@sekiban/dcb-runtime 0.2.0 → 0.2.1

package/dist/index.js

@@ -942,15 +942,15 @@ function encodeOrderOrdinal(value) {
 function decodeOrderOrdinal(value) {
   try {
     return assertSortableUniqueId(value).ticks;
-  } catch (error10) {
-    const detail = error10 instanceof Error ? error10.message : "invalid SortableUniqueId";
-    throw new OrderClockReadError(detail, { cause: error10 });
+  } catch (error11) {
+    const detail = error11 instanceof Error ? error11.message : "invalid SortableUniqueId";
+    throw new OrderClockReadError(detail, { cause: error11 });
   }
 }
-function asOrderClockError(error10) {
-  if (error10 instanceof OrderClockReadError) return error10;
-  const detail = error10 instanceof Error ? error10.message : "SortableUniqueId allocation failed";
-  return new OrderClockReadError(detail, { cause: error10 });
+function asOrderClockError(error11) {
+  if (error11 instanceof OrderClockReadError) return error11;
+  const detail = error11 instanceof Error ? error11.message : "SortableUniqueId allocation failed";
+  return new OrderClockReadError(detail, { cause: error11 });
 }
 function allocateOrderRange(watermark, count, clockTick, options = {}) {
   if (!Number.isSafeInteger(count) || count <= 0) {
@@ -979,9 +979,9 @@ function allocateOrderRange(watermark, count, clockTick, options = {}) {
       watermark: suids.at(-1),
       suids: Object.freeze(suids)
     });
-  } catch (error10) {
-    if (error10 instanceof SortableUniqueIdError) throw error10;
-    throw asOrderClockError(error10);
+  } catch (error11) {
+    if (error11 instanceof SortableUniqueIdError) throw error11;
+    throw asOrderClockError(error11);
   }
 }
 function diagnosticAllocatedAt(ticks) {
@@ -999,7 +999,7 @@ function diagnosticAllocatedAt(ticks) {
 var commit_trace_manifest_default = {
   schemaVersion: 2,
   name: "commit-trace-manifest",
-  description: "Authority for the sdt.commit span manifests. means/19 links to RENDERED-VIEWS.md; it does not duplicate these tables.",
+  description: "Repository-owned authority for the sdt.commit span manifests. The generated views are kept in RENDERED-VIEWS.md; the manifest does not duplicate those tables.",
   remoteInvocationUniverse: [
     "S16"
   ],
@@ -3412,9 +3412,9 @@ var commit_trace_manifest_default = {
 
 // src/trace/AttributionRatio.ts
 function failure(code, message) {
-  const error10 = new Error(`${code}:${message}`);
-  error10.name = "CommitTraceAttributionError";
-  throw error10;
+  const error11 = new Error(`${code}:${message}`);
+  error11.name = "CommitTraceAttributionError";
+  throw error11;
 }
 function clip(interval, root) {
   const start = Math.max(interval[0], root[0]);
@@ -3731,8 +3731,8 @@ var CommitTrace = class {
         unattributed,
         attributionGatePassed: unattributed.unattributedRatio <= 0.05
       });
-    } catch (error10) {
-      this.noteObservationFailure(error10);
+    } catch (error11) {
+      this.noteObservationFailure(error11);
       return Object.freeze({
         ...base,
         runtimeVerification: this.observationVerification()
@@ -3799,9 +3799,9 @@ var CommitTrace = class {
         throw new Error(`Commit trace root ${rowId} is not active`);
       }
       attributes = this.attributesFor(row, options);
-    } catch (error10) {
-      if (!this.isFailOpen()) throw error10;
-      this.noteObservationFailure(error10);
+    } catch (error11) {
+      if (!this.isFailOpen()) throw error11;
+      this.noteObservationFailure(error11);
       return callback(disabledChild());
     }
     const execute = async (native2) => {
@@ -3927,8 +3927,8 @@ var CommitTrace = class {
     for (const [key, value] of Object.entries(attributes)) {
       try {
         native.setAttribute(key, value);
-      } catch (error10) {
-        this.noteObservationFailure(error10);
+      } catch (error11) {
+        this.noteObservationFailure(error11);
       }
     }
   }
@@ -3945,8 +3945,8 @@ var CommitTrace = class {
   now() {
     try {
       return this.clock().now();
-    } catch (error10) {
-      this.noteObservationFailure(error10);
+    } catch (error11) {
+      this.noteObservationFailure(error11);
       return Date.now();
     }
   }
@@ -3954,8 +3954,8 @@ var CommitTrace = class {
     let beforeVerification;
     try {
       beforeVerification = this.snapshot();
-    } catch (error10) {
-      this.noteObservationFailure(error10);
+    } catch (error11) {
+      this.noteObservationFailure(error11);
       return;
     }
     if (this.options.runtimeVerifier !== void 0) {
@@ -3966,15 +3966,15 @@ var CommitTrace = class {
           this.options.runtimeVerifier.verify(beforeVerification);
           this.runtimeVerification = Object.freeze({ passed: true });
         }
-      } catch (error10) {
-        const code = typeof error10 === "object" && error10 !== null && "code" in error10 && typeof error10.code === "string" ? error10.code : "runtime-verifier-error";
+      } catch (error11) {
+        const code = typeof error11 === "object" && error11 !== null && "code" in error11 && typeof error11.code === "string" ? error11.code : "runtime-verifier-error";
         this.runtimeVerification = Object.freeze({ passed: false, code });
       }
     }
     try {
       this.options.sink?.record(this.snapshot());
-    } catch (error10) {
-      this.noteObservationFailure(error10);
+    } catch (error11) {
+      this.noteObservationFailure(error11);
     }
   }
   /**
@@ -3986,8 +3986,8 @@ var CommitTrace = class {
   async scheduleDetachedObservation() {
     try {
       await this.options.scheduleDetachedObservation?.();
-    } catch (error10) {
-      this.noteObservationFailure(error10);
+    } catch (error11) {
+      this.noteObservationFailure(error11);
     }
   }
   isFailOpen() {
@@ -3996,9 +3996,9 @@ var CommitTrace = class {
   observationVerification() {
     return Object.freeze({ passed: false, code: this.observationFailureCode ?? "trace-observation-error" });
   }
-  noteObservationFailure(error10) {
+  noteObservationFailure(error11) {
     if (this.observationFailureCode !== void 0) return;
-    this.observationFailureCode = typeof error10 === "object" && error10 !== null && "code" in error10 && typeof error10.code === "string" ? error10.code : "trace-observation-error";
+    this.observationFailureCode = typeof error11 === "object" && error11 !== null && "code" in error11 && typeof error11.code === "string" ? error11.code : "trace-observation-error";
     this.runtimeVerification = this.observationVerification();
   }
   /**
@@ -4019,9 +4019,9 @@ var CommitTrace = class {
         return callback(void 0);
       }
       return await result2;
-    } catch (error10) {
-      if (callbackStarted) throw error10;
-      this.noteObservationFailure(error10);
+    } catch (error11) {
+      if (callbackStarted) throw error11;
+      this.noteObservationFailure(error11);
       return callback(void 0);
     }
   }
@@ -4119,8 +4119,8 @@ async function enterNativeSpanFailOpen(nativeTracing, name, callback) {
     const result2 = nativeTracing.enterSpan(name, wrapped);
     if (!callbackStarted) return callback(void 0);
     return await result2;
-  } catch (error10) {
-    if (callbackStarted) throw error10;
+  } catch (error11) {
+    if (callbackStarted) throw error11;
     return callback(void 0);
   }
 }
@@ -4152,9 +4152,9 @@ async function enterNativeCommitSpan(nativeTracing, name, input, callback) {
         if (response3 !== void 0 && input.face !== "reconcile-root") setNativeAttribute(span, "http.status", response3.status);
       }
       return result2;
-    } catch (error10) {
+    } catch (error11) {
       setNativeAttribute(span, "outcome", "exception");
-      throw error10;
+      throw error11;
     }
   });
 }
@@ -4193,9 +4193,9 @@ async function enterNativeActorHandleSpan(nativeTracing, input, resolveIdentity,
         if (response3 !== void 0) setNativeAttribute(span, "http.status", response3.status);
       }
       return result2;
-    } catch (error10) {
+    } catch (error11) {
       if (identity2 !== void 0) setNativeAttribute(span, "outcome", "exception");
-      throw error10;
+      throw error11;
     } finally {
       input.observation?.finish();
     }
@@ -4260,9 +4260,9 @@ async function enterNativeReconcileRootSpan(nativeTracing, resolveIdentity, call
       const result2 = await callback(identity2, facts);
       finish("success");
       return result2;
-    } catch (error10) {
+    } catch (error11) {
       finish("exception");
-      throw error10;
+      throw error11;
     }
   });
 }
@@ -4373,6 +4373,8 @@ var ATTEMPT_KEY_PREFIX2 = "attempt:";
 var ROLLBACK_WARNING_WINDOW_MS = 1000n;
 var AllocationTransactionFault = class extends Error {
 };
+var ImportSeedRequiredError = class extends Error {
+};
 function json(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
@@ -4412,7 +4414,17 @@ function seedFrom(value) {
   } catch {
     return { error: "highWatermark must be an allocator SUID" };
   }
-  return { value: { importId: value.importId, leaseEpoch: value.leaseEpoch, highWatermark: value.highWatermark } };
+  let storeMaximum;
+  if (value.storeMaximum !== void 0) {
+    if (!isNonEmptyString2(value.storeMaximum)) return { error: "storeMaximum must be an allocator SUID" };
+    try {
+      decodeSuid(value.storeMaximum);
+    } catch {
+      return { error: "storeMaximum must be an allocator SUID" };
+    }
+    storeMaximum = value.storeMaximum;
+  }
+  return { value: { importId: value.importId, leaseEpoch: value.leaseEpoch, highWatermark: value.highWatermark, ...storeMaximum !== void 0 ? { storeMaximum } : {} } };
 }
 function newAllocatorLineageId() {
   return crypto.randomUUID();
@@ -4467,7 +4479,8 @@ function allocateFrom(value) {
       faultInjection,
       ...serviceId !== void 0 ? { serviceId } : {},
       ...bootstrapCommandId !== void 0 ? { bootstrapCommandId } : {},
-      ...bootstrapEpoch !== void 0 ? { bootstrapEpoch } : {}
+      ...bootstrapEpoch !== void 0 ? { bootstrapEpoch } : {},
+      ...value.requiresImportSeed === true ? { requiresImportSeed: true } : {}
     }
   };
 }
@@ -4852,11 +4865,12 @@ var AllocatorDurableObject = class {
           };
         }
         const state = persistedState === void 0 ? currentState(lineage) : { ...persistedState, allocatorLineageId: lineage, schemaVersion: 5, bootstrapSeed: persistedState.bootstrapSeed ?? null, lastRollbackWarningFingerprint: persistedState.lastRollbackWarningFingerprint ?? null };
+        if (input.requiresImportSeed === true && state.bootstrapSeed === null) throw new ImportSeedRequiredError();
         let clockTick;
         try {
           clockTick = this.orderClock.tick();
-        } catch (error10) {
-          throw error10 instanceof OrderClockReadError ? error10 : new OrderClockReadError("Order clock failed before allocation write", { cause: error10 });
+        } catch (error11) {
+          throw error11 instanceof OrderClockReadError ? error11 : new OrderClockReadError("Order clock failed before allocation write", { cause: error11 });
         }
         const range = allocateOrderRange(state.allocatedWatermark, input.candidates.length, clockTick);
         const rollback = range.observedTicks !== null && range.physicalTicks < range.observedTicks;
@@ -4930,6 +4944,9 @@ var AllocatorDurableObject = class {
       }
       return json(result2.vector, result2.created ? 201 : 200);
     } catch (failure3) {
+      if (failure3 instanceof ImportSeedRequiredError) {
+        return error(409, "allocator_seed_required", "commit before import seed");
+      }
       if (failure3 instanceof AllocationTransactionFault) {
         return error(
           503,
@@ -4970,7 +4987,10 @@ var AllocatorDurableObject = class {
         return { status: 409, body: { code: "allocator_seed_rejected", error: "allocator already seeded" } };
       }
       if (state.allocatedWatermark !== null) return { status: 409, body: { code: "allocator_seed_rejected", error: "allocator already allocating" } };
-      const updated = { ...state, allocatedWatermark: input.highWatermark, bootstrapSeed: input };
+      if (input.storeMaximum !== void 0 && input.highWatermark < input.storeMaximum) {
+        return { status: 409, body: { code: "allocator_seed_below_store_max", error: "seed below store maximum" } };
+      }
+      const updated = { ...state, allocatedWatermark: input.highWatermark, bootstrapSeed: { importId: input.importId, leaseEpoch: input.leaseEpoch, highWatermark: input.highWatermark } };
       await txn.put(STATE_KEY, updated);
       return { status: 201, body: updated };
     });
@@ -4995,7 +5015,7 @@ var isPlainRecord = (value) => {
   return prototype === Object.prototype || prototype === null;
 };
 function assertJsonValue(value, boundary = "value") {
-  const active = /* @__PURE__ */ new WeakSet();
+  const active2 = /* @__PURE__ */ new WeakSet();
   const visit = (candidate, path) => {
     if (candidate === null || typeof candidate === "string" || typeof candidate === "boolean") {
       return candidate;
@@ -5007,10 +5027,10 @@ function assertJsonValue(value, boundary = "value") {
     if (typeof candidate !== "object") {
       throw new JsonValidationError(`Value at ${path} is not JSON serializable`, boundary, path);
     }
-    if (active.has(candidate)) {
+    if (active2.has(candidate)) {
       throw new JsonValidationError(`Cyclic JSON value at ${path}`, boundary, path);
     }
-    active.add(candidate);
+    active2.add(candidate);
     try {
       if (Array.isArray(candidate)) {
         return candidate.map((item, index) => visit(item, `${path}[${index}]`));
@@ -5024,7 +5044,7 @@ function assertJsonValue(value, boundary = "value") {
       }
       return result2;
     } finally {
-      active.delete(candidate);
+      active2.delete(candidate);
     }
   };
   return visit(value, "$");
@@ -5119,16 +5139,16 @@ function createUuidV7(nowMs = Date.now()) {
   if (typeof globalThis.crypto?.getRandomValues !== "function") {
     throw new Error("crypto.getRandomValues is required for UUIDv7");
   }
-  const bytes = new Uint8Array(16);
-  globalThis.crypto.getRandomValues(bytes);
+  const bytes2 = new Uint8Array(16);
+  globalThis.crypto.getRandomValues(bytes2);
   let time = BigInt(nowMs);
   for (let index = 5; index >= 0; index -= 1) {
-    bytes[index] = Number(time & 0xffn);
+    bytes2[index] = Number(time & 0xffn);
     time >>= 8n;
   }
-  bytes[6] = bytes[6] & 15 | 112;
-  bytes[8] = bytes[8] & 63 | 128;
-  const hex = [...bytes].map((value) => value.toString(16).padStart(2, "0")).join("");
+  bytes2[6] = bytes2[6] & 15 | 112;
+  bytes2[8] = bytes2[8] & 63 | 128;
+  const hex = [...bytes2].map((value) => value.toString(16).padStart(2, "0")).join("");
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
 function isRfc4122Uuid(value) {
@@ -5244,7 +5264,7 @@ var epoch = (value) => typeof value === "number" && Number.isSafeInteger(value)
 var response = (body, status = 200) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json; charset=utf-8" } });
 var reject = (code, message, status = 409) => response({ code, error: message }, status);
 function empty(serviceId) {
-  return { schemaVersion: 1, status: "EMPTY", importId: null, targetServiceId: serviceId, allocatorLineageId: null, source: null, digest: null, manifest: null, progress: {}, leaseEpoch: 0, leaseUntil: null, failure: null, readyAt: null, normalInFlight: 0, normalCommands: {}, releasedCommands: {}, verifiedImportId: null, verifiedLeaseEpoch: null, storeCompletion: null };
+  return { schemaVersion: 1, status: "EMPTY", importId: null, targetServiceId: serviceId, allocatorLineageId: null, source: null, digest: null, manifest: null, progress: {}, leaseEpoch: 0, leaseUntil: null, failure: null, readyAt: null, normalInFlight: 0, normalCommands: {}, releasedCommands: {}, writePermits: {}, verifiedImportId: null, verifiedLeaseEpoch: null, storeCompletion: null };
 }
 function expired(control) {
   return control.leaseUntil !== null && control.leaseUntil <= Date.now();
@@ -5255,12 +5275,22 @@ function commands(control) {
 function released(control) {
   return { ...control.releasedCommands ?? {} };
 }
+function permits(control) {
+  return { ...control.writePermits ?? {} };
+}
 function fault(body, point) {
   return object(body) && body.faultAt === point;
 }
 function encodedBytes(value) {
   return new TextEncoder().encode(JSON.stringify(value)).byteLength;
 }
+async function readBody(request) {
+  try {
+    return await request.json();
+  } catch {
+    return void 0;
+  }
+}
 var BootstrapCoordinatorDurableObject = class {
   constructor(ctx, env, nativeTracing = noOpNativeTracing) {
     this.ctx = ctx;
@@ -5282,6 +5312,8 @@ var BootstrapCoordinatorDurableObject = class {
     if (request.method === "POST" && url.pathname === "/command/admit") return this.traceCommand(request, serviceId, activation, observation, "admit");
     if (request.method === "POST" && url.pathname === "/command/finalize") return this.traceCommand(request, serviceId, activation, observation, "finalize");
     if (request.method === "POST" && url.pathname === "/command/release") return this.traceCommand(request, serviceId, activation, observation, "release");
+    if (request.method === "POST" && url.pathname === "/command/permit") return this.permit(serviceId, await readBody(request));
+    if (request.method === "POST" && url.pathname === "/command/permit-release") return this.permitRelease(serviceId, await readBody(request));
     let body;
     try {
       body = await request.json();
@@ -5338,6 +5370,7 @@ var BootstrapCoordinatorDurableObject = class {
       const control = await txn.get(CONTROL) ?? empty(serviceId);
       if (control.status === "READY") return { error: "bootstrap_ready_permanent" };
       if (control.status !== "EMPTY") return control.importId === importId && control.digest === dump.manifest.contentDigest ? { control } : { error: "bootstrap_plan_conflict" };
+      if (Object.keys(permits(control)).length !== 0) return { error: "bootstrap_write_permit_active" };
       if (control.normalInFlight !== 0 || Object.keys(commands(control)).length !== 0) return { error: "bootstrap_normal_command_in_flight" };
       const next = { ...control, status: "PLANNED", importId, allocatorLineageId: dump.manifest.target.allocatorLineageId, source: dump.manifest.source, digest: dump.manifest.contentDigest, manifest: dump.manifest, leaseEpoch: control.leaseEpoch + 1, leaseUntil: Date.now() + 3e4, failure: null, progress: {}, verifiedImportId: null, verifiedLeaseEpoch: null, storeCompletion: null };
       await txn.put(CONTROL, next);
@@ -5350,17 +5383,17 @@ var BootstrapCoordinatorDurableObject = class {
   chunks(events) {
     const chunks = [];
     let current = [];
-    let bytes = 0;
+    let bytes2 = 0;
     for (const event of events) {
       const eventBytes = encodedBytes(event);
       if (eventBytes > MAX_CHUNK_BYTES) throw new Error("bootstrap event exceeds encoded chunk bound");
-      if (current.length === MAX_CHUNK_EVENTS || bytes + eventBytes > MAX_CHUNK_BYTES) {
+      if (current.length === MAX_CHUNK_EVENTS || bytes2 + eventBytes > MAX_CHUNK_BYTES) {
         chunks.push(current);
         current = [];
-        bytes = 0;
+        bytes2 = 0;
       }
       current.push(event);
-      bytes += eventBytes;
+      bytes2 += eventBytes;
     }
     if (current.length > 0) chunks.push(current);
     return chunks;
@@ -5506,6 +5539,45 @@ var BootstrapCoordinatorDurableObject = class {
     const control = await this.control(serviceId);
     return control.status === "EMPTY" || control.status === "READY" ? response({ admitted: true, leaseEpoch: control.leaseEpoch, route: body.route }) : reject("bootstrap_route_rejected", `${body.route} is unavailable during bootstrap`);
   }
+  async permit(serviceId, body) {
+    if (!object(body) || !string(body.commandId) || !string(body.digest)) return reject("bootstrap_permit_invalid", "commandId and digest are required", 400);
+    const commandId = body.commandId;
+    const digest2 = body.digest;
+    const result2 = await this.ctx.storage.transaction(async (txn) => {
+      const control = await txn.get(CONTROL) ?? empty(serviceId);
+      const active2 = permits(control);
+      if (active2[commandId] !== void 0) {
+        return active2[commandId] === digest2 ? { control } : { digestMismatch: true };
+      }
+      if (control.status !== "EMPTY" && control.status !== "READY") return { rejected: true };
+      const updated = { ...control, writePermits: { ...active2, [commandId]: digest2 } };
+      await txn.put(CONTROL, updated);
+      return { control: updated };
+    });
+    if ("digestMismatch" in result2) return reject("bootstrap_permit_digest_mismatch", "bootstrap permit digest does not match the held permit");
+    if ("rejected" in result2) return reject("bootstrap_command_rejected", "bootstrap epoch rejects normal durable mutation");
+    return response({ leaseEpoch: result2.control.leaseEpoch, admitted: true });
+  }
+  async permitRelease(serviceId, body) {
+    if (!object(body) || !string(body.commandId)) return reject("bootstrap_permit_invalid", "commandId is required", 400);
+    const commandId = body.commandId;
+    const digest2 = string(body.digest) ? body.digest : void 0;
+    const result2 = await this.ctx.storage.transaction(async (txn) => {
+      const control = await txn.get(CONTROL) ?? empty(serviceId);
+      const active2 = permits(control);
+      if (active2[commandId] !== void 0 && digest2 !== void 0 && active2[commandId] !== digest2) {
+        return { digestMismatch: true };
+      }
+      if (active2[commandId] === void 0) return { control };
+      const next = { ...active2 };
+      delete next[commandId];
+      const updated = { ...control, writePermits: next };
+      await txn.put(CONTROL, updated);
+      return { control: updated };
+    });
+    if ("digestMismatch" in result2) return reject("bootstrap_permit_digest_mismatch", "bootstrap permit digest does not match the held permit");
+    return response({ leaseEpoch: result2.control.leaseEpoch, admitted: true });
+  }
   async command(serviceId, body, action, observation) {
     if (!object(body) || !string(body.commandId)) return reject("bootstrap_command_invalid", "commandId is required", 400);
     const commandId = body.commandId;
@@ -5571,13 +5643,13 @@ function byteCompare(left, right) {
 }
 function concat(parts) {
   const length = parts.reduce((total, part) => total + part.byteLength, 0);
-  const bytes = new Uint8Array(length);
+  const bytes2 = new Uint8Array(length);
   let offset = 0;
   for (const part of parts) {
-    bytes.set(part, offset);
+    bytes2.set(part, offset);
     offset += part.byteLength;
   }
-  return bytes;
+  return bytes2;
 }
 function lengthPrefix(length) {
   if (!Number.isSafeInteger(length) || length < 0 || length > 4294967295) {
@@ -5606,8 +5678,8 @@ function requiredUtf8(input, name) {
 function tagSetBytes(tags) {
   const canonical2 = canonicalDeclaredTagSet(tags);
   return concat(canonical2.map((tag) => {
-    const bytes = utf8(tag);
-    return concat([lengthPrefix(bytes.byteLength), bytes]);
+    const bytes2 = utf8(tag);
+    return concat([lengthPrefix(bytes2.byteLength), bytes2]);
   }));
 }
 function canonicalDeclaredTagSet(tags) {
@@ -5677,16 +5749,16 @@ function eventDigestBytes(input) {
   ]);
 }
 async function eventDigestHex(input) {
-  const bytes = eventDigestBytes(input);
-  const source = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
-  const digest = await crypto.subtle.digest("SHA-256", source);
-  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  const bytes2 = eventDigestBytes(input);
+  const source = bytes2.buffer.slice(bytes2.byteOffset, bytes2.byteOffset + bytes2.byteLength);
+  const digest2 = await crypto.subtle.digest("SHA-256", source);
+  return [...new Uint8Array(digest2)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 
 // src/bootstrap/BootstrapStoreAdapter.ts
-function arrayBufferBase64(bytes) {
+function arrayBufferBase64(bytes2) {
   let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
+  for (const byte of bytes2) binary += String.fromCharCode(byte);
   return btoa(binary);
 }
 var BootstrapIdentityConflictError = class extends Error {
@@ -6797,6 +6869,22 @@ var COMMIT_TEST_FAULTS = [
 var INITIAL_OWNER_EPOCH = 0;
 var MAX_WRITE_ATTEMPTS = 2;
 var OUTCOME_UNDETERMINED_ERROR = "Commit outcome is undetermined; reread tag heads and event/query state before retrying because blind retry may create duplicate events.";
+function commitPermitDigest(allTags, candidates) {
+  const normalized = JSON.stringify({
+    tags: [...allTags].sort(),
+    events: candidates.map((candidate) => ({
+      eventId: candidate.eventId,
+      payload: candidate.payload,
+      tags: [...candidate.tags].sort()
+    })).sort((left, right) => left.eventId < right.eventId ? -1 : left.eventId > right.eventId ? 1 : 0)
+  });
+  let hash = 2166136261;
+  for (let index = 0; index < normalized.length; index += 1) {
+    hash ^= normalized.charCodeAt(index);
+    hash = Math.imul(hash, 16777619) >>> 0;
+  }
+  return `fnv1a32:${hash.toString(16).padStart(8, "0")}`;
+}
 var GLOBAL_ADMISSION_HEADER = "x-sdt-global-admission";
 var runtimeCommitTraceVerifier = {
   verify(snapshot) {
@@ -6850,19 +6938,19 @@ var CommitPayloadAdmissionError = class extends Error {
   code;
 };
 function decodeBase64Utf8Json(value) {
-  let bytes;
+  let bytes2;
   try {
     const binary = atob(value);
-    bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+    bytes2 = Uint8Array.from(binary, (character) => character.charCodeAt(0));
   } catch {
     throw new CommitPayloadAdmissionError("invalid_payload_utf8", "Payload base64 could not be decoded");
   }
-  if (bytes[0] === 239 && bytes[1] === 187 && bytes[2] === 191) {
+  if (bytes2[0] === 239 && bytes2[1] === 187 && bytes2[2] === 191) {
     throw new CommitPayloadAdmissionError("invalid_payload_utf8", "Payload must not start with a UTF-8 BOM");
   }
   let text;
