@powerhousedao/reactor 6.2.3-dev.50 → 6.2.3-dev.52

package/dist/index.js

@@ -1,13 +1,14 @@
-import { $ as DocumentExistence, A as GATED_DOCUMENT_ACTIONS, C as describeWaitingSessions, Ct as matchesScope, D as CollectionMembershipCache, Dt as __exportAll, E as DocumentMetaCache, J as targetDocumentId, K as submittedActionIds, L as createConsistencyToken, Q as DocumentAlreadyExistsError, R as createDocumentFromAction, S as createKyselyWatermarkProbe, St as ReactorEventTypes, T as snapshotFunctionsFor, Tt as throwIfAborted, X as APPEND_CONDITION_FAILED_PREFIX, Z as AppendConditionFailedError, _ as acquirePurgeLocks, _t as ReservedActionError, a as REACTOR_SCHEMA, at as AuthorizationDeniedError, b as ProbeSettler, bt as UpgradePreconditionFailedError, c as createForwardingPoolInstrumentation, ct as DocumentNotDeletedError, d as KyselyKeyframeStore, dt as ExcessiveReshuffleError, et as DuplicateOperationError, f as EventBus, ft as GroupInUseError, g as PURGE_NS, gt as RelationshipNotFoundError, h as PURGE_LOCK_BUCKETS, ht as PurgeTooLargeError, it as AuthTimestampNotMonotonicError, l as instrumentPgPool, lt as DocumentNotFoundError, m as KyselyOperationIndex, mt as InvalidSignatureError, n as errorToInfo, nt as RevisionMismatchError, o as getMigrationStatus, ot as BatchJobFailedError, p as KyselyWriteCache, pt as InvalidOperationTimestampError, q as summarizeSubmittedActions, r as sanitizeArg, rt as AuthEnforcementDisabledError, s as runMigrations, st as DocumentDeletedError, t as createForwardingLogger, tt as OptimisticLockError, u as KyselyOperationStore, ut as DocumentPurgedError, v as findPurged, vt as UnsupportedProtocolVersionError, w as parseSnapshot, wt as parsePagingOptions, x as SettledWatermark, xt as EventBusAggregateError, y as listPurged, yt as UnsupportedStoredProtocolError, z as createEmptyConsistencyToken } from "./forwarding-logger-ByfBFgMS.js";
-import { _ as buildDecisionModel, a as KyselyExecutionScope, c as appliedDelete, d as DEFAULT_MAX_PURGE_OPERATIONS, f as JobExecutorEventTypes, g as authDecisionModel, h as documentDecisionModel, i as PassthroughSigner, l as resolveFeatureFlags, m as selectDecisionModel, n as SimpleJobExecutor, o as DEFAULT_PURGE_DELETE_BATCH, p as decideAtHead, r as verifyActionSignature, s as KyselyDocumentPurger, t as DEFAULT_DRIVE_CONTAINER_TYPES, u as DEFAULT_DEFERRED_JOB_TTL_MS, v as DriveCollectionId } from "./drive-container-types-Ci1pdv4X.js";
+import { $ as DocumentExistence, A as GATED_DOCUMENT_ACTIONS, C as describeWaitingSessions, Ct as ReactorEventTypes, D as CollectionMembershipCache, Dt as parsePagingOptions, E as DocumentMetaCache, Et as matchesScope, J as targetDocumentId, K as submittedActionIds, L as createConsistencyToken, Ot as throwIfAborted, Q as DocumentAlreadyExistsError, R as createDocumentFromAction, S as createKyselyWatermarkProbe, St as EventBusAggregateError, T as snapshotFunctionsFor, X as APPEND_CONDITION_FAILED_PREFIX, Z as AppendConditionFailedError, _ as acquirePurgeLocks, _t as RelationshipNotFoundError, a as REACTOR_SCHEMA, at as AuthorizationDeniedError, b as ProbeSettler, bt as UnsupportedStoredProtocolError, c as createForwardingPoolInstrumentation, ct as DocumentNotDeletedError, d as KyselyKeyframeStore, dt as ExcessiveReshuffleError, et as DuplicateOperationError, f as EventBus, ft as GroupInUseError, g as PURGE_NS, gt as PurgeTooLargeError, h as PURGE_LOCK_BUCKETS, ht as JOB_NOT_FOUND_ERROR_NAME, it as AuthTimestampNotMonotonicError, jt as __exportAll, kt as withDeadline, l as instrumentPgPool, lt as DocumentNotFoundError, m as KyselyOperationIndex, mt as InvalidSignatureError, n as errorToInfo, nt as RevisionMismatchError, o as getMigrationStatus, ot as BatchJobFailedError, p as KyselyWriteCache, pt as InvalidOperationTimestampError, q as summarizeSubmittedActions, r as sanitizeArg, rt as AuthEnforcementDisabledError, s as runMigrations, st as DocumentDeletedError, t as createForwardingLogger, tt as OptimisticLockError, u as KyselyOperationStore, ut as DocumentPurgedError, v as findPurged, vt as ReservedActionError, w as parseSnapshot, wt as TIMED_OUT, x as SettledWatermark, xt as UpgradePreconditionFailedError, y as listPurged, yt as UnsupportedProtocolVersionError, z as createEmptyConsistencyToken } from "./forwarding-logger-B9LLXItm.js";
+import { C as PropagationMode, S as JobStatus, T as cursorProtectedLoadMeta, _ as selectDecisionModel, a as NoopStorageFlusher, b as buildDecisionModel, c as DEFAULT_PURGE_DELETE_BATCH, d as resolveFeatureFlags, f as DEFAULT_DEFERRED_JOB_TTL_MS, g as decideAtHead, h as JobExecutorEventTypes, i as PassthroughSigner, l as KyselyDocumentPurger, m as DEFAULT_MAX_PURGE_OPERATIONS, n as SimpleJobExecutor, o as StoragePoisonedError, p as DEFAULT_JOB_TIMEOUT_MS, r as verifyActionSignature, s as KyselyExecutionScope, t as DEFAULT_DRIVE_CONTAINER_TYPES, u as appliedDelete, v as documentDecisionModel, w as RelationshipChangeType, x as DriveCollectionId, y as authDecisionModel } from "./drive-container-types-BAfFzBOf.js";
 import { a as DuplicateModuleError, c as ModuleNotFoundError, i as DuplicateManifestError, n as loadDocumentModelSpec, o as InvalidModuleError, r as DocumentModelRegistry, s as ModelNotWorkerImportableError } from "./load-spec-ZLjuyhxz.js";
 import { i as WorkerInitFailedError, r as WorkerExitedError, t as WorkerAbortTimeoutError } from "./errors-BM_ULVWd.js";
-import { _ as ContiguousCursor, a as KyselyDocumentView, b as isCatchUpConsumer, c as ReadModelCoordinator, d as reserveBatch, f as BaseReadModel, g as unchunkedReadModelIndexingConfig, h as defaultReadModelIndexingConfig, i as DeletedDocumentRead, l as indexReserved, m as DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, n as ConsistencyTracker, o as DOCUMENT_INDEXER_READ_MODEL, p as DEFAULT_COMMIT_CHUNK_SIZE, r as makeConsistencyKey, s as DOCUMENT_VIEW_READ_MODEL, t as KyselyDocumentIndexer, u as releaseBatch, v as defaultCatchUpConfig, y as CatchUpScheduler } from "./document-indexer-DwAMDVRI.js";
+import { n as hashDocumentId, t as bucketFor } from "./worker-pool-router-BROOEQSE.js";
+import { S as isCatchUpConsumer, _ as defaultReadModelIndexingConfig, a as KyselyDocumentView, b as defaultCatchUpConfig, c as ReadModelCoordinator, d as releaseBatch, f as reserveBatch, g as DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, h as DEFAULT_COMMIT_CHUNK_SIZE, i as DeletedDocumentRead, l as indexReserved, m as BaseReadModel, n as ConsistencyTracker, o as DOCUMENT_INDEXER_READ_MODEL, p as spliceReadModel, r as makeConsistencyKey, s as DOCUMENT_VIEW_READ_MODEL, t as KyselyDocumentIndexer, u as indexStage, v as unchunkedReadModelIndexingConfig, x as CatchUpScheduler, y as ContiguousCursor } from "./document-indexer-3fkVWCaN.js";
 import { DEFAULT_SIGNATURE_POLICY, DOCUMENT_PURGE_PROTOCOL, DowngradeNotSupportedError, MARKER_REFUSAL_FEATURE, MAX_AUTH_GRANTS, PEER_CAPABILITIES, PURGE_DOCUMENT, UnsupportedDocumentModelVersionError, actionSignerIdentity, actionSigningTarget, actions, actions as documentActions, canonicalJson, coversLocal, createCopyHeader, decide, deserializeSignature, garbageCollect, generateId, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, holdReason, isOlderManifest, isPurgeMarker, isPurgeMarker as isPurgeMarker$1, legacySupports, localPeerManifest, localSupports, mergePeerCapabilities, normalizeDocumentModelVersion, peerSupports, purgedProtocolVersions, readPeerManifest, requestedSignaturePolicy, selectProtocolVersions, sortOperations, toTransportAction, withSignaturePolicy } from "@powerhousedao/shared/document-model";
 import { addFile, addFolder, copyNode, deleteNode, driveCreateDocument, generateNodesCopy, getDescendants, handleTargetNameCollisions, isFileNode, isFolderNode, moveNode, updateNode } from "@powerhousedao/shared/document-drive";
 import { v4 } from "uuid";
 import { ConsoleLogger, childLogger } from "document-model";
-import { CompiledQuery, sql } from "kysely";
+import { CompiledQuery, Kysely, sql } from "kysely";
 import { PGliteDialect } from "kysely-pglite-dialect";
 import { RelationalDbProcessor, createRelationalDb } from "@powerhousedao/shared/processors";
 //#region src/actions/index.ts
@@ -271,49 +272,7 @@ function buildSingleJobMeta(jobId, callerMeta) {
 	};
 }
 //#endregion
-//#region src/shared/types.ts
-/**
-* Enum that determines deletion propagation.
-*/
-let PropagationMode = /* @__PURE__ */ function(PropagationMode) {
-	PropagationMode["None"] = "none";
-	PropagationMode["Cascade"] = "cascade";
-	return PropagationMode;
-}({});
-/**
-* Enum that describes the type of relationship change.
-*/
-let RelationshipChangeType = /* @__PURE__ */ function(RelationshipChangeType) {
-	RelationshipChangeType["Added"] = "added";
-	RelationshipChangeType["Removed"] = "removed";
-	return RelationshipChangeType;
-}({});
-/**
-* Job execution statuses
-*/
-let JobStatus = /* @__PURE__ */ function(JobStatus) {
-	/** Job is queued but not yet started */
-	JobStatus["PENDING"] = "PENDING";
-	/** Job is currently being executed */
-	JobStatus["RUNNING"] = "RUNNING";
-	/** Operations have been written to the operation store (JOB_WRITE_READY event) */
-	JobStatus["WRITE_READY"] = "WRITE_READY";
-	/** Read models have finished indexing operations (JOB_READ_READY event) */
-	JobStatus["READ_READY"] = "READ_READY";
-	/** Job failed (may be retried) */
-	JobStatus["FAILED"] = "FAILED";
-	return JobStatus;
-}({});
-//#endregion
 //#region src/client/drive-client.ts
-/**
-* Implementation of {@link IDriveClient}.
-*
-* Holds a back-reference to its parent {@link IReactorClient} for read and
-* single-document write primitives, plus direct access to {@link IReactor}
-* for batch execution. The back-reference is captured but never invoked
-* during construction, so the partial-`this` hazard does not apply.
-*/
 /** A copy keeps its source's versions; selection fills only the keys it lacks. */
 function withSelectedVersions(header, selected) {
 	return {
@@ -327,15 +286,16 @@ function withSelectedVersions(header, selected) {
 var DriveClient = class {
 	client;
 	logger;
-	reactor;
 	signer;
 	resolveReference;
-	constructor(client, logger, reactor, signer, resolveReference) {
+	executeBatch;
+	/** `submitter` may still be an IReactor, whose executeBatch is used. */
+	constructor(client, logger, submitter, signer, resolveReference) {
 		this.client = client;
 		this.logger = logger;
-		this.reactor = reactor;
 		this.signer = signer;
 		this.resolveReference = resolveReference;
+		this.executeBatch = typeof submitter === "function" ? submitter : (request, signal) => submitter.executeBatch(request, signal);
 	}
 	async create(input, signal) {
 		this.logger.verbose("drives.create(@input)", input);
@@ -535,7 +495,7 @@ var DriveClient = class {
 	* collision has to be told apart from a transient failure.
 	*/
 	async runJobs(jobs, signal) {
-		const batchResult = await this.reactor.executeBatch({ jobs }, signal);
+		const batchResult = await this.executeBatch({ jobs }, signal);
 		const completedJobs = await Promise.all(Object.values(batchResult.jobs).map((job) => this.client.waitForJob(job, signal)));
 		for (const job of completedJobs) if (job.status === "FAILED") throw this.toError(job);
 		return completedJobs;
@@ -592,6 +552,139 @@ var DriveClient = class {
 	}
 };
 //#endregion
+//#region src/client/types.ts
+/**
+* Describes the types of document changes that can occur.
+*/
+let DocumentChangeType = /* @__PURE__ */ function(DocumentChangeType) {
+	DocumentChangeType["Created"] = "created";
+	DocumentChangeType["Deleted"] = "deleted";
+	DocumentChangeType["Updated"] = "updated";
+	DocumentChangeType["ParentAdded"] = "parent_added";
+	DocumentChangeType["ParentRemoved"] = "parent_removed";
+	DocumentChangeType["ChildAdded"] = "child_added";
+	DocumentChangeType["ChildRemoved"] = "child_removed";
+	return DocumentChangeType;
+}({});
+//#endregion
+//#region src/client/derivations.ts
+/** The signed jobs that create `document`, and attach it to `parentId`. */
+async function buildCreateJobs(document, parentId, signer, signal) {
+	const documentId = document.header.id;
+	const branch = document.header.branch || "main";
+	const createInput = {
+		model: document.header.documentType,
+		version: 0,
+		documentId,
+		signing: {
+			signature: documentId,
+			publicKey: document.header.sig.publicKey,
+			nonce: document.header.sig.nonce,
+			createdAtUtcIso: document.header.createdAtUtcIso,
+			documentType: document.header.documentType
+		},
+		slug: document.header.slug,
+		name: document.header.name,
+		branch: document.header.branch,
+		meta: document.header.meta,
+		protocolVersions: document.header.protocolVersions ?? { "base-reducer": 2 }
+	};
+	const createActions = await signActions([createDocumentAction(createInput), upgradeDocumentAction({
+		documentId,
+		model: document.header.documentType,
+		fromVersion: 0,
+		toVersion: normalizeDocumentModelVersion(document.state.document?.version),
+		initialState: document.state
+	})], signer, {
+		documentId,
+		branch
+	}, signal);
+	const jobs = [{
+		key: "create",
+		documentId,
+		scope: getSharedActionScope(createActions),
+		branch,
+		actions: createActions,
+		dependsOn: []
+	}];
+	if (parentId) {
+		const parentActions = await signActions([addRelationshipAction(parentId, documentId, "child")], signer, {
+			documentId: parentId,
+			branch: "main"
+		}, signal);
+		jobs.push({
+			key: "parent",
+			documentId: parentId,
+			scope: getSharedActionScope(parentActions),
+			branch: "main",
+			actions: parentActions,
+			dependsOn: ["create"]
+		});
+	}
+	return jobs;
+}
+/** The registered module for a type: the requested version, else the latest. */
+function selectDocumentModelModule(modules, documentModelType, documentModelVersion) {
+	const matching = modules.filter((m) => m.documentModel.global.id === documentModelType);
+	if (documentModelVersion !== void 0) {
+		const requested = normalizeDocumentModelVersion(documentModelVersion);
+		const module = matching.find((m) => normalizeDocumentModelVersion(m.version) === requested);
+		if (!module) throw new Error(`Document model not found for type: ${documentModelType} with version: ${documentModelVersion}`);
+		return module;
+	}
+	const latest = matching.reduce((best, current) => {
+		if (best === void 0) return current;
+		return normalizeDocumentModelVersion(current.version) > normalizeDocumentModelVersion(best.version) ? current : best;
+	}, void 0);
+	if (!latest) throw new Error(`Document model not found for type: ${documentModelType}`);
+	return latest;
+}
+/** A new, empty document of `module`, under the create defaults given. */
+function createEmptyDocument(module, options, defaultPolicy, baseVersions) {
+	const document = withSignaturePolicy(module.utils.createDocument(), requestedSignaturePolicy(options, defaultPolicy), { protocolVersions: {
+		...baseVersions,
+		...options?.protocolVersions
+	} });
+	document.state.document.version = normalizeDocumentModelVersion(module.version);
+	return document;
+}
+/** Retries from a fresh read when a concurrent edit invalidates the snapshot. */
+async function upgradeDocumentWith(deps, documentIdentifier, toVersion, options, signal) {
+	const maxConflictRetries = options?.maxConflictRetries ?? 3;
+	let lastConflictMessage = "";
+	for (let attempt = 0; attempt <= maxConflictRetries; attempt++) {
+		const document = await deps.read(documentIdentifier, void 0, void 0, signal);
+		const documentId = document.header.id;
+		const documentType = document.header.documentType;
+		const branch = document.header.branch || "main";
+		const fromVersion = normalizeDocumentModelVersion(document.state.document?.version);
+		let targetVersion = toVersion;
+		if (targetVersion === void 0) {
+			const module = await deps.getDocumentModelModule(documentType);
+			targetVersion = normalizeDocumentModelVersion(module.version);
+		}
+		if (targetVersion === fromVersion) return document;
+		if (targetVersion < fromVersion) throw new DowngradeNotSupportedError(documentType, fromVersion, targetVersion);
+		const action = upgradeDocumentAction({
+			documentId,
+			model: documentType,
+			fromVersion,
+			toVersion: targetVersion,
+			revision: { ...document.header.revision }
+		});
+		const signedActions = await signActions([action], deps.signer, {
+			documentId,
+			branch
+		}, signal);
+		const jobInfo = await deps.submit(documentId, branch, signedActions, signal);
+		const completedJob = await deps.waitForJob(jobInfo, signal);
+		if (completedJob.status !== "FAILED") return deps.read(documentId, branch, completedJob.consistencyToken, signal);
+		if (completedJob.error?.name !== "UpgradePreconditionFailedError") throw new Error(completedJob.error?.message);
+		lastConflictMessage = completedJob.error.message;
+	}
+	throw new Error(`Upgrade of document ${documentIdentifier} conflicted with concurrent edits after ${maxConflictRetries + 1} attempts: ${lastConflictMessage}`);
+}
+//#endregion
 //#region src/shared/awaiter.ts
 /**
 * Checks if a job status is terminal (job has finished).
@@ -726,21 +819,6 @@ function decodeCompositeCursor(cursor) {
 	}
 }
 //#endregion
-//#region src/client/types.ts
-/**
-* Describes the types of document changes that can occur.
-*/
-let DocumentChangeType = /* @__PURE__ */ function(DocumentChangeType) {
-	DocumentChangeType["Created"] = "created";
-	DocumentChangeType["Deleted"] = "deleted";
-	DocumentChangeType["Updated"] = "updated";
-	DocumentChangeType["ParentAdded"] = "parent_added";
-	DocumentChangeType["ParentRemoved"] = "parent_removed";
-	DocumentChangeType["ChildAdded"] = "child_added";
-	DocumentChangeType["ChildRemoved"] = "child_removed";
-	return DocumentChangeType;
-}({});
-//#endregion
 //#region src/decision/read-gate.ts
 /**
 * Scopes every holder of a document may read, whatever the grants say. Denying
@@ -1293,7 +1371,7 @@ var ReactorClient = class {
 		this.eventReads = new EventReadsSource(reactor, documentView, readGate);
 		this.actionEvaluation = actionEvaluation;
 		this.createSignaturePolicy = createSignaturePolicy;
-		this.drives = new DriveClient(this, logger, reactor, signer, (id, signal) => this.resolveReference(id, "main", signal));
+		this.drives = new DriveClient(this, logger, (request, signal) => reactor.executeBatch(request, signal), signer, (id, signal) => this.resolveReference(id, "main", signal));
 		this.logger.verbose("ReactorClient initialized");
 	}
 	/**
@@ -1555,58 +1633,7 @@ var ReactorClient = class {
 		return this.submitCreate(document, parentIdentifier, signal);
 	}
 	async submitCreate(document, parentIdentifier, signal) {
-		const documentId = document.header.id;
-		const branch = document.header.branch || "main";
-		const parentId = parentIdentifier ? await this.resolveReference(parentIdentifier, "main", signal) : void 0;
-		const createInput = {
-			model: document.header.documentType,
-			version: 0,
-			documentId,
-			signing: {
-				signature: documentId,
-				publicKey: document.header.sig.publicKey,
-				nonce: document.header.sig.nonce,
-				createdAtUtcIso: document.header.createdAtUtcIso,
-				documentType: document.header.documentType
-			},
-			slug: document.header.slug,
-			name: document.header.name,
-			branch: document.header.branch,
-			meta: document.header.meta,
-			protocolVersions: document.header.protocolVersions ?? { "base-reducer": 2 }
-		};
-		const createActions = await signActions([createDocumentAction(createInput), upgradeDocumentAction({
-			documentId,
-			model: document.header.documentType,
-			fromVersion: 0,
-			toVersion: normalizeDocumentModelVersion(document.state.document?.version),
-			initialState: document.state
-		})], this.signer, {
-			documentId,
-			branch
-		}, signal);
-		const jobs = [{
-			key: "create",
-			documentId,
-			scope: getSharedActionScope(createActions),
-			branch,
-			actions: createActions,
-			dependsOn: []
-		}];
-		if (parentId) {
-			const parentActions = await signActions([addRelationshipAction(parentId, documentId, "child")], this.signer, {
-				documentId: parentId,
-				branch: "main"
-			}, signal);
-			jobs.push({
-				key: "parent",
-				documentId: parentId,
-				scope: getSharedActionScope(parentActions),
-				branch: "main",
-				actions: parentActions,
-				dependsOn: ["create"]
-			});
-		}
+		const jobs = await buildCreateJobs(document, parentIdentifier ? await this.resolveReference(parentIdentifier, "main", signal) : void 0, this.signer, signal);
 		return this.reactor.executeBatch({ jobs }, signal);
 	}
 	/**
@@ -1626,26 +1653,9 @@ var ReactorClient = class {
 		return this.submitCreate(document, options?.parentIdentifier, signal);
 	}
 	async emptyDocument(documentModelType, options, signal) {
-		const matchingModules = (await this.reactor.getDocumentModels(void 0, void 0, signal)).results.filter((m) => m.documentModel.global.id === documentModelType);
-		let module;
-		if (options?.documentModelVersion !== void 0) {
-			const requestedVersion = normalizeDocumentModelVersion(options.documentModelVersion);
-			module = matchingModules.find((m) => normalizeDocumentModelVersion(m.version) === requestedVersion);
-			if (!module) throw new Error(`Document model not found for type: ${documentModelType} with version: ${options.documentModelVersion}`);
-		} else {
-			module = matchingModules.reduce((latest, current) => {
-				if (latest === void 0) return current;
-				return normalizeDocumentModelVersion(current.version) > normalizeDocumentModelVersion(latest.version) ? current : latest;
-			}, void 0);
-			if (!module) throw new Error(`Document model not found for type: ${documentModelType}`);
-		}
+		const module = selectDocumentModelModule((await this.reactor.getDocumentModels(void 0, void 0, signal)).results, documentModelType, options?.documentModelVersion);
 		const base = await this.getCreateProtocolVersions(options?.parentIdentifier, signal);
-		const document = withSignaturePolicy(module.utils.createDocument(), requestedSignaturePolicy(options, this.createSignaturePolicy), { protocolVersions: {
-			...base,
-			...options?.protocolVersions
-		} });
-		document.state.document.version = normalizeDocumentModelVersion(module.version);
-		return document;
+		return createEmptyDocument(module, options, this.createSignaturePolicy, base);
 	}
 	/**
 	* Upgrades a document to a newer document model version by dispatching an
@@ -1660,42 +1670,14 @@ var ReactorClient = class {
 	*/
 	async upgradeDocument(documentIdentifier, toVersion, options, signal) {
 		this.logger.verbose("upgradeDocument(@documentIdentifier, @toVersion)", documentIdentifier, toVersion);
-		const maxConflictRetries = options?.maxConflictRetries ?? 3;
-		let lastConflictMessage = "";
-		for (let attempt = 0; attempt <= maxConflictRetries; attempt++) {
-			const document = await this.reactor.getByIdOrSlug(documentIdentifier, void 0, void 0, signal);
-			const documentId = document.header.id;
-			const documentType = document.header.documentType;
-			const branch = document.header.branch || "main";
-			const fromVersion = normalizeDocumentModelVersion(document.state.document?.version);
-			let targetVersion = toVersion;
-			if (targetVersion === void 0) {
-				const module = await this.getDocumentModelModule(documentType);
-				targetVersion = normalizeDocumentModelVersion(module.version);
-			}
-			if (targetVersion === fromVersion) return this.gateDocument(document, { branch }, signal);
-			if (targetVersion < fromVersion) throw new DowngradeNotSupportedError(documentType, fromVersion, targetVersion);
-			const action = upgradeDocumentAction({
-				documentId,
-				model: documentType,
-				fromVersion,
-				toVersion: targetVersion,
-				revision: { ...document.header.revision }
-			});
-			const signedActions = await signActions([action], this.signer, {
-				documentId,
-				branch
-			}, signal);
-			const jobInfo = await this.reactor.execute(documentId, branch, signedActions, signal);
-			const completedJob = await this.waitForJob(jobInfo, signal);
-			if (completedJob.status !== "FAILED") {
-				const upgraded = await this.reactor.getByIdOrSlug(documentId, { branch }, completedJob.consistencyToken, signal);
-				return this.gateDocument(upgraded, { branch }, signal);
-			}
-			if (completedJob.error?.name !== "UpgradePreconditionFailedError") throw new Error(completedJob.error?.message);
-			lastConflictMessage = completedJob.error.message;
-		}
-		throw new Error(`Upgrade of document ${documentIdentifier} conflicted with concurrent edits after ${maxConflictRetries + 1} attempts: ${lastConflictMessage}`);
+		const upgraded = await upgradeDocumentWith({
+			signer: this.signer,
+			read: (identifier, branch, consistencyToken, readSignal) => this.reactor.getByIdOrSlug(identifier, branch === void 0 ? void 0 : { branch }, consistencyToken, readSignal),
+			getDocumentModelModule: (documentType) => this.getDocumentModelModule(documentType),
+			submit: (documentId, branch, actions, submitSignal) => this.reactor.execute(documentId, branch, actions, submitSignal),
+			waitForJob: (job, waitSignal) => this.waitForJob(job, waitSignal)
+		}, documentIdentifier, toVersion, options, signal);
+		return this.gateDocument(upgraded, { branch: upgraded.header.branch || "main" }, signal);
 	}
 	/**
 	* Creates an empty document in a drive as a single batched operation.
