@rotorsoft/act 1.32.13 → 1.32.15

package/dist/index.cjs

@@ -635,12 +635,12 @@ var InMemoryStream = class {
   _leased_until = void 0;
   _priority = 0;
   _lane = DEFAULT_LANE;
-  // Persisted next-visit time (#1090). When set and still in the future, the
+  // Persisted next-visit time. When set and still in the future, the
   // stream is held out of `claim` entirely — so a deferred reaction is not
   // re-claimed (and `retry` is never bumped) until its due-time passes. Unlike
   // in-process backoff, this is durable store state shared across workers.
   _deferred_at = void 0;
-  // Work mark (#1485): highest event id observed to resolve to this target.
+  // Work mark: highest event id observed to resolve to this target.
   // `undefined` means UNKNOWN — the row predates the mark, so `claim` falls
   // back to the legacy has-work probe rather than treating it as "no work".
   _correlated_at = void 0;
@@ -686,7 +686,7 @@ var InMemoryStream = class {
     this._priority = priority;
   }
   get is_available() {
-    return !this._blocked && (!this._leased_until || this._leased_until <= /* @__PURE__ */ new Date()) && // A stream deferred to a future time is not claimable until due (#1090).
+    return !this._blocked && (!this._leased_until || this._leased_until <= /* @__PURE__ */ new Date()) && // A stream deferred to a future time is not claimable until due.
     (!this._deferred_at || this._deferred_at <= Date.now());
   }
   /**
@@ -716,7 +716,7 @@ var InMemoryStream = class {
   get leased_until() {
     return this._leased_until;
   }
-  /** Persisted next-visit time (#1090/#1221), or undefined when no active defer. */
+  /** Persisted next-visit time, or undefined when no active defer. */
   get deferred_at() {
     return this._deferred_at;
   }
@@ -831,16 +831,16 @@ var InMemoryStore = class {
   _next_id = 0;
   // stored stream positions and other metadata
   _streams = /* @__PURE__ */ new Map();
-  /** Correlate checkpoint (#1484): how far the log has been READ. */
+  /** Correlate checkpoint: how far the log has been READ. */
   _correlated_at = -1;
   /**
-   * Per-correlator checkpoint and lease (#1532), keyed by correlator.
+   * Per-correlator checkpoint and lease, keyed by correlator.
    *
    * Keyed rather than singular because correlators that look for different
    * things read the log for different reasons: sharing one position lets a
    * partial-behaviour worker inherit another's, and sharing one lease lets
    * one starve the other. Callers that supply no correlator use
-   * `_correlated_at` instead, which is the pre-#1532 behaviour.
+   * `_correlated_at` instead, the shared checkpoint.
    */
   _correlators = /* @__PURE__ */ new Map();
   // last committed version per stream — O(1) replacement for filter-on-commit
@@ -2470,7 +2470,7 @@ var CloseSignal = class extends Error {
    */
   at;
   /**
-   * Windowed close (#1011): prune events older than this cutoff behind
+   * Windowed close: prune events older than this cutoff behind
    * the closest safe snapshot instead of retiring the stream. Thrown by
    * the autoclose reaction of a `.autocloses({ keep })` state; flows
    * into {@link CloseTarget.before}. Omitted → a full close.
@@ -2548,7 +2548,7 @@ var SettleOptionsSchema = DrainOptionsSchema.extend({
   // rejects `±Infinity`, and an integer check cannot pass it either. Wrapper
   // code normalizing an optional cap (`maxPasses: opts.maxPasses ?? Infinity`)
   // is the natural way to hit it. Accepting it also honors this module's own
-  // rule that a value which works today is never newly rejected (#1711).
+  // rule that a value which works today is never newly rejected.
   maxPasses: import_zod6.z.union([import_zod6.z.number().int().min(0), import_zod6.z.literal(Number.POSITIVE_INFINITY)]).optional()
 }).loose();
 function resolveSettleConfig(options) {
@@ -3190,7 +3190,7 @@ var CorrelateCycle = class {
   _checkpoint = -1;
   _initialized = false;
   /**
-   * This worker's identity for the correlation lease (#1532). A per-instance
+   * This worker's identity for the correlation lease. A per-instance
    * UUID, matching the drain's convention, so a renewal is recognised as the
    * same holder and a restarted process never inherits a stale claim.
    */
@@ -3206,24 +3206,15 @@ var CorrelateCycle = class {
    * When this worker's correlation lease runs out, as a local clock reading,
    * or 0 when it holds none.
    *
-   * Asking the store on every pass costs a round trip that the holder — which
-   * is the *only* worker in a single-node deployment, and the steady-state
-   * one everywhere else — gains nothing from: it already knows the answer.
-   * The act-sqlite perf gate caught that as a 1.5x regression on
-   * correlate+drain, which is the shape an embedded app runs constantly.
-   *
-   * Believing this while the store disagrees is safe in the one direction it
-   * can fail. A worker that scans without really holding the lease produces
-   * the duplicate scan that existed before the lease, and the marks are
-   * idempotent — so a stale belief costs work, never correctness.
+   * Cached so the holder doesn't ask the store on every pass. A stale belief
+   * can only cause a duplicate scan, and marks are idempotent, so it costs
+   * work, never correctness.
    */
   _lease_until = 0;
   /**
-   * Whether a scan might find anything. The drain has carried the same flag
-   * since it was written — a commit raises it, an empty claim lowers it, and
-   * a disarmed drain returns without touching the store. Correlate had no
-   * equivalent, so a settle pass always scanned, including the final pass
-   * whose only job is to confirm nothing changed (#1510).
+   * Whether a scan might find anything, like the drain's flag: a commit or
+   * notification raises it, a short page lowers it, and a disarmed scan
+   * returns without touching the store.
    *
    * Starts armed: the log may already hold events this process has never
    * correlated, and only a scan can find out.
@@ -3232,15 +3223,9 @@ var CorrelateCycle = class {
   /** In-flight init, memoized for single-flight and cleared on failure. */
   _init_promise;
   // Dynamically discovered targets → what each was last subscribed at,
-  // bounded by `maxSubscribedStreams`. The static half lives in
-  // `_static_subscriptions` below, which is deliberately not evictable.
