@abloatai/humans 0.39.0 → 0.41.0

package/dist/local/BaseSyncedStore.d.ts

@@ -126,6 +126,15 @@ export interface SmartSyncOptions {
     maxBootstrapSize?: number;
     batchingDelay?: number;
     maxBatchSize?: number;
+    /**
+     * Upper bound on deltas revealed per apply slice. A large flush batch is
+     * split at TRANSACTION boundaries into slices of at most this many deltas,
+     * with the event loop yielded between slices, so a catch-up wave never
+     * holds the thread for one long synchronous apply. A transaction larger
+     * than the bound still applies whole — the commit stays the atomic unit of
+     * visibility. `Infinity` restores single-slice behavior.
+     */
+    applySliceDeltas?: number;
 }
 export type { RehydrationStats } from './sync/bootstrapApply.js';
 /**

package/dist/local/BaseSyncedStore.js

@@ -36,6 +36,15 @@ import * as groupChange from './sync/groupChange.js';
 import * as bootstrapApply from './sync/bootstrapApply.js';
 import * as deltaPipeline from './sync/deltaPipeline.js';
 import { queryByClass as runQueryByClass, countModels } from './store/queryApi.js';
+/** Bench-diagnostic slice-bound override; absent everywhere but the bench. */
+function benchApplySliceOverride() {
+    const host = globalThis;
+    const raw = host.process?.env?.ABLO_APPLY_SLICE_DELTAS;
+    if (!raw)
+        return undefined;
+    const value = Number(raw);
+    return Number.isFinite(value) && value > 0 ? value : undefined;
+}
 /**
  * Bootstrap retry configuration.
  *
@@ -378,6 +387,18 @@ export class BaseSyncedStore {
             // trickle just as well and keeps burst tails inside the drain budget.
             batchingDelay: 10,
             maxBatchSize: 50,
+            // ~600 deltas ≈ 9 to 14 ms of apply — inside a no-visible-stall
+            // budget, and a full 500-op commit reveals in one slice. The yield
+            // itself is TIME-budgeted in the pipeline (one or two yields per
+            // batch), because a host yield costs milliseconds under load.
+            // History: the "sliced-apply wedge" that briefly held this at
+            // Infinity was kernel memory limits against the bench's many-isolate
+            // process (semispace commits refused at stock max_map_count /
+            // CommitLimit), not this pipeline — with the limits raised, the
+            // sliced path ran the full certification load with zero errors and
+            // cut writer ack latency threefold. `ABLO_APPLY_SLICE_DELTAS` remains
+            // the bench-diagnostic override.
+            applySliceDeltas: benchApplySliceOverride() ?? 600,
         };
         // Create internal helpers
         this.queryProcessor = new QueryProcessor({

package/dist/local/InstanceCache.d.ts

@@ -60,6 +60,18 @@ export declare class InstanceCache {
     constructor(config?: PoolConfig, modelRegistry?: ModelRegistry);
     private resolveModel;
     get<T extends Model = Model>(id: string): T | undefined;
+    /**
+     * Ingestion-side lookup: resolve a row WITHOUT crossing the consumer
+     * boundary. Same resolution semantics as {@link get} — weak-ref revival,
+     * disposed rows filtered, access recency stamped — but the model is NOT
+     * activated. The delta-apply loop reads every row it updates, and reading
+     * through `get()` made the stream itself install per-field MobX
+     * instrumentation on rows no consumer ever observes; that activation is
+     * the dominant term of apply cost (measured 12.9 vs 2.9 µs/delta in
+     * `applyPool.bench.test.ts`). Consumer reads must keep using `get()`,
+     * which is what activates a deferred model.
+     */
+    peek<T extends Model = Model>(id: string): T | undefined;
     /**
      * Look a row up **within one model**.
      *
@@ -226,6 +238,16 @@ export declare class InstanceCache {
      * on later evictions until it is no longer observed.
      */
     private evictOldestBatch;
+    /**
+     * Data-field keys to probe per model, resolved once per model name. Only
+     * stored-value fields can carry bulk; walking the whole instance also
+     * visited the base class's bookkeeping (`_mobxProperties`,
+     * `modifiedProperties`, `validationRules`, …) and JSON-stringified each of
+     * those empty containers on EVERY add — a first-order term of wire-ingest
+     * create apply. Reference/computed keys are deliberately excluded: reading
+     * them would execute their getters.
+     */
+    private sizeProbeKeys;
     private isLargeModel;
     /**
      * Register a foreign key field for indexing on a model type.

