@rotorsoft/act 1.9.0 → 1.10.1

package/dist/index.js

@@ -19,7 +19,7 @@ import {
   sleep,
   store,
   validate
-} from "./chunk-F4S2JOPN.js";
+} from "./chunk-3Z2HU726.js";
 import {
   ActorSchema,
   CausationEventSchema,
@@ -32,11 +32,19 @@ import {
   LogLevels,
   NonRetryableError,
   QuerySchema,
+  REDACTED,
+  SHREDDED,
   StreamClosedError,
   TargetSchema,
   ValidationError,
-  ZodEmpty
-} from "./chunk-PMAZTOSO.js";
+  ZodEmpty,
+  pii_fields,
+  pii_gate,
+  pii_merge,
+  pii_split,
+  pii_strip,
+  sensitive
+} from "./chunk-BY5JPOZR.js";
 import "./chunk-5WRI5ZAA.js";
 
 // src/signals.ts
@@ -70,7 +78,7 @@ function parse(name) {
   }
   return { base: name, version: 1 };
 }
-function deprecatedEventNames(names) {
+function deprecated_event_names(names) {
   const groups = /* @__PURE__ */ new Map();
   for (const name of names) {
     const { base, version } = parse(name);
@@ -86,10 +94,10 @@ function deprecatedEventNames(names) {
   }
   return deprecated;
 }
-function currentVersionOf(deprecatedName, allNames) {
-  const target = parse(deprecatedName);
+function current_version_of(deprecated_name, all_names) {
+  const target = parse(deprecated_name);
   let highest;
-  for (const name of allNames) {
+  for (const name of all_names) {
     const { base, version } = parse(name);
     if (base !== target.base) continue;
     if (!highest || version > highest.version) highest = { version, name };
@@ -119,27 +127,27 @@ var ALL_CATEGORIES = [
 ];
 async function* audit(deps, categories, options = {}) {
   const requested = new Set(categories ?? [...ALL_CATEGORIES]);
-  const orderedCategories = ALL_CATEGORIES.filter((c) => requested.has(c));
-  const passes = orderedCategories.map(
+  const ordered_categories = ALL_CATEGORIES.filter((c) => requested.has(c));
+  const passes = ordered_categories.map(
     (c) => PASS_FACTORIES[c](deps, options)
   );
-  const needStats = passes.some((p) => p.onStat !== void 0);
-  const needStreams = passes.some((p) => p.onStream !== void 0);
-  const needEvents = passes.some((p) => p.onEvent !== void 0);
-  if (needStats) {
+  const need_stats = passes.some((p) => p.on_stat !== void 0);
+  const need_streams = passes.some((p) => p.on_stream !== void 0);
+  const need_events = passes.some((p) => p.on_event !== void 0);
+  if (need_stats) {
     const stats = await deps.store().query_stats({}, { count: true, names: true });
     for (const [stream, s] of stats) {
-      for (const p of passes) p.onStat?.(stream, s);
+      for (const p of passes) p.on_stat?.(stream, s);
     }
   }
-  if (needStreams) {
+  if (need_streams) {
     await deps.store().query_streams((pos) => {
-      for (const p of passes) p.onStream?.(pos);
+      for (const p of passes) p.on_stream?.(pos);
     });
   }
-  if (needEvents) {
+  if (need_events) {
     await deps.store().query((event) => {
-      for (const p of passes) p.onEvent?.(event);
+      for (const p of passes) p.on_event?.(event);
     }, options.query);
   }
   for (const p of passes) await p.finalize?.(deps);
@@ -147,11 +155,11 @@ async function* audit(deps, categories, options = {}) {
     for (const f of p.drain()) yield f;
   }
 }
-var makeSchemaPass = (deps) => {
+var make_schema_pass = (deps) => {
   const findings = [];
   return {
     category: "schema",
-    onEvent(event) {
+    on_event(event) {
       const name = String(event.name);
       const state2 = deps.event_to_state.get(name);
       if (!state2) {
@@ -181,19 +189,19 @@ var makeSchemaPass = (deps) => {
     drain: () => findings
   };
 };
-var makeDeprecatedLoadPass = (deps, options) => {
+var make_deprecated_load_pass = (deps, options) => {
   const share_min = options.thresholds?.deprecated_min ?? DEFAULTS.deprecated_min;
   const totals = /* @__PURE__ */ new Map();
-  const perStream = /* @__PURE__ */ new Map();
+  const per_stream = /* @__PURE__ */ new Map();
   return {
     category: "deprecated-load",
-    onStat(stream, { names }) {
+    on_stat(stream, { names }) {
       for (const [name, count] of Object.entries(names)) {
         totals.set(name, (totals.get(name) ?? 0) + count);
-        let m = perStream.get(name);
+        let m = per_stream.get(name);
         if (!m) {
           m = /* @__PURE__ */ new Map();
-          perStream.set(name, m);
+          per_stream.set(name, m);
         }
         m.set(stream, count);
       }
@@ -202,33 +210,33 @@ var makeDeprecatedLoadPass = (deps, options) => {
       const findings = [];
       const grand = [...totals.values()].reduce((s, n) => s + n, 0);
       if (grand === 0) return findings;
-      const deprecated = deprecatedEventNames(deps.known_events);
+      const deprecated = deprecated_event_names(deps.known_events);
       const sorted = [...deprecated].map((name) => ({ name, count: totals.get(name) ?? 0 })).sort((a, b) => b.count - a.count);
       for (const { name, count } of sorted) {
         if (count === 0) continue;
         if (count / grand < share_min) continue;
-        const currentVersion = currentVersionOf(name, deps.known_events);
-        const topStreams = [...perStream.get(name).entries()].map(([stream, c]) => ({ stream, count: c })).sort((a, b) => b.count - a.count).slice(0, 10);
+        const current_version = current_version_of(name, deps.known_events);
+        const top_streams = [...per_stream.get(name).entries()].map(([stream, c]) => ({ stream, count: c })).sort((a, b) => b.count - a.count).slice(0, 10);
         findings.push({
           category: "deprecated-load",
           name,
-          current_version: currentVersion,
+          current_version,
           total: count,
-          top_streams: topStreams
+          top_streams
         });
       }
       return findings;
     }
   };
 };
-var makeCloseCandidatePass = (deps, options) => {
+var make_close_candidate_pass = (deps, options) => {
   const idle_days = options.thresholds?.idle_days ?? DEFAULTS.idle_days;
   const terminal_events = new Set(options.thresholds?.terminal_events ?? []);
   const idle_cutoff = Date.now() - idle_days * 24 * 60 * 60 * 1e3;
   const findings = [];
   return {
     category: "close-candidate",
-    onStat(stream, { head }) {
+    on_stat(stream, { head }) {
       const head_name = String(head.name);
       if (head_name.startsWith("__")) return;
       const head_time = head.created.getTime();
@@ -241,22 +249,22 @@ var makeCloseCandidatePass = (deps, options) => {
         last_event_at: head.created.toISOString(),
         reason: is_terminal ? "terminal" : "idle",
         idle_days: is_idle ? Math.floor((Date.now() - head_time) / (24 * 60 * 60 * 1e3)) : void 0,
-        restart_supported: restartIsSupported(deps, head_name)
+        restart_supported: restart_is_supported(deps, head_name)
       });
     },
     drain: () => findings
   };
 };
-var makeRestartCandidatePass = (deps, options) => {
+var make_restart_candidate_pass = (deps, options) => {
   const threshold = options.thresholds?.restart_min ?? DEFAULTS.restart_min;
   const findings = [];
   return {
     category: "restart-candidate",
-    onStat(stream, { head, count, names }) {
+    on_stat(stream, { head, count, names }) {
       if (count < threshold) return;
       const head_name = String(head.name);
       if (head_name.startsWith("__")) return;
-      if (!restartIsSupported(deps, head_name)) return;
+      if (!restart_is_supported(deps, head_name)) return;
       findings.push({
         category: "restart-candidate",
         stream,
@@ -270,14 +278,14 @@ var makeRestartCandidatePass = (deps, options) => {
     drain: () => findings
   };
 };
-var makeReactionHealthPass = (_deps, options) => {
+var make_reaction_health_pass = (_deps, options) => {
   const near_block = options.thresholds?.near_block ?? DEFAULTS.near_block;
   const stuck_minutes = options.thresholds?.stuck_minutes ?? DEFAULTS.stuck_minutes;
   const stuck_cutoff = Date.now() - stuck_minutes * 60 * 1e3;
   const findings = [];
   return {
     category: "reaction-health",
-    onStream(p) {
+    on_stream(p) {
       if (p.blocked) {
         findings.push({
           category: "reaction-health",
@@ -314,14 +322,14 @@ var makeReactionHealthPass = (_deps, options) => {
     drain: () => findings
   };
 };
-var makeSnapshotDriftPass = (deps, options) => {
+var make_snapshot_drift_pass = (deps, options) => {
   const drift_min = options.thresholds?.drift_min ?? DEFAULTS.drift_min;
   const candidates = [];
   const findings = [];
   return {
     category: "snapshot-drift",
-    onStat(stream, { head, count, names }) {
-      if (!restartIsSupported(deps, String(head.name))) return;
+    on_stat(stream, { head, count, names }) {
+      if (!restart_is_supported(deps, String(head.name))) return;
       if (count < drift_min) return;
       candidates.push({
         stream,
@@ -370,12 +378,12 @@ var makeSnapshotDriftPass = (deps, options) => {
     drain: () => findings
   };
 };
-var makeRoutingHealthPass = (deps) => {
+var make_routing_health_pass = (deps) => {
   const findings = [];
-  const seenEventNames = /* @__PURE__ */ new Set();
+  const seen_event_names = /* @__PURE__ */ new Set();
   return {
     category: "routing-health",
-    onStream(p) {
+    on_stream(p) {
       if (!p.lane) return;
       if (deps.declared_lanes.has(p.lane)) return;
       findings.push({
@@ -385,13 +393,13 @@ var makeRoutingHealthPass = (deps) => {
         lane: p.lane
       });
     },
-    onStat(_stream, { names }) {
+    on_stat(_stream, { names }) {
       for (const name of Object.keys(names)) {
-        seenEventNames.add(name);
+        seen_event_names.add(name);
       }
     },
     finalize() {
-      for (const name of seenEventNames) {
+      for (const name of seen_event_names) {
         if (name.startsWith("__")) continue;
         if (deps.routed_events.has(name)) continue;
         findings.push({
@@ -405,23 +413,23 @@ var makeRoutingHealthPass = (deps) => {
     drain: () => findings
   };
 };
-var makeCorrelationGapsPass = () => {
-  const seenIds = /* @__PURE__ */ new Set();
+var make_correlation_gaps_pass = () => {
+  const seen_ids = /* @__PURE__ */ new Set();
   const checks = [];
   return {
