@sekiban/dcb-runtime 0.2.0

package/dist/d1.js

@@ -0,0 +1,3418 @@
+// src/allocator/SortableUniqueId.ts
+var SORTABLE_UNIQUE_ID_TICKS_DIGITS = 19;
+var SORTABLE_UNIQUE_ID_RANDOM_DIGITS = 11;
+var SORTABLE_UNIQUE_ID_DIGITS = SORTABLE_UNIQUE_ID_TICKS_DIGITS + SORTABLE_UNIQUE_ID_RANDOM_DIGITS;
+var DOTNET_UNIX_EPOCH_TICKS = 621355968000000000n;
+var DOTNET_MAX_TICKS = 3155378975999999999n;
+var DOTNET_TICKS_PER_MILLISECOND = 10000n;
+var SORTABLE_UNIQUE_ID_RANDOM_LIMIT = 10n ** BigInt(SORTABLE_UNIQUE_ID_RANDOM_DIGITS);
+var MAX_UNIX_MILLISECONDS = (DOTNET_MAX_TICKS - DOTNET_UNIX_EPOCH_TICKS) / DOTNET_TICKS_PER_MILLISECOND;
+var SortableUniqueIdError = class extends Error {
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+    this.name = "SortableUniqueIdError";
+  }
+  code;
+};
+var LEGACY_PREFIXED_SUID = /^suid-[0-9]+$/;
+var LEGACY_DECISION_OBSERVER = /* @__PURE__ */ Symbol.for("@sekiban/dcb-runtime/legacy-sortable-unique-id-observer");
+function legacyDecisionObserver() {
+  return globalThis[LEGACY_DECISION_OBSERVER];
+}
+function assertDotNetTicks(ticks) {
+  if (ticks < 0n || ticks > DOTNET_MAX_TICKS) {
+    throw new SortableUniqueIdError("SUID_TICKS_INVALID", "SortableUniqueId ticks are outside the .NET DateTime range");
+  }
+  return ticks;
+}
+function assertSortableUniqueId(value) {
+  if (typeof value === "string" && LEGACY_PREFIXED_SUID.test(value)) {
+    legacyDecisionObserver()?.(value);
+    throw new SortableUniqueIdError(
+      "SUID_LEGACY_FORMAT_RETIRED",
+      "Legacy prefixed SortableUniqueId is retired; G32 requires exactly 30 ASCII decimal digits"
+    );
+  }
+  if (typeof value !== "string" || !new RegExp(`^[0-9]{${SORTABLE_UNIQUE_ID_DIGITS}}$`).test(value)) {
+    throw new SortableUniqueIdError("SUID_INVALID", "SortableUniqueId must be exactly 30 ASCII decimal digits");
+  }
+  const ticksText = value.slice(0, SORTABLE_UNIQUE_ID_TICKS_DIGITS);
+  const randomText = value.slice(SORTABLE_UNIQUE_ID_TICKS_DIGITS);
+  const ticks = assertDotNetTicks(BigInt(ticksText));
+  const random = BigInt(randomText);
+  if (random < 0n || random >= SORTABLE_UNIQUE_ID_RANDOM_LIMIT) {
+    throw new SortableUniqueIdError("SUID_RANDOM_INVALID", "SortableUniqueId random suffix is outside its 11-digit range");
+  }
+  return Object.freeze({ value, ticks, random });
+}
+
+// src/safeWindow.ts
+var PUBLISHED_SAFE_WINDOW_MS = 2e4;
+var MAX_PUBLISHED_SAFE_WINDOW_MS = 12e4;
+function decayedLagEstimateMs(estimateMs, observedAtMs, nowMs) {
+  const elapsed = Math.max(0, nowMs - observedAtMs);
+  return Math.max(0, estimateMs - elapsed);
+}
+function safeWindowMs(dynamicLagBoundMs) {
+  return Math.min(MAX_PUBLISHED_SAFE_WINDOW_MS, Math.max(PUBLISHED_SAFE_WINDOW_MS, dynamicLagBoundMs));
+}
+function safeWindowCeilingExceeded(dynamicLagBoundMs) {
+  return dynamicLagBoundMs > MAX_PUBLISHED_SAFE_WINDOW_MS;
+}
+
+// src/diagnostics/G69AdmissionAttempt.ts
+async function appendG69AdmissionAttempt(database, receipt) {
+  const insert = database.prepare(
+    `INSERT INTO serialized_dcb_g69_admission_attempts
+       (service_id, event_id, suid, partition_tag, delivery_source,
+        queue_message_id, attempt_id, allocator_lineage_id, obligation_sequence,
+        enqueued_at, observed_at, arrived_at,
+        first_arrived_at_before, last_arrived_at_before,
+        first_arrived_at_after, last_arrived_at_after,
+        before_observed_at, after_observed_at, observation_consistency,
+        mutation_evidence, diagnostic_duration_ms, receipt_status, retry_reason, clock_origin)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+  ).bind(
+    receipt.serviceId,
+    receipt.eventId,
+    receipt.suid,
+    receipt.tag,
+    receipt.deliverySource,
+    receipt.queueMessageId,
+    receipt.attemptId,
+    receipt.allocatorLineageId,
+    receipt.obligationSequence,
+    receipt.enqueuedAt,
+    receipt.observedAt,
+    receipt.arrivedAt,
+    receipt.firstArrivedAtBefore,
+    receipt.lastArrivedAtBefore,
+    receipt.firstArrivedAtAfter,
+    receipt.lastArrivedAtAfter,
+    receipt.beforeObservedAt,
+    receipt.afterObservedAt,
+    receipt.observationConsistency,
+    receipt.mutationEvidence,
+    receipt.diagnosticDurationMs,
+    receipt.status,
+    receipt.retryReason,
+    "Date.now epoch ms"
+  );
+  const trim = database.prepare(
+    `DELETE FROM serialized_dcb_g69_admission_attempts
+      WHERE service_id = ?
+        AND sequence NOT IN (
+          SELECT sequence FROM serialized_dcb_g69_admission_attempts
+           WHERE service_id = ? ORDER BY sequence DESC LIMIT 512
+        )`
+  ).bind(receipt.serviceId, receipt.serviceId);
+  await database.batch([insert, trim]);
+}
+
+// ../dcb-core/dist/index.js
+var JsonValidationError = class extends Error {
+  code = "invalid_json_value";
+  boundary;
+  path;
+  constructor(message, boundary = "value", path = "$", options) {
+    super(message, options);
+    this.name = "JsonValidationError";
+    this.boundary = boundary;
+    this.path = path;
+  }
+};
+var isPlainRecord = (value) => {
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+};
+function assertJsonValue(value, boundary = "value") {
+  const active = /* @__PURE__ */ new WeakSet();
+  const visit = (candidate, path) => {
+    if (candidate === null || typeof candidate === "string" || typeof candidate === "boolean") {
+      return candidate;
+    }
+    if (typeof candidate === "number") {
+      if (Number.isFinite(candidate)) return candidate;
+      throw new JsonValidationError("JSON numbers must be finite", boundary, path);
+    }
+    if (typeof candidate !== "object") {
+      throw new JsonValidationError(`Value at ${path} is not JSON serializable`, boundary, path);
+    }
+    if (active.has(candidate)) {
+      throw new JsonValidationError(`Cyclic JSON value at ${path}`, boundary, path);
+    }
+    active.add(candidate);
+    try {
+      if (Array.isArray(candidate)) {
+        return candidate.map((item, index) => visit(item, `${path}[${index}]`));
+      }
+      if (!isPlainRecord(candidate)) {
+        throw new JsonValidationError(`Value at ${path} must be a plain JSON object`, boundary, path);
+      }
+      const result = {};
+      for (const [key, item] of Object.entries(candidate)) {
+        result[key] = visit(item, `${path}.${key}`);
+      }
+      return result;
+    } finally {
+      active.delete(candidate);
+    }
+  };
+  return visit(value, "$");
+}
+var DcbDefinitionError = class extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = "DcbDefinitionError";
+    this.code = code;
+  }
+};
+var CanonicalEventIdentityError = class extends DcbDefinitionError {
+  code = "CANONICAL_EVENT_IDENTITY_INVALID";
+  constructor(message) {
+    super("CANONICAL_EVENT_IDENTITY_INVALID", message);
+    this.name = "CanonicalEventIdentityError";
+  }
+};
+function canonicalEventKey(eventPayloadName) {
+  if (typeof eventPayloadName !== "string" || eventPayloadName.length === 0 || eventPayloadName.includes(":")) {
+    throw new CanonicalEventIdentityError("Event payload names must be non-empty and must not contain ':'");
+  }
+  return eventPayloadName;
+}
+function parseCanonicalEventKey(key) {
+  const canonical2 = canonicalEventKey(key);
+  if (canonical2 !== key) {
+    throw new CanonicalEventIdentityError("Event identity key is not canonical");
+  }
+  return Object.freeze({ eventPayloadName: key, key });
+}
+
+// src/eventIdentity.ts
+var DeliveryIdentityError = class extends Error {
+  code = "DELIVERY_IDENTITY_INVALID";
+  retryable = false;
+  constructor(message) {
+    super(message);
+    this.name = "DeliveryIdentityError";
+  }
+};
+var MissingCanonicalEventIdentityError = class extends DeliveryIdentityError {
+  code = "MISSING_CANONICAL_EVENT_IDENTITY";
+  constructor(source) {
+    super(`G32 ${source} delivery is missing canonical event identity`);
+    this.name = "MissingCanonicalEventIdentityError";
+  }
+};
+function provenanceFrom(value) {
+  if (value === void 0) return void 0;
+  if (value === "g32") return value;
+  throw new DeliveryIdentityError("Unknown event identity provenance");
+}
+function resolveDeliveryIdentity(message, source) {
+  const provenance = provenanceFrom(message.provenance);
+  if (message.eventType === void 0) {
+    throw new MissingCanonicalEventIdentityError(source);
+  }
+  const identity = parseCanonicalEventKey(message.eventType);
+  if (provenance !== "g32") {
+    throw new DeliveryIdentityError("G32 delivery provenance is required");
+  }
+  return {
+    ...identity,
+    provenance: "g32",
+    legacy: false
+  };
+}
+
+// src/eventRecord.ts
+var SERIALIZED_COMMIT_CORRELATION_ID = "SerializedCommit";
+var SERIALIZED_SEKIBAN_EXECUTOR = "SerializedSekibanExecutor";
+var CANONICAL_UTC_TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{1,7}Z$/;
+function serializedEventMetadata(eventId) {
+  return Object.freeze({
+    causationId: eventId,
+    correlationId: SERIALIZED_COMMIT_CORRELATION_ID,
+    executedUser: SERIALIZED_SEKIBAN_EXECUTOR
+  });
+}
+function isRfc4122Uuid(value) {
+  return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+}
+function isUuidV7(value) {
+  return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(value);
+}
+
+// src/store/types.ts
+var CanonicalEventIdentityConflictError = class extends Error {
+  constructor(provider, eventId, message) {
+    super(message ?? `${provider} EventId ${eventId} conflicts with its canonical event identity`);
+    this.provider = provider;
+    this.eventId = eventId;
+    this.name = "CanonicalEventIdentityConflictError";
+  }
+  provider;
+  eventId;
+  code = "CANONICAL_EVENT_IDENTITY_CONFLICT";
+};
+
+// src/store/D1EventStore.ts
+var D1IdentityConflictError = class extends CanonicalEventIdentityConflictError {
+  beforeMutation;
+  constructor(message, beforeMutation = false) {
+    super("d1", "", message);
+    this.name = "D1IdentityConflictError";
+    this.beforeMutation = beforeMutation;
+  }
+};
+function asString(value, name) {
+  if (typeof value !== "string") throw new Error(`D1 ${name} was not a string`);
+  return value;
+}
+function nullableString(value, name) {
+  return value === null ? null : asString(value, name);
+}
+function asNumber(value, name) {
+  const number = typeof value === "number" ? value : Number(value);
+  if (!Number.isSafeInteger(number)) throw new Error(`D1 ${name} was not a safe integer`);
+  return number;
+}
+function errorText(error) {
+  return (error instanceof Error ? error.message : String(error)).slice(0, 256);
+}
+function sortedUnique(values) {
+  return [...new Set(values)].sort((left, right) => binaryCompare(left, right));
+}
+function equalStrings(left, right) {
+  return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function assertCompletenessEnvelope(message) {
+  const facts = message.completeness;
+  const declared = sortedUnique(message.eventTags);
+  if (!equalStrings(declared, sortedUnique(facts.declaredTagSet))) {
+    throw new D1IdentityConflictError(`EventId ${message.eventId} declared tag set differs from its source obligation`);
+  }
+  if (facts.localCommittedMembership.length !== 1) {
+    throw new D1IdentityConflictError(`EventId ${message.eventId} source obligation has no exact local membership`);
+  }
+  const membership = facts.localCommittedMembership[0];
+  if (membership.serviceId !== message.serviceId || membership.eventId !== message.eventId || membership.tag !== message.tag) {
+    throw new D1IdentityConflictError(`EventId ${message.eventId} source obligation membership differs from its delivery envelope`);
+  }
+}
+function binaryCompare(left, right) {
+  const leftBytes = new TextEncoder().encode(left);
+  const rightBytes = new TextEncoder().encode(right);
+  const shared = Math.min(leftBytes.length, rightBytes.length);
+  for (let index = 0; index < shared; index += 1) {
+    const difference = leftBytes[index] - rightBytes[index];
+    if (difference !== 0) return difference;
+  }
+  return leftBytes.length - rightBytes.length;
+}
+function asStringArray(value, name) {
+  const decoded = typeof value === "string" ? JSON.parse(value) : value;
+  if (!Array.isArray(decoded) || !decoded.every((entry) => typeof entry === "string")) {
+    throw new Error(`D1 ${name} was not a string array`);
+  }
+  return [...decoded];
+}
+function eventFrom(row, arrivals) {
+  const serviceId = asString(row.service_id, "service_id");
+  const eventId = asString(row.event_id, "event_id");
+  const tags = asStringArray(row.event_tags, "event_tags");
+  return {
+    serviceId,
+    id: eventId,
+    eventId,
+    sortableUniqueId: asString(row.suid, "suid"),
+    suid: asString(row.suid, "suid"),
+    payload: asString(row.payload, "payload"),
+    tags,
+    eventTags: tags,
+    eventType: asString(row.event_type, "event_type"),
+    timestamp: asString(row.timestamp, "timestamp"),
+    causationId: nullableString(row.causation_id, "causation_id"),
+    correlationId: nullableString(row.correlation_id, "correlation_id"),
+    executedUser: nullableString(row.executed_user, "executed_user"),
+    provenance: "g32",
+    ...typeof row.event_digest === "string" && row.event_digest.length > 0 ? { eventDigest: row.event_digest } : {},
+    firstArrivedAt: asNumber(row.first_arrived_at, "first_arrived_at"),
+    lastArrivedAt: asNumber(row.last_arrived_at, "last_arrived_at"),
+    maxDeliveryLagMs: asNumber(row.max_delivery_lag_ms, "max_delivery_lag_ms"),
+    arrivals: arrivals.map((arrival) => ({
+      serviceId: asString(arrival.service_id, "arrival.service_id"),
+      eventId: asString(arrival.event_id, "arrival.event_id"),
+      tag: asString(arrival.tag, "arrival.tag"),
+      enqueuedAt: asNumber(arrival.enqueued_at, "arrival.enqueued_at"),
+      arrivedAt: asNumber(arrival.arrived_at, "arrival.arrived_at"),
+      lagMs: asNumber(arrival.lag_ms, "arrival.lag_ms")
+    }))
+  };
+}
+function pendingFrom(row) {
+  return {
+    serviceId: asString(row.service_id, "service_id"),
+    eventId: asString(row.event_id, "event_id"),
+    attemptId: asString(row.attempt_id, "attempt_id"),
+    suid: asString(row.suid, "suid"),
+    expectedPaths: asStringArray(row.expected_paths, "expected_paths"),
+    observedPaths: asStringArray(row.observed_paths, "observed_paths"),
+    firstObservedAt: asNumber(row.first_observed_at, "first_observed_at"),
+    lagBoundMs: asNumber(row.lag_bound_ms, "lag_bound_ms")
+  };
+}
+function findingFrom(row) {
+  const classification = asString(row.classification, "classification");
+  if (classification !== "MISSING_STABLE" && classification !== "EXCLUDED_AUDITED" && classification !== "RESOLVED_LATE") {
+    throw new Error("D1 finding classification was invalid");
+  }
+  return {
+    serviceId: asString(row.service_id, "service_id"),
+    eventId: asString(row.event_id, "event_id"),
+    path: asString(row.path, "path"),
+    classification,
+    firstObservedAt: asNumber(row.first_observed_at, "first_observed_at"),
+    lagBoundMs: asNumber(row.lag_bound_ms, "lag_bound_ms"),
+    observedAt: asNumber(row.observed_at, "observed_at")
+  };
+}
+function incidentClassification(value) {
+  const classification = asString(value, "classification");
+  if (classification !== "SUID_COLLISION" && classification !== "ORDER_VIOLATION" && classification !== "LINEAGE_MISMATCH" && classification !== "ORDERING_DETECTOR_UNKNOWN") {
+    throw new Error("D1 delivery incident classification was invalid");
+  }
+  return classification;
+}
+function optionalString(value, name) {
+  if (value === null || value === void 0) return void 0;
+  return asString(value, name);
+}
+function incidentFrom(row) {
+  return {
+    serviceId: asString(row.service_id, "service_id"),
+    identityKey: asString(row.identity_key, "identity_key"),
+    classification: incidentClassification(row.classification),
+    suid: optionalString(row.suid, "suid"),
+    existingEventId: optionalString(row.existing_event_id, "existing_event_id"),
+    incomingEventId: optionalString(row.incoming_event_id, "incoming_event_id"),
+    eventId: optionalString(row.event_id, "event_id"),
+    boundLineageId: optionalString(row.bound_lineage_id, "bound_lineage_id"),
+    incomingLineageId: optionalString(row.incoming_lineage_id, "incoming_lineage_id"),
+    observedAt: asNumber(row.observed_at, "observed_at")
+  };
+}
+function checkpointFrom(row) {
+  return {
+    serviceId: asString(row.service_id, "service_id"),
+    projectionId: asString(row.projection_id, "projection_id"),
+    lastSuid: asString(row.last_suid, "last_suid"),
+    stateJson: asString(row.state_json, "state_json"),
+    version: asNumber(row.version, "version"),
+    updatedAt: asNumber(row.updated_at, "updated_at")
+  };
+}
+function collisionIdentity(serviceId, suid, existingEventId, incomingEventId) {
+  const [first, second] = [existingEventId, incomingEventId].sort(binaryCompare);
+  return `SUID_COLLISION|${serviceId}|${suid}|${first}|${second}`;
+}
+function lineageIdentity(serviceId, boundLineageId, incomingLineageId) {
+  return `LINEAGE_MISMATCH|${serviceId}|${boundLineageId}|${incomingLineageId}`;
+}
+function jsonArray(values) {
+  return JSON.stringify(sortedUnique(values));
+}
+function metadataForDelivery(message, deliverySource) {
+  const serialized = serializedEventMetadata(message.eventId);
+  if (deliverySource !== "import") {
+    if (message.causationId !== serialized.causationId || message.correlationId !== serialized.correlationId || message.executedUser !== serialized.executedUser) {
+      throw new D1IdentityConflictError(`EventId ${message.eventId} metadata must use the serialized C# constants`);
+    }
+    return serialized;
+  }
+  const values = [message.causationId, message.correlationId, message.executedUser];
+  if (!values.every((value) => value === null || typeof value === "string")) {
+    throw new D1IdentityConflictError(`EventId ${message.eventId} import metadata must be string or null`);
+  }
+  const allNull = values.every((value) => value === null);
+  const allSerialized = message.causationId === serialized.causationId && message.correlationId === serialized.correlationId && message.executedUser === serialized.executedUser;
+  if (!allNull && !allSerialized) {
+    throw new D1IdentityConflictError(`EventId ${message.eventId} import metadata must be all null or serialized constants`);
+  }
+  return {
+    causationId: message.causationId,
+    correlationId: message.correlationId,
+    executedUser: message.executedUser
+  };
+}
+var D1EventStore = class {
+  constructor(database, options = {}) {
+    this.database = database;
+    this.options = options;
+  }
+  database;
+  options;
+  initialized = false;
+  async initialize() {
+    if (this.initialized) return;
+    await this.database.prepare("SELECT 1 AS migration_binding").all();
+    this.initialized = true;
+  }
+  async recordDelivery(message, arrivedAt, deliverySource = "queue", attemptContext) {
+    this.ready();
+    const mutationAttemptId = `admission-${crypto.randomUUID()}`;
+    let result;
+    let failure;
+    try {
+      result = await this.recordDeliveryCore(message, arrivedAt, deliverySource, mutationAttemptId);
+    } catch (error) {
+      failure = { error };
+    }
+    const retryReason = failure === void 0 ? null : errorText(failure.error);
+    const suppressDiagnostic = failure?.error instanceof D1IdentityConflictError && failure.error.beforeMutation;
+    if (!suppressDiagnostic) {
+      const diagnostic = Promise.resolve().then(() => this.bestEffortG69AdmissionAttempt(
+        message,
+        arrivedAt,
+        deliverySource,
+        attemptContext,
+        mutationAttemptId,
+        result,
+        failure,
+        retryReason
+      ));
+      if (attemptContext?.waitUntil !== void 0) attemptContext.waitUntil(diagnostic);
+      else void diagnostic;
+    }
+    if (failure !== void 0) throw failure.error;
+    return result;
+  }
+  async recordDeliveryCore(message, arrivedAt, deliverySource = "queue", mutationAttemptId = `admission-${crypto.randomUUID()}`) {
+    this.ready();
+    const requiresGlobalReceipt = deliverySource !== "import";
+    if (requiresGlobalReceipt) assertCompletenessEnvelope(message);
+    const identity = resolveDeliveryIdentity(message, deliverySource);
+    assertSortableUniqueId(message.suid);
+    const acceptsImportedId = deliverySource === "import";
+    if (!(acceptsImportedId ? isRfc4122Uuid(message.eventId) : isUuidV7(message.eventId))) {
+      throw new D1IdentityConflictError(`EventId ${message.eventId} is not an ${acceptsImportedId ? "RFC 4122 UUID" : "UUID v7"}`);
+    }
+    try {
+      JSON.parse(message.payload);
+    } catch {
+      throw new D1IdentityConflictError(`EventId ${message.eventId} payload is not JSON text`);
+    }
+    const timestamp = message.timestamp ?? new Date(arrivedAt).toISOString();
+    if (!CANONICAL_UTC_TIMESTAMP_PATTERN.test(timestamp)) {
+      throw new D1IdentityConflictError(`EventId ${message.eventId} timestamp is not canonical UTC ISO-8601`);
+    }
+    const metadata = metadataForDelivery(message, deliverySource);
+    const storedBefore = await this.eventById(message.serviceId, message.eventId);
+    const incomingEventType = identity.key;
+    const eventTags = [...message.eventTags];
+    const tagsJson = JSON.stringify(eventTags);
+    if (storedBefore !== void 0 && (storedBefore.eventType !== incomingEventType || storedBefore.suid !== message.suid || storedBefore.payload !== message.payload || JSON.stringify(storedBefore.eventTags) !== tagsJson || requiresGlobalReceipt && storedBefore.eventDigest !== void 0 && storedBefore.eventDigest !== message.completeness.eventDigest || storedBefore.timestamp !== timestamp || storedBefore.causationId !== metadata.causationId || storedBefore.correlationId !== metadata.correlationId || storedBefore.executedUser !== metadata.executedUser)) {
+      throw new D1IdentityConflictError(`EventId ${message.eventId} conflicts with its canonical event identity`, true);
+    }
+    const lagMs = Math.max(0, arrivedAt - message.enqueuedAt);
+    const statements = [
+      this.database.prepare(
+        `INSERT INTO serialized_dcb_allocator_bindings (service_id, allocator_lineage_id, bound_at)
+         VALUES (?, ?, ?)
