@rotorsoft/act 1.32.24 → 1.32.26

package/dist/index.cjs

@@ -635,13 +635,9 @@ var InMemoryStream = class {
   _leased_until = void 0;
   _priority = 0;
   _lane = DEFAULT_LANE;
-  // Persisted next-visit time. When set and still in the future, the
-  // stream is held out of `claim` entirely — so a deferred reaction is not
-  // re-claimed (and `retry` is never bumped) until its due-time passes. Unlike
-  // in-process backoff, this is durable store state shared across workers.
+  // While in the future, the stream is held out of `claim`.
   _deferred_at = void 0;
-  // Work mark: highest event id observed to resolve to this target.
-  // `undefined` means the row was never correlated, so `claim` skips it.
+  // Work mark; `undefined` = never correlated, so `claim` skips it.
   _correlated_at = void 0;
   constructor(stream, source, priority = 0, lane = DEFAULT_LANE) {
     this.stream = stream;
@@ -655,44 +651,28 @@ var InMemoryStream = class {
   get lane() {
     return this._lane;
   }
-  /** Replace on every subscribe — current builder config wins on restart. */
+  /** Replaced on every subscribe, so the current config wins on restart. */
   set lane(value) {
     this._lane = value;
   }
-  /**
-   * Bump the priority via {@link subscribe}: keeps the maximum across
-   * reactions so the highest-priority registrant wins.
-   */
   bump_priority(priority) {
     if (priority > this._priority) this._priority = priority;
   }
   get correlated_at() {
     return this._correlated_at;
   }
-  /**
-   * Raise the work mark via {@link subscribe}: keeps the maximum, for every
-   * value including zero and negatives, so a mark never regresses.
-   */
+  /** A mark never regresses, including at zero and negatives. */
   mark(correlated_at) {
     if (this._correlated_at === void 0 || correlated_at > this._correlated_at)
       this._correlated_at = correlated_at;
   }
-  /**
-   * Set the priority outright via {@link prioritize}: operator
-   * runtime override that ignores the build-time `max()` invariant.
-   */
+  /** Operator override; ignores the subscribe-time `max()`. */
   set_priority(priority) {
     this._priority = priority;
   }
   get is_available() {
-    return !this._blocked && (!this._leased_until || this._leased_until <= /* @__PURE__ */ new Date()) && // A stream deferred to a future time is not claimable until due.
-    (!this._deferred_at || this._deferred_at <= Date.now());
+    return !this._blocked && (!this._leased_until || this._leased_until <= /* @__PURE__ */ new Date()) && (!this._deferred_at || this._deferred_at <= Date.now());
   }
-  /**
-   * Hold this stream out of `claim` until `deferred_at` (ms since epoch).
-   * Set by a deliberate `defer` outcome — not a failure, so retry/blocked
-   * state is untouched. Cleared by ack/block/reset/unblock.
-   */
   defer(deferred_at) {
     this._deferred_at = deferred_at;
     this._retry = -1;
@@ -715,16 +695,9 @@ var InMemoryStream = class {
   get leased_until() {
     return this._leased_until;
   }
-  /** Persisted next-visit time, or undefined when no active defer. */
   get deferred_at() {
     return this._deferred_at;
   }
-  /**
-   * Attempt to lease this stream for processing.
-   * @param lease - The lease request.
-   * @param millis - Lease duration in milliseconds.
-   * @returns The granted lease or undefined if blocked.
-   */
   lease(lease, millis) {
     this._leased_by = lease.by;
     this._leased_until = new Date(Date.now() + millis);
@@ -739,12 +712,7 @@ var InMemoryStream = class {
       lane: this._lane
     };
   }
-  /**
-   * Finalize this stream's lease: ack (advance the watermark) or, when the
-   * lease carries a `due` marker, defer (persist the schedule, hold the
-   * watermark) — see {@link Store.ack}.
-   * @param lease - The lease request.
-   */
+  /** Ack, or with `due`, also persist the schedule. See {@link Store.ack}. */
   ack(lease) {
     if (this._leased_by === lease.by) {
       this._leased_by = void 0;
@@ -769,11 +737,6 @@ var InMemoryStream = class {
       };
     }
   }
-  /**
-   * Block a stream for processing after failing to process and reaching max retries with blocking enabled.
-   * @param lease - The lease request.
-   * @param error Blocked error message.
-   */
   block(lease, error) {
     if (this._leased_by === lease.by && !this._blocked) {
       this._blocked = true;
@@ -791,11 +754,7 @@ var InMemoryStream = class {
       };
     }
   }
-  /**
-   * Reset this stream's watermark and state for replay. The retry counter
-   * resets to -1 to match the constructor + ack() invariant ("released
-   * stream"); the next claim() bumps it to 0 (first attempt).
-   */
+  /** Retry resets to -1 (released); the next claim makes it 0. */
   reset() {
     this._at = -1;
     this._retry = -1;
@@ -805,11 +764,7 @@ var InMemoryStream = class {
     this._leased_until = void 0;
     this._deferred_at = void 0;
   }
-  /**
-   * Clear the blocked flag and lease bookkeeping without touching the
-   * watermark. Returns true if the stream was actually blocked (and is
-   * now flipped); false otherwise.
-   */
+  /** True only when the stream was blocked. */
   unblock() {
     if (!this._blocked) return false;
     this._blocked = false;
@@ -822,33 +777,17 @@ var InMemoryStream = class {
   }
 };
 var InMemoryStore = class {
-  // stored events
   _events = [];
-  // next event id — monotonic, never reused. Deletions (truncate, windowed
-  // prune) punch holes in the id sequence, so ids are NOT array indexes and
-  // NOT `_events.length`; they only stay sorted ascending in `_events`.
+  // Never reused. Deletions punch holes, so ids are not array indexes.
