@abloatai/humans 0.38.0 → 0.40.0

package/src/local/SyncClient.ts

@@ -1290,34 +1290,25 @@ export class SyncClient extends EventEmitter {
    * local model has unsynced changes, so the two sides stay consistent.
    */
   resolveConflicts(localModel: Model, serverData: Record<string, unknown>): Model {
-    const hasLocalChanges = localModel.hasChanges;
-    // Safely get timestamp, handling both Date objects and strings
-    const localUpdatedAt = localModel.updatedAt
-      ? localModel.updatedAt instanceof Date
-        ? localModel.updatedAt.getTime()
-        : new Date(localModel.updatedAt).getTime()
-      : 0;
-    const serverUpdatedAt = toEpochMs(serverData.updatedAt);
-
-    this.runtime.logger.debug('Conflict resolution', {
-      modelId: localModel.id,
-      modelType: localModel.getModelName(),
-      hasLocalChanges,
-      localUpdatedAt: localModel.updatedAt?.toString(),
-      serverUpdatedAt: serverData.updatedAt,
-      localChanges: localModel.getChanges(),
-      serverState: this.extractCriticalState(serverData),
-    });
-
-    // PRIORITY 1: Check for critical server states that must be respected
-    // These states override any local changes to maintain data consistency
-    const criticalServerStates = this.extractCriticalState(serverData);
-    const shouldForceAcceptServer = this.hasCriticalStateChange(criticalServerStates);
+    // No entry-point debug here: this runs once per incoming update delta,
+    // and a debug call's payload is BUILT even when the logger discards it —
+    // a per-delta model scan on the apply hot path. The outcome branches
+    // below log the cases worth reading.
+
+    // PRIORITY 1: Check for critical server states that must be respected.
+    // These states override any local changes to maintain data consistency.
+    // Checked inline — the collected-object form (`extractCriticalState`)
+    // only materializes on the rare force-accept branch, for its log line.
+    const shouldForceAcceptServer =
+      (serverData.deletedAt !== undefined && serverData.deletedAt !== null) ||
+      (serverData.archivedAt !== undefined && serverData.archivedAt !== null) ||
+      serverData.isActive === false ||
+      (serverData.unassignedAt !== undefined && serverData.unassignedAt !== null);
 
     if (shouldForceAcceptServer) {
       this.runtime.logger.debug('Accepting server update - critical state change detected', {
         modelId: localModel.id,
-        criticalStates: criticalServerStates,
+        criticalStates: this.extractCriticalState(serverData),
       });
 
       // Force accept server state for critical changes
@@ -1329,7 +1320,7 @@ export class SyncClient extends EventEmitter {
 
     // Local-first: if we have local dirty fields, merge by field.
     // Keep locally changed fields; apply server for the rest.
-    if (hasLocalChanges) {
+    if (localModel.hasChanges) {
       const localChanges = localModel.getChanges();
       this.runtime.logger.debug('Merging server update with local dirty fields', {
         modelId: localModel.id,
@@ -1341,6 +1332,13 @@ export class SyncClient extends EventEmitter {
 
       // Preserve the most recent updatedAt without clearing dirty flags
       if (serverData.updatedAt || localModel.updatedAt) {
+        // Safely get timestamp, handling both Date objects and strings
+        const localUpdatedAt = localModel.updatedAt
+          ? localModel.updatedAt instanceof Date
+            ? localModel.updatedAt.getTime()
+            : new Date(localModel.updatedAt).getTime()
+          : 0;
+        const serverUpdatedAt = toEpochMs(serverData.updatedAt);
         const mergedUpdatedAt = new Date(Math.max(localUpdatedAt, serverUpdatedAt));
         // updateFromData accepts Date or ISO string for dates
         merged.updatedAt = mergedUpdatedAt;
@@ -1351,10 +1349,9 @@ export class SyncClient extends EventEmitter {
       return localModel;
     }
 
-    // No local changes: fall back to LWW to converge
-    // Accept server regardless of timestamp equality to stay in sync
-    const acceptReason = serverUpdatedAt > localUpdatedAt ? 'server is newer' : 'no local changes';
-    this.runtime.logger.debug(`Accepting server update - ${acceptReason}`);
+    // No local changes: fall back to LWW to converge. Accept server
+    // regardless of timestamp equality to stay in sync. Not logged — this is
+    // the common path for every collaborator update a client receives.
     localModel.updateFromData(serverData);
     localModel.clearChanges();
     localModel.markAsSynced();
@@ -1392,17 +1389,6 @@ export class SyncClient extends EventEmitter {
     return critical;
   }
 