     category: "correlation-gaps",
-    onEvent(e) {
-      seenIds.add(e.id);
+    on_event(e) {
+      seen_ids.add(e.id);
       const causation = e.meta?.causation;
-      const parentId = causation?.event?.id;
-      if (parentId !== void 0) {
-        checks.push({ stream: e.stream, id: e.id, parentId });
+      const parent_id = causation?.event?.id;
+      if (parent_id !== void 0) {
+        checks.push({ stream: e.stream, id: e.id, parent_id });
       }
     },
     drain() {
       const findings = [];
-      for (const { stream, id, parentId } of checks) {
-        if (!seenIds.has(parentId)) {
+      for (const { stream, id, parent_id } of checks) {
+        if (!seen_ids.has(parent_id)) {
           findings.push({
             category: "correlation-gaps",
             stream,
@@ -434,12 +442,12 @@ var makeCorrelationGapsPass = () => {
     }
   };
 };
-var makeClockAnomaliesPass = () => {
+var make_clock_anomalies_pass = () => {
   const findings = [];
-  const lastPerStream = /* @__PURE__ */ new Map();
+  const last_per_stream = /* @__PURE__ */ new Map();
   return {
     category: "clock-anomalies",
-    onEvent(e) {
+    on_event(e) {
       const created = e.created.getTime();
       if (created > Date.now()) {
         findings.push({
@@ -449,7 +457,7 @@ var makeClockAnomaliesPass = () => {
           reason: "future-created"
         });
       }
-      const prev = lastPerStream.get(e.stream);
+      const prev = last_per_stream.get(e.stream);
       if (prev !== void 0 && created < prev) {
         findings.push({
           category: "clock-anomalies",
@@ -458,48 +466,48 @@ var makeClockAnomaliesPass = () => {
           reason: "out-of-order"
         });
       }
-      lastPerStream.set(e.stream, created);
+      last_per_stream.set(e.stream, created);
     },
     drain: () => findings
   };
 };
-function restartIsSupported(deps, headEventName) {
-  const state2 = deps.event_to_state.get(headEventName);
+function restart_is_supported(deps, head_event_name) {
+  const state2 = deps.event_to_state.get(head_event_name);
   return state2?.snap !== void 0;
 }
 var PASS_FACTORIES = {
-  schema: makeSchemaPass,
-  "deprecated-load": makeDeprecatedLoadPass,
-  "close-candidate": makeCloseCandidatePass,
-  "restart-candidate": makeRestartCandidatePass,
-  "reaction-health": makeReactionHealthPass,
-  "snapshot-drift": makeSnapshotDriftPass,
-  "routing-health": makeRoutingHealthPass,
-  "correlation-gaps": makeCorrelationGapsPass,
-  "clock-anomalies": makeClockAnomaliesPass
+  schema: make_schema_pass,
+  "deprecated-load": make_deprecated_load_pass,
+  "close-candidate": make_close_candidate_pass,
+  "restart-candidate": make_restart_candidate_pass,
+  "reaction-health": make_reaction_health_pass,
+  "snapshot-drift": make_snapshot_drift_pass,
+  "routing-health": make_routing_health_pass,
+  "correlation-gaps": make_correlation_gaps_pass,
+  "clock-anomalies": make_clock_anomalies_pass
 };
 
 // src/internal/build-classify.ts
 var ALL_LANES = /* @__PURE__ */ Symbol("act-1103/all-lanes");
-function classifyRegistry(registry, states) {
+function classify_registry(registry, states) {
   const statics = /* @__PURE__ */ new Map();
-  const reactiveEvents = /* @__PURE__ */ new Set();
-  const eventToLanes = /* @__PURE__ */ new Map();
-  let hasDynamicResolvers = false;
+  const reactive_events = /* @__PURE__ */ new Set();
+  const event_to_lanes = /* @__PURE__ */ new Map();
+  let has_dynamic_resolvers = false;
   for (const [name, register] of Object.entries(registry.events)) {
-    if (register.reactions.size > 0) reactiveEvents.add(name);
+    if (register.reactions.size > 0) reactive_events.add(name);
     for (const reaction of register.reactions.values()) {
       if (typeof reaction.resolver === "function") {
-        hasDynamicResolvers = true;
-        eventToLanes.set(name, ALL_LANES);
+        has_dynamic_resolvers = true;
+        event_to_lanes.set(name, ALL_LANES);
       } else {
         const { target, source, priority = 0, lane } = reaction.resolver;
         const lane_name = lane ?? "default";
-        const existing_lanes = eventToLanes.get(name);
+        const existing_lanes = event_to_lanes.get(name);
         if (existing_lanes !== ALL_LANES) {
           const set = existing_lanes ?? /* @__PURE__ */ new Set();
           set.add(lane_name);
-          eventToLanes.set(name, set);
+          event_to_lanes.set(name, set);
         }
         const key = `${target}|${source ?? ""}`;
         const existing = statics.get(key);
@@ -517,59 +525,59 @@ function classifyRegistry(registry, states) {
       }
     }
   }
-  const eventToState = /* @__PURE__ */ new Map();
+  const event_to_state = /* @__PURE__ */ new Map();
   for (const merged of states.values()) {
-    for (const eventName of Object.keys(merged.events)) {
-      eventToState.set(eventName, merged);
+    for (const event_name of Object.keys(merged.events)) {
+      event_to_state.set(event_name, merged);
     }
   }
   return {
-    staticTargets: [...statics.values()],
-    hasDynamicResolvers,
-    reactiveEvents,
-    eventToState,
-    eventToLanes
+    static_targets: [...statics.values()],
+    has_dynamic_resolvers,
+    reactive_events,
+    event_to_state,
+    event_to_lanes
   };
 }
 
 // src/internal/close-cycle.ts
-async function runCloseCycle(targets, deps) {
-  const targetMap = new Map(targets.map((t) => [t.stream, t]));
-  const streams = [...targetMap.keys()];
+async function run_close_cycle(targets, deps) {
+  const target_map = new Map(targets.map((t) => [t.stream, t]));
+  const streams = [...target_map.keys()];
   const skipped = [];
-  const streamInfo = await scanStreamHeads(streams);
-  const safe = await partitionBySafety(
-    streamInfo,
-    deps.reactiveEventsSize,
+  const stream_info = await scan_stream_heads(streams);
+  const safe = await partition_by_safety(
+    stream_info,
+    deps.reactive_events_size,
     skipped
   );
   if (!safe.length) return { truncated: /* @__PURE__ */ new Map(), skipped };
-  const { guarded, guardEvents } = await guardWithTombstones(
+  const { guarded, guard_events } = await guard_with_tombstones(
     safe,
-    streamInfo,
+    stream_info,
     deps.correlation,
     deps.tombstone,
     skipped
   );
   if (!guarded.length) return { truncated: /* @__PURE__ */ new Map(), skipped };
-  const seedStates = await loadRestartSeeds(
+  const seed_states = await load_restart_seeds(
     guarded,
-    targetMap,
-    streamInfo,
-    deps.eventToState,
+    target_map,
+    stream_info,
+    deps.event_to_state,
     deps.load,
     deps.logger
   );
-  await runArchiveCallbacks(guarded, targetMap);
-  const truncated = await truncateAndWarmCache(
+  await run_archive_callbacks(guarded, target_map);
+  const truncated = await truncate_and_warm_cache(
     guarded,
-    seedStates,
-    guardEvents,
+    seed_states,
+    guard_events,
     deps.correlation
   );
   return { truncated, skipped };
 }
-async function scanStreamHeads(streams) {
+async function scan_stream_heads(streams) {
   const stats = await store().query_stats(streams, {
     exclude: [SNAP_EVENT]
   });
@@ -577,76 +585,76 @@ async function scanStreamHeads(streams) {
   for (const [stream, { head }] of stats) {
     if (head.name === TOMBSTONE_EVENT) continue;
     out.set(stream, {
-      maxId: head.id,
+      max_id: head.id,
       version: head.version,
-      lastEventName: head.name
+      last_event_name: head.name
     });
   }
   return out;
 }
-async function partitionBySafety(streamInfo, reactiveEventsSize, skipped) {
-  if (reactiveEventsSize === 0) return [...streamInfo.keys()];
-  const pendingSet = /* @__PURE__ */ new Set();
+async function partition_by_safety(stream_info, reactive_events_size, skipped) {
+  if (reactive_events_size === 0) return [...stream_info.keys()];
+  const pending_set = /* @__PURE__ */ new Set();
   await store().query_streams((position) => {
-    const sourceRe = position.source ? RegExp(position.source) : void 0;
-    for (const [stream, info] of streamInfo) {
-      if ((!sourceRe || sourceRe.test(stream)) && position.at < info.maxId) {
-        pendingSet.add(stream);
+    const source_re = position.source ? RegExp(position.source) : void 0;
+    for (const [stream, info] of stream_info) {
+      if ((!source_re || source_re.test(stream)) && position.at < info.max_id) {
+        pending_set.add(stream);
       }
     }
   });
   const safe = [];
-  for (const [stream] of streamInfo) {
-    if (pendingSet.has(stream)) skipped.push(stream);
+  for (const [stream] of stream_info) {
+    if (pending_set.has(stream)) skipped.push(stream);
     else safe.push(stream);
   }
   return safe;
 }
-async function guardWithTombstones(safe, streamInfo, correlation, tombstone2, skipped) {
+async function guard_with_tombstones(safe, stream_info, correlation, tombstone2, skipped) {
   const guarded = [];
-  const guardEvents = /* @__PURE__ */ new Map();
+  const guard_events = /* @__PURE__ */ new Map();
   await Promise.all(
     safe.map(async (stream) => {
-      const info = streamInfo.get(stream);
+      const info = stream_info.get(stream);
       const committed = await tombstone2(stream, info.version, correlation);
       if (committed) {
         guarded.push(stream);
-        guardEvents.set(stream, { id: committed.id, stream });
+        guard_events.set(stream, { id: committed.id, stream });
       } else {
         skipped.push(stream);
       }
     })
   );
-  return { guarded, guardEvents };
+  return { guarded, guard_events };
 }
-async function loadRestartSeeds(guarded, targetMap, streamInfo, eventToState, load2, logger) {
-  const seedStates = /* @__PURE__ */ new Map();
+async function load_restart_seeds(guarded, target_map, stream_info, event_to_state, load2, logger) {
+  const seed_states = /* @__PURE__ */ new Map();
   await Promise.all(
-    guarded.filter((s) => targetMap.get(s)?.restart).map(async (stream) => {
-      const lastEventName = streamInfo.get(stream).lastEventName;
-      const ownerState = eventToState.get(lastEventName);
-      if (!ownerState) {
+    guarded.filter((s) => target_map.get(s)?.restart).map(async (stream) => {
