@abloatai/humans 0.37.1 → 0.38.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abloatai/humans",
-  "version": "0.37.1",
+  "version": "0.38.0",
   "description": "The optional human-facing local-state package for Ablo: presence, live queries, and React bindings.",
   "license": "Apache-2.0",
   "type": "module",
@@ -84,7 +84,7 @@
     "directory": "packages/humans"
   },
   "dependencies": {
-    "@abloatai/transaction": "^0.37.1",
+    "@abloatai/transaction": "^0.38.0",
     "mobx": "^6.13.7",
     "uuid": "^11.1.0",
     "zod": "^4.4.3"

package/src/core.ts

@@ -102,3 +102,15 @@ export { LoadStrategy } from '@abloatai/transaction/types';
 // client around an existing store/provider. Kept on the explicit extension
 // surface so those packages do not need the private alias package.
 export type { InternalAbloOptions } from './local/client/options.js';
+
+// Stage timings for the delta drain, so a benchmark harness can report where
+// an observer's catch-up time went instead of inferring it. Inert unless
+// `ABLO_PROFILE_DRAIN=true`, and read-only: the pipeline does the recording.
+export {
+  drainProfileSnapshot,
+  resetDrainProfile,
+  drainProfilingEnabled,
+  type DrainProfile,
+  type DrainStage,
+  type DrainStageTotals,
+} from './local/sync/drainProfile.js';

package/src/local/BaseSyncedStore.ts

@@ -146,8 +146,10 @@ export interface UserContext {
   organizationId: string;
   /** Authenticated data-plane coordinates used to isolate local persistence. */
   projectId?: string | null;
-  environment?: 'sandbox' | 'production' | null;
-  sandboxId?: string | null;
+  /** Immutable branch target. Authoritative whenever present. */
+  branchId: string;
+  /** True only when branchId is the project's production root. */
+  branchRoot?: boolean;
   role?: string;
   teamIds?: string[];
   /** Participant kind on the wire. Default 'user' for browser

package/src/local/client/createModelProxy.ts

@@ -521,15 +521,17 @@ export function createModelProxy<T, C>(
       | ModelDeleteParams<T, C>,
   ): MutationOptions => {
     const rest: MutationOptions = {
-      idempotencyKey: params.idempotencyKey,
-      label: params.label,
-      wait: params.wait,
-      readAt: params.readAt,
-      onStale: params.onStale,
-      fenceToken: params.fenceToken,
-      claimRef: params.claimRef,
-      reads: params.reads,
-      track: params.track,
+      ...(params.idempotencyKey !== undefined
+        ? { idempotencyKey: params.idempotencyKey }
+        : {}),
+      ...(params.label !== undefined ? { label: params.label } : {}),
+      ...(params.wait !== undefined ? { wait: params.wait } : {}),
+      ...(params.readAt !== undefined ? { readAt: params.readAt } : {}),
+      ...(params.onStale !== undefined ? { onStale: params.onStale } : {}),
+      ...(params.fenceToken !== undefined ? { fenceToken: params.fenceToken } : {}),
+      ...(params.claimRef !== undefined ? { claimRef: params.claimRef } : {}),
+      ...(params.reads !== undefined ? { reads: params.reads } : {}),
+      ...(params.track !== undefined ? { track: params.track } : {}),
     };
     // The write-options schema — the runtime twin of the compile-time params.
     // Catches plain-JavaScript callers (for example `onStale: 'rejct'`) at the
@@ -713,7 +715,7 @@ export function createModelProxy<T, C>(
     return {
       object: 'claim',
       id: lease.id,
-      readAt: snapshot.stamp,
+      readAt: lease.readAt ?? snapshot.stamp,
       // The fencing token the server minted for this grant, forwarded from the
       // lease so writes taken under this handle carry it (Option B).
       ...(lease.fenceToken !== undefined ? { fenceToken: lease.fenceToken } : {}),
@@ -1227,7 +1229,7 @@ export function createModelProxy<T, C>(
         const effective: MutationOptions | undefined = claimed
           ? {
               wait: 'confirmed',
-              readAt: claimed.snapshot.stamp,
+              readAt: claimed.lease.readAt ?? claimed.snapshot.stamp,
               onStale: 'reject',
               claimRef: { id: claimed.lease.id },
               ...opts,
@@ -1311,7 +1313,7 @@ export function createModelProxy<T, C>(
       const effective: MutationOptions | undefined = claimed
         ? {
             wait: 'confirmed',
-            readAt: claimed.snapshot.stamp,
+            readAt: claimed.lease.readAt ?? claimed.snapshot.stamp,
             onStale: 'reject',
             claimRef: { id: claimed.lease.id },
             ...(claimed.lease.fenceToken !== undefined

package/src/local/client/options.ts

@@ -520,6 +520,15 @@ export interface InternalAbloOptions<S extends SchemaRecord = SchemaRecord> {
    */
   organizationId?: string;
 
