@rotorsoft/act 1.37.7 → 2.0.0

package/dist/index.js

@@ -5,6 +5,7 @@ import {
   DEFAULT_EVENT_LIMIT,
   DEFAULT_LEASE_MILLIS,
   DEFAULT_MAX_RETRIES,
+  DEFAULT_QUERY_STREAMS_LIMIT,
   DEFAULT_STREAM_LIMIT,
   InMemoryCache,
   InMemoryStore,
@@ -12,6 +13,8 @@ import {
   MAX_SHUTDOWN_GRACE_MS,
   PackageSchema,
   cache,
+  check_appends,
+  check_store,
   config,
   current_autoclose_window,
   current_reacting,
@@ -20,6 +23,7 @@ import {
   dispose,
   disposeAndExit,
   extend,
+  fair_slots,
   is_literal_source,
   log,
   make_reaction_scope,
@@ -40,7 +44,7 @@ import {
   sleep,
   store,
   validate
-} from "./chunk-HXW3TPP6.js";
+} from "./chunk-MWHTNPUY.js";
 import {
   ActorSchema,
   CausationEventSchema,
@@ -54,7 +58,6 @@ import {
   Errors,
   EventMetaSchema,
   ExitCodes,
-  InvariantError,
   LogLevels,
   NonRetryableError,
   PreconditionError,
@@ -74,7 +77,7 @@ import {
   pii_fields,
   pii_schemas,
   sensitive
-} from "./chunk-V5ZB54DC.js";
+} from "./chunk-SNPEQW6Z.js";
 
 // src/signals.ts
 process.once("SIGINT", async (arg) => {
@@ -750,6 +753,7 @@ var CircuitBreaker = class {
 
 // src/internal/classify.ts
 var ALL_LANES = /* @__PURE__ */ Symbol("act/all-lanes");
+var describe_source = (source) => source === void 0 ? "no source (every stream)" : `"${source}"`;
 function classify_registry(registry, states) {
   const statics = /* @__PURE__ */ new Map();
   const target_lanes = /* @__PURE__ */ new Map();
@@ -776,6 +780,10 @@ function classify_registry(registry, states) {
           );
         }
         const existing = statics.get(target);
+        if (existing && existing.source !== source)
+          throw new Error(
+            `Target "${target}" has reactions on two sources, ${describe_source(existing.source)} and ${describe_source(source)}. A target reads one source, so the second would miss events or read too many. Give it its own target.`
+          );
         if (!existing) {
           statics.set(target, { stream: target, source, priority, lane });
         } else if (priority > existing.priority) {
@@ -797,674 +805,303 @@ function classify_registry(registry, states) {
   };
 }
 
-// src/internal/close-cycle.ts
-var CLOSE_CATCH_UP_LIMIT = 1e3;
-var CLOSE_CATCH_UP_PASSES = 20;
-async function catch_up_correlation(cursor, correlate, until) {
-  for (let pass = 0; pass < CLOSE_CATCH_UP_PASSES && cursor.checkpoint < until; pass++) {
-    const before = cursor.checkpoint;
-    cursor.arm();
-    await correlate(CLOSE_CATCH_UP_LIMIT);
-    if (cursor.checkpoint <= before) break;
-  }
-  return cursor.checkpoint;
+// src/internal/autoclose-policy.ts
+import { z } from "zod";
+var DAY_MS = 864e5;
+var MIN_AFTER_DAYS = 1 / 1440;
+var MIN_KEEP_DAYS = 1;
+function days_after(date, days) {
+  return new Date(date.getTime() + days * DAY_MS);
 }
-var CloseLock = class {
-  _tails = /* @__PURE__ */ new Map();
-  /** Run `work` after every earlier close of `stream` has settled. */
-  run(stream, work) {
-    const prev = this._tails.get(stream) ?? Promise.resolve();
-    const next = prev.then(work, work);
-    this._tails.set(stream, next);
-    const cleanup = () => {
-      if (this._tails.get(stream) === next) this._tails.delete(stream);
-    };
-    next.then(cleanup, cleanup);
-    return next;
+function days_before_now(days) {
+  return new Date(Date.now() - days * DAY_MS);
+}
+var window_schema = (field, min_days, floor) => z.object({
+  days: z.number({ message: `autocloses: ${field}.days must be a number` }).positive(`autocloses: ${field}.days must be > 0`)
+}).refine((o) => o.days >= min_days, {
+  message: `autocloses: ${field} resolves to < ${floor}, which is too short to be a meaningful retention window`
+});
+var AfterSchema = window_schema("after", MIN_AFTER_DAYS, "one minute");
+var KeepSchema = window_schema("keep", MIN_KEEP_DAYS, "one day");
+var IsSchema = z.union([
+  z.string().min(1, "autocloses: is must be a non-empty event name"),
+  z.array(
+    z.string().min(1, "autocloses: is entries must be non-empty event names")
+  ).min(1, "autocloses: is must include at least one event name").readonly()
+]);
+var ReachesSchema = z.number({ message: "autocloses: reaches must be a number" }).int("autocloses: reaches must be an integer").min(1, "autocloses: reaches must be >= 1");
+var OrBlockSchema = z.object({
+  after: AfterSchema.optional(),
+  is: IsSchema.optional(),
+  reaches: ReachesSchema.optional()
+}).strict().refine(
+  (o) => o.after !== void 0 || o.is !== void 0 || o.reaches !== void 0,
+  {
+    message: "autocloses: `or` block must include at least one of after / is / reaches"
   }
-};
-var SAFETY_PROBE_PAGE_SIZE = 1e3;
-async function run_close_cycle(targets, deps) {
-  const target_map = new Map(targets.map((t) => [t.stream, t]));
-  for (const t of target_map.values()) {
-    if (t.before !== void 0 && t.restart)
-      throw new Error(
-        `close: \`before\` and \`restart\` are mutually exclusive (stream "${t.stream}") \u2014 a windowed close keeps the stream live behind a real snapshot; restart reseeds it`
-      );
+);
+var AutoclosePolicySchema = z.object({
+  after: AfterSchema.optional(),
+  is: IsSchema.optional(),
+  reaches: ReachesSchema.optional(),
+  or: OrBlockSchema.optional(),
+  keep: KeepSchema.optional()
+}).strict().refine(
+  (o) => o.after !== void 0 || o.is !== void 0 || o.reaches !== void 0 || o.or !== void 0 || o.keep !== void 0,
+  {
+    message: "autocloses: at least one of after / is / reaches / or / keep must be specified \u2014 empty `{}` is a misconfiguration"
   }
-  const windowed = [...target_map.values()].filter(
-    (t) => t.before !== void 0
-  );
-  const full = [...target_map.values()].filter((t) => t.before === void 0);
-  const skipped = [];
-  const windowed_result = windowed.length ? await run_windowed_closes(windowed, deps, skipped) : /* @__PURE__ */ new Map();
-  if (!full.length) return { truncated: windowed_result, skipped };
-  const truncated = await with_stream_locks(
-    full.map((t) => t.stream),
-    deps,
-    () => run_full_closes(full, target_map, deps, skipped)
-  );
-  const retired = [...truncated.entries()].filter(([, r]) => r.committed.name === TOMBSTONE_EVENT).map(([stream]) => stream);
-  if (retired.length) deps.forget_subscribed?.(retired);
-  for (const [stream, entry] of windowed_result) truncated.set(stream, entry);
-  return { truncated, skipped };
+);
+function compile_after(after) {
+  return (_stream, head) => days_after(head.created, after.days) <= /* @__PURE__ */ new Date();
 }
-function with_stream_locks(streams, deps, work) {
-  const with_lock = deps.with_stream_lock ?? ((_stream, w) => w());
-  return [...streams].sort().reduceRight(
-    (inner, stream) => () => with_lock(stream, inner),
-    work
-  )();
+function compile_is(is) {
+  const set = new Set(typeof is === "string" ? [is] : is);
+  return (_stream, head) => set.has(head.name);
 }
-async function run_full_closes(full, target_map, deps, skipped) {
-  const none = /* @__PURE__ */ new Map();
-  const streams = full.map((t) => t.stream);
-  const stream_info = await scan_stream_heads(streams);
-  for (const target of full) {
-    if (!target.restart) continue;
-    const info = stream_info.get(target.stream);
-    if (!info) continue;
-    const owner = deps.event_to_state.get(info.last_event_name);
-    if (owner?.pii_aware) {
-      deps.logger.error(
-        `Refusing to close "${target.stream}" with restart: state "${owner.name}" carries sensitive fields, so a restart seed would persist redacted values while deleting the originals. Close it without restart to retire the stream, or leave it open.`
-      );
-      skipped.push(target.stream);
-      stream_info.delete(target.stream);
-    }
-  }
-  const safe = await partition_by_safety(
-    stream_info,
-    deps.reactive,
-    skipped,
-    deps.probe_page_size ?? SAFETY_PROBE_PAGE_SIZE,
-    deps.catch_up_correlation
-  );
-  if (!safe.length) return none;
-  const { guarded, guard_events } = await guard_with_tombstones(
-    safe,
-    stream_info,
-    deps.correlation,
-    deps.tombstone,
-    skipped
-  );
-  if (!guarded.length) return none;
-  const seed_states = await load_restart_seeds(
-    guarded,
-    target_map,
-    stream_info,
-    deps.event_to_state,
-    deps.load,
-    deps.logger
-  );
-  await run_archive_callbacks(guarded, target_map);
-  const still_guarded = await heads_still_guarded(
-    guarded,
-    guard_events,
-    skipped
-  );
-  if (!still_guarded.length) return none;
-  return truncate_and_warm_cache(
-    still_guarded,
-    seed_states,
-    guard_events,
-    deps.correlation
-  );
+function compile_reaches(reaches) {
+  return (_stream, _head, count) => count >= reaches;
 }
-async function run_windowed_closes(windowed, deps, skipped) {
-  const checkpoint = deps.reactive ? await deps.catch_up_correlation(Number.MAX_SAFE_INTEGER) : -1;
-  const min_at = deps.reactive ? await probe_min_watermarks(
-    windowed.map((t) => t.stream),
-    deps.probe_page_size ?? SAFETY_PROBE_PAGE_SIZE,
-    checkpoint
-  ) : /* @__PURE__ */ new Map();
-  const with_lock = deps.with_stream_lock ?? ((_stream, work) => work());
-  const truncated = /* @__PURE__ */ new Map();
-  for (const t of windowed) {
-    const entry = await with_lock(t.stream, async () => {
-      const max_id = min_at.get(t.stream);
-      if (!await windowed_prune_pending(t.stream, t.before, max_id))
-        return void 0;
-      if (t.archive) await t.archive();
-      const result = await store().truncate([
-        { stream: t.stream, before: t.before, max_id }
-      ]);
-      return result.get(t.stream);
-    });
-    if (entry) truncated.set(t.stream, entry);
-    else skipped.push(t.stream);
-  }
-  return truncated;
+function policy_min_after_days(options) {
+  const parsed = AutoclosePolicySchema.parse(options);
+  const windows = [];
+  if (parsed.after) windows.push(parsed.after.days);
+  if (parsed.or?.after) windows.push(parsed.or.after.days);
+  return windows.length ? Math.min(...windows) : void 0;
 }
-async function windowed_prune_pending(stream, before, max_id) {
-  let boundary_id;
-  let min_id;
-  await store().query(
-    (event) => {
-      if (min_id === void 0 || event.id < min_id) min_id = event.id;
-      if (event.name === SNAP_EVENT && event.created < before && (max_id === void 0 || event.id <= max_id) && (boundary_id === void 0 || event.id > boundary_id))
-        boundary_id = event.id;
-    },
-    { stream, stream_exact: true, with_snaps: true, after: -1 }
-  );
-  return boundary_id !== void 0 && min_id < boundary_id;
+function policy_after_windows(options) {
+  const parsed = AutoclosePolicySchema.parse(options);
+  return [parsed.after, parsed.or?.after].flatMap((w) => w ? [w.days] : []);
 }
-async function probe_min_watermarks(streams, page_size, checkpoint) {
-  const min_at = /* @__PURE__ */ new Map();
-  const matches = source_matcher();
-  await walk_streams(
-    store(),
-    (position) => {
-      const pending = position.correlated_at === void 0 || position.at < position.correlated_at;
-      const cap = pending ? position.at : Math.max(position.at, checkpoint);
-      for (const stream of streams) {
-        if (matches(position.source, stream)) {
-          const prev = min_at.get(stream);
-          if (prev === void 0 || cap < prev) min_at.set(stream, cap);
-        }
-      }
-    },
-    { limit: page_size, source_matches: streams }
-  );
-  return min_at;
+function policy_keep_days(options) {
+  const parsed = AutoclosePolicySchema.parse(options);
+  return parsed.keep?.days;
 }
-function source_matcher() {
-  const compiled = /* @__PURE__ */ new Map();
-  return (source, stream) => {
-    if (!source) return true;
-    let re = compiled.get(source);
-    if (!re) {
-      re = new RegExp(source);
-      compiled.set(source, re);
+function compile_autoclose_policy(options) {
+  const parsed = AutoclosePolicySchema.parse(options);
+  const and_preds = [];
+  if (parsed.after) and_preds.push(compile_after(parsed.after));
+  if (parsed.is) and_preds.push(compile_is(parsed.is));
+  if (parsed.reaches) and_preds.push(compile_reaches(parsed.reaches));
+  const or_preds = [];
+  if (parsed.or) {
+    if (parsed.or.after) or_preds.push(compile_after(parsed.or.after));
+    if (parsed.or.is) or_preds.push(compile_is(parsed.or.is));
+    if (parsed.or.reaches) or_preds.push(compile_reaches(parsed.or.reaches));
+  }
+  return (stream, head, count) => {
+    if (and_preds.length > 0 && and_preds.every((p) => p(stream, head, count))) {
+      return true;
     }
-    return re.test(stream);
+    if (or_preds.some((p) => p(stream, head, count))) {
+      return true;
+    }
+    return false;
   };
 }
-async function scan_stream_heads(streams) {
-  const stats = await store().query_stats(streams, {
-    exclude: [SNAP_EVENT]
-  });
-  const domain_heads = await store().query_stats(streams, {
-    exclude: [SNAP_EVENT, TOMBSTONE_EVENT]
-  });
-  const true_heads = await store().query_stats(streams, {});
-  const out = /* @__PURE__ */ new Map();
-  for (const [stream, { head }] of domain_heads) {
-    const marker_head = stats.get(stream)?.head;
-    const interrupted = marker_head?.name === TOMBSTONE_EVENT;
-    out.set(stream, {
-      max_id: head.id,
-      version: true_heads.get(stream).head.version,
-      last_event_name: head.name,
-      ...interrupted ? { resumed_guard: { id: marker_head.id } } : {}
-    });
-  }
-  return out;
+
+// src/internal/autoclose-window.ts
+function hour_in_zone(now, timeZone) {
+  const parts = new Intl.DateTimeFormat("en-US", {
+    timeZone,
+    hour: "2-digit",
+    hourCycle: "h23"
+  }).formatToParts(now);
+  return Number(parts.find((p) => p.type === "hour")?.value);
 }
-async function partition_by_safety(stream_info, reactive, skipped, page_size, catch_up_correlation2) {
-  if (!reactive) return [...stream_info.keys()];
-  let needed = -1;
-  for (const info of stream_info.values())
-    needed = Math.max(needed, info.max_id);
-  const checkpoint = await catch_up_correlation2(needed);
-  const uncorrelated = /* @__PURE__ */ new Set();
-  for (const [stream, info] of stream_info) {
-    if (checkpoint < info.max_id) uncorrelated.add(stream);
-  }
-  const pending_set = /* @__PURE__ */ new Set();
-  const matches = source_matcher();
-  const targets = [...stream_info.keys()];
-  await walk_streams(
