@powerhousedao/reactor 6.2.3-dev.4 → 6.2.3-dev.41

package/dist/{drive-container-types-yZrksiJR.js → forwarding-logger-BKDP4JnD.js}

@@ -1,7 +1,6 @@
-import { n as ReactorEventTypes, t as EventBusAggregateError } from "./types-DMKLa0Ok.js";
-import { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, DOCUMENT_DELETED_REASON, DowngradeNotSupportedError as DowngradeNotSupportedError$1, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, baseReducerVersion, createPresignedHeader, decide, defaultBaseState, deriveOperationId, evaluate, garbageCollect, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, isDenied, isUndoRedo, mentionedGroupIds, normalizeDocumentModelVersion, referencedGroupIds, sortOperations } from "@powerhousedao/shared/document-model";
+import { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, DOCUMENT_DELETED_REASON, DOCUMENT_SCOPE_ACTION_TYPES, DowngradeNotSupportedError as DowngradeNotSupportedError$1, PEER_CAPABILITIES, PURGE_DOCUMENT, actionSignerIdentity, actionSigningTarget, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, base58Decode, baseReducerVersion, buildOperationSignatureMessage, buildOperationSignatureParams, canonicalJson, createDocumentState, createPresignedHeader, decide, defaultBaseState, deriveDocumentId, deriveOperationId, evaluate, garbageCollect, groupDocumentType, groupMembershipActionTypes, hashActionV2, hashBrowser, hashDocumentStateForScope, isDenied, isDerivedDocumentId, isPurgeMarker, isUndoRedo, isV2ActionHash, localSupports, mentionedGroupIds, normalizeDocumentModelVersion, operationOutcome, purgeDocumentAction, purgeMarkerOperation, purgedProtocolVersions, referencedGroupIds, signaturePolicyOf, sortOperations, targetDocumentId, v2TupleProblem, withProtocolVersions } from "@powerhousedao/shared/document-model";
 import { v4 } from "uuid";
-import { Migrator, sql } from "kysely";
+import { Migrator, TableNode, sql } from "kysely";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
 var __exportAll = (all, no_symbols) => {
@@ -52,6 +51,38 @@ function parsePagingOptions(paging, defaultLimit) {
 	};
 }
 //#endregion
+//#region src/events/types.ts
+/**
+* Custom error class that aggregates multiple errors from event subscribers.
+*/
+var EventBusAggregateError = class extends Error {
+	errors;
+	constructor(errors) {
+		const message = `EventBus emit failed with ${errors.length} error(s): ${errors.map((e) => {
+			if (e && typeof e === "object" && "message" in e) return e.message;
+			return String(e);
+		}).join("; ")}`;
+		super(message);
+		this.name = "EventBusAggregateError";
+		this.errors = errors;
+	}
+};
+/**
+* Event types for reactor lifecycle events.
+*/
+const ReactorEventTypes = {
+	JOB_PENDING: 10001,
+	JOB_RUNNING: 10002,
+	JOB_WRITE_READY: 10003,
+	JOB_READ_READY: 10004,
+	JOB_FAILED: 10005,
+	READMODEL_BATCH_COMPLETED: 10006,
+	READMODEL_INDEXED: 10007,
+	MODEL_LOADED: 10008,
+	SIGNATURE_REFUSED: 10009,
+	CATCHUP_SWEPT: 10010
+};
+//#endregion
 //#region src/shared/errors.ts
 /**
 * Error thrown when attempting to access a deleted document.
@@ -143,6 +174,23 @@ var InvalidOperationTimestampError = class InvalidOperationTimestampError extend
 		return Error.isError(error) && error.name === "InvalidOperationTimestampError";
 	}
 };
+/** A document requires a protocol version this reactor does not run. Terminal. */
+var UnsupportedProtocolVersionError = class UnsupportedProtocolVersionError extends Error {
+	documentId;
+	protocol;
+	version;
+	constructor(documentId, protocol, version) {
+		super(`Document ${documentId} requires ${protocol} ${version}, which this reactor does not support`);
+		this.name = "UnsupportedProtocolVersionError";
+		this.documentId = documentId;
+		this.protocol = protocol;
+		this.version = version;
+		Error.captureStackTrace(this, UnsupportedProtocolVersionError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "UnsupportedProtocolVersionError";
+	}
+};
 /**
 * A load would move more operations than the bound allows, indicating a real
 * divergence between local and incoming history. Counts only first-time moves,
@@ -167,19 +215,22 @@ var ExcessiveReshuffleError = class ExcessiveReshuffleError extends Error {
 		return Error.isError(error) && error.name === "ExcessiveReshuffleError";
 	}
 };
-/**
-* Error thrown when an operation has an invalid signature.
-*/
+/** The message carries the code: only name and message cross the queue. */
 var InvalidSignatureError = class InvalidSignatureError extends Error {
 	documentId;
+	code;
 	reason;
-	constructor(documentId, reason) {
-		super(`Invalid signature in document ${documentId}: ${reason}`);
+	constructor(documentId, code, reason) {
+		super(`Invalid signature in document ${documentId} [${code}]: ${reason}`);
 		this.name = "InvalidSignatureError";
 		this.documentId = documentId;
+		this.code = code;
 		this.reason = reason;
 		Error.captureStackTrace(this, InvalidSignatureError);
 	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "InvalidSignatureError";
+	}
 };
 /**
 * An UPGRADE_DOCUMENT action's preconditions (fromVersion and the per-scope
@@ -220,8 +271,81 @@ var DocumentNotFoundError = class DocumentNotFoundError extends Error {
 		this.documentId = documentId;
 		Error.captureStackTrace(this, DocumentNotFoundError);
 	}
+	/** Also true for DocumentPurgedError: only the name crosses the queue. */
+	static isError(error) {
+		return Error.isError(error) && (error.name === "DocumentNotFoundError" || error.name === "DocumentPurgedError");
+	}
+};
+/** The document was purged; readers treat it as absent. Terminal. */
+var DocumentPurgedError = class DocumentPurgedError extends DocumentNotFoundError {
+	purged = true;
+	constructor(documentId, message) {
+		super(documentId, message ?? `Document ${documentId} was purged`);
+		this.name = "DocumentPurgedError";
+		Error.captureStackTrace(this, DocumentPurgedError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "DocumentPurgedError";
+	}
+};
+/** A purge was asked for a document that is not deleted. Terminal. */
+var DocumentNotDeletedError = class DocumentNotDeletedError extends Error {
+	documentId;
+	constructor(documentId, message) {
+		super(message ?? `Document ${documentId} is not deleted`);
+		this.name = "DocumentNotDeletedError";
+		this.documentId = documentId;
+		Error.captureStackTrace(this, DocumentNotDeletedError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "DocumentNotDeletedError";
+	}
+};
+/** A surviving document's accepted auth history names the group. Terminal. */
+var GroupInUseError = class GroupInUseError extends Error {
+	groupId;
+	referencingDocumentIds;
+	constructor(groupId, referencingDocumentIds) {
+		super(`Group ${groupId} cannot be purged: the auth history of ${referencingDocumentIds.join(", ")} names it`);
+		this.name = "GroupInUseError";
+		this.groupId = groupId;
+		this.referencingDocumentIds = referencingDocumentIds;
+		Error.captureStackTrace(this, GroupInUseError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "GroupInUseError";
+	}
+};
+/** A purge above maxPurgeOperations without allowLarge. Terminal. */
+var PurgeTooLargeError = class PurgeTooLargeError extends Error {
+	documentId;
+	operationCount;
+	maxPurgeOperations;
+	constructor(documentId, operationCount, maxPurgeOperations) {
+		super(`Document ${documentId} has ${operationCount} operations, above the purge limit of ${maxPurgeOperations}; request it with allowLarge`);
+		this.name = "PurgeTooLargeError";
+		this.documentId = documentId;
+		this.operationCount = operationCount;
+		this.maxPurgeOperations = maxPurgeOperations;
+		Error.captureStackTrace(this, PurgeTooLargeError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "PurgeTooLargeError";
+	}
+};
+/** A regular write carried an action type only the reactor issues. Terminal. */
+var ReservedActionError = class ReservedActionError extends Error {
+	documentId;
+	actionType;
+	constructor(documentId, actionType) {
+		super(`Action ${actionType} is reserved and cannot be submitted to document ${documentId}`);
+		this.name = "ReservedActionError";
+		this.documentId = documentId;
+		this.actionType = actionType;
+		Error.captureStackTrace(this, ReservedActionError);
+	}
 	static isError(error) {
-		return Error.isError(error) && error.name === "DocumentNotFoundError";
+		return Error.isError(error) && error.name === "ReservedActionError";
 	}
 };
 /**
@@ -250,6 +374,46 @@ var AuthEnforcementDisabledError = class AuthEnforcementDisabledError extends Er
 		return Error.isError(error) && error.name === "AuthEnforcementDisabledError";
 	}
 };
+/**
+* Error thrown when a relationship edge an operation names does not exist.
+*
+* Detection is by `name`, not `instanceof`: the SharedWorker RPC boundary
+* rebuilds a thrown error from `{ name, message, stack, cause }` alone
+* (`reactor-browser/src/rpc/error-info.ts`), so the class identity is lost in
+* transit.
+*/
+var RelationshipNotFoundError = class RelationshipNotFoundError extends Error {
+	sourceId;
+	targetId;
+	relationshipType;
+	constructor(sourceId, targetId, relationshipType) {
+		super(`No ${relationshipType} relationship from ${sourceId} to ${targetId}`);
+		this.name = "RelationshipNotFoundError";
+		this.sourceId = sourceId;
+		this.targetId = targetId;
+		this.relationshipType = relationshipType;
+		Error.captureStackTrace(this, RelationshipNotFoundError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "RelationshipNotFoundError";
+	}
+};
+/** The store holds documents at protocol versions this reactor does not run. */
+var UnsupportedStoredProtocolError = class UnsupportedStoredProtocolError extends Error {
+	versions;
+	documents;
+	constructor(versions, documents) {
+		const named = versions.map(({ protocol, version }) => `${protocol} ${version}`).join(", ");
+		super(`${documents} stored document(s) require ${named}, which this reactor does not run. Start a build that runs them, or accept them read-only with withUnsupportedStoredDocuments("read-only")`);
+		this.name = "UnsupportedStoredProtocolError";
+		this.versions = versions;
+		this.documents = documents;
+		Error.captureStackTrace(this, UnsupportedStoredProtocolError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "UnsupportedStoredProtocolError";
+	}
+};
 //#endregion
 //#region src/storage/interfaces.ts
 /**
@@ -302,6 +466,7 @@ const APPEND_CONDITION_FAILED_PREFIX = "Append condition failed: ";
 * conflict, not a fault: the caller retries against the new stream heads.
 */
 var AppendConditionFailedError = class extends Error {
+	condition;
 	constructor(condition) {
 		const streams = condition.streams.map((s) => `${s.documentId}:${s.scope}:${s.branch}@${s.revision}`).join(", ");
 		super(`${APPEND_CONDITION_FAILED_PREFIX}a read-set stream advanced [${streams}]`);
@@ -335,6 +500,52 @@ let DocumentExistence = /* @__PURE__ */ function(DocumentExistence) {
 	return DocumentExistence;
 }({});
 //#endregion
+//#region src/cache/operation-index-types.ts
+const DRIVE_COLLECTION_PREFIX = "drive.";
+/**
+* Identifies the collection a remote synchronizes. Collections are drive-level
+* abstractions (document-drive and reactor-drive), so a collection id is the
+* drive document id plus the branch it scopes to rather than an opaque string.
+*
+* The canonical string form (`drive.${branch}.${driveId}`) is produced only by
+* `key` and parsed only by `fromKey`; that string is the wire and storage
+* representation and is byte-for-byte identical to the legacy
+* `driveCollectionId(branch, driveId)` output, so existing `document_collections`
+* rows and persisted remotes remain valid without migration.
+*/
+var DriveCollectionId = class DriveCollectionId {
+	driveId;
+	branch;
+	constructor(driveId, branch) {
+		this.driveId = driveId;
+		this.branch = branch;
+	}
+	static forDrive(driveId, branch = "main") {
+		return new DriveCollectionId(driveId, branch);
+	}
+	/**
+	* The single deserializer for the wire/storage form. `branch` may contain
+	* dots, while `driveId` is a dot-free document id, so the drive id is the
+	* final dot-delimited segment.
+	*/
+	static fromKey(key) {
+		if (!key.startsWith(DRIVE_COLLECTION_PREFIX)) throw new Error(`Unsupported collection id: ${key}`);
+		const rest = key.slice(6);
+		const lastDot = rest.lastIndexOf(".");
+		if (lastDot === -1 || lastDot === rest.length - 1) throw new Error(`Malformed drive collection id: ${key}`);
+		return new DriveCollectionId(rest.slice(lastDot + 1), rest.slice(0, lastDot));
+	}
+	get key() {
+		return `${DRIVE_COLLECTION_PREFIX}${this.branch}.${this.driveId}`;
+	}
+	toString() {
+		return this.key;
+	}
+	equals(other) {
+		return this.driveId === other.driveId && this.branch === other.branch;
+	}
+};
+//#endregion
 //#region src/decision/build-decision-model.ts
 /**
 * Reads each projection's stream through the supplied reader, recording the
@@ -352,9 +563,13 @@ async function buildDecisionModel(reader, definition, target, signal) {
 		model[key] = (await readStream(reader, projection.query, reads, signal)).state;
 	}
 	const staticModel = { ...model };
+	const derived = [];
 	for (const [key, projection] of projections) {
 		if (typeof projection.query !== "function") continue;
-		const queries = projection.query(staticModel);
+		derived.push([key, projection.query(staticModel)]);
+	}
+	if (derived.length > 0 && reader.fence) await reader.fence(derived.flatMap(([, queries]) => queries.map((q) => q.documentId)));
+	for (const [key, queries] of derived) {
 		const value = {};
 		for (const query of queries) {
 			let read;
@@ -690,34 +905,13 @@ function selectDecisionModel(flags, registry) {
 //#endregion
 //#region src/executor/util.ts
 /** Actions the reactor reduces itself, onto the document scope. */
-const DOCUMENT_SCOPE_ACTIONS = new Set([
-	"CREATE_DOCUMENT",
-	"DELETE_DOCUMENT",
-	"UPGRADE_DOCUMENT",
-	"ADD_RELATIONSHIP",
-	"REMOVE_RELATIONSHIP",
-	"UPDATE_RELATIONSHIP"
-]);
+const DOCUMENT_SCOPE_ACTIONS = DOCUMENT_SCOPE_ACTION_TYPES;
 /**
 * `CREATE_DOCUMENT` is exempt by necessity: it runs before the document exists,
 * so building a decision model would throw and defer the job forever.
 */
 const GATED_DOCUMENT_ACTIONS = new Set([...DOCUMENT_SCOPE_ACTIONS].filter((type) => type !== "CREATE_DOCUMENT"));
 /**
-* The document a document-scope action writes to, which is not always the job's
-* own document: delete and upgrade name it in `input.documentId`, and the
-* relationship actions in `input.sourceId`. `execute` only checks that a batch
-* shares one scope, so a caller can submit an action whose target is a document
-* other than the one the job is keyed by. The policy gate has to follow the
-* action rather than the job, or it decides against a policy the caller may
-* control instead of the one guarding the write.
-*/
-function targetDocumentId(action, fallback) {
-	const input = action.input;
-	if (action.type === "ADD_RELATIONSHIP" || action.type === "REMOVE_RELATIONSHIP" || action.type === "UPDATE_RELATIONSHIP") return typeof input?.sourceId === "string" && input.sourceId.length > 0 ? input.sourceId : fallback;
-	return typeof input?.documentId === "string" && input.documentId.length > 0 ? input.documentId : fallback;
-}
-/**
 * Creates a PHDocument from a CREATE_DOCUMENT action input.
 * Reconstructs the document header and initializes the base state.
 *
@@ -896,6 +1090,129 @@ var TouchedStreams = class {
 		return this.streams.values();
 	}
 };
+/**
+* The ids of the actions the caller handed to a job. Load and reevaluation
+* jobs write operations nobody submitted, so they report none.
+*/
+function submittedActionIds(job) {
+	return job.kind === "mutation" ? job.actions.map((action) => action.id) : [];
+}
+/**
+* Reports what became of each submitted action.
+*
+* A job's operations can include ones it only moved to a new index, so only
+* those carrying a submitted action are reported. Returns undefined when the
+* job submitted nothing, which keeps `JobInfo.result` null for the jobs that
+* have no caller to answer to.
+*/
+function summarizeSubmittedActions(operations, submitted) {
+	if (!submitted || submitted.length === 0) return;
+	const ids = new Set(submitted);
+	const actions = [];
+	for (const { operation, context } of operations) {
+		if (!ids.has(operation.action.id)) continue;
+		actions.push({
+			actionId: operation.action.id,
+			scope: context.scope,
+			index: operation.index,
+			...operationOutcome(operation)
+		});
+	}
+	if (actions.length === 0) return;
+	return {
+		actions,
+		allApplied: actions.every((action) => action.kind === "applied")
+	};
+}
+/** Tombstones a job has read, each under the shared lock it took first. */
+var PurgeFence = class {
+	locks;
+	checked;
+	purged;
+	constructor(locks, checked, purged) {
+		this.locks = locks;
+		this.checked = checked;
+		this.purged = purged;
+	}
+	/** Locks and reads an id the job start did not resolve. */
+	async isPurged(documentId) {
+		await this.isPurgedMany([documentId]);
+		return this.purged.has(documentId);
+	}
+	/** Locks and reads the unresolved ids in one lock and one lookup. */
+	async isPurgedMany(documentIds) {
+		const unchecked = [...new Set(documentIds)].filter((id) => !this.checked.has(id));
+		if (unchecked.length > 0) {
+			await this.locks.shared(unchecked);
+			const found = await this.locks.purged(unchecked);
+			for (const id of unchecked) this.checked.add(id);
+			for (const id of found) this.purged.add(id);
+		}
+		return new Set(documentIds.filter((id) => this.purged.has(id)));
+	}
+};
+/** Locks and checks an id on its first read; a purged id reads as purged. */
+var FencedWriteCache = class {
+	inner;
+	purgeFence;
+	evict;
+	evicted = /* @__PURE__ */ new Set();
+	constructor(inner, purgeFence, evict) {
+		this.inner = inner;
+		this.purgeFence = purgeFence;
+		this.evict = evict;
+	}
+	/** Fences ids known before their reads in one round trip. */
+	async fence(documentIds) {
+		await this.purgeFence.isPurgedMany(documentIds);
+	}
+	async getState(documentId, scope, branch, targetRevision, signal) {
+		if (await this.purgeFence.isPurged(documentId)) {
+			if (!this.evicted.has(documentId)) {
+				this.evicted.add(documentId);
+				this.evict(documentId);
+			}
+			throw new DocumentPurgedError(documentId);
+		}
+		return this.inner.getState(documentId, scope, branch, targetRevision, signal);
+	}
+	putState(documentId, scope, branch, revision, document, position) {
+		this.inner.putState(documentId, scope, branch, revision, document, position);
+	}
+	putRun(documentId, scope, branch, run) {
+		this.inner.putRun(documentId, scope, branch, run);
+	}
+	invalidate(documentId, scope, branch) {
+		return this.inner.invalidate(documentId, scope, branch);
+	}
+	clear() {
+		this.inner.clear();
+	}
+	startup() {
+		return this.inner.startup();
+	}
+	shutdown() {
+		return this.inner.shutdown();
+	}
+};
+/** The target whose membership an ADD or REMOVE_RELATIONSHIP writes. */
+function relationshipTarget(action) {
+	if (action.type !== "ADD_RELATIONSHIP" && action.type !== "REMOVE_RELATIONSHIP") return;
+	const target = action.input?.targetId;
+	return typeof target === "string" && target.length > 0 ? target : void 0;
+}
+/** The ids a job's locks cover, sorted: its write ids and groups it names. */
+function jobWriteIds(job) {
+	const ids = /* @__PURE__ */ new Set([job.documentId]);
+	const actions = [...job.actions, ...job.operations.map((operation) => operation.action)];
+	for (const action of actions) {
+		if (DOCUMENT_SCOPE_ACTIONS.has(action.type)) ids.add(targetDocumentId(action, job.documentId));
+		const target = relationshipTarget(action);
+		if (target !== void 0) ids.add(target);
+		if (action.scope === "auth") for (const groupId of mentionedGroupIds(action)) ids.add(groupId);
+	}
+	return [...ids].sort();
+}
 //#endregion
 //#region src/registry/errors.ts
 /**
@@ -915,6 +1232,19 @@ var ModuleNotFoundError = class extends Error {
 		return Error.isError(error) && error.name === "ModuleNotFoundError";
 	}
 };
+/** The host has the model only as a live module, which workers cannot import. */
+var ModelNotWorkerImportableError = class extends Error {
+	documentType;
+	constructor(documentType, version) {
+		const versionSuffix = version !== void 0 ? ` version ${version}` : "";
+		super(`Document model ${documentType}${versionSuffix} is registered on the host only as a live module, so executor workers cannot load it. Register it from a { filePath } or { packageName } source.`);
+		this.name = "ModelNotWorkerImportableError";
+		this.documentType = documentType;
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "ModelNotWorkerImportableError";
+	}
+};
 /**
 * Error thrown when attempting to register a module that already exists.
