@rotorsoft/act 1.32.30 → 1.33.1

package/dist/index.js

@@ -1,13 +1,16 @@
 import {
   ConsoleLogger,
-  DEFAULT_LANE,
-  ExitCodes,
+  DEFAULT_BACKOFF,
+  DEFAULT_BLOCK_ON_ERROR,
+  DEFAULT_EVENT_LIMIT,
+  DEFAULT_LEASE_MILLIS,
+  DEFAULT_MAX_RETRIES,
+  DEFAULT_STREAM_LIMIT,
   InMemoryCache,
   InMemoryStore,
   LruMap,
+  MAX_SHUTDOWN_GRACE_MS,
   PackageSchema,
-  SNAP_EVENT,
-  TOMBSTONE_EVENT,
   cache,
   config,
   current_autoclose_window,
@@ -23,37 +26,51 @@ import {
   make_run_scoped,
   port,
   register_weak_disposer,
+  resolveActConfig,
+  resolveActionConfig,
+  resolveAutocloseConfig,
+  resolveAutocloseConfig2,
+  resolveCircuitBreakerConfig,
+  resolveDrainConfig,
+  resolveFoldConfig,
+  resolveLaneConfig,
+  resolveReactionConfig,
+  resolveSettleConfig,
+  resolveShutdownConfig,
   sleep,
   store,
   validate
-} from "./chunk-X3MMQIIP.js";
+} from "./chunk-NYH6FNTM.js";
 import {
   ActorSchema,
   CausationEventSchema,
   CommittedMetaSchema,
   ConcurrencyError,
+  DEFAULT_LANE,
+  DEFAULT_MAX_SUBSCRIBED_STREAMS,
+  DEFAULT_SETTLE_DEBOUNCE_MS,
+  DeferSignal,
   Environments,
   Errors,
   EventMetaSchema,
-  IDENTITY_GATE,
+  ExitCodes,
   InvariantError,
   LogLevels,
   NonRetryableError,
   QuerySchema,
   REDACTED,
   SHREDDED,
+  SNAP_EVENT,
   StoreError,
   StreamClosedError,
+  TOMBSTONE_EVENT,
   TargetSchema,
   ValidationError,
   ZodEmpty,
-  make_gate,
   pii_fields,
   pii_schemas,
-  pii_split,
-  pii_strip,
   sensitive
-} from "./chunk-HHKLVRR4.js";
+} from "./chunk-TJ4JRRUR.js";
 
 // src/signals.ts
 process.once("SIGINT", async (arg) => {
@@ -76,55 +93,6 @@ process.once("unhandledRejection", async (arg) => {
 // src/act.ts
 import EventEmitter from "events";
 
-// src/builders/build-classify.ts
-var ALL_LANES = /* @__PURE__ */ Symbol("act-1103/all-lanes");
-function classify_registry(registry, states) {
-  const statics = /* @__PURE__ */ new Map();
-  const target_lanes = /* @__PURE__ */ new Map();
-  const event_to_lanes = /* @__PURE__ */ new Map();
-  for (const [name, register] of Object.entries(registry.events)) {
-    for (const reaction of register.reactions.values()) {
-      if (typeof reaction.resolver === "function") {
-        event_to_lanes.set(name, ALL_LANES);
-      } else {
-        const { target, source, priority = 0, lane } = reaction.resolver;
-        const lane_name = lane ?? "default";
-        const existing_lanes = event_to_lanes.get(name);
-        if (existing_lanes !== ALL_LANES) {
-          const set = existing_lanes ?? /* @__PURE__ */ new Set();
-          set.add(lane_name);
-          event_to_lanes.set(name, set);
-        }
-        const recorded_lane = target_lanes.get(target);
-        if (recorded_lane === void 0) {
-          target_lanes.set(target, lane_name);
-        } else if (recorded_lane !== lane_name) {
-          throw new Error(
-            `Stream "${target}" has conflicting lane assignments ("${recorded_lane}" vs "${lane_name}")`
-          );
-        }
-        const existing = statics.get(target);
-        if (!existing) {
-          statics.set(target, { stream: target, source, priority, lane });
-        } else if (priority > existing.priority) {
-          statics.set(target, { ...existing, priority });
-        }
-      }
-    }
-  }
-  const event_to_state = /* @__PURE__ */ new Map();
-  for (const merged of states.values()) {
-    for (const event_name of Object.keys(merged.events)) {
-      event_to_state.set(event_name, merged);
-    }
-  }
-  return {
-    static_targets: [...statics.values()],
-    event_to_state,
-    event_to_lanes
-  };
-}
-
 // src/internal/event-versions.ts
 var VERSION_SUFFIX = /^(.+?)_v(\d+)$/;
 function parse(name) {
@@ -683,495 +651,68 @@ var PASS_FACTORIES = {
   "unreadable-events": make_unreadable_events_pass
 };
 