-    store(),
-    (position) => {
-      const has_work = position.correlated_at !== void 0 && position.at < position.correlated_at;
-      if (!has_work) return;
-      for (const [stream, info] of stream_info) {
-        if (matches(position.source, stream) && position.at < info.max_id)
-          pending_set.add(stream);
-      }
-    },
-    { limit: page_size, source_matches: targets }
-  );
-  const safe = [];
-  for (const [stream] of stream_info) {
-    if (pending_set.has(stream) || uncorrelated.has(stream))
-      skipped.push(stream);
-    else safe.push(stream);
-  }
-  return safe;
+function hour_in_range(hour, start, end) {
+  return start < end ? hour >= start && hour < end : hour >= start || hour < end;
 }
-async function guard_with_tombstones(safe, stream_info, correlation, tombstone2, skipped) {
-  const guarded = [];
-  const guard_events = /* @__PURE__ */ new Map();
-  await Promise.all(
-    safe.map(async (stream) => {
-      const info = stream_info.get(stream);
-      if (info.resumed_guard) {
-        guarded.push(stream);
-        guard_events.set(stream, { id: info.resumed_guard.id, stream });
-        return;
-      }
-      const committed = await tombstone2(stream, info.version, correlation);
-      if (committed) {
-        guarded.push(stream);
-        guard_events.set(stream, { id: committed.id, stream });
-      } else {
-        skipped.push(stream);
-      }
-    })
-  );
-  return { guarded, guard_events };
+function is_dst_gap_open(now, timeZone, start) {
+  const hour = hour_in_zone(now, timeZone);
+  if (hour <= start) return false;
+  const prev = hour_in_zone(new Date(now.getTime() - 36e5), timeZone);
+  return prev === start - 1 && hour === start + 1;
 }
-async function load_restart_seeds(guarded, target_map, stream_info, event_to_state, load2, logger) {
-  const seed_states = /* @__PURE__ */ new Map();
-  await Promise.all(
-    guarded.filter((s) => target_map.get(s)?.restart).map(async (stream) => {
-      const last_event_name = stream_info.get(stream).last_event_name;
-      const owner_state = event_to_state.get(last_event_name);
-      if (!owner_state) {
-        logger.error(
-          `Cannot seed restart for "${stream}": no registered state owns event "${last_event_name}". Stream will be tombstoned instead.`
-        );
-        return;
-      }
-      const snap2 = await load2(owner_state, { stream });
-      seed_states.set(stream, snap2.state);
-    })
-  );
-  return seed_states;
+function in_autoclose_window(window, now) {
+  if (!window) return true;
+  const hour = hour_in_zone(now, window.timeZone);
+  return hour_in_range(hour, window.start, window.end) || is_dst_gap_open(now, window.timeZone, window.start);
 }
-async function run_archive_callbacks(guarded, target_map) {
-  for (const stream of guarded) {
-    const archive_fn = target_map.get(stream)?.archive;
-    if (archive_fn) await archive_fn();
+function next_window_open(window, now) {
+  const start_ms = now.getTime();
+  for (let h = 0; h <= 48; h++) {
+    const candidate = new Date(start_ms + h * 36e5);
+    if (hour_in_zone(candidate, window.timeZone) === window.start)
+      return candidate;
+    const boundary = new Date(
+      candidate.getTime() - candidate.getTime() % 36e5
+    );
+    if (boundary.getTime() >= start_ms && is_dst_gap_open(boundary, window.timeZone, window.start))
+      return boundary;
   }
+  return new Date(start_ms + 864e5);
 }
-async function heads_still_guarded(guarded, guard_events, skipped) {
-  const heads = await store().query_stats(guarded, {});
-  return guarded.filter((stream) => {
-    if (heads.get(stream)?.head.id === guard_events.get(stream).id)
-      return true;
-    skipped.push(stream);
-    return false;
-  });
+
+// src/internal/defer-config.ts
+import { z as z2 } from "zod";
+var DeferDurationSchema = z2.object({
+  days: z2.number().positive().optional(),
+  hours: z2.number().positive().optional(),
+  minutes: z2.number().positive().optional()
+}).strict().refine((d) => d.days != null || d.hours != null || d.minutes != null, {
+  message: "defer: a duration needs at least one of days, hours, or minutes"
+});
+var DeferWhenSchema = z2.object({
+  after: DeferDurationSchema.optional(),
+  at: z2.date().optional()
+}).strict().refine((w) => w.after === void 0 !== (w.at === void 0), {
+  message: "defer: specify exactly one of `after` or `at`"
+});
+function duration_ms(d) {
+  return (d.days ?? 0) * 864e5 + (d.hours ?? 0) * 36e5 + (d.minutes ?? 0) * 6e4;
 }
-async function truncate_and_warm_cache(guarded, seed_states, guard_events, correlation) {
-  const trunc_targets = guarded.map((stream) => {
-    const snapshot = seed_states.get(stream);
-    const guard = guard_events.get(stream);
-    return {
-      stream,
-      snapshot,
-      meta: {
-        correlation,
-        causation: {
-          event: { id: guard.id, name: TOMBSTONE_EVENT, stream: guard.stream }
-        }
-      }
-    };
-  });
-  const truncated = await store().truncate(trunc_targets);
-  await Promise.all(
-    guarded.map(async (stream) => {
-      const entry = truncated.get(stream);
-      const state2 = seed_states.get(stream);
-      if (state2 && entry) {
-        await cache().set(stream, {
-          stream,
-          state: state2,
-          version: entry.committed.version,
-          event_id: entry.committed.id,
-          patches: 0,
-          snaps: 1
-        });
-      } else {
-        await cache().invalidate(stream);
-      }
-    })
-  );
-  return truncated;
+function resolve_defer_at(when, event) {
+  const parsed = DeferWhenSchema.parse(when);
+  if (parsed.after) return event.created.getTime() + duration_ms(parsed.after);
+  return parsed.at.getTime();
+}
+function assert_defer_when(when) {
+  DeferWhenSchema.parse(when);
+}
+function make_deferred(handler, schedule) {
+  const call = handler;
+  const deferred = async (event, stream, app) => {
+    const when = typeof schedule === "function" ? schedule(event) : schedule;
+    if (Date.now() < resolve_defer_at(when, event)) throw new DeferSignal(when);
+    return call(event, stream, app);
+  };
+  Object.defineProperty(deferred, "name", { value: handler.name });
+  return deferred;
 }
 
-// src/internal/correlate-cycle.ts
-import { createHash, randomUUID } from "crypto";
+// src/internal/drain-cycle.ts
+import { randomUUID } from "crypto";
 
-// src/internal/report-once.ts
-function report_once(seen, key, message) {
-  if (seen.has(key)) return;
-  seen.add(key);
-  log().error(new Error(message));
+// src/internal/backoff.ts
+function compute_backoff_delay(retry, opts) {
+  if (!opts || opts.baseMs <= 0) return 0;
+  const r = Math.max(0, retry);
+  let delay;
+  switch (opts.strategy) {
+    case "fixed":
+      delay = opts.baseMs;
+      break;
+    case "linear":
+      delay = opts.baseMs * (r + 1);
+      break;
+    case "exponential":
+      delay = opts.baseMs * 2 ** r;
+      if (opts.maxMs !== void 0) delay = Math.min(delay, opts.maxMs);
+      break;
+    default: {
+      const _never = opts.strategy;
+      throw new Error(`unknown backoff strategy: ${String(_never)}`);
+    }
+  }
+  if (opts.jitter) delay = delay * (0.5 + Math.random());
+  return Math.max(0, Math.floor(delay));
 }
 
-// src/internal/correlate-cycle.ts
-var COLD_START_BACK_SCAN = 1e4;
-var CORRELATION_LEASE_MS = 5e3;
-var registry_key = (events) => {
-  const shape = Object.keys(events).filter((name) => events[name].reactions.size > 0).sort().map((name) => [name, [...events[name].reactions.keys()].sort()]);
-  return createHash("sha256").update(JSON.stringify(shape)).digest("hex").slice(0, 32);
-};
-var PATTERN_CACHE_SIZE = 32;
-function report_undeclared_lane(seen, handler, target, lane, declared) {
-  report_once(
-    seen,
-    `lane|${handler}|${lane}`,
-    `Reaction "${handler}" resolved onto undeclared lane "${lane}" \u2014 for example target "${target}". Declared lanes: ${[...declared].map((l) => `"${l}"`).join(", ")}. No controller claims it, so the stream would never drain \u2014 running it on "default" instead. The equivalent static \`.to({ lane })\` is rejected at build; a dynamic resolver's lane is only knowable here.`
-  );
-}
-function report_lane_conflict(seen, handler, target, kept, dropped) {
-  report_once(
-    seen,
-    `conflict|${handler}|${kept}|${dropped}`,
-    `Reaction "${handler}" resolved lane "${dropped}" for a stream already on "${kept}" \u2014 for example "${target}". These are conflicting lane assignments from two dynamic resolutions at equal priority. Keeping "${kept}", the lane it was first discovered on \u2014 re-laning a live stream would move it out from under a worker holding its lease. The reaction resolving "${dropped}" runs inside the "${kept}" lane's budget, and a process restricted to "${dropped}" via onlyLanes never runs it. The equivalent static declaration is rejected at build; align the resolvers, or split the target.`
-  );
-}
-var CorrelateCycle = class {
-  _checkpoint = -1;
-  // Lease holder id; per instance, so a restart never inherits a stale claim.
-  _by = randomUUID();
-  _key;
-  // Local expiry of the held lease (0 = none); stale only costs a duplicate scan.
-  _lease_until = 0;
-  // Armed while `_raised` (bumped by a commit or notification) is ahead of
-  // `_lowered` (the raise count the last short page saw). Starts armed.
-  _raised = 1;
-  _lowered = 0;
-  // Bumped by a release (shutdown), so a scan or lease reply that was out
-  // across one writes nothing.
-  _epoch = 0;
-  // Passes in flight: a restore waits for them, and refuses new ones.
-  _passes = /* @__PURE__ */ new Set();
-  _restoring = false;
-  _init_promise;
-  // Bounded by `maxSubscribedStreams`; static records live apart so eviction
-  // never lets a resolution re-lane them.
-  _dynamic_subscriptions;
-  _static_subscriptions = /* @__PURE__ */ new Map();
-  _patterns = new LruMap(PATTERN_CACHE_SIZE);
-  _registry;
-  _static_targets;
-  _cd;
-  _on_init;
-  _declared_lanes;
-  // Report-once keys; per instance because `internal/` holds no module state.
-  _reported = /* @__PURE__ */ new Set();
-  constructor({
-    registry,
-    static_targets,
-    cd,
-    max_subscribed_streams,
-    declared_lanes,
-    shard,
-    on_init
-  }) {
-    this._key = shard ? `${registry_key(registry.events)}:${[...shard].sort().join(",")}` : registry_key(registry.events);
-    this._dynamic_subscriptions = new LruMap(max_subscribed_streams);
-    this._registry = registry;
-    this._declared_lanes = declared_lanes;
-    this._static_targets = static_targets;
-    this._cd = cd;
-    this._on_init = on_init;
+// src/internal/defer-timer.ts
+var MAX_TIMER_DELAY_MS = 2147483647;
+var DeferTimer = class {
+  _due = /* @__PURE__ */ new Map();
+  _timer;
+  _on_wake;
+  /**
+   * @param on_wake - invoked once each time the earliest due-time elapses.
+   *   The consumer re-schedules for whatever is still parked.
+   */
+  constructor(on_wake) {
+    this._on_wake = on_wake;
   }
-  get checkpoint() {
-    return this._checkpoint;
+  /** Number of currently parked streams. */
+  get size() {
+    return this._due.size;
   }
-  /** A commit (local or remote) may have produced uncorrelated events. */
-  arm() {
-    this._raised++;
+  /**
+   * Park `stream` for a re-visit at `at` (ms since epoch). A plain
+   * overwrite: the caller computes the authoritative next-visit for the
+   * stream (the drain's `handle` already reconciles a stream's reactions
+   * into one result per cycle), so there is no stale value to merge against.
+   */
+  set(stream, at) {
+    this._due.set(stream, at);
   }
-  async _init() {
-    this._init_promise ??= this._run_init().catch((error) => {
-      this._init_promise = void 0;
-      throw error;
-    });
-    await this._init_promise;
+  /** Drop `stream` from the parked set (e.g. on a successful ack or block). */
+  delete(stream) {
+    this._due.delete(stream);
   }
-  async _run_init() {
-    const { watermark, correlated_at } = await this._cd.subscribe([
-      ...this._static_targets
-    ]);
-    this._checkpoint = correlated_at >= 0 ? correlated_at : Math.max(-1, watermark - COLD_START_BACK_SCAN);
-    for (const { stream, priority = 0, lane } of this._static_targets) {
-      this._static_subscriptions.set(stream, {
-        priority,
-        lane
-      });
-    }
-    await this._on_init?.();
+  /**
+   * Drop every entry due at or before `before`. The drain calls it when a
+   * pass that started at `before` claimed nothing: whatever was due by then
+   * was handled elsewhere (another worker) or has no work left, so waking
+   * for it again would spin.
+   */
+  prune(before) {
+    for (const [stream, at] of this._due)
+      if (at <= before) this._due.delete(stream);
   }
   /**
-   * Replace the log with no pass in flight, then cold-start: a pass that
-   * read the old log writes before the restore, never into the new one.
+   * (Re)schedule the wake timer at the earliest pending due-time. Idempotent
+   * — collapses many parked streams into a single timer. A no-op clears any
+   * pending timer when the map is empty.
+   *
+   * The timer is `unref()`-ed so pending re-visits never keep the process
+   * alive on their own.
    */
-  async restart(restore) {
-    this._restoring = true;
-    try {
-      await Promise.allSettled(this._passes);
-      await restore();
-    } finally {
-      this._restoring = false;
+  schedule() {
+    if (this._timer) clearTimeout(this._timer);
+    if (this._due.size === 0) {
+      this._timer = void 0;
+      return;
     }
-    this._init_promise = void 0;
-    this._checkpoint = -1;
-    this._dynamic_subscriptions.clear();
-    this._static_subscriptions.clear();
-  }
-  /** Forget dynamic targets whose rows a full close deleted, so they re-subscribe. */
-  forget_subscribed(streams) {
-    for (const stream of streams) this._dynamic_subscriptions.delete(stream);
+    let earliest = Number.POSITIVE_INFINITY;
+    for (const t of this._due.values()) if (t < earliest) earliest = t;
+    const delay = Math.min(
+      Math.max(0, earliest - Date.now()),
+      MAX_TIMER_DELAY_MS
+    );
+    this._timer = setTimeout(() => {
+      this._timer = void 0;
+      this._on_wake();
+    }, delay);
+    this._timer.unref();
   }
-  // Would the target's own `fetch` (filtered by `source`) return this event?
