@powerhousedao/reactor 6.2.3-dev.9 → 6.2.3-staging.0

package/dist/{drive-container-types-aO-PASn7.js → forwarding-logger-BkwlvD9W.js}

@@ -1,7 +1,6 @@
-import { n as ReactorEventTypes, t as EventBusAggregateError } from "./types-DMKLa0Ok.js";
-import { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, DOCUMENT_DELETED_REASON, DowngradeNotSupportedError as DowngradeNotSupportedError$1, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, baseReducerVersion, createPresignedHeader, decide, defaultBaseState, deriveOperationId, evaluate, garbageCollect, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, isDenied, isUndoRedo, mentionedGroupIds, normalizeDocumentModelVersion, referencedGroupIds, sortOperations } from "@powerhousedao/shared/document-model";
+import { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, DOCUMENT_DELETED_REASON, DOCUMENT_SCOPE_ACTION_TYPES, DowngradeNotSupportedError as DowngradeNotSupportedError$1, PEER_CAPABILITIES, actionSignerIdentity, actionSigningTarget, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, base58Decode, baseReducerVersion, buildOperationSignatureMessage, buildOperationSignatureParams, canonicalJson, createPresignedHeader, decide, defaultBaseState, deriveDocumentId, deriveOperationId, evaluate, garbageCollect, groupDocumentType, groupMembershipActionTypes, hashActionV2, hashBrowser, hashDocumentStateForScope, isDenied, isDerivedDocumentId, isUndoRedo, isV2ActionHash, localSupports, mentionedGroupIds, normalizeDocumentModelVersion, operationOutcome, referencedGroupIds, signaturePolicyOf, sortOperations, targetDocumentId, v2TupleProblem, withProtocolVersions } from "@powerhousedao/shared/document-model";
 import { v4 } from "uuid";
-import { Migrator, sql } from "kysely";
+import { Migrator, TableNode, sql } from "kysely";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
 var __exportAll = (all, no_symbols) => {
@@ -52,6 +51,38 @@ function parsePagingOptions(paging, defaultLimit) {
 	};
 }
 //#endregion
+//#region src/events/types.ts
+/**
+* Custom error class that aggregates multiple errors from event subscribers.
+*/
+var EventBusAggregateError = class extends Error {
+	errors;
+	constructor(errors) {
+		const message = `EventBus emit failed with ${errors.length} error(s): ${errors.map((e) => {
+			if (e && typeof e === "object" && "message" in e) return e.message;
+			return String(e);
+		}).join("; ")}`;
+		super(message);
+		this.name = "EventBusAggregateError";
+		this.errors = errors;
+	}
+};
+/**
+* Event types for reactor lifecycle events.
+*/
+const ReactorEventTypes = {
+	JOB_PENDING: 10001,
+	JOB_RUNNING: 10002,
+	JOB_WRITE_READY: 10003,
+	JOB_READ_READY: 10004,
+	JOB_FAILED: 10005,
+	READMODEL_BATCH_COMPLETED: 10006,
+	READMODEL_INDEXED: 10007,
+	MODEL_LOADED: 10008,
+	SIGNATURE_REFUSED: 10009,
+	CATCHUP_SWEPT: 10010
+};
+//#endregion
 //#region src/shared/errors.ts
 /**
 * Error thrown when attempting to access a deleted document.
@@ -143,6 +174,23 @@ var InvalidOperationTimestampError = class InvalidOperationTimestampError extend
 		return Error.isError(error) && error.name === "InvalidOperationTimestampError";
 	}
 };
+/** A document requires a protocol version this reactor does not run. Terminal. */
+var UnsupportedProtocolVersionError = class UnsupportedProtocolVersionError extends Error {
+	documentId;
+	protocol;
+	version;
+	constructor(documentId, protocol, version) {
+		super(`Document ${documentId} requires ${protocol} ${version}, which this reactor does not support`);
+		this.name = "UnsupportedProtocolVersionError";
+		this.documentId = documentId;
+		this.protocol = protocol;
+		this.version = version;
+		Error.captureStackTrace(this, UnsupportedProtocolVersionError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "UnsupportedProtocolVersionError";
+	}
+};
 /**
 * A load would move more operations than the bound allows, indicating a real
 * divergence between local and incoming history. Counts only first-time moves,
@@ -167,19 +215,22 @@ var ExcessiveReshuffleError = class ExcessiveReshuffleError extends Error {
 		return Error.isError(error) && error.name === "ExcessiveReshuffleError";
 	}
 };
-/**
-* Error thrown when an operation has an invalid signature.
-*/
+/** The message carries the code: only name and message cross the queue. */
 var InvalidSignatureError = class InvalidSignatureError extends Error {
 	documentId;
+	code;
 	reason;
-	constructor(documentId, reason) {
-		super(`Invalid signature in document ${documentId}: ${reason}`);
+	constructor(documentId, code, reason) {
+		super(`Invalid signature in document ${documentId} [${code}]: ${reason}`);
 		this.name = "InvalidSignatureError";
 		this.documentId = documentId;
+		this.code = code;
 		this.reason = reason;
 		Error.captureStackTrace(this, InvalidSignatureError);
 	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "InvalidSignatureError";
+	}
 };
 /**
 * An UPGRADE_DOCUMENT action's preconditions (fromVersion and the per-scope
@@ -250,6 +301,46 @@ var AuthEnforcementDisabledError = class AuthEnforcementDisabledError extends Er
 		return Error.isError(error) && error.name === "AuthEnforcementDisabledError";
 	}
 };
+/**
+* Error thrown when a relationship edge an operation names does not exist.
+*
+* Detection is by `name`, not `instanceof`: the SharedWorker RPC boundary
+* rebuilds a thrown error from `{ name, message, stack, cause }` alone
+* (`reactor-browser/src/rpc/error-info.ts`), so the class identity is lost in
+* transit.
+*/
+var RelationshipNotFoundError = class RelationshipNotFoundError extends Error {
+	sourceId;
+	targetId;
+	relationshipType;
+	constructor(sourceId, targetId, relationshipType) {
+		super(`No ${relationshipType} relationship from ${sourceId} to ${targetId}`);
+		this.name = "RelationshipNotFoundError";
+		this.sourceId = sourceId;
+		this.targetId = targetId;
+		this.relationshipType = relationshipType;
+		Error.captureStackTrace(this, RelationshipNotFoundError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "RelationshipNotFoundError";
+	}
+};
+/** The store holds documents at protocol versions this reactor does not run. */
+var UnsupportedStoredProtocolError = class UnsupportedStoredProtocolError extends Error {
+	versions;
+	documents;
+	constructor(versions, documents) {
+		const named = versions.map(({ protocol, version }) => `${protocol} ${version}`).join(", ");
+		super(`${documents} stored document(s) require ${named}, which this reactor does not run. Start a build that runs them, or accept them read-only with withUnsupportedStoredDocuments("read-only")`);
+		this.name = "UnsupportedStoredProtocolError";
+		this.versions = versions;
+		this.documents = documents;
+		Error.captureStackTrace(this, UnsupportedStoredProtocolError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "UnsupportedStoredProtocolError";
+	}
+};
 //#endregion
 //#region src/storage/interfaces.ts
 /**
@@ -302,6 +393,7 @@ const APPEND_CONDITION_FAILED_PREFIX = "Append condition failed: ";
 * conflict, not a fault: the caller retries against the new stream heads.
 */
 var AppendConditionFailedError = class extends Error {
+	condition;
 	constructor(condition) {
 		const streams = condition.streams.map((s) => `${s.documentId}:${s.scope}:${s.branch}@${s.revision}`).join(", ");
 		super(`${APPEND_CONDITION_FAILED_PREFIX}a read-set stream advanced [${streams}]`);
@@ -335,6 +427,52 @@ let DocumentExistence = /* @__PURE__ */ function(DocumentExistence) {
 	return DocumentExistence;
 }({});
 //#endregion
+//#region src/cache/operation-index-types.ts
+const DRIVE_COLLECTION_PREFIX = "drive.";
+/**
+* Identifies the collection a remote synchronizes. Collections are drive-level
+* abstractions (document-drive and reactor-drive), so a collection id is the
+* drive document id plus the branch it scopes to rather than an opaque string.
+*
+* The canonical string form (`drive.${branch}.${driveId}`) is produced only by
+* `key` and parsed only by `fromKey`; that string is the wire and storage
+* representation and is byte-for-byte identical to the legacy
+* `driveCollectionId(branch, driveId)` output, so existing `document_collections`
+* rows and persisted remotes remain valid without migration.
+*/
+var DriveCollectionId = class DriveCollectionId {
+	driveId;
+	branch;
+	constructor(driveId, branch) {
+		this.driveId = driveId;
+		this.branch = branch;
+	}
+	static forDrive(driveId, branch = "main") {
+		return new DriveCollectionId(driveId, branch);
+	}
+	/**
+	* The single deserializer for the wire/storage form. `branch` may contain
+	* dots, while `driveId` is a dot-free document id, so the drive id is the
+	* final dot-delimited segment.
+	*/
+	static fromKey(key) {
+		if (!key.startsWith(DRIVE_COLLECTION_PREFIX)) throw new Error(`Unsupported collection id: ${key}`);
+		const rest = key.slice(6);
+		const lastDot = rest.lastIndexOf(".");
+		if (lastDot === -1 || lastDot === rest.length - 1) throw new Error(`Malformed drive collection id: ${key}`);
+		return new DriveCollectionId(rest.slice(lastDot + 1), rest.slice(0, lastDot));
+	}
+	get key() {
+		return `${DRIVE_COLLECTION_PREFIX}${this.branch}.${this.driveId}`;
+	}
+	toString() {
+		return this.key;
+	}
+	equals(other) {
+		return this.driveId === other.driveId && this.branch === other.branch;
+	}
+};
+//#endregion
 //#region src/decision/build-decision-model.ts
 /**
 * Reads each projection's stream through the supplied reader, recording the
@@ -690,34 +828,13 @@ function selectDecisionModel(flags, registry) {
 //#endregion
 //#region src/executor/util.ts
 /** Actions the reactor reduces itself, onto the document scope. */
-const DOCUMENT_SCOPE_ACTIONS = new Set([
-	"CREATE_DOCUMENT",
-	"DELETE_DOCUMENT",
-	"UPGRADE_DOCUMENT",
-	"ADD_RELATIONSHIP",
-	"REMOVE_RELATIONSHIP",
-	"UPDATE_RELATIONSHIP"
-]);
+const DOCUMENT_SCOPE_ACTIONS = DOCUMENT_SCOPE_ACTION_TYPES;
 /**
 * `CREATE_DOCUMENT` is exempt by necessity: it runs before the document exists,
 * so building a decision model would throw and defer the job forever.
 */
 const GATED_DOCUMENT_ACTIONS = new Set([...DOCUMENT_SCOPE_ACTIONS].filter((type) => type !== "CREATE_DOCUMENT"));
 /**
-* The document a document-scope action writes to, which is not always the job's
-* own document: delete and upgrade name it in `input.documentId`, and the
-* relationship actions in `input.sourceId`. `execute` only checks that a batch
-* shares one scope, so a caller can submit an action whose target is a document
-* other than the one the job is keyed by. The policy gate has to follow the
-* action rather than the job, or it decides against a policy the caller may
-* control instead of the one guarding the write.
-*/
-function targetDocumentId(action, fallback) {
-	const input = action.input;
-	if (action.type === "ADD_RELATIONSHIP" || action.type === "REMOVE_RELATIONSHIP" || action.type === "UPDATE_RELATIONSHIP") return typeof input?.sourceId === "string" && input.sourceId.length > 0 ? input.sourceId : fallback;
-	return typeof input?.documentId === "string" && input.documentId.length > 0 ? input.documentId : fallback;
-}
-/**
 * Creates a PHDocument from a CREATE_DOCUMENT action input.
 * Reconstructs the document header and initializes the base state.
 *
@@ -896,6 +1013,40 @@ var TouchedStreams = class {
 		return this.streams.values();
 	}
 };
+/**
+* The ids of the actions the caller handed to a job. Load and reevaluation
+* jobs write operations nobody submitted, so they report none.
+*/
+function submittedActionIds(job) {
+	return job.kind === "mutation" ? job.actions.map((action) => action.id) : [];
+}
+/**
+* Reports what became of each submitted action.
+*
+* A job's operations can include ones it only moved to a new index, so only
+* those carrying a submitted action are reported. Returns undefined when the
+* job submitted nothing, which keeps `JobInfo.result` null for the jobs that
+* have no caller to answer to.
