@rotorsoft/act 1.32.14 → 1.32.16

package/dist/index.js

@@ -26,7 +26,7 @@ import {
   sleep,
   store,
   validate
-} from "./chunk-JPPO3LZ3.js";
+} from "./chunk-PZP5ZEZ4.js";
 import {
   ActorSchema,
   CausationEventSchema,
@@ -53,7 +53,7 @@ import {
   pii_split,
   pii_strip,
   sensitive
-} from "./chunk-FVJFR7GH.js";
+} from "./chunk-JRTZGWVS.js";
 
 // src/signals.ts
 process.once("SIGINT", async (arg) => {
@@ -835,7 +835,7 @@ var CloseSignal = class extends Error {
    */
   at;
   /**
-   * Windowed close (#1011): prune events older than this cutoff behind
+   * Windowed close: prune events older than this cutoff behind
    * the closest safe snapshot instead of retiring the stream. Thrown by
    * the autoclose reaction of a `.autocloses({ keep })` state; flows
    * into {@link CloseTarget.before}. Omitted → a full close.
@@ -913,7 +913,7 @@ var SettleOptionsSchema = DrainOptionsSchema.extend({
   // rejects `±Infinity`, and an integer check cannot pass it either. Wrapper
   // code normalizing an optional cap (`maxPasses: opts.maxPasses ?? Infinity`)
   // is the natural way to hit it. Accepting it also honors this module's own
-  // rule that a value which works today is never newly rejected (#1711).
+  // rule that a value which works today is never newly rejected.
   maxPasses: z2.union([z2.number().int().min(0), z2.literal(Number.POSITIVE_INFINITY)]).optional()
 }).loose();
 function resolveSettleConfig(options) {
@@ -1555,7 +1555,7 @@ var CorrelateCycle = class {
   _checkpoint = -1;
   _initialized = false;
   /**
-   * This worker's identity for the correlation lease (#1532). A per-instance
+   * This worker's identity for the correlation lease. A per-instance
    * UUID, matching the drain's convention, so a renewal is recognised as the
    * same holder and a restarted process never inherits a stale claim.
    */
@@ -1571,24 +1571,15 @@ var CorrelateCycle = class {
    * When this worker's correlation lease runs out, as a local clock reading,
    * or 0 when it holds none.
    *
-   * Asking the store on every pass costs a round trip that the holder — which
-   * is the *only* worker in a single-node deployment, and the steady-state
-   * one everywhere else — gains nothing from: it already knows the answer.
-   * The act-sqlite perf gate caught that as a 1.5x regression on
-   * correlate+drain, which is the shape an embedded app runs constantly.
-   *
-   * Believing this while the store disagrees is safe in the one direction it
-   * can fail. A worker that scans without really holding the lease produces
-   * the duplicate scan that existed before the lease, and the marks are
-   * idempotent — so a stale belief costs work, never correctness.
+   * Cached so the holder doesn't ask the store on every pass. A stale belief
+   * can only cause a duplicate scan, and marks are idempotent, so it costs
+   * work, never correctness.
    */
   _lease_until = 0;
   /**
-   * Whether a scan might find anything. The drain has carried the same flag
-   * since it was written — a commit raises it, an empty claim lowers it, and
-   * a disarmed drain returns without touching the store. Correlate had no
-   * equivalent, so a settle pass always scanned, including the final pass
-   * whose only job is to confirm nothing changed (#1510).
+   * Whether a scan might find anything, like the drain's flag: a commit or
+   * notification raises it, a short page lowers it, and a disarmed scan
+   * returns without touching the store.
    *
    * Starts armed: the log may already hold events this process has never
    * correlated, and only a scan can find out.
@@ -1597,15 +1588,9 @@ var CorrelateCycle = class {
   /** In-flight init, memoized for single-flight and cleared on failure. */
   _init_promise;
   // Dynamically discovered targets → what each was last subscribed at,
-  // bounded by `maxSubscribedStreams`. The static half lives in
-  // `_static_subscriptions` below, which is deliberately not evictable.
-  //
-  // Every scan re-subscribes the
-  // targets it resolved (that is how the work mark lands), so this no longer
-  // decides *whether* a target is sent — it decides *what* is sent with it:
-  // a resolution raises priority/lane only when it beats the recorded floor,
-  // and otherwise re-sends the row's own values so the mark changes nothing
-  // else. See {@link Subscription}.
+  // bounded by `maxSubscribedStreams`. It decides *what* a scan sends with a
+  // target: priority/lane only when the resolution beats the recorded floor,
+  // otherwise the row's own values. See {@link Subscription}.
   _dynamic_subscriptions;
   /**
    * What each static target was subscribed at by `init`. A plain map, never
@@ -1613,14 +1598,8 @@ var CorrelateCycle = class {
    * is already bounded by the registry and costs nothing the registry does
    * not already hold.
    *
-   * Keeping these out of the LRU is what makes the `+Infinity` floor an
-   * invariant rather than a race (#1582). Sharing the bounded map meant a
-   * churn of dynamic targets could evict a static record, and the next
-   * dynamic resolution to that target found no record, took the
-   * first-discovery branch, and re-subscribed the target with its own
-   * priority and lane — silently re-laning a stream whose lane the
-   * build-time subscribe owns, and starving it wherever `onlyLanes` had
-   * provisioned a worker for the declared lane.
+   * Kept out of the LRU so eviction can never drop a static target's
+   * `+Infinity` floor and let a dynamic resolution re-lane it.
    */
   _static_subscriptions = /* @__PURE__ */ new Map();
   /** Compiled pattern sources, bounded by {@link PATTERN_CACHE_SIZE}. */
@@ -1630,17 +1609,13 @@ var CorrelateCycle = class {
   _cd;
   _on_init;
   /**
-   * Async cold-start hook (#1221). Runs once, after the sync `on_init`,
-   * inside the same `init()` await. The orchestrator uses it to re-seed the
-   * process-local defer timers from the store's persisted `deferred_at` so
-   * an idle deferred stream re-arms its drain across a restart. Kept
-   * separate from `on_init` because seeding is an async store read; `init`
-   * already awaits, so folding it in here preserves the "runs exactly once"
-   * guarantee without a second gate on the Act side.
