@abloatai/humans 0.48.0 → 0.50.0

package/dist/client.d.ts

@@ -18,6 +18,7 @@ import type { SyncWebSocket, CoreSyncEventMap } from './local/sync/SyncWebSocket
 import type { SyncStatus } from './local/BaseSyncedStore.js';
 import type { ModelOperations } from './local/client/createModelProxy.js';
 import type { ClaimResource, CommitResource, CreateAgentClientParams, SessionResource } from '@abloatai/transaction/resources/httpResources';
+import type { EffectiveAuthority } from '@abloatai/transaction/auth';
 export type { LocalReadOptions } from './local/client/resourceTypes.js';
 /** The typed sync engine client — one property per model in the schema */
 export type AbloClient<S extends SchemaRecord> = {
@@ -156,6 +157,11 @@ export type AbloClient<S extends SchemaRecord> = {
      * ```
      */
     readonly organizationId: string | null;
+    /**
+     * The effective authority of this running participant, confirmed by the
+     * server credential exchange/identity endpoint. `null` until `ready()`.
+     */
+    readonly identity: EffectiveAuthority | null;
     /**
      * Destroy every IndexedDB database owned by this engine. Disconnects
      * the WebSocket, releases timers, and deletes all `ablo_*` / `ablo-*`

package/dist/humans.d.ts

@@ -2,7 +2,7 @@
  * Public human-facing local-state capability.
  *
  * The plugin and its local-state runtime belong to @abloatai/humans. The
- * shared settlement package supplies only the handoff identity and wire
+ * shared confirmation package supplies only the handoff identity and wire
  * contracts.
  */
 import type { PluginContext, AppliedChange } from './plugin.js';

package/dist/local/RuntimeContext.d.ts

@@ -25,7 +25,7 @@ export interface RuntimeContext {
     config: RuntimeConfig;
     /**
      * Model metadata lookup. Injected by the client (it wires this from its
-     * `ModelRegistry`) so the settlement core can resolve a model's metadata
+     * `ModelRegistry`) so the confirmation core can resolve a model's metadata
      * without importing the registry — the dependency inversion that keeps the
      * core free of the client's `Model` layer (ADR 0013).
      */

package/dist/local/SyncClient.d.ts

@@ -316,7 +316,7 @@ export declare class SyncClient extends EventEmitter {
      * Called when WebSocket successfully connects (can happen independently of browser online/offline)
      */
     markConnected(): void;
-    private drainPendingSettlements;
+    private drainPendingConfirmations;
     /**
      * Dispose and cleanup
      */

package/dist/local/SyncClient.js

@@ -1029,7 +1029,7 @@ export class SyncClient extends EventEmitter {
         if (this.pendingStages.size > 0) {
             await Promise.all([...this.pendingStages]);
         }
-        await this.drainPendingSettlements();
+        await this.drainPendingConfirmations();
     }
     /**
      * Resolve a conflict between the local model and incoming server data,
@@ -1234,7 +1234,7 @@ export class SyncClient extends EventEmitter {
         // Browser online state may have marked the client connected before the
         // WebSocket itself was ready. Always kick both durable lanes on the real
         // socket event, even when the high-level state did not change.
-        void this.drainPendingSettlements().catch((error) => {
+        void this.drainPendingConfirmations().catch((error) => {
             this.runtime.observability.captureMutationFailure({
                 context: 'restore-commit-outbox',
                 error: error instanceof Error ? error : new Error(String(error)),
@@ -1242,7 +1242,7 @@ export class SyncClient extends EventEmitter {
         });
         void this.processPendingMutations();
     }
-    drainPendingSettlements() {
+    drainPendingConfirmations() {
         return this.reconnectDrain.drain(() => this.mutationQueue.drainPending());
     }
     /**

