@shirudo/ddd-kit 3.0.0-rc.10 → 3.0.0-rc.11

package/dist/index.js

@@ -1,5 +1,5 @@
-import { A as NonProgressingEventStreamPageError, B as SnapshotSchemaMismatchError, C as InvalidIntegrationMessageError, D as MissingEntityIdError, E as MisaddressedEventError, F as ProjectionOrderViolationError, G as UnprojectableEventError, H as UnenrolledChangesError, I as ProjectionReceiptViolationError, J as assertNoHostileOwnProtoKey, K as UnregisteredHandlerError, L as ReentrantEventRecordingError, M as PendingEventLimitExceededError, N as ProjectionGapError, O as MissingFoldError, P as ProjectionIdentityViolationError, R as ReplayHeadMismatchError, S as InvalidCommandMessageError, T as KitWiringError, U as UnmanagedInstanceError, V as SnapshotVersionNotRestoredError, W as UnmintedEventError, X as isInfrastructureErrorLike, Y as isDomainErrorLike, Z as isWiringErrorLike, _ as IdempotencyInFlightError, a as DirectStateMutationError, b as InMemoryCapacityExceededError, c as DuplicateEventIdError, d as EventHarvestError, f as FoldReturnedNoStateError, g as IdempotencyCompletionWithoutClaimError, h as IdempotencyClaimLostError, i as ConcurrencyConflictError, j as PendingEventBatchMismatchError, k as MissingHandlerError, l as DuplicateHandlerRegistrationError, m as HostileStateKeyError, n as AggregateNotFoundError, o as DomainError, p as ForeignEventError, q as UnreplayableAggregateError, r as CapabilityRegistryConflictError, s as DuplicateAggregateError, t as AggregateDeletedError, u as ErrorMapperFailedError, v as IdempotencyKeyReuseError, w as InvalidVersionError, x as InfrastructureError, y as IdempotencyReconciliationRequiredError, z as SnapshotCorruptedError } from "./chunks/kit-errors.js";
-import { A as voWithValidation, C as hasCooperativeBrand, D as vo, E as deepFreeze, F as findPropertyDescriptor, I as hasIntrinsicPrototypeChain, L as isBuiltInObject, M as deepOmit, N as deepEqual, O as voEquals, P as builtInTagWithoutInvokingAccessors, R as isIntrinsicConstructorPrototype, S as SnapshotTimeValidationError, T as ValueObject, _ as isRecordedDomainEvent, a as assertNonNegativeFinite, b as recordDomainEvent, c as abortReason, d as copyMetadata, f as createDomainEvent, g as defaultDomainEventFactory, h as createUncommittedDomainEvent, i as runBoundedExecution, j as deepEqualExcept, k as voEqualsExcept, l as adoptRecordedDomainEvent, m as createDomainEventFromFacts, n as DEFAULT_EXECUTION_TIMEOUT_MS, o as assertPositiveInteger, p as createDomainEventFactory, r as ownerSignalOf, s as assertPositiveSafeInteger, t as isDispatchTrackingOutbox, u as adoptUncommittedDomainEvent, v as isUncommittedDomainEvent, w as stampCooperativeBrand, x as DomainEventValidationError, y as mergeMetadata, z as isWeakMap } from "./chunks/ports.js";
+import { $ as isDomainErrorLike, A as MissingHandlerError, B as SnapshotCorruptedError, C as InvalidEventStreamPageError, D as MisattributedEventError, E as KitWiringError, F as ProjectionOrderViolationError, G as UnmintedEventError, H as SnapshotVersionNotRestoredError, I as ProjectionReceiptViolationError, J as UnreplayableAggregateError, K as UnprojectableEventError, L as ReentrantEventRecordingError, M as PendingEventLimitExceededError, N as ProjectionGapError, O as MissingEntityIdError, P as ProjectionIdentityViolationError, Q as detachAggregateIdentity, R as ReplayRejectedError, S as InvalidCommandMessageError, T as InvalidVersionError, U as UnenrolledChangesError, V as SnapshotSchemaMismatchError, W as UnmanagedInstanceError, X as attributeConflictIntent, Y as assertNoHostileOwnProtoKey, Z as describeAggregateIdentity, _ as IdempotencyInFlightError, a as DirectStateMutationError, b as InMemoryCapacityExceededError, c as DuplicateEventIdError, d as EventHarvestError, et as isInfrastructureErrorLike, f as FoldReturnedNoStateError, g as IdempotencyCompletionWithoutClaimError, h as IdempotencyClaimLostError, i as ConcurrencyConflictError, j as PendingEventBatchMismatchError, k as MissingFoldError, l as DuplicateHandlerRegistrationError, m as HostileStateKeyError, n as AggregateNotFoundError, nt as rewriteErrorMessage, o as DomainError, p as ForeignEventError, q as UnregisteredHandlerError, r as CapabilityRegistryConflictError, s as DuplicateAggregateError, t as AggregateDeletedError, tt as isWiringErrorLike, u as ErrorMapperFailedError, v as IdempotencyKeyReuseError, w as InvalidIntegrationMessageError, x as InfrastructureError, y as IdempotencyReconciliationRequiredError, z as ReplayTargetMismatchError } from "./chunks/kit-errors.js";
+import { A as SnapshotTimeValidationError, B as voWithValidation, C as defaultDomainEventFactory, D as mintUncommittedDomainEvent, E as mergeMetadata, F as ValueObject, G as isBuiltInObject, H as deepOmit, I as deepFreeze, K as isIntrinsicConstructorPrototype, L as vo, M as detachState, N as hasCooperativeBrand, O as recordDomainEvent, P as stampCooperativeBrand, R as voEquals, S as createUncommittedDomainEvent, T as isUncommittedDomainEvent, U as deepEqual, V as deepEqualExcept, W as findPropertyDescriptor, _ as adoptUncommittedDomainEvent, a as isDispatchTrackingOutbox, b as createDomainEventFactory, c as runBoundedExecution, d as assertPositiveInteger, f as assertPositiveSafeInteger, g as adoptRecordedDomainEvent, h as waitRejectingOnAbort, i as assertPageWithinWindow, j as detachFreezableState, k as DomainEventValidationError, l as MAX_TIMER_DELAY_MS, m as abortReason, n as readStreamPages, o as DEFAULT_EXECUTION_TIMEOUT_MS, p as assertTimerDelay, q as isWeakMap, r as assertPageNotEmpty, s as ownerSignalOf, t as pinTargetVersion, u as assertNonNegativeSafeInteger, v as copyMetadata, w as isRecordedDomainEvent, x as createDomainEventFromFacts, y as createDomainEvent, z as voEqualsExcept } from "./chunks/read-stream-pages.js";
 import { err, ok } from "@shirudo/result";
 import { ValidationError, someChainRetryable } from "@shirudo/base-error";
 
@@ -200,10 +200,13 @@ function assertJsonValue(value, path, invalid, active = /* @__PURE__ */ new Weak
 * destinations, while event-stream replay only rebuilds process state.
 */
 function routeEventsToCommandOutbox(outbox, mapper) {
-	return { add: async (events) => {
-		const commits = events.map((candidate) => toCommandCommit(candidate, mapper));
-		await outbox.add(commits);
-	} };
+	return {
+		add: async (events) => {
+			const commits = events.map((candidate) => toCommandCommit(candidate, mapper));
+			await outbox.add(commits);
+		},
+		endEventSources: (sources) => outbox.endEventSources(sources)
+	};
 }
 function toCommandCommit(candidate, mapper) {
 	const mapped = mapper(candidate.event);
@@ -283,7 +286,7 @@ function invalid$1(path, reason) {
 }
 
 //#endregion
-//#region src/domain/aggregate/internal/global-capability-registry.ts
+//#region src/internal/global-capability-registry.ts
 /**
 * The sentence a capability lookup appends to its rejection when the
 * registry is private to this copy, so the reader learns why an instance
@@ -343,7 +346,7 @@ function withRequire(registry, shared) {
 
 //#endregion
 //#region src/domain/aggregate/pending-event-lifecycle.ts
-const { registry: capabilities$2, require: require$1 } = createGlobalCapabilityRegistry(Symbol.for("@shirudo/ddd-kit/pending-event-lifecycle-registry/v6"));
+const { registry: capabilities$2, require: require$1 } = createGlobalCapabilityRegistry(Symbol.for("@shirudo/ddd-kit/pending-event-lifecycle-registry/v7"));
 /** Resolves the lifecycle authority or throws `UnmanagedInstanceError`. */
 function requirePendingEventLifecycleCapability(aggregate, operation) {
 	return require$1(aggregate, operation, "aggregate");
@@ -424,9 +427,9 @@ function createCommitTokenScope() {
 		if (existing) {
 			const record = recordsByToken.get(existing);
 			if (!record) throw new EventHarvestError("withCommit: internal commit-token registry is inconsistent.");
-			if (record.disposition === "deleted" && disposition === "saved") throw new EventHarvestError(`withCommit: aggregate ${String(aggregate.id)} was enrolled as saved after it was enrolled as deleted in the same transaction.`);
-			if (options?.expectedVersion !== void 0 && options.expectedVersion !== record.expectedVersion) throw new EventHarvestError(`withCommit: aggregate ${String(aggregate.id)} was re-enrolled with expectedVersion ${String(options.expectedVersion)}, but its enrollment recorded ${String(record.expectedVersion)}. Duplicate enrollment must assert the same OCC baseline or none.`);
-			if (enrollmentDiverged(record)) throw new EventHarvestError(`withCommit: aggregate ${String(aggregate.id)} changed after its commit batch was enrolled. Register persistence intent last.`);
+			if (record.disposition === "deleted" && disposition === "saved") throw new EventHarvestError(`withCommit: aggregate ${describeAggregateIdentity(aggregate.aggregateIdentity)} was enrolled as saved after it was enrolled as deleted in the same transaction.`);
+			if (options?.expectedVersion !== void 0 && options.expectedVersion !== record.expectedVersion) throw new EventHarvestError(`withCommit: aggregate ${describeAggregateIdentity(aggregate.aggregateIdentity)} was re-enrolled with expectedVersion ${String(options.expectedVersion)}, but its enrollment recorded ${String(record.expectedVersion)}. Duplicate enrollment must assert the same OCC baseline or none.`);
+			if (enrollmentDiverged(record)) throw new EventHarvestError(`withCommit: aggregate ${describeAggregateIdentity(aggregate.aggregateIdentity)} changed after its commit batch was enrolled. Register persistence intent last.`);
 			if (disposition === "deleted") record.disposition = "deleted";
 			return existing;
 		}
@@ -467,7 +470,7 @@ function createCommitTokenScope() {
 				if (!record) throw new EventHarvestError("withCommit: a commit token was not minted by this callback's enrollment capability. Forged and stale tokens are rejected.");
 				if (seen.has(tokenObject)) continue;
 				seen.add(tokenObject);
-				if (enrollmentDiverged(record)) throw new EventHarvestError(`withCommit: aggregate ${String(record.aggregate.id)} changed after its commit batch was enrolled; events recorded after enrollment are not part of the attested write and would be silently dropped. Make domain decisions first, write, and enroll last.`);
+				if (enrollmentDiverged(record)) throw new EventHarvestError(`withCommit: aggregate ${describeAggregateIdentity(record.aggregate.aggregateIdentity)} changed after its commit batch was enrolled; events recorded after enrollment are not part of the attested write and would be silently dropped. Make domain decisions first, write, and enroll last.`);
 				records.push(record);
 			}
 			if (seen.size !== mintedTokenCount) throw new EventHarvestError("withCommit: every token minted by the current enrollment capability must be returned in `commits`. If an enrolled write must not commit, throw so the transaction rolls back.");
@@ -595,8 +598,21 @@ function createCommitTokenScope() {
 * ```
 */
 async function withCommit(deps, fn) {
+	return withCheckedCommit(deps, async (ctx, enrollment) => {
+		const { result, commits } = await fn(ctx, enrollment);
+		return {
+			result,
+			commits
+		};
+	}, void 0);
+}
+/**
+* {@link withCommit} with a check per attempt before the commit. The scope
+* receives `onAttemptStart` in its transactional options.
+*/
+async function withCheckedCommit(deps, fn, onAttemptStart) {
 	const postCommitTimeoutMs = deps.postCommitTimeoutMs ?? 3e4;
-	assertNonNegativeFinite("withCommit", "postCommitTimeoutMs", postCommitTimeoutMs);
+	assertTimerDelay("withCommit", "postCommitTimeoutMs", postCommitTimeoutMs);
 	if (deps.signal?.aborted) throw abortReason(deps.signal, "withCommit aborted before opening a transaction");
 	const { result, commitRecords, events } = await deps.scope.transactional(async (ctx) => {
 		const tokenScope = createCommitTokenScope();
@@ -606,44 +622,64 @@ async function withCommit(deps, fn) {
 		} finally {
 			tokenScope.close();
 		}
-		const commitRecords = tokenScope.resolve(fnResult.commits);
-		const candidates = commitRecords.flatMap((record) => {
-			const agg = record.aggregate;
-			if (record.events.length > 0 && record.persistedVersion !== void 0 && record.version <= record.persistedVersion) throw new EventHarvestError(`withCommit: aggregate ${String(agg.id)} recorded events but did not advance its version beyond the persisted version (${String(record.persistedVersion)}). An eventful commit needs a unique cursor; use StateStoredAggregate.setState(currentState, event) instead of addDomainEvent(event) alone.`);
-			const enrolledId = String(agg.id);
-			const enrolledType = record.eventLifecycle.aggregateType();
-			return record.events.map((event, index) => {
-				if (!isRecordedDomainEvent(event)) throw new EventHarvestError(`withCommit: event "${event.type}" has not been recorded. Call recordPendingEvents(aggregate, createStamp) in the application shell before persistence or outbox harvest.`, event.type);
-				const recordedEvent = event;
-				const commitSize = record.events.length;
-				const aggregateId = recordedEvent.aggregateId;
-				const aggregateType = recordedEvent.aggregateType;
-				const missing = [];
-				if (!aggregateId) missing.push("aggregateId");
-				if (!aggregateType) missing.push("aggregateType");
-				if (!aggregateId || !aggregateType) throw new EventHarvestError(`withCommit: event "${recordedEvent.type}" is missing ${missing.join(" and ")}. Use this.createEvent(type, payload) inside aggregate methods instead of createDomainEvent(...); createEvent auto-injects aggregateId and aggregateType. Outbox dispatchers and projection handlers rely on the envelope source.`, recordedEvent.type);
-				if (aggregateId !== enrolledId || aggregateType !== enrolledType) throw new EventHarvestError(`withCommit: event "${recordedEvent.type}" is addressed to ${aggregateType} ${aggregateId} but was enrolled under ${enrolledType} ${enrolledId}. The aggregate base classes stamp the address on every recording path; an instance from another package copy must stamp it the same way.`, recordedEvent.type);
-				return Object.freeze({
-					event: recordedEvent,
-					source: Object.freeze({
-						aggregateId,
-						aggregateType
-					}),
-					position: Object.freeze({
-						aggregateVersion: record.version,
-						commitSequence: index,
-						commitSize
-					})
+		try {
+			const commitRecords = tokenScope.resolve(fnResult.commits);
+			const candidates = commitRecords.flatMap((record) => {
+				const enrolled = record.aggregate.aggregateIdentity;
+				if (record.events.length > 0 && record.persistedVersion !== void 0 && record.version <= record.persistedVersion) throw new EventHarvestError(`withCommit: aggregate ${describeAggregateIdentity(enrolled)} recorded events but did not advance its version beyond the persisted version (${String(record.persistedVersion)}). An eventful commit needs a unique cursor; use StateStoredAggregate.setState(currentState, event) instead of addDomainEvent(event) alone.`);
+				const enrolledId = enrolled.aggregateId;
+				const enrolledType = enrolled.aggregateType;
+				return record.events.map((event, index) => {
+					if (!isRecordedDomainEvent(event)) throw new EventHarvestError(`withCommit: event "${event.type}" has not been recorded. Call recordPendingEvents(aggregate, createStamp) in the application shell before persistence or outbox harvest.`, event.type);
+					const recordedEvent = event;
+					const commitSize = record.events.length;
+					const aggregateId = recordedEvent.aggregateId;
+					const aggregateType = recordedEvent.aggregateType;
+					const missing = [];
+					if (!aggregateId) missing.push("aggregateId");
+					if (!aggregateType) missing.push("aggregateType");
+					if (!aggregateId || !aggregateType) throw new EventHarvestError(`withCommit: event "${recordedEvent.type}" is missing ${missing.join(" and ")}. Use this.createEvent(type, payload) inside aggregate methods instead of createDomainEvent(...); createEvent auto-injects aggregateId and aggregateType. Outbox dispatchers and projection handlers rely on the envelope source.`, recordedEvent.type);
+					if (aggregateId !== enrolledId || aggregateType !== enrolledType) throw new EventHarvestError(`withCommit: event "${recordedEvent.type}" belongs to ${describeAggregateIdentity({
+						aggregateType,
+						aggregateId
+					})} but was enrolled under ${describeAggregateIdentity({
+						aggregateType: enrolledType,
+						aggregateId: enrolledId
+					})}. The aggregate base classes stamp the aggregate identity on every recording path; an instance from another package copy must stamp it the same way.`, recordedEvent.type);
+					return Object.freeze({
+						event: recordedEvent,
+						source: Object.freeze({
+							aggregateId,
+							aggregateType
+						}),
+						position: Object.freeze({
+							aggregateVersion: record.version,
+							commitSequence: index,
+							commitSize
+						})
+					});
 				});
 			});
-		});
-		if (candidates.length > 0) await deps.outbox.add(candidates);
-		return {
-			result: fnResult.result,
-			commitRecords,
-			events: candidates.map(({ event }) => event)
-		};
-	}, { signal: deps.signal });
+			const endedSources = commitRecords.filter((record) => record.disposition === "deleted").map((record) => detachAggregateIdentity(record.aggregate.aggregateIdentity));
+			if (candidates.length > 0) await deps.outbox.add(Object.freeze(candidates));
+			if (endedSources.length > 0) await deps.outbox.endEventSources(Object.freeze(endedSources));
+			fnResult.checkBeforeCommit?.();
+			if (candidates.length > 0 || endedSources.length > 0) {
+				for (const record of commitRecords) if (enrollmentDiverged(record)) throw new EventHarvestError(`withCommit: aggregate ${describeAggregateIdentity(record.aggregate.aggregateIdentity)} changed while its outbox write ran. Await every change inside the work callback.`);
+			}
+			return {
+				result: fnResult.result,
+				commitRecords,
+				events: candidates.map(({ event }) => event)
+			};
+		} catch (error) {
+			fnResult.onFailureBeforeCommit?.(error);
+			throw error;
+		}
+	}, {
+		signal: deps.signal,
+		onAttemptStart
+	});
 	const persistedObservations = [];
 	for (const { aggregate, eventLifecycle, disposition, version, events: committedEvents } of commitRecords) try {
 		if (disposition === "deleted") eventLifecycle.discardPendingEvents(committedEvents);
@@ -753,11 +789,21 @@ var QueryBus = class {
 * limit rejects a new address before mutation; delivery state is never
 * silently evicted.
 *
-* **Not transaction-aware**, the same documented limitation as the
-* other in-memory references: a rolled-back `schedule` or `cancel`
-* stays applied here. The transactional half of the contract is the
-* SQL adapter's job; prove it with `createDeadlineStoreContractTests`
-* and its rollback capability.
+* On its own, the store knows nothing about your `TransactionScope`
+* rollbacks: a rolled-back `schedule` or `cancel` stays applied. Register
+* the store with an `InMemoryTransactionScope` for tests that roll back or
+* retry.
+*
+* A processor reads only committed deadlines. While a transaction is open,
+* `due` skips a deadline that the transaction scheduled. For an address that
+* the transaction rescheduled or cancelled, it returns the committed
+* deadline as it was at the first write of the transaction. A failure report
+* against that deadline counts its attempts. At the ceiling, `due` stops
+* returning it until the transaction ends. A rollback also undoes an acknowledgement or a failure report
+* that a processor made while the transaction was open. The processor then
+* delivers that deadline again. For production, prove the transactional half
+* of the contract with `createDeadlineStoreContractTests` and its rollback
+* capability.
 *
 * Payloads are deep-copied on schedule and on delivery
 * (`structuredClone`), so neither side can mutate the other's copy.
@@ -769,6 +815,11 @@ var InMemoryDeadlineStore = class {
 	maxDeliveryAttempts;
 	maxRecords;
 	nextSequence = 0;
+	/**
+	* The committed deadline of each address that the open transaction wrote,
+	* captured at its first write. `undefined` marks an address without one.
+	*/
+	committedVersions;
 	constructor(options = {}) {
 		const max = options.maxDeliveryAttempts ?? 5;
 		assertPositiveInteger("InMemoryDeadlineStore", "maxDeliveryAttempts", max);
@@ -776,8 +827,38 @@ var InMemoryDeadlineStore = class {
 		if (options.maxRecords !== void 0) assertPositiveSafeInteger("InMemoryDeadlineStore", "maxRecords", options.maxRecords);
 		this.maxRecords = options.maxRecords;
 	}
+	/**
+	* Records the state that a rollback of an `InMemoryTransactionScope`
+	* returns to: the pending and the dead-letter records. The rollback
+	* keeps the sequence counter, as a database sequence does, so a
+	* delivery id stays unique. Until the transaction ends, `due` returns the
+	* committed deadline of each address that the transaction writes.
+	*/
+	beginTransaction() {
+		const pending = [...this.pending].map(([key, deadline]) => [key, { ...deadline }]);
+		const dead = [...this.dead].map(([deliveryId, deadline]) => [deliveryId, { ...deadline }]);
+		const versions = /* @__PURE__ */ new Map();
+		this.committedVersions = versions;
+		const end = () => {
+			if (this.committedVersions === versions) this.committedVersions = void 0;
+		};
+		return {
+			commit: end,
+			rollback: () => {
+				this.pending.clear();
+				for (const [key, deadline] of pending) this.pending.set(key, { ...deadline });
+				this.dead.clear();
+				for (const [deliveryId, deadline] of dead) this.dead.set(deliveryId, { ...deadline });
+				end();
+			}
+		};
+	}
 	async schedule(deadline) {
-		const deadlineAddress = address(deadline.scope, deadline.key);
+		const scope = deadline.scope;
+		const key = deadline.key;
+		const dueAt = new Date(deadline.dueAt);
+		const payload = structuredClone(deadline.payload);
+		const deadlineAddress = address(scope, key);
 		if (!this.pending.has(deadlineAddress) && this.maxRecords !== void 0 && this.pending.size + this.dead.size >= this.maxRecords) throw new InMemoryCapacityExceededError({
 			store: "InMemoryDeadlineStore",
 			resource: "records",
@@ -786,26 +867,54 @@ var InMemoryDeadlineStore = class {
 			attempted: 1
 		});
 		const sequence = this.nextSequence++;
-		this.pending.set(deadlineAddress, {
+		const incarnation = {
 			deliveryId: `deadline-${sequence}`,
-			scope: deadline.scope,
-			key: deadline.key,
-			dueAt: new Date(deadline.dueAt),
-			payload: structuredClone(deadline.payload),
+			scope,
+			key,
+			dueAt,
+			payload,
 			attempts: 0,
 			sequence
-		});
+		};
+		this.recordCommittedVersion(deadlineAddress);
+		this.pending.set(deadlineAddress, incarnation);
 	}
 	async cancel(scope, key) {
-		this.pending.delete(address(scope, key));
+		const deadlineAddress = address(scope, key);
+		this.recordCommittedVersion(deadlineAddress);
+		this.pending.delete(deadlineAddress);
 	}
 	async due(now, limit) {
 		if (!Number.isInteger(limit) || limit < 0) throw new Error(`InMemoryDeadlineStore: limit must be an integer >= 0, got ${limit}`);
 		if (limit === 0) return [];
-		return [...this.pending.values()].filter((deadline) => deadline.dueAt.getTime() <= now.getTime()).sort((a, b) => a.dueAt.getTime() - b.dueAt.getTime() || a.sequence - b.sequence).slice(0, limit).map((deadline) => toRecord(deadline));
+		return this.committedPending().filter((deadline) => deadline.dueAt.getTime() <= now.getTime()).sort((a, b) => a.dueAt.getTime() - b.dueAt.getTime() || a.sequence - b.sequence).slice(0, limit).map((deadline) => toRecord(deadline));
+	}
+	recordCommittedVersion(deadlineAddress) {
+		const versions = this.committedVersions;
+		if (versions === void 0 || versions.has(deadlineAddress)) return;
+		const committed = this.pending.get(deadlineAddress);
+		versions.set(deadlineAddress, committed === void 0 ? void 0 : { ...committed });
+	}
+	/**
+	* The pending deadlines that a processor may see. For an address that the
+	* open transaction wrote, it is the committed deadline, if any, and not
+	* the live record.