+   * Async cold-start hook, run once after `on_init` inside `init()`. The
+   * orchestrator re-seeds its defer timers from the persisted `deferred_at`
+   * here, so an idle deferred stream re-arms across a restart.
    */
   _on_init_async;
   /**
-   * Tail re-scan window applied to the cold-start checkpoint (ACT-1207).
+   * Tail re-scan window applied to the cold-start checkpoint.
    * See {@link DEFAULT_COLD_START_BACK_SCAN}. Constructor arg (not a
    * public option) so tests can shrink it; defaults otherwise.
    */
@@ -1692,7 +1667,7 @@ var CorrelateCycle = class {
    * - Reads the durable correlate checkpoint (and max(at)) from the store,
    *   flooring a first boot at `watermark - back_scan` so an event
    *   committed-but-not-correlated before a crash is re-scanned on
-   *   restart instead of skipped (ACT-1207)
+   *   restart instead of skipped
    * - Subscribes static resolver targets (idempotent upsert)
    * - Populates the subscribed-streams LRU
    * - Fires `on_init` once (Act uses this to flag a cold-start drain)
@@ -1709,7 +1684,7 @@ var CorrelateCycle = class {
     this._initialized = true;
   }
   async _run_init() {
-    const { watermark, correlated_at } = await store().subscribe([
+    const { watermark, correlated_at } = await this._cd.subscribe([
       ...this._static_targets
     ]);
     this._checkpoint = correlated_at >= 0 ? correlated_at : Math.max(-1, watermark - this._cold_start_back_scan);
@@ -1723,21 +1698,6 @@ var CorrelateCycle = class {
     }
     await this._on_init_async?.();
   }
-  /**
-   * Forget targets whose subscription rows no longer exist, so a later
-   * scan can re-subscribe them.
-   *
-   * A full close deletes the closed stream's subscription row. The
-   * in-process dedup would otherwise still believe the target is
-   * subscribed and never re-issue `subscribe()`, silently stopping
-   * delivery for any reaction whose target is named after the stream —
-   * the documented per-aggregate shape `.to(e => ({target: e.stream}))`
-   * makes those two namespaces collide by construction (#1398).
-   *
-   * Static targets are left alone: their record lives in
-   * `_static_subscriptions`, which this never touches, so they stay pinned
-   * at +Infinity and the dynamic path never re-opens them.
-   */
   /**
    * Start correlation over after the event log was replaced wholesale
    * (`restore`). The restored log is renumbered from the start and its
@@ -1746,7 +1706,7 @@ var CorrelateCycle = class {
    * and the init latch makes the next pass run cold-start again: static
    * targets are re-subscribed, the checkpoint is re-read from the store
    * (which `restore` reset), and dynamic targets are rediscovered by the
-   * scan (#1772).
+   * scan.
    */
   restart() {
     this._initialized = false;
@@ -1756,6 +1716,11 @@ var CorrelateCycle = class {
     this._static_subscriptions.clear();
     this._armed = true;
   }
+  /**
+   * Forget dynamic targets whose subscription rows no longer exist (a full
+   * close deletes the row), so a later scan re-subscribes them. Static
+   * targets keep their records.
+   */
   forget_subscribed(streams) {
     for (const stream of streams) this._dynamic_subscriptions.delete(stream);
   }
@@ -1780,7 +1745,7 @@ var CorrelateCycle = class {
    * Scan the events past the checkpoint, resolve each to its target
    * streams, and record what it found through `cd.subscribe` — new dynamic
    * targets get registered, and every target an event resolved to gets its
-   * **work mark** raised to that event's id (#1487).
+   * **work mark** raised to that event's id.
    *
    * Both resolver kinds are walked. A static target is already subscribed
    * at init, but marking it is what makes it claimable without probing the
@@ -1867,18 +1832,10 @@ var CorrelateCycle = class {
           }
         }
       },
-      // Decline the sensitive payload: this scan reads `name`/`stream`/`id`
-      // to resolve reaction targets and throws the rest away. Asking for a
-      // payload it discards made one unreadable row stop EVERY stream's
-      // reactions — correlate is the sole producer of the work mark, so a
-      // decrypt failure here strands the whole app with nothing blocked and
-      // nothing naming the row (#1675).
-      //
-      // A dynamic `.to(event => …)` resolver therefore sees `pii: null`.
-      // That is deliberate and is itself a fix: correlate runs actor-less,
-      // so handing a resolver decrypted plaintext is un-gated disclosure —
-      // the defect #1673 corrected on the drain return and #1277 before it.
-      // `data` already carries no sensitive keys; nothing merges them here.
+      // Decline the sensitive payload: the scan only needs name/stream/id,
+      // and one undecryptable row would otherwise stop every stream's
+      // reactions. Resolvers therefore see `pii: null`; correlate runs
+      // actor-less, so plaintext here would be un-gated disclosure.
       { ...query, after, with_pii: false }
     );
     const streams = [];
@@ -1922,18 +1879,9 @@ var CorrelateCycle = class {
   /**
    * Hand the correlation lease back early.
    *
-   * There is no release verb on the port, deliberately — expiry is the only
-   * path, which keeps a crash and a clean stop on the same code path. A
-   * holder can still shorten its own lease, because re-acquiring as the same
-   * holder renews, and renewing to a millisecond is a release in all but
-   * name.
-   *
-   * Without this a worker that stops cleanly still blocks discovery for the
-   * rest of its lease — invisible in a long-lived deployment, very visible
-   * anywhere Acts are created and dropped inside one process.
-   *
-   * Best-effort: failing here costs the lease's remaining lifetime, which is
-   * what would have happened had the process died instead.
+   * The port has no release verb; re-acquiring as the same holder with a
+   * zero duration releases it. Best-effort: a failure costs the lease's
+   * remaining lifetime, as a crash would.
    */
   async release_correlation() {
     try {
@@ -2419,26 +2367,11 @@ async function load(me, target, callback, patch_fn = bare_patch) {
     {
       stream,
       stream_exact: true,
-      // The snapshot resume floor is a current-state optimization: it only
-      // holds when the load has no window of its own. `time_travel` already
-      // captures that (any `asOf` bound set), so request `with_snaps` only for
-      // a non-time-travel cold load — a bounded load full-scans real events
-      // under its `asOf` filter. This is the single floor-eligibility decision
-      // for the whole system; the stores apply the floor whenever asked and
-      // never re-derive it (RFC 1274).
