@abloatai/humans 0.60.0 → 0.62.0

package/src/local/sync/SyncWebSocket.ts

@@ -36,7 +36,6 @@ export type {
   SyncCapabilities,
   BootstrapHint,
   BootstrapDataEvent,
-  PresenceUpdate,
   CoreSyncEventMap,
   DefaultCollaborationEvents,
   EventMap,
@@ -129,14 +128,10 @@ export class SyncWebSocket<
 
   /**
    * The open ritual, run by the transport between its `connected` emit and the
-   * heartbeat start: announce presence, tell the server where we left off,
+   * heartbeat start: tell the server where we left off,
    * request the deltas we missed, and start the catch-up poll.
    */
   protected override onOpened(): void {
-    // Send presence update with timezone (server sets presence to "online" on connect,
-    // this improves localTime accuracy by providing the user's actual timezone)
-    this.sendPresenceUpdate('online');
-
     // Immediately request incremental sync based on our stored cursor.
     // `requestIncrementalSync` is async — a bare call inside try/catch is a
     // rejection hole (the catch never sees it); route failures through
@@ -323,42 +318,6 @@ export class SyncWebSocket<
     this.sendAck(syncId);
   }
 
-  /**
-   * Send presence update to server.
-   * Use this for:
-   * - Updating timezone (improves localTime accuracy shown to other users)
-   * - Manual status changes (away, custom status)
-   *
-   * Note: "online" status is automatically set by server on WebSocket connect,
-   * and "offline" is set on disconnect. You don't need to call this for basic online/offline.
-   *
-   * @param status - "online", "away", or custom status string
-   * @param customStatus - Optional custom status message
-   */
-  sendPresenceUpdate(
-    status: 'online' | 'away' | 'offline' = 'online',
-    customStatus?: string
-  ): void {
-    if (!this.isConnected()) return;
-
-    const timezone = (() => {
-      try {
-        return Intl.DateTimeFormat().resolvedOptions().timeZone;
-      } catch {
-        return 'UTC';
-      }
-    })();
-
-    this.send({
-      type: 'presence_update',
-      payload: {
-        status,
-        timezone,
-        ...(customStatus ? { customStatus } : {}),
-      },
-    });
-  }
-
   /**
    * Stop the periodic catchup interval
    */

package/src/local/sync/contextOnChange.ts

@@ -54,7 +54,7 @@ export function contextOnChange(
   // already advanced this exact row in the pool.
   for (const read of rowReads) {
     const resident = pool.peek(read.id);
-    if (!resident || resident.getModelName().toLowerCase() !== read.model.toLowerCase()) {
+    if (resident?.getModelName().toLowerCase() !== read.model.toLowerCase()) {
       continue;
     }
     const observed = pool.watermarks.of(resident);

package/src/local/sync/createClaimStream.ts

@@ -5,10 +5,8 @@
  * everyone else's, and watch the wait queue when a claim is contended.
  *
  * The stream is built directly on the sync WebSocket and shares that one
- * connection. It learns about other participants' claims from the same
- * `presence_update` frames the {@link createPresenceStream} presence stream
- * consumes — the server piggybacks each participant's `activeClaims` on every
- * presence frame — and sends its own claims as `claim_begin` and
+ * connection. It learns about other sessions' claims from the normalized
+ * presence projection and sends its own claims as `claim_begin` and
  * `claim_abandon` frames.
  *
  * Wire frames:
@@ -16,16 +14,15 @@
  *       entityId, description, field?, estimatedMs? }`.
  *   • Outbound `claim_abandon` — release it: `{ claimId, entityType?,
  *       entityId? }`.
- *   • Inbound, via presence — `event.activeClaims`, each stamped with
- *       `declaredAt` and `expiresAt`.
+ *   • Inbound, via presence — authoritative `claim` activities.
  *   • Inbound `claim_rejected` — the server refused the claim, with conflict
  *       metadata.
  */
 