   _next_id = 0;
-  // stored stream positions and other metadata
   _streams = /* @__PURE__ */ new Map();
   /** Correlate checkpoint: how far the log has been READ. */
   _correlated_at = -1;
-  /**
-   * Per-correlator checkpoint and lease, keyed by correlator.
-   *
-   * Keyed rather than singular because correlators that look for different
-   * things read the log for different reasons: sharing one position lets a
-   * partial-behaviour worker inherit another's, and sharing one lease lets
-   * one starve the other. Callers that supply no correlator use
-   * `_correlated_at` instead, the shared checkpoint.
-   */
+  /** Per-correlator checkpoint and lease; keyless callers use `_correlated_at`. */
   _correlators = /* @__PURE__ */ new Map();
-  // last committed version per stream — O(1) replacement for filter-on-commit
   _stream_versions = /* @__PURE__ */ new Map();
-  // stream → (event_id → cloned sensitive payload). Two-level so `forget_pii`
-  // is O(1) — drop the inner Map for the stream and the wipe is done — mirroring
-  // the `DELETE WHERE stream = ?` scope that durable adapters get from their
-  // stream index. Entries exist only for events committed with a non-null
-  // `pii` field; absence means "no PII" (returned as `null` on load).
+  // stream → (event_id → cloned pii). Two levels so `forget_pii` drops one
+  // inner Map. Absence means no PII.
   _pii = /* @__PURE__ */ new Map();
   _reset_indexes() {
     this._events.length = 0;
@@ -866,10 +805,7 @@ var InMemoryStore = class {
     }
     per_stream.set(id, structuredClone(pii));
   }
-  // First index whose event id is greater than `after`. `_events` stays
-  // sorted ascending by id (append-only commits; deletions preserve
-  // order), so id-bounded scans binary-search their start instead of
-  // assuming id === index — an invariant that truncation breaks.
+  // First index whose id is greater than `after` (ids are sorted, not dense).
   _first_index_after(after) {
     let lo = 0;
     let hi = this._events.length;
@@ -880,32 +816,19 @@ var InMemoryStore = class {
     }
     return lo;
   }
-  // Attach the isolated PII payload (or null) to an event before handing it to
-  // a caller. Allocation-free for events without PII — by far the common case.
+  // Allocation-free for events without PII, the common case.
   _with_pii(e, wanted = true) {
     if (!wanted) return e;
     const pii = this._pii.get(e.stream)?.get(e.id);
     return pii ? { ...e, pii } : e;
   }
-  /**
-   * Dispose of the store and clear all events.
-   * @returns Promise that resolves when disposal is complete.
-   */
   async dispose() {
     await sleep();
     this._reset_indexes();
   }
-  /**
-   * Seed the store with initial data (no-op for in-memory).
-   * @returns Promise that resolves when seeding is complete.
-   */
   async seed() {
     await sleep();
   }
-  /**
-   * Drop all data from the store.
-   * @returns Promise that resolves when the store is cleared.
-   */
   async drop() {
     await sleep();
     this._reset_indexes();
@@ -925,12 +848,7 @@ var InMemoryStore = class {
   _stream_matches(pattern, query, stream) {
     return query.stream_exact ? stream === pattern : RegExp(pattern).test(stream);
   }
-  /**
-   * Index of the latest snapshot of the queried stream, or -1. `with_snaps`
-   * on an exact single stream resumes there, so earlier events aren't read.
-   * The orchestrator asks only for unbounded current-state loads, so the
-   * floor applies whenever asked; an explicit `after` wins over it.
-   */
+  /** Index of the stream's latest snapshot, or -1; an explicit `after` wins. */
   _snap_floor(query) {
     if (!query?.with_snaps || !query.stream_exact || query.stream === void 0 || query.after !== void 0)
       return -1;
@@ -940,12 +858,6 @@ var InMemoryStore = class {
     }
     return -1;
   }
-  /**
-   * Query events in the store, optionally filtered by query options.
-   * @param callback - Function to call for each event.
-   * @param query - Optional query options.
-   * @returns The number of events processed.
-   */
   async query(callback, query) {
     await sleep();
     const floor = this._snap_floor(query);
@@ -964,15 +876,6 @@ var InMemoryStore = class {
     }
     return count;
   }
-  /**
-   * Commit one or more events to a stream.
-   * @param stream - The stream name.
-   * @param msgs - The events/messages to commit.
-   * @param meta - Event metadata.
-   * @param expectedVersion - Optional optimistic concurrency check.
-   * @returns The committed events with metadata.
-   * @throws ConcurrencyError if expectedVersion does not match.
-   */
   async commit(stream, msgs, meta, expectedVersion) {
     await sleep();
     const current_version = this._stream_versions.get(stream) ?? -1;
@@ -1003,15 +906,6 @@ var InMemoryStore = class {
     this._stream_versions.set(stream, version - 1);
     return committed;
   }
-  /**
-   * Atomically discovers and leases streams for processing.
-   * Fuses poll + lease into a single operation.
-   * @param lagging - Max streams from lagging frontier.
-   * @param leading - Max streams from leading frontier.
-   * @param by - Lease holder identifier.
-   * @param millis - Lease duration in milliseconds.
-   * @returns Granted leases.
-   */
   async claim(lagging, leading, by, millis, lane) {
     await sleep();
     const has_work = (s) => s.correlated_at !== void 0 && s.at < s.correlated_at;
@@ -1047,15 +941,6 @@ var InMemoryStore = class {
       (p) => this._streams.get(p.stream)?.lease({ ...p, by, retry: 0 }, millis)
     ).filter((l) => !!l);
   }
-  /**
-   * Registers streams for event processing. When the same stream is
-   * resubscribed with a different priority, the **maximum** wins — so
-   * the highest-priority registered reaction sets the scheduling lane.
-   * Use {@link prioritize} for operator runtime overrides.
-   *
-   * @param streams - Streams to register with optional source + priority.
-   * @returns subscribed count and current max watermark.