-  //
-  // Every scan re-subscribes the
-  // targets it resolved (that is how the work mark lands), so this no longer
-  // decides *whether* a target is sent — it decides *what* is sent with it:
-  // a resolution raises priority/lane only when it beats the recorded floor,
-  // and otherwise re-sends the row's own values so the mark changes nothing
-  // else. See {@link Subscription}.
+  // bounded by `maxSubscribedStreams`. It decides *what* a scan sends with a
+  // target: priority/lane only when the resolution beats the recorded floor,
+  // otherwise the row's own values. See {@link Subscription}.
   _dynamic_subscriptions;
   /**
    * What each static target was subscribed at by `init`. A plain map, never
@@ -3248,14 +3233,8 @@ var CorrelateCycle = class {
    * is already bounded by the registry and costs nothing the registry does
    * not already hold.
    *
-   * Keeping these out of the LRU is what makes the `+Infinity` floor an
-   * invariant rather than a race (#1582). Sharing the bounded map meant a
-   * churn of dynamic targets could evict a static record, and the next
-   * dynamic resolution to that target found no record, took the
-   * first-discovery branch, and re-subscribed the target with its own
-   * priority and lane — silently re-laning a stream whose lane the
-   * build-time subscribe owns, and starving it wherever `onlyLanes` had
-   * provisioned a worker for the declared lane.
+   * Kept out of the LRU so eviction can never drop a static target's
+   * `+Infinity` floor and let a dynamic resolution re-lane it.
    */
   _static_subscriptions = /* @__PURE__ */ new Map();
   /** Compiled pattern sources, bounded by {@link PATTERN_CACHE_SIZE}. */
@@ -3265,17 +3244,13 @@ var CorrelateCycle = class {
   _cd;
   _on_init;
   /**
-   * Async cold-start hook (#1221). Runs once, after the sync `on_init`,
-   * inside the same `init()` await. The orchestrator uses it to re-seed the
-   * process-local defer timers from the store's persisted `deferred_at` so
-   * an idle deferred stream re-arms its drain across a restart. Kept
-   * separate from `on_init` because seeding is an async store read; `init`
-   * already awaits, so folding it in here preserves the "runs exactly once"
-   * guarantee without a second gate on the Act side.
+   * Async cold-start hook, run once after `on_init` inside `init()`. The
+   * orchestrator re-seeds its defer timers from the persisted `deferred_at`
+   * here, so an idle deferred stream re-arms across a restart.
    */
   _on_init_async;
   /**
-   * Tail re-scan window applied to the cold-start checkpoint (ACT-1207).
+   * Tail re-scan window applied to the cold-start checkpoint.
    * See {@link DEFAULT_COLD_START_BACK_SCAN}. Constructor arg (not a
    * public option) so tests can shrink it; defaults otherwise.
    */
@@ -3327,7 +3302,7 @@ var CorrelateCycle = class {
    * - Reads the durable correlate checkpoint (and max(at)) from the store,
    *   flooring a first boot at `watermark - back_scan` so an event
    *   committed-but-not-correlated before a crash is re-scanned on
-   *   restart instead of skipped (ACT-1207)
+   *   restart instead of skipped
    * - Subscribes static resolver targets (idempotent upsert)
    * - Populates the subscribed-streams LRU
    * - Fires `on_init` once (Act uses this to flag a cold-start drain)
@@ -3358,21 +3333,6 @@ var CorrelateCycle = class {
     }
     await this._on_init_async?.();
   }
-  /**
-   * Forget targets whose subscription rows no longer exist, so a later
-   * scan can re-subscribe them.
-   *
-   * A full close deletes the closed stream's subscription row. The
-   * in-process dedup would otherwise still believe the target is
-   * subscribed and never re-issue `subscribe()`, silently stopping
-   * delivery for any reaction whose target is named after the stream —
-   * the documented per-aggregate shape `.to(e => ({target: e.stream}))`
-   * makes those two namespaces collide by construction (#1398).
-   *
-   * Static targets are left alone: their record lives in
-   * `_static_subscriptions`, which this never touches, so they stay pinned
-   * at +Infinity and the dynamic path never re-opens them.
-   */
   /**
    * Start correlation over after the event log was replaced wholesale
    * (`restore`). The restored log is renumbered from the start and its
@@ -3381,7 +3341,7 @@ var CorrelateCycle = class {
    * and the init latch makes the next pass run cold-start again: static
    * targets are re-subscribed, the checkpoint is re-read from the store
    * (which `restore` reset), and dynamic targets are rediscovered by the
-   * scan (#1772).
+   * scan.
    */
   restart() {
     this._initialized = false;
@@ -3391,6 +3351,11 @@ var CorrelateCycle = class {
     this._static_subscriptions.clear();
     this._armed = true;
   }
+  /**
+   * Forget dynamic targets whose subscription rows no longer exist (a full
+   * close deletes the row), so a later scan re-subscribes them. Static
+   * targets keep their records.
+   */
   forget_subscribed(streams) {
     for (const stream of streams) this._dynamic_subscriptions.delete(stream);
   }
@@ -3415,7 +3380,7 @@ var CorrelateCycle = class {
    * Scan the events past the checkpoint, resolve each to its target
    * streams, and record what it found through `cd.subscribe` — new dynamic
    * targets get registered, and every target an event resolved to gets its
-   * **work mark** raised to that event's id (#1487).
+   * **work mark** raised to that event's id.
    *
    * Both resolver kinds are walked. A static target is already subscribed
    * at init, but marking it is what makes it claimable without probing the
@@ -3502,18 +3467,10 @@ var CorrelateCycle = class {
           }
         }
       },
-      // Decline the sensitive payload: this scan reads `name`/`stream`/`id`
-      // to resolve reaction targets and throws the rest away. Asking for a
-      // payload it discards made one unreadable row stop EVERY stream's
-      // reactions — correlate is the sole producer of the work mark, so a
-      // decrypt failure here strands the whole app with nothing blocked and
-      // nothing naming the row (#1675).
-      //
-      // A dynamic `.to(event => …)` resolver therefore sees `pii: null`.