   try {
-    text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    text = new TextDecoder("utf-8", { fatal: true }).decode(bytes2);
   } catch {
     throw new CommitPayloadAdmissionError("invalid_payload_utf8", "Payload must be valid UTF-8 JSON text");
   }
@@ -6908,9 +6996,9 @@ function assertExactMemberPaths(actual, registered, path = "$") {
   }
 }
 function encodeBase64Utf8(value) {
-  const bytes = new TextEncoder().encode(value);
+  const bytes2 = new TextEncoder().encode(value);
   let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
+  for (const byte of bytes2) binary += String.fromCharCode(byte);
   return btoa(binary);
 }
 function faultFromRequest(request) {
@@ -7169,25 +7257,43 @@ var CommitWorker = class {
       return responseWithAttempt(error3(409, "bootstrap_command_rejected", "Bootstrap admission could not be released"), attemptId, fault2 !== void 0);
     }
     await this.retiredJournalMilestone("S04", traceState?.scope);
+    const permitDigest = commitPermitDigest(input.allTags, candidates);
+    let permitHeld = false;
+    const releasePermit = async () => {
+      if (!permitHeld) return;
+      permitHeld = false;
+      await this.bootstrapPermitRelease(attemptId, permitDigest);
+    };
+    const permit = await this.bootstrapPermitAcquire(attemptId, permitDigest);
+    if (!permit.ok) {
+      if (permit.code === "bootstrap_permit_digest_mismatch") {
+        return responseWithAttempt(error3(409, "bootstrap_permit_digest_mismatch", "Bootstrap write permit digest does not match"), attemptId, fault2 !== void 0);
+      }
+      return responseWithAttempt(error3(409, "bootstrap_command_rejected", "Bootstrap is importing; commit is unavailable"), attemptId, fault2 !== void 0);
+    }
+    permitHeld = this.env.BOOTSTRAP !== void 0;
     const reservations = await this.acquireReservations(input, attemptId, fault2, traceState?.scope);
     await this.retiredJournalMilestone("S05a", traceState?.scope, 0);
     if (reservations.failure !== void 0) {
-      return this.finishReservationFailure(
+      const failure3 = await this.finishReservationFailure(
         [...reservations.successes.keys()],
         attemptId,
         reservations.failure,
         fault2,
         traceState?.scope
       );
+      if (failure3.resolved) await releasePermit();
+      return failure3.response;
     }
     if (fault2 === "after-reservations-before-allocation") {
-      await this.cancelReservations([...reservations.successes.keys()], attemptId, fault2, traceState?.scope);
+      const cleanup = await this.cancelReservations([...reservations.successes.keys()], attemptId, fault2, traceState?.scope);
+      if (cleanup.failedTags.length === 0) await releasePermit();
       return this.noApplicationOutcome(attemptId, true);
     }
     await this.hooks.beforeBootstrapAllocation?.();
     const allocation = await this.allocate(candidates, attemptId, fault2, bootstrapEpoch, traceState?.scope);
     if (allocation === void 0) {
-      return this.finishReservationFailure(
+      const failure3 = await this.finishReservationFailure(
         [...reservations.successes.keys()],
         attemptId,
         {
@@ -7198,10 +7304,13 @@ var CommitWorker = class {
         fault2,
         traceState?.scope
       );
+      if (failure3.resolved) await releasePermit();
+      return failure3.response;
     }
     const allocatedCandidates = this.withAllocatedSuids(candidates, allocation);
     if (allocatedCandidates === void 0) {
-      await this.cancelReservations([...reservations.successes.keys()], attemptId, fault2, traceState?.scope);
+      const cleanup = await this.cancelReservations([...reservations.successes.keys()], attemptId, fault2, traceState?.scope);
+      if (cleanup.failedTags.length === 0) await releasePermit();
       return this.noApplicationOutcome(attemptId, fault2 !== void 0);
     }
     for (const candidate of allocatedCandidates) {
@@ -7216,15 +7325,18 @@ var CommitWorker = class {
     }
     await this.retiredJournalMilestone("S05b", traceState?.scope, 1);
     if (fault2 === "journal-cas-after-allocator") {
-      await this.cancelReservations(input.allTags, attemptId, fault2, traceState?.scope);
+      const cleanup = await this.cancelReservations(input.allTags, attemptId, fault2, traceState?.scope);
+      if (cleanup.failedTags.length === 0) await releasePermit();
       return this.noApplicationOutcome(attemptId, true);
     }
     await this.retiredJournalMilestone("S05c", traceState?.scope, 2);
     await this.hooks.beforeBootstrapFinalization?.();
     if (await this.bootstrapCommand("finalize", attemptId, bootstrapEpoch, traceState?.scope, "S10") === void 0) {
-      await this.cancelReservations(input.allTags, attemptId, fault2, traceState?.scope);
+      const cleanup = await this.cancelReservations(input.allTags, attemptId, fault2, traceState?.scope);
+      if (cleanup.failedTags.length === 0) await releasePermit();
       return responseWithAttempt(error3(409, "bootstrap_command_rejected", "Bootstrap fencing epoch changed before commit write"), attemptId, fault2 !== void 0);
     }
+    await this.hooks.beforeAuthoritativeAppend?.();
     const writes = await this.appendAllTags(
       input,
       allocatedCandidates,
@@ -7240,6 +7352,7 @@ var CommitWorker = class {
         return this.noApplicationOutcome(attemptId, true);
       }
       if (writes.committedTags.size === 0 && writes.registrationUnavailableTags.length === writes.pendingTags.length) {
+        await releasePermit();
         return responseWithAttempt(
           error3(
             503,
@@ -7251,20 +7364,25 @@ var CommitWorker = class {
           fault2 !== void 0
         );
       }
+      await releasePermit();
       return this.partialWriteOutcome(input, allocatedCandidates, writes, attemptId, fault2 !== void 0);
     }
+    await this.hooks.afterAppendBeforeResponse?.();
     await this.retiredJournalMilestone("S05d", traceState?.scope, 3);
     if (fault2 === "sealing-after-cas") {
+      await releasePermit();
       return this.noApplicationOutcome(attemptId, true);
     }
     try {
-      const success = await this.successResponse(input, allocatedCandidates, attemptId, startedAt, fault2, traceState?.scope);
+      const success = await this.successResponse(input, allocatedCandidates, attemptId, startedAt, fault2, traceState?.scope, writes);
+      await releasePermit();
       return responseWithAttempt(
         withGlobalAdmission(json4(success, 200), writes.globalAdmission),
         attemptId,
         fault2 !== void 0
       );
     } catch {
+      await releasePermit();
       return responseWithAttempt(
         error3(500, "internal_error", "Committed records could not be read while preparing the response"),
         attemptId,
@@ -7311,6 +7429,51 @@ var CommitWorker = class {
     const result2 = traceScope === void 0 || rowId === void 0 ? await invoke() : await traceScope.span(rowId, {}, invoke);
     return result2.leaseEpoch;
   }
+  /**
+   * SDT-G36 bootstrap write permit. Deliberately untraced: it must not add
+   * `sdt.commit/v2` rows or new trace identities. Only a bootstrap barrier,
+   * never commit-outcome authority. No JOURNAL, no alarm, no lease expiry.
+   */
+  bootstrapStub() {
+    if (this.env.BOOTSTRAP === void 0) return void 0;
+    return this.env.BOOTSTRAP.get(scopeIdFor(this.env.BOOTSTRAP, {
+      serviceId: this.serviceId,
+      doClass: "bootstrap",
+      identity: "coordinator"
+    }));
+  }
+  async bootstrapPermitAcquire(commandId, digest2) {
+    const stub = this.bootstrapStub();
+    if (stub === void 0) return { ok: true };
+    try {
+      const url = new URL(`https://commit-worker.internal/command/permit`);
+      url.searchParams.set("__serviceId", this.serviceId);
+      const response3 = await stub.fetch(new Request(url, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ commandId, digest: digest2 })
+      }));
+      if (response3.ok) return { ok: true };
+      const body = await response3.clone().json().catch(() => void 0);
+      return { ok: false, code: typeof body?.code === "string" ? body.code : void 0 };
+    } catch {
+      return { ok: false };
+    }
+  }
+  async bootstrapPermitRelease(commandId, digest2) {
+    const stub = this.bootstrapStub();
+    if (stub === void 0) return;
+    try {
+      const url = new URL(`https://commit-worker.internal/command/permit-release`);
+      url.searchParams.set("__serviceId", this.serviceId);
+      await stub.fetch(new Request(url, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ commandId, digest: digest2 })
+      }));
+    } catch {
+    }
+  }
   async postJson(stub, path, body, traceScope, rowId, traceOptions = {}) {
     const invoke = async () => {
       const response3 = await stub.fetch(
@@ -7456,6 +7619,7 @@ var CommitWorker = class {
     let pending = [...input.allTags];
     const committedTags = /* @__PURE__ */ new Set();
     const lastFailureCodeByTag = /* @__PURE__ */ new Map();
+    const tagWriteFacts = /* @__PURE__ */ new Map();
     let globalAdmission = "admitted";
     for (let attempt = 0; attempt < MAX_WRITE_ATTEMPTS && pending.length > 0; attempt += 1) {
       const append = (stageScope) => Promise.allSettled(
@@ -7482,12 +7646,26 @@ var CommitWorker = class {
             retryIndex: attempt,
             attemptId
           });
-          const body = response3.status === 503 ? await response3.clone().json().catch(() => void 0) : void 0;
+          const success = response3.status >= 200 && response3.status < 300;
+          let appendVersion;
+          let appendUpdatedAt;
+          let code;
+          try {
+            const parsed = await response3.clone().json();
+            if (isObject5(parsed)) {
+              if (typeof parsed.version === "number" && Number.isSafeInteger(parsed.version)) appendVersion = parsed.version;
+              if (typeof parsed.updatedAt === "string" && parsed.updatedAt.length > 0) appendUpdatedAt = parsed.updatedAt;
+              if (typeof parsed.code === "string") code = parsed.code;
+            }
+          } catch {
+          }
           return {
             tag,
-            success: response3.status >= 200 && response3.status < 300,
+            success,
             globalAdmission: readGlobalAdmission(response3),
-            code: isObject5(body) && typeof body.code === "string" ? body.code : void 0
+            code,
+            appendVersion,
+            appendUpdatedAt
           };
         })
       );
@@ -7499,6 +7677,9 @@ var CommitWorker = class {
           committedTags.add(tag);
           lastFailureCodeByTag.delete(tag);
           globalAdmission = mergeGlobalAdmission(globalAdmission, result2.value.globalAdmission);
+          if (result2.value.appendVersion !== void 0 && result2.value.appendUpdatedAt !== void 0) {
+            tagWriteFacts.set(tag, { version: result2.value.appendVersion, updatedAt: result2.value.appendUpdatedAt });
+          }
         } else {
           lastFailureCodeByTag.set(
             tag,
@@ -7515,7 +7696,8 @@ var CommitWorker = class {
       registrationUnavailableTags: pending.filter(
         (tag) => lastFailureCodeByTag.get(tag) === "partition_registration_unavailable"
       ),
-      globalAdmission
+      globalAdmission,
+      tagWriteFacts
     };
   }
   /**
@@ -7548,10 +7730,13 @@ var CommitWorker = class {
     if (traceScope !== void 0) {
       await traceScope.span("S17", {}, async () => void 0);
     }
-    await this.cancelReservations(tags, attemptId, fault2, traceScope);
+    const cleanup = await this.cancelReservations(tags, attemptId, fault2, traceScope);
     await this.retiredJournalMilestone("S05e", traceScope, 4);
     const response3 = failure3.outcome === "REFUSED" ? error3(400, "consistency_conflict", "serialized commit was refused by a consistency reservation") : failure3.failureCause === "reservation-timeout" ? error3(504, "timeout", "serialized commit timed out") : error3(500, "internal_error", "serialized commit failed before writing requested records");
-    return responseWithAttempt(response3, attemptId, fault2 !== void 0);
+    return {
+      response: responseWithAttempt(response3, attemptId, fault2 !== void 0),
+      resolved: cleanup.failedTags.length === 0
+    };
   }
   /**
    * Persist the local partial-write fact for each tag whose append did not
@@ -7588,22 +7773,25 @@ var CommitWorker = class {
       }
     }, 500), attemptId, exposeAttempt);
   }
-  async successResponse(input, candidates, attemptId, startedAt, fault2, traceScope) {
-    const readStates = (stageScope) => Promise.all(input.allTags.map(async (tag, memberIndex) => {
+  async successResponse(input, candidates, attemptId, startedAt, fault2, traceScope, writes) {
+    const assemble = async (stageScope) => {
       if (fault2 === "tag-state-unavailable") {
         throw new Error("Test fault made the committed tag state unavailable");
       }
-      const response3 = await this.tagRequest(tag, "/head-facts", void 0, stageScope?.fork(), stageScope === void 0 ? void 0 : "S14", { memberIndex, attemptId });
-      if (response3.status !== 200) {
-        throw new Error("Committed tag state was unavailable while preparing the response");
-      }
-      const body = await response3.json();
-      if (typeof body.version !== "number" || typeof body.updatedAt !== "string" || typeof body.head !== "string") {
-        throw new Error("Committed tag state was malformed while preparing the response");
+      const results = [];
+      for (const [memberIndex, tag] of input.allTags.entries()) {
+        const read = () => {
+          const fact = writes?.tagWriteFacts.get(tag);
+          if (fact === void 0) {
+            throw new Error("Committed tag state was unavailable while preparing the response");
+          }
+          return { tag, version: fact.version, writtenAt: fact.updatedAt };
+        };
+        results.push(stageScope === void 0 ? read() : await stageScope.fork().span("S14", { tag, memberIndex, attemptId }, async () => read()));
       }
-      return { tag, version: body.version, writtenAt: body.updatedAt };
-    }));
-    const tagWriteResults = traceScope === void 0 ? await readStates() : await traceScope.span("S13", {}, async (stage) => readStates(stage));
+      return results;
+    };
+    const tagWriteResults = traceScope === void 0 ? await assemble() : await traceScope.span("S13", {}, async (stage) => assemble(stage));
     return {
       writtenEvents: candidates.map((candidate) => ({
         payload: encodeBase64Utf8(candidate.payload),
@@ -7817,15 +8005,15 @@ function observePostAdmission(observer, message, source, input) {
     observedAt: Date.now()
   });
 }
-function errorText(error10) {
-  if (error10 instanceof Error && error10.message.length > 0) return error10.message;
-  return String(error10);
+function errorText(error11) {
+  if (error11 instanceof Error && error11.message.length > 0) return error11.message;
+  return String(error11);
 }
 function deliveryCorrelationId(message, source, supplied) {
   return supplied ?? `${source}:${message.serviceId}:${message.eventId}:${message.attemptId}`;
 }
-function defaultFailureClass(error10) {
-  const candidate = error10;
+function defaultFailureClass(error11) {
+  const candidate = error11;
   if (candidate.failureClass === "duplicate-race") return "duplicate-race";
   if (candidate.failureClass === "nonretryable-definition-poison") return "nonretryable-definition-poison";
   if (candidate.failureClass === "retryable-transient") return "retryable-transient";
@@ -7884,8 +8072,8 @@ async function applyViewHandlers(views, message, storedEvent, arrivedAt, source,
         result: { id: view.id, status, durationMs: Math.max(0, performance.now() - viewStartedAt) },
         failure: void 0
       };
-    } catch (error10) {
-      const failureClass = view.classifyError?.(error10) ?? defaultFailureClass(error10);
+    } catch (error11) {
+      const failureClass = view.classifyError?.(error11) ?? defaultFailureClass(error11);
       observePostAdmission(observer, message, source, {
         stage: "unsafe-view-apply",
         boundary: "end",
@@ -7897,10 +8085,10 @@ async function applyViewHandlers(views, message, storedEvent, arrivedAt, source,
           id: view.id,
           status: "failed",
           failureClass,
-          error: errorText(error10),
+          error: errorText(error11),
           durationMs: Math.max(0, performance.now() - viewStartedAt)
         },
-        failure: { phase: "view", class: failureClass, viewId: view.id, error: errorText(error10) }
+        failure: { phase: "view", class: failureClass, viewId: view.id, error: errorText(error11) }
       };
     }
   }));
@@ -7930,15 +8118,15 @@ async function processDeliveryCore(message, source, env, options = {}) {
       // settled; this is the durable post-batch observation boundary.
       observedAt: Date.now()
     });
-  } catch (error10) {
-    const failures2 = [{ phase: "recordDelivery", class: "retryable-transient", error: errorText(error10) }];
+  } catch (error11) {
+    const failures2 = [{ phase: "recordDelivery", class: "retryable-transient", error: errorText(error11) }];
     return result(source, message, "stored", arrivedAt, false, [], failures2, options.correlationId, startedAt);
   }
   if (outcome.outcome !== "stored") {
     try {
       await store.projectDeliveryIncidents?.(message.serviceId);
-    } catch (error10) {
-      const failures2 = [{ phase: "detector", class: "retryable-transient", error: errorText(error10) }];
+    } catch (error11) {
+      const failures2 = [{ phase: "detector", class: "retryable-transient", error: errorText(error11) }];
       return result(source, message, outcome.outcome, arrivedAt, false, [], failures2, options.correlationId, startedAt);
     }
     return result(source, message, outcome.outcome, arrivedAt, false, [], [], options.correlationId, startedAt);
@@ -7967,20 +8155,20 @@ async function processDeliveryCore(message, source, env, options = {}) {
         boundary: "end",
         outcome: "available"
       });
-    } catch (error10) {
+    } catch (error11) {
       observePostAdmission(options.durableHopObserver, message, source, {
         stage: "post-record-delivery-global-receipt-readback",
         boundary: "end",
         outcome: "error"
       });
-      failures.push({ phase: "recordDelivery", class: "retryable-transient", error: errorText(error10) });
+      failures.push({ phase: "recordDelivery", class: "retryable-transient", error: errorText(error11) });
       return result(source, message, "stored", arrivedAt, false, [], failures, options.correlationId, startedAt);
     }
     if (options.afterGlobalReceipt !== void 0) {
       try {
         await options.afterGlobalReceipt({ message, receipt, arrivedAt, source });
-      } catch (error10) {
-        failures.push({ phase: "drain", class: "retryable-transient", error: errorText(error10) });
+      } catch (error11) {
+        failures.push({ phase: "drain", class: "retryable-transient", error: errorText(error11) });
       }
     }
   }
@@ -7997,8 +8185,8 @@ async function processDeliveryCore(message, source, env, options = {}) {
   if (options.beforeViews !== void 0) {
     try {
       await options.beforeViews({ message, event: storedEvent, arrivedAt, source });
-    } catch (error10) {
-      failures.push({ phase: "completeness", class: "retryable-transient", error: errorText(error10) });
+    } catch (error11) {
+      failures.push({ phase: "completeness", class: "retryable-transient", error: errorText(error11) });
       return result(source, message, "stored", arrivedAt, false, viewResults, failures, options.correlationId, startedAt);
     }
   }
@@ -8018,14 +8206,14 @@ async function processDeliveryCore(message, source, env, options = {}) {
       boundary: "end",
       outcome: "applied"
     });
-  } catch (error10) {
+  } catch (error11) {
     observePostAdmission(options.durableHopObserver, message, source, {
       stage: "detector",
       boundary: "end",
       outcome: "error"
     });
     try {
-      await options.onDetectorFailure?.({ message, arrivedAt, source, error: error10 });
+      await options.onDetectorFailure?.({ message, arrivedAt, source, error: error11 });
     } catch (healthError) {
       failures.push({
         phase: "detector",
@@ -8033,7 +8221,7 @@ async function processDeliveryCore(message, source, env, options = {}) {
         error: `detector_health_record_failed:${errorText(healthError)}`
       });
     }
-    failures.push({ phase: "detector", class: "retryable-transient", error: errorText(error10) });
+    failures.push({ phase: "detector", class: "retryable-transient", error: errorText(error11) });
     return result(source, message, "stored", arrivedAt, false, [], failures, options.correlationId, startedAt);
   }
   const views = gatedViews;
@@ -8050,16 +8238,16 @@ async function processDeliveryCore(message, source, env, options = {}) {
   if (options.onStored !== void 0) {
     try {
       await options.onStored({ message, event: storedEvent, arrivedAt, source });
-    } catch (error10) {
-      failures.push({ phase: "view", class: "retryable-transient", viewId: "legacy-onStored", error: errorText(error10) });
+    } catch (error11) {
+      failures.push({ phase: "view", class: "retryable-transient", viewId: "legacy-onStored", error: errorText(error11) });
     }
   }
   const preliminary = result(source, message, "stored", arrivedAt, detectorApplied, viewResults, failures, options.correlationId, startedAt);
   if (options.afterDelivery !== void 0 && failures.every((failure3) => failure3.class === "duplicate-race")) {
     try {
       await options.afterDelivery({ message, event: storedEvent, arrivedAt, source, result: preliminary });
-    } catch (error10) {
-      failures.push({ phase: "drain", class: "retryable-transient", error: errorText(error10) });
+    } catch (error11) {
+      failures.push({ phase: "drain", class: "retryable-transient", error: errorText(error11) });
     }
   }
   return result(source, message, "stored", arrivedAt, detectorApplied, viewResults, failures, options.correlationId, startedAt);
@@ -8081,8 +8269,8 @@ function asNumber(value, name) {
   if (!Number.isSafeInteger(number) || number < 0) throw new Error(`G44 ${name} must be a non-negative safe integer`);
   return number;
 }
-function errorText2(error10) {
-  return error10 instanceof Error && error10.message.length > 0 ? error10.message : String(error10);
+function errorText2(error11) {
+  return error11 instanceof Error && error11.message.length > 0 ? error11.message : String(error11);
 }
 function settledFrontierFromCursor(cursorJson) {
   const cursor = settledCursorFromJson(cursorJson);
@@ -8186,8 +8374,8 @@ var GlobalCompletenessReconciler = class {
     let snapshots;
     try {
       snapshots = await this.snapshotPartitions(serviceId);
-    } catch (error10) {
-      const message = errorText2(error10);
+    } catch (error11) {
+      const message = errorText2(error11);
       await this.appendFinding(serviceId, {
         identity: scannerFailureIdentity(serviceId),
         type: "GLOBAL_ARRAY_SCANNER_FAILURE",
@@ -8229,7 +8417,7 @@ var GlobalCompletenessReconciler = class {
               let joined;
               try {
                 joined = this.options.globalReceiptMatcher === void 0 ? await this.globalReceiptMatches(snapshot.serviceId, snapshot.tag, obligation) : await this.options.globalReceiptMatcher(snapshot.serviceId, snapshot.tag, obligation);
-              } catch (error10) {
+              } catch (error11) {
                 await this.appendFinding(snapshot.serviceId, {
                   identity: `GLOBAL_RECEIPT_UNAVAILABLE|${snapshot.serviceId}|${snapshot.tag}|${obligation.obligationSequence}|${obligation.eventId}|${obligation.eventDigest}`,
                   type: "GLOBAL_ARRAY_RECEIPT_UNAVAILABLE",
@@ -8238,7 +8426,7 @@ var GlobalCompletenessReconciler = class {
                   eventId: obligation.eventId,
                   eventDigest: obligation.eventDigest
                 }, nowMs).catch(() => void 0);
-                throw error10;
+                throw error11;
               }
               if (!joined) {
                 await this.appendObligationFinding(snapshot.serviceId, snapshot.tag, obligation, nowMs);
@@ -8257,8 +8445,8 @@ var GlobalCompletenessReconciler = class {
           if (afterSequence !== snapshot.upperBoundSequence) {
             throw new Error(`source_partition_range_incomplete:${snapshot.tag}`);
           }
-        } catch (error10) {
-          if (errorText2(error10).startsWith("source_")) {
+        } catch (error11) {
+          if (errorText2(error11).startsWith("source_")) {
             await this.appendFinding(snapshot.serviceId, {
               identity: sourceUnavailableIdentity(snapshot.serviceId, snapshot.tag),
               type: "GLOBAL_ARRAY_SOURCE_PARTITION_UNAVAILABLE",
@@ -8268,7 +8456,7 @@ var GlobalCompletenessReconciler = class {
               eventDigest: null
             }, nowMs).catch(() => void 0);
           }
-          throw error10;
+          throw error11;
         }
       }
       const endSnapshots = await this.snapshotPartitions(serviceId);
@@ -8287,8 +8475,8 @@ var GlobalCompletenessReconciler = class {
       }
       await this.writeHealth(serviceId, "HEALTHY", JSON.stringify(cursor), nowMs, null, nowMs);
       return { kind: "FULL", partitions: snapshots, scannedObligations: scanned };
-    } catch (error10) {
-      const message = errorText2(error10);
+    } catch (error11) {
+      const message = errorText2(error11);
       const health = message.startsWith("source_") ? "UNKNOWN" : "FAILED";
       if (health === "FAILED") {
         await this.appendFinding(serviceId, {
@@ -8430,8 +8618,8 @@ var GlobalCompletenessReconciler = class {
    * without applying views. It shares the scanner's single health/finding
    * authority rather than creating a second incident workflow.