+         ON CONFLICT (service_id) DO NOTHING`
+      ).bind(message.serviceId, message.allocatorLineageId, arrivedAt),
+      // Binding mismatch is recorded in the same batch before any event path.
+      this.database.prepare(
+        `INSERT INTO serialized_dcb_delivery_incidents
+           (service_id, identity_key, classification, bound_lineage_id, incoming_lineage_id, observed_at)
+         SELECT service_id,
+                'LINEAGE_MISMATCH|' || service_id || '|' || allocator_lineage_id || '|' || ?,
+                'LINEAGE_MISMATCH', allocator_lineage_id, ?, ?
+           FROM serialized_dcb_allocator_bindings
+          WHERE service_id = ? AND allocator_lineage_id <> ?
+         ON CONFLICT (service_id, identity_key) DO NOTHING`
+      ).bind(
+        message.allocatorLineageId,
+        message.allocatorLineageId,
+        arrivedAt,
+        message.serviceId,
+        message.allocatorLineageId
+      ),
+      // G31 needs a target-SUID point gate even though a rejected lineage
+      // delivery has no dcb_events row. Keep this compact alias
+      // separate from the historical incident identity used by operators.
+      this.database.prepare(
+        `INSERT INTO serialized_dcb_wait_target_incidents
+           (service_id, suid, classification, event_id, observed_at)
+         SELECT ?, ?, 'LINEAGE_MISMATCH', ?, ?
+          WHERE EXISTS (
+            SELECT 1 FROM serialized_dcb_allocator_bindings
+             WHERE service_id = ? AND allocator_lineage_id <> ?
+          )
+         ON CONFLICT (service_id, suid, classification) DO NOTHING`
+      ).bind(
+        message.serviceId,
+        message.suid,
+        message.eventId,
+        arrivedAt,
+        message.serviceId,
+        message.allocatorLineageId
+      ),
+      // SUID collision is a typed incident rather than a UNIQUE exception.
+      this.database.prepare(
+        `INSERT INTO serialized_dcb_delivery_incidents
+           (service_id, identity_key, classification, suid, existing_event_id, incoming_event_id, observed_at)
+         SELECT "ServiceId",
+                'SUID_COLLISION|' || "ServiceId" || '|' || "SortableUniqueId" || '|' ||
+                  CASE WHEN "Id" < ? THEN "Id" ELSE ? END || '|' ||
+                  CASE WHEN "Id" < ? THEN ? ELSE "Id" END,
+                'SUID_COLLISION', "SortableUniqueId", "Id", ?, ?
+          FROM dcb_events
+          WHERE "ServiceId" = ? AND "SortableUniqueId" COLLATE BINARY = ? COLLATE BINARY AND "Id" <> ?
+            AND NOT EXISTS (
+              SELECT 1 FROM serialized_dcb_allocator_bindings
+               WHERE service_id = ? AND allocator_lineage_id <> ?
+            )
+          LIMIT 1
+         ON CONFLICT (service_id, identity_key) DO NOTHING`
+      ).bind(
+        message.eventId,
+        message.eventId,
+        message.eventId,
+        message.eventId,
+        message.eventId,
+        arrivedAt,
+        message.serviceId,
+        message.suid,
+        message.eventId,
+        message.serviceId,
+        message.allocatorLineageId
+      ),
+      this.database.prepare(
+        `INSERT INTO serialized_dcb_wait_target_incidents
+           (service_id, suid, classification, event_id, observed_at)
+         SELECT ?, ?, 'SUID_COLLISION', ?, ?
+          WHERE EXISTS (
+          SELECT 1 FROM dcb_events
+             WHERE "ServiceId" = ? AND "SortableUniqueId" COLLATE BINARY = ? COLLATE BINARY
+               AND "Id" <> ?
+          )
+            AND NOT EXISTS (
+              SELECT 1 FROM serialized_dcb_allocator_bindings
+               WHERE service_id = ? AND allocator_lineage_id <> ?
+            )
+         ON CONFLICT (service_id, suid, classification) DO NOTHING`
+      ).bind(
+        message.serviceId,
+        message.suid,
+        message.eventId,
+        arrivedAt,
+        message.serviceId,
+        message.suid,
+        message.eventId,
+        message.serviceId,
+        message.allocatorLineageId
+      ),
+      this.database.prepare(
+        `INSERT INTO dcb_events
+           ("ServiceId", "Id", "SortableUniqueId", "EventType", "Payload", "Tags", "Timestamp", "CausationId", "CorrelationId", "ExecutedUser", "EventDigest")
+         SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
+          WHERE NOT EXISTS (
+            SELECT 1 FROM serialized_dcb_allocator_bindings
+             WHERE service_id = ? AND allocator_lineage_id <> ?
+          )
+            AND NOT EXISTS (
+              SELECT 1 FROM dcb_events
+               WHERE "ServiceId" = ? AND "SortableUniqueId" COLLATE BINARY = ? COLLATE BINARY AND "Id" <> ?
+            )
+         ON CONFLICT ("ServiceId", "Id") DO NOTHING`
+      ).bind(
+        message.serviceId,
+        message.eventId,
+        message.suid,
+        incomingEventType,
+        message.payload,
+        tagsJson,
+        timestamp,
+        metadata.causationId,
+        metadata.correlationId,
+        metadata.executedUser,
+        requiresGlobalReceipt ? message.completeness.eventDigest : null,
+        message.serviceId,
+        message.allocatorLineageId,
+        message.serviceId,
+        message.suid,
+        message.eventId
+      ),
+      // Source discoverability is part of the same atomic global admission
+      // batch as the event, membership, and receipt.  A local Tag commit can
+      // therefore return without a D1 registry probe; until this batch
+      // succeeds, G44 has no source authority for the obligation and remains
+      // fail-closed.  Import delivery deliberately does not manufacture a
+      // Tag source partition.
+      this.database.prepare(
+        `INSERT INTO serialized_dcb_source_partitions
+           (service_id, partition_tag, last_obligation_sequence, registered_at)
+         SELECT ?, ?, ?, ?
+          WHERE ? = 1 AND EXISTS (
+            SELECT 1 FROM dcb_events
+             WHERE "ServiceId" = ? AND "Id" = ? AND "EventDigest" = ?
+          )
+         ON CONFLICT (service_id, partition_tag) DO UPDATE
+           SET last_obligation_sequence = MAX(
+                 serialized_dcb_source_partitions.last_obligation_sequence,
+                 excluded.last_obligation_sequence
+               ),
+               registered_at = excluded.registered_at`
+      ).bind(
+        message.serviceId,
+        message.tag,
+        message.completeness.obligationSequence,
+        arrivedAt,
+        requiresGlobalReceipt ? 1 : 0,
+        message.serviceId,
+        message.eventId,
+        message.completeness.eventDigest
+      ),
+      // The global declared event, this tag-side committed membership, and
+      // the source-obligation receipt are one D1 atomic batch. A Queue ack or
+      // a receipt without this join never becomes source acknowledgement.
+      this.database.prepare(
+        `INSERT INTO serialized_dcb_global_memberships
+           (service_id, event_id, partition_tag, event_digest, committed_at)
+         SELECT ?, ?, ?, ?, ?
+          WHERE ? = 1 AND EXISTS (
+            SELECT 1 FROM dcb_events
+             WHERE "ServiceId" = ? AND "Id" = ? AND "EventDigest" = ?
+          )
+         ON CONFLICT (service_id, event_id, partition_tag) DO NOTHING`
+      ).bind(
+        message.serviceId,
+        message.eventId,
+        message.tag,
+        message.completeness.eventDigest,
+        arrivedAt,
+        requiresGlobalReceipt ? 1 : 0,
+        message.serviceId,
+        message.eventId,
+        message.completeness.eventDigest
+      ),
+      this.database.prepare(
+        `INSERT INTO serialized_dcb_global_receipts
+           (service_id, partition_tag, obligation_sequence, event_id, event_digest, membership_tag, received_at)
+         SELECT ?, ?, ?, ?, ?, ?, ?
+          WHERE ? = 1 AND EXISTS (
+            SELECT 1 FROM serialized_dcb_global_memberships
+             WHERE service_id = ? AND event_id = ? AND partition_tag = ? AND event_digest = ?
+          )
+         ON CONFLICT (service_id, partition_tag, obligation_sequence) DO NOTHING`
+      ).bind(
+        message.serviceId,
+        message.tag,
+        message.completeness.obligationSequence,
+        message.eventId,
+        message.completeness.eventDigest,
+        message.tag,
+        arrivedAt,
+        requiresGlobalReceipt ? 1 : 0,
+        message.serviceId,
+        message.eventId,
+        message.tag,
+        message.completeness.eventDigest
+      ),
+      this.database.prepare(
+        `INSERT INTO dcb_event_ops
+           ("ServiceId", "Id", "AttemptId", "FirstAdmissionAttemptId", "LastAdmissionAttemptId", "AllocatorLineageId", "FirstArrivedAt", "LastArrivedAt", "MaxDeliveryLagMs", "FirstArrivedSource", "LastArrivedSource")
+         SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
+          WHERE EXISTS (
+            SELECT 1 FROM dcb_events
+             WHERE "ServiceId" = ? AND "Id" = ?
+               AND "SortableUniqueId" COLLATE BINARY = ? COLLATE BINARY
+               AND "Payload" = ? AND "EventType" = ? AND "Tags" = ?
+          )
+         ON CONFLICT ("ServiceId", "Id") DO UPDATE
+           SET "FirstArrivedAt" = MIN(dcb_event_ops."FirstArrivedAt", excluded."FirstArrivedAt"),
+               "LastArrivedAt" = MAX(dcb_event_ops."LastArrivedAt", excluded."LastArrivedAt"),
+               "MaxDeliveryLagMs" = MAX(dcb_event_ops."MaxDeliveryLagMs", excluded."MaxDeliveryLagMs"),
+               "FirstAdmissionAttemptId" = COALESCE(dcb_event_ops."FirstAdmissionAttemptId", excluded."FirstAdmissionAttemptId"),
+               "LastAdmissionAttemptId" = excluded."LastAdmissionAttemptId",
+               "FirstArrivedSource" = dcb_event_ops."FirstArrivedSource",
+               "LastArrivedSource" = CASE
+                 WHEN excluded."LastArrivedAt" > dcb_event_ops."LastArrivedAt" THEN excluded."LastArrivedSource"
+                 ELSE dcb_event_ops."LastArrivedSource"
+               END`
+      ).bind(
+        message.serviceId,
+        message.eventId,
+        message.attemptId,
+        mutationAttemptId,
+        mutationAttemptId,
+        message.allocatorLineageId,
+        arrivedAt,
+        arrivedAt,
+        lagMs,
+        deliverySource,
+        deliverySource,
+        message.serviceId,
+        message.eventId,
+        message.suid,
+        message.payload,
+        incomingEventType,
+        tagsJson
+      ),
+      this.database.prepare(
+        `INSERT INTO serialized_dcb_event_arrivals
+           (service_id, event_id, tag, enqueued_at, arrived_at, lag_ms)
+         SELECT ?, ?, ?, ?, ?, ?
+          WHERE EXISTS (
+            SELECT 1 FROM dcb_events
+             WHERE "ServiceId" = ? AND "Id" = ? AND "SortableUniqueId" COLLATE BINARY = ? COLLATE BINARY
+               AND "Payload" = ? AND "EventType" = ? AND "Tags" = ?
+          )
+            AND NOT EXISTS (
+              SELECT 1 FROM serialized_dcb_allocator_bindings
+               WHERE service_id = ? AND allocator_lineage_id <> ?
+            )
+            AND NOT EXISTS (
+              SELECT 1 FROM dcb_events collision
+               WHERE collision."ServiceId" = ? AND collision."SortableUniqueId" COLLATE BINARY = ? COLLATE BINARY
+                 AND collision."Id" <> ?
+            )
+         ON CONFLICT (service_id, event_id, tag) DO UPDATE
+           SET enqueued_at = MIN(serialized_dcb_event_arrivals.enqueued_at, excluded.enqueued_at),
+               arrived_at = MAX(serialized_dcb_event_arrivals.arrived_at, excluded.arrived_at),
+               lag_ms = MAX(serialized_dcb_event_arrivals.lag_ms, excluded.lag_ms)`
+      ).bind(
+        message.serviceId,
+        message.eventId,
+        message.tag,
+        message.enqueuedAt,
+        arrivedAt,
+        lagMs,
+        message.serviceId,
+        message.eventId,
+        message.suid,
+        message.payload,
+        incomingEventType,
+        tagsJson,
+        message.serviceId,
+        message.allocatorLineageId,
+        message.serviceId,
+        message.suid,
+        message.eventId
+      ),
+      this.database.prepare(
+        `INSERT INTO serialized_dcb_lag_estimates (service_id, estimate_ms, observed_at)
+         SELECT ?, ?, ?
+          WHERE ? = 'queue'
+            AND NOT EXISTS (
+            SELECT 1 FROM serialized_dcb_allocator_bindings
+             WHERE service_id = ? AND allocator_lineage_id <> ?
+          )
+            AND NOT EXISTS (
+            SELECT 1 FROM dcb_events collision
+               WHERE collision."ServiceId" = ? AND collision."SortableUniqueId" COLLATE BINARY = ? COLLATE BINARY
+                 AND collision."Id" <> ?
+            )
+            AND NOT EXISTS (
+              SELECT 1 FROM dcb_events contradictory
+               WHERE contradictory."ServiceId" = ? AND contradictory."Id" = ?
+                 AND (contradictory."SortableUniqueId" COLLATE BINARY <> ? COLLATE BINARY
+                   OR contradictory."Payload" <> ? OR contradictory."EventType" <> ?
+                   OR contradictory."Tags" <> ?)
+            )
+            AND NOT EXISTS (
+              SELECT 1 FROM dcb_events prior
+               WHERE prior."ServiceId" = ? AND prior."SortableUniqueId" COLLATE BINARY > ? COLLATE BINARY
+            )
+         ON CONFLICT (service_id) DO UPDATE
+            SET estimate_ms = MAX(
+              MAX(serialized_dcb_lag_estimates.estimate_ms -
+                  MAX(0, excluded.observed_at - serialized_dcb_lag_estimates.observed_at), 0),
+              excluded.estimate_ms
+            ),
+                observed_at = excluded.observed_at`
+      ).bind(
+        message.serviceId,
+        lagMs,
+        arrivedAt,
+        deliverySource,
+        message.serviceId,
+        message.allocatorLineageId,
+        message.serviceId,
+        message.suid,
+        message.eventId,
+        message.serviceId,
+        message.eventId,
+        message.suid,
+        message.payload,
+        incomingEventType,
+        tagsJson,
+        message.serviceId,
+        message.suid
+      )
+    ];
+    await this.batch("recordDelivery", statements);
+    const binding = await this.lineageBinding(message.serviceId);
+    if (binding !== void 0 && binding !== message.allocatorLineageId) {
+      const incident = await this.incidentByIdentity(
+        message.serviceId,
+        lineageIdentity(message.serviceId, binding, message.allocatorLineageId)
+      );
+      if (incident === void 0) throw new Error("D1 lineage incident was not durable");
+      return { outcome: "lineage-mismatch", kind: "lineage-mismatch", incident };
+    }
+    const collision = await this.collisionEvent(message.serviceId, message.suid, message.eventId);
+    if (collision !== void 0) {
+      const identity2 = collisionIdentity(message.serviceId, message.suid, collision, message.eventId);
+      const incident = await this.incidentByIdentity(message.serviceId, identity2);
+      if (incident === void 0) throw new Error("D1 SUID collision incident was not durable");
+      return { outcome: "suid-collision", kind: "suid-collision", incident };
+    }
+    const stored = await this.eventById(message.serviceId, message.eventId);
+    if (stored === void 0) throw new Error("D1 event delivery did not produce a durable row");
+    if (stored.suid !== message.suid || stored.payload !== message.payload || JSON.stringify(stored.eventTags) !== tagsJson || stored.eventType !== incomingEventType || requiresGlobalReceipt && stored.eventDigest !== message.completeness.eventDigest || stored.timestamp !== timestamp || stored.causationId !== metadata.causationId || stored.correlationId !== metadata.correlationId || stored.executedUser !== metadata.executedUser) {
+      throw new D1IdentityConflictError(`EventId ${message.eventId} conflicts with its durable D1 identity`);
+    }
+    if (requiresGlobalReceipt) {
+      const receipt = await this.readGlobalReceiptJoin(message);
+      if (receipt === void 0) {
+        throw new Error(`D1 event ${message.eventId} has no readable global receipt/membership join`);
+      }
+    }
+    return {
+      outcome: "stored",
+      kind: "stored",
+      event: stored,
+      mutationEvidence: "unverified"
+    };
+  }
+  async readGlobalReceiptJoin(message) {
+    this.ready();
+    const row = await this.database.prepare(
+      `SELECT receipt.service_id, receipt.partition_tag, receipt.obligation_sequence,
+              receipt.event_id, receipt.event_digest, receipt.membership_tag, receipt.received_at
+         FROM serialized_dcb_global_receipts AS receipt
+         JOIN serialized_dcb_global_memberships AS membership
+           ON membership.service_id = receipt.service_id
+          AND membership.event_id = receipt.event_id
+          AND membership.partition_tag = receipt.membership_tag
+          AND membership.event_digest = receipt.event_digest
+         JOIN dcb_events AS event
+           ON event."ServiceId" = receipt.service_id
+          AND event."Id" = receipt.event_id
+          AND event."EventDigest" = receipt.event_digest
+        WHERE receipt.service_id = ?
+          AND receipt.partition_tag = ?
+          AND receipt.obligation_sequence = ?
+          AND receipt.event_id = ?
+          AND receipt.event_digest = ?
+          AND receipt.membership_tag = ?`
+    ).bind(
+      message.serviceId,
+      message.tag,
+      message.completeness.obligationSequence,
+      message.eventId,
+      message.completeness.eventDigest,
+      message.tag
+    ).first();
+    if (row === null || row === void 0) return void 0;
+    return {
+      serviceId: asString(row.service_id, "global_receipt.service_id"),
+      partitionTag: asString(row.partition_tag, "global_receipt.partition_tag"),
+      obligationSequence: asNumber(row.obligation_sequence, "global_receipt.obligation_sequence"),
+      eventId: asString(row.event_id, "global_receipt.event_id"),
+      eventDigest: asString(row.event_digest, "global_receipt.event_digest"),
+      membershipTag: asString(row.membership_tag, "global_receipt.membership_tag"),
+      receivedAt: asNumber(row.received_at, "global_receipt.received_at")
+    };
+  }
+  async readAllEvents(serviceId, since) {
+    this.ready();
+    if (since.length !== 0) assertSortableUniqueId(since);
+    const rows = await this.rows(
+      `SELECT e."ServiceId" AS service_id, e."Id" AS event_id,
+              e."SortableUniqueId" AS suid, e."Payload" AS payload,
+              e."EventType" AS event_type, e."Tags" AS event_tags,
+              e."EventDigest" AS event_digest,
+              e."Timestamp" AS timestamp, e."CausationId" AS causation_id,
+              e."CorrelationId" AS correlation_id, e."ExecutedUser" AS executed_user,
+              COALESCE(o."FirstArrivedAt", 0) AS first_arrived_at,
+              COALESCE(o."LastArrivedAt", 0) AS last_arrived_at,
+              COALESCE(o."MaxDeliveryLagMs", 0) AS max_delivery_lag_ms
+         FROM dcb_events e LEFT JOIN dcb_event_ops o
+           ON o."ServiceId" = e."ServiceId" AND o."Id" = e."Id"
+        WHERE e."ServiceId" = ? AND e."SortableUniqueId" COLLATE BINARY > ? COLLATE BINARY
+        ORDER BY e."SortableUniqueId" COLLATE BINARY ASC, e."Id" COLLATE BINARY ASC`,
+      serviceId,
+      since
+    );
+    return Promise.all(rows.map((row) => this.eventFromRow(row)));
+  }
+  /**
+   * G69 strict-order detector: find an event admitted after a projection
+   * checkpoint whose opaque SUID is lower than that checkpoint. A replay of
+   * an event already known before the checkpoint is deliberately excluded by
+   * FirstArrivedAt, so the detector reports new lower-SUID admission rather
+   * than ordinary Queue redelivery.