+	*/
+	committedPending() {
+		const versions = this.committedVersions;
+		if (versions === void 0) return [...this.pending.values()];
+		const deadlines = [...this.pending].filter(([deadlineAddress]) => !versions.has(deadlineAddress)).map(([, deadline]) => deadline);
+		for (const committed of versions.values()) if (committed !== void 0) deadlines.push(committed);
+		return deadlines;
+	}
+	/** The address of the committed deadline with this delivery id, if any. */
+	committedVersionAddress(deliveryId) {
+		for (const [deadlineAddress, committed] of this.committedVersions ?? []) if (committed?.deliveryId === deliveryId) return deadlineAddress;
 	}
 	async markDelivered(deliveryIds) {
 		for (const deliveryId of deliveryIds) {
+			const committedAddress = this.committedVersionAddress(deliveryId);
+			if (committedAddress !== void 0) this.committedVersions?.set(committedAddress, void 0);
 			this.dead.delete(deliveryId);
 			for (const [key, deadline] of this.pending) if (deadline.deliveryId === deliveryId) {
 				this.pending.delete(key);
@@ -825,6 +934,14 @@ var InMemoryDeadlineStore = class {
 			}
 			return;
 		}
+		const committedAddress = this.committedVersionAddress(deliveryId);
+		const committed = committedAddress === void 0 ? void 0 : this.committedVersions?.get(committedAddress);
+		if (committedAddress !== void 0 && committed !== void 0) {
+			committed.attempts += 1;
+			if (error !== void 0) committed.lastError = String(error);
+			if (committed.attempts >= this.maxDeliveryAttempts) this.committedVersions?.set(committedAddress, void 0);
+			return;
+		}
 	}
 	async deadLetters() {
 		return [...this.dead.values()].sort((a, b) => a.sequence - b.sequence).map(toDeadLetter);
@@ -995,9 +1112,9 @@ var PollLoop = class {
 		this.pollIntervalMs = options.pollIntervalMs ?? 250;
 		this.baseDelayMs = options.baseDelayMs ?? 50;
 		this.maxDelayMs = options.maxDelayMs ?? 5e3;
-		assertNonNegativeFinite(context, "pollIntervalMs", this.pollIntervalMs);
-		assertNonNegativeFinite(context, "baseDelayMs", this.baseDelayMs);
-		assertNonNegativeFinite(context, "maxDelayMs", this.maxDelayMs);
+		assertTimerDelay(context, "pollIntervalMs", this.pollIntervalMs);
+		assertTimerDelay(context, "baseDelayMs", this.baseDelayMs);
+		assertTimerDelay(context, "maxDelayMs", this.maxDelayMs);
 		this.jitter = neutralJitterSource(options.random ?? Math.random);
 	}
 	/**
@@ -1158,8 +1275,8 @@ var DeadlineProcessor = class extends PollLoop {
 		this.clock = options.clock ?? (() => /* @__PURE__ */ new Date());
 		this.deliveryTimeoutMs = options.deliveryTimeoutMs ?? 3e4;
 		this.storageTimeoutMs = options.storageTimeoutMs ?? 3e4;
-		assertNonNegativeFinite("DeadlineProcessor", "deliveryTimeoutMs", this.deliveryTimeoutMs);
-		assertNonNegativeFinite("DeadlineProcessor", "storageTimeoutMs", this.storageTimeoutMs);
+		assertTimerDelay("DeadlineProcessor", "deliveryTimeoutMs", this.deliveryTimeoutMs);
+		assertTimerDelay("DeadlineProcessor", "storageTimeoutMs", this.storageTimeoutMs);
 	}
 	/**
 	* One full delivery pass (the `run`/`drainOnce` shell lives on
@@ -1287,14 +1404,26 @@ function positiveSafeInteger(value) {
 * process must configure the limit or use a durable adapter; exhaustion
 * rejects new keys before mutation and never forgets an idempotency decision.
 *
-* It is deliberately not transaction-aware. Claims and staged outcomes carry
-* bounded leases, while every mutation compares the store-minted token. An
-* expired pending claim may be replaced; an expired staged outcome cannot be
-* guessed away and instead returns `reconciliation-required`. Only an
-* authoritative `committed` / `not-committed` decision can settle it.
+* On its own, the store is the reference for the leased family: it cannot
+* see commits or rollbacks. Claims and staged outcomes carry bounded leases,
+* while every mutation compares the store-minted token. An expired pending
+* claim may be replaced; an expired staged outcome cannot be guessed away and
+* instead returns `reconciliation-required`. Only an authoritative
+* `committed` / `not-committed` decision can settle it.
+*
+* Register the store with an `InMemoryTransactionScope` for tests that roll
+* back or retry. A rollback then undoes the writes of `claim` and `complete`,
+* which the port runs inside the transaction. It returns each key that they
+* wrote to its earlier entry. The lease operations `renew`, `confirm`,
+* `abandon`, and `reconcile` stay out of band, as the port defines them. A
+* rollback keeps their writes on every other key. A confirmation that
+* arrives after the next transaction began therefore survives the rollback
+* of that transaction.
 */
 var InMemoryIdempotencyStore = class {
 	entries = /* @__PURE__ */ new Map();
+	/** The entries that `claim` and `complete` replaced in the open transaction. */
+	replacedInTransaction;
 	clock;
 	claimTokenFactory;
 	leaseDurationMs;
@@ -1308,73 +1437,76 @@ var InMemoryIdempotencyStore = class {
 		this.renewAfterMs = options.renewAfterMs ?? Math.floor(this.leaseDurationMs / 2);
 		if (options.maxEntries !== void 0) assertPositiveSafeInteger("InMemoryIdempotencyStore", "maxEntries", options.maxEntries);
 		this.maxEntries = options.maxEntries;
-		if (!positiveSafeInteger(this.leaseDurationMs) || this.leaseDurationMs > 2147483647) throw new RangeError("leaseDurationMs must be a positive safe integer no greater than 2147483647");
-		if (!positiveSafeInteger(this.renewAfterMs) || this.renewAfterMs >= this.leaseDurationMs || this.renewAfterMs > 2147483647) throw new RangeError("renewAfterMs must be a positive safe integer below leaseDurationMs and no greater than 2147483647");
+		if (!positiveSafeInteger(this.leaseDurationMs) || this.leaseDurationMs > 2147483647) throw new RangeError(`leaseDurationMs must be a positive safe integer no greater than ${MAX_TIMER_DELAY_MS}`);
+		if (!positiveSafeInteger(this.renewAfterMs) || this.renewAfterMs >= this.leaseDurationMs || this.renewAfterMs > 2147483647) throw new RangeError(`renewAfterMs must be a positive safe integer below leaseDurationMs and no greater than ${MAX_TIMER_DELAY_MS}`);
 	}
-	async claim(_ctx, key, fingerprint) {
-		const now = this.nowMs();
-		const existing = this.entries.get(key);
-		if (existing === void 0) {
-			if (this.maxEntries !== void 0 && this.entries.size >= this.maxEntries) throw new InMemoryCapacityExceededError({
-				store: "InMemoryIdempotencyStore",
-				resource: "entries",
-				limit: this.maxEntries,
-				current: this.entries.size,
-				attempted: 1
-			});
-			return this.createPending(key, fingerprint, now);
-		}
-		if (existing.fingerprint !== fingerprint) throw new IdempotencyKeyReuseError({
-			key,
-			storedFingerprint: existing.fingerprint,
-			receivedFingerprint: fingerprint
-		});
-		if (existing.status === "confirmed") return {
-			status: "completed",
-			outcome: structuredClone(existing.outcome)
+	/**
+	* Starts to record the entries that `claim` and `complete` replace. The
+	* rollback restores them in reverse order. It keeps the token generation,
+	* so a token from a rolled-back claim never names a later claim.
+	*/
+	beginTransaction() {
+		const replaced = [];
+		this.replacedInTransaction = replaced;
+		const end = () => {
+			if (this.replacedInTransaction === replaced) this.replacedInTransaction = void 0;
 		};
-		if (now < existing.expiresAtMs) throw new IdempotencyInFlightError({ key });
-		if (existing.status === "staged") return {
-			status: "reconciliation-required",
-			reconciliation: Object.freeze({
-				key,
-				fingerprint,
-				token: existing.token,
-				expiredAt: new Date(existing.expiresAtMs).toISOString()
-			})
+		return {
+			commit: end,
+			rollback: () => {
+				for (const [key, entry] of [...replaced].reverse()) if (entry === void 0) this.entries.delete(key);
+				else this.entries.set(key, entry);
+				end();
+			}
 		};
-		return this.createPending(key, fingerprint, now);
+	}
+	async claim(_ctx, key, fingerprint) {
+		const now = this.nowMs();
+		const decided = this.decideFromStoredEntry(key, fingerprint, now);
+		if (decided !== void 0) return decided;
+		const tokenPart = this.newTokenPart();
+		return this.decideFromStoredEntry(key, fingerprint, now) ?? this.createPending(key, fingerprint, now, tokenPart);
 	}
 	async complete(_ctx, claim, outcome) {
+		const { key, token } = claim;
+		const owned = structuredClone(outcome);
 		const now = this.nowMs();
-		const existing = this.entries.get(claim.key);
-		if (existing === void 0) throw new IdempotencyCompletionWithoutClaimError(claim.key);
-		if (existing.status !== "pending" || existing.token !== claim.token || now >= existing.expiresAtMs) throw this.claimLost(claim);
+		const existing = this.entries.get(key);
+		if (existing === void 0) throw new IdempotencyCompletionWithoutClaimError(key);
+		if (existing.status !== "pending" || existing.token !== token || now >= existing.expiresAtMs) throw this.claimLost({
+			key,
+			token
+		});
 		const expiresAtMs = now + this.leaseDurationMs;
 		this.lease(expiresAtMs);
-		this.entries.set(claim.key, {
+		this.writeInTransaction(key, {
 			fingerprint: existing.fingerprint,
 			status: "staged",
 			token: existing.token,
 			expiresAtMs,
-			outcome: structuredClone(outcome)
+			outcome: owned
 		});
 	}
 	async renew(claim) {
+		const { key, token } = claim;
 		const now = this.nowMs();
-		const existing = this.entries.get(claim.key);
-		if (existing === void 0 || existing.status === "confirmed" || existing.token !== claim.token || now >= existing.expiresAtMs) throw this.claimLost(claim);
+		const existing = this.entries.get(key);
+		if (existing === void 0 || existing.status === "confirmed" || existing.token !== token || now >= existing.expiresAtMs) throw this.claimLost({
+			key,
+			token
+		});
 		const expiresAtMs = now + this.leaseDurationMs;
 		const lease = this.lease(expiresAtMs);
-		this.entries.set(claim.key, {
+		this.entries.set(key, {
 			...existing,
 			expiresAtMs
 		});
 		return lease;
 	}
 	async confirm(claim) {
-		const existing = this.entries.get(claim.key);
-		if (existing?.status === "staged" && existing.token === claim.token) this.entries.set(claim.key, {
+		const { key, token } = claim;
+		const existing = this.entries.get(key);
+		if (existing?.status === "staged" && existing.token === token) this.entries.set(key, {
 			fingerprint: existing.fingerprint,
 			status: "confirmed",
 			token: existing.token,
@@ -1382,18 +1514,21 @@ var InMemoryIdempotencyStore = class {
 		});
 	}
 	async abandon(claim) {
-		const existing = this.entries.get(claim.key);
-		if (existing !== void 0 && existing.status !== "confirmed" && existing.token === claim.token) this.entries.delete(claim.key);
+		const { key, token } = claim;
+		const existing = this.entries.get(key);
+		if (existing !== void 0 && existing.status !== "confirmed" && existing.token === token) this.entries.delete(key);
 	}
 	async reconcile(reconciliation, decision) {
+		const { key, token, fingerprint, expiredAt } = reconciliation;
 		if (decision !== "committed" && decision !== "not-committed") throw new TypeError("reconcile decision must be committed or not-committed; uncertainty must leave the record untouched");
-		const existing = this.entries.get(reconciliation.key);
-		if (existing === void 0 || existing.status !== "staged" || existing.token !== reconciliation.token || existing.fingerprint !== reconciliation.fingerprint || new Date(existing.expiresAtMs).toISOString() !== reconciliation.expiredAt || this.nowMs() < existing.expiresAtMs) throw new IdempotencyClaimLostError({
-			key: reconciliation.key,
-			token: reconciliation.token
+		const now = this.nowMs();
+		const existing = this.entries.get(key);
+		if (existing === void 0 || existing.status !== "staged" || existing.token !== token || existing.fingerprint !== fingerprint || new Date(existing.expiresAtMs).toISOString() !== expiredAt || now < existing.expiresAtMs) throw new IdempotencyClaimLostError({
+			key,
+			token
 		});
 		if (decision === "committed") {
-			this.entries.set(reconciliation.key, {
+			this.entries.set(key, {
 				fingerprint: existing.fingerprint,
 				status: "confirmed",
 				token: existing.token,
@@ -1401,7 +1536,7 @@ var InMemoryIdempotencyStore = class {
 			});
 			return;
 		}
-		this.entries.delete(reconciliation.key);
+		this.entries.delete(key);
 	}
 	/** Test hook: number of stored records in any state. */
 	get size() {
@@ -1411,15 +1546,55 @@ var InMemoryIdempotencyStore = class {
 	clear() {
 		this.entries.clear();
 	}
-	createPending(key, fingerprint, now) {
+	/**
+	* Returns the claim that the stored entry of the key decides, or
+	* `undefined` when the store can create a pending claim. Throws for a
+	* reused key, a claim in flight, and a full store.
+	*/
+	decideFromStoredEntry(key, fingerprint, now) {
+		const existing = this.entries.get(key);
+		if (existing === void 0) {
+			if (this.maxEntries !== void 0 && this.entries.size >= this.maxEntries) throw new InMemoryCapacityExceededError({
+				store: "InMemoryIdempotencyStore",
+				resource: "entries",
+				limit: this.maxEntries,
+				current: this.entries.size,
+				attempted: 1
+			});
+			return;
+		}
+		if (existing.fingerprint !== fingerprint) throw new IdempotencyKeyReuseError({
+			key,
+			storedFingerprint: existing.fingerprint,
+			receivedFingerprint: fingerprint
+		});
+		if (existing.status === "confirmed") return {
+			status: "completed",
+			outcome: structuredClone(existing.outcome)
+		};
+		if (now < existing.expiresAtMs) throw new IdempotencyInFlightError({ key });
+		if (existing.status === "staged") return {
+			status: "reconciliation-required",
+			reconciliation: Object.freeze({
+				key,
+				fingerprint,
+				token: existing.token,
+				expiredAt: new Date(existing.expiresAtMs).toISOString()
+			})
+		};
+	}
+	newTokenPart() {
 		const tokenPart = this.claimTokenFactory();
 		if (typeof tokenPart !== "string" || tokenPart.length === 0) throw new TypeError("claimTokenFactory must return a non-empty string");
+		return tokenPart;
+	}
+	createPending(key, fingerprint, now, tokenPart) {
 		this.tokenGeneration += 1;
 		if (!Number.isSafeInteger(this.tokenGeneration)) throw new RangeError("idempotency claim-token generation exhausted");
 		const token = `${this.tokenGeneration}:${tokenPart}`;
 		const expiresAtMs = now + this.leaseDurationMs;
 		const lease = this.lease(expiresAtMs);
-		this.entries.set(key, {
+		this.writeInTransaction(key, {
 			fingerprint,
 			status: "pending",
 			token,
@@ -1434,6 +1609,10 @@ var InMemoryIdempotencyStore = class {
 			})
 		};
 	}
+	writeInTransaction(key, entry) {
+		this.replacedInTransaction?.push([key, this.entries.get(key)]);
+		this.entries.set(key, entry);
+	}
 	lease(expiresAtMs) {
 		return Object.freeze({
 			expiresAt: new Date(expiresAtMs).toISOString(),
@@ -1467,7 +1646,7 @@ function startLeaseHeartbeat(store, claim) {
 	let heartbeatFailure;
 	const schedule = (delayMs) => {
 		if (!validRenewAfterMs(delayMs)) {
-			heartbeatFailure = /* @__PURE__ */ new TypeError("IdempotencyStore returned an invalid lease renewAfterMs; expected a positive safe integer no greater than 2147483647");
+			heartbeatFailure = /* @__PURE__ */ new TypeError(`IdempotencyStore returned an invalid lease renewAfterMs; expected a positive safe integer no greater than ${MAX_TIMER_DELAY_MS}`);
 			return;
 		}
 		timer = setTimeout(() => {
@@ -1677,13 +1856,13 @@ async function withIdempotentCommit(deps, request, fn) {
 }
 
 //#endregion
-//#region src/domain/aggregate/aggregate-address.ts
+//#region src/domain/aggregate/aggregate-identity.ts
 /**
 * Collision-safe map-key encoding shared by the in-memory adapters.
 * Internal: durable adapters key on the two storage columns themselves.
 */
-function encodeAggregateAddress(address) {
-	return JSON.stringify([address.aggregateType, address.aggregateId]);
+function encodeAggregateIdentity(identity) {
+	return JSON.stringify([identity.aggregateType, identity.aggregateId]);
 }
 
 //#endregion
@@ -1707,16 +1886,19 @@ function isPositionAfter(candidate, reference) {
 * serves tests and in-memory read models.
 *
 * Its checkpoint-key locks serialize competing projectors only inside one
-* process and only when they share this store instance. It is **not
-* transaction-aware** (the `ctx` parameter is ignored): a rolled-back
-* projector batch does not roll back its checkpoints. Use it for tests and
-* disposable in-memory read models; production atomicity is the durable
-* adapter's contract, proved with `createProjectionCheckpointStoreContractTests`
-* and its rollback capability.
+* process and only when they share this store instance. The store ignores
+* the `ctx` parameter. On its own, it knows nothing about your
+* `TransactionScope` rollbacks: a rolled-back projector batch keeps its
+* checkpoints. Register the store with an `InMemoryTransactionScope` for
+* tests that roll back or retry. While a transaction is open, `hasReached`
+* answers from the checkpoints at the start of the transaction. Use it for
+* tests and disposable in-memory read models; production atomicity is the
+* durable adapter's contract, proved with
+* `createProjectionCheckpointStoreContractTests` and its rollback capability.
 *
 * Without `maxCheckpoints`, checkpoint retention is unbounded and supported
 * only for finite-lifetime tests and demos. A configured limit rejects a new
-* address before mutation; existing watermarks remain updatable and are never
+* identity before mutation; existing watermarks remain updatable and are never
 * evicted because forgetting one would change projection correctness.
 *
 * Do not nest `withCheckpointLocks` calls whose key sets overlap. This
@@ -1731,15 +1913,40 @@ var InMemoryProjectionCheckpointStore = class {
 	lockTails = /* @__PURE__ */ new Map();
 	maxCheckpoints;
 	checkpointCount = 0;
+	/** The checkpoints at the start of the open transaction. */
+	committedCheckpoints;
 	constructor(options = {}) {
 		if (options.maxCheckpoints !== void 0) assertPositiveSafeInteger("InMemoryProjectionCheckpointStore", "maxCheckpoints", options.maxCheckpoints);
 		this.maxCheckpoints = options.maxCheckpoints;
 	}
-	async withCheckpointLocks(_ctx, projection, addresses, work) {
-		const keys = [...new Set(addresses.map((address) => JSON.stringify([
+	/**
+	* Records the state that a rollback of an `InMemoryTransactionScope`
+	* returns to: the checkpoints and their count. Until the transaction
+	* ends, `hasReached` reads these recorded checkpoints. The rollback
+	* keeps the checkpoint locks, because a caller still holds them.
+	*/
+	beginTransaction() {
+		const committed = new Map([...this.checkpoints].map(([projection, perAggregate]) => [projection, new Map(perAggregate)]));
+		const checkpointCount = this.checkpointCount;
+		this.committedCheckpoints = committed;
+		const end = () => {
+			if (this.committedCheckpoints === committed) this.committedCheckpoints = void 0;
+		};
+		return {
+			commit: end,
+			rollback: () => {
+				this.checkpoints.clear();
+				for (const [projection, perAggregate] of committed) this.checkpoints.set(projection, new Map(perAggregate));
+				this.checkpointCount = checkpointCount;
+				end();
+			}
+		};
+	}
+	async withCheckpointLocks(_ctx, projection, identities, work) {
+		const keys = [...new Set(identities.map((identity) => JSON.stringify([
 			projection,
-			address.aggregateType,
-			address.aggregateId
+			identity.aggregateType,
+			identity.aggregateId
 		])))].sort();
 		const releases = [];
 		for (const key of keys) {
@@ -1762,17 +1969,22 @@ var InMemoryProjectionCheckpointStore = class {
 			for (let index = releases.length - 1; index >= 0; index -= 1) releases[index]?.();
 		}
 	}
-	async load(_ctx, projection, address) {
-		const stored = this.checkpoints.get(projection)?.get(encodeAggregateAddress(address));
+	async load(_ctx, projection, identity) {
+		const stored = this.checkpoints.get(projection)?.get(encodeAggregateIdentity(identity));
 		return stored === void 0 ? void 0 : {
 			...stored,
 			position: { ...stored.position }
 		};
 	}
-	async save(_ctx, projection, address, checkpoint) {
-		const addressKey = encodeAggregateAddress(address);
+	async save(_ctx, projection, identity, checkpoint) {
+		const identityKey = encodeAggregateIdentity(identity);
+		const { position, ...rest } = checkpoint;
+		const owned = {
+			...rest,
+			position: { ...position }
+		};
 		let perAggregate = this.checkpoints.get(projection);
-		const isNewCheckpoint = perAggregate?.has(addressKey) !== true;
+		const isNewCheckpoint = perAggregate?.has(identityKey) !== true;
 		if (isNewCheckpoint && this.maxCheckpoints !== void 0 && this.checkpointCount >= this.maxCheckpoints) throw new InMemoryCapacityExceededError({
 			store: "InMemoryProjectionCheckpointStore",
 			resource: "checkpoints",
@@ -1784,14 +1996,11 @@ var InMemoryProjectionCheckpointStore = class {
 			perAggregate = /* @__PURE__ */ new Map();
 			this.checkpoints.set(projection, perAggregate);
 		}
-		perAggregate.set(addressKey, {
-			...checkpoint,
-			position: { ...checkpoint.position }
-		});
+		perAggregate.set(identityKey, owned);
 		if (isNewCheckpoint) this.checkpointCount += 1;
 	}
-	async hasReached(projection, address, position) {
-		const stored = this.checkpoints.get(projection)?.get(encodeAggregateAddress(address));
+	async hasReached(projection, identity, position) {
+		const stored = (this.committedCheckpoints ?? this.checkpoints).get(projection)?.get(encodeAggregateIdentity(identity));
 		if (stored === void 0) return false;
 		return !isPositionAfter(position, stored.position);
 	}
@@ -1870,8 +2079,8 @@ function projectionFromHandlers(options) {
 *   Because checkpoints advance only across a verified chain, a position
 *   at or behind the watermark is already traversed and can be skipped under
 *   the source's one-logical-event-per-position contract.
-* - **Feeds are complete per aggregate address.** Once a feed supplies one
-*   address, it must supply every committed envelope in that address's cursor
+* - **Feeds are complete per aggregate identity.** Once a feed supplies one
+*   identity, it must supply every committed envelope in that aggregate's cursor
 *   chain. Do not event-type-filter a projector subscription. Irrelevant event
 *   types are explicit no-ops in `Projection.apply`; invoking the handler and
 *   checkpointing their positions preserves continuity.
@@ -1890,13 +2099,13 @@ function projectionFromHandlers(options) {
 *   redeliveries.
 * - **Malformed envelopes reject loudly.** A missing/empty `eventId`, a
 *   missing/invalid `position`, missing `source.aggregateId` /
-*   `source.aggregateType`, or an optional event address contradicting its
+*   `source.aggregateType`, or an optional event identity contradicting its
 *   authoritative envelope source fails the batch BEFORE anything is applied.
