@abloatai/transaction 0.57.0 → 0.58.0

package/src/transport/{commitFrames.ts → websocket/commitFrames.ts}

@@ -7,18 +7,10 @@
 
 // The wire types for the outgoing commit frame. Importing them lets the
 // compiler enforce the frame shape, so the client and server can't drift apart.
-import type { CommitMessage, WireCommitOperation } from '../wire/index.js';
-import type { CommitAck as CanonicalCommitAck } from '../wire/commit.js';
-import type {
-  OnStaleMode,
-  StaleNotification,
-  ReadDependency,
-  TrackDependency,
-} from '../coordination/schema.js';
-import {
-  claimEventReasonSchema,
-  staleNotificationSchema,
-} from '../coordination/schema.js';
+import type { CommitMessage, WireCommitOperation } from '../../wire/index.js';
+import type { CommitAck as CanonicalCommitAck } from '../../commit/contract.js';
+import type { ReadDependency } from '../../coordination/schema.js';
+import { claimEventReasonSchema } from '../../coordination/schema.js';
 import type {
   ClaimAcquired,
   ClaimGranted,
@@ -26,20 +18,15 @@ import type {
   ClaimLost,
   ClaimRejection,
   ClaimExpired,
-} from '../coordination/schema.js';
-import type { ClaimEvent, ClaimCounterparty } from '../coordination/events.js';
-import type { AssertExact } from '../types/assertExact.js';
-import { formatClaim } from '../coordination/trace.js';
-import { modelTarget } from '../coordination/locator.js';
-import type { Logger } from '../logger.js';
-import type { SocketObservability } from '../observability.js';
+} from '../../coordination/schema.js';
+import type { ClaimEvent, ClaimCounterparty } from '../../claims/events.js';
+import type { AssertExact } from '../../types/assertExact.js';
+import { formatClaim } from '../../claims/trace.js';
+import { modelTarget } from '../../claims/locator.js';
+import type { Logger } from '../../logger.js';
+import type { SocketObservability } from '../../observability.js';
 
-/**
- * The value a commit acknowledgement resolves to. `notifications` is present
- * only when a guarded write (`onStale: 'notify'`) met a concurrent change; it
- * carries the advisory signal that lets the writer self-heal, and the same
- * signal also arrives on the `conflict:notified` event.
- */
+/** The value a commit acknowledgement resolves to. */
 export type CommitAck = CanonicalCommitAck;
 
 /**
@@ -55,7 +42,6 @@ export interface CommitFrameOperation {
   readonly transactionId?: string;
   readonly claimId?: string | null;
   readonly readAt?: number | null;
-  readonly onStale?: OnStaleMode | null;
   readonly fenceToken?: number | null;
 }
 
@@ -72,7 +58,6 @@ export function buildCommitFrame(
   operations: readonly CommitFrameOperation[],
   clientTxId: string,
   reads?: readonly ReadDependency[] | null,
-  track?: readonly TrackDependency[] | null,
 ): CommitMessage {
   const payload: CommitMessage['payload'] = {
     operations: operations.map((op) => ({
@@ -83,7 +68,6 @@ export function buildCommitFrame(
       transactionId: op.transactionId,
       claimId: op.claimId,
       readAt: op.readAt,
-      onStale: op.onStale,
       fenceToken: op.fenceToken,
     })),
     clientTxId,
@@ -92,25 +76,9 @@ export function buildCommitFrame(
   // and omission are distinct inputs even when today's server treats each as
   // "none"; the WebSocket path must not silently erase a field the caller set.
   if (reads !== undefined) payload.reads = reads === null ? null : [...reads];
-  if (track !== undefined) payload.track = track === null ? null : [...track];
   return { type: 'commit', payload };
 }
 