-  /**
-   * Check if critical state changes exist that require forcing server state
-   */
-  private hasCriticalStateChange(criticalStates: Record<string, unknown>): boolean {
-    // Any critical state present means we should force accept server
-    return (
-      Object.keys(criticalStates).length > 0 &&
-      Object.values(criticalStates).some((v) => v !== null && v !== undefined)
-    );
-  }
-
   /**
    * Handle network reconnection
    */
@@ -1826,6 +1812,7 @@ export class SyncClient extends EventEmitter {
     return this.mutationQueue.confirmationFor(modelName, modelId);
   }
 
+
   /**
    * Get detailed debug info for the sync debug page
    */
@@ -1901,6 +1888,22 @@ export class SyncClient extends EventEmitter {
   applyDeltaBatchToPool(
     dbResults: readonly AppliedChange[],
     enrichRelations: (modelName: string, data: Record<string, unknown>) => Record<string, unknown>,
+  ): void {
+    // The WHOLE batch — conflict resolution and model mutation included, not
+    // just the pool bookkeeping at the end — runs in one MobX action.
+    // `resolveConflicts` writes model fields via `updateFromData`; when those
+    // writes ran before the action, every delta opened its own top-level
+    // action and flushed reactions at its boundary, so a large frame paid one
+    // reaction pass per delta and an observer could see a partially applied
+    // frame between them.
+    runInAction(() => {
+      this.applyDeltaBatchToPoolInAction(dbResults, enrichRelations);
+    });
+  }
+
+  private applyDeltaBatchToPoolInAction(
+    dbResults: readonly AppliedChange[],
+    enrichRelations: (modelName: string, data: Record<string, unknown>) => Record<string, unknown>,
   ): void {
     const modelsToAdd: Model[] = [];
     const modelsToUpsert: Model[] = [];
@@ -1948,7 +1951,13 @@ export class SyncClient extends EventEmitter {
 
       switch (action) {
         case 'add': {
-          const existing = this.objectPool.get(modelId);
+          // `peek`, not `get`: this loop is ingestion, not a consumer read.
+          // `get()` activates deferred MobX instrumentation, so reading
+          // through it here made the delta stream itself instrument every
+          // row it touched — the dominant term of apply cost for rows no
+          // consumer observes. Activation belongs to the consumer-facing
+          // reads (`get`, views, subscribers), which are unchanged.
+          const existing = this.objectPool.peek(modelId);
           if (existing) {
             existing.markAsSynced();
           } else if (result.data) {
@@ -1961,7 +1970,7 @@ export class SyncClient extends EventEmitter {
           break;
         }
         case 'update': {
-          const existing = this.objectPool.get(modelId);
+          const existing = this.objectPool.peek(modelId);
           if (existing && !existing.disposed && result.data) {
             enrichRelations(modelName, result.data);
             const resolved = this.resolveConflicts(existing, result.data);
@@ -2002,27 +2011,21 @@ export class SyncClient extends EventEmitter {
       }
     }
 