 *   The domain event remains persistence-agnostic.
 * - **Competing instances serialize by checkpoint key.** The required
 *   {@link ProjectionCheckpointStore.withCheckpointLocks} callback covers the
-*   complete load / apply / save critical section for every addressed
-*   aggregate. The adapter must lock a key even when its checkpoint row does
+*   complete load / apply / save critical section for every aggregate of
+*   the batch. The adapter must lock a key even when its checkpoint row does
 *   not exist yet; a plain row lock is insufficient at genesis. Without that
 *   adapter guarantee, only a hard single-projector deployment is safe.
 *
@@ -1924,7 +2133,7 @@ var Projector = class {
 	* per advanced aggregate. Rejects
 	* (after rollback) when a handler throws or an envelope carries no
 	* valid cursor; the caller's at-least-once redelivery retries the batch.
-	* The input must be a complete, ordered feed per aggregate address; an
+	* The input must be a complete, ordered feed per aggregate identity; an
 	* event-type-filtered subscription cannot satisfy the cursor contract.
 	* An already-aborted signal rejects before validation or transaction setup.
 	* In-flight cancellation is forwarded to the transaction scope rather than
@@ -1955,36 +2164,36 @@ var Projector = class {
 			return {
 				event,
 				position,
-				address: {
+				identity: {
 					aggregateType,
 					aggregateId
 				}
 			};
 		});
-		const lockAddresses = [...new Map(cursored.map(({ address }) => [encodeAggregateAddress(address), address])).entries()].sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([, address]) => address);
+		const lockIdentities = [...new Map(cursored.map(({ identity }) => [encodeAggregateIdentity(identity), identity])).entries()].sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([, identity]) => identity);
 		const projectWithLocks = async (ctx) => {
 			let applied = 0;
 			let skipped = 0;
 			const checkpointsAtBatchStart = /* @__PURE__ */ new Map();
 			const watermarks = /* @__PURE__ */ new Map();
-			for (const { event, address } of cursored) {
-				const key = encodeAggregateAddress(address);
+			for (const { event, identity } of cursored) {
+				const key = encodeAggregateIdentity(identity);
 				if (watermarks.has(key)) continue;
-				const stored = await this.checkpoints.load(ctx, this.projection.name, address);
+				const stored = await this.checkpoints.load(ctx, this.projection.name, identity);
 				if (stored !== void 0 && !isValidCheckpoint(stored)) throw new UnprojectableEventError(this.projection.name, event.eventId, "found a stored checkpoint with an invalid or legacy cursor. Migrate the commitSize/previousEventfulAggregateVersion/lastAppliedEventId columns or reset and rebuild this projection.");
 				checkpointsAtBatchStart.set(key, stored);
 				watermarks.set(key, stored?.position);
 			}
-			for (const { event, position, address } of cursored) {
-				const stored = checkpointsAtBatchStart.get(encodeAggregateAddress(address));
+			for (const { event, position, identity } of cursored) {
+				const stored = checkpointsAtBatchStart.get(encodeAggregateIdentity(identity));
 				if (stored !== void 0 && isSameOrderedPosition(position, stored.position)) {
 					if (event.eventId !== stored.lastAppliedEventId) throw new ProjectionIdentityViolationError(this.projection.name, event.eventId, stored.lastAppliedEventId, formatPosition(position));
 					if (!isSamePositionReceipt(position, stored.position)) throw new ProjectionReceiptViolationError(this.projection.name, event.eventId, formatReceipt(stored.position), formatReceipt(position));
 				}
 			}
 			const batchReceiptsByPosition = /* @__PURE__ */ new Map();
-			for (const { event, position, address } of cursored) {
-				const key = addressedPositionKey(address, position);
+			for (const { event, position, identity } of cursored) {
+				const key = aggregatePositionKey(identity, position);
 				const recorded = batchReceiptsByPosition.get(key);
 				if (recorded !== void 0 && recorded.eventId !== event.eventId) throw new ProjectionIdentityViolationError(this.projection.name, event.eventId, recorded.eventId, formatPosition(position));
 				if (recorded !== void 0 && !isSamePositionReceipt(position, recorded.position)) throw new ProjectionReceiptViolationError(this.projection.name, event.eventId, formatReceipt(recorded.position), formatReceipt(position));
@@ -1995,11 +2204,11 @@ var Projector = class {
 			}
 			const newestUnprocessed = /* @__PURE__ */ new Map();
 			const positionsSeenInBatch = /* @__PURE__ */ new Set();
-			for (const { event, position, address } of cursored) {
-				const key = encodeAggregateAddress(address);
+			for (const { event, position, identity } of cursored) {
+				const key = encodeAggregateIdentity(identity);
 				const stored = watermarks.get(key);
 				if (stored !== void 0 && !isPositionAfter(position, stored)) continue;
-				const positionKey = addressedPositionKey(address, position);
+				const positionKey = aggregatePositionKey(identity, position);
 				if (positionsSeenInBatch.has(positionKey)) continue;
 				positionsSeenInBatch.add(positionKey);
 				const newest = newestUnprocessed.get(key);
@@ -2008,8 +2217,8 @@ var Projector = class {
 			}
 			const advanced = /* @__PURE__ */ new Map();
 			const toApply = [];
-			for (const { event, position, address } of cursored) {
-				const key = encodeAggregateAddress(address);
+			for (const { event, position, identity } of cursored) {
+				const key = encodeAggregateIdentity(identity);
 				const watermark = watermarks.get(key);
 				if (watermark !== void 0 && !isPositionAfter(position, watermark)) {
 					skipped += 1;
@@ -2018,7 +2227,7 @@ var Projector = class {
 				if (!isContiguousPosition(position, watermark)) throw new ProjectionGapError(this.projection.name, event.eventId, formatPosition(watermark), formatPosition(position));
 				watermarks.set(key, position);
 				advanced.set(key, {
-					address,
+					identity,
 					checkpoint: {
 						position,
 						lastAppliedEventId: event.eventId
@@ -2028,23 +2237,23 @@ var Projector = class {
 				applied += 1;
 			}
 			for (const { event } of toApply) await this.projection.apply(ctx, event);
-			for (const { address, checkpoint } of advanced.values()) await this.checkpoints.save(ctx, this.projection.name, address, checkpoint);
+			for (const { identity, checkpoint } of advanced.values()) await this.checkpoints.save(ctx, this.projection.name, identity, checkpoint);
 			return {
 				applied,
 				skipped
 			};
 		};
-		return this.scope.transactional((ctx) => this.checkpoints.withCheckpointLocks(ctx, this.projection.name, lockAddresses, () => projectWithLocks(ctx)), { signal: options.signal });
+		return this.scope.transactional((ctx) => this.checkpoints.withCheckpointLocks(ctx, this.projection.name, lockIdentities, () => projectWithLocks(ctx)), { signal: options.signal });
 	}
 	/**
 	* The wait-for-version query: `true` when this projection has
-	* processed the addressed aggregate at least up to `position`. Pass the
+	* processed the given aggregate at least up to `position`. Pass the
 	* position of the last event the awaited commit emitted (see
 	* {@link ProjectionCheckpointStore.hasReached} for why the full
 	* cursor, not just the version).
 	*/
-	hasProcessed(address, position) {
-		return this.checkpoints.hasReached(this.projection.name, address, position);
+	hasProcessed(identity, position) {
+		return this.checkpoints.hasReached(this.projection.name, identity, position);
 	}
 	/**
 	* Rebuild entry point: one transaction that clears this
@@ -2052,7 +2261,7 @@ var Projector = class {
 	* `truncate`, the read model with them. Replay the source through
 	* {@link Projector.project} afterwards. Stop all live consumers for this
 	* projection before reset and keep them stopped through catch-up replay;
-	* rebuild is not coordinated by the per-address delivery locks.
+	* rebuild is not coordinated by the per-aggregate delivery locks.
 	*/
 	async reset() {
 		await this.scope.transactional(async (ctx) => {
@@ -2098,10 +2307,10 @@ function isSameOrderedPosition(left, right) {
 function isSamePositionReceipt(left, right) {
 	return isSameOrderedPosition(left, right) && left.commitSize === right.commitSize && left.previousEventfulAggregateVersion === right.previousEventfulAggregateVersion;
 }
-function addressedPositionKey(address, position) {
+function aggregatePositionKey(identity, position) {
 	return JSON.stringify([
-		address.aggregateType,
-		address.aggregateId,
+		identity.aggregateType,
+		identity.aggregateId,
 		position.aggregateVersion,
 		position.commitSequence
 	]);
@@ -2121,6 +2330,33 @@ function formatReceipt(position) {
 	return `(${position.aggregateVersion}, ${position.commitSequence}; commitSize=${position.commitSize}, previousEventfulAggregateVersion=${String(position.previousEventfulAggregateVersion)})`;
 }
 
+//#endregion
+//#region src/internal/cause-chain.ts
+/**
+* Cycle-safe, getter-throw-safe walk over `error`'s standard `cause`
+* chain. `visit` runs for every object link (the top error included) and
+* receives the link plus its lazily read `cause`; a non-undefined return
+* stops the walk. A throwing `cause` getter (lazy deserialization, revoked
+* Proxy) ends the walk as no-match instead of replacing the real failure
+* with the getter's exception.
+*/
+function findInCauseChain(error, visit) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	while (current !== null && typeof current === "object" && !seen.has(current)) {
+		seen.add(current);
+		let cause;
+		try {
+			cause = current.cause;
+		} catch {
+			return;
+		}
+		const found = visit(current, cause);
+		if (found !== void 0) return found;
+		current = cause;
+	}
+}
+
 //#endregion
 //#region src/application/unit-of-work/errors.ts
 /**
@@ -2147,10 +2383,13 @@ var NestedUnitOfWorkError = class extends KitWiringError {
 	}
 };
 /**
-* Thrown when the unit-of-work context is used after `run()` has
-* settled: reading `context.repositories`, calling an adapter-held
-* `tracking.trackLoaded`, or using a repository facade after the transaction
-* has committed or rolled back.
+* Thrown when the unit-of-work context is used after the unit of work closed
+* it: reading `context.repositories`, calling an adapter-held
+* `tracking.trackLoaded`, or using a repository facade after the flush of its
+* attempt, while the transaction commits, or after it committed or rolled
+* back. An `add`, `update`, or `remove` between the start of the flush and the
+* last check before the commit fails the attempt with `AggregateTrackingError`
+* instead.
 *
 * Use-after-close is a programming bug (typically a leaked context
 * reference or a fire-and-forget promise outliving the callback), so
@@ -2166,18 +2405,22 @@ var NestedUnitOfWorkError = class extends KitWiringError {
 var TransactionClosedError = class extends KitWiringError {
 	operation;
 	constructor(operation) {
-		super("TRANSACTION_CLOSED", `Unit of work is closed: ${operation} was called after the transaction committed or rolled back. Do not use the context or repository facade or tracking capability outside the run() callback.`);
+		super("TRANSACTION_CLOSED", `Unit of work is closed: ${operation} was called after its attempt ended. Do not use the context, the repository facade, or the tracking capability outside the run() callback, and await all work inside it.`);
 		this.operation = operation;
 	}
 };
 /** A repository factory returned a value that cannot be wrapped as a facade. */
 var InvalidRepositoryAdapterError = class extends KitWiringError {
 	repository;
+	reason;
 	receivedType;
-	constructor(repository, receivedType) {
-		super("INVALID_REPOSITORY_ADAPTER", `Repository factory "${repository}" returned ${receivedType}; it must return an adapter object.`);
-		this.repository = repository;
-		this.receivedType = receivedType;
+	operation;
+	constructor(options) {
+		super("INVALID_REPOSITORY_ADAPTER", options.reason === "not_an_object" ? `Repository factory "${options.repository}" returned ${options.receivedType}; it must return an adapter object.` : `Repository factory "${options.repository}" returned an adapter that defines ${options.operation}. The unit of work installs add, update, and remove on the facade, so an adapter must not define them. Remove ${options.operation} from the adapter.`);
+		this.repository = options.repository;
+		this.reason = options.reason;
+		this.receivedType = options.reason === "not_an_object" ? options.receivedType : void 0;
+		this.operation = options.reason === "defines_lifecycle_operation" ? options.operation : void 0;
 	}
 };
 /** A Unit of Work received repository wiring that bypassed {@link defineRepository}. */
@@ -2190,12 +2433,12 @@ var InvalidRepositoryDefinitionError = class extends KitWiringError {
 };
 /** A repository's persistence-error policy threw or returned a non-kit error. */
 var RepositoryErrorMappingFailedError = class extends KitWiringError {
-	aggregateId;
+	identity;
 	intent;
 	mapperCause;
 	constructor(options) {
-		super("REPOSITORY_ERROR_MAPPING_FAILED", `The repository error mapper failed for ${options.intent} of aggregate ${options.aggregateId}. The original persistence failure is preserved as cause; the mapper failure is available as mapperCause.`, options.persistenceError);
-		this.aggregateId = options.aggregateId;
+		super("REPOSITORY_ERROR_MAPPING_FAILED", `The repository error mapper failed for ${options.intent} of aggregate ${describeAggregateIdentity(options.identity)}. The original persistence failure is preserved as cause; the mapper failure is available as mapperCause.`, options.persistenceError);
+		this.identity = detachAggregateIdentity(options.identity);
 		this.intent = options.intent;
 		this.mapperCause = options.mapperError;
 	}
@@ -2205,36 +2448,51 @@ var RepositoryErrorMappingFailedError = class extends KitWiringError {
 *
 * This is a wiring error, not a persistence failure: the statements cannot
 * run the write the Unit of Work registered, and a retry repeats the same
-* outcome. {@link versionedFlush} raises it during the commit phase, so the
-* repository's `mapError` receives it like a store failure. A mapper must
-* return an `InfrastructureError`. So the use case receives the mapper's own
-* error, and the reason stays in the cause chain.
+* outcome. The commit phase hands it to the caller unchanged, never to the
+* repository's `mapError`, because a mapper returns an `InfrastructureError`
+* and would relabel the defect as a store failure.
 */
 var InvalidFlushStatementError = class extends KitWiringError {
-	aggregateType;
-	aggregateId;
+	identity;
+	/** The write, or `null` when the code that found the defect does not know it. */
 	intent;
 	reason;
-	/** What the statement returned instead of a row count. */
+	/** The value that the flush received in place of a valid one. */
 	received;
 	/** The failure of `isDuplicate`, when the classifier itself threw. */
 	classifierCause;
 	constructor(options) {
 		super("INVALID_FLUSH_STATEMENT", flushStatementReasonMessage(options), options.cause);
-		this.aggregateType = options.aggregateType;
-		this.aggregateId = options.aggregateId;
-		this.intent = options.intent;
+		this.identity = detachAggregateIdentity(options.identity);
+		this.intent = options.intent ?? null;
 		this.reason = options.reason;
 		this.received = options.received;
 		this.classifierCause = options.classifierCause;
 	}
 };
+/**
+* Sets the write intent on a statement defect that its raising code could not
+* name, and renders the message again.
+*/
+function attributeFlushStatementIntent(defect, intent) {
+	if (defect.intent === intent) return;
+	Reflect.set(defect, "intent", intent);
+	rewriteErrorMessage(defect, flushStatementReasonMessage({
+		identity: defect.identity,
+		intent,
+		reason: defect.reason,
+		received: defect.received
+	}));
+}
 function flushStatementReasonMessage(options) {
-	const site = `${options.intent} of ${options.aggregateType}(${options.aggregateId})`;
+	const aggregate = describeAggregateIdentity(options.identity);
+	const site = options.intent == null ? aggregate : `${options.intent} of ${aggregate}`;
+	const statement = options.intent ?? "write";
 	switch (options.reason) {
-		case "statement_absent": return `The Unit of Work registered the ${site}, but the statements carry no ${options.intent}. ` + (options.intent === "remove" ? "A definition with physicalRemoval: true needs a remove statement." : "A definition without appendOnly: true needs an update statement.");
-		case "no_row_count": return `The ${options.intent} statement of the ${site} returned ${options.received ?? "no value"}. It must return the count of rows its predicate matched, so the flush can tell a conflict from a write.`;
-		case "no_expected_version": return `The ${site} carries no expectedVersion. The Unit of Work captures it when the aggregate is loaded, so this write did not come from a loaded aggregate.`;
+		case "statement_absent": return `The Unit of Work registered the ${site}, but the statements carry no ${statement} statement. ` + (options.intent === "remove" ? "A definition with physicalRemoval: true needs a remove statement." : "A definition without appendOnly: true needs an update statement.");
+		case "no_row_count": return `The ${statement} statement of the ${site} returned ${options.received ?? "no value"}. It must return the count of rows its predicate matched, so the flush can tell a conflict from a write.`;
+		case "no_expected_version": return `The ${site} carries no valid expectedVersion` + (options.received === void 0 ? "" : ` (${options.received})`) + ". The Unit of Work captures it when the aggregate is loaded, so this write did not come from a loaded aggregate.";
+		case "no_version": return `The currentVersion statement of ${site} returned ${options.received ?? "no value"}. It must return the stored version, a safe integer of at least 0, or undefined when the aggregate does not exist. Convert a bigint or a numeric string with Number().`;
 		case "duplicate_check_failed": return `The isDuplicate check of the ${site} threw. It must classify the error of insert, never fail. The insert failure is the cause; the failure of the check is in classifierCause.`;
 	}
 }
@@ -2246,25 +2504,29 @@ function flushStatementReasonMessage(options) {
 * cannot execute truthfully. Retrying the same callback cannot repair it.
 */
 var AggregateTrackingError = class extends KitWiringError {
-	aggregateId;
+	identity;
 	operation;
 	reason;
 	registeredIntent;
-	constructor(aggregateId, operation, reason, registeredIntent, options = {}) {
-		super("AGGREGATE_TRACKING", trackingReasonMessage(aggregateId, operation, reason, registeredIntent, options));
-		this.aggregateId = aggregateId;
-		this.operation = operation;
-		this.reason = reason;
-		this.registeredIntent = registeredIntent;
+	constructor(options) {
+		super("AGGREGATE_TRACKING", trackingReasonMessage(options));
+		this.identity = detachAggregateIdentity(options.identity);
+		this.operation = options.operation;
+		this.reason = options.reason;
+		this.registeredIntent = options.registeredIntent;
 	}
 };
-function trackingReasonMessage(aggregateId, operation, reason, registeredIntent, options) {
-	switch (reason) {
-		case "not_loaded": return `Aggregate ${aggregateId} cannot be registered for ${operation}: it was not loaded into this unit of work. Load it through the repository before updating or removing it.`;
-		case "loaded_as_new": return `Aggregate ${aggregateId} cannot be added as new because it was loaded by this unit of work. ` + (options.appendOnly ? "Its repository is append-only, so a loaded aggregate is already persisted and must not change." : "Use update for a loaded aggregate.");
-		case "different_repository": return `Aggregate ${aggregateId} cannot be registered for ${operation} through a different repository in the same unit of work. One aggregate instance must remain owned by the repository definition that first tracked it.`;
-		case "conflicting_intent": return `Aggregate ${aggregateId} is already registered for ${registeredIntent ?? "another write"}; ${operation} would create conflicting persistence intent in one unit of work. Decide the final lifecycle outcome before registering it.`;
-		case "mutated_after_registration": return `Aggregate ${aggregateId} changed after ${registeredIntent ?? "write"} was registered. Make domain decisions first and call add, update, or remove last so persisted state and recorded events cannot diverge.`;
+function trackingReasonMessage(options) {
+	const { operation, registeredIntent } = options;
+	const aggregate = describeAggregateIdentity(options.identity);
+	switch (options.reason) {
+		case "not_loaded": return `Aggregate ${aggregate} cannot be registered for ${operation}: it was not loaded into this unit of work. Load it through the repository before updating or removing it.`;
+		case "loaded_as_new": return `Aggregate ${aggregate} cannot be added as new because it was loaded by this unit of work. ` + (options.appendOnly ? "Its repository is append-only, so a loaded aggregate is already persisted and must not change." : "Use update for a loaded aggregate.");
+		case "different_repository": return `Aggregate ${aggregate} cannot be registered for ${operation} through a different repository in the same unit of work. One aggregate instance must remain owned by the repository definition that first tracked it.`;
+		case "conflicting_intent": return `Aggregate ${aggregate} is already registered for ${registeredIntent ?? "another write"}; ${operation} would create conflicting persistence intent in one unit of work. Decide the final lifecycle outcome before registering it.`;
+		case "mutated_after_registration": return `Aggregate ${aggregate} changed after ${registeredIntent ?? "write"} was registered. Make domain decisions first and call add, update, or remove last so persisted state and recorded events cannot diverge.`;
+		case "registered_during_flush": return `Aggregate ${aggregate} cannot be registered for ${operation}: the unit of work already flushes its writes, so this write cannot join the transaction. Await every repository call inside the run() callback.`;
+		case "identity_already_tracked": return `Aggregate ${aggregate} cannot be registered for ${operation}: this unit of work already tracks another instance with the same identity. Change the tracked instance, or give the new aggregate a new id.`;
 	}
 }
 /**
@@ -2297,29 +2559,44 @@ var CommitError = class extends InfrastructureError {
 	}
 };
 /**
-* The work callback threw AND the transaction scope rejected with a
-* DIFFERENT error that does not wrap the callback's error in its cause
-* chain - the strongest available signal that the rollback itself
-* failed. The callback's (primary) error is preserved as `cause`, so
-* cause-chain helpers (`someChainRetryable`, `findInCauseChain`) still
-* see a wrapped `ConcurrencyConflictError` & co.; the scope's error is
-* carried in {@link rollbackCause}.
-*
-* Scopes that rethrow the original error (Drizzle, Prisma do) never
-* produce this; scopes that WRAP the original are detected via the
-* cause chain and passed through unchanged instead.
+* A step inside the transaction threw, and the transaction scope rejected
+* with a different error that does not wrap that failure in its cause chain.
+* This is the strongest available signal that the rollback itself failed.
+* The step is the work callback, or a step after it and before the commit,
+* for example the outbox write. The failure inside the transaction is the
+* `cause`, so cause-chain helpers (`someChainRetryable`, `findInCauseChain`)
+* still see a wrapped `ConcurrencyConflictError` & co. The scope's error is
+* in {@link rollbackCause}. A wiring error as that failure is the cause too,
+* so both facts stay visible.
+*
+* A scope that rethrows the failure (Drizzle and Prisma do) never produces
+* this. A scope that wraps the failure is detected through the cause chain.
+* A wrapped failure of the work passes through unchanged. A wrapped failure
+* after the work becomes a `CommitError`, or passes through when it is a
+* wiring error.
 */
 var RollbackError = class extends InfrastructureError {
 	rollbackCause;
 	constructor(cause, rollbackCause) {
 		super({
 			code: "ROLLBACK_FAILED",
-			message: "The work callback failed and the transaction scope rejected with a different error (possible rollback failure). The callback's error is the cause; the scope's error is in rollbackCause.",
+			message: "A step inside the transaction failed and the transaction scope rejected with a different error (possible rollback failure). The failure inside the transaction is the cause; the scope's error is in rollbackCause.",
 			cause
 		});
 		this.rollbackCause = rollbackCause;
 	}
 };
+/**
+* The first kit wiring error in the cause chain of `error`, also from another
+* copy of the kit. A wiring error states a defect of the wiring, so the unit
+* of work passes it to the caller and never lets a mapper or a retry
+* relabel it, even when an adapter or a scope wrapped it. If the rollback
+* failed as well, the wiring error becomes the cause of a `RollbackError`,
+* so the rollback failure stays visible.
+*/
+function wiringErrorInCauseChain(error) {
+	return findInCauseChain(error, (link) => isWiringErrorLike(link) ? link : void 0);
+}
 
 //#endregion
 //#region src/domain/aggregate/pending-event-recording.ts
@@ -2347,17 +2624,30 @@ function recordPendingEvents(aggregate, source, stampOptions) {
 //#endregion
 //#region src/application/unit-of-work/repository-facade.ts
 /**
-* Builds the application-facing repository facade. Standard lifecycle writes
-* are always supplied by the Unit of Work; similarly named adapter methods are
-* never invoked. Other methods are bound to the adapter so classes with private
-* fields keep their normal receiver.