+  /**
+   * Immutable branch selected by a self-hosted credential. Hosted clients
+   * receive this from the credential exchange.
+   */
+  branchId?: string;
+
+  /** Whether the selected self-hosted branch is the project's root branch. */
+  branchRoot?: boolean;
+
   /** The client-wide write default — see {@link AbloOptions.wait}. Projected
    *  from the public option rather than restated, so the two cannot diverge. */
   wait?: AbloOptions['wait'];

package/src/local/client/reactiveEngine.ts

@@ -401,6 +401,7 @@ export function buildReactiveEngine<const S extends SchemaRecord>(
 	    claim: Claim,
 	    waited = false,
 	    fenceToken?: number,
+	    readAt?: number,
 	  ): Claim {
 	    const release = (): Promise<void> => {
 	      claim.revoke?.();
@@ -416,6 +417,7 @@ export function buildReactiveEngine<const S extends SchemaRecord>(
 	      description: claim.description,
 	      target: claim.target,
 	      waited,
+	      ...(readAt !== undefined ? { readAt } : {}),
 	      ...(resolvedFenceToken !== undefined ? { fenceToken: resolvedFenceToken } : {}),
 	      release,
 	      revoke: claim.revoke,
@@ -448,9 +450,10 @@ export function buildReactiveEngine<const S extends SchemaRecord>(
 	      // holds the lease, never a half-claimed one racing the queue.
 	      let waited = false;
 	      let fenceToken: number | undefined;
+	      let readAt: number | undefined;
 	      if (claimOptions.queue) {
 	        try {
-	          ({ waited, fenceToken } = await awaitClaimGrant(transport, claim.id, {
+	          ({ waited, fenceToken, readAt } = await awaitClaimGrant(transport, claim.id, {
 	            timeoutMs: claimOptions.waitTimeoutMs,
 	            maxQueueDepth: claimOptions.maxQueueDepth,
 	            signal: claimOptions.signal,
@@ -464,7 +467,7 @@ export function buildReactiveEngine<const S extends SchemaRecord>(
 	          throw err;
 	        }
 	      }
-	      return wrapClaimHandle(claim, waited, fenceToken);
+	      return wrapClaimHandle(claim, waited, fenceToken, readAt);
 	    },
 	    list(target?: Partial<ModelTarget>): readonly ModelClaim[] {
 	      return listModelClaims(target);

package/src/local/client/storeLifecycle.ts

@@ -194,8 +194,8 @@ export function startStoreLifecycle<S extends SchemaRecord>(
           userId,
           accountScope,
           projectId,
-          environment,
-          sandboxId,
+          branchId,
+          branchRoot,
           teamIds,
           capabilityToken,
           syncGroups,
@@ -257,13 +257,19 @@ export function startStoreLifecycle<S extends SchemaRecord>(
         // option doc) and everyone else defaults to 'full'.
         const resolvedBootstrapMode: 'full' | 'none' =
           internalOptions.bootstrapMode ?? (participantKind === 'agent' ? 'none' : 'full');
+        if (!branchId) {
+          throw new AbloConnectionError(
+            'The server did not resolve an Ablo branch for this credential.',
+            { code: 'invalid_request' },
+          );
+        }
 
         const gen = store.initialize({
           userId,
           organizationId: accountScope,
           projectId,
-          environment,
-          sandboxId,
+          branchId,
+          branchRoot,
           teamIds,
           kind: participantKind,
           capabilityToken,

package/src/local/stores/DatabaseManager.ts

@@ -31,8 +31,8 @@ export interface DatabaseInfo {
   workspaceId: string;
   participantKind: string;
   projectId: string | null;
-  environment: 'sandbox' | 'production' | null;
-  sandboxId: string | null;
+  branchId: string;
+  branchRoot: boolean;
   schemaHash: string;
   schemaVersion: number;
   userVersion?: number;
@@ -173,8 +173,8 @@ export class DatabaseManager {
       workspaceId: identity.organizationId,
       participantKind: identity.participantKind,
       projectId: identity.projectId,
-      environment: identity.environment,
-      sandboxId: identity.sandboxId,
+      branchId: identity.branchId,
+      branchRoot: identity.branchRoot,
       schemaHash,
       schemaVersion,
       userVersion,

package/src/local/stores/persistenceIdentity.ts

@@ -1,17 +1,16 @@
 import { AbloConnectionError } from '@abloatai/transaction/errors';
 
