js-bao 0.7.0-alpha.8 → 0.7.0-alpha.9

package/dist/browser.cjs

@@ -1314,6 +1314,14 @@ var init_DocumentQueryTranslator = __esm({
         }
         return Array.from(new Set(normalized));
       }
+      /**
+       * The `_meta_doc_id` condition for a document scope, alone: `IN (...)`, or
+       * `1 = 0` for an empty scope, or `null` when there is no scope. For a
+       * statement the translator does not assemble itself (the aggregations).
+       */
+      documentCondition(documents) {
+        return this.buildDocumentClause(documents);
+      }
       buildDocumentClause(documents) {
         const normalized = this.normalizeDocumentIds(documents);
         if (normalized === null) {
@@ -2374,6 +2382,69 @@ var init_overlaySql = __esm({
   }
 });
 
+// src/models/format2FoldedState.ts
+function orderedClients(vector) {
+  return Object.keys(vector).sort((a, b) => {
+    const left = Number(a);
+    const right = Number(b);
+    if (left !== right) return left < right ? -1 : 1;
+    return a < b ? -1 : a > b ? 1 : 0;
+  });
+}
+function canonicalFoldedState(state) {
+  const vector = {};
+  for (const client of orderedClients(state.vector)) {
+    const clock = Number(state.vector[client]);
+    if (Number.isFinite(clock) && clock >= 0) vector[client] = Math.floor(clock);
+  }
+  const models = Array.from(new Set(state.models.map(String))).sort();
+  return { vector, models };
+}
+function encodeFoldedState(state) {
+  const canonical = canonicalFoldedState(state);
+  const clients = orderedClients(canonical.vector).map(
+    (client) => `${JSON.stringify(client)}:${canonical.vector[client]}`
+  );
+  return `{"vector":{${clients.join(",")}},"models":${JSON.stringify(canonical.models)}}`;
+}
+function decodeFoldedState(raw) {
+  if (raw === null || raw === void 0) return null;
+  try {
+    const parsed = JSON.parse(String(raw));
+    if (!parsed || typeof parsed !== "object" || typeof parsed.vector !== "object" || parsed.vector === null || !Array.isArray(parsed.models)) {
+      return null;
+    }
+    return canonicalFoldedState({
+      vector: parsed.vector,
+      models: parsed.models
+    });
+  } catch {
+    return null;
+  }
+}
+function mergeFoldedStates(held, offered) {
+  if (held === null) return canonicalFoldedState(offered);
+  const vector = { ...held.vector };
+  for (const [client, clock] of Object.entries(offered.vector)) {
+    vector[client] = Math.max(vector[client] ?? 0, Number(clock));
+  }
+  return canonicalFoldedState({
+    vector,
+    models: [...held.models, ...offered.models]
+  });
+}
+function vectorIsAtOrAhead(docState, stored) {
+  for (const [client, clock] of Object.entries(stored)) {
+    if ((docState[client] ?? 0) < clock) return false;
+  }
+  return true;
+}
+var init_format2FoldedState = __esm({
+  "src/models/format2FoldedState.ts"() {
+    "use strict";
+  }
+});
+
 // src/models/format2RecordStore.ts
 function format2TableNames(docId) {
   let hex = "";
@@ -2386,6 +2457,9 @@ function format2TableNames(docId) {
   };
 }
 function format2ClientDDL(docId) {
+  return [...format2DocumentDDL(docId), ...FORMAT2_SHARED_DDL];
+}
+function format2DocumentDDL(docId) {
   const { records, stringSetIndex } = format2TableNames(docId);
   return [
     `CREATE TABLE IF NOT EXISTS ${records} (
@@ -2409,68 +2483,7 @@ function format2ClientDDL(docId) {
     // `(_type, field, _record_id)` shape left the planner narrowing on `_type`
     // alone — a walk of the model's whole member table per record. The old
     // name is dropped in `init()`, not here, so this list stays creation-only.
-    `CREATE INDEX IF NOT EXISTS idx_${stringSetIndex}_trf ON ${stringSetIndex}(_type, _record_id, field)`,
-    `CREATE TABLE IF NOT EXISTS _epoch (
-  doc_id TEXT PRIMARY KEY,
-  epoch INTEGER NOT NULL DEFAULT 0,
-  acked_seq INTEGER NOT NULL DEFAULT 0,
-  last_sync_at INTEGER,
-  window_days INTEGER,
-  clock_offset INTEGER,
-  hydrated_models TEXT
-)`,
-    PENDING_OPS_DDL("_pending_ops"),
-    `CREATE TABLE IF NOT EXISTS _client_acks (
-  doc_id TEXT NOT NULL,
-  client_id TEXT NOT NULL,
-  acked_seq INTEGER NOT NULL DEFAULT 0,
-  PRIMARY KEY (doc_id, client_id)
-)`,
-    // #3432 — keyed on the manifest ORDINAL. `{model}/{n}` stopped being a
-    // chunk's identity within its manifest the moment a manifest could reuse
-    // a chunk from an earlier build: two entries can then share that pair, and
-    // a resume keyed on it would treat the second as already loaded.
-    `CREATE TABLE IF NOT EXISTS _snapshot_load (
-  doc_id TEXT NOT NULL,
-  build_id TEXT NOT NULL,
-  ordinal INTEGER NOT NULL,
-  PRIMARY KEY (doc_id, build_id, ordinal)
-)`,
-    // #3435 — which base this merged view is on, and whether its load ever
-    // FINISHED. The second half is what makes a partial replacement safe: a
-    // convergence may keep a chunk by marking it rather than fetching it only
-    // when the rows it is keeping are a complete baseline. A client that is
-    // cold, or whose last load was interrupted, has no such guarantee and
-    // takes the full plan (finding 3435-R04).
-    `CREATE TABLE IF NOT EXISTS _snapshot_base (
-  doc_id TEXT PRIMARY KEY,
-  build_id TEXT NOT NULL,
-  epoch INTEGER NOT NULL,
-  complete INTEGER NOT NULL DEFAULT 0
-)`,
-    // #3435 — every bulk-load epoch this document crossed and has not yet
-    // converged past. Durable, because a connected client that followed a
-    // flagged seal onto E+1 has an epoch mark that reads perfectly current:
-    // if the debt lived only in memory, a restart would clear it and the
-    // client would serve rows the server replaced, for good.
-    `CREATE TABLE IF NOT EXISTS _discontinuities (
-  doc_id TEXT NOT NULL,
-  epoch INTEGER NOT NULL,
-  PRIMARY KEY (doc_id, epoch)
-)`,
-    // The judgement an epoch move DEFERRED and has not made yet. Durable,
-    // written in the same commit as the epoch mark, because the mark moves
-    // first: without this a restart in between reads as a client that is
-    // perfectly current and whose unacknowledged writes are simply missing
-    // from the overlay, so the bind puts them back by key presence alone and
-    // publishes an offline write recency would have dropped.
-    //
-    // Swift's columns and meanings (`Format2RecordStore.swift`), keyed by
-    // CLIENT as well as document: tabs share this database, sequence spaces
-    // are per client, and a note keyed by document alone would be overwritten
-    // by the second tab and read by a restarted one against sequences that
-    // were never its own.
-    DEFERRED_REPLAY_DDL
+    `CREATE INDEX IF NOT EXISTS idx_${stringSetIndex}_trf ON ${stringSetIndex}(_type, _record_id, field)`
   ];
 }
 function toDeferredReplayNote(rows) {
@@ -2496,6 +2509,24 @@ function format2DocumentIdFromTableName(table) {
   }
   return docId;
 }
+function legacyAdoptedPools(sql, tables) {
+  if (!tables.includes("_legacy_adopted")) return [];
+  return Array.from(
+    sql.exec("SELECT DISTINCT pool FROM _legacy_adopted")
+  ).map((row) => String(row.pool));
+}
+function legacyDeliveredAck(sql, docId, clientId, marked) {
+  if (!listTables(sql).includes("_legacy_handover")) return marked;
+  const handover = Array.from(
+    sql.exec(
+      "SELECT handed_seq, acked_seq FROM _legacy_handover WHERE doc_id = ? AND client_id = ?",
+      docId,
+      clientId
+    )
+  )[0];
+  if (!handover) return marked;
+  return marked <= Number(handover.handed_seq) ? Number(handover.acked_seq) : marked;
+}
 function listTables(sql) {
   return Array.from(
     sql.exec("SELECT name FROM sqlite_master WHERE type = 'table'")
@@ -2559,13 +2590,14 @@ function normalizeBinding(value) {
   if (typeof value === "number") return value;
   return String(value);
 }
-var FORMAT2_LEGACY_CLIENT_ID, PENDING_OPS_DDL, DEFERRED_REPLAY_DDL, Format2ModelNotHydratedError, Format2RecordStore;
+var FORMAT2_LEGACY_CLIENT_ID, PENDING_OPS_DDL, DEFERRED_REPLAY_DDL, FORMAT2_SHARED_DDL, LEGACY_HANDOVER_DDL, Format2ModelNotHydratedError, Format2RecordStore;
 var init_format2RecordStore = __esm({
   "src/models/format2RecordStore.ts"() {
     "use strict";
     init_overlaySql();
     init_largeDocuments();
     init_format2OfflineWindow();
+    init_format2FoldedState();
     FORMAT2_LEGACY_CLIENT_ID = "legacy";
     PENDING_OPS_DDL = (table) => `CREATE TABLE IF NOT EXISTS ${table} (
   doc_id TEXT NOT NULL,
@@ -2591,6 +2623,94 @@ var init_format2RecordStore = __esm({
   to_epoch INTEGER NOT NULL,
   kind TEXT NOT NULL,
   PRIMARY KEY (doc_id, client_id)
+)`;
+    FORMAT2_SHARED_DDL = [
+      `CREATE TABLE IF NOT EXISTS _epoch (
+  doc_id TEXT PRIMARY KEY,
+  epoch INTEGER NOT NULL DEFAULT 0,
+  acked_seq INTEGER NOT NULL DEFAULT 0,
+  last_sync_at INTEGER,
+  window_days INTEGER,
+  clock_offset INTEGER,
+  hydrated_models TEXT,
+  folded_state TEXT
+)`,
+      PENDING_OPS_DDL("_pending_ops"),
+      `CREATE TABLE IF NOT EXISTS _client_acks (
+  doc_id TEXT NOT NULL,
+  client_id TEXT NOT NULL,
+  acked_seq INTEGER NOT NULL DEFAULT 0,
+  PRIMARY KEY (doc_id, client_id)
+)`,
+      // #3432 — keyed on the manifest ORDINAL. `{model}/{n}` stopped being a
+      // chunk's identity within its manifest the moment a manifest could reuse
+      // a chunk from an earlier build: two entries can then share that pair, and
+      // a resume keyed on it would treat the second as already loaded.
+      `CREATE TABLE IF NOT EXISTS _snapshot_load (
+  doc_id TEXT NOT NULL,
+  build_id TEXT NOT NULL,
+  ordinal INTEGER NOT NULL,
+  PRIMARY KEY (doc_id, build_id, ordinal)
+)`,
+      // #3435 — which base this merged view is on, and whether its load ever
+      // FINISHED. The second half is what makes a partial replacement safe: a
+      // convergence may keep a chunk by marking it rather than fetching it only
+      // when the rows it is keeping are a complete baseline. A client that is
+      // cold, or whose last load was interrupted, has no such guarantee and
+      // takes the full plan (finding 3435-R04).
+      `CREATE TABLE IF NOT EXISTS _snapshot_base (
+  doc_id TEXT PRIMARY KEY,
+  build_id TEXT NOT NULL,
+  epoch INTEGER NOT NULL,
+  complete INTEGER NOT NULL DEFAULT 0
+)`,
+      // #3435 — every bulk-load epoch this document crossed and has not yet
+      // converged past. Durable, because a connected client that followed a
+      // flagged seal onto E+1 has an epoch mark that reads perfectly current:
+      // if the debt lived only in memory, a restart would clear it and the
+      // client would serve rows the server replaced, for good.
+      `CREATE TABLE IF NOT EXISTS _discontinuities (
+  doc_id TEXT NOT NULL,
+  epoch INTEGER NOT NULL,
+  PRIMARY KEY (doc_id, epoch)
+)`,
+      // The judgement an epoch move DEFERRED and has not made yet. Durable,
+      // written in the same commit as the epoch mark, because the mark moves
+      // first: without this a restart in between reads as a client that is
+      // perfectly current and whose unacknowledged writes are simply missing
+      // from the overlay, so the bind puts them back by key presence alone and
+      // publishes an offline write recency would have dropped.
+      //
+      // Swift's columns and meanings (`Format2RecordStore.swift`), keyed by
+      // CLIENT as well as document: tabs share this database, sequence spaces
+      // are per client, and a note keyed by document alone would be overwritten
+      // by the second tab and read by a restarted one against sequences that
+      // were never its own.
+      DEFERRED_REPLAY_DDL,
+      // #3760 — which of a PRE-AMENDMENT pool's unacknowledged writes this store
+      // has already taken over, so none is ever taken twice.
+      //
+      // Keyed by POOL and not by document (finding 3760-R3). A `doc_id`-keyed
+      // ledger would be swept by that document's purge, and the sequence this
+      // run is about is exactly: import a write, crash before the legacy copy is
+      // dropped, the user discards the document, reopen — at which point a
+      // document-keyed ledger is gone, the legacy copy is still there, and a
+      // write the user explicitly discarded comes back. The pool name outlives
+      // every document of it, so this does too, and only the scope store's own
+      // wipe takes it.
+      `CREATE TABLE IF NOT EXISTS _legacy_adopted (
+  pool TEXT NOT NULL,
+  client_id TEXT NOT NULL,
+  seq INTEGER NOT NULL,
+  PRIMARY KEY (pool, client_id, seq)
+)`
+    ];
+    LEGACY_HANDOVER_DDL = `CREATE TABLE IF NOT EXISTS _legacy_handover (
+  doc_id TEXT NOT NULL,
+  client_id TEXT NOT NULL,
+  handed_seq INTEGER NOT NULL,
+  acked_seq INTEGER NOT NULL,
+  PRIMARY KEY (doc_id, client_id)
 )`;
     Format2ModelNotHydratedError = class extends Error {
       constructor(model, hydrated) {
@@ -2671,6 +2791,9 @@ var init_format2RecordStore = __esm({
         if (columns.length > 0 && !columns.includes("hydrated_models")) {
           this.sql.exec("ALTER TABLE _epoch ADD COLUMN hydrated_models TEXT");
         }
+        if (columns.length > 0 && !columns.includes("folded_state")) {
+          this.sql.exec("ALTER TABLE _epoch ADD COLUMN folded_state TEXT");
+        }
         const pendingColumns = Array.from(
           this.sql.exec("PRAGMA table_info(_pending_ops)")
         ).map((row) => String(row.name));
@@ -2746,11 +2869,18 @@ var init_format2RecordStore = __esm({
        */
       setHydrationScope(models) {
         const scope = models === null ? null : [...models];
-        this.sql.exec(
-          "UPDATE _epoch SET hydrated_models = ? WHERE doc_id = ?",
-          scope === null ? null : JSON.stringify(scope),
-          this.docId
-        );
+        const encoded = scope === null ? null : JSON.stringify(scope);
+        const current = this.hydrationScope();
+        this.sql.transaction(() => {
+          if (encoded !== (current === null ? null : JSON.stringify(current))) {
+            this.clearFoldedState();
+          }
+          this.sql.exec(
+            "UPDATE _epoch SET hydrated_models = ? WHERE doc_id = ?",
+            encoded,
+            this.docId
+          );
+        });
         this.scope = scope;
         this.scopeLoaded = true;
       }
@@ -3225,6 +3355,7 @@ var init_format2RecordStore = __esm({
        */
       setEpoch(epoch, options = {}) {
         this.sql.transaction(() => {
+          if (epoch !== this.epoch()) this.clearFoldedState();
           this.sql.exec(
             "UPDATE _epoch SET epoch = ? WHERE doc_id = ?",
             epoch,
@@ -3295,6 +3426,59 @@ var init_format2RecordStore = __esm({
           this.client()
         );
       }
+      // ── What the store last folded (#3782) ───────────────────────────
+      /**
+       * The overlay state the merged view was last folded from, or `null` when
+       * nothing is known — a store written before this, or one whose rows were
+       * just replaced from another source.
+       *
+       * What it vouches for: for every model in `models`, every overlay item of
+       * that model's map below `vector` has been folded into `records` AND either
+       * projected into the query tables or had its model's projection mark
+       * withdrawn.
+       */
+      foldedState() {
+        const rows = this.rows(
+          "SELECT folded_state FROM _epoch WHERE doc_id = ?",
+          this.docId
+        );
+        return rows.length > 0 ? decodeFoldedState(rows[0].folded_state) : null;
+      }
+      /**
+       * Record that a fold certified `state`. Called INSIDE the transaction of the
+       * fold it vouches for, never beside it.
+       *
+       * Merged per client by MAX, with the models unioned — but only while the
+       * document that folded, at `docState`, is at or ahead of the stored vector
+       * on every client. Otherwise it answers `behind` and writes nothing: a
+       * lagging document folded older values under keys the stored vector
+       * vouches for newer ones of (finding 3782-R02), and a MAX would go on
+       * certifying the newer state over the older rows.
+       *
+       * A store that knows nothing (`NULL`) can only be stamped by a fold of the
+       * WHOLE overlay: an incremental batch folded its own keys and says nothing
+       * about the rest, so it answers `skipped` there.
+       */
+      noteFoldedState(state, options) {
+        const held = this.foldedState();
+        if (held === null && options.whole !== true) return "skipped";
+        if (held !== null && !vectorIsAtOrAhead(options.docState, held.vector)) {
+          return "behind";
+        }
+        this.sql.exec(
+          "UPDATE _epoch SET folded_state = ? WHERE doc_id = ?",
+          encodeFoldedState(mergeFoldedStates(held, state)),
+          this.docId
+        );
+        return "stamped";
+      }
+      /** Nothing is known about what the merged view was folded from. */
+      clearFoldedState() {
+        this.sql.exec(
+          "UPDATE _epoch SET folded_state = NULL WHERE doc_id = ?",
+          this.docId
+        );
+      }
       lastSyncAt() {
         const rows = this.rows(
           "SELECT last_sync_at FROM _epoch WHERE doc_id = ?",
@@ -3477,6 +3661,7 @@ var init_format2RecordStore = __esm({
         let applied = 0;
         this.sql.transaction(() => {
           if (this.chunkIsComplete(buildId, ordinal)) return;
+          this.clearFoldedState();
           for (const entry of entries) {
             if (!this.isHydrated(modelName)) break;
             projectOverlayEntry(this.sql, modelName, entry, this.tables);
@@ -3621,6 +3806,7 @@ var init_format2RecordStore = __esm({
           if (!this.isHydrated(modelName)) {
             return;
           }
+          this.clearFoldedState();
           removed = this.deleteCoverage(modelName, coverage);
           for (const entry of entries) {
             projectOverlayEntry(this.sql, modelName, entry, this.tables);
@@ -3646,6 +3832,7 @@ var init_format2RecordStore = __esm({
         let removed = 0;
         this.sql.transaction(() => {
           removed = this.deleteCoverage(modelName, { after, through }, limit);
+          if (removed > 0) this.clearFoldedState();
         });
         return { removed, done: removed < limit };
       }
@@ -3774,7 +3961,8 @@ var init_format2RecordStore = __esm({
           sql.exec(`DROP TABLE IF EXISTS ${quote(own.stringSetIndex)}`);
           return {
             pendingOps,
-            remainingDocuments: countStoredDocuments(sql).length
+            remainingDocuments: countStoredDocuments(sql).length,
+            legacyPools: legacyAdoptedPools(sql, tables)
           };
         });
       }
@@ -3790,6 +3978,29 @@ var init_format2RecordStore = __esm({
       static storedDocuments(sql) {
         return countStoredDocuments(sql);
       }
+      /**
+       * The pre-amendment pools this database's `_legacy_adopted` ledger names
+       * (#3760): while one of them is still on disk, this database is the only
+       * record of which of its writes have already been taken over, and must not
+       * be removed (findings 3760-REVIEW-02 and 3760-REVIEW-09).
+       */
+      static legacyAdoptedPools(sql) {
+        return legacyAdoptedPools(sql, listTables(sql));
+      }
+      /**
+       * Create the bookkeeping every document of this database shares, without
+       * naming one (#3760).
+       *
+       * What a store hosting SEVERAL documents needs before it knows any of them:
+       * the browser's worker opens one database per user scope and must answer
+       * `storedEpoch` and `listDocuments` for it straight away, and a document's
+       * own tables arrive later, on the first `serve` or probe that names it.
+       * Exactly the statements {@link init} runs that are not per document, so
+       * `init` on any document afterwards is a no-op over them.