-/**
- * Defensively validate the optional `notifications` array off a commit ack.
- * Untrusted wire data — a malformed entry is dropped rather than throwing,
- * so a bad notification never sinks an otherwise-successful commit.
- */
-export function parseNotifications(raw: unknown): StaleNotification[] | undefined {
-  if (!Array.isArray(raw) || raw.length === 0) return undefined;
-  const out: StaleNotification[] = [];
-  for (const entry of raw) {
-    const parsed = staleNotificationSchema.safeParse(entry);
-    if (parsed.success) out.push(parsed.data);
-  }
-  return out.length > 0 ? out : undefined;
-}
-
 /** The reporting ports a claim trace writes through — supplied by the caller
  *  (the frame dispatch passes its session's own ports). */
 export interface ClaimTracePorts {
@@ -209,8 +177,8 @@ export function recordClaim<P extends keyof ClaimFrameByPhase>(
       : {}),
     ...('position' in frame ? { position: frame.position } : {}),
     ...(parsedReason?.success ? { reason: parsedReason.data } : {}),
-    ...('policyReason' in frame && frame.policyReason !== undefined
-      ? { policyReason: frame.policyReason }
+    ...('message' in frame && frame.message !== undefined
+      ? { message: frame.message }
       : {}),
     ...(Object.keys(counterparty).length > 0 ? { heldBy: counterparty } : {}),
   };

package/src/transport/{wsFrameHandlers.ts → websocket/frameHandlers.ts}

@@ -13,13 +13,13 @@ import {
   CapabilityError,
   errorFromWire,
   type RequiredCapability,
-} from '../errors.js';
+} from '../../errors.js';
 import {
   commitAckSchema,
   commitReceiptSchema,
   type CommitReceiptWire,
-} from '../wire/commit.js';
-import { subscriptionAckPayloadSchema } from '../coordination/schema.js';
+} from '../../commit/contract.js';
+import { subscriptionAckPayloadSchema } from '../../coordination/schema.js';
 import {
   WS_INBOUND_FRAMES,
   isKnownInboundFrame,
@@ -27,11 +27,11 @@ import {
   wsInboundEnvelopeSchema,
   type SchemaValidatedFrameType,
   type WsInboundEnvelope,
-} from '../wire/inboundFrames.js';
-import { formatConflict } from '../coordination/trace.js';
-import { parseNotifications, recordClaim, type CommitAck } from './commitFrames.js';
-import type { Logger } from '../logger.js';
-import type { SocketObservability } from '../observability.js';
+} from '../../wire/inboundFrames.js';
+import { formatConflict } from '../../claims/trace.js';
+import { recordClaim, type CommitAck } from './commitFrames.js';
+import type { Logger } from '../../logger.js';
+import type { SocketObservability } from '../../observability.js';
 
