@abloatai/ablo 0.36.0 → 0.37.0

package/CHANGELOG.md

@@ -1,2038 +1,96 @@
 # Changelog
 
-## 0.36.0
+## 0.37.0
 
 ### Minor Changes
 
-- 816081b: `claim({ id })` now means the same thing on every transport: serialize me
-  behind whoever holds this row. The stateless HTTP client used to reject a
-  contended claim with `claim_queued` and leave the wait to you; now it holds
-  your place in the server's FIFO line — heartbeating the queued ticket under
-  the hood — and resolves to the same held claim the realtime client hands
-  back, with the row re-read after the grant so your snapshot reflects what the
-  previous holder committed. The contended-agent snippet is copy-pastable
-  between a browser tab and a Lambda without edits. Shape the wait the same way
-  on either transport: the new `waitTimeoutMs` caps it (rejects `grant_timeout`
-  and leaves the line), the new `signal` cancels it from outside (an
-  `AbortSignal` — a cancelled agent task or an unmounted component takes its
-  queued claim with it, rejecting `claim_wait_aborted`), `maxQueueDepth` bounds
-  the line you'll join, and `queue: false` is now the try-claim: a held
-  target resolves `null` — a declined try is an expected outcome, not an
-  error — so claim-or-skip dedup reads `if (!claim) return` with no
-  try/catch. (Previously it rejected with `entity_claimed`; a _write_ to a
-  held row still does.)
+- f60ed16: Harden browser authentication around one typed credential endpoint contract,
+  full-plane persistence isolation, awaited terminal cleanup, actual credential
+  expiry, and least-privilege human sessions.
 
-  For callers that manage the wait themselves, the HTTP client gains an
-  `ablo.claims` namespace — the ticket surface: `retrieve({ claimId })` polls a
-  ticket to its grant (fence token included), `heartbeat({ claimId, ttl? })`
-  keeps a held or queued lease alive by its id, `heartbeatAll({ ttl? })`
-  extends every lease your identity holds in one round trip, and
-  `release({ claimId })` gives a ticket back, promoting the waiters behind you.
+  Human session minting now requires a non-empty schema-typed `can` grant. It
+  accepts concrete model operations and has no all-data wildcard. Browser
+  credentials remain short-lived, refreshable, and isolated from long-lived
+  server secrets.
 
-  Claims can also target part of a row — a `path` into a document, a `range` of
-  text, a `field` or set of `fields` — and two claims on non-overlapping parts
-  of the same row are both granted. The engine has enforced this all along; it
-  is now documented (the coordination reference leads with it), proven by
-  grant-level tests, and gated so the docs can never again describe a narrower
-  target than the wire accepts. The part names also read your schema now:
-  `field` and `fields` autocomplete from the model's own field names, and an
-  app-defined part — a cell, a section — has an explicit spelling: `part('B2')`
-  (exported from the package root), which will become the only spelling for
-  non-field names once the typed react binding removes the last loose arm.
-  Inverted ranges (`startLine > endLine`) are rejected at the boundary instead
-  of granting a lease that excludes no one.
+  Endpoint URLs move from `apiKey` to `authEndpoint`. The canonical session and
+  capability mint routes are `/v1/ephemeral_keys` and `/v1/capabilities`; legacy
+  route aliases are removed.
 
-  The claim options themselves now show their structure: every option sits on
-  one of four axes — what you claim (`field`/`fields`/`path`/`range`), what
-  others see (`description`/`meta`), how you wait
-  (`queue`/`maxQueueDepth`/`waitTimeoutMs`/`signal`), and how long you hold
-  (`ttl`/`heartbeat`) — and the docs and the type read in that order. The
-  lease axis slims from four members to two:
-  `heartbeat: { every?, onBeat?, onLost? }` carries the cadence and both
-  callbacks in one place, with `true` and a bare duration still the
-  shorthands. Removed: the flat `onHeartbeat` and `onHeartbeatLost` options —
-  move each callback onto the plan, unchanged: `heartbeat: { onBeat, onLost }`.
+  Credential providers now use the `CredentialProvider` type. The former
+  `ApiKeySetter` export is removed.
 
-  The react layer gains its typed binding: `createAbloReact(schema)` (from
-  `@abloatai/ablo/react`) returns `{ AbloProvider, useAblo }` with the schema
-  captured once — the one-binding-file convention of tRPC and typed
-  react-redux hooks. Components import `useAblo` from your `lib/ablo` and
-  never spell a type argument; the global `AbloProvider`/`useAblo<R>` keep
-  working unchanged.
+- 16cc7d1: Claims are field-granular. The `path` and `range` claim targets are removed, and
+  a claim narrows to a whole field or set of fields and no finer. Two agents on the
+  same row proceed concurrently when they hold different fields, and serialize when
+  they share one.
 
-  Coordination errors now name the next call: `grant_timeout` says how to
-  rejoin or proceed, `stale_context` points at the functional update, and
-  `queue_too_deep` distinguishes its claim meaning from its write meaning.
-  Removed: the `claim_wait_poll_interval_required` error code — no code path
-  ever raised it, so no caller can be affected.
+  This is a breaking removal (the `path` and `range` claim options, the
+  `TargetRange` type, and sub-field conflict semantics are gone) and a deliberate
+  one. A claim must not promise finer exclusion than the write path can deliver,
+  and the smallest thing a write addresses is a whole field: nothing writes part of
+  a value. `path`/`range` let two writers hold disjoint spans of one field and told
+  them it was safe, which it is not until concurrent edits to one field can be
+  reconciled (operational transformation). Until that lands, field is the floor;
+  when it lands, sub-field targets return, working.
 
-- 7950669: A new `@abloatai/ablo/syncLog` subpath exposes the canonical sync-log contracts:
-  the Zod schemas and types for a delta's position and identity (`deltaPosition`,
-  `clientMutationId`, `sourceCorrelationId`, `sourceChangeId`, `replicationLsn`),
-  and the `commitDispatchMarker` that names the delta range a commit wrote. These
-  are the single definition the client and server both read, so a tool that
-  follows or reconciles the log validates positions and markers against the same
-  shapes the engine enforces.
-- 61e4daf: The `/testing` subpath no longer ships. It carried the package's own test
-  scaffolding — mocks, fixtures, and harnesses built on internals that were never
-  a stable contract. If your tests need a stand-in for the write path, implement
-  the public `MutationExecutor` interface from the `/core` subpath; a recording
-  executor is about eighty lines and stays type-checked against the same contract
-  the real client uses. For storage-adapter authors, `/source/conformance` remains
-  the supported suite for proving an adapter correct.
+  If you narrowed a claim by `path` or `range`, claim the field the position lives
+  in instead: `fields: ['content']`. To describe a sub-field region to peers for
+  display, put it in `meta` — that promises nothing about exclusion.
 
-## 0.35.0
+- 08a3cad: Launch the branded Ablo package as the single package application developers
+  install. The root serves headless HTTP callers, while `/client` and `/react`
+  serve WebSocket-backed reactive applications.
 