 */
@@ -978,6 +1308,8 @@ var InvalidUpgradeStepError = class extends Error {
 };
 //#endregion
 //#region src/executor/types.ts
+/** 200k operations purge in 1.6 s on local Postgres; jobs time out at 30 s. */
+const DEFAULT_MAX_PURGE_OPERATIONS = 2e5;
 /** How long a deferred job waits for its document before it fails. */
 const DEFAULT_DEFERRED_JOB_TTL_MS = 3e4;
 /**
@@ -993,6 +1325,7 @@ const JobExecutorEventTypes = {
 //#endregion
 //#region src/cache/collection-membership-cache.ts
 var CollectionMembershipCache = class CollectionMembershipCache {
+	operationIndex;
 	cache = /* @__PURE__ */ new Map();
 	constructor(operationIndex) {
 		this.operationIndex = operationIndex;
@@ -1190,26 +1523,294 @@ var DocumentMetaCache = class DocumentMetaCache {
 		const docScopeOps = await this.operationStore.getSince(documentId, "document", branch, -1, void 0, void 0, signal);
 		if (docScopeOps.results.length === 0) throw new DocumentNotFoundError(documentId);
 		const createOp = docScopeOps.results[0];
+		if (isPurgeMarker(createOp)) return purgedMeta(createOp.action);
 		if (createOp.action.type !== "CREATE_DOCUMENT") throw new Error(`Invalid document: first operation must be CREATE_DOCUMENT, found ${createOp.action.type}`);
 		const createAction = createOp.action;
 		const documentType = createAction.input.model;
 		let document = createDocumentFromAction(createAction);
 		let documentScopeRevision = 0;
+		let purged = false;
 		for (const op of docScopeOps.results) {
 			if (targetRevision !== void 0 && op.index > targetRevision) break;
 			documentScopeRevision = op.index;
 			if (op.action.type === "UPGRADE_DOCUMENT") {
 				const upgradeAction = op.action;
 				document = applyUpgradeDocumentAction$1(document, upgradeAction);
-			} else if (op.action.type === "DELETE_DOCUMENT") document = applyDeleteDocumentAction$1(document, op.action);
+			} else if (op.action.type === "DELETE_DOCUMENT" || op.action.type === PURGE_DOCUMENT) {
+				document = applyDeleteDocumentAction$1(document, op.action);
+				purged ||= op.action.type === PURGE_DOCUMENT;
+			}
 		}
 		return {
 			state: document.state.document,
 			documentType,
+			protocolVersions: purged ? purgedProtocolVersions() : createAction.input.protocolVersions,
 			documentScopeRevision: documentScopeRevision + 1
 		};
 	}
 };
+/** A lone marker has no CREATE_DOCUMENT; the marker describes the stream. */
+function purgedMeta(action) {
+	return {
+		state: createDocumentState({
+			isDeleted: true,
+			deletedAtUtcIso: action.input.purgedAtUtcIso
+		}),
+		documentType: action.input.documentType,
+		protocolVersions: purgedProtocolVersions(),
+		documentScopeRevision: 1
+	};
+}
+//#endregion
+//#region src/catch-up/settled-watermark.ts
+const MAX_PENDING_PROBES = 64;
+/** pg_sequence_last_value needs 10; pg_current_* replaced txid_* in 13. */
+function snapshotFunctionsFor(serverVersionNum) {
+	if (serverVersionNum >= 13e4) return {
+		snapshot: "pg_current_snapshot",
+		currentXid: "pg_current_xact_id",
+		xidIfAssigned: "pg_current_xact_id_if_assigned"
+	};
+	if (serverVersionNum >= 1e5) return {
+		snapshot: "txid_current_snapshot",
+		currentXid: "txid_current",
+		xidIfAssigned: "txid_current_if_assigned"
+	};
+	throw new Error(`PostgreSQL server_version_num ${serverVersionNum} is not supported: read-side catch-up needs 10 or later`);
+}
+/** Parses the `xmin:xmax:xip,...` text form of a snapshot. */
+function parseSnapshot(text) {
+	const parts = text.split(":");
+	if (parts.length !== 3) throw new Error(`Malformed snapshot: ${text}`);
+	const [xmin, xmax, xip] = parts;
+	return {
+		xmin: BigInt(xmin),
+		xmax: BigInt(xmax),
+		xip: xip === "" ? [] : xip.split(",").map((xid) => BigInt(xid))
+	};
+}
+async function readSnapshotFunctions(db) {
+	const result = await sql`select current_setting('server_version_num') as version`.execute(db);
+	return snapshotFunctionsFor(Number(result.rows[0].version));
+}
+/** A probe settles once an xmin passes the xid it took after its head. */
+var ProbeSettler = class {
+	settled = 0;
+	lastHead = 0;
+	covered = 0;
+	lastXip = [];
+	pending = [];
+	get settledThrough() {
+		return this.settled;
+	}
+	get head() {
+		return this.lastHead;
+	}
+	/** The highest head a settled or pending probe covers. */
+	get probedHead() {
+		return this.covered;
+	}
+	observe(head, xid, snapshot, nowUtcMs) {
+		this.lastHead = Math.max(this.lastHead, head);
+		this.lastXip = snapshot.xip;
+		if (xid !== null && head > this.covered) {
+			this.covered = head;
+			this.pending.push({
+				head,
+				xid,
+				takenAtUtcMs: nowUtcMs
+			});
+			if (this.pending.length > MAX_PENDING_PROBES) this.pending.shift();
+		}
+		const stillPending = [];
+		for (const probe of this.pending) if (snapshot.xmin > probe.xid) this.settled = Math.max(this.settled, probe.head);
+		else stillPending.push(probe);
+		this.pending = stillPending.filter((probe) => probe.head > this.settled);
+		return this.settled;
+	}
+	/** Xids an unsettled probe still waits on. */
+	waitingOn() {
+		if (this.pending.length === 0) return [];
+		const xid = this.pending[0].xid;
+		return this.lastXip.filter((open) => open < xid).map((open) => open.toString());
+	}
+	stalledSinceUtcMs() {
+		return this.pending[0]?.takenAtUtcMs;
+	}
+};
+function operationIndexTableName(db) {
+	const from = db.selectFrom("operation_index_operations").selectAll().toOperationNode().from?.froms[0];
+	const schema = from !== void 0 && TableNode.is(from) ? from.table.schema?.name : void 0;
+	const quote = (identifier) => `"${identifier.replace(/"/g, "\"\"")}"`;
+	return schema === void 0 ? quote("operation_index_operations") : `${quote(schema)}.${quote("operation_index_operations")}`;
+}
+/** Reads the head, takes and commits an xid, then reads a snapshot, in order. */
+function createKyselyWatermarkProbe(db) {
+	let resolved = null;
+	const resolve = async () => {
+		const fns = await readSnapshotFunctions(db);
+		const table = operationIndexTableName(db);
+		const sequence = (await sql`select pg_get_serial_sequence(${table}, 'ordinal') as sequence`.execute(db)).rows[0]?.sequence;
+		if (!sequence) throw new Error(`No ordinal sequence found for ${table}`);
+		return {
+			fns,
+			sequence
+		};
+	};
+	return async (probedHead) => {
+		resolved ??= resolve().catch((error) => {
+			resolved = null;
+			throw error;
+		});
+		const { fns, sequence } = await resolved;
+		const headRow = (await sql`select coalesce(pg_sequence_last_value(${sequence}::regclass), 0) as head, ${sql.raw(fns.xidIfAssigned)}() is null as outside_write`.execute(db)).rows[0];
+		const head = Number(headRow.head);
+		let xid = null;
+		if (headRow.outside_write && head > probedHead) {
+			const xidResult = await sql`select ${sql.raw(fns.currentXid)}()::text as xid`.execute(db);
+			xid = BigInt(xidResult.rows[0].xid);
+		}
+		const row = (await sql`select ${sql.raw(fns.snapshot)}()::text as snapshot, ${sql.raw(fns.xidIfAssigned)}() is null as outside_write`.execute(db)).rows[0];
+		return {
+			head,
+			xid,
+			snapshot: parseSnapshot(row.snapshot),
+			outsideWrite: headRow.outside_write && row.outside_write
+		};
+	};
+}
+/** Knows when an ordinal gap is final by asking which transactions are open. */
+var SettledWatermark = class {
+	probe;
+	logger;
+	now;
+	settler = new ProbeSettler();
+	listeners = /* @__PURE__ */ new Set();
+	current;
+	next;
+	warnedInsideWrite = false;
+	constructor(probe, logger, now = Date.now) {
+		this.probe = probe;
+		this.logger = logger;
+		this.now = now;
+	}
+	get settledThrough() {
+		return this.settler.settledThrough;
+	}
+	refresh(signal) {
+		signal?.throwIfAborted();
+		if (this.next !== void 0) return this.next;
+		if (this.current === void 0) return this.start();
+		const next = this.current.catch(() => this.settledThrough).then(() => {
+			this.next = void 0;
+			return this.start();
+		});
+		this.next = next;
+		return next;
+	}
+	onAdvance(listener) {
+		this.listeners.add(listener);
+		return () => {
+			this.listeners.delete(listener);
+		};
+	}
+	status() {
+		const stalledSinceUtcMs = this.settler.head > this.settledThrough ? this.settler.stalledSinceUtcMs() : void 0;
+		return {
+			head: this.settler.head,
+			settledThrough: this.settledThrough,
+			waitingOn: this.settler.waitingOn(),
+			...stalledSinceUtcMs !== void 0 ? { stalledSinceUtcMs } : {}
+		};
+	}
+	start() {
+		const run = this.probeOnce().finally(() => {
+			if (this.current === run) this.current = void 0;
+		});
+		this.current = run;
+		return run;
+	}
+	async probeOnce() {
+		const reading = await this.probe(this.settler.probedHead);
+		if (!reading.outsideWrite) {
+			if (!this.warnedInsideWrite) {
+				this.warnedInsideWrite = true;
+				this.logger.warn("settled watermark probe ran inside another session's write transaction; discarded");
+			}
+			return this.settledThrough;
+		}
+		const before = this.settledThrough;
+		const after = this.settler.observe(reading.head, reading.xid, reading.snapshot, this.now());
+		if (after > before) for (const listener of this.listeners) try {
+			listener(after);
+		} catch (error) {
+			this.logger.error("settled watermark listener failed: @error", error);
+		}
+		return after;
+	}
+};
+/** Sessions holding these xids open; empty without pg_stat_activity. */
+async function describeWaitingSessions(db, xids) {
+	if (xids.length === 0) return [];
+	const epochless = xids.map((xid) => (BigInt(xid) % 2n ** 32n).toString());
+	try {
+		return (await sql`select pid, application_name, state, xact_start, backend_xid::text as xid
+       from pg_stat_activity
+       where backend_xid::text in (${sql.join(epochless)})`.execute(db)).rows.map((row) => ({
+			pid: Number(row.pid),
+			applicationName: row.application_name ?? "",
+			state: row.state ?? "",
+			xactStart: row.xact_start === null ? null : new Date(row.xact_start).toISOString(),
+			xid: row.xid
+		}));
+	} catch {
+		return [];
+	}
+}
+//#endregion
+//#region src/storage/kysely/document-purges.ts
+/** Class key of every purge lock; the stream locks use the single-key space. */
+const PURGE_NS = 1347571013;
+/** Ids share this many lock keys, so a job's lock count stays bounded. */
+const PURGE_LOCK_BUCKETS = 1024;
+async function acquirePurgeLocks(trx, ids, mode) {
+	const unique = [...new Set(ids)];
+	if (unique.length === 0) return;
+	const lock = sql.raw(mode === "shared" ? "pg_advisory_xact_lock_shared" : "pg_advisory_xact_lock");
+	await sql`
+    with keys as materialized (
+      select distinct hashtext(id) & ${sql.lit(1023)} as key
+      from unnest(${unique}::text[]) as t(id)
+      order by key
+    )
+    select ${lock}(${sql.lit(PURGE_NS)}, key) from keys order by key
+  `.execute(trx);
+}
+/** The ids among `ids` that have a tombstone, read in the handle's schema. */
+async function findPurged(db, ids) {
+	const unique = [...new Set(ids)];
+	if (unique.length === 0) return /* @__PURE__ */ new Set();
+	const rows = await db.selectFrom("document_purges").select("documentId").where(sql`"documentId" = any(${unique}::text[])`).execute();
+	return new Set(rows.map((row) => row.documentId));
+}
+/** Every tombstoned id, read in the handle's schema. */
+async function listPurged(db) {
+	return (await db.selectFrom("document_purges").select("documentId").orderBy("documentId").execute()).map((row) => row.documentId);
+}
+/** Bind slots per statement: 16-bit on the wire, read signed in-process. */
+const MAX_BIND_PARAMETERS = 32767;
+/** Splits rows into runs that each bind at most MAX_BIND_PARAMETERS. */
+function chunkRows(rows) {
+	if (rows.length === 0) return [];
+	const columnsPerRow = Math.max(1, Object.keys(rows[0]).length);
+	const perChunk = Math.max(1, Math.floor(MAX_BIND_PARAMETERS / columnsPerRow));
+	if (rows.length <= perChunk) return [rows];
+	const chunks = [];
+	for (let i = 0; i < rows.length; i += perChunk) chunks.push(rows.slice(i, i + perChunk));
+	return chunks;
+}
+/** Per database: the function that assigns the transaction's xid. */
+const xidFunctions = /* @__PURE__ */ new WeakMap();
 var KyselyOperationIndexTxn = class {
 	collections = [];
 	collectionMemberships = [];
@@ -1275,16 +1876,20 @@ var KyselyOperationIndexTxn = class {
 	}
 };
 var KyselyOperationIndex = class KyselyOperationIndex {
+	db;
 	trx;
+	liveIds;
 	constructor(db) {
 		this.db = db;
 	}
 	get queryExecutor() {
 		return this.trx ?? this.db;
 	}
-	withTransaction(trx) {
+	/** `liveIds`: ids the transaction read untombstoned under its shared lock. */
+	withTransaction(trx, liveIds) {
 		const instance = new KyselyOperationIndex(this.db);
 		instance.trx = trx;
+		instance.liveIds = liveIds;
 		return instance;
 	}
 	start() {
@@ -1331,10 +1936,12 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 				leftOrdinal: null
 			}));
 			for (const collectionId of collections) kyselyTxn.recordMembershipInvalidation(collectionId);
-			await trx.insertInto("document_collections").values(collectionRows).onConflict((oc) => oc.doNothing()).execute();
+			for (const chunk of chunkRows(collectionRows)) await trx.insertInto("document_collections").values(chunk).onConflict((oc) => oc.doNothing()).execute();
 		}
 		let operationOrdinals = [];
 		if (operations.length > 0) {
+			await this.refusePurgedOperations(trx, operations);
+			await this.assignXid(trx);
 			const operationRows = operations.map((op) => ({
 				opId: op.id || "",
 				documentId: op.documentId,
@@ -1349,7 +1956,10 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 				deniedReason: op.deniedReason ?? null,
 				sourceRemote: op.sourceRemote
 			}));
-			operationOrdinals = (await trx.insertInto("operation_index_operations").values(operationRows).returning("ordinal").execute()).map((row) => row.ordinal);
+			for (const chunk of chunkRows(operationRows)) {
+				const insertedOps = await trx.insertInto("operation_index_operations").values(chunk).returning("ordinal").execute();
+				operationOrdinals = operationOrdinals.concat(insertedOps.map((row) => row.ordinal));
+			}
 		}
 		if (memberships.length > 0) for (const m of memberships) {
 			const ordinal = operationOrdinals[m.operationIndex];
@@ -1382,10 +1992,44 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 		}
 		return operationOrdinals;
 	}
+	async getCollectionsInRange(after, through, among, signal) {
+		signal?.throwIfAborted();
+		if (through <= after || among?.length === 0) return [];
+		let query = this.queryExecutor.selectFrom("operation_index_operations as oi").innerJoin("document_collections as dc", "oi.documentId", "dc.documentId").select("dc.collectionId").distinct().where("oi.ordinal", ">", after).where("oi.ordinal", "<=", through);
+		if (among !== void 0) query = query.where("dc.collectionId", "in", [...among]);
+		return (await query.execute()).map((row) => row.collectionId);
+	}
+	async getOrdinalsInRange(after, through, limit, signal) {
+		signal?.throwIfAborted();
+		if (through <= after || limit <= 0) return [];
+		return (await this.queryExecutor.selectFrom("operation_index_operations").select("ordinal").where("ordinal", ">", after).where("ordinal", "<=", through).orderBy("ordinal", "asc").limit(limit).execute()).map((row) => Number(row.ordinal));
+	}
+	async getByOrdinals(ordinals, signal) {
+		signal?.throwIfAborted();
+		if (ordinals.length === 0) return [];
+		const results = [];
+		for (let i = 0; i < ordinals.length; i += MAX_BIND_PARAMETERS) {
+			const chunk = ordinals.slice(i, i + MAX_BIND_PARAMETERS);
+			const rows = await this.queryExecutor.selectFrom("operation_index_operations").selectAll().where("ordinal", "in", chunk).orderBy("ordinal", "asc").execute();
+			for (const row of rows) results.push(this.rowToOperationWithContext(row));
+		}
+		results.sort((a, b) => a.context.ordinal - b.context.ordinal);
+		return results;
+	}
+	async getStreamAfter(stream, after, signal, limit) {
+		signal?.throwIfAborted();
+		return (await this.queryExecutor.selectFrom("operation_index_operations").selectAll().where("documentId", "=", stream.documentId).where("branch", "=", stream.branch).where("scope", "=", stream.scope).where("ordinal", ">", after).orderBy("ordinal", "asc").$if(limit !== void 0, (qb) => qb.limit(limit)).execute()).map((row) => this.rowToOperationWithContext(row));
+	}
 	async getGroupReferencers(groupId, signal) {
 		if (signal?.aborted) throw new Error("Operation aborted");
 		return (await this.queryExecutor.selectFrom("group_references").select("documentId").where("groupId", "=", groupId).orderBy("documentId").execute()).map((row) => row.documentId);
 	}
+	async getOrdinalsByOpIds(documentId, scope, branch, opIds, signal) {
+		signal?.throwIfAborted();
+		if (opIds.length === 0) return /* @__PURE__ */ new Map();
+		const rows = await this.queryExecutor.selectFrom("operation_index_operations").select("opId").select((eb) => eb.fn.max("ordinal").as("ordinal")).where("documentId", "=", documentId).where("branch", "=", branch).where("scope", "=", scope).where("opId", "in", opIds).groupBy("opId").execute();
+		return new Map(rows.map((row) => [row.opId, Number(row.ordinal)]));
+	}
 	async find(collectionId, cursor, view, paging, signal) {
 		if (signal?.aborted) throw new Error("Operation aborted");
 		const outerCursor = cursor ?? -1;
@@ -1399,6 +2043,7 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 			if (view?.branch) qb = qb.where("oi.branch", "=", view.branch);
 			if (view?.scopes && view.scopes.length > 0) qb = qb.where("oi.scope", "in", view.scopes);
 			if (view?.excludeSourceRemote) qb = qb.where("oi.sourceRemote", "!=", view.excludeSourceRemote);
+			if (view?.throughOrdinal !== void 0) qb = qb.where("oi.ordinal", "<=", view.throughOrdinal).where("dc.joinedOrdinal", "<=", BigInt(view.throughOrdinal));
 			return qb;
 		};
 		const rows = await buildBranch("joiner").unionAll(buildBranch("newOps")).orderBy("ordinal", "asc").limit(limit + 1).execute();
@@ -1487,6 +2132,23 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 			}, signal) : void 0
 		};
 	}
+	/** Backstop to the store's refusal: only a marker indexes a purged id. */
+	async refusePurgedOperations(trx, operations) {
+		const ids = new Set(operations.filter((operation) => !isPurgeMarker(operation)).map((operation) => operation.documentId).filter((id) => !this.liveIds?.has(id)));
+		const purged = await findPurged(trx, ids);
+		for (const id of ids) if (purged.has(id)) throw new DocumentPurgedError(id);
+	}
+	/** Takes the xid before the first ordinal, as the settled watermark needs. */
+	async assignXid(trx) {
+		let fn = xidFunctions.get(this.db);
+		if (fn === void 0) {
+			fn = readSnapshotFunctions(trx).then((fns) => fns.currentXid);
+			xidFunctions.set(this.db, fn);
+			fn.catch(() => xidFunctions.delete(this.db));
+		}
+		const name = await fn;
+		await sql`select ${sql.raw(name)}()`.execute(trx);
+	}
 	rowToOperationWithContext(row) {
 		return {
 			operation: {
@@ -1605,21 +2267,6 @@ var RingBuffer = class {
 	}
 };
 //#endregion
-//#region src/cache/write-cache-types.ts
-/**
-* Where a snapshot sits in its stream.
-*
-* - `Head`: the newest revision of the stream when it was stored. Only these
-*   can answer a read that asks for the head.
-* - `Historical`: state at an earlier revision. Usable as a starting point to
-*   replay forward from, and as an answer to a read for that same revision.
-*/
-let SnapshotPosition = /* @__PURE__ */ function(SnapshotPosition) {
-	SnapshotPosition["Head"] = "head";
-	SnapshotPosition["Historical"] = "historical";
-	return SnapshotPosition;
-}({});
-//#endregion
 //#region src/cache/kysely-write-cache.ts
 /**
 * The last operation index a keyframe's document reflects for the scope. A
@@ -1654,42 +2301,6 @@ function copyDocument(document) {
 		operations: { ...document.operations }
 	};
 }
-/**
-* In-memory write cache with keyframe persistence for PHDocuments.
-*
-* Caches document snapshots in ring buffers with LRU eviction. On cache miss,
-* rebuilds documents from nearest keyframe or full operation history.
-*
-* **Performance Characteristics:**
-* - Cache hit: O(1) lookup in ring buffer
-* - Cold miss: O(n) where n is total operation count, or O(k) where k is operations since keyframe
-* - Warm miss: O(m) where m is operations since cached revision
-* - Eviction: O(1) for LRU tracking and removal
-*
-* **Thread Safety:**
-* Not thread-safe. Designed for single-threaded job executor environment.
-* External synchronization required for concurrent access across multiple executors.
-*
-* **Example:**
-* ```typescript
-* const cache = new KyselyWriteCache(
-*   keyframeStore,
-*   operationStore,
-*   registry,
-*   { maxDocuments: 1000, ringBufferSize: 10, keyframeInterval: 10 }
-* );
-*
-* await cache.startup();
-*
-* // Retrieve or rebuild document
-* const doc = await cache.getState(docId, docType, scope, branch, revision);
-*
-* // Cache result after job execution
-* cache.putState(docId, docType, scope, branch, newRevision, updatedDoc);
-*
-* await cache.shutdown();
-* ```
-*/
 var KyselyWriteCache = class KyselyWriteCache {
 	streams;
 	lruTracker;
@@ -1697,6 +2308,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 	operationStore;
 	registry;
 	config;
+	reads = /* @__PURE__ */ new Map();
 	constructor(keyframeStore, operationStore, registry, config) {
 		this.keyframeStore = keyframeStore;
 		this.operationStore = operationStore;
@@ -1713,6 +2325,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 		const scoped = new KyselyWriteCache(keyframeStore, operationStore, this.registry, this.config);
 		scoped.streams = this.streams;
 		scoped.lruTracker = this.lruTracker;
+		scoped.reads = this.reads;
 		return scoped;
 	}
 	/**
@@ -1746,11 +2359,27 @@ var KyselyWriteCache = class KyselyWriteCache {
 	* @returns The document at the target revision
 	* @throws {Error} "Operation aborted" if signal is aborted
 	* @throws {ModuleNotFoundError} If document type not registered in registry
+	* @throws {DocumentPurgedError} If the stream's only row is a purge marker
 	* @throws {Error} "Failed to rebuild document" if operation store fails
 	* @throws {Error} If reducer throws during operation application
 	* @throws {Error} If document serialization fails
 	*/
 	async getState(documentId, scope, branch, targetRevision, signal) {
+		const read = { evicted: false };
+		let pending = this.reads.get(documentId);
+		if (!pending) {
+			pending = /* @__PURE__ */ new Set();
+			this.reads.set(documentId, pending);
+		}
+		pending.add(read);
+		try {
+			return await this.readState(documentId, scope, branch, targetRevision, signal, read);
+		} finally {
+			pending.delete(read);
+			if (pending.size === 0) this.reads.delete(documentId);
+		}
+	}
+	async readState(documentId, scope, branch, targetRevision, signal, read) {
 		if (signal?.aborted) throw new Error("Operation aborted");
 		const streamKey = this.makeStreamKey(documentId, scope, branch);
 		const stream = this.streams.get(streamKey);
@@ -1758,13 +2387,13 @@ var KyselyWriteCache = class KyselyWriteCache {
 			const snapshots = stream.ringBuffer.getAll();
 			if (targetRevision === void 0) {
 				const newest = highestRevision(snapshots);
-				if (newest?.position === SnapshotPosition.Head) {
+				if (newest?.position === "head") {
 					this.lruTracker.touch(streamKey);
 					return copyDocument(newest.document);
 				}
 				if (newest) {
 					const document = await this.warmMissRebuild(newest.document, newest.revision, documentId, scope, branch, void 0, signal);
-					this.store(documentId, scope, branch, (document.header.revision[scope] ?? 0) - 1, document, SnapshotPosition.Head);
+					this.storeUnlessEvicted(read, documentId, scope, branch, (document.header.revision[scope] ?? 0) - 1, document, "head");
 					this.lruTracker.touch(streamKey);
 					return document;
 				}
@@ -1777,7 +2406,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 				const newestOlder = this.findNearestOlderSnapshot(snapshots, targetRevision);
 				if (newestOlder) {
 					const document = await this.warmMissRebuild(newestOlder.document, newestOlder.revision, documentId, scope, branch, targetRevision, signal);
-					this.store(documentId, scope, branch, targetRevision, document, SnapshotPosition.Historical);
+					this.storeUnlessEvicted(read, documentId, scope, branch, targetRevision, document, "historical");
 					this.lruTracker.touch(streamKey);
 					return document;
 				}
@@ -1785,7 +2414,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 		}
 		const document = await this.coldMissRebuild(documentId, scope, branch, targetRevision, signal);
 		const revision = targetRevision ?? (document.header.revision[scope] ?? 0) - 1;
-		this.store(documentId, scope, branch, revision, document, targetRevision === void 0 ? SnapshotPosition.Head : SnapshotPosition.Historical);
+		this.storeUnlessEvicted(read, documentId, scope, branch, revision, document, targetRevision === void 0 ? "head" : "historical");
 		return document;
 	}
 	/**
@@ -1820,7 +2449,10 @@ var KyselyWriteCache = class KyselyWriteCache {
 		if (run.length === 0) return;
 		for (const entry of run.slice(0, -1)) this.persistKeyframe(documentId, scope, branch, entry.revision, entry.document);
 		const head = run[run.length - 1];
-		this.store(documentId, scope, branch, head.revision, head.document, SnapshotPosition.Head);
+		this.store(documentId, scope, branch, head.revision, head.document, "head");
+	}
+	storeUnlessEvicted(read, documentId, scope, branch, revision, document, position) {
+		if (!read.evicted) this.store(documentId, scope, branch, revision, document, position);
 	}
 	store(documentId, scope, branch, revision, document, position) {
 		const streamKey = this.makeStreamKey(documentId, scope, branch);
@@ -1862,6 +2494,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 	* @returns The number of streams evicted
 	*/
 	invalidate(documentId, scope, branch) {
+		for (const read of this.reads.get(documentId) ?? []) read.evicted = true;
 		let evicted = 0;
 		if (scope === void 0 && branch === void 0) {
 			for (const [key] of this.streams.entries()) if (key.startsWith(`${documentId}:`)) {
@@ -1890,6 +2523,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 	* Resets LRU tracking state. This operation always succeeds.
 	*/
 	clear() {
+		for (const pending of this.reads.values()) for (const read of pending) read.evicted = true;
 		this.streams.clear();
 		this.lruTracker.clear();
 	}
@@ -1924,9 +2558,9 @@ var KyselyWriteCache = class KyselyWriteCache {
 	* the last replayed operation are applied at the end. Creation-time 0->N seed
 	* upgrades carry the initial state, so they still apply immediately.
