@sekiban/dcb-runtime 0.2.0

package/dist/d1-mv.js

@@ -0,0 +1,2001 @@
+// src/allocator/SortableUniqueId.ts
+var SORTABLE_UNIQUE_ID_TICKS_DIGITS = 19;
+var SORTABLE_UNIQUE_ID_RANDOM_DIGITS = 11;
+var SORTABLE_UNIQUE_ID_DIGITS = SORTABLE_UNIQUE_ID_TICKS_DIGITS + SORTABLE_UNIQUE_ID_RANDOM_DIGITS;
+var DOTNET_UNIX_EPOCH_TICKS = 621355968000000000n;
+var DOTNET_MAX_TICKS = 3155378975999999999n;
+var DOTNET_TICKS_PER_MILLISECOND = 10000n;
+var SORTABLE_UNIQUE_ID_RANDOM_LIMIT = 10n ** BigInt(SORTABLE_UNIQUE_ID_RANDOM_DIGITS);
+var MAX_UNIX_MILLISECONDS = (DOTNET_MAX_TICKS - DOTNET_UNIX_EPOCH_TICKS) / DOTNET_TICKS_PER_MILLISECOND;
+var SortableUniqueIdError = class extends Error {
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+    this.name = "SortableUniqueIdError";
+  }
+  code;
+};
+var LEGACY_PREFIXED_SUID = /^suid-[0-9]+$/;
+var LEGACY_DECISION_OBSERVER = /* @__PURE__ */ Symbol.for("@sekiban/dcb-runtime/legacy-sortable-unique-id-observer");
+function legacyDecisionObserver() {
+  return globalThis[LEGACY_DECISION_OBSERVER];
+}
+function assertDotNetTicks(ticks) {
+  if (ticks < 0n || ticks > DOTNET_MAX_TICKS) {
+    throw new SortableUniqueIdError("SUID_TICKS_INVALID", "SortableUniqueId ticks are outside the .NET DateTime range");
+  }
+  return ticks;
+}
+function assertSortableUniqueId(value) {
+  if (typeof value === "string" && LEGACY_PREFIXED_SUID.test(value)) {
+    legacyDecisionObserver()?.(value);
+    throw new SortableUniqueIdError(
+      "SUID_LEGACY_FORMAT_RETIRED",
+      "Legacy prefixed SortableUniqueId is retired; G32 requires exactly 30 ASCII decimal digits"
+    );
+  }
+  if (typeof value !== "string" || !new RegExp(`^[0-9]{${SORTABLE_UNIQUE_ID_DIGITS}}$`).test(value)) {
+    throw new SortableUniqueIdError("SUID_INVALID", "SortableUniqueId must be exactly 30 ASCII decimal digits");
+  }
+  const ticksText = value.slice(0, SORTABLE_UNIQUE_ID_TICKS_DIGITS);
+  const randomText = value.slice(SORTABLE_UNIQUE_ID_TICKS_DIGITS);
+  const ticks = assertDotNetTicks(BigInt(ticksText));
+  const random = BigInt(randomText);
+  if (random < 0n || random >= SORTABLE_UNIQUE_ID_RANDOM_LIMIT) {
+    throw new SortableUniqueIdError("SUID_RANDOM_INVALID", "SortableUniqueId random suffix is outside its 11-digit range");
+  }
+  return Object.freeze({ value, ticks, random });
+}
+
+// src/safeWindow.ts
+var PUBLISHED_SAFE_WINDOW_MS = 2e4;
+var MAX_PUBLISHED_SAFE_WINDOW_MS = 12e4;
+function safeWindowMs(dynamicLagBoundMs) {
+  return Math.min(MAX_PUBLISHED_SAFE_WINDOW_MS, Math.max(PUBLISHED_SAFE_WINDOW_MS, dynamicLagBoundMs));
+}
+function safeWindowCeilingExceeded(dynamicLagBoundMs) {
+  return dynamicLagBoundMs > MAX_PUBLISHED_SAFE_WINDOW_MS;
+}
+
+// ../dcb-core/dist/index.js
+var JsonValidationError = class extends Error {
+  code = "invalid_json_value";
+  boundary;
+  path;
+  constructor(message, boundary = "value", path = "$", options) {
+    super(message, options);
+    this.name = "JsonValidationError";
+    this.boundary = boundary;
+    this.path = path;
+  }
+};
+var isPlainRecord = (value) => {
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+};
+function assertJsonValue(value, boundary = "value") {
+  const active = /* @__PURE__ */ new WeakSet();
+  const visit = (candidate, path) => {
+    if (candidate === null || typeof candidate === "string" || typeof candidate === "boolean") {
+      return candidate;
+    }
+    if (typeof candidate === "number") {
+      if (Number.isFinite(candidate)) return candidate;
+      throw new JsonValidationError("JSON numbers must be finite", boundary, path);
+    }
+    if (typeof candidate !== "object") {
+      throw new JsonValidationError(`Value at ${path} is not JSON serializable`, boundary, path);
+    }
+    if (active.has(candidate)) {
+      throw new JsonValidationError(`Cyclic JSON value at ${path}`, boundary, path);
+    }
+    active.add(candidate);
+    try {
+      if (Array.isArray(candidate)) {
+        return candidate.map((item, index) => visit(item, `${path}[${index}]`));
+      }
+      if (!isPlainRecord(candidate)) {
+        throw new JsonValidationError(`Value at ${path} must be a plain JSON object`, boundary, path);
+      }
+      const result = {};
+      for (const [key, item] of Object.entries(candidate)) {
+        result[key] = visit(item, `${path}.${key}`);
+      }
+      return result;
+    } finally {
+      active.delete(candidate);
+    }
+  };
+  return visit(value, "$");
+}
+
+// src/mv/UnsafeWindowMaterializedView.ts
+var UnsafeWindowMaterializedViewError = class extends Error {
+  constructor(code, retryable, message, options) {
+    super(message, options);
+    this.code = code;
+    this.retryable = retryable;
+    this.name = "UnsafeWindowMaterializedViewError";
+  }
+  code;
+  retryable;
+};
+function compareSuid(left, right) {
+  const leftBytes = new TextEncoder().encode(left);
+  const rightBytes = new TextEncoder().encode(right);
+  for (let index = 0; index < Math.min(leftBytes.length, rightBytes.length); index += 1) {
+    const difference = leftBytes[index] - rightBytes[index];
+    if (difference !== 0) return difference;
+  }
+  return leftBytes.length - rightBytes.length;
+}
+function string(row, key) {
+  if (typeof row[key] !== "string") throw new Error(`Unsafe MV ${key} was not a string`);
+  return row[key];
+}
+function integer(row, key) {
+  const value = typeof row[key] === "number" ? row[key] : Number(row[key]);
+  if (!Number.isSafeInteger(value)) throw new Error(`Unsafe MV ${key} was not an integer`);
+  return value;
+}
+function operationId() {
+  return `mv-unsafe-${crypto.randomUUID()}`;
+}
+function errorFrom(error) {
+  const value = String(error);
+  if (value.includes("mv_unsafe_receipts") && (value.includes("UNIQUE") || value.includes("constraint"))) {
+    return new UnsafeWindowMaterializedViewError("UNSAFE_DUPLICATE_RACE", false, "Concurrent unsafe receipt was committed by another delivery", { cause: error });
+  }
+  if (value.includes("unsafe_row_cas")) return new UnsafeWindowMaterializedViewError("UNSAFE_ROW_CAS_MISMATCH", true, "Unsafe row version changed before atomic apply", { cause: error });
+  if (value.includes("unsafe_suid_contradiction")) return new UnsafeWindowMaterializedViewError("UNSAFE_SUID_CONTRADICTION", false, "Unsafe same-SUID payload contradiction", { cause: error });
+  if (value.includes("unsafe_safe_ahead")) return new UnsafeWindowMaterializedViewError("UNSAFE_SAFE_AHEAD", false, "Safe head already covers unsafe event", { cause: error });
+  if (value.includes("unsafe_behind_frontier")) return new UnsafeWindowMaterializedViewError("UNSAFE_BEHIND_FRONTIER", false, "Unsafe reads are fail-closed pending rebuild", { cause: error });
+  return void 0;
+}
+var UnsafeWindowMaterializedViewStore = class {
+  constructor(database, options = {}) {
+    this.database = database;
+    this.options = options;
+  }
+  database;
+  options;
+  /**
+   * The common row-materializer shape is one complete upsert. Keep its
+   * duplicate/order guards and all observable mutations in one D1 batch. A
+   * guard race falls back to apply(), which preserves the detailed older,
+   * duplicate, and contradiction classifications; only the uncontended fast
+   * path avoids the receipt/row pre-reads and separate arrival write.
+   */
+  async applyUpsertFast(input) {
+    const { rowUpserts, rowPatches, rowDeletes } = input.mutations;
+    if (rowUpserts.length !== 1 || rowPatches.length !== 0 || rowDeletes.length !== 0) return void 0;
+    const upsert = rowUpserts[0];
+    if (upsert.sourceSuid !== input.suid) return void 0;
+    const valueJson = JSON.stringify(assertJsonValue(upsert.value, "state-persistence"));
+    const operation = operationId();
+    const statements = [];
+    const guard = (name, predicate, values) => {
+      statements.push(this.database.prepare(
+        `INSERT INTO mv_atomic_guards (operation_id, checkpoint_match)
+         SELECT ?, CASE WHEN (${predicate}) THEN 1 ELSE NULL END`
+      ).bind(`${operation}:${name}`, ...values));
+    };
+    guard(
+      "receipt",
+      "NOT EXISTS (SELECT 1 FROM mv_unsafe_receipts WHERE service_id = ? AND view_id = ? AND event_id = ?)",
+      [input.serviceId, input.viewId, input.eventId]
+    );
+    guard("safe-head", "? = '' OR ? COLLATE BINARY < ? COLLATE BINARY", [input.safeHead, input.safeHead, input.suid]);
+    guard(
+      "row-order",
+      "NOT EXISTS (SELECT 1 FROM mv_unsafe_rows WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ? AND source_suid COLLATE BINARY > ? COLLATE BINARY)",
+      [input.serviceId, input.viewId, input.generation, upsert.rowKey, input.suid]
+    );
+    guard(
+      "same-suid",
+      "NOT EXISTS (SELECT 1 FROM mv_unsafe_rows WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ? AND source_suid COLLATE BINARY = ? COLLATE BINARY AND value_json <> ?)",
+      [input.serviceId, input.viewId, input.generation, upsert.rowKey, input.suid, valueJson]
+    );
+    if (input.expectedRowVersion !== void 0 && input.expectedRowVersion !== null) {
+      guard(
+        "row-cas",
+        "NOT EXISTS (SELECT 1 FROM mv_unsafe_rows WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?) OR EXISTS (SELECT 1 FROM mv_unsafe_rows WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ? AND row_version = ?)",
+        [
+          input.serviceId,
+          input.viewId,
+          input.generation,
+          upsert.rowKey,
+          input.serviceId,
+          input.viewId,
+          input.generation,
+          upsert.rowKey,
+          input.expectedRowVersion
+        ]
+      );
+    }
+    if (input.recordArrival === true) {
+      const behindFrontier = input.safeHead !== "" && compareSuid(input.suid, input.safeHead) <= 0;
+      statements.push(this.database.prepare(
+        `INSERT INTO mv_unsafe_arrivals
+           (service_id, view_id, generation, safe_head, arrival_watermark, behind_frontier_event_id, behind_frontier_suid, rebuild_required)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT (service_id, view_id, generation) DO UPDATE SET
+           arrival_watermark = CASE WHEN excluded.arrival_watermark COLLATE BINARY > mv_unsafe_arrivals.arrival_watermark COLLATE BINARY THEN excluded.arrival_watermark ELSE mv_unsafe_arrivals.arrival_watermark END,
+           behind_frontier_event_id = CASE WHEN mv_unsafe_arrivals.rebuild_required = 1 THEN mv_unsafe_arrivals.behind_frontier_event_id ELSE excluded.behind_frontier_event_id END,
+           behind_frontier_suid = CASE WHEN mv_unsafe_arrivals.rebuild_required = 1 THEN mv_unsafe_arrivals.behind_frontier_suid ELSE excluded.behind_frontier_suid END,
+           rebuild_required = MAX(mv_unsafe_arrivals.rebuild_required, excluded.rebuild_required)`
+      ).bind(
+        input.serviceId,
+        input.viewId,
+        input.generation,
+        input.safeHead,
+        input.suid,
+        behindFrontier ? input.eventId : null,
+        behindFrontier ? input.suid : null,
+        behindFrontier ? 1 : 0
+      ));
+    }
+    statements.push(this.database.prepare(
+      `DELETE FROM mv_unsafe_index_entries WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?`
+    ).bind(input.serviceId, input.viewId, input.generation, upsert.rowKey));
+    statements.push(this.database.prepare(
+      `INSERT INTO mv_unsafe_rows (service_id, view_id, generation, row_key, value_json, row_version, source_suid, tombstone)
+       VALUES (?, ?, ?, ?, ?, ?, ?, 0)
+       ON CONFLICT (service_id, view_id, generation, row_key) DO UPDATE SET
+         value_json = excluded.value_json, row_version = excluded.row_version, source_suid = excluded.source_suid, tombstone = 0`
+    ).bind(input.serviceId, input.viewId, input.generation, upsert.rowKey, valueJson, upsert.rowVersion, upsert.sourceSuid));
+    for (const entry of input.mutations.indexEntries) this.addIndex(statements, "mv_unsafe_index_entries", input, entry);
+    statements.push(this.database.prepare(
+      `INSERT INTO mv_unsafe_receipts (service_id, view_id, event_id, suid, outcome, observed_at)
+       VALUES (?, ?, ?, ?, 'applied', ?)`
+    ).bind(input.serviceId, input.viewId, input.eventId, input.suid, input.updatedAt));
+    statements.push(this.database.prepare(
+      `INSERT INTO mv_wait_receipts
+         (service_id, view_id, generation, definition_version, event_id, suid, observed_at)
+       SELECT ?, ?, ?, instance.definition_version, ?, ?, ?