+      const last_event_name = stream_info.get(stream).last_event_name;
+      const owner_state = event_to_state.get(last_event_name);
+      if (!owner_state) {
         logger.error(
-          `Cannot seed restart for "${stream}": no registered state owns event "${lastEventName}". Stream will be tombstoned instead.`
+          `Cannot seed restart for "${stream}": no registered state owns event "${last_event_name}". Stream will be tombstoned instead.`
         );
         return;
       }
-      const snap2 = await load2(ownerState, stream);
-      seedStates.set(stream, snap2.state);
+      const snap2 = await load2(owner_state, stream);
+      seed_states.set(stream, snap2.state);
     })
   );
-  return seedStates;
+  return seed_states;
 }
-async function runArchiveCallbacks(guarded, targetMap) {
+async function run_archive_callbacks(guarded, target_map) {
   for (const stream of guarded) {
-    const archiveFn = targetMap.get(stream)?.archive;
-    if (archiveFn) await archiveFn();
+    const archive_fn = target_map.get(stream)?.archive;
+    if (archive_fn) await archive_fn();
   }
 }
-async function truncateAndWarmCache(guarded, seedStates, guardEvents, correlation) {
-  const truncTargets = guarded.map((stream) => {
-    const snapshot = seedStates.get(stream);
-    const guard = guardEvents.get(stream);
+async function truncate_and_warm_cache(guarded, seed_states, guard_events, correlation) {
+  const trunc_targets = guarded.map((stream) => {
+    const snapshot = seed_states.get(stream);
+    const guard = guard_events.get(stream);
     return {
       stream,
       snapshot,
@@ -658,11 +666,11 @@ async function truncateAndWarmCache(guarded, seedStates, guardEvents, correlatio
       }
     };
   });
-  const truncated = await store().truncate(truncTargets);
+  const truncated = await store().truncate(trunc_targets);
   await Promise.all(
     guarded.map(async (stream) => {
       const entry = truncated.get(stream);
-      const state2 = seedStates.get(stream);
+      const state2 = seed_states.get(stream);
       if (state2 && entry) {
         await cache().set(stream, {
           state: state2,
@@ -690,13 +698,13 @@ var CorrelateCycle = class {
   _has_dynamic_resolvers;
   _cd;
   _on_init;
-  constructor(registry, staticTargets, hasDynamicResolvers, cd, maxSubscribedStreams, onInit) {
+  constructor(registry, static_targets, has_dynamic_resolvers, cd, maxSubscribedStreams, on_init) {
     this._subscribed = new LruSet(maxSubscribedStreams);
     this._registry = registry;
-    this._static_targets = staticTargets;
-    this._has_dynamic_resolvers = hasDynamicResolvers;
+    this._static_targets = static_targets;
+    this._has_dynamic_resolvers = has_dynamic_resolvers;
     this._cd = cd;
-    this._on_init = onInit;
+    this._on_init = on_init;
   }
   /** Last correlated event id. */
   get checkpoint() {
@@ -707,7 +715,7 @@ var CorrelateCycle = class {
    * - Reads max(at) from store as cold-start checkpoint
    * - Subscribes static resolver targets (idempotent upsert)
    * - Populates the subscribed-streams LRU
-   * - Fires `onInit` once (Act uses this to flag a cold-start drain)
+   * - Fires `on_init` once (Act uses this to flag a cold-start drain)
    */
   async init() {
     if (this._initialized) return;
@@ -740,15 +748,15 @@ var CorrelateCycle = class {
             if (typeof reaction.resolver !== "function") continue;
             const resolved = reaction.resolver(event);
             if (resolved && !this._subscribed.has(resolved.target)) {
-              const incomingPriority = resolved.priority ?? 0;
+              const incoming_priority = resolved.priority ?? 0;
               const entry = correlated.get(resolved.target) || {
                 source: resolved.source,
-                priority: incomingPriority,
+                priority: incoming_priority,
                 lane: resolved.lane,
                 payloads: []
               };
-              if (incomingPriority > entry.priority)
-                entry.priority = incomingPriority;
+              if (incoming_priority > entry.priority)
+                entry.priority = incoming_priority;
               entry.payloads.push({
                 ...reaction,
                 source: resolved.source,
@@ -787,7 +795,7 @@ var CorrelateCycle = class {
    * running. Errors from `correlate()` are routed through `log()` so they
    * land in the configured logger (the timer keeps running on failure).
    */
-  startPolling(query = {}, frequency = 1e4, callback) {
+  start_polling(query = {}, frequency = 1e4, callback) {
     if (this._timer) return false;
     const limit = query.limit || 100;
     this._timer = setInterval(
@@ -799,7 +807,7 @@ var CorrelateCycle = class {
     return true;
   }
   /** Stop the periodic correlation worker. Idempotent. */
-  stopPolling() {
+  stop_polling() {
     if (this._timer) {
       clearInterval(this._timer);
       this._timer = void 0;
@@ -815,14 +823,14 @@ var SEG_SPACE = BASE ** SEG_WIDTH;
 function seg(n) {
   return n.toString(BASE).padStart(SEG_WIDTH, "0");
 }
-var defaultCorrelator = ({ state: state2, action: action2 }) => {
+var default_correlator = ({ state: state2, action: action2 }) => {
   const s = state2.slice(0, SEG_WIDTH).toLowerCase();
   const a = action2.slice(0, SEG_WIDTH).toLowerCase();
   const ts = seg(Date.now() % SEG_SPACE);
   const rnd = seg(randomInt(SEG_SPACE));
   return `${s}-${a}-${ts}${rnd}`;
 };
-function closeCorrelation(correlator, actor) {
+function close_correlation(correlator, actor) {
   return correlator({
     state: "$close",
     action: "close",
@@ -838,7 +846,7 @@ import { randomUUID } from "crypto";
 var RATIO_MIN = 0.2;
 var RATIO_MAX = 0.8;
 var RATIO_DEFAULT = 0.5;
-function computeLagLeadRatio(handled, lagging, leading) {
+function compute_lag_lead_ratio(handled, lagging, leading) {
   let lagging_handled = 0;
   let leading_handled = 0;
   for (const { lease, handled: count } of handled) {
@@ -875,7 +883,7 @@ var subscribe = (streams) => store().subscribe(streams);
 import { patch } from "@rotorsoft/act-patch";
 
 // src/internal/backoff.ts
-function computeBackoffDelay(retry, opts) {
+function compute_backoff_delay(retry, opts) {
   if (!opts || opts.baseMs <= 0) return 0;
   const r = Math.max(0, retry);
   let delay;
@@ -1044,9 +1052,9 @@ async function scan(source, opts = {}, callback) {
     }
   };
 }
-async function load(me, stream, callback, asOf) {
-  const timeTravel = !!asOf && Object.values(asOf).some((v) => v !== void 0);
-  const cached = timeTravel ? void 0 : await cache().get(stream);
+async function load(me, stream, callback, asOf, actor) {
+  const time_travel = !!asOf && Object.values(asOf).some((v) => v !== void 0);
+  const cached = time_travel ? void 0 : await cache().get(stream);
   const cache_hit = !!cached;
   let state2 = cached?.state ?? (me.init ? me.init() : {});
   let patches = cached?.patches ?? 0;
@@ -1056,15 +1064,16 @@ async function load(me, stream, callback, asOf) {
   let event;
   await store().query(
     (e) => {
-      event = e;
       version = e.version;
+      const typed = e;
+      event = me.view(typed, actor);
       if (e.name === SNAP_EVENT) {
         state2 = e.data;
         snaps++;
         patches = 0;
         replayed++;
       } else if (me.patch[e.name]) {
-        state2 = patch(state2, me.patch[e.name](event, state2));
+        state2 = patch(state2, me.patch[e.name](typed, state2));
         patches++;
         replayed++;
       } else if (e.name !== TOMBSTONE_EVENT) {
@@ -1088,7 +1097,7 @@ async function load(me, stream, callback, asOf) {
       ...cached ? { after: cached.event_id } : { with_snaps: true, ...asOf }
     }
   );
-  if (replayed > 0 && !timeTravel && event) {
+  if (replayed > 0 && !time_travel && event) {
     await cache().set(stream, {
       state: state2,
       version,
@@ -1099,15 +1108,21 @@ async function load(me, stream, callback, asOf) {
   }
   return { event, state: state2, version, patches, snaps, cache_hit, replayed };
 }
-async function action(me, action2, target, payload, reactingTo, skipValidation = false, correlator = defaultCorrelator) {
+async function action(me, action2, target, payload, reactingTo, skipValidation = false, correlator = default_correlator) {
   const { stream, expectedVersion, actor } = target;
   if (!stream) throw new Error("Missing target stream");
   const validated = skipValidation ? payload : validate(action2, payload, me.actions[action2]);
   const opts = me.options?.[action2];
-  const maxRetries = opts?.maxRetries ?? 0;
+  const max_retries = opts?.maxRetries ?? 0;
   for (let attempt = 0; ; attempt++) {
     try {
-      const snapshot = await load(me, stream);
+      const snapshot = await load(
+        me,
+        stream,
+        void 0,
+        void 0,
+        target.actor
+      );
       if (snapshot.event?.name === TOMBSTONE_EVENT)
         throw new StreamClosedError(stream);
       const expected = expectedVersion ?? snapshot.event?.version;
@@ -1144,10 +1159,10 @@ async function action(me, action2, target, payload, reactingTo, skipValidation =
           }
         }
       }
-      const emitted = tuples.map(([name, data]) => ({
-        name,
-        data: skipValidation ? data : validate(name, data, me.events[name])
-      }));
+      const emitted = tuples.map(([name, data]) => {
+        const validated2 = skipValidation ? data : validate(name, data, me.events[name]);
+        return me.message({ name, data: validated2 });
+      });
       const meta = {
         correlation: reactingTo?.meta.correlation || correlator({
           action: action2,
@@ -1159,8 +1174,8 @@ async function action(me, action2, target, payload, reactingTo, skipValidation =
           action: {
             name: action2,
             ...target
-            // payload intentionally omitted: it can be large or contain PII,
-            // and callers correlate via the correlation id when they need it.
+            // payload intentionally omitted from causation metadata —
+            // callers correlate via the correlation id when they need it.