    */
-  async recordDetectorFailure(serviceId, error10, nowMs) {
-    const message = `detector_failure:${errorText2(error10).slice(0, 256)}`;
+  async recordDetectorFailure(serviceId, error11, nowMs) {
+    const message = `detector_failure:${errorText2(error11).slice(0, 256)}`;
     await this.appendFinding(serviceId, {
       identity: `GLOBAL_DETECTOR_FAILURE|${serviceId}`,
       type: "GLOBAL_ARRAY_DETECTOR_FAILURE",
@@ -8570,7 +8758,7 @@ var GlobalCompletenessReconciler = class {
       nowMs
     ).run();
   }
-  async writeHealth(serviceId, status, cursor, lastFullScanAt, error10, nowMs) {
+  async writeHealth(serviceId, status, cursor, lastFullScanAt, error11, nowMs) {
     await this.database.prepare(
       `INSERT INTO serialized_dcb_completeness_scanner_health
          (service_id, scanner_version, status, cursor_json, last_full_scan_at, last_error, updated_at)
@@ -8582,7 +8770,7 @@ var GlobalCompletenessReconciler = class {
          last_full_scan_at = COALESCE(excluded.last_full_scan_at, serialized_dcb_completeness_scanner_health.last_full_scan_at),
          last_error = excluded.last_error,
          updated_at = excluded.updated_at`
-    ).bind(serviceId, this.scannerVersion, status, cursor, lastFullScanAt, error10, nowMs).run();
+    ).bind(serviceId, this.scannerVersion, status, cursor, lastFullScanAt, error11, nowMs).run();
   }
 };
 function globalReceiptAcknowledgement(message, receivedAt) {
@@ -8674,7 +8862,7 @@ function sourceAcknowledgementOptions(env, options) {
       if (decision.kind !== "SETTLED") {
         throw new Error(`global_completeness_${decision.kind}:${decision.health.status}`);
       }
-    } catch (error10) {
+    } catch (error11) {
       if (!completed) {
         observeG60PostAdmission(options.durableHopObserver, {
           stage: "completeness-coverage",
@@ -8689,7 +8877,7 @@ function sourceAcknowledgementOptions(env, options) {
           observedAt: Date.now()
         });
       }
-      throw error10;
+      throw error11;
     }
   } : options.beforeViews;
   const observedSourceAcknowledgement = sourceAcknowledgement === void 0 ? void 0 : async (input) => {
@@ -8697,14 +8885,14 @@ function sourceAcknowledgementOptions(env, options) {
     try {
       await sourceAcknowledgement(input);
       observeSourceSubstep(options.durableHopObserver, { ...input, boundary: "end", outcome: "acknowledged" });
-    } catch (error10) {
+    } catch (error11) {
       observeSourceSubstep(options.durableHopObserver, { ...input, boundary: "end", outcome: "error" });
-      throw error10;
+      throw error11;
     }
   };
-  const detectorFailure = hasG44Authority ? async ({ message, arrivedAt, error: error10, source }) => {
-    await options.onDetectorFailure?.({ message, arrivedAt, error: error10, source });
-    await new GlobalCompletenessReconciler(env.D1, env.TAG).recordDetectorFailure(message.serviceId, error10, arrivedAt);
+  const detectorFailure = hasG44Authority ? async ({ message, arrivedAt, error: error11, source }) => {
+    await options.onDetectorFailure?.({ message, arrivedAt, error: error11, source });
+    await new GlobalCompletenessReconciler(env.D1, env.TAG).recordDetectorFailure(message.serviceId, error11, arrivedAt);
   } : options.onDetectorFailure;
   return {
     ...options,
@@ -8719,9 +8907,9 @@ function sharedStore(env, provider) {
 async function admitBootstrapRoute(env, serviceId, route) {
   if (env.BOOTSTRAP === void 0) {
     if (env.G38_DOORBELL_DELIVERY_ROLE === "receiver") {
-      const error10 = new Error(`bootstrap_route_binding_missing:${route}`);
-      error10.name = "BootstrapRouteBindingMissingError";
-      throw error10;
+      const error11 = new Error(`bootstrap_route_binding_missing:${route}`);
+      error11.name = "BootstrapRouteBindingMissingError";
+      throw error11;
     }
     return;
   }
@@ -8810,10 +8998,10 @@ async function handleDownstreamQueue(batch, env, options = {}) {
         if (outcome.outcome === "stored" && !outcome.failures.some((failure3) => failure3.phase === "recordDelivery")) {
           try {
             options.afterStoredQueueDelivery?.({ message: queued.body, result: outcome });
-          } catch (error10) {
+          } catch (error11) {
             console.warn("safe_lane_kick", {
               status: "failed-to-schedule",
-              error: error10 instanceof Error ? error10.message : String(error10),
+              error: error11 instanceof Error ? error11.message : String(error11),
               serviceId: queued.body.serviceId,
               eventId: queued.body.eventId,
               attemptId: queued.body.attemptId
@@ -8835,6 +9023,36 @@ async function stabilizeDownstream(env, options = {}, serviceId, serviceIdentity
   });
 }
 
+// src/scope/ControlRouteScope.ts
+function response2(status, code, error11) {
+  return new Response(JSON.stringify({ code, error: error11 }), {
+    status,
+    headers: { "content-type": "application/json; charset=utf-8" }
+  });
+}
+function scopeIdentityMissingResponse() {
+  return response2(503, "scope.identity_missing", "A deployment service identity is required for this scope");
+}
+function enforceControlRouteScope(input) {
+  let actual;
+  try {
+    actual = input.provider.forRequest(input.request, input.requestOptions).serviceId;
+  } catch (caught) {
+    if (caught instanceof ServiceIdentityMissingError) {
+      console.error({ schema: "sdt.scope/v1", code: "scope.identity_missing", route: input.route });
+      return { response: scopeIdentityMissingResponse() };
+    }
+    throw caught;
+  }
+  if (input.pathServiceId !== actual) {
+    console.warn({ schema: "sdt.scope/v1", code: "scope.mismatch", route: input.route });
+    return {
+      response: response2(403, "scope.mismatch", "The path service identity is not authorized for this deployment")
+    };
+  }
+  return { serviceId: actual };
+}
+
 // src/downstream/OutboxDrain.ts
 function json5(body, status = 200) {
   return new Response(JSON.stringify(body), {
@@ -8931,15 +9149,32 @@ async function handleOutboxDrainRequest(request, env, options = {}) {
   if (!isDrainRequest(body)) {
     return json5({ error: "serviceId and unique non-empty tags are required", code: "invalid_outbox_drain_request" }, 400);
   }
+  const requestedServiceId = body.serviceId;
+  const tags = body.tags;
+  const provider = options.serviceIdentityProvider ?? envServiceIdentity(env);
+  let authority;
+  try {
+    authority = provider.forRequest(request).serviceId;
+  } catch (caught) {
+    if (caught instanceof ServiceIdentityMissingError) return scopeIdentityMissingResponse();
+    throw caught;
+  }
+  if (requestedServiceId !== authority) {
+    console.warn({ schema: "sdt.scope/v1", code: "scope.mismatch", route: "outbox-drain" });
+    return json5({
+      code: "scope.mismatch",
+      error: "The request service identity is not authorized for this deployment"
+    }, 403);
+  }
   try {
     const results = [];
-    for (const tag of body.tags) {
-      results.push(await drainTagOutbox({ serviceId: body.serviceId, tag }, env, systemPipelineClock, options));
+    for (const tag of tags) {
+      results.push(await drainTagOutbox({ serviceId: authority, tag }, env, systemPipelineClock, options));
     }
     return json5({ results });
-  } catch (error10) {
+  } catch (error11) {
     return json5({
-      error: error10 instanceof Error ? error10.message : "Outbox drain failed",
+      error: error11 instanceof Error ? error11.message : "Outbox drain failed",
       code: "outbox_drain_failed"
     }, 503);
   }
@@ -9384,9 +9619,9 @@ function isNonEmptyString7(value) {
   return typeof value === "string" && value.length > 0;
 }
 function base64Json(value) {
-  const bytes = new TextEncoder().encode(JSON.stringify(value));
+  const bytes2 = new TextEncoder().encode(JSON.stringify(value));
   let binary = "";
-  for (const byte of bytes) {
+  for (const byte of bytes2) {
     binary += String.fromCharCode(byte);
   }
   return btoa(binary);
@@ -9564,9 +9799,9 @@ function decodeStoredJson(value) {
   }
 }
 function jsonBytes(value) {
-  const bytes = new TextEncoder().encode(JSON.stringify(value));
+  const bytes2 = new TextEncoder().encode(JSON.stringify(value));
   let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
+  for (const byte of bytes2) binary += String.fromCharCode(byte);
   return btoa(binary);
 }
 function isRuntimeBridgedProjector(definition) {
@@ -9639,9 +9874,9 @@ function isRuntimeCommandLike(value) {
   return typeof candidate.id === "string" && candidate.id.length > 0 && typeof candidate.name === "string" && typeof candidate.parseInput === "function" && typeof candidate.execute === "function" && typeof candidate.handle === "function";
 }
 function encodeJsonPayload(value) {
-  const bytes = new TextEncoder().encode(JSON.stringify(value));
+  const bytes2 = new TextEncoder().encode(JSON.stringify(value));
   let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
+  for (const byte of bytes2) binary += String.fromCharCode(byte);
   return btoa(binary);
 }
 function candidateToV1Envelope(candidate) {
@@ -9825,8 +10060,8 @@ function stateFromCheckpoint(projector, checkpoint) {
   if (checkpoint === void 0) return projector.initialState();
   try {
     return projector.deserializeState(checkpoint.stateJson);
-  } catch (error10) {
-    throw new ProjectionCheckpointCorruption(error10);
+  } catch (error11) {
+    throw new ProjectionCheckpointCorruption(error11);
   }
 }
 function projectionEventFromStored(event) {
@@ -10050,8 +10285,8 @@ async function admitBootstrapRoute2(env, serviceId) {
   })).fetch(new Request(url, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ route: "projection-rebuild" }) }));
   if (!admitted.ok) throw new Error("bootstrap_route_rejected:projection-rebuild");
 }
-function boundedErrorReason(error10) {
-  const value = error10 instanceof Error ? error10.message : String(error10);
+function boundedErrorReason(error11) {
+  const value = error11 instanceof Error ? error11.message : String(error11);
   return value.length > 256 ? `${value.slice(0, 253)}...` : value;
 }
 async function notifyObserver(observer, callback, input) {
@@ -10064,7 +10299,7 @@ async function notifyObserver(observer, callback, input) {
   } catch {
   }
 }
-async function notifyOutcomes(observer, serviceId, projectorIds, attemptedAt, results, maximumSuid, env, error10) {
+async function notifyOutcomes(observer, serviceId, projectorIds, attemptedAt, results, maximumSuid, env, error11) {
   if (observer?.onOutcome === void 0) return;
   const byProjector = /* @__PURE__ */ new Map();
   for (const result2 of results) {
@@ -10077,9 +10312,9 @@ async function notifyOutcomes(observer, serviceId, projectorIds, attemptedAt, re
     let outcome = "invoked-but-no-work";
     let reason = null;
     let advancedSourceEvents = 0;
-    if (error10 !== void 0) {
+    if (error11 !== void 0) {
       outcome = "invoked-and-threw";
-      reason = boundedErrorReason(error10);
+      reason = boundedErrorReason(error11);
     } else {
       advancedSourceEvents = projectorResults.reduce((total, result2) => total + result2.advancedSourceEvents, 0);
       if (advancedSourceEvents > 0) {
@@ -10181,9 +10416,9 @@ async function pollLiveProjections(env, options = {}) {
     const results = await runtime.pollRegistered(serviceId, attemptedAt, options.maximumSuid);
     await notifyOutcomes(options.observer, serviceId, projectorIds, attemptedAt, results, options.maximumSuid, env);
     return results;
-  } catch (error10) {
-    await notifyOutcomes(options.observer, serviceId, projectorIds, attemptedAt, [], options.maximumSuid, env, error10);
-    throw error10;
+  } catch (error11) {
+    await notifyOutcomes(options.observer, serviceId, projectorIds, attemptedAt, [], options.maximumSuid, env, error11);
+    throw error11;
   }
 }
 async function handleProjectionLag(request, env, registry = DEPLOYED_PROJECTOR_REGISTRY, storeProvider, serviceIdentityProvider) {
@@ -10421,15 +10656,15 @@ function integer(row, key) {
 function operationId() {
   return `mv-unsafe-${crypto.randomUUID()}`;
 }
-function errorFrom(error10) {
-  const value = String(error10);
+function errorFrom(error11) {
+  const value = String(error11);
   if (value.includes("mv_unsafe_receipts") && (value.includes("UNIQUE") || value.includes("constraint"))) {
-    return new UnsafeWindowMaterializedViewError("UNSAFE_DUPLICATE_RACE", false, "Concurrent unsafe receipt was committed by another delivery", { cause: error10 });
+    return new UnsafeWindowMaterializedViewError("UNSAFE_DUPLICATE_RACE", false, "Concurrent unsafe receipt was committed by another delivery", { cause: error11 });
   }
-  if (value.includes("unsafe_row_cas")) return new UnsafeWindowMaterializedViewError("UNSAFE_ROW_CAS_MISMATCH", true, "Unsafe row version changed before atomic apply", { cause: error10 });
-  if (value.includes("unsafe_suid_contradiction")) return new UnsafeWindowMaterializedViewError("UNSAFE_SUID_CONTRADICTION", false, "Unsafe same-SUID payload contradiction", { cause: error10 });
-  if (value.includes("unsafe_safe_ahead")) return new UnsafeWindowMaterializedViewError("UNSAFE_SAFE_AHEAD", false, "Safe head already covers unsafe event", { cause: error10 });
-  if (value.includes("unsafe_behind_frontier")) return new UnsafeWindowMaterializedViewError("UNSAFE_BEHIND_FRONTIER", false, "Unsafe reads are fail-closed pending rebuild", { cause: error10 });
+  if (value.includes("unsafe_row_cas")) return new UnsafeWindowMaterializedViewError("UNSAFE_ROW_CAS_MISMATCH", true, "Unsafe row version changed before atomic apply", { cause: error11 });
+  if (value.includes("unsafe_suid_contradiction")) return new UnsafeWindowMaterializedViewError("UNSAFE_SUID_CONTRADICTION", false, "Unsafe same-SUID payload contradiction", { cause: error11 });
+  if (value.includes("unsafe_safe_ahead")) return new UnsafeWindowMaterializedViewError("UNSAFE_SAFE_AHEAD", false, "Safe head already covers unsafe event", { cause: error11 });
+  if (value.includes("unsafe_behind_frontier")) return new UnsafeWindowMaterializedViewError("UNSAFE_BEHIND_FRONTIER", false, "Unsafe reads are fail-closed pending rebuild", { cause: error11 });
   return void 0;
 }
 var UnsafeWindowMaterializedViewStore = class {
@@ -10562,8 +10797,8 @@ var UnsafeWindowMaterializedViewStore = class {
     await this.options.beforeApplyBatch?.(input, statements);
     try {
       await this.database.batch(statements);
-    } catch (error10) {
-      const text = String(error10);
+    } catch (error11) {
+      const text = String(error11);
       const guardFailure = text.includes("mv_atomic_guards") || text.includes("checkpoint_match") || text.includes("mv_unsafe_receipts") && (text.includes("UNIQUE") || text.includes("constraint"));
       if (guardFailure) {
         const receipt = await this.database.prepare(
@@ -10571,16 +10806,16 @@ var UnsafeWindowMaterializedViewStore = class {
         ).bind(input.serviceId, input.viewId, input.eventId).first();
         if (receipt !== null && receipt !== void 0) {
           if (string2(receipt, "suid") !== input.suid) {
-            throw new UnsafeWindowMaterializedViewError("UNSAFE_SUID_CONTRADICTION", false, "Duplicate event identity has a contradictory SUID", { cause: error10 });
+            throw new UnsafeWindowMaterializedViewError("UNSAFE_SUID_CONTRADICTION", false, "Duplicate event identity has a contradictory SUID", { cause: error11 });
           }
           if (this.options.beforeApplyBatch !== void 0) {
-            throw new UnsafeWindowMaterializedViewError("UNSAFE_DUPLICATE_RACE", false, "Concurrent unsafe receipt was committed by another delivery", { cause: error10 });
+            throw new UnsafeWindowMaterializedViewError("UNSAFE_DUPLICATE_RACE", false, "Concurrent unsafe receipt was committed by another delivery", { cause: error11 });
           }
           return { outcome: "no-change", duplicate: true };
         }
         return this.apply(input, true);
       }
-      throw error10;
+      throw error11;
     }
     const result2 = { outcome: "applied", duplicate: false };
     await this.options.afterApplyBatch?.(input, result2);
@@ -10713,13 +10948,13 @@ var UnsafeWindowMaterializedViewStore = class {
     await this.options.beforeApplyBatch?.(input, statements);
     try {
       await this.database.batch(statements);
-    } catch (error10) {
-      if (sameSuidContradiction) throw new UnsafeWindowMaterializedViewError("UNSAFE_SUID_CONTRADICTION", false, "Unsafe same-SUID payload contradiction", { cause: error10 });
-      if (rowCasMismatch) throw new UnsafeWindowMaterializedViewError("UNSAFE_ROW_CAS_MISMATCH", true, "Unsafe row version changed before atomic apply", { cause: error10 });
-      if (safeAhead) throw new UnsafeWindowMaterializedViewError("UNSAFE_SAFE_AHEAD", false, "Safe head already covers unsafe event", { cause: error10 });
-      const typed = errorFrom(error10);
+    } catch (error11) {
+      if (sameSuidContradiction) throw new UnsafeWindowMaterializedViewError("UNSAFE_SUID_CONTRADICTION", false, "Unsafe same-SUID payload contradiction", { cause: error11 });
+      if (rowCasMismatch) throw new UnsafeWindowMaterializedViewError("UNSAFE_ROW_CAS_MISMATCH", true, "Unsafe row version changed before atomic apply", { cause: error11 });
+      if (safeAhead) throw new UnsafeWindowMaterializedViewError("UNSAFE_SAFE_AHEAD", false, "Safe head already covers unsafe event", { cause: error11 });
+      const typed = errorFrom(error11);
       if (typed !== void 0) throw typed;
-      throw error10;
+      throw error11;
     }
     const result2 = { outcome, duplicate: false };
     await this.options.afterApplyBatch?.(input, result2);
@@ -10786,8 +11021,8 @@ var UnsafeWindowMaterializedViewStore = class {
         this.database.prepare(`UPDATE mv_unsafe_kicks SET lease_owner = ?, lease_until = ?, dirty = 0 WHERE service_id = ? AND view_id = ?`).bind(owner, nowMs + leaseMs, serviceId, viewId),
         this.database.prepare("DELETE FROM mv_atomic_guards WHERE operation_id = ?").bind(operation)
       ]);
-    } catch (error10) {
-      throw new UnsafeWindowMaterializedViewError("UNSAFE_KICK_LEASE_HELD", true, "Unsafe kick is held by another lease owner", { cause: error10 });
+    } catch (error11) {
+      throw new UnsafeWindowMaterializedViewError("UNSAFE_KICK_LEASE_HELD", true, "Unsafe kick is held by another lease owner", { cause: error11 });
     }
     const row = await this.database.prepare(`SELECT target_suid, dirty FROM mv_unsafe_kicks WHERE service_id = ? AND view_id = ?`).bind(serviceId, viewId).first();
     return row === null || row === void 0 ? void 0 : { targetSuid: string2(row, "target_suid"), dirty: integer(row, "dirty") === 1 };
@@ -10861,9 +11096,9 @@ var UnsafeWindowMaterializedViewStore = class {
     try {
       await this.database.batch(statements);
       return true;
-    } catch (error10) {
-      if (String(error10).includes("mv_atomic_guards") || String(error10).includes("checkpoint_match")) return false;
-      throw error10;
+    } catch (error11) {
+      if (String(error11).includes("mv_atomic_guards") || String(error11).includes("checkpoint_match")) return false;
+      throw error11;
     }
   }
   /**
@@ -11029,12 +11264,12 @@ function indexValue(row, type) {
 function operationId2() {
   return `mv-${crypto.randomUUID()}`;
 }
-function isCasFailure(error10) {
-  const message = String(error10);
+function isCasFailure(error11) {
+  const message = String(error11);
   return message.includes("mv_atomic_guards.checkpoint_match") || message.includes("MV_CAS_MISMATCH");
 }
-function isPatchFailure(error10) {
-  return String(error10).includes("CHECK constraint failed: checkpoint_match");
+function isPatchFailure(error11) {
+  return String(error11).includes("CHECK constraint failed: checkpoint_match");
 }
 var D1MaterializedViewStore = class {
   constructor(database) {
@@ -11070,8 +11305,8 @@ var D1MaterializedViewStore = class {
            VALUES (?, ?, ?, ?)`
         ).bind(input.serviceId, input.viewId, generation, input.updatedAt)
       ]);
-    } catch (error10) {
-      throw new MaterializedViewStoreError("create-active", "MV_INSTANCE_EXISTS", `Active materialized view already exists: ${String(error10)}`, { cause: error10 });
+    } catch (error11) {
+      throw new MaterializedViewStoreError("create-active", "MV_INSTANCE_EXISTS", `Active materialized view already exists: ${String(error11)}`, { cause: error11 });
     }
     return this.readInstance(input.serviceId, input.viewId, generation);
   }
@@ -11092,8 +11327,8 @@ var D1MaterializedViewStore = class {
         input.definitionVersion,
         input.updatedAt
       ).run();
-    } catch (error10) {
-      throw new MaterializedViewStoreError("create-candidate", "MV_INSTANCE_EXISTS", `Candidate generation already exists: ${String(error10)}`, { cause: error10 });
+    } catch (error11) {
+      throw new MaterializedViewStoreError("create-candidate", "MV_INSTANCE_EXISTS", `Candidate generation already exists: ${String(error11)}`, { cause: error11 });
     }
     return this.readInstance(input.serviceId, input.viewId, input.generation);
   }
@@ -11231,10 +11466,10 @@ var D1MaterializedViewStore = class {
    */
   async readListPage(serviceId, viewId, options = {}) {
     this.ready("initialize");
-    const active = await this.readActive(serviceId, viewId);
-    if (active === void 0) return { rows: [], totalCount: 0, readHead: "" };
-    const selected = options.generation ?? active.generation;
-    const selectedInstance = selected === active.generation ? active : await this.readInstance(serviceId, viewId, selected);
+    const active2 = await this.readActive(serviceId, viewId);
+    if (active2 === void 0) return { rows: [], totalCount: 0, readHead: "" };
+    const selected = options.generation ?? active2.generation;
+    const selectedInstance = selected === active2.generation ? active2 : await this.readInstance(serviceId, viewId, selected);
     if (selectedInstance === void 0) {
       throw new MaterializedViewStoreError("initialize", "MV_INSTANCE_MISSING", "Requested materialized-view generation is unavailable");
     }
@@ -11751,10 +11986,10 @@ var D1MaterializedViewStore = class {
     ).bind(operation, `${operation}:%`));
     try {
       await this.database.batch(statements);