 /**
  * In-flight `commit` request record, keyed by clientTxId in the session.
@@ -139,11 +139,6 @@ export type WsFrameHandler = (session: WsSession, message: WsInboundFrame) => vo
 const handleMutationResult: WsFrameHandler = (session, message) => {
   const p = (message.payload ?? message) as Record<string, unknown>;
   const { clientTxId, success, error } = p;
-  // Defensive: validate notifications against the canonical schema —
-  // untrusted wire data from a possibly-older/newer server.
-  const notifications = parseNotifications(
-    (p as { notifications?: unknown } | undefined)?.notifications,
-  );
   const missingIds = Array.isArray(p.missingIds)
     ? [
         ...new Set(
@@ -164,7 +159,6 @@ const handleMutationResult: WsFrameHandler = (session, message) => {
   if (success) {
     const parsedReceipt = commitReceiptSchema.safeParse({
       ...p,
-      notifications,
       missingIds,
     });
     if (!parsedReceipt.success) {
@@ -177,35 +171,6 @@ const handleMutationResult: WsFrameHandler = (session, message) => {
       return;
     }
     const receipt = parsedReceipt.data;
-    // The write succeeded, but a guarded premise shifted underneath it.
-    // Emit the advisory signal so a caller can react, and still resolve
-    // the receipt, since the commit itself went through.
-    if (receipt.notifications && receipt.notifications.length > 0) {
-      const txId = receipt.clientTxId;
-      const event = {
-        clientTxId: txId,
-        rows: receipt.notifications.map((n) => ({
-          // The row that moved, in both scopes. A group notification used to
-          // report its group key here, so the log named a row that does not
-          // exist; the premise it breached is reported as `group` instead.
-          model: n.target.model,
-          id: n.target.id,
-          fields: n.target.fields ?? [],
-          writtenBy: n.writtenBy.kind,
-          ...(n.scope === 'group'
-            ? { group: n.group, ...(n.propagation ? { via: n.propagation.via } : {}) }
-            : {}),
-        })),
-      };
-      const message = formatConflict(event);
-      session.logger.warn(message);
-      session.observability.breadcrumb(message, 'sync.coordination', 'warning');
-      session.observability.captureConflict(event);
-      session.emit('conflict:notified', {
-        clientTxId: txId,
-        notifications: receipt.notifications,
-      });
-    }
     pending.resolve(
       pending.returnReceipt
         ? receipt
@@ -216,9 +181,6 @@ const handleMutationResult: WsFrameHandler = (session, message) => {
           : {}),
         statusAt: receipt.statusAt,
         lastSyncId: receipt.lastSyncId,
-        ...(receipt.notifications && receipt.notifications.length > 0
-          ? { notifications: receipt.notifications }
-          : {}),
         ...(receipt.missingIds && receipt.missingIds.length > 0
           ? { missingIds: receipt.missingIds }
           : {}),
@@ -279,17 +241,12 @@ const handleMutationResult: WsFrameHandler = (session, message) => {
     } else {
       errorMessage = 'mutation failed on server';
     }
-    // A stale-context rejection (the write read state that has since
-    // changed) or a foreign-claim conflict is a coordination collision.
-    // The success-with-notifications path above records the conflict, and a
-    // hard rejection must record it too, or the collision count would miss
-    // every rejected write. The conflicting rows ride along on the typed
-    // error's `conflicts` detail.
+    // Stale-context and foreign-claim rejections are coordination collisions.
+    // The conflicting rows ride on the typed error's `conflicts` detail.
     if (
       errorCode === 'stale_context' ||
       errorCode === 'claim_conflict' ||
-      errorCode === 'entity_claimed' ||
-      errorCode?.startsWith('policy:') === true
+      errorCode === 'entity_claimed'
     ) {
       const rawConflicts =
         error != null &&

package/src/transport/{heartbeat.ts → websocket/heartbeat.ts}

@@ -12,11 +12,11 @@
  * merely guarantees that something arrives even on an otherwise idle stream.
  */
 
-import { PING_INTERVAL_MS } from '../wire/protocol.js';
+import { PING_INTERVAL_MS } from '../../wire/protocol.js';
 import {
   noopSocketObservability,
   type TransportObservability,
-} from '../observability.js';
+} from '../../observability.js';
 
 /**
  * The interval between application-level pings, shared with both sides of the

package/src/transport/websocket/index.ts

@@ -0,0 +1,5 @@
+/** Stateful WebSocket transport boundary. */
+export * from './transport.js';
+export * from './frameHandlers.js';
+export * from './commitFrames.js';
+export * from './heartbeat.js';