-    // Reveal the whole frame in a single MobX action. `addBatch`,
-    // `upsertBatch`, `removeBatch`, and `updateScope` are each individually
-    // wrapped in an action, so calling them in sequence flushes reactions at
-    // every action boundary — a catch-up frame that adds, updates, and removes
-    // would fire every dependent reaction several times in a row, re-rendering
-    // and re-sorting on each. Wrapping them in one outer `runInAction` defers
-    // all reaction flushes to a single boundary, so dependents recompute
-    // exactly once regardless of how many models or operation kinds the frame
-    // touched. The app therefore never observes a partially applied frame.
-    runInAction(() => {
-      if (modelsToAdd.length > 0) this.objectPool.addBatch(modelsToAdd, ModelScope.live);
-      if (modelsToUpsert.length > 0) this.objectPool.upsertBatch(modelsToUpsert, ModelScope.live);
-      if (idsToRemove.length > 0) this.objectPool.removeBatch(idsToRemove);
-      for (const id of idsToArchive) this.objectPool.updateScope(id, ModelScope.archived);
-
-      // Emit changed model types so QueryProcessor can auto-invalidate.
-      // Kept inside the action so any observable query-cache state it
-      // flips is part of the same atomic reveal.
-      const changedTypes = new Set(dbResults.map(r => r.modelName));
-      if (changedTypes.size > 0) this.emit('models:changed', changedTypes);
-    });
+    // Reveal the whole frame at one reaction boundary: the caller's single
+    // action covers the collection loop above and these batch pool writes, so
+    // dependents recompute exactly once regardless of how many models or
+    // operation kinds the frame touched, and the app never observes a
+    // partially applied frame.
+    if (modelsToAdd.length > 0) this.objectPool.addBatch(modelsToAdd, ModelScope.live);
+    if (modelsToUpsert.length > 0) this.objectPool.upsertBatch(modelsToUpsert, ModelScope.live);
+    if (idsToRemove.length > 0) this.objectPool.removeBatch(idsToRemove);
+    for (const id of idsToArchive) this.objectPool.updateScope(id, ModelScope.archived);
+
+    // Emit changed model types so QueryProcessor can auto-invalidate.
+    // Kept inside the action so any observable query-cache state it
+    // flips is part of the same atomic reveal.
+    const changedTypes = new Set(dbResults.map(r => r.modelName));
+    if (changedTypes.size > 0) this.emit('models:changed', changedTypes);
   }
 
   /**

package/src/local/client/reactiveEngine.ts

@@ -13,6 +13,7 @@
  */
 
 import type { Schema, SchemaRecord } from '@abloatai/transaction/schema/schema';
+import { omittedModelError } from '@abloatai/transaction/schema/select';
 import {
   durableCommitOperationSchema,
   type DurableCommitOperation,
@@ -934,5 +935,22 @@ export function buildReactiveEngine<const S extends SchemaRecord>(
     },
   } as Ablo<S>;
 
+  // A model the schema projection left out answers with an error naming the
+  // model and the fix, not `undefined`. An app can compile against the full
+  // source schema while running a projection, so the type system never sees
+  // this gap; without the stub the caller crashes one property later with a
+  // bare TypeError ("reading 'local'") that names neither. Non-enumerable so
+  // spread, Object.keys, and JSON.stringify walk past the stubs untriggered.
+  for (const name of schema.omittedModels ?? []) {
+    if (name in engine) continue;
+    Object.defineProperty(engine, name, {
+      get() {
+        throw omittedModelError(name);
+      },
+      enumerable: false,
+      configurable: true,
+    });
+  }
+
   return engine;
 }

package/src/local/sync/SyncWebSocket.ts

@@ -272,12 +272,9 @@ export class SyncWebSocket<
   protected override handleDelta(rawDelta: unknown): void {
     const delta = this.normalizeWireDelta(rawDelta);
     if (!delta) return;
-    getContext().logger.debug('Received delta', {
-      action: delta.actionType,
-      model: delta.modelName,
-      id: delta.modelId,
-      syncId: delta.id,
-    });
+    // No per-delta debug here: the payload object is built even when the
+    // logger discards it, and this runs at the full live wire rate. Dropped
+    // malformed deltas are still logged by `normalizeWireDelta`.
 
     // Do not advance `this.cursor.lastSyncId` on receipt. The runtime cursor
     // must stay consistent with what has been persisted locally; otherwise the

package/src/local/sync/deltaPipeline.ts

@@ -24,7 +24,14 @@ import {
   type AbloPlugin,
   type AppliedChange,
 } from '../../plugin.js';
-import { observeDrainBatch, timeDrainStage, timeDrainStageAsync } from './drainProfile.js';
+import {
+  observeDrainBatch,
+  observeDrainAcknowledge,
+  timeDrainStage,
+  timeDrainStageAsync,
+  openDrainBatchRow,
+  closeDrainBatchRow,
+} from './drainProfile.js';
 