-// src/internal/autoclose-policy.ts
-import { z } from "zod";
-var DAY_MS = 864e5;
-var MIN_AFTER_DAYS = 1 / 1440;
-var MIN_KEEP_DAYS = 1;
-function days_after(date, days) {
-  return new Date(date.getTime() + days * DAY_MS);
-}
-function days_before_now(days) {
-  return new Date(Date.now() - days * DAY_MS);
-}
-var window_schema = (field, min_days, floor) => z.object({
-  days: z.number({ message: `autocloses: ${field}.days must be a number` }).positive(`autocloses: ${field}.days must be > 0`)
-}).refine((o) => o.days >= min_days, {
-  message: `autocloses: ${field} resolves to < ${floor}, which is too short to be a meaningful retention window`
-});
-var AfterSchema = window_schema("after", MIN_AFTER_DAYS, "one minute");
-var KeepSchema = window_schema("keep", MIN_KEEP_DAYS, "one day");
-var IsSchema = z.union([
-  z.string().min(1, "autocloses: is must be a non-empty event name"),
-  z.array(
-    z.string().min(1, "autocloses: is entries must be non-empty event names")
-  ).min(1, "autocloses: is must include at least one event name").readonly()
-]);
-var ReachesSchema = z.number({ message: "autocloses: reaches must be a number" }).int("autocloses: reaches must be an integer").min(1, "autocloses: reaches must be >= 1");
-var OrBlockSchema = z.object({
-  after: AfterSchema.optional(),
-  is: IsSchema.optional(),
-  reaches: ReachesSchema.optional()
-}).strict().refine(
-  (o) => o.after !== void 0 || o.is !== void 0 || o.reaches !== void 0,
-  {
-    message: "autocloses: `or` block must include at least one of after / is / reaches"
+// src/internal/circuit-breaker.ts
+var CircuitBreaker = class {
+  _failures = 0;
+  _opened_at;
+  _wake;
+  _threshold;
+  _cooldown_ms;
+  _hooks;
+  constructor(config2, hooks = {}) {
+    this._threshold = config2.failureThreshold;
+    this._cooldown_ms = config2.cooldownMs;
+    this._hooks = hooks;
   }
-);
-var AutoclosePolicySchema = z.object({
-  after: AfterSchema.optional(),
-  is: IsSchema.optional(),
-  reaches: ReachesSchema.optional(),
-  or: OrBlockSchema.optional(),
-  keep: KeepSchema.optional()
-}).strict().refine(
-  (o) => o.after !== void 0 || o.is !== void 0 || o.reaches !== void 0 || o.or !== void 0 || o.keep !== void 0,
-  {
-    message: "autocloses: at least one of after / is / reaches / or / keep must be specified \u2014 empty `{}` is a misconfiguration"
+  /**
+   * True when the store has failed at least once since the last pass that
+   * went all the way through. The breaker can still read "closed" here: it
+   * only opens after several failures in a row, so this catches the first
+   * one, which `state()` cannot.
+   */
+  get failing() {
+    return this._failures > 0;
   }
-);
-function compile_after(after) {
-  return (_stream, head) => days_after(head.created, after.days) <= /* @__PURE__ */ new Date();
-}
-function compile_is(is) {
-  const set = new Set(typeof is === "string" ? [is] : is);
-  return (_stream, head) => set.has(head.name);
-}
-function compile_reaches(reaches) {
-  return (_stream, _head, count) => count >= reaches;
-}
-function policy_min_after_days(options) {
-  const parsed = AutoclosePolicySchema.parse(options);
-  const windows = [];
-  if (parsed.after) windows.push(parsed.after.days);
-  if (parsed.or?.after) windows.push(parsed.or.after.days);
-  return windows.length ? Math.min(...windows) : void 0;
-}
-function policy_keep_days(options) {
-  const parsed = AutoclosePolicySchema.parse(options);
-  return parsed.keep?.days;
-}
-function compile_autoclose_policy(options) {
-  const parsed = AutoclosePolicySchema.parse(options);
-  const and_preds = [];
-  if (parsed.after) and_preds.push(compile_after(parsed.after));
-  if (parsed.is) and_preds.push(compile_is(parsed.is));
-  if (parsed.reaches) and_preds.push(compile_reaches(parsed.reaches));
-  const or_preds = [];
-  if (parsed.or) {
-    if (parsed.or.after) or_preds.push(compile_after(parsed.or.after));
-    if (parsed.or.is) or_preds.push(compile_is(parsed.or.is));
-    if (parsed.or.reaches) or_preds.push(compile_reaches(parsed.or.reaches));
+  /** How long the store is left alone after a failure before a retry. */
+  get cooldown_ms() {
+    return this._cooldown_ms;
   }
-  return (stream, head, count) => {
-    if (and_preds.length > 0 && and_preds.every((p) => p(stream, head, count))) {
-      return true;
-    }
-    if (or_preds.some((p) => p(stream, head, count))) {
-      return true;
-    }
-    return false;
-  };
-}
-
-// src/internal/autoclose-window.ts
-function hour_in_zone(now, timeZone) {
-  const parts = new Intl.DateTimeFormat("en-US", {
-    timeZone,
-    hour: "2-digit",
-    hourCycle: "h23"
-  }).formatToParts(now);
-  return Number(parts.find((p) => p.type === "hour")?.value);
-}
-function hour_in_range(hour, start, end) {
-  return start < end ? hour >= start && hour < end : hour >= start || hour < end;
-}
-function is_dst_gap_open(now, timeZone, start) {
-  const hour = hour_in_zone(now, timeZone);
-  if (hour <= start) return false;
-  const prev = hour_in_zone(new Date(now.getTime() - 36e5), timeZone);
-  return prev === start - 1 && hour === start + 1;
-}
-function in_autoclose_window(window, now) {
-  if (!window) return true;
-  const hour = hour_in_zone(now, window.timeZone);
-  return hour_in_range(hour, window.start, window.end) || is_dst_gap_open(now, window.timeZone, window.start);
-}
-function next_window_open(window, now) {
-  const start_ms = now.getTime();
-  for (let h = 0; h <= 48; h++) {
-    const candidate = new Date(start_ms + h * 36e5);
-    if (hour_in_zone(candidate, window.timeZone) === window.start)
-      return candidate;
-    const boundary = new Date(
-      candidate.getTime() - candidate.getTime() % 36e5
-    );
-    if (boundary.getTime() >= start_ms && is_dst_gap_open(boundary, window.timeZone, window.start))
-      return boundary;
+  /** Current state given the wall-clock `now`. */
+  state(now) {
+    if (this._opened_at === void 0) return "closed";
+    return now - this._opened_at >= this._cooldown_ms ? "half-open" : "open";
+  }
+  /** A store op passed — reset to closed and cancel any pending retry. */
+  passed() {
+    this._failures = 0;
+    this._opened_at = void 0;
+    this._clear_wake();
   }
-  return new Date(start_ms + 864e5);
-}
-
-// src/internal/close-signal.ts
-var CloseSignal = class extends Error {
-  /**
-   * Stream to close. Omitted → the reaction's own lease stream (a self-close).
-   * The synthesized autoclose reaction sets it to the aggregate stream, since
-   * its lease runs on a synthetic `__autoclose__` target.
-   */
-  stream;
-  /** Optional archive callback to run while the stream is guarded. */
-  archive;
   /**
-   * Watermark to ack the requesting reaction to before the close runs. The
-   * close-cycle safety guard skips a stream whose subscriptions (matched by
-   * source) lag the head; the autoclose reaction's `source` is the aggregate,
-   * so it must advance its own watermark to the live head id it evaluated
-   * against — otherwise it blocks its own close. Defaults to the triggering
-   * event id when omitted.
+   * A store op failed. Opens the breaker when the consecutive-failure
+   * threshold is reached, or immediately re-opens (restarting the cooldown)
+   * if a half-open trial just failed. Returns the resulting state.
+   *
+   * Callers gate on the state directly — `state(now) === "open"` means skip.
+   * Every failure (re)schedules the `on_retry` wake, so one failed pass on
+   * an idle app retries without waiting for the breaker to open; always
+   * surfaces the failure via `on_error`.
    */
-  at;
+  failed(now, error) {
+    const circuit = this._advance(now);
+    this._schedule_wake();
+    this._hooks.on_error?.(error, circuit);
+    return circuit;
+  }
+  /** Cancel the pending retry timer. Idempotent; call on shutdown. */
+  stop() {
+    this._clear_wake();
+  }
   /**
-   * Windowed close: prune events older than this cutoff behind
-   * the closest safe snapshot instead of retiring the stream. Thrown by
-   * the autoclose reaction of a `.autocloses({ keep })` state; flows
-   * into {@link CloseTarget.before}. Omitted → a full close.
-   */
-  before;
-  constructor(opts) {
-    super("reaction requested close");
-    this.name = "CloseSignal";
-    this.stream = opts?.stream;
-    this.archive = opts?.archive;
-    this.at = opts?.at;
-    this.before = opts?.before;
-  }
-};
-
-// src/internal/config.ts
-import { z as z2 } from "zod";
-var BackoffOptionsSchema = z2.object({
-  strategy: z2.enum(["fixed", "linear", "exponential"]),
-  baseMs: z2.number().min(0),
-  maxMs: z2.number().gt(0).optional(),
-  jitter: z2.boolean().optional()
-});
-var DEFAULT_BACKOFF = {
-  strategy: "fixed",
-  baseMs: 1e4
-};
-var DEFAULT_MAX_RETRIES = 3;
-var DEFAULT_BLOCK_ON_ERROR = true;
-var ReactionOptionsSchema = z2.object({
-  blockOnError: z2.boolean(),
-  maxRetries: z2.number().int().min(0),
-  backoff: BackoffOptionsSchema.optional()
-});
-function resolveReactionConfig(options) {
-  return ReactionOptionsSchema.parse(options);
-}
-var ActionOptionsSchema = z2.object({
-  maxRetries: z2.number().int().min(0).optional(),
-  backoff: BackoffOptionsSchema.optional()
-});
-function resolveActionConfig(options) {
-  return ActionOptionsSchema.parse(options);
-}
-var LaneConfigSchema = z2.object({
-  name: z2.string().min(1),
-  leaseMillis: z2.number().min(0).optional(),
-  streamLimit: z2.number().int().min(0).optional(),
-  cycleMs: z2.number().min(0).optional()
-});
-function resolveLaneConfig(options) {
-  LaneConfigSchema.parse(options);
-  return options;
-}
-var DEFAULT_STREAM_LIMIT = 10;
-var DEFAULT_EVENT_LIMIT = 10;
-var DEFAULT_LEASE_MILLIS = 1e4;
-var DEFAULT_SETTLE_DEBOUNCE_MS = 10;
-var DEFAULT_MAX_SUBSCRIBED_STREAMS = 1e3;
-var DrainOptionsSchema = z2.object({
-  streamLimit: z2.number().int().min(0).optional(),
-  eventLimit: z2.number().int().min(0).optional(),
-  leaseMillis: z2.number().min(0).optional()
-});
-function resolveDrainConfig(options) {
-  if (options === void 0) return void 0;
-  DrainOptionsSchema.parse(options);
-  return options;
-}
-var SettleOptionsSchema = DrainOptionsSchema.extend({
-  debounceMs: z2.number().min(0).optional(),
-  // `maxPasses` defaults to Infinity (no cap) when omitted; a present value is
-  // a non-negative integer — `0` is legal and means "run no passes".
-  //
-  // `Infinity` is accepted explicitly. It is the documented default
-  // (`Act.settle`'s doc-comment and `SettleOptions.maxPasses` both name it),
-  // and `settle.ts` destructures `maxPasses = Infinity`, so the one value the
-  // docs advertise was the one value `z.number().int()` refused — Zod 4
-  // rejects `±Infinity`, and an integer check cannot pass it either. Wrapper
-  // code normalizing an optional cap (`maxPasses: opts.maxPasses ?? Infinity`)
-  // is the natural way to hit it. Accepting it also honors this module's own
-  // rule that a value which works today is never newly rejected.
-  maxPasses: z2.union([z2.number().int().min(0), z2.literal(Number.POSITIVE_INFINITY)]).optional()
-}).loose();
-function resolveSettleConfig(options) {
-  if (options === void 0) return void 0;
-  SettleOptionsSchema.parse(options);
-  return options;
-}
-var MAX_SHUTDOWN_GRACE_MS = 3e4;
-var ShutdownOptionsSchema = z2.object({
-  // `0` is legal and is exactly today's behavior: stop scheduling and
-  // return without waiting.
-  graceMs: z2.number().min(0).optional()
-}).loose();
-function resolveShutdownConfig(options) {
-  if (options === void 0) return void 0;
-  ShutdownOptionsSchema.parse(options);
-  return options;
-}
-var ActOptionsSchema = z2.object({
-  maxSubscribedStreams: z2.number().int().min(1).optional(),
-  settleDebounceMs: z2.number().int().min(0).optional()
-}).loose();
-function resolveActConfig(options) {
-  if (options === void 0) return void 0;
-  ActOptionsSchema.parse(options);
-  return options;
-}
-var DEFAULT_AUTOCLOSE_CYCLE_MINUTES = 720;
-var DEFAULT_CLOSE_BATCH_SIZE = 64;
-var DEFAULT_CLOSE_YIELD_MS = 0;
-var DEFAULT_AUTOCLOSE_WINDOW_TZ = "UTC";
-function is_valid_time_zone(tz) {
-  try {
-    new Intl.DateTimeFormat("en-US", { timeZone: tz });
-    return true;
-  } catch {
-    return false;
-  }
-}
-var AutocloseWindowSchema = z2.object({
-  start: z2.number().int().min(0).max(23, { message: "autocloseWindow.start must be an hour in [0, 23]" }),
-  end: z2.number().int().min(0).max(23, { message: "autocloseWindow.end must be an hour in [0, 23]" }),
-  timeZone: z2.string().refine(is_valid_time_zone, {
-    message: "autocloseWindow.timeZone must be a valid IANA time zone"
-  }).default(DEFAULT_AUTOCLOSE_WINDOW_TZ)
-}).refine((w) => w.start !== w.end, {
-  message: "autocloseWindow.start and end must differ \u2014 an empty window disables autoclose"
-});
-var AutocloseOptionsSchema = z2.object({
-  autocloseCycleMinutes: z2.number().int().min(1).max(1440).default(DEFAULT_AUTOCLOSE_CYCLE_MINUTES),
-  closeBatchSize: z2.number().int().min(1).max(1024).default(DEFAULT_CLOSE_BATCH_SIZE),
-  closeYieldMs: z2.number().min(0).max(1e3).default(DEFAULT_CLOSE_YIELD_MS),
-  closeOnError: z2.boolean().default(false),
-  autocloseWindow: AutocloseWindowSchema.optional()
-});
-function resolveAutocloseConfig(options) {
-  return AutocloseOptionsSchema.parse({
-    autocloseCycleMinutes: options?.autocloseCycleMinutes,
-    closeBatchSize: options?.closeBatchSize,
-    closeYieldMs: options?.closeYieldMs,
-    closeOnError: options?.closeOnError,
-    autocloseWindow: options?.autocloseWindow
-  });
-}
-var DEFAULT_CIRCUIT_FAILURE_THRESHOLD = 5;
-var DEFAULT_CIRCUIT_COOLDOWN_MS = 3e4;
-var CircuitBreakerOptionsSchema = z2.object({
-  failureThreshold: z2.number().int().min(1).default(DEFAULT_CIRCUIT_FAILURE_THRESHOLD),
-  cooldownMs: z2.number().int().min(100).max(36e5).default(DEFAULT_CIRCUIT_COOLDOWN_MS)
-});
-var resolveCircuitBreakerConfig = (options) => CircuitBreakerOptionsSchema.parse(options ?? {});
-var DEFAULT_FOLD_FLUSH_EVERY = 1e3;
-var DEFAULT_MAX_CACHED_STATES = 1e4;
-var FoldOptionsSchema = z2.object({
-  flushEvery: z2.number().int().min(1).default(DEFAULT_FOLD_FLUSH_EVERY),
-  maxCachedStates: z2.number().int().min(1).default(DEFAULT_MAX_CACHED_STATES)
-});
-function resolveFoldConfig(options) {
-  return FoldOptionsSchema.parse(options);
-}
-
-// src/internal/defer-signal.ts
-var DeferSignal = class extends Error {
-  /**
-   * The unresolved schedule. The dispatcher turns this into an absolute
-   * due-time by resolving it against the triggering event.
-   */
-  when;
-  constructor(when) {
-    super("reaction deferred");
-    this.name = "DeferSignal";
-    this.when = when;
-  }
-};
-
-// src/internal/autoclose-reaction.ts
-var AUTOCLOSE_TARGET_PREFIX = "__autoclose__:";
-function synthesize_autoclose_reactions(registry, states, read_window) {
-  for (const st of states.values()) {
-    const predicate = st.autoclose;
-    if (!predicate) continue;
-    const after_days = st.autoclose_after_days;
-    const keep_days = st.autoclose_keep_days;
-    const archiver = st.archive;
-    const reaction = {
-      // Run on a SYNTHETIC stream — `source` is the aggregate, `target` is a
-      // per-aggregate `__autoclose__` key — so the autoclose reaction never
-      // shares a watermark with the aggregate's own reactions. A shared
-      // watermark would let autoclose's defer short-circuit the aggregate's
-      // other reactions (the "a defer affects all reactions on a stream"
-      // hazard). The close still targets the aggregate (`source`).
-      resolver: (e) => ({
-        target: `${AUTOCLOSE_TARGET_PREFIX}${e.stream}`,
-        source: e.stream
-      }),
-      // Never block on autoclose: a transient query/store error should retry,
-      // not quarantine the synthetic stream.
-      options: { blockOnError: false, maxRetries: DEFAULT_MAX_RETRIES },
-      handler: async (event) => {
-        const aggregate = event.stream;
-        const window = read_window();
-        if (!in_autoclose_window(window, /* @__PURE__ */ new Date()))
-          throw new DeferSignal({ at: next_window_open(window, /* @__PURE__ */ new Date()) });
-        const stats = await store().query_stats([aggregate], {
-          count: true,
-          tail: keep_days !== void 0 ? true : void 0,
-          exclude: [TOMBSTONE_EVENT, SNAP_EVENT]
-        });
-        const entry = stats.get(aggregate);
-        if (!entry) return;
-        const head = entry.head;
-        if (predicate(aggregate, head, entry.count))
-          throw new CloseSignal({
-            stream: aggregate,
-            archive: archiver ? () => archiver(aggregate, head) : void 0,
-            // Ack this reaction's own watermark to the live head so the
-            // close-cycle guard (which matches subscriptions by source =
-            // aggregate) sees it caught up instead of blocking its own close.
-            at: head.id
-          });
-        if (keep_days !== void 0) {
-          const cutoff = days_before_now(keep_days);
-          if (entry.tail.created < cutoff)
-            throw new CloseSignal({
-              stream: aggregate,
-              before: cutoff,
-              archive: archiver ? () => archiver(aggregate, head, cutoff) : void 0,
-              at: head.id
-            });
-        }
-        const dues = [];
-        if (after_days !== void 0)
-          dues.push(days_after(head.created, after_days));
-        if (keep_days !== void 0)
-          dues.push(days_after(entry.tail.created, keep_days));
-        const future = dues.map((d) => d.getTime()).filter((t) => t > Date.now());
-        if (future.length)
-          throw new DeferSignal({ at: new Date(Math.min(...future)) });
-      }
-    };
-    const key = `__autoclose_${st.name}`;
-    for (const event_name of Object.keys(st.events)) {
-      registry.events[event_name]?.reactions.set(
-        key,
-        reaction
-      );
-    }
-  }
-}
-
-// src/internal/backoff.ts
-function compute_backoff_delay(retry, opts) {
-  if (!opts || opts.baseMs <= 0) return 0;
-  const r = Math.max(0, retry);
-  let delay;
-  switch (opts.strategy) {
-    case "fixed":
-      delay = opts.baseMs;
-      break;
-    case "linear":
-      delay = opts.baseMs * (r + 1);
-      break;
-    case "exponential":
-      delay = opts.baseMs * 2 ** r;
-      if (opts.maxMs !== void 0) delay = Math.min(delay, opts.maxMs);
-      break;
-    default: {
-      const _never = opts.strategy;
-      throw new Error(`unknown backoff strategy: ${String(_never)}`);
-    }
-  }
-  if (opts.jitter) delay = delay * (0.5 + Math.random());
-  return Math.max(0, Math.floor(delay));
-}
-
-// src/internal/circuit-breaker.ts
-var CircuitBreaker = class {
-  _failures = 0;
-  _opened_at;
-  _wake;
-  _threshold;
-  _cooldown_ms;
-  _hooks;
-  constructor(config2, hooks = {}) {
-    this._threshold = config2.failureThreshold;
-    this._cooldown_ms = config2.cooldownMs;
-    this._hooks = hooks;
-  }
-  /**
-   * True when the store has failed at least once since the last pass that
-   * went all the way through. The breaker can still read "closed" here: it
-   * only opens after several failures in a row, so this catches the first
-   * one, which `state()` cannot.
-   */
-  get failing() {
-    return this._failures > 0;
-  }
-  /** How long the store is left alone after a failure before a retry. */
-  get cooldown_ms() {
-    return this._cooldown_ms;
-  }
-  /** Current state given the wall-clock `now`. */
-  state(now) {
-    if (this._opened_at === void 0) return "closed";
-    return now - this._opened_at >= this._cooldown_ms ? "half-open" : "open";
-  }
-  /** A store op passed — reset to closed and cancel any pending retry. */
-  passed() {
-    this._failures = 0;
-    this._opened_at = void 0;
-    this._clear_wake();
-  }
-  /**
-   * A store op failed. Opens the breaker when the consecutive-failure
-   * threshold is reached, or immediately re-opens (restarting the cooldown)
-   * if a half-open trial just failed. Returns the resulting state.
-   *
-   * Callers gate on the state directly — `state(now) === "open"` means skip.
-   * Every failure (re)schedules the `on_retry` wake, so one failed pass on
-   * an idle app retries without waiting for the breaker to open; always
-   * surfaces the failure via `on_error`.
-   */
-  failed(now, error) {
-    const circuit = this._advance(now);
-    this._schedule_wake();
-    this._hooks.on_error?.(error, circuit);
-    return circuit;
-  }
-  /** Cancel the pending retry timer. Idempotent; call on shutdown. */
-  stop() {
-    this._clear_wake();
-  }
-  /**
-   * Schedule the `on_retry` wake `cooldownMs` out so the breaker re-trials
-   * the store on its own. No-op when no `on_retry` hook is wired (e.g. unit
-   * tests of the pure state machine). The timer is `unref`'d so it never
-   * keeps the process alive.
+   * Schedule the `on_retry` wake `cooldownMs` out so the breaker re-trials
+   * the store on its own. No-op when no `on_retry` hook is wired (e.g. unit
+   * tests of the pure state machine). The timer is `unref`'d so it never
+   * keeps the process alive.
    */
   _schedule_wake() {
     if (!this._hooks.on_retry) return;
@@ -1203,6 +744,55 @@ var CircuitBreaker = class {
   }
 };
 