package/dist/local/InstanceCache.js

@@ -11,7 +11,7 @@ import { DEFER_MODEL_OBSERVABILITY, Model } from './Model.js';
 import { ModelRegistry } from './ModelRegistry.js';
 import { globalRuntime } from './context.js';
 import { AbloValidationError } from '@abloatai/transaction/errors';
-import { ModelScope } from '@abloatai/transaction/types';
+import { ModelScope, PropertyType } from '@abloatai/transaction/types';
 import { ViewRegistry } from './views/ViewRegistry.js';
 import { QueryView } from './views/QueryView.js';
 // Re-exported so `import { ModelScope } from './InstanceCache.js'` resolves
@@ -21,9 +21,18 @@ export { ModelScope };
  * entity resolves to a single instance.
  */
 export class InstanceCache {
-    // Single source of truth for all models (observable for reactivity)
-    entries = observable.map();
-    typeIndex = observable.map();
+    // Single source of truth for all models (observable for reactivity).
+    // Shallow on purpose, and the reactivity contract depends on it: readers
+    // track MEMBERSHIP (keys), and every entry-level change re-sets the whole
+    // entry (see `updateScope`) — in-place field writes on an entry do not
+    // notify. The deep default additionally converted every stored ModelEntry
+    // into an observable object, a per-add extendObservable/defineProperty
+    // pass that profiled as the single largest term of create-apply on the
+    // wire-ingestion path, bought nothing the contract uses, and meant
+    // `entries.get()` returned a converted wrapper rather than the object
+    // the insert stored.
+    entries = observable.map({}, { deep: false });
+    typeIndex = observable.map({}, { deep: false });
     // Non-observable access time tracking — kept outside observable.map so that
     // updating timestamps in get() during React render does NOT trigger MobX
     // reactions (which would cause infinite re-render loops).
@@ -205,6 +214,37 @@ export class InstanceCache {
         model?.ensureObservable();
         return model ?? undefined;
     }
+    /**
+     * Ingestion-side lookup: resolve a row WITHOUT crossing the consumer
+     * boundary. Same resolution semantics as {@link get} — weak-ref revival,
+     * disposed rows filtered, access recency stamped — but the model is NOT
+     * activated. The delta-apply loop reads every row it updates, and reading
+     * through `get()` made the stream itself install per-field MobX
+     * instrumentation on rows no consumer ever observes; that activation is
+     * the dominant term of apply cost (measured 12.9 vs 2.9 µs/delta in
+     * `applyPool.bench.test.ts`). Consumer reads must keep using `get()`,
+     * which is what activates a deferred model.
+     */
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-parameters
+    peek(id) {
+        const entry = this.entries.get(id);
+        if (!entry)
+            return undefined;
+        let model = entry.model;
+        if (!model && entry.weakRef) {
+            const restoredModel = entry.weakRef.deref();
+            if (!restoredModel)
+                return undefined;
+            model = restoredModel;
+            runInAction(() => {
+                entry.model = restoredModel;
+            });
+        }
+        if (model?.disposed)
+            return undefined;
+        this.touchAccess(id, Date.now());
+        return model ?? undefined;
+    }
     /**
      * Look a row up **within one model**.
      *
@@ -588,6 +628,11 @@ export class InstanceCache {
                 continue;
             const model = this.resolveModel(entry, id);
             if (model && !model.disposed) {
+                // Bulk reads are a consumer boundary: rows land cold from the wire
+                // (delta ingestion applies with `peek` and never activates), so
+                // every read that hands models out must activate them, exactly as
+                // `get()` does. Idempotent — an active row pays one boolean check.
+                model.ensureObservable();
                 result.push(model);
             }
         }
@@ -613,6 +658,8 @@ export class InstanceCache {
                 continue;
             const model = this.resolveModel(entry, id);
             if (model && !model.disposed) {
+                // Consumer boundary — activate, as in getByType.
+                model.ensureObservable();
                 result.push(model);
             }
         }
@@ -1030,14 +1077,37 @@ export class InstanceCache {
             }
         });
     }
+    /**
+     * Data-field keys to probe per model, resolved once per model name. Only
+     * stored-value fields can carry bulk; walking the whole instance also
+     * visited the base class's bookkeeping (`_mobxProperties`,
+     * `modifiedProperties`, `validationRules`, …) and JSON-stringified each of
+     * those empty containers on EVERY add — a first-order term of wire-ingest
+     * create apply. Reference/computed keys are deliberately excluded: reading
+     * them would execute their getters.
+     */
+    sizeProbeKeys = new Map();
     isLargeModel(model) {
         try {
-            // Most synchronized rows contain only short scalars. Serializing the
-            // entire model merely to discover that fact doubled wire-ingest object
-            // walking. Accumulate cheap scalar sizes and serialize only nested
-            // payloads that can plausibly cross the WeakRef threshold.
+            const modelName = model.getModelName();
+            let keys = this.sizeProbeKeys.get(modelName);
+            if (!keys) {
+                const props = this.registry.getProperties(modelName);
+                keys = [...props.entries()]
+                    .filter(([, meta]) => meta.type === PropertyType.property || meta.type === PropertyType.ephemeralProperty)
+                    .map(([key]) => key);
+                this.sizeProbeKeys.set(modelName, keys);
+            }
+            // A model with no registered stored fields (e.g. a custom entity) keeps
+            // the whole-instance walk, since its payload lives outside the schema.
+            const values = keys.length > 0
+                ? keys.map((key) => Reflect.get(model, key))
+                : Object.values(model);
+            // Most synchronized rows contain only short scalars. Accumulate cheap
+            // scalar sizes and serialize only nested payloads that can plausibly
+            // cross the WeakRef threshold.
             let size = 0;
-            for (const value of Object.values(model)) {
+            for (const value of values) {
                 if (typeof value === 'string') {
                     size += value.length;
                 }
@@ -1134,6 +1204,9 @@ export class InstanceCache {
             }
             const model = this.resolveModel(entry, id);
             if (model && !model.disposed) {
+                // Consumer boundary — activate, as in getByType. `hasMany` reads
+                // (`section.blocks`) observe fields off these rows directly.
+                model.ensureObservable();
                 result.push(model);
             }
             else if (model?.disposed) {

package/dist/local/Model.d.ts

@@ -81,6 +81,16 @@ export declare abstract class Model {
     clientId: string;
     /** MobX observable properties storage */
     _mobxProperties: ModelData;
+    /**
+     * True while {@link updateFromData} assigns inbound wire data. The
+     * `observe()` bridge (`mobxSetup.M1`) checks it and skips the forward to
+     * {@link propertyChanged} entirely: hydration writes are not user edits, and
+     * the bridge's work per changed field — a nested action, map bookkeeping,
+     * and a fabricated `updatedAt` stamp — was already being discarded by the
+     * `modifiedProperties` swap in `updateFromData`. The swap stays as the
+     * correctness backstop; this flag removes the cost.
+     */
+    _isHydrating: boolean;
     /** Referenced models cache */
     _referencedModels: Record<string, Model | null>;
     /** Track property changes */

package/dist/local/Model.js

@@ -47,6 +47,16 @@ export class Model {
     clientId;
     /** MobX observable properties storage */
     _mobxProperties = {};
+    /**
+     * True while {@link updateFromData} assigns inbound wire data. The
+     * `observe()` bridge (`mobxSetup.M1`) checks it and skips the forward to
+     * {@link propertyChanged} entirely: hydration writes are not user edits, and
+     * the bridge's work per changed field — a nested action, map bookkeeping,
+     * and a fabricated `updatedAt` stamp — was already being discarded by the
+     * `modifiedProperties` swap in `updateFromData`. The swap stays as the
+     * correctness backstop; this flag removes the cost.
+     */
+    _isHydrating = false;
     /** Referenced models cache */
     _referencedModels = {};
     /** Track property changes */
@@ -594,9 +604,15 @@ export class Model {
         runInAction(() => {
             const originalTracking = this.modifiedProperties;
             this.modifiedProperties = new Map();
-            // No `onWrite` → this call records nothing itself.
-            this.assignFieldsFromData(data);
-            this.modifiedProperties = originalTracking;
+            this._isHydrating = true;
+            try {
+                // No `onWrite` → this call records nothing itself.
+                this.assignFieldsFromData(data);
+            }
+            finally {
+                this._isHydrating = false;
+                this.modifiedProperties = originalTracking;
+            }
         });
         // Mark as persisted if updating existing model
         if (!this._isNew) {