-    } catch (error10) {
-      if (isPatchFailure(error10)) throw new MaterializedViewPatchError();
-      if (isCasFailure(error10)) throw new MaterializedViewCasError();
-      throw new MaterializedViewStoreError("apply", "MV_STORE_OPERATION_FAILED", `Materialized-view atomic apply failed: ${String(error10)}`, { cause: error10 });
+    } catch (error11) {
+      if (isPatchFailure(error11)) throw new MaterializedViewPatchError();
+      if (isCasFailure(error11)) throw new MaterializedViewCasError();
+      throw new MaterializedViewStoreError("apply", "MV_STORE_OPERATION_FAILED", `Materialized-view atomic apply failed: ${String(error11)}`, { cause: error11 });
     }
     const instance = await this.readInstance(input.serviceId, input.viewId, input.generation);
     if (instance === void 0) throw new MaterializedViewStoreError("apply", "MV_INSTANCE_MISSING", "Materialized-view instance disappeared after apply");
@@ -11859,13 +12094,13 @@ var D1MaterializedViewStore = class {
     ];
     try {
       await this.database.batch(statements);
-    } catch (error10) {
-      if (isCasFailure(error10)) throw new MaterializedViewPromotionCasError();
-      throw new MaterializedViewStoreError("promote", "MV_STORE_OPERATION_FAILED", `Materialized-view promotion failed: ${String(error10)}`, { cause: error10 });
+    } catch (error11) {
+      if (isCasFailure(error11)) throw new MaterializedViewPromotionCasError();
+      throw new MaterializedViewStoreError("promote", "MV_STORE_OPERATION_FAILED", `Materialized-view promotion failed: ${String(error11)}`, { cause: error11 });
     }
-    const active = await this.readActive(input.serviceId, input.viewId);
-    if (active === void 0) throw new MaterializedViewStoreError("promote", "MV_INSTANCE_MISSING", "Active generation disappeared after promotion");
-    return active;
+    const active2 = await this.readActive(input.serviceId, input.viewId);
+    if (active2 === void 0) throw new MaterializedViewStoreError("promote", "MV_INSTANCE_MISSING", "Active generation disappeared after promotion");
+    return active2;
   }
   /** Short aliases make the port convenient for runtime composition and tests. */
   apply = this.applyMutationsAndAdvanceCheckpoint.bind(this);
@@ -11874,8 +12109,8 @@ var D1MaterializedViewStore = class {
     let value;
     try {
       value = assertJsonValue(JSON.parse(asString2(row.value_json, "value_json")), "state-persistence");
-    } catch (error10) {
-      throw new MaterializedViewStoreError("initialize", "MV_VALUE_INVALID", `Materialized-view row JSON was invalid: ${String(error10)}`, { cause: error10 });
+    } catch (error11) {
+      throw new MaterializedViewStoreError("initialize", "MV_VALUE_INVALID", `Materialized-view row JSON was invalid: ${String(error11)}`, { cause: error11 });
     }
     return {
       serviceId: asString2(row.service_id, "service_id"),
@@ -12522,10 +12757,10 @@ var SerializedReadWorker = class {
     });
   }
   async ensureWindowDeterminate() {
-    if (this.storeProvider === void 0 || this.storeProvider.isConfigured?.(this.env) === false) {
-      return;
-    }
     try {
+      if (this.storeProvider === void 0 || this.storeProvider.isConfigured?.(this.env) === false) {
+        return;
+      }
       const store = this.storeProvider.create(this.env);
       await store.initialize();
       const nowMs = Date.now();
@@ -12566,13 +12801,683 @@ async function handleSerializedRead(request, env, registry = DEPLOYED_PROJECTOR_
   }), registry, storeProvider).handle(request);
 }
 
+// src/completeness/IncidentLifecycle.ts
+var MAX_IDENTITY_BYTES = 256;
+var MAX_LONG_TEXT_BYTES = 2048;
+var SHA256_DIGEST = /^sha256:[0-9a-f]{64}$/;
+var IncidentLifecycleError = class extends Error {
+  code;
+  status;
+  constructor(code, status, message) {
+    super(message);
+    this.name = "IncidentLifecycleError";
+    this.code = code;
+    this.status = status;
+  }
+};
+function isObject11(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasOnlyKeys(value, keys) {
+  const allowed = new Set(keys);
+  return Object.keys(value).every((key) => allowed.has(key));
+}
+function bytes(value) {
+  return new TextEncoder().encode(value).byteLength;
+}
+function boundedString(value, name, maximum, required = true) {
+  if (typeof value !== "string") {
+    throw new IncidentLifecycleError("incident_invalid_request", 400, `${name} must be a string`);
+  }
+  const normalized = value.trim();
+  if (required && normalized.length === 0) {
+    throw new IncidentLifecycleError("incident_invalid_request", 400, `${name} must be non-empty`);
+  }
+  if (bytes(normalized) > maximum) {
+    throw new IncidentLifecycleError("incident_invalid_request", 400, `${name} is too long`);
+  }
+  return normalized.length === 0 ? null : normalized;
+}
+function normalizeIncidentIdentity(value) {
+  const identity2 = boundedString(value, "incidentIdentity", MAX_IDENTITY_BYTES);
+  if (identity2 === null) {
+    throw new IncidentLifecycleError("incident_invalid_request", 400, "incidentIdentity must be non-empty");
+  }
+  return identity2;
+}
+function safeInteger(value, name) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value)) {
+    throw new IncidentLifecycleError("incident_invalid_request", 400, `${name} must be a safe integer`);
+  }
+  return value;
+}
+function normalizeCorrection(value) {
+  if (!isObject11(value) || !hasOnlyKeys(value, ["kind", "reference", "digest"])) {
+    throw new IncidentLifecycleError("incident_invalid_request", 400, "correction has unknown or missing keys");
+  }
+  if (value.kind !== "event" && value.kind !== "receipt") {
+    throw new IncidentLifecycleError("incident_invalid_request", 400, "correction.kind must be event or receipt");
+  }
+  const reference = boundedString(value.reference, "correction.reference", MAX_LONG_TEXT_BYTES);
+  const digest2 = boundedString(value.digest, "correction.digest", MAX_IDENTITY_BYTES);
+  if (reference === null || digest2 === null || !SHA256_DIGEST.test(digest2)) {
+    throw new IncidentLifecycleError("incident_invalid_request", 400, "correction.digest must be lowercase sha256");
+  }
+  return { kind: value.kind, reference, digest: digest2 };
+}
+function normalizeRequest(value) {
+  if (!isObject11(value) || !hasOnlyKeys(value, ["action", "incidentIdentity", "transitionKey", "expectedVersion", "reason", "ownerId", "deadlineAt", "correction", "resolution"])) {
+    throw new IncidentLifecycleError("incident_invalid_request", 400, "transition has unknown keys");
+  }
+  const action = value.action;
+  if (typeof action !== "string" || !["ACKNOWLEDGE", "UPDATE_ASSIGNMENT", "RECORD_CORRECTION", "CLOSE", "REOPEN"].includes(action)) {
+    throw new IncidentLifecycleError("incident_invalid_request", 400, "transition action is invalid");
+  }
+  const actionKeys = action === "RECORD_CORRECTION" ? ["action", "incidentIdentity", "transitionKey", "expectedVersion", "reason", "correction"] : action === "CLOSE" ? ["action", "incidentIdentity", "transitionKey", "expectedVersion", "reason", "resolution"] : ["action", "incidentIdentity", "transitionKey", "expectedVersion", "reason", "ownerId", "deadlineAt"];
+  if (!hasOnlyKeys(value, actionKeys)) {
+    throw new IncidentLifecycleError("incident_invalid_request", 400, "transition has keys not valid for its action");
+  }
+  const base = {
+    incidentIdentity: normalizeIncidentIdentity(value.incidentIdentity),
+    transitionKey: boundedString(value.transitionKey, "transitionKey", MAX_IDENTITY_BYTES),
+    expectedVersion: safeInteger(value.expectedVersion, "expectedVersion"),
+    reason: boundedString(value.reason, "reason", MAX_LONG_TEXT_BYTES)
+  };
+  if (base.expectedVersion < 0) {
+    throw new IncidentLifecycleError("incident_invalid_request", 400, "expectedVersion must not be negative");
+  }
+  if (action === "ACKNOWLEDGE" || action === "UPDATE_ASSIGNMENT" || action === "REOPEN") {
+    const ownerId = boundedString(value.ownerId, "ownerId", MAX_IDENTITY_BYTES);
+    const deadlineAt = safeInteger(value.deadlineAt, "deadlineAt");
+    if (ownerId === null) throw new IncidentLifecycleError("incident_invalid_request", 400, "ownerId must be non-empty");
+    return { ...base, action, ownerId, deadlineAt };
+  }
+  if (action === "RECORD_CORRECTION") {
+    return { ...base, action, correction: normalizeCorrection(value.correction) };
+  }
+  if (!isObject11(value.resolution) || !hasOnlyKeys(value.resolution, ["kind", "explanation"])) {
+    throw new IncidentLifecycleError("incident_invalid_request", 400, "resolution has unknown or missing keys");
+  }
+  if (value.resolution.kind === "CORRECTED") {
+    if (value.resolution.explanation !== void 0) {
+      throw new IncidentLifecycleError("incident_invalid_request", 400, "CORRECTED resolution has unknown keys");
+    }
+    return { ...base, action, resolution: { kind: "CORRECTED" } };
+  }
+  if (value.resolution.kind === "ACCEPTED_AS_IS") {
+    const explanation = boundedString(value.resolution.explanation, "resolution.explanation", MAX_LONG_TEXT_BYTES);
+    if (explanation === null) throw new IncidentLifecycleError("incident_invalid_request", 400, "resolution.explanation is required");
+    return { ...base, action, resolution: { kind: "ACCEPTED_AS_IS", explanation } };
+  }
+  throw new IncidentLifecycleError("incident_invalid_request", 400, "resolution.kind is invalid");
+}
+function canonicalize(value) {
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (!isObject11(value)) return value;
+  return Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonicalize(value[key])]));
+}
+async function digestFor(request, actorId) {
+  const envelope = canonicalize({ action: request, actor: actorId });
+  const encoded = new TextEncoder().encode(JSON.stringify(envelope));
+  const digest2 = await crypto.subtle.digest("SHA-256", encoded);
+  return `sha256:${Array.from(new Uint8Array(digest2), (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+}
+function projectionFromRow(row, finding2) {
+  if (row === null) {
+    return {
+      serviceId: finding2.service_id,
+      incidentIdentity: finding2.incident_identity,
+      lifecycleState: "OPEN",
+      ownerId: null,
+      deadlineAt: null,
+      correction: null,
+      closeResolution: null,
+      closeReason: null,
+      version: 0,
+      lastTransitionKey: "",
+      updatedAt: finding2.last_observed_at
+    };
+  }
+  return {
+    serviceId: row.service_id,
+    incidentIdentity: row.incident_identity,
+    lifecycleState: row.lifecycle_state,
+    ownerId: row.owner_id,
+    deadlineAt: row.deadline_at,
+    correction: row.correction_kind === null ? null : {
+      kind: row.correction_kind,
+      reference: row.correction_reference,
+      digest: row.correction_digest
+    },
+    closeResolution: row.close_resolution,
+    closeReason: row.close_reason,
+    version: row.version,
+    lastTransitionKey: row.last_transition_key,
+    updatedAt: row.updated_at
+  };
+}
+function findingFromRow(row) {
+  return {
+    serviceId: row.service_id,
+    incidentIdentity: row.incident_identity,
+    incidentType: row.incident_type,
+    partitionTag: row.partition_tag,
+    obligationSequence: row.obligation_sequence,
+    eventId: row.event_id,
+    eventDigest: row.event_digest,
+    state: row.finding_state,
+    firstObservedAt: row.first_observed_at,
+    lastObservedAt: row.last_observed_at
+  };
+}
+function transitionFromRow(row) {
+  const before = projectionFromAudit(row, "before");
+  const after = projectionFromAudit(row, "after");
+  return {
+    transitionId: row.transition_id,
+    serviceId: row.service_id,
+    incidentIdentity: row.incident_identity,
+    transitionKey: row.transition_key,
+    requestDigest: row.request_digest,
+    action: row.action,
+    fromState: row.from_state,
+    toState: row.to_state,
+    fromVersion: row.from_version,
+    toVersion: row.to_version,
+    actorId: row.actor_id,
+    before,
+    after,
+    reason: row.reason,
+    occurredAt: row.occurred_at
+  };
+}
+function projectionFromAudit(row, prefix) {
+  const state = prefix === "before" ? row.from_state : row.to_state;
+  const version = prefix === "before" ? row.from_version : row.to_version;
+  const ownerId = row[`${prefix}_owner_id`];
+  const correctionKind = row[`${prefix}_correction_kind`];
+  return {
+    serviceId: row.service_id,
+    incidentIdentity: row.incident_identity,
+    lifecycleState: state,
+    ownerId,
+    deadlineAt: row[`${prefix}_deadline_at`],
+    correction: correctionKind === null ? null : {
+      kind: correctionKind,
+      reference: row[`${prefix}_correction_reference`],
+      digest: row[`${prefix}_correction_digest`]
+    },
+    closeResolution: row[`${prefix}_close_resolution`],
+    closeReason: row[`${prefix}_close_reason`],
+    version,
+    lastTransitionKey: prefix === "after" ? row.transition_key : "",
+    updatedAt: row.occurred_at
+  };
+}
+function active(state) {
+  return state !== "CLOSED";
+}
+function compareItems(left, right) {
+  if (left.overdue !== right.overdue) return left.overdue ? -1 : 1;
+  if (left.unowned !== right.unowned) return left.unowned ? -1 : 1;
+  if (left.finding.lastObservedAt !== right.finding.lastObservedAt) return right.finding.lastObservedAt - left.finding.lastObservedAt;
+  return left.finding.incidentIdentity < right.finding.incidentIdentity ? -1 : left.finding.incidentIdentity > right.finding.incidentIdentity ? 1 : 0;
+}
+var IncidentLifecycle = class {
+  constructor(database, now2 = () => Date.now()) {
+    this.database = database;
+    this.now = now2;
+  }
+  database;
+  now;
+  static parseTransition(value) {
+    return normalizeRequest(value);
+  }
+  async finding(serviceId, incidentIdentity) {
+    const row = await this.database.prepare(
+      `SELECT service_id, incident_identity, incident_type, partition_tag,
+              obligation_sequence, event_id, event_digest, state AS finding_state,
+              first_observed_at, last_observed_at
+         FROM serialized_dcb_completeness_findings
+        WHERE service_id = ? AND incident_identity = ?`
+    ).bind(serviceId, incidentIdentity).first();
+    if (row === null || row === void 0) {
+      throw new IncidentLifecycleError("incident_not_found", 404, "The completeness incident was not found");
+    }
+    return row;
+  }
+  async lifecycle(serviceId, incidentIdentity) {
+    const row = await this.database.prepare(
+      `SELECT service_id, incident_identity, lifecycle_state, owner_id, deadline_at,
+              correction_kind, correction_reference, correction_digest,
+              close_resolution, close_reason, version, last_transition_key, updated_at
+         FROM serialized_dcb_incident_lifecycles
+        WHERE service_id = ? AND incident_identity = ?`
+    ).bind(serviceId, incidentIdentity).first();
+    return row === void 0 ? null : row;
+  }
+  async transitions(serviceId, incidentIdentity) {
+    const result2 = await this.database.prepare(
+      `SELECT * FROM serialized_dcb_incident_transitions
+        WHERE service_id = ? AND incident_identity = ?
+        ORDER BY transition_id ASC`
+    ).bind(serviceId, incidentIdentity).all();
+    return result2.results.map(transitionFromRow);
+  }
+  async closeTime(serviceId, incidentIdentity) {
+    const row = await this.database.prepare(
+      `SELECT occurred_at FROM serialized_dcb_incident_transitions
+        WHERE service_id = ? AND incident_identity = ? AND to_state = 'CLOSED'
+        ORDER BY transition_id DESC LIMIT 1`
+    ).bind(serviceId, incidentIdentity).first();
+    return row?.occurred_at ?? null;
+  }
+  async item(finding2, row, at) {
+    const lifecycle = projectionFromRow(row, finding2);
+    const closeTime = lifecycle.lifecycleState === "OPEN" && row === null ? null : await this.closeTime(finding2.service_id, finding2.incident_identity);
+    const observedAfterClose = closeTime !== null && finding2.last_observed_at > closeTime;
+    const overdue = active(lifecycle.lifecycleState) && lifecycle.deadlineAt !== null && lifecycle.deadlineAt < at;
+    return {
+      finding: findingFromRow(finding2),
+      lifecycle,
+      overdue,
+      unowned: lifecycle.ownerId === null,
+      observedAfterClose
+    };
+  }
+  async list(serviceId, filters = {}, at = this.now()) {
+    const rows = await this.database.prepare(
+      `SELECT service_id, incident_identity, incident_type, partition_tag,
+              obligation_sequence, event_id, event_digest, state AS finding_state,
+              first_observed_at, last_observed_at
+         FROM serialized_dcb_completeness_findings
+        WHERE service_id = ?`
+    ).bind(serviceId).all();
+    const items = [];
+    for (const finding2 of rows.results) {
+      const item = await this.item(finding2, await this.lifecycle(serviceId, finding2.incident_identity), at);
+      if (filters.state !== void 0 && item.lifecycle.lifecycleState !== filters.state) continue;
+      if (filters.owner !== void 0 && item.lifecycle.ownerId !== filters.owner) continue;
+      if (filters.unowned === true && !item.unowned) continue;
+      if (filters.overdue === true && !item.overdue) continue;
+      if (filters.observedAfterClose === true && !item.observedAfterClose) continue;
+      items.push(item);
+    }
+    items.sort(compareItems);
+    const byState = {
+      OPEN: 0,
+      ACKNOWLEDGED: 0,
+      CORRECTION_RECORDED: 0,
+      CLOSED: 0,
+      REOPENED: 0
+    };
+    for (const item of items) byState[item.lifecycle.lifecycleState] += 1;
+    return {
+      items,
+      summary: {
+        total: items.length,
+        byState,
+        unowned: items.filter((item) => item.unowned).length,
+        overdue: items.filter((item) => item.overdue).length,
+        observedAfterClose: items.filter((item) => item.observedAfterClose).length
+      }
+    };
+  }
+  async detail(serviceId, incidentIdentity, at = this.now()) {
+    const finding2 = await this.finding(serviceId, incidentIdentity);
+    const lifecycle = await this.lifecycle(serviceId, incidentIdentity);
+    const item = await this.item(finding2, lifecycle, at);
+    return {
+      finding: item.finding,
+      lifecycle: item.lifecycle,
+      flags: { overdue: item.overdue, unowned: item.unowned, observedAfterClose: item.observedAfterClose },
+      transitions: await this.transitions(serviceId, incidentIdentity)
+    };
+  }
+  async transition(serviceId, value, actor) {
+    const request = normalizeRequest(value);
+    let actorId;
+    try {
+      actorId = boundedString(actor, "x-sdt-maintainer", MAX_IDENTITY_BYTES);
+    } catch (caught) {
+      if (caught instanceof IncidentLifecycleError && caught.code === "incident_invalid_request") {
+        throw new IncidentLifecycleError("incident_invalid_actor", 400, caught.message);
+      }
+      throw caught;
+    }
+    if (actorId === null) throw new IncidentLifecycleError("incident_invalid_actor", 400, "x-sdt-maintainer must be non-empty");
+    const finding2 = await this.finding(serviceId, request.incidentIdentity);
+    const digest2 = await digestFor(request, actorId);
+    const existing = await this.database.prepare(
+      `SELECT * FROM serialized_dcb_incident_transitions
+        WHERE service_id = ? AND incident_identity = ? AND transition_key = ?`
+    ).bind(serviceId, request.incidentIdentity, request.transitionKey).first();
+    if (existing !== null && existing !== void 0) {
+      if (existing.request_digest !== digest2) {
+        throw new IncidentLifecycleError("incident_idempotency_conflict", 409, "The transition key was already used with different content");
+      }
+      return { projection: transitionFromRow(existing).after, transition: transitionFromRow(existing), idempotent: true };
+    }
+    const priorRow = await this.lifecycle(serviceId, request.incidentIdentity);
+    const before = projectionFromRow(priorRow, finding2);
+    if (before.version !== request.expectedVersion) {
+      throw new IncidentLifecycleError("incident_version_conflict", 409, "The incident version is stale");
+    }
+    const at = this.now();
+    const after = this.nextProjection(before, request, at);
+    const newVersion = before.version + 1;
+    const occurredAt = at;
+    const seed = this.database.prepare(
+      `INSERT INTO serialized_dcb_incident_lifecycles
+         (service_id, incident_identity, lifecycle_state, version, last_transition_key, updated_at)
+       VALUES (?, ?, 'OPEN', 0, '', ?)
+       ON CONFLICT (service_id, incident_identity) DO NOTHING`
+    ).bind(serviceId, request.incidentIdentity, occurredAt);
+    const update = this.database.prepare(
+      `UPDATE serialized_dcb_incident_lifecycles
+          SET lifecycle_state = ?, owner_id = ?, deadline_at = ?,
+              correction_kind = ?, correction_reference = ?, correction_digest = ?,
+              close_resolution = ?, close_reason = ?, version = ?,
+              last_transition_key = ?, updated_at = ?
+        WHERE service_id = ? AND incident_identity = ? AND version = ?
+          AND last_transition_key <> ?`
+    ).bind(
+      after.lifecycleState,
+      after.ownerId,
+      after.deadlineAt,
+      after.correction?.kind ?? null,
+      after.correction?.reference ?? null,
+      after.correction?.digest ?? null,
+      after.closeResolution,
+      after.closeReason,
+      newVersion,
+      request.transitionKey,
+      occurredAt,
+      serviceId,
+      request.incidentIdentity,
+      before.version,
+      request.transitionKey
+    );
+    const audit = this.database.prepare(
+      `INSERT INTO serialized_dcb_incident_transitions
+         (service_id, incident_identity, transition_key, request_digest, action,
+          from_state, to_state, from_version, to_version, actor_id,
+          before_owner_id, before_deadline_at, before_correction_kind,
+          before_correction_reference, before_correction_digest, before_close_resolution,
+          before_close_reason, after_owner_id, after_deadline_at, after_correction_kind,
+          after_correction_reference, after_correction_digest, after_close_resolution,
+          after_close_reason, reason, occurred_at)
+       SELECT ?, ?, ?, ?, ?, ?, lifecycle_state, ?, version, ?,
+              ?, ?, ?, ?, ?, ?, ?, owner_id, deadline_at, correction_kind,
+              correction_reference, correction_digest, close_resolution, close_reason, ?, ?