package/dist/local/client/createModelProxy.d.ts

@@ -22,6 +22,7 @@ export type { Claim, ClaimHeartbeat, ClaimHeartbeatOptions, HeldClaim, HeldLease
 import type { ClaimApi, ClaimAttemptEvent, JoinOptions, LocalCountOptions, LocalReadOptions } from '@abloatai/transaction/resources/modelOperations';
 import type { HttpModelClient } from '@abloatai/transaction/transport/httpClient';
 import type { ParticipantKind } from '@abloatai/transaction/types/participant';
+import { type ReadSetContext } from '@abloatai/transaction/internal/read-set';
 export interface ModelClientMeta {
     readonly key: string;
     readonly typename: string;
@@ -33,6 +34,11 @@ export declare function getModelClientMeta(modelClient: unknown): ModelClientMet
  */
 type EntityHalf = Pick<ModelTarget, 'model' | 'id'>;
 export interface ModelCollaboration {
+    /** Exact point evidence from the HTTP read boundary (stamp captured before data). */
+    readPoint(model: string, id: string): Promise<{
+        data: unknown;
+        stamp: number;
+    }>;
     createClaim(options: {
         /**
          * The locator, in the spelling the SDK surface and the HTTP routes use.
@@ -245,4 +251,4 @@ export declare function createModelProxy<T, C>(schemaKey: string, registeredMode
  * collaborator, a test most of all, is pushed into a cast through `unknown`
  * to supply the one method that is actually read.
  */
-hydration: Pick<OnDemandLoader, 'fetch'>, collaboration?: ModelCollaboration): ModelOperations<T, C>;
+hydration: Pick<OnDemandLoader, 'fetch'> & Partial<Pick<OnDemandLoader, 'getReadEvidence'>>, collaboration?: ModelCollaboration, readSetContext?: ReadSetContext): ModelOperations<T, C>;