@@ -2294,6 +2276,10 @@ function toErrorInfo(error) {
 		stack: (/* @__PURE__ */ new Error()).stack || ""
 	};
 }
+/** Whether a retry charged to the job's limit is still within it. */
+function hasRetriesLeft(job) {
+	return (job.retryCount || 0) < (job.maxRetries || 0);
+}
 var JobResultHandler = class {
 	queue;
 	jobTracker;
@@ -2322,7 +2308,7 @@ var JobResultHandler = class {
 					return;
 				}
 			}
-			if (modelLoaded) {
+			if (modelLoaded && hasRetriesLeft(handle.job)) {
 				const errorInfo = toErrorInfo(result.error);
 				try {
 					await this.queue.retryJob(handle.job.id, errorInfo);
@@ -2347,7 +2333,7 @@ var JobResultHandler = class {
 			return;
 		}
 		const retryCount = handle.job.retryCount || 0;
-		if (retryCount < (handle.job.maxRetries || 0)) {
+		if (hasRetriesLeft(handle.job)) {
 			const currentErrorInfo = result.error ? toErrorInfo(result.error) : toErrorInfo("Unknown error");
 			try {
 				await this.queue.retryJob(handle.job.id, currentErrorInfo);
@@ -2530,38 +2516,6 @@ var DeferredJobs = class {
 	}
 };
 //#endregion
-//#region src/executor/worker-pool-router.ts
-/**
-* Sticky-by-document routing for the executor worker pool.
-*
-* Hashes `documentId` to a stable bucket so every job on a given document
-* lands on the same worker. The queue already enforces "at most one job
-* executing per document at a time", so a sticky worker always sees a fresh
-* post-commit snapshot before its next job on that document — which keeps
-* the per-worker `IWriteCache` and `IDocumentMetaCache` coherent for free.
-*
-* The hash is FNV-1a 32-bit: deterministic, dependency-free, and stable
-* across processes (so the same routing decision can be reproduced anywhere
-* the documentId is known).
-*
-* @see Executor Worker Pool Design wiki page
-*   (Powerhouse board wiki id: d400d711-f07e-4389-a226-4e9fdd4fa8ba)
-*/
-const FNV_OFFSET_BASIS = 2166136261;
-const FNV_PRIME = 16777619;
-function hashDocumentId(documentId) {
-	let hash = FNV_OFFSET_BASIS;
-	for (let i = 0; i < documentId.length; i++) {
-		hash ^= documentId.charCodeAt(i);
-		hash = Math.imul(hash, FNV_PRIME);
-	}
-	return hash >>> 0;
-}
-function bucketFor(documentId, numWorkers) {
-	if (numWorkers < 1) throw new Error(`bucketFor: numWorkers must be >= 1 (got ${numWorkers})`);
-	return hashDocumentId(documentId) % numWorkers;
-}
-//#endregion
 //#region src/executor/worker-pool-job-executor-manager.ts
 /**
 * Manages a pool of executor workers and dispatches jobs across them with
@@ -2714,20 +2668,11 @@ var WorkerPoolJobExecutorManager = class {
 		} catch (error) {
 			const errorInfo = toErrorInfo(error instanceof Error ? error : String(error));
 			if (isWorkerTransportError(error)) {
-				await this.handleWorkerTransportFailure(worker, handle.job, errorInfo);
+				await this.handleWorkerTransportFailure(worker, handle, errorInfo);
 				return;
 			}
-			handle.fail(errorInfo);
 			this.activeJobs--;
-			this.jobTracker.markFailed(handle.job.id, errorInfo, handle.job);
-			const failedEvent = {
-				job: handle.job,
-				error: errorInfo.message,
-				willRetry: false,
-				retryCount: 0,
-				workerId
-			};
-			this.eventBus.emit(JobExecutorEventTypes.JOB_FAILED, failedEvent).catch(() => {});
+			this.failInFlight(handle, errorInfo, workerId);
 			await this.tryDispatchFor(worker);
 			return;
 		}
@@ -2790,20 +2735,41 @@ var WorkerPoolJobExecutorManager = class {
 			this.logger.error("Failed to emit JOB_WRITE_READY event: @Error", error);
 		}
 	}
+	failInFlight(handle, errorInfo, workerId) {
+		handle.fail(errorInfo);
+		this.jobTracker.markFailed(handle.job.id, errorInfo, handle.job);
+		const failedEvent = {
+			job: handle.job,
+			error: errorInfo.message,
+			willRetry: false,
+			retryCount: handle.job.retryCount || 0,
+			workerId
+		};
+		this.eventBus.emit(JobExecutorEventTypes.JOB_FAILED, failedEvent).catch(() => {});
+	}
 	/**
 	* Handle a worker-transport failure (worker exited / init failed / abort
-	* timed out) detected while `worker.execute` was in flight. Re-enqueues
-	* the in-flight job via `queue.retryJob` so it is retried on a healthy
-	* worker, then replaces the dead worker with a fresh handle and resumes
-	* dispatch on the same bucket. Does NOT emit JOB_FAILED — the job is
-	* not failed, only the worker is.
+	* timed out) detected while `worker.execute` was in flight. The dead
+	* worker is replaced and dispatch resumes on its bucket. The in-flight
+	* job is retried via `queue.retryJob` while it has retries left, and
+	* failed with the transport error once they are spent.
 	*/
-	async handleWorkerTransportFailure(dead, job, errorInfo) {
+	async handleWorkerTransportFailure(dead, handle, errorInfo) {
+		const job = handle.job;
+		this.activeJobs--;
+		if (!hasRetriesLeft(job)) {
+			this.logger.error("worker transport error during execute; job @jobId is out of retries: @error", {
+				jobId: job.id,
+				workerId: dead.workerId
+			}, errorInfo.message);
+			this.failInFlight(handle, errorInfo, dead.workerId);
+			await this.replaceWorker(dead);
+			return;
+		}
 		this.logger.warn("worker transport error during execute; retrying job @jobId on a replacement worker: @error", {
 			jobId: job.id,
 			workerId: dead.workerId
 		}, errorInfo.message);
-		this.activeJobs--;
 		await this.replaceWorker(dead);
 		try {
 			await this.queue.retryJob(job.id, errorInfo);
@@ -3009,7 +2975,7 @@ var SimpleJobExecutorManager = class {
 	deferredJobs;
 	resultHandler;
 	jobTimeoutMs;
-	constructor(executorFactory, eventBus, queue, jobTracker, logger, resolver, jobTimeoutMs = 3e4, deferredJobTtlMs = DEFAULT_DEFERRED_JOB_TTL_MS) {
+	constructor(executorFactory, eventBus, queue, jobTracker, logger, resolver, jobTimeoutMs = DEFAULT_JOB_TIMEOUT_MS, deferredJobTtlMs = DEFAULT_DEFERRED_JOB_TTL_MS) {
 		this.executorFactory = executorFactory;
 		this.eventBus = eventBus;
 		this.queue = queue;
@@ -3079,7 +3045,12 @@ var SimpleJobExecutorManager = class {
 			workerId
 		};
 		this.eventBus.emit(JobExecutorEventTypes.JOB_STARTED, startedEvent).catch(() => {});
-		const signal = AbortSignal.timeout(this.jobTimeoutMs);
+		const timeout = new AbortController();
+		const timer = setTimeout(() => {
+			timeout.abort(new DOMException("The operation was aborted due to timeout", "TimeoutError"));
+		}, this.jobTimeoutMs);
+		timer.unref?.();
+		const signal = timeout.signal;
 		const toError = (reason) => reason instanceof Error ? reason : new Error(String(reason));
 		const abortPromise = new Promise((_, reject) => {
 			if (signal.aborted) {
@@ -3090,8 +3061,9 @@ var SimpleJobExecutorManager = class {
 		});
 		let result;
 		try {
-			result = await Promise.race([executor.executeJob(handle.job, signal), abortPromise]);
+			result = await Promise.race([executor.executeJob(handle.job, signal, () => clearTimeout(timer)), abortPromise]);
 		} catch (error) {
+			clearTimeout(timer);
 			const errorInfo = toErrorInfo(error instanceof Error ? error : String(error));
 			handle.fail(errorInfo);
 			this.activeJobs--;
@@ -3107,6 +3079,7 @@ var SimpleJobExecutorManager = class {
 			await this.checkForMoreJobs();
 			return;
 		}
+		clearTimeout(timer);
 		if (result.success) this.totalJobsProcessed++;
 		if (result.success) {
 			const completedEvent = {
@@ -4542,6 +4515,8 @@ var InMemoryQueue = class {
 	jobIdToDocId = /* @__PURE__ */ new Map();
 	completedJobs = /* @__PURE__ */ new Set();
 	jobIndex = /* @__PURE__ */ new Map();
+	jobIdToSeq = /* @__PURE__ */ new Map();
+	nextSeq = 0;
 	isBlocked = false;
 	onDrainedCallback;
 	isPausedFlag = false;
@@ -4636,7 +4611,15 @@ var InMemoryQueue = class {
 	async enqueue(job) {
 		if (this.isBlocked) throw new Error("Queue is blocked");
 		const queueKey = this.createQueueKey(job.documentId, job.scope, job.branch);
-		this.getQueue(queueKey).push(job);
+		const queue = this.getQueue(queueKey);
+		const seq = this.jobIdToSeq.get(job.id);
+		if (seq === void 0) {
+			this.jobIdToSeq.set(job.id, this.nextSeq++);
+			queue.push(job);
+		} else {
+			const later = queue.findIndex((queued) => (this.jobIdToSeq.get(queued.id) ?? Infinity) > seq);
+			queue.splice(later === -1 ? queue.length : later, 0, job);
+		}
 		this.jobIdToQueueKey.set(job.id, queueKey);
 		this.jobIndex.set(job.id, job);
 		const documentType = this.getCreateDocumentType(job);
@@ -4774,6 +4757,7 @@ var InMemoryQueue = class {
 		queue.splice(jobIdx, 1);
 		this.jobIdToQueueKey.delete(jobId);
 		this.jobIndex.delete(jobId);
+		this.jobIdToSeq.delete(jobId);
 		if (queue.length === 0) this.queues.delete(queueKey);
 		return Promise.resolve(true);
 	}
@@ -4784,6 +4768,7 @@ var InMemoryQueue = class {
 			for (const job of queue) {
 				this.jobIdToQueueKey.delete(job.id);
 				this.jobIndex.delete(job.id);
+				this.jobIdToSeq.delete(job.id);
 			}
 			this.queues.delete(queueKey);
 		}
@@ -4792,6 +4777,7 @@ var InMemoryQueue = class {
 	clearAll() {
 		this.jobIdToQueueKey.clear();
 		this.jobIndex.clear();
+		this.jobIdToSeq.clear();
 		this.completedJobs.clear();
 		this.queues.clear();
 		return Promise.resolve();
@@ -4804,6 +4790,7 @@ var InMemoryQueue = class {
 		if (documentId) this.markJobComplete(jobId, documentId);
 		this.completedJobs.add(jobId);
 		this.jobIndex.delete(jobId);
+		this.jobIdToSeq.delete(jobId);
 		await this.remove(jobId);
 		this.checkDrained();
 	}
@@ -4816,6 +4803,7 @@ var InMemoryQueue = class {
 			if (error) job.errorHistory.push(error);
 		}
 		this.jobIndex.delete(jobId);
+		this.jobIdToSeq.delete(jobId);
 		this.completedJobs.add(jobId);
 		await this.remove(jobId);
 		if (job) {
@@ -5158,112 +5146,763 @@ var NullDocumentModelResolver = class {
 		return this.ensureModelLoaded(documentType);
 	}
 };
-//#endregion
-//#region src/subs/default-error-handler.ts
-/**
-* Default error handler that re-throws subscription errors.
-* This ensures that errors are not silently swallowed.
-*/
-var DefaultSubscriptionErrorHandler = class {
-	handleError(error, context) {
-		const errorMessage = `Subscription error in ${context.eventType} (${context.subscriptionId})`;
-		if (error instanceof Error) {
-			const enhancedError = /* @__PURE__ */ new Error(`${errorMessage}: ${error.message}`);
-			enhancedError.cause = error;
-			enhancedError.stack = error.stack;
-			throw enhancedError;
-		} else throw new Error(`${errorMessage}: ${String(error)}`);
+/** The filesystem sync never settled. */
+var PGliteFlushSyncTimeoutError = class extends Error {
+	constructor(timeoutMs) {
+		super(`The PGlite filesystem sync neither resolved nor rejected within ${timeoutMs}ms; no durability barrier was established.`);
+		this.name = "PGliteFlushSyncTimeoutError";
 	}
 };
-//#endregion
-//#region src/subs/react-subscription-manager.ts
-var ReactorSubscriptionManager = class {
-	createdSubscriptions = /* @__PURE__ */ new Map();
-	deletedSubscriptions = /* @__PURE__ */ new Map();
-	updatedSubscriptions = /* @__PURE__ */ new Map();
-	relationshipSubscriptions = /* @__PURE__ */ new Map();
-	subscriptionCounter = 0;
-	errorHandler;
-	constructor(errorHandler) {
-		this.errorHandler = errorHandler;
-	}
-	onDocumentCreated(callback, search) {
-		const id = `created-${++this.subscriptionCounter}`;
-		this.createdSubscriptions.set(id, {
-			id,
-			callback,
-			search
-		});
-		return () => {
-			this.createdSubscriptions.delete(id);
+/** Group-commits PGlite's per-statement sync; see `withGroupCommitPGlite`. */
+var GroupCommitPGliteClient = class {
+	instance;
+	options;
+	deferred;
+	/** The instance's own `syncToFs`, captured before deferral replaces it. */
+	instanceSync;
+	/** Statements started. */
+	sequence = 0;
+	/** The highest {@link sequence} a completed flush made durable. */
+	flushed = 0;
+	/** `covers` is 0 until the snapshot starts; earlier requests join it. */
+	running = void 0;
+	syncFailures = 0;
+	/** PGlite returns at once from a sync requested while one is scheduled. */
+	lastSync = Promise.resolve();
+	inFlight = 0;
+	admittedRuns = 0;
+	idleWaiters = [];
+	gate = void 0;
+	releaseGate = () => void 0;
+	poisonCause = void 0;
+	/** Rejects once the session is poisoned; every wait races it. */
+	poisonedSignal;
+	signalPoisoned = () => void 0;
+	constructor(instance, options = {}) {
+		this.instance = instance;
+		this.options = {
+			onDiagnostic: options.onDiagnostic ?? ((message, error) => {
+				console.error(`[group-commit-pglite] ${message}`, error);
+			}),
+			onSyncStuck: options.onSyncStuck ?? (() => void 0),
+			flushSyncTimeoutMs: options.flushSyncTimeoutMs ?? 12e4,
+			maxConsecutiveSyncFailures: options.maxConsecutiveSyncFailures ?? 3,
+			closeTimeoutMs: options.closeTimeoutMs ?? 3e4
 		};
-	}
-	onDocumentDeleted(callback, search) {
-		const id = `deleted-${++this.subscriptionCounter}`;
-		this.deletedSubscriptions.set(id, {
-			id,
-			callback,
-			search
+		this.poisonedSignal = new Promise((_resolve, reject) => {
+			this.signalPoisoned = reject;
 		});
-		return () => {
-			this.deletedSubscriptions.delete(id);
-		};
+		this.poisonedSignal.catch(() => void 0);
+		const candidate = instance.syncToFs;
+		this.deferred = typeof candidate === "function";
+		this.instanceSync = this.deferred ? candidate.bind(instance) : () => Promise.resolve();
+		if (!this.deferred) this.options.onDiagnostic("this PGlite session exposes no filesystem sync, so statements keep their own durability");
+		this.setStatementSync(!this.deferred);
+	}
+	query(sql, params) {
+		const run = () => this.instance.query(sql, params);
+		return this.admittedRuns > 0 ? run() : this.admit(run);
+	}
+	exec(sql) {
+		const run = () => this.instance.exec(sql);
+		return this.admittedRuns > 0 ? run() : this.admit(run);
+	}
+	/** Runs a statement past the flush gate; the calls it makes are not gated again. */
+	async admit(run) {
+		await this.enterStatement();
+		this.admittedRuns += 1;
+		try {
+			return await run();
+		} finally {
+			this.admittedRuns -= 1;
+			this.endStatement();
+		}
 	}
-	onDocumentStateUpdated(callback, search, view) {
-		const id = `updated-${++this.subscriptionCounter}`;
-		this.updatedSubscriptions.set(id, {
-			id,
-			callback,
-			search,
-			view
-		});
-		return () => {
-			this.updatedSubscriptions.delete(id);
-		};
+	isInTransaction() {
+		return this.instance.isInTransaction();
 	}
-	onRelationshipChanged(callback, search) {
-		const id = `relationship-${++this.subscriptionCounter}`;
-		this.relationshipSubscriptions.set(id, {
-			id,
-			callback,
-			search
-		});
-		return () => {
-			this.relationshipSubscriptions.delete(id);
-		};
+	/** Whether statements have stopped flushing themselves. */
+	get deferringStatementFlush() {
+		return this.deferred;
 	}
-	/**
-	* Notify subscribers about created documents
-	*/
-	notifyDocumentsCreated(documentIds, documentTypes, parentIds) {
-		const result = {
-			results: documentIds,
-			options: {
-				cursor: "",
-				limit: documentIds.length
+	/** Every later and parked flush rejects: nothing can be made durable again. */
+	markPoisoned(cause) {
+		if (this.poisonCause) return;
+		this.poisonCause = new StoragePoisonedError("The PGlite session is poisoned; nothing more can be made durable until the host restarts.", cause);
+		this.releaseGate();
+		this.idleWaiters = [];
+		this.signalPoisoned(this.poisonCause);
+	}
+	/** Shares one sync between callers whose statements it covers. */
+	async flush() {
+		if (!this.deferred) return;
+		const target = this.sequence;
+		for (;;) {
+			this.assertHealthy();
+			if (this.flushed >= target) return;
+			const running = this.running;
+			if (running === void 0) {
+				await this.startFlush();
+				continue;
 			}
-		};
-		for (const subscription of this.createdSubscriptions.values()) {
-			const filteredIds = this.filterDocumentIds(documentIds, subscription.search, documentTypes, parentIds);
-			if (filteredIds.length > 0) try {
-				subscription.callback({
-					...result,
-					results: filteredIds
-				});
-			} catch (error) {
-				this.errorHandler.handleError(error, {
-					eventType: "created",
-					subscriptionId: subscription.id,
-					eventData: filteredIds
-				});
+			if (running.covers === 0 || running.covers >= target) {
+				await running.promise;
+				continue;
 			}
+			await running.promise.catch(() => void 0);
 		}
 	}
-	/**
-	* Notify subscribers about deleted documents
-	*/
-	notifyDocumentsDeleted(documentIds, documentTypes, parentIds, info) {
-		for (const subscription of this.deletedSubscriptions.values()) {
+	/** PGlite's own close relies on the per-statement sync, so it is restored. */
+	async close() {
+		const flushing = this.flush();
+		flushing.catch(() => void 0);
+		let failure;
+		try {
+			if (await this.bounded(flushing) === TIMED_OUT) failure = /* @__PURE__ */ new Error("the closing flush did not settle");
+		} catch (error) {
+			failure = error;
+		}
+		if (failure !== void 0) this.options.onDiagnostic("the closing flush failed; writes since the last group commit are lost", failure);
+		this.setStatementSync(true);
+		const closing = this.instance.close();
+		if (await this.bounded(closing) === TIMED_OUT) this.options.onDiagnostic("closing the PGlite instance did not settle");
+	}
+	/** Hands the instance back to per-statement durability, unclosed. */
+	restoreStatementSync() {
+		this.setStatementSync(true);
+	}
+	/** A statement that died in flight would otherwise hold a close forever. */
+	bounded(pending) {
+		const timeoutMs = this.options.closeTimeoutMs;
+		return timeoutMs > 0 ? withDeadline(pending, timeoutMs) : pending;
+	}
+	assertHealthy() {
+		if (this.poisonCause) throw this.poisonCause;
+	}
+	/** Restores by assignment so a prototype or own-field `syncToFs` both work. */
+	setStatementSync(enabled) {
+		if (!this.deferred) return;
+		const target = this.instance;
+		target.syncToFs = enabled ? this.instanceSync : () => Promise.resolve();
+	}
+	startFlush() {
+		const running = {
+			promise: Promise.resolve(),
+			covers: 0
+		};
+		running.promise = this.runFlush(running).finally(() => {
+			if (this.running === running) this.running = void 0;
+		});
+		this.running = running;
+		return running.promise;
+	}
+	async runFlush(running) {
+		const release = await this.holdStatements();
+		running.covers = this.sequence;
+		const covered = running.covers;
+		try {
+			await this.boundedSync();
+		} finally {
+			release();
+		}
+		this.flushed = Math.max(this.flushed, covered);
+	}
+	/** Chained, so PGlite's scheduled-sync shortcut never stands in for a sync. */
+	async boundedSync() {
+		const started = this.lastSync.then(() => this.instanceSync());
+		this.lastSync = started.then(() => void 0, () => void 0);
+		const syncing = Promise.race([started, this.poisonedSignal]);
+		syncing.catch(() => void 0);
+		let failure;
+		try {
+			const timeoutMs = this.options.flushSyncTimeoutMs;
+			if ((timeoutMs > 0 ? await withDeadline(syncing, timeoutMs) : await syncing) !== TIMED_OUT) {
+				this.syncFailures = 0;
+				return;
+			}
+			failure = new PGliteFlushSyncTimeoutError(timeoutMs);
+		} catch (error) {
+			this.assertHealthy();
+			this.syncFailures += 1;
+			if (this.syncFailures < this.options.maxConsecutiveSyncFailures) throw error;
+			failure = error instanceof Error ? error : new Error(String(error));
+		}
+		this.options.onDiagnostic("the PGlite filesystem sync is stuck; treating the session as poisoned", failure);
+		this.markPoisoned(failure);
+		try {
+			this.options.onSyncStuck(failure);
+		} catch (error) {
+			this.options.onDiagnostic("onSyncStuck threw", error);
+		}
+		throw this.poisonCause ?? failure;
+	}
+	/** Waits for the statement in flight to finish and holds the next one back. */
+	async holdStatements() {
+		while (this.gate !== void 0) await Promise.race([this.gate, this.poisonedSignal]);
+		this.assertHealthy();
+		this.gate = new Promise((resolve) => {
+			this.releaseGate = () => {
+				this.gate = void 0;
+				this.releaseGate = () => void 0;
+				resolve();
+			};
+		});
+		const release = () => this.releaseGate();
+		if (this.inFlight === 0) return release;
+		try {
+			await Promise.race([new Promise((resolve) => this.idleWaiters.push(resolve)), this.poisonedSignal]);
+		} catch (error) {
+			release();
+			throw error;
+		}
+		return release;
+	}
+	async enterStatement() {
+		while (this.gate !== void 0) await this.gate;
+		this.inFlight += 1;
+		this.sequence += 1;
+	}
+	endStatement() {
+		this.inFlight -= 1;
+		if (this.inFlight > 0) return;
+		const waiters = this.idleWaiters;
+		this.idleWaiters = [];
+		for (const waiter of waiters) waiter();
+	}
+};
+//#endregion
+//#region src/storage/storage-health.ts
+/** Fed by the poison path so "connected" never reads green over a dead session. */
+var StorageHealthTracker = class {
+	healthy = true;
+	markPoisoned() {
+		this.healthy = false;
+	}
+	getStorageHealth() {
+		return { healthy: this.healthy };
+	}
+};
+//#endregion
+//#region src/storage/kysely/pglite-dialect.ts
+var pglite_dialect_exports = /* @__PURE__ */ __exportAll({
+	DEFAULT_LONG_STATEMENT_TIMEOUT_MS: () => DEFAULT_LONG_STATEMENT_TIMEOUT_MS,
+	DEFAULT_RECOVERY_TIMEOUT_MS: () => DEFAULT_RECOVERY_TIMEOUT_MS,
+	DEFAULT_STATEMENT_TIMEOUT_MS: () => DEFAULT_STATEMENT_TIMEOUT_MS,
+	HardenedPGliteDialect: () => HardenedPGliteDialect,
+	PGliteAbortedTransactionError: () => PGliteAbortedTransactionError,
+	PGliteAcquireTimeoutError: () => PGliteAcquireTimeoutError,
+	PGliteSessionError: () => PGliteSessionError,
+	PGliteSessionPoisonedError: () => PGliteSessionPoisonedError,
+	PGliteStatementTimeoutError: () => PGliteStatementTimeoutError,
+	isLongRunningStatement: () => isLongRunningStatement,
+	queryThroughDialect: () => queryThroughDialect
+});
+const DEFAULT_STATEMENT_TIMEOUT_MS = 12e4;
+const DEFAULT_LONG_STATEMENT_TIMEOUT_MS = 9e5;
+const DEFAULT_RECOVERY_TIMEOUT_MS = 15e3;
+const LONG_STATEMENT_PREFIXES = [
+	"vacuum",
+	"analyze",
+	"reindex",
+	"cluster",
+	"checkpoint",
+	"copy",
+	"alter ",
+	"create ",
+	"drop ",
+	"truncate",
+	"refresh "
+];
+/** Maintenance and DDL, matched on the leading keyword of the compiled SQL. */
+function isLongRunningStatement(statement) {
+	const normalized = statement.trimStart().toLowerCase();
+	return LONG_STATEMENT_PREFIXES.some((prefix) => normalized.startsWith(prefix));
+}
+function summarize(statement) {
+	const collapsed = statement.replace(/\s+/g, " ").trim();
+	return collapsed.length > 160 ? `${collapsed.slice(0, 160)}...` : collapsed;
+}
+/** COMMIT in an aborted transaction silently rolls back; the guard raises first. */
+const COMMIT_WITH_GUARD = "select 1 as __commit_guard; commit";
+const PROBE = "select 1 as __session_probe";
+const ABORTED_TRANSACTION_CODE = "25P02";
+var PGliteSessionError = class extends Error {
+	cause;
+	constructor(message, cause) {
+		super(message);
+		this.cause = cause;
+		this.name = "PGliteSessionError";
+	}
+};
+var PGliteAcquireTimeoutError = class extends PGliteSessionError {
+	constructor(timeoutMs) {
+		super(`Timed out after ${timeoutMs}ms waiting for the PGlite connection. The single session is held by a statement that never completed: a transaction awaiting a nested query on the base handle, or an abandoned stream iterator.`);
+		this.name = "PGliteAcquireTimeoutError";
+	}
+};
+/** The call cannot be aborted, so it is abandoned and the session treated as poisoned. */
+var PGliteStatementTimeoutError = class extends PGliteSessionError {
+	constructor(timeoutMs, statement) {
+		super(`A PGlite statement neither resolved nor rejected within ${timeoutMs}ms, so its wasm call is presumed dead and the session poisoned: ${summarize(statement)}`);
+		this.name = "PGliteStatementTimeoutError";
+	}
+};
+var PGliteAbortedTransactionError = class extends PGliteSessionError {
+	constructor(cause) {
+		super(`Refusing to report a commit for an aborted transaction: COMMIT would have been answered with a ROLLBACK tag and nothing written. Underlying error: ${errorOf(cause).message}`, cause);
+		this.name = "PGliteAbortedTransactionError";
+	}
+};
+/** No statement can clear the session (e.g. a stuck active portal). */
+var PGliteSessionPoisonedError = class extends PGliteSessionError {
+	constructor(cause) {
+		super(`The PGlite session is unrecoverable and cannot be reused; the component owning it must be restarted. Original error: ${errorOf(cause).message}`, cause);
+		this.name = "PGliteSessionPoisonedError";
+	}
+};
+function errorOf(error) {
+	return error instanceof Error ? error : new Error(String(error));
+}
+function isAbortedTransactionError(error) {
+	if (error?.code === ABORTED_TRANSACTION_CODE) return true;
+	return errorOf(error).message.includes("current transaction is aborted");
+}
+/** `kysely-pglite-dialect` hardened for one shared session that a fault must not brick. */
+var HardenedPGliteDialect = class {
+	client;
+	inner;
+	options;
+	constructor(client, options = {}) {