-   */
   async subscribe(streams, correlated_at, correlator) {
     await sleep();
     let correlating;
@@ -1070,9 +955,7 @@ var InMemoryStore = class {
         this._correlators.set(correlator.key, {
           at,
           by: correlator.by,
-          // A non-positive `millis` releases outright rather than setting an
-          // expiry a hair in the future: a successor asking inside the same
-          // millisecond would otherwise still be refused.
+          // Release outright, or a successor in the same ms is still refused.
           until: correlator.millis > 0 ? now + correlator.millis : 0
         });
       } else {
@@ -1114,53 +997,26 @@ var InMemoryStore = class {
       ...correlating === void 0 ? {} : { correlating }
     };
   }
-  /**
-   * Acknowledge completion of processing for leased streams.
-   * @param leases - Leases to acknowledge, including last processed watermark and lease holder.
-   */
   async ack(leases) {
     await sleep();
     return leases.map((l) => this._streams.get(l.stream)?.ack(l)).filter((l) => !!l);
   }
-  /**
-   * Block a stream for processing after failing to process and reaching max retries with blocking enabled.
-   * @param leases - Leases to block, including lease holder and last error message.
-   * @returns Blocked leases.
-   */
   async block(leases) {
     await sleep();
     return leases.map((l) => this._streams.get(l.stream)?.block(l, l.error)).filter((l) => !!l);
   }
-  /**
-   * Hold the matched streams out of {@link claim} until `deferred_at`
-   * (ms since epoch) — see {@link Store.defer}. Accepts an explicit list
-   * of names or a {@link StreamFilter}, mirroring {@link reset}/{@link unblock}.
-   * Persisted store state (unlike in-process backoff), so the skip is honored
-   * by every competing worker. Unknown names are silently skipped.
-   *
-   * @returns Count of streams whose `deferred_at` was set.
-   */
   async defer(input, deferred_at) {
     await sleep();
     const selected = this._select(input);
     for (const s of selected) s.defer(deferred_at);
     return selected.length;
   }
-  /**
-   * The streams named by `input`: an explicit list (de-duplicated, so a
-   * repeated name counts once, matching the SQL adapters' set-based
-   * `stream = ANY(...)`; unknown names are skipped) or a {@link StreamFilter}.
-   */
+  /** De-duplicated like the SQL `stream = ANY(...)`; unknown names skipped. */
   _select(input) {
     if (Array.isArray(input))
       return [...new Set(input)].map((name) => this._streams.get(name)).filter((s) => s !== void 0);
     return [...this._streams.values()].filter(this._filter_predicate(input));
   }
-  /**
-   * Build a predicate from a {@link StreamFilter}. Compiled regexes are
-   * cached in the closure so callers can apply it across the streams
-   * map without re-compiling per iteration.
-   */
   _filter_predicate(filter) {
     const stream_re = filter.stream !== void 0 && !filter.stream_exact ? new RegExp(filter.stream) : void 0;
     const source_re = filter.source !== void 0 && !filter.source_exact ? new RegExp(filter.source) : void 0;
@@ -1180,46 +1036,18 @@ var InMemoryStore = class {
       return true;
     };
   }
-  /**
-   * Reset watermarks to -1, clearing retry, blocked, error, and lease
-   * state so the matched streams can be replayed from the beginning.
-   * Accepts either an explicit list of names or a {@link StreamFilter}.
-   *
-   * @param input - Stream names or a filter selecting the streams to reset.
-   * @returns Count of streams that were actually reset.
-   */
   async reset(input) {
     await sleep();
     const selected = this._select(input);
     for (const s of selected) s.reset();
     return selected.length;
   }
-  /**
-   * Wipe the sensitive-data payload for every event on the stream — see
-   * {@link Store.forget_pii}. O(1) drop of the stream's inner Map; the size of
-   * that Map is the count of events that had PII. Idempotent: a second call
-   * finds no inner Map and returns `0`.
-   *
-   * @param stream - Target stream.
-   * @returns Count of events whose isolated PII payload was deleted.
-   */
   async forget_pii(stream) {
     await sleep();
     const count = this._pii.get(stream)?.size ?? 0;
     this._pii.delete(stream);
     return count;
   }
-  /**
-   * Clear the blocked flag (and retry / error / lease) on the matched
-   * streams without touching the watermark. Streams that aren't blocked
-   * at call time are silently skipped. Accepts either an explicit list
-   * of names or a {@link StreamFilter}. The filter form always restricts
-   * to blocked streams — passing `blocked: false` matches nothing.
-   * See {@link Store.unblock}.
-   *
-   * @param input - Stream names or a filter selecting the streams to unblock.
-   * @returns Count of streams that were actually flipped (were blocked).
-   */
   async unblock(input) {
     await sleep();
     const selected = this._select(
@@ -1227,26 +1055,12 @@ var InMemoryStore = class {
     );
     return selected.filter((s) => s.unblock()).length;
   }
-  /**
-   * Bulk-update priority of streams matching `filter`. Mirrors
-   * {@link query_streams}'s filter semantics — see {@link Store.prioritize}.
-   * Unlike {@link subscribe} (which keeps `max()` of registered
-   * priorities), this sets the priority outright — operator override
-   * for the build-time scheduling policy.
-   *
-   * @returns Count of streams whose priority changed.
-   */
   async prioritize(filter, priority) {
     await sleep();
     const changed = this._select(filter).filter((s) => s.priority !== priority);
     for (const s of changed) s.set_priority(priority);
     return changed.length;
   }
-  /**
-   * Streams registered subscription positions to the callback, ordered by
-   * stream name. Returns the highest event id in the store and the count
-   * of positions emitted.
-   */
   async query_streams(callback, query) {
     await sleep();
     const limit = query?.limit ?? 100;
@@ -1289,19 +1103,6 @@ var InMemoryStore = class {
     }
     return { maxEventId: this._events.at(-1)?.id ?? -1, count };
   }
-  /**
-   * Per-stream aggregated stats — see {@link Store.query_stats}.