 /**
- * The complete authenticated plane that owns one local replica. The same
- * participant can have different data in a project, sandbox, or environment;
- * those replicas must never share a namespace.
+ * The complete authenticated branch that owns one local replica. A branch id
+ * is authoritative.
  */
 export interface PersistenceIdentity {
   readonly participantId: string;
   readonly participantKind: string;
   readonly organizationId: string;
   readonly projectId: string | null;
-  readonly environment: 'sandbox' | 'production' | null;
-  readonly sandboxId: string | null;
+  readonly branchId: string;
+  readonly branchRoot: boolean;
 }
 
 export interface PersistedIdentityMetadata {
@@ -20,11 +19,11 @@ export interface PersistedIdentityMetadata {
   readonly workspaceId: string;
   readonly participantKind?: string;
   readonly projectId?: string | null;
-  readonly environment?: 'sandbox' | 'production' | null;
-  readonly sandboxId?: string | null;
+  readonly branchId?: string;
+  readonly branchRoot?: boolean;
 }
 
-export const PERSISTENCE_NAMESPACE_VERSION = 2;
+export const PERSISTENCE_NAMESPACE_VERSION = 4;
 
 function canonicalIdentity(
   identity: PersistenceIdentity,
@@ -33,8 +32,7 @@ function canonicalIdentity(
   return JSON.stringify([
     PERSISTENCE_NAMESPACE_VERSION,
     identity.projectId,
-    identity.environment,
-    identity.sandboxId,
+    ['branch', identity.branchId, identity.branchRoot],
     identity.organizationId,
     identity.participantKind,
     identity.participantId,
@@ -77,7 +75,7 @@ export function persistenceIdentityMatches(
     info.workspaceId === identity.organizationId &&
     info.participantKind === identity.participantKind &&
     (info.projectId ?? null) === identity.projectId &&
-    (info.environment ?? null) === identity.environment &&
-    (info.sandboxId ?? null) === identity.sandboxId
+    info.branchId === identity.branchId &&
+    (info.branchRoot ?? false) === identity.branchRoot
   );
 }

package/src/local/sync/SyncWebSocket.ts

@@ -12,6 +12,7 @@
 
 import { getContext } from '../context.js';
 import { clientSyncDeltaSchema, type ClientSyncDelta } from '@abloatai/transaction/wire/delta';
+import { drainProfilingEnabled, observeDrainStage } from './drainProfile.js';
 import {
   WsTransport,
   type WsTransportOptions,
@@ -212,7 +213,23 @@ export class SyncWebSocket<
    * and an observability breadcrumb; it is never applied. There is one parse per
    * delta — callers must not re-parse.
    */
+  /**
+   * Wire validation runs once per delta, so at drain scale it is a per-delta
+   * fixed cost rather than a payload-proportional one. The guard keeps the
+   * normal path free: when profiling is off this is a boolean test and a
+   * direct call, with no closure allocated per delta.
+   */
   private normalizeWireDelta(raw: unknown): SyncDelta | null {
+    if (!drainProfilingEnabled()) return this.parseWireDelta(raw);
+    const startedAt = performance.now();
+    try {
+      return this.parseWireDelta(raw);
+    } finally {
+      observeDrainStage('parse', performance.now() - startedAt);
+    }
+  }
+
+  private parseWireDelta(raw: unknown): SyncDelta | null {
     let candidate: unknown = raw;
     if (isRecord(raw)) {
       const normalized: Record<string, unknown> = { ...raw };

package/src/local/sync/deltaPipeline.ts

@@ -24,6 +24,7 @@ import {
   type AbloPlugin,
   type AppliedChange,
 } from '../../plugin.js';
+import { observeDrainBatch, timeDrainStage, timeDrainStageAsync } from './drainProfile.js';
 
 /**
  * What the pipeline needs back from the surrounding store: the shared mutable
@@ -409,7 +410,8 @@ async function flushDeltaBatch(
   queuedDeltas: SyncDelta[],
 ): Promise<void> {
   const stagePlugins = ctx.stagePlugins ?? [];
-  const deduplicatedDeltas = ctx.deduplicateDeltas(queuedDeltas);
+  const deduplicatedDeltas = timeDrainStage('dedupe', () => ctx.deduplicateDeltas(queuedDeltas));
+  observeDrainBatch(queuedDeltas.length, deduplicatedDeltas.length);
   runStage(stagePlugins, 'dedupe', { deltas: deduplicatedDeltas });
 