+		this.client = client;
+		this.inner = new PGliteDialect(client);
+		this.options = {
+			acquireTimeoutMs: options.acquireTimeoutMs ?? 0,
+			statementTimeoutMs: options.statementTimeoutMs ?? 12e4,
+			longStatementTimeoutMs: options.longStatementTimeoutMs ?? 9e5,
+			recoveryTimeoutMs: options.recoveryTimeoutMs ?? 15e3,
+			onDiagnostic: options.onDiagnostic ?? ((message, error) => {
+				console.error(`[pglite-dialect] ${message}`, error);
+			}),
+			onPoisoned: options.onPoisoned ?? (() => void 0)
+		};
+	}
+	createAdapter() {
+		return this.inner.createAdapter();
+	}
+	createDriver() {
+		return new HardenedPGliteDriver(this.inner.createDriver(), this.client, this.options);
+	}
+	createQueryCompiler() {
+		return this.inner.createQueryCompiler();
+	}
+	createIntrospector(db) {
+		return this.inner.createIntrospector(db);
+	}
+};
+var HardenedPGliteConnection = class {
+	inner;
+	guard;
+	failure = void 0;
+	rollbackFailure = void 0;
+	transactionOpen = false;
+	constructor(inner, guard) {
+		this.inner = inner;
+		this.guard = guard;
+	}
+	/** Never retried: a replay could commit alone a write meant for another consumer's transaction. */
+	async executeQuery(compiledQuery) {
+		const generation = this.guard.generation;
+		try {
+			return await this.guard.runStatement(compiledQuery.sql, () => this.inner.executeQuery(compiledQuery));
+		} catch (error) {
+			this.guard.recordFailure(this, generation, error);
+			throw error;
+		}
+	}
+	streamQuery(compiledQuery, chunkSize) {
+		const inner = this.inner.streamQuery(compiledQuery, chunkSize);
+		return this.deadlinedStream(compiledQuery, inner);
+	}
+	/** Upstream issues the whole query on the first pull, so each pull is bounded like a statement. */
+	async *deadlinedStream(compiledQuery, inner) {
+		for (;;) {
+			const generation = this.guard.generation;
+			let next;
+			try {
+				next = await this.guard.runStatement(compiledQuery.sql, () => inner.next());
+			} catch (error) {
+				this.guard.recordFailure(this, generation, error);
+				throw error;
+			}
+			if (next.done === true) return;
+			yield next.value;
+		}
+	}
+	get suspect() {
+		return this.failure !== void 0 || this.rollbackFailure !== void 0 || this.transactionOpen;
+	}
+};
+var HardenedPGliteDriver = class {
+	inner;
+	client;
+	options;
+	/** Set when release could not reset the session; each acquire retries the reset. */
+	sessionFault = void 0;
+	/** Lets an abandoned call's late settlement be told apart from current failures. */
+	statementGeneration = 0;
+	/** A call abandoned at its deadline; PGlite would queue every later call behind it, so none is issued. */
+	deadCall = void 0;
+	poisonReported = false;
+	constructor(inner, client, options) {
+		this.inner = inner;
+		this.client = client;
+		this.options = options;
+	}
+	get generation() {
+		return this.statementGeneration;
+	}
+	/** Bounds one statement; an expiry is escalated as a poisoned session. */
+	async runStatement(statement, execute) {
+		if (this.deadCall !== void 0) throw new PGliteSessionPoisonedError(this.deadCall);
+		const timeoutMs = this.timeoutFor(statement);
+		if (timeoutMs <= 0) return execute();
+		return this.admitted(async () => {
+			if (this.deadCall !== void 0) throw new PGliteSessionPoisonedError(this.deadCall);
+			const generation = this.statementGeneration;
+			const outcome = await withDeadline(execute(), timeoutMs);
+			if (outcome !== TIMED_OUT) return outcome;
+			throw this.escalateHungStatement(new PGliteStatementTimeoutError(timeoutMs, statement), generation);
+		});
+	}
+	/** Time spent waiting to be admitted is bounded by the session, not the deadline. */
+	admitted(run) {
+		return this.client.admit ? this.client.admit(run) : run();
+	}
+	recordFailure(connection, generation, error) {
+		if (generation === this.statementGeneration) connection.failure = errorOf(error);
+	}
+	async init() {
+		await this.inner.init();
+	}
+	async acquireConnection() {
+		const innerConnection = await this.acquireWithTimeout();
+		if (this.deadCall !== void 0) {
+			await this.inner.releaseConnection(innerConnection);
+			throw new PGliteSessionPoisonedError(this.deadCall);
+		}
+		if (this.sessionFault !== void 0) {
+			const fault = this.sessionFault;
+			let recovered = false;
+			try {
+				recovered = await this.tryRecoverSession(false);
+			} finally {
+				if (!recovered) await this.inner.releaseConnection(innerConnection);
+			}
+			if (!recovered) {
+				this.reportPoisoned(fault);
+				throw new PGliteSessionPoisonedError(fault);
+			}
+			this.sessionFault = void 0;
+		}
+		return new HardenedPGliteConnection(innerConnection, this);
+	}
+	/** Kysely never rolls back after a failed BEGIN, so an aborted session is reset here. */
+	async beginTransaction(connection, settings) {
+		const wrapper = asWrapper(connection);
+		const generation = this.statementGeneration;
+		try {
+			await this.runStatement("begin", () => this.inner.beginTransaction(wrapper.inner, settings));
+		} catch (error) {
+			this.recordFailure(wrapper, generation, error);
+			if (!isAbortedTransactionError(error)) throw error;
+			if (!await this.tryRecoverSession(false)) {
+				this.sessionFault = errorOf(error);
+				throw error;
+			}
+			const retryGeneration = this.statementGeneration;
+			try {
+				await this.runStatement("begin", () => this.inner.beginTransaction(wrapper.inner, settings));
+			} catch (retryError) {
+				this.recordFailure(wrapper, retryGeneration, retryError);
+				throw retryError;
+			}
+			wrapper.failure = void 0;
+		}
+		wrapper.transactionOpen = true;
+	}
+	async commitTransaction(connection) {
+		const wrapper = asWrapper(connection);
+		const generation = this.statementGeneration;
+		try {
+			await this.runStatement(COMMIT_WITH_GUARD, () => this.client.exec(COMMIT_WITH_GUARD));
+		} catch (error) {
+			this.recordFailure(wrapper, generation, error);
+			if (isAbortedTransactionError(error)) throw new PGliteAbortedTransactionError(error);
+			throw error;
+		}
+		wrapper.transactionOpen = false;
+		wrapper.failure = void 0;
+	}
+	/** Swallowed so the original failure propagates; release resets the session. */
+	async rollbackTransaction(connection) {
+		const wrapper = asWrapper(connection);
+		const generation = this.statementGeneration;
+		try {
+			await this.runStatement("rollback", () => this.inner.rollbackTransaction(wrapper.inner));
+			wrapper.transactionOpen = false;
+		} catch (error) {
+			if (generation === this.statementGeneration) wrapper.rollbackFailure = errorOf(error);
+			this.options.onDiagnostic("rollback failed; preserving the original failure and recovering the session on release", error);
+		}
+	}
+	async releaseConnection(connection) {
+		const wrapper = asWrapper(connection);
+		try {
+			if (wrapper.suspect && this.deadCall === void 0) {
+				if (!await this.tryRecoverSession(wrapper.transactionOpen)) {
+					this.sessionFault = wrapper.rollbackFailure ?? wrapper.failure ?? /* @__PURE__ */ new Error("session left in a transaction");
+					this.options.onDiagnostic("the PGlite session could not be reset and is being marked unrecoverable", this.sessionFault);
+				}
+			}
+		} finally {
+			await this.inner.releaseConnection(wrapper.inner);
+		}
+	}
+	async destroy() {
+		await this.inner.destroy();
+	}
+	reportPoisoned(cause) {
+		if (this.poisonReported) return;
+		this.poisonReported = true;
+		try {
+			this.options.onPoisoned(cause);
+		} catch (error) {
+			this.options.onDiagnostic("onPoisoned threw", error);
+		}
+	}
+	timeoutFor(statement) {
+		return isLongRunningStatement(statement) ? this.options.longStatementTimeoutMs : this.options.statementTimeoutMs;
+	}
+	/** Marks the session faulted once per generation; a stale expiry reports only itself. */
+	escalateHungStatement(cause, generation) {
+		if (generation !== this.statementGeneration) return cause;
+		this.statementGeneration += 1;
+		this.deadCall = cause;
+		this.reportPoisoned(cause);
+		this.options.onDiagnostic("a PGlite statement never settled within its deadline; treating the session as poisoned", cause);
+		return new PGliteSessionPoisonedError(cause);
+	}
+	/** A waiter that gave up still passes the lease on, so it cannot wedge the queue. */
+	async acquireWithTimeout() {
+		const timeoutMs = this.options.acquireTimeoutMs;
+		if (timeoutMs <= 0) return this.inner.acquireConnection();
+		let abandoned = false;
+		const pending = this.inner.acquireConnection().then((connection) => {
+			if (!abandoned) return connection;
+			this.inner.releaseConnection(connection).catch(() => void 0);
+			throw new PGliteAcquireTimeoutError(timeoutMs);
+		});
+		let handle;
+		const expiry = new Promise((_resolve, reject) => {
+			handle = setTimeout(() => {
+				abandoned = true;
+				reject(new PGliteAcquireTimeoutError(timeoutMs));
+			}, timeoutMs);
+		});
+		try {
+			return await Promise.race([pending, expiry]);
+		} finally {
+			clearTimeout(handle);
+		}
+	}
+	/** {@link recoverSession}, with a recovery that throws counted as failed. */
+	async tryRecoverSession(mustEndTransaction) {
+		try {
+			return await this.recoverSession(mustEndTransaction);
+		} catch (error) {
+			this.options.onDiagnostic("session recovery threw", error);
+			return false;
+		}
+	}
+	/** Rolls back only when told to or when the probe fails, sparing another consumer's live transaction. */
+	async recoverSession(mustEndTransaction) {
+		if (!mustEndTransaction && !this.client.isInTransaction() && await this.probeSession()) return true;
+		if (!await this.recoveryExec("rollback")) this.options.onDiagnostic("session rollback did not complete; the session stays suspect");
+		if (!await this.probeSession()) return false;
+		return !this.client.isInTransaction();
+	}
+	async probeSession() {
+		return this.recoveryExec(PROBE);
+	}
+	/** Kysely awaits release, so an unbounded recovery statement would hold the lease forever. */
+	async recoveryExec(statement) {
+		if (this.deadCall !== void 0) return false;
+		const timeoutMs = this.options.recoveryTimeoutMs;
+		const run = () => this.client.exec(statement).then(() => true, (error) => {
+			this.options.onDiagnostic("recovery statement failed", error);
+			return false;
+		});
+		if (timeoutMs <= 0) return run();
+		return this.admitted(async () => {
+			if (this.deadCall !== void 0) return false;
+			const outcome = await withDeadline(run(), timeoutMs);
+			if (outcome === TIMED_OUT) {
+				this.deadCall ??= new PGliteStatementTimeoutError(timeoutMs, statement);
+				this.reportPoisoned(this.deadCall);
+				this.options.onDiagnostic(`a PGlite recovery statement did not settle within ${timeoutMs}ms; the session is unrecoverable from SQL`);
+				return false;
+			}
+			return outcome;
+		});
+	}
+};
+function asWrapper(connection) {
+	if (!(connection instanceof HardenedPGliteConnection)) throw new PGliteSessionError("Connection was not created by HardenedPGliteDialect");
+	return connection;
+}
+/** Raw SQL through the dialect's queue, instead of into whatever transaction holds the session. */
+async function queryThroughDialect(db, sql, params) {
+	return [...(await db.executeQuery(CompiledQuery.raw(sql, params ?? []))).rows];
+}
+//#endregion
+//#region src/storage/kysely/group-commit-storage.ts
+/** One unit, so the deferral never exists without its flusher and poison path. */
+function createGroupCommitStorage(options) {
+	const onDiagnostic = options.onDiagnostic ?? ((message, error) => {
+		console.error(`[group-commit-pglite] ${message}`, error);
+	});
+	const health = new StorageHealthTracker();
+	let poisoned = false;
+	const poison = (cause) => {
+		if (poisoned) return;
+		poisoned = true;
+		health.markPoisoned();
+		client.markPoisoned(cause);
+		options.onUnrecoverable(cause);
+	};
+	const client = new GroupCommitPGliteClient(options.pg, {
+		...options.client,
+		onDiagnostic,
+		onSyncStuck: poison
+	});
+	return {
+		db: new Kysely({ dialect: new HardenedPGliteDialect(client, {
+			...options.dialect,
+			onDiagnostic,
+			onPoisoned: poison
+		}) }),
+		flusher: client,
+		health,
+		close: () => client.close(),
+		restoreStatementSync: () => client.restoreStatementSync()
+	};
+}
+//#endregion
+//#region src/subs/default-error-handler.ts
+/**
+* Default error handler that re-throws subscription errors.
+* This ensures that errors are not silently swallowed.
+*/
+var DefaultSubscriptionErrorHandler = class {
+	handleError(error, context) {
+		const errorMessage = `Subscription error in ${context.eventType} (${context.subscriptionId})`;
+		if (error instanceof Error) {
+			const enhancedError = /* @__PURE__ */ new Error(`${errorMessage}: ${error.message}`);
+			enhancedError.cause = error;
+			enhancedError.stack = error.stack;
+			throw enhancedError;
+		} else throw new Error(`${errorMessage}: ${String(error)}`);
+	}
+};
+//#endregion
+//#region src/subs/react-subscription-manager.ts
+var ReactorSubscriptionManager = class {
+	createdSubscriptions = /* @__PURE__ */ new Map();
+	deletedSubscriptions = /* @__PURE__ */ new Map();
+	updatedSubscriptions = /* @__PURE__ */ new Map();
+	relationshipSubscriptions = /* @__PURE__ */ new Map();
+	subscriptionCounter = 0;
+	errorHandler;
+	constructor(errorHandler) {
+		this.errorHandler = errorHandler;
+	}
+	onDocumentCreated(callback, search) {
+		const id = `created-${++this.subscriptionCounter}`;
+		this.createdSubscriptions.set(id, {
+			id,
+			callback,
+			search
+		});
+		return () => {
+			this.createdSubscriptions.delete(id);
+		};
+	}
+	onDocumentDeleted(callback, search) {
+		const id = `deleted-${++this.subscriptionCounter}`;
+		this.deletedSubscriptions.set(id, {
+			id,
+			callback,
+			search
+		});
+		return () => {
+			this.deletedSubscriptions.delete(id);
+		};
+	}
+	onDocumentStateUpdated(callback, search, view) {
+		const id = `updated-${++this.subscriptionCounter}`;
+		this.updatedSubscriptions.set(id, {
+			id,
+			callback,
+			search,
+			view
+		});
+		return () => {
+			this.updatedSubscriptions.delete(id);
+		};
+	}
+	onRelationshipChanged(callback, search) {
+		const id = `relationship-${++this.subscriptionCounter}`;
+		this.relationshipSubscriptions.set(id, {
+			id,
+			callback,
+			search
+		});
+		return () => {
+			this.relationshipSubscriptions.delete(id);
+		};
+	}
+	/**
+	* Notify subscribers about created documents
+	*/
+	notifyDocumentsCreated(documentIds, documentTypes, parentIds) {
+		const result = {
+			results: documentIds,
+			options: {
+				cursor: "",
+				limit: documentIds.length
+			}
+		};
+		for (const subscription of this.createdSubscriptions.values()) {
+			const filteredIds = this.filterDocumentIds(documentIds, subscription.search, documentTypes, parentIds);
+			if (filteredIds.length > 0) try {
+				subscription.callback({
+					...result,
+					results: filteredIds
+				});
+			} catch (error) {
+				this.errorHandler.handleError(error, {
+					eventType: "created",
+					subscriptionId: subscription.id,
+					eventData: filteredIds
+				});
+			}
+		}
+	}
+	/**
+	* Notify subscribers about deleted documents
+	*/
+	notifyDocumentsDeleted(documentIds, documentTypes, parentIds, info) {
+		for (const subscription of this.deletedSubscriptions.values()) {
 			const filteredIds = this.filterDocumentIds(documentIds, subscription.search, documentTypes, parentIds);
 			if (filteredIds.length > 0) try {
 				if (info) subscription.callback(filteredIds, info);
@@ -5539,6 +6178,62 @@ var GroupReevaluationTrigger = class extends BaseReadModel {
 	}
 };
 //#endregion
+//#region src/sync/channels/composite-channel-factory.ts
+/**
+* An {@link IChannelFactory} that dispatches to one of several factories on
+* {@link ChannelConfig.type}.
+*
+* This is the seam that lets ONE reactor hold remotes of more than one
+* transport at once -- gql remotes to a Switchboard AND brokered
+* `LocalChannel` peers (multi-reactor W3.0). Before it, a reactor wired a
+* single factory, so a local-sync reactor was local-only and a gql reactor
+* could not adopt a local peer; every mixed topology was out of reach.
+*
+* Routing is strict and total: a config whose type no registered factory
+* claims is refused by name rather than handed to whichever factory happens to
+* be first. That refusal is the point -- the single-factory world answered a
+* `{ type: "local" }` config on a gql reactor with a complaint about a missing
+* `url`, which says nothing about what is actually wrong.
+*
+* The composite adds no behaviour of its own: it holds no queue, no transport
+* and no logger, and every argument is passed through untouched. Which types a
+* reactor registers is the builder's decision (`ReactorBuilder`), not this
+* class's.
+*/
+var CompositeChannelFactory = class {
+	factories;
+	/**
+	* @param factories - (channel-config type -> factory) pairs. A duplicated
+	*   type is refused rather than silently resolved to the last entry: two
+	*   factories claiming one type is a configuration mistake with no correct
+	*   answer.
+	* @throws Error if `factories` is empty or names a type twice
+	*/
+	constructor(factories) {
+		this.factories = /* @__PURE__ */ new Map();
+		for (const [type, factory] of factories) {
+			if (this.factories.has(type)) throw new Error(`CompositeChannelFactory was given two factories for the channel type "${type}"`);
+			if (factory.channelTypes && !factory.channelTypes.includes(type)) throw new Error(`CompositeChannelFactory was given a factory for "${type}" that builds only [${factory.channelTypes.join(", ")}]`);
+			this.factories.set(type, factory);
+		}
+		if (this.factories.size === 0) throw new Error("CompositeChannelFactory requires at least one (type, factory) entry");
+	}
+	/**
+	* Creates a channel with the factory registered for `config.type`.
+	*
+	* @throws Error if no factory is registered for that type
+	*/
+	instance(remoteId, remoteName, config, cursorStorage, collectionId, filter, operationIndex, options) {
+		const factory = this.factories.get(config.type);
+		if (!factory) throw new Error(`This reactor has no "${config.type}" channel factory: it composes factories for [${this.channelTypes.join(", ")}]`);
+		return factory.instance(remoteId, remoteName, config, cursorStorage, collectionId, filter, operationIndex, options);
+	}
+	/** The types it routes, in registration order. */
+	get channelTypes() {
+		return [...this.factories.keys()];
+	}
+};
+//#endregion
 //#region src/sync/types.ts
 let ChannelScheme = /* @__PURE__ */ function(ChannelScheme) {
 	ChannelScheme["CONNECT"] = "connect";
@@ -5556,6 +6251,19 @@ let PollBehavior = /* @__PURE__ */ function(PollBehavior) {
 	PollBehavior["Manual"] = "manual";
 	return PollBehavior;
 }({});
+/**
+* Whether a remote outlives the process that added it.
+*
+* A `Session` remote's transport is a live object of this session, such as a
+* brokered `MessagePort`. Its record is written like any other, so its cursors,
+* holds and dead letters have a parent row, and the next `startup()` removes
+* it instead of rehydrating it.
+*/
+let RemotePersistence = /* @__PURE__ */ function(RemotePersistence) {
+	RemotePersistence["Durable"] = "durable";
+	RemotePersistence["Session"] = "session";
+	return RemotePersistence;
+}({});
 let SyncOperationStatus = /* @__PURE__ */ function(SyncOperationStatus) {
 	SyncOperationStatus[SyncOperationStatus["Unknown"] = -1] = "Unknown";
 	SyncOperationStatus[SyncOperationStatus["TransportPending"] = 0] = "TransportPending";
@@ -5599,10 +6307,14 @@ var MailboxAggregateError = class extends Error {
 };
 var Mailbox = class {
 	holdAckBelowMarkers;
+	holdAckBelowUnapplied;
 	itemsMap = /* @__PURE__ */ new Map();
 	/** Unapplied items carrying a marker, so the held ack reads only these. */
 	heldMarkers = /* @__PURE__ */ new Set();
-	held = /* @__PURE__ */ new Set();
+	/** Lowest ordinal of each item neither applied nor failed, read once at add. */
+	unapplied = /* @__PURE__ */ new Map();
+	/** Null when stale; a valid cache may be positive infinity. */
+	unappliedFloorCache = Number.POSITIVE_INFINITY;
 	addedCallbacks = [];
 	removedCallbacks = [];
 	paused = false;
@@ -5612,6 +6324,7 @@ var Mailbox = class {
 	_latestOrdinal = 0;
 	constructor(options = {}) {
 		this.holdAckBelowMarkers = options.holdAckBelowMarkers ?? false;
+		this.holdAckBelowUnapplied = options.holdAckBelowUnapplied ?? true;
 	}
 	init(ackOrdinal) {
 		this._ack = this._latestOrdinal = ackOrdinal;
@@ -5623,22 +6336,17 @@ var Mailbox = class {
 		return Array.from(this.itemsMap.values());
 	}
 	get ackOrdinal() {
-		if (!this.holdAckBelowMarkers && this.held.size === 0) return this._ack;
-		let floor = Number.POSITIVE_INFINITY;
-		for (const item of [...this.heldMarkers, ...this.held]) for (const op of item.operations) {
+		let floor = this.unappliedFloor();
+		for (const item of this.heldMarkers) for (const op of item.operations) {
 			const ordinal = op.context.ordinal;
 			if (ordinal > 0 && ordinal < floor) floor = ordinal;
 		}
+		if (floor === Number.POSITIVE_INFINITY) return this._ack;
 		return Math.min(this._ack, floor - 1);
 	}
 	get latestOrdinal() {
 		return this._latestOrdinal;
 	}
-	hold(item) {
-		if (item.status === 2) return;
-		if (this.itemsMap.get(item.id) !== item) return;
-		this.held.add(item);
-	}
 	get(id) {
 		return this.itemsMap.get(id);
 	}
@@ -5647,19 +6355,28 @@ var Mailbox = class {
 			const replaced = this.itemsMap.get(item.id);
 			if (replaced !== void 0 && replaced !== item) {
 				this.heldMarkers.delete(replaced);
-				this.held.delete(replaced);
+				this.forgetUnapplied(replaced);
 			}
 			this.itemsMap.set(item.id, item);
 			let marker = false;
+			let lowest = Number.POSITIVE_INFINITY;
 			for (const op of item.operations) {
-				this._latestOrdinal = Math.max(this._latestOrdinal, op.context.ordinal);
+				const ordinal = op.context.ordinal;
+				this._latestOrdinal = Math.max(this._latestOrdinal, ordinal);
+				if (ordinal > 0 && ordinal < lowest) lowest = ordinal;
 				if (isPurgeMarker$1(op)) marker = true;
 			}
+			if (this.holdAckBelowUnapplied && lowest !== Number.POSITIVE_INFINITY && item.status !== 2 && item.status !== 3) {
+				this.unapplied.set(item, lowest);
+				const cached = this.unappliedFloorCache;
+				if (cached !== null && lowest < cached) this.unappliedFloorCache = lowest;
+			}
 			if (this.holdAckBelowMarkers && marker && item.status !== 2) this.heldMarkers.add(item);
 			item.on((syncOp, _, next) => {
+				if (next === 3) this.forgetUnapplied(syncOp);
 				if (next === 2) {
 					this.heldMarkers.delete(syncOp);
-					this.held.delete(syncOp);
+					this.forgetUnapplied(syncOp);
 					for (const op of syncOp.operations) this._ack = Math.max(this._ack, op.context.ordinal);
 				}
 			});
@@ -5679,9 +6396,14 @@ var Mailbox = class {
 	}
 	remove(...items) {
 		for (const item of items) {
+			const current = this.itemsMap.get(item.id);
+			if (current !== void 0 && current !== item) {
+				this.heldMarkers.delete(current);
+				this.forgetUnapplied(current);
+			}
 			this.itemsMap.delete(item.id);
 			this.heldMarkers.delete(item);
-			this.held.delete(item);
+			this.forgetUnapplied(item);
 		}
 		if (this.paused) {
 			this.removedBuffer.push(...items);
@@ -5736,6 +6458,20 @@ var Mailbox = class {
 	isPaused() {
 		return this.paused;
 	}
+	/** Recomputed only once the item that set it has resolved. */
+	unappliedFloor() {
+		if (this.unappliedFloorCache !== null) return this.unappliedFloorCache;
+		let floor = Number.POSITIVE_INFINITY;
+		for (const ordinal of this.unapplied.values()) if (ordinal < floor) floor = ordinal;
+		this.unappliedFloorCache = floor;
+		return floor;
+	}
+	forgetUnapplied(item) {
+		const ordinal = this.unapplied.get(item);
+		if (ordinal === void 0) return;
+		this.unapplied.delete(item);
+		if (ordinal === this.unappliedFloorCache) this.unappliedFloorCache = null;
+	}
 };
 //#endregion
 //#region src/sync/buffered-mailbox.ts
@@ -5965,6 +6701,15 @@ var SyncRepairRefusedError = class extends Error {
 		this.name = "SyncRepairRefusedError";
 	}
 };
+/** A dead-letter page cursor that is not a row offset. */
+var InvalidDeadLetterCursorError = class extends Error {
+	cursor;
+	constructor(cursor) {
+		super(`Invalid dead-letter cursor: ${JSON.stringify(cursor)}`);
+		this.cursor = cursor;
+		this.name = "InvalidDeadLetterCursorError";
+	}
+};
 var PollingChannelError = class extends Error {
 	constructor(message) {
 		super(message);
@@ -7695,6 +8440,13 @@ var GqlRequestChannel = class {
 //#endregion
 //#region src/sync/channels/gql-request-channel-factory.ts
 /**
+* The {@link ChannelConfig.type} a GqlRequestChannel is created from.
+*
+* Named so {@link CompositeChannelFactory} registration and the callers that
+* build a `{ type: "gql" }` config agree on one spelling.
+*/
+const GQL_CHANNEL_TYPE = "gql";
+/**
 * Factory for creating GqlRequestChannel instances.