package/dist/local/SyncClient.js

@@ -1579,7 +1579,13 @@ export class SyncClient extends EventEmitter {
             }
             switch (action) {
                 case 'add': {
-                    const existing = this.objectPool.get(modelId);
+                    // `peek`, not `get`: this loop is ingestion, not a consumer read.
+                    // `get()` activates deferred MobX instrumentation, so reading
+                    // through it here made the delta stream itself instrument every
+                    // row it touched — the dominant term of apply cost for rows no
+                    // consumer observes. Activation belongs to the consumer-facing
+                    // reads (`get`, views, subscribers), which are unchanged.
+                    const existing = this.objectPool.peek(modelId);
                     if (existing) {
                         existing.markAsSynced();
                     }
@@ -1594,7 +1600,7 @@ export class SyncClient extends EventEmitter {
                     break;
                 }
                 case 'update': {
-                    const existing = this.objectPool.get(modelId);
+                    const existing = this.objectPool.peek(modelId);
                     if (existing && !existing.disposed && result.data) {
                         enrichRelations(modelName, result.data);
                         const resolved = this.resolveConflicts(existing, result.data);

package/dist/local/sync/deltaPipeline.d.ts

@@ -38,6 +38,7 @@ export interface DeltaPipelineContext {
     readonly smartSyncOptions: {
         readonly batchingDelay: number;
         readonly maxBatchSize: number;
+        readonly applySliceDeltas: number;
     };
     /** Pool-applied cursor (`syncClient.position.applied`). */
     readonly highestProcessedSyncId: number;
@@ -62,7 +63,8 @@ export interface DeltaPipelineContext {
     /** Acknowledges a sync id back to the server; a no-op when the socket is down. */
     acknowledge(syncId: number): void;
     readonly objectPool: {
-        get(id: string): Model | undefined;
+        /** Ingestion-side lookup — resolves without activating observability. */
+        peek(id: string): Model | undefined;
         add(model: Model, scope: ModelScope): void;
         remove(id: string): boolean;
         /** Full in-memory clear — the revocation-failure fallback (see
@@ -114,3 +116,32 @@ export declare function applyDeltaFrame(ctx: DeltaPipelineContext, deltas: SyncD
  * and advances the acknowledgement cursor once the store write has committed.
  */
 export declare function flushPendingDeltas(ctx: DeltaPipelineContext): Promise<void>;
+/**
+ * Wedge forensics: where the pipeline currently is, updated synchronously at
+ * every stage boundary. A hang diagnoses itself by which counter pair
+ * diverged and which phase the active flush froze in. Mirrored onto
+ * `globalThis.__abloPipelineDebug` so a bench watchdog in the same thread
+ * can read it without an import path into SDK internals — diagnostics only,
+ * a handful of numbers, no payload data.
+ */
+export declare const pipelineDebug: {
+    flushesStarted: number;
+    flushesSettled: number;
+    persistsStarted: number;
+    persistsSettled: number;
+    applySlices: number;
+    applyYields: number;
+    enqueued: number;
+    phase: string;
+};
+/**
+ * Split applied changes into slices of at most `maxDeltas`, never splitting a
+ * transaction: consecutive changes sharing a `transactionId` form one
+ * indivisible group (a commit reveals whole), while changes without one are
+ * individually splittable. A single transaction larger than the bound forms
+ * its own oversized slice, so apply always advances rather than stalling on
+ * an oversized commit — the same rule the server's publication chunking uses.
+ */
+export declare function sliceApplyChanges<T extends {
+    readonly transactionId?: string;
+}>(changes: readonly T[], maxDeltas: number): readonly T[][];