+   */
+  async findLateLowerSuid(serviceId, checkpointSuid, checkpointUpdatedAt) {
+    const evidence = await this.findLateLowerSuidEvidence(serviceId, checkpointSuid, checkpointUpdatedAt);
+    return evidence.kind === "late-lower-suid" ? evidence.event : void 0;
+  }
+  async findLateLowerSuidEvidence(serviceId, checkpointSuid, checkpointUpdatedAt, generation) {
+    const detectorStartedAt = Date.now();
+    const finish = (result) => ({ ...result, durationMs: Math.max(0, Date.now() - detectorStartedAt) });
+    this.ready();
+    if (generation !== void 0 && (!Number.isSafeInteger(generation) || generation < 0)) {
+      return finish({ kind: "unknown", reason: "generation-invalid" });
+    }
+    if (checkpointSuid.length === 0) return finish({ kind: "miss" });
+    if (!Number.isSafeInteger(checkpointUpdatedAt) || checkpointUpdatedAt < 0) {
+      return finish({ kind: "unknown", reason: "checkpoint-clock-invalid" });
+    }
+    try {
+      assertSortableUniqueId(checkpointSuid);
+      const proven = await this.database.prepare(
+        `SELECT e."Id" AS event_id
+           FROM dcb_events e
+           JOIN dcb_event_ops o
+             ON o."ServiceId" = e."ServiceId" AND o."Id" = e."Id"
+          WHERE e."ServiceId" = ?
+            AND e."SortableUniqueId" COLLATE BINARY < ? COLLATE BINARY
+            AND o."FirstArrivedAt" > ?
+            AND o."FirstArrivedAt" >= 0
+            AND o."LastArrivedAt" >= o."FirstArrivedAt"
+            AND o."FirstArrivedSource" IN ('queue', 'fast')
+          ORDER BY e."SortableUniqueId" COLLATE BINARY ASC, e."Id" COLLATE BINARY ASC
+          LIMIT 1`
+      ).bind(serviceId, checkpointSuid, checkpointUpdatedAt).first();
+      if (proven !== null && proven !== void 0) {
+        const event2 = await this.eventById(serviceId, asString(proven.event_id, "late_lower_suid.event_id"));
+        return event2 === void 0 ? finish({ kind: "unknown", reason: "late-event-row-disappeared" }) : finish({ kind: "late-lower-suid", event: event2 });
+      }
+      const uncertain = await this.database.prepare(
+        `SELECT o."FirstArrivedAt" AS first_arrived_at,
+                o."LastArrivedAt" AS last_arrived_at,
+                o."FirstArrivedSource" AS first_arrived_source
+           FROM dcb_events e
+           JOIN dcb_event_ops o
+             ON o."ServiceId" = e."ServiceId" AND o."Id" = e."Id"
+          WHERE e."ServiceId" = ?
+            AND e."SortableUniqueId" COLLATE BINARY < ? COLLATE BINARY
+            AND (
+              o."FirstArrivedAt" < 0
+              OR o."LastArrivedAt" < o."FirstArrivedAt"
+              OR (
+                o."FirstArrivedAt" > ?
+                AND COALESCE(o."FirstArrivedSource", 'unknown') NOT IN ('queue', 'fast')
+              )
+            )
+          ORDER BY e."SortableUniqueId" COLLATE BINARY ASC, e."Id" COLLATE BINARY ASC
+          LIMIT 1`
+      ).bind(serviceId, checkpointSuid, checkpointUpdatedAt).first();
+      if (uncertain !== null && uncertain !== void 0) {
+        const first = asNumber(uncertain.first_arrived_at, "late_lower_suid.first_arrived_at");
+        const last = asNumber(uncertain.last_arrived_at, "late_lower_suid.last_arrived_at");
+        return finish({
+          kind: "unknown",
+          reason: first < 0 || last < first ? "arrival-clock-rollback" : "arrival-provenance-untrusted"
+        });
+      }
+      const replay = await this.database.prepare(
+        `SELECT e."Id" AS event_id
+           FROM dcb_events e
+           JOIN dcb_event_ops o
+             ON o."ServiceId" = e."ServiceId" AND o."Id" = e."Id"
+          WHERE e."ServiceId" = ?
+            AND e."SortableUniqueId" COLLATE BINARY < ? COLLATE BINARY
+            AND o."FirstArrivedAt" <= ?
+            AND o."LastArrivedAt" > ?
+            AND o."LastArrivedSource" IN ('queue', 'fast')
+          ORDER BY o."LastArrivedAt" DESC,
+                   e."SortableUniqueId" COLLATE BINARY ASC,
+                   e."Id" COLLATE BINARY ASC
+          LIMIT 1`
+      ).bind(serviceId, checkpointSuid, checkpointUpdatedAt, checkpointUpdatedAt).first();
+      if (replay === null || replay === void 0) return finish({ kind: "miss" });
+      const event = await this.eventById(serviceId, asString(replay.event_id, "replay.event_id"));
+      return event === void 0 ? finish({ kind: "unknown", reason: "replay-event-row-disappeared" }) : finish({ kind: "replay", event });
+    } catch (error) {
+      return finish({ kind: "unknown", reason: errorText(error) });
+    }
+  }
+  /**
+   * G31 source proof: one indexed target-SUID lookup distinguishes pending,
+   * unique stored, and contradictory/incident states. It intentionally never
+   * delegates to readAllEvents, which would make waitFor history-size bound.
+   */
+  async readWaitForTarget(serviceId, suid) {
+    this.ready();
+    assertSortableUniqueId(suid);
+    const row = await this.database.prepare(
+      `WITH target AS (
+         SELECT "Id" AS event_id
+           FROM dcb_events
+          WHERE "ServiceId" = ? AND "SortableUniqueId" COLLATE BINARY = ? COLLATE BINARY
+          ORDER BY "Id" COLLATE BINARY ASC
+          LIMIT 2
+       )
+       SELECT
+         (SELECT COUNT(*) FROM target) AS target_count,
+         (SELECT event_id FROM target ORDER BY event_id COLLATE BINARY ASC LIMIT 1) AS event_id,
+         CASE WHEN EXISTS (
+           SELECT 1
+             FROM serialized_dcb_wait_target_incidents incident
+            WHERE incident.service_id = ? AND incident.suid COLLATE BINARY = ? COLLATE BINARY
+              AND incident.classification IN ('SUID_COLLISION', 'LINEAGE_MISMATCH')
+         ) OR EXISTS (
+           SELECT 1
+             FROM serialized_dcb_delivery_incidents incident
+            WHERE incident.service_id = ? AND incident.suid COLLATE BINARY = ? COLLATE BINARY
+              AND incident.classification = 'SUID_COLLISION'
+         ) THEN 1 ELSE 0 END AS target_incident`
+    ).bind(serviceId, suid, serviceId, suid, serviceId, suid).first();
+    if (row === null || row === void 0) throw new Error("D1 wait target lookup returned no row");
+    if (asNumber(row.target_incident, "target_incident") === 1) {
+      return { kind: "unavailable", reason: "incident" };
+    }
+    const count = asNumber(row.target_count, "target_count");
+    if (count === 0) return { kind: "pending" };
+    if (count !== 1 || typeof row.event_id !== "string" || row.event_id.length === 0) {
+      return { kind: "unavailable", reason: "suid-contradiction" };
+    }
+    return { kind: "stored", eventId: row.event_id, suid };
+  }
+  async currentLagBound(serviceId, nowMs) {
+    this.ready();
+    const rows = await this.rows(
+      `SELECT estimate_ms, observed_at FROM serialized_dcb_lag_estimates WHERE service_id = ?`,
+      serviceId
+    );
+    const row = rows[0];
+    if (row === void 0) return 0;
+    const estimate = asNumber(row.estimate_ms, "estimate_ms");
+    const observedAt = asNumber(row.observed_at, "observed_at");
+    const decayNow = nowMs !== void 0 && nowMs >= 1e11 && observedAt >= 1e11 ? nowMs : observedAt;
+    return decayedLagEstimateMs(estimate, observedAt, decayNow);
+  }
+  async lagBoundDiagnostics(serviceId, nowMs) {
+    this.ready();
+    const rows = await this.rows(
+      `SELECT estimate_ms, observed_at FROM serialized_dcb_lag_estimates WHERE service_id = ?`,
+      serviceId
+    );
+    const row = rows[0];
+    if (row === void 0) {
+      return { serviceIdUsed: serviceId, dynamicLagBoundMs: 0, rowFound: false, rawEstimateMs: null, rawObservedAt: null, nowMs };
+    }
+    const rawEstimateMs = asNumber(row.estimate_ms, "estimate_ms");
+    const rawObservedAt = asNumber(row.observed_at, "observed_at");
+    const decayNow = nowMs >= 1e11 && rawObservedAt >= 1e11 ? nowMs : rawObservedAt;
+    return {
+      serviceIdUsed: serviceId,
+      dynamicLagBoundMs: decayedLagEstimateMs(rawEstimateMs, rawObservedAt, decayNow),
+      rowFound: true,
+      rawEstimateMs,
+      rawObservedAt,
+      nowMs
+    };
+  }
+  async listProjectionTags(serviceId) {
+    this.ready();
+    const rows = await this.rows(
+      `SELECT DISTINCT membership.value AS tag
+         FROM dcb_events event, json_each(event."Tags") membership
+        WHERE event."ServiceId" = ?
+        ORDER BY tag COLLATE BINARY ASC`,
+      serviceId
+    );
+    return rows.map((row) => asString(row.tag, "tag"));
+  }
+  async readProjectionCheckpoint(serviceId, projectionId) {
+    this.ready();
+    const rows = await this.rows(
+      `SELECT service_id, projection_id, last_suid, state_json, version, updated_at
+         FROM serialized_dcb_projection_checkpoints
+        WHERE service_id = ? AND projection_id = ?`,
+      serviceId,
+      projectionId
+    );
+    return rows[0] === void 0 ? void 0 : checkpointFrom(rows[0]);
+  }
+  async advanceProjectionCheckpoint(input) {
+    this.ready();
+    const statement = this.database.prepare(
+      `INSERT INTO serialized_dcb_projection_checkpoints
+         (service_id, projection_id, last_suid, state_json, version, updated_at)
+       SELECT ?, ?, ?, ?, ?, ?
+        WHERE ? IS NULL OR EXISTS (
+          SELECT 1 FROM serialized_dcb_projection_checkpoints current
+           WHERE current.service_id = ? AND current.projection_id = ?
+             AND current.last_suid COLLATE BINARY = ? COLLATE BINARY
+        )
+       ON CONFLICT (service_id, projection_id) DO UPDATE
+          SET last_suid = excluded.last_suid,
+              state_json = excluded.state_json,
+              version = excluded.version,
+              updated_at = excluded.updated_at
+        WHERE serialized_dcb_projection_checkpoints.last_suid COLLATE BINARY = ? COLLATE BINARY`
+    ).bind(
+      input.serviceId,
+      input.projectionId,
+      input.lastSuid,
+      input.stateJson,
+      input.version,
+      input.updatedAt,
+      input.expectedLastSuid,
+      input.serviceId,
+      input.projectionId,
+      input.expectedLastSuid,
+      input.expectedLastSuid
+    );
+    const result = await this.write("advanceProjectionCheckpoint", statement).run();
+    return result.meta.changes === 1;
+  }
+  async projectionLag(serviceId, projectionId, tag) {
+    this.ready();
+    const checkpoint = await this.readProjectionCheckpoint(serviceId, projectionId);
+    const checkpointSuid = checkpoint?.lastSuid ?? "";
+    const rows = await this.rows(
+      `SELECT
+         COALESCE((SELECT event."SortableUniqueId"
+                     FROM dcb_events event, json_each(event."Tags") membership
+                    WHERE event."ServiceId" = ? AND membership.value = ?
+                    ORDER BY event."SortableUniqueId" COLLATE BINARY DESC LIMIT 1), '') AS head_suid,
+         (SELECT COUNT(*)
+            FROM dcb_events event, json_each(event."Tags") membership
+           WHERE event."ServiceId" = ? AND membership.value = ?
+             AND event."SortableUniqueId" COLLATE BINARY > ? COLLATE BINARY) AS behind_events`,
+      serviceId,
+      tag,
+      serviceId,
+      tag,
+      checkpointSuid
+    );
+    const row = rows[0] ?? {};
+    return {
+      serviceId,
+      projectionId,
+      tag,
+      checkpointSuid,
+      headSuid: asString(row.head_suid ?? "", "head_suid"),
+      behindEvents: asNumber(row.behind_events ?? 0, "behind_events")
+    };
+  }
+  async upsertPending(message, firstObservedAt, lagBoundMs) {
+    this.ready();
+    const expectedJson = jsonArray(message.eventTags);
+    const observedJson = jsonArray([message.tag]);
+    const statements = [
+      this.database.prepare(
+        `INSERT INTO serialized_dcb_pending_arrivals
+           (service_id, event_id, attempt_id, suid, expected_paths, observed_paths, first_observed_at, lag_bound_ms)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT (service_id, event_id) DO NOTHING`
+      ).bind(
+        message.serviceId,
+        message.eventId,
+        message.attemptId,
+        message.suid,
+        expectedJson,
+        observedJson,
+        firstObservedAt,
+        lagBoundMs
+      ),
+      // JSON1 performs the set union inside the atomic UPDATE. There is no
+      // TypeScript read/merge/write window under concurrent deliveries.
+      this.database.prepare(
+        `UPDATE serialized_dcb_pending_arrivals AS pending
+            SET expected_paths = COALESCE((
+                  SELECT json_group_array(value) FROM (
+                    SELECT value FROM json_each(pending.expected_paths)
+                    UNION
+                    SELECT value FROM json_each(?)
+                    ORDER BY value COLLATE BINARY
+                  )
+                ), '[]'),
+                observed_paths = COALESCE((
+                  SELECT json_group_array(value) FROM (
+                    SELECT value FROM json_each(pending.observed_paths)
+                    UNION
+                    SELECT value FROM json_each(?)
+                    ORDER BY value COLLATE BINARY
+                  )
+                ), '[]'),
+                lag_bound_ms = MAX(lag_bound_ms, ?)
+          WHERE service_id = ? AND event_id = ? AND attempt_id = ?
+            AND suid COLLATE BINARY = ? COLLATE BINARY`
+      ).bind(
+        expectedJson,
+        observedJson,
+        lagBoundMs,
+        message.serviceId,
+        message.eventId,
+        message.attemptId,
+        message.suid
+      )
+    ];
+    await this.batch("upsertPending", statements);
+    const pending = await this.pendingById(message.serviceId, message.eventId);
+    if (pending === void 0) throw new Error("D1 pending arrival was not persisted");
+    if (pending.attemptId !== message.attemptId || pending.suid !== message.suid) {
+      throw new D1IdentityConflictError(`EventId ${message.eventId} has contradictory pending-arrival identity`);
+    }
+    return pending;
+  }
+  async listPending(serviceId) {
+    this.ready();
+    const rows = serviceId === void 0 ? await this.rows(
+      `SELECT service_id, event_id, attempt_id, suid, expected_paths, observed_paths, first_observed_at, lag_bound_ms
+           FROM serialized_dcb_pending_arrivals
+          ORDER BY service_id COLLATE BINARY ASC, event_id COLLATE BINARY ASC`
+    ) : await this.rows(
+      `SELECT service_id, event_id, attempt_id, suid, expected_paths, observed_paths, first_observed_at, lag_bound_ms
+           FROM serialized_dcb_pending_arrivals
+          WHERE service_id = ?
+          ORDER BY event_id COLLATE BINARY ASC`,
+      serviceId
+    );
+    return rows.map(pendingFrom);
+  }
+  async appendFinding(finding) {
+    this.ready();
+    const statement = this.database.prepare(
+      `INSERT INTO serialized_dcb_inconsistency_findings
+         (service_id, event_id, path, classification, first_observed_at, lag_bound_ms, observed_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT (service_id, event_id, path, classification) DO NOTHING`
+    ).bind(
+      finding.serviceId,
+      finding.eventId,
+      finding.path,
+      finding.classification,
+      finding.firstObservedAt,
+      finding.lagBoundMs,
+      finding.observedAt
+    );
+    await this.write("appendFinding", statement).run();
+  }
+  async hasFinding(serviceId, eventId, path, classification) {
+    this.ready();
+    const rows = await this.rows(
+      `SELECT 1 AS present FROM serialized_dcb_inconsistency_findings
+        WHERE service_id = ? AND event_id = ? AND path = ? AND classification = ?`,
+      serviceId,
+      eventId,
+      path,
+      classification
+    );
+    return rows.length !== 0;
+  }
+  async listFindings(serviceId, eventId) {
+    this.ready();
+    const conditions = [];
+    const values = [];
+    if (serviceId !== void 0) {
+      conditions.push("service_id = ?");
+      values.push(serviceId);
+    }
+    if (eventId !== void 0) {
+      conditions.push("event_id = ?");
+      values.push(eventId);
+    }
+    const rows = await this.rows(
+      `SELECT service_id, event_id, path, classification, first_observed_at, lag_bound_ms, observed_at
+         FROM serialized_dcb_inconsistency_findings
+        ${conditions.length === 0 ? "" : `WHERE ${conditions.join(" AND ")}`}
+        ORDER BY sequence ASC`,
+      ...values
+    );
+    return rows.map(findingFrom);
+  }
+  async appendDeliveryIncident(incident) {
+    this.ready();
+    const statement = this.database.prepare(
+      `INSERT INTO serialized_dcb_delivery_incidents
+         (service_id, identity_key, classification, suid, existing_event_id, incoming_event_id, event_id,
+          bound_lineage_id, incoming_lineage_id, observed_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT (service_id, identity_key) DO NOTHING`
+    ).bind(
+      incident.serviceId,
+      incident.identityKey,
+      incident.classification,
+      incident.suid ?? null,
+      incident.existingEventId ?? null,
+      incident.incomingEventId ?? null,
+      incident.eventId ?? null,
+      incident.boundLineageId ?? null,
+      incident.incomingLineageId ?? null,
+      incident.observedAt
+    );
+    await this.write("appendDeliveryIncident", statement).run();
+  }
+  async hasDeliveryIncident(serviceId, identityKey) {
+    this.ready();
+    return await this.incidentByIdentity(serviceId, identityKey) !== void 0;
+  }
+  async listDeliveryIncidents(serviceId) {
+    this.ready();
+    const rows = serviceId === void 0 ? await this.rows(
+      `SELECT service_id, identity_key, classification, suid, existing_event_id, incoming_event_id, event_id,
+                bound_lineage_id, incoming_lineage_id, observed_at
+           FROM serialized_dcb_delivery_incidents
+          ORDER BY sequence ASC`
+    ) : await this.rows(
+      `SELECT service_id, identity_key, classification, suid, existing_event_id, incoming_event_id, event_id,
+                bound_lineage_id, incoming_lineage_id, observed_at
+           FROM serialized_dcb_delivery_incidents
+          WHERE service_id = ?
+          ORDER BY sequence ASC`,
+      serviceId
+    );
+    return rows.map(incidentFrom);
+  }
+  async batch(operation, statements) {
+    const transformed = await this.options.beforeBatch?.(operation, statements, this.database) ?? statements;
+    await this.database.batch([...transformed]);
+  }
+  write(operation, statement) {
+    return this.options.beforeWrite?.(operation, statement, this.database) ?? statement;
+  }
+  async rows(statement, ...values) {
+    const result = await this.database.prepare(statement).bind(...values).all();
+    return result.results;
+  }
+  async eventById(serviceId, eventId) {
+    const rows = await this.rows(
+      `SELECT e."ServiceId" AS service_id, e."Id" AS event_id,
+              e."SortableUniqueId" AS suid, e."Payload" AS payload,
+              e."EventType" AS event_type, e."Tags" AS event_tags,
+              e."EventDigest" AS event_digest,
+              e."Timestamp" AS timestamp, e."CausationId" AS causation_id,
+              e."CorrelationId" AS correlation_id, e."ExecutedUser" AS executed_user,
+              COALESCE(o."FirstArrivedAt", 0) AS first_arrived_at,
+              COALESCE(o."LastArrivedAt", 0) AS last_arrived_at,
+              COALESCE(o."MaxDeliveryLagMs", 0) AS max_delivery_lag_ms
+         FROM dcb_events e LEFT JOIN dcb_event_ops o
+           ON o."ServiceId" = e."ServiceId" AND o."Id" = e."Id"
+        WHERE e."ServiceId" = ? AND e."Id" = ?`,
+      serviceId,
+      eventId
+    );
+    return rows[0] === void 0 ? void 0 : this.eventFromRow(rows[0]);
+  }
+  async eventFromRow(row) {
+    const arrivals = await this.rows(
+      `SELECT service_id, event_id, tag, enqueued_at, arrived_at, lag_ms
+         FROM serialized_dcb_event_arrivals
+        WHERE service_id = ? AND event_id = ?