 /**
  * What the pipeline needs back from the surrounding store: the shared mutable
@@ -46,7 +53,11 @@ export interface DeltaPipelineContext {
   batchTimer: ReturnType<typeof setTimeout> | null;
   /** Queue for deltas arriving during an active bootstrap; null when none. */
   readonly bootstrapDeltaQueue: SyncDelta[] | null;
-  readonly smartSyncOptions: { readonly batchingDelay: number; readonly maxBatchSize: number };
+  readonly smartSyncOptions: {
+    readonly batchingDelay: number;
+    readonly maxBatchSize: number;
+    readonly applySliceDeltas: number;
+  };
   /** Pool-applied cursor (`syncClient.position.applied`). */
   readonly highestProcessedSyncId: number;
   /** Resume/ack cursor (`syncClient.position.persisted`). */
@@ -79,7 +90,8 @@ export interface DeltaPipelineContext {
 
   // ── Custom-entity pool ops (deltas that skip the local store) ──
   readonly objectPool: {
-    get(id: string): Model | undefined;
+    /** Ingestion-side lookup — resolves without activating observability. */
+    peek(id: string): Model | undefined;
     add(model: Model, scope: ModelScope): void;
     remove(id: string): boolean;
     /** Full in-memory clear — the revocation-failure fallback (see
@@ -305,6 +317,7 @@ export function enqueueDelta(
   // The delta is accepted and queued — the `receive` stage boundary.
   runStage(ctx.stagePlugins ?? [], 'receive', { delta });
   ctx.pendingDeltas.push(delta);
+  pipelineDebug.enqueued += 1;
   return true;
 }
 
@@ -393,6 +406,71 @@ async function drainPendingDeltas(ctx: DeltaPipelineContext): Promise<void> {
   }
 }
 
+/**
+ * Uninterrupted apply time allowed before the sliced loop yields — the
+ * "no visible stall" bound. Yields are amortized against it because one host
+ * yield costs milliseconds under load; at the measured per-delta apply cost
+ * this works out to roughly one yield per one to two 600-delta slices.
+ */
+const APPLY_YIELD_BUDGET_MS = 12;
+
+/**
+ * Wedge forensics: where the pipeline currently is, updated synchronously at
+ * every stage boundary. A hang diagnoses itself by which counter pair
+ * diverged and which phase the active flush froze in. Mirrored onto
+ * `globalThis.__abloPipelineDebug` so a bench watchdog in the same thread
+ * can read it without an import path into SDK internals — diagnostics only,
+ * a handful of numbers, no payload data.
+ */
+export const pipelineDebug = {
+  flushesStarted: 0,
+  flushesSettled: 0,
+  persistsStarted: 0,
+  persistsSettled: 0,
+  applySlices: 0,
+  applyYields: 0,
+  enqueued: 0,
+  phase: 'idle' as string,
+};
+(globalThis as { __abloPipelineDebug?: typeof pipelineDebug }).__abloPipelineDebug =
+  pipelineDebug;
+
+/**
+ * Split applied changes into slices of at most `maxDeltas`, never splitting a
+ * transaction: consecutive changes sharing a `transactionId` form one
+ * indivisible group (a commit reveals whole), while changes without one are
+ * individually splittable. A single transaction larger than the bound forms
+ * its own oversized slice, so apply always advances rather than stalling on
+ * an oversized commit — the same rule the server's publication chunking uses.
+ */
+export function sliceApplyChanges<T extends { readonly transactionId?: string }>(
+  changes: readonly T[],
+  maxDeltas: number,
+): readonly T[][] {
+  if (changes.length <= maxDeltas) return changes.length > 0 ? [[...changes]] : [];
+  const slices: T[][] = [];
+  let current: T[] = [];
+  let index = 0;
+  while (index < changes.length) {
+    // The indivisible unit starting here: one transaction's run, or a single
+    // untransacted change.
+    const transactionId = changes[index]!.transactionId;
+    let end = index + 1;
+    if (transactionId !== undefined) {
+      while (end < changes.length && changes[end]!.transactionId === transactionId) end += 1;
+    }
+    const groupSize = end - index;
+    if (current.length > 0 && current.length + groupSize > maxDeltas) {
+      slices.push(current);
+      current = [];
+    }
+    current.push(...changes.slice(index, end));
+    index = end;
+  }
+  if (current.length > 0) slices.push(current);
+  return slices;
+}
+
 function yieldToHost(): Promise<void> {
   const immediate = (
     globalThis as {
@@ -408,8 +486,24 @@ function yieldToHost(): Promise<void> {
 async function flushDeltaBatch(
   ctx: DeltaPipelineContext,
   queuedDeltas: SyncDelta[],
+): Promise<void> {
+  openDrainBatchRow(queuedDeltas.length);
+  pipelineDebug.flushesStarted += 1;
+  try {
+    await flushDeltaBatchInner(ctx, queuedDeltas);
+  } finally {
+    pipelineDebug.flushesSettled += 1;
+    pipelineDebug.phase = 'idle';
+    closeDrainBatchRow();
+  }
+}
+
+async function flushDeltaBatchInner(
+  ctx: DeltaPipelineContext,
+  queuedDeltas: SyncDelta[],
 ): Promise<void> {
   const stagePlugins = ctx.stagePlugins ?? [];
+  pipelineDebug.phase = 'dedupe';
   const deduplicatedDeltas = timeDrainStage('dedupe', () => ctx.deduplicateDeltas(queuedDeltas));
   observeDrainBatch(queuedDeltas.length, deduplicatedDeltas.length);
   runStage(stagePlugins, 'dedupe', { deltas: deduplicatedDeltas });
@@ -427,7 +521,7 @@ async function flushDeltaBatch(
         // gained permission to see the entity, so we insert it into the
         // pool as if newly created.
         if (delta.actionType === 'I' || delta.actionType === 'U' || delta.actionType === 'C') {
-          const existing = ctx.objectPool.get(delta.modelId);
+          const existing = ctx.objectPool.peek(delta.modelId);
           if (existing) {
             existing.updateFromData(data);
           } else {
@@ -446,6 +540,8 @@ async function flushDeltaBatch(
   // handleGroupRemoved) and never reach here, though the persistence
   // signature accepts them defensively.
   const regularDeltas = deduplicatedDeltas.filter((d) => !ctx.isCustomEntity(d.modelName));
+  pipelineDebug.phase = 'persist';
+  pipelineDebug.persistsStarted += 1;
   const batch = await timeDrainStageAsync('persist', () =>
     ctx.processDeltaBatch(
       regularDeltas.map((d) => ({
@@ -460,6 +556,7 @@ async function flushDeltaBatch(
       }))
     )
   );
+  pipelineDebug.persistsSettled += 1;
   const dbResults = batch.results;
   runStage(stagePlugins, 'persist', { deltas: regularDeltas });
 