+         FROM mv_instances instance
+         JOIN mv_active_generations active
+           ON active.service_id = instance.service_id
+          AND active.view_id = instance.view_id
+          AND active.generation = instance.generation
+        WHERE instance.service_id = ? AND instance.view_id = ? AND instance.generation = ?
+       ON CONFLICT DO NOTHING`
+    ).bind(
+      input.serviceId,
+      input.viewId,
+      input.generation,
+      input.eventId,
+      input.suid,
+      input.updatedAt,
+      input.serviceId,
+      input.viewId,
+      input.generation
+    ));
+    statements.push(this.database.prepare(
+      `INSERT INTO mv_unsafe_kicks (service_id, view_id, target_suid, dirty)
+       VALUES (?, ?, ?, 1)
+       ON CONFLICT (service_id, view_id) DO UPDATE SET
+         target_suid = CASE WHEN excluded.target_suid COLLATE BINARY > mv_unsafe_kicks.target_suid COLLATE BINARY THEN excluded.target_suid ELSE mv_unsafe_kicks.target_suid END,
+         dirty = 1`
+    ).bind(input.serviceId, input.viewId, input.targetSuid ?? input.suid));
+    statements.push(this.database.prepare("DELETE FROM mv_atomic_guards WHERE operation_id LIKE ?").bind(`${operation}:%`));
+    await this.options.beforeApplyBatch?.(input, statements);
+    try {
+      await this.database.batch(statements);
+    } catch (error) {
+      const text = String(error);
+      const guardFailure = text.includes("mv_atomic_guards") || text.includes("checkpoint_match") || text.includes("mv_unsafe_receipts") && (text.includes("UNIQUE") || text.includes("constraint"));
+      if (guardFailure) {
+        const receipt = await this.database.prepare(
+          `SELECT suid FROM mv_unsafe_receipts WHERE service_id = ? AND view_id = ? AND event_id = ? ORDER BY observed_at DESC LIMIT 1`
+        ).bind(input.serviceId, input.viewId, input.eventId).first();
+        if (receipt !== null && receipt !== void 0) {
+          if (string(receipt, "suid") !== input.suid) {
+            throw new UnsafeWindowMaterializedViewError("UNSAFE_SUID_CONTRADICTION", false, "Duplicate event identity has a contradictory SUID", { cause: error });
+          }
+          if (this.options.beforeApplyBatch !== void 0) {
+            throw new UnsafeWindowMaterializedViewError("UNSAFE_DUPLICATE_RACE", false, "Concurrent unsafe receipt was committed by another delivery", { cause: error });
+          }
+          return { outcome: "no-change", duplicate: true };
+        }
+        return this.apply(input, true);
+      }
+      throw error;
+    }
+    const result = { outcome: "applied", duplicate: false };
+    await this.options.afterApplyBatch?.(input, result);
+    return result;
+  }
+  async apply(input, skipFastPath = false) {
+    assertSortableUniqueId(input.suid);
+    if (input.safeHead.length > 0) assertSortableUniqueId(input.safeHead);
+    if (input.targetSuid !== void 0) assertSortableUniqueId(input.targetSuid);
+    for (const mutation of [...input.mutations.rowUpserts, ...input.mutations.rowPatches]) {
+      assertSortableUniqueId(mutation.sourceSuid);
+    }
+    const fast = skipFastPath ? void 0 : await this.applyUpsertFast(input);
+    if (fast !== void 0) return fast;
+    if (input.recordArrival === true) await this.observeArrival(input.serviceId, input.viewId, input.generation, input.eventId, input.suid);
+    const receipt = await this.database.prepare(
+      `SELECT suid FROM mv_unsafe_receipts WHERE service_id = ? AND view_id = ? AND event_id = ? ORDER BY observed_at DESC LIMIT 1`
+    ).bind(input.serviceId, input.viewId, input.eventId).first();
+    if (receipt !== null && receipt !== void 0) {
+      if (string(receipt, "suid") !== input.suid) {
+        throw new UnsafeWindowMaterializedViewError("UNSAFE_SUID_CONTRADICTION", false, "Duplicate event identity has a contradictory SUID");
+      }
+      return { outcome: "no-change", duplicate: true };
+    }
+    const rowKeys = [.../* @__PURE__ */ new Set([
+      ...input.mutations.rowUpserts.map((row) => row.rowKey),
+      ...input.mutations.rowPatches.map((row) => row.rowKey),
+      ...input.mutations.rowDeletes.map((row) => row.rowKey)
+    ])];
+    const existing = /* @__PURE__ */ new Map();
+    for (const rowKey of rowKeys) {
+      const row = await this.database.prepare(
+        `SELECT row_key, value_json, row_version, source_suid FROM mv_unsafe_rows
+          WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?`
+      ).bind(input.serviceId, input.viewId, input.generation, rowKey).first();
+      if (row !== null && row !== void 0) existing.set(rowKey, row);
+    }
+    const older = [...existing.values()].some((row) => compareSuid(string(row, "source_suid"), input.suid) > 0);
+    const noRowForPatch = input.mutations.rowPatches.some((patch) => !existing.has(patch.rowKey));
+    const deleteWithoutRow = input.mutations.rowDeletes.some((row) => !existing.has(row.rowKey));
+    const outcome = older ? "older" : noRowForPatch ? "patch-not-found" : deleteWithoutRow ? "delete-without-row" : input.mutations.rowUpserts.length + input.mutations.rowPatches.length + input.mutations.rowDeletes.length === 0 ? "no-change" : "applied";
+    const operation = operationId();
+    const statements = [];
+    const safeAhead = input.safeHead !== "" && compareSuid(input.safeHead, input.suid) >= 0;
+    let rowCasMismatch = false;
+    let sameSuidContradiction = false;
+    const guard = (name, predicate, values) => {
+      statements.push(this.database.prepare(
+        `INSERT INTO mv_atomic_guards (operation_id, checkpoint_match)
+         SELECT ?, CASE WHEN (${predicate}) THEN 1 ELSE NULL END`
+      ).bind(`${operation}:${name}`, ...values));
+    };
+    guard("unsafe_safe_ahead", "? = '' OR ? COLLATE BINARY < ? COLLATE BINARY", [input.safeHead, input.safeHead, input.suid]);
+    for (const [rowKey, row] of existing) {
+      if (input.expectedRowVersion !== void 0 && input.expectedRowVersion !== null) {
+        rowCasMismatch ||= integer(row, "row_version") !== input.expectedRowVersion;
+        guard("unsafe_row_cas", "? = ?", [integer(row, "row_version"), input.expectedRowVersion]);
+      }
+      const upsert = input.mutations.rowUpserts.find((candidate) => candidate.rowKey === rowKey);
+      if (upsert !== void 0 && string(row, "source_suid") === input.suid && string(row, "value_json") !== JSON.stringify(assertJsonValue(upsert.value, "state-persistence"))) {
+        sameSuidContradiction = true;
+        guard("unsafe_suid_contradiction", "0", []);
+      }
+    }
+    if (!older && outcome === "applied") {
+      for (const deletion of input.mutations.rowDeletes) {
+        statements.push(this.database.prepare(`DELETE FROM mv_unsafe_index_entries WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?`).bind(input.serviceId, input.viewId, input.generation, deletion.rowKey));
+        statements.push(this.database.prepare(`DELETE FROM mv_unsafe_rows WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?`).bind(input.serviceId, input.viewId, input.generation, deletion.rowKey));
+      }
+      for (const upsert of input.mutations.rowUpserts) {
+        statements.push(this.database.prepare(`DELETE FROM mv_unsafe_index_entries WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?`).bind(input.serviceId, input.viewId, input.generation, upsert.rowKey));
+        statements.push(this.database.prepare(
+          `INSERT INTO mv_unsafe_rows (service_id, view_id, generation, row_key, value_json, row_version, source_suid, tombstone)
+           VALUES (?, ?, ?, ?, ?, ?, ?, 0)
+           ON CONFLICT (service_id, view_id, generation, row_key) DO UPDATE SET
+             value_json = excluded.value_json, row_version = excluded.row_version, source_suid = excluded.source_suid, tombstone = 0`
+        ).bind(input.serviceId, input.viewId, input.generation, upsert.rowKey, JSON.stringify(assertJsonValue(upsert.value, "state-persistence")), upsert.rowVersion, upsert.sourceSuid));
+      }
+      for (const patch of input.mutations.rowPatches) {
+        statements.push(this.database.prepare(
+          `UPDATE mv_unsafe_rows SET value_json = json_patch(value_json, ?), row_version = ?, source_suid = ?, tombstone = 0
+            WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?`
+        ).bind(JSON.stringify(assertJsonValue(patch.patch, "state-persistence")), patch.rowVersion, patch.sourceSuid, input.serviceId, input.viewId, input.generation, patch.rowKey));
+      }
+      for (const entry of input.mutations.indexEntries) this.addIndex(statements, "mv_unsafe_index_entries", input, entry);
+      for (const patch of input.mutations.rowPatches) for (const entry of patch.indexEntries) this.addIndex(statements, "mv_unsafe_index_entries", input, entry);
+    }
+    const markerReason = outcome === "applied" ? void 0 : outcome;
+    if (markerReason !== void 0) {
+      for (const rowKey of rowKeys.length === 0 ? [input.eventId] : rowKeys) {
+        statements.push(this.database.prepare(
+          `INSERT INTO mv_unsafe_markers (service_id, view_id, generation, row_key, event_id, suid, reason)
+           VALUES (?, ?, ?, ?, ?, ?, ?) ON CONFLICT DO NOTHING`
+        ).bind(input.serviceId, input.viewId, input.generation, rowKey, input.eventId, input.suid, markerReason));
+      }
+    }
+    statements.push(this.database.prepare(
+      `INSERT INTO mv_unsafe_receipts (service_id, view_id, event_id, suid, outcome, observed_at) VALUES (?, ?, ?, ?, ?, ?)`
+    ).bind(input.serviceId, input.viewId, input.eventId, input.suid, outcome, input.updatedAt));
+    statements.push(this.database.prepare(
+      `INSERT INTO mv_wait_receipts
+         (service_id, view_id, generation, definition_version, event_id, suid, observed_at)
+       SELECT ?, ?, ?, instance.definition_version, ?, ?, ?
+         FROM mv_instances instance
+         JOIN mv_active_generations active
+           ON active.service_id = instance.service_id
+          AND active.view_id = instance.view_id
+          AND active.generation = instance.generation
+        WHERE instance.service_id = ? AND instance.view_id = ? AND instance.generation = ?
+       ON CONFLICT DO NOTHING`
+    ).bind(
+      input.serviceId,
+      input.viewId,
+      input.generation,
+      input.eventId,
+      input.suid,
+      input.updatedAt,
+      input.serviceId,
+      input.viewId,
+      input.generation
+    ));
+    statements.push(this.database.prepare(
+      `INSERT INTO mv_unsafe_kicks (service_id, view_id, target_suid, dirty)
+       VALUES (?, ?, ?, 1)
+       ON CONFLICT (service_id, view_id) DO UPDATE SET
+         target_suid = CASE WHEN excluded.target_suid COLLATE BINARY > mv_unsafe_kicks.target_suid COLLATE BINARY THEN excluded.target_suid ELSE mv_unsafe_kicks.target_suid END,
+         dirty = 1`
+    ).bind(input.serviceId, input.viewId, input.targetSuid ?? input.suid));
+    statements.push(this.database.prepare("DELETE FROM mv_atomic_guards WHERE operation_id LIKE ?").bind(`${operation}:%`));
+    await this.options.beforeApplyBatch?.(input, statements);
+    try {
+      await this.database.batch(statements);
+    } catch (error) {
+      if (sameSuidContradiction) throw new UnsafeWindowMaterializedViewError("UNSAFE_SUID_CONTRADICTION", false, "Unsafe same-SUID payload contradiction", { cause: error });
+      if (rowCasMismatch) throw new UnsafeWindowMaterializedViewError("UNSAFE_ROW_CAS_MISMATCH", true, "Unsafe row version changed before atomic apply", { cause: error });
+      if (safeAhead) throw new UnsafeWindowMaterializedViewError("UNSAFE_SAFE_AHEAD", false, "Safe head already covers unsafe event", { cause: error });
+      const typed = errorFrom(error);
+      if (typed !== void 0) throw typed;
+      throw error;
+    }
+    const result = { outcome, duplicate: false };
+    await this.options.afterApplyBatch?.(input, result);
+    return result;
+  }
+  /** Advance safe head and remove markers only if this transaction observed its exact receipt. */
+  async observeSafeReceipt(serviceId, viewId, generation, eventId, suid) {
+    assertSortableUniqueId(suid);
+    const operation = operationId();
+    await this.database.batch([
+      this.database.prepare(
+        `INSERT INTO mv_atomic_guards (operation_id, checkpoint_match)
+         SELECT ?, CASE WHEN EXISTS (SELECT 1 FROM mv_unsafe_receipts WHERE service_id = ? AND view_id = ? AND event_id = ? AND suid = ?) THEN 1 ELSE NULL END`
+      ).bind(operation, serviceId, viewId, eventId, suid),
+      this.database.prepare(
+        `INSERT INTO mv_unsafe_arrivals (service_id, view_id, generation, safe_head, arrival_watermark)
+         VALUES (?, ?, ?, ?, ?)