+// src/internal/classify.ts
+var ALL_LANES = /* @__PURE__ */ Symbol("act-1103/all-lanes");
+function classify_registry(registry, states) {
+  const statics = /* @__PURE__ */ new Map();
+  const target_lanes = /* @__PURE__ */ new Map();
+  const event_to_lanes = /* @__PURE__ */ new Map();
+  for (const [name, register] of Object.entries(registry.events)) {
+    for (const reaction of register.reactions.values()) {
+      if (typeof reaction.resolver === "function") {
+        event_to_lanes.set(name, ALL_LANES);
+      } else {
+        const { target, source, priority = 0, lane } = reaction.resolver;
+        const lane_name = lane ?? "default";
+        const existing_lanes = event_to_lanes.get(name);
+        if (existing_lanes !== ALL_LANES) {
+          const set = existing_lanes ?? /* @__PURE__ */ new Set();
+          set.add(lane_name);
+          event_to_lanes.set(name, set);
+        }
+        const recorded_lane = target_lanes.get(target);
+        if (recorded_lane === void 0) {
+          target_lanes.set(target, lane_name);
+        } else if (recorded_lane !== lane_name) {
+          throw new Error(
+            `Stream "${target}" has conflicting lane assignments ("${recorded_lane}" vs "${lane_name}")`
+          );
+        }
+        const existing = statics.get(target);
+        if (!existing) {
+          statics.set(target, { stream: target, source, priority, lane });
+        } else if (priority > existing.priority) {
+          statics.set(target, { ...existing, priority });
+        }
+      }
+    }
+  }
+  const event_to_state = /* @__PURE__ */ new Map();
+  for (const merged of states.values()) {
+    for (const event_name of Object.keys(merged.events)) {
+      event_to_state.set(event_name, merged);
+    }
+  }
+  return {
+    static_targets: [...statics.values()],
+    event_to_state,
+    event_to_lanes
+  };
+}
+
 // src/internal/close-cycle.ts
 var CLOSE_CATCH_UP_LIMIT = 1e3;
 var CLOSE_CATCH_UP_PASSES = 20;
@@ -1862,7 +1452,7 @@ var CorrelateCycle = class {
   }
 };
 
-// src/internal/correlator.ts
+// src/internal/correlation-id.ts
 import { randomInt } from "crypto";
 var BASE = 36;
 var SEG_WIDTH = 4;
@@ -1886,111 +1476,34 @@ function close_correlation(correlator, actor) {
   });
 }
 
-// src/internal/date-reviver.ts
-import { z as z3 } from "zod";
-var def_of = (schema) => schema._zod?.def ?? schema.def;
-function variant_schema(schema) {
-  const shape = def_of(schema)?.shape;
-  if (!shape) {
-    const dates = date_reviver_schema(schema);
-    return { schema: dates ?? schema, dated: !!dates };
-  }
-  const next = {};
-  let dated = false;
-  for (const [key, field] of Object.entries(shape)) {
-    const dates = date_reviver_schema(field);
-    if (dates) dated = true;
-    next[key] = (dates ?? field).optional();
-  }
-  return { schema: z3.looseObject(next), dated };
-}
-function date_reviver_schema(schema) {
-  const def = def_of(schema);
-  if (!def) return void 0;
-  const inner = () => date_reviver_schema(def.innerType);
-  switch (def.type) {
-    case "date":
-      return z3.coerce.date();
-    case "object": {
-      const shape = def.shape;
-      if (!shape) return void 0;
-      const dated = {};
-      for (const [key, field] of Object.entries(shape)) {
-        const dates = date_reviver_schema(field);
-        if (dates) dated[key] = dates.optional();
-      }
-      return Object.keys(dated).length ? z3.looseObject(dated) : void 0;
-    }
-    case "array": {
-      const element = date_reviver_schema(def.element);
-      return element && z3.array(element);
-    }
-    case "tuple": {
-      const items = def.items.map((i) => date_reviver_schema(i));
-      return items.some(Boolean) ? z3.tuple(items.map((i) => i ?? z3.unknown())) : void 0;
-    }
-    case "record": {
-      const value = date_reviver_schema(def.valueType);
-      return value && z3.record(z3.string(), value);
-    }
-    case "union": {
-      const variants = def.options.map(variant_schema);
-      return variants.some((v) => v.dated) ? z3.union(variants.map((v) => v.schema)) : void 0;
+// src/internal/drain-cycle.ts
+import { randomUUID as randomUUID2 } from "crypto";
+
+// src/internal/backoff.ts
+function compute_backoff_delay(retry, opts) {
+  if (!opts || opts.baseMs <= 0) return 0;
+  const r = Math.max(0, retry);
+  let delay;
+  switch (opts.strategy) {
+    case "fixed":
+      delay = opts.baseMs;
+      break;
+    case "linear":
+      delay = opts.baseMs * (r + 1);
+      break;
+    case "exponential":
+      delay = opts.baseMs * 2 ** r;
+      if (opts.maxMs !== void 0) delay = Math.min(delay, opts.maxMs);
+      break;
+    default: {
+      const _never = opts.strategy;
+      throw new Error(`unknown backoff strategy: ${String(_never)}`);
     }
-    case "nullable":
-      return inner()?.nullable();
-    case "optional":
-    case "nonoptional":
-    case "readonly":
-    case "default":
-    case "prefault":
-    case "catch":
-      return inner();
-    default:
-      return void 0;
   }
+  if (opts.jitter) delay = delay * (0.5 + Math.random());
+  return Math.max(0, Math.floor(delay));
 }
 
-// src/internal/defer-config.ts
-import { z as z4 } from "zod";
-var DeferDurationSchema = z4.object({
-  days: z4.number().positive().optional(),
-  hours: z4.number().positive().optional(),
-  minutes: z4.number().positive().optional()
-}).strict().refine((d) => d.days != null || d.hours != null || d.minutes != null, {
-  message: "defer: a duration needs at least one of days, hours, or minutes"
-});
-var DeferWhenSchema = z4.object({
-  after: DeferDurationSchema.optional(),
-  at: z4.date().optional()
-}).strict().refine((w) => w.after === void 0 !== (w.at === void 0), {
-  message: "defer: specify exactly one of `after` or `at`"
-});
-function duration_ms(d) {
-  return (d.days ?? 0) * 864e5 + (d.hours ?? 0) * 36e5 + (d.minutes ?? 0) * 6e4;
-}
-function resolve_defer_at(when, event) {
-  const parsed = DeferWhenSchema.parse(when);
-  if (parsed.after) return event.created.getTime() + duration_ms(parsed.after);
-  return parsed.at.getTime();
-}
-function assert_defer_when(when) {
-  DeferWhenSchema.parse(when);
-}
-function make_deferred(handler, schedule) {
-  const call = handler;
-  const deferred = async (event, stream, app) => {
-    const when = typeof schedule === "function" ? schedule(event) : schedule;
-    if (Date.now() < resolve_defer_at(when, event)) throw new DeferSignal(when);
-    return call(event, stream, app);
-  };
-  Object.defineProperty(deferred, "name", { value: handler.name });
-  return deferred;
-}
-
-// src/internal/drain-cycle.ts
-import { randomUUID as randomUUID2 } from "crypto";
-
 // src/internal/defer-timer.ts
 var MAX_TIMER_DELAY_MS = 2147483647;
 var DeferTimer = class {
@@ -2084,7 +1597,7 @@ function compute_lag_lead_ratio(handled, lagging, leading) {
   return Math.max(RATIO_MIN, Math.min(RATIO_MAX, lagging_avg / total));
 }
 