-      // That is deliberate and is itself a fix: correlate runs actor-less,
-      // so handing a resolver decrypted plaintext is un-gated disclosure —
-      // the defect #1673 corrected on the drain return and #1277 before it.
-      // `data` already carries no sensitive keys; nothing merges them here.
+      // Decline the sensitive payload: the scan only needs name/stream/id,
+      // and one undecryptable row would otherwise stop every stream's
+      // reactions. Resolvers therefore see `pii: null`; correlate runs
+      // actor-less, so plaintext here would be un-gated disclosure.
       { ...query, after, with_pii: false }
     );
     const streams = [];
@@ -3557,18 +3514,9 @@ var CorrelateCycle = class {
   /**
    * Hand the correlation lease back early.
    *
-   * There is no release verb on the port, deliberately — expiry is the only
-   * path, which keeps a crash and a clean stop on the same code path. A
-   * holder can still shorten its own lease, because re-acquiring as the same
-   * holder renews, and renewing to a millisecond is a release in all but
-   * name.
-   *
-   * Without this a worker that stops cleanly still blocks discovery for the
-   * rest of its lease — invisible in a long-lived deployment, very visible
-   * anywhere Acts are created and dropped inside one process.
-   *
-   * Best-effort: failing here costs the lease's remaining lifetime, which is
-   * what would have happened had the process died instead.
+   * The port has no release verb; re-acquiring as the same holder with a
+   * zero duration releases it. Best-effort: a failure costs the lease's
+   * remaining lifetime, as a crash would.
    */
   async release_correlation() {
     try {
@@ -4054,26 +4002,11 @@ async function load(me, target, callback, patch_fn = bare_patch) {
     {
       stream,
       stream_exact: true,
-      // The snapshot resume floor is a current-state optimization: it only
-      // holds when the load has no window of its own. `time_travel` already
-      // captures that (any `asOf` bound set), so request `with_snaps` only for
-      // a non-time-travel cold load — a bounded load full-scans real events
-      // under its `asOf` filter. This is the single floor-eligibility decision
-      // for the whole system; the stores apply the floor whenever asked and
-      // never re-derive it (RFC 1274).
-      //
-      // The warm path resumes from `after`, and MUST also carry `with_snaps`
-      // (#1345): `after` and `with_snaps` are independent store conditions —
-      // `after` bounds the scan (id > cached.event_id), `with_snaps` keeps
-      // `__snapshot__` rows in the result. A stale (lagging/cross-process)
-      // cache checkpoint can sit below a newer `__snapshot__` boundary, and a
-      // windowed close (`app.close`/`.autocloses({keep})`) may have pruned the
-      // domain events between the checkpoint and that snapshot. Without
-      // `with_snaps` the rebaselining snapshot is filtered out and the fold
-      // silently applies the surviving tail on top of stale state (wrong
-      // count, yet `version` still reports the true head — the concurrency
-      // guard passes). With it, the snapshot in the after-window rebaselines
-      // the fold; when no snapshot falls in the window it is a no-op.
+      // `with_snaps` on every non-time-travel load. Cold, it resumes from the
+      // latest snapshot (this is the only place that decides it; stores just
+      // apply it). Warm, it keeps a snapshot above a stale checkpoint in the
+      // result, so a windowed close that pruned the events in between can't
+      // make the fold apply the tail onto stale state.
       ...cached ? { after: cached.event_id, with_snaps: true } : { ...time_travel ? {} : { with_snaps: true }, ...asOf }
     }
   );
@@ -4100,7 +4033,7 @@ async function load(me, target, callback, patch_fn = bare_patch) {
     // Head event id, captured atomically with `state`: the last replayed
     // event's id on a cache miss, or the cached checkpoint's event_id on a
     // warm hit with no new events. Consumers read this instead of a
-    // separate cache lookup that could race a concurrent commit (ACT-1204).
+    // separate cache lookup that could race a concurrent commit.
     id: event?.id ?? cached?.event_id ?? -1,
     patches,
     snaps,
@@ -4178,14 +4111,8 @@ async function action(me, action2, target, payload, options, patch_fn = bare_pat
           stream,
           emitted,
           meta,
-          // Reactions skip the INFERRED guard: they always append against the
-          // current head. Stream leasing already serializes concurrent reactions,
-          // and forcing version checks here would turn ordinary catch-up into
-          // spurious retries. An expectedVersion the caller passed explicitly is
-          // still honored — dropping a guard the caller asked for is silent data
-          // loss, and the reaction context can reach further than the handler
-          // (detached timers, settle cycles) where the caller never intended a
-          // reaction's semantics at all.
+          // Reactions skip the inferred version guard (leases already
+          // serialize them); an explicit expectedVersion is still honored.
           reactingTo ? expectedVersion : expected
         );
       } catch (error) {
@@ -4561,32 +4488,25 @@ var DrainController = class {
   _locked = false;
   _ratio = 0.5;
   /**
-   * Per-stream re-visit schedule (#1090): `stream → next visit` (ms since
-   * epoch). Holds both retry backoff (`HandleResult.next_attempt_at`) and the
-   * `defer` outcome; cleared on successful ack or terminal block. Lives in
-   * process memory — per-worker pacing by design (see {@link BackoffOptions}
-   * for the multi-worker trade-off). Its wake re-arms drain at the earliest
-   * pending visit.
+   * Local wake for streams this worker parked (backoff or defer). The
+   * schedule itself is persisted in the store; this only re-arms the drain
+   * at the earliest pending visit.
    */
   _defer = new DeferTimer(() => {
     this._armed = true;
   });
-  /** Worker timer (ACT-1103). Set when `start()` is active, undefined otherwise. */
+  /** Worker timer. Set when `start()` is active, undefined otherwise. */
   _worker;
   /**
-   * Misroutings this controller has reported (#1563). A resolver returning a
+   * Misroutings this controller has reported. A resolver returning a
    * projection's target does so for every matching event; one line per event
    * would bury the signal it exists to raise.
