@abloatai/humans 0.45.0 → 0.47.0

package/dist/local/transactions/mutations/failureHandling.js

@@ -1,5 +1,17 @@
 import { AbloError } from '@abloatai/transaction/errors';
 import { extractStatusCode } from './commitPayload.js';
+export function transientRetryDelayMs(error, attempt, retryBackoff) {
+    const { baseMs, capMs } = retryBackoff;
+    let base = baseMs;
+    try {
+        const status = extractStatusCode(error);
+        if (status === 429 || status === 503)
+            base = Math.max(baseMs, 1_000);
+    }
+    catch { }
+    const ceiling = Math.min(capMs, base * Math.pow(2, Math.max(0, attempt - 1)));
+    return Math.floor(Math.random() * ceiling);
+}
 export async function handleFailure(ctx, transaction, error) {
     transaction.attempts++;
     // Check whether this is a permanent error that should not be retried.
@@ -89,28 +101,21 @@ export async function handleFailure(ctx, transaction, error) {
             await ctx.rollbackOptimistic(transaction, 'permanent_error', error);
         }
         ctx.emit('transaction:failed', { transaction, error, permanent: true });
-        // The id-suffixed event is what `waitForConfirmation` (the
-        // `wait:'confirmed'` path) listens on — without it a permanently
+        // The id-suffixed event is what the awaited model-write promise listens
+        // on through `waitForConfirmation` — without it a permanently
         // rejected write left the caller's promise hanging forever.
         ctx.emit(`transaction:failed:${transaction.id}`, { error });
         return;
     }
-    if (transaction.attempts < ctx.config.maxRetries) {
+    transaction.firstTransientFailureAt ??= Date.now();
+    const insideAvailabilityWindow = Date.now() - transaction.firstTransientFailureAt < ctx.config.availabilityRetryWindowMs;
+    if (transaction.attempts < ctx.config.maxRetries || insideAvailabilityWindow) {
         // Exponential backoff with full jitter on every transient retry:
         // `sleep = random(0, min(cap, base * 2^attempt))`. Throttling responses
         // (429/503) use a longer base than other transient errors. The re-enqueue
         // is scheduled rather than awaited, so one backing-off transaction cannot
         // stall unrelated commits.
-        const { baseMs, capMs } = ctx.config.retryBackoff;
-        let base = baseMs;
-        try {
-            const status = extractStatusCode(error);
-            if (status === 429 || status === 503)
-                base = Math.max(baseMs, 1_000);
-        }
-        catch { }
-        const ceiling = Math.min(capMs, base * Math.pow(2, transaction.attempts - 1));
-        const delay = Math.floor(Math.random() * ceiling);
+        const delay = transientRetryDelayMs(error, transaction.attempts, ctx.config.retryBackoff);
         ctx.store.updateStatus(transaction.id, 'pending');
         setTimeout(() => {
             // The queue may have shut down or the tx may have been settled

package/dist/surface.d.ts

@@ -30,7 +30,7 @@ export declare const PUBLIC_LIST_OPTION_KEYS: readonly ["where", "filter", "orde
  * The keys of the client constructor options, {@link AbloOptions}. Only
  * `schema` is required; every other key is optional.
  */
-export declare const PUBLIC_ABLO_OPTION_KEYS: readonly ["schema", "apiKey", "authEndpoint", "authTimeoutMs", "allowCrossOriginAuthEndpoint", "persistence", "durableWrites", "commitOutbox", "commitOutboxScope", "debug", "logLevel", "logger", "authToken", "baseURL", "fetch", "defaultHeaders", "defaultQuery", "dangerouslyAllowBrowser", "collaborationEvents", "plugins", "wait"];
+export declare const PUBLIC_ABLO_OPTION_KEYS: readonly ["schema", "apiKey", "projectId", "branchId", "authEndpoint", "authTimeoutMs", "allowCrossOriginAuthEndpoint", "persistence", "durableWrites", "commitOutbox", "commitOutboxScope", "debug", "logLevel", "logger", "authToken", "baseURL", "fetch", "defaultHeaders", "defaultQuery", "dangerouslyAllowBrowser", "collaborationEvents", "plugins"];
 export type ModelVerb = (typeof PUBLIC_MODEL_VERBS)[number];
 export type ListOptionKey = (typeof PUBLIC_LIST_OPTION_KEYS)[number];
 export type AbloOptionKey = (typeof PUBLIC_ABLO_OPTION_KEYS)[number];

