@salesforce/lds-worker-api 1.466.0 → 1.467.0

package/dist/standalone/umd/lds-worker-api.js

@@ -4282,7 +4282,7 @@
         }
         callbacks.push(callback);
     }
-    // version: 1.466.0-b7b08a8e3c
+    // version: 1.467.0-4f065d2a2a
 
     // TODO [TD-0081508]: once that TD is fulfilled we can probably change this file
     function instrumentAdapter$1(createFunction, _metadata) {
@@ -5326,7 +5326,7 @@
         const { apiFamily, name } = metadata;
         return createGraphQLWireAdapterConstructor$1(adapter, `${apiFamily}.${name}`, luvio, astResolver);
     }
-    // version: 1.466.0-b7b08a8e3c
+    // version: 1.467.0-4f065d2a2a
 
     function isSupportedEntity(_objectApiName) {
         return true;
@@ -32571,7 +32571,7 @@
         throttle(60, 60000, setupNotifyAllListRecordUpdateAvailable(luvio));
         throttle(60, 60000, setupNotifyAllListInfoSummaryUpdateAvailable(luvio));
     });
-    // version: 1.466.0-ba624febc8
+    // version: 1.467.0-049a8b6027
 
     var draftQueueMaxRetryAttemptsGate = {
         isOpen: function (e) {
@@ -44103,6 +44103,15 @@
         return luvioDocumentNode;
     }
 
+    var parentRelationshipPrefetchKillSwitch = {
+        isOpen: function (e) {
+            return e.fallback;
+        },
+        hasError: function () {
+            return !0;
+        },
+    };
+
     var graphqlRelationshipFieldsPerf = {
         isOpen: function (e) {
             return e.fallback;
@@ -48056,6 +48065,14 @@
          * Triggered after the Draft Queue state changes
          */
         DraftQueueEventType["QueueStateChanged"] = "state";
+        /**
+         * Triggered when batch-journal crash recovery (B2, Performance Upload path)
+         * could not complete: a maybe-committed all-or-none batch's members could not
+         * be durably quarantined this session, a startup reconcile failed, or a
+         * resolved journal row could not be cleared. Carries only a bounded reason
+         * code (no ids/messages) so it is safe to surface to o11y.
+         */
+        DraftQueueEventType["BatchRecoveryFailed"] = "batchRecoveryFailed";
     })(DraftQueueEventType || (DraftQueueEventType = {}));
     var QueueOperationType;
     (function (QueueOperationType) {
@@ -48265,6 +48282,8 @@
             mergeActions: () => {
                 throw Error('mergeActions not supported for custom actions');
             },
+            getDraftIdsFromAction: (action) => [action.targetId],
+            getRedirectMappings: () => undefined,
         };
     }
 
@@ -48348,6 +48367,13 @@
             const handler = customActionHandler(executor, id, this);
             return this.addHandler(handler);
         }
+        /**
+         * True when a handler for `id` is registered on this queue — i.e. this queue owns
+         * (and drains) the actions carrying that handlerId.
+         */
+        isHandlerRegistered(id) {
+            return this.handlers[id] !== undefined;
+        }
         getQueueState() {
             return this.state;
         }
@@ -48372,6 +48398,11 @@
             }
             this.retryIntervalMilliseconds = 0;
             this.state = DraftQueueState.Started;
+            // Stuck-queue detection: a live upload keeps the queue Started (filtered by the early
+            // return above), so a stale uploadingActionId here strands processNextAction() on it.
+            if (this.uploadingActionId !== undefined && this.logger) {
+                this.logger.logWarning(`Draft queue restarting with action still marked uploading (stale uploadingActionId=${this.uploadingActionId}); possible abandoned-upload stuck queue`);
+            }
             await this.notifyChangedListeners({
                 type: DraftQueueEventType.QueueStateChanged,
                 state: this.state,
@@ -48902,239 +48933,1814 @@
         }
     }
 