    */
   _misrouted = /* @__PURE__ */ new Set();
   _stopped = false;
   /**
-   * Resolves when the cycle currently in flight finishes; `undefined` when
-   * no cycle is running (#1442). `_locked` answers "is a cycle running?" for
-   * the overlap guard; this answers "tell me when it is done" for a graceful
-   * shutdown, which needs to await the handler rather than abandon it
-   * mid-`await` with the stream still leased. Never rejects — `drain()`
-   * contains its own errors — so awaiting it is always safe.
+   * Resolves when the cycle in flight finishes, so a graceful shutdown can
+   * wait for it. Never rejects.
    */
   _inflight;
   _inflight_done;
@@ -4603,16 +4523,9 @@ var DrainController = class {
     this._armed = true;
   }
   /**
-   * Re-seed a persisted defer schedule into the process-local timer at cold
-   * start (#1221). The `_defer` map lives in worker memory and is empty
-   * after a restart; a stream deferred to a future due-time (e.g. an idle
-   * autoclose aggregate) is durable in the store's `deferred_at` but has
-   * nothing in memory to re-arm the drain at the due-time. The orchestrator
-   * reads the persisted `deferred_at` for this controller's lane and calls
-   * this to park the stream + (re)schedule the shared wake — so the drain
-   * re-arms at the due-time with no intervening commit. `schedule()`
-   * collapses many seeds into one timer, so callers may seed in a loop and
-   * let the earliest due-time win.
+   * Re-seed a persisted `deferred_at` into the local wake at cold start, so
+   * an idle deferred stream re-arms at its due-time with no new commit.
+   * Seeds collapse into one timer; the earliest wins.
    */
   seed_defer(stream, at) {
     this._defer.set(stream, at);
@@ -4622,31 +4535,21 @@ var DrainController = class {
   get armed() {
     return this._armed;
   }
-  /**
-   * The cycle currently in flight, or `undefined` when idle (#1442). A
-   * graceful shutdown awaits this so an in-flight handler reaches its `ack`
-   * — which releases the stream's lease — instead of being abandoned with
-   * the lease held until it expires.
-   */
+  /** The cycle in flight, or `undefined` when idle. */
   get inflight() {
     return this._inflight;
   }
-  /**
-   * This lane's configured lease budget, or `undefined` when the lane didn't
-   * pin one. It is the operator's own statement of how long a handler may
-   * legitimately hold a stream, which makes it the right basis for a
-   * shutdown grace budget (#1442).
-   */
+  /** This lane's configured lease, or `undefined`; the shutdown grace basis. */
   get lease_millis() {
     return this._deps.defaults?.leaseMillis;
   }
-  /** Lane this controller drains (undefined = legacy single-lane span). */
+  /** Lane this controller drains (undefined spans all lanes). */
   get lane() {
     return this._deps.lane;
   }
   /**
    * Start a per-lane worker that drains at the lane's `cycleMs`
-   * cadence (ACT-1103). When armed, the worker calls `drain()` on every
+   * cadence. When armed, the worker calls `drain()` on every
    * tick and re-schedules; when not armed, it still re-schedules at
    * `cycleMs` so a future `arm()` is picked up on the next tick.
    *
@@ -4833,26 +4736,13 @@ var SettleLoop = class {
   _timer = void 0;
   _running = false;
   /**
-   * Resolves when the cycle currently in flight finishes; `undefined` when
-   * idle (#1468). `_running` answers "is a cycle running?" for the
-   * re-arm bookkeeping; this answers "tell me when it is done" for a
-   * graceful shutdown.
-   *
-   * `stop()` only cancels *scheduling* — a cycle already inside its
-   * correlate → drain loop keeps going, and because `DrainController.drain`
-   * does not consult `_stopped`, it can claim a stream after teardown
-   * returned and after the store adapter was disposed. Never rejects: the
-   * cycle's own `catch` contains its errors, so awaiting this is safe.
+   * Resolves when the cycle in flight finishes, so shutdown can wait for
+   * it (`stop()` cancels scheduling only). Never rejects.
    */
   _inflight;
   /**
-   * Set when a `schedule()` timer fires while a cycle is still running
-   * (ACT-1205). The in-flight cycle's `finally` re-arms one more pass so
-   * the wake-up isn't dropped — a commit landing during the final
-   * no-progress drain pass would otherwise leave armed controllers with
-   * nothing to re-drain on an instance with no lane `cycleMs` and no
-   * polling. Carries the options of the dropped call so the re-armed
-   * pass honors its `debounceMs`/`maxPasses`/drain overrides.
+   * A wake-up that fired while a cycle was running. The running cycle's
+   * `finally` schedules one more pass with these options, so it isn't lost.
    */
   _pending = void 0;
   _deps;
@@ -4924,7 +4814,7 @@ var SettleLoop = class {
     }, debounceMs);
   }
   /**
-   * The cycle currently in flight, or `undefined` when idle (#1468). A
+   * The cycle currently in flight, or `undefined` when idle. A
    * graceful shutdown awaits this alongside the drain controllers so a
    * settle parked in `correlate` does not resume after teardown.
    */
@@ -5070,17 +4960,17 @@ function validate_only_lanes(options, lanes) {
 }
 var Act = class {
   _emitter = new import_node_events.default();
-  /** ACT-984: orchestrator-owned circuit breaker shared by all drain lanes. */
+  /** Circuit breaker shared by all drain lanes. */
   _breaker;
-  /** #803: gate the `Store.notify` subscription side. */
+  /** Whether this instance subscribes to `Store.notify`. */
   _listen;
-  /** #803: gate the local reaction pipeline (drain controllers, settle, correlate). */
+  /** Whether this instance runs reactions (drain, settle, correlate). */
   _drain;
   /** Event names with at least one registered reaction (computed at build time) */
   _reactive_events;
   /** One DrainController per active lane, keyed by lane name. */
   _drain_controllers;
-  /** Correlation state machine: lazy init, dynamic-resolver scan, periodic worker. */
+  /** Correlation: lazy init and the scan that marks work. */
   _correlate;
   /** Debounced correlate→drain catch-up loop. */
   _settle;
@@ -5110,26 +5000,10 @@ var Act = class {
    * Emit a lifecycle event. The payload type is inferred from the event name
    * via {@link ActLifecycleEvents}.
