emitBatches(remote, operations, mode, chain);
+		let page = await this.operationIndex.find(remote.meta.collectionId.key, startOrdinal, {
+			excludeSourceRemote: remote.meta.name,
+			throughOrdinal: this.watermark.settledThrough
+		}, void 0, composedSignal);
 		let carry = [];
 		let hasMore;
 		do {
@@ -7880,6 +8746,7 @@ var SyncManager = class {
 			if (sinceTimestamp && sinceTimestamp !== "0") operations = operations.filter((op) => op.operation.timestampUtcMs >= sinceTimestamp);
 			operations = filterOperations(operations, remote.meta.filter);
 			operations = operations.filter((op) => !this.quarantinedDocumentIds.has(op.context.documentId));
+			if (this.gates(remote)) operations = await this.gateOutbound(remote, operations);
 			hasMore = !!page.next;
 			if (operations.length > 0) {
 				const created = /* @__PURE__ */ new Set();
@@ -7914,6 +8781,7 @@ var SyncBuilder = class {
 	remoteStorage;
 	cursorStorage;
 	deadLetterStorage;
+	holdStorage;
 	config = {};
 	withChannelFactory(factory) {
 		this.channelFactory = factory;
@@ -7931,6 +8799,10 @@ var SyncBuilder = class {
 		this.deadLetterStorage = storage;
 		return this;
 	}
+	withHoldStorage(storage) {
+		this.holdStorage = storage;
+		return this;
+	}
 	withMaxDeadLettersPerRemote(limit) {
 		this.config.maxDeadLettersPerRemote = limit;
 		return this;
@@ -7947,19 +8819,21 @@ var SyncBuilder = class {
 		this.config.staleRemotePollWindowMs = windowMs;
 		return this;
 	}
-	build(reactor, logger, operationIndex, eventBus, db, driveContainerTypes) {
-		return this.buildModule(reactor, logger, operationIndex, eventBus, db, driveContainerTypes).syncManager;
+	build(reactor, logger, operationIndex, eventBus, db, driveContainerTypes, watermark, localPeer) {
+		return this.buildModule(reactor, logger, operationIndex, eventBus, db, driveContainerTypes, watermark, localPeer).syncManager;
 	}
-	buildModule(reactor, logger, operationIndex, eventBus, db, driveContainerTypes) {
+	buildModule(reactor, logger, operationIndex, eventBus, db, driveContainerTypes, watermark, localPeer) {
 		if (!this.channelFactory) throw new Error("Channel factory is required");
 		const remoteStorage = this.remoteStorage ?? new KyselySyncRemoteStorage(db);
 		const cursorStorage = this.cursorStorage ?? new KyselySyncCursorStorage(db);
 		const deadLetterStorage = this.deadLetterStorage ?? new KyselySyncDeadLetterStorage(db);
-		const syncManager = new SyncManager(logger, remoteStorage, cursorStorage, deadLetterStorage, this.channelFactory, operationIndex, reactor, eventBus, driveContainerTypes, this.config);
+		const holdStorage = this.holdStorage ?? new KyselySyncHoldStorage(db);
+		const syncManager = new SyncManager(logger, remoteStorage, cursorStorage, deadLetterStorage, this.channelFactory, operationIndex, reactor, eventBus, driveContainerTypes, watermark, this.config, localPeer, holdStorage);
 		return {
 			remoteStorage,
 			cursorStorage,
 			deadLetterStorage,
+			holdStorage,
 			channelFactory: this.channelFactory,
 			syncManager
 		};
@@ -8033,7 +8907,9 @@ var Reactor = class {
 	operationStore;
 	eventBus;
 	executorManager;
-	constructor(logger, documentModelRegistry, queue, jobTracker, readModelCoordinator, features, documentView, documentIndexer, operationStore, eventBus, executorManager) {
+	catchUp;
+	constructor(logger, documentModelRegistry, queue, jobTracker, readModelCoordinator, features, documentView, documentIndexer, operationStore, eventBus, executorManager, catchUp) {
+		this.catchUp = catchUp;
 		this.logger = logger;
 		this.documentModelRegistry = documentModelRegistry;
 		this.queue = queue;
@@ -8060,6 +8936,7 @@ var Reactor = class {
 		this.setShutdown(true);
 		const shutdownAsync = async () => {
 			await this.executorManager.stop(true);
+			await this.catchUp?.stop();
 			this.readModelCoordinator.stop();
 			this.jobTracker.shutdown();
 		};
@@ -8589,6 +9466,14 @@ var Reactor = class {
 };