 import type {
   WsTransport,
-  PresenceUpdate,
 } from '@abloatai/transaction/transport/websocket';
+import type { PresenceSession } from '@abloatai/transaction/presence';
 import type {
   ClaimOptions,
   ClaimTarget,
@@ -79,12 +76,15 @@ function claimLabel(type: string, id: string, field?: string): string {
 }
 
 export interface ClaimStreamConfig {
-  /** Identity used to filter our own active claims out of `others`. */
-  participantId: string;
   /** Where the coordination trace is logged. Defaults to silent. */
   logger?: Logger;
 }
 
+export interface ClaimPresenceSource {
+  readonly others: readonly PresenceSession[];
+  onChange(listener: () => void): () => void;
+}
+
 /**
  * How long a heartbeat waits for its `claim_heartbeat_ack` before giving up
  * as transient (the auto-heartbeat loop's next tick retries). Comfortably
@@ -107,14 +107,6 @@ export interface AttachableClaimStream extends ClaimStream {
    */
   claim(target: PresenceTarget, opts?: ClaimOptions, claimId?: string): Claim;
   attach(transport: ClaimTransport): void;
-  /**
-   * Seeds the participant identity once the host resolves it. The stream can
-   * be built before identity is known — a hosted client learns who it is
-   * from its credential's scope during connect — and until then the
-   * construction-time id (possibly empty) would let the participant's own
-   * claims into `others`. Idempotent; later frames filter on the new id.
-   */
-  setParticipant(participant: { id: string }): void;
   dispose(): void;
 }
 
@@ -144,10 +136,8 @@ interface OwnGrant {
 export function createClaimStream(
   config: ClaimStreamConfig,
   transport: ClaimTransport | null = null,
+  presence: ClaimPresenceSource | null = null,
 ): AttachableClaimStream {
-  // Mutable: the host seeds the resolved identity via `setParticipant` once
-  // it is known; the own-claim filter always reads the current value.
-  let participantId = config.participantId;
   const logger = config.logger ?? noopLogger;
 
   // ── State: others' open claims, keyed by claimId ───────────────
@@ -247,54 +237,7 @@ export function createClaimStream(
     if (attached) return;
     attached = t;
 
-    // (1) Inbound presence frames carry every participant's full
-    //     active-claim set. Prune previous claims by holder, then
-    //     re-add from the frame — the frame is authoritative for that
-    //     participant's open claims at that moment.
-    unsubs.push(
-      t.subscribe('presence_update', (event: PresenceUpdate) => {
-        if (!event.userId) return;
-        if (event.userId === participantId) return;
-
-        let mutated = false;
-
-        if (event.kind === 'leave') {
-          for (const [id, claim] of activeByClaimId) {
-            if (claim.heldBy === event.userId) {
-              activeByClaimId.delete(id);
-              mutated = true;
-            }
-          }
-          if (mutated) notifyListeners();
-          return;
-        }
-
-        for (const [id, claim] of activeByClaimId) {
-          if (claim.heldBy === event.userId) {
-            activeByClaimId.delete(id);
-            mutated = true;
-          }
-        }
-        for (const claim of event.activeClaims ?? []) {
-          // Terminal-status entries (committed / expired / canceled) are
-          // one-shot "this claim ended" signals. The holder sweep above
-          // already removed the prior active entry; skipping the re-add
-          // drops it from `others`, which is what resolves a contender's
-          // `settled()`. Absent status means active (wire back-compat).
-          if (claim.status && claim.status !== 'active') continue;
-          observeForeignClaim(
-            event.userId,
-            claim,
-            event.participantKind,
-            event.isAgent,
-          );
-          mutated = true;
-        }
-        if (mutated) notifyListeners();
-      }),
-    );
-
-    // (2) Server-side rejection frames.
+    // Server-side rejection frames.
     unsubs.push(
       t.subscribe('claim_rejected', (rejection) => {
         if (!rejection.claimId) return;
@@ -468,7 +411,7 @@ export function createClaimStream(
         }
         ownClaims.clear();
         for (const claimId of [...pendingHeartbeats.keys()]) {
-          settleHeartbeat(claimId, ({ reject }) => reject(error));
+          settleHeartbeat(claimId, ({ reject }) => { reject(error); });
         }
       }),
     );
@@ -476,6 +419,46 @@ export function createClaimStream(
 
   if (transport) attach(transport);
 