-   *
-   * Single forward scan over the in-memory event list, accumulating per
-   * stream. The "cheap heads" cost tier from durable adapters doesn't
-   * apply here (InMemory has no indexes); correctness is the goal, perf
-   * is a non-issue.
-   *
-   * Scope rules:
-   * - Array `input` — explicit stream names, regardless of subscription.
-   * - Filter `input` — `stream`/`stream_exact` match against event-bearing
-   *   stream names. Empty filter `{}` matches every event-bearing stream.
-   */
   async query_stats(input, options) {
     await sleep();
     const exclude = new Set(options?.exclude ?? []);
@@ -1363,15 +1164,6 @@ var InMemoryStore = class {
     }
     return out;
   }
-  /**
-   * Atomically truncates streams and seeds each with a snapshot or tombstone.
-   * Windowed targets (`before` set) prune the prefix below the closest safe
-   * `__snapshot__` instead — no seed, subscriptions untouched, no-op when no
-   * snapshot qualifies.
-   * @param targets - Streams to truncate with optional snapshot state and meta,
-   *   or a `before`/`max_id` boundary for a windowed prefix delete.
-   * @returns Map keyed by stream name, each entry with `deleted` count and `committed` event.
-   */
   async truncate(targets) {
     await sleep();
     const result = /* @__PURE__ */ new Map();
@@ -1422,18 +1214,7 @@ var InMemoryStore = class {
     }
     return result;
   }
-  /**
-   * Atomically wipe-and-rebuild the store under an in-process snapshot.
-   *
-   * Captures every index state up front, clears it, then hands the
-   * orchestrator a per-event insert `callback` via the driver. Any
-   * throw inside the driver restores the snapshot, leaving the store
-   * byte-for-byte unchanged from the operator's perspective.
-   *
-   * `id`s are reassigned `0..N-1` as events arrive (dense — the
-   * monotonic id counter restarts at 0 for the rebuild). `created` is
-   * preserved verbatim from the source.
-   */
+  /** A throw inside the driver restores the captured state. Ids restart at 0. */
   async restore(driver) {
     await sleep();
     const prev_events = this._events;
@@ -2899,37 +2680,34 @@ async function windowed_prune_pending(stream, before, max_id) {
 }
 async function probe_min_watermarks(streams, page_size, checkpoint) {
   const min_at = /* @__PURE__ */ new Map();
-  const source_regex = /* @__PURE__ */ new Map();
-  const get_regex = (source) => {
-    let re = source_regex.get(source);
+  const matches = source_matcher();
+  await walk_streams(
+    store2(),
+    (position) => {
+      const pending = position.correlated_at === void 0 || position.at < position.correlated_at;
+      const cap = pending ? position.at : Math.max(position.at, checkpoint);
+      for (const stream of streams) {
+        if (matches(position.source, stream)) {
+          const prev = min_at.get(stream);
+          if (prev === void 0 || cap < prev) min_at.set(stream, cap);
+        }
+      }
+    },
+    { limit: page_size, source_matches: streams }
+  );
+  return min_at;
+}
+function source_matcher() {
+  const compiled = /* @__PURE__ */ new Map();
+  return (source, stream) => {
+    if (!source) return true;
+    let re = compiled.get(source);
     if (!re) {
       re = new RegExp(source);
-      source_regex.set(source, re);
+      compiled.set(source, re);
     }
-    return re;
+    return re.test(stream);
   };
-  let after;
-  for (; ; ) {
-    let last;
-    const { count } = await store2().query_streams(
-      (position) => {
-        last = position.stream;
-        const source_re = position.source ? get_regex(position.source) : void 0;
-        const pending = position.correlated_at === void 0 || position.at < position.correlated_at;
-        const cap = pending ? position.at : Math.max(position.at, checkpoint);
-        for (const stream of streams) {
-          if (!source_re || source_re.test(stream)) {
-            const prev = min_at.get(stream);
-            if (prev === void 0 || cap < prev) min_at.set(stream, cap);
-          }
-        }
-      },
-      { after, limit: page_size, source_matches: streams }
-    );
-    if (count < page_size) break;
-    after = last;
-  }
-  return min_at;
 }
 async function scan_stream_heads(streams) {
   const stats = await store2().query_stats(streams, {
@@ -2963,36 +2741,20 @@ async function partition_by_safety(stream_info, reactive_events_size, skipped, p
     if (checkpoint < info.max_id) uncorrelated.add(stream);
   }
   const pending_set = /* @__PURE__ */ new Set();
-  const source_regex = /* @__PURE__ */ new Map();
-  const get_regex = (source) => {
-    let re = source_regex.get(source);
-    if (!re) {
-      re = new RegExp(source);
-      source_regex.set(source, re);
-    }
-    return re;
-  };
+  const matches = source_matcher();
   const targets = [...stream_info.keys()];
-  let after;
-  for (; ; ) {
-    let last;
-    const { count } = await store2().query_streams(
-      (position) => {
-        last = position.stream;
-        const source_re = position.source ? get_regex(position.source) : void 0;
-        const has_work = position.correlated_at !== void 0 && position.at < position.correlated_at;
-        if (!has_work) return;
-        for (const [stream, info] of stream_info) {
-          if ((!source_re || source_re.test(stream)) && position.at < info.max_id) {
-            pending_set.add(stream);
-          }
-        }
-      },
-      { after, limit: page_size, source_matches: targets }
-    );
-    if (count < page_size) break;
-    after = last;
-  }
+  await walk_streams(
+    store2(),
+    (position) => {
+      const has_work = position.correlated_at !== void 0 && position.at < position.correlated_at;
+      if (!has_work) return;
+      for (const [stream, info] of stream_info) {
+        if (matches(position.source, stream) && position.at < info.max_id)
+          pending_set.add(stream);
+      }
+    },
+    { limit: page_size, source_matches: targets }
