@abloatai/humans 0.37.1 → 0.39.0

package/dist/local/Model.js

@@ -31,6 +31,7 @@ export class ValidationError extends Error {
 }
 /** Shared frozen default for {@link Model.getDerivedGetterNames}. */
 const EMPTY_DERIVED_GETTERS = Object.freeze([]);
+const fieldWritePlans = new WeakMap();
 /**
  * The abstract base class every domain model extends. It holds the model's id
  * and timestamps, tracks in-place property changes for change detection and
@@ -54,6 +55,17 @@ export class Model {
     _isNew = true;
     /** Original data snapshot */
     _originalData;
+    /**
+     * Whether the persisted baseline needs recapturing. Hydration and ack land
+     * far more often than anything reads the baseline — an observer-only client
+     * reads it never — so each of those sites marks the snapshot stale and
+     * {@link getOriginalSnapshot} materializes it on first read. Correctness
+     * rests on the tracking invariant: every non-hydration write is recorded in
+     * `modifiedProperties` (first-old-wins), so between the stale mark and the
+     * read, untracked fields still hold exactly the values an eager capture
+     * would have recorded.
+     */
+    _originalDataStale = false;
     /** Sync status */
     syncStatus = 'pending';
     /** Timestamps */
@@ -208,7 +220,8 @@ export class Model {
      */
     markAsPersisted() {
         this._isNew = false;
-        this._originalData = this.captureSnapshot();
+        this._originalData = undefined;
+        this._originalDataStale = true;
     }
     /**
      * Check if this is a new model
@@ -230,6 +243,10 @@ export class Model {
      * last acknowledged state would already be the authoritative baseline.
      */
     getOriginalSnapshot() {
+        if (this._originalDataStale) {
+            this._originalData = this.captureSnapshot();
+            this._originalDataStale = false;
+        }
         return this._originalData;
     }
     /**
@@ -238,7 +255,8 @@ export class Model {
     clearChanges() {
         runInAction(() => {
             this.modifiedProperties.clear();
-            this._originalData = this.captureSnapshot();
+            this._originalData = undefined;
+            this._originalDataStale = true;
         });
     }
     /**
@@ -471,43 +489,39 @@ export class Model {
      * leaves that baseline intact.
      */
     assignFieldsFromData(data, onWrite) {
-        // Update properties with safety checks for read-only/computed accessors
-        for (const [key, raw] of Object.entries(data)) {
+        let plan = fieldWritePlans.get(this.constructor);
+        if (!plan) {
+            plan = new Map();
+            fieldWritePlans.set(this.constructor, plan);
+        }
+        for (const key in data) {
             if (key === 'id')
                 continue;
-            // Only attempt to set if the property exists on instance or prototype
-            if (!(this.hasOwnProperty(key) || key in this))
+            if (!Object.prototype.hasOwnProperty.call(data, key))
                 continue;
-            // Never assign to MobX computed properties (they may expose a setter that throws)
-            try {
-                if (isComputedProp(this, key)) {
-                    continue;
-                }
-            }
-            catch {
-                // If MobX internals are unavailable for some reason, fall back to descriptor checks below
+            const raw = data[key];
+            let disposition = plan.get(key);
+            if (disposition === undefined) {
+                disposition = this.resolveFieldDisposition(key);
+                plan.set(key, disposition);
             }
-            // Resolve property descriptor from own or prototype chain