+  const refreshPresenceClaims = (): void => {
+    if (presence === null) return;
+    activeByClaimId.clear();
+    for (const session of presence.others) {
+      for (const activity of session.activities) {
+        if (
+          activity.operation !== 'claim'
+          || activity.source !== 'claim'
+          || activity.target.id === undefined
+        ) continue;
+        const claimId = activity.id.startsWith('claim:')
+          ? activity.id.slice('claim:'.length)
+          : activity.id;
+        observeForeignClaim(
+          session.participant.id,
+          {
+            claimId,
+            entityType: activity.target.model,
+            entityId: activity.target.id,
+            ...(activity.target.field !== undefined
+              ? { field: activity.target.field }
+              : {}),
+            ...(activity.target.fields !== undefined
+              ? { fields: activity.target.fields }
+              : {}),
+            description: 'claim',
+            declaredAt: Date.parse(activity.startedAt),
+            expiresAt: Date.parse(activity.expiresAt),
+          },
+          session.participant.kind,
+        );
+      }
+    }
+    notifyListeners();
+  };
+  if (presence !== null) {
+    refreshPresenceClaims();
+    unsubs.push(presence.onChange(refreshPresenceClaims));
+  }
+
   // ── Outbound ────────────────────────────────────────────────────
   function sendBegin(claimId: string, claim: OwnClaim): void {
     if (!attached?.isConnected()) return;
@@ -705,9 +688,6 @@ export function createClaimStream(
       );
     },
     attach,
-    setParticipant(participant: { id: string }): void {
-      participantId = participant.id;
-    },
     dispose(): void {
       for (const off of unsubs) off();
       unsubs.length = 0;

package/src/local/sync/deltaPipeline.ts

@@ -173,7 +173,9 @@ export function deduplicateDeltas(deltas: SyncDelta[]): SyncDelta[] {
 
   let strictlyOrdered = true;
   for (let index = 1; index < deltas.length; index += 1) {
-    if (deltas[index - 1]!.id >= deltas[index]!.id) {
+    const previous = deltas[index - 1];
+    const current = deltas[index];
+    if (!previous || !current || previous.id >= current.id) {
       strictlyOrdered = false;
       break;
     }
@@ -400,10 +402,12 @@ export function sliceApplyChanges<T extends { readonly transactionId?: string }>
   while (index < changes.length) {
     // The indivisible unit starting here: one transaction's run, or a single
     // untransacted change.
-    const transactionId = changes[index]!.transactionId;
+    const change = changes[index];
+    if (!change) break;
+    const transactionId = change.transactionId;
     let end = index + 1;
     if (transactionId !== undefined) {
-      while (end < changes.length && changes[end]!.transactionId === transactionId) end += 1;
+      while (changes[end]?.transactionId === transactionId) end += 1;
     }
     const groupSize = end - index;
     if (current.length > 0 && current.length + groupSize > maxDeltas) {
@@ -459,9 +463,10 @@ async function flushDeltaBatchInner(
   if (customDeltas.length > 0) {
     runInAction(() => {
       for (const delta of customDeltas) {
+        if (delta.data === null) continue;
         const data = typeof delta.data === 'string'
           ? (JSON.parse(delta.data) as Record<string, unknown>)
-          : (delta.data!);
+          : delta.data;
 