package/dist/local/sync/deltaPipeline.js

@@ -199,6 +199,7 @@ export function enqueueDelta(ctx, delta, options = {}) {
     // The delta is accepted and queued — the `receive` stage boundary.
     runStage(ctx.stagePlugins ?? [], 'receive', { delta });
     ctx.pendingDeltas.push(delta);
+    pipelineDebug.enqueued += 1;
     return true;
 }
 /** Debounce a flush for live single-delta traffic. */
@@ -285,6 +286,68 @@ async function drainPendingDeltas(ctx) {
         ctx.batchTimer = null;
     }
 }
+/**
+ * Uninterrupted apply time allowed before the sliced loop yields — the
+ * "no visible stall" bound. Yields are amortized against it because one host
+ * yield costs milliseconds under load; at the measured per-delta apply cost
+ * this works out to roughly one yield per one to two 600-delta slices.
+ */
+const APPLY_YIELD_BUDGET_MS = 12;
+/**
+ * Wedge forensics: where the pipeline currently is, updated synchronously at
+ * every stage boundary. A hang diagnoses itself by which counter pair
+ * diverged and which phase the active flush froze in. Mirrored onto
+ * `globalThis.__abloPipelineDebug` so a bench watchdog in the same thread
+ * can read it without an import path into SDK internals — diagnostics only,
+ * a handful of numbers, no payload data.
+ */
+export const pipelineDebug = {
+    flushesStarted: 0,
+    flushesSettled: 0,
+    persistsStarted: 0,
+    persistsSettled: 0,
+    applySlices: 0,
+    applyYields: 0,
+    enqueued: 0,
+    phase: 'idle',
+};
+globalThis.__abloPipelineDebug =
+    pipelineDebug;
+/**
+ * Split applied changes into slices of at most `maxDeltas`, never splitting a
+ * transaction: consecutive changes sharing a `transactionId` form one
+ * indivisible group (a commit reveals whole), while changes without one are
+ * individually splittable. A single transaction larger than the bound forms
+ * its own oversized slice, so apply always advances rather than stalling on
+ * an oversized commit — the same rule the server's publication chunking uses.
+ */
+export function sliceApplyChanges(changes, maxDeltas) {
+    if (changes.length <= maxDeltas)
+        return changes.length > 0 ? [[...changes]] : [];
+    const slices = [];
+    let current = [];
+    let index = 0;
+    while (index < changes.length) {
+        // The indivisible unit starting here: one transaction's run, or a single
+        // untransacted change.
+        const transactionId = changes[index].transactionId;
+        let end = index + 1;
+        if (transactionId !== undefined) {
+            while (end < changes.length && changes[end].transactionId === transactionId)
+                end += 1;
+        }
+        const groupSize = end - index;
+        if (current.length > 0 && current.length + groupSize > maxDeltas) {
+            slices.push(current);
+            current = [];
+        }
+        current.push(...changes.slice(index, end));
+        index = end;
+    }
+    if (current.length > 0)
+        slices.push(current);
+    return slices;
+}
 function yieldToHost() {
     const immediate = globalThis.setImmediate;
     return new Promise((resolve) => {
@@ -296,15 +359,19 @@ function yieldToHost() {
 }
 async function flushDeltaBatch(ctx, queuedDeltas) {
     openDrainBatchRow(queuedDeltas.length);
+    pipelineDebug.flushesStarted += 1;
     try {
         await flushDeltaBatchInner(ctx, queuedDeltas);
     }
     finally {
+        pipelineDebug.flushesSettled += 1;
+        pipelineDebug.phase = 'idle';
         closeDrainBatchRow();
     }
 }
 async function flushDeltaBatchInner(ctx, queuedDeltas) {
     const stagePlugins = ctx.stagePlugins ?? [];
+    pipelineDebug.phase = 'dedupe';
     const deduplicatedDeltas = timeDrainStage('dedupe', () => ctx.deduplicateDeltas(queuedDeltas));
     observeDrainBatch(queuedDeltas.length, deduplicatedDeltas.length);
     runStage(stagePlugins, 'dedupe', { deltas: deduplicatedDeltas });
@@ -320,7 +387,7 @@ async function flushDeltaBatchInner(ctx, queuedDeltas) {
                 // gained permission to see the entity, so we insert it into the
                 // pool as if newly created.
                 if (delta.actionType === 'I' || delta.actionType === 'U' || delta.actionType === 'C') {
-                    const existing = ctx.objectPool.get(delta.modelId);
+                    const existing = ctx.objectPool.peek(delta.modelId);
                     if (existing) {
                         existing.updateFromData(data);
                     }
@@ -343,6 +410,8 @@ async function flushDeltaBatchInner(ctx, queuedDeltas) {
     // handleGroupRemoved) and never reach here, though the persistence
     // signature accepts them defensively.
     const regularDeltas = deduplicatedDeltas.filter((d) => !ctx.isCustomEntity(d.modelName));
+    pipelineDebug.phase = 'persist';
+    pipelineDebug.persistsStarted += 1;
     const batch = await timeDrainStageAsync('persist', () => ctx.processDeltaBatch(regularDeltas.map((d) => ({
         syncId: d.id,
         actionType: d.actionType,
@@ -353,6 +422,7 @@ async function flushDeltaBatchInner(ctx, queuedDeltas) {
         // echoes of locally-applied transactions and skip the pool mutation.
         transactionId: d.transactionId,
     }))));
+    pipelineDebug.persistsSettled += 1;
     const dbResults = batch.results;
     runStage(stagePlugins, 'persist', { deltas: regularDeltas });
     // Apply the batch results to the in-memory graph. When a plugin has
@@ -360,14 +430,42 @@ async function flushDeltaBatchInner(ctx, queuedDeltas) {
     // materialiser attached where it said it would. The direct call is the
     // bridge for stores constructed without plugins (subclasses, tests),
     // whose own apply is the whole pipeline.
-    timeDrainStage('apply', () => {
-        if (pluginsForStage(stagePlugins, 'apply').length > 0) {
-            runStage(stagePlugins, 'apply', { changes: dbResults });
-        }
-        else {
-            ctx.applyDeltaBatchToPool(dbResults);
+    //
+    // Large batches apply in TIME SLICES: split at transaction boundaries into
+    // bounded chunks with the event loop yielded between them, so a catch-up
+    // wave reveals commit-by-commit instead of holding the thread for one long
+    // synchronous block. Each slice is still one MobX action (reactions fire
+    // once per slice), and a transaction never splits across slices — the
+    // commit remains the atomic unit of visibility.
+    const slices = sliceApplyChanges(dbResults, ctx.smartSyncOptions.applySliceDeltas);
+    await timeDrainStageAsync('apply', async () => {
+        const hasApplyPlugins = pluginsForStage(stagePlugins, 'apply').length > 0;
+        // Yield on a TIME budget, not per slice: a host yield costs milliseconds
+        // under load (measured ~7x throughput collapse when yielding every few
+        // deltas), so the yield decision amortizes it — only after the budget of
+        // uninterrupted apply work has been spent, and never before the first
+        // slice. Slices stay the atomicity unit; the budget only decides where
+        // the loop breathes.
+        let sliceStartedAt = performance.now();
+        for (let index = 0; index < slices.length; index++) {
+            if (index > 0 && performance.now() - sliceStartedAt > APPLY_YIELD_BUDGET_MS) {
+                pipelineDebug.phase = `apply-yield-${index}`;
+                pipelineDebug.applyYields += 1;
+                await yieldToHost();
+                sliceStartedAt = performance.now();
+            }
+            pipelineDebug.phase = `apply-slice-${index}`;
+            pipelineDebug.applySlices += 1;
+            const slice = slices[index];
+            if (hasApplyPlugins) {
+                runStage(stagePlugins, 'apply', { changes: slice });
+            }
+            else {
+                ctx.applyDeltaBatchToPool(slice);
+            }
         }
     });
+    pipelineDebug.phase = 'acknowledge';
     // Acknowledge and advance the sync cursor, gated on persistence.
     //
     // We must acknowledge `persistedSyncId` — the high-water mark of deltas whose

