@sixb/core 0.1.0 → 0.1.2

package/dist/{chunk-yvef9xwc.js → chunk-st4xgxey.js}

@@ -1,17 +1,19 @@
 // @bun
 import {
-  isStorageSerializationFailure
-} from "./chunk-aebzcsxr.js";
+  ensureExecutionRecord,
+  executionRecordInputFromRuntime
+} from "./chunk-8ryen3p3.js";
 import {
-  materializationApplyPhase
-} from "./chunk-q4qzq0ea.js";
+  isStorageSerializationFailure
+} from "./chunk-ys1nse2v.js";
 import {
   createCommitId,
   createEventId,
   createRequestHash,
+  materializationApplyPhase,
   materializationEventKindOrdinal,
   sha256Canonical
-} from "./chunk-wxhdnwh4.js";
+} from "./chunk-fmx1sz2h.js";
 import {
   assertPinnedDatasetWatermark
 } from "./chunk-9dzba0f2.js";
@@ -32,7 +34,7 @@ import {
   telemetryPointKey,
   telemetryPointSortKey,
   utf8JsonByteLength
-} from "./chunk-p6r5g77m.js";
+} from "./chunk-vybf6pkp.js";
 import {
   MaterializationCancellationError,
   MaterializationConflictError,
@@ -48,18 +50,19 @@ import {
   validateObjectProperties,
   validatePropertyValue,
   validateTelemetryUnit
-} from "./chunk-tsk2bxs3.js";
+} from "./chunk-rnshztfq.js";
 import {
   ProjectionValidationError,
   isProjectionDefinition,
+  resolveExecutionScopeAuthorization,
   validateProjectionsAtStartup
-} from "./chunk-btpe64e4.js";
+} from "./chunk-34bqh420.js";
 import {
   assertJsonValue,
   cloneJsonValue,
   compareStrings,
   stableJsonStringify
-} from "./chunk-1vffvydj.js";
+} from "./chunk-t8t39h7v.js";
 // src/projections/revision.ts
 function computeOntologyRevision(ontology) {
   const referencedValueTypeIds = collectOntologyValueTypeDependencies(ontology);
@@ -324,16 +327,19 @@ class ProjectionRegistry {
       this.dispatchById.set(descriptor.projectionId, descriptor);
     }
   }
-  listObjectProjections() {
+  list() {
+    return [...this.objectProjections, ...this.linkProjections, ...this.telemetryProjections];
+  }
+  listObjects() {
     return this.objectProjections;
   }
-  listLinkProjections() {
+  listLinks() {
     return this.linkProjections;
   }
-  listTelemetryProjections() {
+  listTelemetry() {
     return this.telemetryProjections;
   }
-  getProjectionById(projectionId) {
+  getById(projectionId) {
     return this.projectionsById.get(projectionId) ?? null;
   }
   getDispatchDescriptors() {
@@ -456,7 +462,7 @@ function deepFreeze(value) {
 }
 // src/materializer/shared/batching.ts
 var DEFAULT_MATERIALIZATION_BATCHING = Object.freeze({
-  sourceStageRows: 1000,
+  sourceStageRows: 2000,
   sourceStageBytes: 4 * 1024 * 1024,
   statePageRows: 1000,
   planChunkRows: 1000,
@@ -571,7 +577,7 @@ function createMaterializerContext(input) {
 }
 
 // src/materializer/execution/commit-lifecycle.ts
-async function replayCommitRecord(context, identity, storage = context.storage) {
+async function replayCommitRecord(context, identity, executionId, storage = context.storage) {
   const existing = await storage.ontology.commits.getByIdempotencyKey({
     projectId: context.projectId,
     idempotencyKey: identity.idempotencyKey
@@ -581,10 +587,13 @@ async function replayCommitRecord(context, identity, storage = context.storage)
   if (existing.requestHash !== identity.requestHash) {
     throw new MaterializationConflictError("idempotency", `Idempotency key '${identity.idempotencyKey}' was reused with different intent.`);
   }
+  if (existing.executionId !== executionId) {
+    throw new MaterializationConflictError("idempotency", `Idempotency key '${identity.idempotencyKey}' belongs to execution '${existing.executionId}', not '${executionId}'.`);
+  }
   return existing;
 }
-async function replayCommit(context, identity, storage = context.storage) {
-  const existing = await replayCommitRecord(context, identity, storage);
+async function replayCommit(context, identity, executionId, storage = context.storage) {
+  const existing = await replayCommitRecord(context, identity, executionId, storage);
   if (!existing)
     return null;
   return { ...structuredClone(existing.result), created: false };
@@ -602,6 +611,43 @@ async function withSerializationRetry(context, run) {
   }
 }
 
+// src/materializer/execution/scope.ts
+function prepareMaterializerExecution(projectId, scope) {
+  const authorization = resolveExecutionScopeAuthorization(projectId, scope);
+  const base = {
+    scope,
+    record: executionRecordInputFromRuntime({
+      execution: scope.execution,
+      runtimeAuthorization: scope.authorization
+    }),
+    executionId: scope.execution.id,
+    correlationId: scope.execution.correlationId
+  };
+  if (authorization.type !== "principal")
+    return base;
+  return { ...base, actor: authorization.context.principal };
+}
+function ensureMaterializerExecution(executions, execution) {
+  return ensureExecutionRecord(executions, execution.record);
+}
+function assertRuntimeMutationExecution(execution) {
+  if (execution.scope.execution.executor.type !== "kernel")
+    return;
+  throw new MaterializationValidationError(`Kernel execution '${execution.executionId}' cannot enter the runtime mutation boundary.`);
+}
+function assertTrustedPrimitiveMutationExecution(execution, primitive) {
+  const executor = execution.scope.execution.executor;
+  if (executor.type === "primitive" && executor.kind === primitive.kind && executor.id === primitive.id && executor.runId === primitive.runId) {
+    return;
+  }
+  throw new MaterializationConflictError("run-correlation", `Execution '${execution.executionId}' does not own ${primitive.kind} run '${primitive.runId}'.`);
+}
+function assertMaterializerRunExecution(execution, runExecutionId, label) {
+  if (runExecutionId === execution.executionId)
+    return;
+  throw new MaterializationConflictError("run-correlation", `${label} belongs to execution '${runExecutionId}', not '${execution.executionId}'.`);
+}
+
 // src/materializer/effective/build-events.ts
 function buildObjectMaterializationEventDraft(input) {
   const draft = buildObjectEventDraft(input, input.change);
@@ -713,6 +759,7 @@ function eventDraftBase(context) {
     schemaVersion: 1,
     projectId: context.projectId,
     occurredAt: context.committedAt,
+    correlationId: context.correlationId,
     origin: context.origin,
     commitId: context.commitId
   };
@@ -780,7 +827,13 @@ async function* planStream(items, batching) {
 }
 function mutableChunk() {
   return {
-    overrides: { objectUpserts: [], objectDeletes: [], linkUpserts: [], linkDeletes: [] },
+    overrides: {
+      objects: { upserts: [], deletes: [] },
+      links: {
+        edges: { upserts: [], deletes: [] },
+        slots: { upserts: [], deletes: [] }
+      }
+    },
     effective: { objectUpserts: [], objectDeletes: [], linkUpserts: [], linkDeletes: [] },
     timeseries: { pointUpserts: [] },
     outbox: []
@@ -789,16 +842,22 @@ function mutableChunk() {
 function appendItem(chunk, item) {
   switch (item.kind) {
     case "object-override-upsert":
-      chunk.overrides.objectUpserts.push(item.value);
+      chunk.overrides.objects.upserts.push(item.value);
       break;
     case "object-override-delete":
-      chunk.overrides.objectDeletes.push(item.value);
+      chunk.overrides.objects.deletes.push(item.value);
       break;
     case "link-override-upsert":
-      chunk.overrides.linkUpserts.push(item.value);
+      chunk.overrides.links.edges.upserts.push(item.value);
       break;
     case "link-override-delete":
-      chunk.overrides.linkDeletes.push(item.value);
+      chunk.overrides.links.edges.deletes.push(item.value);
+      break;
+    case "link-slot-override-upsert":
+      chunk.overrides.links.slots.upserts.push(item.value);
+      break;
+    case "link-slot-override-delete":
+      chunk.overrides.links.slots.deletes.push(item.value);
       break;
     case "object-upsert":
       chunk.effective.objectUpserts.push(item.value);
@@ -822,7 +881,7 @@ function appendItem(chunk, item) {
 }
 
 // src/materializer/execution/work-records.ts
-function appendObjectOverridePlan(items, working, identity) {
+function appendObjectOverrideWork(items, working, identity) {
   if (stableJsonStringify(working.originalOverride?.value ?? null) === stableJsonStringify(working.override)) {
     return;
   }
@@ -844,7 +903,7 @@ function appendObjectOverridePlan(items, working, identity) {
     });
   }
 }
-function appendLinkOverridePlan(items, working, identity) {
+function appendLinkEdgeOverrideWork(items, working, identity) {
   if (stableJsonStringify(working.originalOverride?.value ?? null) === stableJsonStringify(working.override)) {
     return;
   }
@@ -866,7 +925,32 @@ function appendLinkOverridePlan(items, working, identity) {
     });
   }
 }
-function appendObjectEffectivePlan(items, change) {
+function appendLinkSlotOverrideWork(items, working, identity) {
+  if (stableJsonStringify(working.originalOverride?.value ?? null) === stableJsonStringify(working.override)) {
+    return;
+  }
+  if (working.override) {
+    items.push({
+      kind: "link-slot-override-upsert",
+      value: {
+        ref: working.ref,
+        value: working.override,