 	*/
-	async coldMissRebuild(documentId, scope, branch, targetRevision, signal) {
+	async coldMissRebuild(documentId, scope, branch, targetRevision, signal, fromKeyframe = true) {
 		const effectiveTargetRevision = targetRevision || Number.MAX_SAFE_INTEGER;
-		const keyframe = await this.findNearestKeyframe(documentId, scope, branch, effectiveTargetRevision, signal);
+		const keyframe = fromKeyframe ? await this.findNearestKeyframe(documentId, scope, branch, effectiveTargetRevision, signal) : void 0;
 		const documentScopeBound = scope === "document" ? targetRevision : void 0;
 		let document;
 		let startRevision;
@@ -1969,7 +2603,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 							subsequentDeletes: []
 						});
 					}
-				} else if (operation.action.type === "DELETE_DOCUMENT") {
+				} else if (operation.action.type === "DELETE_DOCUMENT" || operation.action.type === PURGE_DOCUMENT) {
 					applyDeleteDocumentAction(document, operation.action);
 					for (const pending of pendingUpgrades) pending.subsequentDeletes.push(operation.action);
 				}
@@ -1982,6 +2616,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 			}, signal);
 			if (createOpResult.results.length === 0) throw new DocumentNotFoundError(documentId);
 			const createOp = createOpResult.results[0];
+			if (isPurgeMarker(createOp)) throw new DocumentPurgedError(documentId);
 			if (createOp.action.type !== "CREATE_DOCUMENT") throw new Error(`Failed to rebuild document ${documentId}: first operation in document scope must be CREATE_DOCUMENT, found ${createOp.action.type}`);
 			const documentCreateAction = createOp.action;
 			documentType = documentCreateAction.input.model;
@@ -2021,15 +2656,15 @@ var KyselyWriteCache = class KyselyWriteCache {
 						});
 					} else document = applyUpgradeDocumentAction(document, upgradeAction, void 0);
 					docModule = this.registry.getModule(documentType, normalizeDocumentModelVersion(toVersion));
-				} else if (operation.action.type === "DELETE_DOCUMENT") {
+				} else if (operation.action.type === "DELETE_DOCUMENT" || operation.action.type === PURGE_DOCUMENT) {
 					applyDeleteDocumentAction(document, operation.action);
 					for (const pending of pendingUpgrades) pending.subsequentDeletes.push(operation.action);
 				} else {
 					const protocolVersion = baseReducerVersion(document.header);
-					document = docModule.reducer(document, operation.action, void 0, {
+					document = withProtocolVersions(docModule.reducer(document, operation.action, void 0, {
 						skip: operation.skip,
 						protocolVersion
-					});
+					}), document.header.protocolVersions);
 				}
 			}
 		}
@@ -2063,6 +2698,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 		let cursor = void 0;
 		const pageSize = 100;
 		let hasMorePages;
+		let needsFullReplay = false;
 		do {
 			if (signal?.aborted) throw new Error("Operation aborted");
 			const paging = {
@@ -2073,26 +2709,31 @@ var KyselyWriteCache = class KyselyWriteCache {
 				const result = await this.operationStore.getSince(documentId, scope, branch, startRevision, void 0, paging, signal);
 				for (const operation of result.results) {
 					if (targetRevision !== void 0 && operation.index > targetRevision) break;
+					if (keyframe && operation.skip > 0) {
+						needsFullReplay = true;
+						break;
+					}
 					const moduleVersion = this.resolveModuleVersionForOp(operation.index, operation.timestampUtcMs, scope, validatedUpgrades, finalVersion);
 					document = this.applyPendingUpgrades(document, pendingUpgrades, moduleVersion ?? Number.MAX_SAFE_INTEGER);
 					if (isDenied(operation)) document = appendWithoutApplying(document, operation, scope);
 					else {
 						const protocolVersion = baseReducerVersion(document.header);
-						document = getModuleCached(moduleVersion).reducer(document, operation.action, void 0, {
+						document = withProtocolVersions(getModuleCached(moduleVersion).reducer(document, operation.action, void 0, {
 							skip: operation.skip,
 							protocolVersion,
 							replayOptions: { operation },
 							skipIndexValidation: true
-						});
+						}), document.header.protocolVersions);
 					}
 				}
 				const reachedTarget = targetRevision !== void 0 && result.results.some((op) => op.index >= targetRevision);
-				hasMorePages = Boolean(result.nextCursor) && !reachedTarget;
+				hasMorePages = Boolean(result.nextCursor) && !reachedTarget && !needsFullReplay;
 				if (hasMorePages) cursor = result.nextCursor;
 			} catch (err) {
 				throw new Error(`Failed to rebuild document ${documentId}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
 			}
 		} while (hasMorePages);
+		if (needsFullReplay) return this.coldMissRebuild(documentId, scope, branch, targetRevision, signal, false);
 		document = this.applyTailPendingUpgrades(document, pendingUpgrades, scope, targetRevision);
 		document = await this.stampRevisions(document, documentId, scope, branch, targetRevision, signal);
 		if (pendingUpgrades.length > 0) {
@@ -2199,26 +2840,32 @@ var KyselyWriteCache = class KyselyWriteCache {
 		if ((await this.operationStore.getSince(documentId, "document", branch, docScopeNextIndex - 1, void 0, void 0, signal)).results.length > 0) return this.coldMissRebuild(documentId, scope, branch, targetRevision, signal);
 		const module = this.registry.getModule(documentType, extractModuleVersion(baseDocument));
 		let document = copyDocument(baseDocument);
+		let needsFullReplay = false;
 		try {
 			const pagedResults = await this.operationStore.getSince(documentId, scope, branch, baseRevision, void 0, void 0, signal);
 			for (const operation of pagedResults.results) {
 				if (signal?.aborted) throw new Error("Operation aborted");
 				if (targetRevision !== void 0 && operation.index > targetRevision) break;
+				if (operation.skip > 0) {
+					needsFullReplay = true;
+					break;
+				}
 				if (isDenied(operation)) document = appendWithoutApplying(document, operation, scope);
 				else {
 					const protocolVersion = baseReducerVersion(document.header);
-					document = module.reducer(document, operation.action, void 0, {
+					document = withProtocolVersions(module.reducer(document, operation.action, void 0, {
 						skip: operation.skip,
 						protocolVersion,
 						replayOptions: { operation },
 						skipIndexValidation: true
-					});
+					}), document.header.protocolVersions);
 				}
 				if (targetRevision !== void 0 && operation.index === targetRevision) break;
 			}
 		} catch (err) {
 			throw new Error(`Failed to rebuild document ${documentId}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
 		}
+		if (needsFullReplay) return this.coldMissRebuild(documentId, scope, branch, targetRevision, signal, false);
 		const revisions = await this.operationStore.getRevisions(documentId, branch, signal);
 		document.header.revision = revisions.revision;
 		if (targetRevision !== void 0) document.header.revision = {
@@ -2337,8 +2984,160 @@ function validateFeatureFlags(flags, prerequisites) {
 	}
 }
 //#endregion
+//#region src/storage/kysely/document-purger.ts
+/** An `Operation` row whose DELETE_DOCUMENT applied: not errored, not denied. */
+const appliedDelete = sql`action->>'type' = 'DELETE_DOCUMENT' and coalesce(error, '') = '' and coalesce("deniedReason", '') = ''`;
+/** Rows removed per statement from the tables a document can fill. */
+const DEFAULT_PURGE_DELETE_BATCH = 5e3;
+/** A purge transaction's statements; bound to the job's transaction. */
+var KyselyDocumentPurger = class {
+	batchSize;
+	db;
+	constructor(db, batchSize = DEFAULT_PURGE_DELETE_BATCH) {
+		this.batchSize = batchSize;
+		this.db = db;
+	}
+	/** Every stream the document holds operations in. */
+	async streams(documentId) {
+		return this.db.selectFrom("Operation").select(["scope", "branch"]).distinct().where("documentId", "=", documentId).orderBy("scope").orderBy("branch").execute();
+	}
+	async operationCount(documentId) {
+		const row = await this.db.selectFrom("operation_index_operations").select((eb) => eb.fn.countAll().as("count")).where("documentId", "=", documentId).executeTakeFirst();
+		return Number(row?.count ?? 0);
+	}
+	/** Untombstoned documents group_references records as naming the group. */
+	async groupReferencers(groupId) {
+		const ids = (await this.db.selectFrom("group_references").select("documentId").where("groupId", "=", groupId).where("documentId", "<>", groupId).orderBy("documentId").execute()).map((row) => row.documentId);
+		const purged = await findPurged(this.db, ids);
+		return ids.filter((id) => !purged.has(id));
+	}
+	/** Survivors whose accepted auth history names the group; refusals do not. */
+	async groupReferencersInHistory(groupId) {
+		const referencing = [];
+		for (const documentId of await this.groupReferencers(groupId)) if ([...(await this.authOperations(documentId)).values()].some((operations) => garbageCollect(sortOperations(operations)).some((operation) => operation.deniedReason === void 0 && operation.error === void 0 && mentionedGroupIds(operation.action).includes(groupId)))) referencing.push(documentId);
+		return referencing;
+	}
+	/** The document's auth-scope operations, per branch, in index order. */
+	async authOperations(documentId) {
+		const rows = await this.db.selectFrom("Operation").selectAll().where("documentId", "=", documentId).where("scope", "=", "auth").orderBy("branch").orderBy("index").execute();
+		const byBranch = /* @__PURE__ */ new Map();
+		for (const row of rows) {
+			const operations = byBranch.get(row.branch) ?? [];
+			operations.push({
+				index: row.index,
+				timestampUtcMs: row.timestampUtcMs.toISOString(),
+				hash: row.hash,
+				skip: row.skip,
+				error: row.error || void 0,
+				deniedReason: row.deniedReason || void 0,
+				id: row.opId,
+				action: row.action
+			});
+			byBranch.set(row.branch, operations);
+		}
+		return byBranch;
+	}
+	/** Every document ever in the collection, but its owner and its own row. */
+	async collectionMembers(collectionId, ownerId, branch) {
+		return (await this.db.selectFrom("document_collections as dc").select("dc.documentId").select(sql`dc."leftOrdinal" is null`.as("openHere")).select((eb) => eb.exists(eb.selectFrom("Operation as op").select("op.opId").whereRef("op.documentId", "=", "dc.documentId").where("op.branch", "=", branch).where("op.scope", "=", "document").where(appliedDelete)).as("deleted")).select((eb) => eb.exists(eb.selectFrom("document_collections as other").select("other.documentId").whereRef("other.documentId", "=", "dc.documentId").where("other.collectionId", "<>", collectionId).where("other.leftOrdinal", "is", null)).as("openElsewhere")).where("dc.collectionId", "=", collectionId).where("dc.documentId", "not in", [ownerId, collectionId]).orderBy("dc.documentId").execute()).map((row) => {
+			const openElsewhere = Boolean(row.openElsewhere);
+			return {
+				documentId: row.documentId,
+				openElsewhere,
+				required: !openElsewhere && (Boolean(row.openHere) || Boolean(row.deleted))
+			};
+		});
+	}
+	async remoteCollection(remoteName) {
+		return (await this.db.selectFrom("sync_remotes").select("collection_id").where("name", "=", remoteName).executeTakeFirst())?.collection_id;
+	}
+	/** Deletes every row about the document; the counts are per table. */
+	async deleteRows(documentId) {
+		const removed = {};
+		removed.Operation = await this.deleteBatched(async () => {
+			const result = await this.db.deleteFrom("Operation").where("id", "in", (eb) => eb.selectFrom("Operation").select("id").where("documentId", "=", documentId).limit(this.batchSize)).executeTakeFirst();
+			return Number(result.numDeletedRows);
+		});
+		removed.operation_index_operations = await this.deleteBatched(async () => {
+			const result = await this.db.deleteFrom("operation_index_operations").where("ordinal", "in", (eb) => eb.selectFrom("operation_index_operations").select("ordinal").where("documentId", "=", documentId).limit(this.batchSize)).executeTakeFirst();
+			return Number(result.numDeletedRows);
+		});
+		removed.Keyframe = await this.deleteBatched(async () => {
+			const result = await this.db.deleteFrom("Keyframe").where("id", "in", (eb) => eb.selectFrom("Keyframe").select("id").where("documentId", "=", documentId).limit(this.batchSize)).executeTakeFirst();
+			return Number(result.numDeletedRows);
+		});
+		removed.DocumentSnapshot = await this.deleteBatched(async () => {
+			const result = await this.db.deleteFrom("DocumentSnapshot").where("id", "in", (eb) => eb.selectFrom("DocumentSnapshot").select("id").where("documentId", "=", documentId).limit(this.batchSize)).executeTakeFirst();
+			return Number(result.numDeletedRows);
+		});
+		removed.SlugMapping = await this.deleteWhere("SlugMapping", "documentId", documentId);
+		const relationships = await this.db.selectFrom("DocumentRelationship").select((eb) => eb.fn.countAll().as("count")).where((eb) => eb.or([eb("sourceId", "=", documentId), eb("targetId", "=", documentId)])).executeTakeFirst();
+		removed.DocumentRelationship = Number(relationships?.count ?? 0);
+		removed.Document = await this.deleteWhere("Document", "id", documentId);
+		removed.group_references = await this.deleteWhere("group_references", "documentId", documentId);
+		removed.sync_dead_letters = await this.deleteWhere("sync_dead_letters", "document_id", documentId);
+		removed.sync_holds = await this.deleteWhere("sync_holds", "document_id", documentId);
+		return removed;
+	}
+	async writeTombstone(tombstone) {
+		const values = {
+			documentId: tombstone.documentId,
+			ordinal: tombstone.ordinal,
+			removedRows: JSON.stringify(tombstone.removedRows),
+			purgedAtUtc: tombstone.purgedAtUtc,
+			requestId: tombstone.requestId
+		};
+		await this.db.insertInto("document_purges").values(values).onConflict((oc) => oc.column("documentId").doUpdateSet({
+			ordinal: values.ordinal,
+			removedRows: values.removedRows,
+			purgedAtUtc: values.purgedAtUtc,
+			requestId: values.requestId
+		})).execute();
+	}
+	/** Reopens every membership at the marker ordinal, plus `collectionIds`. */
+	async reopenMemberships(documentId, ordinal, collectionIds = []) {
+		await this.db.updateTable("document_collections").set({
+			joinedOrdinal: BigInt(ordinal),
+			leftOrdinal: null
+		}).where("documentId", "=", documentId).execute();
+		for (const collectionId of new Set(collectionIds)) await this.db.insertInto("document_collections").values({
+			documentId,
+			collectionId,
+			joinedOrdinal: BigInt(ordinal),
+			leftOrdinal: null
+		}).onConflict((oc) => oc.columns(["documentId", "collectionId"]).doUpdateSet({
+			joinedOrdinal: BigInt(ordinal),
+			leftOrdinal: null
+		})).execute();
+		return (await this.db.selectFrom("document_collections").select("collectionId").where("documentId", "=", documentId).orderBy("collectionId").execute()).map((row) => row.collectionId);
+	}
+	async deleteBatched(step) {
+		let total = 0;
+		for (;;) {
+			const deleted = await step();
+			total += deleted;
+			if (deleted < this.batchSize) return total;
+		}
+	}
+	async deleteWhere(table, column, documentId) {
+		const result = await this.db.deleteFrom(table).where(column, "=", documentId).executeTakeFirst();
+		return Number(result.numDeletedRows);
+	}
+};
+//#endregion
 //#region src/executor/execution-scope.ts
+/** For scopes without a transaction to hold a lock in. */
+const NOOP_DOCUMENT_LOCKS = {
+	shared: () => Promise.resolve(),
+	exclusive: () => Promise.resolve(),
+	purged: () => Promise.resolve(/* @__PURE__ */ new Set())
+};
 var DefaultExecutionScope = class {
+	operationStore;
+	operationIndex;
+	writeCache;
+	documentMetaCache;
+	collectionMembershipCache;
 	constructor(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache) {
 		this.operationStore = operationStore;
 		this.operationIndex = operationIndex;
@@ -2353,11 +3152,19 @@ var DefaultExecutionScope = class {
 			operationIndex: this.operationIndex,
 			writeCache: this.writeCache,
 			documentMetaCache: this.documentMetaCache,
-			collectionMembershipCache: this.collectionMembershipCache
+			collectionMembershipCache: this.collectionMembershipCache,
+			documentLocks: NOOP_DOCUMENT_LOCKS
 		});
 	}
 };
 var KyselyExecutionScope = class {
+	db;
+	operationStore;
+	operationIndex;
+	keyframeStore;
+	writeCache;
+	documentMetaCache;
+	collectionMembershipCache;
 	constructor(db, operationStore, operationIndex, keyframeStore, writeCache, documentMetaCache, collectionMembershipCache) {
 		this.db = db;
 		this.operationStore = operationStore;
@@ -2370,28 +3177,46 @@ var KyselyExecutionScope = class {
 	async run(fn, signal) {
 		signal?.throwIfAborted();
 		return this.db.transaction().execute(async (trx) => {
-			const scopedOperationStore = this.operationStore.withTransaction(trx);
-			const scopedOperationIndex = this.operationIndex.withTransaction(trx);
+			const sharedLocked = /* @__PURE__ */ new Set();
+			const liveIds = /* @__PURE__ */ new Set();
+			const scopedOperationStore = this.operationStore.withTransaction(trx, liveIds);
+			const scopedOperationIndex = this.operationIndex.withTransaction(trx, liveIds);
 			const scopedKeyframeStore = this.keyframeStore.withTransaction(trx);
 			return fn({
 				operationStore: scopedOperationStore,
 				operationIndex: scopedOperationIndex,
 				writeCache: this.writeCache.withScopedStores(scopedOperationStore, scopedKeyframeStore),
 				documentMetaCache: this.documentMetaCache.withScopedStore(scopedOperationStore),
-				collectionMembershipCache: this.collectionMembershipCache.withScopedIndex(scopedOperationIndex)
+				collectionMembershipCache: this.collectionMembershipCache.withScopedIndex(scopedOperationIndex),
+				documentLocks: {
+					shared: async (ids) => {
+						const list = [...ids];
+						await acquirePurgeLocks(trx, list, "shared");
+						for (const id of list) sharedLocked.add(id);
+					},
+					exclusive: (id) => acquirePurgeLocks(trx, [id], "exclusive"),
+					purged: async (ids) => {
+						const list = [...ids];
+						const found = await findPurged(trx, list);
+						for (const id of list) if (sharedLocked.has(id) && !found.has(id)) liveIds.add(id);
+						return found;
+					}
+				},
+				purger: new KyselyDocumentPurger(trx)
 			});
 		});
 	}
 };
 //#endregion
 //#region src/utils/reshuffle.ts
-const STRICT_ORDER_ACTION_TYPES = new Set([
+const STRICT_ORDER_ACTION_TYPES = /* @__PURE__ */ new Set([
 	"CREATE_DOCUMENT",
 	"DELETE_DOCUMENT",
 	"UPGRADE_DOCUMENT",
 	"ADD_RELATIONSHIP",
 	"REMOVE_RELATIONSHIP",
 	"UPDATE_RELATIONSHIP",
+	"PURGE_DOCUMENT",
 	"ADD_FOLDER",
 	"UPDATE_FOLDER",
 	"REMOVE_FOLDER"
@@ -2597,6 +3422,15 @@ async function evaluateByPosition(model, target, subject, stores, signal) {
 	const derivedSet = derivedReadSet(definition);
 	if (!definition.evaluatesScope(scope)) return operations.map(() => void 0);
 	const evaluating = new Set(operations.map((operation) => operation.id));
+	const creation = operations.find((operation) => operation.action.type === "CREATE_DOCUMENT" && operation.action.input.documentId === target.documentId);
+	async function stateBefore(query) {
+		try {
+			return await writeCache.getState(query.documentId, query.scope, query.branch, -1, signal);
+		} catch (error) {
+			if (creation !== void 0 && query.documentId === target.documentId && error instanceof DocumentNotFoundError && !(error instanceof DocumentPurgedError)) return createDocumentFromAction(creation.action);
+			throw error;
+		}
+	}
 	const readStreams = await Promise.all(readSet.map(async (stream) => ({
 		stream,
 		operations: (await operationStore.getSince(stream.query.documentId, stream.query.scope, stream.query.branch, -1, { actionTypes: stream.decidingActions }, void 0, signal)).results.filter((operation) => !evaluating.has(operation.id))
@@ -2609,7 +3443,7 @@ async function evaluateByPosition(model, target, subject, stores, signal) {
 	const histories = [];
 	for (const read of readStreams) {
 		const streamOperations = read.stream === writtenProjection ? [...read.operations, ...operations] : read.operations;
-		const before = await writeCache.getState(read.stream.query.documentId, read.stream.query.scope, read.stream.query.branch, -1, signal);
+		const before = await stateBefore(read.stream.query);
 		walked.push({
 			streamKey: streamKey(read.stream.query),
 			scope: read.stream.query.scope,
@@ -2631,7 +3465,7 @@ async function evaluateByPosition(model, target, subject, stores, signal) {
 			branch: target.branch
 		};
 		const storedOperations = (await operationStore.getSince(query.documentId, query.scope, query.branch, -1, void 0, void 0, signal)).results.filter((operation) => !evaluating.has(operation.id));
-		const before = await writeCache.getState(query.documentId, query.scope, query.branch, -1, signal);
+		const before = await stateBefore(query);
 		evaluatedStateKey = streamKey(query);
 		walked.push({
 			streamKey: evaluatedStateKey,
@@ -2702,58 +3536,36 @@ async function evaluateByPosition(model, target, subject, stores, signal) {
 	return operations.map((operation) => reasons.get(operation.id));
 }
 //#endregion
-//#region src/cache/operation-index-types.ts
-const DRIVE_COLLECTION_PREFIX = "drive.";
-/**
-* Identifies the collection a remote synchronizes. Collections are drive-level
-* abstractions (document-drive and reactor-drive), so a collection id is the
-* drive document id plus the branch it scopes to rather than an opaque string.
-*
-* The canonical string form (`drive.${branch}.${driveId}`) is produced only by
-* `key` and parsed only by `fromKey`; that string is the wire and storage
-* representation and is byte-for-byte identical to the legacy
-* `driveCollectionId(branch, driveId)` output, so existing `document_collections`
-* rows and persisted remotes remain valid without migration.
-*/
-var DriveCollectionId = class DriveCollectionId {
-	constructor(driveId, branch) {
-		this.driveId = driveId;
-		this.branch = branch;
-	}
-	static forDrive(driveId, branch = "main") {
-		return new DriveCollectionId(driveId, branch);
-	}
-	/**
-	* The single deserializer for the wire/storage form. `branch` may contain
-	* dots, while `driveId` is a dot-free document id, so the drive id is the
-	* final dot-delimited segment.