package/dist/local/transactions/mutations/MutationQueue.js

@@ -419,11 +419,19 @@ export class MutationQueue extends EventEmitter {
         const notificationsByTarget = new Map();
         let holdsEntireBatch = false;
         for (const notification of notifications) {
-            const candidates = targets.filter((target) => target.id === notification.id);
-            const notificationKey = this.receiptTargetKey(notification.model, notification.id);
+            // Scope is decided before any target matching. A group premise fires over
+            // the WHOLE batch by convention, and its `target` now names the row that
+            // actually moved — which may well be a row this batch is writing, so
+            // matching first would misread a batch-wide hold as a per-row one.
+            if (notification.scope === 'group') {
+                holdsEntireBatch = true;
+                continue;
+            }
+            const candidates = targets.filter((target) => target.id === notification.target.id);
+            const notificationKey = this.receiptTargetKey(notification.target.model, notification.target.id);
             const exactTargets = candidates.filter((target) => target.key === notificationKey);
             const candidateKeys = new Set((exactTargets.length > 0 ? exactTargets : candidates).map((target) => target.key));
-            if (notification.group || candidates.length === 0) {
+            if (candidates.length === 0) {
                 holdsEntireBatch = true;
                 continue;
             }

package/dist/local/utils/mobxSetup.d.ts

@@ -16,6 +16,7 @@ import { type PropertyMetadata, type ReferenceMetadata } from '@abloatai/transac
 interface M1Target {
     _hasCustomObservability?: boolean;
     _isConstructing?: boolean;
+    _isHydrating?: boolean;
     _extraMobxAnnotations?: Record<string, AnnotationMapEntry>;
     setupObservability?(): void;
     propertyChanged?(name: string, oldValue: unknown, newValue: unknown): void;

package/dist/local/utils/mobxSetup.js

@@ -245,6 +245,11 @@ export function M1(target, propertyMetadata, referenceMetadata) {
                             // would otherwise spuriously fill `modifiedProperties`.
                             if (target._isConstructing)
                                 return;
+                            // Hydration writes (`updateFromData`) are inbound wire data,
+                            // not user edits: the forward's result is discarded by the
+                            // `modifiedProperties` swap anyway, so skip the work.
+                            if (target._isHydrating)
+                                return;
                             if (typeof target.propertyChanged === 'function') {
                                 target.propertyChanged(propName, change.oldValue, change.newValue);
                             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abloatai/humans",
-  "version": "0.39.0",
+  "version": "0.41.0",
   "description": "The optional human-facing local-state package for Ablo: presence, live queries, and React bindings.",
   "license": "Apache-2.0",
   "type": "module",
@@ -84,7 +84,7 @@
     "directory": "packages/humans"
   },
   "dependencies": {
-    "@abloatai/transaction": "^0.39.0",
+    "@abloatai/transaction": "^0.41.0",
     "mobx": "^6.13.7",
     "uuid": "^11.1.0",
     "zod": "^4.4.3"

package/src/local/BaseSyncedStore.ts

@@ -187,12 +187,30 @@ export interface SmartSyncOptions {
   maxBootstrapSize?: number;
   batchingDelay?: number;
   maxBatchSize?: number;
+  /**
+   * Upper bound on deltas revealed per apply slice. A large flush batch is
+   * split at TRANSACTION boundaries into slices of at most this many deltas,
+   * with the event loop yielded between slices, so a catch-up wave never
+   * holds the thread for one long synchronous apply. A transaction larger
+   * than the bound still applies whole — the commit stays the atomic unit of
+   * visibility. `Infinity` restores single-slice behavior.
+   */
+  applySliceDeltas?: number;
 }
 
 // RehydrationStats is defined alongside the bootstrap-apply path and is
 // re-exported here.
 export type { RehydrationStats } from './sync/bootstrapApply.js';
 
+/** Bench-diagnostic slice-bound override; absent everywhere but the bench. */
+function benchApplySliceOverride(): number | undefined {
+  const host = globalThis as { process?: { env?: Record<string, string | undefined> } };
+  const raw = host.process?.env?.ABLO_APPLY_SLICE_DELTAS;
+  if (!raw) return undefined;
+  const value = Number(raw);
+  return Number.isFinite(value) && value > 0 ? value : undefined;
+}
+
 /**
  * Bootstrap retry configuration.
  *
@@ -652,6 +670,18 @@ export class BaseSyncedStore<
       // trickle just as well and keeps burst tails inside the drain budget.
       batchingDelay: 10,
       maxBatchSize: 50,
+      // ~600 deltas ≈ 9 to 14 ms of apply — inside a no-visible-stall
+      // budget, and a full 500-op commit reveals in one slice. The yield
+      // itself is TIME-budgeted in the pipeline (one or two yields per
+      // batch), because a host yield costs milliseconds under load.
+      // History: the "sliced-apply wedge" that briefly held this at
+      // Infinity was kernel memory limits against the bench's many-isolate
+      // process (semispace commits refused at stock max_map_count /
+      // CommitLimit), not this pipeline — with the limits raised, the
+      // sliced path ran the full certification load with zero errors and
+      // cut writer ack latency threefold. `ABLO_APPLY_SLICE_DELTAS` remains
+      // the bench-diagnostic override.
+      applySliceDeltas: benchApplySliceOverride() ?? 600,
     };
 
     // Create internal helpers

package/src/local/InstanceCache.ts

@@ -13,7 +13,7 @@ import { ModelRegistry } from './ModelRegistry.js';
 import { globalRuntime } from './context.js';
 import type { RuntimeContext } from './RuntimeContext.js';
 import { AbloValidationError } from '@abloatai/transaction/errors';
-import { ModelScope } from '@abloatai/transaction/types';
+import { ModelScope, PropertyType } from '@abloatai/transaction/types';
 import { ViewRegistry } from './views/ViewRegistry.js';
 import { QueryView, type QueryViewOptions } from './views/QueryView.js';
 
@@ -48,9 +48,18 @@ interface DeltaInfo {
  * entity resolves to a single instance.
  */
 export class InstanceCache {
-  // Single source of truth for all models (observable for reactivity)
-  private entries = observable.map<string, ModelEntry>();
-  private typeIndex = observable.map<string, Set<string>>();
+  // Single source of truth for all models (observable for reactivity).
+  // Shallow on purpose, and the reactivity contract depends on it: readers
+  // track MEMBERSHIP (keys), and every entry-level change re-sets the whole
+  // entry (see `updateScope`) — in-place field writes on an entry do not
+  // notify. The deep default additionally converted every stored ModelEntry
+  // into an observable object, a per-add extendObservable/defineProperty
+  // pass that profiled as the single largest term of create-apply on the
+  // wire-ingestion path, bought nothing the contract uses, and meant
+  // `entries.get()` returned a converted wrapper rather than the object
+  // the insert stored.
+  private entries = observable.map<string, ModelEntry>({}, { deep: false });
+  private typeIndex = observable.map<string, Set<string>>({}, { deep: false });
 