+        ORDER BY tag COLLATE BINARY ASC`,
+      asString(row.service_id, "service_id"),
+      asString(row.event_id, "event_id")
+    );
+    return eventFrom(row, arrivals);
+  }
+  async pendingById(serviceId, eventId) {
+    const rows = await this.rows(
+      `SELECT service_id, event_id, attempt_id, suid, expected_paths, observed_paths, first_observed_at, lag_bound_ms
+         FROM serialized_dcb_pending_arrivals WHERE service_id = ? AND event_id = ?`,
+      serviceId,
+      eventId
+    );
+    return rows[0] === void 0 ? void 0 : pendingFrom(rows[0]);
+  }
+  async lineageBinding(serviceId) {
+    const rows = await this.rows(
+      `SELECT allocator_lineage_id FROM serialized_dcb_allocator_bindings WHERE service_id = ?`,
+      serviceId
+    );
+    return rows[0] === void 0 ? void 0 : asString(rows[0].allocator_lineage_id, "allocator_lineage_id");
+  }
+  async collisionEvent(serviceId, suid, eventId) {
+    const rows = await this.rows(
+      `SELECT "Id" AS event_id FROM dcb_events
+        WHERE "ServiceId" = ? AND "SortableUniqueId" COLLATE BINARY = ? COLLATE BINARY AND "Id" <> ?
+        ORDER BY "Id" COLLATE BINARY ASC LIMIT 1`,
+      serviceId,
+      suid,
+      eventId
+    );
+    return rows[0] === void 0 ? void 0 : asString(rows[0].event_id, "event_id");
+  }
+  async incidentByIdentity(serviceId, identityKey) {
+    const rows = await this.rows(
+      `SELECT service_id, identity_key, classification, suid, existing_event_id, incoming_event_id, event_id,
+              bound_lineage_id, incoming_lineage_id, observed_at
+         FROM serialized_dcb_delivery_incidents
+        WHERE service_id = ? AND identity_key = ?`,
+      serviceId,
+      identityKey
+    );
+    return rows[0] === void 0 ? void 0 : incidentFrom(rows[0]);
+  }
+  async eventArrivalOps(serviceId, eventId) {
+    const row = await this.database.prepare(
+      `SELECT "FirstArrivedAt" AS first_arrived_at, "LastArrivedAt" AS last_arrived_at
+         FROM dcb_event_ops
+        WHERE "ServiceId" = ? AND "Id" = ?`
+    ).bind(serviceId, eventId).first();
+    if (row === null || row === void 0) return void 0;
+    return {
+      firstArrivedAt: asNumber(row.first_arrived_at, "event_ops.first_arrived_at"),
+      lastArrivedAt: asNumber(row.last_arrived_at, "event_ops.last_arrived_at")
+    };
+  }
+  async admissionMutationEvidence(serviceId, eventId, mutationAttemptId) {
+    const row = await this.database.prepare(
+      `SELECT "FirstAdmissionAttemptId" AS first_admission_attempt_id,
+              "LastAdmissionAttemptId" AS last_admission_attempt_id
+         FROM dcb_event_ops
+        WHERE "ServiceId" = ? AND "Id" = ?`
+    ).bind(serviceId, eventId).first();
+    const first = row?.first_admission_attempt_id === null || row?.first_admission_attempt_id === void 0 ? void 0 : asString(row.first_admission_attempt_id, "event_ops.first_admission_attempt_id");
+    const last = row?.last_admission_attempt_id === null || row?.last_admission_attempt_id === void 0 ? void 0 : asString(row.last_admission_attempt_id, "event_ops.last_admission_attempt_id");
+    if (first === mutationAttemptId) return "first-admission";
+    if (last === mutationAttemptId) return "duplicate-admission";
+    return "unverified";
+  }
+  async bestEffortG69AdmissionAttempt(message, arrivedAt, deliverySource, attemptContext, mutationAttemptId, result, failure, retryReason) {
+    const diagnosticStartedAt = Date.now();
+    const receiptCostMs = () => Math.max(0, Date.now() - diagnosticStartedAt);
+    const appendFailedDiagnostic = async (reason) => {
+      try {
+        await appendG69AdmissionAttempt(this.database, {
+          serviceId: message.serviceId,
+          eventId: message.eventId,
+          suid: message.suid,
+          tag: message.tag,
+          deliverySource,
+          queueMessageId: attemptContext?.queueMessageId ?? null,
+          attemptId: message.attemptId,
+          allocatorLineageId: message.allocatorLineageId,
+          obligationSequence: message.completeness.obligationSequence,
+          enqueuedAt: message.enqueuedAt,
+          observedAt: Date.now(),
+          arrivedAt,
+          firstArrivedAtBefore: null,
+          lastArrivedAtBefore: null,
+          firstArrivedAtAfter: null,
+          lastArrivedAtAfter: null,
+          beforeObservedAt: null,
+          afterObservedAt: null,
+          observationConsistency: "unverified",
+          mutationEvidence: "unverified",
+          diagnosticDurationMs: receiptCostMs(),
+          status: "failed",
+          retryReason: reason
+        });
+      } catch {
+      }
+    };
+    try {
+      try {
+        await this.options.beforeG69AdmissionAttempt?.();
+      } catch (error) {
+        await appendFailedDiagnostic(errorText(error));
+        return;
+      }
+      const afterObservedAt = Date.now();
+      const afterResult = this.eventArrivalOps(message.serviceId, message.eventId).then((after2) => ({ after: after2, failed: false })).catch(() => ({ after: void 0, failed: true }));
+      const mutationResult = this.admissionMutationEvidence(message.serviceId, message.eventId, mutationAttemptId).then((evidence) => ({ evidence, failed: false })).catch(() => ({ evidence: "unverified", failed: true }));
+      const [{ after, failed: afterReadFailed }, { evidence: observedMutationEvidence }] = await Promise.all([afterResult, mutationResult]);
+      const status = failure !== void 0 ? "failed" : result?.outcome === "stored" ? observedMutationEvidence === "duplicate-admission" ? "duplicate" : "stored" : result?.outcome ?? "failed";
+      const finalObservationConsistency = afterReadFailed ? "after-read-failed" : after === void 0 ? "unverified" : "after-admission";
+      await appendG69AdmissionAttempt(this.database, {
+        serviceId: message.serviceId,
+        eventId: message.eventId,
+        suid: message.suid,
+        tag: message.tag,
+        deliverySource,
+        queueMessageId: attemptContext?.queueMessageId ?? null,
+        attemptId: message.attemptId,
+        allocatorLineageId: message.allocatorLineageId,
+        obligationSequence: message.completeness.obligationSequence,
+        enqueuedAt: message.enqueuedAt,
+        observedAt: afterObservedAt,
+        arrivedAt,
+        firstArrivedAtBefore: null,
+        lastArrivedAtBefore: null,
+        firstArrivedAtAfter: after?.firstArrivedAt ?? null,
+        lastArrivedAtAfter: after?.lastArrivedAt ?? null,
+        beforeObservedAt: null,
+        afterObservedAt,
+        observationConsistency: finalObservationConsistency,
+        mutationEvidence: observedMutationEvidence,
+        diagnosticDurationMs: receiptCostMs(),
+        status,
+        retryReason
+      });
+    } catch {
+    }
+  }
+  ready() {
+    if (!this.initialized) throw new Error("D1EventStore.initialize() must complete before use");
+  }
+};
+
+// src/mv/UnsafeWindowMaterializedView.ts
+var UnsafeWindowMaterializedViewError = class extends Error {
+  constructor(code, retryable, message, options) {
+    super(message, options);
+    this.code = code;
+    this.retryable = retryable;
+    this.name = "UnsafeWindowMaterializedViewError";
+  }
+  code;
+  retryable;
+};
+function compareSuid(left, right) {
+  const leftBytes = new TextEncoder().encode(left);
+  const rightBytes = new TextEncoder().encode(right);
+  for (let index = 0; index < Math.min(leftBytes.length, rightBytes.length); index += 1) {
+    const difference = leftBytes[index] - rightBytes[index];
+    if (difference !== 0) return difference;
+  }
+  return leftBytes.length - rightBytes.length;
+}
+function string(row, key) {
+  if (typeof row[key] !== "string") throw new Error(`Unsafe MV ${key} was not a string`);
+  return row[key];
+}
+function integer(row, key) {
+  const value = typeof row[key] === "number" ? row[key] : Number(row[key]);
+  if (!Number.isSafeInteger(value)) throw new Error(`Unsafe MV ${key} was not an integer`);
+  return value;
+}
+function operationId() {
+  return `mv-unsafe-${crypto.randomUUID()}`;
+}
+function errorFrom(error) {
+  const value = String(error);
+  if (value.includes("mv_unsafe_receipts") && (value.includes("UNIQUE") || value.includes("constraint"))) {
+    return new UnsafeWindowMaterializedViewError("UNSAFE_DUPLICATE_RACE", false, "Concurrent unsafe receipt was committed by another delivery", { cause: error });
+  }
+  if (value.includes("unsafe_row_cas")) return new UnsafeWindowMaterializedViewError("UNSAFE_ROW_CAS_MISMATCH", true, "Unsafe row version changed before atomic apply", { cause: error });
+  if (value.includes("unsafe_suid_contradiction")) return new UnsafeWindowMaterializedViewError("UNSAFE_SUID_CONTRADICTION", false, "Unsafe same-SUID payload contradiction", { cause: error });
+  if (value.includes("unsafe_safe_ahead")) return new UnsafeWindowMaterializedViewError("UNSAFE_SAFE_AHEAD", false, "Safe head already covers unsafe event", { cause: error });
+  if (value.includes("unsafe_behind_frontier")) return new UnsafeWindowMaterializedViewError("UNSAFE_BEHIND_FRONTIER", false, "Unsafe reads are fail-closed pending rebuild", { cause: error });
+  return void 0;
+}
+var UnsafeWindowMaterializedViewStore = class {
+  constructor(database, options = {}) {
+    this.database = database;
+    this.options = options;
+  }
+  database;
+  options;
+  /**
+   * The common row-materializer shape is one complete upsert. Keep its
+   * duplicate/order guards and all observable mutations in one D1 batch. A
+   * guard race falls back to apply(), which preserves the detailed older,
+   * duplicate, and contradiction classifications; only the uncontended fast
+   * path avoids the receipt/row pre-reads and separate arrival write.
+   */
+  async applyUpsertFast(input) {
+    const { rowUpserts, rowPatches, rowDeletes } = input.mutations;
+    if (rowUpserts.length !== 1 || rowPatches.length !== 0 || rowDeletes.length !== 0) return void 0;
+    const upsert = rowUpserts[0];
+    if (upsert.sourceSuid !== input.suid) return void 0;
+    const valueJson = JSON.stringify(assertJsonValue(upsert.value, "state-persistence"));
+    const operation = operationId();
+    const statements = [];
+    const guard = (name, predicate, values) => {
+      statements.push(this.database.prepare(
+        `INSERT INTO mv_atomic_guards (operation_id, checkpoint_match)
+         SELECT ?, CASE WHEN (${predicate}) THEN 1 ELSE NULL END`
+      ).bind(`${operation}:${name}`, ...values));
+    };
+    guard(
+      "receipt",
+      "NOT EXISTS (SELECT 1 FROM mv_unsafe_receipts WHERE service_id = ? AND view_id = ? AND event_id = ?)",
+      [input.serviceId, input.viewId, input.eventId]
+    );
+    guard("safe-head", "? = '' OR ? COLLATE BINARY < ? COLLATE BINARY", [input.safeHead, input.safeHead, input.suid]);
+    guard(
+      "row-order",
+      "NOT EXISTS (SELECT 1 FROM mv_unsafe_rows WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ? AND source_suid COLLATE BINARY > ? COLLATE BINARY)",
+      [input.serviceId, input.viewId, input.generation, upsert.rowKey, input.suid]
+    );
+    guard(
+      "same-suid",
+      "NOT EXISTS (SELECT 1 FROM mv_unsafe_rows WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ? AND source_suid COLLATE BINARY = ? COLLATE BINARY AND value_json <> ?)",
+      [input.serviceId, input.viewId, input.generation, upsert.rowKey, input.suid, valueJson]
+    );
+    if (input.expectedRowVersion !== void 0 && input.expectedRowVersion !== null) {
+      guard(
+        "row-cas",
+        "NOT EXISTS (SELECT 1 FROM mv_unsafe_rows WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?) OR EXISTS (SELECT 1 FROM mv_unsafe_rows WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ? AND row_version = ?)",
+        [
+          input.serviceId,
+          input.viewId,
+          input.generation,
+          upsert.rowKey,
+          input.serviceId,
+          input.viewId,
+          input.generation,
+          upsert.rowKey,
+          input.expectedRowVersion
+        ]
+      );
+    }
+    if (input.recordArrival === true) {
+      const behindFrontier = input.safeHead !== "" && compareSuid(input.suid, input.safeHead) <= 0;
+      statements.push(this.database.prepare(
+        `INSERT INTO mv_unsafe_arrivals
+           (service_id, view_id, generation, safe_head, arrival_watermark, behind_frontier_event_id, behind_frontier_suid, rebuild_required)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT (service_id, view_id, generation) DO UPDATE SET
+           arrival_watermark = CASE WHEN excluded.arrival_watermark COLLATE BINARY > mv_unsafe_arrivals.arrival_watermark COLLATE BINARY THEN excluded.arrival_watermark ELSE mv_unsafe_arrivals.arrival_watermark END,
+           behind_frontier_event_id = CASE WHEN mv_unsafe_arrivals.rebuild_required = 1 THEN mv_unsafe_arrivals.behind_frontier_event_id ELSE excluded.behind_frontier_event_id END,
+           behind_frontier_suid = CASE WHEN mv_unsafe_arrivals.rebuild_required = 1 THEN mv_unsafe_arrivals.behind_frontier_suid ELSE excluded.behind_frontier_suid END,
+           rebuild_required = MAX(mv_unsafe_arrivals.rebuild_required, excluded.rebuild_required)`
+      ).bind(
+        input.serviceId,
+        input.viewId,
+        input.generation,
+        input.safeHead,
+        input.suid,
+        behindFrontier ? input.eventId : null,
+        behindFrontier ? input.suid : null,
+        behindFrontier ? 1 : 0
+      ));
+    }
+    statements.push(this.database.prepare(
+      `DELETE FROM mv_unsafe_index_entries WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?`
+    ).bind(input.serviceId, input.viewId, input.generation, upsert.rowKey));
+    statements.push(this.database.prepare(
+      `INSERT INTO mv_unsafe_rows (service_id, view_id, generation, row_key, value_json, row_version, source_suid, tombstone)
+       VALUES (?, ?, ?, ?, ?, ?, ?, 0)
+       ON CONFLICT (service_id, view_id, generation, row_key) DO UPDATE SET
+         value_json = excluded.value_json, row_version = excluded.row_version, source_suid = excluded.source_suid, tombstone = 0`
+    ).bind(input.serviceId, input.viewId, input.generation, upsert.rowKey, valueJson, upsert.rowVersion, upsert.sourceSuid));
+    for (const entry of input.mutations.indexEntries) this.addIndex(statements, "mv_unsafe_index_entries", input, entry);
+    statements.push(this.database.prepare(
+      `INSERT INTO mv_unsafe_receipts (service_id, view_id, event_id, suid, outcome, observed_at)
+       VALUES (?, ?, ?, ?, 'applied', ?)`
+    ).bind(input.serviceId, input.viewId, input.eventId, input.suid, input.updatedAt));
+    statements.push(this.database.prepare(
+      `INSERT INTO mv_wait_receipts
+         (service_id, view_id, generation, definition_version, event_id, suid, observed_at)
+       SELECT ?, ?, ?, instance.definition_version, ?, ?, ?
+         FROM mv_instances instance
+         JOIN mv_active_generations active
+           ON active.service_id = instance.service_id
+          AND active.view_id = instance.view_id
+          AND active.generation = instance.generation
+        WHERE instance.service_id = ? AND instance.view_id = ? AND instance.generation = ?
+       ON CONFLICT DO NOTHING`
+    ).bind(
+      input.serviceId,
+      input.viewId,
+      input.generation,
+      input.eventId,
+      input.suid,
+      input.updatedAt,
+      input.serviceId,
+      input.viewId,
+      input.generation
+    ));
+    statements.push(this.database.prepare(
+      `INSERT INTO mv_unsafe_kicks (service_id, view_id, target_suid, dirty)
+       VALUES (?, ?, ?, 1)
+       ON CONFLICT (service_id, view_id) DO UPDATE SET
+         target_suid = CASE WHEN excluded.target_suid COLLATE BINARY > mv_unsafe_kicks.target_suid COLLATE BINARY THEN excluded.target_suid ELSE mv_unsafe_kicks.target_suid END,
+         dirty = 1`
+    ).bind(input.serviceId, input.viewId, input.targetSuid ?? input.suid));
+    statements.push(this.database.prepare("DELETE FROM mv_atomic_guards WHERE operation_id LIKE ?").bind(`${operation}:%`));
+    await this.options.beforeApplyBatch?.(input, statements);
+    try {
+      await this.database.batch(statements);
+    } catch (error) {
+      const text = String(error);
+      const guardFailure = text.includes("mv_atomic_guards") || text.includes("checkpoint_match") || text.includes("mv_unsafe_receipts") && (text.includes("UNIQUE") || text.includes("constraint"));
+      if (guardFailure) {
+        const receipt = await this.database.prepare(
+          `SELECT suid FROM mv_unsafe_receipts WHERE service_id = ? AND view_id = ? AND event_id = ? ORDER BY observed_at DESC LIMIT 1`
+        ).bind(input.serviceId, input.viewId, input.eventId).first();
+        if (receipt !== null && receipt !== void 0) {
+          if (string(receipt, "suid") !== input.suid) {
+            throw new UnsafeWindowMaterializedViewError("UNSAFE_SUID_CONTRADICTION", false, "Duplicate event identity has a contradictory SUID", { cause: error });
+          }
+          if (this.options.beforeApplyBatch !== void 0) {
+            throw new UnsafeWindowMaterializedViewError("UNSAFE_DUPLICATE_RACE", false, "Concurrent unsafe receipt was committed by another delivery", { cause: error });
+          }
+          return { outcome: "no-change", duplicate: true };
+        }
+        return this.apply(input, true);
+      }
+      throw error;
+    }
+    const result = { outcome: "applied", duplicate: false };
+    await this.options.afterApplyBatch?.(input, result);
+    return result;
+  }
+  async apply(input, skipFastPath = false) {
+    assertSortableUniqueId(input.suid);
+    if (input.safeHead.length > 0) assertSortableUniqueId(input.safeHead);
+    if (input.targetSuid !== void 0) assertSortableUniqueId(input.targetSuid);
+    for (const mutation of [...input.mutations.rowUpserts, ...input.mutations.rowPatches]) {
+      assertSortableUniqueId(mutation.sourceSuid);
+    }
+    const fast = skipFastPath ? void 0 : await this.applyUpsertFast(input);
+    if (fast !== void 0) return fast;
+    if (input.recordArrival === true) await this.observeArrival(input.serviceId, input.viewId, input.generation, input.eventId, input.suid);
+    const receipt = await this.database.prepare(
+      `SELECT suid FROM mv_unsafe_receipts WHERE service_id = ? AND view_id = ? AND event_id = ? ORDER BY observed_at DESC LIMIT 1`
+    ).bind(input.serviceId, input.viewId, input.eventId).first();
+    if (receipt !== null && receipt !== void 0) {
+      if (string(receipt, "suid") !== input.suid) {
+        throw new UnsafeWindowMaterializedViewError("UNSAFE_SUID_CONTRADICTION", false, "Duplicate event identity has a contradictory SUID");
+      }
+      return { outcome: "no-change", duplicate: true };
+    }
+    const rowKeys = [.../* @__PURE__ */ new Set([
+      ...input.mutations.rowUpserts.map((row) => row.rowKey),
+      ...input.mutations.rowPatches.map((row) => row.rowKey),
+      ...input.mutations.rowDeletes.map((row) => row.rowKey)
+    ])];
+    const existing = /* @__PURE__ */ new Map();
+    for (const rowKey of rowKeys) {
+      const row = await this.database.prepare(
+        `SELECT row_key, value_json, row_version, source_suid FROM mv_unsafe_rows
+          WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?`
+      ).bind(input.serviceId, input.viewId, input.generation, rowKey).first();
+      if (row !== null && row !== void 0) existing.set(rowKey, row);
+    }
+    const older = [...existing.values()].some((row) => compareSuid(string(row, "source_suid"), input.suid) > 0);
+    const noRowForPatch = input.mutations.rowPatches.some((patch) => !existing.has(patch.rowKey));
+    const deleteWithoutRow = input.mutations.rowDeletes.some((row) => !existing.has(row.rowKey));
+    const outcome = older ? "older" : noRowForPatch ? "patch-not-found" : deleteWithoutRow ? "delete-without-row" : input.mutations.rowUpserts.length + input.mutations.rowPatches.length + input.mutations.rowDeletes.length === 0 ? "no-change" : "applied";
+    const operation = operationId();
+    const statements = [];
+    const safeAhead = input.safeHead !== "" && compareSuid(input.safeHead, input.suid) >= 0;
+    let rowCasMismatch = false;
+    let sameSuidContradiction = false;
+    const guard = (name, predicate, values) => {
+      statements.push(this.database.prepare(
+        `INSERT INTO mv_atomic_guards (operation_id, checkpoint_match)
+         SELECT ?, CASE WHEN (${predicate}) THEN 1 ELSE NULL END`
+      ).bind(`${operation}:${name}`, ...values));
+    };
+    guard("unsafe_safe_ahead", "? = '' OR ? COLLATE BINARY < ? COLLATE BINARY", [input.safeHead, input.safeHead, input.suid]);
+    for (const [rowKey, row] of existing) {
+      if (input.expectedRowVersion !== void 0 && input.expectedRowVersion !== null) {
+        rowCasMismatch ||= integer(row, "row_version") !== input.expectedRowVersion;
+        guard("unsafe_row_cas", "? = ?", [integer(row, "row_version"), input.expectedRowVersion]);
+      }
+      const upsert = input.mutations.rowUpserts.find((candidate) => candidate.rowKey === rowKey);
+      if (upsert !== void 0 && string(row, "source_suid") === input.suid && string(row, "value_json") !== JSON.stringify(assertJsonValue(upsert.value, "state-persistence"))) {
+        sameSuidContradiction = true;
+        guard("unsafe_suid_contradiction", "0", []);
+      }
+    }
+    if (!older && outcome === "applied") {
+      for (const deletion of input.mutations.rowDeletes) {
+        statements.push(this.database.prepare(`DELETE FROM mv_unsafe_index_entries WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?`).bind(input.serviceId, input.viewId, input.generation, deletion.rowKey));
+        statements.push(this.database.prepare(`DELETE FROM mv_unsafe_rows WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?`).bind(input.serviceId, input.viewId, input.generation, deletion.rowKey));
+      }
+      for (const upsert of input.mutations.rowUpserts) {
+        statements.push(this.database.prepare(`DELETE FROM mv_unsafe_index_entries WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?`).bind(input.serviceId, input.viewId, input.generation, upsert.rowKey));
+        statements.push(this.database.prepare(
+          `INSERT INTO mv_unsafe_rows (service_id, view_id, generation, row_key, value_json, row_version, source_suid, tombstone)
+           VALUES (?, ?, ?, ?, ?, ?, ?, 0)
+           ON CONFLICT (service_id, view_id, generation, row_key) DO UPDATE SET
+             value_json = excluded.value_json, row_version = excluded.row_version, source_suid = excluded.source_suid, tombstone = 0`
+        ).bind(input.serviceId, input.viewId, input.generation, upsert.rowKey, JSON.stringify(assertJsonValue(upsert.value, "state-persistence")), upsert.rowVersion, upsert.sourceSuid));
+      }
+      for (const patch of input.mutations.rowPatches) {
+        statements.push(this.database.prepare(
+          `UPDATE mv_unsafe_rows SET value_json = json_patch(value_json, ?), row_version = ?, source_suid = ?, tombstone = 0
+            WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?`
+        ).bind(JSON.stringify(assertJsonValue(patch.patch, "state-persistence")), patch.rowVersion, patch.sourceSuid, input.serviceId, input.viewId, input.generation, patch.rowKey));
+      }
+      for (const entry of input.mutations.indexEntries) this.addIndex(statements, "mv_unsafe_index_entries", input, entry);
+      for (const patch of input.mutations.rowPatches) for (const entry of patch.indexEntries) this.addIndex(statements, "mv_unsafe_index_entries", input, entry);
+    }
+    const markerReason = outcome === "applied" ? void 0 : outcome;
+    if (markerReason !== void 0) {
+      for (const rowKey of rowKeys.length === 0 ? [input.eventId] : rowKeys) {
+        statements.push(this.database.prepare(
+          `INSERT INTO mv_unsafe_markers (service_id, view_id, generation, row_key, event_id, suid, reason)
+           VALUES (?, ?, ?, ?, ?, ?, ?) ON CONFLICT DO NOTHING`
+        ).bind(input.serviceId, input.viewId, input.generation, rowKey, input.eventId, input.suid, markerReason));
+      }
+    }
+    statements.push(this.database.prepare(
+      `INSERT INTO mv_unsafe_receipts (service_id, view_id, event_id, suid, outcome, observed_at) VALUES (?, ?, ?, ?, ?, ?)`
+    ).bind(input.serviceId, input.viewId, input.eventId, input.suid, outcome, input.updatedAt));
+    statements.push(this.database.prepare(
+      `INSERT INTO mv_wait_receipts
+         (service_id, view_id, generation, definition_version, event_id, suid, observed_at)
+       SELECT ?, ?, ?, instance.definition_version, ?, ?, ?