+*/
+function summarizeSubmittedActions(operations, submitted) {
+	if (!submitted || submitted.length === 0) return;
+	const ids = new Set(submitted);
+	const actions = [];
+	for (const { operation, context } of operations) {
+		if (!ids.has(operation.action.id)) continue;
+		actions.push({
+			actionId: operation.action.id,
+			scope: context.scope,
+			index: operation.index,
+			...operationOutcome(operation)
+		});
+	}
+	if (actions.length === 0) return;
+	return {
+		actions,
+		allApplied: actions.every((action) => action.kind === "applied")
+	};
+}
 //#endregion
 //#region src/registry/errors.ts
 /**
@@ -993,6 +1144,7 @@ const JobExecutorEventTypes = {
 //#endregion
 //#region src/cache/collection-membership-cache.ts
 var CollectionMembershipCache = class CollectionMembershipCache {
+	operationIndex;
 	cache = /* @__PURE__ */ new Map();
 	constructor(operationIndex) {
 		this.operationIndex = operationIndex;
@@ -1206,10 +1358,231 @@ var DocumentMetaCache = class DocumentMetaCache {
 		return {
 			state: document.state.document,
 			documentType,
+			protocolVersions: createAction.input.protocolVersions,
 			documentScopeRevision: documentScopeRevision + 1
 		};
 	}
 };
+//#endregion
+//#region src/catch-up/settled-watermark.ts
+const MAX_PENDING_PROBES = 64;
+/** pg_sequence_last_value needs 10; pg_current_* replaced txid_* in 13. */
+function snapshotFunctionsFor(serverVersionNum) {
+	if (serverVersionNum >= 13e4) return {
+		snapshot: "pg_current_snapshot",
+		currentXid: "pg_current_xact_id",
+		xidIfAssigned: "pg_current_xact_id_if_assigned"
+	};
+	if (serverVersionNum >= 1e5) return {
+		snapshot: "txid_current_snapshot",
+		currentXid: "txid_current",
+		xidIfAssigned: "txid_current_if_assigned"
+	};
+	throw new Error(`PostgreSQL server_version_num ${serverVersionNum} is not supported: read-side catch-up needs 10 or later`);
+}
+/** Parses the `xmin:xmax:xip,...` text form of a snapshot. */
+function parseSnapshot(text) {
+	const parts = text.split(":");
+	if (parts.length !== 3) throw new Error(`Malformed snapshot: ${text}`);
+	const [xmin, xmax, xip] = parts;
+	return {
+		xmin: BigInt(xmin),
+		xmax: BigInt(xmax),
+		xip: xip === "" ? [] : xip.split(",").map((xid) => BigInt(xid))
+	};
+}
+async function readSnapshotFunctions(db) {
+	const result = await sql`select current_setting('server_version_num') as version`.execute(db);
+	return snapshotFunctionsFor(Number(result.rows[0].version));
+}
+/** A probe settles once an xmin passes the xid it took after its head. */
+var ProbeSettler = class {
+	settled = 0;
+	lastHead = 0;
+	covered = 0;
+	lastXip = [];
+	pending = [];
+	get settledThrough() {
+		return this.settled;
+	}
+	get head() {
+		return this.lastHead;
+	}
+	/** The highest head a settled or pending probe covers. */
+	get probedHead() {
+		return this.covered;
+	}
+	observe(head, xid, snapshot, nowUtcMs) {
+		this.lastHead = Math.max(this.lastHead, head);
+		this.lastXip = snapshot.xip;
+		if (xid !== null && head > this.covered) {
+			this.covered = head;
+			this.pending.push({
+				head,
+				xid,
+				takenAtUtcMs: nowUtcMs
+			});
+			if (this.pending.length > MAX_PENDING_PROBES) this.pending.shift();
+		}
+		const stillPending = [];
+		for (const probe of this.pending) if (snapshot.xmin > probe.xid) this.settled = Math.max(this.settled, probe.head);
+		else stillPending.push(probe);
+		this.pending = stillPending.filter((probe) => probe.head > this.settled);
+		return this.settled;
+	}
+	/** Xids an unsettled probe still waits on. */
+	waitingOn() {
+		if (this.pending.length === 0) return [];
+		const xid = this.pending[0].xid;
+		return this.lastXip.filter((open) => open < xid).map((open) => open.toString());
+	}
+	stalledSinceUtcMs() {
+		return this.pending[0]?.takenAtUtcMs;
+	}
+};
+function operationIndexTableName(db) {
+	const from = db.selectFrom("operation_index_operations").selectAll().toOperationNode().from?.froms[0];
+	const schema = from !== void 0 && TableNode.is(from) ? from.table.schema?.name : void 0;
+	const quote = (identifier) => `"${identifier.replace(/"/g, "\"\"")}"`;
+	return schema === void 0 ? quote("operation_index_operations") : `${quote(schema)}.${quote("operation_index_operations")}`;
+}
+/** Reads the head, takes and commits an xid, then reads a snapshot, in order. */
+function createKyselyWatermarkProbe(db) {
+	let resolved = null;
+	const resolve = async () => {
+		const fns = await readSnapshotFunctions(db);
+		const table = operationIndexTableName(db);
+		const sequence = (await sql`select pg_get_serial_sequence(${table}, 'ordinal') as sequence`.execute(db)).rows[0]?.sequence;
+		if (!sequence) throw new Error(`No ordinal sequence found for ${table}`);
+		return {
+			fns,
+			sequence
+		};
+	};
+	return async (probedHead) => {
+		resolved ??= resolve().catch((error) => {
+			resolved = null;
+			throw error;
+		});
+		const { fns, sequence } = await resolved;
+		const headRow = (await sql`select coalesce(pg_sequence_last_value(${sequence}::regclass), 0) as head, ${sql.raw(fns.xidIfAssigned)}() is null as outside_write`.execute(db)).rows[0];
+		const head = Number(headRow.head);
+		let xid = null;
+		if (headRow.outside_write && head > probedHead) {
+			const xidResult = await sql`select ${sql.raw(fns.currentXid)}()::text as xid`.execute(db);
+			xid = BigInt(xidResult.rows[0].xid);
+		}
+		const row = (await sql`select ${sql.raw(fns.snapshot)}()::text as snapshot, ${sql.raw(fns.xidIfAssigned)}() is null as outside_write`.execute(db)).rows[0];
+		return {
+			head,
+			xid,
+			snapshot: parseSnapshot(row.snapshot),
+			outsideWrite: headRow.outside_write && row.outside_write
+		};
+	};
+}
+/** Knows when an ordinal gap is final by asking which transactions are open. */
+var SettledWatermark = class {
+	probe;
+	logger;
+	now;
+	settler = new ProbeSettler();
+	listeners = /* @__PURE__ */ new Set();
+	current;
+	next;
+	warnedInsideWrite = false;
+	constructor(probe, logger, now = Date.now) {
+		this.probe = probe;
+		this.logger = logger;
+		this.now = now;
+	}
+	get settledThrough() {
+		return this.settler.settledThrough;
+	}
+	refresh(signal) {
+		signal?.throwIfAborted();
+		if (this.next !== void 0) return this.next;
+		if (this.current === void 0) return this.start();
+		const next = this.current.catch(() => this.settledThrough).then(() => {
+			this.next = void 0;
+			return this.start();
+		});
+		this.next = next;
+		return next;
+	}
+	onAdvance(listener) {
+		this.listeners.add(listener);
+		return () => {
+			this.listeners.delete(listener);
+		};
+	}
+	status() {
+		const stalledSinceUtcMs = this.settler.head > this.settledThrough ? this.settler.stalledSinceUtcMs() : void 0;
+		return {
+			head: this.settler.head,
+			settledThrough: this.settledThrough,
+			waitingOn: this.settler.waitingOn(),
+			...stalledSinceUtcMs !== void 0 ? { stalledSinceUtcMs } : {}
+		};
+	}
+	start() {
+		const run = this.probeOnce().finally(() => {
+			if (this.current === run) this.current = void 0;
+		});
+		this.current = run;
+		return run;
+	}
+	async probeOnce() {
+		const reading = await this.probe(this.settler.probedHead);
+		if (!reading.outsideWrite) {
+			if (!this.warnedInsideWrite) {
+				this.warnedInsideWrite = true;
+				this.logger.warn("settled watermark probe ran inside another session's write transaction; discarded");
+			}
+			return this.settledThrough;
+		}
+		const before = this.settledThrough;
+		const after = this.settler.observe(reading.head, reading.xid, reading.snapshot, this.now());
+		if (after > before) for (const listener of this.listeners) try {
+			listener(after);
+		} catch (error) {
+			this.logger.error("settled watermark listener failed: @error", error);
+		}
+		return after;
+	}
+};
+/** Sessions holding these xids open; empty without pg_stat_activity. */
+async function describeWaitingSessions(db, xids) {
+	if (xids.length === 0) return [];
+	const epochless = xids.map((xid) => (BigInt(xid) % 2n ** 32n).toString());
+	try {
+		return (await sql`select pid, application_name, state, xact_start, backend_xid::text as xid
+       from pg_stat_activity
+       where backend_xid::text in (${sql.join(epochless)})`.execute(db)).rows.map((row) => ({
+			pid: Number(row.pid),
+			applicationName: row.application_name ?? "",
+			state: row.state ?? "",
+			xactStart: row.xact_start === null ? null : new Date(row.xact_start).toISOString(),
+			xid: row.xid
+		}));
+	} catch {
+		return [];
+	}
+}
+/** Bind slots per statement: 16-bit on the wire, read signed in-process. */
+const MAX_BIND_PARAMETERS = 32767;
+/** Splits rows into runs that each bind at most MAX_BIND_PARAMETERS. */
+function chunkRows(rows) {
+	if (rows.length === 0) return [];
+	const columnsPerRow = Math.max(1, Object.keys(rows[0]).length);
+	const perChunk = Math.max(1, Math.floor(MAX_BIND_PARAMETERS / columnsPerRow));
+	if (rows.length <= perChunk) return [rows];
+	const chunks = [];
+	for (let i = 0; i < rows.length; i += perChunk) chunks.push(rows.slice(i, i + perChunk));
+	return chunks;
+}
+/** Per database: the function that assigns the transaction's xid. */
+const xidFunctions = /* @__PURE__ */ new WeakMap();
 var KyselyOperationIndexTxn = class {
 	collections = [];
 	collectionMemberships = [];
@@ -1275,6 +1648,7 @@ var KyselyOperationIndexTxn = class {
 	}
 };
 var KyselyOperationIndex = class KyselyOperationIndex {
+	db;
 	trx;
 	constructor(db) {
 		this.db = db;
@@ -1331,10 +1705,11 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 				leftOrdinal: null
 			}));
 			for (const collectionId of collections) kyselyTxn.recordMembershipInvalidation(collectionId);
-			await trx.insertInto("document_collections").values(collectionRows).onConflict((oc) => oc.doNothing()).execute();
+			for (const chunk of chunkRows(collectionRows)) await trx.insertInto("document_collections").values(chunk).onConflict((oc) => oc.doNothing()).execute();
 		}
 		let operationOrdinals = [];
 		if (operations.length > 0) {
+			await this.assignXid(trx);
 			const operationRows = operations.map((op) => ({
 				opId: op.id || "",
 				documentId: op.documentId,
@@ -1349,7 +1724,10 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 				deniedReason: op.deniedReason ?? null,
 				sourceRemote: op.sourceRemote
 			}));
-			operationOrdinals = (await trx.insertInto("operation_index_operations").values(operationRows).returning("ordinal").execute()).map((row) => row.ordinal);
+			for (const chunk of chunkRows(operationRows)) {
+				const insertedOps = await trx.insertInto("operation_index_operations").values(chunk).returning("ordinal").execute();
+				operationOrdinals = operationOrdinals.concat(insertedOps.map((row) => row.ordinal));
+			}
 		}
 		if (memberships.length > 0) for (const m of memberships) {
 			const ordinal = operationOrdinals[m.operationIndex];
@@ -1382,10 +1760,37 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 		}
 		return operationOrdinals;
 	}
+	async getOrdinalsInRange(after, through, limit, signal) {
+		signal?.throwIfAborted();
+		if (through <= after || limit <= 0) return [];
+		return (await this.queryExecutor.selectFrom("operation_index_operations").select("ordinal").where("ordinal", ">", after).where("ordinal", "<=", through).orderBy("ordinal", "asc").limit(limit).execute()).map((row) => Number(row.ordinal));
+	}
+	async getByOrdinals(ordinals, signal) {
+		signal?.throwIfAborted();
+		if (ordinals.length === 0) return [];
+		const results = [];
+		for (let i = 0; i < ordinals.length; i += MAX_BIND_PARAMETERS) {
+			const chunk = ordinals.slice(i, i + MAX_BIND_PARAMETERS);
+			const rows = await this.queryExecutor.selectFrom("operation_index_operations").selectAll().where("ordinal", "in", chunk).orderBy("ordinal", "asc").execute();
+			for (const row of rows) results.push(this.rowToOperationWithContext(row));
+		}
+		results.sort((a, b) => a.context.ordinal - b.context.ordinal);
+		return results;
+	}
+	async getStreamAfter(stream, after, signal) {
+		signal?.throwIfAborted();
+		return (await this.queryExecutor.selectFrom("operation_index_operations").selectAll().where("documentId", "=", stream.documentId).where("branch", "=", stream.branch).where("scope", "=", stream.scope).where("ordinal", ">", after).orderBy("ordinal", "asc").execute()).map((row) => this.rowToOperationWithContext(row));
+	}
 	async getGroupReferencers(groupId, signal) {
 		if (signal?.aborted) throw new Error("Operation aborted");
 		return (await this.queryExecutor.selectFrom("group_references").select("documentId").where("groupId", "=", groupId).orderBy("documentId").execute()).map((row) => row.documentId);
 	}
+	async getOrdinalsByOpIds(documentId, scope, branch, opIds, signal) {
+		signal?.throwIfAborted();
+		if (opIds.length === 0) return /* @__PURE__ */ new Map();
+		const rows = await this.queryExecutor.selectFrom("operation_index_operations").select("opId").select((eb) => eb.fn.max("ordinal").as("ordinal")).where("documentId", "=", documentId).where("branch", "=", branch).where("scope", "=", scope).where("opId", "in", opIds).groupBy("opId").execute();
+		return new Map(rows.map((row) => [row.opId, Number(row.ordinal)]));
+	}
 	async find(collectionId, cursor, view, paging, signal) {
 		if (signal?.aborted) throw new Error("Operation aborted");
 		const outerCursor = cursor ?? -1;
@@ -1399,6 +1804,7 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 			if (view?.branch) qb = qb.where("oi.branch", "=", view.branch);
 			if (view?.scopes && view.scopes.length > 0) qb = qb.where("oi.scope", "in", view.scopes);
 			if (view?.excludeSourceRemote) qb = qb.where("oi.sourceRemote", "!=", view.excludeSourceRemote);
+			if (view?.throughOrdinal !== void 0) qb = qb.where("oi.ordinal", "<=", view.throughOrdinal).where("dc.joinedOrdinal", "<=", BigInt(view.throughOrdinal));
 			return qb;
 		};
 		const rows = await buildBranch("joiner").unionAll(buildBranch("newOps")).orderBy("ordinal", "asc").limit(limit + 1).execute();
@@ -1487,6 +1893,17 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 			}, signal) : void 0
 		};
 	}
+	/** Takes the xid before the first ordinal, as the settled watermark needs. */
+	async assignXid(trx) {
+		let fn = xidFunctions.get(this.db);
+		if (fn === void 0) {
+			fn = readSnapshotFunctions(trx).then((fns) => fns.currentXid);
+			xidFunctions.set(this.db, fn);
+			fn.catch(() => xidFunctions.delete(this.db));
+		}
+		const name = await fn;
+		await sql`select ${sql.raw(name)}()`.execute(trx);
+	}
 	rowToOperationWithContext(row) {
 		return {
 			operation: {
@@ -1605,21 +2022,6 @@ var RingBuffer = class {
 	}
 };
 //#endregion
-//#region src/cache/write-cache-types.ts
-/**
-* Where a snapshot sits in its stream.
-*
-* - `Head`: the newest revision of the stream when it was stored. Only these
-*   can answer a read that asks for the head.
-* - `Historical`: state at an earlier revision. Usable as a starting point to
-*   replay forward from, and as an answer to a read for that same revision.
-*/
-let SnapshotPosition = /* @__PURE__ */ function(SnapshotPosition) {
-	SnapshotPosition["Head"] = "head";
-	SnapshotPosition["Historical"] = "historical";
-	return SnapshotPosition;
-}({});
-//#endregion
 //#region src/cache/kysely-write-cache.ts
 /**
 * The last operation index a keyframe's document reflects for the scope. A
@@ -1758,13 +2160,13 @@ var KyselyWriteCache = class KyselyWriteCache {
 			const snapshots = stream.ringBuffer.getAll();
 			if (targetRevision === void 0) {
 				const newest = highestRevision(snapshots);
-				if (newest?.position === SnapshotPosition.Head) {
+				if (newest?.position === "head") {
 					this.lruTracker.touch(streamKey);
 					return copyDocument(newest.document);
 				}
 				if (newest) {
 					const document = await this.warmMissRebuild(newest.document, newest.revision, documentId, scope, branch, void 0, signal);
-					this.store(documentId, scope, branch, (document.header.revision[scope] ?? 0) - 1, document, SnapshotPosition.Head);
+					this.store(documentId, scope, branch, (document.header.revision[scope] ?? 0) - 1, document, "head");
 					this.lruTracker.touch(streamKey);
 					return document;
 				}
@@ -1777,7 +2179,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 				const newestOlder = this.findNearestOlderSnapshot(snapshots, targetRevision);
 				if (newestOlder) {
 					const document = await this.warmMissRebuild(newestOlder.document, newestOlder.revision, documentId, scope, branch, targetRevision, signal);
-					this.store(documentId, scope, branch, targetRevision, document, SnapshotPosition.Historical);
+					this.store(documentId, scope, branch, targetRevision, document, "historical");
 					this.lruTracker.touch(streamKey);
 					return document;
 				}
@@ -1785,7 +2187,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 		}
 		const document = await this.coldMissRebuild(documentId, scope, branch, targetRevision, signal);
 		const revision = targetRevision ?? (document.header.revision[scope] ?? 0) - 1;
-		this.store(documentId, scope, branch, revision, document, targetRevision === void 0 ? SnapshotPosition.Head : SnapshotPosition.Historical);
+		this.store(documentId, scope, branch, revision, document, targetRevision === void 0 ? "head" : "historical");
 		return document;
 	}
 	/**
@@ -1820,7 +2222,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 		if (run.length === 0) return;
 		for (const entry of run.slice(0, -1)) this.persistKeyframe(documentId, scope, branch, entry.revision, entry.document);
 		const head = run[run.length - 1];
-		this.store(documentId, scope, branch, head.revision, head.document, SnapshotPosition.Head);
+		this.store(documentId, scope, branch, head.revision, head.document, "head");
 	}
 	store(documentId, scope, branch, revision, document, position) {
 		const streamKey = this.makeStreamKey(documentId, scope, branch);
@@ -1924,9 +2326,9 @@ var KyselyWriteCache = class KyselyWriteCache {
 	* the last replayed operation are applied at the end. Creation-time 0->N seed
 	* upgrades carry the initial state, so they still apply immediately.