package/src/transport/{wsTransport.ts → websocket/transport.ts}

@@ -19,20 +19,20 @@
  */
 
 import { EventEmitter } from 'events';
-import type { ParticipantKind } from '../types/participant.js';
+import type { ParticipantKind } from '../../types/participant.js';
 import {
   AbloConnectionError,
   AbloError,
   AbloSessionError,
   AbloValidationError,
   toAbloError,
-} from '../errors.js';
+} from '../../errors.js';
 import {
   participantClaimPayloadSchema,
   updateSubscriptionPayloadSchema,
-} from '../coordination/schema.js';
-import type { BootstrapReason } from '../wire/bootstrapReason.js';
-import type { ClientSyncDelta } from '../wire/delta.js';
+} from '../../coordination/schema.js';
+import type { BootstrapReason } from '../../wire/bootstrapReason.js';
+import type { ClientSyncDelta } from '../../observation/contract.js';
 import type {
   ClaimAcquired,
   PresenceUpdate,
@@ -44,19 +44,17 @@ import type {
   ClaimQueued,
   ClaimRejection,
   ParticipantClaimPayload,
-  StaleNotification,
   ReadDependency,
-  TrackDependency,
   WireClaim,
-} from '../coordination/schema.js';
-import { PROTOCOL_VERSION, WS_CLOSE_PROTOCOL_VERSION } from '../wire/protocolVersion.js';
+} from '../../coordination/schema.js';
+import { PROTOCOL_VERSION, WS_CLOSE_PROTOCOL_VERSION } from '../../wire/protocolVersion.js';
 import {
   WS_BEARER_SUBPROTOCOL_PREFIX,
   WS_SYNC_SUBPROTOCOL,
   type AuthTokenGetter,
-} from '../auth/credentialSource.js';
+} from '../../auth/credentialSource.js';
 import { buildCommitFrame, type CommitAck, type CommitFrameOperation } from './commitFrames.js';
-import type { CommitReceiptWire } from '../wire/commit.js';
+import type { CommitReceiptWire } from '../../commit/contract.js';
 import {
   dispatchWsFrame,
   readWsInboundFrame,
@@ -64,14 +62,14 @@ import {
   type PendingCommit,
   type PendingClaim,
   type PendingSubscription,
-} from './wsFrameHandlers.js';
+} from './frameHandlers.js';
 import { HeartbeatController } from './heartbeat.js';
-import { noopLogger, type Logger } from '../logger.js';
+import { noopLogger, type Logger } from '../../logger.js';
 import {
   noopSocketObservability,
   type SocketObservability,
-} from '../observability.js';
-import type { DeliveryPartitionRoute } from '../auth/deliveryPartition.js';
+} from '../../observability.js';
+import type { DeliveryPartitionRoute } from '../../auth/deliveryPartition.js';
 
 /**
  * Ceiling for the exponential reconnect backoff (`reconnectDelay * 2^n`,
@@ -254,15 +252,6 @@ export interface CoreSyncEventMap {
    * claim stream.
    */
   claim_heartbeat_ack: [ClaimHeartbeatAckPayload];
-  /**
-   * A committed write guarded with `onStale: 'notify'` collided with a
-   * concurrent change. Rather than forcing an outcome, the engine returns the
-   * conflicting field's current value so the actor — an agent reasoning over the
-   * change, or a person watching the row — can reconcile it. The commit itself
-   * succeeded; the held operations were not written, and the actor re-issues
-   * them once it has reconciled.
-   */
-  'conflict:notified': [{ clientTxId: string; notifications: StaleNotification[] }];
 }
 
 /**
@@ -1025,7 +1014,6 @@ export class WsTransport<
     clientTxId: string,
     timeoutMs = 15_000,
     reads?: readonly ReadDependency[] | null,
-    track?: readonly TrackDependency[] | null,
   ): Promise<CommitAck> {
     if (this.ws?.readyState !== WebSocket.OPEN) {
       return Promise.reject(this.notConnectedError('commit'));
@@ -1047,7 +1035,7 @@ export class WsTransport<
         timeout,
       });
       try {
-        const frame = buildCommitFrame(operations, clientTxId, reads, track);
+        const frame = buildCommitFrame(operations, clientTxId, reads);
         this.ws!.send(JSON.stringify(frame));
       } catch (error) {
         clearTimeout(timeout);
@@ -1063,7 +1051,6 @@ export class WsTransport<
     clientTxId: string,
     timeoutMs = 15_000,
     reads?: readonly ReadDependency[] | null,
-    track?: readonly TrackDependency[] | null,
   ): Promise<CommitReceiptWire> {
     if (this.ws?.readyState !== WebSocket.OPEN) {
       return Promise.reject(this.notConnectedError('commit'));
@@ -1083,7 +1070,7 @@ export class WsTransport<
         returnReceipt: true,
       });
       try {
-        const frame = buildCommitFrame(operations, clientTxId, reads, track);
+        const frame = buildCommitFrame(operations, clientTxId, reads);
         this.ws!.send(JSON.stringify(frame));
       } catch (error) {
         clearTimeout(timeout);
@@ -1105,12 +1092,11 @@ export class WsTransport<
     operations: readonly CommitFrameOperation[],
     clientTxId: string,
     reads?: readonly ReadDependency[] | null,
-    track?: readonly TrackDependency[] | null,
   ): void {
     if (this.ws?.readyState !== WebSocket.OPEN) {
       throw this.notConnectedError('commit');
     }
-    const frame = buildCommitFrame(operations, clientTxId, reads, track);
+    const frame = buildCommitFrame(operations, clientTxId, reads);
     this.ws.send(JSON.stringify(frame));
   }
 