-      //
-      // The warm path resumes from `after`, and MUST also carry `with_snaps`
-      // (#1345): `after` and `with_snaps` are independent store conditions —
-      // `after` bounds the scan (id > cached.event_id), `with_snaps` keeps
-      // `__snapshot__` rows in the result. A stale (lagging/cross-process)
-      // cache checkpoint can sit below a newer `__snapshot__` boundary, and a
-      // windowed close (`app.close`/`.autocloses({keep})`) may have pruned the
-      // domain events between the checkpoint and that snapshot. Without
-      // `with_snaps` the rebaselining snapshot is filtered out and the fold
-      // silently applies the surviving tail on top of stale state (wrong
-      // count, yet `version` still reports the true head — the concurrency
-      // guard passes). With it, the snapshot in the after-window rebaselines
-      // the fold; when no snapshot falls in the window it is a no-op.
+      // `with_snaps` on every non-time-travel load. Cold, it resumes from the
+      // latest snapshot (this is the only place that decides it; stores just
+      // apply it). Warm, it keeps a snapshot above a stale checkpoint in the
+      // result, so a windowed close that pruned the events in between can't
+      // make the fold apply the tail onto stale state.
       ...cached ? { after: cached.event_id, with_snaps: true } : { ...time_travel ? {} : { with_snaps: true }, ...asOf }
     }
   );
@@ -2465,7 +2398,7 @@ async function load(me, target, callback, patch_fn = bare_patch) {
     // Head event id, captured atomically with `state`: the last replayed
     // event's id on a cache miss, or the cached checkpoint's event_id on a
     // warm hit with no new events. Consumers read this instead of a
-    // separate cache lookup that could race a concurrent commit (ACT-1204).
+    // separate cache lookup that could race a concurrent commit.
     id: event?.id ?? cached?.event_id ?? -1,
     patches,
     snaps,
@@ -2543,14 +2476,8 @@ async function action(me, action2, target, payload, options, patch_fn = bare_pat
           stream,
           emitted,
           meta,
-          // Reactions skip the INFERRED guard: they always append against the
-          // current head. Stream leasing already serializes concurrent reactions,
-          // and forcing version checks here would turn ordinary catch-up into
-          // spurious retries. An expectedVersion the caller passed explicitly is
-          // still honored — dropping a guard the caller asked for is silent data
-          // loss, and the reaction context can reach further than the handler
-          // (detached timers, settle cycles) where the caller never intended a
-          // reaction's semantics at all.
+          // Reactions skip the inferred version guard (leases already
+          // serialize them); an explicit expectedVersion is still honored.
           reactingTo ? expectedVersion : expected
         );
       } catch (error) {
@@ -2829,7 +2756,16 @@ function warn_misrouted(seen, stream, handler, event) {
     `Reaction "${handler}" on "${event}" resolved to target "${stream}", which a projection already serves. A target is served by one batch handler or one state projection, so this reaction can never run \u2014 and delivering to it would hand the projection an aggregate from another stream. Skipping it. The equivalent static \`.to({ target })\` is rejected at build; a dynamic resolver's target is only knowable here.`
   );
 }
-async function run_drain_cycle(ops, registry, batch_handlers, misrouted, store_failing, handle, handle_batch, lagging, leading, eventLimit, leaseMillis, on_blocked, lane) {
+async function run_drain_cycle(deps, cycle) {
+  const { ops, registry, batch_handlers, handle, handle_batch, lane } = deps;
+  const {
+    lagging,
+    leading,
+    eventLimit,
+    leaseMillis,
+    misrouted,
+    store_failing
+  } = cycle;
   const leased = await ops.claim(
     lagging,
     leading,
@@ -2901,7 +2837,7 @@ async function run_drain_cycle(ops, registry, batch_handlers, misrouted, store_f
   const blocked = await ops.block(
     handled.filter(({ block: block2 }) => block2).map(({ lease, error }) => ({ ...lease, error }))
   );
-  if (blocked.length) on_blocked(blocked);
+  if (blocked.length) deps.on_blocked(blocked);
   const submitted = handled.flatMap((h, i) => {
     const advance = h.handled > 0 ? h.acked_at : leased[i].at;
     return h.defer !== void 0 ? { ...h.lease, at: advance, due: h.defer, retry: -1 } : h.next_attempt_at !== void 0 ? { ...h.lease, at: advance, due: h.next_attempt_at } : h.handled > 0 || !h.error ? { ...h.lease, at: h.acked_at } : [];
@@ -2926,32 +2862,25 @@ var DrainController = class {
   _locked = false;
   _ratio = 0.5;
   /**
-   * Per-stream re-visit schedule (#1090): `stream → next visit` (ms since
-   * epoch). Holds both retry backoff (`HandleResult.next_attempt_at`) and the
-   * `defer` outcome; cleared on successful ack or terminal block. Lives in
-   * process memory — per-worker pacing by design (see {@link BackoffOptions}
-   * for the multi-worker trade-off). Its wake re-arms drain at the earliest
-   * pending visit.
+   * Local wake for streams this worker parked (backoff or defer). The
+   * schedule itself is persisted in the store; this only re-arms the drain
+   * at the earliest pending visit.
    */
   _defer = new DeferTimer(() => {
     this._armed = true;
   });
-  /** Worker timer (ACT-1103). Set when `start()` is active, undefined otherwise. */
+  /** Worker timer. Set when `start()` is active, undefined otherwise. */
   _worker;
   /**
-   * Misroutings this controller has reported (#1563). A resolver returning a
+   * Misroutings this controller has reported. A resolver returning a
    * projection's target does so for every matching event; one line per event
    * would bury the signal it exists to raise.
    */
   _misrouted = /* @__PURE__ */ new Set();
   _stopped = false;
   /**
-   * Resolves when the cycle currently in flight finishes; `undefined` when
-   * no cycle is running (#1442). `_locked` answers "is a cycle running?" for
-   * the overlap guard; this answers "tell me when it is done" for a graceful
-   * shutdown, which needs to await the handler rather than abandon it
-   * mid-`await` with the stream still leased. Never rejects — `drain()`
-   * contains its own errors — so awaiting it is always safe.