+        expectedLastCommitId: working.originalOverride?.lastCommitId ?? null,
+        lastCommitId: identity.commitId,
+        updatedAt: identity.committedAt
+      }
+    });
+  } else if (working.originalOverride) {
+    items.push({
+      kind: "link-slot-override-delete",
+      value: {
+        ref: working.ref,
+        expectedLastCommitId: working.originalOverride.lastCommitId
+      }
+    });
+  }
+}
+function appendEffectiveObjectWork(items, change) {
   if (change.kind === "deleted") {
     items.push({
       kind: "object-delete",
@@ -885,7 +969,7 @@ function appendObjectEffectivePlan(items, change) {
     });
   }
 }
-function appendLinkEffectivePlan(items, change) {
+function appendEffectiveLinkWork(items, change) {
   if (change.kind === "deleted") {
     items.push({
       kind: "link-delete",
@@ -996,6 +1080,7 @@ async function drainStagedWork(context, storage, session, signal) {
   await flush();
 }
 async function validateStagedCardinality(context, storage, session, signal) {
+  let currentView = null;
   let currentScope = null;
   let occupant = null;
   for await (const page of storage.streamWork({
@@ -1008,14 +1093,15 @@ async function validateStagedCardinality(context, storage, session, signal) {
       if (record.kind !== "cardinality") {
         throw new MaterializationValidationError("Provider returned non-cardinality cardinality work.");
       }
-      if (record.scopeSortKey !== currentScope) {
+      if (record.view !== currentView || record.scopeSortKey !== currentScope) {
+        currentView = record.view;
         currentScope = record.scopeSortKey;
         occupant = null;
       }
       if (!record.occupied)
         continue;
       if (occupant && occupant !== record.linkSortKey) {
-        throw new MaterializationValidationError(`Link scope '${record.ref.source.objectTypeId}.${record.ref.linkId}' has cardinality one.`);
+        throw new MaterializationValidationError(record.view === "candidate" ? `Projection source scope '${record.ref.source.objectTypeId}.${record.ref.linkId}' has cardinality one.` : `Link scope '${record.ref.source.objectTypeId}.${record.ref.linkId}' has cardinality one.`);
       }
       occupant = record.linkSortKey;
     }
@@ -1067,18 +1153,6 @@ function normalizeNonblank(value, label) {
   }
   return value;
 }
-function normalizeEventActor(actor) {
-  if (typeof actor !== "object" || actor === null || Array.isArray(actor)) {
-    throw new MaterializationValidationError("Event actor must be an object.");
-  }
-  if (actor.type !== "user" && actor.type !== "serviceAccount" && actor.type !== "system") {
-    throw new MaterializationValidationError("Event actor type must be 'user', 'serviceAccount', or 'system'.");
-  }
-  return Object.freeze({
-    type: actor.type,
-    id: normalizeNonblank(actor.id, "Event actor id")
-  });
-}
 function normalizeTimestamp(value, label) {
   const milliseconds = Date.parse(value);
   if (!Number.isFinite(milliseconds)) {
@@ -1243,7 +1317,6 @@ function normalizeOntologyEditCommit(input) {
         kind: "runtime",
         requestId: normalizeNonblank(input.source.requestId, "Runtime request id")
       }),
-      ...input.actor !== undefined ? { actor: normalizeEventActor(input.actor) } : {},
       operations: Object.freeze(operations),
       ...input.operationGroups !== undefined ? { operationGroups: normalizeOperationGroups(input.operationGroups, operationIds) } : {}
     });
@@ -1262,7 +1335,6 @@ function normalizeOntologyEditCommit(input) {
   return Object.freeze({
     mode: "atomic",
     source,
-    ...input.actor !== undefined ? { actor: normalizeEventActor(input.actor) } : {},
     operations: Object.freeze(operations),
     expectedObjects: deduplicateExpectations(expectedObjects, (value) => objectRefKey(value.ref), "Expected objects"),
     expectedLinks: deduplicateExpectations(expectedLinks, (value) => linkRefKey(value.ref), "Expected links"),
@@ -1401,7 +1473,6 @@ function normalizeTelemetryAppend(input) {
   }
   return Object.freeze({
     source,
-    ...input.actor !== undefined ? { actor: normalizeEventActor(input.actor) } : {},
     points: Object.freeze(points)
   });
 }
@@ -1444,56 +1515,16 @@ async function loadState(context, storage, session, request) {
   return result;
 }
 
-// src/materializer/edits/read-set.ts
-function buildEditReadSet(ontology, operations) {
-  const objects = new Map;
-  const links = new Map;
-  const scopes = new Map;
-  const incidentObjects = new Map;
-  for (const operation of operations) {
-    if (isObjectOperation(operation)) {
-      if (!ontology.getObjectTypeById(operation.ref.objectTypeId))
-        continue;
-      objects.set(objectRefKey(operation.ref), operation.ref);
-      if (operation.kind !== "object.patch") {
-        incidentObjects.set(objectRefKey(operation.ref), operation.ref);
-      }
-      continue;
-    }
-    if (!isKnownLinkRef(ontology, operation.ref))
-      continue;
-    links.set(linkRefKey(operation.ref), operation.ref);
-    objects.set(objectRefKey(operation.ref.source), operation.ref.source);
-    objects.set(objectRefKey(operation.ref.target), operation.ref.target);
-    if (linkCardinality(ontology, operation.ref) === "one") {
-      const scope = { source: operation.ref.source, linkId: operation.ref.linkId };
-      scopes.set(linkScopeKey(scope.source, scope.linkId), scope);
-    }
-  }
-  return {
-    objects: [...objects.values()].sort(compareObjectRefs),
-    links: [...links.values()].sort(compareLinkRefs),
-    linkScopes: [...scopes.values()].sort((left, right) => linkScopeKey(left.source, left.linkId).localeCompare(linkScopeKey(right.source, right.linkId))),
-    incidentObjects: [...incidentObjects.values()].sort(compareObjectRefs),
-    points: []
-  };
-}
-function isKnownLinkRef(ontology, ref) {
-  const sourceType = ontology.getObjectTypeById(ref.source.objectTypeId);
-  if (!sourceType || !ontology.getObjectTypeById(ref.target.objectTypeId))
-    return false;
-  const link = sourceType.links.find((candidate) => candidate.id === ref.linkId);
-  return Boolean(link && ontology.isValidLinkTarget(link.targetObjectTypeId, ref.target.objectTypeId));
-}
-function linkCardinality(ontology, ref) {
-  const definition = ontology.getObjectTypeById(ref.source.objectTypeId)?.links.find((candidate) => candidate.id === ref.linkId);
-  return definition?.cardinality ?? "many";
-}
-function isObjectOperation(operation) {
-  return operation.kind.startsWith("object.");
-}
-
 // src/materializer/effective/resolve.ts
+function usableLinkSlotOverride(stored) {
+  if (!stored)
+    return null;
+  if (stored.value.kind !== "legacy-conflict")
+    return stored.value;
+  const { source, linkId } = stored.ref;
+  const scopeLabel = JSON.stringify([source.objectTypeId, source.primaryId, linkId]);
+  throw new MaterializationConflictError("effective-state", `Cardinality-one link slot ${scopeLabel} could not be migrated automatically because it ` + "contains multiple legacy upsert overrides. Consolidate the stored overrides and clear " + "the migration conflict marker before materializing this scope.");
+}
 function resolveEffectiveObject(input) {
   const properties = resolveObjectAuthority(input.source, input.override);
   if (!properties)
@@ -1540,30 +1571,117 @@ function resolveEffectiveLink(input) {
     return null;
   return resolvedLink(input.ref, input.source.assertion.properties);
 }
+function resolveEffectiveLinkSlot(input) {
+  if (!input.endpointExists(input.scope.source))
+    return null;
+  if (input.override?.kind === "clear")
+    return null;
+  if (input.override?.kind === "set") {
+    if (!input.endpointExists(input.override.target))
+      return null;
+    return resolvedLink({
+      source: input.scope.source,
+      linkId: input.scope.linkId,
+      target: input.override.target
+    }, input.override.properties);
+  }
+  if (!input.source || !input.endpointExists(input.source.assertion.ref.target))
+    return null;
+  return resolvedLink(input.source.assertion.ref, input.source.assertion.properties);
+}
+function resolveEffectiveLinkSlotMember(input) {
+  const resolved = resolveEffectiveLinkSlot({
+    scope: { source: input.ref.source, linkId: input.ref.linkId },
+    source: input.source,
+    override: input.override,
+    endpointExists: input.endpointExists
+  });
+  return resolved && linkRefKey(resolved.ref) === linkRefKey(input.ref) ? resolved : null;
+}
 function resolvedLink(ref, properties) {
   if (properties === undefined)
     return { ref };
   return { ref, properties };
 }
 
+// src/materializer/edits/read-set.ts
+function buildEditReadSet(ontology, operations) {
+  const objects = new Map;
+  const links = new Map;
+  const scopes = new Map;
+  const incidentObjects = new Map;
+  for (const operation of operations) {
+    if (isObjectOperation(operation)) {
+      if (!ontology.getObjectTypeById(operation.ref.objectTypeId))
+        continue;
+      objects.set(objectRefKey(operation.ref), operation.ref);