package/dist/surface.js

@@ -55,6 +55,8 @@ export const PUBLIC_LIST_OPTION_KEYS = [
 export const PUBLIC_ABLO_OPTION_KEYS = [
     'schema',
     'apiKey',
+    'projectId',
+    'branchId',
     'authEndpoint',
     'authTimeoutMs',
     'allowCrossOriginAuthEndpoint',
@@ -73,5 +75,4 @@ export const PUBLIC_ABLO_OPTION_KEYS = [
     'dangerouslyAllowBrowser',
     'collaborationEvents',
     'plugins',
-    'wait',
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abloatai/humans",
-  "version": "0.45.0",
+  "version": "0.47.0",
   "description": "The optional human-facing local-state package for Ablo: presence, live queries, and React bindings.",
   "license": "Apache-2.0",
   "type": "module",
@@ -84,7 +84,7 @@
     "directory": "packages/humans"
   },
   "dependencies": {
-    "@abloatai/transaction": "^0.45.0",
+    "@abloatai/transaction": "^0.47.0",
     "mobx": "^6.13.7",
     "uuid": "^11.1.0",
     "zod": "^4.4.3"
@@ -99,6 +99,7 @@
   },
   "devDependencies": {
     "@jest/globals": "^30.2.0",
+    "@testing-library/dom": "^10.0.0",
     "@testing-library/react": "^16.0.0",
     "@types/jest": "^30.0.0",
     "@types/react": "^19.0.0",

package/src/local/BaseSyncedStore.ts

@@ -73,6 +73,7 @@ import type { PoolContext, RehydrationStats } from './sync/bootstrapApply.js';
 import * as deltaPipeline from './sync/deltaPipeline.js';
 import type { DeltaPipelineContext } from './sync/deltaPipeline.js';
 import type { ParticipantKind } from '@abloatai/transaction/types/participant';
+import type { DeliveryPartitionRoute } from '@abloatai/transaction/auth/deliveryPartition';
 import { queryByClass as runQueryByClass, countModels } from './store/queryApi.js';
 import type { QueuedMutation } from './transactions/mutations/MutationQueue.js';
 import type { CommitLatencySample } from './transactions/mutations/commitLatency.js';
@@ -150,6 +151,8 @@ export interface UserContext {
   branchId: string;
   /** True only when branchId is the project's production root. */
   branchRoot?: boolean;
+  /** Server-resolved WebSocket gateway route; never an authorization claim. */
+  deliveryPartition?: DeliveryPartitionRoute | null;
   role?: string;
   teamIds?: string[];
   /** Participant kind on the wire. Default 'user' for browser
@@ -1457,6 +1460,7 @@ export class BaseSyncedStore<
     }
     const syncGroups = this.resolveSyncGroups(context);
     this.syncWebSocket.setSyncGroups(syncGroups);
+    this.syncWebSocket.setDeliveryPartition(context.deliveryPartition ?? null);
     this.syncWebSocket.setLastSyncId(lastSyncId || 0);
     // The permanent base scopes for read interest — same set the connection
     // subscribes to at upgrade, so the two can never disagree.

package/src/local/client/clientPrelude.ts

@@ -69,8 +69,12 @@ export interface ClientPrelude<S extends SchemaRecord> {
 export function resolveClientPrelude<S extends SchemaRecord>(
   options: AbloOptions<S>,
 ): ClientPrelude<S> {
-  const internalOptions = options as InternalAbloOptions<S>;
   const env = readProcessEnv();
+  const internalOptions = {
+    ...options,
+    projectId: options.projectId ?? env.ABLO_PROJECT_ID,
+    branchId: options.branchId ?? env.ABLO_BRANCH_ID,
+  } as InternalAbloOptions<S>;
   const authInput = { options, env };
   const configuredApiKey = resolveApiKey(authInput);
   const configuredAuthToken = resolveAuthToken(authInput);

package/src/local/client/createModelProxy.ts

@@ -405,8 +405,6 @@ export function createModelProxy<T, C>(
    */
   hydration: Pick<OnDemandLoader, 'fetch'>,
   collaboration?: ModelCollaboration,
-  /** The client-wide `wait` default; a per-call `wait` still wins over it. */
-  defaultWait?: 'queued' | 'confirmed',
 ): ModelOperations<T, C> {
   /**
    * Resolve a row **this** resource owns.
@@ -471,20 +469,34 @@ export function createModelProxy<T, C>(
     };
   };
 