+   * Resolves when the cycle in flight finishes, so a graceful shutdown can
+   * wait for it. Never rejects.
    */
   _inflight;
   _inflight_done;
@@ -2968,16 +2897,9 @@ var DrainController = class {
     this._armed = true;
   }
   /**
-   * Re-seed a persisted defer schedule into the process-local timer at cold
-   * start (#1221). The `_defer` map lives in worker memory and is empty
-   * after a restart; a stream deferred to a future due-time (e.g. an idle
-   * autoclose aggregate) is durable in the store's `deferred_at` but has
-   * nothing in memory to re-arm the drain at the due-time. The orchestrator
-   * reads the persisted `deferred_at` for this controller's lane and calls
-   * this to park the stream + (re)schedule the shared wake — so the drain
-   * re-arms at the due-time with no intervening commit. `schedule()`
-   * collapses many seeds into one timer, so callers may seed in a loop and
-   * let the earliest due-time win.
+   * Re-seed a persisted `deferred_at` into the local wake at cold start, so
+   * an idle deferred stream re-arms at its due-time with no new commit.
+   * Seeds collapse into one timer; the earliest wins.
    */
   seed_defer(stream, at) {
     this._defer.set(stream, at);
@@ -2987,31 +2909,21 @@ var DrainController = class {
   get armed() {
     return this._armed;
   }
-  /**
-   * The cycle currently in flight, or `undefined` when idle (#1442). A
-   * graceful shutdown awaits this so an in-flight handler reaches its `ack`
-   * — which releases the stream's lease — instead of being abandoned with
-   * the lease held until it expires.
-   */
+  /** The cycle in flight, or `undefined` when idle. */
   get inflight() {
     return this._inflight;
   }
-  /**
-   * This lane's configured lease budget, or `undefined` when the lane didn't
-   * pin one. It is the operator's own statement of how long a handler may
-   * legitimately hold a stream, which makes it the right basis for a
-   * shutdown grace budget (#1442).
-   */
+  /** This lane's configured lease, or `undefined`; the shutdown grace basis. */
   get lease_millis() {
     return this._deps.defaults?.leaseMillis;
   }
-  /** Lane this controller drains (undefined = legacy single-lane span). */
+  /** Lane this controller drains (undefined spans all lanes). */
   get lane() {
     return this._deps.lane;
   }
   /**
    * Start a per-lane worker that drains at the lane's `cycleMs`
-   * cadence (ACT-1103). When armed, the worker calls `drain()` on every
+   * cadence. When armed, the worker calls `drain()` on every
    * tick and re-schedules; when not armed, it still re-schedules at
    * `cycleMs` so a future `arm()` is picked up on the next tick.
    *
@@ -3056,21 +2968,14 @@ var DrainController = class {
       });
       const lagging = Math.ceil(streamLimit * this._ratio);
       const leading = streamLimit - lagging;
-      const cycle = await run_drain_cycle(
-        this._deps.ops,
-        this._deps.registry,
-        this._deps.batch_handlers,
-        this._misrouted,
-        this._deps.breaker.failing,
-        this._deps.handle,
-        this._deps.handle_batch,
+      const cycle = await run_drain_cycle(this._deps, {
         lagging,
         leading,
         eventLimit,
         leaseMillis,
-        (b) => this._deps.on_blocked(b),
-        this._deps.lane
-      );
+        misrouted: this._misrouted,
+        store_failing: this._deps.breaker.failing
+      });
       if (!cycle) {
         this._deps.breaker.passed();
         this._armed = false;
@@ -3198,26 +3103,13 @@ var SettleLoop = class {
   _timer = void 0;
   _running = false;
   /**
-   * Resolves when the cycle currently in flight finishes; `undefined` when
-   * idle (#1468). `_running` answers "is a cycle running?" for the
-   * re-arm bookkeeping; this answers "tell me when it is done" for a
-   * graceful shutdown.
-   *
-   * `stop()` only cancels *scheduling* — a cycle already inside its
-   * correlate → drain loop keeps going, and because `DrainController.drain`
-   * does not consult `_stopped`, it can claim a stream after teardown
-   * returned and after the store adapter was disposed. Never rejects: the
-   * cycle's own `catch` contains its errors, so awaiting this is safe.
+   * Resolves when the cycle in flight finishes, so shutdown can wait for
+   * it (`stop()` cancels scheduling only). Never rejects.
    */
   _inflight;
   /**
-   * Set when a `schedule()` timer fires while a cycle is still running
-   * (ACT-1205). The in-flight cycle's `finally` re-arms one more pass so
-   * the wake-up isn't dropped — a commit landing during the final
-   * no-progress drain pass would otherwise leave armed controllers with
-   * nothing to re-drain on an instance with no lane `cycleMs` and no
-   * polling. Carries the options of the dropped call so the re-armed
-   * pass honors its `debounceMs`/`maxPasses`/drain overrides.
+   * A wake-up that fired while a cycle was running. The running cycle's
+   * `finally` schedules one more pass with these options, so it isn't lost.
    */
   _pending = void 0;
   _deps;
@@ -3289,7 +3181,7 @@ var SettleLoop = class {
     }, debounceMs);
   }
   /**
-   * The cycle currently in flight, or `undefined` when idle (#1468). A
+   * The cycle currently in flight, or `undefined` when idle. A
    * graceful shutdown awaits this alongside the drain controllers so a
    * settle parked in `correlate` does not resume after teardown.
    */
@@ -3435,17 +3327,17 @@ function validate_only_lanes(options, lanes) {
 }
 var Act = class {
   _emitter = new EventEmitter();
-  /** ACT-984: orchestrator-owned circuit breaker shared by all drain lanes. */
+  /** Circuit breaker shared by all drain lanes. */
   _breaker;
-  /** #803: gate the `Store.notify` subscription side. */
+  /** Whether this instance subscribes to `Store.notify`. */
   _listen;
-  /** #803: gate the local reaction pipeline (drain controllers, settle, correlate). */
+  /** Whether this instance runs reactions (drain, settle, correlate). */
   _drain;
   /** Event names with at least one registered reaction (computed at build time) */
   _reactive_events;
   /** One DrainController per active lane, keyed by lane name. */
   _drain_controllers;
-  /** Correlation state machine: lazy init, dynamic-resolver scan, periodic worker. */
+  /** Correlation: lazy init and the scan that marks work. */
   _correlate;
   /** Debounced correlate→drain catch-up loop. */
   _settle;
@@ -3475,26 +3367,10 @@ var Act = class {
    * Emit a lifecycle event. The payload type is inferred from the event name
    * via {@link ActLifecycleEvents}.