         // 'C' (Covering) is treated identically to 'I' here — the client
         // gained permission to see the entity, so we insert it into the
@@ -529,7 +534,7 @@ async function flushDeltaBatchInner(
     // slice. Slices stay the atomicity unit; the budget only decides where
     // the loop breathes.
     let sliceStartedAt = performance.now();
-    for (let index = 0; index < slices.length; index++) {
+    for (const [index, slice] of slices.entries()) {
       if (index > 0 && performance.now() - sliceStartedAt > APPLY_YIELD_BUDGET_MS) {
         pipelineDebug.phase = `apply-yield-${index}`;
         pipelineDebug.applyYields += 1;
@@ -538,7 +543,6 @@ async function flushDeltaBatchInner(
       }
       pipelineDebug.phase = `apply-slice-${index}`;
       pipelineDebug.applySlices += 1;
-      const slice = slices[index]!;
       if (hasApplyPlugins) {
         runStage(stagePlugins, 'apply', { changes: slice });
       } else {

package/src/local/sync/socketEventWiring.ts

@@ -9,7 +9,6 @@ import type { SyncStatus } from '../storeContract.js';
 import type {
   BootstrapHint,
   BootstrapDataEvent,
-  PresenceUpdate,
   SyncWebSocket,
   EventMap,
 } from './SyncWebSocket.js';
@@ -31,7 +30,6 @@ export interface SocketEventHost<TCollaboration extends EventMap<TCollaboration>
   applyDeltaFrame(deltas: SyncDelta[]): void;
   handleBootstrapRequired(hint: BootstrapHint): void;
   handleBootstrapData(data: BootstrapDataEvent): void;
-  handlePresenceUpdate(data: PresenceUpdate): void;
   performCredentialRefresh(): Promise<'refreshed' | 'session_error' | 'network_error'>;
   handleTerminalSessionError(error: Error): void;
   nudgeReconnect(): void;
@@ -93,11 +91,6 @@ export function wireSocketEvents<TCollaboration extends EventMap<TCollaboration>
       deps.handleBootstrapData(data);
     });
 
-    const onPresenceUpdate = deps.syncWebSocket.subscribe('presence_update', (...args) => {
-      const data = args[0];
-      deps.handlePresenceUpdate(data);
-    });
-
     // Error events
     const onError = deps.syncWebSocket.subscribe('error', (error: Error) => {
       if (error.message === 'Network is offline' || error.message === 'WebSocket connection failed') {
@@ -189,7 +182,7 @@ export function wireSocketEvents<TCollaboration extends EventMap<TCollaboration>
     deps.disposers.push(
       onConnected, onDisconnected, onReconnecting,
       onDelta, onDeltaBatch, onBootstrapRequired,
-      onBootstrapData, onPresenceUpdate,
+      onBootstrapData,
       onError, onSessionError, onHandshakeFailed, onReconnectFailed,
       () => { deps.areaOfInterest.dispose(); },
     );

package/src/local/transactions/localMutation.ts

@@ -35,11 +35,11 @@ export function createLocalMutationPort(
   return {
     updates,
     applyCreate: (model, transaction) =>
-      track('optimistic:create', model, transaction),
+      { track('optimistic:create', model, transaction); },
     applyUpdate: (model, transaction) =>
-      track('optimistic:update', model, transaction),
+      { track('optimistic:update', model, transaction); },
     applyDelete: (model, transaction) =>
-      track('optimistic:delete', model, transaction),
+      { track('optimistic:delete', model, transaction); },
     rollback: (transaction, reason, error) => {
       const optimistic = updates.get(transaction.id);
       if (!optimistic) return Promise.resolve();