+* Builds the application-facing repository facade. The Unit of Work supplies
+* the lifecycle writes, and an adapter that defines its own add, update, or
+* remove is rejected. Other methods are bound to the adapter so classes with private
+* fields keep their normal receiver. A member that returns the adapter itself
+* (a fluent `this`) returns the facade instead. A promise passes unchanged: a
+* raw adapter that it resolves to can only read, because an adapter defines
+* no add, update, or remove.
 */
 function bindRepositoryWrites(adapter, session, definition, repository) {
-	if (adapter === null || typeof adapter !== "object") throw new InvalidRepositoryAdapterError(repository, adapter === null ? "null" : typeof adapter);
+	if (adapter === null || typeof adapter !== "object") throw new InvalidRepositoryAdapterError({
+		repository,
+		reason: "not_an_object",
+		receivedType: adapter === null ? "null" : typeof adapter
+	});
+	for (const operation of REPOSITORY_LIFECYCLE_OPERATIONS) if (hasMemberBelowObjectPrototype(adapter, operation)) throw new InvalidRepositoryAdapterError({
+		repository,
+		reason: "defines_lifecycle_operation",
+		operation
+	});
 	const state = createRepositoryFacadeState(adapter, session, definition);
 	installRepositoryLifecycleOperations(state);
 	forwardAdapterOwnProperties(state);
-	return new Proxy(state.target, createRepositoryFacadeHandler(state));
+	state.facade = new Proxy(state.target, createRepositoryFacadeHandler(state));
+	return state.facade;
 }
 const REPOSITORY_LIFECYCLE_OPERATIONS = [
 	"add",
@@ -2368,6 +2658,7 @@ function createRepositoryFacadeState(source, session, definition) {
 	return {
 		source,
 		target: Object.create(Reflect.getPrototypeOf(source)),
+		facade: void 0,
 		session,
 		definition,
 		methodCache: /* @__PURE__ */ new Map(),
@@ -2382,10 +2673,20 @@ function isRepositoryLifecycleOperation(property) {
 	return REPOSITORY_LIFECYCLE_OPERATIONS.includes(property);
 }
 /**
-* Own-or-inherited presence that stops BEFORE `Object.prototype`: members
-* every object inherits (`toString`, `valueOf`, `constructor`) are language
-* plumbing, not repository surface, and must not trip the facade's
-* session-open assertion.
+* Whether a property read or `in` probe is language plumbing, not a
+* repository member: promise resolution probes `then`, JSON.stringify probes
+* `toJSON`, string interpolation reads `toString`, and inspection utilities
+* read well-known symbols. Only a property present BELOW Object.prototype is
+* repository surface, except `constructor`, which every class prototype
+* carries. Plumbing answers without the session-open assertion, so logging a
+* leaked facade after close cannot mask the original failure.
+*/
+function isLanguagePlumbing(state, property) {
+	return property === "constructor" || !hasMemberBelowObjectPrototype(state.target, property) && !hasMemberBelowObjectPrototype(state.source, property);
+}
+/**
+* Own-or-inherited presence that stops BEFORE `Object.prototype`, where the
+* members that every object inherits live.
 */
 function hasMemberBelowObjectPrototype(object, property) {
 	let current = object;
@@ -2398,20 +2699,29 @@ function hasMemberBelowObjectPrototype(object, property) {
 function readRepositorySource(state, property) {
 	state.session.assertOpen(repositoryOperationName(property));
 	const value = Reflect.get(state.source, property, state.source);
-	if (typeof value !== "function") return value;
+	if (typeof value !== "function") return facadeInPlaceOfSource(state, value);
 	const cached = state.methodCache.get(property);
 	if (cached && cached.sourceMethod === value) return cached.guarded;
 	const sourceMethod = value;
-	const guarded = (...args) => {
-		state.session.assertOpen(repositoryOperationName(property));
-		return Reflect.apply(sourceMethod, state.source, args);
-	};
+	const guarded = new Proxy(sourceMethod, {
+		apply: (method, _receiver, args) => {
+			state.session.assertOpen(repositoryOperationName(property));
+			return facadeInPlaceOfSource(state, Reflect.apply(method, state.source, args));
+		},
+		construct: (method, args, newTarget) => {
+			state.session.assertOpen(repositoryOperationName(property));
+			return Reflect.construct(method, args, newTarget);
+		}
+	});
 	state.methodCache.set(property, {
 		sourceMethod,
 		guarded
 	});
 	return guarded;
 }
+function facadeInPlaceOfSource(state, value) {
+	return value === state.source ? state.facade : value;
+}
 function defineForwardedRepositoryProperty(state, property, descriptor) {
 	Object.defineProperty(state.target, property, {
 		configurable: true,
@@ -2426,8 +2736,8 @@ function defineForwardedRepositoryProperty(state, property, descriptor) {
 }
 function installedLifecycleOperations(definition) {
 	const operations = ["add"];
-	if (!definition.appendOnly) operations.push("update");
-	if (definition.physicalRemoval) operations.push("remove");
+	if (definition.appendOnly !== true) operations.push("update");
+	if (definition.physicalRemoval === true) operations.push("remove");
 	return operations;
 }
 function installRepositoryLifecycleOperations(state) {
@@ -2438,7 +2748,6 @@ function installRepositoryLifecycleOperations(state) {
 			enumerable: false,
 			writable: false,
 			value: (aggregate) => {
-				state.session.assertOpen(repositoryOperationName(operation));
 				state.session[operation](aggregate, state.definition);
 			}
 		});
@@ -2454,7 +2763,11 @@ function forwardAdapterOwnProperties(state) {
 function createRepositoryFacadeHandler(state) {
 	return {
 		get: (target, property, receiver) => {
-			if (!hasMemberBelowObjectPrototype(target, property) && !hasMemberBelowObjectPrototype(state.source, property)) return Reflect.get(target, property, receiver);
+			if (isLanguagePlumbing(state, property)) return Reflect.get(target, property, receiver);
+			if (state.writes.has(property)) {
+				state.session.assertOpenForRegistration(repositoryOperationName(property));
+				return Reflect.get(target, property, receiver);
+			}
 			state.session.assertOpen(repositoryOperationName(property));
 			if (Reflect.getOwnPropertyDescriptor(target, property)) return Reflect.get(target, property, receiver);
 			if (isRepositoryLifecycleOperation(property)) return void 0;
@@ -2462,6 +2775,11 @@ function createRepositoryFacadeHandler(state) {
 		},
 		set: (target, property, value, receiver) => setRepositoryFacadeProperty(state, target, property, value, receiver),
 		has: (target, property) => {
+			if (isLanguagePlumbing(state, property)) return Reflect.has(target, property);
+			if (state.writes.has(property)) {
+				state.session.assertOpenForRegistration(repositoryOperationName(property));
+				return true;
+			}
 			state.session.assertOpen(repositoryOperationName(property));
 			return state.writes.has(property) || !isRepositoryLifecycleOperation(property) && (Reflect.has(target, property) || Reflect.has(state.source, property));
 		},
@@ -2578,7 +2896,8 @@ var IdentityMap = class {
 		return this._deleted.get(type)?.has(id) ?? false;
 	}
 	/**
-	* Registers the hydrated instance for type+id.
+	* Registers the hydrated instance under its class and the id of its
+	* `aggregateIdentity`.
 	*
 	* - Re-registering the SAME instance is a no-op (idempotent).
 	* - Registering a DIFFERENT instance for an occupied type+id throws:
@@ -2590,15 +2909,16 @@ var IdentityMap = class {
 	*   work throws `AggregateDeletedError`: deletion is final within
 	*   the operation.
 	*/
-	set(type, id, aggregate) {
-		if (this._deleted.get(type)?.has(id)) throw new AggregateDeletedError(String(id));
+	set(type, aggregate) {
+		const id = aggregate.aggregateIdentity.aggregateId;
+		if (this._deleted.get(type)?.has(id)) throw new AggregateDeletedError({ identity: aggregate.aggregateIdentity });
 		let store = this._stores.get(type);
 		if (store === void 0) {
 			store = /* @__PURE__ */ new Map();
 			this._stores.set(type, store);
 		}
 		const existing = store.get(id);
-		if (existing !== void 0 && existing !== aggregate) throw new Error(`IdentityMap: a different instance is already registered for ${type.name}(${String(id)}). Check get() before hydrating - two live instances of one aggregate break the one-instance-per-unit-of-work contract that exactly-once event harvest relies on.`);
+		if (existing !== void 0 && existing !== aggregate) throw new Error(`IdentityMap: a different instance is already registered for ${describeAggregateIdentity(aggregate.aggregateIdentity)}. Check get() before hydrating: two live instances of one aggregate break the one-instance-per-unit-of-work contract that exactly-once event harvest relies on.`);
 		store.set(id, aggregate);
 		if (aggregate !== null && typeof aggregate === "object" && !this._pendingAtRegistration.has(aggregate)) {
 			const pending = pendingEventCountOf(aggregate);
@@ -2761,13 +3081,24 @@ var Session = class {
 	_commitTokens = /* @__PURE__ */ new Set();
 	_identityMap = new IdentityMap();
 	_identityMapView = Object.freeze({
-		get: this._identityMap.get.bind(this._identityMap),
-		has: this._identityMap.has.bind(this._identityMap),
-		isDeleted: this._identityMap.isDeleted.bind(this._identityMap)
+		get: (type, id) => this._phase === "open" ? this._identityMap.get(type, id) : void 0,
+		has: (type, id) => this._phase === "open" && this._identityMap.has(type, id),
+		isDeleted: (type, id) => this._phase === "open" && this._identityMap.isDeleted(type, id)
 	});
 	_trackingByAggregate = /* @__PURE__ */ new WeakMap();
 	_trackedAggregates = /* @__PURE__ */ new Set();
-	_closed = false;
+	/** Whether the context, facades, and tracking may still be used. */
+	_phase = "open";
+	/**
+	* True from the start of the flush until the last check before the
+	* commit ran or the run ended. A write registered in that window would
+	* be committed and harvested without its flush, so it is rejected, and
+	* the first rejection also fails the attempt, even when the caller
+	* swallows it. After the window, a registration reports a closed unit of
+	* work: nothing can fail the attempt any more.
+	*/
+	_lateRegistrationsFailAttempt = false;
+	_registrationDuringFlush;
 	constructor(commitEnrollment) {
 		this.commitEnrollment = commitEnrollment;
 	}
@@ -2794,31 +3125,55 @@ var Session = class {
 	}
 	trackLoaded(aggregate, definition) {
 		this.assertOpen("tracking.trackLoaded");
+		requirePendingEventLifecycleReadView(aggregate, "tracking.trackLoaded");
+		const tracked = this._identityMap.get(definition.aggregate, aggregate.id);
+		if (tracked !== void 0 && tracked !== aggregate) return this.trackLoaded(tracked, definition);
 		const existing = this._trackingByAggregate.get(aggregate);
-		if (existing && existing.definition !== definition) throw new AggregateTrackingError(String(aggregate.id), "load", "different_repository", existing.registration?.intent);
-		this._identityMap.set(definition.aggregate, aggregate.id, aggregate);
-		if (existing) return aggregate;
+		if (existing && existing.definition !== definition) throw new AggregateTrackingError({
+			identity: aggregate.aggregateIdentity,
+			operation: "load",
+			reason: "different_repository",
+			registeredIntent: existing.registration?.intent
+		});
+		if (existing) {
+			this._identityMap.set(definition.aggregate, aggregate);
+			return aggregate;
+		}
+		const baseline = capturePersistenceBaseline(definition.persistence, aggregate);
+		this._identityMap.set(definition.aggregate, aggregate);
 		const entry = {
 			aggregate,
 			lifecycle: "loaded",
 			expectedVersion: aggregate.version,
 			definition,
-			baseline: capturePersistenceBaseline(definition.persistence, aggregate)
+			baseline
 		};
 		this._trackingByAggregate.set(aggregate, entry);
 		this._trackedAggregates.add(entry);
 		return aggregate;
 	}
 	add(aggregate, definition) {
-		this.assertOpen("repository.add");
+		if (this.isRepeatAdmitted(aggregate, definition, "add")) return;
 		this.assertNotRemoved(aggregate, definition);
 		const existing = this._trackingByAggregate.get(aggregate);
-		if (existing && existing.definition !== definition) throw new AggregateTrackingError(String(aggregate.id), "add", "different_repository", existing.registration?.intent);
-		if (existing?.lifecycle === "loaded") throw new AggregateTrackingError(String(aggregate.id), "add", "loaded_as_new", existing.registration?.intent, { appendOnly: definition.appendOnly === true });
+		if (existing && existing.definition !== definition) throw new AggregateTrackingError({
+			identity: aggregate.aggregateIdentity,
+			operation: "add",
+			reason: "different_repository",
+			registeredIntent: existing.registration?.intent
+		});
+		if (existing?.lifecycle === "loaded") throw new AggregateTrackingError({
+			identity: aggregate.aggregateIdentity,
+			operation: "add",
+			reason: "loaded_as_new",
+			registeredIntent: existing.registration?.intent,
+			appendOnly: definition.appendOnly === true
+		});
 		let entry = existing;
 		const newlyTracked = !entry;
 		if (!entry) {
-			this._identityMap.set(definition.aggregate, aggregate.id, aggregate);
+			this.assertIdentityNotTaken(aggregate, definition);
+			this._identityMap.set(definition.aggregate, aggregate);
 			entry = {
 				aggregate,
 				lifecycle: "new",
@@ -2840,15 +3195,29 @@ var Session = class {
 			throw error;
 		}
 	}
+	/** Two live instances of one identity would each flush and harvest. */
+	assertIdentityNotTaken(aggregate, definition) {
+		const tracked = this._identityMap.get(definition.aggregate, aggregate.id);
+		if (tracked === void 0 || tracked === aggregate) return;
+		throw new AggregateTrackingError({
+			identity: aggregate.aggregateIdentity,
+			operation: "add",
+			reason: "identity_already_tracked",
+			registeredIntent: this.registrationOf(tracked)?.intent
+		});
+	}
 	update(aggregate, definition) {
-		this.assertOpen("repository.update");
+		if (this.isRepeatAdmitted(aggregate, definition, "update")) return;
 		const entry = this.loadedEntryFor(aggregate, "update", definition);
 		this.registerWrite(entry, "update", definition);
 	}
 	remove(aggregate, definition) {
-		this.assertOpen("repository.remove");
+		if (this.isRepeatAdmitted(aggregate, definition, "remove")) return;
 		const entry = this._trackingByAggregate.get(aggregate);
-		if (this.isRemovedInstance(aggregate) && entry?.definition === definition) return;
+		if (this.isRemovedInstance(aggregate) && entry?.definition === definition) {
+			this.assertUnchangedAfterRegistration(entry, "remove");
+			return;
+		}
 		const loaded = this.loadedEntryFor(aggregate, "remove", definition);
 		this.registerWrite(loaded, "remove", definition);
 	}
@@ -2866,18 +3235,38 @@ var Session = class {
 	loadedEntryFor(aggregate, operation, definition) {
 		this.assertNotRemoved(aggregate, definition);
 		const entry = this._trackingByAggregate.get(aggregate);
-		if (entry && entry.definition !== definition) throw new AggregateTrackingError(String(aggregate.id), operation, "different_repository", entry.registration?.intent);
-		if (entry && entry.lifecycle === "new" && entry.definition === definition) throw new AggregateTrackingError(String(aggregate.id), operation, "conflicting_intent", entry.registration?.intent);
-		if (entry?.lifecycle !== "loaded" || entry.definition !== definition) throw new AggregateTrackingError(String(aggregate.id), operation, "not_loaded", entry?.registration?.intent);
+		if (entry && entry.definition !== definition) throw new AggregateTrackingError({
+			identity: aggregate.aggregateIdentity,
+			operation,
+			reason: "different_repository",
+			registeredIntent: entry.registration?.intent
+		});
+		if (entry && entry.lifecycle === "new" && entry.definition === definition) throw new AggregateTrackingError({
+			identity: aggregate.aggregateIdentity,
+			operation,
+			reason: "conflicting_intent",
+			registeredIntent: entry.registration?.intent
+		});
+		if (entry?.lifecycle !== "loaded" || entry.definition !== definition) throw new AggregateTrackingError({
+			identity: aggregate.aggregateIdentity,
+			operation,
+			reason: "not_loaded",
+			registeredIntent: entry?.registration?.intent
+		});
 		return entry;
 	}
 	assertNotRemoved(aggregate, definition) {
-		if (this._identityMap.isDeleted(definition.aggregate, aggregate.id)) throw new AggregateDeletedError(String(aggregate.id));
+		if (this._identityMap.isDeleted(definition.aggregate, aggregate.id)) throw new AggregateDeletedError({ identity: aggregate.aggregateIdentity });
 	}
 	registerIntent(entry, intent) {
 		if (entry.registration !== void 0) {
-			if (entry.registration.intent !== intent) throw new AggregateTrackingError(String(entry.aggregate.id), intent, "conflicting_intent", entry.registration.intent);
-			this.assertUnchangedAfterRegistration(entry);
+			if (entry.registration.intent !== intent) throw new AggregateTrackingError({
+				identity: entry.aggregate.aggregateIdentity,
+				operation: intent,
+				reason: "conflicting_intent",
+				registeredIntent: entry.registration.intent
+			});
+			this.assertUnchangedAfterRegistration(entry, intent);
 			return false;
 		}
 		entry.registration = Object.freeze({
@@ -2896,17 +3285,22 @@ var Session = class {
 		if (index >= 0) this._registeredWrites.splice(index, 1);
 		delete entry.registration;
 	}
-	assertUnchangedAfterRegistration(entry) {
+	assertUnchangedAfterRegistration(entry, operation) {
 		const registration = entry.registration;
 		if (registration === void 0) return;
 		const currentEvents = entry.aggregate.pendingEvents;
 		const persistenceChanged = persistenceProjectionDrifted(registration.baseline, entry.aggregate);
 		const sameEvents = currentEvents.length === registration.events.length && currentEvents.every((event, index) => event === registration.events[index]);
-		if (registration.version !== entry.aggregate.version || !sameEvents || persistenceChanged) throw new AggregateTrackingError(String(entry.aggregate.id), "commit", "mutated_after_registration", registration.intent);
+		if (registration.version !== entry.aggregate.version || !sameEvents || persistenceChanged) throw new AggregateTrackingError({
+			identity: entry.aggregate.aggregateIdentity,
+			operation,
+			reason: "mutated_after_registration",
+			registeredIntent: registration.intent
+		});
 	}
 	registerSavedCommit(aggregate, definition, expectedVersion) {
 		this.assertOpen("repository.add/update");
-		if (this.isRemovedInstance(aggregate) || this._identityMap.isDeleted(definition.aggregate, aggregate.id)) throw new AggregateDeletedError(String(aggregate.id));
+		if (this.isRemovedInstance(aggregate) || this._identityMap.isDeleted(definition.aggregate, aggregate.id)) throw new AggregateDeletedError({ identity: aggregate.aggregateIdentity });
 		const token = this.commitEnrollment.enrollSaved(aggregate, { expectedVersion });
 		this._commitTokens.add(token);
 		return token;
@@ -2926,28 +3320,40 @@ var Session = class {
 	* transaction.
 	*/
 	assertReadyToCommit() {
+		if (this._registrationDuringFlush !== void 0) throw this._registrationDuringFlush;
 		for (const entry of this._trackedAggregates) {
 			if (entry.registration !== void 0) {
-				this.assertUnchangedAfterRegistration(entry);
+				this.assertUnchangedAfterRegistration(entry, "commit");
 				continue;
 			}
-			if (entry.lifecycle === "loaded" && (entry.aggregate.version !== entry.expectedVersion || persistenceProjectionDrifted(entry.baseline, entry.aggregate))) throw new UnenrolledChangesError(String(entry.aggregate.id), { appendOnly: entry.definition.appendOnly === true });
+			if (entry.lifecycle === "loaded" && (entry.aggregate.version !== entry.expectedVersion || persistenceProjectionDrifted(entry.baseline, entry.aggregate))) throw new UnenrolledChangesError({
+				identity: entry.aggregate.aggregateIdentity,
+				appendOnly: entry.definition.appendOnly === true
+			});
 		}
 		for (const instance of this._identityMap.instancesWithNewPendingEvents()) {
 			if (instance !== null && typeof instance === "object" && this.registrationOf(instance) !== void 0) continue;
-			const id = instance.id;
-			throw new UnenrolledChangesError(String(id), { appendOnly: this._trackingByAggregate.get(instance)?.definition.appendOnly === true });
+			const aggregate = instance;
+			throw new UnenrolledChangesError({
+				identity: aggregate.aggregateIdentity,
+				appendOnly: this._trackingByAggregate.get(aggregate)?.definition.appendOnly === true
+			});
 		}
 	}
 	/** Flushes every registered receipt in deterministic registration order. */
 	async flush(transaction) {
 		this.assertOpen("unitOfWork.flush");
+		this._lateRegistrationsFailAttempt = true;
 		for (const entry of this._registeredWrites) {
 			const registration = entry.registration;
-			if (registration === void 0) throw new AggregateTrackingError(String(entry.aggregate.id), "commit", "mutated_after_registration");
+			if (registration === void 0) throw new AggregateTrackingError({
+				identity: entry.aggregate.aggregateIdentity,
+				operation: "commit",
+				reason: "mutated_after_registration"
+			});
 			const write = Object.freeze({
 				intent: registration.intent,
-				aggregateId: entry.aggregate.id,
+				aggregateIdentity: entry.aggregate.aggregateIdentity,
 				expectedVersion: entry.expectedVersion,
 				version: registration.version,
 				changes: registration.changes,
@@ -2963,42 +3369,119 @@ var Session = class {
 	get commitTokens() {
 		return [...this._commitTokens];
 	}
+	/**
+	* Closes the session for use. The tracked state stays, and late
+	* registrations still fail the attempt until its last check before the
+	* commit: a scope can abandon an attempt and still commit it, and that
+	* attempt's check must see its own state. Leaked views answer empty once
+	* the session is closed, so the state cannot serve a later operation.
+	*/
 	close() {
-		this._closed = true;
-		this._identityMap.clear();
-		this._trackedAggregates.clear();
-		this._registeredWrites.length = 0;
-		this._commitTokens.clear();
+		this._phase = "closed";
+	}
+	/** Runs {@link assertReadyToCommit} for the last time before the commit. */
+	assertReadyToCommitLastTime() {
+		this.assertReadyToCommit();
+		this._lateRegistrationsFailAttempt = false;
+	}
+	/** Closes the session for good, when its attempt or the run ended. */
+	end() {
+		this._phase = "closed";
+		this._lateRegistrationsFailAttempt = false;
 	}
 	assertOpen(operation) {
-		if (this._closed) throw new TransactionClosedError(operation);
+		if (this._phase !== "open") throw new TransactionClosedError(operation);
+	}
+	/** Like {@link assertOpen}, but open while a late registration still counts. */
+	assertOpenForRegistration(operation) {
+		if (!this._lateRegistrationsFailAttempt) this.assertOpen(operation);
+	}
+	/**
+	* Admits an add, update, or remove. Before the flush, the call proceeds.
+	* In the late-registration window, a repeat of the same registered write
+	* stays a no-op (returns true), and any other registration is rejected
+	* and fails the attempt. After the window, the call reports a closed unit
+	* of work before it looks at its argument.
+	*/
+	isRepeatAdmitted(aggregate, definition, operation) {
+		const name = repositoryOperation(operation);
+		if (!this._lateRegistrationsFailAttempt) {
+			this.assertOpen(name);
+			requirePendingEventLifecycleReadView(aggregate, name);
+			return false;
+		}
+		requirePendingEventLifecycleReadView(aggregate, name);
+		const entry = this._trackingByAggregate.get(aggregate);
+		if (entry?.definition === definition && entry.registration?.intent === operation) {
+			this.assertUnchangedAfterRegistration(entry, operation);
+			return true;
+		}
+		const rejection = new AggregateTrackingError({
+			identity: aggregate.aggregateIdentity,
+			operation,
+			reason: "registered_during_flush"
+		});
+		this._registrationDuringFlush ??= rejection;
+		throw rejection;
 	}
 };
+/**
+* A flush and an event store report what they observed; the unit of work
+* knows which write it asked for. So the intent of a conflict and of a
+* statement defect comes from here. It is set on the error object itself,
+* found by its code anywhere in the cause chain, so a wrapped error and an
+* error from another copy of the kit get it too.