+       */
+      static ensureSharedSchema(sql) {
+        for (const ddl of FORMAT2_SHARED_DDL) sql.exec(ddl);
+      }
       /**
        * Purge every document this database holds except `keep` (#3754).
        *
@@ -3841,9 +4052,314 @@ var init_format2RecordStore = __esm({
           this.sql.exec(`DELETE FROM ${this.tables.records}`);
           this.sql.exec(`DELETE FROM ${this.tables.stringSetIndex}`);
           this.sql.exec("DELETE FROM _snapshot_load WHERE doc_id = ?", this.docId);
+          this.clearFoldedState();
           this.sql.exec("DELETE FROM _snapshot_base WHERE doc_id = ?", this.docId);
         });
       }
+      // ── a pre-amendment pool's debt (#3760) ───────────────────────────
+      /**
+       * What a pre-amendment per-document pool still owes the server for `docId`.
+       *
+       * Read from the LEGACY database, by a transient worker on the legacy
+       * namespace. Its schema is MIGRATED first, through the one path that knows
+       * how (finding 3760-REVIEW-04): the transient worker's open runs only
+       * {@link ensureSharedSchema}, which creates a missing table and leaves an
+       * existing one exactly as it found it — so against a genuine 0.7.0 pool,
+       * whose `_pending_ops` has no `client_id`, no `mutation` and no
+       * `prior_overlay`, the read below failed on the column and the export
+       * answered "this pool owes nothing". That is the one outcome the intent's
+       * 0.7.0 rule does not permit, and it was silent. {@link init} is what turns
+       * a pool of any 0.7.x or 0.9.x shape into one these columns exist on, and it
+       * maps the 0.7.0 log to {@link FORMAT2_LEGACY_CLIENT_ID} with the acked mark
+       * that measures it (edge E5), which is also what lets edge E14's rule reach
+       * those rows. Writing to a pool this call is about to delete rows from
+       * anyway costs nothing, and is what an 0.8.0 client would have done to it.
+       *
+       * A table that is genuinely ABSENT afterwards is a release that never wrote
+       * it and owes nothing through it (edge E4). Any other read failure is raised:
+       * the adoption logs it and retries at the next open, which is honest, where
+       * reading it as "owes nothing" would silently strand the writes and then
+       * drop nothing — the caller only deletes what it was told moved.
+       */
+      static exportLegacyDocument(sql, docId) {
+        new _Format2RecordStore(sql, docId).init();
+        const tables = new Set(listTables(sql));
+        const rowsOf = (table, query, ...bindings) => {
+          if (!tables.has(table)) return [];
+          return Array.from(sql.exec(query, ...bindings));
+        };
+        const epochRow = rowsOf(
+          "_epoch",
+          "SELECT epoch, acked_seq FROM _epoch WHERE doc_id = ?",
+          docId
+        )[0];
+        return {
+          // A pool with no `_epoch` row for the document was never bound; its
+          // writes, if any, were made on no epoch this can name, and 0 is the
+          // honest answer — the judgement then spans the whole chain.
+          epoch: epochRow ? Number(epochRow.epoch) : 0,
+          pendingOps: rowsOf(
+            "_pending_ops",
+            `SELECT client_id, seq, model, record_id, op, fields, base_epoch, ts,
+                mutation, prior_overlay
+           FROM _pending_ops WHERE doc_id = ? ORDER BY client_id, seq`,
+            docId
+          ),
+          // The mark a server DELIVERY set, not the floor an earlier drop raised
+          // so the pre-amendment allocator could not reuse a handed-over sequence
+          // (finding 3760-REVIEW-08). The importer reads these as "already
+          // acknowledged", and an adopted row at or below that is pruned as sent.
+          clientAcks: rowsOf(
+            "_client_acks",
+            "SELECT client_id, acked_seq FROM _client_acks WHERE doc_id = ?",
+            docId
+          ).map((row) => ({
+            client_id: String(row.client_id),
+            acked_seq: legacyDeliveredAck(
+              sql,
+              docId,
+              String(row.client_id),
+              Number(row.acked_seq)
+            )
+          })),
+          deferredReplay: rowsOf(
+            "_deferred_replay",
+            `SELECT client_id, through_seq, from_epoch, to_epoch, kind
+           FROM _deferred_replay WHERE doc_id = ?`,
+            docId
+          ),
+          discontinuities: rowsOf(
+            "_discontinuities",
+            "SELECT epoch FROM _discontinuities WHERE doc_id = ? ORDER BY epoch",
+            docId
+          ).map((row) => Number(row.epoch))
+        };
+      }
+      /**
+       * Take over `legacy`'s debt for `docId`, once, in ONE transaction (#3760).
+       *
+       * Every row goes in under its ORIGINAL client id. That is what makes the
+       * bind's own adoption do the rest of the work: those clients are dead by
+       * construction — their lock names are keyed on the SCOPE namespace and the
+       * document, which no pre-amendment tab ever held — so
+       * `adoptOrphanedPendingOps` re-sequences them into this tab's space and
+       * classifies each against the merged row, exactly as it does for a sibling
+       * tab that closed (#3431).
+       *
+       * `_legacy_adopted` is consulted first and written in the same transaction,
+       * so a row already taken over is never taken again — including after a crash
+       * that left the legacy copy in place, and including after the document has
+       * been purged in between.
+       *
+       * Answers both halves the caller needs: the rows it took over just now, and
+       * every row of the batch the ledger records — which is what may be deleted
+       * from the legacy pool. They differ after a crash between an import and its
+       * drop: the row is already adopted, so it is not imported again, and its
+       * legacy copy still has to go. Dropping the whole document's log instead of
+       * the named batch would take a row a legacy tab wrote since the export.
+       */
+      static importLegacyDocument(sql, options) {
+        const { docId, pool, legacyEpoch, rows } = options;
+        const imported = [];
+        const settled = [];
+        const discontinuities = [];
+        let note = false;
+        sql.transaction(() => {
+          const adopted = new Set(
+            Array.from(
+              sql.exec(
+                "SELECT client_id, seq FROM _legacy_adopted WHERE pool = ?",
+                pool
+              )
+              // NUL as the separator, and written as an escape: a client id is
+              // whatever the app's build minted and nothing forbids a space in
+              // one, so a printable separator could make two rows one key.
+            ).map((row) => `${row.client_id}\0${row.seq}`)
+          );
+          const throughSeq = /* @__PURE__ */ new Map();
+          const fromEpoch = /* @__PURE__ */ new Map();
+          const lowerTo = (clientId, epoch) => {
+            if (!Number.isFinite(epoch) || epoch <= 0) return;
+            const held = fromEpoch.get(clientId);
+            fromEpoch.set(clientId, held === void 0 ? epoch : Math.min(held, epoch));
+          };
+          const legacyNotes = /* @__PURE__ */ new Map();
+          for (const row of rows.deferredReplay) {
+            const from = Number(row.from_epoch);
+            if (Number.isFinite(from) && from > 0) {
+              legacyNotes.set(String(row.client_id), from);
+            }
+          }
+          for (const row of rows.pendingOps) {
+            const clientId = String(row.client_id);
+            const seq = Number(row.seq);
+            if (adopted.has(`${clientId}\0${seq}`)) {
+              settled.push({ clientId, seq });
+              continue;
+            }
+            sql.exec(
+              `INSERT OR IGNORE INTO _pending_ops
+             (doc_id, client_id, seq, model, record_id, op, fields, base_epoch, ts,
+              mutation, prior_overlay)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+              docId,
+              clientId,
+              seq,
+              String(row.model),
+              String(row.record_id),
+              String(row.op),
+              String(row.fields),
+              Number(row.base_epoch),
+              Number(row.ts),
+              row.mutation ?? null,
+              row.prior_overlay ?? null
+            );
+            sql.exec(
+              "INSERT OR IGNORE INTO _legacy_adopted (pool, client_id, seq) VALUES (?, ?, ?)",
+              pool,
+              clientId,
+              seq
+            );
+            imported.push({ clientId, seq });
+            settled.push({ clientId, seq });
+            throughSeq.set(clientId, Math.max(throughSeq.get(clientId) ?? 0, seq));
+            lowerTo(clientId, Number(row.base_epoch));
+            const deferred = legacyNotes.get(clientId);
+            if (deferred !== void 0) lowerTo(clientId, deferred);
+          }
+          for (const ack of rows.clientAcks) {
+            sql.exec(
+              `INSERT INTO _client_acks (doc_id, client_id, acked_seq)
+           VALUES (?, ?, ?)
+           ON CONFLICT(doc_id, client_id) DO UPDATE SET
+             acked_seq = MAX(acked_seq, ?)`,
+              docId,
+              String(ack.client_id),
+              Number(ack.acked_seq),
+              Number(ack.acked_seq)
+            );
+          }
+          for (const epoch of rows.discontinuities) {
+            sql.exec(
+              "INSERT OR IGNORE INTO _discontinuities (doc_id, epoch) VALUES (?, ?)",
+              docId,
+              epoch
+            );
+            discontinuities.push(epoch);
+          }
+          for (const [clientId, seq] of throughSeq) {
+            const from = Math.min(fromEpoch.get(clientId) ?? legacyEpoch, legacyEpoch);
+            sql.exec(
+              `INSERT INTO _deferred_replay
+             (doc_id, client_id, through_seq, from_epoch, to_epoch, kind)
+           VALUES (?, ?, ?, ?, ?, 'legacy')
+           ON CONFLICT(doc_id, client_id) DO UPDATE SET
+             through_seq = MAX(through_seq, ?),
+             from_epoch = MIN(from_epoch, ?),
+             to_epoch = MAX(to_epoch, ?),
+             kind = 'legacy'`,
+              docId,
+              clientId,
+              seq,
+              from,
+              legacyEpoch,
+              seq,
+              from,
+              legacyEpoch
+            );
+            note = true;
+          }
+        });
+        return { imported, settled, discontinuities, note };
+      }
+      /**
+       * Delete exactly the rows that were imported, from the LEGACY pool (#3760).
+       *
+       * By primary key, and only the named batch: a legacy tab still running may
+       * have written more since the export, and a blanket delete of the document's
+       * log would take a write nothing has taken over.
+       *
+       * `discontinuities` are the bulk-load debts the scope store has recorded
+       * (finding 3760-REVIEW-06). They are deleted for the same reason the pending
+       * rows are: the debt now lives in the scope store, where a convergence
+       * settles it, and a copy left in a pool that is never removed would keep
+       * putting it back.
+       *
+       * The sequences go with the rows, never back into circulation (finding
+       * 3760-REVIEW-08). A pre-amendment bundle allocates `max(pending, acked) + 1`
+       * per client, so with its rows deleted and nothing acknowledged a legacy tab
+       * that reopens the document under the same client id would hand out
+       * sequence 1 again — and the next import would find `(pool, client, 1)` in
+       * the ledger, read the NEW write as the one already taken over, and delete
+       * it. So the client's `_client_acks` mark is raised to the highest sequence
+       * handed over, the one floor that allocator reads. That mark is a HAND-OVER,
+       * not a delivery, and the scope store must never read it as one (an adopted
+       * row at or below an acknowledged mark is pruned as delivered): the real
+       * acknowledgement is kept beside it in `_legacy_handover`, and
+       * {@link exportLegacyDocument} reports that one.
+       */
+      static dropLegacyDocument(sql, docId, rows, discontinuities = []) {
+        if (rows.length === 0 && discontinuities.length === 0) return 0;
+        let dropped = 0;
+        const handedThrough = /* @__PURE__ */ new Map();
+        for (const row of rows) {
+          handedThrough.set(
+            row.clientId,
+            Math.max(handedThrough.get(row.clientId) ?? 0, row.seq)
+          );
+        }
+        sql.transaction(() => {
+          if (handedThrough.size > 0) sql.exec(LEGACY_HANDOVER_DDL);
+          for (const [clientId, through] of handedThrough) {
+            const marked = Number(
+              Array.from(
+                sql.exec(
+                  "SELECT acked_seq FROM _client_acks WHERE doc_id = ? AND client_id = ?",
+                  docId,
+                  clientId
+                )
+              )[0]?.acked_seq ?? 0
+            );
+            const delivered = legacyDeliveredAck(sql, docId, clientId, marked);
+            const floor = Math.max(marked, through);
+            sql.exec(
+              `INSERT INTO _client_acks (doc_id, client_id, acked_seq) VALUES (?, ?, ?)
+           ON CONFLICT (doc_id, client_id) DO UPDATE SET acked_seq = excluded.acked_seq`,
+              docId,
+              clientId,
+              floor
+            );
+            sql.exec(
+              `INSERT INTO _legacy_handover (doc_id, client_id, handed_seq, acked_seq)
+           VALUES (?, ?, ?, ?)
+           ON CONFLICT (doc_id, client_id) DO UPDATE SET
+             handed_seq = excluded.handed_seq,
+             acked_seq = excluded.acked_seq`,
+              docId,
+              clientId,
+              floor,
+              delivered
+            );
+          }
+          for (const epoch of discontinuities) {
+            sql.exec(
+              "DELETE FROM _discontinuities WHERE doc_id = ? AND epoch = ?",
+              docId,
+              epoch
+            );
+          }
+          for (const row of rows) {
+            sql.exec(
+              "DELETE FROM _pending_ops WHERE doc_id = ? AND client_id = ? AND seq = ?",
+              docId,
+              row.clientId,
+              row.seq
+            );
+            dropped++;
+          }
+        });
+        return dropped;
+      }
       // ── helpers ───────────────────────────────────────────────────────
       rows(query, ...bindings) {
         return Array.from(this.sql.exec(query, ...bindings));
@@ -4039,10 +4555,10 @@ function observeFormat2Overlay(doc, store, onApplied) {
   doc.on("afterTransaction", handler);
   return () => doc.off("afterTransaction", handler);
 }
-function foldFormat2Overlay(doc, store, onApplied) {
+function foldFormat2Overlay(doc, store, onApplied, options = {}) {
   const sink = store;
   if (typeof sink.foldWholeOverlay === "function") {
-    sink.foldWholeOverlay(doc, onApplied);
+    sink.foldWholeOverlay(doc, onApplied, options);
     return;
   }
   const sync = store;
@@ -4066,6 +4582,68 @@ var init_format2Observer = __esm({
   }
 });
 
+// src/models/format2OverlayKeysSince.ts
+function readStateVector(doc) {
+  const vector = {};
+  for (const client of doc.store.clients.keys()) {
+    vector[String(client)] = Y7.getState(doc.store, client);
+  }
+  return vector;
+}
+function foldableModels(doc, isHydrated = () => true) {
+  const models = [];
+  for (const name of doc.share.keys()) {
+    if (!isFormat2ModelMap(name)) continue;
+    if (!isHydrated(name)) continue;
+    models.push(name);
+  }
+  return models.sort();
+}
+function overlayKeysSince(doc, stored, isHydrated = () => true) {
+  const rootNames = /* @__PURE__ */ new Map();
+  for (const [name, type] of doc.share) rootNames.set(type, name);
+  const covered = new Set(stored.models);
+  const keys = /* @__PURE__ */ new Map();
+  let moved = false;
+  let visited = 0;
+  for (const [client, structs] of doc.store.clients) {
+    const from = stored.vector[String(client)] ?? 0;
+    if (Y7.getState(doc.store, client) <= from) continue;
+    moved = true;
+    let index = from === 0 ? 0 : Y7.findIndexSS(structs, from);
+    for (; index < structs.length; index++) {
+      const struct = structs[index];
+      visited++;
+      if (!(struct instanceof Y7.Item)) continue;
+      const key = struct.parentSub;
+      if (typeof key !== "string") continue;
+      const model = rootNames.get(struct.parent);
+      if (model === void 0 || !isFormat2ModelMap(model)) continue;
+      if (!isHydrated(model) || !covered.has(model)) continue;
+      let set = keys.get(model);
+      if (!set) keys.set(model, set = /* @__PURE__ */ new Set());
+      set.add(key);
+    }
+  }
+  const uncovered = [];
+  for (const model of foldableModels(doc, isHydrated)) {
+    if (covered.has(model)) continue;
+    const map = doc.getMap(model);
+    if (map.size === 0) continue;
+    uncovered.push(model);
+  }
+  if (uncovered.length > 0) moved = true;
+  return { moved, keys, uncovered, visited };
+}
+var Y7;
+var init_format2OverlayKeysSince = __esm({
+  "src/models/format2OverlayKeysSince.ts"() {
+    "use strict";
+    Y7 = __toESM(require("yjs"), 1);
+    init_format2Observer();
+  }
+});
+
 // src/models/format2RecordStoreAsync.ts
 function widenDeferredReplay(held, note, epoch) {
   if (!note) {
@@ -4082,7 +4660,7 @@ function widenDeferredReplay(held, note, epoch) {
 function isFormat2RecordStoreAsync(value) {
   return value instanceof Format2RecordStoreAsync;
 }
-var ROW_REFRESH_PAGE, Format2FoldBrokenError, Format2RecordStoreAsync;
+var ROW_REFRESH_PAGE, LOCAL_STAMP_IDLE_MS, FORMAT2_HOLD_ATTEMPTS, FORMAT2_HOLD_RETRY_MS, Format2FoldBrokenError, Format2RecordStoreAsync;
 var init_format2RecordStoreAsync = __esm({
   "src/models/format2RecordStoreAsync.ts"() {
     "use strict";
@@ -4092,8 +4670,12 @@ var init_format2RecordStoreAsync = __esm({
     init_snapshotChunks();
     init_format2RecordStore();
     init_format2RowCache();
+    init_format2OverlayKeysSince();
     init_format2Observer();
     ROW_REFRESH_PAGE = 500;
+    LOCAL_STAMP_IDLE_MS = 250;
+    FORMAT2_HOLD_ATTEMPTS = 5;
+    FORMAT2_HOLD_RETRY_MS = 1e3;
     Format2FoldBrokenError = class extends Error {
       constructor(docId, cause) {
         super(
@@ -4110,6 +4692,12 @@ var init_format2RecordStoreAsync = __esm({
         this.host = host;
         this.docId = docId;
       }
+      /**
+       * How long a held batch waits for its document to catch up before it is
+       * tried again, overridable so a suite need not spend it.
+       * @internal
+       */
+      static holdRetryMs = FORMAT2_HOLD_RETRY_MS;
       cache = new Format2RowCache();
       state = "ready";
       foldBrokenCause = null;
@@ -4119,6 +4707,10 @@ var init_format2RecordStoreAsync = __esm({
       /** Operations admitted and not yet finished, for `drain()`. */
       admitted = 0;
       drainWaiters = [];
+      /** Local writes whose commit or projection is still running (#3756). */
+      localWrites = 0;
+      localWriteWaiters = [];
+      localWritesRefused = false;
       /**
        * Mark commands in flight, outside the scheduler.
        *
@@ -4138,6 +4730,38 @@ var init_format2RecordStoreAsync = __esm({
       unfoldedBatches = 0;
       /** The mirror. Unused on an in-process host, where the store is asked. */
       mirror = null;
+      /**
+       * The document that IS this store's current overlay (#3782). Only its
+       * batches are stamped: a sealed archive folded through a throwaway doc
+       * describes an epoch that is over, and its vector means nothing here.
+       */
+      trackedOverlay = null;
+      /**
+       * The tracked overlay's own clock before the earliest local write still in
+       * flight, or `null` (#3782). A write's items are on the overlay the moment
+       * it publishes, but its query row lands only when its projection settles;
+       * a stamp read in between must not vouch for them, so this client's clock
+       * is capped here in every stamp read while any local write is running.
+       */
+      localFloor = null;
+      /**
+       * A settled local write is not yet certified by any stamp (finding
+       * 3782-R06). Issued as a stamp-only batch after an idle window, at a
+       * disconnect, or carried along by the next remote batch's stamp.
+       */
+      localStampOwed = false;
+      localStampTimer = null;
+      /**
+       * A batch the host refused because its document is behind what the store
+       * certifies (#3782, finding 3782-R02). Nothing of it was written. It goes
+       * back out with the next transaction of its document — which is usually the
+       * one that catches it up — or after `holdRetryMs`, and past
+       * {@link FORMAT2_HOLD_ATTEMPTS} refusals it is folded forced.
+       */
+      heldBatch = null;
+      heldTimer = null;
+      /** Which query tables a batch's records are projected into (#3782). */
+      projectionProvider = null;
       /**
        * Open the store behind `host`: create the schema and load the marks mirror.
        */
@@ -4285,6 +4909,120 @@ var init_format2RecordStoreAsync = __esm({
         await this.batchSettled;
         await this.drainMarks();
       }
+      // ── Local writes, commit AND projection ───────────────────────────
+      /**
+       * Run one local write — its scheduled commit and the query projection that
+       * follows it — as a unit a release can wait for (#3756).