@@ -468,13 +565,41 @@ async function flushDeltaBatch(
   // materialiser attached where it said it would. The direct call is the
   // bridge for stores constructed without plugins (subclasses, tests),
   // whose own apply is the whole pipeline.
-  timeDrainStage('apply', () => {
-    if (pluginsForStage(stagePlugins, 'apply').length > 0) {
-      runStage(stagePlugins, 'apply', { changes: dbResults });
-    } else {
-      ctx.applyDeltaBatchToPool(dbResults);
+  //
+  // Large batches apply in TIME SLICES: split at transaction boundaries into
+  // bounded chunks with the event loop yielded between them, so a catch-up
+  // wave reveals commit-by-commit instead of holding the thread for one long
+  // synchronous block. Each slice is still one MobX action (reactions fire
+  // once per slice), and a transaction never splits across slices — the
+  // commit remains the atomic unit of visibility.
+  const slices = sliceApplyChanges(dbResults, ctx.smartSyncOptions.applySliceDeltas);
+  await timeDrainStageAsync('apply', async () => {
+    const hasApplyPlugins = pluginsForStage(stagePlugins, 'apply').length > 0;
+    // Yield on a TIME budget, not per slice: a host yield costs milliseconds
+    // under load (measured ~7x throughput collapse when yielding every few
+    // deltas), so the yield decision amortizes it — only after the budget of
+    // uninterrupted apply work has been spent, and never before the first
+    // slice. Slices stay the atomicity unit; the budget only decides where
+    // the loop breathes.
+    let sliceStartedAt = performance.now();
+    for (let index = 0; index < slices.length; index++) {
+      if (index > 0 && performance.now() - sliceStartedAt > APPLY_YIELD_BUDGET_MS) {
+        pipelineDebug.phase = `apply-yield-${index}`;
+        pipelineDebug.applyYields += 1;
+        await yieldToHost();
+        sliceStartedAt = performance.now();
+      }
+      pipelineDebug.phase = `apply-slice-${index}`;
+      pipelineDebug.applySlices += 1;
+      const slice = slices[index]!;
+      if (hasApplyPlugins) {
+        runStage(stagePlugins, 'apply', { changes: slice });
+      } else {
+        ctx.applyDeltaBatchToPool(slice);
+      }
     }
   });
+  pipelineDebug.phase = 'acknowledge';
 