 *
 * Extracts GraphQL-specific configuration from ChannelConfig.parameters and
@@ -7704,6 +8456,7 @@ var GqlRequestChannel = class {
 * which is useful for short-lived tokens with audience-specific claims.
 */
 var GqlRequestChannelFactory = class {
+	channelTypes = ["gql"];
 	logger;
 	jwtHandler;
 	queue;
@@ -7815,7 +8568,7 @@ var GqlResponseChannel = class {
 		this.cursorStorage = cursorStorage;
 		this.isShutdown = false;
 		this.inbox = new Mailbox({ holdAckBelowMarkers: true });
-		this.outbox = new Mailbox();
+		this.outbox = new Mailbox({ holdAckBelowUnapplied: false });
 		this.deadLetter = new Mailbox();
 		this.outbox.onRemoved((syncOps) => {
 			this.rememberUnserved(syncOps);
@@ -7964,9 +8717,20 @@ var GqlResponseChannel = class {
 //#endregion
 //#region src/sync/channels/gql-response-channel-factory.ts
 /**
+* The {@link ChannelConfig.type} a GqlResponseChannel is created from.
+*
+* A response channel is never configured by this reactor: it is registered by
+* the peer that polls it, over the `registerChannel` mutation, whose resolver
+* (`packages/reactor-api`) writes exactly this type. Named here so
+* {@link CompositeChannelFactory} registration for the SWITCHBOARD scheme
+* routes the configs that actually arrive.
+*/
+const POLLING_CHANNEL_TYPE = "polling";
+/**
 * Factory for creating GqlResponseChannel instances.
 */
 var GqlResponseChannelFactory = class {
+	channelTypes = [POLLING_CHANNEL_TYPE];
 	logger;
 	constructor(logger) {
 		this.logger = logger;
@@ -7976,6 +8740,36 @@ var GqlResponseChannelFactory = class {
 	}
 };
 //#endregion
+//#region src/storage/flush-guarded-sync-cursor-storage.ts
+/**
+* Durability boundary 1 as a seam around whatever cursor storage sync uses: no
+* cursor row is written before a flush covering its operations, and a failed
+* flush takes the write with it. The row itself is not flushed after: a crash
+* then loses the advance, never the data, and a re-pull is idempotent.
+*/
+var FlushGuardedSyncCursorStorage = class {
+	inner;
+	flusher;
+	constructor(inner, flusher) {
+		this.inner = inner;
+		this.flusher = flusher;
+	}
+	list(remoteName, signal) {
+		return this.inner.list(remoteName, signal);
+	}
+	get(remoteName, cursorType, signal) {
+		return this.inner.get(remoteName, cursorType, signal);
+	}
+	async upsert(cursor, signal) {
+		await this.flusher.flush();
+		await this.inner.upsert(cursor, signal);
+	}
+	/** Forgetting an advance is the safe direction, so it needs no barrier. */
+	remove(remoteName, signal) {
+		return this.inner.remove(remoteName, signal);
+	}
+};
+//#endregion
 //#region src/storage/kysely/delivery-lookup.ts
 /** The index row at `ordinal` and every membership of its document. */
 async function deliveryAt(db, documentId, ordinal) {
@@ -8315,7 +9109,8 @@ function rowToRemoteRecord(row) {
 		},
 		options: {
 			sinceTimestampUtcMs: "0",
-			boundAddress: row.bound_address ?? void 0
+			boundAddress: row.bound_address ?? void 0,
+			...row.persistence === "session" ? { persistence: "session" } : {}
 		},
 		status: {
 			push: {
@@ -8358,6 +9153,7 @@ function remoteRecordToRow(remote) {
 		pull_last_failure_utc_ms: remote.status.pull.lastFailureUtcMs ? new Date(remote.status.pull.lastFailureUtcMs).toISOString() : null,
 		pull_failure_count: remote.status.pull.failureCount,
 		bound_address: remote.options.boundAddress ?? null,
+		persistence: remote.options.persistence ?? "durable",
 		peer_manifest: remote.peer?.manifest ? canonicalJson(remote.peer.manifest, "peer manifest") : null,
 		peer_manifest_at_utc_ms: remote.peer?.receivedAtUtcMs ?? null
 	};
@@ -8789,6 +9585,15 @@ var SyncAwaiter = class {
 	}
 };
 //#endregion
+//#region src/sync/sync-inspection.ts
+function deriveConnectionHealth(snapshot, nowMs = Date.now()) {
+	return {
+		snapshot,
+		neverSucceeded: snapshot.state === "connected" && snapshot.lastSuccessUtcMs === 0,
+		stalenessMs: snapshot.lastSuccessUtcMs > 0 ? Math.max(0, nowMs - snapshot.lastSuccessUtcMs) : void 0
+	};
+}
+//#endregion
 //#region src/sync/sync-status-tracker.ts
 let SyncStatus = /* @__PURE__ */ function(SyncStatus) {
 	SyncStatus["Synced"] = "SYNCED";
@@ -8904,7 +9709,8 @@ const defaultSyncManagerConfig = {
 	maxHeldOperationsPerRemote: 1e4,
 	staleRemotePollWindowMs: 3e5,
 	markerRetryBaseDelayMs: 1e3,
-	markerRetryMaxDelayMs: 6e4
+	markerRetryMaxDelayMs: 6e4,
+	maxConcurrentInboxChunks: 8
 };
 const PLAN_KEY_TO_JOB_UUID_CAP = 1e4;
 /**
@@ -8916,6 +9722,9 @@ function isCredentialOrNetworkError(error) {
 	if (isDriveAuthError(error)) return true;
 	return error instanceof GraphQLRequestError && (error.category === "network" || error.category === "timeout");
 }
+function isSessionScoped(options) {
+	return options.persistence === "session";
+}
 const holdKey = (documentId, branch) => `${documentId}\u0000${branch}`;
 const VERSION_CACHE_CAP = 1e4;
 /** The versions a CREATE_DOCUMENT among `operations` fixes for the document. */
@@ -8984,7 +9793,9 @@ var SyncManager = class {
 	derivedThrough = /* @__PURE__ */ new Map();
 	sweptThrough = 0;
 	settledUnsubscribe;
-	inboxChunkChain = Promise.resolve();
+	inboxLanes = /* @__PURE__ */ new Map();
+	inboxChunksInFlight = 0;
+	inboxSlotWaiters = [];
 	capabilities;
 	manifest;
 	localSupport;
@@ -8998,6 +9809,7 @@ var SyncManager = class {
 	peerUpdates = /* @__PURE__ */ new Map();
 	peerUnsubscribes = /* @__PURE__ */ new Map();
 	receivedMarkers = /* @__PURE__ */ new Map();
+	appliedMarkers = /* @__PURE__ */ new Map();
 	markerStorage;
 	refusalStorage;
 	markerWrites = /* @__PURE__ */ new Map();
@@ -9047,6 +9859,14 @@ var SyncManager = class {
 	}
 	async startup() {
 		if (this.isShutdown) throw new Error("SyncManager is already shutdown and cannot be started");
+		const remoteRecords = [];
+		for (const record of await this.remoteStorage.list()) {
+			if (isSessionScoped(record.options)) {
+				await this.purgeSessionRemote(record.name);
+				continue;
+			}
+			remoteRecords.push(record);
+		}
 		try {
 			const quarantinedIds = await this.deadLetterStorage.listQuarantinedDocumentIds();
 			for (const id of quarantinedIds) this.quarantinedDocumentIds.add(id);
@@ -9063,30 +9883,19 @@ var SyncManager = class {
 		} catch (error) {
 			this.logger.error("Failed to load sync holds (@error)", error instanceof Error ? error.message : String(error));
 		}
-		const remoteRecords = await this.remoteStorage.list();
 		const head = await this.watermarkHead();
 		this.sweptThrough = Math.max(this.sweptThrough, head);
 		for (const record of remoteRecords) {
-			const channel = this.channelFactory.instance(record.id, record.name, record.channelConfig, this.cursorStorage, record.collectionId, record.filter, this.operationIndex, record.options);
-			const remote = {
-				meta: {
-					id: record.id,
-					name: record.name,
-					collectionId: record.collectionId,
-					channelConfig: record.channelConfig,
-					filter: record.filter,
-					options: record.options,
-					peer: record.peer
-				},
-				channel
-			};
-			this.remotes.set(record.name, remote);
-			this.owe(record.name, head);
-			this.records.set(record.name, remote.meta);
-			await this.loadDeadLetters(remote);
-			await this.restoreReceivedMarkers(remote);
-			const unheard = [...remote.channel.inbox.items];
-			this.wireChannelCallbacks(remote);
+			let rehydrated;
+			try {
+				rehydrated = await this.rehydrateRemote(record, head);
+			} catch (error) {
+				await this.degradeRemoteAfterFailedRehydration(record, error);
+				continue;
+			}
+			const remote = rehydrated.remote;
+			const channel = remote.channel;
+			const unheard = rehydrated.unheard;
 			try {
 				await channel.init();
 			} catch (error) {
@@ -9120,6 +9929,8 @@ var SyncManager = class {
 		this.backfillAbortControllers.clear();
 		this.planKeyToJobUuid.clear();
 		this.lastEnqueuedJobIdByKey.clear();
+		this.inboxLanes.clear();
+		for (const waiter of this.inboxSlotWaiters.splice(0)) waiter();
 		this.prunePending.clear();
 		this.pruneDrainDeferred = false;
 		this.batchAggregator.clear();
@@ -9510,6 +10321,16 @@ var SyncManager = class {
 		}
 		return kept;
 	}
+	/** A previous session's transport is gone, so its remote and rows go too. */
+	async purgeSessionRemote(name) {
+		try {
+			await this.remoteStorage.remove(name);
+			await this.cursorStorage.remove(name);
+			await this.forgetRemote(name);
+		} catch (error) {
+			this.logger.error("Error removing a previous session's remote at startup (@name, @error)", name, error instanceof Error ? error.message : String(error));
+		}
+	}
 	recordOf(meta) {
 		return {
 			id: meta.id,
@@ -9546,8 +10367,8 @@ var SyncManager = class {
 				receivedAtUtcMs: Date.now()
 			}
 		};
-		await this.remoteStorage.upsert(this.recordOf(meta));
 		const channel = this.channelFactory.instance(remoteId, name, channelConfig, this.cursorStorage, collectionId, filter, this.operationIndex, options);
+		await this.remoteStorage.upsert(this.recordOf(meta));
 		const remote = {
 			meta,
 			channel
@@ -9587,6 +10408,72 @@ var SyncManager = class {
 		}
 	}
 	/**
+	* Rebuilds one stored remote's channel and wires it up, short of init().
+	*
+	* Everything here can throw -- the factory rejects an unusable config, the
+	* dead-letter and marker reads touch storage -- so startup() calls it inside
+	* a guard and degrades just this remote when it does. Nothing is left half
+	* registered on the throwing path that {@link degradeRemoteAfterFailedRehydration}
+	* does not then clear.
+	*/
+	async rehydrateRemote(record, head) {
+		const channel = this.channelFactory.instance(record.id, record.name, record.channelConfig, this.cursorStorage, record.collectionId, record.filter, this.operationIndex, record.options);
+		const remote = {
+			meta: {
+				id: record.id,
+				name: record.name,
+				collectionId: record.collectionId,
+				channelConfig: record.channelConfig,
+				filter: record.filter,
+				options: record.options,
+				peer: record.peer
+			},
+			channel
+		};
+		this.remotes.set(record.name, remote);
+		this.owe(record.name, head);
+		this.records.set(record.name, remote.meta);
+		await this.loadDeadLetters(remote);
+		await this.restoreReceivedMarkers(remote);
+		const unheard = [...remote.channel.inbox.items];
+		this.wireChannelCallbacks(remote);
+		return {
+			remote,
+			unheard
+		};
+	}
+	/**
+	* Records a stored remote startup() could not bring up and moves on.
+	*
+	* Classified exactly as a failed init is: a credential or network failure
+	* says nothing about the configuration, so the row stays and a retry after
+	* sign-in can re-add it; anything else -- a factory with no scheme for this
+	* config, a transport this session cannot resolve -- says the record itself
+	* is unusable, so it is dropped rather than left to fail every boot. Either
+	* way the boot carries on without it.
+	*/
+	async degradeRemoteAfterFailedRehydration(record, error) {
+		const message = error instanceof Error ? error.message : String(error);
+		this.logger.error("Error rehydrating stored remote at startup (@name, @error)", record.name, message);
+		const recordKept = isCredentialOrNetworkError(error);
+		this.remotes.delete(record.name);
+		this.owed.delete(record.name);
+		this.derivedThrough.delete(record.name);
+		this.connectionStateUnsubscribes.get(record.name)?.();
+		this.connectionStateUnsubscribes.delete(record.name);
+		if (recordKept) return;
+		try {
+			await this.remoteStorage.remove(record.name);
+		} catch (removeError) {
+			this.logger.error("Error removing unusable remote record at startup (@name, @error)", record.name, removeError instanceof Error ? removeError.message : String(removeError));
+		}
+		try {
+			await this.forgetRemote(record.name);
+		} catch (forgetError) {
+			this.logger.error("Error forgetting unusable remote at startup (@name, @error)", record.name, forgetError instanceof Error ? forgetError.message : String(forgetError));
+		}
+	}
+	/**
 	* Drops a remote whose channel.init() rejected, optionally removing its
 	* stored record. Ordered like remove(): the registry slot is released last,
 	* so a concurrent add of the same name cannot slip in and have its record
@@ -9641,6 +10528,7 @@ var SyncManager = class {
 			this.derivedThrough.delete(name);
 			this.prunePending.delete(name);
 			this.receivedMarkers.delete(name);
+			this.appliedMarkers.delete(name);
 			for (const [id, retry] of [...this.markerRetries]) {
 				if (retry.remoteName !== name) continue;
 				clearTimeout(retry.timer);
@@ -9654,6 +10542,55 @@ var SyncManager = class {
 	list() {
 		return Array.from(this.remotes.values());
 	}
+	async inspectRemote(remoteName) {
+		const remote = this.getByName(remoteName);
+		return this.inspectionOf(remote);
+	}
+	async inspectRemotes() {
+		const out = [];
+		for (const remote of [...this.remotes.values()]) out.push(await this.inspectionOf(remote));
+		return out;
+	}
+	async listDeadLetters(remoteName, cursor, limit) {
+		this.getByName(remoteName);
+		if (cursor && !(/^\d+$/.test(cursor) && Number.isSafeInteger(Number(cursor)))) throw new InvalidDeadLetterCursorError(cursor);
+		const max = this.config.maxDeadLettersPerRemote;
+		const page = await this.deadLetterStorage.list(remoteName, {
+			cursor: cursor || "0",
+			limit: limit === void 0 || !Number.isFinite(limit) ? max : Math.min(Math.max(Math.trunc(limit), 1), max)
+		});
+		return {
+			remoteName,
+			results: page.results,
+			nextCursor: page.nextCursor
+		};
+	}
+	async inspectionOf(remote) {
+		const cursors = await this.cursorStorage.list(remote.meta.name);
+		const cursorInfo = (cursorType, mailbox) => {
+			const stored = cursors.find((c) => c.cursorType === cursorType);
+			return {
+				cursorType,
+				cursorOrdinal: stored?.cursorOrdinal ?? 0,
+				lastSyncedAtUtcMs: stored?.lastSyncedAtUtcMs,
+				liveAckOrdinal: mailbox.ackOrdinal,
+				liveLatestOrdinal: mailbox.latestOrdinal
+			};
+		};
+		const { channel } = remote;
+		return {
+			remoteName: remote.meta.name,
+			remoteId: remote.meta.id,
+			inboxCursor: cursorInfo("inbox", channel.inbox),
+			outboxCursor: cursorInfo("outbox", channel.outbox),
+			mailboxDepths: {
+				inbox: channel.inbox.items.length,
+				outbox: channel.outbox.items.length,
+				deadLetter: channel.deadLetter.items.length
+			},
+			connection: deriveConnectionHealth(channel.getConnectionState())
+		};
+	}
 	waitForSync(jobId, signal) {
 		return this.syncAwaiter.waitForSync(jobId, signal);
 	}
@@ -9667,6 +10604,13 @@ var SyncManager = class {
 	async receiptsStored(remoteNames) {
 		await Promise.all(this.markerWritesOf(remoteNames));
 	}
+	async resetSettled(name) {
+		for (;;) {
+			const pending = this.queuedResets.get(name) ?? this.resets.get(name);
+			if (!pending) return;
+			await pending.catch(() => void 0);
+		}
+	}
 	/** Never joins a running rebuild: it may have read state older than the request. */
 	resetChannel(remoteName) {
 		const queued = this.queuedResets.get(remoteName);
@@ -9743,7 +10687,6 @@ var SyncManager = class {
 			if (!this.parkedByQuarantine.has(item) || requeued.has(item.id)) continue;
 			const copy = new SyncOperation(item.id, item.jobId, item.jobDependencies, item.remoteName, item.documentId, item.scopes, item.branch, item.operations);
 			fresh.channel.inbox.add(copy);
-			fresh.channel.inbox.hold?.(copy);
 		}
 	}
 	/** Before a fresh channel is registered: nothing to tear down. */
@@ -10107,13 +11050,15 @@ var SyncManager = class {
 		const eligible = [];
 		const dropped = [];
 		const received = this.receivedMarkersOf(remote.meta.name);
+		const applied = this.appliedMarkers.get(remote.meta.name);
 		const loading = (id, syncOp) => {
 			const item = received.get(id);
 			return item !== void 0 && item !== syncOp && item.status !== 2 && remote.channel.inbox.get(item.id) === item;
 		};
 		for (const syncOp of syncOps) if (carriesMarker(syncOp)) {
 			const ids = markerIdsOf(syncOp);
-			if (ids.every((id) => loading(id, syncOp))) {
+			if (applied !== void 0 && ids.every((id) => applied.has(id))) dropped.push(syncOp);
+			else if (ids.every((id) => loading(id, syncOp))) {
 				this.storeReceivedMarker(remote, syncOp);
 				dropped.push(syncOp);
 			} else {
@@ -10126,10 +11071,7 @@ var SyncManager = class {
 			this.dropRequeuedDeadLetter(syncOp.id, remote.meta.name);
 		} else if (!this.quarantinedDocumentIds.has(syncOp.documentId)) eligible.push(syncOp);
 		else if (!this.requeuedDeadLetterIds.has(syncOp.id) && this.parkedCopyOf(remote, syncOp)) dropped.push(syncOp);
-		else {
-			this.parkedByQuarantine.add(syncOp);
-			remote.channel.inbox.hold?.(syncOp);
-		}
+		else this.parkedByQuarantine.add(syncOp);
 		for (const syncOp of dropped) {
 			this.logger.debug("Dropping received operations of a purged, already-loading or already-parked document (@remote, @documentId)", remote.meta.name, syncOp.documentId);
 			syncOp.executed();
@@ -10156,14 +11098,34 @@ var SyncManager = class {
 	}
 	/** Forgets a marker once the item loading it leaves the inbox. */
 	handleInboxRemoved(remote, syncOps) {
-		const received = this.receivedMarkers.get(remote.meta.name);
-		if (received === void 0 || received.size === 0) return;
 		const name = remote.meta.name;
-		for (const syncOp of syncOps) for (const id of markerIdsOf(syncOp)) {
+		const received = this.receivedMarkers.get(name);
+		if (received !== void 0 && received.size > 0) for (const syncOp of syncOps) for (const id of markerIdsOf(syncOp)) {
 			if (received.get(id) !== syncOp) continue;
 			received.delete(id);
 			this.writeMarker(name, id, () => this.markerStorage.remove(name, id));
+			if (syncOp.status === 2) this.rememberAppliedMarker(name, id, syncOp);
 		}
+		this.forgetAckedMarkers(remote);
+	}
+	/** Kept until the ack passes it: the pusher re-pushes everything above the ack. */
+	rememberAppliedMarker(name, id, syncOp) {
+		let applied = this.appliedMarkers.get(name);
+		if (applied === void 0) {
+			applied = /* @__PURE__ */ new Map();
+			this.appliedMarkers.set(name, applied);
+		}
+		let ordinal = 0;
+		for (const op of syncOp.operations) ordinal = Math.max(ordinal, op.context.ordinal);
+		applied.set(id, ordinal);
+	}
+	forgetAckedMarkers(remote) {
+		const name = remote.meta.name;
+		const applied = this.appliedMarkers.get(name);
+		if (applied === void 0) return;
+		const ack = remote.channel.inbox.ackOrdinal;
+		for (const [id, ordinal] of applied) if (ordinal <= ack) applied.delete(id);
+		if (applied.size === 0) this.appliedMarkers.delete(name);
 	}
 	markerWritesOf(remoteNames) {
 		if (remoteNames === void 0) return [...this.markerWrites.values()];
@@ -10229,23 +11191,91 @@ var SyncManager = class {
 		return received;
 	}
 	processInboxChunks(chunks) {
-		const next = this.inboxChunkChain.then(async () => {
-			for (const chunk of chunks) {
-				if (this.isShutdown) return;
-				await this.applyInboxBatch(chunk);
-			}
-		});
-		this.inboxChunkChain = next.catch((err) => {
+		return Promise.all(chunks.map((chunk) => this.queueInboxChunk(chunk))).then(() => void 0);
+	}
+	/**
+	* Queues a chunk behind every chunk it shares a lane key with and beside the
+	* rest, so one document's stalled or failing load does not hold up another's.
+	*/
+	queueInboxChunk(chunk) {
+		const keys = this.inboxLaneKeys(chunk);
+		const predecessors = [];
+		for (const key of keys) {
+			const tail = this.inboxLanes.get(key);
+			if (tail !== void 0) predecessors.push(tail);
+		}
+		const lane = Promise.all(predecessors).then(() => this.runInboxChunk(chunk)).catch((err) => {
 			this.logger.error("Inbox chunk processing failed (@error)", err instanceof Error ? err.message : String(err));
 		});
-		return next;
+		for (const key of keys) this.inboxLanes.set(key, lane);
+		lane.then(() => {
+			for (const key of keys) if (this.inboxLanes.get(key) === lane) this.inboxLanes.delete(key);
+		});
+		return lane;
+	}
+	/**
+	* The documents a chunk writes, since the FIFO dependency reads the job last
+	* enqueued for its document, and the plan keys its edges name, since a
+	* cross-chunk edge resolves only once its provider is enqueued. Per document
+	* rather than per scope or branch: the queue serialises a document across both.
+	*/
+	inboxLaneKeys(chunk) {
+		const keys = /* @__PURE__ */ new Set();
+		for (const { syncOp } of chunk) {
+			keys.add(`doc ${syncOp.documentId}`);
+			keys.add(`plan ${syncOp.jobId}`);
+			for (const dep of syncOp.jobDependencies) if (dep) keys.add(`plan ${dep}`);
+		}
+		return [...keys];
+	}
+	/**
+	* Settles once the chunk is enqueued, which is all its lane waits for; the
+	* queue orders the writes. The slot is released there too, and the items
+	* then resolve beside one another, unbounded: each is a passive wait on a
+	* job for an item the inbox already holds.