+       *
+       * `drain()` covers the commit only: the projection runs after the scheduled
+       * operation resolves, and a projection that finds its document unregistered
+       * returns silently. A release keeps the projection marks, so it must not
+       * unregister while a write it admitted still has its row to project.
+       */
+      async trackLocalWrite(work) {
+        if (this.localWritesRefused || this.state === "closed") {
+          throw new DocumentClosedError(
+            `[format2] Document '${this.docId}' is being released; the write was not run.`
+          );
+        }
+        if (this.localWrites === 0) this.localFloor = this.ownClock();
+        this.localWrites++;
+        try {
+          return await work();
+        } finally {
+          this.localWrites--;
+          if (this.localWrites === 0) {
+            this.localFloor = null;
+            if (this.localStampOwed) this.scheduleLocalStamp();
+            const waiters = this.localWriteWaiters;
+            this.localWriteWaiters = [];
+            for (const waiter of waiters) waiter();
+          }
+        }
+      }
+      /**
+       * A local write just published to the tracked overlay (#3782, finding
+       * 3782-R06). Called inside the scheduled operation that committed it; costs
+       * a flag, not a vector read — the stamp that certifies it reads the vector
+       * when it is issued, once the write's projection has settled.
+       */
+      noteLocalPublish(doc) {
+        if (doc !== this.trackedOverlay) return;
+        this.localStampOwed = true;
+      }
+      /** The tracked overlay's own client clock right now. */
+      ownClock() {
+        const doc = this.trackedOverlay;
+        if (!doc) return null;
+        return readStateVector(doc)[String(doc.clientID)] ?? 0;
+      }
+      /**
+       * Issue the owed local stamp after an idle window, so a burst of saves
+       * stamps once. Not holding the process open: an idle window that never
+       * fires is a stamp the next open pays for with a fold of those writes.
+       */
+      scheduleLocalStamp() {
+        if (this.localStampTimer) clearTimeout(this.localStampTimer);
+        const timer = setTimeout(() => {
+          this.localStampTimer = null;
+          this.issueLocalStamp();
+        }, LOCAL_STAMP_IDLE_MS);
+        timer.unref?.();
+        this.localStampTimer = timer;
+      }
+      cancelLocalStamp() {
+        this.localStampOwed = false;
+        if (this.localStampTimer) {
+          clearTimeout(this.localStampTimer);
+          this.localStampTimer = null;
+        }
+      }
+      /**
+       * Queue the stamp-only batch that certifies the settled local writes,
+       * through the ordinary FIFO and the ordinary guard: every remote batch
+       * queued before it is folded first, and a document behind the store is
+       * refused like any other.
+       */
+      issueLocalStamp() {
+        if (!this.localStampOwed) return;
+        this.localStampOwed = false;
+        const doc = this.trackedOverlay;
+        if (!doc || this.state === "closed") return;
+        const batch = this.openBatch(doc);
+        batch.stamp = this.captureStamp(doc);
+        this.applyBatchInThread(batch);
+      }
+      /**
+       * Issue the owed local stamp now and wait for it (#3782). A disconnect
+       * calls it once every local write has projected and before the facade
+       * closes, so a clean close leaves the store certified.
+       */
+      async flushLocalStamp() {
+        if (!this.localStampOwed) return;
+        if (this.localStampTimer) {
+          clearTimeout(this.localStampTimer);
+          this.localStampTimer = null;
+        }
+        this.issueLocalStamp();
+        await this.whenBatchesSettled();
+      }
+      /** Local writes admitted and not yet projected. */
+      localWritesInFlight() {
+        return this.localWrites;
+      }
+      /** Resolves when no local write is committing or projecting. */
+      whenLocalWritesSettled() {
+        if (this.localWrites === 0) return Promise.resolve();
+        return new Promise((resolve) => this.localWriteWaiters.push(resolve));
+      }
+      /**
+       * Refuse every local write from now on. The release calls this once the
+       * writes it waited for have landed, in the same turn as its last check, so
+       * no write can be admitted between that check and the unregistering.
+       */
+      refuseLocalWrites() {
+        this.localWritesRefused = true;
+      }
       ops() {
         const dispatch = (command) => this.host.dispatch(command);
         return {
@@ -4397,6 +5135,7 @@ var init_format2RecordStoreAsync = __esm({
           return;
         }
         const marks = this.mirrored();
+        if (marks.epoch !== epoch) marks.foldedState = null;
         marks.epoch = epoch;
         marks.deferredReplay = widenDeferredReplay(
           marks.deferredReplay,
@@ -4492,6 +5231,48 @@ var init_format2RecordStoreAsync = __esm({
         );
         this.refreshMirror({ deferredReplay: null });
       }
+      // ── What the merged view was last folded from (#3782) ────────────
+      /** The stored folded state, or `null` when nothing is known. */
+      foldedState() {
+        const store = this.direct();
+        return store ? store.foldedState() : this.mirrored().foldedState ?? null;
+      }
+      /**
+       * Say which document is this store's live overlay. The binding calls it at
+       * every connect, so an epoch move's fresh overlay replaces the sealed one.
+       */
+      trackOverlay(doc) {
+        if (this.heldBatch && this.heldBatch.doc !== doc) {
+          this.retireHeld("the document was rebound to a new overlay");
+        }
+        this.trackedOverlay = doc;
+      }
+      /**
+       * Say which query tables a fold's records go into. Set by the binding that
+       * owns the model registry; a store nothing set it on — one registered
+       * directly, with no engine — projects nothing, as it never did.
+       */
+      setProjectionProvider(provider) {
+        this.projectionProvider = provider;
+      }
+      /** What folding the tracked overlay up to now would certify. */
+      captureStamp(doc) {
+        if (doc !== this.trackedOverlay) return null;
+        const vector = readStateVector(doc);
+        const own = String(doc.clientID);
+        if (this.localFloor !== null) {
+          if (this.localFloor === 0) delete vector[own];
+          else if (vector[own] !== void 0) {
+            vector[own] = Math.min(vector[own], this.localFloor);
+          }
+        } else if (this.localStampOwed) {
+          this.cancelLocalStamp();
+        }
+        return {
+          vector,
+          models: foldableModels(doc, (model) => this.isHydrated(model))
+        };
+      }
       /** Whether the base this view is on finished loading (#3435). */
       baseComplete() {
         const store = this.direct();
@@ -4511,7 +5292,11 @@ var init_format2RecordStoreAsync = __esm({
         const store = this.direct();
         if (store) store.setHydrationScope(scope);
         else {
-          this.mirrored().hydrationScope = scope;
+          const marks = this.mirrored();
+          if (JSON.stringify(marks.hydrationScope) !== JSON.stringify(scope)) {
+            marks.foldedState = null;
+          }
+          marks.hydrationScope = scope;
           this.sendMark({ kind: "setHydrationScope", models: scope });
         }
       }
@@ -4707,6 +5492,7 @@ var init_format2RecordStoreAsync = __esm({
             ordinal
           })
         );
+        this.refreshMirror({ foldedState: null });
         for (const entry of entries) {
           if (this.cache.peek(model, entry.id)) {
             await this.refreshRows(model, [entry.id]);
@@ -4745,6 +5531,7 @@ var init_format2RecordStoreAsync = __esm({
           })
         );
         if (!reply.skipped) {
+          this.refreshMirror({ foldedState: null });
           await this.refreshRange(
             model,
             coverage,
@@ -4760,6 +5547,7 @@ var init_format2RecordStoreAsync = __esm({
           () => this.host.dispatch({ kind: "deleteRange", model, after, through, limit })
         );
         if (reply.removed > 0) {
+          this.refreshMirror({ foldedState: null });
           await this.refreshRange(model, { after, through }, []);
         }
         return reply;
@@ -4838,6 +5626,7 @@ var init_format2RecordStoreAsync = __esm({
           "discardMergedView",
           () => this.host.dispatch({ kind: "discardMergedView" })
         );
+        this.refreshMirror({ foldedState: null });
         this.cache.invalidateAll();
       }
       // ── Presence and adoption (#3431) ─────────────────────────────────
@@ -4913,6 +5702,26 @@ var init_format2RecordStoreAsync = __esm({
         );
         return adopted;
       }
+      // ── The query projection (#3782) ──────────────────────────────────
+      /**
+       * Project the named records of `model` into its query tables, on the host.
+       *
+       * One command however many ids: the host reads each record from its own
+       * `records` and writes the derived rows in one transaction, so nothing per
+       * record crosses the boundary. A failure withdraws the model's projection
+       * mark on the host and rejects here.
+       */
+      async projectRows(model, ids, spec) {
+        this.assertReadable();
+        this.assertHydrated(model);
+        if (ids.length === 0) return { projected: 0, deleted: 0 };
+        return this.host.dispatch({
+          kind: "projectRows",
+          model,
+          ids: [...ids],
+          spec
+        });
+      }
       // ── Projection marks ──────────────────────────────────────────────
       queryProjectionIsCurrent(model) {
         return this.host.dispatch({
@@ -4946,9 +5755,11 @@ var init_format2RecordStoreAsync = __esm({
        * are COALESCED into one: their key sets are unioned, so one
        * `applyRemoteBatch` carries them and each touched record is reported once.
        */
-      enqueueOverlayBatch(doc, touched, onApplied) {
+      enqueueOverlayBatch(doc, touched, onApplied, options = {}) {
         if (this.state === "closed") return;
+        if (this.heldBatch && this.heldBatch.doc === doc) this.releaseHeld(false);
         const batch = this.openBatch(doc);
+        if (options.atBind) batch.atBind = true;
         for (const [model, keys] of touched) {
           let set = batch.touched.get(model);
           if (!set) batch.touched.set(model, set = /* @__PURE__ */ new Set());
@@ -4957,16 +5768,23 @@ var init_format2RecordStoreAsync = __esm({
         if (onApplied && !batch.onApplied.includes(onApplied)) {
           batch.onApplied.push(onApplied);
         }
+        batch.stamp = this.captureStamp(doc);
         this.applyBatchInThread(batch);
       }
       /** Queue a WHOLE-overlay catch-up fold (connect, refold, sealed overlay). */
-      foldWholeOverlay(doc, onApplied) {
+      foldWholeOverlay(doc, onApplied, options = {}) {
         if (this.state === "closed") return;
         const batch = this.openBatch(doc);
         batch.wholeDocs.push(doc);
+        if (options.atBind) batch.atBind = true;
         if (onApplied && !batch.onApplied.includes(onApplied)) {
           batch.onApplied.push(onApplied);
         }
+        const stamp = this.captureStamp(doc);
+        if (stamp) {
+          batch.stamp = stamp;
+          batch.whole = true;
+        }
         this.applyBatchInThread(batch);
       }
       openBatch(doc) {
@@ -4979,7 +5797,11 @@ var init_format2RecordStoreAsync = __esm({
           touched: /* @__PURE__ */ new Map(),
           wholeDocs: [],
           onApplied: [],
-          applied: false
+          applied: false,
+          stamp: null,
+          whole: false,
+          atBind: false,
+          behind: 0
         };
         this.pendingBatch = batch;
         this.unfoldedBatches++;
@@ -5014,6 +5836,169 @@ var init_format2RecordStoreAsync = __esm({
         }
         return entries;
       }
+      /** Batches held because their document lags the store: 0 or 1. */
+      heldBatches() {
+        return this.heldBatch ? 1 : 0;
+      }
+      /** Everything `source` stands for, added to `target`. */
+      mergeBatch(target, source) {
+        for (const [model, keys] of source.touched) {
+          let set = target.touched.get(model);
+          if (!set) target.touched.set(model, set = /* @__PURE__ */ new Set());
+          for (const key of keys) set.add(key);
+        }
+        for (const doc of source.wholeDocs) {
+          if (!target.wholeDocs.includes(doc)) target.wholeDocs.push(doc);
+        }
+        for (const notify of source.onApplied) {
+          if (!target.onApplied.includes(notify)) target.onApplied.push(notify);
+        }
+        target.stamp = target.stamp ?? source.stamp;
+        target.whole = target.whole || source.whole;
+        target.behind = Math.max(target.behind, source.behind);
+      }
+      /** The host refused `batch`: its document is behind the store. Hold it. */
+      holdBatch(batch) {
+        batch.behind++;
+        if (this.state === "closed") return;
+        if (batch.doc !== this.trackedOverlay) {
+          Logger.warn(
+            `[format2] ${this.docId}: a fold refused for an overlay this document has since moved off was dropped; nothing of it was written`
+          );
+          return;
+        }
+        if (this.heldBatch && this.heldBatch !== batch) {
+          if (this.heldBatch.doc === batch.doc) {
+            this.mergeBatch(this.heldBatch, batch);
+          } else {
+            this.retireHeld("the document was rebound to a new overlay");
+            this.heldBatch = batch;
+          }
+        } else {
+          this.heldBatch = batch;
+        }
+        const held = this.heldBatch;
+        Logger.warn(
+          `[format2] ${this.docId}: the store is ahead of this document; its fold is held until the document catches up (refused ${held.behind} of ${FORMAT2_HOLD_ATTEMPTS} time(s) before it is folded forced).`
+        );
+        if (this.heldTimer) clearTimeout(this.heldTimer);
+        const timer = setTimeout(() => {
+          this.heldTimer = null;
+          this.releaseHeld(true);
+        }, _Format2RecordStoreAsync.holdRetryMs);
+        timer.unref?.();
+        this.heldTimer = timer;
+      }
+      /**
+       * Put the held batch back in the queue. `schedule` false leaves it pending
+       * for the caller, who is adding a transaction's keys to it.
+       */
+      releaseHeld(schedule) {
+        const held = this.heldBatch;
+        if (!held) return;
+        if (held.doc !== this.trackedOverlay) {
+          this.retireHeld("its overlay is no longer the document's live one");
+          return;
+        }
+        this.heldBatch = null;
+        if (this.heldTimer) {
+          clearTimeout(this.heldTimer);
+          this.heldTimer = null;
+        }
+        if (this.state === "closed") return;
+        const batch = this.openBatch(held.doc);
+        this.mergeBatch(batch, held);
+        if (schedule) this.applyBatchInThread(batch);
+      }
+      /**
+       * Drop the held batch without folding it (finding 3782-C03). It was refused
+       * because the store is ahead of its document, so it wrote nothing and
+       * certified nothing; what it carried is the sealed overlay's, which the
+       * room archived and the tab the store is ahead of folds.
+       */
+      retireHeld(reason) {
+        const held = this.heldBatch;
+        if (!held) return;
+        this.heldBatch = null;
+        if (this.heldTimer) {
+          clearTimeout(this.heldTimer);
+          this.heldTimer = null;
+        }
+        Logger.warn(
+          `[format2] ${this.docId}: a held fold was dropped because ${reason}; nothing of it was written`
+        );
+      }
+      /**
+       * Fold the held batch with `batch`, which is about to run (finding
+       * 3782-C02). A batch queued while its predecessor's refusal was on the way
+       * opened on its own — nothing was held yet — and its stamp, read after the
+       * refused transaction, covers that transaction's items. Carrying the held
+       * keys is what makes that stamp true; if `batch` is refused in turn, the
+       * two are held together.
+       */
+      absorbHeld(batch) {
+        const held = this.heldBatch;
+        if (!held || held === batch || held.doc !== batch.doc) return;
+        this.heldBatch = null;
+        if (this.heldTimer) {
+          clearTimeout(this.heldTimer);
+          this.heldTimer = null;
+        }
+        this.mergeBatch(batch, held);
+      }
+      /**
+       * The one command a batch is folded, projected and stamped by (#3782).
+       *
+       * `null` when there is nothing to send: no entries and nothing to certify.
+       * A stamp is offered only for the tracked overlay, and only while the
+       * facade is healthy — a batch folded after a failed one must not vouch for
+       * the items the failure left behind — unless the batch folds the WHOLE
+       * overlay, which is the repair. The folding document's CURRENT vector goes
+       * with every tracked-overlay batch, stamped or not, so the host can refuse
+       * a fold from a document the store is ahead of (finding 3782-R02).
+       */
+      batchCommand(batch, entries) {
+        const tracked = batch.doc === this.trackedOverlay;
+        const stamp = tracked && batch.stamp && (batch.whole || this.state === "ready") ? batch.stamp : null;
+        if (entries.length === 0 && stamp === null) return null;
+        const command = {
+          kind: "applyRemoteBatch",
+          entries
+        };
+        const models = Array.from(new Set(entries.map((item) => item.model)));
+        const project = models.length > 0 && this.projectionProvider ? this.projectionProvider(models) : [];
+        if (project.length > 0) command.project = project;
+        if (tracked) command.docState = readStateVector(batch.doc);
+        else command.untracked = true;
+        if (stamp) {
+          command.foldedState = stamp;
+          if (batch.whole) command.whole = true;
+        }
+        if (batch.behind >= FORMAT2_HOLD_ATTEMPTS) {
+          return entries.length === 0 ? null : this.forcedCommand(command);
+        }
+        return command;
+      }
+      /**
+       * The same batch, forced (#3782): folded whatever the store holds, with the
+       * stored folded state cleared instead of written. What a bind does when
+       * its document is behind the store — it cannot wait for the room.
+       */
+      forcedCommand(command) {
+        const { foldedState: _stamp, whole: _whole, ...rest } = command;
+        return { ...rest, force: true };
+      }
+      /** What a folded batch's reply means for this side (#3782). */
+      noteBatchReply(reply) {
+        if (reply.foldedState !== void 0) {
+          this.refreshMirror({ foldedState: reply.foldedState });
+        }
+        for (const failure of reply.projectionFailed ?? []) {
+          Logger.error(
+            `[format2] ${this.docId}: projecting a fold into '${failure.model}' query tables failed; the fold landed, the model's mark is withdrawn and the next bind rebuilds it: ${failure.message}`
+          );
+        }
+      }
       notifyBatch(batch, touched) {
         for (const { model, id } of touched) {
           for (const notify of batch.onApplied) {
@@ -5056,9 +6041,20 @@ var init_format2RecordStoreAsync = __esm({
         this.unfoldedBatches--;
         if (this.pendingBatch === batch) this.pendingBatch = null;
         try {
+          this.absorbHeld(batch);
           const entries = this.materializeBatch(batch);
-          if (entries.length === 0) return true;
-          const reply = host.dispatchSync({ kind: "applyRemoteBatch", entries });
+          const command = this.batchCommand(batch, entries);
+          if (command === null) return true;
+          let reply = host.dispatchSync(command);
+          this.noteBatchReply(reply);
+          if (reply.behind && batch.atBind) {
+            reply = host.dispatchSync(this.forcedCommand(command));
+            this.noteBatchReply(reply);
+          }
+          if (reply.behind) {
+            this.holdBatch(batch);
+            return true;
+          }
           if (batch.wholeDocs.length > 0) this.clearFoldBroken();
           for (const { model, id } of reply.touched) {
             if (!this.cache.peek(model, id)) continue;
@@ -5078,16 +6074,24 @@ var init_format2RecordStoreAsync = __esm({
         if (this.state === "closed") return;
         try {
           await this.run("applyRemoteBatch", async () => {
+            this.absorbHeld(batch);
             const entries = this.materializeBatch(batch);
             const repairs = batch.wholeDocs.length > 0;
-            if (entries.length === 0) {
+            const command = this.batchCommand(batch, entries);
+            if (command === null) {
               if (repairs) this.clearFoldBroken();
               return;
             }
-            const reply = await this.host.dispatch({
-              kind: "applyRemoteBatch",
-              entries
-            });
+            let reply = await this.host.dispatch(command);
+            this.noteBatchReply(reply);
+            if (reply.behind && batch.atBind) {
+              reply = await this.host.dispatch(this.forcedCommand(command));
+              this.noteBatchReply(reply);
+            }
+            if (reply.behind) {
+              this.holdBatch(batch);
+              return;
+            }
             if (repairs) this.clearFoldBroken();
             const byModel = /* @__PURE__ */ new Map();
             for (const { model, id } of reply.touched) {
@@ -5128,8 +6132,18 @@ var init_format2RecordStoreAsync = __esm({
         }
       }
       // ── Teardown ──────────────────────────────────────────────────────
-      async close(options = {}) {
-        if (this.state === "closed") return { wiped: false };
+      /**
+       * Release the facade and its host. Removes nothing (#3756): the query
+       * tables and projection marks stay for the next open.