-            const ownDesc = Object.getOwnPropertyDescriptor(this, key);
-            let desc = ownDesc;
-            if (!desc) {
-                let proto = Object.getPrototypeOf(this);
-                while (proto && proto !== Object.prototype && !desc) {
-                    desc = Object.getOwnPropertyDescriptor(proto, key);
-                    proto = Object.getPrototypeOf(proto);
-                }
+            if (disposition === 'skip-readonly')
+                continue;
+            if (disposition === 'skip-absent') {
+                // The plan was built from an instance that lacked this key. Re-resolve
+                // for this instance without touching the cache, so heterogeneous
+                // shapes stay correct at the cost of the slow path.
+                if (!(key in this))
+                    continue;
+                disposition = this.resolveFieldDisposition(key);
+                if (disposition === 'skip-readonly' || disposition === 'skip-absent')
+                    continue;
             }
-            // Determine writability: allow if data descriptor writable, or accessor with setter
-            const writable = desc
-                ? ('writable' in desc && !!desc.writable) ||
-                    ('set' in desc && typeof desc.set === 'function')
-                : true;
-            if (!writable) {
-                // Skip read-only accessor properties (getter-only)
+            else if (!(key in this)) {
                 continue;
             }
             // Handle date conversions
-            const value = (key === 'createdAt' || key === 'updatedAt' || key === 'archivedAt') && raw
+            const value = disposition === 'write-date' && raw
                 ? new Date(raw)
                 : raw;
             // Capture the pre-write value BEFORE assignment so trackers
@@ -518,6 +532,42 @@ export class Model {
             onWrite?.(key, oldValue, value);
         }
     }
+    /**
+     * The uncached decision for one key: existence on instance or prototype,
+     * never a MobX computed (its setter may throw), and writability resolved
+     * through the descriptor chain — a data descriptor's `writable` or an
+     * accessor's setter.
+     */
+    resolveFieldDisposition(key) {
+        if (!(key in this))
+            return 'skip-absent';
+        try {
+            if (isComputedProp(this, key)) {
+                return 'skip-readonly';
+            }
+        }
+        catch {
+            // If MobX internals are unavailable for some reason, fall back to descriptor checks below
+        }
+        const ownDesc = Object.getOwnPropertyDescriptor(this, key);
+        let desc = ownDesc;
+        if (!desc) {
+            let proto = Object.getPrototypeOf(this);
+            while (proto && proto !== Object.prototype && !desc) {
+                desc = Object.getOwnPropertyDescriptor(proto, key);
+                proto = Object.getPrototypeOf(proto);
+            }
+        }
+        const writable = desc
+            ? ('writable' in desc && !!desc.writable) ||
+                ('set' in desc && typeof desc.set === 'function')
+            : true;
+        if (!writable)
+            return 'skip-readonly';
+        return key === 'createdAt' || key === 'updatedAt' || key === 'archivedAt'
+            ? 'write-date'
+            : 'write';
+    }
     /**
      * Update from raw data (hydration)
      *
@@ -550,7 +600,8 @@ export class Model {
         });
         // Mark as persisted if updating existing model
         if (!this._isNew) {
-            this._originalData = this.captureSnapshot();
+            this._originalData = undefined;
+            this._originalDataStale = true;
         }
         this.didUpdate();
     }