    *
-   * **Every listener is contained individually.** Lifecycle listeners are
-   * observers — `observability.md` promises that a throwing one is "contained,
-   * not fatal" — and containment belongs here rather than at each call site,
-   * for two reasons the previous arrangement got wrong (#1437):
-   *
-   * - Wrapping the *emit* rather than each *listener* still let the first
-   *   thrower abort the rest: `EventEmitter.emit` stops dispatching on the
-   *   first exception, so a second `app.on("acked", …)` never ran. The
-   *   documented "the remaining sinks still fire" was false whenever an event
-   *   had more than one listener. Same lesson as #1423, where guarding the
-   *   loop instead of each callback left every later SSE subscriber unserved.
-   * - Only *some* call sites wrapped at all. The drain contained `acked` and
-   *   `blocked`; `committed`, `forgotten` and `close()`'s `closed` did not, so
-   *   a throwing listener rejected `do()`, `forget()` and `close()` **after**
-   *   their durable work had already landed. A caller retrying a "failed"
-   *   `do()` writes the event twice, since the framework has no dedup by
-   *   design.
-   *
-   * Containing here makes it a property of emitting, so a new lifecycle event
-   * cannot reintroduce the gap by omission.
+   * Each listener is contained on its own: a throwing listener is logged,
+   * the remaining listeners still run, and the caller (`do()`, `forget()`,
+   * `close()`, the drain) never sees the throw, since its durable work has
+   * already landed.
    *
    * Uses `rawListeners` so `once` wrappers still de-register themselves, and
    * returns "had listeners" to preserve the `EventEmitter.emit` contract.
@@ -5190,29 +5064,23 @@ var Act = class {
    */
   _event_to_state;
   /**
-   * Event-name → lane fan-in for selective arming (ACT-1103). Built by
+   * Event-name → lane fan-in for selective arming. Built by
    * `classify_registry` once per build. `"all"` means at least one of
    * the event's reactions is a dynamic resolver (lane opaque until
    * runtime); a `Set<string>` lists the static lanes only that event's
    * reactions target.
    */
   _event_to_lanes;
-  /**
-   * Audit dependency bag (#723). Built once at construction; held as
-   * an immutable snapshot of the registry state the audit module
-   * needs. Lives in `internal/audit.ts` — this orchestrator never
-   * carries audit logic, only the deps + a one-liner that hands them
-   * over.
-   */
+  /** What `internal/audit.ts` needs, built once at construction. */
   _audit_deps;
   /** Logger resolved at construction time (after user port configuration) */
   _logger = log();
-  /** Wraps a public-method body so internal `store()`/`cache()` resolve to the
-   * per-Act ports (ACT-501). No-op when the Act is unscoped — so the singleton
-   * path keeps reading fresh `store()`/`cache()` per call, which matters for
-   * tests that dispose and re-seed mid-suite. */
   /** This Act's ports: its own bag, or the singleton adapters. */
   _ports;
+  /**
+   * Runs a body inside this Act's ports frame, so internal
+   * `store()`/`cache()` calls resolve to `_ports`.
+   */
   _scoped;
   /**
    * Correlation-id generator for originating actions. Bound at
@@ -5231,24 +5099,18 @@ var Act = class {
   /** Reaction dispatchers built once and handed to run_drain_cycle each cycle. */
   _handle;
   _handle_batch;
-  /** Declared drain lanes (ACT-1103). */
+  /** Declared drain lanes. */
   _lanes;
   /**
-   * Per-stream close serialization tails (#1222). Chains each stream's
-   * windowed-close work behind the previous one so a manual
-   * `app.close([{stream, before}])` and an autoclose windowed close for
-   * the same stream never run their guard-free prune concurrently — the
-   * manual path bypasses the `__autoclose__:X` drain lease that would
-   * otherwise exclude them, so without this both closers archive the
-   * same prefix. Process-local: both racers run on the same Act
-   * instance. Entries are dropped once their tail resolves so the map
-   * doesn't grow with distinct stream names.
+   * Per-stream close serialization tails, so a manual close and an
+   * autoclose of the same stream never prune concurrently (the manual path
+   * has no drain lease to exclude it). Entries are dropped once settled.
    */
   _close_locks = /* @__PURE__ */ new Map();
   /**
-   * Run `work` under the per-stream close lock (#1222). Serializes close
-   * critical sections for the same stream (windowed prunes, and full closes
-   * since #1738) while letting different streams proceed in parallel.
+   * Run `work` under the per-stream close lock. Serializes close
+   * critical sections for the same stream (windowed prunes and full
+   * closes) while letting different streams proceed in parallel.
    */
   _with_close_lock(stream, work) {
     const prev = this._close_locks.get(stream) ?? Promise.resolve();
@@ -5275,11 +5137,11 @@ var Act = class {
    * @param states    Merged map of state name → state definition
    * @param batch_handlers Static-target projection batch handlers (target → handler)
    * @param options   Tuning knobs — see {@link ActOptions}
-   * @param lanes     Declared drain lanes (ACT-1103). The builder collects
-   *   these from `.withLane(...)` calls. Slice 1 records them on the
-   *   instance; later slices fan out one `DrainController` per lane.
+   * @param lanes     Declared drain lanes. The builder collects
+   *   these from `.withLane(...)` calls; one `DrainController` runs
+   *   per lane, plus the implicit `"default"`.
    * @param patch_fn  The per-event patch step selected once by the builder
-   *   from `ActOptions.validateFoldedState` (ACT-1238) — `bare_patch` by
+   *   from `ActOptions.validateFoldedState` — `bare_patch` by
    *   default, `validating_patch` when the flag is on. The builder uses
    *   the same value for its projection-fold handlers, so there is a
    *   single selection site. Defaults to `bare_patch` for direct
@@ -5294,16 +5156,15 @@ var Act = class {
     this._ports = options.scoped ?? default_scope();
     const ports = this._ports;
     this._scoped = make_run_scoped({
-      // Delegating getters, NOT a spread: `default_scope()` resolves the
-      // process singletons lazily, so copying its properties would freeze
-      // whichever adapters happened to be installed at construction and
-      // ignore a later `store(...)` / `cache(...)`.