+       */
+      async close() {
+        if (this.state === "closed") return;
+        this.cancelLocalStamp();
+        this.heldBatch = null;
+        if (this.heldTimer) {
+          clearTimeout(this.heldTimer);
+          this.heldTimer = null;
+        }
         try {
           await this.drain();
         } catch {
@@ -5139,9 +6153,8 @@ var init_format2RecordStoreAsync = __esm({
         } catch {
         }
         this.cache.clear();
-        const result = await this.host.close(options);
+        await this.host.close();
         this.state = "closed";
-        return result;
       }
     };
   }
@@ -5285,6 +6298,95 @@ CREATE TABLE IF NOT EXISTS _query_projection (
   }
 });
 
+// src/models/format2RowProjector.ts
+function quote2(identifier) {
+  return `"${identifier.replace(/"/g, '""')}"`;
+}
+function binding(value) {
+  if (value === void 0) return null;
+  if (typeof value === "boolean") return value ? 1 : 0;
+  return value;
+}
+function projectFormat2Row(sql, spec, docId, recordId, row) {
+  const table = quote2(spec.table);
+  if (row === null) {
+    sql.exec(`DELETE FROM ${table} WHERE ${quote2("id")} = ?`, recordId);
+    return "deleted";
+  }
+  const stringSetFields = new Set(spec.stringSets.map((set) => set.field));
+  const columns = new Set(spec.columns);
+  const data = {};
+  for (const [key, value] of Object.entries(row)) {
+    if (stringSetFields.has(key)) continue;
+    if (value === void 0) continue;
+    if (!columns.has(key) && key !== "id" && key !== "type") continue;
+    data[key] = value;
+  }
+  data.id = recordId;
+  data.type = spec.model;
+  data._meta_doc_id = docId;
+  data._meta_permission_hint = spec.permissionHint;
+  const names = Object.keys(data);
+  const updates = names.filter((name) => name !== "id").map((name) => `${quote2(name)}=excluded.${quote2(name)}`);
+  sql.exec(
+    `INSERT INTO ${table} (${names.map(quote2).join(", ")}) VALUES (${names.map(() => "?").join(", ")}) ON CONFLICT(${quote2("id")}) DO UPDATE SET ${updates.join(", ")}`,
+    ...names.map((name) => binding(data[name]))
+  );
+  const foreignKey = quote2(spec.foreignKey);
+  for (const { field, table: junctionName } of spec.stringSets) {
+    const junction = quote2(junctionName);
+    const members = (Array.isArray(row[field]) ? row[field] : []).map(String);
+    let current = [];
+    try {
+      current = Array.from(
+        sql.exec(
+          `SELECT ${quote2("value")} FROM ${junction} WHERE ${foreignKey} = ?`,
+          recordId
+        )
+      ).map((entry) => String(entry.value));
+    } catch {
+      current = [];
+    }
+    for (const member of current) {
+      if (members.includes(member)) continue;
+      sql.exec(
+        `DELETE FROM ${junction} WHERE ${foreignKey} = ? AND ${quote2("value")} = ?`,
+        recordId,
+        member
+      );
+    }
+    for (const member of members) {
+      if (current.includes(member)) continue;
+      sql.exec(
+        `INSERT OR IGNORE INTO ${junction} (${quote2("id")}, ${foreignKey}, ${quote2(
+          "value"
+        )}) VALUES (?, ?, ?)`,
+        `${recordId}_${member}`,
+        recordId,
+        member
+      );
+    }
+  }
+  return "projected";
+}
+function projectFormat2Rows(sql, spec, docId, ids, readRow) {
+  let projected = 0;
+  let deleted = 0;
+  for (const id of ids) {
+    if (projectFormat2Row(sql, spec, docId, id, readRow(id)) === "projected") {
+      projected++;
+    } else {
+      deleted++;
+    }
+  }
+  return { projected, deleted };
+}
+var init_format2RowProjector = __esm({
+  "src/models/format2RowProjector.ts"() {
+    "use strict";
+  }
+});
+
 // src/models/format2StoreDispatcher.ts
 function readFormat2StoreMarks(store) {
   return {
@@ -5303,7 +6405,9 @@ function readFormat2StoreMarks(store) {
     baseComplete: store.baseState().base?.complete ?? false,
     // #3755 — read on the same round trip as the rest, because the claim path
     // reads it synchronously off the mirror.
-    deferredReplay: store.deferredReplay()
+    deferredReplay: store.deferredReplay(),
+    // #3782 — what the bind compares the loaded overlay with.
+    foldedState: store.foldedState()
   };
 }
 function dispatchFormat2StoreCommand(store, sql, command) {
@@ -5368,15 +6472,78 @@ function run(store, sql, command) {
       return { seq, row };
     }
     case "applyRemoteBatch": {
+      if (command.docState !== void 0 && command.force !== true) {
+        const held = store.foldedState();
+        if (held !== null && !vectorIsAtOrAhead(command.docState, held.vector)) {
+          return {
+            touched: [],
+            projected: [],
+            stamped: false,
+            behind: true,
+            foldedState: held
+          };
+        }
+      }
       const touched = [];
+      const projected = [];
+      const projectionFailed = [];
+      let stamped = false;
       sql.transaction(() => {
         for (const { model, entry } of command.entries) {
           if (!store.isHydrated(model)) continue;
           store.applyRemote(model, entry);
           touched.push({ model, id: entry.id });
         }
+        for (const spec of command.project ?? []) {
+          const ids = Array.from(
+            new Set(touched.filter((t) => t.model === spec.model).map((t) => t.id))
+          );
+          if (ids.length === 0) continue;
+          sql.exec("SAVEPOINT f2_project");
+          try {
+            projectFormat2Rows(
+              sql,
+              spec,
+              store.documentId(),
+              ids,
+              (id) => store.read(spec.model, id)
+            );
+            sql.exec("RELEASE f2_project");
+            projected.push({ model: spec.model, count: ids.length });
+          } catch (error) {
+            sql.exec("ROLLBACK TO f2_project");
+            sql.exec("RELEASE f2_project");
+            forgetQueryProjection(sql, store.documentId(), spec.model);
+            projectionFailed.push({
+              model: spec.model,
+              message: error instanceof Error ? error.message : String(error)
+            });
+          }
+        }
+        if (command.force === true) {
+          store.clearFoldedState();
+          Logger.warn(
+            `[format2] ${store.documentId()}: folded from a document behind the store; the next open folds the whole overlay`
+          );
+        } else if (command.foldedState && command.docState) {
+          stamped = store.noteFoldedState(command.foldedState, {
+            docState: command.docState,
+            whole: command.whole === true
+          }) === "stamped";
+        } else if (command.docState === void 0 && command.untracked !== true && touched.length > 0 && store.foldedState() !== null) {
+          store.clearFoldedState();
+          Logger.warn(
+            `[format2] ${store.documentId()}: folded a batch from a tab that predates the folded-state mark; the next open folds the whole overlay`
+          );
+        }
       });
-      return { touched };
+      return {
+        touched,
+        projected,
+        ...projectionFailed.length > 0 ? { projectionFailed } : {},
+        stamped,
+        foldedState: store.foldedState()
+      };
     }
     case "applyChunk":
       return {
@@ -5427,6 +6594,23 @@ function run(store, sql, command) {
       forgetQueryProjection(sql, store.documentId());
       return void 0;
     }
+    case "projectRows": {
+      const docId = store.documentId();
+      try {
+        return sql.transaction(
+          () => projectFormat2Rows(
+            sql,
+            command.spec,
+            docId,
+            command.ids,
+            (id) => store.read(command.model, id)
+          )
+        );
+      } catch (error) {
+        forgetQueryProjection(sql, docId, command.model);
+        throw error;
+      }
+    }
     case "purge": {
       const docId = store.documentId();
       return sql.transaction(() => {
@@ -5439,7 +6623,11 @@ function run(store, sql, command) {
           purged: true,
           ...report.nothingStored ? { nothingStored: true } : {},
           pendingOps: report.pendingOps,
-          remainingDocuments: report.remainingDocuments
+          remainingDocuments: report.remainingDocuments,
+          // Which pre-amendment pools this store still holds adoption evidence
+          // about: what keeps a last-document eviction from removing the
+          // directory that ledger lives in (finding 3760-REVIEW-02).
+          ...report.legacyPools?.length ? { legacyPools: report.legacyPools } : {}
         };
       });
     }
@@ -5466,8 +6654,11 @@ function run(store, sql, command) {
 var init_format2StoreDispatcher = __esm({
   "src/models/format2StoreDispatcher.ts"() {
     "use strict";
+    init_logger();
     init_format2RecordStore();
     init_format2QueryProjection();
+    init_format2RowProjector();
+    init_format2FoldedState();
   }
 });
 
@@ -5644,32 +6835,13 @@ var init_format2StoreHost = __esm({
         this.log.length = 0;
       }
       /**
-       * The only holder, always: an in-process host owns its executor. So a
-       * `wipeIfLast` always runs, through the hook the binding injected — which is
-       * the same engine delete and mark withdrawal the main thread used to do
-       * before the disconnect gate moved (#3431). Node's observable result is
-       * unchanged.
+       * The only holder, always: an in-process host owns its executor. A close
+       * removes nothing (#3756) — the query tables and projection marks stay in
+       * the engine's database for the next open, as on a worker.
        */
-      async close(options = {}) {
-        let wiped = false;
-        if (options.wipeIfLast && this.wipe) {
-          await this.wipe(options.wipeIfLast.models);
-          wiped = true;
-        }
+      async close() {
         this.closed = true;
-        return { wiped };
-      }
-      /**
-       * Remove this document from the named models' query tables on close.
-       *
-       * Injected because the query tables belong to the ENGINE, which an
-       * in-process store host has no handle on; over a worker host the same
-       * instruction travels as the worker's own `release` command.
-       */
-      onWipe(wipe) {
-        this.wipe = wipe;
       }
-      wipe = null;
       async holders() {
         return 1;
       }
@@ -5752,7 +6924,7 @@ var init_format2StoreHost = __esm({
         return null;
       }
       async close() {
-        if (this.disposed) return { wiped: false };
+        if (this.disposed) return;
         this.disposed = true;
         this.closed = true;
         this.stopListening();
@@ -5765,7 +6937,6 @@ var init_format2StoreHost = __esm({
           this.port.close?.();
         } catch {
         }
-        return { wiped: false };
       }
     };
   }
@@ -7100,10 +8271,19 @@ var init_IncludeResolver = __esm({
        * for everything, which is every Node engine.
        */
       resolveEngine;
-      constructor(db, registry, resolveEngine) {
+      /**
+       * The documents a related row may come from (#3756): `_meta_doc_id IN
+       * (...)` on every related-model statement, `1 = 0` for an empty list. A
+       * closed large document keeps its query rows for its next open, so without
+       * this an include would answer rows the parent statement already excludes.
+       * Absent, related rows are not restricted by document.
+       */
+      documents;
+      constructor(db, registry, resolveEngine, documents) {
         this.db = db;
         this.registry = registry ?? ModelRegistry.getInstance();
         this.resolveEngine = resolveEngine ?? (() => this.db);
+        this.documents = documents ? [...documents] : null;
       }
       /** The engine `modelName`'s rows are read from. */
       async engineFor(modelName) {
@@ -7321,6 +8501,11 @@ var init_IncludeResolver = __esm({
             filterParams = translated.params;
           }
         }
+        const documentCondition = this.documents === null ? null : translator.documentCondition([...this.documents]);
+        if (documentCondition) {
+          filterClause += ` AND ${documentCondition.sql}`;
+          filterParams = [...filterParams, ...documentCondition.params];
+        }
         const reservedParams = filterParams.length + 1;
         const chunkSize = Math.max(1, 100 - reservedParams);
         const db = await this.engineFor(spec.model);
@@ -7367,7 +8552,8 @@ var init_IncludeResolver = __esm({
           const translated = translator.translateFilter(extraFilter);
           filterParamCount = translated.params.length;
         }
-        const chunkSize = Math.max(1, 100 - filterParamCount);
+        const documentParamCount = this.documents?.length ?? 0;
+        const chunkSize = Math.max(1, 100 - filterParamCount - documentParamCount);
         const db = await this.engineFor(model);
         const allResults = [];
         for (let i = 0; i < values.length; i += chunkSize) {
@@ -7379,6 +8565,7 @@ var init_IncludeResolver = __esm({
           const options = {};
           if (extraOptions?.sort) options.sort = extraOptions.sort;
           if (extraOptions?.projection) options.projection = extraOptions.projection;
+          if (this.documents !== null) options.documents = [...this.documents];
           const { sql, params } = translator.translateFind(filter, options);
           const rows = await db.query(sql, params);
           allResults.push(...rows);
@@ -7499,11 +8686,11 @@ function reindexFailure(modelConstructor, modelName, recordId, docId, error) {
   failure.cause = error;
   return failure;
 }
-var Y7, import_ulid2, FORMAT2_ROW_PAGE, UniqueConstraintViolationError, RecordNotFoundError, SCHEMA_ACCESSORS_KEY, BaseModel2;
+var Y8, import_ulid2, FORMAT2_ROW_PAGE, UniqueConstraintViolationError, RecordNotFoundError, SCHEMA_ACCESSORS_KEY, BaseModel2;
 var init_BaseModel = __esm({
   "src/models/BaseModel.ts"() {
     "use strict";
-    Y7 = __toESM(require("yjs"), 1);
+    Y8 = __toESM(require("yjs"), 1);
     import_ulid2 = require("ulid");
     init_StringSet();
     init_documentTypes();
@@ -8415,7 +9602,7 @@ var init_BaseModel = __esm({
        * record's key from the map — cannot drift apart (#3252).
        */
       static _stringSetMembersFromStored(stored) {
-        if (stored instanceof Y7.Map) {
+        if (stored instanceof Y8.Map) {
           return Array.from(stored.keys());
         }
         if (Array.isArray(stored)) {
@@ -8583,7 +9770,7 @@ var init_BaseModel = __esm({
         }
         const extractStringSetValues = (value) => {
           if (!value) return [];
-          if (value instanceof Y7.Map) {
+          if (value instanceof Y8.Map) {
             return Array.from(value.entries()).filter(([, isMember]) => Boolean(isMember)).map(([key]) => key);
           }
           if (Array.isArray(value)) {
@@ -8600,7 +9787,7 @@ var init_BaseModel = __esm({
             if (!recordId) continue;
             let itemData;
             const stringSetValuesByField = {};
-            if (recordData instanceof Y7.Map) {
+            if (recordData instanceof Y8.Map) {
               itemData = {};
               const unknownFields = [];
               for (const [fieldKey, value] of recordData.entries()) {
@@ -8719,7 +9906,7 @@ var init_BaseModel = __esm({
         const buildUniqueKey2 = (recordData, fields) => buildUniqueKey(recordData, fields);
         const extractItemData = (key, recordData) => {
           let itemData;
-          if (recordData instanceof Y7.Map) {
+          if (recordData instanceof Y8.Map) {
             itemData = {};
             const unknownFields = [];
             for (const [fieldKey, value] of recordData.entries()) {
@@ -8851,7 +10038,7 @@ var init_BaseModel = __esm({
               if (!recordData || !key) continue;
               const itemData = extractItemData(key, recordData);
               if (!itemData) continue;
-              if (change.action === "add" && recordData instanceof Y7.Map) {
+              if (change.action === "add" && recordData instanceof Y8.Map) {
                 Logger.verbose(
                   `[${this.name}] Setting up observer on newly added nested YMap for record ${key} in document ${docId}`
                 );
@@ -9013,7 +10200,7 @@ var init_BaseModel = __esm({
           `[${this.name}] Setting up observers on existing nested YMaps for ${modelName}/${docId}...`
         );
         for (const [recordId, recordData] of documentYMap.entries()) {
-          if (recordData instanceof Y7.Map) {
+          if (recordData instanceof Y8.Map) {
             Logger.verbose(
               `[${this.name}] Setting up observer on existing nested YMap for record ${recordId} in document ${docId}`
             );
@@ -9077,7 +10264,7 @@ var init_BaseModel = __esm({
           ctx.notifyListeners(modelName);
           return;
         }
-        const entries = recordData instanceof Y7.Map ? Array.from(recordData.entries()) : Object.entries(recordData);
+        const entries = recordData instanceof Y8.Map ? Array.from(recordData.entries()) : Object.entries(recordData);
         const rowData = {};
         for (const [fieldKey, value] of entries) {
           const fieldOptions = schema.fields?.get(fieldKey);
@@ -9426,7 +10613,7 @@ var init_BaseModel = __esm({
         const ownerId = constraintMap.get(uniqueKey);
         if (!ownerId) return null;
         const recordYMap = modelYMap?.get(ownerId);
-        if (!(recordYMap instanceof Y7.Map)) return null;
+        if (!(recordYMap instanceof Y8.Map)) return null;
         const fields = this.getSchema?.()?.fields;
         const heldKey = this._buildKeyFromValues(
           constraint.fields,
@@ -9600,16 +10787,18 @@ var init_BaseModel = __esm({
             yDoc,
             targetYMap
           );
-          await this.saveFormat2({
-            store: target.store,
-            schema,
-            modelName,
-            docId: targetDocId,
-            permissionHint,
-            yDoc: target.yDoc,
-            modelYMap: target.modelYMap,
-            upsertOnField: options?.upsertOn ?? null
-          });
+          await target.store.trackLocalWrite(
+            () => this.saveFormat2({
+              store: target.store,
+              schema,
+              modelName,
+              docId: targetDocId,
+              permissionHint,
+              yDoc: target.yDoc,
+              modelYMap: target.modelYMap,
+              upsertOnField: options?.upsertOn ?? null
+            })
+          );
           this.clearLocalChanges();
           return;
         }
@@ -9708,7 +10897,7 @@ var init_BaseModel = __esm({
           Logger.debug(`[${modelName}.save] isUpdate: ${isUpdate}`);
           Logger.debug(`[${modelName}.save] recordYMap exists: ${!!recordYMap}`);
           if (!recordYMap) {
-            recordYMap = new Y7.Map();
+            recordYMap = new Y8.Map();
             Logger.verbose(
               `[${modelName}] Creating new nested YMap for record ${this.id} in document ${targetDocId || "legacy"}`
             );
@@ -10174,6 +11363,7 @@ var init_BaseModel = __esm({
             stringSetChanges,
             stringSetFieldNames
           });
+          this._format2Row = store.entryFor(modelName, this.id);
           await ops.commitLocalWrite(modelName, mutation, {
             model: modelName,
             recordId: this.id,
@@ -10219,11 +11409,34 @@ var init_BaseModel = __esm({
             applyOverlayMutation(modelYMap, mutation);
           }, FORMAT2_LOCAL_WRITE_ORIGIN);
           syncModelMeta(yDoc, modelName, schema);
+          store.noteLocalPublish(yDoc);
           return true;
         });
         void planned;
         this._format2Row = store.entryFor(modelName, this.id);
-        await modelConstructor.projectFormat2Record(docId, this.id);
+        await modelConstructor.projectFormat2LocalWrite(store, docId, modelName, this.id);
+      }
+      /**
+       * Project the row a local write just committed, withdrawing the model's
+       * projection mark if that fails (#3756). The mark outlives a close, so a
+       * projection that failed under it would leave `query()` disagreeing with
+       * `find()` until something rebuilt the model; dropping the mark makes the
+       * next bind that something. The failure still reaches the caller.
+       */
+      static async projectFormat2LocalWrite(store, docId, modelName, recordId) {
+        try {
+          await this.projectFormat2Record(docId, recordId);
+        } catch (error) {
+          try {
+            await store.forgetQueryProjection(modelName);
+          } catch (markError) {
+            Logger.error(
+              `[format2] ${docId}: failed to withdraw the query-projection mark of ${modelName} after a local write's projection failed:`,
+              markError
+            );
+          }
+          throw error;
+        }
       }
       /**
        * Mirror one merged-view row into the engine's per-model query tables, so
@@ -10241,67 +11454,60 @@ var init_BaseModel = __esm({
        * updates that arrive from the sync layer.
        */
       static async projectFormat2Record(docId, recordId, options = {}) {
+        const modelConstructor = this;
+        const projected = await modelConstructor.projectFormat2Ids(docId, [recordId]);
+        if (projected && options.notify !== false) modelConstructor.notifyListeners();
+      }
+      /**
+       * What this model's query tables look like, as data a store host can
+       * project with. The one place the table, junction and column names
+       * are decided; `null` when there is nothing to project into — no engine
+       * behind this ORM instance, or no schema.
