@abloatai/ablo 0.34.1 → 0.36.0

package/dist/client/createModelProxy.js

@@ -3,29 +3,71 @@
  * `ablo.<model>`.
  *
  * Each schema model gets one {@link ModelOperations}: the async server reads
- * `retrieve` and `list`, the synchronous local-graph snapshots `get`, `getAll`,
- * and `getCount`, the writes `create`, `update`, and `delete`, the coordination
+ * `retrieve` and `list`, the same verbs restricted to the local graph under
+ * `local`, the writes `create`, `update`, and `delete`, the coordination
  * namespace `claim` (callable as `claim({ id })`, plus `claim.state`,
  * `claim.queue`, `claim.release`, and `claim.reorder`), `join`, and `onChange`.
  * The factory returns a plain object; the client assembles the `ablo.<model>`
  * lookup table from one of these per model.
  */
 import { autorun } from 'mobx';
-import { AbloClaimedError, AbloStaleContextError, AbloValidationError, formatClaimedErrorMessage, toAbloError, } from '../errors.js';
-import { reconcileFunctionalUpdate, } from './functionalUpdate.js';
+import { AbloClaimedError, AbloValidationError, formatClaimedErrorMessage, toAbloError, } from '../transaction/errors.js';
+import { reconcileFunctionalUpdate, } from '../transaction/resources/functionalUpdate.js';
+import { claimDescription, } from '../transaction/coordination/schema.js';
 import { Model, modelAsRow } from '../Model.js';
-import { toMs } from '../utils/duration.js';
-import { LEASE_TTL_MS } from '../wire/protocol.js';
-import { heartbeatCadenceMs, resolveHeartbeatOptions, startClaimHeartbeatLoop, } from './claimHeartbeatLoop.js';
-import { assertWriteOptions } from './writeOptionsSchema.js';
-import { ModelScope } from '../types/index.js';
+import { toMs } from '../transaction/utils/duration.js';
+import { LEASE_TTL_MS } from '../transaction/wire/protocol.js';
+import { heartbeatCadenceMs, resolveHeartbeatOptions, resolveHeartbeatPlan, startClaimHeartbeatLoop, } from '../transaction/coordination/claimHeartbeatLoop.js';
+import { assertWriteOptions } from '../transaction/resources/writeOptionsSchema.js';
+import { modelTarget, subTarget } from '../transaction/coordination/index.js';
+// A named claim-meta crossing (see `claim-meta-crossings-are-enumerated` in
+// .dependency-cruiser.cjs): the reactive proxy's self-claim targets are
+// decodes that build a public claim, so their `meta` converts wire→declared
+// here like the other enumerated crossings.
+import { declaredMeta } from '../transaction/coordination/claimMeta.js';
+import { ModelScope } from '../transaction/types/index.js';
 const modelClientMeta = new WeakMap();
 export function getModelClientMeta(modelClient) {
     if (typeof modelClient !== 'object' || modelClient === null)
         return undefined;
     return modelClientMeta.get(modelClient);
 }
-export function createModelProxy(schemaKey, registeredModelName, objectPool, syncClient, registry, hydration, collaboration) {
+export function createModelProxy(schemaKey, registeredModelName, objectPool, syncClient, registry, 
+/**
+ * The one thing this factory asks of the loader: fetch rows for a model.
+ *
+ * Declared as the slice rather than the whole `OnDemandLoader` because the
+ * whole is a class, and a parameter typed as a class can only ever be
+ * satisfied by an instance of it — so every caller that has a narrower
+ * collaborator, a test most of all, is pushed into a cast through `unknown`
+ * to supply the one method that is actually read.
+ */
+hydration, collaboration, 
+/** The client-wide `wait` default; a per-call `wait` still wins over it. */
+defaultWait) {
+    /**
+     * Resolve a row **this** resource owns.
+     *
+     * The pool is one id space, so `objectPool.get(id)` happily returns another
+     * model's row. Every write path below addresses rows by bare id, so without
+     * this an id from a sibling model resolves and gets written — silently
+     * corrupting a row the caller never named.