+*/
+function attributeWriteIntent(error, intent) {
+	const conflict = firstInCauseChainWithCode(error, "CONCURRENCY_CONFLICT");
+	if (conflict instanceof ConcurrencyConflictError) attributeConflictIntent(conflict, intent);
+	else if (conflict !== void 0) Reflect.set(conflict, "intent", intent);
+	const defect = firstInCauseChainWithCode(error, "INVALID_FLUSH_STATEMENT");
+	if (defect instanceof InvalidFlushStatementError) attributeFlushStatementIntent(defect, intent);
+	else if (defect !== void 0) Reflect.set(defect, "intent", intent);
+}
+function firstInCauseChainWithCode(error, code) {
+	return findInCauseChain(error, (link) => {
+		try {
+			return link.code === code ? link : void 0;
+		} catch {
+			return;
+		}
+	});
+}
 function mapRepositoryPersistenceError(definition, error, write) {
-	if (isWiringErrorLike(error)) throw error;
+	attributeWriteIntent(error, write.intent);
+	const wiringError = wiringErrorInCauseChain(error);
+	if (wiringError !== void 0) throw wiringError;
 	let mapped;
 	try {
 		mapped = definition.mapError(error, write);
 	} catch (mapperError) {
 		throw new RepositoryErrorMappingFailedError({
-			aggregateId: String(write.aggregateId),
+			identity: write.aggregateIdentity,
 			intent: write.intent,
 			persistenceError: error,
 			mapperError
 		});
 	}
-	if (isInfrastructureErrorLike(mapped)) return mapped;
+	if (isInfrastructureErrorLike(mapped)) {
+		attributeWriteIntent(mapped, write.intent);
+		return mapped;
+	}
 	throw new RepositoryErrorMappingFailedError({
-		aggregateId: String(write.aggregateId),
+		identity: write.aggregateIdentity,
 		intent: write.intent,
 		persistenceError: error,
 		mapperError: /* @__PURE__ */ new TypeError("Repository mapError must return an InfrastructureError instance")
 	});
 }
+function repositoryOperation(operation) {
+	return `repository.${operation}`;
+}
 
 //#endregion
 //#region src/application/unit-of-work/unit-of-work.ts
-const repositoryDefinitionBrand = Symbol.for("@shirudo/ddd-kit/repository-definition/v2");
+const repositoryDefinitionBrand = Symbol.for("@shirudo/ddd-kit/repository-definition/v3");
 function assertRepositoryDefinitionMembers(definition) {
 	for (const key of [
 		"create",
@@ -3007,6 +3490,19 @@ function assertRepositoryDefinitionMembers(definition) {
 	]) if (typeof definition[key] !== "function") throw new TypeError(`defineRepository: "${key}" is missing or not a function on the definition. The builder copies own enumerable properties only; prototype methods and non-enumerable members are not carried. Pass a plain object literal.`);
 	if (typeof definition.aggregate !== "function") throw new TypeError("defineRepository: \"aggregate\" is missing or not a class reference on the definition. Pass a plain object literal with own enumerable properties.");
 	if (definition.persistence === null || typeof definition.persistence !== "object") throw new TypeError("defineRepository: \"persistence\" is missing or not a PersistenceModel on the definition. Pass a plain object literal with own enumerable properties.");
+	assertPersistenceModelMembers(definition.persistence);
+	for (const key of ["appendOnly", "physicalRemoval"]) {
+		const flag = definition[key];
+		if (flag !== void 0 && typeof flag !== "boolean") throw new TypeError(`defineRepository: "${key}" must be true or false, got ${String(flag)}.`);
+	}
+}
+function assertPersistenceModelMembers(persistence) {
+	for (const key of [
+		"capture",
+		"changes",
+		"isEmpty"
+	]) if (typeof persistence[key] !== "function") throw new TypeError(`defineRepository: "persistence.${key}" is not a function. A PersistenceModel needs capture, changes, and isEmpty.`);
+	if (persistence.captureEquals !== void 0 && typeof persistence.captureEquals !== "function") throw new TypeError("defineRepository: \"persistence.captureEquals\" is not a function. Omit it, or pass a function that compares two captures.");
 }
 /**
 * Defines repository wiring for an application-owned driven port.
@@ -3015,7 +3511,8 @@ function assertRepositoryDefinitionMembers(definition) {
 * aggregate, persistence, event, and lifecycle types from the adapter wiring.
 * The port must declare `add` for the aggregate. It declares `update` unless
 * the definition sets `appendOnly: true`. If it declares `remove`, the
-* definition must set `physicalRemoval: true`. A violated constraint fails
+* definition must set `physicalRemoval: true`. The adapter that `create`
+* returns does not define `add`, `update`, or `remove`. A violated constraint fails
 * the call with a compiler error that names the constraint. The adapter
 * created by the definition implements only the remaining methods because
 * lifecycle writes are installed by the Unit of Work.
@@ -3113,11 +3610,10 @@ var UnitOfWork = class {
 		if (this._active) throw new NestedUnitOfWorkError();
 		this._active = true;
 		let session;
-		let workCompleted = false;
-		let workThrew = false;
-		let workError;
+		const sessions = [];
+		let attempt = startAttempt();
 		try {
-			return await withCommit({
+			return await withCheckedCommit({
 				outbox: this.deps.outbox,
 				bus: this.deps.bus,
 				scope: this.deps.scope,
@@ -3130,37 +3626,40 @@ var UnitOfWork = class {
 				session?.close();
 				const s = new Session(enrollment);
 				session = s;
-				workCompleted = false;
-				workThrew = false;
-				workError = void 0;
-				const context = makeContext(this.buildRepositories(tx, s), s, options?.signal);
+				sessions.push(s);
+				const current = startAttempt();
+				attempt = current;
 				try {
-					const result = await work(context);
+					const result = await work(makeContext(this.buildRepositories(tx, s), s, options?.signal));
 					s.assertReadyToCommit();
 					await s.flush(tx);
 					s.assertReadyToCommit();
-					workCompleted = true;
+					current.workCompleted = true;
 					const commits = s.commitTokens;
 					s.close();
 					return {
 						result,
-						commits
+						commits,
+						checkBeforeCommit: () => s.assertReadyToCommitLastTime(),
+						onFailureBeforeCommit: (error) => {
+							current.failedBeforeCommit = true;
+							current.failureBeforeCommit = error;
+							s.end();
+						}
 					};
 				} catch (error) {
-					workThrew = true;
-					workError = error;
+					current.workThrew = true;
+					current.workError = error;
+					s.end();
 					throw error;
 				}
+			}, () => {
+				attempt = startAttempt();
 			});
 		} catch (error) {
-			throw classifyRunError(error, {
-				workThrew,
-				workCompleted,
-				workError,
-				signal: options?.signal
-			});
+			throw classifyRunError(error, attempt, options?.signal);
 		} finally {
-			session?.close();
+			for (const ended of sessions) ended.end();
 			this._active = false;
 		}
 	}
@@ -3188,13 +3687,23 @@ function makeContext(repositories, session, signal) {
 		signal
 	};
 }
+function startAttempt() {
+	return {
+		workCompleted: false,
+		workThrew: false,
+		workError: void 0,
+		failedBeforeCommit: false,
+		failureBeforeCommit: void 0
+	};
+}
 /**
 * Classifies a `withCommit` rejection into the error `run()` should throw,
-* using the flags captured inside the work wrapper. Pure and total: it
+* using the record of the attempt that the scope ran last. Pure and total: it
 * returns the error to throw rather than throwing itself, so `run()` reads
 * as orchestration and this decision is unit-testable in isolation.
 *
-* - `workThrew`: the work callback (or `assertReadyToCommit`) threw.
+* - `workThrew`: the attempt threw before it completed: the repository
+*   factories, the work callback, or `assertReadyToCommit`.
 *   The scope normally rethrows that error unchanged (rolled back, pass
 *   through so a `ConcurrencyConflictError` & co. stay catchable as-is); a
 *   scope that WRAPS the original is detected via the cause chain and also
@@ -3202,66 +3711,37 @@ function makeContext(repositories, session, signal) {
 *   callback's error indicates the rollback itself failed, which becomes a
 *   {@link RollbackError}.
 * - `workCompleted`: the callback finished; the failure is post-completion.
-*   A harvest-guard violation (an event missing aggregateId / aggregateType,
-*   or an eventful persisted aggregate that did not advance its version) is a deterministic
-*   programming bug, surfaced as its {@link EventHarvestError} (which does
-*   NOT extend `InfrastructureError`, so a retry-on-Infrastructure handler
-*   skips it). It is thrown inside `scope.transactional()`, so a wrapping
-*   scope can nest it: walk the chain rather than a bare `instanceof`. Only
-*   genuinely unforeseeable post-completion failures (outbox write, the
-*   commit itself) become {@link CommitError}.
+*   The checks run in this order. First, a wiring error in the rejection (a
+*   harvest-guard violation, or an aggregate that changed after its
+*   registration) is a deterministic programming bug and passes through; it
+*   does NOT extend `InfrastructureError`, so a retry-on-Infrastructure
+*   handler skips it. It is thrown inside `scope.transactional()`, so a
+*   wrapping scope can nest it: walk the chain rather than a bare
+*   `instanceof`. Second, a step that failed inside the transaction after
+*   the callback (`failedBeforeCommit`) and a rejection that neither is nor
+*   wraps that failure indicate a possible rollback failure: a
+*   {@link RollbackError} with that failure as its cause, also when it is a
+*   wiring error, as in the work phase. Every other post-completion failure
+*   (a failed step whose rollback succeeded, the commit itself) becomes a
+*   {@link CommitError}.
 * - Neither flag set: `withCommit` rejected before the callback ran (the
 *   scope failed to even open a transaction); pass the error through.
 */
-function classifyRunError(error, state) {
-	if (state.signal?.aborted && state.signal.reason !== void 0 && (error === state.signal.reason || causeChainContains(error, state.signal.reason))) return error;
+function classifyRunError(error, state, signal) {
+	if (signal?.aborted && signal.reason !== void 0 && (error === signal.reason || causeChainContains(error, signal.reason))) return error;
 	if (state.workThrew) {
 		if (error === state.workError || causeChainContains(error, state.workError)) return error;
 		return new RollbackError(state.workError, error);
 	}
 	if (state.workCompleted) {
-		const harvestError = findHarvestErrorInChain(error);
-		if (harvestError) return harvestError;
+		const wiringError = wiringErrorInCauseChain(error);
+		if (wiringError) return wiringError;
+		if (state.failedBeforeCommit && error !== state.failureBeforeCommit && !causeChainContains(error, state.failureBeforeCommit)) return new RollbackError(state.failureBeforeCommit, error);
 		return new CommitError(error);
 	}
 	return error;
 }
 /**
-* Cycle-safe, getter-throw-safe walk over `error`'s standard `cause`
-* chain. `visit` runs for every object link (the top error included) and
-* receives the link plus its lazily read `cause`; a non-undefined return
-* stops the walk. A throwing `cause` getter (lazy deserialization, revoked
-* Proxy) ends the walk as no-match instead of replacing the real failure
-* with the getter's exception.
-*/
-function findInCauseChain(error, visit) {
-	const seen = /* @__PURE__ */ new Set();
-	let current = error;
-	while (current !== null && typeof current === "object" && !seen.has(current)) {
-		seen.add(current);
-		let cause;
-		try {
-			cause = current.cause;
-		} catch {
-			return;
-		}
-		const found = visit(current, cause);
-		if (found !== void 0) return found;
-		current = cause;
-	}
-}
-/**
-* Walks `error`'s `cause` chain and returns the first `EventHarvestError`,
-* or `undefined`. `withCommit` throws the harvest-guard error INSIDE
-* `scope.transactional`, so a wrapping scope can nest it; matching
-* only the top-level error would let the wrapper mask the non-retryable
-* type. `withCommit` and `run()` share this module, so the local
-* `instanceof` is reliable for the un-wrapped link.
-*/
-function findHarvestErrorInChain(error) {
-	return findInCauseChain(error, (link) => link instanceof EventHarvestError ? link : void 0);
-}
-/**
 * Whether `error`'s `cause` chain contains `target` by reference. A
 * `target` of `undefined`/`null` never matches: every error without a
 * `cause` property would otherwise "contain" a thrown `undefined`.
@@ -3290,9 +3770,8 @@ function causeChainContains(error, target) {
 */
 function versionedFlush(statements) {
 	const versionedWrites = versionedWritesOf(statements);
-	const aggregateType = statements.aggregateType;
 	const runInsert = insertWriter(statements);
-	const { update: runUpdate, remove: runRemove } = versionedWriters(aggregateType, versionedWrites);
+	const { update: runUpdate, remove: runRemove } = versionedWriters(versionedWrites);
 	return async (transaction, write) => {
 		switch (write.intent) {
 			case "add": return runInsert(transaction, write);
@@ -3307,7 +3786,7 @@ function versionedFlush(statements) {
 }
 /** Reads its statements here, like its versioned peers. */
 function insertWriter(statements) {
-	const { aggregateType, insert, isDuplicate } = statements;
+	const { insert, isDuplicate } = statements;
 	return async (transaction, write) => {
 		try {
 			await insert(transaction, write);
@@ -3317,8 +3796,7 @@ function insertWriter(statements) {
 				duplicate = isDuplicate(error);
 			} catch (classifierCause) {
 				throw new InvalidFlushStatementError({
-					aggregateType,
-					aggregateId: write.aggregateId,
+					identity: write.aggregateIdentity,
 					intent: "add",
 					reason: "duplicate_check_failed",
 					cause: error,
@@ -3327,8 +3805,7 @@ function insertWriter(statements) {
 			}
 			if (!duplicate) throw error;
 			throw new DuplicateAggregateError({
-				aggregateType,
-				aggregateId: write.aggregateId,
+				identity: write.aggregateIdentity,
 				cause: error
 			});
 		}
@@ -3343,42 +3820,72 @@ function versionedWritesOf(statements) {
 	if ((statements.update ?? statements.remove) === void 0) return void 0;
 	throw new TypeError("versionedFlush: the statements carry update or remove but no currentVersion. A failed version check reports the stored version through currentVersion.");
 }
-function versionedWriters(aggregateType, versionedWrites) {
+function versionedWriters(versionedWrites) {
 	return {
-		update: versionedWriter(aggregateType, versionedWrites, "update"),
-		remove: versionedWriter(aggregateType, versionedWrites, "remove")
+		update: versionedWriter(versionedWrites, "update"),
+		remove: versionedWriter(versionedWrites, "remove")
 	};
 }
 /**
 * Resolves the statement of one intent here, so a statements object that
 * changes after the flush is built has no effect.
 */
-function versionedWriter(aggregateType, versionedWrites, intent) {
+function versionedWriter(versionedWrites, intent) {
 	const statement = versionedWrites?.[intent];
 	const statementDefect = (write, reason, received) => new InvalidFlushStatementError({
-		aggregateType,
-		aggregateId: write.aggregateId,
+		identity: write.aggregateIdentity,
 		intent,
 		reason,
 		received
 	});
 	return async (transaction, write) => {
 		if (versionedWrites === void 0 || statement === void 0) throw statementDefect(write, "statement_absent");
-		if (write.expectedVersion === void 0) throw statementDefect(write, "no_expected_version");
+		if (!isStoredVersion(write.expectedVersion)) throw statementDefect(write, "no_expected_version", describeReceived(write.expectedVersion));
 		const matchedRows = await statement(transaction, write);
-		if (!Number.isInteger(matchedRows) || matchedRows < 0) throw statementDefect(write, "no_row_count", describeMatchedRows(matchedRows));
+		if (!Number.isInteger(matchedRows) || matchedRows < 0) throw statementDefect(write, "no_row_count", describeReceived(matchedRows));
 		if (matchedRows > 0) return;
-		const stored = await readCurrentVersion(versionedWrites, transaction, write.aggregateId);
-		throw new ConcurrencyConflictError({
-			aggregateType,
-			aggregateId: write.aggregateId,
+		throw await classifyConcurrencyConflict({
+			identity: write.aggregateIdentity,
 			expectedVersion: write.expectedVersion,
-			cause: stored.read ? void 0 : stored.readFailure,
-			...storedVersionOf(stored, write.expectedVersion)
+			transaction,
+			currentVersion: versionedWrites.currentVersion
 		});
 	};
 }
 /**
+* Builds the conflict of a compare-and-set that matched no row. It reads the
+* stored version and names the reason of the conflict. The zero row count
+* already proves the conflict, so the read is diagnostic: a read that fails
+* becomes `version_unknown`, with the failure as the cause.
+*
+* A version read that returns neither a stored version nor `undefined`, and
+* an expected version that is no version, are defects of the statements. They
+* throw {@link InvalidFlushStatementError}.
+*/
+async function classifyConcurrencyConflict(options) {
+	const { identity, expectedVersion } = options;
+	if (!isStoredVersion(expectedVersion)) throw new InvalidFlushStatementError({
+		identity,
+		reason: "no_expected_version",
+		received: describeReceived(expectedVersion)
+	});
+	const stored = await readStoredVersion(() => options.currentVersion(options.transaction, identity.aggregateId));
+	if (stored.read && stored.currentVersion !== void 0 && !isStoredVersion(stored.currentVersion)) throw new InvalidFlushStatementError({
+		identity,
+		reason: "no_version",
+		received: describeReceived(stored.currentVersion)
+	});
+	return new ConcurrencyConflictError({
+		identity,
+		expectedVersion,
+		cause: stored.read ? void 0 : stored.readFailure,
+		...storedVersionOf(stored, expectedVersion)
+	});
+}
+function isStoredVersion(value) {
+	return Number.isSafeInteger(value) && value >= 0;
+}
+/**
 * Names which version the conflict reports, and why. A read that failed leaves
 * the stored version unknown; a store that lost the aggregate has none to
 * name; a version that still equals the expected one means the statement
@@ -3395,21 +3902,23 @@ function storedVersionOf(stored, expectedVersion) {
 		actualVersion: stored.currentVersion
 	};
 }
-/** Names what a statement returned instead of a row count. */
-function describeMatchedRows(value) {
+/** Names a value that the flush received in place of a valid one. */
+function describeReceived(value) {
 	if (value === void 0) return void 0;
-	return typeof value === "number" ? String(value) : `${String(value)} (${typeof value})`;
+	if (typeof value === "number") return String(value);
+	let text;
+	try {
+		text = String(value);
+	} catch {
+		text = Object.prototype.toString.call(value);
+	}
+	return `${text} (${typeof value})`;
 }
-/**
-* Reads the stored version for the `actualVersion` of a conflict. The zero
-* row count already proves the conflict, so a failed read must not replace
-* it. Such a read reports no version and travels as the conflict's cause.
-*/
-async function readCurrentVersion(versionedWrites, transaction, aggregateId) {
+async function readStoredVersion(currentVersion) {
 	try {
 		return {
 			read: true,
-			currentVersion: await versionedWrites.currentVersion(transaction, aggregateId)
+			currentVersion: await currentVersion()
 		};
 	} catch (readFailure) {
 		return {
@@ -3956,6 +4465,21 @@ function entityIds(entities) {
 *   (emitting any event becomes a compile error).
 */
 var BaseAggregate = class extends Entity {
+	#aggregateIdentity;
+	/**
+	* The full identity of the aggregate: its declared `aggregateType` and
+	* its `id`, as one frozen value. The id alone is unique only within the
+	* type, so this value names the aggregate unambiguously.
+	*/
+	get aggregateIdentity() {
+		if (this.#aggregateIdentity !== void 0) return this.#aggregateIdentity;
+		const identity = Object.freeze({
+			aggregateType: this.aggregateType,
+			aggregateId: this.id
+		});
+		if (identity.aggregateType !== void 0) this.#aggregateIdentity = identity;
+		return identity;
+	}
 	_version = 0;
 	/**
 	* Version the persistence layer last confirmed for this instance:
@@ -3980,8 +4504,7 @@ var BaseAggregate = class extends Entity {
 				this.discardPendingEventsAfterDeletion(events);
 			},
 			persistedVersion: () => this._persistedVersion,
-			pendingEventCount: () => this._pendingEvents.length,
-			aggregateType: () => this.aggregateType
+			pendingEventCount: () => this._pendingEvents.length
 		});
 		registerPendingEventRecordingCapability(this, { record: (createStamp) => this.recordPendingDecisions(createStamp) });
 	}
@@ -4005,11 +4528,14 @@ var BaseAggregate = class extends Entity {
 			if (!isUncommittedDomainEvent(candidate)) throw new UnmintedEventError(event.type);
 			return recordDomainEvent(candidate, createStamp(candidate, index));
 		});
-		if (this._pendingEvents !== stamped || this._pendingEvents.length !== stampedCount) throw new ReentrantEventRecordingError(String(this.id));
+		if (this._pendingEvents !== stamped || this._pendingEvents.length !== stampedCount) throw new ReentrantEventRecordingError({ identity: this.aggregateIdentity });
 		const seenEventIds = /* @__PURE__ */ new Set();
 		for (const event of recorded) {
 			const eventId = event.eventId;
-			if (seenEventIds.has(eventId)) throw new DuplicateEventIdError(String(this.id), eventId);
+			if (seenEventIds.has(eventId)) throw new DuplicateEventIdError({
+				identity: this.aggregateIdentity,
+				eventId
+			});
 			seenEventIds.add(eventId);
 		}
 		this._pendingEvents = recorded;
@@ -4030,7 +4556,11 @@ var BaseAggregate = class extends Entity {
 		this.stripAcknowledgedPrefix(events);
 	}
 	stripAcknowledgedPrefix(events) {
-		if (events.length > this._pendingEvents.length || events.some((event, index) => event !== this._pendingEvents[index])) throw new PendingEventBatchMismatchError(String(this.id), events.length, this._pendingEvents.length);
+		if (events.length > this._pendingEvents.length || events.some((event, index) => event !== this._pendingEvents[index])) throw new PendingEventBatchMismatchError({
+			identity: this.aggregateIdentity,
+			batchLength: events.length,
+			pendingLength: this._pendingEvents.length
+		});
 		this._pendingEvents = this._pendingEvents.slice(events.length);
 	}
 	get version() {
@@ -4099,7 +4629,7 @@ var BaseAggregate = class extends Entity {
 	* ```
 	*/
 	markReconstituted(version) {
-		assertReplayTargetHasNoPendingEvents(this.id, this._pendingEvents.length);
+		assertReplayTargetHasNoPendingEvents(this.aggregateIdentity, this._pendingEvents.length);
 		const restored = toVersion(version);
 		if (restored < this._version) throw new InvalidVersionError(version, `is below the current version ${this._version}`);
 		this.setVersion(restored);
@@ -4108,8 +4638,8 @@ var BaseAggregate = class extends Entity {
 	/**
 	* Appends a domain event to the pending list. The event must be minted
 	* by a kit constructor; a missing `aggregateId` or `aggregateType` is
-	* stamped from this aggregate, and an address that names another
-	* aggregate throws {@link MisaddressedEventError} before anything is
+	* stamped from this aggregate, and an aggregate identity that names another
+	* aggregate throws {@link MisattributedEventError} before anything is
 	* recorded. Each append is one fact. A decision appended twice becomes
 	* two facts with distinct ids. A recorded event that is already pending
 	* throws {@link DuplicateEventIdError}, and a list at `maxPendingEvents`
@@ -4124,7 +4654,7 @@ var BaseAggregate = class extends Entity {
 	* application shell rejects it; use `setState(currentState, event)`.
 	*/
 	addDomainEvent(event) {
-		const stamped = this.addressNewEvent(event);
+		const stamped = this.stampNewEventIdentity(event);
 		this.assertEventIdsNotPending([stamped]);
 		this.assertPendingEventLimit(1);
 		this.appendStampedEvent(stamped);
@@ -4141,7 +4671,10 @@ var BaseAggregate = class extends Entity {
 		for (const pending of this._pendingEvents) if (isRecordedDomainEvent(pending)) pendingIds.add(pending.eventId);
 		for (const event of batch) {
 			if (!isRecordedDomainEvent(event)) continue;
-			if (pendingIds.has(event.eventId)) throw new DuplicateEventIdError(String(this.id), event.eventId);
+			if (pendingIds.has(event.eventId)) throw new DuplicateEventIdError({
+				identity: this.aggregateIdentity,
+				eventId: event.eventId
+			});
 			pendingIds.add(event.eventId);
 		}
 	}
@@ -4157,8 +4690,7 @@ var BaseAggregate = class extends Entity {
 		const pending = this._pendingEvents.length;
 		if (pending + added <= limit) return;
 		throw new PendingEventLimitExceededError({
-			aggregateType: this.aggregateType,
-			aggregateId: String(this.id),
+			identity: this.aggregateIdentity,
 			limit,
 			pending,
 			added
@@ -4166,7 +4698,7 @@ var BaseAggregate = class extends Entity {
 	}
 	/**
 	* Appends an event that the caller already passed through
-	* {@link addressNewEvent}, {@link assertEventIdsNotPending} and
+	* {@link stampNewEventIdentity}, {@link assertEventIdsNotPending} and
 	* {@link assertPendingEventLimit}. `setState()` and `apply()` run the
 	* three before the state moves and append afterwards, so each gate
 	* runs once per event.