+       */
+      static format2ProjectionSpec(docId) {
         const modelConstructor = this;
         const schema = modelConstructor.getSchema?.();
         const modelName = schema?.options?.name;
-        const store = modelConstructor.getFormat2StoreAsync(docId);
-        if (!modelConstructor.dbInstance || !modelName || !store) return;
-        if (!store.isHydrated(modelName)) return;
-        const db = await modelConstructor.queryEngineFor([docId], modelName);
-        const permissionHint = modelConstructor.connectedDocuments.get(docId)?.permissionHint ?? "read-write";
-        const stringSetFieldNames = /* @__PURE__ */ new Set();
+        if (!modelConstructor.dbInstance || !modelName) return null;
+        const columns = [];
+        const stringSets = [];
         for (const [fieldKey, fieldOptions] of schema.fields.entries()) {
           if (fieldOptions?.type === "stringset") {
-            stringSetFieldNames.add(fieldKey);
-          }
-        }
-        const notify = options.notify !== false;
-        const row = await store.read(modelName, recordId);
-        if (!row) {
-          await db.delete(modelName, recordId);
-          if (notify) modelConstructor.notifyListeners();
-          return;
-        }
-        const scalars = {};
-        for (const [key, value] of Object.entries(row)) {
-          if (stringSetFieldNames.has(key)) continue;
-          if (value === void 0) continue;
-          if (!schema.fields.has(key) && key !== "id" && key !== "type") continue;
-          scalars[key] = value;
-        }
-        await db.insert(modelName, {
-          ...scalars,
-          id: recordId,
-          type: modelName,
-          _meta_doc_id: docId,
-          _meta_permission_hint: permissionHint
-        });
-        for (const field of stringSetFieldNames) {
-          const members = (Array.isArray(row[field]) ? row[field] : []).map(String);
-          let current = [];
-          try {
-            const junction = quoteIdentifier(
-              modelConstructor.getDatabaseJunctionTableName(modelName, field)
-            );
-            const foreignKey = quoteIdentifier(`${modelName.toLowerCase()}_id`);
-            const rows = await db.query(
-              `SELECT value FROM ${junction} WHERE ${foreignKey} = ?`,
-              [recordId]
-            );
-            current = rows.map((entry) => String(entry.value));
-          } catch {
-            current = [];
-          }
-          const removals = current.filter((member) => !members.includes(member));
-          if (removals.length > 0) {
-            await db.removeStringSetValues(modelName, field, recordId, removals);
-          }
-          const additions = members.filter((member) => !current.includes(member));
-          if (additions.length > 0) {
-            await db.insertStringSetValues(modelName, field, recordId, additions);
+            stringSets.push({
+              field: fieldKey,
+              table: modelConstructor.getDatabaseJunctionTableName(modelName, fieldKey)
+            });
+          } else {
+            columns.push(fieldKey);
           }
         }
-        if (notify) modelConstructor.notifyListeners();
+        return {
+          model: modelName,
+          table: modelConstructor.getDatabaseTableName(modelName),
+          foreignKey: `${modelName.toLowerCase()}_id`,
+          columns,
+          stringSets,
+          permissionHint: modelConstructor.connectedDocuments.get(docId)?.permissionHint ?? "read-write"
+        };
+      }
+      /**
+       * Tell this model's listeners that folded overlay changes reached its rows
+       * and its query tables. Called once per model per fold batch by the
+       * document binding; the projection itself ran on the store's host.
+       * @internal
+       */
+      static notifyFormat2Folded() {
+        this.notifyListeners();
+      }
+      /** Project `recordIds` through the store's host; whether anything was sent. */
+      static async projectFormat2Ids(docId, recordIds) {
+        const modelConstructor = this;
+        const store = modelConstructor.getFormat2StoreAsync(docId);
+        const spec = modelConstructor.format2ProjectionSpec(docId);
+        if (!store || !spec) return false;
+        if (!store.isHydrated(spec.model)) return false;
+        await store.projectRows(spec.model, recordIds, spec);
+        return true;
       }
       /**
        * Remove a PAGE of records from the query tables, without consulting the
@@ -10333,12 +11539,9 @@ var init_BaseModel = __esm({
       static async projectFormat2Records(docId, recordIds) {
         if (recordIds.length === 0) return;
         const modelConstructor = this;
-        for (const recordId of recordIds) {
-          await modelConstructor.projectFormat2Record(docId, recordId, {
-            notify: false
-          });
+        if (await modelConstructor.projectFormat2Ids(docId, recordIds)) {
+          modelConstructor.notifyListeners();
         }
-        modelConstructor.notifyListeners();
       }
       async delete() {
         const modelConstructor = this.constructor;
@@ -10379,14 +11582,16 @@ var init_BaseModel = __esm({
             sourceYDoc,
             modelConstructor.documentYMaps.get(`${docId}_${modelName}`) ?? sourceYDoc.getMap(modelName)
           );
-          await this.deleteFormat2({
-            store: target.store,
-            schema,
-            modelName,
-            docId,
-            yDoc: target.yDoc,
-            modelYMap: target.modelYMap
-          });
+          await target.store.trackLocalWrite(
+            () => this.deleteFormat2({
+              store: target.store,
+              schema,
+              modelName,
+              docId,
+              yDoc: target.yDoc,
+              modelYMap: target.modelYMap
+            })
+          );
           return;
         }
         if (!sourceYMap) {
@@ -10483,9 +11688,15 @@ var init_BaseModel = __esm({
             }
             applyOverlayMutation(modelYMap, mutation);
           }, FORMAT2_LOCAL_WRITE_ORIGIN);
+          store.noteLocalPublish(yDoc);
           return existing;
         });
-        await modelConstructor.projectFormat2Record(ctx.docId, this.id);
+        await modelConstructor.projectFormat2LocalWrite(
+          store,
+          ctx.docId,
+          modelName,
+          this.id
+        );
       }
       // Get current state combining local changes with Yjs data
       getCurrentJSState() {
@@ -10665,13 +11876,16 @@ var init_BaseModel = __esm({
             limit: requestedLimit + 1
           };
         }
+        const scope = this.documentsInScope(
+          options?.documents
+        );
+        if (options?.documents == null) {
+          translatorOptions = { ...translatorOptions || {}, documents: scope };
+        }
         const translator = new DocumentQueryTranslator(modelName, schema.fields);
         const translatedQuery = translator.translateFind(filter, translatorOptions);
         Logger.verbose(`[${modelName}] Translated SQL:`, translatedQuery.sql);
         Logger.verbose(`[${modelName}] SQL params:`, translatedQuery.params);
-        const scope = this.documentsInScope(
-          options?.documents
-        );
         const queryEngine = await this.queryEngineFor(
           scope,
           modelName
@@ -10691,7 +11905,8 @@ var init_BaseModel = __esm({
           const resolver = new IncludeResolver2(
             queryEngine,
             ormContext.modelRegistry ?? void 0,
-            (relatedModel) => this.queryEngineFor(scope, relatedModel)
+            (relatedModel) => this.queryEngineFor(scope, relatedModel),
+            this.documentsInScope()
           );
           await resolver.resolve(results, options.include, 0, modelName);
         }
@@ -10842,7 +12057,9 @@ var init_BaseModel = __esm({
           );
         }
         this.assertFormat2Readable(
-          this.format2DocumentsInScope()
+          this.format2DocumentsInScope(
+            options.documents
+          )
         );
         const schema = this.getSchema?.();
         if (!schema || !schema.options?.name) {
@@ -10879,10 +12096,16 @@ var init_BaseModel = __esm({
             }
           }
         }
+        const aggregateScope = this.documentsInScope(options.documents);
+        const connected = new Set(
+          this.documentsInScope()
+        );
+        const sqlScope = options.documents == null ? aggregateScope : (typeof options.documents === "string" ? [options.documents] : options.documents).filter((docId) => connected.has(docId));
         const aggregationQuery = this.buildAggregationQuery(
           options,
           schema,
-          modelName
+          modelName,
+          sqlScope
         );
         Logger.verbose(
           `[${modelName}] Generated aggregation SQL:`,
@@ -10893,7 +12116,7 @@ var init_BaseModel = __esm({
           aggregationQuery.params
         );
         const aggregateEngine = await this.queryEngineFor(
-          this.documentsInScope(),
+          aggregateScope,
           modelName
         );
         const results = await aggregateEngine.query(
@@ -10929,7 +12152,7 @@ var init_BaseModel = __esm({
       /**
        * Build SQL query for structured aggregation
        */
-      static buildAggregationQuery(options, schema, modelName) {
+      static buildAggregationQuery(options, schema, modelName, documents) {
         const translator = new DocumentQueryTranslator(modelName, schema.fields);
         const regularGroupBy = [];
         const stringSetFacets = [];
@@ -10951,7 +12174,8 @@ var init_BaseModel = __esm({
             stringSetFacets,
             options,
             translator,
-            modelName
+            modelName,
+            documents
           );
         } else if (stringSetMemberships.length > 0 || regularGroupBy.length > 0) {
           return this.buildRegularAggregationQuery(
@@ -10959,12 +12183,26 @@ var init_BaseModel = __esm({
             stringSetMemberships,
             options,
             translator,
-            modelName
+            modelName,
+            documents
           );
         } else {
           throw new Error("Invalid aggregation configuration");
         }
       }
+      /**
+       * Append the document condition to an aggregation's WHERE (#3756): `AND`
+       * after a filter, `WHERE` without one, nothing when `documents` is absent.
+       */
+      static withDocumentCondition(sql, params, translator, documents) {
+        const condition = translator.documentCondition(documents);
+        if (!condition) return { sql, params };
+        const joiner = /\sWHERE\s/i.test(sql) ? "AND" : "WHERE";
+        return {
+          sql: `${sql} ${joiner} ${condition.sql}`,
+          params: [...params, ...condition.params]
+        };
+      }
       /**
        * Get the proper database table name (should match database engine naming)
        */
@@ -10983,7 +12221,7 @@ var init_BaseModel = __esm({
       /**
        * Build query for StringSet facet counts
        */
-      static buildStringSetFacetQuery(stringSetFields, options, translator, modelName) {
+      static buildStringSetFacetQuery(stringSetFields, options, translator, modelName, documents) {
         if (stringSetFields.length > 1) {
           throw new Error(
             "Multiple StringSet facet fields not supported in single aggregation"
@@ -11021,6 +12259,12 @@ var init_BaseModel = __esm({
             params = whereClause.params;
           }
         }
+        ({ sql, params } = this.withDocumentCondition(
+          sql,
+          params,
+          translator,
+          documents
+        ));
         sql += ` GROUP BY ${quotedJunctionTable}.${quotedValueColumn}`;
         if (options.sort) {
           const sortField = options.sort.field === "count" ? "COUNT(*)" : quoteIdentifier(options.sort.field);
@@ -11035,7 +12279,7 @@ var init_BaseModel = __esm({
       /**
        * Build query for regular field aggregation
        */
-      static buildRegularAggregationQuery(regularGroupBy, stringSetMemberships, options, translator, modelName) {
+      static buildRegularAggregationQuery(regularGroupBy, stringSetMemberships, options, translator, modelName, documents) {
         const mainTable = this.getDatabaseTableName(modelName);
         const quotedMainTable = quoteIdentifier(mainTable);
         const recordIdColumn = `${modelName.toLowerCase()}_id`;
@@ -11141,6 +12385,12 @@ var init_BaseModel = __esm({
             params = params.concat(whereClause.params);
           }
         }
+        ({ sql, params } = this.withDocumentCondition(
+          sql,
+          params,
+          translator,
+          documents
+        ));
         const groupByParts = [];
         for (const field of regularGroupBy) {
           groupByParts.push(`${quotedMainTable}.${quoteIdentifier(field)}`);
@@ -11287,12 +12537,18 @@ var init_BaseModel = __esm({
         }
         const modelName = schema.options.name;
         Logger.verbose(`[${modelName}] Executing count:`, { filter, options });
+        const scope = this.documentsInScope(
+          options?.documents
+        );
         const translator = new DocumentQueryTranslator(modelName, schema.fields);
-        const translatedQuery = translator.translateCount(filter, options);
+        const translatedQuery = translator.translateCount(
+          filter,
+          options?.documents == null ? { documents: scope } : options
+        );
         Logger.verbose(`[${modelName}] Translated count SQL:`, translatedQuery.sql);
         Logger.verbose(`[${modelName}] Count SQL params:`, translatedQuery.params);
         const countEngine = await this.queryEngineFor(
-          this.documentsInScope(options?.documents),
+          scope,
           modelName
         );
         const results = await countEngine.query(
@@ -11366,7 +12622,7 @@ var init_BaseModel = __esm({
                 );
               }
               for (const [recordId, recordYMap] of documentYMap.entries()) {
-                if (recordYMap instanceof Y7.Map) {
+                if (recordYMap instanceof Y8.Map) {
                   const instance = new this({ id: recordId });
                   instance._metaDocId = docId;
                   const connectedDoc = modelConstructor.connectedDocuments.get(docId);
@@ -11552,7 +12808,7 @@ var init_BaseModel = __esm({
         if (!recordYMap) {
           return null;
         }
-        if (recordYMap instanceof Y7.Map) {
+        if (recordYMap instanceof Y8.Map) {
           const instance = new modelConstructor({
             id: recordId
           });
@@ -11828,7 +13084,7 @@ var init_BaseModel = __esm({
         for (const [fieldKey, fieldOptions] of schema.fields) {
           if (fieldOptions?.type !== "stringset") continue;
           const value = recordYMap.get(fieldKey);
-          if (value instanceof Y7.Map) {
+          if (value instanceof Y8.Map) {
             this.observeStringSetMapOnce(value, docId);
           }
         }
@@ -12050,6 +13306,7 @@ __export(browser_exports, {
   FORMAT2_MANIFEST_VERSION: () => FORMAT2_MANIFEST_VERSION,
   FORMAT2_MIN_MANIFEST_VERSION: () => FORMAT2_MIN_MANIFEST_VERSION,
   FORMAT2_STORE_CHANNEL: () => FORMAT2_STORE_CHANNEL,
+  FORMAT2_STORE_PROTOCOL: () => FORMAT2_STORE_PROTOCOL,
   Format2CompositeFieldError: () => Format2CompositeFieldError,
   Format2FoldBrokenError: () => Format2FoldBrokenError,
   Format2ModelNotHydratedError: () => Format2ModelNotHydratedError,
@@ -12058,6 +13315,7 @@ __export(browser_exports, {
   Format2RecordStoreAsync: () => Format2RecordStoreAsync,
   Format2RowCache: () => Format2RowCache,
   Format2StorageCapabilityError: () => Format2StorageCapabilityError,
+  Format2StoreOutdatedError: () => Format2StoreOutdatedError,
   INGEST_CHUNK_LIMITS: () => INGEST_CHUNK_LIMITS,
   InProcessFormat2StoreHost: () => InProcessFormat2StoreHost,
   LogLevel: () => LogLevel,
@@ -12093,12 +13351,14 @@ __export(browser_exports, {
   configuredOfflineWindowDays: () => configuredOfflineWindowDays,
   createModelClass: () => createModelClass,
   decideDeferredReplay: () => decideDeferredReplay,
+  decodeFoldedState: () => decodeFoldedState,
   decodeFormat2StoreError: () => decodeFormat2StoreError,
   defineModelSchema: () => defineModelSchema,
   detectEnvironment: () => detectEnvironment,
   discoverModelNames: () => discoverModelNames,
   discoverSchema: () => discoverSchema,
   dispatchFormat2StoreCommand: () => dispatchFormat2StoreCommand,
+  encodeFoldedState: () => encodeFoldedState,
   encodeFormat2StoreError: () => encodeFormat2StoreError,
   encodeOverlayMutation: () => encodeOverlayMutation,
   estimateMaterializedBytes: () => estimateMaterializedBytes,
@@ -12127,10 +13387,12 @@ __export(browser_exports, {
   loadFormat2Snapshot: () => loadFormat2Snapshot,
   loadSchemaFromTomlString: () => loadSchemaFromTomlString,
   materializeOverlayRecord: () => materializeOverlayRecord,
+  mergeFoldedStates: () => mergeFoldedStates,
   observeFormat2Overlay: () => observeFormat2Overlay,
   offlineReplayRecordKey: () => offlineReplayRecordKey,
   offlineWindowStatus: () => offlineWindowStatus,
   overlayFieldKey: () => overlayFieldKey,
+  overlayKeysSince: () => overlayKeysSince,
   overlayMarkerKey: () => overlayMarkerKey,
   overlayMemberKey: () => overlayMemberKey,
   parseOverlayKey: () => parseOverlayKey,
@@ -12144,6 +13406,7 @@ __export(browser_exports, {
   readFormat2StoreMarks: () => readFormat2StoreMarks,
   readOverlayRecord: () => readOverlayRecord,
   readSnapshotChunk: () => readSnapshotChunk,
+  readStateVector: () => readStateVector,
   registerFunctionDefault: () => registerFunctionDefault,
   resetJsBao: () => resetJsBao,
   resolveChunkOrdinal: () => resolveChunkOrdinal,
@@ -13015,7 +14278,7 @@ function planSnapshotHydration(input) {
 var Format2QueryScopeError = class _Format2QueryScopeError extends Error {
   constructor(model, documents) {
     super(
-      `A query on '${model}' spans documents held in different local databases (${documents.join(", ")}): scope it with \`documents\` to one side. Under the opfs engine a large document's query tables live in its own worker, apart from ordinary documents.`
+      `A query on '${model}' spans documents held in different local stores (${documents.join(", ")}): an ordinary document's rows and a large document's cannot be read in one statement. Scope it with \`documents\` to one kind.`
     );
     this.model = model;
     this.documents = documents;
@@ -13037,6 +14300,7 @@ init_format2StoreHost();
 // src/engines/opfs/format2WorkerProtocol.ts
 init_format2StoreProtocol();
 var FORMAT2_WORKER_CHANNEL = "js-bao.format2.worker";
+var FORMAT2_STORE_PROTOCOL = 2;
 var FORMAT2_ENGINE_CHANNEL = "js-bao.format2.engine";
 function isFormat2WorkerResponse(data) {
   return typeof data === "object" && data !== null && (data.channel === FORMAT2_WORKER_CHANNEL || data.channel === FORMAT2_ENGINE_CHANNEL) && typeof data.id === "number" && typeof data.ok === "boolean";
@@ -13050,6 +14314,23 @@ var Format2WorkerOpenError = class _Format2WorkerOpenError extends Error {
   }
   code = "FORMAT2_WORKER_OPEN_FAILED";
 };
+function servedStoreProtocol(reply) {
+  const version = reply?.storeProtocol;
+  return typeof version === "number" && Number.isFinite(version) ? version : 1;
+}
+var Format2StoreOutdatedError = class _Format2StoreOutdatedError extends Error {
+  constructor(served, required) {
+    super(
+      "the tab leading this store runs an older version of the app; reload it or close it"
+    );
+    this.served = served;
+    this.required = required;
+    this.name = "Format2StoreOutdatedError";
+    Object.setPrototypeOf(this, _Format2StoreOutdatedError.prototype);
+  }
+  /** Stable across builds, so an app can branch on it rather than on text. */
+  code = "FORMAT2_STORE_OUTDATED";
+};
 function decodeFormat2WorkerError(payload) {
   if (payload.code === "FORMAT2_WORKER_OPEN_FAILED") {
     const rebuilt = new Format2WorkerOpenError(
@@ -13066,6 +14347,7 @@ function decodeFormat2WorkerError(payload) {
 var FORMAT2_WORKER_MAX_SPAWNS = 12;
 var FORMAT2_WORKER_BACKOFF_MS = 250;
 var FORMAT2_WORKER_CLOSE_BOUND_MS = 2e3;
+var FORMAT2_LEGACY_OPEN_BOUND_MS = 2e3;
 var defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 var WorkerLink = class {
   constructor(worker, label) {
@@ -13180,13 +14462,13 @@ async function openFormat2Worker(options) {
   const failures = [];
   const abandoned = () => new Format2WorkerOpenError(
     "worker-unavailable",
-    `the format-2 store for '${request.docId}' was not opened: the engine was destroyed`
+    `the format-2 store '${request.poolName}' was not opened: the engine was destroyed`
   );
   for (let attempt = 1; attempt <= maxSpawns; attempt++) {
     if (signal?.aborted) throw abandoned();
     let link;
     try {
-      link = new WorkerLink(options.spawn(), request.docId);
+      link = new WorkerLink(options.spawn(), request.poolName);
     } catch (error) {
       throw new Format2WorkerOpenError(
         "worker-unavailable",
@@ -13215,7 +14497,7 @@ async function openFormat2Worker(options) {
   }
   throw new Format2WorkerOpenError(
     "install-failed",
-    `the format-2 store for '${request.docId}' did not open after ${maxSpawns} worker spawn(s); last failure: ${failures[failures.length - 1] ?? "unknown"}`
+    `the format-2 store '${request.poolName}' did not open after ${maxSpawns} worker spawn(s); last failure: ${failures[failures.length - 1] ?? "unknown"}`
   );
 }
 function attachFormat2Worker(port, label) {
@@ -13242,27 +14524,36 @@ function makeHandle(link, reply, spawns, failures) {
     get died() {
       return link.died;
     },
-    storedEpoch: () => control({ kind: "storedEpoch" }),
+    storedEpoch: (docId) => control({ kind: "storedEpoch", docId }),
     engine: (command) => link.send(FORMAT2_ENGINE_CHANNEL, command),
     send: (channel, command) => link.send(channel, command),
     async serveStore(docId, clientId) {
       const channel = new MessageChannel();
-      await control(
+      const served = await control(
         { kind: "serve", port: channel.port2, docId, ...clientId ? { clientId } : {} },
         [channel.port2]
       );
+      const version = servedStoreProtocol(served);
+      if (version < FORMAT2_STORE_PROTOCOL) {
+        try {
+          channel.port1.close();
+        } catch {
+        }
+        throw new Format2StoreOutdatedError(version, FORMAT2_STORE_PROTOCOL);
+      }
       const host = new RemoteFormat2StoreHost(channel.port1, docId);
       link.trackHost(host);
       return host;
     },
-    release: (docId, clientId, wipeIfLast) => control({
+    release: (docId, clientId) => control({
       kind: "release",
       docId,
-      ...clientId ? { clientId } : {},
-      ...wipeIfLast ? { wipeIfLast } : {}
+      ...clientId ? { clientId } : {}
     }),
     holders: (docId) => control({ kind: "holders", docId }),
-    attach: (attachedPort) => control({ kind: "attach", port: attachedPort }, [attachedPort]),
+    attach: async (attachedPort) => {
+      await control({ kind: "attach", port: attachedPort }, [attachedPort]);
+    },
     async close(boundMs = FORMAT2_WORKER_CLOSE_BOUND_MS) {
       if (link.died) {
         link.terminate();
@@ -13503,8 +14794,44 @@ var Format2NamespaceAttachment = class {
   engine(command) {
     return this.send(FORMAT2_ENGINE_CHANNEL, command);
   }
-  storedEpoch() {
-    return this.send(FORMAT2_WORKER_CHANNEL, { kind: "storedEpoch" });
+  /**
+   * The epoch `docId`'s merged view is on, before it is bound (#3760: one
+   * worker holds every document of the scope, so the command names one).