+     *
+     * `undefined` means genuinely absent. A row belonging to another model throws:
+     * unlike a read, a cross-model *write* is never a legitimate outcome, and
+     * naming both models turns a silent corruption into a one-line diagnosis.
+     */
+    const ownRowOrThrow = (id) => {
+        const own = objectPool.getOfType(id, registeredModelName);
+        if (own)
+            return own;
+        const foreign = objectPool.get(id);
+        if (!foreign)
+            return undefined;
+        const owner = foreign.getModelName();
+        throw new AbloValidationError(`No ${registeredModelName} with id ${id} — that id belongs to a ${owner}. ` +
+            `Read or write it through ${owner}.`, { code: 'entity_not_found' });
+    };
     const ModelClass = registry.getModelByName(registeredModelName);
     if (!ModelClass) {
         throw new AbloValidationError(`Ablo: schema model "${schemaKey}" resolved to "${registeredModelName}", ` +
@@ -66,7 +108,11 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
         return rows;
     };
     const waitForMutation = async (model, options) => {
-        if (options?.wait !== 'confirmed')
+        // A per-call `wait` wins; otherwise the client-wide default decides. This
+        // is the single point that turns "confirmed" into actually waiting, so a
+        // client configured that way rejects on a refused write everywhere rather
+        // than in the one place a caller remembered to ask.
+        if ((options?.wait ?? defaultWait) !== 'confirmed')
             return;
         await syncClient.syncNow();
         await syncClient.waitForConfirmation(model.getModelName(), model.id);
@@ -93,7 +139,6 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
         value.object === 'claim' &&
         typeof value.id === 'string' &&
         typeof value.release === 'function';
-    const claimMeta = (options) => options?.meta;
     const claimContextFromClaim = (claim) => {
         return {
             id: claim.id,
@@ -104,12 +149,8 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
             status: claim.status,
             expiresAt: claim.expiresAt,
             target: {
-                model: claim.target.type,
-                id: claim.target.id,
-                path: claim.target.path,
-                range: claim.target.range,
-                field: claim.target.field,
-                meta: claim.target.meta,
+                ...modelTarget(claim.target),
+                ...subTarget(claim.target),
             },
         };
     };
@@ -139,26 +180,21 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
         const held = collaboration.state({ model: wireModel, id });
         const contended = !!held && held.heldBy !== collaboration.selfParticipantId;
         const failFast = options.queue === false;
-        // Fail-fast (`queue: false`): if another participant already holds it,
-        // reject now instead of queuing. Best-effort at the client (a racing
-        // claim not yet synced into our snapshot slips through here) — the
-        // commit-time claim guard is the authoritative backstop that rejects
-        // the loser's first write. For work-distribution dedup that's exactly
-        // right: don't wait (that would double-process), skip.
+        // The try-claim (`queue: false`): a held target is an expected outcome,
+        // not an error, so it resolves `null` — the caller reads `if (!claim)`
+        // and moves on; who holds it stays readable via `claim.state`. Best-effort
+        // at the client (a racing claim not yet synced into our snapshot slips
+        // through here) — the commit-time claim guard is the authoritative
+        // backstop that rejects the loser's first write. For work-distribution
+        // dedup that's exactly right: don't wait (that would double-process), skip.
         if (failFast && contended) {
-            const claim = claimContextFromClaim(held);
-            throw new AbloClaimedError(formatClaimedErrorMessage({
-                targetLabel: `${registeredModelName}/${id}`,
-                heldBy: held.heldBy,
-                claim,
-                fallback: `${registeredModelName}/${id} is held by ${held.heldBy ?? 'another participant'}.`,
-            }), { code: 'entity_claimed', claims: [claim] });
+            return null;
         }
         // Ensure the row exists locally before claiming.
-        let model = objectPool.get(id);
+        let model = ownRowOrThrow(id);
         if (!model) {
             await load({ where: [['id', id]] });
-            model = objectPool.get(id);
+            model = ownRowOrThrow(id);
         }
         if (!model) {
             throw new AbloValidationError(`Entity not found: ${registeredModelName}/${id}`, { code: 'entity_not_found' });
@@ -180,15 +216,19 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
             target: {
                 model: wireModel,
                 id,
-                ...(options.field ? { field: options.field } : {}),
-                ...(options.path ? { path: options.path } : {}),
-                ...(options.range ? { range: options.range } : {}),
-                ...(claimMeta(options) ? { meta: claimMeta(options) } : {}),
+                // The whole sub-entity locator in one move — listing its members here
+                // is what let `fields` die between the caller and the lease, so the
+                // claim covered the whole row while the caller believed it named parts.