package/dist/local/client/createModelProxy.js

@@ -27,6 +27,7 @@ import { subTarget } from '@abloatai/transaction/coordination';
 import { declaredMeta } from '@abloatai/transaction/coordination/claimMeta';
 import { ModelScope } from '@abloatai/transaction/types';
 import { claimQueueView, resolveClaimContentionOptions, } from '@abloatai/transaction/resources/modelOperations';
+import { abortReadSetCommit, capturePointRead, consumeReadSet, prepareReadSet, } from '@abloatai/transaction/internal/read-set';
 const modelClientMeta = new WeakMap();
 export function getModelClientMeta(modelClient) {
     if (typeof modelClient !== 'object' || modelClient === null)
@@ -43,7 +44,8 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
  * collaborator, a test most of all, is pushed into a cast through `unknown`
  * to supply the one method that is actually read.
  */
-hydration, collaboration) {
+hydration, collaboration, readSetContext) {
+    const readSetClientIdentity = syncClient;
     /**
      * Resolve a row **this** resource owns.
      *
@@ -152,24 +154,45 @@ hydration, collaboration) {
         value.object === 'claim' &&
         typeof value.id === 'string' &&
         typeof value.release === 'function';
-    const mutationOptions = (params) => {
+    const preparedMutation = (params) => {
+        const prepared = prepareReadSet(readSetContext, readSetClientIdentity, params.readAt, params.onStale, params.idempotencyKey, params.reads);
         const rest = {
-            ...(params.idempotencyKey !== undefined
-                ? { idempotencyKey: params.idempotencyKey }
-                : {}),
+            ...(prepared.idempotencyKey !== undefined
+                ? { idempotencyKey: prepared.idempotencyKey }
+                : params.idempotencyKey !== undefined
+                    ? { idempotencyKey: params.idempotencyKey }
+                    : {}),
             ...(params.label !== undefined ? { label: params.label } : {}),
-            ...(params.readAt !== undefined ? { readAt: params.readAt } : {}),
-            ...(params.onStale !== undefined ? { onStale: params.onStale } : {}),
+            ...(prepared.readAt !== undefined
+                ? { readAt: prepared.readAt }
+                : params.readAt !== undefined
+                    ? { readAt: params.readAt }
+                    : {}),
+            ...(prepared.onStale !== undefined
+                ? { onStale: prepared.onStale }
+                : params.onStale !== undefined
+                    ? { onStale: params.onStale }
+                    : {}),
             ...(params.fenceToken !== undefined ? { fenceToken: params.fenceToken } : {}),
             ...(params.claimRef !== undefined ? { claimRef: params.claimRef } : {}),
-            ...(params.reads !== undefined ? { reads: params.reads } : {}),
+            ...(prepared.reads !== undefined
+                ? { reads: prepared.reads === null ? null : [...prepared.reads] }
+                : params.reads !== undefined
+                    ? { reads: params.reads }
+                    : {}),
             ...(params.track !== undefined ? { track: params.track } : {}),
         };
         // The write-options schema — the runtime twin of the compile-time params.
         // Catches plain-JavaScript callers (for example `onStale: 'rejct'`) at the
         // call site with a typed error instead of a silent no-op or a server 400.
-        assertWriteOptions(rest, `${schemaKey} write`);
-        return rest;
+        try {
+            assertWriteOptions(rest, `${schemaKey} write`);
+        }
+        catch (error) {
+            abortReadSetCommit(readSetContext, prepared.automaticCommit);
+            throw error;
+        }
+        return { options: rest, prepared };
     };
     const releaseClaim = async (id) => {
         const held = activeClaims.get(id);
@@ -615,18 +638,44 @@ hydration, collaboration) {
             where: [['id', params.id]],
             limit: 1,
         });
+        if (readSetContext?.getStore() && collaboration) {
+            const read = await collaboration.readPoint(schemaKey, params.id);
+            const data = (read.data ?? undefined);
+            capturePointRead(readSetContext, readSetClientIdentity, wireModel, params.id, data, read.stamp);
+            return data;
+        }
         return rows[0];
     });
+    const list = guard(async (options) => {
+        const registry = readSetContext?.getStore();
+        const rows = await load(options);
+        if (!registry)
+            return rows;
+        for (const row of rows) {
+            const stamp = hydration.getReadEvidence?.(row);
+            if (stamp === undefined) {
+                // Local-first/lazy rows remain valid reads, but cannot later be used as
+                // guarded dependencies. `prepareReadSet` rejects them if supplied in
+                // `reads`; authoritative complete reads carry evidence here.
+                continue;
+            }
+            const id = row.id;
+            if (typeof id !== 'string' || id.length === 0) {
+                throw new AbloValidationError(`${registeredModelName}.list returned a row without an id.`, { code: 'commit_no_result' });
