@abloatai/ablo 0.35.0 → 0.36.0

package/dist/client/createModelProxy.d.ts

@@ -52,6 +52,10 @@ export interface ModelCollaboration {
         queue?: boolean;
         /** Reject (don't wait) if the queue is already this deep when we join. */
         maxQueueDepth?: number;
+        /** Cap on the queued wait before rejecting with `grant_timeout`. */
+        waitTimeoutMs?: number;
+        /** Abort the queued wait — rejects with `claim_wait_aborted`. */
+        signal?: AbortSignal;
     }): Promise<Claim>;
     createSnapshot(modelKey: string, id: string): Snapshot;
     /**
@@ -67,6 +71,12 @@ export interface ModelCollaboration {
      * target because it isn't bound to a single model.
      */
     state(target: EntityHalf): Claim | null;
+    /**
+     * Every active claim on a target, not just one. Sub-row claims on disjoint
+     * parts of a row are all granted, so a row can have several holders at once
+     * and `state` answers with only the first of them.
+     */
+    holders(target: EntityHalf): readonly Claim[];
     /**
      * The reactive wait queue on a target — the FIFO line of queued claims
      * behind the holder. Synchronous snapshot off the synced claim stream.
@@ -223,6 +233,16 @@ interface ReactiveModelSurface<T> {
  * See {@link ReactiveModelSurface}.
  */
 export type ModelOperations<T, CreateInput> = Omit<HttpModelClient<T, CreateInput>, 'claim'> & ReactiveModelSurface<T>;
-export declare function createModelProxy<T, C>(schemaKey: string, registeredModelName: string, objectPool: InstanceCache, syncClient: SyncClient, registry: ModelRegistry, hydration: OnDemandLoader, collaboration?: ModelCollaboration, 
+export declare function createModelProxy<T, C>(schemaKey: string, registeredModelName: string, objectPool: InstanceCache, syncClient: SyncClient, registry: ModelRegistry, 
+/**
+ * The one thing this factory asks of the loader: fetch rows for a model.
+ *
+ * Declared as the slice rather than the whole `OnDemandLoader` because the
+ * whole is a class, and a parameter typed as a class can only ever be
+ * satisfied by an instance of it — so every caller that has a narrower
+ * collaborator, a test most of all, is pushed into a cast through `unknown`
+ * to supply the one method that is actually read.
+ */
+hydration: Pick<OnDemandLoader, 'fetch'>, collaboration?: ModelCollaboration, 
 /** The client-wide `wait` default; a per-call `wait` still wins over it. */
 defaultWait?: 'queued' | 'confirmed'): ModelOperations<T, C>;

package/dist/client/createModelProxy.js

@@ -17,9 +17,14 @@ import { claimDescription, } from '../transaction/coordination/schema.js';
 import { Model, modelAsRow } from '../Model.js';
 import { toMs } from '../transaction/utils/duration.js';
 import { LEASE_TTL_MS } from '../transaction/wire/protocol.js';
-import { heartbeatCadenceMs, resolveHeartbeatOptions, startClaimHeartbeatLoop, } from '../transaction/coordination/claimHeartbeatLoop.js';
+import { heartbeatCadenceMs, resolveHeartbeatOptions, resolveHeartbeatPlan, startClaimHeartbeatLoop, } from '../transaction/coordination/claimHeartbeatLoop.js';
 import { assertWriteOptions } from '../transaction/resources/writeOptionsSchema.js';
 import { modelTarget, subTarget } from '../transaction/coordination/index.js';
+// A named claim-meta crossing (see `claim-meta-crossings-are-enumerated` in
+// .dependency-cruiser.cjs): the reactive proxy's self-claim targets are
+// decodes that build a public claim, so their `meta` converts wire→declared
+// here like the other enumerated crossings.