+                ...subTarget(options),
             },
-            description: options.description ?? 'editing',
+            description: claimDescription(options),
             ttl: options.ttl,
             queue: !failFast,
             maxQueueDepth: options.maxQueueDepth,
+            // The one wait cap, declared once on ClaimTargetOptions — the socket
+            // wait and the HTTP poll-wait both honor it as `grant_timeout`.
+            waitTimeoutMs: options.waitTimeoutMs,
+            signal: options.signal,
         });
         // Only when the claim actually waited behind another holder can the row have
         // changed underneath us — re-read so the claimed snapshot reflects what that
@@ -205,20 +245,22 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
             // holder's final write may not have fanned out yet — the exact
             // stale-snapshot race this re-read closes.
             await load({ where: [['id', id]], type: 'complete' });
-            model = objectPool.get(id) ?? model;
+            model = ownRowOrThrow(id) ?? model;
         }
         const snapshot = collaboration.createSnapshot(schemaKey, id);
-        const description = options.description ?? 'editing';
+        const description = claimDescription(options);
         // The self-claim's `ClaimTarget` mirrors what a peer's `claim.state` would
         // report (`state` maps `held.target.model` to `type`), so a holder and a
         // peer see the same `target.type` for one row — the wire model token.
+        // Its `meta` is the DECLARED shape (the handle is a public claim), so the
+        // wire-shaped projection converts back through `declaredMeta` — the same
+        // crossing the HTTP handle assembly makes.
+        const { meta: selfMeta, ...selfNarrowed } = subTarget(options);
         const selfTarget = {
             type: wireModel,
             id,
-            ...(options.field ? { field: options.field } : {}),
-            ...(options.path ? { path: options.path } : {}),
-            ...(options.range ? { range: options.range } : {}),
-            ...(claimMeta(options) ? { meta: claimMeta(options) } : {}),
+            ...selfNarrowed,
+            ...(selfMeta !== undefined ? { meta: declaredMeta(selfMeta) } : {}),
         };
         const ttlMs = options.ttl !== undefined ? toMs(options.ttl) : DEFAULT_LEASE_TTL_MS;
         const expiresAt = Date.now() + ttlMs;
@@ -229,17 +271,20 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
             description,
             expiresAt,
         });
+        const { meta: targetMeta, ...targetNarrowed } = subTarget(options);
         const target = {
             type: schemaKey,
             id,
-            ...(options.field ? { field: options.field } : {}),
-            ...(options.path ? { path: options.path } : {}),
-            ...(options.range ? { range: options.range } : {}),
-            ...(claimMeta(options) ? { meta: claimMeta(options) } : {}),
+            ...targetNarrowed,
+            ...(targetMeta !== undefined ? { meta: declaredMeta(targetMeta) } : {}),
         };
+        // One reading of the heartbeat options — cadence and callbacks from
+        // whichever spelling the caller used (plan object, shorthand, or the
+        // deprecated flat callbacks).
+        const plan = resolveHeartbeatPlan(options);
         // A beat resolves with the server's extended expiry; keep the local
         // self-claim estimate in step so `claim.state` renders the real window,
-        // and surface every answer through `onHeartbeat` (pressure signal).
+        // and surface every answer through the plan's `onBeat` (pressure signal).
         const heartbeat = async (beatOptions) => {
             if (!lease.heartbeat) {
                 throw new AbloValidationError('This claim handle has no heartbeat wiring, which the standard Ablo({ schema, apiKey }) client provides on every claim. This appears only when a claim is minted through an internal path that predates heartbeats.', { code: 'claim_not_wired' });
@@ -252,18 +297,16 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
             const held = activeClaims.get(id);
             if (held)
                 held.expiresAt = beat.expiresAt;
-            options.onHeartbeat?.(beat);
+            plan.onBeat?.(beat);
             return beat;
         };
         // Opt-in auto-heartbeat: the loop beats until release, and a definitive
-        // loss stops it and surfaces through `onHeartbeatLost`.