    *
-   * **Every listener is contained individually.** Lifecycle listeners are
-   * observers — `observability.md` promises that a throwing one is "contained,
-   * not fatal" — and containment belongs here rather than at each call site,
-   * for two reasons the previous arrangement got wrong (#1437):
-   *
-   * - Wrapping the *emit* rather than each *listener* still let the first
-   *   thrower abort the rest: `EventEmitter.emit` stops dispatching on the
-   *   first exception, so a second `app.on("acked", …)` never ran. The
-   *   documented "the remaining sinks still fire" was false whenever an event
-   *   had more than one listener. Same lesson as #1423, where guarding the
-   *   loop instead of each callback left every later SSE subscriber unserved.
-   * - Only *some* call sites wrapped at all. The drain contained `acked` and
-   *   `blocked`; `committed`, `forgotten` and `close()`'s `closed` did not, so
-   *   a throwing listener rejected `do()`, `forget()` and `close()` **after**
-   *   their durable work had already landed. A caller retrying a "failed"
-   *   `do()` writes the event twice, since the framework has no dedup by
-   *   design.
-   *
-   * Containing here makes it a property of emitting, so a new lifecycle event
-   * cannot reintroduce the gap by omission.
+   * Each listener is contained on its own: a throwing listener is logged,
+   * the remaining listeners still run, and the caller (`do()`, `forget()`,
+   * `close()`, the drain) never sees the throw, since its durable work has
+   * already landed.
    *
    * Uses `rawListeners` so `once` wrappers still de-register themselves, and
    * returns "had listeners" to preserve the `EventEmitter.emit` contract.
@@ -3555,29 +3431,23 @@ var Act = class {
    */
   _event_to_state;
   /**
-   * Event-name → lane fan-in for selective arming (ACT-1103). Built by
+   * Event-name → lane fan-in for selective arming. Built by
    * `classify_registry` once per build. `"all"` means at least one of
    * the event's reactions is a dynamic resolver (lane opaque until
    * runtime); a `Set<string>` lists the static lanes only that event's
    * reactions target.
    */
   _event_to_lanes;
-  /**
-   * Audit dependency bag (#723). Built once at construction; held as
-   * an immutable snapshot of the registry state the audit module
-   * needs. Lives in `internal/audit.ts` — this orchestrator never
-   * carries audit logic, only the deps + a one-liner that hands them
-   * over.
-   */
+  /** What `internal/audit.ts` needs, built once at construction. */
   _audit_deps;
   /** Logger resolved at construction time (after user port configuration) */
   _logger = log();
-  /** Wraps a public-method body so internal `store()`/`cache()` resolve to the
-   * per-Act ports (ACT-501). No-op when the Act is unscoped — so the singleton
-   * path keeps reading fresh `store()`/`cache()` per call, which matters for
-   * tests that dispose and re-seed mid-suite. */
   /** This Act's ports: its own bag, or the singleton adapters. */
   _ports;
+  /**
+   * Runs a body inside this Act's ports frame, so internal
+   * `store()`/`cache()` calls resolve to `_ports`.
+   */
   _scoped;
   /**
    * Correlation-id generator for originating actions. Bound at
@@ -3596,24 +3466,18 @@ var Act = class {
   /** Reaction dispatchers built once and handed to run_drain_cycle each cycle. */
   _handle;
   _handle_batch;
-  /** Declared drain lanes (ACT-1103). */
+  /** Declared drain lanes. */
   _lanes;
   /**
-   * Per-stream close serialization tails (#1222). Chains each stream's
-   * windowed-close work behind the previous one so a manual
-   * `app.close([{stream, before}])` and an autoclose windowed close for
-   * the same stream never run their guard-free prune concurrently — the
-   * manual path bypasses the `__autoclose__:X` drain lease that would
-   * otherwise exclude them, so without this both closers archive the
-   * same prefix. Process-local: both racers run on the same Act
-   * instance. Entries are dropped once their tail resolves so the map
-   * doesn't grow with distinct stream names.
+   * Per-stream close serialization tails, so a manual close and an
+   * autoclose of the same stream never prune concurrently (the manual path
+   * has no drain lease to exclude it). Entries are dropped once settled.
    */
   _close_locks = /* @__PURE__ */ new Map();
   /**
-   * Run `work` under the per-stream close lock (#1222). Serializes close
-   * critical sections for the same stream (windowed prunes, and full closes
-   * since #1738) while letting different streams proceed in parallel.
+   * Run `work` under the per-stream close lock. Serializes close
+   * critical sections for the same stream (windowed prunes and full
+   * closes) while letting different streams proceed in parallel.
    */
   _with_close_lock(stream, work) {
     const prev = this._close_locks.get(stream) ?? Promise.resolve();
@@ -3640,11 +3504,11 @@ var Act = class {
    * @param states    Merged map of state name → state definition
    * @param batch_handlers Static-target projection batch handlers (target → handler)
    * @param options   Tuning knobs — see {@link ActOptions}
-   * @param lanes     Declared drain lanes (ACT-1103). The builder collects
-   *   these from `.withLane(...)` calls. Slice 1 records them on the
-   *   instance; later slices fan out one `DrainController` per lane.
+   * @param lanes     Declared drain lanes. The builder collects
+   *   these from `.withLane(...)` calls; one `DrainController` runs
+   *   per lane, plus the implicit `"default"`.