+import { declaredMeta } from '../transaction/coordination/claimMeta.js';
 import { ModelScope } from '../transaction/types/index.js';
 const modelClientMeta = new WeakMap();
 export function getModelClientMeta(modelClient) {
@@ -27,7 +32,17 @@ export function getModelClientMeta(modelClient) {
         return undefined;
     return modelClientMeta.get(modelClient);
 }
-export function createModelProxy(schemaKey, registeredModelName, objectPool, syncClient, registry, hydration, collaboration, 
+export function createModelProxy(schemaKey, registeredModelName, objectPool, syncClient, registry, 
+/**
+ * The one thing this factory asks of the loader: fetch rows for a model.
+ *
+ * Declared as the slice rather than the whole `OnDemandLoader` because the
+ * whole is a class, and a parameter typed as a class can only ever be
+ * satisfied by an instance of it — so every caller that has a narrower
+ * collaborator, a test most of all, is pushed into a cast through `unknown`
+ * to supply the one method that is actually read.
+ */
+hydration, collaboration, 
 /** The client-wide `wait` default; a per-call `wait` still wins over it. */
 defaultWait) {
     /**
@@ -165,20 +180,15 @@ defaultWait) {
         const held = collaboration.state({ model: wireModel, id });
         const contended = !!held && held.heldBy !== collaboration.selfParticipantId;
         const failFast = options.queue === false;
-        // Fail-fast (`queue: false`): if another participant already holds it,
-        // reject now instead of queuing. Best-effort at the client (a racing
-        // claim not yet synced into our snapshot slips through here) — the
-        // commit-time claim guard is the authoritative backstop that rejects
-        // the loser's first write. For work-distribution dedup that's exactly
-        // right: don't wait (that would double-process), skip.
+        // The try-claim (`queue: false`): a held target is an expected outcome,
+        // not an error, so it resolves `null` — the caller reads `if (!claim)`
+        // and moves on; who holds it stays readable via `claim.state`. Best-effort
+        // at the client (a racing claim not yet synced into our snapshot slips
+        // through here) — the commit-time claim guard is the authoritative
+        // backstop that rejects the loser's first write. For work-distribution
+        // dedup that's exactly right: don't wait (that would double-process), skip.
         if (failFast && contended) {
-            const claim = claimContextFromClaim(held);
-            throw new AbloClaimedError(formatClaimedErrorMessage({
-                targetLabel: `${registeredModelName}/${id}`,
-                heldBy: held.heldBy,
-                claim,
-                fallback: `${registeredModelName}/${id} is held by ${held.heldBy ?? 'another participant'}.`,
-            }), { code: 'entity_claimed', claims: [claim] });
+            return null;
         }
         // Ensure the row exists locally before claiming.
         let model = ownRowOrThrow(id);
@@ -215,6 +225,10 @@ defaultWait) {
             ttl: options.ttl,
             queue: !failFast,
             maxQueueDepth: options.maxQueueDepth,
+            // The one wait cap, declared once on ClaimTargetOptions — the socket
+            // wait and the HTTP poll-wait both honor it as `grant_timeout`.
+            waitTimeoutMs: options.waitTimeoutMs,
+            signal: options.signal,
         });
         // Only when the claim actually waited behind another holder can the row have
         // changed underneath us — re-read so the claimed snapshot reflects what that
@@ -238,10 +252,15 @@ defaultWait) {
         // The self-claim's `ClaimTarget` mirrors what a peer's `claim.state` would
         // report (`state` maps `held.target.model` to `type`), so a holder and a
         // peer see the same `target.type` for one row — the wire model token.
+        // Its `meta` is the DECLARED shape (the handle is a public claim), so the
+        // wire-shaped projection converts back through `declaredMeta` — the same
+        // crossing the HTTP handle assembly makes.