-	*/
-	static fromKey(key) {
-		if (!key.startsWith(DRIVE_COLLECTION_PREFIX)) throw new Error(`Unsupported collection id: ${key}`);
-		const rest = key.slice(6);
-		const lastDot = rest.lastIndexOf(".");
-		if (lastDot === -1 || lastDot === rest.length - 1) throw new Error(`Malformed drive collection id: ${key}`);
-		return new DriveCollectionId(rest.slice(lastDot + 1), rest.slice(0, lastDot));
-	}
-	get key() {
-		return `${DRIVE_COLLECTION_PREFIX}${this.branch}.${this.driveId}`;
-	}
-	toString() {
-		return this.key;
-	}
-	equals(other) {
-		return this.driveId === other.driveId && this.branch === other.branch;
-	}
-};
-//#endregion
 //#region src/executor/document-action-handler.ts
 var DocumentActionHandler = class {
-	constructor(registry, logger, driveContainerTypes, featureFlags, decisionModel) {
+	registry;
+	logger;
+	driveContainerTypes;
+	featureFlags;
+	decisionModel;
+	protocolSupport;
+	loggedUnregisteredProtocols = /* @__PURE__ */ new Set();
+	constructor(registry, logger, driveContainerTypes, featureFlags, decisionModel, protocolSupport) {
 		this.registry = registry;
 		this.logger = logger;
 		this.driveContainerTypes = driveContainerTypes;
 		this.featureFlags = featureFlags;
 		this.decisionModel = decisionModel;
+		this.protocolSupport = protocolSupport;
+	}
+	/** Keys this reactor does not register are admitted: it cannot judge them. */
+	unsupportedProtocol(documentId, protocolVersions) {
+		for (const [protocol, version] of Object.entries(protocolVersions ?? {})) {
+			const supported = this.protocolSupport[protocol];
+			if (supported === void 0) {
+				if (!this.loggedUnregisteredProtocols.has(protocol)) {
+					this.loggedUnregisteredProtocols.add(protocol);
+					this.logger.info("Admitting document @documentId with unregistered protocol @protocol @version", documentId, protocol, version);
+				}
+				continue;
+			}
+			if (!supported.includes(version)) return new UnsupportedProtocolVersionError(documentId, protocol, version);
+		}
 	}
 	/** Whether the write arrives with its evaluation already decided. */
 	alreadyEvaluated(executing) {
@@ -2771,6 +3583,7 @@ var DocumentActionHandler = class {
 			case "ADD_RELATIONSHIP": return this.executeAddRelationship(write, executing);
 			case "REMOVE_RELATIONSHIP": return this.executeRemoveRelationship(write, executing);
 			case "UPDATE_RELATIONSHIP": return this.executeUpdateRelationship(write, executing);
+			case "PURGE_DOCUMENT": return buildErrorResult(executing.job, new ReservedActionError(executing.job.documentId, action.type), executing.startTime);
 			default: return buildErrorResult(executing.job, /* @__PURE__ */ new Error(`Unknown document action type: ${action.type}`), executing.startTime);
 		}
 	}
@@ -2840,7 +3653,7 @@ var DocumentActionHandler = class {
 			[job.scope]: [...standing.operations[job.scope] ?? [], operation]
 		};
 		executing.touchedStreams.add(job.documentId, job.scope, job.branch);
-		stores.writeCache.putState(job.documentId, job.scope, job.branch, operation.index, standing, SnapshotPosition.Head);
+		stores.writeCache.putState(job.documentId, job.scope, job.branch, operation.index, standing, "head");
 		indexTxn.write([{
 			...operation,
 			documentId: job.documentId,
@@ -2852,6 +3665,7 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(job.documentId, job.branch, {
 			state: standing.state.document,
 			documentType: standing.header.documentType,
+			protocolVersions: standing.header.protocolVersions,
 			documentScopeRevision: operation.index + 1
 		});
 		return buildSuccessResult(job, operation, job.documentId, standing.header.documentType, JSON.stringify({
@@ -2868,6 +3682,9 @@ var DocumentActionHandler = class {
 			error: /* @__PURE__ */ new Error(`CREATE_DOCUMENT must be in "document" scope, got "${job.scope}"`),
 			duration: Date.now() - startTime
 		};
+		const input = action.input;
+		const unsupported = this.unsupportedProtocol(input.documentId, input.protocolVersions);
+		if (unsupported) return buildErrorResult(job, unsupported, startTime);
 		const document = createDocumentFromAction(action);
 		let operation = createOperation(action, 0, skip, {
 			documentId: document.header.id,
@@ -2875,8 +3692,8 @@ var DocumentActionHandler = class {
 			branch: job.branch
 		});
 		const resultingStateObj = {
-			header: document.header,
-			...document.state
+			...document.state,
+			header: document.header
 		};
 		const resultingState = JSON.stringify(resultingStateObj);
 		const writeResult = await this.writeOperationToStore({
@@ -2893,7 +3710,7 @@ var DocumentActionHandler = class {
 			[job.scope]: [...document.operations[job.scope] ?? [], operation]
 		};
 		executing.touchedStreams.add(document.header.id, job.scope, job.branch);
-		stores.writeCache.putState(document.header.id, job.scope, job.branch, operation.index, document, SnapshotPosition.Head);
+		stores.writeCache.putState(document.header.id, job.scope, job.branch, operation.index, document, "head");
 		indexTxn.write([{
 			...operation,
 			documentId: document.header.id,
@@ -2910,6 +3727,7 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(document.header.id, job.branch, {
 			state: document.state.document,
 			documentType: document.header.documentType,
+			protocolVersions: document.header.protocolVersions,
 			documentScopeRevision: 1
 		});
 		return buildSuccessResult(job, operation, document.header.id, document.header.documentType, resultingState, startTime);
@@ -2953,7 +3771,7 @@ var DocumentActionHandler = class {
 			[job.scope]: [...document.operations[job.scope] ?? [], operation]
 		};
 		executing.touchedStreams.add(documentId, job.scope, job.branch);
-		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, SnapshotPosition.Head);
+		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, "head");
 		indexTxn.write([{
 			...operation,
 			documentId,
@@ -2965,6 +3783,7 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(documentId, job.branch, {
 			state: document.state.document,
 			documentType: document.header.documentType,
+			protocolVersions: document.header.protocolVersions,
 			documentScopeRevision: operation.index + 1
 		});
 		return buildSuccessResult(job, operation, documentId, document.header.documentType, resultingState, startTime);
@@ -3003,7 +3822,7 @@ var DocumentActionHandler = class {
 				} catch (error) {
 					return buildErrorResult(job, /* @__PURE__ */ new Error(`Failed to fetch revisions for upgrade: ${error instanceof Error ? error.message : String(error)}`), startTime);
 				}
-				const revisionScopes = new Set([...Object.keys(input.revision), ...Object.keys(actualRevisions)]);
+				const revisionScopes = /* @__PURE__ */ new Set([...Object.keys(input.revision), ...Object.keys(actualRevisions)]);
 				for (const revisionScope of revisionScopes) {
 					const snapshot = input.revision[revisionScope] ?? 0;
 					const actual = actualRevisions[revisionScope] ?? 0;
@@ -3045,8 +3864,8 @@ var DocumentActionHandler = class {
 			branch: job.branch
 		});
 		const resultingStateObj = {
-			header: document.header,
-			...document.state
+			...document.state,
+			header: document.header
 		};
 		if (fromVersion > 0) resultingStateObj.__migrated = true;
 		const resultingState = JSON.stringify(resultingStateObj);
@@ -3064,7 +3883,7 @@ var DocumentActionHandler = class {
 			[job.scope]: [...document.operations[job.scope] ?? [], operation]
 		};
 		executing.touchedStreams.add(documentId, job.scope, job.branch);
-		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, SnapshotPosition.Head);
+		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, "head");
 		for (const scope of otherScopes) executing.postCommitInvalidations.push({
 			documentId,
 			scope,
@@ -3081,22 +3900,41 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(documentId, job.branch, {
 			state: document.state.document,
 			documentType: document.header.documentType,
+			protocolVersions: document.header.protocolVersions,
 			documentScopeRevision: operation.index + 1
 		});
 		return buildSuccessResult(job, operation, documentId, document.header.documentType, resultingState, startTime);
 	}
-	executeAddRelationship(write, executing) {
+	/** A submitted write naming a purged target was refused at job start. */
+	async isTargetPurged(write, executing) {
+		const target = relationshipTarget(write.action);
+		if (target === void 0 || !executing.purgeFence) return false;
+		return executing.purgeFence.isPurged(target);
+	}
+	async executeAddRelationship(write, executing) {
+		let targetPurged;
+		try {
+			targetPurged = await this.isTargetPurged(write, executing);
+		} catch (error) {
+			return buildErrorResult(executing.job, error instanceof Error ? error : new Error(String(error)), executing.startTime);
+		}
 		return this.withRelationshipAction("ADD_RELATIONSHIP", write, executing, (input) => input.sourceId === input.targetId ? /* @__PURE__ */ new Error("ADD_RELATIONSHIP: sourceId and targetId cannot be the same (self-relationships not allowed)") : null, ({ indexTxn: txn, stores: s, sourceDoc, input, job: j }) => {
-			if (this.driveContainerTypes.has(sourceDoc.header.documentType)) {
+			if (!targetPurged && this.driveContainerTypes.has(sourceDoc.header.documentType)) {
 				const collectionId = DriveCollectionId.forDrive(input.sourceId, j.branch).key;
 				txn.addToCollection(collectionId, input.targetId);
 				s.collectionMembershipCache.invalidate(input.targetId);
 			}
 		});
 	}
-	executeRemoveRelationship(write, executing) {
+	async executeRemoveRelationship(write, executing) {
+		let targetPurged;
+		try {
+			targetPurged = await this.isTargetPurged(write, executing);
+		} catch (error) {
+			return buildErrorResult(executing.job, error instanceof Error ? error : new Error(String(error)), executing.startTime);
+		}
 		return this.withRelationshipAction("REMOVE_RELATIONSHIP", write, executing, null, ({ indexTxn: txn, stores: s, sourceDoc, input, job: j }) => {
-			if (this.driveContainerTypes.has(sourceDoc.header.documentType)) {
+			if (!targetPurged && this.driveContainerTypes.has(sourceDoc.header.documentType)) {
 				const collectionId = DriveCollectionId.forDrive(input.sourceId, j.branch).key;
 				txn.removeFromCollection(collectionId, input.targetId);
 				s.collectionMembershipCache.invalidate(input.targetId);
@@ -3120,6 +3958,7 @@ var DocumentActionHandler = class {
 		try {
 			sourceDoc = await stores.writeCache.getState(input.sourceId, "document", job.branch, void 0, signal);
 		} catch (error) {
+			if (DocumentPurgedError.isError(error)) return buildErrorResult(job, error, startTime);
 			if (DocumentNotFoundError.isError(error)) return buildErrorResult(job, new DocumentNotFoundError(input.sourceId, `${actionTypeName}: source document ${input.sourceId} not found`), startTime);
 			return buildErrorResult(job, /* @__PURE__ */ new Error(`${actionTypeName}: source document ${input.sourceId} not found: ${error instanceof Error ? error.message : String(error)}`), startTime);
 		}
@@ -3150,7 +3989,7 @@ var DocumentActionHandler = class {
 		const resultingState = JSON.stringify(resultingStateObj);
 		executing.touchedStreams.add(input.sourceId, job.scope, job.branch);
 		executing.touchedStreams.add(input.targetId, job.scope, job.branch);
-		stores.writeCache.putState(input.sourceId, job.scope, job.branch, operation.index, sourceDoc, SnapshotPosition.Head);
+		stores.writeCache.putState(input.sourceId, job.scope, job.branch, operation.index, sourceDoc, "head");
 		indexTxn.write([{
 			...operation,
 			documentId: input.sourceId,
@@ -3169,6 +4008,7 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(input.sourceId, job.branch, {
 			state: sourceDoc.state.document,
 			documentType: sourceDoc.header.documentType,
+			protocolVersions: sourceDoc.header.protocolVersions,
 			documentScopeRevision: operation.index + 1
 		});
 		return buildSuccessResult(job, operation, input.sourceId, sourceDoc.header.documentType, resultingState, startTime);
@@ -3197,55 +4037,669 @@ var DocumentActionHandler = class {
 	}
 };
 //#endregion
-//#region src/executor/signature-verifier.ts
-var SignatureVerifier = class {
-	constructor(verifier) {
-		this.verifier = verifier;
+//#region src/signer/passthrough-signer.ts
+/**
+* A no-op signer that returns empty values for all methods.
+* Used when signing is not required.
+*/
+var PassthroughSigner = class {
+	publicKey = {};
+	sign() {
+		return Promise.resolve(/* @__PURE__ */ new Uint8Array(0));
 	}
-	async verifyActions(documentId, branch, actions) {
-		if (!this.verifier) return;
-		for (const action of actions) {
-			const signer = action.context?.signer;
-			if (!signer) continue;
-			if (signer.signatures.length === 0) throw new InvalidSignatureError(documentId, `Action ${action.id} has signer but no signatures`);
-			const publicKey = signer.app.key;
-			let isValid;
-			try {
-				const tempOperation = {
-					id: deriveOperationId(documentId, action.scope, branch, action.id),
-					index: 0,
-					timestampUtcMs: action.timestampUtcMs || (/* @__PURE__ */ new Date()).toISOString(),
-					hash: "",
-					skip: 0,
-					action
-				};
-				isValid = await this.verifier(tempOperation, publicKey);
-			} catch (error) {
-				const errorMessage = error instanceof Error ? error.message : String(error);
-				throw new InvalidSignatureError(documentId, `Action ${action.id} verification failed: ${errorMessage}`);
-			}
-			if (!isValid) throw new InvalidSignatureError(documentId, `Action ${action.id} signature verification returned false`);
+	verify() {
+		return Promise.resolve();
+	}
+	signAction() {
+		return Promise.resolve([
+			"",
+			"",
+			"",
+			"",
+			""
+		]);
+	}
+};
+//#endregion
+//#region src/signer/trust-policy.ts
+/**
+* The policy admission asks: the reactor's own key signing as its own user is
+* accepted, then the host's policy decides, else the default does. `own` is
+* read on every ask, since its user changes on login.
+*/
+function admissionTrustPolicy(own, authEnforcement, policy) {
+	return { authorizeSigner(signer, key, documentId) {
+		const identity = actionSignerIdentity(own);
+		if (identity.app.key !== "" && key === identity.app.key) {
+			if (sameUser(actionSignerIdentity(signer).user, identity.user)) return Promise.resolve(true);
 		}
+		if (policy) return policy.authorizeSigner(signer, key, documentId);
+		return Promise.resolve(!authEnforcement);
+	} };
+}
+function sameUser(a, b) {
+	return a.address.toLowerCase() === b.address.toLowerCase() && a.networkId === b.networkId && a.chainId === b.chainId;
+}
+//#endregion
+//#region src/signer/did-key.ts
+const DID_KEY_PREFIX = "did:key:z";
+const P256_MULTICODEC = [128, 36];
+const MAX_CACHED_KEYS = 1024;
+const P = BigInt("0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff");
+const A = BigInt("0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc");
+const B = BigInt("0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b");
+/** A did:key that is not a compressed P-256 public key. */
+var MalformedDidKeyError = class extends Error {
+	constructor(did, detail) {
+		super(`Malformed did:key ${did}: ${detail}`);
+		this.name = "MalformedDidKeyError";
 	}
-	async verifyOperations(documentId, operations) {
-		if (!this.verifier) return;
-		for (let i = 0; i < operations.length; i++) {
-			const operation = operations[i];
-			const signer = operation.action.context?.signer;
-			if (!signer) continue;
-			if (signer.signatures.length === 0) throw new InvalidSignatureError(documentId, `Operation ${operation.id} at index ${operation.index} has signer but no signatures`);
-			const publicKey = signer.app.key;
-			let isValid;
-			try {
-				isValid = await this.verifier(operation, publicKey);
-			} catch (error) {
-				const errorMessage = error instanceof Error ? error.message : String(error);
-				throw new InvalidSignatureError(documentId, `Operation ${operation.id} at index ${operation.index} verification failed: ${errorMessage}`);
+};
+const keyCache = /* @__PURE__ */ new Map();
+/** Cached per process: decompressing the point costs a BigInt modPow. */
+async function importDidKey(did) {
+	const cached = keyCache.get(did);
+	if (cached) {
+		keyCache.delete(did);
+		keyCache.set(did, cached);
+		return cached;
+	}
+	const raw = decompressP256(compressedPointFromDid(did), did);
+	const key = await crypto.subtle.importKey("raw", raw.buffer, {
+		name: "ECDSA",
+		namedCurve: "P-256"
+	}, false, ["verify"]);
+	keyCache.set(did, key);
+	if (keyCache.size > MAX_CACHED_KEYS) {
+		const oldest = keyCache.keys().next().value;
+		if (oldest !== void 0) keyCache.delete(oldest);
+	}
+	return key;
+}
+function compressedPointFromDid(did) {
+	if (!did.startsWith(DID_KEY_PREFIX)) throw new MalformedDidKeyError(did, "not a base58btc did:key");
+	const decoded = base58Decode(did.slice(9));
+	if (!decoded || decoded.length !== 35) throw new MalformedDidKeyError(did, "not a compressed P-256 key");
+	if (decoded[0] !== P256_MULTICODEC[0] || decoded[1] !== P256_MULTICODEC[1]) throw new MalformedDidKeyError(did, "not a P-256 multicodec");
+	return decoded.subarray(2);
+}
+function decompressP256(compressed, did) {
+	const prefix = compressed[0];
+	if (prefix !== 2 && prefix !== 3) throw new MalformedDidKeyError(did, `compression prefix ${prefix}`);
+	let x = BigInt(0);
+	for (let i = 1; i < compressed.length; i++) x = x << BigInt(8) | BigInt(compressed[i]);
+	if (x >= P) throw new MalformedDidKeyError(did, "x outside the field");
+	const ySquared = (modPow(x, BigInt(3), P) + A * x + B) % P;
+	let y = modPow(ySquared, (P + BigInt(1)) / BigInt(4), P);
+	if (y * y % P !== ySquared) throw new MalformedDidKeyError(did, "x is not on the curve");
+	if (y % BigInt(2) === BigInt(0) !== (prefix === 2)) y = P - y;
+	const uncompressed = /* @__PURE__ */ new Uint8Array(65);
+	uncompressed[0] = 4;
+	uncompressed.set(bigIntToBytes(x), 1);
+	uncompressed.set(bigIntToBytes(y), 33);
+	return uncompressed;
+}
+function modPow(base, exp, mod) {
+	let result = BigInt(1);
+	let b = base % mod;
+	let e = exp;
+	while (e > BigInt(0)) {
+		if (e & BigInt(1)) result = result * b % mod;
+		e >>= BigInt(1);
+		b = b * b % mod;
+	}
+	return result;
+}
+function bigIntToBytes(value) {
+	const bytes = /* @__PURE__ */ new Uint8Array(32);
+	let v = value;
+	for (let i = 31; i >= 0; i--) {
+		bytes[i] = Number(v & BigInt(255));
+		v >>= BigInt(8);
+	}
+	return bytes;
+}
+//#endregion
+//#region src/signer/verify-action-signature.ts
+const RENOWN_HASH_LENGTH = 44;
+const SHARED_HASH_LENGTH = 28;
+const HEX_SIGNATURE = /^(0x)?([0-9a-fA-F]{2})+$/;
+/**
+* Integrity only: identity binding and the live-id check sit with the caller.
+* `operation` is the incoming operation at load admission.
+*/
+async function verifyActionSignature(action, target, path, operation) {
+	const policy = target.policy ?? "legacy";
+	const refusal = policyRefusal(action, policy);
+	if (refusal) return refusal;
+	const shape = signerShape(action.context?.signer);
+	if (shape.kind === "unsigned") return policy === "v2-required" ? refuse("unsigned", "UNSIGNED_REQUIRED", `action ${action.id} is unsigned but ${target.documentId} requires v2 signatures`) : {
+		ok: true,
+		scheme: "unsigned"
+	};
+	if (shape.kind === "malformed") return refuse("legacy-unknown", "MALFORMED_TUPLE", `action ${action.id} ${shape.reason}`);
+	const { signer, tuple } = shape;
+	const scheme = schemeOf(tuple[2]);
+	if (tuple[1] !== signer.app.key) return refuse(scheme, "KEY_MISMATCH", `action ${action.id} tuple key does not match signer.app.key`);
+	if (scheme !== "v2" && policy === "v2-required") return refuse(scheme, "SCHEME_BELOW_POLICY", `action ${action.id} carries a legacy tuple but ${target.documentId} requires v2 signatures`);
+	if (scheme === "legacy-unknown" && path === "mutation") return refuse(scheme, "MALFORMED_TUPLE", `action ${action.id} carries a hash of unknown length ${tuple[2].length}`);
+	if (scheme === "v2") {
+		const refusal = await checkV2(action, tuple, target, operation);
+		if (refusal) return refusal;
+	} else if (path === "mutation") {
+		if (await legacyHash(scheme, action, target) !== tuple[2]) return refuse(scheme, "HASH_MISMATCH", `action ${action.id} does not match the hash its signature covers`);
+	}
+	return verifyEcdsa(tuple, scheme, action.id);
+}
+/** Refusals a document's policy makes before any tuple is read. */
+function policyRefusal(action, policy) {
+	if (action.type !== "CREATE_DOCUMENT") return;
+	const scheme = schemeOfAction(action);
+	const input = action.input;
+	const documentId = input?.documentId ?? "";
+	if (policy === "legacy") return isDerivedDocumentId(documentId) ? refuse(scheme, "ID_MISMATCH", `action ${action.id}: a legacy document cannot take the content-addressed id ${documentId}`) : void 0;
+	const expected = derivedCreateId(input);
+	if (expected === documentId) return;
+	return refuse(scheme, "ID_MISMATCH", expected === void 0 ? `action ${action.id} creates v2-required ${documentId} without the header params its id is derived from` : `action ${action.id} creates v2-required ${documentId}, but its header params derive ${expected}`);
+}
+function derivedCreateId(input) {
+	if (!input?.signing || !input.protocolVersions) return;
+	try {
+		return deriveDocumentId({
+			documentType: input.model,
+			createdAtUtcIso: input.signing.createdAtUtcIso,
+			nonce: input.signing.nonce,
+			protocolVersions: input.protocolVersions
+		});
+	} catch {
+		return;
+	}
+}
+function schemeOfAction(action) {
+	const shape = signerShape(action.context?.signer);
+	if (shape.kind === "unsigned") return "unsigned";
+	return shape.kind === "signed" ? schemeOf(shape.tuple[2]) : "legacy-unknown";
+}
+/** Peers send arbitrary JSON, so nothing past `context` is assumed. */
+function signerShape(value) {
+	if (value === void 0 || value === null) return { kind: "unsigned" };
+	if (!isRecord(value)) return {
+		kind: "malformed",
+		reason: "has a signer that is not an object"
+	};
+	const { app, user, signatures } = value;
+	if (app !== void 0 && app !== null && !isRecord(app)) return {
+		kind: "malformed",
+		reason: "has a signer.app that is not an object"
+	};
+	const key = isRecord(app) ? app.key : void 0;
+	if (key !== void 0 && key !== null && typeof key !== "string") return {
+		kind: "malformed",
+		reason: "has a signer.app.key that is not a string"
+	};
+	if (!key) return { kind: "unsigned" };
+	if (!isRecord(user) || typeof user.address !== "string") return {
+		kind: "malformed",
+		reason: "has a signer without a user address"
+	};
+	if (!Array.isArray(signatures)) return {
+		kind: "malformed",
+		reason: "has a signer whose signatures are not a list"
+	};
+	const tuple = signatures.at(-1);
+	if (!isTuple(tuple)) return {
+		kind: "malformed",
+		reason: signatures.length === 0 ? "has a signer but no signatures" : "carries a malformed signature tuple"
+	};
+	return {
+		kind: "signed",
+		signer: value,
+		tuple
+	};
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function checkV2(action, tuple, target, operation) {
+	const problem = v2TupleProblem(tuple);
+	if (problem) return refuse("v2", "MALFORMED_TUPLE", `action ${action.id}: ${problem}`);
+	if (operation && !sameInstant(operation.timestampUtcMs, action.timestampUtcMs)) return refuse("v2", "TIMESTAMP_MISMATCH", `action ${action.id} is stamped ${action.timestampUtcMs} but its operation ${operation.timestampUtcMs}`);
+	let expected;
+	try {
+		expected = await hashActionV2(action, target, action.context.signer);
+	} catch (error) {
+		return refuse("v2", "HASH_MISMATCH", `action ${action.id} has no v2 hash: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (expected !== tuple[2]) return refuse("v2", "HASH_MISMATCH", `action ${action.id} does not match the hash its signature covers`);
+}
+function sameInstant(a, b) {
+	const left = Date.parse(a);
+	return !Number.isNaN(left) && left === Date.parse(b);
+}
+function schemeOf(hash) {
+	if (isV2ActionHash(hash)) return "v2";
+	if (hash.length === RENOWN_HASH_LENGTH) return "legacy-renown";
+	if (hash.length === SHARED_HASH_LENGTH) return "legacy-shared";
+	return "legacy-unknown";
+}
+async function legacyHash(scheme, action, target) {
+	if (scheme === "legacy-renown") {
+		const payload = [
+			action.scope,
+			action.type,
+			JSON.stringify(action.input)
+		].join("");
+		const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(payload));
+		return bytesToBase64(new Uint8Array(digest));
+	}
+	const signer = action.context.signer;
+	return buildOperationSignatureParams({
+		documentId: target.documentId,
+		signer,
+		action,
+		previousStateHash: ""
+	})[2];
+}
+async function verifyEcdsa(tuple, scheme, actionId) {
+	const [timestamp, key, hash, prevStateHash, signatureHex] = tuple;
+	if (!HEX_SIGNATURE.test(signatureHex)) return refuse(scheme, "MALFORMED_TUPLE", `action ${actionId} signature is not hex`);
+	let cryptoKey;
+	try {
+		cryptoKey = await importDidKey(key);
+	} catch (error) {
+		return refuse(scheme, "MALFORMED_TUPLE", `action ${actionId}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	const message = buildOperationSignatureMessage([
+		timestamp,
+		key,
+		hash,
+		prevStateHash
+	]);
+	let valid;
+	try {
+		valid = await crypto.subtle.verify({
+			name: "ECDSA",
+			hash: "SHA-256"
+		}, cryptoKey, hexToBytes(signatureHex).buffer, message.buffer);
+	} catch {
+		valid = false;
+	}
+	if (!valid) return refuse(scheme, "BAD_SIGNATURE", `action ${actionId} signature does not verify under its key`);
+	return {
+		ok: true,
+		scheme
+	};
+}
+function isTuple(value) {
+	return Array.isArray(value) && value.length === 5 && value.every((element) => typeof element === "string");
+}
+function refuse(scheme, code, reason) {
+	return {
+		ok: false,
+		scheme,
+		code,
+		reason
+	};
+}
+function hexToBytes(hex) {
+	const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
+	const bytes = new Uint8Array(clean.length / 2);
+	for (let i = 0; i < bytes.length; i++) bytes[i] = parseInt(clean.substring(i * 2, i * 2 + 2), 16);
+	return bytes;
+}
+function bytesToBase64(bytes) {
+	let binary = "";
+	for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+	return btoa(binary);
+}
+//#endregion
+//#region src/executor/synthesized-signing.ts
+/** Submitted types whose stored action the reducer writes in their place. */
+const SYNTHESIZING_TYPES = /* @__PURE__ */ new Set(["UNDO", "REDO"]);
+/**
+* The id of the action synthesized from `submittedId`. Derived, so the stored
+* operation answers for the submitted id at the live-id check.