           },
           event: reactingTo ? {
             id: reactingTo.id,
@@ -1193,7 +1208,7 @@ async function action(me, action2, target, payload, reactingTo, skipValidation =
         state2 = patch(state2, p);
         patches++;
         return {
-          event,
+          event: me.view(event, target.actor),
           state: state2,
           version: event.version,
           patches,
@@ -1216,10 +1231,10 @@ async function action(me, action2, target, payload, reactingTo, skipValidation =
       return snapshots;
     } catch (error) {
       if (!(error instanceof ConcurrencyError)) throw error;
-      if (attempt >= maxRetries) throw error;
+      if (attempt >= max_retries) throw error;
       if (opts?.backoff) {
-        const delayMs = computeBackoffDelay(attempt, opts.backoff);
-        if (delayMs > 0) await sleep(delayMs);
+        const delay_ms = compute_backoff_delay(attempt, opts.backoff);
+        if (delay_ms > 0) await sleep(delay_ms);
       }
     }
   }
@@ -1243,12 +1258,12 @@ var C_STREAM = "\x1B[38;5;226m";
 var dim = (text) => PRETTY ? `${C_DIM}${text}${C_RESET}` : text;
 var hue = (color, text) => PRETTY ? `${color}${text}${C_RESET}` : text;
 var drain_caption = (caption, lane) => {
-  const showLane = lane && lane !== "default";
+  const show_lane = lane && lane !== "default";
   if (PRETTY) {
     const tag = `${C_DRAIN}>> ${caption}${C_RESET}`;
-    return showLane ? `${tag} ${C_LANE}${lane}${C_RESET}` : tag;
+    return show_lane ? `${tag} ${C_LANE}${lane}${C_RESET}` : tag;
   }
-  return showLane ? `>> ${caption} ${lane}` : `>> ${caption}`;
+  return show_lane ? `>> ${caption} ${lane}` : `>> ${caption}`;
 };
 var cache_marker = (hit) => {
   const word = hit ? "hit" : "miss";
@@ -1277,10 +1292,10 @@ var traced = (inner, exit, entry) => (async (...args) => {
   exit?.(result, ...args);
   return result;
 });
-function buildEs(logger, correlator = defaultCorrelator) {
-  const boundAction = (me, actionName, target, payload, reactingTo, skipValidation = false) => action(
+function build_es(logger, correlator = default_correlator) {
+  const bound_action = (me, action_name, target, payload, reactingTo, skipValidation = false) => action(
     me,
-    actionName,
+    action_name,
     target,
     payload,
     reactingTo,
@@ -1291,7 +1306,7 @@ function buildEs(logger, correlator = defaultCorrelator) {
     return {
       snap,
       load,
-      action: boundAction,
+      action: bound_action,
       tombstone
     };
   }
@@ -1321,7 +1336,7 @@ function buildEs(logger, correlator = defaultCorrelator) {
       );
     }),
     action: traced(
-      boundAction,
+      bound_action,
       (snapshots, _me, _action, target) => {
         const committed = snapshots.filter((s) => s.event);
         if (committed.length) {
@@ -1350,7 +1365,7 @@ function buildEs(logger, correlator = defaultCorrelator) {
     })
   };
 }
-function buildDrain(logger) {
+function build_drain(logger) {
   return {
     claim,
     fetch,
@@ -1359,46 +1374,48 @@ function buildDrain(logger) {
     subscribe: logger.level !== "trace" ? subscribe : traced(subscribe, (result, streams) => {
       if (!result.subscribed) return;
       const lanes = new Set(streams.map((s) => s.lane ?? "default"));
-      const uniformLane = lanes.size === 1 ? streams[0]?.lane : void 0;
+      const uniform_lane = lanes.size === 1 ? streams[0]?.lane : void 0;
       const data = streams.map(
-        ({ stream, lane }) => uniformLane || !lane || lane === "default" ? hue(C_STREAM, stream) : `${hue(C_STREAM, stream)}${dim(`[${lane}]`)}`
+        ({ stream, lane }) => uniform_lane || !lane || lane === "default" ? hue(C_STREAM, stream) : `${hue(C_STREAM, stream)}${dim(`[${lane}]`)}`
       ).join(" ");
-      logger.trace(`${drain_caption("correlated", uniformLane)} ${data}`);
+      logger.trace(
+        `${drain_caption("correlated", uniform_lane)} ${data}`
+      );
     })
   };
 }
-function traceCycle(logger, leased, fetched, handled, acked, blocked) {
+function trace_cycle(logger, leased, fetched, handled, acked, blocked) {
   if (logger.level !== "trace" || !leased.length) return;
   const lane = leased[0]?.lane;
-  const fetchByStream = new Map(fetched.map((f) => [f.stream, f]));
-  const ackedByStream = new Map(acked.map((a) => [a.stream, a.at]));
-  const blockedByStream = new Map(blocked.map((b) => [b.stream, b.error]));
-  const failedByStream = new Map(
+  const fetch_by_stream = new Map(fetched.map((f) => [f.stream, f]));
+  const acked_by_stream = new Map(acked.map((a) => [a.stream, a.at]));
+  const blocked_by_stream = new Map(blocked.map((b) => [b.stream, b.error]));
+  const failed_by_stream = new Map(
     handled.filter((h) => h.error).map((h) => [h.lease.stream, h])
   );
   const detail = leased.map(({ stream, at, retry }) => {
-    const f = fetchByStream.get(stream);
+    const f = fetch_by_stream.get(stream);
     const key = f?.source ? `${hue(C_STREAM, stream)}${dim(`<-${f.source}`)}` : hue(C_STREAM, stream);
     const events = f && f.events.length ? ` ${dim(
       `[${f.events.map(({ id, name }) => `#${id} ${String(name)}`).join(", ")}]`
     )}` : "";
-    const ackedAt = ackedByStream.get(stream);
-    const ackPart = ackedAt !== void 0 ? hue(C_HIT, `\u2713 @${ackedAt}`) : "";
-    const failure = failedByStream.get(stream);
-    let failPart = "";
+    const acked_at = acked_by_stream.get(stream);
+    const ack_part = acked_at !== void 0 ? hue(C_HIT, `\u2713 @${acked_at}`) : "";
+    const failure = failed_by_stream.get(stream);
+    let fail_part = "";
     if (failure) {
-      const failedAt = failure.failed_at ?? at;
-      const blockedError = blockedByStream.get(stream);
-      if (blockedError !== void 0) {
-        failPart = `${hue(C_ERR, `\u2717 @${failedAt}/${retry}`)} ${dim(`(${blockedError})`)}`;
+      const failed_at = failure.failed_at ?? at;
+      const blocked_error = blocked_by_stream.get(stream);
+      if (blocked_error !== void 0) {
+        fail_part = `${hue(C_ERR, `\u2717 @${failed_at}/${retry}`)} ${dim(`(${blocked_error})`)}`;
       } else {
-        failPart = `${hue(C_MISS, `\u26A0 @${failedAt}/${retry}`)} ${dim(`(${failure.error})`)}`;
+        fail_part = `${hue(C_MISS, `\u26A0 @${failed_at}/${retry}`)} ${dim(`(${failure.error})`)}`;
       }
     }
     let tail;
-    if (ackPart && failPart) tail = ` ${ackPart} ${failPart}`;
-    else if (ackPart) tail = ` ${ackPart}`;
-    else if (failPart) tail = ` ${failPart}`;
+    if (ack_part && fail_part) tail = ` ${ack_part} ${fail_part}`;
+    else if (ack_part) tail = ` ${ack_part}`;
+    else if (fail_part) tail = ` ${fail_part}`;
     else tail = ` ${dim(`\u2298 @${at}/${retry}`)}`;
     return `${key}${events}${tail}`;
   }).join(", ");
@@ -1406,7 +1423,7 @@ function traceCycle(logger, leased, fetched, handled, acked, blocked) {
 }
 
 // src/internal/drain-cycle.ts
-async function runDrainCycle(ops, registry, batchHandlers, handle, handleBatch, lagging, leading, eventLimit, leaseMillis, isDeferred, lane) {
+async function run_drain_cycle(ops, registry, batch_handlers, handle, handle_batch, lagging, leading, eventLimit, leaseMillis, is_deferred, lane) {
   const leased = await ops.claim(
     lagging,
     leading,
@@ -1415,7 +1432,7 @@ async function runDrainCycle(ops, registry, batchHandlers, handle, handleBatch,
     lane
   );
   if (!leased.length) return void 0;
-  const active = isDeferred ? leased.filter((l) => !isDeferred(l.stream)) : leased;
+  const active = is_deferred ? leased.filter((l) => !is_deferred(l.stream)) : leased;
   if (!active.length) {
     return {
       leased,
@@ -1426,7 +1443,7 @@ async function runDrainCycle(ops, registry, batchHandlers, handle, handleBatch,
     };
   }
   const fetched = await ops.fetch(active, eventLimit);
-  const fetchMap = /* @__PURE__ */ new Map();
+  const fetch_map = /* @__PURE__ */ new Map();
   const fetch_window_at = fetched.reduce(
     (max, { at, events }) => Math.max(max, events.at(-1)?.id || at),
     0
@@ -1441,16 +1458,16 @@ async function runDrainCycle(ops, registry, batchHandlers, handle, handleBatch,
         return resolved && resolved.target === stream;
       }).map((reaction) => ({ ...reaction, event }));
     });
-    fetchMap.set(stream, { fetch: f, payloads });
+    fetch_map.set(stream, { fetch: f, payloads });
   }
   const handled = await Promise.all(
     active.map((lease) => {
-      const entry = fetchMap.get(lease.stream);
+      const entry = fetch_map.get(lease.stream);
       const at = entry.fetch.events.at(-1)?.id || fetch_window_at;
       const { payloads } = entry;
-      const batchHandler = batchHandlers.get(lease.stream);
+      const batchHandler = batch_handlers.get(lease.stream);
       if (batchHandler && payloads.length > 0) {
-        return handleBatch({ ...lease, at }, payloads, batchHandler);
+        return handle_batch({ ...lease, at }, payloads, batchHandler);
       }
       return handle({ ...lease, at }, payloads);
     })
@@ -1474,14 +1491,14 @@ var DrainController = class {
   _locked = false;
   _ratio = 0.5;
   /**
-   * Per-stream backoff: `stream → nextAttemptAt` (ms since epoch). Set by
-   * `_finalize` via `HandleResult.nextAttemptAt`; cleared on successful
+   * Per-stream backoff: `stream → next_attempt_at` (ms since epoch). Set by
+   * `_finalize` via `HandleResult.next_attempt_at`; cleared on successful
    * ack or terminal block. Lives in process memory — per-worker pacing
    * by design (see {@link BackoffOptions} for the multi-worker trade-off).
    */
   _backoff = /* @__PURE__ */ new Map();
-  /** Timer re-arming drain at the earliest pending `nextAttemptAt`. */
-  _backoffTimer;
+  /** Timer re-arming drain at the earliest pending `next_attempt_at`. */
+  _backoff_timer;
   /** Worker timer (ACT-1103). Set when `start()` is active, undefined otherwise. */
   _worker;
   _stopped = false;
@@ -1502,7 +1519,7 @@ var DrainController = class {
     return this._armed;
   }
   /** Returns true when `stream` is currently within a backoff window. */
-  isDeferred = (stream) => {
+  is_deferred = (stream) => {
     const next = this._backoff.get(stream);
     return next !== void 0 && next > Date.now();
   };
@@ -1512,20 +1529,20 @@ var DrainController = class {
    * Idempotent — collapses many simultaneously deferred streams into a
    * single timer.