   // Custom entities → apply straight to the pool, skipping the local store.
@@ -444,17 +446,19 @@ async function flushDeltaBatch(
   // handleGroupRemoved) and never reach here, though the persistence
   // signature accepts them defensively.
   const regularDeltas = deduplicatedDeltas.filter((d) => !ctx.isCustomEntity(d.modelName));
-  const batch = await ctx.processDeltaBatch(
-    regularDeltas.map((d) => ({
-      syncId: d.id,
-      actionType: d.actionType,
-      modelName: d.modelName,
-      modelId: d.modelId,
-      data: typeof d.data === 'string' ? JSON.parse(d.data) : d.data,
-      // Thread `transactionId` through so the receive layer can recognize
-      // echoes of locally-applied transactions and skip the pool mutation.
-      transactionId: d.transactionId,
-    }))
+  const batch = await timeDrainStageAsync('persist', () =>
+    ctx.processDeltaBatch(
+      regularDeltas.map((d) => ({
+        syncId: d.id,
+        actionType: d.actionType,
+        modelName: d.modelName,
+        modelId: d.modelId,
+        data: typeof d.data === 'string' ? JSON.parse(d.data) : d.data,
+        // Thread `transactionId` through so the receive layer can recognize
+        // echoes of locally-applied transactions and skip the pool mutation.
+        transactionId: d.transactionId,
+      }))
+    )
   );
   const dbResults = batch.results;
   runStage(stagePlugins, 'persist', { deltas: regularDeltas });
@@ -464,11 +468,13 @@ async function flushDeltaBatch(
   // materialiser attached where it said it would. The direct call is the
   // bridge for stores constructed without plugins (subclasses, tests),
   // whose own apply is the whole pipeline.
-  if (pluginsForStage(stagePlugins, 'apply').length > 0) {
-    runStage(stagePlugins, 'apply', { changes: dbResults });
-  } else {
-    ctx.applyDeltaBatchToPool(dbResults);
-  }
+  timeDrainStage('apply', () => {
+    if (pluginsForStage(stagePlugins, 'apply').length > 0) {
+      runStage(stagePlugins, 'apply', { changes: dbResults });
+    } else {
+      ctx.applyDeltaBatchToPool(dbResults);
+    }
+  });
 
   // Acknowledge and advance the sync cursor, gated on persistence.
   //
@@ -480,11 +486,15 @@ async function flushDeltaBatch(
   // be lost. The cursor and the persisted state must move together.
   const persistedSyncId = batch.persistedSyncId;
   if (persistedSyncId > ctx.lastAckedId) {
-    ctx.acknowledge(persistedSyncId);
-    ctx.advancePersisted(persistedSyncId);
-    runStage(stagePlugins, 'acknowledge', { syncId: persistedSyncId });
+    timeDrainStage('acknowledge', () => {
+      ctx.acknowledge(persistedSyncId);
+      ctx.advancePersisted(persistedSyncId);
+      runStage(stagePlugins, 'acknowledge', { syncId: persistedSyncId });
+    });
   }
 
   // Cache invalidation happens automatically via the 'models:changed' event.
-  runStage(stagePlugins, 'notify', { changes: dbResults });
+  timeDrainStage('notify', () => {
+    runStage(stagePlugins, 'notify', { changes: dbResults });
+  });
 }