+         FROM mv_instances instance
+         JOIN mv_active_generations active
+           ON active.service_id = instance.service_id
+          AND active.view_id = instance.view_id
+          AND active.generation = instance.generation
+        WHERE instance.service_id = ? AND instance.view_id = ? AND instance.generation = ?
+       ON CONFLICT DO NOTHING`
+    ).bind(
+      input.serviceId,
+      input.viewId,
+      input.generation,
+      input.eventId,
+      input.suid,
+      input.updatedAt,
+      input.serviceId,
+      input.viewId,
+      input.generation
+    ));
+    statements.push(this.database.prepare(
+      `INSERT INTO mv_unsafe_kicks (service_id, view_id, target_suid, dirty)
+       VALUES (?, ?, ?, 1)
+       ON CONFLICT (service_id, view_id) DO UPDATE SET
+         target_suid = CASE WHEN excluded.target_suid COLLATE BINARY > mv_unsafe_kicks.target_suid COLLATE BINARY THEN excluded.target_suid ELSE mv_unsafe_kicks.target_suid END,
+         dirty = 1`
+    ).bind(input.serviceId, input.viewId, input.targetSuid ?? input.suid));
+    statements.push(this.database.prepare("DELETE FROM mv_atomic_guards WHERE operation_id LIKE ?").bind(`${operation}:%`));
+    await this.options.beforeApplyBatch?.(input, statements);
+    try {
+      await this.database.batch(statements);
+    } catch (error) {
+      if (sameSuidContradiction) throw new UnsafeWindowMaterializedViewError("UNSAFE_SUID_CONTRADICTION", false, "Unsafe same-SUID payload contradiction", { cause: error });
+      if (rowCasMismatch) throw new UnsafeWindowMaterializedViewError("UNSAFE_ROW_CAS_MISMATCH", true, "Unsafe row version changed before atomic apply", { cause: error });
+      if (safeAhead) throw new UnsafeWindowMaterializedViewError("UNSAFE_SAFE_AHEAD", false, "Safe head already covers unsafe event", { cause: error });
+      const typed = errorFrom(error);
+      if (typed !== void 0) throw typed;
+      throw error;
+    }
+    const result = { outcome, duplicate: false };
+    await this.options.afterApplyBatch?.(input, result);
+    return result;
+  }
+  /** Advance safe head and remove markers only if this transaction observed its exact receipt. */
+  async observeSafeReceipt(serviceId, viewId, generation, eventId, suid) {
+    assertSortableUniqueId(suid);
+    const operation = operationId();
+    await this.database.batch([
+      this.database.prepare(
+        `INSERT INTO mv_atomic_guards (operation_id, checkpoint_match)
+         SELECT ?, CASE WHEN EXISTS (SELECT 1 FROM mv_unsafe_receipts WHERE service_id = ? AND view_id = ? AND event_id = ? AND suid = ?) THEN 1 ELSE NULL END`
+      ).bind(operation, serviceId, viewId, eventId, suid),
+      this.database.prepare(
+        `INSERT INTO mv_unsafe_arrivals (service_id, view_id, generation, safe_head, arrival_watermark)
+         VALUES (?, ?, ?, ?, ?)
+         ON CONFLICT (service_id, view_id, generation) DO UPDATE SET safe_head = excluded.safe_head`
+      ).bind(serviceId, viewId, generation, suid, suid),
+      this.database.prepare(`DELETE FROM mv_unsafe_markers WHERE service_id = ? AND view_id = ? AND generation = ? AND event_id = ? AND suid = ?`).bind(serviceId, viewId, generation, eventId, suid),
+      this.database.prepare("DELETE FROM mv_atomic_guards WHERE operation_id = ?").bind(operation)
+    ]);
+  }
+  /** Detects late first-arrivals independently of SafeWindow and fail-closes reads. */
+  async observeArrival(serviceId, viewId, generation, eventId, suid) {
+    assertSortableUniqueId(suid);
+    const existing = await this.database.prepare(
+      `SELECT safe_head, arrival_watermark FROM mv_unsafe_arrivals WHERE service_id = ? AND view_id = ? AND generation = ?`
+    ).bind(serviceId, viewId, generation).first();
+    const safeHead = existing === null || existing === void 0 ? "" : string(existing, "safe_head");
+    const behind = safeHead !== "" && compareSuid(suid, safeHead) <= 0;
+    await this.database.prepare(
+      `INSERT INTO mv_unsafe_arrivals (service_id, view_id, generation, safe_head, arrival_watermark, behind_frontier_event_id, behind_frontier_suid, rebuild_required)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT (service_id, view_id, generation) DO UPDATE SET
+         arrival_watermark = CASE WHEN excluded.arrival_watermark COLLATE BINARY > mv_unsafe_arrivals.arrival_watermark COLLATE BINARY THEN excluded.arrival_watermark ELSE mv_unsafe_arrivals.arrival_watermark END,
+         behind_frontier_event_id = CASE WHEN mv_unsafe_arrivals.rebuild_required = 1 THEN mv_unsafe_arrivals.behind_frontier_event_id ELSE excluded.behind_frontier_event_id END,
+         behind_frontier_suid = CASE WHEN mv_unsafe_arrivals.rebuild_required = 1 THEN mv_unsafe_arrivals.behind_frontier_suid ELSE excluded.behind_frontier_suid END,
+         rebuild_required = MAX(mv_unsafe_arrivals.rebuild_required, excluded.rebuild_required)`
+    ).bind(serviceId, viewId, generation, safeHead, suid, behind ? eventId : null, behind ? suid : null, behind ? 1 : 0).run();
+    return behind;
+  }
+  async readMeta(serviceId, viewId, generation) {
+    const arrival = await this.database.prepare(`SELECT safe_head, rebuild_required FROM mv_unsafe_arrivals WHERE service_id = ? AND view_id = ? AND generation = ?`).bind(serviceId, viewId, generation).first();
+    const row = await this.database.prepare(`SELECT COALESCE(MAX(suid), '') AS max_suid FROM mv_unsafe_receipts WHERE service_id = ? AND view_id = ?`).bind(serviceId, viewId).first();
+    return {
+      safeContiguousHead: arrival === null || arrival === void 0 ? "" : string(arrival, "safe_head"),
+      unsafeObservedMaxSuid: row === null || row === void 0 ? "" : string(row, "max_suid"),
+      rebuildRequired: arrival !== null && arrival !== void 0 && integer(arrival, "rebuild_required") === 1
+    };
+  }
+  async hasTargetReceipt(serviceId, viewId, eventId, suid) {
+    const receipt = await this.database.prepare(`SELECT 1 FROM mv_unsafe_receipts WHERE service_id = ? AND view_id = ? AND event_id = ? AND suid = ?`).bind(serviceId, viewId, eventId, suid).first();
+    return receipt !== null && receipt !== void 0;
+  }
+  async acquireKick(serviceId, viewId, owner, nowMs, leaseMs) {
+    const operation = operationId();
+    try {
+      await this.database.batch([
+        this.database.prepare(
+          `INSERT INTO mv_atomic_guards (operation_id, checkpoint_match)
+           SELECT ?, CASE WHEN EXISTS (SELECT 1 FROM mv_unsafe_kicks WHERE service_id = ? AND view_id = ? AND dirty = 1 AND (lease_owner IS NULL OR lease_until <= ? OR lease_owner = ?)) THEN 1 ELSE NULL END`
+        ).bind(operation, serviceId, viewId, nowMs, owner),
+        this.database.prepare(`UPDATE mv_unsafe_kicks SET lease_owner = ?, lease_until = ?, dirty = 0 WHERE service_id = ? AND view_id = ?`).bind(owner, nowMs + leaseMs, serviceId, viewId),
+        this.database.prepare("DELETE FROM mv_atomic_guards WHERE operation_id = ?").bind(operation)
+      ]);
+    } catch (error) {
+      throw new UnsafeWindowMaterializedViewError("UNSAFE_KICK_LEASE_HELD", true, "Unsafe kick is held by another lease owner", { cause: error });
+    }
+    const row = await this.database.prepare(`SELECT target_suid, dirty FROM mv_unsafe_kicks WHERE service_id = ? AND view_id = ?`).bind(serviceId, viewId).first();
+    return row === null || row === void 0 ? void 0 : { targetSuid: string(row, "target_suid"), dirty: integer(row, "dirty") === 1 };
+  }
+  /**
+   * Settle an unsafe kick at the checkpoint actually reached by its follow.
+   * A first-unsafe return is a successful bounded pass, not proof that the
+   * lease target was reached.  When a reached checkpoint is supplied, keep the
+   * durable dirty bit set if the target remains ahead so the next scheduled
+   * tick can acquire the kick again.  Requiring this checkpoint keeps every
+   * production settlement honest about whether its target was reached.
+   */
+  async finishKick(serviceId, viewId, owner, reachedSuid) {
+    if (reachedSuid.length > 0) assertSortableUniqueId(reachedSuid);
+    const result = await this.database.prepare(
+      `UPDATE mv_unsafe_kicks
+          SET lease_owner = NULL,
+              lease_until = 0,
+              dirty = CASE
+                WHEN ? IS NOT NULL AND target_suid COLLATE BINARY > ? COLLATE BINARY THEN 1
+                ELSE 0
+              END
+        WHERE service_id = ? AND view_id = ? AND lease_owner = ? AND dirty = 0`
+    ).bind(reachedSuid, reachedSuid, serviceId, viewId, owner).run();
+    return result.meta.changes === 1;
+  }
+  /**
+   * Collect a repairable unsafe row only when every recovery predicate holds.
+   * Every predicate is a constraint-promotion guard ahead of the deletes; a
+   * rejected GC therefore cannot leak a partially removed index/receipt.
+   */
+  async garbageCollect(input) {
+    const operation = operationId();
+    const statements = [
+      // safeHead >= row source, including the mandatory post-GC resurrection fence.
+      this.database.prepare(`INSERT INTO mv_atomic_guards (operation_id, checkpoint_match) SELECT ?, CASE WHEN ? COLLATE BINARY >= ? COLLATE BINARY THEN 1 ELSE NULL END`).bind(`${operation}:safe-head`, input.safeHead, input.expectedSourceSuid),
+      // Arrival receipt/watermark is a separate condition from the
+      // fail-closed detector state; each has its own in-batch guard.
+      this.database.prepare(
+        `INSERT INTO mv_atomic_guards (operation_id, checkpoint_match)
+         SELECT ?, CASE WHEN EXISTS (SELECT 1 FROM mv_unsafe_arrivals WHERE service_id = ? AND view_id = ? AND generation = ? AND arrival_watermark COLLATE BINARY >= ? COLLATE BINARY) THEN 1 ELSE NULL END`
+      ).bind(`${operation}:arrival`, input.serviceId, input.viewId, input.generation, input.expectedSourceSuid),
+      this.database.prepare(
+        `INSERT INTO mv_atomic_guards (operation_id, checkpoint_match)
+         SELECT ?, CASE WHEN EXISTS (SELECT 1 FROM mv_unsafe_arrivals WHERE service_id = ? AND view_id = ? AND generation = ? AND rebuild_required = 0) THEN 1 ELSE NULL END`
+      ).bind(`${operation}:frontier`, input.serviceId, input.viewId, input.generation),
+      // Candidate/retired generations and changed materializer definitions are
+      // never GC targets.  These are intentionally separate guards so a
+      // definition mutation cannot piggy-back on an active-generation check.
+      this.database.prepare(
+        `INSERT INTO mv_atomic_guards (operation_id, checkpoint_match)
+         SELECT ?, CASE WHEN EXISTS (SELECT 1 FROM mv_active_generations WHERE service_id = ? AND view_id = ? AND generation = ?) THEN 1 ELSE NULL END`
+      ).bind(`${operation}:active-generation`, input.serviceId, input.viewId, input.generation),
+      this.database.prepare(
+        `INSERT INTO mv_atomic_guards (operation_id, checkpoint_match)
+         SELECT ?, CASE WHEN EXISTS (SELECT 1 FROM mv_instances WHERE service_id = ? AND view_id = ? AND generation = ? AND definition_version = ?) THEN 1 ELSE NULL END`
+      ).bind(`${operation}:definition`, input.serviceId, input.viewId, input.generation, input.definitionVersion),
+      // Compare-and-delete is revalidated inside the atomic batch, never on a
+      // read-then-delete snapshot.
+      this.database.prepare(
+        `INSERT INTO mv_atomic_guards (operation_id, checkpoint_match)
+         SELECT ?, CASE WHEN EXISTS (SELECT 1 FROM mv_unsafe_rows WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ? AND row_version = ? AND source_suid COLLATE BINARY = ? COLLATE BINARY) THEN 1 ELSE NULL END`
+      ).bind(`${operation}:row`, input.serviceId, input.viewId, input.generation, input.rowKey, input.expectedRowVersion, input.expectedSourceSuid),
+      this.database.prepare(`DELETE FROM mv_unsafe_index_entries WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?`).bind(input.serviceId, input.viewId, input.generation, input.rowKey),
+      this.database.prepare(`DELETE FROM mv_unsafe_markers WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?`).bind(input.serviceId, input.viewId, input.generation, input.rowKey),
+      this.database.prepare(`DELETE FROM mv_unsafe_receipts WHERE service_id = ? AND view_id = ? AND suid = ?`).bind(input.serviceId, input.viewId, input.expectedSourceSuid),
+      this.database.prepare(`DELETE FROM mv_wait_receipts WHERE service_id = ? AND view_id = ? AND generation = ? AND suid = ?`).bind(input.serviceId, input.viewId, input.generation, input.expectedSourceSuid),
+      this.database.prepare(`DELETE FROM mv_unsafe_rows WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ? AND row_version = ? AND source_suid COLLATE BINARY = ? COLLATE BINARY`).bind(input.serviceId, input.viewId, input.generation, input.rowKey, input.expectedRowVersion, input.expectedSourceSuid),
+      this.database.prepare("DELETE FROM mv_atomic_guards WHERE operation_id LIKE ?").bind(`${operation}:%`)
+    ];
+    try {
+      await this.database.batch(statements);
+      return true;
+    } catch (error) {
+      if (String(error).includes("mv_atomic_guards") || String(error).includes("checkpoint_match")) return false;
+      throw error;
+    }
+  }
+  /**
+   * Idle catch-up calls this after it has advanced (or observed) the safe
+   * checkpoint.  Candidates are deliberately rechecked by garbageCollect;
+   * this read is only work selection, never permission to delete.
+   */
+  async collectEligible(serviceId, viewId, generation, definitionVersion, safeHead) {
+    if (safeHead === "") return 0;
+    const candidates = await this.database.prepare(
+      `SELECT row_key, row_version, source_suid FROM mv_unsafe_rows
+        WHERE service_id = ? AND view_id = ? AND generation = ?
+          AND source_suid COLLATE BINARY <= ? COLLATE BINARY
+        ORDER BY source_suid COLLATE BINARY ASC, row_key COLLATE BINARY ASC`
+    ).bind(serviceId, viewId, generation, safeHead).all();
+    let collected = 0;
+    for (const row of candidates.results) {
+      const candidate = {
+        rowKey: string(row, "row_key"),
+        rowVersion: integer(row, "row_version"),
+        sourceSuid: string(row, "source_suid")
+      };
+      if (await this.garbageCollect({
+        serviceId,
+        viewId,
+        generation,
+        definitionVersion,
+        rowKey: candidate.rowKey,
+        expectedRowVersion: candidate.rowVersion,
+        expectedSourceSuid: candidate.sourceSuid,
+        safeHead
+      })) collected += 1;
+    }
+    return collected;
+  }
+  async queryComposedPage(serviceId, viewId, generation, limit, offset, descending = false) {
+    const meta = await this.readMeta(serviceId, viewId, generation);
+    if (meta.rebuildRequired) throw new UnsafeWindowMaterializedViewError("UNSAFE_BEHIND_FRONTIER", false, "Unsafe window is rebuilding after a behind-frontier arrival");
+    const direction = descending ? "DESC" : "ASC";
+    const result = await this.database.prepare(
+      `WITH candidates AS (
+         SELECT row_key, value_json, row_version, source_suid, 0 AS tombstone, 0 AS unsafe_layer FROM mv_rows
+          WHERE service_id = ? AND view_id = ? AND generation = ?
+         UNION ALL
+         SELECT row_key, value_json, row_version, source_suid, tombstone, 1 AS unsafe_layer FROM mv_unsafe_rows
+          WHERE service_id = ? AND view_id = ? AND generation = ?