+            }
+            capturePointRead(readSetContext, readSetClientIdentity, wireModel, id, row, stamp);
+        }
+        return rows;
+    });
     const operations = {
         local,
         get,
         retrieve: get,
         // No automatic scope enrolment on bulk `list`: that would subscribe to an
         // unbounded set of rows' entity groups.
-        list: guard(load),
+        list,
         create: guardWrite(async (params) => {
             const id = params.id ?? Model.generateId();
-            const opts = mutationOptions(params);
             const claim = params.claim;
             let autoLease;
             if (claim && !isClaimHandle(claim)) {
@@ -668,16 +717,38 @@ hydration, collaboration) {
                 createdAt: new Date(),
                 updatedAt: new Date(),
             });
-            const effective = {
-                ...opts,
-                ...(autoLease ? { claim: autoLease } : {}),
-                ...(isClaimHandle(claim) ? { claim: { id: claim.id } } : {}),
-            };
+            let prepared;
             try {
+                const resolved = preparedMutation(params);
+                prepared = resolved.prepared;
+                const effective = {
+                    ...resolved.options,
+                    ...(autoLease
+                        ? {
+                            claimRef: { id: autoLease.id },
+                            ...(autoLease.fenceToken !== undefined
+                                ? { fenceToken: autoLease.fenceToken }
+                                : {}),
+                        }
+                        : {}),
+                    ...(isClaimHandle(claim)
+                        ? {
+                            claimRef: { id: claim.id },
+                            ...(claim.fenceToken !== undefined
+                                ? { fenceToken: claim.fenceToken }
+                                : {}),
+                        }
+                        : {}),
+                };
                 syncClient.add(model, effective);
                 await waitForMutation(model);
+                consumeReadSet(readSetContext, readSetClientIdentity, prepared.consumed, prepared.automaticCommit);
                 return modelAsRow(model);
             }
+            catch (error) {
+                abortReadSetCommit(readSetContext, prepared?.automaticCommit ?? false);
+                throw error;
+            }
             finally {
                 await autoLease?.release?.().catch(() => { });
             }
@@ -712,11 +783,11 @@ hydration, collaboration) {
                             // `type: 'complete'` forces the round-trip — the hydration ledger
                             // would otherwise serve a possibly-stale local row for a hydrated id.
                             await load({ where: [['id', id]], type: 'complete' });
-                            const fresh = ownRowOrThrow(id);
-                            const snapshot = collaboration.createSnapshot(schemaKey, id);
+                            const exact = await collaboration.readPoint(wireModel, id);
+                            capturePointRead(readSetContext, readSetClientIdentity, wireModel, id, exact.data, exact.stamp);
                             return {
-                                data: fresh ? modelAsRow(fresh) : undefined,
-                                stamp: snapshot.stamp,
+                                data: exact.data,
+                                stamp: exact.stamp,
                             };
                         },
                         writeNext: async (patch, readAt) => {
@@ -724,14 +795,28 @@ hydration, collaboration) {
                             if (!model) {
                                 throw new AbloValidationError(`Entity not found: ${registeredModelName}/${id}`, { code: 'entity_not_found' });
                             }
-                            const effective = {
-                                readAt,
-                                onStale: 'reject',
-                            };
-                            model.applyChanges(patch);
-                            syncClient.update(model, effective);
-                            await waitForMutation(model);
-                            return modelAsRow(model);
+                            const prepared = prepareReadSet(readSetContext, readSetClientIdentity, undefined, 'reject', undefined, contention?.reads);
+                            try {
+                                const effective = {
+                                    readAt: prepared.readAt ?? readAt,
+                                    onStale: prepared.onStale ?? 'reject',
+                                    ...(prepared.idempotencyKey
+                                        ? { idempotencyKey: prepared.idempotencyKey }
+                                        : {}),
+                                    ...(prepared.reads !== undefined
+                                        ? { reads: prepared.reads === null ? null : [...prepared.reads] }
