@abloatai/transaction 0.57.0 → 0.58.0

package/src/observability.ts

@@ -1,8 +1,8 @@
 /**
  * The observability the confirmation core reports on its own behalf.
  *
- * Coordination outcomes — a claim changing state, a stale-write collision that
- * notified instead of aborting — happen with no UI and no local store anywhere,
+ * Coordination outcomes — a claim changing state or a rejected write collision
+ * — happen with no UI and no local store anywhere,
  * so the core must be able to report them without depending on the consumer's
  * full provider (ADR 0016).
  *
@@ -11,13 +11,13 @@
  * this interface, so a single implementation still satisfies both.
  */
 
-import type { ClaimEvent, ConflictEvent } from './coordination/events.js';
+import type { ClaimEvent, ConflictEvent } from './claims/events.js';
 
 export interface CoordinationObservability {
   /** Capture a claim state change (acquired / queued / granted / lost / rejected / expired). */
   captureClaim(event: ClaimEvent): void;
 
-  /** Capture a notify-instead-of-abort stale-write collision. */
+  /** Capture a rejected stale-write or foreign-claim collision. */
   captureConflict(event: ConflictEvent): void;
 }
 

package/src/{wire/delta.ts → observation/contract.ts}

@@ -6,7 +6,7 @@
  * layer, alongside the other protocol shapes in `wire/`.
  *
  * The wire delta is a projection of the stored `sync_deltas` row (the
- * `syncDeltaRowSchema` in `../log/syncDeltaRow.ts`) and differs from it
+ * `syncDeltaRowSchema` in `./persistence/syncDeltaRow.ts`) and differs from it
  * in three ways: it omits `organizationId` (the tenant-isolation predicate is
  * never broadcast), it uses the full action vocabulary (see
  * {@link syncDeltaActionSchema}) rather than plain create, update, and delete, and
@@ -26,7 +26,7 @@
  */
 
 import { z } from 'zod';
-import { correlationIdSchema } from './commit.js';
+import { correlationIdSchema } from '../commit/contract.js';
 import { participantKindSchema } from '../coordination/schema.js';
 import type { ParticipantKind, ParticipantRef } from '../types/participant.js';
 import type { AssertExact } from '../types/assertExact.js';

package/src/{wire/feedEvent.ts → observation/feedContract.ts}

@@ -14,9 +14,9 @@
  */
 
 import { z } from 'zod';
-import { logEventSchema, logOpSchema, type LogEvent } from './accountResponses.js';
-import { claimEventSchema, type ClaimEvent } from './claimEvent.js';
-import { listEnvelopeSchema, type ListEnvelope } from './listEnvelope.js';
+import { logEventSchema, logOpSchema, type LogEvent } from '../wire/accountResponses.js';
+import { claimEventSchema, type ClaimEvent } from '../claims/eventContract.js';
+import { listEnvelopeSchema, type ListEnvelope } from '../wire/listEnvelope.js';
 
 /**
  * One entry, from either source. Discriminated on `object`, so a consumer
@@ -71,4 +71,3 @@ export type LogQuery = z.infer<typeof logQuerySchema>;
  * What is here is the definition the producer will fill: the union parses
  * today's pages unchanged, and the cursor already carries the second position.
  */
-

package/src/{transport → observation}/httpFeed.ts

@@ -1,9 +1,9 @@
-import { formatFeedCursor, parseFeedCursor } from '../wire/feedCursor.js';
-import type { HttpLogsResource } from '../resources/httpResources.js';
+import { formatFeedCursor, parseFeedCursor } from './cursor.js';
+import type { HttpLogsResource } from '../client/resources/httpResources.js';
 import type {
   ObserveOptions,
   ObservedDelta,
-} from '../transactionLayer.js';
+} from '../client/contract.js';
 
 const DEFAULT_PAGE_SIZE = 100;
 const DEFAULT_POLL_INTERVAL_MS = 500;

package/src/observation/index.ts

@@ -0,0 +1,12 @@
+/**
+ * Observation subsystem.
+ *
+ * Start here and descend through delta contracts, feed contracts, cursor
+ * handling, delivery inspection, HTTP polling, and persisted row projection.
+ */
+export * from './contract.js';
+export * from './cursor.js';
+export * from './feedContract.js';
+export * from './deliveryContract.js';
+export * from './httpFeed.js';
+export * from './persistence/syncDeltaRow.js';