-### Minor Changes
-
-The `@abloatai/ablo/agent` entry point is removed, along with the single name it exported, `Agent`.
-
-There is no separate agent SDK, and in practice there has not been one for some time: an agent is
-the same client with a different transport. `Ablo({ schema, apiKey, transport: 'http' })` returns a
-stateless, request/response client whose credential is its identity, carrying the same typed
-`ablo.<model>` surface a browser or a server action uses, minus the parts that need a socket — the
-`local` reads and `onChange`, which are absent from the type rather than failing at runtime. A
-second entry point offered a second way in and, mostly, a second thing to keep in step with the
-first. If you imported from `@abloatai/ablo/agent`, import from `@abloatai/ablo` and select the
-transport.
-
-`ClaimEvent.participantKind` is also removed. A claim event is one transition in a lease's
-lifecycle — acquired, queued, granted, lost, rejected, expired — and it identifies the actor that
-moved it. Whether that actor was a person, an agent, or the system is a property of the holder, not
-of the transition, and stating it on every event meant maintaining the same fact in two shapes. Read
-it where the holder is described instead: `ablo.<model>.claim.state({ id })` returns the current
-holder with its `participantKind`, which is what the "an agent is editing this" affordance in a UI
-has always read.
-
-The client is now the coordination layer, and the things built on top of it are
-capabilities you install rather than parts of the client you get whether you use
-them or not.
-
-```ts
-import { Ablo, humans } from '@abloatai/ablo';
-
-const ablo = Ablo({ schema, apiKey, plugins: [humans()] });
-```
-
-`humans()` declares the local, watchable copy: the offline store, live queries,
-presence, and the framework bindings — everything that exists because a person
-is looking at the screen. What remains underneath is what coordination actually
-needs: commit, read, observe, claim. Omit `plugins` and `humans()` is installed
-for you, so an application that renders anything today keeps working with no
-change; naming it in the list only makes visible what was already true.
-
-There is no `agents()` counterpart, and the absence is the point. An agent is
-not a special caller that needs its own mode — it is the ordinary one, and what
-it needs is the client without the materialiser. That is the same observation
-behind removing the `/agent` entry point in this release: there was never a
-second SDK to enter, only a client with a transport that does not open a socket.
-`Ablo({ schema, apiKey, transport: 'http' })` is the whole of it, and because
-`humans()` requires a duplex connection, asking for it on that client fails while
-the client is being constructed, with an error naming the plugin, rather than
-resolving to a presence stream that can never receive a frame. A plugin listed
-twice fails the same way.
-
-The rearrangement is also why the reactive `ablo.<model>` surface composes from
-the transport-independent one rather than restating it — the note on the renamed
-local reads describes what that buys — and why `track`, a durable premise that
-keeps no local copy, sits in the core where an agent can reach it without
-installing a materialiser it has no use for.
-
-This is a seam, not a finished migration. `humans()` today constructs the
-presence stream and declares the constraint that keeps it off a stateless
-client; the rest of the materialiser — the store, the bootstrap, the delta
-pipeline, the framework bindings — still lives in the composition root and moves
-behind the same door as the plugin context grows to carry what each piece needs.
-The contract those pieces will arrive through is the one published here, so a
-capability written against it now keeps working as they do.
-
-The shape of a claim's `meta` is now declared once, on `Register`, beside your
-schema:
-
-```ts
-declare module '@abloatai/ablo' {
-  interface Register {
-    Schema: typeof schema;
-    ClaimMeta: { blocks: string[] };
-  }
-}
-```
-
-From then on `claim.state({ id })?.target.meta`, every entry in `claim.queue`,
-and the claim you hold under `await using` all read that shape, and the `typeof`
-guard each of those reads used to need is gone. The same declaration types what
-you write — `claim({ id, meta: { blocks } })` — so the writer and every reader
-agree by construction rather than by convention, which is the half a per-call
-type argument could never reach: naming the shape at the read site said nothing
-about what the write site was allowed to put there.
-
-Prefer the registration to the per-call `claim.state<MyMeta>({ id })`, because
-one declaration is one place to change when the metadata grows a field. The
-type argument remains supported and is still the honest answer for a program
-carrying more than one metadata shape; only its default moved, from a bare
-record to whatever you registered. A program that registers nothing sees no
-change at all — `target.meta` stays the loose record it has always been.
-
-What travels between participants is untouched. Claim metadata is carried
-verbatim and never interpreted, and the protocol keeps accepting any object it
-is given, so a peer on a newer build can send a field this one has never heard
-of and it still arrives intact. The declaration is a promise about what your own
-program writes, not a filter on what it receives.
-
-A model's conflict stance can be written as a chain through one name.
-
-```ts
-import { coordination, model, z } from '@abloatai/ablo/schema';
-
-export const cards = model(
-  {
-    title: z.string(),
-  },
-  {
-    conflict: coordination.humansOverwrite().agentsReject(),
-  }
-);
-```
-
-The nine disposition rules were the only loose functions left in the schema DSL.
-Everything else there arrives under a noun that owns it — `relation.belongsTo`,
-`field.string`, `mutable.lazy` — but declaring that humans overwrite and agents
-yield meant importing three separate names to say one thing, and a schema with a
-couple of stances spent more of its import list on conflict rules than on the rest
-of the language combined.
-
-So the rules now hang off `coordination`, and each one returns an axis that is
-still open to the next, the way a field chains its own modifiers. The rules
-themselves are unchanged, and each remains the single place its disposition map is
-written; the chain delegates to the standalone function rather than restating it.
-Those standalone functions stay exported, and `coordination()` still merges them,
-which is the form to reach for when the rules are assembled at runtime rather than
-written out:
-
-```ts
-const stance = coordination(humansOverwrite(), agentsReject());
-```
-
-Both forms produce the same plain, serializable map keyed by the committer's
-participant kind — `{ user: 'overwrite', agent: 'reject' }` — and the engine reads
-it at the commit chokepoint exactly as before. A kind left unnamed still falls
-through to the engine default, and a kind named twice still takes the later rule.
-
-`captureTransactionFailure` on the observability provider is renamed to `captureMutationFailure`.
-If you pass an `observability` provider to `Ablo(...)`, rename that one method; its argument is
-unchanged.
-
-The rename frees a word that had been doing two jobs. A transaction, in this system, is a unit of
-write that settles — the thing you author, hand to the engine, and get a receipt for. But the same
-word also named the client's optimistic queue, the buffer of writes that have been applied locally
-and are still waiting for the server to agree. The callback belonged to the second meaning: it
-fires when a queued write has exhausted its attempts and will never land, so the local change is
-rolled back and something upstream needs to hear about it. Calling that a transaction failure
-invited the reading that a settlement had failed, which is a different event with a different
-remedy — and as the settlement layer grew a vocabulary of its own, the collision stopped being
-cosmetic.
-
-There is no compatibility alias, and the reason is worth stating, because it is the opposite of
-the usual one. `captureMutationFailure` is a required member of the provider interface. A provider
-still carrying the old spelling therefore does not satisfy that interface at all: the compiler
-stops the build and names the missing member, at the line where the provider is constructed. An
-optional alias would have made that build succeed while the engine went on calling a method the
-provider does not implement — quiet in exactly the way a renamed callback must not be. The
-compiler is the better messenger here, and this note is the rest of the message.
-
-`debug`, `logLevel`, and `persistence` are no longer accepted on the stateless HTTP client. They
-remain exactly where they have always worked — on the default client, over the socket.
-
-They were reachable on `Ablo({ transport: 'http' })` only because that client's options type was
-assembled from the whole composition bag rather than from the fields the transport actually reads,
-and nothing on the HTTP path ever read them. `persistence` configures a local store a stateless
-client does not keep. `debug` and `logLevel` turn on the `[Ablo]` coordination trace, which
-narrates presence, claim grants, and queueing — frames that arrive over a socket an HTTP client
-never opens. Passing any of the three was accepted and did nothing, which is the kind of option
-that costs a reader an afternoon before they conclude the feature is broken.
-
-If you passed one to an HTTP client, delete it: nothing changes, because nothing was happening.
-If what you wanted was the trace from a server-side worker, it is not a setting you were missing —
-a stateless agent holds no live session to narrate, and its writes are visible in the audit log and
-in `ablo logs` instead.
-
-A model's load strategy is now `'instant'` or `'lazy'`, and nothing else. The
-word `'manual'` is gone, along with the `mutable.manual(...)` helper that set
-it.
-
-The strategy had drifted into two declarations that never agreed. The authoring
-side, reached through `@abloatai/ablo/schema`, offered `'instant' | 'lazy' |
-'manual'`. The runtime side, reached through `@abloatai/ablo/core` under the
-same name, offered `instant`, `lazy`, `partial`, `explicitlyRequested`, and
-`local`. Importing `LoadStrategy` from the two paths gave you two different
-types, and no compiler anywhere would tell you which one you had.
-
-Only `instant` and `lazy` were ever real. `'manual'` promised loading a model
-"only when you explicitly call `sync.model.load()`", a method that was never
-built; a model declared manual resolved to `lazy` and loaded on first access
-like any other. `partial` had live branches in the client but no way to declare
-it, and `explicitlyRequested` and `local` had neither. So the correction is
-mostly the removal of vocabulary that described behavior the engine did not
-have — a model that said `manual` was already behaving as `lazy`, and continues
-to, which is why this changes what your schema is allowed to say rather than
-what your program does.
-
-Replace `load: 'manual'` with `load: 'lazy'`, and `mutable.manual(...)` with
-`mutable.lazy(...)`. `readOnly.internal(...)` stays, and its guarantee is
-unchanged and worth restating plainly: it is a write boundary, not a read one.
-Clients cannot commit to an internal model, and the server rejects any attempt.
-Its rows still reach a client that reads the model.
-
-`LoadStrategy` now has one declaration behind both import paths. It reads as a
-value where the engine branches on it — `LoadStrategy.instant` — and as the
-plain string an author types in `model(…, { load: 'instant' })`, and the two
-can no longer name different sets.
-
-Two names join it on `@abloatai/ablo/schema`. `DEFAULT_LOAD_STRATEGY` is the
-strategy a model gets when it declares none, and `loadsAtBootstrap(load)`
-answers whether a model's rows arrive in the bootstrap payload or on first
-access. The predicate is exported because both halves of the system have to
-agree on it: the client builds its bootstrap subscription from the schema and
-the server assembles the payload from the same schema, and they had been
-asking the question in three different spellings — `load !== 'lazy'` in one
-place, `load === 'instant'` in another. Against two members those agree. A
-third member would have had one side enrolling it and the other withholding it,
-which surfaces as rows that never arrive, a long way from the line responsible.
-
-- The three synchronous reads on `ablo.<model>` are renamed. `get(id)`, `getAll(options)`,
-  and `getCount(options)` become `local.retrieve(id)`, `local.list(options)`, and
-  `local.count(options)`.
-
-The old names were a pair that carried no information. `get` and `retrieve` are
-synonyms in English, so a reader who found `ablo.tasks.get(id)` beside
-`ablo.tasks.retrieve({ id })` had no way to tell from the words which one waited
-on the network and which one did not — the difference had to be memorised, and
-it was memorised imperfectly. Two bugs reached review that way, both of them a
-synchronous read standing in for an asynchronous one against a graph that had
-not warmed up yet, both of them invisible in the diff because the line read
-exactly like the call it should have been.
-
-The new names say the thing out loud. Every verb is the verb it already was on
-the asynchronous side; the only addition anywhere in the design is the word
-`local`, and it is a narrowing rather than a claim about its sibling.
-`retrieve` consults the local graph first and falls back to the network;
-`local.retrieve` is restricted to what is already resident, which is also why it
-can hand back a value instead of a promise. There is nothing to await. Reading
-`ablo.tasks.local.list({ where })`, you know both what it does and what it costs
-without leaving the line.
-
-The reads themselves are unchanged — same options, same lifecycle `state`
-filter, same reactivity inside `useAblo` selectors and in render. Only the path
-to them moved, and it is the only path: the local reads are not also exposed at
-the top level, because a namespace that duplicates what sits beside it stops
-disambiguating anything.
-
-Underneath, the rename arrives with a structural change that will keep the
-surface honest from here on. The reactive `ablo.<model>` type was hand-written as
-a second list that happened to agree with the transport-independent one, and
-nothing linked them: a verb added to one said nothing about the other. It is now
-composed from that base rather than restated, so a verb added there arrives on
-the reactive client on its own. `track` — registering a durable premise on a
-row — is the first to arrive that way.
-
-Migrating is mechanical, but reach for the compiler rather than a search. `getAll`
-and `getCount` are distinctive enough to find by name; `get` is not, and in a
-codebase of any size it hides among the `Map.get` and `headers.get` calls that a
-search cannot tell it from. Removing the old names from the type turns the
-question into a list of type errors, each one a site that genuinely needs to
-move.
-
-A capability is declared in the vocabulary you write, and every other spelling
-of it derives from that declaration.
-
-```ts
-import { grantedOperations, modelWireNames } from '@abloatai/ablo/auth';
-
-const operations = grantedOperations(
-  { documents: ['read', 'update'] },
-  modelWireNames(schema.models)
-);
-```
-
-The same grant used to be spelled five times: a literal union in the resource
-types, a `z.array(z.string())` on the wire, a field-by-field parser in the mint
-route, an object literal in the response type, and a hand-written `model.verb`
-array at every caller that mints without the SDK. Nothing failed when those
-drifted apart. The drift surfaced later as `capability_scope_denied` on a grant
-the caller was certain it held, at a call site with no view of the spelling that
-had gone stale.
-
-They are now one module on `@abloatai/ablo/auth`. `capabilityOperationSchema`
-holds the verb vocabulary; `grantedOperationSchema` derives the wire pattern
-`<model>.<verb>` from it as a template literal, so tightening the verbs cannot
-leave a stale regex or a stale published contract behind. `CapabilityCan<S>`
-narrows the declaration to one schema's models, so `can: { tasks: ['update'] }`
-fails to compile against a schema with no `tasks` model.
-
-`modelWireNames` is the derivation worth knowing about, because it is the one
-people got wrong by hand. A model whose type name is overridden — schema key
-`documents`, type name `Document` — must be granted as `document.update`, and a
-caller who works that out by eye learns otherwise at enforcement time. Pass your
-schema's models and the map is built for you. It is a required argument rather
-than an optional one: an omitted map would mint the schema key verbatim, which
-is right for most models and wrong for exactly the ones that need it.
-
-Two more derivations ride along. `expandReadYourWrites` appends `<model>.read`
-for every model the grant can write, because a scoped agent that may update a
-row has to be able to read it or the read gate starves the writes the grant
-allows — write verbs stay the source of truth, reads are derived and deduped,
-and a model the grant cannot write stays unreadable. And a grant is now checked
-against the schema **at the mint**: `capabilityModelAliases` accepts any of the
-three names one model answers to (type name, schema key, table name), and
-`unresolvableOperations` reports the ones that name nothing, so a typo is a
-rejected mint rather than a credential that looks healthy until its first write.
-
-### Breaking
-
-`ExchangeApiKeyRequest.operations` narrows from `readonly string[]` to
-`readonly GrantedOperation[]`. If you assembled that array by hand, the compiler
-will now reject any entry that is not `<model>.<verb>` — including the `'*'`
-wildcard, which was never a member of the wire form and is no longer typable as
-one. Build the array with `grantedOperations(can, modelWireNames(schema.models))`
-instead of composing the strings; that is the same call the SDK makes, and it
-resolves the type-name override you would otherwise have to remember.
-
-Three error codes carried the word "intent", left over from the vocabulary the
-coordination layer used before it settled on claims. The word had come to mean
-two unrelated things in the same registry, so both are now named for what they
-are.
-
-`invalid_intent` is removed. It was raised when a claim request failed to name
-the model and row it targeted — which is what `malformed_claim` already
-described, in the same words, for the same failure arriving over the WebSocket
-instead of over HTTP. The two have been merged into `malformed_claim`; a caller
-switching on `invalid_intent` should switch on `malformed_claim` instead, and
-the HTTP status is 400 either way.
-
-`slide_intent_missing_deck_id` and `slide_intent_unknown_sibling` are renamed to
-`position_missing_parent` and `position_unknown_sibling`. These were never about
-claims at all: they report that a row created at a position stated relative to
-its neighbours — "before this one" — could not have that position resolved,
-because the parent it belongs to was not named or because the neighbour is not
-in it. An earlier rename had swept the word "claim" through their descriptions
-and left them reading as contention errors. The slide and the deck have gone the
-same way as the intent: nothing in the rule is particular to a deck, and a
-registry that every schema's callers switch on should not name one consumer's
-models, so the codes and their messages now speak of a row and its parent. Both
-remain `validation` errors carrying a 400.
-
-`malformed_claim` moves from the `claim` category to `validation`, alongside
-`malformed_subscription`. The code, its 400 status, and its meaning are
-unchanged — only the grouping it appears under in the error documentation. The
-`claim` category now holds only genuine contention, which is what its name
-promised.
-
-`model()` now takes a shape and one options object. Relations, which used to hold a
-positional argument of their own in between, are the `relations` key on those options.
-
-```ts
-documents: model(
-  {
-    title: z.string(),
-    projectId: z.string(),
-  },
-  {
-    relations: { project: relation.belongsTo('projects', 'projectId') },
-    conflict: coordination(humansOverwrite(), agentsReject()),
-    load: 'lazy',
-  }
-),
-```
-
-The middle argument was the problem. Most models have no relations at all, yet nearly
-every model has something to say about itself — a table it maps to, a load strategy, a
-conflict disposition — and the only way to reach that third argument was to write the
-second one first. So the schema filled up with empty braces standing in for edges that
-did not exist. In this repository alone the placeholder appeared 104 times, which made
-`{}` the single most common thing anyone ever passed in that position: more often than
-any real relations object. A reader opening a schema met the empty braces before they
-met the model.
-
-Nothing about relations themselves changes. They are built with the same
-`relation.belongsTo` and `relation.hasMany` factories, they carry the same options, and
-the engine reads them exactly as before — to index foreign keys, to order inserts so a
-parent lands before its children, and to generate the accessors behind `task.project`.
-They have simply stopped being a position and become a name, which is what they always
-were to everything downstream.
-
-Migrating is mechanical, and the compiler finds every site. A call that passed an empty
-placeholder drops it:
-
-```ts
--model({ title: z.string() }, {}, { groups: { root: 'workspace' } }) +
-  model({ title: z.string() }, { groups: { root: 'workspace' } });
-```
-
-A call that passed real relations folds them in under their own key:
-
-```ts
-- model({ title: z.string(), projectId: z.string() }, {
--   project: relation.belongsTo('projects', 'projectId'),
-- }, { load: 'lazy' })
-+ model({ title: z.string(), projectId: z.string() }, {
-+   relations: { project: relation.belongsTo('projects', 'projectId') },
-+   load: 'lazy',
-+ })
-```
-
-A call that passed only fields is untouched.
-
-`app.current_user_id` is now a reserved session setting, so a schema can no
-longer claim it — and a read that cannot be scoped to the person asking says so
-with `user_scope_not_enforced` instead of quietly returning rows.
-
-Ablo's direct-write connection already applied a fixed bundle of settings before
-your DML — the organization, the project, the environment, the sandbox, the
-acting participant — and `sessionSettings` let a schema forward any of those
-into a differently-named setting its own policies read. What a schema could
-never do was reassign one of the engine's own settings, because that would let a
-schema push relax the scoping under which Ablo writes. `RESERVED_SESSION_SETTINGS`
-is the list that prevents it, and the engine now sets one more: the acting user.
-
-The setting carries a person's id when a person is behind the write, and `'*'`
-when the request comes from a backend credential acting as the organization
-itself. Absent identity writes the empty string rather than leaving the previous
-value on a pooled connection, so a policy reading it denies rather than
-inheriting. Your own policies are welcome to read it; they simply cannot be the
-thing that decides what it contains.
-
-If your schema mapped `app.current_user_id` through `sessionSettings`, that entry
-is now dropped at authoring time and at runtime, and the engine's own value
-applies instead. Map a different name if your policies need a value you control.
-
-The new error code covers the one arrangement where that boundary cannot hold. A
-plane served from its retained log carries the organization and the project on
-every row but not the owner, so a rule that names a person has nothing to act on
-there. Rather than fold the rows and return a plausible answer, such a read is
-declined whole — a member reading a colleague's private records would otherwise
-be indistinguishable from a member reading their own. Reads made by a credential
-acting for the organization are unaffected, as is every plane served from its
-tables.
-
-All of this now has a page. The seam has been in the SDK since 0.32.0 and under
-this name since 0.33.0, documented both times only in a release note — which is
-a poor place to keep a feature rather than announce one:
-a reader with row-level-security policies had no way to discover that Ablo sets
-an identity context at all, let alone that they could point their own policies
-at it. **Session Settings** states what the engine sets before every write, which
-identities a mapping may name, which settings are reserved and why, and what
-happens on a plane served from its log. Read it with `npx ablo docs
-session-settings`, or on the site.
-
-`causedByTaskId` is removed from `MutationOptions` — and so from the per-verb params that
-compose it, `ModelCreateParams`, `ModelUpdateParams`, and `ModelDeleteParams` — together with
-the seven `turn_*` error codes that existed to police it. It also leaves `CommitContext`, where
-the server carried it from the wire to the stored row. The field was never usable for its stated
-purpose: setting it was the one reliable way to have a write refused.
-
-It was the surviving half of an agent-turn protocol whose other half was never built. The idea
-had been that an agent would open a turn, write under it, and close it, so that an auditor could
-later ask what an agent did _because_ a person asked it to — a prompt at the root of a tree of
-changes. What actually shipped was only the check. Every commit that carried a `causedByTaskId`
-was validated against a task record, and nothing in the system has ever opened one, so the record
-was never there. A caller who supplied the field had the entire batch rejected with
-`turn_validation_failed`; a caller who left it null passed straight through. The prudent thing to
-do with a documented, public option was to never touch it, and the field spent its life as
-plumbing threaded through the wire protocol, the settlement envelope, the stored row, and the
-replication consumer, carrying null on every path.
-
-Nothing is lost by its removal, because write attribution never depended on it. A delta already
-records who made the change and on whose authority — the actor, the `onBehalfOf` principal behind
-a delegated write, the capability that authorized it, and the claim the write was made under. Those
-answer "who did this and by what right" without asking the caller to maintain a lifecycle the
-engine never opened on their behalf. If your code passed `causedByTaskId`, delete the argument;
-if it branched on `turn_validation_failed`, that branch was unreachable and can go with it.
-
-The removed codes are `turn_validation_failed`, `turn_open_failed`, `turn_close_failed`,
-`turn_not_found`, `turn_foreign_agent`, `parent_turn_not_found`, and `parent_turn_foreign_agent`.
-`ERROR_CONTRACT_VERSION` moves to `2026-07-19`, as it does whenever a code leaves the registry.
-The stored-row schema loses its provenance slice with them: `deltaProvenanceSchema` and the
-`DeltaProvenance` type are gone, and `syncDeltaRowSchema` is now the core and attribution slices
-composed, which is what it had always described in practice. On the wire the field was optional
-and nullable, so a client that still sends it is accepted and ignored, and a client reading deltas
-sees one fewer always-null key.
-
-The storage goes with it. The `caused_by_task_id` column leaves `sync_deltas`, `agent_actions_log`,
-and `source_write_intents`, and the two tables that were never written — `agent_tasks` and
-`agent_task_prompts` — are dropped along with the `agent_surface` enum that typed them. This looked
-at first like a separate versioned migration, because the audit chain hashes the lineage id into
-every row's signature and rewriting those signatures is not something a release should do quietly.
-It turned out not to need rewriting. Every row was hashed with a null in that position, so the
-canonical byte layout the stored hashes were computed against is preserved exactly by passing
-`NULL::text` where the column used to be read — which is what the migration does, in the append
-trigger and in the rechain function, before the column is dropped. The signature is untouched and
-every historical `row_hash` still verifies. The `packages/audit-chain` reproduction freezes the same
-position, so the two implementations cannot drift apart on it.
-
-Eight names that were renamed in an earlier release, and have shipped since as
-aliases beside the names that replaced them, are removed.
-
-| Removed                 | Use                      |
-| ----------------------- | ------------------------ |
-| `CommitOutboxRecord`    | `PendingWrite`           |
-| `CommitOutboxStore`     | `DurableWriteStore`      |
-| `MeshParticipantStatus` | `ParticipantStatus`      |
-| `planeSchema`           | `residencySchema`        |
-| `SchemaPlane`           | `ModelResidency`         |
-| `DEFAULT_PLANE`         | `DEFAULT_RESIDENCY`      |
-| `DELTA_RESIDENCY`       | `DELTA_PHYSICAL_STORAGE` |
-| `InferModel`            | `Model`                  |
-
-Each is a one-for-one substitution — the alias and its replacement were the same
-type or the same value, so nothing about your program's behavior changes with
-the name. `InferModel` is the one worth a sentence: `Model<typeof schema,
-'tasks'>` reads as the domain rather than the machinery, which is why it became
-the published spelling, and the old name is gone from `@abloatai/ablo/schema`
-and from the `Ablo.Schema` namespace both. The type it named still exists
-underneath, because `Model` is defined in terms of it rather than as a second
-name for the same idea.
-
-An alias earns one release of overlap. That is what the surface snapshot in
-this repository records and enforces: a published name may leave only from a
-release that shipped it marked deprecated, which is the release in which a
-reader could have found out. These eight were marked in 0.34.1, so this is the
-release that may drop them, and dropping them is what keeps the rule a rule
-rather than a preamble on a list that only grows.
-
-`DELTA_RESIDENCY` is the one whose replacement is not merely a rename.
-Residency and classification are separate axes — where a column physically
-lives, and how sensitive its contents are — and one constant named as though
-they were the same question. `DELTA_PHYSICAL_STORAGE` answers the first;
-`DELTA_DATA_CLASSIFICATION`, which has been exported alongside it, answers the
-second. If you were reading `DELTA_RESIDENCY` to decide handling rather than
-placement, the classification constant is the one you wanted.
-
-`ablo docs` reads the documentation for the version you installed, and the
-public docs routes now serve the whole corpus instead of two thirds of it.
-
-A documentation URL always describes the newest release. A package in
-`node_modules` is frozen at whatever version was published. Those two facts
-drift apart the moment a project pins a dependency, and the drift is invisible
-from both ends: the docs are correct, the code is correct, and the agent reading
-one to write the other produces a call that does not exist. `get`, `getAll`, and
-`getCount` became `retrieve` and `list` in 0.35.0, so an assistant working in a
-project still on 0.34 reads the current page, writes `retrieve`, and watches it
-fail against the package sitting beside it.
-
-The documentation already travelled in the npm tarball; nothing read it there.