+  );
   const safe = [];
   for (const [stream] of stream_info) {
     if (pending_set.has(stream) || uncorrelated.has(stream))
@@ -3255,13 +3017,25 @@ var CorrelateCycle = class {
     const after = Math.max(this._checkpoint, query.after || -1);
     const correlated = /* @__PURE__ */ new Map();
     let last_id = after;
+    let stopped = false;
     const found = await store2().query(
       (event) => {
-        last_id = event.id;
+        if (stopped) return;
         const register = this._registry.events[event.name];
         if (register) {
           for (const reaction of register.reactions.values()) {
-            const resolved = typeof reaction.resolver === "function" ? reaction.resolver(event) : reaction.resolver;
+            let resolved;
+            try {
+              resolved = typeof reaction.resolver === "function" ? reaction.resolver(event) : reaction.resolver;
+            } catch (error) {
+              stopped = true;
+              report_once(
+                this._reported,
+                `resolver|${reaction.handler.name}|${event.id}`,
+                `Resolver of reaction "${reaction.handler.name}" threw on ${String(event.name)} #${event.id} (stream "${event.stream}"): ${String(error)}. Correlation stops before this event until the resolver stops throwing; work already found keeps draining.`
+              );
+              return;
+            }
             if (!resolved) continue;
             let lane = resolved.lane;
             if (lane !== void 0 && !this._declared_lanes.has(lane)) {
@@ -3310,6 +3084,7 @@ var CorrelateCycle = class {
             correlated.set(resolved.target, entry);
           }
         }
+        last_id = event.id;
       },
       // Resolvers see `pii: null`: correlate runs actor-less, and one
       // undecryptable row would otherwise stop every stream's reactions.
@@ -3351,7 +3126,7 @@ var CorrelateCycle = class {
       return { subscribed, last_id, marked, scanned: true };
     }
     this._checkpoint = last_id;
-    this._armed = found === query.limit;
+    this._armed = stopped || found === query.limit;
     return { subscribed: 0, last_id, marked: 0, scanned: true };
   }
   /**
@@ -3676,6 +3451,18 @@ var validating_patch = (me, state2, partial, event) => {
   );
 };
 var DEFAULT_BATCH = 500;
+var cache_put = (stream, entry) => cache2().set(stream, entry).catch(
+  (err) => log().warn(
+    err,
+    "cache set skipped; the next load re-folds from the store"
+  )
+);
+var cache_drop = (stream) => cache2().invalidate(stream).catch(
+  (err) => log().warn(
+    err,
+    "cache invalidate skipped; a stale checkpoint re-folds from its event_id"
+  )
+);
 async function snap(snapshot) {
   const { id, stream, name, meta, version } = snapshot.event;
   try {
@@ -3878,19 +3665,14 @@ async function load(me, target, callback, patch_fn = bare_patch) {
   );
   const head_is_tombstone = event?.name === TOMBSTONE_EVENT;
   if (replayed > 0 && !time_travel && event && !me.pii_aware && !head_is_tombstone) {
-    await cache2().set(stream, {
+    await cache_put(stream, {
       stream,
       state: state2,
       version: event.version,
       event_id: event.id,
       patches,
       snaps
-    }).catch(
-      (err) => log().warn(
-        err,
-        "cache set skipped; the next load re-folds from the store"
-      )
-    );
+    });
   }
   return {
     event,
@@ -3978,14 +3760,7 @@ async function action(me, action2, target, payload, options, patch_fn = bare_pat
           reactingTo ? expectedVersion : expected
         );
       } catch (error) {
-        if (error instanceof ConcurrencyError) {
-          cache2().invalidate(stream).catch(
-            (err) => log().warn(
-              err,
-              "cache invalidate skipped; a stale checkpoint re-folds from its event_id"
-            )
-          );
-        }
+        if (error instanceof ConcurrencyError) void cache_drop(stream);
         throw error;
       }
       let { state: state2, patches } = snapshot;
@@ -4012,26 +3787,15 @@ async function action(me, action2, target, payload, options, patch_fn = bare_pat
       const snap_event = snapped ? await snap(last) : void 0;
       if (!me.pii_aware) {
         if (contiguous)
-          cache2().set(stream, {
+          void cache_put(stream, {
             stream,
             state: last.state,
             version: snap_event?.version ?? last.event.version,
             event_id: snap_event?.id ?? last.event.id,
             patches: snap_event ? 0 : last.patches,
             snaps: snap_event ? last.snaps + 1 : last.snaps
-          }).catch(
-            (err) => log().warn(
-              err,
-              "cache set skipped; the next load re-folds from the store"
-            )
-          );
-        else
-          cache2().invalidate(stream).catch(
-            (err) => log().warn(
-              err,
-              "cache invalidate skipped; a stale checkpoint re-folds from its event_id"
-            )
-          );
+          });
+        else void cache_drop(stream);
       }
       return snapshots;
     } catch (error) {
@@ -4246,6 +4010,22 @@ function fetch_failure_policy(registry) {
     }
   return { blockOnError, maxRetries };
 }
+function resolver_failed(lease, { error, options }) {
+  log().error(error);
+  const block2 = options.blockOnError && lease.retry >= options.maxRetries;
+  return {
+    lease,
+    handled: 0,
+    acked_at: lease.at,
+    error,
+    ...block2 ? { block: true } : {
+      next_attempt_at: Date.now() + compute_backoff_delay(
+        lease.retry,
+        options.backoff ?? DEFAULT_BACKOFF
+      )
+    }
+  };
+}
 function warn_misrouted(seen, stream, handler, event) {
   report_once(
     seen,
@@ -4279,13 +4059,23 @@ async function run_drain_cycle(deps, cycle) {
   );
   for (const f of fetched) {
     const { stream, events } = f;
+    let failed;
     const payloads = events.flatMap((event) => {