+                                        : {}),
+                                };
+                                model.applyChanges(patch);
+                                syncClient.update(model, effective);
+                                await waitForMutation(model);
+                                consumeReadSet(readSetContext, readSetClientIdentity, prepared.consumed, prepared.automaticCommit);
+                                return modelAsRow(model);
+                            }
+                            catch (error) {
+                                abortReadSetCommit(readSetContext, prepared.automaticCommit);
+                                throw error;
+                            }
                         },
                     });
                 }
@@ -758,13 +843,17 @@ hydration, collaboration) {
                 // If we hold a claim on this row, guard the write with its snapshot
                 // watermark + lease so it's stale-rejected and attributed to the claim.
                 const claimed = activeClaims.get(id);
-                const opts = mutationOptions(params);
+                const resolved = preparedMutation(params);
+                const opts = resolved.options;
                 const handle = isClaimHandle(params.claim) ? params.claim : undefined;
                 const effective = claimed
                     ? {
                         readAt: claimed.lease.readAt ?? claimed.snapshot.stamp,
                         onStale: 'reject',
                         claimRef: { id: claimed.lease.id },
+                        ...(claimed.lease.fenceToken !== undefined
+                            ? { fenceToken: claimed.lease.fenceToken }
+                            : {}),
                         ...opts,
                     }
                     : {
@@ -781,16 +870,23 @@ hydration, collaboration) {
                             }
                             : {}),
                         ...opts,
-                        ...(handle ? { claim: { id: handle.id } } : {}),
+                        ...(handle ? { claimRef: { id: handle.id } } : {}),
                     };
                 // Local user update: `applyChanges` keeps change tracking on so the
                 // edited fields land in `modifiedProperties` and are actually sent to
                 // the server. (`updateFromData` is the hydration path and would discard
                 // the tracking, producing an empty `input: {}` no-op mutation.)
-                model.applyChanges(params.data);
-                syncClient.update(model, effective);
-                await waitForMutation(model);
-                return modelAsRow(model);
+                try {
+                    model.applyChanges(params.data);
+                    syncClient.update(model, effective);
+                    await waitForMutation(model);
+                    consumeReadSet(readSetContext, readSetClientIdentity, resolved.prepared.consumed, resolved.prepared.automaticCommit);
+                    return modelAsRow(model);
+                }
+                catch (error) {
+                    abortReadSetCommit(readSetContext, resolved.prepared.automaticCommit);
+                    throw error;
+                }
             });
             function update(arg, updater, contention) {
                 return updateImpl(arg, updater, contention);
@@ -826,7 +922,8 @@ hydration, collaboration) {
             if (!model)
                 return;
             const claimed = activeClaims.get(id);
-            const opts = mutationOptions(params);
+            const resolved = preparedMutation(params);
+            const opts = resolved.options;
             const handle = isClaimHandle(params.claim) ? params.claim : undefined;
             const effective = claimed
                 ? {
@@ -843,13 +940,23 @@ hydration, collaboration) {
                         ? {
                             readAt: handle.readAt,
                             onStale: 'reject',
+                            ...(handle.fenceToken !== undefined
+                                ? { fenceToken: handle.fenceToken }
+                                : {}),
                         }
                         : {}),
                     ...opts,
-                    ...(handle ? { claim: { id: handle.id } } : {}),
+                    ...(handle ? { claimRef: { id: handle.id } } : {}),
                 };
-            syncClient.delete(model, effective);
-            await waitForMutation(model);
+            try {
+                syncClient.delete(model, effective);
+                await waitForMutation(model);
+                consumeReadSet(readSetContext, readSetClientIdentity, resolved.prepared.consumed, resolved.prepared.automaticCommit);
+            }
+            catch (error) {
+                abortReadSetCommit(readSetContext, resolved.prepared.automaticCommit);
+                throw error;
+            }
         }),
         // `claim` is a callable namespace (take a claim) carrying the coordination
         // readers (`claim.state` / `claim.queue` / `claim.release` / `claim.reorder`).