-`ablo docs` lists every page with what it covers, and `ablo docs <page>` prints
-one as markdown — from the files shipped alongside the code they describe, so
-they cannot disagree with it, and with no network at all, which is the condition
-most agent work now runs under. `ablo docs --json` gives the same list to a
-program. A new `@abloatai/ablo/docs` entry point exposes the catalog for
-anything that wants to build its own reader.
-
-The same catalog now answers `/api/docs/*`. That surface had been maintained by
-hand and had fallen twenty-one pages behind: `coordination`, the page explaining
-how claims work, returned a 404 while the site published it, and so did
-`sessions`, `webhooks`, `migration`, `deployment`, and every example but two.
-Nothing failed when the list went stale, which is why it stayed stale. Pages are
-now discovered rather than listed, so one is reachable the moment it is written,
-and only what ships in the package is reachable at all.
-
-One address changed meaning. `/api/docs/agents` returns the Agents guide, the
-page the docs index has always linked under that name; the install playbook that
-briefly answered there is at `/api/docs/AGENTS.md`, where it also answered
-before.
-
-`GET /v1/logs` answers two questions now — what changed, and who is working on
-what — through one envelope and one cursor.
-
-```ts
-import { feedEventSchema, parseFeedCursor } from '@abloatai/ablo/wire';
-
-const page = await fetch(`${baseUrl}/v1/logs?after=${cursor}`, {
-  headers: { authorization: `Bearer ${apiKey}` },
-}).then((r) => r.json());
-
-for (const event of page.data) {
-  const entry = feedEventSchema.parse(event);
-  if (entry.object === 'log_event') applyChange(entry);
-}
-cursor = page.next_cursor;
-```
-
-An entry is discriminated on `object`, so a reader that knows only the arm it
-came for parses the whole page and skips the rest — which is what lets a second
-arm be added to a feed that callers are already following. The two arms stay
-separately sequenced on purpose. A claim is a lease rather than a settled fact,
-and allocating its positions from the delta sequence would put ephemeral leases
-into the log that clients materialise rows from and that WAL-echo promotion and
-compaction operate over, where a burst of claim churn would be indistinguishable
-from committed change. They share a reading, not a sequence.
-
-That is why the cursor carries a position for each, encoded `"<log>.<claims>"`.
-A bare `"<log>"` still parses and resumes at claim position zero, which is the
-right answer for every cursor issued before this existed: a caller who never
-asked for claim events has no claim position to preserve. `parseFeedCursor`,
-`formatFeedCursor`, and `feedCursorAdvanced` are exported from
-`@abloatai/ablo/wire` alongside `feedEventSchema`, `logListResponseSchema`, and
-`claimEventSchema`, so a program that builds its own reader states the grammar
-once. `claimRecordSchema` and `heldClaimStatusSchema` join them on
-`@abloatai/ablo/coordination` — the one claim record, and the peer-visible
-projection of it.
-
-`GET /v1/claims` gains the filters the audit log already had: `actorId`,
-`actorKind`, `onBehalfOfId`, and `capabilityId`, beside the existing `model` and
-`id`. The names are audit's names deliberately. Asking what an agent is doing
-and asking what it did should not require two vocabularies for one idea, and now
-the tense is the only thing that differs.
-
-The claim arm has no producer yet. Claim transitions are broadcast and recorded
-nowhere, so there is no sequence to read a position from, and the route emits
-only `log_event`s today — with no request parameter for selecting arms, because
-a knob that cannot be honoured is how a contract comes to describe a server that
-does not exist. What ships here is the definition that producer will fill: the
-union parses today's pages unchanged, and the cursor already carries the second
-position, so a follower written now keeps working when the arm arrives.
-
-### The cursor fix
-
-A malformed `after` is now an error rather than a position. The previous reader
-was `parseInt(raw, 10)` with a `NaN` falling back to zero, so a truncated or
-garbled cursor resumed from the beginning of the log and replayed it in full —
-while looking exactly like a working follow, with the damage scaling to how long
-the log had been running. Such a request is now declined with `invalid_request`,
-naming the `after` parameter and how to recover. `ablo logs` carried the mirror
-of the same bug: it read the cursor with `Number(...)`, which is harmless while a
-cursor is a bare delta id and silently wrong the moment it has two parts —
-`Number('42.10')` is `42.1`, which re-serialises as `'42.1'` and resumes eight
-claim positions late. The cursor is now a string end to end, passed back exactly
-as it was issued.
-
-`legacyCompatibleCommitReceiptSchema` is removed from `@abloatai/ablo/wire`. The WebSocket client
-now parses a commit acknowledgement with `commitReceiptSchema`, the canonical one, directly.
-
-It was a compatibility decoder rather than a contract: a `z.preprocess` step that supplied fields
-older servers omitted and coerced their string `lastSyncId` into a number before handing the result
-to the canonical schema, which did the real work. It was careful in one respect worth recording —
-it never invented a source correlation, so an old or malformed queued receipt still failed closed
-rather than being promoted to something the server had not said.
-
-The servers it decoded for predate the commit contract, and the hosted engine has not spoken that
-shape in some time. Keeping the wrapper meant every receipt on the socket path went through a
-normalizer for a case that no longer arrives, and it left two spellings of "a receipt" on a
-published surface whose entire purpose is to have one.
-
-This matters only if you run a self-hosted engine older than the commit contract: its
-acknowledgements will now fail to parse, and the write is reported as `commit_no_result` — pending
-and safe to retry — rather than being silently normalized. Upgrade the engine. If you imported the
-schema to parse receipts yourself, `commitReceiptSchema` is the replacement and always was the one
-doing the parsing.
-
-### Patch Changes
-
-`ablo login`, `ablo mode`, and `ablo status` now say what the key in your hand
-can do, and `status` labels the plane your credential reaches as `acts on`
-rather than `env`.
-
-Logging in provisions a pair — a secret sandbox key and a restricted production
-one — so that a stolen CLI config cannot deploy to production. That protection
-was deliberate and it was also silent. `login` confirmed the sandbox and moved
-on, `mode production` printed a checkmark, and `status` showed the production
-key as twelve characters of prefix. Nothing said the key could not push, so the
-first notice was a 403 in the middle of a deploy, at the moment it cost the
-most to learn.
-
-Each of those three commands now names the capability at the point it hands you
-the credential: the key rows in `status` carry what each key does beside how
-long it lasts, the line under `push` says which secret key deploys, and
-`ablo status --json` reports `effectiveKey.kind` so a pipeline can check before
-it pushes instead of after it fails. The wording has one definition site, so the
-command that stores a key, the command that switches to it, and the command
-that reports it cannot describe it three different ways.
-
-The renamed `status` line is the same fix in smaller form. `mode` and `env`
-printed as peers and were not: one is the environment you selected, the other is
-the one your credential actually reaches, and when they diverged neither word
-said which was which. `acts on` states the fact. The `--json` output is
-unchanged apart from the added `kind`.
-
-## 0.34.1
-
-### Patch Changes
-
-Connecting a database whose tables are owned by an earlier integration's role now just works, with no manual step. When `ablo connect --apply` publishes your tables and grants the writer role access to them, Postgres reserves both operations for each table's owner — so if you reach that owner only through a membership that doesn't inherit its privileges, which is the ordinary shape on managed Postgres where a top role administers everything else without holding superuser, the run would otherwise stop partway through. Apply now clears that itself. It grants your admin inheritance of the owning role as the first step of the plan — shown in the preview and covered by the same confirmation you already give, `GRANT <owner> TO <your-admin> WITH INHERIT TRUE`, the per-membership inheritance Postgres 16 introduced — so the admin acts with the owner's authority for the rest of the setup, with no ownership change and reversible by `WITH INHERIT FALSE`. You approve the plan; you never run a line of SQL. The previous release had only detected the situation and suggested reassigning the table's ownership, which is itself reserved for the current owner and so couldn't run from where you stood; apply now does the one thing that can, and does it for you. Only when your admin genuinely can't take that authority — when it isn't a member with admin option of the owning role — does apply stop, and then it names the exact grant an authorized role must run, or the drop for the idempotency ledger. The same handling covers that ledger, which had kept an older, stricter ownership test that could turn away an admin who in fact inherited the owner.
-
-The line printed once a database registers has been rewritten to say what happened and what comes next — that your database is connected, that reads follow its replication stream while writes go through Ablo and land in your own tables, and that `ablo connect check` verifies the connection at any time — in place of the internal shorthand it printed before.
-
-A new page, **Operating on Your Database**, sets out the safety model for working on a live database through Ablo: which actions run freely because they are read-only or reversible, which to verify against the database first, and which change the database itself and belong to a human — written so a person or an agent can sort any action into the right one and stop guessing which move is the dangerous one.
-
-## 0.34.0
-
-### Minor Changes
-
-A long-running actor has a stale-context problem the per-commit read gate never reaches. The `reads` guard is a premise for the commit in hand: you declare what you looked at, the server checks it at commit, and the premise is gone. That fits an actor that reads and writes in one breath, not one that reads a row, works for minutes — an LLM call, a fetch, a human's turn — and only then writes. By the time it commits, the premise it would have declared is already old, and there was no commit in between on which to hear that the ground had shifted. This release adds `track`, the durable half of the same idea. `ablo.<model>.track({ id })` registers a read-dependency that persists on the server; the next time you commit anything, a change that landed on the tracked row since you registered rides back on the receipt's `notifications` — the same `StaleNotification` an `onStale: 'notify'` premise hands you, arriving on the write you were going to make anyway. You can also register one as part of a write, `track: [{ group: 'deck:abc' }]` alongside the batch, the standing-subscription companion to the single-commit `reads`. A track is idempotent — registering the same target again refreshes the one subscription rather than stacking duplicates — it re-baselines after it fires so a given change notifies once, and it never notifies you of your own writes, since the signal is about what others did. Delivery is on your next commit's receipt; a track does not yet push out of band between commits, so it sharpens the write-time freshness check rather than replacing a live subscription.
-
-The model-level presence verb is renamed from `watch` to `join`. It read like a data subscription but delivered presence — who else is on a set of rows and what they hold — so it now says what it does. `ablo.<model>.join(ids, { ttl })` opens the participant handle, with `.peers`, the scoped claim stream, and `await using` disposal unchanged; the handle's `status` was already `'joined'` and the layer beneath always called itself join, so the verb now matches the thing it returns. `onChange` remains the way to hear a row's _values_ change, and `track` is the durable read-dependency for actors — three distinct jobs that the one overloaded `watch` used to blur. The React hook follows: `useWatch` becomes `useJoin`, the `WatchOptions` / `UseWatchOptions` / `UseWatchReturn` types become `JoinOptions` / `UseJoinOptions` / `UseJoinReturn`, and the error code `model_watch_not_configured` is now `model_join_not_configured`. There is no compatibility alias — rename the call sites and the type imports. The migration guide carries the mechanical diff.
-
-### Patch Changes
-
-`ablo connect --apply` now checks, before it runs any grants, that you can actually grant on the tables you're publishing — and stops with the one-line fix if you can't, instead of failing partway through. The setup grants the writer role access to each published table, an operation Postgres reserves for the table's owner, so a table left owned by an earlier integration's role used to abort the run midway with a bare `must be owner of table …` and no guidance. Apply now names the offending tables and their owner up front and prints the exact `ALTER TABLE … OWNER TO` to reassign them to your admin — metadata only, your rows and row-level-security policies untouched. The check understands inherited role membership, so an admin that inherits the owning role — the ordinary managed-Postgres case — is left to proceed rather than stopped needlessly; only a membership that can't act as the owner is flagged.
-
-## 0.33.0
-
-### Minor Changes
-
-The declarative seam introduced in 0.32.0 for carrying tenant identity into your row-level-security policies has a clearer name and a simpler shape. `tenantContext` is now `sessionSettings`, and instead of a list of `{ guc, from }` pairs it is a plain map from the Postgres session setting your policies read to the Ablo identity that fills it:
-
-```ts
-defineSchema({
-  models: { document: {/* … */} },
-  sessionSettings: { 'app.current_org': 'orgId' },
-});
-```
-
-The setting name is the key, so a setting takes exactly one source and a duplicate is unrepresentable rather than something to validate away. If you adopted `tenantContext` in 0.32.0, rename it to `sessionSettings` and turn each `{ guc: 'app.current_org', from: 'orgId' }` into `'app.current_org': 'orgId'`; the exported names followed the rename — `TenantContextMapping` and `TenantContextSource` became `SessionSettings` and `SessionSettingSource`, and `RESERVED_TENANT_CONTEXT_GUCS` became `RESERVED_SESSION_SETTINGS`. The meaning is unchanged: Ablo fills only settings it resolves from your authenticated identity, never from client-supplied data, so a mapping can forward the tenant Ablo already trusts but can never widen a writer's scope, and settings the engine reserves for itself — `row_security`, the timeouts — are still refused at definition time. Schemas pushed before the rename keep parsing.
-
-Claims gain a fairness backstop, off by default. Claims coordinate long work by waiting rather than locking: when another participant holds a row, your `claim` joins a fair FIFO line behind it, and the holder keeps its lease alive for as long as the work runs by beating on a cadence. Nothing bounded a hold, so a holder that kept beating — and never read the `queueDepth` pressure signal each beat returns, the cue to checkpoint and release when others are waiting — could keep a contended row indefinitely, and the line behind it had no recourse but that holder's goodwill. A deployment can now configure, per model, how long a single holding may last while contenders are actually queued; a holder that runs past that fair share is preempted at the server on its next beat, which arrives as the `claim_lost` you already handle — abandon or re-claim, exactly as when a lease lapses. The guarantee is deliberately narrow: a holder with no one waiting is never preempted however long it runs, so open-ended solo work is untouched, and preemption is a fairness decision, never a correctness one — a preempted holder's next write is still checked at commit against the row's version and fencing token, so the worst it can cause is a clean re-read, never a lost update.
-
-### Patch Changes
-
-Connecting a database a second time now behaves the way you'd expect. `ablo connect --apply` publishes exactly the tables you name with `--tables`, and until now it assumed that publication didn't exist yet — so on a database that had already been connected, the step to publish your tables quietly did nothing, and the writer role ended up granted on one set of tables while Ablo was still reading a different, older set. Registration then refused the writer as "not ready," which was correct but baffling: the two halves disagreed and nothing said so. Apply now reconciles the publication to match your `--tables` on every run — adding what's newly named, dropping what's no longer there, the same declarative model a CDC tool like Debezium uses — and prints what it's about to add or drop before it touches anything, so narrowing the set is a decision you see rather than a surprise.
-
-When a readiness check does fail, the reason is finally visible. The direct-write preflight has always returned a precise checklist — which privilege is missing, on which table, and the exact grant to fix it — but the CLI was reading it from the wrong place in the error and rendered a blank message that sent you in circles. The checklist now prints under the failure, one line per unmet requirement, with the fix.
-
-## 0.32.0
-
-### Minor Changes
-
-The last release folded connecting a database into a single command. This one finishes the thought: once a database is connected, your application holds exactly one Ablo secret — `ABLO_API_KEY` — and nothing else.
-
-The scoped roles Ablo needs to read and write your database are real Postgres credentials, but they were never meant to live in your environment. `ablo connect --apply` creates them from a one-time admin connection, hands them to Ablo, and discards the admin credential; from then on Ablo holds and rotates them. What changed in this release is the last place that still asked you to keep a database credential: the health check. `ablo connect --check` used to require the two scoped connection strings in your environment so it could dial them from your laptop. Now it asks Ablo to check the database it already holds, from the same infrastructure replication actually runs on, and needs nothing but your API key. If your own machine can't reach your database — an IPv6-only host, an IP allowlist, a VPN — that no longer matters, because your machine was never the right place to check from. And when nothing is connected yet, the check says so plainly and points you at `ablo connect --apply` rather than failing for a missing environment variable.
-
-The `DATABASE_URL` fallback for the replication credential, deprecated in 0.31.0 with a warning, is removed as promised. Reading a scoped connection string from the generic `DATABASE_URL` risked quietly validating against your application's own database, so the replication role is read only from `ABLO_REPLICATION_DATABASE_URL` now. If you register a database by hand instead of using `--apply`, you set that and `ABLO_WRITE_DATABASE_URL` just long enough to register — Ablo takes them over, and your app is back to holding only its API key. `DATABASE_URL` keeps its one honest job: the transient admin credential for `--apply`.
-
-The other half of holding one key is trusting that Ablo's writer stays inside the rules your database already enforces. Ablo writes through a scoped role that is subject to your row-level security — but many applications don't carry a tenant in a column; they set it once per request as a session variable, `SET app.current_org = '…'`, and every policy reads that. That was invisible to Ablo: its writer opened its own transaction and never set the variable, so on the first insert every policy evaluated against an empty tenant and the write failed closed — silent, total, and correct, but baffling from the outside. You can now declare the mapping in your schema, and Ablo's writer sets the variable per transaction before it touches a row:
-
-```ts
-defineSchema({
-  models: { document: {/* … */} },
-  tenantContext: [{ guc: 'app.current_org', from: 'orgId' }],
-});
-```
-
-The `from` side is a closed set — `orgId`, `projectId`, `environment`, and the other identifiers Ablo establishes for the write from your credential. It is deliberately not free-form: a mapping can only pass through a value Ablo has already authenticated, never let a caller name its own tenant, so it can narrow what the writer sees but never widen it. Settings Ablo reserves for itself are refused at definition time. Your policies stay the sole authority on what the writer may touch; this only gives them the context they were written to read.
-
-Reading the setup SQL before you grant it is the whole compliance story of `ablo connect`, so the SQL has to match its narration — and in a few places it didn't. `--tables documents` promised least privilege but granted the reader `SELECT` on every table in the schema, present and future, and the writer every sequence; both are now scoped to exactly the tables you name, with schema-wide access surviving only in whole-database mode, where it's honest. A `REVOKE CREATE ON SCHEMA public FROM PUBLIC` that had crept into the script is gone — a vendor recipe must not alter the permissions of roles it doesn't own as a side effect, and modern Postgres does it by default anyway. The row-level-security narration no longer implies protection that isn't there: it distinguishes tables that have policies from those that don't, and reports honest per-table coverage rather than a blanket claim. The bookkeeping table Ablo keeps in your database, `ablo_idempotency`, now ages its rows out on a bounded window with one documented statement to prune it, instead of growing without end. And a ledger left from an earlier integration, owned by another role, no longer makes a harmless re-run fail with `must be owner of table ablo_idempotency` — Postgres checks ownership before it checks whether the column being added already exists, so re-runs now touch the table only when there is genuinely something to change, and a foreign-owned ledger stops the run early with the fix spelled out.
-
-Two smaller things. `ablo connect --apply` no longer reports success against a database where replication never turned on: it reads `wal_level`, recognizes your provider from the host, and on a managed platform that won't accept `ALTER SYSTEM` shows the real path — the console toggle, the parameter group — and exits non-zero instead of printing an un-runnable statement and a green checkmark. And `ablo disconnect` is the counterpart to connect: it removes a database, scoped to exactly the project and environment it shows you, so tearing down a sandbox connection never reaches a sibling's.
-
-Where this is heading: fewer keys, held more briefly, with your database's own rules the final word on what Ablo's writer can do. Tenant-context mapping is the first declarative seam where your schema tells Ablo how your database governs itself; more of that — which columns a writer may set, which policies it must satisfy — will move into the schema over time, so that granting Ablo a role stays something you can read, reason about, and revoke.
-
-## 0.31.0
-
-### Minor Changes
-
-Ablo's relationship with your database is unusual, and this release is about making the setup match it. You write through Ablo — `ablo.<model>.create`, `.update`, `.delete` — and Ablo lands each change in your own Postgres through a scoped role, then reads it back off your write-ahead log to confirm it landed. Your rows never leave your database; Ablo keeps only the ordered log that lets everyone writing to that database take turns. So "connecting a database" really means handing Ablo two narrow keys: one role that can stream and read, and one that can write rows and nothing else.
-
-Handing over those keys used to be a chore — paste some SQL, wire two connection strings into your environment, then run a second command to register them. This release folds it into one step. Point `ablo connect --apply` at an admin connection — pass it with `--url`, or let it use the `DATABASE_URL` you already have — and it runs the whole ceremony: creates the two scoped roles, publishes your tables, turns on logical decoding where the provider allows, and registers both roles with Ablo. The admin credential is used once and discarded. Nothing is written to your `.env`; Ablo generates and holds the scoped passwords itself, and your app keeps only its `ABLO_API_KEY`. When a password needs replacing, `ablo connect --rotate` mints a new pair and re-registers them in the same step.
-
-The shape is deliberate, and it follows one rule: a credential can only have one owner. The admin connection is yours — it's the key to your whole database, so Ablo uses it once and never stores it. The two scoped roles are Ablo's, which is why Ablo, not you, generates their passwords: a credential Ablo owns is one it can rotate, revoke, and audit, and one you can read as plain SQL before you grant it. The same rule is why the scoped strings moved out of the generic `DATABASE_URL` into names of their own — `ABLO_REPLICATION_DATABASE_URL` for the reader, `ABLO_WRITE_DATABASE_URL` for the writer. Nearly every app already sets `DATABASE_URL` to reach its own database, so a replication-only credential left there breaks the app's writes, and a `--check` that quietly falls through to it can report success against the wrong database entirely. `--check` still reads the old name, with a warning, through 0.31.x, and stops in 0.32.0; `--register` refuses it today. The one job `DATABASE_URL` keeps is the honest one: the one-time admin input to `--apply`.
-
-Where this is heading: connecting should eventually be a single sentence to an agent — "connect my Postgres" — with the CLI recognizing your provider, doing everything your credentials allow, and asking once for the single privileged step it can't do for you (a reboot to enable logical replication, an OAuth grant). `--rotate` is the first piece of the credential lifecycle that vision needs, and the `ABLO_`-prefixed names clear away the last fossils of the old dial-in era. The direction is steady: fewer keys, held more briefly, with the one irreversible act always surfaced for a human to approve.
-
-## 0.30.2
-
-### Patch Changes
-
-- **`ablo connect --apply` sets up your database for you.** Connecting a database used to mean pasting a block of SQL into a psql prompt. Now one command does it. `--apply` creates the two scoped roles, publishes your tables, turns on logical replication where your provider allows, and points `DATABASE_URL` and `ABLO_WRITE_DATABASE_URL` at the new least-privilege roles. Then it checks its own work, reconnecting as the replication role to confirm the database is ready.
-
-  Nothing leaves your machine. It runs against the admin credential already in `DATABASE_URL`, asks before it changes anything, and writes the passwords it generates to your environment file rather than printing them. Every step is safe to run twice. When a managed provider needs a restart to finish — RDS, Neon — it does everything else and hands you that one step, with the exact fix. Prefer to run the SQL yourself? `ablo connect` still prints it, and `--show-sql` shows it inline first.
-
-## 0.30.1
-
-### Patch Changes
-
-- **Writes land in your own database.** Connect a database with `ablo connect` and the models you already read become writable. `ablo.<model>.create`, `.update`, and `.delete` route through Ablo's commit chokepoint and into your database — no connection string in the client. A claim you hold is checked at the chokepoint before the write applies, so agents and people take turns on a row whether they reach it by reading from Ablo or by writing back to your own database.
-
-  A write returns as soon as it is durably accepted; the receipt calls that `queued`. For the authoritative outcome, pass `wait: 'confirmed'`. Ablo watches the change actually land in your database — the write-ahead-log echo for a replicated source, the event feed for a signed endpoint — and promotes the receipt to `confirmed` before the call returns. The code is the same either way; only the feed Ablo waits on differs.
-
-- **A clearer error when a table isn't ready yet.** `ablo push` records your models, but a plane's physical tables are created separately, out of band — so a model can exist in the schema before its table does. Read or write one in that window and you now get a typed `model_not_provisioned` error (HTTP 409) that says what's missing and how to fix it, instead of an opaque failure.
-
-## 0.30.0
-
-### Minor Changes
-
-- **The `databaseUrl` client option is gone.** Your database connects to Ablo out of band, not through the client. Ablo is Stripe-shaped: the client only ever talks to the engine. You build it with `Ablo({ schema, apiKey })` — add `transport: 'http'` for a stateless worker — and it reaches Ablo over WebSocket or HTTP. It never opens a Postgres connection of its own. How your data connects is a separate, one-time step, and it takes one of two shapes:
-
-  - **Logical replication, the default.** `ablo connect` registers your database, and Ablo tails its write-ahead log. Your rows stay where they are; Ablo reads the change stream and keeps its own log.
-  - **A signed endpoint, the fallback.** When a database can't grant a `REPLICATION` role, your app exposes a signed HTTP endpoint for Ablo to call. Same principle — the credentials stay with your app.
-
-  With no connection string in the client, `ablo init` no longer scaffolds the `--storage direct` connector, the last thing that wrote `databaseUrl: process.env.DATABASE_URL` into generated code. Run `ablo init --storage replication` (the default) or `--storage endpoint`.
-
-- **A claim's work label is `description`, not `reason`.** A claim is an advisory lock: you take it on a row before editing, and other participants — agents or people — see it's held and wait. The free-text note that says what you're doing is now `description`, the line a peer reads when it lands on a row you hold: `ablo.<model>.claim({ id, description: 'Renaming the task to match the brief' })`. The old `reason` option is gone, with no alias, so a call still passing it won't type-check — rename it. (This is a different field from the `reason` on a rejected or lost claim — `'conflict'`, `'expired'`, `'preempted'` — which explains why coordination said no, and hasn't changed.)
-
-- **Claim a key Ablo hasn't synced: `ablo.<model>.claim(id)`.** Claims now come in two shapes, matched to whether Ablo holds the row. The object form, `claim({ id })`, loads the row from Ablo's synced pool and returns a `HeldClaim<T>` with its `.data`. The new string form, `claim(id)`, locks a row that lives only in your database — one Ablo has never synced — skipping the pool load and the `entity_not_found` throw, and returns a `HeldLease`: a `HeldClaim` without the data. This is Rung 0 of the connect ladder: coordination with no replication grant, no schema change, no `organization_id` column — so you can coordinate agents against your database before wiring any sync at all. `await using` releases either shape at end of scope, and the object form is untouched, so nothing you've already written changes.