-  _in_fetch_window(source, stream) {
-    if (source === void 0 || source === stream) return true;
-    if (is_literal_source(source)) return false;
-    let pattern = this._patterns.get(source);
-    if (!pattern) {
-      pattern = new RegExp(source);
-      this._patterns.set(source, pattern);
+  /** Cancel any pending wake timer. Idempotent. Leaves the parked set intact. */
+  stop() {
+    if (this._timer) {
+      clearTimeout(this._timer);
+      this._timer = void 0;
     }
-    return pattern.test(stream);
   }
-  /** Scan past the checkpoint, subscribe new targets and raise their work marks. */
-  async correlate(limit, lease = false) {
-    if (this._restoring) return { kind: "idle", last_id: this._checkpoint };
-    const pass = this._scan(limit, lease);
-    this._passes.add(pass);
-    try {
-      return await pass;
-    } finally {
-      this._passes.delete(pass);
-    }
+};
+
+// src/internal/drain-ratio.ts
+var RATIO_MIN = 0.2;
+var RATIO_MAX = 0.8;
+var RATIO_DEFAULT = 0.5;
+function compute_lag_lead_ratio(handled, lagging, leading) {
+  let lagging_handled = 0;
+  let leading_handled = 0;
+  for (const { lease, handled: count } of handled) {
+    if (lease.lagging) lagging_handled += count;
+    else leading_handled += count;
   }
-  async _scan(limit, lease) {
-    await this._init();
-    const epoch = this._epoch;
-    const idle = () => ({
-      kind: "idle",
-      last_id: this._checkpoint
-    });
-    if (this._raised === this._lowered) return idle();
-    const raised = this._raised;
-    const now = Date.now();
-    if (lease && now >= this._lease_until - CORRELATION_LEASE_MS / 2) {
-      const { correlating } = await this._cd.subscribe([], void 0, {
-        key: this._key,
-        by: this._by,
-        millis: CORRELATION_LEASE_MS
-      });
-      if (this._epoch !== epoch) return idle();
-      this._lease_until = correlating ? now + CORRELATION_LEASE_MS : 0;
-      if (correlating === false) return idle();
-    }
-    const after = this._checkpoint;
-    const correlated = /* @__PURE__ */ new Map();
-    let last_id = after;
-    let stopped = false;
-    const found = await store().query(
-      (event) => {
-        if (stopped) return;
-        const register = this._registry.events[event.name];
-        if (register) {
-          for (const reaction of register.reactions.values()) {
-            let resolved;
-            try {
-              resolved = typeof reaction.resolver === "function" ? reaction.resolver(event) : reaction.resolver;
-            } catch (error) {
-              stopped = true;
-              report_once(
-                this._reported,
-                `resolver|${reaction.handler.name}|${event.id}`,
-                `Resolver of reaction "${reaction.handler.name}" threw on ${String(event.name)} #${event.id} (stream "${event.stream}"): ${String(error)}. Correlation stops before this event until the resolver stops throwing; work already found keeps draining.`
-              );
-              return;
-            }
-            if (!resolved) continue;
-            let lane = resolved.lane;
-            if (lane !== void 0 && !this._declared_lanes.has(lane)) {
-              report_undeclared_lane(
-                this._reported,
-                reaction.handler.name,
-                resolved.target,
-                lane,
-                this._declared_lanes
-              );
-              lane = void 0;
-            }
-            const fixed = this._static_subscriptions.get(resolved.target);
-            const recorded = fixed ?? this._dynamic_subscriptions.get(resolved.target);
-            const priority = resolved.priority ?? 0;
-            const upgraded = !recorded || !fixed && priority > recorded.priority;
-            const carried = upgraded ? { priority, lane } : { priority: recorded.priority, lane: recorded.lane };
-            const entry = correlated.get(resolved.target) || {
-              source: resolved.source,
-              priority: carried.priority,
-              lane: carried.lane,
-              upgraded,
-              missed: !recorded,
-              handler: reaction.handler.name,
-              correlated_at: void 0
-            };
-            const seen_in_scan = correlated.has(resolved.target);
-            const held_lane = (seen_in_scan ? entry.lane : recorded?.lane) ?? DEFAULT_LANE;
-            const held_priority = seen_in_scan ? entry.priority : recorded?.priority;
-            const resolved_lane = lane ?? DEFAULT_LANE;
-            if (held_priority === priority && held_lane !== resolved_lane)
-              report_lane_conflict(
-                this._reported,
-                reaction.handler.name,
-                resolved.target,
-                held_lane,
-                resolved_lane
-              );
-            if (carried.priority > entry.priority) {
-              entry.priority = carried.priority;
-              entry.lane = carried.lane;
-              entry.upgraded = upgraded;
-              entry.handler = reaction.handler.name;
-            }
-            if (this._in_fetch_window(resolved.source, event.stream))
-              entry.correlated_at = event.id;
-            correlated.set(resolved.target, entry);
-          }
-        }
-        last_id = event.id;
-      },
-      // Resolvers see `pii: null`: correlate runs actor-less, and one
-      // undecryptable row would otherwise stop every stream's reactions.
-      { after, limit, with_pii: false }
-    );
-    if (this._declared_lanes.size > 1) await this._recall(correlated);
-    const read = last_id > after;
-    if (this._epoch !== epoch) return idle();
-    const streams = [];
-    for (const [stream, entry] of correlated) {
-      if (entry.upgraded || entry.correlated_at !== void 0)
-        streams.push({
-          stream,
-          source: entry.source,
-          priority: entry.priority,
-          lane: entry.lane,
-          correlated_at: entry.correlated_at
-        });
-    }
-    if (streams.length) {
-      const renewed_at = Date.now();
-      const { subscribed, correlating } = await this._cd.subscribe(
-        streams,
-        last_id,
-        lease ? { key: this._key, by: this._by, millis: CORRELATION_LEASE_MS } : void 0
-      );
-      if (lease && correlating !== false)
-        this._lease_until = renewed_at + CORRELATION_LEASE_MS;
-      const marked = streams.filter(
-        (entry) => entry.correlated_at !== void 0
-      ).length;
-      this._checkpoint = last_id;
-      for (const { stream, priority, lane } of streams) {
-        if (correlated.get(stream)?.upgraded)
-          this._dynamic_subscriptions.set(stream, {
-            priority,
-            lane
-          });
-      }
-      return { kind: "scanned", last_id, subscribed, marked, read };
-    }
-    this._checkpoint = last_id;
-    if (!stopped && found !== limit) this._lowered = raised;
-    return { kind: "scanned", last_id, subscribed: 0, marked: 0, read };
-  }
-  // Read the row of each target this scan had no record of (new or evicted),
-  // so a resolution that doesn't beat its priority keeps the row's lane.
-  // Only called with more than one lane declared.
-  async _recall(correlated) {
-    const missed = [...correlated].filter(([, entry]) => entry.missed);
-    await Promise.all(
-      missed.map(async ([stream, entry]) => {
-        let row;
-        await store().query_streams(
-          (position) => {
-            row = position;
-          },
-          { stream, stream_exact: true, limit: 1 }
-        );
-        if (!row) return;
-        this._dynamic_subscriptions.set(stream, {
-          priority: row.priority,
-          lane: row.lane
-        });
-        if (entry.priority > row.priority) return;
-        const held_lane = row.lane ?? DEFAULT_LANE;
-        const resolved_lane = entry.lane ?? DEFAULT_LANE;
-        if (entry.priority === row.priority && held_lane !== resolved_lane)
-          report_lane_conflict(
-            this._reported,
-            entry.handler,
-            stream,
-            held_lane,
-            resolved_lane
-          );
-        entry.priority = row.priority;
-        entry.lane = row.lane;
-        entry.upgraded = false;
-      })
-    );
-  }
-  /** Release the lease early by re-acquiring it for zero ms. Best-effort. */
-  async release_correlation() {
-    try {
-      this._lease_until = 0;
-      this._epoch++;
-      await this._cd.subscribe([], void 0, {
-        key: this._key,
-        by: this._by,
-        millis: 0
-      });
-    } catch (error) {
-      log().warn(
-        `Could not hand back the correlation lease during shutdown; it expires on its own within ${CORRELATION_LEASE_MS}ms and correlation resumes normally after that. On a single-writer store this usually means another connection holds the database. Cause: ${String(error.cause ?? error)}`
-      );
-    }
-  }
-};
+  const lagging_avg = lagging > 0 ? lagging_handled / lagging : 0;
+  const leading_avg = leading > 0 ? leading_handled / leading : 0;
+  const total = lagging_avg + leading_avg;
+  if (total === 0) return RATIO_DEFAULT;
+  return Math.max(RATIO_MIN, Math.min(RATIO_MAX, lagging_avg / total));
+}
+
+// src/internal/report-once.ts
+function report_once(seen, key, message) {
+  if (seen.has(key)) return;
+  seen.add(key);
+  log().error(new Error(message));
+}
 
 // src/internal/correlation-id.ts
 import { randomInt } from "crypto";
@@ -1490,134 +1127,13 @@ function close_correlation(correlator, actor) {
   });
 }
 
-// src/internal/drain-cycle.ts
-import { randomUUID as randomUUID2 } from "crypto";
-
-// src/internal/backoff.ts
-function compute_backoff_delay(retry, opts) {
-  if (!opts || opts.baseMs <= 0) return 0;
-  const r = Math.max(0, retry);
-  let delay;
-  switch (opts.strategy) {
-    case "fixed":
-      delay = opts.baseMs;
-      break;
-    case "linear":
-      delay = opts.baseMs * (r + 1);
-      break;
-    case "exponential":
-      delay = opts.baseMs * 2 ** r;
-      if (opts.maxMs !== void 0) delay = Math.min(delay, opts.maxMs);
-      break;
-    default: {
-      const _never = opts.strategy;
-      throw new Error(`unknown backoff strategy: ${String(_never)}`);
-    }
-  }
-  if (opts.jitter) delay = delay * (0.5 + Math.random());
-  return Math.max(0, Math.floor(delay));
-}
-
-// src/internal/defer-timer.ts
-var MAX_TIMER_DELAY_MS = 2147483647;
-var DeferTimer = class {
-  _due = /* @__PURE__ */ new Map();
-  _timer;
-  _on_wake;
-  /**
-   * @param on_wake - invoked once each time the earliest due-time elapses.
-   *   The consumer re-schedules for whatever is still parked.
-   */
-  constructor(on_wake) {
-    this._on_wake = on_wake;
-  }
-  /** Number of currently parked streams. */
-  get size() {
-    return this._due.size;
-  }
-  /**
-   * Park `stream` for a re-visit at `at` (ms since epoch). A plain
-   * overwrite: the caller computes the authoritative next-visit for the
-   * stream (the drain's `handle` already reconciles a stream's reactions
-   * into one result per cycle), so there is no stale value to merge against.
-   */
-  set(stream, at) {
-    this._due.set(stream, at);
-  }
-  /** Drop `stream` from the parked set (e.g. on a successful ack or block). */
-  delete(stream) {
-    this._due.delete(stream);
-  }
-  /**
-   * Drop every entry due at or before `before`. The drain calls it when a
-   * pass that started at `before` claimed nothing: whatever was due by then
-   * was handled elsewhere (another worker) or has no work left, so waking
-   * for it again would spin.
-   */
-  prune(before) {
-    for (const [stream, at] of this._due)
-      if (at <= before) this._due.delete(stream);
-  }
-  /**
-   * (Re)schedule the wake timer at the earliest pending due-time. Idempotent
-   * — collapses many parked streams into a single timer. A no-op clears any
-   * pending timer when the map is empty.
-   *
-   * The timer is `unref()`-ed so pending re-visits never keep the process
-   * alive on their own.