+   */
+  storedEpoch(docId) {
+    return this.send(FORMAT2_WORKER_CHANNEL, { kind: "storedEpoch", docId });
+  }
+  /** Every large document the pool's store holds (#3760). */
+  listDocuments() {
+    return this.send(FORMAT2_WORKER_CHANNEL, { kind: "listDocuments" });
+  }
+  /**
+   * What a PRE-AMENDMENT pool still owes for `docId` (#3760).
+   *
+   * Sent to a transient attachment over the LEGACY namespace, never to the
+   * scope worker: it is the old database that holds the debt.
+   */
+  exportLegacy(docId) {
+    return this.send(FORMAT2_WORKER_CHANNEL, { kind: "exportLegacy", docId });
+  }
+  /** Take that debt over, once, in one transaction (#3760). */
+  importLegacy(options) {
+    return this.send(FORMAT2_WORKER_CHANNEL, {
+      kind: "importLegacy",
+      docId: options.docId,
+      pool: options.pool,
+      legacyEpoch: options.legacyEpoch,
+      rows: options.rows
+    });
+  }
+  /** Delete exactly the imported batch from the legacy pool (#3760). */
+  dropLegacy(docId, rows, discontinuities = []) {
+    return this.send(FORMAT2_WORKER_CHANNEL, {
+      kind: "dropLegacy",
+      docId,
+      rows,
+      discontinuities
+    });
   }
   holders(docId) {
     return this.send(FORMAT2_WORKER_CHANNEL, { kind: "holders", docId });
@@ -13519,6 +14846,21 @@ var Format2NamespaceAttachment = class {
   purge(docId, force) {
     return this.send(FORMAT2_WORKER_CHANNEL, { kind: "purge", docId, force });
   }
+  /**
+   * Purge exactly `documents`, in ONE queued command (#3760).
+   *
+   * The scope-wide wipe's single act. Like `purge` it goes out on whatever
+   * this tab is attached to and touches rows rather than the pool; unlike a
+   * loop of `purge`es, no other tab's `serve` can land between two of its
+   * documents.
+   */
+  purgeAll(documents, force) {
+    return this.send(FORMAT2_WORKER_CHANNEL, {
+      kind: "purgeAll",
+      documents: [...documents],
+      force
+    });
+  }
   /**
    * Ask the worker to give up the pool, so its directory may be removed
    * (#3754).
@@ -13542,12 +14884,12 @@ var Format2NamespaceAttachment = class {
   get leads() {
     return this.attachment?.role === "leader" && (this.options.locks === null || this.leaderRelease !== null);
   }
-  release(docId, clientId, wipeIfLast) {
+  /** End one session; answers how many sessions of `docId` remain (#3756). */
+  release(docId, clientId) {
     return this.send(FORMAT2_WORKER_CHANNEL, {
       kind: "release",
       docId,
-      ...clientId ? { clientId } : {},
-      ...wipeIfLast ? { wipeIfLast } : {}
+      ...clientId ? { clientId } : {}
     });
   }
   send(channel, command) {
@@ -13989,8 +15331,17 @@ var Format2NamespaceAttachment = class {
   /** @internal — used by {@link AttachedStoreSession}. */
   async openStorePort(docId, clientId) {
     const attachment = await this.ensureAttached();
-    const host = await attachment.handle.serveStore(docId, clientId);
-    return { host, generation: attachment.generation };
+    try {
+      const host = await attachment.handle.serveStore(docId, clientId);
+      return { host, generation: attachment.generation };
+    } catch (error) {
+      if (error instanceof Format2StoreOutdatedError) {
+        Logger.warn(
+          `[OpfsEngine] ${this.options.namespace.poolName}: the worker serving this store speaks store protocol ${error.served}; this tab needs ${error.required}. ${docId} is not opened: ${error.message}.`
+        );
+      }
+      throw error;
+    }
   }
   /** @internal */
   forgetSession(session) {
@@ -14074,7 +15425,7 @@ var Format2NamespaceAttachment = class {
     if (current && !current.handle.died) {
       await withinBound(
         Promise.all(
-          leaving.map((session) => session.close({}).catch(() => void 0))
+          leaving.map((session) => session.close().catch(() => void 0))
         ).then(() => void 0),
         this.options.closeBoundMs
       );
@@ -14232,19 +15583,18 @@ var AttachedStoreSession = class {
     this.opening = opening;
     await opening;
   }
-  close(options = {}) {
-    return this.closed ??= this.closeOnce(options);
+  close() {
+    return this.closed ??= this.closeOnce();
   }
-  async closeOnce(options) {
+  async closeOnce() {
     this.attachment.forgetSession(this);
-    let wiped = false;
     try {
-      const reply = await this.attachment.release(
-        this.docId,
-        this.clientId,
-        options.wipeIfLast
-      );
-      wiped = reply.wiped;
+      const reply = await this.attachment.release(this.docId, this.clientId);
+      if (typeof reply?.remaining !== "number") {
+        Logger.info(
+          `[OpfsEngine] ${this.docId}: the worker answered release with no holder count (an older worker bundle); the session is ended.`
+        );
+      }
     } catch (error) {
       Logger.debug(
         `[OpfsEngine] ${this.docId}: release was not answered: ${error?.message ?? String(error)}`
@@ -14254,7 +15604,6 @@ var AttachedStoreSession = class {
     this.host = null;
     await host?.close().catch(() => {
     });
-    return { wiped };
   }
 };
 
@@ -14285,8 +15634,8 @@ function observeFormat2Lifecycle(target, handlers) {
 }
 
 // src/engines/opfs/storeNamespace.ts
-function format2ClientLockName(namespace, clientId) {
-  return `${namespace.lockName}:client:${encodePart(clientId)}`;
+function format2ClientLockName(namespace, docId, clientId) {
+  return `${namespace.lockName}:client:${encodePart(docId)}:${encodePart(clientId)}`;
 }
 function format2DocumentLockName(namespace, docId) {
   return `${namespace.lockName}:doc:${encodePart(docId)}`;
@@ -14294,12 +15643,13 @@ function format2DocumentLockName(namespace, docId) {
 function format2PoolDirectory(poolName) {
   return `.${poolName}`;
 }
-function format2StoreNamespacePrefix(scope = {}) {
+function format2LegacyPoolPrefix(scope = {}) {
   const parts = [scope.server ?? "", scope.app ?? "", scope.user ?? ""];
-  return parts.some((part) => part !== "") ? PREFIX + parts.map(encodePart).join("-") + "-" : PREFIX;
+  return parts.some((part) => part !== "") ? LEGACY_PREFIX + parts.map(encodePart).join("-") + "-" : LEGACY_PREFIX;
 }
 function format2DocumentIdFromPoolName(poolName, scope = {}) {
-  const prefix = format2StoreNamespacePrefix(scope);
+  const prefix = format2LegacyPoolPrefix(scope);
+  if (poolName.startsWith(SCOPE_PREFIX)) return null;
   if (!poolName.startsWith(prefix)) return null;
   const encoded = poolName.slice(prefix.length);
   if (encoded.length === 0 || encoded.includes("-")) return null;
@@ -14324,7 +15674,9 @@ function format2DocumentIdFromPoolName(poolName, scope = {}) {
     return null;
   }
 }
-var PREFIX = "js-bao-format2-";
+var LEGACY_PREFIX = "js-bao-format2-";
+var SCOPE_PREFIX = "js-bao-format2s-";
+var UNSCOPED_NAME = `${SCOPE_PREFIX}unscoped`;
 function encodePart(value) {
   let out = "";
   for (const char of value) {
@@ -14337,10 +15689,20 @@ function encodePart(value) {
   }
   return out;
 }
-function format2StoreNamespace(docId, scope = {}) {
+function format2StoreNamespace(scope = {}) {
+  const parts = [scope.server ?? "", scope.app ?? "", scope.user ?? ""];
+  const name = parts.some((part) => part !== "") ? SCOPE_PREFIX + parts.map(encodePart).join("-") : UNSCOPED_NAME;
+  return {
+    poolName: name,
+    dbFile: "/store.sqlite3",
+    lockName: name,
+    poolLockName: `${name}:pool`
+  };
+}
+function format2LegacyStoreNamespace(docId, scope = {}) {
   const parts = [scope.server ?? "", scope.app ?? "", scope.user ?? ""];
   const prefix = parts.some((part) => part !== "") ? parts.map(encodePart).join("-") + "-" : "";
-  const name = PREFIX + prefix + encodePart(docId);
+  const name = LEGACY_PREFIX + prefix + encodePart(docId);
   return {
     poolName: name,
     dbFile: "/store.sqlite3",
@@ -14490,7 +15852,7 @@ var OpfsEngine = class {
    * refusal, raised before the models are wired, with one grep-able line.
    */
   async createFormat2StoreHost(docId, options = {}) {
-    const namespace = format2StoreNamespace(docId, options.scope ?? {});
+    const namespace = format2StoreNamespace(options.scope ?? {});
     const documentHeld = await this.holdShared(
       format2DocumentLockName(namespace, docId)
     );
@@ -14500,7 +15862,7 @@ var OpfsEngine = class {
     };
     let entry;
     try {
-      entry = await this.ensureWorker(docId, options.scope);
+      entry = await this.ensureWorker(namespace);
     } catch (error) {
       releaseDocument();
       const reason = error?.message ?? String(error);
@@ -14512,56 +15874,192 @@ var OpfsEngine = class {
     const clientId = options.clientId;
     let host;
     try {
-      host = entry.attachment.serveStore(docId, clientId);
-      await host.dispatch({ kind: "storedEpoch" });
+      host = entry.attachment.serveStore(docId, clientId);
+      await host.dispatch({ kind: "storedEpoch" });
+    } catch (error) {
+      releaseDocument();
+      if (error instanceof Format2StoreOutdatedError) {
+        await host?.close().catch(() => {
+        });
+        throw error;
+      }
+      const reason = error?.message ?? String(error);
+      Logger.error(
+        `[OpfsEngine] ${docId}: the worker could not open its store: ${reason}`
+      );
+      throw new Format2StorageCapabilityError("not-persistent", 0, null, []);
+    }
+    await this.adoptLegacyPool(docId, options.scope ?? {}, entry).catch(
+      (error) => {
+        Logger.warn(
+          `[OpfsEngine] ${docId}: the pre-amendment pool could not be adopted (${error?.message ?? String(error)}); its writes stay there and the next open tries again.`
+        );
+      }
+    );
+    entry.docIds.add(docId);
+    const routing = this.docs.get(docId);
+    if (routing && routing.entry === entry) routing.sessions++;
+    else this.docs.set(docId, { entry, sessions: 1 });
+    const held = clientId ? this.holdPresence(format2ClientLockName(namespace, docId, clientId)) : null;
+    if (held) this.presence.add(held);
+    const releasePresence = () => {
+      if (held && this.presence.delete(held)) held();
+      releaseDocument();
+    };
+    const engine = this;
+    const closeOnce = async () => {
+      const routing2 = engine.docs.get(docId);
+      if (routing2 && routing2.entry === entry && --routing2.sessions <= 0) {
+        entry.docIds.delete(docId);
+        engine.docs.delete(docId);
+      }
+      releasePresence();
+      await host.close();
+    };
+    let closing = null;
+    return {
+      dispatch: (command) => host.dispatch(command),
+      directStore: () => null,
+      holders: () => entry.attachment.holders(docId),
+      clientIsLive: (other) => engine.probeLock(format2ClientLockName(namespace, docId, other)),
+      // Forwarded, not answered here: the SESSION is what knows it has been
+      // served again by a worker that never knew it, which is the moment the
+      // document's projection marks stop vouching for anything (finding
+      // 3431-R12).
+      onReattached: (handler) => host.onReattached ? host.onReattached(handler) : () => {
+      },
+      close: () => (
+        // Idempotent: a second close of one host must not give up a second
+        // session, which would unroute a document another host still holds.
+        closing ??= closeOnce()
+      )
+    };
+  }
+  /**
+   * Take over a pre-amendment per-document pool's debt for `docId` (#3760).
+   *
+   * Before the 2026-09-24 amendment a large document's unacknowledged writes
+   * lived in a pool named by document. This build names a pool by scope alone,
+   * so those writes would simply stop being found — and they were accepted from
+   * the app and never acknowledged by the server, which is the one thing the
+   * intent's 0.7.0 rule does not let go of. The ROWS are not migrated (they
+   * re-download through the ordinary cold start); the DEBT is.
+   *
+   * Runs on EVERY open, because a pre-amendment tab may still be running and
+   * writing to that pool. With nothing new to take over it costs one directory
+   * probe, one bounded spawn and two commands, and imports nothing. With no
+   * legacy directory at all it costs the probe alone.
+   *
+   * The order is import-then-drop, and never the other way round: a crash
+   * between them leaves the write in both databases, which the `_legacy_adopted`
+   * ledger makes harmless (the next open imports nothing and drops the copy),
+   * whereas dropping first would lose it outright.
+   */
+  async adoptLegacyPool(docId, scope, scopeEntry) {
+    const legacy = format2LegacyStoreNamespace(docId, scope);
+    await this.ensureRoot();
+    const root = this.opfsRoot();
+    if (!root) return;
+    const directory = format2PoolDirectory(legacy.poolName);
+    if (!await this.directoryExists(root, directory)) return;
+    let entry;
+    try {
+      entry = await this.openLegacyWorker(legacy);
+    } catch (error) {
+      Logger.warn(
+        `[OpfsEngine] ${docId}: the pre-amendment pool '${directory}' could not be opened (${error?.message ?? String(error)}); its writes stay there and the next open tries again.`
+      );
+      return;
+    }
+    try {
+      const rows = await entry.attachment.exportLegacy(docId);
+      const report = await scopeEntry.attachment.importLegacy({
+        docId,
+        pool: legacy.poolName,
+        legacyEpoch: rows.epoch,
+        rows
+      });
+      if (report.imported.length > 0) {
+        Logger.info(
+          `[OpfsEngine] ${docId}: adopted ${report.imported.length} unacknowledged write(s) from the pre-amendment pool '${directory}', made on epoch ${rows.epoch}.`
+        );
+      }
+      if (this.__failLegacyDropOnce) {
+        this.__failLegacyDropOnce = false;
+        throw new Error("the drop was interrupted");
+      }
+      if (report.settled.length > 0 || report.discontinuities.length > 0) {
+        await entry.attachment.dropLegacy(
+          docId,
+          report.settled,
+          report.discontinuities
+        );
+      }
+    } finally {
+      await this.closeLegacyWorker(legacy, entry);
+    }
+  }
+  /**
+   * A transient attachment over a legacy namespace, bounded (#3760).
+   *
+   * Deliberately NOT `ensureWorker`: this worker is not the scope's, it must
+   * not be remembered in `workers` (a leader change has nothing to hand over
+   * here), and its open budget is capped so a legacy pool another tab holds
+   * costs an open two seconds rather than the engine's whole budget.
+   */
+  async openLegacyWorker(namespace) {
+    const openTimeoutMs = Math.min(
+      this.openTimeoutMs,
+      FORMAT2_LEGACY_OPEN_BOUND_MS
+    );
+    const attachment = new Format2NamespaceAttachment({
+      namespace,
+      clientId: this.tabId,
+      openRequest: {
+        poolName: namespace.poolName,
+        dbFile: namespace.dbFile,
+        poolLockName: namespace.poolLockName,
+        openTimeoutMs,
+        ...this.wasmURL ? { wasmURL: this.wasmURL } : {}
+      },
+      spawnWorker: this.spawn,
+      connectBroker: this.connectBroker,
+      brokerHint: this.brokerHint,
+      locks: this.locks(),
+      openTimeoutMs,
+      closeBoundMs: this.internals.closeBoundMs ?? FORMAT2_WORKER_CLOSE_BOUND_MS,
+      sleep: this.internals.sleep,
+      // One spawn: a legacy pool that will not open is not worth retrying
+      // inside an open, and the next open tries again anyway.
+      maxSpawns: 1,
+      backoffMs: this.internals.backoffMs,
+      signal: this.teardown.signal
+    });
+    this.attachments.add(attachment);
+    try {
+      await attachment.ensureAttached();
     } catch (error) {
-      releaseDocument();
-      const reason = error?.message ?? String(error);
-      Logger.error(
-        `[OpfsEngine] ${docId}: the worker could not open its store: ${reason}`
-      );
-      throw new Format2StorageCapabilityError("not-persistent", 0, null, []);
+      this.attachments.delete(attachment);
+      await attachment.destroy().catch(() => {
+      });
+      throw error;
     }
-    entry.docIds.add(docId);
-    const routing = this.docs.get(docId);
-    if (routing && routing.entry === entry) routing.sessions++;
-    else this.docs.set(docId, { entry, sessions: 1 });
-    const held = clientId ? this.holdPresence(format2ClientLockName(namespace, clientId)) : null;
-    if (held) this.presence.add(held);
-    const releasePresence = () => {
-      if (held && this.presence.delete(held)) held();
-      releaseDocument();
-    };
-    const engine = this;
-    const closeOnce = async (closeOptions) => {
-      const routing2 = engine.docs.get(docId);
-      if (routing2 && routing2.entry === entry && --routing2.sessions <= 0) {
-        entry.docIds.delete(docId);
-        engine.docs.delete(docId);
-      }
-      releasePresence();
-      return host.close(closeOptions);
-    };
-    let closing = null;
     return {
-      dispatch: (command) => host.dispatch(command),
-      directStore: () => null,
-      holders: () => entry.attachment.holders(docId),
-      clientIsLive: (other) => engine.probeLock(format2ClientLockName(namespace, other)),
-      // Forwarded, not answered here: the SESSION is what knows it has been
-      // served again by a worker that never knew it, which is the moment the
-      // document's projection marks stop vouching for anything (finding
-      // 3431-R12).
-      onReattached: (handler) => host.onReattached ? host.onReattached(handler) : () => {
-      },
-      close: (closeOptions = {}) => (
-        // Idempotent: a second close of one host must not give up a second
-        // session, which would unroute a document another host still holds and
-        // let its `release` wipe the query tables as the last holder.
-        closing ??= closeOnce(closeOptions)
-      )
+      poolName: namespace.poolName,
+      attachment,
+      engine: new RemoteQueryEngine(attachment),
+      docIds: /* @__PURE__ */ new Set()
     };
   }
+  /** Pause and let go of a transient legacy worker; never remove its pool. */
+  async closeLegacyWorker(namespace, entry) {
+    this.attachments.delete(entry.attachment);
+    await entry.attachment.destroy().catch((error) => {
+      Logger.debug(
+        `[OpfsEngine] the pre-amendment pool '${namespace.poolName}' did not close cleanly: ${error?.message ?? String(error)}`
+      );
+    });
+  }
   /**
    * The epoch `docId`'s worker-side store follows, asked before the document
    * is bound. `null` only when the worker cannot be reached; a fresh store
@@ -14569,12 +16067,25 @@ var OpfsEngine = class {
    */
   async format2StoredEpoch(docId, scope) {
     try {
-      const entry = await this.ensureWorker(docId, scope);
-      return await entry.attachment.storedEpoch();
+      const entry = await this.ensureWorker(format2StoreNamespace(scope ?? {}));
+      return await entry.attachment.storedEpoch(docId);
     } catch {
       return null;
     }
   }
+  /**
+   * Every large document this scope's store holds, asked of its worker
+   * (#3760).