-    function clone$1(obj) {
-        return parse$6(stringify$6(obj));
+    /**
+     * Narrows a peer DraftQueue to one that also participates in cross-queue
+     * coordination. A peer may be a NimbusDraftQueue (gate-ON on-device path),
+     * which implements DraftQueue but NOT CrossQueueCoordination, so this check
+     * is load-bearing, not defensive.
+     */
+    function isCrossQueueCoordination(queue) {
+        const candidate = queue;
+        return (typeof candidate.applyDraftIdRedirects === 'function' &&
+            typeof candidate.resumeDeferredActions === 'function' &&
+            typeof candidate.getInFlightRewritableDraftIds === 'function' &&
+            typeof candidate.getOwnedQueueActions === 'function');
     }
-
-    const DRAFT_ACTION_KEY_JUNCTION = '__DraftAction__';
-    function buildDraftDurableStoreKey(recordKey, draftActionId) {
-        return `${recordKey}${DRAFT_ACTION_KEY_JUNCTION}${draftActionId}`;
+    /**
+     * Maximum number of draft actions to combine into a single UI-API Batch
+     * request when batching is enabled. Tunable; chosen as a conservative starting
+     * point that bounds payload size and retry cost while still amortizing TTFB
+     * across many actions.
+     */
+    const MAX_BATCH_SIZE$1 = 25;
+    /**
+     * How many times clearBatchJournalIfSupported retries a failed journal clear
+     * before giving up and escalating the log line. Bounded so a permanently-failing
+     * store can't spin. A leftover row is mainly a scale concern (unbounded restart
+     * reconcile); it can also cause a rare, fail-safe over-quarantine — a definitively
+     * rolled-back batch's still-Pending siblings surface as commit-ambiguous on the
+     * next restart (never a replay, since the envelope records no rolled-back outcome).
+     * A small bound suffices for the spin guard; a durable rolled-back/resolved
+     * tombstone is the follow-up to close the over-quarantine before queueBatching is
+     * enabled (4077120435).
+     */
+    const CLEAR_JOURNAL_MAX_ATTEMPTS = 3;
+    /**
+     * Diagnostic log line for the local-experimental batching path. Routes through
+     * JSLoggerPlugin.logInfo so messages surface in the iOS device log, each line
+     * prefixed with `Batch `. Silently no-ops outside the LWR JSC environment.
+     */
+    function batchLog$1(line) {
+        try {
+            globalThis.__nimbus?.plugins?.JSLoggerPlugin?.logInfo(`Batch ${line}`);
+        }
+        catch {
+            // debug-only; never fail real work because of logging
+        }
     }
     /**
-     * Implements a write-through InMemoryStore for Drafts, storing all drafts in a
-     * in-memory store with a write through to the DurableStore.
-     *
-     * Before any reads or writes come in from the draft queue, we need to revive the draft
-     * queue into memory. During this initial revive, any writes are queued up and operated on the
-     * queue once it's in memory. Similarly any reads are delayed until the queue is in memory.
-     *
+     * Bounded, scrubbed rendering of a caught value for the device log. Emits only
+     * the error constructor NAME (e.g. "TypeError"), never the free-text message,
+     * which can embed record ids (URL path segments) or server field-validation
+     * strings. Mirrors the device-log PII policy in metrics.ts
+     * (reportDraftActionUploadError): bounded metadata only; full detail belongs on
+     * the structured, scrubbed o11y path (4065667273).
      */
-    class DurableDraftStore {
-        constructor(durableStore, instrumentation, useSnapshot = true) {
-            this.draftStore = {};
-            // Snapshot: holds deep clones of each draft, refreshed at write time.
-            // getAllDrafts serves from this snapshot with zero deep clones per read.
-            this.cleanSnapshot = {};
-            // queue of writes that were made during the initial sync
-            this.writeQueue = [];
-            this.durableStore = durableStore;
-            this.instrumentation = instrumentation;
-            this.useSnapshot = useSnapshot;
-            this.resyncDraftStore();
+    function errName(e) {
+        try {
+            const name = e?.name;
+            if (typeof name !== 'string' || name.length === 0) {
+                return 'Error';
+            }
+            // Strip everything outside printable ASCII, then bound the length. The
+            // id/free-text PII vector is already closed by reading `.name` (a
+            // constructor name) and never `.message` (see above) — but a thrown object
+            // can carry an arbitrary `name` (and reading it can trip a getter), so a
+            // newline or control character could still break device-log-line integrity
+            // and a pathological length could blow up a log entry. This drops control
+            // sequences and bounds length; it does NOT attempt to strip a printable
+            // identifier, since nothing in this path populates `.name` with one
+            // (4077120502).
+            const cleaned = name.replace(/[^\x20-\x7E]/g, '');
+            if (cleaned.length === 0) {
+                return 'Error';
+            }
+            return cleaned.length > 64 ? cleaned.slice(0, 64) : cleaned;
         }
-        // When no instrumentation is injected the promise is returned as-is (zero overhead).
-        timeDurableOp(op, segment, run) {
-            const onDurableOperation = this.instrumentation?.onDurableOperation;
-            if (onDurableOperation === undefined) {
-                return run();
-            }
-            const start = Date.now();
-            return run().finally(() => {
-                onDurableOperation(op, segment, Date.now() - start);
-            });
+        catch {
+            // Reading `.name` threw (a hostile getter). Scrubbing a value for the
+            // log must never itself throw and take down the caller's error path.
+            return 'Error';
         }
-        writeAction(action) {
-            const addAction = () => {
-                const { id, tag } = action;
-                this.draftStore[id] = action;
-                this.cleanSnapshot[id] = clone$1(action);
-                const durableEntryKey = buildDraftDurableStoreKey(tag, id);
-                const entry = {
-                    data: action,
-                };
-                const entries = { [durableEntryKey]: entry };
-                return this.timeDurableOp('setEntries', DRAFT_SEGMENT, () => this.durableStore.setEntries(entries, DRAFT_SEGMENT));
+    }
+    /**
+     * Builds the queue operations needed to rewrite every queued action whose
+     * basePath/body text contains a draft id from `redirects`. If a queued
+     * action's tag matches a redirect's draftKey, the action is deleted and
+     * re-added at the canonical key. Pure function — no draft-store side
+     * effects. Used by PerformanceDraftQueue.applyDraftIdRedirects to propagate
+     * a peer queue's POST completion across queues.
+     */
+    function rewriteQueueActionsForRedirects(queue, redirects) {
+        const queueOperations = [];
+        if (redirects.length === 0) {
+            return queueOperations;
+        }
+        for (let i = 0, len = queue.length; i < len; i++) {
+            const queueAction = queue[i];
+            const data = queueAction.data;
+            if (data === undefined ||
+                data === null ||
+                typeof data.method !== 'string' ||
+                data.body === undefined) {
+                continue;
+            }
+            let basePath = data.basePath || '';
+            let stringifiedBody = JSON.stringify(data.body || '');
+            let mutated = false;
+            let updatedTag;
+            let updatedTargetId;
+            for (const r of redirects) {
+                if (basePath.indexOf(r.draftId) >= 0 || stringifiedBody.indexOf(r.draftId) >= 0) {
+                    const re = new RegExp(r.draftId, 'g');
+                    basePath = basePath.replace(re, r.canonicalId);
+                    stringifiedBody = stringifiedBody.replace(re, r.canonicalId);
+                    mutated = true;
+                }
+                if (queueAction.tag === r.draftKey) {
+                    updatedTag = r.canonicalKey;
+                    updatedTargetId = r.canonicalId;
+                }
+            }
+            if (!mutated) {
+                continue;
+            }
+            const baseUpdated = {
+                ...queueAction,
+                data: { ...data, basePath, body: JSON.parse(stringifiedBody) },
             };
-            return this.enqueueAction(addAction);
+            if (updatedTag !== undefined && updatedTargetId !== undefined) {
+                queueOperations.push({ type: QueueOperationType.Delete, id: queueAction.id });
+                queueOperations.push({
+                    type: QueueOperationType.Add,
+                    action: { ...baseUpdated, tag: updatedTag, targetId: updatedTargetId },
+                });
+            }
+            else {
+                queueOperations.push({
+                    type: QueueOperationType.Update,
+                    id: queueAction.id,
+                    action: baseUpdated,
+                });
+            }
         }
-        getAllDrafts() {
-            const waitForOngoingSync = this.syncPromise || Promise.resolve();
-            return waitForOngoingSync.then(() => {
-                const actionArray = [];
-                if (this.useSnapshot) {
-                    const { cleanSnapshot } = this;
-                    const keys$1 = keys$4(cleanSnapshot);
-                    for (let i = 0, len = keys$1.length; i < len; i++) {
-                        const key = keys$1[i];
-                        // Return shallow spread of snapshot entries so top-level caller mutations
-                        // (e.g., .status =) don't persist into the snapshot. The snapshot itself
-                        // is a deep clone of draftStore, so no nested mutation reaches draftStore.
-                        actionArray.push({ ...cleanSnapshot[key] });
-                    }
+        return queueOperations;
+    }
+    /**
+     * The Performance Upload draft queue. Extends {@link DurableDraftQueue} — the
+     * base class is byte-identical to today's shipped serial queue — and adds the
+     * multi-candidate concurrent scheduler, Set-based in-flight tracking,
+     * cross-queue redirect propagation, and UI-API batching. Only constructed on
+     * the gate-ON code path; gate-off customers never run any of this.
+     */
+    class PerformanceDraftQueue extends DurableDraftQueue {
+        constructor(draftStore, { getPeerQueues = () => [], concurrency = 1, strictOrdering = true, queueBatching = false, } = {}) {
+            super(draftStore);
+            this.uploadingActionIds = new Set();
+            // Reentrancy guard for processNextAction, which dispatches into free concurrency
+            // slots with eligible actions. It is invoked un-awaited from several sites
+            // (actionCompleted, applyDraftIdRedirects, resumeDeferredActions, enqueue)
+            // and awaits mid-pass to read peer state, so without this two passes could
+            // clear the concurrency guard, select the same action, and dispatch it
+            // twice. `isDispatching` is set synchronously before any await; a concurrent
+            // entrant records `redispatchRequested` and bails, and the active pass re-runs
+            // to honor the missed wakeup.
+            this.isDispatching = false;
+            this.redispatchRequested = false;
+            // Monotonic counter used to mint a unique batchId per dispatched batch
+            // (combined with the head action id). Deterministic and dependency-free —
+            // no Date/random — and unique within a session; across restarts a journal
+            // is either cleared on completion or consumed by reconcile, so ids never
+            // collide meaningfully.
+            this.batchSequence = 0;
+            // Guards the one-time batch-completion journal reconcile so it runs on the
+            // first startQueue of the process (crash recovery) and not on every
+            // stop/start cycle. Holds the in-flight reconcile promise rather than a
+            // set-first boolean: startQueue can be called concurrently at launch (the
+            // first call's reconcile awaits before super.startQueue() marks the queue
+            // Started, so a second call still passes the base state guard). A boolean
+            // set before the await would let that second call skip reconcile and begin
+            // dispatching — re-batching a journaled, committed, not-yet-resolved member
+            // and dropping its idempotency key. Every caller awaits the same promise,
+            // so no dispatch begins until the members are surfaced as errors.
+            this.reconcileBatchJournalsPromise = undefined;
+            // Actions currently in retry backoff. A failed-but-retryable action stays
+            // Pending in the store, so without this a re-entrant dispatch pass (a peer
+            // kick or a sibling completion) could re-select and re-dispatch it before
+            // its backoff timer fires. Populated in actionFailed's retry branch and
+            // cleared per-action when that action's own backoff timer elapses, plus on
+            // permanent failure / removal.
+            this.retryingActionIds = new Set();
+            // Members of a maybe-committed batch whose commit status could NOT be moved
+            // to a durable Error this session (both the atomic completion and the
+            // commit-ambiguous quarantine write failed — the store was rejecting writes
+            // right after the server committed). They are still Pending in the store, so
+            // without this guard a later startQueue / retryAllErrors / reconnect would
+            // re-select them and re-batch keyless, replaying a maybe-committed write
+            // (Option A forbids that). Excluded from dispatch (isDispatchable and the
+            // single-action candidate loop) until they are durably resolved. In-memory
+            // only: it bridges the current session; a restart clears it and the retained
+            // batch journal is surfaced by reconcile before dispatch instead.
+            this.commitAmbiguousUnresolvedIds = new Set();
+            // Per-action retry backoff state. The serial base tracks a single
+            // `timeoutHandler` + single `retryIntervalMilliseconds`, which conflate
+            // concurrent retries: two actions failing at different times would overwrite
+            // each other's timer (leaking the earlier one) and share one exponential
+            // interval, so the first timer to fire would unpark every retrying action on
+            // whichever backoff happened to be shortest. A concurrent queue instead
+            // parks each action under its OWN timer and its OWN growing interval, keyed
+            // by action id, so each retries on its own schedule independent of siblings.
+            this.retryTimers = new Map();
+            this.retryIntervals = new Map();
+            // Draft ids of in-flight/just-completed POSTs whose redirects have not yet
+            // been applied to peer queues. actionCompleted resolves a completing POST
+            // out of the store (completeAction) BEFORE propagateRedirectsToPeers
+            // fire-and-forgets the rewrite to peers, so between those two points
+            // getInFlightRewritableDraftIds would no longer see the id in the store and
+            // a peer could dispatch a queued action still carrying the stale draft id.
+            // Ids are retained here before completeAction and released only once the
+            // peer applyDraftIdRedirects calls settle; getInFlightRewritableDraftIds
+            // unions this set so peers keep deferring across the gap.
+            this.redirectingDraftIds = new Set();
+            this.getPeerQueues = getPeerQueues;
+            this.concurrency = concurrency;
+            this.strictOrdering = strictOrdering;
+            this.queueBatching = queueBatching;
+        }
+        /**
+         * One-time batch-journal crash recovery (B2). A journal entry that survives
+         * a restart means a batch was dispatched but its members were never
+         * confirmed removed — the app may have died after the server committed the
+         * all-or-none request. Any journaled member still Pending might therefore be
+         * committed already, and the batch envelope carried no server-visible
+         * idempotency key, so it must not be re-batched OR re-dispatched (either
+         * would risk replaying a committed write). Surface every still-Pending member
+         * as a commit-ambiguous error for manual resolution (Option A). The journal
+         * entry is cleared only once its members are resolved (surfaced or already
+         * gone), so a failure to record the error leaves the entry for the next
+         * startup.
+         */
+        reconcileBatchJournalsOnce() {
+            // Memoize the in-flight promise so concurrent startQueue calls all await
+            // the same reconcile (see reconcileBatchJournalsPromise). Assigning
+            // before the first await is the point: a later caller reuses this
+            // promise instead of racing past a boolean that was flipped before the
+            // pinning work ran.
+            //
+            // Reconcile must fail CLOSED (4065665821): if it rejects, startQueue does
+            // NOT dispatch. But the failure must be RETRYABLE — clear the memo on
+            // rejection so the next startQueue re-runs the reconcile rather than
+            // reusing a cached rejection and never recovering. Success stays memoized
+            // (runs at most once per process).
+            if (this.reconcileBatchJournalsPromise === undefined) {
+                this.reconcileBatchJournalsPromise = this.runBatchJournalReconcile().catch((e) => {
+                    this.reconcileBatchJournalsPromise = undefined;
+                    // Single choke point for every reconcile failure (journal read
+                    // error, resolve failure, or missing journal support): surface one
+                    // bounded o11y signal before re-throwing so startQueue still fails
+                    // closed. Fire-and-forget — the rejection must propagate unchanged.
+                    this.signalBatchRecoveryFailed('reconcile-failed');
+                    throw e;
+                });
+            }
+            return this.reconcileBatchJournalsPromise;
+        }
+        async runBatchJournalReconcile() {
+            // Nothing journals when batching is off, so there is nothing to reconcile.
+            if (!this.queueBatching) {
+                return;
+            }
+            const store = this.draftStore;
+            if (typeof store.readRecoverableBatchJournals !== 'function' ||
+                typeof store.clearBatchJournal !== 'function' ||
+                typeof store.writeBatchJournal !== 'function') {
+                // Batching is ON but the store cannot journal. Dispatching would batch
+                // keyless writes with no crash backstop, so refuse to start rather than
+                // silently run unprotected (4065665821). Throwing keeps startQueue
+                // stopped; a store misconfigured this way will keep failing, which is
+                // the intended fail-closed outcome.
+                // eslint-disable-next-line @salesforce/lds/no-error-in-production
+                throw new Error('PerformanceDraftQueue: batching enabled but the DraftStore lacks batch-journal support');
+            }
+            // A read failure THROWS here (not swallowed): it propagates through
+            // reconcileBatchJournalsOnce so startQueue stays stopped and retries,
+            // rather than proceeding to dispatch a member of a batch that may have
+            // already committed (4065665821). Only RECOVERABLE journals are read —
+            // crash residue from a dead process. A journal stamped with the live
+            // session's token is a batch still in flight (possibly on a sibling queue
+            // sharing this store); reconciling it would quarantine live members out
+            // from under their owner, so the store filters those out.
+            const journals = await store.readRecoverableBatchJournals();
+            if (journals.length === 0) {
+                return;
+            }
+            for (const journal of journals) {
+                // A journaled member that never completed was in-flight when the
+                // process died: the batch MAY have committed, and the envelope carried
+                // no server-visible idempotency key, so we do NOT re-batch or
+                // re-dispatch it. Surface every still-Pending member as commit-ambiguous
+                // for manual resolution (Option A), then clear the journal once resolved.
+                // A resolve failure THROWS (via reconcileBatchJournalsOnce) so startup
+                // stays stopped-but-retryable and the journal is retained.
+                //
+                // errorAmbiguousActions reads its own fresh draft snapshot per call
+                // rather than sharing one across this loop: each iteration awaits
+                // completeAction and listener callbacks, which can delete a member
+                // (listener re-entrancy, or a concurrent removeDraftAction/deleteByTag),
+                // and a snapshot held across the loop would let a later journal
+                // resurrect that just-deleted member as an Error draft via the blind
+                // Update in completeAction (4077120311). A fresh read per journal costs
+                // O(journals × drafts), acceptable on this once-per-process
+                // crash-recovery path.
+                const resolved = await this.errorAmbiguousActions(journal.memberIds);
+                if (resolved) {
+                    await this.clearBatchJournalIfSupported(journal.batchId);
                 }
                 else {
-                    // Killswitch (W-23515682): original pre-fix behavior — deep-clone every draft on
-                    // every read so the internal draft store is never exposed. O(N) clones per read.
-                    const { draftStore } = this;
-                    const keys$1 = keys$4(draftStore);
-                    for (let i = 0, len = keys$1.length; i < len; i++) {
-                        actionArray.push(clone$1(draftStore[keys$1[i]]));
-                    }
+                    // eslint-disable-next-line @salesforce/lds/no-error-in-production
+                    throw new Error(`PerformanceDraftQueue: batch journal ${journal.batchId} could not be reconciled`);
                 }
-                return actionArray;
-            });
+            }
         }
-        deleteDraft(id) {
-            const deleteAction = () => {
-                const draft = this.draftStore[id];
-                if (draft !== undefined) {
-                    delete this.draftStore[id];
-                    delete this.cleanSnapshot[id];
-                    const durableKey = buildDraftDurableStoreKey(draft.tag, draft.id);
-                    return this.timeDurableOp('evictEntries', DRAFT_SEGMENT, () => this.durableStore.evictEntries([durableKey], DRAFT_SEGMENT));
+        // Overrides DurableDraftQueue.getQueueActions rather than reusing it: the
+        // base marks the single in-flight action from its private `uploadingActionId`
+        // (serial path), while the concurrent path tracks many in-flight ids in
+        // `uploadingActionIds`. The base field is private, so the uploading check
+        // cannot be shared without a base refactor; the rest of the body (sort) is
+        // deliberately kept identical. If the base sort changes, mirror it here.
+        async getQueueActions() {
+            const drafts = (await this.draftStore.getAllDrafts());
+            const queue = [];
+            drafts.forEach((draft) => {
+                if (this.uploadingActionIds.has(draft.id)) {
+                    draft.status = DraftActionStatus.Uploading;
+                }
+                queue.push(draft);
+            });
+            return queue.sort((a, b) => {
+                const aTime = parseInt(a.id, 10);
+                const bTime = parseInt(b.id, 10);
+                // safety check
+                if (isNaN(aTime)) {
+                    return 1;
                 }
+                if (isNaN(bTime)) {
+                    return -1;
+                }
+                return aTime - bTime;
+            });
+        }
+        async getOwnedQueueActions() {
+            const all = await this.getQueueActions();
+            return all.filter((a) => this.handlers[a.handler] !== undefined);
+        }
+        /** Draft ids `action` creates — the same set the dispatch-time dependency check uses. */
+        getCreatedDraftIds(action) {
+            const ids = new Set();
+            this.collectDraftIds(action, ids);
+            return Array.from(ids);
+        }
+        /** Owned actions whose basePath or body references any of `draftIds`. */
+        async getOwnedActionsReferencing(draftIds) {
+            const ids = new Set(draftIds);
+            const owned = await this.getOwnedQueueActions();
+            return owned.filter((action) => this.actionReferencesAny(action, ids));
+        }
+        async actionCompleted(action) {
+            return this.workerPool.push({
+                workFn: async () => {
+                    const handler = this.getHandler(action.handler);
+                    // Compute the redirects this completion produces BEFORE
+                    // completeAction resolves the POST out of the store, and retain
+                    // the draft ids they resolve. completeAction below removes the
+                    // completing POST from the store, so getInFlightRewritableDraftIds
+                    // would stop reporting its draft id — but the fire-and-forget
+                    // propagation to peers hasn't run yet, so a peer could dispatch a
+                    // queued action still carrying that stale draft id. Retaining the
+                    // ids (released only once the peer rewrites settle, below) keeps
+                    // peers deferring across that gap. Only bother when there are
+                    // peers to propagate to — with none, there is nothing to retain
+                    // for and no handler consultation to pay for.
+                    const peers = this.getPeerQueues().filter(isCrossQueueCoordination);
+                    const redirects = peers.length > 0 && handler.getRedirectMappings !== undefined
+                        ? handler.getRedirectMappings(action)
+                        : undefined;
+                    const retainedDraftIds = this.retainRedirectingDraftIds(redirects);
+                    try {
+                        let queue = await this.getQueueActions();
+                        const queueOperations = handler.getQueueOperationsForCompletingDrafts(queue, action);
+                        // write the queue operations to the store prior to ingesting the result
+                        await this.draftStore.completeAction(queueOperations);
+                        await this.finalizeCompletedAction(action, handler, queueOperations);
+                        if (this.state === DraftQueueState.Started) {
+                            this.processNextAction();
+                        }
+                        // Propagate redirects to peer queues; fire-and-forget. Awaiting
+                        // peer.applyDraftIdRedirects from inside this worker callback
+                        // produces a cross-queue worker-pool deadlock when the peer is
+                        // also propagating back to this queue. Release the retained ids
+                        // only once every peer's rewrite settles.
+                        this.propagateRedirectsToPeers(redirects, () => this.releaseRedirectingDraftIds(retainedDraftIds));
+                    }
+                    catch (e) {
+                        // Any step above can throw before propagateRedirectsToPeers
+                        // schedules the release. Release the retained ids here so they
+                        // don't leak into redirectingDraftIds permanently (which would
+                        // make getInFlightRewritableDraftIds report them forever and
+                        // strand peers deferring on them). Must be a catch, not a
+                        // finally — on the success path release happens only after
+                        // peers apply the rewrites, so releasing here too early would
+                        // reopen the cross-queue stale-id race.
+                        this.releaseRedirectingDraftIds(retainedDraftIds);
+                        throw e;
+                    }
+                },
+            });
+        }
+        /**
+         * Shared in-memory finalization for a completed action, run after its durable
+         * removal: ingest the response and apply side effects (handleActionCompleted),
+         * drop any retry backoff state, release the in-flight claim, and notify
+         * listeners. Used by both the single-action completion path (actionCompleted)
+         * and the atomic batch completion path (completeBatchAtomically), which each
+         * wrap it in their own error handling.
+         */
+        async finalizeCompletedAction(action, handler, queueOperations) {
+            await handler.handleActionCompleted(action, queueOperations, values$2(this.handlers));
+            // A completed action is no longer backing off: drop its timer, interval,
+            // and parked flag.
+            this.clearActionRetry(action.id);
+            this.uploadingActionIds.delete(action.id);
+            await this.notifyChangedListeners({
+                type: DraftQueueEventType.ActionCompleted,
+                action,
+                draftCount: this.draftStore.getCount(),
+            });
+        }
+        async actionFailed(action, retry, retryDelayInMs, actionDataChanged) {
+            if (actionDataChanged === true) {
+                await this.draftStore.writeAction({
+                    ...action,
+                    status: DraftActionStatus.Pending,
+                });
+            }
+            this.uploadingActionIds.delete(action.id);
+            if (retry && this.state !== DraftQueueState.Stopped) {
+                // Park the action so a re-entrant dispatch pass (peer kick / sibling
+                // completion) can't re-select it while it's Pending in the store and
+                // waiting on its backoff timer. Cleared when this action's own timer
+                // fires.
+                this.retryingActionIds.add(action.id);
+                await this.scheduleActionRetry(action.id, retryDelayInMs);
+                return;
+            }
+            // Permanent failure. Awaiting handleServerError (rather than returning
+            // it) guarantees the errored action is persisted before this method
+            // resolves, so any dispatch pass on the next tick observes the error
+            // state instead of racing the write.
+            if (isDraftError(action)) {
+                this.clearActionRetry(action.id);
+                await this.handleServerError(action, action.error);
+                // A permanently-failed POST never resolves the draft ids it would
+                // have created, so peers that deferred actions on those ids would
+                // otherwise stall until an unrelated success on a later tick wakes
+                // them. Wake them explicitly so they can re-evaluate (and surface
+                // their own error, rather than hang).
+                this.getPeerQueues()
+                    .filter(isCrossQueueCoordination)
+                    .forEach((peer) => peer.resumeDeferredActions());
+            }
+        }
+        async handleBatch(actions) {
+            const handler = this.getHandler(actions[0].handler);
+            if (handler === undefined) {
+                return Promise.reject(`No handler for ${actions[0].handler}.`);
+            }
+            if (handler.handleBatchActions === undefined) {
+                return Promise.reject(`Handler ${actions[0].handler} does not support batching.`);
+            }
+            const batchIds = actions.map((a) => a.id);
+            // B2: buffer the members the handler reports completed instead of
+            // removing each from the store as its callback fires. On success they
+            // are removed in ONE atomic durable write (completeBatchAtomically), so
+            // there is no partial-removal window that a crash — or a completion
+            // callback throwing mid-loop — could strand. The stranded-member bug it
+            // prevents: a batch commits all-or-none on the server exactly once, but
+            // members removed one-at-a-time can leave committed members Pending,
+            // which restart (or the handler's broad retry) would re-batch WITHOUT
+            // their per-action idempotency keys (the batch envelope drops them),
+            // replaying a committed PATCH's automation or failing a committed DELETE.
+            const completed = [];
+            const batchActionCompleted = (action) => {
+                completed.push(action);
                 return Promise.resolve();
             };
-            return this.enqueueAction(deleteAction);
-        }
-        deleteByTag(tag) {
-            const deleteAction = () => {
-                const { draftStore } = this;
-                const keys$1 = keys$4(draftStore);
-                const durableKeys = [];
-                for (let i = 0, len = keys$1.length; i < len; i++) {
-                    const key = keys$1[i];
-                    const action = draftStore[key];
-                    if (action.tag === tag) {
-                        delete draftStore[action.id];
-                        delete this.cleanSnapshot[action.id];
-                        durableKeys.push(buildDraftDurableStoreKey(action.tag, action.id));
+            // Mint a unique id for this batch and journal its members BEFORE
+            // dispatch (B2). If the process dies — or the atomic removal below fails
+            // — between the server committing the request and the members being
+            // removed, the next startQueue reconcile finds this journal and surfaces
+            // any still-Pending member as commit-ambiguous (Option A: not auto-replayed,
+            // because the batch envelope carries no server-visible idempotency key).
+            // Journal support is optional; a store without it (never the gate-ON path)
+            // skips this.
+            const batchId = `${actions[0].id}:${(this.batchSequence += 1)}`;
+            try {
+                await this.writeBatchJournalIfSupported(batchId, batchIds);
+            }
+            catch (e) {
+                // Fail CLOSED (4048061181): without a durable journal a mid-flight crash
+                // would revive these members Pending with no record that they were
+                // in-flight, so they would be re-batched — replaying a maybe-committed
+                // write. Do NOT dispatch the batch. Release every member's in-flight
+                // claim and dispatch the head alone via the single-action path, which
+                // sends its idempotency key on the first attempt and so is replay-safe;
+                // the remaining members re-arm and drain one-at-a-time single-action
+                // while journaling is unavailable.
+                batchLog$1(`journal write failed, single-action fallback batchId=${batchId} err=${errName(e)}`);
+                for (const id of batchIds) {
+                    this.uploadingActionIds.delete(id);
+                }
+                this.uploadingActionIds.add(actions[0].id);
+                return this.handle(actions[0]);
+            }
+            // Shared post-dispatch bookkeeping: release every batch member's uploading
+            // claim, then handle the batch journal + still-Pending members per the
+            // outcome, and issue the single trailing processNextAction. Two shapes:
+            //
+            //   - Commit-AMBIGUOUS (result === NETWORK_ERROR, or a promise rejection):
+            //     the batch was dispatched but its outcome could not be confirmed
+            //     (network throw, empty-body 2xx, misaligned response, a retryable
+            //     5xx/408/dropped-connection or generic-400 envelope that may have
+            //     committed with the 2xx lost — see executeBatch / classifyBatchFailure).
+            //     A rejection likewise implies a dispatch attempt whose cleanup then
+            //     threw, so it is treated as ambiguous too (it must NOT be read as
+            //     "nothing was sent"). The all-or-none request MAY have committed, and
+            //     the batch envelope carries no server-visible idempotency key, so a
+            //     re-send (batch OR serial) could replay a committed write. Do NOT
+            //     auto-replay (Option A): surface every still-Pending member as an error
+            //     for manual resolution, then clear the now-resolved journal (its job —
+            //     catching a mid-flight crash before we could record the ambiguity — is
+            //     done once the members carry the durable error).
+            //
+            //   - Definitive non-success (any other non-success result): a terminal or
+            //     rolled-back envelope (server-generated 4xx, 429) or a partial
+            //     all-or-none failure — the server rolled the whole batch back or
+            //     rejected it before commit, so nothing committed and re-batching on
+            //     retry is replay-safe. The journal is stale: clear it. The handler
+            //     routed the offender (terminal, or parked in retryingActionIds) and
+            //     deliberately left innocent rolled-back siblings Pending/unparked (B5);
+            //     we only re-notify still-Pending members to clear the "uploading" UI
+            //     state.
+            const finalize = async (result, rejected) => {
+                for (const id of batchIds) {
+                    this.uploadingActionIds.delete(id);
+                }
+                if (rejected || result === ProcessActionResult.NETWORK_ERROR) {
+                    // Commit-ambiguous: surface members for manual resolution, then
+                    // clear the journal ONLY once the ambiguity is durably recorded on
+                    // every still-Pending member. If a member could not be moved to
+                    // Error, retain the journal so the next startQueue reconcile can
+                    // surface it — clearing now would strand it Pending with no backstop
+                    // and let a restart re-batch it (the replay Option A prevents).
+                    const resolved = await this.errorAmbiguousActions(batchIds);
+                    if (resolved) {
+                        await this.clearBatchJournalIfSupported(batchId);
+                    }
+                    else {
+                        // errorAmbiguousActions could not durably move the members to
+                        // Error (its bulk write failed); it stopped the queue and
+                        // quarantined them in-memory, and the journal is retained for
+                        // the next reconcile. Surface the failure as a bounded signal.
+                        await this.signalBatchRecoveryFailed('quarantine-failed');
                     }
                 }
-                return this.timeDurableOp('evictEntries', DRAFT_SEGMENT, () => this.durableStore.evictEntries(durableKeys, DRAFT_SEGMENT));
+                else if (result !== ProcessActionResult.ACTION_SUCCEEDED) {
+                    // Definitively rolled back: journal is stale, clear it.
+                    await this.clearBatchJournalIfSupported(batchId);
+                    const queue = await this.getQueueActions();
+                    for (const id of batchIds) {
+                        const action = queue.find((a) => a.id === id);
+                        if (action && action.status === DraftActionStatus.Pending) {
+                            await this.notifyChangedListeners({
+                                type: DraftQueueEventType.ActionUpdated,
+                                action,
+                                draftCount: this.draftStore.getCount(),
+                            });
+                        }
+                    }
+                }
+                if (this.state === DraftQueueState.Started) {
+                    this.processNextAction();
+                }
+                return result;
             };
-            return this.enqueueAction(deleteAction);
+            return handler
+                .handleBatchActions(actions, batchActionCompleted, this.actionFailed.bind(this))
+                .then(async (result) => {
+                batchLog$1(`dispatch done result=${result} size=${actions.length}`);
+                if (result === ProcessActionResult.ACTION_SUCCEEDED) {
+                    // Atomically remove every committed member and clear the
+                    // journal. Never rejects — it protects members itself if
+                    // the durable write fails (see below).
+                    await this.completeBatchAtomically(batchId, completed);
+                }
+                return finalize(result, false);
+            }, (e) => {
+                batchLog$1(`dispatch rejected err=${errName(e)} size=${actions.length}`);
+                return finalize(ProcessActionResult.ACTION_ERRORED, true);
+            });
         }
-        completeAction(queueOperations) {
-            const action = () => {
-                const durableStoreOperations = [];
-                const { draftStore } = this;
-                for (let i = 0, len = queueOperations.length; i < len; i++) {
-                    const operation = queueOperations[i];
-                    if (operation.type === QueueOperationType.Delete) {
-                        const action = draftStore[operation.id];
-                        if (action !== undefined) {
-                            delete draftStore[operation.id];
-                            delete this.cleanSnapshot[operation.id];
-                            const key = buildDraftDurableStoreKey(action.tag, action.id);
-                            durableStoreOperations.push({
-                                ids: [key],
-                                type: 'evictEntries',
-                                segment: DRAFT_SEGMENT,
+        /**
+         * Atomically completes every successfully-uploaded member of a batch (B2).
+         *
+         * The server commits an all-or-none batch exactly once; the old path removed
+         * members one-at-a-time, so a crash — or a completion callback throwing
+         * mid-loop — could strand already-committed members Pending, which restart
+         * (or the handler's broad retry) would re-batch WITHOUT their idempotency
+         * keys and replay. This removes ALL members in ONE durable batchOperations
+         * (the base completeAction applies the whole QueueOperation[] in a single
+         * transaction), so there is no partial-removal state, then clears the
+         * pre-dispatch journal. If any step throws after the server committed, this
+         * fails CLOSED (4065665227): it quarantines every still-Pending member as a
+         * commit-ambiguous error and retains the journal unless every member is
+         * durably resolved, so the trailing finalize's claim release cannot let
+         * collectBatch re-batch a keyless, maybe-committed member (Option A — the
+         * batch envelope drops the idempotency key, so a re-send could replay a
+         * committed write). Whatever the journal does not resolve this session is
+         * surfaced by the next startQueue reconcile. The per-member cache ingest and
+         * listener notification run afterward: they are best-effort cache updates, so
+         * a throw there cannot corrupt the already-correct durable state.
+         *
+         * Batched members are UPDATE/DELETE only (collectBatch excludes POSTs), so
+         * none mint server ids — getRedirectMappings returns undefined and each
+         * member's queue ops reduce to a single self-delete, independent of the
+         * others. That is why one queue snapshot yields correct ops for every member
+         * and why the cross-queue redirect machinery on the single-action completion
+         * path is not needed here. Never rejects.
+         */
+        completeBatchAtomically(batchId, completed) {
+            return this.workerPool.push({
+                workFn: async () => {
+                    if (completed.length === 0) {
+                        await this.clearBatchJournalIfSupported(batchId);
+                        return;
+                    }
+                    const memberIds = completed.map((a) => a.id);
+                    let perMember;
+                    try {
+                        // The setup (snapshot, handler lookup, op construction) is
+                        // inside the try too (4065666785): it runs in the success
+                        // callback, so a throw here would otherwise reject this task,
+                        // bypass finalize, and strand every member marked Uploading for
+                        // the session. Every exit below either removes the members or
+                        // quarantines them, so this method still never rejects.
+                        const queue = await this.getQueueActions();
+                        perMember = [];
+                        const allOps = [];
+                        for (const action of completed) {
+                            const handler = this.getHandler(action.handler);
+                            const ops = handler.getQueueOperationsForCompletingDrafts(queue, action);
+                            perMember.push({ action, ops, handler });
+                            for (let i = 0, len = ops.length; i < len; i++) {
+                                allOps.push(ops[i]);
+                            }
+                        }
+                        // ONE transaction removes every committed member — no
+                        // partial-removal window (B2).
+                        await this.draftStore.completeAction(allOps);
+                        await this.clearBatchJournalIfSupported(batchId);
+                    }
+                    catch (e) {
+                        // The server committed the all-or-none request but the local
+                        // completion could not be applied (snapshot read, op
+                        // construction, or the durable write failed). Do NOT assume the
+                        // members were evicted from memory: completeAction is part of the
+                        // public DraftStore contract and an implementation may reject
+                        // without removing its Pending rows (4065665227). If we simply
+                        // returned, the trailing finalize would release the uploading
+                        // claims and re-arm dispatch, letting collectBatch re-batch a
+                        // keyless, maybe-committed member and replay it. Fail CLOSED:
+                        // quarantine every still-Pending member as commit-ambiguous
+                        // BEFORE finalize releases the claims. treatMissingAsResolved is
+                        // false because the base store evicts a member from memory before
+                        // its durable row settles, so an absent member's durable state is
+                        // unknown here — leave the journal so the next startQueue reconcile
+                        // (which reads freshly-synced durable state) is the authority
+                        // (4065666287). Only clear the journal once every member is durably
+                        // resolved.
+                        batchLog$1(`atomic completion failed batchId=${batchId} err=${errName(e)}`);
+                        let resolved = false;
+                        try {
+                            resolved = await this.errorAmbiguousActions(memberIds, {
+                                treatMissingAsResolved: false,
                             });
                         }
+                        catch (qe) {
+                            batchLog$1(`atomic completion quarantine failed batchId=${batchId} err=${errName(qe)}`);
+                        }
+                        if (resolved) {
+                            await this.clearBatchJournalIfSupported(batchId);
+                        }
+                        else {
+                            // Not resolved: errorAmbiguousActions either failed its
+                            // durable write (it already stopped the queue + quarantined)
+                            // or threw before quarantining (e.g. its snapshot read
+                            // failed). Handle both uniformly — force the queue
+                            // non-dispatchable and quarantine every member in-memory so
+                            // the trailing finalize's unconditional claim release cannot
+                            // let collectBatch re-batch a keyless, maybe-committed member
+                            // and replay it (Option A). The journal is deliberately NOT
+                            // cleared; the next process-restart reconcile is the backstop.
+                            this.state = DraftQueueState.Error;
+                            for (const id of memberIds) {
+                                this.commitAmbiguousUnresolvedIds.add(id);
+                            }
+                            // The server committed but the members could not be durably
+                            // quarantined this session — surface a bounded o11y signal.
+                            await this.signalBatchRecoveryFailed('quarantine-failed');
+                        }
+                        return;
                     }
-                    else {
-                        const { action } = operation;
-                        const key = buildDraftDurableStoreKey(action.tag, action.id);
-                        draftStore[action.id] = action;
-                        this.cleanSnapshot[action.id] = clone$1(action);
-                        durableStoreOperations.push({
-                            type: 'setEntries',
-                            segment: DRAFT_SEGMENT,
-                            entries: {
-                                [key]: {
-                                    data: operation.action,
-                                },
-                            },
+                    // Durable state is now correct. Per-member in-memory
+                    // finalization (cache ingest, retry-state clear, listener
+                    // notify) is best-effort; isolate each so one failure can't skip
+                    // the others or reject this task (which would surface as an
+                    // unhandled dispatch rejection).
+                    let finalizeFailed = false;
+                    for (const { action, ops, handler } of perMember) {
+                        try {
+                            await this.finalizeCompletedAction(action, handler, ops);
+                        }
+                        catch (e) {
+                            // Still release the in-flight claim so the id isn't stuck
+                            // marked uploading.
+                            this.uploadingActionIds.delete(action.id);
+                            finalizeFailed = true;
+                            batchLog$1(`post-completion finalize failed id=${action.id} err=${errName(e)}`);
+                        }
+                    }
+                    if (finalizeFailed) {
+                        // The write committed and was durably removed exactly once — no
+                        // replay/duplication risk — but some member's local cache/notify
+                        // work was lost with no retry path. Emit one bounded structured
+                        // signal per batch (o11y counter) so this is monitorable beyond
+                        // the per-member device log (4077120522).
+                        await this.signalBatchRecoveryFailed('finalize-failed');
+                    }
+                },
+            });
+        }
+        /**
+         * Surfaces the given still-Pending actions as commit-ambiguous errors (Option
+         * A). A batch that MAY have committed cannot be safely re-sent because the batch
+         * envelope drops the per-action idempotency keys, so instead of auto-replaying
+         * (batch OR serial — both would present keys the server never saw on the
+         * original batch) we move each member to Error for manual resolution. Used by
+         * finalize on a commit-ambiguous dispatch outcome and by startQueue reconcile
+         * for members a prior batch journaled but never completed (in-flight at a
+         * crash). Reads the raw store status (not the uploading overlay); a member
+         * already Error is left as-is (counts as resolved).
+         *
+         * All still-Pending members are moved to Error in ONE completeAction
+         * transaction rather than one writeAction (and one getQueueActions snapshot)
+         * per member (4065667688): a 25-member batch is a single durable
+         * batchOperations, not 25 writes plus 25 snapshots. The in-memory effects
+         * handleServerError applies per member (drop the uploading claim + retry
+         * state, set queue Error state, notify listeners) are mirrored here once for
+         * the whole set.
+         *
+         * A fresh draft snapshot (id → action) is read per call — never shared across
+         * the reconcile loop — because each call awaits completeAction and listener
+         * callbacks that can delete a member, and a stale shared snapshot would let a
+         * later call resurrect a just-deleted member as an Error draft (4077120311).
+         * `options.treatMissingAsResolved` controls how an id absent from the snapshot
+         * is scored: true (default) when the snapshot authoritatively reflects durable
+         * state (restart reconcile runs against a freshly-synced store, so absent means
+         * genuinely gone); false in the live post-commit failure path, where the base
+         * store evicts a member from memory BEFORE its durable row settles (4065666287),
+         * so an absent member's durable state is unknown and must be treated as
+         * unresolved to keep the journal. An id already in commitAmbiguousUnresolvedIds
+         * is likewise treated as unresolved regardless of its (possibly stale) in-memory
+         * status: its durable Error write failed earlier this session, so its durable
+         * row is still Pending and the journal must be retained for the next
+         * fresh-process reconcile (4077120459). Returns true only when every targeted id
+         * is resolved.
+         */
+        async errorAmbiguousActions(ids, options) {
+            if (ids.length === 0) {
+                return true;
+            }
+            const treatMissingAsResolved = options?.treatMissingAsResolved ?? true;
+            // Read a fresh snapshot and index it by id so each targeted id is an O(1)
+            // lookup instead of a full scan. Deliberately NOT shared across the
+            // reconcile loop: a snapshot held across this call's awaited completeAction
+            // and listener callbacks could go stale and let a later call resurrect a
+            // just-deleted member as an Error draft (4077120311).
+            const draftsById = new Map((await this.draftStore.getAllDrafts()).map((d) => [d.id, d]));
+            const ops = [];
+            const erroredActions = [];
+            const seen = new Set();
+            // An id whose durable Error write already failed this session (still in the
+            // quarantine set) is NOT resolved even if its in-memory status now reads
+            // Error: that in-memory Error is the write-through cache mutation that was
+            // never rolled back after its durable batchOperations rejected, so the
+            // durable row is still Pending. Retain the journal (return false) so the
+            // next fresh-process reconcile — running against a re-synced store — is the
+            // authority, rather than clearing the journal on unpersisted state and