package/src/{log → observation/persistence}/syncDeltaRow.ts

@@ -16,25 +16,25 @@
  * incorrectly as a physical-residency guarantee.
  *
  * This is the stored shape. The delta broadcast to clients is a narrower projection
- * of it — see {@link import('../wire/delta.js').syncDeltaWireCoreSchema} — and
+ * of it — see {@link import('../contract.js').syncDeltaWireCoreSchema} — and
  * the field names here mirror those on that wire delta.
  */
 
 import { z } from 'zod';
-import type { ModelResidency } from '../schema/residency.js';
+import type { ModelResidency } from '../../schema/residency.js';
 import {
   participantKindSchema,
   confirmationStateSchema,
   syncDeltaActionSchema,
-} from '../wire/delta.js';
+} from '../contract.js';
 
 // ── Enumerations that mirror the corresponding Postgres enum types ────────────
 
 // `participant_kind` and `confirmation_state` are shared with the wire delta and
-// live at the wire layer (see `../wire/delta.js`); they are re-exported here so
+// live in the observation contract (see `../contract.js`); they are re-exported here so
 // code that imports them from `schema` keeps resolving.
-export { participantKindSchema, confirmationStateSchema } from '../wire/delta.js';
-export type { ParticipantKind, ConfirmationState } from '../wire/delta.js';
+export { participantKindSchema, confirmationStateSchema } from '../contract.js';
+export type { ParticipantKind, ConfirmationState } from '../contract.js';
 
 /** `backfill_provenance` */
 export const backfillProvenanceSchema = z.enum(['exact', 'inferred', 'unknown']);
@@ -116,4 +116,3 @@ export const DELTA_PHYSICAL_STORAGE = {
   core: 'control',
   attribution: 'control',
 } as const satisfies Record<string, ModelResidency>;
-

package/src/pricing.ts

@@ -28,10 +28,9 @@
  * invoice, because raising one number does not fail anything that pins the
  * other.
  *
- * Storage is deliberately absent from {@link billableAxisSchema}. It is a real
- * recurring cost and it is quoted per tier as a ceiling, but no per-organization
- * bytes sampler emits it yet, and pricing a dimension nothing measures would be
- * a claim the invoice cannot support. Add the axis when the sampler ships.
+ * Audit-log storage is quoted as an included allowance plus Scale overage. It
+ * remains separate from the request meter because GiB-months come from a
+ * periodic storage sampler rather than an API event.
  */
 
 import { z } from 'zod';
@@ -47,7 +46,7 @@ export type { MeterEvent, PlanTier, RateBracket };
  * could observe the difference. It is emitted into the generated pricing
  * documentation so a stale copy is identifiable on sight.
  */
-export const PRICING_VERSION = '2026-07-31';
+export const PRICING_VERSION = '2026-08-24';
 
 /**
  * Resolve a stored plan string (`stripe_subscription.plan`) to a tier.
@@ -66,8 +65,8 @@ export function toPlanTier(plan: string | null | undefined): PlanTier {
 }
 
 /**
- * The axes a bill is actually computed from: `ops` is metered, `connections` is
- * capped. Storage is quoted but not billed, so it is not here.
+ * The request-time axes: `ops` is metered and `connections` is capped. Audit
+ * storage is sampled periodically, so it does not map from a request event.
  */
 export const billableAxisSchema = z.enum(['ops', 'connections']);
 export type BillableAxis = z.infer<typeof billableAxisSchema>;
@@ -184,11 +183,12 @@ const rateCardSchema = z
  * knob; the bracket structure is the contract.
  */
 export const OPS_RATE_CARD: readonly RateBracket[] = rateCardSchema.parse([
-  { throughOps: 50_000_000, usdPerMillionOps: 2.0 },
-  { throughOps: 500_000_000, usdPerMillionOps: 1.2 },
-  { throughOps: null, usdPerMillionOps: 0.6 },
+  { throughOps: null, usdPerMillionOps: 5 },
 ]);
 