+         FROM serialized_dcb_incident_lifecycles
+        WHERE service_id = ? AND incident_identity = ? AND version = ? AND last_transition_key = ?`
+    ).bind(
+      serviceId,
+      request.incidentIdentity,
+      request.transitionKey,
+      digest2,
+      request.action,
+      before.lifecycleState,
+      before.version,
+      actorId,
+      before.ownerId,
+      before.deadlineAt,
+      before.correction?.kind ?? null,
+      before.correction?.reference ?? null,
+      before.correction?.digest ?? null,
+      before.closeResolution,
+      before.closeReason,
+      request.reason,
+      occurredAt,
+      serviceId,
+      request.incidentIdentity,
+      newVersion,
+      request.transitionKey
+    );
+    await this.database.batch([seed, update, audit]);
+    const inserted = await this.database.prepare(
+      `SELECT * FROM serialized_dcb_incident_transitions
+        WHERE service_id = ? AND incident_identity = ? AND transition_key = ?`
+    ).bind(serviceId, request.incidentIdentity, request.transitionKey).first();
+    if (inserted === null || inserted === void 0) {
+      const competing = await this.database.prepare(
+        `SELECT * FROM serialized_dcb_incident_transitions
+          WHERE service_id = ? AND incident_identity = ? AND transition_key = ?`
+      ).bind(serviceId, request.incidentIdentity, request.transitionKey).first();
+      if (competing !== null && competing !== void 0 && competing.request_digest !== digest2) {
+        throw new IncidentLifecycleError("incident_idempotency_conflict", 409, "The transition key was already used with different content");
+      }
+      if (competing !== null && competing !== void 0) {
+        const transition2 = transitionFromRow(competing);
+        return { projection: transition2.after, transition: transition2, idempotent: true };
+      }
+      throw new IncidentLifecycleError("incident_version_conflict", 409, "The incident version is stale");
+    }
+    const transition = transitionFromRow(inserted);
+    return { projection: transition.after, transition, idempotent: false };
+  }
+  nextProjection(before, request, at) {
+    const laterDeadline = (deadlineAt2) => {
+      if (deadlineAt2 <= at) throw new IncidentLifecycleError("incident_invalid_deadline", 400, "deadlineAt must be in the future");
+      return deadlineAt2;
+    };
+    let lifecycleState;
+    let ownerId = before.ownerId;
+    let deadlineAt = before.deadlineAt;
+    let correction = before.correction;
+    let closeResolution = before.closeResolution;
+    let closeReason = before.closeReason;
+    if (request.action === "ACKNOWLEDGE") {
+      if (before.lifecycleState !== "OPEN" && before.lifecycleState !== "REOPENED") {
+        throw new IncidentLifecycleError("incident_invalid_transition", 409, "The incident cannot be acknowledged from its current state");
+      }
+      lifecycleState = "ACKNOWLEDGED";
+      ownerId = request.ownerId;
+      deadlineAt = laterDeadline(request.deadlineAt);
+      correction = null;
+      closeResolution = null;
+      closeReason = null;
+    } else if (request.action === "UPDATE_ASSIGNMENT") {
+      if (before.lifecycleState !== "ACKNOWLEDGED" && before.lifecycleState !== "CORRECTION_RECORDED") {
+        throw new IncidentLifecycleError("incident_invalid_transition", 409, "The incident cannot be reassigned from its current state");
+      }
+      lifecycleState = before.lifecycleState;
+      ownerId = request.ownerId;
+      deadlineAt = laterDeadline(request.deadlineAt);
+    } else if (request.action === "RECORD_CORRECTION") {
+      if (before.lifecycleState !== "ACKNOWLEDGED") {
+        throw new IncidentLifecycleError("incident_invalid_transition", 409, "The incident must be acknowledged before correction evidence");
+      }
+      lifecycleState = "CORRECTION_RECORDED";
+      correction = request.correction;
+    } else if (request.action === "CLOSE") {
+      if (before.ownerId === null || before.deadlineAt === null) {
+        throw new IncidentLifecycleError("incident_invalid_transition", 409, "The incident must have an owner and deadline before closure");
+      }
+      if (request.resolution.kind === "CORRECTED") {
+        if (before.lifecycleState !== "CORRECTION_RECORDED") {
+          throw new IncidentLifecycleError("incident_invalid_transition", 409, "A corrected closure requires recorded correction evidence");
+        }
+        lifecycleState = "CLOSED";
+        closeResolution = "CORRECTED";
+        closeReason = request.reason;
+      } else {
+        if (before.lifecycleState !== "ACKNOWLEDGED") {
+          throw new IncidentLifecycleError("incident_invalid_transition", 409, "Accepted-as-is closure requires an acknowledged incident");
+        }
+        lifecycleState = "CLOSED";
+        closeResolution = "ACCEPTED_AS_IS";
+        closeReason = request.resolution.explanation;
+        correction = null;
+      }
+    } else {
+      if (before.lifecycleState !== "CLOSED") {
+        throw new IncidentLifecycleError("incident_invalid_transition", 409, "Only a closed incident can be reopened");
+      }
+      lifecycleState = "REOPENED";
+      ownerId = request.ownerId;
+      deadlineAt = laterDeadline(request.deadlineAt);
+      correction = null;
+      closeResolution = null;
+      closeReason = null;
+    }
+    return {
+      ...before,
+      lifecycleState,
+      ownerId,
+      deadlineAt,
+      correction,
+      closeResolution,
+      closeReason,
+      version: before.version + 1,
+      lastTransitionKey: request.transitionKey,
+      updatedAt: at
+    };
+  }
+};
+
+// src/http/IncidentMaintenance.ts
+function json10(body, status = 200) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json; charset=utf-8" }
+  });
+}
+function error8(status, code, message) {
+  return json10({ error: message, code }, status);
+}
+function configuredToken(value) {
+  if (typeof value !== "string") return void 0;
+  const token = value.trim();
+  return token.length === 0 ? void 0 : token;
+}
+async function digest(value) {
+  const bytes2 = new TextEncoder().encode(value);
+  return new Uint8Array(await crypto.subtle.digest("SHA-256", bytes2));
+}
+function fixedLengthEqual(left, right) {
+  let difference = left.length ^ right.length;
+  const length = Math.max(left.length, right.length);
+  for (let index = 0; index < length; index += 1) {
+    difference |= (left[index] ?? 0) ^ (right[index] ?? 0);
+  }
+  return difference === 0;
+}
+async function authenticated(request, token) {
+  const credential = request.headers.get("authorization") ?? "";
+  const suppliedToken = credential.startsWith("Bearer ") ? credential.slice("Bearer ".length) : "";
+  const [expectedDigest, suppliedDigest] = await Promise.all([digest(token), digest(suppliedToken)]);
+  return fixedLengthEqual(expectedDigest, suppliedDigest);
+}
+function boolFilter(value, name) {
+  if (value === null) return void 0;
+  if (value === "true") return true;
+  if (value === "false") return false;
+  throw new IncidentLifecycleError("incident_invalid_filter", 400, `${name} must be true or false`);
+}
+function parseFilters(url) {
+  const allowed = /* @__PURE__ */ new Set(["state", "owner", "unowned", "overdue", "observedAfterClose"]);
+  let unknown = false;
+  url.searchParams.forEach((_value, key) => {
+    if (!allowed.has(key)) unknown = true;
+  });
+  if (unknown) throw new IncidentLifecycleError("incident_invalid_filter", 400, "Unknown incident list filter");
+  const state = url.searchParams.get("state");
+  if (state !== null && !["OPEN", "ACKNOWLEDGED", "CORRECTION_RECORDED", "CLOSED", "REOPENED"].includes(state)) {
+    throw new IncidentLifecycleError("incident_invalid_filter", 400, "state is invalid");
+  }
+  const owner = url.searchParams.get("owner");
+  if (owner !== null) {
+    const normalizedOwner = owner.trim();
+    if (normalizedOwner.length === 0) {
+      throw new IncidentLifecycleError("incident_invalid_filter", 400, "owner must be non-empty");
+    }
+    if (new TextEncoder().encode(normalizedOwner).byteLength > 256) {
+      throw new IncidentLifecycleError("incident_invalid_filter", 400, "owner is too long");
+    }
+  }
+  const unowned = boolFilter(url.searchParams.get("unowned"), "unowned");
+  const overdue = boolFilter(url.searchParams.get("overdue"), "overdue");
+  const observedAfterClose = boolFilter(url.searchParams.get("observedAfterClose"), "observedAfterClose");
+  return {
+    ...state === null ? {} : { state },
+    ...owner === null ? {} : { owner: owner.trim() },
+    ...unowned === void 0 ? {} : { unowned },
+    ...overdue === void 0 ? {} : { overdue },
+    ...observedAfterClose === void 0 ? {} : { observedAfterClose }
+  };
+}
+function incidentIdentityFromPath(pathname) {
+  const encoded = pathname.slice("/maintenance/incidents/".length);
+  if (encoded.length === 0 || encoded.includes("/")) {
+    throw new IncidentLifecycleError("incident_route_not_found", 404, "Incident route not found");
+  }
+  try {
+    return normalizeIncidentIdentity(decodeURIComponent(encoded));
+  } catch {
+    throw new IncidentLifecycleError("incident_invalid_request", 400, "Incident identity must be URI encoded");
+  }
+}
+function isIncidentMaintenancePath(pathname) {
+  return pathname === "/maintenance/incidents" || pathname.startsWith("/maintenance/incidents/");
+}
+async function handleIncidentMaintenance(request, env, serviceIdentityProvider) {
+  const token = configuredToken(env.INCIDENT_MAINTAINER_TOKEN);
+  if (token === void 0) {
+    return error8(503, "incident_maintenance_unavailable", "Incident maintenance is not configured");
+  }
+  if (!await authenticated(request, token)) {
+    return error8(401, "incident_auth_required", "A valid incident maintenance bearer token is required");
+  }
+  let serviceId;
+  try {
+    serviceId = requestServiceIdentity(request, serviceIdentityProvider, {
+      allowG11Verification: env.G11_VERIFICATION_ENABLED === "true"
+    });
+  } catch {
+    return error8(503, "scope.identity_missing", "A deployment service identity is required for this scope");
+  }
+  if (env.D1 === void 0) {
+    return error8(503, "incident_maintenance_unavailable", "Incident maintenance storage is unavailable");
+  }
+  const lifecycle = new IncidentLifecycle(env.D1);
+  const url = new URL(request.url);
+  try {
+    if (request.method === "GET" && url.pathname === "/maintenance/incidents") {
+      return json10(await lifecycle.list(serviceId, parseFilters(url)));
+    }
+    if (request.method === "GET" && url.pathname.startsWith("/maintenance/incidents/")) {
+      return json10(await lifecycle.detail(serviceId, incidentIdentityFromPath(url.pathname)));
+    }
+    if (request.method === "POST" && url.pathname === "/maintenance/incidents/transitions") {
+      let body;
+      try {
+        body = await request.json();
+      } catch {
+        return error8(400, "incident_invalid_request", "Transition request must be JSON");
+      }
+      const requestValue = IncidentLifecycle.parseTransition(body);
+      const actor = request.headers.get("x-sdt-maintainer");
+      if (actor === null) {
+        return error8(400, "incident_invalid_actor", "x-sdt-maintainer is required");
+      }
+      return json10(await lifecycle.transition(serviceId, requestValue, actor));
+    }
+    return error8(404, "incident_route_not_found", "Incident maintenance route not found");
+  } catch (caught) {
+    if (caught instanceof IncidentLifecycleError) return error8(caught.status, caught.code, caught.message);
+    return error8(500, "incident_maintenance_failed", "Incident maintenance could not complete the request");
+  }
+}
+
 // src/downstream/Doorbell.ts
 var MAX_SERVICE_BINDING_INVOCATIONS_PER_REQUEST = 32;
-function classifyDirectDoorbellFailure(error10) {
-  const structured = typeof error10 === "object" && error10 !== null ? error10 : {};
+function classifyDirectDoorbellFailure(error11) {
+  const structured = typeof error11 === "object" && error11 !== null ? error11 : {};
   const status = typeof structured.status === "number" ? structured.status : typeof structured.statusCode === "number" ? structured.statusCode : void 0;
   if (status !== void 0 && (status < 200 || status >= 300)) return "non-2xx";
-  const value = String(error10).toLowerCase();
+  const value = String(error11).toLowerCase();
   const code = `${String(structured.code ?? "")} ${String(structured.name ?? "")}`.toLowerCase();
   if (value.includes("timeout") || value.includes("deadline") || code.includes("timeout")) return "timeout";
   if (value.includes("cancel") || value.includes("abort") || code.includes("abort")) return "cancel";
@@ -12815,6 +13720,7 @@ var TAG_SQL_SCHEMA_DDL = `
     committed_event_count INTEGER NOT NULL,
     head_suid TEXT NOT NULL,
     reservation_confirmed INTEGER NOT NULL CHECK (reservation_confirmed IN (0, 1)),
+    written_version INTEGER NOT NULL,
     PRIMARY KEY (attempt_id, epoch)
   );
 
@@ -12865,6 +13771,12 @@ var TAG_READ_AFTER_THROUGH_SQL = `
 `;
 function initializeTagSqlSchema(sql) {
   sql.exec(TAG_SQL_SCHEMA_DDL);
+  ensureTagCommitReceiptWrittenVersion(sql);
+}
+function ensureTagCommitReceiptWrittenVersion(sql) {
+  const columns = sql.exec("SELECT name FROM pragma_table_info('tag_commit_receipt')").toArray();
+  if (columns.some((column) => column.name === "written_version")) return;
+  sql.exec("ALTER TABLE tag_commit_receipt ADD COLUMN written_version INTEGER");
 }
 function hasTagSqlStorage(storage) {
   return typeof storage.sql?.exec === "function";
@@ -13042,8 +13954,8 @@ function asNumber2(value, name) {
   if (!Number.isSafeInteger(number)) throw new Error(`D1 ${name} was not a safe integer`);
   return number;
 }
-function errorText3(error10) {
-  return (error10 instanceof Error ? error10.message : String(error10)).slice(0, 256);
+function errorText3(error11) {
+  return (error11 instanceof Error ? error11.message : String(error11)).slice(0, 256);
 }
 function sortedUnique2(values) {
   return [...new Set(values)].sort((left, right) => binaryCompare(left, right));
@@ -13230,8 +14142,8 @@ var D1EventStore = class {
     let failure3;
     try {
       result2 = await this.recordDeliveryCore(message, arrivedAt, deliverySource, mutationAttemptId);
-    } catch (error10) {
-      failure3 = { error: error10 };
+    } catch (error11) {
+      failure3 = { error: error11 };
     }
     const retryReason = failure3 === void 0 ? null : errorText3(failure3.error);
     const suppressDiagnostic = failure3?.error instanceof D1IdentityConflictError && failure3.error.beforeMutation;
@@ -13802,8 +14714,8 @@ var D1EventStore = class {
       if (replay === null || replay === void 0) return finish({ kind: "miss" });
       const event = await this.eventById(serviceId, asString3(replay.event_id, "replay.event_id"));
       return event === void 0 ? finish({ kind: "unknown", reason: "replay-event-row-disappeared" }) : finish({ kind: "replay", event });
-    } catch (error10) {
-      return finish({ kind: "unknown", reason: errorText3(error10) });
+    } catch (error11) {
+      return finish({ kind: "unknown", reason: errorText3(error11) });
     }
   }
   /**
@@ -14278,8 +15190,8 @@ var D1EventStore = class {
     try {
       try {
         await this.options.beforeG69AdmissionAttempt?.();
-      } catch (error10) {
-        await appendFailedDiagnostic(errorText3(error10));
+      } catch (error11) {
+        await appendFailedDiagnostic(errorText3(error11));
         return;
       }
       const afterObservedAt = Date.now();
@@ -14353,14 +15265,14 @@ var TagIdentityConflict = class extends Error {
     this.name = "TagIdentityConflict";
   }
 };
-function json10(body, status = 200) {
+function json11(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "content-type": "application/json; charset=utf-8" }
   });
 }
-function error8(status, code, message, retryable = false) {
-  return json10(retryable ? { error: message, code, retryable: true } : { error: message, code }, status);
+function error9(status, code, message, retryable = false) {
+  return json11(retryable ? { error: message, code, retryable: true } : { error: message, code }, status);
 }
 function withGlobalAdmission2(response3, status) {
   response3.headers.set(G65_GLOBAL_ADMISSION_HEADER, status);
@@ -14379,7 +15291,7 @@ function repairRejected(reason, status = 409) {
     body: { code: "repair_operation_rejected", error: reason, reason }
   };
 }
-function isObject11(value) {
+function isObject12(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isNonEmptyString11(value) {
@@ -14424,8 +15336,8 @@ function sqlJson(value, column) {
     throw new Error(`Tag SQL column ${column} is not valid JSON`);
   }
 }
-function copyArrayBuffer(bytes) {
-  return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+function copyArrayBuffer(bytes2) {
+  return bytes2.buffer.slice(bytes2.byteOffset, bytes2.byteOffset + bytes2.byteLength);
 }
 function arrayBufferBase642(value) {
   let binary = "";
@@ -14436,7 +15348,7 @@ function nowIso() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
 function epochFrom(value) {
-  if (!isObject11(value) || !isNonEmptyString11(value.attemptId) || !isEpoch(value.epoch)) {
+  if (!isObject12(value) || !isNonEmptyString11(value.attemptId) || !isEpoch(value.epoch)) {
     return { error: "attemptId and a non-negative safe-integer epoch are required" };
   }
   return { value: { attemptId: value.attemptId, epoch: value.epoch } };
@@ -14456,7 +15368,7 @@ function consistencyTagsFrom(value) {
   }
   const entries = [];
   for (const rawEntry of value) {
-    if (!isObject11(rawEntry) || !isNonEmptyString11(rawEntry.tag)) {
+    if (!isObject12(rawEntry) || !isNonEmptyString11(rawEntry.tag)) {
       return { error: "each consistency tag needs a non-empty tag" };
     }
     if (!("lastSortableUniqueId" in rawEntry)) {
@@ -14484,7 +15396,7 @@ function consistencyTagsFrom(value) {
 }
 function acquireFrom(value, tag) {
   const epoch2 = epochFrom(value);
-  if (epoch2.value === void 0 || !isObject11(value)) {
+  if (epoch2.value === void 0 || !isObject12(value)) {
     return { error: epoch2.error ?? "Invalid acquire request" };
   }
   const eventTags = stringArrayFrom(value.eventTags, "eventTags");
@@ -14507,7 +15419,7 @@ function acquireFrom(value, tag) {
 }
 function reservationFrom(value) {
   const epoch2 = epochFrom(value);
-  if (epoch2.value === void 0 || !isObject11(value)) {
+  if (epoch2.value === void 0 || !isObject12(value)) {
     return { error: epoch2.error ?? "Invalid reservation request" };
   }
   if (value.reservationToken !== void 0 && !isNonEmptyString11(value.reservationToken)) {
@@ -14526,7 +15438,7 @@ function reservationFrom(value) {
 }
 function appendFrom(value, tag) {
   const reservation = reservationFrom(value);
-  if (reservation.value === void 0 || !isObject11(value) || !Array.isArray(value.candidates)) {
+  if (reservation.value === void 0 || !isObject12(value) || !Array.isArray(value.candidates)) {
     return { error: reservation.error ?? "candidates must be an array" };
   }
   if (value.candidates.length === 0) {
@@ -14534,7 +15446,7 @@ function appendFrom(value, tag) {
   }
   const candidates = [];
   for (const rawCandidate of value.candidates) {
-    if (!isObject11(rawCandidate) || !isNonEmptyString11(rawCandidate.eventId) || !isNonEmptyString11(rawCandidate.suid) || typeof rawCandidate.payload !== "string") {
+    if (!isObject12(rawCandidate) || !isNonEmptyString11(rawCandidate.eventId) || !isNonEmptyString11(rawCandidate.suid) || typeof rawCandidate.payload !== "string") {
       return { error: "each candidate needs eventId, suid, and payload" };
     }
     const eventTags = stringArrayFrom(rawCandidate.eventTags, "candidate eventTags");
@@ -14548,8 +15460,8 @@ function appendFrom(value, tag) {
       assertSortableUniqueId(rawCandidate.suid);
       if (!isUuidV7(rawCandidate.eventId)) return { error: "candidate eventId must be a UUID v7" };
       JSON.parse(rawCandidate.payload);
-    } catch (error10) {
-      return { error: error10 instanceof Error ? error10.message : "candidate identity or payload is invalid" };
+    } catch (error11) {
+      return { error: error11 instanceof Error ? error11.message : "candidate identity or payload is invalid" };
     }
     if (rawCandidate.provenance !== "g32") return { error: "candidate provenance must be g32" };
     if (!isNonEmptyString11(rawCandidate.allocatorLineageId)) return { error: "candidate allocatorLineageId is required" };
@@ -14583,10 +15495,10 @@ function appendFrom(value, tag) {
   return { value: { ...reservation.value, candidates: ordered, faultInjection } };
 }
 function bootstrapAppendFrom(value, tag) {
-  if (!isObject11(value) || !isNonEmptyString11(value.importId) || !isEpoch(value.leaseEpoch) || !isNonEmptyString11(value.manifestDigest) || !isNonEmptyString11(value.targetServiceId) || !Array.isArray(value.candidates) || value.candidates.length === 0) return { error: "bootstrap identity and candidates are required" };
+  if (!isObject12(value) || !isNonEmptyString11(value.importId) || !isEpoch(value.leaseEpoch) || !isNonEmptyString11(value.manifestDigest) || !isNonEmptyString11(value.targetServiceId) || !Array.isArray(value.candidates) || value.candidates.length === 0) return { error: "bootstrap identity and candidates are required" };
   const candidates = [];
   for (const candidate of value.candidates) {
-    if (!isObject11(candidate) || !isNonEmptyString11(candidate.eventId) || !isNonEmptyString11(candidate.suid) || typeof candidate.payload !== "string") return { error: "bootstrap candidate is invalid" };
+    if (!isObject12(candidate) || !isNonEmptyString11(candidate.eventId) || !isNonEmptyString11(candidate.suid) || typeof candidate.payload !== "string") return { error: "bootstrap candidate is invalid" };
     const tags = stringArrayFrom(candidate.eventTags, "bootstrap candidate eventTags");
     if (tags.value === void 0 || !tags.value.includes(tag) || !isNonEmptyString11(candidate.allocatorLineageId)) return { error: "bootstrap candidate must include this tag and lineage" };
     let eventType;
@@ -14596,8 +15508,8 @@ function bootstrapAppendFrom(value, tag) {
       assertSortableUniqueId(candidate.suid);
       if (!isRfc4122Uuid(candidate.eventId)) return { error: "bootstrap candidate eventId must be an RFC 4122 UUID" };
       JSON.parse(candidate.payload);
-    } catch (error10) {
-      return { error: error10 instanceof Error ? error10.message : "bootstrap candidate identity or payload is invalid" };
+    } catch (error11) {
+      return { error: error11 instanceof Error ? error11.message : "bootstrap candidate identity or payload is invalid" };
     }
     if (candidate.provenance !== "g32") return { error: "bootstrap candidate provenance must be g32" };
     if (!isNonEmptyString11(candidate.timestamp) || !CANONICAL_UTC_TIMESTAMP_PATTERN.test(candidate.timestamp)) return { error: "bootstrap candidate timestamp must be canonical UTC" };
@@ -14609,13 +15521,13 @@ function bootstrapAppendFrom(value, tag) {
 }
 function fenceFrom(value) {
   const epoch2 = epochFrom(value);
-  if (epoch2.value === void 0 || !isObject11(value) || !isNonEmptyString11(value.reason)) {
+  if (epoch2.value === void 0 || !isObject12(value) || !isNonEmptyString11(value.reason)) {
     return { error: epoch2.error ?? "reason is required" };
   }
   return { value: { ...epoch2.value, reason: value.reason } };
 }
 function repairScopeItemFrom(value, tag) {
-  if (!isObject11(value) || !isNonEmptyString11(value.attemptId) || !isNonEmptyString11(value.eventId) || !isNonEmptyString11(value.suid) || typeof value.payload !== "string" || !isNonEmptyString11(value.allocatorLineageId) || !isNonEmptyString11(value.eventType) || value.provenance !== "g32" || !isNonEmptyString11(value.timestamp)) {