package/src/types/index.ts

@@ -228,9 +228,8 @@ export interface PartialIndexInfo {
   path: string[];
 }
 
-// Re-export the stream, snapshot, and coordination types that make up the
-// engine's public surface (PresenceStream, ClaimStream, Snapshot, and the
-// rest), reached through `Ablo({...}).presence`, `.claims`, and `.snapshot()`.
+// Re-export the stream and coordination types that make up the engine's public
+// surface, reached through `Ablo({...}).presence` and `.claims`.
 //
 // The list is written out by name rather than `export *` so that adding a
 // symbol here is always a deliberate decision, and new types don't become
@@ -238,7 +237,6 @@ export interface PartialIndexInfo {
 export type {
   // Coordination wire shapes, defined in `../coordination/schema` and
   // re-exported through streams.ts.
-  OnStaleMode,
   WireClaim,
   ClaimRejection,
   PresenceKind,
@@ -250,8 +248,6 @@ export type {
   ConfirmationState,
   Delta,
   AgentDelta,
-  Snapshot,
-  ContextChange,
   ClaimTarget,
   PresenceTarget,
   PresenceStream,

package/src/types/streams.ts

@@ -3,14 +3,12 @@
  *
  * Ablo treats people and AI agents alike as participants working on live
  * application entities. A participant announces what it is reading or editing,
- * claims an entity before writing to it, and captures a context snapshot before
- * starting long-running AI work. You keep your own schema, agent stack, tools,
+ * claims an entity before writing to it, and carries exact reads into later
+ * writes. You keep your own schema, agent stack, tools,
  * prompts, and product rules; this package provides the shared coordination
  * layer underneath.
  */
 
-import type { InferModel, Schema } from '../schema/schema.js';
-
 // The shape of a claim's application metadata is declared once, on `Register`.
 // This module reads it back rather than restating it, so the default of every
 // `M` parameter below is the one the program declared.
@@ -20,7 +18,6 @@ import type { ResolveClaimMeta } from './global.js';
 // They are imported here so the rest of this file can reference them, and
 // re-exported so consumers can keep importing them from this module.
 import type {
-  OnStaleMode,
   WireClaim,
   ClaimRejection,
   ClaimLost,
@@ -30,7 +27,6 @@ import type {
   PresenceUpdatePayload,
 } from '../coordination/schema.js';
 export type {
-  OnStaleMode,
   WireClaim,
   ClaimRejection,
   ClaimLost,
@@ -60,9 +56,9 @@ import type { ParticipantRef } from './participant.js';
 export type { ParticipantRef } from './participant.js';
 
 // The delta and approval-stage vocabulary are declared once in
-// `wire/delta.ts`; this module re-serves them for source compatibility.
-import type { Delta } from '../wire/delta.js';
-export type { ConfirmationState, Delta } from '../wire/delta.js';
+// `observation/contract.ts`; this module re-serves them for source compatibility.
+import type { Delta } from '../observation/contract.js';
+export type { ConfirmationState, Delta } from '../observation/contract.js';
 
 /**
  * @deprecated Renamed to {@link Delta} — the authoritative change feed serves
@@ -71,56 +67,6 @@ export type { ConfirmationState, Delta } from '../wire/delta.js';
  */
 export type AgentDelta = Delta;
 