 	*/
-	async coldMissRebuild(documentId, scope, branch, targetRevision, signal) {
+	async coldMissRebuild(documentId, scope, branch, targetRevision, signal, fromKeyframe = true) {
 		const effectiveTargetRevision = targetRevision || Number.MAX_SAFE_INTEGER;
-		const keyframe = await this.findNearestKeyframe(documentId, scope, branch, effectiveTargetRevision, signal);
+		const keyframe = fromKeyframe ? await this.findNearestKeyframe(documentId, scope, branch, effectiveTargetRevision, signal) : void 0;
 		const documentScopeBound = scope === "document" ? targetRevision : void 0;
 		let document;
 		let startRevision;
@@ -2026,10 +2428,10 @@ var KyselyWriteCache = class KyselyWriteCache {
 					for (const pending of pendingUpgrades) pending.subsequentDeletes.push(operation.action);
 				} else {
 					const protocolVersion = baseReducerVersion(document.header);
-					document = docModule.reducer(document, operation.action, void 0, {
+					document = withProtocolVersions(docModule.reducer(document, operation.action, void 0, {
 						skip: operation.skip,
 						protocolVersion
-					});
+					}), document.header.protocolVersions);
 				}
 			}
 		}
@@ -2063,6 +2465,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 		let cursor = void 0;
 		const pageSize = 100;
 		let hasMorePages;
+		let needsFullReplay = false;
 		do {
 			if (signal?.aborted) throw new Error("Operation aborted");
 			const paging = {
@@ -2073,26 +2476,31 @@ var KyselyWriteCache = class KyselyWriteCache {
 				const result = await this.operationStore.getSince(documentId, scope, branch, startRevision, void 0, paging, signal);
 				for (const operation of result.results) {
 					if (targetRevision !== void 0 && operation.index > targetRevision) break;
+					if (keyframe && operation.skip > 0) {
+						needsFullReplay = true;
+						break;
+					}
 					const moduleVersion = this.resolveModuleVersionForOp(operation.index, operation.timestampUtcMs, scope, validatedUpgrades, finalVersion);
 					document = this.applyPendingUpgrades(document, pendingUpgrades, moduleVersion ?? Number.MAX_SAFE_INTEGER);
 					if (isDenied(operation)) document = appendWithoutApplying(document, operation, scope);
 					else {
 						const protocolVersion = baseReducerVersion(document.header);
-						document = getModuleCached(moduleVersion).reducer(document, operation.action, void 0, {
+						document = withProtocolVersions(getModuleCached(moduleVersion).reducer(document, operation.action, void 0, {
 							skip: operation.skip,
 							protocolVersion,
 							replayOptions: { operation },
 							skipIndexValidation: true
-						});
+						}), document.header.protocolVersions);
 					}
 				}
 				const reachedTarget = targetRevision !== void 0 && result.results.some((op) => op.index >= targetRevision);
-				hasMorePages = Boolean(result.nextCursor) && !reachedTarget;
+				hasMorePages = Boolean(result.nextCursor) && !reachedTarget && !needsFullReplay;
 				if (hasMorePages) cursor = result.nextCursor;
 			} catch (err) {
 				throw new Error(`Failed to rebuild document ${documentId}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
 			}
 		} while (hasMorePages);
+		if (needsFullReplay) return this.coldMissRebuild(documentId, scope, branch, targetRevision, signal, false);
 		document = this.applyTailPendingUpgrades(document, pendingUpgrades, scope, targetRevision);
 		document = await this.stampRevisions(document, documentId, scope, branch, targetRevision, signal);
 		if (pendingUpgrades.length > 0) {
@@ -2199,26 +2607,32 @@ var KyselyWriteCache = class KyselyWriteCache {
 		if ((await this.operationStore.getSince(documentId, "document", branch, docScopeNextIndex - 1, void 0, void 0, signal)).results.length > 0) return this.coldMissRebuild(documentId, scope, branch, targetRevision, signal);
 		const module = this.registry.getModule(documentType, extractModuleVersion(baseDocument));
 		let document = copyDocument(baseDocument);
+		let needsFullReplay = false;
 		try {
 			const pagedResults = await this.operationStore.getSince(documentId, scope, branch, baseRevision, void 0, void 0, signal);
 			for (const operation of pagedResults.results) {
 				if (signal?.aborted) throw new Error("Operation aborted");
 				if (targetRevision !== void 0 && operation.index > targetRevision) break;
+				if (operation.skip > 0) {
+					needsFullReplay = true;
+					break;
+				}
 				if (isDenied(operation)) document = appendWithoutApplying(document, operation, scope);
 				else {
 					const protocolVersion = baseReducerVersion(document.header);
-					document = module.reducer(document, operation.action, void 0, {
+					document = withProtocolVersions(module.reducer(document, operation.action, void 0, {
 						skip: operation.skip,
 						protocolVersion,
 						replayOptions: { operation },
 						skipIndexValidation: true
-					});
+					}), document.header.protocolVersions);
 				}
 				if (targetRevision !== void 0 && operation.index === targetRevision) break;
 			}
 		} catch (err) {
 			throw new Error(`Failed to rebuild document ${documentId}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
 		}
+		if (needsFullReplay) return this.coldMissRebuild(documentId, scope, branch, targetRevision, signal, false);
 		const revisions = await this.operationStore.getRevisions(documentId, branch, signal);
 		document.header.revision = revisions.revision;
 		if (targetRevision !== void 0) document.header.revision = {
@@ -2339,6 +2753,11 @@ function validateFeatureFlags(flags, prerequisites) {
 //#endregion
 //#region src/executor/execution-scope.ts
 var DefaultExecutionScope = class {
+	operationStore;
+	operationIndex;
+	writeCache;
+	documentMetaCache;
+	collectionMembershipCache;
 	constructor(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache) {
 		this.operationStore = operationStore;
 		this.operationIndex = operationIndex;
@@ -2358,6 +2777,13 @@ var DefaultExecutionScope = class {
 	}
 };
 var KyselyExecutionScope = class {
+	db;
+	operationStore;
+	operationIndex;
+	keyframeStore;
+	writeCache;
+	documentMetaCache;
+	collectionMembershipCache;
 	constructor(db, operationStore, operationIndex, keyframeStore, writeCache, documentMetaCache, collectionMembershipCache) {
 		this.db = db;
 		this.operationStore = operationStore;
@@ -2385,7 +2811,7 @@ var KyselyExecutionScope = class {
 };
 //#endregion
 //#region src/utils/reshuffle.ts
-const STRICT_ORDER_ACTION_TYPES = new Set([
+const STRICT_ORDER_ACTION_TYPES = /* @__PURE__ */ new Set([
 	"CREATE_DOCUMENT",
 	"DELETE_DOCUMENT",
 	"UPGRADE_DOCUMENT",
@@ -2702,58 +3128,36 @@ async function evaluateByPosition(model, target, subject, stores, signal) {
 	return operations.map((operation) => reasons.get(operation.id));
 }
 //#endregion
-//#region src/cache/operation-index-types.ts
-const DRIVE_COLLECTION_PREFIX = "drive.";
-/**
-* Identifies the collection a remote synchronizes. Collections are drive-level
-* abstractions (document-drive and reactor-drive), so a collection id is the
-* drive document id plus the branch it scopes to rather than an opaque string.
-*
-* The canonical string form (`drive.${branch}.${driveId}`) is produced only by
-* `key` and parsed only by `fromKey`; that string is the wire and storage
-* representation and is byte-for-byte identical to the legacy
-* `driveCollectionId(branch, driveId)` output, so existing `document_collections`
-* rows and persisted remotes remain valid without migration.
-*/
-var DriveCollectionId = class DriveCollectionId {
-	constructor(driveId, branch) {
-		this.driveId = driveId;
-		this.branch = branch;
-	}
-	static forDrive(driveId, branch = "main") {
-		return new DriveCollectionId(driveId, branch);
-	}
-	/**
-	* The single deserializer for the wire/storage form. `branch` may contain
-	* dots, while `driveId` is a dot-free document id, so the drive id is the
-	* final dot-delimited segment.
-	*/
-	static fromKey(key) {
-		if (!key.startsWith(DRIVE_COLLECTION_PREFIX)) throw new Error(`Unsupported collection id: ${key}`);
-		const rest = key.slice(6);
-		const lastDot = rest.lastIndexOf(".");
-		if (lastDot === -1 || lastDot === rest.length - 1) throw new Error(`Malformed drive collection id: ${key}`);
-		return new DriveCollectionId(rest.slice(lastDot + 1), rest.slice(0, lastDot));
-	}
-	get key() {
-		return `${DRIVE_COLLECTION_PREFIX}${this.branch}.${this.driveId}`;
-	}
-	toString() {
-		return this.key;
-	}
-	equals(other) {
-		return this.driveId === other.driveId && this.branch === other.branch;
-	}
-};
-//#endregion
 //#region src/executor/document-action-handler.ts
 var DocumentActionHandler = class {
-	constructor(registry, logger, driveContainerTypes, featureFlags, decisionModel) {
+	registry;
+	logger;
+	driveContainerTypes;
+	featureFlags;
+	decisionModel;
+	protocolSupport;
+	loggedUnregisteredProtocols = /* @__PURE__ */ new Set();
+	constructor(registry, logger, driveContainerTypes, featureFlags, decisionModel, protocolSupport) {
 		this.registry = registry;
 		this.logger = logger;
 		this.driveContainerTypes = driveContainerTypes;
 		this.featureFlags = featureFlags;
 		this.decisionModel = decisionModel;
+		this.protocolSupport = protocolSupport;
+	}
+	/** Keys this reactor does not register are admitted: it cannot judge them. */
+	unsupportedProtocol(documentId, protocolVersions) {
+		for (const [protocol, version] of Object.entries(protocolVersions ?? {})) {
+			const supported = this.protocolSupport[protocol];
+			if (supported === void 0) {
+				if (!this.loggedUnregisteredProtocols.has(protocol)) {
+					this.loggedUnregisteredProtocols.add(protocol);
+					this.logger.info("Admitting document @documentId with unregistered protocol @protocol @version", documentId, protocol, version);
+				}
+				continue;
+			}
+			if (!supported.includes(version)) return new UnsupportedProtocolVersionError(documentId, protocol, version);
+		}
 	}
 	/** Whether the write arrives with its evaluation already decided. */
 	alreadyEvaluated(executing) {
@@ -2840,7 +3244,7 @@ var DocumentActionHandler = class {
 			[job.scope]: [...standing.operations[job.scope] ?? [], operation]
 		};
 		executing.touchedStreams.add(job.documentId, job.scope, job.branch);
-		stores.writeCache.putState(job.documentId, job.scope, job.branch, operation.index, standing, SnapshotPosition.Head);
+		stores.writeCache.putState(job.documentId, job.scope, job.branch, operation.index, standing, "head");
 		indexTxn.write([{
 			...operation,
 			documentId: job.documentId,
@@ -2852,6 +3256,7 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(job.documentId, job.branch, {
 			state: standing.state.document,
 			documentType: standing.header.documentType,
+			protocolVersions: standing.header.protocolVersions,
 			documentScopeRevision: operation.index + 1
 		});
 		return buildSuccessResult(job, operation, job.documentId, standing.header.documentType, JSON.stringify({
@@ -2868,6 +3273,9 @@ var DocumentActionHandler = class {
 			error: /* @__PURE__ */ new Error(`CREATE_DOCUMENT must be in "document" scope, got "${job.scope}"`),
 			duration: Date.now() - startTime
 		};
+		const input = action.input;
+		const unsupported = this.unsupportedProtocol(input.documentId, input.protocolVersions);
+		if (unsupported) return buildErrorResult(job, unsupported, startTime);
 		const document = createDocumentFromAction(action);
 		let operation = createOperation(action, 0, skip, {
 			documentId: document.header.id,
@@ -2875,8 +3283,8 @@ var DocumentActionHandler = class {
 			branch: job.branch
 		});
 		const resultingStateObj = {
-			header: document.header,
-			...document.state
+			...document.state,
+			header: document.header
 		};
 		const resultingState = JSON.stringify(resultingStateObj);
 		const writeResult = await this.writeOperationToStore({
@@ -2893,7 +3301,7 @@ var DocumentActionHandler = class {
 			[job.scope]: [...document.operations[job.scope] ?? [], operation]
 		};
 		executing.touchedStreams.add(document.header.id, job.scope, job.branch);
-		stores.writeCache.putState(document.header.id, job.scope, job.branch, operation.index, document, SnapshotPosition.Head);
+		stores.writeCache.putState(document.header.id, job.scope, job.branch, operation.index, document, "head");
 		indexTxn.write([{
 			...operation,
 			documentId: document.header.id,
@@ -2910,6 +3318,7 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(document.header.id, job.branch, {
 			state: document.state.document,
 			documentType: document.header.documentType,
+			protocolVersions: document.header.protocolVersions,
 			documentScopeRevision: 1
 		});
 		return buildSuccessResult(job, operation, document.header.id, document.header.documentType, resultingState, startTime);
@@ -2953,7 +3362,7 @@ var DocumentActionHandler = class {
 			[job.scope]: [...document.operations[job.scope] ?? [], operation]
 		};
 		executing.touchedStreams.add(documentId, job.scope, job.branch);
-		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, SnapshotPosition.Head);
+		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, "head");
 		indexTxn.write([{
 			...operation,
 			documentId,
@@ -2965,6 +3374,7 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(documentId, job.branch, {
 			state: document.state.document,
 			documentType: document.header.documentType,
+			protocolVersions: document.header.protocolVersions,
 			documentScopeRevision: operation.index + 1
 		});
 		return buildSuccessResult(job, operation, documentId, document.header.documentType, resultingState, startTime);
@@ -3003,7 +3413,7 @@ var DocumentActionHandler = class {
 				} catch (error) {
 					return buildErrorResult(job, /* @__PURE__ */ new Error(`Failed to fetch revisions for upgrade: ${error instanceof Error ? error.message : String(error)}`), startTime);
 				}
-				const revisionScopes = new Set([...Object.keys(input.revision), ...Object.keys(actualRevisions)]);
+				const revisionScopes = /* @__PURE__ */ new Set([...Object.keys(input.revision), ...Object.keys(actualRevisions)]);
 				for (const revisionScope of revisionScopes) {
 					const snapshot = input.revision[revisionScope] ?? 0;
 					const actual = actualRevisions[revisionScope] ?? 0;
@@ -3045,8 +3455,8 @@ var DocumentActionHandler = class {
 			branch: job.branch
 		});
 		const resultingStateObj = {
-			header: document.header,
-			...document.state
+			...document.state,
+			header: document.header
 		};
 		if (fromVersion > 0) resultingStateObj.__migrated = true;
 		const resultingState = JSON.stringify(resultingStateObj);
@@ -3064,7 +3474,7 @@ var DocumentActionHandler = class {
 			[job.scope]: [...document.operations[job.scope] ?? [], operation]
 		};
 		executing.touchedStreams.add(documentId, job.scope, job.branch);
-		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, SnapshotPosition.Head);
+		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, "head");
 		for (const scope of otherScopes) executing.postCommitInvalidations.push({
 			documentId,
 			scope,
@@ -3081,6 +3491,7 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(documentId, job.branch, {
 			state: document.state.document,
 			documentType: document.header.documentType,
+			protocolVersions: document.header.protocolVersions,
 			documentScopeRevision: operation.index + 1
 		});
 		return buildSuccessResult(job, operation, documentId, document.header.documentType, resultingState, startTime);
@@ -3150,7 +3561,7 @@ var DocumentActionHandler = class {
 		const resultingState = JSON.stringify(resultingStateObj);
 		executing.touchedStreams.add(input.sourceId, job.scope, job.branch);
 		executing.touchedStreams.add(input.targetId, job.scope, job.branch);
-		stores.writeCache.putState(input.sourceId, job.scope, job.branch, operation.index, sourceDoc, SnapshotPosition.Head);
+		stores.writeCache.putState(input.sourceId, job.scope, job.branch, operation.index, sourceDoc, "head");
 		indexTxn.write([{
 			...operation,
 			documentId: input.sourceId,
@@ -3169,6 +3580,7 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(input.sourceId, job.branch, {
 			state: sourceDoc.state.document,
 			documentType: sourceDoc.header.documentType,
+			protocolVersions: sourceDoc.header.protocolVersions,
 			documentScopeRevision: operation.index + 1
 		});
 		return buildSuccessResult(job, operation, input.sourceId, sourceDoc.header.documentType, resultingState, startTime);
@@ -3197,86 +3609,701 @@ var DocumentActionHandler = class {
 	}
 };
 //#endregion
-//#region src/executor/signature-verifier.ts
-var SignatureVerifier = class {
-	constructor(verifier) {
-		this.verifier = verifier;
-	}
-	async verifyActions(documentId, branch, actions) {
-		if (!this.verifier) return;
-		for (const action of actions) {
-			const signer = action.context?.signer;
-			if (!signer) continue;
-			if (signer.signatures.length === 0) throw new InvalidSignatureError(documentId, `Action ${action.id} has signer but no signatures`);
-			const publicKey = signer.app.key;
-			let isValid;
-			try {
-				const tempOperation = {
-					id: deriveOperationId(documentId, action.scope, branch, action.id),
-					index: 0,
-					timestampUtcMs: action.timestampUtcMs || (/* @__PURE__ */ new Date()).toISOString(),
-					hash: "",
-					skip: 0,
-					action
-				};
-				isValid = await this.verifier(tempOperation, publicKey);
-			} catch (error) {
-				const errorMessage = error instanceof Error ? error.message : String(error);
-				throw new InvalidSignatureError(documentId, `Action ${action.id} verification failed: ${errorMessage}`);
-			}
-			if (!isValid) throw new InvalidSignatureError(documentId, `Action ${action.id} signature verification returned false`);
-		}
+//#region src/signer/passthrough-signer.ts
+/**
+* A no-op signer that returns empty values for all methods.
+* Used when signing is not required.
+*/
+var PassthroughSigner = class {
+	publicKey = {};
+	sign() {
+		return Promise.resolve(/* @__PURE__ */ new Uint8Array(0));
 	}
-	async verifyOperations(documentId, operations) {
-		if (!this.verifier) return;
-		for (let i = 0; i < operations.length; i++) {
-			const operation = operations[i];
-			const signer = operation.action.context?.signer;
-			if (!signer) continue;
-			if (signer.signatures.length === 0) throw new InvalidSignatureError(documentId, `Operation ${operation.id} at index ${operation.index} has signer but no signatures`);
-			const publicKey = signer.app.key;
-			let isValid;
-			try {
-				isValid = await this.verifier(operation, publicKey);
-			} catch (error) {
-				const errorMessage = error instanceof Error ? error.message : String(error);
-				throw new InvalidSignatureError(documentId, `Operation ${operation.id} at index ${operation.index} verification failed: ${errorMessage}`);
-			}
-			if (!isValid) throw new InvalidSignatureError(documentId, `Operation ${operation.id} at index ${operation.index} signature verification returned false`);
-		}
+	verify() {
+		return Promise.resolve();
+	}
+	signAction() {
+		return Promise.resolve([
+			"",
+			"",
+			"",
+			"",
+			""
+		]);
 	}
 };
 //#endregion
-//#region src/executor/simple-job-executor.ts
-const MAX_SKIP_THRESHOLD = 1e3;
-const ISO_TIMESTAMP_REGEX = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/;
-function isValidISOTimestamp(value) {
-	if (!ISO_TIMESTAMP_REGEX.test(value)) return false;
-	return !isNaN(new Date(value).getTime());
-}
+//#region src/signer/trust-policy.ts
 /**
-* Carries a failed job out of the execution scope so its transaction rolls
-* back. A scope callback that returns commits, whatever result it returns, so
-* a returned failure would leave the writes the job made before it failed
-* standing. Never escapes executeJob: the failure goes back to being a
-* returned JobResult there, which is what the queue, the worker protocol and
-* every test expect a failed job to look like.
+* The policy admission asks: the reactor's own key signing as its own user is
+* accepted, then the host's policy decides, else the default does. `own` is
+* read on every ask, since its user changes on login.