-// src/internal/drain.ts
+// src/internal/drain-ops.ts
 var claim = (lagging, leading, by, millis, lane) => store().claim(lagging, leading, by, millis, lane);
 async function fetch(leased, eventLimit) {
   return Promise.all(
@@ -2968,6 +2481,54 @@ var DrainController = class {
   }
 };
 
+// src/internal/pii.ts
+function pii_split(emitted, fields) {
+  const data = { ...emitted.data };
+  const pii = {};
+  for (const f of fields) {
+    if (f in data) {
+      pii[f] = data[f];
+      delete data[f];
+    }
+  }
+  return { name: emitted.name, data, pii };
+}
+function pii_gate(event, fields, predicate, actor) {
+  const data = event.data;
+  const { pii, ...rest } = event;
+  if (pii == null) {
+    const shredded = { ...data };
+    for (const f of fields) shredded[f] = SHREDDED;
+    return { ...rest, data: shredded };
+  }
+  const allowed = !!actor && !!predicate && predicate(event, actor);
+  if (allowed) {
+    return {
+      ...rest,
+      data: { ...data, ...pii }
+    };
+  }
+  const redacted = { ...data };
+  for (const f of fields) redacted[f] = REDACTED;
+  return { ...rest, data: redacted };
+}
+var IDENTITY_GATE = (event) => event;
+function make_gate(fields, predicate) {
+  return (event, actor) => pii_gate(event, fields, predicate, actor);
+}
+function pii_strip(event, fields) {
+  const data = event.data;
+  const stripped = {};
+  for (const k of Object.keys(data)) {
+    if (!fields.includes(k)) stripped[k] = data[k];
+  }
+  const { pii: _drop_pii, ...rest } = event;
+  return {
+    ...rest,
+    data: stripped
+  };
+}
+
 // src/internal/projection-fold.ts
 var FOLD_RESET = /* @__PURE__ */ Symbol("act.fold.reset");
 function make_fold_handler(me, flush, config2, patch_fn = bare_patch, sensitive_fields) {
@@ -3055,108 +2616,78 @@ function make_fold_handler(me, flush, config2, patch_fn = bare_patch, sensitive_
   return handler;
 }
 
-// src/internal/settle.ts
-var SettleLoop = class {
-  _timer = void 0;
-  _running = false;
-  /**
-   * Resolves when the cycle in flight finishes, so shutdown can wait for
-   * it (`stop()` cancels scheduling only). Never rejects.
-   */
-  _inflight;
+// src/internal/defer-config.ts
+import { z } from "zod";
+var DeferDurationSchema = z.object({
+  days: z.number().positive().optional(),
+  hours: z.number().positive().optional(),
+  minutes: z.number().positive().optional()
+}).strict().refine((d) => d.days != null || d.hours != null || d.minutes != null, {
+  message: "defer: a duration needs at least one of days, hours, or minutes"
+});
+var DeferWhenSchema = z.object({
+  after: DeferDurationSchema.optional(),
+  at: z.date().optional()
+}).strict().refine((w) => w.after === void 0 !== (w.at === void 0), {
+  message: "defer: specify exactly one of `after` or `at`"
+});
+function duration_ms(d) {
+  return (d.days ?? 0) * 864e5 + (d.hours ?? 0) * 36e5 + (d.minutes ?? 0) * 6e4;
+}
+function resolve_defer_at(when, event) {
+  const parsed = DeferWhenSchema.parse(when);
+  if (parsed.after) return event.created.getTime() + duration_ms(parsed.after);
+  return parsed.at.getTime();
+}
+function assert_defer_when(when) {
+  DeferWhenSchema.parse(when);
+}
+function make_deferred(handler, schedule) {
+  const call = handler;
+  const deferred = async (event, stream, app) => {
+    const when = typeof schedule === "function" ? schedule(event) : schedule;
+    if (Date.now() < resolve_defer_at(when, event)) throw new DeferSignal(when);
+    return call(event, stream, app);
+  };
+  Object.defineProperty(deferred, "name", { value: handler.name });
+  return deferred;
+}
+
+// src/internal/reaction-dispatch.ts
+var CloseSignal = class extends Error {
   /**
-   * A wake-up that fired while a cycle was running. The running cycle's
-   * `finally` schedules one more pass with these options, so it isn't lost.
+   * Stream to close. Omitted → the reaction's own lease stream (a self-close).
+   * The synthesized autoclose reaction sets it to the aggregate stream, since
+   * its lease runs on a synthetic `__autoclose__` target.
    */
-  _pending = void 0;
-  _deps;
-  /** Debounce window applied when the caller doesn't override via `SettleOptions.debounceMs`. */
-  _default_debounce_ms;
-  constructor(deps, default_debounce_ms) {
-    this._deps = deps;
-    this._default_debounce_ms = default_debounce_ms;
-  }
+  stream;
+  /** Optional archive callback to run while the stream is guarded. */
+  archive;
   /**
-   * Schedule a settle pass. Multiple calls inside the debounce window
-   * coalesce into one cycle. The cycle runs correlate→drain in a loop
-   * until no progress is made (no new subscriptions, no events read, no
-   * streams leased)
-   * or `maxPasses` is reached, then emits the `"settled"` lifecycle event
-   * via {@link SettleDeps.on_settled}.
+   * Watermark to ack the requesting reaction to before the close runs. The
+   * close-cycle safety guard skips a stream whose subscriptions (matched by
+   * source) lag the head; the autoclose reaction's `source` is the aggregate,
+   * so it must advance its own watermark to the live head id it evaluated
+   * against — otherwise it blocks its own close. Defaults to the triggering
+   * event id when omitted.
    */
-  schedule(options = {}) {
-    const {
-      debounceMs = this._default_debounce_ms,
-      correlate: correlate_query = { after: -1, limit: 100 },
-      maxPasses = Infinity,
-      ...drain_options
-    } = options;
-    if (this._timer) clearTimeout(this._timer);
-    this._timer = setTimeout(() => {
-      this._timer = void 0;
-      if (this._running) {
-        this._pending = options;
-        return;
-      }
-      this._running = true;
-      let settle_done;
-      this._inflight = new Promise((done) => {
-        settle_done = done;
-      });
-      (async () => {
-        await this._deps.init();
-        let settled_drain;
-        for (let i = 0; i < maxPasses; i++) {
-          const after_before = this._deps.checkpoint();
-          const { subscribed, last_id, scanned } = await this._deps.correlate({
-            ...correlate_query,
-            after: after_before
-          });
-          if (scanned) this._deps.breaker.passed();
-          const drain = await this._deps.drain(drain_options);
-          settled_drain = settled_drain ? {
-            fetched: [...settled_drain.fetched, ...drain.fetched],
-            leased: [...settled_drain.leased, ...drain.leased],
-            acked: [...settled_drain.acked, ...drain.acked],
-            blocked: [...settled_drain.blocked, ...drain.blocked]
-          } : drain;
-          const made_progress = subscribed > 0 || drain.leased.length > 0 || last_id > after_before;
-          if (!made_progress) break;
-        }
-        if (settled_drain) this._deps.on_settled(settled_drain);
-      })().catch((err) => {
-        this._deps.breaker.failed(Date.now(), err);
-      }).finally(() => {
-        this._running = false;
-        this._inflight = void 0;
-        settle_done();
-        const pending = this._pending;
-        if (pending !== void 0) {
-          this._pending = void 0;
-          this.schedule(pending);
-        }
-      });
-    }, debounceMs);
-  }
+  at;
   /**
-   * The cycle currently in flight, or `undefined` when idle. A
-   * graceful shutdown awaits this alongside the drain controllers so a
-   * settle parked in `correlate` does not resume after teardown.
+   * Windowed close: prune events older than this cutoff behind
+   * the closest safe snapshot instead of retiring the stream. Thrown by
+   * the autoclose reaction of a `.autocloses({ keep })` state; flows
+   * into {@link CloseTarget.before}. Omitted → a full close.
    */
-  get inflight() {
-    return this._inflight;
-  }
-  /** Cancel any pending or active settle cycle. Idempotent. */
-  stop() {
-    this._pending = void 0;
-    if (this._timer) {
-      clearTimeout(this._timer);
-      this._timer = void 0;
-    }
+  before;
+  constructor(opts) {
+    super("reaction requested close");
+    this.name = "CloseSignal";
+    this.stream = opts?.stream;
+    this.archive = opts?.archive;
+    this.at = opts?.at;
+    this.before = opts?.before;
   }
 };
-
-// src/builders/reaction-builder.ts
 function build_handle(deps) {
   const { logger, reaction_scope } = deps;
   return async (lease, payloads) => {
@@ -3251,12 +2782,132 @@ function build_handle_batch(logger) {
   };
 }
 