package/dist/local/client/options.d.ts

@@ -8,7 +8,7 @@ import type { Schema, SchemaRecord } from '@abloatai/transaction/schema/schema';
 import type { RuntimeConfig, Logger, MutationExecutor, ObservabilityProvider, Analytics, SessionErrorDetector, OnlineStatusProvider } from '../interfaces/index.js';
 import type { AbloPersistence } from '../persistence.js';
 import type { DurableWriteStore, DurableWritesConfig } from '@abloatai/transaction/durableWrites';
-import type { CommitOutboxScope } from '@abloatai/transaction/transactions/settlement/commitEnvelope';
+import type { CommitOutboxScope } from '@abloatai/transaction/transactions/confirmation/commitEnvelope';
 /**
  * An async function that resolves an apiKey at request time. Use it for credential
  * rotation — read from a vault, refresh from session storage, or pull from an

package/dist/local/client/reactiveEngine.js

@@ -12,9 +12,9 @@
  * design step (docs/plans/package-split.md).
  */
 import { omittedModelError } from '@abloatai/transaction/schema/select';
-import { durableCommitOperationSchema, } from '@abloatai/transaction/transactions/settlement/commitEnvelope';
+import { durableCommitOperationSchema, } from '@abloatai/transaction/transactions/confirmation/commitEnvelope';
 import { AbloAuthenticationError, AbloConnectionError, AbloValidationError, claimedError } from '@abloatai/transaction/errors';
-import { batchFence, fenceTokenFor, modelTarget, streamTarget, subTarget, } from '@abloatai/transaction/coordination';
+import { batchFence, claimIdFor, fenceTokenFor, modelTarget, streamTarget, subTarget, } from '@abloatai/transaction/coordination';
 import { validateAbloOptions } from './validateAbloOptions.js';
 import { mintSession } from '@abloatai/transaction/auth/sessionMint';
 import { revokeCapability, rotateCapability, } from '@abloatai/transaction/auth/capabilityLifecycle';
@@ -28,14 +28,42 @@ import { resolveApiKeyValue, resolveBootstrapBaseUrl } from '@abloatai/transacti
 import { claimAttemptFailure, emitClaimStatus, } from '@abloatai/transaction/resources/modelOperations';
 import { createModelProxy } from './createModelProxy.js';
 import { assertWriteOptions } from '@abloatai/transaction/resources/writeOptionsSchema';
+import { modelReadResponseSchema, commitRecordSchema, commitRecordListSchema, commitRecordWhereSchema, } from '@abloatai/transaction/wire';
+import { translateHttpError } from '@abloatai/transaction/errors';
+import { kReadEvidence } from '@abloatai/transaction/internal/read-set';
 export function buildReactiveEngine(inputs) {
     const { options, internalOptions, url, logger, configuredApiKey, configuredAuthToken, credentialResolver, authCredentials, transport, participantId, kind, presence, cluster, createSibling, } = inputs;
     const schema = options.schema;
+    const pointReadBaseUrl = resolveBootstrapBaseUrl({
+        url,
+        bootstrapBaseUrl: internalOptions.bootstrapBaseUrl,
+    });
+    async function readPoint(model, id) {
+        const fetchImpl = internalOptions.fetch ?? globalThis.fetch;
+        const response = await fetchImpl(`${pointReadBaseUrl}/v1/models/${encodeURIComponent(model)}/${encodeURIComponent(id)}`, { headers: authCredentials.withAuthHeaders() });
+        let body;
+        try {
+            body = await response.json();
+        }
+        catch {
+            body = null;
+        }
+        if (!response.ok)
+            throw translateHttpError(response.status, body);
+        const parsed = modelReadResponseSchema.safeParse(body);
+        if (!parsed.success) {
+            throw new AbloConnectionError('Model point-read response failed validation.', {
+                code: 'commit_no_result',
+                cause: parsed.error,
+            });
+        }
+        return { data: parsed.data.data, stamp: parsed.data.stamp };
+    }
     // The store cluster — this client's runtime, the component graph, the
     // registered models, and the store — was constructed by `humans().init`
     // from the widened plugin context (see `./storeCluster.ts`). The engine
     // assembles around it.
-    const { components, store } = cluster;
+    const { components, store, readSetContext } = cluster;
     const { modelRegistry, objectPool, syncClient, hydration, } = components;
     // Self identity, late-bound the same way the connection's values are: the
     // construction-time guess seeds it (correct on the self-hosted path, empty
@@ -93,6 +121,7 @@ export function buildReactiveEngine(inputs) {
     /** Resolved account scope — seeded once identity resolution completes;
      *  exposed as the readonly `ablo.organizationId` accessor. */
     let _resolvedOrganizationId = null;
+    let _resolvedIdentity = null;
     const lifecycle = startStoreLifecycle({
         cluster,
         schema,
@@ -105,10 +134,11 @@ export function buildReactiveEngine(inputs) {
         kind,
         logger,
         validationError: _validationError,
-        onIdentityResolved: ({ userId, participantKind, accountScope, syncGroups }) => {
+        onIdentityResolved: ({ userId, participantKind, accountScope, syncGroups, authority }) => {