+       ), ranked AS (
+         SELECT *, ROW_NUMBER() OVER (PARTITION BY row_key ORDER BY source_suid COLLATE BINARY DESC, unsafe_layer ASC) AS winner_rank FROM candidates
+       ), live AS (
+         SELECT *, COUNT(*) OVER() AS total_count FROM ranked WHERE winner_rank = 1 AND tombstone = 0
+       )
+       SELECT row_key, value_json, row_version, source_suid, total_count FROM live
+       ORDER BY source_suid COLLATE BINARY ${direction}, row_key COLLATE BINARY ${direction} LIMIT ? OFFSET ?`
+    ).bind(serviceId, viewId, generation, serviceId, viewId, generation, limit, offset).all();
+    const rows = result.results.map((row) => ({
+      serviceId,
+      viewId,
+      generation,
+      rowKey: string(row, "row_key"),
+      value: assertJsonValue(JSON.parse(string(row, "value_json")), "state-persistence"),
+      rowVersion: integer(row, "row_version"),
+      sourceSuid: string(row, "source_suid")
+    }));
+    return { rows, totalCount: result.results.length === 0 ? 0 : integer(result.results[0], "total_count") };
+  }
+  addIndex(statements, table, input, entry) {
+    const typed = entry.valueType === "text" ? [entry.value, null, null] : entry.valueType === "integer" ? [null, entry.value, null] : [null, null, entry.value];
+    statements.push(this.database.prepare(
+      `INSERT INTO ${table} (service_id, view_id, generation, index_id, value_type, text_value, integer_value, real_value, row_key)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT DO NOTHING`
+    ).bind(input.serviceId, input.viewId, input.generation, entry.indexId, entry.valueType, ...typed, entry.rowKey));
+  }
+};
+
+// src/mv/MaterializedViewStore.ts
+var MaterializedViewStoreError = class extends Error {
+  constructor(operation, code, message, options) {
+    super(message, options);
+    this.operation = operation;
+    this.code = code;
+    this.name = "MaterializedViewStoreError";
+  }
+  operation;
+  code;
+};
+var MaterializedViewCasError = class extends MaterializedViewStoreError {
+  constructor(message = "Materialized-view checkpoint CAS did not match") {
+    super("apply", "MV_CAS_MISMATCH", message);
+    this.name = "MaterializedViewCasError";
+  }
+};
+var MaterializedViewPromotionCasError = class extends MaterializedViewStoreError {
+  constructor(message = "Materialized-view active-generation CAS did not match") {
+    super("promote", "MV_PROMOTION_CAS_MISMATCH", message);
+    this.name = "MaterializedViewPromotionCasError";
+  }
+};
+var MaterializedViewPatchError = class extends MaterializedViewStoreError {
+  constructor(message = "Materialized-view JSON patch target row does not exist") {
+    super("apply", "MV_PATCH_ROW_MISSING", message);
+    this.name = "MaterializedViewPatchError";
+  }
+};
+function asString2(value, name) {
+  if (typeof value !== "string") throw new Error(`MV ${name} was not a string`);
+  return value;
+}
+function asInteger(value, name) {
+  const number = typeof value === "number" ? value : Number(value);
+  if (!Number.isSafeInteger(number)) throw new Error(`MV ${name} was not a safe integer`);
+  return number;
+}
+function asStatus(value) {
+  if (value === "active" || value === "candidate" || value === "retired") return value;
+  throw new Error("MV instance status was invalid");
+}
+function compareSuid2(left, right) {
+  const leftBytes = new TextEncoder().encode(left);
+  const rightBytes = new TextEncoder().encode(right);
+  for (let index = 0; index < Math.min(leftBytes.length, rightBytes.length); index += 1) {
+    const difference = leftBytes[index] - rightBytes[index];
+    if (difference !== 0) return difference;
+  }
+  return leftBytes.length - rightBytes.length;
+}
+function maxReflectedSuid(rows) {
+  let maximum = "";
+  for (const row of rows) {
+    if (maximum === "" || compareSuid2(row.sourceSuid, maximum) > 0) maximum = row.sourceSuid;
+  }
+  return maximum;
+}
+function instanceFrom(row) {
+  return {
+    serviceId: asString2(row.service_id, "service_id"),
+    viewId: asString2(row.view_id, "view_id"),
+    generation: asInteger(row.generation, "generation"),
+    status: asStatus(row.status),
+    lastSuid: asString2(row.last_suid, "last_suid"),
+    definitionVersion: asInteger(row.definition_version, "definition_version"),
+    updatedAt: asInteger(row.updated_at, "updated_at"),
+    rebuildVerifiedAt: row.rebuild_verified_at === null || row.rebuild_verified_at === void 0 ? null : asInteger(row.rebuild_verified_at, "rebuild_verified_at"),
+    rebuildRecoveryId: row.rebuild_recovery_id === null || row.rebuild_recovery_id === void 0 ? null : asString2(row.rebuild_recovery_id, "rebuild_recovery_id"),
+    rebuildIncidentIdentity: row.rebuild_incident_identity === null || row.rebuild_incident_identity === void 0 ? null : asString2(row.rebuild_incident_identity, "rebuild_incident_identity"),
+    rebuildIncidentGeneration: row.rebuild_incident_generation === null || row.rebuild_incident_generation === void 0 ? null : asInteger(row.rebuild_incident_generation, "rebuild_incident_generation"),
+    rebuildSourceEventCount: row.rebuild_source_event_count === null || row.rebuild_source_event_count === void 0 ? null : asInteger(row.rebuild_source_event_count, "rebuild_source_event_count"),
+    rebuildSourceMaxSuid: row.rebuild_source_max_suid === null || row.rebuild_source_max_suid === void 0 ? null : asString2(row.rebuild_source_max_suid, "rebuild_source_max_suid"),
+    rebuildSourceHistoryDigest: row.rebuild_source_history_digest === null || row.rebuild_source_history_digest === void 0 ? null : asString2(row.rebuild_source_history_digest, "rebuild_source_history_digest")
+  };
+}
+function valueType(value) {
+  if (value === "text" || value === "integer" || value === "real") return value;
+  throw new Error("MV index value type was invalid");
+}
+function indexValue(row, type) {
+  if (type === "text") return asString2(row.text_value, "text_value");
+  const number = typeof row[`${type}_value`] === "number" ? row[`${type}_value`] : Number(row[`${type}_value`]);
+  if (!Number.isFinite(number) || type === "integer" && !Number.isSafeInteger(number)) {
+    throw new Error(`MV ${type}_value was invalid`);
+  }
+  return number;
+}
+function operationId2() {
+  return `mv-${crypto.randomUUID()}`;
+}
+function isCasFailure(error) {
+  const message = String(error);
+  return message.includes("mv_atomic_guards.checkpoint_match") || message.includes("MV_CAS_MISMATCH");
+}
+function isPatchFailure(error) {
+  return String(error).includes("CHECK constraint failed: checkpoint_match");
+}
+var D1MaterializedViewStore = class {
+  constructor(database) {
+    this.database = database;
+    this.unsafe = new UnsafeWindowMaterializedViewStore(database);
+  }
+  database;
+  initialized = false;
+  unsafe;
+  async initialize() {
+    if (this.initialized) return;
+    await this.database.prepare("SELECT 1 FROM mv_instances LIMIT 1").all();
+    await this.database.prepare("SELECT 1 FROM mv_atomic_guards LIMIT 1").all();
+    await this.database.prepare("SELECT 1 FROM mv_checkpoint_ahead_findings LIMIT 1").all();
+    await this.database.prepare("SELECT 1 FROM mv_ordering_quarantines LIMIT 1").all();
+    this.initialized = true;
+  }
+  async createActive(input) {
+    this.ready("create-active");
+    const generation = input.generation ?? 0;
+    this.validateGeneration(generation, "create-active");
+    const lastSuid = input.lastSuid ?? "";
+    if (lastSuid.length > 0) assertSortableUniqueId(lastSuid);
+    try {
+      await this.database.batch([
+        this.database.prepare(
+          `INSERT INTO mv_instances
+             (service_id, view_id, generation, status, last_suid, definition_version, updated_at)
+           VALUES (?, ?, ?, 'active', ?, ?, ?)`
+        ).bind(input.serviceId, input.viewId, generation, lastSuid, input.definitionVersion, input.updatedAt),
+        this.database.prepare(
+          `INSERT INTO mv_active_generations (service_id, view_id, generation, updated_at)
+           VALUES (?, ?, ?, ?)`
+        ).bind(input.serviceId, input.viewId, generation, input.updatedAt)
+      ]);
+    } catch (error) {
+      throw new MaterializedViewStoreError("create-active", "MV_INSTANCE_EXISTS", `Active materialized view already exists: ${String(error)}`, { cause: error });
+    }
+    return this.readInstance(input.serviceId, input.viewId, generation);
+  }
+  async createCandidate(input) {
+    this.ready("create-candidate");
+    this.validateGeneration(input.generation, "create-candidate");
+    if ((input.lastSuid ?? "").length > 0) assertSortableUniqueId(input.lastSuid);
+    try {
+      await this.database.prepare(
+        `INSERT INTO mv_instances
+           (service_id, view_id, generation, status, last_suid, definition_version, updated_at)
+         VALUES (?, ?, ?, 'candidate', ?, ?, ?)`
+      ).bind(
+        input.serviceId,
+        input.viewId,
+        input.generation,
+        input.lastSuid ?? "",
+        input.definitionVersion,
+        input.updatedAt
+      ).run();
+    } catch (error) {
+      throw new MaterializedViewStoreError("create-candidate", "MV_INSTANCE_EXISTS", `Candidate generation already exists: ${String(error)}`, { cause: error });
+    }
+    return this.readInstance(input.serviceId, input.viewId, input.generation);
+  }
+  async beginRebuild(input) {
+    this.ready("create-candidate");
+    const generation = input.generation ?? await this.nextGeneration(input.serviceId, input.viewId);
+    return this.createCandidate({ ...input, generation });
+  }
+  async nextGeneration(serviceId, viewId) {
+    this.ready("create-candidate");
+    const row = await this.database.prepare(
+      `SELECT COALESCE(MAX(generation), -1) AS generation FROM mv_instances WHERE service_id = ? AND view_id = ?`
+    ).bind(serviceId, viewId).first();
+    return asInteger(row?.generation ?? -1, "generation") + 1;
+  }
+  async readInstance(serviceId, viewId, generation) {
+    this.ready("initialize");
+    const row = await this.database.prepare(
+      `SELECT service_id, view_id, generation, status, last_suid, definition_version, updated_at,
+              rebuild_verified_at, rebuild_recovery_id, rebuild_incident_identity,
+              rebuild_incident_generation, rebuild_source_event_count,
+              rebuild_source_max_suid, rebuild_source_history_digest
+         FROM mv_instances WHERE service_id = ? AND view_id = ? AND generation = ?`
+    ).bind(serviceId, viewId, generation).first();
+    return row === null || row === void 0 ? void 0 : instanceFrom(row);
+  }
+  async readActive(serviceId, viewId) {
+    this.ready("initialize");
+    const row = await this.database.prepare(
+      `SELECT instance.service_id, instance.view_id, instance.generation, instance.status,
+              instance.last_suid, instance.definition_version, instance.updated_at,
+              instance.rebuild_verified_at, instance.rebuild_recovery_id,
+              instance.rebuild_incident_identity, instance.rebuild_incident_generation,
+              instance.rebuild_source_event_count, instance.rebuild_source_max_suid,
+              instance.rebuild_source_history_digest
+         FROM mv_active_generations pointer
+         JOIN mv_instances instance
+           ON instance.service_id = pointer.service_id
+          AND instance.view_id = pointer.view_id
+          AND instance.generation = pointer.generation
+        WHERE pointer.service_id = ? AND pointer.view_id = ?`
+    ).bind(serviceId, viewId).first();
+    return row === null || row === void 0 ? void 0 : instanceFrom(row);
+  }
+  async readRows(serviceId, viewId, generation) {
+    this.ready("initialize");
+    const selected = generation ?? (await this.readActive(serviceId, viewId))?.generation;
+    if (selected === void 0) return [];
+    const result = await this.database.prepare(
+      `SELECT service_id, view_id, generation, row_key, value_json, row_version, source_suid
+         FROM mv_rows
+        WHERE service_id = ? AND view_id = ? AND generation = ?
+        ORDER BY row_key COLLATE BINARY ASC`
+    ).bind(serviceId, viewId, selected).all();
+    return result.results.map((row) => this.rowFrom(row));
+  }
+  async readIndexEntries(serviceId, viewId, generation) {
+    this.ready("initialize");
+    const selected = generation ?? (await this.readActive(serviceId, viewId))?.generation;
+    if (selected === void 0) return [];
+    const result = await this.database.prepare(
+      `SELECT service_id, view_id, generation, index_id, value_type,
+              text_value, integer_value, real_value, row_key
+         FROM mv_index_entries
+        WHERE service_id = ? AND view_id = ? AND generation = ?
+        ORDER BY index_id COLLATE BINARY ASC, value_type COLLATE BINARY ASC,
+                 COALESCE(text_value, CAST(integer_value AS TEXT), CAST(real_value AS TEXT)) COLLATE BINARY ASC,
+                 row_key COLLATE BINARY ASC`
+    ).bind(serviceId, viewId, selected).all();
+    return result.results.map((row) => this.indexFrom(row));
+  }
+  /** Read rows through a declared index without exposing SQL identifiers to callers. */
+  async queryRows(serviceId, viewId, options = {}) {
+    this.ready("initialize");
+    const selected = options.generation ?? (await this.readActive(serviceId, viewId))?.generation;
+    if (selected === void 0) return [];
+    const limit = options.limit === void 0 ? 100 : options.limit;
+    const offset = options.offset ?? 0;
+    if (limit !== null && (!Number.isSafeInteger(limit) || limit < 0) || !Number.isSafeInteger(offset) || offset < 0) {
+      throw new MaterializedViewStoreError("initialize", "MV_VALUE_INVALID", "MV query limit/offset must be non-negative integers");
+    }
+    if (options.indexId === void 0) {
+      const limitClause2 = limit === null ? "" : " LIMIT ? OFFSET ?";
+      const direction2 = options.descending === true ? "DESC" : "ASC";
+      const values2 = [serviceId, viewId, selected];
+      if (limit !== null) values2.push(limit, offset);
+      const result2 = await this.database.prepare(
+        `SELECT service_id, view_id, generation, row_key, value_json, row_version, source_suid
+           FROM mv_rows
+          WHERE service_id = ? AND view_id = ? AND generation = ?
+          ORDER BY row_key COLLATE BINARY ${direction2}${limitClause2}`
+      ).bind(...values2).all();
+      return result2.results.map((row) => this.rowFrom(row));
+    }
+    const valueType2 = options.valueType;
+    const orderColumn = valueType2 === "text" ? "index_entry.text_value" : valueType2 === "integer" ? "index_entry.integer_value" : valueType2 === "real" ? "index_entry.real_value" : "index_entry.row_key";
+    const direction = options.descending === true ? "DESC" : "ASC";
+    const indexPredicate = options.indexId === void 0 ? "" : " AND index_entry.index_id = ?";
+    const typePredicate = valueType2 === void 0 ? "" : " AND index_entry.value_type = ?";
+    const values = [serviceId, viewId, selected];
+    if (options.indexId !== void 0) values.push(options.indexId);
+    if (valueType2 !== void 0) values.push(valueType2);
+    if (limit !== null) values.push(limit, offset);
+    const limitClause = limit === null ? "" : " LIMIT ? OFFSET ?";
+    const result = await this.database.prepare(
+      `SELECT row.service_id, row.view_id, row.generation, row.row_key,
+              row.value_json, row.row_version, row.source_suid
+         FROM mv_index_entries index_entry
+         JOIN mv_rows row
+           ON row.service_id = index_entry.service_id
+          AND row.view_id = index_entry.view_id
+          AND row.generation = index_entry.generation
+          AND row.row_key = index_entry.row_key
+        WHERE row.service_id = ? AND row.view_id = ? AND row.generation = ?${indexPredicate}${typePredicate}
+        ORDER BY ${orderColumn} COLLATE BINARY ${direction}, row.row_key COLLATE BINARY ${direction}${limitClause}`
+    ).bind(...values).all();
+    return result.results.map((row) => this.rowFrom(row));
+  }
+  /** SDT-G23 composed server page; count and page rows share one statement. */
+  async queryRowsWithTotal(serviceId, viewId, options = {}) {
+    this.ready("initialize");
+    const selected = options.generation ?? (await this.readActive(serviceId, viewId))?.generation;
+    if (selected === void 0) return { rows: [], totalCount: 0 };
+    const limit = options.limit === null ? -1 : options.limit === void 0 ? 100 : options.limit;
+    const offset = options.offset ?? 0;
+    if (!Number.isSafeInteger(limit) || limit < -1 || !Number.isSafeInteger(offset) || offset < 0) {
+      throw new MaterializedViewStoreError("initialize", "MV_VALUE_INVALID", "MV composed query needs limit -1 or a non-negative limit/offset");
+    }
+    return this.unsafe.queryComposedPage(serviceId, viewId, selected, limit, offset, options.descending === true);
+  }
+  /**
+   * SDT-G55's explicit list-read port.  Existing composed reads intentionally
+   * keep their G23 semantics; only this port can include unsafe rows, and it
+   * can include only rows newer than the active safe checkpoint.
+   */
+  async readListPage(serviceId, viewId, options = {}) {
+    this.ready("initialize");
+    const active = await this.readActive(serviceId, viewId);
+    if (active === void 0) return { rows: [], totalCount: 0, readHead: "" };
+    const selected = options.generation ?? active.generation;
+    const selectedInstance = selected === active.generation ? active : await this.readInstance(serviceId, viewId, selected);
+    if (selectedInstance === void 0) {
+      throw new MaterializedViewStoreError("initialize", "MV_INSTANCE_MISSING", "Requested materialized-view generation is unavailable");
+    }
+    const limit = options.limit === null ? -1 : options.limit === void 0 ? 100 : options.limit;
+    const offset = options.offset ?? 0;
+    if (!Number.isSafeInteger(limit) || limit < -1 || !Number.isSafeInteger(offset) || offset < 0) {
+      throw new MaterializedViewStoreError("initialize", "MV_VALUE_INVALID", "MV list query needs limit -1 or a non-negative limit/offset");
+    }
+    if (options.indexId !== void 0 || options.valueType !== void 0) {
+      throw new MaterializedViewStoreError("initialize", "MV_VALUE_INVALID", "MV list query does not support an index selector");
+    }
+    const direction = options.descending === true ? "DESC" : "ASC";
+    const safeRows = `SELECT row_key, value_json, row_version, source_suid, 0 AS tombstone, 0 AS unsafe_layer FROM mv_rows
+          WHERE service_id = ? AND view_id = ? AND generation = ?`;
+    const result = options.consistency === "unsafe" ? await this.database.prepare(
+      `WITH candidates AS (
+           ${safeRows}
+           UNION ALL
+           SELECT row_key, value_json, row_version, source_suid, tombstone, 1 AS unsafe_layer FROM mv_unsafe_rows
+            WHERE service_id = ? AND view_id = ? AND generation = ?
+              AND source_suid COLLATE BINARY > ? COLLATE BINARY
+         ), ranked AS (
+           SELECT *, ROW_NUMBER() OVER (PARTITION BY row_key ORDER BY source_suid COLLATE BINARY DESC, unsafe_layer ASC) AS winner_rank FROM candidates
+         ), live AS (
+           SELECT *, COUNT(*) OVER() AS total_count FROM ranked WHERE winner_rank = 1 AND tombstone = 0
+         )
+         SELECT row_key, value_json, row_version, source_suid, total_count FROM live
+         ORDER BY source_suid COLLATE BINARY ${direction}, row_key COLLATE BINARY ${direction} LIMIT ? OFFSET ?`
+    ).bind(serviceId, viewId, selected, serviceId, viewId, selected, selectedInstance.lastSuid, limit, offset).all() : await this.database.prepare(
+      `WITH live AS (
+           SELECT row_key, value_json, row_version, source_suid, COUNT(*) OVER() AS total_count FROM mv_rows
+            WHERE service_id = ? AND view_id = ? AND generation = ?
+         )
+         SELECT row_key, value_json, row_version, source_suid, total_count FROM live
+         ORDER BY source_suid COLLATE BINARY ${direction}, row_key COLLATE BINARY ${direction} LIMIT ? OFFSET ?`
+    ).bind(serviceId, viewId, selected, limit, offset).all();
+    const rows = result.results.map((row) => ({
+      serviceId,
+      viewId,
+      generation: selected,
+      rowKey: asString2(row.row_key, "row_key"),
+      value: assertJsonValue(JSON.parse(asString2(row.value_json, "value_json")), "state-persistence"),
+      rowVersion: asInteger(row.row_version, "row_version"),
+      sourceSuid: asString2(row.source_suid, "source_suid")
+    }));
+    return {
+      rows,
+      totalCount: result.results.length === 0 ? 0 : asInteger(result.results[0].total_count, "total_count"),
+      // Safe reads report the active checkpoint even for an empty page. Unsafe
+      // reads instead report only what this page actually reflected.
+      readHead: options.consistency === "unsafe" ? maxReflectedSuid(rows) : selectedInstance.lastSuid
+    };
+  }
+  /** Explicit unsafe port: callers must choose this exceptional immediate lane. */
+  unsafeWindow() {
+    this.ready("apply");
+    return this.unsafe;
+  }
+  /** Runs repairable unsafe GC after an idle or advancing safe catch-up pass. */
+  async collectUnsafeGarbage(serviceId, viewId, generation, definitionVersion, safeHead) {
+    this.ready("apply");
+    return this.unsafe.collectEligible(serviceId, viewId, generation, definitionVersion, safeHead);
+  }
+  async hasTargetReceipt(serviceId, viewId, eventId, suid) {
+    this.ready("initialize");
+    return this.unsafe.hasTargetReceipt(serviceId, viewId, eventId, suid);
+  }
+  /**
+   * Read all G31 wait facts in one static D1 statement. Every table access is
+   * keyed by service/view/active generation (and target identity where
+   * applicable); no row or source-history scan is permitted on this path.