    * @param patch_fn  The per-event patch step selected once by the builder
-   *   from `ActOptions.validateFoldedState` (ACT-1238) — `bare_patch` by
+   *   from `ActOptions.validateFoldedState` — `bare_patch` by
    *   default, `validating_patch` when the flag is on. The builder uses
    *   the same value for its projection-fold handlers, so there is a
    *   single selection site. Defaults to `bare_patch` for direct
@@ -3659,16 +3523,15 @@ var Act = class {
     this._ports = options.scoped ?? default_scope();
     const ports = this._ports;
     this._scoped = make_run_scoped({
-      // Delegating getters, NOT a spread: `default_scope()` resolves the
-      // process singletons lazily, so copying its properties would freeze
-      // whichever adapters happened to be installed at construction and
-      // ignore a later `store(...)` / `cache(...)`.
+      // Getters, not a spread: the singletons resolve lazily, so a later
+      // `store(...)` / `cache(...)` still takes effect.
       get store() {
         return ports.store;
       },
       get cache() {
         return ports.cache;
       },
+      // Parsed per build, so a bad window throws on every build.
       autoclose_window: resolveAutocloseConfig(options).autocloseWindow
     });
     this._correlator = options.correlator ?? default_correlator;
@@ -3676,8 +3539,6 @@ var Act = class {
     this._cd = build_drain(this._logger);
     this._handle = build_handle({
       logger: this._logger,
-      // The orchestrator owns ambient context; `build_handle` only asks for
-      // the triggering event to be in scope while the handler runs.
       reaction_scope: make_reaction_scope({
         do: this._bound_do,
         load: this._bound_load,
@@ -3712,16 +3573,8 @@ var Act = class {
       resolveCircuitBreakerConfig(options.circuitBreaker),
       {
         on_error: (error, circuit) => this._emit_error(error, circuit),
-        // Re-probe the store when the cooldown elapses, so recovery is
-        // automatic even on the default lane (which has no periodic poller).
-        // The wake fires `settle()`, which (in half-open) runs a real store
-        // probe: for a dynamic-resolver app the probe is settle's correlate
-        // (a store scan); for a static-reaction app correlate is a no-op that
-        // records no health, so the probe is settle's DRAIN claim — either
-        // way one success closes the breaker and every loop resumes, a
-        // failure re-opens it and reschedules the wake. Settle does NOT close
-        // the breaker off a no-op correlate (#1329) — only a real store op
-        // (correlate scan or drain claim) records `passed()`.
+        // When the cooldown elapses, settle once: its scan or claim is the
+        // half-open probe that closes or re-opens the breaker.
         on_retry: () => {
           this.settle({ debounceMs: 0 });
         }
@@ -3729,12 +3582,9 @@ var Act = class {
     );
   }
   /**
-   * One DrainController per active lane. The implicit "default" lane is
-   * always present unless onlyLanes excludes it. Each controller filters
-   * its claim() by its lane name; the legacy single-controller path is the
-   * no-lane-declared case with `lane: undefined` deps so claim() doesn't
-   * filter (preserves the single-lane SQL planner shape for apps that never
-   * call withLane).
+   * One DrainController per active lane, plus the implicit "default" unless
+   * `onlyLanes` excludes it. Apps that declare no lanes pass no lane filter
+   * to `claim`.
    */
   _build_drain_controllers(options, lanes) {
     const all_lanes = ["default", ...lanes.map((l) => l.name)];
@@ -3753,11 +3603,7 @@ var Act = class {
         handle_batch: this._handle_batch,
         on_acked: (acked) => this.emit("acked", acked),
         on_blocked: (blocked) => this.emit("blocked", blocked),
-        // Reaction-requested close. Runs the same close machinery as
-        // `app.close` (tombstone guard + archive + atomic truncate) for the
-        // targets a handler signalled via `CloseSignal`. No `correlate()`
-        // here — the drain that produced these targets has already
-        // correlated.
+        // Reaction-requested close: the same machinery as `app.close`.
         on_close: async (targets) => {
           const close_actor = { id: "$close", name: "close" };
           const result = await run_close_cycle(targets, {
@@ -3774,12 +3620,7 @@ var Act = class {
           this.emit("closed", result);
         },
         breaker: this._breaker,
-        // Re-scope the per-lane worker's auto-start ticks so their drain
-        // resolves the scoped ports, not the singleton (#1191).
         run_scoped: this._scoped,
-        // Pass lane only when a true per-lane controller is active.
-        // The all-lanes (single default) case keeps lane=undefined so
-        // adapter SQL collapses to the single-lane shape.
         lane: single_default_lane ? void 0 : name,
         defaults: cfg && {
           streamLimit: cfg.streamLimit,
@@ -3793,17 +3634,9 @@ var Act = class {
     return controllers;
   }
   /**
-   * Orphaned-lane startup advisory (#1220). When `onlyLanes` is set, this
-   * instance builds a controller only for its slice of the declared lane
-   * universe — every OTHER declared lane's stream is persisted (correlate
-   * subscribes all static targets regardless of `onlyLanes`) but never
-   * claimed here. If no peer worker deploys with those lanes in ITS
-   * `onlyLanes`, their reactions accumulate forever, silently. A single
-   * process can't verify the cluster invariant `∪ onlyLanes ⊇ declared
-   * lanes`, so we surface the per-instance signal — "these declared lanes
-   * have no controller here" — the same way the deprecated-event advisory
-   * surfaces legacy events. No advisory when `onlyLanes` is unset (every
-   * lane gets a controller) or covers every declared lane.
+   * Startup advisory naming declared lanes that `onlyLanes` leaves without a
+   * controller here. One process can't check that the cluster covers every
+   * lane, so it reports its own gaps.
    */
   _advise_orphaned_lanes(options, lanes) {
     if (!options.onlyLanes || options.onlyLanes.length === 0) return;
@@ -3817,25 +3650,15 @@ var Act = class {
       `Act declared ${orphaned.length} orphaned lane(s) on this instance: ${list}. onlyLanes excludes them, so no DrainController claims their streams here \u2014 their reactions accumulate un-drained unless a peer worker deploys with these lanes in its onlyLanes. Ensure the cluster invariant holds: the union of every worker's onlyLanes must cover every declared lane. See docs/docs/guides/production-checklist.md \xA7 Sizing lanes.`
     );
   }
-  /**
-   * Audit deps bag. Snapshotted after registry classification and
-   * drain-controller build so the audit module sees the finalized lane
-   * set. Held as an immutable bag — the orchestrator never carries audit
-   * logic itself, only this typed contract.