+/** Scale audit-log storage above the included allowance, per GiB-month. */
+export const AUDIT_LOG_STORAGE_USD_PER_GIB_MONTH = 1;
+
 /**
  * A tier. `null` on a floor, a cap, or a quota means negotiated rather than
  * unlimited, and the runtime treats it as "no typed default, use the operator's
@@ -206,9 +206,9 @@ export const planDefinitionSchema = z.object({
    */
   monthlyMinimumUsd: z.number().nonnegative().nullable(),
   /**
-   * A hard monthly stop on operations. Set only where the tier is not billed at
-   * all: Free is capped rather than metered, so exceeding it is refused instead
-   * of invoiced. `null` on every metered tier.
+   * The no-billing monthly stop. On Free this is also the included allowance:
+   * organizations without billing enabled stop here, while organizations that
+   * enable billing pay only for operations above it. `null` on paid tiers.
    */
   hardCapOps: z.number().int().positive().nullable(),
   /**
@@ -220,7 +220,7 @@ export const planDefinitionSchema = z.object({
    * are billed rather than stopped.
    */
   hardCapOpsPerDay: z.number().int().positive().nullable(),
-  /** Quoted ceiling on stored data, in GiB. Not billed. `null` is negotiated. */
+  /** Included audit-log storage, in GiB. `null` means contract-priced capacity. */
   storageGib: z.number().positive().nullable(),
   /** Hard concurrent-connection cap, the real Free to Scale boundary. */
   maxConcurrentConnections: z.number().int().positive().nullable(),
@@ -240,7 +240,7 @@ export const PLANS = z
     free: {
       tier: 'free',
       label: 'Free',
-      summary: 'Build against the real engine without a card.',
+      summary: 'Free for early-stage teams building against the real engine.',
       monthlyMinimumUsd: 0,
       hardCapOps: 100_000,
       hardCapOpsPerDay: 10_000,
@@ -252,8 +252,8 @@ export const PLANS = z
     scale: {
       tier: 'scale',
       label: 'Scale',
-      summary: 'Production traffic, metered above a monthly floor.',
-      monthlyMinimumUsd: 20,
+      summary: 'Built for scaling teams with production traffic.',
+      monthlyMinimumUsd: 250,
       hardCapOps: null,
       hardCapOpsPerDay: null,
       storageGib: 50,
@@ -264,8 +264,8 @@ export const PLANS = z
     enterprise: {
       tier: 'enterprise',
       label: 'Enterprise',
-      summary: 'Committed volume, private networking, and an uptime guarantee.',
-      monthlyMinimumUsd: 2_000,
+      summary: 'Custom infrastructure, security, and support for critical workloads.',
+      monthlyMinimumUsd: 4_000,
       hardCapOps: null,
       hardCapOpsPerDay: null,
       storageGib: null,
@@ -336,8 +336,8 @@ export function opsForUsd(usd: number): number {
 }
 
 /**
- * The operations a tier includes, as shown on the pricing page. A capped tier
- * shows its cap; a metered tier shows what its floor covers, computed from the
+ * The operations a tier includes, as shown on the pricing page. Free shows its
+ * pay-as-you-go allowance; a tier with a floor shows what that floor covers, computed from the
  * floor rather than stored beside it. `null` where the terms are contractual.
  */
 export function monthlyOpsAllowance(tier: PlanTier): number | null {
@@ -348,17 +348,38 @@ export function monthlyOpsAllowance(tier: PlanTier): number | null {
 }
 
 /**
- * The invoice for a month: the floor, or the metered usage, whichever is
- * greater. A capped tier is never billed above its floor because the cap is
- * enforced before the usage exists. `null` where the terms are contractual.
+ * The invoice for a month. Free subtracts its included operations before
+ * applying the rate. Scale charges the floor or metered usage, whichever is
+ * greater. `null` where the terms are contractual.
  */
 export function monthlyBillUsd(tier: PlanTier, ops: number): number | null {
   const plan = PLANS[tier];
   if (plan.contractPriced || plan.monthlyMinimumUsd === null) return null;
-  if (plan.hardCapOps !== null) return plan.monthlyMinimumUsd;
+  if (plan.hardCapOps !== null) {
+    return roundUsd(usdForOps(Math.max(0, ops - plan.hardCapOps)));
+  }
   return roundUsd(Math.max(plan.monthlyMinimumUsd, usdForOps(ops)));
 }
 