-// src/act.ts
-function validate_only_lanes(options, lanes) {
-  if (!options.onlyLanes || options.onlyLanes.length === 0) return;
-  const declared = /* @__PURE__ */ new Set(["default", ...lanes.map((l) => l.name)]);
-  const unknown = options.onlyLanes.filter((l) => !declared.has(l));
-  if (unknown.length > 0)
+// src/internal/settle.ts
+var SettleLoop = class {
+  _timer = void 0;
+  _running = false;
+  /**
+   * Resolves when the cycle in flight finishes, so shutdown can wait for
+   * it (`stop()` cancels scheduling only). Never rejects.
+   */
+  _inflight;
+  /** A wake-up arrived while a cycle ran: run one more pass after it. */
+  _pending = false;
+  /** The last caller's options, used by the next pass. */
+  _next = void 0;
+  /** When the scheduled pass fires (epoch ms). */
+  _due = 0;
+  /** Set at shutdown: nothing schedules again. */
+  _stopped = false;
+  _deps;
+  /** Debounce window applied when the caller doesn't override via `SettleOptions.debounceMs`. */
+  _default_debounce_ms;
+  constructor(deps, default_debounce_ms) {
+    this._deps = deps;
+    this._default_debounce_ms = default_debounce_ms;
+  }
+  /**
+   * Schedule a settle pass. A pass already scheduled is never put off or
+   * replaced: calls that arrive before it runs join it (a shorter
+   * `debounceMs` brings it forward), and a call during a running cycle
+   * queues one more pass after it. Callers pass options, which the next
+   * pass uses; internal wake-ups pass none, so they never discard a
+   * caller's. The cycle runs correlate→drain in a
+   * loop until no progress is made (no new subscriptions, no events read,
+   * no streams leased) or `maxPasses` is reached, then emits the
+   * `"settled"` lifecycle event via {@link SettleDeps.on_settled}.
+   */
+  schedule(options) {
+    if (this._stopped) return;
+    if (options) this._next = options;
+    if (this._running) {
+      this._pending = true;
+      return;
+    }
+    const delay = options?.debounceMs ?? this._default_debounce_ms;
+    const due = Date.now() + delay;
+    if (this._timer) {
+      if (due >= this._due) return;
+      clearTimeout(this._timer);
+    }
+    this._due = due;
+    this._timer = setTimeout(() => {
+      this._timer = void 0;
+      const {
+        debounceMs: _,
+        correlate: correlate_query = {},
+        maxPasses = Infinity,
+        ...drain_options
+      } = this._next ?? {};
+      this._next = void 0;
+      this._running = true;
+      let settle_done;
+      this._inflight = new Promise((done) => {
+        settle_done = done;
+      });
+      (async () => {
+        await this._deps.init();
+        let settled_drain;
+        for (let i = 0; i < maxPasses; i++) {
+          const after_before = this._deps.checkpoint();
+          const { subscribed, last_id, scanned } = await this._deps.correlate({
+            ...correlate_query,
+            after: after_before
+          });
+          if (scanned) this._deps.breaker.passed();
+          const drain = await this._deps.drain(drain_options);
+          settled_drain = settled_drain ? {
+            fetched: [...settled_drain.fetched, ...drain.fetched],
+            leased: [...settled_drain.leased, ...drain.leased],
+            acked: [...settled_drain.acked, ...drain.acked],
+            blocked: [...settled_drain.blocked, ...drain.blocked]
+          } : drain;
+          const made_progress = subscribed > 0 || drain.leased.length > 0 || last_id > after_before;
+          if (!made_progress) break;
+        }
+        if (settled_drain) this._deps.on_settled(settled_drain);
+      })().catch((err) => {
+        this._deps.breaker.failed(Date.now(), err);
+      }).finally(() => {
+        this._running = false;
+        this._inflight = void 0;
+        settle_done();
+        if (this._pending) {
+          this._pending = false;
+          this.schedule(this._next);
+        }
+      });
+    }, delay);
+  }
+  /**
+   * The cycle currently in flight, or `undefined` when idle. A
+   * graceful shutdown awaits this alongside the drain controllers so a
+   * settle parked in `correlate` does not resume after teardown.
+   */
+  get inflight() {
+    return this._inflight;
+  }
+  /**
+   * Cancel any pending settle pass. Idempotent. `final` (shutdown) also
+   * stops all later scheduling.
+   */
+  stop(final = false) {
+    if (final) this._stopped = true;
+    this._pending = false;
+    this._next = void 0;
+    if (this._timer) {
+      clearTimeout(this._timer);
+      this._timer = void 0;
+    }
+  }
+};
+
+// src/act.ts
+function validate_only_lanes(options, lanes) {
+  if (!options.onlyLanes || options.onlyLanes.length === 0) return;
+  const declared = /* @__PURE__ */ new Set(["default", ...lanes.map((l) => l.name)]);
+  const unknown = options.onlyLanes.filter((l) => !declared.has(l));
+  if (unknown.length > 0)
     throw new Error(
       `ActOptions.onlyLanes references undeclared lane(s): ${unknown.map((l) => `"${l}"`).join(", ")}`
     );
@@ -3266,14 +2917,15 @@ var Act = class {
   _breaker;
   _listen;
   _drain;
+  _auto_settle;
   /** Whether any event has a reaction; nothing arms without one. */
   _reactive;
   _drain_controllers;
   _correlate;
   _settle;
   _poll;
-  /** The deprecated `start_correlations` callback, while the poll runs. */
-  _on_discovered;
+  /** The poll's correlate `limit`, used by every settle pass while it runs. */
+  _poll_limit;
   /**
    * Wired at construction against the store current then, so a store
    * injected after `build()` is never notified.
@@ -3402,6 +3054,7 @@ var Act = class {
     this._event_to_lanes = classification.event_to_lanes;
     this._listen = options.listen !== false;
     this._drain = options.drain !== false;
+    this._auto_settle = options.autoSettle !== false;
     this._breaker = this._build_breaker(options);
     this._drain_controllers = this._build_drain_controllers(options, lanes);
     this._advise_orphaned_lanes(options);
@@ -3419,9 +3072,7 @@ var Act = class {
         on_error: (error, circuit) => this._emit_error(error, circuit),
         // When the cooldown elapses, settle once: its scan or claim is the
         // half-open probe that closes or re-opens the breaker.
-        on_retry: () => {
-          this.settle({ debounceMs: 0 });
-        }
+        on_retry: () => this._schedule()
       }
     );
   }
@@ -3523,7 +3174,10 @@ var Act = class {
       {
         init: () => this._scoped(() => this._correlate.init()),
         checkpoint: () => this._correlate.checkpoint,
-        correlate: (q) => this._correlate_scanned(q, true),
+        correlate: (q) => this._correlate_scanned(
+          { ...q, limit: q.limit ?? this._poll_limit ?? 100 },
+          true
+        ),
         drain: (o) => this.drain(o),
         on_settled: (drain) => this.emit("settled", drain),
         breaker: this._breaker
@@ -3533,21 +3187,14 @@ var Act = class {
   }
   _shutdown_promise;
   /**
-   * Per-instance teardown: stop scheduling new work, give drain cycles
-   * already in flight a bounded chance to finish, then remove lifecycle
-   * listeners and tear down the cross-process notify subscription.
-   *
-   * Scheduling stops first, then in-flight cycles get up to `graceMs` to
-   * reach their `ack` (an abandoned handler holds its lease until it
-   * expires). Listeners come off after the wait, so they still see work that
-   * finished during it. The budget is a ceiling, not a delay; when it runs
-   * out, teardown proceeds anyway.
+   * Per-instance teardown: stops scheduling, gives the cycles in flight up
+   * to `graceMs` to reach their `ack` (an abandoned handler holds its lease
+   * until it expires), then removes listeners and the notify subscription.
+   * The budget is a ceiling, not a delay.
    *
-   * Idempotent — repeated calls return the same promise, and the first
-   * call's `graceMs` is the one that applies. Registered automatically with
-   * the global `dispose()` registry at construction, so process-wide
-   * `dispose()()` covers it; test helpers (or operators that mint
-   * short-lived Acts) call it explicitly for prompt cleanup.
+   * Idempotent: repeated calls return the same promise, with the first
+   * call's `graceMs`. Registered with the global `dispose()` registry, so
+   * `dispose()()` covers it; call it directly for prompt cleanup.
    *
    * @param options - See {@link ShutdownOptions}. Defaults the grace budget
    *   to the largest lane `leaseMillis` (capped at 30s).
@@ -3559,7 +3206,7 @@ var Act = class {
         this.stop_correlations();
         const disposer = await this._notify_disposer;
         if (disposer) await disposer();
-        this._settle.stop();
+        this._settle.stop(true);
         this._breaker.stop();
         for (const c of this._drain_controllers.values()) c.stop();
         await this._await_inflight(options?.graceMs);
@@ -3613,7 +3260,7 @@ var Act = class {
             const armed = this._arm_for_event_names(
               notification.events.map((e) => e.name)
             );
-            if (armed) this._settle.schedule({ debounceMs: 0 });
+            this._settle_armed(armed);
           }
         } catch (err) {
           this._logger.error(err, "notified handler threw");
@@ -3625,15 +3272,10 @@ var Act = class {
     }
   }
   /**
-   * Executes an action on a state instance, committing resulting events.
-   *
-   * This is the primary method for modifying state. It:
-   * 1. Validates the action payload against the schema
-   * 2. Loads the current state snapshot
-   * 3. Checks invariants (business rules)
-   * 4. Executes the action handler to generate events
-   * 5. Applies events to create new state
-   * 6. Commits events to the store with optimistic concurrency control
+   * Executes an action: validates the payload, loads the state, checks its
+   * invariants, and commits the events its handler emits, with optimistic
+   * concurrency on the stream. The reactions to those events settle on
+   * their own (unless `autoSettle: false`).
    *
    * @template TKey - Action name from registered actions
    * @param action - The name of the action to execute
@@ -3677,9 +3319,10 @@ var Act = class {
         payload,
         do_options
       );
-      this._arm_for_event_names(
+      const armed = this._arm_for_event_names(
         snapshots.map((s) => s.event.name)
       );
+      this._settle_armed(armed);
       this.emit("committed", snapshots);
       return snapshots;
     });
@@ -3711,9 +3354,7 @@ var Act = class {
    *
    * For small result sets, consider using {@link query_array} instead.
    *
-   * @param query - Filter criteria — see {@link Query} for available fields
-   *   (`stream`, `name`, `after`, `before`, `created_after`, `created_before`,
-   *   `limit`, `with_snaps`, `stream_exact`)
+   * @param query - Filter criteria; see {@link Query} for the fields
    * @param callback - Optional callback invoked for each matching event
    * @returns Object with first event, last event, and total count
    *
@@ -3797,31 +3438,23 @@ var Act = class {
     });
   }
   /**
-   * Processes pending reactions by draining uncommitted events from the event store.
+   * Runs one drain cycle: claims streams with marked work (leasing them),
+   * fetches their events, runs the matching reactions, and acks or blocks
+   * each stream.
    *
-   * Runs a single drain cycle:
-   * 1. Polls the store for streams with uncommitted events
-   * 2. Leases streams to prevent concurrent processing
-   * 3. Fetches events for each leased stream
-   * 4. Executes matching reaction handlers
-   * 5. Acknowledges successful reactions or blocks failing ones
-   *
-   * Drain uses a dual-frontier strategy to balance processing of new streams (lagging)
-   * vs active streams (leading). The ratio adapts based on event pressure.
-   *
-   * Call `correlate()` before `drain()`. It is not only how dynamic targets
-   * are discovered: a stream is claimable while `at < correlated_at`, and
-   * `correlate` is the only component that raises that mark, so a
-   * commit no correlate has seen is not drainable, static targets included. For a
-   * higher-level API that handles debouncing, correlation, and signaling
-   * automatically, use {@link settle}.
+   * A stream is claimable only once `correlate()` has marked it, static
+   * targets included, so a commit no correlate has seen is not drainable.
+   * Apps rarely call this: each commit settles its reactions on its own.
+   * With `autoSettle: false`, tests walk the pipeline with `correlate()`
+   * then `drain()` (see the testing guide).
    *
    * @param options - Drain configuration — see {@link DrainOptions} for fields
    *   (`streamLimit`, `eventLimit`, `leaseMillis`).
    * @returns Drain statistics with fetched, leased, acked, and blocked counts
    *
-   * @example In tests and scripts
+   * @example Walking the pipeline in a test
    * ```typescript
+   * const app = act().withState(User).withProjection(Users).build({ autoSettle: false });
    * await app.do("createUser", target, payload);
    * await app.correlate();
    * await app.drain();
@@ -3829,7 +3462,6 @@ var Act = class {
    *
    * @see {@link settle} for debounced correlate→drain with lifecycle events
    * @see {@link correlate} for dynamic stream discovery
-   * @see {@link start_correlations} for automatic correlation
    */
   async drain(options = {}) {
     resolveDrainConfig(options);
@@ -3842,6 +3474,18 @@ var Act = class {
     this._correlate.arm();
     for (const c of this._drain_controllers.values()) c.arm();
   }
+  /**
+   * Settles what a change armed (a commit, a reset, an unblock, a restore,
+   * a notification from another process), unless the app walks the
+   * pipeline itself (`autoSettle: false`).
+   */
+  _settle_armed(armed) {
+    if (armed && this._auto_settle) this._schedule();
+  }
+  /** Schedules a settle pass; writer-only instances (`drain: false`) skip it. */
+  _schedule(options) {
+    if (this._drain) this._settle.schedule(options);
+  }
   /** Arms only the lanes these events react on; true when any was armed. */
   _arm_for_event_names(names) {
     const to_arm = /* @__PURE__ */ new Set();
@@ -3884,32 +3528,20 @@ var Act = class {
     return { fetched, leased, acked, blocked };
   }
   /**
-   * Discovers and registers new streams dynamically based on reaction resolvers.
-   *
-   * Correlation enables "dynamic reactions" where target streams are determined at runtime
-   * based on event content. For example, you might create a stats stream for each user
-   * when they perform certain actions.
-   *
-   * This method scans events matching the query and identifies new target streams based
-   * on reaction resolvers. It then registers these streams so they'll be picked up by
-   * the next drain cycle.
+   * Scans committed events from the correlation checkpoint, subscribes the
+   * target streams their reactions resolve to (static or computed from
+   * the event), and marks their work so the next drain can claim it.
    *
    * @param query - Scan filter — see {@link Query} for fields (typically
-   *   `{ after: <event-id>, limit: <count> }`)
+   *   `{ limit: <count> }`; the scan starts at the checkpoint)
    * @returns The number of newly subscribed streams and the last scanned event id