+        const { meta: selfMeta, ...selfNarrowed } = subTarget(options);
         const selfTarget = {
             type: wireModel,
             id,
-            ...subTarget(options),
+            ...selfNarrowed,
+            ...(selfMeta !== undefined ? { meta: declaredMeta(selfMeta) } : {}),
         };
         const ttlMs = options.ttl !== undefined ? toMs(options.ttl) : DEFAULT_LEASE_TTL_MS;
         const expiresAt = Date.now() + ttlMs;
@@ -252,14 +271,20 @@ defaultWait) {
             description,
             expiresAt,
         });
+        const { meta: targetMeta, ...targetNarrowed } = subTarget(options);
         const target = {
             type: schemaKey,
             id,
-            ...subTarget(options),
+            ...targetNarrowed,
+            ...(targetMeta !== undefined ? { meta: declaredMeta(targetMeta) } : {}),
         };
+        // One reading of the heartbeat options — cadence and callbacks from
+        // whichever spelling the caller used (plan object, shorthand, or the
+        // deprecated flat callbacks).
+        const plan = resolveHeartbeatPlan(options);
         // A beat resolves with the server's extended expiry; keep the local
         // self-claim estimate in step so `claim.state` renders the real window,
-        // and surface every answer through `onHeartbeat` (pressure signal).
+        // and surface every answer through the plan's `onBeat` (pressure signal).
         const heartbeat = async (beatOptions) => {
             if (!lease.heartbeat) {
                 throw new AbloValidationError('This claim handle has no heartbeat wiring, which the standard Ablo({ schema, apiKey }) client provides on every claim. This appears only when a claim is minted through an internal path that predates heartbeats.', { code: 'claim_not_wired' });
@@ -272,18 +297,16 @@ defaultWait) {
             const held = activeClaims.get(id);
             if (held)
                 held.expiresAt = beat.expiresAt;
-            options.onHeartbeat?.(beat);
+            plan.onBeat?.(beat);
             return beat;
         };
         // Opt-in auto-heartbeat: the loop beats until release, and a definitive
-        // loss stops it and surfaces through `onHeartbeatLost`.
-        const stopHeartbeatLoop = options.heartbeat
+        // loss stops it and surfaces through the plan's `onLost`.
+        const stopHeartbeatLoop = plan.loop
             ? startClaimHeartbeatLoop({
                 beat: () => heartbeat(),
-                intervalMs: heartbeatCadenceMs(ttlMs, options.heartbeat),
-                ...(options.onHeartbeatLost
-                    ? { onLost: options.onHeartbeatLost }
-                    : {}),
+                intervalMs: heartbeatCadenceMs(ttlMs, plan.cadence),
+                ...(plan.onLost ? { onLost: plan.onLost } : {}),
             })
             : undefined;
         const release = () => {
@@ -325,19 +348,14 @@ defaultWait) {
         const held = collaboration.state({ model: wireModel, id });
         const contended = !!held && held.heldBy !== collaboration.selfParticipantId;
         const failFast = options.queue === false;
-        // Fail-fast (`queue: false`): reject now if a holder is already visible.
-        // Best-effort at the client — a row this participant never synced usually
-        // carries no local claim state either, so a peer gets the deterministic
-        // rejection only once it has observed the holder (entered the row's entity
-        // scope). The server's queue is the backstop for the queuing path.
+        // The try-claim (`queue: false`): resolve `null` if a holder is already
+        // visible — an expected outcome, not an error. Best-effort at the client —
+        // a row this participant never synced usually carries no local claim state
+        // either, so a peer gets the deterministic `null` only once it has
+        // observed the holder (entered the row's entity scope). The server's
+        // queue is the backstop for the queuing path.
         if (failFast && contended) {
-            const claim = claimContextFromClaim(held);
-            throw new AbloClaimedError(formatClaimedErrorMessage({
-                targetLabel: `${registeredModelName}/${id}`,
-                heldBy: held.heldBy,
-                claim,
-                fallback: `${registeredModelName}/${id} is held by ${held.heldBy ?? 'another participant'}.`,
-            }), { code: 'entity_claimed', claims: [claim] });
+            return null;
         }
         // Enter the entity scope before acquiring the lease so the holder's claim
         // presence broadcasts to everyone in this entity group — the same ordering
@@ -358,6 +376,10 @@ defaultWait) {
             ttl: options.ttl,
             queue: !failFast,
             maxQueueDepth: options.maxQueueDepth,
+            // The one wait cap, declared once on ClaimTargetOptions — the socket
+            // wait and the HTTP poll-wait both honor it as `grant_timeout`.