package/src/local/transactions/mutations/MutationQueue.ts

@@ -108,12 +108,8 @@ import { enqueueTransaction, type QueueCoalescingContext } from './queueCoalesci
 import { processBatch, type BatchProcessingContext } from './batchProcessing.js';
 import { handleFailure, type FailureHandlingContext } from './failureHandling.js';
 import { handleConflict as resolveConflict, isPermanentError as classifyPermanentError, isDefinitiveRejection as classifyDefinitiveRejection, type ConflictResolutionContext } from './failurePolicy.js';
-import { takeNextExecutionBatch as selectExecutionBatch, takePendingDrainBatch as selectPendingDrainBatch } from './executionSelection.js';
+import { takeNextExecutionBatch as selectExecutionBatch } from './executionSelection.js';
 import { scheduleProcessing as scheduleProcessingExternal, type ProcessingSchedulerContext } from './processingScheduler.js';
-import {
-  drainPendingConfirmations,
-  type PendingDrainContext,
-} from './pendingDrain.js';
 import { restoreDurableCommits as restoreDurableCommitsExternal, type DurableCommitRestoreContext } from './durableCommitRestore.js';
 
 // The queue is split across sibling modules (`commitPayload`,
@@ -244,6 +240,7 @@ export class MutationQueue extends EventEmitter {
   }[] = [];
   private persistenceStageScheduled = false;
   private pendingDrainPromise: Promise<void> | null = null;
+  private modelProcessingPromise: Promise<void> | null = null;
 
   private executionQueue: QueuedMutation[] = [];
   private isProcessing = false;
@@ -496,33 +493,6 @@ export class MutationQueue extends EventEmitter {
     };
   }
 
-  private get pendingDrainContext(): PendingDrainContext {
-    return {
-      runtime: this.runtime,
-      config: { deltaConfirmationTimeout: this.config.deltaConfirmationTimeout },
-      store: this.store,
-      executionQueue: this.executionQueue,
-      optimisticUpdates: this.localMutationPort.updates,
-      assertDurableReplayOpen: () => { this.assertDurableReplayOpen(); },
-      processCommitLane: () => this.processCommitLane(),
-      takePendingDrainBatch: (pending) => this.takePendingDrainBatch(pending),
-      ensureCommitEnvelope: (batch) => this.ensureCommitEnvelope(batch),
-      ensureDerivedFields: (transaction) => { this.ensureDerivedFields(transaction); },
-      sourceMutationIdsFor: (batch) => this.sourceMutationIdsFor(batch),
-      sealDurableCommit: (input) => this.sealDurableCommit(input),
-      assertEnvelopeInsideReplayWindow: (envelope) => { this.assertEnvelopeInsideReplayWindow(envelope); },
-      parseMutationCommitResult: (value) => this.parseMutationCommitResult(value),
-      dispatchCommitBounded: (...args) => this.dispatchCommitBounded(...args),
-      persistDurableCommitAcceptance: (envelope, result) => this.persistDurableCommitAcceptance(envelope, result),
-      removeDurableCommit: (idempotencyKey) => this.removeDurableCommit(idempotencyKey),
-      scheduleReplicationLagTimeout: (transactionId, clientTxId, correlationId) => { this.scheduleReplicationLagTimeout(transactionId, clientTxId, correlationId); },
-      scheduleDeltaConfirmationTimeout: (transaction, timeoutMs) => { this.scheduleDeltaConfirmationTimeout(transaction, timeoutMs); },
-      enqueue: (transaction) => { this.enqueue(transaction); },
-      recentDeltaCorrelations: this.recentDeltaCorrelations,
-      emit: (event, payload) => this.emit(event, payload),
-    };
-  }
-
   private get durableCommitRestoreContext(): DurableCommitRestoreContext {
     return {
       config: this.config,
@@ -1064,10 +1034,6 @@ export class MutationQueue extends EventEmitter {
     return selected.batch;
   }
 