   // Non-observable access time tracking — kept outside observable.map so that
   // updating timestamps in get() during React render does NOT trigger MobX
@@ -272,6 +281,38 @@ export class InstanceCache {
     return model ?? undefined;
   }
 
+  /**
+   * Ingestion-side lookup: resolve a row WITHOUT crossing the consumer
+   * boundary. Same resolution semantics as {@link get} — weak-ref revival,
+   * disposed rows filtered, access recency stamped — but the model is NOT
+   * activated. The delta-apply loop reads every row it updates, and reading
+   * through `get()` made the stream itself install per-field MobX
+   * instrumentation on rows no consumer ever observes; that activation is
+   * the dominant term of apply cost (measured 12.9 vs 2.9 µs/delta in
+   * `applyPool.bench.test.ts`). Consumer reads must keep using `get()`,
+   * which is what activates a deferred model.
+   */
+  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-parameters
+  peek<T extends Model = Model>(id: string): T | undefined {
+    const entry = this.entries.get(id);
+    if (!entry) return undefined;
+
+    let model = entry.model as T | undefined;
+    if (!model && entry.weakRef) {
+      const restoredModel = entry.weakRef.deref();
+      if (!restoredModel) return undefined;
+      model = restoredModel as T;
+      runInAction(() => {
+        entry.model = restoredModel;
+      });
+    }
+
+    if (model?.disposed) return undefined;
+
+    this.touchAccess(id, Date.now());
+    return model ?? undefined;
+  }
+
   /**
    * Look a row up **within one model**.
    *
@@ -720,6 +761,11 @@ export class InstanceCache {
 
       const model = this.resolveModel(entry, id);
       if (model && !model.disposed) {
+        // Bulk reads are a consumer boundary: rows land cold from the wire
+        // (delta ingestion applies with `peek` and never activates), so
+        // every read that hands models out must activate them, exactly as
+        // `get()` does. Idempotent — an active row pays one boolean check.
+        model.ensureObservable();
         result.push(model);
       }
     }
@@ -747,6 +793,8 @@ export class InstanceCache {
 
       const model = this.resolveModel(entry, id);
       if (model && !model.disposed) {
+        // Consumer boundary — activate, as in getByType.
+        model.ensureObservable();
         result.push(model);
       }
     }
@@ -1272,14 +1320,39 @@ export class InstanceCache {
     });
   }
 
+  /**
+   * Data-field keys to probe per model, resolved once per model name. Only
+   * stored-value fields can carry bulk; walking the whole instance also
+   * visited the base class's bookkeeping (`_mobxProperties`,
+   * `modifiedProperties`, `validationRules`, …) and JSON-stringified each of
+   * those empty containers on EVERY add — a first-order term of wire-ingest
+   * create apply. Reference/computed keys are deliberately excluded: reading
+   * them would execute their getters.
+   */
+  private sizeProbeKeys = new Map<string, readonly string[]>();
+
   private isLargeModel(model: Model): boolean {
     try {
-      // Most synchronized rows contain only short scalars. Serializing the
-      // entire model merely to discover that fact doubled wire-ingest object
-      // walking. Accumulate cheap scalar sizes and serialize only nested
-      // payloads that can plausibly cross the WeakRef threshold.
+      const modelName = model.getModelName();
+      let keys = this.sizeProbeKeys.get(modelName);
+      if (!keys) {
+        const props = this.registry.getProperties(modelName);
+        keys = [...props.entries()]
+          .filter(([, meta]) => meta.type === PropertyType.property || meta.type === PropertyType.ephemeralProperty)
+          .map(([key]) => key);
+        this.sizeProbeKeys.set(modelName, keys);
+      }
+      // A model with no registered stored fields (e.g. a custom entity) keeps
+      // the whole-instance walk, since its payload lives outside the schema.
+      const values: Iterable<unknown> = keys.length > 0
+        ? keys.map((key): unknown => Reflect.get(model, key))
+        : Object.values(model);
+
+      // Most synchronized rows contain only short scalars. Accumulate cheap
+      // scalar sizes and serialize only nested payloads that can plausibly
+      // cross the WeakRef threshold.
       let size = 0;
-      for (const value of Object.values(model)) {
+      for (const value of values) {
         if (typeof value === 'string') {
           size += value.length;
         } else if (
@@ -1375,6 +1448,9 @@ export class InstanceCache {
       if (!this.matchesScope(entry.scope, ModelScope.live)) { droppedScope++; continue; }
       const model = this.resolveModel(entry, id);
       if (model && !model.disposed) {
+        // Consumer boundary — activate, as in getByType. `hasMany` reads
+        // (`section.blocks`) observe fields off these rows directly.
+        model.ensureObservable();
         result.push(model);
       } else if (model?.disposed) {
         droppedDisposed++;

package/src/local/Model.ts

@@ -121,6 +121,17 @@ export abstract class Model {
   /** MobX observable properties storage */
   _mobxProperties: ModelData = {};
 
+  /**
+   * True while {@link updateFromData} assigns inbound wire data. The
+   * `observe()` bridge (`mobxSetup.M1`) checks it and skips the forward to
+   * {@link propertyChanged} entirely: hydration writes are not user edits, and
+   * the bridge's work per changed field — a nested action, map bookkeeping,
+   * and a fabricated `updatedAt` stamp — was already being discarded by the
+   * `modifiedProperties` swap in `updateFromData`. The swap stays as the
+   * correctness backstop; this flag removes the cost.
+   */
+  _isHydrating = false;
+
   /** Referenced models cache */
   _referencedModels: Record<string, Model | null> = {};
 
@@ -721,11 +732,14 @@ export abstract class Model {
     runInAction(() => {
       const originalTracking = this.modifiedProperties;
       this.modifiedProperties = new Map();
-
-      // No `onWrite` → this call records nothing itself.
-      this.assignFieldsFromData(data);
-
-      this.modifiedProperties = originalTracking;
+      this._isHydrating = true;
+      try {
+        // No `onWrite` → this call records nothing itself.
+        this.assignFieldsFromData(data);
+      } finally {
+        this._isHydrating = false;
+        this.modifiedProperties = originalTracking;
+      }
     });
 