-   */
-  schedule() {
-    if (this._timer) clearTimeout(this._timer);
-    if (this._due.size === 0) {
-      this._timer = void 0;
-      return;
-    }
-    let earliest = Number.POSITIVE_INFINITY;
-    for (const t of this._due.values()) if (t < earliest) earliest = t;
-    const delay = Math.min(
-      Math.max(0, earliest - Date.now()),
-      MAX_TIMER_DELAY_MS
-    );
-    this._timer = setTimeout(() => {
-      this._timer = void 0;
-      this._on_wake();
-    }, delay);
-    this._timer.unref();
-  }
-  /** Cancel any pending wake timer. Idempotent. Leaves the parked set intact. */
-  stop() {
-    if (this._timer) {
-      clearTimeout(this._timer);
-      this._timer = void 0;
-    }
-  }
-};
-
-// src/internal/drain-ratio.ts
-var RATIO_MIN = 0.2;
-var RATIO_MAX = 0.8;
-var RATIO_DEFAULT = 0.5;
-function compute_lag_lead_ratio(handled, lagging, leading) {
-  let lagging_handled = 0;
-  let leading_handled = 0;
-  for (const { lease, handled: count } of handled) {
-    if (lease.lagging) lagging_handled += count;
-    else leading_handled += count;
-  }
-  const lagging_avg = lagging > 0 ? lagging_handled / lagging : 0;
-  const leading_avg = leading > 0 ? leading_handled / leading : 0;
-  const total = lagging_avg + leading_avg;
-  if (total === 0) return RATIO_DEFAULT;
-  return Math.max(RATIO_MIN, Math.min(RATIO_MAX, lagging_avg / total));
-}
-
 // src/internal/drain-ops.ts
 var claim = (lagging, leading, by, millis, lane) => store().claim(lagging, leading, by, millis, lane);
 async function fetch(leased, eventLimit) {
   return Promise.all(
     leased.map(async ({ stream, source, at, lagging }) => {
       const events = [];
-      const stream_exact = source !== void 0 && is_literal_source(source) ? true : void 0;
+      const stream_exact = source !== void 0 && is_literal_source(source, stream) ? true : void 0;
       try {
         await store().query((e) => events.push(e), {
           stream: source,
@@ -1687,14 +1203,18 @@ async function snap(snapshot) {
   const { id, stream, name, meta, version } = snapshot.event;
   try {
     const [committed] = await store().commit(
-      stream,
-      [{ name: SNAP_EVENT, data: snapshot.state }],
+      [
+        {
+          stream,
+          msgs: [{ name: SNAP_EVENT, data: snapshot.state }],
+          // IMPORTANT! - state events are committed right after the snapshot event
+          expectedVersion: version
+        }
+      ],
       {
         correlation: meta.correlation,
         causation: { event: { id, name, stream } }
-      },
-      version
-      // IMPORTANT! - state events are committed right after the snapshot event
+      }
     );
     return committed;
   } catch (error) {
@@ -1707,10 +1227,14 @@ async function snap(snapshot) {
 async function tombstone(stream, expectedVersion, correlation) {
   try {
     const [committed] = await store().commit(
-      stream,
-      [{ name: TOMBSTONE_EVENT, data: {} }],
-      { correlation, causation: {} },
-      expectedVersion
+      [
+        {
+          stream,
+          msgs: [{ name: TOMBSTONE_EVENT, data: {} }],
+          expectedVersion
+        }
+      ],
+      { correlation, causation: {} }
     );
     return committed;
   } catch (error) {
@@ -1912,6 +1436,38 @@ async function load(me, target, callback, patch_fn = bare_patch) {
     replayed
   };
 }
+async function load_others(loads, payload, own, actor, patch_fn, refuse) {
+  const streams = loads.map((l) => l.target(payload, own.state));
+  streams.forEach((stream, i) => {
+    if (stream === void 0) return;
+    if (typeof stream !== "string" || !stream)
+      throw refuse(`loads "${loads[i].name}" from an empty stream name`);
+    if (stream === own.stream) throw refuse(`loads its own stream "${stream}"`);
+    if (streams.indexOf(stream) !== i)
+      throw refuse(`loads stream "${stream}" twice`);
+  });
+  return Promise.all(
+    loads.map(async (l, i) => {
+      const stream = streams[i];
+      if (stream === void 0) return void 0;
+      const snapshot = await load(
+        l.state,
+        { stream, actor },
+        void 0,
+        patch_fn
+      );
+      if (snapshot.event?.name === TOMBSTONE_EVENT)
+        throw new StreamClosedError(stream);
+      return {
+        state: l.state,
+        stream,
+        snapshot,
+        expected: snapshot.version,
+        events: []
+      };
+    })
+  );
+}
 async function action(me, action2, target, payload, options, patch_fn = bare_patch) {
   const { stream, expectedVersion, actor } = target;
   if (!stream) throw new Error("Missing target stream");
@@ -1920,6 +1476,7 @@ async function action(me, action2, target, payload, options, patch_fn = bare_pat
   const validated = validate(action2, payload, me.actions[action2]);
   const opts = me.options?.[action2];
   const max_retries = opts?.maxRetries ?? 0;
+  const loads = me.loads?.[action2] ?? [];
   for (let attempt = 0; ; attempt++) {
     try {
       const snapshot = await load(
@@ -1930,34 +1487,64 @@ async function action(me, action2, target, payload, options, patch_fn = bare_pat
       );
       if (snapshot.event?.name === TOMBSTONE_EVENT)
         throw new StreamClosedError(stream);
-      const expected = expectedVersion ?? snapshot.version;
-      for (const { valid, description } of me.given?.[action2] ?? [])
-        if (!valid(snapshot.state, actor))
-          throw new InvariantError(
+      const own = {
+        state: me,
+        stream,
+        snapshot,
+        expected: expectedVersion ?? snapshot.version,
+        events: []
+      };
+      const others = loads.length ? await load_others(
+        loads,
+        validated,
+        { stream, state: snapshot.state },
+        target.actor,
+        patch_fn,
+        (description) => new PreconditionError(
+          action2,
+          validated,
+          target,
+          snapshot,
+          description
+        )
+      ) : [];
+      const loaded = Object.fromEntries(
+        others.map((p, i) => [loads[i].name, p?.snapshot.state])
+      );
+      for (const { holds, description } of me.requires?.[action2] ?? [])
+        if (!holds(validated, snapshot.state, actor, loaded))
+          throw new PreconditionError(
             action2,
             validated,
             target,
             snapshot,
             description
           );
-      for (const { holds, description } of me.requires?.[action2] ?? [])
-        if (!holds(validated, snapshot.state, actor))
-          throw new PreconditionError(
-            action2,
-            validated,
-            target,
-            snapshot,
-            description
-          );
-      const result = me.on[action2](validated, snapshot, target);
+      const result = me.on[action2](validated, snapshot, target, loaded);
       if (!result || Array.isArray(result) && !result.length)
         return [snapshot];
       const tuples = Array.isArray(result[0]) ? result : [result];
-      const events = tuples.map(([name, data]) => ({
-        name,
-        data: validate(name, data, me.events[name])
-      }));
-      const emitted = events.map((e) => me.message(e));
+      for (const [name, data] of tuples) {
+        const event = name;
+        const i = loads.findIndex((l) => l.events.includes(event));
+        if (i >= 0 && !others[i]) continue;
+        const to = i >= 0 ? others[i] : name in me.events ? own : void 0;
+        if (!to)
+          throw new Error(
+            `Action "${action2}" emitted "${event}", which isn't an event of "${me.name}" and isn't listed on any of its loads`
+          );
+        to.events.push({
+          name: event,
+          data: validate(event, data, to.state.events[event])
+        });
+      }
+      if (!own.events.length)
+        throw new Error(
+          `Action "${action2}" appends only to the streams it loads; it must append an event to its own stream too`
+        );
+      const appends = [own, ...others].filter(
+        (p) => !!p?.events.length
+      );
       const meta = {
         correlation: reactingTo?.meta.correlation || correlator({
           action: action2,
@@ -1978,61 +1565,86 @@ async function action(me, action2, target, payload, options, patch_fn = bare_pat
           } : void 0
         }
       };
-      let { state: state2, patches } = snapshot;
       const created = /* @__PURE__ */ new Date();
-      const folded = events.map((e, i) => {
-        const event = {
-          ...e,
-          id: -1,
-          stream,
-          version: snapshot.version + i + 1,
-          created,
-          meta
-        };
-        const patch2 = me.patch[event.name](event, state2);
-        state2 = patch_fn(me, state2, patch2, event);
-        patches++;
-        return { state: state2, patch: patch2, patches };
+      const folds = appends.map((p) => {
+        let { state: state2, patches } = p.snapshot;
+        const folded = p.events.map((e, i) => {
+          const event = {
+            ...e,
+            id: -1,
+            stream: p.stream,
+            version: p.snapshot.version + i + 1,
+            created,
+            meta
+          };
+          const patch2 = p.state.patch[event.name](event, state2);
+          state2 = patch_fn(p.state, state2, patch2, event);
+          patches++;
+          return { state: state2, patch: patch2, patches };
+        });
+        check_invariants(
+          `${p.state.name}.${action2}`,
+          state2,
+          p.state.state,
+          p.state.pii_aware
+        );
+        return folded;
       });
-      check_invariants(
-        `${me.name}.${action2}`,
-        state2,
-        me.state,
-        me.pii_aware
-      );
       let committed;
       try {
-        committed = await store().commit(stream, emitted, meta, expected);
+        committed = await store().commit(
+          appends.map((p) => ({
+            stream: p.stream,
+            msgs: p.events.map((e) => p.state.message(e)),
+            expectedVersion: p.expected
+          })),
+          meta
+        );
       } catch (error) {
-        if (error instanceof ConcurrencyError) void cache_drop(stream);
+        if (error instanceof ConcurrencyError) void cache_drop(error.stream);
         throw error;
       }
-      const snapshots = committed.map((row, i) => ({
-        event: { ...row, data: events[i].data },
-        state: folded[i].state,
-        version: row.version,
-        id: row.id,
-        patches: folded[i].patches,
-        snaps: snapshot.snaps,
-        patch: folded[i].patch,
-        cache_hit: snapshot.cache_hit,
-        replayed: snapshot.replayed
-      }));
-      const last = snapshots.at(-1);
-      const snap_event = me.snap?.(last) ? await snap(last) : void 0;
-      if (!me.pii_aware)
-        void cache_put(stream, {
-          stream,
-          state: last.state,
-          version: snap_event?.version ?? last.event.version,
-          event_id: snap_event?.id ?? last.event.id,
-          patches: snap_event ? 0 : last.patches,
-          snaps: snap_event ? last.snaps + 1 : last.snaps
+      let row = 0;
+      const snapshots = [];
+      for (const [a, append] of appends.entries()) {
+        const { snapshot: base, state: owner } = append;
+        const appended = append.events.map((e, i) => {
+          const stored = committed[row++];
+          const fold = folds[a][i];
+          return {
+            event: { ...stored, data: e.data },
+            state: fold.state,
+            version: stored.version,
+            id: stored.id,
+            patches: fold.patches,
+            snaps: base.snaps,
+            patch: fold.patch,
+            cache_hit: base.cache_hit,
+            replayed: base.replayed
+          };
         });
+        const last = appended.at(-1);
+        const snap_event = owner.snap?.(last) ? await snap(last) : void 0;
+        if (!owner.pii_aware)
+          void cache_put(append.stream, {
+            stream: append.stream,
+            state: last.state,
+            version: snap_event?.version ?? last.event.version,
+            event_id: snap_event?.id ?? last.event.id,
+            patches: snap_event ? 0 : last.patches,
+            snaps: snap_event ? last.snaps + 1 : last.snaps
+          });
+        if (snap_event)
+          appended[appended.length - 1] = {
+            ...last,
+            version: snap_event.version
+          };
+        snapshots.push(...appended);
+      }
       return snapshots;
     } catch (error) {
       if (!(error instanceof ConcurrencyError)) throw error;
-      if (expectedVersion !== void 0) throw error;
+      if (expectedVersion !== void 0 && error.stream === stream) throw error;
       if (attempt >= max_retries) throw error;
       if (opts?.backoff) {
         const delay_ms = compute_backoff_delay(attempt, opts.backoff);
@@ -2139,14 +1751,14 @@ function build_es(logger, correlator = default_correlator, patch_fn = bare_patch
     }),
     action: traced(
       bound_action,
-      (snapshots, _me, _action, target) => {
+      (snapshots) => {
         if (snapshots[0].patch)
           logger.trace(
             snapshots.map((s) => s.event.data),
             es_caption(
               "committed",
               C_ORANGE,
-              `${target.stream}.${snapshots.map((s) => s.event.name).join(", ")}`
+              snapshots.map((s) => `${s.event.stream}.${s.event.name}`).join(", ")
             )
           );
       },
@@ -2280,7 +1892,7 @@ async function run_drain_cycle(deps, cycle) {
   const leased = await ops.claim(
     lagging,
     leading,
-    randomUUID2(),
+    randomUUID(),
     leaseMillis,
     lane
   );
@@ -2467,68 +2079,958 @@ var DrainController = class {
       clearTimeout(this._worker);
       this._worker = void 0;
     }
-    this._defer.stop();
+    this._defer.stop();
+  }
+  async drain(options = {}) {
+    if (!this.armed || this._stopped || this._inflight)
+      return EMPTY_DRAIN;
+    const d = this._deps.defaults ?? {};
+    const streamLimit = d.streamLimit ?? options.streamLimit ?? DEFAULT_STREAM_LIMIT;
+    const eventLimit = options.eventLimit ?? DEFAULT_EVENT_LIMIT;
+    const leaseMillis = d.leaseMillis ?? options.leaseMillis ?? DEFAULT_LEASE_MILLIS;
+    if (this._deps.breaker.state(Date.now()) === "open")
+      return EMPTY_DRAIN;
+    const pass = this._pass(streamLimit, eventLimit, leaseMillis).finally(
+      () => {
+        this._inflight = void 0;
+      }
+    );
+    this._inflight = pass;
+    return pass;
+  }
+  // One claim → fetch → handle → ack pass. Never throws.
+  async _pass(streamLimit, eventLimit, leaseMillis) {
+    try {
+      const lagging = Math.ceil(streamLimit * this._ratio);
+      const leading = streamLimit - lagging;
+      const started = Date.now();
+      const raised = this._raised;
+      const cycle = await run_drain_cycle(this._deps, {
+        lagging,
+        leading,
+        eventLimit,
+        leaseMillis,
+        misrouted: this._misrouted,
+        store_failing: this._deps.breaker.failing
+      });
+      if (!cycle) {
+        this._defer.prune(started);
+        this._deps.breaker.passed();
+        this._lowered = raised;
+        return EMPTY_DRAIN;
+      }
+      const { leased, fetched, handled, acked, blocked, closeable } = cycle;
+      trace_cycle(this._deps.logger, leased, fetched, handled, acked, blocked);
+      this._ratio = compute_lag_lead_ratio(handled, lagging, leading);
+      for (const lease of acked) this._defer.delete(lease.stream);
+      for (const lease of blocked) this._defer.delete(lease.stream);
+      for (const h of handled) {
+        const next = h.defer ?? h.next_attempt_at;
+        if (next !== void 0) this._defer.set(h.lease.stream, next);
+      }
+      if (acked.length) this._deps.on_acked(acked);
+      if (closeable.length) await this._deps.on_close(closeable);
+      this._deps.breaker.passed();
+      return { fetched, leased, acked, blocked };
+    } catch (error) {
+      this._defer.set(
+        RETRY,
+        Date.now() + Math.max(leaseMillis, this._deps.breaker.cooldown_ms)
+      );
+      this._deps.breaker.failed(Date.now(), error);
+      return EMPTY_DRAIN;
+    } finally {
+      if (!this._stopped) this._defer.schedule();
+    }
+  }
+};
+
+// src/internal/reaction-dispatch.ts
+var CloseSignal = class extends Error {
+  /**
+   * Stream to close. Omitted → the reaction's own lease stream (a self-close).
+   * The synthesized autoclose reaction sets it to the aggregate stream, since
+   * its lease runs on a synthetic `__autoclose__` target.
+   */
+  stream;
+  /** Optional archive callback to run while the stream is guarded. */
+  archive;
+  /**
+   * Watermark to ack the requesting reaction to before the close runs. The
+   * close-cycle safety guard skips a stream whose subscriptions (matched by
+   * source) lag the head; the autoclose reaction's `source` is the aggregate,
+   * so it must advance its own watermark to the live head id it evaluated
+   * against — otherwise it blocks its own close. Defaults to the triggering
+   * event id when omitted.
+   */
+  at;
+  /**
+   * Windowed close: prune events older than this cutoff behind
+   * the closest safe snapshot instead of retiring the stream. Thrown by
+   * the autoclose reaction of a `.autocloses({ keep })` state; flows
+   * into {@link CloseTarget.before}. Omitted → a full close.
+   */
+  before;
+  /**
+   * Revisit the requesting reaction at this time. Only useful with an `at`
+   * below the head: a reaction runs only when an event is waiting for it.