+            // re-batching the still-Pending row keyless after a later restart
+            // (4077120459).
+            let quarantinedUnresolved = false;
+            for (const id of ids) {
+                if (seen.has(id)) {
+                    continue;
+                }
+                if (this.commitAmbiguousUnresolvedIds.has(id)) {
+                    quarantinedUnresolved = true;
+                    continue;
+                }
+                const action = draftsById.get(id);
+                if (action === undefined) {
+                    continue;
+                }
+                seen.add(id);
+                if (action.status !== DraftActionStatus.Pending) {
+                    continue;
+                }
+                const errored = {
+                    ...action,
+                    status: DraftActionStatus.Error,
+                    error: PerformanceDraftQueue.COMMIT_AMBIGUOUS_ERROR,
+                    metadata: action.metadata || {},
+                };
+                ops.push({ type: QueueOperationType.Update, id: action.id, action: errored });
+                erroredActions.push(errored);
+            }
+            if (ops.length > 0) {
+                try {
+                    // One durable transaction moves every still-Pending member to Error.
+                    await this.draftStore.completeAction(ops);
+                }
+                catch (e) {
+                    // Nothing was durably moved: the members are still Pending and MAY
+                    // have committed. Fail CLOSED — stop the queue and quarantine them
+                    // in-memory so no later dispatch (a re-arm, retryAllErrors, or a
+                    // reconnect-driven startQueue) re-batches them keyless and replays a
+                    // committed write (Option A). Report unresolved so the caller retains
+                    // the journal for the next reconcile.
+                    batchLog$1(`commit-ambiguous bulk error failed count=${ops.length} err=${errName(e)}`);
+                    this.state = DraftQueueState.Error;
+                    for (const errored of erroredActions) {
+                        this.commitAmbiguousUnresolvedIds.add(errored.id);
+                    }
+                    return false;
+                }
+                // Durable Error state is written; mirror handleServerError's in-memory
+                // effects once for the whole set rather than per member. Batched members
+                // are UPDATE/DELETE (never POST — collectBatch excludes POSTs), so no
+                // peer deferred on a draft id these would have created; the peer-wake
+                // that actionFailed does for permanently-failed POSTs is not needed.
+                this.state = DraftQueueState.Error;
+                for (const errored of erroredActions) {
+                    this.uploadingActionIds.delete(errored.id);
+                    // Durably Error now (already excluded from dispatch by status), so
+                    // drop any prior in-memory quarantine — otherwise a later
+                    // retryAllErrors that re-pends this action would find it wrongly
+                    // blocked from ever dispatching again.
+                    this.commitAmbiguousUnresolvedIds.delete(errored.id);
+                    this.clearActionRetry(errored.id);
+                    try {
+                        await this.notifyChangedListeners({
+                            type: DraftQueueEventType.ActionFailed,
+                            action: errored,
+                            draftCount: this.draftStore.getCount(),
                         });
                     }
+                    catch (e) {
+                        batchLog$1(`commit-ambiguous notify failed id=${errored.id} err=${errName(e)}`);
+                    }
                 }
-                return this.timeDurableOp('batchOperations', DRAFT_SEGMENT, () => this.durableStore.batchOperations(durableStoreOperations));
-            };
-            return this.enqueueAction(action);
-        }
-        getCount() {
-            return keys$4(this.draftStore).length;
+            }
+            if (quarantinedUnresolved) {
+                return false;
+            }
+            if (treatMissingAsResolved) {
+                return true;
+            }
+            for (let i = 0, len = ids.length; i < len; i++) {
+                if (!seen.has(ids[i])) {
+                    return false;
+                }
+            }
+            return true;
         }
         /**
-         * Runs a write operation against the draft store, if the initial
-         * revive is still in progress, the action gets enqueued to run once the
-         * initial revive is complete
-         * @param action
-         * @returns a promise that is resolved once the action has run
+         * Feature-detecting wrapper: journals a batch's members if the store supports
+         * it. A store without journal support (never the gate-ON path) resolves as a
+         * no-op. When supported, the write REJECTION propagates so handleBatch can fail
+         * CLOSED (4048061181) — the journal is the only record that these members were
+         * in-flight, so a failed write must abort the batch dispatch rather than send
+         * unrecorded.
          */
-        enqueueAction(action) {
-            const { syncPromise, writeQueue: pendingMerges } = this;
-            // if the initial sync is done and existing operations have been run, no need to queue, just run
-            if (syncPromise === undefined && pendingMerges.length === 0) {
-                return action();
+        writeBatchJournalIfSupported(batchId, memberIds) {
+            const store = this.draftStore;
+            if (typeof store.writeBatchJournal !== 'function') {
+                return Promise.resolve();
             }
-            const deferred = new Promise((resolve, reject) => {
-                this.writeQueue.push(() => {
-                    return action()
-                        .then((x) => {
-                        resolve(x);
-                    })
-                        .catch((err) => reject(err));
+            return store.writeBatchJournal(batchId, memberIds);
+        }
+        /**
+         * Surfaces a batch-journal crash-recovery failure (B2) to listeners as a
+         * bounded structured signal, so instrumentDraftQueue can map it to o11y —
+         * these paths are otherwise visible only in device logs. Carries ONLY the
+         * reason code and the queue depth (never ids or messages — device-log PII
+         * policy). Best-effort and never rejects: a listener throw must not break the
+         * recovery path, so it is swallowed to the batch log.
+         */
+        async signalBatchRecoveryFailed(reason) {
+            try {
+                await this.notifyChangedListeners({
+                    type: DraftQueueEventType.BatchRecoveryFailed,
+                    reason,
+                    draftCount: this.draftStore.getCount(),
                 });
+            }
+            catch (e) {
+                batchLog$1(`batch recovery signal failed reason=${reason} err=${errName(e)}`);
+            }
+        }
+        /**
+         * Feature-detecting wrapper: clears a batch journal entry if the store
+         * supports it. A resolved batch's journal is stale, but a swallowed clear
+         * failure would leave a recovery row behind on EVERY dispatch, so restart
+         * reconcile grows unbounded (4065667688). Retry the clear a bounded number of
+         * times, and if it still fails escalate the log line (leftover=true) so a
+         * persistently-failing clear is greppable rather than silent. Never rejects:
+         * callers (finalize, completeBatchAtomically) treat the clear as best-effort
+         * cleanup of an already-resolved journal — a leftover row is caught by the
+         * next reconcile, it does not risk a replay.
+         */
+        async clearBatchJournalIfSupported(batchId) {
+            const store = this.draftStore;
+            if (typeof store.clearBatchJournal !== 'function') {
+                return;
+            }
+            for (let attempt = 1; attempt <= CLEAR_JOURNAL_MAX_ATTEMPTS; attempt++) {
+                try {
+                    await store.clearBatchJournal(batchId);
+                    return;
+                }
+                catch (e) {
+                    const leftover = attempt === CLEAR_JOURNAL_MAX_ATTEMPTS;
+                    batchLog$1(`journal clear failed batchId=${batchId} attempt=${attempt} leftover=${leftover} err=${errName(e)}`);
+                }
+            }
+            // Every attempt failed (the loop returns on success): the resolved journal
+            // row leaks, so the next reconcile keeps re-reading it (unbounded growth).
+            // Surface a bounded o11y signal — the device log alone is not enough.
+            // Still never rejects: signalBatchRecoveryFailed swallows its own errors.
+            await this.signalBatchRecoveryFailed('clear-exhausted');
+        }
+        /**
+         * A queued action is eligible to be selected or batched only when it is
+         * Pending in the store and this queue is neither already uploading it nor
+         * holding it in retry backoff. A retrying action stays Pending in the
+         * store, so without the retryingActionIds guard collectBatch would pull a
+         * parked action into a batch before its backoff timer fires (C5).
+         */
+        isDispatchable(action) {
+            return (action.status === DraftActionStatus.Pending &&
+                !this.uploadingActionIds.has(action.id) &&
+                !this.retryingActionIds.has(action.id) &&
+                // A member left Pending because its commit-ambiguous quarantine could
+                // not be durably written must never be re-batched keyless (Option A).
+                !this.commitAmbiguousUnresolvedIds.has(action.id));
+        }
+        /**
+         * Walks the queue from `headIndex` and returns the longest contiguous prefix
+         * of actions that are eligible to batch together. Eligibility:
+         *   - same handler id as the head action
+         *   - dispatchable (Pending, not in-flight, not parked in retry backoff)
+         *   - not a POST/CREATE (POSTs are never batched — see BatchCutReason.PostBoundary)
+         *   - tag does not collide with any tag already in the batch
+         *     (UI-API Batch rejects two operations on the same record per request)
+         *   - body/basePath does not reference an unresolved draft id from a peer
+         *     queue's (or this queue's) pending POST (would dispatch with a draft id)
+         *   - targetId is not already being written by an in-flight request
+         *     (per-record serialization; the head is pre-checked by the caller,
+         *     but later members must be checked here too — see BatchCutReason.TargetInFlight)
+         *   - batch size capped at MAX_BATCH_SIZE
+         */
+        collectBatch(queue, headIndex, peerPendingPostDraftIds, inFlightTargetIds) {
+            if (queue.length === 0 || headIndex >= queue.length) {
+                return [];
+            }
+            const head = queue[headIndex];
+            const handler = this.handlers[head.handler];
+            // CREATEs are never batched (C1): a POST head falls back to single-action
+            // dispatch, which preserves its per-action idempotency key.
+            const headData = head.data;
+            if (headData !== undefined && headData.method === 'post') {
+                batchLog$1('head is POST — not batchable, fall back to single-action');
+                return [head];
+            }
+            // The head carries semantics the batch envelope cannot represent (B1):
+            // fall back to single-action dispatch so those semantics (e.g. a
+            // conditional-update header) are preserved.
+            if (handler !== undefined &&
+                typeof handler.isActionBatchable === 'function' &&
+                !handler.isActionBatchable(head)) {
+                batchLog$1('head not batchable — fall back to single-action');
+                return [head];
+            }
+            const batch = [head];
+            const seenTags = new Set();
+            seenTags.add(head.tag);
+            let reason = "END_OF_QUEUE" /* BatchCutReason.EndOfQueue */;
+            let detail = '';
+            for (let i = headIndex + 1; i < queue.length; i++) {
+                if (batch.length >= MAX_BATCH_SIZE$1) {
+                    reason = "MAX_BATCH_SIZE" /* BatchCutReason.MaxBatchSize */;
+                    break;
+                }
+                const candidate = queue[i];
+                if (candidate.handler !== head.handler) {
+                    reason = "HANDLER_CHANGE" /* BatchCutReason.HandlerChange */;
+                    detail = `nextHandler=${candidate.handler}`;
+                    break;
+                }
+                if (!this.isDispatchable(candidate)) {
+                    reason = "NOT_PENDING" /* BatchCutReason.NotPending */;
+                    detail = `nextStatus=${candidate.status}`;
+                    break;
+                }
+                // Stop at any POST: CREATEs are excluded from batching (C1). Only
+                // naturally-idempotent UPDATE/DELETE actions batch, so there are no
+                // in-batch POST draft ids to track — the blocking set below is the
+                // caller's peer/owned pending-POST set alone.
+                const candData = candidate.data;
+                if (candData !== undefined && candData.method === 'post') {
+                    reason = "POST_BOUNDARY" /* BatchCutReason.PostBoundary */;
+                    break;
+                }
+                // Candidate carries semantics the batch envelope cannot represent
+                // (B1): end the batch here so it is dispatched via single-action
+                // handleAction on a later pass rather than folded in and stripped.
+                if (handler !== undefined &&
+                    typeof handler.isActionBatchable === 'function' &&
+                    !handler.isActionBatchable(candidate)) {
+                    reason = "NOT_BATCHABLE" /* BatchCutReason.NotBatchable */;
+                    break;
+                }
+                // Per-record serialization (see BatchCutReason.TargetInFlight): the
+                // caller pre-checks the head; later members must be checked here too.
+                if (candidate.targetId && inFlightTargetIds.has(candidate.targetId)) {
+                    reason = "TARGET_IN_FLIGHT" /* BatchCutReason.TargetInFlight */;
+                    // Log the cut position, NOT the targetId: a targetId is a record id
+                    // and even a 24-char suffix preserves the full 18-char id, which the
+                    // device-log PII policy (metrics.ts) forbids (4065667273). The
+                    // BatchCutReason already says why; the offset says where.
+                    detail = `atOffset=${i - headIndex}`;
+                    break;
+                }
+                if (seenTags.has(candidate.tag)) {
+                    reason = "TAG_COLLISION" /* BatchCutReason.TagCollision */;
+                    // Log the cut position, NOT the tag: the tag embeds the record id
+                    // (same PII concern as targetId above).
+                    detail = `atOffset=${i - headIndex}`;
+                    break;
+                }
+                // Block a candidate that references a draft id still unresolved on a
+                // peer queue's (or this queue's) in-flight POST, minus the
+                // candidate's own draft ids (an action mustn't self-block on its own
+                // targetId).
+                const candidateOwnIds = new Set();
+                this.collectDraftIds(candidate, candidateOwnIds);
+                const blockingIds = new Set(peerPendingPostDraftIds);
+                for (const id of candidateOwnIds) {
+                    blockingIds.delete(id);
+                }
+                if (this.actionReferencesAny(candidate, blockingIds)) {
+                    reason = "REF_BLOCKED" /* BatchCutReason.RefBlocked */;
+                    break;
+                }
+                batch.push(candidate);
+                seenTags.add(candidate.tag);
+            }
+            const queuedAfterBatch = queue.length - headIndex - batch.length;
+            batchLog$1(`collected size=${batch.length} reason=${reason}` +
+                ` queueRemaining=${queuedAfterBatch}` +
+                (detail.length > 0 ? ` ${detail}` : ''));
+            return batch;
+        }
+        /**
+         * Returns all draft ids "created" by this action (i.e., ids that don't yet
+         * exist on the server). Defaults to `[targetId]`; handlers may override
+         * `getDraftIdsFromAction` to return additional ids (e.g., the CD composite
+         * handler returns CD + CV + CDL).
+         */
+        collectDraftIds(action, into) {
+            const handler = this.handlers[action.handler];
+            if (handler !== undefined && typeof handler.getDraftIdsFromAction === 'function') {
+                for (const id of handler.getDraftIdsFromAction(action)) {
+                    if (id !== undefined && id !== null && id !== '') {
+                        into.add(id);
+                    }
+                }
+                return;
+            }
+            if (action.targetId) {
+                into.add(action.targetId);
+            }
+        }
+        /**
+         * Returns true if any of the given draft ids appears in the action's
+         * basePath or stringified body. Mirrors the substring scan used by
+         * `getQueueOperationsForCompletingDrafts` so blocking and rewriting agree.
+         *
+         * TODO [W-23515682]: this re-scans basePath/body on every dispatch pass.
+         * The referenced-id set could instead be computed once and cached on the
+         * DraftAction, recomputed only when rewriteQueueActionsForRedirects mutates
+         * basePath/body (the only place they change), so the hot path is a set
+         * lookup rather than a stringify+substring scan.
+         */
+        actionReferencesAny(action, draftIds) {
+            if (draftIds.size === 0) {
+                return false;
+            }
+            const data = action.data;
+            if (data === undefined) {
+                return false;
+            }
+            const body = typeof data.body === 'string' ? data.body : JSON.stringify(data.body || '');
+            const haystack = `${data.basePath || ''}${body}`;
+            return [...draftIds].some((id) => haystack.includes(id));
+        }
+        async getInFlightRewritableDraftIds() {
+            const allDrafts = await this.draftStore.getAllDrafts();
+            // Seed with draft ids retained across the completeAction →
+            // propagateRedirectsToPeers gap so a peer keeps deferring even though the
+            // completing POST has already left the store but its redirects have not
+            // yet reached peers.
+            const ids = new Set(this.redirectingDraftIds);
+            for (const action of allDrafts) {
+                if (this.handlers[action.handler] !== undefined &&
+                    (action.status === DraftActionStatus.Pending ||
+                        action.status === DraftActionStatus.Uploading) &&
+                    action.data &&
+                    action.data.method === 'post') {
+                    this.collectDraftIds(action, ids);
+                }
+            }
+            return Array.from(ids);
+        }
+        resumeDeferredActions() {
+            if (this.state === DraftQueueState.Started) {
+                this.processNextAction();
+            }
+        }
+        // Applies a set of draft → canonical id rewrites to every action queued
+        // on this queue. Called by a peer queue after one of its POSTs completes
+        // and produced redirects. Walks this queue, rewrites any action whose
+        // basePath/body/tag references a draft id, persists via the shared
+        // store, and kicks processNextAction so newly-resolvable actions dispatch.
+        async applyDraftIdRedirects(redirects) {
+            if (!redirects || redirects.length === 0) {
+                return;
+            }
+            return this.workerPool.push({
+                workFn: async () => {
+                    const queue = await this.getQueueActions();
+                    const queueOperations = rewriteQueueActionsForRedirects(queue, redirects);
+                    if (queueOperations.length > 0) {
+                        await this.draftStore.completeAction(queueOperations);
+                    }
+                    if (this.state === DraftQueueState.Started) {
+                        this.processNextAction();
+                    }
+                },
             });
-            return deferred;
         }
         /**
-         * Revives the draft store from the durable store. Once the draft store is
-         * revived, executes any queued up draft store operations that came in while
-         * reviving
+         * Retains the draft ids resolved by `redirects` in `redirectingDraftIds` so
+         * getInFlightRewritableDraftIds keeps reporting them across the
+         * completeAction → propagateRedirectsToPeers fire-and-forget gap. Returns
+         * only the ids this call newly added (so a concurrent completion touching
+         * the same id doesn't release it early). Called before completeAction on the
+         * single-action completion path (actionCompleted).
          */
-        resyncDraftStore() {
-            const sync = () => {
-                this.syncPromise = this.durableStore
-                    .getAllEntries(DRAFT_SEGMENT)
-                    .then((durableEntries) => {
-                    if (durableEntries === undefined) {
-                        this.draftStore = {};
-                        this.cleanSnapshot = {};
-                        return this.runQueuedOperations();
+        retainRedirectingDraftIds(redirects) {
+            const retainedDraftIds = [];
+            if (redirects !== undefined) {
+                for (const redirect of redirects) {
+                    if (redirect.draftId && !this.redirectingDraftIds.has(redirect.draftId)) {
+                        this.redirectingDraftIds.add(redirect.draftId);
+                        retainedDraftIds.push(redirect.draftId);
                     }
-                    const { draftStore } = this;
-                    const keys$1 = keys$4(durableEntries);
-                    for (let i = 0, len = keys$1.length; i < len; i++) {
-                        const entry = durableEntries[keys$1[i]];
-                        const action = entry.data;
-                        draftStore[action.id] = action;
-                        this.cleanSnapshot[action.id] = clone$1(action);
+                }
+            }
+            return retainedDraftIds;
+        }
+        /** Releases the ids retained by a prior retainRedirectingDraftIds call. */
+        releaseRedirectingDraftIds(retainedDraftIds) {
+            for (const id of retainedDraftIds) {
+                this.redirectingDraftIds.delete(id);
+            }
+        }
+        /**
+         * After an action on this queue completes, propagates the draft → canonical
+         * id rewrites it produced to the peer queues so their queued actions that
+         * reference the resolved id are rewritten before dispatch. When there are no
+         * redirects (or none apply), falls back to a bare wake of each peer so their
+         * previously-deferred actions re-evaluate.
+         *
+         * `redirects` is precomputed by the caller (before completeAction resolves
+         * the POST out of the store) so the redirecting draft ids can be retained
+         * across the fire-and-forget gap. `onSettled` runs once every peer's rewrite
+         * has settled, so the caller can release those retained ids.
+         */
+        propagateRedirectsToPeers(redirects, onSettled) {
+            // Peers are typed DraftQueue[]; only those that also implement
+            // CrossQueueCoordination can participate. Narrow once up front so the
+            // calls below need no per-method guards.
+            const peers = this.getPeerQueues().filter(isCrossQueueCoordination);
+            if (peers.length === 0) {
+                onSettled();
+                return;
+            }
+            if (redirects !== undefined && redirects.length > 0) {
+                const settlements = peers.map((peer) => {
+                    // Fire-and-forget: peer.applyDraftIdRedirects schedules its own
+                    // work on the peer's worker pool. Don't await — that deadlocks
+                    // when the peer is propagating redirects back to this queue.
+                    const promise = peer.applyDraftIdRedirects(redirects);
+                    if (promise && typeof promise.catch === 'function') {
+                        return promise.catch((e) => {
+                            if (this.logger) {
+                                this.logger.logError(`PerformanceDraftQueue: cross-queue redirect propagation to peer failed: ${errName(e)}`);
+                            }
+                        });
                     }
-                    return this.runQueuedOperations();
-                })
-                    .finally(() => {
-                    this.syncPromise = undefined;
+                    return Promise.resolve();
                 });
-                return this.syncPromise;
-            };
-            // if there's an ongoing sync populating the in memory store, wait for it to complete before re-syncing
-            const { syncPromise } = this;
-            if (syncPromise === undefined) {
-                return sync();
+                // Release the retained draft ids only once every peer has applied
+                // (or failed to apply) the rewrites, so getInFlightRewritableDraftIds
+                // keeps reporting them until peers no longer reference the stale id.
+                Promise.all(settlements).then(onSettled, onSettled);
             }
-            return syncPromise.then(() => {
-                return sync();
+            else {
+                peers.forEach((peer) => peer.resumeDeferredActions());
+                onSettled();
+            }
+        }
+        async processNextAction() {
+            // Serialize dispatch passes. A pass awaits peer state before
+            // claiming a slot, so overlapping passes could double-dispatch. If a
+            // pass is already running, record the wakeup and let it re-run.
+            if (this.isDispatching) {
+                this.redispatchRequested = true;
+                return ProcessActionResult.ACTION_ALREADY_PROCESSING;
+            }
+            this.isDispatching = true;
+            try {
+                let result = ProcessActionResult.NO_ACTION_TO_PROCESS;
+                do {
+                    this.redispatchRequested = false;
+                    result = await this.dispatchFreeSlots();
+                } while (this.redispatchRequested);
+                return result;
+            }
+            finally {
+                this.isDispatching = false;
+            }
+        }
+        async dispatchFreeSlots() {
+            if (this.uploadingActionIds.size >= this.concurrency) {
+                return ProcessActionResult.ACTION_ALREADY_PROCESSING;
+            }
+            // Gather the set of pending POST draft ids whose creators are still in
+            // flight on any peer queue. A candidate action that references one of
+            // those ids would otherwise dispatch with an unresolved draft id
+            // (ContentDocument 069... etc.) instead of waiting for the upstream
+            // POST to rewrite it to canonical. These peer reads each await, so they
+            // run BEFORE the owned-queue snapshot below — otherwise an await would
+            // sit between snapshotting the queue and claiming from it, letting the
+            // store change underneath the selection (the candidate we picked could
+            // already be gone or completed by the time we claim it).
+            const blockingDraftIds = new Set();
+            const peers = this.getPeerQueues().filter(isCrossQueueCoordination);
+            for (const peer of peers) {
+                try {
+                    const ids = await peer.getInFlightRewritableDraftIds();
+                    for (const id of ids) {
+                        blockingDraftIds.add(id);
+                    }
+                }
+                catch (e) {
+                    // Peers are already narrowed to CrossQueueCoordination, so this
+                    // is a genuine failure to read a peer's in-flight ids, not a
+                    // missing capability. Log it: on failure we fall through with an
+                    // incomplete blocking set, which can let a dependent action
+                    // dispatch against an unresolved draft id.
+                    if (this.logger) {
+                        this.logger.logError(`PerformanceDraftQueue: failed to read peer in-flight rewritable draft ids: ${errName(e)}`);
+                    }
+                }
+            }
+            // Snapshot the owned queue AFTER the peer reads. From here to the claims
+            // below there is no await, so the snapshot and the slot claims see a
+            // consistent view of the store.
+            const queue = await this.getQueueActions();
+            // The shared DurableDraftStore returns actions for every queue, so we
+            // restrict candidate selection to actions whose handler is registered
+            // on this queue. This keeps a queue from claiming or being
+            // error-blocked by its peer's actions.
+            const ownedQueue = queue.filter((a) => this.handlers[a.handler] !== undefined);
+            // Head-of-queue error block: only applies when strictOrdering is enabled.
+            // With strictOrdering=false the candidate loop will skip errored items.
+            if (this.strictOrdering) {
+                const head = ownedQueue[0];
+                if (head !== undefined && head.status === DraftActionStatus.Error) {
+                    this.state = DraftQueueState.Error;
+                    await this.notifyChangedListeners({
+                        type: DraftQueueEventType.ActionFailed,
+                        action: head,
+                        draftCount: this.draftStore.getCount(),
+                    });
+                    return ProcessActionResult.BLOCKED_ON_ERROR;
+                }
+            }
+            // Single pass over ownedQueue derives everything the selection loop
+            // needs: candidates (actions neither already claimed in-flight nor
+            // parked in retry backoff), the targetIds of in-flight actions
+            // (per-record serialization), and every owned pending/uploading POST's
+            // draft ids (this queue's contribution to the blocking set).
+            const candidates = [];
+            const inFlightTargetIds = new Set();
+            for (const a of ownedQueue) {
+                if (this.uploadingActionIds.has(a.id)) {
+                    if (a.targetId) {
+                        inFlightTargetIds.add(a.targetId);
+                    }
+                }
+                else if (!this.retryingActionIds.has(a.id) &&
+                    // Same guard as isDispatchable: a commit-ambiguous member whose
+                    // quarantine could not be durably written stays out of
+                    // single-action dispatch too, not just batching.
+                    !this.commitAmbiguousUnresolvedIds.has(a.id)) {
+                    candidates.push(a);
+                }
+                if ((a.status === DraftActionStatus.Pending ||
+                    a.status === DraftActionStatus.Uploading) &&
+                    a.data &&
+                    a.data.method === 'post') {
+                    this.collectDraftIds(a, blockingDraftIds);
+                }
+            }
+            // Fill every free concurrency slot from this single snapshot rather than
+            // claiming one and bouncing back through processNextAction — that would
+            // re-run getQueueActions (and its deep clone) per slot. Claims are
+            // synchronous (no await inside the loop), so inFlightTargetIds stays
+            // authoritative for per-record serialization of later picks in the same
+            // pass. Blocked candidates are skipped (strictOrdering=false) or halt
+            // the scan (strictOrdering=true head-of-line semantics).
+            const toDispatch = [];
+            let blockedCount = 0;
+            for (const candidate of candidates) {
+                if (this.uploadingActionIds.size >= this.concurrency) {
+                    break;
+                }
+                if (candidate.status === DraftActionStatus.Error) {
+                    continue;
+                }
+                // Per-record serialization: skip if another action on the same record is in-flight.
+                if (candidate.targetId && inFlightTargetIds.has(candidate.targetId)) {
+                    blockedCount++;
+                    if (this.strictOrdering) {
+                        break;
+                    }
+                    continue;
+                }
+                // Exclude the candidate's own draft IDs so a POST doesn't self-block
+                // on its own targetId.
+                const ownIds = new Set();
+                this.collectDraftIds(candidate, ownIds);
+                const effectiveBlockingIds = new Set(blockingDraftIds);
+                for (const id of ownIds) {
+                    effectiveBlockingIds.delete(id);
+                }
+                if (this.actionReferencesAny(candidate, effectiveBlockingIds)) {
+                    blockedCount++;
+                    if (this.strictOrdering) {
+                        break;
+                    }
+                    continue;
+                }
+                // Batching path: only when enabled, on the first action dispatched
+                // this pass, and only if its handler implements handleBatchActions
+                // and the eligible batch is larger than 1. collectBatch enforces the
+                // same ref-blocking rule applied above so a candidate referencing a
+                // peer's pending POST id won't be batched alongside the head. When a
+                // batch dispatches it consumes the pass (returns), matching the
+                // pre-fill-all behavior. It is also passed inFlightTargetIds so a
+                // batch member can't write a record that another in-flight request
+                // is already writing (the head candidate is pre-checked above).
+                if (this.queueBatching && toDispatch.length === 0) {
+                    const handler = this.getHandler(candidate.handler);
+                    if (handler.handleBatchActions !== undefined) {
+                        const actionIndex = ownedQueue.indexOf(candidate);
+                        const batch = this.collectBatch(ownedQueue, actionIndex, blockingDraftIds, inFlightTargetIds);
+                        if (batch.length > 1) {
+                            batchLog$1(`dispatching batch size=${batch.length}`);
+                            if (this.state === DraftQueueState.Waiting) {
+                                this.state = DraftQueueState.Started;
+                            }
+                            // Claim every batch member so a re-entrant
+                            // processNextAction (e.g. a peer kick during the await
+                            // below) doesn't re-claim any of them.
+                            for (const batched of batch) {
+                                this.uploadingActionIds.add(batched.id);
+                            }
+                            for (const batched of batch) {
+                                await this.notifyChangedListeners({
+                                    type: DraftQueueEventType.ActionUploading,
+                                    action: { ...batched, status: DraftActionStatus.Uploading },
+                                    draftCount: this.draftStore.getCount(),
+                                });
+                            }
+                            return this.handleBatch(batch);
+                        }
+                    }
+                }
+                // Eligible — claim the slot now (synchronously) so the next
+                // iteration serializes against it.
+                this.uploadingActionIds.add(candidate.id);
+                if (candidate.targetId) {
+                    inFlightTargetIds.add(candidate.targetId);
+                }
+                toDispatch.push(candidate);
+            }
+            if (toDispatch.length === 0) {
+                if (blockedCount > 0 && this.logger) {
+                    this.logger.logInfo(`[DraftQueue c=${this.concurrency}] processNextAction: ${blockedCount} action(s) deferred waiting on upstream draft ids`);
+                }
+                if (this.uploadingActionIds.size === 0) {
+                    if (this.state === DraftQueueState.Waiting) {
+                        this.state = DraftQueueState.Started;
+                    }
+                    return ProcessActionResult.NO_ACTION_TO_PROCESS;
+                }
+                return ProcessActionResult.ACTION_ALREADY_PROCESSING;
+            }
+            if (this.state === DraftQueueState.Waiting) {
+                this.state = DraftQueueState.Started;
+            }
+            for (const action of toDispatch) {
+                await this.notifyChangedListeners({
+                    type: DraftQueueEventType.ActionUploading,
+                    action: { ...action, status: DraftActionStatus.Uploading },
+                    draftCount: this.draftStore.getCount(),
+                });
+                this.handle(action);
+            }
+            return ProcessActionResult.ACTION_ALREADY_PROCESSING;
+        }
+        // Overrides DurableDraftQueue.removeDraftAction rather than reusing it: the
+        // uploading guard reads the concurrent `uploadingActionIds` set (the base
+        // reads its private single `uploadingActionId`, which this path never sets,
+        // so delegating would defeat the guard), and it additionally clears the
+        // per-action retry timer — a concept that exists only on this subclass. The
+        // rest of the body is kept identical to the base; keep them in sync.
+        async removeDraftAction(actionId) {
+            const queue = await this.getQueueActions();
+            //Get the store key for the removed action
+            const actions = queue.filter((action) => action.id === actionId);
+            if (actions.length === 0) {
+                // eslint-disable-next-line @salesforce/lds/no-error-in-production
+                throw new Error(`No removable action with id ${actionId}`);
+            }
+            const action = actions[0];
+            if (this.uploadingActionIds.has(action.id)) {
+                // eslint-disable-next-line @salesforce/lds/no-error-in-production
+                throw new Error(`Cannot remove an uploading draft action with ID ${actionId}`);
+            }
+            // A removed action must not leave a dangling backoff timer that would
+            // later fire and re-drive the scheduler for an id that no longer exists.
+            this.clearActionRetry(action.id);
+            const handler = this.getHandler(action.handler);
+            const shouldDeleteRelated = handler.shouldDeleteActionByTagOnRemoval(action);
+            if (shouldDeleteRelated) {
+                await this.draftStore.deleteByTag(action.tag);
+            }
+            else {
+                await this.draftStore.deleteDraft(action.id);
+            }
+            await handler.handleActionRemoved(action, queue.filter((x) => x.id !== actionId));
+            await this.notifyChangedListeners({
+                type: DraftQueueEventType.ActionDeleted,
+                action,
+                draftCount: this.draftStore.getCount(),
             });
+            if (this.userState === DraftQueueState.Started &&
+                this.state !== DraftQueueState.Started &&
+                this.replacingAction === undefined) {
+                await this.startQueue();
+            }
         }
         /**
-         * Runs the operations that were queued up while reviving the
-         * draft store from the durable store
+         * Concurrent-aware, per-action retry scheduler. The serial base parks the
+         * whole queue under one shared timer + one shared exponential interval,
+         * which conflate concurrent retries. This instead gives the failed action
+         * its own timer and its own growing backoff, keyed by id, so it retries on
+         * its own schedule without disturbing siblings still uploading in other
+         * slots.
+         *
+         * Only broadcasts `Waiting` when the queue is genuinely idle (nothing in
+         * flight): a concurrent queue with other slots live is still `Started`, and
+         * on the serial path the failed action was already removed from
+         * `uploadingActionIds` above (size 0), so the Waiting broadcast the regular
+         * queue emits today is preserved.
          */
-        runQueuedOperations() {
-            const { writeQueue } = this;
-            if (writeQueue.length > 0) {
-                const queueItem = writeQueue.shift();
-                if (queueItem !== undefined) {
-                    return queueItem().then(() => {
-                        return this.runQueuedOperations();
-                    });
+        async scheduleActionRetry(actionId, retryDelayInMs) {
+            const delay = retryDelayInMs !== undefined ? retryDelayInMs : this.nextBackoffInterval(actionId);
+            // Only move to Waiting when the queue is genuinely idle (nothing in
+            // flight). A concurrent queue with other slots still uploading must stay
+            // Started — otherwise sibling completions (which gate their
+            // processNextAction on state === Started) would stop advancing the queue
+            // and free slots would sit idle until this action's retry timer fired.
+            // Only dispatchFreeSlots flips Waiting back to Started, and nothing
+            // reaches it while state is Waiting. On the serial path the failed action
+            // was already removed above (size 0), so the Waiting transition the
+            // regular queue emits today is preserved.
+            if (this.uploadingActionIds.size === 0) {
+                this.state = DraftQueueState.Waiting;
+                await this.notifyChangedListeners({
+                    type: DraftQueueEventType.QueueStateChanged,
+                    state: DraftQueueState.Waiting,
+                    draftCount: this.draftStore.getCount(),
+                });
+            }
+            // Replace any existing timer for this action so a fresh failure resets
+            // its own backoff window without leaking the prior timer.
+            const existing = this.retryTimers.get(actionId);
+            if (existing !== undefined) {
+                clearTimeout(existing);
+            }
+            this.retryTimers.set(actionId, setTimeout(() => {
+                // Only this action becomes eligible again; siblings keep their
+                // own backoff windows.
+                this.retryTimers.delete(actionId);
+                this.retryingActionIds.delete(actionId);
+                if (this.state !== DraftQueueState.Stopped) {
+                    this.processNextAction();
                 }
+            }, delay));
+        }
+        /**
+         * Per-action exponential backoff, mirroring the base's doubling within the
+         * same [minimum, maximum] bounds but tracked per id so each retrying action
+         * grows its own interval independently.
+         */
+        nextBackoffInterval(actionId) {
+            const current = this.retryIntervals.get(actionId) ?? 0;
+            const next = Math.min(Math.max(current * 2, this.minimumRetryInterval), this.maximumRetryInterval);
+            this.retryIntervals.set(actionId, next);
+            return next;
+        }
+        /**
+         * Drops all retry bookkeeping for an action: cancels its pending timer,
+         * un-parks it, and forgets its backoff interval. Called on completion,
+         * permanent failure, and removal.
+         */
+        clearActionRetry(actionId) {
+            const timer = this.retryTimers.get(actionId);
+            if (timer !== undefined) {
+                clearTimeout(timer);
+                this.retryTimers.delete(actionId);
+            }
+            this.retryIntervals.delete(actionId);
+            this.retryingActionIds.delete(actionId);
+        }
+        /**
+         * Cancels every per-action retry timer. The base clears only its single
+         * `timeoutHandler`; a concurrent queue may have many parked actions, so on
+         * any full stop we must clear them all to avoid a dangling timer firing
+         * against a stopped queue.
+         */
+        clearAllRetryTimers() {
+            for (const timer of this.retryTimers.values()) {
+                clearTimeout(timer);
+            }
+            this.retryTimers.clear();
+            this.retryIntervals.clear();
+            this.retryingActionIds.clear();
+        }
+        stopQueueManually(internalReason) {
+            this.clearAllRetryTimers();
+            super.stopQueueManually(internalReason);
+        }
+        /**
+         * Clears every per-action retry timer on (re)start for the same reason the
+         * base clears its single `timeoutHandler`: a dangling backoff timer must not
+         * fire against a freshly-started queue. Guarded by the same conditions under
+         * which the base actually restarts (not already Started, not mid-replace) so
+         * a `startQueue()` that is a no-op — or a replace-driven restart — doesn't
+         * wipe legitimately-parked backoff windows out from under in-flight retries.
+         */
+        async startQueue() {
+            // Record the caller's intent up front, exactly as the base startQueue does
+            // synchronously. The reconcile below awaits, so a stopQueue() can interleave
+            // with it; capturing intent here lets that later stop flip userState and win
+            // (see the revalidation after the await, R4-6).
+            this.userState = DraftQueueState.Started;
+            if (this.state !== DraftQueueState.Started && this.replacingAction === undefined) {
+                this.clearAllRetryTimers();
+                // Concurrent counterpart: the base scalar is never set here, so check the Set.
+                // Stale ids in uploadingActionIds at restart strand the dispatcher's uploading guard.
+                if (this.uploadingActionIds.size > 0 && this.logger) {
+                    this.logger.logWarning(`Draft queue restarting with ${this.uploadingActionIds.size} action(s) still marked uploading (stale uploadingActionIds=${[
+                    ...this.uploadingActionIds,
+                ].join(',')}); possible abandoned-upload stuck queue`);
+                }
+            }
+            // Recover from any batch journaled but never confirmed removed (B2)
+            // before the base starts dispatching, so a committed-but-unremoved
+            // member is surfaced as a commit-ambiguous error before collectBatch can
+            // re-batch it (Option A). Guarded to run at most once per process; a no-op
+            // when batching is disabled or the store keeps no journal.
+            await this.reconcileBatchJournalsOnce();
+            // The reconcile awaited above yields the event loop. If a stopQueue() ran
+            // while it was pending, that stop already completed and set
+            // userState=Stopped; honor it rather than clobbering the queue back to
+            // Started via super.startQueue() and dispatching after the caller stopped
+            // it (R4-6).
+            if (this.userState !== DraftQueueState.Started) {
+                return;
+            }
+            return super.startQueue();
+        }
+        async retryAllErrors() {
+            const actions = await this.getOwnedQueueActions();
+            const errored = actions.filter((a) => a.status === DraftActionStatus.Error);
+            if (errored.length === 0) {
+                return;
+            }
+            // Stop the queue before rewriting errored actions to Pending. With
+            // strictOrdering=false the queue keeps running while errored items are
+            // skipped, so a live pass could observe the store mid-rewrite. Stop,
+            // rewrite, then restart safely.
+            this.stopQueueManually(true);
+            for (const action of errored) {
+                // Drop the `error` field that's only present on ErrorDraftAction so
+                // the resulting object structurally matches PendingDraftAction and
+                // satisfies the discriminated-union narrower.
+                const { error: _droppedError, ...rest } = action;
+                const pendingAction = {
+                    ...rest,
+                    status: DraftActionStatus.Pending,
+                };
+                await this.draftStore.writeAction(pendingAction);
+                await this.notifyChangedListeners({
+                    type: DraftQueueEventType.ActionUpdated,
+                    action: pendingAction,
+                    draftCount: this.draftStore.getCount(),
+                });
+            }
+            await this.startQueueSafe();
+        }
+    }
+    /**
+     * Error surfaced on a batch member whose commit status could not be confirmed:
+     * the batch response was lost (network throw, empty/misaligned 2xx, a retryable
+     * gateway envelope) or the process died mid-flight. Because the batch envelope
+     * carries no server-visible idempotency key, such a write cannot be safely
+     * re-sent without risking a duplicate, so the member is surfaced as an error for
+     * manual resolution rather than auto-replayed (Option A). Shaped like a
+     * FetchResponse so downstream consumers that read action.error.status/.body
+     * behave consistently with a server error.
+     */
+    PerformanceDraftQueue.COMMIT_AMBIGUOUS_ERROR = {
+        status: 0,
+        statusText: 'Batch commit ambiguous',
+        ok: false,
+        headers: {},
+        body: {
+            errorCode: 'BATCH_COMMIT_AMBIGUOUS',
+            message: 'The batched change may or may not have been saved (the server response ' +
+                'was not received). It was not retried automatically to avoid saving it ' +
+                'twice; please verify the record and retry or discard the draft.',
+        },
+    };
+
+    class RoutingDraftQueue {
+        /**
+         * @param primaryLane the serial/fallback lane: it owns unregistered handlers and backs
+         * every store read. Passed explicitly so routing never depends on array ordering.
+         * @param secondaryLanes the remaining routed lanes (e.g. the concurrent binary lane).
+         */
+        constructor(primaryLane, secondaryLanes = []) {
+            this.primaryLane = primaryLane;
+            this.lanes = [primaryLane, ...secondaryLanes];
+        }
+        get primary() {
+            return this.primaryLane.queue;
+        }
+        /** Resolve the lane that owns `handlerId`, falling back to the primary lane. */
+        laneForHandler(handlerId) {
+            return (this.lanes.find(({ queue }) => queue.isHandlerRegistered(handlerId)) ?? this.primaryLane);
+        }
+        /** Resolve the sub-queue that owns `handlerId`, falling back to the primary queue. */
+        routeByHandler(handlerId) {
+            return this.laneForHandler(handlerId).queue;
+        }
+        /**
+         * Resolve the sub-queue that owns the action identified by `actionId` by
+         * reading its stamped handler from the shared store (visible via the primary
+         * queue), then routing by handler ownership. Falls back to the primary queue
+         * when the action can't be found.
+         */
+        async routeByActionId(actionId) {
+            const actions = await this.primary.getQueueActions();
+            const action = actions.find((candidate) => candidate.id === actionId);
+            return action !== undefined ? this.routeByHandler(action.handler) : this.primary;
+        }
+        enqueue(handlerId, data, observabilityContext) {
+            return this.routeByHandler(handlerId).enqueue(handlerId, data, observabilityContext);
+        }
+        async getQueueActions() {
+            const actions = await this.primary.getQueueActions();
+            return actions.map((action) => ({
+                ...action,
+                lane: this.laneForHandler(action.handler).lane,
+            }));
+        }
+        addHandler(handler) {
+            return this.primary.addHandler(handler);
+        }
+        addCustomHandler(id, executor) {
+            return this.primary.addCustomHandler(id, executor);
+        }
+        removeHandler(id) {
+            return this.primary.removeHandler(id);
+        }
+        async removeDraftAction(actionId) {
+            const owner = await this.routeByActionId(actionId);
+            return owner.removeDraftAction(actionId);
+        }
+        updateDraftAction(action) {
+            return this.routeByHandler(action.handler).updateDraftAction(action);
+        }
+        async retryAction(actionId) {
+            const owner = await this.routeByActionId(actionId);
+            return owner.retryAction(actionId);
+        }
+        async setMetadata(actionId, metadata) {
+            const owner = await this.routeByActionId(actionId);
+            return owner.setMetadata(actionId, metadata);
+        }
+        async replaceAction(targetActionId, sourceActionId) {
+            const owner = await this.routeByActionId(targetActionId);
+            return owner.replaceAction(targetActionId, sourceActionId);
+        }
+        async mergeActions(targetActionId, sourceActionId) {
+            const owner = await this.routeByActionId(targetActionId);
+            return owner.mergeActions(targetActionId, sourceActionId);
+        }
+        registerOnChangedListener(listener) {
+            const unsubscribes = this.lanes.map(({ queue }) => queue.registerOnChangedListener(listener));
+            return () => Promise.all(unsubscribes.map((unsubscribe) => unsubscribe())).then(() => undefined);
+        }
+        async processNextAction() {
+            const [primaryResult] = await Promise.all(this.lanes.map(({ queue }) => queue.processNextAction()));
+            return primaryResult;
+        }
+        /**
+         * Conservative aggregate of the sub-queue states, most-attention-needed first:
+         * Error (blocked, needs intervention) > Stopped (explicitly halted) > Waiting
+         * (transient network backoff) > Started. Not bridged — DraftManager reports
+         * per-queue state separately; this exists only to satisfy the interface.
+         */
+        getQueueState() {
+            const states = this.lanes.map(({ queue }) => queue.getQueueState());
+            if (states.includes(DraftQueueState.Error)) {
+                return DraftQueueState.Error;
+            }
+            if (states.includes(DraftQueueState.Stopped)) {
+                return DraftQueueState.Stopped;
+            }
+            if (states.includes(DraftQueueState.Waiting)) {
+                return DraftQueueState.Waiting;
+            }
+            return DraftQueueState.Started;
+        }
+        async startQueue() {
+            await Promise.all(this.lanes.map(({ queue }) => queue.startQueue()));
+        }
+        async stopQueue() {
+            await Promise.all(this.lanes.map(({ queue }) => queue.stopQueue()));
+        }
+        /**
+         * Stops every sub-queue, runs `action` once, then restarts every sub-queue.
+         * Not bridged; the per-queue variant preserves userState via an internal stop,
+         * which isn't reachable from here, so this uses the public stop/start pair.
+         */
+        async stopQueueWhileRunning(action) {
+            await Promise.all(this.lanes.map(({ queue }) => queue.stopQueue()));
+            try {
+                await action();
+            }
+            finally {
+                await Promise.all(this.lanes.map(({ queue }) => queue.startQueue()));
             }
-            return Promise.resolve();
         }
     }
 