+*/
+function synthesizedActionId(submittedId) {
+	return hashBrowser(`synthesized:${submittedId}`, "sha1", "hex").slice(0, 32);
+}
+/**
+* Whether `operation` stores an action the reducer made from `submitted`
+* rather than `submitted` itself or an operation already in `history`.
+*/
+function isSynthesized(submitted, operation, history) {
+	if (!SYNTHESIZING_TYPES.has(submitted.type)) return false;
+	const id = operation.action.id;
+	if (!id) return true;
+	if (id === submitted.id) return false;
+	return !history.some((existing) => existing.action.id === id);
+}
+/**
+* Signs the synthesized action of `operation` in place as `signer`, under the
+* id {@link synthesizedActionId} derives from the submitted one. A REDO's
+* rebuilt action has no timestamp, so it takes the submitted one; the
+* operation timestamp is set to the action's, which a peer requires of a v2
+* tuple.
+*/
+async function signSynthesized(operation, submitted, target, signer, signal) {
+	const synthesized = operation.action;
+	const id = synthesizedActionId(submitted.id);
+	const timestampUtcMs = operation.timestampUtcMs || synthesized.timestampUtcMs || submitted.timestampUtcMs;
+	const action = {
+		id,
+		timestampUtcMs,
+		type: synthesized.type,
+		input: synthesized.input,
+		scope: synthesized.scope
+	};
+	const signature = await signer.signAction(action, {
+		documentId: target.documentId,
+		branch: target.branch
+	}, signal);
+	operation.action = {
+		...action,
+		context: { signer: {
+			...actionSignerIdentity(signer),
+			signatures: [signature]
+		} }
+	};
+	operation.id = deriveOperationId(target.documentId, target.scope, target.branch, id);
+	operation.timestampUtcMs = timestampUtcMs;
+}
+//#endregion
+//#region src/executor/signature-admission.ts
+const DEFAULT_TRUST_TIMEOUT_MS = 1e4;
+/** Runs once per write, when this reactor first stores it; never on re-appends. */
+var SignatureAdmission = class {
+	mode;
+	logger;
+	eventBus;
+	policySource;
+	trustPolicy;
+	trustTimeoutMs;
+	constructor(mode, logger, eventBus, policySource = "meta", trust = {
+		authEnforcement: false,
+		timeoutMs: DEFAULT_TRUST_TIMEOUT_MS
+	}) {
+		this.mode = mode;
+		this.logger = logger;
+		this.eventBus = eventBus;
+		this.policySource = policySource;
+		this.trustPolicy = admissionTrustPolicy(trust.signer ?? new PassthroughSigner(), trust.authEnforcement, trust.policy);
+		this.trustTimeoutMs = trust.timeoutMs;
+	}
+	/** The first refusal of a mutation's submitted actions, when enforcing. */
+	async admitMutation(job, stores, signal) {
+		const { operationStore } = stores;
+		const candidates = job.actions.map((action) => candidate(action, mutationStream(action, job)));
+		const live = await this.liveOperationIds(candidates, operationStore, signal);
+		const committed = await this.storedAsSubmitted(candidates, live, isRetry(job), operationStore, signal);
+		await resolvePolicies(candidates, job.actions, (documentId, branch) => storedPolicy(stores, this.policySource, documentId, branch, signal));
+		const submitted = /* @__PURE__ */ new Set();
+		for (const entry of candidates) {
+			if (committed.has(entry)) continue;
+			const verdict = await this.verdict(entry, live, submitted, "mutation", signal);
+			submitted.add(entry.opId);
+			if (verdict.ok) continue;
+			const refusal = this.record(job, entry, verdict, "mutation");
+			if (refusal) return {
+				kind: "refused",
+				error: refusal
+			};
+		}
+		return {
+			kind: "admitted",
+			committed: [...committed.values()]
+		};
+	}
+	/** The incoming operations a load drops, empty unless enforcing. */
+	async admitLoad(job, operations, stores, signal) {
+		const { operationStore } = stores;
+		const stream = {
+			documentId: job.documentId,
+			scope: job.scope,
+			branch: job.branch
+		};
+		const candidates = operations.map((operation) => ({
+			...candidate(operation.action, stream),
+			operation
+		}));
+		const live = await this.liveOperationIds(candidates, operationStore, signal);
+		const redelivered = await this.redelivered(candidates, live, operationStore, signal);
+		await resolvePolicies(candidates, job.operations.map((operation) => operation.action), (documentId, branch) => storedPolicy(stores, this.policySource, documentId, branch, signal));
+		const dropped = /* @__PURE__ */ new Set();
+		for (let i = 0; i < candidates.length; i++) {
+			const verdict = await this.verdict(candidates[i], live, void 0, "load", signal, redelivered.has(candidates[i]));
+			if (verdict.ok) continue;
+			if (this.record(job, candidates[i], verdict, "load")) dropped.add(operations[i]);
+		}
+		return dropped;
+	}
+	/** A marker is held to v2 and enforced whatever the policy and mode. */
+	async admitMarker(job, marker, signal) {
+		const entry = {
+			...candidate(marker.action, {
+				documentId: job.documentId,
+				scope: "document",
+				branch: job.branch
+			}),
+			operation: marker,
+			policy: "v2-required"
+		};
+		const verdict = await this.verdict(entry, /* @__PURE__ */ new Set(), void 0, "load", signal);
+		if (verdict.ok) return;
+		return this.record(job, entry, verdict, "load", true);
+	}
+	async verdict(entry, live, submitted, path, signal, known = false) {
+		const verdict = await verifyActionSignature(entry.action, {
+			documentId: entry.stream.documentId,
+			branch: entry.stream.branch,
+			policy: entry.policy
+		}, path, entry.operation);
+		if (!verdict.ok) return verdict;
+		if (!known && (isLive(entry, live) || submitted?.has(entry.opId))) return {
+			ok: false,
+			scheme: verdict.scheme,
+			code: "DUPLICATE_ACTION",
+			reason: `action ${entry.action.id} is already in the stream`
+		};
+		if (verdict.scheme === "unsigned") {
+			const address = entry.action.context?.signer?.user?.address;
+			return address ? {
+				ok: false,
+				scheme: "unsigned",
+				code: "UNSIGNED_IDENTITY",
+				reason: `action ${entry.action.id} is unsigned but claims to act as ${address}`
+			} : verdict;
+		}
+		if (known) return verdict;
+		const signer = entry.action.context.signer;
+		if (!await this.authorize(signer, entry.stream.documentId, signal)) return {
+			ok: false,
+			scheme: verdict.scheme,
+			code: "SIGNER_UNAUTHORIZED",
+			reason: `action ${entry.action.id}: key ${signer.app.key} may not sign as ${signer.user.address}`
+		};
+		return verdict;
+	}
+	/** Throws when the policy does, times out or the job is aborted. */
+	async authorize(signer, documentId, signal) {
+		signal?.throwIfAborted();
+		let timer;
+		let onAbort;
+		const stop = new Promise((_, reject) => {
+			timer = setTimeout(() => {
+				reject(/* @__PURE__ */ new Error(`signature trust policy did not answer for ${signer.app.key} within ${this.trustTimeoutMs}ms`));
+			}, this.trustTimeoutMs);
+			if (signal) {
+				onAbort = () => reject(signal.reason instanceof Error ? signal.reason : new Error(String(signal.reason)));
+				signal.addEventListener("abort", onAbort, { once: true });
 			}
-			if (!isValid) throw new InvalidSignatureError(documentId, `Operation ${operation.id} at index ${operation.index} signature verification returned false`);
+		});
+		try {
+			return await Promise.race([this.trustPolicy.authorizeSigner(signer, signer.app.key, documentId), stop]);
+		} finally {
+			clearTimeout(timer);
+			if (onAbort) signal?.removeEventListener("abort", onAbort);
+		}
+	}
+	/**
+	* The live candidates stored exactly as submitted and still standing: one
+	* an undo or a reshuffle has since superseded is refused, not re-emitted with
+	* the state it once produced. A synthesized operation
+	* holds another action, so it cannot be compared; only a retry, whose first
+	* attempt this job was, takes it as committed.
+	*/
+	async storedAsSubmitted(candidates, live, retry, operationStore, signal) {
+		const committed = /* @__PURE__ */ new Map();
+		const toCompare = [];
+		for (const entry of candidates) if (entry.synthesizedOpId && live.has(entry.synthesizedOpId)) {
+			if (retry) committed.set(entry, committedWrite(entry, entry.synthesizedOpId));
+		} else if (live.has(entry.opId)) toCompare.push(entry);
+		for (const [stream, entries] of byStream(toCompare)) {
+			const stored = await operationStore.getOperationsByIds(stream.documentId, stream.scope, stream.branch, entries.map((entry) => entry.opId), signal);
+			const byId = new Map(stored.map((operation) => [operation.id, operation]));
+			const matching = entries.filter((entry) => {
+				const operation = byId.get(entry.opId);
+				return operation && sameContent(operation.action, entry.action);
+			});
+			if (matching.length === 0) continue;
+			const later = await operationStore.getSince(stream.documentId, stream.scope, stream.branch, Math.min(...matching.map((entry) => byId.get(entry.opId).index)), void 0, void 0, signal);
+			for (const entry of matching) if (!isSuperseded(byId.get(entry.opId), later.results)) committed.set(entry, committedWrite(entry, entry.opId));
 		}
+		return committed;
+	}
+	/**
+	* The load candidates stored exactly as they arrive, timestamp included: a
+	* peer re-sending what this stream holds, not a replay of its action.
+	*/
+	async redelivered(candidates, live, operationStore, signal) {
+		const found = /* @__PURE__ */ new Set();
+		const toCompare = candidates.filter((entry) => live.has(entry.opId) && !(entry.synthesizedOpId && live.has(entry.synthesizedOpId)));
+		for (const [stream, entries] of byStream(toCompare)) {
+			const stored = await operationStore.getOperationsByIds(stream.documentId, stream.scope, stream.branch, entries.map((entry) => entry.opId), signal);
+			for (const entry of entries) if (stored.some((operation) => operation.id === entry.opId && Date.parse(operation.timestampUtcMs) === Date.parse(entry.operation?.timestampUtcMs ?? "") && sameContent(operation.action, entry.action))) found.add(entry);
+		}
+		return found;
+	}
+	async liveOperationIds(candidates, operationStore, signal) {
+		const live = /* @__PURE__ */ new Set();
+		for (const [stream, entries] of byStream(candidates)) {
+			const found = await operationStore.findOperationIds(stream.documentId, stream.scope, stream.branch, entries.flatMap((entry) => entry.synthesizedOpId ? [entry.opId, entry.synthesizedOpId] : [entry.opId]), signal);
+			for (const opId of found) live.add(opId);
+		}
+		return live;
+	}
+	/** Logs and counts a refusal; returns the error only when enforcing. */
+	record(job, entry, refusal, path, enforced = this.mode === "enforce") {
+		const event = {
+			jobId: job.id,
+			documentId: entry.stream.documentId,
+			scope: entry.stream.scope,
+			branch: entry.stream.branch,
+			actionId: entry.action.id,
+			code: refusal.code,
+			scheme: refusal.scheme,
+			path,
+			enforced,
+			reason: refusal.reason
+		};
+		this.logger.warn(enforced ? "Signature refused: @Refusal" : "Signature refusal logged, write admitted: @Refusal", event);
+		this.eventBus.emit(ReactorEventTypes.SIGNATURE_REFUSED, event).catch((error) => {
+			this.logger.error("Failed to emit SIGNATURE_REFUSED: @Error", error);
+		});
+		return enforced ? new InvalidSignatureError(entry.stream.documentId, refusal.code, refusal.reason) : void 0;
 	}
 };
+/**
+* A CREATE_DOCUMENT is verified under its own input. Anything else takes the
+* stored document's policy, or, for a document this job creates, that CREATE's.
+*/
+async function resolvePolicies(candidates, jobActions, stored) {
+	const resolved = /* @__PURE__ */ new Map();
+	for (const entry of candidates) {
+		if (entry.action.type === "CREATE_DOCUMENT") {
+			entry.policy = createPolicy(entry.action);
+			continue;
+		}
+		const { documentId, branch } = entry.stream;
+		const key = `${documentId}\u0000${branch}`;
+		let policy = resolved.get(key);
+		if (policy === void 0) {
+			policy = await stored(documentId, branch) ?? createdPolicy(jobActions, documentId) ?? "legacy";
+			resolved.set(key, policy);
+		}
+		entry.policy = policy;
+	}
+}
+async function storedPolicy(stores, source, documentId, branch, signal) {
+	try {
+		if (source === "write-cache") {
+			const document = await stores.writeCache.getState(documentId, "document", branch, void 0, signal);
+			return signaturePolicyOf(document.header);
+		}
+		const meta = await stores.documentMetaCache.getDocumentMeta(documentId, branch, signal);
+		return signaturePolicyOf(meta.protocolVersions);
+	} catch (error) {
+		if (DocumentNotFoundError.isError(error)) return;
+		throw error;
+	}
+}
+function createdPolicy(actions, documentId) {
+	const create = actions.find((action) => action.type === "CREATE_DOCUMENT" && action.input?.documentId === documentId);
+	return create ? createPolicy(create) : void 0;
+}
+function createPolicy(action) {
+	return signaturePolicyOf(action.input);
+}
+function candidate(action, stream) {
+	const opId = (actionId) => deriveOperationId(stream.documentId, stream.scope, stream.branch, actionId);
+	return {
+		action,
+		stream,
+		opId: opId(action.id),
+		synthesizedOpId: SYNTHESIZING_TYPES.has(action.type) ? opId(synthesizedActionId(action.id)) : void 0
+	};
+}
+function isLive(entry, live) {
+	return live.has(entry.opId) || entry.synthesizedOpId !== void 0 && live.has(entry.synthesizedOpId);
+}
+function mutationStream(action, job) {
+	return {
+		...actionSigningTarget(action, job.documentId, job.branch),
+		scope: job.scope
+	};
+}
+function byStream(candidates) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const entry of candidates) {
+		const key = `${entry.stream.documentId}\u0000${entry.stream.scope}\u0000${entry.stream.branch}`;
+		const group = groups.get(key) ?? [entry.stream, []];
+		group[1].push(entry);
+		groups.set(key, group);
+	}
+	return [...groups.values()];
+}
+function isRetry(job) {
+	return job.errorHistory.length > 0 || (job.retryCount ?? 0) > 0;
+}
+function committedWrite(entry, opId) {
+	return {
+		...entry.stream,
+		actionId: entry.action.id,
+		opId
+	};
+}
+function isSuperseded(operation, later) {
+	return later.some((next) => next.index > operation.index && next.skip > 0 && next.index - next.skip <= operation.index);
+}
+function sameContent(stored, submitted) {
+	try {
+		return canonicalJson(stored) === canonicalJson(submitted);
+	} catch {
+		return false;
+	}
+}
 //#endregion
 //#region src/executor/simple-job-executor.ts
 const MAX_SKIP_THRESHOLD = 1e3;
@@ -3262,7 +4716,32 @@ function isValidISOTimestamp(value) {
 * returned JobResult there, which is what the queue, the worker protocol and
 * every test expect a failed job to look like.
 */
+/** The ids of a purge job's request, which a drive purge may precede. */
+function purgeRequestDocumentIds(job) {
+	const ids = job.meta.purgeRequestDocumentIds;
+	return Array.isArray(ids) ? ids.filter((id) => typeof id === "string") : [];
+}
+const MARKER_INPUT_KEYS = /* @__PURE__ */ new Set([
+	"documentId",
+	"documentType",
+	"purgedAtUtcIso",
+	"requestId"
+]);
+/** A peer's marker must name this job's id on main and carry nothing else. */
+function malformedMarker(job) {
+	const action = job.operations.find((operation) => isPurgeMarker(operation))?.action;
+	const input = action?.input;
+	const refuse = (reason) => new InvalidSignatureError(job.documentId, "ID_MISMATCH", `marker ${action?.id ?? "?"} ${reason}`);
+	if (typeof input !== "object" || input === null) return refuse("carries no input");
+	const extra = Object.keys(input).filter((key) => !MARKER_INPUT_KEYS.has(key));
+	if (extra.length > 0) return refuse(`carries unexpected input ${extra.join(", ")}`);
+	for (const key of MARKER_INPUT_KEYS) if (typeof input[key] !== "string" || input[key] === "") return refuse(`input.${key} is not a non-empty string`);
+	const purgedAt = Date.parse(input.purgedAtUtcIso);
+	if (Number.isNaN(purgedAt) || new Date(purgedAt).toISOString() !== input.purgedAtUtcIso) return refuse("input.purgedAtUtcIso is not an ISO timestamp");
+	if (input.documentId !== job.documentId || job.branch !== "main" || action?.scope !== "document") return refuse(`does not purge ${job.documentId} on document/main`);
+}
 var JobRollbackSignal = class extends Error {
+	result;
 	constructor(result) {
 		super("job rolled back");
 		this.result = result;
@@ -3270,13 +4749,27 @@ var JobRollbackSignal = class extends Error {
 	}
 };
 var SimpleJobExecutor = class {
+	logger;
+	registry;
+	operationStore;
+	eventBus;
+	writeCache;
+	operationIndex;
+	documentMetaCache;
+	collectionMembershipCache;
+	driveContainerTypes;
 	config;
 	featureFlags;
 	decisionModel;
-	signatureVerifierModule;
+	signatureAdmission;
 	documentActionHandler;
 	executionScope;
-	constructor(logger, registry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, driveContainerTypes, config, signatureVerifier, executionScope) {
+	signer;
+	/**
+	* `signer` signs the operations the reducer synthesizes; unsigned if omitted.
+	* `trustPolicy` decides which keys may sign as which users at admission.
+	*/
+	constructor(logger, registry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, driveContainerTypes, config, executionScope, signer, trustPolicy) {
 		this.logger = logger;
 		this.registry = registry;
 		this.operationStore = operationStore;
@@ -3286,6 +4779,8 @@ var SimpleJobExecutor = class {
 		this.documentMetaCache = documentMetaCache;
 		this.collectionMembershipCache = collectionMembershipCache;
 		this.driveContainerTypes = driveContainerTypes;
+		this.signer = signer ?? new PassthroughSigner();
+		this.featureFlags = resolveFeatureFlags(config.featureFlags);
 		this.config = {
 			featureFlags: config.featureFlags ?? {},
 			maxSkipThreshold: config.maxSkipThreshold ?? MAX_SKIP_THRESHOLD,
@@ -3295,12 +4790,19 @@ var SimpleJobExecutor = class {
 			retryBaseDelayMs: config.retryBaseDelayMs ?? 100,
 			retryMaxDelayMs: config.retryMaxDelayMs ?? 5e3,
 			yieldDeadlineMs: config.yieldDeadlineMs ?? 50,
-			batchApplies: config.batchApplies ?? true
+			batchApplies: config.batchApplies ?? true,
+			signatureVerification: config.signatureVerification ?? "enforce",
+			protocolSupport: config.protocolSupport ?? localSupports(PEER_CAPABILITIES, this.featureFlags).protocols,
+			maxPurgeOperations: config.maxPurgeOperations ?? 2e5
 		};
-		this.featureFlags = resolveFeatureFlags(config.featureFlags);
 		this.decisionModel = selectDecisionModel(this.featureFlags, registry);
-		this.signatureVerifierModule = new SignatureVerifier(signatureVerifier);
-		this.documentActionHandler = new DocumentActionHandler(registry, logger, driveContainerTypes, this.featureFlags, this.decisionModel);
+		this.signatureAdmission = new SignatureAdmission(this.config.signatureVerification, logger, eventBus, this.featureFlags.documentDecisions ? "write-cache" : "meta", {
+			signer: this.signer,
+			authEnforcement: this.featureFlags.authEnforcement,
+			policy: trustPolicy,
+			timeoutMs: Math.min(DEFAULT_TRUST_TIMEOUT_MS, this.config.jobTimeoutMs / 2)
+		});
+		this.documentActionHandler = new DocumentActionHandler(registry, logger, driveContainerTypes, this.featureFlags, this.decisionModel, this.config.protocolSupport);
 		this.executionScope = executionScope ?? new DefaultExecutionScope(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache);
 	}
 	/**
@@ -3327,6 +4829,7 @@ var SimpleJobExecutor = class {
 		const touchedStreams = new TouchedStreams();
 		const postCommitInvalidations = [];
 		const postCommitMembershipInvalidations = [];
+		const postCommitMetaInvalidations = [];
 		let outcome;
 		try {
 			outcome = await this.executionScope.run(async (stores) => {
@@ -3337,7 +4840,8 @@ var SimpleJobExecutor = class {
 					signal,
 					touchedStreams,
 					postCommitInvalidations,
-					postCommitMembershipInvalidations
+					postCommitMembershipInvalidations,
+					postCommitMetaInvalidations
 				});
 				if (!scoped.result.success) throw new JobRollbackSignal(scoped.result);
 				return scoped;
@@ -3349,6 +4853,7 @@ var SimpleJobExecutor = class {
 		}
 		for (const entry of postCommitInvalidations) this.writeCache.invalidate(entry.documentId, entry.scope, entry.branch);
 		for (const documentId of postCommitMembershipInvalidations) this.collectionMembershipCache.invalidate(documentId);
+		for (const documentId of postCommitMetaInvalidations) this.documentMetaCache.invalidate(documentId);
 		const { pendingEvent } = outcome;
 		if (pendingEvent) this.eventBus.emit(ReactorEventTypes.JOB_WRITE_READY, pendingEvent).catch((error) => {
 			this.logger.error("Failed to emit JOB_WRITE_READY event: @Event : @Error", pendingEvent, error);
@@ -3364,8 +4869,38 @@ var SimpleJobExecutor = class {
 	* has not committed yet has nothing to announce.