+      if (operation.kind !== "object.patch") {
+        incidentObjects.set(objectRefKey(operation.ref), operation.ref);
+      }
+      continue;
+    }
+    if (!isKnownLinkRef(ontology, operation.ref))
+      continue;
+    links.set(linkRefKey(operation.ref), operation.ref);
+    objects.set(objectRefKey(operation.ref.source), operation.ref.source);
+    objects.set(objectRefKey(operation.ref.target), operation.ref.target);
+    if (linkCardinality(ontology, operation.ref) === "one") {
+      const scope = { source: operation.ref.source, linkId: operation.ref.linkId };
+      scopes.set(linkScopeKey(scope.source, scope.linkId), scope);
+    }
+  }
+  return {
+    objects: [...objects.values()].sort(compareObjectRefs),
+    links: [...links.values()].sort(compareLinkRefs),
+    linkScopes: [...scopes.values()].sort((left, right) => linkScopeKey(left.source, left.linkId).localeCompare(linkScopeKey(right.source, right.linkId))),
+    incidentObjects: [...incidentObjects.values()].sort(compareObjectRefs),
+    points: []
+  };
+}
+function isKnownLinkRef(ontology, ref) {
+  const sourceType = ontology.getObjectTypeById(ref.source.objectTypeId);
+  if (!sourceType || !ontology.getObjectTypeById(ref.target.objectTypeId))
+    return false;
+  const link = sourceType.links.find((candidate) => candidate.id === ref.linkId);
+  return Boolean(link && ontology.isValidLinkTarget(link.targetObjectTypeId, ref.target.objectTypeId));
+}
+function linkCardinality(ontology, ref) {
+  const definition = ontology.getObjectTypeById(ref.source.objectTypeId)?.links.find((candidate) => candidate.id === ref.linkId);
+  return definition?.cardinality ?? "many";
+}
+function isObjectOperation(operation) {
+  return operation.kind.startsWith("object.");
+}
+
 // src/materializer/edits/working-state.ts
-function mergeWorkingState(objects, links, scopes, state) {
+function mergeWorkingState(ontology, working, state) {
   for (const object of state.objects) {
-    if (!objects.has(objectRefKey(object.ref))) {
-      objects.set(objectRefKey(object.ref), workingObjectFromState(object));
+    if (!working.objects.has(objectRefKey(object.ref))) {
+      working.objects.set(objectRefKey(object.ref), workingObjectFromState(object));
     }
   }
   for (const link of state.links) {
-    if (!links.has(linkRefKey(link.ref))) {
-      links.set(linkRefKey(link.ref), workingLinkFromState(link));
+    if (linkCardinality(ontology, link.ref) !== "one" && !working.links.edges.has(linkRefKey(link.ref))) {
+      working.links.edges.set(linkRefKey(link.ref), workingLinkEdgeFromState(link));
     }
   }
   for (const scope of state.linkScopes) {
-    if (!scopes.has(linkScopeKey(scope.source, scope.linkId))) {
-      scopes.set(linkScopeKey(scope.source, scope.linkId), scope);
+    const key = linkScopeKey(scope.source, scope.linkId);
+    if (!working.links.slots.has(key)) {
+      working.links.slots.set(key, workingLinkSlotFromState(scope));
     }
   }
 }
+function workingLinkSlotFromState(scope) {
+  return {
+    ref: { source: scope.source, linkId: scope.linkId },
+    source: scope.sourceAssertion,
+    originalOverride: scope.override,
+    override: usableLinkSlotOverride(scope.override),
+    before: scope.effective,
+    effectiveCount: scope.effectiveCount
+  };
+}
 function workingObjectFromState(object) {
   return {
     ref: object.ref,
@@ -1574,7 +1692,7 @@ function workingObjectFromState(object) {
     latestTelemetry: [...object.latestTelemetry]
   };
 }
-function workingLinkFromState(link) {
+function workingLinkEdgeFromState(link) {
   return {
     ref: link.ref,
     source: link.source,
@@ -1592,7 +1710,7 @@ function resolveObject(ontology, working) {
     latestTelemetry: working.latestTelemetry
   });
 }
-function resolveLink(ontology, working, objects) {
+function resolveLinkEdge(ontology, working, objects) {
   const source = objects.get(objectRefKey(working.ref.source));
   const target = objects.get(objectRefKey(working.ref.target));
   return resolveEffectiveLink({
@@ -1603,44 +1721,32 @@ function resolveLink(ontology, working, objects) {
     targetEndpointExists: Boolean(target && resolveObject(ontology, target))
   });
 }
+function resolveLinkSlot(ontology, working, objects) {
+  return resolveEffectiveLinkSlot({
+    scope: working.ref,
+    source: working.source,
+    override: working.override,
+    endpointExists: (ref) => {
+      const object = objects.get(objectRefKey(ref));
+      return Boolean(object && resolveObject(ontology, object));
+    }
+  });
+}
 function distinctCardinalityOneScopes(ontology, links, existing) {
   const scopes = new Map;
   for (const state of links) {
-    const definition = ontology.resolveObjectType(state.ref.source.objectTypeId).links.find((candidate) => candidate.id === state.ref.linkId);
     const key = linkScopeKey(state.ref.source, state.ref.linkId);
-    if (definition?.cardinality === "one" && !existing.has(key)) {
+    if (linkCardinality(ontology, state.ref) === "one" && !existing.has(key)) {
       scopes.set(key, { source: state.ref.source, linkId: state.ref.linkId });
     }
   }
   return [...scopes.values()];
 }
-function validateWorkingCardinality(ontology, objects, links, scopes) {
-  const effectiveByScope = new Map;
-  for (const [scope, snapshot] of scopes) {
-    effectiveByScope.set(scope, {
-      count: snapshot.effectiveCount,
-      source: snapshot.source,
-      linkId: snapshot.linkId
-    });
-  }
-  for (const working of links.values()) {
-    if (!isKnownLinkRef(ontology, working.ref))
-      continue;
-    const scope = linkScopeKey(working.ref.source, working.ref.linkId);
-    const state = effectiveByScope.get(scope);
-    if (!state)
-      continue;
-    const before = working.before ? 1 : 0;
-    const after = resolveLink(ontology, working, objects) ? 1 : 0;
-    state.count += after - before;
-  }
-  for (const { count, source, linkId } of effectiveByScope.values()) {
-    if (count <= 1)
+function validateWorkingCardinality(slots) {
+  for (const { effectiveCount, ref } of slots.values()) {
+    if (effectiveCount <= 1)
       continue;
-    const link = ontology.resolveObjectType(source.objectTypeId).links.find((candidate) => candidate.id === linkId);
-    if (link?.cardinality === "one") {
-      throw new MaterializationValidationError(`Link scope '${source.objectTypeId}.${linkId}' has cardinality one.`);
-    }
+    throw new MaterializationValidationError(`Link scope '${ref.source.objectTypeId}.${ref.linkId}' has cardinality one.`);
   }
 }
 
@@ -1648,29 +1754,38 @@ function validateWorkingCardinality(ontology, objects, links, scopes) {
 async function loadEditWorkingState(context, storage, session, operations) {
   const state = {
     objects: new Map,
-    links: new Map,
-    scopeSnapshots: new Map
+    links: {
+      edges: new Map,
+      slots: new Map
+    }
   };
   const readSet = buildEditReadSet(context.ontology, operations);
   const explicitLinkKeys = new Set(readSet.links.map(linkRefKey));
   const incidentLinks = new Map;
-  const ignoredLinks = new Map;
+  const loadedState = {
+    objects: state.objects,
+    links: {
+      edges: new Map,
+      slots: state.links.slots
+    }
+  };
   const revivingObjects = new Set(operations.filter(isRevivingObjectOperation).map((operation) => objectRefKey(operation.ref)));
   for await (const page of storage.streamState({
     session,
     requests: oneStateRequest(readSet),
     pageRows: context.batching.statePageRows
   })) {
-    mergeWorkingState(state.objects, ignoredLinks, state.scopeSnapshots, page);
+    mergeWorkingState(context.ontology, loadedState, page);
     for (const link of page.links) {
       const key = linkRefKey(link.ref);
-      if (explicitLinkKeys.has(key) && !state.links.has(key)) {
-        state.links.set(key, workingLinkFromState(link));
+      if (linkCardinality(context.ontology, link.ref) !== "one" && explicitLinkKeys.has(key) && !state.links.edges.has(key)) {
+        state.links.edges.set(key, workingLinkEdgeFromState(link));
       }
       if (readSet.incidentObjects.length > 0)
         incidentLinks.set(key, link);
     }
   }
+  await mergeMissingLinkSlotEndpoints(context, storage, session, state);
   await mergeIncidentState(context, storage, session, state, [...incidentLinks.values()], revivingObjects);
   return state;
 }
@@ -1701,9 +1816,20 @@ async function mergeIncidentState(context, storage, session, state, incidentStat
     if (revivingObjects.has(objectRefKey(link.ref.source)) || revivingObjects.has(objectRefKey(link.ref.target))) {
       return true;
     }
-    return Boolean(resolveLink(context.ontology, workingLinkFromState(link), state.objects));
+    if (linkCardinality(context.ontology, link.ref) === "one") {
+      return Boolean(resolveEffectiveLinkSlotMember({
+        ref: link.ref,
+        source: link.source,
+        override: usableLinkSlotOverride(link.slotOverride),
+        endpointExists: (ref) => {
+          const object = state.objects.get(objectRefKey(ref));