 */
-var JobRollbackSignal = class extends Error {
-	constructor(result) {
+function admissionTrustPolicy(own, authEnforcement, policy) {
+	return { authorizeSigner(signer, key, documentId) {
+		const identity = actionSignerIdentity(own);
+		if (identity.app.key !== "" && key === identity.app.key) {
+			if (sameUser(actionSignerIdentity(signer).user, identity.user)) return Promise.resolve(true);
+		}
+		if (policy) return policy.authorizeSigner(signer, key, documentId);
+		return Promise.resolve(!authEnforcement);
+	} };
+}
+function sameUser(a, b) {
+	return a.address.toLowerCase() === b.address.toLowerCase() && a.networkId === b.networkId && a.chainId === b.chainId;
+}
+//#endregion
+//#region src/signer/did-key.ts
+const DID_KEY_PREFIX = "did:key:z";
+const P256_MULTICODEC = [128, 36];
+const MAX_CACHED_KEYS = 1024;
+const P = BigInt("0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff");
+const A = BigInt("0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc");
+const B = BigInt("0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b");
+/** A did:key that is not a compressed P-256 public key. */
+var MalformedDidKeyError = class extends Error {
+	constructor(did, detail) {
+		super(`Malformed did:key ${did}: ${detail}`);
+		this.name = "MalformedDidKeyError";
+	}
+};
+const keyCache = /* @__PURE__ */ new Map();
+/** Cached per process: decompressing the point costs a BigInt modPow. */
+async function importDidKey(did) {
+	const cached = keyCache.get(did);
+	if (cached) {
+		keyCache.delete(did);
+		keyCache.set(did, cached);
+		return cached;
+	}
+	const raw = decompressP256(compressedPointFromDid(did), did);
+	const key = await crypto.subtle.importKey("raw", raw.buffer, {
+		name: "ECDSA",
+		namedCurve: "P-256"
+	}, false, ["verify"]);
+	keyCache.set(did, key);
+	if (keyCache.size > MAX_CACHED_KEYS) {
+		const oldest = keyCache.keys().next().value;
+		if (oldest !== void 0) keyCache.delete(oldest);
+	}
+	return key;
+}
+function compressedPointFromDid(did) {
+	if (!did.startsWith(DID_KEY_PREFIX)) throw new MalformedDidKeyError(did, "not a base58btc did:key");
+	const decoded = base58Decode(did.slice(9));
+	if (!decoded || decoded.length !== 35) throw new MalformedDidKeyError(did, "not a compressed P-256 key");
+	if (decoded[0] !== P256_MULTICODEC[0] || decoded[1] !== P256_MULTICODEC[1]) throw new MalformedDidKeyError(did, "not a P-256 multicodec");
+	return decoded.subarray(2);
+}
+function decompressP256(compressed, did) {
+	const prefix = compressed[0];
+	if (prefix !== 2 && prefix !== 3) throw new MalformedDidKeyError(did, `compression prefix ${prefix}`);
+	let x = BigInt(0);
+	for (let i = 1; i < compressed.length; i++) x = x << BigInt(8) | BigInt(compressed[i]);
+	if (x >= P) throw new MalformedDidKeyError(did, "x outside the field");
+	const ySquared = (modPow(x, BigInt(3), P) + A * x + B) % P;
+	let y = modPow(ySquared, (P + BigInt(1)) / BigInt(4), P);
+	if (y * y % P !== ySquared) throw new MalformedDidKeyError(did, "x is not on the curve");
+	if (y % BigInt(2) === BigInt(0) !== (prefix === 2)) y = P - y;
+	const uncompressed = /* @__PURE__ */ new Uint8Array(65);
+	uncompressed[0] = 4;
+	uncompressed.set(bigIntToBytes(x), 1);
+	uncompressed.set(bigIntToBytes(y), 33);
+	return uncompressed;
+}
+function modPow(base, exp, mod) {
+	let result = BigInt(1);
+	let b = base % mod;
+	let e = exp;
+	while (e > BigInt(0)) {
+		if (e & BigInt(1)) result = result * b % mod;
+		e >>= BigInt(1);
+		b = b * b % mod;
+	}
+	return result;
+}
+function bigIntToBytes(value) {
+	const bytes = /* @__PURE__ */ new Uint8Array(32);
+	let v = value;
+	for (let i = 31; i >= 0; i--) {
+		bytes[i] = Number(v & BigInt(255));
+		v >>= BigInt(8);
+	}
+	return bytes;
+}
+//#endregion
+//#region src/signer/verify-action-signature.ts
+const RENOWN_HASH_LENGTH = 44;
+const SHARED_HASH_LENGTH = 28;
+const HEX_SIGNATURE = /^(0x)?([0-9a-fA-F]{2})+$/;
+/**
+* Integrity only: identity binding and the live-id check sit with the caller.
+* `operation` is the incoming operation at load admission.
+*/
+async function verifyActionSignature(action, target, path, operation) {
+	const policy = target.policy ?? "legacy";
+	const refusal = policyRefusal(action, policy);
+	if (refusal) return refusal;
+	const shape = signerShape(action.context?.signer);
+	if (shape.kind === "unsigned") return policy === "v2-required" ? refuse("unsigned", "UNSIGNED_REQUIRED", `action ${action.id} is unsigned but ${target.documentId} requires v2 signatures`) : {
+		ok: true,
+		scheme: "unsigned"
+	};
+	if (shape.kind === "malformed") return refuse("legacy-unknown", "MALFORMED_TUPLE", `action ${action.id} ${shape.reason}`);
+	const { signer, tuple } = shape;
+	const scheme = schemeOf(tuple[2]);
+	if (tuple[1] !== signer.app.key) return refuse(scheme, "KEY_MISMATCH", `action ${action.id} tuple key does not match signer.app.key`);
+	if (scheme !== "v2" && policy === "v2-required") return refuse(scheme, "SCHEME_BELOW_POLICY", `action ${action.id} carries a legacy tuple but ${target.documentId} requires v2 signatures`);
+	if (scheme === "legacy-unknown" && path === "mutation") return refuse(scheme, "MALFORMED_TUPLE", `action ${action.id} carries a hash of unknown length ${tuple[2].length}`);
+	if (scheme === "v2") {
+		const refusal = await checkV2(action, tuple, target, operation);
+		if (refusal) return refusal;
+	} else if (path === "mutation") {
+		if (await legacyHash(scheme, action, target) !== tuple[2]) return refuse(scheme, "HASH_MISMATCH", `action ${action.id} does not match the hash its signature covers`);
+	}
+	return verifyEcdsa(tuple, scheme, action.id);
+}
+/** Refusals a document's policy makes before any tuple is read. */
+function policyRefusal(action, policy) {
+	if (action.type !== "CREATE_DOCUMENT") return;
+	const scheme = schemeOfAction(action);
+	const input = action.input;
+	const documentId = input?.documentId ?? "";
+	if (policy === "legacy") return isDerivedDocumentId(documentId) ? refuse(scheme, "ID_MISMATCH", `action ${action.id}: a legacy document cannot take the content-addressed id ${documentId}`) : void 0;
+	const expected = derivedCreateId(input);
+	if (expected === documentId) return;
+	return refuse(scheme, "ID_MISMATCH", expected === void 0 ? `action ${action.id} creates v2-required ${documentId} without the header params its id is derived from` : `action ${action.id} creates v2-required ${documentId}, but its header params derive ${expected}`);
+}
+function derivedCreateId(input) {
+	if (!input?.signing || !input.protocolVersions) return;
+	try {
+		return deriveDocumentId({
+			documentType: input.model,
+			createdAtUtcIso: input.signing.createdAtUtcIso,
+			nonce: input.signing.nonce,
+			protocolVersions: input.protocolVersions
+		});
+	} catch {
+		return;
+	}
+}
+function schemeOfAction(action) {
+	const shape = signerShape(action.context?.signer);
+	if (shape.kind === "unsigned") return "unsigned";
+	return shape.kind === "signed" ? schemeOf(shape.tuple[2]) : "legacy-unknown";
+}
+/** Peers send arbitrary JSON, so nothing past `context` is assumed. */
+function signerShape(value) {
+	if (value === void 0 || value === null) return { kind: "unsigned" };
+	if (!isRecord(value)) return {
+		kind: "malformed",
+		reason: "has a signer that is not an object"
+	};
+	const { app, user, signatures } = value;
+	if (app !== void 0 && app !== null && !isRecord(app)) return {
+		kind: "malformed",
+		reason: "has a signer.app that is not an object"
+	};
+	const key = isRecord(app) ? app.key : void 0;
+	if (key !== void 0 && key !== null && typeof key !== "string") return {
+		kind: "malformed",
+		reason: "has a signer.app.key that is not a string"
+	};
+	if (!key) return { kind: "unsigned" };
+	if (!isRecord(user) || typeof user.address !== "string") return {
+		kind: "malformed",
+		reason: "has a signer without a user address"
+	};
+	if (!Array.isArray(signatures)) return {
+		kind: "malformed",
+		reason: "has a signer whose signatures are not a list"
+	};
+	const tuple = signatures.at(-1);
+	if (!isTuple(tuple)) return {
+		kind: "malformed",
+		reason: signatures.length === 0 ? "has a signer but no signatures" : "carries a malformed signature tuple"
+	};
+	return {
+		kind: "signed",
+		signer: value,
+		tuple
+	};
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function checkV2(action, tuple, target, operation) {
+	const problem = v2TupleProblem(tuple);
+	if (problem) return refuse("v2", "MALFORMED_TUPLE", `action ${action.id}: ${problem}`);
+	if (operation && !sameInstant(operation.timestampUtcMs, action.timestampUtcMs)) return refuse("v2", "TIMESTAMP_MISMATCH", `action ${action.id} is stamped ${action.timestampUtcMs} but its operation ${operation.timestampUtcMs}`);
+	let expected;
+	try {
+		expected = await hashActionV2(action, target, action.context.signer);
+	} catch (error) {
+		return refuse("v2", "HASH_MISMATCH", `action ${action.id} has no v2 hash: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (expected !== tuple[2]) return refuse("v2", "HASH_MISMATCH", `action ${action.id} does not match the hash its signature covers`);
+}
+function sameInstant(a, b) {
+	const left = Date.parse(a);
+	return !Number.isNaN(left) && left === Date.parse(b);
+}
+function schemeOf(hash) {
+	if (isV2ActionHash(hash)) return "v2";
+	if (hash.length === RENOWN_HASH_LENGTH) return "legacy-renown";
+	if (hash.length === SHARED_HASH_LENGTH) return "legacy-shared";
+	return "legacy-unknown";
+}
+async function legacyHash(scheme, action, target) {
+	if (scheme === "legacy-renown") {
+		const payload = [
+			action.scope,
+			action.type,
+			JSON.stringify(action.input)
+		].join("");
+		const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(payload));
+		return bytesToBase64(new Uint8Array(digest));
+	}
+	const signer = action.context.signer;
+	return buildOperationSignatureParams({
+		documentId: target.documentId,
+		signer,
+		action,
+		previousStateHash: ""
+	})[2];
+}
+async function verifyEcdsa(tuple, scheme, actionId) {
+	const [timestamp, key, hash, prevStateHash, signatureHex] = tuple;
+	if (!HEX_SIGNATURE.test(signatureHex)) return refuse(scheme, "MALFORMED_TUPLE", `action ${actionId} signature is not hex`);
+	let cryptoKey;
+	try {
+		cryptoKey = await importDidKey(key);
+	} catch (error) {
+		return refuse(scheme, "MALFORMED_TUPLE", `action ${actionId}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	const message = buildOperationSignatureMessage([
+		timestamp,
+		key,
+		hash,
+		prevStateHash
+	]);
+	let valid;
+	try {
+		valid = await crypto.subtle.verify({
+			name: "ECDSA",
+			hash: "SHA-256"
+		}, cryptoKey, hexToBytes(signatureHex).buffer, message.buffer);
+	} catch {
+		valid = false;
+	}
+	if (!valid) return refuse(scheme, "BAD_SIGNATURE", `action ${actionId} signature does not verify under its key`);
+	return {
+		ok: true,
+		scheme
+	};
+}
+function isTuple(value) {
+	return Array.isArray(value) && value.length === 5 && value.every((element) => typeof element === "string");
+}
+function refuse(scheme, code, reason) {
+	return {
+		ok: false,
+		scheme,
+		code,
+		reason
+	};
+}
+function hexToBytes(hex) {
+	const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
+	const bytes = new Uint8Array(clean.length / 2);
+	for (let i = 0; i < bytes.length; i++) bytes[i] = parseInt(clean.substring(i * 2, i * 2 + 2), 16);
+	return bytes;
+}
+function bytesToBase64(bytes) {
+	let binary = "";
+	for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+	return btoa(binary);
+}
+//#endregion
+//#region src/executor/synthesized-signing.ts
+/** Submitted types whose stored action the reducer writes in their place. */
+const SYNTHESIZING_TYPES = /* @__PURE__ */ new Set(["UNDO", "REDO"]);
+/**
+* The id of the action synthesized from `submittedId`. Derived, so the stored
+* operation answers for the submitted id at the live-id check.
+*/
+function synthesizedActionId(submittedId) {
+	return hashBrowser(`synthesized:${submittedId}`, "sha1", "hex").slice(0, 32);
+}
+/**
+* Whether `operation` stores an action the reducer made from `submitted`
+* rather than `submitted` itself or an operation already in `history`.
+*/
+function isSynthesized(submitted, operation, history) {
+	if (!SYNTHESIZING_TYPES.has(submitted.type)) return false;
+	const id = operation.action.id;
+	if (!id) return true;
+	if (id === submitted.id) return false;
+	return !history.some((existing) => existing.action.id === id);
+}
+/**
+* Signs the synthesized action of `operation` in place as `signer`, under the
+* id {@link synthesizedActionId} derives from the submitted one. A REDO's
+* rebuilt action has no timestamp, so it takes the submitted one; the
+* operation timestamp is set to the action's, which a peer requires of a v2
+* tuple.
+*/
+async function signSynthesized(operation, submitted, target, signer, signal) {
+	const synthesized = operation.action;
+	const id = synthesizedActionId(submitted.id);
+	const timestampUtcMs = operation.timestampUtcMs || synthesized.timestampUtcMs || submitted.timestampUtcMs;
+	const action = {
+		id,
+		timestampUtcMs,
+		type: synthesized.type,
+		input: synthesized.input,
+		scope: synthesized.scope
+	};
+	const signature = await signer.signAction(action, {
+		documentId: target.documentId,
+		branch: target.branch
+	}, signal);
+	operation.action = {
+		...action,
+		context: { signer: {
+			...actionSignerIdentity(signer),
+			signatures: [signature]
+		} }
+	};
+	operation.id = deriveOperationId(target.documentId, target.scope, target.branch, id);
+	operation.timestampUtcMs = timestampUtcMs;
+}
+//#endregion
+//#region src/executor/signature-admission.ts
+const DEFAULT_TRUST_TIMEOUT_MS = 1e4;
+/** Runs once per write, when this reactor first stores it; never on re-appends. */
+var SignatureAdmission = class {
+	mode;
+	logger;
+	eventBus;
+	policySource;
+	trustPolicy;
+	trustTimeoutMs;
+	constructor(mode, logger, eventBus, policySource = "meta", trust = {
+		authEnforcement: false,
+		timeoutMs: DEFAULT_TRUST_TIMEOUT_MS
+	}) {
+		this.mode = mode;
+		this.logger = logger;
+		this.eventBus = eventBus;
+		this.policySource = policySource;
+		this.trustPolicy = admissionTrustPolicy(trust.signer ?? new PassthroughSigner(), trust.authEnforcement, trust.policy);
+		this.trustTimeoutMs = trust.timeoutMs;
+	}
+	/** The first refusal of a mutation's submitted actions, when enforcing. */
+	async admitMutation(job, stores, signal) {
+		const { operationStore } = stores;
+		const candidates = job.actions.map((action) => candidate(action, mutationStream(action, job)));
+		const live = await this.liveOperationIds(candidates, operationStore, signal);
+		const committed = await this.storedAsSubmitted(candidates, live, isRetry(job), operationStore, signal);
+		await resolvePolicies(candidates, job.actions, (documentId, branch) => storedPolicy(stores, this.policySource, documentId, branch, signal));
+		const submitted = /* @__PURE__ */ new Set();
+		for (const entry of candidates) {
+			if (committed.has(entry)) continue;
+			const verdict = await this.verdict(entry, live, submitted, "mutation", signal);
+			submitted.add(entry.opId);
+			if (verdict.ok) continue;
+			const refusal = this.record(job, entry, verdict, "mutation");
+			if (refusal) return {
+				kind: "refused",
+				error: refusal
+			};
+		}
+		return {
+			kind: "admitted",
+			committed: [...committed.values()]
+		};
+	}
+	/** The incoming operations a load drops, empty unless enforcing. */
+	async admitLoad(job, operations, stores, signal) {
+		const { operationStore } = stores;
+		const stream = {
+			documentId: job.documentId,
+			scope: job.scope,
+			branch: job.branch
+		};
+		const candidates = operations.map((operation) => ({
+			...candidate(operation.action, stream),
+			operation
+		}));
+		const live = await this.liveOperationIds(candidates, operationStore, signal);
+		const redelivered = await this.redelivered(candidates, live, operationStore, signal);
+		await resolvePolicies(candidates, job.operations.map((operation) => operation.action), (documentId, branch) => storedPolicy(stores, this.policySource, documentId, branch, signal));
+		const dropped = /* @__PURE__ */ new Set();
+		for (let i = 0; i < candidates.length; i++) {
+			const verdict = await this.verdict(candidates[i], live, void 0, "load", signal, redelivered.has(candidates[i]));
+			if (verdict.ok) continue;
+			if (this.record(job, candidates[i], verdict, "load")) dropped.add(operations[i]);
+		}
+		return dropped;
+	}
+	async verdict(entry, live, submitted, path, signal, known = false) {
+		const verdict = await verifyActionSignature(entry.action, {
+			documentId: entry.stream.documentId,
+			branch: entry.stream.branch,
+			policy: entry.policy
+		}, path, entry.operation);
+		if (!verdict.ok) return verdict;
+		if (!known && (isLive(entry, live) || submitted?.has(entry.opId))) return {
+			ok: false,
+			scheme: verdict.scheme,
+			code: "DUPLICATE_ACTION",
+			reason: `action ${entry.action.id} is already in the stream`
+		};
+		if (verdict.scheme === "unsigned") {
+			const address = entry.action.context?.signer?.user?.address;
+			return address ? {
+				ok: false,
+				scheme: "unsigned",
+				code: "UNSIGNED_IDENTITY",
+				reason: `action ${entry.action.id} is unsigned but claims to act as ${address}`
+			} : verdict;
+		}
+		if (known) return verdict;
+		const signer = entry.action.context.signer;
+		if (!await this.authorize(signer, entry.stream.documentId, signal)) return {
+			ok: false,
+			scheme: verdict.scheme,
+			code: "SIGNER_UNAUTHORIZED",
+			reason: `action ${entry.action.id}: key ${signer.app.key} may not sign as ${signer.user.address}`
+		};
+		return verdict;
+	}
+	/** Throws when the policy does, times out or the job is aborted. */
+	async authorize(signer, documentId, signal) {
+		signal?.throwIfAborted();
+		let timer;
+		let onAbort;
+		const stop = new Promise((_, reject) => {
+			timer = setTimeout(() => {
+				reject(/* @__PURE__ */ new Error(`signature trust policy did not answer for ${signer.app.key} within ${this.trustTimeoutMs}ms`));
+			}, this.trustTimeoutMs);
+			if (signal) {
+				onAbort = () => reject(signal.reason instanceof Error ? signal.reason : new Error(String(signal.reason)));
+				signal.addEventListener("abort", onAbort, { once: true });
+			}
+		});
+		try {
+			return await Promise.race([this.trustPolicy.authorizeSigner(signer, signer.app.key, documentId), stop]);
+		} finally {
+			clearTimeout(timer);
+			if (onAbort) signal?.removeEventListener("abort", onAbort);
+		}
+	}
+	/**
+	* The live candidates stored exactly as submitted and still standing: one
+	* an undo or a reshuffle has since superseded is refused, not re-emitted with
+	* the state it once produced. A synthesized operation
+	* holds another action, so it cannot be compared; only a retry, whose first
+	* attempt this job was, takes it as committed.