@@ -4183,22 +4715,23 @@ var BaseAggregate = class extends Entity {
 		this._pendingEvents = [];
 	}
 	/**
-	* Address discipline for NEW facts, shared by both flavours: a
+	* Aggregate identity discipline for NEW facts, shared by both flavours: a
 	* present-but-foreign `aggregateId` / `aggregateType` is a wiring bug and
-	* throws {@link MisaddressedEventError}; missing fields are filled in
-	* from the aggregate, so a recorded event is always fully addressed and
-	* can never fail the harvest or the replay guard later. The mint gate
+	* throws {@link MisattributedEventError}; missing fields are filled in
+	* from the aggregate, so a recorded event always carries its full
+	* aggregate identity and can never fail the harvest or the replay guard
+	* later. The mint gate
 	* runs first, so an unminted event fails before anything else. The
 	* stamped copy is frozen like the original (payload and metadata are
-	* shared, already deep-frozen by the constructors); a fully addressed
+	* shared, already deep-frozen by the constructors); a fully stamped
 	* event is returned as is.
 	*/
-	addressNewEvent(event) {
+	stampNewEventIdentity(event) {
 		this.assertMintedEvent(event);
 		const { aggregateId, aggregateType } = event;
 		const idForeign = aggregateId !== void 0 && aggregateId !== this.id;
 		const typeForeign = aggregateType !== void 0 && aggregateType !== this.aggregateType;
-		if (idForeign || typeForeign) throw new MisaddressedEventError({
+		if (idForeign || typeForeign) throw new MisattributedEventError({
 			expected: {
 				aggregateType: this.aggregateType,
 				aggregateId: this.id
@@ -4240,11 +4773,11 @@ var BaseAggregate = class extends Entity {
 	* concrete event producer, rather than in shell-owned recording data.
 	*/
 	createEvent(type, payload, options) {
-		return createUncommittedDomainEvent(type, payload, {
+		return mintUncommittedDomainEvent(type, payload, {
 			...options,
 			aggregateId: this.id,
 			aggregateType: this.aggregateType
-		});
+		}, "createEvent");
 	}
 };
 /**
@@ -4267,8 +4800,11 @@ var BaseAggregate = class extends Entity {
 * @internal Shared by the aggregate flavours in this package; not part of
 * the public API.
 */
-function assertReplayTargetHasNoPendingEvents(id, pending) {
-	if (pending > 0) throw new UnreplayableAggregateError(String(id), `it carries ${pending} unflushed pending event(s) that are not part of the persisted stream; discard this dirty instance and reconstitute a fresh aggregate before restoring persisted history`);
+function assertReplayTargetHasNoPendingEvents(identity, pending) {
+	if (pending > 0) throw new UnreplayableAggregateError({
+		identity,
+		reason: `it carries ${pending} unflushed pending event(s) that are not part of the persisted stream; discard this dirty instance and reconstitute a fresh aggregate before restoring persisted history`
+	});
 }
 
 //#endregion
@@ -4358,7 +4894,7 @@ var EventSourcedAggregate = class extends BaseAggregate {
 	* recorded and the version advances with it.
 	*/
 	setState(_newState) {
-		throw new DirectStateMutationError(String(this.id));
+		throw new DirectStateMutationError({ identity: this.aggregateIdentity });
 	}
 	/**
 	* Applies an event: validates the decision, locates the fold, computes
@@ -4371,9 +4907,9 @@ var EventSourcedAggregate = class extends BaseAggregate {
 	* Throws `MissingFoldError` if no fold is declared for `event.type`.
 	* Throws `FoldReturnedNoStateError` (wiring) when the fold returns
 	* `undefined`, the signature of a fold without a `return`.
-	* Throws `MisaddressedEventError` (wiring) when the event carries an
+	* Throws `MisattributedEventError` (wiring) when the event carries an
 	* `aggregateId` or `aggregateType` naming a different aggregate;
-	* missing address fields are stamped from the aggregate instead.
+	* missing aggregate identity fields are stamped from the aggregate instead.
 	*
 	* State is not mutated if any step throws: the fold is invoked into
 	* a local and only stored once all checks pass.
@@ -4390,7 +4926,7 @@ var EventSourcedAggregate = class extends BaseAggregate {
 	* @param event - The domain event to apply
 	*/
 	apply(event) {
-		const stamped = this.addressNewEvent(event);
+		const stamped = this.stampNewEventIdentity(event);
 		this.assertEventIdsNotPending([stamped]);
 		this.assertPendingEventLimit(1);
 		this.validateEvent(stamped);
@@ -4414,16 +4950,16 @@ var EventSourcedAggregate = class extends BaseAggregate {
 	* and the discriminator is resolved via the (statically-sound)
 	* `folds` map.
 	*
-	* Replay address check: a history event that names a DIFFERENT
+	* Replay aggregate identity check: a history event that names a DIFFERENT
 	* aggregate id or type is a persisted row that belongs to someone
 	* else (a miswired stream read, colliding ids across types, a
 	* corrupted store). Throws `ForeignEventError`, an
 	* `InfrastructureError`, which PROPAGATES through the replay
 	* methods (their `Result` channel is reserved for `DomainError`
 	* stream corruption) after the all-or-nothing rollback. History
-	* events without the optional address fields pass unchecked (the
+	* events without the optional aggregate identity fields pass unchecked (the
 	* fields are optional on the event shape); NEW events are covered
-	* by the stricter `addressNewEvent` on the apply path.
+	* by the stricter `stampNewEventIdentity` on the apply path.
 	*/
 	assertReplayedEventBelongsHere(event) {
 		const idMismatch = event.aggregateId !== void 0 && event.aggregateId !== this.id;
@@ -4467,15 +5003,15 @@ var EventSourcedAggregate = class extends BaseAggregate {
 	* a reconstituted aggregate at v=P catching up on M newer events ends at
 	* v=P+M. Events carry no stream position, so an overlap with the current
 	* version is invisible here: the caller passes only the events after
-	* that version and checks the final version against the pinned stream
-	* head ({@link ReplayHeadMismatchError}).
+	* that version, and it compares the final version with the version it
+	* expects.
 	*
 	* The replay target must not carry pending decisions. Factory-vs-load
 	* lifecycle is owned by the Unit of Work rather than inferred from an
 	* aggregate persistence flag.
 	*/
 	replayHistory(history) {
-		assertReplayTargetHasNoPendingEvents(this.id, requirePendingEventLifecycleReadView(this, "replayHistory").pendingEventCount());
+		assertReplayTargetHasNoPendingEvents(this.aggregateIdentity, requirePendingEventLifecycleReadView(this, "replayHistory").pendingEventCount());
 		if (history.length === 0) return ok();
 		const previousState = this.state;
 		const startVersion = this.version;
@@ -4499,10 +5035,10 @@ var EventSourcedAggregate = class extends BaseAggregate {
 /**
 * Reconstitutes an event-sourced aggregate from one page of history and
 * yields it only on success. `createReplayTarget` builds the instance: a
-* fresh one, or one restored from a snapshot. The instance exists only
+* fresh one, or one reconstituted from a snapshot. The instance exists only
 * inside this call. A rejected replay therefore leaves the caller with
-* nothing to return by mistake. Later catch-up pages go through
-* `replayHistory` on the value. A `DomainError` from a fold rides the
+* nothing to return by mistake. A stream read in pages goes through
+* `reconstituteAggregateFromStreamPages` instead. A `DomainError` from a fold rides the
 * `Result`; wiring errors and a foreign row throw, as in `replayHistory`.
 * The creator runs outside the `Result`: what it throws propagates.
 */
@@ -4528,13 +5064,13 @@ var StateStoredAggregate = class extends BaseAggregate {
 	/**
 	* Replaces the state, advances the OCC version, and records the events
 	* of the change, in that order. State validation, the event mint gate,
-	* the event address check, the pending-identity check, and the pending
-	* event limit check run before the change becomes observable, so a
-	* rejected decision records nothing and moves nothing. Without events the call is a plain versioned state
-	* change.
+	* the aggregate identity check of the event, the pending event-id check,
+	* and the pending event limit check run before the change becomes
+	* observable, so a rejected decision records nothing and moves nothing.
+	* Without events the call is a plain versioned state change.
 	*/
 	setState(newState, events = []) {
-		const stamped = (Array.isArray(events) ? events : [events]).map((event) => this.addressNewEvent(event));
+		const stamped = (Array.isArray(events) ? events : [events]).map((event) => this.stampNewEventIdentity(event));
 		this.assertEventIdsNotPending(stamped);
 		this.assertPendingEventLimit(stamped.length);
 		const next = this.nextVersion();
@@ -5399,117 +5935,6 @@ function voValidated(t, validate, message = "Validation failed") {
 	return issues.hasIssues() ? err(issues) : ok(vo(t));
 }
 
-//#endregion
-//#region src/internal/structural/detach-state.ts
-/**
-* Returns a copy of `state` that shares no object with the original.
-* Throws a `TypeError` that names the path when the graph carries a value
-* a structured clone would lose or silently degrade. A class instance, a
-* subclass of a built-in included, loses the methods on its prototype. A
-* symbol-keyed, non-enumerable, or accessor property and an expando on a
-* built-in are dropped. A function or a symbol value throws a raw
-* `DataCloneError`. An Error, a Promise, a WeakMap, or a WeakSet cannot be
-* detached at all. A SharedArrayBuffer and a view over one keep sharing
-* their memory. A Proxy is invisible to the walk and fails inside the
-* clone; that failure is rethrown as a `TypeError` with the cause.
-*
-* Plain objects (from any realm), arrays, Dates, Maps, Sets, bigints, and
-* typed arrays pass. A RegExp passes: pattern and flags survive the clone,
-* and `lastIndex` restores as 0. The scan state of a global or sticky
-* pattern is not domain data. A non-enumerable property on a built-in
-* passes: it is the built-in's own machinery (`lastIndex`), not data. A
-* non-enumerable symbol key passes anywhere: it is metadata by convention.
-*
-* The concrete entity uses it for a detached read DTO of a plain-data
-* state. The snapshot model uses it for the captured DTO and the restored
-* state. A state that carries a class-based child is mapped to plain data
-* first, in the entity or in the model.
-*/
-function detachState(state) {
-	assertDetachable(state, "", /* @__PURE__ */ new WeakSet());
-	try {
-		return structuredClone(state);
-	} catch (cause) {
-		throw new TypeError("detachState: state holds a Proxy or a host object that cannot be cloned; map it to plain data", { cause });
-	}
-}
-const INDEX_KEY = /^(0|[1-9]\d*)$/;
-function assertDetachable(value, path, seen) {
-	if (typeof value === "function") throw new TypeError(`detachState: state${path} is a function; map it to plain data`);
-	if (typeof value === "symbol") throw new TypeError(`detachState: state${path} is a symbol; map it to plain data`);
-	if (value === null || typeof value !== "object") return;
-	const object = value;
-	if (seen.has(object)) return;
-	seen.add(object);
-	if (Array.isArray(object)) {
-		if (!hasIntrinsicPrototypeChain(object, "Array")) throwClassInstance(object, path);
-		assertOwnPropertiesDetachable(object, path, seen, "array");
-		return;
-	}
-	const tag = builtInTagWithoutInvokingAccessors(object);
-	if (tag !== void 0) {
-		if (!hasIntrinsicPrototypeChain(object)) throwClassInstance(object, path);
-		if (tag === "[object Map]") {
-			let index = 0;
-			for (const [key, entry] of object) {
-				assertDetachable(key, `${path}<map key #${index}>`, seen);
-				assertDetachable(entry, `${path}<map value #${index}>`, seen);
-				index++;
-			}
-		} else if (tag === "[object Set]") {
-			let index = 0;
-			for (const member of object) {
-				assertDetachable(member, `${path}<set member #${index}>`, seen);
-				index++;
-			}
-		} else if (tag === "[object Promise]" || tag === "[object WeakMap]" || tag === "[object WeakSet]") throw new TypeError(`detachState: state${path} is a ${tag.slice(8, -1)} and cannot be detached`);
-		else if (tag === "[object Error]") throw new TypeError(`detachState: state${path} is an Error; map it to plain data`);
-		else if (sharesMemory(object, tag)) throw new TypeError(`detachState: state${path} is backed by a SharedArrayBuffer and the copy would share its memory; map it to plain data`);
-		assertOwnPropertiesDetachable(object, path, seen, "built-in");
-		return;
-	}
-	const prototype = Object.getPrototypeOf(object);
-	if (!(prototype === null || isIntrinsicConstructorPrototype(prototype, "Object") && Object.getPrototypeOf(prototype) === null)) throwClassInstance(object, path);
-	assertOwnPropertiesDetachable(object, path, seen, "record");
-}
-/**
-* Audits the own properties the clone would copy or drop. The clone keeps
-* the enumerable own keys of a record and of an array, expandos included,
-* and drops every own key of another built-in. `length` on an array and
-* the non-enumerable keys of a built-in (`lastIndex`) are its own
-* machinery, not data. Index keys of a typed array or a boxed String are
-* its content and pass as such.
-*/
-function assertOwnPropertiesDetachable(object, path, seen, kind) {
-	for (const key of Reflect.ownKeys(object)) {
-		const descriptor = Object.getOwnPropertyDescriptor(object, key);
-		if (descriptor === void 0) continue;
-		if (typeof key === "symbol") {
-			if (!descriptor.enumerable) continue;
-			throw new TypeError(`detachState: state${path} has a symbol-keyed property; map it to plain data`);
-		}
-		if (kind === "array" && key === "length") continue;
-		const isIndex = INDEX_KEY.test(key);
-		if (!descriptor.enumerable) {
-			if (kind === "built-in") continue;
-			throw new TypeError(`detachState: state${path}.${key} is not enumerable and the clone would drop it; map it to plain data`);
-		}
-		if (kind === "built-in" && isIndex) continue;
-		const memberPath = isIndex ? `${path}[${key}]` : `${path}.${key}`;
-		if (!("value" in descriptor)) throw new TypeError(`detachState: state${memberPath} is an accessor property; map it to plain data`);
-		if (kind === "built-in") throw new TypeError(`detachState: state${memberPath} is an expando on a ${object.constructor?.name ?? "built-in"} and the clone would drop it; map it to plain data`);
-		assertDetachable(descriptor.value, memberPath, seen);
-	}
-}
-function sharesMemory(object, tag) {
-	if (tag === "[object SharedArrayBuffer]") return true;
-	return ArrayBuffer.isView(object) && Object.prototype.toString.call(object.buffer) === "[object SharedArrayBuffer]";
-}
-function throwClassInstance(object, path) {
-	const name = Object.getPrototypeOf(object)?.constructor?.name || "anonymous class";
-	throw new TypeError(`detachState: state${path} is a class instance (${name}); map it to plain data`);
-}
-
 //#endregion
 //#region src/messaging/event-bus/errors.ts
 /** Keeps a deep chain readable in the message without losing the recent path. */
@@ -5912,6 +6337,8 @@ var EventBusImpl = class {
 	}
 	once(eventType, options) {
 		return new Promise((resolve, reject) => {
+			const timeoutMs = options?.timeoutMs;
+			if (timeoutMs !== void 0) assertTimerDelay("EventBus.once", "timeoutMs", timeoutMs);
 			if (this.closed) {
 				reject(new EventBusClosedError("once"));
 				return;
@@ -5953,10 +6380,10 @@ var EventBusImpl = class {
 				};
 				signal.addEventListener("abort", abortListener);
 			}
-			if (typeof options?.timeoutMs === "number") timer = setTimeout(() => {
+			if (timeoutMs !== void 0) timer = setTimeout(() => {
 				cleanup();
-				reject(/* @__PURE__ */ new Error(`EventBus.once timed out after ${options.timeoutMs}ms waiting for "${eventType}"`));
-			}, options.timeoutMs);
+				reject(/* @__PURE__ */ new Error(`EventBus.once timed out after ${timeoutMs}ms waiting for "${eventType}"`));
+			}, timeoutMs);
 		});
 	}
 	/**
@@ -6218,7 +6645,10 @@ function invalid(path, reason) {
 * name.
 */
 function outboxWriterAcceptingEventLoss() {
-	return { add: async () => {} };
+	return {
+		add: async () => {},
+		endEventSources: async () => {}
+	};
 }
 /**
 * In-memory reference implementation of `DispatchTrackingOutbox<Evt>`
@@ -6234,12 +6664,16 @@ function outboxWriterAcceptingEventLoss() {
 * recent-dispatch receipt cache keeps retries idempotent after acknowledgement.
 * Re-adding a pending event refreshes the stored commit envelope while the
 * delivery attempt count survives. Its commit sequence and size remain
-* immutable; only this transaction-unaware adapter may move a still-pending
-* event to another aggregate version after an outer rollback leaked the first
-* add. Dead-lettered and acknowledged retries must match the complete original
-* candidate receipt. Reusing an `eventId` for another source or commit position
+* immutable. Only this in-memory adapter may move a still-pending event to
+* another aggregate version. Without an `InMemoryTransactionScope`, it keeps
+* the first add of a rolled-back attempt. Dead-lettered and acknowledged
+* retries must match the complete original candidate receipt. Reusing an `eventId` for another source or commit position
 * throws {@link EventHarvestError} while the pending, dead-letter, or bounded
-* dispatched receipt still proves the collision. Insertion order is preserved:
+* dispatched receipt still proves the collision. `add` also throws
+* {@link EventHarvestError} for a malformed candidate: a part that is not an
+* object, an `eventId` or `type` that is not an own string data property, a
+* source field that is not a string, or a position that is not a valid
+* commit position. Insertion order is preserved:
 * `getPending` returns records in commit order, as the port contract requires.
 *
 * Dispatch tracking: `markFailed` increments the record's attempt count
@@ -6249,7 +6683,9 @@ function outboxWriterAcceptingEventLoss() {
 * inverse of `deadLetters()`); `markDispatched` acks pending AND
 * dead-lettered records (manual redelivery then ack).
 * To link future eventful commits, the implementation also retains one
-* source cursor per qualified aggregate after dispatch. Consequently a
+* source cursor per qualified aggregate after dispatch. `endEventSources`
+* marks the cursor of a removed aggregate as ended, and a new event of that
+* source then throws {@link EventHarvestError}. Consequently a
 * long-lived instance is bounded only when `maxRecords` and `maxSources` are
 * configured, plus `maxRetainedDispatchedEventIds`; use a durable adapter with
 * an explicit source-head lifecycle and an event-id unique key for unbounded
@@ -6263,12 +6699,21 @@ function outboxWriterAcceptingEventLoss() {
 * that are never `markDispatched` accumulate until `maxRecords` rejects a new
 * add, or without that option grow unbounded. For a deliberate no-delivery
 * setup use {@link outboxWriterAcceptingEventLoss} instead. Sharper still:
-* events `add()`ed inside a transaction that later rolls back are NOT
-* removed (the Map knows nothing about your scope's rollback). Tests
-* that assert rollback purity need an outbox that participates in the
-* test store's transactional semantics; see the reference adapter at
-* https://github.com/shi-rudo/ddd-kit-ts/blob/main/src/testing/repository-contract.test.ts
-* (repo-only, not shipped to npm).
+* on its own, the outbox knows nothing about your scope's rollback. Events
+* `add()`ed inside a transaction that later rolls back stay, and a source
+* that `endEventSources` ended inside such a transaction stays ended: the
+* outbox then rejects every later event of that aggregate, also on the retry
+* of a `RetryingTransactionScope`. For tests that roll back or retry,
+* register the outbox with an `InMemoryTransactionScope`. A rollback then
+* returns the outbox to its state at the start of the attempt.
+*
+* A relay reads only committed records. While a transaction is open,
+* `getPending` returns a record that the transaction wrote as it was
+* committed at the first write, with its current attempts. It skips a record
+* that was not pending at that write, such as a new or a requeued record. A
+* rollback also undoes an acknowledgement or a failure report that a
+* dispatcher made while the transaction was open. The dispatcher then
+* delivers that record again.
 *
 * @example
 * ```ts
@@ -6291,8 +6736,15 @@ var InMemoryOutbox = class {
 	dead = /* @__PURE__ */ new Map();
 	/** Latest eventful commit and its predecessor per qualified source. */
 	sourceCursors = /* @__PURE__ */ new Map();
+	/** Keys of source cursors whose aggregate was removed. */
+	endedSourceKeys = /* @__PURE__ */ new Set();
 	/** Bounded insertion-ordered receipts for exact retries after acknowledgement. */
 	dispatchedEventIds = /* @__PURE__ */ new Map();
+	/**
+	* The committed pending record of each event id that the open transaction
+	* wrote, captured at its first write. `undefined` marks an id without one.