+/**
+ * Audit-log storage overage for a month. Free and Scale meter only the GiB
+ * above their included amount, and Enterprise is priced in the contract.
+ */
+export function auditLogStorageBillUsd(tier: PlanTier, storageGib: number): number | null {
+  const plan = PLANS[tier];
+  if (plan.contractPriced || plan.storageGib === null) return null;
+  if (!Number.isFinite(storageGib)) return 0;
+  return roundUsd(Math.max(0, storageGib - plan.storageGib) * AUDIT_LOG_STORAGE_USD_PER_GIB_MONTH);
+}
+
+/** The complete published estimate across operation and audit-storage usage. */
+export function monthlyEstimateUsd(tier: PlanTier, ops: number, auditStorageGib: number): number | null {
+  const operationsBill = monthlyBillUsd(tier, ops);
+  const storageBill = auditLogStorageBillUsd(tier, auditStorageGib);
+  if (operationsBill === null || storageBill === null) return null;
+  return roundUsd(operationsBill + storageBill);
+}
+
 /**
  * The daily operations cap for a tier: the typed default the quota gate falls
  * back to when no `plan_limit` row sets one. `null` means the tier is metered

package/src/schema/index.ts

@@ -13,7 +13,7 @@
  *     status: z.enum(['todo', 'doing', 'done']).default('todo'),
  *     projectId: z.string().optional(),
  *   }, {
- *     project: relation.belongsTo('projects', 'projectId'),
+ *     relations: { project: relation.belongsTo('projects', 'projectId') },
  *   }),
  * });
  *
@@ -80,7 +80,7 @@ export {
   type ParticipantKind,
   type ConfirmationState,
   type BackfillProvenance,
-} from '../log/syncDeltaRow.js';
+} from '../observation/persistence/syncDeltaRow.js';
 
 // The wire delta contract — the server-to-client projection of the stored row.
 // Both the client SDK and the server derive their `SyncDelta` type from these with
@@ -98,7 +98,7 @@ export {
   type SyncDeltaWireCore,
   type ClientSyncDelta,
   type ServerSyncDelta,
-} from '../wire/delta.js';
+} from '../observation/contract.js';
 
 // Model builder
 export {
@@ -115,25 +115,8 @@ export {
   type PersistOptions,
   type RelationRecord,
   type GrantsRef,
-  type ConflictAxis,
 } from './model.js';
 
-// Coordination authoring helpers for the `conflict` axis — composable disposition
-// functions plus a combinator that merges them.
-export {
-  coordination,
-  humansOverwrite,
-  humansReject,
-  humansNotify,
-  agentsOverwrite,
-  agentsReject,
-  agentsNotify,
-  systemOverwrite,
-  systemReject,
-  systemNotify,
-  type ConflictRule,
-} from './coordination.js';
-
 // Claim-first shorthand for common model options: `mutable.lazy({...})` and friends
 // encode a model's write-safety and load strategy in the verb, and fall back to
 // sensible defaults for everything else.
@@ -145,6 +128,7 @@ export {
   composeIdentitySyncGroups,
   type Schema,
   type SchemaRecord,
+  BASE_FIELDS,
   type Model,
   type Row,
   type InferCreate,

package/src/schema/model.ts

@@ -29,11 +29,6 @@ import { getFieldMeta, inferFieldMetaFromZod, type FieldMeta } from './field.js'
 import { resolvePolicy, type Tenancy, type ScopedViaRef, type PolicyInput } from './tenancy.js';
 export type { ScopedViaRef, Tenancy, PolicyInput } from './tenancy.js';
 import { DEFAULT_RESIDENCY, type ModelResidency } from './residency.js';
-// The write-conflict disposition. It is plain data (the `onStale` vocabulary) so it
-// round-trips through schema serialization, and the engine interprets it when a
-// commit is applied.
-import type { ConflictAxis } from '../policy/types.js';
-export type { ConflictAxis } from '../policy/types.js';
 
 /** Normalize the `entityRoles` option (single | array | undefined) to an array. */
 function normalizeEntityRoles(
@@ -197,29 +192,6 @@ export interface ModelOptions {
    */
   groups?: GroupsInput;
 