+	*/
+	async storedAsSubmitted(candidates, live, retry, operationStore, signal) {
+		const committed = /* @__PURE__ */ new Map();
+		const toCompare = [];
+		for (const entry of candidates) if (entry.synthesizedOpId && live.has(entry.synthesizedOpId)) {
+			if (retry) committed.set(entry, committedWrite(entry, entry.synthesizedOpId));
+		} else if (live.has(entry.opId)) toCompare.push(entry);
+		for (const [stream, entries] of byStream(toCompare)) {
+			const stored = await operationStore.getOperationsByIds(stream.documentId, stream.scope, stream.branch, entries.map((entry) => entry.opId), signal);
+			const byId = new Map(stored.map((operation) => [operation.id, operation]));
+			const matching = entries.filter((entry) => {
+				const operation = byId.get(entry.opId);
+				return operation && sameContent(operation.action, entry.action);
+			});
+			if (matching.length === 0) continue;
+			const later = await operationStore.getSince(stream.documentId, stream.scope, stream.branch, Math.min(...matching.map((entry) => byId.get(entry.opId).index)), void 0, void 0, signal);
+			for (const entry of matching) if (!isSuperseded(byId.get(entry.opId), later.results)) committed.set(entry, committedWrite(entry, entry.opId));
+		}
+		return committed;
+	}
+	/**
+	* The load candidates stored exactly as they arrive, timestamp included: a
+	* peer re-sending what this stream holds, not a replay of its action.
+	*/
+	async redelivered(candidates, live, operationStore, signal) {
+		const found = /* @__PURE__ */ new Set();
+		const toCompare = candidates.filter((entry) => live.has(entry.opId) && !(entry.synthesizedOpId && live.has(entry.synthesizedOpId)));
+		for (const [stream, entries] of byStream(toCompare)) {
+			const stored = await operationStore.getOperationsByIds(stream.documentId, stream.scope, stream.branch, entries.map((entry) => entry.opId), signal);
+			for (const entry of entries) if (stored.some((operation) => operation.id === entry.opId && Date.parse(operation.timestampUtcMs) === Date.parse(entry.operation?.timestampUtcMs ?? "") && sameContent(operation.action, entry.action))) found.add(entry);
+		}
+		return found;
+	}
+	async liveOperationIds(candidates, operationStore, signal) {
+		const live = /* @__PURE__ */ new Set();
+		for (const [stream, entries] of byStream(candidates)) {
+			const found = await operationStore.findOperationIds(stream.documentId, stream.scope, stream.branch, entries.flatMap((entry) => entry.synthesizedOpId ? [entry.opId, entry.synthesizedOpId] : [entry.opId]), signal);
+			for (const opId of found) live.add(opId);
+		}
+		return live;
+	}
+	/** Logs and counts a refusal; returns the error only when enforcing. */
+	record(job, entry, refusal, path) {
+		const enforced = this.mode === "enforce";
+		const event = {
+			jobId: job.id,
+			documentId: entry.stream.documentId,
+			scope: entry.stream.scope,
+			branch: entry.stream.branch,
+			actionId: entry.action.id,
+			code: refusal.code,
+			scheme: refusal.scheme,
+			path,
+			enforced,
+			reason: refusal.reason
+		};
+		this.logger.warn(enforced ? "Signature refused: @Refusal" : "Signature refusal logged, write admitted: @Refusal", event);
+		this.eventBus.emit(ReactorEventTypes.SIGNATURE_REFUSED, event).catch((error) => {
+			this.logger.error("Failed to emit SIGNATURE_REFUSED: @Error", error);
+		});
+		return enforced ? new InvalidSignatureError(entry.stream.documentId, refusal.code, refusal.reason) : void 0;
+	}
+};
+/**
+* A CREATE_DOCUMENT is verified under its own input. Anything else takes the
+* stored document's policy, or, for a document this job creates, that CREATE's.
+*/
+async function resolvePolicies(candidates, jobActions, stored) {
+	const resolved = /* @__PURE__ */ new Map();
+	for (const entry of candidates) {
+		if (entry.action.type === "CREATE_DOCUMENT") {
+			entry.policy = createPolicy(entry.action);
+			continue;
+		}
+		const { documentId, branch } = entry.stream;
+		const key = `${documentId}\u0000${branch}`;
+		let policy = resolved.get(key);
+		if (policy === void 0) {
+			policy = await stored(documentId, branch) ?? createdPolicy(jobActions, documentId) ?? "legacy";
+			resolved.set(key, policy);
+		}
+		entry.policy = policy;
+	}
+}
+async function storedPolicy(stores, source, documentId, branch, signal) {
+	try {
+		if (source === "write-cache") {
+			const document = await stores.writeCache.getState(documentId, "document", branch, void 0, signal);
+			return signaturePolicyOf(document.header);
+		}
+		const meta = await stores.documentMetaCache.getDocumentMeta(documentId, branch, signal);
+		return signaturePolicyOf(meta.protocolVersions);
+	} catch (error) {
+		if (DocumentNotFoundError.isError(error)) return;
+		throw error;
+	}
+}
+function createdPolicy(actions, documentId) {
+	const create = actions.find((action) => action.type === "CREATE_DOCUMENT" && action.input?.documentId === documentId);
+	return create ? createPolicy(create) : void 0;
+}
+function createPolicy(action) {
+	return signaturePolicyOf(action.input);
+}
+function candidate(action, stream) {
+	const opId = (actionId) => deriveOperationId(stream.documentId, stream.scope, stream.branch, actionId);
+	return {
+		action,
+		stream,
+		opId: opId(action.id),
+		synthesizedOpId: SYNTHESIZING_TYPES.has(action.type) ? opId(synthesizedActionId(action.id)) : void 0
+	};
+}
+function isLive(entry, live) {
+	return live.has(entry.opId) || entry.synthesizedOpId !== void 0 && live.has(entry.synthesizedOpId);
+}
+function mutationStream(action, job) {
+	return {
+		...actionSigningTarget(action, job.documentId, job.branch),
+		scope: job.scope
+	};
+}
+function byStream(candidates) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const entry of candidates) {
+		const key = `${entry.stream.documentId}\u0000${entry.stream.scope}\u0000${entry.stream.branch}`;
+		const group = groups.get(key) ?? [entry.stream, []];
+		group[1].push(entry);
+		groups.set(key, group);
+	}
+	return [...groups.values()];
+}
+function isRetry(job) {
+	return job.errorHistory.length > 0 || (job.retryCount ?? 0) > 0;
+}
+function committedWrite(entry, opId) {
+	return {
+		...entry.stream,
+		actionId: entry.action.id,
+		opId
+	};
+}
+function isSuperseded(operation, later) {
+	return later.some((next) => next.index > operation.index && next.skip > 0 && next.index - next.skip <= operation.index);
+}
+function sameContent(stored, submitted) {
+	try {
+		return canonicalJson(stored) === canonicalJson(submitted);
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/executor/simple-job-executor.ts
+const MAX_SKIP_THRESHOLD = 1e3;
+const ISO_TIMESTAMP_REGEX = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/;
+function isValidISOTimestamp(value) {
+	if (!ISO_TIMESTAMP_REGEX.test(value)) return false;
+	return !isNaN(new Date(value).getTime());
+}
+/**
+* Carries a failed job out of the execution scope so its transaction rolls
+* back. A scope callback that returns commits, whatever result it returns, so
+* a returned failure would leave the writes the job made before it failed
+* standing. Never escapes executeJob: the failure goes back to being a
+* returned JobResult there, which is what the queue, the worker protocol and
+* every test expect a failed job to look like.
+*/
+var JobRollbackSignal = class extends Error {
+	result;
+	constructor(result) {
 		super("job rolled back");
 		this.result = result;
 		this.name = "JobRollbackSignal";
 	}
 };
 var SimpleJobExecutor = class {
+	logger;
+	registry;
+	operationStore;
+	eventBus;
+	writeCache;
+	operationIndex;
+	documentMetaCache;
+	collectionMembershipCache;
+	driveContainerTypes;
 	config;
 	featureFlags;
 	decisionModel;
-	signatureVerifierModule;
+	signatureAdmission;
 	documentActionHandler;
 	executionScope;
-	constructor(logger, registry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, driveContainerTypes, config, signatureVerifier, executionScope) {
+	signer;
+	/**
+	* `signer` signs the operations the reducer synthesizes; unsigned if omitted.
+	* `trustPolicy` decides which keys may sign as which users at admission.
+	*/
+	constructor(logger, registry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, driveContainerTypes, config, executionScope, signer, trustPolicy) {
 		this.logger = logger;
 		this.registry = registry;
 		this.operationStore = operationStore;
@@ -3286,6 +4313,8 @@ var SimpleJobExecutor = class {
 		this.documentMetaCache = documentMetaCache;
 		this.collectionMembershipCache = collectionMembershipCache;
 		this.driveContainerTypes = driveContainerTypes;
+		this.signer = signer ?? new PassthroughSigner();
+		this.featureFlags = resolveFeatureFlags(config.featureFlags);
 		this.config = {
 			featureFlags: config.featureFlags ?? {},
 			maxSkipThreshold: config.maxSkipThreshold ?? MAX_SKIP_THRESHOLD,
@@ -3295,12 +4324,18 @@ var SimpleJobExecutor = class {
 			retryBaseDelayMs: config.retryBaseDelayMs ?? 100,
 			retryMaxDelayMs: config.retryMaxDelayMs ?? 5e3,
 			yieldDeadlineMs: config.yieldDeadlineMs ?? 50,
-			batchApplies: config.batchApplies ?? true
+			batchApplies: config.batchApplies ?? true,
+			signatureVerification: config.signatureVerification ?? "enforce",
+			protocolSupport: config.protocolSupport ?? localSupports(PEER_CAPABILITIES, this.featureFlags).protocols
 		};
-		this.featureFlags = resolveFeatureFlags(config.featureFlags);
 		this.decisionModel = selectDecisionModel(this.featureFlags, registry);
-		this.signatureVerifierModule = new SignatureVerifier(signatureVerifier);
-		this.documentActionHandler = new DocumentActionHandler(registry, logger, driveContainerTypes, this.featureFlags, this.decisionModel);
+		this.signatureAdmission = new SignatureAdmission(this.config.signatureVerification, logger, eventBus, this.featureFlags.documentDecisions ? "write-cache" : "meta", {
+			signer: this.signer,
+			authEnforcement: this.featureFlags.authEnforcement,
+			policy: trustPolicy,
+			timeoutMs: Math.min(DEFAULT_TRUST_TIMEOUT_MS, this.config.jobTimeoutMs / 2)
+		});
+		this.documentActionHandler = new DocumentActionHandler(registry, logger, driveContainerTypes, this.featureFlags, this.decisionModel, this.config.protocolSupport);
 		this.executionScope = executionScope ?? new DefaultExecutionScope(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache);
 	}
 	/**
@@ -3366,6 +4401,8 @@ var SimpleJobExecutor = class {
 	async executeInScope(params) {
 		const { job, startTime, stores, signal, touchedStreams, postCommitInvalidations, postCommitMembershipInvalidations } = params;
 		let pendingEvent;
+		const unsupported = await this.unsupportedStoredProtocol(job, stores, signal);
+		if (unsupported) return { result: buildErrorResult(job, unsupported, startTime) };
 		const indexTxn = stores.operationIndex.start();
 		if (job.kind === "load") {
 			const loadResult = await this.executeLoadJob({
@@ -3429,10 +4466,29 @@ var SimpleJobExecutor = class {
 				pendingEvent
 			};
 		}
-		const positioned = await this.positionByTimestamp(job, stores, signal);
+		let admission;
+		try {
+			admission = await this.signatureAdmission.admitMutation(job, stores, signal);
+		} catch (error) {
+			return { result: buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime) };
+		}
+		if (admission.kind === "refused") return { result: buildErrorResult(job, admission.error, startTime) };
+		let committed;
+		try {
+			committed = await this.reloadCommitted(admission.committed, stores, signal);
+		} catch (error) {
+			return { result: buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime) };
+		}
+		const committedIds = new Set(admission.committed.map((write) => write.actionId));
+		const fresh = committedIds.size === 0 ? job : {
+			...job,
+			actions: job.actions.filter((action) => !committedIds.has(action.id))
+		};
+		if (fresh.actions.length === 0) return this.committedOutcome(job, committed, [], [], stores, startTime);
+		const positioned = await this.positionByTimestamp(fresh, stores, signal);
 		if (positioned.error) return { result: buildErrorResult(job, positioned.error, startTime) };
 		const executing = {
-			job,
+			job: fresh,
 			startTime,
 			indexTxn,
 			stores,
@@ -3462,13 +4518,33 @@ var SimpleJobExecutor = class {
 		} };
 		const ordinals = await stores.operationIndex.commit(indexTxn, signal);
 		postCommitMembershipInvalidations.push(...indexTxn.getMembershipInvalidations());
-		if (actionResult.operationsWithContext.length > 0) {
-			for (let i = 0; i < actionResult.operationsWithContext.length; i++) actionResult.operationsWithContext[i].context.ordinal = ordinals[i];
-			const collectionMemberships = await this.getCollectionMembershipsForOperations(actionResult.operationsWithContext, stores);
+		for (let i = 0; i < actionResult.operationsWithContext.length; i++) actionResult.operationsWithContext[i].context.ordinal = ordinals[i];
+		return this.committedOutcome(job, committed, actionResult.operationsWithContext, actionResult.generatedOperations, stores, startTime);
+	}
+	/** A stored document at a version this reactor does not run is read-only here. */
+	async unsupportedStoredProtocol(job, stores, signal) {
+		let versions;
+		try {
+			versions = this.featureFlags.documentDecisions && job.kind !== "load" ? (await stores.writeCache.getState(job.documentId, "document", job.branch, void 0, signal)).header.protocolVersions : (await stores.documentMetaCache.getDocumentMeta(job.documentId, job.branch, signal)).protocolVersions;
+		} catch {
+			return;
+		}
+		return this.documentActionHandler.unsupportedProtocol(job.documentId, versions);
+	}
+	/**
+	* A successful mutation's result and the write-ready event it owes, carrying
+	* what earlier attempts committed ahead of what this one wrote.