+         ON CONFLICT (service_id, view_id, generation) DO UPDATE SET safe_head = excluded.safe_head`
+      ).bind(serviceId, viewId, generation, suid, suid),
+      this.database.prepare(`DELETE FROM mv_unsafe_markers WHERE service_id = ? AND view_id = ? AND generation = ? AND event_id = ? AND suid = ?`).bind(serviceId, viewId, generation, eventId, suid),
+      this.database.prepare("DELETE FROM mv_atomic_guards WHERE operation_id = ?").bind(operation)
+    ]);
+  }
+  /** Detects late first-arrivals independently of SafeWindow and fail-closes reads. */
+  async observeArrival(serviceId, viewId, generation, eventId, suid) {
+    assertSortableUniqueId(suid);
+    const existing = await this.database.prepare(
+      `SELECT safe_head, arrival_watermark FROM mv_unsafe_arrivals WHERE service_id = ? AND view_id = ? AND generation = ?`
+    ).bind(serviceId, viewId, generation).first();
+    const safeHead = existing === null || existing === void 0 ? "" : string(existing, "safe_head");
+    const behind = safeHead !== "" && compareSuid(suid, safeHead) <= 0;
+    await this.database.prepare(
+      `INSERT INTO mv_unsafe_arrivals (service_id, view_id, generation, safe_head, arrival_watermark, behind_frontier_event_id, behind_frontier_suid, rebuild_required)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT (service_id, view_id, generation) DO UPDATE SET
+         arrival_watermark = CASE WHEN excluded.arrival_watermark COLLATE BINARY > mv_unsafe_arrivals.arrival_watermark COLLATE BINARY THEN excluded.arrival_watermark ELSE mv_unsafe_arrivals.arrival_watermark END,
+         behind_frontier_event_id = CASE WHEN mv_unsafe_arrivals.rebuild_required = 1 THEN mv_unsafe_arrivals.behind_frontier_event_id ELSE excluded.behind_frontier_event_id END,
+         behind_frontier_suid = CASE WHEN mv_unsafe_arrivals.rebuild_required = 1 THEN mv_unsafe_arrivals.behind_frontier_suid ELSE excluded.behind_frontier_suid END,
+         rebuild_required = MAX(mv_unsafe_arrivals.rebuild_required, excluded.rebuild_required)`
+    ).bind(serviceId, viewId, generation, safeHead, suid, behind ? eventId : null, behind ? suid : null, behind ? 1 : 0).run();
+    return behind;
+  }
+  async readMeta(serviceId, viewId, generation) {
+    const arrival = await this.database.prepare(`SELECT safe_head, rebuild_required FROM mv_unsafe_arrivals WHERE service_id = ? AND view_id = ? AND generation = ?`).bind(serviceId, viewId, generation).first();
+    const row = await this.database.prepare(`SELECT COALESCE(MAX(suid), '') AS max_suid FROM mv_unsafe_receipts WHERE service_id = ? AND view_id = ?`).bind(serviceId, viewId).first();
+    return {
+      safeContiguousHead: arrival === null || arrival === void 0 ? "" : string(arrival, "safe_head"),
+      unsafeObservedMaxSuid: row === null || row === void 0 ? "" : string(row, "max_suid"),
+      rebuildRequired: arrival !== null && arrival !== void 0 && integer(arrival, "rebuild_required") === 1
+    };
+  }
+  async hasTargetReceipt(serviceId, viewId, eventId, suid) {
+    const receipt = await this.database.prepare(`SELECT 1 FROM mv_unsafe_receipts WHERE service_id = ? AND view_id = ? AND event_id = ? AND suid = ?`).bind(serviceId, viewId, eventId, suid).first();
+    return receipt !== null && receipt !== void 0;
+  }
+  async acquireKick(serviceId, viewId, owner, nowMs, leaseMs) {
+    const operation = operationId();
+    try {
+      await this.database.batch([
+        this.database.prepare(
+          `INSERT INTO mv_atomic_guards (operation_id, checkpoint_match)
+           SELECT ?, CASE WHEN EXISTS (SELECT 1 FROM mv_unsafe_kicks WHERE service_id = ? AND view_id = ? AND dirty = 1 AND (lease_owner IS NULL OR lease_until <= ? OR lease_owner = ?)) THEN 1 ELSE NULL END`
+        ).bind(operation, serviceId, viewId, nowMs, owner),
+        this.database.prepare(`UPDATE mv_unsafe_kicks SET lease_owner = ?, lease_until = ?, dirty = 0 WHERE service_id = ? AND view_id = ?`).bind(owner, nowMs + leaseMs, serviceId, viewId),
+        this.database.prepare("DELETE FROM mv_atomic_guards WHERE operation_id = ?").bind(operation)
+      ]);
+    } catch (error) {
+      throw new UnsafeWindowMaterializedViewError("UNSAFE_KICK_LEASE_HELD", true, "Unsafe kick is held by another lease owner", { cause: error });
+    }
+    const row = await this.database.prepare(`SELECT target_suid, dirty FROM mv_unsafe_kicks WHERE service_id = ? AND view_id = ?`).bind(serviceId, viewId).first();
+    return row === null || row === void 0 ? void 0 : { targetSuid: string(row, "target_suid"), dirty: integer(row, "dirty") === 1 };
+  }
+  /**
+   * Settle an unsafe kick at the checkpoint actually reached by its follow.
+   * A first-unsafe return is a successful bounded pass, not proof that the
+   * lease target was reached.  When a reached checkpoint is supplied, keep the
+   * durable dirty bit set if the target remains ahead so the next scheduled
+   * tick can acquire the kick again.  Requiring this checkpoint keeps every
+   * production settlement honest about whether its target was reached.
+   */
+  async finishKick(serviceId, viewId, owner, reachedSuid) {
+    if (reachedSuid.length > 0) assertSortableUniqueId(reachedSuid);
+    const result = await this.database.prepare(
+      `UPDATE mv_unsafe_kicks
+          SET lease_owner = NULL,
+              lease_until = 0,
+              dirty = CASE
+                WHEN ? IS NOT NULL AND target_suid COLLATE BINARY > ? COLLATE BINARY THEN 1
+                ELSE 0
+              END
+        WHERE service_id = ? AND view_id = ? AND lease_owner = ? AND dirty = 0`
+    ).bind(reachedSuid, reachedSuid, serviceId, viewId, owner).run();
+    return result.meta.changes === 1;
+  }
+  /**
+   * Collect a repairable unsafe row only when every recovery predicate holds.
+   * Every predicate is a constraint-promotion guard ahead of the deletes; a
+   * rejected GC therefore cannot leak a partially removed index/receipt.
+   */
+  async garbageCollect(input) {
+    const operation = operationId();
+    const statements = [
+      // safeHead >= row source, including the mandatory post-GC resurrection fence.
+      this.database.prepare(`INSERT INTO mv_atomic_guards (operation_id, checkpoint_match) SELECT ?, CASE WHEN ? COLLATE BINARY >= ? COLLATE BINARY THEN 1 ELSE NULL END`).bind(`${operation}:safe-head`, input.safeHead, input.expectedSourceSuid),
+      // Arrival receipt/watermark is a separate condition from the
+      // fail-closed detector state; each has its own in-batch guard.
+      this.database.prepare(
+        `INSERT INTO mv_atomic_guards (operation_id, checkpoint_match)
+         SELECT ?, CASE WHEN EXISTS (SELECT 1 FROM mv_unsafe_arrivals WHERE service_id = ? AND view_id = ? AND generation = ? AND arrival_watermark COLLATE BINARY >= ? COLLATE BINARY) THEN 1 ELSE NULL END`
+      ).bind(`${operation}:arrival`, input.serviceId, input.viewId, input.generation, input.expectedSourceSuid),
+      this.database.prepare(
+        `INSERT INTO mv_atomic_guards (operation_id, checkpoint_match)
+         SELECT ?, CASE WHEN EXISTS (SELECT 1 FROM mv_unsafe_arrivals WHERE service_id = ? AND view_id = ? AND generation = ? AND rebuild_required = 0) THEN 1 ELSE NULL END`
+      ).bind(`${operation}:frontier`, input.serviceId, input.viewId, input.generation),
+      // Candidate/retired generations and changed materializer definitions are
+      // never GC targets.  These are intentionally separate guards so a
+      // definition mutation cannot piggy-back on an active-generation check.
+      this.database.prepare(
+        `INSERT INTO mv_atomic_guards (operation_id, checkpoint_match)
+         SELECT ?, CASE WHEN EXISTS (SELECT 1 FROM mv_active_generations WHERE service_id = ? AND view_id = ? AND generation = ?) THEN 1 ELSE NULL END`
+      ).bind(`${operation}:active-generation`, input.serviceId, input.viewId, input.generation),
+      this.database.prepare(
+        `INSERT INTO mv_atomic_guards (operation_id, checkpoint_match)
+         SELECT ?, CASE WHEN EXISTS (SELECT 1 FROM mv_instances WHERE service_id = ? AND view_id = ? AND generation = ? AND definition_version = ?) THEN 1 ELSE NULL END`
+      ).bind(`${operation}:definition`, input.serviceId, input.viewId, input.generation, input.definitionVersion),
+      // Compare-and-delete is revalidated inside the atomic batch, never on a
+      // read-then-delete snapshot.
+      this.database.prepare(
+        `INSERT INTO mv_atomic_guards (operation_id, checkpoint_match)
+         SELECT ?, CASE WHEN EXISTS (SELECT 1 FROM mv_unsafe_rows WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ? AND row_version = ? AND source_suid COLLATE BINARY = ? COLLATE BINARY) THEN 1 ELSE NULL END`
+      ).bind(`${operation}:row`, input.serviceId, input.viewId, input.generation, input.rowKey, input.expectedRowVersion, input.expectedSourceSuid),
+      this.database.prepare(`DELETE FROM mv_unsafe_index_entries WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?`).bind(input.serviceId, input.viewId, input.generation, input.rowKey),
+      this.database.prepare(`DELETE FROM mv_unsafe_markers WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?`).bind(input.serviceId, input.viewId, input.generation, input.rowKey),
+      this.database.prepare(`DELETE FROM mv_unsafe_receipts WHERE service_id = ? AND view_id = ? AND suid = ?`).bind(input.serviceId, input.viewId, input.expectedSourceSuid),
+      this.database.prepare(`DELETE FROM mv_wait_receipts WHERE service_id = ? AND view_id = ? AND generation = ? AND suid = ?`).bind(input.serviceId, input.viewId, input.generation, input.expectedSourceSuid),
+      this.database.prepare(`DELETE FROM mv_unsafe_rows WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ? AND row_version = ? AND source_suid COLLATE BINARY = ? COLLATE BINARY`).bind(input.serviceId, input.viewId, input.generation, input.rowKey, input.expectedRowVersion, input.expectedSourceSuid),
+      this.database.prepare("DELETE FROM mv_atomic_guards WHERE operation_id LIKE ?").bind(`${operation}:%`)
+    ];
+    try {
+      await this.database.batch(statements);
+      return true;
+    } catch (error) {
+      if (String(error).includes("mv_atomic_guards") || String(error).includes("checkpoint_match")) return false;
+      throw error;
+    }
+  }
+  /**
+   * Idle catch-up calls this after it has advanced (or observed) the safe
+   * checkpoint.  Candidates are deliberately rechecked by garbageCollect;
+   * this read is only work selection, never permission to delete.
+   */
+  async collectEligible(serviceId, viewId, generation, definitionVersion, safeHead) {
+    if (safeHead === "") return 0;
+    const candidates = await this.database.prepare(
+      `SELECT row_key, row_version, source_suid FROM mv_unsafe_rows
+        WHERE service_id = ? AND view_id = ? AND generation = ?
+          AND source_suid COLLATE BINARY <= ? COLLATE BINARY
+        ORDER BY source_suid COLLATE BINARY ASC, row_key COLLATE BINARY ASC`
+    ).bind(serviceId, viewId, generation, safeHead).all();
+    let collected = 0;
+    for (const row of candidates.results) {
+      const candidate = {
+        rowKey: string(row, "row_key"),
+        rowVersion: integer(row, "row_version"),
+        sourceSuid: string(row, "source_suid")
+      };
+      if (await this.garbageCollect({
+        serviceId,
+        viewId,
+        generation,
+        definitionVersion,
+        rowKey: candidate.rowKey,
+        expectedRowVersion: candidate.rowVersion,
+        expectedSourceSuid: candidate.sourceSuid,
+        safeHead
+      })) collected += 1;
+    }
+    return collected;
+  }
+  async queryComposedPage(serviceId, viewId, generation, limit, offset, descending = false) {
+    const meta = await this.readMeta(serviceId, viewId, generation);
+    if (meta.rebuildRequired) throw new UnsafeWindowMaterializedViewError("UNSAFE_BEHIND_FRONTIER", false, "Unsafe window is rebuilding after a behind-frontier arrival");
+    const direction = descending ? "DESC" : "ASC";
+    const result = await this.database.prepare(
+      `WITH candidates AS (
+         SELECT row_key, value_json, row_version, source_suid, 0 AS tombstone, 0 AS unsafe_layer FROM mv_rows
+          WHERE service_id = ? AND view_id = ? AND generation = ?