@@ -49202,6 +50808,16 @@
         shouldEmitEvent(event) {
             return this.draftEventsShouldBeEmitted.includes(event.type);
         }
+        /**
+         * Routes a sub-queue change event into the listener pipeline. Exposed to subclasses so they
+         * can register it on an additional queue without duplicating the emit-gating logic.
+         */
+        handleQueueChange(event) {
+            if (this.shouldEmitEvent(event)) {
+                return this.callListeners(event);
+            }
+            return Promise.resolve();
+        }
         constructor(draftQueue) {
             this.listeners = [];
             this.draftEventsShouldBeEmitted = [
@@ -49214,12 +50830,7 @@
                 DraftQueueEventType.QueueStateChanged,
             ];
             this.draftQueue = draftQueue;
-            draftQueue.registerOnChangedListener((event) => {
-                if (this.shouldEmitEvent(event)) {
-                    return this.callListeners(event);
-                }
-                return Promise.resolve();
-            });
+            draftQueue.registerOnChangedListener((event) => this.handleQueueChange(event));
         }
         draftQueueEventTypeToOperationType(type) {
             switch (type) {
@@ -49419,6 +51030,11 @@
             if (isDraftQueueStateChangeEvent(event)) {
                 operationType = DraftQueueOperationType.QueueStateChanged;
             }
+            else if (event.type === DraftQueueEventType.BatchRecoveryFailed) {
+                // Telemetry-only signal (batch-recovery failure): it carries no
+                // draft item, so DraftManager has nothing to surface to its listeners.
+                return;
+            }
             else {
                 const { action, type } = event;
                 item = this.buildDraftQueueItem(action);
@@ -49497,6 +51113,560 @@
         return (dataAsAny !== undefined && dataAsAny.method !== undefined && dataAsAny.body !== undefined);
     }
 