-
-### Patch Changes
-
-- **`ablo push` defers provisioning instead of failing when a role can't run DDL.** When the engine role bound to a plane can't create or alter tables, `push` no longer aborts. It records the schema and defers the table changes for a role that can run them — so your models still register, rather than the whole command stalling on a privilege the plane may never grant the engine.
-
-- **Schema-drift stops false-alarming on `selectModels` / `omitModels` clients.** A projected client carries a deliberate subset of the schema, so its hash differs from the full one by design. The check now compares against the projection's own source hash — so a correctly projected app no longer sees a phantom drift warning at startup.
-
-## 0.29.3
-
-### Patch Changes
-
-- **`ablo connect` validates from Ablo's network when your machine can't reach the database.** Replication runs from Ablo's infrastructure, not from your laptop, so a database that is IPv6-only (Supabase direct hosts), IP-allowlisted, or behind a VPN can be perfectly replicable even when every local dial fails. When `--check` can't connect at all, it now asks the engine to run the same readiness checklist from its own network instead of reporting a false failure; `--register` no longer blocks on local unreachability and lets the registration preflight decide. A host that _was_ reached and rejected the connection — bad credentials, a TLS error, a Postgres error — still fails locally, because the engine would see exactly the same thing.
-
-## 0.29.2
-
-### Patch Changes
-
-- **Switching to a project you never minted a key for no longer locks you out.** Project-management commands — `ablo projects list`, `create`, `rename`, and `use` — are organization-level operations, so they now accept any of the organization's stored keys (the active project's key first, then the `default` profile, then any profile still holding an unexpired key) instead of strictly the active project's key. Selecting a keyless project could previously leave `ablo projects use default` unauthorized — the one command that would undo the switch. Data commands keep the strict resolver, so this permissive fallback never routes a read or write through an unintended project.
-
-## 0.29.1
-
-### Patch Changes
-
-- **The `omitModels` doc example uses generic model names.** The schema-projection example in the `omitModels` JSDoc and the API docs now reads `omitModels(full, ['reports', 'reportSections'])` — an illustrative parent/child pair rather than application-specific model names. Documentation only; no API or behavior change.
-
-## 0.29.0
-
-### Minor Changes
-
-- **`omitModels()` projects a schema by exclusion — the companion to `selectModels`.** Keep every model except the named ones, so one app can be the general case while a separate app owns the models it drops. The suite shell narrows with `omitModels(full, ['reports', 'reportSections'])` while the standalone app selects those same models. Validation matches `selectModels`: relations into the omitted set are dropped, and a dropped `parent` edge throws, so a model whose scope routes through an omitted parent can't be silently kept. Each app now binds its own schema projection rather than sharing one global registration.
-
-- **Every application model has one typed access path: `ablo.<model>`.** Both the WebSocket and stateless HTTP clients return bare rows from `retrieve` and accept the same typed create/update/delete forms. The schema-less `Ablo({ schema: null })` overload, the public `.model(name)` accessors, the transport-envelope types, and the hidden capability CRUD client are removed. Select `transport: 'http'` for workers without changing model syntax, use `commits.create` only for atomic multi-row writes, and `sessions.create` to mint a scoped user or agent credential.
-
-- **The commit wire names only the protocol that actually runs.** `@abloatai/ablo/wire` exports `CommitMessage`, `MutationResultMessage`, `commitOperationSchema`, and `commitPayloadSchema` directly. The prospective v2 commit contract published under `@abloatai/ablo/commit` in 0.28.0 — its `CommitReceipt` type, the `legacyCommit*` wire aliases, and the unsent named-mutation frame — is removed, so there is one contract to implement and test. Idempotency-key sealing and fencing move to `transactions/idempotencyKey.ts` (ADR 0006: the v1/v2 boundary lives at ingress, not in the client). Local `useMutators` calls still compose normal transactions; this removes only the dead server wire path.
-
-- **Protocol support is backed by codecs, not a numeric claim (ADR 0005).** The wire package publishes an explicit supported-version manifest; the server must provide a decoder for every entry. Durable HTTP writes seal their original protocol version and replay with it after an upgrade. Application-schema hashes are an advisory bootstrap warning rather than an exact WebSocket gate, so additive schema versions can overlap through an expand/contract rollout.
-
-- **The injected write-storage option is `durableWrites`, and `DurableWriteStore` is its interface.** The `commitOutbox` client option and `CommitOutboxStore` interface introduced in 0.28.0 are renamed. `durableWritesConfigSchema`, `durableWriteStoreSchema`, `pendingWriteSchema`, and the `DurableWritesConfig` / `DurableWriteStore` / `PendingWrite` types are exported from the package root, so a workflow-, SQLite-, or filesystem-backed adapter validates against the shipped schema instead of an interface you re-declare. The old `commitOutbox` / `CommitOutboxStore` names remain as deprecated aliases through the next major release.
-
-- **`Register` registers your `Schema` and `UserMeta` — those are the two keys.** The `Presence` and `Claims` registration keys and their `ResolvePresence` / `ResolveClaims` resolver types are gone, matching the removed presence and claim React placeholders. Read presence through `usePeers` or `useWatch`, and row claims through `ablo.<model>.claim`. The default resolver now carries a `SchemaRecord` fallback, so a shared package typechecks standalone with no app registration in scope.
-
-- **One signed adapter export: `dataSource`.** The `abloSource` alias is removed, and the parallel `DataSource*` type names (`DataSourceOptions`, `DataSourceCommitParams`, `DataSourceHandlerContext`, and the rest) collapse into the canonical `Source*` types — one name per shape. Endpoints already built with `dataSource()` are unchanged; only the duplicate names are gone.
-
-- **The claim type surface is reached through `Ablo.Claim.*`.** `ClaimOptions`, `ClaimParams`, `ClaimLookupParams`, `ClaimReorderParams`, `Claim`, `ClaimHeartbeat`, `ClaimHeartbeatOptions`, and `ModelOperations` are namespace members rather than top-level exports; `HeldClaim` stays as a deprecated top-level alias because 0.20.1 documented it. The internal construction types `InternalAbloOptions` and `HttpClaimApi` are no longer exported — the public surface names only what an application builds against.
-
-### Patch Changes
-
-- **Removed React placeholders that had no working runtime.** `usePresence`, `useClaim`, `SyncGroupProvider`, and `useSyncGroup` are no longer exported. Use `usePeers` or `useWatch` for presence and scoped participation, and `ablo.<model>.claim` for row claims. The unused `Register.Presence` / `Register.Claims` resolver types are gone with them.
-
-## 0.28.0
-
-### Minor Changes
-
-- **Commits are now crash-durable — a sealed envelope replays the exact request after a restart, on both transports.** Before a batch reaches the wire, the WebSocket client seals it into one atomic outbox record: the stable idempotency key, the exact JSON-normalized ordered operations, and the source mutations it supersedes. Recovery replays the sealed request as it was sent — never re-projected from model state in the new process — and a multi-operation commit is only ever replayed whole, so an atomic A+B can't come back later as A and B separately.
-
-- **The stateless HTTP client replays its outbox on startup.** It persists the exact request (method, path, body, idempotency key) and re-sends unacknowledged envelopes before its first new request. A definitive rejection (a 4xx other than 429) settles the envelope instead of retrying it.
-
-- **New `commitOutbox` client option + `CommitOutboxStore` interface.** Browsers default to strict IndexedDB storage when persistence is on; Node agents and workers can inject workflow-, SQLite-, or filesystem-backed storage so commits survive process restarts. The client's transaction journal now writes with strict durability, so an acknowledged outbox record means disk-backed.
-
-- **Replay is fenced and fails closed.** Reusing an idempotency key with a different request is rejected on both transports; replay is scoped to the actor and server that sealed the envelope and bounded to the server's idempotency retention, so a stale envelope is held for review instead of re-sent; a write queued behind an ambiguous predecessor waits for it to settle rather than overtaking it; and a persistence adapter that cannot guarantee durability reports failure instead of phantom success. Generated create ids are sealed with the request, so a crash mid-create recovers the same row.
-
-- **`@abloatai/ablo/commit` publishes the transport-independent v2 commit contract.** Branded identifiers, ordered operations, explicit write preconditions (`unchanged_since`, `version_matches`, `claim_fence`), and a discriminated `CommitReceipt` — `committed`, `conflicted` (carrying the smallest current state needed to reconcile), or `rejected` (a typed error plus the capability a retry would need). This release publishes the contract so tooling and tests can validate against it today; the engine's live commit path still speaks the current protocol, and the cutover to v2 ships server-side.
-
-- **New wire exports.** `@abloatai/ablo/wire` gains the matching `CommitRequestMessage` / `CommitResultMessage` frames, re-exports the current transport's operation schemas under `legacyCommit*` names, and exports `BootstrapReason` — the machine-readable reasons a live delta stream must resume via catch-up (`too_far_behind`, `too_many_deltas`, `missing_entities`, `stream_gap`).
-
-- **Reactive reads are typed as what they actually return: snapshot rows, not model instances.** `useAblo` selectors now receive `AbloReads<Schema>` — model reads typed as the row's data fields plus schema computeds, without relation accessors or model methods. Reading `row.layers` inside a selector is a compile error instead of a silent `undefined` at runtime; compose relations through a dedicated hook or selector instead. The new `Row<'slides'>` / `InferRow` types are the snapshot-row companion to `Model<'slides'>`, mirroring what `toReactiveSnapshot()` produces. This is a type-level change only: selectors that compiled against relation accessors now fail to compile, and each of those reads was already returning `undefined` — the new errors point at real bugs. Runtime behavior is unchanged.
-
-### Patch Changes
-
-- **The resume cursor advances only through the contiguous durable prefix of a delta frame.** A frame spanning several local stores commits per store, and those transactions can fail independently — taking the maximum id from any successful store could permanently skip an earlier failed delta on every later catch-up.
-
-- **Conflicting undo-scope options warn instead of being silently ignored.** A scope keeps the options it was created with; the silent version of that rule could leave a surface believing it enabled stream recording when it hadn't.
-
-- **Docs and error copy name the real HTTP mount.** REST paths are documented as `/api/v1/...` — the OpenAPI server URLs carry the `/api` mount — and the `jwt_issuer_untrusted` message no longer points at an endpoint that doesn't exist.
-
-- **The resume cursor advances only through the contiguous durable prefix of a delta frame.** A frame spanning several local stores commits per store, and those transactions can fail independently — taking the maximum id from any successful store could permanently skip an earlier failed delta on every later catch-up.
-
-- **Conflicting undo-scope options warn instead of being silently ignored.** A scope keeps the options it was created with; the silent version of that rule could leave a surface believing it enabled stream recording when it hadn't.
-
-- **Docs and error copy name the real HTTP mount.** REST paths are documented as `/api/v1/...` — the OpenAPI server URLs carry the `/api` mount — and the `jwt_issuer_untrusted` message no longer points at an endpoint that doesn't exist.
-
-## 0.27.0
-
-### Minor Changes
-
-- **Claims can now be held for long-running work by heartbeating — on both transports.** A claim's TTL is crash cleanup, not a work estimate; work that outlives it (a 30-minute report, a long agent run) keeps its lease by beating. `claim({ heartbeat: true })` beats automatically until release; `held.heartbeat()` beats by hand. A lapsed lease answers the next beat with `AbloClaimedError` (`claim_lost`) — for a socketless worker, the failed beat _is_ the loss notification, and any write attempted under the old lease is independently rejected by its `readAt` guard.
-
-- **Beats carry progress and pressure.** `heartbeat({ details })` stores lightweight progress as the claim's peer-visible `meta.progress` (last beat wins, via `claim.state`); every beat's answer reports `queueDepth` — how many participants wait in line behind the lease — observable per auto-beat with the new `onHeartbeat` claim option.
-
-- **`ablo.claims.heartbeatAll({ ttl })`** extends every lease the credential holds in one request (`POST /api/v1/claims/heartbeat`) — the stateless twin of the WebSocket keepalive, for workers holding many rows.
-
-- **Keepalive renewals extend but never shorten a lease**, so an explicit work-duration `ttl` now survives pings and brief reconnects instead of collapsing to the liveness window.
-
-- **README.** The quick start leads with a runnable example, and a new _Background workers_ section shows the enqueue-on-your-own-queue / heartbeat-the-claim pattern end to end.
-
-## 0.26.0
-
-### Minor Changes
-
-- **`ablo connect --register` works against any deployment.** Registering your database as an Ablo data source over logical replication is now a first-class path everywhere — the gate that could refuse a new connection-string registration is gone. Point `ablo connect --register` at your Postgres and Ablo begins consuming its replication stream while your application keeps owning the write path; registering the source _is_ the enable, with no tier or flag to choose. The signed `dataSource()` endpoint remains the explicit fallback for databases that can't grant replication.
-
-- **More engine failures surface as typed errors you can branch on**, instead of opaque `500`s. New `AbloError` codes: `schema_provisioning_forbidden` (`403` — a push tried to create tables in a database where the engine isn't permitted to run DDL), `request_too_large` (`413` — a query or commit body exceeded the size limit), `commit_operation_invalid` (`400` — a malformed commit operation), and `upload_not_configured` (`503` — an upload was attempted with no blob store wired).
-
-- **`@abloatai/ablo/wire` now exports the protocol schemas.** `commitOperationSchema`, `commitPayloadSchema`, and the frame schemas let tooling and tests validate client↔engine frames against the same contract the engine enforces.
-
-- **Protocol version negotiation is surfaced.** `@abloatai/ablo/wire` exports `PROTOCOL_VERSION`, `MIN_SUPPORTED_PROTOCOL_VERSION`, `WS_CLOSE_PROTOCOL_VERSION`, `PROTOCOL_VERSION_HEADER`, `protocolVersionProblem`, and `ERROR_CONTRACT_VERSION` — the single integer the client and server compare on connect to detect an incompatible peer and fail with a clear reason instead of a cryptic wire error.
-
-- **`@abloatai/ablo/coordination` exposes the conflict-policy vocabulary** — `defaultPolicy`, `capabilityPreemptPolicy`, and `interpretConflictAxis` — for server-side consumers building on the claim model. `@abloatai/ablo/schema` gains the role primitives (`identityRole`, `entityRole`, and their types and schemas) for declaring identity- and entity-scoped roles.
-
-- **Removed unused API surface.** Dropped the `@abloatai/ablo/server/next` subpath export and the unused `MutationDispatcher` interface (plus its `MockMutationDispatcher` test double) and the offline-mutation-queue internals behind them — none had documented consumers. Every supported entry point (`@abloatai/ablo`, `/ai-sdk`, `/react`, `/source`, `/coordination`, `/schema`, `/keys`, `/auth`, `/wire`, …) is unchanged.
-
-- **Internal:** the SDK's largest modules — the `Ablo` client, the data-source runtime, the transaction queue, and the WebSocket sync loop — were decomposed into cohesive leaf modules. No public runtime API or import path changed.
-
-- **CLI & docs.** `ablo push` prints a calmer, information-first deploy banner (a production push still requires typing the project name to confirm). The README and `AGENTS.md` now lead with the one-path logical-replication model and clarify that sandbox is test-mode only — in production your rows stay in your database and Ablo holds only the transaction log.
-
-## 0.25.0
-
-### Minor Changes
-
-- ca30064: Logical replication is now the documented default storage path, with self-service data-source registration from the CLI.
-  - **`ablo connect --register`** — registers your database as an Ablo data source over logical replication in one step: it runs the same pre-flight replication probe `ablo connect` uses (server reachable, `REPLICATION` privilege, `wal_level=logical`, publication/slot creatable), and on success `POST`s the connection to the engine's `/api/v1/datasources`. The `ek_`-authed call scopes the source to your org automatically; the password is stored decomposed as a secret, never echoed back. This is the "registration is the enable" path — there is no separate tier or flag to pick.
-  - **`ablo init` leads with logical replication** — the default storage mode is now `replication` (was `endpoint`); the generated env + next-steps point at `ablo connect` / `ablo connect --register`. The signed-endpoint and direct modes remain as the explicit fallback / legacy options.
-  - **`ablo status`** — a data-plane diagnostic that probes whether your registered source is reachable and replicating (failure-only reporting, so it never falsely reports healthy).
-  - **`ablo push`** — minor guard/UX refinements (deploy-target clarity).
-  - **Docs (README, `docs/data-sources.md`, `llms.txt`)** rewritten to the one-path model: Ablo consumes your database's logical-replication stream and your application owns the write path. The security wording is precise — a logical-replication connection requires the `REPLICATION` privilege (it is **not** a read-only SQL account), so reviews are not misled by a "read-only" claim.
-
-  No breaking changes to the SDK runtime API. The server-side WAL read cutover these CLI changes support ships by deploying the engine, not this package.
-
-## 0.24.0
-
-### Minor Changes
-
-- Multi-agent coordination for AI SDK tools + safer `ablo push`.
-  - **`coordinatedTool` (`@abloatai/ablo/ai-sdk`)** — one call turns an Ablo model
-    write into a Vercel AI SDK `tool()` with concurrency coordination handled, so an
-    AI agent can contribute to shared state without clobbering concurrent writers.
-    Three strategies: `merge` (default — delegates to the functional update's
-    compare-and-swap + backoff, self-healing accumulate), `claim` (mutual exclusion,
-    returns a `claimed` signal the model retries on), and `queue` (SQS-style
-    poll-acquire over HTTP). The `ai-sdk` entry now also documents the canonical
-    multi-agent coordination model (surface-the-signal + back-off laws, strategy
-    table).
-  - **`ablo push` guards** — `--dry-run`/`--plan` prints the deploy target, a
-    model-level diff vs the deployed schema, and git state, then exits without
-    applying. Production deploys now require a typed confirmation (and refuse an
-    uncommitted schema unless `--allow-dirty`); sandbox confirms interactively.
-    `--yes`/`-y` skips confirmation for CI.
-
-## 0.23.0
-
-### Minor Changes
-
-- 2807efb: `create` now returns the created row, not a `CommitReceipt`.
-
-  The WebSocket client's `create` already returned the row (`T`); the HTTP client
-  and the `.model(name)` accessor returned a `CommitReceipt`, so "create returns
-  the thing I created" only held on one transport. Both now return the confirmed,
-  authoritative server row (framework defaults like `createdAt`/`createdBy`
-  included). For an idempotent re-create of an existing caller-supplied id, the
-  EXISTING row is returned (not the input).
-
-  BREAKING (HTTP / `.model()` callers only): `await ablo.<model>.create(...)` now
-  resolves to the row instead of `{ status, lastSyncId, ... }`. Code that ignored
-  the return value, or that read `.id` (the row carries `id` too), is unaffected;
-  code that read `lastSyncId` / `serverTxId` / `status` off a typed model create
-  should use the raw `commits.create(...)` resource, which still returns a
-  `CommitReceipt`. WebSocket-client callers are unaffected (already returned `T`).
-
-- 2807efb: `delete` is idempotent — deleting an already-absent row is a no-op success, not
-  an error.
-
-  The WebSocket client's `delete` threw `entity_not_found` when the row wasn't in
-  the local pool, while the HTTP client returned without error — so "delete this"
-  was a hard edge on one transport. Both now agree: a row that isn't present is
-  already gone, so the delete succeeds with no effect. This is AIP-135's
-  recommended behavior for client-assigned-id / declarative APIs (Ablo is exactly
-  that), and it makes delete safe to retry and to race (two actors deleting the
-  same row). The deliberate "loud 0-row" assertion in `@ablo/slides-sdk` is
-  unchanged (it keeps its own `allowMissing` opt-out).
-
-- 2807efb: `retrieve` reports a missing row as `data: undefined` instead of throwing.
-
-  The HTTP client previously threw `model_not_found` for a missing row while the
-  WebSocket client returned `T | undefined` — so the obvious read ("does this row
-  exist?") was a hard edge an agent had to wrap in `try/catch` on one transport
-  only. Both transports now agree: an absent row is data-absence, not an error.
-  `ModelRead.data` is now `T | undefined` (matching the documented `.data?.x`
-  usage). Taking a `claim` on a row that doesn't exist still throws
-  `AbloNotFoundError` — a claim has nothing to hold.
-
-## 0.22.1
-
-### Patch Changes
-
-- Expose the functional `update(id, current => next)` overload on the stateless
-  HTTP client type (`HttpModelClient` / `AbloHttpClient`).
-
-  0.22.0 wired the functional update at runtime on every transport and added the
-  overload to `ModelOperations` (WebSocket) and `ModelClient`, but the
-  `Ablo({ transport: 'http' })` client resolves its models to `HttpModelClient`,
-  whose `update` type still declared only the `update({ id, data })` form. So
-  server-side agents — the primary callers — saw a type error on
-  `update(id, fn)` even though it worked. Add the overload to that type.
-
-## 0.22.0
-
-### Minor Changes
-
-- Add the functional update form: `ablo.<model>.update(id, current => next)`.
-
-  The `setState(prev => next)` of the data layer. Pass a function of the latest
-  row and the SDK owns everything that used to be the caller's problem under
-  contention: it reads the freshest row, runs your updater, writes it as a
-  compare-and-swap against the row's watermark, and re-reads + re-runs on any
-  concurrent write. No claim, no per-participant identity, and no
-  `stale_context` / `claim_*` codes ever surface — correctness rides on the
-  watermark, so concurrent writers reconcile instead of silently clobbering. The
-  write either lands or throws a single `AbloContentionError` once its reconcile
-  budget is spent.
-
-  Identical guarantee on both transports (HTTP and WebSocket share one reconcile
-  loop). Return `null`/`undefined` from the updater to skip the write. Tune with
-  `{ retries, signal }`. Exports: `AbloContentionError`, `ModelUpdater`,
-  `ContentionOptions`, `DEFAULT_CONTENTION_RETRIES`.
-
-  The classic `update({ id, data })` form is unchanged.
-
-## 0.21.0
-
-### Minor Changes
-
-- Coordination observability now fires on BOTH transports. Previously `captureClaim`/`captureConflict` were emitted only by the WebSocket transport, so a `ClaimLog` (or any `observability` provider) handed to a stateless HTTP client — the transport server-side agents use via `Ablo({ transport: 'http' })` — stayed empty, and even on WebSocket a hard commit rejection went unrecorded. Fixed:
-  - **HTTP transport now emits.** `Ablo({ transport: 'http', observability })` records `claim` acquisition (`captureClaim`) and coordination-conflict rejections (`captureConflict`, code `stale_context` / `claim_conflict` / `entity_claimed`) on BOTH HTTP write doors (`commits.create` and per-model `ablo.<model>.update/create/delete`). The conflict names the collided rows — from the server's `conflicts` detail when present, otherwise the ops the write attempted. `observability` is now a documented option on the HTTP client.
-  - **WebSocket rejections now recorded.** A commit rejected by the conflict policy (`mutation_result` `success: false` with a coordination code) now calls `captureConflict`, mirroring the existing notify-on-success path. So `ClaimLog.collisions()` no longer silently misses rejected writes.
-
-  Net effect: a `ClaimLog` behaves identically regardless of transport — `entries`, `collisions()`, and `onChange` reflect the real coordination timeline for headless agent evals and live activity feeds alike.
-
-## 0.20.2
-
-### Patch Changes
-
-- Extend the `HeldClaim` return type to the HTTP transport. 0.20.1 fixed `await using` on the WebSocket client's `claim()` but missed the stateless HTTP client (`HttpClaimApi`) used by server-side agents, which still returned the looser `Claim<T>`. Both transports' `claim()` now return `HeldClaim<T>`, so `await using held = await ablo.<model>.claim(...)` typechecks regardless of transport.
-
-## 0.20.1
-
-### Patch Changes
-
-- Fix `await using held = await ablo.<model>.claim(...)` failing to typecheck. `claim()` now returns a `HeldClaim<T>` — a `Claim<T>` with `data`, `release`, `revoke`, and the async disposer made `Required` (they're optional on the base `Claim<T>`, which also models observed peer claims that lack them). A held claim is therefore assignable to `AsyncDisposable`, so the `await using` auto-release pattern compiles. Observed claim surfaces still return the looser `Claim<T>`. `HeldClaim` is exported.
-
-## 0.20.0
-
-### Minor Changes
-
-- Reactive reads now work out of the box. A read like `useAblo((a) => a.documents.get(id))` re-renders when a live delta updates the row — including in-place field updates (the common collaborative case), which previously fired no reaction and left the UI silently stale.
-
-  Two changes make this work:
-  - **Models are reactive by default.** Schema fields are now MobX-observable without opting in. `json` fields stay `observable.ref` (one atom for the whole blob, not a deep atom tree per node), so the default is cheap. Opt out per model with `lazyObservable: false` for very large read-only list models where the QueryView's entry-replaced reactivity is enough.
-  - **`useAblo` returns a plain row snapshot** (via the new `Model.toReactiveSnapshot()`) instead of the live model instance. Reading the fields inside the tracked function is what subscribes the reaction (MobX tracks property access, not values), and the fresh snapshot identity lets the hook detect the change. Consumers get plain row objects and never touch a MobX observable directly.
-
-  Also new: `deepEqual` and `stableStringify` exports for comparing `field.json()` values. A `jsonb`-backed json field round-trips with reordered object keys (Postgres `jsonb` does not preserve key order), so a naive `JSON.stringify(a) === JSON.stringify(b)` comparison is unreliable when reconciling against external state (e.g. a rich-text editor). These helpers compare key-order-insensitively.
-
-## 0.19.0
-
-### Minor Changes
-
-- **Claim observability — a `ClaimLog` you can print or assert on.** A new
-  `observability` provider hook lets you tap every claim event and stale-write
-  collision the client sees. Hand `new ClaimLog()` to `Ablo({ observability })`
-  and it collects an ordered, readable log — `formatClaim` / `formatConflict`
-  render one line per event, and `collisions()` returns the conflicts for eval
-  assertions. New exports: `ClaimLog`, `formatClaim`, `formatConflict`,
-  `noopObservability`, and the types `ClaimLogEntry`, `ClaimEvent`,
-  `ConflictEvent`, `SyncObservabilityProvider`. Spread `noopObservability` to
-  override only the hooks you care about.
-
-  **AWS-shaped CLI credential store + `ablo config`.** Local CLI state is now split
-  into two files, matching `~/.aws/config` vs `~/.aws/credentials`: `config.json`
-  holds non-secret settings (active environment + active project) and is safe to
-  print or let an agent read; `credentials.json` holds the keys (0600, never
-  printed), keyed by project profile then environment. Per-project profiles follow
-  Stripe's model — `ablo projects use <slug>` selects the active profile, and a
-  key's project is fixed at mint so selecting a project never re-scopes an existing
-  key. `ablo status` now reports the resolved profile and environment.
-
-  **Schema JSON-column reconciliation.** `generateJsonColumnReconciliation` (new
-  export) emits the DDL to reconcile JSON-backed columns when adopting or evolving
-  an existing schema.
-
-  **Breaking (0.x):**
-  - The claim handle type `ClaimHandle` is renamed to **`Claim`**, and its
-    identifier field is `id` (was `claimId`). Update type imports and any code
-    reading `.claimId`.
-  - The ai-sdk `claimBroadcastMiddleware` (and `./ai-sdk/claim-broadcast`) is
-    removed — coordination broadcast is handled by `coordinationContextMiddleware`.
-    Import `ClaimTarget` from the package root or `@abloatai/ablo` ai-sdk's
-    `coordination-context` instead of `claim-broadcast`. The inline-claim option is
-    `reason` (not the pre-0.12 `action`); the ai-sdk docs are corrected to match.
-
-## 0.18.0
-
-### Minor Changes
-
-- **Client observability — `debug` / `logLevel`, off by default.** The SDK used to
-  emit a `debug` line per model and per property during schema registration (a
-  firehose). It now defaults to a quiet `warn` threshold and exposes two new
-  `Ablo()` options to opt back in:
-  - `logLevel: 'debug' | 'info' | 'warn' | 'error' | 'silent'` — `'info'` surfaces
-    coordination and connection events without the per-model registration noise;
-    `'debug'` is everything. Precedence: explicit `logLevel` → `debug: true` →
-    `ABLO_LOG_LEVEL` env → default `warn`. Supplying your own `logger` bypasses both.
-  - `debug: boolean` — shorthand for `logLevel: 'debug'`.
-
-  Coordination is now traceable at `info`: claims that are **rejected** or **lost**
-  (preempted/expired), and your position **advancing in a claim queue**, each log
-  once per change with a readable target (`documents:abc.title`) — quiet lowercase
-  lines, no shouty tags.
-
-  **New: canonical wire-egress contract export.** `errorEnvelope`, `statusForType`,
-  and the `ErrorEnvelope` type are now exported from the package root. Server
-  consumers (e.g. a self-hosted sync server) can assert against the one source of
-  truth for the error-envelope shape and the `AbloError`-subclass→HTTP-status
-  table instead of keeping a copy that silently drifts.
+  The public surface now provides:
 