+            waitTimeoutMs: options.waitTimeoutMs,
+            signal: options.signal,
         });
         // A watermark-only snapshot: `createSnapshot` still reads the engine's
         // current `lastSyncId` even though the pool holds no row (the bucket is
@@ -384,6 +406,9 @@ defaultWait) {
             id,
             ...subTarget(options),
         };
+        // One reading of the heartbeat options — cadence and callbacks from
+        // whichever spelling the caller used.
+        const plan = resolveHeartbeatPlan(options);
         // A beat resolves with the server's extended expiry; keep the local
         // self-claim estimate in step so `claim.state` renders the real window.
         const heartbeat = async (beatOptions) => {
@@ -398,16 +423,14 @@ defaultWait) {
             const held = activeClaims.get(id);
             if (held)
                 held.expiresAt = beat.expiresAt;
-            options.onHeartbeat?.(beat);
+            plan.onBeat?.(beat);
             return beat;
         };
-        const stopHeartbeatLoop = options.heartbeat
+        const stopHeartbeatLoop = plan.loop
             ? startClaimHeartbeatLoop({
                 beat: () => heartbeat(),
-                intervalMs: heartbeatCadenceMs(ttlMs, options.heartbeat),
-                ...(options.onHeartbeatLost
-                    ? { onLost: options.onHeartbeatLost }
-                    : {}),
+                intervalMs: heartbeatCadenceMs(ttlMs, plan.cadence),
+                ...(plan.onLost ? { onLost: plan.onLost } : {}),
             })
             : undefined;
         const release = () => {
@@ -455,6 +478,33 @@ defaultWait) {
     // JSON into an interface. These read as `Claim` here, and the one assertion
     // that applies the caller's parameter is on the assignment below, in one
     // place rather than at every call site.
+    /**
+     * This client's own claim on a row, as a claim-state object.
+     *
+     * The server excludes a holder's own presence frames and the client skips
+     * them, so a row this client holds is absent from every peer-derived read.
+     * Both `state` and `list` therefore synthesize it from the stored lease, and
+     * they do it through here so the two answers cannot describe the same
+     * holding differently.
+     */
+    const ownClaimState = (id) => {
+        const own = activeClaims.get(id);
+        if (!own)
+            return null;
+        return {
+            object: 'claim',
+            id: own.lease.id,
+            status: 'active',
+            target: own.target,
+            description: own.description,
+            heldBy: collaboration?.selfParticipantId ?? '',
+            participantKind: collaboration?.selfParticipantKind ?? 'user',
+            expiresAt: own.expiresAt,
+            // Symmetric with the peer projection: a holder reading its own claim
+            // sees the same `meta` an observer does.
+            ...(own.target.meta !== undefined ? { meta: own.target.meta } : {}),
+        };
+    };
     const claimReaders = {
         state(params) {
             // Read interest: a passive observer of a row's claim state must enter that
@@ -466,20 +516,27 @@ defaultWait) {
             // the client skips them, so `state` would return null for a row this client
             // holds. Synthesize the active claim from the stored lease so the holder
             // sees its own claim, honoring the documented contract on `claim.state`.
-            const own = activeClaims.get(params.id);
-            if (own) {
-                return {
-                    object: 'claim',
-                    id: own.lease.id,
-                    status: 'active',
-                    target: own.target,
-                    description: own.description,
-                    heldBy: collaboration?.selfParticipantId ?? '',
-                    participantKind: collaboration?.selfParticipantKind ?? 'user',
-                    expiresAt: own.expiresAt,
-                };
-            }
-            return collaboration?.state({ model: wireModel, id: params.id }) ?? null;
+            return (ownClaimState(params.id) ??
+                collaboration?.state({ model: wireModel, id: params.id }) ??
