The live guards of a set of instances in one resource, as an App SDK query
source. Guards co-locate with the subjects they lock, so they're spread
across the resources the instances' GDRs name; the caller fans this across
that set and slices out each instance's rows (see makeSdkObserver).
Exported as the lower-level guard store used by custom observers.
Consolidation comes from the SDK query store's options-keyed state: every
subscriber passing an identical (query, params, resource) shares one live
query, so the ids are canonicalized (sorted, deduped) to make equal id-sets
produce identical keys.
Reads the committed query store (unlike the optimistic per-doc instance
stream), so freshly-deployed guards can lag by one commit round-trip;
that is acceptable because verdicts are advisory, not enforcement.
The live guards of a set of instances in one resource, as an App SDK query source. Guards co-locate with the subjects they lock, so they're spread across the resources the instances' GDRs name; the caller fans this across that set and slices out each instance's rows (see makeSdkObserver). Exported as the lower-level guard store used by custom observers.
Consolidation comes from the SDK query store's options-keyed state: every subscriber passing an identical (query, params, resource) shares one live query, so the ids are canonicalized (sorted, deduped) to make equal id-sets produce identical keys.
Reads the committed query store (unlike the optimistic per-doc instance stream), so freshly-deployed guards can lag by one commit round-trip; that is acceptable because verdicts are advisory, not enforcement.