-  **Structured CLI error rendering.** CLI failures render as a titled block with a
-  reason code and per-code remediation (`--verbose` for the stack) instead of a
-  console wall-of-text; `AbloError.toString()` produces a leak-proof one-liner.
+  - `@abloatai/ablo` for agents, services, workers, jobs, and backend code;
+  - `@abloatai/ablo/client` for live local state;
+  - `@abloatai/ablo/react` for React bindings;
+  - branded schema, source-adapter, server, authorization, coordination, and wire
+    subpaths; and
+  - `/source/next`, `/source/drizzle`, `/source/kysely`, and
+    `/source/conformance` for Data Source integrations.
 
-  **`ABLO_API_KEY` resolution + sandbox key scopes.** The key is now resolved from
-  `.env.local` / `.env` (not just the process env), and sandbox keys are granted
-  `schema:push` by default so `ablo push` works out of the box in a fresh sandbox.
+  Authoritative reads use `model.get({ id })`; reactive snapshots use
+  `model.local.get(id)`.
 
-## 0.17.0
+  Ablo is now presented as the transaction and coordination API for state
+  operated by humans, services, tools, and AI agents. Realtime synchronization
+  remains available as a client capability rather than defining the product.
+  Live applications no longer accept HTTP transport configuration, and the old
+  sync-engine package and compatibility paths are removed.
 