-   */
+  /** Audit deps, built after the controllers so the lane set is final. */
   _build_audit_deps() {
     return {
       store,
       logger: this._logger,
       event_to_state: this._event_to_state,
       states: this._states,
-      // The DECLARED lane universe — the implicit "default" plus every
-      // `.withLane(...)` name — NOT `_drain_controllers.keys()` (#1224).
-      // An `onlyLanes`-filtered instance builds a controller only for its
-      // slice of lanes, so keying off the active controller set would flag
-      // a stream correctly assigned to an excluded-but-declared lane (one
-      // another worker drains) as `unknown-lane`. The audit reports what's
-      // structurally routable across the cluster, not what this process runs.
+      // Declared lanes, not this process's controllers: a lane another
+      // worker drains is not `unknown-lane`.
       declared_lanes: /* @__PURE__ */ new Set(["default", ...this._lanes.map((l) => l.name)]),
       routed_events: new Set(this._event_to_lanes.keys())
     };
@@ -3851,10 +3674,8 @@ var Act = class {
       static_targets: classification.static_targets,
       cd: this._cd,
       max_subscribed_streams: options.maxSubscribedStreams ?? DEFAULT_MAX_SUBSCRIBED_STREAMS,
-      // Every lane a controller can exist for, so correlate can reroute a
-      // dynamic resolution that names one that doesn't (#1564). Declared,
-      // not active: `onlyLanes` shrinks this process's controllers, but a
-      // lane another process claims is still a valid destination.
+      // Declared lanes (not active ones): a lane another process claims is
+      // still a valid destination.
       declared_lanes: /* @__PURE__ */ new Set([
         "default",
         ...this._lanes.map((l) => l.name)
@@ -3862,26 +3683,14 @@ var Act = class {
       on_init: () => {
         if (this._drain && this._reactive_events.size > 0) this._arm_all();
       },
-      // Cold-start defer re-seed (#1221). Skipped on writer-only instances
-      // (`drain: false`) — they run no local controllers to re-arm.
       on_init_async: this._drain ? () => this._seed_persisted_defers() : void 0
     });
   }
   /**
-   * Re-seed every active lane controller's process-local defer timer from
-   * the store's persisted `deferred_at` (#1221). Runs once at cold start,
-   * inside `CorrelateCycle.init`, after static targets are subscribed.
-   *
-   * The defer timer is worker memory: empty after a restart. A stream
-   * deferred to a future due-time (the classic case: an idle autoclose
-   * aggregate that deferred its terminal close) is durable in the store but
-   * has nothing in memory to re-arm the drain — the controller disarms on
-   * the first empty claim and, since the aggregate is idle, no commit ever
-   * re-arms it. Reading the persisted schedule and seeding the owning lane's
-   * timer restores the wake, so the close fires at the due-time.
-   *
-   * Streams whose lane has no controller on this instance (excluded by
-   * `onlyLanes`) are skipped — a peer worker owns that lane's timer.
+   * At cold start, re-seed each lane controller's local wake from the
+   * persisted future `deferred_at`, so an idle deferred stream (an
+   * autoclose waiting out its window) still fires on time. Streams on lanes
+   * this instance doesn't run are skipped.
    */
   async _seed_persisted_defers() {
     const now = Date.now();
@@ -3895,10 +3704,6 @@ var Act = class {
   _build_settle(options) {
     return new SettleLoop(
       {
-        // Scope the init like every other store-touching path — a bare
-        // `this._correlate.init()` runs `store().subscribe(...)` against
-        // the singleton for a scoped Act, so static targets never land on
-        // the scoped store and `_initialized` then blocks a retry (#1191).
         init: () => this._scoped(() => this._correlate.init()),
         checkpoint: () => this._correlate.checkpoint,
         correlate: (q) => this._correlate_scanned(q, true),
@@ -3916,19 +3721,11 @@ var Act = class {
    * already in flight a bounded chance to finish, then remove lifecycle
    * listeners and tear down the cross-process notify subscription.
    *
-   * The order is deliberate (#1442). Scheduling stops first, so nothing new
-   * is claimed while teardown runs. Then in-flight cycles are awaited up to
-   * `graceMs`: a reaction handler parked on an `await` holds its stream's
-   * lease until it acks, so abandoning it costs the replacement worker up to
-   * `leaseMillis` of dead time on that stream and discards the round of work
-   * (which #1418 then redelivers). Listeners come off *after* that wait, not
-   * before, so an `acked` / `blocked` subscriber still observes the work
-   * that completed during the grace window.
-   *
-   * The budget is a ceiling, not a delay — teardown continues the moment the
-   * last in-flight cycle finishes. When it is exhausted, teardown proceeds
-   * anyway: one stuck handler must not hang a deploy, which is the failure
-   * mode an unbounded wait would trade for.
+   * Scheduling stops first, then in-flight cycles get up to `graceMs` to
+   * reach their `ack` (an abandoned handler holds its lease until it
+   * expires). Listeners come off after the wait, so they still see work that
+   * finished during it. The budget is a ceiling, not a delay; when it runs
+   * out, teardown proceeds anyway.
    *
    * Idempotent — repeated calls return the same promise, and the first
    * call's `graceMs` is the one that applies. Registered automatically with
@@ -3961,26 +3758,10 @@ var Act = class {
    * whichever comes first. Cycle promises never reject (`drain()` contains
    * its own errors), so this never throws.
    *
-   * An omitted budget is derived from the lanes that actually have a cycle
-   * in flight: their `leaseMillis` is the operator's own statement of how
-   * long one of their handlers may hold a stream, which makes it the honest
-   * ceiling for how long teardown should wait for that handler. A parked
-   * lane that pinned no lease contributes `drain()`'s own fallback, and the
-   * whole thing is capped so a long-leased lane cannot hold a deploy open.
-   * Idle lanes do not count — nothing is running on them to wait for.
-   *
-   * An in-flight settle counts the same way, on the same fallback (#1617).
-   * It is waited on like any cycle, and deriving from the lanes alone gave
-   * it a budget of `0` whenever it was the only thing running — which
-   * returned before the wait it was about to be added to.