package/dist/local/SyncClient.d.ts

@@ -275,10 +275,6 @@ export declare class SyncClient extends EventEmitter {
      * conflict resolver reads exactly these fields and no others.
      */
     private extractCriticalState;
-    /**
-     * Check if critical state changes exist that require forcing server state
-     */
-    private hasCriticalStateChange;
     /**
      * Handle network reconnection
      */
@@ -487,6 +483,7 @@ export declare class SyncClient extends EventEmitter {
      */
     getMutationQueue(): MutationQueue;
     applyDeltaBatchToPool(dbResults: readonly AppliedChange[], enrichRelations: (modelName: string, data: Record<string, unknown>) => Record<string, unknown>): void;
+    private applyDeltaBatchToPoolInAction;
     /**
      * Apply bootstrap data to the InstanceCache with ghost removal.
      * Owns: model creation, batch upsert, ghost detection + removal.

package/dist/local/SyncClient.js

@@ -1038,31 +1038,22 @@ export class SyncClient extends EventEmitter {
      * local model has unsynced changes, so the two sides stay consistent.
      */
     resolveConflicts(localModel, serverData) {
-        const hasLocalChanges = localModel.hasChanges;
-        // Safely get timestamp, handling both Date objects and strings
-        const localUpdatedAt = localModel.updatedAt
-            ? localModel.updatedAt instanceof Date
-                ? localModel.updatedAt.getTime()
-                : new Date(localModel.updatedAt).getTime()
-            : 0;
-        const serverUpdatedAt = toEpochMs(serverData.updatedAt);
-        this.runtime.logger.debug('Conflict resolution', {
-            modelId: localModel.id,
-            modelType: localModel.getModelName(),
-            hasLocalChanges,
-            localUpdatedAt: localModel.updatedAt?.toString(),
-            serverUpdatedAt: serverData.updatedAt,
-            localChanges: localModel.getChanges(),
-            serverState: this.extractCriticalState(serverData),
-        });
-        // PRIORITY 1: Check for critical server states that must be respected
-        // These states override any local changes to maintain data consistency
-        const criticalServerStates = this.extractCriticalState(serverData);
-        const shouldForceAcceptServer = this.hasCriticalStateChange(criticalServerStates);
+        // No entry-point debug here: this runs once per incoming update delta,
+        // and a debug call's payload is BUILT even when the logger discards it —
+        // a per-delta model scan on the apply hot path. The outcome branches
+        // below log the cases worth reading.
+        // PRIORITY 1: Check for critical server states that must be respected.
+        // These states override any local changes to maintain data consistency.
+        // Checked inline — the collected-object form (`extractCriticalState`)
+        // only materializes on the rare force-accept branch, for its log line.
+        const shouldForceAcceptServer = (serverData.deletedAt !== undefined && serverData.deletedAt !== null) ||
+            (serverData.archivedAt !== undefined && serverData.archivedAt !== null) ||
+            serverData.isActive === false ||
+            (serverData.unassignedAt !== undefined && serverData.unassignedAt !== null);
         if (shouldForceAcceptServer) {
             this.runtime.logger.debug('Accepting server update - critical state change detected', {
                 modelId: localModel.id,
-                criticalStates: criticalServerStates,
+                criticalStates: this.extractCriticalState(serverData),
             });
             // Force accept server state for critical changes
             localModel.updateFromData(serverData);
@@ -1072,7 +1063,7 @@ export class SyncClient extends EventEmitter {
         }
         // Local-first: if we have local dirty fields, merge by field.
         // Keep locally changed fields; apply server for the rest.
-        if (hasLocalChanges) {
+        if (localModel.hasChanges) {
             const localChanges = localModel.getChanges();
             this.runtime.logger.debug('Merging server update with local dirty fields', {
                 modelId: localModel.id,
@@ -1082,6 +1073,13 @@ export class SyncClient extends EventEmitter {
             const merged = { ...serverData, ...(localChanges || {}) };
             // Preserve the most recent updatedAt without clearing dirty flags
             if (serverData.updatedAt || localModel.updatedAt) {
+                // Safely get timestamp, handling both Date objects and strings
+                const localUpdatedAt = localModel.updatedAt
+                    ? localModel.updatedAt instanceof Date
+                        ? localModel.updatedAt.getTime()
+                        : new Date(localModel.updatedAt).getTime()
+                    : 0;
+                const serverUpdatedAt = toEpochMs(serverData.updatedAt);
                 const mergedUpdatedAt = new Date(Math.max(localUpdatedAt, serverUpdatedAt));
                 // updateFromData accepts Date or ISO string for dates
                 merged.updatedAt = mergedUpdatedAt;
@@ -1090,10 +1088,9 @@ export class SyncClient extends EventEmitter {
             // Intentionally DO NOT clearChanges here; pending tx will confirm and clear