-  /**
-   * Write-conflict disposition, set per committer kind — decides what happens when a
-   * commit collides with another participant's claim or with a stale snapshot of this
-   * model. This is independent of {@link policy} (read access) and {@link groups}
-   * (delta routing). It is a map keyed by the committer's kind (`user`, `agent`, or
-   * `system`), with these outcomes as values:
-   *
-   * - `'overwrite'` — the write wins; that committer is never blocked.
-   * - `'reject'`    — the write is refused; that committer yields.
-   * - `'notify'`    — hold the write and hand the current value back so the committer
-   *                   re-reads and re-applies (for stale writes only).
-   *
-   * A kind you omit falls back to the engine default: reject, while honoring
-   * `onStale: 'notify'`. The value is plain data that travels with the schema to the
-   * server, where the engine interprets it. For example:
-   *
-   * ```ts
-   * // "a human's edit always wins (never blocked); an agent yields"
-   * conflict: { user: 'overwrite', agent: 'reject' }
-   * ```
-   */
-  conflict?: ConflictAxis;
-
   /**
    * Whether clients may create, update, and delete this model's rows through the
    * commit protocol. Defaults to true: declaring a model in your schema is the
@@ -377,9 +349,6 @@ export interface ModelDef<
   readonly entityRoles?: readonly EntityRole[];
   /** Explicit acknowledgement that sync groups are routing, not row access. */
   readonly routingOnly?: true;
-  /** The write-conflict disposition per committer kind, carried as plain data. See
-   *  {@link ModelOptions.conflict}. */
-  readonly conflict?: ConflictAxis;
   /** Whether wire-level CREATE/UPDATE/DELETE is allowed. See {@link ModelOptions.mutable}. */
   readonly mutable?: boolean;
   /** Defer MobX setup until first observer access. See {@link ModelOptions.lazyObservable}. */
@@ -467,8 +436,6 @@ export function model<
     grants: options?.groups?.grants,
     entityRoles: normalizeEntityRoles(options?.groups?.roles),
     routingOnly: options?.groups?.routingOnly,
-    // The conflict disposition is already plain data, so it passes through unchanged.
-    conflict: options?.conflict,
     mutable: options?.mutable ?? true,
     lazyObservable: options?.lazyObservable,
     computed: options?.computed,

package/src/schema/openapi.ts

@@ -25,6 +25,7 @@ import type { FieldMeta } from './field.js';
 // Pulled from the endpoints module to keep this schema file free of the client's
 // error-handling and credential dependencies.
 import { ABLO_HOSTED_HTTP_BASE_URL } from '../auth/hostedEndpoints.js';
+import { docUrlForCode } from '../errors.js';
 // The commit body is DERIVED from the schema the server validates against —
 // one definition site, so the documented surface cannot drift from the
 // enforced one.
@@ -35,7 +36,7 @@ import {
   commitRecordSchema,
   commitRecordListSchema,
   commitRecordWhereSchema,
-} from '../wire/commit.js';
+} from '../commit/contract.js';
 import { CURSOR_PARAM, CURSOR_PARAM_ALIAS } from '../wire/listEnvelope.js';
 import {
   claimRequestSchema,
@@ -51,7 +52,7 @@ import {
   claimReorderRequestSchema,
   claimReorderReplySchema,
   claimReleaseReplySchema,
-} from '../wire/claims.js';
+} from '../claims/contract.js';
 import { errorEnvelopeSchema } from '../wire/errorEnvelope.js';
 // The lifecycle promise and the rate-limit fields are contract, not prose about
 // contract: the document renders the same constants the server emits, so the
@@ -69,8 +70,8 @@ import {
 } from '../wire/rateLimit.js';
 import { modelReadResponseSchema, modelListResponseSchema } from '../wire/modelResponses.js';
 import { modelMutationRequestSchema } from '../wire/modelMutations.js';
-import { logListResponseSchema, logQuerySchema } from '../wire/feedEvent.js';
-import { logDeliveryResponseSchema } from '../wire/deltaDelivery.js';
+import { logListResponseSchema, logQuerySchema } from '../observation/feedContract.js';
+import { logDeliveryResponseSchema } from '../observation/deliveryContract.js';
 import { schemaReadResponseSchema } from '../wire/accountResponses.js';
 import {
   ephemeralKeyRequestSchema,
@@ -530,6 +531,11 @@ function envelope(options: SchemaToOpenApiOptions, description: string, paths: J
         name: 'Apache License 2.0',
         identifier: 'Apache-2.0',
       },
+      contact: {
+        name: 'Ablo Support',
+        url: 'https://github.com/Abloatai/ablo/issues',
+        email: 'support@abloatai.com',
+      },
     },
     servers: [{ url: options.serverUrl ?? `${ABLO_HOSTED_HTTP_BASE_URL}/api` }],
     security: [{ bearerAuth: [] }],
@@ -555,6 +561,41 @@ const ERROR_RESPONSES: Readonly<Record<string, string>> = {
   '503': 'A required service is temporarily unavailable.',
 };
 