    */
-  scheduleBackoffWake() {
-    if (this._backoffTimer) clearTimeout(this._backoffTimer);
+  schedule_backoff_wake() {
+    if (this._backoff_timer) clearTimeout(this._backoff_timer);
     let earliest = Number.POSITIVE_INFINITY;
     for (const t of this._backoff.values()) if (t < earliest) earliest = t;
     const delay = Math.max(0, earliest - Date.now());
-    this._backoffTimer = setTimeout(() => {
-      this._backoffTimer = void 0;
+    this._backoff_timer = setTimeout(() => {
+      this._backoff_timer = void 0;
       const now = Date.now();
       for (const [stream, at] of this._backoff) {
         if (at <= now) this._backoff.delete(stream);
       }
       this._armed = true;
     }, delay);
-    this._backoffTimer.unref();
+    this._backoff_timer.unref();
   }
   /** Lane this controller drains (undefined = legacy single-lane span). */
   get lane() {
@@ -1571,17 +1588,17 @@ var DrainController = class {
       this._locked = true;
       const lagging = Math.ceil(streamLimit * this._ratio);
       const leading = streamLimit - lagging;
-      const cycle = await runDrainCycle(
+      const cycle = await run_drain_cycle(
         this._deps.ops,
         this._deps.registry,
-        this._deps.batchHandlers,
+        this._deps.batch_handlers,
         this._deps.handle,
-        this._deps.handleBatch,
+        this._deps.handle_batch,
         lagging,
         leading,
         eventLimit,
         leaseMillis,
-        this._backoff.size > 0 ? this.isDeferred : void 0,
+        this._backoff.size > 0 ? this.is_deferred : void 0,
         this._deps.lane
       );
       if (!cycle) {
@@ -1589,20 +1606,20 @@ var DrainController = class {
         return EMPTY_DRAIN;
       }
       const { leased, fetched, handled, acked, blocked } = cycle;
-      traceCycle(this._deps.logger, leased, fetched, handled, acked, blocked);
-      this._ratio = computeLagLeadRatio(handled, lagging, leading);
+      trace_cycle(this._deps.logger, leased, fetched, handled, acked, blocked);
+      this._ratio = compute_lag_lead_ratio(handled, lagging, leading);
       for (const lease of acked) this._backoff.delete(lease.stream);
       for (const lease of blocked) this._backoff.delete(lease.stream);
       for (const h of handled) {
-        if (h.nextAttemptAt !== void 0 && !h.block) {
-          this._backoff.set(h.lease.stream, h.nextAttemptAt);
+        if (h.next_attempt_at !== void 0 && !h.block) {
+          this._backoff.set(h.lease.stream, h.next_attempt_at);
         }
       }
-      if (this._backoff.size > 0) this.scheduleBackoffWake();
-      if (acked.length) this._deps.onAcked(acked);
-      if (blocked.length) this._deps.onBlocked(blocked);
-      const hasErrors = handled.some(({ error }) => error);
-      if (!acked.length && !blocked.length && !hasErrors) this._armed = false;
+      if (this._backoff.size > 0) this.schedule_backoff_wake();
+      if (acked.length) this._deps.on_acked(acked);
+      if (blocked.length) this._deps.on_blocked(blocked);
+      const has_errors = handled.some(({ error }) => error);
+      if (!acked.length && !blocked.length && !has_errors) this._armed = false;
       return { fetched, leased, acked, blocked };
     } catch (error) {
       this._deps.logger.error(error);
@@ -1615,44 +1632,44 @@ var DrainController = class {
 
 // src/internal/merge.ts
 import { ZodObject } from "zod";
-function baseTypeName(zodType) {
+function base_type_name(zodType) {
   let t = zodType;
   while (typeof t.unwrap === "function") {
     t = t.unwrap();
   }
   return t.constructor.name;
 }
-function mergeSchemas(existing, incoming, stateName) {
+function merge_schemas(existing, incoming, state_name) {
   if (existing instanceof ZodObject && incoming instanceof ZodObject) {
-    const existingShape = existing.shape;
-    const incomingShape = incoming.shape;
-    for (const key of Object.keys(incomingShape)) {
-      if (key in existingShape) {
-        const existingBase = baseTypeName(existingShape[key]);
-        const incomingBase = baseTypeName(incomingShape[key]);
-        if (existingBase !== incomingBase) {
+    const existing_shape = existing.shape;
+    const incoming_shape = incoming.shape;
+    for (const key of Object.keys(incoming_shape)) {
+      if (key in existing_shape) {
+        const existing_base = base_type_name(existing_shape[key]);
+        const incoming_base = base_type_name(incoming_shape[key]);
+        if (existing_base !== incoming_base) {
           throw new Error(
-            `Schema conflict in "${stateName}": key "${key}" has type "${existingBase}" but incoming partial declares "${incomingBase}"`
+            `Schema conflict in "${state_name}": key "${key}" has type "${existing_base}" but incoming partial declares "${incoming_base}"`
           );
         }
       }
     }
-    return existing.extend(incomingShape);
+    return existing.extend(incoming_shape);
   }
   return existing;
 }
-function mergeInits(existing, incoming) {
+function merge_inits(existing, incoming) {
   return () => ({ ...existing(), ...incoming() });
 }
-function registerState(state2, states, actions, events) {
+function register_state(state2, states, actions, events) {
   const existing = states.get(state2.name);
   if (existing) {
-    mergeIntoExisting(state2, existing, states, actions, events);
+    merge_into_existing(state2, existing, states, actions, events);
   } else {
-    registerNewState(state2, states, actions, events);
+    register_new_state(state2, states, actions, events);
   }
 }
-function registerNewState(state2, states, actions, events) {
+function register_new_state(state2, states, actions, events) {
   states.set(state2.name, state2);
   for (const name of Object.keys(state2.actions)) {
     if (actions[name]) throw new Error(`Duplicate action "${name}"`);
@@ -1663,7 +1680,7 @@ function registerNewState(state2, states, actions, events) {
     events[name] = { schema: state2.events[name], reactions: /* @__PURE__ */ new Map() };
   }
 }
-function mergeIntoExisting(state2, existing, states, actions, events) {
+function merge_into_existing(state2, existing, states, actions, events) {
   for (const name of Object.keys(state2.actions)) {
     if (existing.actions[name] === state2.actions[name]) continue;
     if (actions[name]) throw new Error(`Duplicate action "${name}"`);
@@ -1677,14 +1694,14 @@ function mergeIntoExisting(state2, existing, states, actions, events) {
     }
     if (events[name]) throw new Error(`Duplicate event "${name}"`);
   }
-  const mergedPatch = mergePatches(existing.patch, state2.patch, state2.name);
+  const merged_patch = merge_patches(existing.patch, state2.patch, state2.name);
   const merged = {
     ...existing,
-    state: mergeSchemas(existing.state, state2.state, state2.name),
-    init: mergeInits(existing.init, state2.init),
+    state: merge_schemas(existing.state, state2.state, state2.name),
+    init: merge_inits(existing.init, state2.init),
     events: { ...existing.events, ...state2.events },
     actions: { ...existing.actions, ...state2.actions },
-    patch: mergedPatch,
+    patch: merged_patch,
     on: { ...existing.on, ...state2.on },
     given: { ...existing.given, ...state2.given },
     snap: state2.snap && existing.snap && state2.snap !== existing.snap ? (() => {
@@ -1702,48 +1719,48 @@ function mergeIntoExisting(state2, existing, states, actions, events) {
     events[name] = { schema: state2.events[name], reactions: /* @__PURE__ */ new Map() };
   }
 }
-function mergePatches(existing, incoming, stateName) {
+function merge_patches(existing, incoming, state_name) {
   const merged = { ...existing };
   for (const name of Object.keys(incoming)) {
-    const existingP = existing[name];
-    const incomingP = incoming[name];
-    if (!existingP) {
-      merged[name] = incomingP;
+    const existing_p = existing[name];
+    const incoming_p = incoming[name];
+    if (!existing_p) {
+      merged[name] = incoming_p;
       continue;
     }
-    const existingIsDefault = existingP._passthrough;
-    const incomingIsDefault = incomingP._passthrough;
-    if (!existingIsDefault && !incomingIsDefault && existingP !== incomingP) {
+    const existing_is_default = existing_p._passthrough;
+    const incoming_is_default = incoming_p._passthrough;
+    if (!existing_is_default && !incoming_is_default && existing_p !== incoming_p) {
       throw new Error(
-        `Duplicate custom patch for event "${name}" in state "${stateName}"`
+        `Duplicate custom patch for event "${name}" in state "${state_name}"`
       );
     }
-    if (existingIsDefault && !incomingIsDefault) {
-      merged[name] = incomingP;
+    if (existing_is_default && !incoming_is_default) {
+      merged[name] = incoming_p;
     }
   }
   return merged;
 }
-function mergeEventRegister(target, source) {
-  for (const [eventName, sourceReg] of Object.entries(source)) {
-    const targetReg = target[eventName];
-    if (!targetReg) continue;
-    for (const [name, reaction] of sourceReg.reactions) {
-      targetReg.reactions.set(name, reaction);
+function merge_event_register(target, source) {
+  for (const [event_name, source_reg] of Object.entries(source)) {
+    const target_reg = target[event_name];
+    if (!target_reg) continue;
+    for (const [name, reaction] of source_reg.reactions) {
+      target_reg.reactions.set(name, reaction);
     }
   }
 }
-function mergeProjection(proj, events) {
-  for (const eventName of Object.keys(proj.events)) {
-    const projRegister = proj.events[eventName];
-    const existing = events[eventName];
+function merge_projection(proj, events) {
+  for (const event_name of Object.keys(proj.events)) {
+    const proj_register = proj.events[event_name];
+    const existing = events[event_name];
     if (!existing) {
-      events[eventName] = {
-        schema: projRegister.schema,
-        reactions: new Map(projRegister.reactions)
+      events[event_name] = {
+        schema: proj_register.schema,
+        reactions: new Map(proj_register.reactions)
       };
     } else {
-      for (const [name, reaction] of projRegister.reactions) {
+      for (const [name, reaction] of proj_register.reactions) {
         let key = name;
         while (existing.reactions.has(key)) key = `${key}_p`;
         existing.reactions.set(key, reaction);
@@ -1760,25 +1777,32 @@ var _this_ = ({ stream }) => ({
 function finalize(lease, handled, at, error, options, logger, failed_at) {
   if (!error) return { lease, handled, acked_at: at };
   logger.error(error);
-  const nonRetryable = error instanceof NonRetryableError;
-  const block2 = options.blockOnError && (nonRetryable || lease.retry >= options.maxRetries);
+  const non_retryable = error instanceof NonRetryableError;
+  const block2 = options.blockOnError && (non_retryable || lease.retry >= options.maxRetries);
   if (block2)
     logger.error(
-      nonRetryable ? `Blocking ${lease.stream} on non-retryable error.` : `Blocking ${lease.stream} after ${lease.retry} retries.`
+      non_retryable ? `Blocking ${lease.stream} on non-retryable error.` : `Blocking ${lease.stream} after ${lease.retry} retries.`
     );
-  const nextAttemptAt = !block2 && options.backoff ? Date.now() + computeBackoffDelay(lease.retry, options.backoff) : void 0;
+  const next_attempt_at = !block2 && options.backoff ? Date.now() + compute_backoff_delay(lease.retry, options.backoff) : void 0;
   return {
     lease,
     handled,
     acked_at: at,
     error: error.message,
     block: block2,
-    nextAttemptAt,
+    next_attempt_at,
     failed_at
   };
 }
-function buildHandle(deps) {
-  const { logger, boundDo, boundLoad, boundQuery, boundQueryArray } = deps;
+function build_handle(deps) {
+  const {
+    logger,
+    bound_do,
+    bound_load,
+    bound_query,
+    bound_query_array,
+    bound_forget
+  } = deps;
   return async (lease, payloads) => {
     if (payloads.length === 0) return { lease, handled: 0, acked_at: lease.at };
     const stream = lease.stream;
@@ -1786,23 +1810,24 @@ function buildHandle(deps) {
     let handled = 0;
     if (lease.retry > 0)
       logger.warn(`Retrying ${stream}@${at} (${lease.retry}).`);
-    const scopedApp = {
-      do: boundDo,
-      load: boundLoad,
-      query: boundQuery,
-      query_array: boundQueryArray
+    const scoped_app = {
+      do: bound_do,
+      load: bound_load,
+      query: bound_query,
+      query_array: bound_query_array,
+      forget: bound_forget
     };
     for (const payload of payloads) {
       const { event, handler } = payload;
-      scopedApp.do = (action2, target, actionPayload, reactingTo, skipValidation) => boundDo(
+      scoped_app.do = (action2, target, action_payload, reactingTo, skipValidation) => bound_do(
         action2,
         target,
-        actionPayload,
+        action_payload,
         reactingTo ?? event,
         skipValidation
       );
       try {
-        await handler(event, stream, scopedApp);
+        await handler(event, stream, scoped_app);
         at = event.id;
         handled++;
       } catch (error) {
@@ -1820,10 +1845,12 @@ function buildHandle(deps) {
     return finalize(lease, handled, at, void 0, payloads[0].options, logger);
   };
 }
-function buildHandleBatch(logger) {
+function build_handle_batch(logger) {
   return async (lease, payloads, batchHandler) => {
     const stream = lease.stream;
-    const events = payloads.map((p) => p.event);
+    const events = payloads.map(
+      (p) => p.event
+    );
     const options = payloads[0].options;
     if (lease.retry > 0)
       logger.warn(`Retrying batch ${stream}@${events[0].id} (${lease.retry}).`);
@@ -1850,23 +1877,23 @@ var SettleLoop = class {
   _deps;
   /** Debounce window applied when the caller doesn't override via `SettleOptions.debounceMs`. */
   _default_debounce_ms;
-  constructor(deps, defaultDebounceMs) {
+  constructor(deps, default_debounce_ms) {
     this._deps = deps;
-    this._default_debounce_ms = defaultDebounceMs;
+    this._default_debounce_ms = default_debounce_ms;
   }
   /**
    * Schedule a settle pass. Multiple calls inside the debounce window
    * coalesce into one cycle. The cycle runs correlate→drain in a loop
    * until no progress is made (no new subscriptions, no acks, no blocks)
    * or `maxPasses` is reached, then emits the `"settled"` lifecycle event
-   * via {@link SettleDeps.onSettled}.