             selfParticipantId = userId;
             selfParticipantKind = participantKind;
             _resolvedOrganizationId = accountScope;
+            _resolvedIdentity = authority;
             presenceStream.setParticipant({
                 id: userId,
                 kind: participantKind,
@@ -145,7 +175,7 @@ export function buildReactiveEngine(inputs) {
             ? crypto.randomUUID()
             : `tx_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
     }
-    function normalizeCommitOperation(op, defaults, fence) {
+    function normalizeCommitOperation(op, defaults, fence, claim) {
         const type = op.action.toUpperCase();
         const id = op.id ?? '';
         return durableCommitOperationSchema.parse({
@@ -154,6 +184,7 @@ export function buildReactiveEngine(inputs) {
             id,
             input: op.data ?? undefined,
             transactionId: op.transactionId ?? undefined,
+            claimId: op.claimId ?? claimIdFor(claim?.target, claim?.id, op.model, op.id ?? null) ?? undefined,
             readAt: op.readAt ?? defaults.readAt ?? undefined,
             onStale: op.onStale ?? defaults.onStale ?? undefined,
             fenceToken: op.fenceToken ?? fenceTokenFor(fence, op.model, op.id ?? null) ?? undefined,
@@ -163,7 +194,7 @@ export function buildReactiveEngine(inputs) {
         if (commitOptions.operations.length === 0) {
             throw new AbloValidationError('Commit requires a non-empty `operations` array.', { code: 'commit_operation_required' });
         }
-        return commitOptions.operations.map((op) => normalizeCommitOperation(op, commitOptions, fence));
+        return commitOptions.operations.map((op) => normalizeCommitOperation(op, commitOptions, fence, commitOptions.claim ?? null));
     }
     function modelClaimFromActive(claim) {
         const target = {
@@ -377,6 +408,7 @@ export function buildReactiveEngine(inputs) {
         const registeredModelName = modelDef.typename ?? schemaKey;
         modelProxies[schemaKey] = createModelProxy(schemaKey, registeredModelName, objectPool, syncClient, modelRegistry, hydration, {
             createClaim: (claimOptions) => publicClaims.create(claimOptions),
+            readPoint,
             createSnapshot: (modelKey, id) => createSnapshot({
                 pool: objectPool,
                 transport,
@@ -429,7 +461,7 @@ export function buildReactiveEngine(inputs) {
                 scope: { [modelKey]: ids },
                 ...(options?.ttl !== undefined ? { ttl: options.ttl } : {}),
             }),
-        });
+        }, readSetContext);
     }
     const commits = {
         async create(commitOptions) {
@@ -479,6 +511,29 @@ export function buildReactiveEngine(inputs) {
                 ...(missingIds && missingIds.length > 0 ? { missingIds } : {}),
             };
         },
+        async get({ id }) {
+            await ready();
+            const response = await (internalOptions.fetch ?? globalThis.fetch)(`${pointReadBaseUrl}/v1/commits/${encodeURIComponent(id)}`, { headers: authCredentials.withAuthHeaders() });
+            const body = await response.json().catch(() => null);
+            if (!response.ok)
+                throw translateHttpError(response.status, body);
+            return commitRecordSchema.nullable().parse(body);
+        },
+        async list(listOptions = {}) {
+            await ready();
+            const where = commitRecordWhereSchema.parse(listOptions.where ?? {});
+            const params = new URLSearchParams();
+            if (where.actorId)
+                params.set('actorId', where.actorId);
+            if (where.status)
+                params.set('status', where.status);
+            const query = params.size > 0 ? `?${params.toString()}` : '';
+            const response = await (internalOptions.fetch ?? globalThis.fetch)(`${pointReadBaseUrl}/v1/commits${query}`, { headers: authCredentials.withAuthHeaders() });
+            const body = await response.json().catch(() => null);
+            if (!response.ok)
+                throw translateHttpError(response.status, body);
+            return commitRecordListSchema.parse(body);
+        },
     };
     /**
      * The control-plane credential: always the original configured secret key.
@@ -560,6 +615,9 @@ export function buildReactiveEngine(inputs) {
         get organizationId() {
             return _resolvedOrganizationId;
         },
+        get identity() {
+            return _resolvedIdentity;
+        },
         nudgeReconnect() {
             store.nudgeReconnect();
         },
@@ -716,6 +774,10 @@ export function buildReactiveEngine(inputs) {
             });
         },
     };
+    Object.defineProperty(engine, kReadEvidence, {
+        value: { context: cluster.readSetContext, client: syncClient },
+        enumerable: false,
+    });
     // A model the schema projection left out answers with an error naming the
     // model and the fix, not `undefined`. An app can compile against the full
     // source schema while running a projection, so the type system never sees