+/**
+ * One real instance of the error shape every operation shares.
+ *
+ * This lives beside the canonical error responses rather than on the schema:
+ * OpenAPI consumers select examples from an operation's media type, and an
+ * example buried on a component does not tell them which response carries it.
+ * Stamping the same representative validation failure on every operation also
+ * means a newly added route cannot regress the published example coverage.
+ */
+const ERROR_RESPONSE_EXAMPLE: Readonly<Json> = {
+  type: 'AbloValidationError',
+  code: 'invalid_request',
+  param: 'body',
+  message: 'The request did not satisfy the published contract.',
+  doc_url: docUrlForCode('invalid_request'),
+  request_id: 'req_52bb7f46-17bc-4f2d-9988-89d1398d2990',
+};
+
+function canonicalErrorResp(description: string): Json {
+  return {
+    description,
+    content: {
+      'application/json': {
+        schema: schemaRef('ErrorEnvelope'),
+        examples: {
+          validation: {
+            summary: 'Typed validation failure',
+            value: ERROR_RESPONSE_EXAMPLE,
+          },
+        },
+      },
+    },
+  };
+}
+
 /**
  * Every route passes failures through the same server error funnel. Publish
  * that fact on every operation so generated transports decode all HTTP errors
@@ -569,11 +610,10 @@ function attachCanonicalErrors(paths: Json): void {
       const operation = rawOperation as Json;
       const responses = { ...(operation.responses as Json | undefined) };
       for (const [status, description] of Object.entries(ERROR_RESPONSES)) {
-        responses[status] = namedResp(description, 'ErrorEnvelope');
+        responses[status] = canonicalErrorResp(description);
       }
-      responses.default = namedResp(
+      responses.default = canonicalErrorResp(
         'An HTTP error not otherwise listed; decoded through the canonical envelope.',
-        'ErrorEnvelope',
       );
       operation.responses = responses;
     }

package/src/schema/schema.ts

@@ -13,11 +13,11 @@
  *       status: z.enum(['todo', 'doing', 'done']).default('todo'),
  *       workspaceId: z.string().optional(),
  *     }, {
- *       workspace: relation.belongsTo('workspaces', 'workspaceId'),
+ *       relations: { workspace: relation.belongsTo('workspaces', 'workspaceId') },
  *     }),
  *   });
  *
- *   type Item = InferModel<typeof schema, 'items'>;
+ *   type Item = Model<typeof schema, 'items'>;
  */
 
 import { z } from 'zod';
@@ -231,6 +231,13 @@ export const baseFieldsSchema = z.object({
 /**
  * The universal model field names. Audit and application metadata is declared
  * by the application or carried by the commit record, never injected here.
+ *
+ * This is the runtime spelling of {@link baseFieldsSchema}, and the one every
+ * consumer outside this package derives from: the CLI's adopt rule, the MCP
+ * schema linter, and the docs that tell an author which names not to declare.
+ * It is exported from `@abloatai/transaction/schema` for exactly that reason —
+ * when this list last moved (0.52.0, five names down to one) three hand-written
+ * copies stayed behind and went on rejecting correct schemas for five releases.
  */
 export const BASE_FIELDS = [
   'id',
@@ -239,6 +246,18 @@ export const BASE_FIELDS = [
 /** The base fields type — pure data columns. */
 export type BaseModelFields = z.infer<typeof baseFieldsSchema>;
 
+// Invariant equality (no runtime, no casts): true only when both are mutually
+// assignable. `ExpectTrue`'s constraint is what turns a mismatch into an error
+// at THIS declaration, so the tuple and the schema cannot move apart — in
+// either direction, a name in one and not the other fails to compile.
+type BaseFieldsEqual<A, B> =
+  (<T>() => T extends A ? 1 : 2) extends <T>() => T extends B ? 1 : 2 ? true : false;
+type ExpectTrue<T extends true> = T;
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+type _BaseFieldsExact = ExpectTrue<
+  BaseFieldsEqual<(typeof BASE_FIELDS)[number], keyof BaseModelFields & string>
+>;
+
 /**
  * Methods every model instance carries. These are intersected into
  * {@link InferModel}, the read-side type, but not into the create or update
@@ -332,7 +351,8 @@ export interface Schema<S extends SchemaRecord = SchemaRecord> {
 