+	*/
+	async runInboxChunk(chunk) {
+		if (this.isShutdown) return;
+		await this.acquireInboxSlot();
+		if (this.isShutdown) {
+			this.releaseInboxSlot();
+			return;
+		}
+		let enqueued;
+		try {
+			enqueued = await this.enqueueInboxBatch(chunk);
+		} finally {
+			this.releaseInboxSlot();
+		}
+		if (enqueued === void 0) return;
+		this.resolveInboxBatch(enqueued).catch((err) => {
+			this.logger.error("Inbox chunk resolution failed (@error)", err instanceof Error ? err.message : String(err));
+		});
+	}
+	acquireInboxSlot() {
+		if (this.inboxChunksInFlight < this.config.maxConcurrentInboxChunks) {
+			this.inboxChunksInFlight++;
+			return Promise.resolve();
+		}
+		return new Promise((resolve) => {
+			this.inboxSlotWaiters.push(resolve);
+		});
+	}
+	/** Hands the slot straight to a waiter rather than freeing it. */
+	releaseInboxSlot() {
+		const waiter = this.inboxSlotWaiters.shift();
+		if (waiter !== void 0) {
+			waiter();
+			return;
+		}
+		this.inboxChunksInFlight--;
 	}
 	async applyInboxJob(remote, syncOp) {
 		if ((await this.refuseOnReceipt(remote, [syncOp])).size > 0) return;
 		const operations = syncOp.operations.map((op) => op.operation);
 		let jobInfo;
 		try {
-			jobInfo = await this.reactor.load(syncOp.documentId, syncOp.branch, operations, this.abortController.signal, { sourceRemote: remote.meta.name });
+			jobInfo = await this.reactor.load(syncOp.documentId, syncOp.branch, operations, this.abortController.signal, cursorProtectedLoadMeta(remote.meta.name));
 		} catch (error) {
 			if (this.isShutdown) return;
 			const err = error instanceof Error ? error : new Error(String(error));
@@ -10335,14 +11365,15 @@ var SyncManager = class {
 		}
 		await this.applyInboxJob(remote, syncOp);
 	}
-	async applyInboxBatch(received) {
+	/** Enqueues one chunk's loads; the resolution runs outside the lane. */
+	async enqueueInboxBatch(received) {
 		const refused = /* @__PURE__ */ new Set();
 		for (const { remote, syncOp } of received) {
 			const refusals = await this.refuseOnReceipt(remote, [syncOp]);
 			for (const refusal of refusals) refused.add(refusal);
 		}
 		const items = received.filter(({ syncOp }) => !refused.has(syncOp));
-		if (items.length === 0) return;
+		if (items.length === 0) return void 0;
 		const sourceRemote = items[0].remote.meta.name;
 		const chunkKeys = new Set(items.map(({ syncOp }) => syncOp.jobId));
 		const jobs = items.map(({ syncOp }) => {
@@ -10372,9 +11403,9 @@ var SyncManager = class {
 		const request = { jobs };
 		let result;
 		try {
-			result = await this.reactor.loadBatch(request, this.abortController.signal, { sourceRemote });
+			result = await this.reactor.loadBatch(request, this.abortController.signal, cursorProtectedLoadMeta(sourceRemote));
 		} catch (error) {
-			if (this.isShutdown) return;
+			if (this.isShutdown) return void 0;
 			for (const { remote, syncOp } of items) {
 				const err = error instanceof Error ? error : new Error(String(error));
 				if (carriesMarker(syncOp)) {
@@ -10387,7 +11418,7 @@ var SyncManager = class {
 			}
 			return;
 		}
-		if (this.isShutdown) return;
+		if (this.isShutdown) return void 0;
 		for (const plan of jobs) {
 			if (!(plan.key in result.jobs)) continue;
 			const info = result.jobs[plan.key];
@@ -10395,51 +11426,59 @@ var SyncManager = class {
 			const fifoKey = `${plan.documentId}:${plan.scope}:${plan.branch}`;
 			this.lastEnqueuedJobIdByKey.set(fifoKey, info.id);
 		}
-		for (const { remote, syncOp } of items) {
-			if (!(syncOp.jobId in result.jobs)) {
-				this.logger.error("Job key missing from batch load result (@remote, @documentId, @jobId)", remote.meta.name, syncOp.documentId, syncOp.jobId);
-				const error = new ChannelError("inbox", /* @__PURE__ */ new Error(`Job key '${syncOp.jobId}' missing from batch load result`));
-				syncOp.failed(error);
-				remote.channel.deadLetter.add(syncOp);
-				remote.channel.inbox.remove(syncOp);
-				continue;
-			}
-			const jobInfo = result.jobs[syncOp.jobId];
-			let completedJobInfo;
-			try {
-				completedJobInfo = await this.awaiter.waitForJob(jobInfo.id, this.abortController.signal);
-			} catch (error) {
-				if (this.isShutdown) continue;
-				const err = error instanceof Error ? error : new Error(String(error));
-				if (carriesMarker(syncOp)) {
-					this.retryMarker(remote, syncOp, err.message);
-					continue;
-				}
-				syncOp.failed(new ChannelError("inbox", err));
-				remote.channel.deadLetter.add(syncOp);
-				remote.channel.inbox.remove(syncOp);
-				continue;
-			}
+		return {
+			items,
+			result
+		};
+	}
+	/** Each item awaits its own job, so one deferred load holds no other. */
+	async resolveInboxBatch(enqueued) {
+		await Promise.all(enqueued.items.map(({ remote, syncOp }) => this.resolveInboxItem(remote, syncOp, enqueued.result)));
+	}
+	async resolveInboxItem(remote, syncOp, result) {
+		if (!(syncOp.jobId in result.jobs)) {
+			this.logger.error("Job key missing from batch load result (@remote, @documentId, @jobId)", remote.meta.name, syncOp.documentId, syncOp.jobId);
+			const error = new ChannelError("inbox", /* @__PURE__ */ new Error(`Job key '${syncOp.jobId}' missing from batch load result`));
+			syncOp.failed(error);
+			remote.channel.deadLetter.add(syncOp);
+			remote.channel.inbox.remove(syncOp);
+			return;
+		}
+		const jobInfo = result.jobs[syncOp.jobId];
+		let completedJobInfo;
+		try {
+			completedJobInfo = await this.awaiter.waitForJob(jobInfo.id, this.abortController.signal);
+		} catch (error) {
 			if (this.isShutdown) return;
-			let resolved = false;
-			if (completedJobInfo.status !== "FAILED") {
-				syncOp.executed();
-				if (carriesMarker(syncOp)) this.tombstone(syncOp.documentId);
-				resolved = true;
-			} else if (isPurgedFailure(completedJobInfo.error, syncOp.documentId)) {
-				this.tombstone(syncOp.documentId);
-				syncOp.executed();
-				resolved = true;
-			} else if (carriesMarker(syncOp) && !isRefusedMarker(completedJobInfo.error)) {
-				this.retryMarker(remote, syncOp, completedJobInfo.error?.message || "Unknown error");
-				continue;
-			} else {
-				syncOp.failed(this.inboxFailure(syncOp, completedJobInfo.error));
-				remote.channel.deadLetter.add(syncOp);
+			const err = error instanceof Error ? error : new Error(String(error));
+			if (carriesMarker(syncOp)) {
+				this.retryMarker(remote, syncOp, err.message);
+				return;
 			}
+			syncOp.failed(new ChannelError("inbox", err));
+			remote.channel.deadLetter.add(syncOp);
 			remote.channel.inbox.remove(syncOp);
-			if (resolved) await this.dropRequeuedDeadLetter(syncOp.id, remote.meta.name);
+			return;
+		}
+		if (this.isShutdown) return;
+		let resolved = false;
+		if (completedJobInfo.status !== "FAILED") {
+			syncOp.executed();
+			if (carriesMarker(syncOp)) this.tombstone(syncOp.documentId);
+			resolved = true;
+		} else if (isPurgedFailure(completedJobInfo.error, syncOp.documentId)) {
+			this.tombstone(syncOp.documentId);
+			syncOp.executed();
+			resolved = true;
+		} else if (carriesMarker(syncOp) && !isRefusedMarker(completedJobInfo.error)) {
+			this.retryMarker(remote, syncOp, completedJobInfo.error?.message || "Unknown error");
+			return;
+		} else {
+			syncOp.failed(this.inboxFailure(syncOp, completedJobInfo.error));
+			remote.channel.deadLetter.add(syncOp);
 		}
+		remote.channel.inbox.remove(syncOp);
+		if (resolved) await this.dropRequeuedDeadLetter(syncOp.id, remote.meta.name);
 	}
 	/**
 	* The dead letter for a load job the executor failed.
@@ -10671,6 +11710,7 @@ var SyncBuilder = class {
 	holdStorage;
 	receivedMarkerStorage;
 	purgeRefusalStorage;
+	storageFlusher = new NoopStorageFlusher();
 	config = {};
 	withChannelFactory(factory) {
 		this.channelFactory = factory;
@@ -10684,6 +11724,11 @@ var SyncBuilder = class {
 		this.cursorStorage = storage;
 		return this;
 	}
+	/** The barrier every cursor write, including a custom storage's, goes behind. */
+	withStorageFlusher(flusher) {
+		this.storageFlusher = flusher;
+		return this;
+	}
 	withDeadLetterStorage(storage) {
 		this.deadLetterStorage = storage;
 		return this;
@@ -10708,6 +11753,10 @@ var SyncBuilder = class {
 		this.config.maxInboxBatchSize = limit;
 		return this;
 	}
+	withMaxConcurrentInboxChunks(limit) {
+		this.config.maxConcurrentInboxChunks = limit;
+		return this;
+	}
 	withMaxHeldOperationsPerRemote(limit) {
 		this.config.maxHeldOperationsPerRemote = limit;
 		return this;
@@ -10722,7 +11771,7 @@ var SyncBuilder = class {
 	buildModule(reactor, logger, operationIndex, eventBus, db, driveContainerTypes, watermark, localPeer) {
 		if (!this.channelFactory) throw new Error("Channel factory is required");
 		const remoteStorage = this.remoteStorage ?? new KyselySyncRemoteStorage(db);
-		const cursorStorage = this.cursorStorage ?? new KyselySyncCursorStorage(db);
+		const cursorStorage = new FlushGuardedSyncCursorStorage(this.cursorStorage ?? new KyselySyncCursorStorage(db), this.storageFlusher);
 		const deadLetterStorage = this.deadLetterStorage ?? new KyselySyncDeadLetterStorage(db);
 		const holdStorage = this.holdStorage ?? new KyselySyncHoldStorage(db);
 		const receivedMarkerStorage = this.receivedMarkerStorage ?? new KyselySyncReceivedMarkerStorage(db);
@@ -10735,7 +11784,8 @@ var SyncBuilder = class {
 			holdStorage,
 			channelFactory: this.channelFactory,
 			syncManager,
-			syncAdmin: syncManager
+			syncAdmin: syncManager,
+			syncInspector: syncManager
 		};
 	}
 };
@@ -10748,6 +11798,38 @@ async function createDefaultDatabase() {
 	return new Kysely({ dialect: new HardenedPGliteDialect(new PGlite()) });
 }
 //#endregion
+//#region src/inspector/storage-facts.ts
+const UNKNOWN_STORAGE_FACTS = Object.freeze({
+	engine: "unknown",
+	persistence: "unknown",
+	durable: false,
+	selfHeal: false
+});
+const POSTGRES_STORAGE_FACTS = Object.freeze({
+	engine: "postgres",
+	persistence: "server",
+	durable: true,
+	selfHeal: false
+});
+const IN_MEMORY_PGLITE_STORAGE_FACTS = Object.freeze({
+	engine: "pglite",
+	persistence: "memory",
+	durable: false,
+	selfHeal: false
+});
+const PGLITE_PATH_STORAGE_FACTS = Object.freeze({
+	engine: "pglite",
+	persistence: "path",
+	durable: true,
+	selfHeal: false
+});
+const PGLITE_IDB_STORAGE_FACTS = Object.freeze({
+	engine: "pglite",
+	persistence: "idb",
+	durable: true,
+	selfHeal: false
+});
+//#endregion
 //#region src/shared/factories.ts
 /**
 * Factory method to create a ShutdownStatus that can be updated
@@ -11322,7 +12404,10 @@ var Reactor = class {
 				status: "FAILED",
 				createdAtUtcIso: now,
 				completedAtUtcIso: now,
-				error: toErrorInfo$1("Job not found"),
+				error: {
+					...toErrorInfo$1("Job not found"),
+					name: JOB_NOT_FOUND_ERROR_NAME
+				},
 				consistencyToken: {
 					version: 1,
 					createdAtUtcIso: now,
@@ -11401,6 +12486,19 @@ function validateBuiltInKindCoverage(preReadyKinds, postReadyKinds) {
 	const problems = [missing.length > 0 ? `never named: ${missing.join(", ")} (would be indexed by no shard, leaving those reads permanently stale and their consistency-token waits unresolvable)` : void 0, duplicated.length > 0 ? `named more than once: ${duplicated.join(", ")} (would be indexed twice per operation)` : void 0].filter((problem) => problem !== void 0);
 	throw new Error(`withProjectionShards requires preReadyKinds and postReadyKinds to name each built-in read model (${BUILT_IN_READ_MODEL_KINDS.join(", ")}) exactly once between them; ${problems.join("; ")}`);
 }
+function schemeChannelDescriptor(scheme) {
+	switch (scheme) {
+		case "connect": return {
+			type: "gql",
+			create: (logger, jwtHandler, queue) => new GqlRequestChannelFactory(logger, jwtHandler, queue)
+		};
+		case "switchboard": return {
+			type: POLLING_CHANNEL_TYPE,
+			create: (logger) => new GqlResponseChannelFactory(logger)
+		};
+		default: throw new Error(`Unsupported channel scheme: ${JSON.stringify(scheme)}`);
+	}
+}
 var ReactorBuilder = class {
 	logger;
 	documentModelSources = [];
@@ -11421,6 +12519,8 @@ var ReactorBuilder = class {
 	readModelCoordinator;
 	readModelCoordinatorFactory;
 	kyselyInstance;
+	storageFactsOverride;
+	groupCommitPGlite;
 	signer;
 	workerSigner;
 	trustPolicy;
@@ -11428,6 +12528,7 @@ var ReactorBuilder = class {
 	signalHandlersEnabled = false;
 	queueInstance;
 	channelScheme;
+	additionalChannelFactories = /* @__PURE__ */ new Map();
 	jwtHandler;
 	documentModelLoader;
 	shutdownHooks = [];
@@ -11585,6 +12686,23 @@ var ReactorBuilder = class {
 		this.kyselyInstance = kysely;
 		return this;
 	}
+	/** Declares the store's facts; without it a caller-supplied store is unknown. */
+	withStorageFacts(facts) {
+		this.storageFactsOverride = facts;
+		return this;
+	}
+	/**
+	* Runs the reactor on an embedded PGlite with group commit: statements stop
+	* syncing the filesystem, and the flush moves to a job's write-ready and
+	* every sync cursor write. A poisoned session goes to `onUnrecoverable`,
+	* since a fallback would leave in-memory read-model positions ahead of the
+	* store. The caller keeps `pg` if the build fails; once built, the module's
+	* `groupCommitStorage` closes it.
+	*/
+	withGroupCommitPGlite(options) {
+		this.groupCommitPGlite = options;
+		return this;
+	}
 	/**
 	* Register an externally-constructed pg.Pool's {@link PoolInstrumentation}
 	* so it surfaces through {@link ReactorModule.pools}. Use this when the
@@ -11600,11 +12718,24 @@ var ReactorBuilder = class {
 		this.queueInstance = queue;
 		return this;
 	}
-	/** Mutually exclusive with {@link withSync}; setting both fails the build. */
+	/**
+	* Mutually exclusive with {@link withSync}; setting both fails the build.
+	* Compose further transports onto the scheme with {@link withAdditionalChannelFactory}.
+	*/
 	withChannelScheme(scheme) {
 		this.channelScheme = scheme;
 		return this;
 	}
+	/**
+	* Routes `type` to `factory` beside the {@link withChannelScheme} scheme's
+	* own factory, through a {@link CompositeChannelFactory}. Build refuses it
+	* without a scheme, or when `type` is the scheme's own.
+	*/
+	withAdditionalChannelFactory(type, factory) {
+		if (this.additionalChannelFactories.has(type)) throw new Error(`A channel factory for the type "${type}" is already registered on this ReactorBuilder`);
+		this.additionalChannelFactories.set(type, factory);
+		return this;
+	}
 	withJwtHandler(handler) {
 		this.jwtHandler = handler;
 		return this;
@@ -11680,6 +12811,43 @@ var ReactorBuilder = class {
 		return (await this.buildModule()).reactor;
 	}
 	async buildModule() {
+		this.assertStorageConfiguration();
+		const groupCommit = this.groupCommitPGlite ? createGroupCommitStorage(this.groupCommitPGlite) : void 0;
+		try {
+			return await this.assembleModule(groupCommit);
+		} catch (error) {
+			groupCommit?.restoreStatementSync();
+			throw error;
+		}
+	}
+	/** Refuses what would bypass the flush or leave a poison with no owner. */
+	assertStorageConfiguration() {
+		const options = this.groupCommitPGlite;
+		if (options === void 0) return;
+		if (typeof options.onUnrecoverable !== "function") throw new Error("withGroupCommitPGlite needs onUnrecoverable: a poisoned session is never reused, so without it the store stays wedged");
+		if (this.kyselyInstance !== void 0) throw new Error("withGroupCommitPGlite and withKysely are mutually exclusive: both supply the reactor's database");
+		if (this.workerPool !== void 0 || this.projectionShardConfig) throw new Error("withGroupCommitPGlite cannot be combined with withWorkerPool or withProjectionShards: those open their own Postgres connections and never see the embedded store or its flush");
+		if (this.executorManager !== void 0) throw new Error("withExecutor cannot be combined with withGroupCommitPGlite: only the executor this builder constructs flushes before announcing a job write-ready");
+		this.fitJobTimeoutToDurability(options);
+	}
+	/**
+	* A committed job waits for its flush, the statement in flight then one
+	* sync, and withholds past that wait. Statements before the commit queue
+	* behind the same flush, so the job timeout outlasts the wait too.
+	*/
+	fitJobTimeoutToDurability(options) {
+		const requested = this.executorConfig.durabilityWaitMs;
+		const durabilityWaitMs = requested ?? (options.dialect?.statementTimeoutMs ?? 12e4) + (options.client?.flushSyncTimeoutMs ?? 12e4);
+		if (!(Number.isFinite(durabilityWaitMs) && durabilityWaitMs > 0)) throw new Error(requested === void 0 ? `withGroupCommitPGlite needs a positive, finite durabilityWaitMs when its statement and flush sync bounds add up to ${durabilityWaitMs}: otherwise a committed job whose flush never lands waits forever` : `withGroupCommitPGlite needs a positive, finite durabilityWaitMs (got ${requested}): otherwise a committed job whose flush never lands waits forever`);
+		const configured = this.executorConfig.jobTimeoutMs;
+		if (configured !== void 0 && configured <= durabilityWaitMs) throw new Error(`jobTimeoutMs (${configured}) must exceed withGroupCommitPGlite's durability wait (${durabilityWaitMs}ms: statement + flush sync bounds): statements before a job's commit queue behind the same flush`);
+		this.executorConfig = {
+			...this.executorConfig,
+			durabilityWaitMs,
+			jobTimeoutMs: configured ?? durabilityWaitMs + 3e4
+		};
+	}
+	async assembleModule(groupCommit) {
 		if (!this.logger) this.logger = new ConsoleLogger(["reactor"]);
 		const featureFlags = resolveFeatureFlags(this.executorConfig.featureFlags);
 		if (this.executorConfig.protocolSupport === void 0) this.executorConfig = {
@@ -11688,6 +12856,7 @@ var ReactorBuilder = class {
 		};
 		if (this.channelScheme !== void 0 && this.syncBuilder !== void 0) throw new Error("withChannelScheme and withSync are mutually exclusive; use one (the scheme builds its own SyncBuilder)");
 		if (this.readModelCoordinator !== void 0 && this.readModelCoordinatorFactory !== void 0) throw new Error("withReadModelCoordinator and withReadModelCoordinatorFactory are mutually exclusive; register one coordinator source");
+		this.assertAdditionalChannelFactories();
 		if (this.projectionShardConfig !== void 0 && this.readModelCoordinatorFactory !== void 0) throw new Error("withProjectionShards and withReadModelCoordinatorFactory are mutually exclusive; the factory owns the projection worker through its createProjectionShardManager dependency");
 		if (this.projectionShardConfig !== void 0 && this.readModelFactories.length > 0) throw new Error("withProjectionShards does not support read models registered through withReadModelFactory; projection workers cannot receive host-only factory dependencies");
 		if (this.projectionShardConfig !== void 0 && this.readModels.length > 0) throw new Error("withProjectionShards does not support read models registered through withReadModel; projection workers build their own read models from the shard config and would silently omit these");
@@ -11712,11 +12881,13 @@ var ReactorBuilder = class {
 			for (const result of results) if (result.status === "error") this.logger.error("Failed to register document model: @error", result.error.message);
 		}
 		const reactorDbConfig = this.resolveReactorDbConfig();
-		const baseDatabase = this.kyselyInstance ?? (reactorDbConfig ? await this.createPostgresDatabase(reactorDbConfig) : await createDefaultDatabase());
+		const baseDatabase = this.kyselyInstance ?? groupCommit?.db ?? (reactorDbConfig ? await this.createPostgresDatabase(reactorDbConfig) : await createDefaultDatabase());
+		const storageFacts = this.storageFactsOverride ?? (this.kyselyInstance || groupCommit ? UNKNOWN_STORAGE_FACTS : reactorDbConfig ? POSTGRES_STORAGE_FACTS : IN_MEMORY_PGLITE_STORAGE_FACTS);
 		if (this.migrationStrategy === "auto") {
 			const result = await runMigrations(baseDatabase, REACTOR_SCHEMA);
 			if (!result.success && result.error) throw new Error(`Database migration failed: ${result.error.message}`);
 		}
+		await groupCommit?.flusher.flush();
 		await checkStoredProtocols(baseDatabase, REACTOR_SCHEMA, this.executorConfig.protocolSupport ?? {}, this.unsupportedStoredDocuments, this.logger);
 		const database = baseDatabase.withSchema(REACTOR_SCHEMA);
 		const operationStore = new KyselyOperationStore(database);
@@ -11773,7 +12944,7 @@ var ReactorBuilder = class {
 				executorManager = poolManager;
 				executorStartCount = pool.numWorkers;
 				if (resolver instanceof DocumentModelResolver) resolver.setBroadcastHook((entry) => poolManager.loadModel(entry));
-			} else executorManager = new SimpleJobExecutorManager(() => new SimpleJobExecutor(this.logger, documentModelRegistry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, this.driveContainerTypes, this.executorConfig, executionScope, this.signer, this.trustPolicy), eventBus, queue, jobTracker, this.logger, resolver, this.executorConfig.jobTimeoutMs, this.executorConfig.deferredJobTtlMs);
+			} else executorManager = new SimpleJobExecutorManager(() => new SimpleJobExecutor(this.logger, documentModelRegistry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, this.driveContainerTypes, this.executorConfig, executionScope, this.signer, this.trustPolicy, groupCommit?.flusher), eventBus, queue, jobTracker, this.logger, resolver, this.executorConfig.jobTimeoutMs, this.executorConfig.deferredJobTtlMs);
 		}
 		await executorManager.start(executorStartCount);
 		const callerReadModels = Array.from(/* @__PURE__ */ new Set([...this.readModels]));
@@ -11868,10 +13039,12 @@ var ReactorBuilder = class {
 		};
 		let syncModule = void 0;
 		if (this.channelScheme) {
-			const factory = this.channelScheme === "connect" ? new GqlRequestChannelFactory(this.logger, this.jwtHandler, queue) : new GqlResponseChannelFactory(this.logger);
-			syncModule = new SyncBuilder().withChannelFactory(factory).buildModule(reactor, this.logger, operationIndex, eventBus, database, this.driveContainerTypes, settledWatermark, localPeer);
+			const syncBuilder = new SyncBuilder().withChannelFactory(this.buildSchemeChannelFactory(this.channelScheme, this.logger, queue));
+			if (groupCommit) syncBuilder.withStorageFlusher(groupCommit.flusher);
+			syncModule = syncBuilder.buildModule(reactor, this.logger, operationIndex, eventBus, database, this.driveContainerTypes, settledWatermark, localPeer);
 			await syncModule.syncManager.startup();
 		} else if (this.syncBuilder) {
+			if (groupCommit) this.syncBuilder.withStorageFlusher(groupCommit.flusher);
 			syncModule = this.syncBuilder.buildModule(reactor, this.logger, operationIndex, eventBus, database, this.driveContainerTypes, settledWatermark, localPeer);
 			await syncModule.syncManager.startup();
 		}
@@ -11909,13 +13082,34 @@ var ReactorBuilder = class {
 			degradedComponents,
 			catchUp,
 			settledWatermark,
-			documentPurgeService: new DocumentPurgeService(queue, jobTracker, eventBus)
+			documentPurgeService: new DocumentPurgeService(queue, jobTracker, eventBus),
+			storageFacts: { ...storageFacts },
+			groupCommitStorage: groupCommit && {
+				health: groupCommit.health,
+				close: () => groupCommit.close()
+			}
 		};
 		catchUp.start();
 		if (degradedComponents.length > 0) this.logger.warn("Reactor started with @count degraded component(s): @components", degradedComponents.length, degradedComponents.map(({ component }) => component).join(", "));
 		if (this.signalHandlersEnabled) this.attachSignalHandlers(module);
 		return module;
 	}
+	assertAdditionalChannelFactories() {
+		if (this.additionalChannelFactories.size === 0) return;
+		if (!this.channelScheme) {
+			const types = [...this.additionalChannelFactories.keys()].join(", ");
+			throw new Error(`withAdditionalChannelFactory([${types}]) needs a withChannelScheme to compose with: without a scheme there is no factory to compose, and a withSync SyncBuilder owns its own. Pass a CompositeChannelFactory to that SyncBuilder instead.`);
+		}
+		const { type } = schemeChannelDescriptor(this.channelScheme);
+		if (this.additionalChannelFactories.has(type)) throw new Error(`withAdditionalChannelFactory("${type}", ...) collides with the "${this.channelScheme}" channel scheme, which already serves that channel type`);
+	}
+	/** Bare without additional factories, so an existing reactor routes as before. */
+	buildSchemeChannelFactory(scheme, logger, queue) {
+		const { type, create } = schemeChannelDescriptor(scheme);
+		const schemeFactory = create(logger, this.jwtHandler, queue);
+		if (this.additionalChannelFactories.size === 0) return schemeFactory;
+		return new CompositeChannelFactory([[type, schemeFactory], ...this.additionalChannelFactories]);
+	}
 	/**
 	* The single Postgres config for the parent, executor workers, and
 	* projection shards. They must share one physical database (the parent
@@ -11976,7 +13170,7 @@ var ReactorBuilder = class {
 			poolInstrumentations.push(forwarder);
 			this.instrumentedPools.push(forwarder);
 		}
-		const { ProjectionShardManager } = await import("./projection-shard-manager-CQ5FwQmv.js");
+		const { ProjectionShardManager } = await import("./projection-shard-manager-Drl9w8Eo.js");
 		const manager = new ProjectionShardManager({
 			shardCount: config.shardCount,
 			db,
@@ -12021,7 +13215,7 @@ var ReactorBuilder = class {
 	*/
 	async createDefaultWorkerFactory(numWorkers, db) {
 		const [{ WorkerHandle }, { createThreadTransport }, { workerEntryPath }] = await Promise.all([
-			import("./worker-handle-CN2-oRv-.js"),
+			import("./worker-handle-Nso8i5eU.js"),
 			import("./transport-CZDHzfvy.js"),
 			Promise.resolve().then(() => worker_exports)
 		]);
@@ -12178,6 +13372,9 @@ var HybridProjectionCoordinator = class {
 		else this.postReady.push(readModel);
 		this.readModels.push(readModel);
 	}
+	removeReadModel(readModel) {
+		return spliceReadModel(readModel, this.preReady, this.postReady, this.readModels);
+	}
 	getChainDepth() {
 		return this.manager.getChainDepth() + this.chains.size;
 	}
@@ -12214,11 +13411,7 @@ var HybridProjectionCoordinator = class {
 	async runHostBatch(event, enqueuedAt, reservations) {
 		const chainWaitDurationMs = performance.now() - enqueuedAt;
 		const preReadyStart = performance.now();
-		try {
-			await Promise.all(this.preReady.map((readModel) => this.indexWithTiming(readModel, "pre_ready", event, reservations)));
-		} catch (error) {
-			this.logger.error("Host pre-ready read model indexing failed for job @jobId: @Error", { jobId: event.jobId }, error);
-		}
+		await indexStage([...this.preReady], (readModel) => this.indexWithTiming(readModel, "pre_ready", event, reservations), (error) => this.logger.error("Host pre-ready read model indexing failed for job @jobId: @Error", { jobId: event.jobId }, error));
 		const preReadyDurationMs = performance.now() - preReadyStart;
 		const emitStart = performance.now();
 		try {
@@ -12228,11 +13421,7 @@ var HybridProjectionCoordinator = class {
 		}
 		const emitDurationMs = performance.now() - emitStart;
 		const postReadyStart = performance.now();
-		try {
-			await Promise.all(this.postReady.map((readModel) => this.indexWithTiming(readModel, "post_ready", event, reservations)));
-		} catch (error) {
-			this.logger.error("Host post-ready read model indexing failed for job @jobId: @Error", { jobId: event.jobId }, error);
-		}
+		await indexStage([...this.postReady], (readModel) => this.indexWithTiming(readModel, "post_ready", event, reservations), (error) => this.logger.error("Host post-ready read model indexing failed for job @jobId: @Error", { jobId: event.jobId }, error));
 		const postReadyDurationMs = performance.now() - postReadyStart;
 		this.emitBatchCompleted({
 			jobId: event.jobId,
@@ -12618,394 +13807,813 @@ function firstOutOfOrderPair(operations, options) {
 	}
 }
 //#endregion
-//#region src/storage/kysely/pglite-dialect.ts
-var pglite_dialect_exports = /* @__PURE__ */ __exportAll({
-	DEFAULT_LONG_STATEMENT_TIMEOUT_MS: () => DEFAULT_LONG_STATEMENT_TIMEOUT_MS,
-	DEFAULT_RECOVERY_TIMEOUT_MS: () => DEFAULT_RECOVERY_TIMEOUT_MS,
-	DEFAULT_STATEMENT_TIMEOUT_MS: () => DEFAULT_STATEMENT_TIMEOUT_MS,
-	HardenedPGliteDialect: () => HardenedPGliteDialect,
-	PGliteAbortedTransactionError: () => PGliteAbortedTransactionError,
-	PGliteAcquireTimeoutError: () => PGliteAcquireTimeoutError,
-	PGliteSessionError: () => PGliteSessionError,
-	PGliteSessionPoisonedError: () => PGliteSessionPoisonedError,
-	PGliteStatementTimeoutError: () => PGliteStatementTimeoutError,
-	isLongRunningStatement: () => isLongRunningStatement,
-	queryThroughDialect: () => queryThroughDialect
-});
-const DEFAULT_STATEMENT_TIMEOUT_MS = 12e4;
-const DEFAULT_LONG_STATEMENT_TIMEOUT_MS = 9e5;
-const DEFAULT_RECOVERY_TIMEOUT_MS = 15e3;
-const LONG_STATEMENT_PREFIXES = [
-	"vacuum",
-	"analyze",
-	"reindex",
-	"cluster",
-	"checkpoint",
-	"copy",
-	"alter ",
-	"create ",
-	"drop ",
-	"truncate",
-	"refresh "
-];
-/** Maintenance and DDL, matched on the leading keyword of the compiled SQL. */
-function isLongRunningStatement(statement) {
-	const normalized = statement.trimStart().toLowerCase();
-	return LONG_STATEMENT_PREFIXES.some((prefix) => normalized.startsWith(prefix));
+//#region src/read-models/interfaces.ts
+function supportsLiveReadModelRegistration(coordinator) {
+	return "addReadModel" in coordinator && typeof coordinator.addReadModel === "function" && "removeReadModel" in coordinator && typeof coordinator.removeReadModel === "function";
 }
-function summarize(statement) {
-	const collapsed = statement.replace(/\s+/g, " ").trim();
-	return collapsed.length > 160 ? `${collapsed.slice(0, 160)}...` : collapsed;
+//#endregion
+//#region src/sync/channels/channel-factory-types.ts
+/** The channel types a built factory declares; empty when it declares none. */
+function channelFactoryTypes(factory) {
+	return factory.channelTypes ?? [];
 }
-/** COMMIT in an aborted transaction silently rolls back; the guard raises first. */
-const COMMIT_WITH_GUARD = "select 1 as __commit_guard; commit";
-const PROBE = "select 1 as __session_probe";
-const ABORTED_TRANSACTION_CODE = "25P02";
-var PGliteSessionError = class extends Error {
-	cause;
-	constructor(message, cause) {
-		super(message);
-		this.cause = cause;
-		this.name = "PGliteSessionError";
-	}
-};
-var PGliteAcquireTimeoutError = class extends PGliteSessionError {
-	constructor(timeoutMs) {
-		super(`Timed out after ${timeoutMs}ms waiting for the PGlite connection. The single session is held by a statement that never completed: a transaction awaiting a nested query on the base handle, or an abandoned stream iterator.`);
-		this.name = "PGliteAcquireTimeoutError";
-	}
-};
-/** The call cannot be aborted, so it is abandoned and the session treated as poisoned. */
-var PGliteStatementTimeoutError = class extends PGliteSessionError {
-	constructor(timeoutMs, statement) {
-		super(`A PGlite statement neither resolved nor rejected within ${timeoutMs}ms, so its wasm call is presumed dead and the session poisoned: ${summarize(statement)}`);
-		this.name = "PGliteStatementTimeoutError";
+//#endregion
+//#region src/sync/channels/local-wire.ts
+/**
+* Whether a received value is a well-formed wire message.