 //#endregion
 //#region src/core/reactor-builder.ts
+/** One contiguous cursor per read model cannot serve shards that each see part of the stream. */
+function validateShardCount(shardCount) {
+	if (shardCount !== 1) throw new Error(`shardCount ${shardCount} is not supported: read-side catch-up keeps one cursor per read model, so projection runs in exactly one worker (shardCount: 1)`);
+}
+/** A coordinator whose models sweep in a worker reports that status. */
+function hasCatchUpStatuses(coordinator) {
+	return "catchUpStatuses" in coordinator && typeof coordinator.catchUpStatuses === "function";
+}
 function sameDatabaseTarget(a, b) {
 	return a.host === b.host && a.port === b.port && a.database === b.database;
 }
@@ -8620,6 +9505,7 @@ var ReactorBuilder = class {
 	executorConfig = {};
 	writeCacheConfig;
 	migrationStrategy = "auto";
+	unsupportedStoredDocuments = "refuse";
 	syncBuilder;
 	eventBus;
 	readModelCoordinator;
@@ -8642,6 +9528,8 @@ var ReactorBuilder = class {
 	projectionShardConfig;
 	projectionWorkerFactory;
 	instrumentedPools = [];
+	catchUpConfig = defaultCatchUpConfig;
+	extraPeerCapabilities = [];
 	withLogger(logger) {
 		this.logger = logger;
 		return this;
@@ -8657,6 +9545,15 @@ var ReactorBuilder = class {
 		this.documentModelSources.push(...sources);
 		return this;
 	}
+	/** Capabilities beyond the registry, for tests and hosts that ship their own. */
+	withPeerCapabilities(extra) {
+		this.extraPeerCapabilities = mergePeerCapabilities(this.extraPeerCapabilities, extra);
+		return this;
+	}
+	/** The registry plus any capabilities added with withPeerCapabilities. */
+	getPeerCapabilities() {
+		return mergePeerCapabilities(PEER_CAPABILITIES, this.extraPeerCapabilities);
+	}
 	withUpgradeManifests(manifests) {
 		this.upgradeManifests = manifests;
 		return this;
@@ -8719,10 +9616,27 @@ var ReactorBuilder = class {
 		this.migrationStrategy = strategy;
 		return this;
 	}
+	/**
+	* Stored documents at protocol versions this build does not run: "refuse"
+	* (the default) fails buildModule; "read-only" starts with a warning, and
+	* every job and received row into them is refused.
+	*/
+	withUnsupportedStoredDocuments(mode) {
+		this.unsupportedStoredDocuments = mode;
+		return this;
+	}
 	withSync(syncBuilder) {
 		this.syncBuilder = syncBuilder;
 		return this;
 	}
+	/** Tunes the read-side catch-up sweep. */
+	withCatchUp(config) {
+		this.catchUpConfig = {
+			...this.catchUpConfig,
+			...config
+		};
+		return this;
+	}
 	withEventBus(eventBus) {
 		this.eventBus = eventBus;
 		return this;
@@ -8848,11 +9762,18 @@ var ReactorBuilder = class {
 	async buildModule() {
 		if (!this.logger) this.logger = new ConsoleLogger(["reactor"]);
 		const featureFlags = resolveFeatureFlags(this.executorConfig.featureFlags);
+		if (this.executorConfig.protocolSupport === void 0) this.executorConfig = {
+			...this.executorConfig,
+			protocolSupport: localSupports(this.getPeerCapabilities(), featureFlags).protocols
+		};
 		if (this.readModelCoordinator !== void 0 && this.readModelCoordinatorFactory !== void 0) throw new Error("withReadModelCoordinator and withReadModelCoordinatorFactory are mutually exclusive; register one coordinator source");
 		if (this.projectionShardConfig !== void 0 && this.readModelCoordinatorFactory !== void 0) throw new Error("withProjectionShards and withReadModelCoordinatorFactory are mutually exclusive; the factory owns the projection worker through its createProjectionShardManager dependency");
 		if (this.projectionShardConfig !== void 0 && this.readModelFactories.length > 0) throw new Error("withProjectionShards does not support read models registered through withReadModelFactory; projection workers cannot receive host-only factory dependencies");
 		if (this.projectionShardConfig !== void 0 && this.readModels.length > 0) throw new Error("withProjectionShards does not support read models registered through withReadModel; projection workers build their own read models from the shard config and would silently omit these");