             return localModel;
         }
-        // No local changes: fall back to LWW to converge
-        // Accept server regardless of timestamp equality to stay in sync
-        const acceptReason = serverUpdatedAt > localUpdatedAt ? 'server is newer' : 'no local changes';
-        this.runtime.logger.debug(`Accepting server update - ${acceptReason}`);
+        // No local changes: fall back to LWW to converge. Accept server
+        // regardless of timestamp equality to stay in sync. Not logged — this is
+        // the common path for every collaborator update a client receives.
         localModel.updateFromData(serverData);
         localModel.clearChanges();
         localModel.markAsSynced();
@@ -1125,14 +1122,6 @@ export class SyncClient extends EventEmitter {
         }
         return critical;
     }
-    /**
-     * Check if critical state changes exist that require forcing server state
-     */
-    hasCriticalStateChange(criticalStates) {
-        // Any critical state present means we should force accept server
-        return (Object.keys(criticalStates).length > 0 &&
-            Object.values(criticalStates).some((v) => v !== null && v !== undefined));
-    }
     /**
      * Handle network reconnection
      */
@@ -1536,6 +1525,18 @@ export class SyncClient extends EventEmitter {
         return this.mutationQueue;
     }
     applyDeltaBatchToPool(dbResults, enrichRelations) {
+        // The WHOLE batch — conflict resolution and model mutation included, not
+        // just the pool bookkeeping at the end — runs in one MobX action.
+        // `resolveConflicts` writes model fields via `updateFromData`; when those
+        // writes ran before the action, every delta opened its own top-level
+        // action and flushed reactions at its boundary, so a large frame paid one
+        // reaction pass per delta and an observer could see a partially applied
+        // frame between them.
+        runInAction(() => {
+            this.applyDeltaBatchToPoolInAction(dbResults, enrichRelations);
+        });
+    }
+    applyDeltaBatchToPoolInAction(dbResults, enrichRelations) {
         const modelsToAdd = [];
         const modelsToUpsert = [];
         const idsToRemove = [];
@@ -1633,31 +1634,25 @@ export class SyncClient extends EventEmitter {
                     break;
             }
         }
-        // Reveal the whole frame in a single MobX action. `addBatch`,
-        // `upsertBatch`, `removeBatch`, and `updateScope` are each individually
-        // wrapped in an action, so calling them in sequence flushes reactions at
-        // every action boundary — a catch-up frame that adds, updates, and removes
-        // would fire every dependent reaction several times in a row, re-rendering
-        // and re-sorting on each. Wrapping them in one outer `runInAction` defers
-        // all reaction flushes to a single boundary, so dependents recompute
-        // exactly once regardless of how many models or operation kinds the frame
-        // touched. The app therefore never observes a partially applied frame.
-        runInAction(() => {
-            if (modelsToAdd.length > 0)
-                this.objectPool.addBatch(modelsToAdd, ModelScope.live);
-            if (modelsToUpsert.length > 0)
-                this.objectPool.upsertBatch(modelsToUpsert, ModelScope.live);
-            if (idsToRemove.length > 0)
-                this.objectPool.removeBatch(idsToRemove);
-            for (const id of idsToArchive)
-                this.objectPool.updateScope(id, ModelScope.archived);
-            // Emit changed model types so QueryProcessor can auto-invalidate.
-            // Kept inside the action so any observable query-cache state it
-            // flips is part of the same atomic reveal.
-            const changedTypes = new Set(dbResults.map(r => r.modelName));
-            if (changedTypes.size > 0)
-                this.emit('models:changed', changedTypes);
-        });
+        // Reveal the whole frame at one reaction boundary: the caller's single
+        // action covers the collection loop above and these batch pool writes, so
+        // dependents recompute exactly once regardless of how many models or
+        // operation kinds the frame touched, and the app never observes a
+        // partially applied frame.
+        if (modelsToAdd.length > 0)
+            this.objectPool.addBatch(modelsToAdd, ModelScope.live);
+        if (modelsToUpsert.length > 0)
+            this.objectPool.upsertBatch(modelsToUpsert, ModelScope.live);
+        if (idsToRemove.length > 0)
+            this.objectPool.removeBatch(idsToRemove);
+        for (const id of idsToArchive)
+            this.objectPool.updateScope(id, ModelScope.archived);
+        // Emit changed model types so QueryProcessor can auto-invalidate.
+        // Kept inside the action so any observable query-cache state it
+        // flips is part of the same atomic reveal.
+        const changedTypes = new Set(dbResults.map(r => r.modelName));
+        if (changedTypes.size > 0)
+            this.emit('models:changed', changedTypes);
     }
     /**
      * Apply bootstrap data to the InstanceCache with ghost removal.