+   * via {@link SettleDeps.on_settled}.
    */
   schedule(options = {}) {
     const {
       debounceMs = this._default_debounce_ms,
-      correlate: correlateQuery = { after: -1, limit: 100 },
+      correlate: correlate_query = { after: -1, limit: 100 },
       maxPasses = Infinity,
-      ...drainOptions
+      ...drain_options
     } = options;
     if (this._timer) clearTimeout(this._timer);
     this._timer = setTimeout(() => {
@@ -1875,17 +1902,17 @@ var SettleLoop = class {
       this._running = true;
       (async () => {
         await this._deps.init();
-        let lastDrain;
+        let last_drain;
         for (let i = 0; i < maxPasses; i++) {
           const { subscribed } = await this._deps.correlate({
-            ...correlateQuery,
+            ...correlate_query,
             after: this._deps.checkpoint()
           });
-          lastDrain = await this._deps.drain(drainOptions);
-          const made_progress = subscribed > 0 || lastDrain.acked.length > 0 || lastDrain.blocked.length > 0;
+          last_drain = await this._deps.drain(drain_options);
+          const made_progress = subscribed > 0 || last_drain.acked.length > 0 || last_drain.blocked.length > 0;
           if (!made_progress) break;
         }
-        if (lastDrain) this._deps.onSettled(lastDrain);
+        if (last_drain) this._deps.on_settled(last_drain);
       })().catch((err) => this._deps.logger.error(err)).finally(() => {
         this._running = false;
       });
@@ -1972,7 +1999,7 @@ var Act = class {
   _event_to_state;
   /**
    * Event-name → lane fan-in for selective arming (ACT-1103). Built by
-   * `classifyRegistry` once per build. `"all"` means at least one of
+   * `classify_registry` once per build. `"all"` means at least one of
    * the event's reactions is a dynamic resolver (lane opaque until
    * runtime); a `Set<string>` lists the static lanes only that event's
    * reactions target.
@@ -1995,9 +2022,9 @@ var Act = class {
   _scoped;
   /**
    * Correlation-id generator for originating actions. Bound at
-   * construction from `options.correlator ?? defaultCorrelator`. The
+   * construction from `options.correlator ?? default_correlator`. The
    * `do()` path passes this into the `_es.action` closure; close-cycle
-   * uses it via {@link closeCorrelation}.
+   * uses it via {@link close_correlation}.
    */
   _correlator;
   /** Pre-bound IAct methods reused across drain cycles. Only `do` varies per
@@ -2006,7 +2033,8 @@ var Act = class {
   _bound_load = this.load.bind(this);
   _bound_query = this.query.bind(this);
   _bound_query_array = this.query_array.bind(this);
-  /** Reaction dispatchers built once and handed to runDrainCycle each cycle. */
+  _bound_forget = this.forget.bind(this);
+  /** Reaction dispatchers built once and handed to run_drain_cycle each cycle. */
   _handle;
   _handle_batch;
   /** Declared drain lanes (ACT-1103). */
@@ -2023,16 +2051,16 @@ var Act = class {
    *
    * @param registry  Schemas for every event and action across registered states
    * @param states    Merged map of state name → state definition
-   * @param batchHandlers Static-target projection batch handlers (target → handler)
+   * @param batch_handlers Static-target projection batch handlers (target → handler)
    * @param options   Tuning knobs — see {@link ActOptions}
    * @param lanes     Declared drain lanes (ACT-1103). The builder collects
    *   these from `.withLane(...)` calls. Slice 1 records them on the
    *   instance; later slices fan out one `DrainController` per lane.
    */
-  constructor(registry, states = /* @__PURE__ */ new Map(), batchHandlers = /* @__PURE__ */ new Map(), options = {}, lanes = []) {
+  constructor(registry, states = /* @__PURE__ */ new Map(), batch_handlers = /* @__PURE__ */ new Map(), options = {}, lanes = []) {
     this.registry = registry;
     this._states = states;
-    this._batch_handlers = batchHandlers;
+    this._batch_handlers = batch_handlers;
     this._lanes = lanes;
     if (options.onlyLanes && options.onlyLanes.length > 0) {
       const declared = /* @__PURE__ */ new Set([
@@ -2046,49 +2074,50 @@ var Act = class {
         );
     }
     this._scoped = options.scoped ? (fn) => scoped.run(options.scoped, fn) : (fn) => fn();
-    this._correlator = options.correlator ?? defaultCorrelator;
-    this._es = buildEs(this._logger, this._correlator);
-    this._cd = buildDrain(this._logger);
-    this._handle = buildHandle({
+    this._correlator = options.correlator ?? default_correlator;
+    this._es = build_es(this._logger, this._correlator);
+    this._cd = build_drain(this._logger);
+    this._handle = build_handle({
       logger: this._logger,
-      boundDo: this._bound_do,
-      boundLoad: this._bound_load,
-      boundQuery: this._bound_query,
-      boundQueryArray: this._bound_query_array
+      bound_do: this._bound_do,
+      bound_load: this._bound_load,
+      bound_query: this._bound_query,
+      bound_query_array: this._bound_query_array,
+      bound_forget: this._bound_forget
     });
-    this._handle_batch = buildHandleBatch(this._logger);
+    this._handle_batch = build_handle_batch(this._logger);
     const {
-      staticTargets,
-      hasDynamicResolvers,
-      reactiveEvents,
-      eventToState,
-      eventToLanes
-    } = classifyRegistry(this.registry, this._states);
-    this._reactive_events = reactiveEvents;
+      static_targets,
+      has_dynamic_resolvers,
+      reactive_events,
+      event_to_state,
+      event_to_lanes
+    } = classify_registry(this.registry, this._states);
+    this._reactive_events = reactive_events;
     this._listen = options.listen !== false;
     this._drain = options.drain !== false;
-    this._event_to_state = eventToState;
-    this._event_to_lanes = eventToLanes;
-    const allLanes = ["default", ...lanes.map((l) => l.name)];
-    const onlySet = options.onlyLanes && options.onlyLanes.length > 0 ? new Set(options.onlyLanes) : void 0;
-    const activeLanes = onlySet ? allLanes.filter((n) => onlySet.has(n)) : allLanes;
-    const singleDefaultLane = activeLanes.length === 1 && activeLanes[0] === "default";
+    this._event_to_state = event_to_state;
+    this._event_to_lanes = event_to_lanes;
+    const all_lanes = ["default", ...lanes.map((l) => l.name)];
+    const only_set = options.onlyLanes && options.onlyLanes.length > 0 ? new Set(options.onlyLanes) : void 0;
+    const active_lanes = only_set ? all_lanes.filter((n) => only_set.has(n)) : all_lanes;
+    const single_default_lane = active_lanes.length === 1 && active_lanes[0] === "default";
     this._drain_controllers = /* @__PURE__ */ new Map();
-    for (const name of activeLanes) {
+    for (const name of active_lanes) {
       const cfg = lanes.find((l) => l.name === name);
       const controller = new DrainController({
         logger: this._logger,
         ops: this._cd,
         registry: this.registry,
-        batchHandlers: this._batch_handlers,
+        batch_handlers: this._batch_handlers,
         handle: this._handle,
-        handleBatch: this._handle_batch,
-        onAcked: (acked) => this.emit("acked", acked),
-        onBlocked: (blocked) => this.emit("blocked", blocked),
+        handle_batch: this._handle_batch,
+        on_acked: (acked) => this.emit("acked", acked),
+        on_blocked: (blocked) => this.emit("blocked", blocked),
         // Pass lane only when a true per-lane controller is active.
         // The all-lanes (single default) case keeps lane=undefined so
         // adapter SQL collapses to the pre-1103 shape.
-        lane: singleDefaultLane ? void 0 : name,
+        lane: single_default_lane ? void 0 : name,
         defaults: cfg && {
           streamLimit: cfg.streamLimit,
           leaseMillis: cfg.leaseMillis
@@ -2101,22 +2130,22 @@ var Act = class {
     this._audit_deps = {
       store,
       logger: this._logger,
-      event_to_state: eventToState,
+      event_to_state,
       states: this._states,
-      known_events: new Set(eventToState.keys()),
+      known_events: new Set(event_to_state.keys()),
       declared_lanes: new Set(this._drain_controllers.keys()),
-      routed_events: new Set(eventToLanes.keys())
+      routed_events: new Set(event_to_lanes.keys())
     };
     this._correlate = new CorrelateCycle(
       this.registry,
-      staticTargets,
-      hasDynamicResolvers,
+      static_targets,
+      has_dynamic_resolvers,
       this._cd,
       options.maxSubscribedStreams ?? DEFAULT_MAX_SUBSCRIBED_STREAMS,
       // Cold start: assume drain is needed (historical events may need processing).
       // #803: writer-only instances skip the cold-start arm.