+      // Getters, not a spread: the singletons resolve lazily, so a later
+      // `store(...)` / `cache(...)` still takes effect.
       get store() {
         return ports.store;
       },
       get cache() {
         return ports.cache;
       },
+      // Parsed per build, so a bad window throws on every build.
       autoclose_window: resolveAutocloseConfig(options).autocloseWindow
     });
     this._correlator = options.correlator ?? default_correlator;
@@ -5311,8 +5172,6 @@ var Act = class {
     this._cd = build_drain(this._logger);
     this._handle = build_handle({
       logger: this._logger,
-      // The orchestrator owns ambient context; `build_handle` only asks for
-      // the triggering event to be in scope while the handler runs.
       reaction_scope: make_reaction_scope({
         do: this._bound_do,
         load: this._bound_load,
@@ -5347,16 +5206,8 @@ var Act = class {
       resolveCircuitBreakerConfig(options.circuitBreaker),
       {
         on_error: (error, circuit) => this._emit_error(error, circuit),
-        // Re-probe the store when the cooldown elapses, so recovery is
-        // automatic even on the default lane (which has no periodic poller).
-        // The wake fires `settle()`, which (in half-open) runs a real store
-        // probe: for a dynamic-resolver app the probe is settle's correlate
-        // (a store scan); for a static-reaction app correlate is a no-op that
-        // records no health, so the probe is settle's DRAIN claim — either
-        // way one success closes the breaker and every loop resumes, a
-        // failure re-opens it and reschedules the wake. Settle does NOT close
-        // the breaker off a no-op correlate (#1329) — only a real store op
-        // (correlate scan or drain claim) records `passed()`.
+        // When the cooldown elapses, settle once: its scan or claim is the
+        // half-open probe that closes or re-opens the breaker.
         on_retry: () => {
           this.settle({ debounceMs: 0 });
         }
@@ -5364,12 +5215,9 @@ var Act = class {
     );
   }
   /**
-   * One DrainController per active lane. The implicit "default" lane is
-   * always present unless onlyLanes excludes it. Each controller filters
-   * its claim() by its lane name; the legacy single-controller path is the
-   * no-lane-declared case with `lane: undefined` deps so claim() doesn't
-   * filter (preserves the single-lane SQL planner shape for apps that never
-   * call withLane).
+   * One DrainController per active lane, plus the implicit "default" unless
+   * `onlyLanes` excludes it. Apps that declare no lanes pass no lane filter
+   * to `claim`.
    */
   _build_drain_controllers(options, lanes) {
     const all_lanes = ["default", ...lanes.map((l) => l.name)];
@@ -5388,11 +5236,7 @@ var Act = class {
         handle_batch: this._handle_batch,
         on_acked: (acked) => this.emit("acked", acked),
         on_blocked: (blocked) => this.emit("blocked", blocked),
-        // Reaction-requested close. Runs the same close machinery as
-        // `app.close` (tombstone guard + archive + atomic truncate) for the
-        // targets a handler signalled via `CloseSignal`. No `correlate()`
-        // here — the drain that produced these targets has already
-        // correlated.
+        // Reaction-requested close: the same machinery as `app.close`.
         on_close: async (targets) => {
           const close_actor = { id: "$close", name: "close" };
           const result = await run_close_cycle(targets, {
@@ -5409,12 +5253,7 @@ var Act = class {
           this.emit("closed", result);
         },
         breaker: this._breaker,
-        // Re-scope the per-lane worker's auto-start ticks so their drain
-        // resolves the scoped ports, not the singleton (#1191).
         run_scoped: this._scoped,
-        // Pass lane only when a true per-lane controller is active.
-        // The all-lanes (single default) case keeps lane=undefined so
-        // adapter SQL collapses to the single-lane shape.
         lane: single_default_lane ? void 0 : name,
         defaults: cfg && {
           streamLimit: cfg.streamLimit,
@@ -5428,17 +5267,9 @@ var Act = class {
     return controllers;
   }
   /**
-   * Orphaned-lane startup advisory (#1220). When `onlyLanes` is set, this
-   * instance builds a controller only for its slice of the declared lane
-   * universe — every OTHER declared lane's stream is persisted (correlate
-   * subscribes all static targets regardless of `onlyLanes`) but never
-   * claimed here. If no peer worker deploys with those lanes in ITS
-   * `onlyLanes`, their reactions accumulate forever, silently. A single
-   * process can't verify the cluster invariant `∪ onlyLanes ⊇ declared
-   * lanes`, so we surface the per-instance signal — "these declared lanes
-   * have no controller here" — the same way the deprecated-event advisory
-   * surfaces legacy events. No advisory when `onlyLanes` is unset (every
-   * lane gets a controller) or covers every declared lane.
+   * Startup advisory naming declared lanes that `onlyLanes` leaves without a
+   * controller here. One process can't check that the cluster covers every
+   * lane, so it reports its own gaps.
    */
   _advise_orphaned_lanes(options, lanes) {
     if (!options.onlyLanes || options.onlyLanes.length === 0) return;
@@ -5452,25 +5283,15 @@ var Act = class {
       `Act declared ${orphaned.length} orphaned lane(s) on this instance: ${list}. onlyLanes excludes them, so no DrainController claims their streams here \u2014 their reactions accumulate un-drained unless a peer worker deploys with these lanes in its onlyLanes. Ensure the cluster invariant holds: the union of every worker's onlyLanes must cover every declared lane. See docs/docs/guides/production-checklist.md \xA7 Sizing lanes.`
     );
   }
-  /**
-   * Audit deps bag. Snapshotted after registry classification and
-   * drain-controller build so the audit module sees the finalized lane
-   * set. Held as an immutable bag — the orchestrator never carries audit
-   * logic itself, only this typed contract.
-   */
+  /** Audit deps, built after the controllers so the lane set is final. */
   _build_audit_deps() {
     return {
       store: store2,
       logger: this._logger,
       event_to_state: this._event_to_state,
       states: this._states,
-      // The DECLARED lane universe — the implicit "default" plus every
-      // `.withLane(...)` name — NOT `_drain_controllers.keys()` (#1224).