    *
    * @example Manual correlation
    * ```typescript
-   * // Scan for new streams
-   * const { subscribed, last_id } = await app.correlate({ after: 0, limit: 100 });
-   * console.log(`Subscribed ${subscribed} new streams`);
-   *
-   * // Save last_id for next scan
-   * await saveCheckpoint(last_id);
+   * const { subscribed } = await app.correlate({ limit: 100 });
    * ```
    *
    * @see {@link start_correlations} for automatic periodic correlation
-   * @see {@link stop_correlations} to stop automatic correlation
    */
   async correlate(query = { after: -1, limit: 10 }) {
     const { subscribed, last_id } = await this._correlate_scanned(query);
@@ -3921,7 +3553,6 @@ var Act = class {
     return this._scoped(async () => {
       const { subscribed, last_id, marked, scanned } = await this._correlate.correlate(query, lease);
       if (subscribed > 0 || marked > 0) this._arm_all();
-      if (subscribed > 0) this._on_discovered?.(subscribed);
       return { subscribed, last_id, scanned };
     });
   }
@@ -3941,9 +3572,6 @@ var Act = class {
    *   reads (default 100). The scan always starts at the correlation
    *   checkpoint, so `after` is ignored.
    * @param frequency - Milliseconds between ticks (default: 10000)
-   * @param callback - Called with the number of newly subscribed streams
-   *   after each correlate pass that found some.
-   *   @deprecated Listen to the `"settled"` lifecycle event instead.
    * @returns `true` if the poll started, `false` if one is already running
    *
    * @example
@@ -3956,13 +3584,12 @@ var Act = class {
    * @see {@link settle} for what each tick runs
    * @see {@link stop_correlations} to stop the poll
    */
-  start_correlations(query = {}, frequency = 1e4, callback) {
+  start_correlations(query = {}, frequency = 1e4) {
     if (this._poll) return false;
-    this._on_discovered = callback;
-    const correlate = { limit: query.limit || 100 };
+    this._poll_limit = query.limit || void 0;
     this._poll = setInterval(() => {
       this._correlate.arm();
-      this.settle({ debounceMs: 0, correlate });
+      this._schedule();
     }, frequency);
     return true;
   }
@@ -3976,12 +3603,13 @@ var Act = class {
     if (this._poll) {
       clearInterval(this._poll);
       this._poll = void 0;
+      this._poll_limit = void 0;
     }
-    this._on_discovered = void 0;
     void this._scoped(() => this._correlate.release_correlation());
   }
   /**
-   * Cancels any pending or active settle cycle.
+   * Drops the settle pass scheduled but not yet started. A cycle already
+   * running finishes; later changes schedule new passes.
    *
    * @see {@link settle}
    */
@@ -3989,19 +3617,17 @@ var Act = class {
     this._settle.stop();
   }
   /**
-   * Reset reaction stream watermarks and request a drain on the next
-   * `drain()` / `settle()` cycle.
+   * Reset reaction stream watermarks and settle them, replaying their
+   * events through their reactions.
    *
    * Use this to replay events through projections (or other reaction targets)
-   * after changing handler logic. Equivalent to calling `store().reset(streams)`
-   * directly, but also raises the orchestrator's internal "needs drain" flag —
-   * `store().reset(...)` alone leaves the flag untouched, so a settled app
-   * would short-circuit and skip the replay.
-   *
-   * Pair with `app.settle()` (or a single `app.drain()` for small streams).
-   * `settle()` loops correlate→drain until no progress is made, so one call
-   * fully catches up paginated streams without forcing callers to roll
-   * their own loop.
+   * after changing handler logic. It rewinds the same watermarks as
+   * `store().reset(streams)`, and also wakes the drain and schedules a
+   * settle, which loops correlate→drain until the replay catches up;
+   * `store().reset(...)` alone leaves a settled app idle. Call
+   * `app.settle(options)` right after to give that pass batch options, or,
+   * with `autoSettle: false`, `correlate()` / `drain()` to drive the replay
+   * by hand.
    *
    * @param input - Reaction target streams (e.g., projection names) to reset, or a {@link StreamFilter} for bulk operations
    * @returns Count of streams that were actually reset
@@ -4009,7 +3635,7 @@ var Act = class {
    * @example Rebuild a projection (production)
    * ```typescript
    * await app.reset(["my-projection"]);
-   * app.settle({ eventLimit: 1000 });   // emits "settled" when fully replayed
+   * app.settle({ eventLimit: 1000 }); // optional: bigger batches; emits "settled"
    * ```
    *
    * @see {@link Store.reset} for the underlying store primitive
@@ -4020,7 +3646,10 @@ var Act = class {
       const count = await store().reset(input);
       for (const handler of this._batch_handlers.values())
         handler[FOLD_RESET]?.();
-      if (count > 0) this._arm_all();
+      if (count > 0) {
+        this._arm_all();
+        this._settle_armed(this._reactive);
+      }
       return count;
     });
   }
@@ -4033,11 +3662,9 @@ var Act = class {
    * {@link reset}, which rebuilds from event 0 (suitable for projection
    * rebuilds, wrong for "I fixed the bug, please retry").
    *
-   * Wraps `store().unblock(streams)` and raises the orchestrator's
-   * internal "needs drain" flag so a settled app picks up the now-free
-   * streams on the next cycle. Equivalent to calling `store().unblock(...)`
-   * directly, but `store().unblock(...)` alone leaves the flag
-   * untouched.
+   * Wraps `store().unblock(streams)` and settles the now-free streams on
+   * its own. `store().unblock(...)` alone leaves them waiting for the next
+   * commit.
    *
    * @param input - Stream names to unblock, or a {@link StreamFilter} for bulk recovery
    * @returns Count of streams that were actually flipped (were blocked)
@@ -4054,7 +3681,10 @@ var Act = class {
   async unblock(input) {
     return this._scoped(async () => {
       const count = await store().unblock(input);
-      if (count > 0) this._arm_all();
+      if (count > 0) {
+        this._arm_all();
+        this._settle_armed(this._reactive);
+      }
       return count;
     });
   }
@@ -4116,223 +3746,377 @@ var Act = class {
       if (!sink) {
         this._correlate.restart();
         this._arm_all();
+        this._settle_armed(this._reactive);
+      }
+      return { kept, migrated, dropped, duration_ms: Date.now() - started };
+    });
+  }
+  /**
+   * Return every currently-blocked stream position. Convenience wrapper
+   * around `store().query_streams(cb, { blocked: true })` for the common
+   * "show me what's broken" operational query.
+   *
+   * Results are ordered by stream name, paginated by `limit` (default
+   * 100). Pass `after` to fetch the next page (keyset cursor on the
+   * stream name). For richer queries — including blocked + source
+   * filters, or full unblocked introspection — drop to
+   * `store().query_streams(...)` directly.
+   *
+   * @returns Array of {@link StreamPosition} for currently-blocked streams.
+   *
+   * @example Discover and recover
+   * ```typescript
+   * const blocked = await app.blocked_streams();
+   * console.table(blocked.map(({ stream, retry, error }) => ({ stream, retry, error })));
+   *
+   * // Operator investigates, then bulk-unblocks the family:
+   * await app.unblock({ stream: "^webhooks-out-" });
+   * ```
+   */
+  async blocked_streams(options) {
+    return this._scoped(async () => {
+      const positions = [];
+      await store().query_streams(
+        (p) => {
+          positions.push(p);
+        },
+        { blocked: true, after: options?.after, limit: options?.limit }
+      );
+      return positions;
+    });
+  }
+  /**
+   * Operator-driven store audit: walks the store and yields findings per
+   * category, each with the remediation it suggests. Never run by the
+   * framework. Pass a subset of categories to scope the work; the iterable
+   * can be broken early, and findings stream without buffering the report.
+   *
+   * @param categories - Subset of categories to run (default: all).
+   * @param options - Query window + per-category thresholds.
+   * @returns Async iterable of {@link AuditFinding}.
+   *
+   * @example Schema drift since the last scan
+   * ```typescript
+   * for await (const f of app.audit(["schema"], { query: { created_after: lastScan } }))
+   *   await escalate(f);
+   * ```
+   */
+  async *audit(categories, options) {
+    const it = audit(this._audit_deps, categories, options)[Symbol.asyncIterator]();
+    while (true) {
+      const { value, done } = await this._scoped(() => it.next());
+      if (done) break;
+      yield value;
+    }
+  }
+  /**
+   * Sets the scheduling priority of every stream matching `filter`, as-is:
+   * unlike build-time priorities (the highest across reactions wins), this
+   * overrides them. Useful to let a long replay jump ahead of other lagging
+   * streams, or to yield slots back. **An empty filter (`{}`) updates every
+   * registered stream.**
+   *
+   * @param filter - Selection criteria (regex by default, like {@link query}).
+   * @param priority - New priority value. Set as-is — no clamp.
+   * @returns Count of streams whose priority changed.
+   *
+   * @example Boost a specific projection mid-replay
+   * ```typescript
+   * await app.prioritize({ stream: "^proj-orders$", stream_exact: false }, 10);
+   * ```
+   *
+   * @see {@link Store.prioritize} for the underlying primitive
+   */
+  async prioritize(filter, priority) {
+    return this._scoped(() => store().prioritize(filter, priority));
+  }
+  /** Shared by `close()` and reaction-requested closes. */
+  async _run_close(targets) {
+    const close_actor = { id: "$close", name: "close" };
+    const result = await run_close_cycle(targets, {
+      reactive: this._reactive,
+      catch_up_correlation: (until) => catch_up_correlation(
+        this._correlate,
+        (limit) => this.correlate({ limit }),
+        until
+      ),
+      event_to_state: this._event_to_state,
+      load: this._es.load,
+      tombstone: this._es.tombstone,
+      logger: this._logger,
+      correlation: close_correlation(this._correlator, close_actor),
+      with_stream_lock: (stream, work) => this._close_lock.run(stream, work),
+      forget_subscribed: (streams) => this._correlate.forget_subscribed(streams)
+    });
+    this.emit("closed", result);
+    return result;
+  }
+  /**
+   * Close the books: guard, archive, truncate, and optionally restart
+   * streams. A stream with pending reactions is skipped; an archive
+   * failure aborts the whole close while the streams are still guarded.
+   * Targets carrying `before` prune a rolling window instead and leave the
+   * stream live (needs `.snap(...)`). The phases and their failure
+   * semantics are in the close-cycle architecture page.
+   *
+   * @param targets - Per-stream close options (stream, restart?, archive?, before?)
+   * @returns `{ truncated: TruncateResult, skipped: string[] }`
+   *
+   * @example Archive and close
+   * ```typescript
+   * await app.close([
+   *   { stream: "order-123", archive: async () => { await archiveToS3("order-123"); } },
+   *   { stream: "order-456" },
+   * ]);
+   * ```
+   */
+  async close(targets) {
+    if (!targets.length) return { truncated: /* @__PURE__ */ new Map(), skipped: [] };
+    return this._scoped(() => this._run_close(targets));
+  }
+  /**
+   * Debounced, non-blocking correlate→drain cycle.
+   *
+   * A local change that frees reaction work (a commit, `reset()`,
+   * `unblock()`, `restore()`) schedules this on its own unless the app
+   * sets `autoSettle: false`. Call it at startup, to run what was pending
+   * before a restart, or with options for the next pass. A pass already
+   * scheduled is never put off: calls before it runs join it (a shorter
+   * `debounceMs` brings it forward), and a call during a running cycle
+   * queues one more pass after it. Runs correlate→drain in a loop until a pass makes no
+   * progress — no new subscriptions, no events read, no streams leased —
+   * then emits the `"settled"` lifecycle event, so one call fully catches
+   * up paginated streams without forcing callers to loop.
+   *
+   * @param options - Settle configuration — see {@link SettleOptions} for fields:
+   *   `debounceMs` (default 10), `correlate.limit` (default 100, or the
+   *   poll's limit while `start_correlations` runs; `after` is always the
+   *   checkpoint),
+   *   `maxPasses` (default `Infinity` — kill-switch for runaway loops),
+   *   `streamLimit` (default 10), `eventLimit` (default 10),
+   *   `leaseMillis` (default 10000).
+   *
+   * @example Startup
+   * ```typescript
+   * app.settle(); // run what was pending before the restart
+   *
+   * app.on("settled", (drain) => {
+   *   // notify SSE clients, invalidate caches, etc.
+   * });
+   * ```
+   *
+   * @see {@link drain} for single synchronous drain cycles
+   * @see {@link correlate} for manual correlation
+   */
+  settle(options) {
+    resolveSettleConfig(options ?? {});
+    this._schedule(options);
+  }
+};
+
+// src/internal/autoclose-policy.ts
+import { z as z2 } from "zod";
+var DAY_MS = 864e5;
+var MIN_AFTER_DAYS = 1 / 1440;
+var MIN_KEEP_DAYS = 1;
+function days_after(date, days) {
+  return new Date(date.getTime() + days * DAY_MS);
+}
+function days_before_now(days) {
+  return new Date(Date.now() - days * DAY_MS);
+}
+var window_schema = (field, min_days, floor) => z2.object({
+  days: z2.number({ message: `autocloses: ${field}.days must be a number` }).positive(`autocloses: ${field}.days must be > 0`)
+}).refine((o) => o.days >= min_days, {
+  message: `autocloses: ${field} resolves to < ${floor}, which is too short to be a meaningful retention window`
+});
+var AfterSchema = window_schema("after", MIN_AFTER_DAYS, "one minute");
+var KeepSchema = window_schema("keep", MIN_KEEP_DAYS, "one day");
+var IsSchema = z2.union([
+  z2.string().min(1, "autocloses: is must be a non-empty event name"),
+  z2.array(
+    z2.string().min(1, "autocloses: is entries must be non-empty event names")
+  ).min(1, "autocloses: is must include at least one event name").readonly()
+]);
+var ReachesSchema = z2.number({ message: "autocloses: reaches must be a number" }).int("autocloses: reaches must be an integer").min(1, "autocloses: reaches must be >= 1");
+var OrBlockSchema = z2.object({
+  after: AfterSchema.optional(),
+  is: IsSchema.optional(),
+  reaches: ReachesSchema.optional()
+}).strict().refine(
+  (o) => o.after !== void 0 || o.is !== void 0 || o.reaches !== void 0,
+  {
+    message: "autocloses: `or` block must include at least one of after / is / reaches"
+  }
+);
+var AutoclosePolicySchema = z2.object({
+  after: AfterSchema.optional(),
+  is: IsSchema.optional(),
+  reaches: ReachesSchema.optional(),
+  or: OrBlockSchema.optional(),
+  keep: KeepSchema.optional()
+}).strict().refine(
+  (o) => o.after !== void 0 || o.is !== void 0 || o.reaches !== void 0 || o.or !== void 0 || o.keep !== void 0,
+  {
+    message: "autocloses: at least one of after / is / reaches / or / keep must be specified \u2014 empty `{}` is a misconfiguration"
+  }
+);
+function compile_after(after) {
+  return (_stream, head) => days_after(head.created, after.days) <= /* @__PURE__ */ new Date();
+}
+function compile_is(is) {