   // Acknowledge and advance the sync cursor, gated on persistence.
   //
@@ -489,6 +614,7 @@ async function flushDeltaBatch(
     timeDrainStage('acknowledge', () => {
       ctx.acknowledge(persistedSyncId);
       ctx.advancePersisted(persistedSyncId);
+      observeDrainAcknowledge(persistedSyncId);
       runStage(stagePlugins, 'acknowledge', { syncId: persistedSyncId });
     });
   }

package/src/local/sync/drainProfile.ts

@@ -32,6 +32,19 @@ export interface DrainStageTotals {
   readonly calls: number;
 }
 
+/**
+ * One flush batch on the wall clock. Wall time (`Date.now`) rather than
+ * `performance.now`, because rows cross the worker boundary and each thread
+ * has its own `performance` origin — the drain-tail stamps learned the same
+ * lesson. Stage entries are the batch's own share of each pipeline stage.
+ */
+export interface DrainBatchRow {
+  readonly startedAtWallMs: number;
+  readonly endedAtWallMs: number;
+  readonly deltas: number;
+  readonly stages: Readonly<Partial<Record<DrainStage, number>>>;
+}
+
 export interface DrainProfile {
   /** Flush batches drained. The per-batch fixed cost multiplies by this. */
   readonly batches: number;
@@ -42,6 +55,12 @@ export interface DrainProfile {
   /** Wall time from the first observed stage to the last. */
   readonly spanMs: number;
   readonly stages: Readonly<Record<DrainStage, DrainStageTotals>>;
+  /**
+   * The most recent flush batches, oldest first, capped — enough to cover a
+   * drain tail. Optional because derived profiles (window subtraction, fleet
+   * merges) drop it; only a worker's own snapshot carries rows.
+   */
+  readonly recentBatches?: readonly DrainBatchRow[];
 }
 
 const DRAIN_STAGES: readonly DrainStage[] = [
@@ -72,6 +91,73 @@ let deduplicated = 0;
 let firstMark: number | undefined;
 let lastMark = 0;
 
+/** Ring of recent batch rows. ~50 batches/sec at benchmark rates, so this covers seconds of tail. */
+const BATCH_ROW_CAP = 128;
+let batchRows: DrainBatchRow[] = [];
+interface OpenBatchRow {
+  startedAtWallMs: number;
+  deltas: number;
+  stages: Partial<Record<DrainStage, number>>;
+}
+/**
+ * The batch currently being flushed. Module-global like the totals above, so
+ * an isolate hosting several stores attributes interleaved awaits to whichever
+ * batch is open — the same per-isolate approximation the totals already make.
+ */
+let currentRow: OpenBatchRow | null = null;
+
+/**
+ * Wall-stamped persisted-cursor advances, oldest first. The benchmark's drain
+ * gate reads THESE rather than observing the cursor from a timer or a
+ * cross-thread poll: any observation that has to be scheduled onto the
+ * worker's event loop queues behind the very drain burst it is measuring and
+ * reports the queue's latency as drain. A stamp taken synchronously inside
+ * the acknowledge stage cannot be deferred by anything.
+ */
+export interface AcknowledgeStamp {
+  readonly syncId: number;
+  readonly atWallMs: number;
+}
+const ACK_STAMP_CAP = 512;
+let ackStamps: AcknowledgeStamp[] = [];
+
+/**
+ * Record a persisted-cursor advance. Called by the pipeline's acknowledge
+ * stage. Unlike every stage timer here, this is NOT gated on the profiler
+ * flag: it is one wall-clock read and one bounded push per flush batch —
+ * nothing against the batch's own work — and the certification benchmark
+ * runs unprofiled (the profiler costs ~15%), so the honest drain stamp must
+ * exist without it.
+ */
+export function observeDrainAcknowledge(syncId: number): void {
+  ackStamps.push({ syncId, atWallMs: Date.now() });
+  if (ackStamps.length > ACK_STAMP_CAP) ackStamps.shift();
+}
+
+/** The recorded persisted-advance stamps, oldest first. */
+export function drainAcknowledgeStamps(): readonly AcknowledgeStamp[] {
+  return [...ackStamps];
+}
+
+/** Begin a batch row. Called by the pipeline at flush entry when profiling. */
+export function openDrainBatchRow(deltaCount: number): void {
+  if (!enabled) return;
+  currentRow = { startedAtWallMs: Date.now(), deltas: deltaCount, stages: {} };
+}
+
+/** Close the open batch row and commit it to the ring. */
+export function closeDrainBatchRow(): void {
+  if (!enabled || currentRow === null) return;
+  batchRows.push({
+    startedAtWallMs: currentRow.startedAtWallMs,
+    endedAtWallMs: Date.now(),
+    deltas: currentRow.deltas,
+    stages: currentRow.stages,
+  });
+  if (batchRows.length > BATCH_ROW_CAP) batchRows.shift();
+  currentRow = null;
+}
+
 /**
  * Read once. A profiler that consults the environment on every delta would
  * itself become a per-delta cost in the path it is measuring.
@@ -98,6 +184,9 @@ export function observeDrainStage(stage: DrainStage, elapsedMs: number): void {
   const entry = totals[stage];
   entry.totalMs += elapsedMs;
   entry.calls += 1;
+  if (currentRow !== null) {
+    currentRow.stages[stage] = (currentRow.stages[stage] ?? 0) + elapsedMs;
+  }
   mark(elapsedMs);
 }
 