-### Minor Changes
-
-- **Bring-your-own database is now one model.** Ablo connects to your Postgres and
-  never operates it. There used to be two confusing BYO paths, and the
-  connection-string one would create roles, force row-level security, transfer
-  table ownership, and push you to run `ablo migrate` before anything worked. That
-  cascade is gone. Ablo now follows the shape every serious "sync over your own
-  Postgres" engine uses (ElectricSQL, PowerSync, Zero): it reads your database via
-  Postgres logical replication and never runs DDL, creates roles, forces RLS, or
-  rewrites your `DATABASE_URL`. You own your schema; Ablo reads it.
-  - **New: `ablo connect`.** One command prints the exact, copy-pasteable setup for
-    your own Postgres — enable `wal_level=logical`, create the `ablo_publication`
-    publication and a least-privilege `ablo_replicator` role — and
-    `ablo connect --check` validates readiness (wal level, publication, replication
-    grant, replica identity). This is the single supported way to connect a real
-    database.
-  - **`ablo migrate` left the happy path.** It no longer creates roles, transfers
-    ownership, or rewrites your connection string, and `ablo dev` no longer attempts
-    a scoped-role creation on every watch loop. `migrate` is now an optional escape
-    hatch for generating starter DDL (`--dry-run` prints the SQL).
-  - **Clearer failures.** `ablo push` permission errors lead with the server's actual
-    reason code and per-code remediation instead of a generic "needs `schema:push`
-    scope," and the schema-conflict message names which environment/version a prior
-    push came from and when.
-  - **Logical-replication runtime is in Preview.** The setup (`ablo connect`) and the
-    connection model are live; the server-side WAL consumer that streams your changes
-    is implemented and journey-tested but not yet generally available.
-
-  The previous connection-string-operate and adapter/outbox modes are demoted to a
-  clearly-labeled **Legacy / not recommended** section — they still work, but new
-  integrations should use logical replication.
-
-## 0.16.3
-
-### Patch Changes
-
-- **Docs.** The bundled SDK docs are now the single source for the documentation
-  site, and several pages were expanded or corrected:
-  - The sessions/identity model is reframed around **projects** — push one schema
-    to a project, mint an `ek_` per user (your users need no Ablo account), and
-    all of them commit to that one schema. Per-customer org isolation
-    (`schemaProject`) is presented as the add-on it is, not the default.
-  - The declarative `conflict` schema axis (Axis 3) is now documented.
-  - The agent docs were corrected to the current claim vocabulary
-    (`reason`/`queue`, not the pre-0.12.0 `action`/`wait`).
-
-  No code changes.
-
-## 0.16.2
-
-### Patch Changes
-
-- **`mintUserSessionKey`: name the shared-schema binding around the project.** The
-  two flat options added in 0.16.0 (`schemaOwnerOrgId` + `schemaProjectId`) are
-  replaced by one project-centric option — `schemaProject: { organizationId, projectId }` —
-  naming "the project that owns the schema" as a single concept. The wire format
-  is unchanged (the SDK still sends the same keys), so no server redeploy is
-  needed. Released as a patch: the replaced options shipped in 0.16.0 and have no
-  external consumers yet.
-
-  ```ts
-  // before
-  mintUserSessionKey({ organizationId, schemaOwnerOrgId, schemaProjectId, ... });
-  // after
-  mintUserSessionKey({
-    organizationId,                                  // data org
-    schemaProject: { organizationId, projectId },    // the project that owns the schema
-    ...
-  });
-  ```
-
-## 0.16.1
-
-### Patch Changes
-
-- **Fix `ablo login` against the standalone auth server.** The device flow now
-  targets two origins instead of one: the RFC 8628 device endpoints
-  (`/api/auth/device/*`) go to the identity server (`auth.abloatai.com`, override
-  `ABLO_AUTH_URL`), while the human approval page (`/cli`), sign-up, and the
-  key-handoff route (`/api/cli/provision-key`) go to the dashboard host
-  (`www.abloatai.com`, new override `ABLO_DASHBOARD_URL`). Previously every step
-  ran against `www`, where the device endpoints no longer resolve —
-  producing "Couldn't start login… Is the dashboard reachable?". The CLI now also
-  builds the approval URL itself rather than trusting the server's
-  `verification_uri`, which (being a relative `/cli`) resolved against the auth
-  server's origin to a 404.
-
-## 0.16.0
-
-### Minor Changes
-
-- **Axis 3 — declare write-conflict behaviour in the schema (new).** A model can now
-  state what happens when a commit collides with a foreign claim or a stale snapshot —
-  per committer kind (`user` / `agent` / `system`) — right next to its fields, using the
-  same `overwrite | reject | notify` vocabulary as the `onStale` write guard. It is a
-  third axis, orthogonal to `policy` (read access) and `groups` (delta routing).
-  - **`conflict` on `model()`** — a plain, serializable disposition map. Pure data, so it
-    round-trips through the schema registry to the server; the generic engine interprets it
-    at the commit chokepoint (no per-model logic in the engine).
-
-    ```ts
-    // "a human's edit always wins (never blocked); an agent yields"
-    conflict: { user: 'overwrite', agent: 'reject' }
-    ```
-
-  - **Composable authoring helpers (new, from `@abloatai/ablo/schema`)** — disposition
-    functions plus a `cn`/`cx`-style combinator, so conflict policy reads like the rest of
-    the DSL (`relation.belongsTo()`) and like modern config (`plugins: [admin(), …]`):
-
-    ```ts
-    import { coordination, humansOverwrite, agentsReject } from '@abloatai/ablo/schema';
-
-    conflict: coordination(humansOverwrite(), agentsReject());
-    // → { user: 'overwrite', agent: 'reject' }
-    ```
-
-    Exports: `coordination`, `humansOverwrite` / `humansReject` / `humansNotify`,
-    `agentsOverwrite` / `agentsReject` / `agentsNotify`,
-    `systemOverwrite` / `systemReject` / `systemNotify`, and the `ConflictRule` type.
-
-  - An omitted committer kind falls through to the engine default (reject; honor
-    `onStale: 'notify'`), so this is fully additive — existing schemas are unchanged.
-    New public types `ConflictAxis` (also `Ablo.Conflict.Axis`) and the
-    `interpretConflictAxis` interpreter are exported for custom policy composition.
-
-- **First-party shared schema for ephemeral keys (new).** `mintUserSessionKey` now accepts
-  `schemaProjectId` + `schemaOwnerOrgId`, binding the minted `ek_` to a schema owner-org +
-  project so **schema** resolves org-independently (one schema serves all of an integrator's
-  end-user orgs) while **data** stays scoped to `organizationId`. Requires the `sk_` to carry
-  `ephemeral:mint-any-org`; omit both for the existing per-org (BYO) behaviour.
-
-## 0.15.1
-
-### Patch Changes
-
-- Loud 0-row writes: surface unmatched UPDATE/DELETE ids and add `AbloNotFoundError`
-
-  A commit now reports the ids of any UPDATE/DELETE that matched zero rows on
-  `CommitReceipt.missingIds`, and the new exported `AbloNotFoundError` lets typed
-  write wrappers throw instead of silently treating a missed write as success.
-  Additive and back-compatible (the field is omitted when nothing missed). This
-  unblocks the slides-sdk name-addressing / own-your-id work, which relies on a
-  loud failure when a stale id is written.
-
-## 0.15.0
-
-### Minor Changes
-
-- **Notify-instead-of-abort: non-coercive conflict handling + read-set (the "did anything I looked at change?" layer).**
-
-  The principle: on a stale-context conflict the engine now **surfaces the current state and lets the actor — agent or human — resolve it**, instead of forcing an outcome. See `docs/concurrency-convention.md`.
-
-  **`onStale` redesigned — Stripe-aligned values (BREAKING).**
-
-  The mode set is now `'reject' | 'overwrite' | 'notify'`. Each value names its outcome:
-  - **`notify` (new, non-coercive)** — the conflicting write is **held** (not applied) and the commit returns a `StaleNotification` carrying the conflicting field's _current_ value, so the actor reconciles and re-commits rather than losing work. The rest of the batch still commits.
-  - **`overwrite`** (was `force`) — blind last-writer-wins, no signal.
-  - **`reject`** (default, unchanged) — throws `AbloStaleContextError`.
-
-  Migration:
-  - `onStale: 'force'` → `onStale: 'overwrite'`.
-  - `onStale: 'flag'` / `onStale: 'merge'` → `onStale: 'notify'` (both removed; `notify` is the single hold-and-surface mode).
-
-  **`StaleNotification` — the new advisory signal.** New public type + `staleNotificationSchema`:
-  `{ object: 'stale_notification', model, id, readAt, observedSyncId, conflictingFields, currentValues, writtenBy, group? }`. Delivered two ways:
-  - on the receipt — `CommitReceipt.notifications` (and `CommitResult.notifications`);
-  - on a new SDK event — **`conflict:notified`** `{ clientTxId, notifications }` (mirrors `reconciliation:needed` / `sync:rollback`).
-
-  **Read-set (`reads[]`) — declare what you looked at, not just what you write (new).** A commit may carry batch-level read dependencies; a moved premise fires that entry's `onStale` over the whole batch (`notify` holds every write + notifies, `reject` aborts, `overwrite` proceeds). Two granularities:
-  - **Row** — `{ model, id, readAt, fields? }`: did this row (optionally these fields) change?
-  - **Group** — `{ group, readAt }`: did anything in this sync group (`deck:abc`, `org:X`) change? — the same unit a participant watches and claims.
-
-  New public type `ReadDependency` + `readDependencySchema`; available on `ablo.commits.create({ operations, reads })` and the lower-level write options. This closes the gap the write-target check alone could not: a premise that changed without the written row changing.
-
-  **Conflict policy.** `ConflictDecision` gains `{ action: 'notify' }`; `defaultPolicy` maps `onStale: 'notify'` → notify-and-hold, everything else → reject. `StaleContextConflict.requestedMode` is added so custom policies can honor the caller's declared intent.
-
-- **Data Source reverse-channel connector (new).** A customer Data Source can now **dial out** to the engine over a single outbound WebSocket (`ablo.source.v1` subprotocol) instead of exposing an inbound HTTP endpoint — the deployment shape private/VPC stores need.
-  - **`createSourceConnector({ apiKey, handler, baseURL? })`** (new public API, exported from the root and `/source`) — opens one outbound socket (Node global `WebSocket`, no new dependency), with reconnect/backoff, and serves the customer's existing Data Source `handler`.
-  - Server side: a connector registry + `/v1/source/listen` upgrade route bridge requests down / responses up, teed into `SourceClient` through the storage resolver.
-  - **Trust model unchanged:** the Standard-Webhooks HMAC is signed _above_ the transport, so the socket carries the signed envelope byte-for-byte and the customer's `verifyAbloSourceRequest` is untouched. Transport changes, trust model doesn't.
-  - Opt-in per source via `reverse_channel_prod` (migration `20260622150000`); gated in `authorizeUpgrade`.
-
-## 0.14.0
-
-### Minor Changes
-
-- Claim API consistency + coordination docs
-  - **React:** document `useWatch` (scoped presence + read-interest, with `claim`/`hydrate`/`paused` options) and `usePeers` (read-only presence) — previously exported but undocumented.
-  - **HTTP claim surface:** `HttpClaimApi` is now a mechanically derived async projection of the reactive `ClaimApi` (`AwaitedClaimMethod`), so the two transports can never drift. No behavior change — the only difference remains the `Promise` wrapper that statelessness forces on `state`/`queue`/`reorder`.
-  - **Naming:** unified the claim read verb to `state` across every layer (the internal `ModelCollaboration.observe` is now `state`, matching the public `ablo.<model>.claim.state({ id })`).
-  - **Docs:** corrected the `Claim` object reference — the field is `reason` (serialized on the wire as `action`), and `createdAt`/`expiresAt` are `number` (epoch-ms), not strings; corrected the claim options to `reason` and `queue`.
-
-## 0.13.0
-
-### Minor Changes
-
-- Schema authoring: split model routing into two orthogonal axes — `policy` (row access) and `groups` (sync-group routing).
-
-  **Breaking (schema authoring).** The flat, collision-prone model options are replaced by two namespaced ones:
-  - **`policy`** — row-access / tenant isolation (named after Postgres/Supabase RLS policies: the rule that scopes which rows a tenant may read). A discriminated union on `by` replaces the old `orgScoped` / `scopedVia` / `orgColumn` trio:
-    - `{ by: 'column' }` — row-local tenancy column (the default when omitted; column name still overridable).
-    - `{ by: 'parent', fk, parent }` — inherit tenancy through a foreign key when the table has no tenancy column of its own (e.g. `slide_layers` → `slides`).
-    - Type `TenancyInput` is renamed `PolicyInput`; `policyInputSchema` / `resolvePolicy` are now exported.
-  - **`groups: { root, grants, roles }`** — which delta channels a row fans into (orthogonal to `policy`, which governs read access). One namespaced object replaces the old flat `scope` / `grants` / `entityRoles`:
-    - `root` (was `scope`) — mark a model a scope root; its records form the group `<kind>:<id>`. Renamed so it no longer collides with the old `scopedVia` tenancy sugar or the inner `grants.scope` relation name.
-    - `grants` — a membership edge granting an identity access to a scope root.
-    - `roles` (was `entityRoles`) — explicit non-relational record→group roles; accepts one role or an array.
-    - `groupsInputSchema` / `GroupsInput` are now exported.
-
-  **CLI.** `config.json` now stores per-project profile key pairs (`profiles: Record<string, ProfileKeys>`) instead of a single top-level pair; older flat layouts are folded into the active profile automatically on read, so existing logins keep working. `login` / `projects` updated to the profile model.
-
-## 0.12.0
-
-### Minor Changes
-
-- Canonicalize the claim API to one vocabulary, plus DX fixes (breaking).
-  - BREAKING: claim phase field `action` → `reason` on every claim surface
-    (`Claim`, `ClaimHandle`, `ClaimCreateOptions`, `ModelClaim`, ...). The wire
-    is unchanged (still `action`, healed on read) — no server redeploy needed.
-  - BREAKING: claim contention flag `wait` → `queue` (one word everywhere).
-  - BREAKING: React hook `useParticipant` → `useWatch` (aligns with `ablo.<model>.watch`).
-  - `ClaimDeclaration.ttlSeconds` is now `number` (was a `Duration`).
-  - Docs: `retrieve` HTTP envelope (`.data`/`.stamp`) called out; `syncGroups`
-    reworded (provisional, not deprecated); `orgScoped` cross-tenant security
-    warning; React error strings point at `<AbloProvider>`.
-
-## 0.11.2
-
-### Patch Changes
-
-- a35d935: Fix stream-recorded undo capturing the wrong "before" value for updates. A second
-  update to the same field before the first sync-ack re-captured the original
-  pre-session value (first-old-wins + clear-only-on-ack), so undo of a quick second
-  edit jumped all the way back instead of one step. The queue now re-baselines a
-  field's tracked `.old` once its before-image is frozen into the committed
-  transaction.
-
-  Also close the create/update undo asymmetry: an update whose written key had no
-  in-place mutation produced an empty `previousData`, which made the inverse
-  un-revertible (a create's `delete` inverse never is). Before-image capture now
-  falls back to the last loaded/acked snapshot.
-
-  Internally, the two undo paths (stream-recorded and manual `RecordingTransaction`)
-  now share one before-image implementation via `Model.capturePreviousValues` /
-  `Model.consumeModifiedFields`, so they can no longer drift.
-
-- One-correct-way consolidation (breaking; no external consumers yet, so released as a patch):
-  - Credentials collapse to a single `apiKey` — a string, or a `() => Promise<string | null>` that
-    fetches a per-user token. Removed `getToken` / `authEndpoint` / public `authToken`.
-  - `ablo.<model>.watch(ids, { ttl })` replaces the top-level `ablo.participants.join({ scope })` —
-    model-scoped read-interest + presence (WebSocket only).
-  - Read claim-gating is `ifClaimed: 'return' | 'fail'` (removed `'wait'`); waiting is the claim
-    primitive's job (`ablo.<model>.claim`).
-  - The stateless client is `Ablo({ transport: 'http' })`; `createAbloHttpClient` is no longer a
-    public export (the factory uses it internally).
-  - Read-option types renamed: `ServerReadOptions` (server `retrieve`/`list`) and `LocalReadOptions`
-    (local `get`/`getAll`).
-  - `defineSchema` throws a clear error on a reserved-field collision; the MCP/docs API surface is
-    now compile-time bound to the real exported types (can't drift).
-
-## 0.11.1
-
-### Patch Changes
-
-- 7f91f6e: DX hardening from a real onboarding session — onboarding, CLI, coordination, types, and docs.
-
-  **Client behavior**
-  - `databaseUrl` is now an explicit, server-only option: `Ablo(...)` no longer auto-reads `process.env.DATABASE_URL`. A stray `DATABASE_URL` (common — Prisma/Drizzle/docker set it) no longer silently flips the client into connection-string mode; a one-time warning points at the explicit option. Passing `databaseUrl: process.env.DATABASE_URL` explicitly is unchanged.
-  - Claims/presence are now observable from any client (including Node agents): reading a row enters its entity sync group (read-interest) and claiming pins it (write-intent), so `ablo.<model>.claim.state({ id })` reports co-participants without any manual subscribe step — whether the observer arrives before the claim (live delta) or after it (subscribe-time backfill). The claim **holder** now also sees its own claim via `claim.state`. **Requires a coordinated `sync-server` deploy** (the subscribe-time claim backfill + the entity-scope subscription gate that lets an org-authority agent key narrow into a row's group live server-side); the client package change alone does not deliver cross-client agent observation.
-
-  **CLI**
-  - `ablo init` detects the `src/app` layout (routes + the `@/ablo` import alias resolve correctly), writes the **real** stored sandbox key into `.env.local` instead of a placeholder, and scaffolds `ablo/register.ts` (a regular module, not a colliding `ablo.d.ts`).
-  - `ablo <command> --help` / `-h` now prints usage instead of erroring with "unknown flag", and `migrate` is listed in the top-level help.
-  - `ablo dev --no-watch` now exits after one push instead of watching forever.
-
-  **Types**
-  - Name the client with `typeof sync` (the value-inferred idiom, like tRPC's `typeof appRouter` / Drizzle's `typeof db`) — `ReturnType<typeof Ablo>` collapses to the untyped client and should not be used. No bespoke client-type generic is needed.
-  - `model_claim_not_configured` message clarified: claiming needs no per-model schema configuration; every model is claimable through the standard client.
-
-  **Docs**
-  - Reconciled the self-contradictory `databaseUrl` story (it is an explicit, server-only option, not auto-read from the environment; consistent casing), documented that the sandbox can host rows (apiKey only, no database), explained why a localhost Postgres can't be the system of record, and led the connect-your-database flow with `ablo pull`/`ablo check` over `ablo migrate`. Fixed stale `api.md` vocabulary (`object: 'claim'`, `participantKind: 'user' | 'agent' | 'system'`).
-
-- 7f91f6e: Docs: document the completed `intent` → `claim` rename. Adds a 0.11.0 migration entry (`useIntent` → `useClaim`, `Register.Intents` → `Register.Claims`, `Ablo.Intent.*` → `Ablo.Claim.*`, and the coordinated client/server deploy for the `claim_*` wire frames), a `useClaim` section in the React reference, and fixes the stale `participantKind` union to the canonical `'user' | 'agent' | 'system'`.
-
-## 0.11.0
-
-### Minor Changes
-
-- Canonical `claim` vocabulary, sync-group area-of-interest, and richer claim-rejection errors.
-  - **`intent` → `claim` everywhere.** The coordination primitive is now a `Claim` across the public surface: `useClaim` replaces `useIntent`, the `Ablo.Claim.*` namespace replaces `Ablo.Intent.*`, and module augmentation registers `Claims` instead of `Intents` on the `Register` interface. The underlying wire frames moved from `intent_*` to `claim_*` — clients and servers must run a `claim_*`-aware build together.
-  - **Sync-group area of interest.** A client's read interest is no longer frozen at connect: the new `update_subscription` frame drives live re-indexing, and `enterScope` / `leaveScope` / `pinScope` / `unpinScope` let a store narrow or widen what it streams. `AreaOfInterestManager` adds hysteresis (warm-TTL), claim-pinning, reconcile coalescing, and an LRU cap so narrowing the view never shrinks the write allowlist.
-  - **Richer claim-rejection errors.** Rejections (over WebSocket and HTTP) now carry `heldByClaim` and `policyReason`, and `AbloClaimedError` exposes a typed `claims` array so callers can see exactly who holds the contested rows.
-  - **Coordination vocabulary consolidation.** Participant identity is canonical `user` | `agent` | `system`; the server stamps `participantKind` on every presence emit and clients read it, so non-human peers surface correctly.
-
-## 0.10.1
-
-### Patch Changes
-
-- Docs: add the 0.10.0 entry to the Version History & Migration Guide — the `test`/`live` → `sandbox`/`production` environment enum rename (key prefixes unchanged) and the new `transport: 'http'` stateless client.
-
-## 0.10.0
-
-### Minor Changes
-
-- Rename environment enum values to `production` and `sandbox` while preserving the existing `*_live_`/`*_test_` key prefix format.
-
-### Patch Changes
-
-- Stateless HTTP transport for server-side actors, and a canonical environment vocabulary.
-  - **`Ablo({ transport: 'http' })`** returns a stateless `AbloHttpClient` for agents, workers, and serverless — the same `ablo.<model>` surface and coordination plane with no websocket: each call is one HTTP round-trip and identity rides the Bearer credential. The return type narrows so stateful-only APIs (`get`/`getAll`/`onChange`) are compile errors instead of latent runtime gaps.
-  - **Canonical `production` / `sandbox` environments** (new `environment.ts`, exported from the root): `sk_test_` / `sk_live_` remain the wire-level key prefixes but now map to `production` / `sandbox` everywhere — key parsing, source `mode`, and the CLI (which drops the legacy test/live config migration).
-  - **Source-mode commit scoping**: `commit` now forwards `projectId`, `accountScope`, and `environment` to customer storage resolvers, so per-project and sandbox/production traffic can be routed to distinct stores.
-  - **Fixes**: the WebSocket bearer credential is sent in the `ablo.bearer.<token>` subprotocol (never in the URL or proxy logs); `Model` no longer fabricates an `updatedAt` of "now" for records that arrive with only `createdAt`.
-
-## 0.9.15
-
-### Patch Changes
-
-- Package metadata: set the npm description to "The Collaboration Layer For AI Agents" (matching the GitHub repo About) so it stops reverting to the old "State control API…" text on publish.
-
-## 0.9.14
-
-### Patch Changes
-
-- README: replace the `schema -> ablo.<model>...` pseudo-diagram with a real typed snippet (`create`/`retrieve`/`update`/`claim`), and tidy the Get-started line.
-
-## 0.9.13
-
-### Patch Changes
-
-- Per-project axis: schemas, planes, routing, and enforcement scoped per project. Adds the control plane, per-project key scoping with identity threading, a `remove_model` gate, and the CLI/docs to drive it.
-
-## 0.9.12
-
-### Patch Changes
-
-- README: point the Docs / Quickstart / API header links at `docs.abloatai.com` (the real docs) instead of `abloatai.com`, which 307-redirects to the marketing site.
-
-## 0.9.11
-
-### Patch Changes
-
-- `Model<'name'>` type helper via the `Register` binding — name your model in one parameter (`Model<'tasks'>`) instead of restating `typeof schema`; `Model<S, 'name'>` is also supported and `InferModel` is deprecated. CLI: retire the stale `dev` wording from the login outro and `push` header. Docs: cover the `Register` binding end-to-end and document the `pk_` publishable key + the `/api/v1/commits` HTTP path.
-- 3024593: Fix `sessions.create({ user })` 403 — user sessions now mint via the sk\_-gated ephemeral-key door
-  - `sessions.create({ user })` mints an `ek_` user session via `/auth/ephemeral-keys` (was wrongly routed through `/auth/capability`, which rejects human participants — writes were being attributed to agents).
-  - Control-plane calls always present your original `sk_`, never the client's exchanged sync credential.
-  - `sessions.create({ agent, can })` no longer requires hand-built `syncGroups` — the org anchor is the server default — and the `can` allowlist is now honored at commit time (model-alias matching).
-  - New: `ablo.organizationId` (resolved after `ready()`), `ablo status --json`, typed sync-group inputs (`SyncGroupInput` + `invalid_sync_group` rejection for malformed groups).
-
-## 0.9.10
-
-### Patch Changes
-
-- README: add a centered brand header (Ablo banner, tagline, doc nav links, and status badges).
-
-## 0.9.9
-
-### Patch Changes
-
-- Docs: version history & migration guide refinements plus changelog, audit, and link fixes.
-
-## 0.9.8
-
-### Patch Changes
-
-- Docs: add a Version History & Migration Guide, bring the changelog current, and sync doc trees. Drop the dormant `causedByTaskId` from the audit-row docs and fix the `ablo mode` argument vocabulary.
-
-## 0.9.7
-
-### Patch Changes
-
-- Docs: fix the `commits.create` operation shape to the public `{ action, model, data }` form.
-
-## 0.9.6
+  The public repository preserves the workspace structure used for development
+  instead of flattening sources into a generated package. The branded banner,
+  documentation, examples, license, notices, and release automation remain part
+  of the repository.
 