+    function hasGetOwnedQueueActions(queue) {
+        return typeof queue.getOwnedQueueActions === 'function';
+    }
+    function hasGetCreatedDraftIds(queue) {
+        return typeof queue.getCreatedDraftIds === 'function';
+    }
+    function hasGetOwnedActionsReferencing(queue) {
+        return typeof queue.getOwnedActionsReferencing === 'function';
+    }
+    function hasRetryAllErrors(queue) {
+        return typeof queue.retryAllErrors === 'function';
+    }
+    /**
+     * Gate-ON DraftManager: the concurrent-binary upload variant, instantiated only when the
+     * `concurrentBinaryQueue` feature flag is on. It wraps a strict-ordering serial draft queue
+     * plus a parallel binary queue over one shared store, stamps each draft's routing `lane`, and
+     * drives the binary-queue lifecycle/read methods the native Pending Images UI consumes.
+     *
+     * The base `DraftManager` (gate-OFF) keeps every one of these methods as an inert stub so the
+     * native bridge surface is identical regardless of the flag; this subclass supplies the real
+     * behavior. Current (non-SCE) users never instantiate this class — they run the unchanged base.
+     */
+    class RoutingDraftManager extends DraftManager {
+        constructor(draftQueue, binaryQueue, laneLabels) {
+            super(draftQueue);
+            this.logger = typeof __nimbus !== 'undefined' &&
+                __nimbus.plugins !== undefined &&
+                __nimbus.plugins.JSLoggerPlugin !== undefined
+                ? __nimbus.plugins.JSLoggerPlugin
+                : undefined;
+            this.binaryQueue = binaryQueue;
+            this.laneLabels = laneLabels;
+            // Surface binary-queue change events through the same listener pipeline as the serial
+            // queue (super already registered the serial queue; reuse the inherited handler here).
+            this.binaryQueue.registerOnChangedListener((event) => this.handleQueueChange(event));
+        }
+        getQueue() {
+            return Promise.all([this.draftQueue.getQueueActions(), this.binaryActionsById()])
+                .then(([queueActions, binaryById]) => queueActions.map((action) => {
+                const binaryAction = binaryById.get(action.id);
+                return this.buildDraftQueueItem(this.stampLane(binaryAction ?? action, binaryAction !== undefined));
+            }))
+                .then(toQueueState(this.draftQueue));
+        }
+        /**
+         * Get the current state of each of the DraftActions in the binary DraftQueue
+         * (ContentDocument/Version/Link uploads).
+         */
+        getBinaryQueue() {
+            const queue = this.binaryQueue;
+            const getActions = hasGetOwnedQueueActions(queue)
+                ? queue.getOwnedQueueActions()
+                : queue.getQueueActions();
+            return getActions
+                .then((queueActions) => {
+                return queueActions.map(this.buildDraftQueueItem);
+            })
+                .then(toQueueState(queue));
+        }
+        /**
+         * Starts both the serial and binary draft queues and begins processing their items.
+         */
+        startQueue() {
+            return Promise.all([this.draftQueue.startQueue(), this.binaryQueue.startQueue()]).then(() => undefined);
+        }
+        /**
+         * Stops both the serial and binary draft queues from processing more draft items after
+         * any in-progress items are finished.
+         */
+        stopQueue() {
+            return Promise.all([this.draftQueue.stopQueue(), this.binaryQueue.stopQueue()]).then(() => undefined);
+        }
+        /**
+         * Starts the binary draft queue (for ContentDocument/Version/Link uploads). Separate from
+         * startQueue() so the binary queue can be paused/resumed independently from the regular
+         * draft queue and from stopQueueWhileRunning() interruptions.
+         */
+        startBinaryQueue() {
+            return this.binaryQueue.startQueue();
+        }
+        /** Stops the binary draft queue; pairs with startBinaryQueue(). */
+        stopBinaryQueue() {
+            return this.binaryQueue.stopQueue();
+        }
+        async retryAllErrors() {
+            if (hasRetryAllErrors(this.draftQueue)) {
+                await this.draftQueue.retryAllErrors();
+            }
+            if (hasRetryAllErrors(this.binaryQueue)) {
+                await this.binaryQueue.retryAllErrors();
+            }
+        }
+        /**
+         * Routes the remove to the queue that owns the action. The serial queue reads the shared
+         * store, so it sees binary-owned actions too, but has no handler registered for them and
+         * would throw.
+         */
+        removeDraftAction(actionId) {
+            return this.binaryActionsById()
+                .then((binaryById) => {
+                const binaryAction = binaryById.get(actionId);
+                return binaryAction !== undefined
+                    ? this.removeBinaryActionAndDependents(binaryAction)
+                    : this.draftQueue.removeDraftAction(actionId);
+            })
+                .then(() => this.getQueue());
+        }
+        /**
+         * Removes a binary action plus the serial actions that reference a draft id it creates
+         * (e.g. the ContentDocumentLink native enqueues to link an uploaded image to a record).
+         * Nothing resolves those ids once the binary action is gone, so a dependent left behind
+         * would dispatch with an unresolved draft id, fail, and block the serial queue.
+         *
+         * Rejects up front when a dependent is uploading: an errored binary action no longer holds
+         * its dependents back, so one can be mid-dispatch. Otherwise the binary action goes first
+         * so a rejected remove (e.g. it is uploading) leaves its dependents untouched.
+         */
+        async removeBinaryActionAndDependents(action) {
+            const dependents = await this.serialActionsDependingOn(action);
+            const uploading = dependents.find((d) => d.status === DraftActionStatus.Uploading);
+            if (uploading !== undefined) {
+                // eslint-disable-next-line @salesforce/lds/no-error-in-production
+                throw new Error(`Cannot remove draft action ${action.id} while its dependent draft action ${uploading.id} is uploading`);
+            }
+            await this.binaryQueue.removeDraftAction(action.id);
+            for (const dependent of dependents) {
+                const current = (await this.draftQueue.getQueueActions()).find((a) => a.id === dependent.id);
+                // Removing an earlier dependent may already have deleted this one by shared tag.
+                if (current === undefined) {
+                    continue;
+                }
+                // It started uploading after the check above. The binary action is already gone,
+                // so keep going rather than report a failed remove; this one will error and can be
+                // removed on its own.
+                if (current.status === DraftActionStatus.Uploading) {
+                    if (this.logger) {
+                        this.logger.logWarning(`RoutingDraftManager: dependent draft action ${dependent.id} of removed draft action ${action.id} started uploading and was not removed`);
+                    }
+                    continue;
+                }
+                await this.draftQueue.removeDraftAction(dependent.id);
+            }
+        }
+        serialActionsDependingOn(action) {
+            const binary = this.binaryQueue;
+            const serial = this.draftQueue;
+            if (!hasGetCreatedDraftIds(binary) || !hasGetOwnedActionsReferencing(serial)) {
+                return Promise.resolve([]);
+            }
+            const draftIds = binary.getCreatedDraftIds(action);
+            return draftIds.length === 0
+                ? Promise.resolve([])
+                : serial.getOwnedActionsReferencing(draftIds);
+        }
+        /**
+         * Binary-lane actions keyed by id, carrying the lane's transient `Uploading` status.
+         * `getQueue` uses it to stamp the `concurrentBinary` lane and source the correct status.
+         * An empty map means "treat every action as serial" — returned both when the binary queue
+         * can't report ownership and (harmlessly) when it is simply empty; the caller doesn't need
+         * to tell those apart.
+         */
+        binaryActionsById() {
+            const binary = this.binaryQueue;
+            if (!hasGetOwnedQueueActions(binary)) {
+                return Promise.resolve(new Map());
+            }
+            return binary
+                .getOwnedQueueActions()
+                .then((actions) => new Map(actions.map((action) => [action.id, action])));
+        }
+        /** Stamp `action`'s routing `lane` from lane membership. */
+        stampLane(action, isBinaryOwned) {
+            const lane = isBinaryOwned ? this.laneLabels.concurrentBinary : this.laneLabels.serial;
+            return { ...action, lane };
+        }
+        /**
+         * Extends the base projection with the routing `lane` stamped onto the action. Only the
+         * gate-ON path carries a lane; the base DraftManager never emits the field, so the gate-OFF
+         * projection stays identical to before the concurrent-binary queue existed.
+         */
+        buildDraftQueueItem(action) {
+            const item = super.buildDraftQueueItem(action);
+            if (action.lane !== undefined) {
+                item.lane = action.lane;
+            }
+            return item;
+        }
+    }
+
+    function clone$1(obj) {
+        return parse$6(stringify$6(obj));
+    }
+
+    const DRAFT_ACTION_KEY_JUNCTION = '__DraftAction__';
+    function buildDraftDurableStoreKey(recordKey, draftActionId) {
+        return `${recordKey}${DRAFT_ACTION_KEY_JUNCTION}${draftActionId}`;
+    }
+    /**
+     * Implements a write-through InMemoryStore for Drafts, storing all drafts in a
+     * in-memory store with a write through to the DurableStore.
+     *
+     * Before any reads or writes come in from the draft queue, we need to revive the draft
+     * queue into memory. During this initial revive, any writes are queued up and operated on the
+     * queue once it's in memory. Similarly any reads are delayed until the queue is in memory.
+     *
+     */
+    class DurableDraftStore {
+        constructor(durableStore, instrumentation, useSnapshot = true) {
+            this.draftStore = {};
+            // Snapshot: holds deep clones of each draft, refreshed at write time.
+            // getAllDrafts serves from this snapshot with zero deep clones per read.
+            this.cleanSnapshot = {};
+            // queue of writes that were made during the initial sync
+            this.writeQueue = [];
+            this.durableStore = durableStore;
+            this.instrumentation = instrumentation;
+            this.useSnapshot = useSnapshot;
+            this.resyncDraftStore();
+        }
+        // When no instrumentation is injected the promise is returned as-is (zero overhead).
+        timeDurableOp(op, segment, run) {
+            const onDurableOperation = this.instrumentation?.onDurableOperation;
+            if (onDurableOperation === undefined) {
+                return run();
+            }
+            const start = Date.now();
+            return run().finally(() => {
+                onDurableOperation(op, segment, Date.now() - start);
+            });
+        }
+        writeAction(action) {
+            const addAction = () => {
+                const { id, tag } = action;
+                this.draftStore[id] = action;
+                this.cleanSnapshot[id] = clone$1(action);
+                const durableEntryKey = buildDraftDurableStoreKey(tag, id);
+                const entry = {
+                    data: action,
+                };
+                const entries = { [durableEntryKey]: entry };
+                return this.timeDurableOp('setEntries', DRAFT_SEGMENT, () => this.durableStore.setEntries(entries, DRAFT_SEGMENT));
+            };
+            return this.enqueueAction(addAction);
+        }
+        getAllDrafts() {
+            const waitForOngoingSync = this.syncPromise || Promise.resolve();
+            return waitForOngoingSync.then(() => {
+                const actionArray = [];
+                if (this.useSnapshot) {
+                    const { cleanSnapshot } = this;
+                    const keys$1 = keys$4(cleanSnapshot);
+                    for (let i = 0, len = keys$1.length; i < len; i++) {
+                        const key = keys$1[i];
+                        // Return shallow spread of snapshot entries so top-level caller mutations
+                        // (e.g., .status =) don't persist into the snapshot. The snapshot itself
+                        // is a deep clone of draftStore, so no nested mutation reaches draftStore.
+                        actionArray.push({ ...cleanSnapshot[key] });
+                    }
+                }
+                else {
+                    // Killswitch (W-23515682): original pre-fix behavior — deep-clone every draft on
+                    // every read so the internal draft store is never exposed. O(N) clones per read.
+                    const { draftStore } = this;
+                    const keys$1 = keys$4(draftStore);
+                    for (let i = 0, len = keys$1.length; i < len; i++) {
+                        actionArray.push(clone$1(draftStore[keys$1[i]]));
+                    }
+                }
+                return actionArray;
+            });
+        }
+        deleteDraft(id) {
+            const deleteAction = () => {
+                const draft = this.draftStore[id];
+                if (draft !== undefined) {
+                    delete this.draftStore[id];
+                    delete this.cleanSnapshot[id];
+                    const durableKey = buildDraftDurableStoreKey(draft.tag, draft.id);
+                    return this.timeDurableOp('evictEntries', DRAFT_SEGMENT, () => this.durableStore.evictEntries([durableKey], DRAFT_SEGMENT));
+                }
+                return Promise.resolve();
+            };
+            return this.enqueueAction(deleteAction);
+        }
+        deleteByTag(tag) {
+            const deleteAction = () => {
+                const { draftStore } = this;
+                const keys$1 = keys$4(draftStore);
+                const durableKeys = [];
+                for (let i = 0, len = keys$1.length; i < len; i++) {
+                    const key = keys$1[i];
+                    const action = draftStore[key];
+                    if (action.tag === tag) {
+                        delete draftStore[action.id];
+                        delete this.cleanSnapshot[action.id];
+                        durableKeys.push(buildDraftDurableStoreKey(action.tag, action.id));
+                    }
+                }
+                return this.timeDurableOp('evictEntries', DRAFT_SEGMENT, () => this.durableStore.evictEntries(durableKeys, DRAFT_SEGMENT));
+            };
+            return this.enqueueAction(deleteAction);
+        }
+        completeAction(queueOperations) {
+            const action = () => {
+                const durableStoreOperations = [];
+                const { draftStore } = this;
+                for (let i = 0, len = queueOperations.length; i < len; i++) {
+                    const operation = queueOperations[i];
+                    if (operation.type === QueueOperationType.Delete) {
+                        const action = draftStore[operation.id];
+                        if (action !== undefined) {
+                            delete draftStore[operation.id];
+                            delete this.cleanSnapshot[operation.id];
+                            const key = buildDraftDurableStoreKey(action.tag, action.id);
+                            durableStoreOperations.push({
+                                ids: [key],
+                                type: 'evictEntries',
+                                segment: DRAFT_SEGMENT,
+                            });
+                        }
+                    }
+                    else {
+                        const { action } = operation;
+                        const key = buildDraftDurableStoreKey(action.tag, action.id);
+                        draftStore[action.id] = action;
+                        this.cleanSnapshot[action.id] = clone$1(action);
+                        durableStoreOperations.push({
+                            type: 'setEntries',
+                            segment: DRAFT_SEGMENT,
+                            entries: {
+                                [key]: {
+                                    data: operation.action,
+                                },
+                            },
+                        });
+                    }
+                }
+                return this.timeDurableOp('batchOperations', DRAFT_SEGMENT, () => this.durableStore.batchOperations(durableStoreOperations));
+            };
+            return this.enqueueAction(action);
+        }
+        getCount() {
+            return keys$4(this.draftStore).length;
+        }
+        /**
+         * Runs a write operation against the draft store, if the initial
+         * revive is still in progress, the action gets enqueued to run once the
+         * initial revive is complete
+         * @param action
+         * @returns a promise that is resolved once the action has run
+         */
+        enqueueAction(action) {
+            const { syncPromise, writeQueue: pendingMerges } = this;
+            // if the initial sync is done and existing operations have been run, no need to queue, just run
+            if (syncPromise === undefined && pendingMerges.length === 0) {
+                return action();
+            }
+            const deferred = new Promise((resolve, reject) => {
+                this.writeQueue.push(() => {
+                    return action()
+                        .then((x) => {
+                        resolve(x);
+                    })
+                        .catch((err) => reject(err));
+                });
+            });
+            return deferred;
+        }
+        /**
+         * Revives the draft store from the durable store. Once the draft store is
+         * revived, executes any queued up draft store operations that came in while
+         * reviving
+         */
+        resyncDraftStore() {
+            const sync = () => {
+                this.syncPromise = this.durableStore
+                    .getAllEntries(DRAFT_SEGMENT)
+                    .then((durableEntries) => {
+                    if (durableEntries === undefined) {
+                        this.draftStore = {};
+                        this.cleanSnapshot = {};
+                        return this.runQueuedOperations();
+                    }
+                    const { draftStore } = this;
+                    const keys$1 = keys$4(durableEntries);
+                    for (let i = 0, len = keys$1.length; i < len; i++) {
+                        const entry = durableEntries[keys$1[i]];
+                        const action = entry.data;
+                        draftStore[action.id] = action;
+                        this.cleanSnapshot[action.id] = clone$1(action);
+                    }
+                    return this.runQueuedOperations();
+                })
+                    .finally(() => {
+                    this.syncPromise = undefined;
+                });
+                return this.syncPromise;
+            };
+            // if there's an ongoing sync populating the in memory store, wait for it to complete before re-syncing
+            const { syncPromise } = this;
+            if (syncPromise === undefined) {
+                return sync();
+            }
+            return syncPromise.then(() => {
+                return sync();
+            });
+        }
+        /**
+         * Runs the operations that were queued up while reviving the
+         * draft store from the durable store
+         */
+        runQueuedOperations() {
+            const { writeQueue } = this;
+            if (writeQueue.length > 0) {
+                const queueItem = writeQueue.shift();
+                if (queueItem !== undefined) {
+                    return queueItem().then(() => {
+                        return this.runQueuedOperations();
+                    });
+                }
+            }
+            return Promise.resolve();
+        }
+    }
+
+    /**
+     * Durable-store segment holding batch-completion journal entries (B2). Kept
+     * separate from DRAFT_SEGMENT so journal rows are never mistaken for draft
+     * actions by DurableDraftStore's resync (which parses every DRAFT_SEGMENT entry
+     * as a DraftAction).
+     */
+    const DRAFT_BATCH_JOURNAL_SEGMENT = 'DRAFT_BATCH_JOURNAL';
+    /**
+     * The Performance Upload draft store. Extends {@link DurableDraftStore} — whose
+     * body is byte-identical to today's shipped store — and serializes concurrent
+     * writes through a `writeChain` so that when two queues share a single store
+     * their snapshot-then-mutate sequences cannot interleave (which would otherwise
+     * let one queue's queue-operation rewrites clobber another's). Only constructed
+     * on the gate-ON code path; gate-off customers use a plain DurableDraftStore.
+     */
+    class PerformanceDraftStore extends DurableDraftStore {
+        constructor(durableStore) {
+            super(durableStore);
+            // Serializes writes so two queues sharing this store can't interleave; see
+            // class doc.
+            this.writeChain = Promise.resolve();
+            // Identifies THIS store session (process launch). Minted fresh per
+            // construction and never persisted, so a journal entry stamped with a
+            // different token is crash residue from a dead process (recoverable), while
+            // one stamped with this token is a batch still in flight this session. Sibling
+            // queues share one store instance (the Performance Upload model) and therefore
+            // one token; see readRecoverableBatchJournals.
+            this.sessionToken = uuidv4();
+            this.durableStoreRef = durableStore;
+        }
+        /**
+         * Records, BEFORE a batch is dispatched, the ids of the members about to be
+         * sent as one all-or-none request (B2). If the app dies — or the durable
+         * removal fails — between the server commit and the client removing the
+         * committed members, the next startQueue reconcile reads this journal and
+         * pins any still-Pending member to the key-preserving serial path instead
+         * of re-batching it (which would drop its idempotency key and replay a
+         * committed write). Journal rows live in their own segment and never flow
+         * through the draft writeChain — they are keyed by batchId, independent of
+         * the draft snapshot-then-mutate sequence the chain serializes.
+         */
+        writeBatchJournal(batchId, memberIds) {
+            const entry = {
+                // Stamp the live session token so a later reconcile can tell this
+                // in-flight batch apart from crash residue (see sessionToken).
+                data: { batchId, memberIds, owner: this.sessionToken },
+            };
+            return this.durableStoreRef.setEntries({ [batchId]: entry }, DRAFT_BATCH_JOURNAL_SEGMENT);
+        }
+        /** Removes a batch-completion journal entry once its members are durably resolved. */
+        clearBatchJournal(batchId) {
+            return this.durableStoreRef.evictEntries([batchId], DRAFT_BATCH_JOURNAL_SEGMENT);
+        }
+        /**
+         * Returns only crash-residue journals — those written by a PRIOR store session
+         * (owner token != this session's). Entries stamped with the live session's
+         * token are batches still in flight this launch (possibly on a sibling queue
+         * sharing this store) and are deliberately excluded, so a startup reconcile can
+         * never quarantine a live peer batch's members out from under it. This is the
+         * only read the queue reconcile uses; readBatchJournals (all entries) is kept
+         * for inspection/tests.
+         *
+         * Relies on sibling queues sharing ONE store INSTANCE (the documented
+         * Performance Upload model), so they share one session token. If two queues
+         * were ever given separate store instances over the same durable store, the
+         * token would have to move down to the durable store.
+         */
+        readRecoverableBatchJournals() {
+            return this.readBatchJournals().then((journals) => journals.filter((journal) => journal.owner !== this.sessionToken));
+        }
+        /** Returns every persisted batch-completion journal entry (inspection/tests). */
+        readBatchJournals() {
+            return this.durableStoreRef
+                .getAllEntries(DRAFT_BATCH_JOURNAL_SEGMENT)
+                .then((entries) => {
+                if (entries === undefined) {
+                    return [];
+                }
+                const keys$1 = keys$4(entries);
+                const journals = [];
+                for (let i = 0, len = keys$1.length; i < len; i++) {
+                    journals.push(entries[keys$1[i]].data);
+                }
+                return journals;
+            });
+        }
+        getAllDrafts() {
+            const waitForOngoingSync = this.syncPromise || Promise.resolve();
+            // Also wait for any outstanding writes serialized through the
+            // write chain so callers observe writes initiated before this read.
+            const waitForOutstandingWrites = this.writeChain;
+            return Promise.all([waitForOngoingSync, waitForOutstandingWrites]).then(() => {
+                const { draftStore } = this;
+                const keys$1 = keys$4(draftStore);
+                const actionArray = [];
+                for (let i = 0, len = keys$1.length; i < len; i++) {
+                    const key = keys$1[i];
+                    // clone draft so we don't expose the internal draft store
+                    actionArray.push(clone$1(draftStore[key]));
+                }
+                return actionArray;
+            });
+        }
+        enqueueAction(action) {
+            const { syncPromise, writeQueue: pendingMerges } = this;
+            // During initial sync, queue the write to run after sync completes.
+            if (syncPromise !== undefined || pendingMerges.length > 0) {
+                const deferred = new Promise((resolve, reject) => {
+                    this.writeQueue.push(() => {
+                        return action()
+                            .then((x) => {
+                            resolve(x);
+                        })
+                            .catch((err) => reject(err));
+                    });
+                });
+                return deferred;
+            }
+            // Sync done. Serialize concurrent writes through writeChain so that
+            // when two queues share this store, their snapshot-then-mutate
+            // sequences cannot interleave.
+            const next = this.writeChain.then(action, action);
+            // Don't propagate failures into the chain — every caller awaits its own
+            // result and a single rejection must not poison subsequent writes.
+            this.writeChain = next.catch(() => undefined);
+            return next;
+        }
+    }
+
     const { hasOwnProperty: ObjectPrototypeHasOwnProperty$1$1 } = Object.prototype;
     const { keys: ObjectKeys$1$2, create: ObjectCreate$1$2 } = Object;
     const { stringify: JSONStringify$1 } = JSON;
@@ -80322,6 +82492,7 @@
     const DRAFT_QUEUE_ACTION_UPDATED = 'draft-queue-action-updated';
     const DRAFT_QUEUE_ACTION_FAILED = 'draft-queue-action-failed';
     const DRAFT_QUEUE_ACTION_UPLOAD_ERROR = 'draft-queue-action-upload-error';
+    const DRAFT_QUEUE_BATCH_RECOVERY_FAILED = 'draft-queue-batch-recovery-failed';
     const DRAFT_QUEUE_TOTAL_MERGE_ACTIONS_CALLS = 'draft-queue-total-mergeActions-calls';
     // Emitted every time a draft's Idempotency-Key is rotated (replaced with a fresh uuid).
     // Used to triage the WOLI duplicate-record investigation in Splunk — correlate by draftId
@@ -80372,6 +82543,11 @@
         __nimbus.plugins.JSLoggerPlugin !== undefined
         ? __nimbus.plugins.JSLoggerPlugin
         : undefined;
+    function logInfo(message) {
+        if (nimbusLogger) {
+            nimbusLogger.logInfo(message);
+        }
+    }
     function reportGraphqlQueryParseError(err) {
         const error = normalizeError$2(err);
         const errorCode = GRAPHQL_QUERY_PARSE_ERROR;
@@ -80417,9 +82593,7 @@
         ldsMobileInstrumentation$2.incrementCounter(GRAPHQL_SNAPSHOT_REFRESH_UNDEFINED);
     }
     function reportDraftActionEvent(state, draftCount, message) {
-        if (nimbusLogger) {
-            nimbusLogger.logInfo(`Draft action event: ${state}, depth: ${draftCount}${message ? `, message: ${message}` : ''}`);
-        }
+        logInfo(`Draft action event: ${state}, depth: ${draftCount}${message ? `, message: ${message}` : ''}`);
         switch (state) {
             case 'added':
                 ldsMobileInstrumentation$2.incrementCounter(DRAFT_QUEUE_ACTION_ADDED);
@@ -80619,6 +82793,26 @@
         });
         ldsMobileInstrumentation$2.error(normalized, DRAFT_QUEUE_ACTION_UPLOAD_ERROR);
     }
+    /**
+     * Reports a batch-journal crash-recovery failure on the Performance Upload
+     * batching path (B2, currently feature-gated and dormant): a maybe-committed
+     * all-or-none batch's members could not be durably quarantined this session, a
+     * startup reconcile could not surface a prior crash's batch, or a resolved journal
+     * row could not be cleared. Each is otherwise visible only in device logs; this
+     * surfaces it to o11y (greppable log line + reason-tagged counter) so the batching
+     * path can be monitored when it ships.
+     *
+     * PII: carries ONLY the bounded reason code and the queue depth — never a record
+     * id, draft id, tag, or free-text error message (device-log PII policy).
+     */
+    function reportBatchRecoveryFailure(reason, draftCount) {
+        if (nimbusLogger) {
+            nimbusLogger.logInfo(`Batch recovery failed: reason=${reason}, depth=${draftCount}`);
+        }
+        ldsMobileInstrumentation$2.incrementCounter(DRAFT_QUEUE_BATCH_RECOVERY_FAILED, 1, true, {
+            reason,
+        });
+    }
     /**
      * Emits a single greppable Splunk log line (and an o11y counter) every time a draft's
      * Idempotency-Key is rotated — i.e. replaced with a fresh uuid rather than reused on
@@ -80648,9 +82842,7 @@
         });
     }
     function reportDraftQueueState(state, draftCount) {
-        if (nimbusLogger) {
-            nimbusLogger.logInfo(`Draft state changed: ${state}, depth: ${draftCount}`);
-        }
+        logInfo(`Draft state changed: ${state}, depth: ${draftCount}`);
         switch (state) {
             case 'started':
                 ldsMobileInstrumentation$2.incrementCounter(DRAFT_QUEUE_STATE_STARTED);
@@ -80763,6 +82955,26 @@
 