 /**
  * Infer the full model type from a schema.
- * Includes base fields (id, createdAt, updatedAt, etc.)
+ * Includes the base fields, which today means `id` alone: audit timestamps are
+ * ordinary declared fields and appear here only when the model declares them.
  *
  * ```ts
  * type Item = InferModel<typeof schema, 'items'>;

package/src/schema/serialize.ts

@@ -41,7 +41,6 @@ import type {
   LoadStrategy,
   PersistOptions,
   AutoFillRule,
-  ConflictAxis,
 } from './model.js';
 import {
   relation,
@@ -90,9 +89,6 @@ export interface ModelJSON {
   readonly grants?: GrantsRef;
   readonly entityRoles?: readonly EntityRole[];
   readonly routingOnly?: true;
-  /** The declared write-conflict disposition per committer kind. When absent,
-   *  the engine falls back to its default. */
-  readonly conflict?: ConflictAxis;
   readonly bootstrapLimit?: number;
   readonly bootstrapOrderBy?: string;
   readonly mutable?: boolean;
@@ -145,7 +141,6 @@ function modelToJSON(def: ModelDef): ModelJSON {
     grants: def.grants,
     entityRoles: def.entityRoles,
     routingOnly: def.routingOnly,
-    conflict: def.conflict,
     bootstrapLimit: def.bootstrapLimit,
     bootstrapOrderBy: def.bootstrapOrderBy,
     mutable: def.mutable,
@@ -285,9 +280,6 @@ function modelFromJSON(json: ModelJSON): ModelDef {
     grants: json.grants,
     entityRoles: json.entityRoles,
     routingOnly: json.routingOnly,
-    // Absent in older artifacts → undefined, so the commit path falls through to
-    // the function registry or the engine default.
-    conflict: json.conflict,
     mutable: json.mutable,
     lazyObservable: json.lazyObservable,
     // computed getters are closures and intentionally not serialized; a

package/src/server/adapter.ts

@@ -21,7 +21,7 @@ import type {
   SourceOperation,
   SourceRequestContext,
 } from '../source/index.js';
-import type { ServerSyncDelta } from '../wire/delta.js';
+import type { ServerSyncDelta } from '../observation/contract.js';
 import type { BootstrapModel } from './readConfig.js';
 import type { CommitContext, CommitExecutionResult } from './commit.js';
 import type { StorageMode } from './storageMode.js';

package/src/server/commit.ts

@@ -13,11 +13,11 @@
  * commit time and the shape of a stored or broadcast delta share one definition
  * rather than being kept in step by hand.
  */
-import type { ParticipantKind, ConfirmationState } from '../log/syncDeltaRow.js';
-import type { ParticipantRef } from '../wire/delta.js';
-import type { CommitExecutionResultInput } from '../wire/commit.js';
-import type { CommitOperationResult } from '../wire/commit.js';
-import type { ReadDependency, TrackDependency } from '../coordination/schema.js';
+import type { ParticipantKind, ConfirmationState } from '../observation/persistence/syncDeltaRow.js';
+import type { ParticipantRef } from '../observation/contract.js';
+import type { CommitExecutionResultInput } from '../commit/contract.js';
+import type { CommitOperationResult } from '../commit/contract.js';
+import type { ReadDependency } from '../coordination/schema.js';
 import type { EffectiveAuthority } from '../auth/capability.js';
 
 export interface CommitContext {
@@ -81,18 +81,10 @@ export interface CommitContext {
   /**
    * The premise for the whole batch. The committer declares the rows or groups
    * it read to form this batch; the engine checks that none of them changed since
-   * each entry's `readAt` timestamp and applies that entry's `onStale` disposition
-   * across the batch. This differs from the per-operation `readAt` guard, which
+   * each entry's `readAt` timestamp and rejects the batch if one moved. This differs from the per-operation `readAt` guard, which
    * validates only the rows being written. Omit it to check the write targets alone.
    */
   reads?: ReadDependency[] | null;
-  /**
-   * Durable premises to persist for this commit's participant. Each entry is
-   * kept in `track_dependencies` and re-checked against every future delta; a
-   * later match opens a `StaleNotification` delivered out of band. Distinct
-   * from `reads`, which is checked once here and discarded.
-   */
-  track?: TrackDependency[] | null;
 }
 
 /**

package/src/server/index.ts

@@ -26,7 +26,7 @@ export {
   commitExecutionResultSchema,
   commitRecordSchema,
   type CommitRecord,
-} from '../wire/commit.js';
+} from '../commit/contract.js';
 export { storageModeSchema, type StorageMode } from './storageMode.js';
 export type {
   ColumnOverride,