+*
+* A push is validated down to what `envelopesToSyncOperations` dereferences:
+* each envelope's `channelMeta.id` and, per operation, the `operation.action`
+* and the `context` fields it batches on.
+*/
+function isLocalWireMessage(data) {
+	if (!isObject(data)) return false;
+	const kind = data.kind;
+	if (kind === "push") return Array.isArray(data.envelopes) && data.envelopes.every(isEnvelope);
+	return kind === "hello" || kind === "ack" || kind === "resend";
+}
+function isObject(value) {
+	return typeof value === "object" && value !== null;
+}
+function isEnvelope(envelope) {
+	if (!isObject(envelope)) return false;
+	if (!isObject(envelope.channelMeta)) return false;
+	if (typeof envelope.channelMeta.id !== "string") return false;
+	const operations = envelope.operations;
+	return operations === void 0 || operations === null || Array.isArray(operations) && operations.every(isWireOperation);
+}
+function isWireOperation(entry) {
+	if (!isObject(entry)) return false;
+	const { operation, context } = entry;
+	return isObject(operation) && isObject(operation.action) && isObject(context) && typeof context.documentId === "string" && typeof context.scope === "string" && typeof context.branch === "string" && typeof context.ordinal === "number";
+}
+//#endregion
+//#region src/sync/channels/local-channel.ts
+/** Base delay for the backoff that re-pushes after a transient transport fault. */
+const PUSH_RETRY_BASE_DELAY_MS = 500;
+/** Ceiling for that backoff. */
+const PUSH_RETRY_MAX_DELAY_MS = 3e4;
+/**
+* A symmetric, push-capable synchronization channel between two reactors over a
+* message port.
+*
+* Unlike the gql channels -- one polls and pushes over HTTP, the other never
+* initiates and is filled by resolvers -- a LocalChannel is peer-to-peer: either
+* side may push envelopes to the other at any time, with no GraphQL, no HTTP and
+* no Switchboard. It is the productionized sibling of the test channel: a real
+* wire protocol over an injected {@link LocalChannelPort}, the peer-manifest
+* handshake wired into the sync manager, cursor persistence, and ACK-driven
+* outbox trimming.
+*
+* The inbox holds its ack below unapplied purge markers, as the gql channels'
+* inboxes do.
+*/
+var LocalChannel = class {
+	inbox;
+	outbox;
+	deadLetter;
+	logger;
+	channelId;
+	remoteName;
+	cursorStorage;
+	port;
+	collectionId;
+	filter;
+	isShutdown = false;
+	unsubscribeTransport;
+	localManifestProvider;
+	/** Undefined until the first handshake; null for a peer that announces nothing. */
+	peerManifest = void 0;
+	peerManifestCallbacks = /* @__PURE__ */ new Set();
+	connectionState = "connecting";
+	/** Whether any valid frame has arrived since init. */
+	heardPeer = false;
+	failureCount = 0;
+	lastSuccessUtcMs;
+	lastFailureUtcMs;
+	/** The highest inbox ack already reported to the peer; only an advance re-posts. */
+	lastPostedAckOrdinal = 0;
+	pushFailureCount = 0;
+	pushRetryTimer;
+	connectionStateCallbacks = /* @__PURE__ */ new Set();
+	cursorWriters = {
+		inbox: {
+			persisted: 0,
+			requested: 0,
+			tail: Promise.resolve()
+		},
+		outbox: {
+			persisted: 0,
+			requested: 0,
+			tail: Promise.resolve()
+		}
+	};
+	constructor(logger, channelId, remoteName, cursorStorage, port, collectionId, filter) {
+		this.logger = logger;
+		this.channelId = channelId;
+		this.remoteName = remoteName;
+		this.cursorStorage = cursorStorage;
+		this.port = port;
+		this.collectionId = collectionId;
+		this.filter = filter;
+		this.inbox = new Mailbox({ holdAckBelowMarkers: true });
+		this.outbox = new Mailbox();
+		this.deadLetter = new Mailbox();
+		this.outbox.onAdded((added) => this.onOutboxAdded(added));
+		this.outbox.onRemoved((syncOps) => this.onOutboxRemoved(syncOps));
+		this.inbox.onRemoved(() => this.onInboxRemoved());
 	}
-};
-var PGliteAbortedTransactionError = class extends PGliteSessionError {
-	constructor(cause) {
-		super(`Refusing to report a commit for an aborted transaction: COMMIT would have been answered with a ROLLBACK tag and nothing written. Underlying error: ${errorOf(cause).message}`, cause);
-		this.name = "PGliteAbortedTransactionError";
+	/**
+	* Loads the persisted cursors and initialises both mailboxes BEFORE
+	* subscribing to the transport, so no inbound message is ever processed
+	* against a zeroed mailbox. A frame processed before `inbox.init` runs would
+	* be added below an ack of 0, and the init that followed would overwrite the
+	* ack while leaving that frame pinning the floor -- dragging the live ack
+	* below the durable cursor and re-loading already-applied ops as fresh jobs.
+	*
+	* Loading first relies on the port holding frames until a listener attaches.
+	* A `LocalChannelPortRegistry` port does: it keeps one listener on the
+	* raw port for its whole registration and replays, in order, what arrived
+	* while no channel was attached. A raw browser MessagePort handed straight to
+	* a channel does not once started, so a frame arriving between a shutdown
+	* and the next init on it is lost.
+	*/
+	async init() {
+		const cursors = await this.cursorStorage.list(this.remoteName);
+		if (this.isShutdown) return;
+		const inboxOrdinal = cursors.find((c) => c.cursorType === "inbox")?.cursorOrdinal ?? 0;
+		const outboxOrdinal = cursors.find((c) => c.cursorType === "outbox")?.cursorOrdinal ?? 0;
+		this.inbox.init(inboxOrdinal);
+		this.outbox.init(outboxOrdinal);
+		this.cursorWriters.inbox.persisted = inboxOrdinal;
+		this.cursorWriters.outbox.persisted = outboxOrdinal;
+		this.lastPostedAckOrdinal = inboxOrdinal;
+		this.unsubscribeTransport = this.port.onMessage((data) => this.receive(data));
+		this.sendHello(false);
 	}
-};
-/** No statement can clear the session (e.g. a stuck active portal). */
-var PGliteSessionPoisonedError = class extends PGliteSessionError {
-	constructor(cause) {
-		super(`The PGlite session is unrecoverable and cannot be reused; the component owning it must be restarted. Original error: ${errorOf(cause).message}`, cause);
-		this.name = "PGliteSessionPoisonedError";
+	/** Leaves the port open: whoever registered it closes it. */
+	async shutdown() {
+		this.isShutdown = true;
+		this.clearPushRetry();
+		this.unsubscribeTransport?.();
+		this.unsubscribeTransport = void 0;
+		this.transitionConnectionState("disconnected");
+		return Promise.resolve();
 	}
-};
-function errorOf(error) {
-	return error instanceof Error ? error : new Error(String(error));
-}
-const TIMED_OUT = Symbol("pglite-deadline-expired");
-/** Races a call that cannot be cancelled; on {@link TIMED_OUT} the call may still settle later. */
-async function withDeadline(pending, timeoutMs) {
-	let handle;
-	const expiry = new Promise((resolve) => {
-		handle = setTimeout(() => resolve(TIMED_OUT), timeoutMs);
-	});
-	try {
-		return await Promise.race([pending, expiry]);
-	} finally {
-		clearTimeout(handle);
+	getConnectionState() {
+		return {
+			state: this.connectionState,
+			failureCount: this.failureCount,
+			lastSuccessUtcMs: this.lastSuccessUtcMs ?? 0,
+			lastFailureUtcMs: this.lastFailureUtcMs ?? 0,
+			pushBlocked: this.pushRetryTimer !== void 0,
+			pushFailureCount: this.pushFailureCount,
+			receivingPages: false,
+			requiresAuth: false
+		};
 	}
-}
-function isAbortedTransactionError(error) {
-	if (error?.code === ABORTED_TRANSACTION_CODE) return true;
-	return errorOf(error).message.includes("current transaction is aborted");
-}
-/** `kysely-pglite-dialect` hardened for one shared session that a fault must not brick. */
-var HardenedPGliteDialect = class {
-	client;
-	inner;
-	options;
-	constructor(client, options = {}) {
-		this.client = client;
-		this.inner = new PGliteDialect(client);
-		this.options = {
-			acquireTimeoutMs: options.acquireTimeoutMs ?? 0,
-			statementTimeoutMs: options.statementTimeoutMs ?? 12e4,
-			longStatementTimeoutMs: options.longStatementTimeoutMs ?? 9e5,
-			recoveryTimeoutMs: options.recoveryTimeoutMs ?? 15e3,
-			onDiagnostic: options.onDiagnostic ?? ((message, error) => {
-				console.error(`[pglite-dialect] ${message}`, error);
-			}),
-			onPoisoned: options.onPoisoned ?? (() => void 0)
+	onConnectionStateChange(callback) {
+		this.connectionStateCallbacks.add(callback);
+		return () => {
+			this.connectionStateCallbacks.delete(callback);
+		};
+	}
+	/**
+	* A push transport has nothing to poll, so this asks the peer to re-push
+	* whatever it still holds unacked for this side, from this side's inbox ack.
+	*/
+	triggerPull() {
+		if (this.isShutdown) return;
+		this.post({
+			kind: "resend",
+			channelId: this.channelId,
+			sinceOrdinal: this.inbox.ackOrdinal
+		});
+	}
+	/** This channel pushes to its peer; it has no holder to hear from. */
+	notePoll() {}
+	/** No holder, so nothing this channel reports may strand one. */
+	lastHolderPollUtcMs() {}
+	setLocalManifest(provider) {
+		this.localManifestProvider = provider;
+	}
+	onPeerManifest(callback) {
+		this.peerManifestCallbacks.add(callback);
+		return () => {
+			this.peerManifestCallbacks.delete(callback);
 		};
 	}
-	createAdapter() {
-		return this.inner.createAdapter();
+	/** Pushes freshly added outbox items that have not since been removed. */
+	onOutboxAdded(added) {
+		if (this.isShutdown) return;
+		const syncOps = added.filter((op) => this.outbox.get(op.id) === op);
+		if (syncOps.length > 0) this.pushOutbox(syncOps);
 	}
-	createDriver() {
-		return new HardenedPGliteDriver(this.inner.createDriver(), this.client, this.options);
+	/**
+	* Persists the outbox cursor from the applied ordinal of what was removed,
+	* clamped below the lowest ordinal still in flight. Items for different
+	* documents apply out of order, so the highest applied ordinal can pass one
+	* still unacked; a restart from it would skip that one.
+	*/
+	onOutboxRemoved(syncOps) {
+		const ordinal = Math.min(getLatestAppliedOrdinal(syncOps), this.unappliedOutboxFloor() - 1);
+		this.persistCursor("outbox", ordinal);
 	}
-	createQueryCompiler() {
-		return this.inner.createQueryCompiler();
+	/**
+	* Persists the inbox ack and reports it to the peer so it trims its outbox.
+	* The ack is posted only when it strictly advances, so a burst of removals
+	* that does not move the floor does not flood the peer with duplicate acks.
+	*/
+	onInboxRemoved() {
+		const ackOrdinal = this.inbox.ackOrdinal;
+		this.persistCursor("inbox", ackOrdinal);
+		if (ackOrdinal > this.lastPostedAckOrdinal) this.postAck();
 	}
-	createIntrospector(db) {
-		return this.inner.createIntrospector(db);
+	/** Unconditional, so a peer re-pushing what this side applied can trim. */
+	postAck() {
+		const ackOrdinal = this.inbox.ackOrdinal;
+		this.lastPostedAckOrdinal = Math.max(this.lastPostedAckOrdinal, ackOrdinal);
+		this.post({
+			kind: "ack",
+			channelId: this.channelId,
+			ackOrdinal
+		});
 	}
-};
-var HardenedPGliteConnection = class {
-	inner;
-	guard;
-	failure = void 0;
-	rollbackFailure = void 0;
-	transactionOpen = false;
-	constructor(inner, guard) {
-		this.inner = inner;
-		this.guard = guard;
+	receive(data) {
+		if (this.isShutdown) return;
+		if (!isLocalWireMessage(data)) {
+			this.recordFailure(/* @__PURE__ */ new Error("LocalChannel received a malformed wire message"));
+			return;
+		}
+		this.heardPeer = true;
+		this.markSuccess();
+		this.transitionConnectionState("connected");
+		switch (data.kind) {
+			case "hello":
+				this.receiveHello(data);
+				return;
+			case "push":
+				this.receivePush(data);
+				return;
+			case "ack":
+				if (data.ackOrdinal > 0) trimMailboxFromAckOrdinal(this.outbox, data.ackOrdinal);
+				return;
+			case "resend":
+				this.receiveResend(data);
+				return;
+		}
 	}
-	/** Never retried: a replay could commit alone a write meant for another consumer's transaction. */
-	async executeQuery(compiledQuery) {
-		const generation = this.guard.generation;
+	/**
+	* A HELLO's sinceOrdinal is the peer's inbox ack, so the outbox is trimmed to
+	* it exactly as an ACK would, letting a reconnect resume without re-serving
+	* applied ops. An opening hello then re-pushes the remaining unacked items in
+	* case the peer reconnected and lost them. A reply does not: it answers this
+	* side's own opening, so the peer did not reset, and re-pushing would hand
+	* it every unacked op a second time.
+	*/
+	receiveHello(message) {
+		if (message.sinceOrdinal > 0) trimMailboxFromAckOrdinal(this.outbox, message.sinceOrdinal);
+		if (!message.reply) this.sendHello(true);
+		this.hearPeer(message.manifest);
+		if (!message.reply) this.rePushUnacked();
+	}
+	/**
+	* Ingests a push into the inbox, dropping operations the inbox has already
+	* acked. A reconnecting peer may re-push durable ops before it hears this
+	* side's ack; adding one back as a fresh sync job would transiently drag the
+	* ack floor below the persisted cursor, so a batch entirely at or below the
+	* ack is skipped, and the ack is posted again so the peer can trim them. A
+	* frame {@link isLocalWireMessage} rejects never reaches here; one that still
+	* fails conversion is recorded as a failure.
+	*/
+	receivePush(message) {
+		const ackFloor = this.inbox.ackOrdinal;
+		const syncOps = [];
+		let dropped = false;
+		let converted;
 		try {
-			return await this.guard.runStatement(compiledQuery.sql, () => this.inner.executeQuery(compiledQuery));
+			converted = message.envelopes.flatMap((envelope) => envelopesToSyncOperations(envelope, this.remoteName));
 		} catch (error) {
-			this.guard.recordFailure(this, generation, error);
-			throw error;
+			this.recordFailure(error instanceof Error ? error : new Error(String(error)));
+			return;
 		}
-	}
-	streamQuery(compiledQuery, chunkSize) {
-		const inner = this.inner.streamQuery(compiledQuery, chunkSize);
-		return this.deadlinedStream(compiledQuery, inner);
-	}
-	/** Upstream issues the whole query on the first pull, so each pull is bounded like a statement. */
-	async *deadlinedStream(compiledQuery, inner) {
-		for (;;) {
-			const generation = this.guard.generation;
-			let next;
-			try {
-				next = await this.guard.runStatement(compiledQuery.sql, () => inner.next());
-			} catch (error) {
-				this.guard.recordFailure(this, generation, error);
-				throw error;
+		for (const syncOp of converted) {
+			if (this.highestOrdinal(syncOp) <= ackFloor) {
+				dropped = true;
+				continue;
 			}
-			if (next.done === true) return;
-			yield next.value;
+			syncOp.transported();
+			syncOps.push(syncOp);
+		}
+		if (dropped) this.postAck();
+		if (syncOps.length === 0) return;
+		try {
+			this.inbox.add(...syncOps);
+		} catch (error) {
+			this.recordFailure(error instanceof Error ? error : new Error(String(error)));
 		}
 	}
-	get suspect() {
-		return this.failure !== void 0 || this.rollbackFailure !== void 0 || this.transactionOpen;
+	receiveResend(message) {
+		if (message.sinceOrdinal > 0) trimMailboxFromAckOrdinal(this.outbox, message.sinceOrdinal);
+		this.rePushUnacked();
 	}
-};
-var HardenedPGliteDriver = class {
-	inner;
-	client;
-	options;
-	/** Set when release could not reset the session; each acquire retries the reset. */
-	sessionFault = void 0;
-	/** Lets an abandoned call's late settlement be told apart from current failures. */
-	statementGeneration = 0;
-	/** A call abandoned at its deadline; PGlite would queue every later call behind it, so none is issued. */
-	deadCall = void 0;
-	poisonReported = false;
-	constructor(inner, client, options) {
-		this.inner = inner;
-		this.client = client;
-		this.options = options;
+	sendHello(reply) {
+		this.post({
+			kind: "hello",
+			channelId: this.channelId,
+			collectionId: this.collectionId.key,
+			filter: this.filter,
+			sinceOrdinal: this.inbox.ackOrdinal,
+			manifest: this.localManifestProvider?.() ?? null,
+			...reply ? { reply } : {}
+		});
 	}
-	get generation() {
-		return this.statementGeneration;
+	/**
+	* Pushes the given outbox items to the peer, marking them in flight.
+	*
+	* A transport throw is classified rather than treated as terminal: only a
+	* structured-clone failure, which recurs identically on every retry, dead-
+	* letters its ops. Any other fault is transient -- the port is momentarily
+	* unusable -- so the ops stay in the outbox and {@link handlePushFailure}
+	* schedules a backoff re-push, keeping behaviour in step with the gql
+	* sibling's recoverable/unrecoverable split.
+	*/
+	pushOutbox(syncOps) {
+		if (this.isShutdown || syncOps.length === 0) return;
+		for (const syncOp of syncOps) syncOp.started();
+		try {
+			this.port.postMessage({
+				kind: "push",
+				channelId: this.channelId,
+				envelopes: this.envelopesFor(syncOps)
+			});
+		} catch (error) {
+			this.handlePushFailure(syncOps, error instanceof Error ? error : new Error(String(error)));
+			return;
+		}
+		this.clearPushRetry();
+		if (this.heardPeer) {
+			this.markSuccess();
+			this.transitionConnectionState("connected");
+		} else this.transitionConnectionState("connecting");
 	}
-	/** Bounds one statement; an expiry is escalated as a poisoned session. */
-	async runStatement(statement, execute) {
-		if (this.deadCall !== void 0) throw new PGliteSessionPoisonedError(this.deadCall);
-		const timeoutMs = this.timeoutFor(statement);
-		if (timeoutMs <= 0) return execute();
-		const generation = this.statementGeneration;
-		const outcome = await withDeadline(execute(), timeoutMs);
-		if (outcome !== TIMED_OUT) return outcome;
-		throw this.escalateHungStatement(new PGliteStatementTimeoutError(timeoutMs, statement), generation);
+	/** Re-pushes every outbox item the peer has not acknowledged. */
+	rePushUnacked() {
+		if (this.isShutdown) return;
+		const unacked = this.outbox.items.filter((syncOp) => syncOp.status !== 2);
+		this.pushOutbox(unacked);
+	}
+	/**
+	* Routes a push transport failure: a structured-clone (`DataCloneError`)
+	* failure is unrecoverable and dead-letters its ops; any other error is a
+	* transient transport fault, so the ops are left in the outbox to be
+	* re-pushed by the backoff retry and by the next hello/resend recovery.
+	*/
+	handlePushFailure(syncOps, error) {
+		if (this.classifyPostError(error) === "unrecoverable") {
+			const channelError = new ChannelError("outbox", error);
+			for (const syncOp of syncOps) syncOp.failed(channelError);
+			this.deadLetter.add(...syncOps);
+			this.outbox.remove(...syncOps);
+			this.recordFailure(error);
+			return;
+		}
+		this.recordFailure(error);
+		this.schedulePushRetry();
 	}
-	recordFailure(connection, generation, error) {
-		if (generation === this.statementGeneration) connection.failure = errorOf(error);
+	/** A structured-clone failure cannot self-heal; every other fault can. */
+	classifyPostError(error) {
+		return error.name === "DataCloneError" ? "unrecoverable" : "recoverable";
 	}
-	async init() {
-		await this.inner.init();
+	/** Schedules a single backoff re-push of the unacked outbox. */
+	schedulePushRetry() {
+		if (this.isShutdown || this.pushRetryTimer !== void 0) return;
+		const delay = calculateBackoffDelay(this.pushFailureCount, PUSH_RETRY_BASE_DELAY_MS, PUSH_RETRY_MAX_DELAY_MS, Math.random());
+		this.pushFailureCount++;
+		this.pushRetryTimer = setTimeout(() => {
+			this.pushRetryTimer = void 0;
+			this.rePushUnacked();
+		}, delay);
 	}
-	async acquireConnection() {
-		const innerConnection = await this.acquireWithTimeout();
-		if (this.deadCall !== void 0) {
-			await this.inner.releaseConnection(innerConnection);
-			throw new PGliteSessionPoisonedError(this.deadCall);
+	/** Clears the backoff state once a push lands or the channel stops. */
+	clearPushRetry() {
+		this.pushFailureCount = 0;
+		if (this.pushRetryTimer !== void 0) {
+			clearTimeout(this.pushRetryTimer);
+			this.pushRetryTimer = void 0;
 		}
-		if (this.sessionFault !== void 0) {
-			const fault = this.sessionFault;
-			let recovered = false;
-			try {
-				recovered = await this.tryRecoverSession(false);
-			} finally {
-				if (!recovered) await this.inner.releaseConnection(innerConnection);
+	}
+	/** One envelope per SyncOperation, with key/dependsOn for batch ordering. */
+	envelopesFor(syncOps) {
+		const jobIdToKeys = /* @__PURE__ */ new Map();
+		const envelopes = [];
+		for (let i = 0; i < syncOps.length; i++) {
+			const syncOp = syncOps[i];
+			const key = String(i);
+			if (syncOp.jobId) {
+				const keys = jobIdToKeys.get(syncOp.jobId) ?? [];
+				keys.push(key);
+				jobIdToKeys.set(syncOp.jobId, keys);
 			}
-			if (!recovered) {
-				this.reportPoisoned(fault);
-				throw new PGliteSessionPoisonedError(fault);
+			const dependsOn = [];
+			for (const dep of syncOp.jobDependencies) {
+				const depKeys = jobIdToKeys.get(dep);
+				if (depKeys) dependsOn.push(...depKeys);
 			}
-			this.sessionFault = void 0;
+			envelopes.push({
+				type: "operations",
+				channelMeta: { id: this.channelId },
+				operations: syncOp.operations,
+				key,
+				dependsOn
+			});
 		}
-		return new HardenedPGliteConnection(innerConnection, this);
+		return envelopes.map((envelope) => serializeEnvelope(envelope));
 	}
-	/** Kysely never rolls back after a failed BEGIN, so an aborted session is reset here. */
-	async beginTransaction(connection, settings) {
-		const wrapper = asWrapper(connection);
-		const generation = this.statementGeneration;
-		try {
-			await this.runStatement("begin", () => this.inner.beginTransaction(wrapper.inner, settings));
-		} catch (error) {
-			this.recordFailure(wrapper, generation, error);
-			if (!isAbortedTransactionError(error)) throw error;
-			if (!await this.tryRecoverSession(false)) {
-				this.sessionFault = errorOf(error);
-				throw error;
-			}
-			const retryGeneration = this.statementGeneration;
+	/**
+	* Hears the peer's manifest, deduped like the gql channel: an older or
+	* identical revision is ignored, so a reconnect that re-announces the same
+	* manifest does not re-run the sync manager's hold reconciliation.