-		if (this.projectionShardConfig !== void 0) validateBuiltInKindCoverage(this.projectionShardConfig.preReadyKinds, this.projectionShardConfig.postReadyKinds);
+		if (this.projectionShardConfig !== void 0) {
+			validateShardCount(this.projectionShardConfig.shardCount);
+			validateBuiltInKindCoverage(this.projectionShardConfig.preReadyKinds, this.projectionShardConfig.postReadyKinds);
+		}
 		const resolvedSources = await resolveModelSources(this.documentModelSources);
 		if (this.workerPool) {
 			if (resolvedSources.manifest.length === 0) throw new Error("withWorkerPool requires at least one worker-importable document-model source ({ filePath } or { packageName }).");
@@ -8875,6 +9796,7 @@ var ReactorBuilder = class {
 			const result = await runMigrations(baseDatabase, REACTOR_SCHEMA);
 			if (!result.success && result.error) throw new Error(`Database migration failed: ${result.error.message}`);
 		}
+		await checkStoredProtocols(baseDatabase, REACTOR_SCHEMA, this.executorConfig.protocolSupport ?? {}, this.unsupportedStoredDocuments, this.logger);
 		const database = baseDatabase.withSchema(REACTOR_SCHEMA);
 		const operationStore = new KyselyOperationStore(database);
 		const keyframeStore = new KyselyKeyframeStore(database);
@@ -8891,6 +9813,14 @@ var ReactorBuilder = class {
 		const writeCache = new KyselyWriteCache(keyframeStore, operationStore, documentModelRegistry, cacheConfig);
 		await writeCache.startup();
 		const operationIndex = new KyselyOperationIndex(database);
+		const settledWatermark = new SettledWatermark(createKyselyWatermarkProbe(database), this.logger);
+		const catchUp = new CatchUpScheduler(settledWatermark, operationIndex, this.catchUpConfig, this.logger, {
+			onSwept: (result, thread) => void eventBus.emit(ReactorEventTypes.CATCHUP_SWEPT, {
+				...result,
+				thread
+			}).catch(() => {}),
+			describeSessions: (xids) => describeWaitingSessions(database, xids)
+		});
 		const documentMetaCache = new DocumentMetaCache(operationStore, { maxDocuments: 1e3 });
 		await documentMetaCache.startup();
 		const collectionMembershipCache = new CollectionMembershipCache(operationIndex);
@@ -8929,6 +9859,7 @@ var ReactorBuilder = class {
 		};
 		const documentViewConsistencyTracker = new ConsistencyTracker();
 		const documentView = new KyselyDocumentView(database, operationStore, operationIndex, writeCache, documentViewConsistencyTracker, featureFlags.documentDecisions ? "StateAtDeletion" : "NotFound", readModelIndexing);
+		documentView.attachCatchUp(settledWatermark, this.catchUpConfig.maxTrackedAboveCursor);
 		try {
 			await documentView.init();
 		} catch (error) {
@@ -8936,6 +9867,7 @@ var ReactorBuilder = class {
 		}
 		const documentIndexerConsistencyTracker = new ConsistencyTracker();
 		const documentIndexer = new KyselyDocumentIndexer(database, operationIndex, writeCache, documentIndexerConsistencyTracker, readModelIndexing);
+		documentIndexer.attachCatchUp(settledWatermark, this.catchUpConfig.maxTrackedAboveCursor);
 		try {
 			await documentIndexer.init();
 		} catch (error) {
@@ -8945,6 +9877,7 @@ var ReactorBuilder = class {
 		const subscriptionNotificationReadModel = new SubscriptionNotificationReadModel(subscriptionManager, documentView);
 		const processorManagerConsistencyTracker = new ConsistencyTracker();
 		const processorManager = new ProcessorManager(database, operationIndex, writeCache, processorManagerConsistencyTracker, this.logger, this.driveContainerTypes, { legacyProcessorIds: this.features.legacyProcessorIds !== false });
+		processorManager.attachCatchUp(settledWatermark, this.catchUpConfig.maxTrackedAboveCursor);
 		try {
 			await processorManager.init();
 		} catch (error) {
@@ -8981,20 +9914,38 @@ var ReactorBuilder = class {