+          return Boolean(object && resolveObject(context.ontology, object));
+        }
+      }));
+    }
+    return Boolean(resolveLinkEdge(context.ontology, workingLinkEdgeFromState(link), state.objects));
   });
-  const missingScopes = distinctCardinalityOneScopes(context.ontology, relevantStates, state.scopeSnapshots);
+  const missingScopes = distinctCardinalityOneScopes(context.ontology, relevantStates, state.links.slots);
   if (missingScopes.length > 0) {
     await mergeLoadedState(context, storage, session, state, {
       objects: [],
@@ -1713,17 +1839,44 @@ async function mergeIncidentState(context, storage, session, state, incidentStat
       points: []
     });
   }
+  await mergeMissingLinkSlotEndpoints(context, storage, session, state);
   for (const link of relevantStates) {
+    if (linkCardinality(context.ontology, link.ref) === "one")
+      continue;
     const key = linkRefKey(link.ref);
-    if (state.links.has(key))
+    if (state.links.edges.has(key))
       continue;
-    state.links.set(key, workingLinkFromState(link));
+    state.links.edges.set(key, workingLinkEdgeFromState(link));
+  }
+  context.observeCoreBuffer?.("edits.incident-links", state.links.edges.size + state.links.slots.size);
+}
+async function mergeMissingLinkSlotEndpoints(context, storage, session, state) {
+  const missing = new Map;
+  for (const working of state.links.slots.values()) {
+    const refs = [
+      working.ref.source,
+      working.source?.assertion.ref.target,
+      working.override?.target,
+      working.before?.ref.target
+    ];
+    for (const ref of refs) {
+      if (ref && !state.objects.has(objectRefKey(ref)))
+        missing.set(objectRefKey(ref), ref);
+    }
   }
-  context.observeCoreBuffer?.("edits.incident-links", state.links.size);
+  if (missing.size === 0)
+    return;
+  await mergeLoadedState(context, storage, session, state, {
+    objects: [...missing.values()],
+    links: [],
+    linkScopes: [],
+    incidentObjects: [],
+    points: []
+  });
 }
 async function mergeLoadedState(context, storage, session, state, request) {
   const loaded = await loadState(context, storage, session, request);
-  mergeWorkingState(state.objects, state.links, state.scopeSnapshots, loaded);
+  mergeWorkingState(context.ontology, state, loaded);
 }
 
 // src/materializer/effective/diff.ts
@@ -1792,6 +1945,16 @@ function diffEffectiveLink(input) {
     return null;
   return updateLinkChange(input.before, input.resolved, input.commitId, input.committedAt);
 }
+function diffEffectiveLinkSlot(input) {
+  if (input.before && input.resolved && linkRefKey(input.before.ref) !== linkRefKey(input.resolved.ref)) {
+    return [
+      diffEffectiveLink({ ...input, resolved: null }),
+      diffEffectiveLink({ ...input, before: null })
+    ];
+  }
+  const change = diffEffectiveLink(input);
+  return change ? [change] : [];
+}
 function createLinkChange(resolved, commitId, committedAt) {
   const after = {
     ...resolved,
@@ -2178,7 +2341,7 @@ function applyObjectTransition(context, state, working, next, journal) {
     const resolved = resolveObject(context.ontology, working);
     if (resolved)
       validateEffectiveObject(context.ontology, resolved.ref, resolved.properties);
-    validateWorkingCardinality(context.ontology, state.objects, state.links, state.scopeSnapshots);
+    validateWorkingCardinality(state.links.slots);
   } catch (error) {
     working.override = previous;
     throw error;
@@ -2211,10 +2374,13 @@ function objectOperationOutcome(operation, working, changed, context, identity)
   return { ...outcome, object };
 }
 function applyLinkOperation(context, state, operation, cardinality, journal) {
-  const working = requireWorkingLink(state, operation);
   validateLinkEndpoints(context, state, operation);
   const normalizedProperties = validateLinkOperation(context, operation);
-  const currentEffective = resolveLink(context.ontology, working, state.objects);
+  if (cardinality === "one") {
+    return applyLinkSlotOperation(context, state, operation, normalizedProperties, journal);
+  }
+  const working = requireWorkingLinkEdge(state, operation);
+  const currentEffective = resolveLinkEdge(context.ontology, working, state.objects);
   const transitionInput = {
     operation,
     hasSource: working.source !== null,
@@ -2222,11 +2388,51 @@ function applyLinkOperation(context, state, operation, cardinality, journal) {
     effectiveExists: currentEffective !== null
   };
   const transition2 = applyLinkEdit({ ...transitionInput, normalizedProperties });
-  applyLinkTransition(context, state, working, transition2.next, cardinality, journal);
+  applyLinkEdgeTransition(working, transition2.next, journal);
   return { id: operation.id, ok: true, authority: authorityOutcome(transition2.changed) };
 }
-function requireWorkingLink(state, operation) {
-  const working = state.links.get(linkRefKey(operation.ref));
+function applyLinkSlotOperation(context, state, operation, normalizedProperties, journal) {
+  const key = linkScopeKey(operation.ref.source, operation.ref.linkId);
+  const working = state.links.slots.get(key);
+  if (!working) {
+    throw new MaterializationValidationError("Link slot state was not loaded.");
+  }
+  const current = resolveLinkSlot(context.ontology, working, state.objects);
+  const previous = working.override;
+  let next = previous;
+  switch (operation.kind) {
+    case "link.upsert":
+      if (current && linkRefKey(current.ref) !== linkRefKey(operation.ref)) {
+        throw new MaterializationValidationError(`Link scope '${operation.ref.source.objectTypeId}.${operation.ref.linkId}' has cardinality one.`);
+      }
+      next = {
+        kind: "set",
+        target: operation.ref.target,
+        ...normalizedProperties !== undefined ? { properties: normalizedProperties } : {}
+      };
+      break;
+    case "link.delete":
+      if (current && linkRefKey(current.ref) === linkRefKey(operation.ref)) {
+        next = { kind: "clear", target: operation.ref.target };
+      }
+      break;
+    case "link.reset":
+      if (previous && objectRefKey(previous.target) === objectRefKey(operation.ref.target)) {
+        next = null;
+      }
+      break;
+  }
+  const changed = stableJsonStringify(previous) !== stableJsonStringify(next);
+  working.override = next;
+  journal?.push({
+    restore: () => {
+      working.override = previous;
+    }
+  });
+  return { id: operation.id, ok: true, authority: authorityOutcome(changed) };
+}
+function requireWorkingLinkEdge(state, operation) {
+  const working = state.links.edges.get(linkRefKey(operation.ref));
   if (!working)
     throw new MaterializationValidationError("Link state was not loaded.");
   return working;
@@ -2247,17 +2453,9 @@ function validateLinkOperation(context, operation) {
     return;
   return validateLinkAuthorityProperties(context.ontology, operation.ref, operation.properties);
 }
-function applyLinkTransition(context, state, working, next, cardinality, journal) {
+function applyLinkEdgeTransition(working, next, journal) {
   const previous = working.override;
   working.override = next;
-  try {
-    if (cardinality === "one") {
-      validateWorkingCardinality(context.ontology, state.objects, state.links, state.scopeSnapshots);
-    }
-  } catch (error) {
-    working.override = previous;
-    throw error;
-  }
   journal?.push({
     restore: () => {
       working.override = previous;
@@ -2286,24 +2484,57 @@ function isObjectOperation2(operation) {
 
 // src/materializer/edits/plan.ts
 async function stageEditPlan(context, storage, session, state, planContext) {
-  validateWorkingCardinality(context.ontology, state.objects, state.links, state.scopeSnapshots);
+  validateWorkingCardinality(state.links.slots);
   const objectChanges = [];
   for (const working of sortedObjects(state.objects)) {
-    const change = await stageObjectPlan(context, storage, session, working, planContext);
+    const change = await stageObject(context, storage, session, working, planContext);
     if (change)
       objectChanges.push(change);
   }
   const linkChanges = [];
-  for (const working of sortedLinks(state.links)) {
-    const change = await stageLinkPlan(context, storage, session, state.objects, working, planContext);
+  for (const working of sortedLinkEdges(state.links.edges)) {
+    const change = await stageLinkEdge(context, storage, session, state.objects, working, planContext);
     if (change)
       linkChanges.push(change);
   }
+  for (const working of sortedLinkSlots(state.links.slots)) {
+    linkChanges.push(...await stageLinkSlot(context, storage, session, state.objects, working, planContext));
+  }
   return { objects: objectChanges, links: linkChanges };
 }
-async function stageObjectPlan(context, storage, session, working, planContext) {
+async function stageLinkSlot(context, storage, session, objects, working, planContext) {
+  const overrideItems = [];
+  appendLinkSlotOverrideWork(overrideItems, working, planContext.identity);