+	*/
+	async hearPeer(manifest) {
+		if (this.peerManifest !== void 0 && (this.peerManifest?.revision ?? null) === (manifest?.revision ?? null) || isOlderManifest(manifest, this.peerManifest)) return;
+		this.peerManifest = manifest;
+		await Promise.all([...this.peerManifestCallbacks].map(async (callback) => {
 			try {
-				await this.runStatement("begin", () => this.inner.beginTransaction(wrapper.inner, settings));
-			} catch (retryError) {
-				this.recordFailure(wrapper, retryGeneration, retryError);
-				throw retryError;
+				await callback(manifest);
+			} catch (error) {
+				this.logger.error("LocalChannel @ChannelId peer manifest callback error: @Error", this.channelId, error);
 			}
-			wrapper.failure = void 0;
-		}
-		wrapper.transactionOpen = true;
+		}));
 	}
-	async commitTransaction(connection) {
-		const wrapper = asWrapper(connection);
-		const generation = this.statementGeneration;
+	/** Sends a message, returning whether the transport accepted it. */
+	post(message) {
+		if (this.isShutdown) return false;
 		try {
-			await this.runStatement(COMMIT_WITH_GUARD, () => this.client.exec(COMMIT_WITH_GUARD));
+			this.port.postMessage(message);
+			return true;
 		} catch (error) {
-			this.recordFailure(wrapper, generation, error);
-			if (isAbortedTransactionError(error)) throw new PGliteAbortedTransactionError(error);
-			throw error;
+			this.recordFailure(error instanceof Error ? error : new Error(String(error)));
+			return false;
 		}
-		wrapper.transactionOpen = false;
-		wrapper.failure = void 0;
 	}
-	/** Swallowed so the original failure propagates; release resets the session. */
-	async rollbackTransaction(connection) {
-		const wrapper = asWrapper(connection);
-		const generation = this.statementGeneration;
-		try {
-			await this.runStatement("rollback", () => this.inner.rollbackTransaction(wrapper.inner));
-			wrapper.transactionOpen = false;
+	/** Leaves the push retry alone: only a push that lands clears it. */
+	markSuccess() {
+		this.lastSuccessUtcMs = Date.now();
+		this.failureCount = 0;
+	}
+	recordFailure(error) {
+		this.failureCount++;
+		this.lastFailureUtcMs = Date.now();
+		this.logger.error("LocalChannel @ChannelId transport error (@FailureCount): @Error", this.channelId, this.failureCount, error);
+		this.transitionConnectionState("error");
+	}
+	transitionConnectionState(next) {
+		if (this.connectionState === next) return;
+		this.connectionState = next;
+		const snapshot = this.getConnectionState();
+		for (const callback of this.connectionStateCallbacks) try {
+			callback(snapshot);
 		} catch (error) {
-			if (generation === this.statementGeneration) wrapper.rollbackFailure = errorOf(error);
-			this.options.onDiagnostic("rollback failed; preserving the original failure and recovering the session on release", error);
+			this.logger.error("LocalChannel @ChannelId connection state callback error: @Error", this.channelId, error);
 		}
 	}
-	async releaseConnection(connection) {
-		const wrapper = asWrapper(connection);
-		try {
-			if (wrapper.suspect && this.deadCall === void 0) {
-				if (!await this.tryRecoverSession(wrapper.transactionOpen)) {
-					this.sessionFault = wrapper.rollbackFailure ?? wrapper.failure ?? /* @__PURE__ */ new Error("session left in a transaction");
-					this.options.onDiagnostic("the PGlite session could not be reset and is being marked unrecoverable", this.sessionFault);
-				}
+	/** The greatest operation ordinal a sync op carries, or 0 when it carries none. */
+	highestOrdinal(syncOp) {
+		let highest = 0;
+		for (const op of syncOp.operations) if (op.context.ordinal > highest) highest = op.context.ordinal;
+		return highest;
+	}
+	/** The lowest ordinal of an outbox item the peer has not applied. */
+	unappliedOutboxFloor() {
+		let floor = Number.POSITIVE_INFINITY;
+		for (const syncOp of this.outbox.items) {
+			if (syncOp.status === 2) continue;
+			for (const op of syncOp.operations) {
+				const ordinal = op.context.ordinal;
+				if (ordinal > 0 && ordinal < floor) floor = ordinal;
 			}
-		} finally {
-			await this.inner.releaseConnection(wrapper.inner);
 		}
+		return floor;
 	}
-	async destroy() {
-		await this.inner.destroy();
+	/**
+	* Advances a persisted cursor only once the write has landed, and never with
+	* two writes for the same row outstanding. See the gql request channel for
+	* the full argument: concurrent writers for one row are last-writer-wins, and
+	* the storage promises no FIFO, so a burst of removals is coalesced into one
+	* ordered write rather than a race.
+	*/
+	persistCursor(cursorType, ordinal) {
+		const writer = this.cursorWriters[cursorType];
+		if (ordinal <= Math.max(writer.persisted, writer.requested)) return;
+		writer.requested = ordinal;
+		writer.tail = writer.tail.then(() => this.writeCursor(cursorType));
 	}
-	reportPoisoned(cause) {
-		if (this.poisonReported) return;
-		this.poisonReported = true;
+	/** One link of a cursor write chain; never rejects, so the chain survives. */
+	async writeCursor(cursorType) {
+		const writer = this.cursorWriters[cursorType];
+		const ordinal = writer.requested;
+		if (ordinal <= writer.persisted) return;
+		writer.requested = 0;
 		try {
-			this.options.onPoisoned(cause);
+			await this.cursorStorage.upsert({
+				remoteName: this.remoteName,
+				cursorType,
+				cursorOrdinal: ordinal,
+				lastSyncedAtUtcMs: Date.now()
+			});
 		} catch (error) {
-			this.options.onDiagnostic("onPoisoned threw", error);
+			this.logger.error("LocalChannel @ChannelId failed to persist @CursorType cursor at @Ordinal; the watermark stays put so the next advance retries it: @Error", this.channelId, cursorType, ordinal, error);
+			return;
 		}
+		writer.persisted = Math.max(writer.persisted, ordinal);
 	}
-	timeoutFor(statement) {
-		return isLongRunningStatement(statement) ? this.options.longStatementTimeoutMs : this.options.statementTimeoutMs;
+};
+//#endregion
+//#region src/sync/channels/local-channel-factory.ts
+/** The {@link ChannelConfig.type} a LocalChannel is created from. */
+const LOCAL_CHANNEL_TYPE = "local";
+/**
+* Factory for {@link LocalChannel} instances.
+*
+* The channel's config is `{ type: "local", parameters: { peerId, channelName } }`
+* -- no url, because there is no server. The factory does not take a port
+* directly: {@link IChannelFactory.instance} has no seam for a live object, and
+* a MessagePort is not clone-safe config that could ride in `parameters`.
+* Instead the factory holds a {@link LocalChannelTransportProvider} and resolves
+* the port from the (peerId, channelName) the config names. W1.2 supplies a real
+* brokered MessagePort by registering it with the provider under that key, with
+* no change to the channel or this factory.
+*/
+var LocalChannelFactory = class {
+	channelTypes = [LOCAL_CHANNEL_TYPE];
+	logger;
+	transportProvider;
+	constructor(logger, transportProvider) {
+		this.logger = logger;
+		this.transportProvider = transportProvider;
+	}
+	instance(remoteId, remoteName, config, cursorStorage, collectionId, filter, _operationIndex, _options) {
+		if (config.type !== "local") throw new Error(`This reactor has no "${config.type}" channel factory: it is provisioned local-only, and LocalChannelFactory builds only "${LOCAL_CHANNEL_TYPE}" channels`);
+		const peerId = config.parameters.peerId;
+		if (typeof peerId !== "string" || !peerId) throw new Error("LocalChannelFactory requires a non-empty \"peerId\" string in config.parameters");
+		const channelName = config.parameters.channelName;
+		if (typeof channelName !== "string" || !channelName) throw new Error("LocalChannelFactory requires a non-empty \"channelName\" string in config.parameters");
+		const port = this.transportProvider(peerId, channelName);
+		if (!port) throw new Error(`LocalChannelFactory has no transport for peer '${peerId}' channel '${channelName}'`);
+		return new LocalChannel(this.logger, remoteId, remoteName, cursorStorage, port, collectionId, filter);
 	}
-	/** Marks the session faulted once per generation; a stale expiry reports only itself. */
-	escalateHungStatement(cause, generation) {
-		if (generation !== this.statementGeneration) return cause;
-		this.statementGeneration += 1;
-		this.deadCall = cause;
-		this.reportPoisoned(cause);
-		this.options.onDiagnostic("a PGlite statement never settled within its deadline; treating the session as poisoned", cause);
-		return new PGliteSessionPoisonedError(cause);
+};
+//#endregion
+//#region src/sync/channels/local-channel-registry.ts
+const DEFAULT_MAX_QUEUED_FRAMES = 1024;
+function frameKind(data) {
+	return typeof data === "object" && data !== null ? data.kind : void 0;
+}
+/**
+* The port a channel sees. It holds the registry's one listener on the raw port
+* for the whole registration, so a frame that arrives between two channels
+* (a reset) is queued and replayed to the next one instead of lost.
+*
+* Past the bound, every queued push is discarded, and so is every later one
+* until a channel is attached and hears a live hello: the inbox ack is the
+* highest applied ordinal, so delivering pushes after a gap would ack past the
+* missing ones. The peer still holds them unacked and re-pushes them right
+* after the hello it answers the fresh channel's hello with, or after its own
+* opening hello's backfill.
+*/
+var RegisteredPort = class {
+	raw;
+	label;
+	logger;
+	maxQueuedFrames;
+	subscriber;
+	queued = [];
+	discardingPushes = false;
+	detachRaw;
+	constructor(raw, label, logger, maxQueuedFrames) {
+		this.raw = raw;
+		this.label = label;
+		this.logger = logger;
+		this.maxQueuedFrames = maxQueuedFrames;
+		this.detachRaw = raw.onMessage((data) => this.dispatch(data));
 	}
-	/** A waiter that gave up still passes the lease on, so it cannot wedge the queue. */
-	async acquireWithTimeout() {
-		const timeoutMs = this.options.acquireTimeoutMs;
-		if (timeoutMs <= 0) return this.inner.acquireConnection();
-		let abandoned = false;
-		const pending = this.inner.acquireConnection().then((connection) => {
-			if (!abandoned) return connection;
-			this.inner.releaseConnection(connection).catch(() => void 0);
-			throw new PGliteAcquireTimeoutError(timeoutMs);
-		});
-		let handle;
-		const expiry = new Promise((_resolve, reject) => {
-			handle = setTimeout(() => {
-				abandoned = true;
-				reject(new PGliteAcquireTimeoutError(timeoutMs));
-			}, timeoutMs);
-		});
-		try {
-			return await Promise.race([pending, expiry]);
-		} finally {
-			clearTimeout(handle);
-		}
+	postMessage(data) {
+		this.raw.postMessage(data);
 	}
-	/** {@link recoverSession}, with a recovery that throws counted as failed. */
-	async tryRecoverSession(mustEndTransaction) {
-		try {
-			return await this.recoverSession(mustEndTransaction);
-		} catch (error) {
-			this.options.onDiagnostic("session recovery threw", error);
-			return false;
+	/**
+	* One channel at a time; a newer attach supersedes an older one. A receive
+	* that throws during replay detaches it and leaves the rest queued.
+	*/
+	onMessage(callback) {
+		this.subscriber = callback;
+		const detach = () => {
+			if (this.subscriber === callback) this.subscriber = void 0;
+		};
+		while (this.queued.length > 0 && this.subscriber === callback) {
+			const frame = this.queued.shift();
+			try {
+				callback(frame);
+			} catch (error) {
+				detach();
+				if (frameKind(frame) === "push") this.discardPushes();
+				throw error;
+			}
 		}
+		return detach;
 	}
-	/** Rolls back only when told to or when the probe fails, sparing another consumer's live transaction. */
-	async recoverSession(mustEndTransaction) {
-		if (!mustEndTransaction && !this.client.isInTransaction() && await this.probeSession()) return true;
-		if (!await this.recoveryExec("rollback")) this.options.onDiagnostic("session rollback did not complete; the session stays suspect");
-		if (!await this.probeSession()) return false;
-		return !this.client.isInTransaction();
-	}
-	async probeSession() {
-		return this.recoveryExec(PROBE);
+	/** The registry closes the raw port on unregister; a channel cannot. */
+	close() {}
+	release() {
+		this.subscriber = void 0;
+		this.queued.length = 0;
+		this.detachRaw();
+		this.raw.close();
 	}
-	/** Kysely awaits release, so an unbounded recovery statement would hold the lease forever. */
-	async recoveryExec(statement) {
-		if (this.deadCall !== void 0) return false;
-		const timeoutMs = this.options.recoveryTimeoutMs;
-		const pending = this.client.exec(statement).then(() => true, (error) => {
-			this.options.onDiagnostic("recovery statement failed", error);
-			return false;
+	dispatch(data) {
+		if (this.discardingPushes) {
+			const kind = frameKind(data);
+			if (kind === "push") return;
+			if (kind === "hello" && this.subscriber) this.discardingPushes = false;
+		}
+		if (this.subscriber) {
+			this.subscriber(data);
+			return;
+		}
+		this.queued.push(data);
+		if (this.queued.length <= this.maxQueuedFrames) return;
+		if (!this.discardingPushes) this.logger.warn("Local sync port @Label queued more than @Max frames with no channel attached; discarding queued pushes for the peer to re-push", this.label, this.maxQueuedFrames);
+		this.discardPushes();
+		this.compact();
+	}
+	/** Until a live hello, so no later push lands across the gap. */
+	discardPushes() {
+		this.discardingPushes = true;
+		this.queued = this.queued.filter((frame) => frameKind(frame) !== "push");
+	}
+	/** Keeps only the latest hello or resend and the latest ack, in order. */
+	compact() {
+		const handshake = this.queued.findLast((frame) => {
+			const kind = frameKind(frame);
+			return kind === "hello" || kind === "resend";
 		});
-		if (timeoutMs <= 0) return pending;
-		const outcome = await withDeadline(pending, timeoutMs);
-		if (outcome === TIMED_OUT) {
-			this.deadCall ??= new PGliteStatementTimeoutError(timeoutMs, statement);
-			this.reportPoisoned(this.deadCall);
-			this.options.onDiagnostic(`a PGlite recovery statement did not settle within ${timeoutMs}ms; the session is unrecoverable from SQL`);
-			return false;
+		const ack = this.queued.findLast((frame) => frameKind(frame) === "ack");
+		this.queued = this.queued.filter((frame) => frame === handshake || frame === ack);
+	}
+};
+/** Brokered local-sync ports by (peerId, channelName); owns closing them. */
+var LocalChannelPortRegistry = class {
+	ports = /* @__PURE__ */ new Map();
+	closedKeys = /* @__PURE__ */ new Set();
+	closed = false;
+	logger;
+	maxQueuedFrames;
+	constructor(options = {}) {
+		this.logger = options.logger ?? new ConsoleLogger(["local-sync"]);
+		this.maxQueuedFrames = options.maxQueuedFrames ?? DEFAULT_MAX_QUEUED_FRAMES;
+	}
+	/** Hand this to the {@link LocalChannelFactory}. */
+	provider = (peerId, channelName) => {
+		const key = this.key(peerId, channelName);
+		const port = this.ports.get(key);
+		if (port) return port;
+		if (this.closedKeys.has(key)) throw new Error(`Local sync port for peer '${peerId}' channel '${channelName}' has been closed; the link is severed and must be brokered again`);
+	};
+	/** Refuses a live key; a closed key may be registered again (a re-link). */
+	register(peerId, channelName, port) {
+		if (this.closed) throw new Error(`This reactor's local sync ports are closed; peer '${peerId}' channel '${channelName}' cannot be brokered here`);
+		const key = this.key(peerId, channelName);
+		if (this.ports.has(key)) throw new Error(`A local sync port is already registered for peer '${peerId}' channel '${channelName}'; unlink the existing link before brokering another`);
+		this.closedKeys.delete(key);
+		this.ports.set(key, new RegisteredPort(port, key, this.logger, this.maxQueuedFrames));
+	}
+	has(peerId, channelName) {
+		return this.ports.has(this.key(peerId, channelName));
+	}
+	isClosed(peerId, channelName) {
+		return this.closedKeys.has(this.key(peerId, channelName));
+	}
+	/** Detaches the registry's listener and closes the port. */
+	unregister(peerId, channelName) {
+		const key = this.key(peerId, channelName);
+		const port = this.ports.get(key);
+		this.ports.delete(key);
+		this.closedKeys.add(key);
+		port?.release();
+	}
+	/** Closes every port and refuses later registrations; the host is going away. */
+	close() {
+		this.closed = true;
+		for (const [key, port] of [...this.ports]) {
+			this.ports.delete(key);
+			this.closedKeys.add(key);
+			try {
+				port.release();
+			} catch (error) {
+				this.logger.error("Closing local sync port @Label failed: @Error", key, error);
+			}
 		}
-		return outcome;
+	}
+	key(peerId, channelName) {
+		return JSON.stringify([peerId, channelName]);
 	}
 };
-function asWrapper(connection) {
-	if (!(connection instanceof HardenedPGliteConnection)) throw new PGliteSessionError("Connection was not created by HardenedPGliteDialect");
-	return connection;
+/** `branch: ""` matches every branch. */
+const DEFAULT_LOCAL_FILTER = {
+	documentId: [],
+	scope: [],
+	branch: ""
+};
+/** Session-scoped: no later boot can rebuild a brokered port. */
+const LOCAL_REMOTE_OPTIONS = {
+	sinceTimestampUtcMs: "0",
+	persistence: "session"
+};
+function localChannelConfig(peerId, channelName) {
+	return {
+		type: LOCAL_CHANNEL_TYPE,
+		parameters: {
+			peerId,
+			channelName
+		}
+	};
 }
-/** Raw SQL through the dialect's queue, instead of into whatever transaction holds the session. */
-async function queryThroughDialect(db, sql, params) {
-	return [...(await db.executeQuery(CompiledQuery.raw(sql, params ?? []))).rows];
+/** `fromKey` splits on the last dot, so neither part may hold one. */
+function assertCollectionIdParts(driveId, branch) {
+	if (driveId.includes(".")) throw new Error(`Drive id ${JSON.stringify(driveId)} contains a "." which the collection id format cannot carry; local sync needs a dot-free drive id`);
+	if (branch.includes(".")) throw new Error(`Branch ${JSON.stringify(branch)} contains a "." which the collection id format cannot carry; local sync needs a dot-free branch`);
+}
+/** A dotted drive id parses as a dotted branch, so that is refused here. */
+function collectionIdFromKey(key) {
+	const collectionId = DriveCollectionId.fromKey(key);
+	assertCollectionIdParts(collectionId.driveId, collectionId.branch);
+	return collectionId;
+}
+/** Registers before `add`, because `add` resolves the port through the factory. */
+async function registerLocalPeer(syncManager, registry, spec, port) {
+	if (registry.has(spec.peerId, spec.channelName)) throw new Error(`This reactor already holds a local sync port for peer '${spec.peerId}' channel '${spec.channelName}'; unlink the existing link first`);
+	if (syncManager.list().some((remote) => remote.meta.name === spec.remoteName)) throw new Error(`This reactor already has a remote named '${spec.remoteName}'; unlink the existing link first`);
+	registry.register(spec.peerId, spec.channelName, port);
+	try {
+		return await syncManager.add(spec.remoteName, spec.collectionId, localChannelConfig(spec.peerId, spec.channelName), spec.filter, LOCAL_REMOTE_OPTIONS);
+	} catch (error) {
+		registry.unregister(spec.peerId, spec.channelName);
+		throw error;
+	}
+}
+/**
+* Waits out a running reset, then removes. The port is closed only once the
+* remote is gone, so a failed remove (a reset that started meanwhile) leaves
+* the link intact for a retry.
+*/
+async function removeLocalPeer(syncManager, registry, spec) {
+	await syncManager.resetSettled?.(spec.remoteName);
+	try {
+		await syncManager.remove(spec.remoteName);
+	} catch (error) {
+		if (!syncManager.list().some((remote) => remote.meta.name === spec.remoteName)) registry.unregister(spec.peerId, spec.channelName);
+		throw error;
+	}
+	registry.unregister(spec.peerId, spec.channelName);
 }
 //#endregion
-//#region src/read-models/interfaces.ts
-function supportsLiveReadModelRegistration(coordinator) {
-	return "addReadModel" in coordinator && typeof coordinator.addReadModel === "function";
+//#region src/sync/channels/local-channel-transport.ts
+/**
+* Wraps a real MessagePort as a {@link LocalChannelPort}.
+*
+* A `node:worker_threads` port is an EventEmitter, so the EventEmitter surface
+* (`on`/`off`) is preferred when present. A browser port is driven through
+* `addEventListener` and an explicit `start()`, whose event carries the payload
+* on `.data`; once started it drops what arrives with no listener attached.
+* Register the result with a `LocalChannelPortRegistry`, which holds one
+* listener for the port's life and queues frames between channels.