 			createProjectionShardManager: (config) => this.createProjectionShardManager(config, eventBus, hostTrackers, readModelIndexing, false),
 			registerShutdownHook: (hook) => this.shutdownHooks.push(hook)
 		}) : this.projectionShardConfig ? await this.createProjectionShardManager(this.projectionShardConfig, eventBus, hostTrackers, readModelIndexing, true) : new ReadModelCoordinator(eventBus, readModelInstances, [subscriptionNotificationReadModel, processorManager]);
-		const reactor = new Reactor(this.logger, documentModelRegistry, queue, jobTracker, readModelCoordinator, this.features, documentView, documentIndexer, operationStore, eventBus, executorManager);
+		if (hasCatchUpStatuses(readModelCoordinator)) catchUp.addStatusSource(() => readModelCoordinator.catchUpStatuses().flatMap((status) => status.consumers));
+		const indexedReadModels = readModelCoordinator.indexedReadModels?.bind(readModelCoordinator);
+		if (indexedReadModels) catchUp.addSource(() => indexedReadModels().filter((model) => isCatchUpConsumer(model)), "host");
+		else this.logger.warn("The read model coordinator does not report indexedReadModels; the host runs no read-side catch-up sweep");
+		const reactor = new Reactor(this.logger, documentModelRegistry, queue, jobTracker, readModelCoordinator, this.features, documentView, documentIndexer, operationStore, eventBus, executorManager, catchUp);
+		const localPeer = {
+			capabilities: this.getPeerCapabilities(),
+			flags: featureFlags,
+			appKey: this.signer?.app?.key,
+			protocolVersionsOf: async (documentId, branch) => {
+				try {
+					return (await documentMetaCache.getDocumentMeta(documentId, branch)).protocolVersions;
+				} catch {
+					return;
+				}
+			}
+		};
 		let syncModule = void 0;
 		if (this.channelScheme) {
 			const factory = this.channelScheme === "connect" ? new GqlRequestChannelFactory(this.logger, this.jwtHandler, queue) : new GqlResponseChannelFactory(this.logger);
-			syncModule = new SyncBuilder().withChannelFactory(factory).buildModule(reactor, this.logger, operationIndex, eventBus, database, this.driveContainerTypes);
+			syncModule = new SyncBuilder().withChannelFactory(factory).buildModule(reactor, this.logger, operationIndex, eventBus, database, this.driveContainerTypes, settledWatermark, localPeer);
 			await syncModule.syncManager.startup();
 		} else if (this.syncBuilder) {
-			syncModule = this.syncBuilder.buildModule(reactor, this.logger, operationIndex, eventBus, database, this.driveContainerTypes);
+			syncModule = this.syncBuilder.buildModule(reactor, this.logger, operationIndex, eventBus, database, this.driveContainerTypes, settledWatermark, localPeer);
 			await syncModule.syncManager.startup();
 		}
 		let groupReevaluationTrigger;
 		if (featureFlags.authGroups) {
-			groupReevaluationTrigger = new GroupReevaluationTrigger(this.logger, eventBus, queue, operationIndex);
-			groupReevaluationTrigger.startup();
+			groupReevaluationTrigger = new GroupReevaluationTrigger(this.logger, eventBus, queue, operationIndex, database);
+			groupReevaluationTrigger.attachCatchUp(settledWatermark, this.catchUpConfig.maxTrackedAboveCursor);
+			await groupReevaluationTrigger.startup();
+			catchUp.addConsumer(groupReevaluationTrigger, "host");
 		}
 		const module = {
 			eventBus,
@@ -9020,8 +9971,11 @@ var ReactorBuilder = class {
 			reactor,
 			groupReevaluationTrigger,
 			pools: this.instrumentedPools,
-			degradedComponents
+			degradedComponents,
+			catchUp,
+			settledWatermark
 		};
+		catchUp.start();
 		if (degradedComponents.length > 0) this.logger.warn("Reactor started with @count degraded component(s): @components", degradedComponents.length, degradedComponents.map(({ component }) => component).join(", "));
 		if (this.signalHandlersEnabled) this.attachSignalHandlers(module);
 		return module;
@@ -9070,6 +10024,7 @@ var ReactorBuilder = class {