 	*/
 	async executeInScope(params) {
-		const { job, startTime, stores, signal, touchedStreams, postCommitInvalidations, postCommitMembershipInvalidations } = params;
+		const { job, startTime, stores: scopeStores, signal, touchedStreams, postCommitInvalidations, postCommitMembershipInvalidations } = params;
 		let pendingEvent;
+		if (job.kind === "mutation") {
+			const reserved = job.actions.find((action) => isPurgeMarker(action));
+			if (reserved) return { result: buildErrorResult(job, new ReservedActionError(job.documentId, reserved.type), startTime) };
+		}
+		if (job.kind === "purge" || job.kind === "load" && job.operations.some((op) => isPurgeMarker(op))) return this.executePurge(params);
+		const lockedIds = jobWriteIds(job);
+		const lockFailure = (error) => ({ result: buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime) });
+		try {
+			await scopeStores.documentLocks.shared(lockedIds);
+		} catch (error) {
+			return lockFailure(error);
+		}
+		let purged;
+		try {
+			purged = await scopeStores.documentLocks.purged(lockedIds);
+		} catch (error) {
+			return lockFailure(error);
+		}
+		const purgedRefusal = this.purgedRefusal(job, purged);
+		if (purgedRefusal) return { result: buildErrorResult(job, purgedRefusal, startTime) };
+		const purgeFence = new PurgeFence(scopeStores.documentLocks, new Set(lockedIds), purged);
+		const stores = {
+			...scopeStores,
+			writeCache: new FencedWriteCache(scopeStores.writeCache, purgeFence, (documentId) => {
+				scopeStores.writeCache.invalidate(documentId);
+				scopeStores.documentMetaCache.invalidate(documentId);
+			})
+		};
+		const unsupported = await this.unsupportedStoredProtocol(job, stores, signal);
+		if (unsupported) return { result: buildErrorResult(job, unsupported, startTime) };
 		const indexTxn = stores.operationIndex.start();
 		if (job.kind === "load") {
 			const loadResult = await this.executeLoadJob({
@@ -3378,7 +4913,8 @@ var SimpleJobExecutor = class {
 				evaluatedByPosition: false,
 				postCommitInvalidations,
 				postCommitMembershipInvalidations,
-				touchedStreams
+				touchedStreams,
+				purgeFence
 			});
 			if (loadResult.success && loadResult.operationsWithContext) {
 				const ordinals = await stores.operationIndex.commit(indexTxn, signal);
@@ -3408,7 +4944,8 @@ var SimpleJobExecutor = class {
 				evaluatedByPosition: false,
 				postCommitInvalidations,
 				postCommitMembershipInvalidations,
-				touchedStreams
+				touchedStreams,
+				purgeFence
 			});
 			if (reevalResult.success && reevalResult.operationsWithContext) {
 				const ordinals = await stores.operationIndex.commit(indexTxn, signal);
@@ -3429,10 +4966,29 @@ var SimpleJobExecutor = class {
 				pendingEvent
 			};
 		}
-		const positioned = await this.positionByTimestamp(job, stores, signal);
+		let admission;
+		try {
+			admission = await this.signatureAdmission.admitMutation(job, stores, signal);
+		} catch (error) {
+			return { result: buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime) };
+		}
+		if (admission.kind === "refused") return { result: buildErrorResult(job, admission.error, startTime) };
+		let committed;
+		try {
+			committed = await this.reloadCommitted(admission.committed, stores, signal);
+		} catch (error) {
+			return { result: buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime) };
+		}
+		const committedIds = new Set(admission.committed.map((write) => write.actionId));
+		const fresh = committedIds.size === 0 ? job : {
+			...job,
+			actions: job.actions.filter((action) => !committedIds.has(action.id))
+		};
+		if (fresh.actions.length === 0) return this.committedOutcome(job, committed, [], [], stores, startTime);
+		const positioned = await this.positionByTimestamp(fresh, stores, signal);
 		if (positioned.error) return { result: buildErrorResult(job, positioned.error, startTime) };
 		const executing = {
-			job,
+			job: fresh,
 			startTime,
 			indexTxn,
 			stores,
@@ -3441,7 +4997,8 @@ var SimpleJobExecutor = class {
 			evaluatedByPosition: positioned.evaluatedByPosition,
 			postCommitInvalidations,
 			postCommitMembershipInvalidations,
-			touchedStreams
+			touchedStreams,
+			purgeFence
 		};
 		const actionResult = await this.processActions(positioned.writes, executing);
 		if (!actionResult.success) return { result: {
@@ -3462,13 +5019,291 @@ var SimpleJobExecutor = class {
 		} };
 		const ordinals = await stores.operationIndex.commit(indexTxn, signal);
 		postCommitMembershipInvalidations.push(...indexTxn.getMembershipInvalidations());
-		if (actionResult.operationsWithContext.length > 0) {
-			for (let i = 0; i < actionResult.operationsWithContext.length; i++) actionResult.operationsWithContext[i].context.ordinal = ordinals[i];
-			const collectionMemberships = await this.getCollectionMembershipsForOperations(actionResult.operationsWithContext, stores);
+		for (let i = 0; i < actionResult.operationsWithContext.length; i++) actionResult.operationsWithContext[i].context.ordinal = ordinals[i];
+		return this.committedOutcome(job, committed, actionResult.operationsWithContext, actionResult.generatedOperations, stores, startTime);
+	}
+	/** A load names only its own id purged; a foreign one is ID_MISMATCH. */
+	purgedRefusal(job, purged) {
+		if (purged.size === 0) return;
+		if (purged.has(job.documentId)) return new DocumentPurgedError(job.documentId);
+		const actions = [...job.actions, ...job.operations.map((operation) => operation.action)];
+		for (const action of actions) {
+			if (!DOCUMENT_SCOPE_ACTIONS.has(action.type)) continue;
+			const target = targetDocumentId(action, job.documentId);
+			if (!purged.has(target)) continue;
+			if (job.kind === "mutation") return new DocumentPurgedError(target);
+			return new InvalidSignatureError(job.documentId, "ID_MISMATCH", `${action.type} ${action.id} in ${job.documentId} writes purged ${target}`);
+		}
+		if (job.kind !== "mutation") return;
+		for (const action of job.actions) {
+			const target = relationshipTarget(action);
+			if (action.type === "ADD_RELATIONSHIP" && target !== void 0 && purged.has(target)) return new DocumentPurgedError(target, `${action.type} target ${target} was purged`);
+			if (action.scope !== "auth") continue;
+			const group = mentionedGroupIds(action).find((id) => purged.has(id));
+			if (group !== void 0) return new DocumentPurgedError(group, `${action.type} names purged group ${group}`);
+		}
+	}
+	/** A purge job or a marker load: the exclusive lock is the job's only lock. */
+	async executePurge(params) {
+		const { job, startTime, stores } = params;
+		const fail = (error) => ({ result: buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime) });
+		if (job.kind === "load") {
+			const malformed = malformedMarker(job);
+			if (malformed) return fail(malformed);
+		}
+		const purger = stores.purger;
+		if (!purger) return fail(/* @__PURE__ */ new Error(`Purge of ${job.documentId} needs a transactional scope`));
+		try {
+			await stores.documentLocks.exclusive(job.documentId);
+		} catch (error) {
+			return fail(error);
+		}
+		let alreadyPurged;
+		try {
+			alreadyPurged = (await stores.documentLocks.purged([job.documentId])).has(job.documentId);
+		} catch (error) {
+			return fail(error);
+		}
+		if (alreadyPurged) return {
+			result: {
+				job,
+				success: true,
+				operations: [],
+				operationsWithContext: [],
+				duration: Date.now() - startTime
+			},
+			pendingEvent: {
+				jobId: job.id,
+				operations: [],
+				jobMeta: job.meta,
+				collectionMemberships: {}
+			}
+		};
+		let commit;
+		try {
+			commit = job.kind === "purge" ? await this.preparePurgeJob(params, purger) : await this.preparePurgeLoad(params, purger);
+		} catch (error) {
+			return fail(error);
+		}
+		if (commit instanceof Error) return fail(commit);
+		try {
+			return await this.commitPurge(params, commit);
+		} catch (error) {
+			return fail(error);
+		}
+	}
+	/** Preconditions 1-5, then the marker this host signs. */
+	async preparePurgeJob(params, purger) {
+		const { job, stores, signal } = params;
+		const documentId = job.documentId;
+		if (!job.purge) return /* @__PURE__ */ new Error(`Purge job ${job.id} carries no purge options`);
+		const held = await this.heldStreams(purger, documentId);
+		if (held.branches.length === 0) return new DocumentNotDeletedError(documentId, `Document ${documentId} is not held here`);
+		let documentType;
+		for (const branch of held.branches) {
+			let meta;
+			try {
+				meta = await stores.documentMetaCache.getDocumentMeta(documentId, branch, signal);
+			} catch (error) {
+				return new DocumentNotDeletedError(documentId, `Document ${documentId} has no readable state on ${branch}: ${error instanceof Error ? error.message : String(error)}`);
+			}
+			if (!meta.state.isDeleted) return new DocumentNotDeletedError(documentId, `Document ${documentId} is not deleted on branch ${branch}`);
+			documentType ??= meta.documentType;
+		}
+		if (documentType === void 0) return new DocumentNotDeletedError(documentId);
+		if (documentType === groupDocumentType) {
+			const referencers = await purger.groupReferencersInHistory(documentId);
+			if (referencers.length > 0) return new GroupInUseError(documentId, referencers);
+		}
+		let survivors = [];
+		if (this.driveContainerTypes.has(documentType)) {
+			const requested = new Set(purgeRequestDocumentIds(job));
+			const members = await this.driveMembers(purger, stores, documentId, held.branches);
+			const blocking = members.required.filter((id) => !requested.has(id));
+			if (blocking.length > 0) return new DocumentNotDeletedError(documentId, `Drive ${documentId} cannot be purged: ${blocking.join(", ")} neither purged nor in the request`);
+			survivors = members.survivors;
+		}
+		const operationCount = await purger.operationCount(documentId);
+		if (operationCount > this.config.maxPurgeOperations && !job.purge.allowLarge) return new PurgeTooLargeError(documentId, operationCount, this.config.maxPurgeOperations);
+		return {
+			purger,
+			marker: await this.signMarker(documentId, documentType, job.purge.requestId, signal),
+			documentType,
+			held,
+			sourceRemote: "",
+			collectionIds: [],
+			survivors
+		};
+	}
+	/** A peer's marker, admitted alone; a receiver cannot refuse an erasure. */
+	async preparePurgeLoad(params, purger) {
+		const { job, stores, signal } = params;
+		const documentId = job.documentId;
+		const marker = job.operations.find((operation) => isPurgeMarker(operation));
+		const refusal = await this.signatureAdmission.admitMarker(job, marker, signal);
+		if (refusal) return refusal;
+		const held = await this.heldStreams(purger, documentId);
+		let documentType = marker.action.input.documentType;
+		let appliedDeletion = held.branches.length > 0;
+		if (held.branches.length > 0) try {
+			const meta = await stores.documentMetaCache.getDocumentMeta(documentId, held.branches.includes("main") ? "main" : held.branches[0], signal);
+			documentType = meta.documentType;
+			appliedDeletion = !meta.state.isDeleted;
+		} catch {}
+		let survivors = [];
+		if (this.driveContainerTypes.has(documentType)) {
+			const members = await this.driveMembers(purger, stores, documentId, held.branches);
+			survivors = [...members.required, ...members.survivors];
+		}
+		const sourceRemote = typeof job.meta.sourceRemote === "string" ? job.meta.sourceRemote : "";
+		const collectionId = sourceRemote ? await purger.remoteCollection(sourceRemote) : void 0;
+		return {
+			purger,
+			marker: purgeMarkerOperation(marker.action),
+			documentType,
+			held,
+			sourceRemote,
+			collectionIds: collectionId === void 0 ? [] : [collectionId],
+			survivors,
+			...appliedDeletion ? { appliedDeletion: true } : {}
+		};
+	}
+	/** Execution: delete, write the marker and its twin, tombstone, reopen. */
+	async commitPurge(params, commit) {
+		const { job, startTime, stores, signal, touchedStreams } = params;
+		const { purger, marker, documentType, held, sourceRemote } = commit;
+		const documentId = job.documentId;
+		const streams = [...held.streams, {
+			scope: "document",
+			branch: "main"
+		}];
+		for (const stream of streams) {
+			touchedStreams.add(documentId, stream.scope, stream.branch);
+			params.postCommitInvalidations.push({
+				documentId,
+				...stream
+			});
+		}
+		params.postCommitMetaInvalidations.push(documentId);
+		const removedRows = await purger.deleteRows(documentId);
+		const [stored] = await stores.operationStore.apply(documentId, documentType, "document", "main", 0, (txn) => {
+			txn.addOperations(marker);
+		}, signal);
+		const indexTxn = stores.operationIndex.start();
+		indexTxn.write([{
+			...stored,
+			documentId,
+			documentType,
+			scope: "document",
+			branch: "main",
+			sourceRemote
+		}]);
+		const [ordinal] = await stores.operationIndex.commit(indexTxn, signal);
+		await purger.writeTombstone({
+			documentId,
+			ordinal,
+			removedRows,
+			purgedAtUtc: marker.action.input.purgedAtUtcIso,
+			requestId: marker.action.input.requestId
+		});
+		const collections = await purger.reopenMemberships(documentId, ordinal, commit.collectionIds);
+		params.postCommitMembershipInvalidations.push(documentId, ...commit.survivors, ...indexTxn.getMembershipInvalidations());
+		const operationWithContext = {
+			operation: stored,
+			context: {
+				documentId,
+				scope: "document",
+				branch: "main",
+				documentType,
+				ordinal,
+				...commit.appliedDeletion ? { appliedDeletion: true } : {}
+			}
+		};
+		return {
+			result: {
+				job,
+				success: true,
+				operations: [stored],
+				operationsWithContext: [operationWithContext],
+				duration: Date.now() - startTime
+			},
+			pendingEvent: {
+				jobId: job.id,
+				operations: [operationWithContext],
+				jobMeta: job.meta,
+				collectionMemberships: { [documentId]: collections }
+			}
+		};
+	}
+	async heldStreams(purger, documentId) {
+		const streams = await purger.streams(documentId);
+		return {
+			streams,
+			branches: [...new Set(streams.filter((stream) => stream.scope === "document").map((stream) => stream.branch))]
+		};
+	}
+	/** Members a drive purge needs gone, and those living on elsewhere. */
+	async driveMembers(purger, stores, driveId, branches) {
+		const required = /* @__PURE__ */ new Set();
+		const survivors = /* @__PURE__ */ new Set();
+		for (const branch of branches.length > 0 ? branches : ["main"]) {
+			const collectionId = DriveCollectionId.forDrive(driveId, branch).key;
+			const members = await purger.collectionMembers(collectionId, driveId, branch);
+			const purged = await stores.documentLocks.purged(members.map((member) => member.documentId));
+			for (const member of members) {
+				if (purged.has(member.documentId)) continue;
+				if (member.required) required.add(member.documentId);
+				else survivors.add(member.documentId);
+			}
+		}
+		return {
+			required: [...required],
+			survivors: [...survivors]
+		};
+	}
+	/** The marker, signed by this executor's signer as any peer admits it. */
+	async signMarker(documentId, documentType, requestId, signal) {
+		const action = purgeDocumentAction({
+			documentId,
+			documentType,
+			requestId
+		});
+		const signature = await this.signer.signAction(action, {
+			documentId,
+			branch: "main"
+		}, signal);
+		return purgeMarkerOperation({
+			...action,
+			context: { signer: {
+				...actionSignerIdentity(this.signer),
+				signatures: [signature]
+			} }
+		});
+	}
+	/** A stored document at a version this reactor does not run is read-only here. */
+	async unsupportedStoredProtocol(job, stores, signal) {
+		let versions;
+		try {
+			versions = this.featureFlags.documentDecisions && job.kind !== "load" ? (await stores.writeCache.getState(job.documentId, "document", job.branch, void 0, signal)).header.protocolVersions : (await stores.documentMetaCache.getDocumentMeta(job.documentId, job.branch, signal)).protocolVersions;
+		} catch {
+			return;
+		}
+		return this.documentActionHandler.unsupportedProtocol(job.documentId, versions);
+	}
+	/**
+	* A successful mutation's result and the write-ready event it owes, carrying
+	* what earlier attempts committed ahead of what this one wrote.
+	*/
+	async committedOutcome(job, reloaded, written, generated, stores, startTime) {
+		const operationsWithContext = [...reloaded, ...written];
+		let pendingEvent;
+		if (operationsWithContext.length > 0) {
+			const collectionMemberships = await this.getCollectionMembershipsForOperations(operationsWithContext, stores);
 			pendingEvent = {
 				jobId: job.id,
-				operations: actionResult.operationsWithContext,
+				operations: operationsWithContext,
 				jobMeta: job.meta,
+				submittedActionIds: submittedActionIds(job),
 				collectionMemberships
 			};
 		}
@@ -3476,14 +5311,62 @@ var SimpleJobExecutor = class {
 			result: {
 				job,
 				success: true,
-				operations: actionResult.generatedOperations,
-				operationsWithContext: actionResult.operationsWithContext,
+				operations: [...reloaded.map((entry) => entry.operation), ...generated],
+				operationsWithContext,
 				duration: Date.now() - startTime
 			},
 			pendingEvent
 		};
 	}
 	/**
+	* The stored operations of writes an earlier attempt committed, as a fresh
+	* write would report them. State is rebuilt from the write cache, and left
+	* out when it cannot be.
+	*/
+	async reloadCommitted(writes, stores, signal) {
+		const streams = /* @__PURE__ */ new Map();
+		for (const write of writes) {
+			const key = `${write.documentId}\u0000${write.scope}\u0000${write.branch}`;
+			streams.set(key, [...streams.get(key) ?? [], write]);
+		}
+		const reloaded = [];
+		for (const group of streams.values()) {
+			const { documentId, scope, branch } = group[0];
+			const opIds = [...new Set(group.map((write) => write.opId))];
+			const operations = await stores.operationStore.getOperationsByIds(documentId, scope, branch, opIds, signal);
+			const ordinals = await stores.operationIndex.getOrdinalsByOpIds(documentId, scope, branch, opIds, signal);
+			const { documentType } = await stores.documentMetaCache.getDocumentMeta(documentId, branch, signal);
+			for (const operation of operations.sort((a, b) => a.index - b.index)) reloaded.push({
+				operation,
+				context: {
+					documentId,
+					scope,
+					branch,
+					documentType,
+					resultingState: await this.rebuiltState(stores, {
+						documentId,
+						scope,
+						branch
+					}, operation, signal),
+					ordinal: ordinals.get(operation.id) ?? 0
+				}
+			});
+		}
+		return reloaded;
+	}
+	async rebuiltState(stores, stream, operation, signal) {
+		try {
+			const document = await stores.writeCache.getState(stream.documentId, stream.scope, stream.branch, operation.index, signal);
+			return JSON.stringify({
+				...document.state,
+				header: document.header
+			});
+		} catch (error) {
+			this.logger.warn("No state for committed operation @OperationId in @Stream: @Error", operation.id, stream, error);
+			return;
+		}
+	}
+	/**
 	* Drops the cached state of every stream a job wrote, after its transaction
 	* did not commit.
 	*
@@ -3512,16 +5395,6 @@ var SimpleJobExecutor = class {
 		const actions = writes.map((write) => write.action);
 		const generatedOperations = [];
 		const operationsWithContext = [];
-		try {
-			await this.signatureVerifierModule.verifyActions(job.documentId, job.branch, actions);
-		} catch (error) {
-			return {
-				success: false,
-				generatedOperations,
-				operationsWithContext,
-				error: error instanceof Error ? error : new Error(String(error))
-			};
-		}
 		for (const action of actions) if (action.timestampUtcMs && !isValidISOTimestamp(action.timestampUtcMs)) return {
 			success: false,
 			generatedOperations,
@@ -3619,7 +5492,7 @@ var SimpleJobExecutor = class {
 			if (docMeta.state.isDeleted) return buildErrorResult(job, new DocumentDeletedError(job.documentId, docMeta.state.deletedAtUtcIso), startTime);
 			documentVersion = docMeta.state.version;
 		}
-		if (isUndoRedo(action) || action.type === "PRUNE" || skip > 0) stores.writeCache.invalidate(job.documentId, job.scope, job.branch);
+		if (isUndoRedo(action) || skip > 0) stores.writeCache.invalidate(job.documentId, job.scope, job.branch);
 		let document;
 		if (baseDocument !== void 0) document = baseDocument;
 		else try {
@@ -3679,18 +5552,27 @@ var SimpleJobExecutor = class {
 				branch: job.branch,
 				protocolVersion
 			};
-			updatedDocument = module.reducer(document, action, void 0, reducerOptions);
+			updatedDocument = withProtocolVersions(module.reducer(document, action, void 0, reducerOptions), document.header.protocolVersions);
 		} catch (error) {
 			const contextMessage = `Failed to apply action to document:\n  Action type: ${action.type}\n  Document ID: ${job.documentId}\n  Document type: ${document.header.documentType}\n  Scope: ${job.scope}\n  Original error: ${error instanceof Error ? error.message : String(error)}`;
 			const enhancedError = new Error(contextMessage);
 			if (error instanceof Error && error.stack) enhancedError.stack = `${contextMessage}\n\nOriginal stack trace:\n${error.stack}`;
 			return buildErrorResult(job, enhancedError, startTime);
 		}
-		const scope = job.scope;
-		const operations = updatedDocument.operations[scope];
-		if (operations.length === 0) return buildErrorResult(job, /* @__PURE__ */ new Error("No operation generated from action"), startTime);
-		const newOperation = operations[operations.length - 1];
-		if (!isUndoRedo(action)) newOperation.skip = skip;
+		const scope = job.scope;
+		const operations = updatedDocument.operations[scope];
+		if (operations.length === 0) return buildErrorResult(job, /* @__PURE__ */ new Error("No operation generated from action"), startTime);
+		const newOperation = operations[operations.length - 1];
+		if (!isUndoRedo(action)) newOperation.skip = skip;
+		if (deniedReason === void 0 && sourceOperation === void 0 && !executing.replayingAcceptedHistory && isSynthesized(action, newOperation, document.operations[scope] ?? [])) try {
+			await signSynthesized(newOperation, action, {
+				documentId: job.documentId,
+				scope,
+				branch: job.branch
+			}, this.signer, signal);
+		} catch (error) {
+			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+		}
 		const resultingState = JSON.stringify({
 			...updatedDocument.state,
 			header: updatedDocument.header
@@ -3791,7 +5673,7 @@ var SimpleJobExecutor = class {
 	*   apply and its own reasons for it.
 	* - A positional or replayed run carries skips and re-appended operations,
 	*   whose indices are not a simple ascending run from the head.
-	* - UNDO, REDO, PRUNE and NOOP-with-skip each invalidate the write cache to
+	* - UNDO, REDO and NOOP-with-skip each invalidate the write cache to
 	*   force a full-history rebuild, so they cannot be reduced against state
 	*   threaded from the write before them.