-        const stopHeartbeatLoop = options.heartbeat
+        // loss stops it and surfaces through the plan's `onLost`.
+        const stopHeartbeatLoop = plan.loop
             ? startClaimHeartbeatLoop({
                 beat: () => heartbeat(),
-                intervalMs: heartbeatCadenceMs(ttlMs, options.heartbeat),
-                ...(options.onHeartbeatLost
-                    ? { onLost: options.onHeartbeatLost }
-                    : {}),
+                intervalMs: heartbeatCadenceMs(ttlMs, plan.cadence),
+                ...(plan.onLost ? { onLost: plan.onLost } : {}),
             })
             : undefined;
         const release = () => {
@@ -305,19 +348,14 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
         const held = collaboration.state({ model: wireModel, id });
         const contended = !!held && held.heldBy !== collaboration.selfParticipantId;
         const failFast = options.queue === false;
-        // Fail-fast (`queue: false`): reject now if a holder is already visible.
-        // Best-effort at the client — a row this participant never synced usually
-        // carries no local claim state either, so a peer gets the deterministic
-        // rejection only once it has observed the holder (entered the row's entity
-        // scope). The server's queue is the backstop for the queuing path.
+        // The try-claim (`queue: false`): resolve `null` if a holder is already
+        // visible — an expected outcome, not an error. Best-effort at the client —
+        // a row this participant never synced usually carries no local claim state
+        // either, so a peer gets the deterministic `null` only once it has
+        // observed the holder (entered the row's entity scope). The server's
+        // queue is the backstop for the queuing path.
         if (failFast && contended) {
-            const claim = claimContextFromClaim(held);
-            throw new AbloClaimedError(formatClaimedErrorMessage({
-                targetLabel: `${registeredModelName}/${id}`,
-                heldBy: held.heldBy,
-                claim,
-                fallback: `${registeredModelName}/${id} is held by ${held.heldBy ?? 'another participant'}.`,
-            }), { code: 'entity_claimed', claims: [claim] });
+            return null;
         }
         // Enter the entity scope before acquiring the lease so the holder's claim
         // presence broadcasts to everyone in this entity group — the same ordering
@@ -329,29 +367,30 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
             target: {
                 model: wireModel,
                 id,
-                ...(options.field ? { field: options.field } : {}),
-                ...(options.path ? { path: options.path } : {}),
-                ...(options.range ? { range: options.range } : {}),
-                ...(claimMeta(options) ? { meta: claimMeta(options) } : {}),
+                // The whole sub-entity locator in one move — listing its members here
+                // is what let `fields` die between the caller and the lease, so the
+                // claim covered the whole row while the caller believed it named parts.
+                ...subTarget(options),
             },
-            description: options.description ?? 'editing',
+            description: claimDescription(options),
             ttl: options.ttl,
             queue: !failFast,
             maxQueueDepth: options.maxQueueDepth,
+            // The one wait cap, declared once on ClaimTargetOptions — the socket
+            // wait and the HTTP poll-wait both honor it as `grant_timeout`.
+            waitTimeoutMs: options.waitTimeoutMs,
+            signal: options.signal,
         });
         // A watermark-only snapshot: `createSnapshot` still reads the engine's
         // current `lastSyncId` even though the pool holds no row (the bucket is
         // empty). It costs nothing extra and gives a write taken under this lease a
         // real `readAt` to guard against changes since the lease was acquired.
         const snapshot = collaboration.createSnapshot(schemaKey, id);
-        const description = options.description ?? 'editing';
+        const description = claimDescription(options);
         const selfTarget = {
             type: wireModel,
             id,
-            ...(options.field ? { field: options.field } : {}),
-            ...(options.path ? { path: options.path } : {}),
-            ...(options.range ? { range: options.range } : {}),
-            ...(claimMeta(options) ? { meta: claimMeta(options) } : {}),
+            ...subTarget(options),
         };
         const ttlMs = options.ttl !== undefined ? toMs(options.ttl) : DEFAULT_LEASE_TTL_MS;
         const expiresAt = Date.now() + ttlMs;
@@ -365,11 +404,11 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
         const target = {
             type: schemaKey,
             id,
-            ...(options.field ? { field: options.field } : {}),
-            ...(options.path ? { path: options.path } : {}),
-            ...(options.range ? { range: options.range } : {}),
-            ...(claimMeta(options) ? { meta: claimMeta(options) } : {}),
+            ...subTarget(options),
         };
+        // One reading of the heartbeat options — cadence and callbacks from
+        // whichever spelling the caller used.