-      // An `onlyLanes`-filtered instance builds a controller only for its
-      // slice of lanes, so keying off the active controller set would flag
-      // a stream correctly assigned to an excluded-but-declared lane (one
-      // another worker drains) as `unknown-lane`. The audit reports what's
-      // structurally routable across the cluster, not what this process runs.
+      // Declared lanes, not this process's controllers: a lane another
+      // worker drains is not `unknown-lane`.
       declared_lanes: /* @__PURE__ */ new Set(["default", ...this._lanes.map((l) => l.name)]),
       routed_events: new Set(this._event_to_lanes.keys())
     };
@@ -5486,10 +5307,8 @@ var Act = class {
       static_targets: classification.static_targets,
       cd: this._cd,
       max_subscribed_streams: options.maxSubscribedStreams ?? DEFAULT_MAX_SUBSCRIBED_STREAMS,
-      // Every lane a controller can exist for, so correlate can reroute a
-      // dynamic resolution that names one that doesn't (#1564). Declared,
-      // not active: `onlyLanes` shrinks this process's controllers, but a
-      // lane another process claims is still a valid destination.
+      // Declared lanes (not active ones): a lane another process claims is
+      // still a valid destination.
       declared_lanes: /* @__PURE__ */ new Set([
         "default",
         ...this._lanes.map((l) => l.name)
@@ -5497,26 +5316,14 @@ var Act = class {
       on_init: () => {
         if (this._drain && this._reactive_events.size > 0) this._arm_all();
       },
-      // Cold-start defer re-seed (#1221). Skipped on writer-only instances
-      // (`drain: false`) — they run no local controllers to re-arm.
       on_init_async: this._drain ? () => this._seed_persisted_defers() : void 0
     });
   }
   /**
-   * Re-seed every active lane controller's process-local defer timer from
-   * the store's persisted `deferred_at` (#1221). Runs once at cold start,
-   * inside `CorrelateCycle.init`, after static targets are subscribed.
-   *
-   * The defer timer is worker memory: empty after a restart. A stream
-   * deferred to a future due-time (the classic case: an idle autoclose
-   * aggregate that deferred its terminal close) is durable in the store but
-   * has nothing in memory to re-arm the drain — the controller disarms on
-   * the first empty claim and, since the aggregate is idle, no commit ever
-   * re-arms it. Reading the persisted schedule and seeding the owning lane's
-   * timer restores the wake, so the close fires at the due-time.
-   *
-   * Streams whose lane has no controller on this instance (excluded by
-   * `onlyLanes`) are skipped — a peer worker owns that lane's timer.
+   * At cold start, re-seed each lane controller's local wake from the
+   * persisted future `deferred_at`, so an idle deferred stream (an
+   * autoclose waiting out its window) still fires on time. Streams on lanes
+   * this instance doesn't run are skipped.
    */
   async _seed_persisted_defers() {
     const now = Date.now();
@@ -5530,10 +5337,6 @@ var Act = class {
   _build_settle(options) {
     return new SettleLoop(
       {
-        // Scope the init like every other store-touching path — a bare
-        // `this._correlate.init()` runs `store().subscribe(...)` against
-        // the singleton for a scoped Act, so static targets never land on
-        // the scoped store and `_initialized` then blocks a retry (#1191).
         init: () => this._scoped(() => this._correlate.init()),
         checkpoint: () => this._correlate.checkpoint,
         correlate: (q) => this._correlate_scanned(q, true),
@@ -5551,19 +5354,11 @@ var Act = class {
    * already in flight a bounded chance to finish, then remove lifecycle
    * listeners and tear down the cross-process notify subscription.
    *
-   * The order is deliberate (#1442). Scheduling stops first, so nothing new
-   * is claimed while teardown runs. Then in-flight cycles are awaited up to
-   * `graceMs`: a reaction handler parked on an `await` holds its stream's
-   * lease until it acks, so abandoning it costs the replacement worker up to
-   * `leaseMillis` of dead time on that stream and discards the round of work
-   * (which #1418 then redelivers). Listeners come off *after* that wait, not
-   * before, so an `acked` / `blocked` subscriber still observes the work
-   * that completed during the grace window.
-   *
-   * The budget is a ceiling, not a delay — teardown continues the moment the
-   * last in-flight cycle finishes. When it is exhausted, teardown proceeds
-   * anyway: one stuck handler must not hang a deploy, which is the failure
-   * mode an unbounded wait would trade for.
+   * Scheduling stops first, then in-flight cycles get up to `graceMs` to
+   * reach their `ack` (an abandoned handler holds its lease until it
+   * expires). Listeners come off after the wait, so they still see work that
+   * finished during it. The budget is a ceiling, not a delay; when it runs
+   * out, teardown proceeds anyway.
    *
    * Idempotent — repeated calls return the same promise, and the first
    * call's `graceMs` is the one that applies. Registered automatically with
@@ -5581,7 +5376,7 @@ var Act = class {
         this.stop_correlations();
         const disposer = await this._notify_disposer;
         if (disposer) await disposer();
-        this.stop_settling();
+        this._settle.stop();
         this._breaker.stop();
         for (const c of this._drain_controllers.values()) c.stop();
         await this._await_inflight(options?.graceMs);
@@ -5596,26 +5391,10 @@ var Act = class {
    * whichever comes first. Cycle promises never reject (`drain()` contains
    * its own errors), so this never throws.
    *
-   * An omitted budget is derived from the lanes that actually have a cycle
-   * in flight: their `leaseMillis` is the operator's own statement of how
-   * long one of their handlers may hold a stream, which makes it the honest
-   * ceiling for how long teardown should wait for that handler. A parked
-   * lane that pinned no lease contributes `drain()`'s own fallback, and the
-   * whole thing is capped so a long-leased lane cannot hold a deploy open.
-   * Idle lanes do not count — nothing is running on them to wait for.
-   *
-   * An in-flight settle counts the same way, on the same fallback (#1617).
-   * It is waited on like any cycle, and deriving from the lanes alone gave
-   * it a budget of `0` whenever it was the only thing running — which
-   * returned before the wait it was about to be added to.