+   */
+  async readWaitForState(serviceId, viewId, target) {
+    this.ready("initialize");
+    const row = await this.database.prepare(
+      `WITH active AS (
+         SELECT instance.generation, instance.definition_version, instance.last_suid
+           FROM mv_active_generations pointer
+           JOIN mv_instances instance
+             ON instance.service_id = pointer.service_id
+            AND instance.view_id = pointer.view_id
+            AND instance.generation = pointer.generation
+          WHERE pointer.service_id = ? AND pointer.view_id = ?
+       )
+       SELECT
+         (SELECT generation FROM active) AS active_generation,
+         (SELECT definition_version FROM active) AS active_definition_version,
+         COALESCE((SELECT last_suid FROM active), '') AS safe_contiguous_head,
+         CASE WHEN EXISTS (
+           SELECT 1
+             FROM mv_wait_receipts receipt
+             JOIN active
+               ON active.generation = receipt.generation
+              AND active.definition_version = receipt.definition_version
+            WHERE receipt.service_id = ? AND receipt.view_id = ?
+              AND receipt.event_id = ? AND receipt.suid = ?
+         ) THEN 1 ELSE 0 END AS target_receipt,
+         CASE WHEN EXISTS (
+           SELECT 1
+             FROM mv_checkpoint_ahead_findings finding
+             JOIN active
+               ON active.generation = finding.generation
+            WHERE finding.service_id = ? AND finding.view_id = ?
+         ) THEN 1 ELSE 0 END AS checkpoint_ahead,
+         COALESCE((
+           SELECT arrival.rebuild_required
+             FROM mv_unsafe_arrivals arrival
+             JOIN active
+               ON active.generation = arrival.generation
+            WHERE arrival.service_id = ? AND arrival.view_id = ?
+         ), 0) AS rebuild_required,
+         CASE WHEN EXISTS (
+           SELECT 1
+             FROM mv_wait_target_poison finding
+             JOIN active
+               ON active.generation = finding.generation
+              AND active.definition_version = finding.definition_version
+            WHERE finding.service_id = ? AND finding.view_id = ?
+              AND finding.suid = ?
+              AND (? IS NULL OR finding.event_id = ?)
+         ) THEN 1 ELSE 0 END AS poison`
+    ).bind(
+      serviceId,
+      viewId,
+      serviceId,
+      viewId,
+      target.eventId ?? "",
+      target.suid,
+      serviceId,
+      viewId,
+      serviceId,
+      viewId,
+      serviceId,
+      viewId,
+      target.suid,
+      target.eventId ?? null,
+      target.eventId ?? null
+    ).first();
+    if (row === null || row === void 0) {
+      throw new MaterializedViewStoreError("initialize", "MV_STORE_OPERATION_FAILED", "D1 wait-state query returned no row");
+    }
+    const generation = row.active_generation === null || row.active_generation === void 0 ? void 0 : asInteger(row.active_generation, "active_generation");
+    const definitionVersion = row.active_definition_version === null || row.active_definition_version === void 0 ? void 0 : asInteger(row.active_definition_version, "active_definition_version");
+    return {
+      activeGeneration: generation,
+      activeDefinitionVersion: definitionVersion,
+      safeContiguousHead: asString2(row.safe_contiguous_head, "safe_contiguous_head"),
+      targetReceipt: asInteger(row.target_receipt, "target_receipt") === 1,
+      checkpointAhead: asInteger(row.checkpoint_ahead, "checkpoint_ahead") === 1,
+      rebuildRequired: asInteger(row.rebuild_required, "rebuild_required") === 1,
+      poison: asInteger(row.poison, "poison") === 1
+    };
+  }
+  /** Idempotent operational fact: a stored Queue event needs unsafe retry/DLQ attention. */
+  async recordUnsafeFailureFinding(input) {
+    this.ready("apply");
+    const legacyFinding = this.database.prepare(
+      `INSERT INTO mv_unsafe_failure_findings
+         (service_id, view_id, event_id, suid, classification, observed_at)
+       VALUES (?, ?, ?, ?, 'UNSAFE_APPLY_RETRY', ?)
+       ON CONFLICT (service_id, view_id, event_id, suid, classification) DO NOTHING`
+    ).bind(input.serviceId, input.viewId, input.eventId, input.suid, input.observedAt);
+    const targetPoison = input.generation === void 0 ? this.database.prepare(
+      `INSERT INTO mv_wait_target_poison
+           (service_id, view_id, generation, definition_version, event_id, suid, classification, observed_at)
+         SELECT instance.service_id, instance.view_id, instance.generation, instance.definition_version, ?, ?, 'UNSAFE_APPLY_RETRY', ?
+           FROM mv_active_generations active
+           JOIN mv_instances instance
+             ON instance.service_id = active.service_id
+            AND instance.view_id = active.view_id
+            AND instance.generation = active.generation
+          WHERE active.service_id = ? AND active.view_id = ?
+         ON CONFLICT DO NOTHING`
+    ).bind(input.eventId, input.suid, input.observedAt, input.serviceId, input.viewId) : this.database.prepare(
+      `INSERT INTO mv_wait_target_poison
+           (service_id, view_id, generation, definition_version, event_id, suid, classification, observed_at)
+         SELECT instance.service_id, instance.view_id, instance.generation, instance.definition_version, ?, ?, 'UNSAFE_APPLY_RETRY', ?
+           FROM mv_instances instance
+          WHERE instance.service_id = ? AND instance.view_id = ? AND instance.generation = ?
+         ON CONFLICT DO NOTHING`
+    ).bind(input.eventId, input.suid, input.observedAt, input.serviceId, input.viewId, input.generation);
+    await this.database.batch([legacyFinding, targetPoison]);
+  }
+  /**
+   * Persist the source-reset observation exactly once for the affected
+   * generation.  This deliberately never rewinds `mv_instances.last_suid`.
+   */
+  async recordCheckpointAhead(input) {
+    this.ready("apply");
+    await this.database.prepare(
+      `INSERT INTO mv_checkpoint_ahead_findings
+         (service_id, view_id, generation, checkpoint_suid, store_max_suid, observed_at)
+       VALUES (?, ?, ?, ?, ?, ?)
+       ON CONFLICT (service_id, view_id, generation) DO NOTHING`
+    ).bind(
+      input.serviceId,
+      input.viewId,
+      input.generation,
+      input.checkpointSuid,
+      input.storeMaxSuid,
+      input.observedAt
+    ).run();
+  }
+  /** An open finding on the active generation fail-closes composed MV reads. */
+  async hasCheckpointAheadFinding(serviceId, viewId) {
+    this.ready("initialize");
+    const result = await this.database.prepare(
+      `SELECT 1 AS present
+         FROM mv_checkpoint_ahead_findings finding
+         JOIN mv_active_generations active
+           ON active.service_id = finding.service_id
+          AND active.view_id = finding.view_id
+          AND active.generation = finding.generation
+        WHERE finding.service_id = ? AND finding.view_id = ?
+        LIMIT 1`
+    ).bind(serviceId, viewId).first();
+    return result?.present === 1;
+  }
+  /** Open quarantine is keyed to the active generation; old generations are not a public read gate. */
+  async readOrderingQuarantine(serviceId, viewId) {
+    this.ready("initialize");
+    const row = await this.database.prepare(
+      `SELECT quarantine.service_id, quarantine.view_id, quarantine.generation,
+              quarantine.checkpoint_suid, quarantine.late_suid, quarantine.event_id,
+              quarantine.classification, quarantine.status, quarantine.observed_at,
+              quarantine.resolved_at, quarantine.incident_identity
+         FROM mv_ordering_quarantines quarantine
+         JOIN mv_active_generations active
+           ON active.service_id = quarantine.service_id
+          AND active.view_id = quarantine.view_id
+          AND active.generation = quarantine.generation
+        WHERE quarantine.service_id = ? AND quarantine.view_id = ? AND quarantine.status = 'open'
+        LIMIT 1`
+    ).bind(serviceId, viewId).first();
+    if (row === null || row === void 0) return void 0;
+    const classification = asString2(row.classification, "ordering_quarantine.classification");
+    if (classification !== "LATE_LOWER_SUID" && classification !== "ORDER_VIOLATION") {
+      throw new MaterializedViewStoreError("initialize", "MV_STORE_OPERATION_FAILED", "Materialized-view ordering quarantine classification was invalid");
+    }
+    const status = asString2(row.status, "ordering_quarantine.status");
+    if (status !== "open" && status !== "resolved") {
+      throw new MaterializedViewStoreError("initialize", "MV_STORE_OPERATION_FAILED", "Materialized-view ordering quarantine status was invalid");
+    }
+    return {
+      serviceId: asString2(row.service_id, "ordering_quarantine.service_id"),
+      viewId: asString2(row.view_id, "ordering_quarantine.view_id"),
+      generation: asInteger(row.generation, "ordering_quarantine.generation"),
+      checkpointSuid: asString2(row.checkpoint_suid, "ordering_quarantine.checkpoint_suid"),
+      lateSuid: asString2(row.late_suid, "ordering_quarantine.late_suid"),
+      eventId: asString2(row.event_id, "ordering_quarantine.event_id"),
+      classification,
+      status,
+      observedAt: asInteger(row.observed_at, "ordering_quarantine.observed_at"),
+      resolvedAt: row.resolved_at === null || row.resolved_at === void 0 ? null : asInteger(row.resolved_at, "ordering_quarantine.resolved_at"),
+      incidentIdentity: row.incident_identity === null || row.incident_identity === void 0 ? null : asString2(row.incident_identity, "ordering_quarantine.incident_identity")
+    };
+  }
+  async readActiveGeneration(serviceId, viewId) {
+    this.ready("initialize");
+    return (await this.readActive(serviceId, viewId))?.generation;
+  }
+  /** Persist the detector result before stopping the safe pass. Repeated observations are idempotent. */
+  async recordOrderingQuarantine(input) {
+    this.ready("apply");
+    this.validateGeneration(input.generation, "apply");
+    const incidentIdentity = `${input.classification}|${input.serviceId}|${input.viewId}|${input.checkpointSuid}|${input.lateSuid}|${input.eventId}`;
+    await this.database.prepare(
+      `INSERT INTO mv_ordering_quarantines
+         (service_id, view_id, generation, checkpoint_suid, late_suid, event_id, classification, status, observed_at, resolved_at, incident_identity)
+       VALUES (?, ?, ?, ?, ?, ?, ?, 'open', ?, NULL, ?)
+       ON CONFLICT (service_id, view_id, generation) DO UPDATE SET
+         checkpoint_suid = excluded.checkpoint_suid,
+         late_suid = excluded.late_suid,
+         event_id = excluded.event_id,
+         classification = excluded.classification,
+         status = 'open',
+         observed_at = MIN(mv_ordering_quarantines.observed_at, excluded.observed_at),
+         resolved_at = NULL,
+         incident_identity = excluded.incident_identity`
+    ).bind(
+      input.serviceId,
+      input.viewId,
+      input.generation,
+      input.checkpointSuid,
+      input.lateSuid,
+      input.eventId,
+      input.classification,
+      input.observedAt,
+      incidentIdentity
+    ).run();
+  }
+  /**
+   * Mark a candidate only after the real rebuild path observed the complete
+   * source history. The proof is incident-bound when an ordering quarantine is
+   * open, and an empty row set is valid when the source history itself is
+   * complete (for example, a rebuild whose materializer deletes every row).
+   */
+  async markGenerationRebuilt(input) {
+    this.ready("promote");
+    this.validateGeneration(input.generation, "promote");
+    if (input.rebuildId.length === 0 || !Number.isSafeInteger(input.sourceEventCount) || input.sourceEventCount < 0 || input.sourceEventIds.length !== input.sourceEventCount || input.sourceSuids.length !== input.sourceEventCount || (input.sourceEventCount === 0 ? input.sourceMaxSuid !== "" : input.sourceMaxSuid.length === 0) || input.sourceHistoryDigest.length === 0) {
+      throw new MaterializedViewStoreError("promote", "MV_REBUILD_NOT_VERIFIED", "Rebuild proof does not describe a complete source history");
+    }
+    const quarantine = await this.database.prepare(
+      `SELECT generation, incident_identity, event_id, late_suid
+         FROM mv_ordering_quarantines
+        WHERE service_id = ? AND view_id = ? AND status = 'open'
+        ORDER BY generation DESC LIMIT 1`
+    ).bind(input.serviceId, input.viewId).first();
+    const incidentGeneration = quarantine === null || quarantine === void 0 ? null : asInteger(quarantine.generation, "rebuild.incident_generation");
+    const incidentIdentity = quarantine === null || quarantine === void 0 ? null : typeof quarantine.incident_identity === "string" && quarantine.incident_identity.length > 0 ? quarantine.incident_identity : null;
+    if (quarantine !== null && quarantine !== void 0) {
+      if (incidentIdentity === null) {
+        throw new MaterializedViewStoreError("promote", "MV_REBUILD_NOT_VERIFIED", "Ordering quarantine has no durable incident identity");
+      }
+      const incidentEventId = asString2(quarantine.event_id, "rebuild.incident_event_id");
+      const incidentLateSuid = asString2(quarantine.late_suid, "rebuild.incident_late_suid");
+      if (!input.sourceEventIds.includes(incidentEventId) || !input.sourceSuids.includes(incidentLateSuid)) {
+        throw new MaterializedViewStoreError("promote", "MV_REBUILD_NOT_VERIFIED", "Rebuild source history does not include the quarantined event");
+      }
+    }
+    const result = await this.database.prepare(
+      `UPDATE mv_instances
+          SET rebuild_verified_at = ?,
+              rebuild_recovery_id = ?,
+              rebuild_incident_identity = ?,
+              rebuild_incident_generation = ?,
+              rebuild_source_event_count = ?,
+              rebuild_source_max_suid = ?,
+              rebuild_source_history_digest = ?
+        WHERE service_id = ? AND view_id = ? AND generation = ?
+          AND status = 'candidate'
+          AND last_suid COLLATE BINARY = ? COLLATE BINARY`
+    ).bind(
+      input.verifiedAt,
+      input.rebuildId,
+      incidentIdentity,
+      incidentGeneration,
+      input.sourceEventCount,
+      input.sourceMaxSuid,
+      input.sourceHistoryDigest,
+      input.serviceId,
+      input.viewId,
+      input.generation,
+      input.sourceMaxSuid
+    ).run();
+    if ((result.meta?.changes ?? 0) !== 1) {
+      throw new MaterializedViewStoreError("promote", "MV_REBUILD_NOT_VERIFIED", "Candidate generation does not match the complete rebuild source history");
+    }
+  }
+  /**
+   * Apply rows/index entries and advance one generation checkpoint atomically.
+   * The guard row intentionally uses a NOT NULL failure to abort a stale CAS.
+   */
+  async applyMutationsAndAdvanceCheckpoint(input) {
+    assertSortableUniqueId(input.lastSuid);
+    if (input.expectedLastSuid !== null) assertSortableUniqueId(input.expectedLastSuid);
+    for (const mutation of [...input.mutations.rowUpserts, ...input.mutations.rowPatches]) {
+      assertSortableUniqueId(mutation.sourceSuid);
+    }
+    this.ready("apply");
+    this.validateGeneration(input.generation, "apply");
+    const operation = operationId2();
+    const statements = [
+      this.database.prepare(
+        `INSERT INTO mv_atomic_guards (operation_id, checkpoint_match)
+         SELECT ?, CASE WHEN EXISTS (
+           SELECT 1 FROM mv_instances
+            WHERE service_id = ? AND view_id = ? AND generation = ?
+              AND ((? IS NULL AND last_suid = '') OR last_suid COLLATE BINARY = ? COLLATE BINARY)
+         ) THEN 1 ELSE NULL END`
+      ).bind(
+        operation,
+        input.serviceId,
+        input.viewId,
+        input.generation,
+        input.expectedLastSuid,
+        input.expectedLastSuid
+      )
+    ];
+    for (const patch of input.mutations.rowPatches) {
+      statements.push(this.database.prepare(
+        `INSERT INTO mv_atomic_guards (operation_id, checkpoint_match)
+         SELECT ?, CASE WHEN EXISTS (
+           SELECT 1 FROM mv_rows
+            WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key COLLATE BINARY = ? COLLATE BINARY
+         ) THEN 1 ELSE 0 END`
+      ).bind(
+        `${operation}:patch:${patch.rowKey}`,
+        input.serviceId,
+        input.viewId,
+        input.generation,
+        patch.rowKey
+      ));
+    }
+    for (const deletion of input.mutations.rowDeletes) {
+      statements.push(this.database.prepare(
+        `DELETE FROM mv_index_entries WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?`
+      ).bind(input.serviceId, input.viewId, input.generation, deletion.rowKey));
+      statements.push(this.database.prepare(
+        `DELETE FROM mv_rows WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?`
+      ).bind(input.serviceId, input.viewId, input.generation, deletion.rowKey));
+    }
+    for (const upsert of input.mutations.rowUpserts) {
+      statements.push(this.database.prepare(
+        `DELETE FROM mv_index_entries WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?`
+      ).bind(input.serviceId, input.viewId, input.generation, upsert.rowKey));
+      statements.push(this.database.prepare(
+        `INSERT INTO mv_rows
+           (service_id, view_id, generation, row_key, value_json, row_version, source_suid)
+         VALUES (?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT (service_id, view_id, generation, row_key) DO UPDATE SET
+           value_json = excluded.value_json,
+           row_version = excluded.row_version,
+           source_suid = excluded.source_suid`
+      ).bind(
+        input.serviceId,
+        input.viewId,
+        input.generation,
+        upsert.rowKey,
+        JSON.stringify(assertJsonValue(upsert.value, "state-persistence")),
+        upsert.rowVersion,
+        upsert.sourceSuid
+      ));
+    }
+    for (const patch of input.mutations.rowPatches) {
+      if (patch.indexEntries.length > 0) {
+        statements.push(this.database.prepare(
+          `DELETE FROM mv_index_entries WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?`
+        ).bind(input.serviceId, input.viewId, input.generation, patch.rowKey));
+      }
+      statements.push(this.database.prepare(
+        `UPDATE mv_rows
+            SET value_json = json_patch(value_json, ?), row_version = ?, source_suid = ?
+          WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key COLLATE BINARY = ? COLLATE BINARY`
+      ).bind(
+        JSON.stringify(assertJsonValue(patch.patch, "state-persistence")),
+        patch.rowVersion,
+        patch.sourceSuid,
+        input.serviceId,
+        input.viewId,
+        input.generation,
+        patch.rowKey
+      ));
+    }
+    for (const deletion of input.mutations.indexDeletes) {
+      const indexPredicate = deletion.indexId === void 0 ? "" : " AND index_id = ?";
+      const values = [input.serviceId, input.viewId, input.generation, deletion.rowKey];
+      if (deletion.indexId !== void 0) values.push(deletion.indexId);
+      statements.push(this.database.prepare(
+        `DELETE FROM mv_index_entries
+          WHERE service_id = ? AND view_id = ? AND generation = ? AND row_key = ?${indexPredicate}`
+      ).bind(...values));
+    }
+    for (const entry of input.mutations.indexEntries) {
+      const typed = entry.valueType === "text" ? [entry.value, null, null] : entry.valueType === "integer" ? [null, entry.value, null] : [null, null, entry.value];
+      statements.push(this.database.prepare(
+        `INSERT INTO mv_index_entries
+           (service_id, view_id, generation, index_id, value_type, text_value, integer_value, real_value, row_key)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT (service_id, view_id, generation, index_id, value_type, text_value, integer_value, real_value, row_key)
+         DO NOTHING`
+      ).bind(
+        input.serviceId,
+        input.viewId,
+        input.generation,
+        entry.indexId,
+        entry.valueType,
+        ...typed,
+        entry.rowKey
+      ));
+    }
+    for (const patch of input.mutations.rowPatches) {
+      for (const entry of patch.indexEntries) {
+        const typed = entry.valueType === "text" ? [entry.value, null, null] : entry.valueType === "integer" ? [null, entry.value, null] : [null, null, entry.value];
+        statements.push(this.database.prepare(
+          `INSERT INTO mv_index_entries
+             (service_id, view_id, generation, index_id, value_type, text_value, integer_value, real_value, row_key)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+           ON CONFLICT (service_id, view_id, generation, index_id, value_type, text_value, integer_value, real_value, row_key)
+           DO NOTHING`
+        ).bind(
+          input.serviceId,
+          input.viewId,
+          input.generation,
+          entry.indexId,
+          entry.valueType,
+          ...typed,
+          entry.rowKey
+        ));
+      }
+    }
+    statements.push(this.database.prepare(
+      `UPDATE mv_instances
+          SET last_suid = ?, definition_version = ?, updated_at = MAX(updated_at, ?),
+              rebuild_verified_at = NULL,
+              rebuild_recovery_id = NULL,
+              rebuild_incident_identity = NULL,
+              rebuild_incident_generation = NULL,
+              rebuild_source_event_count = NULL,
+              rebuild_source_max_suid = NULL,
+              rebuild_source_history_digest = NULL
+        WHERE service_id = ? AND view_id = ? AND generation = ?`
+    ).bind(
+      input.lastSuid,
+      input.definitionVersion,
+      input.updatedAt,
+      input.serviceId,
+      input.viewId,
+      input.generation
+    ));
+    statements.push(this.database.prepare(
+      "DELETE FROM mv_atomic_guards WHERE operation_id = ? OR operation_id LIKE ?"