+   */
+  defer;
+  constructor(opts) {
+    super("reaction requested close");
+    this.name = "CloseSignal";
+    this.stream = opts?.stream;
+    this.archive = opts?.archive;
+    this.at = opts?.at;
+    this.before = opts?.before;
+    this.defer = opts?.defer;
+  }
+};
+function build_handle(deps) {
+  const { logger, reaction_scope } = deps;
+  return async (lease, payloads) => {
+    if (payloads.length === 0) return { lease, handled: 0, acked_at: lease.at };
+    const stream = lease.stream;
+    const last_index_of = /* @__PURE__ */ new Map();
+    for (let i = 0; i < payloads.length; i++)
+      last_index_of.set(payloads[i].event.id, i);
+    let at = lease.at;
+    let handled = 0;
+    if (lease.retry > 0)
+      logger.warn(
+        `Retrying ${stream}@${payloads.at(0).event.id} (${lease.retry}).`
+      );
+    for (let i = 0; i < payloads.length; i++) {
+      const payload = payloads[i];
+      const { event, handler } = payload;
+      try {
+        await reaction_scope.run(
+          event,
+          () => handler(event, stream, reaction_scope.app)
+        );
+        if (last_index_of.get(event.id) === i) {
+          at = event.id;
+          handled++;
+        }
+      } catch (error) {
+        if (error instanceof DeferSignal) {
+          let defer;
+          try {
+            defer = resolve_defer_at(error.when, event);
+          } catch (invalid) {
+            return finalize(
+              lease,
+              handled,
+              at,
+              invalid,
+              payload.options,
+              logger,
+              event.id
+            );
+          }
+          return { lease, handled, acked_at: at, defer };
+        }
+        if (error instanceof CloseSignal)
+          return {
+            lease,
+            handled: handled + 1,
+            // Advance to the live head the handler evaluated against (when
+            // provided) so the close-cycle guard sees this reaction caught up.
+            acked_at: error.at ?? event.id,
+            defer: error.defer?.getTime(),
+            // Close the signalled stream (the autoclose reaction's aggregate,
+            // which differs from its synthetic lease stream); a self-closing
+            // user reaction omits it and closes its own lease stream. A
+            // carried `before` makes it a windowed close (prune, not retire).
+            close: {
+              stream: error.stream ?? stream,
+              archive: error.archive,
+              before: error.before
+            }
+          };
+        return finalize(
+          lease,
+          handled,
+          at,
+          error,
+          payload.options,
+          logger,
+          event.id
+        );
+      }
+    }
+    return finalize(lease, handled, at, void 0, payloads[0].options, logger);
+  };
+}
+function build_handle_batch(logger) {
+  return async (lease, payloads, batchHandler) => {
+    const stream = lease.stream;
+    const events = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const p of payloads) {
+      if (seen.has(p.event.id)) continue;
+      seen.add(p.event.id);
+      events.push(p.event);
+    }
+    const options = payloads[0].options;
+    if (lease.retry > 0)
+      logger.warn(`Retrying batch ${stream}@${events[0].id} (${lease.retry}).`);
+    try {
+      await batchHandler(events, stream);
+      return finalize(
+        lease,
+        events.length,
+        events.at(-1).id,
+        void 0,
+        options,
+        logger
+      );
+    } catch (error) {
+      return finalize(lease, 0, lease.at, error, options, logger);
+    }
+  };
+}
+
+// src/internal/autoclose-reaction.ts
+var AUTOCLOSE_TARGET_PREFIX = "__autoclose__:";
+function synthesize_autoclose_reactions(registry, states, read_window) {
+  for (const st of states.values()) {
+    const predicate = st.autoclose;
+    if (!predicate) continue;
+    const after_windows = st.autoclose_after_windows;
+    const keep_days = st.autoclose_keep_days;
+    const archiver = st.archive;
+    const reaction = {
+      // Run on a SYNTHETIC stream — `source` is the aggregate, `target` is a
+      // per-aggregate `__autoclose__` key — so the autoclose reaction never
+      // shares a watermark with the aggregate's own reactions. A shared
+      // watermark would let autoclose's defer short-circuit the aggregate's
+      // other reactions (the "a defer affects all reactions on a stream"
+      // hazard). The close still targets the aggregate (`source`).
+      // An anchored stream name would read as a pattern, and a store may refuse
+      // it at subscribe, stopping every reaction. Such a stream has no
+      // autoclose: `app.close` still closes it.
+      resolver: (e) => is_literal_source(e.stream) ? {
+        target: `${AUTOCLOSE_TARGET_PREFIX}${e.stream}`,
+        source: e.stream
+      } : void 0,
+      // Never block on autoclose: a transient query/store error should retry,
+      // not quarantine the synthetic stream.
+      options: { blockOnError: false, maxRetries: DEFAULT_MAX_RETRIES },
+      handler: async (event) => {
+        const aggregate = event.stream;
+        const window = read_window();
+        if (!in_autoclose_window(window, /* @__PURE__ */ new Date()))
+          throw new DeferSignal({ at: next_window_open(window, /* @__PURE__ */ new Date()) });
+        const stats = await store().query_stats([aggregate], {
+          count: true,
+          tail: keep_days !== void 0 ? true : void 0,
+          exclude: [TOMBSTONE_EVENT, SNAP_EVENT]
+        });
+        const entry = stats.get(aggregate);
+        if (!entry) return;
+        const head = entry.head;
+        if (predicate(aggregate, head, entry.count))
+          throw new CloseSignal({
+            stream: aggregate,
+            archive: archiver ? () => archiver(aggregate, head) : void 0,
+            // Ack this reaction's own watermark to the live head so the
+            // close-cycle guard (which matches subscriptions by source =
+            // aggregate) sees it caught up instead of blocking its own close.
+            at: head.id
+          });
+        if (keep_days !== void 0) {
+          const cutoff = days_before_now(keep_days);
+          if (entry.tail.created < cutoff) {
+            const waiting = after_windows.some(
+              (days) => days_after(head.created, days).getTime() > Date.now()
+            );
+            throw new CloseSignal({
+              stream: aggregate,
+              before: cutoff,
+              archive: archiver ? () => archiver(aggregate, head, cutoff) : void 0,
+              at: waiting ? head.id - 1 : head.id,
+              defer: waiting ? days_after(/* @__PURE__ */ new Date(), 1) : void 0
+            });
+          }
+        }
+        const dues = [];
+        for (const days of after_windows)
+          dues.push(days_after(head.created, days));
+        if (keep_days !== void 0)
+          dues.push(days_after(entry.tail.created, keep_days));
+        const future = dues.map((d) => d.getTime()).filter((t) => t > Date.now());
+        if (future.length)
+          throw new DeferSignal({ at: new Date(Math.min(...future)) });
+      }
+    };
+    const key = `__autoclose_${st.name}`;
+    for (const event_name of Object.keys(st.events)) {
+      registry.events[event_name]?.reactions.set(
+        key,
+        reaction
+      );
+    }
+  }
+}
+
+// src/internal/close-cycle.ts
+var CLOSE_CATCH_UP_LIMIT = 1e3;
+var CLOSE_CATCH_UP_PASSES = 20;
+async function catch_up_correlation(cursor, correlate, until) {
+  for (let pass = 0; pass < CLOSE_CATCH_UP_PASSES && cursor.checkpoint < until; pass++) {
+    const before = cursor.checkpoint;
+    cursor.arm();
+    await correlate(CLOSE_CATCH_UP_LIMIT);
+    if (cursor.checkpoint <= before) break;
+  }
+  return cursor.checkpoint;
+}
+var CloseLock = class {
+  _tails = /* @__PURE__ */ new Map();
+  /** Run `work` after every earlier close of `stream` has settled. */
+  run(stream, work) {
+    const prev = this._tails.get(stream) ?? Promise.resolve();
+    const next = prev.then(work, work);
+    this._tails.set(stream, next);
+    const cleanup = () => {
+      if (this._tails.get(stream) === next) this._tails.delete(stream);
+    };
+    next.then(cleanup, cleanup);
+    return next;
+  }
+};
+var SAFETY_PROBE_PAGE_SIZE = 1e3;
+async function run_close_cycle(targets, deps) {
+  const target_map = new Map(targets.map((t) => [t.stream, t]));
+  for (const t of target_map.values()) {
+    if (t.before !== void 0 && t.restart)
+      throw new Error(
+        `close: \`before\` and \`restart\` are mutually exclusive (stream "${t.stream}") \u2014 a windowed close keeps the stream live behind a real snapshot; restart reseeds it`
+      );
+  }
+  const windowed = [...target_map.values()].filter(
+    (t) => t.before !== void 0
+  );
+  const full = [...target_map.values()].filter((t) => t.before === void 0);
+  const skipped = [];
+  const windowed_result = windowed.length ? await run_windowed_closes(windowed, deps, skipped) : /* @__PURE__ */ new Map();
+  if (!full.length) return { truncated: windowed_result, skipped };
+  const truncated = await with_stream_locks(
+    full.map((t) => t.stream),
+    deps,
+    () => run_full_closes(full, target_map, deps, skipped)
+  );
+  const retired = [...truncated.entries()].filter(([, r]) => r.committed.name === TOMBSTONE_EVENT).map(([stream]) => stream);
+  if (retired.length) deps.forget_subscribed?.(retired);
+  for (const [stream, entry] of windowed_result) truncated.set(stream, entry);
+  return { truncated, skipped };
+}
+function with_stream_locks(streams, deps, work) {
+  const with_lock = deps.with_stream_lock ?? ((_stream, w) => w());
+  return [...streams].sort().reduceRight(
+    (inner, stream) => () => with_lock(stream, inner),
+    work
+  )();
+}
+async function run_full_closes(full, target_map, deps, skipped) {
+  const none = /* @__PURE__ */ new Map();
+  const streams = full.map((t) => t.stream);
+  const stream_info = await scan_stream_heads(streams);
+  for (const target of full) {
+    if (!target.restart) continue;
+    const info = stream_info.get(target.stream);
+    if (!info) continue;
+    const owner = deps.event_to_state.get(info.last_event_name);
+    if (owner?.pii_aware) {
+      deps.logger.error(
+        `Refusing to close "${target.stream}" with restart: state "${owner.name}" carries sensitive fields, so a restart seed would persist redacted values while deleting the originals. Close it without restart to retire the stream, or leave it open.`
+      );
+      skipped.push(target.stream);
+      stream_info.delete(target.stream);
+    }
+  }
+  const safe = await partition_by_safety(
+    stream_info,
+    deps.reactive,
+    skipped,
+    deps.probe_page_size ?? SAFETY_PROBE_PAGE_SIZE,
+    deps.catch_up_correlation
+  );
+  if (!safe.length) return none;
+  const { guarded, guard_events } = await guard_with_tombstones(
+    safe,
+    stream_info,
+    deps.correlation,
+    deps.tombstone,
+    skipped
+  );
+  if (!guarded.length) return none;
+  const seed_states = await load_restart_seeds(
+    guarded,
+    target_map,
+    stream_info,
+    deps.event_to_state,
+    deps.load,
+    deps.logger
+  );
+  await run_archive_callbacks(guarded, target_map);
+  const still_guarded = await heads_still_guarded(
+    guarded,
+    guard_events,
+    skipped
+  );
+  if (!still_guarded.length) return none;
+  return truncate_and_warm_cache(
+    still_guarded,
+    seed_states,
+    guard_events,
+    deps.correlation
+  );
+}
+async function run_windowed_closes(windowed, deps, skipped) {
+  const checkpoint = deps.reactive ? await deps.catch_up_correlation(Number.MAX_SAFE_INTEGER) : -1;
+  const min_at = deps.reactive ? await probe_min_watermarks(
+    windowed.map((t) => t.stream),
+    deps.probe_page_size ?? SAFETY_PROBE_PAGE_SIZE,
+    checkpoint
+  ) : /* @__PURE__ */ new Map();
+  const with_lock = deps.with_stream_lock ?? ((_stream, work) => work());
+  const truncated = /* @__PURE__ */ new Map();
+  for (const t of windowed) {
+    const entry = await with_lock(t.stream, async () => {
+      const max_id = min_at.get(t.stream);
+      if (!await windowed_prune_pending(t.stream, t.before, max_id))
+        return void 0;
+      if (t.archive) await t.archive();
+      const result = await store().truncate([
+        { stream: t.stream, before: t.before, max_id }
+      ]);
+      return result.get(t.stream);
+    });
+    if (entry) truncated.set(t.stream, entry);
+    else skipped.push(t.stream);
+  }
+  return truncated;
+}
+async function windowed_prune_pending(stream, before, max_id) {
+  let boundary_id;
+  let min_id;
+  await store().query(
+    (event) => {
+      if (min_id === void 0 || event.id < min_id) min_id = event.id;
+      if (event.name === SNAP_EVENT && event.created < before && (max_id === void 0 || event.id <= max_id) && (boundary_id === void 0 || event.id > boundary_id))
+        boundary_id = event.id;
+    },
+    { stream, stream_exact: true, with_snaps: true, after: -1 }
+  );
+  return boundary_id !== void 0 && min_id < boundary_id;
+}
+async function probe_min_watermarks(streams, page_size, checkpoint) {
+  const min_at = /* @__PURE__ */ new Map();
+  const matches = source_matcher();
+  await walk_streams(
+    store(),
+    (position) => {
+      const pending = position.correlated_at === void 0 || position.at < position.correlated_at;
+      const cap = pending ? position.at : Math.max(position.at, checkpoint);
+      for (const stream of streams) {
+        if (matches(position.source, position.stream, stream)) {
+          const prev = min_at.get(stream);
+          if (prev === void 0 || cap < prev) min_at.set(stream, cap);
+        }
+      }
+    },
+    { limit: page_size }
+  );
+  return min_at;
+}
+function source_matcher() {
+  const compiled = /* @__PURE__ */ new Map();
+  return (source, target, stream) => {
+    if (!source) return true;
+    if (is_literal_source(source, target)) return source === stream;
+    let re = compiled.get(source);
+    if (!re) {
+      re = new RegExp(source);
+      compiled.set(source, re);
+    }
+    return re.test(stream);
+  };
+}
+async function scan_stream_heads(streams) {
+  const stats = await store().query_stats(streams, {
+    exclude: [SNAP_EVENT]
+  });
+  const domain_heads = await store().query_stats(streams, {
+    exclude: [SNAP_EVENT, TOMBSTONE_EVENT]
+  });
+  const true_heads = await store().query_stats(streams, {});
+  const out = /* @__PURE__ */ new Map();
+  for (const [stream, { head }] of domain_heads) {
+    const marker_head = stats.get(stream)?.head;
+    const interrupted = marker_head?.name === TOMBSTONE_EVENT;
+    out.set(stream, {
+      max_id: head.id,
+      version: true_heads.get(stream).head.version,
+      last_event_name: head.name,
+      ...interrupted ? { resumed_guard: { id: marker_head.id } } : {}
+    });
+  }
+  return out;
+}
+async function partition_by_safety(stream_info, reactive, skipped, page_size, catch_up_correlation2) {
+  if (!reactive) return [...stream_info.keys()];
+  let needed = -1;
+  for (const info of stream_info.values())
+    needed = Math.max(needed, info.max_id);
+  const checkpoint = await catch_up_correlation2(needed);
+  const uncorrelated = /* @__PURE__ */ new Set();
+  for (const [stream, info] of stream_info) {
+    if (checkpoint < info.max_id) uncorrelated.add(stream);
+  }
+  const pending_set = /* @__PURE__ */ new Set();
+  const matches = source_matcher();
+  await walk_streams(
+    store(),
+    (position) => {
+      const has_work = position.correlated_at !== void 0 && position.at < position.correlated_at;
+      if (!has_work) return;