 	* - The auth scope decides later writes against the policy earlier ones
@@ -3809,7 +5691,7 @@ var SimpleJobExecutor = class {
 		if (scope === "auth" || scope === "document") return false;
 		return writes.every((write) => {
 			const type = write.action.type;
-			return write.skip === 0 && write.deniedReason === void 0 && write.sourceOperation === void 0 && !DOCUMENT_SCOPE_ACTIONS.has(type) && !isUndoRedo(write.action) && type !== "PRUNE" && type !== "NOOP";
+			return write.skip === 0 && write.deniedReason === void 0 && write.sourceOperation === void 0 && !DOCUMENT_SCOPE_ACTIONS.has(type) && !isUndoRedo(write.action) && type !== "NOOP";
 		});
 	}
 	/**
@@ -3932,13 +5814,22 @@ var SimpleJobExecutor = class {
 		}
 		if (!backdated) return plain();
 		const conflicting = (await stores.operationStore.getConflicting(job.documentId, job.scope, job.branch, earliest, void 0, signal)).results.filter((operation) => !isGenesisOperation(operation));
-		if (conflicting.length === 0) {
+		const nothingToMove = async () => {
 			if (!this.featureFlags.authEnforcement) return plain();
 			return this.evaluatePositioned(job, stores, this.appendedOperations(job, revisions.revision[job.scope] ?? 0), signal);
-		}
+		};
+		if (conflicting.length === 0) return nothingToMove();
 		const nextIndex = revisions.revision[job.scope] ?? 0;
 		let firstConflicting = conflicting[0].index;
 		for (const operation of conflicting) if (operation.index < firstConflicting) firstConflicting = operation.index;
+		const stored = (await stores.operationStore.getSince(job.documentId, job.scope, job.branch, firstConflicting - 1, void 0, void 0, signal)).results;
+		const conflictingIds = new Set(conflicting.map((operation) => operation.id));
+		const effective = garbageCollect(sortOperations(stored)).filter((operation) => !isGenesisOperation(operation));
+		const firstMoving = effective.findIndex((operation) => conflictingIds.has(operation.id));
+		const moving = firstMoving === -1 ? [] : effective.slice(firstMoving);
+		if (moving.length === 0) return nothingToMove();
+		let firstRetracted = moving[0].index;
+		for (const operation of moving) firstRetracted = Math.min(firstRetracted, operation.index - operation.skip);
 		const incoming = job.actions.map((action, i) => ({
 			id: action.id,
 			index: nextIndex + i,
@@ -3949,8 +5840,8 @@ var SimpleJobExecutor = class {
 		}));
 		const merged = reshuffleByTimestamp({
 			index: nextIndex,
-			skip: retractionSkip(nextIndex, firstConflicting)
-		}, conflicting, incoming);
+			skip: retractionSkip(nextIndex, firstRetracted)
+		}, moving, incoming);
 		stores.writeCache.invalidate(job.documentId, job.scope, job.branch);
 		if (!this.featureFlags.authEnforcement) return {
 			writes: merged.map((operation) => ({
@@ -4098,7 +5989,7 @@ var SimpleJobExecutor = class {
 			stores.writeCache.invalidate(job.documentId, scope, job.branch);
 			const result = await this.processActions(tail.map((operation, i) => ({
 				action: operation.action,
-				skip: i === 0 ? retractionSkip(nextIndex, tail[0].index) : 0,
+				skip: i === 0 ? retractionSkip(nextIndex, tail[0].index - tail[0].skip) : 0,
 				sourceRemote: "",
 				deniedReason: reevaluated[firstChange + i]
 			})), {
@@ -4187,36 +6078,32 @@ var SimpleJobExecutor = class {
 			error: new InvalidOperationTimestampError(job.documentId, scope, operation.timestampUtcMs, `operation (index: ${operation.index})`),
 			duration: Date.now() - startTime
 		};
-		let minIncomingIndex = Number.POSITIVE_INFINITY;
-		let minIncomingTimestamp = job.operations[0]?.timestampUtcMs || "";
-		for (const operation of job.operations) {
-			minIncomingIndex = Math.min(minIncomingIndex, operation.index);
-			const ts = operation.timestampUtcMs || "";
-			if (Date.parse(ts) < Date.parse(minIncomingTimestamp)) minIncomingTimestamp = ts;
-		}
-		let conflictingOps;
-		try {
-			conflictingOps = (await stores.operationStore.getConflicting(job.documentId, scope, job.branch, minIncomingTimestamp, void 0, signal)).results;
-		} catch {
-			conflictingOps = [];
-		}
-		let allOpsFromMinConflictingIndex = conflictingOps;
-		if (conflictingOps.length > 0) {
-			const minConflictingIndex = Math.min(...conflictingOps.map((op) => op.index));
+		const dropped = /* @__PURE__ */ new Set();
+		const admitted = /* @__PURE__ */ new Set();
+		let selection = await this.selectLoadWrites(job, job.operations, stores, signal);
+		for (;;) {
+			const unadmitted = selection.incomingOpsToApply.filter((operation) => !admitted.has(operation));
+			if (unadmitted.length === 0) break;
+			let refused;
 			try {
-				allOpsFromMinConflictingIndex = (await stores.operationStore.getSince(job.documentId, scope, job.branch, minConflictingIndex - 1, void 0, void 0, signal)).results;
-			} catch {
-				allOpsFromMinConflictingIndex = conflictingOps;
+				refused = await this.signatureAdmission.admitLoad(job, unadmitted, stores, signal);
+			} catch (error) {
+				return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
 			}
+			for (const operation of unadmitted) if (refused.has(operation)) dropped.add(operation);
+			else admitted.add(operation);
+			if (refused.size === 0) break;
+			const remaining = job.operations.filter((operation) => !dropped.has(operation));
+			if (remaining.length === 0) return {
+				job,
+				success: true,
+				operations: [],
+				operationsWithContext: [],
+				duration: Date.now() - startTime
+			};
+			selection = await this.selectLoadWrites(job, remaining, stores, signal);
 		}
-		const incomingActionIds = new Set(job.operations.map((op) => op.action.id));
-		const nonSupersededOps = conflictingOps.filter((op) => {
-			if (op.index < minIncomingIndex && !incomingActionIds.has(op.action.id)) return false;
-			for (const laterOp of allOpsFromMinConflictingIndex) if (laterOp.index > op.index && laterOp.skip > 0) {
-				if (laterOp.index - laterOp.skip <= op.index) return false;
-			}
-			return true;
-		});
+		const { nonSupersededOps, allOpsFromMinConflictingIndex, incomingOpsToApply } = selection;
 		const existingOpsToReshuffle = monotonicAuthStream ? [] : nonSupersededOps.filter((operation) => !isGenesisOperation(operation));
 		const actionIdCounts = /* @__PURE__ */ new Map();
 		for (const operation of allOpsFromMinConflictingIndex) actionIdCounts.set(operation.action.id, (actionIdCounts.get(operation.action.id) ?? 0) + 1);
@@ -4237,14 +6124,6 @@ var SimpleJobExecutor = class {
 			const logicalSkip = latestRevision - minLogicalIndex;
 			if (logicalSkip > skipCount) skipCount = logicalSkip;
 		}
-		const existingActionIds = new Set(nonSupersededOps.map((op) => op.action.id));
-		const seenIncomingActionIds = /* @__PURE__ */ new Set();
-		const incomingOpsToApply = job.operations.filter((op) => {
-			if (existingActionIds.has(op.action.id)) return false;
-			if (seenIncomingActionIds.has(op.action.id)) return false;
-			seenIncomingActionIds.add(op.action.id);
-			return true;
-		});
 		if (incomingOpsToApply.length === 0) return {
 			job,
 			success: true,
@@ -4272,7 +6151,8 @@ var SimpleJobExecutor = class {
 			...operation,
 			id: operation.id
 		})));
-		for (const operation of reshuffledOperations) if (operation.action.type === "NOOP" && operation.skip === 0) operation.skip = 1;
+		const incomingIds = new Set(incomingOpsToApply.map((operation) => operation.action.id));
+		for (const operation of reshuffledOperations) if (operation.action.type === "NOOP" && operation.skip === 0 && incomingIds.has(operation.action.id)) operation.skip = 1;
 		let deniedReasons;
 		if (this.featureFlags.documentDecisions) try {
 			deniedReasons = await evaluateByPosition(this.decisionModel, {
@@ -4324,6 +6204,71 @@ var SimpleJobExecutor = class {
 			duration: Date.now() - startTime
 		};
 	}
+	/** The conflicting window a load opens, and which of its operations are new. */
+	async selectLoadWrites(job, operations, stores, signal) {
+		const scope = job.scope;
+		let minIncomingIndex = Number.POSITIVE_INFINITY;
+		let minIncomingTimestamp = operations[0]?.timestampUtcMs || "";
+		for (const operation of operations) {
+			minIncomingIndex = Math.min(minIncomingIndex, operation.index);
+			const ts = operation.timestampUtcMs || "";
+			if (Date.parse(ts) < Date.parse(minIncomingTimestamp)) minIncomingTimestamp = ts;
+		}
+		let conflictingOps;
+		try {
+			conflictingOps = (await stores.operationStore.getConflicting(job.documentId, scope, job.branch, minIncomingTimestamp, void 0, signal)).results;
+		} catch {
+			conflictingOps = [];
+		}
+		let allOpsFromMinConflictingIndex = conflictingOps;
+		if (conflictingOps.length > 0) {
+			const minConflictingIndex = Math.min(...conflictingOps.map((op) => op.index));
+			try {
+				allOpsFromMinConflictingIndex = (await stores.operationStore.getSince(job.documentId, scope, job.branch, minConflictingIndex - 1, void 0, void 0, signal)).results;
+			} catch {
+				allOpsFromMinConflictingIndex = conflictingOps;
+			}
+		}
+		const incomingActionIds = new Set(operations.map((op) => op.action.id));
+		const supersededBy = (op) => {
+			let nearest;
+			for (const laterOp of allOpsFromMinConflictingIndex) if (laterOp.index > op.index && laterOp.skip > 0 && laterOp.index - laterOp.skip <= op.index && (nearest === void 0 || laterOp.index < nearest.index)) nearest = laterOp;
+			return nearest;
+		};
+		const undoneActionIds = /* @__PURE__ */ new Set();
+		let predecessorBound = minIncomingIndex;
+		const rowsByActionId = /* @__PURE__ */ new Map();
+		for (const op of conflictingOps) if (incomingActionIds.has(op.action.id)) rowsByActionId.set(op.action.id, [...rowsByActionId.get(op.action.id) ?? [], op]);
+		const liveOps = /* @__PURE__ */ new Set();
+		for (const op of conflictingOps) if (supersededBy(op) === void 0) liveOps.add(op);
+		for (const [actionId, rows] of rowsByActionId) {
+			if (rows.some((row) => liveOps.has(row))) continue;
+			if (rows.some((row) => supersededBy(row)?.action.type === "NOOP")) undoneActionIds.add(actionId);
+			else predecessorBound = Math.min(predecessorBound, Math.max(...rows.map((row) => row.index)));
+		}
+		const nonSupersededOps = conflictingOps.filter((op) => {
+			if (op.index < predecessorBound && !incomingActionIds.has(op.action.id)) return false;
+			return liveOps.has(op);
+		});
+		let rewoundFrom = Number.POSITIVE_INFINITY;
+		for (const op of nonSupersededOps) if (!isGenesisOperation(op)) rewoundFrom = Math.min(rewoundFrom, op.index - op.skip);
+		const reappended = new Set(nonSupersededOps.map((op) => op.index));
+		for (const op of allOpsFromMinConflictingIndex) if (op.index >= rewoundFrom && !reappended.has(op.index) && supersededBy(op) === void 0) nonSupersededOps.push(op);
+		const existingActionIds = new Set(nonSupersededOps.map((op) => op.action.id));
+		const seenIncomingActionIds = /* @__PURE__ */ new Set();
+		const incomingOpsToApply = operations.filter((op) => {
+			if (existingActionIds.has(op.action.id)) return false;
+			if (undoneActionIds.has(op.action.id)) return false;
+			if (seenIncomingActionIds.has(op.action.id)) return false;
+			seenIncomingActionIds.add(op.action.id);
+			return true;
+		});
+		return {
+			nonSupersededOps,
+			allOpsFromMinConflictingIndex,
+			incomingOpsToApply
+		};
+	}
 	accumulateResultOrReturnError(result, generatedOperations, operationsWithContext) {
 		if (!result.success) return result;
 		if (result.operations && result.operations.length > 0) generatedOperations.push(...result.operations);
@@ -4470,6 +6415,7 @@ var DocumentModelRegistry = class {
 //#endregion
 //#region src/storage/kysely/keyframe-store.ts
 var KyselyKeyframeStore = class KyselyKeyframeStore {
+	db;
 	trx;
 	constructor(db) {
 		this.db = db;
@@ -4484,19 +6430,28 @@ var KyselyKeyframeStore = class KyselyKeyframeStore {
 	}
 	async putKeyframe(documentId, scope, branch, revision, document, signal) {
 		if (signal?.aborted) throw new Error("Operation aborted");
-		await this.queryExecutor.insertInto("Keyframe").values({
-			documentId,
-			documentType: document.header.documentType,
-			scope,
-			branch,
-			revision,
-			document
-		}).onConflict((oc) => oc.columns([
-			"documentId",
-			"scope",
-			"branch",
-			"revision"
-		]).doUpdateSet({ document })).execute();
+		const write = async (trx) => {
+			await acquirePurgeLocks(trx, [documentId], "shared");
+			if ((await findPurged(trx, [documentId])).has(documentId)) return;
+			await trx.insertInto("Keyframe").values({
+				documentId,
+				documentType: document.header.documentType,
+				scope,
+				branch,
+				revision,
+				document
+			}).onConflict((oc) => oc.columns([
+				"documentId",
+				"scope",
+				"branch",
+				"revision"
+			]).doUpdateSet({ document })).execute();
+		};
+		if (this.trx) {
+			await write(this.trx);
+			return;
+		}
+		await this.db.transaction().execute(write);
 	}
 	async findNearestKeyframe(documentId, scope, branch, targetRevision, signal) {
 		if (signal?.aborted) throw new Error("Operation aborted");
@@ -4554,6 +6509,11 @@ function paginateRows(rows, paging, cursorOf, toItem, refetch) {
 //#endregion
 //#region src/storage/txn.ts
 var AtomicTransaction = class {
+	documentId;
+	documentType;
+	scope;
+	branch;
+	baseRevision;
 	operations = [];
 	constructor(documentId, documentType, scope, branch, baseRevision) {
 		this.documentId = documentId;
@@ -4587,6 +6547,11 @@ var AtomicTransaction = class {
 //#endregion
 //#region src/storage/kysely/store.ts
 var _UniqueConstraintContext = class extends Error {
+	documentId;
+	scope;
+	branch;
+	revision;
+	stagedOps;
 	constructor(documentId, scope, branch, revision, stagedOps) {
 		super("unique constraint");
 		this.documentId = documentId;
@@ -4598,16 +6563,20 @@ var _UniqueConstraintContext = class extends Error {
 	}
 };
 var KyselyOperationStore = class KyselyOperationStore {
+	db;
 	trx;
+	liveIds;
 	constructor(db) {
 		this.db = db;
 	}
 	get queryExecutor() {
 		return this.trx ?? this.db;
 	}
-	withTransaction(trx) {
+	/** `liveIds`: ids the transaction read untombstoned under its shared lock. */
+	withTransaction(trx, liveIds) {
 		const instance = new KyselyOperationStore(this.db);
 		instance.trx = trx;
+		instance.liveIds = liveIds;
 		return instance;
 	}
 	async apply(documentId, documentType, scope, branch, revision, fn, signal, condition) {
@@ -4652,6 +6621,8 @@ var KyselyOperationStore = class KyselyOperationStore {
 		await fn(atomicTxn);
 		const operations = atomicTxn.getOperations();
 		if (operations.length === 0) return [];
+		const purgedHead = this.liveIds?.has(documentId) ? void 0 : await this.refusePurgedAppend(trx, documentId, operations);
+		if (purgedHead !== void 0) return purgedHead;
 		if (condition) await this.acquireStreamLocks(trx, documentId, scope, branch, condition);
 		const latestOp = await trx.selectFrom("Operation").selectAll().where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).orderBy("index", "desc").limit(1).executeTakeFirst();
 		const currentRevision = latestOp ? latestOp.index : -1;
@@ -4697,12 +6668,13 @@ var KyselyOperationStore = class KyselyOperationStore {
 	* otherwise read a snapshot taken before the locks were held.
 	*/
 	async acquireStreamLocks(trx, documentId, scope, branch, condition) {
-		const keys = new Set([`${documentId}:${scope}:${branch}`]);
+		const keys = /* @__PURE__ */ new Set([`${documentId}:${scope}:${branch}`]);
 		for (const stream of condition.streams) keys.add(`${stream.documentId}:${stream.scope}:${stream.branch}`);
+		const sortedKeys = sql.join([...keys].sort());
 		await sql`
       with ordered as materialized (
         select key
-        from unnest(array[${sql.join([...keys].sort())}]::text[]) with ordinality as t(key, ord)
+        from unnest(array[${sortedKeys}]::text[]) with ordinality as t(key, ord)
         order by ord
       )
       select pg_advisory_xact_lock(hashtext(key)) from ordered
@@ -4766,6 +6738,24 @@ var KyselyOperationStore = class KyselyOperationStore {
 		}
 		return storedRows.map((row) => this.rowToOperation(row));
 	}
+	/** A purged stream refuses appends; a marker gets the stored one back. */
+	async refusePurgedAppend(trx, documentId, operations) {
+		if (!(await findPurged(trx, [documentId])).has(documentId)) return;
+		if (!operations.every((operation) => this.isMarker(operation))) throw new DocumentPurgedError(documentId);
+		return (await trx.selectFrom("Operation").selectAll().where("documentId", "=", documentId).where(sql`action->>'type' = ${PURGE_DOCUMENT}`).orderBy("index", "asc").execute()).map((row) => this.rowToOperation(row));
+	}
+	isMarker(operation) {
+		return this.actionType(operation) === PURGE_DOCUMENT;
+	}
+	actionType(operation) {
+		let action = operation.action;
+		if (typeof action === "string") try {
+			action = JSON.parse(action);
+		} catch {
+			return;
+		}
+		if (typeof action === "object" && action !== null && "type" in action && typeof action.type === "string") return action.type;
+	}
 	/** True when the staged write creates a document rather than appending to one. */
 	isCreate(operations) {
 		for (const operation of operations) {
@@ -4779,6 +6769,14 @@ var KyselyOperationStore = class KyselyOperationStore {
 		}
 		return false;
 	}
+	/**
+	* The paging cursor here encodes the index to resume from (one past the
+	* last row returned), not the last row's own index. This keeps "0" an
+	* unambiguous start-of-stream sentinel even when a page ends at index 0
+	* (e.g. `limit: 1` on a fresh stream), which would otherwise make
+	* `nextCursor` equal the start cursor and loop a caller that walks pages
+	* forever.
+	*/
 	async getSince(documentId, scope, branch, revision, filter, paging, signal) {
 		throwIfAborted(signal);
 		let query = this.queryExecutor.selectFrom("Operation").selectAll().where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).where("index", ">", revision).orderBy("index", "asc");
@@ -4793,10 +6791,10 @@ var KyselyOperationStore = class KyselyOperationStore {
 		}
 		if (paging) {
 			const cursorValue = Number.parseInt(paging.cursor, 10);
-			if (cursorValue > 0) query = query.where("index", ">", cursorValue);
+			if (Number.isFinite(cursorValue) && cursorValue > 0) query = query.where("index", ">=", cursorValue);
 			if (paging.limit) query = query.limit(paging.limit + 1);
 		}
-		return paginateRows(await query.execute(), paging, (row) => row.index, (row) => this.rowToOperation(row), (cursor, limit) => this.getSince(documentId, scope, branch, revision, filter, {
+		return paginateRows(await query.execute(), paging, (row) => row.index + 1, (row) => this.rowToOperation(row), (cursor, limit) => this.getSince(documentId, scope, branch, revision, filter, {
 			cursor,
 			limit
 		}, signal));
@@ -4814,26 +6812,28 @@ var KyselyOperationStore = class KyselyOperationStore {
 			limit
 		}, signal));
 	}
+	/**
+	* The paging cursor here encodes the index to resume from (one past the
+	* last row returned), not the last row's own index, for the same reason as
+	* `getSince`: a page ending at index 0 must not produce a cursor that is
+	* indistinguishable from the start-of-stream sentinel.
+	*/
 	async getConflicting(documentId, scope, branch, minTimestamp, paging, signal) {
 		throwIfAborted(signal);
 		let query = this.queryExecutor.selectFrom("Operation").selectAll().where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).where("timestampUtcMs", ">=", new Date(minTimestamp)).orderBy("index", "asc");
 		if (paging) {
 			const cursorValue = Number.parseInt(paging.cursor, 10);
-			if (cursorValue > 0) query = query.where("index", ">", cursorValue);
+			if (Number.isFinite(cursorValue) && cursorValue > 0) query = query.where("index", ">=", cursorValue);
 			if (paging.limit) query = query.limit(paging.limit + 1);
 		}
-		return paginateRows(await query.execute(), paging, (row) => row.index, (row) => this.rowToOperation(row), (cursor, limit) => this.getConflicting(documentId, scope, branch, minTimestamp, {
+		return paginateRows(await query.execute(), paging, (row) => row.index + 1, (row) => this.rowToOperation(row), (cursor, limit) => this.getConflicting(documentId, scope, branch, minTimestamp, {
 			cursor,
 			limit
 		}, signal));
 	}
 	async getRevisions(documentId, branch, signal) {
 		throwIfAborted(signal);
-		const scopeRevisions = await this.queryExecutor.selectFrom("Operation as o1").select([
-			"o1.scope",
-			"o1.index",
-			"o1.timestampUtcMs"
-		]).where("o1.documentId", "=", documentId).where("o1.branch", "=", branch).where((eb) => eb("o1.index", "=", eb.selectFrom("Operation as o2").select((eb2) => eb2.fn.max("o2.index").as("maxIndex")).where("o2.documentId", "=", eb.ref("o1.documentId")).where("o2.branch", "=", eb.ref("o1.branch")).where("o2.scope", "=", eb.ref("o1.scope")))).execute();
+		const scopeRevisions = await this.queryExecutor.selectFrom("Operation").select("scope").select((eb) => eb.fn.max("index").as("index")).where("documentId", "=", documentId).where("branch", "=", branch).groupBy("scope").execute();
 		const latest = await this.queryExecutor.selectFrom("Operation").select((eb) => eb.fn.max("timestampUtcMs").as("latestTimestamp")).where("documentId", "=", documentId).where("branch", "=", branch).executeTakeFirst();
 		const revision = {};
 		for (const row of scopeRevisions) revision[row.scope] = row.index + 1;
@@ -4846,6 +6846,20 @@ var KyselyOperationStore = class KyselyOperationStore {
 		const latest = await this.queryExecutor.selectFrom("Operation").select((eb) => eb.fn.max("timestampUtcMs").as("latestTimestamp")).where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).executeTakeFirst();
 		return latest?.latestTimestamp ? new Date(latest.latestTimestamp).toISOString() : void 0;
 	}
+	async findOperationIds(documentId, scope, branch, opIds, signal) {
+		throwIfAborted(signal);
+		if (opIds.length === 0) return /* @__PURE__ */ new Set();
+		const rows = await this.queryExecutor.selectFrom("Operation").select("opId").distinct().where("opId", "in", opIds).where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).execute();
+		return new Set(rows.map((row) => row.opId));
+	}
+	async getOperationsByIds(documentId, scope, branch, opIds, signal) {
+		throwIfAborted(signal);
+		if (opIds.length === 0) return [];
+		const rows = await this.queryExecutor.selectFrom("Operation").selectAll().where("opId", "in", opIds).where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).orderBy("index", "asc").execute();
+		const latest = /* @__PURE__ */ new Map();
+		for (const row of rows) latest.set(row.opId, this.rowToOperation(row));
+		return [...latest.values()];
+	}
 	rowToOperation(row) {
 		return {
 			index: row.index,
@@ -4939,8 +6953,8 @@ function createForwardingPoolInstrumentation(name) {
 }
 //#endregion
 //#region src/storage/migrations/001_create_operation_table.ts
-var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$18 });
-async function up$18(db) {
+var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$25 });
+async function up$25(db) {
 	await db.schema.createTable("Operation").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("jobId", "text", (col) => col.notNull()).addColumn("opId", "text", (col) => col.notNull()).addColumn("prevOpId", "text", (col) => col.notNull()).addColumn("writeTimestampUtcMs", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("timestampUtcMs", "timestamptz", (col) => col.notNull()).addColumn("index", "integer", (col) => col.notNull()).addColumn("action", "jsonb", (col) => col.notNull()).addColumn("skip", "integer", (col) => col.notNull()).addColumn("error", "text").addColumn("hash", "text", (col) => col.notNull()).addUniqueConstraint("unique_revision", [
 		"documentId",
 		"scope",
@@ -4965,8 +6979,8 @@ async function up$18(db) {
 }
 //#endregion
 //#region src/storage/migrations/002_create_keyframe_table.ts
-var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$17 });
-async function up$17(db) {
+var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$24 });
+async function up$24(db) {
 	await db.schema.createTable("Keyframe").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("revision", "integer", (col) => col.notNull()).addColumn("document", "jsonb", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_keyframe", [
 		"documentId",
 		"scope",
@@ -4982,14 +6996,14 @@ async function up$17(db) {
 }
 //#endregion
 //#region src/storage/migrations/003_create_document_table.ts
-var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$16 });
-async function up$16(db) {
+var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$23 });
+async function up$23(db) {
 	await db.schema.createTable("Document").addColumn("id", "text", (col) => col.primaryKey()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/004_create_document_relationship_table.ts
-var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$15 });
-async function up$15(db) {
+var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$22 });
+async function up$22(db) {
 	await db.schema.createTable("DocumentRelationship").addColumn("id", "text", (col) => col.primaryKey()).addColumn("sourceId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("targetId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("relationshipType", "text", (col) => col.notNull()).addColumn("metadata", "jsonb").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_source_target_type", [
 		"sourceId",
 		"targetId",
@@ -5001,14 +7015,14 @@ async function up$15(db) {
 }
 //#endregion
 //#region src/storage/migrations/005_create_indexer_state_table.ts
-var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$14 });
-async function up$14(db) {
+var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$21 });
+async function up$21(db) {
 	await db.schema.createTable("IndexerState").addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity()).addColumn("lastOperationId", "integer", (col) => col.notNull()).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/006_create_document_snapshot_table.ts
-var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
-async function up$13(db) {
+var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$20 });
+async function up$20(db) {
 	await db.schema.createTable("DocumentSnapshot").addColumn("id", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("slug", "text").addColumn("name", "text").addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("content", "jsonb", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("lastOperationIndex", "integer", (col) => col.notNull()).addColumn("lastOperationHash", "text", (col) => col.notNull()).addColumn("lastUpdatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("snapshotVersion", "integer", (col) => col.notNull().defaultTo(1)).addColumn("identifiers", "jsonb").addColumn("metadata", "jsonb").addColumn("isDeleted", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("deletedAt", "timestamptz").addUniqueConstraint("unique_doc_scope_branch", [
 		"documentId",
 		"scope",
@@ -5029,8 +7043,8 @@ async function up$13(db) {
 }
 //#endregion
 //#region src/storage/migrations/007_create_slug_mapping_table.ts
-var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$12 });
-async function up$12(db) {
+var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$19 });
+async function up$19(db) {
 	await db.schema.createTable("SlugMapping").addColumn("slug", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_docid_scope_branch", [
 		"documentId",
 		"scope",
@@ -5040,14 +7054,14 @@ async function up$12(db) {
 }
 //#endregion
 //#region src/storage/migrations/008_create_view_state_table.ts
-var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$11 });
-async function up$11(db) {
+var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$18 });
+async function up$18(db) {
 	await db.schema.createTable("ViewState").addColumn("readModelId", "text", (col) => col.primaryKey()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(0)).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/009_create_operation_index_tables.ts
-var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$10 });
-async function up$10(db) {
+var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$17 });
+async function up$17(db) {
 	await db.schema.createTable("document_collections").addColumn("documentId", "text", (col) => col.notNull()).addColumn("collectionId", "text", (col) => col.notNull()).addColumn("joinedOrdinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("leftOrdinal", "bigint").addPrimaryKeyConstraint("document_collections_pkey", ["documentId", "collectionId"]).execute();
 	await db.schema.createIndex("idx_document_collections_collectionId").on("document_collections").column("collectionId").execute();
 	await db.schema.createIndex("idx_doc_collections_collection_range").on("document_collections").columns(["collectionId", "joinedOrdinal"]).execute();
@@ -5061,8 +7075,8 @@ async function up$10(db) {
 }
 //#endregion
 //#region src/storage/migrations/010_create_sync_tables.ts
-var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$9 });
-async function up$9(db) {
+var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$16 });
+async function up$16(db) {
 	await db.schema.createTable("sync_remotes").addColumn("name", "text", (col) => col.primaryKey()).addColumn("collection_id", "text", (col) => col.notNull()).addColumn("channel_type", "text", (col) => col.notNull()).addColumn("channel_id", "text", (col) => col.notNull().defaultTo("")).addColumn("remote_name", "text", (col) => col.notNull().defaultTo("")).addColumn("channel_parameters", "jsonb", (col) => col.notNull().defaultTo(sql`'{}'::jsonb`)).addColumn("filter_document_ids", "jsonb").addColumn("filter_scopes", "jsonb").addColumn("filter_branch", "text", (col) => col.notNull().defaultTo("main")).addColumn("push_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("push_last_success_utc_ms", "text").addColumn("push_last_failure_utc_ms", "text").addColumn("push_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("pull_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("pull_last_success_utc_ms", "text").addColumn("pull_last_failure_utc_ms", "text").addColumn("pull_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 	await db.schema.createIndex("idx_sync_remotes_collection").on("sync_remotes").column("collection_id").execute();
 	await db.schema.createTable("sync_cursors").addColumn("remote_name", "text", (col) => col.primaryKey().references("sync_remotes.name").onDelete("cascade")).addColumn("cursor_ordinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("last_synced_at_utc_ms", "text").addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
@@ -5070,8 +7084,8 @@ async function up$9(db) {
 }
 //#endregion
 //#region src/storage/migrations/011_add_cursor_type_column.ts
-var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$8 });
-async function up$8(db) {
+var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$15 });
+async function up$15(db) {
 	await db.deleteFrom("sync_cursors").where("remote_name", "like", "outbox::%").execute();
 	await db.deleteFrom("sync_remotes").where("name", "like", "outbox::%").execute();
 	await db.schema.dropTable("sync_cursors").execute();
@@ -5080,64 +7094,64 @@ async function up$8(db) {
 }
 //#endregion
 //#region src/storage/migrations/012_add_source_remote_column.ts
-var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$7 });
-async function up$7(db) {
+var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$14 });
+async function up$14(db) {
 	await db.schema.alterTable("operation_index_operations").addColumn("sourceRemote", "text", (col) => col.notNull().defaultTo("")).execute();
 }
 //#endregion
 //#region src/storage/migrations/013_create_sync_dead_letters_table.ts
-var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$6 });
-async function up$6(db) {
+var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
+async function up$13(db) {
 	await db.schema.createTable("sync_dead_letters").addColumn("ordinal", "serial", (col) => col.primaryKey()).addColumn("id", "text", (col) => col.unique().notNull()).addColumn("job_id", "text", (col) => col.notNull()).addColumn("job_dependencies", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("remote_name", "text", (col) => col.notNull().references("sync_remotes.name").onDelete("cascade")).addColumn("document_id", "text", (col) => col.notNull()).addColumn("scopes", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("branch", "text", (col) => col.notNull()).addColumn("operations", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("error_source", "text", (col) => col.notNull()).addColumn("error_message", "text", (col) => col.notNull()).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 	await db.schema.createIndex("idx_sync_dead_letters_remote").on("sync_dead_letters").column("remote_name").execute();
 }
 //#endregion
 //#region src/storage/migrations/014_create_processor_cursor_table.ts
-var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$5 });
-async function up$5(db) {
+var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$12 });
+async function up$12(db) {
 	await db.schema.createTable("ProcessorCursor").addColumn("processorId", "text", (col) => col.primaryKey()).addColumn("factoryId", "text", (col) => col.notNull()).addColumn("driveId", "text", (col) => col.notNull()).addColumn("processorIndex", "integer", (col) => col.notNull()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(sql`0`)).addColumn("status", "text", (col) => col.notNull().defaultTo(sql`'active'`)).addColumn("lastError", "text").addColumn("lastErrorTimestamp", "timestamptz").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/015_add_operation_denied_reason.ts
 var _015_add_operation_denied_reason_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$4,
-	up: () => up$4
+	down: () => down$11,
+	up: () => up$11
 });
 /**
 * Records why authorization refused an operation. Separate from `error` so a
 * denial is distinguishable from a reducer failure without matching on a
 * message. Null for every operation written before decisions were enforced.