+  const resolved = resolveLinkSlot(context.ontology, working, objects);
+  const changes = diffEffectiveLinkSlot({
+    before: working.before,
+    resolved,
+    commitId: planContext.identity.commitId,
+    committedAt: planContext.identity.committedAt
+  });
+  const representative = resolved?.ref ?? working.before?.ref ?? (working.override ? {
+    source: working.ref.source,
+    linkId: working.ref.linkId,
+    target: working.override.target
+  } : null);
+  const scopeSortKey = linkScopeSortKey(working.ref.source, working.ref.linkId);
+  const work = overrideItems.map((item) => planWork(item, scopeSortKey));
+  if (representative) {
+    work.push(classificationWork("link", linkRefKey(representative), linkRefSortKey(representative)));
+  }
+  for (const change of changes) {
+    const effectiveItems = [];
+    appendEffectiveLinkWork(effectiveItems, change);
+    const sortKey = linkRefSortKey(change.ref);
+    work.push(...effectiveItems.map((item) => planWork(item, sortKey)));
+    work.push(eventWork(buildLinkEvent(context, planContext, change)));
+  }
+  await stageWorkBounded(context, storage, session, work);
+  return changes;
+}
+async function stageObject(context, storage, session, working, planContext) {
   const items = [];
-  appendObjectOverridePlan(items, working, planContext.identity);
+  appendObjectOverrideWork(items, working, planContext.identity);
   const resolved = resolveObject(context.ontology, working);
   if (resolved)
     validateEffectiveObject(context.ontology, resolved.ref, resolved.properties);
@@ -2314,7 +2545,7 @@ async function stageObjectPlan(context, storage, session, working, planContext)
     committedAt: planContext.identity.committedAt
   });
   if (change)
-    appendObjectEffectivePlan(items, change);
+    appendEffectiveObjectWork(items, change);
   const sortKey = objectRefSortKey(working.ref);
   const work = [
     classificationWork("object", objectRefKey(working.ref), sortKey),
@@ -2326,10 +2557,10 @@ async function stageObjectPlan(context, storage, session, working, planContext)
   await stageWorkBounded(context, storage, session, work);
   return change;
 }
-async function stageLinkPlan(context, storage, session, objects, working, planContext) {
+async function stageLinkEdge(context, storage, session, objects, working, planContext) {
   const items = [];
-  appendLinkOverridePlan(items, working, planContext.identity);
-  const resolved = resolveLink(context.ontology, working, objects);
+  appendLinkEdgeOverrideWork(items, working, planContext.identity);
+  const resolved = resolveLinkEdge(context.ontology, working, objects);
   const change = diffEffectiveLink({
     before: working.before,
     resolved,
@@ -2337,7 +2568,7 @@ async function stageLinkPlan(context, storage, session, objects, working, planCo
     committedAt: planContext.identity.committedAt
   });
   if (change)
-    appendLinkEffectivePlan(items, change);
+    appendEffectiveLinkWork(items, change);
   const sortKey = linkRefSortKey(working.ref);
   const work = [
     classificationWork("link", linkRefKey(working.ref), sortKey),
@@ -2362,7 +2593,8 @@ function materializationEventContext(context, planContext) {
     projectId: context.projectId,
     commitId: planContext.identity.commitId,
     committedAt: planContext.identity.committedAt,
-    origin: planContext.origin
+    origin: planContext.origin,
+    correlationId: planContext.correlationId
   };
   if (planContext.actor === undefined)
     return base;
@@ -2371,20 +2603,20 @@ function materializationEventContext(context, planContext) {
 function sortedObjects(objects) {
   return [...objects.values()].sort((left, right) => compareObjectRefs(left.ref, right.ref));
 }
-function sortedLinks(links) {
-  return [...links.values()].sort((left, right) => compareLinkRefs(left.ref, right.ref));
+function sortedLinkEdges(edges) {
+  return [...edges.values()].sort((left, right) => compareLinkRefs(left.ref, right.ref));
+}
+function sortedLinkSlots(slots) {
+  return [...slots.values()].sort((left, right) => linkScopeKey(left.ref.source, left.ref.linkId).localeCompare(linkScopeKey(right.ref.source, right.ref.linkId)));
 }
 
 // src/materializer/edits/commit.ts
 async function commitEdits(context, raw) {
   const command = prepareEditCommit(context, raw);
-  const replay = await replayEditCommit(context, command);
-  if (replay)
-    return replay;
   return executeEditCommit(context, command);
 }
 function prepareEditCommit(context, raw) {
-  const input = normalizeOntologyEditCommit(raw);
+  const input = normalizeOntologyEditCommit(raw.input);
   const idempotencyKey = editIdempotencyKey(input);
   const identity = createTimedCommitIdentity({
     projectId: context.projectId,
@@ -2392,7 +2624,12 @@ function prepareEditCommit(context, raw) {
     normalizedCallerIntent: input,
     now: context.clock()
   });
-  return { input, identity, origin: input.source };
+  return {
+    input,
+    identity,
+    origin: input.source,
+    execution: prepareMaterializerExecution(context.projectId, raw.scope)
+  };
 }
 function editIdempotencyKey(input) {
   if (input.source.kind === "action") {
@@ -2400,20 +2637,40 @@ function editIdempotencyKey(input) {
   }
   return createRuntimeIdempotencyKey(input.source.requestId);
 }
-async function lockActionRunForMaterialization(storage, projectId, input) {
+async function lockActionRunForMaterialization(storage, projectId, input, execution) {
   if (input.source.kind !== "action")
     return;
   if (!storage.actionRuns) {
     throw new MaterializationValidationError("Storage does not provide Action run capabilities required by this commit.");
   }
-  await storage.actionRuns.lockForMaterialization({
+  const run = await storage.actionRuns.lockForMaterialization({
     projectId,
     actionId: input.source.actionId,
     runId: input.source.runId
   });
+  assertMaterializerRunExecution(execution, run.executionId, `Action run '${run.id}'`);
 }
-function replayEditCommit(context, command) {
-  return replayCommit(context, command.identity);
+async function validateMutationExecution(storage, projectId, input, execution) {
+  if (input.source.kind !== "action") {
+    assertRuntimeMutationExecution(execution);
+    return;
+  }
+  assertTrustedPrimitiveMutationExecution(execution, {
+    kind: "action",
+    id: input.source.actionId,
+    runId: input.source.runId
+  });
+  if (!storage.actionRuns) {
+    throw new MaterializationValidationError("Storage does not provide Action run capabilities required by this commit.");
+  }
+  const run = await storage.actionRuns.getById({ projectId, id: input.source.runId });
+  if (!run) {
+    throw new MaterializationValidationError(`Action run '${input.source.runId}' was not found.`);
+  }
+  if (run.actionId !== input.source.actionId) {
+    throw new MaterializationConflictError("run-correlation", `Action run '${run.id}' does not belong to action '${input.source.actionId}'.`);
+  }
+  assertMaterializerRunExecution(execution, run.executionId, `Action run '${run.id}'`);
 }
 async function executeEditCommit(context, command) {
   return withSerializationRetry(context, () => context.storage.transaction((storage) => executeEditTransaction(context, storage, command), {
@@ -2421,10 +2678,12 @@ async function executeEditCommit(context, command) {
   }));
 }
 async function executeEditTransaction(context, storage, command) {
-  await lockActionRunForMaterialization(storage, context.projectId, command.input);
-  const replay = await replayCommit(context, command.identity, storage);
+  await ensureMaterializerExecution(storage.executions, command.execution);
+  await validateMutationExecution(storage, context.projectId, command.input, command.execution);
+  const replay = await replayCommit(context, command.identity, command.execution.executionId, storage);
   if (replay)
     return replay;
+  await lockActionRunForMaterialization(storage, context.projectId, command.input, command.execution);
   const session = await beginEditMaterialization(context, storage, command);
   const workingState = await loadEditWorkingState(context, storage.ontology.materializations, session, command.input.operations);
   const outcomes = applyEditOperations(context, workingState, command);
@@ -2459,6 +2718,7 @@ function buildEditCommit(context, command) {
     id: command.identity.commitId,
     idempotencyKey: command.identity.idempotencyKey,
     requestHash: command.identity.requestHash,
+    executionId: command.execution.executionId,
     origin: command.origin,
     ontologyRevision: context.projectionRegistry.ontologyRevision,
     intent: {
@@ -2468,9 +2728,9 @@ function buildEditCommit(context, command) {
     },
     committedAt: command.identity.committedAt
   };
-  if (command.input.actor === undefined)
+  if (command.execution.actor === undefined)
     return commit;
-  return { ...commit, actor: command.input.actor };
+  return { ...commit, actor: command.execution.actor };
 }
 function editExpectations(input) {
   if (input.mode === "atomic") {