     const DEFAULT_FIELD_LAST_MODIFIED_DATE$1 = 'LastModifiedDate';
     const DEFAULT_FIELD_CREATED_DATE$1 = 'CreatedDate';
+    // UI-API Records Batch endpoint. Reuses the same baseUri pattern as the
+    // generated record adapters (see e.g. getUiApiRecordsByRecordId.ts).
+    const BATCH_BASE_URI = '/services/data/v68.0';
+    const BATCH_BASE_PATH = '/ui-api/records/batch';
+    // Non-attributive error codes returned by an allOrNone=true batch. When one
+    // operation fails, UI-API rolls the whole batch back and marks the *innocent*
+    // siblings with one of these codes — they are not themselves the offender:
+    //   - ALL_OR_NONE_OPERATION_ROLLED_BACK: the canonical all-or-none rollback
+    //     marker applied to every sibling that would otherwise have succeeded.
+    //   - PROCESSING_HALTED: applied to operations skipped because processing was
+    //     halted (e.g. a dependency/composite-ordering stop) before they ran.
+    // The true offender is any member whose errorCode is neither of these.
+    const PROCESSING_HALTED_ERROR_CODE = 'PROCESSING_HALTED';
+    const ALL_OR_NONE_ROLLED_BACK_ERROR_CODE = 'ALL_OR_NONE_OPERATION_ROLLED_BACK';
+    // Codes that mark a batch member as a rolled-back innocent sibling rather than
+    // the operation that actually caused the batch to fail.
+    const ROLLBACK_SIBLING_ERROR_CODES = new Set([
+        PROCESSING_HALTED_ERROR_CODE,
+        ALL_OR_NONE_ROLLED_BACK_ERROR_CODE,
+    ]);
     class AbstractResourceRequestActionHandler {
         constructor(draftQueue, networkAdapter, getLuvio, recordService) {
             this.draftQueue = draftQueue;
@@ -80925,23 +83137,7 @@
                         actionDataChanged = true;
                     }
                 }
-                if (response.status === HttpStatusCode$2.BadRequest &&
-                    this.isBackdatingError(response.body, action)) {
-                    updatedAction.timestamp = Date.now();
-                    updatedAction.data.body.fields = {
-                        ...updatedAction.data.body.fields,
-                        LastModifiedDate: new Date(updatedAction.timestamp).toISOString(),
-                    };
-                    // The record content changed (LastModifiedDate is bumped), so this is a NEW
-                    // logical write. Rotate the idempotency key so the server treats it as such
-                    // rather than deduping it against the stale, pre-backdate request. This is a
-                    // legitimate rotation — the request body is modified — unlike the generic-400
-                    // fallback above which must preserve the key. @W-23445154
-                    if (this.hasIdempotencySupport() &&
-                        updatedAction.data.headers[HTTP_HEADER_IDEMPOTENCY_KEY] !== undefined) {
-                        updatedAction.data.headers[HTTP_HEADER_IDEMPOTENCY_KEY] = uuidv4();
-                        reportIdempotencyKeyRotated(updatedAction.targetId, 'backdating-collision');
-                    }
+                if (this.applyBackdatingRetryIfNeeded(response, updatedAction)) {
                     shouldRetry = true;
                     actionDataChanged = true;
                 }
@@ -81039,6 +83235,113 @@
             };
             await actionErrored(retryingAction, true, retryDelayInMs, true);
         }
+        /**
+         * If `response` is a LastModifiedDate backdating collision (@W-23445154) for
+         * `action`, mutate the action so it is treated as a NEW logical write — bump
+         * its timestamp + LastModifiedDate, and rotate the idempotency key when one
+         * is present (the body changed, so the server must not dedupe it against the
+         * stale pre-backdate request) — and return true. Otherwise return false and
+         * leave the action untouched.
+         *
+         * Extracted from the single-action handleAction path so the batch upload
+         * path (UiApiActionHandler.classifyBatchFailure) treats a backdating
+         * collision identically instead of diverging (B4).
+         */
+        applyBackdatingRetryIfNeeded(response, action) {
+            if (response.status !== HttpStatusCode$2.BadRequest ||
+                !this.isBackdatingError(response.body, action)) {
+                return false;
+            }
+            action.timestamp = Date.now();
+            action.data.body.fields = {
+                ...action.data.body.fields,
+                LastModifiedDate: new Date(action.timestamp).toISOString(),
+            };
+            if (this.hasIdempotencySupport() &&
+                action.data.headers[HTTP_HEADER_IDEMPOTENCY_KEY] !== undefined) {
+                action.data.headers[HTTP_HEADER_IDEMPOTENCY_KEY] = uuidv4();
+                reportIdempotencyKeyRotated(action.targetId, 'backdating-collision');
+            }
+            return true;
+        }
+        /**
+         * Classifies a failure surfaced by the batch upload path — either a non-ok
+         * batch envelope (whole request failed) or a single offending operation's
+         * error result — into a retry-or-terminal decision, reusing the SAME policy
+         * the single-action handleAction path applies to the same failure shapes so
+         * the two do not diverge (B4). The caller routes the decision: a retry goes
+         * through retryOrCap (so the durable attempt cap and backoff apply), a
+         * terminal result errors the action with no retry.
+         *
+         * Note the idempotency-key state machine in handleAction (key rotation on
+         * recognized idempotency error codes, isIdempotencySupported toggling) is
+         * intentionally NOT shared here: those branches are keyed on the request's
+         * per-action Idempotency-Key, which the batch envelope does not carry.
+         *
+         * commitAmbiguous distinguishes retryable failures that MAY have committed the
+         * all-or-none batch at the origin (a 5xx/408/dropped-connection — or a generic
+         * gateway 400 — returned after the write landed, with the success response lost
+         * in transit) from retryable failures that definitively rolled back or never
+         * reached the origin (a 429 rate-limit, a backdating collision the server
+         * evaluated and rejected). The batch envelope carries no server-visible
+         * idempotency key, so a commit-ambiguous failure cannot be safely re-sent; the
+         * caller returns NETWORK_ERROR and the queue surfaces the members for manual
+         * resolution instead of auto-replaying them (Option A). A definitively
+         * rolled-back failure committed nothing, so a keyless re-batch is replay-safe.
+         */
+        classifyBatchFailure(response, action) {
+            const status = response.status ?? 0;
+            // Transient / infrastructure failures — retry, honoring any server-sent
+            // Retry-After (mirrors handleAction's 408/503 handling). 0 = no response
+            // (connection dropped / suspended in flight); 408 Request Timeout; 429
+            // Too Many Requests; 5xx server errors.
+            if (status === 0 ||
+                status === 408 ||
+                status === 429 ||
+                status >= HttpStatusCode$2.ServerError) {
+                return {
+                    shouldRetry: true,
+                    retryDelayInMs: getRetryAfterInMs(response.headers),
+                    actionDataChanged: false,
+                    // 0 (dropped connection), 408 (timeout), and 5xx (gateway/LB/origin
+                    // server error) can each be returned AFTER the all-or-none batch
+                    // committed at the origin with the 2xx lost — commit-ambiguous, like
+                    // handleAction's NoResponse/ServiceUnavailable path. A 429 is a rate
+                    // limiter rejecting the request before it is processed, so nothing
+                    // committed and a keyless re-batch is replay-safe.
+                    commitAmbiguous: status !== 429,
+                };
+            }
+            // LastModifiedDate backdating collision — bump the record + retry, same
+            // as the single-action path. The server evaluated and rejected the write,
+            // so the batch rolled back — not commit-ambiguous.
+            if (this.applyBackdatingRetryIfNeeded(response, action)) {
+                return { shouldRetry: true, actionDataChanged: true, commitAmbiguous: false };
+            }
+            // A 400 with no recognizable server-generated error body is an edge- or
+            // gateway-injected rejection whose commit status is genuinely ambiguous: an
+            // edge proxy or load balancer can return a bare 400 AFTER the origin has
+            // already committed the all-or-none batch. The envelope carries no
+            // server-visible idempotency key, so a keyless re-send could double-apply.
+            // Treat it as commit-ambiguous (like status 0/408/5xx) so the queue does NOT
+            // auto-replay it and surfaces the members for manual resolution instead.
+            if (status === HttpStatusCode$2.BadRequest && !this.isServerGeneratedError(response.body)) {
+                return { shouldRetry: true, actionDataChanged: false, commitAmbiguous: true };
+            }
+            // A real, server-generated client error (validation, permissions, a
+            // deterministic 4xx) — terminal. Retrying it unchanged would only be
+            // rejected again.
+            return { shouldRetry: false, actionDataChanged: false, commitAmbiguous: false };
+        }
+        /**
+         * Reports an upload failure to o11y using the same channel and attempt
+         * numbering as the single-action handleAction catch. Exposed so the batch
+         * upload path surfaces a thrown/deterministic failure to telemetry instead
+         * of swallowing it (B4).
+         */
+        reportUploadFailure(error, action) {
+            reportDraftActionUploadError(error, this.handlerId, this.getUploadRetryCount(action) + 1);
+        }
         async handleActionEnqueued(action) {
             const impactedKeys = await this.recordService.setSideEffectsForActions([action], 'enqueued');
             await this.recordService.reapplyRecordSideEffects(impactedKeys, 'enqueued');
@@ -81501,6 +83804,23 @@
 