 */
-async function up$4(db) {
+async function up$11(db) {
 	await db.schema.alterTable("Operation").addColumn("deniedReason", "text").execute();
 	await db.schema.alterTable("operation_index_operations").addColumn("deniedReason", "text").execute();
 }
-async function down$4(db) {
+async function down$11(db) {
 	await db.schema.alterTable("operation_index_operations").dropColumn("deniedReason").execute();
 	await db.schema.alterTable("Operation").dropColumn("deniedReason").execute();
 }
 //#endregion
 //#region src/storage/migrations/016_add_dead_letter_error_type.ts
 var _016_add_dead_letter_error_type_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$3,
-	up: () => up$3
+	down: () => down$10,
+	up: () => up$10
 });
 /**
 * The classification a dead letter falls into, stored because it decides whether
 * the document stays quarantined and the in-memory error is gone after a restart.
 * Defaulted rather than nullable, so a pre-existing row rehydrates.
 */
-async function up$3(db) {
+async function up$10(db) {
 	await db.schema.alterTable("sync_dead_letters").addColumn("error_type", "text", (col) => col.notNull().defaultTo("UNCLASSIFIED")).execute();
 }
-async function down$3(db) {
+async function down$10(db) {
 	await db.schema.alterTable("sync_dead_letters").dropColumn("error_type").execute();
 }
 //#endregion
 //#region src/storage/migrations/017_create_group_references.ts
 var _017_create_group_references_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$2,
-	up: () => up$2
+	down: () => down$9,
+	up: () => up$9
 });
 /**
 * One row per (document, group) reference ever discovered from an auth
@@ -5148,18 +7162,18 @@ var _017_create_group_references_exports = /* @__PURE__ */ __exportAll({
 * requires (sync), and by groupId for the documents a group change affects
 * (re-evaluation).
 */
-async function up$2(db) {
+async function up$9(db) {
 	await db.schema.createTable("group_references").addColumn("documentId", "text", (col) => col.notNull()).addColumn("groupId", "text", (col) => col.notNull()).addPrimaryKeyConstraint("group_references_pkey", ["documentId", "groupId"]).execute();
 	await db.schema.createIndex("idx_group_references_groupId").on("group_references").column("groupId").execute();
 }
-async function down$2(db) {
+async function down$9(db) {
 	await db.schema.dropTable("group_references").execute();
 }
 //#endregion
 //#region src/storage/migrations/018_add_sync_remote_bound_address.ts
 var _018_add_sync_remote_bound_address_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$8,
+	up: () => up$8
 });
 /**
 * The address a sync channel is bound to, so a channel created by one subject
@@ -5170,17 +7184,17 @@ var _018_add_sync_remote_bound_address_exports = /* @__PURE__ */ __exportAll({
 * until its first authenticated poll adopts it. A default would claim them all
 * for one address.
 */
-async function up$1(db) {
+async function up$8(db) {
 	await db.schema.alterTable("sync_remotes").addColumn("bound_address", "text").execute();
 }
-async function down$1(db) {
+async function down$8(db) {
 	await db.schema.alterTable("sync_remotes").dropColumn("bound_address").execute();
 }
 //#endregion
 //#region src/storage/migrations/019_require_action_id.ts
 var _019_require_action_id_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$7,
+	up: () => up$7
 });
 /**
 * Makes an operation whose action carries no id physically unstorable.
@@ -5207,7 +7221,7 @@ var _019_require_action_id_exports = /* @__PURE__ */ __exportAll({
 * The empty string is rejected alongside null. It derives the same colliding
 * operation id as an absent id, so admitting it would leave the hole open.
 */
-async function up(db) {
+async function up$7(db) {
 	await db.updateTable("Operation").set({ action: sql`jsonb_set(action, '{id}', to_jsonb(gen_random_uuid()::text))` }).where(sql`jsonb_typeof(action) = 'object' and coalesce(action->>'id', '') = ''`).execute();
 	await db.updateTable("operation_index_operations as oio").from("Operation as op").set({ action: sql`jsonb_set(oio.action, '{id}', to_jsonb(op.action->>'id'))` }).whereRef("oio.opId", "=", "op.opId").whereRef("oio.index", "=", "op.index").whereRef("oio.skip", "=", "op.skip").where(sql`jsonb_typeof(oio.action) = 'object' and coalesce(oio.action->>'id', '') = ''`).where(sql`coalesce(op.action->>'id', '') <> ''`).execute();
 	await db.updateTable("operation_index_operations").set({ action: sql`jsonb_set(action, '{id}', to_jsonb(gen_random_uuid()::text))` }).where(sql`jsonb_typeof(action) = 'object' and coalesce(action->>'id', '') = ''`).execute();
@@ -5219,11 +7233,118 @@ async function up(db) {
 * their operations are now known by, and reverting them would reintroduce the
 * collision the migration removed.
 */
-async function down(db) {
+async function down$7(db) {
 	await db.schema.alterTable("operation_index_operations").dropConstraint("action_must_have_id").execute();
 	await db.schema.alterTable("Operation").dropConstraint("action_must_have_id").execute();
 }
 //#endregion
+//#region src/storage/migrations/020_add_snapshot_operation_ordinal.ts
+var _020_add_snapshot_operation_ordinal_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$6,
+	up: () => up$6
+});
+/** Orders header row writes across scopes; `lastOperationIndex` is per scope. */
+async function up$6(db) {
+	await db.schema.alterTable("DocumentSnapshot").addColumn("lastOperationOrdinal", "integer", (col) => col.notNull().defaultTo(0)).execute();
+}
+async function down$6(db) {
+	await db.schema.alterTable("DocumentSnapshot").dropColumn("lastOperationOrdinal").execute();
+}
+//#endregion
+//#region src/storage/migrations/021_add_sync_remote_peer.ts
+var _021_add_sync_remote_peer_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$5,
+	up: () => up$5
+});
+/**
+* The peer's manifest as canonical JSON, and when it was heard. Both null: not
+* yet heard. A time with no manifest: a silent peer, which gets the baselines.
+*/
+async function up$5(db) {
+	await db.schema.alterTable("sync_remotes").addColumn("peer_manifest", "text").addColumn("peer_manifest_at_utc_ms", "bigint").execute();
+}
+async function down$5(db) {
+	await db.schema.alterTable("sync_remotes").dropColumn("peer_manifest").dropColumn("peer_manifest_at_utc_ms").execute();
+}
+//#endregion
+//#region src/storage/migrations/022_create_sync_holds.ts
+var _022_create_sync_holds_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$4,
+	up: () => up$4
+});
+/** Documents held back from a remote whose peer cannot run their versions. */
+async function up$4(db) {
+	await db.schema.createTable("sync_holds").addColumn("remote_name", "text", (col) => col.notNull().references("sync_remotes.name").onDelete("cascade")).addColumn("document_id", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("protocol", "text", (col) => col.notNull()).addColumn("version", "integer", (col) => col.notNull()).addColumn("held_at_utc_ms", "bigint", (col) => col.notNull()).addPrimaryKeyConstraint("sync_holds_pkey", [
+		"remote_name",
+		"document_id",
+		"branch"
+	]).execute();
+}
+async function down$4(db) {
+	await db.schema.dropTable("sync_holds").execute();
+}
+//#endregion
+//#region src/storage/migrations/023_index_created_protocol_versions.ts
+var _023_index_created_protocol_versions_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$3,
+	up: () => up$3
+});
+/**
+* One entry per document created with protocolVersions, keyed by a hash so an
+* oversized header cannot make its creation unstorable. Startup reads the
+* distinct values without visiting every document.
+*/
+async function up$3(db) {
+	await db.schema.createIndex("idx_operation_created_protocol_versions").on("Operation").expression(sql`md5((action->'input'->'protocolVersions')::text)`).where(sql`scope = 'document' and "index" = 0 and (action->'input'->'protocolVersions') is not null`).execute();
+}
+async function down$3(db) {
+	await db.schema.dropIndex("idx_operation_created_protocol_versions").execute();
+}
+//#endregion
+//#region src/storage/migrations/024_create_document_purges.ts
+var _024_create_document_purges_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$2,
+	up: () => up$2
+});
+/** One row per purged document: the tombstone. Written once, never deleted. */
+async function up$2(db) {
+	await db.schema.createTable("document_purges").addColumn("documentId", "text", (col) => col.primaryKey()).addColumn("ordinal", "bigint", (col) => col.notNull()).addColumn("removedRows", "jsonb", (col) => col.notNull()).addColumn("purgedAtUtc", "timestamptz", (col) => col.notNull()).addColumn("requestId", "text", (col) => col.notNull()).execute();
+}
+async function down$2(db) {
+	await db.schema.dropTable("document_purges").execute();
+}
+//#endregion
+//#region src/storage/migrations/025_create_sync_received_markers.ts
+var _025_create_sync_received_markers_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$1,
+	up: () => up$1
+});
+/** Received purge markers awaiting their outcome; removed with their remote. */
+async function up$1(db) {
+	await db.schema.createTable("sync_received_markers").addColumn("remote_name", "text", (col) => col.notNull()).addColumn("marker_id", "text", (col) => col.notNull()).addColumn("document_id", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("operation", "jsonb", (col) => col.notNull()).addColumn("received_at_utc_ms", "bigint", (col) => col.notNull()).addPrimaryKeyConstraint("sync_received_markers_pkey", ["remote_name", "marker_id"]).execute();
+}
+async function down$1(db) {
+	await db.schema.dropTable("sync_received_markers").execute();
+}
+//#endregion
+//#region src/storage/migrations/026_create_sync_purge_refusals.ts
+var _026_create_sync_purge_refusals_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/** A remote's refusal of a purge marker; payload-free, kept like the tombstone. */
+async function up(db) {
+	await db.schema.createTable("sync_purge_refusals").addColumn("remote_name", "text", (col) => col.notNull()).addColumn("document_id", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("refused_at_utc_ms", "bigint", (col) => col.notNull()).addPrimaryKeyConstraint("sync_purge_refusals_pkey", [
+		"remote_name",
+		"document_id",
+		"branch"
+	]).execute();
+	await db.schema.createIndex("idx_sync_purge_refusals_document").on("sync_purge_refusals").column("document_id").execute();
+}
+async function down(db) {
+	await db.schema.dropTable("sync_purge_refusals").execute();
+}
+//#endregion
 //#region src/storage/migrations/migrator.ts
 const REACTOR_SCHEMA = "reactor";
 const migrations = {
@@ -5245,7 +7366,14 @@ const migrations = {
 	"016_add_dead_letter_error_type": _016_add_dead_letter_error_type_exports,
 	"017_create_group_references": _017_create_group_references_exports,
 	"018_add_sync_remote_bound_address": _018_add_sync_remote_bound_address_exports,
-	"019_require_action_id": _019_require_action_id_exports
+	"019_require_action_id": _019_require_action_id_exports,
+	"020_add_snapshot_operation_ordinal": _020_add_snapshot_operation_ordinal_exports,
+	"021_add_sync_remote_peer": _021_add_sync_remote_peer_exports,
+	"022_create_sync_holds": _022_create_sync_holds_exports,
+	"023_index_created_protocol_versions": _023_index_created_protocol_versions_exports,
+	"024_create_document_purges": _024_create_document_purges_exports,
+	"025_create_sync_received_markers": _025_create_sync_received_markers_exports,
+	"026_create_sync_purge_refusals": _026_create_sync_purge_refusals_exports
 };
 var ProgrammaticMigrationProvider = class {
 	getMigrations() {
@@ -5303,8 +7431,163 @@ async function getMigrationStatus(db, schema = REACTOR_SCHEMA) {
 }
 //#endregion
 //#region src/core/drive-container-types.ts
-const DEFAULT_DRIVE_CONTAINER_TYPES = new Set(["powerhouse/document-drive", "powerhouse/reactor-drive"]);
+const DEFAULT_DRIVE_CONTAINER_TYPES = /* @__PURE__ */ new Set(["powerhouse/document-drive", "powerhouse/reactor-drive"]);
+//#endregion
+//#region src/executor/worker/error-info.ts
+const MAX_STACK_LENGTH = 8192;
+const MAX_CAUSE_DEPTH = 8;
+function toErrorInfo(err, depth = 0) {
+	if (depth > MAX_CAUSE_DEPTH) return {
+		name: "Error",
+		message: "cause chain truncated"
+	};
+	if (err instanceof Error) {
+		const info = {
+			name: err.name || "Error",
+			message: err.message
+		};
+		if (typeof err.stack === "string") info.stack = err.stack.length > MAX_STACK_LENGTH ? err.stack.slice(0, MAX_STACK_LENGTH) : err.stack;
+		if (err.cause !== void 0) info.cause = toErrorInfo(err.cause, depth + 1);
+		const documentId = err.documentId;
+		if (typeof documentId === "string") info.documentId = documentId;
+		const { documentType, requestedVersion } = err;
+		if (typeof documentType === "string") info.documentType = documentType;
+		if (typeof requestedVersion === "number") info.requestedVersion = requestedVersion;
+		return info;
+	}
+	if (typeof err === "string") return {
+		name: "Error",
+		message: err
+	};
+	if (err && typeof err === "object") {
+		const record = err;
+		return {
+			name: typeof record.name === "string" ? record.name : "Error",
+			message: typeof record.message === "string" ? record.message : safeStringify(err)
+		};
+	}
+	return {
+		name: "Error",
+		message: safeStringify(err)
+	};
+}
+function safeStringify(value) {
+	if (value === null || value === void 0) return String(value);
+	if (typeof value === "string") return value;
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	try {
+		return JSON.stringify(value);
+	} catch {
+		return "[unserializable]";
+	}
+}
+function fromErrorInfo(info) {
+	const err = new Error(info.message);
+	Object.defineProperty(err, "name", {
+		value: info.name,
+		configurable: true,
+		writable: true
+	});
+	if (info.stack !== void 0) err.stack = info.stack;
+	if (info.documentId !== void 0) Object.defineProperty(err, "documentId", {
+		value: info.documentId,
+		configurable: true,
+		writable: true
+	});
+	for (const key of ["documentType", "requestedVersion"]) if (info[key] !== void 0) Object.defineProperty(err, key, {
+		value: info[key],
+		configurable: true,
+		writable: true
+	});
+	if (info.cause !== void 0) Object.defineProperty(err, "cause", {
+		value: fromErrorInfo(info.cause),
+		configurable: true,
+		writable: true
+	});
+	return err;
+}
+//#endregion
+//#region src/executor/worker/sanitize.ts
+const MAX_DEPTH = 8;
+function errorToInfo(err) {
+	return toErrorInfo(err);
+}
+function sanitizeArg(value, depth = 0, seen = /* @__PURE__ */ new WeakSet()) {
+	if (depth > MAX_DEPTH) return "[Truncated]";
+	if (value === null || value === void 0) return null;
+	if (typeof value === "boolean") return value;
+	if (typeof value === "number") return value;
+	if (typeof value === "string") return value;
+	if (typeof value === "bigint") return value.toString();
+	if (typeof value === "function" || typeof value === "symbol") return null;
+	if (value instanceof Error) return toErrorInfo(value);
+	if (value instanceof Date) return value.toISOString();
+	if (value instanceof Map) {
+		const obj = {};
+		for (const [k, v] of value.entries()) obj[String(k)] = sanitizeArg(v, depth + 1, seen);
+		return obj;
+	}
+	if (value instanceof Set) {
+		const arr = [];
+		for (const v of value.values()) arr.push(sanitizeArg(v, depth + 1, seen));
+		return arr;
+	}
+	if (Array.isArray(value)) {
+		if (seen.has(value)) return "[Circular]";
+		seen.add(value);
+		const result = value.map((v) => sanitizeArg(v, depth + 1, seen));
+		seen.delete(value);
+		return result;
+	}
+	if (typeof value === "object") {
+		const proto = Object.getPrototypeOf(value);
+		if (proto !== Object.prototype && proto !== null) return { __nonClonable: value.constructor?.name || "Unknown" };
+		if (seen.has(value)) return "[Circular]";
+		seen.add(value);
+		const result = {};
+		for (const [k, v] of Object.entries(value)) result[k] = sanitizeArg(v, depth + 1, seen);
+		seen.delete(value);
+		return result;
+	}
+	return null;
+}
+//#endregion
+//#region src/executor/worker/forwarding-logger.ts
+function createForwardingLogger(post, level = "info", tags = []) {
+	function safePost(msg) {
+		try {
+			post(msg);
+		} catch {
+			try {
+				process.stderr.write(`[forwarding-logger] postMessage failed: ${msg.level} ${msg.message}\n`);
+			} catch {}
+		}
+	}
+	function emit(wireLevel, message, args) {
+		const sanitizedArgs = args.map((a) => sanitizeArg(a));
+		safePost({
+			type: "log",
+			level: wireLevel,
+			message,
+			args: tags.length > 0 ? [sanitizeArg({ tags }), ...sanitizedArgs] : sanitizedArgs,
+			timestamp: Date.now()
+		});
+	}
+	return {
+		level,
+		verbose: (message, ...args) => emit("debug", message, args),
+		debug: (message, ...args) => emit("debug", message, args),
+		info: (message, ...args) => emit("info", message, args),
+		warn: (message, ...args) => emit("warn", message, args),
+		error: (message, ...args) => emit("error", message, args),
+		errorHandler: ((...data) => {
+			const first = data[0];
+			emit("error", typeof first === "string" ? first : "", data.slice(1));
+		}),
+		child: (childTags) => createForwardingLogger(post, level, [...tags, ...childTags])
+	};
+}
 //#endregion
-export { selectDecisionModel as A, RevisionMismatchError as B, InvalidModuleError as C, createEmptyConsistencyToken as D, createConsistencyToken as E, AppendConditionFailedError as F, DocumentNotFoundError as G, AuthTimestampNotMonotonicError as H, DocumentAlreadyExistsError as I, UpgradePreconditionFailedError as J, ExcessiveReshuffleError as K, DocumentExistence as L, authDecisionModel as M, buildDecisionModel as N, targetDocumentId as O, APPEND_CONDITION_FAILED_PREFIX as P, __exportAll as Q, DuplicateOperationError as R, DuplicateModuleError as S, GATED_DOCUMENT_ACTIONS as T, AuthorizationDeniedError as U, AuthEnforcementDisabledError as V, DocumentDeletedError as W, parsePagingOptions as X, matchesScope as Y, throwIfAborted as Z, DocumentMetaCache as _, createForwardingPoolInstrumentation as a, JobExecutorEventTypes as b, KyselyKeyframeStore as c, DriveCollectionId as d, KyselyExecutionScope as f, KyselyOperationIndex as g, KyselyWriteCache as h, runMigrations as i, documentDecisionModel as j, decideAtHead as k, DocumentModelRegistry as l, EventBus as m, REACTOR_SCHEMA as n, instrumentPgPool as o, resolveFeatureFlags as p, InvalidOperationTimestampError as q, getMigrationStatus as r, KyselyOperationStore as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, SimpleJobExecutor as u, CollectionMembershipCache as v, ModuleNotFoundError as w, DuplicateManifestError as x, DEFAULT_DEFERRED_JOB_TTL_MS as y, OptimisticLockError as z };
+export { decideAtHead as $, ProbeSettler as A, ReactorEventTypes as At, JobExecutorEventTypes as B, KyselyWriteCache as C, PurgeTooLargeError as Ct, acquirePurgeLocks as D, UnsupportedStoredProtocolError as Dt, PURGE_NS as E, UnsupportedProtocolVersionError as Et, snapshotFunctionsFor as F, __exportAll as Ft, ModuleNotFoundError as G, DuplicateModuleError as H, DocumentMetaCache as I, createDocumentFromAction as J, GATED_DOCUMENT_ACTIONS as K, CollectionMembershipCache as L, createKyselyWatermarkProbe as M, parsePagingOptions as Mt, describeWaitingSessions as N, throwIfAborted as Nt, findPurged as O, UpgradePreconditionFailedError as Ot, parseSnapshot as P, yieldToMain as Pt, targetDocumentId as Q, DEFAULT_DEFERRED_JOB_TTL_MS as R, EventBus as S, InvalidSignatureError as St, PURGE_LOCK_BUCKETS as T, ReservedActionError as Tt, InvalidModuleError as U, DuplicateManifestError as V, ModelNotWorkerImportableError as W, submittedActionIds as X, createEmptyConsistencyToken as Y, summarizeSubmittedActions as Z, KyselyExecutionScope as _, DocumentNotFoundError as _t, DEFAULT_DRIVE_CONTAINER_TYPES as a, APPEND_CONDITION_FAILED_PREFIX as at, appliedDelete as b, GroupInUseError as bt, runMigrations as c, DocumentExistence as ct, KyselyOperationStore as d, RevisionMismatchError as dt, selectDecisionModel as et, KyselyKeyframeStore as f, AuthEnforcementDisabledError as ft, PassthroughSigner as g, DocumentNotDeletedError as gt, verifyActionSignature as h, DocumentDeletedError as ht, fromErrorInfo as i, DriveCollectionId as it, SettledWatermark as j, matchesScope as jt, listPurged as k, EventBusAggregateError as kt, createForwardingPoolInstrumentation as l, DuplicateOperationError as lt, SimpleJobExecutor as m, AuthorizationDeniedError as mt, errorToInfo as n, authDecisionModel as nt, REACTOR_SCHEMA as o, AppendConditionFailedError as ot, DocumentModelRegistry as p, AuthTimestampNotMonotonicError as pt, createConsistencyToken as q, sanitizeArg as r, buildDecisionModel as rt, getMigrationStatus as s, DocumentAlreadyExistsError as st, createForwardingLogger as t, documentDecisionModel as tt, instrumentPgPool as u, OptimisticLockError as ut, DEFAULT_PURGE_DELETE_BATCH as v, DocumentPurgedError as vt, KyselyOperationIndex as w, RelationshipNotFoundError as wt, resolveFeatureFlags as x, InvalidOperationTimestampError as xt, KyselyDocumentPurger as y, ExcessiveReshuffleError as yt, DEFAULT_MAX_PURGE_OPERATIONS as z };
 
-//# sourceMappingURL=drive-container-types-yZrksiJR.js.map
+//# sourceMappingURL=forwarding-logger-BKDP4JnD.js.map