     // Mark as persisted if updating existing model

package/src/local/SyncClient.ts

@@ -1812,6 +1812,7 @@ export class SyncClient extends EventEmitter {
     return this.mutationQueue.confirmationFor(modelName, modelId);
   }
 
+
   /**
    * Get detailed debug info for the sync debug page
    */
@@ -1950,7 +1951,13 @@ export class SyncClient extends EventEmitter {
 
       switch (action) {
         case 'add': {
-          const existing = this.objectPool.get(modelId);
+          // `peek`, not `get`: this loop is ingestion, not a consumer read.
+          // `get()` activates deferred MobX instrumentation, so reading
+          // through it here made the delta stream itself instrument every
+          // row it touched — the dominant term of apply cost for rows no
+          // consumer observes. Activation belongs to the consumer-facing
+          // reads (`get`, views, subscribers), which are unchanged.
+          const existing = this.objectPool.peek(modelId);
           if (existing) {
             existing.markAsSynced();
           } else if (result.data) {
@@ -1963,7 +1970,7 @@ export class SyncClient extends EventEmitter {
           break;
         }
         case 'update': {
-          const existing = this.objectPool.get(modelId);
+          const existing = this.objectPool.peek(modelId);
           if (existing && !existing.disposed && result.data) {
             enrichRelations(modelName, result.data);
             const resolved = this.resolveConflicts(existing, result.data);

package/src/local/sync/deltaPipeline.ts

@@ -53,7 +53,11 @@ export interface DeltaPipelineContext {
   batchTimer: ReturnType<typeof setTimeout> | null;
   /** Queue for deltas arriving during an active bootstrap; null when none. */
   readonly bootstrapDeltaQueue: SyncDelta[] | null;
-  readonly smartSyncOptions: { readonly batchingDelay: number; readonly maxBatchSize: number };
+  readonly smartSyncOptions: {
+    readonly batchingDelay: number;
+    readonly maxBatchSize: number;
+    readonly applySliceDeltas: number;
+  };
   /** Pool-applied cursor (`syncClient.position.applied`). */
   readonly highestProcessedSyncId: number;
   /** Resume/ack cursor (`syncClient.position.persisted`). */
@@ -86,7 +90,8 @@ export interface DeltaPipelineContext {
 
   // ── Custom-entity pool ops (deltas that skip the local store) ──
   readonly objectPool: {
-    get(id: string): Model | undefined;
+    /** Ingestion-side lookup — resolves without activating observability. */
+    peek(id: string): Model | undefined;
     add(model: Model, scope: ModelScope): void;
     remove(id: string): boolean;
     /** Full in-memory clear — the revocation-failure fallback (see
@@ -312,6 +317,7 @@ export function enqueueDelta(
   // The delta is accepted and queued — the `receive` stage boundary.
   runStage(ctx.stagePlugins ?? [], 'receive', { delta });
   ctx.pendingDeltas.push(delta);
+  pipelineDebug.enqueued += 1;
   return true;
 }
 
@@ -400,6 +406,71 @@ async function drainPendingDeltas(ctx: DeltaPipelineContext): Promise<void> {
   }
 }
 
+/**
+ * Uninterrupted apply time allowed before the sliced loop yields — the
+ * "no visible stall" bound. Yields are amortized against it because one host
+ * yield costs milliseconds under load; at the measured per-delta apply cost
+ * this works out to roughly one yield per one to two 600-delta slices.
+ */
+const APPLY_YIELD_BUDGET_MS = 12;
+
+/**
+ * Wedge forensics: where the pipeline currently is, updated synchronously at
+ * every stage boundary. A hang diagnoses itself by which counter pair
+ * diverged and which phase the active flush froze in. Mirrored onto
+ * `globalThis.__abloPipelineDebug` so a bench watchdog in the same thread
+ * can read it without an import path into SDK internals — diagnostics only,
+ * a handful of numbers, no payload data.
+ */
+export const pipelineDebug = {
+  flushesStarted: 0,
+  flushesSettled: 0,
+  persistsStarted: 0,
+  persistsSettled: 0,
+  applySlices: 0,
+  applyYields: 0,
+  enqueued: 0,
+  phase: 'idle' as string,
+};
+(globalThis as { __abloPipelineDebug?: typeof pipelineDebug }).__abloPipelineDebug =
+  pipelineDebug;
+
+/**
+ * Split applied changes into slices of at most `maxDeltas`, never splitting a
+ * transaction: consecutive changes sharing a `transactionId` form one
+ * indivisible group (a commit reveals whole), while changes without one are
+ * individually splittable. A single transaction larger than the bound forms
+ * its own oversized slice, so apply always advances rather than stalling on
+ * an oversized commit — the same rule the server's publication chunking uses.
+ */
+export function sliceApplyChanges<T extends { readonly transactionId?: string }>(
+  changes: readonly T[],
+  maxDeltas: number,
+): readonly T[][] {
+  if (changes.length <= maxDeltas) return changes.length > 0 ? [[...changes]] : [];
+  const slices: T[][] = [];
+  let current: T[] = [];
+  let index = 0;
+  while (index < changes.length) {
+    // The indivisible unit starting here: one transaction's run, or a single
+    // untransacted change.
+    const transactionId = changes[index]!.transactionId;
+    let end = index + 1;
+    if (transactionId !== undefined) {
+      while (end < changes.length && changes[end]!.transactionId === transactionId) end += 1;
+    }
+    const groupSize = end - index;
+    if (current.length > 0 && current.length + groupSize > maxDeltas) {
+      slices.push(current);
+      current = [];
+    }
+    current.push(...changes.slice(index, end));
+    index = end;
+  }
+  if (current.length > 0) slices.push(current);
+  return slices;
+}
+
 function yieldToHost(): Promise<void> {
   const immediate = (
     globalThis as {
@@ -417,9 +488,12 @@ async function flushDeltaBatch(
   queuedDeltas: SyncDelta[],
 ): Promise<void> {
   openDrainBatchRow(queuedDeltas.length);
+  pipelineDebug.flushesStarted += 1;
   try {
     await flushDeltaBatchInner(ctx, queuedDeltas);
   } finally {
+    pipelineDebug.flushesSettled += 1;
+    pipelineDebug.phase = 'idle';
     closeDrainBatchRow();
   }
 }
@@ -429,6 +503,7 @@ async function flushDeltaBatchInner(
   queuedDeltas: SyncDelta[],
 ): Promise<void> {
   const stagePlugins = ctx.stagePlugins ?? [];
+  pipelineDebug.phase = 'dedupe';
   const deduplicatedDeltas = timeDrainStage('dedupe', () => ctx.deduplicateDeltas(queuedDeltas));
   observeDrainBatch(queuedDeltas.length, deduplicatedDeltas.length);
   runStage(stagePlugins, 'dedupe', { deltas: deduplicatedDeltas });
@@ -446,7 +521,7 @@ async function flushDeltaBatchInner(
         // gained permission to see the entity, so we insert it into the
         // pool as if newly created.
         if (delta.actionType === 'I' || delta.actionType === 'U' || delta.actionType === 'C') {
-          const existing = ctx.objectPool.get(delta.modelId);
+          const existing = ctx.objectPool.peek(delta.modelId);
           if (existing) {
             existing.updateFromData(data);
           } else {
@@ -465,6 +540,8 @@ async function flushDeltaBatchInner(
   // handleGroupRemoved) and never reach here, though the persistence
   // signature accepts them defensively.
   const regularDeltas = deduplicatedDeltas.filter((d) => !ctx.isCustomEntity(d.modelName));
+  pipelineDebug.phase = 'persist';
+  pipelineDebug.persistsStarted += 1;
   const batch = await timeDrainStageAsync('persist', () =>
     ctx.processDeltaBatch(
       regularDeltas.map((d) => ({
@@ -479,6 +556,7 @@ async function flushDeltaBatchInner(
       }))
     )
   );
+  pipelineDebug.persistsSettled += 1;
   const dbResults = batch.results;
   runStage(stagePlugins, 'persist', { deltas: regularDeltas });
 