       const register = registry.events[event.name];
       if (!register) return [];
       return [...register.reactions.values()].filter((reaction) => {
         const resolver = reaction.resolver;
         const dynamic = typeof resolver === "function";
-        const resolved = dynamic ? resolver(event) : resolver;
+        let resolved;
+        try {
+          resolved = dynamic ? resolver(event) : resolver;
+        } catch (error) {
+          failed ??= {
+            error: `Resolver of reaction "${reaction.handler.name}" threw on ${String(event.name)} #${event.id} (stream "${event.stream}"): ${String(error)}`,
+            options: reaction.options
+          };
+          return false;
+        }
         if (!resolved || resolved.target !== stream) return false;
         if (!dynamic || !batch_handlers.has(stream)) return true;
         warn_misrouted(
@@ -4297,7 +4087,7 @@ async function run_drain_cycle(deps, cycle) {
         return false;
       }).map((reaction) => ({ ...reaction, event }));
     });
-    fetch_map.set(stream, { fetch: f, payloads });
+    fetch_map.set(stream, { fetch: f, payloads, failed });
   }
   const handled = await Promise.all(
     leased.map((lease) => {
@@ -4318,6 +4108,8 @@ async function run_drain_cycle(deps, cycle) {
         };
         return Promise.resolve(failed);
       }
+      if (entry.failed)
+        return Promise.resolve(resolver_failed(lease, entry.failed));
       const at = entry.fetch.events.at(-1)?.id || fetch_window_at;
       const { payloads } = entry;
       const exhausted = budget_exhausted(
@@ -4794,41 +4586,23 @@ function validate_only_lanes(options, lanes) {
 }
 var Act = class {
   _emitter = new import_node_events.default();
-  /** Circuit breaker shared by all drain lanes. */
   _breaker;
-  /** Whether this instance subscribes to `Store.notify`. */
   _listen;
-  /** Whether this instance runs reactions (drain, settle, correlate). */
   _drain;
-  /** Event names with at least one registered reaction (computed at build time) */
   _reactive_events;
-  /** One DrainController per active lane, keyed by lane name. */
   _drain_controllers;
-  /** Correlation: lazy init and the scan that marks work. */
   _correlate;
-  /** Debounced correlate→drain catch-up loop. */
   _settle;
-  /** Timer behind {@link start_correlations}. */
   _poll;
   /** The deprecated `start_correlations` callback, while the poll runs. */
   _on_discovered;
   /**
-   * Disposer for the cross-process notify subscription, set up eagerly
-   * during construction. Held as a promise because the subscription
-   * itself may be async (the PG adapter checks out a dedicated client
-   * and runs `LISTEN` before resolving). Resolves to `undefined` when
-   * the store doesn't implement `notify` or there are no registered
-   * reactions.
-   *
-   * **Contract:** the configured store must be injected via
-   * {@link store}`(adapter)` *before* calling `act()...build()`. The
-   * orchestrator wires notify against whatever store is current at
-   * construction time — late injection after build is unsupported.
+   * Wired at construction against the store current then, so a store
+   * injected after `build()` is never notified.
    */
   _notify_disposer;
   /** Public registry — kept as-is per the no-prefix-on-public convention. */
   registry;
-  /** Map of state name → state definition; populated by the builder. */
   _states;
   /**
    * Emit a lifecycle event. The payload type is inferred from the event name
@@ -4854,15 +4628,9 @@ var Act = class {
     return listeners.length > 0;
   }
   /**
-   * The single store-failure handler: log it, then emit the `error`
-   * lifecycle event. Wired into the circuit breaker's `on_error`, so it
-   * runs on every `failed()` — drain / settle / autoclose just call
-   * `breaker.failed(now, error)` and never log or emit themselves.
-   *
-   * The emit is guarded against Node's `EventEmitter` contract that an
-   * unhandled `"error"` emission is rethrown (which would crash the process
-   * from inside the drain catch); logging is unconditional so failures are
-   * never silent.
+   * The one place a store failure is logged and emitted (the breaker's
+   * `on_error`). The emit is guarded: an unhandled `"error"` emission
+   * would crash the process.
    */
   _emit_error(error, circuit) {
     this._logger.error(error);
@@ -4884,58 +4652,29 @@ var Act = class {
     this._emitter.off(event, listener);
     return this;
   }
-  /** Batch handlers for static-target projections (target → handler) */
   _batch_handlers;
-  /** Event-sourcing handlers, optionally wrapped with trace decorators */
   _es;
-  /** Correlate/drain pipeline ops, optionally wrapped with trace decorators */
   _cd;
-  /**
-   * Event-name → owning state, computed at build time. The duplicate-event
-   * guard in merge.ts ensures one event name maps to at most one state, so
-   * this lookup is unambiguous. Used by `close()` to pick the right reducer
-   * set when seeding a `restart` snapshot in multi-state apps.
-   */
+  /** Unambiguous: merge rejects an event name declared by two states. */
   _event_to_state;
-  /**
-   * Event-name → lane fan-in for selective arming. Built by
-   * `classify_registry` once per build. `"all"` means at least one of
-   * the event's reactions is a dynamic resolver (lane opaque until
-   * runtime); a `Set<string>` lists the static lanes only that event's
-   * reactions target.
-   */
+  /** Lanes to arm per event; `"all"` when a dynamic resolver hides the lane. */
   _event_to_lanes;
-  /** What `internal/audit.ts` needs, built once at construction. */
   _audit_deps;
-  /** Logger resolved at construction time (after user port configuration) */
   _logger = log();
   /** This Act's ports: its own bag, or the singleton adapters. */
   _ports;
-  /**
-   * Runs a body inside this Act's ports frame, so internal
-   * `store()`/`cache()` calls resolve to `_ports`.