+	*/
+	async committedOutcome(job, reloaded, written, generated, stores, startTime) {
+		const operationsWithContext = [...reloaded, ...written];
+		let pendingEvent;
+		if (operationsWithContext.length > 0) {
+			const collectionMemberships = await this.getCollectionMembershipsForOperations(operationsWithContext, stores);
 			pendingEvent = {
 				jobId: job.id,
-				operations: actionResult.operationsWithContext,
+				operations: operationsWithContext,
 				jobMeta: job.meta,
+				submittedActionIds: submittedActionIds(job),
 				collectionMemberships
 			};
 		}
@@ -3476,14 +4552,62 @@ var SimpleJobExecutor = class {
 			result: {
 				job,
 				success: true,
-				operations: actionResult.generatedOperations,
-				operationsWithContext: actionResult.operationsWithContext,
+				operations: [...reloaded.map((entry) => entry.operation), ...generated],
+				operationsWithContext,
 				duration: Date.now() - startTime
 			},
 			pendingEvent
 		};
 	}
 	/**
+	* The stored operations of writes an earlier attempt committed, as a fresh
+	* write would report them. State is rebuilt from the write cache, and left
+	* out when it cannot be.
+	*/
+	async reloadCommitted(writes, stores, signal) {
+		const streams = /* @__PURE__ */ new Map();
+		for (const write of writes) {
+			const key = `${write.documentId}\u0000${write.scope}\u0000${write.branch}`;
+			streams.set(key, [...streams.get(key) ?? [], write]);
+		}
+		const reloaded = [];
+		for (const group of streams.values()) {
+			const { documentId, scope, branch } = group[0];
+			const opIds = [...new Set(group.map((write) => write.opId))];
+			const operations = await stores.operationStore.getOperationsByIds(documentId, scope, branch, opIds, signal);
+			const ordinals = await stores.operationIndex.getOrdinalsByOpIds(documentId, scope, branch, opIds, signal);
+			const { documentType } = await stores.documentMetaCache.getDocumentMeta(documentId, branch, signal);
+			for (const operation of operations.sort((a, b) => a.index - b.index)) reloaded.push({
+				operation,
+				context: {
+					documentId,
+					scope,
+					branch,
+					documentType,
+					resultingState: await this.rebuiltState(stores, {
+						documentId,
+						scope,
+						branch
+					}, operation, signal),
+					ordinal: ordinals.get(operation.id) ?? 0
+				}
+			});
+		}
+		return reloaded;
+	}
+	async rebuiltState(stores, stream, operation, signal) {
+		try {
+			const document = await stores.writeCache.getState(stream.documentId, stream.scope, stream.branch, operation.index, signal);
+			return JSON.stringify({
+				...document.state,
+				header: document.header
+			});
+		} catch (error) {
+			this.logger.warn("No state for committed operation @OperationId in @Stream: @Error", operation.id, stream, error);
+			return;
+		}
+	}
+	/**
 	* Drops the cached state of every stream a job wrote, after its transaction
 	* did not commit.
 	*
@@ -3512,16 +4636,6 @@ var SimpleJobExecutor = class {
 		const actions = writes.map((write) => write.action);
 		const generatedOperations = [];
 		const operationsWithContext = [];
-		try {
-			await this.signatureVerifierModule.verifyActions(job.documentId, job.branch, actions);
-		} catch (error) {
-			return {
-				success: false,
-				generatedOperations,
-				operationsWithContext,
-				error: error instanceof Error ? error : new Error(String(error))
-			};
-		}
 		for (const action of actions) if (action.timestampUtcMs && !isValidISOTimestamp(action.timestampUtcMs)) return {
 			success: false,
 			generatedOperations,
@@ -3619,7 +4733,7 @@ var SimpleJobExecutor = class {
 			if (docMeta.state.isDeleted) return buildErrorResult(job, new DocumentDeletedError(job.documentId, docMeta.state.deletedAtUtcIso), startTime);
 			documentVersion = docMeta.state.version;
 		}
-		if (isUndoRedo(action) || action.type === "PRUNE" || skip > 0) stores.writeCache.invalidate(job.documentId, job.scope, job.branch);
+		if (isUndoRedo(action) || skip > 0) stores.writeCache.invalidate(job.documentId, job.scope, job.branch);
 		let document;
 		if (baseDocument !== void 0) document = baseDocument;
 		else try {
@@ -3679,7 +4793,7 @@ var SimpleJobExecutor = class {
 				branch: job.branch,
 				protocolVersion
 			};
-			updatedDocument = module.reducer(document, action, void 0, reducerOptions);
+			updatedDocument = withProtocolVersions(module.reducer(document, action, void 0, reducerOptions), document.header.protocolVersions);
 		} catch (error) {
 			const contextMessage = `Failed to apply action to document:\n  Action type: ${action.type}\n  Document ID: ${job.documentId}\n  Document type: ${document.header.documentType}\n  Scope: ${job.scope}\n  Original error: ${error instanceof Error ? error.message : String(error)}`;
 			const enhancedError = new Error(contextMessage);
@@ -3691,6 +4805,15 @@ var SimpleJobExecutor = class {
 		if (operations.length === 0) return buildErrorResult(job, /* @__PURE__ */ new Error("No operation generated from action"), startTime);
 		const newOperation = operations[operations.length - 1];
 		if (!isUndoRedo(action)) newOperation.skip = skip;
+		if (deniedReason === void 0 && sourceOperation === void 0 && !executing.replayingAcceptedHistory && isSynthesized(action, newOperation, document.operations[scope] ?? [])) try {
+			await signSynthesized(newOperation, action, {
+				documentId: job.documentId,
+				scope,
+				branch: job.branch
+			}, this.signer, signal);
+		} catch (error) {
+			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+		}
 		const resultingState = JSON.stringify({
 			...updatedDocument.state,
 			header: updatedDocument.header
@@ -3791,7 +4914,7 @@ var SimpleJobExecutor = class {
 	*   apply and its own reasons for it.
 	* - A positional or replayed run carries skips and re-appended operations,
 	*   whose indices are not a simple ascending run from the head.
-	* - UNDO, REDO, PRUNE and NOOP-with-skip each invalidate the write cache to
+	* - UNDO, REDO and NOOP-with-skip each invalidate the write cache to
 	*   force a full-history rebuild, so they cannot be reduced against state
 	*   threaded from the write before them.
 	* - The auth scope decides later writes against the policy earlier ones
@@ -3809,7 +4932,7 @@ var SimpleJobExecutor = class {
 		if (scope === "auth" || scope === "document") return false;
 		return writes.every((write) => {
 			const type = write.action.type;
-			return write.skip === 0 && write.deniedReason === void 0 && write.sourceOperation === void 0 && !DOCUMENT_SCOPE_ACTIONS.has(type) && !isUndoRedo(write.action) && type !== "PRUNE" && type !== "NOOP";
+			return write.skip === 0 && write.deniedReason === void 0 && write.sourceOperation === void 0 && !DOCUMENT_SCOPE_ACTIONS.has(type) && !isUndoRedo(write.action) && type !== "NOOP";
 		});
 	}
 	/**
@@ -4107,7 +5230,7 @@ var SimpleJobExecutor = class {
 			stores.writeCache.invalidate(job.documentId, scope, job.branch);
 			const result = await this.processActions(tail.map((operation, i) => ({
 				action: operation.action,
-				skip: i === 0 ? retractionSkip(nextIndex, tail[0].index) : 0,
+				skip: i === 0 ? retractionSkip(nextIndex, tail[0].index - tail[0].skip) : 0,
 				sourceRemote: "",
 				deniedReason: reevaluated[firstChange + i]
 			})), {
@@ -4196,36 +5319,32 @@ var SimpleJobExecutor = class {
 			error: new InvalidOperationTimestampError(job.documentId, scope, operation.timestampUtcMs, `operation (index: ${operation.index})`),
 			duration: Date.now() - startTime
 		};
-		let minIncomingIndex = Number.POSITIVE_INFINITY;
-		let minIncomingTimestamp = job.operations[0]?.timestampUtcMs || "";
-		for (const operation of job.operations) {
-			minIncomingIndex = Math.min(minIncomingIndex, operation.index);
-			const ts = operation.timestampUtcMs || "";
-			if (Date.parse(ts) < Date.parse(minIncomingTimestamp)) minIncomingTimestamp = ts;
-		}
-		let conflictingOps;
-		try {
-			conflictingOps = (await stores.operationStore.getConflicting(job.documentId, scope, job.branch, minIncomingTimestamp, void 0, signal)).results;
-		} catch {
-			conflictingOps = [];
-		}
-		let allOpsFromMinConflictingIndex = conflictingOps;
-		if (conflictingOps.length > 0) {
-			const minConflictingIndex = Math.min(...conflictingOps.map((op) => op.index));
+		const dropped = /* @__PURE__ */ new Set();
+		const admitted = /* @__PURE__ */ new Set();
+		let selection = await this.selectLoadWrites(job, job.operations, stores, signal);
+		for (;;) {
+			const unadmitted = selection.incomingOpsToApply.filter((operation) => !admitted.has(operation));
+			if (unadmitted.length === 0) break;
+			let refused;
 			try {
-				allOpsFromMinConflictingIndex = (await stores.operationStore.getSince(job.documentId, scope, job.branch, minConflictingIndex - 1, void 0, void 0, signal)).results;
-			} catch {
-				allOpsFromMinConflictingIndex = conflictingOps;
+				refused = await this.signatureAdmission.admitLoad(job, unadmitted, stores, signal);
+			} catch (error) {
+				return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
 			}
+			for (const operation of unadmitted) if (refused.has(operation)) dropped.add(operation);
+			else admitted.add(operation);
+			if (refused.size === 0) break;
+			const remaining = job.operations.filter((operation) => !dropped.has(operation));
+			if (remaining.length === 0) return {
+				job,
+				success: true,
+				operations: [],
+				operationsWithContext: [],
+				duration: Date.now() - startTime
+			};
+			selection = await this.selectLoadWrites(job, remaining, stores, signal);
 		}
-		const incomingActionIds = new Set(job.operations.map((op) => op.action.id));
-		const nonSupersededOps = conflictingOps.filter((op) => {
-			if (op.index < minIncomingIndex && !incomingActionIds.has(op.action.id)) return false;
-			for (const laterOp of allOpsFromMinConflictingIndex) if (laterOp.index > op.index && laterOp.skip > 0) {
-				if (laterOp.index - laterOp.skip <= op.index) return false;
-			}
-			return true;
-		});
+		const { nonSupersededOps, allOpsFromMinConflictingIndex, incomingOpsToApply } = selection;
 		const existingOpsToReshuffle = monotonicAuthStream ? [] : nonSupersededOps.filter((operation) => !isGenesisOperation(operation));
 		const actionIdCounts = /* @__PURE__ */ new Map();
 		for (const operation of allOpsFromMinConflictingIndex) actionIdCounts.set(operation.action.id, (actionIdCounts.get(operation.action.id) ?? 0) + 1);
@@ -4246,14 +5365,6 @@ var SimpleJobExecutor = class {
 			const logicalSkip = latestRevision - minLogicalIndex;
 			if (logicalSkip > skipCount) skipCount = logicalSkip;
 		}
-		const existingActionIds = new Set(nonSupersededOps.map((op) => op.action.id));
-		const seenIncomingActionIds = /* @__PURE__ */ new Set();
-		const incomingOpsToApply = job.operations.filter((op) => {
-			if (existingActionIds.has(op.action.id)) return false;
-			if (seenIncomingActionIds.has(op.action.id)) return false;
-			seenIncomingActionIds.add(op.action.id);
-			return true;
-		});
 		if (incomingOpsToApply.length === 0) return {
 			job,
 			success: true,
@@ -4281,7 +5392,8 @@ var SimpleJobExecutor = class {
 			...operation,
 			id: operation.id
 		})));
-		for (const operation of reshuffledOperations) if (operation.action.type === "NOOP" && operation.skip === 0) operation.skip = 1;
+		const incomingIds = new Set(incomingOpsToApply.map((operation) => operation.action.id));
+		for (const operation of reshuffledOperations) if (operation.action.type === "NOOP" && operation.skip === 0 && incomingIds.has(operation.action.id)) operation.skip = 1;
 		let deniedReasons;
 		if (this.featureFlags.documentDecisions) try {
 			deniedReasons = await evaluateByPosition(this.decisionModel, {
@@ -4333,6 +5445,71 @@ var SimpleJobExecutor = class {
 			duration: Date.now() - startTime
 		};
 	}
+	/** The conflicting window a load opens, and which of its operations are new. */
+	async selectLoadWrites(job, operations, stores, signal) {
+		const scope = job.scope;
+		let minIncomingIndex = Number.POSITIVE_INFINITY;
+		let minIncomingTimestamp = operations[0]?.timestampUtcMs || "";
+		for (const operation of operations) {
+			minIncomingIndex = Math.min(minIncomingIndex, operation.index);
+			const ts = operation.timestampUtcMs || "";
+			if (Date.parse(ts) < Date.parse(minIncomingTimestamp)) minIncomingTimestamp = ts;
+		}
+		let conflictingOps;
+		try {
+			conflictingOps = (await stores.operationStore.getConflicting(job.documentId, scope, job.branch, minIncomingTimestamp, void 0, signal)).results;
+		} catch {
+			conflictingOps = [];
+		}
+		let allOpsFromMinConflictingIndex = conflictingOps;
+		if (conflictingOps.length > 0) {
+			const minConflictingIndex = Math.min(...conflictingOps.map((op) => op.index));
+			try {
+				allOpsFromMinConflictingIndex = (await stores.operationStore.getSince(job.documentId, scope, job.branch, minConflictingIndex - 1, void 0, void 0, signal)).results;
+			} catch {
+				allOpsFromMinConflictingIndex = conflictingOps;
+			}
+		}
+		const incomingActionIds = new Set(operations.map((op) => op.action.id));
+		const supersededBy = (op) => {
+			let nearest;
+			for (const laterOp of allOpsFromMinConflictingIndex) if (laterOp.index > op.index && laterOp.skip > 0 && laterOp.index - laterOp.skip <= op.index && (nearest === void 0 || laterOp.index < nearest.index)) nearest = laterOp;
+			return nearest;
+		};
+		const undoneActionIds = /* @__PURE__ */ new Set();
+		let predecessorBound = minIncomingIndex;
+		const rowsByActionId = /* @__PURE__ */ new Map();
+		for (const op of conflictingOps) if (incomingActionIds.has(op.action.id)) rowsByActionId.set(op.action.id, [...rowsByActionId.get(op.action.id) ?? [], op]);
+		const liveOps = /* @__PURE__ */ new Set();
+		for (const op of conflictingOps) if (supersededBy(op) === void 0) liveOps.add(op);
+		for (const [actionId, rows] of rowsByActionId) {
+			if (rows.some((row) => liveOps.has(row))) continue;
+			if (rows.some((row) => supersededBy(row)?.action.type === "NOOP")) undoneActionIds.add(actionId);
+			else predecessorBound = Math.min(predecessorBound, Math.max(...rows.map((row) => row.index)));
+		}
+		const nonSupersededOps = conflictingOps.filter((op) => {
+			if (op.index < predecessorBound && !incomingActionIds.has(op.action.id)) return false;
+			return liveOps.has(op);
+		});
+		let rewoundFrom = Number.POSITIVE_INFINITY;
+		for (const op of nonSupersededOps) if (!isGenesisOperation(op)) rewoundFrom = Math.min(rewoundFrom, op.index - op.skip);
+		const reappended = new Set(nonSupersededOps.map((op) => op.index));
+		for (const op of allOpsFromMinConflictingIndex) if (op.index >= rewoundFrom && !reappended.has(op.index) && supersededBy(op) === void 0) nonSupersededOps.push(op);
+		const existingActionIds = new Set(nonSupersededOps.map((op) => op.action.id));
+		const seenIncomingActionIds = /* @__PURE__ */ new Set();
+		const incomingOpsToApply = operations.filter((op) => {
+			if (existingActionIds.has(op.action.id)) return false;
+			if (undoneActionIds.has(op.action.id)) return false;
+			if (seenIncomingActionIds.has(op.action.id)) return false;
+			seenIncomingActionIds.add(op.action.id);
+			return true;
+		});
+		return {
+			nonSupersededOps,
+			allOpsFromMinConflictingIndex,
+			incomingOpsToApply
+		};
+	}
 	accumulateResultOrReturnError(result, generatedOperations, operationsWithContext) {
 		if (!result.success) return result;
 		if (result.operations && result.operations.length > 0) generatedOperations.push(...result.operations);
@@ -4479,6 +5656,7 @@ var DocumentModelRegistry = class {
 //#endregion
 //#region src/storage/kysely/keyframe-store.ts
 var KyselyKeyframeStore = class KyselyKeyframeStore {
+	db;
 	trx;
 	constructor(db) {
 		this.db = db;
@@ -4563,6 +5741,11 @@ function paginateRows(rows, paging, cursorOf, toItem, refetch) {
 //#endregion
 //#region src/storage/txn.ts
 var AtomicTransaction = class {
+	documentId;
+	documentType;
+	scope;
+	branch;
+	baseRevision;
 	operations = [];
 	constructor(documentId, documentType, scope, branch, baseRevision) {
 		this.documentId = documentId;
@@ -4596,6 +5779,11 @@ var AtomicTransaction = class {
 //#endregion
 //#region src/storage/kysely/store.ts
 var _UniqueConstraintContext = class extends Error {
+	documentId;
+	scope;
+	branch;
+	revision;
+	stagedOps;
 	constructor(documentId, scope, branch, revision, stagedOps) {
 		super("unique constraint");
 		this.documentId = documentId;
@@ -4607,6 +5795,7 @@ var _UniqueConstraintContext = class extends Error {
 	}
 };
 var KyselyOperationStore = class KyselyOperationStore {
+	db;
 	trx;
 	constructor(db) {
 		this.db = db;
@@ -4706,12 +5895,13 @@ var KyselyOperationStore = class KyselyOperationStore {
 	* otherwise read a snapshot taken before the locks were held.