+  if (!isObject12(value) || !isNonEmptyString11(value.attemptId) || !isNonEmptyString11(value.eventId) || !isNonEmptyString11(value.suid) || typeof value.payload !== "string" || !isNonEmptyString11(value.allocatorLineageId) || !isNonEmptyString11(value.eventType) || value.provenance !== "g32" || !isNonEmptyString11(value.timestamp)) {
     return { error: "each repair scope item needs attemptId, eventId, suid, and payload" };
   }
   const eventTags = stringArrayFrom(value.eventTags, "repair eventTags");
@@ -14663,13 +15575,13 @@ function repairScopeFrom(value, tag) {
   return { value: sortRepairScope(scope) };
 }
 function repairLeaseFrom(value) {
-  if (!isObject11(value) || !isNonEmptyString11(value.owner) || !isEpoch(value.epoch)) {
+  if (!isObject12(value) || !isNonEmptyString11(value.owner) || !isEpoch(value.epoch)) {
     return { error: "repair owner and non-negative safe-integer epoch are required" };
   }
   return { value: { owner: value.owner, epoch: value.epoch } };
 }
 function repairAcquireFrom(value, tag) {
-  if (!isObject11(value) || !isNonEmptyString11(value.owner)) {
+  if (!isObject12(value) || !isNonEmptyString11(value.owner)) {
     return { error: "repair owner is required" };
   }
   const leaseMs = value.leaseMs ?? DEFAULT_REPAIR_LEASE_MS;
@@ -14681,7 +15593,7 @@ function repairAcquireFrom(value, tag) {
 }
 function repairScopeUnionFrom(value, tag) {
   const lease = repairLeaseFrom(value);
-  if (lease.value === void 0 || !isObject11(value)) {
+  if (lease.value === void 0 || !isObject12(value)) {
     return { error: lease.error };
   }
   const scope = repairScopeFrom(value.scope, tag);
@@ -14689,7 +15601,7 @@ function repairScopeUnionFrom(value, tag) {
 }
 function repairApplyFrom(value, tag) {
   const lease = repairLeaseFrom(value);
-  if (lease.value === void 0 || !isObject11(value)) {
+  if (lease.value === void 0 || !isObject12(value)) {
     return { error: lease.error };
   }
   const item = repairScopeItemFrom(value.item, tag);
@@ -14697,20 +15609,20 @@ function repairApplyFrom(value, tag) {
 }
 function repairAuditFrom(value, tag) {
   const apply = repairApplyFrom(value, tag);
-  if (apply.value === void 0 || !isObject11(value) || !isNonEmptyString11(value.actor)) {
+  if (apply.value === void 0 || !isObject12(value) || !isNonEmptyString11(value.actor)) {
     return { error: apply.error ?? "audit actor is required" };
   }
   return { value: { ...apply.value, actor: value.actor } };
 }
 function repairClearFrom(value) {
   const lease = repairLeaseFrom(value);
-  if (lease.value === void 0 || !isObject11(value) || !isNonEmptyString11(value.attemptId) || !isNonNegativeInteger4(value.scopeVersion)) {
+  if (lease.value === void 0 || !isObject12(value) || !isNonEmptyString11(value.attemptId) || !isNonNegativeInteger4(value.scopeVersion)) {
     return { error: lease.error ?? "attemptId and scopeVersion are required" };
   }
   return { value: { ...lease.value, attemptId: value.attemptId, scopeVersion: value.scopeVersion } };
 }
 function outboxPendingFrom(value) {
-  if (!isObject11(value)) {
+  if (!isObject12(value)) {
     return { error: "outbox pending request must be an object" };
   }
   const nowMs = value.nowMs ?? Date.now();
@@ -14728,22 +15640,22 @@ function outboxPendingFrom(value) {
   return { value: { nowMs, limit, force } };
 }
 function outboxMarkFrom(value) {
-  if (!isObject11(value) || !Array.isArray(value.deliveries) || value.deliveries.length === 0) {
+  if (!isObject12(value) || !Array.isArray(value.deliveries) || value.deliveries.length === 0) {
     return { error: "deliveries must be a non-empty array" };
   }
   const deliveries = [];
   for (const raw of value.deliveries) {
-    if (!isObject11(raw) || !isNonEmptyString11(raw.attemptId) || !isNonEmptyString11(raw.eventId) || !isNonEmptyString11(raw.suid) || typeof raw.payload !== "string" || !isSafeInteger(raw.enqueuedAt)) {
+    if (!isObject12(raw) || !isNonEmptyString11(raw.attemptId) || !isNonEmptyString11(raw.eventId) || !isNonEmptyString11(raw.suid) || typeof raw.payload !== "string" || !isSafeInteger(raw.enqueuedAt)) {
       return { error: "each delivery needs attemptId, eventId, suid, payload, and enqueuedAt" };
     }
     if (!isNonEmptyString11(raw.eventType) || raw.provenance !== "g32" || !isNonEmptyString11(raw.timestamp) || !isNonEmptyString11(raw.allocatorLineageId)) return { error: "delivery must carry the complete G32 identity" };
-    if (!isObject11(raw.completeness)) {
+    if (!isObject12(raw.completeness)) {
       return { error: "delivery must carry a readable global receipt/membership join proof" };
     }
     const completeness = raw.completeness;
     const obligationSequence = completeness.obligationSequence;
     const memberships = completeness.localCommittedMembership;
-    if (!isNonEmptyString11(completeness.eventDigest) || !isSafeInteger(obligationSequence) || obligationSequence < 1 || !Array.isArray(memberships) || memberships.length !== 1 || !isObject11(memberships[0]) || memberships[0].eventId !== raw.eventId || typeof memberships[0].tag !== "string") {
+    if (!isNonEmptyString11(completeness.eventDigest) || !isSafeInteger(obligationSequence) || obligationSequence < 1 || !Array.isArray(memberships) || memberships.length !== 1 || !isObject12(memberships[0]) || memberships[0].eventId !== raw.eventId || typeof memberships[0].tag !== "string") {
       return { error: "delivery must carry a readable global receipt/membership join proof" };
     }
     const membership = memberships[0];
@@ -14782,7 +15694,7 @@ function outboxMarkFrom(value) {
   return { value: { deliveries, nowMs } };
 }
 function g44SourceScanFrom(value) {
-  if (!isObject11(value) || !isNonEmptyString11(value.serviceId) || !isNonEmptyString11(value.tag) || !isSafeInteger(value.upperBoundSequence) || value.upperBoundSequence < 0 || !isSafeInteger(value.afterSequence) || value.afterSequence < 0 || !isSafeInteger(value.limit) || value.limit < 1 || value.limit > 256) {
+  if (!isObject12(value) || !isNonEmptyString11(value.serviceId) || !isNonEmptyString11(value.tag) || !isSafeInteger(value.upperBoundSequence) || value.upperBoundSequence < 0 || !isSafeInteger(value.afterSequence) || value.afterSequence < 0 || !isSafeInteger(value.limit) || value.limit < 1 || value.limit > 256) {
     return { error: "source scan needs serviceId, tag, and a bounded compound cursor" };
   }
   return {
@@ -14796,7 +15708,7 @@ function g44SourceScanFrom(value) {
   };
 }
 function g46TagStateSourceFrom(value) {
-  if (!isObject11(value) || !isNonEmptyString11(value.tag) || typeof value.cursor !== "string" || !isSafeInteger(value.limit) || value.limit < 1 || value.limit > 256 || value.through !== void 0 && typeof value.through !== "string") {
+  if (!isObject12(value) || !isNonEmptyString11(value.tag) || typeof value.cursor !== "string" || !isSafeInteger(value.limit) || value.limit < 1 || value.limit > 256 || value.through !== void 0 && typeof value.through !== "string") {
     return { error: "G46 source read needs tag, cursor, optional through, and a bounded limit" };
   }
   try {
@@ -14970,8 +15882,8 @@ function logicalNow(record) {
   return record.clockNowMs ?? Date.now() + record.clockOffsetMs;
 }
 function expireReservation(record) {
-  const active = record.activeReservation;
-  if (active === null || active.expiresAt > logicalNow(record)) {
+  const active2 = record.activeReservation;
+  if (active2 === null || active2.expiresAt > logicalNow(record)) {
     return { record, expired: false };
   }
   return {
@@ -15089,7 +16001,7 @@ var TagDurableObject = class {
     const url = new URL(request.url);
     const tag = url.searchParams.get("__tag");
     if (!isNonEmptyString11(tag)) {
-      return error8(400, "tag_identity_required", "Tag identity is required");
+      return error9(400, "tag_identity_required", "Tag identity is required");
     }
     const serviceId = url.searchParams.get("__serviceId");
     if (request.method === "GET" && url.pathname === "/head-facts") {
@@ -15097,10 +16009,10 @@ var TagDurableObject = class {
         observation.markFirstStorageRead();
         try {
           const facts = this.readHeadFacts(tag);
-          return facts === void 0 ? error8(404, "tag_not_found", "Tag has no durable state yet") : json10(facts);
+          return facts === void 0 ? error9(404, "tag_not_found", "Tag has no durable state yet") : json11(facts);
         } catch (caught) {
           if (caught instanceof TagIdentityConflict) {
-            return error8(409, "tag_identity_conflict", "Tag Durable Object identity changed");
+            return error9(409, "tag_identity_conflict", "Tag Durable Object identity changed");
           }
           throw caught;
         }
@@ -15111,9 +16023,9 @@ var TagDurableObject = class {
         observation.markFirstStorageRead();
         const record = this.readStoredRecord(tag);
         if (record === void 0) {
-          return error8(404, "tag_not_found", "Tag has no durable state yet");
+          return error9(404, "tag_not_found", "Tag has no durable state yet");
         }
-        return record.tag === tag ? json10(requireG32TagRecord(record)) : error8(409, "tag_identity_conflict", "Tag Durable Object identity changed");
+        return record.tag === tag ? json11(requireG32TagRecord(record)) : error9(409, "tag_identity_conflict", "Tag Durable Object identity changed");
       });
     }
     if (request.method === "GET" && url.pathname === "/repair/facts") {
@@ -15121,7 +16033,7 @@ var TagDurableObject = class {
     }
     if (request.method === "POST" && url.pathname === "/debug/alarm") {
       const record = await this.runAlarm();
-      return record === void 0 ? error8(404, "tag_not_found", "Tag has no durable state yet") : json10(record);
+      return record === void 0 ? error9(404, "tag_not_found", "Tag has no durable state yet") : json11(record);
     }
     if (request.method === "POST" && url.pathname === "/acquire") {
       return this.traceCommitActor(request, tag, serviceId, activation, observation, (body2) => this.acquire(tag, body2, observation));
@@ -15144,37 +16056,37 @@ var TagDurableObject = class {
     }
     const body = await this.jsonBody(request);
     if (body === void 0) {
-      return error8(400, "malformed_tag_request", "Request body must be JSON");
+      return error9(400, "malformed_tag_request", "Request body must be JSON");
     }
     if (request.method === "POST" && url.pathname === "/__internal/g46/tag-state-incremental") {
       if (request.headers.get("x-sdt-g46-source-read") !== "1") {
-        return error8(403, "g46_source_read_forbidden", "G46 source reads require the TagState adapter");
+        return error9(403, "g46_source_read_forbidden", "G46 source reads require the TagState adapter");
       }
       const parsed = g46TagStateSourceFrom(body);
       if (parsed.value === void 0 || parsed.value.tag !== tag) {
-        return error8(400, "g46_source_read_invalid", parsed.error ?? "G46 source read is invalid");
+        return error9(400, "g46_source_read_invalid", parsed.error ?? "G46 source read is invalid");
       }
       try {
-        return json10(await this.g43TagStateIncrementalCatchUp(parsed.value));
+        return json11(await this.g43TagStateIncrementalCatchUp(parsed.value));
       } catch (caught) {
         if (caught instanceof TagIdentityConflict) {
-          return error8(409, "tag_identity_conflict", "Tag Durable Object identity changed");
+          return error9(409, "tag_identity_conflict", "Tag Durable Object identity changed");
         }
-        return error8(503, "g46_source_read_unavailable", caught instanceof Error ? caught.message : "G46 source read is unavailable");
+        return error9(503, "g46_source_read_unavailable", caught instanceof Error ? caught.message : "G46 source read is unavailable");
       }
     }
     if (request.method === "POST" && url.pathname === "/__internal/g44/source-obligations") {
       if (request.headers.get("x-sdt-g44-source-scan") !== "1") {
-        return error8(403, "g44_source_scan_forbidden", "G44 source scan requires the internal scanner seam");
+        return error9(403, "g44_source_scan_forbidden", "G44 source scan requires the internal scanner seam");
       }
       const parsed = g44SourceScanFrom(body);
       if (parsed.value === void 0 || parsed.value.tag !== tag || parsed.value.serviceId !== serviceId) {
-        return error8(400, "g44_source_scan_invalid", parsed.error ?? "G44 source scan identity is invalid");
+        return error9(400, "g44_source_scan_invalid", parsed.error ?? "G44 source scan identity is invalid");
       }
       try {
-        return json10(await this.g44ReadSourceObligations(parsed.value));
+        return json11(await this.g44ReadSourceObligations(parsed.value));
       } catch (failure3) {
-        return error8(503, "g44_source_scan_unavailable", failure3 instanceof Error ? failure3.message : "G44 source scan is unavailable");
+        return error9(503, "g44_source_scan_unavailable", failure3 instanceof Error ? failure3.message : "G44 source scan is unavailable");
       }
     }
     if (request.method === "POST" && url.pathname === "/bootstrap/admit") {
@@ -15221,7 +16133,7 @@ var TagDurableObject = class {
     }
     if (request.method === "POST" && url.pathname === "/__internal/g77/inspect-target") {
       if (!isNonEmptyString11(serviceId)) {
-        return error8(400, "service_identity_required", "Service identity is required");
+        return error9(400, "service_identity_required", "Service identity is required");
       }
       return this.inspectG77Target(serviceId, tag, body);
     }
@@ -15229,28 +16141,28 @@ var TagDurableObject = class {
       return this.fenceAbsentG77Target(tag, body);
     }
     if (request.method === "POST" && url.pathname === "/__internal/g77/capabilities") {
-      return json10({ inspectTarget: true, fenceAbsentTarget: true });
+      return json11({ inspectTarget: true, fenceAbsentTarget: true });
     }
-    return error8(404, "tag_route_not_found", "Tag route was not found");
+    return error9(404, "tag_route_not_found", "Tag route was not found");
   }
   /** Identity-bound installed/absent inspection for G77 issuance reconciliation. */
   inspectG77Target(serviceId, tag, body) {
-    if (!isObject11(body) || !isNonEmptyString11(body.eventId) || !isNonEmptyString11(body.suid)) {
-      return error8(400, "invalid_inspect_target", "eventId and suid are required");
+    if (!isObject12(body) || !isNonEmptyString11(body.eventId) || !isNonEmptyString11(body.suid)) {
+      return error9(400, "invalid_inspect_target", "eventId and suid are required");
     }
     const pinnedWriterEpoch = isNonNegativeInteger4(body.pinnedWriterEpoch) ? body.pinnedWriterEpoch : 0;
     const attemptId = isNonEmptyString11(body.attemptId) ? body.attemptId : void 0;
     const sql = this.sqlStorage();
-    if (sql === void 0) return error8(503, "tag_sql_unavailable", "Tag SQL storage is unavailable");
+    if (sql === void 0) return error9(503, "tag_sql_unavailable", "Tag SQL storage is unavailable");
     const identity2 = sql.exec("SELECT tag FROM tag_identity WHERE singleton = 1").toArray()[0];
     if (identity2 === void 0) {
       if (attemptId !== void 0) {
-        return json10({ inspectionStatus: "absent-never-contacted" });
+        return json11({ inspectionStatus: "absent-never-contacted" });
       }
-      return error8(409, "target_not_terminal", "Target is not terminal under pinned writer authority");
+      return error9(409, "target_not_terminal", "Target is not terminal under pinned writer authority");
     }
     if (sqlString(identity2.tag, "tag_identity.tag") !== tag) {
-      return error8(409, "tag_identity_mismatch", "Tag identity does not match the inspected tag");
+      return error9(409, "tag_identity_mismatch", "Tag identity does not match the inspected tag");
     }
     const event = sql.exec(`
       SELECT attempt_id, event_id, suid FROM tag_event
@@ -15263,41 +16175,41 @@ var TagDurableObject = class {
       `, serviceId, body.eventId).toArray()[0];
       if (obligation !== void 0) {
         const obligationDigest = sqlString(obligation.event_digest, "tag_outbox_obligation.event_digest");
-        return json10({
+        return json11({
           terminalStatus: "installed-and-covered",
           eventId: body.eventId,
           obligationDigest
         });
       }
-      return error8(409, "target_not_terminal", "Target append is in flight under pinned writer authority");
+      return error9(409, "target_not_terminal", "Target append is in flight under pinned writer authority");
     }
     if (attemptId !== void 0) {
       const tombstone = sql.exec("SELECT epoch FROM tag_tombstone WHERE attempt_id = ?", attemptId).toArray()[0];
       const tombstoneEpoch = tombstone === void 0 ? void 0 : sqlNumber(tombstone.epoch, "tag_tombstone.epoch");
       if (tombstoneEpoch !== void 0 && pinnedWriterEpoch <= tombstoneEpoch) {
-        return json10({ terminalStatus: "absent-and-irrevocably-fenced", tombstoneEpoch });
+        return json11({ terminalStatus: "absent-and-irrevocably-fenced", tombstoneEpoch });
       }
       const reservation = sql.exec("SELECT attempt_id, expires_at FROM tag_reservation WHERE singleton = 1").toArray()[0];
       if (reservation !== void 0 && sqlString(reservation.attempt_id, "tag_reservation.attempt_id") === attemptId) {
-        return error8(409, "target_not_terminal", "Active reservation holds writer authority");
+        return error9(409, "target_not_terminal", "Active reservation holds writer authority");
       }
       const epoch2 = sql.exec("SELECT attempt_id FROM tag_epoch WHERE attempt_id = ?", attemptId).toArray()[0];
       if (epoch2 !== void 0) {
-        return json10({ inspectionStatus: "absent-but-unfenced" });
+        return json11({ inspectionStatus: "absent-but-unfenced" });
       }
-      return json10({ inspectionStatus: "absent-never-contacted" });
+      return json11({ inspectionStatus: "absent-never-contacted" });
     }
-    return error8(409, "target_not_terminal", "Target is not terminal under pinned writer authority");
+    return error9(409, "target_not_terminal", "Target is not terminal under pinned writer authority");
   }
   /** Reconciler-only fence for never-contacted targets; creates durable tombstone state. */
   async fenceAbsentG77Target(tag, body) {
     const parsed = reservationFrom(body);
     if (parsed.value === void 0) {
-      return error8(400, "invalid_fence_target", parsed.error ?? "attemptId and epoch are required");
+      return error9(400, "invalid_fence_target", parsed.error ?? "attemptId and epoch are required");
     }
     this.ensureSqlTag(tag);
     const result2 = await this.cancelSql(tag, { ...parsed.value, forceTombstone: true });
-    return result2.status >= 200 && result2.status < 300 ? json10(result2.body) : error8(result2.status, "fence_target_rejected", "Absent target fence was rejected");
+    return result2.status >= 200 && result2.status < 300 ? json11(result2.body) : error9(result2.status, "fence_target_rejected", "Absent target fence was rejected");
   }
   async alarm() {
     this.activation.beginHandler();
@@ -15644,21 +16556,21 @@ var TagDurableObject = class {
       const result2 = await authority;
       g44GlobalArrayAuthorityResultByD1.set(database, result2);
       return result2;
-    } catch (error10) {
+    } catch (error11) {
       if (g44GlobalArrayAuthorityByD1.get(database) === authority) {
         g44GlobalArrayAuthorityByD1.delete(database);
       }
-      throw error10;
+      throw error11;
     }
   }
   async readG44GlobalArrayAuthority(database) {
     try {
       await database.prepare('SELECT "EventDigest" FROM dcb_events WHERE 1 = 0').all();
       return true;
-    } catch (error10) {
-      const message = error10 instanceof Error ? error10.message : String(error10);
+    } catch (error11) {
+      const message = error11 instanceof Error ? error11.message : String(error11);
       if (/no such (?:table|column):\s*(?:dcb_events|EventDigest)/i.test(message)) return false;
-      throw error10;
+      throw error11;
     }
   }
   async traceCommitActor(request, tag, serviceId, activation, observation, callback) {
@@ -15668,10 +16580,10 @@ var TagDurableObject = class {
       { actorClass: "TAG", actorKey: `tag:${serviceId}:${tag}`, activation, observation },
       async () => {
         body = await this.jsonBody(request);
-        const attemptId = isObject11(body) && isNonEmptyString11(body.attemptId) ? body.attemptId : void 0;
+        const attemptId = isObject12(body) && isNonEmptyString11(body.attemptId) ? body.attemptId : void 0;
         return attemptId === void 0 || !isNonEmptyString11(serviceId) ? void 0 : { attemptId, serviceId };
       },
-      async () => body === void 0 ? error8(400, "malformed_tag_request", "Request body must be JSON") : callback(body)
+      async () => body === void 0 ? error9(400, "malformed_tag_request", "Request body must be JSON") : callback(body)
     );
   }
   /**
@@ -15885,6 +16797,7 @@ var TagDurableObject = class {
   ensureSqlTag(tag) {
     const sql = this.sqlStorage();
     if (sql === void 0) throw new Error("Tag SQL storage is unavailable");
+    ensureTagCommitReceiptWrittenVersion(sql);
     const existing = sql.exec("SELECT tag FROM tag_identity WHERE singleton = 1").toArray()[0];
     if (existing !== void 0) {
       if (sqlString(existing.tag, "tag_identity.tag") !== tag) throw new Error("Tag Durable Object identity changed");
@@ -15997,17 +16910,18 @@ var TagDurableObject = class {
     sql.exec("UPDATE tag_control SET head_suid = ?, version = ?, updated_at = ? WHERE singleton = 1", head, version, committedAt);
     sql.exec("UPDATE tag_head SET service_id = ?, head_suid = ? WHERE singleton = 1", serviceId, head);
   }
-  writeCommittedSqlReceipt(sql, input, committedAt, eventCount, head, confirmsReservation) {
+  writeCommittedSqlReceipt(sql, input, committedAt, eventCount, head, confirmsReservation, writtenVersion) {
     sql.exec(`
       INSERT INTO tag_commit_receipt
-        (attempt_id, epoch, committed_at, committed_event_count, head_suid, reservation_confirmed)
-      VALUES (?, ?, ?, ?, ?, ?)
+        (attempt_id, epoch, committed_at, committed_event_count, head_suid, reservation_confirmed, written_version)
+      VALUES (?, ?, ?, ?, ?, ?, ?)
       ON CONFLICT(attempt_id, epoch) DO UPDATE SET
         committed_at = excluded.committed_at,
         committed_event_count = excluded.committed_event_count,
         head_suid = excluded.head_suid,
-        reservation_confirmed = excluded.reservation_confirmed
-    `, input.attemptId, input.epoch, committedAt, eventCount, head, confirmsReservation ? 1 : 0);
+        reservation_confirmed = excluded.reservation_confirmed,
+        written_version = excluded.written_version
+    `, input.attemptId, input.epoch, committedAt, eventCount, head, confirmsReservation ? 1 : 0, writtenVersion);
   }
   /**
    * The normal append path deliberately probes only the indexed rows it needs
@@ -16049,11 +16963,29 @@ var TagDurableObject = class {
         return { event, obligation, exact };
       });
       if (existingCandidates.every(({ exact }) => exact)) {
-        return { status: 200, body: { status: "duplicate", version } };
+        const receipts = sql.exec(`
+          SELECT epoch, committed_at, written_version, head_suid FROM tag_commit_receipt
+          WHERE attempt_id = ?