+         UNION ALL
+         SELECT row_key, value_json, row_version, source_suid, tombstone, 1 AS unsafe_layer FROM mv_unsafe_rows
+          WHERE service_id = ? AND view_id = ? AND generation = ?
+       ), ranked AS (
+         SELECT *, ROW_NUMBER() OVER (PARTITION BY row_key ORDER BY source_suid COLLATE BINARY DESC, unsafe_layer ASC) AS winner_rank FROM candidates
+       ), live AS (
+         SELECT *, COUNT(*) OVER() AS total_count FROM ranked WHERE winner_rank = 1 AND tombstone = 0
+       )
+       SELECT row_key, value_json, row_version, source_suid, total_count FROM live
+       ORDER BY source_suid COLLATE BINARY ${direction}, row_key COLLATE BINARY ${direction} LIMIT ? OFFSET ?`
+    ).bind(serviceId, viewId, generation, serviceId, viewId, generation, limit, offset).all();
+    const rows = result.results.map((row) => ({
+      serviceId,
+      viewId,
+      generation,
+      rowKey: string(row, "row_key"),
+      value: assertJsonValue(JSON.parse(string(row, "value_json")), "state-persistence"),
+      rowVersion: integer(row, "row_version"),
+      sourceSuid: string(row, "source_suid")
+    }));
+    return { rows, totalCount: result.results.length === 0 ? 0 : integer(result.results[0], "total_count") };
+  }
+  addIndex(statements, table, input, entry) {
+    const typed = entry.valueType === "text" ? [entry.value, null, null] : entry.valueType === "integer" ? [null, entry.value, null] : [null, null, entry.value];
+    statements.push(this.database.prepare(
+      `INSERT INTO ${table} (service_id, view_id, generation, index_id, value_type, text_value, integer_value, real_value, row_key)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT DO NOTHING`
+    ).bind(input.serviceId, input.viewId, input.generation, entry.indexId, entry.valueType, ...typed, entry.rowKey));
+  }
+};
+
+// src/mv/MaterializedViewStore.ts
+var MaterializedViewStoreError = class extends Error {
+  constructor(operation, code, message, options) {
+    super(message, options);
+    this.operation = operation;
+    this.code = code;
+    this.name = "MaterializedViewStoreError";
+  }
+  operation;
+  code;
+};
+var MaterializedViewCasError = class extends MaterializedViewStoreError {
+  constructor(message = "Materialized-view checkpoint CAS did not match") {
+    super("apply", "MV_CAS_MISMATCH", message);
+    this.name = "MaterializedViewCasError";
+  }
+};
+var MaterializedViewPromotionCasError = class extends MaterializedViewStoreError {
+  constructor(message = "Materialized-view active-generation CAS did not match") {
+    super("promote", "MV_PROMOTION_CAS_MISMATCH", message);
+    this.name = "MaterializedViewPromotionCasError";
+  }
+};
+var MaterializedViewPatchError = class extends MaterializedViewStoreError {
+  constructor(message = "Materialized-view JSON patch target row does not exist") {
+    super("apply", "MV_PATCH_ROW_MISSING", message);
+    this.name = "MaterializedViewPatchError";
+  }
+};
+function asString(value, name) {
+  if (typeof value !== "string") throw new Error(`MV ${name} was not a string`);
+  return value;
+}
+function asInteger(value, name) {
+  const number = typeof value === "number" ? value : Number(value);
+  if (!Number.isSafeInteger(number)) throw new Error(`MV ${name} was not a safe integer`);
+  return number;
+}
+function asStatus(value) {
+  if (value === "active" || value === "candidate" || value === "retired") return value;
+  throw new Error("MV instance status was invalid");
+}
+function compareSuid2(left, right) {
+  const leftBytes = new TextEncoder().encode(left);
+  const rightBytes = new TextEncoder().encode(right);
+  for (let index = 0; index < Math.min(leftBytes.length, rightBytes.length); index += 1) {
+    const difference = leftBytes[index] - rightBytes[index];
+    if (difference !== 0) return difference;
+  }
+  return leftBytes.length - rightBytes.length;
+}
+function maxReflectedSuid(rows) {
+  let maximum = "";
+  for (const row of rows) {
+    if (maximum === "" || compareSuid2(row.sourceSuid, maximum) > 0) maximum = row.sourceSuid;
+  }
+  return maximum;
+}
+function instanceFrom(row) {
+  return {
+    serviceId: asString(row.service_id, "service_id"),
+    viewId: asString(row.view_id, "view_id"),
+    generation: asInteger(row.generation, "generation"),
+    status: asStatus(row.status),
+    lastSuid: asString(row.last_suid, "last_suid"),
+    definitionVersion: asInteger(row.definition_version, "definition_version"),
+    updatedAt: asInteger(row.updated_at, "updated_at"),
+    rebuildVerifiedAt: row.rebuild_verified_at === null || row.rebuild_verified_at === void 0 ? null : asInteger(row.rebuild_verified_at, "rebuild_verified_at"),
+    rebuildRecoveryId: row.rebuild_recovery_id === null || row.rebuild_recovery_id === void 0 ? null : asString(row.rebuild_recovery_id, "rebuild_recovery_id"),
+    rebuildIncidentIdentity: row.rebuild_incident_identity === null || row.rebuild_incident_identity === void 0 ? null : asString(row.rebuild_incident_identity, "rebuild_incident_identity"),
+    rebuildIncidentGeneration: row.rebuild_incident_generation === null || row.rebuild_incident_generation === void 0 ? null : asInteger(row.rebuild_incident_generation, "rebuild_incident_generation"),
+    rebuildSourceEventCount: row.rebuild_source_event_count === null || row.rebuild_source_event_count === void 0 ? null : asInteger(row.rebuild_source_event_count, "rebuild_source_event_count"),
+    rebuildSourceMaxSuid: row.rebuild_source_max_suid === null || row.rebuild_source_max_suid === void 0 ? null : asString(row.rebuild_source_max_suid, "rebuild_source_max_suid"),
+    rebuildSourceHistoryDigest: row.rebuild_source_history_digest === null || row.rebuild_source_history_digest === void 0 ? null : asString(row.rebuild_source_history_digest, "rebuild_source_history_digest")
+  };
+}
+function valueType(value) {
+  if (value === "text" || value === "integer" || value === "real") return value;
+  throw new Error("MV index value type was invalid");
+}
+function indexValue(row, type) {
+  if (type === "text") return asString(row.text_value, "text_value");
+  const number = typeof row[`${type}_value`] === "number" ? row[`${type}_value`] : Number(row[`${type}_value`]);
+  if (!Number.isFinite(number) || type === "integer" && !Number.isSafeInteger(number)) {
+    throw new Error(`MV ${type}_value was invalid`);
+  }
+  return number;
+}
+function operationId2() {
+  return `mv-${crypto.randomUUID()}`;
+}
+function isCasFailure(error) {
+  const message = String(error);
+  return message.includes("mv_atomic_guards.checkpoint_match") || message.includes("MV_CAS_MISMATCH");
+}
+function isPatchFailure(error) {
+  return String(error).includes("CHECK constraint failed: checkpoint_match");
+}
+var D1MaterializedViewStore = class {
+  constructor(database) {
+    this.database = database;
+    this.unsafe = new UnsafeWindowMaterializedViewStore(database);
+  }
+  database;
+  initialized = false;
+  unsafe;
+  async initialize() {
+    if (this.initialized) return;
+    await this.database.prepare("SELECT 1 FROM mv_instances LIMIT 1").all();
+    await this.database.prepare("SELECT 1 FROM mv_atomic_guards LIMIT 1").all();
+    await this.database.prepare("SELECT 1 FROM mv_checkpoint_ahead_findings LIMIT 1").all();
+    await this.database.prepare("SELECT 1 FROM mv_ordering_quarantines LIMIT 1").all();
+    this.initialized = true;
+  }
+  async createActive(input) {
+    this.ready("create-active");
+    const generation = input.generation ?? 0;
+    this.validateGeneration(generation, "create-active");
+    const lastSuid = input.lastSuid ?? "";
+    if (lastSuid.length > 0) assertSortableUniqueId(lastSuid);
+    try {
+      await this.database.batch([
+        this.database.prepare(
+          `INSERT INTO mv_instances
+             (service_id, view_id, generation, status, last_suid, definition_version, updated_at)
+           VALUES (?, ?, ?, 'active', ?, ?, ?)`
+        ).bind(input.serviceId, input.viewId, generation, lastSuid, input.definitionVersion, input.updatedAt),
+        this.database.prepare(
+          `INSERT INTO mv_active_generations (service_id, view_id, generation, updated_at)
+           VALUES (?, ?, ?, ?)`
+        ).bind(input.serviceId, input.viewId, generation, input.updatedAt)
+      ]);
+    } catch (error) {
+      throw new MaterializedViewStoreError("create-active", "MV_INSTANCE_EXISTS", `Active materialized view already exists: ${String(error)}`, { cause: error });
+    }
+    return this.readInstance(input.serviceId, input.viewId, generation);
+  }
+  async createCandidate(input) {
+    this.ready("create-candidate");
+    this.validateGeneration(input.generation, "create-candidate");
+    if ((input.lastSuid ?? "").length > 0) assertSortableUniqueId(input.lastSuid);
+    try {
+      await this.database.prepare(
+        `INSERT INTO mv_instances
+           (service_id, view_id, generation, status, last_suid, definition_version, updated_at)
+         VALUES (?, ?, ?, 'candidate', ?, ?, ?)`
+      ).bind(
+        input.serviceId,
+        input.viewId,
+        input.generation,
+        input.lastSuid ?? "",
+        input.definitionVersion,
+        input.updatedAt
+      ).run();
+    } catch (error) {
+      throw new MaterializedViewStoreError("create-candidate", "MV_INSTANCE_EXISTS", `Candidate generation already exists: ${String(error)}`, { cause: error });
+    }
+    return this.readInstance(input.serviceId, input.viewId, input.generation);
+  }
+  async beginRebuild(input) {
+    this.ready("create-candidate");
+    const generation = input.generation ?? await this.nextGeneration(input.serviceId, input.viewId);
+    return this.createCandidate({ ...input, generation });
+  }
+  async nextGeneration(serviceId, viewId) {
+    this.ready("create-candidate");
+    const row = await this.database.prepare(
+      `SELECT COALESCE(MAX(generation), -1) AS generation FROM mv_instances WHERE service_id = ? AND view_id = ?`
+    ).bind(serviceId, viewId).first();
+    return asInteger(row?.generation ?? -1, "generation") + 1;
+  }
+  async readInstance(serviceId, viewId, generation) {
+    this.ready("initialize");
+    const row = await this.database.prepare(
+      `SELECT service_id, view_id, generation, status, last_suid, definition_version, updated_at,
+              rebuild_verified_at, rebuild_recovery_id, rebuild_incident_identity,
+              rebuild_incident_generation, rebuild_source_event_count,
+              rebuild_source_max_suid, rebuild_source_history_digest
+         FROM mv_instances WHERE service_id = ? AND view_id = ? AND generation = ?`
+    ).bind(serviceId, viewId, generation).first();
+    return row === null || row === void 0 ? void 0 : instanceFrom(row);
+  }
+  async readActive(serviceId, viewId) {
+    this.ready("initialize");
+    const row = await this.database.prepare(
+      `SELECT instance.service_id, instance.view_id, instance.generation, instance.status,
+              instance.last_suid, instance.definition_version, instance.updated_at,
+              instance.rebuild_verified_at, instance.rebuild_recovery_id,
+              instance.rebuild_incident_identity, instance.rebuild_incident_generation,
+              instance.rebuild_source_event_count, instance.rebuild_source_max_suid,
+              instance.rebuild_source_history_digest
+         FROM mv_active_generations pointer
+         JOIN mv_instances instance
+           ON instance.service_id = pointer.service_id
+          AND instance.view_id = pointer.view_id
+          AND instance.generation = pointer.generation
+        WHERE pointer.service_id = ? AND pointer.view_id = ?`
+    ).bind(serviceId, viewId).first();
+    return row === null || row === void 0 ? void 0 : instanceFrom(row);
+  }
+  async readRows(serviceId, viewId, generation) {
+    this.ready("initialize");
+    const selected = generation ?? (await this.readActive(serviceId, viewId))?.generation;
+    if (selected === void 0) return [];
+    const result = await this.database.prepare(
+      `SELECT service_id, view_id, generation, row_key, value_json, row_version, source_suid
+         FROM mv_rows
+        WHERE service_id = ? AND view_id = ? AND generation = ?
+        ORDER BY row_key COLLATE BINARY ASC`
+    ).bind(serviceId, viewId, selected).all();
+    return result.results.map((row) => this.rowFrom(row));
+  }
+  async readIndexEntries(serviceId, viewId, generation) {
+    this.ready("initialize");
+    const selected = generation ?? (await this.readActive(serviceId, viewId))?.generation;
+    if (selected === void 0) return [];
+    const result = await this.database.prepare(
+      `SELECT service_id, view_id, generation, index_id, value_type,
+              text_value, integer_value, real_value, row_key
+         FROM mv_index_entries
+        WHERE service_id = ? AND view_id = ? AND generation = ?