package/src/local/sync/drainProfile.ts

@@ -0,0 +1,164 @@
+/**
+ * Where the drain's seconds go.
+ *
+ * A commit's receipt is confirmed the moment its PostgreSQL transaction
+ * commits, but an observer is not caught up until it has applied the last
+ * delta. Server publication p95 is single-digit milliseconds while the final
+ * observer takes seconds, so the gap is client-side and has never been
+ * attributed to a stage. Two fixes aimed at wire bytes (project filtering,
+ * patch-only UPDATE delivery) each returned well under a third, which is
+ * evidence the dominant term is a per-delta or per-batch fixed cost rather
+ * than payload size.
+ *
+ * This times the stages a delta actually passes through so a benchmark run can
+ * state the attribution instead of inferring it. It is off unless
+ * `ABLO_PROFILE_DRAIN=true`, and every entry point returns before doing work
+ * when off, mirroring the server's commit profiler.
+ *
+ * The stage vocabulary derives from {@link PipelineStage}; `parse` is the one
+ * addition, because wire validation happens in the transport before a delta
+ * reaches the pipeline at all.
+ */
+
+import type { PipelineStage } from '../../plugin.js';
+
+/** The pipeline's own stages plus the transport-level wire validation ahead of them. */
+export type DrainStage = 'parse' | PipelineStage;
+
+export interface DrainStageTotals {
+  /** Accumulated wall time attributed to this stage. */
+  readonly totalMs: number;
+  /** How many times the stage ran. Per-delta for `parse`, per-batch for the rest. */
+  readonly calls: number;
+}
+
+export interface DrainProfile {
+  /** Flush batches drained. The per-batch fixed cost multiplies by this. */
+  readonly batches: number;
+  /** Deltas that reached the pipeline. The per-delta fixed cost multiplies by this. */
+  readonly deltas: number;
+  /** Deltas dropped by the dedupe stage before persistence. */
+  readonly deduplicated: number;
+  /** Wall time from the first observed stage to the last. */
+  readonly spanMs: number;
+  readonly stages: Readonly<Record<DrainStage, DrainStageTotals>>;
+}
+
+const DRAIN_STAGES: readonly DrainStage[] = [
+  'parse',
+  'receive',
+  'dedupe',
+  'persist',
+  'apply',
+  'acknowledge',
+  'notify',
+];
+
+interface MutableTotals {
+  totalMs: number;
+  calls: number;
+}
+
+function emptyTotals(): Record<DrainStage, MutableTotals> {
+  const totals = {} as Record<DrainStage, MutableTotals>;
+  for (const stage of DRAIN_STAGES) totals[stage] = { totalMs: 0, calls: 0 };
+  return totals;
+}
+
+let totals = emptyTotals();
+let batches = 0;
+let deltas = 0;
+let deduplicated = 0;
+let firstMark: number | undefined;
+let lastMark = 0;
+
+/**
+ * Read once. A profiler that consults the environment on every delta would
+ * itself become a per-delta cost in the path it is measuring.
+ */
+const enabled: boolean = (() => {
+  const host = globalThis as { process?: { env?: Record<string, string | undefined> } };
+  return host.process?.env?.ABLO_PROFILE_DRAIN === 'true';
+})();
+
+/** Whether drain profiling is on. Callers skip their own bookkeeping when it is not. */
+export function drainProfilingEnabled(): boolean {
+  return enabled;
+}
+
+function mark(elapsedMs: number): void {
+  const now = performance.now();
+  firstMark ??= now - elapsedMs;
+  lastMark = now;
+}
+
+/** Attribute already-measured wall time to a stage. */
+export function observeDrainStage(stage: DrainStage, elapsedMs: number): void {
+  if (!enabled) return;
+  const entry = totals[stage];
+  entry.totalMs += elapsedMs;
+  entry.calls += 1;
+  mark(elapsedMs);
+}
+
+/** Time a synchronous stage. Returns the callback's value untouched. */
+export function timeDrainStage<T>(stage: DrainStage, run: () => T): T {
+  if (!enabled) return run();
+  const startedAt = performance.now();
+  try {
+    return run();
+  } finally {
+    observeDrainStage(stage, performance.now() - startedAt);
+  }
+}
+
+/** Time an asynchronous stage. Returns the callback's value untouched. */
+export async function timeDrainStageAsync<T>(
+  stage: DrainStage,
+  run: () => Promise<T>,
+): Promise<T> {
+  if (!enabled) return run();
+  const startedAt = performance.now();
+  try {
+    return await run();
+  } finally {
+    observeDrainStage(stage, performance.now() - startedAt);
+  }
+}
+
+/**
+ * Record one drained batch: how many deltas entered it and how many survived
+ * deduplication. Batch count is the multiplier on every per-batch cost, so it
+ * is reported alongside the timings rather than derived from them.
+ */
+export function observeDrainBatch(received: number, survived: number): void {
+  if (!enabled) return;
+  batches += 1;
+  deltas += received;
+  deduplicated += Math.max(0, received - survived);
+}
+
+/** The totals accumulated since the last reset. */
+export function drainProfileSnapshot(): DrainProfile {
+  const stages = {} as Record<DrainStage, DrainStageTotals>;
+  for (const stage of DRAIN_STAGES) {
+    stages[stage] = { totalMs: totals[stage].totalMs, calls: totals[stage].calls };
+  }
+  return {
+    batches,
+    deltas,
+    deduplicated,
+    spanMs: firstMark === undefined ? 0 : lastMark - firstMark,
+    stages,
+  };
+}
+
+/** Clear the totals so a phase measures only its own traffic. */
+export function resetDrainProfile(): void {
+  totals = emptyTotals();
+  batches = 0;
+  deltas = 0;
+  deduplicated = 0;
+  firstMark = undefined;
+  lastMark = 0;
+}