package/dist/local/client/createModelProxy.js

@@ -142,15 +142,17 @@ defaultWait) {
         typeof value.release === 'function';
     const mutationOptions = (params) => {
         const rest = {
-            idempotencyKey: params.idempotencyKey,
-            label: params.label,
-            wait: params.wait,
-            readAt: params.readAt,
-            onStale: params.onStale,
-            fenceToken: params.fenceToken,
-            claimRef: params.claimRef,
-            reads: params.reads,
-            track: params.track,
+            ...(params.idempotencyKey !== undefined
+                ? { idempotencyKey: params.idempotencyKey }
+                : {}),
+            ...(params.label !== undefined ? { label: params.label } : {}),
+            ...(params.wait !== undefined ? { wait: params.wait } : {}),
+            ...(params.readAt !== undefined ? { readAt: params.readAt } : {}),
+            ...(params.onStale !== undefined ? { onStale: params.onStale } : {}),
+            ...(params.fenceToken !== undefined ? { fenceToken: params.fenceToken } : {}),
+            ...(params.claimRef !== undefined ? { claimRef: params.claimRef } : {}),
+            ...(params.reads !== undefined ? { reads: params.reads } : {}),
+            ...(params.track !== undefined ? { track: params.track } : {}),
         };
         // The write-options schema — the runtime twin of the compile-time params.
         // Catches plain-JavaScript callers (for example `onStale: 'rejct'`) at the
@@ -312,7 +314,7 @@ defaultWait) {
         return {
             object: 'claim',
             id: lease.id,
-            readAt: snapshot.stamp,
+            readAt: lease.readAt ?? snapshot.stamp,
             // The fencing token the server minted for this grant, forwarded from the
             // lease so writes taken under this handle carry it (Option B).
             ...(lease.fenceToken !== undefined ? { fenceToken: lease.fenceToken } : {}),
@@ -746,7 +748,7 @@ defaultWait) {
                 const effective = claimed
                     ? {
                         wait: 'confirmed',
-                        readAt: claimed.snapshot.stamp,
+                        readAt: claimed.lease.readAt ?? claimed.snapshot.stamp,
                         onStale: 'reject',
                         claimRef: { id: claimed.lease.id },
                         ...opts,
@@ -816,7 +818,7 @@ defaultWait) {
             const effective = claimed
                 ? {
                     wait: 'confirmed',
-                    readAt: claimed.snapshot.stamp,
+                    readAt: claimed.lease.readAt ?? claimed.snapshot.stamp,
                     onStale: 'reject',
                     claimRef: { id: claimed.lease.id },
                     ...(claimed.lease.fenceToken !== undefined

package/dist/local/client/options.d.ts

@@ -434,6 +434,13 @@ export interface InternalAbloOptions<S extends SchemaRecord = SchemaRecord> {
      * identity from the token through the identity endpoint instead.
      */
     organizationId?: string;
+    /**
+     * Immutable branch selected by a self-hosted credential. Hosted clients
+     * receive this from the credential exchange.
+     */
+    branchId?: string;
+    /** Whether the selected self-hosted branch is the project's root branch. */
+    branchRoot?: boolean;
     /** The client-wide write default — see {@link AbloOptions.wait}. Projected
      *  from the public option rather than restated, so the two cannot diverge. */
     wait?: AbloOptions['wait'];