-### Patch Changes
-
-- CLI quickstart simplification (3 commands). `init` now owns login, `migrate` is dropped from the direct-`databaseUrl` quickstart (dev handles it), and the `dev` command is renamed to `push` for honest naming with headless-safe login. **Note:** `ablo dev` is now `ablo push` — update any scripts. Also fixes 3 production bugs surfaced by the new end-to-end journey test harness.
-
-## 0.9.5
-
-### Patch Changes
-
-- Scoped-role automation + tenant-routing fix. `ablo migrate` now auto-creates the RLS-gated scoped role (zero SQL) with a log-safe SCRAM-SHA-256 password verifier, plus a Neon/Supabase scoped-role `databaseUrl` recipe. Fix a jsonb double-encode that corrupted per-tenant routing and silently fell back to the shared pool.
-
-## 0.9.4
-
-### Patch Changes
-
-- Sync-position correctness + CLI hardening. Consolidate five scattered sync cursors into one typed `syncPosition` (persisted/applied/acked with a derived `readFloor`), fixing a claim taken right after an ack-confirmed write reading stale against that write's own delta. Add transaction ack-confirmation, schema DDL-first-push, and a reworked CLI (config/dev/login/mode/drizzle-pull).
-
-## 0.9.3
-
-### Patch Changes
-
-- Onboarding: quickstart leads with your-own-database (Drizzle Data Source), drop Ablo-managed mode, add `ablo push` step; context7 library-claim config.
-
-## 0.9.2
-
-### Patch Changes
-
-- Developer-onboarding overhaul so an LLM or a person gets a working integration on the first try.
-  - **`ablo init` scaffolds a project that builds and is current-API.** The Next.js scaffold now ships `app/providers.tsx` + an `app/api/ablo-session` route, uses `useAblo` (the removed `withSync` is gone), object-param verbs, and never bundles your `sk_` key into the browser. The webhook receiver moved off the `[...all]` catch-all.
-  - **Agent docs are accurate and ship.** `AGENTS.md`, `llms.txt`, and `llms-full.txt` are on the 0.9.x API (object-param `create`/`update`/`delete`/`retrieve`, disposable `await using claim`, `AbloProvider client` prop), lead with `ablo init`, and `AGENTS.md` now ships in the package.
-  - **`ablo push` is self-documenting.** Writing to a model the server hasn't seen now fails with an error that tells you to run `ablo push` (the `server_execute_unknown_model` / `unknown_model` messages), instead of a cryptic "unknown model."
-  - **`intents` is deprecated in favor of `claim`** everywhere the docs and the MCP scaffold/prompts teach or generate coordination; the public `ablo.intents` accessor is marked `@internal`.
-  - Docs say Node 24+, and the `drizzle-orm` peer floor is `>=0.44`.
-
-- a88747a: Remove the `turn` primitive and the agent-work `tasks` resource from the client surface — the SDK is now purely `ablo.<model>` + `claim`.
-
-  **Breaking**
-  - `engine.beginTurn()`, the `Turn` handle interface, and the `Ablo.Turn` type are removed. `AbloApi.beginTurn` and the HTTP client's `beginTurn` are gone too.
-  - `CommitCreateOptions.causedByTaskId` is removed. (Lineage is no longer stamped from the client.)
-  - The engine no longer exposes a `protocol` accessor or a public `tasks` work-unit resource. `ablo.tasks` is, and always was, the schema `tasks` model proxy.
-  - The **`agent().run()` helper and the low-level agent/task type family are removed**: `AbloApi.agent(id, options)` and `AbloApi.tasks` (the `TaskResource`), plus the exported types `Agent`, `AgentOptions`, `AgentRunOptions`, `AgentRunResult`/`Done`/`Failed`/`Cancelled`, `AgentRunStatus`, `AgentRunContext`, `AgentModelClient`, `AgentModelReadOptions`, `AgentModelMutationOptions`, `AgentIntentOptions`, `AgentIntentInput`, `Task`, `TaskResource`, `TaskCreateOptions`, `TaskCloseOptions`, `TaskCloseResult` (and the `Ablo.*` namespace aliases for all of them). The `Ablo.Auth.Agent` principal constructor and the schema-backed `tasks` model are unaffected.
-
-  **Why**
-
-  `turn`/`agent_tasks` was a second coordination-and-attribution mechanism living alongside `claim`. It is redundant on the client:
-  - `claim` already serializes writers **and** carries the causal link — its `intent` id rides on every guarded write.
-  - The server stamps `actor` / `onBehalfOf` / `capabilityId` onto each delta from the auth context.
-  - Per-run token/cost is recorded in Langfuse, not the `agent_tasks` table.
-
-  So the only thing the client lost is the audit pane's "show everything this exact prompt produced" filter, which keyed off `caused_by_task_id`; new writes leave that column null.
-
-  **Migration**
-
-  Agents stop opening/closing tasks — just issue `ablo.<model>` writes (schema-backed) or `ablo.commits.create(...)` (schema-less) under a `claim`. Replace `Ablo({ apiKey }).agent(id, opts).run(prompt, handler)` with: mint a scoped credential via `sessions.create({ agent })`, then `claim` the row and `update` / `commits.create`.
-
-  The **server** `agent_tasks` table, the `caused_by_task_id` delta column, the `/api/sync/commit` wire field, and the `agent_actions_log` compliance hash-chain remain in place but **dormant** (client writes leave the field null) — they are load-bearing for the tamper-evident audit chain and historical-row audit JOINs, so they are intentionally NOT dropped. The dead `/v1/tasks` + `/api/agent/turn` route handlers ARE removed (zero live callers).
-
-## 0.9.1
-
-### Patch Changes
-
-- 90b656c: `drizzleDataSource` now takes `(db, schema)` and derives snake_case columns from your schema, so it composes with `ablo migrate` with no parallel Drizzle table. Update calls from `drizzleDataSource(db, tables)` → `drizzleDataSource(db, schema)`. Also adds the `snakeToCamel` export and provisions the adapter's `ablo_outbox` / `ablo_idempotency` tables via `ablo migrate`.
-
-## 0.9.0
-
-A single options object for every model verb, and a disposable `claim` handle.
+  The new package pages direct application developers to the branded Ablo
+  entrypoints while still documenting where integration authors can find the
+  lower-level transaction and interactive-client contracts.
 
-### Breaking Changes
+- f60ed16: Improve confirmed commit throughput and live-client materialization without
+  weakening atomic writes, ordered observation, audit delivery, or replay.
 
-- **One options object per verb.** `create`, `update`, `delete`, and the async
-  server `retrieve` each take a single options object instead of positional
-  arguments, so the id, the data, and every modifier live as named siblings:
-  `create({ data, id? })`, `update({ id, data, ...options })`,
-  `delete({ id, ...options })`, `retrieve({ id, ...options })`. Reactive local
-  reads stay on `get(id)` (synchronous) —
-  `useAblo((ablo) => ablo.tasks.get(id))`.
+  The certified AWS benchmark sustained more than 10,000 committed operations per
+  second for homogeneous creates, mixed creates, updates, and deletes with zero
+  write errors and sub-second publication drain. The result covers the documented
+  single-plane, 12-client, 500-operation benchmark topology rather than claiming
+  universal production capacity.
 
-  ```diff
-  - await ablo.tasks.update(id, { status: 'done' }, { wait: 'confirmed' })
-  + await ablo.tasks.update({ id, data: { status: 'done' }, wait: 'confirmed' })
-
-  - await ablo.tasks.retrieve(id)
-  + await ablo.tasks.retrieve({ id })
-
-  - useAblo((ablo) => ablo.tasks.retrieve(id)) ?? serverTask
-  + useAblo((ablo) => ablo.tasks.get(id)) ?? serverTask
-  ```
-
-- **`claim` returns a disposable handle** instead of taking a callback. The
-  handle exposes the fresh row on `.data` and is released on scope exit
-  (`await using`) or explicitly via `.release()`. `claim.state`, `claim.queue`,
-  `claim.release`, and `claim.reorder` also take the options object.
-
-  ```diff
-  - await ablo.tasks.claim(id, async (task) => {
-  -   await ablo.tasks.update(task.id, { status: 'in_review' })
-  - })
-  + await using claim = await ablo.tasks.claim({ id })
-  + const task = claim.data
-  + await ablo.tasks.update({ id: task.id, data: { status: 'in_review' } })
-  ```
-
-## 0.8.0
-
-A callable `claim` coordination namespace and bring-your-own-database support
-via a new `databaseUrl` option.
-
-### Minor Changes
-
-- **Callable `claim` coordination namespace.** Taking a claim and inspecting its
-  state now live under one accessor: `claim(id, work)` acquires a claim and runs
-  `work` while it's held, and `claim.state(id)`, `claim.queue(id)`,
-  `claim.release(id)`, and `claim.reorder(id, order)` cover the surrounding
-  lifecycle. The README leads with the problem (who is allowed to act, and in
-  what order) and the Quick Start now demonstrates `claim` directly.
-
-- **Bring-your-own-database via `databaseUrl`.** Point a project at your own
-  Postgres with `Ablo({ schema, apiKey, databaseUrl })`. Ablo writes synced rows
-  back into your database, so your data stays canonical. Server-side only;
-  defaults to `process.env.DATABASE_URL`. See the data-sources guide for setup
-  and role requirements.
-
-### Breaking
-
-- The flat coordination methods `claimState`, `queue`, `release`, and `reorder`
-  are removed in favor of the `claim` namespace above.
-
-  ```diff
-  - await ablo.task.claimState(id)
-  - await ablo.task.release(id)
-  + await ablo.task.claim.state(id)
-  + await ablo.task.claim.release(id)
-  ```
-
-## 0.7.0
-
-### Minor Changes
-
-- Structured error contract, schema/migration engine, and a full `ablo` CLI.
-  - **Structured error contract across HTTP + WS planes.** A closed, canonical
-    error-code registry is now the `code` tier of a Stripe-style error model. A
-    single HTTP egress funnel converts every throw to a canonical
-    `{ type, code, message, doc_url, request_id, ...details }` envelope; the WS
-    plane narrows mutation/claim error codes to the same union.
-  - **Versioned contract + drift guard.** `ERROR_CONTRACT_VERSION` (date-based)
-    ships in `errors.json` and on the `Ablo-Version` response header, so consumers
-    detect contract changes without diffing docs. Generated `errors.mdx` /
-    `errors.json` plus a CI drift guard keep the docs, OpenAPI spec, and SDK from
-    silently diverging from the registry.
-  - **Always-on request correlation.** Every response carries a `req_…` request id
-    (honoring an inbound `x-request-id`), stamped into the envelope's `request_id`.
-  - **OpenAPI parity.** The stale `{ error, reason }` schema is replaced by the
-    canonical envelope plus a generated `ErrorCode` enum.
-
-  CLI + schema:
-  - **Schema diff + migration planning engine** (`generateProvisionPlan` /
-    `generateMigrationPlan` in `@abloatai/ablo/schema`) — pure diff, classify,
-    apply, and constant-value backfill for required-field migrations.
-  - **`ablo generate`** — emit TypeScript types from the pushed schema.
-  - **Full `ablo` CLI suite**, Stripe-CLI-shaped: `init`, `login` / `logout` /
-    `status`, `mode [test|live]`, `dev` (push schema to the test sandbox + watch),
-    `logs` (tail your scope's commit activity), and the data-source commands below.
-    Authentication is the OAuth 2.0 device flow; `login` provisions and stores a
-    test and a live key, and `mode` switches the active one.
-  - **Database-URL structure (bring-your-own-database).** The CLI is split by where
-    it writes:
-    - `ablo pull` / `ablo check` / `ablo migrate` operate on **your own
-      `DATABASE_URL`** — `pull` introspects it to emit `defineSchema(...)` from
-      existing tables (read-only, like `prisma db pull`), `check` verifies tables
-      fit the schema with no DDL, and `migrate` applies DDL to `DATABASE_URL`.
-    - `ablo schema push` / `ablo dev` target the **hosted** test/live sandbox; the
-      server diffs, migrates, and activates the uploaded schema. `dev` never
-      touches live data.
-
-  **BREAKING** — removed the legacy React hooks `useQuery` / `useOne` / `useMutate`
-  / `useReader`. Use `useAblo()` + `ablo.<model>.*` instead. The `MutateActions`,
-  `ReaderActions`, and `ReaderFindOptions` types are still re-exported for callers
-  that referenced them.
-
-## 0.6.0
-
-### Minor Changes
-
-- 0f663e7: Coordination surface: fair queue, reactive wait-line, and lease renewal.
-  - **Claims acquire through a server FIFO queue.** On contention a claim waits its turn and re-reads before proceeding; reads are never blocked. Writes blocked by another participant's claim throw a typed `AbloBusyError`.
-  - **`ablo.<model>.queue(id)`** — reactive read of the wait-line behind a row: who's queued, their action, and FIFO position. Synced to peers like `activity(id)`.
-  - **Backpressure on `claim`** — `{ wait: false }` skips instead of waiting if the row is already held (claim-or-skip dedup); `{ maxQueueDepth: n }` bails with `AbloBusyError('queue_too_deep')` rather than joining a line already that deep.
-  - **Lease renewal** — a held claim renews automatically while the holder's connection is alive, so you never size a TTL; it lapses only after the holder goes silent. A queued claim that's abandoned is dequeued (no ghost waiters).
-  - **Reads are never gated by a claim**, including for agents.
-  - Intent vocabulary cleanup: a waiting claim is an `Intent` with `status: 'queued'` (`position` carries its place in line). Removed the unbuilt `whenFree`.
-
-- **BREAKING — API renames** (apply when upgrading from 0.5.1):
-  - Change-listeners renamed to `.onChange(...)`: `ablo.<model>.subscribe(cb)`, `presence.subscribe()`, `intents.subscribe()` → `.onChange(...)`. (`subscribe` is reserved for an upcoming scope-grant verb.)
-  - Row-access API renamed Resource → Model: `Ablo.Resource.*` → `Ablo.Model.*`, `ablo.resource(name)` → `ablo.model(name)`, `ModelTarget.resource` → `ModelTarget.model`, error code `resource_not_found` → `model_not_found`.
-
-## 0.5.1
+  Live clients now defer reactive model activation until state reaches a
+  consumer-visible boundary and keep cache eviction work bounded under sustained
+  ingestion. Optimistic state and actively observed models remain immediately
+  reactive.
 