+	*/
+	committedVersions;
 	maxDeliveryAttempts;
 	maxRetainedDispatchedEventIds;
 	maxRecords;
@@ -6310,11 +6762,14 @@ var InMemoryOutbox = class {
 		this.maxSources = options?.maxSources;
 	}
 	async add(events) {
-		this.assertBatchEventReceiptIntegrity(events);
-		this.assertBatchPositionIntegrity(events);
-		this.assertCapacity(events);
-		for (const message of events) {
+		const batch = Array.from(events, ownCandidate);
+		const headRetries = this.retriesAtSourceHead(batch);
+		this.assertBatchEventReceiptIntegrity(batch);
+		this.assertBatchPositionIntegrity(batch, headRetries);
+		this.assertCapacity(batch, headRetries);
+		for (const message of batch) {
 			const { event, source, position } = message;
+			if (headRetries.has(event.eventId)) continue;
 			const dispatchedReceipt = this.dispatchedEventIds.get(event.eventId);
 			if (dispatchedReceipt !== void 0) {
 				assertSameEventSource(event, source, dispatchedReceipt.source);
@@ -6332,6 +6787,7 @@ var InMemoryOutbox = class {
 				assertSameEventSource(event, source, deadLetter.source);
 				assertSameCandidateReceipt(event, position, deadLetter.position);
 				this.dead.delete(event.eventId);
+				this.recordCommittedVersion(event.eventId);
 				this.pending.set(event.eventId, {
 					dispatchId: deadLetter.dispatchId,
 					event: deadLetter.event,
@@ -6341,17 +6797,16 @@ var InMemoryOutbox = class {
 				});
 				continue;
 			}
-			const ownedSource = Object.freeze({ ...source });
-			const sourceKey = encodeAggregateAddress(source);
+			const sourceKey = encodeAggregateIdentity(source);
 			const sourceCursor = this.sourceCursors.get(sourceKey);
 			let staleHeadVersion;
 			if (existing !== void 0 && position.aggregateVersion < existing.position.aggregateVersion) staleHeadVersion = existing.position.aggregateVersion;
 			else if (existing === void 0 && sourceCursor !== void 0 && position.aggregateVersion < sourceCursor.aggregateVersion) staleHeadVersion = sourceCursor.aggregateVersion;
 			if (staleHeadVersion !== void 0) throw staleHeadError(event, source, position, staleHeadVersion);
 			if (sourceCursor?.aggregateVersion === position.aggregateVersion) {
-				if (sourceCursor.commitSize !== position.commitSize) throw new EventHarvestError(`InMemoryOutbox rejected event "${event.eventId}" for ${source.aggregateType} ${source.aggregateId}: aggregate version ${position.aggregateVersion} was already recorded with commitSize ${sourceCursor.commitSize}, not ${position.commitSize}.`, event.type);
+				if (sourceCursor.commitSize !== position.commitSize) throw commitSizeMismatchError(event, source, position, sourceCursor.commitSize);
 				const positionOwner = sourceCursor.eventIdsBySequence.get(position.commitSequence);
-				if (positionOwner !== void 0 && positionOwner !== event.eventId) throw new EventHarvestError(`InMemoryOutbox rejected event "${event.eventId}" for ${source.aggregateType} ${source.aggregateId}: source position (${position.aggregateVersion}, ${position.commitSequence}) is already owned by event "${positionOwner}". One qualified source position must identify exactly one immutable event.`, event.type);
+				if (positionOwner !== void 0 && positionOwner !== event.eventId) throw positionOwnedError(event, source, position, positionOwner);
 			}
 			let previousEventfulAggregateVersion;
 			if (existing !== void 0 && existing.position.aggregateVersion !== position.aggregateVersion) {
@@ -6381,27 +6836,30 @@ var InMemoryOutbox = class {
 				previousEventfulAggregateVersion
 			});
 			if (existing) {
+				this.recordCommittedVersion(event.eventId);
 				existing.event = event;
-				existing.source = ownedSource;
+				existing.source = source;
 				existing.position = ownedPosition;
 				continue;
 			}
+			this.recordCommittedVersion(event.eventId);
 			this.pending.set(event.eventId, {
 				dispatchId: event.eventId,
 				event,
-				source: ownedSource,
+				source,
 				position: ownedPosition,
 				attempts: 0
 			});
 		}
+		for (const { event, source, position } of batch) if (headRetries.has(event.eventId)) this.rememberDispatched(event.eventId, source, position);
 	}
-	assertCapacity(events) {
+	assertCapacity(events, headRetries) {
 		const newRecordIds = /* @__PURE__ */ new Set();
 		const newSourceKeys = /* @__PURE__ */ new Set();
 		for (const { event, source } of events) {
-			if (this.pending.has(event.eventId) || this.dead.has(event.eventId) || this.dispatchedEventIds.has(event.eventId)) continue;
+			if (this.pending.has(event.eventId) || this.dead.has(event.eventId) || this.dispatchedEventIds.has(event.eventId) || headRetries.has(event.eventId)) continue;
 			newRecordIds.add(event.eventId);
-			const sourceKey = encodeAggregateAddress(source);
+			const sourceKey = encodeAggregateIdentity(source);
 			if (!this.sourceCursors.has(sourceKey)) newSourceKeys.add(sourceKey);
 		}
 		const currentRecords = this.pending.size + this.dead.size;
@@ -6449,10 +6907,12 @@ var InMemoryOutbox = class {
 			}
 		}
 	}
-	assertBatchPositionIntegrity(events) {
+	assertBatchPositionIntegrity(events, headRetries) {
 		const simulatedCursors = /* @__PURE__ */ new Map();
 		for (const { event, source, position } of events) {
-			const sourceKey = encodeAggregateAddress(source);
+			if (headRetries.has(event.eventId)) continue;
+			const sourceKey = encodeAggregateIdentity(source);
+			this.assertSourceNotEnded(event, source, position, sourceKey);
 			const cursor = simulatedCursors.get(sourceKey) ?? this.sourceCursors.get(sourceKey);
 			if (cursor === void 0 || position.aggregateVersion > cursor.aggregateVersion) {
 				simulatedCursors.set(sourceKey, {
@@ -6469,23 +6929,26 @@ var InMemoryOutbox = class {
 				if (pendingRecord !== void 0 && position.aggregateVersion < pendingRecord.position.aggregateVersion || pendingRecord === void 0 && !dedupes) throw staleHeadError(event, source, position, pendingRecord?.position.aggregateVersion ?? cursor.aggregateVersion);
 				continue;
 			}
-			if (cursor.commitSize !== position.commitSize) throw new EventHarvestError(`InMemoryOutbox rejected event "${event.eventId}" for ${source.aggregateType} ${source.aggregateId}: aggregate version ${position.aggregateVersion} was already recorded with commitSize ${cursor.commitSize}, not ${position.commitSize}.`, event.type);
+			if (cursor.commitSize !== position.commitSize) throw commitSizeMismatchError(event, source, position, cursor.commitSize);
 			const positionOwner = cursor.eventIdsBySequence.get(position.commitSequence);
-			if (positionOwner !== void 0 && positionOwner !== event.eventId) throw new EventHarvestError(`InMemoryOutbox rejected event "${event.eventId}" for ${source.aggregateType} ${source.aggregateId}: source position (${position.aggregateVersion}, ${position.commitSequence}) is already owned by event "${positionOwner}". One qualified source position must identify exactly one immutable event.`, event.type);
+			if (positionOwner !== void 0 && positionOwner !== event.eventId) throw positionOwnedError(event, source, position, positionOwner);
 			if (positionOwner === void 0) simulatedCursors.set(sourceKey, cursorWithEvent(cursor, position.commitSequence, event.eventId));
 		}
 	}
 	async getPending(limit) {
 		const max = typeof limit === "number" ? Math.max(0, Number.isNaN(limit) ? 0 : limit) : Number.POSITIVE_INFINITY;
 		const batch = [];
-		for (const record of this.pending.values()) {
+		const versions = this.committedVersions;
+		for (const [eventId, live] of this.pending) {
 			if (batch.length >= max) break;
+			const committed = versions?.has(eventId) ? versions.get(eventId) : live;
+			if (committed === void 0) continue;
 			batch.push({
-				dispatchId: record.dispatchId,
-				event: record.event,
-				source: record.source,
-				position: record.position,
-				attempts: record.attempts
+				dispatchId: committed.dispatchId,
+				event: committed.event,
+				source: committed.source,
+				position: committed.position,
+				attempts: live.attempts
 			});
 		}
 		return batch;
@@ -6495,9 +6958,88 @@ var InMemoryOutbox = class {
 			const record = this.pending.get(id) ?? this.dead.get(id);
 			if (record !== void 0) this.rememberDispatched(id, record.source, record.position);
 			this.pending.delete(id);
+			this.forgetCommittedVersion(id);
 			this.dead.delete(id);
 		}
 	}
+	/**
+	* Records the state that a rollback of an `InMemoryTransactionScope`
+	* returns to: pending and dead-letter records, receipts, source cursors,
+	* and ended sources, in their order. Until the transaction ends,
+	* `getPending` returns the committed record of each event id that the
+	* transaction writes.
+	*/
+	beginTransaction() {
+		const pending = [...this.pending].map(([id, record]) => [id, { ...record }]);
+		const dead = [...this.dead];
+		const receipts = [...this.dispatchedEventIds];
+		const cursors = [...this.sourceCursors];
+		const ended = [...this.endedSourceKeys];
+		const versions = /* @__PURE__ */ new Map();
+		this.committedVersions = versions;
+		const end = () => {
+			if (this.committedVersions === versions) this.committedVersions = void 0;
+		};
+		return {
+			commit: end,
+			rollback: () => {
+				refill(this.pending, pending);
+				refill(this.dead, dead);
+				refill(this.dispatchedEventIds, receipts);
+				refill(this.sourceCursors, cursors);
+				this.endedSourceKeys.clear();
+				for (const key of ended) this.endedSourceKeys.add(key);
+				end();
+			}
+		};
+	}
+	/** A record that a dispatcher removed is no longer pending in the committed state. */
+	forgetCommittedVersion(eventId) {
+		if (this.committedVersions?.has(eventId)) this.committedVersions.set(eventId, void 0);
+	}
+	recordCommittedVersion(eventId) {
+		const versions = this.committedVersions;
+		if (versions === void 0 || versions.has(eventId)) return;
+		const committed = this.pending.get(eventId);
+		versions.set(eventId, committed === void 0 ? void 0 : { ...committed });
+	}
+	async endEventSources(sources) {
+		for (const source of sources) {
+			const sourceKey = encodeAggregateIdentity(source);
+			if (this.sourceCursors.has(sourceKey)) this.endedSourceKeys.add(sourceKey);
+		}
+	}
+	/**
+	* Rejects a new event of an ended source above its head. An exact retry of
+	* a stored event of an ended source stays a retry; the caller skips
+	* retries at the source head before this check. The stale-head, commit
+	* size, and position checks reject a candidate below the head or at a
+	* position that another event owns, and their messages name the
+	* re-created identity as a cause.
+	*/
+	assertSourceNotEnded(event, source, position, sourceKey) {
+		if (!this.endedSourceKeys.has(sourceKey)) return;
+		if (this.pending.has(event.eventId) || this.dead.has(event.eventId) || this.dispatchedEventIds.has(event.eventId)) return;
+		const cursor = this.sourceCursors.get(sourceKey);
+		if (cursor !== void 0 && (position.aggregateVersion < cursor.aggregateVersion || position.aggregateVersion === cursor.aggregateVersion && cursor.eventIdsBySequence.has(position.commitSequence))) return;
+		throw new EventHarvestError(`InMemoryOutbox rejected event "${event.eventId}" for ${describeAggregateIdentity(source)}: the aggregate was removed, so its event source ended. The kit does not support an aggregate that is created again under a removed identity. Give the new aggregate a new id.`, event.type);
+	}
+	/**
+	* Event ids of the batch that the source head names at their position
+	* although no receipt, pending record, or dead letter remains: events
+	* that were dispatched and whose receipt was evicted. They are decided
+	* against the heads before the batch, so their place in the batch does
+	* not matter. Their receipts are restored after the batch.
+	*/
+	retriesAtSourceHead(events) {
+		const retries = /* @__PURE__ */ new Set();
+		for (const { event, source, position } of events) if (!this.pending.has(event.eventId) && !this.dead.has(event.eventId) && !this.dispatchedEventIds.has(event.eventId) && this.recordedAtSourceHead(event, source, position)) retries.add(event.eventId);
+		return retries;
+	}
+	recordedAtSourceHead(event, source, position) {
+		const cursor = this.sourceCursors.get(encodeAggregateIdentity(source));
+		return cursor?.aggregateVersion === position.aggregateVersion && cursor.commitSize === position.commitSize && cursor.eventIdsBySequence.get(position.commitSequence) === event.eventId;
+	}
 	rememberDispatched(eventId, source, position) {
 		this.dispatchedEventIds.delete(eventId);
 		this.dispatchedEventIds.set(eventId, {
@@ -6521,6 +7063,7 @@ var InMemoryOutbox = class {
 		record.lastError = error instanceof Error ? error.message : String(error ?? "unknown");
 		if (record.attempts >= this.maxDeliveryAttempts) {
 			this.pending.delete(dispatchId);
+			this.forgetCommittedVersion(dispatchId);
 			const deadLetter = {
 				dispatchId: record.dispatchId,
 				event: record.event,
@@ -6547,9 +7090,10 @@ function assertSameCandidateReceipt(event, received, recorded) {
 	assertReceiptShape(event, received, recorded, false);
 }
 /**
-* The lenient variant for PENDING records only: this in-memory adapter
-* cannot observe rollback, so a re-harvested event may legitimately arrive
-* at a new aggregateVersion. Index and commit cardinality stay immutable.
+* The lenient variant for PENDING records only: an outbox without an
+* `InMemoryTransactionScope` cannot observe a rollback, so a re-harvested
+* event may legitimately arrive at a new aggregateVersion. Index and commit
+* cardinality stay immutable.
 */
 function assertSameCandidateReceiptAllowingVersionRefresh(event, received, recorded) {
 	assertReceiptShape(event, received, recorded, true);
@@ -6558,12 +7102,77 @@ function assertReceiptShape(event, received, recorded, allowAggregateVersionRefr
 	if ((allowAggregateVersionRefresh || received.aggregateVersion === recorded.aggregateVersion) && received.commitSequence === recorded.commitSequence && received.commitSize === recorded.commitSize) return;
 	throw new EventHarvestError(`InMemoryOutbox rejected event "${event.eventId}": its commit candidate changed from (${recorded.aggregateVersion}, ${recorded.commitSequence}; commitSize=${recorded.commitSize}) to (${received.aggregateVersion}, ${received.commitSequence}; commitSize=${received.commitSize}). An exact redelivery must keep its source position immutable.`, event.type);
 }
+/**
+* The fields of a candidate that the outbox reads, read once and checked.
+* The function copies the source and the position. The event stays the
+* caller's object, because a dispatcher gets the event that the commit
+* recorded. The outbox reads only `eventId` and `type` from it, so these
+* must be own data properties: a read of them then runs no getter.
+*/
+function ownCandidate(candidate, index) {
+	let subject = `the candidate at index ${index}`;
+	let eventType;
+	const rejection = (field, expected, observed) => new EventHarvestError(`InMemoryOutbox rejected ${subject}: ${field} must be ${expected}, but it is ${observed}. Pass the candidates that withCommit builds.`, eventType);
+	if (typeof candidate !== "object" || candidate === null) throw rejection("the candidate", "an object", describeRejected(candidate));
+	const { event, source, position } = candidate;
+	if (typeof event !== "object" || event === null) throw rejection("event", "an object", describeRejected(event));
+	const eventId = Object.getOwnPropertyDescriptor(event, "eventId");
+	const type = Object.getOwnPropertyDescriptor(event, "type");
+	if (typeof type?.value === "string") eventType = type.value;
+	if (typeof eventId?.value === "string") subject = `event "${eventId.value}" (the candidate at index ${index})`;
+	for (const [field, descriptor] of [["event.eventId", eventId], ["event.type", type]]) {
+		if (descriptor === void 0) throw rejection(field, "an own data property", "missing");
+		if (!("value" in descriptor)) throw rejection(field, "an own data property", "an accessor");
+		if (typeof descriptor.value !== "string") throw rejection(field, "a string", describeRejected(descriptor.value));
+	}
+	if (typeof source !== "object" || source === null) throw rejection("source", "an object", describeRejected(source));
+	const { aggregateId, aggregateType } = source;
+	if (typeof aggregateType !== "string") throw rejection("source.aggregateType", "a string", describeRejected(aggregateType));
+	if (typeof aggregateId !== "string") throw rejection("source.aggregateId", "a string", describeRejected(aggregateId));
+	if (typeof position !== "object" || position === null) throw rejection("position", "an object", describeRejected(position));
+	const { aggregateVersion, commitSequence, commitSize } = position;
+	if (!Number.isSafeInteger(aggregateVersion) || aggregateVersion < 0) throw rejection("position.aggregateVersion", "an integer >= 0", describeRejected(aggregateVersion));
+	if (!Number.isSafeInteger(commitSize) || commitSize < 1) throw rejection("position.commitSize", "an integer >= 1", describeRejected(commitSize));
+	if (!Number.isSafeInteger(commitSequence) || commitSequence < 0 || commitSequence >= commitSize) throw rejection("position.commitSequence", `an integer from 0 to ${commitSize - 1}`, describeRejected(commitSequence));
+	return {
+		event,
+		source: Object.freeze({
+			aggregateId,
+			aggregateType
+		}),
+		position: Object.freeze({
+			aggregateVersion,
+			commitSequence,
+			commitSize
+		})
+	};
+}
+/** Describes a rejected value. It does not call `toString` of an object. */
+function describeRejected(value) {
+	if (typeof value === "string") return JSON.stringify(value);
+	if (value === null || value === void 0) return String(value);
+	if (typeof value === "object") return "an object";
+	if (typeof value === "function") return "a function";
+	if (typeof value === "symbol") return "a symbol";
+	return `${typeof value} ${String(value)}`;
+}
+/** Replaces the entries of a map with recorded ones, in their order. */
+function refill(map, entries) {
+	map.clear();
+	for (const [key, value] of entries) map.set(key, value);
+}
+function commitSizeMismatchError(event, source, position, recordedCommitSize) {
+	return new EventHarvestError(`InMemoryOutbox rejected event "${event.eventId}" for ${describeAggregateIdentity(source)}: aggregate version ${position.aggregateVersion} was already recorded with commitSize ${recordedCommitSize}, not ${position.commitSize}. An aggregate that was removed and created again under the same identity causes this too; the kit does not support that, so give the new aggregate a new id.`, event.type);
+}
+function positionOwnedError(event, source, position, positionOwner) {
+	return new EventHarvestError(`InMemoryOutbox rejected event "${event.eventId}" for ${describeAggregateIdentity(source)}: source position (${position.aggregateVersion}, ${position.commitSequence}) is already owned by event "${positionOwner}". One qualified source position must identify exactly one immutable event. An aggregate that was removed and created again under the same identity causes this too; the kit does not support that, so give the new aggregate a new id.`, event.type);
+}
 function staleHeadError(event, source, position, staleHeadVersion) {
-	return new EventHarvestError(`InMemoryOutbox rejected stale event "${event.eventId}" for ${source.aggregateType} ${source.aggregateId} at aggregate version ${position.aggregateVersion}: the event-source head is already ${staleHeadVersion}. The dispatched-id receipt may have expired; use a durable outbox with a transactional eventId unique key for unbounded idempotency.`, event.type);
+	return new EventHarvestError(`InMemoryOutbox rejected stale event "${event.eventId}" for ${describeAggregateIdentity(source)} at aggregate version ${position.aggregateVersion}: the event-source head is already ${staleHeadVersion}. There are two possible causes. First, the aggregate was removed and created again under the same identity. The kit does not support this, because the versions of the new aggregate restart below the head. Give the new aggregate a new id. Second, this is a retry of an event whose dispatched-id receipt expired. Use a durable outbox with a transactional eventId unique key for unbounded idempotency.`, event.type);
 }
 function assertSameEventSource(event, received, recorded) {
 	if (received.aggregateType === recorded.aggregateType && received.aggregateId === recorded.aggregateId) return;
-	throw new EventHarvestError(`InMemoryOutbox rejected eventId collision for "${event.eventId}": it already belongs to ${recorded.aggregateType} ${recorded.aggregateId}, but was received for ${received.aggregateType} ${received.aggregateId}. An eventId must identify one immutable event across all aggregate sources.`, event.type);
+	throw new EventHarvestError(`InMemoryOutbox rejected eventId collision for "${event.eventId}": it already belongs to ${describeAggregateIdentity(recorded)}, but was received for ${describeAggregateIdentity(received)}. An eventId must identify one immutable event across all aggregate sources.`, event.type);
 }
 
 //#endregion
@@ -6718,8 +7327,8 @@ var OutboxDispatcher = class extends PollLoop {
 		this.classifyFailure = options.classifyFailure;
 		this.deliveryTimeoutMs = options.deliveryTimeoutMs ?? 3e4;
 		this.storageTimeoutMs = options.storageTimeoutMs ?? 3e4;
-		assertNonNegativeFinite("OutboxDispatcher", "deliveryTimeoutMs", this.deliveryTimeoutMs);
-		assertNonNegativeFinite("OutboxDispatcher", "storageTimeoutMs", this.storageTimeoutMs);
+		assertTimerDelay("OutboxDispatcher", "deliveryTimeoutMs", this.deliveryTimeoutMs);
+		assertTimerDelay("OutboxDispatcher", "storageTimeoutMs", this.storageTimeoutMs);
 	}
 	/**
 	* One full dispatch pass (the `run`/`drainOnce` shell lives on
@@ -6813,6 +7422,19 @@ var OutboxDispatcher = class extends PollLoop {
 
 //#endregion
 //#region src/persistence/event-store/adapters/in-memory-event-store.ts
+/**
+* A copy of `event` that shares nothing with the caller. The walk rejects a
+* value that a copy would lose or change, for example a function, a class
+* instance, or an accessor, and what a freeze cannot make immutable (binary
+* data and a RegExp), as the event constructors do.
+* It runs no accessor unless a Proxy trap adds one. Its rejection names the
+* event, and any other error passes unchanged.
+*/
+function copyForStorage(event, index, stream) {
+	const subject = `InMemoryEventStore.append (stream ${describeAggregateIdentity(stream)}): events[${index}]`;
+	if (event === null || typeof event !== "object") throw new TypeError(`${subject} is not an event object`);
+	return detachFreezableState(event, subject);
+}
 function assertStreamPosition(name, value) {
 	if (value !== void 0 && (!Number.isSafeInteger(value) || value < 0)) throw new RangeError(`InMemoryEventStore: ${name} must be a non-negative safe integer, got ${String(value)}`);
 }
@@ -6826,20 +7448,19 @@ function assertStreamPosition(name, value) {
 * `InMemoryCapacityExceededError`; histories are never silently evicted.
 * Implements the full port contract: expectedVersion-guarded appends
 * (throwing `ConcurrencyConflictError` on mismatch), atomic rejected
-* appends, explicit missing/existing stream state with the actual head,
+* appends, explicit absent/existing stream state with the actual head,
 * append-order reads, mandatory page bounds, and `(fromVersion, toVersion]`
-* slicing. Invalid limits or positions reject with `RangeError`.
+* slicing. Invalid limits or positions reject with `RangeError`. A read
+* with an aborted `signal` rejects with its `reason`.
 *
 * For production, back the port with a durable store whose append and
 * the aggregate transaction share atomicity (a table with a
 * `(aggregate_type, aggregate_id, position)` unique key inside the same
 * transaction, or a dedicated event store). Same caveat as
-* `InMemoryOutbox`: this class
-* lives in memory only and knows nothing about your `TransactionScope`
-* rollbacks; events appended inside a transaction that later rolls back
-* are NOT removed. The event-sourced repository contract suite's
-* reference environment shows the snapshot/restore pattern for
-* rollback-pure in-memory testing.
+* `InMemoryOutbox`: this class lives in memory only. On its own, it knows
+* nothing about your `TransactionScope` rollbacks, so events appended inside
+* a transaction that later rolls back stay. Register the store with an
+* `InMemoryTransactionScope` for tests that roll back or retry.
 */
 var InMemoryEventStore = class {
 	streams = /* @__PURE__ */ new Map();
@@ -6852,14 +7473,48 @@ var InMemoryEventStore = class {
 		this.maxStreams = options.maxStreams;
 		this.maxEvents = options.maxEvents;
 	}
+	/**
+	* Records the state that a rollback of an `InMemoryTransactionScope`
+	* returns to: every stream and the event count.
+	*/
+	beginTransaction() {
+		const streams = [...this.streams].map(([key, events]) => [key, [...events]]);
+		const totalEvents = this.totalEvents;
+		return {
+			commit: () => {},
+			rollback: () => {
+				this.streams.clear();
+				for (const [key, events] of streams) this.streams.set(key, [...events]);
+				this.totalEvents = totalEvents;
+			}
+		};
+	}
 	async append(stream, events, options) {
-		if (events.length === 0) return;
-		const key = encodeAggregateAddress(stream);
+		const batch = Array.from(events);
+		if (batch.length === 0) return;
+		const identity = detachAggregateIdentity(stream);
+		const expectedVersion = options.expectedVersion;
+		const key = encodeAggregateIdentity(identity);
+		this.existingStreamForAppend(identity, key, expectedVersion, batch.length);
+		const owned = batch.map((event, index) => copyForStorage(event, index, identity));
+		let storedEvents = this.existingStreamForAppend(identity, key, expectedVersion, owned.length);
+		if (storedEvents === void 0) {
+			storedEvents = [];
+			this.streams.set(key, storedEvents);
+		}
+		for (const event of owned) storedEvents.push(event);
+		this.totalEvents += owned.length;
+	}
+	/**
+	* The stream that an append of `count` events at `expectedVersion`
+	* writes to, or `undefined` for a new stream. Throws when the version
+	* is stale or a capacity would overflow.
+	*/
+	existingStreamForAppend(stream, key, expectedVersion, count) {
 		const existing = this.streams.get(key);
-		if ((existing?.length ?? 0) !== options.expectedVersion) throw new ConcurrencyConflictError({
-			aggregateType: stream.aggregateType,
-			aggregateId: stream.aggregateId,
-			expectedVersion: options.expectedVersion,
+		if ((existing?.length ?? 0) !== expectedVersion) throw new ConcurrencyConflictError({
+			identity: stream,
+			expectedVersion,
 			reason: "stale_version",
 			actualVersion: existing?.length ?? 0
 		});
@@ -6870,26 +7525,21 @@ var InMemoryEventStore = class {
 			current: this.streams.size,
 			attempted: 1
 		});
-		if (this.maxEvents !== void 0 && this.totalEvents + events.length > this.maxEvents) throw new InMemoryCapacityExceededError({
+		if (this.maxEvents !== void 0 && this.totalEvents + count > this.maxEvents) throw new InMemoryCapacityExceededError({
 			store: "InMemoryEventStore",
 			resource: "events",
 			limit: this.maxEvents,
 			current: this.totalEvents,
-			attempted: events.length
+			attempted: count
 		});
-		let storedEvents = existing;
-		if (storedEvents === void 0) {
-			storedEvents = [];
-			this.streams.set(key, storedEvents);
-		}
-		for (const event of events) storedEvents.push(structuredClone(event));
-		this.totalEvents += events.length;
+		return existing;
 	}
 	async readStream(stream, options) {
 		if (!Number.isSafeInteger(options?.limit) || options.limit < 1) throw new RangeError(`InMemoryEventStore: limit must be a positive safe integer, got ${String(options?.limit)}`);
 		assertStreamPosition("fromVersion", options.fromVersion);
 		assertStreamPosition("toVersion", options.toVersion);
-		const events = this.streams.get(encodeAggregateAddress(stream));
+		if (options.signal?.aborted) throw abortReason(options.signal, "InMemoryEventStore.readStream aborted");
+		const events = this.streams.get(encodeAggregateIdentity(stream));
 		if (events === void 0) return {
 			exists: false,
 			lastVersion: 0,
@@ -6906,6 +7556,191 @@ var InMemoryEventStore = class {
 	}
 };
 
+//#endregion
+//#region src/persistence/event-store/reconstitute-from-stream-pages.ts
+/**
+* Reconstitutes an event-sourced aggregate from the pages of a stream read
+* and yields it only when the replay ends at the target version.