-  private takePendingDrainBatch(pending: QueuedMutation[]): QueuedMutation[] {
-    return selectPendingDrainBatch(pending, this.config.maxBatchSize);
-  }
-
   /**
    * Resolvers for per-transaction `confirmation` promises. Populated in
    * `attachConfirmation` at staging time, consumed by the constructor-time
@@ -1361,22 +1327,15 @@ export class MutationQueue extends EventEmitter {
   }
 
   private async drainPendingInternal(): Promise<void> {
-    // The normal batch scheduler and the explicit/reconnect drain are two
-    // ways to drive the same durable queue. They must never seal the same
-    // staged source records concurrently: the first seal consumes those
-    // records, so the second would correctly reject them as already claimed.
-    //
-    // `isProcessing` is acquired synchronously before either path awaits,
-    // making it the queue-wide execution lock. If the normal lane already
-    // owns it, that lane will finish the pending work; callers waiting on a
-    // specific confirmation remain attached to the exact transaction.
-    if (this.isProcessing) return;
-    this.isProcessing = true;
-    try {
-      await drainPendingConfirmations(this.pendingDrainContext);
-    } finally {
-      this.isProcessing = false;
-      if (this.executionQueue.length > 0) this.scheduleProcessing(true);
+    // Explicit flushes and reconnects are merely another trigger for the one
+    // model-mutation execution lane. A second sealing implementation can race
+    // the scheduled lane, consume its journal sources, and later dispatch the
+    // same transaction again. Move every staged row to the owned queue, then
+    // drive the normal lane until the queue has handed off all current work.
+    this.commitCreatedTransactions();
+    await this.processCommitLane();
+    while (this.executionQueue.length > 0 || this.modelProcessingPromise) {
+      await this.processBatch();
     }
   }
   async create(
@@ -1445,7 +1404,19 @@ export class MutationQueue extends EventEmitter {
   }
 
   private async processBatch(): Promise<void> {
-    await processBatch(this.batchProcessingContext);
+    if (this.modelProcessingPromise) {
+      await this.modelProcessingPromise;
+      if (this.executionQueue.length > 0) await this.processBatch();
+      return;
+    }
+    const processing = processBatch(this.batchProcessingContext);
+    const tracked = processing.finally(() => {
+      if (this.modelProcessingPromise === tracked) {
+        this.modelProcessingPromise = null;
+      }
+    });
+    this.modelProcessingPromise = tracked;
+    await tracked;
   }
 
   private rememberDeltaCorrelation(correlationId: string, syncId: number): void {

package/src/local/transactions/mutations/batchProcessing.ts

@@ -133,16 +133,31 @@ export async function processBatch(ctx: BatchProcessingContext): Promise<void> {
           if (batchOps.length > 0) {
             let dispatchStarted = false;
             try {
-              const durableEnvelope = await ctx.sealDurableCommit({
-                idempotencyKey: commitIdempotencyKey,
-                origin: 'model_batch',
-                operations: batchOps.map(({ op }) => op),
-                sourceMutationIds: ctx.sourceMutationIdsFor(batch),
-                commitOptions: { reads: collectQueuedReads(batch) },
-                createdAt: Math.min(...batch.map((transaction) => transaction.createdAt)),
-                sealedAt: batch[0]?.commitEnvelope?.sealedAt ?? Date.now(),
-                sequence: batch[0]?.commitEnvelope?.sequence,
-              });
+              let durableEnvelope = batch[0]?.durableEnvelope;
+              if (durableEnvelope) {
+                const mismatched = batch.some(
+                  (transaction) =>
+                    transaction.durableEnvelope?.idempotencyKey !==
+                    durableEnvelope?.idempotencyKey,
+                );
+                if (mismatched || durableEnvelope.idempotencyKey !== commitIdempotencyKey) {
+                  throw new Error('Cannot replay a model batch with inconsistent durable envelopes');
+                }
+              } else {
+                durableEnvelope = await ctx.sealDurableCommit({
+                  idempotencyKey: commitIdempotencyKey,
+                  origin: 'model_batch',
+                  operations: batchOps.map(({ op }) => op),
+                  sourceMutationIds: ctx.sourceMutationIdsFor(batch),
+                  commitOptions: { reads: collectQueuedReads(batch) },
+                  createdAt: Math.min(...batch.map((transaction) => transaction.createdAt)),
+                  sealedAt: batch[0]?.commitEnvelope?.sealedAt ?? Date.now(),
+                  sequence: batch[0]?.commitEnvelope?.sequence,
+                });
+                for (const transaction of batch) {
+                  transaction.durableEnvelope = durableEnvelope;
+                }
+              }
               const operations = durableEnvelope.operations;
 