 	*/
 	async acquireStreamLocks(trx, documentId, scope, branch, condition) {
-		const keys = new Set([`${documentId}:${scope}:${branch}`]);
+		const keys = /* @__PURE__ */ new Set([`${documentId}:${scope}:${branch}`]);
 		for (const stream of condition.streams) keys.add(`${stream.documentId}:${stream.scope}:${stream.branch}`);
+		const sortedKeys = sql.join([...keys].sort());
 		await sql`
       with ordered as materialized (
         select key
-        from unnest(array[${sql.join([...keys].sort())}]::text[]) with ordinality as t(key, ord)
+        from unnest(array[${sortedKeys}]::text[]) with ordinality as t(key, ord)
         order by ord
       )
       select pg_advisory_xact_lock(hashtext(key)) from ordered
@@ -4788,6 +5978,14 @@ var KyselyOperationStore = class KyselyOperationStore {
 		}
 		return false;
 	}
+	/**
+	* The paging cursor here encodes the index to resume from (one past the
+	* last row returned), not the last row's own index. This keeps "0" an
+	* unambiguous start-of-stream sentinel even when a page ends at index 0
+	* (e.g. `limit: 1` on a fresh stream), which would otherwise make
+	* `nextCursor` equal the start cursor and loop a caller that walks pages
+	* forever.
+	*/
 	async getSince(documentId, scope, branch, revision, filter, paging, signal) {
 		throwIfAborted(signal);
 		let query = this.queryExecutor.selectFrom("Operation").selectAll().where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).where("index", ">", revision).orderBy("index", "asc");
@@ -4802,10 +6000,10 @@ var KyselyOperationStore = class KyselyOperationStore {
 		}
 		if (paging) {
 			const cursorValue = Number.parseInt(paging.cursor, 10);
-			if (cursorValue > 0) query = query.where("index", ">", cursorValue);
+			if (Number.isFinite(cursorValue) && cursorValue > 0) query = query.where("index", ">=", cursorValue);
 			if (paging.limit) query = query.limit(paging.limit + 1);
 		}
-		return paginateRows(await query.execute(), paging, (row) => row.index, (row) => this.rowToOperation(row), (cursor, limit) => this.getSince(documentId, scope, branch, revision, filter, {
+		return paginateRows(await query.execute(), paging, (row) => row.index + 1, (row) => this.rowToOperation(row), (cursor, limit) => this.getSince(documentId, scope, branch, revision, filter, {
 			cursor,
 			limit
 		}, signal));
@@ -4823,26 +6021,28 @@ var KyselyOperationStore = class KyselyOperationStore {
 			limit
 		}, signal));
 	}
+	/**
+	* The paging cursor here encodes the index to resume from (one past the
+	* last row returned), not the last row's own index, for the same reason as
+	* `getSince`: a page ending at index 0 must not produce a cursor that is
+	* indistinguishable from the start-of-stream sentinel.
+	*/
 	async getConflicting(documentId, scope, branch, minTimestamp, paging, signal) {
 		throwIfAborted(signal);
 		let query = this.queryExecutor.selectFrom("Operation").selectAll().where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).where("timestampUtcMs", ">=", new Date(minTimestamp)).orderBy("index", "asc");
 		if (paging) {
 			const cursorValue = Number.parseInt(paging.cursor, 10);
-			if (cursorValue > 0) query = query.where("index", ">", cursorValue);
+			if (Number.isFinite(cursorValue) && cursorValue > 0) query = query.where("index", ">=", cursorValue);
 			if (paging.limit) query = query.limit(paging.limit + 1);
 		}
-		return paginateRows(await query.execute(), paging, (row) => row.index, (row) => this.rowToOperation(row), (cursor, limit) => this.getConflicting(documentId, scope, branch, minTimestamp, {
+		return paginateRows(await query.execute(), paging, (row) => row.index + 1, (row) => this.rowToOperation(row), (cursor, limit) => this.getConflicting(documentId, scope, branch, minTimestamp, {
 			cursor,
 			limit
 		}, signal));
 	}
 	async getRevisions(documentId, branch, signal) {
 		throwIfAborted(signal);
-		const scopeRevisions = await this.queryExecutor.selectFrom("Operation as o1").select([
-			"o1.scope",
-			"o1.index",
-			"o1.timestampUtcMs"
-		]).where("o1.documentId", "=", documentId).where("o1.branch", "=", branch).where((eb) => eb("o1.index", "=", eb.selectFrom("Operation as o2").select((eb2) => eb2.fn.max("o2.index").as("maxIndex")).where("o2.documentId", "=", eb.ref("o1.documentId")).where("o2.branch", "=", eb.ref("o1.branch")).where("o2.scope", "=", eb.ref("o1.scope")))).execute();
+		const scopeRevisions = await this.queryExecutor.selectFrom("Operation").select("scope").select((eb) => eb.fn.max("index").as("index")).where("documentId", "=", documentId).where("branch", "=", branch).groupBy("scope").execute();
 		const latest = await this.queryExecutor.selectFrom("Operation").select((eb) => eb.fn.max("timestampUtcMs").as("latestTimestamp")).where("documentId", "=", documentId).where("branch", "=", branch).executeTakeFirst();
 		const revision = {};
 		for (const row of scopeRevisions) revision[row.scope] = row.index + 1;
@@ -4855,6 +6055,20 @@ var KyselyOperationStore = class KyselyOperationStore {
 		const latest = await this.queryExecutor.selectFrom("Operation").select((eb) => eb.fn.max("timestampUtcMs").as("latestTimestamp")).where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).executeTakeFirst();
 		return latest?.latestTimestamp ? new Date(latest.latestTimestamp).toISOString() : void 0;
 	}
+	async findOperationIds(documentId, scope, branch, opIds, signal) {
+		throwIfAborted(signal);
+		if (opIds.length === 0) return /* @__PURE__ */ new Set();
+		const rows = await this.queryExecutor.selectFrom("Operation").select("opId").distinct().where("opId", "in", opIds).where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).execute();
+		return new Set(rows.map((row) => row.opId));
+	}
+	async getOperationsByIds(documentId, scope, branch, opIds, signal) {
+		throwIfAborted(signal);
+		if (opIds.length === 0) return [];
+		const rows = await this.queryExecutor.selectFrom("Operation").selectAll().where("opId", "in", opIds).where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).orderBy("index", "asc").execute();
+		const latest = /* @__PURE__ */ new Map();
+		for (const row of rows) latest.set(row.opId, this.rowToOperation(row));
+		return [...latest.values()];
+	}
 	rowToOperation(row) {
 		return {
 			index: row.index,
@@ -4948,8 +6162,8 @@ function createForwardingPoolInstrumentation(name) {
 }
 //#endregion
 //#region src/storage/migrations/001_create_operation_table.ts
-var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$18 });
-async function up$18(db) {
+var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$22 });
+async function up$22(db) {
 	await db.schema.createTable("Operation").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("jobId", "text", (col) => col.notNull()).addColumn("opId", "text", (col) => col.notNull()).addColumn("prevOpId", "text", (col) => col.notNull()).addColumn("writeTimestampUtcMs", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("timestampUtcMs", "timestamptz", (col) => col.notNull()).addColumn("index", "integer", (col) => col.notNull()).addColumn("action", "jsonb", (col) => col.notNull()).addColumn("skip", "integer", (col) => col.notNull()).addColumn("error", "text").addColumn("hash", "text", (col) => col.notNull()).addUniqueConstraint("unique_revision", [
 		"documentId",
 		"scope",
@@ -4974,8 +6188,8 @@ async function up$18(db) {
 }
 //#endregion
 //#region src/storage/migrations/002_create_keyframe_table.ts
-var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$17 });
-async function up$17(db) {
+var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$21 });
+async function up$21(db) {
 	await db.schema.createTable("Keyframe").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("revision", "integer", (col) => col.notNull()).addColumn("document", "jsonb", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_keyframe", [
 		"documentId",
 		"scope",
@@ -4991,14 +6205,14 @@ async function up$17(db) {
 }
 //#endregion
 //#region src/storage/migrations/003_create_document_table.ts
-var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$16 });
-async function up$16(db) {
+var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$20 });
+async function up$20(db) {
 	await db.schema.createTable("Document").addColumn("id", "text", (col) => col.primaryKey()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/004_create_document_relationship_table.ts
-var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$15 });
-async function up$15(db) {
+var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$19 });
+async function up$19(db) {
 	await db.schema.createTable("DocumentRelationship").addColumn("id", "text", (col) => col.primaryKey()).addColumn("sourceId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("targetId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("relationshipType", "text", (col) => col.notNull()).addColumn("metadata", "jsonb").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_source_target_type", [
 		"sourceId",
 		"targetId",
@@ -5010,14 +6224,14 @@ async function up$15(db) {
 }
 //#endregion
 //#region src/storage/migrations/005_create_indexer_state_table.ts
-var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$14 });
-async function up$14(db) {
+var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$18 });
+async function up$18(db) {
 	await db.schema.createTable("IndexerState").addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity()).addColumn("lastOperationId", "integer", (col) => col.notNull()).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/006_create_document_snapshot_table.ts
-var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
-async function up$13(db) {
+var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$17 });
+async function up$17(db) {
 	await db.schema.createTable("DocumentSnapshot").addColumn("id", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("slug", "text").addColumn("name", "text").addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("content", "jsonb", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("lastOperationIndex", "integer", (col) => col.notNull()).addColumn("lastOperationHash", "text", (col) => col.notNull()).addColumn("lastUpdatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("snapshotVersion", "integer", (col) => col.notNull().defaultTo(1)).addColumn("identifiers", "jsonb").addColumn("metadata", "jsonb").addColumn("isDeleted", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("deletedAt", "timestamptz").addUniqueConstraint("unique_doc_scope_branch", [
 		"documentId",
 		"scope",
@@ -5038,8 +6252,8 @@ async function up$13(db) {
 }
 //#endregion
 //#region src/storage/migrations/007_create_slug_mapping_table.ts
-var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$12 });
-async function up$12(db) {
+var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$16 });
+async function up$16(db) {
 	await db.schema.createTable("SlugMapping").addColumn("slug", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_docid_scope_branch", [
 		"documentId",
 		"scope",
@@ -5049,14 +6263,14 @@ async function up$12(db) {
 }
 //#endregion
 //#region src/storage/migrations/008_create_view_state_table.ts
-var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$11 });
-async function up$11(db) {
+var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$15 });
+async function up$15(db) {
 	await db.schema.createTable("ViewState").addColumn("readModelId", "text", (col) => col.primaryKey()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(0)).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/009_create_operation_index_tables.ts
-var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$10 });
-async function up$10(db) {
+var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$14 });
+async function up$14(db) {
 	await db.schema.createTable("document_collections").addColumn("documentId", "text", (col) => col.notNull()).addColumn("collectionId", "text", (col) => col.notNull()).addColumn("joinedOrdinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("leftOrdinal", "bigint").addPrimaryKeyConstraint("document_collections_pkey", ["documentId", "collectionId"]).execute();
 	await db.schema.createIndex("idx_document_collections_collectionId").on("document_collections").column("collectionId").execute();
 	await db.schema.createIndex("idx_doc_collections_collection_range").on("document_collections").columns(["collectionId", "joinedOrdinal"]).execute();
@@ -5070,8 +6284,8 @@ async function up$10(db) {
 }
 //#endregion
 //#region src/storage/migrations/010_create_sync_tables.ts
-var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$9 });
-async function up$9(db) {
+var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
+async function up$13(db) {
 	await db.schema.createTable("sync_remotes").addColumn("name", "text", (col) => col.primaryKey()).addColumn("collection_id", "text", (col) => col.notNull()).addColumn("channel_type", "text", (col) => col.notNull()).addColumn("channel_id", "text", (col) => col.notNull().defaultTo("")).addColumn("remote_name", "text", (col) => col.notNull().defaultTo("")).addColumn("channel_parameters", "jsonb", (col) => col.notNull().defaultTo(sql`'{}'::jsonb`)).addColumn("filter_document_ids", "jsonb").addColumn("filter_scopes", "jsonb").addColumn("filter_branch", "text", (col) => col.notNull().defaultTo("main")).addColumn("push_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("push_last_success_utc_ms", "text").addColumn("push_last_failure_utc_ms", "text").addColumn("push_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("pull_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("pull_last_success_utc_ms", "text").addColumn("pull_last_failure_utc_ms", "text").addColumn("pull_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 	await db.schema.createIndex("idx_sync_remotes_collection").on("sync_remotes").column("collection_id").execute();
 	await db.schema.createTable("sync_cursors").addColumn("remote_name", "text", (col) => col.primaryKey().references("sync_remotes.name").onDelete("cascade")).addColumn("cursor_ordinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("last_synced_at_utc_ms", "text").addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
@@ -5079,8 +6293,8 @@ async function up$9(db) {
 }
 //#endregion
 //#region src/storage/migrations/011_add_cursor_type_column.ts
-var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$8 });
-async function up$8(db) {
+var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$12 });
+async function up$12(db) {
 	await db.deleteFrom("sync_cursors").where("remote_name", "like", "outbox::%").execute();
 	await db.deleteFrom("sync_remotes").where("name", "like", "outbox::%").execute();
 	await db.schema.dropTable("sync_cursors").execute();
@@ -5089,64 +6303,64 @@ async function up$8(db) {
 }
 //#endregion
 //#region src/storage/migrations/012_add_source_remote_column.ts
-var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$7 });
-async function up$7(db) {
+var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$11 });
+async function up$11(db) {
 	await db.schema.alterTable("operation_index_operations").addColumn("sourceRemote", "text", (col) => col.notNull().defaultTo("")).execute();
 }
 //#endregion
 //#region src/storage/migrations/013_create_sync_dead_letters_table.ts
-var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$6 });
-async function up$6(db) {
+var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$10 });
+async function up$10(db) {
 	await db.schema.createTable("sync_dead_letters").addColumn("ordinal", "serial", (col) => col.primaryKey()).addColumn("id", "text", (col) => col.unique().notNull()).addColumn("job_id", "text", (col) => col.notNull()).addColumn("job_dependencies", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("remote_name", "text", (col) => col.notNull().references("sync_remotes.name").onDelete("cascade")).addColumn("document_id", "text", (col) => col.notNull()).addColumn("scopes", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("branch", "text", (col) => col.notNull()).addColumn("operations", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("error_source", "text", (col) => col.notNull()).addColumn("error_message", "text", (col) => col.notNull()).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 	await db.schema.createIndex("idx_sync_dead_letters_remote").on("sync_dead_letters").column("remote_name").execute();
 }
 //#endregion
 //#region src/storage/migrations/014_create_processor_cursor_table.ts
-var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$5 });
-async function up$5(db) {
+var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$9 });
+async function up$9(db) {
 	await db.schema.createTable("ProcessorCursor").addColumn("processorId", "text", (col) => col.primaryKey()).addColumn("factoryId", "text", (col) => col.notNull()).addColumn("driveId", "text", (col) => col.notNull()).addColumn("processorIndex", "integer", (col) => col.notNull()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(sql`0`)).addColumn("status", "text", (col) => col.notNull().defaultTo(sql`'active'`)).addColumn("lastError", "text").addColumn("lastErrorTimestamp", "timestamptz").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/015_add_operation_denied_reason.ts
 var _015_add_operation_denied_reason_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$4,
-	up: () => up$4
+	down: () => down$8,
+	up: () => up$8
 });
 /**
 * Records why authorization refused an operation. Separate from `error` so a
 * denial is distinguishable from a reducer failure without matching on a
 * message. Null for every operation written before decisions were enforced.
 */
-async function up$4(db) {
+async function up$8(db) {
 	await db.schema.alterTable("Operation").addColumn("deniedReason", "text").execute();
 	await db.schema.alterTable("operation_index_operations").addColumn("deniedReason", "text").execute();
 }
-async function down$4(db) {
+async function down$8(db) {
 	await db.schema.alterTable("operation_index_operations").dropColumn("deniedReason").execute();
 	await db.schema.alterTable("Operation").dropColumn("deniedReason").execute();
 }
 //#endregion
 //#region src/storage/migrations/016_add_dead_letter_error_type.ts
 var _016_add_dead_letter_error_type_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$3,
-	up: () => up$3
+	down: () => down$7,
+	up: () => up$7
 });
 /**
 * The classification a dead letter falls into, stored because it decides whether
 * the document stays quarantined and the in-memory error is gone after a restart.
 * Defaulted rather than nullable, so a pre-existing row rehydrates.