+        `, input.attemptId).toArray();
+        const sameEpoch = receipts.find((row) => sqlNumber(row.epoch, "tag_commit_receipt.epoch") === input.epoch);
+        const replayHead = input.candidates.at(-1)?.suid;
+        const byHead = replayHead === void 0 ? [] : receipts.filter((row) => sqlString(row.head_suid, "tag_commit_receipt.head_suid") === replayHead);
+        const receipt = sameEpoch ?? (byHead.length === 1 ? byHead[0] : void 0) ?? (receipts.length === 1 ? receipts[0] : void 0);
+        if (receipt === void 0) {
+          await this.rearmScheduler(txn);
+          return { ...rejected("duplicate_receipt_missing"), body: { ...rejected("duplicate_receipt_missing").body, version } };
+        }
+        const storedAt = sqlNullableString(receipt.committed_at, "tag_commit_receipt.committed_at");
+        const storedVersion = sqlNullableNumber(receipt.written_version, "tag_commit_receipt.written_version");
+        if (storedAt === null || storedVersion === null) {
+          await this.rearmScheduler(txn);
+          return { ...rejected("duplicate_receipt_unknown"), body: { ...rejected("duplicate_receipt_unknown").body, version } };
+        }
+        return { status: 200, body: { status: "duplicate", version: storedVersion, updatedAt: storedAt } };
       }
-      const active = sql.exec("SELECT * FROM tag_reservation WHERE singleton = 1").toArray()[0];
+      const active2 = sql.exec("SELECT * FROM tag_reservation WHERE singleton = 1").toArray()[0];
       const now2 = sqlNullableNumber(control.clock_now_ms, "tag_control.clock_now_ms") ?? Date.now() + sqlNumber(control.clock_offset_ms, "tag_control.clock_offset_ms");
-      let reservation = active;
+      let reservation = active2;
       if (reservation !== void 0 && sqlNumber(reservation.expires_at, "tag_reservation.expires_at") <= now2) {
         sql.exec("DELETE FROM tag_reservation WHERE singleton = 1");
         version += 1;
@@ -16146,7 +17078,7 @@ var TagDurableObject = class {
       if (input.faultInjection === "after-append-before-confirm") {
         throw new AppendTransactionFault("Simulated interruption before atomic commit receipt");
       }
-      this.writeCommittedSqlReceipt(sql, input, committedAt, events.length, head, confirmsReservation);
+      this.writeCommittedSqlReceipt(sql, input, committedAt, events.length, head, confirmsReservation, version + 1);
       if (confirmsReservation) sql.exec("DELETE FROM tag_reservation WHERE singleton = 1");
       await this.rearmScheduler(txn);
       return {
@@ -16154,7 +17086,8 @@ var TagDurableObject = class {
         body: {
           status: "appended",
           fenceGate: { checked: true, activeFenceCount: 0 },
-          version: version + 1
+          version: version + 1,
+          updatedAt: committedAt
         },
         hopFacts
       };
@@ -16555,18 +17488,20 @@ var TagDurableObject = class {
       );
       this.upsertSourcePartitionRegistration(sql, eventServiceId, record.tag, outbox.eventId);
     }
+    ensureTagCommitReceiptWrittenVersion(sql);
     for (const confirmation of record.confirmations) {
       sql.exec(
         `
         INSERT OR IGNORE INTO tag_commit_receipt
-          (attempt_id, epoch, committed_at, committed_event_count, head_suid, reservation_confirmed)
-        VALUES (?, ?, ?, ?, ?, 1)
+          (attempt_id, epoch, committed_at, committed_event_count, head_suid, reservation_confirmed, written_version)
+        VALUES (?, ?, ?, ?, ?, 1, ?)
       `,
         confirmation.attemptId,
         confirmation.epoch,
         record.updatedAt,
         record.events.filter((event) => event.attemptId === confirmation.attemptId).length,
-        record.head
+        record.head,
+        record.version
       );
     }
   }
@@ -16615,13 +17550,13 @@ var TagDurableObject = class {
   async acquire(tag, body, observation) {
     const parsed = acquireFrom(body, tag);
     if (parsed.value === void 0) {
-      return error8(400, "invalid_tag_acquire", parsed.error ?? "Invalid acquire request");
+      return error9(400, "invalid_tag_acquire", parsed.error ?? "Invalid acquire request");
     }
     const input = parsed.value;
     observation?.markFirstStorageRead();
     if (this.sqlStorage() !== void 0) {
       const result3 = await this.acquireSql(tag, input);
-      return json10(result3.body, result3.status);
+      return json11(result3.body, result3.status);
     }
     const result2 = await this.ctx.storage.transaction(async (txn) => {
       const loaded = await this.recordFor(txn, tag);
@@ -16656,9 +17591,9 @@ var TagDurableObject = class {
           body: { ...rejected("consistency_head_mismatch").body, version: record.version }
         };
       }
-      const active = record.activeReservation;
-      if (active !== null) {
-        if (active.attemptId === input.attemptId && active.epoch === input.epoch) {
+      const active2 = record.activeReservation;
+      if (active2 !== null) {
+        if (active2.attemptId === input.attemptId && active2.epoch === input.epoch) {
           return {
             status: 200,
             body: {
@@ -16703,18 +17638,18 @@ var TagDurableObject = class {
         body: { status: "reserved", reservation, fenceGate, version: updated.version }
       };
     });
-    return json10(result2.body, result2.status);
+    return json11(result2.body, result2.status);
   }
   async cancel(tag, body, observation) {
     const parsed = reservationFrom(body);
     if (parsed.value === void 0) {
-      return error8(400, "invalid_tag_cancel", parsed.error ?? "Invalid cancel request");
+      return error9(400, "invalid_tag_cancel", parsed.error ?? "Invalid cancel request");
     }
     const input = parsed.value;
     observation?.markFirstStorageRead();
     if (this.sqlStorage() !== void 0) {
       const result3 = await this.cancelSql(tag, input);
-      return json10(result3.body, result3.status);
+      return json11(result3.body, result3.status);
     }
     const result2 = await this.ctx.storage.transaction(async (txn) => {
       const loaded = await this.recordFor(txn, tag);
@@ -16749,8 +17684,8 @@ var TagDurableObject = class {
         record = await this.commitExpiryIfNeeded(txn, expiry);
         return { ...rejected(epochError), body: { ...rejected(epochError).body, version: record.version } };
       }
-      const active = record.activeReservation;
-      if (active === null || active.attemptId !== input.attemptId || active.epoch !== input.epoch || active.token !== input.reservationToken) {
+      const active2 = record.activeReservation;
+      if (active2 === null || active2.attemptId !== input.attemptId || active2.epoch !== input.epoch || active2.token !== input.reservationToken) {
         record = await this.commitExpiryIfNeeded(txn, expiry);
         return {
           ...rejected("reservation_token_required"),
@@ -16765,12 +17700,12 @@ var TagDurableObject = class {
       });
       return { status: 200, body: { status: "cancelled", idempotent: false, version: updated.version } };
     });
-    return json10(result2.body, result2.status);
+    return json11(result2.body, result2.status);
   }
   async seal(tag, body, observation) {
     const parsed = epochFrom(body);
     if (parsed.value === void 0) {
-      return error8(400, "invalid_tag_seal", parsed.error ?? "Invalid seal request");
+      return error9(400, "invalid_tag_seal", parsed.error ?? "Invalid seal request");
     }
     const input = parsed.value;
     observation?.markFirstStorageRead();
@@ -16805,7 +17740,7 @@ var TagDurableObject = class {
       });
       return { status: 200, body: { status: "sealed", highestEpoch: input.epoch, version: updated.version } };
     });
-    return json10(result2.body, result2.status);
+    return json11(result2.body, result2.status);
   }
   /**
    * Coordinator-only import admission.  This is deliberately not a flag on
@@ -16814,8 +17749,8 @@ var TagDurableObject = class {
    */
   async bootstrapAppend(tag, body, serviceId) {
     const parsed = bootstrapAppendFrom(body, tag);
-    if (parsed.value === void 0) return error8(400, "invalid_bootstrap_admission", parsed.error ?? "Invalid bootstrap admission");
-    if (serviceId !== parsed.value.targetServiceId) return error8(409, "bootstrap_service_scope_mismatch", "Bootstrap target service does not match tag scope");
+    if (parsed.value === void 0) return error9(400, "invalid_bootstrap_admission", parsed.error ?? "Invalid bootstrap admission");
+    if (serviceId !== parsed.value.targetServiceId) return error9(409, "bootstrap_service_scope_mismatch", "Bootstrap target service does not match tag scope");
     const input = parsed.value;
     const result2 = await this.ctx.storage.transaction(async (txn) => {
       const loaded = await this.recordFor(txn, tag);
@@ -16836,10 +17771,10 @@ var TagDurableObject = class {
       );
       return { status: 201, body: { status: "bootstrap_admitted", version: updated.version } };
     });
-    return json10(result2.body, result2.status);
+    return json11(result2.body, result2.status);
   }
   async closeBootstrap(tag, body) {
-    if (!isObject11(body) || !isNonEmptyString11(body.importId) || !isEpoch(body.leaseEpoch)) return error8(400, "invalid_bootstrap_close", "bootstrap importId and leaseEpoch are required");
+    if (!isObject12(body) || !isNonEmptyString11(body.importId) || !isEpoch(body.leaseEpoch)) return error9(400, "invalid_bootstrap_close", "bootstrap importId and leaseEpoch are required");
     const result2 = await this.ctx.storage.transaction(async (txn) => {
       const loaded = await this.recordFor(txn, tag);
       const record = loaded.record;
@@ -16849,7 +17784,7 @@ var TagDurableObject = class {
       const updated = await this.commit(txn, record, { bootstrapAdmission: { ...admission, closed: true } });
       return { status: 200, body: { status: "closed", version: updated.version } };
     });
-    return json10(result2.body, result2.status);
+    return json11(result2.body, result2.status);
   }
   directDoorbellPreflight(domainDeliveryClass) {
     const domainClass = domainDeliveryClass === void 0 ? void 0 : readDomainDeliveryClass({ DOMAIN_DELIVERY_CLASS: domainDeliveryClass });
@@ -16868,7 +17803,7 @@ var TagDurableObject = class {
   async append(tag, body, serviceId, domainDeliveryClass, observation) {
     const parsed = appendFrom(body, tag);
     if (parsed.value === void 0) {
-      return error8(400, "invalid_tag_append", parsed.error ?? "Invalid append request");
+      return error9(400, "invalid_tag_append", parsed.error ?? "Invalid append request");
     }
     const input = parsed.value;
     try {
@@ -16906,7 +17841,7 @@ var TagDurableObject = class {
         if ((result3.status === 201 || result3.status === 200) && serviceId !== null && serviceId.length > 0 && sourcePartitionRegistration !== "unconfigured") {
           this.scheduleSourcePartitionWatermark(tag, serviceId);
         }
-        const response4 = json10(result3.body, result3.status);
+        const response4 = json11(result3.body, result3.status);
         if (result3.status === 201 && serviceId !== null && serviceId.length > 0 && this.env.AUTO_DRAIN_OUTBOX === "true" && (this.env.DOWNSTREAM_QUEUE !== void 0 || doorbellPreflight.status === "ready" && this.env.DOWNSTREAM_DOORBELL !== void 0)) {
           const directRows = doorbellPreflight.status === "ready" && this.env.DOWNSTREAM_DOORBELL !== void 0 ? await this.directDeliveryBeforeResponse(tag, serviceId) : void 0;
           if (sourcePartitionRegistration !== "unconfigured" || sourcePartitionWasRegistered) {
@@ -16923,7 +17858,19 @@ var TagDurableObject = class {
         const loaded = await this.recordFor(txn, tag);
         let record = loaded.record;
         if (batchIsExactDuplicate(record, input)) {
-          return { status: 200, body: { status: "duplicate", version: record.version } };
+          const receipts = record.writeReceipts ?? {};
+          const sameEpoch = receipts[`${input.attemptId}:${input.epoch}`];
+          const forAttempt = Object.entries(receipts).filter(([key]) => key.startsWith(`${input.attemptId}:`));
+          const replayHead = input.candidates.at(-1)?.suid;
+          const byHead = replayHead === void 0 ? [] : forAttempt.filter(([, value]) => value.headSuid === replayHead);
+          const receipt = sameEpoch ?? (byHead.length === 1 ? byHead[0]?.[1] : void 0) ?? (forAttempt.length === 1 ? forAttempt[0]?.[1] : void 0);
+          if (receipt === void 0) {
+            return {
+              ...rejected("duplicate_receipt_unknown"),
+              body: { ...rejected("duplicate_receipt_unknown").body, version: record.version }
+            };
+          }
+          return { status: 200, body: { status: "duplicate", version: receipt.version, updatedAt: receipt.updatedAt } };
         }
         const expiry = expireReservation(record);
         record = expiry.record;
@@ -16936,9 +17883,9 @@ var TagDurableObject = class {
           await this.commitExpiryIfNeeded(txn, expiry);
           return fenceGateRejected();
         }
-        const active = record.activeReservation;
-        const confirmsReservation = active !== null && active.attemptId === input.attemptId && active.epoch === input.epoch && active.token === input.reservationToken;
-        if (active !== null && (active.attemptId !== input.attemptId || active.epoch !== input.epoch || active.token !== input.reservationToken)) {
+        const active2 = record.activeReservation;
+        const confirmsReservation = active2 !== null && active2.attemptId === input.attemptId && active2.epoch === input.epoch && active2.token === input.reservationToken;
+        if (active2 !== null && (active2.attemptId !== input.attemptId || active2.epoch !== input.epoch || active2.token !== input.reservationToken)) {
           record = await this.commitExpiryIfNeeded(txn, expiry);
           return {
             ...rejected("reservation_token_required"),
@@ -17000,13 +17947,20 @@ var TagDurableObject = class {
           alarmDueAt: null,
           confirmations: confirmsReservation ? withMaxEpoch(record.confirmations, input.attemptId, input.epoch) : record.confirmations
         });
-        await this.write(txn, updated, serviceId ?? "");
+        const recorded = {
+          ...updated,
+          writeReceipts: {
+            ...record.writeReceipts ?? {},
+            [`${input.attemptId}:${input.epoch}`]: { version: updated.version, updatedAt: updated.updatedAt, headSuid: updated.head }
+          }
+        };
+        await this.write(txn, recorded, serviceId ?? "");
         return {
           status: 201,
-          body: { status: "appended", fenceGate, version: updated.version }
+          body: { status: "appended", fenceGate, version: recorded.version, updatedAt: recorded.updatedAt }
         };
       });
-      const response3 = json10(result2.body, result2.status);
+      const response3 = json11(result2.body, result2.status);
       if (result2.status === 201 && serviceId !== null && serviceId.length > 0 && this.env.AUTO_DRAIN_OUTBOX === "true" && (this.env.DOWNSTREAM_QUEUE !== void 0 || doorbellPreflight.status === "ready" && this.env.DOWNSTREAM_DOORBELL !== void 0)) {
         const directRows = doorbellPreflight.status === "ready" && this.env.DOWNSTREAM_DOORBELL !== void 0 ? await this.directDeliveryBeforeResponse(tag, serviceId) : void 0;
         withGlobalAdmission2(
@@ -17018,16 +17972,16 @@ var TagDurableObject = class {
       return response3;
     } catch (failure3) {
       if (failure3 instanceof PartitionRegistrationUnavailableError) {
-        return error8(503, "partition_registration_unavailable", "Source partition registration is unavailable; retry the commit.", true);
+        return error9(503, "partition_registration_unavailable", "Source partition registration is unavailable; retry the commit.", true);
       }
       if (failure3 instanceof AppendTransactionFault) {
-        return error8(
+        return error9(
           503,
           "simulated_append_crash",
           "Simulated interruption before atomic append and confirmation commit"
         );
       }
-      return error8(500, "tag_append_failure", "Tag append could not be persisted");
+      return error9(500, "tag_append_failure", "Tag append could not be persisted");
     }
   }
   /**
@@ -17143,7 +18097,7 @@ var TagDurableObject = class {
     let timer;
     const operationResult = Promise.resolve().then(operation).then(
       (value) => ({ status: "completed", value }),
-      (error10) => ({ status: "failed", error: error10 })
+      (error11) => ({ status: "failed", error: error11 })
     );
     const timeout = new Promise((resolve) => {
       timer = setTimeout(() => resolve({ status: "timeout" }), budgetMs);
@@ -17194,14 +18148,14 @@ var TagDurableObject = class {
           envelopeBytes,
           status: "success"
         });
-      } catch (error10) {
+      } catch (error11) {
         console.warn("direct_doorbell_status", {
           status: "queued-degraded",
           reason: "direct_doorbell_delivery_failed",
           correlationId,
           envelopeBytes,
-          failureKind: classifyDirectDoorbellFailure(error10),
-          error: String(error10)
+          failureKind: classifyDirectDoorbellFailure(error11),
+          error: String(error11)
         });
       }
     }
@@ -17262,7 +18216,7 @@ var TagDurableObject = class {
   async confirm(tag, body) {
     const parsed = reservationFrom(body);
     if (parsed.value === void 0) {
-      return error8(400, "invalid_tag_confirm", parsed.error ?? "Invalid confirm request");
+      return error9(400, "invalid_tag_confirm", parsed.error ?? "Invalid confirm request");
     }
     const input = parsed.value;
     const result2 = await this.ctx.storage.transaction(async (txn) => {
@@ -17278,8 +18232,8 @@ var TagDurableObject = class {
         record = await this.commitExpiryIfNeeded(txn, expiry);
         return { ...rejected(epochError), body: { ...rejected(epochError).body, version: record.version } };
       }
-      const active = record.activeReservation;
-      if (active !== null && active.attemptId === input.attemptId && active.epoch === input.epoch && active.token === input.reservationToken) {
+      const active2 = record.activeReservation;
+      if (active2 !== null && active2.attemptId === input.attemptId && active2.epoch === input.epoch && active2.token === input.reservationToken) {
         record = await this.commitExpiryIfNeeded(txn, expiry);
         return {
           ...rejected("append_required_for_confirmation"),
@@ -17292,12 +18246,12 @@ var TagDurableObject = class {
         body: { ...rejected("confirmation_not_found").body, version: record.version }
       };
     });
-    return json10(result2.body, result2.status);
+    return json11(result2.body, result2.status);
   }
   async installFence(tag, body) {
     const parsed = fenceFrom(body);
     if (parsed.value === void 0) {
-      return error8(400, "invalid_tag_fence", parsed.error ?? "Invalid fence request");
+      return error9(400, "invalid_tag_fence", parsed.error ?? "Invalid fence request");
     }
     const input = parsed.value;
     const result2 = await this.ctx.storage.transaction(async (txn) => {
@@ -17334,12 +18288,12 @@ var TagDurableObject = class {
       });
       return { status: 201, body: { status: "fence-installed", idempotent: false, version: updated.version } };
     });
-    return json10(result2.body, result2.status);
+    return json11(result2.body, result2.status);
   }
   async clearFence(tag, body) {
     const parsed = fenceFrom(body);
     if (parsed.value === void 0) {
-      return error8(400, "invalid_tag_fence", parsed.error ?? "Invalid fence request");
+      return error9(400, "invalid_tag_fence", parsed.error ?? "Invalid fence request");
     }
     const input = parsed.value;
     const result2 = await this.ctx.storage.transaction(async (txn) => {
@@ -17365,7 +18319,7 @@ var TagDurableObject = class {
       });
       return { status: 200, body: { status: "fence-cleared", idempotent: false, version: updated.version } };
     });
-    return json10(result2.body, result2.status);
+    return json11(result2.body, result2.status);
   }
   /**
    * Returns Tag-side repair facts only.  Journal observations are deliberately
@@ -17401,7 +18355,7 @@ var TagDurableObject = class {
         }
       };
     });
-    return json10(result2.body, result2.status);
+    return json11(result2.body, result2.status);
   }
   /**
    * Internal outbox handoff: enqueuedAt is persisted before any Queue send so
@@ -17411,10 +18365,10 @@ var TagDurableObject = class {
   async pendingOutbox(tag, serviceId, body) {
     const parsed = outboxPendingFrom(body);
     if (parsed.value === void 0) {
-      return error8(400, "invalid_outbox_pending", parsed.error ?? "Invalid outbox pending request");
+      return error9(400, "invalid_outbox_pending", parsed.error ?? "Invalid outbox pending request");
     }
     if (!isNonEmptyString11(serviceId)) {
-      return error8(400, "outbox_service_identity_required", "Outbox delivery requires a service identity");
+      return error9(400, "outbox_service_identity_required", "Outbox delivery requires a service identity");
     }
     const input = parsed.value;
     const result2 = await this.ctx.storage.transaction(async (txn) => {
@@ -17490,7 +18444,7 @@ var TagDurableObject = class {
       }
       return { status: 200, body: { rows } };
     });
-    return json10(result2.body, result2.status);
+    return json11(result2.body, result2.status);
   }
   /**
    * Source-side obligation scanner.  It deliberately does not call the Queue,
@@ -17560,7 +18514,7 @@ var TagDurableObject = class {
         }
       };
     });
-    return json10(result2.body, result2.status);
+    return json11(result2.body, result2.status);
   }
   /** Record a retry or terminal poison disposition without changing the source event. */
   async recordOutboxFailure(tag, delivery, failure3) {
@@ -17614,16 +18568,16 @@ var TagDurableObject = class {
   async markOutboxDelivered(tag, body) {
     const parsed = outboxMarkFrom(body);
     if (parsed.value === void 0) {
-      return error8(400, "invalid_outbox_delivery_mark", parsed.error ?? "Invalid outbox delivery mark");
+      return error9(400, "invalid_outbox_delivery_mark", parsed.error ?? "Invalid outbox delivery mark");
     }
     const input = parsed.value;
     try {
       const joined = await Promise.all(input.deliveries.map((delivery) => this.globalReceiptMatches(delivery)));
       if (joined.some((value) => !value)) {
-        return error8(409, "outbox_global_receipt_unverified", "Global receipt and membership must be read back before source acknowledgement");
+        return error9(409, "outbox_global_receipt_unverified", "Global receipt and membership must be read back before source acknowledgement");
       }
     } catch {
-      return error8(503, "outbox_global_receipt_unavailable", "Global receipt verification is unavailable");
+      return error9(503, "outbox_global_receipt_unavailable", "Global receipt verification is unavailable");
     }
     const result2 = await this.ctx.storage.transaction(async (txn) => {
       if (this.sqlStorage() !== void 0) {
@@ -17662,7 +18616,7 @@ var TagDurableObject = class {
       }
       return { status: 200, body: { marked, idempotent: marked === 0 } };
     });
-    return json10(result2.body, result2.status);
+    return json11(result2.body, result2.status);
   }
   /**
    * The delivery handoff reads its universe from `tag_outbox_obligation`.