-   *
-   * A lane configured `leaseMillis: 0` takes the fallback rather than its
-   * own value, which is why this coalesces on falsy and not just on absent
-   * (#1647). A zero-length lease expires the instant it is granted, so it
-   * has no answer to offer for "how long may a handler hold this stream" —
-   * it is the pinned-no-lease case spelled with a number, and #1617 already
-   * settled what that case is worth. Taking it literally derived a budget
-   * of `0` and abandoned the very cycle this had just found running.
+   * An omitted budget is the largest `leaseMillis` among lanes with a cycle
+   * in flight (the drain's fallback for lanes that pinned none, or pinned
+   * 0, which is the same as none), with an in-flight settle counting on the
+   * fallback, capped at the maximum. Idle lanes don't count.
    */
   _derive_grace_ms(running, settling) {
     let max = settling ? DEFAULT_SHUTDOWN_GRACE_MS : 0;
@@ -4253,7 +4034,7 @@ var Act = class {
   }
   /**
    * Wipe the sensitive-data payload for every event on the stream — see
-   * {@link IAct.forget}. Application-level half of #566.
+   * {@link IAct.forget}.
    *
    * Throws on adapters without `Store.forget_pii`, invalidates the cache
    * entry for the stream, emits the `forgotten` lifecycle event with the
@@ -4294,7 +4075,7 @@ var Act = class {
    *
    * Call `correlate()` before `drain()`. It is not only how dynamic targets
    * are discovered: a stream is claimable while `at < correlated_at`, and
-   * `correlate` is the only component that raises that mark (#1487), so a
+   * `correlate` is the only component that raises that mark, so a
    * commit no correlate has seen is not drainable — including for static
    * targets, which were served by a probe of the event log before. For a
    * higher-level API that handles debouncing, correlation, and signaling
@@ -4327,14 +4108,14 @@ var Act = class {
       return { fetched: [], leased: [], acked: [], blocked: [] };
     return this._scoped(() => this._drain_all(options));
   }
-  /** Arm every active lane controller (ACT-1103). */
+  /** Arm every active lane controller. */
   _arm_all() {
     this._correlate.arm();
     for (const c of this._drain_controllers.values()) c.arm();
   }
   /**
    * Arm only the lane controllers whose reactions match the supplied
-   * event names (ACT-1103 selective arming). Events with any dynamic
+   * event names (selective arming). Events with any dynamic
    * resolver fall back to `_arm_all()` via the `"all"` sentinel — the
    * resolver's lane isn't known until correlate runs the function.
    * Events with no reactions are skipped; `_event_to_lanes` doesn't
@@ -4438,7 +4219,7 @@ var Act = class {
     return { subscribed, last_id };
   }
   /**
-   * `correlate` plus whether the pass actually read the store (#1510).
+   * `correlate` plus whether the pass actually read the store.
    *
    * The settle loop needs that extra bit to decide whether the pass carries a
    * circuit-breaker health signal, and a disarmed pass carries none. It stays
@@ -4699,7 +4480,7 @@ var Act = class {
     });
   }
   /**
-   * Operator-driven store audit (#723).
+   * Operator-driven store audit.
    *
    * Walks the connected store and yields per-category findings —
    * each tagged with the remediation it suggests. Same operator-
@@ -4751,7 +4532,7 @@ var Act = class {
    * Bulk-update scheduling priority for streams matching `filter`.
    *
    * Operator-grade override of the `claim()` lagging-frontier
-   * ordering (ACT-102). Useful when a long-running replay needs to
+   * ordering. Useful when a long-running replay needs to
    * jump ahead of other lagging streams, or when a no-longer-urgent
    * job should yield slots back to the rest. Build-time priorities
    * (set via the resolver's `priority` field) are subject to a
@@ -4848,12 +4629,12 @@ var Act = class {
    */
   /**
    * After a close, forget any target whose subscription row the truncate
-   * removed, so a later correlate can re-subscribe it (#1398). Restart
+   * removed, so a later correlate can re-subscribe it. Restart
    * targets keep their row, so only fully-retired streams are forgotten.
    */
   /**
    * Advance correlation until the read cursor reaches `until`, and report
-   * where it landed (#1487). Used by the close cycle's safety probe, which
+   * where it landed. Used by the close cycle's safety probe, which
    * cannot judge a subscription's pending work over events correlate has
    * not resolved yet.
    *
@@ -4879,13 +4660,12 @@ var Act = class {
    * A tombstone seed means the stream was retired; a snapshot seed means it
    * was restarted and is still consuming.
    *
-   * `truncate` no longer removes the subscription row (#1527), so this is no
+   * `truncate` no longer removes the subscription row, so this is no
    * longer repairing damage the close itself did. It still matters, because
    * the row can disappear later: reclaiming retired subscriptions is an
    * operator job now, and that `DELETE` can land while this process is
    * running. Forgetting here keeps the in-process view from outliving a row
-   * an operator removed, which is the same silent-no-delivery failure #1398
-   * described — a reaction whose target is named after the stream would never
+   * an operator removed, which is a silent-no-delivery failure — a reaction whose target is named after the stream would never
    * be re-registered.
    */
   _forget_closed_subscriptions(result) {
@@ -5160,7 +4940,7 @@ function reaction_on(event, events, builder) {
     const reaction = {
       handler: schedule ? make_deferred(handler, schedule) : handler,
       resolver: _this_,
-      // #1269: validate the whole bag at the declaration site so a bad
+      // Validate the whole bag at the declaration site so a bad
       // `maxRetries`/`backoff`/`blockOnError` throws ZodError at build,
       // not a NaN gate on the first retry.
       options: resolveReactionConfig({
@@ -5362,7 +5142,7 @@ function act() {
             spec.flush,
             spec.config,
             patch_fn,
-            // Head loads strip sensitive keys like the warm path (#1320).
+            // Head loads strip sensitive keys like the warm path.
             registry.sensitive_fields
           )
         )
@@ -5868,7 +5648,7 @@ var CsvFile = class {
         name: fields[1],
         // Revive dates like every Store adapter does — a Date in an event
         // payload must not depend on whether it came back through a store or
-        // through a CSV restore (#1399). The `created` column below has
+        // through a CSV restore. The `created` column below has
         // always been parsed explicitly; the JSON columns were missed.
         data: JSON.parse(fields[2]),
         stream: fields[3],