@@ -487,13 +565,41 @@ async function flushDeltaBatchInner(
   // materialiser attached where it said it would. The direct call is the
   // bridge for stores constructed without plugins (subclasses, tests),
   // whose own apply is the whole pipeline.
-  timeDrainStage('apply', () => {
-    if (pluginsForStage(stagePlugins, 'apply').length > 0) {
-      runStage(stagePlugins, 'apply', { changes: dbResults });
-    } else {
-      ctx.applyDeltaBatchToPool(dbResults);
+  //
+  // Large batches apply in TIME SLICES: split at transaction boundaries into
+  // bounded chunks with the event loop yielded between them, so a catch-up
+  // wave reveals commit-by-commit instead of holding the thread for one long
+  // synchronous block. Each slice is still one MobX action (reactions fire
+  // once per slice), and a transaction never splits across slices — the
+  // commit remains the atomic unit of visibility.
+  const slices = sliceApplyChanges(dbResults, ctx.smartSyncOptions.applySliceDeltas);
+  await timeDrainStageAsync('apply', async () => {
+    const hasApplyPlugins = pluginsForStage(stagePlugins, 'apply').length > 0;
+    // Yield on a TIME budget, not per slice: a host yield costs milliseconds
+    // under load (measured ~7x throughput collapse when yielding every few
+    // deltas), so the yield decision amortizes it — only after the budget of
+    // uninterrupted apply work has been spent, and never before the first
+    // slice. Slices stay the atomicity unit; the budget only decides where
+    // the loop breathes.
+    let sliceStartedAt = performance.now();
+    for (let index = 0; index < slices.length; index++) {
+      if (index > 0 && performance.now() - sliceStartedAt > APPLY_YIELD_BUDGET_MS) {
+        pipelineDebug.phase = `apply-yield-${index}`;
+        pipelineDebug.applyYields += 1;
+        await yieldToHost();
+        sliceStartedAt = performance.now();
+      }
+      pipelineDebug.phase = `apply-slice-${index}`;
+      pipelineDebug.applySlices += 1;
+      const slice = slices[index]!;
+      if (hasApplyPlugins) {
+        runStage(stagePlugins, 'apply', { changes: slice });
+      } else {
+        ctx.applyDeltaBatchToPool(slice);
+      }
     }
   });
+  pipelineDebug.phase = 'acknowledge';
 
   // Acknowledge and advance the sync cursor, gated on persistence.
   //

package/src/local/transactions/mutations/MutationQueue.ts

@@ -647,10 +647,20 @@ export class MutationQueue extends EventEmitter {
     let holdsEntireBatch = false;
 
     for (const notification of notifications) {
-      const candidates = targets.filter((target) => target.id === notification.id);
+      // Scope is decided before any target matching. A group premise fires over
+      // the WHOLE batch by convention, and its `target` now names the row that
+      // actually moved — which may well be a row this batch is writing, so
+      // matching first would misread a batch-wide hold as a per-row one.
+      if (notification.scope === 'group') {
+        holdsEntireBatch = true;
+        continue;
+      }
+      const candidates = targets.filter(
+        (target) => target.id === notification.target.id,
+      );
       const notificationKey = this.receiptTargetKey(
-        notification.model,
-        notification.id,
+        notification.target.model,
+        notification.target.id,
       );
       const exactTargets = candidates.filter(
         (target) => target.key === notificationKey,
@@ -661,7 +671,7 @@ export class MutationQueue extends EventEmitter {
         ),
       );
 
-      if (notification.group || candidates.length === 0) {
+      if (candidates.length === 0) {
         holdsEntireBatch = true;
         continue;
       }

package/src/local/utils/mobxSetup.ts

@@ -27,6 +27,7 @@ import { getContext } from '../context.js';
 interface M1Target {
   _hasCustomObservability?: boolean;
   _isConstructing?: boolean;
+  _isHydrating?: boolean;
   _extraMobxAnnotations?: Record<string, AnnotationMapEntry>;
   setupObservability?(): void;
   propertyChanged?(name: string, oldValue: unknown, newValue: unknown): void;
@@ -282,6 +283,10 @@ export function M1<T extends M1Target>(
               // pre-construct models with partial data then bulk-assign
               // would otherwise spuriously fill `modifiedProperties`.
               if (target._isConstructing) return;
+              // Hydration writes (`updateFromData`) are inbound wire data,
+              // not user edits: the forward's result is discarded by the
+              // `modifiedProperties` swap anyway, so skip the work.
+              if (target._isHydrating) return;
               if (typeof target.propertyChanged === 'function') {
                 target.propertyChanged(
                   propName,