-   */
+  /** Runs a body so internal `store()`/`cache()` calls resolve to `_ports`. */
   _scoped;
-  /**
-   * Correlation-id generator for originating actions. Bound at
-   * construction from `options.correlator ?? default_correlator`. The
-   * `do()` path passes this into the `_es.action` closure; close-cycle
-   * uses it via {@link close_correlation}.
-   */
   _correlator;
-  /** Pre-bound IAct methods reused across drain cycles. Only `do` varies per
-   * payload (it captures the triggering event for reactingTo auto-inject). */
+  // Bound once, reused by every reaction payload.
   _bound_do = this.do.bind(this);
   _bound_load = this.load.bind(this);
   _bound_query = this.query.bind(this);
   _bound_query_array = this.query_array.bind(this);
   _bound_forget = this.forget.bind(this);
-  /** Reaction dispatchers built once and handed to run_drain_cycle each cycle. */
   _handle;
   _handle_batch;
-  /** Declared drain lanes. */
   _lanes;
-  /** Serializes close critical sections per stream. */
   _close_lock = new CloseLock();
   /** Every lane a controller can exist for: `"default"` plus each declared one. */
   _declared_lanes;
@@ -4943,26 +4682,7 @@ var Act = class {
   get lanes() {
     return this._lanes;
   }
-  /**
-   * Create a new Act orchestrator. Prefer the {@link act} builder over
-   * direct construction — `act()...build()` wires the registry, merges
-   * partial states, and collects batch handlers from registered slices
-   * and projections in one pass.
-   *
-   * @param registry  Schemas for every event and action across registered states
-   * @param states    Merged map of state name → state definition
-   * @param batch_handlers Static-target projection batch handlers (target → handler)
-   * @param options   Tuning knobs — see {@link ActOptions}
-   * @param lanes     Declared drain lanes. The builder collects
-   *   these from `.withLane(...)` calls; one `DrainController` runs
-   *   per lane, plus the implicit `"default"`.
-   * @param patch_fn  The per-event patch step selected once by the builder
-   *   from `ActOptions.validateFoldedState` — `bare_patch` by
-   *   default, `validating_patch` when the flag is on. The builder uses
-   *   the same value for its projection-fold handlers, so there is a
-   *   single selection site. Defaults to `bare_patch` for direct
-   *   construction.
-   */
+  /** Use the {@link act} builder rather than constructing directly. */
   constructor(registry, states = /* @__PURE__ */ new Map(), batch_handlers = /* @__PURE__ */ new Map(), options = {}, lanes = [], patch_fn = bare_patch) {
     this.registry = registry;
     this._states = states;
@@ -5013,11 +4733,7 @@ var Act = class {
     this._notify_disposer = this._wire_notify(this._ports.store);
     register_weak_disposer(new WeakRef(this), (self) => self.shutdown());
   }
-  /**
-   * Circuit breaker shared by every store-polling loop (drain, the settle
-   * correlate, autoclose). Validates the knobs eagerly so out-of-range
-   * values throw at build time, not on the first cycle tick.
-   */
+  /** Shared by drain, settle and autoclose; bad knobs throw at build. */
   _build_breaker(options) {
     return new CircuitBreaker(
       resolveCircuitBreakerConfig(options.circuitBreaker),
@@ -5031,11 +4747,7 @@ var Act = class {
       }
     );
   }
-  /**
-   * One DrainController per active lane, plus the implicit "default" unless
-   * `onlyLanes` excludes it. Apps that declare no lanes pass no lane filter
-   * to `claim`.
-   */
+  /** Apps that declare no lanes pass no lane filter to `claim`. */
   _build_drain_controllers(options, lanes) {
     const all_lanes = this._declared_lanes;
     const only_set = options.onlyLanes && options.onlyLanes.length > 0 ? new Set(options.onlyLanes) : void 0;
@@ -5054,8 +4766,18 @@ var Act = class {
         on_acked: (acked) => this.emit("acked", acked),
         on_blocked: (blocked) => this.emit("blocked", blocked),
         // Reaction-requested close: the same machinery as `app.close`.
+        // A store failure reaches the breaker; anything else (the archive
+        // callback is app code) is logged here, never counted.
         on_close: async (targets) => {
-          await this._run_close(targets);
+          try {
+            await this._run_close(targets);
+          } catch (error) {
+            if (error instanceof StoreError) throw error;
+            this._logger.error(
+              error,
+              `Reaction-requested close of ${targets.map((t) => `"${t.stream}"`).join(", ")} failed and was not retried; close it with app.close(...) once the cause is fixed.`
+            );
+          }
         },
         breaker: this._breaker,
         run_scoped: this._scoped,
@@ -5071,11 +4793,7 @@ var Act = class {
     }
     return controllers;
   }
-  /**
-   * Startup advisory naming declared lanes that `onlyLanes` leaves without a
-   * controller here. One process can't check that the cluster covers every
-   * lane, so it reports its own gaps.
-   */
+  /** One process can't see the cluster, so it reports its own lane gaps. */
   _advise_orphaned_lanes(options) {
     if (!options.onlyLanes || options.onlyLanes.length === 0) return;
     const active = new Set(this._drain_controllers.keys());
@@ -5097,11 +4815,6 @@ var Act = class {
       routed_events: new Set(this._event_to_lanes.keys())
     };
   }
-  /**
-   * Correlate cycle over the classified registry. The cold-start callback
-   * arms every controller — historical events may need processing —
-   * except on writer-only instances (`drain: false`).
-   */
   _build_correlate(options, classification) {
     return new CorrelateCycle({
       registry: this.registry,
@@ -5119,12 +4832,7 @@ var Act = class {
       on_init_async: this._drain ? () => this._seed_persisted_defers() : void 0
     });
   }
-  /**
-   * At cold start, re-seed each lane controller's local wake from the
-   * persisted future `deferred_at`, so an idle deferred stream (an
-   * autoclose waiting out its window) still fires on time. Streams on lanes
-   * this instance doesn't run are skipped.