package/dist/local/client/resourceTypes.d.ts

@@ -1,7 +1,7 @@
 /**
  * The interactive resource-type surface.
  *
- * The transport-facing half of these types moved down into the settlement core
+ * The transport-facing half of these types moved down into the confirmation core
  * (ADR 0016). This module keeps the
  * consumer-facing import path intact and rejoins it with the model-proxy types
  * that stay here — `ModelOperations` chief among them, because it returns the

package/dist/local/client/resourceTypes.js

@@ -1,7 +1,7 @@
 /**
  * The interactive resource-type surface.
  *
- * The transport-facing half of these types moved down into the settlement core
+ * The transport-facing half of these types moved down into the confirmation core
  * (ADR 0016). This module keeps the
  * consumer-facing import path intact and rejoins it with the model-proxy types
  * that stay here — `ModelOperations` chief among them, because it returns the

package/dist/local/client/storeCluster.d.ts

@@ -19,6 +19,7 @@ import { type RuntimeContext } from '../RuntimeContext.js';
 import { BaseSyncedStore } from '../BaseSyncedStore.js';
 import { type InternalComponents } from './createInternalComponents.js';
 import type { InternalAbloOptions } from './options.js';
+import { type ReadSetContext } from '@abloatai/transaction/internal/read-set';
 export type { InternalAbloOptions } from './options.js';
 /**
  * The private handoff slot on the humans surface. Symbol-keyed on purpose:
@@ -34,6 +35,8 @@ export interface StoreCluster {
     readonly components: InternalComponents;
     /** The store orchestrating the graph, holding the host-built connection. */
     readonly store: BaseSyncedStore;
+    /** Client-local opaque evidence registry; never an ambient execution scope. */
+    readonly readSetContext: ReadSetContext;
 }
 /**
  * Builds the cluster from what the context carries, or returns `null` when

package/dist/local/client/storeCluster.js

@@ -24,6 +24,7 @@ import { createInternalComponents, } from './createInternalComponents.js';
 import { registerModelsFromSchema } from './modelRegistration.js';
 import { deriveConfigFromSchema } from './schemaConfig.js';
 import { createDefaultMutationExecutor } from './wsMutationExecutor.js';
+import { createReadSetContext, } from '@abloatai/transaction/internal/read-set';
 /**
  * The private handoff slot on the humans surface. Symbol-keyed on purpose:
  * surface members merge onto the client by string key, and the cluster is
@@ -70,6 +71,7 @@ export function buildStoreCluster(context) {
         return null;
     }
     const schema = options.schema;
+    const readSetContext = createReadSetContext();
     // Config derives from the schema; caller-supplied overrides layer on top,
     // caller winning per key.
     const config = {
@@ -80,7 +82,7 @@ export function buildStoreCluster(context) {
     // connection; before it opens, sends reject with the diagnosed not-ready
     // error and the MutationQueue owns the retry. A caller-supplied executor
     // still wins (test mocks, alternative transports).
-    const executor = options.mutationExecutor ?? createDefaultMutationExecutor(() => transport);
+    const executor = options.mutationExecutor ?? createDefaultMutationExecutor(() => transport, readSetContext);
     // This client's runtime — the instance the whole graph is constructed
     // with, so two clients in one process never read each other's logger,
     // config, or executor. `getModelMetadata` closes over this client's own
@@ -129,5 +131,5 @@ export function buildStoreCluster(context) {
     // Collaboration vocabulary is the application's: the SDK subscribes to
     // the event types the caller declares and to nothing by default.
     { collaborationEvents: options.collaborationEvents ?? [] });
-    return { runtime, components, store };
+    return { runtime, components, store, readSetContext };
 }