+        const plan = resolveHeartbeatPlan(options);
         // A beat resolves with the server's extended expiry; keep the local
         // self-claim estimate in step so `claim.state` renders the real window.
         const heartbeat = async (beatOptions) => {
@@ -384,16 +423,14 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
             const held = activeClaims.get(id);
             if (held)
                 held.expiresAt = beat.expiresAt;
-            options.onHeartbeat?.(beat);
+            plan.onBeat?.(beat);
             return beat;
         };
-        const stopHeartbeatLoop = options.heartbeat
+        const stopHeartbeatLoop = plan.loop
             ? startClaimHeartbeatLoop({
                 beat: () => heartbeat(),
-                intervalMs: heartbeatCadenceMs(ttlMs, options.heartbeat),
-                ...(options.onHeartbeatLost
-                    ? { onLost: options.onHeartbeatLost }
-                    : {}),
+                intervalMs: heartbeatCadenceMs(ttlMs, plan.cadence),
+                ...(plan.onLost ? { onLost: plan.onLost } : {}),
             })
             : undefined;
         const release = () => {
@@ -434,7 +471,41 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
     // members to read/steer the coordination plane. Attach the readers to the
     // callable so `ablo.<model>.claim(...)` and `ablo.<model>.claim.state(...)`
     // are the same object.
-    const claimApi = Object.assign(claim, {
+    // `state` and `queue` take a caller-named `meta` shape. The runtime cannot
+    // check it and is not meant to: `target.meta` is application data the
+    // protocol carries verbatim and never interprets, so naming its type is the
+    // caller asserting what it put there — the same bargain as parsing your own
+    // JSON into an interface. These read as `Claim` here, and the one assertion
+    // that applies the caller's parameter is on the assignment below, in one
+    // place rather than at every call site.
+    /**
+     * This client's own claim on a row, as a claim-state object.
+     *
+     * The server excludes a holder's own presence frames and the client skips
+     * them, so a row this client holds is absent from every peer-derived read.
+     * Both `state` and `list` therefore synthesize it from the stored lease, and
+     * they do it through here so the two answers cannot describe the same
+     * holding differently.
+     */
+    const ownClaimState = (id) => {
+        const own = activeClaims.get(id);
+        if (!own)
+            return null;
+        return {
+            object: 'claim',
+            id: own.lease.id,
+            status: 'active',
+            target: own.target,
+            description: own.description,
+            heldBy: collaboration?.selfParticipantId ?? '',
+            participantKind: collaboration?.selfParticipantKind ?? 'user',
+            expiresAt: own.expiresAt,
+            // Symmetric with the peer projection: a holder reading its own claim
+            // sees the same `meta` an observer does.
+            ...(own.target.meta !== undefined ? { meta: own.target.meta } : {}),
+        };
+    };
+    const claimReaders = {
         state(params) {
             // Read interest: a passive observer of a row's claim state must enter that
             // row's entity scope, or it sits only on broader `org:`/`user:` groups and
@@ -445,20 +516,27 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
             // the client skips them, so `state` would return null for a row this client
             // holds. Synthesize the active claim from the stored lease so the holder
             // sees its own claim, honoring the documented contract on `claim.state`.
-            const own = activeClaims.get(params.id);
-            if (own) {
-                return {
-                    object: 'claim',
-                    id: own.lease.id,
-                    status: 'active',
-                    target: own.target,
-                    description: own.description,
-                    heldBy: collaboration?.selfParticipantId ?? '',
-                    participantKind: collaboration?.selfParticipantKind ?? 'user',
-                    expiresAt: own.expiresAt,
-                };
-            }
-            return collaboration?.state({ model: wireModel, id: params.id }) ?? null;
+            return (ownClaimState(params.id) ??