+  const guardWrite = <A extends unknown[], R>(
+    fn: (...args: A) => Promise<R>,
+  ): ((...args: A) => Promise<R>) => {
+    const guarded = guard(fn);
+    return (...args: A): Promise<R> => {
+      const confirmation = guarded(...args);
+      // Optimistic writes are intentionally useful without awaiting them. The
+      // transaction pipeline already reports a later refusal through
+      // `onMutationFailure`; attach an observer here as well so choosing not to
+      // await does not create an unhandled-rejection process error. Returning
+      // the original promise preserves normal rejection for callers that do
+      // await or attach their own catch handler.
+      void confirmation.catch(() => undefined);
+      return confirmation;
+    };
+  };
+
   const load = async (options?: ServerReadOptions<T>): Promise<T[]> => {
     const rows = await hydration.fetch<T>(schemaKey, options);
     return rows.map((row) => modelAsRow<T>(row));
   };
 
-  const waitForMutation = async (
-    model: Model,
-    options?: MutationOptions,
-  ): Promise<void> => {
-    // A per-call `wait` wins; otherwise the client-wide default decides. This
-    // is the single point that turns "confirmed" into actually waiting, so a
-    // client configured that way rejects on a refused write everywhere rather
-    // than in the one place a caller remembered to ask.
-    if ((options?.wait ?? defaultWait) !== 'confirmed') return;
+  const waitForMutation = async (model: Model): Promise<void> => {
+    // Model writes are optimistic locally, but their promise has one stable
+    // meaning: authoritative confirmation. Callers that do not need the
+    // barrier can keep using the row immediately and leave the promise to the
+    // global mutation-failure handler; awaiting the promise never means merely
+    // "placed in the local queue".
     // Let sibling writes from the same synchronous burst enter the mutation
     // queue before forcing a drain. Without this yield, every confirmed
     // create/update calls syncNow() alone, defeating the queue's microtask
@@ -540,7 +552,6 @@ export function createModelProxy<T, C>(
         ? { idempotencyKey: params.idempotencyKey }
         : {}),
       ...(params.label !== undefined ? { label: params.label } : {}),
-      ...(params.wait !== undefined ? { wait: params.wait } : {}),
       ...(params.readAt !== undefined ? { readAt: params.readAt } : {}),
       ...(params.onStale !== undefined ? { onStale: params.onStale } : {}),
       ...(params.fenceToken !== undefined ? { fenceToken: params.fenceToken } : {}),
@@ -1086,7 +1097,7 @@ export function createModelProxy<T, C>(
     // unbounded set of rows' entity groups.
     list: guard(load),
 
-    create: guard(async (params: ModelCreateParams<T, C>): Promise<T> => {
+    create: guardWrite(async (params: ModelCreateParams<T, C>): Promise<T> => {
       const id = params.id ?? Model.generateId();
       const opts = mutationOptions(params);
       const claim = params.claim;
@@ -1142,7 +1153,7 @@ export function createModelProxy<T, C>(
       };
       try {
         syncClient.add(model, effective);
-        await waitForMutation(model, effective);
+        await waitForMutation(model);
         return modelAsRow<T>(model);
       } finally {
         await autoLease?.release?.().catch(() => {});
@@ -1154,7 +1165,7 @@ export function createModelProxy<T, C>(
     // wrapping while exposing the two public signatures (a plain `guard(...)`
     // would collapse them to one).
     update: ((): ModelOperations<T, C>['update'] => {
-      const updateImpl = guard(
+      const updateImpl = guardWrite(
         async (
           arg: ModelUpdateParams<T, C> | string,
           updater?: ModelUpdater<T>,
@@ -1206,13 +1217,12 @@ export function createModelProxy<T, C>(
                 );
               }
               const effective: MutationOptions = {
-                wait: 'confirmed',
                 readAt,
                 onStale: 'reject',
               };
               model.applyChanges(patch);
               syncClient.update(model, effective);
-              await waitForMutation(model, effective);
+              await waitForMutation(model);
               return modelAsRow<T>(model);
             },
           });
@@ -1250,7 +1260,6 @@ export function createModelProxy<T, C>(
         const handle = isClaimHandle(params.claim) ? params.claim : undefined;
         const effective: MutationOptions | undefined = claimed
           ? {
-              wait: 'confirmed',
               readAt: claimed.lease.readAt ?? claimed.snapshot.stamp,
               onStale: 'reject',
               claimRef: { id: claimed.lease.id },
@@ -1262,7 +1271,6 @@ export function createModelProxy<T, C>(
               // works across clients (HTTP-minted handles included).
               ...(handle?.readAt !== undefined
                 ? {
-                    wait: 'confirmed' as const,
                     readAt: handle.readAt,
                     onStale: 'reject' as const,
                     ...(handle.fenceToken !== undefined
@@ -1279,7 +1287,7 @@ export function createModelProxy<T, C>(
         // the tracking, producing an empty `input: {}` no-op mutation.)
         model.applyChanges(params.data);
         syncClient.update(model, effective);
-        await waitForMutation(model, effective);
+        await waitForMutation(model);
         return modelAsRow<T>(model);
         },
       );
@@ -1299,7 +1307,7 @@ export function createModelProxy<T, C>(
       return update;
     })(),
 