 */
-async function up$3(db) {
+async function up$7(db) {
 	await db.schema.alterTable("sync_dead_letters").addColumn("error_type", "text", (col) => col.notNull().defaultTo("UNCLASSIFIED")).execute();
 }
-async function down$3(db) {
+async function down$7(db) {
 	await db.schema.alterTable("sync_dead_letters").dropColumn("error_type").execute();
 }
 //#endregion
 //#region src/storage/migrations/017_create_group_references.ts
 var _017_create_group_references_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$2,
-	up: () => up$2
+	down: () => down$6,
+	up: () => up$6
 });
 /**
 * One row per (document, group) reference ever discovered from an auth
@@ -5157,18 +6371,18 @@ var _017_create_group_references_exports = /* @__PURE__ */ __exportAll({
 * requires (sync), and by groupId for the documents a group change affects
 * (re-evaluation).
 */
-async function up$2(db) {
+async function up$6(db) {
 	await db.schema.createTable("group_references").addColumn("documentId", "text", (col) => col.notNull()).addColumn("groupId", "text", (col) => col.notNull()).addPrimaryKeyConstraint("group_references_pkey", ["documentId", "groupId"]).execute();
 	await db.schema.createIndex("idx_group_references_groupId").on("group_references").column("groupId").execute();
 }
-async function down$2(db) {
+async function down$6(db) {
 	await db.schema.dropTable("group_references").execute();
 }
 //#endregion
 //#region src/storage/migrations/018_add_sync_remote_bound_address.ts
 var _018_add_sync_remote_bound_address_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$5,
+	up: () => up$5
 });
 /**
 * The address a sync channel is bound to, so a channel created by one subject
@@ -5179,17 +6393,17 @@ var _018_add_sync_remote_bound_address_exports = /* @__PURE__ */ __exportAll({
 * until its first authenticated poll adopts it. A default would claim them all
 * for one address.
 */
-async function up$1(db) {
+async function up$5(db) {
 	await db.schema.alterTable("sync_remotes").addColumn("bound_address", "text").execute();
 }
-async function down$1(db) {
+async function down$5(db) {
 	await db.schema.alterTable("sync_remotes").dropColumn("bound_address").execute();
 }
 //#endregion
 //#region src/storage/migrations/019_require_action_id.ts
 var _019_require_action_id_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$4,
+	up: () => up$4
 });
 /**
 * Makes an operation whose action carries no id physically unstorable.
@@ -5216,7 +6430,7 @@ var _019_require_action_id_exports = /* @__PURE__ */ __exportAll({
 * The empty string is rejected alongside null. It derives the same colliding
 * operation id as an absent id, so admitting it would leave the hole open.
 */
-async function up(db) {
+async function up$4(db) {
 	await db.updateTable("Operation").set({ action: sql`jsonb_set(action, '{id}', to_jsonb(gen_random_uuid()::text))` }).where(sql`jsonb_typeof(action) = 'object' and coalesce(action->>'id', '') = ''`).execute();
 	await db.updateTable("operation_index_operations as oio").from("Operation as op").set({ action: sql`jsonb_set(oio.action, '{id}', to_jsonb(op.action->>'id'))` }).whereRef("oio.opId", "=", "op.opId").whereRef("oio.index", "=", "op.index").whereRef("oio.skip", "=", "op.skip").where(sql`jsonb_typeof(oio.action) = 'object' and coalesce(oio.action->>'id', '') = ''`).where(sql`coalesce(op.action->>'id', '') <> ''`).execute();
 	await db.updateTable("operation_index_operations").set({ action: sql`jsonb_set(action, '{id}', to_jsonb(gen_random_uuid()::text))` }).where(sql`jsonb_typeof(action) = 'object' and coalesce(action->>'id', '') = ''`).execute();
@@ -5228,11 +6442,74 @@ async function up(db) {
 * their operations are now known by, and reverting them would reintroduce the
 * collision the migration removed.
 */
-async function down(db) {
+async function down$4(db) {
 	await db.schema.alterTable("operation_index_operations").dropConstraint("action_must_have_id").execute();
 	await db.schema.alterTable("Operation").dropConstraint("action_must_have_id").execute();
 }
 //#endregion
+//#region src/storage/migrations/020_add_snapshot_operation_ordinal.ts
+var _020_add_snapshot_operation_ordinal_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$3,
+	up: () => up$3
+});
+/** Orders header row writes across scopes; `lastOperationIndex` is per scope. */
+async function up$3(db) {
+	await db.schema.alterTable("DocumentSnapshot").addColumn("lastOperationOrdinal", "integer", (col) => col.notNull().defaultTo(0)).execute();
+}
+async function down$3(db) {
+	await db.schema.alterTable("DocumentSnapshot").dropColumn("lastOperationOrdinal").execute();
+}
+//#endregion
+//#region src/storage/migrations/021_add_sync_remote_peer.ts
+var _021_add_sync_remote_peer_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$2,
+	up: () => up$2
+});
+/**
+* The peer's manifest as canonical JSON, and when it was heard. Both null: not
+* yet heard. A time with no manifest: a silent peer, which gets the baselines.
+*/
+async function up$2(db) {
+	await db.schema.alterTable("sync_remotes").addColumn("peer_manifest", "text").addColumn("peer_manifest_at_utc_ms", "bigint").execute();
+}
+async function down$2(db) {
+	await db.schema.alterTable("sync_remotes").dropColumn("peer_manifest").dropColumn("peer_manifest_at_utc_ms").execute();
+}
+//#endregion
+//#region src/storage/migrations/022_create_sync_holds.ts
+var _022_create_sync_holds_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$1,
+	up: () => up$1
+});
+/** Documents held back from a remote whose peer cannot run their versions. */
+async function up$1(db) {
+	await db.schema.createTable("sync_holds").addColumn("remote_name", "text", (col) => col.notNull().references("sync_remotes.name").onDelete("cascade")).addColumn("document_id", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("protocol", "text", (col) => col.notNull()).addColumn("version", "integer", (col) => col.notNull()).addColumn("held_at_utc_ms", "bigint", (col) => col.notNull()).addPrimaryKeyConstraint("sync_holds_pkey", [
+		"remote_name",
+		"document_id",
+		"branch"
+	]).execute();
+}
+async function down$1(db) {
+	await db.schema.dropTable("sync_holds").execute();
+}
+//#endregion
+//#region src/storage/migrations/023_index_created_protocol_versions.ts
+var _023_index_created_protocol_versions_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* One entry per document created with protocolVersions, keyed by a hash so an
+* oversized header cannot make its creation unstorable. Startup reads the
+* distinct values without visiting every document.
+*/
+async function up(db) {
+	await db.schema.createIndex("idx_operation_created_protocol_versions").on("Operation").expression(sql`md5((action->'input'->'protocolVersions')::text)`).where(sql`scope = 'document' and "index" = 0 and (action->'input'->'protocolVersions') is not null`).execute();
+}
+async function down(db) {
+	await db.schema.dropIndex("idx_operation_created_protocol_versions").execute();
+}
+//#endregion
 //#region src/storage/migrations/migrator.ts
 const REACTOR_SCHEMA = "reactor";
 const migrations = {
@@ -5254,7 +6531,11 @@ const migrations = {
 	"016_add_dead_letter_error_type": _016_add_dead_letter_error_type_exports,
 	"017_create_group_references": _017_create_group_references_exports,
 	"018_add_sync_remote_bound_address": _018_add_sync_remote_bound_address_exports,
-	"019_require_action_id": _019_require_action_id_exports
+	"019_require_action_id": _019_require_action_id_exports,
+	"020_add_snapshot_operation_ordinal": _020_add_snapshot_operation_ordinal_exports,
+	"021_add_sync_remote_peer": _021_add_sync_remote_peer_exports,
+	"022_create_sync_holds": _022_create_sync_holds_exports,
+	"023_index_created_protocol_versions": _023_index_created_protocol_versions_exports
 };
 var ProgrammaticMigrationProvider = class {
 	getMigrations() {
@@ -5312,8 +6593,148 @@ async function getMigrationStatus(db, schema = REACTOR_SCHEMA) {
 }
 //#endregion
 //#region src/core/drive-container-types.ts
-const DEFAULT_DRIVE_CONTAINER_TYPES = new Set(["powerhouse/document-drive", "powerhouse/reactor-drive"]);
+const DEFAULT_DRIVE_CONTAINER_TYPES = /* @__PURE__ */ new Set(["powerhouse/document-drive", "powerhouse/reactor-drive"]);
+//#endregion
+//#region src/executor/worker/error-info.ts
+const MAX_STACK_LENGTH = 8192;
+const MAX_CAUSE_DEPTH = 8;
+function toErrorInfo(err, depth = 0) {
+	if (depth > MAX_CAUSE_DEPTH) return {
+		name: "Error",
+		message: "cause chain truncated"
+	};
+	if (err instanceof Error) {
+		const info = {
+			name: err.name || "Error",
+			message: err.message
+		};
+		if (typeof err.stack === "string") info.stack = err.stack.length > MAX_STACK_LENGTH ? err.stack.slice(0, MAX_STACK_LENGTH) : err.stack;
+		if (err.cause !== void 0) info.cause = toErrorInfo(err.cause, depth + 1);
+		return info;
+	}
+	if (typeof err === "string") return {
+		name: "Error",
+		message: err
+	};
+	if (err && typeof err === "object") {
+		const record = err;
+		return {
+			name: typeof record.name === "string" ? record.name : "Error",
+			message: typeof record.message === "string" ? record.message : safeStringify(err)
+		};
+	}
+	return {
+		name: "Error",
+		message: safeStringify(err)
+	};
+}
+function safeStringify(value) {
+	if (value === null || value === void 0) return String(value);
+	if (typeof value === "string") return value;
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	try {
+		return JSON.stringify(value);
+	} catch {
+		return "[unserializable]";
+	}
+}
+function fromErrorInfo(info) {
+	const err = new Error(info.message);
+	Object.defineProperty(err, "name", {
+		value: info.name,
+		configurable: true,
+		writable: true
+	});
+	if (info.stack !== void 0) err.stack = info.stack;
+	if (info.cause !== void 0) Object.defineProperty(err, "cause", {
+		value: fromErrorInfo(info.cause),
+		configurable: true,
+		writable: true
+	});
+	return err;
+}
+//#endregion
+//#region src/executor/worker/sanitize.ts
+const MAX_DEPTH = 8;
+function errorToInfo(err) {
+	return toErrorInfo(err);
+}
+function sanitizeArg(value, depth = 0, seen = /* @__PURE__ */ new WeakSet()) {
+	if (depth > MAX_DEPTH) return "[Truncated]";
+	if (value === null || value === void 0) return null;
+	if (typeof value === "boolean") return value;
+	if (typeof value === "number") return value;
+	if (typeof value === "string") return value;
+	if (typeof value === "bigint") return value.toString();
+	if (typeof value === "function" || typeof value === "symbol") return null;
+	if (value instanceof Error) return toErrorInfo(value);
+	if (value instanceof Date) return value.toISOString();
+	if (value instanceof Map) {
+		const obj = {};
+		for (const [k, v] of value.entries()) obj[String(k)] = sanitizeArg(v, depth + 1, seen);
+		return obj;
+	}
+	if (value instanceof Set) {
+		const arr = [];
+		for (const v of value.values()) arr.push(sanitizeArg(v, depth + 1, seen));
+		return arr;
+	}
+	if (Array.isArray(value)) {
+		if (seen.has(value)) return "[Circular]";
+		seen.add(value);
+		const result = value.map((v) => sanitizeArg(v, depth + 1, seen));
+		seen.delete(value);
+		return result;
+	}
+	if (typeof value === "object") {
+		const proto = Object.getPrototypeOf(value);
+		if (proto !== Object.prototype && proto !== null) return { __nonClonable: value.constructor?.name || "Unknown" };
+		if (seen.has(value)) return "[Circular]";
+		seen.add(value);
+		const result = {};
+		for (const [k, v] of Object.entries(value)) result[k] = sanitizeArg(v, depth + 1, seen);
+		seen.delete(value);
+		return result;
+	}
+	return null;
+}
+//#endregion
+//#region src/executor/worker/forwarding-logger.ts
+function createForwardingLogger(post, level = "info", tags = []) {
+	function safePost(msg) {
+		try {
+			post(msg);
+		} catch {
+			try {
+				process.stderr.write(`[forwarding-logger] postMessage failed: ${msg.level} ${msg.message}\n`);
+			} catch {}
+		}
+	}
+	function emit(wireLevel, message, args) {
+		const sanitizedArgs = args.map((a) => sanitizeArg(a));
+		safePost({
+			type: "log",
+			level: wireLevel,
+			message,
+			args: tags.length > 0 ? [sanitizeArg({ tags }), ...sanitizedArgs] : sanitizedArgs,
+			timestamp: Date.now()
+		});
+	}
+	return {
+		level,
+		verbose: (message, ...args) => emit("debug", message, args),
+		debug: (message, ...args) => emit("debug", message, args),
+		info: (message, ...args) => emit("info", message, args),
+		warn: (message, ...args) => emit("warn", message, args),
+		error: (message, ...args) => emit("error", message, args),
+		errorHandler: ((...data) => {
+			const first = data[0];
+			emit("error", typeof first === "string" ? first : "", data.slice(1));
+		}),
+		child: (childTags) => createForwardingLogger(post, level, [...tags, ...childTags])
+	};
+}
 //#endregion
-export { selectDecisionModel as A, RevisionMismatchError as B, InvalidModuleError as C, createEmptyConsistencyToken as D, createConsistencyToken as E, AppendConditionFailedError as F, DocumentNotFoundError as G, AuthTimestampNotMonotonicError as H, DocumentAlreadyExistsError as I, UpgradePreconditionFailedError as J, ExcessiveReshuffleError as K, DocumentExistence as L, authDecisionModel as M, buildDecisionModel as N, targetDocumentId as O, APPEND_CONDITION_FAILED_PREFIX as P, __exportAll as Q, DuplicateOperationError as R, DuplicateModuleError as S, GATED_DOCUMENT_ACTIONS as T, AuthorizationDeniedError as U, AuthEnforcementDisabledError as V, DocumentDeletedError as W, parsePagingOptions as X, matchesScope as Y, throwIfAborted as Z, DocumentMetaCache as _, createForwardingPoolInstrumentation as a, JobExecutorEventTypes as b, KyselyKeyframeStore as c, DriveCollectionId as d, KyselyExecutionScope as f, KyselyOperationIndex as g, KyselyWriteCache as h, runMigrations as i, documentDecisionModel as j, decideAtHead as k, DocumentModelRegistry as l, EventBus as m, REACTOR_SCHEMA as n, instrumentPgPool as o, resolveFeatureFlags as p, InvalidOperationTimestampError as q, getMigrationStatus as r, KyselyOperationStore as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, SimpleJobExecutor as u, CollectionMembershipCache as v, ModuleNotFoundError as w, DuplicateManifestError as x, DEFAULT_DEFERRED_JOB_TTL_MS as y, OptimisticLockError as z };
+export { OptimisticLockError as $, DEFAULT_DEFERRED_JOB_TTL_MS as A, summarizeSubmittedActions as B, SettledWatermark as C, snapshotFunctionsFor as D, parseSnapshot as E, ModuleNotFoundError as F, authDecisionModel as G, decideAtHead as H, GATED_DOCUMENT_ACTIONS as I, APPEND_CONDITION_FAILED_PREFIX as J, buildDecisionModel as K, createConsistencyToken as L, DuplicateManifestError as M, DuplicateModuleError as N, DocumentMetaCache as O, InvalidModuleError as P, DuplicateOperationError as Q, createEmptyConsistencyToken as R, ProbeSettler as S, describeWaitingSessions as T, selectDecisionModel as U, targetDocumentId as V, documentDecisionModel as W, DocumentAlreadyExistsError as X, AppendConditionFailedError as Y, DocumentExistence as Z, KyselyExecutionScope as _, throwIfAborted as _t, DEFAULT_DRIVE_CONTAINER_TYPES as a, DocumentNotFoundError as at, KyselyWriteCache as b, runMigrations as c, InvalidSignatureError as ct, KyselyOperationStore as d, UnsupportedStoredProtocolError as dt, RevisionMismatchError as et, KyselyKeyframeStore as f, UpgradePreconditionFailedError as ft, PassthroughSigner as g, parsePagingOptions as gt, verifyActionSignature as h, matchesScope as ht, fromErrorInfo as i, DocumentDeletedError as it, JobExecutorEventTypes as j, CollectionMembershipCache as k, createForwardingPoolInstrumentation as l, RelationshipNotFoundError as lt, SimpleJobExecutor as m, ReactorEventTypes as mt, errorToInfo as n, AuthTimestampNotMonotonicError as nt, REACTOR_SCHEMA as o, ExcessiveReshuffleError as ot, DocumentModelRegistry as p, EventBusAggregateError as pt, DriveCollectionId as q, sanitizeArg as r, AuthorizationDeniedError as rt, getMigrationStatus as s, InvalidOperationTimestampError as st, createForwardingLogger as t, AuthEnforcementDisabledError as tt, instrumentPgPool as u, UnsupportedProtocolVersionError as ut, resolveFeatureFlags as v, yieldToMain as vt, createKyselyWatermarkProbe as w, KyselyOperationIndex as x, EventBus as y, __exportAll as yt, submittedActionIds as z };
 
-//# sourceMappingURL=drive-container-types-aO-PASn7.js.map
+//# sourceMappingURL=forwarding-logger-BkwlvD9W.js.map