@@ -2539,10 +2799,14 @@ function isRecoverableEditValidation(input, error) {
   return error instanceof MaterializationValidationError;
 }
 function editPlanContext(command) {
-  const context = { identity: command.identity, origin: command.origin };
-  if (command.input.actor === undefined)
+  const context = {
+    identity: command.identity,
+    origin: command.origin,
+    correlationId: command.execution.correlationId
+  };
+  if (command.execution.actor === undefined)
     return context;
-  return { ...context, actor: command.input.actor };
+  return { ...context, actor: command.execution.actor };
 }
 async function finalizeEditMaterialization(storage, session, result) {
   const applied = await storage.ontology.materializations.finalize({
@@ -2611,11 +2875,11 @@ async function finishProjectionRun(context, raw) {
   }));
 }
 function prepareProjectionRunFinish(context, raw) {
-  assertValidTerminalDecision(raw);
-  const source = normalizeProjectionSourceRef(raw.source);
-  const datasetVersion = normalizePinnedDatasetVersion(raw.datasetVersion);
-  const execution = normalizeProjectionExecution(raw.execution);
-  const resolved = raw.protocol === "replacement" ? context.projectionRegistry.resolveSource(source.projectionId) : context.projectionRegistry.resolveTelemetry(source.projectionId);
+  assertValidTerminalDecision(raw.input);
+  const source = normalizeProjectionSourceRef(raw.input.source);
+  const datasetVersion = normalizePinnedDatasetVersion(raw.input.datasetVersion);
+  const projectionExecution = normalizeProjectionExecution(raw.input.execution);
+  const resolved = raw.input.protocol === "replacement" ? context.projectionRegistry.resolveSource(source.projectionId) : context.projectionRegistry.resolveTelemetry(source.projectionId);
   if (resolved.datasetId !== datasetVersion.datasetId) {
     throw new MaterializationValidationError(`Projection '${resolved.projectionId}' requires dataset '${resolved.datasetId}'.`);
   }
@@ -2626,20 +2890,28 @@ function prepareProjectionRunFinish(context, raw) {
   });
   return {
     projectId: context.projectId,
-    input: { ...raw, source, datasetVersion, execution },
+    input: { ...raw.input, source, datasetVersion, execution: projectionExecution },
     identity,
     resolved,
-    finishedAt: context.clock()
+    finishedAt: new Date(raw.input.finishedAt ?? context.clock()),
+    execution: prepareMaterializerExecution(context.projectId, raw.scope)
   };
 }
 async function finishProjectionRunTransaction(storage, command) {
-  const { projectionRuns } = await lockProjectionRunForMaterialization(storage, {
+  await ensureMaterializerExecution(storage.executions, command.execution);
+  assertTrustedPrimitiveMutationExecution(command.execution, {
+    kind: "projection",
+    id: command.input.source.projectionId,
+    runId: command.input.execution.projectionRunId
+  });
+  const { projectionRuns, run } = await lockProjectionRunForMaterialization(storage, {
     projectId: command.projectId,
     projectionRunId: command.input.execution.projectionRunId,
     executionToken: command.input.execution.executionToken,
     identity: command.identity,
     resolved: command.resolved
   });
+  assertMaterializerRunExecution(command.execution, run.executionId, `Projection run '${run.id}'`);
   if (command.input.protocol === "replacement") {
     await assertReplacementTerminalDecision(storage, command);
   }
@@ -2674,7 +2946,7 @@ function terminalDecision(input) {
     return {
       protocol: input.protocol,
       status: input.status,
-      ...input.errorMessage === undefined ? {} : { errorMessage: input.errorMessage }
+      ...input.error === undefined ? {} : { error: input.error }
     };
   }
   if (input.protocol === "telemetry") {
@@ -2703,7 +2975,7 @@ async function assertReplacementTerminalDecision(storage, command) {
 }
 function assertReplacementCommitCorrelation(commit, command) {
   const { input, identity } = command;
-  if (commit.origin.kind !== "projection" || commit.intent.kind !== "projection" || commit.result.kind !== "projection" || commit.origin.projectionRunId !== input.execution.projectionRunId || commit.origin.projectionId !== input.source.projectionId || commit.intent.source.projectionId !== input.source.projectionId || !datasetVersionsEqual(commit.intent.datasetVersion, input.datasetVersion) || commit.ontologyRevision !== identity.ontologyRevision || commit.projectionRevision !== identity.projectionRevision || commit.ownershipHash !== identity.ownershipHash) {
+  if (commit.origin.kind !== "projection" || commit.executionId !== command.execution.executionId || commit.intent.kind !== "projection" || commit.result.kind !== "projection" || commit.origin.projectionRunId !== input.execution.projectionRunId || commit.origin.projectionId !== input.source.projectionId || commit.intent.source.projectionId !== input.source.projectionId || !datasetVersionsEqual(commit.intent.datasetVersion, input.datasetVersion) || commit.ontologyRevision !== identity.ontologyRevision || commit.projectionRevision !== identity.projectionRevision || commit.ownershipHash !== identity.ownershipHash) {
     throw new MaterializationConflictError("run-correlation", `Projection replacement run '${input.execution.projectionRunId}' commit identity does not match.`);
   }
 }
@@ -2853,7 +3125,7 @@ function planReplacementObject(context, input, state, counts) {
 }
 function appendObjectChangeWork(work, sortKey, context, input, change) {
   const items = [];
-  appendObjectEffectivePlan(items, change);
+  appendEffectiveObjectWork(items, change);
   for (const item of items)
     work.push(planWork(item, sortKey));
   work.push(eventWork(buildObjectMaterializationEventDraft({
@@ -2861,6 +3133,7 @@ function appendObjectChangeWork(work, sortKey, context, input, change) {
     commitId: input.identity.commitId,
     committedAt: input.identity.committedAt,
     origin: input.origin,
+    correlationId: input.correlationId,
     change
   })));
 }
@@ -2923,7 +3196,7 @@ function planLinkPage(context, input, page, endpointExistence, counts) {
   return work;
 }
 function planReplacementLink(context, input, state, endpointExistence, counts) {
-  const resolved = resolveReplacementLink(state, endpointExistence);
+  const resolved = resolveReplacementLink(context, state, endpointExistence);
   const work = cardinalityWork(context, state, resolved !== null);
   if (!state.diffRequired)
     return work;
@@ -2943,9 +3216,18 @@ function planReplacementLink(context, input, state, endpointExistence, counts) {
   appendLinkChangeWork(work, sortKey, context, input, change);
   return work;
 }
-function resolveReplacementLink(state, endpointExistence) {
+function resolveReplacementLink(context, state, endpointExistence) {
   if (!state.diffRequired)
     return state.effective;
+  const definition = context.ontology.resolveObjectType(state.ref.source.objectTypeId).links.find((candidate) => candidate.id === state.ref.linkId);
+  if (definition?.cardinality === "one") {
+    return resolveEffectiveLinkSlotMember({
+      ref: state.ref,
+      source: state.candidateSource,
+      override: usableLinkSlotOverride(state.slotOverride),
+      endpointExists: (ref) => endpointExistence.get(objectRefKey(ref)) ?? false
+    });
+  }
   return resolveEffectiveLink({
     ref: state.ref,
     source: state.candidateSource,
@@ -2963,7 +3245,17 @@ function cardinalityWork(context, state, occupied) {
   return [
     {
       kind: "cardinality",
-      recordKey: `cardinality:${scopeSortKey}:${linkSortKey}`,
+      recordKey: `cardinality:candidate:${scopeSortKey}:${linkSortKey}`,
+      view: "candidate",
+      scopeSortKey,
+      linkSortKey,
+      ref: state.ref,
+      occupied: state.candidateSource !== null
+    },
+    {
+      kind: "cardinality",
+      recordKey: `cardinality:effective:${scopeSortKey}:${linkSortKey}`,
+      view: "effective",
       scopeSortKey,
       linkSortKey,
       ref: state.ref,
@@ -2973,7 +3265,7 @@ function cardinalityWork(context, state, occupied) {
 }
 function appendLinkChangeWork(work, sortKey, context, input, change) {
   const items = [];
-  appendLinkEffectivePlan(items, change);
+  appendEffectiveLinkWork(items, change);
   for (const item of items)
     work.push(planWork(item, sortKey));
   work.push(eventWork(buildLinkMaterializationEventDraft({
@@ -2981,6 +3273,7 @@ function appendLinkChangeWork(work, sortKey, context, input, change) {
     commitId: input.identity.commitId,
     committedAt: input.identity.committedAt,
     origin: input.origin,
+    correlationId: input.correlationId,
     change
   })));
 }
@@ -3080,10 +3373,7 @@ async function stageProjectionMaterialization(context, input) {
 // src/materializer/projections/replace.ts
 async function replaceProjection(context, raw) {
   const command = prepareProjectionReplacement(context, raw);
-  await assertProjectionExecution(context.storage, context.projectId, command, {
-    capabilityErrorMessage: "Storage does not provide projection run capabilities required by source replacement."