-    delete: guard(async (params: ModelDeleteParams<T, C>): Promise<void> => {
+    delete: guardWrite(async (params: ModelDeleteParams<T, C>): Promise<void> => {
       const autoClaim =
         params.claim && !isClaimHandle(params.claim) ? params.claim : null;
       if (autoClaim) {
@@ -1334,7 +1342,6 @@ export function createModelProxy<T, C>(
       const handle = isClaimHandle(params.claim) ? params.claim : undefined;
       const effective: MutationOptions | undefined = claimed
         ? {
-            wait: 'confirmed',
             readAt: claimed.lease.readAt ?? claimed.snapshot.stamp,
             onStale: 'reject',
             claimRef: { id: claimed.lease.id },
@@ -1346,7 +1353,6 @@ export function createModelProxy<T, C>(
         : {
             ...(handle?.readAt !== undefined
               ? {
-                  wait: 'confirmed' as const,
                   readAt: handle.readAt,
                   onStale: 'reject' as const,
                 }
@@ -1355,7 +1361,7 @@ export function createModelProxy<T, C>(
             ...(handle ? { claim: { id: handle.id } } : {}),
           };
       syncClient.delete(model, effective);
-      await waitForMutation(model, effective);
+      await waitForMutation(model);
     }),
 
     // `claim` is a callable namespace (take a claim) carrying the coordination

package/src/local/client/options.ts

@@ -87,6 +87,21 @@ export interface AbloOptions<S extends SchemaRecord = SchemaRecord> {
    */
   apiKey?: string | CredentialProvider | null | undefined;
 
+  /**
+   * Pins this client to one Ablo project. During `ready()` the server resolves
+   * the API key's actual project and the client refuses to start when it differs.
+   * Defaults to `ABLO_PROJECT_ID`; `ablo dev` writes that value beside the key.
+   * This is an assertion, never a routing selector — the key remains authoritative.
+   */
+  projectId?: string | null | undefined;
+
+  /**
+   * Pins this client to one immutable Ablo branch. Defaults to
+   * `ABLO_BRANCH_ID`; `ablo dev` writes it beside the branch key. Like
+   * `projectId`, this is a startup assertion and never selects a branch.
+   */
+  branchId?: string | null | undefined;
+
   /**
    * The session-mint endpoint — the browser-side auth field, and the named
    * endpoint for the route that mints the signed-in user's short-lived token:
@@ -230,34 +245,6 @@ export interface AbloOptions<S extends SchemaRecord = SchemaRecord> {
    * session token (`ek_`/`rk_`) or you route through a controlled server proxy.
    */
   dangerouslyAllowBrowser?: boolean | undefined;
-
-  /**
-   * How far a write goes before its promise settles, for every model write on
-   * this client. The same word each write already takes per call
-   * (`create({ …, wait: 'confirmed' })`); setting it here makes it the default
-   * instead of repeating it.
-   *
-   * A write resolves as soon as it is applied locally and queued. That is what
-   * makes the UI immediate, and it is right for most writes — but it means a
-   * write the server later REFUSES has no caller left to tell. The rejection
-   * reverts the local row and reaches `ablo.onMutationFailure(…)`, and an
-   * application that subscribes to neither shows the change, then loses it,
-   * with nothing thrown anywhere.
-   *
-   * ```ts
-   * const ablo = new Ablo({ schema, apiKey, wait: 'confirmed' });
-   * try {
-   *   await ablo.documents.update({ id, data });   // throws if refused
-   * } catch (err) {
-   *   if (err instanceof AbloError) show(err.message);
-   * }
-   * ```
-   *
-   * The cost is real: each write now waits for the server's answer, so it is a
-   * choice between immediacy and certainty rather than a strict improvement.
-   * A per-call `wait` still wins over this.
-   */
-  wait?: 'queued' | 'confirmed' | undefined;
 }
 