+  const set = new Set(typeof is === "string" ? [is] : is);
+  return (_stream, head) => set.has(head.name);
+}
+function compile_reaches(reaches) {
+  return (_stream, _head, count) => count >= reaches;
+}
+function policy_min_after_days(options) {
+  const parsed = AutoclosePolicySchema.parse(options);
+  const windows = [];
+  if (parsed.after) windows.push(parsed.after.days);
+  if (parsed.or?.after) windows.push(parsed.or.after.days);
+  return windows.length ? Math.min(...windows) : void 0;
+}
+function policy_keep_days(options) {
+  const parsed = AutoclosePolicySchema.parse(options);
+  return parsed.keep?.days;
+}
+function compile_autoclose_policy(options) {
+  const parsed = AutoclosePolicySchema.parse(options);
+  const and_preds = [];
+  if (parsed.after) and_preds.push(compile_after(parsed.after));
+  if (parsed.is) and_preds.push(compile_is(parsed.is));
+  if (parsed.reaches) and_preds.push(compile_reaches(parsed.reaches));
+  const or_preds = [];
+  if (parsed.or) {
+    if (parsed.or.after) or_preds.push(compile_after(parsed.or.after));
+    if (parsed.or.is) or_preds.push(compile_is(parsed.or.is));
+    if (parsed.or.reaches) or_preds.push(compile_reaches(parsed.or.reaches));
+  }
+  return (stream, head, count) => {
+    if (and_preds.length > 0 && and_preds.every((p) => p(stream, head, count))) {
+      return true;
+    }
+    if (or_preds.some((p) => p(stream, head, count))) {
+      return true;
+    }
+    return false;
+  };
+}
+
+// src/internal/autoclose-window.ts
+function hour_in_zone(now, timeZone) {
+  const parts = new Intl.DateTimeFormat("en-US", {
+    timeZone,
+    hour: "2-digit",
+    hourCycle: "h23"
+  }).formatToParts(now);
+  return Number(parts.find((p) => p.type === "hour")?.value);
+}
+function hour_in_range(hour, start, end) {
+  return start < end ? hour >= start && hour < end : hour >= start || hour < end;
+}
+function is_dst_gap_open(now, timeZone, start) {
+  const hour = hour_in_zone(now, timeZone);
+  if (hour <= start) return false;
+  const prev = hour_in_zone(new Date(now.getTime() - 36e5), timeZone);
+  return prev === start - 1 && hour === start + 1;
+}
+function in_autoclose_window(window, now) {
+  if (!window) return true;
+  const hour = hour_in_zone(now, window.timeZone);
+  return hour_in_range(hour, window.start, window.end) || is_dst_gap_open(now, window.timeZone, window.start);
+}
+function next_window_open(window, now) {
+  const start_ms = now.getTime();
+  for (let h = 0; h <= 48; h++) {
+    const candidate = new Date(start_ms + h * 36e5);
+    if (hour_in_zone(candidate, window.timeZone) === window.start)
+      return candidate;
+    const boundary = new Date(
+      candidate.getTime() - candidate.getTime() % 36e5
+    );
+    if (boundary.getTime() >= start_ms && is_dst_gap_open(boundary, window.timeZone, window.start))
+      return boundary;
+  }
+  return new Date(start_ms + 864e5);
+}
+
+// src/internal/autoclose-reaction.ts
+var AUTOCLOSE_TARGET_PREFIX = "__autoclose__:";
+function synthesize_autoclose_reactions(registry, states, read_window) {
+  for (const st of states.values()) {
+    const predicate = st.autoclose;
+    if (!predicate) continue;
+    const after_days = st.autoclose_after_days;
+    const keep_days = st.autoclose_keep_days;
+    const archiver = st.archive;
+    const reaction = {
+      // Run on a SYNTHETIC stream — `source` is the aggregate, `target` is a
+      // per-aggregate `__autoclose__` key — so the autoclose reaction never
+      // shares a watermark with the aggregate's own reactions. A shared
+      // watermark would let autoclose's defer short-circuit the aggregate's
+      // other reactions (the "a defer affects all reactions on a stream"
+      // hazard). The close still targets the aggregate (`source`).
+      resolver: (e) => ({
+        target: `${AUTOCLOSE_TARGET_PREFIX}${e.stream}`,
+        source: e.stream
+      }),
+      // Never block on autoclose: a transient query/store error should retry,
+      // not quarantine the synthetic stream.
+      options: { blockOnError: false, maxRetries: DEFAULT_MAX_RETRIES },
+      handler: async (event) => {
+        const aggregate = event.stream;
+        const window = read_window();
+        if (!in_autoclose_window(window, /* @__PURE__ */ new Date()))
+          throw new DeferSignal({ at: next_window_open(window, /* @__PURE__ */ new Date()) });
+        const stats = await store().query_stats([aggregate], {
+          count: true,
+          tail: keep_days !== void 0 ? true : void 0,
+          exclude: [TOMBSTONE_EVENT, SNAP_EVENT]
+        });
+        const entry = stats.get(aggregate);
+        if (!entry) return;
+        const head = entry.head;
+        if (predicate(aggregate, head, entry.count))
+          throw new CloseSignal({
+            stream: aggregate,
+            archive: archiver ? () => archiver(aggregate, head) : void 0,
+            // Ack this reaction's own watermark to the live head so the
+            // close-cycle guard (which matches subscriptions by source =
+            // aggregate) sees it caught up instead of blocking its own close.
+            at: head.id
+          });
+        if (keep_days !== void 0) {
+          const cutoff = days_before_now(keep_days);
+          if (entry.tail.created < cutoff)
+            throw new CloseSignal({
+              stream: aggregate,
+              before: cutoff,
+              archive: archiver ? () => archiver(aggregate, head, cutoff) : void 0,
+              at: head.id
+            });
+        }
+        const dues = [];
+        if (after_days !== void 0)
+          dues.push(days_after(head.created, after_days));
+        if (keep_days !== void 0)
+          dues.push(days_after(entry.tail.created, keep_days));
+        const future = dues.map((d) => d.getTime()).filter((t) => t > Date.now());
+        if (future.length)
+          throw new DeferSignal({ at: new Date(Math.min(...future)) });
       }
-      return { kept, migrated, dropped, duration_ms: Date.now() - started };
-    });
-  }
-  /**
-   * Return every currently-blocked stream position. Convenience wrapper
-   * around `store().query_streams(cb, { blocked: true })` for the common
-   * "show me what's broken" operational query.
-   *
-   * Results are ordered by stream name, paginated by `limit` (default
-   * 100). Pass `after` to fetch the next page (keyset cursor on the
-   * stream name). For richer queries — including blocked + source
-   * filters, or full unblocked introspection — drop to
-   * `store().query_streams(...)` directly.
-   *
-   * @returns Array of {@link StreamPosition} for currently-blocked streams.
-   *
-   * @example Discover and recover
-   * ```typescript
-   * const blocked = await app.blocked_streams();
-   * console.table(blocked.map(({ stream, retry, error }) => ({ stream, retry, error })));
-   *
-   * // Operator investigates, then bulk-unblocks the family:
-   * await app.unblock({ stream: "^webhooks-out-" });
-   * ```
-   */
-  async blocked_streams(options) {
-    return this._scoped(async () => {
-      const positions = [];
-      await store().query_streams(
-        (p) => {
-          positions.push(p);
-        },
-        { blocked: true, after: options?.after, limit: options?.limit }
+    };
+    const key = `__autoclose_${st.name}`;
+    for (const event_name of Object.keys(st.events)) {
+      registry.events[event_name]?.reactions.set(
+        key,
+        reaction
       );
-      return positions;
-    });
-  }
-  /**
-   * Operator-driven store audit.
-   *
-   * Walks the connected store and yields per-category findings —
-   * each tagged with the remediation it suggests. Same operator-
-   * driven category as `app.close()` / `app.reset()` /
-   * `app.unblock()` / `app.blocked_streams()`: never auto-invoked by
-   * the framework; the operator decides when to run it (CI gate,
-   * scheduled job, ad-hoc forensics) and what to do with the
-   * findings.
-   *
-   * Categories are independent — pass a subset to scope the work,
-   * or omit to run everything:
-   *
-   * ```typescript
-   * // Targeted: schema drift + deprecated-event load only
-   * for await (const f of app.audit(["schema", "deprecated-load"], {
-   *   query: { created_after: lastScan },
-   *   thresholds: { deprecatedLoadShareMin: 0.10 },
-   * })) {
-   *   await escalate(f);
-   * }
-   *
-   * // Full audit, default thresholds
-   * for await (const f of app.audit()) console.log(f);
-   * ```
-   *
-   * Returns an `AsyncIterable` so callers can `break` early — the
-   * underlying store paginations respect the iterator protocol and
-   * stop cleanly. Each finding is emitted independently, so
-   * pipelining into Slack / persistence / further analysis works
-   * without buffering the full report in memory.
-   *
-   * Findings shape — see {@link AuditFinding}. The discriminated
-   * union carries enough context for the operator to act on each
-   * finding directly: stream id, event id, recommendation hints.
-   *
-   * @param categories - Subset of categories to run (default: all).
-   * @param options - Query window + per-category thresholds.
-   * @returns Async iterable of {@link AuditFinding}.
-   */
-  async *audit(categories, options) {
-    const it = audit(this._audit_deps, categories, options)[Symbol.asyncIterator]();
-    while (true) {
-      const { value, done } = await this._scoped(() => it.next());
-      if (done) break;
-      yield value;
     }
   }
-  /**
-   * Bulk-update scheduling priority for streams matching `filter`.
-   *
-   * Operator-grade override of the `claim()` lagging-frontier
-   * ordering. Useful when a long-running replay needs to
-   * jump ahead of other lagging streams, or when a no-longer-urgent
-   * job should yield slots back to the rest. Build-time priorities
-   * (set via the resolver's `priority` field) are subject to a
-   * `max()` invariant across reactions; this API ignores that and
-   * sets the priority outright on every matching row.
-   *
-   * Filter shape mirrors {@link query} / {@link Store.query_streams}:
-   * `stream` / `source` are regex by default, exact with the
-   * `*_exact` flags; `blocked` restricts to blocked or unblocked
-   * rows. **An empty filter (`{}`) updates every registered stream.**
-   *
-   * @param filter - Selection criteria (regex by default).
-   * @param priority - New priority value. Set as-is — no clamp.
-   * @returns Count of streams whose priority changed.
-   *
-   * @example Boost a specific projection mid-replay
-   * ```typescript
-   * await app.prioritize({ stream: "^proj-orders$", stream_exact: false }, 10);
-   * ```
-   *
-   * @see {@link Store.prioritize} for the underlying primitive
-   * @see {@link claim} for how priority biases scheduling
-   */
-  async prioritize(filter, priority) {
-    return this._scoped(() => store().prioritize(filter, priority));
-  }
-  /** Shared by `close()` and reaction-requested closes. */
-  async _run_close(targets) {
-    const close_actor = { id: "$close", name: "close" };
-    const result = await run_close_cycle(targets, {
-      reactive: this._reactive,
-      catch_up_correlation: (until) => catch_up_correlation(
-        this._correlate,
-        (limit) => this.correlate({ limit }),
-        until
-      ),
-      event_to_state: this._event_to_state,
-      load: this._es.load,
-      tombstone: this._es.tombstone,
-      logger: this._logger,
-      correlation: close_correlation(this._correlator, close_actor),
-      with_stream_lock: (stream, work) => this._close_lock.run(stream, work),
-      forget_subscribed: (streams) => this._correlate.forget_subscribed(streams)
-    });
-    this.emit("closed", result);
-    return result;
-  }
-  /**
-   * Close the books — guard, archive, truncate, and optionally restart streams.
-   *
-   * Safely removes historical events from the operational store:
-   *
-   * 1. **Correlate** — discover pending reaction targets
-   * 2. **Safety check** — skip streams with pending reactions (skipped when no reactive events)
-   * 3. **Guard** — commit `__tombstone__` with `expectedVersion` to block concurrent writes
-   * 4. **Load state** — for streams in `snapshots`, load final state while guarded (no races)
-   * 5. **Archive** — user callback per stream (abort-all on failure, streams are guarded)
-   * 6. **Truncate + seed** — atomic: delete all events, insert `__snapshot__` or `__tombstone__`
-   * 7. **Cache** — invalidate (tombstoned) or warm (restarted)
-   * 8. **Emit "closed"** — lifecycle event with results
-   *
-   * Targets carrying `before` take the **windowed** branch instead —
-   * close the books on a rolling window: probe the min consumer
-   * watermark (so the boundary never rises past a lagging reaction),
-   * run the archive callback against the cutoff, then prune the prefix
-   * below the closest safe `__snapshot__`. No tombstone guard (the
-   * pre-cutoff prefix is immutable), no seed, cache untouched — the
-   * stream stays live and keeps accepting actions. Requires the state
-   * to snapshot via `.snap(...)`; no qualifying snapshot ⇒ the stream
-   * lands in `skipped` (retry after the next snapshot). Windowed
-   * entries in the result echo `before` and carry the surviving
-   * boundary snapshot as `committed`.
-   *
-   * @param targets - Per-stream close options (stream, restart?, archive?, before?)
-   * @returns `{ truncated: TruncateResult, skipped: string[] }`
-   *
-   * @example Archive and close
-   * ```typescript
-   * await app.close([
-   *   { stream: "order-123", archive: async () => { await archiveToS3("order-123"); } },
-   *   { stream: "order-456" },
-   * ]);
-   * ```
-   */
-  async close(targets) {
-    if (!targets.length) return { truncated: /* @__PURE__ */ new Map(), skipped: [] };
-    return this._scoped(() => this._run_close(targets));
-  }
-  /**
-   * Debounced, non-blocking correlate→drain cycle.
-   *
-   * Call this after `app.do()` (or `app.reset()`) to schedule a background
-   * drain. Multiple rapid calls within the debounce window are coalesced
-   * into a single cycle. Runs correlate→drain in a loop until a pass makes
-   * no progress — no new subscriptions, no events read, no streams leased —
-   * then emits
-   * the `"settled"` lifecycle event. This means a single `settle()` call
-   * fully catches up paginated streams (e.g. after `reset()` on a long
-   * projection) without forcing callers to loop.
-   *
-   * @param options - Settle configuration — see {@link SettleOptions} for fields:
-   *   `debounceMs` (default 10), `correlate` (default `{ after: -1, limit: 100 }`),
-   *   `maxPasses` (default `Infinity` — kill-switch for runaway loops),
-   *   `streamLimit` (default 10), `eventLimit` (default 10),
-   *   `leaseMillis` (default 10000).
-   *
-   * @example API mutations
-   * ```typescript
-   * await app.do("CreateItem", target, input);
-   * app.settle(); // non-blocking, returns immediately
-   *
-   * app.on("settled", (drain) => {
-   *   // notify SSE clients, invalidate caches, etc.
-   * });
-   * ```
-   *
-   * @see {@link drain} for single synchronous drain cycles
-   * @see {@link correlate} for manual correlation
-   */
-  settle(options = {}) {
-    resolveSettleConfig(options);
-    if (!this._drain) return;
-    this._settle.schedule(options);
-  }
-};
+}
 