+                collaboration?.state({ model: wireModel, id: params.id }) ??
+                null);
+        },
+        /**
+         * Every claim on the row, holders first. Sub-row claims on disjoint parts
+         * are all granted, so a row can have several holders at once and
+         * {@link state} answers with one of them — this is the read that renders
+         * all of them. Same list envelope as {@link queue}, reactive on the same
+         * snapshot, so a render reads it inline.
+         */
+        list(params) {
+            void collaboration?.enterScope?.({ [schemaKey]: params.id });
+            const own = ownClaimState(params.id);
+            const peers = collaboration?.holders({ model: wireModel, id: params.id }) ?? [];
+            return {
+                object: 'list',
+                // Own claim first: the server excludes a holder's own presence frames,
+                // so it is never among `peers` and the two never duplicate.
+                data: own ? [own, ...peers] : [...peers],
+            };
         },
         queue(params) {
             return {
@@ -470,28 +548,17 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
             collaboration?.reorder({ model: wireModel, id: params.id }, params.order);
         },
         release: guard((params) => releaseClaim(isClaimHandle(params) ? params.target.id : params.id)),
-    });
-    const operations = {
-        retrieve: guard(async (params) => {
-            // Read-interest enrolment: reading a row enters its entity scope, so a
-            // client lands in the same group the holder's claim presence fans out
-            // on and `claim.state`/`claim.queue` report peers. Best-effort and
-            // fire-and-forget — it never makes the read reject or run slower.
-            void collaboration?.enterScope?.({ [schemaKey]: params.id });
-            const rows = await load({
-                ...params,
-                where: [['id', params.id]],
-                limit: 1,
-            });
-            return rows[0];
-        }),
-        // No automatic scope enrolment on bulk `list`/`getAll`: that would subscribe
-        // to an unbounded set of rows' entity groups.
-        list: guard(load),
-        get(id) {
-            return objectPool.get(id);
+    };
+    // The one place the caller's `meta` parameter is applied — see the note on
+    // `claimReaders`. Everything else about this object is checked structurally.
+    const claimApi = Object.assign(claim, claimReaders);
+    const local = {
+        retrieve(id) {
+            // Scoped to this model: an id belonging to a sibling model reads as
+            // absent rather than being handed back as if it were a `T`.
+            return objectPool.getOfType(id, registeredModelName);
         },
-        getAll(options) {
+        list(options) {
             const all = objectPool.getByType(ModelClass, (options?.state ?? ModelScope.live));
             let result = all;
             if (options?.where) {
@@ -525,9 +592,28 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
                 result = result.slice(0, options.limit);
             return result;
         },
-        getCount(options) {
-            return this.getAll(options).length;
+        count(options) {
+            return local.list(options).length;
         },
+    };
+    const operations = {
+        local,
+        retrieve: guard(async (params) => {
+            // Read-interest enrolment: reading a row enters its entity scope, so a
+            // client lands in the same group the holder's claim presence fans out
+            // on and `claim.state`/`claim.queue` report peers. Best-effort and
+            // fire-and-forget — it never makes the read reject or run slower.
+            void collaboration?.enterScope?.({ [schemaKey]: params.id });
+            const rows = await load({
+                ...params,
+                where: [['id', params.id]],
+                limit: 1,
+            });
+            return rows[0];
+        }),
+        // No automatic scope enrolment on bulk `list`: that would subscribe to an
+        // unbounded set of rows' entity groups.
+        list: guard(load),
         create: guard(async (params) => {
             const id = params.id ?? Model.generateId();
             const opts = mutationOptions(params);
@@ -547,12 +633,9 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
                     target: {
                         model: wireModel,
                         id,
-                        ...(claim.field ? { field: claim.field } : {}),
-                        ...(claim.path ? { path: claim.path } : {}),
-                        ...(claim.range ? { range: claim.range } : {}),
-                        ...(claimMeta(claim) ? { meta: claimMeta(claim) } : {}),
+                        ...subTarget(claim),
                     },
-                    description: claim.description ?? 'creating',
+                    description: claimDescription(claim, 'creating'),
                     ttl: claim.ttl,
                     queue: claim.queue !== false,
                     maxQueueDepth: claim.maxQueueDepth,
@@ -615,7 +698,7 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
                             // `type: 'complete'` forces the round-trip — the hydration ledger
                             // would otherwise serve a possibly-stale local row for a hydrated id.