     const LDS_ACTION_HANDLER_ID = 'LDS_ACTION_HANDLER';
     const LDS_ACTION_METADATA_API_NAME = 'LDS_ACTION_METADATA_API_NAME';
+    // Request headers/query params that the UI-API records/batch envelope can omit
+    // without changing the write, so their presence must not disqualify an action
+    // from batching (see isActionBatchable, B1). Everything not listed here does
+    // change server behavior and forces single-action dispatch.
+    const BATCH_OMITTABLE_HEADERS = new Set([HTTP_HEADER_IDEMPOTENCY_KEY]);
+    const BATCH_OMITTABLE_QUERY_PARAMS = new Set(['includeFieldsInBody']);
+    // Diagnostic log line for the local-experimental batching path. Mirrors the
+    // helper in PerformanceDraftQueue so handler-side events show up in the same
+    // device-log stream with the same `Batch ` prefix.
+    function batchLog(line) {
+        try {
+            globalThis.__nimbus?.plugins?.JSLoggerPlugin?.logInfo(`Batch ${line}`);
+        }
+        catch {
+            // debug-only
+        }
+    }
     class UiApiActionHandler extends AbstractResourceRequestActionHandler {
         constructor(getLuvio, networkAdapter, draftQueue, getRecordAdapter, objectInfoService, isDraftId, recordService, sideEffectService, durableRecordStore) {
             super(draftQueue, networkAdapter, getLuvio, recordService);
@@ -81683,6 +84003,500 @@
         getIdFromResponseBody(responseBody) {
             return responseBody.id;
         }
+        /**
+         * The UI-API records/batch envelope carries only { type, records:[{ apiName?,
+         * fields }] } per operation — it has no place for per-operation headers or
+         * query params (see buildBatchOperations / executeBatch, which send empty
+         * headers and queryParams). An action whose request relies on a header or
+         * query param that changes the *write* would silently lose that semantic if
+         * folded into a batch, so it must be dispatched through single-action
+         * handleAction (which sends the request verbatim) instead (B1).
+         *
+         * Two request members are present on essentially every update/delete draft
+         * and are safe for the batch to omit, so they must NOT disqualify batching
+         * (doing so would disable it wholesale):
+         *   - Idempotency-Key header: dropped from the batch envelope by design (the
+         *     batch has no per-op key). Its absence weakens replay protection, which
+         *     is addressed by journaled batch completion (B2) — it is not a per-op
+         *     write-semantic change, so it does not block batching here.
+         *   - includeFieldsInBody query param: only shapes the response body, not the
+         *     write; updateRecord adds it unconditionally.
+         * Any OTHER header (e.g. If-Unmodified-Since — a conditional update that would
+         * become an unconditional lost-update) or query param (useDefaultRule,
+         * triggerUserEmail, triggerOtherEmail — assignment-rule / email side effects)
+         * does change server behavior and makes the action non-batchable.
+         *
+         * The request BODY is checked too: buildBatchOperations copies ONLY `fields`
+         * into the batch UPDATE/DELETE operation, so any other body member — e.g.
+         * `allowSaveOnDuplicate`, which changes duplicate-rule handling — would be
+         * silently dropped if the action were batched. An action whose body carries
+         * anything beyond `fields` is therefore dispatched single-action (handleAction
+         * sends the body verbatim), preserving those semantics.
+         *
+         * resolveResourceRequest only rewrites basePath/body/urlParams (never headers
+         * or queryParams), and a body option like allowSaveOnDuplicate survives that
+         * rewrite, so the raw action.data is authoritative for this check and we avoid
+         * the cost of resolving here.
+         */
+        isActionBatchable(action) {
+            const request = action.data;
+            if (request.headers !== undefined) {
+                const headerNames = keys$3(request.headers);
+                for (let i = 0; i < headerNames.length; i++) {
+                    if (!BATCH_OMITTABLE_HEADERS.has(headerNames[i])) {
+                        return false;
+                    }
+                }
+            }
+            if (request.queryParams !== undefined) {
+                const queryNames = keys$3(request.queryParams);
+                for (let i = 0; i < queryNames.length; i++) {
+                    if (!BATCH_OMITTABLE_QUERY_PARAMS.has(queryNames[i])) {
+                        return false;
+                    }
+                }
+            }
+            // Only `fields` is carried into the batch op (buildBatchOperations); any
+            // other body member (e.g. allowSaveOnDuplicate) would be dropped, so it
+            // disqualifies the action from batching.
+            const body = request.body;
+            if (body !== undefined && body !== null) {
+                const bodyKeys = keys$3(body);
+                for (let i = 0; i < bodyKeys.length; i++) {
+                    if (bodyKeys[i] !== 'fields') {
+                        return false;
+                    }
+                }
+            }
+            return true;
+        }
+        /**
+         * Sends a single UI-API records/batch request that combines all given actions.
+         * Uses allOrNone=true so any failure rolls back the whole batch on the server,
+         * preserving today's "one bad mutation blocks the queue" UX.
+         *
+         * Per-action result routing pairs each result with its action by index. The
+         * endpoint exposes no per-result correlation key (no client-supplied
+         * referenceId; DELETE/error results carry no id) and does not contractually
+         * guarantee results order matches operations order, so index pairing is
+         * guarded: the result count must equal the action count, and each UPDATE
+         * result's returned record id must match the action's resolved recordId.
+         *   - Success (hasErrors === false): each result is paired with its action by
+         *     index and forwarded to actionCompleted in order.
+         *   - Server-reported failure (hasErrors === true): exactly one result carries
+         *     the real errorCode; the innocent siblings carry a non-attributive
+         *     rollback code (ALL_OR_NONE_OPERATION_ROLLED_BACK or PROCESSING_HALTED).
+         *     The batch rolled back, so a retryable offender parks EVERY member
+         *     together (C4/R4-3 — no self-driven prefix/suffix retry) charging a retry
+         *     attempt only to the offender, and a deterministic offender is errored
+         *     terminally while innocent siblings are left Pending (B5); returns
+         *     ACTION_ERRORED (journal cleared, replay-safe).
+         *   - Commit-ambiguous transport failure (network throw, empty-body or
+         *     misaligned 2xx, result count/id mismatch, or a retryable 5xx/408/dropped-
+         *     connection or generic-400 envelope that may have committed with the 2xx
+         *     lost): return NETWORK_ERROR WITHOUT retrying. The batch envelope carries
+         *     no server-visible idempotency key, so it cannot be safely re-sent; the
+         *     queue surfaces the members for manual resolution and retains/clears the
+         *     B2 journal instead of auto-replaying them (Option A / R4-4).
+         */
+        async handleBatchActions(actions, actionCompleted, actionErrored) {
+            return this.executeBatch(actions, actionCompleted, actionErrored);
+        }
+        async executeBatch(actions, actionCompleted, actionErrored) {
+            if (actions.length === 0) {
+                return ProcessActionResult.NO_ACTION_TO_PROCESS;
+            }
+            try {
+                const operations = this.buildBatchOperations(actions);
+                batchLog(`sending size=${actions.length}`);
+                const batchRequest = {
+                    baseUri: BATCH_BASE_URI,
+                    basePath: BATCH_BASE_PATH,
+                    method: 'post',
+                    body: { allOrNone: true, operations },
+                    urlParams: {},
+                    queryParams: {},
+                    headers: {},
+                    priority: 'normal',
+                };
+                // Attribute the batch request to the head action's observability
+                // context. A batch collapses N actions into one request, so there is
+                // no per-member correlation; the head action's context is used as a
+                // representative, mirroring the single-action dispatch path in
+                // handleAction. (If members carried differing contexts, only the
+                // head's is reported.)
+                const dispatchOptions = actions[0].observabilityContext !== undefined
+                    ? {
+                        requestCorrelator: {
+                            observabilityContext: actions[0].observabilityContext,
+                        },
+                    }
+                    : {};
+                const response = await this.networkAdapter(batchRequest, dispatchOptions);
+                if (!response.ok) {
+                    // Classify the envelope with the SAME body-aware policy the
+                    // single-action path uses (classifyBatchFailure) instead of a
+                    // status-only check. Three outcomes, routing EVERY member (not just
+                    // the head — C4):
+                    //   - Commit-AMBIGUOUS (5xx/408/dropped connection, or a generic
+                    //     gateway 400): may have committed at the origin with the 2xx
+                    //     lost, and the batch carries no server-visible idempotency key,
+                    //     so a keyless re-send could double-apply. Return NETWORK_ERROR
+                    //     WITHOUT retrying; the queue surfaces the members for manual
+                    //     resolution and retains/clears the journal instead of
+                    //     auto-replaying them (Option A / R4-4).
+                    //   - Definitively rolled back but retryable (429 rate-limit,
+                    //     backdating collision the server evaluated): committed nothing,
+                    //     so a keyless re-batch is replay-safe — park every member for a
+                    //     bounded, backed-off retry (capped, honoring Retry-After).
+                    //   - Deterministic server-generated client error: terminal, so a
+                    //     rejected batch is not retried forever (C3/B4).
+                    const decision = this.classifyBatchFailure(response, actions[0]);
+                    batchLog(`http error status=${response.status ?? 0} retry=${decision.shouldRetry}` +
+                        ` ambiguous=${decision.commitAmbiguous} size=${actions.length}`);
+                    if (decision.shouldRetry) {
+                        if (decision.commitAmbiguous) {
+                            return ProcessActionResult.NETWORK_ERROR;
+                        }
+                        await this.retryBatchMembers(actions, response, actionErrored, decision.retryDelayInMs);
+                    }
+                    else {
+                        await this.terminalBatchMembers(actions, response, actionErrored);
+                    }
+                    return ProcessActionResult.ACTION_ERRORED;
+                }
+                if (response.body === undefined || response.body === null) {
+                    // 2xx with no body — a misaligned/empty response. We got a success
+                    // status but cannot confirm what committed, so this is
+                    // commit-AMBIGUOUS: return NETWORK_ERROR so the queue surfaces the
+                    // members for manual resolution and retains/clears the journal,
+                    // rather than auto-replaying a keyless batch that may have committed
+                    // (Option A / R4-4).
+                    batchLog(`empty body ambiguous size=${actions.length}`);
+                    return ProcessActionResult.NETWORK_ERROR;
+                }
+                const body = response.body;
+                // Both branches below pair body.results to actions positionally.
+                // The UI-API batch endpoint supplies no per-result correlation key
+                // (no client referenceId, and DELETE/error results carry no id) and
+                // does not contractually guarantee results order matches operations
+                // order, so a short/over-length response would silently mis-pair
+                // completions with the wrong drafts. Refuse to pair positionally
+                // unless the counts match exactly; on mismatch complete nothing. This is
+                // commit-AMBIGUOUS (2xx received, response untrustworthy): return
+                // NETWORK_ERROR so the queue surfaces the members for manual resolution
+                // and retains/clears the journal (Option A / R4-4).
+                if (!isArray$3$1(body.results) || body.results.length !== actions.length) {
+                    batchLog(`result count mismatch expected=${actions.length}` +
+                        ` got=${isArray$3$1(body.results) ? body.results.length : 'none'}` +
+                        ` ambiguous`);
+                    return ProcessActionResult.NETWORK_ERROR;
+                }
+                if (body.hasErrors === false) {
+                    // Strict success envelope (R4-4): the endpoint claims the batch
+                    // succeeded, but we only complete (and remove) a draft when the
+                    // member's OWN result confirms it committed — otherwise it is
+                    // commit-AMBIGUOUS: return NETWORK_ERROR so the queue surfaces the
+                    // members for manual resolution and retains/clears the journal,
+                    // rather than silently dropping a write that may never have landed.
+                    // (CREATE is never batched; DELETE carries no body, so only its 2xx
+                    // status is required — id echo is UPDATE-only.)
+                    for (let i = 0; i < actions.length; i++) {
+                        const action = actions[i];
+                        const method = action.data.method;
+                        const result = body.results[i];
+                        const childStatus = result?.statusCode;
+                        if (childStatus === undefined ||
+                            childStatus < HttpStatusCode$2.Ok ||
+                            childStatus >= 300) {
+                            batchLog(`success envelope unconfirmed child index=${i}` +
+                                ` status=${childStatus ?? 'none'} ambiguous`);
+                            return ProcessActionResult.NETWORK_ERROR;
+                        }
+                        if (method === 'patch') {
+                            const resolved = this.resolveResourceRequest(action.data);
+                            const expectedId = resolved.urlParams['recordId'];
+                            const returnedId = !isArray$3$1(result.result)
+                                ? result.result.id
+                                : undefined;
+                            // UPDATE must echo a matching record id; a missing or
+                            // mismatched id is commit-AMBIGUOUS.
+                            if (returnedId === undefined || returnedId !== expectedId) {
+                                // Log the reason code + whether an id came back, NOT the
+                                // ids themselves: expectedId/returnedId are record ids,
+                                // and the device-log PII policy (metrics.ts) forbids
+                                // record ids in device logs (4065667273).
+                                batchLog(`success envelope bad update id index=${i}` +
+                                    ` returned=${returnedId === undefined ? 'none' : 'mismatch'} ambiguous`);
+                                return ProcessActionResult.NETWORK_ERROR;
+                            }
+                        }
+                    }
+                    batchLog(`completed size=${actions.length}`);
+                    for (let i = 0; i < actions.length; i++) {
+                        const action = actions[i];
+                        const result = body.results[i];
+                        const recordBody = result !== undefined && !isArray$3$1(result.result)
+                            ? result.result
+                            : undefined;
+                        const perActionResponse = {
+                            status: (result?.statusCode ?? HttpStatusCode$2.Ok),
+                            statusText: 'OK',
+                            ok: true,
+                            headers: {},
+                            body: recordBody,
+                        };
+                        await actionCompleted({
+                            ...action,
+                            response: perActionResponse,
+                            status: DraftActionStatus.Completed,
+                        });
+                    }
+                    return ProcessActionResult.ACTION_SUCCEEDED;
+                }
+                // hasErrors is neither false (clean success, handled above) nor true
+                // (attributable failure, handled below): the envelope is incomplete
+                // or malformed — we can neither confirm a commit nor attribute a
+                // failure, so treat it as commit-AMBIGUOUS (return NETWORK_ERROR, as
+                // above).
+                if (body.hasErrors !== true) {
+                    batchLog(`success envelope missing hasErrors flag ambiguous`);
+                    return ProcessActionResult.NETWORK_ERROR;
+                }
+                // Locate the action whose result is the real failure. Under
+                // allOrNone=true the server rolls the whole batch back and marks the
+                // innocent siblings with a non-attributive code (B3): the canonical
+                // all-or-none marker ALL_OR_NONE_OPERATION_ROLLED_BACK, or
+                // PROCESSING_HALTED for operations skipped before they ran. The true
+                // offender is the member whose errorCode is neither — matching only
+                // PROCESSING_HALTED would mis-pick an innocent rolled-back sibling as
+                // the offender and leave the real invalid action Pending forever.
+                let offendingIndex = -1;
+                let offendingResult;
+                for (let i = 0; i < body.results.length; i++) {
+                    const r = body.results[i];
+                    if (r === undefined)
+                        continue;
+                    if (!isArray$3$1(r.result))
+                        continue;
+                    const code = r.result[0]?.errorCode;
+                    if (code !== undefined && !ROLLBACK_SIBLING_ERROR_CODES.has(code)) {
+                        offendingIndex = i;
+                        offendingResult = r;
+                        break;
+                    }
+                }
+                // Unattributed: every failing result carries only a non-attributive
+                // rollback-sibling code with no clear offender. Treat as a transient
+                // server error — retry the whole batch.
+                if (offendingIndex < 0 || offendingResult === undefined) {
+                    batchLog(`hasErrors size=${actions.length} unattributed retry=true`);
+                    await this.retryBatchMembers(actions, response, actionErrored);
+                    return ProcessActionResult.ACTION_ERRORED;
+                }
+                const offendingAction = actions[offendingIndex];
+                const errorBody = offendingResult?.result ?? [];
+                const errorResponse = {
+                    status: (offendingResult?.statusCode ??
+                        HttpStatusCode$2.BadRequest),
+                    statusText: 'Bad Request',
+                    ok: false,
+                    headers: {},
+                    body: errorBody,
+                };
+                const offendingErrorCode = isArray$3$1(offendingResult?.result)
+                    ? offendingResult.result[0]?.errorCode ?? 'unknown'
+                    : 'unknown';
+                // Classify the offender, reusing the single-action retry/terminal
+                // policy (B4): a transient/ambiguous failure retries through the
+                // durable cap, a deterministic server-generated client error is
+                // terminal so the user can fix or remove it. classifyBatchFailure may
+                // mutate offendingAction (e.g. a backdating bump) and reports
+                // actionDataChanged so the mutation is persisted before the retry.
+                // The batch endpoint returns each member's failure as a UiApiError[]
+                // (the offender loop above keys on r.result[0].errorCode). The shared
+                // classifiers reused by classifyBatchFailure — isBackdatingError /
+                // isServerGeneratedError — and the single-action handleAction path
+                // expect the origin's structured enhancedErrorType envelope, where a
+                // backdating collision surfaces as
+                // { enhancedErrorType: 'RecordError', output: { errors: [...] } }.
+                // Left as a bare array, isBackdatingError never matches, so a batched
+                // LastModifiedDate CollisionDetectedException would be errored
+                // terminally instead of getting the single-action backdating bump +
+                // key-rotate + retry (B4). Wrap the member's error array in that
+                // envelope for CLASSIFICATION ONLY. This is behavior-preserving for
+                // every non-collision offender: isServerGeneratedError is already
+                // true for a UiApiError[] offender, so the terminal decision is
+                // unchanged; only a genuine collision (which also requires the action
+                // to carry a LastModifiedDate field) now recovers. The error surfaced
+                // to the draft (errorResponse) keeps the raw array — unchanged.
+                const classificationResponse = {
+                    ...errorResponse,
+                    body: {
+                        enhancedErrorType: 'RecordError',
+                        output: {
+                            errors: isArray$3$1(offendingResult?.result) ? offendingResult.result : [],
+                        },
+                    },
+                };
+                const decision = this.classifyBatchFailure(classificationResponse, offendingAction);
+                batchLog(`failed size=${actions.length} offendingIndex=${offendingIndex}` +
+                    ` errorCode=${offendingErrorCode} retry=${decision.shouldRetry}`);
+                if (decision.shouldRetry) {
+                    // Transient/ambiguous offender: the whole batch rolled back and
+                    // NONE committed. Parking only the offender and leaving the innocent
+                    // siblings Pending would let the queue immediately re-collect them
+                    // into a fresh, backoff-free batch — and if that batch's new head
+                    // draws the same transient response, [A,B,C] retries as [B,C] then
+                    // [C], up to 25 + 24 + ... + 1 = 325 operations before the first
+                    // backoff expires (R4-3). Park EVERY member together so the whole
+                    // batch backs off — but charge a durable retry attempt ONLY to the
+                    // offender (via retryOrCap). The innocent rolled-back siblings
+                    // produced no error of their own, so they are parked for the same
+                    // backoff WITHOUT consuming their retry budget; charging them could
+                    // push an innocent later action to its cap for another action's
+                    // transient failure (#9, matching the terminal branch's B5
+                    // treatment). The offender's own cap still bounds the shared-batch
+                    // retry loop. Only the offender carries any classifier mutation (a
+                    // backdating bump), so it alone reports actionDataChanged to persist
+                    // that mutation before its retry.
+                    for (const member of actions) {
+                        if (member === offendingAction) {
+                            await this.retryOrCap(member, errorResponse, actionErrored, decision.retryDelayInMs, decision.actionDataChanged);
+                        }
+                        else {
+                            await actionErrored(member, true, decision.retryDelayInMs);
+                        }
+                    }
+                }
+                else {
+                    // Deterministic, server-generated offender: terminal. Route ONLY the
+                    // offender and leave the innocent rolled-back siblings Pending and
+                    // unparked — reporting nothing for them (B5). Charging a sibling a
+                    // durable retry attempt for another action's terminal failure could
+                    // push an innocent later action to its cap without it ever producing
+                    // its own error. The queue re-collects the siblings on the next pass
+                    // (bounded: each pass terminally resolves one offender, so there is
+                    // no zero-delay storm), and it owns stop state / backoff / retry
+                    // budgets — the handler no longer self-drives prefix/suffix retries
+                    // (that recursion bypassed stopQueue and could launch a new request
+                    // while the original was in flight).
+                    await actionErrored({
+                        ...offendingAction,
+                        error: errorResponse,
+                        status: DraftActionStatus.Error,
+                    }, false);
+                }
+                return ProcessActionResult.ACTION_ERRORED;
+            }
+            catch (e) {
+                batchLog(`network error ambiguous size=${actions.length}`);
+                const failure = normalizeError$1(e);
+                // A throw here means the request was dispatched but no response was
+                // received — the all-or-none batch may have committed at the origin
+                // with the response lost, and the envelope carries no server-visible
+                // idempotency key. This is commit-AMBIGUOUS: surface the failure to o11y
+                // (the single-action handleAction catch reports every upload error, and
+                // the batch path swallowed them until now — B4; attributed to the head
+                // as a representative, matching the dispatch correlation above), then
+                // return NETWORK_ERROR so the queue surfaces the members for manual
+                // resolution instead of auto-replaying them (Option A).
+                this.reportUploadFailure(failure, actions[0]);
+                return ProcessActionResult.NETWORK_ERROR;
+            }
+        }
+        /**
+         * Retries every given batch member through the durable retry cap
+         * (retryOrCap). Used for whole-batch transient failures (network throw,
+         * misaligned/short/empty response, unattributed rollback, retryable envelope
+         * status) and for the surviving members of a partial failure, so that (a)
+         * every member is parked with backoff before the queue re-arms — not just
+         * the head (C4) — and (b) the durable attempt cap bounds the retries instead
+         * of looping forever (C3). When the cap gate is closed, retryOrCap is a
+         * passthrough that parks each member exactly as before (retry=true).
+         */
+        async retryBatchMembers(members, lastFailure, actionErrored, retryDelayInMs) {
+            for (const member of members) {
+                await this.retryOrCap(member, lastFailure, actionErrored, retryDelayInMs);
+            }
+        }
+        /**
+         * Terminally errors every given batch member (no retry). Used when the batch
+         * envelope is rejected with a deterministic client error (4xx other than
+         * 408/429): retrying an unchanged, server-rejected batch would only be
+         * rejected again, so the drafts are errored for the user to fix or discard —
+         * consistent with the single-action response policy — instead of being
+         * retried forever (C3).
+         */
+        async terminalBatchMembers(members, error, actionErrored) {
+            for (const member of members) {
+                await actionErrored({ ...member, error, status: DraftActionStatus.Error }, false);
+            }
+        }
+        /**
+         * Maps each draft action to a UI-API records/batch operation. Each op has
+         * exactly one record entry; the order of returned ops matches the order of
+         * input actions so per-action result routing works on index alone.
+         *
+         * - method='post'   -> CREATE with apiName + fields
+         * - method='patch'  -> UPDATE with fields including Id (Id pulled from
+         *                       urlParams.recordId)
+         * - method='delete' -> DELETE with fields containing only Id
+         *
+         * Each request is re-resolved through resolveResourceRequest first. The
+         * draft-id redirect rewrite that runs when an upstream POST completes only
+         * updates a queued action's basePath/body — NOT its urlParams — so a stored
+         * PATCH/DELETE can still carry a stale draft id in urlParams.recordId at
+         * drain time. resolveResourceRequest re-canonicalizes urlParams.recordId
+         * (and body fields) against the store, and is idempotent when the id is
+         * already canonical, so it is safe to call unconditionally here.
+         */
+        buildBatchOperations(actions) {
+            const operations = [];
+            for (const action of actions) {
+                const request = this.resolveResourceRequest(action.data);
+                const method = request.method;
+                if (method === 'post') {
+                    const body = request.body;
+                    operations.push({
+                        type: 'CREATE',
+                        records: [
+                            {
+                                apiName: body.apiName,
+                                fields: { ...body.fields },
+                            },
+                        ],
+                    });
+                }
+                else if (method === 'patch') {
+                    const recordId = request.urlParams['recordId'];
+                    const body = request.body;
+                    operations.push({
+                        type: 'UPDATE',
+                        records: [
+                            {
+                                fields: { Id: recordId, ...body.fields },
+                            },
+                        ],
+                    });
+                }
+                else if (method === 'delete') {
+                    const recordId = request.urlParams['recordId'];
+                    operations.push({
+                        type: 'DELETE',
+                        records: [
+                            {
+                                fields: { Id: recordId },
+                            },
+                        ],
+                    });
+                }
+                else {
+                    throw Error(`Unsupported method '${method}' in UiApiActionHandler.buildBatchOperations`);
+                }
+            }
+            return operations;
+        }
         async draftActionToSideEffects(action) {
             const method = action.data.method;
             const apiName = action.metadata[LDS_ACTION_METADATA_API_NAME];
@@ -82165,6 +84979,12 @@
     const CONTENT_DOCUMENT_DRAFT_ID_KEY = 'CONTENT_DOCUMENT_DRAFT_ID';
     const CONTENT_VERSION_DRAFT_ID_KEY = 'CONTENT_VERSION_DRAFT_ID';
     const CONTENT_DOCUMENT_LINK_DRAFT_ID_KEY = 'CONTENT_DOCUMENT_LINK_DRAFT_ID';
+    /**
+     * Metadata key carrying the LDS binary store URI for the upload's local file.
+     * Set in `buildPendingAction` so the Swift "Pending Images" UI can render
+     * a thumbnail from the local bytes without a JSC round-trip.
+     */
+    const LDS_BINARY_HANDLE_KEY = 'LDS_BINARY_HANDLE';
     const RESPONSE_CONTENT_DOCUMENT_FIELDS = [
         'ContentSize',
         'CreatedDate',
@@ -82416,6 +85236,15 @@
                 return Promise.reject(new DraftSynthesisError('Cannot generate local ContentDocumentLink synthetic id', 'CANNOT_GENERATE_ID'));
             });
             pendingAction.metadata[CONTENT_DOCUMENT_LINK_DRAFT_ID_KEY] = contentDocumentLinkId;
+            // Stash the LDS binary store URI so the Swift "Pending Images" section
+            // can render a thumbnail directly from the local file bytes.
+            try {
+                const fileRef = getFileReferenceFromResourceRequest(request);
+                pendingAction.metadata[LDS_BINARY_HANDLE_KEY] = fileRef.handle;
+            }
+            catch {
+                // No file data — leave metadata unset; UI falls back to placeholder.
+            }
             const objectInfo = await this.objectInfoService.getObjectInfo(CONTENT_VERSION_API_NAME);
             if (objectInfo === undefined) {
                 throw Error(`Could not generate draft. Object info is missing`);
@@ -83018,7 +85847,18 @@
                 return ids.map((id) => recordMap.get(id) || null);
             }
         }
-        return new DataLoader(batchRecordQuery);
+        const loader = new DataLoader(batchRecordQuery);
+        const loads = new Map();
+        return Object.assign(loader, {
+            prefetch(id) {
+                const existing = loads.get(id);
+                if (existing)
+                    return existing;
+                const load = loader.load(id).then((record) => ({ record }), (error) => ({ error }));
+                loads.set(id, load);
+                return load;
+            },
+        });
     }
 