-  });
-  const replay = await replayProjectionCommit(context, command);
+  const replay = await admitProjectionExecution(context, command);
   if (replay)
     return replay;
   const candidate = await prepareProjectionCandidate(context, command);
@@ -3096,9 +3386,9 @@ async function replaceProjection(context, raw) {
   }
 }
 function prepareProjectionReplacement(context, raw) {
-  const source = normalizeProjectionSourceRef(raw.source);
-  const datasetVersion = normalizePinnedDatasetVersion(raw.datasetVersion);
-  const execution = normalizeProjectionExecution(raw.execution);
+  const source = normalizeProjectionSourceRef(raw.input.source);
+  const datasetVersion = normalizePinnedDatasetVersion(raw.input.datasetVersion);
+  const execution = normalizeProjectionExecution(raw.input.execution);
   const resolved = context.projectionRegistry.resolveSource(source.projectionId);
   validateProjectionDataset(resolved, datasetVersion);
   const projectionKind = sourceProjectionKind(resolved);
@@ -3116,15 +3406,16 @@ function prepareProjectionReplacement(context, raw) {
     source,
     datasetVersion,
     execution,
-    entries: raw.entries,
+    entries: raw.input.entries,
     resolved,
     projectionKind,
     runIdentity,
-    identity
+    identity,
+    scopeExecution: prepareMaterializerExecution(context.projectId, raw.scope)
   };
-  if (raw.signal === undefined)
+  if (raw.input.signal === undefined)
     return command;
-  return { ...command, signal: raw.signal };
+  return { ...command, signal: raw.input.signal };
 }
 function validateProjectionDataset(resolved, datasetVersion) {
   if (datasetVersion.datasetId === resolved.datasetId)
@@ -3137,7 +3428,12 @@ function sourceProjectionKind(resolved) {
   return "link";
 }
 async function assertProjectionExecution(storage, projectId, command, options = {}) {
-  await lockProjectionRunForMaterialization(storage, {
+  assertTrustedPrimitiveMutationExecution(command.scopeExecution, {
+    kind: "projection",
+    id: command.source.projectionId,
+    runId: command.execution.projectionRunId
+  });
+  const locked = await lockProjectionRunForMaterialization(storage, {
     projectId,
     projectionRunId: command.execution.projectionRunId,
     executionToken: command.execution.executionToken,
@@ -3145,14 +3441,15 @@ async function assertProjectionExecution(storage, projectId, command, options =
     resolved: command.resolved,
     ...options
   });
+  assertMaterializerRunExecution(command.scopeExecution, locked.run.executionId, `Projection run '${locked.run.id}'`);
 }
-async function replayProjectionCommit(context, command) {
-  const existing = await replayCommitRecord(context, command.identity);
-  if (!existing)
-    return null;
+async function admitProjectionExecution(context, command) {
   return withSerializationRetry(context, () => context.storage.transaction(async (storage) => {
-    await assertProjectionExecution(storage, context.projectId, command);
-    const commit = await replayCommitRecord(context, command.identity, storage);
+    await ensureMaterializerExecution(storage.executions, command.scopeExecution);
+    await assertProjectionExecution(storage, context.projectId, command, {
+      capabilityErrorMessage: "Storage does not provide projection run capabilities required by source replacement."
+    });
+    const commit = await replayCommitRecord(context, command.identity, command.scopeExecution.executionId, storage);
     return commit ? projectionReplayResult(commit, command) : null;
   }, { isolation: "serializable" }));
 }
@@ -3214,8 +3511,9 @@ async function commitProjectionCandidate(context, command, ready) {
   return withSerializationRetry(context, () => context.storage.transaction((storage) => executeProjectionTransaction(context, storage, command, ready), { isolation: "serializable" }));
 }
 async function executeProjectionTransaction(context, storage, command, ready) {
+  await ensureMaterializerExecution(storage.executions, command.scopeExecution);
   await assertProjectionExecution(storage, context.projectId, command);
-  const replay = await replayCommitRecord(context, command.identity, storage);
+  const replay = await replayCommitRecord(context, command.identity, command.scopeExecution.executionId, storage);
   if (replay)
     return projectionReplayResult(replay, command);
   const origin = projectionOrigin(command);
@@ -3269,6 +3567,7 @@ function projectionCommit(projectId, command, identity, origin) {
     id: identity.commitId,
     idempotencyKey: identity.idempotencyKey,
     requestHash: identity.requestHash,
+    executionId: command.scopeExecution.executionId,
     origin,
     ontologyRevision: command.runIdentity.ontologyRevision,
     projectionRevision: command.runIdentity.projectionRevision,
@@ -3283,7 +3582,8 @@ async function planReadyProjection(context, storage, session, command, ready, or
     materializationId: ready.materializationId,
     projectionKind: command.projectionKind,
     identity: ready.identity,
-    origin
+    origin,
+    correlationId: command.scopeExecution.correlationId
   };
   if (command.signal === undefined) {
     return planProjectionReplacement(context, storage, session, input);
@@ -3326,7 +3626,7 @@ function shouldAbandonCandidate(error) {
     return true;
   if (error instanceof MaterializationCancellationError)
     return true;
-  return error instanceof MaterializationConflictError && error.kind === "run-correlation";
+  return error instanceof MaterializationConflictError && (error.kind === "run-correlation" || error.kind === "idempotency");
 }
 function validateProjectionWatermark(active, next) {
   if (!active)
@@ -3335,9 +3635,9 @@ function validateProjectionWatermark(active, next) {
 }
 
 // src/materializer/telemetry/plan.ts
-async function planTelemetryAppend(context, storage, session, input, identity, origin) {
+async function planTelemetryAppend(context, storage, session, input, identity, origin, event) {
   const counts = emptyTelemetryCounts();
-  const planContext = { input, identity, origin };
+  const planContext = { input, identity, origin, event };
   const objects = await loadTelemetryObjects(context, storage, session, input.points);
   const existingPoints = await loadExistingPoints(context, storage, session, input.points);
   for (const group of telemetryObjectGroups(input.points)) {
@@ -3505,7 +3805,7 @@ async function stageTelemetryObjectPlan(context, storage, session, planContext,
   if (change) {
     counts.latestObjectsChanged += 1;
     const items = [];
-    appendObjectEffectivePlan(items, change);
+    appendEffectiveObjectWork(items, change);
     work.push(...items.map((item) => planWork(item, sortKey)));
     const eventContext = telemetryEventContext(context, planContext);
     work.push(eventWork(buildObjectMaterializationEventDraft({ ...eventContext, change })));
@@ -3517,11 +3817,12 @@ function telemetryEventContext(context, planContext) {
     projectId: context.projectId,
     commitId: planContext.identity.commitId,
     committedAt: planContext.identity.committedAt,
-    origin: planContext.origin
+    origin: planContext.origin,
+    correlationId: planContext.event.correlationId
   };
-  if (planContext.input.actor === undefined)
+  if (planContext.event.actor === undefined)
     return eventContext;
-  return { ...eventContext, actor: planContext.input.actor };
+  return { ...eventContext, actor: planContext.event.actor };
 }
 function emptyTelemetryCounts() {
   return {
@@ -3535,26 +3836,28 @@ function emptyTelemetryCounts() {
 // src/materializer/telemetry/append.ts
 async function appendTelemetry(context, raw) {
   const command = prepareTelemetryAppend(context, raw);