+    ).bind(operation, `${operation}:%`));
+    try {
+      await this.database.batch(statements);
+    } catch (error) {
+      if (isPatchFailure(error)) throw new MaterializedViewPatchError();
+      if (isCasFailure(error)) throw new MaterializedViewCasError();
+      throw new MaterializedViewStoreError("apply", "MV_STORE_OPERATION_FAILED", `Materialized-view atomic apply failed: ${String(error)}`, { cause: error });
+    }
+    const instance = await this.readInstance(input.serviceId, input.viewId, input.generation);
+    if (instance === void 0) throw new MaterializedViewStoreError("apply", "MV_INSTANCE_MISSING", "Materialized-view instance disappeared after apply");
+    return {
+      instance,
+      rowUpserts: input.mutations.rowUpserts.length,
+      rowDeletes: input.mutations.rowDeletes.length,
+      rowPatches: input.mutations.rowPatches.length,
+      indexEntries: input.mutations.indexEntries.length
+    };
+  }
+  async promoteGeneration(input) {
+    this.ready("promote");
+    this.validateGeneration(input.candidateGeneration, "promote");
+    const operation = operationId2();
+    const statements = [
+      this.database.prepare(
+        `INSERT INTO mv_atomic_guards (operation_id, checkpoint_match)
+         SELECT ?, CASE WHEN EXISTS (
+           SELECT 1 FROM mv_instances candidate
+           WHERE candidate.service_id = ? AND candidate.view_id = ?
+              AND candidate.generation = ? AND candidate.status = 'candidate'
+              AND (
+                NOT EXISTS (
+                   SELECT 1 FROM mv_ordering_quarantines open_quarantine
+                   WHERE open_quarantine.service_id = candidate.service_id
+                     AND open_quarantine.view_id = candidate.view_id
+                     AND open_quarantine.status = 'open'
+                )
+                OR EXISTS (
+                  SELECT 1 FROM mv_ordering_quarantines open_quarantine
+                   WHERE open_quarantine.service_id = candidate.service_id
+                     AND open_quarantine.view_id = candidate.view_id
+                     AND open_quarantine.status = 'open'
+                     AND open_quarantine.incident_identity IS NOT NULL
+                     AND candidate.rebuild_verified_at IS NOT NULL
+                     AND candidate.rebuild_incident_generation = open_quarantine.generation
+                     AND candidate.rebuild_incident_identity = open_quarantine.incident_identity
+                )
+              )
+         ) AND (
+           (? IS NULL AND NOT EXISTS (
+             SELECT 1 FROM mv_active_generations existing
+              WHERE existing.service_id = ? AND existing.view_id = ?
+           ))
+           OR (? IS NOT NULL AND EXISTS (
+             SELECT 1 FROM mv_active_generations pointer
+              WHERE pointer.service_id = ? AND pointer.view_id = ?
+                AND pointer.generation = ?
+           ))
+         ) THEN 1 ELSE NULL END`
+      ).bind(
+        operation,
+        input.serviceId,
+        input.viewId,
+        input.candidateGeneration,
+        input.expectedActiveGeneration,
+        input.serviceId,
+        input.viewId,
+        input.expectedActiveGeneration,
+        input.serviceId,
+        input.viewId,
+        input.expectedActiveGeneration
+      ),
+      this.database.prepare(
+        `UPDATE mv_instances SET status = 'retired', updated_at = ?
+          WHERE service_id = ? AND view_id = ? AND status = 'active'`
+      ).bind(input.updatedAt, input.serviceId, input.viewId),
+      this.database.prepare(
+        `UPDATE mv_instances SET status = 'active', updated_at = ?
+          WHERE service_id = ? AND view_id = ? AND generation = ?`
+      ).bind(input.updatedAt, input.serviceId, input.viewId, input.candidateGeneration),
+      this.database.prepare(
+        `INSERT INTO mv_active_generations (service_id, view_id, generation, updated_at)
+         VALUES (?, ?, ?, ?)
+         ON CONFLICT (service_id, view_id) DO UPDATE SET generation = excluded.generation, updated_at = excluded.updated_at`
+      ).bind(input.serviceId, input.viewId, input.candidateGeneration, input.updatedAt),
+      // A successful rebuild/promotion is the explicit recovery action for an
+      // open ordering quarantine. The active-generation pointer changes in the
+      // same batch, so a safe read never observes a cleared gate on the old
+      // generation with the new generation still unproven.
+      this.database.prepare(
+        `UPDATE mv_ordering_quarantines
+            SET status = 'resolved', resolved_at = ?
+          WHERE service_id = ? AND view_id = ? AND status = 'open' AND generation <> ?
+            AND incident_identity = (
+              SELECT candidate.rebuild_incident_identity
+                FROM mv_instances candidate
+               WHERE candidate.service_id = ? AND candidate.view_id = ?
+                 AND candidate.generation = ? AND candidate.status = 'active'
+            )`
+      ).bind(
+        input.updatedAt,
+        input.serviceId,
+        input.viewId,
+        input.candidateGeneration,
+        input.serviceId,
+        input.viewId,
+        input.candidateGeneration
+      ),
+      this.database.prepare("DELETE FROM mv_atomic_guards WHERE operation_id = ?").bind(operation)
+    ];
+    try {
+      await this.database.batch(statements);
+    } catch (error) {
+      if (isCasFailure(error)) throw new MaterializedViewPromotionCasError();
+      throw new MaterializedViewStoreError("promote", "MV_STORE_OPERATION_FAILED", `Materialized-view promotion failed: ${String(error)}`, { cause: error });
+    }
+    const active = await this.readActive(input.serviceId, input.viewId);
+    if (active === void 0) throw new MaterializedViewStoreError("promote", "MV_INSTANCE_MISSING", "Active generation disappeared after promotion");
+    return active;
+  }
+  /** Short aliases make the port convenient for runtime composition and tests. */
+  apply = this.applyMutationsAndAdvanceCheckpoint.bind(this);
+  promote = this.promoteGeneration.bind(this);
+  rowFrom(row) {
+    let value;
+    try {
+      value = assertJsonValue(JSON.parse(asString2(row.value_json, "value_json")), "state-persistence");
+    } catch (error) {
+      throw new MaterializedViewStoreError("initialize", "MV_VALUE_INVALID", `Materialized-view row JSON was invalid: ${String(error)}`, { cause: error });
+    }
+    return {
+      serviceId: asString2(row.service_id, "service_id"),
+      viewId: asString2(row.view_id, "view_id"),
+      generation: asInteger(row.generation, "generation"),
+      rowKey: asString2(row.row_key, "row_key"),
+      value,
+      rowVersion: asInteger(row.row_version, "row_version"),
+      sourceSuid: asString2(row.source_suid, "source_suid")
+    };
+  }
+  indexFrom(row) {
+    const type = valueType(row.value_type);
+    return {
+      serviceId: asString2(row.service_id, "service_id"),
+      viewId: asString2(row.view_id, "view_id"),
+      generation: asInteger(row.generation, "generation"),
+      indexId: asString2(row.index_id, "index_id"),
+      valueType: type,
+      value: indexValue(row, type),
+      rowKey: asString2(row.row_key, "row_key")
+    };
+  }
+  validateGeneration(generation, operation) {
+    if (!Number.isSafeInteger(generation) || generation < 0) {
+      throw new MaterializedViewStoreError(operation, "MV_GENERATION_INVALID", "Materialized-view generation must be a non-negative integer");
+    }
+  }
+  ready(operation) {
+    if (!this.initialized) throw new MaterializedViewStoreError(operation, "MV_STORE_NOT_INITIALIZED", "D1MaterializedViewStore.initialize() must complete before use");
+  }
+};
+
+// src/bootstrap/manifest.ts
+var isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var canonical = (value) => {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  if (isObject(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`).join(",")}}`;
+  return JSON.stringify(value);
+};
+function bootstrapDigest(value) {
+  let hash = 2166136261;
+  for (const char of canonical(value)) {
+    hash ^= char.charCodeAt(0);
+    hash = Math.imul(hash, 16777619);
+  }
+  return `fnv1a32:${(hash >>> 0).toString(16).padStart(8, "0")}`;
+}
+
+// src/tag/EventDigest.ts
+var EVENT_DIGEST_DOMAIN_SEPARATOR = "sekiban-dcb-ts/eventDigest/v2";
+var EventDigestValidationError = class extends TypeError {
+  constructor(message) {
+    super(message);
+    this.name = "EventDigestValidationError";
+  }
+};
+var encoder = new TextEncoder();
+var requiredFieldNames = [
+  "serviceId",
+  "eventId",
+  "sortableUniqueId",
+  "eventType",
+  "timestamp",
+  "attemptId",
+  "declaredTagSet",
+  "payload"
+];
+var optionalFieldNames = ["allocatorLineageId"];
+var excludedFieldNames = ["causationId", "correlationId", "executedUser"];
+var allowedFieldNames = /* @__PURE__ */ new Set([...requiredFieldNames, ...optionalFieldNames, ...excludedFieldNames]);
+function byteCompare(left, right) {
+  const length = Math.min(left.byteLength, right.byteLength);
+  for (let index = 0; index < length; index += 1) {
+    const delta = left[index] - right[index];
+    if (delta !== 0) return delta;
+  }
+  return left.byteLength - right.byteLength;
+}
+function concat(parts) {
+  const length = parts.reduce((total, part) => total + part.byteLength, 0);
+  const bytes = new Uint8Array(length);
+  let offset = 0;
+  for (const part of parts) {
+    bytes.set(part, offset);
+    offset += part.byteLength;
+  }
+  return bytes;
+}
+function lengthPrefix(length) {
+  if (!Number.isSafeInteger(length) || length < 0 || length > 4294967295) {
+    throw new EventDigestValidationError("eventDigest field length is outside uint32 range");
+  }
+  return Uint8Array.of(
+    length >>> 24 & 255,
+    length >>> 16 & 255,
+    length >>> 8 & 255,
+    length & 255
+  );
+}
+function utf8(value) {
+  return encoder.encode(value);
+}
+function hasOwn(input, name) {
+  return Object.prototype.hasOwnProperty.call(input, name);
+}
+function requiredUtf8(input, name) {
+  const value = input[name];
+  if (typeof value !== "string") {
+    throw new EventDigestValidationError(`eventDigest required field ${name} is absent or not a string`);
+  }
+  return utf8(value);
+}
+function tagSetBytes(tags) {
+  const canonical2 = canonicalDeclaredTagSet(tags);
+  return concat(canonical2.map((tag) => {
+    const bytes = utf8(tag);
+    return concat([lengthPrefix(bytes.byteLength), bytes]);
+  }));
+}
+function canonicalDeclaredTagSet(tags) {
+  if (!Array.isArray(tags) || !tags.every((tag) => typeof tag === "string")) {
+    throw new EventDigestValidationError("eventDigest declaredTagSet must contain only strings");
+  }
+  const encoded = tags.map((tag) => ({ tag, bytes: utf8(tag) })).sort((left, right) => byteCompare(left.bytes, right.bytes));
+  const unique = [];
+  let previous;
+  for (const item of encoded) {
+    if (previous !== void 0 && byteCompare(previous, item.bytes) === 0) continue;
+    unique.push(item.tag);
+    previous = item.bytes;
+  }
+  return Object.freeze(unique);
+}
+function assertClosedProjection(input) {
+  for (const name of Object.keys(input)) {
+    if (!allowedFieldNames.has(name)) {
+      throw new EventDigestValidationError(`eventDigest field ${name} is neither included nor explicitly excluded`);
+    }
+  }
+  for (const name of requiredFieldNames) {
+    if (!hasOwn(input, name)) {
+      throw new EventDigestValidationError(`eventDigest required field ${name} is absent`);
+    }
+  }
+  if (!Array.isArray(input.declaredTagSet)) {
+    throw new EventDigestValidationError("eventDigest required field declaredTagSet is absent or invalid");
+  }
+  if (!(input.payload instanceof Uint8Array)) {
+    throw new EventDigestValidationError("eventDigest required field payload is absent or not raw bytes");
+  }
+  if (hasOwn(input, "allocatorLineageId") && typeof input.allocatorLineageId !== "string") {
+    throw new EventDigestValidationError("eventDigest optional field allocatorLineageId must be absent or a string");
+  }
+}
+function encodeField(name, value) {
+  const nameBytes = utf8(name);
+  const present = value === void 0 ? Uint8Array.of(0) : Uint8Array.of(1);
+  const valueBytes = value ?? new Uint8Array();
+  return concat([
+    present,
+    lengthPrefix(nameBytes.byteLength),
+    nameBytes,
+    lengthPrefix(valueBytes.byteLength),
+    valueBytes
+  ]);
+}
+function eventDigestBytes(input) {
+  assertClosedProjection(input);
+  const fields = [
+    ["serviceId", requiredUtf8(input, "serviceId")],
+    ["eventId", requiredUtf8(input, "eventId")],
+    ["sortableUniqueId", requiredUtf8(input, "sortableUniqueId")],
+    ["eventType", requiredUtf8(input, "eventType")],
+    ["timestamp", requiredUtf8(input, "timestamp")],
+    ["allocatorLineageId", hasOwn(input, "allocatorLineageId") ? utf8(input.allocatorLineageId) : void 0],
+    ["attemptId", requiredUtf8(input, "attemptId")],
+    ["declaredTagSet", tagSetBytes(input.declaredTagSet)],
+    ["payload", input.payload]
+  ];
+  return concat([
+    utf8(EVENT_DIGEST_DOMAIN_SEPARATOR),
+    Uint8Array.of(0),
+    ...fields.map(([name, value]) => encodeField(name, value))
+  ]);
+}
+async function eventDigestHex(input) {
+  const bytes = eventDigestBytes(input);
+  const source = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+  const digest = await crypto.subtle.digest("SHA-256", source);
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+// src/bootstrap/BootstrapStoreAdapter.ts
+function arrayBufferBase64(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+var BootstrapIdentityConflictError = class extends Error {
+  constructor(provider, eventId) {
+    super(`${provider} bootstrap EventId ${eventId} conflicts with the target identity`);
+    this.provider = provider;
+    this.eventId = eventId;
+    this.name = "BootstrapIdentityConflictError";
+  }
+  provider;
+  eventId;
+  code = "BOOTSTRAP_EVENT_IDENTITY_CONFLICT";
+};
+function compareOpaque(left, right) {
+  const a = new TextEncoder().encode(left);
+  const b = new TextEncoder().encode(right);
+  for (let index = 0; index < Math.min(a.length, b.length); index += 1) if (a[index] !== b[index]) return a[index] - b[index];
+  return a.length - b.length;
+}
+function bootstrapEventIdentityMatches(event, record) {
+  return event.suid === record.suid && event.payload === record.payload && event.eventType === record.eventType && event.timestamp === record.timestamp && event.causationId === record.causationId && event.correlationId === record.correlationId && event.executedUser === record.executedUser && JSON.stringify(event.eventTags) === JSON.stringify(record.eventTags);
+}
+function toRecord(event) {
+  return {
+    eventId: event.eventId,
+    suid: event.suid,
+    payload: event.payload,
+    eventTags: [...event.eventTags],
+    eventType: event.eventType,
+    provenance: { origin: "g32" },
+    timestamp: event.timestamp,
+    causationId: event.causationId,
+    correlationId: event.correlationId,
+    executedUser: event.executedUser
+  };
+}
+var BootstrapStoreAdapter = class {
+  constructor(provider, store, identityGuard = bootstrapEventIdentityMatches) {
+    this.provider = provider;
+    this.store = store;
+    this.identityGuard = identityGuard;
+  }
+  provider;
+  store;
+  identityGuard;
+  async exportPage(input) {
+    if (!Number.isSafeInteger(input.pageSize) || input.pageSize <= 0) throw new Error("bootstrap export pageSize must be positive");
+    await this.store.initialize();
+    const observed = await this.store.readAllEvents(input.sourceServiceId, "");
+    const highWatermark = input.cursor?.highWatermark ?? observed.at(-1)?.suid ?? null;
+    const snapshot = observed.filter((event) => highWatermark === null || compareOpaque(event.suid, highWatermark) <= 0).map(toRecord);
+    const start = input.cursor?.nextEventId === null || input.cursor?.nextEventId === void 0 ? 0 : snapshot.findIndex((event) => event.eventId === input.cursor.nextEventId) + 1;
+    const page = snapshot.slice(Math.max(0, start), Math.max(0, start) + input.pageSize);
+    const tagCounts = {};
+    for (const event of snapshot) for (const tag of event.eventTags) tagCounts[tag] = (tagCounts[tag] ?? 0) + 1;
+    const draft = {
+      format: "sekiban-dcb-bootstrap",
+      version: 1,
+      source: { serviceId: input.sourceServiceId, lineageId: input.sourceAllocatorLineageId },
+      target: { serviceId: input.targetServiceId, allocatorLineageId: input.allocatorLineageId },
+      highWatermark,
+      eventCount: snapshot.length,
+      tagCounts,
+      canonicalization: "utf8-json-sorted-keys-v1"
+    };
+    const fullDump = { manifest: { ...draft, contentDigest: "" }, events: snapshot };
+    const manifest = { ...draft, contentDigest: bootstrapDigest(fullDump) };
+    const pageEnd = Math.max(0, start) + page.length;
+    return {
+      dump: { manifest, events: snapshot },
+      page,
+      cursor: { highWatermark, nextEventId: pageEnd >= snapshot.length ? null : snapshot[pageEnd - 1].eventId },
+      complete: pageEnd >= snapshot.length
+    };
+  }
+  async admitBootstrap(input) {
+    await this.store.initialize();
+    const existing = new Map((await this.store.readAllEvents(input.manifest.target.serviceId, "")).map((event) => [event.eventId, event]));
+    for (const record of input.events) {
+      const prior = existing.get(record.eventId);
+      if (prior !== void 0 && !this.identityGuard(prior, record)) throw new BootstrapIdentityConflictError(this.provider, record.eventId);
+      for (const tag of record.eventTags) {
+        const attemptId = `bootstrap:${input.importId}:${input.leaseEpoch}`;
+        const digestInput = {
+          serviceId: input.manifest.target.serviceId,
+          eventId: record.eventId,
+          sortableUniqueId: record.suid,
+          eventType: record.eventType,
+          timestamp: record.timestamp,
+          allocatorLineageId: input.manifest.target.allocatorLineageId,
+          attemptId,
+          declaredTagSet: canonicalDeclaredTagSet(record.eventTags),
+          payload: new TextEncoder().encode(record.payload)
+        };
+        const delivered = await this.store.recordDelivery({
+          version: 1,
+          serviceId: input.manifest.target.serviceId,
+          allocatorLineageId: input.manifest.target.allocatorLineageId,
+          tag,
+          attemptId,
+          eventId: record.eventId,
+          suid: record.suid,
+          payload: record.payload,
+          eventTags: [...record.eventTags],
+          eventType: record.eventType,
+          provenance: "g32",
+          timestamp: record.timestamp,
+          causationId: record.causationId,
+          correlationId: record.correlationId,
+          executedUser: record.executedUser,
+          enqueuedAt: 0,
+          completeness: {
+            canonicalBytesBase64: arrayBufferBase64(eventDigestBytes(digestInput)),
+            eventDigest: await eventDigestHex(digestInput),
+            declaredTagSet: [...digestInput.declaredTagSet],
+            localCommittedMembership: [{ serviceId: input.manifest.target.serviceId, eventId: record.eventId, tag }],
+            // Bootstrap is not a source outbox replay path. The deterministic
+            // per-event/tag ordinal is only enough to satisfy the D1 receipt
+            // key while G44's source scanner remains explicitly out of scope.
+            obligationSequence: Math.max(1, [...new TextEncoder().encode(`${record.eventId}|${tag}`)].reduce((total, byte) => (total * 33 + byte) % 1e9, 5381))
+          }
+          // A C# import may contain a historical RFC 4122 Id. It bypasses
+          // Queue/doorbell and is admitted only through this fenced path;
+          // normal deliveries still require UUID v7.
+        }, 0, "import");
+        if (delivered.outcome !== "stored") throw new Error(`${this.provider} bootstrap admission rejected ${record.eventId}`);
+      }
+    }
+  }
+  async verifyBootstrap(input) {
+    await this.store.initialize();
+    const actual = await this.store.readAllEvents(input.manifest.target.serviceId, "");
+    if (actual.length !== input.manifest.eventCount) throw new Error(`${this.provider} bootstrap store count differs for ${input.importId}`);
+  }
+};
+function createBootstrapStoreAdapter(provider, store, identityGuard) {
+  return new BootstrapStoreAdapter(provider, store, identityGuard);
+}
+
+// src/d1.ts
+function createD1StoreProvider(config = {}) {
+  return Object.freeze({
+    name: "d1",
+    isConfigured: (env) => env.D1 !== void 0,
+    create: (env) => {
+      if (env.D1 === void 0) throw new Error("A D1 binding is required for the D1 store");
+      return new D1EventStore(env.D1, config.storeOptions);
+    },
+    createBootstrapAdapter: (env) => {
+      if (env.D1 === void 0) throw new Error("A D1 binding is required for the D1 store");
+      return createD1BootstrapAdapter(new D1EventStore(env.D1, config.storeOptions));
+    }
+  });
+}
+function createD1MaterializedViewStore(database) {
+  return new D1MaterializedViewStore(database);
+}
+function createD1BootstrapAdapter(store) {
+  return createBootstrapStoreAdapter("d1", store, (event, record) => bootstrapEventIdentityMatches(event, record));
+}
+export {
+  D1EventStore,
+  D1IdentityConflictError,
+  D1MaterializedViewStore,
+  MaterializedViewCasError,
+  MaterializedViewPatchError,
+  MaterializedViewPromotionCasError,
+  MaterializedViewStoreError,
+  createD1BootstrapAdapter,
+  createD1MaterializedViewStore,
+  createD1StoreProvider,
+  safeWindowCeilingExceeded,
+  safeWindowMs
+};