 ### Patch Changes
 
-- Docs: add a React quick-start (provider + `useAblo`), plain-language rewrite, and a "Set up with Claude Code" section.
-
-## 0.5.0
-
-### Minor Changes
-
-- 9154c1b: Rename intent handle methods to a clearer claim vocabulary; add `AbloProvider` `bootstrapMode`.
-
-  BREAKING — on the model intent handle (`ablo.<model>.intent(id)`):
-  `acquire`→`claim`, `acquireOrAwait`→`claimOrWait`, `settled`→`whenFree`,
-  `release`→`finish`, `revoke`→`cancel`. The lower-level `IntentHandle` /
-  `IntentLeaseHandle` (`ablo.intents.*`) are unchanged.
-
-  Also: `AbloProvider` gains a `bootstrapMode` prop (`'full' | 'none'`) to skip the
-  baseline pull on read-light pages; `StaleContextConflict` gains an optional
-  `conflictingFields`; README + JSDoc clarity pass and a new HTTP API section.
-
-## 0.4.0
-
-### Minor Changes
-
-- Per-entity coordination intents on the model accessor.
-
-  Coordinate writes to an entity through the same accessor you read it with —
-  `ablo.<model>.intent(id)`, returning a `ModelIntentHandle`. Intent state is one
-  self-describing object (`{ object: 'intent', id, status, target, action, heldBy,
-participantKind, createdAt?, expiresAt? }`) with a single lifecycle:
-  `status: 'active' | 'committed' | 'expired' | 'canceled'`. An `active` intent is
-  the lock.
-
-  ### Added
-  - `ablo.<model>.intent(id)` → `ModelIntentHandle<T>`, beside `create` / `update`
-    / `retrieve` / `load` on every model.
-    - Read side (any participant, synchronous + reactive): `current` (the holder's
-      intent, or `null`), `status` (`'idle'` when free), `settled()`.
-    - Write side (the holder): `acquire()`, `acquireOrAwait()`, lease-guarded
-      `update()`, `release()`, `revoke()`.
-    - `AsyncDisposable`: `await using lock = ablo.<model>.intent(id)` auto-releases
-      on scope exit.
-  - `acquireOrAwait()` — serialize-on-contention: take the lease, or wait out the
-    current holder, re-read the changed row, then take it. The caller never branches
-    on who holds the target — it just gets the target safely. Bind it to an agent's
-    write-tool boundary so agents never reason about coordination.
-  - New exports: `ModelIntentHandle`, `ModelIntentAcquireOptions`.
-
-  ### Changed
-  - `acquire()` is fire-and-forget over the socket — it does not throw on conflict.
-    Resolve contention with `acquireOrAwait()` (wait) or read `current` for a
-    reactive "who's editing" badge, rather than catching a rejection.
-
-  ### Deprecated
-  - Participant-level `intents.claim()` / `onRejected()` and the `intent_rejected`
-    wire frame still work but are superseded by the per-model handle. Their removal
-    is a future breaking change.
-
-## Unreleased
-
-Schema-driven identity sync-group composition, plus a terser capability surface.
-
-The convention for deriving a participant's allowed sync-groups from its identity is now declared on the consumer's schema as an open registration. Consumers with a `{ regionId, customerId }` identity shape declare their own roles instead of receiving any built-in prefixes from the SDK.
-
-Capability fields shed their redundant `allowed` prefix to match the surrounding vocabulary — capability inputs always describe what the bearer _can_ touch, so the prefix was doing no disambiguation work for the consumer.
-
-### Added
-
-- `DefineSchemaOptions.identityRoles?: readonly IdentityRole[]` — open registration of identity-anchored sync-group roles on `defineSchema(...)`. Each `IdentityRole` declares `{ kind, template, extract }`: a diagnostic label, a `'<prefix>:{id}'` template, and a pure extractor function from an opaque identity context to zero-or-more ids. No closed enum; consumers fully control both the template strings and the extraction logic.
-- `composeIdentitySyncGroups(identity, schema)` exported from `@abloatai/ablo/schema` — walks the schema's registered `identityRoles`, calls each extractor, and substitutes ids into templates. Stable, deduped output. Returns `[]` when no roles are registered.
-- `Schema.identityRoles: readonly IdentityRole[]` — the registered list, accessible on every `defineSchema(...)` result.
-- New exported types: `IdentityRole`, `IdentityContext`.
-
-### Breaking
-
-- `capabilities.create({ allowedSyncGroups, allowedOperations })` → `capabilities.create({ syncGroups, operations })`. Both fields renamed at every public surface — capability create input, capability retrieve response, capability record, Identity returned from `AuthProvider`. Hard rename, no alias. Update the call sites; the field semantics are unchanged.
-
-  ```ts
-  // Before
-  await api.capabilities.create({
-    allowedSyncGroups: ['org:acme'],
-    allowedOperations: ['tasks.update'],
-    lease: '10m',
-  });
-
-  // After
-  await api.capabilities.create({
-    syncGroups: ['org:acme'],
-    operations: ['tasks.update'],
-    lease: '10m',
-  });
-  ```
-
-### Changed
-
-- `docs/integration-guide.md` §1 now shows `identityRoles` in the canonical `defineSchema` example plus a "Declaring scope on a model" subsection covering `orgScoped` / `scopedVia` / `syncGroupFormat`. `docs/capabilities.md`, `docs/api.md`, `docs/mcp.md`, and `AGENTS.md` cross-reference the `identityRoles` section and use the renamed fields throughout.
-
-## 0.3.0 (2026-04-22)
-
-Umbrella `<AbloProvider>` for React apps. One provider component now owns the full lifecycle — singleton rotation on auth change, Strict-Mode-safe bootstrap, `beforeunload` cleanup, session-expiry IndexedDB wipe, post-bootstrap hooks, mesh client construction. Replaces the ad-hoc provider glue every consumer had to write themselves.
-
-Declarative props absorb every class of lifecycle glue; the status hook returns a tagged union so impossible states are unrepresentable. The reference integration shrank from 515 LOC of hand-rolled singleton/AbortController/beforeunload/reaction-bridge wiring to a 60-LOC thin wrapper that just passes props through.
-
-### Added
-
-- `<AbloProvider>` — umbrella provider at `@abloatai/ablo/react`. Props include data config (`schema`, `url`, `userId`, `organizationId`), auth (`capabilityToken` / `apiKey` / session cookie fallback), declarative behavior (`preventUnsavedChanges`, `lostConnectionTimeout`, `postBootstrap`), callbacks (`onSessionExpired`, `onError`, `resolveUsers`), and DI escape hatches.
-- `<SyncGroupProvider id="matter:...">` + `useSyncGroup()` — per-entity scope context.
-- `<ClientSideSuspense fallback={...}>` — gate renders until the engine reports `connected`. Phase-1 non-Suspense; phase-2 upgrades to real Suspense.
-- `useSyncStatus()` rewritten as a tagged union: `{ name: 'initial' | 'connecting' | 'connected' | 'reconnecting' | 'disconnected' | 'needs-auth', ... }`. Impossible states are unrepresentable.
-- `useCurrentUserId()` — returns the `userId` prop. Replaces downstream consumers' defineProperty hacks on the store.
-- `useErrorListener(cb)` — imperative error callback (Sentry/Datadog).
-- `useSync<R>()` and `useSyncStore<T>()` accept generic parameters so consumers can widen to their concrete schema types without `as unknown` casts at call sites.
-- `BaseSyncedStore.purge()` / `SyncEngine.purge()` — disconnect + wipe every `ablo_*` / `ablo-*` IndexedDB. Called automatically on session expiry.
-- `SyncEngine.onSessionError(listener)` — subscribe to session-error events. Multiple subscribers supported.
-- Commit payload projection built into `TransactionQueue`. Mutations are automatically projected onto the model's schema-declared fields (dropping framework internals `__class` / `__typename` / `clientId` / `syncStatus` and anything not declared), with `field.json()` values auto-stringified for TEXT columns and `undefined` dropped on updates. No config port, no consumer hook — the SDK derives correct wire payloads from the schema alone. Apps that previously maintained hand-rolled extractor tables can delete them entirely.
-
-### Breaking (continued)
-
-- Removed `SyncEngineConfig.extractCreateInput` and `SyncEngineConfig.buildUpdateInput`. The SDK's built-in projection replaces them. Consumers who passed these in `configOverrides` should delete the override; the default now covers 100% of identity-column mutations. The `configOverrides` prop still exists but its remaining fields are all deprecated (see below) and scheduled for removal in v0.4.
-
-### Deprecated (vestigial — removal in v0.4)
-
-- `SyncEngineConfig.modelCreatePriority`, `defaultCreatePriority`, `defaultNonCreatePriority` — never read at runtime.
-- `SyncEngineConfig.batchableModels` — never read at runtime.
-- `SyncEngineConfig.dedicatedDeleteModels` — never read at runtime.
-- `SyncEngineConfig.preserveCaseModels` — never read at runtime.
-- `SyncEngineConfig.essentialFields` — used only in debug logging, no behavioral effect.
-- `SyncEngineConfig.classNameFallbackMap` — dead path; `ModelRegistry.registerModelsFromSchema` registers by constructor identity, bypassing the class-name fallback entirely.
-
-### Breaking
-
-- Removed `<SyncProvider>` — folded into `<AbloProvider>`. Migrate by swapping the provider and passing `userId`/`organizationId`/`url` instead of a pre-constructed store.
-- Removed `createAbloContext()` factory and its returned `AbloProvider` / `useAblo` / `useParticipant` triple. Mesh is now always-on inside `<AbloProvider>`; `useAblo()` and `useParticipant(opts)` are always available. Schema-typed mesh hooks are on the roadmap.
-- Removed `withSync` (no-op alias of `observer`). Import `observer` from `mobx-react-lite` directly if needed.
-- Removed `useSyncContext` from the public surface (never used outside the SDK's test helpers).
-- `useSyncStatus()` return shape changed from six booleans to a tagged union. Migration: `const { isReady } = useSyncStatus()` → `const status = useSyncStatus(); const isReady = status.name === 'connected'`.
-- `SyncStoreContract` gained six sync-status getters and a `syncStatus` field. Third-party classes implementing the contract must add these (additive for callers).
-
-### Migration
-
-```tsx
-// Before (0.2.x)
-const { AbloProvider, useAblo, useParticipant } = createAbloContext<typeof schema>();
-
-function Root() {
-  const sync = createSyncEngine({ url, schema, user });
-  const ablo = new Ablo({ schema });
-  return (
-    <SyncProvider store={sync._store} organizationId={orgId}>
-      <AbloProvider ablo={ablo}>
-        <App />
-      </AbloProvider>
-    </SyncProvider>
-  );
-}
-
-// After (0.3.0)
-function Root() {
-  return (
-    <AbloProvider
-      schema={schema}
-      url={url}
-      userId={userId}
-      organizationId={orgId}
-      preventUnsavedChanges
-      onSessionExpired={() => router.replace('/signin')}
-    >
-      <ClientSideSuspense fallback={<Skeleton />}>
-        <App />
-      </ClientSideSuspense>
-    </AbloProvider>
-  );
-}
-```
-
-No breaking change to `useQuery` / `useOne` / `useMutate` / `useReader` / `useMutators` / `useUndoScope` / `usePresence` / `useIntent` — call sites remain source-compatible.
-
-## 0.2.1 (2026-04-22)
-
-React bindings hardening. Fixes two infinite-loop classes that surfaced in downstream apps as React error #185 ("Maximum update depth exceeded"), and exposes sync-status reactivity as a first-class observable + hook.
-
-### Fixed
-
-- **`useQuery` / `useOne` no longer loop on `getSnapshot`.** The `useSyncExternalStore` adapter was returning a fresh `view.results.slice()` on every call, which React's post-commit consistency check interpreted as "store updated mid-render" — scheduling another render, another snapshot, another mismatch, ad infinitum. The snapshot is now cached in a ref and only refreshed inside the subscribe callback right before `onChange()` fires. Affected every tree with multiple simultaneous `useQuery` subscribers.
-
-### Added
-
-- **`BaseSyncedStore` sync status is now properly observable.** `syncStatus` and `dataReady` are annotated `observable`; `isReady`, `isSyncing`, `isOffline`, `isReconnecting`, `isError`, `hasUnsyncedChanges` are `computed`. Before, these were plain getters over plain fields — `reaction(() => store.isReady, ...)` silently never fired. Existing `observer` / `reaction` call sites that relied on the implicit `pool.size` trigger will continue to work; new call sites should read these observables directly.
-- **`useSyncStatus()` React hook.** Returns `{ isReady, isSyncing, isOffline, isReconnecting, isError, hasUnsyncedChanges }` as a reactive snapshot, bridged via `useSyncExternalStore` with a correctly-cached snapshot. Replaces hand-rolled `reaction` bridges in consumer providers. See `docs/react.md`.
-- **`SyncStoreContract` surfaces the status getters** so TypeScript autocomplete works from the `useSyncContext()` return value without a cast.
-
-### Documentation
-
-- **`llms.txt` and `docs/react.md`** gained a "Common pitfalls" section covering the three traps this release addresses: don't wrap providers in `observer()`, `getSnapshot` must return a cached reference, and sync-status fields are real observables (don't watch `pool.size` as a proxy).
-
-### Migration
-
-No breaking changes. Optional: replace any local `reaction(() => store.isReady, setReady, { fireImmediately: true })` bridges in your own providers with `const { isReady } = useSyncStatus()` for consumers below the store provider.
-
-## 0.2.0 (2026-04-21)
-
-Mesh SDK — the canonical agent-multiplayer surface. Locked at this release; further work is consolidation, not expansion.
-
-### What's frozen
-
-The SDK covers exactly three integration shapes. Each has a canonical example in [`examples/`](./examples/):
-
-1. **Server agent** — `new Ablo({ schema })` reads `ABLO_API_KEY`, joins and works. ([`examples/server-agent.ts`](./examples/server-agent.ts))
-2. **Browser app** — server mints a scoped capability, browser holds it via `new Ablo({ schema, capabilityToken })`. No API key in bundle, no session cookies, no allowed-origins registration required. Stripe `client_secret` shape. ([`examples/browser-app.ts`](./examples/browser-app.ts))
-3. **Sub-agent** — `parent.join(child, opts)` attenuates from the parent's capability. ([`examples/sub-agent.ts`](./examples/sub-agent.ts))
-
-### Ergonomics (package-wide)
-
-- **`Ablo` class** — `import Ablo from '@abloatai/ablo'` / `new Ablo({ schema })`. Matches `new Stripe()` / `new OpenAI()` / `new Anthropic()` pattern. `createMesh(opts)` stays available as the functional alias.
-- **Model-scoped joins** — `ablo.matters.join(id, { label })` desugars to the generic `join`. Proxy-based so the namespace adapts to any schema. Collisions with reserved admin fields (`roles`, `members`, `audit`, `capabilities`) throw at construction time.
-- **Flat scope form** — `scope: { matters: id }` alongside the array form.
-- **`as` alias** — `{ as: session({...}) }` replaces the security-jargon `onBehalfOf`; both still accepted.
-- **Auto-connect** — `join()` returns a connected participant. `autoConnect: false` to opt out.
-- **Duration strings** — `ttl: '3m'`, `ttlSeconds: '24h'` accepted alongside numbers.
-- **Descriptive generics** — every public type uses `TSchema` / `TAgent` / `ModelName` instead of `S` / `A` / `K`. Zero `unknown` in public types.
-
-### Coordination primitives
-
-- **Presence verbs** — `participant.presence.editing(target)` / `viewing(target)` / `idle()`. Plus `update({...})` escape hatch for custom actions.
-- **Intent verbs** — `participant.intents.editing(target, opts)` / `writing(target, opts)`. Returns an `IntentHandle` with `Symbol.asyncDispose` so `await using work = ...` auto-revokes.
-- **Snapshots** — `const snap = await participant.snapshot({ clauses: [id] })`. Flat shape: `snap.clauses[id]` (typed from schema via `InferModel`, not `unknown`), `snap.stamp`, `snap.signal` (AbortSignal).
-- **Async iterables** — `for await (const peers of participant.presence)`, `for await (const openIntents of participant.intents)`, `for await (const delta of participant.deltas)`.
-
-### Env / config
-
-- `ABLO_API_KEY` — required for server-side use.
-- `baseURL` — optional override for private deployments / local-dev (defaults to `wss://api.abloatai.com`).
-- `organizationId` — **no longer required** in `createMesh`. The API key or session binds the caller to one org; the capability mint response echoes it back.
-- `createMeshFromEnv` — removed. `new Ablo({ schema })` auto-reads env.
-
-### Test coverage
-
-- 53 mesh unit tests across 8 suites (`__tests__/unit/mesh/`)
-- New E2E test `e2e-browser-capability-token.ts` proves the server-mints / browser-holds flow end-to-end
-- Existing 12 mesh E2E tests (token refresh, watermark, chinese wall, etc.) still pass
-
----
-
-## 0.1.0 (2026-04-10)
-
-Initial release.
-
-### Features
-
-- **Schema DSL**: Zero-codegen schema definition with full TypeScript inference (`defineSchema`, `field`, `relation`)
-- **React Hooks**: `useModels`, `useModel`, `useMutations`, `withSync` for reactive data binding
-- **Consumer API**: `createSyncEngine()` — one-liner setup that hides all internal wiring
-- **Offline-first**: IndexedDB persistence with automatic offline mutation queue and FK-safe flush
-- **Real-time sync**: WebSocket delta streaming with optimistic updates and rollback
-- **AI Agent SDK**: `SyncAgent` for backend/AI agent participation as first-class sync citizens
-- **Pluggable auth**: `AuthProvider` interface with built-in API key, JWT, and session providers
-- **Security**: IndexedDB cleanup on session expiry and sync group revocation
-- **Testing utilities**: `@abloatai/ablo/testing` subpath with mocks, fixtures, and harness
-
-### Test Coverage
+- Updated dependencies [f60ed16]
+- Updated dependencies [16cc7d1]
+- Updated dependencies [08a3cad]
+- Updated dependencies [f60ed16]
+  - @abloatai/transaction@0.37.0
+  - @abloatai/humans@0.37.0
 
-- 231 unit/integration/property/contract tests
-- 50 E2E tests against real Go server + PostgreSQL + Redis
-- Property-based testing via fast-check
+Release notes are generated from the repository changesets.