-  if (command.kind === "runtime") {
-    const replay = await replayCommit(context, command.identity);
-    if (replay)
-      return replay;
-  }
   return executeTelemetryCommit(context, command);
 }
 function prepareTelemetryAppend(context, raw) {
-  const rawInputPointCount = raw.points.length;
+  const rawInputPointCount = raw.input.points.length;
   const input = normalizeTelemetryAppend({
-    ...raw,
-    points: raw.points.map((point) => validateTelemetryPoint(context.ontology, point))
+    ...raw.input,
+    points: raw.input.points.map((point) => validateTelemetryPoint(context.ontology, point))
   });
   const inputPointCount = telemetryInputPointCount(input, rawInputPointCount);
   validateTelemetryBatch(input, inputPointCount);
   const ontologyRevision = context.projectionRegistry.ontologyRevision;
+  const execution = prepareMaterializerExecution(context.projectId, raw.scope);
   if (input.source.kind === "runtime") {
-    return prepareRuntimeTelemetry(context, input, input.source, inputPointCount, ontologyRevision);
+    return {
+      ...prepareRuntimeTelemetry(context, input, input.source, inputPointCount, ontologyRevision),
+      execution
+    };
   }
-  return prepareProjectionTelemetry(context, input, input.source, inputPointCount, ontologyRevision);
+  return {
+    ...prepareProjectionTelemetry(context, input, input.source, inputPointCount, ontologyRevision),
+    execution
+  };
 }
 function telemetryInputPointCount(input, rawInputPointCount) {
   if (input.source.kind === "projection")
@@ -3634,13 +3937,18 @@ function projectionTelemetryCallerIntent(input, source, inputPointCount) {
     inputPointCount,
     points: input.points
   };
-  if (input.actor === undefined)
-    return intent;
-  return { ...intent, actor: input.actor };
+  return intent;
 }
 async function assertTelemetryExecution(storage, projectId, command) {
-  if (command.kind === "runtime")
+  if (command.kind === "runtime") {
+    assertRuntimeMutationExecution(command.execution);
     return null;
+  }
+  assertTrustedPrimitiveMutationExecution(command.execution, {
+    kind: "projection",
+    id: command.source.projection.projectionId,
+    runId: command.source.execution.projectionRunId
+  });
   const execution = await lockProjectionRunForMaterialization(storage, {
     projectId,
     projectionRunId: command.source.execution.projectionRunId,
@@ -3649,6 +3957,7 @@ async function assertTelemetryExecution(storage, projectId, command) {
     resolved: command.resolvedProjection,
     capabilityErrorMessage: "Storage does not provide projection run capabilities required by telemetry projection."
   });
+  assertMaterializerRunExecution(command.execution, execution.run.executionId, `Projection run '${execution.run.id}'`);
   assertTelemetryBatchPosition(execution.run, command.source.batchOrdinal, command.source.sourceRowCount, command.source.inputExhausted);
   return execution;
 }
@@ -3686,8 +3995,9 @@ async function executeTelemetryCommit(context, command) {
   return withSerializationRetry(context, () => context.storage.transaction((storage) => executeTelemetryTransaction(context, storage, command), { isolation: "serializable" }));
 }
 async function executeTelemetryTransaction(context, storage, command) {
+  await ensureMaterializerExecution(storage.executions, command.execution);
   const execution = await assertTelemetryExecution(storage, context.projectId, command);
-  const replay = await replayCommitRecord(context, command.identity, storage);
+  const replay = await replayCommitRecord(context, command.identity, command.execution.executionId, storage);
   if (replay) {
     if (command.kind === "projection" && execution) {
       assertTelemetryReplayCheckpoint(execution.run, command.source.batchOrdinal);
@@ -3702,7 +4012,10 @@ async function executeTelemetryTransaction(context, storage, command) {
   }
   const origin = telemetryOrigin(command);
   const session = await beginTelemetryMaterialization(context, storage, command, origin);
-  const counts = await planTelemetryAppend(context, storage.ontology.materializations, session, command.input, command.identity, origin);
+  const counts = await planTelemetryAppend(context, storage.ontology.materializations, session, command.input, command.identity, origin, {
+    correlationId: command.execution.correlationId,
+    ...command.execution.actor === undefined ? {} : { actor: command.execution.actor }
+  });
   await drainStagedWork(context, storage.ontology.materializations, session);
   const eventCount = await drainStagedEvents(context, storage.ontology.materializations, session, command.identity);
   const result = {
@@ -3749,6 +4062,7 @@ function telemetryCommit(projectId, command, origin) {
     id: command.identity.commitId,
     idempotencyKey: command.identity.idempotencyKey,
     requestHash: command.identity.requestHash,
+    executionId: command.execution.executionId,
     origin,
     ontologyRevision: command.ontologyRevision,
     intent: telemetryCommitIntent(command),
@@ -3764,9 +4078,9 @@ function telemetryCommit(projectId, command, origin) {
   };
 }
 function telemetryCommitActor(commit, command) {
-  if (command.input.actor === undefined)
+  if (command.execution.actor === undefined)
     return commit;
-  return { ...commit, actor: command.input.actor };
+  return { ...commit, actor: command.execution.actor };
 }
 function telemetryCommitIntent(command) {
   if (command.kind === "runtime") {
@@ -3817,12 +4131,30 @@ async function finalizeTelemetryMaterialization(storage, session, command, resul
 
 // src/materializer/materializer.ts
 class OntologyMaterializer {
-  edits = { commit: (input) => commitEdits(this.context, input) };
+  edits = {
+    commit: (command) => commitEdits(this.context, command)
+  };
   projections = {
-    replace: (input) => replaceProjection(this.context, input),
-    finishRun: (input) => finishProjectionRun(this.context, input)
+    replace: (command) => replaceProjection(this.context, command),
+    finishRun: (command) => finishProjectionRun(this.context, command)
   };
-  telemetry = { append: (input) => appendTelemetry(this.context, input) };
+  telemetry = {
+    append: (command) => appendTelemetry(this.context, command)
+  };
+  withScope(scope) {
+    return Object.freeze({
+      edits: Object.freeze({
+        commit: (input) => this.edits.commit({ scope, input })
+      }),
+      projections: Object.freeze({
+        replace: (input) => this.projections.replace({ scope, input }),
+        finishRun: (input) => this.projections.finishRun({ scope, input })
+      }),
+      telemetry: Object.freeze({
+        append: (input) => this.telemetry.append({ scope, input })
+      })
+    });
+  }
   context;
   constructor(projectId, ontology, projectionRegistry, storage, dependencies = {}) {
     this.context = createMaterializerContext({
@@ -3839,4 +4171,4 @@ function createOntologyMaterializer(input) {
 }
 export { computeOntologyRevision, computeProjectionRevision, computeProjectionOwnershipHash, ProjectionRegistry, createActionIdempotencyKey, createRuntimeIdempotencyKey, createProjectionIdempotencyKey, createRuntimeTelemetryIdempotencyKey, createProjectionTelemetryIdempotencyKey, createCommitIdentity, timestampCommitIdentity, createTimedCommitIdentity, createProjectionMaterializationId, createLinkScopeFingerprint, normalizeJsonProperties, normalizeOntologyEditCommit, normalizeProjectionExecution, normalizeProjectionSourceEntry, normalizeTelemetryAppend, OntologyMaterializer, createOntologyMaterializer };
 
-//# debugId=B1AC0F5B25E653E764756E2164756E21
+//# debugId=E9E5C3996D8CF74864756E2164756E21