-   *
-   * A lane configured `leaseMillis: 0` takes the fallback rather than its
-   * own value, which is why this coalesces on falsy and not just on absent
-   * (#1647). A zero-length lease expires the instant it is granted, so it
-   * has no answer to offer for "how long may a handler hold this stream" —
-   * it is the pinned-no-lease case spelled with a number, and #1617 already
-   * settled what that case is worth. Taking it literally derived a budget
-   * of `0` and abandoned the very cycle this had just found running.
+   * An omitted budget is the largest `leaseMillis` among lanes with a cycle
+   * in flight (the drain's fallback for lanes that pinned none, or pinned
+   * 0, which is the same as none), with an in-flight settle counting on the
+   * fallback, capped at the maximum. Idle lanes don't count.
    */
   _derive_grace_ms(running, settling) {
     let max = settling ? DEFAULT_SHUTDOWN_GRACE_MS : 0;
@@ -5888,7 +5667,7 @@ var Act = class {
   }
   /**
    * Wipe the sensitive-data payload for every event on the stream — see
-   * {@link IAct.forget}. Application-level half of #566.
+   * {@link IAct.forget}.
    *
    * Throws on adapters without `Store.forget_pii`, invalidates the cache
    * entry for the stream, emits the `forgotten` lifecycle event with the
@@ -5929,7 +5708,7 @@ var Act = class {
    *
    * Call `correlate()` before `drain()`. It is not only how dynamic targets
    * are discovered: a stream is claimable while `at < correlated_at`, and
-   * `correlate` is the only component that raises that mark (#1487), so a
+   * `correlate` is the only component that raises that mark, so a
    * commit no correlate has seen is not drainable — including for static
    * targets, which were served by a probe of the event log before. For a
    * higher-level API that handles debouncing, correlation, and signaling
@@ -5962,14 +5741,14 @@ var Act = class {
       return { fetched: [], leased: [], acked: [], blocked: [] };
     return this._scoped(() => this._drain_all(options));
   }
-  /** Arm every active lane controller (ACT-1103). */
+  /** Arm every active lane controller. */
   _arm_all() {
     this._correlate.arm();
     for (const c of this._drain_controllers.values()) c.arm();
   }
   /**
    * Arm only the lane controllers whose reactions match the supplied
-   * event names (ACT-1103 selective arming). Events with any dynamic
+   * event names (selective arming). Events with any dynamic
    * resolver fall back to `_arm_all()` via the `"all"` sentinel — the
    * resolver's lane isn't known until correlate runs the function.
    * Events with no reactions are skipped; `_event_to_lanes` doesn't
@@ -6073,7 +5852,7 @@ var Act = class {
     return { subscribed, last_id };
   }
   /**
-   * `correlate` plus whether the pass actually read the store (#1510).
+   * `correlate` plus whether the pass actually read the store.
    *
    * The settle loop needs that extra bit to decide whether the pass carries a
    * circuit-breaker health signal, and a disarmed pass carries none. It stays
@@ -6334,7 +6113,7 @@ var Act = class {
     });
   }
   /**
-   * Operator-driven store audit (#723).
+   * Operator-driven store audit.
    *
    * Walks the connected store and yields per-category findings —
    * each tagged with the remediation it suggests. Same operator-
@@ -6386,7 +6165,7 @@ var Act = class {
    * Bulk-update scheduling priority for streams matching `filter`.
    *
    * Operator-grade override of the `claim()` lagging-frontier
-   * ordering (ACT-102). Useful when a long-running replay needs to
+   * ordering. Useful when a long-running replay needs to
    * jump ahead of other lagging streams, or when a no-longer-urgent
    * job should yield slots back to the rest. Build-time priorities
    * (set via the resolver's `priority` field) are subject to a
@@ -6483,12 +6262,12 @@ var Act = class {
    */
   /**
    * After a close, forget any target whose subscription row the truncate
-   * removed, so a later correlate can re-subscribe it (#1398). Restart
+   * removed, so a later correlate can re-subscribe it. Restart
    * targets keep their row, so only fully-retired streams are forgotten.
    */
   /**
    * Advance correlation until the read cursor reaches `until`, and report
-   * where it landed (#1487). Used by the close cycle's safety probe, which
+   * where it landed. Used by the close cycle's safety probe, which
    * cannot judge a subscription's pending work over events correlate has
    * not resolved yet.
    *
@@ -6514,13 +6293,12 @@ var Act = class {
    * A tombstone seed means the stream was retired; a snapshot seed means it
    * was restarted and is still consuming.
    *
-   * `truncate` no longer removes the subscription row (#1527), so this is no
+   * `truncate` no longer removes the subscription row, so this is no
    * longer repairing damage the close itself did. It still matters, because
    * the row can disappear later: reclaiming retired subscriptions is an
    * operator job now, and that `DELETE` can land while this process is
    * running. Forgetting here keeps the in-process view from outliving a row
-   * an operator removed, which is the same silent-no-delivery failure #1398
-   * described — a reaction whose target is named after the stream would never
+   * an operator removed, which is a silent-no-delivery failure — a reaction whose target is named after the stream would never
    * be re-registered.
    */
   _forget_closed_subscriptions(result) {
@@ -6795,7 +6573,7 @@ function reaction_on(event, events, builder) {
     const reaction = {
       handler: schedule ? make_deferred(handler, schedule) : handler,
       resolver: _this_,
-      // #1269: validate the whole bag at the declaration site so a bad
+      // Validate the whole bag at the declaration site so a bad
       // `maxRetries`/`backoff`/`blockOnError` throws ZodError at build,
       // not a NaN gate on the first retry.
       options: resolveReactionConfig({
@@ -6997,7 +6775,7 @@ function act() {
             spec.flush,
             spec.config,
             patch_fn,
-            // Head loads strip sensitive keys like the warm path (#1320).
+            // Head loads strip sensitive keys like the warm path.
             registry.sensitive_fields
           )
         )
@@ -7503,7 +7281,7 @@ var CsvFile = class {
         name: fields[1],
         // Revive dates like every Store adapter does — a Date in an event
         // payload must not depend on whether it came back through a store or
-        // through a CSV restore (#1399). The `created` column below has
+        // through a CSV restore. The `created` column below has
         // always been parsed explicitly; the JSON columns were missed.
         data: JSON.parse(fields[2]),
         stream: fields[3],