 export interface InternalAbloOptions<S extends SchemaRecord = SchemaRecord> {
@@ -274,6 +261,9 @@ export interface InternalAbloOptions<S extends SchemaRecord = SchemaRecord> {
    */
   apiKey?: string | CredentialProvider | null | undefined;
 
+  /** Expected project assertion; see {@link AbloOptions.projectId}. */
+  projectId?: string | null | undefined;
+
   /**
    * Session-mint endpoint (string or async resolver) — see
    * {@link AbloOptions.authEndpoint}. Mutually exclusive with `apiKey`.
@@ -521,15 +511,11 @@ export interface InternalAbloOptions<S extends SchemaRecord = SchemaRecord> {
   organizationId?: string;
 
   /**
-   * Immutable branch selected by a self-hosted credential. Hosted clients
-   * receive this from the credential exchange.
+   * Expected immutable branch. Hosted clients compare it with the credential
+   * exchange; self-hosted clients use it as their locally selected branch.
    */
   branchId?: string;
 
   /** Whether the selected self-hosted branch is the project's root branch. */
   branchRoot?: boolean;
-
-  /** The client-wide write default — see {@link AbloOptions.wait}. Projected
-   *  from the public option rather than restated, so the two cannot diverge. */
-  wait?: AbloOptions['wait'];
 }

package/src/local/client/reactiveEngine.ts

@@ -607,8 +607,6 @@ export function buildReactiveEngine<const S extends SchemaRecord>(
             ...(options?.ttl !== undefined ? { ttl: options.ttl } : {}),
           }),
       },
-      // The client-wide `wait` default; a per-call `wait` still wins.
-      internalOptions.wait,
     );
   }
 

package/src/local/client/resourceTypes.ts

@@ -18,6 +18,7 @@ export type {
   ModelListScope,
   ServerReadOptions,
   ModelRetrieveParams,
+  ModelWriteOptions,
   ModelCreateParams,
   ModelUpdateParams,
   ModelDeleteParams,

package/src/local/client/storeLifecycle.ts

@@ -63,6 +63,44 @@ export interface StoreLifecycleDeps<S extends SchemaRecord> {
   readonly onIdentityResolved: (seed: IdentitySeed) => void;
 }
 
+/** Refuse a credential for another project before the store opens its socket. */
+export function assertExpectedProject(
+  expectedProjectId: string | null | undefined,
+  actualProjectId: string | null
+): void {
+  const expected = expectedProjectId?.trim();
+  if (!expected || actualProjectId === expected) return;
+  throw new AbloAuthenticationError(
+    `ABLO_API_KEY belongs to project ${actualProjectId ?? '(none)'}, but this app is pinned to ${expected} by projectId/ABLO_PROJECT_ID.`,
+    {
+      code: 'project_scope_denied',
+      details: {
+        expectedProjectId: expected,
+        actualProjectId,
+      },
+    }
+  );
+}
+
+/** Refuse a credential for another branch before the store opens its socket. */
+export function assertExpectedBranch(
+  expectedBranchId: string | null | undefined,
+  actualBranchId: string | null
+): void {
+  const expected = expectedBranchId?.trim();
+  if (!expected || actualBranchId === expected) return;
+  throw new AbloAuthenticationError(
+    `ABLO_API_KEY belongs to branch ${actualBranchId ?? '(none)'}, but this app is pinned to ${expected} by branchId/ABLO_BRANCH_ID.`,
+    {
+      code: 'branch_scope_denied',
+      details: {
+        expectedBranchId: expected,
+        actualBranchId,
+      },
+    }
+  );
+}
+
 /**
  * Wires the credential machinery onto the cluster and returns the `ready`
  * the client exposes. Wiring happens now — the refresh lifecycle, the
@@ -200,8 +238,12 @@ export function startStoreLifecycle<S extends SchemaRecord>(
           capabilityToken,
           syncGroups,
           participantKind,
+          deliveryPartition,
         } = resolved;
 