 			if (!parentDb) throw new Error(`The projection worker db passed to ${caller} must also be the parent reactor's database, but nothing configures the parent: it would fall back to the default embedded database while the worker projects into Postgres. Pass the same { db } to withWorkerPool, or give the parent its connection with withKysely.`);
 			if (!sameDatabaseTarget(config.db, parentDb)) throw new Error(`The projection worker db passed to ${caller} and the parent reactor database must address the same Postgres database (same host, port, and database); the parent writes operations there and the projection shards read them.`);
 		}
+		validateShardCount(config.shardCount);
 		validateBuiltInKindCoverage(config.preReadyKinds, config.postReadyKinds);
 		if (this.moduleOnlyModelKeys.length > 0) throw new Error(`projection workers require worker-importable sources, but these models were registered only as live modules: ${this.moduleOnlyModelKeys.join(", ")}. Provide a { filePath } or { packageName } source for each.`);
 		const models = this.resolvedModelManifest ?? [];
@@ -9085,7 +10040,7 @@ var ReactorBuilder = class {
 			poolInstrumentations.push(forwarder);
 			this.instrumentedPools.push(forwarder);
 		}
-		const { ProjectionShardManager } = await import("./projection-shard-manager-BpcqDtnQ.js");
+		const { ProjectionShardManager } = await import("./projection-shard-manager-CJIdjsd8.js");
 		const manager = new ProjectionShardManager({
 			shardCount: config.shardCount,
 			db,
@@ -9093,6 +10048,7 @@ var ReactorBuilder = class {
 			preReadyKinds: config.preReadyKinds,
 			postReadyKinds: config.postReadyKinds,
 			indexing,
+			catchUp: this.catchUpConfig,
 			factory,
 			logger: this.logger,
 			hostBus: eventBus,
@@ -9129,7 +10085,7 @@ var ReactorBuilder = class {
 	*/
 	async createDefaultWorkerFactory(numWorkers, db) {
 		const [{ WorkerHandle }, { createThreadTransport }, { workerEntryPath }] = await Promise.all([
-			import("./worker-handle-C2rLUHwv.js"),
+			import("./worker-handle-DjbEQkq-.js"),
 			import("./transport-CZDHzfvy.js"),
 			Promise.resolve().then(() => worker_exports)
 		]);
@@ -9272,7 +10228,9 @@ var HybridProjectionCoordinator = class {
 		}
 		const enqueuedAt = performance.now();
 		const key = this.queueKeyFor(event);
-		const current = (this.chains.get(key) ?? Promise.resolve()).then(() => this.runHostChain(event, enqueuedAt));
+		const reservations = reserveBatch(this.indexedReadModels(), event.operations, this.logger);
+		const run = () => this.runHostChain(event, enqueuedAt, reservations);
+		const current = (this.chains.get(key) ?? Promise.resolve()).then(run, run);
 		this.chains.set(key, current);
 		current.finally(() => {
 			if (this.chains.get(key) === current) this.chains.delete(key);
@@ -9287,6 +10245,12 @@ var HybridProjectionCoordinator = class {
 	getChainDepth() {
 		return this.manager.getChainDepth() + this.chains.size;
 	}
+	indexedReadModels() {
+		return [...this.preReady, ...this.postReady];
+	}
+	catchUpStatuses() {
+		return this.manager.catchUpStatuses();
+	}
 	/** Worker chains flush first, so every relayed read-ready is in `chains`. */
 	async drain() {
 		await this.manager.drain();
@@ -9304,11 +10268,18 @@ var HybridProjectionCoordinator = class {
 		}
 		await this.manager.shutdown();
 	}
-	async runHostChain(event, enqueuedAt) {
+	async runHostChain(event, enqueuedAt, reservations) {
+		try {
+			await this.runHostBatch(event, enqueuedAt, reservations);
+		} finally {
+			releaseBatch(reservations);
+		}
+	}
+	async runHostBatch(event, enqueuedAt, reservations) {
 		const chainWaitDurationMs = performance.now() - enqueuedAt;
 		const preReadyStart = performance.now();
 		try {
-			await Promise.all(this.preReady.map((readModel) => this.indexWithTiming(readModel, "pre_ready", event)));
+			await Promise.all(this.preReady.map((readModel) => this.indexWithTiming(readModel, "pre_ready", event, reservations)));
 		} catch (error) {
 			this.logger.error("Host pre-ready read model indexing failed for job @jobId: @Error", { jobId: event.jobId }, error);