+                null);
+        },
+        /**
+         * Every claim on the row, holders first. Sub-row claims on disjoint parts
+         * are all granted, so a row can have several holders at once and
+         * {@link state} answers with one of them — this is the read that renders
+         * all of them. Same list envelope as {@link queue}, reactive on the same
+         * snapshot, so a render reads it inline.
+         */
+        list(params) {
+            void collaboration?.enterScope?.({ [schemaKey]: params.id });
+            const own = ownClaimState(params.id);
+            const peers = collaboration?.holders({ model: wireModel, id: params.id }) ?? [];
+            return {
+                object: 'list',
+                // Own claim first: the server excludes a holder's own presence frames,
+                // so it is never among `peers` and the two never duplicate.
+                data: own ? [own, ...peers] : [...peers],
+            };
         },
         queue(params) {
             return {
@@ -669,6 +726,11 @@ defaultWait) {
                 const autoClaim = params.claim && !isClaimHandle(params.claim) ? params.claim : null;
                 if (autoClaim) {
                     const handle = await takeClaim({ ...autoClaim, id: params.id });
+                    // A declined try-claim is `null` only on the standalone verb; a
+                    // write that could not take its claim is a failed write.
+                    if (!handle) {
+                        throw new AbloClaimedError(`${registeredModelName}/${params.id} is held by another participant, so this update's claim could not be taken.`, { code: 'entity_claimed' });
+                    }
                     try {
                         return await operations.update({ ...params, claim: handle });
                     }
@@ -728,6 +790,10 @@ defaultWait) {
             const autoClaim = params.claim && !isClaimHandle(params.claim) ? params.claim : null;
             if (autoClaim) {
                 const handle = await takeClaim({ ...autoClaim, id: params.id });
+                // Same rule as update: a write that could not take its claim fails.
+                if (!handle) {
+                    throw new AbloClaimedError(`${registeredModelName}/${params.id} is held by another participant, so this delete's claim could not be taken.`, { code: 'entity_claimed' });
+                }
                 try {
                     await operations.delete({ ...params, claim: handle });
                 }

package/dist/client/humans.d.ts

@@ -10,19 +10,29 @@
  * Transitional shape: the contract fields do real configuration work
  * (`requires.duplex` rejects it on a request-response client at construction
  * time; `materialises` is the five-second membership test as a checkable
- * property), and `init` constructs what the widened context already carries
- * enough to build — the presence stream, attached to the connection the
- * context carries (the host built it before resolving the plugin list). The
- * rest of the materialiser (store, bootstrap, delta pipeline, framework
- * bindings) still lives in the composition root and migrates here as the
- * context grows to carry what it needs.
+ * property), and `init` constructs what the widened context carries enough
+ * to build — the presence stream, attached to the connection the context
+ * carries, and the store cluster (this client's runtime, the component
+ * graph, the registered models, and the `BaseSyncedStore`), now that the
+ * context carries the resolved url and the credential source. What still
+ * lives in the composition root — the credential lifecycle, `ready()`, the
+ * model proxies, the resources, the framework bindings — migrates here as
+ * the context grows to carry what it needs.
  */
-import type { PluginContext } from '../transaction/plugin.js';
+import type { PluginContext, AppliedChange } from '../transaction/plugin.js';
+import type { SchemaRecord } from '../transaction/schema/schema.js';
 import { type AttachablePresenceStream } from '../sync/createPresenceStream.js';
+import { kStoreCluster, type StoreCluster } from './storeCluster.js';
+import type { InternalAbloOptions } from './options.js';
 /**
  * What `humans()` contributes to the client — exactly the members that merge
  * onto it, nothing else. Whether a plugin materialises is declared on the
  * plugin itself, never restated on its surface.
+ *
+ * The one exception is deliberate and invisible to merging:
+ * {@link kStoreCluster} is symbol-keyed, and surface members merge onto the
+ * client by string key alone — so the cluster reaches the host without ever
+ * becoming client API.