                             await load({ where: [['id', id]], type: 'complete' });
-                            const fresh = objectPool.get(id);
+                            const fresh = ownRowOrThrow(id);
                             const snapshot = collaboration.createSnapshot(schemaKey, id);
                             return {
                                 data: fresh ? modelAsRow(fresh) : undefined,
@@ -623,7 +706,7 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
                             };
                         },
                         writeNext: async (patch, readAt) => {
-                            const model = objectPool.get(id);
+                            const model = ownRowOrThrow(id);
                             if (!model) {
                                 throw new AbloValidationError(`Entity not found: ${registeredModelName}/${id}`, { code: 'entity_not_found' });
                             }
@@ -643,6 +726,11 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
                 const autoClaim = params.claim && !isClaimHandle(params.claim) ? params.claim : null;
                 if (autoClaim) {
                     const handle = await takeClaim({ ...autoClaim, id: params.id });
+                    // A declined try-claim is `null` only on the standalone verb; a
+                    // write that could not take its claim is a failed write.
+                    if (!handle) {
+                        throw new AbloClaimedError(`${registeredModelName}/${params.id} is held by another participant, so this update's claim could not be taken.`, { code: 'entity_claimed' });
+                    }
                     try {
                         return await operations.update({ ...params, claim: handle });
                     }
@@ -651,7 +739,7 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
                     }
                 }
                 const { id } = params;
-                const model = objectPool.get(id);
+                const model = ownRowOrThrow(id);
                 if (!model)
                     throw new AbloValidationError(`Entity not found: ${registeredModelName}/${id}`, { code: 'entity_not_found' });
                 // If we hold a claim on this row, guard the write with its snapshot
@@ -702,6 +790,10 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
             const autoClaim = params.claim && !isClaimHandle(params.claim) ? params.claim : null;
             if (autoClaim) {
                 const handle = await takeClaim({ ...autoClaim, id: params.id });
+                // Same rule as update: a write that could not take its claim fails.
+                if (!handle) {
+                    throw new AbloClaimedError(`${registeredModelName}/${params.id} is held by another participant, so this delete's claim could not be taken.`, { code: 'entity_claimed' });
+                }
                 try {
                     await operations.delete({ ...params, claim: handle });
                 }
@@ -711,7 +803,10 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
                 return;
             }
             const { id } = params;
-            const model = objectPool.get(id);
+            // Scoped: "ensure absent" stays idempotent for an id this model simply
+            // doesn't hold, but an id owned by a sibling model throws rather than
+            // deleting a row the caller never addressed.
+            const model = ownRowOrThrow(id);
             // Idempotent delete: "ensure absent". A row that isn't in this client's
             // replicated view is already gone from its perspective, so a delete is a
             // no-op success rather than an `entity_not_found` error. This matches the
@@ -758,13 +853,13 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
             };
             // A track carries no write, so it rides the commit lane as a zero-operation
             // commit: the queue tolerates disconnects and de-dupes replays, and the
-            // server's track-only path registers the dependency and reports anything
+            // server's track-only path registers the premise and reports anything
             // that already fired. Reuse the same lane the batch `commits.create` door
             // uses rather than opening a bespoke transport.
             const clientTxId = typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function'
                 ? crypto.randomUUID()
                 : `tx_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
-            const queue = syncClient.getTransactionQueue();
+            const queue = syncClient.getMutationQueue();
             await queue.enqueueCommit(clientTxId, [], { track: [dep] });
             const { notifications } = await queue.waitForCommitReceipt(clientTxId);
             return notifications && notifications.length > 0 ? { notifications } : {};
@@ -777,8 +872,7 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
         }),
         onChange(callback, options) {
             return autorun(() => {
-                const entities = this.getAll(options);
-                callback(entities);
+                callback(local.list(options));
             });
         },
     };