+        ORDER BY index_id COLLATE BINARY ASC, value_type COLLATE BINARY ASC,
+                 COALESCE(text_value, CAST(integer_value AS TEXT), CAST(real_value AS TEXT)) COLLATE BINARY ASC,
+                 row_key COLLATE BINARY ASC`
+    ).bind(serviceId, viewId, selected).all();
+    return result.results.map((row) => this.indexFrom(row));
+  }
+  /** Read rows through a declared index without exposing SQL identifiers to callers. */
+  async queryRows(serviceId, viewId, options = {}) {
+    this.ready("initialize");
+    const selected = options.generation ?? (await this.readActive(serviceId, viewId))?.generation;
+    if (selected === void 0) return [];
+    const limit = options.limit === void 0 ? 100 : options.limit;
+    const offset = options.offset ?? 0;
+    if (limit !== null && (!Number.isSafeInteger(limit) || limit < 0) || !Number.isSafeInteger(offset) || offset < 0) {
+      throw new MaterializedViewStoreError("initialize", "MV_VALUE_INVALID", "MV query limit/offset must be non-negative integers");
+    }
+    if (options.indexId === void 0) {
+      const limitClause2 = limit === null ? "" : " LIMIT ? OFFSET ?";
+      const direction2 = options.descending === true ? "DESC" : "ASC";
+      const values2 = [serviceId, viewId, selected];
+      if (limit !== null) values2.push(limit, offset);
+      const result2 = await this.database.prepare(
+        `SELECT service_id, view_id, generation, row_key, value_json, row_version, source_suid
+           FROM mv_rows
+          WHERE service_id = ? AND view_id = ? AND generation = ?
+          ORDER BY row_key COLLATE BINARY ${direction2}${limitClause2}`
+      ).bind(...values2).all();
+      return result2.results.map((row) => this.rowFrom(row));
+    }
+    const valueType2 = options.valueType;
+    const orderColumn = valueType2 === "text" ? "index_entry.text_value" : valueType2 === "integer" ? "index_entry.integer_value" : valueType2 === "real" ? "index_entry.real_value" : "index_entry.row_key";
+    const direction = options.descending === true ? "DESC" : "ASC";
+    const indexPredicate = options.indexId === void 0 ? "" : " AND index_entry.index_id = ?";
+    const typePredicate = valueType2 === void 0 ? "" : " AND index_entry.value_type = ?";
+    const values = [serviceId, viewId, selected];
+    if (options.indexId !== void 0) values.push(options.indexId);
+    if (valueType2 !== void 0) values.push(valueType2);
+    if (limit !== null) values.push(limit, offset);
+    const limitClause = limit === null ? "" : " LIMIT ? OFFSET ?";
+    const result = await this.database.prepare(
+      `SELECT row.service_id, row.view_id, row.generation, row.row_key,
+              row.value_json, row.row_version, row.source_suid
+         FROM mv_index_entries index_entry
+         JOIN mv_rows row
+           ON row.service_id = index_entry.service_id
+          AND row.view_id = index_entry.view_id
+          AND row.generation = index_entry.generation
+          AND row.row_key = index_entry.row_key
+        WHERE row.service_id = ? AND row.view_id = ? AND row.generation = ?${indexPredicate}${typePredicate}
+        ORDER BY ${orderColumn} COLLATE BINARY ${direction}, row.row_key COLLATE BINARY ${direction}${limitClause}`
+    ).bind(...values).all();
+    return result.results.map((row) => this.rowFrom(row));
+  }
+  /** SDT-G23 composed server page; count and page rows share one statement. */
+  async queryRowsWithTotal(serviceId, viewId, options = {}) {
+    this.ready("initialize");
+    const selected = options.generation ?? (await this.readActive(serviceId, viewId))?.generation;
+    if (selected === void 0) return { rows: [], totalCount: 0 };
+    const limit = options.limit === null ? -1 : options.limit === void 0 ? 100 : options.limit;
+    const offset = options.offset ?? 0;
+    if (!Number.isSafeInteger(limit) || limit < -1 || !Number.isSafeInteger(offset) || offset < 0) {
+      throw new MaterializedViewStoreError("initialize", "MV_VALUE_INVALID", "MV composed query needs limit -1 or a non-negative limit/offset");
+    }
+    return this.unsafe.queryComposedPage(serviceId, viewId, selected, limit, offset, options.descending === true);
+  }
+  /**
+   * SDT-G55's explicit list-read port.  Existing composed reads intentionally
+   * keep their G23 semantics; only this port can include unsafe rows, and it
+   * can include only rows newer than the active safe checkpoint.
+   */
+  async readListPage(serviceId, viewId, options = {}) {
+    this.ready("initialize");
+    const active = await this.readActive(serviceId, viewId);
+    if (active === void 0) return { rows: [], totalCount: 0, readHead: "" };
+    const selected = options.generation ?? active.generation;
+    const selectedInstance = selected === active.generation ? active : await this.readInstance(serviceId, viewId, selected);
+    if (selectedInstance === void 0) {
+      throw new MaterializedViewStoreError("initialize", "MV_INSTANCE_MISSING", "Requested materialized-view generation is unavailable");
+    }
+    const limit = options.limit === null ? -1 : options.limit === void 0 ? 100 : options.limit;
+    const offset = options.offset ?? 0;
+    if (!Number.isSafeInteger(limit) || limit < -1 || !Number.isSafeInteger(offset) || offset < 0) {
+      throw new MaterializedViewStoreError("initialize", "MV_VALUE_INVALID", "MV list query needs limit -1 or a non-negative limit/offset");
+    }
+    if (options.indexId !== void 0 || options.valueType !== void 0) {
+      throw new MaterializedViewStoreError("initialize", "MV_VALUE_INVALID", "MV list query does not support an index selector");
+    }
+    const direction = options.descending === true ? "DESC" : "ASC";
+    const safeRows = `SELECT row_key, value_json, row_version, source_suid, 0 AS tombstone, 0 AS unsafe_layer FROM mv_rows
+          WHERE service_id = ? AND view_id = ? AND generation = ?`;
+    const result = options.consistency === "unsafe" ? await this.database.prepare(
+      `WITH candidates AS (
+           ${safeRows}
+           UNION ALL
+           SELECT row_key, value_json, row_version, source_suid, tombstone, 1 AS unsafe_layer FROM mv_unsafe_rows
+            WHERE service_id = ? AND view_id = ? AND generation = ?
+              AND source_suid COLLATE BINARY > ? COLLATE BINARY
+         ), ranked AS (
+           SELECT *, ROW_NUMBER() OVER (PARTITION BY row_key ORDER BY source_suid COLLATE BINARY DESC, unsafe_layer ASC) AS winner_rank FROM candidates
+         ), live AS (
+           SELECT *, COUNT(*) OVER() AS total_count FROM ranked WHERE winner_rank = 1 AND tombstone = 0
+         )
+         SELECT row_key, value_json, row_version, source_suid, total_count FROM live
+         ORDER BY source_suid COLLATE BINARY ${direction}, row_key COLLATE BINARY ${direction} LIMIT ? OFFSET ?`
+    ).bind(serviceId, viewId, selected, serviceId, viewId, selected, selectedInstance.lastSuid, limit, offset).all() : await this.database.prepare(
+      `WITH live AS (
+           SELECT row_key, value_json, row_version, source_suid, COUNT(*) OVER() AS total_count FROM mv_rows
+            WHERE service_id = ? AND view_id = ? AND generation = ?
+         )
+         SELECT row_key, value_json, row_version, source_suid, total_count FROM live
+         ORDER BY source_suid COLLATE BINARY ${direction}, row_key COLLATE BINARY ${direction} LIMIT ? OFFSET ?`
+    ).bind(serviceId, viewId, selected, limit, offset).all();
+    const rows = result.results.map((row) => ({
+      serviceId,
+      viewId,
+      generation: selected,
+      rowKey: asString(row.row_key, "row_key"),
+      value: assertJsonValue(JSON.parse(asString(row.value_json, "value_json")), "state-persistence"),
+      rowVersion: asInteger(row.row_version, "row_version"),
+      sourceSuid: asString(row.source_suid, "source_suid")
+    }));
+    return {
+      rows,
+      totalCount: result.results.length === 0 ? 0 : asInteger(result.results[0].total_count, "total_count"),
+      // Safe reads report the active checkpoint even for an empty page. Unsafe
+      // reads instead report only what this page actually reflected.
+      readHead: options.consistency === "unsafe" ? maxReflectedSuid(rows) : selectedInstance.lastSuid
+    };
+  }
+  /** Explicit unsafe port: callers must choose this exceptional immediate lane. */
+  unsafeWindow() {
+    this.ready("apply");
+    return this.unsafe;
+  }
+  /** Runs repairable unsafe GC after an idle or advancing safe catch-up pass. */
+  async collectUnsafeGarbage(serviceId, viewId, generation, definitionVersion, safeHead) {
+    this.ready("apply");
+    return this.unsafe.collectEligible(serviceId, viewId, generation, definitionVersion, safeHead);
+  }
+  async hasTargetReceipt(serviceId, viewId, eventId, suid) {
+    this.ready("initialize");
+    return this.unsafe.hasTargetReceipt(serviceId, viewId, eventId, suid);
+  }
+  /**
+   * Read all G31 wait facts in one static D1 statement. Every table access is
+   * keyed by service/view/active generation (and target identity where
+   * applicable); no row or source-history scan is permitted on this path.
+   */
+  async readWaitForState(serviceId, viewId, target) {
+    this.ready("initialize");
+    const row = await this.database.prepare(
+      `WITH active AS (
+         SELECT instance.generation, instance.definition_version, instance.last_suid
+           FROM mv_active_generations pointer
+           JOIN mv_instances instance
+             ON instance.service_id = pointer.service_id
+            AND instance.view_id = pointer.view_id
+            AND instance.generation = pointer.generation
+          WHERE pointer.service_id = ? AND pointer.view_id = ?
+       )
+       SELECT
+         (SELECT generation FROM active) AS active_generation,
+         (SELECT definition_version FROM active) AS active_definition_version,
+         COALESCE((SELECT last_suid FROM active), '') AS safe_contiguous_head,
+         CASE WHEN EXISTS (
+           SELECT 1
+             FROM mv_wait_receipts receipt
+             JOIN active
+               ON active.generation = receipt.generation
+              AND active.definition_version = receipt.definition_version
+            WHERE receipt.service_id = ? AND receipt.view_id = ?
+              AND receipt.event_id = ? AND receipt.suid = ?
+         ) THEN 1 ELSE 0 END AS target_receipt,
+         CASE WHEN EXISTS (
+           SELECT 1
+             FROM mv_checkpoint_ahead_findings finding
+             JOIN active
+               ON active.generation = finding.generation
+            WHERE finding.service_id = ? AND finding.view_id = ?
+         ) THEN 1 ELSE 0 END AS checkpoint_ahead,
+         COALESCE((
+           SELECT arrival.rebuild_required
+             FROM mv_unsafe_arrivals arrival
+             JOIN active
+               ON active.generation = arrival.generation
+            WHERE arrival.service_id = ? AND arrival.view_id = ?
+         ), 0) AS rebuild_required,
+         CASE WHEN EXISTS (
+           SELECT 1
+             FROM mv_wait_target_poison finding
+             JOIN active
+               ON active.generation = finding.generation
+              AND active.definition_version = finding.definition_version
+            WHERE finding.service_id = ? AND finding.view_id = ?
+              AND finding.suid = ?
+              AND (? IS NULL OR finding.event_id = ?)
+         ) THEN 1 ELSE 0 END AS poison`
+    ).bind(
+      serviceId,
+      viewId,
+      serviceId,
+      viewId,
+      target.eventId ?? "",
+      target.suid,
+      serviceId,
+      viewId,
+      serviceId,
+      viewId,
+      serviceId,
+      viewId,
+      target.suid,
+      target.eventId ?? null,
+      target.eventId ?? null
+    ).first();
+    if (row === null || row === void 0) {
+      throw new MaterializedViewStoreError("initialize", "MV_STORE_OPERATION_FAILED", "D1 wait-state query returned no row");
+    }
+    const generation = row.active_generation === null || row.active_generation === void 0 ? void 0 : asInteger(row.active_generation, "active_generation");
+    const definitionVersion = row.active_definition_version === null || row.active_definition_version === void 0 ? void 0 : asInteger(row.active_definition_version, "active_definition_version");
+    return {
+      activeGeneration: generation,
+      activeDefinitionVersion: definitionVersion,
+      safeContiguousHead: asString(row.safe_contiguous_head, "safe_contiguous_head"),
+      targetReceipt: asInteger(row.target_receipt, "target_receipt") === 1,
+      checkpointAhead: asInteger(row.checkpoint_ahead, "checkpoint_ahead") === 1,
+      rebuildRequired: asInteger(row.rebuild_required, "rebuild_required") === 1,
+      poison: asInteger(row.poison, "poison") === 1
+    };
+  }
+  /** Idempotent operational fact: a stored Queue event needs unsafe retry/DLQ attention. */
+  async recordUnsafeFailureFinding(input) {
+    this.ready("apply");
+    const legacyFinding = this.database.prepare(
+      `INSERT INTO mv_unsafe_failure_findings
+         (service_id, view_id, event_id, suid, classification, observed_at)
+       VALUES (?, ?, ?, ?, 'UNSAFE_APPLY_RETRY', ?)