  */
 export interface HumansSurface {
     /**
@@ -31,6 +41,13 @@ export interface HumansSurface {
      * the wire send, and the stream re-announces on every connect.
      */
     readonly presence: AttachablePresenceStream;
+    /**
+     * The constructed store cluster, when the context carried enough to build
+     * it (the connection, the resolved url, the credential source, and a
+     * schema). Absent on a thinner context — the presence stream's own
+     * tolerance, applied to the store.
+     */
+    readonly [kStoreCluster]?: StoreCluster;
 }
 /**
  * The reactive materialiser. Installed by default when `Ablo({ ... })` is
@@ -43,6 +60,10 @@ export declare function humans(): {
         readonly duplex: true;
     };
     readonly materialises: true;
-    readonly stage: "apply";
-    readonly init: (context: PluginContext) => HumansSurface;
+    readonly stages: {
+        readonly apply: ({ changes }: {
+            readonly changes: readonly AppliedChange[];
+        }) => void;
+    };
+    readonly init: (context: PluginContext<InternalAbloOptions<SchemaRecord>>) => HumansSurface;
 };

package/dist/client/humans.js

@@ -10,20 +10,28 @@
  * Transitional shape: the contract fields do real configuration work
  * (`requires.duplex` rejects it on a request-response client at construction
  * time; `materialises` is the five-second membership test as a checkable
- * property), and `init` constructs what the widened context already carries
- * enough to build — the presence stream, attached to the connection the
- * context carries (the host built it before resolving the plugin list). The
- * rest of the materialiser (store, bootstrap, delta pipeline, framework
- * bindings) still lives in the composition root and migrates here as the
- * context grows to carry what it needs.
+ * property), and `init` constructs what the widened context carries enough
+ * to build — the presence stream, attached to the connection the context
+ * carries, and the store cluster (this client's runtime, the component
+ * graph, the registered models, and the `BaseSyncedStore`), now that the
+ * context carries the resolved url and the credential source. What still
+ * lives in the composition root — the credential lifecycle, `ready()`, the
+ * model proxies, the resources, the framework bindings — migrates here as
+ * the context grows to carry what it needs.
  */
+import { AbloValidationError } from '../transaction/errors.js';
 import { createPresenceStream, } from '../sync/createPresenceStream.js';
+import { buildStoreCluster, kStoreCluster, } from './storeCluster.js';
 /**
  * The reactive materialiser. Installed by default when `Ablo({ ... })` is
  * constructed over the socket with no `plugins` list; listed explicitly, it
  * reads as what it is — this client renders for people.
  */
 export function humans() {
+    // The apply handler's target. `init` binds it to the store it constructs;
+    // until then the handler is a no-op, and nothing dispatches before then —
+    // the store itself is the pipeline that dispatches.
+    let applyChanges = null;
     return {
         id: 'humans',
         // Live queries, presence, and claim push are server-initiated frames, so
@@ -33,19 +41,37 @@ export function humans() {
         // The point of the plugin: it keeps a local copy of rows. A stateless
         // caller can assert its own list is uniformly false.
         materialises: true,
-        // Deltas land in the materialised in-memory graph at `apply`.
-        stage: 'apply',
-        init: (context) => ({
-            presence: createPresenceStream({
-                participantId: context.participant?.id ?? '',
-                syncGroups: [...(context.syncGroups ?? [])],
-                // Peers' kinds are server-stamped; only the local `self` entry is ours.
-                isAgent: context.participant?.kind === 'agent',
-            }, 
-            // The host built the connection before resolving the plugin list, so
-            // the stream attaches now and starts the moment the feed opens.
-            context.transport ?? null),
-        }),
+        stages: {
+            // Deltas land in the materialised in-memory graph at `apply` — the
+            // declaration and the handler are one field, so this cannot name a
+            // stage and forget the work.