package/src/local/sync/initialize.ts

@@ -54,8 +54,8 @@ export function* initialize<TCollaboration extends EventMap<TCollaboration>>(
         organizationId: context.organizationId,
         participantKind: context.kind ?? 'user',
         projectId: context.projectId ?? context.organizationId,
-        environment: context.environment ?? null,
-        sandboxId: context.sandboxId ?? null,
+        branchId: context.branchId,
+        branchRoot: context.branchRoot ?? false,
       });
 
       // Propagate identity only after storage is ready, then restore sealed

package/src/local/transactions/mutations/MutationQueue.ts

@@ -1222,17 +1222,20 @@ export class MutationQueue extends EventEmitter {
    * transaction.
    */
   confirmationFor(modelName: string, modelId: string): Promise<void> {
-    const candidates = [
-      ...this.store.getByStatus('pending'),
-      ...this.store.getByStatus('executing'),
-      ...this.store.getByStatus('awaiting_delta'),
-    ].filter(
-      (tx) => tx.modelName === modelName && tx.modelId === modelId,
-    );
-    if (candidates.length === 0) return Promise.resolve();
-    const latest = candidates.sort((a, b) => b.createdAt - a.createdAt)[0];
-    if (!latest) return Promise.resolve();
-    return latest.confirmation ?? Promise.resolve();
+    const transactions = this.store.getAll();
+    for (let index = transactions.length - 1; index >= 0; index--) {
+      const transaction = transactions[index];
+      if (
+        transaction?.modelName === modelName &&
+        transaction.modelId === modelId &&
+        (transaction.status === 'pending' ||
+          transaction.status === 'executing' ||
+          transaction.status === 'awaiting_delta')
+      ) {
+        return transaction.confirmation ?? Promise.resolve();
+      }
+    }
+    return Promise.resolve();
   }
 
   /**
@@ -1425,7 +1428,23 @@ export class MutationQueue extends EventEmitter {
   }
 
   private async drainPendingInternal(): Promise<void> {
-    await drainPendingSettlements(this.pendingDrainContext);
+    // The normal batch scheduler and the explicit/reconnect drain are two
+    // ways to drive the same durable queue. They must never seal the same
+    // staged source records concurrently: the first seal consumes those
+    // records, so the second would correctly reject them as already claimed.
+    //
+    // `isProcessing` is acquired synchronously before either path awaits,
+    // making it the queue-wide execution lock. If the normal lane already
+    // owns it, that lane will finish the pending work; callers waiting on a
+    // specific confirmation remain attached to the exact transaction.
+    if (this.isProcessing) return;
+    this.isProcessing = true;
+    try {
+      await drainPendingSettlements(this.pendingDrainContext);
+    } finally {
+      this.isProcessing = false;
+      if (this.executionQueue.length > 0) this.scheduleProcessing(true);
+    }
   }
   async create(
     model: LocalModel,

package/src/local/transactions/mutations/pendingDrain.ts

@@ -10,7 +10,7 @@ export interface PendingDrainContext {
   readonly runtime: RuntimeContext;
   readonly config: { deltaConfirmationTimeout: number };
   readonly store: MutationStore;
-  executionQueue: QueuedMutation[];
+  readonly executionQueue: QueuedMutation[];
   readonly optimisticUpdates: Map<string, OptimisticUpdateEntry>;
   readonly assertDurableReplayOpen: () => void;
   readonly processCommitLane: () => Promise<void>;
@@ -45,9 +45,14 @@ export async function drainPendingSettlements(ctx: PendingDrainContext): Promise
     // These rows may already be waiting behind the normal batch timer. The
     // reconnect fast path takes ownership of them for this attempt so the same
     // transaction cannot dispatch concurrently through both paths.
-    ctx.executionQueue = ctx.executionQueue.filter(
+    const retainedQueue = ctx.executionQueue.filter(
       (tx) => !pendingIds.has(tx.id),
     );
+    ctx.executionQueue.splice(
+      0,
+      ctx.executionQueue.length,
+      ...retainedQueue,
+    );
 
     const remaining = [...pending];
     while (remaining.length > 0) {