+      if (position.stream.startsWith(AUTOCLOSE_TARGET_PREFIX)) return;
+      for (const [stream, info] of stream_info) {
+        if (matches(position.source, position.stream, stream) && position.at < info.max_id)
+          pending_set.add(stream);
+      }
+    },
+    { limit: page_size }
+  );
+  const safe = [];
+  for (const [stream] of stream_info) {
+    if (pending_set.has(stream) || uncorrelated.has(stream))
+      skipped.push(stream);
+    else safe.push(stream);
+  }
+  return safe;
+}
+async function guard_with_tombstones(safe, stream_info, correlation, tombstone2, skipped) {
+  const guarded = [];
+  const guard_events = /* @__PURE__ */ new Map();
+  await Promise.all(
+    safe.map(async (stream) => {
+      const info = stream_info.get(stream);
+      if (info.resumed_guard) {
+        guarded.push(stream);
+        guard_events.set(stream, { id: info.resumed_guard.id, stream });
+        return;
+      }
+      const committed = await tombstone2(stream, info.version, correlation);
+      if (committed) {
+        guarded.push(stream);
+        guard_events.set(stream, { id: committed.id, stream });
+      } else {
+        skipped.push(stream);
+      }
+    })
+  );
+  return { guarded, guard_events };
+}
+async function load_restart_seeds(guarded, target_map, stream_info, event_to_state, load2, logger) {
+  const seed_states = /* @__PURE__ */ new Map();
+  await Promise.all(
+    guarded.filter((s) => target_map.get(s)?.restart).map(async (stream) => {
+      const last_event_name = stream_info.get(stream).last_event_name;
+      const owner_state = event_to_state.get(last_event_name);
+      if (!owner_state) {
+        logger.error(
+          `Cannot seed restart for "${stream}": no registered state owns event "${last_event_name}". Stream will be tombstoned instead.`
+        );
+        return;
+      }
+      const snap2 = await load2(owner_state, { stream });
+      seed_states.set(stream, snap2.state);
+    })
+  );
+  return seed_states;
+}
+async function run_archive_callbacks(guarded, target_map) {
+  for (const stream of guarded) {
+    const archive_fn = target_map.get(stream)?.archive;
+    if (archive_fn) await archive_fn();
+  }
+}
+async function heads_still_guarded(guarded, guard_events, skipped) {
+  const heads = await store().query_stats(guarded, {});
+  return guarded.filter((stream) => {
+    if (heads.get(stream)?.head.id === guard_events.get(stream).id)
+      return true;
+    skipped.push(stream);
+    return false;
+  });
+}
+async function truncate_and_warm_cache(guarded, seed_states, guard_events, correlation) {
+  const trunc_targets = guarded.map((stream) => {
+    const snapshot = seed_states.get(stream);
+    const guard = guard_events.get(stream);
+    return {
+      stream,
+      snapshot,
+      meta: {
+        correlation,
+        causation: {
+          event: { id: guard.id, name: TOMBSTONE_EVENT, stream: guard.stream }
+        }
+      }
+    };
+  });
+  const truncated = await store().truncate(trunc_targets);
+  await Promise.all(
+    guarded.map(async (stream) => {
+      const entry = truncated.get(stream);
+      const state2 = seed_states.get(stream);
+      if (state2 && entry) {
+        await cache().set(stream, {
+          stream,
+          state: state2,
+          version: entry.committed.version,
+          event_id: entry.committed.id,
+          patches: 0,
+          snaps: 1
+        });
+      } else {
+        await cache().invalidate(stream);
+      }
+    })
+  );
+  return truncated;
+}
+
+// src/internal/correlate-cycle.ts
+import { createHash, randomUUID as randomUUID2 } from "crypto";
+var COLD_START_BACK_SCAN = 1e4;
+var CORRELATION_LEASE_MS = 5e3;
+var registry_key = (events) => {
+  const shape = Object.keys(events).filter((name) => events[name].reactions.size > 0).sort().map((name) => [name, [...events[name].reactions.keys()].sort()]);
+  return createHash("sha256").update(JSON.stringify(shape)).digest("hex").slice(0, 32);
+};
+var PATTERN_CACHE_SIZE = 32;
+function report_undeclared_lane(seen, handler, target, lane, declared) {
+  report_once(
+    seen,
+    `lane|${handler}|${lane}`,
+    `Reaction "${handler}" resolved onto undeclared lane "${lane}" \u2014 for example target "${target}". Declared lanes: ${[...declared].map((l) => `"${l}"`).join(", ")}. No controller claims it, so the stream would never drain \u2014 running it on "default" instead. The equivalent static \`.to({ lane })\` is rejected at build; a dynamic resolver's lane is only knowable here.`
+  );
+}
+function report_lane_conflict(seen, handler, target, kept, dropped) {
+  report_once(
+    seen,
+    `conflict|${handler}|${kept}|${dropped}`,
+    `Reaction "${handler}" resolved lane "${dropped}" for a stream already on "${kept}" \u2014 for example "${target}". These are conflicting lane assignments from two dynamic resolutions at equal priority. Keeping "${kept}", the lane it was first discovered on \u2014 re-laning a live stream would move it out from under a worker holding its lease. The reaction resolving "${dropped}" runs inside the "${kept}" lane's budget, and a process restricted to "${dropped}" via onlyLanes never runs it. The equivalent static declaration is rejected at build; align the resolvers, or split the target.`
+  );
+}
+var CorrelateCycle = class {
+  _checkpoint = -1;
+  // Lease holder id; per instance, so a restart never inherits a stale claim.
+  _by = randomUUID2();
+  _key;
+  // Local expiry of the held lease (0 = none); stale only costs a duplicate scan.
+  _lease_until = 0;
+  // Armed while `_raised` (bumped by a commit or notification) is ahead of
+  // `_lowered` (the raise count the last short page saw). Starts armed.
+  _raised = 1;
+  _lowered = 0;
+  // Bumped by a release (shutdown), so a scan or lease reply that was out
+  // across one writes nothing.
+  _epoch = 0;
+  // Passes in flight: a restore waits for them, and refuses new ones.
+  _passes = /* @__PURE__ */ new Set();
+  _restoring = false;
+  _init_promise;
+  // Bounded by `maxSubscribedStreams`; static records live apart so eviction
+  // never lets a resolution re-lane them.
+  _dynamic_subscriptions;
+  _static_subscriptions = /* @__PURE__ */ new Map();
+  _patterns = new LruMap(PATTERN_CACHE_SIZE);
+  _registry;
+  _static_targets;
+  _cd;
+  _on_init;
+  _declared_lanes;
+  // Report-once keys; per instance because `internal/` holds no module state.
+  _reported = /* @__PURE__ */ new Set();
+  constructor({
+    registry,
+    static_targets,
+    cd,
+    max_subscribed_streams,
+    declared_lanes,
+    shard,
+    on_init
+  }) {
+    this._key = shard ? `${registry_key(registry.events)}:${[...shard].sort().join(",")}` : registry_key(registry.events);
+    this._dynamic_subscriptions = new LruMap(max_subscribed_streams);
+    this._registry = registry;
+    this._declared_lanes = declared_lanes;
+    this._static_targets = static_targets;
+    this._cd = cd;
+    this._on_init = on_init;
+  }
+  get checkpoint() {
+    return this._checkpoint;
+  }
+  /** A commit (local or remote) may have produced uncorrelated events. */
+  arm() {
+    this._raised++;
+  }
+  async _init() {
+    this._init_promise ??= this._run_init().catch((error) => {
+      this._init_promise = void 0;
+      throw error;
+    });
+    await this._init_promise;
+  }
+  async _run_init() {
+    const { watermark, correlated_at } = await this._cd.subscribe([
+      ...this._static_targets
+    ]);
+    this._checkpoint = correlated_at >= 0 ? correlated_at : Math.max(-1, watermark - COLD_START_BACK_SCAN);
+    for (const { stream, priority = 0, lane } of this._static_targets) {
+      this._static_subscriptions.set(stream, {
+        priority,
+        lane
+      });
+    }
+    await this._on_init?.();
+  }
+  /**
+   * Replace the log with no pass in flight, then cold-start: a pass that
+   * read the old log writes before the restore, never into the new one.
+   */
+  async restart(restore) {
+    this._restoring = true;
+    try {
+      await Promise.allSettled(this._passes);
+      await restore();
+    } finally {
+      this._restoring = false;
+    }
+    this._init_promise = void 0;
+    this._checkpoint = -1;
+    this._dynamic_subscriptions.clear();
+    this._static_subscriptions.clear();
+  }
+  /** Forget dynamic targets whose rows a full close deleted, so they re-subscribe. */
+  forget_subscribed(streams) {
+    for (const stream of streams) this._dynamic_subscriptions.delete(stream);
+  }
+  // Would the target's own `fetch` (filtered by `source`) return this event?
+  _in_fetch_window(source, stream) {
+    if (source === void 0 || source === stream) return true;
+    if (is_literal_source(source)) return false;
+    let pattern = this._patterns.get(source);
+    if (!pattern) {
+      pattern = new RegExp(source);
+      this._patterns.set(source, pattern);
+    }
+    return pattern.test(stream);
+  }
+  /** Scan past the checkpoint, subscribe new targets and raise their work marks. */
+  async correlate(limit, lease = false) {
+    if (this._restoring) return { kind: "idle", last_id: this._checkpoint };
+    const pass = this._scan(limit, lease);
+    this._passes.add(pass);
+    try {
+      return await pass;
+    } finally {
+      this._passes.delete(pass);
+    }
+  }
+  async _scan(limit, lease) {
+    await this._init();
+    const epoch = this._epoch;
+    const idle = () => ({
+      kind: "idle",
+      last_id: this._checkpoint
+    });
+    if (this._raised === this._lowered) return idle();
+    const raised = this._raised;
+    const now = Date.now();
+    if (lease && now >= this._lease_until - CORRELATION_LEASE_MS / 2) {
+      const { correlating } = await this._cd.subscribe([], void 0, {
+        key: this._key,
+        by: this._by,
+        millis: CORRELATION_LEASE_MS
+      });
+      if (this._epoch !== epoch) return idle();
+      this._lease_until = correlating ? now + CORRELATION_LEASE_MS : 0;
+      if (correlating === false) return idle();
+    }
+    const after = this._checkpoint;
+    const correlated = /* @__PURE__ */ new Map();
+    let last_id = after;
+    let stopped = false;
+    const found = await store().query(
+      (event) => {
+        if (stopped) return;
+        const register = this._registry.events[event.name];
+        if (register) {
+          for (const reaction of register.reactions.values()) {
+            let resolved;
+            try {
+              resolved = typeof reaction.resolver === "function" ? reaction.resolver(event) : reaction.resolver;
+            } catch (error) {
+              stopped = true;
+              report_once(
+                this._reported,
+                `resolver|${reaction.handler.name}|${event.id}`,
+                `Resolver of reaction "${reaction.handler.name}" threw on ${String(event.name)} #${event.id} (stream "${event.stream}"): ${String(error)}. Correlation stops before this event until the resolver stops throwing; work already found keeps draining.`
+              );
+              return;
+            }
+            if (!resolved) continue;
+            let lane = resolved.lane;
+            if (lane !== void 0 && !this._declared_lanes.has(lane)) {
+              report_undeclared_lane(
+                this._reported,
+                reaction.handler.name,
+                resolved.target,
+                lane,
+                this._declared_lanes
+              );
+              lane = void 0;
+            }
+            const fixed = this._static_subscriptions.get(resolved.target);
+            const recorded = fixed ?? this._dynamic_subscriptions.get(resolved.target);
+            const priority = resolved.priority ?? 0;
+            const upgraded = !recorded || !fixed && priority > recorded.priority;
+            const carried = upgraded ? { priority, lane } : { priority: recorded.priority, lane: recorded.lane };
+            const entry = correlated.get(resolved.target) || {
+              source: resolved.source,
+              priority: carried.priority,
+              lane: carried.lane,
+              upgraded,
+              missed: !recorded,
+              handler: reaction.handler.name,
+              correlated_at: void 0
+            };
+            const seen_in_scan = correlated.has(resolved.target);
+            const held_lane = (seen_in_scan ? entry.lane : recorded?.lane) ?? DEFAULT_LANE;
+            const held_priority = seen_in_scan ? entry.priority : recorded?.priority;
+            const resolved_lane = lane ?? DEFAULT_LANE;
+            if (held_priority === priority && held_lane !== resolved_lane)
+              report_lane_conflict(
+                this._reported,
+                reaction.handler.name,
+                resolved.target,
+                held_lane,
+                resolved_lane
+              );
+            if (carried.priority > entry.priority) {
+              entry.priority = carried.priority;
+              entry.lane = carried.lane;
+              entry.upgraded = upgraded;
+              entry.handler = reaction.handler.name;
+            }
+            if (this._in_fetch_window(resolved.source, event.stream))
+              entry.correlated_at = event.id;
+            correlated.set(resolved.target, entry);
+          }
+        }
+        last_id = event.id;
+      },
+      // Resolvers see `pii: null`: correlate runs actor-less, and one
+      // undecryptable row would otherwise stop every stream's reactions.
+      { after, limit, with_pii: false }
+    );
+    if (this._declared_lanes.size > 1) await this._recall(correlated);
+    const read = last_id > after;
+    if (this._epoch !== epoch) return idle();
+    const streams = [];
+    for (const [stream, entry] of correlated) {
+      if (entry.upgraded || entry.correlated_at !== void 0)
+        streams.push({
+          stream,
+          source: entry.source,
+          priority: entry.priority,
+          lane: entry.lane,
+          correlated_at: entry.correlated_at
+        });
+    }
+    if (streams.length) {
+      const renewed_at = Date.now();
+      const { subscribed, correlating } = await this._cd.subscribe(
+        streams,
+        last_id,
+        lease ? { key: this._key, by: this._by, millis: CORRELATION_LEASE_MS } : void 0
+      );
+      if (lease && correlating !== false)
+        this._lease_until = renewed_at + CORRELATION_LEASE_MS;
+      const marked = streams.filter(
+        (entry) => entry.correlated_at !== void 0
+      ).length;
+      this._checkpoint = last_id;
+      for (const { stream, priority, lane } of streams) {
+        if (correlated.get(stream)?.upgraded)
+          this._dynamic_subscriptions.set(stream, {
+            priority,
+            lane
+          });
+      }
+      return { kind: "scanned", last_id, subscribed, marked, read };
+    }
+    this._checkpoint = last_id;
+    if (!stopped && found !== limit) this._lowered = raised;
+    return { kind: "scanned", last_id, subscribed: 0, marked: 0, read };
   }
-  async drain(options = {}) {
-    if (!this.armed || this._stopped || this._inflight)
-      return EMPTY_DRAIN;
-    const d = this._deps.defaults ?? {};
-    const streamLimit = d.streamLimit ?? options.streamLimit ?? DEFAULT_STREAM_LIMIT;
-    const eventLimit = options.eventLimit ?? DEFAULT_EVENT_LIMIT;
-    const leaseMillis = d.leaseMillis ?? options.leaseMillis ?? DEFAULT_LEASE_MILLIS;
-    if (this._deps.breaker.state(Date.now()) === "open")
-      return EMPTY_DRAIN;
-    const pass = this._pass(streamLimit, eventLimit, leaseMillis).finally(
-      () => {
-        this._inflight = void 0;
-      }
+  // Read the row of each target this scan had no record of (new or evicted),
+  // so a resolution that doesn't beat its priority keeps the row's lane.