package/dist/local/client/reactiveEngine.js

@@ -11,6 +11,7 @@
  * host-built core client with the per-model surface split — the cut's own
  * design step (docs/plans/package-split.md).
  */
+import { omittedModelError } from '@abloatai/transaction/schema/select';
 import { durableCommitOperationSchema, } from '@abloatai/transaction/transactions/settlement/commitEnvelope';
 import { AbloAuthenticationError, AbloConnectionError, AbloValidationError, claimedError } from '@abloatai/transaction/errors';
 import { batchFence, fenceTokenFor, modelTarget, streamTarget, subTarget, } from '@abloatai/transaction/coordination';
@@ -250,7 +251,7 @@ export function buildReactiveEngine(inputs) {
             }
         });
     }
-    function wrapClaimHandle(claim, waited = false, fenceToken) {
+    function wrapClaimHandle(claim, waited = false, fenceToken, readAt) {
         const release = () => {
             claim.revoke?.();
             return Promise.resolve();
@@ -265,6 +266,7 @@ export function buildReactiveEngine(inputs) {
             description: claim.description,
             target: claim.target,
             waited,
+            ...(readAt !== undefined ? { readAt } : {}),
             ...(resolvedFenceToken !== undefined ? { fenceToken: resolvedFenceToken } : {}),
             release,
             revoke: claim.revoke,
@@ -293,9 +295,10 @@ export function buildReactiveEngine(inputs) {
             // holds the lease, never a half-claimed one racing the queue.
             let waited = false;
             let fenceToken;
+            let readAt;
             if (claimOptions.queue) {
                 try {
-                    ({ waited, fenceToken } = await awaitClaimGrant(transport, claim.id, {
+                    ({ waited, fenceToken, readAt } = await awaitClaimGrant(transport, claim.id, {
                         timeoutMs: claimOptions.waitTimeoutMs,
                         maxQueueDepth: claimOptions.maxQueueDepth,
                         signal: claimOptions.signal,
@@ -310,7 +313,7 @@ export function buildReactiveEngine(inputs) {
                     throw err;
                 }
             }
-            return wrapClaimHandle(claim, waited, fenceToken);
+            return wrapClaimHandle(claim, waited, fenceToken, readAt);
         },
         list(target) {
             return listModelClaims(target);
@@ -701,5 +704,22 @@ export function buildReactiveEngine(inputs) {
             });
         },
     };
+    // A model the schema projection left out answers with an error naming the
+    // model and the fix, not `undefined`. An app can compile against the full
+    // source schema while running a projection, so the type system never sees
+    // this gap; without the stub the caller crashes one property later with a
+    // bare TypeError ("reading 'local'") that names neither. Non-enumerable so
+    // spread, Object.keys, and JSON.stringify walk past the stubs untriggered.
+    for (const name of schema.omittedModels ?? []) {
+        if (name in engine)
+            continue;
+        Object.defineProperty(engine, name, {
+            get() {
+                throw omittedModelError(name);
+            },
+            enumerable: false,
+            configurable: true,
+        });
+    }
     return engine;
 }

package/dist/local/client/storeLifecycle.js

@@ -107,7 +107,7 @@ export function startStoreLifecycle(deps) {
                     auth: authCredentials,
                     logger,
                 });
-                const { userId, accountScope, projectId, environment, sandboxId, teamIds, capabilityToken, syncGroups, participantKind, } = resolved;
+                const { userId, accountScope, projectId, branchId, branchRoot, teamIds, capabilityToken, syncGroups, participantKind, } = resolved;
                 // Fail-loud guard: detect the degenerate "no real sync groups
                 // resolved" state before opening the socket. It is the same class of bug as
                 // a sensible-looking default that's functionally broken: the
@@ -155,12 +155,15 @@ export function startStoreLifecycle(deps) {
                 // agents default to 'none' (transactional participant — see
                 // option doc) and everyone else defaults to 'full'.
                 const resolvedBootstrapMode = internalOptions.bootstrapMode ?? (participantKind === 'agent' ? 'none' : 'full');
+                if (!branchId) {
+                    throw new AbloConnectionError('The server did not resolve an Ablo branch for this credential.', { code: 'invalid_request' });
+                }
                 const gen = store.initialize({
                     userId,
                     organizationId: accountScope,
                     projectId,
-                    environment,
-                    sandboxId,
+                    branchId,
+                    branchRoot,
                     teamIds,
                     kind: participantKind,
                     capabilityToken,

package/dist/local/stores/DatabaseManager.d.ts

@@ -15,8 +15,8 @@ export interface DatabaseInfo {
     workspaceId: string;
     participantKind: string;
     projectId: string | null;
-    environment: 'sandbox' | 'production' | null;
-    sandboxId: string | null;
+    branchId: string;
+    branchRoot: boolean;
     schemaHash: string;
     schemaVersion: number;
     userVersion?: number;