@@ -150,6 +239,7 @@ export function drainProfileSnapshot(): DrainProfile {
     deduplicated,
     spanMs: firstMark === undefined ? 0 : lastMark - firstMark,
     stages,
+    recentBatches: [...batchRows],
   };
 }
 
@@ -161,4 +251,7 @@ export function resetDrainProfile(): void {
   deduplicated = 0;
   firstMark = undefined;
   lastMark = 0;
+  batchRows = [];
+  currentRow = null;
+  ackStamps = [];
 }

package/src/local/transactions/mutations/MutationQueue.ts

@@ -647,10 +647,20 @@ export class MutationQueue extends EventEmitter {
     let holdsEntireBatch = false;
 
     for (const notification of notifications) {
-      const candidates = targets.filter((target) => target.id === notification.id);
+      // Scope is decided before any target matching. A group premise fires over
+      // the WHOLE batch by convention, and its `target` now names the row that
+      // actually moved — which may well be a row this batch is writing, so
+      // matching first would misread a batch-wide hold as a per-row one.
+      if (notification.scope === 'group') {
+        holdsEntireBatch = true;
+        continue;
+      }
+      const candidates = targets.filter(
+        (target) => target.id === notification.target.id,
+      );
       const notificationKey = this.receiptTargetKey(
-        notification.model,
-        notification.id,
+        notification.target.model,
+        notification.target.id,
       );
       const exactTargets = candidates.filter(
         (target) => target.key === notificationKey,
@@ -661,7 +671,7 @@ export class MutationQueue extends EventEmitter {
         ),
       );
 
-      if (notification.group || candidates.length === 0) {
+      if (candidates.length === 0) {
         holdsEntireBatch = true;
         continue;
       }

package/src/local/utils/mobxSetup.ts

@@ -27,6 +27,7 @@ import { getContext } from '../context.js';
 interface M1Target {
   _hasCustomObservability?: boolean;
   _isConstructing?: boolean;
+  _isHydrating?: boolean;
   _extraMobxAnnotations?: Record<string, AnnotationMapEntry>;
   setupObservability?(): void;
   propertyChanged?(name: string, oldValue: unknown, newValue: unknown): void;
@@ -282,6 +283,10 @@ export function M1<T extends M1Target>(
               // pre-construct models with partial data then bulk-assign
               // would otherwise spuriously fill `modifiedProperties`.
               if (target._isConstructing) return;
+              // Hydration writes (`updateFromData`) are inbound wire data,
+              // not user edits: the forward's result is discarded by the
+              // `modifiedProperties` swap anyway, so skip the work.
+              if (target._isHydrating) return;
               if (typeof target.propertyChanged === 'function') {
                 target.propertyChanged(
                   propName,