+  // Only called with more than one lane declared.
+  async _recall(correlated) {
+    const missed = [...correlated].filter(([, entry]) => entry.missed);
+    await Promise.all(
+      missed.map(async ([stream, entry]) => {
+        let row;
+        await store().query_streams(
+          (position) => {
+            row = position;
+          },
+          { stream, stream_exact: true, limit: 1 }
+        );
+        if (!row) return;
+        this._dynamic_subscriptions.set(stream, {
+          priority: row.priority,
+          lane: row.lane
+        });
+        if (entry.priority > row.priority) return;
+        const held_lane = row.lane ?? DEFAULT_LANE;
+        const resolved_lane = entry.lane ?? DEFAULT_LANE;
+        if (entry.priority === row.priority && held_lane !== resolved_lane)
+          report_lane_conflict(
+            this._reported,
+            entry.handler,
+            stream,
+            held_lane,
+            resolved_lane
+          );
+        entry.priority = row.priority;
+        entry.lane = row.lane;
+        entry.upgraded = false;
+      })
     );
-    this._inflight = pass;
-    return pass;
   }
-  // One claim → fetch → handle → ack pass. Never throws.
-  async _pass(streamLimit, eventLimit, leaseMillis) {
+  /** Release the lease early by re-acquiring it for zero ms. Best-effort. */
+  async release_correlation() {
     try {
-      const lagging = Math.ceil(streamLimit * this._ratio);
-      const leading = streamLimit - lagging;
-      const started = Date.now();
-      const raised = this._raised;
-      const cycle = await run_drain_cycle(this._deps, {
-        lagging,
-        leading,
-        eventLimit,
-        leaseMillis,
-        misrouted: this._misrouted,
-        store_failing: this._deps.breaker.failing
+      this._lease_until = 0;
+      this._epoch++;
+      await this._cd.subscribe([], void 0, {
+        key: this._key,
+        by: this._by,
+        millis: 0
       });
-      if (!cycle) {
-        this._defer.prune(started);
-        this._deps.breaker.passed();
-        this._lowered = raised;
-        return EMPTY_DRAIN;
-      }
-      const { leased, fetched, handled, acked, blocked, closeable } = cycle;
-      trace_cycle(this._deps.logger, leased, fetched, handled, acked, blocked);
-      this._ratio = compute_lag_lead_ratio(handled, lagging, leading);
-      for (const lease of acked) this._defer.delete(lease.stream);
-      for (const lease of blocked) this._defer.delete(lease.stream);
-      for (const h of handled) {
-        const next = h.defer ?? h.next_attempt_at;
-        if (next !== void 0) this._defer.set(h.lease.stream, next);
-      }
-      if (acked.length) this._deps.on_acked(acked);
-      if (closeable.length) await this._deps.on_close(closeable);
-      this._deps.breaker.passed();
-      return { fetched, leased, acked, blocked };
     } catch (error) {
-      this._defer.set(
-        RETRY,
-        Date.now() + Math.max(leaseMillis, this._deps.breaker.cooldown_ms)
+      log().warn(
+        `Could not hand back the correlation lease during shutdown; it expires on its own within ${CORRELATION_LEASE_MS}ms and correlation resumes normally after that. On a single-writer store this usually means another connection holds the database. Cause: ${String(error.cause ?? error)}`
       );
-      this._deps.breaker.failed(Date.now(), error);
-      return EMPTY_DRAIN;
-    } finally {
-      if (!this._stopped) this._defer.schedule();
     }
   }
 };
@@ -2657,191 +3159,15 @@ function make_fold_handler(me, flush, config2, sensitive_fields) {
       } else {
         fold.dirty = true;
       }
-      if (++folded_since_flush >= config2.flushEvery) {
-        await flush_dirty();
-        folded_since_flush = 0;
-      }
-    }
-    await flush_dirty();
-  };
-  Object.defineProperty(handler, FOLD_RESET, { value: () => cache2.clear() });
-  return handler;
-}
-
-// src/internal/defer-config.ts
-import { z } from "zod";
-var DeferDurationSchema = z.object({
-  days: z.number().positive().optional(),
-  hours: z.number().positive().optional(),
-  minutes: z.number().positive().optional()
-}).strict().refine((d) => d.days != null || d.hours != null || d.minutes != null, {
-  message: "defer: a duration needs at least one of days, hours, or minutes"
-});
-var DeferWhenSchema = z.object({
-  after: DeferDurationSchema.optional(),
-  at: z.date().optional()
-}).strict().refine((w) => w.after === void 0 !== (w.at === void 0), {
-  message: "defer: specify exactly one of `after` or `at`"
-});
-function duration_ms(d) {
-  return (d.days ?? 0) * 864e5 + (d.hours ?? 0) * 36e5 + (d.minutes ?? 0) * 6e4;
-}
-function resolve_defer_at(when, event) {
-  const parsed = DeferWhenSchema.parse(when);
-  if (parsed.after) return event.created.getTime() + duration_ms(parsed.after);
-  return parsed.at.getTime();
-}
-function assert_defer_when(when) {
-  DeferWhenSchema.parse(when);
-}
-function make_deferred(handler, schedule) {
-  const call = handler;
-  const deferred = async (event, stream, app) => {
-    const when = typeof schedule === "function" ? schedule(event) : schedule;
-    if (Date.now() < resolve_defer_at(when, event)) throw new DeferSignal(when);
-    return call(event, stream, app);
-  };
-  Object.defineProperty(deferred, "name", { value: handler.name });
-  return deferred;
-}
-
-// src/internal/reaction-dispatch.ts
-var CloseSignal = class extends Error {
-  /**
-   * Stream to close. Omitted → the reaction's own lease stream (a self-close).
-   * The synthesized autoclose reaction sets it to the aggregate stream, since
-   * its lease runs on a synthetic `__autoclose__` target.
-   */
-  stream;
-  /** Optional archive callback to run while the stream is guarded. */
-  archive;
-  /**
-   * Watermark to ack the requesting reaction to before the close runs. The
-   * close-cycle safety guard skips a stream whose subscriptions (matched by
-   * source) lag the head; the autoclose reaction's `source` is the aggregate,
-   * so it must advance its own watermark to the live head id it evaluated
-   * against — otherwise it blocks its own close. Defaults to the triggering
-   * event id when omitted.
-   */
-  at;
-  /**
-   * Windowed close: prune events older than this cutoff behind
-   * the closest safe snapshot instead of retiring the stream. Thrown by
-   * the autoclose reaction of a `.autocloses({ keep })` state; flows
-   * into {@link CloseTarget.before}. Omitted → a full close.
-   */
-  before;
-  constructor(opts) {
-    super("reaction requested close");
-    this.name = "CloseSignal";
-    this.stream = opts?.stream;
-    this.archive = opts?.archive;
-    this.at = opts?.at;
-    this.before = opts?.before;
-  }
-};
-function build_handle(deps) {
-  const { logger, reaction_scope } = deps;
-  return async (lease, payloads) => {
-    if (payloads.length === 0) return { lease, handled: 0, acked_at: lease.at };
-    const stream = lease.stream;
-    const last_index_of = /* @__PURE__ */ new Map();
-    for (let i = 0; i < payloads.length; i++)
-      last_index_of.set(payloads[i].event.id, i);
-    let at = lease.at;
-    let handled = 0;
-    if (lease.retry > 0)
-      logger.warn(
-        `Retrying ${stream}@${payloads.at(0).event.id} (${lease.retry}).`
-      );
-    for (let i = 0; i < payloads.length; i++) {
-      const payload = payloads[i];
-      const { event, handler } = payload;
-      try {
-        await reaction_scope.run(
-          event,
-          () => handler(event, stream, reaction_scope.app)
-        );
-        if (last_index_of.get(event.id) === i) {
-          at = event.id;
-          handled++;
-        }
-      } catch (error) {
-        if (error instanceof DeferSignal) {
-          let defer;
-          try {
-            defer = resolve_defer_at(error.when, event);
-          } catch (invalid) {
-            return finalize(
-              lease,
-              handled,
-              at,
-              invalid,
-              payload.options,
-              logger,
-              event.id
-            );
-          }
-          return { lease, handled, acked_at: at, defer };
-        }
-        if (error instanceof CloseSignal)
-          return {
-            lease,
-            handled: handled + 1,
-            // Advance to the live head the handler evaluated against (when
-            // provided) so the close-cycle guard sees this reaction caught up.
-            acked_at: error.at ?? event.id,
-            // Close the signalled stream (the autoclose reaction's aggregate,
-            // which differs from its synthetic lease stream); a self-closing
-            // user reaction omits it and closes its own lease stream. A
-            // carried `before` makes it a windowed close (prune, not retire).
-            close: {
-              stream: error.stream ?? stream,
-              archive: error.archive,
-              before: error.before
-            }
-          };
-        return finalize(
-          lease,
-          handled,
-          at,
-          error,
-          payload.options,
-          logger,
-          event.id
-        );
+      if (++folded_since_flush >= config2.flushEvery) {
+        await flush_dirty();
+        folded_since_flush = 0;
       }
     }
-    return finalize(lease, handled, at, void 0, payloads[0].options, logger);
-  };
-}
-function build_handle_batch(logger) {
-  return async (lease, payloads, batchHandler) => {
-    const stream = lease.stream;
-    const events = [];
-    const seen = /* @__PURE__ */ new Set();
-    for (const p of payloads) {
-      if (seen.has(p.event.id)) continue;
-      seen.add(p.event.id);
-      events.push(p.event);
-    }
-    const options = payloads[0].options;
-    if (lease.retry > 0)
-      logger.warn(`Retrying batch ${stream}@${events[0].id} (${lease.retry}).`);
-    try {
-      await batchHandler(events, stream);
-      return finalize(
-        lease,
-        events.length,
-        events.at(-1).id,
-        void 0,
-        options,
-        logger
-      );
-    } catch (error) {
-      return finalize(lease, 0, lease.at, error, options, logger);
-    }
+    await flush_dirty();
   };
+  Object.defineProperty(handler, FOLD_RESET, { value: () => cache2.clear() });
+  return handler;
 }
 
 // src/internal/settle.ts
@@ -3061,6 +3387,7 @@ var Act = class {
     this._lanes = lanes;
     this._declared_lanes = ["default", ...lanes.map((l) => l.name)];
     validate_only_lanes(options.onlyLanes, this._declared_lanes);
+    if (options.scoped) check_store(options.scoped.store);
     this._ports = options.scoped ?? default_scope();
     const ports = this._ports;
     this._scoped = make_run_scoped({
@@ -3316,7 +3643,7 @@ var Act = class {
    * Executes an action: validates the payload, loads the state, checks its
    * preconditions, runs the handler, folds the events it emits, checks the
    * state's invariants (its schema) on the result, and commits them with
-   * optimistic concurrency on the stream. The reactions to those events
+   * optimistic concurrency on every stream it appends to. The reactions to those events
    * settle on their own (unless `autoSettle: false`).
    *
    * @template TKey - Action name from registered actions
@@ -3326,7 +3653,8 @@ var Act = class {
    * @param options - Per-call dispatch options ({@link DoOptions}) —
    *   `reactingTo` to thread correlation, `correlator` to override the
    *   framework or orchestrator-level correlator for this call only.