-// ─────────────────────────────────────────────────────────────────────
-//  Snapshots — context watermarks for long-running work
-// ─────────────────────────────────────────────────────────────────────
-
-/**
- * A flat, point-in-time view of application data returned by
- * `participant.snapshot(...)`. Capture it before long-running AI work, then
- * detect whether the data changed underneath while that work ran.
- *
- *   - Per-model buckets: `snap.<modelName>[id]` returns the entity, typed from
- *     your schema (via `InferModel`) rather than as `unknown` — so, for
- *     example, `snap.clauses[clauseId].text` is a `string`.
- *   - `stamp` — an opaque version marker. Thread it into writes as
- *     `{ readAt: snap.stamp }` so the server can reject a write made against
- *     stale data.
- *   - `signal` — an `AbortSignal` that fires if any captured entity receives a
- *     change during the window. Pass it into your LLM call so a mid-generation
- *     change aborts the token stream instead of completing against a snapshot
- *     that is no longer current.
- *   - `onChange(fn)` — a callback alternative to `signal` for cases that don't
- *     abort, such as logging, UI flags, or partial regeneration. Returns an
- *     unsubscribe function.
- *
- * The per-model buckets share the object with `stamp`, `signal`, and
- * `onChange`, so naming a model `stamp`, `signal`, or `onChange` collides.
- * Snapshot creation throws a clear error in that case.
- */
-export type Snapshot<
-  TSchema extends Schema = Schema,
-  ModelName extends keyof TSchema['models'] = keyof TSchema['models'],
-> = {
-  readonly stamp: number;
-  readonly signal: AbortSignal;
-  onChange(listener: (change: ContextChange) => void): () => void;
-} & {
-  readonly [M in ModelName]: Readonly<Record<string, InferModel<TSchema, M>>>;
-};
-
-export interface ContextChange {
-  readonly model: string;
-  readonly id: string;
-  readonly severity: 'semantic' | 'metadata';
-}
-
-/**
- * The staleness mode for a write that follows a snapshot. When `readAt` is
- * provided without an `onStale` mode, it defaults to `'reject'`.
- */
-// `OnStaleMode` is defined in `../coordination/schema` and re-exported above.
-
 // ─────────────────────────────────────────────────────────────────────
 //  Coordination primitives — a live stream, not polling
 // ─────────────────────────────────────────────────────────────────────
@@ -484,8 +430,8 @@ export interface ClaimStream {
   /**
    * Observe losing a claim you held — distinct from `onRejected`, which is a
    * claim the server refused to grant. Fires when the server reports the loss,
-   * carrying why: `'preempted'` (a privileged participant evicted you) or
-   * `'expired'` (your lease lapsed). This lets a holder react — re-plan or
+   * carrying why: `'preempted'` (the fairness ceiling advanced a queued waiter)
+   * or `'expired'` (your lease lapsed). This lets a holder react — re-plan or
    * re-claim — rather than discovering the lease gone through presence.
    *
    * ```ts

package/src/webhooks/events.ts

@@ -11,7 +11,7 @@
  * skip a change it has already processed, and to apply changes in the order they
  * were committed.
  */
-import type { SyncDeltaAction } from '@abloatai/transaction/wire/delta';
+import type { SyncDeltaAction } from '../observation/contract.js';
 
 /**
  * Maps each delta action code to the verb that appears in an event type. Only

package/src/wire/accountResponses.ts

@@ -19,12 +19,11 @@ import { listEnvelopeSchema } from './listEnvelope.js';
 // hand-written mirror here would be a second copy of the exact record this
 // response exists to stop withholding.
 import { fieldMetaSchema, relationMetaSchema } from './modelShape.js';
-import { onStaleModeSchema } from '../coordination/schema.js';
 // The price's own vocabulary. A dashboard that restated the tier names or the
 // meter set would be a second definition of what the invoice is computed from.
 import { meterEventSchema, planTierSchema, rateBracketSchema } from './pricing.js';
-import type { SyncDeltaAction } from './delta.js';
-import { deltaSchema } from './delta.js';
+import type { SyncDeltaAction } from '../observation/contract.js';
+import { deltaSchema } from '../observation/contract.js';
 // Kept for the {@link ListEnvelope} references below; `GET /v1/logs`'s own
 // envelope moved to `feedEvent.ts`, which owns the union it wraps.
 import type { ListEnvelope } from './listEnvelope.js';
@@ -85,22 +84,14 @@ export type ProvisionKeyResponse = z.infer<typeof provisionKeyResponseSchema>;
  * three members as a TypeScript interface: `wire/` holds runtime-validatable
  * schemas, and it is the protocol leaf — everything depends on it and it depends
  * on nothing. The check that the two never drift therefore lives on the policy
- * side of that edge, next to the interface, in `../policy/types.ts`.
+ * side of that edge, next to the interface, in `../claims/policy.ts`.
  */
-export const conflictAxisWireSchema = z.object({
-  user: onStaleModeSchema.optional(),
-  agent: onStaleModeSchema.optional(),
-  system: onStaleModeSchema.optional(),
-});
-
 /** One model in the deployed schema, as the schema read reports it. */
 export const schemaModelResponseSchema = z.object({
   /** The key local code addresses (`ablo.records`). */
   key: z.string(),
   /** The wire typename the engine routes and gates on. */
   typename: z.string(),
-  /** Declared disposition, or null for the engine default. */
-  conflict: conflictAxisWireSchema.nullable(),
   /**
    * Per-model content hash — the unit of the client's drift check, and the
    * revalidation key for everything below it.