+   *
+   * The wipe's first question — a scope store is one pool holding many
+   * documents, so "what is in it" is no longer readable off the OPFS root's
+   * directory names — and the only window onto a shared store's contents from
+   * outside it.
+   */
+  async format2ListDocuments(scope) {
+    const entry = await this.ensureWorker(format2StoreNamespace(scope ?? {}));
+    return entry.attachment.listDocuments();
+  }
   // ── Removing a document's store, and the pool holding it (#3754) ──
   /**
    * Remove `docId`'s local data, and its pool's directory once it holds
@@ -14599,21 +16110,26 @@ var OpfsEngine = class {
       );
     }
     await this.ensureRoot();
-    const namespace = format2StoreNamespace(docId, options.scope ?? {});
+    const namespace = format2StoreNamespace(options.scope ?? {});
     if (this.docs.has(docId)) {
       Logger.warn(
         `[OpfsEngine] ${docId}: purge refused: held (this tab has it open).`
       );
       return { purged: false, reason: "held" };
     }
+    return this.purgeInNamespace(docId, namespace, options.force);
+  }
+  /**
+   * Purge `docId` out of ONE named store, under its presence lock.
+   *
+   * Parameterized by namespace since #3760, because there are now two kinds
+   * of store to reach: the scope store an evict and an open both use, and a
+   * pre-amendment per-document pool, which only the wipe does.
+   */
+  async purgeInNamespace(docId, namespace, force) {
     const taken = await this.withExclusive(
       format2DocumentLockName(namespace, docId),
-      () => this.purgeUnderDocumentLock(
-        docId,
-        namespace,
-        options.scope ?? {},
-        options.force
-      )
+      () => this.purgeUnderDocumentLock(docId, namespace, force)
     );
     if (!taken.got) {
       Logger.warn(
@@ -14624,13 +16140,28 @@ var OpfsEngine = class {
     return taken.value;
   }
   /**
-   * Remove every large document of one scope except `keep` (#3754).
+   * Remove every large document of one scope except `keep` (#3754, re-shaped
+   * by #3760).
    *
-   * Driven by the OPFS root's ENTRIES rather than by anything in memory, which
-   * is the only thing that reaches a document this session never opened and a
-   * pool left behind before a purge existed (finding R3). A scoped prefix ends
-   * in the separator and no encoded part contains one, so it can match neither
-   * another scope's pool nor an unscoped one (edge E4).
+   * Two families of store to reach, and they are swept differently because
+   * they are shaped differently.
+   *
+   * The SCOPE store is one pool holding many documents, so what is in it is
+   * no longer readable off the OPFS root's directory names: the worker is
+   * asked (`listDocuments`). Each document that is not kept then has its
+   * presence lock taken EXCLUSIVE with `ifAvailable` ON THE MAIN THREAD,
+   * BEFORE any worker command — because a frozen tab after a leader change
+   * registers no session anywhere, and that lock is the only thing that
+   * speaks for it (finding 3760-R1, purge-3754 behavior 9b). Only the
+   * documents whose locks were granted are purged, in one queued `purgeAll`
+   * command, and the locks are held across the command, the retire and the
+   * directory removal.
+   *
+   * A PRE-AMENDMENT per-document pool is still exactly one document's data,
+   * and goes through #3754's per-pool path unchanged, on the legacy
+   * namespace: a wipe is the user asking for their data to go, and the docs
+   * promise it reaches a store an older client left behind (decision
+   * 3760-SO-08).
    */
   async format2PurgeAll(options) {
     if (this.destroyed) {
@@ -14640,29 +16171,27 @@ var OpfsEngine = class {
     }
     await this.ensureRoot();
     const scope = options.scope ?? {};
-    const prefix = format2PoolDirectory(format2StoreNamespacePrefix(scope));
-    const keepDirectories = new Set(
-      (options.keep ?? []).map(
-        (id) => format2PoolDirectory(format2StoreNamespace(id, scope).poolName)
-      )
-    );
     const removed = [];
     const skipped = [];
-    for (const directory of await this.listPoolDirectories(prefix)) {
-      if (keepDirectories.has(directory)) {
-        skipped.push({ pool: directory, reason: "keep" });
-        continue;
-      }
+    const purged = [];
+    const namespace = format2StoreNamespace(scope);
+    const scopeDirectory = format2PoolDirectory(namespace.poolName);
+    const legacyPrefix = format2PoolDirectory(format2LegacyPoolPrefix(scope));
+    for (const directory of await this.listPoolDirectories(legacyPrefix)) {
+      if (directory === scopeDirectory) continue;
       const poolName = directory.slice(1);
       const docId = format2DocumentIdFromPoolName(poolName, scope);
       if (docId === null) {
         skipped.push({ pool: directory, reason: "unrecognized" });
         continue;
       }
-      const result = await this.format2Purge(docId, {
-        force: options.force,
-        scope
-      });
+      if ((options.keep ?? []).includes(docId)) {
+        skipped.push({ pool: directory, reason: "keep" });
+        continue;
+      }
+      const legacy = format2LegacyStoreNamespace(docId, scope);
+      const result = await this.purgeInNamespace(docId, legacy, options.force);
+      if (result.purged) purged.push(docId);
       if (result.purged && result.poolRemoved) {
         removed.push(directory);
         continue;
@@ -14670,13 +16199,170 @@ var OpfsEngine = class {
       const reason = result.purged ? "kept-pool" : result.reason;
       skipped.push({ pool: directory, reason });
       Logger.warn(
-        `[OpfsEngine] the sweep skipped the pool '${directory}': ${reason}.`
+        `[OpfsEngine] the sweep skipped the pre-amendment pool '${directory}': ${reason}.`
       );
     }
+    await this.sweepScopeStore(namespace, options, {
+      removed,
+      skipped,
+      purged
+    });
     Logger.info(
-      `[OpfsEngine] large-document sweep removed ${removed.length} pool(s), skipped ${skipped.length}.`
+      `[OpfsEngine] large-document sweep purged ${purged.length} document(s), removed ${removed.length} pool(s), skipped ${skipped.length}.`
+    );
+    return { removed, skipped, purged };
+  }
+  /**
+   * The scope store's half of a sweep: its documents, its locks, one command
+   * (#3760).
+   */
+  async sweepScopeStore(namespace, options, report) {
+    const directory = format2PoolDirectory(namespace.poolName);
+    const root = this.opfsRoot();
+    if (root && !await this.directoryExists(root, directory)) {
+      Logger.debug(
+        `[OpfsEngine] the scope store '${directory}' holds nothing (no pool directory), so the sweep skips it.`
+      );
+      return;
+    }
+    let entry;
+    try {
+      entry = await this.ensureWorker(namespace);
+    } catch (error) {
+      const reason = error?.message ?? String(error);
+      Logger.warn(
+        `[OpfsEngine] the scope store '${directory}' could not be reached (${reason}), so nothing in it was swept.`
+      );
+      report.skipped.push({ pool: directory, reason: "unreachable" });
+      return;
+    }
+    let stored;
+    try {
+      stored = await entry.attachment.listDocuments();
+    } catch (error) {
+      const reason = error?.message ?? String(error);
+      Logger.warn(
+        `[OpfsEngine] the scope store '${directory}' could not list its documents (${reason}), so nothing in it was swept.`
+      );
+      report.skipped.push({ pool: directory, reason: "unreachable" });
+      return;
+    }
+    const keep = new Set(options.keep ?? []);
+    const wanted = [];
+    for (const docId of stored) {
+      if (keep.has(docId)) report.skipped.push({ pool: docId, reason: "keep" });
+      else wanted.push(docId);
+    }
+    await this.withExclusiveAll(
+      wanted.map((docId) => format2DocumentLockName(namespace, docId)),
+      async (granted) => {
+        const acquired = wanted.filter((_, at) => granted[at]);
+        for (const [at, docId] of wanted.entries()) {
+          if (granted[at]) continue;
+          Logger.warn(
+            `[OpfsEngine] ${docId}: the sweep skipped it: held (another tab holds its presence lock, so it still has the document open).`
+          );
+          report.skipped.push({ pool: docId, reason: "held" });
+        }
+        let reply;
+        try {
+          reply = await entry.attachment.purgeAll(acquired, options.force);
+        } catch (error) {
+          const reason = error?.message ?? String(error);
+          Logger.warn(
+            `[OpfsEngine] the scope store '${directory}' could not be swept (${reason}).`
+          );
+          report.skipped.push({ pool: directory, reason: "unreachable" });
+          return;
+        }
+        report.purged.push(...reply.purged);
+        for (const kept of reply.kept) {
+          Logger.warn(
+            `[OpfsEngine] ${kept.docId}: the sweep kept it: ${kept.reason}` + (kept.reason === "pending" ? ` (${kept.pendingOps ?? 0} unacknowledged write(s); sweep with force to drop them)` : ` (${kept.holders ?? 0} session(s) on the pool's worker)`) + "."
+          );
+          report.skipped.push({ pool: kept.docId, reason: kept.reason });
+        }
+        if (reply.remainingDocuments > 0) {
+          Logger.debug(
+            `[OpfsEngine] the scope store still holds ${reply.remainingDocuments} document(s), so '${directory}' stays.`
+          );
+          report.skipped.push({ pool: directory, reason: "kept-pool" });
+          return;
+        }
+        const owing = await this.legacyPoolsStillOnDisk(reply.legacyPools ?? []);
+        if (owing.length > 0) {
+          Logger.info(
+            `[OpfsEngine] the scope store '${directory}' holds no documents, but it stays: it is the only record that ${owing.join(", ")} has already been adopted from.`
+          );
+          report.skipped.push({ pool: directory, reason: "kept-pool" });
+          return;
+        }
+        const gone = await this.retireAndRemove(namespace, entry, directory);
+        if (gone) report.removed.push(directory);
+        else report.skipped.push({ pool: directory, reason: "kept-pool" });
+      }
+    );
+  }
+  /**
+   * Retire a namespace's worker and remove its directory, under the leader
+   * lock this tab already holds (#3754, lifted out for the scope sweep).
+   */
+  async retireAndRemove(namespace, entry, directory) {
+    if (!entry.attachment.leads) {
+      Logger.debug(
+        `[OpfsEngine] another tab leads '${directory}', so its directory is left to that tab.`
+      );
+      return false;
+    }
+    let retired;
+    try {
+      retired = await entry.attachment.retire();
+    } catch (error) {
+      Logger.warn(
+        `[OpfsEngine] '${directory}' could not be retired (${error?.message ?? String(error)}), so its directory stays.`
+      );
+      return false;
+    }
+    if (!retired.retired) {
+      Logger.warn(
+        `[OpfsEngine] '${directory}' was not retired \u2014 ${retired.holders} session(s) on its worker still hold a document open, so its directory stays.`
+      );
+      return false;
+    }
+    const poolRemoved = await this.removePoolDirectory(
+      namespace,
+      namespace.poolName,
+      entry
     );
-    return { removed, skipped };
+    this.workers.delete(namespace.poolName);
+    this.attachments.delete(entry.attachment);
+    await entry.attachment.destroy({ alreadyRetired: true }).catch(() => {
+    });
+    return poolRemoved;
+  }
+  /**
+   * Hold every name in `names` exclusively (with `ifAvailable`) for the
+   * length of `run`, telling it which were granted (#3760).
+   *
+   * Nested rather than sequential: the whole point is that the locks are all
+   * held AT ONCE, across the one `purgeAll` command, the retire and the
+   * directory removal, so a tab cannot open a document between the moment the
+   * sweep decided to take it and the moment its pool is gone.
+   */
+  async withExclusiveAll(names, run2) {
+    const granted = [];
+    const next = async (at) => {
+      if (at >= names.length) return run2(granted);
+      const taken = await this.withExclusive(names[at], async () => {
+        granted[at] = true;
+        await next(at + 1);
+      });
+      if (!taken.got) {
+        granted[at] = false;
+        await next(at + 1);
+      }
+    };
+    await next(0);
   }
   /**
    * The purge itself, with this tab holding the document lock exclusively.
@@ -14686,16 +16372,25 @@ var OpfsEngine = class {
    * `routing.sessions` say what THIS tab serves, while the worker's session map
    * says what every tab does (finding 3754-SO-03).
    */
-  async purgeUnderDocumentLock(docId, namespace, scope, force) {
+  async purgeUnderDocumentLock(docId, namespace, force) {
     const existing = this.workers.get(namespace.poolName);
     const attached = existing && !existing.attachment.died ? existing : null;
     if (!attached) {
-      return this.purgeWithoutAttachment(docId, namespace, scope, force);
+      return this.purgeWithoutAttachment(docId, namespace, force);
     }
     return this.purgeThroughAttachment(docId, namespace, attached, force);
   }
-  /** No attachment for the namespace: what is on disk decides what happens. */
-  async purgeWithoutAttachment(docId, namespace, scope, force) {
+  /**
+   * No attachment for the namespace: what is on disk decides what happens.
+   *
+   * There is no forced shortcut that removes the directory instead of purging
+   * the store. #3754 had one, on the premise that "a per-document pool IS
+   * exactly this document's data" — under one store per scope that premise is
+   * false, and taking the directory would take every other document of the
+   * user with it. The worker is spawned and the rows purged through it,
+   * forced or not (decision 3760-SO-06).
+   */
+  async purgeWithoutAttachment(docId, namespace, force) {
     const directory = format2PoolDirectory(namespace.poolName);
     const root = this.opfsRoot();
     if (root) {
@@ -14706,24 +16401,10 @@ var OpfsEngine = class {
         );
         return { purged: true, nothingStored: true, poolRemoved: false };
       }
-      if (force) {
-        const under = await this.withExclusive(
-          namespace.lockName,
-          () => this.removePoolDirectory(namespace, docId, null)
-        );
-        if (under.got && under.value) {
-          return { purged: true, poolRemoved: true, pendingOps: 0 };
-        }
-        if (under.got) {
-          Logger.warn(
-            `[OpfsEngine] ${docId}: its pool directory could not be removed directly, so its store is purged through a worker instead.`
-          );
-        }
-      }
     }
     let entry;
     try {
-      entry = await this.ensureWorker(docId, scope);
+      entry = await this.ensureWorker(namespace);
     } catch (error) {
       const reason = error?.message ?? String(error);
       Logger.warn(
@@ -14770,6 +16451,13 @@ var OpfsEngine = class {
       );
       return { ...purgedReport(reply), poolRemoved: false };
     }
+    const owing = await this.legacyPoolsStillOnDisk(reply.legacyPools ?? []);
+    if (owing.length > 0) {
+      Logger.info(
+        `[OpfsEngine] ${docId}: its store holds no documents, but its directory stays: it is the only record that ${owing.join(", ")} has already been adopted from. A wipe of this user's data reclaims both.`
+      );
+      return { ...purgedReport(reply), poolRemoved: false };
+    }
     if (!entry.attachment.leads) {
       Logger.debug(
         `[OpfsEngine] ${docId}: another tab leads its pool, so its directory is left to that tab.`
@@ -14860,10 +16548,10 @@ var OpfsEngine = class {
   /**
    * Resolve `navigator.storage.getDirectory()` once, if this platform has it.
    *
-   * Awaited at the top of every purge rather than in the constructor: an engine
-   * is built before anybody has asked it for anything, and a rejected promise
-   * kept on a field would be an unhandled rejection in every app that never
-   * purges.
+   * Awaited at the top of every purge and of the legacy-pool probe rather than
+   * in the constructor: an engine is built before anybody has asked it for
+   * anything, and a rejected promise kept on a field would be an unhandled
+   * rejection in every app that never reaches the root at all.
    */
   async ensureRoot() {
     if (this.internals.opfsRoot !== void 0 || this.resolvedRoot) return;
@@ -14877,6 +16565,26 @@ var OpfsEngine = class {
       );
     }
   }
+  /**
+   * Which of `pools` still has a directory in the OPFS root (#3760).
+   *
+   * A ledger row for a pool whose directory is gone says nothing anybody can
+   * act on — there is no source left to take a write from — so it does not keep
+   * the scope store's directory alive. With no root at all nothing names any
+   * of them either: `removePoolDirectory` cannot remove a directory it has no
+   * root for, so the ledger is in no danger and this answers none.
+   */
+  async legacyPoolsStillOnDisk(pools) {
+    if (pools.length === 0) return [];
+    const root = this.opfsRoot();
+    if (!root) return [];
+    const present = [];
+    for (const pool of pools) {
+      const directory = format2PoolDirectory(pool);
+      if (await this.directoryExists(root, directory)) present.push(directory);
+    }
+    return present;
+  }
   /** Whether `name` is a directory of the root, without creating it. */
   async directoryExists(root, name) {
     try {
@@ -15109,18 +16817,20 @@ var OpfsEngine = class {
     await this.mirror.close();
   }
   /**
-   * The attachment for `docId`'s namespace, joined if this tab has not joined
-   * it yet.
+   * The attachment for one scope's namespace, joined if this tab has not
+   * joined it yet.
    *
    * One attachment per namespace, whatever role this tab ends up in: a
    * document is routed to the attachment, not to a worker, because a leader
-   * change replaces the worker under it and the rows do not move.
+   * change replaces the worker under it and the rows do not move. Since
+   * #3760 a namespace is a SCOPE, so every large document of one user shares
+   * this entry — and because the attachment re-serves every session on each
+   * new generation, a leader change hands over all of them at once.
    */
-  ensureWorker(docId, scope) {
+  ensureWorker(namespace) {
     if (this.destroyed) {
       return Promise.reject(new Error("the opfs engine was destroyed"));
     }
-    const namespace = format2StoreNamespace(docId, scope ?? {});
     const existing = this.workers.get(namespace.poolName);
     if (existing && !existing.attachment.died) return Promise.resolve(existing);
     const pending = this.opening.get(namespace.poolName);
@@ -15130,7 +16840,6 @@ var OpfsEngine = class {
         namespace,
         clientId: this.tabId,
         openRequest: {
-          docId,
           poolName: namespace.poolName,
           dbFile: namespace.dbFile,
           poolLockName: namespace.poolLockName,
@@ -15408,12 +17117,13 @@ init_BaseModel();
 init_OrmContext();
 
 // src/models/format2DocumentBinding.ts
-var Y8 = __toESM(require("yjs"), 1);
+var Y9 = __toESM(require("yjs"), 1);
 init_BaseModel();
 init_OrmContext();
 init_format2RecordStoreAsync();
 init_format2StoreHost();
 init_format2Observer();
+init_format2OverlayKeysSince();
 
 // src/models/format2PendingRestore.ts
 init_largeDocuments();
@@ -15617,7 +17327,14 @@ function sameOverlayValue(a, b) {
   return JSON.stringify(a) === JSON.stringify(b);
 }
 function decideDeferredReplay(note, epoch, ackedSeq) {
-  if (!note || note.kind !== "ordinary") return { kind: "none" };
+  if (!note) return { kind: "none" };
+  if (note.kind === "legacy") {
+    if (note.throughSeq <= ackedSeq) {
+      return { kind: "clear", reason: "acknowledged", note };
+    }
+    return { kind: "honour", note, clamped: false };
+  }
+  if (note.kind !== "ordinary") return { kind: "none" };
   let resolved = note;
   let clamped = false;
   if (note.toEpoch > epoch) {
@@ -15969,8 +17686,12 @@ var Format2DocumentBinding = class _Format2DocumentBinding {
    * first one and answer out of a database it has nothing to do with.
    */
   opened = /* @__PURE__ */ new Map();
-  /** Serialized query-projection work for folded overlay updates. */
-  queue = Promise.resolve();
+  /**
+   * Models a fold batch touched, per document, awaiting their one
+   * notification (#3782). A batch reports its records one by one; the
+   * listeners hear once per model per batch, after the projection landed.
+   */
+  foldedModels = /* @__PURE__ */ new Map();
   /**
    * Refuse a large document this device cannot keep, before anything is wired
    * to it (#2816, sponsor decision B of 2026-08-27).