-   * @returns Array of snapshots for all affected states (usually one)
+   * @returns The snapshots of the action's own stream, one per event appended
+   *   to it; the loaded snapshot alone when the action commits nothing
    *
    * @throws {ValidationError} If the payload doesn't match the action schema,
    *   or the state the action leaves breaks the state schema
@@ -3363,13 +3691,22 @@ var Act = class {
         do_options
       );
       if (!snapshots[0].patch) return snapshots;
+      const me = this.registry.actions[action2];
       this._wake(snapshots.map((s) => s.event.name));
-      this.emit("committed", snapshots);
-      this._notify(
-        `committed:${this.registry.actions[action2].name}`,
-        snapshots
-      );
-      return snapshots;
+      const by_stream = /* @__PURE__ */ new Map();
+      for (const s of snapshots) {
+        const of_stream = by_stream.get(s.event.stream);
+        if (of_stream) of_stream.push(s);
+        else by_stream.set(s.event.stream, [s]);
+      }
+      for (const [stream, of_stream] of by_stream) {
+        const owner = stream === target.stream ? me : me.loads[action2].find(
+          (l) => l.events.includes(of_stream[0].event.name)
+        ).state;
+        this.emit("committed", of_stream);
+        this._notify(`committed:${owner.name}`, of_stream);
+      }
+      return snapshots.filter((s) => s.event.stream === target.stream);
     });
   }
   async load(stateOrName, streamOrTarget, callback, asOf) {
@@ -3963,217 +4300,6 @@ var Act = class {
   }
 };
 
-// src/internal/autoclose-policy.ts
-import { z as z2 } from "zod";
-var DAY_MS = 864e5;
-var MIN_AFTER_DAYS = 1 / 1440;
-var MIN_KEEP_DAYS = 1;
-function days_after(date, days) {
-  return new Date(date.getTime() + days * DAY_MS);
-}
-function days_before_now(days) {
-  return new Date(Date.now() - days * DAY_MS);
-}
-var window_schema = (field, min_days, floor) => z2.object({
-  days: z2.number({ message: `autocloses: ${field}.days must be a number` }).positive(`autocloses: ${field}.days must be > 0`)
-}).refine((o) => o.days >= min_days, {
-  message: `autocloses: ${field} resolves to < ${floor}, which is too short to be a meaningful retention window`
-});
-var AfterSchema = window_schema("after", MIN_AFTER_DAYS, "one minute");
-var KeepSchema = window_schema("keep", MIN_KEEP_DAYS, "one day");
-var IsSchema = z2.union([
-  z2.string().min(1, "autocloses: is must be a non-empty event name"),
-  z2.array(
-    z2.string().min(1, "autocloses: is entries must be non-empty event names")
-  ).min(1, "autocloses: is must include at least one event name").readonly()
-]);
-var ReachesSchema = z2.number({ message: "autocloses: reaches must be a number" }).int("autocloses: reaches must be an integer").min(1, "autocloses: reaches must be >= 1");
-var OrBlockSchema = z2.object({
-  after: AfterSchema.optional(),
-  is: IsSchema.optional(),
-  reaches: ReachesSchema.optional()
-}).strict().refine(
-  (o) => o.after !== void 0 || o.is !== void 0 || o.reaches !== void 0,
-  {
-    message: "autocloses: `or` block must include at least one of after / is / reaches"
-  }
-);
-var AutoclosePolicySchema = z2.object({
-  after: AfterSchema.optional(),
-  is: IsSchema.optional(),
-  reaches: ReachesSchema.optional(),
-  or: OrBlockSchema.optional(),
-  keep: KeepSchema.optional()
-}).strict().refine(
-  (o) => o.after !== void 0 || o.is !== void 0 || o.reaches !== void 0 || o.or !== void 0 || o.keep !== void 0,
-  {
-    message: "autocloses: at least one of after / is / reaches / or / keep must be specified \u2014 empty `{}` is a misconfiguration"
-  }
-);
-function compile_after(after) {
-  return (_stream, head) => days_after(head.created, after.days) <= /* @__PURE__ */ new Date();
-}
-function compile_is(is) {
-  const set = new Set(typeof is === "string" ? [is] : is);
-  return (_stream, head) => set.has(head.name);
-}
-function compile_reaches(reaches) {
-  return (_stream, _head, count) => count >= reaches;
-}
-function policy_min_after_days(options) {
-  const parsed = AutoclosePolicySchema.parse(options);
-  const windows = [];
-  if (parsed.after) windows.push(parsed.after.days);
-  if (parsed.or?.after) windows.push(parsed.or.after.days);
-  return windows.length ? Math.min(...windows) : void 0;
-}
-function policy_after_windows(options) {
-  const parsed = AutoclosePolicySchema.parse(options);
-  return [parsed.after, parsed.or?.after].flatMap((w) => w ? [w.days] : []);
-}
-function policy_keep_days(options) {
-  const parsed = AutoclosePolicySchema.parse(options);
-  return parsed.keep?.days;
-}
-function compile_autoclose_policy(options) {
-  const parsed = AutoclosePolicySchema.parse(options);
-  const and_preds = [];
-  if (parsed.after) and_preds.push(compile_after(parsed.after));
-  if (parsed.is) and_preds.push(compile_is(parsed.is));
-  if (parsed.reaches) and_preds.push(compile_reaches(parsed.reaches));
-  const or_preds = [];
-  if (parsed.or) {
-    if (parsed.or.after) or_preds.push(compile_after(parsed.or.after));
-    if (parsed.or.is) or_preds.push(compile_is(parsed.or.is));
-    if (parsed.or.reaches) or_preds.push(compile_reaches(parsed.or.reaches));
-  }
-  return (stream, head, count) => {
-    if (and_preds.length > 0 && and_preds.every((p) => p(stream, head, count))) {
-      return true;
-    }
-    if (or_preds.some((p) => p(stream, head, count))) {
-      return true;
-    }
-    return false;
-  };
-}
-
-// src/internal/autoclose-window.ts
-function hour_in_zone(now, timeZone) {
-  const parts = new Intl.DateTimeFormat("en-US", {
-    timeZone,
-    hour: "2-digit",
-    hourCycle: "h23"
-  }).formatToParts(now);
-  return Number(parts.find((p) => p.type === "hour")?.value);
-}
-function hour_in_range(hour, start, end) {
-  return start < end ? hour >= start && hour < end : hour >= start || hour < end;
-}
-function is_dst_gap_open(now, timeZone, start) {
-  const hour = hour_in_zone(now, timeZone);
-  if (hour <= start) return false;
-  const prev = hour_in_zone(new Date(now.getTime() - 36e5), timeZone);
-  return prev === start - 1 && hour === start + 1;
-}
-function in_autoclose_window(window, now) {
-  if (!window) return true;
-  const hour = hour_in_zone(now, window.timeZone);
-  return hour_in_range(hour, window.start, window.end) || is_dst_gap_open(now, window.timeZone, window.start);
-}
-function next_window_open(window, now) {
-  const start_ms = now.getTime();
-  for (let h = 0; h <= 48; h++) {
-    const candidate = new Date(start_ms + h * 36e5);
-    if (hour_in_zone(candidate, window.timeZone) === window.start)
-      return candidate;
-    const boundary = new Date(
-      candidate.getTime() - candidate.getTime() % 36e5
-    );
-    if (boundary.getTime() >= start_ms && is_dst_gap_open(boundary, window.timeZone, window.start))
-      return boundary;
-  }
-  return new Date(start_ms + 864e5);
-}
-
-// src/internal/autoclose-reaction.ts
-var AUTOCLOSE_TARGET_PREFIX = "__autoclose__:";
-function synthesize_autoclose_reactions(registry, states, read_window) {
-  for (const st of states.values()) {
-    const predicate = st.autoclose;
-    if (!predicate) continue;
-    const after_windows = st.autoclose_after_windows;
-    const keep_days = st.autoclose_keep_days;
-    const archiver = st.archive;
-    const reaction = {
-      // Run on a SYNTHETIC stream — `source` is the aggregate, `target` is a
-      // per-aggregate `__autoclose__` key — so the autoclose reaction never
-      // shares a watermark with the aggregate's own reactions. A shared
-      // watermark would let autoclose's defer short-circuit the aggregate's
-      // other reactions (the "a defer affects all reactions on a stream"
-      // hazard). The close still targets the aggregate (`source`).
-      // A stream name with a regex metacharacter would read as a pattern, and a
-      // store may refuse it at subscribe, stopping every reaction. Such a stream
-      // has no autoclose: `app.close` still closes it.
-      resolver: (e) => is_literal_source(e.stream) ? {
-        target: `${AUTOCLOSE_TARGET_PREFIX}${e.stream}`,
-        source: e.stream
-      } : void 0,
-      // Never block on autoclose: a transient query/store error should retry,
-      // not quarantine the synthetic stream.
-      options: { blockOnError: false, maxRetries: DEFAULT_MAX_RETRIES },
-      handler: async (event) => {
-        const aggregate = event.stream;
-        const window = read_window();
-        if (!in_autoclose_window(window, /* @__PURE__ */ new Date()))
-          throw new DeferSignal({ at: next_window_open(window, /* @__PURE__ */ new Date()) });
-        const stats = await store().query_stats([aggregate], {
-          count: true,
-          tail: keep_days !== void 0 ? true : void 0,
-          exclude: [TOMBSTONE_EVENT, SNAP_EVENT]
-        });
-        const entry = stats.get(aggregate);
-        if (!entry) return;
-        const head = entry.head;
-        if (predicate(aggregate, head, entry.count))
-          throw new CloseSignal({
-            stream: aggregate,
-            archive: archiver ? () => archiver(aggregate, head) : void 0,
-            // Ack this reaction's own watermark to the live head so the
-            // close-cycle guard (which matches subscriptions by source =
-            // aggregate) sees it caught up instead of blocking its own close.
-            at: head.id
-          });
-        if (keep_days !== void 0) {
-          const cutoff = days_before_now(keep_days);
-          if (entry.tail.created < cutoff)
-            throw new CloseSignal({
-              stream: aggregate,
-              before: cutoff,
-              archive: archiver ? () => archiver(aggregate, head, cutoff) : void 0,
-              at: head.id
-            });
-        }
-        const dues = [];
-        for (const days of after_windows)
-          dues.push(days_after(head.created, days));
-        if (keep_days !== void 0)
-          dues.push(days_after(entry.tail.created, keep_days));
-        const future = dues.map((d) => d.getTime()).filter((t) => t > Date.now());
-        if (future.length)
-          throw new DeferSignal({ at: new Date(Math.min(...future)) });
-      }
-    };
-    const key = `__autoclose_${st.name}`;
-    for (const event_name of Object.keys(st.events)) {
-      registry.events[event_name]?.reactions.set(
-        key,
-        reaction
-      );
-    }
-  }
-}
-
 // src/builders/merge.ts
 import { ZodObject } from "zod";
 function base_type_name(zodType) {
@@ -4273,8 +4399,8 @@ function merge_into_existing(state2, existing, states, actions, events) {
     actions: { ...existing.actions, ...state2.actions },
     patch: merged_patch,
     on: { ...existing.on, ...state2.on },
-    given: { ...existing.given, ...state2.given },
     requires: { ...existing.requires, ...state2.requires },
+    loads: existing.loads || state2.loads ? { ...existing.loads, ...state2.loads } : void 0,
     snap: pick_declared(existing.snap, state2.snap, "snap strategy", state2.name),
     // Per-action retry policy is keyed by action name, so the two partials'
     // maps combine. Left `undefined` when neither declared one, so the
@@ -4433,25 +4559,47 @@ import { z as z4 } from "zod";
 
 // src/internal/date-reviver.ts
 import { z as z3 } from "zod";
-function variant_schema(schema) {
+function variant_schema(schema, walk) {
   const shape = def_of(schema)?.shape;
   if (!shape) {
-    const dates = date_reviver_schema(schema);
+    const dates = walk(schema);
     return { schema: dates ?? schema, dated: !!dates };
   }
   const next = {};
   let dated = false;
   for (const [key, field] of Object.entries(shape)) {
-    const dates = date_reviver_schema(field);
+    const dates = walk(field);
     if (dates) dated = true;
     next[key] = (dates ?? field).optional();
   }
   return { schema: z3.looseObject(next), dated };
 }
 function date_reviver_schema(schema) {
+  let recursive = false;
+  const pass = (tie) => {
+    const done = /* @__PURE__ */ new Map();
+    const active = /* @__PURE__ */ new Set();
+    const walk = (node) => {
+      if (done.has(node)) return done.get(node);
+      if (active.has(node)) {
+        recursive = true;
+        return tie ? z3.lazy(() => done.get(node)) : void 0;
+      }
+      active.add(node);
+      const result = build(node, walk);
+      active.delete(node);
+      done.set(node, result);
+      return result;
+    };
+    return walk(schema);
+  };
+  const first = pass(false);
+  return first && recursive ? pass(true) : first;
+}
+function build(schema, walk) {
   const def = def_of(schema);
   if (!def) return void 0;
-  const inner = () => date_reviver_schema(def.innerType);
+  const inner = () => walk(def.innerType);
   switch (def.type) {
     case "date":
       return z3.coerce.date();
@@ -4460,31 +4608,40 @@ function date_reviver_schema(schema) {
       if (!shape) return void 0;
       const dated = {};
       for (const [key, field] of Object.entries(shape)) {
-        const dates = date_reviver_schema(field);
+        const dates = walk(field);
         if (dates) dated[key] = dates.optional();
       }
       return Object.keys(dated).length ? z3.looseObject(dated) : void 0;
     }
     case "array": {
-      const element = date_reviver_schema(def.element);
+      const element = walk(def.element);
       return element && z3.array(element);
     }
     case "tuple": {
-      const items = def.items.map((i) => date_reviver_schema(i));
+      const items = def.items.map((i) => walk(i));
       return items.some(Boolean) ? z3.tuple(items.map((i) => i ?? z3.unknown())) : void 0;
     }
     case "record": {
-      const value = date_reviver_schema(def.valueType);
+      const value = walk(def.valueType);
       return value && z3.record(z3.string(), value);
     }
     case "union": {
-      const variants = def.options.map(variant_schema);
+      const variants = def.options.map(
+        (o) => variant_schema(o, walk)
+      );
       return variants.some((v) => v.dated) ? z3.union(variants.map((v) => v.schema)) : void 0;
     }
     case "nullable":
       return inner()?.nullable();
     case "pipe":
-      return date_reviver_schema(def.out);
+      return walk(def.out);
+    case "lazy":
+      return walk(def.getter());
+    case "intersection": {
+      const left = walk(def.left);
+      const right = walk(def.right);
+      return left && right ? left.pipe(right) : left ?? right;
+    }
     default:
       return inner_of(def) ? inner() : void 0;
   }
@@ -4808,6 +4965,38 @@ function act() {
         for (const [name, gate] of built.handler_readers) _hr.set(name, gate);
         finalize_deprecations();
         if (built.advisory) log().warn(built.advisory);
+        for (const [name, state2] of states) {
+          if (!state2.loads) continue;
+          const resolved = {};
+          for (const [action2, loads] of Object.entries(state2.loads)) {
+            resolved[action2] = loads.map((l) => {
+              const registered = states.get(l.state.name);
+              if (!registered)
+                throw new Error(
+                  `Action "${action2}" loads "${l.state.name}", which is not registered \u2014 add it via withState/withSlice before build()`
+                );
+              const deprecated = l.events.find(
+                (e) => _de.get(registered.name)?.has(e)
+              );
+              if (deprecated)
+                throw new Error(
+                  `Action "${action2}" lists deprecated event "${deprecated}" on its load of "${registered.name}". A newer version exists: "${current_version_of(deprecated, Object.keys(registered.events))}". List the current version instead.`
+                );
+              return { ...l, state: registered };
+            });
+          }
+          for (const [action2, loads] of Object.entries(resolved)) {
+            const static_target = state2.on[action2]._static_emit;
+            if (static_target && loads.some((l) => l.events.includes(static_target)))
+              throw new Error(
+                `Action "${action2}" statically emits "${static_target}", which its load lists, so nothing goes to its own stream; emit one of its own events too`
+              );
+          }
+          const own = { ...state2, loads: resolved };
+          states.set(name, own);
+          for (const action2 of Object.keys(own.actions))
+            registry.actions[action2] = own;
+        }
         for (const state2 of states.values()) {
           if (state2.disclose) _dp.set(state2.name, state2.disclose);
           if (state2.autoclose) _ac.set(state2.name, state2.autoclose);
@@ -5048,9 +5237,25 @@ function action_builder(state2) {
         internal.options ??= {};
         internal.options[action2] = options;
       }
-      function given(rules) {
-        (internal.given ??= {})[action2] = rules;
-        return { requires, emit };
+      const loads = [];
+      function load2(state3, target, events = [], name = state3.name) {
+        if (loads.some((l) => l.name === name))
+          throw new Error(
+            `Action "${action2}" loads "${name}" twice; name each load of the same state`
+          );
+        for (const event of events) {
+          if (!(event in state3.events))
+            throw new Error(
+              `Action "${action2}" lists "${event}" on its load of "${state3.name}", which doesn't emit it`
+            );
+          if (loads.some((l) => l.events.includes(event)))
+            throw new Error(
+              `Action "${action2}" lists "${event}" on two loads; an event goes to one stream`
+            );
+        }
+        loads.push({ state: state3, target, events, name });
+        (internal.loads ??= {})[action2] = loads;
+        return { loads: load2, requires, emit };
       }
       function requires(rules) {
         (internal.requires ??= {})[action2] = rules;
@@ -5071,7 +5276,7 @@ function action_builder(state2) {
         }
         return builder;
       }
-      return { given, requires, emit };
+      return { loads: load2, requires, emit };
     },
     snap(snap2) {
       internal.snap = snap2;
@@ -5295,6 +5500,7 @@ export {
   CsvFile,
   DEFAULT_LANE,
   DEFAULT_MAX_SUBSCRIBED_STREAMS,
+  DEFAULT_QUERY_STREAMS_LIMIT,
   DEFAULT_SETTLE_DEBOUNCE_MS,
   DeferSignal,
   Environments,
@@ -5303,7 +5509,6 @@ export {
   ExitCodes,
   InMemoryCache,
   InMemoryStore,
-  InvariantError,
   LogLevels,
   NonRetryableError,
   PackageSchema,
@@ -5320,12 +5525,14 @@ export {
   ZodEmpty,
   act,
   cache,
+  check_appends,
   config,
   dateReviver,
   default_scope,
   dispose,
   disposeAndExit,
   extend,
+  fair_slots,
   is_literal_source,
   log,
   pii_fields,