package/src/wire/frames.ts

@@ -15,12 +15,9 @@ import { z } from 'zod';
 // schema module to keep this file's runtime dependencies limited to Zod.
 import {
   commitOperationSchema as coordinationCommitOperationSchema,
-  MAX_READ_SET_ENTRIES,
   readDependencyListSchema,
-  readSetProjectionEntryCount,
-  trackDependencyListSchema,
 } from '../coordination/schema.js';
-import type { MutationResultMessageWire } from './commit.js';
+import type { MutationResultMessageWire } from '../commit/contract.js';
 
 // ── Client → Server ────────────────────────────────────────────────────────
 
@@ -31,13 +28,10 @@ import type { MutationResultMessageWire } from './commit.js';
  * Both commit transports — the WebSocket `commit` frame and the HTTP
  * `/v1/commits` endpoint — run this check
  * on every operation before it is applied, so a malformed operation is rejected
- * at the edge. It builds on the shared coordination schema, widening `bypass`
- * to also accept `null`. The TypeScript type is inferred from this schema so
- * the runtime and compile-time contracts have one definition site.
+ * at the edge. The TypeScript type is inferred from the shared coordination
+ * schema so runtime and compile-time contracts have one definition site.
  */
-export const wireCommitOperationSchema = coordinationCommitOperationSchema.extend({
-  bypass: z.boolean().nullish(),
-});
+export const wireCommitOperationSchema = coordinationCommitOperationSchema;
 export type WireCommitOperation = z.infer<typeof wireCommitOperationSchema>;
 
 /**
@@ -59,10 +53,6 @@ export const commitPayloadSchema = z.object({
   operations: z.array(wireCommitOperationSchema),
   clientTxId: z.string(),
   reads: readDependencyListSchema.nullish(),
-  track: trackDependencyListSchema.nullish(),
-}).refine((value) => readSetProjectionEntryCount(value) <= MAX_READ_SET_ENTRIES, {
-  path: ['reads'],
-  message: `reads and track may contain at most ${MAX_READ_SET_ENTRIES} entries combined`,
 });
 
 /** A client-to-server frame that asks the server to commit a batch atomically. */
@@ -76,7 +66,7 @@ export type CommitMessage = z.infer<typeof commitMessageSchema>;
 
 /**
  * The server's acknowledgement of a {@link CommitMessage}. Runtime shape and
- * TypeScript type are both owned by `wire/commit.ts`; HTTP, WebSocket, and
+ * TypeScript type are both owned by `commit/contract.ts`; HTTP, WebSocket, and
  * cached replay no longer maintain parallel receipt declarations.
  */
 export type MutationResultMessage = MutationResultMessageWire;

package/src/wire/inboundFrames.ts

@@ -24,8 +24,8 @@
  */
 
 import { z } from 'zod';
-import { commitReceiptSchema } from './commit.js';
-import { clientSyncDeltaSchema } from './delta.js';
+import { commitReceiptSchema } from '../commit/contract.js';
+import { clientSyncDeltaSchema } from '../observation/contract.js';
 import {
   claimAcquiredSchema,
   claimExpiredSchema,
@@ -106,7 +106,7 @@ export const WS_INBOUND_FRAMES = {
   // ── Commit ─────────────────────────────────────────────────────────────
   mutation_result: {
     validation: 'handler',
-    where: 'handleMutationResult — it lifts the frame\'s notifications and missingIds alongside the payload before this can parse',
+    where: 'handleMutationResult — it validates missingIds alongside the payload before this can parse',
     checkedBy: commitReceiptSchema,
   },