+            apply: ({ changes }) => { applyChanges?.(changes); },
+        },
+        init: (context) => {
+            const cluster = buildStoreCluster(context);
+            if (cluster) {
+                // One client per humans() instance: the apply handler routes into
+                // the store this init built, so a shared instance would silently
+                // apply one client's deltas into another client's store.
+                if (applyChanges) {
+                    throw new AbloValidationError('This humans() instance is already installed on a client. ' +
+                        'Construct a fresh humans() for each Ablo({ ... }) call.', { code: 'invalid_options', param: 'plugins' });
+                }
+                applyChanges = (changes) => { cluster.store.applyChangesToPool(changes); };
+            }
+            return {
+                presence: createPresenceStream({
+                    participantId: context.participant?.id ?? '',
+                    syncGroups: [...(context.syncGroups ?? [])],
+                    // Peers' kinds are server-stamped; only the local `self` entry is ours.
+                    isAgent: context.participant?.kind === 'agent',
+                }, 
+                // The host built the connection before resolving the plugin list, so
+                // the stream attaches now and starts the moment the feed opens.
+                context.transport ?? null),
+                ...(cluster ? { [kStoreCluster]: cluster } : {}),
+            };
+        },
         // `satisfies` rather than a return annotation, so `id` keeps its literal
         // type and a plugin list's surface can be keyed by id at the type level.
     };

package/dist/client/reactiveEngine.d.ts

@@ -1,18 +1,18 @@
 /**
- * The reactive engine build — everything `humans()` means at construction
- * time (ADR 0016). `Ablo({ ... })` resolves auth and capabilities, then hands
- * this module the prelude; from here on it is all materialisation: the
- * runtime context, the internal components, the store and its credential
- * lifecycle, presence and claim streams, the typed model proxies, and the
- * commit/claim/session resources — assembled into the reactive client.
+ * The reactive engine assembly (ADR 0016). `Ablo({ ... })` resolves auth and
+ * capabilities; `humans().init` constructs the store cluster; the lifecycle
+ * — first mint, identity, ready() — lives in `./storeLifecycle.ts`. What
+ * remains here is assembly around those parts: the claim stream and
+ * participant manager, options validation, the typed model proxies, and the
+ * commit/claim/session resources — composed into the reactive client.
  *
  * Extracted from the factory so the composition root stays a root: resolve,
- * dispatch, return. The construction moves behind `humans().init` proper when
- * the plugin context can carry these inputs — until then the factory calls
- * this directly for the humans-installed path.
+ * dispatch, return. The remaining assembly converts to decoration of a
+ * host-built core client with the per-model surface split — the cut's own
+ * design step (docs/plans/package-split.md).
  */
 import type { SchemaRecord } from '../transaction/schema/schema.js';
-import type { MutationExecutor } from '../interfaces/index.js';
+import type { StoreCluster } from './storeCluster.js';
 import type { SyncWebSocket } from '../sync/SyncWebSocket.js';
 import type { AttachablePresenceStream } from '../sync/createPresenceStream.js';
 import type { AbloOptions } from './options.js';
@@ -28,7 +28,6 @@ import type { Ablo } from './Ablo.js';
  */
 export interface ReactiveEngineInputs<S extends SchemaRecord> extends ClientPrelude<S> {
     options: AbloOptions<S>;
-    executor: MutationExecutor;
     /**
      * The connection, constructed by the factory before the plugin list
      * resolved — the same instance `PluginContext.transport` carries. The
@@ -38,6 +37,12 @@ export interface ReactiveEngineInputs<S extends SchemaRecord> extends ClientPrel
     /** The humans() plugin's contribution — built by its `init`, already
      *  attached to the connection the context carried. */
     presence: AttachablePresenceStream;
+    /**
+     * The store cluster `humans().init` constructed from the widened context:
+     * this client's runtime, the component graph, and the store. The engine
+     * assembles around it and constructs none of it.
+     */
+    cluster: StoreCluster;
     /**
      * Constructs a sibling client (`ablo.agents.create(...)` mints a scoped key
      * and builds a second engine with it). Injected by the factory — a direct