+        assertExpectedProject(internalOptions.projectId, projectId);
+        assertExpectedBranch(internalOptions.branchId, branchId);
+
         // Fail-loud guard: detect the degenerate "no real sync groups
         // resolved" state before opening the socket. It is the same class of bug as
         // a sensible-looking default that's functionally broken: the
@@ -274,6 +316,7 @@ export function startStoreLifecycle<S extends SchemaRecord>(
           kind: participantKind,
           capabilityToken,
           syncGroups,
+          deliveryPartition,
           bootstrapMode: resolvedBootstrapMode,
         });
         let current = gen.next();

package/src/local/sync/createClaimStream.ts

@@ -44,6 +44,7 @@ import {
   claimDescription,
   descriptionFromMeta,
   participantKindFromWire,
+  type WireClaimSummary,
 } from '@abloatai/transaction/coordination/schema';
 import {
   isTargetTuple,
@@ -198,6 +199,38 @@ export function createClaimStream(
     }
   };
 
+  const observeForeignClaim = (
+    heldBy: string,
+    claim: WireClaimSummary,
+    participantKind?: 'user' | 'agent' | 'system',
+    isAgent?: boolean,
+  ): void => {
+    const description =
+      claim.description ??
+      descriptionFromMeta(claim.meta) ??
+      'editing';
+    const { meta, ...details } = subTarget(claim);
+    activeByClaimId.set(claim.claimId, {
+      object: 'claim',
+      id: claim.claimId,
+      status: 'active',
+      heldBy,
+      participantKind: participantKindFromWire(participantKind, isAgent),
+      target: {
+        ...streamTarget(claim),
+        ...details,
+        ...(meta !== undefined ? { meta: declaredMeta(meta) } : {}),
+      },
+      description,
+      ttlSeconds: Math.max(
+        0,
+        Math.floor((claim.expiresAt - Date.now()) / 1000),
+      ),
+      createdAt: claim.declaredAt,
+      expiresAt: claim.expiresAt,
+    });
+  };
+
   // ── Wire wiring ──────────────────────────────────────────────────
   let attached: ClaimTransport | null = null;
   const unsubs: (() => void)[] = [];
@@ -241,37 +274,12 @@ export function createClaimStream(
           // drops it from `others`, which is what resolves a contender's
           // `settled()`. Absent status means active (wire back-compat).
           if (claim.status && claim.status !== 'active') continue;
-          // Resolve the always-present public field, tolerating a frame that
-          // carries the value in `meta` rather than as an explicit description.
-          const description =
-            claim.description ??
-            descriptionFromMeta(claim.meta) ??
-            'editing';
-          // The frame is parsed permissively, on purpose; `declaredMeta` is where
-          // that wire value becomes the shape the program declared.
-          const { meta, ...details } = subTarget(claim);
-          activeByClaimId.set(claim.claimId, {
-            object: 'claim',
-            id: claim.claimId,
-            status: 'active',
-            heldBy: event.userId,
-            participantKind: participantKindFromWire(
-              event.participantKind,
-              event.isAgent,
-            ),
-            target: {
-              ...streamTarget(claim),
-              ...details,
-              ...(meta !== undefined ? { meta: declaredMeta(meta) } : {}),
-            },
-            description,
-            ttlSeconds: Math.max(
-              0,
-              Math.floor((claim.expiresAt - Date.now()) / 1000),
-            ),
-            createdAt: claim.declaredAt,
-            expiresAt: claim.expiresAt,
-          });
+          observeForeignClaim(
+            event.userId,
+            claim,
+            event.participantKind,
+            event.isAgent,
+          );
           mutated = true;
         }
         if (mutated) notifyListeners();
@@ -295,6 +303,22 @@ export function createClaimStream(
         // a claim the server already rejected (would just spam both
         // sides with conflicts).
         ownClaims.delete(rejection.claimId);
+        // A holder on another server may have claimed before this client joined
+        // the row group, so its one-shot presence frame was missed. A conflict
+        // reply carries the authoritative holder summary; seed the same local
+        // state immediately instead of continuing to report the row as free.
+        if (
+          rejection.reason === 'conflict' &&
+          rejection.heldBy &&
+          rejection.heldByClaim
+        ) {
+          observeForeignClaim(
+            rejection.heldBy,
+            rejection.heldByClaim,
+            rejection.heldByKind,
+          );
+          notifyListeners();
+        }
         for (const l of rejectionListeners) {
           try {
             l(rejection);