+       ON CONFLICT (service_id, view_id, event_id, suid, classification) DO NOTHING`
+    ).bind(input.serviceId, input.viewId, input.eventId, input.suid, input.observedAt);
+    const targetPoison = input.generation === void 0 ? this.database.prepare(
+      `INSERT INTO mv_wait_target_poison
+           (service_id, view_id, generation, definition_version, event_id, suid, classification, observed_at)
+         SELECT instance.service_id, instance.view_id, instance.generation, instance.definition_version, ?, ?, 'UNSAFE_APPLY_RETRY', ?
+           FROM mv_active_generations active
+           JOIN mv_instances instance
+             ON instance.service_id = active.service_id
+            AND instance.view_id = active.view_id
+            AND instance.generation = active.generation
+          WHERE active.service_id = ? AND active.view_id = ?
+         ON CONFLICT DO NOTHING`
+    ).bind(input.eventId, input.suid, input.observedAt, input.serviceId, input.viewId) : this.database.prepare(
+      `INSERT INTO mv_wait_target_poison
+           (service_id, view_id, generation, definition_version, event_id, suid, classification, observed_at)
+         SELECT instance.service_id, instance.view_id, instance.generation, instance.definition_version, ?, ?, 'UNSAFE_APPLY_RETRY', ?
+           FROM mv_instances instance
+          WHERE instance.service_id = ? AND instance.view_id = ? AND instance.generation = ?
+         ON CONFLICT DO NOTHING`
+    ).bind(input.eventId, input.suid, input.observedAt, input.serviceId, input.viewId, input.generation);
+    await this.database.batch([legacyFinding, targetPoison]);
+  }
+  /**
+   * Persist the source-reset observation exactly once for the affected
+   * generation.  This deliberately never rewinds `mv_instances.last_suid`.
+   */
+  async recordCheckpointAhead(input) {
+    this.ready("apply");
+    await this.database.prepare(
+      `INSERT INTO mv_checkpoint_ahead_findings
+         (service_id, view_id, generation, checkpoint_suid, store_max_suid, observed_at)
+       VALUES (?, ?, ?, ?, ?, ?)
+       ON CONFLICT (service_id, view_id, generation) DO NOTHING`
+    ).bind(
+      input.serviceId,
+      input.viewId,
+      input.generation,
+      input.checkpointSuid,
+      input.storeMaxSuid,
+      input.observedAt
+    ).run();
+  }
+  /** An open finding on the active generation fail-closes composed MV reads. */
+  async hasCheckpointAheadFinding(serviceId, viewId) {
+    this.ready("initialize");
+    const result = await this.database.prepare(
+      `SELECT 1 AS present
+         FROM mv_checkpoint_ahead_findings finding
+         JOIN mv_active_generations active
+           ON active.service_id = finding.service_id
+          AND active.view_id = finding.view_id
+          AND active.generation = finding.generation
+        WHERE finding.service_id = ? AND finding.view_id = ?
+        LIMIT 1`
+    ).bind(serviceId, viewId).first();
+    return result?.present === 1;
+  }
+  /** Open quarantine is keyed to the active generation; old generations are not a public read gate. */
+  async readOrderingQuarantine(serviceId, viewId) {
+    this.ready("initialize");
+    const row = await this.database.prepare(
+      `SELECT quarantine.service_id, quarantine.view_id, quarantine.generation,
+              quarantine.checkpoint_suid, quarantine.late_suid, quarantine.event_id,
+              quarantine.classification, quarantine.status, quarantine.observed_at,
+              quarantine.resolved_at, quarantine.incident_identity
+         FROM mv_ordering_quarantines quarantine
+         JOIN mv_active_generations active
+           ON active.service_id = quarantine.service_id
+          AND active.view_id = quarantine.view_id
+          AND active.generation = quarantine.generation
+        WHERE quarantine.service_id = ? AND quarantine.view_id = ? AND quarantine.status = 'open'
+        LIMIT 1`
+    ).bind(serviceId, viewId).first();
+    if (row === null || row === void 0) return void 0;
+    const classification = asString(row.classification, "ordering_quarantine.classification");
+    if (classification !== "LATE_LOWER_SUID" && classification !== "ORDER_VIOLATION") {
+      throw new MaterializedViewStoreError("initialize", "MV_STORE_OPERATION_FAILED", "Materialized-view ordering quarantine classification was invalid");
+    }
+    const status = asString(row.status, "ordering_quarantine.status");
+    if (status !== "open" && status !== "resolved") {
+      throw new MaterializedViewStoreError("initialize", "MV_STORE_OPERATION_FAILED", "Materialized-view ordering quarantine status was invalid");
+    }
+    return {
+      serviceId: asString(row.service_id, "ordering_quarantine.service_id"),
+      viewId: asString(row.view_id, "ordering_quarantine.view_id"),
+      generation: asInteger(row.generation, "ordering_quarantine.generation"),
+      checkpointSuid: asString(row.checkpoint_suid, "ordering_quarantine.checkpoint_suid"),
+      lateSuid: asString(row.late_suid, "ordering_quarantine.late_suid"),
+      eventId: asString(row.event_id, "ordering_quarantine.event_id"),
+      classification,
+      status,
+      observedAt: asInteger(row.observed_at, "ordering_quarantine.observed_at"),
+      resolvedAt: row.resolved_at === null || row.resolved_at === void 0 ? null : asInteger(row.resolved_at, "ordering_quarantine.resolved_at"),
+      incidentIdentity: row.incident_identity === null || row.incident_identity === void 0 ? null : asString(row.incident_identity, "ordering_quarantine.incident_identity")
+    };
+  }
+  async readActiveGeneration(serviceId, viewId) {
+    this.ready("initialize");
+    return (await this.readActive(serviceId, viewId))?.generation;
+  }
+  /** Persist the detector result before stopping the safe pass. Repeated observations are idempotent. */
+  async recordOrderingQuarantine(input) {
+    this.ready("apply");
+    this.validateGeneration(input.generation, "apply");
+    const incidentIdentity = `${input.classification}|${input.serviceId}|${input.viewId}|${input.checkpointSuid}|${input.lateSuid}|${input.eventId}`;
+    await this.database.prepare(
+      `INSERT INTO mv_ordering_quarantines
+         (service_id, view_id, generation, checkpoint_suid, late_suid, event_id, classification, status, observed_at, resolved_at, incident_identity)
+       VALUES (?, ?, ?, ?, ?, ?, ?, 'open', ?, NULL, ?)
+       ON CONFLICT (service_id, view_id, generation) DO UPDATE SET
+         checkpoint_suid = excluded.checkpoint_suid,
+         late_suid = excluded.late_suid,
+         event_id = excluded.event_id,
+         classification = excluded.classification,
+         status = 'open',
+         observed_at = MIN(mv_ordering_quarantines.observed_at, excluded.observed_at),
+         resolved_at = NULL,
+         incident_identity = excluded.incident_identity`
+    ).bind(
+      input.serviceId,
+      input.viewId,
+      input.generation,
+      input.checkpointSuid,
+      input.lateSuid,
+      input.eventId,
+      input.classification,
+      input.observedAt,
+      incidentIdentity
+    ).run();
+  }
+  /**
+   * Mark a candidate only after the real rebuild path observed the complete
+   * source history. The proof is incident-bound when an ordering quarantine is
+   * open, and an empty row set is valid when the source history itself is
+   * complete (for example, a rebuild whose materializer deletes every row).
+   */
+  async markGenerationRebuilt(input) {
+    this.ready("promote");
+    this.validateGeneration(input.generation, "promote");
+    if (input.rebuildId.length === 0 || !Number.isSafeInteger(input.sourceEventCount) || input.sourceEventCount < 0 || input.sourceEventIds.length !== input.sourceEventCount || input.sourceSuids.length !== input.sourceEventCount || (input.sourceEventCount === 0 ? input.sourceMaxSuid !== "" : input.sourceMaxSuid.length === 0) || input.sourceHistoryDigest.length === 0) {
+      throw new MaterializedViewStoreError("promote", "MV_REBUILD_NOT_VERIFIED", "Rebuild proof does not describe a complete source history");
+    }
+    const quarantine = await this.database.prepare(
+      `SELECT generation, incident_identity, event_id, late_suid
+         FROM mv_ordering_quarantines
+        WHERE service_id = ? AND view_id = ? AND status = 'open'
+        ORDER BY generation DESC LIMIT 1`
+    ).bind(input.serviceId, input.viewId).first();
+    const incidentGeneration = quarantine === null || quarantine === void 0 ? null : asInteger(quarantine.generation, "rebuild.incident_generation");
+    const incidentIdentity = quarantine === null || quarantine === void 0 ? null : typeof quarantine.incident_identity === "string" && quarantine.incident_identity.length > 0 ? quarantine.incident_identity : null;
+    if (quarantine !== null && quarantine !== void 0) {
+      if (incidentIdentity === null) {
+        throw new MaterializedViewStoreError("promote", "MV_REBUILD_NOT_VERIFIED", "Ordering quarantine has no durable incident identity");
+      }
+      const incidentEventId = asString(quarantine.event_id, "rebuild.incident_event_id");
+      const incidentLateSuid = asString(quarantine.late_suid, "rebuild.incident_late_suid");
+      if (!input.sourceEventIds.includes(incidentEventId) || !input.sourceSuids.includes(incidentLateSuid)) {
+        throw new MaterializedViewStoreError("promote", "MV_REBUILD_NOT_VERIFIED", "Rebuild source history does not include the quarantined event");
+      }
+    }
+    const result = await this.database.prepare(
+      `UPDATE mv_instances
+          SET rebuild_verified_at = ?,
+              rebuild_recovery_id = ?,
+              rebuild_incident_identity = ?,
+              rebuild_incident_generation = ?,
+              rebuild_source_event_count = ?,
+              rebuild_source_max_suid = ?,
+              rebuild_source_history_digest = ?
+        WHERE service_id = ? AND view_id = ? AND generation = ?
+          AND status = 'candidate'
+          AND last_suid COLLATE BINARY = ? COLLATE BINARY`
+    ).bind(
+      input.verifiedAt,
+      input.rebuildId,
+      incidentIdentity,
+      incidentGeneration,
+      input.sourceEventCount,
+      input.sourceMaxSuid,
+      input.sourceHistoryDigest,
+      input.serviceId,
+      input.viewId,
+      input.generation,
+      input.sourceMaxSuid
+    ).run();
+    if ((result.meta?.changes ?? 0) !== 1) {
+      throw new MaterializedViewStoreError("promote", "MV_REBUILD_NOT_VERIFIED", "Candidate generation does not match the complete rebuild source history");
+    }
+  }
+  /**
+   * Apply rows/index entries and advance one generation checkpoint atomically.
+   * The guard row intentionally uses a NOT NULL failure to abort a stale CAS.
+   */
+  async applyMutationsAndAdvanceCheckpoint(input) {
+    assertSortableUniqueId(input.lastSuid);
+    if (input.expectedLastSuid !== null) assertSortableUniqueId(input.expectedLastSuid);
+    for (const mutation of [...input.mutations.rowUpserts, ...input.mutations.rowPatches]) {
+      assertSortableUniqueId(mutation.sourceSuid);
+    }
+    this.ready("apply");
+    this.validateGeneration(input.generation, "apply");
+    const operation = operationId2();
+    const statements = [
+      this.database.prepare(
+        `INSERT INTO mv_atomic_guards (operation_id, checkpoint_match)
+         SELECT ?, CASE WHEN EXISTS (
+           SELECT 1 FROM mv_instances
+            WHERE service_id = ? AND view_id = ? AND generation = ?
+              AND ((? IS NULL AND last_suid = '') OR last_suid COLLATE BINARY = ? COLLATE BINARY)
+         ) THEN 1 ELSE NULL END`
+      ).bind(
+        operation,
+        input.serviceId,
+        input.viewId,
+        input.generation,
+        input.expectedLastSuid,
+        input.expectedLastSuid
+      )
+    ];
+    for (const patch of input.mutations.rowPatches) {
+      statements.push(this.database.prepare(
+        `INSERT INTO mv_atomic_guards (operation_id, checkpoint_match)
+         SELECT ?, CASE WHEN EXISTS (
+           SELECT 1 FROM mv_rows
+            WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key COLLATE BINARY = ? COLLATE BINARY
+         ) THEN 1 ELSE 0 END`
+      ).bind(
+        `${operation}:patch:${patch.rowKey}`,
+        input.serviceId,
+        input.viewId,
+        input.generation,
+        patch.rowKey
+      ));
+    }
+    for (const deletion of input.mutations.rowDeletes) {
+      statements.push(this.database.prepare(
+        `DELETE FROM mv_index_entries WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?`
+      ).bind(input.serviceId, input.viewId, input.generation, deletion.rowKey));
+      statements.push(this.database.prepare(
+        `DELETE FROM mv_rows WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?`
+      ).bind(input.serviceId, input.viewId, input.generation, deletion.rowKey));
+    }
+    for (const upsert of input.mutations.rowUpserts) {
+      statements.push(this.database.prepare(
+        `DELETE FROM mv_index_entries WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?`
+      ).bind(input.serviceId, input.viewId, input.generation, upsert.rowKey));
+      statements.push(this.database.prepare(
+        `INSERT INTO mv_rows
+           (service_id, view_id, generation, row_key, value_json, row_version, source_suid)
+         VALUES (?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT (service_id, view_id, generation, row_key) DO UPDATE SET
+           value_json = excluded.value_json,
+           row_version = excluded.row_version,
+           source_suid = excluded.source_suid`
+      ).bind(
+        input.serviceId,
+        input.viewId,
+        input.generation,
+        upsert.rowKey,
+        JSON.stringify(assertJsonValue(upsert.value, "state-persistence")),
+        upsert.rowVersion,
+        upsert.sourceSuid
+      ));
+    }
+    for (const patch of input.mutations.rowPatches) {
+      if (patch.indexEntries.length > 0) {
+        statements.push(this.database.prepare(
+          `DELETE FROM mv_index_entries WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?`
+        ).bind(input.serviceId, input.viewId, input.generation, patch.rowKey));
+      }
+      statements.push(this.database.prepare(
+        `UPDATE mv_rows
+            SET value_json = json_patch(value_json, ?), row_version = ?, source_suid = ?