+*/
+function messagePortTransport(port) {
+	return {
+		postMessage(data) {
+			port.postMessage(data);
+		},
+		onMessage(callback) {
+			if (typeof port.on === "function" && typeof port.off === "function") {
+				const listener = (value) => callback(value);
+				port.on("message", listener);
+				return () => {
+					port.off?.("message", listener);
+				};
+			}
+			const listener = (event) => {
+				callback(event.data);
+			};
+			port.addEventListener?.("message", listener);
+			port.start?.();
+			return () => {
+				port.removeEventListener?.("message", listener);
+			};
+		},
+		close() {
+			port.close();
+		}
+	};
 }
 //#endregion
 //#region src/processors/host-module.ts
@@ -13156,6 +14764,732 @@ var DocumentIntegrityService = class {
 	}
 };
 //#endregion
-export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, AppendConditionFailedError, AuthEnforcementDisabledError, BareReadGate, BaseReadModel, BatchJobFailedError, CatchUpScheduler, ChannelError, ChannelErrorSource, ChannelScheme, ConsistencyTracker, ContiguousCursor, DEFAULT_COMMIT_CHUNK_SIZE, DEFAULT_DRIVE_CONTAINER_TYPES, DEFAULT_LONG_STATEMENT_TIMEOUT_MS, DEFAULT_MAX_PURGE_OPERATIONS, DEFAULT_PURGE_DELETE_BATCH, DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, DEFAULT_RECOVERY_TIMEOUT_MS, DEFAULT_STATEMENT_TIMEOUT_MS, DOCUMENT_INDEXER_READ_MODEL, DOCUMENT_VIEW_READ_MODEL, DRIVE_AUTH_ERROR_MESSAGES, DefaultSubscriptionErrorHandler, DeletedDocumentRead, DocumentAlreadyExistsError, DocumentChangeType, DocumentExistence, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, DocumentNotDeletedError, DocumentPurgeService, DocumentPurgedError, DriveClient, DriveCollectionId, DriveRequestError, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, GroupInUseError, HardenedPGliteDialect, HybridProjectionCoordinator, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, InMemorySyncHoldStorage, InMemorySyncPurgeRefusalStorage, InMemorySyncReceivedMarkerStorage, IntervalPollTimer, InvalidModuleError, InvalidSignatureError, JobAwaiter, JobExecutorEventTypes, JobStatus, KyselyDocumentIndexer, KyselyDocumentPurger, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncHoldStorage, KyselySyncPurgeRefusalStorage, KyselySyncReceivedMarkerStorage, KyselySyncRemoteStorage, KyselyWriteCache, MAX_POLLED_REFUSALS, Mailbox, ModelNotWorkerImportableError, ModelReadGate, ModuleNotFoundError, NullDocumentModelResolver, OptimisticLockError, PGliteAbortedTransactionError, PGliteAcquireTimeoutError, PGliteSessionError, PGliteSessionPoisonedError, PGliteStatementTimeoutError, PURGE_DOCUMENT, PURGE_LOCK_BUCKETS, PURGE_NS, PollBehavior, PollingChannelError, ProbeSettler, ProcessorManager, PropagationMode, PurgeTooLargeError, QueueEventTypes, REACTOR_SCHEMA, RECOVERABLE_GRAPHQL_ERROR_CODES, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, ReactorEventTypes, ReactorSubscriptionManager, ReadModelCoordinator, RelationalDbProcessor, RelationshipChangeType, RelationshipNotFoundError, ReservedActionError, RetryAccounting, RevisionMismatchError, SIGNATURE_REFUSAL_CODES, SeededStateReader, SettledWatermark, SimpleJobExecutorManager, SyncBuilder, SyncEventTypes, SyncOperation, SyncOperationAggregateError, SyncOperationStatus, SyncRepairRefusedError, SyncScopeGate, SyncStatus, SyncStatusTracker, UnsupportedStoredProtocolError, acquirePurgeLocks, addRelationshipAction, appliedDelete, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createHybridProjectionCoordinatorFactory, createKyselyWatermarkProbe, createMutableShutdownStatus, createPeerAgreement, createReactorHostModuleBase, createRelationalDb, decideAtHead, defaultCatchUpConfig, defaultReadModelIndexingConfig, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, findPurged, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isCatchUpConsumer, isDriveAuthError, isLongRunningStatement, isPurgeMarker, isRecoverableGraphQLError, listPurged, loadDocumentModelSpec, makeConsistencyKey, parseDriveUrl, parsePagingOptions, parseSnapshot, quarantinesDocument, queryThroughDialect, readDecisionModel, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, snapshotFunctionsFor, supportsDeliveryTracking, supportsLiveReadModelRegistration, supportsPurgeRefusals, syncOperationErrorType, trimMailboxFromAckOrdinal, unchunkedReadModelIndexingConfig, updateRelationshipAction, upgradeDocumentAction, verifyActionSignature, workerEntryPath };
+//#region src/inspector/drive-inspection.ts
+const DRIVE_DOCUMENT_TYPE = "powerhouse/document-drive";
+const INTEGRITY_FIND_BATCH_SIZE = 500;
+const DEFAULT_DRIVE_PAGE_SIZE = 100;
+function readDriveState(doc) {
+	const global = doc.state?.global;
+	const rawNodes = Array.isArray(global?.nodes) ? global.nodes : [];
+	const nodes = [];
+	let folderCount = 0;
+	let otherNodeCount = 0;
+	let unreadableNodeCount = 0;
+	for (const raw of rawNodes) {
+		if (typeof raw !== "object" || raw === null) {
+			unreadableNodeCount += 1;
+			continue;
+		}
+		const node = raw;
+		if (typeof node.id !== "string" || typeof node.kind !== "string") {
+			unreadableNodeCount += 1;
+			continue;
+		}
+		nodes.push({
+			id: node.id,
+			kind: node.kind,
+			documentType: typeof node.documentType === "string" ? node.documentType : void 0
+		});
+		if (node.kind === "folder") folderCount += 1;
+		else if (node.kind !== "file") otherNodeCount += 1;
+	}
+	return {
+		name: typeof global?.name === "string" ? global.name : doc.header.name,
+		icon: typeof global?.icon === "string" ? global.icon : void 0,
+		nodes,
+		totalNodeCount: rawNodes.length,
+		folderCount,
+		otherNodeCount,
+		unreadableNodeCount
+	};
+}
+function fileNodesOf(nodes) {
+	return nodes.filter((node) => node.kind === "file");
+}
+function toDriveInfo(doc) {
+	const driveId = doc.header.id;
+	const branch = doc.header.branch;
+	const state = readDriveState(doc);
+	return {
+		driveId,
+		name: state.name,
+		branch,
+		collectionId: DriveCollectionId.forDrive(driveId, branch).key,
+		documentType: doc.header.documentType,
+		nodeCount: state.totalNodeCount,
+		fileCount: fileNodesOf(state.nodes).length,
+		folderCount: state.folderCount,
+		otherNodeCount: state.otherNodeCount,
+		unreadableNodeCount: state.unreadableNodeCount,
+		icon: state.icon
+	};
+}
+/** Drive listing and integrity, every read made through one reader and view. */
+var DriveInspection = class {
+	reader;
+	registry;
+	view;
+	constructor(reader, registry, view = {}) {
+		this.reader = reader;
+		this.registry = registry;
+		this.view = view;
+	}
+	async listDrives(cursor, limit) {
+		const page = await this.reader.find({ type: DRIVE_DOCUMENT_TYPE }, this.view, {
+			cursor: cursor ?? "",
+			limit: limit ?? DEFAULT_DRIVE_PAGE_SIZE
+		});
+		return {
+			results: page.results.map(toDriveInfo),
+			nextCursor: page.nextCursor
+		};
+	}
+	async checkDriveIntegrity(driveId, branch) {
+		const fileNodes = fileNodesOf(readDriveState(await this.reader.get(driveId, {
+			...this.view,
+			branch
+		})).nodes);
+		const present = await this.presentDocumentIds(fileNodes.map((node) => node.id), branch);
+		const supported = this.supportedDocumentTypes();
+		const missingDocuments = [];
+		const unsupportedTypes = [];
+		for (const node of fileNodes) {
+			if (!present.has(node.id)) missingDocuments.push({
+				id: node.id,
+				documentType: node.documentType ?? ""
+			});
+			if (supported !== void 0 && node.documentType !== void 0 && !supported.has(node.documentType)) unsupportedTypes.push({
+				id: node.id,
+				documentType: node.documentType
+			});
+		}
+		return {
+			driveId,
+			checkedNodeCount: fileNodes.length,
+			totalFileNodeCount: fileNodes.length,
+			missingDocuments,
+			unsupportedTypes
+		};
+	}
+	async presentDocumentIds(ids, branch) {
+		const present = /* @__PURE__ */ new Set();
+		for (let start = 0; start < ids.length; start += INTEGRITY_FIND_BATCH_SIZE) {
+			const batch = ids.slice(start, start + INTEGRITY_FIND_BATCH_SIZE);
+			let page = await this.reader.find({ ids: batch }, {
+				...this.view,
+				branch
+			}, {
+				cursor: "",
+				limit: batch.length
+			});
+			for (const doc of page.results) present.add(doc.header.id);
+			while (page.nextCursor !== void 0 && page.next) {
+				page = await page.next();
+				for (const doc of page.results) present.add(doc.header.id);
+			}
+		}
+		return present;
+	}
+	supportedDocumentTypes() {
+		if (!this.registry) return;
+		return new Set(this.registry.getAllModules().map((module) => module.documentModel.global.id));
+	}
+};
+//#endregion
+//#region src/inspector/ops.ts
+/** The `inspector-op` channel, one row per member. */
+const INSPECTOR_OPS = {
+	info: {
+		rpc: "reactor.info",
+		tier: "read",
+		gql: "info"
+	},
+	listDocumentModels: {
+		rpc: "registry.listDocumentModels",
+		tier: "read",
+		gql: "documentModels"
+	},
+	listDrives: {
+		rpc: "drives.list",
+		tier: "read",
+		gql: "drives"
+	},
+	checkDriveIntegrity: {
+		rpc: "drives.checkIntegrity",
+		tier: "read",
+		gql: "driveIntegrity"
+	},
+	getAttachmentInfo: {
+		rpc: "attachments.info",
+		tier: "read",
+		gql: "attachmentInfo"
+	},
+	getQueueState: {
+		rpc: "queue.getState",
+		tier: "read",
+		gql: "queueState"
+	},
+	getProcessors: {
+		rpc: "processors.getAll",
+		tier: "read",
+		gql: "processors"
+	},
+	getCatchUpStatus: {
+		rpc: "catchUp.status",
+		tier: "read",
+		gql: "catchUpStatus"
+	},
+	getStorageHealth: {
+		rpc: "storage.health",
+		tier: "read",
+		gql: "storageHealth"
+	},
+	validateDocument: {
+		rpc: "integrity.validate",
+		tier: "read",
+		gql: "validateDocument"
+	},
+	pauseQueue: {
+		rpc: "queue.pause",
+		tier: "admin"
+	},
+	resumeQueue: {
+		rpc: "queue.resume",
+		tier: "admin"
+	},
+	retryProcessor: {
+		rpc: "processors.retry",
+		tier: "admin"
+	},
+	sweepCatchUp: {
+		rpc: "catchUp.sweepNow",
+		tier: "admin"
+	},
+	rebuildKeyframes: {
+		rpc: "integrity.rebuildKeyframes",
+		tier: "admin"
+	},
+	rebuildSnapshots: {
+		rpc: "integrity.rebuildSnapshots",
+		tier: "admin"
+	},
+	queryDb: {
+		rpc: "db.query",
+		tier: "sql"
+	}
+};
+/** The inspection and repair rows of the `sync-op` channel. */
+const SYNC_INSPECTION_OPS = {
+	inspectRemote: {
+		rpc: "inspect.remote",
+		tier: "read",
+		gql: "remote"
+	},
+	inspectRemotes: {
+		rpc: "inspect.remotes",
+		tier: "read",
+		gql: "remotes"
+	},
+	listDeadLetters: {
+		rpc: "deadLetters.list",
+		tier: "read",
+		gql: "deadLetters"
+	},
+	resetChannel: {
+		rpc: "repair.resetChannel",
+		tier: "admin"
+	},
+	requeueDeadLetter: {
+		rpc: "deadLetters.requeue",
+		tier: "admin"
+	},
+	clearDeadLetter: {
+		rpc: "deadLetters.clear",
+		tier: "admin"
+	}
+};
+/** Reads only, unless a host grants more. */
+const READ_ONLY_ACCESS = Object.freeze({
+	admin: false,
+	sql: false
+});
+function tierAllowed(tier, access) {
+	switch (tier) {
+		case "read": return true;
+		case "admin": return access.admin;
+		case "sql": return access.sql;
+	}
+}
+/** The table key whose rpc name is `method`, or undefined. */
+function opKeyOf(table, method) {
+	for (const key of Object.keys(table)) if (table[key].rpc === method) return key;
+}
+/** The read rows' GraphQL root field names, keyed by member. */
+function readOpFields(table) {
+	const fields = {};
+	for (const key of Object.keys(table)) {
+		const spec = table[key];
+		if (spec.tier === "read") fields[key] = spec.gql;
+	}
+	return fields;
+}
+var UnknownInspectorOpError = class extends Error {
+	method;
+	constructor(method) {
+		super(`Unknown inspector op: ${method}`);
+		this.method = method;
+		this.name = "UnknownInspectorOpError";
+	}
+};
+var InspectorOpRefusedError = class extends Error {
+	method;
+	tier;
+	constructor(method, tier) {
+		super(`This host does not serve ${tier}-tier inspection ops (${method})`);
+		this.method = method;
+		this.tier = tier;
+		this.name = "InspectorOpRefusedError";
+	}
+};
+var InspectorOpUnavailableError = class extends Error {
+	method;
+	constructor(method) {
+		super(`This host has nothing to serve ${method} with`);
+		this.method = method;
+		this.name = "InspectorOpUnavailableError";
+	}
+};
+/** Refuses unknown methods and ungranted tiers before resolving a handler. */
+async function dispatchTableOp(table, resolve, access, method, args) {
+	const key = opKeyOf(table, method);
+	if (key === void 0) throw new UnknownInspectorOpError(method);
+	const tier = table[key].tier;
+	if (!tierAllowed(tier, access)) throw new InspectorOpRefusedError(method, tier);
+	const handler = resolve(key);
+	if (!handler) throw new InspectorOpUnavailableError(method);
+	return await handler(...args);
+}
+/** Binds `key` on `target` when it is a method there. */
+function methodOf(target, key) {
+	const member = target?.[key];
+	return typeof member === "function" ? member.bind(target) : void 0;
+}
+//#endregion
+//#region src/inspector/reactor-inspector.ts
+const untrackedStorageHealth = {
+	tracked: false,
+	healthy: false,
+	everRecreated: false,
+	recreateCount: 0
+};
+const emptyQueueState = {
+	isPaused: false,
+	pendingJobs: [],
+	executingJobs: [],
+	totalPending: 0,
+	totalExecuting: 0
+};
+const noAttachmentStore = {
+	present: false,
+	storeKind: "none",
+	hasReplicator: false,
+	replicatorRunning: false,
+	backlogScanned: false,
+	refsSeen: 0,
+	held: 0,
+	bytesHeld: 0,
+	queued: 0,
+	fetching: 0,
+	pendingFetches: 0,
+	waiting: 0,
+	notFound: 0,
+	failed: 0,
+	lastError: void 0
+};
+function unsupported(what, why) {
+	return /* @__PURE__ */ new Error(`${what} is unsupported on this host: ${why}`);
+}
+const NO_INSPECTABLE_QUEUE = "its queue is not the in-memory one, so it cannot be paused or resumed";
+const NO_CATCH_UP = "it was built without catch-up";
+const NO_INTEGRITY = "it has no document integrity service";
+const NO_PROCESSORS = "it was built without a processor manager";
+/** In-process inspector over a reactor module's live components. */
+var ReactorInspector = class {
+	components;
+	storageFacts;
+	syncChannels;
+	access;
+	workflows;
+	constructor(components) {
+		this.components = components;
+		const facts = components.facts ?? {};
+		this.storageFacts = facts.storage ?? UNKNOWN_STORAGE_FACTS;
+		this.syncChannels = Object.freeze([...facts.syncChannels ?? []]);
+		this.access = facts.access ?? READ_ONLY_ACCESS;
+		this.workflows = facts.workflows ?? false;
+	}
+	setWorkflows(composed) {
+		this.workflows = composed;
+	}
+	info() {
+		return Promise.resolve({
+			storage: { ...this.storageFacts },
+			workflows: this.workflows,
+			syncChannels: [...this.syncChannels],
+			access: { ...this.access }
+		});
+	}
+	listDocumentModels() {
+		const registry = this.components.documentModelRegistry;
+		if (!registry) return Promise.resolve([]);
+		const byType = /* @__PURE__ */ new Map();
+		for (const module of registry.getAllModules()) {
+			const documentType = module.documentModel.global.id;
+			if (byType.has(documentType)) continue;
+			const supportedVersions = registry.getSupportedVersions(documentType);
+			byType.set(documentType, {
+				documentType,
+				name: module.documentModel.global.name,
+				version: supportedVersions.at(-1) ?? module.version ?? 1,
+				supportedVersions
+			});
+		}
+		return Promise.resolve([...byType.values()]);
+	}
+	listDrives(cursor, limit) {
+		const drives = this.components.drives;
+		if (!drives) return Promise.resolve({
+			results: [],
+			nextCursor: void 0
+		});
+		return drives.listDrives(cursor, limit);
+	}
+	checkDriveIntegrity(driveId, branch) {
+		const drives = this.components.drives;
+		if (!drives) return Promise.resolve({
+			driveId,
+			checkedNodeCount: 0,
+			totalFileNodeCount: 0,
+			missingDocuments: [],
+			unsupportedTypes: []
+		});
+		return drives.checkDriveIntegrity(driveId, branch);
+	}
+	getAttachmentInfo() {
+		const store = this.components.attachmentStore;
+		if (!store) return Promise.resolve({ ...noAttachmentStore });
+		return store.getAttachmentInfo();
+	}
+	getQueueState() {
+		const queue = this.components.queue;
+		if (!queue) return Promise.resolve({ ...emptyQueueState });
+		const pendingJobs = queue.getPendingJobs();
+		const executingJobs = [];
+		for (const jobIds of queue.getExecutingJobIds().values()) for (const jobId of jobIds) {
+			const job = queue.getJob(jobId);
+			if (job) executingJobs.push(job);
+		}
+		return Promise.resolve({
+			isPaused: queue.paused,
+			pendingJobs,
+			executingJobs,
+			totalPending: pendingJobs.length,
+			totalExecuting: executingJobs.length
+		});
+	}
+	getProcessors() {
+		const tracked = this.components.processorManager?.getAll() ?? [];
+		return Promise.resolve(tracked.map((processor) => ({
+			processorId: processor.processorId,
+			factoryId: processor.factoryId,
+			driveId: processor.driveId,
+			processorIndex: processor.processorIndex,
+			lastOrdinal: processor.lastOrdinal,
+			status: processor.status,
+			lastError: processor.lastError,
+			lastErrorTimestamp: processor.lastErrorTimestamp
+		})));
+	}
+	getCatchUpStatus() {
+		const catchUp = this.components.catchUp;
+		if (!catchUp) return Promise.reject(unsupported("Reading catch-up", NO_CATCH_UP));
+		return Promise.resolve(catchUp.status());
+	}
+	getStorageHealth() {
+		const provider = this.components.storageHealth;
+		if (!provider) return Promise.resolve({ ...untrackedStorageHealth });
+		return Promise.resolve(provider.getStorageHealth());
+	}
+	validateDocument(documentId, branch) {
+		const integrity = this.components.integrity;
+		if (!integrity) return Promise.reject(unsupported("Validating a document", NO_INTEGRITY));
+		return integrity.validateDocument(documentId, branch);
+	}
+	pauseQueue() {
+		const queue = this.components.queue;
+		if (!queue) return Promise.reject(unsupported("Pausing the queue", NO_INSPECTABLE_QUEUE));
+		queue.pause();
+		return Promise.resolve();
+	}
+	resumeQueue() {
+		const queue = this.components.queue;
+		if (!queue) return Promise.reject(unsupported("Resuming the queue", NO_INSPECTABLE_QUEUE));
+		return queue.resume();
+	}
+	retryProcessor(processorId) {
+		const manager = this.components.processorManager;
+		if (!manager) return Promise.reject(unsupported("Retrying a processor", NO_PROCESSORS));
+		const processor = manager.get(processorId);
+		if (!processor) return Promise.reject(/* @__PURE__ */ new Error(`Cannot retry processor ${JSON.stringify(processorId)}: this reactor is not tracking it`));
+		return processor.retry();
+	}
+	sweepCatchUp() {
+		const catchUp = this.components.catchUp;
+		if (!catchUp) return Promise.reject(unsupported("Sweeping catch-up", NO_CATCH_UP));
+		return catchUp.sweepNow();
+	}
+	rebuildKeyframes(documentId, branch) {
+		const integrity = this.components.integrity;
+		if (!integrity) return Promise.reject(unsupported("Rebuilding keyframes", NO_INTEGRITY));
+		return integrity.rebuildKeyframes(documentId, branch);
+	}
+	rebuildSnapshots(documentId, branch) {
+		const integrity = this.components.integrity;
+		if (!integrity) return Promise.reject(unsupported("Rebuilding snapshots", NO_INTEGRITY));
+		return integrity.rebuildSnapshots(documentId, branch);
+	}
+};
+//#endregion
+//#region src/inspector/from-module.ts
+/** A group-commit store is never recreated in place; a poison needs a restart. */
+function groupCommitHealth(storage) {
+	if (!storage) return;
+	return { getStorageHealth: () => ({
+		tracked: true,
+		healthy: storage.health.getStorageHealth().healthy,
+		everRecreated: false,
+		recreateCount: 0
+	}) };
+}
+/** The in-process inspector over a built module; drive reads run as the host. */
+function createReactorInspector(module, options = {}) {
+	return new ReactorInspector({
+		queue: module.queue instanceof InMemoryQueue ? module.queue : void 0,
+		processorManager: module.processorManager,
+		catchUp: module.catchUp,
+		integrity: new DocumentIntegrityService(module.keyframeStore, module.operationStore, module.writeCache, module.documentView, module.documentModelRegistry),
+		storageHealth: options.storageHealth ?? groupCommitHealth(module.groupCommitStorage),
+		documentModelRegistry: module.documentModelRegistry,
+		drives: new DriveInspection(module.reactor, module.documentModelRegistry),
+		attachmentStore: options.attachmentStore,
+		facts: {
+			storage: module.storageFacts,
+			syncChannels: module.syncModule ? channelFactoryTypes(module.syncModule.channelFactory) : [],
+			access: options.access,
+			workflows: options.workflows
+		}
+	});
+}
+//#endregion
+//#region src/inspector/wire.ts
+function toWireQueueJob(job, status) {
+	return {
+		id: job.id,
+		kind: job.kind,
+		documentId: job.documentId,
+		scope: job.scope,
+		branch: job.branch,
+		status,
+		actionCount: job.actions.length,
+		operationCount: job.operations.length,
+		retryCount: job.retryCount ?? 0
+	};
+}
+/** The queue as the inspection surface serves it: no document content. */
+function toWireQueueState(snapshot) {
+	return {
+		isPaused: snapshot.isPaused,
+		totalPending: snapshot.totalPending,
+		totalExecuting: snapshot.totalExecuting,
+		pendingJobs: snapshot.pendingJobs.map((job) => toWireQueueJob(job, "pending")),
+		executingJobs: snapshot.executingJobs.map((job) => toWireQueueJob(job, "executing"))
+	};
+}
+/** A dead letter as the inspection surface serves it: no document content. */
+function toWireDeadLetter(record) {
+	return {
+		id: record.id,
+		jobId: record.jobId,
+		documentId: record.documentId,
+		branch: record.branch,
+		scopes: [...record.scopes],
+		errorType: record.errorType,
+		errorMessage: record.errorMessage,
+		operationCount: record.operations.length
+	};
+}
+/** Compile error unless `names` lists every key of `T` and nothing else. */
+function fieldsOf() {
+	return (names) => names;
+}
+/** Every wire record's fields, by the GraphQL type that serves it. */
+const INSPECTION_WIRE_FIELDS = {
+	ReactorInfo: fieldsOf()([
+		"storage",
+		"workflows",
+		"syncChannels",
+		"access"
+	]),
+	ReactorStorageFacts: fieldsOf()([
+		"engine",
+		"persistence",
+		"durable",
+		"selfHeal"
+	]),
+	InspectorAccess: fieldsOf()(["admin", "sql"]),
+	InspectionDocumentModel: fieldsOf()([
+		"documentType",
+		"name",
+		"version",
+		"supportedVersions"
+	]),
+	InspectionDrive: fieldsOf()([
+		"driveId",
+		"name",
+		"branch",
+		"collectionId",
+		"documentType",
+		"nodeCount",
+		"fileCount",
+		"folderCount",
+		"otherNodeCount",
+		"unreadableNodeCount",
+		"icon"
+	]),
+	InspectionDrivePage: fieldsOf()(["results", "nextCursor"]),
+	InspectionDriveIntegrityRef: fieldsOf()(["id", "documentType"]),
+	InspectionDriveIntegrity: fieldsOf()([
+		"driveId",
+		"checkedNodeCount",
+		"totalFileNodeCount",
+		"missingDocuments",
+		"unsupportedTypes"
+	]),
+	InspectionAttachmentInfo: fieldsOf()([
+		"present",
+		"storeKind",
+		"hasReplicator",
+		"replicatorRunning",
+		"backlogScanned",
+		"refsSeen",
+		"held",
+		"bytesHeld",
+		"queued",
+		"fetching",
+		"pendingFetches",
+		"waiting",
+		"notFound",
+		"failed",
+		"lastError"
+	]),
+	InspectionQueueJob: fieldsOf()([
+		"id",
+		"kind",
+		"documentId",
+		"scope",
+		"branch",
+		"status",
+		"actionCount",
+		"operationCount",
+		"retryCount"
+	]),
+	InspectionQueueState: fieldsOf()([
+		"isPaused",
+		"totalPending",
+		"totalExecuting",
+		"pendingJobs",
+		"executingJobs"
+	]),
+	InspectionProcessor: fieldsOf()([
+		"processorId",
+		"factoryId",
+		"driveId",
+		"processorIndex",
+		"lastOrdinal",
+		"status",
+		"lastError",
+		"lastErrorTimestampUtcMs"
+	]),
+	InspectionStorageHealth: fieldsOf()([
+		"tracked",
+		"healthy",
+		"everRecreated",
+		"recreateCount"
+	]),
+	InspectionValidation: fieldsOf()([
+		"documentId",
+		"isConsistent",
+		"keyframeIssues",
+		"snapshotIssues",
+		"streamOrderIssues"
+	]),
+	InspectionCursor: fieldsOf()([
+		"cursorType",
+		"cursorOrdinal",
+		"lastSyncedAtUtcMs",
+		"liveAckOrdinal",
+		"liveLatestOrdinal"
+	]),
+	InspectionMailboxDepths: fieldsOf()([
+		"inbox",
+		"outbox",
+		"deadLetter"
+	]),
+	InspectionConnectionHealth: fieldsOf()([
+		"snapshot",
+		"neverSucceeded",
+		"stalenessMs"
+	]),
+	InspectionRemote: fieldsOf()([
+		"remoteName",
+		"remoteId",
+		"inboxCursor",
+		"outboxCursor",
+		"mailboxDepths",
+		"connection",
+		"meta"
+	]),
+	InspectionDeadLetter: fieldsOf()([
+		"id",
+		"jobId",
+		"documentId",
+		"branch",
+		"scopes",
+		"errorType",
+		"errorMessage",
+		"operationCount"
+	]),
+	InspectionDeadLetterPage: fieldsOf()([
+		"remoteName",
+		"results",
+		"nextCursor"
+	])
+};
+function rootFieldsOf(...tables) {
+	return tables.flatMap((table) => Object.values(readOpFields(table)).filter((field) => field !== void 0));
+}
+/** The root fields the inspection subgraph serves: the read rows only. */
+const INSPECTION_ROOT_FIELDS = Object.freeze({ ReactorInspection: Object.freeze(rootFieldsOf(INSPECTOR_OPS, SYNC_INSPECTION_OPS)) });
+/** Ordinals pass 2^31, so these are `Float` rather than `Int`. */
+const INSPECTION_ORDINAL_FIELDS = {
+	InspectionProcessor: ["lastOrdinal"],
+	InspectionCursor: [
+		"cursorOrdinal",
+		"liveAckOrdinal",
+		"liveLatestOrdinal"
+	]
+};
+//#endregion
+export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, AppendConditionFailedError, AuthEnforcementDisabledError, BareReadGate, BaseReadModel, BatchJobFailedError, CatchUpScheduler, ChannelError, ChannelErrorSource, ChannelScheme, CompositeChannelFactory, ConsistencyTracker, ContiguousCursor, DEFAULT_COMMIT_CHUNK_SIZE, DEFAULT_DRIVE_CONTAINER_TYPES, DEFAULT_LOCAL_FILTER, DEFAULT_LONG_STATEMENT_TIMEOUT_MS, DEFAULT_MAX_PURGE_OPERATIONS, DEFAULT_PURGE_DELETE_BATCH, DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, DEFAULT_RECOVERY_TIMEOUT_MS, DEFAULT_STATEMENT_TIMEOUT_MS, DOCUMENT_INDEXER_READ_MODEL, DOCUMENT_VIEW_READ_MODEL, DRIVE_AUTH_ERROR_MESSAGES, DefaultSubscriptionErrorHandler, DeletedDocumentRead, DocumentAlreadyExistsError, DocumentChangeType, DocumentExistence, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, DocumentNotDeletedError, DocumentPurgeService, DocumentPurgedError, DriveClient, DriveCollectionId, DriveInspection, DriveRequestError, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, GQL_CHANNEL_TYPE, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, GroupInUseError, HardenedPGliteDialect, HybridProjectionCoordinator, INSPECTION_ORDINAL_FIELDS, INSPECTION_ROOT_FIELDS, INSPECTION_WIRE_FIELDS, INSPECTOR_OPS, IN_MEMORY_PGLITE_STORAGE_FACTS, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, InMemorySyncHoldStorage, InMemorySyncPurgeRefusalStorage, InMemorySyncReceivedMarkerStorage, InspectorOpRefusedError, InspectorOpUnavailableError, IntervalPollTimer, InvalidDeadLetterCursorError, InvalidModuleError, InvalidSignatureError, JOB_NOT_FOUND_ERROR_NAME, JobAwaiter, JobExecutorEventTypes, JobStatus, KyselyDocumentIndexer, KyselyDocumentPurger, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncHoldStorage, KyselySyncPurgeRefusalStorage, KyselySyncReceivedMarkerStorage, KyselySyncRemoteStorage, KyselyWriteCache, LOCAL_CHANNEL_TYPE, LOCAL_REMOTE_OPTIONS, LocalChannel, LocalChannelFactory, LocalChannelPortRegistry, MAX_POLLED_REFUSALS, Mailbox, ModelNotWorkerImportableError, ModelReadGate, ModuleNotFoundError, NullDocumentModelResolver, OptimisticLockError, PGLITE_IDB_STORAGE_FACTS, PGLITE_PATH_STORAGE_FACTS, PGliteAbortedTransactionError, PGliteAcquireTimeoutError, PGliteFlushSyncTimeoutError, PGliteSessionError, PGliteSessionPoisonedError, PGliteStatementTimeoutError, POLLING_CHANNEL_TYPE, POSTGRES_STORAGE_FACTS, PURGE_DOCUMENT, PURGE_LOCK_BUCKETS, PURGE_NS, PollBehavior, PollingChannelError, ProbeSettler, ProcessorManager, PropagationMode, PurgeTooLargeError, QueueEventTypes, REACTOR_SCHEMA, READ_ONLY_ACCESS, RECOVERABLE_GRAPHQL_ERROR_CODES, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, ReactorEventTypes, ReactorInspector, ReactorSubscriptionManager, ReadModelCoordinator, RelationalDbProcessor, RelationshipChangeType, RelationshipNotFoundError, RemotePersistence, ReservedActionError, RetryAccounting, RevisionMismatchError, SIGNATURE_REFUSAL_CODES, SYNC_INSPECTION_OPS, SeededStateReader, SettledWatermark, SimpleJobExecutorManager, StoragePoisonedError, SyncBuilder, SyncEventTypes, SyncOperation, SyncOperationAggregateError, SyncOperationStatus, SyncRepairRefusedError, SyncScopeGate, SyncStatus, SyncStatusTracker, UNKNOWN_STORAGE_FACTS, UnknownInspectorOpError, UnsupportedStoredProtocolError, acquirePurgeLocks, addRelationshipAction, appliedDelete, assertCollectionIdParts, authDecisionModel, batchOperationsByDocument, bucketFor, buildCreateJobs, buildDecisionModel, channelFactoryTypes, classifyJobFailure, collectionIdFromKey, consolidateSyncOperations, createDocumentAction, createEmptyDocument, createForwardingLogger, createHybridProjectionCoordinatorFactory, createKyselyWatermarkProbe, createMutableShutdownStatus, createPeerAgreement, createReactorHostModuleBase, createReactorInspector, createRelationalDb, decideAtHead, defaultCatchUpConfig, defaultReadModelIndexingConfig, deleteDocumentAction, deriveConnectionHealth, dispatchTableOp, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, findPurged, firstOutOfOrderPair, getMigrationStatus, hashDocumentId, instrumentPgPool, isCatchUpConsumer, isDriveAuthError, isLocalWireMessage, isLongRunningStatement, isPurgeMarker, isRecoverableGraphQLError, listPurged, loadDocumentModelSpec, localChannelConfig, makeConsistencyKey, messagePortTransport, methodOf, opKeyOf, parseDriveUrl, parsePagingOptions, parseSnapshot, quarantinesDocument, queryThroughDialect, readDecisionModel, readOpFields, registerLocalPeer, removeLocalPeer, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, selectDocumentModelModule, snapshotFunctionsFor, supportsDeliveryTracking, supportsLiveReadModelRegistration, supportsPurgeRefusals, syncOperationErrorType, tierAllowed, toWireDeadLetter, toWireQueueState, trimMailboxFromAckOrdinal, unchunkedReadModelIndexingConfig, updateRelationshipAction, upgradeDocumentAction, upgradeDocumentWith, verifyActionSignature, workerEntryPath };
 
 //# sourceMappingURL=index.js.map