package/dist/local/stores/DatabaseManager.js

@@ -114,8 +114,8 @@ export class DatabaseManager {
             workspaceId: identity.organizationId,
             participantKind: identity.participantKind,
             projectId: identity.projectId,
-            environment: identity.environment,
-            sandboxId: identity.sandboxId,
+            branchId: identity.branchId,
+            branchRoot: identity.branchRoot,
             schemaHash,
             schemaVersion,
             userVersion,

package/dist/local/stores/persistenceIdentity.d.ts

@@ -1,15 +1,14 @@
 /**
- * The complete authenticated plane that owns one local replica. The same
- * participant can have different data in a project, sandbox, or environment;
- * those replicas must never share a namespace.
+ * The complete authenticated branch that owns one local replica. A branch id
+ * is authoritative.
  */
 export interface PersistenceIdentity {
     readonly participantId: string;
     readonly participantKind: string;
     readonly organizationId: string;
     readonly projectId: string | null;
-    readonly environment: 'sandbox' | 'production' | null;
-    readonly sandboxId: string | null;
+    readonly branchId: string;
+    readonly branchRoot: boolean;
 }
 export interface PersistedIdentityMetadata {
     readonly namespaceVersion?: number;
@@ -17,10 +16,10 @@ export interface PersistedIdentityMetadata {
     readonly workspaceId: string;
     readonly participantKind?: string;
     readonly projectId?: string | null;
-    readonly environment?: 'sandbox' | 'production' | null;
-    readonly sandboxId?: string | null;
+    readonly branchId?: string;
+    readonly branchRoot?: boolean;
 }
-export declare const PERSISTENCE_NAMESPACE_VERSION = 2;
+export declare const PERSISTENCE_NAMESPACE_VERSION = 4;
 /** Collision-resistant IndexedDB name for one authenticated data plane. */
 export declare function persistenceDatabaseName(identity: PersistenceIdentity, userVersion?: number): Promise<string>;
 /** Defense-in-depth check after namespace lookup and before persisted reads. */

package/dist/local/stores/persistenceIdentity.js

@@ -1,11 +1,10 @@
 import { AbloConnectionError } from '@abloatai/transaction/errors';
-export const PERSISTENCE_NAMESPACE_VERSION = 2;
+export const PERSISTENCE_NAMESPACE_VERSION = 4;
 function canonicalIdentity(identity, userVersion) {
     return JSON.stringify([
         PERSISTENCE_NAMESPACE_VERSION,
         identity.projectId,
-        identity.environment,
-        identity.sandboxId,
+        ['branch', identity.branchId, identity.branchRoot],
         identity.organizationId,
         identity.participantKind,
         identity.participantId,
@@ -33,6 +32,6 @@ export function persistenceIdentityMatches(info, identity) {
         info.workspaceId === identity.organizationId &&
         info.participantKind === identity.participantKind &&
         (info.projectId ?? null) === identity.projectId &&
-        (info.environment ?? null) === identity.environment &&
-        (info.sandboxId ?? null) === identity.sandboxId);
+        info.branchId === identity.branchId &&
+        (info.branchRoot ?? false) === identity.branchRoot);
 }

package/dist/local/sync/SyncWebSocket.d.ts

@@ -94,7 +94,14 @@ export declare class SyncWebSocket<TCollaboration extends EventMap<TCollaboratio
      * and an observability breadcrumb; it is never applied. There is one parse per
      * delta — callers must not re-parse.
      */
+    /**
+     * Wire validation runs once per delta, so at drain scale it is a per-delta
+     * fixed cost rather than a payload-proportional one. The guard keeps the
+     * normal path free: when profiling is off this is a boolean test and a
+     * direct call, with no closure allocated per delta.
+     */
     private normalizeWireDelta;
+    private parseWireDelta;
     /**
      * Handle incoming sync delta (untrusted wire input — validated and
      * normalized by {@link normalizeWireDelta}; malformed deltas are dropped).