 		}
@@ -9322,7 +10293,7 @@ var HybridProjectionCoordinator = class {
 		const emitDurationMs = performance.now() - emitStart;
 		const postReadyStart = performance.now();
 		try {
-			await Promise.all(this.postReady.map((readModel) => this.indexWithTiming(readModel, "post_ready", event)));
+			await Promise.all(this.postReady.map((readModel) => this.indexWithTiming(readModel, "post_ready", event, reservations)));
 		} catch (error) {
 			this.logger.error("Host post-ready read model indexing failed for job @jobId: @Error", { jobId: event.jobId }, error);
 		}
@@ -9336,11 +10307,11 @@ var HybridProjectionCoordinator = class {
 			postReadyDurationMs
 		});
 	}
-	async indexWithTiming(readModel, stage, event) {
+	async indexWithTiming(readModel, stage, event, reservations) {
 		const start = performance.now();
 		let success = false;
 		try {
-			await readModel.indexOperations(event.operations);
+			await indexReserved(readModel, event.operations, reservations);
 			success = true;
 		} finally {
 			this.emitReadModelIndexed({
@@ -9521,6 +10492,17 @@ var ReactorClientBuilder = class {
 			flags: reactorModule.featureFlags
 		} : void 0;
 	}
+	/** Selection reads the sync manager's agreement; without a module, none. */
+	resolveProtocolSelection(reactorModule) {
+		if (!reactorModule || !this.reactorBuilder) return;
+		const syncManager = reactorModule.syncModule?.syncManager;
+		return {
+			capabilities: this.reactorBuilder.getPeerCapabilities(),
+			flags: reactorModule.featureFlags,
+			agreement: syncManager ? () => syncManager.agreement() : void 0,
+			collectionsOf: (documentIds) => reactorModule.operationIndex.getCollectionsForDocuments(documentIds)
+		};
+	}
 	async build() {
 		return (await this.buildModule()).client;
 	}
@@ -9552,7 +10534,7 @@ var ReactorClientBuilder = class {
 		const jobAwaiter = this.jobAwaiter ?? new JobAwaiter(eventBus, (jobId, signal) => reactor.getJobStatus(jobId, signal));
 		const decisionModel = reactorModule ? readDecisionModel(reactorModule.featureFlags, reactorModule.documentModelRegistry) : void 0;
 		return {
-			client: new ReactorClient(this.logger, reactor, signer, subscriptionManager, jobAwaiter, documentIndexer, documentView, this.readGate ?? this.resolveReadGate(reactorModule, documentView, decisionModel), this.resolveActionEvaluation(reactorModule, decisionModel), this.createSignaturePolicy),
+			client: new ReactorClient(this.logger, reactor, signer, subscriptionManager, jobAwaiter, documentIndexer, documentView, this.readGate ?? this.resolveReadGate(reactorModule, documentView, decisionModel), this.resolveActionEvaluation(reactorModule, decisionModel), this.createSignaturePolicy, this.resolveProtocolSelection(reactorModule)),
 			reactor,
 			eventBus,
 			documentIndexer,
@@ -9852,6 +10834,6 @@ var DocumentIntegrityService = class {
 	}
 };
 //#endregion
-export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, AppendConditionFailedError, AuthEnforcementDisabledError, BareReadGate, BaseReadModel, ChannelError, ChannelErrorSource, ChannelScheme, ConsistencyTracker, DEFAULT_COMMIT_CHUNK_SIZE, DEFAULT_DRIVE_CONTAINER_TYPES, DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, DOCUMENT_INDEXER_READ_MODEL, DOCUMENT_VIEW_READ_MODEL, DRIVE_AUTH_ERROR_MESSAGES, DefaultSubscriptionErrorHandler, DeletedDocumentRead, DocumentAlreadyExistsError, DocumentChangeType, DocumentExistence, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, DriveClient, DriveCollectionId, DriveRequestError, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, HybridProjectionCoordinator, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, IntervalPollTimer, InvalidModuleError, InvalidSignatureError, JobAwaiter, JobExecutorEventTypes, JobStatus, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, Mailbox, ModelReadGate, ModuleNotFoundError, NullDocumentModelResolver, OptimisticLockError, PollBehavior, PollingChannelError, ProcessorManager, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, RECOVERABLE_GRAPHQL_ERROR_CODES, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, ReactorEventTypes, ReactorSubscriptionManager, ReadModelCoordinator, RelationalDbProcessor, RelationshipChangeType, RelationshipNotFoundError, RetryAccounting, RevisionMismatchError, SIGNATURE_REFUSAL_CODES, SeededStateReader, SimpleJobExecutorManager, SyncBuilder, SyncEventTypes, SyncOperation, SyncOperationAggregateError, SyncOperationStatus, SyncScopeGate, SyncStatus, SyncStatusTracker, addRelationshipAction, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createHybridProjectionCoordinatorFactory, createMutableShutdownStatus, createReactorHostModuleBase, createRelationalDb, decideAtHead, defaultReadModelIndexingConfig, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isDriveAuthError, isRecoverableGraphQLError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, quarantinesDocument, readDecisionModel, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, supportsLiveReadModelRegistration, syncOperationErrorType, trimMailboxFromAckOrdinal, unchunkedReadModelIndexingConfig, updateRelationshipAction, upgradeDocumentAction, verifyActionSignature, workerEntryPath };
+export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, AppendConditionFailedError, AuthEnforcementDisabledError, BareReadGate, BaseReadModel, CatchUpScheduler, ChannelError, ChannelErrorSource, ChannelScheme, ConsistencyTracker, ContiguousCursor, DEFAULT_COMMIT_CHUNK_SIZE, DEFAULT_DRIVE_CONTAINER_TYPES, DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, DOCUMENT_INDEXER_READ_MODEL, DOCUMENT_VIEW_READ_MODEL, DRIVE_AUTH_ERROR_MESSAGES, DefaultSubscriptionErrorHandler, DeletedDocumentRead, DocumentAlreadyExistsError, DocumentChangeType, DocumentExistence, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, DriveClient, DriveCollectionId, DriveRequestError, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, HybridProjectionCoordinator, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, InMemorySyncHoldStorage, IntervalPollTimer, InvalidModuleError, InvalidSignatureError, JobAwaiter, JobExecutorEventTypes, JobStatus, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncHoldStorage, KyselySyncRemoteStorage, KyselyWriteCache, Mailbox, ModelReadGate, ModuleNotFoundError, NullDocumentModelResolver, OptimisticLockError, PollBehavior, PollingChannelError, ProbeSettler, ProcessorManager, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, RECOVERABLE_GRAPHQL_ERROR_CODES, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, ReactorEventTypes, ReactorSubscriptionManager, ReadModelCoordinator, RelationalDbProcessor, RelationshipChangeType, RelationshipNotFoundError, RetryAccounting, RevisionMismatchError, SIGNATURE_REFUSAL_CODES, SeededStateReader, SettledWatermark, SimpleJobExecutorManager, SyncBuilder, SyncEventTypes, SyncOperation, SyncOperationAggregateError, SyncOperationStatus, SyncScopeGate, SyncStatus, SyncStatusTracker, UnsupportedStoredProtocolError, addRelationshipAction, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createHybridProjectionCoordinatorFactory, createKyselyWatermarkProbe, createMutableShutdownStatus, createPeerAgreement, createReactorHostModuleBase, createRelationalDb, decideAtHead, defaultCatchUpConfig, defaultReadModelIndexingConfig, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isCatchUpConsumer, isDriveAuthError, isRecoverableGraphQLError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, parseSnapshot, quarantinesDocument, readDecisionModel, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, snapshotFunctionsFor, supportsLiveReadModelRegistration, syncOperationErrorType, trimMailboxFromAckOrdinal, unchunkedReadModelIndexingConfig, updateRelationshipAction, upgradeDocumentAction, verifyActionSignature, workerEntryPath };
 
 //# sourceMappingURL=index.js.map