 // src/builders/merge.ts
 import { ZodObject } from "zod";
@@ -4571,7 +4355,74 @@ function reaction_on(event, events, builder) {
 }
 
 // src/builders/event-builder.ts
-import { z as z5 } from "zod";
+import { z as z4 } from "zod";
+
+// src/internal/date-reviver.ts
+import { z as z3 } from "zod";
+var def_of = (schema) => schema._zod?.def ?? schema.def;
+function variant_schema(schema) {
+  const shape = def_of(schema)?.shape;
+  if (!shape) {
+    const dates = date_reviver_schema(schema);
+    return { schema: dates ?? schema, dated: !!dates };
+  }
+  const next = {};
+  let dated = false;
+  for (const [key, field] of Object.entries(shape)) {
+    const dates = date_reviver_schema(field);
+    if (dates) dated = true;
+    next[key] = (dates ?? field).optional();
+  }
+  return { schema: z3.looseObject(next), dated };
+}
+function date_reviver_schema(schema) {
+  const def = def_of(schema);
+  if (!def) return void 0;
+  const inner = () => date_reviver_schema(def.innerType);
+  switch (def.type) {
+    case "date":
+      return z3.coerce.date();
+    case "object": {
+      const shape = def.shape;
+      if (!shape) return void 0;
+      const dated = {};
+      for (const [key, field] of Object.entries(shape)) {
+        const dates = date_reviver_schema(field);
+        if (dates) dated[key] = dates.optional();
+      }
+      return Object.keys(dated).length ? z3.looseObject(dated) : void 0;
+    }
+    case "array": {
+      const element = date_reviver_schema(def.element);
+      return element && z3.array(element);
+    }
+    case "tuple": {
+      const items = def.items.map((i) => date_reviver_schema(i));
+      return items.some(Boolean) ? z3.tuple(items.map((i) => i ?? z3.unknown())) : void 0;
+    }
+    case "record": {
+      const value = date_reviver_schema(def.valueType);
+      return value && z3.record(z3.string(), value);
+    }
+    case "union": {
+      const variants = def.options.map(variant_schema);
+      return variants.some((v) => v.dated) ? z3.union(variants.map((v) => v.schema)) : void 0;
+    }
+    case "nullable":
+      return inner()?.nullable();
+    case "optional":
+    case "nonoptional":
+    case "readonly":
+    case "default":
+    case "prefault":
+    case "catch":
+      return inner();
+    default:
+      return void 0;
+  }
+}
+
+// src/builders/event-builder.ts
 function event_tags(schema) {
   const pii = pii_schemas(schema);
   const pii_dates = {};
@@ -4588,7 +4439,7 @@ function event_tags(schema) {
   return {
     sensitive: Object.keys(pii),
     date_reviver: data_reviver_schema && revive(data_reviver_schema),
-    pii_date_reviver: dated_pii ? revive(z5.looseObject(pii_dates)) : void 0
+    pii_date_reviver: dated_pii ? revive(z4.looseObject(pii_dates)) : void 0
   };
 }
 function make_event_reader(tags, disclosure, predicate = null) {
@@ -5375,9 +5226,6 @@ export {
   ConcurrencyError,
   ConsoleLogger,
   CsvFile,
-  DEFAULT_AUTOCLOSE_CYCLE_MINUTES,
-  DEFAULT_CLOSE_BATCH_SIZE,
-  DEFAULT_CLOSE_YIELD_MS,
   DEFAULT_LANE,
   DEFAULT_MAX_SUBSCRIBED_STREAMS,
   DEFAULT_SETTLE_DEBOUNCE_MS,
@@ -5415,7 +5263,7 @@ export {
   pii_fields,
   port,
   projection,
-  resolveAutocloseConfig,
+  resolveAutocloseConfig2 as resolveAutocloseConfig,
   sensitive,
   sleep,
   slice,