@@ -16035,19 +17756,16 @@ var Format2DocumentBinding = class _Format2DocumentBinding {
     if (Number.isInteger(epoch) && epoch > store.epoch()) {
       store.setEpoch(epoch);
     }
+    store.trackOverlay(yDoc);
     this.unobservers.set(
       docId,
       observeFormat2Overlay(
         yDoc,
         store,
-        (modelName, recordId) => this.enqueueProjection(docId, modelName, recordId)
+        (modelName) => this.noteFolded(docId, modelName)
       )
     );
-    foldFormat2Overlay(
-      yDoc,
-      store,
-      (modelName, recordId) => this.enqueueProjection(docId, modelName, recordId)
-    );
+    this.catchUp(docId, yDoc, store);
     await store.whenBatchesSettled();
     if (options.restorePending !== false) {
       const verdicts = await this.adoptOrphanedWrites(docId, yDoc, store);
@@ -16071,11 +17789,7 @@ var Format2DocumentBinding = class _Format2DocumentBinding {
       }
       const adoptedWasRestored = verdicts !== void 0 && restored.restored.some((seq) => verdicts.has(seq));
       if (adoptedWasRestored) {
-        foldFormat2Overlay(
-          yDoc,
-          store,
-          (modelName, recordId) => this.enqueueProjection(docId, modelName, recordId)
-        );
+        this.catchUp(docId, yDoc, store);
         await store.whenBatchesSettled();
       }
       if (restored.unreproducible.length > 0) {
@@ -16092,6 +17806,42 @@ var Format2DocumentBinding = class _Format2DocumentBinding {
       store.onReattached(() => this.revalidateQueryTables(docId, store))
     );
   }
+  /**
+   * Fold what `yDoc` holds that the store does not (#3782).
+   *
+   * - Nothing is known about what the store holds (no folded state), or the
+   *   facade is fold-broken: the WHOLE overlay, as every bind did before —
+   *   for a broken fold that is the repair.
+   * - Otherwise the items above the stored vector name the keys that moved;
+   *   those are folded as one ordinary batch (materialized and completed by
+   *   the observer's own path), with any hydrated model the stored state
+   *   never covered folded whole. A document that did not move is sent
+   *   nothing at all.
+   *
+   * Either way the batch is a bind's: a document behind the store is folded
+   * forced rather than held, because a bind resolves with what local
+   * persistence gave it.
+   */
+  catchUp(docId, yDoc, store) {
+    const onFolded = (modelName) => this.noteFolded(docId, modelName);
+    const stored = store.foldedState();
+    if (stored === null || store.health() === "fold-broken") {
+      foldFormat2Overlay(yDoc, store, onFolded, { atBind: true });
+      return;
+    }
+    const diff = overlayKeysSince(yDoc, stored, (model) => store.isHydrated(model));
+    if (!diff.moved) {
+      Logger.debug(
+        `[format2] ${docId}: the overlay is unchanged since the last fold; nothing to fold.`
+      );
+      return;
+    }
+    const keys = new Map(diff.keys);
+    for (const model of diff.uncovered) {
+      keys.set(model, new Set(yDoc.getMap(model).keys()));
+    }
+    store.enqueueOverlayBatch(yDoc, keys, onFolded, { atBind: true });
+  }
   /**
    * Settle what a deferred judgement means for THIS bind (#3755).
    *
@@ -16139,10 +17889,10 @@ var Format2DocumentBinding = class _Format2DocumentBinding {
    *
    * Ordinarily nothing: {@link hydrateQueryTables} skips every model whose
    * projection mark is current, so a re-attachment that lost nothing costs one
-   * mark read per model. When a sibling DID wipe — it counted the sessions of
-   * a worker this tab had not reached yet and read itself as the last holder —
-   * the marks are gone with the rows and the tables are rebuilt from the
-   * merged view, which no wipe touches.
+   * mark read per model. A close removes nothing (#3756), but a PURGE can run
+   * while this tab is frozen — it counted the sessions of a worker this tab
+   * had not reached yet — and then the marks are gone with the rows and the
+   * tables are rebuilt from the merged view.
    *
    * Serialized per document and never awaited by the engine: the re-attachment
    * is a notification, not a command, and a rebuild that takes a while must not
@@ -16185,13 +17935,9 @@ var Format2DocumentBinding = class _Format2DocumentBinding {
         `[DocumentManager] Cannot apply a sealed overlay to ${docId}: it has no merged record view`
       );
     }
-    const doc = new Y8.Doc();
-    Y8.applyUpdate(doc, update);
-    foldFormat2Overlay(
-      doc,
-      store,
-      (modelName, recordId) => this.enqueueProjection(docId, modelName, recordId)
-    );
+    const doc = new Y9.Doc();
+    Y9.applyUpdate(doc, update);
+    foldFormat2Overlay(doc, store, (modelName) => this.noteFolded(docId, modelName));
     await store.whenBatchesSettled();
     doc.destroy();
     await this.whenProjectionSettled();
@@ -16217,11 +17963,7 @@ var Format2DocumentBinding = class _Format2DocumentBinding {
         `[DocumentManager] Cannot re-fold the overlay of ${docId}: it has no merged record view`
       );
     }
-    foldFormat2Overlay(
-      yDoc,
-      store,
-      (modelName, recordId) => this.enqueueProjection(docId, modelName, recordId)
-    );
+    foldFormat2Overlay(yDoc, store, (modelName) => this.noteFolded(docId, modelName));
     await this.whenProjectionSettled();
   }
   /**
@@ -16374,7 +18116,10 @@ var Format2DocumentBinding = class _Format2DocumentBinding {
       );
       return;
     }
-    await this.hydrateQueryTables(docId, store, { only: modelName });
+    await this.hydrateQueryTables(docId, store, {
+      only: modelName,
+      reason: "registered on a running instance"
+    });
     await this.whenProjectionSettled();
   }
   localModels(docId) {
@@ -16421,28 +18166,54 @@ var Format2DocumentBinding = class _Format2DocumentBinding {
   /**
    * Release `docId`. Safe on a document that was never format 2.
    *
-   * Asynchronous since #3429: the facade may have operations in flight, and
-   * closing under them would reject a save the app is still awaiting. The
-   * facade's `close()` drains first.
+   * A release removes nothing (#3756): the records, the unacknowledged
+   * writes, the query tables and their projection marks all stay, so the next
+   * open projects nothing — exactly as a reload that never called close. The
+   * store purge behind the eviction doors is what removes them.
+   *
+   * A kept mark must vouch only for rows that LANDED, so the order matters
+   * (decision D4):
+   *
+   * 1. stop listening, so no NEW fold is queued;
+   * 2. settle the local writes already admitted — commit and projection — and
+   *    the folds already queued on the facade, while the facade is
+   *    still registered — a fold notifies its records after its
+   *    `applyRemoteBatch`, and a projection enqueued against an unregistered
+   *    document is dropped silently;
+   * 3. settle the projection queue those folds fed. A projection that fails
+   *    here withdraws its model's mark through the still-open facade, and the
+   *    next bind rebuilds that model;
+   * 4. only then unregister the facade and close it (its close drains what
+   *    the app still has in flight).
    */
-  async disconnect(docId, options = {}) {
+  async disconnect(docId) {
     this.unobservers.get(docId)?.();
     this.unobservers.delete(docId);
     this.reattachSubscriptions.get(docId)?.();
     this.reattachSubscriptions.delete(docId);
     const store = this.opened.get(docId);
+    if (!store) return;
+    try {
+      do {
+        await store.whenLocalWritesSettled();
+        await store.whenBatchesSettled();
+      } while (store.localWritesInFlight() > 0);
+      await store.flushLocalStamp();
+    } catch (error) {
+      Logger.error(
+        `[DocumentManager] ${docId}: settling its queued folds before the release failed:`,
+        error
+      );
+    }
+    store.refuseLocalWrites();
     this.opened.delete(docId);
     if (this.ormContext.format2Documents.get(docId) === store) {
       this.ormContext.format2Documents.delete(docId);
     }
-    if (!store) return { wiped: false };
-    const result = await store.close(
-      options.wipeIfLastModels ? { wipeIfLast: { models: options.wipeIfLastModels } } : {}
-    );
+    await store.close();
     Logger.info(
-      `[DocumentManager] ${docId}: released its merged view; ` + (options.wipeIfLastModels === void 0 ? "no query-table wipe was asked for." : result.wiped ? "it was the last holder, so its query tables were emptied." : "another holder remains, so its query tables were kept.")
+      `[DocumentManager] ${docId}: released its merged view; its query tables and projection marks are kept for the next open.`
     );
-    return result;
   }
   /**
    * Take over the unacknowledged writes of clients that are gone, and decide
@@ -16511,28 +18282,6 @@ var Format2DocumentBinding = class _Format2DocumentBinding {
       `[DocumentManager] ${docId}: adopted write #${op.seq} (${where}, from client ${op.fromClientId} seq ${op.fromSeq}) is restored in part: ${kept.join(", ")} are still owed, and its other keys were overwritten after it.`
     );
   }
-  /**
-   * Remove `docId` from `models`' query tables, in THIS thread.
-   *
-   * The in-process host's `wipeIfLast` hook. Exactly the two steps
-   * `removeDocumentData` used to take for a large document, moved here so the
-   * observable result is the same wherever the store runs.
-   */
-  async wipeQueryTables(docId, models) {
-    const classes = this.modelRegistry.getActiveModels();
-    for (const modelName of models) {
-      const modelClass = classes.get(modelName);
-      try {
-        const engine = typeof modelClass?.queryEngineFor === "function" && modelClass?.dbInstance ? await modelClass.queryEngineFor([docId], modelName) : modelClass?.dbInstance ?? this.dbEngine;
-        await engine.deleteByDocumentId(modelName, docId);
-      } catch (error) {
-        Logger.error(
-          `[DocumentManager] ${docId}: could not remove '${modelName}' rows:`,
-          error
-        );
-      }
-    }
-  }
   /**
    * Close every open document. Used by `destroy()` and `resetJsBao()`.
    *
@@ -16572,7 +18321,6 @@ var Format2DocumentBinding = class _Format2DocumentBinding {
     for (const store of Array.from(this.opened.values())) {
       await store.whenBatchesSettled();
     }
-    await this.queue;
   }
   /**
    * Rebuild the derived query tables from the merged view.
@@ -16639,56 +18387,67 @@ var Format2DocumentBinding = class _Format2DocumentBinding {
         continue;
       }
       await store.forgetQueryProjection(modelName);
+      const started = Date.now();
+      let rows = 0;
       let after = null;
       for (; ; ) {
-        const page = await store.readRowsAfter(
+        const page = await store.recordIdsAfter(
           modelName,
           after,
           QUERY_HYDRATION_PAGE_ROWS
         );
         if (page.length === 0) break;
-        await modelClass.projectFormat2Records(
-          docId,
-          page.map((row) => String(row.id))
-        );
-        after = String(page[page.length - 1].id);
+        await modelClass.projectFormat2Records(docId, page);
+        rows += page.length;
+        after = page[page.length - 1];
         if (page.length < QUERY_HYDRATION_PAGE_ROWS) break;
       }
       await store.markQueryProjectionCurrent(modelName);
+      Logger.info(
+        `[format2] ${docId}: rebuilt '${modelName}' query tables from ${rows} rows in ${Date.now() - started} ms (${forced ? scope.reason ?? "replaced by a snapshot load" : "no projection mark"})`
+      );
     }
   }
   /**
-   * Refresh the per-model query projection for a record an overlay update
-   * touched. The merged view is already up to date (the fold is synchronous);
-   * this keeps `query()` / `aggregate()` in step, serialized on one chain so
-   * concurrent updates to the same record cannot interleave.
-   *
-   * A failure here cannot be swallowed. The mark this model carries says its
-   * query tables hold the merged view, and every later session reads that mark
-   * and SKIPS the rebuild — so a projection that failed would otherwise leave
-   * `query()` answering from a row `find()` disagrees with, for the life of
-   * the database. Dropping the mark costs one rebuild at the next bind, which
-   * is the repair.
+   * A fold batch landed records of `modelName` — rows AND query rows, since
+   * the projection rides in the batch's own command (#3782). The listeners
+   * hear once per model per batch: the batch reports its records in one
+   * synchronous pass, and the notification is taken a microtask later.
    */
-  enqueueProjection(docId, modelName, recordId) {
-    const modelClass = this.modelRegistry.getModelClass(modelName);
-    if (!modelClass) return;
-    const store = this.ormContext.getFormat2StoreAsync(docId);
-    if (!store?.isHydrated(modelName)) return;
-    this.queue = this.queue.then(() => modelClass.projectFormat2Record(docId, recordId)).catch(async (error) => {
-      Logger.error(
-        `[DocumentManager] Failed to project ${modelName}/${recordId} into the query tables:`,
-        error
-      );
-      try {
-        await store.forgetQueryProjection(modelName);
-      } catch (markError) {
-        Logger.error(
-          `[DocumentManager] Failed to withdraw the query-projection mark of ${modelName}:`,
-          markError
-        );
-      }
-    });
+  noteFolded(docId, modelName) {
+    let models = this.foldedModels.get(docId);
+    if (!models) {
+      models = /* @__PURE__ */ new Set();
+      this.foldedModels.set(docId, models);
+      queueMicrotask(() => {
+        const touched = this.foldedModels.get(docId);
+        this.foldedModels.delete(docId);
+        for (const model of touched ?? []) {
+          const modelClass = this.modelRegistry.getModelClass(model);
+          modelClass?.notifyFormat2Folded();
+        }
+      });
+    }
+    models.add(modelName);
+  }
+  /**
+   * Which query tables a fold of `docId` projects into (#3782): one spec per
+   * model with an active class, held on this device, while this binding's
+   * facade is the one registered for the document. A released facade projects
+   * nothing, as a projection enqueued against an unregistered document never
+   * did.
+   */
+  projectionSpecs(docId, store) {
+    return (models) => {
+      if (this.ormContext.format2Documents.get(docId) !== store) return [];
+      const specs = [];
+      for (const model of models) {
+        if (!store.isHydrated(model)) continue;
+        const spec = this.modelRegistry.getModelClass(model)?.format2ProjectionSpec(docId);
+        if (spec) specs.push(spec);
+      }
+      return specs;
+    };
   }
   /**
    * What this device can hold a large document in — the PLATFORM's quota and
@@ -16730,6 +18489,7 @@ var Format2DocumentBinding = class _Format2DocumentBinding {
     }
     const host = await this.createHost(docId);
     const store = await Format2RecordStoreAsync.open(host, docId);
+    store.setProjectionProvider(this.projectionSpecs(docId, store));
     this.opened.set(docId, store);
     this.ormContext.format2Documents.set(docId, store);
     return store;
@@ -16751,17 +18511,12 @@ var Format2DocumentBinding = class _Format2DocumentBinding {
         `[DocumentManager] ${docId} is a large document on a store that does not survive this process (${this.dbEngine.constructor.name}): its records and its unacknowledged writes are lost on restart, and a base snapshot cannot be loaded into it.`
       );
     }
-    const host = new InProcessFormat2StoreHost(
+    return new InProcessFormat2StoreHost(
       this.dbEngine.createFormat2Sql(),
       docId,
       void 0,
       this.ormContext.format2ClientId
     );
-    host.onWipe(async (models) => {
-      await this.wipeQueryTables(docId, models);
-      await host.dispatch({ kind: "projectionMark", op: "forget", docId });
-    });
-    return host;
   }
 };
 function withinBound3(promise, boundMs) {
@@ -17241,14 +18996,10 @@ var DocumentManagerImpl = class {
     }
     Logger.info(`[DocumentManager] Disconnecting document ${docId}`);
     const large = this.ormContext.getFormat2StoreAsync(docId) !== null;
-    const wipeModels = large ? Array.from(this.modelRegistry.getActiveModels().keys()) : void 0;
     await this.modelRegistry.removeDocumentData(docId, this.dbEngine, {
       skipQueryTableWipe: large
     });
-    await this.format2.disconnect(
-      docId,
-      wipeModels ? { wipeIfLastModels: wipeModels } : {}
-    );
+    await this.format2.disconnect(docId);
     this.connectedDocuments.delete(docId);
     for (const docIds of this.runtimeInitialized.values()) {
       docIds.delete(docId);
@@ -17745,7 +19496,7 @@ function attachAndRegisterModel(modelClass, schema) {
 }
 
 // src/utils/yDocSchema.ts
-var Y9 = __toESM(require("yjs"), 1);
+var Y10 = __toESM(require("yjs"), 1);
 init_yjsValues();
 function discoverSchema(yDoc) {
   const models = {};
@@ -17780,7 +19531,7 @@ function discoverModelNames(yDoc) {
 function materializeMap(yDoc, key) {
   try {
     const map = yDoc.getMap(key);
-    return map instanceof Y9.Map ? map : null;
+    return map instanceof Y10.Map ? map : null;
   } catch {
     return null;
   }
@@ -17790,11 +19541,11 @@ function readModelMeta(metaMap) {
   let constraints;
   let relationships;
   for (const [key, value] of metaMap.entries()) {
-    if (key === "_constraints" && value instanceof Y9.Map) {
+    if (key === "_constraints" && value instanceof Y10.Map) {
       constraints = readConstraints(value);
-    } else if (key === "_relationships" && value instanceof Y9.Map) {
+    } else if (key === "_relationships" && value instanceof Y10.Map) {
       relationships = readRelationships(value);
-    } else if (value instanceof Y9.Map) {
+    } else if (value instanceof Y10.Map) {
       fields[key] = readFieldMeta(value);
     }
   }
@@ -17829,7 +19580,7 @@ function inferModelFromData(dataMap) {
   const fields = {};
   let sampled = 0;
   for (const [_recordId, recordValue] of dataMap.entries()) {
-    if (!(recordValue instanceof Y9.Map)) continue;
+    if (!(recordValue instanceof Y10.Map)) continue;
     if (++sampled > 5) break;
     for (const [fieldName, value] of recordValue.entries()) {
       if (fieldName.startsWith("_")) continue;
@@ -17857,7 +19608,7 @@ function inferTypeFromValue(value) {
 function readConstraints(constraintsMap) {
   const out = {};
   for (const [name, value] of constraintsMap.entries()) {
-    if (!(value instanceof Y9.Map)) continue;
+    if (!(value instanceof Y10.Map)) continue;
     let fields = [];
     const rawFields = value.get("fields");
     if (typeof rawFields === "string") {
@@ -17876,7 +19627,7 @@ function readConstraints(constraintsMap) {
 function readRelationships(relsMap) {
   const out = {};
   for (const [name, value] of relsMap.entries()) {
-    if (!(value instanceof Y9.Map)) continue;
+    if (!(value instanceof Y10.Map)) continue;
     const rel = {};
     for (const [k, v] of value.entries()) {
       rel[k] = v;
@@ -18344,7 +20095,7 @@ function suppressSupersededKeys(carried, later) {
 }
 
 // src/models/format2EpochRotation.ts
-var Y10 = __toESM(require("yjs"), 1);
+var Y11 = __toESM(require("yjs"), 1);
 init_largeDocuments();
 async function followEpoch(host, nextEpoch, options = {}) {
   const sealed = host.overlayDoc();
@@ -18385,7 +20136,7 @@ async function followEpoch(host, nextEpoch, options = {}) {
         suppressDeletes: owed.suppressDeletes
       });
     }
-    const fresh = new Y10.Doc();
+    const fresh = new Y11.Doc();
     fresh.documentId = sealed.documentId;
     if (carried.length > 0) {
       fresh.transact(() => {
@@ -18449,7 +20200,7 @@ async function writeDeferredReplay(host, ops, owedOverlay, resolveReplay) {
 }
 
 // src/models/format2FastForward.ts
-var Y11 = __toESM(require("yjs"), 1);
+var Y12 = __toESM(require("yjs"), 1);
 function planFastForward(options) {
   const { current, target } = options;
   if (!Number.isInteger(target) || target <= 0) {
@@ -18513,8 +20264,8 @@ async function applyFastForward(plan, host) {
   for (const [index, step] of plan.steps.entries()) {
     try {
       const update = await host.fetchArchive(step);
-      const doc = new Y11.Doc();
-      Y11.applyUpdate(doc, update);
+      const doc = new Y12.Doc();
+      Y12.applyUpdate(doc, update);
       await host.applyOverlay(doc, step.epoch);
       doc.destroy();
     } catch (error) {
@@ -18658,8 +20409,12 @@ function meets(coverage, range) {
   return true;
 }
 
+// src/browser.ts
+init_format2FoldedState();
+init_format2OverlayKeysSince();
+
 // src/models/format2OfflineReplay.ts
-var Y12 = __toESM(require("yjs"), 1);
+var Y13 = __toESM(require("yjs"), 1);
 init_largeDocuments();
 init_format2Observer();
 var recordKey = (model, recordId) => `${model}\0${recordId}`;
@@ -18701,7 +20456,7 @@ var OfflineConflictLedger = class {
     for (const modelName of Array.from(doc.share.keys())) {
       if (!isFormat2ModelMap(modelName)) continue;
       const modelMap = doc.getMap(modelName);
-      if (!(modelMap instanceof Y12.Map) || modelMap.size === 0) continue;
+      if (!(modelMap instanceof Y13.Map) || modelMap.size === 0) continue;
       const entries = [];
       for (const [key, value] of modelMap.entries()) {
         if (!parseOverlayKey(key)) continue;