               // Capture lastSyncId from the server response for threshold-based

package/src/local/transactions/mutations/commitPayload.ts

@@ -14,7 +14,10 @@ import type { RuntimeContext } from '../../RuntimeContext.js';
 import { MutationOperationType } from '@abloatai/transaction/types';
 import { snapshotJsonValue } from '@abloatai/transaction/utils/json';
 import type { MutationOptions, WriteOptions } from '../../interfaces/index.js';
-import type { CommitEnvelopeMember } from '@abloatai/transaction/commit';
+import type {
+  CommitEnvelopeMember,
+  DurableCommitEnvelope,
+} from '@abloatai/transaction/commit';
 
 export interface UserContext {
   userId: string;
@@ -123,6 +126,13 @@ export interface QueuedMutation {
    * re-batching its operations under a fresh key.
    */
   commitEnvelope?: CommitEnvelopeMember;
+  /**
+   * The exact durable request produced by the first successful local seal.
+   * Runtime retries dispatch this object directly. Asking the outbox to seal
+   * again is both unnecessary and unsafe after a concurrent authoritative
+   * completion has begun cleaning up the stored envelope.
+   */
+  durableEnvelope?: DurableCommitEnvelope;
   /** Pending-mutation journal entries atomically consumed by this envelope. */
   sourceMutationIds?: string[];
   /** Completed locally without a server operation; no sync echo will arrive. */

package/src/local/transactions/mutations/commitTransport.ts

@@ -158,10 +158,10 @@ export function dispatchCommitBounded(
   const timeoutMs = ctx.config.commitDispatchTimeoutMs;
   if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) return dispatched;
   return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => reject(new AbloConnectionError(
+    const timer = setTimeout(() => { reject(new AbloConnectionError(
       'The mutation transport did not acknowledge the commit in time; its outcome remains pending and is safe to retry.',
       { code: 'commit_no_result' },
-    )), timeoutMs);
+    )); }, timeoutMs);
     dispatched.then(
       (value) => { clearTimeout(timer); resolve(value); },
       (error) => { clearTimeout(timer); reject(error instanceof Error ? error : new Error(String(error))); },