+*
+* This is the paged form of `reconstituteAggregateFromHistory`.
+* `createReplayTarget` builds the replay target: a fresh instance for a
+* full replay, or an instance reconstituted from a snapshot for a read that
+* starts at `snapshot.version`. `read` is the reachable branch of a kit
+* read, or the value that an adapter that pages on its own built.
+*
+* The call checks the window first. `targetVersion` must be a positive
+* safe integer, and `fromVersion` a non-negative one at or below it. A bad
+* window rejects with `RangeError` before the replay target is built.
+*
+* The call then primes the replay target with an empty history, so the
+* aggregate runs its own guard even when the read holds no page: a replay
+* target with pending decisions throws `UnreplayableAggregateError`. The
+* replay target must stand at `read.fromVersion`. A replay target at
+* another version throws {@link ReplayTargetMismatchError} before the
+* first page, even when it also rejected the empty history: a wiring
+* defect wins over a rejection that the data cannot explain.
+*
+* Each page goes through `replayHistory` on the replay target, so
+* allocation stays bounded by the size of a page; `readStreamPages` rejects
+* a page over its `limit`. An empty page, and a page that would run past
+* the target version, throw {@link InvalidEventStreamPageError} before any
+* row of them reaches the aggregate. Events carry no stream position, so
+* only the call can find pages that end short of the target version. After
+* the last page it compares the final version with `read.targetVersion` and
+* throws {@link ReplayTargetMismatchError} on a difference.
+*
+* When the aggregate rejects a stored event with a `DomainError`, the call
+* stops reading and returns {@link ReplayRejectedError} as `Err`. The
+* error names the stream and the window of the rejected page, and it holds
+* the `DomainError` as `cause`. The replay target never escapes on that
+* path. Wiring errors and a foreign row throw, as in `replayHistory`. What
+* `createReplayTarget` throws propagates.
+*/
+async function reconstituteAggregateFromStreamPages(createReplayTarget, read) {
+	assertNonNegativeSafeInteger("reconstituteAggregateFromStreamPages", "fromVersion", read.fromVersion);
+	assertPositiveSafeInteger("reconstituteAggregateFromStreamPages", "targetVersion", read.targetVersion);
+	if (read.fromVersion > read.targetVersion) throw new RangeError(`reconstituteAggregateFromStreamPages: fromVersion must not exceed targetVersion, got ${read.fromVersion} > ${read.targetVersion}`);
+	const aggregate = createReplayTarget();
+	const primed = aggregate.replayHistory([]);
+	if (aggregate.version !== read.fromVersion) throw new ReplayTargetMismatchError({
+		identity: read.stream,
+		reason: "target_not_at_cursor",
+		fromVersion: read.fromVersion,
+		targetVersion: read.targetVersion,
+		actualVersion: aggregate.version
+	});
+	if (primed.isErr()) return err(new ReplayRejectedError({
+		identity: read.stream,
+		fromVersion: aggregate.version,
+		toVersion: aggregate.version,
+		cause: primed.error
+	}));
+	for await (const page of read.pages) {
+		assertPageNotEmpty(read.stream, page.length, aggregate.version, read.targetVersion);
+		assertPageWithinWindow(read.stream, page.length, aggregate.version, read.targetVersion);
+		const versionBeforePage = aggregate.version;
+		const replayed = aggregate.replayHistory(page);
+		if (replayed.isErr()) return err(new ReplayRejectedError({
+			identity: read.stream,
+			fromVersion: versionBeforePage,
+			toVersion: versionBeforePage + page.length,
+			cause: replayed.error
+		}));
+	}
+	if (aggregate.version !== read.targetVersion) throw new ReplayTargetMismatchError({
+		identity: read.stream,
+		reason: "pages_short_of_target",
+		fromVersion: read.fromVersion,
+		targetVersion: read.targetVersion,
+		actualVersion: aggregate.version
+	});
+	return ok(aggregate);
+}
+
+//#endregion
+//#region src/persistence/repository/adapters/in-memory-transaction-scope.ts
+const ABORT_MESSAGE$1 = "InMemoryTransactionScope aborted";
+const { registry: registeredParticipants } = createGlobalCapabilityRegistry(Symbol.for("@shirudo/ddd-kit/in-memory-transaction-participants/v1"));
+/**
+* A {@link TransactionScope} for tests and demos that gives in-memory stores
+* a rollback. Register every store that the work writes inside the
+* transaction. When the work fails, each registered store undoes the writes
+* of the attempt, so the retry of a `RetryingTransactionScope` does not see
+* them. Each store decides what its rollback undoes, and its documentation
+* says so.
+*
+* **One transaction at a time.** A store cannot tell which of two open
+* transactions a write belongs to. The scope therefore runs its transactions
+* one after the other, in call order. A queued transaction stops its wait
+* when its abort signal fires. Work that waits inside a transaction for
+* another transaction of the same scope never finishes, because the inner
+* transaction waits for the outer one. Only the abort signal of the inner
+* transaction ends that wait. A database with only one connection behaves
+* the same way. Use a database with real isolation to test concurrent
+* transactions.
+*
+* **Code outside a transaction.** A dispatcher, a deadline processor, and a
+* `hasReached` check run outside the transactions. Outbox `getPending`,
+* deadline `due`, and checkpoint `hasReached` read only committed writes.
+* Other reads also see the writes of an open transaction. A store that
+* restores its whole state on rollback also undoes the writes that code
+* outside the transaction made meanwhile. An example is an acknowledgement
+* of an outbox dispatcher. The dispatcher then delivers the record again,
+* which the at-least-once contract allows.
+*
+* **A store belongs to one scope.** A scope works like one in-memory
+* database, so register all stores of a test with one scope. A second scope
+* with a registered store throws at construction, because the rollback of
+* one scope would undo a commit of the other.
+*
+* A store that is not registered keeps its own behavior: it does not roll
+* back.
+*/
+var InMemoryTransactionScope = class {
+	participants;
+	lastTransaction = Promise.resolve();
+	constructor(participants) {
+		const listed = /* @__PURE__ */ new Map();
+		for (const [index, participant] of participants.entries()) {
+			if (typeof participant?.beginTransaction !== "function") throw new TypeError(`InMemoryTransactionScope: participant ${index} has no beginTransaction method.`);
+			const firstIndex = listed.get(participant);
+			if (firstIndex !== void 0) throw new TypeError(`InMemoryTransactionScope: participant ${index} repeats participant ${firstIndex}.`);
+			if (registeredParticipants.has(participant)) throw new TypeError(`InMemoryTransactionScope: participant ${index} already belongs to an InMemoryTransactionScope. Register all in-memory stores of a test with one scope.`);
+			listed.set(participant, index);
+		}
+		for (const participant of listed.keys()) registeredParticipants.set(participant, this);
+		this.participants = [...listed.keys()];
+	}
+	async transactional(fn, options) {
+		const previous = this.lastTransaction;
+		let finish;
+		this.lastTransaction = new Promise((resolve) => {
+			finish = resolve;
+		});
+		const signal = options?.signal;
+		try {
+			await waitRejectingOnAbort(previous, signal, ABORT_MESSAGE$1);
+			if (signal?.aborted) throw abortReason(signal, ABORT_MESSAGE$1);
+			const transactions = [];
+			let result;
+			try {
+				for (const participant of this.participants) transactions.push(participant.beginTransaction());
+				result = await fn(void 0);
+			} catch (error) {
+				const rollback = endAll([...transactions].reverse(), (transaction) => transaction.rollback());
+				throw rollback.failed ? rollback.failure : error;
+			}
+			const commit = endAll(transactions, (transaction) => transaction.commit());
+			if (commit.failed) throw commit.failure;
+			return result;
+		} finally {
+			previous.then(finish);
+		}
+	}
+};
+/**
+* Ends every transaction, also after a failed end, and returns the first
+* failure. For a rollback, a scope that rejects with a different error than
+* the failure inside the transaction tells `UnitOfWork.run` that the
+* rollback failed.
+*/
+function endAll(transactions, end) {
+	let failure;
+	let failed = false;
+	for (const transaction of transactions) try {
+		end(transaction);
+	} catch (error) {
+		if (!failed) {
+			failure = error;
+			failed = true;
+		}
+	}
+	return {
+		failed,
+		failure
+	};
+}
+
 //#endregion
 //#region src/persistence/repository/retrying-scope.ts
 const DEFAULT_MAX_ATTEMPTS = 3;
@@ -6940,6 +7775,10 @@ function defaultSleep(ms, signal) {
 * After `maxAttempts` the last error is rethrown unchanged, so a caller
 * can still match `ConcurrencyConflictError` and map it to HTTP 409.
 *
+* **Attempts.** Before each attempt, the scope calls `onAttemptStart` from
+* the `transactional` options, so the caller can attribute a failure to the
+* attempt that raised it.
+*
 * **Cancellation.** The `AbortSignal` from `transactional` options is
 * checked before each attempt and aborts the backoff wait, so an
 * `AbortSignal.timeout(ms)` bounds total elapsed time (there is
@@ -6960,8 +7799,8 @@ var RetryingTransactionScope = class {
 		this.baseDelayMs = policy.baseDelayMs ?? DEFAULT_BASE_DELAY_MS;
 		this.maxDelayMs = policy.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;
 		assertPositiveInteger("RetryingTransactionScope", "maxAttempts", this.maxAttempts);
-		assertNonNegativeFinite("RetryingTransactionScope", "baseDelayMs", this.baseDelayMs);
-		assertNonNegativeFinite("RetryingTransactionScope", "maxDelayMs", this.maxDelayMs);
+		assertTimerDelay("RetryingTransactionScope", "baseDelayMs", this.baseDelayMs);
+		assertTimerDelay("RetryingTransactionScope", "maxDelayMs", this.maxDelayMs);
 		this.isRetryable = policy.isRetryable ?? someChainRetryable;
 		this.sleep = policy.sleep ?? defaultSleep;
 		this.random = neutralJitterSource(policy.random ?? Math.random);
@@ -6979,6 +7818,7 @@ var RetryingTransactionScope = class {
 		};
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
 			if (signal?.aborted) throw abortReason(signal, ABORT_MESSAGE);
+			options?.onAttemptStart?.();
 			try {
 				return await this.inner.transactional(fn, options);
 			} catch (error) {
@@ -7014,6 +7854,13 @@ var RetryingTransactionScope = class {
 * rebuildable derived data, so `maxEntries` may evict the least recently used
 * entry and `ttlMs` may expire it safely. A load updates LRU recency but does
 * not extend TTL; only another save does.
+*
+* The port keeps snapshot writes out of the write transaction, so the store
+* does not roll back on its own. If you register it with an
+* `InMemoryTransactionScope`, a rollback restores the snapshots, their LRU
+* order, and their expiry from the start of the transaction. It also undoes
+* a save or a delete that code made outside the transaction meanwhile. This
+* is safe, because a snapshot is derived data.
 */
 var InMemorySnapshotStore = class {
 	snapshots = /* @__PURE__ */ new Map();
@@ -7027,8 +7874,22 @@ var InMemorySnapshotStore = class {
 		this.ttlMs = options.ttlMs;
 		this.clock = options.clock ?? (() => /* @__PURE__ */ new Date());
 	}
-	async load(address) {
-		const key = encodeAggregateAddress(address);
+	/**
+	* Records the state that a rollback of an `InMemoryTransactionScope`
+	* returns to: every snapshot in LRU order.
+	*/
+	beginTransaction() {
+		const snapshots = [...this.snapshots];
+		return {
+			commit: () => {},
+			rollback: () => {
+				this.snapshots.clear();
+				for (const [key, stored] of snapshots) this.snapshots.set(key, stored);
+			}
+		};
+	}
+	async load(identity) {
+		const key = encodeAggregateIdentity(identity);
 		const stored = this.snapshots.get(key);
 		if (stored === void 0) return void 0;
 		if (stored.expiresAtMs !== void 0 && this.readClock() >= stored.expiresAtMs) {
@@ -7039,9 +7900,9 @@ var InMemorySnapshotStore = class {
 		this.snapshots.set(key, stored);
 		return structuredClone(stored.snapshot);
 	}
-	async save(address, snapshot) {
+	async save(identity, snapshot) {
 		const ownedSnapshot = structuredClone(snapshot);
-		const key = encodeAggregateAddress(address);
+		const key = encodeAggregateIdentity(identity);
 		let expiresAtMs;
 		if (this.ttlMs !== void 0) {
 			const nowMs = this.readClock();
@@ -7058,8 +7919,8 @@ var InMemorySnapshotStore = class {
 			expiresAtMs
 		});
 	}
-	async delete(address) {
-		this.snapshots.delete(encodeAggregateAddress(address));
+	async delete(identity) {
+		this.snapshots.delete(encodeAggregateIdentity(identity));
 	}
 	readClock() {
 		const now = this.clock();
@@ -7122,7 +7983,10 @@ function reconstituteAggregateFromSnapshot(model, id, snapshot) {
 	try {
 		version = toVersion(snapshot.version);
 	} catch (error) {
-		throw new SnapshotCorruptedError(`Snapshot of ${model.aggregateType} ${String(id)} carries the invalid version ${String(snapshot.version)}. Discard the derived snapshot and refold from the stream.`, error);
+		throw new SnapshotCorruptedError(`Snapshot of ${describeAggregateIdentity({
+			aggregateType: model.aggregateType,
+			aggregateId: String(id)
+		})} carries the invalid version ${String(snapshot.version)}. Discard the derived snapshot and refold from the stream.`, error);
 	}
 	let aggregate;
 	try {
@@ -7130,19 +7994,26 @@ function reconstituteAggregateFromSnapshot(model, id, snapshot) {
 		if (storedSchemaVersion === model.schemaVersion) state = detachState(snapshot.state);
 		else if (model.migrate) state = detachState(model.migrate(detachState(snapshot.state), storedSchemaVersion));
 		else throw new SnapshotSchemaMismatchError({
-			aggregateType: model.aggregateType,
-			aggregateId: String(id),
+			identity: {
+				aggregateType: model.aggregateType,
+				aggregateId: String(id)
+			},
 			expectedSchemaVersion: model.schemaVersion,
 			actualSchemaVersion: storedSchemaVersion
 		});
 		aggregate = model.reconstitute(id, state, version);
 	} catch (error) {
-		if (isDomainErrorLike(error)) throw new SnapshotCorruptedError(`Snapshot of ${model.aggregateType} ${String(id)} (schema ${storedSchemaVersion}, version ${String(snapshot.version)}) was rejected during reconstitution. Discard the derived snapshot and refold from the stream.`, error);
+		if (isDomainErrorLike(error)) throw new SnapshotCorruptedError(`Snapshot of ${describeAggregateIdentity({
+			aggregateType: model.aggregateType,
+			aggregateId: String(id)
+		})} (schema ${storedSchemaVersion}, version ${String(snapshot.version)}) was rejected during reconstitution. Discard the derived snapshot and refold from the stream.`, error);
 		throw error;
 	}
 	if (aggregate.version !== snapshot.version) throw new SnapshotVersionNotRestoredError({
-		aggregateType: model.aggregateType,
-		aggregateId: String(id),
+		identity: {
+			aggregateType: model.aggregateType,
+			aggregateId: String(id)
+		},
 		snapshotVersion: snapshot.version,
 		restoredVersion: aggregate.version
 	});
@@ -7160,5 +8031,5 @@ function copySnapshotAt(snapshotAt) {
 }
 
 //#endregion
-export { AggregateDeletedError, AggregateNotFoundError, AggregateTrackingError, CapabilityRegistryConflictError, CommandBus, CommitError, ConcurrencyConflictError, DeadlineProcessor, DirectStateMutationError, DomainError, DomainEventValidationError, DomainStateMachine, DomainTransitionGuardRejectedError, DuplicateAggregateError, DuplicateEventIdError, DuplicateHandlerRegistrationError, Entity, ErrorMapperFailedError, EventBusClosedError, EventBusImpl, EventHarvestError, EventSourcedAggregate, FoldReturnedNoStateError, ForeignEventError, HostileStateKeyError, IdempotencyClaimLostError, IdempotencyCompletionWithoutClaimError, IdempotencyInFlightError, IdempotencyKeyReuseError, IdempotencyReconciliationRequiredError, IdentityMap, InMemoryCapacityExceededError, InMemoryDeadlineStore, InMemoryEventStore, InMemoryIdempotencyStore, InMemoryOutbox, InMemoryProjectionCheckpointStore, InMemorySnapshotStore, InfrastructureError, InvalidCommandMessageError, InvalidDomainMachineContextError, InvalidDomainMachineDefinitionError, InvalidDomainMachineInputError, InvalidDomainMachineSnapshotError, InvalidDomainTransitionError, InvalidDomainTransitionGuardResultError, InvalidDomainTransitionResultError, InvalidFlushStatementError, InvalidIntegrationMessageError, InvalidRepositoryAdapterError, InvalidRepositoryDefinitionError, InvalidVersionError, MisaddressedEventError, MissingEntityIdError, MissingFoldError, MissingHandlerError, NestedUnitOfWorkError, NonProgressingEventStreamPageError, OutboxDispatcher, PendingEventBatchMismatchError, PendingEventLimitExceededError, ProjectionGapError, ProjectionIdentityViolationError, ProjectionOrderViolationError, ProjectionReceiptViolationError, Projector, PublishDepthExceededError, QueryBus, ReentrantDomainStateMachineEvaluationError, ReentrantEventRecordingError, ReplayHeadMismatchError, RepositoryErrorMappingFailedError, RetryingTransactionScope, RollbackError, SnapshotCorruptedError, SnapshotSchemaMismatchError, SnapshotTimeValidationError, SnapshotVersionNotRestoredError, Specification, StateStoredAggregate, TransactionClosedError, UnenrolledChangesError, UnitOfWork, UnmanagedInstanceError, UnmintedEventError, UnprojectableEventError, UnregisteredHandlerError, UnreplayableAggregateError, ValueObject, analyzeDomainMachineDefinition, canTransitionDomainState, captureAggregateSnapshot, capturePersistenceBaseline, copyMetadata, createDomainEvent, createDomainEventFactory, createDomainEventFromFacts, createInitialDomainMachineSnapshot, createIntegrationMessage, createUncommittedDomainEvent, decodeIntegrationMessage, deepEqual, deepEqualExcept, deepFreeze, deepOmit, defaultDomainEventFactory, defineRepository, defineSnapshotModel, derivePersistenceChanges, detachState, domainErrorToResult, encodeIntegrationMessage, entityIds, eventBusSink, findEntityById, freezeShallow, hasEntityId, ignoreProjectionEvent, insertPersistenceBaseline, integrationMessageToCommittedEvent, isDomainErrorLike, isInfrastructureErrorLike, isPositionAfter, isWiringErrorLike, mergeMetadata, outboxWriterAcceptingEventLoss, persistenceProjectionDrifted, prepareDomainMachineDefinition, projectionFromHandlers, recapturePersistenceBaseline, reconstituteAggregateFromHistory, reconstituteAggregateFromSnapshot, recordDomainEvent, recordPendingEvents, removeEntityById, replaceEntityById, routeEventsToCommandOutbox, sameEntity, sameVersion, specification, toVersion, transitionDomainState, updateEntityById, versionedFlush, vo, voEquals, voEqualsExcept, voValidated, voWithValidation, withCommit, withIdempotentCommit };
+export { AggregateDeletedError, AggregateNotFoundError, AggregateTrackingError, CapabilityRegistryConflictError, CommandBus, CommitError, ConcurrencyConflictError, DeadlineProcessor, DirectStateMutationError, DomainError, DomainEventValidationError, DomainStateMachine, DomainTransitionGuardRejectedError, DuplicateAggregateError, DuplicateEventIdError, DuplicateHandlerRegistrationError, Entity, ErrorMapperFailedError, EventBusClosedError, EventBusImpl, EventHarvestError, EventSourcedAggregate, FoldReturnedNoStateError, ForeignEventError, HostileStateKeyError, IdempotencyClaimLostError, IdempotencyCompletionWithoutClaimError, IdempotencyInFlightError, IdempotencyKeyReuseError, IdempotencyReconciliationRequiredError, IdentityMap, InMemoryCapacityExceededError, InMemoryDeadlineStore, InMemoryEventStore, InMemoryIdempotencyStore, InMemoryOutbox, InMemoryProjectionCheckpointStore, InMemorySnapshotStore, InMemoryTransactionScope, InfrastructureError, InvalidCommandMessageError, InvalidDomainMachineContextError, InvalidDomainMachineDefinitionError, InvalidDomainMachineInputError, InvalidDomainMachineSnapshotError, InvalidDomainTransitionError, InvalidDomainTransitionGuardResultError, InvalidDomainTransitionResultError, InvalidEventStreamPageError, InvalidFlushStatementError, InvalidIntegrationMessageError, InvalidRepositoryAdapterError, InvalidRepositoryDefinitionError, InvalidVersionError, MisattributedEventError, MissingEntityIdError, MissingFoldError, MissingHandlerError, NestedUnitOfWorkError, OutboxDispatcher, PendingEventBatchMismatchError, PendingEventLimitExceededError, ProjectionGapError, ProjectionIdentityViolationError, ProjectionOrderViolationError, ProjectionReceiptViolationError, Projector, PublishDepthExceededError, QueryBus, ReentrantDomainStateMachineEvaluationError, ReentrantEventRecordingError, ReplayRejectedError, ReplayTargetMismatchError, RepositoryErrorMappingFailedError, RetryingTransactionScope, RollbackError, SnapshotCorruptedError, SnapshotSchemaMismatchError, SnapshotTimeValidationError, SnapshotVersionNotRestoredError, Specification, StateStoredAggregate, TransactionClosedError, UnenrolledChangesError, UnitOfWork, UnmanagedInstanceError, UnmintedEventError, UnprojectableEventError, UnregisteredHandlerError, UnreplayableAggregateError, ValueObject, analyzeDomainMachineDefinition, canTransitionDomainState, captureAggregateSnapshot, capturePersistenceBaseline, classifyConcurrencyConflict, copyMetadata, createDomainEvent, createDomainEventFactory, createDomainEventFromFacts, createInitialDomainMachineSnapshot, createIntegrationMessage, createUncommittedDomainEvent, decodeIntegrationMessage, deepEqual, deepEqualExcept, deepFreeze, deepOmit, defaultDomainEventFactory, defineRepository, defineSnapshotModel, derivePersistenceChanges, detachState, domainErrorToResult, encodeIntegrationMessage, entityIds, eventBusSink, findEntityById, freezeShallow, hasEntityId, ignoreProjectionEvent, insertPersistenceBaseline, integrationMessageToCommittedEvent, isDomainErrorLike, isInfrastructureErrorLike, isPositionAfter, isWiringErrorLike, mergeMetadata, outboxWriterAcceptingEventLoss, persistenceProjectionDrifted, pinTargetVersion, prepareDomainMachineDefinition, projectionFromHandlers, readStreamPages, recapturePersistenceBaseline, reconstituteAggregateFromHistory, reconstituteAggregateFromSnapshot, reconstituteAggregateFromStreamPages, recordDomainEvent, recordPendingEvents, removeEntityById, replaceEntityById, routeEventsToCommandOutbox, sameEntity, sameVersion, specification, toVersion, transitionDomainState, updateEntityById, versionedFlush, vo, voEquals, voEqualsExcept, voValidated, voWithValidation, withCommit, withIdempotentCommit };
 //# sourceMappingURL=index.js.map