+          WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key COLLATE BINARY = ? COLLATE BINARY`
+      ).bind(
+        JSON.stringify(assertJsonValue(patch.patch, "state-persistence")),
+        patch.rowVersion,
+        patch.sourceSuid,
+        input.serviceId,
+        input.viewId,
+        input.generation,
+        patch.rowKey
+      ));
+    }
+    for (const deletion of input.mutations.indexDeletes) {
+      const indexPredicate = deletion.indexId === void 0 ? "" : " AND index_id = ?";
+      const values = [input.serviceId, input.viewId, input.generation, deletion.rowKey];
+      if (deletion.indexId !== void 0) values.push(deletion.indexId);
+      statements.push(this.database.prepare(
+        `DELETE FROM mv_index_entries
+          WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?${indexPredicate}`
+      ).bind(...values));
+    }
+    for (const entry of input.mutations.indexEntries) {
+      const typed = entry.valueType === "text" ? [entry.value, null, null] : entry.valueType === "integer" ? [null, entry.value, null] : [null, null, entry.value];
+      statements.push(this.database.prepare(
+        `INSERT INTO mv_index_entries
+           (service_id, view_id, generation, index_id, value_type, text_value, integer_value, real_value, row_key)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT (service_id, view_id, generation, index_id, value_type, text_value, integer_value, real_value, row_key)
+         DO NOTHING`
+      ).bind(
+        input.serviceId,
+        input.viewId,
+        input.generation,
+        entry.indexId,
+        entry.valueType,
+        ...typed,
+        entry.rowKey
+      ));
+    }
+    for (const patch of input.mutations.rowPatches) {
+      for (const entry of patch.indexEntries) {
+        const typed = entry.valueType === "text" ? [entry.value, null, null] : entry.valueType === "integer" ? [null, entry.value, null] : [null, null, entry.value];
+        statements.push(this.database.prepare(
+          `INSERT INTO mv_index_entries
+             (service_id, view_id, generation, index_id, value_type, text_value, integer_value, real_value, row_key)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+           ON CONFLICT (service_id, view_id, generation, index_id, value_type, text_value, integer_value, real_value, row_key)
+           DO NOTHING`
+        ).bind(
+          input.serviceId,
+          input.viewId,
+          input.generation,
+          entry.indexId,
+          entry.valueType,
+          ...typed,
+          entry.rowKey
+        ));
+      }
+    }
+    statements.push(this.database.prepare(
+      `UPDATE mv_instances
+          SET last_suid = ?, definition_version = ?, updated_at = MAX(updated_at, ?),
+              rebuild_verified_at = NULL,
+              rebuild_recovery_id = NULL,
+              rebuild_incident_identity = NULL,
+              rebuild_incident_generation = NULL,
+              rebuild_source_event_count = NULL,
+              rebuild_source_max_suid = NULL,
+              rebuild_source_history_digest = NULL
+        WHERE service_id = ? AND view_id = ? AND generation = ?`
+    ).bind(
+      input.lastSuid,
+      input.definitionVersion,
+      input.updatedAt,
+      input.serviceId,
+      input.viewId,
+      input.generation
+    ));
+    statements.push(this.database.prepare(
+      "DELETE FROM mv_atomic_guards WHERE operation_id = ? OR operation_id LIKE ?"
+    ).bind(operation, `${operation}:%`));
+    try {
+      await this.database.batch(statements);
+    } catch (error) {
+      if (isPatchFailure(error)) throw new MaterializedViewPatchError();
+      if (isCasFailure(error)) throw new MaterializedViewCasError();
+      throw new MaterializedViewStoreError("apply", "MV_STORE_OPERATION_FAILED", `Materialized-view atomic apply failed: ${String(error)}`, { cause: error });
+    }
+    const instance = await this.readInstance(input.serviceId, input.viewId, input.generation);
+    if (instance === void 0) throw new MaterializedViewStoreError("apply", "MV_INSTANCE_MISSING", "Materialized-view instance disappeared after apply");
+    return {
+      instance,
+      rowUpserts: input.mutations.rowUpserts.length,
+      rowDeletes: input.mutations.rowDeletes.length,
+      rowPatches: input.mutations.rowPatches.length,
+      indexEntries: input.mutations.indexEntries.length
+    };
+  }
+  async promoteGeneration(input) {
+    this.ready("promote");
+    this.validateGeneration(input.candidateGeneration, "promote");
+    const operation = operationId2();
+    const statements = [
+      this.database.prepare(
+        `INSERT INTO mv_atomic_guards (operation_id, checkpoint_match)
+         SELECT ?, CASE WHEN EXISTS (
+           SELECT 1 FROM mv_instances candidate
+           WHERE candidate.service_id = ? AND candidate.view_id = ?
+              AND candidate.generation = ? AND candidate.status = 'candidate'
+              AND (
+                NOT EXISTS (
+                   SELECT 1 FROM mv_ordering_quarantines open_quarantine
+                   WHERE open_quarantine.service_id = candidate.service_id
+                     AND open_quarantine.view_id = candidate.view_id
+                     AND open_quarantine.status = 'open'
+                )
+                OR EXISTS (
+                  SELECT 1 FROM mv_ordering_quarantines open_quarantine
+                   WHERE open_quarantine.service_id = candidate.service_id
+                     AND open_quarantine.view_id = candidate.view_id
+                     AND open_quarantine.status = 'open'
+                     AND open_quarantine.incident_identity IS NOT NULL
+                     AND candidate.rebuild_verified_at IS NOT NULL
+                     AND candidate.rebuild_incident_generation = open_quarantine.generation
+                     AND candidate.rebuild_incident_identity = open_quarantine.incident_identity
+                )
+              )
+         ) AND (
+           (? IS NULL AND NOT EXISTS (
+             SELECT 1 FROM mv_active_generations existing
+              WHERE existing.service_id = ? AND existing.view_id = ?
+           ))
+           OR (? IS NOT NULL AND EXISTS (
+             SELECT 1 FROM mv_active_generations pointer
+              WHERE pointer.service_id = ? AND pointer.view_id = ?
+                AND pointer.generation = ?
+           ))
+         ) THEN 1 ELSE NULL END`
+      ).bind(
+        operation,
+        input.serviceId,
+        input.viewId,
+        input.candidateGeneration,
+        input.expectedActiveGeneration,
+        input.serviceId,
+        input.viewId,
+        input.expectedActiveGeneration,
+        input.serviceId,
+        input.viewId,
+        input.expectedActiveGeneration
+      ),
+      this.database.prepare(
+        `UPDATE mv_instances SET status = 'retired', updated_at = ?
+          WHERE service_id = ? AND view_id = ? AND status = 'active'`
+      ).bind(input.updatedAt, input.serviceId, input.viewId),
+      this.database.prepare(
+        `UPDATE mv_instances SET status = 'active', updated_at = ?
+          WHERE service_id = ? AND view_id = ? AND generation = ?`
+      ).bind(input.updatedAt, input.serviceId, input.viewId, input.candidateGeneration),
+      this.database.prepare(
+        `INSERT INTO mv_active_generations (service_id, view_id, generation, updated_at)
+         VALUES (?, ?, ?, ?)
+         ON CONFLICT (service_id, view_id) DO UPDATE SET generation = excluded.generation, updated_at = excluded.updated_at`
+      ).bind(input.serviceId, input.viewId, input.candidateGeneration, input.updatedAt),
+      // A successful rebuild/promotion is the explicit recovery action for an
+      // open ordering quarantine. The active-generation pointer changes in the
+      // same batch, so a safe read never observes a cleared gate on the old
+      // generation with the new generation still unproven.
+      this.database.prepare(
+        `UPDATE mv_ordering_quarantines
+            SET status = 'resolved', resolved_at = ?
+          WHERE service_id = ? AND view_id = ? AND status = 'open' AND generation <> ?
+            AND incident_identity = (
+              SELECT candidate.rebuild_incident_identity
+                FROM mv_instances candidate
+               WHERE candidate.service_id = ? AND candidate.view_id = ?
+                 AND candidate.generation = ? AND candidate.status = 'active'
+            )`
+      ).bind(
+        input.updatedAt,
+        input.serviceId,
+        input.viewId,
+        input.candidateGeneration,
+        input.serviceId,
+        input.viewId,
+        input.candidateGeneration
+      ),
+      this.database.prepare("DELETE FROM mv_atomic_guards WHERE operation_id = ?").bind(operation)
+    ];
+    try {
+      await this.database.batch(statements);
+    } catch (error) {
+      if (isCasFailure(error)) throw new MaterializedViewPromotionCasError();
+      throw new MaterializedViewStoreError("promote", "MV_STORE_OPERATION_FAILED", `Materialized-view promotion failed: ${String(error)}`, { cause: error });
+    }
+    const active = await this.readActive(input.serviceId, input.viewId);
+    if (active === void 0) throw new MaterializedViewStoreError("promote", "MV_INSTANCE_MISSING", "Active generation disappeared after promotion");
+    return active;
+  }
+  /** Short aliases make the port convenient for runtime composition and tests. */
+  apply = this.applyMutationsAndAdvanceCheckpoint.bind(this);
+  promote = this.promoteGeneration.bind(this);
+  rowFrom(row) {
+    let value;
+    try {
+      value = assertJsonValue(JSON.parse(asString(row.value_json, "value_json")), "state-persistence");
+    } catch (error) {
+      throw new MaterializedViewStoreError("initialize", "MV_VALUE_INVALID", `Materialized-view row JSON was invalid: ${String(error)}`, { cause: error });
+    }
+    return {
+      serviceId: asString(row.service_id, "service_id"),
+      viewId: asString(row.view_id, "view_id"),
+      generation: asInteger(row.generation, "generation"),
+      rowKey: asString(row.row_key, "row_key"),
+      value,
+      rowVersion: asInteger(row.row_version, "row_version"),
+      sourceSuid: asString(row.source_suid, "source_suid")
+    };
+  }
+  indexFrom(row) {
+    const type = valueType(row.value_type);
+    return {
+      serviceId: asString(row.service_id, "service_id"),
+      viewId: asString(row.view_id, "view_id"),
+      generation: asInteger(row.generation, "generation"),
+      indexId: asString(row.index_id, "index_id"),
+      valueType: type,
+      value: indexValue(row, type),
+      rowKey: asString(row.row_key, "row_key")
+    };
+  }
+  validateGeneration(generation, operation) {
+    if (!Number.isSafeInteger(generation) || generation < 0) {
+      throw new MaterializedViewStoreError(operation, "MV_GENERATION_INVALID", "Materialized-view generation must be a non-negative integer");
+    }
+  }
+  ready(operation) {
+    if (!this.initialized) throw new MaterializedViewStoreError(operation, "MV_STORE_NOT_INITIALIZED", "D1MaterializedViewStore.initialize() must complete before use");
+  }
+};
+
+// src/d1.ts
+function createD1MaterializedViewStore(database) {
+  return new D1MaterializedViewStore(database);
+}
+
+// src/mv/MaterializedViewCatchUp.ts
+var MAX_CAS_RETRIES = 8;
+var MaterializedViewCatchUpRuntime = class {
+  constructor(source, materializedViews) {
+    this.source = source;
+    this.materializedViews = materializedViews;
+  }
+  source;
+  materializedViews;
+  async build(serviceId, materializer, nowMs, hooks = {}, options = {}) {
+    const existing = await this.materializedViews.readActive(serviceId, materializer.id);
+    if (existing !== void 0) {
+      throw new MaterializedViewStoreError("create-active", "MV_INSTANCE_EXISTS", "Active materialized view already exists");
+    }
+    await this.materializedViews.createActive({
+      serviceId,
+      viewId: materializer.id,
+      generation: 0,
+      definitionVersion: materializer.version,
+      updatedAt: nowMs
+    });
+    return this.follow(serviceId, materializer, nowMs, hooks, options);
+  }
+  async follow(serviceId, materializer, nowMs, hooks = {}, options = {}) {
+    const active = await this.materializedViews.readActive(serviceId, materializer.id);
+    if (active === void 0) {
+      throw new MaterializedViewStoreError("apply", "MV_INSTANCE_MISSING", "Materialized-view must be built before follow");
+    }
+    return this.followGeneration(serviceId, materializer, active.generation, nowMs, "apply", hooks, options);
+  }
+  async rebuild(serviceId, materializer, nowMs, rebuildId, hooks = {}, options = {}) {
+    const effectiveRebuildId = rebuildId ?? `g69-rebuild-${crypto.randomUUID()}`;
+    const sourceBefore = await this.source.readAllEvents(serviceId, "");
+    const sourceBeforeProof = await sourceHistoryProof(sourceBefore);
+    const candidate = await this.materializedViews.beginRebuild({
+      serviceId,
+      viewId: materializer.id,
+      definitionVersion: materializer.version,
+      updatedAt: nowMs
+    });
+    const result = await this.followGeneration(serviceId, materializer, candidate.generation, nowMs, "apply", hooks, options);
+    const sourceAfter = await this.source.readAllEvents(serviceId, "");