     function createContext(store, objectInfos, eventEmitter, settings, snapshot, mappedCursors = new Map(), draftFunctions) {
@@ -83052,6 +85892,8 @@
             draftFunctions,
             mappedCursors,
             missingFieldsMap: new Map(),
+            parentPrefetchEnabled: !parentRelationshipPrefetchKillSwitch.isOpen({ fallback: false }),
+            parentResults: new Map(),
         };
     }
 
@@ -86199,6 +89041,207 @@
         return metadataMap;
     }
 
+    function getDirectiveBooleanValue(argument, variables) {
+        if (!argument)
+            return undefined;
+        if (argument.value.kind === Kind$2.BOOLEAN)
+            return argument.value.value;
+        if (argument.value.kind === Kind$2.VARIABLE) {
+            const value = variables[argument.value.name.value];
+            return typeof value === 'boolean' ? value : undefined;
+        }
+        return undefined;
+    }
+    function isSelectionIncluded(selection, variables) {
+        for (const directive of selection.directives || []) {
+            if (directive.name.value !== 'skip' && directive.name.value !== 'include')
+                continue;
+            const argument = (directive.arguments || []).find((argument) => argument.name.value === 'if');
+            const value = getDirectiveBooleanValue(argument, variables);
+            if (value === undefined)
+                return false;
+            if (directive.name.value === 'skip' && value === true)
+                return false;
+            if (directive.name.value === 'include' && value === false)
+                return false;
+        }
+        return true;
+    }
+    function matchesTypeCondition(typeCondition, runtimeType, schema) {
+        if (!typeCondition)
+            return true;
+        const conditionType = schema.getType(typeCondition.name.value);
+        if (!conditionType || conditionType === runtimeType)
+            return conditionType === runtimeType;
+        const kind = conditionType.astNode?.kind;
+        if (kind !== Kind$2.INTERFACE_TYPE_DEFINITION && kind !== Kind$2.UNION_TYPE_DEFINITION)
+            return false;
+        return schema.isSubType(conditionType, runtimeType);
+    }
+    function relationshipId(fieldName, record) {
+        let id;
+        if (fieldName === 'RecordType')
+            id = record.recordTypeId;
+        else if (fieldName.endsWith('__r')) {
+            const relationshipField = record.fields[fieldName.replace('__r', '__c')];
+            id = relationshipField && relationshipField.value;
+        }
+        else {
+            const relationshipField = record.fields[fieldName + 'Id'];
+            id = relationshipField && relationshipField.value;
+        }
+        return typeof id === 'string' && id ? id : null;
+    }
+    function getObjectFields(type) {
+        return isObjectType(type) ? type.getFields() : {};
+    }
+    function getSelectedParentFields(selectionSet, runtimeType, info, visitedFragments) {
+        if (!selectionSet)
+            return [];
+        const selectedParentFields = [];
+        const variables = info.variableValues;
+        for (const selection of selectionSet.selections) {
+            if (!isSelectionIncluded(selection, variables))
+                continue;
+            if (selection.kind === Kind$2.FIELD) {
+                const field = getObjectFields(runtimeType)[selection.name.value];
+                const fieldType = field && getNamedType(field.type);
+                const isParent = fieldType &&
+                    ((isObjectType(fieldType) &&
+                        fieldType.getInterfaces().some((iface) => iface.name === 'Record')) ||
+                        fieldType.name === 'Record');
+                if (isParent &&
+                    selection.selectionSet &&
+                    !(isObjectType(fieldType) && fieldType.name.endsWith('Connection'))) {
+                    selectedParentFields.push({
+                        name: selection.name.value,
+                        selectionSet: selection.selectionSet,
+                    });
+                }
+            }
+            else if (selection.kind === Kind$2.INLINE_FRAGMENT &&
+                matchesTypeCondition(selection.typeCondition, runtimeType, info.schema)) {
+                selectedParentFields.push(...getSelectedParentFields(selection.selectionSet, runtimeType, info, visitedFragments));
+            }
+            else if (selection.kind === Kind$2.FRAGMENT_SPREAD) {
+                const fragment = info.fragments[selection.name.value];
+                if (!fragment ||
+                    visitedFragments.has(fragment.name.value) ||
+                    !matchesTypeCondition(fragment.typeCondition, runtimeType, info.schema))
+                    continue;
+                visitedFragments.add(fragment.name.value);
+                selectedParentFields.push(...getSelectedParentFields(fragment.selectionSet, runtimeType, info, visitedFragments));
+            }
+        }
+        return selectedParentFields;
+    }
+    function getActiveFieldSelectionSets(selectionSet, fieldName, runtimeType, info, visitedFragments) {
+        if (!selectionSet)
+            return [];
+        const fieldSelectionSets = [];
+        const variables = info.variableValues;
+        for (const selection of selectionSet.selections) {
+            if (!isSelectionIncluded(selection, variables))
+                continue;
+            if (selection.kind === Kind$2.FIELD &&
+                selection.name.value === fieldName &&
+                selection.selectionSet)
+                fieldSelectionSets.push(selection.selectionSet);
+            else if (selection.kind === Kind$2.INLINE_FRAGMENT &&
+                matchesTypeCondition(selection.typeCondition, runtimeType, info.schema)) {
+                fieldSelectionSets.push(...getActiveFieldSelectionSets(selection.selectionSet, fieldName, runtimeType, info, visitedFragments));
+            }
+            else if (selection.kind === Kind$2.FRAGMENT_SPREAD) {
+                const fragment = info.fragments[selection.name.value];
+                if (!fragment ||
+                    visitedFragments.has(fragment.name.value) ||
+                    !matchesTypeCondition(fragment.typeCondition, runtimeType, info.schema))
+                    continue;
+                visitedFragments.add(fragment.name.value);
+                fieldSelectionSets.push(...getActiveFieldSelectionSets(fragment.selectionSet, fieldName, runtimeType, info, visitedFragments));
+            }
+        }
+        return fieldSelectionSets;
+    }
+    async function prefetchParentBatch(parents, state) {
+        const { info, context, parentOutcomes, visitedSelections } = state;
+        const nextParents = [];
+        const parentLoads = [];
+        for (const parentWork of parents) {
+            let selectionsByType = visitedSelections.get(parentWork.record.recordRepresentation.id);
+            if (!selectionsByType)
+                visitedSelections.set(parentWork.record.recordRepresentation.id, (selectionsByType = new Map()));
+            let visitedSelectionSets = selectionsByType.get(parentWork.runtimeType);
+            if (!visitedSelectionSets)
+                selectionsByType.set(parentWork.runtimeType, (visitedSelectionSets = new Set()));
+            if (visitedSelectionSets.has(parentWork.selectionSet))
+                continue;
+            visitedSelectionSets.add(parentWork.selectionSet);
+            for (const parentField of getSelectedParentFields(parentWork.selectionSet, parentWork.runtimeType, info, new Set())) {
+                const parentId = relationshipId(parentField.name, parentWork.record.recordRepresentation);
+                if (!parentId)
+                    continue;
+                const knownOutcome = parentOutcomes.get(parentId) || context.parentResults.get(parentId);
+                if (knownOutcome && 'error' in knownOutcome)
+                    continue;
+                const parentLoad = context.Record.prefetch(parentId);
+                parentLoads.push(parentLoad.then((outcome) => {
+                    parentOutcomes.set(parentId, outcome);
+                    if ('error' in outcome || outcome.record === null)
+                        return;
+                    const parentRecord = outcome.record;
+                    const declaredParentType = getNamedType(getObjectFields(parentWork.runtimeType)[parentField.name].type);
+                    const recordInterface = declaredParentType.name === 'Record' &&
+                        declaredParentType.astNode?.kind === Kind$2.INTERFACE_TYPE_DEFINITION
+                        ? declaredParentType
+                        : undefined;
+                    const resolveRecordType = recordInterface?.resolveType;
+                    const resolvedParentType = resolveRecordType
+                        ? resolveRecordType({
+                            recordRepresentation: parentRecord,
+                            ingestionTimestamp: parentWork.record.ingestionTimestamp,
+                        }, context, info)
+                        : declaredParentType;
+                    const parentRuntimeType = typeof resolvedParentType === 'string'
+                        ? info.schema.getType(resolvedParentType)
+                        : resolvedParentType;
+                    if (!isObjectType(parentRuntimeType))
+                        return;
+                    nextParents.push({
+                        record: {
+                            recordRepresentation: parentRecord,
+                            ingestionTimestamp: parentWork.record.ingestionTimestamp,
+                        },
+                        selectionSet: parentField.selectionSet,
+                        runtimeType: parentRuntimeType,
+                    });
+                }));
+            }
+        }
+        await Promise.all(parentLoads);
+        if (nextParents.length > 0)
+            await prefetchParentBatch(nextParents, state);
+    }
+    async function prefetchSelectedParents(records, info, context) {
+        const parentOutcomes = new Map();
+        const connectionType = getNamedType(info.returnType);
+        const edgeType = getNamedType(getObjectFields(connectionType).edges?.type);
+        const nodeType = getNamedType(getObjectFields(edgeType).node?.type);
+        if (!isObjectType(connectionType) || !isObjectType(edgeType) || !isObjectType(nodeType)) {
+            return parentOutcomes;
+        }
+        const edgeSelectionSets = info.fieldNodes.flatMap((node) => getActiveFieldSelectionSets(node.selectionSet, 'edges', connectionType, info, new Set()));
+        const nodeSelectionSets = edgeSelectionSets.flatMap((selectionSet) => getActiveFieldSelectionSets(selectionSet, 'node', edgeType, info, new Set()));
+        if (records.length > 0 && nodeSelectionSets.length > 0) {
+            await prefetchParentBatch(records.flatMap((record) => nodeSelectionSets.map((selectionSet) => ({
+                record,
+                selectionSet,
+                runtimeType: nodeType,
+            }))), { info, context, parentOutcomes, visitedSelections: new Map() });
+        }
+        return parentOutcomes;
+    }
+
     /*
     resolves connections...
     */
@@ -86322,6 +89365,11 @@
                 earlyEnd,
             };
         });
+        if (context.parentPrefetchEnabled) {
+            const results = await prefetchSelectedParents(records, info, context);
+            for (const [id, outcome] of results)
+                context.parentResults.set(id, outcome);
+        }
         return {
             records,
             hasNextPage,
@@ -86594,7 +89642,8 @@
                                     .getInterfaces()
                                     .find((iface) => iface.name === 'Record')) ||
                                 (recordFieldType && recordFieldType.name === 'Record')) {
-                                field.resolve = async function relationResolver(obj, _args, { Record, seenRecordIds }) {
+                                field.resolve = function relationResolver(obj, _args, context) {
+                                    const { Record, seenRecordIds, parentPrefetchEnabled } = context;
                                     const fetchRecordOrNull = async (key) => {
                                         const recordRepresentation = await Record.load(key);
                                         return recordRepresentation !== null
@@ -86605,29 +89654,22 @@
                                             : null;
                                     };
                                     const { recordRepresentation: record, ingestionTimestamp } = obj;
-                                    let id = undefined;
-                                    if (field.name === 'RecordType') {
-                                        // RecordTypeId has special handling during ingest and is
-                                        // not in record.fields, so check for it at the UIAPI root property location
-                                        id = record.recordTypeId;
-                                    }
-                                    else if (field.name.endsWith('__r')) {
-                                        // Custom relationships end in `__r` and the corresponding ID field should be `__c`
-                                        let fieldName = field.name.replace('__r', '__c');
-                                        id = record.fields[fieldName] && record.fields[fieldName].value;
-                                    }
-                                    else {
-                                        // Standard relationships are just FieldNameId
-                                        let fieldName = field.name + 'Id';
-                                        id = record.fields[fieldName] && record.fields[fieldName].value;
-                                    }
-                                    if (!id || typeof id !== 'string') {
-                                        // possibly field injection did not inject the necessary Id field
-                                        // for the relationship, or we found a non-string value.
-                                        return null;
+                                    const id = relationshipId(field.name, record);
+                                    if (!id) {
+                                        return parentPrefetchEnabled ? null : Promise.resolve(null);
                                     }
                                     seenRecordIds.add(id);
-                                    return fetchRecordOrNull(id);
+                                    if (!parentPrefetchEnabled)
+                                        return fetchRecordOrNull(id);
+                                    const prefetched = context.parentResults.get(id);
+                                    if (!prefetched)
+                                        return fetchRecordOrNull(id);
+                                    if ('error' in prefetched)
+                                        return Promise.reject(prefetched.error);
+                                    const recordRepresentation = prefetched.record;
+                                    return recordRepresentation === null
+                                        ? null
+                                        : { recordRepresentation, ingestionTimestamp };
                                 };
                             }
                             else if (isObjectType(recordFieldType) &&
@@ -90575,10 +93617,21 @@
      *
      * This instance is leveraged in the LMR webview which proxies DraftQueue requests
      * to a concrete implementation running in jscore.
+     *
+     * The Nimbus plugin name targeted by this proxy can be parameterized via the
+     * constructor (defaults to 'LdsDraftQueue'); pass 'LdsPerformanceDraftQueue' to
+     * target the primer's Performance Upload draft queue.
      */
     class NimbusDraftQueue {
+        constructor(pluginName = 'LdsDraftQueue') {
+            this.pluginName = pluginName;
+        }
+        get callProxyMethod() {
+            const plugin = __nimbus.plugins[this.pluginName];
+            return plugin && plugin.callProxyMethod;
+        }
         enqueue(handlerId, data, observabilityContext) {
-            const callProxyMethod = __nimbus.plugins.LdsDraftQueue.callProxyMethod;
+            const callProxyMethod = this.callProxyMethod;
             if (callProxyMethod === undefined) {
                 return Promise.reject(new Error('callProxyMethod not defined on the nimbus plugin'));
             }
@@ -90605,7 +93658,7 @@
             return Promise.reject(new Error('Cannot call processNextAction from the NimbusDraftQueue'));
         }
         getQueueActions() {
-            const callProxyMethod = __nimbus.plugins.LdsDraftQueue.callProxyMethod;
+            const callProxyMethod = this.callProxyMethod;
             if (callProxyMethod === undefined) {
                 return Promise.reject(new Error('callProxyMethod not defined on the nimbus plugin'));
             }
@@ -90618,7 +93671,7 @@
             });
         }
         getDataForAction(action) {
-            const callProxyMethod = __nimbus.plugins.LdsDraftQueue.callProxyMethod;
+            const callProxyMethod = this.callProxyMethod;
             if (callProxyMethod === undefined) {
                 return Promise.reject('callProxyMethod not defined on the nimbus plugin');
             }
@@ -90759,6 +93812,12 @@
                 case DraftQueueEventType.ActionUpdated:
                     reportDraftActionEvent('updated', draftQueueEvent.draftCount);
                     break;
+                case DraftQueueEventType.BatchRecoveryFailed:
+                    {
+                        const recoveryEvent = draftQueueEvent;
+                        reportBatchRecoveryFailure(recoveryEvent.reason, recoveryEvent.draftCount);
+                    }
+                    break;
             }
             return Promise.resolve();
         });
@@ -90807,14 +93866,42 @@
 
     // so eslint doesn't complain about nimbus
     /* global __nimbus */
-    function buildLdsDraftQueue(durableStore) {
+    /**
+     * Builds the regular draft queue.
+     *
+     * One-arg call = legacy plain DurableDraftQueue (unchanged shipped behavior);
+     * the 3-arg call builds a PerformanceDraftQueue (serial, concurrency=1, cross-queue
+     * coordination + optional batching) over the shared store for the gate-ON path.
+     */
+    function buildLdsDraftQueue(durableStore, draftStore, options) {
         if (typeof __nimbus !== 'undefined' &&
             __nimbus.plugins !== undefined &&
             __nimbus.plugins.LdsDraftQueue !== undefined) {
-            return new NimbusDraftQueue();
+            return new NimbusDraftQueue('LdsDraftQueue');
+        }
+        // Legacy gate-OFF path: no shared store / options → today's plain queue.
+        if (draftStore === undefined && options === undefined) {
+            const useSnapshot = draftQueueStoreSnapshotGate.isOpen({ fallback: true });
+            const draftQueue = new DurableDraftQueue(new DurableDraftStore(durableStore, draftQueueInstrumentation, useSnapshot), draftQueueInstrumentation);
+            return instrumentDraftQueue(draftQueue);
         }
-        const useSnapshot = draftQueueStoreSnapshotGate.isOpen({ fallback: true });
-        const draftQueue = new DurableDraftQueue(new DurableDraftStore(durableStore, draftQueueInstrumentation, useSnapshot), draftQueueInstrumentation);
+        // Performance Upload path: serial queue participating in cross-queue coordination.
+        const store = draftStore ?? new DurableDraftStore(durableStore);
+        const draftQueue = new PerformanceDraftQueue(store, options);
+        return instrumentDraftQueue(draftQueue);
+    }
+    /**
+     * Builds the Performance Upload draft queue (ContentDocument/Version/Link
+     * multipart uploads, concurrency > 1). Only constructed on the gate-ON path.
+     */
+    function buildLdsPerformanceDraftQueue(durableStore, draftStore, options) {
+        if (typeof __nimbus !== 'undefined' &&
+            __nimbus.plugins !== undefined &&
+            __nimbus.plugins.LdsPerformanceDraftQueue !== undefined) {
+            return new NimbusDraftQueue('LdsPerformanceDraftQueue');
+        }
+        const store = draftStore ?? new DurableDraftStore(durableStore);
+        const draftQueue = new PerformanceDraftQueue(store, options);
         return instrumentDraftQueue(draftQueue);
     }
 
@@ -97919,7 +101006,7 @@
             },
         };
     }
-    // version: 1.466.0-b7b08a8e3c
+    // version: 1.467.0-4f065d2a2a
 
     /**
      * Copyright (c) 2022, Salesforce, Inc.,
@@ -97945,7 +101032,7 @@
             },
         };
     }
-    // version: 1.466.0-b7b08a8e3c
+    // version: 1.467.0-4f065d2a2a
 
     function findExecutableOperation$1(input) {
       const operations = input.query.definitions.filter(
@@ -100455,7 +103542,13 @@
     // so eslint doesn't complain about nimbus
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     /* global __nimbus */
+    const DRAFT_QUEUE_LANE = {
+        serial: 'serial',
+        concurrentBinary: 'concurrentBinary',
+    };
     let lazyDraftQueue;
+    let lazyBinaryDraftQueue;
+    let lazyRoutingDraftQueue;
     let lazyDraftManager;
     let lazyLuvio;
     let lazyInternalLuvio;
@@ -100544,8 +103637,37 @@
                     return false;
                 },
             });
-            // draft queue
-            lazyDraftQueue = buildLdsDraftQueue(lazyDurableStore);
+            // Concurrent binary draft queue configuration is supplied by the native
+            // host on globalThis.LDS, injected before the lds bundle loads so the
+            // runtime sees the Performance Upload Queue levers at startup.
+            const concurrentBinaryQueueConfig = (typeof globalThis !== 'undefined' &&
+                globalThis.LDS) ||
+                {};
+            const useConcurrentBinaryQueue = concurrentBinaryQueueConfig.enableConcurrentBinaryQueue === true;
+            const useQueueBatching = concurrentBinaryQueueConfig.enableDraftBatching === true;
+            const usePerformanceDraftQueue = useConcurrentBinaryQueue || useQueueBatching;
+            if (usePerformanceDraftQueue) {
+                const sharedDraftStore = new PerformanceDraftStore(lazyDurableStore);
+                logInfo(`Serial draft queue created with batching=${useQueueBatching}, strictOrdering=true`);
+                lazyDraftQueue = buildLdsDraftQueue(lazyDurableStore, sharedDraftStore, {
+                    // No peer queues when there's no binary lane (batching-only).
+                    getPeerQueues: () => (useConcurrentBinaryQueue ? [lazyBinaryDraftQueue] : []),
+                    concurrency: 1,
+                    strictOrdering: true,
+                    queueBatching: useQueueBatching,
+                });
+                if (useConcurrentBinaryQueue) {
+                    lazyBinaryDraftQueue = buildLdsPerformanceDraftQueue(lazyDurableStore, sharedDraftStore, {
+                        getPeerQueues: () => [lazyDraftQueue],
+                        concurrency: 4,
+                        strictOrdering: false,
+                    });
+                    logInfo('Concurrent draft queue created with concurrency=4, strictOrdering=false');
+                }
+            }
+            else {
+                lazyDraftQueue = buildLdsDraftQueue(lazyDurableStore);
+            }
             lazySideEffectStore = new SideEffectStore(lazyDurableStore);
             lazySideEffectService = new SideEffectService(lazyDurableRecordStore, lazyObjectInfoService, userId, formatDisplayValue);
             const draftService = new UiApiDraftRecordService(() => lazyLuvio, lazyDurableStore, lazyObjectInfoService, newRecordId, lazySideEffectStore, lazyDurableRecordStore);
@@ -100553,13 +103675,46 @@
             uiApiRecordHandler.setSideEffectHooks(createSfsSideEffectHooks(lazyDurableRecordStore));
             const quickActionHandler = new QuickActionExecutionRepresentationHandler(() => lazyLuvio, draftService, lazyDraftQueue, lazyNetworkAdapter, isGenerated, lazySideEffectService, lazyObjectInfoService, getRecord);
             const updateRecordQuickActionHandler = new UpdateRecordQuickActionExecutionRepresentationHandler(() => lazyLuvio, draftService, lazyDraftQueue, lazyNetworkAdapter, isGenerated, lazySideEffectService);
-            const contentDocumentCompositeActionHandler = new ContentDocumentCompositeRepresentationActionHandler(() => lazyLuvio, userId, draftService, lazyObjectInfoService, lazyDraftQueue, lazyNetworkAdapter, isGenerated, NimbusBinaryStore, lazySideEffectService);
+            // Route the CD composite to the concurrent binary queue when gate-ON so
+            // multipart uploads run in parallel and don't block other DML.
+            const contentDocumentTargetQueue = useConcurrentBinaryQueue
+                ? lazyBinaryDraftQueue
+                : lazyDraftQueue;
+            logInfo(`ContentDocumentVersion handler routed to ${useConcurrentBinaryQueue ? 'concurrent draft queue' : 'serial draft queue'}`);
+            const contentDocumentCompositeActionHandler = new ContentDocumentCompositeRepresentationActionHandler(() => lazyLuvio, userId, draftService, lazyObjectInfoService, contentDocumentTargetQueue, lazyNetworkAdapter, isGenerated, NimbusBinaryStore, lazySideEffectService);
             lazyDraftQueue.addHandler(uiApiRecordHandler);
             lazyDraftQueue.addHandler(quickActionHandler);
             lazyDraftQueue.addHandler(updateRecordQuickActionHandler);
-            lazyDraftQueue.addHandler(contentDocumentCompositeActionHandler);
-            // draft manager
-            lazyDraftManager = new DraftManager(lazyDraftQueue);
+            contentDocumentTargetQueue.addHandler(contentDocumentCompositeActionHandler);
+            // Build the routing façade only with the flag on AND over concrete, handler-owning
+            // queues. Only the worker-realm queues expose isHandlerRegistered; the WebView realm's
+            // Nimbus proxies lack it. Feature-detect that method rather than sniffing the realm via
+            // `window`: it tests the exact invariant the DurableDraftQueue casts below rely on, and
+            // stays correct in non-browser (e.g. jest) realms where `window` is an unreliable realm
+            // signal. The flag must stay the first term — it short-circuits the queue accesses, and
+            // the gate-OFF path never builds lazyBinaryDraftQueue (it is undefined there).
+            const shouldBuildRoutingQueue = useConcurrentBinaryQueue &&
+                typeof lazyDraftQueue.isHandlerRegistered ===
+                    'function' &&
+                typeof lazyBinaryDraftQueue
+                    .isHandlerRegistered === 'function';
+            if (shouldBuildRoutingQueue) {
+                // Serial is the primary/fallback lane, so the bridged `draftQueue` routes enqueue
+                // by handler ownership in the worker. Lane labels are stamped onto each action
+                // by getQueueActions so the WebView can display the two queues separately.
+                lazyRoutingDraftQueue = new RoutingDraftQueue({
+                    queue: lazyDraftQueue,
+                    lane: DRAFT_QUEUE_LANE.serial,
+                }, [
+                    {
+                        queue: lazyBinaryDraftQueue,
+                        lane: DRAFT_QUEUE_LANE.concurrentBinary,
+                    },
+                ]);
+            }
+            lazyDraftManager = useConcurrentBinaryQueue
+                ? new RoutingDraftManager(lazyDraftQueue, lazyBinaryDraftQueue, DRAFT_QUEUE_LANE)
+                : new DraftManager(lazyDraftQueue);
             const objectInfoCachingEnvironment = enableObjectInfoCaching(durableEnv, lazyObjectInfoService.ensureObjectInfoCached);
             let draftEnv = makeEnvironmentUiApiRecordDraftAware(lazyLuvio, {
                 store,
@@ -100634,7 +103789,9 @@
             internalLuvio: lazyInternalLuvio,
             environment: lazyEnvironment,
             draftManager: lazyDraftManager,
-            draftQueue: lazyDraftQueue,
+            draftQueue: lazyRoutingDraftQueue ?? lazyDraftQueue,
+            serialDraftQueue: lazyDraftQueue,
+            binaryDraftQueue: lazyBinaryDraftQueue,
             createPrimingSession: (config) => {
                 return primingSessionFactory({
                     store: lazyDurableStore,
@@ -100660,7 +103817,7 @@
         id: '@salesforce/lds-network-adapter',
         instrument: instrument$2,
     });
-    // version: 1.466.0-b7b08a8e3c
+    // version: 1.467.0-4f065d2a2a
 
     const { create: create$2, keys: keys$2 } = Object;
     const { stringify, parse } = JSON;
@@ -108210,7 +111367,7 @@
             cb(graphql_v1_import, graphql_imperative$1, graphql_imperative_legacy_v1_import, graphql_state_manager);
         }
     }
-    // version: 1.466.0-ba624febc8
+    // version: 1.467.0-049a8b6027
 
     function createFragmentMap(documentNode) {
         const fragments = {};
@@ -137439,7 +140596,7 @@
         configuration: { ...configurationForGraphQLAdapters$1 },
         instrument: instrument$1,
     });
-    // version: 1.466.0-ba624febc8
+    // version: 1.467.0-049a8b6027
 
     // On core the unstable adapters are re-exported with different names,
     // we want to match them here.
@@ -137591,7 +140748,7 @@
         unstable_graphQL_imperative = createImperativeAdapter(luvio, createInstrumentedAdapter(ldsAdapter, adapterMetadata), adapterMetadata);
         graphQLImperative = ldsAdapter;
     });
-    // version: 1.466.0-ba624febc8
+    // version: 1.467.0-049a8b6027
 
     var gqlApi = /*#__PURE__*/Object.freeze({
         __proto__: null,
@@ -138443,7 +141600,7 @@
     function register(r) {
         callbacks$1.forEach((callback) => callback(r));
     }
-    // version: 1.466.0-b7b08a8e3c
+    // version: 1.467.0-4f065d2a2a
 
     /**
      * Copyright (c) 2022, Salesforce, Inc.,
@@ -139754,4 +142911,4 @@
     exports.subscribeToAdapter = subscribeToAdapter;
 
 }));
-// version: 1.466.0-b7b08a8e3c
+// version: 1.467.0-4f065d2a2a