package/src/local/transactions/mutations/executionSelection.ts

@@ -4,8 +4,12 @@ export function takeNextExecutionBatch(
   executionQueue: QueuedMutation[],
   maxBatchSize: number,
 ): { batch: QueuedMutation[]; remaining: QueuedMutation[] } {
+  // Cancellation, delta confirmation, and failure settlement can all make a
+  // queued reference terminal before its scheduler callback runs. Terminal or
+  // currently executing rows have no authority to cross the dispatch boundary.
+  const pendingQueue = executionQueue.filter((tx) => tx.status === 'pending');
   const retryGroups = new Map<string, Map<string, QueuedMutation>>();
-  for (const tx of executionQueue) {
+  for (const tx of pendingQueue) {
     const envelope = tx.commitEnvelope;
     if (!envelope) continue;
     const group = retryGroups.get(envelope.idempotencyKey) ?? new Map<string, QueuedMutation>();
@@ -16,27 +20,17 @@ export function takeNextExecutionBatch(
     const members = [...byId.values()];
     const expectedCount = members[0]?.commitEnvelope?.operationCount;
     if (expectedCount === undefined || members.length !== expectedCount) continue;
-    const remaining = executionQueue.filter((tx) => tx.commitEnvelope?.idempotencyKey !== idempotencyKey);
+    const remaining = pendingQueue.filter((tx) => tx.commitEnvelope?.idempotencyKey !== idempotencyKey);
     members.sort((a, b) => (a.commitEnvelope?.operationIndex ?? 0) - (b.commitEnvelope?.operationIndex ?? 0));
     return { batch: members, remaining };
   }
-  const fresh = executionQueue.filter((tx) => !tx.commitEnvelope);
+  const fresh = pendingQueue.filter((tx) => !tx.commitEnvelope);
   const firstFresh = fresh[0];
-  if (!firstFresh) return { batch: [], remaining: executionQueue };
+  if (!firstFresh) return { batch: [], remaining: pendingQueue };
   const explicitIndex = fresh.findIndex((tx) => typeof tx.writeOptions?.idempotencyKey === 'string');
   const selected = explicitIndex === 0
     ? [firstFresh]
     : fresh.slice(0, Math.min(maxBatchSize, explicitIndex > 0 ? explicitIndex : fresh.length));
   const selectedIds = new Set(selected.map((tx) => tx.id));
-  return { batch: selected, remaining: executionQueue.filter((tx) => !selectedIds.has(tx.id)) };
-}
-
-export function takePendingDrainBatch(pending: QueuedMutation[], maxBatchSize: number): QueuedMutation[] {
-  const first = pending[0];
-  if (!first) return [];
-  const envelope = first.commitEnvelope;
-  if (envelope) return pending.filter((tx) => tx.commitEnvelope?.idempotencyKey === envelope.idempotencyKey);
-  if (typeof first.writeOptions?.idempotencyKey === 'string') return [first];
-  const explicitIndex = pending.findIndex((tx) => typeof tx.writeOptions?.idempotencyKey === 'string');
-  return pending.slice(0, Math.min(maxBatchSize, explicitIndex > 0 ? explicitIndex : pending.length));
+  return { batch: selected, remaining: pendingQueue.filter((tx) => !selectedIds.has(tx.id)) };
 }

package/src/local/transactions/mutations/failureHandling.ts

@@ -44,6 +44,16 @@ export async function handleFailure(
   transaction: QueuedMutation,
   error: Error,
 ): Promise<void> {
+  // The dispatch owner may lose its acknowledgement while an authoritative
+  // delta concurrently completes the same transaction. Completion is
+  // terminal: a late catch path must not turn that row back into `pending`
+  // and schedule a second seal after its durable sources were cleaned up.
+  if (
+    transaction.status === 'completed' ||
+    transaction.status === 'failed' ||
+    transaction.status === 'rolled_back' ||
+    transaction.status === 'awaiting_delta'
+  ) return;
   transaction.attempts++;
 
   // Check whether this is a permanent error that should not be retried.

package/src/local/transactions/mutations/localMutation.ts

@@ -43,9 +43,9 @@ export function createLocalMutationPort(emitter: OptimisticEmitter): LocalMutati
   const updates = new Map<string, OptimisticUpdateEntry>();
   return {
     updates,
-    applyCreate: (model, transaction) => applyOptimisticCreate(updates, emitter, model, transaction),
-    applyUpdate: (model, transaction) => applyOptimisticUpdate(updates, emitter, model, transaction),
-    applyDelete: (model, transaction) => applyOptimisticDelete(updates, emitter, model, transaction),
+    applyCreate: (model, transaction) => { applyOptimisticCreate(updates, emitter, model, transaction); },
+    applyUpdate: (model, transaction) => { applyOptimisticUpdate(updates, emitter, model, transaction); },
+    applyDelete: (model, transaction) => { applyOptimisticDelete(updates, emitter, model, transaction); },
     rollback: (transaction, reason, error) => rollbackOptimistic(updates, emitter, transaction, reason, error),
   };
 }