+    const sourceAfterProof = await sourceHistoryProof(sourceAfter);
+    if (result.stopReason === null && !result.indeterminate && result.advancedSourceEvents === sourceBefore.length && sourceBeforeProof.digest === sourceAfterProof.digest) {
+      await this.materializedViews.markGenerationRebuilt({
+        serviceId,
+        viewId: materializer.id,
+        generation: candidate.generation,
+        verifiedAt: nowMs,
+        rebuildId: effectiveRebuildId,
+        sourceEventCount: sourceBeforeProof.eventIds.length,
+        sourceEventIds: sourceBeforeProof.eventIds,
+        sourceSuids: sourceBeforeProof.suids,
+        sourceMaxSuid: sourceBeforeProof.maxSuid,
+        sourceHistoryDigest: sourceBeforeProof.digest
+      });
+    }
+    return { ...result, candidateGeneration: candidate.generation, rebuildId: effectiveRebuildId };
+  }
+  async promote(serviceId, materializer, candidateGeneration, nowMs) {
+    const active = await this.materializedViews.readActive(serviceId, materializer.id);
+    return this.materializedViews.promoteGeneration({
+      serviceId,
+      viewId: materializer.id,
+      candidateGeneration,
+      expectedActiveGeneration: active?.generation ?? null,
+      updatedAt: nowMs
+    });
+  }
+  async read(serviceId, materializer) {
+    const instance = await this.materializedViews.readActive(serviceId, materializer.id);
+    if (instance === void 0) return void 0;
+    return { instance, rows: await this.materializedViews.readRows(serviceId, materializer.id, instance.generation) };
+  }
+  async followGeneration(serviceId, materializer, generation, nowMs, _operation, hooks, options) {
+    for (let attempt = 0; attempt < MAX_CAS_RETRIES; attempt += 1) {
+      const instance = await this.materializedViews.readInstance(serviceId, materializer.id, generation);
+      if (instance === void 0) {
+        throw new MaterializedViewStoreError("apply", "MV_INSTANCE_MISSING", "Materialized-view generation is missing");
+      }
+      const sourceForHead = await this.source.readAllEvents(serviceId, "");
+      for (const event of sourceForHead) assertSortableUniqueId(event.suid);
+      const storeMaxSuid = sourceForHead.reduce(
+        (maximum, event) => compareSuid3(maximum, event.suid) >= 0 ? maximum : event.suid,
+        ""
+      );
+      if (instance.lastSuid.length > 0 && compareSuid3(storeMaxSuid, instance.lastSuid) < 0) {
+        await this.materializedViews.recordCheckpointAhead({
+          serviceId,
+          viewId: materializer.id,
+          generation,
+          checkpointSuid: instance.lastSuid,
+          storeMaxSuid,
+          observedAt: nowMs
+        });
+        throw new MaterializedViewStoreError(
+          "apply",
+          "MV_STORE_OPERATION_FAILED",
+          "CHECKPOINT_AHEAD: materialized-view checkpoint is ahead of the source store; rebuild and promote a generation"
+        );
+      }
+      const dynamicLagBoundMs = await this.source.currentLagBound(serviceId, nowMs);
+      const windowMs = safeWindowMs(dynamicLagBoundMs);
+      if (safeWindowCeilingExceeded(dynamicLagBoundMs)) {
+        return {
+          instance,
+          dynamicLagBoundMs,
+          safeWindowMs: windowMs,
+          advancedSourceEvents: 0,
+          appliedEvents: 0,
+          lateLowerQueryDurationMs: 0,
+          indeterminate: true,
+          deferredEventSuid: null,
+          deferredEventLastArrivedAt: null,
+          deferredDeadlineAt: null,
+          stopReason: "safe_window_ceiling"
+        };
+      }
+      const sourceEvents = await this.source.readAllEvents(serviceId, instance.lastSuid);
+      await this.assertSourceBatchOrder(
+        serviceId,
+        materializer.id,
+        generation,
+        instance.lastSuid,
+        sourceEvents
+      );
+      let lateLowerQueryDurationMs = 0;
+      if (options.runOrderingDetector === true) {
+        lateLowerQueryDurationMs = await this.detectLateLowerSuid(
+          serviceId,
+          materializer.id,
+          generation,
+          instance.lastSuid,
+          instance.updatedAt
+        );
+      }
+      let current = instance;
+      let advancedSourceEvents = 0;
+      let appliedEvents = 0;
+      let conflicted = false;
+      for (const event of sourceEvents) {
+        if (options.maximumSuid === null || options.maximumSuid !== void 0 && compareSuid3(event.suid, options.maximumSuid) > 0) {
+          return {
+            instance: current,
+            dynamicLagBoundMs,
+            safeWindowMs: windowMs,
+            advancedSourceEvents,
+            appliedEvents,
+            lateLowerQueryDurationMs,
+            indeterminate: false,
+            deferredEventSuid: event.suid,
+            deferredEventLastArrivedAt: event.lastArrivedAt,
+            deferredDeadlineAt: null,
+            stopReason: "frontier_fence"
+          };
+        }
+        if (event.lastArrivedAt > nowMs - windowMs) {
+          return {
+            instance: current,
+            dynamicLagBoundMs,
+            safeWindowMs: windowMs,
+            advancedSourceEvents,
+            appliedEvents,
+            lateLowerQueryDurationMs,
+            indeterminate: false,
+            deferredEventSuid: event.suid,
+            deferredEventLastArrivedAt: event.lastArrivedAt,
+            deferredDeadlineAt: event.lastArrivedAt + windowMs,
+            stopReason: "safe_window_fence"
+          };
+        }
+        await hooks.beforeApply?.(event);
+        const mutations = materializer.plan(event);
+        let result;
+        try {
+          result = await this.materializedViews.applyMutationsAndAdvanceCheckpoint({
+            serviceId,
+            viewId: materializer.id,
+            generation,
+            // The durable schema represents an unadvanced checkpoint as an
+            // empty string, while the atomic apply port reserves `null` for
+            // that state so all non-null ingress values are full G32 SUIDs.
+            expectedLastSuid: current.lastSuid.length === 0 ? null : current.lastSuid,
+            lastSuid: event.suid,
+            definitionVersion: materializer.version,
+            updatedAt: nowMs,
+            mutations
+          });
+        } catch (error) {
+          if (error instanceof MaterializedViewCasError) {
+            conflicted = true;
+            break;
+          }
+          throw error;
+        }
+        current = result.instance;
+        advancedSourceEvents += 1;
+        appliedEvents += 1;
+        const unsafe = this.materializedViews.unsafeWindow();
+        if (await unsafe.hasTargetReceipt(serviceId, materializer.id, event.eventId, event.suid)) {
+          await unsafe.observeSafeReceipt(serviceId, materializer.id, generation, event.eventId, event.suid);
+        }
+        await hooks.afterApply?.(event, result);
+      }
+      if (!conflicted) {
+        await this.materializedViews.collectUnsafeGarbage(
+          serviceId,
+          materializer.id,
+          generation,
+          materializer.version,
+          current.lastSuid
+        );
+        return {
+          instance: current,
+          dynamicLagBoundMs,
+          safeWindowMs: windowMs,
+          advancedSourceEvents,
+          appliedEvents,
+          lateLowerQueryDurationMs,
+          indeterminate: false,
+          deferredEventSuid: null,
+          deferredEventLastArrivedAt: null,
+          deferredDeadlineAt: null,
+          stopReason: null
+        };
+      }
+    }
+    throw new MaterializedViewStoreError("apply", "MV_CAS_MISMATCH", "Materialized-view catch-up did not converge after concurrent updates");
+  }
+  async detectLateLowerSuid(serviceId, viewId, generation, priorSuid, checkpointUpdatedAt) {
+    let lateLowerQueryDurationMs = 0;
+    if (priorSuid.length > 0) {
+      const detectorStartedAt = Date.now();
+      const evidence = this.source.findLateLowerSuidEvidence === void 0 ? void 0 : await this.source.findLateLowerSuidEvidence(serviceId, priorSuid, checkpointUpdatedAt, generation);
+      const lateLower = evidence === void 0 ? await this.source.findLateLowerSuid?.(serviceId, priorSuid, checkpointUpdatedAt) : evidence.kind === "late-lower-suid" ? evidence.event : void 0;
+      lateLowerQueryDurationMs = evidence?.durationMs ?? Math.max(0, Date.now() - detectorStartedAt);
+      if (evidence?.kind === "unknown") {
+        const incident = {
+          serviceId,
+          identityKey: `ORDERING_DETECTOR_UNKNOWN|${serviceId}|${viewId}|${generation}|${priorSuid}|${checkpointUpdatedAt}`,
+          classification: "ORDERING_DETECTOR_UNKNOWN",
+          suid: priorSuid,
+          observedAt: checkpointUpdatedAt
+        };
+        await this.source.appendDeliveryIncident(incident);
+        console.error("SDT-G69_ORDERING_DETECTOR_UNKNOWN", JSON.stringify({
+          ...incident,
+          reason: evidence.reason ?? "unknown"
+        }));
+      }
+      if (lateLower !== void 0) {
+        const incident = {
+          serviceId,
+          identityKey: `LATE_LOWER_SUID|${serviceId}|${viewId}|${priorSuid}|${lateLower.suid}|${lateLower.eventId}`,
+          classification: "ORDER_VIOLATION",
+          suid: lateLower.suid,
+          eventId: lateLower.eventId,
+          incomingEventId: lateLower.eventId,
+          observedAt: lateLower.lastArrivedAt
+        };
+        await this.source.appendDeliveryIncident(incident);
+        await this.materializedViews.recordOrderingQuarantine({
+          serviceId,
+          viewId,
+          generation,
+          checkpointSuid: priorSuid,
+          lateSuid: lateLower.suid,
+          eventId: lateLower.eventId,
+          classification: "LATE_LOWER_SUID",
+          observedAt: lateLower.lastArrivedAt
+        });
+        console.error("SDT-G69_ORDERING_QUARANTINE", JSON.stringify({
+          serviceId,
+          viewId,
+          generation,
+          checkpointSuid: priorSuid,
+          lateSuid: lateLower.suid,
+          eventId: lateLower.eventId,
+          classification: "LATE_LOWER_SUID"
+        }));
+        throw new MaterializedViewStoreError(
+          "apply",
+          "MV_ORDERING_QUARANTINED",
+          "Materialized-view safe lane is quarantined for an ordering violation; rebuild and promote a generation"
+        );
+      }
+    }
+    return lateLowerQueryDurationMs;
+  }
+  async assertSourceBatchOrder(serviceId, viewId, generation, priorSuid, events) {
+    let previous = priorSuid;
+    for (const event of events) {
+      if (compareSuid3(previous, event.suid) >= 0) {
+        const incident = {
+          serviceId,
+          identityKey: `ORDER_VIOLATION|${serviceId}|${viewId}|${previous}|${event.suid}|${event.eventId}`,
+          classification: "ORDER_VIOLATION",
+          suid: event.suid,
+          eventId: event.eventId,
+          incomingEventId: event.eventId,
+          observedAt: event.lastArrivedAt
+        };
+        await this.source.appendDeliveryIncident(incident);
+        await this.materializedViews.recordOrderingQuarantine({
+          serviceId,
+          viewId,
+          generation,
+          checkpointSuid: previous,
+          lateSuid: event.suid,
+          eventId: event.eventId,
+          classification: "ORDER_VIOLATION",
+          observedAt: event.lastArrivedAt
+        });
+        console.error("SDT-G69_ORDERING_QUARANTINE", JSON.stringify({
+          serviceId,
+          viewId,
+          generation,
+          checkpointSuid: previous,
+          lateSuid: event.suid,
+          eventId: event.eventId,
+          classification: "ORDER_VIOLATION"
+        }));
+        throw new MaterializedViewStoreError(
+          "apply",
+          "MV_ORDERING_QUARANTINED",
+          "Materialized-view safe lane is quarantined for an ordering violation; rebuild and promote a generation"
+        );
+      }
+      previous = event.suid;
+    }
+  }
+};
+async function sourceHistoryProof(events) {
+  const eventIds = events.map((event) => event.eventId);
+  const suids = events.map((event) => event.suid);
+  const maxSuid = events.reduce(
+    (maximum, event) => maximum === "" || compareSuid3(event.suid, maximum) > 0 ? event.suid : maximum,
+    ""
+  );
+  const canonical = events.map((event) => `${event.eventId}\0${event.suid}`).join("\n");
+  const digestBytes = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonical));
+  const digest = [...new Uint8Array(digestBytes)].map((value) => value.toString(16).padStart(2, "0")).join("");
+  return { eventIds, suids, maxSuid, digest };
+}
+function compareSuid3(left, right) {
+  const leftBytes = new TextEncoder().encode(left);
+  const rightBytes = new TextEncoder().encode(right);
+  const shared = Math.min(leftBytes.length, rightBytes.length);
+  for (let index = 0; index < shared; index += 1) {
+    const difference = leftBytes[index] - rightBytes[index];
+    if (difference !== 0) return difference;
+  }
+  return leftBytes.length - rightBytes.length;
+}
+export {
+  D1MaterializedViewStore,
+  MaterializedViewCasError,
+  MaterializedViewCatchUpRuntime,
+  MaterializedViewPatchError,
+  MaterializedViewPromotionCasError,
+  MaterializedViewStoreError,
+  UnsafeWindowMaterializedViewError,
+  UnsafeWindowMaterializedViewStore,
+  createD1MaterializedViewStore
+};