@@ -17801,7 +18755,7 @@ var TagDurableObject = class {
   async acquireRepairLease(tag, body) {
     const parsed = repairAcquireFrom(body, tag);
     if (parsed.value === void 0) {
-      return error8(400, "invalid_repair_acquire", parsed.error ?? "Invalid repair acquire request");
+      return error9(400, "invalid_repair_acquire", parsed.error ?? "Invalid repair acquire request");
     }
     const input = parsed.value;
     const result2 = await this.ctx.storage.transaction(async (txn) => {
@@ -17847,12 +18801,12 @@ var TagDurableObject = class {
         }
       };
     });
-    return json10(result2.body, result2.status);
+    return json11(result2.body, result2.status);
   }
   async renewRepairLease(tag, body) {
     const parsed = repairLeaseFrom(body);
     if (parsed.value === void 0) {
-      return error8(400, "invalid_repair_renew", parsed.error ?? "Invalid repair renew request");
+      return error9(400, "invalid_repair_renew", parsed.error ?? "Invalid repair renew request");
     }
     const input = parsed.value;
     const result2 = await this.ctx.storage.transaction(async (txn) => {
@@ -17876,12 +18830,12 @@ var TagDurableObject = class {
         }
       };
     });
-    return json10(result2.body, result2.status);
+    return json11(result2.body, result2.status);
   }
   async unionRepairScope(tag, body) {
     const parsed = repairScopeUnionFrom(body, tag);
     if (parsed.value === void 0) {
-      return error8(400, "invalid_repair_scope_union", parsed.error ?? "Invalid repair scope union request");
+      return error9(400, "invalid_repair_scope_union", parsed.error ?? "Invalid repair scope union request");
     }
     const input = parsed.value;
     const result2 = await this.ctx.storage.transaction(async (txn) => {
@@ -17917,12 +18871,12 @@ var TagDurableObject = class {
         body: { status: "repair-scope-unioned", scopeVersion: updated.repairScopeVersion, scope: updated.repairScope }
       };
     });
-    return json10(result2.body, result2.status);
+    return json11(result2.body, result2.status);
   }
   async applyRepair(tag, body) {
     const parsed = repairApplyFrom(body, tag);
     if (parsed.value === void 0) {
-      return error8(400, "invalid_repair_apply", parsed.error ?? "Invalid repair apply request");
+      return error9(400, "invalid_repair_apply", parsed.error ?? "Invalid repair apply request");
     }
     const input = parsed.value;
     const result2 = await this.ctx.storage.transaction(async (txn) => {
@@ -18003,12 +18957,12 @@ var TagDurableObject = class {
         body: { status: branch, idempotent: false, head: (updatedRecord ?? record).head, version: (updatedRecord ?? record).version }
       };
     });
-    return json10(result2.body, result2.status);
+    return json11(result2.body, result2.status);
   }
   async auditRepair(tag, body) {
     const parsed = repairAuditFrom(body, tag);
     if (parsed.value === void 0) {
-      return error8(400, "invalid_repair_audit", parsed.error ?? "Invalid repair audit request");
+      return error9(400, "invalid_repair_audit", parsed.error ?? "Invalid repair audit request");
     }
     const input = parsed.value;
     const result2 = await this.ctx.storage.transaction(async (txn) => {
@@ -18045,12 +18999,12 @@ var TagDurableObject = class {
       await txn.put(REPAIR_FACTS_KEY, { ...facts, audits: [...facts.audits, audit] });
       return { status: 200, body: { status: "repair-audited", idempotent: false, branch: audit.branch } };
     });
-    return json10(result2.body, result2.status);
+    return json11(result2.body, result2.status);
   }
   async clearRepairFence(tag, body) {
     const parsed = repairClearFrom(body);
     if (parsed.value === void 0) {
-      return error8(400, "invalid_repair_clear", parsed.error ?? "Invalid repair clear request");
+      return error9(400, "invalid_repair_clear", parsed.error ?? "Invalid repair clear request");
     }
     const input = parsed.value;
     const result2 = await this.ctx.storage.transaction(async (txn) => {
@@ -18081,16 +19035,16 @@ var TagDurableObject = class {
       });
       return { status: 200, body: { status: "repair-fence-cleared", idempotent: false, version: updated.version } };
     });
-    return json10(result2.body, result2.status);
+    return json11(result2.body, result2.status);
   }
   async setClockOffset(tag, body) {
-    if (!isObject11(body)) {
-      return error8(400, "invalid_tag_clock", "offsetMs or nowMs must be a safe integer");
+    if (!isObject12(body)) {
+      return error9(400, "invalid_tag_clock", "offsetMs or nowMs must be a safe integer");
     }
     const nowMs = body.nowMs;
     const offsetMs = body.offsetMs;
     if (!isSafeInteger(nowMs) && !isSafeInteger(offsetMs)) {
-      return error8(400, "invalid_tag_clock", "offsetMs or nowMs must be a safe integer");
+      return error9(400, "invalid_tag_clock", "offsetMs or nowMs must be a safe integer");
     }
     const result2 = await this.ctx.storage.transaction(async (txn) => {
       const loaded = await this.recordFor(txn, tag);
@@ -18108,7 +19062,7 @@ var TagDurableObject = class {
         }
       };
     });
-    return json10(result2.body, result2.status);
+    return json11(result2.body, result2.status);
   }
   async runAlarm() {
     const due = await this.ctx.storage.transaction(async (txn) => {
@@ -18227,16 +19181,16 @@ var TagStateCheckpointFault = class extends Error {
     this.name = "TagStateCheckpointFault";
   }
 };
-function json11(body, status = 200) {
+function json12(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "content-type": "application/json; charset=utf-8" }
   });
 }
-function error9(status, code, message) {
-  return json11({ code, error: message }, status);
+function error10(status, code, message) {
+  return json12({ code, error: message }, status);
 }
-function isObject12(value) {
+function isObject13(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isNonEmptyString12(value) {
@@ -18251,7 +19205,7 @@ function sqlNullableString2(value, column) {
   return sqlString2(value, column);
 }
 function parseIdentity(value) {
-  if (!isObject12(value) || !isNonEmptyString12(value.serviceId) || !isNonEmptyString12(value.tag) || !isNonEmptyString12(value.projectorId)) {
+  if (!isObject13(value) || !isNonEmptyString12(value.serviceId) || !isNonEmptyString12(value.tag) || !isNonEmptyString12(value.projectorId)) {
     return void 0;
   }
   return { serviceId: value.serviceId, tag: value.tag, projectorId: value.projectorId };
@@ -18313,17 +19267,17 @@ var TagStateDurableObject = class {
   async fetch(request) {
     const url = new URL(request.url);
     if (request.method !== "POST" || url.pathname !== "/read") {
-      return error9(404, "tag_state_route_not_found", "TagState route was not found");
+      return error10(404, "tag_state_route_not_found", "TagState route was not found");
     }
     let body;
     try {
       body = await request.json();
     } catch {
-      return error9(400, "tag_state_validation_error", "TagState request must be JSON");
+      return error10(400, "tag_state_validation_error", "TagState request must be JSON");
     }
     const identity2 = parseIdentity(body);
     if (identity2 === void 0) {
-      return error9(400, "tag_state_validation_error", "TagState identity requires serviceId, tag, and projectorId");
+      return error10(400, "tag_state_validation_error", "TagState identity requires serviceId, tag, and projectorId");
     }
     return await this.read(identity2);
   }
@@ -18345,16 +19299,16 @@ var TagStateDurableObject = class {
       return await this.continueRebuild(identity2, projector, cache);
     } catch (caught) {
       if (caught instanceof TagStateIdentityConflict) {
-        return error9(409, "tag_state_identity_conflict", "TagState Durable Object identity changed");
+        return error10(409, "tag_state_identity_conflict", "TagState Durable Object identity changed");
       }
       if (caught instanceof TagStateUnknownProjector) {
-        return error9(404, "tag_state_unknown_projector", "TagState projector is not registered");
+        return error10(404, "tag_state_unknown_projector", "TagState projector is not registered");
       }
       if (caught instanceof TagStateRegistryFailure) {
-        return error9(503, "tag_state_projector_registry_failure", "TagState projector registry is unavailable");
+        return error10(503, "tag_state_projector_registry_failure", "TagState projector registry is unavailable");
       }
       if (caught instanceof TagStateSourceFailure) {
-        return error9(caught.status, "tag_state_source_frontier_failure", "TagState source frontier could not be read");
+        return error10(caught.status, "tag_state_source_frontier_failure", "TagState source frontier could not be read");
       }
       if (caught instanceof TagStateCacheCorruption) {
         try {
@@ -18362,21 +19316,21 @@ var TagStateDurableObject = class {
           this.beginRebuild(projector, "cache-corrupt");
         } catch (rebuildFailure) {
           if (rebuildFailure instanceof TagStateRegistryFailure) {
-            return error9(503, "tag_state_projector_registry_failure", "TagState projector registry is unavailable");
+            return error10(503, "tag_state_projector_registry_failure", "TagState projector registry is unavailable");
           }
         }
-        return error9(409, "tag_state_cache_corrupt", "TagState cache is corrupt and is rebuilding");
+        return error10(409, "tag_state_cache_corrupt", "TagState cache is corrupt and is rebuilding");
       }
       if (caught instanceof TagStateCheckpointFault) {
-        return error9(503, "tag_state_rebuild_interrupted", "TagState replay checkpoint was interrupted");
+        return error10(503, "tag_state_rebuild_interrupted", "TagState replay checkpoint was interrupted");
       }
-      return error9(503, "tag_state_unavailable", "TagState cache is unavailable");
+      return error10(503, "tag_state_unavailable", "TagState cache is unavailable");
     }
   }
   async beginDeltaOrRespondReady(identity2, projector, cache) {
     const page = await this.readSource(identity2, cache.lastSuid, void 0);
     if (page.events.length === 0 && page.completeThrough !== null) {
-      return json11(this.success(projector, cache.stateJson, cache.lastSuid));
+      return json12(this.success(projector, cache.stateJson, cache.lastSuid));
     }
     const rebuild = this.beginRebuild(projector, "normal-delta", {
       cursor: cache.lastSuid,
@@ -18425,9 +19379,9 @@ var TagStateDurableObject = class {
     });
     if (this.g46CheckpointFault === "after-checkpoint") throw new TagStateCheckpointFault();
     if (!complete) {
-      return error9(503, "tag_state_rebuild_in_progress", "TagState replay is rebuilding to its frozen frontier");
+      return error10(503, "tag_state_rebuild_in_progress", "TagState replay is rebuilding to its frozen frontier");
     }
-    return json11(this.success(projector, accumulatorJson, page.completeThrough));
+    return json12(this.success(projector, accumulatorJson, page.completeThrough));
   }
   success(projector, stateJson, lastSortedUniqueId) {
     try {
@@ -18484,7 +19438,7 @@ var TagStateDurableObject = class {
     }
   }
   assertSourcePage(cursor, expectedThrough, page) {
-    if (!isObject12(page) || !Array.isArray(page.events) || typeof page.lastSortableUniqueId !== "string" || typeof page.through !== "string" || page.completeThrough !== null && typeof page.completeThrough !== "string") {
+    if (!isObject13(page) || !Array.isArray(page.events) || typeof page.lastSortableUniqueId !== "string" || typeof page.through !== "string" || page.completeThrough !== null && typeof page.completeThrough !== "string") {
       throw new TagStateSourceFailure(503, new Error("TagState source response was malformed"));
     }
     if (expectedThrough !== void 0 && expectedThrough !== null && page.through !== expectedThrough) {
@@ -18909,9 +19863,9 @@ var PostgresEventStore = class {
         await transaction.unsafe(SCHEMA, [], { prepare: false });
       });
       this.sql = sql;
-    } catch (error10) {
+    } catch (error11) {
       await sql.end({ timeout: 1 });
-      throw error10;
+      throw error11;
     }
   }
   /** Close an owned request/test client without touching durable records. */
@@ -19102,6 +20056,65 @@ var PostgresEventStore = class {
     }
     return outcome === "stored" ? { outcome, kind: "stored", event: stored } : { outcome, kind: outcome, incident };
   }
+  /**
+   * DDL columns only. C# rows have no provenance and no allocator lineage;
+   * this read must not invent either, and it must not treat Tags as
+   * committed membership.
+   */
+  async readLogicalEvents(serviceId) {
+    const rows = await this.query(
+      `SELECT "ServiceId" AS service_id, "Id"::text AS event_id,
+              "SortableUniqueId" AS suid, "Payload"::text AS payload,
+              "EventType" AS event_type, "Tags" AS event_tags,
+              "Timestamp"::text AS timestamp, "CausationId" AS causation_id,
+              "CorrelationId" AS correlation_id, "ExecutedUser" AS executed_user
+         FROM dcb_events
+        WHERE "ServiceId" = $1
+        ORDER BY "SortableUniqueId" ASC, "Id" ASC`,
+      [serviceId]
+    );
+    return rows.map((row) => ({
+      serviceId: asString4(row.service_id, "service_id"),
+      id: asString4(row.event_id, "event_id"),
+      sortableUniqueId: asString4(row.suid, "suid"),
+      eventType: asString4(row.event_type, "event_type"),
+      payload: asString4(row.payload, "payload"),
+      tags: asStringArray2(row.event_tags, "event_tags"),
+      timestamp: canonicalUtcTimestamp(row.timestamp, "timestamp"),
+      causationId: nullableString2(row.causation_id, "causation_id"),
+      correlationId: nullableString2(row.correlation_id, "correlation_id"),
+      executedUser: nullableString2(row.executed_user, "executed_user")
+    }));
+  }
+  /** Insert one DDL row. Does not write dcb_event_ops or a provenance stamp. */
+  async appendLogicalEvent(event) {
+    JSON.parse(event.payload);
+    assertSortableUniqueId(event.sortableUniqueId);
+    if (!isRfc4122Uuid(event.id)) {
+      throw new CanonicalEventIdentityConflictError("postgres", event.id, "logical event id must be an RFC 4122 UUID");
+    }
+    assertUtcTimestamp(event.timestamp, event.id);
+    const sql = this.requireSql();
+    await sql.begin(async (transaction) => {
+      await transaction.unsafe(
+        `INSERT INTO dcb_events
+           ("ServiceId", "Id", "SortableUniqueId", "EventType", "Payload", "Tags", "Timestamp", "CausationId", "CorrelationId", "ExecutedUser")
+         VALUES ($1, $2::uuid, $3, $4, $5::text::json, $6::text::jsonb, $7::timestamptz, $8, $9, $10)`,
+        [
+          event.serviceId,
+          event.id,
+          event.sortableUniqueId,
+          event.eventType,
+          event.payload,
+          JSON.stringify(event.tags),
+          event.timestamp,
+          event.causationId,
+          event.correlationId,
+          event.executedUser
+        ]
+      );
+    });
+  }
   async readAllEvents(serviceId, since) {
     if (since.length !== 0) assertSortableUniqueId(since);
     const rows = await this.query(
@@ -19574,12 +20587,12 @@ function encodedCommitSnapshotLogBytes(record) {
 function assertCommitSnapshotLogSize(record) {
   const encodedBytes2 = encodedCommitSnapshotLogBytes(record);
   if (encodedBytes2 > COMMIT_SNAPSHOT_LOG_BYTE_BUDGET) {
-    const error10 = new Error(
+    const error11 = new Error(
       `Commit snapshot log is ${encodedBytes2} bytes; budget is ${COMMIT_SNAPSHOT_LOG_BYTE_BUDGET} bytes`
     );
-    error10.code = "commit-snapshot-log-size";
-    error10.encodedBytes = encodedBytes2;
-    throw error10;
+    error11.code = "commit-snapshot-log-size";
+    error11.encodedBytes = encodedBytes2;
+    throw error11;
   }
   return encodedBytes2;
 }
@@ -19598,8 +20611,8 @@ function createCommitTraceConsoleSink(options = {}) {
       if (record === void 0) return;
       try {
         assertCommitSnapshotLogSize(record);
-      } catch (error10) {
-        const encodedBytes2 = typeof error10 === "object" && error10 !== null && "encodedBytes" in error10 && typeof error10.encodedBytes === "number" ? error10.encodedBytes : encodedCommitSnapshotLogBytes(record);
+      } catch (error11) {
+        const encodedBytes2 = typeof error11 === "object" && error11 !== null && "encodedBytes" in error11 && typeof error11.encodedBytes === "number" ? error11.encodedBytes : encodedCommitSnapshotLogBytes(record);
         reportRejectedSize(Object.freeze({
           schema: COMMIT_SNAPSHOT_LOG_SCHEMA,
           event: "commit.snapshot-size-rejected",
@@ -19608,41 +20621,107 @@ function createCommitTraceConsoleSink(options = {}) {
           encodedBytes: encodedBytes2,
           byteBudget: COMMIT_SNAPSHOT_LOG_BYTE_BUDGET
         }));
-        throw error10;
+        throw error11;
       }
       log(record);
     }
   });
 }
 
-// src/scope/ControlRouteScope.ts
-function response2(status, code, error10) {
-  return new Response(JSON.stringify({ code, error: error10 }), {
-    status,
-    headers: { "content-type": "application/json; charset=utf-8" }
-  });
+// src/shard/ShardRotation.ts
+var ShardRotationError = class extends Error {
+  diagnostic;
+  constructor(diagnostic) {
+    super(diagnostic.code);
+    this.name = "ShardRotationError";
+    this.diagnostic = diagnostic;
+  }
+};
+function fail(code, path, reason) {
+  throw new ShardRotationError({ code, path, reason });
 }
-function scopeIdentityMissingResponse() {
-  return response2(503, "scope.identity_missing", "A deployment service identity is required for this scope");
+function createRotationState(active2) {
+  if (typeof active2 !== "string" || active2.length === 0) fail("ACTIVE_COUNT", "active", "active-missing");
+  return { sealed: [], active: active2, ledger: [] };
 }
-function enforceControlRouteScope(input) {
-  let actual;
-  try {
-    actual = input.provider.forRequest(input.request, input.requestOptions).serviceId;
-  } catch (caught) {
-    if (caught instanceof ServiceIdentityMissingError) {
-      console.error({ schema: "sdt.scope/v1", code: "scope.identity_missing", route: input.route });
-      return { response: scopeIdentityMissingResponse() };
-    }
-    throw caught;
+function assertStrictlyBefore(lastD1_1, firstD1_2) {
+  assertSortableUniqueId(lastD1_1);
+  assertSortableUniqueId(firstD1_2);
+  if (compareSortableUniqueId(lastD1_1, firstD1_2) >= 0) {
+    fail("ORDER_INVARIANT", "last(D1-1)<first(D1-2)", "order-invariant");
   }
-  if (input.pathServiceId !== actual) {
-    console.warn({ schema: "sdt.scope/v1", code: "scope.mismatch", route: input.route });
-    return {
-      response: response2(403, "scope.mismatch", "The path service identity is not authorized for this deployment")
-    };
+}
+function maxSortableUniqueId(values) {
+  if (values.length === 0) fail("SEAL_MAX_MISSING", "d1-1", "seal-max-missing");
+  let max = assertSortableUniqueId(values[0]).value;
+  for (let i = 1; i < values.length; i += 1) {
+    const next = assertSortableUniqueId(values[i]).value;
+    if (next > max) max = next;
   }
-  return { serviceId: actual };
+  return max;
+}
+function rotateAppend(state, sealedId, shardSuids, nextActiveId) {
+  if (sealedId !== state.active) fail("UNKNOWN_SHARD", sealedId, "unknown-shard");
+  if (typeof nextActiveId !== "string" || nextActiveId.length === 0 || nextActiveId === sealedId) {
+    fail("ACTIVE_COUNT", "active", "active-count");
+  }
+  if (state.sealed.some((entry) => entry.id === nextActiveId)) {
+    fail("ACTIVE_COUNT", nextActiveId, "active-already-sealed");
+  }
+  if (state.sealed.some((entry) => entry.id === sealedId)) fail("IDENTITY_SWAP", sealedId, "identity-swap");
+  const lastSuid = maxSortableUniqueId(shardSuids);
+  return {
+    sealed: [...state.sealed, { id: sealedId, lastSuid }],
+    active: nextActiveId,
+    ledger: state.ledger
+  };
+}
+function replaceSealedIdentity(state, index, nextId) {
+  if (index < 0 || index >= state.sealed.length) fail("UNKNOWN_SHARD", "sealed", "unknown-shard");
+  fail("IDENTITY_SWAP", state.sealed[index].id, `identity-swap:${nextId}`);
+}
+function refuseSealedWrite(state, shardId) {
+  if (state.sealed.some((entry) => entry.id === shardId)) fail("SEALED_WRITE", shardId, "sealed-write");
+}
+function admitActiveWrite(state, shardId, firstOrNextSuid) {
+  assertSortableUniqueId(firstOrNextSuid);
+  refuseSealedWrite(state, shardId);
+  if (shardId !== state.active) fail("UNKNOWN_SHARD", shardId, "unknown-shard");
+  if (state.sealed.length === 0) return;
+  const previous = state.sealed[state.sealed.length - 1];
+  assertStrictlyBefore(previous.lastSuid, firstOrNextSuid);
+}
+function recordLateArrival(state, sealedShardId, suid) {
+  assertSortableUniqueId(suid);
+  const sealed = state.sealed.find((entry) => entry.id === sealedShardId);
+  if (sealed === void 0) fail("UNKNOWN_SHARD", sealedShardId, "unknown-shard");
+  if (compareSortableUniqueId(suid, sealed.lastSuid) > 0) {
+    fail("ORDER_INVARIANT", sealedShardId, "not-late-arrival");
+  }
+  return {
+    ...state,
+    ledger: [...state.ledger, { shardId: sealed.id, suid, reason: "sealed-range" }]
+  };
+}
+var SILENT_MERGE_TOKENS = [
+  ["merge", "Ledger", "Into", "Sealed"],
+  ["merge", "OnRead", "Sealed"],
+  ["silent", "Merge", "Ledger"],
+  ["ledger", ".concat(", "sealed"],
+  ["sealed", ".concat(", "ledger"]
+];
+function assertNoSilentLedgerMerge(source) {
+  const lowered = source.toLowerCase();
+  for (const token of SILENT_MERGE_TOKENS) {
+    const needle = token.join("").toLowerCase();
+    if (lowered.includes(needle)) fail("SILENT_MERGE", "ledger", "silent-merge");
+  }
+}
+function refuseSilentLedgerMerge() {
+  fail("SILENT_MERGE", "ledger", "silent-merge");
+}
+function refuseSafeWindowSeal() {
+  fail("SAFEWINDOW_SEAL", "safe-window", "safewindow-seal");
 }
 
 // src/index.ts
@@ -19652,6 +20731,10 @@ function createRuntimeWorker(options = {}) {
   const storeProvider = options.storeProvider ?? POSTGRES_STORE_PROVIDER;
   return {
     async fetch(request, env, ctx) {
+      const url = new URL(request.url);
+      if (isIncidentMaintenancePath(url.pathname)) {
+        return handleIncidentMaintenance(request, env, options.serviceIdentityProvider ?? envServiceIdentity(env));
+      }
       const serviceIdentity = options.serviceIdentityProvider ?? envServiceIdentity(env);
       const requestIdentityOptions = { allowG11Verification: env.G11_VERIFICATION_ENABLED === "true" };
       let requestServiceId;
@@ -19660,7 +20743,6 @@ function createRuntimeWorker(options = {}) {
       } catch {
         return scopeIdentityMissingResponse();
       }
-      const url = new URL(request.url);
       if (url.pathname === "/api/sekiban/serialized/commit") {
         return handleSerializedCommit(request, env, {
           domainDeliveryClass: options.config?.deliveryClass,
@@ -19689,7 +20771,7 @@ function createRuntimeWorker(options = {}) {
         return handleOperatorBootstrap(request, env, storeProvider);
       }
       if (url.pathname === "/internal/downstream/drain" && request.method === "POST") {
-        return handleOutboxDrainRequest(request, env);
+        return handleOutboxDrainRequest(request, env, { serviceIdentityProvider: serviceIdentity });
       }
       if (url.pathname === "/internal/projection/lag") {
         return handleProjectionLag(request, env, composition.projectors, storeProvider, serviceIdentity);
@@ -19822,6 +20904,8 @@ export {
   GLOBAL_COMPLETENESS_INTERIM_DISPOSITION,
   GlobalCompletenessReconciler,
   IDLE_EXPERIMENT_SCHEDULE_MS,
+  IncidentLifecycle,
+  IncidentLifecycleError,
   JournalDurableObject,
   MAX_PUBLISHED_SAFE_WINDOW_MS,
   MAX_SERVICE_BINDING_INVOCATIONS_PER_REQUEST,
@@ -19842,17 +20926,21 @@ export {
   SORTABLE_UNIQUE_ID_TICKS_DIGITS,
   ScopeNameError,
   ServiceIdentityMissingError,
+  ShardRotationError,
   SortableUniqueIdError,
   TEST_SERVICE_ID_HEADER,
   TagDurableObject,
   TagStateDurableObject,
   UnsafeWindowMaterializedViewError,
   UnsafeWindowMaterializedViewStore,
+  admitActiveWrite,
   allocateOrderRange,
   assertCanonicalEventType,
   assertCommitSnapshotLogSize,
   assertDotNetTicks,
+  assertNoSilentLedgerMerge,
   assertSortableUniqueId,
+  assertStrictlyBefore,
   beginWorkerInvocationObservation,
   bootstrapDigest,
   buildScopeName,
@@ -19869,6 +20957,7 @@ export {
   createCommitTraceConsoleSink,
   createPostgresBootstrapAdapter,
   createPostgresStoreProvider,
+  createRotationState,
   createRuntimeCommitPort,
   createRuntimeWorker,
   createTraceCorrelationId,
@@ -19893,8 +20982,10 @@ export {
   isScopeServiceId,
   isSortableUniqueId,
   isUuidV7,
+  maxSortableUniqueId,
   nativeTracingFromContext,
   noOpNativeTracing,
+  normalizeIncidentIdentity,
   observeLegacySortableUniqueIdDecision,
   observedIdleGapLowerBoundMs,
   parseBootstrapDump,
@@ -19904,10 +20995,16 @@ export {
   processDownstreamDoorbell,
   readDirectDoorbellConfig,
   readDomainDeliveryClass,
+  recordLateArrival,
+  refuseSafeWindowSeal,
+  refuseSealedWrite,
+  refuseSilentLedgerMerge,
   registeredEventParsers,
+  replaceSealedIdentity,
   requestServiceIdentity,
   requireServiceIdentity,
   resolveDeliveryIdentity,
+  rotateAppend,
   safeWindowCeilingExceeded,
   safeWindowCutoffSuid,
   safeWindowMs,