-   */
+  /** Cold start: an idle deferred stream still fires on time after a restart. */
   async _seed_persisted_defers() {
     const now = Date.now();
     await walk_streams(store2(), (pos) => {
@@ -5133,7 +4841,6 @@ var Act = class {
       controller?.seed_defer(pos.stream, pos.deferred_at);
     });
   }
-  /** Settle loop driving correlate + drain to quiescence. */
   _build_settle(options) {
     return new SettleLoop(
       {
@@ -5147,7 +4854,6 @@ var Act = class {
       options.settleDebounceMs ?? DEFAULT_SETTLE_DEBOUNCE_MS
     );
   }
-  /** True after the first `shutdown()` call. Guards idempotency. */
   _shutdown_promise;
   /**
    * Per-instance teardown: stop scheduling new work, give drain cycles
@@ -5187,14 +4893,8 @@ var Act = class {
     return this._shutdown_promise;
   }
   /**
-   * Wait for every in-flight drain cycle, or for the grace budget to elapse,
-   * whichever comes first. Cycle promises never reject (`drain()` contains
-   * its own errors), so this never throws.
-   *
-   * An omitted budget is the largest `leaseMillis` among lanes with a cycle
-   * in flight (the drain's fallback for lanes that pinned none, or pinned
-   * 0, which is the same as none), with an in-flight settle counting on the
-   * fallback, capped at the maximum. Idle lanes don't count.
+   * The largest `leaseMillis` among lanes with a cycle in flight (the
+   * default for none or 0, and for a running settle), capped.
    */
   _derive_grace_ms(running, settling) {
     let max = settling ? DEFAULT_LEASE_MILLIS : 0;
@@ -5223,12 +4923,7 @@ var Act = class {
       clearTimeout(timer);
     }
   }
-  /**
-   * Subscribe to {@link Store.notify} when both the store and the
-   * registry support it. Returns the disposer (or `undefined` when no
-   * subscription was made). Errors during subscription are logged but
-   * never thrown — `notify` is a hint, not a contract.
-   */
+  /** Failures are logged, never thrown: `notify` is a hint. */
   async _wire_notify(s) {
     if (this._reactive_events.size === 0) return void 0;
     if (!s.notify) return void 0;
@@ -5540,20 +5235,11 @@ var Act = class {
       return { fetched: [], leased: [], acked: [], blocked: [] };
     return this._scoped(() => this._drain_all(options));
   }
-  /** Arm every active lane controller. */
   _arm_all() {
     this._correlate.arm();
     for (const c of this._drain_controllers.values()) c.arm();
   }
-  /**
-   * Arm only the lane controllers whose reactions match the supplied
-   * event names (selective arming). Events with any dynamic
-   * resolver fall back to `_arm_all()` via the `"all"` sentinel — the
-   * resolver's lane isn't known until correlate runs the function.
-   * Events with no reactions are skipped; `_event_to_lanes` doesn't
-   * carry them. Returns true when any controller was armed (used by
-   * the notify handler to decide whether to schedule a settle).
-   */
+  /** Arms only the lanes these events react on; true when any was armed. */
   _arm_for_event_names(names) {
     const to_arm = /* @__PURE__ */ new Set();
     for (const name of names) {
@@ -5570,14 +5256,7 @@ var Act = class {
     for (const lane of to_arm) this._drain_controllers.get(lane)?.arm();
     return true;
   }
-  /** Drain every active lane controller in parallel and aggregate.
-   *
-   * Parallel — not sequential — so a slow lane's in-flight handler does
-   * not block a fast lane's claim/dispatch/ack cycle. Each controller's
-   * `claim()` is independent (filtered by lane); the store's
-   * `SKIP LOCKED` keeps cross-controller races safe. Lifecycle events
-   * (`acked`, `blocked`) may interleave by lane — listeners filter via
-   * `lease.lane`. */
+  /** In parallel, so a slow lane never holds up a fast one. */
   async _drain_all(options) {
     const results = await Promise.all(
       [...this._drain_controllers.values()].map((c) => c.drain(options))
@@ -5650,14 +5329,7 @@ var Act = class {
     const { subscribed, last_id } = await this._correlate_scanned(query);
     return { subscribed, last_id };
   }
-  /**
-   * `correlate` plus whether the pass actually read the store.
-   *
-   * The settle loop needs that extra bit to decide whether the pass carries a
-   * circuit-breaker health signal, and a disarmed pass carries none. It stays
-   * internal rather than widening the public `correlate` return, which is
-   * charter-covered and has no use for it.
-   */
+  /** `correlate` plus `scanned`, which settle needs for the breaker. */
   async _correlate_scanned(query, lease = false) {
     if (!this._drain) return { subscribed: 0, last_id: -1, scanned: false };
     return this._scoped(async () => {
@@ -5998,11 +5670,7 @@ var Act = class {
   async prioritize(filter, priority) {
     return this._scoped(() => store2().prioritize(filter, priority));
   }
-  /**
-   * Run one close: the cycle with this Act's ports, then emit `closed`. Shared by `close()` and the drain's
-   * reaction-requested closes. The close actor lets a custom correlator
-   * still tag tenant context or trace ids.
-   */
+  /** Shared by `close()` and reaction-requested closes. */
   async _run_close(targets) {
     const close_actor = { id: "$close", name: "close" };
     const result = await run_close_cycle(targets, {
@@ -6083,10 +5751,7 @@ var Act = class {
    */
   async close(targets) {
     if (!targets.length) return { truncated: /* @__PURE__ */ new Map(), skipped: [] };
-    return this._scoped(async () => {
-      await this.correlate({ limit: CLOSE_CATCH_UP_LIMIT });
-      return this._run_close(targets);
-    });
+    return this._scoped(() => this._run_close(targets));
   }
   /**
    * Debounced, non-blocking correlate→drain cycle.