       () => {
-        if (this._drain && this._reactive_events.size > 0) this._armAll();
+        if (this._drain && this._reactive_events.size > 0) this._arm_all();
       }
     );
     this._settle = new SettleLoop(
@@ -2126,11 +2155,11 @@ var Act = class {
         checkpoint: () => this._correlate.checkpoint,
         correlate: (q) => this.correlate(q),
         drain: (o) => this.drain(o),
-        onSettled: (drain) => this.emit("settled", drain)
+        on_settled: (drain) => this.emit("settled", drain)
       },
       options.settleDebounceMs ?? DEFAULT_SETTLE_DEBOUNCE_MS
     );
-    this._notify_disposer = this._wireNotify(options.scoped?.store ?? store());
+    this._notify_disposer = this._wire_notify(options.scoped?.store ?? store());
     dispose(() => this.shutdown());
   }
   /** True after the first `shutdown()` call. Guards idempotency. */
@@ -2164,7 +2193,7 @@ var Act = class {
    * subscription was made). Errors during subscription are logged but
    * never thrown — `notify` is a hint, not a contract.
    */
-  async _wireNotify(s) {
+  async _wire_notify(s) {
     if (this._reactive_events.size === 0) return void 0;
     if (!s.notify) return void 0;
     if (!this._listen) return void 0;
@@ -2173,7 +2202,7 @@ var Act = class {
         try {
           this.emit("notified", notification);
           if (this._drain) {
-            const armed = this._armForEventNames(
+            const armed = this._arm_for_event_names(
               notification.events.map((e) => e.name)
             );
             if (armed) this._settle.schedule({ debounceMs: 0 });
@@ -2279,14 +2308,14 @@ var Act = class {
         skipValidation
       );
       if (this._reactive_events.size > 0)
-        this._armForEventNames(
+        this._arm_for_event_names(
           snapshots.map((s) => s.event.name)
         );
       this.emit("committed", snapshots);
       return snapshots;
     });
   }
-  async load(stateOrName, stream, callback, asOf) {
+  async load(stateOrName, stream, callback, asOf, actor) {
     return this._scoped(async () => {
       let merged;
       if (typeof stateOrName === "string") {
@@ -2296,7 +2325,7 @@ var Act = class {
       } else {
         merged = this._states.get(stateOrName.name) || stateOrName;
       }
-      return await this._es.load(merged, stream, callback, asOf);
+      return await this._es.load(merged, stream, callback, asOf, actor);
     });
   }
   /**
@@ -2390,6 +2419,34 @@ var Act = class {
       return events;
     });
   }
+  /**
+   * Wipe the sensitive-data payload for every event on the stream — see
+   * {@link IAct.forget}. Application-level half of #566.
+   *
+   * Throws on adapters without `Store.forget_pii`, invalidates the cache
+   * entry for the stream, emits the `forgotten` lifecycle event with the
+   * row count. Idempotent: a second call returns `{eventCount: 0}` and
+   * does NOT re-emit.
+   *
+   * @param stream - Target stream.
+   * @returns `{eventCount}` — number of events whose PII column was wiped.
+   */
+  async forget(stream) {
+    return this._scoped(async () => {
+      const s = store();
+      if (!s.forget_pii) {
+        throw new Error(
+          `Store does not implement forget_pii \u2014 adapter cannot comply with sensitive-data erasure. Use an adapter that declares pii_isolation: true (e.g. @rotorsoft/act on the in-memory store).`
+        );
+      }
+      const eventCount = await s.forget_pii(stream);
+      await cache().invalidate(stream);
+      if (eventCount > 0) {
+        this.emit("forgotten", { stream, at: /* @__PURE__ */ new Date(), eventCount });
+      }
+      return { eventCount };
+    });
+  }
   /**
    * Processes pending reactions by draining uncommitted events from the event store.
    *
@@ -2430,28 +2487,28 @@ var Act = class {
   async drain(options = {}) {
     if (!this._drain)
       return { fetched: [], leased: [], acked: [], blocked: [] };
-    return this._scoped(() => this._drainAll(options));
+    return this._scoped(() => this._drain_all(options));
   }
   /** Arm every active lane controller (ACT-1103). */
-  _armAll() {
+  _arm_all() {
     for (const c of this._drain_controllers.values()) c.arm();
   }
   /**
    * Arm only the lane controllers whose reactions match the supplied
    * event names (ACT-1103 selective arming). Events with any dynamic
-   * resolver fall back to `_armAll()` via the `"all"` sentinel — the
+   * resolver fall back to `_arm_all()` via the `"all"` sentinel — the
    * resolver's lane isn't known until correlate runs the function.
    * Events with no reactions are skipped; `_event_to_lanes` doesn't
    * carry them. Returns true when any controller was armed (used by
    * the notify handler to decide whether to schedule a settle).
    */
-  _armForEventNames(names) {
+  _arm_for_event_names(names) {
     const to_arm = /* @__PURE__ */ new Set();
     for (const name of names) {
       const set = this._event_to_lanes.get(name);
       if (set === void 0) continue;
       if (set === ALL_LANES) {
-        this._armAll();
+        this._arm_all();
         return true;
       }
       for (const lane of set) to_arm.add(lane);
@@ -2468,7 +2525,7 @@ var Act = class {
    * `SKIP LOCKED` keeps cross-controller races safe. Lifecycle events
    * (`acked`, `blocked`) may interleave by lane — listeners filter via
    * `lease.lane`. */
-  async _drainAll(options) {
+  async _drain_all(options) {
     const results = await Promise.all(
       [...this._drain_controllers.values()].map((c) => c.drain(options))
     );
@@ -2588,7 +2645,7 @@ var Act = class {
    * @see {@link stop_correlations} to stop the worker
    */
   start_correlations(query = {}, frequency = 1e4, callback) {
-    return this._correlate.startPolling(query, frequency, callback);
+    return this._correlate.start_polling(query, frequency, callback);
   }
   /**
    * Stops the automatic correlation worker.
@@ -2608,7 +2665,7 @@ var Act = class {
    * @see {@link start_correlations}
    */
   stop_correlations() {
-    this._correlate.stopPolling();
+    this._correlate.stop_polling();
   }
   /**
    * Cancels any pending or active settle cycle.
@@ -2654,7 +2711,7 @@ var Act = class {
   async reset(input) {
     return this._scoped(async () => {
       const count = await store().reset(input);
-      if (count > 0 && this._reactive_events.size > 0) this._armAll();
+      if (count > 0 && this._reactive_events.size > 0) this._arm_all();
       return count;
     });
   }
@@ -2688,7 +2745,7 @@ var Act = class {
   async unblock(input) {
     return this._scoped(async () => {
       const count = await store().unblock(input);
-      if (count > 0 && this._reactive_events.size > 0) this._armAll();
+      if (count > 0 && this._reactive_events.size > 0) this._arm_all();
       return count;
     });
   }
@@ -2914,14 +2971,14 @@ var Act = class {
     if (!targets.length) return { truncated: /* @__PURE__ */ new Map(), skipped: [] };
     return this._scoped(async () => {
       await this.correlate({ limit: 1e3 });
-      const closeActor = { id: "$close", name: "close" };
-      const result = await runCloseCycle(targets, {
-        reactiveEventsSize: this._reactive_events.size,
-        eventToState: this._event_to_state,
+      const close_actor = { id: "$close", name: "close" };
+      const result = await run_close_cycle(targets, {
+        reactive_events_size: this._reactive_events.size,
+        event_to_state: this._event_to_state,
         load: this._es.load,
         tombstone: this._es.tombstone,
         logger: this._logger,
-        correlation: closeCorrelation(this._correlator, closeActor)
+        correlation: close_correlation(this._correlator, close_actor)
       });
       this.emit("closed", result);
       return result;
@@ -2964,17 +3021,17 @@ var Act = class {
 };
 
 // src/builders/act-builder.ts
-function registerBatchHandler(proj, batchHandlers) {
+function register_batch_handler(proj, batch_handlers) {
   if (!proj.batchHandler || !proj.target) return;
-  const existing = batchHandlers.get(proj.target);
+  const existing = batch_handlers.get(proj.target);
   if (existing && existing !== proj.batchHandler) {
     throw new Error(`Duplicate batch handler for target "${proj.target}"`);
   }
-  batchHandlers.set(proj.target, proj.batchHandler);
+  batch_handlers.set(proj.target, proj.batchHandler);
 }
-function validateLaneReferences(registry, lanes) {
+function validate_lane_references(registry, lanes) {
   const declared = /* @__PURE__ */ new Set([DEFAULT_LANE, ...lanes.map((l) => l.name)]);
-  for (const [eventName, def] of Object.entries(registry.events)) {
+  for (const [event_name, def] of Object.entries(registry.events)) {
     const entry = def;
     for (const [handlerName, reaction] of entry.reactions) {
       const resolver = reaction.resolver;
@@ -2982,7 +3039,7 @@ function validateLaneReferences(registry, lanes) {
       const lane = resolver.lane;
       if (lane && !declared.has(lane)) {
         throw new Error(
-          `Reaction "${handlerName}" on "${eventName}" targets undeclared lane "${lane}". Declared lanes: ${[...declared].map((l) => `"${l}"`).join(", ")}. Add \`.withLane({ name: "${lane}", ... })\` to act() or correct the .to() declaration.`
+          `Reaction "${handlerName}" on "${event_name}" targets undeclared lane "${lane}". Declared lanes: ${[...declared].map((l) => `"${l}"`).join(", ")}. Add \`.withLane({ name: "${lane}", ... })\` to act() or correct the .to() declaration.`
         );
       }
     }
@@ -2990,76 +3047,80 @@ function validateLaneReferences(registry, lanes) {
 }
 function act() {
   const states = /* @__PURE__ */ new Map();
+  const _sf = /* @__PURE__ */ new Map();
+  const _dp = /* @__PURE__ */ new Map();
   const registry = {
     actions: {},
-    events: {}
+    events: {},
+    sensitive_fields: (event_name) => _sf.get(event_name) ?? [],
+    disclosure_predicate: (state_name) => _dp.get(state_name) ?? null
   };
-  const pendingProjections = [];
-  const batchHandlers = /* @__PURE__ */ new Map();
+  const pending_projections = [];
+  const batch_handlers = /* @__PURE__ */ new Map();
   const lanes = [];
   let _built = false;
-  const finalizeDeprecations = () => {
-    const deprecationSummary = [];
+  const finalize_deprecations = () => {
+    const deprecation_summary = [];
     for (const state2 of states.values()) {
-      const eventNames = Object.keys(state2.events);
-      const deprecated = deprecatedEventNames(eventNames);
+      const event_names = Object.keys(state2.events);
+      const deprecated = deprecated_event_names(event_names);
       if (deprecated.size === 0) continue;
       state2._deprecated = deprecated;
       for (const name of deprecated) {
-        const current = currentVersionOf(name, eventNames);
-        deprecationSummary.push({
-          stateName: state2.name,
+        const current = current_version_of(name, event_names);
+        deprecation_summary.push({
+          state_name: state2.name,
           deprecated: name,
           current
         });
       }
-      for (const [actionName, handler] of Object.entries(state2.on)) {
-        const staticTarget = handler?._staticEmit;
-        if (staticTarget && deprecated.has(staticTarget)) {
-          const current = currentVersionOf(staticTarget, eventNames);
+      for (const [action_name, handler] of Object.entries(state2.on)) {
+        const static_target = handler?._static_emit;
+        if (static_target && deprecated.has(static_target)) {
+          const current = current_version_of(static_target, event_names);
           throw new Error(
-            `Action "${actionName}" in state "${state2.name}" emits deprecated event "${staticTarget}". A newer version exists: "${current}". Update the .emit() call to target the current version. The reducer (.patch) for "${staticTarget}" stays as-is \u2014 historical events still need it.`
+            `Action "${action_name}" in state "${state2.name}" emits deprecated event "${static_target}". A newer version exists: "${current}". Update the .emit() call to target the current version. The reducer (.patch) for "${static_target}" stays as-is \u2014 historical events still need it.`
           );
         }
       }
     }
-    if (deprecationSummary.length > 0) {
-      const list = deprecationSummary.map(
-        (d) => `"${d.deprecated}" (current: "${d.current}", state: "${d.stateName}")`
+    if (deprecation_summary.length > 0) {
+      const list = deprecation_summary.map(
+        (d) => `"${d.deprecated}" (current: "${d.current}", state: "${d.state_name}")`
       ).join(", ");
       log().info(
-        `Act registered ${deprecationSummary.length} deprecated event(s): ${list}. These are legacy versions kept for the read path. Consider truncating closed streams via app.close() when feasible to reduce historical event load. See docs/docs/architecture/event-schema-evolution.md.`
+        `Act registered ${deprecation_summary.length} deprecated event(s): ${list}. These are legacy versions kept for the read path. Consider truncating closed streams via app.close() when feasible to reduce historical event load. See docs/docs/architecture/event-schema-evolution.md.`
       );
     }
   };
   const builder = {
     withState: (state2) => {
-      registerState(state2, states, registry.actions, registry.events);
+      register_state(state2, states, registry.actions, registry.events);
       return builder;
     },
     withSlice: (input) => {
       for (const s of input.states.values()) {
-        registerState(s, states, registry.actions, registry.events);
+        register_state(s, states, registry.actions, registry.events);
       }
-      mergeEventRegister(registry.events, input.events);
-      pendingProjections.push(...input.projections);
-      for (const sliceLane of input.lanes) {
-        const existing = lanes.find((l) => l.name === sliceLane.name);
+      merge_event_register(registry.events, input.events);
+      pending_projections.push(...input.projections);
+      for (const slice_lane of input.lanes) {
+        const existing = lanes.find((l) => l.name === slice_lane.name);
         if (!existing) {
-          lanes.push(sliceLane);
+          lanes.push(slice_lane);
           continue;
         }
-        if (existing.leaseMillis !== sliceLane.leaseMillis || existing.streamLimit !== sliceLane.streamLimit || existing.cycleMs !== sliceLane.cycleMs) {
+        if (existing.leaseMillis !== slice_lane.leaseMillis || existing.streamLimit !== slice_lane.streamLimit || existing.cycleMs !== slice_lane.cycleMs) {
           throw new Error(
-            `Lane "${sliceLane.name}" was already declared with a different config`
+            `Lane "${slice_lane.name}" was already declared with a different config`
           );
         }
       }
       return builder;
     },
     withProjection: (proj) => {
-      mergeProjection(proj, registry.events);
-      registerBatchHandler(proj, batchHandlers);
+      merge_projection(proj, registry.events);
+      register_batch_handler(proj, batch_handlers);
       return builder;
     },
     withActor: () => builder,
@@ -3097,18 +3158,70 @@ function act() {
     }),
     build: (options) => {
       if (!_built) {
-        for (const proj of pendingProjections) {
-          mergeProjection(proj, registry.events);
-          registerBatchHandler(proj, batchHandlers);
+        for (const proj of pending_projections) {
+          merge_projection(proj, registry.events);
+          register_batch_handler(proj, batch_handlers);
+        }
+        finalize_deprecations();
+        validate_lane_references(registry, lanes);
+        for (const [event_name, reg] of Object.entries(
+          registry.events
+        )) {
+          const fields = pii_fields(reg.schema);
+          if (fields.length === 0) continue;
+          _sf.set(event_name, fields);
+          for (const [name, reaction] of reg.reactions) {
+            const inner = reaction.handler;
+            const wrapped = (event, stream, app) => inner(pii_strip(event, fields), stream, app);
+            Object.defineProperty(wrapped, "name", { value: inner.name });
+            reaction.handler = wrapped;
+            reg.reactions.set(name, reaction);
+          }
+        }
+        for (const state2 of states.values()) {
+          if (state2.disclose) _dp.set(state2.name, state2.disclose);
+          const fields_by_event = /* @__PURE__ */ new Map();
+          for (const event_name of Object.keys(state2.events)) {
+            const fields = _sf.get(event_name);
+            if (fields) fields_by_event.set(event_name, fields);
+          }
+          if (fields_by_event.size === 0) continue;
+          if (state2.snap) {
+            const offending = [...fields_by_event.keys()];
+            throw new Error(
+              `State "${state2.name}" cannot snapshot \u2014 events {${offending.join(", ")}} carry sensitive fields. Snapshots write derived state into __snapshot__.data, which forget_pii cannot reach. Remove .snap() or remove sensitive(...) markers.`
+            );
+          }
+          const disclose = state2.disclose ?? null;
+          state2.view = (event, actor) => {
+            const fields = fields_by_event.get(event.name);
+            return fields ? pii_gate(event, fields, disclose, actor) : event;
+          };
+          state2.message = (validated) => {
+            const fields = fields_by_event.get(validated.name);
+            return fields ? pii_split(validated, fields) : validated;
+          };
+          for (const [event_name, fields] of fields_by_event) {
+            const original = state2.patch[event_name];
+            state2.patch[event_name] = (event, s) => original(pii_merge(event, fields), s);
+          }
+        }
+        for (const [target, original] of batch_handlers) {
+          const wrapped = async (events, stream) => {
+            const stripped = events.map((e) => {
+              const f = _sf.get(e.name);
+              return f ? pii_strip(e, f) : e;
+            });
+            return original(stripped, stream);
+          };
+          batch_handlers.set(target, wrapped);
         }
-        finalizeDeprecations();
-        validateLaneReferences(registry, lanes);
         _built = true;
       }
       return new Act(
         registry,
         states,
-        batchHandlers,
+        batch_handlers,
         options,
         lanes
       );
@@ -3121,7 +3234,7 @@ function act() {
 // src/builders/projection-builder.ts
 function _projection(target) {
   const events = {};
-  const defaultResolver = typeof target === "string" ? { target } : void 0;
+  const default_resolver = typeof target === "string" ? { target } : void 0;
   const base = {
     on: (entry) => {
       const keys = Object.keys(entry);
@@ -3138,7 +3251,7 @@ function _projection(target) {
         do: (handler) => {
           const reaction = {
             handler,
-            resolver: defaultResolver ?? _this_,
+            resolver: default_resolver ?? _this_,
             options: {
               blockOnError: true,
               maxRetries: 3
@@ -3194,7 +3307,7 @@ function slice() {
   const lanes = [];
   const builder = {
     withState: (state2) => {
-      registerState(state2, states, actions, events);
+      register_state(state2, states, actions, events);
       return builder;
     },
     withProjection: (proj) => {
@@ -3250,12 +3363,12 @@ function state(entry) {
   const keys = Object.keys(entry);
   if (keys.length !== 1) throw new Error("state() requires exactly one key");
   const name = keys[0];
-  const stateSchema = entry[name];
+  const state_schema = entry[name];
   return {
     init(init) {
       return {
         emits(events) {
-          const defaultPatch = Object.fromEntries(
+          const default_patch = Object.fromEntries(
             Object.keys(events).map((k) => {
               const fn = Object.assign(({ data }) => data, {
                 _passthrough: true
@@ -3266,11 +3379,16 @@ function state(entry) {
           const internal = {
             events,
             actions: {},
-            state: stateSchema,
+            state: state_schema,
             name,
             init,
-            patch: defaultPatch,
-            on: {}
+            patch: default_patch,
+            on: {},
+            // Step delegates initialized as identity. `act().build()`
+            // overrides on states with `sensitive(...)` events to bake in
+            // the gate / split.
+            view: (event) => event,
+            message: (validated) => validated
           };
           const builder = action_builder(internal);
           return Object.assign(builder, {
@@ -3306,11 +3424,14 @@ function action_builder(state2) {
       }
       function emit(handler) {
         if (typeof handler === "string") {
-          const eventName = handler;
-          const emitFn = Object.assign((payload) => [eventName, payload], {
-            _staticEmit: eventName
-          });
-          internal.on[action2] = emitFn;
+          const event_name = handler;
+          const emit_fn = Object.assign(
+            (payload) => [event_name, payload],
+            {
+              _static_emit: event_name
+            }
+          );
+          internal.on[action2] = emit_fn;
         } else {
           internal.on[action2] = handler;
         }
@@ -3322,6 +3443,10 @@ function action_builder(state2) {
       internal.snap = snap2;
       return builder;
     },
+    discloses(disclose) {
+      internal.disclose = disclose;
+      return builder;
+    },
     build() {
       return internal;
     }
@@ -3359,7 +3484,7 @@ var CsvFile = class {
     let header = null;
     for await (const line of lines) {
       if (!line.trim()) continue;
-      const fields = parseCsvLine(line);
+      const fields = parse_csv_line(line);
       if (!header) {
         header = fields;
         const expected = CSV_COLUMNS.join(",");
@@ -3396,21 +3521,21 @@ var CsvFile = class {
       flags: "w",
       encoding: "utf8"
     });
-    let nextId = 1;
+    let next_id = 1;
     try {
-      await writeLine(writer, CSV_COLUMNS.join(","));
+      await write_line(writer, CSV_COLUMNS.join(","));
       await driver(async (event) => {
-        const id = nextId++;
+        const id = next_id++;
         const row = [
           String(id),
-          csvEscape(event.name),
-          csvEscape(JSON.stringify(event.data)),
-          csvEscape(event.stream),
+          csv_escape(event.name),
+          csv_escape(JSON.stringify(event.data)),
+          csv_escape(event.stream),
           String(event.version),
           event.created.toISOString(),
-          csvEscape(JSON.stringify(event.meta))
+          csv_escape(JSON.stringify(event.meta))
         ].join(",");
-        await writeLine(writer, row);
+        await write_line(writer, row);
         return id;
       });
     } finally {
@@ -3443,7 +3568,7 @@ async function* linesFromBlob(blob) {
     await Promise.resolve();
   }
 }
-function parseCsvLine(line) {
+function parse_csv_line(line) {
   const fields = [];
   let i = 0;
   while (i < line.length) {
@@ -3476,11 +3601,11 @@ function parseCsvLine(line) {
   }
   return fields;
 }
-function csvEscape(value) {
+function csv_escape(value) {
   if (/[",\n\r]/.test(value)) return `"${value.replace(/"/g, '""')}"`;
   return value;
 }
-function writeLine(writer, line) {
+function write_line(writer, line) {
   return new Promise((resolve, reject) => {
     writer.write(`${line}
 `, (err) => {
@@ -3511,6 +3636,8 @@ export {
   NonRetryableError,
   PackageSchema,
   QuerySchema,
+  REDACTED,
+  SHREDDED,
   SNAP_EVENT,
   StreamClosedError,
   TOMBSTONE_EVENT,
@@ -3527,6 +3654,7 @@ export {
   port,
   projection,
   scoped,
+  sensitive,
   sleep,
   slice,
   state,